BleepingComputer.com: Windows will not boot. After fake av.

A few days ago I had a fake av on my pc and eset caught it, but didn't seem to catch it all as it was redirecting google searches. I booted into safemode and ran an eset scan and malwarebytes scan. They both caught some other files, but still didn't remove it.

Come to today my pc froze and so I had to do a hard reboot. Now when I reboot I get this error " stop: c0000135 the program can't start because %hs is missing from your computer. try reinstalling the program to fix this problem."

I tried to run the automatic repair and it didn't work, I tried chkdsk /f /r, and sfc /scannow. I can't get into safemode or normal Windows. Anyone have some ideas on how to fix it without reinstalling Windows? Thank you for your help!

This post has been edited by Orange Blossom: 12 November 2011 - 11:59 AM
Reason for edit: Moved to log forum. ~ OB

Which operating system is installed? How many hard drives are installed in the computer?

Sorry it has Windows 7 Pro x64 and has 2 hard drives.

Remove the hard drive that does not contain the Operating System. You can always connect it once we have identified the issue.

For x32 (x86) bit systems download Farbar Recovery Scan Tool and save it to a flash drive.
For x64 bit systems download Farbar Recovery Scan Tool x64 and save it to a flash drive.

Plug the flashdrive into the infected PC.

Enter System Recovery Options.

To enter System Recovery Options from the Advanced Boot Options:

• Restart the computer.
  
• As soon as the BIOS is loaded begin tapping the F8 key until Advanced Boot Options appears.
  
• Click on Repair your computer menu item.
  
• Select US as the keyboard language settings, and then click Next.
  
• Select the operating system you want to repair, and then click Next.
  
• Select your user account and click Next.

On the System Recovery Options menu you will get the following options:

• Select Command Prompt
  
• In the command window type in notepad and press Enter.
  
• The notepad opens. Under File menu select Open.
  
• Select "Computer" and find your flash drive letter and close the notepad.
  
• In the command window type e:\frst.exe (for x64 bit version type e:\frst64) and press Enter
  Note: Replace letter e with the drive letter of your flash drive.
  
• The tool will start to run.
  
• When the tool opens click Yes to disclaimer.
  
• Press Scan button.
  
• It will make a log (FRST.txt) in the flash drive. Please copy and paste it to your reply.

Thanks for the reply here are my findings:

Scan result of Farbars's Recovery Tool (FRST written by farbar) Version 2.2.7
Ran by SYSTEM at 2011-11-12 12:44:09
Running from H:\
Windows 7 Ultimate (X64) OS Language: English(US)
The current controlset is ControlSet001

========================== Registry (Whitelisted) =============

HKLM\...\Run: [LogMeIn GUI] "C:\Program Files (x86)\LogMeIn\x64\LogMeInSystray.exe" [57928 2008-08-11] (LogMeIn, Inc.)
HKLM\...\Run: [egui] "C:\Program Files\ESET\ESET Smart Security\egui.exe" /hide /waitservice [3382680 2011-04-20] (ESET)
HKLM-x32\...\Run: [{0228e555-4f9c-4e35-a3ec-b109a192b4c2}] C:\Program Files (x86)\Google\Gmail Notifier\gnotify.exe [479232 2005-07-15] (Google Inc.)
HKLM-x32\...\Run: [] [x]
HKU\Mcx1-QUITTANCE\...\Winlogon: [Shell] C:\Windows\eHome\McrMgr.exe [343552 2009-07-13] (Microsoft Corporation)
HKU\Scooter Toy Park\...\Run: [msnmsgr] "C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe" /background [4283256 2011-05-13] (Microsoft Corporation)
HKU\Scooter Toy Park\...\Run: [AdobeBridge] [x]
HKU\Scooter Toy Park\...\Policies\system: [DisableTaskMgr] 0
HKU\Scooter Toy Park\...\Policies\system: [DisableRegistryTools] 0
HKLM\...\RunOnce: [*Restore] C:\Windows\system32\rstrui.exe /RUNONCE [296960 2010-11-20] (Microsoft Corporation)
Tcpip\Parameters: [DhcpNameServer] 97.64.183.164 97.64.209.37
SubSystems: [Windows] ==> ZeroAccess

==================== Services (Whitelisted) ======

2 Dyyno Launcher; C:\Program Files (x86)\Dyyno\Dyyno Broadcaster\launcherd.exe [415072 2011-05-18] ()
2 ekrn; "C:\Program Files\ESET\ESET Smart Security\x86\ekrn.exe" [958464 2011-04-20] (ESET)
3 ESHASRV; "C:\Program Files\ESET\ESET Smart Security\EShaSrv.exe" [184512 2011-04-20] (ESET)
3 FLEXnet Licensing Service; "C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe" [651720 2010-05-13] (Macrovision Europe Ltd.)
2 Intel® PROSet Monitoring Service; C:\Windows\system32\IProsetMonitor.exe [133800 2010-08-12] (Intel Corporation)
2 IntuitUpdateService; "C:\Program Files (x86)\Common Files\Intuit\Update Service\IntuitUpdateService.exe" [13088 2008-10-10] (Intuit Inc.)
2 LMIGuardianSvc; "C:\Program Files (x86)\LogMeIn\x64\LMIGuardianSvc.exe" [375176 2011-10-07] (LogMeIn, Inc.)
2 LMIMaint; "C:\Program Files (x86)\LogMeIn\x64\RaMaint.exe" [147336 2011-10-07] (LogMeIn, Inc.)
2 LogMeIn; "C:\Program Files (x86)\LogMeIn\x64\LogMeIn.exe" [407424 2010-11-08] (LogMeIn, Inc.)
3 MatSvc; "C:\Program Files\Microsoft Fix it Center\Matsvc.exe" [343856 2011-06-13] (Microsoft Corporation)
2 MBAMService; "C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe" [366152 2011-08-31] (Malwarebytes Corporation)
3 OpenVPNService; "C:\Program Files (x86)\OpenVPN\bin\openvpnserv.exe" [14848 2011-04-26] ()
4 TlntSvr; C:\Windows\System32\tlntsvr.exe [81920 2009-07-13] (Microsoft Corporation)
2 VMAuthdService; "C:\Program Files (x86)\VMware\VMware Workstation\vmware-authd.exe" [79872 2011-08-22] (VMware, Inc.)
2 VMUSBArbService; "C:\Program Files (x86)\Common Files\VMware\USB\vmware-usbarbitrator64.exe" [846448 2011-08-21] (VMware, Inc.)
2 VMwareHostd; "C:\Program Files (x86)\VMware\VMware Workstation\vmware-hostd.exe" -u "C:\ProgramData\VMware\hostd\config.xml" [31995 2011-09-19] ()
2 Akamai; c:\program files (x86)\common files\akamai\netsession_win_e477fed.dll [x]
2 KMService; C:\Windows\system32\srvany.exe [x]
3 rpcapd; "%ProgramFiles(x86)%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles(x86)%\WinPcap\rpcapd.ini" [x]
2 VMnetDHCP; C:\Windows\system32\vmnetdhcp.exe [x]
2 VMware NAT Service; C:\Windows\system32\vmnat.exe [x]

========================== Drivers (Whitelisted) =============

2 eamonm; C:\Windows\System32\DRIVERS\eamonm.sys [199992 2011-04-27] (ESET)
1 ehdrv; C:\Windows\System32\DRIVERS\ehdrv.sys [146432 2011-04-20] (ESET)
2 epfw; C:\Windows\System32\DRIVERS\epfw.sys [182976 2011-04-20] (ESET)
1 EpfwLWF; C:\Windows\System32\DRIVERS\EpfwLWF.sys [34704 2011-04-20] (ESET)
3 Epfwndis; C:\Windows\System32\DRIVERS\Epfwndis.sys [33632 2010-07-29] (ESET)
0 epfwwfp; C:\Windows\System32\DRIVERS\epfwwfp.sys [56304 2011-04-20] (ESET)
2 hcmon; \??\C:\Windows\system32\drivers\hcmon.sys [39024 2011-08-21] (VMware, Inc.)
3 HTCAND64; C:\Windows\System32\Drivers\ANDROIDUSB.sys [31744 2009-02-02] (HTC1124 Inc)
0 JRAID; C:\Windows\System32\DRIVERS\jraid.sys [109480 2009-07-18] (JMicron Technology Corp.)
2 LMIInfo; \??\C:\Program Files (x86)\LogMeIn\x64\RaInfo.sys [15928 2008-08-11] (LogMeIn, Inc.)
3 lmimirr; C:\Windows\System32\DRIVERS\lmimirr.sys [11552 2008-08-11] (LogMeIn, Inc.)
2 LMIRfsDriver; \??\C:\Windows\system32\drivers\LMIRfsDriver.sys [72216 2008-08-11] (LogMeIn, Inc.)
3 mcdbus; C:\Windows\System32\DRIVERS\mcdbus.sys [255552 2009-02-24] (MagicISO, Inc.)
3 NAL; \??\C:\Windows\system32\Drivers\iqvw64e.sys [32936 2010-09-17] (Intel Corporation )
3 netr28ux; C:\Windows\System32\DRIVERS\netr28ux.sys [867328 2009-06-10] (Ralink Technology Corp.)
2 NPF; C:\Windows\System32\drivers\npf.sys [35344 2010-06-25] (CACE Technologies, Inc.)
3 pbfilter; \??\C:\Users\Scooter Toy Park\Desktop\Peer Block\pbfilter.sys [19544 2009-09-27] ()
3 pneteth; C:\Windows\System32\DRIVERS\pneteth.sys [15360 2010-09-02] (June Fabrics Technology Inc.)
3 PORTIO; \??\C:\Downloads\xbox\DosFlash32\portio64.sys [4608 2011-09-03] ()
3 RTL8192cu; C:\Windows\System32\DRIVERS\RTL8192cu.sys [742432 2010-06-29] (Realtek Semiconductor Corporation )
3 RTL8192su; C:\Windows\System32\DRIVERS\RTL8192su.sys [695400 2010-09-29] (Realtek Semiconductor Corporation )
3 StillCam; C:\Windows\System32\DRIVERS\serscan.sys [12288 2009-07-13] (Microsoft Corporation)
3 tap0901; C:\Windows\System32\DRIVERS\tap0901.sys [31232 2011-04-26] (The OpenVPN Project)
3 taphss; C:\Windows\System32\DRIVERS\taphss.sys [37888 2011-05-24] (AnchorFree Inc)
3 tapoas; C:\Windows\System32\DRIVERS\tapoas.sys [30720 2011-03-23] (The OpenVPN Project)
3 TVICHW64; \??\C:\Windows\SysWOW64\Drivers\TVICHW64.SYS [21200 2007-03-12] (EnTech Taiwan)
3 USB_RNDIS_NTamd64; C:\Windows\System32\DRIVERS\usb8023.sys [19968 2009-07-13] (Microsoft Corporation)
3 VMnetAdapter; C:\Windows\System32\DRIVERS\vmnetadapter.sys [20080 2011-08-22] (VMware, Inc.)
2 VMnetBridge; C:\Windows\System32\DRIVERS\vmnetbridge.sys [45680 2011-08-22] (VMware, Inc.)
2 VMnetuserif; \??\C:\Windows\system32\drivers\vmnetuserif.sys [30320 2011-08-22] (VMware, Inc.)
2 vmx86; \??\C:\Windows\system32\drivers\vmx86.sys [62064 2011-08-22] (VMware, Inc.)
2 vstor2-mntapi10-shared; C:\Windows\SysWow64\drivers\vstor2-mntapi10-shared.sys [33392 2011-07-08] (VMware, Inc.)
3 ALSysIO; \??\C:\Users\SCOOTE~1\AppData\Local\Temp\ALSysIO64.sys [x]
2 ccEvtMgr; [x]
2 ccSetMgr; [x]
3 CEDRIVER55; \??\C:\Downloads\Program Files\Cheat Engine\dbk64.sys [x]
4 LMIRfsClientNP; [x]
3 MBAMProtector; \??\C:\Windows\system32\drivers\mbam.sys [x]
3 navapsvc; [x]
2 NVR0FLASHDev; \??\C:\Windows\nvflsh64.sys [x]
1 SASDIFSV; \??\C:\Users\SCOOTE~1\AppData\Local\Temp\SAS_SelfExtract\SASDIFSV.SYS [x]
3 SASENUM; \??\C:\Users\SCOOTE~1\AppData\Local\Temp\SAS_SelfExtract\SASENUM.SYS [x]
1 SASKUTIL; \??\C:\Users\SCOOTE~1\AppData\Local\Temp\SAS_SelfExtract\SASKUTIL.sys [x]
3 SAVRT; [x]
1 SAVRTPEL; [x]
3 Synth3dVsc; C:\Windows\System32\drivers\synth3dvsc.sys [x]
3 tsusbhub; C:\Windows\System32\drivers\tsusbhub.sys [x]
3 TVICHW32; \??\C:\Windows\system32\DRIVERS\TVICHW32.SYS [x]
3 VGPU; C:\Windows\System32\drivers\rdvgkmd.sys [x]

========================== NetSvcs (Whitelisted) ===========

============ One Month Created Files and Folders ==============

2011-11-12 12:43 - 2011-11-12 12:44 - 0000000 ____D C:\FRST
2011-11-11 08:25 - 2011-11-11 08:26 - 12688962 ____A C:\Users\Scooter Toy Park\Desktop\Latest_iXtreme_and_Stock_Firmware_Pack.rar
2011-11-11 01:42 - 2011-11-11 01:43 - 0000000 ____D C:\Users\Scooter Toy Park\AppData\Local\{E47FAFD1-BC2A-43CE-9768-AD944BD396A6}
2011-11-11 01:42 - 2011-11-11 01:42 - 0000000 ____D C:\Users\Scooter Toy Park\AppData\Local\{640D4A38-F41B-4487-AF01-0404196E4097}
2011-11-10 13:42 - 2011-11-10 13:42 - 0000000 ____D C:\Users\Scooter Toy Park\AppData\Local\{4B773A1E-9371-4B8B-BF6B-3728E3089495}
2011-11-10 13:41 - 2011-11-10 13:42 - 0000000 ____D C:\Users\Scooter Toy Park\AppData\Local\{2E068569-F19B-475B-8398-1D9EDF802F72}
2011-11-10 01:41 - 2011-11-10 01:41 - 0000000 ____D C:\Users\Scooter Toy Park\AppData\Local\{F554B3AD-C981-4C6E-89D5-CF53166C467C}
2011-11-10 01:41 - 2011-11-10 01:41 - 0000000 ____D C:\Users\Scooter Toy Park\AppData\Local\{66A211AB-C520-4824-B923-58D7BE1B27F9}
2011-11-09 15:23 - 2011-11-09 15:23 - 0000000 ____D C:\Users\Scooter Toy Park\AppData\Local\Bossland GmbH
2011-11-09 13:46 - 2011-11-09 13:46 - 0000000 ____D C:\Users\Scooter Toy Park\AppData\Local\Adobe
2011-11-09 13:40 - 2011-11-09 13:41 - 0000000 ____D C:\Users\Scooter Toy Park\AppData\Local\{58EBA5DC-9F8F-462D-978D-89675E4D737E}
2011-11-09 13:40 - 2011-11-09 13:40 - 0000000 ____D C:\Users\Scooter Toy Park\AppData\Local\{D0FE3B02-0D0E-4070-BEEB-0106038FC8E7}
2011-11-09 13:36 - 2011-11-09 13:36 - 0293816 ____A C:\Windows\Minidump\110911-37331-01.dmp
2011-11-08 20:09 - 2011-11-08 20:09 - 0000000 ____D C:\Users\Scooter Toy Park\AppData\Local\Google
2011-11-08 20:08 - 2011-11-08 20:08 - 0000000 ____D C:\Users\Scooter Toy Park\AppData\Local\ESET
2011-11-08 18:20 - 2011-11-08 18:20 - 0000000 __SHD C:\Windows\System32\%APPDATA%
2011-11-08 18:16 - 2011-11-08 22:35 - 0000000 __SHD C:\Users\Scooter Toy Park\AppData\Local\ed92321b
2011-11-08 17:50 - 2011-11-11 08:44 - 0355856 ____A C:\Windows\ntbtlog.txt
2011-11-08 17:46 - 2011-11-08 17:46 - 0000000 ____D C:\Users\Scooter Toy Park\AppData\Local\Apps\2.0
2011-11-05 08:10 - 2011-11-05 08:10 - 0036192 ____A C:\Users\Scooter Toy Park\Desktop\info2.pdf
2011-11-05 08:09 - 2011-11-05 08:09 - 0026074 ____A C:\Users\Scooter Toy Park\Desktop\info.pdf
2011-11-05 08:06 - 2011-11-05 08:06 - 0024350 ____A C:\Users\Scooter Toy Park\Desktop\employment.pdf
2011-10-22 11:06 - 2011-10-22 11:06 - 0000000 ____D C:\Program Files\TortoiseSVN
2011-10-22 11:06 - 2011-10-22 11:06 - 0000000 ____D C:\Program Files\Common Files\TortoiseOverlays
2011-10-19 17:56 - 2011-10-19 17:56 - 0000000 ____D C:\Users\Scooter Toy Park\AppData\Roaming\PlayFirst
2011-10-19 17:56 - 2011-10-19 17:56 - 0000000 ____D C:\Users\All Users\PlayFirst
2011-10-19 17:56 - 2011-10-19 17:56 - 0000000 ____D C:\ProgramData\PlayFirst
2011-10-19 17:42 - 2011-10-19 17:56 - 0000000 ____D C:\Users\Scooter Toy Park\AppData\Roaming\RockHero
2011-10-19 17:39 - 2011-10-19 17:39 - 0002028 ____A C:\Users\Scooter Toy Park\Desktop\Epic Slot - Rock Hero.lnk
2011-10-19 17:39 - 2011-10-19 17:39 - 0000000 ____D C:\Program Files (x86)\Epic Slot - Rock Hero
2011-10-14 22:14 - 2011-10-15 07:29 - 0000000 ____D C:\Users\Scooter Toy Park\Desktop\The Meaning Of I


============ 3 Months Modified Files and Folders =============

2011-11-12 12:44 - 2011-11-12 12:43 - 0000000 ____D C:\FRST
2011-11-11 14:56 - 2010-03-11 00:25 - 2945798144 __ASH C:\hiberfil.sys
2011-11-11 08:44 - 2011-11-08 17:50 - 0355856 ____A C:\Windows\ntbtlog.txt
2011-11-11 08:38 - 2010-03-10 22:48 - 1467416 ____A C:\Windows\WindowsUpdate.log
2011-11-11 08:37 - 2011-05-25 15:22 - 0000000 ____D C:\Users\Scooter Toy Park\AppData\Local\TSVNCache
2011-11-11 08:37 - 2009-07-13 21:13 - 0789882 ____A C:\Windows\System32\PerfStringBackup.INI
2011-11-11 08:37 - 2009-07-13 20:45 - 0014016 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2011-11-11 08:37 - 2009-07-13 20:45 - 0014016 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2011-11-11 08:32 - 2011-08-28 09:41 - 0000616 ____A C:\Windows\setupact.log
2011-11-11 08:32 - 2010-05-08 21:23 - 0000000 ____D C:\Users\All Users\VMware
2011-11-11 08:32 - 2010-05-08 21:23 - 0000000 ____D C:\ProgramData\VMware
2011-11-11 08:32 - 2010-03-15 10:00 - 0000914 ____A C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2011-11-11 08:32 - 2009-07-13 21:08 - 0000006 ___AH C:\Windows\Tasks\SA.DAT
2011-11-11 08:26 - 2011-11-11 08:25 - 12688962 ____A C:\Users\Scooter Toy Park\Desktop\Latest_iXtreme_and_Stock_Firmware_Pack.rar
2011-11-11 08:24 - 2010-03-22 09:34 - 0000952 ____A C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-400140772-108668955-1500843441-1001UA.job
2011-11-11 08:20 - 2009-07-13 18:34 - 0000860 ____A C:\Windows\System32\Drivers\etc\hosts
2011-11-11 07:55 - 2010-03-15 10:00 - 0000918 ____A C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2011-11-11 01:43 - 2011-11-11 01:42 - 0000000 ____D C:\Users\Scooter Toy Park\AppData\Local\{E47FAFD1-BC2A-43CE-9768-AD944BD396A6}
2011-11-11 01:42 - 2011-11-11 01:42 - 0000000 ____D C:\Users\Scooter Toy Park\AppData\Local\{640D4A38-F41B-4487-AF01-0404196E4097}
2011-11-11 01:42 - 2010-10-29 16:28 - 0000000 ____D C:\Users\Scooter Toy Park\AppData\Local\Windows Live
2011-11-10 22:00 - 2010-05-01 01:45 - 0000000 ____D C:\Users\All Users\LogMeIn
2011-11-10 22:00 - 2010-05-01 01:45 - 0000000 ____D C:\ProgramData\LogMeIn
2011-11-10 13:42 - 2011-11-10 13:42 - 0000000 ____D C:\Users\Scooter Toy Park\AppData\Local\{4B773A1E-9371-4B8B-BF6B-3728E3089495}
2011-11-10 13:42 - 2011-11-10 13:41 - 0000000 ____D C:\Users\Scooter Toy Park\AppData\Local\{2E068569-F19B-475B-8398-1D9EDF802F72}
2011-11-10 12:32 - 2011-07-09 19:18 - 0000000 ____D C:\Users\Scooter Toy Park\Desktop\Install
2011-11-10 12:25 - 2010-03-22 09:34 - 0000900 ____A C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-400140772-108668955-1500843441-1001Core.job
2011-11-10 09:26 - 2011-08-13 10:50 - 0000000 __SHD C:\Users\Scooter Toy Park\wc
2011-11-10 01:41 - 2011-11-10 01:41 - 0000000 ____D C:\Users\Scooter Toy Park\AppData\Local\{F554B3AD-C981-4C6E-89D5-CF53166C467C}
2011-11-10 01:41 - 2011-11-10 01:41 - 0000000 ____D C:\Users\Scooter Toy Park\AppData\Local\{66A211AB-C520-4824-B923-58D7BE1B27F9}
2011-11-09 15:23 - 2011-11-09 15:23 - 0000000 ____D C:\Users\Scooter Toy Park\AppData\Local\Bossland GmbH
2011-11-09 14:51 - 2010-12-27 22:02 - 0001027 ____A C:\Users\Public\Desktop\World of Warcraft.lnk
2011-11-09 13:46 - 2011-11-09 13:46 - 0000000 ____D C:\Users\Scooter Toy Park\AppData\Local\Adobe
2011-11-09 13:41 - 2011-11-09 13:40 - 0000000 ____D C:\Users\Scooter Toy Park\AppData\Local\{58EBA5DC-9F8F-462D-978D-89675E4D737E}
2011-11-09 13:40 - 2011-11-09 13:40 - 0000000 ____D C:\Users\Scooter Toy Park\AppData\Local\{D0FE3B02-0D0E-4070-BEEB-0106038FC8E7}
2011-11-09 13:36 - 2011-11-09 13:36 - 0293816 ____A C:\Windows\Minidump\110911-37331-01.dmp
2011-11-09 13:36 - 2011-09-19 13:31 - 0007938 ____A C:\Windows\PFRO.log
2011-11-09 13:36 - 2010-06-17 12:22 - 0000000 ____D C:\Windows\Minidump
2011-11-08 23:48 - 2010-03-19 20:02 - 0000000 ____D C:\Users\Scooter Toy Park\AppData\Roaming\uTorrent
2011-11-08 22:35 - 2011-11-08 18:16 - 0000000 __SHD C:\Users\Scooter Toy Park\AppData\Local\ed92321b
2011-11-08 20:09 - 2011-11-08 20:09 - 0000000 ____D C:\Users\Scooter Toy Park\AppData\Local\Google
2011-11-08 20:08 - 2011-11-08 20:08 - 0000000 ____D C:\Users\Scooter Toy Park\AppData\Local\ESET
2011-11-08 20:08 - 2011-05-22 20:07 - 0414368 ____A (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2011-11-08 18:20 - 2011-11-08 18:20 - 0000000 __SHD C:\Windows\System32\%APPDATA%
2011-11-08 17:52 - 2010-08-06 09:39 - 0000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2011-11-08 17:46 - 2011-11-08 17:46 - 0000000 ____D C:\Users\Scooter Toy Park\AppData\Local\Apps\2.0
2011-11-08 17:44 - 2010-03-10 22:50 - 0000000 ____D C:\Users\Scooter Toy Park\AppData\LocalLow
2011-11-05 09:35 - 2010-09-03 16:20 - 0000000 ____D C:\Users\Scooter Toy Park\Desktop\Resumes
2011-11-05 08:10 - 2011-11-05 08:10 - 0036192 ____A C:\Users\Scooter Toy Park\Desktop\info2.pdf
2011-11-05 08:09 - 2011-11-05 08:09 - 0026074 ____A C:\Users\Scooter Toy Park\Desktop\info.pdf
2011-11-05 08:06 - 2011-11-05 08:06 - 0024350 ____A C:\Users\Scooter Toy Park\Desktop\employment.pdf
2011-10-31 16:43 - 2011-08-06 09:15 - 0000000 ____D C:\Users\Scooter Toy Park\Desktop\Install - Copy
2011-10-29 17:02 - 2010-04-17 18:37 - 0000000 ____D C:\Users\Scooter Toy Park\AppData\Local\Last.fm
2011-10-27 17:42 - 2010-04-02 11:23 - 0000000 ____D C:\Users\Scooter Toy Park\AppData\Local\QuickPar
2011-10-22 11:06 - 2011-10-22 11:06 - 0000000 ____D C:\Program Files\TortoiseSVN
2011-10-22 11:06 - 2011-10-22 11:06 - 0000000 ____D C:\Program Files\Common Files\TortoiseOverlays
2011-10-19 17:56 - 2011-10-19 17:56 - 0000000 ____D C:\Users\Scooter Toy Park\AppData\Roaming\PlayFirst
2011-10-19 17:56 - 2011-10-19 17:56 - 0000000 ____D C:\Users\All Users\PlayFirst
2011-10-19 17:56 - 2011-10-19 17:56 - 0000000 ____D C:\ProgramData\PlayFirst
2011-10-19 17:56 - 2011-10-19 17:42 - 0000000 ____D C:\Users\Scooter Toy Park\AppData\Roaming\RockHero
2011-10-19 17:39 - 2011-10-19 17:39 - 0002028 ____A C:\Users\Scooter Toy Park\Desktop\Epic Slot - Rock Hero.lnk
2011-10-19 17:39 - 2011-10-19 17:39 - 0000000 ____D C:\Program Files (x86)\Epic Slot - Rock Hero
2011-10-18 15:29 - 2011-09-03 17:00 - 0000000 ____D C:\Users\Scooter Toy Park\Desktop\Dualhorns
2011-10-15 07:29 - 2011-10-14 22:14 - 0000000 ____D C:\Users\Scooter Toy Park\Desktop\The Meaning Of I
2011-10-14 22:13 - 2011-10-14 22:08 - 127714056 ____A C:\Users\Scooter Toy Park\Downloads\Vr_-_TMOI__2011_.rar
2011-10-09 08:05 - 2011-10-09 08:01 - 416299508 ____A C:\Users\Scooter Toy Park\Desktop\Install.rar
2011-10-08 15:26 - 2010-03-17 21:51 - 0000000 ____D C:\Program Files (x86)\Windows Live
2011-10-08 15:25 - 2009-07-13 19:20 - 0000000 ____D C:\Program Files\Common Files\Microsoft Shared
2011-10-07 18:09 - 2011-10-07 18:09 - 5771456 ____A (Antibody Software ) C:\Users\Scooter Toy Park\Downloads\bid_4_26_setup.exe
2011-10-07 18:09 - 2011-04-16 06:19 - 0000000 ____D C:\Program Files (x86)\Bulk Image Downloader
2011-10-07 18:04 - 2011-04-16 06:19 - 0000000 ____D C:\Users\Scooter Toy Park\AppData\Roaming\BID
2011-10-07 18:02 - 2011-10-07 18:02 - 5657677 ____A C:\Users\Scooter Toy Park\Downloads\Bulk_Image_Downloader_4.20.0.1.rar
2011-10-07 15:48 - 2009-07-13 21:32 - 0000000 ____D C:\Windows\Downloaded Program Files
2011-10-07 14:45 - 2010-05-01 01:45 - 0000000 ____D C:\Program Files (x86)\LogMeIn
2011-10-07 14:17 - 2010-05-01 01:45 - 0087456 ____A (LogMeIn, Inc.) C:\Windows\System32\LMIRfsClientNP.dll
2011-10-07 14:17 - 2010-05-01 01:45 - 0080768 ____A (LogMeIn, Inc.) C:\Windows\System32\LMIinit.dll
2011-10-07 14:17 - 2010-05-01 01:45 - 0034688 ____A (LogMeIn, Inc.) C:\Windows\System32\LMIport.dll
2011-10-03 13:18 - 2010-11-05 12:10 - 0000000 ____D C:\Users\Scooter Toy Park\AppData\Local\VMware
2011-10-03 13:18 - 2010-05-08 21:27 - 0000000 ____D C:\Users\Scooter Toy Park\AppData\Roaming\VMware
2011-09-30 17:33 - 2010-04-16 21:40 - 0002010 ___AH C:\Users\Scooter Toy Park\Documents\Default.rdp
2011-09-27 15:17 - 2011-01-12 19:30 - 0000000 ____D C:\Users\Scooter Toy Park\AppData\Roaming\vlc
2011-09-22 16:23 - 2010-04-17 18:42 - 0000000 ____D C:\Users\Scooter Toy Park\AppData\Roaming\Winamp
2011-09-19 14:38 - 2009-07-13 21:32 - 0000000 ____D C:\Windows\System32\FxsTmp
2011-09-19 13:56 - 2010-05-10 17:43 - 0000000 ____D C:\myVms
2011-09-19 13:44 - 2010-03-14 01:19 - 0000000 ____D C:\Users\Scooter Toy Park\Desktop\Shortcuts
2011-09-19 13:40 - 2010-05-01 01:45 - 0001024 ____A C:\.rnd
2011-09-19 13:40 - 2010-04-20 21:02 - 0802680 ____A C:\Windows\SysWOW64\PerfStringBackup.INI
2011-09-19 13:38 - 2011-09-19 13:38 - 0000000 ____D C:\Users\Public\Documents\Shared Virtual Machines
2011-09-19 13:38 - 2011-09-19 13:38 - 0000000 ____D C:\Program Files (x86)\VMware
2011-09-19 13:37 - 2011-09-19 13:37 - 0000000 ____D C:\Program Files\Common Files\VMware
2011-09-19 13:31 - 2009-07-13 20:45 - 5027304 ____A C:\Windows\System32\FNTCACHE.DAT
2011-09-18 16:43 - 2011-09-18 16:43 - 0000913 ____A C:\Users\Scooter Toy Park\Desktop\Ventrilo.lnk
2011-09-18 16:43 - 2011-09-18 16:43 - 0000000 ____D C:\Program Files\Ventrilo
2011-09-18 16:43 - 2011-09-18 16:42 - 0000262 ____A C:\Windows\{EEB3F6BB-318D-4CE5-989F-8191FCBFB578}_WiseFW.ini
2011-09-17 16:35 - 2011-09-17 16:35 - 0000000 ____D C:\Users\Scooter Toy Park\Desktop\Site
2011-09-17 16:33 - 2010-10-15 15:09 - 0000000 ____D C:\Users\Scooter Toy Park\Desktop\Games
2011-09-17 16:31 - 2010-03-10 22:50 - 0000000 ____D C:\users\Scooter Toy Park
2011-09-17 10:50 - 2010-05-15 11:32 - 0000000 ____D C:\Users\Scooter Toy Park\AppData\Roaming\abgx360
2011-09-17 10:25 - 2011-09-17 16:32 - 0000037 ____A C:\Users\Scooter Toy Park\Desktop\Dead Island.dvd
2011-09-17 10:09 - 2010-05-18 10:30 - 0000000 ____D C:\Users\Scooter Toy Park\AppData\Roaming\dvdcss
2011-09-08 19:06 - 2011-09-08 19:06 - 0000000 ____D C:\Program Files\TurboTax
2011-09-08 18:47 - 2011-09-08 16:01 - 0000000 ____D C:\Program Files (x86)\TurboTax
2011-09-08 18:43 - 2011-09-08 18:43 - 0000000 ____D C:\Users\Scooter Toy Park\Documents\ItsDeductible2006
2011-09-08 18:43 - 2011-09-08 18:43 - 0000000 ____D C:\Program Files (x86)\ItsDeductible2006
2011-09-08 18:37 - 2010-06-15 14:35 - 0144696 ____A C:\Users\Scooter Toy Park\AppData\Local\GDIPFONTCACHEV1.DAT
2011-09-08 16:23 - 2011-02-21 16:44 - 0000000 ____D C:\Users\All Users\Intuit
2011-09-08 16:23 - 2011-02-21 16:44 - 0000000 ____D C:\ProgramData\Intuit
2011-09-08 16:22 - 2011-09-08 16:22 - 0000023 ____H C:\Windows\PltWin04.ppl
2011-09-08 16:22 - 2011-09-08 16:22 - 0000000 ____D C:\Users\Scooter Toy Park\Documents\TurboTax
2011-09-08 16:22 - 2011-09-08 16:22 - 0000000 ____D C:\Users\Scooter Toy Park\AppData\Roaming\Intuit
2011-09-08 16:05 - 2011-09-08 16:05 - 0000000 ____D C:\Program Files (x86)\ItsDeductibleEX
2011-09-08 16:04 - 2010-06-26 21:33 - 0000000 ___HD C:\Program Files (x86)\InstallShield Installation Information
2011-09-07 10:15 - 2011-09-17 16:32 - 3543728128 ____A C:\Users\Scooter Toy Park\Desktop\Dead Island.iso
2011-09-05 06:50 - 2009-07-13 19:20 - 0000000 ____D C:\Windows\system
2011-09-03 19:05 - 2010-09-09 22:06 - 0026112 ____A C:\Users\Scooter Toy Park\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2011-09-03 07:49 - 2011-09-03 07:49 - 0098747 ____A C:\Users\Scooter Toy Park\Desktop\rawrmeow2.jpg
2011-09-03 07:18 - 2011-09-03 07:18 - 0375488 ____A C:\Users\Scooter Toy Park\Desktop\Craagle1.91.zip
2011-09-02 17:20 - 2011-09-02 17:20 - 0000000 ____D C:\Users\Scooter Toy Park\AppData\Local\Xara Online Dreamweaver Cache
2011-08-30 16:41 - 2011-08-08 13:40 - 0000000 __SHD C:\Users\Scooter Toy Park\AppData\Roaming\wyUpdate AU
2011-08-28 09:41 - 2011-08-28 09:41 - 0000000 ____A C:\Windows\setuperr.log
2011-08-28 08:58 - 2010-03-14 08:13 - 0000000 ____D C:\Download
2011-08-26 15:19 - 2011-08-26 15:18 - 0003694 ____A C:\Windows\SysWOW64\jupdate-1.6.0_27-b07.log
2011-08-26 15:19 - 2010-11-20 21:37 - 0000000 ____D C:\Program Files (x86)\Java
2011-08-23 21:47 - 2011-08-23 21:40 - 172858724 ____A C:\Users\Scooter Toy Park\Downloads\HD Michael Jackson Superbowl XXVIII Halftime Show 1993 Full Version [www.keepvid.com].mp4
2011-08-23 21:26 - 2011-08-23 21:19 - 406792952 ____A C:\Users\Scooter Toy Park\Desktop\HD Michael Jackson Superbowl XXVIII Halftime Show 1993 Full Version [www.keepvid.com].mp4
2011-08-23 13:08 - 2011-08-23 13:08 - 2126034944 ____A C:\Users\Scooter Toy Park\Desktop\BT5R1-KDE-64.iso
2011-08-22 14:07 - 2011-09-19 13:41 - 0062064 ____A (VMware, Inc.) C:\Windows\System32\Drivers\vmx86.sys
2011-08-22 14:07 - 2011-09-19 13:40 - 0942192 ____A (VMware, Inc.) C:\Windows\System32\vnetlib64.dll
2011-08-22 14:07 - 2011-09-19 13:40 - 0354416 ____A (VMware, Inc.) C:\Windows\SysWOW64\vmnetdhcp.exe
2011-08-22 14:06 - 2011-09-19 13:40 - 0432752 ____A (VMware, Inc.) C:\Windows\SysWOW64\vmnat.exe
2011-08-22 14:06 - 2011-09-19 13:40 - 0030320 ____A (VMware, Inc.) C:\Windows\System32\Drivers\vmnetuserif.sys
2011-08-22 12:40 - 2011-08-22 12:40 - 0252016 ____A (VMware, Inc.) C:\Windows\SysWOW64\vmnc.dll
2011-08-22 12:12 - 2011-08-22 12:12 - 0062064 ____A (VMware, Inc.) C:\Windows\System32\vmnetbridge.dll
2011-08-22 12:12 - 2011-08-22 12:12 - 0048752 ____A (VMware, Inc.) C:\Windows\System32\vnetinst.dll
2011-08-22 12:12 - 2011-08-22 12:12 - 0045680 ____A (VMware, Inc.) C:\Windows\System32\Drivers\vmnetbridge.sys
2011-08-22 12:12 - 2011-08-22 12:12 - 0024176 ____A (VMware, Inc.) C:\Windows\System32\Drivers\vmnet.sys
2011-08-22 12:12 - 2011-08-22 12:12 - 0020080 ____A (VMware, Inc.) C:\Windows\System32\Drivers\vmnetadapter.sys
2011-08-21 20:11 - 2011-09-19 13:40 - 0039024 ____A (VMware, Inc.) C:\Windows\System32\Drivers\hcmon.sys
2011-08-20 12:43 - 2010-11-06 19:07 - 0000000 ____D C:\Users\Scooter Toy Park\Desktop\Hacking
2011-08-20 12:40 - 2011-08-20 12:40 - 0000000 ____D C:\Users\Scooter Toy Park\Documents\Bulk Image Downloader
2011-08-20 08:31 - 2011-08-20 08:31 - 0000000 ___SD C:\Users\Scooter Toy Park\Documents\My Data Sources

========================= Known DLLs (Whitelisted) ============


========================= Bamital & volsnap Check ============

C:\Windows\System32\winlogon.exe => MD5 is legit

C:\Windows\System32\wininit.exe => MD5 is legit

C:\Windows\explorer.exe => MD5 is legit

C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit

========================= Memory info ======================

Percentage of memory in use: 9%
Total physical RAM: 9207.11 MB
Available physical RAM: 8324.14 MB
Total Pagefile: 9205.26 MB
Available Pagefile: 8312.08 MB
Total Virtual: 8192 MB
Available Virtual: 8191.9 MB

======================= Partitions =========================

1 Drive c: () (Fixed) (Total:919.13 GB) (Free:16 GB) NTFS
2 Drive e: (FACTORY_IMAGE) (Fixed) (Total:12.28 GB) (Free:2.23 GB) NTFS
4 Drive g: (U3 System) (CDROM) (Total:0.01 GB) (Free:0 GB) CDFS
5 Drive h: (IPREP_101) (Removable) (Total:1.91 GB) (Free:1.91 GB) FAT
10 Drive x: (Boot) (Fixed) (Total:0.03 GB) (Free:0.03 GB) NTFS
11 Drive y: (SYSTEM) (Fixed) (Total:0.1 GB) (Free:0.07 GB) NTFS

==========================================================

Last Boot: 2011-11-10 22:54

======================= End Of Log ==========================

This post has been edited by WrathofGod: 12 November 2011 - 05:58 PM

Download the enclosed file: [attachment=111352:fixlist.txt]

Save it in the USB drive.

Insert the USb drive in the ailing computer and the System Recovery Options.

Run FRST as you did before, except that this time around click on the Fix button just once and wait.

The tool will make a log on the flashdrive (Fixlog.txt) please post it to your reply.

If successful, boot in Normal Mode. If able to do so, run Combofix as follows:

Please download ComboFix from Here or Here to your Desktop.

**Note: In the event you already have Combofix, this is a new version that I need you to download. It is important that it is saved directly to your desktop**

• Please, never rename Combofix unless instructed.
  
• Close any open browsers.
  
• Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
  -----------------------------------------------------------
  
  • Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before performing a scan. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
    
  • Click on this link or this link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.
    
    If AVG or CA Internet Security Suite is installed, you must remove these programs before using Combofix. If any of these applications will not uninstall, it is first recommended to uninstall it with AppRemover by Opswat. http://www.appremover.com/supported-applications. Do not use AppRemover on Norton
    
    -----------------------------------------------------------
  
  
  • Close any open browsers.
    
  • WARNING: Combofix will disconnect your machine from the Internet as soon as it starts
    
  • Please do not attempt to re-connect your machine back to the Internet until Combofix has completely finished.
    
  • If there is no internet connection after running Combofix, then restart your computer to restore back your connection.
  
  -----------------------------------------------------------
  
• Double click on combofix.exe & follow the prompts.
  
• Install the Recovery Console if prompted.
  
• When finished, it will produce a report for you.
  
• Please post the "C:\ComboFix.txt" .

**Note: Do not mouseclick combofix's window while it's running. That may cause it to stall**

Note: ComboFix may reset a number of Internet Explorer's settings, including making it the default browser.
Note: Combofix prevents autorun of ALL CDs, floppies and USB devices to assist with malware removal & increase security.

Please do not install any new programs or update anything (always allow your antivirus/antispyware to update) unless told to do so while we are fixing your problem. If combofix alerts to a new version and offers to update, please let it. It is essential we always use the latest version.

I ran it and it's sitting on the screen saying it's preparing a log, but it's been 1 1/2hr. I'm going to sleep and will post the log if it creates one.

EDIT: Here you go

ComboFix 11-11-12.04 - Scooter Toy Park 11/12/2011 23:27:41.2.8 - x64
Microsoft Windows 7 Ultimate 6.1.7601.1.1252.1.1033.18.9207.7347 [GMT -6:00]
Running from: c:\users\Scooter Toy Park\Desktop\ComboFix.exe
AV: ESET Smart Security 5.0 *Enabled/Updated* {77DEAFED-8149-104B-25A1-21771CA47CD1}
FW: ESET Personal firewall *Enabled* {4FE52EC8-CB26-1113-0EFE-8842E2773BAA}
SP: ESET Smart Security 5.0 *Enabled/Updated* {CCBF4E09-A773-1FC5-1F11-1A056723366C}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
* Created a new restore point
* Resident AV is active
.
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
---- Previous Run -------
.
c:\users\Scooter Toy Park\.msf3\logs\framework.log
c:\users\Scooter Toy Park\.msf3\modcache
c:\users\Scooter Toy Park\.msf3\msfgui
c:\users\Scooter Toy Park\AppData\Local\ed92321b\U\80000000.@
c:\users\Scooter Toy Park\AppData\Local\ed92321b\U\800000cb.@
c:\users\Scooter Toy Park\AppData\Local\ed92321b\U\800000cf.@
c:\users\Scooter Toy Park\AppData\Roaming\BITS\BITS.ini
c:\users\Scooter Toy Park\AppData\Roaming\BITS\UPnP.ini
c:\users\Scooter Toy Park\AppData\Roaming\Dyyno\dgcsrv.xml
c:\users\Scooter Toy Park\AppData\Roaming\Dyyno\dyyno.xml
c:\users\Scooter Toy Park\AppData\Roaming\inst.exe
c:\users\Scooter Toy Park\AppData\Roaming\vso_ts_preview.xml
c:\users\Scooter Toy Park\AppData\Roaming\Xbins\dict
c:\users\Scooter Toy Park\AppData\Roaming\Xbins\FileZilla.xml
c:\users\Scooter Toy Park\AppData\Roaming\Xbins\icon.ico
c:\users\Scooter Toy Park\AppData\Roaming\Xbins\xbinsftp.exe
c:\windows\assembly\tmp\U\000000c0.@
c:\windows\assembly\tmp\U\000000cb.@
c:\windows\assembly\tmp\U\000000cf.@
c:\windows\assembly\tmp\U\80000000.@
c:\windows\assembly\tmp\U\800000c0.@
c:\windows\assembly\tmp\U\800000cb.@
c:\windows\assembly\tmp\U\800000cf.@
c:\windows\Downloaded Program Files\x64\racodec.ax
c:\windows\Downloaded Program Files\x86\racodec.ax
c:\windows\pthreadGC2.dll
c:\windows\security\Database\tmp.edb
c:\windows\SysWow64\Packet.dll
c:\windows\SysWow64\pthreadVC.dll
c:\windows\SysWow64\wpcap.dll
c:\windows\UA000106.DLL
.
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
-------\Legacy_NPF
-------\Service_NPF
.
.
((((((((((((((((((((((((( Files Created from 2011-10-13 to 2011-11-13 )))))))))))))))))))))))))))))))
.
.
2011-11-13 06:04 . 2011-11-13 06:04 -------- d-----w- c:\users\Mcx1-QUITTANCE\AppData\Local\temp
2011-11-13 06:04 . 2011-11-13 06:04 -------- d-----w- c:\users\LogMeInRemoteUser\AppData\Local\temp
2011-11-13 06:04 . 2011-11-13 06:04 -------- d-----w- c:\users\Default\AppData\Local\temp
2011-11-12 20:43 . 2011-11-12 20:44 -------- d-----w- C:\FRST
2011-11-09 23:23 . 2011-11-09 23:23 -------- d-----w- c:\users\Scooter Toy Park\AppData\Local\Bossland GmbH
2011-11-09 21:46 . 2011-11-09 21:46 -------- d-----w- c:\users\Scooter Toy Park\AppData\Local\Adobe
2011-11-09 04:09 . 2011-11-09 04:09 -------- d-----w- c:\users\Scooter Toy Park\AppData\Local\Google
2011-11-09 04:08 . 2011-11-09 04:08 -------- d-----w- c:\users\Scooter Toy Park\AppData\Local\ESET
2011-11-09 02:20 . 2011-11-09 02:20 -------- d-sh--w- c:\windows\system32\%APPDATA%
2011-11-09 02:16 . 2011-11-13 04:43 -------- d-sh--w- c:\users\Scooter Toy Park\AppData\Local\ed92321b
2011-11-09 01:46 . 2011-11-09 01:46 -------- d-----w- c:\users\Scooter Toy Park\AppData\Local\Apps
2011-10-22 19:06 . 2011-10-22 19:06 -------- d-----w- c:\program files (x86)\Common Files\TortoiseOverlays
2011-10-22 19:06 . 2011-10-22 19:06 -------- d-----w- c:\program files\TortoiseSVN
2011-10-22 19:06 . 2011-10-22 19:06 -------- d-----w- c:\program files\Common Files\TortoiseOverlays
2011-10-20 01:56 . 2011-10-20 01:56 -------- d-----w- c:\users\Scooter Toy Park\AppData\Roaming\PlayFirst
2011-10-20 01:56 . 2011-10-20 01:56 -------- d-----w- c:\programdata\PlayFirst
2011-10-20 01:42 . 2011-10-20 01:56 -------- d-----w- c:\users\Scooter Toy Park\AppData\Roaming\RockHero
2011-10-20 01:39 . 2011-10-20 01:39 -------- d-----w- c:\program files (x86)\Epic Slot - Rock Hero
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-11-09 04:08 . 2011-05-23 04:07 414368 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2011-10-08 23:26 . 2010-06-24 16:33 18328 ----a-w- c:\programdata\Microsoft\IdentityCRL\production\ppcrlconfig600.dll
2011-10-07 22:17 . 2010-05-01 09:45 87456 ----a-w- c:\windows\system32\LMIRfsClientNP.dll
2011-10-07 22:17 . 2010-05-01 09:45 34688 ----a-w- c:\windows\system32\LMIport.dll
2011-10-07 22:17 . 2010-05-01 09:45 80768 ----a-w- c:\windows\system32\LMIinit.dll
2011-09-09 02:43 . 2011-09-09 02:43 40960 ----a-r- c:\users\Scooter Toy Park\AppData\Roaming\Microsoft\Installer\{AFF1EA96-9C23-4249-B7D4-CD4B54D4582F}\NewShortcut3_2E7595EC4FB14E2993D49083C8A9B107.exe
2011-09-09 00:05 . 2011-09-09 00:05 40960 ----a-r- c:\users\Scooter Toy Park\AppData\Roaming\Microsoft\Installer\{36495C59-089C-49D1-BD15-9E5BD86DC9A1}\NewShortcut11_36495C59089C49D1BD159E5BD86DC9A1.exe
2011-09-09 00:05 . 2011-09-09 00:05 40960 ----a-r- c:\users\Scooter Toy Park\AppData\Roaming\Microsoft\Installer\{36495C59-089C-49D1-BD15-9E5BD86DC9A1}\NewShortcut1_36495C59089C49D1BD159E5BD86DC9A1.exe
2011-08-22 22:07 . 2011-09-19 21:41 62064 ----a-w- c:\windows\system32\drivers\vmx86.sys
2011-08-22 22:07 . 2011-09-19 21:40 942192 ----a-w- c:\windows\system32\vnetlib64.dll
2011-08-22 22:07 . 2011-09-19 21:40 354416 ----a-w- c:\windows\SysWow64\vmnetdhcp.exe
2011-08-22 22:06 . 2011-09-19 21:40 432752 ----a-w- c:\windows\SysWow64\vmnat.exe
2011-08-22 22:06 . 2011-09-19 21:40 30320 ----a-w- c:\windows\system32\drivers\vmnetuserif.sys
2011-08-22 20:40 . 2011-08-22 20:40 252016 ----a-w- c:\windows\SysWow64\vmnc.dll
2011-08-22 20:12 . 2011-08-22 20:12 62064 ----a-w- c:\windows\system32\vmnetbridge.dll
2011-08-22 20:12 . 2011-08-22 20:12 48752 ----a-w- c:\windows\system32\vnetinst.dll
2011-08-22 20:12 . 2011-08-22 20:12 45680 ----a-w- c:\windows\system32\drivers\vmnetbridge.sys
2011-08-22 20:12 . 2011-08-22 20:12 24176 ----a-w- c:\windows\system32\drivers\vmnet.sys
2011-08-22 20:12 . 2011-08-22 20:12 20080 ----a-w- c:\windows\system32\drivers\vmnetadapter.sys
2011-08-22 04:11 . 2011-09-19 21:40 39024 ----a-w- c:\windows\system32\drivers\hcmon.sys
.
.
((((((((((((((((((((((((((((( SnapShot@2011-11-13_04.57.07 )))))))))))))))))))))))))))))))))))))))))
.
- 2009-07-14 02:36 . 2011-11-13 04:55 666680 c:\windows\system32\perfh009.dat
+ 2009-07-14 02:36 . 2011-11-13 05:04 666680 c:\windows\system32\perfh009.dat
+ 2009-07-14 02:36 . 2011-11-13 05:04 124098 c:\windows\system32\perfc009.dat
- 2009-07-14 02:36 . 2011-11-13 04:55 124098 c:\windows\system32\perfc009.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\1TortoiseNormal]
@="{C5994560-53D9-4125-87C9-F193FC689CB2}"
[HKEY_CLASSES_ROOT\CLSID\{C5994560-53D9-4125-87C9-F193FC689CB2}]
2011-06-13 15:20 64792 ----a-w- c:\program files (x86)\Common Files\TortoiseOverlays\TortoiseOverlays.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\2TortoiseModified]
@="{C5994561-53D9-4125-87C9-F193FC689CB2}"
[HKEY_CLASSES_ROOT\CLSID\{C5994561-53D9-4125-87C9-F193FC689CB2}]
2011-06-13 15:20 64792 ----a-w- c:\program files (x86)\Common Files\TortoiseOverlays\TortoiseOverlays.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\3TortoiseConflict]
@="{C5994562-53D9-4125-87C9-F193FC689CB2}"
[HKEY_CLASSES_ROOT\CLSID\{C5994562-53D9-4125-87C9-F193FC689CB2}]
2011-06-13 15:20 64792 ----a-w- c:\program files (x86)\Common Files\TortoiseOverlays\TortoiseOverlays.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\4TortoiseLocked]
@="{C5994563-53D9-4125-87C9-F193FC689CB2}"
[HKEY_CLASSES_ROOT\CLSID\{C5994563-53D9-4125-87C9-F193FC689CB2}]
2011-06-13 15:20 64792 ----a-w- c:\program files (x86)\Common Files\TortoiseOverlays\TortoiseOverlays.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\5TortoiseReadOnly]
@="{C5994564-53D9-4125-87C9-F193FC689CB2}"
[HKEY_CLASSES_ROOT\CLSID\{C5994564-53D9-4125-87C9-F193FC689CB2}]
2011-06-13 15:20 64792 ----a-w- c:\program files (x86)\Common Files\TortoiseOverlays\TortoiseOverlays.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\6TortoiseDeleted]
@="{C5994565-53D9-4125-87C9-F193FC689CB2}"
[HKEY_CLASSES_ROOT\CLSID\{C5994565-53D9-4125-87C9-F193FC689CB2}]
2011-06-13 15:20 64792 ----a-w- c:\program files (x86)\Common Files\TortoiseOverlays\TortoiseOverlays.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\7TortoiseAdded]
@="{C5994566-53D9-4125-87C9-F193FC689CB2}"
[HKEY_CLASSES_ROOT\CLSID\{C5994566-53D9-4125-87C9-F193FC689CB2}]
2011-06-13 15:20 64792 ----a-w- c:\program files (x86)\Common Files\TortoiseOverlays\TortoiseOverlays.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\8TortoiseIgnored]
@="{C5994567-53D9-4125-87C9-F193FC689CB2}"
[HKEY_CLASSES_ROOT\CLSID\{C5994567-53D9-4125-87C9-F193FC689CB2}]
2011-06-13 15:20 64792 ----a-w- c:\program files (x86)\Common Files\TortoiseOverlays\TortoiseOverlays.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\9TortoiseUnversioned]
@="{C5994568-53D9-4125-87C9-F193FC689CB2}"
[HKEY_CLASSES_ROOT\CLSID\{C5994568-53D9-4125-87C9-F193FC689CB2}]
2011-06-13 15:20 64792 ----a-w- c:\program files (x86)\Common Files\TortoiseOverlays\TortoiseOverlays.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"msnmsgr"="c:\program files (x86)\Windows Live\Messenger\msnmsgr.exe" [2011-05-13 4283256]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2010-11-20 1475584]
"AdobeBridge"="" [BU]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"{0228e555-4f9c-4e35-a3ec-b109a192b4c2}"="c:\program files (x86)\Google\Gmail Notifier\gnotify.exe" [2005-07-15 479232]
.
c:\users\Scooter Toy Park\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
MagicDisc.lnk - c:\program files (x86)\MagicDisc\MagicDisc.exe [2010-4-21 576000]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 0 (0x0)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)
"SoftwareSASGeneration"= 1 (0x1)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Security Packages REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp
.
R1 SASDIFSV;SASDIFSV;c:\users\SCOOTE~1\AppData\Local\Temp\SAS_SelfExtract\SASDIFSV.SYS [x]
R1 SASKUTIL;SASKUTIL;c:\users\SCOOTE~1\AppData\Local\Temp\SAS_SelfExtract\SASKUTIL.sys [x]
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R2 gupdate;Google Update Service (gupdate);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-03-15 135664]
R2 MBAMService;MBAMService;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2011-08-31 366152]
R2 VMwareHostd;VMware Workstation Server;c:\program files (x86)\VMware\VMware Workstation\vmware-hostd.exe [2011-08-22 11837440]
R3 ALSysIO;ALSysIO;c:\users\SCOOTE~1\AppData\Local\Temp\ALSysIO64.sys [x]
R3 CEDRIVER55;CEDRIVER55;c:\downloads\Program Files\Cheat Engine\dbk64.sys [x]
R3 ESHASRV;ESET SHA Service;c:\program files\ESET\ESET Smart Security\EShaSrv.exe [2011-04-20 184512]
R3 gupdatem;Google Update Service (gupdatem);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-03-15 135664]
R3 MatSvc;Microsoft Automated Troubleshooting Service;c:\program files\Microsoft Fix it Center\Matsvc.exe [2011-06-14 343856]
R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [x]
R3 netr28ux;RT2870 USB Wireless LAN Card Driver for Vista;c:\windows\system32\DRIVERS\netr28ux.sys [x]
R3 osppsvc;Office Software Protection Platform;c:\program files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-01-10 4925184]
R3 pbfilter;pbfilter;c:\users\Scooter Toy Park\Desktop\Peer Block\pbfilter.sys [2009-09-28 19544]
R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys [x]
R3 RTL8192cu;Realtek RTL8192CU Wireless LAN 802.11n USB 2.0 Network Adapter;c:\windows\system32\DRIVERS\RTL8192cu.sys [x]
R3 RTL8192su;Realtek RTL8192SU Wireless LAN 802.11n USB 2.0 Network Adapter;c:\windows\system32\DRIVERS\RTL8192su.sys [x]
R3 SASENUM;SASENUM;c:\users\SCOOTE~1\AppData\Local\Temp\SAS_SelfExtract\SASENUM.SYS [x]
R3 SwitchBoard;Adobe SwitchBoard;c:\program files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [2010-02-19 517096]
R3 Synth3dVsc;Synth3dVsc;c:\windows\system32\drivers\synth3dvsc.sys [x]
R3 tapoas;TAP-Win32 Adapter OAS;c:\windows\system32\DRIVERS\tapoas.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [x]
R3 tsusbhub;tsusbhub;c:\windows\system32\drivers\tsusbhub.sys [x]
R3 TVICHW64;TVICHW64;c:\windows\SysWOW64\Drivers\TVICHW64.SYS [2007-03-12 21200]
R3 USB_RNDIS_NTamd64;USB Remote Ndis Cable Modem Network Device Driver;c:\windows\system32\DRIVERS\usb8023.sys [x]
R3 VGPU;VGPU;c:\windows\system32\drivers\rdvgkmd.sys [x]
S0 epfwwfp;epfwwfp;c:\windows\system32\DRIVERS\epfwwfp.sys [x]
S0 vmci;VMware VMCI Bus Driver;c:\windows\system32\DRIVERS\vmci.sys [x]
S1 ehdrv;ehdrv;c:\windows\system32\DRIVERS\ehdrv.sys [x]
S1 EpfwLWF;Epfw NDIS LightWeight Filter;c:\windows\system32\DRIVERS\EpfwLWF.sys [x]
S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [x]
S2 Akamai;Akamai NetSession Interface;c:\windows\System32\svchost.exe [2009-07-14 27136]
S2 Dyyno Launcher;Dyyno Service;c:\program files (x86)\Dyyno\Dyyno Broadcaster\launcherd.exe [2011-05-18 415072]
S2 eamonm;eamonm;c:\windows\system32\DRIVERS\eamonm.sys [x]
S2 ekrn;ESET Service;c:\program files\ESET\ESET Smart Security\x86\ekrn.exe [2011-04-20 958464]
S2 Intel® PROSet Monitoring Service;Intel® PROSet Monitoring Service;c:\windows\system32\IProsetMonitor.exe [x]
S2 LMIGuardianSvc;LMIGuardianSvc;c:\program files (x86)\LogMeIn\x64\LMIGuardianSvc.exe [2011-10-07 375176]
S2 LMIInfo;LogMeIn Kernel Information Provider;c:\program files (x86)\LogMeIn\x64\RaInfo.sys [2008-08-11 15928]
S2 NAUpdate;Nero Update;c:\program files (x86)\Nero\Update\NASvc.exe [2010-03-25 490280]
S2 VMUSBArbService;VMware USB Arbitration Service;c:\program files (x86)\Common Files\VMware\USB\vmware-usbarbitrator64.exe [2011-08-22 846448]
S2 vstor2-mntapi10-shared;Vstor2 MntApi 1.0 Driver (shared);SysWOW64\drivers\vstor2-mntapi10-shared.sys [x]
S3 e1yexpress;Intel® Gigabit Network Connections Driver;c:\windows\system32\DRIVERS\e1y62x64.sys [x]
S3 HTCAND64;HTC Device Driver;c:\windows\system32\Drivers\ANDROIDUSB.sys [x]
S3 pcouffin;VSO Software pcouffin;c:\windows\system32\Drivers\pcouffin.sys [x]
S3 pneteth;PdaNet Broadband;c:\windows\system32\DRIVERS\pneteth.sys [x]
.
.
--- Other Services/Drivers In Memory ---
.
*Deregistered* - NAL
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\svchost]
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
Akamai REG_MULTI_SZ Akamai
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
2009-06-17 17:11 451872 ----a-w- c:\program files (x86)\Common Files\LightScribe\LSRunOnce.exe
.
Contents of the 'Scheduled Tasks' folder
.
2011-11-13 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-03-15 18:00]
.
2011-11-13 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-03-15 18:00]
.
.
--------- x86-64 -----------
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\1TortoiseNormal]
@="{C5994560-53D9-4125-87C9-F193FC689CB2}"
[HKEY_CLASSES_ROOT\CLSID\{C5994560-53D9-4125-87C9-F193FC689CB2}]
2011-06-13 15:20 75544 ----a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\2TortoiseModified]
@="{C5994561-53D9-4125-87C9-F193FC689CB2}"
[HKEY_CLASSES_ROOT\CLSID\{C5994561-53D9-4125-87C9-F193FC689CB2}]
2011-06-13 15:20 75544 ----a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\3TortoiseConflict]
@="{C5994562-53D9-4125-87C9-F193FC689CB2}"
[HKEY_CLASSES_ROOT\CLSID\{C5994562-53D9-4125-87C9-F193FC689CB2}]
2011-06-13 15:20 75544 ----a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\4TortoiseLocked]
@="{C5994563-53D9-4125-87C9-F193FC689CB2}"
[HKEY_CLASSES_ROOT\CLSID\{C5994563-53D9-4125-87C9-F193FC689CB2}]
2011-06-13 15:20 75544 ----a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\5TortoiseReadOnly]
@="{C5994564-53D9-4125-87C9-F193FC689CB2}"
[HKEY_CLASSES_ROOT\CLSID\{C5994564-53D9-4125-87C9-F193FC689CB2}]
2011-06-13 15:20 75544 ----a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\6TortoiseDeleted]
@="{C5994565-53D9-4125-87C9-F193FC689CB2}"
[HKEY_CLASSES_ROOT\CLSID\{C5994565-53D9-4125-87C9-F193FC689CB2}]
2011-06-13 15:20 75544 ----a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\7TortoiseAdded]
@="{C5994566-53D9-4125-87C9-F193FC689CB2}"
[HKEY_CLASSES_ROOT\CLSID\{C5994566-53D9-4125-87C9-F193FC689CB2}]
2011-06-13 15:20 75544 ----a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\8TortoiseIgnored]
@="{C5994567-53D9-4125-87C9-F193FC689CB2}"
[HKEY_CLASSES_ROOT\CLSID\{C5994567-53D9-4125-87C9-F193FC689CB2}]
2011-06-13 15:20 75544 ----a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\9TortoiseUnversioned]
@="{C5994568-53D9-4125-87C9-F193FC689CB2}"
[HKEY_CLASSES_ROOT\CLSID\{C5994568-53D9-4125-87C9-F193FC689CB2}]
2011-06-13 15:20 75544 ----a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"LogMeIn GUI"="c:\program files (x86)\LogMeIn\x64\LogMeInSystray.exe" [2008-08-11 57928]
"egui"="c:\program files\ESET\ESET Smart Security\egui.exe" [2011-04-20 3382680]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"LoadAppInit_DLLs"=0x1
.
------- Supplementary Scan -------
.
uLocal Page = c:\windows\system32\blank.htm
mLocal Page = c:\windows\system32\blank.htm
IE: &Download All with FlashGet - c:\program files (x86)\FlashGet\jc_all.htm
IE: &Download with FlashGet - c:\program files (x86)\FlashGet\jc_link.htm
IE: &ieSpell Options - c:\program files (x86)\ieSpell\iespell.dll/SPELLOPTION.HTM
IE: Check &Spelling - c:\program files (x86)\ieSpell\iespell.dll/SPELLCHECK.HTM
IE: En&queue current page with BID - file://c:\program files (x86)\Bulk Image Downloader\iemenu\iebidqueue.htm
IE: Enqueue link tar&get with BID - file://c:\program files (x86)\Bulk Image Downloader\iemenu\iebidlinkqueue.htm
IE: Google Sidewiki... - c:\program files (x86)\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_7461B1589E8B4FB7.dll/cmsidewiki.html
IE: Lookup on Merriam Webster - file://c:\program files (x86)\ieSpell\Merriam Webster.HTM
IE: Lookup on Wikipedia - file://c:\program files (x86)\ieSpell\wikipedia.HTM
IE: Open &link target with BID - file://c:\program files (x86)\Bulk Image Downloader\iemenu\iebidlink.htm
IE: Open current page with BI&D - file://c:\program files (x86)\Bulk Image Downloader\iemenu\iebid.htm
IE: Open current page with BID Link Explorer - file://c:\program files (x86)\Bulk Image Downloader\iemenu\iebidlinkexplorer.htm
LSP: %SystemRoot%\system32\vsocklib.dll
Trusted Zone: kuaiche.com\software
Trusted Zone: turbotax.com
Trusted Zone: virtualapple.org\www
DPF: ActiveGS.cab - hxxp://activegs.freetoolsassociation.com/ActiveGS.cab
FF - ProfilePath - c:\users\Scooter Toy Park\AppData\Roaming\Mozilla\Firefox\Profiles\oavm81fh.brd\
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\downloads\Program Files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0016-ABCDEFFEDCBA} - c:\downloads\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0016-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} - c:\downloads\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} - c:\downloads\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} - c:\downloads\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0027-ABCDEFFEDCBA} - c:\downloads\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0027-ABCDEFFEDCBA}
FF - Ext: DivX Plus Web Player HTML5 <video>: {23fcfd51-4958-4f00-80a3-ae97e717ed8b} - c:\program files (x86)\DivX\DivX Plus Web Player\firefox\html5video
FF - Ext: DivX HiQ: {6904342A-8307-11DF-A508-4AE2DFD72085} - c:\program files (x86)\DivX\DivX Plus Web Player\firefox\wpa
.
- - - - ORPHANS REMOVED - - - -
.
Toolbar-Locked - (no file)
BHO-{F9E4A054-E9B1-4BC3-83A3-76A1AE736170} - (no file)
Toolbar-Locked - (no file)
HKLM-Run-combofix - c:\combofix\CF7471.3XE
AddRemove-Adobe Shockwave Player - c:\windows\system32\Adobe\Shockwave 11\uninstaller.exe
AddRemove-dBpoweramp CD Writer - c:\windows\system32\SpoonUninstall.exe
AddRemove-dBpoweramp DSP Effects - c:\windows\system32\SpoonUninstall.exe
AddRemove-dBpoweramp Music Converter - c:\windows\system32\SpoonUninstall.exe
AddRemove-dBpoweramp [Arrange Audio] Codec - c:\windows\system32\SpoonUninstall.exe
AddRemove-dBpoweramp [Audio Info] Codec - c:\windows\system32\SpoonUninstall.exe
AddRemove-dBpoweramp [Calculate Audio CRC] Codec - c:\windows\system32\SpoonUninstall.exe
AddRemove-dBpoweramp [Channel Split] Codec - c:\windows\system32\SpoonUninstall.exe
AddRemove-dBpoweramp [ID Tag Update] Codec - c:\windows\system32\SpoonUninstall.exe
AddRemove-dBpoweramp [Length Split] Codec - c:\windows\system32\SpoonUninstall.exe
AddRemove-dBpoweramp [Multi Encoder] Codec - c:\windows\system32\SpoonUninstall.exe
AddRemove-dBpoweramp [ReplayGain] Codec - c:\windows\system32\SpoonUninstall.exe
AddRemove-dBpoweramp [Tag From Filename] Codec - c:\windows\system32\SpoonUninstall.exe
AddRemove-Google Chrome - c:\users\Scooter Toy Park\AppData\Local\Google\Chrome\Application\15.0.874.106\Installer\setup.exe
.
.
"ImagePath"="%SystemRoot%\System32\snmptrap.exe"
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\services\Solarwinds: Job Broker]
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\services\Solarwinds: Job Engine]
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\services\Solarwinds: Job Scheduler]
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil11c_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil11c_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11c.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.10"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11c.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11c.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11c.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\software\Wow6432Node\Microsoft\Office\Common\Smart Tag\Actions\{B7EFF951-E52F-45CC-9EF7-57124F2177CC}]
@Denied: (A) (Everyone)
"Solution"="{15727DE6-F92D-4E46-ACB4-0E2C58B31A18}"
.
[HKEY_LOCAL_MACHINE\software\Wow6432Node\Microsoft\Schema Library\ActionsPane3]
@Denied: (A) (Everyone)
.
[HKEY_LOCAL_MACHINE\software\Wow6432Node\Microsoft\Schema Library\ActionsPane3\0]
"Key"="ActionsPane3"
"Location"="c:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VSTO\\ActionsPane3.xsd"
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Completion time: 2011-11-13 00:29:36
ComboFix-quarantined-files.txt 2011-11-13 06:29
.
Pre-Run: 17,275,166,720 bytes free
Post-Run: 17,905,963,008 bytes free
.
- - End Of File - - AE5081A0717113A5CAFB492B716CF995

This post has been edited by WrathofGod: 13 November 2011 - 02:47 AM

JSntgRvr, on 13 November 2011 - 02:02 AM, said:

Think were good then?

Lets check for remnants.

Please download Malwarebytes' Anti-Malware from Here. Never download Malwarebytes' Anti-Malware from other sources.

Double Click mbam-setup.exe to install the application.

• Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
  
• If an update is found, it will download and install the latest version.
  
• Once the program has loaded, select "Perform Quick Scan", then click Scan.
  
• The scan may take some time to finish,so please be patient.
  
• When the scan is complete, click OK, then Show Results to view the results.
  
• Make sure that everything is checked, and click Remove Selected.
  
• When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
  
• The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
  
• Copy&Paste the entire report in your next reply.

Extra Note:

If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process. If asked to restart the computer, please do so immediatly.


You need an antivirus. I would recommend AVAST. Install the application, register, update and perform a full scan. Let me know the outcome.

Ok I already have mbam so I'll update an run another full scan. It didn't pick up the rootkit init up initially though :/ So hopefully it will pick it up this time.

bleep THIS ROOTKIT! I just tried to get on WOW and my account is banned :'( and I got a call from lifelock asking if I was opening a credit card. Why do they do this to people. I lost my job two weeks ago and can't afford $80 for a new accout not to mention all the time I had into it :'( I pray Blizzard will help me like you guys have. Thanks again.

Very unfortunate, but is the truth.

I think they're going to deny it according to the nice man on the phone. I'm so pissed. At least Windows works though, sigh.

When the scan gets done I'll upload the log. Nothing found Any other scans I should run?

This post has been edited by WrathofGod: 13 November 2011 - 10:58 PM