Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Browser Redirect Issues


  • This topic is locked This topic is locked
11 replies to this topic

#1 Faerin

Faerin

  • Members
  • 7 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:Cleveland, OH
  • Local time:11:26 AM

Posted 30 November 2011 - 10:21 AM

Hello!

I'm running on Windows 7 and my default browser is Firefox. It would appear that I have been hit with these dreaded browser redirect problems that a lot of other people have been having.

Basically, whenever I Google something, the search results appear to be relevant and what I searched for, but when I clink on a link it will redirect to another page, sometimes totally unrelated to what the link should be taking me to and at other times just to other "search"-like pages for that topic.

To temporarily deal with it until I can fix the problem, I have the NoScript Add-On for Firefox enabled so that it doesn't do this. Also, occasionally a whole new window will pop up altogether with anywhere between 2 to 5 tabs of random pages, and these have been coming up even with the Add-On enabled, but not very often.

I admit that until this point, I haven't been great at keeping up with my computer's safety. I did install MBAM and ran both a quick scan and a full-scan. It did find a few infected files, but since those were taken care of, it's been running through clean. I also ran through TDSS on recommendation from another site, but that also found nothing.

I'm also experiencing problems making any changes to my Windows Firewall settings, it's coming up with an error message that says "Windows Firewall can't change some of your settings. Error code 0x8007042c"

Any help at all would be really appreciated in trying to fix this problem! Also, while trying to fix it, should I keep this NoScript add-on enabled or should I disable it? I'm just a little paranoid to really touch much of anything until I can get the issue fixed.

Below is the DDS.txt. I also have the Attach.txt and the ARK.log, but I don't want to attach them since it seems most people here say not to? If those are needed, just let me know.


.
DDS (Ver_2011-08-26.01) - NTFSAMD64
Internet Explorer: 8.0.7600.16385 BrowserJavaVersion: 1.6.0_22
Run by Midnight Mistress at 9:11:06 on 2011-11-30
Microsoft Windows 7 Home Premium 6.1.7600.0.1252.1.1033.18.1788.767 [GMT -5:00]
.
AV: Norton Internet Security *Disabled/Outdated* {63DF5164-9100-186D-2187-8DC619EFD8BF}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
SP: Norton Internet Security *Disabled/Updated* {D8BEB080-B73A-17E3-1B37-B6B462689202}
FW: Norton Internet Security *Disabled* {5BE4D041-DB6F-1935-0AD8-24F3E73C9FC4}
.
============== Running Processes ===============
.
C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\svchost.exe -k RPCSS
C:\Windows\system32\atiesrxx.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\atieclxx.exe
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\system32\WLANExt.exe
C:\Windows\system32\conhost.exe
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Windows\SysWOW64\svchost.exe -k Akamai
C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
C:\Program Files (x86)\Bonjour\mDNSResponder.exe
C:\Program Files\eMachines\eMachines Power Management\ePowerSvc.exe
C:\Program Files (x86)\eMachines\Registration\GregHSRW.exe
C:\Program Files (x86)\Norton Internet Security\Engine\16.8.3.6\ccSvcHst.exe
C:\Program Files (x86)\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe
C:\Windows\system32\svchost.exe -k imgsvc
C:\Program Files\eMachines\eMachines Updater\UpdaterService.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
C:\Windows\system32\taskhost.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
C:\Program Files (x86)\Norton Internet Security\Engine\16.8.3.6\ccSvcHst.exe
C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
C:\Windows\system32\SearchIndexer.exe
C:\Program Files\eMachines\eMachines Power Management\ePowerTray.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Windows\PLFSetI.exe
C:\Users\Midnight Mistress\AppData\Local\Akamai\netsession_win.exe
C:\Program Files (x86)\McAfee Security Scan\2.0.181\SSScheduler.exe
C:\Users\Midnight Mistress\AppData\Local\Akamai\netsession_win.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
C:\Program Files (x86)\Launch Manager\LManager.exe
C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
C:\Program Files\eMachines\eMachines Power Management\ePowerEvent.exe
C:\Program Files (x86)\Mozilla Firefox\firefox.exe
C:\Windows\System32\svchost.exe -k LocalServicePeerNet
C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
C:\Windows\System32\svchost.exe -k secsvcs
C:\Windows\system32\wuauclt.exe
C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe
C:\Windows\SysWOW64\ping.exe
C:\Windows\system32\conhost.exe
C:\Windows\system32\SearchProtocolHost.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\conhost.exe
C:\Windows\SysWOW64\cscript.exe
C:\Windows\system32\wbem\wmiprvse.exe
.
============== Pseudo HJT Report ===============
.
uStart Page = hxxp://homepage.emachines.com/rdr.aspx?b=ACEW&l=0409&m=e627&r=273608101005l04h4z125r44j2393o
uDefault_Page_URL = hxxp://homepage.emachines.com/rdr.aspx?b=ACEW&l=0409&m=e627&r=273608101005l04h4z125r44j2393o
mDefault_Page_URL = hxxp://homepage.emachines.com/rdr.aspx?b=ACEW&l=0409&m=e627&r=273608101005l04h4z125r44j2393o
mStart Page = hxxp://homepage.emachines.com/rdr.aspx?b=ACEW&l=0409&m=e627&r=273608101005l04h4z125r44j2393o
uInternet Settings,ProxyOverride = *.local
mWinlogon: Userinit=userinit.exe,
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
BHO: Symantec NCO BHO: {602adb0e-4aff-4217-8aa1-95dac4dfa408} - C:\Program Files (x86)\Norton Internet Security\Engine\16.8.3.6\coIEPlg.dll
BHO: Symantec Intrusion Prevention: {6d53ec84-6aae-4787-aeee-f4628f01010c} - C:\Program Files (x86)\Norton Internet Security\Engine\16.8.3.6\IPSBHO.DLL
BHO: Windows Live ID Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
BHO: Skype Browser Helper: {ae805869-2e5c-4ed4-8f7b-f1f7851a4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll
TB: Norton Toolbar: {7febefe3-6b19-4349-98d2-ffb09d4b49ca} - C:\Program Files (x86)\Norton Internet Security\Engine\16.8.3.6\coIEPlg.dll
uRun: [conhost] C:\Users\Midnight Mistress\AppData\Roaming\Microsoft\conhost.exe
uRun: [Akamai NetSession Interface] C:\Users\Midnight Mistress\AppData\Local\Akamai\netsession_win.exe
uRun: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
mRun: [LManager] C:\Program Files (x86)\Launch Manager\LManager.exe
mRun: [Adobe Reader Speed Launcher] "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe"
mRun: [NortonOnlineBackupReminder] "C:\Program Files (x86)\Symantec\Norton Online Backup\Activation\NobuActivation.exe" UNATTENDED
mRun: [StartCCC] "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
mRun: [AdobeCS4ServiceManager] "C:\Program Files (x86)\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe" -launchedbylogin
mRun: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
mRun: [SwitchBoard] C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe
mRun: [AdobeCS5ServiceManager] "C:\Program Files (x86)\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe" -launchedbylogin
mRun: [AdobeCS5.5ServiceManager] "C:\Program Files (x86)\Common Files\Adobe\CS5.5ServiceManager\CS5.5ServiceManager.exe" -launchedbylogin
mRun: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime
StartupFolder: C:\Users\MIDNIG~1\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\OPENOF~1.LNK - C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe
StartupFolder: C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\Startup\MCAFEE~1.LNK - C:\Program Files (x86)\McAfee Security Scan\2.0.181\SSScheduler.exe
mPolicies-explorer: NoActiveDesktop = 1 (0x1)
mPolicies-explorer: NoActiveDesktopChanges = 1 (0x1)
mPolicies-system: ConsentPromptBehaviorAdmin = 5 (0x5)
mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3)
mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
IE: E&xport to Microsoft Excel - C:\PROGRA~2\MICROS~1\Office12\EXCEL.EXE/3000
IE: Google Sidewiki... - C:\Program Files (x86)\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_E11712C84EA7E12B.dll/cmsidewiki.html
IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - C:\PROGRA~2\MICROS~1\Office12\ONBttnIE.dll
IE: {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - C:\PROGRA~2\MICROS~1\Office12\REFIEBAR.DLL
LSP: mswsock.dll
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab
TCP: DhcpNameServer = 192.168.1.254
TCP: Interfaces\{98E60A81-E364-4AE1-93D3-2372EABF7DF9} : DhcpNameServer = 192.168.1.254
TCP: Interfaces\{98E60A81-E364-4AE1-93D3-2372EABF7DF9}\452554E444E65647635323 : DhcpNameServer = 192.168.10.1
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
Handler: symres - {AA1061FE-6C41-421f-9344-69640C9732AB} - C:\Program Files (x86)\Norton Internet Security\Engine\16.8.3.6\CoIEPlg.dll
Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files (x86)\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll
Notify: klartew - C:\Windows\system32\config\systemprofile\AppData\Local\klartew.dll
SubSystems: Windows = basesrv,1 winsrv:UserServerDllInitialization,3 consrv:ConServerDllInitialization,2 sxssrv,4
BHO-X64: Adobe PDF Link Helper: {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
BHO-X64: AcroIEHelperStub - No File
BHO-X64: Symantec NCO BHO: {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files (x86)\Norton Internet Security\Engine\16.8.3.6\coIEPlg.dll
BHO-X64: Symantec NCO BHO - No File
BHO-X64: Symantec Intrusion Prevention: {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files (x86)\Norton Internet Security\Engine\16.8.3.6\IPSBHO.DLL
BHO-X64: Symantec Intrusion Prevention - No File
BHO-X64: Windows Live ID Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
BHO-X64: Skype Browser Helper: {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
BHO-X64: SkypeIEPluginBHO - No File
BHO-X64: Java™ Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll
TB-X64: Norton Toolbar: {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton Internet Security\Engine\16.8.3.6\coIEPlg.dll
mRun-x64: [LManager] C:\Program Files (x86)\Launch Manager\LManager.exe
mRun-x64: [Adobe Reader Speed Launcher] "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe"
mRun-x64: [NortonOnlineBackupReminder] "C:\Program Files (x86)\Symantec\Norton Online Backup\Activation\NobuActivation.exe" UNATTENDED
mRun-x64: [StartCCC] "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
mRun-x64: [AdobeCS4ServiceManager] "C:\Program Files (x86)\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe" -launchedbylogin
mRun-x64: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
mRun-x64: [SwitchBoard] C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe
mRun-x64: [AdobeCS5ServiceManager] "C:\Program Files (x86)\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe" -launchedbylogin
mRun-x64: [AdobeCS5.5ServiceManager] "C:\Program Files (x86)\Common Files\Adobe\CS5.5ServiceManager\CS5.5ServiceManager.exe" -launchedbylogin
mRun-x64: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime
.
================= FIREFOX ===================
.
FF - ProfilePath - C:\Users\Midnight Mistress\AppData\Roaming\Mozilla\Firefox\Profiles\1m3fs8fu.default\
FF - prefs.js: browser.startup.homepage - hxxp://homepage.emachines.com/rdr.aspx?b=ACEW&l=0409&m=e627&r=273608101005l04h4z125r44j2393o
FF - prefs.js: network.proxy.http - 127.0.0.1
FF - prefs.js: network.proxy.http_port - 62808
FF - prefs.js: network.proxy.type - 0
FF - component: C:\Program Files (x86)\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}\components\SkypeFfComponent.dll
FF - plugin: C:\Program Files (x86)\Google\Update\1.3.21.79\npGoogleUpdate3.dll
FF - plugin: C:\Program Files (x86)\Java\jre6\bin\new_plugin\npdeployJava1.dll
FF - plugin: C:\Program Files (x86)\Mozilla Firefox\plugins\npclntax_ClickPotatoLiteSA.dll
FF - plugin: C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll
FF - plugin: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll
FF - plugin: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - C:\Program Files (x86)\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}
FF - Ext: Skype Click to Call: {82AF8DCA-6DE9-405D-BD5E-43525BDAD38A} - C:\Program Files (x86)\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}
FF - Ext: Adblock Plus: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d} - %profile%\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}
FF - Ext: Memory Fox: {E173B749-DB5B-4fd2-BA0E-94ECEA0CA55B} - %profile%\extensions\{E173B749-DB5B-4fd2-BA0E-94ECEA0CA55B}
FF - Ext: NoScript: {73a6fe31-595d-460b-a920-fcc0f8843232} - %profile%\extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}
.
============= SERVICES / DRIVERS ===============
.
R0 SymEFA;Symantec Extended File Attributes;C:\Windows\system32\drivers\NISx64\1008030.006\SYMEFA64.SYS --> C:\Windows\system32\drivers\NISx64\1008030.006\SYMEFA64.SYS [?]
R1 BHDrvx64;Symantec Heuristics Driver;C:\Windows\system32\Drivers\NISx64\1008030.006\BHDrvx64.sys --> C:\Windows\system32\Drivers\NISx64\1008030.006\BHDrvx64.sys [?]
R1 ccHP;Symantec Hash Provider;C:\Windows\system32\Drivers\NISx64\1008030.006\ccHPx64.sys --> C:\Windows\system32\Drivers\NISx64\1008030.006\ccHPx64.sys [?]
R1 IDSVia64;IDSVia64;C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20101103.001\IDSviA64.sys [2010-10-19 476720]
R1 vwififlt;Virtual WiFi Filter Driver;C:\Windows\system32\DRIVERS\vwififlt.sys --> C:\Windows\system32\DRIVERS\vwififlt.sys [?]
R2 Akamai;Akamai NetSession Interface;C:\Windows\System32\svchost.exe -k Akamai [2009-7-13 20992]
R2 AMD External Events Utility;AMD External Events Utility;C:\Windows\system32\atiesrxx.exe --> C:\Windows\system32\atiesrxx.exe [?]
R2 ePowerSvc;Acer ePower Service;C:\Program Files\eMachines\eMachines Power Management\ePowerSvc.exe [2009-11-5 844320]
R2 Greg_Service;GRegService;C:\Program Files (x86)\eMachines\Registration\GregHSRW.exe [2009-8-28 1150496]
R2 Norton Internet Security;Norton Internet Security;C:\Program Files (x86)\Norton Internet Security\Engine\16.8.3.6\ccSvcHst.exe [2011-10-11 117648]
R2 NTISchedulerSvc;NTI Backup Now 5 Scheduler Service;C:\Program Files (x86)\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe [2009-6-17 144640]
R2 Updater Service;Updater Service;C:\Program Files\eMachines\eMachines Updater\UpdaterService.exe [2009-11-5 240160]
R3 EraserUtilRebootDrv;EraserUtilRebootDrv;C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [2010-9-15 132656]
R3 L1C;NDIS Miniport Driver for Atheros AR8131/AR8132 PCI-E Ethernet Controller (NDIS 6.20);C:\Windows\system32\DRIVERS\L1C62x64.sys --> C:\Windows\system32\DRIVERS\L1C62x64.sys [?]
R3 usbfilter;AMD USB Filter Driver;C:\Windows\system32\DRIVERS\usbfilter.sys --> C:\Windows\system32\DRIVERS\usbfilter.sys [?]
R3 vwifimp;Microsoft Virtual WiFi Miniport Service;C:\Windows\system32\DRIVERS\vwifimp.sys --> C:\Windows\system32\DRIVERS\vwifimp.sys [?]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]
S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-3-18 138576]
S2 gupdate;Google Update Service (gupdate);C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2010-8-31 135664]
S3 gupdatem;Google Update Service (gupdatem);C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2010-8-31 135664]
S3 McComponentHostService;McAfee Security Scan Component Host Service;C:\Program Files (x86)\McAfee Security Scan\2.0.181\McCHSvc.exe [2010-1-15 227232]
S3 npggsvc;nProtect GameGuard Service;C:\Windows\system32\GameMon.des -service --> C:\Windows\system32\GameMon.des -service [?]
S3 NTIBackupSvc;NTI Backup Now 5 Backup Service;C:\Program Files (x86)\NewTech Infosystems\NTI Backup Now 5\BackupSvc.exe [2009-6-17 50432]
S3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;C:\Windows\system32\Drivers\RtsUStor.sys --> C:\Windows\system32\Drivers\RtsUStor.sys [?]
S3 SwitchBoard;Adobe SwitchBoard;C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [2010-2-19 517096]
S3 USBAAPL64;Apple Mobile USB Driver;C:\Windows\system32\Drivers\usbaapl64.sys --> C:\Windows\system32\Drivers\usbaapl64.sys [?]
S3 WatAdminSvc;Windows Activation Technologies Service;C:\Windows\system32\Wat\WatAdminSvc.exe --> C:\Windows\system32\Wat\WatAdminSvc.exe [?]
.
=============== Created Last 30 ================
.
2011-11-30 02:11:20 69000 ----a-w- C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{0011FA8D-6FBB-49A6-BABF-68D2F063BDBC}\offreg.dll
2011-11-30 02:11:11 8570192 ----a-w- C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{0011FA8D-6FBB-49A6-BABF-68D2F063BDBC}\mpengine.dll
2011-11-29 06:15:38 -------- d--h--w- C:\ProgramData\Common Files
2011-11-29 06:12:49 -------- d-----w- C:\Windows\SysWow64\drivers\AVG
2011-11-29 06:11:35 -------- d-----w- C:\ProgramData\AVG2012
2011-11-29 05:36:20 -------- d-----w- C:\Users\Midnight Mistress\AppData\Roaming\Malwarebytes
2011-11-29 05:36:00 -------- d-----w- C:\ProgramData\Malwarebytes
2011-11-29 05:35:56 25416 ----a-w- C:\Windows\System32\drivers\mbam.sys
2011-11-29 05:35:56 -------- d-----w- C:\Program Files (x86)\Malwarebytes' Anti-Malware
2011-11-29 05:35:19 -------- d-----w- C:\ProgramData\MFAData
2011-11-28 07:45:24 -------- d-----w- C:\Users\Midnight Mistress\AppData\Local\{F6D58509-EB60-4089-AF6E-2BB2B7E11DDB}
2011-11-28 05:44:43 -------- d-----w- C:\Users\Midnight Mistress\AppData\Local\{6F46F398-6339-4BC3-981B-B02309073DE6}
2011-11-28 05:44:42 -------- d-----w- C:\Users\Midnight Mistress\AppData\Local\{FB995FF2-11C0-4A43-BB0F-2461192D85B1}
2011-11-27 13:07:40 111616 ----a-w- C:\Windows\SysWow64\j4066k2to.com
2011-11-27 12:08:06 111616 ----a-w- C:\Windows\SysWow64\j4066k2to.com_
2011-11-27 11:56:43 -------- d-----we C:\Windows\system64
2011-11-10 07:06:03 886784 ----a-w- C:\Program Files\Common Files\System\wab32.dll
2011-11-10 07:06:03 708608 ----a-w- C:\Program Files (x86)\Common Files\System\wab32.dll
2011-11-10 07:05:59 1897328 ----a-w- C:\Windows\System32\drivers\tcpip.sys
2011-11-10 07:05:54 3141120 ----a-w- C:\Windows\System32\win32k.sys
2011-11-10 06:48:27 -------- d-----w- C:\Users\Midnight Mistress\AppData\Local\Akamai
.
==================== Find3M ====================
.
2011-10-11 08:41:31 561800 ----a-w- C:\Windows\System32\drivers\NISx64\1008030.006\cchpx64.sys
2011-10-01 03:21:20 1638912 ----a-w- C:\Windows\System32\mshtml.tlb
2011-10-01 02:59:14 1638912 ----a-w- C:\Windows\SysWow64\mshtml.tlb
2011-09-22 00:35:58 56952 ----a-w- C:\Windows\System32\drivers\NISx64\1008030.006\symndisv.sys
2011-09-22 00:35:58 44152 ----a-w- C:\Windows\System32\drivers\NISx64\1008030.006\symndis.sys
2011-09-22 00:35:58 43640 ----a-w- C:\Windows\System32\drivers\NISx64\1008030.006\symids.sys
2011-09-22 00:35:58 279160 ----a-w- C:\Windows\System32\drivers\NISx64\1008030.006\symtdi.sys
2011-09-22 00:35:58 120952 ----a-w- C:\Windows\System32\drivers\NISx64\1008030.006\symfw.sys
.
============= FINISH: 9:12:52.16 ===============


Many thanks!

Faerin

BC AdBot (Login to Remove)

 


#2 SweetTech

SweetTech

    Agent ST


  • Members
  • 13,421 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Antarctica
  • Local time:12:26 PM

Posted 02 December 2011 - 03:36 AM

Hello and welcome to the forums!

My secret agent name on the forums is SweetTech (you can call me Agent ST for short), it's a pleasure to meet you. :)

I am very sorry for the delay in responding, but as you can see we are at the moment being flooded with logs which, when paired with the never-ending shortage of helpers, resulted in the delayed responding to your thread.

I would be glad to take a look at your log and help you with solving any malware problems.

If you have since resolved the issues you were originally experiencing, or have received help elsewhere, please inform me so that this topic can be closed.

If you have not, please adhere to the guidelines below and then follow instructions as outlined further below:


  • Logs from malware removal programs (OTL is one of them) can take some time to analyze. I need you to be patient while I analyze any logs you post. Please remember, I am a volunteer, and I do have a life outside of these forums.
  • Please make sure to carefully read any instruction that I give you. Attention to detail is important! Since I cannot see or directly interact with your computer I am dependent on you to "be my eyes" and provide as much information as you can regarding the current state of your computer.
  • If you're not sure, or if something unexpected happens, do NOT continue! Stop and ask!
  • In Windows Vista and Windows 7, all tools need to be started by right clicking and selecting Run as Administrator!
  • If I instruct you to download a specific tool in which you already have, please delete the copy that you have and re-download the tool. The reason I ask you to do this is because these tools are updated fairly regularly.
  • Do not do things I do not ask for, such as running a spyware scan on your computer. The one thing that you should always do, is to make sure sure that your anti-virus definitions are up-to-date!
  • Please do not use the Attachment feature for any log file. Do a Copy/Paste of the entire contents of the log file and submit it inside your post.
  • I am going to stick with you until ALL malware is gone from your system. I would appreciate it if you would do the same. From this point, we're in this together ;)
    Because of this, you must reply within three days
    failure to reply will result in the topic being closed!
  • Lastly, I am no magician. I will try very hard to fix your issues, but no promises can be made. Also be aware that some infections are so severe that you might need to resort to reformatting and reinstalling your operating system.
    Don't worry, this only happens in severe cases, but it sadly does happen. Be prepared to back up your data. Have means of backing up your data available.

____________________________________________________

Looks like you maybe infected with an infection known as ZeroAccess.

Running TDSSKiller

Download the latest version of TDSSKiller from here and save it to your Desktop.


  • Doubleclick on TDSSKiller.exe to run the application, then click on Change parameters.

    Posted Image
  • Check the boxes beside Verify Driver Digital Signature and Detect TDLFS file system, then click OK.

    Posted Image
  • Click the Start Scan button.

    Posted Image
  • If a suspicious object is detected, the default action will be Skip, click on Continue.

    Posted Image
  • If malicious objects are found, they will show in the Scan results and offer three (3) options.
  • Ensure SKIP is selected, then click Continue => Reboot now to finish the cleaning process.

    Posted Image
  • Note: Do not choose Delete unless instructed.

A report will be created in your root directory, (usually C:\ folder) in the form of "TDSSKiller.[Version]_[Date]_[Time]_log.txt". Please copy and paste its contents on your next reply.



NEXT:



OTS Scan
Download OTS to your Desktop
  • Double-click on OTS.exe to start the program. Make sure you close all other programs.
  • Now click the Run Scan button on the toolbar. Make sure not to use the PC while the program is running or it will freeze.
  • When the scan is complete Notepad will open with the report file loaded in it.
  • Please copy and paste the contents of the OTS report into your next reply.


NEXT:



What issues are you currently experiencing with your computer?

Have I helped you? If you'd like to assist in the fight against malware, click here Posted Image


The instructions seen in this post have been specifically tailored to this user and the issues they are experiencing with their computer. If you think you have a similar problem, please first read this topic, and then begin your own, new thread. I do not offer private support via Private Message.


#3 Faerin

Faerin
  • Topic Starter

  • Members
  • 7 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:Cleveland, OH
  • Local time:11:26 AM

Posted 02 December 2011 - 05:19 AM

Hello there Agent ST! :) It's a pleasure meeting you as well. No worries for the delayed response -- I see how many threads there are to get to in such a short amount of time, and of course you all have other things going on, so it's totally understandable. I downloaded and ran TDSSKiller, and it came back with no threats. Following are the logs saved from both that and OTS.

Also, as for the issues I'm having, they're pretty much the same issues as when I posted this topic. If I didn't have the NoScript add-on for Firefox enabled right now, every time I clicked on a search result, it would look like it's going to load the right page but then redirect me somewhere else, sometimes completely unrelated. Having the add-on enabled stops it from doing that for the time being so that I'm still able to browse without getting redirected. I am still sometimes getting new windows popping up with three or so tabs open on it. I'm not exactly sure what the tabs are trying to open, because usually they're all a "page could not be opened" or some such error.

Thank you so much for your aiding me in trying to get this problem fixed! :)


04:56:32.0735 1136 TDSS rootkit removing tool 2.6.21.0 Nov 24 2011 12:32:44
04:56:32.0922 1136 ============================================================
04:56:32.0922 1136 Current date / time: 2011/12/02 04:56:32.0922
04:56:32.0922 1136 SystemInfo:
04:56:32.0922 1136
04:56:32.0922 1136 OS Version: 6.1.7600 ServicePack: 0.0
04:56:32.0922 1136 Product type: Workstation
04:56:32.0922 1136 ComputerName: MIDNIGHT-PC
04:56:32.0922 1136 UserName: Midnight Mistress
04:56:32.0922 1136 Windows directory: C:\Windows
04:56:32.0922 1136 System windows directory: C:\Windows
04:56:32.0922 1136 Running under WOW64
04:56:32.0922 1136 Processor architecture: Intel x64
04:56:32.0922 1136 Number of processors: 1
04:56:32.0922 1136 Page size: 0x1000
04:56:32.0922 1136 Boot type: Normal boot
04:56:32.0922 1136 ============================================================
04:56:33.0905 1136 Initialize success
04:56:40.0909 3088 ============================================================
04:56:40.0909 3088 Scan started
04:56:40.0909 3088 Mode: Manual; SigCheck; TDLFS;
04:56:40.0909 3088 ============================================================
04:56:42.0095 3088 1394ohci (1b00662092f9f9568b995902f0cc40d5) C:\Windows\system32\DRIVERS\1394ohci.sys
04:56:42.0173 3088 1394ohci - ok
04:56:42.0235 3088 ACPI (6f11e88748cdefd2f76aa215f97ddfe5) C:\Windows\system32\DRIVERS\ACPI.sys
04:56:42.0267 3088 ACPI - ok
04:56:42.0469 3088 AcpiPmi (63b05a0420ce4bf0e4af6dcc7cada254) C:\Windows\system32\DRIVERS\acpipmi.sys
04:56:42.0501 3088 AcpiPmi - ok
04:56:42.0547 3088 adp94xx (2f6b34b83843f0c5118b63ac634f5bf4) C:\Windows\system32\DRIVERS\adp94xx.sys
04:56:42.0579 3088 adp94xx - ok
04:56:42.0625 3088 adpahci (597f78224ee9224ea1a13d6350ced962) C:\Windows\system32\DRIVERS\adpahci.sys
04:56:42.0657 3088 adpahci - ok
04:56:42.0688 3088 adpu320 (e109549c90f62fb570b9540c4b148e54) C:\Windows\system32\DRIVERS\adpu320.sys
04:56:42.0703 3088 adpu320 - ok
04:56:42.0813 3088 AFD (6ef20ddf3172e97d69f596fb90602f29) C:\Windows\system32\drivers\afd.sys
04:56:42.0844 3088 AFD - ok
04:56:42.0875 3088 agp440 (608c14dba7299d8cb6ed035a68a15799) C:\Windows\system32\DRIVERS\agp440.sys
04:56:42.0891 3088 agp440 - ok
04:56:42.0953 3088 aliide (5812713a477a3ad7363c7438ca2ee038) C:\Windows\system32\DRIVERS\aliide.sys
04:56:42.0969 3088 aliide - ok
04:56:43.0015 3088 amdide (1ff8b4431c353ce385c875f194924c0c) C:\Windows\system32\DRIVERS\amdide.sys
04:56:43.0031 3088 amdide - ok
04:56:43.0093 3088 AmdK8 (7024f087cff1833a806193ef9d22cda9) C:\Windows\system32\DRIVERS\amdk8.sys
04:56:43.0125 3088 AmdK8 - ok
04:56:43.0171 3088 AmdPPM (1e56388b3fe0d031c44144eb8c4d6217) C:\Windows\system32\DRIVERS\amdppm.sys
04:56:43.0187 3088 AmdPPM - ok
04:56:43.0281 3088 amdsata (ec7ebab00a4d8448bab68d1e49b4beb9) C:\Windows\system32\drivers\amdsata.sys
04:56:43.0312 3088 amdsata - ok
04:56:43.0374 3088 amdsbs (f67f933e79241ed32ff46a4f29b5120b) C:\Windows\system32\DRIVERS\amdsbs.sys
04:56:43.0390 3088 amdsbs - ok
04:56:43.0437 3088 amdxata (db27766102c7bf7e95140a2aa81d042e) C:\Windows\system32\drivers\amdxata.sys
04:56:43.0452 3088 amdxata - ok
04:56:43.0483 3088 AppID (42fd751b27fa0e9c69bb39f39e409594) C:\Windows\system32\drivers\appid.sys
04:56:43.0515 3088 AppID - ok
04:56:43.0561 3088 arc (c484f8ceb1717c540242531db7845c4e) C:\Windows\system32\DRIVERS\arc.sys
04:56:43.0593 3088 arc - ok
04:56:43.0624 3088 arcsas (019af6924aefe7839f61c830227fe79c) C:\Windows\system32\DRIVERS\arcsas.sys
04:56:43.0639 3088 arcsas - ok
04:56:43.0717 3088 AsyncMac (769765ce2cc62867468cea93969b2242) C:\Windows\system32\DRIVERS\asyncmac.sys
04:56:43.0764 3088 AsyncMac - ok
04:56:43.0811 3088 atapi (02062c0b390b7729edc9e69c680a6f3c) C:\Windows\system32\DRIVERS\atapi.sys
04:56:43.0827 3088 atapi - ok
04:56:44.0045 3088 atikmdag (2db9047aac9d981f59ce06d04d70c4d8) C:\Windows\system32\DRIVERS\atikmdag.sys
04:56:44.0185 3088 atikmdag - ok
04:56:44.0263 3088 AtiPcie (7c5d273e29dcc5505469b299c6f29163) C:\Windows\system32\DRIVERS\AtiPcie.sys
04:56:44.0295 3088 AtiPcie - ok
04:56:44.0404 3088 b06bdrv (3e5b191307609f7514148c6832bb0842) C:\Windows\system32\DRIVERS\bxvbda.sys
04:56:44.0435 3088 b06bdrv - ok
04:56:44.0497 3088 b57nd60a (b5ace6968304a3900eeb1ebfd9622df2) C:\Windows\system32\DRIVERS\b57nd60a.sys
04:56:44.0529 3088 b57nd60a - ok
04:56:44.0794 3088 BCM43XX (b44879610f2dc4a046b14befa3ae72de) C:\Windows\system32\DRIVERS\bcmwl664.sys
04:56:44.0872 3088 BCM43XX - ok
04:56:44.0919 3088 Beep (16a47ce2decc9b099349a5f840654746) C:\Windows\system32\drivers\Beep.sys
04:56:44.0965 3088 Beep - ok
04:56:45.0137 3088 BHDrvx64 (4d7f8401eae7eaa4ef702fa6f4153269) C:\Windows\System32\Drivers\NISx64\1008030.006\BHDrvx64.sys
04:56:45.0168 3088 BHDrvx64 - ok
04:56:45.0231 3088 bjoxgftv - ok
04:56:45.0277 3088 blbdrive (61583ee3c3a17003c4acd0475646b4d3) C:\Windows\system32\DRIVERS\blbdrive.sys
04:56:45.0293 3088 blbdrive - ok
04:56:45.0371 3088 bowser (19d20159708e152267e53b66677a4995) C:\Windows\system32\DRIVERS\bowser.sys
04:56:45.0387 3088 bowser - ok
04:56:45.0418 3088 BrFiltLo (f09eee9edc320b5e1501f749fde686c8) C:\Windows\system32\DRIVERS\BrFiltLo.sys
04:56:45.0449 3088 BrFiltLo - ok
04:56:45.0480 3088 BrFiltUp (b114d3098e9bdb8bea8b053685831be6) C:\Windows\system32\DRIVERS\BrFiltUp.sys
04:56:45.0496 3088 BrFiltUp - ok
04:56:45.0543 3088 Brserid (43bea8d483bf1870f018e2d02e06a5bd) C:\Windows\System32\Drivers\Brserid.sys
04:56:45.0574 3088 Brserid - ok
04:56:45.0621 3088 BrSerWdm (a6eca2151b08a09caceca35c07f05b42) C:\Windows\System32\Drivers\BrSerWdm.sys
04:56:45.0636 3088 BrSerWdm - ok
04:56:45.0683 3088 BrUsbMdm (b79968002c277e869cf38bd22cd61524) C:\Windows\System32\Drivers\BrUsbMdm.sys
04:56:45.0699 3088 BrUsbMdm - ok
04:56:45.0745 3088 BrUsbSer (a87528880231c54e75ea7a44943b38bf) C:\Windows\System32\Drivers\BrUsbSer.sys
04:56:45.0761 3088 BrUsbSer - ok
04:56:45.0823 3088 BTHMODEM (9da669f11d1f894ab4eb69bf546a42e8) C:\Windows\system32\DRIVERS\bthmodem.sys
04:56:45.0855 3088 BTHMODEM - ok
04:56:46.0026 3088 ccHP (a2e6ab452b9393ca8d11d28827e0e1a1) C:\Windows\System32\Drivers\NISx64\1008030.006\ccHPx64.sys
04:56:46.0073 3088 ccHP - ok
04:56:46.0120 3088 cdfs (b8bd2bb284668c84865658c77574381a) C:\Windows\system32\DRIVERS\cdfs.sys
04:56:46.0167 3088 cdfs - ok
04:56:46.0229 3088 cdrom (83d2d75e1efb81b3450c18131443f7db) C:\Windows\system32\DRIVERS\cdrom.sys
04:56:46.0245 3088 cdrom - ok
04:56:46.0323 3088 circlass (d7cd5c4e1b71fa62050515314cfb52cf) C:\Windows\system32\DRIVERS\circlass.sys
04:56:46.0354 3088 circlass - ok
04:56:46.0401 3088 CLFS (fe1ec06f2253f691fe36217c592a0206) C:\Windows\system32\CLFS.sys
04:56:46.0432 3088 CLFS - ok
04:56:46.0510 3088 CmBatt (0840155d0bddf1190f84a663c284bd33) C:\Windows\system32\DRIVERS\CmBatt.sys
04:56:46.0541 3088 CmBatt - ok
04:56:46.0572 3088 cmdide (e19d3f095812725d88f9001985b94edd) C:\Windows\system32\DRIVERS\cmdide.sys
04:56:46.0588 3088 cmdide - ok
04:56:46.0635 3088 CNG (f95fd4cb7da00ba2a63ce9f6b5c053e1) C:\Windows\system32\Drivers\cng.sys
04:56:46.0666 3088 CNG - ok
04:56:46.0713 3088 Compbatt (102de219c3f61415f964c88e9085ad14) C:\Windows\system32\DRIVERS\compbatt.sys
04:56:46.0728 3088 Compbatt - ok
04:56:46.0759 3088 CompositeBus (f26b3a86f6fa87ca360b879581ab4123) C:\Windows\system32\DRIVERS\CompositeBus.sys
04:56:46.0775 3088 CompositeBus - ok
04:56:46.0806 3088 crcdisk (1c827878a998c18847245fe1f34ee597) C:\Windows\system32\DRIVERS\crcdisk.sys
04:56:46.0822 3088 crcdisk - ok
04:56:46.0931 3088 DfsC (9c253ce7311ca60fc11c774692a13208) C:\Windows\system32\Drivers\dfsc.sys
04:56:46.0947 3088 DfsC - ok
04:56:46.0978 3088 discache (13096b05847ec78f0977f2c0f79e9ab3) C:\Windows\system32\drivers\discache.sys
04:56:47.0040 3088 discache - ok
04:56:47.0103 3088 Disk (9819eee8b5ea3784ec4af3b137a5244c) C:\Windows\system32\DRIVERS\disk.sys
04:56:47.0118 3088 Disk - ok
04:56:47.0243 3088 DKbFltr (d5bcb77be83cf99f508943945d46343d) C:\Windows\SysWOW64\Drivers\DKbFltr.sys
04:56:47.0274 3088 DKbFltr - ok
04:56:47.0321 3088 drmkaud (9b19f34400d24df84c858a421c205754) C:\Windows\system32\drivers\drmkaud.sys
04:56:47.0352 3088 drmkaud - ok
04:56:47.0493 3088 dump_wmimmc - ok
04:56:47.0586 3088 DXGKrnl (1633b9abf52784a1331476397a48cbef) C:\Windows\System32\drivers\dxgkrnl.sys
04:56:47.0617 3088 DXGKrnl - ok
04:56:47.0773 3088 ebdrv (dc5d737f51be844d8c82c695eb17372f) C:\Windows\system32\DRIVERS\evbda.sys
04:56:47.0836 3088 ebdrv - ok
04:56:47.0914 3088 eeCtrl (066108ae4c35835081598827a1a7d08d) C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys
04:56:47.0945 3088 eeCtrl - ok
04:56:47.0992 3088 ehvkvdtc - ok
04:56:48.0054 3088 elxstor (0e5da5369a0fcaea12456dd852545184) C:\Windows\system32\DRIVERS\elxstor.sys
04:56:48.0085 3088 elxstor - ok
04:56:48.0148 3088 EraserUtilRebootDrv (12866876e3851f1e5d462b2a83e25578) C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys
04:56:48.0179 3088 EraserUtilRebootDrv - ok
04:56:48.0210 3088 ErrDev (34a3c54752046e79a126e15c51db409b) C:\Windows\system32\DRIVERS\errdev.sys
04:56:48.0226 3088 ErrDev - ok
04:56:48.0304 3088 exfat (a510c654ec00c1e9bdd91eeb3a59823b) C:\Windows\system32\drivers\exfat.sys
04:56:48.0366 3088 exfat - ok
04:56:48.0397 3088 fastfat (0adc83218b66a6db380c330836f3e36d) C:\Windows\system32\drivers\fastfat.sys
04:56:48.0460 3088 fastfat - ok
04:56:48.0522 3088 fdc (d765d19cd8ef61f650c384f62fac00ab) C:\Windows\system32\DRIVERS\fdc.sys
04:56:48.0538 3088 fdc - ok
04:56:48.0585 3088 FileInfo (655661be46b5f5f3fd454e2c3095b930) C:\Windows\system32\drivers\fileinfo.sys
04:56:48.0600 3088 FileInfo - ok
04:56:48.0631 3088 Filetrace (5f671ab5bc87eea04ec38a6cd5962a47) C:\Windows\system32\drivers\filetrace.sys
04:56:48.0678 3088 Filetrace - ok
04:56:48.0741 3088 flpydisk (c172a0f53008eaeb8ea33fe10e177af5) C:\Windows\system32\DRIVERS\flpydisk.sys
04:56:48.0756 3088 flpydisk - ok
04:56:48.0803 3088 FltMgr (f7866af72abbaf84b1fa5aa195378c59) C:\Windows\system32\drivers\fltmgr.sys
04:56:48.0819 3088 FltMgr - ok
04:56:48.0865 3088 FsDepends (d43703496149971890703b4b1b723eac) C:\Windows\system32\drivers\FsDepends.sys
04:56:48.0881 3088 FsDepends - ok
04:56:48.0912 3088 Fs_Rec (e95ef8547de20cf0603557c0cf7a9462) C:\Windows\system32\drivers\Fs_Rec.sys
04:56:48.0928 3088 Fs_Rec - ok
04:56:48.0975 3088 fvevol (ae87ba80d0ec3b57126ed2cdc15b24ed) C:\Windows\system32\DRIVERS\fvevol.sys
04:56:48.0990 3088 fvevol - ok
04:56:49.0053 3088 gagp30kx (8c778d335c9d272cfd3298ab02abe3b6) C:\Windows\system32\DRIVERS\gagp30kx.sys
04:56:49.0068 3088 gagp30kx - ok
04:56:49.0224 3088 hcw85cir (f2523ef6460fc42405b12248338ab2f0) C:\Windows\system32\drivers\hcw85cir.sys
04:56:49.0240 3088 hcw85cir - ok
04:56:49.0318 3088 HdAudAddService (6410f6f415b2a5a9037224c41da8bf12) C:\Windows\system32\drivers\HdAudio.sys
04:56:49.0349 3088 HdAudAddService - ok
04:56:49.0380 3088 HDAudBus (0a49913402747a0b67de940fb42cbdbb) C:\Windows\system32\DRIVERS\HDAudBus.sys
04:56:49.0411 3088 HDAudBus - ok
04:56:49.0458 3088 HidBatt (78e86380454a7b10a5eb255dc44a355f) C:\Windows\system32\DRIVERS\HidBatt.sys
04:56:49.0474 3088 HidBatt - ok
04:56:49.0521 3088 HidBth (7fd2a313f7afe5c4dab14798c48dd104) C:\Windows\system32\DRIVERS\hidbth.sys
04:56:49.0536 3088 HidBth - ok
04:56:49.0567 3088 HidIr (0a77d29f311b88cfae3b13f9c1a73825) C:\Windows\system32\DRIVERS\hidir.sys
04:56:49.0599 3088 HidIr - ok
04:56:49.0645 3088 HidUsb (b3bf6b5b50006def50b66306d99fcf6f) C:\Windows\system32\DRIVERS\hidusb.sys
04:56:49.0677 3088 HidUsb - ok
04:56:49.0739 3088 HpSAMD (0886d440058f203eba0e1825e4355914) C:\Windows\system32\DRIVERS\HpSAMD.sys
04:56:49.0755 3088 HpSAMD - ok
04:56:49.0786 3088 HTTP (cee049cac4efa7f4e1e4ad014414a5d4) C:\Windows\system32\drivers\HTTP.sys
04:56:49.0864 3088 HTTP - ok
04:56:49.0895 3088 hwpolicy (f17766a19145f111856378df337a5d79) C:\Windows\system32\drivers\hwpolicy.sys
04:56:49.0911 3088 hwpolicy - ok
04:56:49.0942 3088 i8042prt (fa55c73d4affa7ee23ac4be53b4592d3) C:\Windows\system32\DRIVERS\i8042prt.sys
04:56:49.0957 3088 i8042prt - ok
04:56:50.0020 3088 iaStorV (b75e45c564e944a2657167d197ab29da) C:\Windows\system32\drivers\iaStorV.sys
04:56:50.0051 3088 iaStorV - ok
04:56:50.0207 3088 IDSVia64 (5b6fde76d72c2a1f0f99cbe5277e82ec) C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\ipsdefs\20101103.001\IDSvia64.sys
04:56:50.0238 3088 IDSVia64 - ok
04:56:50.0285 3088 iirsp (5c18831c61933628f5bb0ea2675b9d21) C:\Windows\system32\DRIVERS\iirsp.sys
04:56:50.0301 3088 iirsp - ok
04:56:50.0425 3088 IntcAzAudAddService (0c3cf4b3bae28e121a1689e3538f8712) C:\Windows\system32\drivers\RTKVHD64.sys
04:56:50.0488 3088 IntcAzAudAddService - ok
04:56:50.0535 3088 intelide (f00f20e70c6ec3aa366910083a0518aa) C:\Windows\system32\DRIVERS\intelide.sys
04:56:50.0550 3088 intelide - ok
04:56:50.0613 3088 intelppm (ada036632c664caa754079041cf1f8c1) C:\Windows\system32\DRIVERS\intelppm.sys
04:56:50.0659 3088 intelppm - ok
04:56:50.0722 3088 IpFilterDriver (722dd294df62483cecaae6e094b4d695) C:\Windows\system32\DRIVERS\ipfltdrv.sys
04:56:50.0784 3088 IpFilterDriver - ok
04:56:50.0815 3088 IPMIDRV (e2b4a4494db7cb9b89b55ca268c337c5) C:\Windows\system32\DRIVERS\IPMIDrv.sys
04:56:50.0831 3088 IPMIDRV - ok
04:56:50.0862 3088 IPNAT (af9b39a7e7b6caa203b3862582e9f2d0) C:\Windows\system32\drivers\ipnat.sys
04:56:50.0925 3088 IPNAT - ok
04:56:50.0987 3088 IRENUM (3abf5e7213eb28966d55d58b515d5ce9) C:\Windows\system32\drivers\irenum.sys
04:56:51.0003 3088 IRENUM - ok
04:56:51.0049 3088 isapnp (2f7b28dc3e1183e5eb418df55c204f38) C:\Windows\system32\DRIVERS\isapnp.sys
04:56:51.0065 3088 isapnp - ok
04:56:51.0096 3088 iScsiPrt (fa4d2557de56d45b0a346f93564be6e1) C:\Windows\system32\DRIVERS\msiscsi.sys
04:56:51.0127 3088 iScsiPrt - ok
04:56:51.0174 3088 kbdclass (bc02336f1cba7dcc7d1213bb588a68a5) C:\Windows\system32\DRIVERS\kbdclass.sys
04:56:51.0190 3088 kbdclass - ok
04:56:51.0237 3088 kbdhid (6def98f8541e1b5dceb2c822a11f7323) C:\Windows\system32\DRIVERS\kbdhid.sys
04:56:51.0252 3088 kbdhid - ok
04:56:51.0315 3088 KSecDD (e8b6fcc9c83535c67f835d407620bd27) C:\Windows\system32\Drivers\ksecdd.sys
04:56:51.0330 3088 KSecDD - ok
04:56:51.0377 3088 KSecPkg (a8c63880ef6f4d3fec7b616b9c060215) C:\Windows\system32\Drivers\ksecpkg.sys
04:56:51.0393 3088 KSecPkg - ok
04:56:51.0424 3088 ksthunk (6869281e78cb31a43e969f06b57347c4) C:\Windows\system32\drivers\ksthunk.sys
04:56:51.0486 3088 ksthunk - ok
04:56:51.0533 3088 L1C (2377ec4cc3e356655b996f39b43486b6) C:\Windows\system32\DRIVERS\L1C62x64.sys
04:56:51.0564 3088 L1C - ok
04:56:51.0627 3088 lltdio (1538831cf8ad2979a04c423779465827) C:\Windows\system32\DRIVERS\lltdio.sys
04:56:51.0673 3088 lltdio - ok
04:56:51.0751 3088 LSI_FC (1a93e54eb0ece102495a51266dcdb6a6) C:\Windows\system32\DRIVERS\lsi_fc.sys
04:56:51.0767 3088 LSI_FC - ok
04:56:51.0798 3088 LSI_SAS (1047184a9fdc8bdbff857175875ee810) C:\Windows\system32\DRIVERS\lsi_sas.sys
04:56:51.0814 3088 LSI_SAS - ok
04:56:51.0861 3088 LSI_SAS2 (30f5c0de1ee8b5bc9306c1f0e4a75f93) C:\Windows\system32\DRIVERS\lsi_sas2.sys
04:56:51.0876 3088 LSI_SAS2 - ok
04:56:51.0907 3088 LSI_SCSI (0504eacaff0d3c8aed161c4b0d369d4a) C:\Windows\system32\DRIVERS\lsi_scsi.sys
04:56:51.0923 3088 LSI_SCSI - ok
04:56:51.0970 3088 luafv (43d0f98e1d56ccddb0d5254cff7b356e) C:\Windows\system32\drivers\luafv.sys
04:56:52.0032 3088 luafv - ok
04:56:52.0110 3088 megasas (a55805f747c6edb6a9080d7c633bd0f4) C:\Windows\system32\DRIVERS\megasas.sys
04:56:52.0126 3088 megasas - ok
04:56:52.0188 3088 MegaSR (baf74ce0072480c3b6b7c13b2a94d6b3) C:\Windows\system32\DRIVERS\MegaSR.sys
04:56:52.0235 3088 MegaSR - ok
04:56:52.0297 3088 Modem (800ba92f7010378b09f9ed9270f07137) C:\Windows\system32\drivers\modem.sys
04:56:52.0360 3088 Modem - ok
04:56:52.0485 3088 monitor (b03d591dc7da45ece20b3b467e6aadaa) C:\Windows\system32\DRIVERS\monitor.sys
04:56:52.0516 3088 monitor - ok
04:56:52.0563 3088 mouclass (7d27ea49f3c1f687d357e77a470aea99) C:\Windows\system32\DRIVERS\mouclass.sys
04:56:52.0578 3088 mouclass - ok
04:56:52.0625 3088 mouhid (d3bf052c40b0c4166d9fd86a4288c1e6) C:\Windows\system32\DRIVERS\mouhid.sys
04:56:52.0656 3088 mouhid - ok
04:56:52.0687 3088 mountmgr (791af66c4d0e7c90a3646066386fb571) C:\Windows\system32\drivers\mountmgr.sys
04:56:52.0703 3088 mountmgr - ok
04:56:52.0734 3088 mpio (609d1d87649ecc19796f4d76d4c15cea) C:\Windows\system32\DRIVERS\mpio.sys
04:56:52.0750 3088 mpio - ok
04:56:52.0781 3088 mpsdrv (6c38c9e45ae0ea2fa5e551f2ed5e978f) C:\Windows\system32\drivers\mpsdrv.sys
04:56:52.0828 3088 mpsdrv - ok
04:56:52.0875 3088 MRxDAV (30524261bb51d96d6fcbac20c810183c) C:\Windows\system32\drivers\mrxdav.sys
04:56:52.0906 3088 MRxDAV - ok
04:56:52.0953 3088 mrxsmb (040d62a9d8ad28922632137acdd984f2) C:\Windows\system32\DRIVERS\mrxsmb.sys
04:56:52.0968 3088 mrxsmb - ok
04:56:53.0031 3088 mrxsmb10 (f0067552f8f9b33d7c59403ab808a3cb) C:\Windows\system32\DRIVERS\mrxsmb10.sys
04:56:53.0062 3088 mrxsmb10 - ok
04:56:53.0093 3088 mrxsmb20 (3c142d31de9f2f193218a53fe2632051) C:\Windows\system32\DRIVERS\mrxsmb20.sys
04:56:53.0109 3088 mrxsmb20 - ok
04:56:53.0140 3088 msahci (5c37497276e3b3a5488b23a326a754b7) C:\Windows\system32\DRIVERS\msahci.sys
04:56:53.0155 3088 msahci - ok
04:56:53.0202 3088 msdsm (8d27b597229aed79430fb9db3bcbfbd0) C:\Windows\system32\DRIVERS\msdsm.sys
04:56:53.0218 3088 msdsm - ok
04:56:53.0265 3088 Msfs (aa3fb40e17ce1388fa1bedab50ea8f96) C:\Windows\system32\drivers\Msfs.sys
04:56:53.0327 3088 Msfs - ok
04:56:53.0358 3088 mshidkmdf (f9d215a46a8b9753f61767fa72a20326) C:\Windows\System32\drivers\mshidkmdf.sys
04:56:53.0436 3088 mshidkmdf - ok
04:56:53.0467 3088 msisadrv (d916874bbd4f8b07bfb7fa9b3ccae29d) C:\Windows\system32\DRIVERS\msisadrv.sys
04:56:53.0467 3088 msisadrv - ok
04:56:53.0530 3088 MSKSSRV (49ccf2c4fea34ffad8b1b59d49439366) C:\Windows\system32\drivers\MSKSSRV.sys
04:56:53.0592 3088 MSKSSRV - ok
04:56:53.0639 3088 MSPCLOCK (bdd71ace35a232104ddd349ee70e1ab3) C:\Windows\system32\drivers\MSPCLOCK.sys
04:56:53.0701 3088 MSPCLOCK - ok
04:56:53.0733 3088 MSPQM (4ed981241db27c3383d72092b618a1d0) C:\Windows\system32\drivers\MSPQM.sys
04:56:53.0779 3088 MSPQM - ok
04:56:53.0826 3088 MsRPC (89cb141aa8616d8c6a4610fa26c60964) C:\Windows\system32\drivers\MsRPC.sys
04:56:53.0842 3088 MsRPC - ok
04:56:53.0889 3088 mssmbios (0eed230e37515a0eaee3c2e1bc97b288) C:\Windows\system32\DRIVERS\mssmbios.sys
04:56:53.0904 3088 mssmbios - ok
04:56:53.0935 3088 MSTEE (2e66f9ecb30b4221a318c92ac2250779) C:\Windows\system32\drivers\MSTEE.sys
04:56:53.0982 3088 MSTEE - ok
04:56:54.0029 3088 MTConfig (7ea404308934e675bffde8edf0757bcd) C:\Windows\system32\DRIVERS\MTConfig.sys
04:56:54.0045 3088 MTConfig - ok
04:56:54.0092 3088 Mup (f9a18612fd3526fe473c1bda678d61c8) C:\Windows\system32\Drivers\mup.sys
04:56:54.0107 3088 Mup - ok
04:56:54.0170 3088 NativeWifiP (1ea3749c4114db3e3161156ffffa6b33) C:\Windows\system32\DRIVERS\nwifi.sys
04:56:54.0201 3088 NativeWifiP - ok
04:56:54.0341 3088 NAVENG (956f589c6a7dde71dc6b03be633ebf23) C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20101105.003\ENG64.SYS
04:56:54.0372 3088 NAVENG - ok
04:56:54.0466 3088 NAVEX15 (ee7a0e2478e7cd1a199d1b82e3a69b3e) C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20101105.003\EX64.SYS
04:56:54.0513 3088 NAVEX15 - ok
04:56:54.0653 3088 NDIS (cad515dbd07d082bb317d9928ce8962c) C:\Windows\system32\drivers\ndis.sys
04:56:54.0700 3088 NDIS - ok
04:56:54.0762 3088 NdisCap (9f9a1f53aad7da4d6fef5bb73ab811ac) C:\Windows\system32\DRIVERS\ndiscap.sys
04:56:54.0809 3088 NdisCap - ok
04:56:54.0856 3088 NdisTapi (30639c932d9fef22b31268fe25a1b6e5) C:\Windows\system32\DRIVERS\ndistapi.sys
04:56:54.0918 3088 NdisTapi - ok
04:56:54.0950 3088 Ndisuio (f105ba1e22bf1f2ee8f005d4305e4bec) C:\Windows\system32\DRIVERS\ndisuio.sys
04:56:55.0012 3088 Ndisuio - ok
04:56:55.0028 3088 NdisWan (557dfab9ca1fcb036ac77564c010dad3) C:\Windows\system32\DRIVERS\ndiswan.sys
04:56:55.0090 3088 NdisWan - ok
04:56:55.0121 3088 NDProxy (659b74fb74b86228d6338d643cd3e3cf) C:\Windows\system32\drivers\NDProxy.sys
04:56:55.0184 3088 NDProxy - ok
04:56:55.0215 3088 NetBIOS (86743d9f5d2b1048062b14b1d84501c4) C:\Windows\system32\DRIVERS\netbios.sys
04:56:55.0262 3088 NetBIOS - ok
04:56:55.0293 3088 NetBT (9162b273a44ab9dce5b44362731d062a) C:\Windows\system32\DRIVERS\netbt.sys
04:56:55.0355 3088 NetBT - ok
04:56:55.0433 3088 nfrd960 (77889813be4d166cdab78ddba990da92) C:\Windows\system32\DRIVERS\nfrd960.sys
04:56:55.0449 3088 nfrd960 - ok
04:56:55.0496 3088 Npfs (1e4c4ab5c9b8dd13179bbdc75a2a01f7) C:\Windows\system32\drivers\Npfs.sys
04:56:55.0542 3088 Npfs - ok
04:56:55.0589 3088 NPPTNT2 - ok
04:56:55.0620 3088 nsiproxy (e7f5ae18af4168178a642a9247c63001) C:\Windows\system32\drivers\nsiproxy.sys
04:56:55.0683 3088 nsiproxy - ok
04:56:55.0808 3088 Ntfs (378e0e0dfea67d98ae6ea53adbbd76bc) C:\Windows\system32\drivers\Ntfs.sys
04:56:55.0886 3088 Ntfs - ok
04:56:55.0948 3088 NTIDrvr (64ddd0dee976302f4bd93e5efcc2f013) C:\Windows\system32\drivers\NTIDrvr.sys
04:56:55.0964 3088 NTIDrvr - ok
04:56:56.0010 3088 Null (9899284589f75fa8724ff3d16aed75c1) C:\Windows\system32\drivers\Null.sys
04:56:56.0057 3088 Null - ok
04:56:56.0135 3088 nvraid (a4d9c9a608a97f59307c2f2600edc6a4) C:\Windows\system32\drivers\nvraid.sys
04:56:56.0151 3088 nvraid - ok
04:56:56.0213 3088 nvstor (6c1d5f70e7a6a3fd1c90d840edc048b9) C:\Windows\system32\drivers\nvstor.sys
04:56:56.0229 3088 nvstor - ok
04:56:56.0276 3088 nv_agp (270d7cd42d6e3979f6dd0146650f0e05) C:\Windows\system32\DRIVERS\nv_agp.sys
04:56:56.0307 3088 nv_agp - ok
04:56:56.0338 3088 ohci1394 (3589478e4b22ce21b41fa1bfc0b8b8a0) C:\Windows\system32\DRIVERS\ohci1394.sys
04:56:56.0369 3088 ohci1394 - ok
04:56:56.0416 3088 Parport (0086431c29c35be1dbc43f52cc273887) C:\Windows\system32\DRIVERS\parport.sys
04:56:56.0432 3088 Parport - ok
04:56:56.0478 3088 partmgr (7daa117143316c4a1537e074a5a9eaf0) C:\Windows\system32\drivers\partmgr.sys
04:56:56.0494 3088 partmgr - ok
04:56:56.0525 3088 pci (f36f6504009f2fb0dfd1b17a116ad74b) C:\Windows\system32\DRIVERS\pci.sys
04:56:56.0541 3088 pci - ok
04:56:56.0572 3088 pciide (b5b8b5ef2e5cb34df8dcf8831e3534fa) C:\Windows\system32\DRIVERS\pciide.sys
04:56:56.0588 3088 pciide - ok
04:56:56.0634 3088 pcmcia (b2e81d4e87ce48589f98cb8c05b01f2f) C:\Windows\system32\DRIVERS\pcmcia.sys
04:56:56.0666 3088 pcmcia - ok
04:56:56.0697 3088 pcw (d6b9c2e1a11a3a4b26a182ffef18f603) C:\Windows\system32\drivers\pcw.sys
04:56:56.0712 3088 pcw - ok
04:56:56.0759 3088 PEAUTH (68769c3356b3be5d1c732c97b9a80d6e) C:\Windows\system32\drivers\peauth.sys
04:56:56.0822 3088 PEAUTH - ok
04:56:56.0931 3088 PptpMiniport (27cc19e81ba5e3403c48302127bda717) C:\Windows\system32\DRIVERS\raspptp.sys
04:56:56.0993 3088 PptpMiniport - ok
04:56:57.0040 3088 Processor (0d922e23c041efb1c3fac2a6f943c9bf) C:\Windows\system32\DRIVERS\processr.sys
04:56:57.0056 3088 Processor - ok
04:56:57.0149 3088 Psched (ee992183bd8eaefd9973f352e587a299) C:\Windows\system32\DRIVERS\pacer.sys
04:56:57.0212 3088 Psched - ok
04:56:57.0274 3088 ql2300 (a53a15a11ebfd21077463ee2c7afeef0) C:\Windows\system32\DRIVERS\ql2300.sys
04:56:57.0321 3088 ql2300 - ok
04:56:57.0352 3088 ql40xx (4f6d12b51de1aaeff7dc58c4d75423c8) C:\Windows\system32\DRIVERS\ql40xx.sys
04:56:57.0368 3088 ql40xx - ok
04:56:57.0414 3088 QWAVEdrv (76707bb36430888d9ce9d705398adb6c) C:\Windows\system32\drivers\qwavedrv.sys
04:56:57.0446 3088 QWAVEdrv - ok
04:56:57.0492 3088 RasAcd (5a0da8ad5762fa2d91678a8a01311704) C:\Windows\system32\DRIVERS\rasacd.sys
04:56:57.0539 3088 RasAcd - ok
04:56:57.0602 3088 RasAgileVpn (7ecff9b22276b73f43a99a15a6094e90) C:\Windows\system32\DRIVERS\AgileVpn.sys
04:56:57.0664 3088 RasAgileVpn - ok
04:56:57.0726 3088 Rasl2tp (87a6e852a22991580d6d39adc4790463) C:\Windows\system32\DRIVERS\rasl2tp.sys
04:56:57.0789 3088 Rasl2tp - ok
04:56:57.0820 3088 RasPppoe (855c9b1cd4756c5e9a2aa58a15f58c25) C:\Windows\system32\DRIVERS\raspppoe.sys
04:56:57.0882 3088 RasPppoe - ok
04:56:57.0929 3088 RasSstp (e8b1e447b008d07ff47d016c2b0eeecb) C:\Windows\system32\DRIVERS\rassstp.sys
04:56:57.0976 3088 RasSstp - ok
04:56:58.0023 3088 rdbss (3bac8142102c15d59a87757c1d41dce5) C:\Windows\system32\DRIVERS\rdbss.sys
04:56:58.0070 3088 rdbss - ok
04:56:58.0132 3088 rdpbus (302da2a0539f2cf54d7c6cc30c1f2d8d) C:\Windows\system32\DRIVERS\rdpbus.sys
04:56:58.0163 3088 rdpbus - ok
04:56:58.0194 3088 RDPCDD (cea6cc257fc9b7715f1c2b4849286d24) C:\Windows\system32\DRIVERS\RDPCDD.sys
04:56:58.0257 3088 RDPCDD - ok
04:56:58.0304 3088 RDPENCDD (bb5971a4f00659529a5c44831af22365) C:\Windows\system32\drivers\rdpencdd.sys
04:56:58.0350 3088 RDPENCDD - ok
04:56:58.0397 3088 RDPREFMP (216f3fa57533d98e1f74ded70113177a) C:\Windows\system32\drivers\rdprefmp.sys
04:56:58.0460 3088 RDPREFMP - ok
04:56:58.0491 3088 RDPWD (8a3e6bea1c53ea6177fe2b6eba2c80d7) C:\Windows\system32\drivers\RDPWD.sys
04:56:58.0553 3088 RDPWD - ok
04:56:58.0600 3088 rdyboost (634b9a2181d98f15941236886164ec8b) C:\Windows\system32\drivers\rdyboost.sys
04:56:58.0616 3088 rdyboost - ok
04:56:58.0694 3088 rspndr (ddc86e4f8e7456261e637e3552e804ff) C:\Windows\system32\DRIVERS\rspndr.sys
04:56:58.0740 3088 rspndr - ok
04:56:58.0818 3088 RSUSBSTOR (fb39af63d6617f028ba0ebc21b83360d) C:\Windows\system32\Drivers\RtsUStor.sys
04:56:58.0834 3088 RSUSBSTOR - ok
04:56:58.0896 3088 sbp2port (e3bbb89983daf5622c1d50cf49f28227) C:\Windows\system32\DRIVERS\sbp2port.sys
04:56:58.0912 3088 sbp2port - ok
04:56:58.0959 3088 scfilter (c94da20c7e3ba1dca269bc8460d98387) C:\Windows\system32\DRIVERS\scfilter.sys
04:56:59.0006 3088 scfilter - ok
04:56:59.0084 3088 secdrv (3ea8a16169c26afbeb544e0e48421186) C:\Windows\system32\drivers\secdrv.sys
04:56:59.0146 3088 secdrv - ok
04:56:59.0208 3088 Serenum (cb624c0035412af0debec78c41f5ca1b) C:\Windows\system32\DRIVERS\serenum.sys
04:56:59.0224 3088 Serenum - ok
04:56:59.0286 3088 Serial (c1d8e28b2c2adfaec4ba89e9fda69bd6) C:\Windows\system32\DRIVERS\serial.sys
04:56:59.0302 3088 Serial - ok
04:56:59.0318 3088 sermouse (1c545a7d0691cc4a027396535691c3e3) C:\Windows\system32\DRIVERS\sermouse.sys
04:56:59.0349 3088 sermouse - ok
04:56:59.0411 3088 sffdisk (a554811bcd09279536440c964ae35bbf) C:\Windows\system32\DRIVERS\sffdisk.sys
04:56:59.0442 3088 sffdisk - ok
04:56:59.0474 3088 sffp_mmc (ff414f0baefeba59bc6c04b3db0b87bf) C:\Windows\system32\DRIVERS\sffp_mmc.sys
04:56:59.0505 3088 sffp_mmc - ok
04:56:59.0520 3088 sffp_sd (5588b8c6193eb1522490c122eb94dffa) C:\Windows\system32\DRIVERS\sffp_sd.sys
04:56:59.0552 3088 sffp_sd - ok
04:56:59.0567 3088 sfloppy (a9d601643a1647211a1ee2ec4e433ff4) C:\Windows\system32\DRIVERS\sfloppy.sys
04:56:59.0583 3088 sfloppy - ok
04:56:59.0661 3088 SiSRaid2 (843caf1e5fde1ffd5ff768f23a51e2e1) C:\Windows\system32\DRIVERS\SiSRaid2.sys
04:56:59.0676 3088 SiSRaid2 - ok
04:56:59.0708 3088 SiSRaid4 (6a6c106d42e9ffff8b9fcb4f754f6da4) C:\Windows\system32\DRIVERS\sisraid4.sys
04:56:59.0723 3088 SiSRaid4 - ok
04:56:59.0770 3088 Smb (548260a7b8654e024dc30bf8a7c5baa4) C:\Windows\system32\DRIVERS\smb.sys
04:56:59.0832 3088 Smb - ok
04:56:59.0895 3088 spldr (b9e31e5cacdfe584f34f730a677803f9) C:\Windows\system32\drivers\spldr.sys
04:56:59.0910 3088 spldr - ok
04:57:00.0035 3088 SRTSP (9e399476e5d5e0d3c8822c857a7e9a9a) C:\Windows\System32\Drivers\NISx64\1008030.006\SRTSP64.SYS
04:57:00.0098 3088 SRTSP - ok
04:57:00.0144 3088 SRTSPX (3d7717b582f0365e75071556936e5a6b) C:\Windows\system32\drivers\NISx64\1008030.006\SRTSPX64.SYS
04:57:00.0160 3088 SRTSPX - ok
04:57:00.0222 3088 srv (2408c0366d96bcdf63e8f1c78e4a29c5) C:\Windows\system32\DRIVERS\srv.sys
04:57:00.0316 3088 srv - ok
04:57:00.0363 3088 srv2 (76548f7b818881b47d8d1ae1be9c11f8) C:\Windows\system32\DRIVERS\srv2.sys
04:57:00.0394 3088 srv2 - ok
04:57:00.0456 3088 srvnet (0af6e19d39c70844c5caa8fb0183c36e) C:\Windows\system32\DRIVERS\srvnet.sys
04:57:00.0503 3088 srvnet - ok
04:57:00.0566 3088 stexstor (f3817967ed533d08327dc73bc4d5542a) C:\Windows\system32\DRIVERS\stexstor.sys
04:57:00.0581 3088 stexstor - ok
04:57:00.0706 3088 swenum (d01ec09b6711a5f8e7e6564a4d0fbc90) C:\Windows\system32\DRIVERS\swenum.sys
04:57:00.0722 3088 swenum - ok
04:57:00.0878 3088 SymEFA (4f87bb5389a93778ebc363b28271a65b) C:\Windows\system32\drivers\NISx64\1008030.006\SYMEFA64.SYS
04:57:00.0893 3088 SymEFA - ok
04:57:00.0956 3088 SymEvent (7e4d281982e19abd06728c7ee9ac40a8) C:\Windows\system32\Drivers\SYMEVENT64x86.SYS
04:57:00.0971 3088 SymEvent - ok
04:57:01.0018 3088 SYMFW - ok
04:57:01.0065 3088 SymIM (212bbf5a964513980d5de9397381534f) C:\Windows\system32\DRIVERS\SymIMv.sys
04:57:01.0080 3088 SymIM - ok
04:57:01.0112 3088 SYMNDISV - ok
04:57:01.0221 3088 SYMTDI (33b37cb0a74f1f4b78a665ece9184095) C:\Windows\System32\Drivers\NISx64\1008030.006\SYMTDI.SYS
04:57:01.0252 3088 SYMTDI - ok
04:57:01.0299 3088 SynTP (bcf305959b53b200ceb2ad25ad22f8a7) C:\Windows\system32\DRIVERS\SynTP.sys
04:57:01.0330 3088 SynTP - ok
04:57:01.0470 3088 Tcpip (f18f56efc0bfb9c87ba01c37b27f4da5) C:\Windows\system32\drivers\tcpip.sys
04:57:01.0533 3088 Tcpip - ok
04:57:01.0626 3088 TCPIP6 (f18f56efc0bfb9c87ba01c37b27f4da5) C:\Windows\system32\DRIVERS\tcpip.sys
04:57:01.0689 3088 TCPIP6 - ok
04:57:01.0736 3088 tcpipreg (76d078af6f587b162d50210f761eb9ed) C:\Windows\system32\drivers\tcpipreg.sys
04:57:01.0798 3088 tcpipreg - ok
04:57:01.0860 3088 TDPIPE (3371d21011695b16333a3934340c4e7c) C:\Windows\system32\drivers\tdpipe.sys
04:57:01.0907 3088 TDPIPE - ok
04:57:01.0954 3088 TDTCP (e4245bda3190a582d55ed09e137401a9) C:\Windows\system32\drivers\tdtcp.sys
04:57:02.0001 3088 TDTCP - ok
04:57:02.0048 3088 tdx (079125c4b17b01fcaeebce0bcb290c0f) C:\Windows\system32\DRIVERS\tdx.sys
04:57:02.0126 3088 tdx - ok
04:57:02.0141 3088 TermDD (c448651339196c0e869a355171875522) C:\Windows\system32\DRIVERS\termdd.sys
04:57:02.0157 3088 TermDD - ok
04:57:02.0235 3088 tssecsrv (61b96c26131e37b24e93327a0bd1fb95) C:\Windows\system32\DRIVERS\tssecsrv.sys
04:57:02.0297 3088 tssecsrv - ok
04:57:02.0344 3088 tunnel (3836171a2cdf3af8ef10856db9835a70) C:\Windows\system32\DRIVERS\tunnel.sys
04:57:02.0406 3088 tunnel - ok
04:57:02.0531 3088 uagp35 (b4dd609bd7e282bfc683cec7eaaaad67) C:\Windows\system32\DRIVERS\uagp35.sys
04:57:02.0562 3088 uagp35 - ok
04:57:02.0609 3088 UBHelper (2e22c1fd397a5a9ffef55e9d1fc96c00) C:\Windows\system32\drivers\UBHelper.sys
04:57:02.0625 3088 UBHelper - ok
04:57:02.0672 3088 udfs (d47baead86c65d4f4069d7ce0a4edceb) C:\Windows\system32\DRIVERS\udfs.sys
04:57:02.0718 3088 udfs - ok
04:57:02.0796 3088 uliagpkx (4bfe1bc28391222894cbf1e7d0e42320) C:\Windows\system32\DRIVERS\uliagpkx.sys
04:57:02.0812 3088 uliagpkx - ok
04:57:02.0874 3088 umbus (eab6c35e62b1b0db0d1b48b671d3a117) C:\Windows\system32\DRIVERS\umbus.sys
04:57:02.0890 3088 umbus - ok
04:57:02.0921 3088 UmPass (b2e8e8cb557b156da5493bbddcc1474d) C:\Windows\system32\DRIVERS\umpass.sys
04:57:02.0937 3088 UmPass - ok
04:57:02.0999 3088 USBAAPL64 (54d4b48d443e7228bf64cf7cdc3118ac) C:\Windows\system32\Drivers\usbaapl64.sys
04:57:03.0030 3088 USBAAPL64 - ok
04:57:03.0108 3088 usbaudio (77b01bc848298223a95d4ec23e1785a1) C:\Windows\system32\drivers\usbaudio.sys
04:57:03.0140 3088 usbaudio - ok
04:57:03.0202 3088 usbccgp (7b6a127c93ee590e4d79a5f2a76fe46f) C:\Windows\system32\DRIVERS\usbccgp.sys
04:57:03.0218 3088 usbccgp - ok
04:57:03.0264 3088 usbcir (af0892a803fdda7492f595368e3b68e7) C:\Windows\system32\DRIVERS\usbcir.sys
04:57:03.0296 3088 usbcir - ok
04:57:03.0342 3088 usbehci (92969ba5ac44e229c55a332864f79677) C:\Windows\system32\DRIVERS\usbehci.sys
04:57:03.0374 3088 usbehci - ok
04:57:03.0405 3088 usbfilter (6648c6d7323a2ce0c4776c36cefbcb14) C:\Windows\system32\DRIVERS\usbfilter.sys
04:57:03.0420 3088 usbfilter - ok
04:57:03.0483 3088 usbhub (e7df1cfd28ca86b35ef5add0735ceef3) C:\Windows\system32\DRIVERS\usbhub.sys
04:57:03.0498 3088 usbhub - ok
04:57:03.0561 3088 usbohci (f1bb1e55f1e7a65c5839ccc7b36d773e) C:\Windows\system32\DRIVERS\usbohci.sys
04:57:03.0592 3088 usbohci - ok
04:57:03.0623 3088 usbprint (73188f58fb384e75c4063d29413cee3d) C:\Windows\system32\DRIVERS\usbprint.sys
04:57:03.0670 3088 usbprint - ok
04:57:03.0748 3088 USBSTOR (f39983647bc1f3e6100778ddfe9dce29) C:\Windows\system32\DRIVERS\USBSTOR.SYS
04:57:03.0779 3088 USBSTOR - ok
04:57:03.0857 3088 usbuhci (bc3070350a491d84b518d7cca9abd36f) C:\Windows\system32\drivers\usbuhci.sys
04:57:03.0873 3088 usbuhci - ok
04:57:03.0935 3088 usbvideo (7cb8c573c6e4a2714402cc0a36eab4fe) C:\Windows\System32\Drivers\usbvideo.sys
04:57:03.0966 3088 usbvideo - ok
04:57:04.0013 3088 vdrvroot (c5c876ccfc083ff3b128f933823e87bd) C:\Windows\system32\DRIVERS\vdrvroot.sys
04:57:04.0029 3088 vdrvroot - ok
04:57:04.0076 3088 vga (da4da3f5e02943c2dc8c6ed875de68dd) C:\Windows\system32\DRIVERS\vgapnp.sys
04:57:04.0122 3088 vga - ok
04:57:04.0154 3088 VgaSave (53e92a310193cb3c03bea963de7d9cfc) C:\Windows\System32\drivers\vga.sys
04:57:04.0216 3088 VgaSave - ok
04:57:04.0263 3088 vhdmp (c82e748660f62a242b2dfac1442f22a4) C:\Windows\system32\DRIVERS\vhdmp.sys
04:57:04.0278 3088 vhdmp - ok
04:57:04.0310 3088 viaide (e5689d93ffe4e5d66c0178761240dd54) C:\Windows\system32\DRIVERS\viaide.sys
04:57:04.0325 3088 viaide - ok
04:57:04.0372 3088 volmgr (2b1a3dae2b4e70dbba822b7a03fbd4a3) C:\Windows\system32\DRIVERS\volmgr.sys
04:57:04.0388 3088 volmgr - ok
04:57:04.0434 3088 volmgrx (99b0cbb569ca79acaed8c91461d765fb) C:\Windows\system32\drivers\volmgrx.sys
04:57:04.0450 3088 volmgrx - ok
04:57:04.0481 3088 volsnap (58f82eed8ca24b461441f9c3e4f0bf5c) C:\Windows\system32\DRIVERS\volsnap.sys
04:57:04.0497 3088 volsnap - ok
04:57:04.0544 3088 vsmraid (5e2016ea6ebaca03c04feac5f330d997) C:\Windows\system32\DRIVERS\vsmraid.sys
04:57:04.0559 3088 vsmraid - ok
04:57:04.0590 3088 vwifibus (36d4720b72b5c5d9cb2b9c29e9df67a1) C:\Windows\system32\DRIVERS\vwifibus.sys
04:57:04.0622 3088 vwifibus - ok
04:57:04.0653 3088 vwififlt (6a3d66263414ff0d6fa754c646612f3f) C:\Windows\system32\DRIVERS\vwififlt.sys
04:57:04.0684 3088 vwififlt - ok
04:57:04.0746 3088 vwifimp (6a638fc4bfddc4d9b186c28c91bd1a01) C:\Windows\system32\DRIVERS\vwifimp.sys
04:57:04.0762 3088 vwifimp - ok
04:57:04.0840 3088 WacomPen (4e9440f4f152a7b944cb1663d3935a3e) C:\Windows\system32\DRIVERS\wacompen.sys
04:57:04.0871 3088 WacomPen - ok
04:57:04.0949 3088 WANARP (47ca49400643effd3f1c9a27e1d69324) C:\Windows\system32\DRIVERS\wanarp.sys
04:57:05.0012 3088 WANARP - ok
04:57:05.0058 3088 Wanarpv6 (47ca49400643effd3f1c9a27e1d69324) C:\Windows\system32\DRIVERS\wanarp.sys
04:57:05.0121 3088 Wanarpv6 - ok
04:57:05.0261 3088 Wd (72889e16ff12ba0f235467d6091b17dc) C:\Windows\system32\DRIVERS\wd.sys
04:57:05.0277 3088 Wd - ok
04:57:05.0324 3088 Wdf01000 (441bd2d7b4f98134c3a4f9fa570fd250) C:\Windows\system32\drivers\Wdf01000.sys
04:57:05.0355 3088 Wdf01000 - ok
04:57:05.0448 3088 WfpLwf (611b23304bf067451a9fdee01fbdd725) C:\Windows\system32\DRIVERS\wfplwf.sys
04:57:05.0511 3088 WfpLwf - ok
04:57:05.0526 3088 WIMMount (05ecaec3e4529a7153b3136ceb49f0ec) C:\Windows\system32\drivers\wimmount.sys
04:57:05.0542 3088 WIMMount - ok
04:57:05.0682 3088 WinUsb (817eaff5d38674edd7713b9dfb8e9791) C:\Windows\system32\DRIVERS\WinUsb.sys
04:57:05.0745 3088 WinUsb - ok
04:57:05.0807 3088 WmiAcpi (f6ff8944478594d0e414d3f048f0d778) C:\Windows\system32\DRIVERS\wmiacpi.sys
04:57:05.0838 3088 WmiAcpi - ok
04:57:05.0901 3088 ws2ifsl (6bcc1d7d2fd2453957c5479a32364e52) C:\Windows\system32\drivers\ws2ifsl.sys
04:57:05.0948 3088 ws2ifsl - ok
04:57:06.0010 3088 WudfPf (7cadc74271dd6461c452c271b30bd378) C:\Windows\system32\drivers\WudfPf.sys
04:57:06.0057 3088 WudfPf - ok
04:57:06.0119 3088 WUDFRd (3b197af0fff08aa66b6b2241ca538d64) C:\Windows\system32\DRIVERS\WUDFRd.sys
04:57:06.0166 3088 WUDFRd - ok
04:57:06.0275 3088 X6va002 - ok
04:57:06.0369 3088 MBR (0x1B8) (a36c5e4f47e84449ff07ed3517b43a31) \Device\Harddisk0\DR0
04:57:06.0494 3088 \Device\Harddisk0\DR0 - ok
04:57:06.0509 3088 Boot (0x1200) (ada81cbe71e22e5c7a2222a610b11218) \Device\Harddisk0\DR0\Partition0
04:57:06.0509 3088 \Device\Harddisk0\DR0\Partition0 - ok
04:57:06.0540 3088 Boot (0x1200) (282832b20f02b1baa82e4d61b95f1dc3) \Device\Harddisk0\DR0\Partition1
04:57:06.0540 3088 \Device\Harddisk0\DR0\Partition1 - ok
04:57:06.0540 3088 ============================================================
04:57:06.0540 3088 Scan finished
04:57:06.0540 3088 ============================================================
04:57:06.0572 0692 Detected object count: 0
04:57:06.0572 0692 Actual detected object count: 0
04:57:12.0234 5464 Deinitialize success



OTS logfile created on: 12/2/2011 4:58:40 AM - Run 1
OTS by OldTimer - Version 3.1.46.0     Folder = C:\Users\Midnight Mistress\Desktop
64bit- Home Premium Edition  (Version = 6.1.7600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7600.16385)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy
 
2.00 Gb Total Physical Memory | 1.00 Gb Available Physical Memory | 51.00% Memory free
3.00 Gb Paging File | 2.00 Gb Available in Paging File | 60.00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 136.95 Gb Total Space | 21.60 Gb Free Space | 15.77% Space Free | Partition Type: NTFS
D: Drive not present or media not loaded
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded
 
Computer Name: MIDNIGHT-PC
Current User Name: Midnight Mistress
Logged in as Administrator.
 
Current Boot Mode: Normal
Scan Mode: Current user
Include 64bit Scans
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
 
[Processes - Safe List]
ots.exe -> C:\Users\Midnight Mistress\Desktop\OTS.exe -> [2011/12/02 04:53:11 | 000,646,144 | ---- | M] (OldTimer Tools)
netsession_win.exe -> C:\Users\Midnight Mistress\AppData\Local\Akamai\netsession_win.exe -> [2011/11/17 06:58:04 | 003,303,000 | ---- | M] (Akamai Technologies, Inc)
ccsvchst.exe -> C:\Program Files (x86)\Norton Internet Security\Engine\16.8.3.6\ccSvcHst.exe -> [2011/09/21 19:35:57 | 000,117,648 | R--- | M] (Symantec Corporation)
plfseti.exe -> C:\Windows\PLFSetI.exe -> [2010/08/31 01:42:43 | 000,200,704 | ---- | M] ()
ssscheduler.exe -> C:\Program Files (x86)\McAfee Security Scan\2.0.181\SSScheduler.exe -> [2010/01/15 07:49:20 | 000,255,536 | ---- | M] (McAfee, Inc.)
greghsrw.exe -> C:\Program Files (x86)\eMachines\Registration\GregHSRW.exe -> [2009/08/28 04:38:58 | 001,150,496 | ---- | M] (Acer Incorporated)
lmanager.exe -> C:\Program Files (x86)\Launch Manager\LManager.exe -> [2009/08/18 04:42:08 | 001,157,128 | ---- | M] (Dritek System Inc.)
ping.exe -> C:\Windows\SysWOW64\PING.EXE -> [2009/07/13 20:14:28 | 000,015,360 | ---- | M] (Microsoft Corporation)
updaterservice.exe -> C:\Program Files\eMachines\eMachines Updater\UpdaterService.exe -> [2009/07/03 21:47:12 | 000,240,160 | ---- | M] (Acer)
 
[Modules - No Company Name]
plfseti.exe -> C:\Windows\PLFSetI.exe -> [2010/08/31 01:42:43 | 000,200,704 | ---- | M] ()
mswsock.dll -> \\?\globalroot\systemroot\syswow64\mswsock.DLL -> [2009/07/13 20:15:51 | 000,232,448 | ---- | M] ()
mswsock.dll -> \\.\globalroot\systemroot\syswow64\mswsock.dll -> [2009/07/13 20:15:51 | 000,232,448 | ---- | M] ()
 
[Win32 Services - Safe List]
64bit-(ePowerSvc)  [Auto | Running] -> C:\Program Files\eMachines\eMachines Power Management\ePowerSvc.exe -> [2009/09/30 17:44:58 | 000,844,320 | ---- | M] (Acer Incorporated)
64bit-(AMD External Events Utility)  [Auto | Running] -> C:\Windows\SysNative\atiesrxx.exe -> [2009/07/29 07:03:42 | 000,203,264 | ---- | M] (AMD)
64bit-(WinDefend)  [Auto | Running] -> C:\Program Files\Windows Defender\MpSvc.dll -> [2009/07/13 20:41:27 | 001,011,712 | ---- | M] (Microsoft Corporation)
64bit-(Updater Service)  [Auto | Running] -> C:\Program Files\eMachines\eMachines Updater\UpdaterService.exe -> [2009/07/03 21:47:12 | 000,240,160 | ---- | M] (Acer)
(Akamai) Akamai NetSession Interface [Auto | Running] -> c:\program files (x86)\common files\akamai/netsession_win_d768ebc.dll -> [2011/11/17 20:54:33 | 003,313,752 | ---- | M] ()
(Norton Internet Security) Norton Internet Security [Auto | Running] -> C:\Program Files (x86)\Norton Internet Security\Engine\16.8.3.6\ccSvcHst.exe -> [2011/09/21 19:35:57 | 000,117,648 | R--- | M] (Symantec Corporation)
(FLEXnet Licensing Service) FLEXnet Licensing Service [On_Demand | Stopped] -> C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe -> [2011/02/10 10:20:12 | 000,655,624 | ---- | M] (Acresso Software Inc.)
(npggsvc) nProtect GameGuard Service [On_Demand | Stopped] -> C:\Windows\SysWow64\GameMon.des -> [2010/12/21 20:06:22 | 004,304,808 | ---- | M] (INCA Internet Co., Ltd.)
(Macromedia Licensing Service) Macromedia Licensing Service [On_Demand | Stopped] -> C:\Program Files (x86)\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe -> [2010/11/03 21:37:35 | 000,068,096 | ---- | M] ()
(clr_optimization_v4.0.30319_32) Microsoft .NET Framework NGEN v4.0.30319_X86 [Auto | Stopped] -> C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -> [2010/03/18 13:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation)
(SwitchBoard) Adobe SwitchBoard [On_Demand | Stopped] -> C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe -> [2010/02/19 12:37:14 | 000,517,096 | ---- | M] (Adobe Systems Incorporated)
(McComponentHostService) McAfee Security Scan Component Host Service [On_Demand | Stopped] -> C:\Program Files (x86)\McAfee Security Scan\2.0.181\McCHSvc.exe -> [2010/01/15 07:49:20 | 000,227,232 | ---- | M] (McAfee, Inc.)
(Greg_Service) GRegService [Auto | Running] -> C:\Program Files (x86)\eMachines\Registration\GregHSRW.exe -> [2009/08/28 04:38:58 | 001,150,496 | ---- | M] (Acer Incorporated)
(clr_optimization_v2.0.50727_32) Microsoft .NET Framework NGEN v2.0.50727_X86 [Disabled | Stopped] -> C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -> [2009/06/10 16:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation)
(GameConsoleService) GameConsoleService [On_Demand | Stopped] -> C:\Program Files (x86)\eMachines Games\eMachines Game Console\GameConsoleService.exe -> [2009/05/22 13:02:20 | 000,250,616 | ---- | M] (WildTangent, Inc.)
 
[Driver Services - Safe List]
64bit-(ccHP) Symantec Hash Provider [Kernel | System | Running] -> C:\Windows\SysNative\drivers\NISx64\1008030.006\cchpx64.sys -> [2011/10/11 03:41:31 | 000,561,800 | ---- | M] (Symantec Corporation)
64bit-(SYMTDI) Symantec Network Dispatch Driver [Kernel | System | Running] -> C:\Windows\SysNative\drivers\NISx64\1008030.006\symtdi.sys -> [2011/09/21 19:35:58 | 000,279,160 | ---- | M] (Symantec Corporation)
64bit-(amdsata) amdsata [Kernel | On_Demand | Stopped] -> C:\Windows\SysNative\drivers\amdsata.sys -> [2011/03/11 01:22:41 | 000,107,904 | ---- | M] (Advanced Micro Devices)
64bit-(amdxata) amdxata [Kernel | Boot | Running] -> C:\Windows\SysNative\drivers\amdxata.sys -> [2011/03/11 01:22:40 | 000,027,008 | ---- | M] (Advanced Micro Devices)
64bit-(USBAAPL64) Apple Mobile USB Driver [Kernel | On_Demand | Stopped] -> C:\Windows\SysNative\drivers\usbaapl64.sys -> [2011/02/18 15:36:58 | 000,051,712 | ---- | M] (Apple, Inc.)
64bit-(SymEvent) SymEvent [Kernel | On_Demand | Running] -> C:\Windows\SysNative\drivers\SYMEVENT64x86.SYS -> [2010/09/05 23:03:55 | 000,172,592 | ---- | M] (Symantec Corporation)
64bit-(BHDrvx64) Symantec Heuristics Driver [Kernel | System | Running] -> C:\Windows\SysNative\drivers\NISx64\1008030.006\BHDrvx64.sys -> [2010/01/20 16:18:24 | 000,334,384 | ---- | M] (Symantec Corporation)
64bit-(SRTSP) Symantec Real Time Storage Protection x64 [File_System | On_Demand | Stopped] -> C:\Windows\SysNative\drivers\NISx64\1008030.006\srtsp64.sys -> [2009/11/05 13:50:46 | 000,476,720 | ---- | M] (Symantec Corporation)
64bit-(SymEFA) Symantec Extended File Attributes [File_System | Boot | Running] -> C:\Windows\SysNative\drivers\NISx64\1008030.006\SymEFA64.sys -> [2009/11/05 13:50:46 | 000,402,992 | ---- | M] (Symantec Corporation)
64bit-(SRTSPX) Symantec Real Time Storage Protection (PEL) x64 [Kernel | System | Running] -> C:\Windows\SysNative\drivers\NISx64\1008030.006\srtspx64.sys -> [2009/11/05 13:50:46 | 000,032,304 | ---- | M] (Symantec Corporation)
64bit-(SymIM) Symantec Network Security Intermediate Filter Driver [Kernel | System | Running] -> C:\Windows\SysNative\drivers\SymIMV.sys -> [2009/11/05 13:50:46 | 000,031,280 | R--- | M] (Symantec Corporation)
64bit-(BCM43XX) Broadcom 802.11 Network Adapter Driver [Kernel | On_Demand | Running] -> C:\Windows\SysNative\drivers\BCMWL664.SYS -> [2009/08/21 04:18:16 | 002,978,296 | ---- | M] (Broadcom Corporation)
64bit-(RSUSBSTOR) RtsUStor.Sys Realtek USB Card Reader [Kernel | On_Demand | Stopped] -> C:\Windows\SysNative\drivers\RtsUStor.sys -> [2009/08/09 22:07:14 | 000,222,208 | ---- | M] (Realtek Semiconductor Corp.)
64bit-(atikmdag) atikmdag [Kernel | On_Demand | Running] -> C:\Windows\SysNative\drivers\atikmdag.sys -> [2009/07/29 17:11:24 | 006,038,016 | ---- | M] (ATI Technologies Inc.)
64bit-(L1C) NDIS Miniport Driver for Atheros AR8131/AR8132 PCI-E Ethernet Controller (NDIS 6.20) [Kernel | On_Demand | Running] -> C:\Windows\SysNative\drivers\L1C62x64.sys -> [2009/07/27 02:04:36 | 000,058,880 | ---- | M] (Atheros Communications, Inc.)
64bit-(amdsbs) amdsbs [Kernel | On_Demand | Stopped] -> C:\Windows\SysNative\drivers\amdsbs.sys -> [2009/07/13 20:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.)
64bit-(LSI_SAS2) LSI_SAS2 [Kernel | On_Demand | Stopped] -> C:\Windows\SysNative\drivers\lsi_sas2.sys -> [2009/07/13 20:48:04 | 000,065,600 | ---- | M] (LSI Corporation)
64bit-(HpSAMD) HpSAMD [Kernel | On_Demand | Stopped] -> C:\Windows\SysNative\drivers\HpSAMD.sys -> [2009/07/13 20:47:48 | 000,077,888 | ---- | M] (Hewlett-Packard Company)
64bit-(stexstor) stexstor [Kernel | On_Demand | Stopped] -> C:\Windows\SysNative\drivers\stexstor.sys -> [2009/07/13 20:45:55 | 000,024,656 | ---- | M] (Promise Technology)
64bit-(SynTP) Synaptics TouchPad Driver [Kernel | On_Demand | Running] -> C:\Windows\SysNative\drivers\SynTP.sys -> [2009/06/18 07:12:32 | 000,272,432 | ---- | M] (Synaptics Incorporated)
64bit-(ebdrv) Broadcom NetXtreme II 10 GigE VBD [Kernel | On_Demand | Stopped] -> C:\Windows\SysNative\drivers\evbda.sys -> [2009/06/10 15:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation)
64bit-(b06bdrv) Broadcom NetXtreme II VBD [Kernel | On_Demand | Stopped] -> C:\Windows\SysNative\drivers\bxvbda.sys -> [2009/06/10 15:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation)
64bit-(b57nd60a) Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0 [Kernel | On_Demand | Stopped] -> C:\Windows\SysNative\drivers\b57nd60a.sys -> [2009/06/10 15:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation)
64bit-(hcw85cir) Hauppauge Consumer Infrared Receiver [Kernel | On_Demand | Stopped] -> C:\Windows\SysNative\drivers\hcw85cir.sys -> [2009/06/10 15:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.)
64bit-(NTIDrvr) NTIDrvr [Kernel | On_Demand | Running] -> C:\Windows\SysNative\drivers\NTIDrvr.sys -> [2009/05/05 03:46:08 | 000,018,432 | ---- | M] (NewTech Infosystems, Inc.)
64bit-(UBHelper) UBHelper [Kernel | On_Demand | Running] -> C:\Windows\SysNative\drivers\UBHelper.sys -> [2009/05/05 03:46:08 | 000,016,896 | ---- | M] (NewTech Infosystems Corporation)
64bit-(AtiPcie) AMD PCI Express (3GIO) Filter [Kernel | Boot | Running] -> C:\Windows\SysNative\drivers\AtiPcie.sys -> [2009/05/04 08:30:28 | 000,016,440 | ---- | M] (Advanced Micro Devices Inc.)
64bit-(usbfilter) AMD USB Filter Driver [Kernel | On_Demand | Running] -> C:\Windows\SysNative\drivers\usbfilter.sys -> [2009/04/03 08:39:58 | 000,034,872 | ---- | M] (Advanced Micro Devices)
(IDSVia64) IDSVia64 [Kernel | System | Running] -> C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20101103.001\IDSviA64.sys -> [2010/10/19 15:36:20 | 000,476,720 | ---- | M] (Symantec Corporation)
(NAVEX15) NAVEX15 [Kernel | On_Demand | Stopped] -> C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20101105.003\EX64.SYS -> [2010/09/28 03:00:00 | 001,804,336 | ---- | M] (Symantec Corporation)
(NAVENG) NAVENG [Kernel | On_Demand | Stopped] -> C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20101105.003\ENG64.SYS -> [2010/09/28 03:00:00 | 000,117,808 | ---- | M] (Symantec Corporation)
(eeCtrl) Symantec Eraser Control driver [Kernel | System | Running] -> C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys -> [2010/09/10 10:42:52 | 000,475,696 | ---- | M] (Symantec Corporation)
(EraserUtilRebootDrv) EraserUtilRebootDrv [Kernel | On_Demand | Running] -> C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys -> [2010/09/10 10:42:52 | 000,132,656 | ---- | M] (Symantec Corporation)
(WIMMount) WIMMount [File_System | On_Demand | Stopped] -> C:\Windows\SysWOW64\drivers\wimmount.sys -> [2009/07/13 20:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation)
(DKbFltr) Dritek Keyboard Filter Driver (64-bit) [Kernel | On_Demand | Running] -> C:\Windows\SysWOW64\Drivers\DKbFltr.sys -> [2009/03/25 22:16:08 | 000,025,608 | ---- | M] (Dritek System Inc.)
(NPPTNT2) NPPTNT2 [Kernel | On_Demand | Stopped] -> C:\Windows\SysWOW64\npptNT2.sys -> [2005/01/04 13:43:08 | 000,004,682 | ---- | M] (INCA Internet Co., Ltd.)
 
[Registry - Safe List]
< 64bit-Internet Explorer Settings [HKEY_LOCAL_MACHINE\] > -> -> 
HKEY_LOCAL_MACHINE\: Main\\"Default_Page_URL" -> http://homepage.emachines.com/rdr.aspx?b=ACEW&l=0409&m=e627&r=273608101005l04h4z125r44j2393o -> 
HKEY_LOCAL_MACHINE\: Main\\"Start Page" -> http://homepage.emachines.com/rdr.aspx?b=ACEW&l=0409&m=e627&r=273608101005l04h4z125r44j2393o -> 
< Internet Explorer Settings [HKEY_LOCAL_MACHINE\] > -> -> 
HKEY_LOCAL_MACHINE\: Main\\"Default_Page_URL" -> http://homepage.emachines.com/rdr.aspx?b=ACEW&l=0409&m=e627&r=273608101005l04h4z125r44j2393o -> 
HKEY_LOCAL_MACHINE\: Main\\"Local Page" -> C:\Windows\SysWOW64\blank.htm -> 
HKEY_LOCAL_MACHINE\: Main\\"Start Page" -> http://homepage.emachines.com/rdr.aspx?b=ACEW&l=0409&m=e627&r=273608101005l04h4z125r44j2393o -> 
< Internet Explorer Settings [HKEY_CURRENT_USER\] > -> -> 
HKEY_CURRENT_USER\: Main\\"Default_Page_URL" -> http://homepage.emachines.com/rdr.aspx?b=ACEW&l=0409&m=e627&r=273608101005l04h4z125r44j2393o -> 
HKEY_CURRENT_USER\: Main\\"Start Page" -> http://homepage.emachines.com/rdr.aspx?b=ACEW&l=0409&m=e627&r=273608101005l04h4z125r44j2393o -> 
HKEY_CURRENT_USER\: "ProxyEnable" -> 0 -> 
HKEY_CURRENT_USER\: "ProxyOverride" -> *.local -> 
< FireFox Settings [Prefs.js] > -> C:\Users\Midnight Mistress\AppData\Roaming\Mozilla\FireFox\Profiles\1m3fs8fu.default\prefs.js -> 
browser.startup.homepage -> "http://homepage.emachines.com/rdr.aspx?b=ACEW&l=0409&m=e627&r=273608101005l04h4z125r44j2393o" ->
extensions.enabledItems -> {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}:6.0.22 ->
extensions.enabledItems -> {82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}:5.6.0.8442 ->
extensions.enabledItems -> {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:1.3.10 ->
extensions.enabledItems -> {E173B749-DB5B-4fd2-BA0E-94ECEA0CA55B}:7.4 ->
extensions.enabledItems -> {73a6fe31-595d-460b-a920-fcc0f8843232}:2.2.1 ->
network.proxy.http -> "127.0.0.1" ->
network.proxy.http_port -> 62808 ->
network.proxy.type -> 0 ->
< FireFox Extensions [HKLM] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla
HKLM\software\mozilla\Firefox\Extensions ->  -> 
HKLM\software\mozilla\Firefox\Extensions\\{7BA52691-1876-45ce-9EE6-54BCB3B04BBC} -> C:\PROGRAMDATA\NORTON\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NORTON\COFFPLGN\ [C:\PROGRAMDATA\NORTON\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NORTON\COFFPLGN\] -> [2011/10/15 14:08:31 | 000,000,000 | ---D | M]
HKLM\software\mozilla\Mozilla Firefox 3.6.24\extensions ->  -> 
HKLM\software\mozilla\Mozilla Firefox 3.6.24\extensions\\Components -> C:\Program Files (x86)\Mozilla Firefox\components [C:\PROGRAM FILES (X86)\MOZILLA FIREFOX\COMPONENTS] -> [2011/11/09 00:07:33 | 000,000,000 | ---D | M]
HKLM\software\mozilla\Mozilla Firefox 3.6.24\extensions\\Plugins -> C:\Program Files (x86)\Mozilla Firefox\plugins [C:\PROGRAM FILES (X86)\MOZILLA FIREFOX\PLUGINS] -> [2011/11/09 00:07:33 | 000,000,000 | ---D | M]
< FireFox Extensions [User Folders] > -> 
  -> C:\Users\Midnight Mistress\AppData\Roaming\Mozilla\Extensions -> [2010/08/31 14:53:08 | 000,000,000 | ---D | M]
  -> C:\Users\Midnight Mistress\AppData\Roaming\Mozilla\Extensions\IMVUClientXUL@imvu.com -> [2010/08/31 14:53:08 | 000,000,000 | ---D | M]
  -> C:\Users\Midnight Mistress\AppData\Roaming\Mozilla\Firefox\Profiles\1m3fs8fu.default\extensions -> [2011/12/01 21:30:09 | 000,000,000 | ---D | M]
NoScript   -> C:\Users\Midnight Mistress\AppData\Roaming\Mozilla\Firefox\Profiles\1m3fs8fu.default\extensions\{73a6fe31-595d-460b-a920-fcc0f8843232} -> [2011/11/30 06:14:27 | 000,000,000 | ---D | M]
Adblock Plus   -> C:\Users\Midnight Mistress\AppData\Roaming\Mozilla\Firefox\Profiles\1m3fs8fu.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d} -> [2011/11/30 05:26:38 | 000,000,000 | ---D | M]
Memory Fox   -> C:\Users\Midnight Mistress\AppData\Roaming\Mozilla\Firefox\Profiles\1m3fs8fu.default\extensions\{E173B749-DB5B-4fd2-BA0E-94ECEA0CA55B} -> [2011/11/30 05:26:38 | 000,000,000 | ---D | M]
< FireFox Extensions [Program Folders] > -> 
  -> C:\Program Files (x86)\Mozilla Firefox\extensions -> [2011/11/30 06:14:34 | 000,000,000 | ---D | M]
Skype Click to Call   -> C:\Program Files (x86)\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A} -> [2011/10/28 02:42:03 | 000,000,000 | ---D | M]
Java Console   -> C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} -> [2011/02/21 07:38:09 | 000,000,000 | ---D | M]
Hosts file not found -> -> 
< BHO's [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\ -> 
{602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} [HKLM] -> C:\Program Files (x86)\Norton Internet Security\Engine\16.8.3.6\CoIEPlg.dll [Symantec NCO BHO] -> [2011/09/21 19:35:55 | 000,378,736 | R--- | M] (Symantec Corporation)
{6D53EC84-6AAE-4787-AEEE-F4628F01010C} [HKLM] -> C:\Program Files (x86)\Norton Internet Security\Engine\16.8.3.6\IPSBHO.dll [Symantec Intrusion Prevention] -> [2009/11/05 13:50:41 | 000,107,896 | R--- | M] (Symantec Corporation)
{AE805869-2E5C-4ED4-8F7B-F1F7851A4497} [HKLM] -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll [Skype Browser Helper] -> [2011/10/10 10:09:16 | 003,834,016 | ---- | M] (Skype Technologies S.A.)
< 64bit-Internet Explorer ToolBars [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\ToolBar -> 
"Locked" [HKLM] -> Reg Error: Key error. [Reg Error: Key error.] -> File not found
< Internet Explorer ToolBars [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\ToolBar -> 
"{7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA}" [HKLM] -> C:\Program Files (x86)\Norton Internet Security\Engine\16.8.3.6\CoIEPlg.dll [Norton Toolbar] -> [2011/09/21 19:35:55 | 000,378,736 | R--- | M] (Symantec Corporation)
"Locked" [HKLM] -> Reg Error: Key error. [Reg Error: Key error.] -> File not found
< Internet Explorer ToolBars [HKEY_CURRENT_USER\] > -> HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\ -> 
WebBrowser\\"{7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA}" [HKLM] -> C:\Program Files (x86)\Norton Internet Security\Engine\16.8.3.6\CoIEPlg.dll [Norton Toolbar] -> [2011/09/21 19:35:55 | 000,378,736 | R--- | M] (Symantec Corporation)
< 64bit-Run [HKEY_LOCAL_MACHINE\] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run -> 
"Acer ePower Management" -> C:\Program Files\eMachines\eMachines Power Management\ePowerTray.exe [C:\Program Files\eMachines\eMachines Power Management\ePowerTray.exe] -> [2009/09/30 17:45:20 | 000,823,840 | ---- | M] (Acer Incorporated)
"AdobeAAMUpdater-1.0" -> C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe ["C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe"] -> [2011/03/30 07:46:38 | 000,499,608 | ---- | M] (Adobe Systems Incorporated)
"PLFSetI" -> C:\Windows\PLFSetI.exe [C:\Windows\PLFSetI.exe] -> [2010/08/31 01:42:43 | 000,200,704 | ---- | M] ()
"RtHDVCpl" -> C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe] -> [2009/07/28 08:14:20 | 007,982,112 | ---- | M] (Realtek Semiconductor)
< Run [HKEY_LOCAL_MACHINE\] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run -> 
"AdobeCS4ServiceManager" -> C:\Program Files (x86)\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe ["C:\Program Files (x86)\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe" -launchedbylogin] -> [2008/08/14 07:58:34 | 000,611,712 | ---- | M] (Adobe Systems Incorporated)
"AdobeCS5.5ServiceManager" ->  ["C:\Program Files (x86)\Common Files\Adobe\CS5.5ServiceManager\CS5.5ServiceManager.exe" -launchedbylogin] -> File not found
"AdobeCS5ServiceManager" -> C:\Program Files (x86)\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe ["C:\Program Files (x86)\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe" -launchedbylogin] -> [2010/02/22 03:57:06 | 000,406,992 | ---- | M] (Adobe Systems Incorporated)
"LManager" -> C:\Program Files (x86)\Launch Manager\LManager.exe [C:\Program Files (x86)\Launch Manager\LManager.exe] -> [2009/08/18 04:42:08 | 001,157,128 | ---- | M] (Dritek System Inc.)
"NortonOnlineBackupReminder" -> C:\Program Files (x86)\Symantec\Norton Online Backup\Activation\NobuActivation.exe ["C:\Program Files (x86)\Symantec\Norton Online Backup\Activation\NobuActivation.exe" UNATTENDED] -> [2009/07/24 19:33:50 | 000,588,648 | ---- | M] (Symantec Corporation)
"StartCCC" -> C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe ["C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun] -> [2009/07/30 00:20:52 | 000,098,304 | ---- | M] (Advanced Micro Devices, Inc.)
"SwitchBoard" -> C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe] -> [2010/02/19 12:37:14 | 000,517,096 | ---- | M] (Adobe Systems Incorporated)
< Run [HKEY_CURRENT_USER\] > -> HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run -> 
"Akamai NetSession Interface" -> C:\Users\Midnight Mistress\AppData\Local\Akamai\netsession_win.exe [C:\Users\Midnight Mistress\AppData\Local\Akamai\netsession_win.exe] -> [2011/11/17 06:58:04 | 003,303,000 | ---- | M] (Akamai Technologies, Inc)
"conhost" ->  [C:\Users\Midnight Mistress\AppData\Roaming\Microsoft\conhost.exe] -> File not found
< CurrentVersion Policy Settings - Explorer [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer -> 
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer
\\"NoActiveDesktop" ->  [1] -> File not found
\\"NoActiveDesktopChanges" ->  [1] -> File not found
< CurrentVersion Policy Settings - System [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System -> 
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System
\\"ConsentPromptBehaviorAdmin" ->  [5] -> File not found
\\"ConsentPromptBehaviorUser" ->  [3] -> File not found
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats
< Internet Explorer Menu Extensions [HKEY_CURRENT_USER\] > -> HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\MenuExt\ -> 
Google Sidewiki... ->  [res://C:\Program Files (x86)\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_E11712C84EA7E12B.dll/cmsidewiki.html] -> File not found
< Internet Explorer Extensions [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\ -> 
{898EA8C8-E7FF-479B-8935-AEC46303B9E5}:{898EA8C8-E7FF-479B-8935-AEC46303B9E5} [HKLM] -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll [Button: Skype Click to Call] -> [2011/10/10 10:09:16 | 003,834,016 | ---- | M] (Skype Technologies S.A.)
{898EA8C8-E7FF-479B-8935-AEC46303B9E5}:{898EA8C8-E7FF-479B-8935-AEC46303B9E5} [HKLM] -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll [Menu: Skype Click to Call] -> [2011/10/10 10:09:16 | 003,834,016 | ---- | M] (Skype Technologies S.A.)
< 64bit-Internet Explorer Plugins [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Plugins\ -> 
PluginsPageFriendlyName -> Microsoft ActiveX Gallery -> 
PluginsPage -> http://activex.microsoft.com/controls/find.asp?ext=%s&mime=%s -> 
< Internet Explorer Plugins [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Plugins\ -> 
< 64bit-Default Prefix > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\URL\DefaultPrefix
"" -> http://
< Default Prefix > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\URL\DefaultPrefix
"" -> http://
< 64bit-Trusted Sites Domains [HKEY_LOCAL_MACHINE\] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\ -> 
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\ -> [Key] 0 domain(s) found. -> 
< 64bit-Trusted Sites Ranges [HKEY_LOCAL_MACHINE\] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\ -> 
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\ -> [Key] 0 range(s) found. -> 
< Trusted Sites Domains [HKEY_LOCAL_MACHINE\] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\ -> 
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\ -> [Key] 0 domain(s) found. -> 
< Trusted Sites Ranges [HKEY_LOCAL_MACHINE\] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\ -> 
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\ -> [Key] 0 range(s) found. -> 
< Trusted Sites Domains [HKEY_CURRENT_USER\] > -> HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\ -> 
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\ -> [Key] 0 domain(s) found. -> 
< Trusted Sites Ranges [HKEY_CURRENT_USER\] > -> HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\ -> 
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\ -> [Key] 0 range(s) found. -> 
< Downloaded Program Files > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\ -> 
{8AD9C840-044E-11D1-B3E9-00805F499D93} [HKLM] -> http://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab [Java Plug-in 1.6.0_22] -> 
{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} [HKLM] -> http://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab [Java Plug-in 1.6.0_22] -> 
{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} [HKLM] -> http://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab [Java Plug-in 1.6.0_22] -> 
< Name Servers [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\ -> 
DhcpNameServer -> 192.168.1.254 -> 
< Name Servers [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Adapters\ -> 
{98E60A81-E364-4AE1-93D3-2372EABF7DF9}\\DhcpNameServer -> 192.168.1.254   (Broadcom 802.11g Network Adapter) -> 
< 64bit-Winlogon settings [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon -> 
64bit-*Shell* -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\\Shell -> 
explorer.exe -> C:\Windows\explorer.exe -> [2011/02/26 01:23:14 | 002,870,272 | ---- | M] (Microsoft Corporation)
*MultiFile Done* -> -> 
64bit-*UserInit* -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\\UserInit -> 
C:\Windows\system32\userinit.exe -> C:\Windows\SysNative\userinit.exe -> [2009/07/13 20:39:48 | 000,030,208 | ---- | M] (Microsoft Corporation)
*MultiFile Done* -> -> 
64bit-*VMApplet* -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\\VMApplet -> 
SystemPropertiesPerformance.exe -> C:\Windows\SysNative\SystemPropertiesPerformance.exe -> [2009/07/13 20:39:47 | 000,082,432 | ---- | M] (Microsoft Corporation)
/pagefile ->  -> File not found
*MultiFile Done* -> -> 
< Winlogon settings [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon -> 
*Shell* -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\\Shell -> 
explorer.exe -> C:\Windows\SysWow64\explorer.exe -> [2011/02/26 00:33:07 | 002,614,784 | ---- | M] (Microsoft Corporation)
*MultiFile Done* -> -> 
*UserInit* -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\\UserInit -> 
userinit.exe -> C:\Windows\SysWow64\userinit.exe -> [2009/07/13 20:14:43 | 000,026,112 | ---- | M] (Microsoft Corporation)
*MultiFile Done* -> -> 
*VMApplet* -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\\VMApplet -> 
/pagefile ->  -> File not found
*MultiFile Done* -> -> 
< Winlogon\Notify settings [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ -> 
klartew -> C:\Windows\SysWOW64\config\systemprofile\AppData\Local\klartew.dll -> [2011/11/29 16:24:49 | 000,011,264 | ---- | M] ()
< 64bit-SSODL [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad -> 
"{E6FB5E20-DE35-11CF-9C87-00AA005127ED}" [HKLM] -> Reg Error: Key error. [WebCheck] -> File not found
< SSODL [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad -> 
"{E6FB5E20-DE35-11CF-9C87-00AA005127ED}" [HKLM] -> Reg Error: Key error. [WebCheck] -> File not found
< Vista Active Firewall Rules > -> HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules -> 
{1A6104F0-077A-4634-8470-EFFF86969253} -> lport=2869 | protocol=6 | dir=in | action=allow | name=windows live communications platform (upnp) | 
{1B0EADC5-EBD4-4910-A0AE-EE44EAD71499} -> rport=445 | profile=private | protocol=6 | dir=out | action=allow | name=@firewallapi.dll,-28515 | app=system | 
{1BC8EA6C-CBD8-4F32-A97F-43F3847FE896} -> rport=139 | profile=private | protocol=6 | dir=out | action=allow | name=@firewallapi.dll,-28507 | app=system | 
{31547DBF-A452-4065-BF58-AADB29729041} -> lport=10243 | profile=private | protocol=6 | dir=in | action=allow | name=@firewallapi.dll,-31285 | app=system | 
{32CA8863-4D8D-40C5-ACB1-7DC16226ED0F} -> rport=137 | profile=private | protocol=17 | dir=out | action=allow | name=@firewallapi.dll,-28523 | app=system | 
{39E7F03F-9D07-42BC-9FAA-7DBD487D22DF} -> lport=63569 | profile=private | protocol=6 | dir=in | action=allow | name=akamai netsession interface | 
{48132CAE-A31E-4CC2-9E2B-D943A1682C67} -> lport=1900 | profile=private | protocol=17 | dir=in | action=allow | name=@firewallapi.dll,-31269 | app=%systemroot%\system32\svchost.exe | svc=ssdpsrv | 
{494C031E-2353-46D6-9FCD-2366193131A5} -> lport=1900 | protocol=17 | dir=in | action=allow | name=windows live communications platform (ssdp) | 
{5207A947-F82F-41B9-B671-986FA7F25A3F} -> lport=rpc-epmap | profile=private | protocol=6 | dir=in | action=allow | name=@firewallapi.dll,-28539 | svc=rpcss | 
{5B4C4549-266A-4550-B2F4-50CEBA66E169} -> lport=2177 | profile=private | protocol=6 | dir=in | action=allow | name=@firewallapi.dll,-31261 | app=%systemroot%\system32\svchost.exe | svc=qwave | 
{62A40E1E-4D13-4533-AF74-7C28B763F0E5} -> rport=138 | profile=private | protocol=17 | dir=out | action=allow | name=@firewallapi.dll,-28531 | app=system | 
{64516B4A-A5B9-488D-A140-72EFAAA841FC} -> rport=5355 | profile=private | protocol=17 | dir=out | action=allow | name=@firewallapi.dll,-28550 | app=%systemroot%\system32\svchost.exe | svc=dnscache | 
{6B25B806-B232-485E-8AC3-76ED69605050} -> lport=5355 | profile=private | protocol=17 | dir=in | action=allow | name=@firewallapi.dll,-28548 | app=%systemroot%\system32\svchost.exe | svc=dnscache | 
{6E05DC43-2246-4FC6-9BA6-DE08795CF4E3} -> lport=138 | profile=private | protocol=17 | dir=in | action=allow | name=@firewallapi.dll,-28527 | app=system | 
{89369B86-0228-4C0A-8835-B023C8B237DD} -> lport=rpc | profile=private | protocol=6 | dir=in | action=allow | name=@firewallapi.dll,-28535 | app=%systemroot%\system32\spoolsv.exe | svc=spooler | 
{9EA66C3F-B341-4909-BABB-ABD7AC56D086} -> lport=5353 | profile=private | protocol=6 | dir=in | action=allow | name=adobe csi cs4 | 
{A28CAF3F-E1E3-4763-93E9-6C6918D0EB77} -> lport=7935 | profile=private | protocol=6 | dir=in | action=allow | name=adobe flash builder 4.5 | 
{B1DC38B3-6A7B-4357-97E9-4463CF2C2077} -> lport=2177 | profile=private | protocol=17 | dir=in | action=allow | name=@firewallapi.dll,-31253 | app=%systemroot%\system32\svchost.exe | svc=qwave | 
{B309D443-91BF-45E6-8F31-FECEDAF61479} -> lport=2869 | protocol=6 | dir=in | action=allow | name=windows live messenger (upnp-in) | app=system | 
{B3579C1D-21AE-4357-8A8D-FC58ABA79AA1} -> lport=445 | profile=private | protocol=6 | dir=in | action=allow | name=@firewallapi.dll,-28511 | app=system | 
{B58D133D-B10B-408F-B7D3-82144B7D2ED4} -> rport=1900 | profile=private | protocol=17 | dir=out | action=allow | name=@firewallapi.dll,-31273 | app=%systemroot%\system32\svchost.exe | svc=ssdpsrv | 
{B7E7CC5A-F0FE-4ED3-A4A3-BD3EDA8CCEC1} -> lport=5000 | profile=private | protocol=17 | dir=in | action=allow | name=akamai netsession interface | 
{B98DAF64-AE49-4AEC-9150-BDC7A5797988} -> lport=1900 | protocol=17 | dir=in | action=allow | name=windows live messenger (ssdp-in) | app=svchost.exe | svc=ssdpsrv | 
{BF21C02F-0C8B-4203-B94C-F06DA8F76EDF} -> rport=10243 | profile=private | protocol=6 | dir=out | action=allow | name=@firewallapi.dll,-31289 | app=system | 
{D2091455-C209-442E-9C9C-03142DC0D51B} -> rport=2177 | profile=private | protocol=17 | dir=out | action=allow | name=@firewallapi.dll,-31257 | app=%systemroot%\system32\svchost.exe | svc=qwave | 
{D3B9EF3C-E3CF-489A-9BBE-698AB407EE43} -> lport=2869 | profile=private | protocol=6 | dir=in | action=allow | name=@firewallapi.dll,-31277 | app=system | 
{D6CEDD99-4904-442C-9E9B-39C07A639B31} -> lport=137 | profile=private | protocol=17 | dir=in | action=allow | name=@firewallapi.dll,-28519 | app=system | 
{E887EB16-7A53-46BC-A71C-A71AE7D0F8AA} -> rport=2177 | profile=private | protocol=6 | dir=out | action=allow | name=@firewallapi.dll,-31265 | app=%systemroot%\system32\svchost.exe | svc=qwave | 
{F02C130E-B505-4D58-AA0E-1ECA474DC19A} -> lport=139 | profile=private | protocol=6 | dir=in | action=allow | name=@firewallapi.dll,-28503 | app=system | 
< Vista Active Application Exception Rules > -> HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules -> 
{03299597-73A8-4BD5-890B-A8FF2EA91F3C} -> profile=private | protocol=17 | dir=in | action=allow | name=blizzard launcher | app=c:\program files (x86)\world of warcraft\launcher.exe | 
{04A84590-F27B-4381-A260-2C1B959FE5A1} -> profile=private | protocol=58 | dir=in | action=allow | name=@firewallapi.dll,-28545 | 
{0FE0AB03-3CF0-4264-8ACF-6207212E195C} -> profile=private | protocol=17 | dir=in | action=allow | name=@firewallapi.dll,-31305 | app=%programfiles%\windows media player\wmpnetwk.exe | 
{1027D504-438C-4DF2-B607-A1AF91754146} -> profile=private | protocol=17 | dir=in | action=allow | name=adobe flash builder 4.5 | app=c:\program files (x86)\adobe\adobe flash builder 4.5\flashbuilder.exe | 
{126CD794-F92F-4EDC-870F-C232040242B1} -> profile=private | protocol=17 | dir=in | action=allow | name=blizzard launcher | app=c:\program files (x86)\world of warcraft\launcher.patch.exe | 
{13A448E1-A94B-46EB-91DD-FC275F837418} -> profile=private | protocol=17 | dir=in | action=allow | name=pando media booster | app=c:\program files (x86)\pando networks\media booster\pmb.exe | 
{1B0AFDC9-1AAE-4255-B1A6-318A58B70D1F} -> profile=private | protocol=17 | dir=out | action=allow | name=@firewallapi.dll,-31297 | app=%programfiles%\windows media player\wmplayer.exe | 
{1BA30238-A04B-414C-8977-D836EB1ECDC7} -> profile=public | protocol=6 | dir=in | action=allow | name=microsoft office onenote | app=c:\program files (x86)\microsoft office\office12\onenote.exe | 
{1E4FC579-BD1C-4922-8054-9242501CC7E4} -> profile=public | protocol=17 | dir=in | action=allow | name=microsoft office onenote | app=c:\program files (x86)\microsoft office\office12\onenote.exe | 
{28BA7F71-A084-47C0-A4FE-0205517D6505} -> profile=private | protocol=6 | dir=out | action=allow | name=@firewallapi.dll,-31317 | app=%programfiles%\windows media player\wmpnetwk.exe | 
{35906B2B-3D8B-4D7F-85B7-59454745B7D7} -> profile=public | protocol=6 | dir=in | action=allow | name=backupsvc.exe | app=c:\program files (x86)\newtech infosystems\nti backup now 5\backupsvc.exe | 
{37F2AA14-6E53-48F5-9B5D-788EA86596BF} -> profile=private | protocol=6 | dir=in | action=allow | name=blizzard launcher | app=c:\program files (x86)\world of warcraft\launcher.exe | 
{384DE02E-B612-43A4-90DD-26CD436BFF3A} -> profile=private | protocol=1 | dir=in | action=allow | name=@firewallapi.dll,-28543 | 
{3C9A1C2C-F434-43D9-9112-465F2D156325} -> dir=in | action=allow | name=windows live sync | app=c:\program files (x86)\windows live\sync\windowslivesync.exe | 
{3ED08214-BA26-4629-94A6-70EA8A76B02F} -> profile=private | protocol=17 | dir=in | action=allow | name=@firewallapi.dll,-31293 | app=%programfiles%\windows media player\wmplayer.exe | 
{44A98C8B-3F15-4461-AA91-DB4EAB68B8E6} -> profile=private | protocol=17 | dir=out | action=allow | name=@firewallapi.dll,-31007 | app=%programfiles%\windows media player\wmplayer.exe | 
{56ADA1B5-295E-49C2-A8C6-0A29E57B1EF8} -> dir=in | action=allow | name=skype | app=c:\program files (x86)\skype\phone\skype.exe | 
{5E830A7A-4375-453F-9C3F-552369AAB229} -> profile=private | protocol=6 | dir=out | action=allow | name=@firewallapi.dll,-31281 | app=system | 
{6DB28B06-9833-40C9-90CA-1DA4B9A35511} -> profile=private | protocol=6 | dir=out | action=allow | name=@firewallapi.dll,-31301 | app=%programfiles%\windows media player\wmplayer.exe | 
{70D5F122-CBCB-44CF-8D1C-577A456A24F0} -> profile=private | protocol=17 | dir=in | action=allow | name=@firewallapi.dll,-31023 | app=%programfiles(x86)%\windows media player\wmplayer.exe | 
{7245AAF1-9A9E-4352-8CA3-7A9988BFFE70} -> profile=domain | protocol=6 | dir=in | action=allow | name=pando media booster | app=c:\program files (x86)\pando networks\media booster\pmb.exe | 
{79A9C1D3-8671-4C30-8EF3-90E2239A0FF1} -> profile=private | protocol=17 | dir=in | action=allow | name=adobe csi cs4 | app=c:\program files (x86)\common files\adobe\cs4servicemanager\cs4servicemanager.exe | 
{812E436D-ECE8-4AFE-A9FA-EEB5D3E1EADD} -> protocol=6 | dir=in | action=allow | name=μtorrent (tcp-in) | app=c:\program files (x86)\utorrent\utorrent.exe | 
{830C2100-BC1D-4F04-BC84-33786BE53E73} -> profile=private | protocol=6 | dir=in | action=allow | name=akamai netsession interface | app=c:\users\midnight mistress\appdata\local\akamai\netsession_win.exe | 
{853D30AD-3A7E-4E34-942E-DE0D6DC299A9} -> profile=private | protocol=17 | dir=in | action=allow | name=bonjour service | app=c:\program files (x86)\bonjour\mdnsresponder.exe | 
{8F9738A0-CD11-484D-B7F1-37313E82C990} -> dir=in | action=allow | name=windows live communications platform | app=c:\program files (x86)\windows live\contacts\wlcomm.exe | 
{92206128-D15A-4E72-8E3F-5E7891D3D16C} -> dir=in | action=allow | name=windows live messenger | app=c:\program files (x86)\windows live\messenger\msnmsgr.exe | 
{95EF34F4-C6C0-41DB-8F8E-F60320CE8D6B} -> profile=private | protocol=6 | dir=out | action=allow | name=@firewallapi.dll,-31011 | app=%programfiles%\windows media player\wmplayer.exe | 
{962AC8D9-1A7E-4518-B3DF-9E37C4D2C722} -> profile=private | protocol=58 | dir=out | action=allow | name=@firewallapi.dll,-28546 | 
{9DD3FA49-6D44-40CC-978C-D279F4315C55} -> profile=private | protocol=6 | dir=in | action=allow | name=adobe flash builder 4.5 | app=c:\program files (x86)\adobe\adobe flash builder 4.5\flashbuilder.exe | 
{9F048C64-23D5-4F2D-9603-C877C59616FD} -> profile=private | protocol=1 | dir=out | action=allow | name=@firewallapi.dll,-28544 | 
{A7C52120-75BB-4EAB-B87F-C8BA1F944A32} -> profile=private | protocol=17 | dir=out | action=allow | name=@firewallapi.dll,-31309 | app=%programfiles%\windows media player\wmpnetwk.exe | 
{B0701D53-C4CA-41BB-BDD4-4D4EB43F245D} -> profile=private | protocol=17 | dir=in | action=allow | name=akamai netsession interface | app=c:\users\midnight mistress\appdata\local\akamai\netsession_win.exe | 
{B39B0C29-8D6B-4012-97A0-77E28641F49C} -> profile=private | protocol=6 | dir=in | action=allow | name=adobe csi cs4 | app=c:\program files (x86)\common files\adobe\cs4servicemanager\cs4servicemanager.exe | 
{B3FFC847-3A47-4F89-8EC7-23DA09E53021} -> dir=in | action=allow | name=pando media booster | app=c:\program files (x86)\pando networks\media booster\pmb.exe | 
{BC42C704-012C-4413-B18F-F9E3B01364BF} -> profile=private | protocol=17 | dir=out | action=allow | name=@firewallapi.dll,-31024 | app=%programfiles(x86)%\windows media player\wmplayer.exe | 
{BD723C13-B8D0-4DDE-A146-89E5EC276CED} -> profile=public | protocol=6 | dir=in | action=allow | name=schedulersvc.exe | app=c:\program files (x86)\newtech infosystems\nti backup now 5\schedulersvc.exe | 
{C19C0466-1E9C-4457-8AA9-74FEBA95ABB5} -> profile=private | protocol=17 | dir=in | action=allow | name=@firewallapi.dll,-31003 | app=%programfiles%\windows media player\wmplayer.exe | 
{C4839CCB-85F6-4826-8738-AFD59E86BF81} -> profile=private | protocol=17 | dir=in | action=allow | name=dropbox | app=c:\users\midnight mistress\appdata\roaming\dropbox\bin\dropbox.exe | 
{C8BDA173-E84B-437C-B4E8-07570D768CD8} -> profile=public | protocol=17 | dir=in | action=allow | name=schedulersvc.exe | app=c:\program files (x86)\newtech infosystems\nti backup now 5\schedulersvc.exe | 
{D19B775B-536B-46A6-A52C-780DFFF630C8} -> profile=private | protocol=6 | dir=in | action=allow | name=dropbox | app=c:\users\midnight mistress\appdata\roaming\dropbox\bin\dropbox.exe | 
{D32201F4-8781-492E-8CF7-6A1CAB19DCC7} -> profile=private | protocol=6 | dir=in | action=allow | name=blizzard launcher | app=c:\program files (x86)\world of warcraft\launcher.patch.exe | 
{D3E68B5F-879F-4213-AD2F-16CBAC2C0B1A} -> profile=private | protocol=6 | dir=in | action=allow | name=bonjour service | app=c:\program files (x86)\bonjour\mdnsresponder.exe | 
{DD4D189E-936D-4098-A5F3-484BCFD50462} -> profile=private | protocol=6 | dir=out | action=allow | name=@firewallapi.dll,-31321 | app=%systemroot%\system32\svchost.exe | svc=upnphost | 
{E49562AD-AA4D-473F-98A1-562E1CD39056} -> dir=in | action=allow | name=pando media booster | app=c:\program files (x86)\pando networks\media booster\pmb.exe | 
{E54FA4C3-37D4-4AD8-B797-4334262092A0} -> profile=domain | protocol=17 | dir=in | action=allow | name=pando media booster | app=c:\program files (x86)\pando networks\media booster\pmb.exe | 
{E8E01395-AC44-4D01-A16B-4872AEAC9699} -> profile=private | protocol=6 | dir=out | action=allow | name=@firewallapi.dll,-31025 | app=%programfiles(x86)%\windows media player\wmplayer.exe | 
{ECC8C83E-4060-4648-A67C-093A023BF4ED} -> profile=public | protocol=17 | dir=in | action=allow | name=backupsvc.exe | app=c:\program files (x86)\newtech infosystems\nti backup now 5\backupsvc.exe | 
{EF5D95DD-4A7A-4E60-9084-3C22801976C3} -> profile=private | protocol=6 | dir=in | action=allow | name=@firewallapi.dll,-31313 | app=%programfiles%\windows media player\wmpnetwk.exe | 
{F889B5D3-1A7E-4900-A618-42850A8B9ED9} -> profile=private | protocol=6 | dir=in | action=allow | name=pando media booster | app=c:\program files (x86)\pando networks\media booster\pmb.exe | 
{FC258157-05E3-4EF1-9983-8CC38F9EC7F3} -> protocol=17 | dir=in | action=allow | name=μtorrent (udp-in) | app=c:\program files (x86)\utorrent\utorrent.exe | 
TCP Query User{1CB7C90B-5008-48E5-B892-46405BCA2603}C:\users\midnight mistress\downloads\yuleech-runes_of_magic_3_0_5_2262_us.exe -> profile=private | protocol=6 | dir=in | action=allow | name=yuleech-runes_of_magic_3_0_5_2262_us.exe | app=c:\users\midnight mistress\downloads\yuleech-runes_of_magic_3_0_5_2262_us.exe | 
TCP Query User{26C178A5-48DF-4940-A26A-75899F3E4384}C:\users\midnight mistress\documents\world of warcraft\wow-3.2.0-enus-downloader.exe -> profile=private | protocol=6 | dir=in | action=allow | name=wow-3.2.0-enus-downloader.exe | app=c:\users\midnight mistress\documents\world of warcraft\wow-3.2.0-enus-downloader.exe | 
TCP Query User{2855F9EF-6C89-47B9-939E-E26006EA92CC}C:\users\midnight mistress\appdata\local\akamai\netsession_win.exe -> profile=public | protocol=6 | dir=in | action=block | name=netsession_win.exe | app=c:\users\midnight mistress\appdata\local\akamai\netsession_win.exe | 
TCP Query User{41E42E02-91B8-4896-B4CD-6B41FB730EE6}C:\program files (x86)\world of warcraft\blizzard downloader.exe -> profile=private | protocol=6 | dir=in | action=allow | name=blizzard downloader | app=c:\program files (x86)\world of warcraft\blizzard downloader.exe | 
TCP Query User{EDAEADEF-6807-4F62-8384-FC364C278EDD}C:\users\midnight mistress\appdata\roaming\imvuclient\1vivoxvoice.exe -> profile=private | protocol=6 | dir=in | action=block | name=1vivoxvoice.exe | app=c:\users\midnight mistress\appdata\roaming\imvuclient\1vivoxvoice.exe | 
UDP Query User{114D760C-D295-4188-8E76-83EDEED8FA7C}C:\users\midnight mistress\appdata\roaming\imvuclient\1vivoxvoice.exe -> profile=private | protocol=17 | dir=in | action=block | name=1vivoxvoice.exe | app=c:\users\midnight mistress\appdata\roaming\imvuclient\1vivoxvoice.exe | 
UDP Query User{8418BBCF-82C6-4E24-839A-0125707AA625}C:\users\midnight mistress\documents\world of warcraft\wow-3.2.0-enus-downloader.exe -> profile=private | protocol=17 | dir=in | action=allow | name=wow-3.2.0-enus-downloader.exe | app=c:\users\midnight mistress\documents\world of warcraft\wow-3.2.0-enus-downloader.exe | 
UDP Query User{B1EDCEEB-3B52-41D5-830B-E2CB42F0C1C9}C:\users\midnight mistress\appdata\local\akamai\netsession_win.exe -> profile=public | protocol=17 | dir=in | action=block | name=netsession_win.exe | app=c:\users\midnight mistress\appdata\local\akamai\netsession_win.exe | 
UDP Query User{D1F82A1B-B186-402E-A3A8-93005C1240D7}C:\program files (x86)\world of warcraft\blizzard downloader.exe -> profile=private | protocol=17 | dir=in | action=allow | name=blizzard downloader | app=c:\program files (x86)\world of warcraft\blizzard downloader.exe | 
UDP Query User{DB07424C-7917-4F12-ACAD-72F075B3382D}C:\users\midnight mistress\downloads\yuleech-runes_of_magic_3_0_5_2262_us.exe -> profile=private | protocol=17 | dir=in | action=allow | name=yuleech-runes_of_magic_3_0_5_2262_us.exe | app=c:\users\midnight mistress\downloads\yuleech-runes_of_magic_3_0_5_2262_us.exe | 
< SafeBoot AlternateShell [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot -> 
< CDROM Autorun Setting [HKEY_LOCAL_MACHINE]> -> HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdrom ->
"AutoRun" -> 1 -> 
"DisplayName" -> CD-ROM Driver -> 
"ImagePath" -> C:\Windows\SysNative\drivers\cdrom.sys [system32\DRIVERS\cdrom.sys] -> [2009/07/13 18:19:54 | 000,147,456 | ---- | M] (Microsoft Corporation)
< MountPoints2 [HKEY_CURRENT_USER] > -> HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2 -> 
\{36c37112-7cce-11e0-937a-705ab60d3aef}
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{36c37112-7cce-11e0-937a-705ab60d3aef}\shell
\{36c37112-7cce-11e0-937a-705ab60d3aef}\shell\\"" ->  [AutoRun] -> File not found
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{36c37112-7cce-11e0-937a-705ab60d3aef}\shell\AutoRun\command
\{36c37112-7cce-11e0-937a-705ab60d3aef}\shell\AutoRun\command\\"" ->  [E:\setup.exe -a] -> File not found
\{36c3763f-7cce-11e0-937a-705ab60d3aef}
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{36c3763f-7cce-11e0-937a-705ab60d3aef}\shell
\{36c3763f-7cce-11e0-937a-705ab60d3aef}\shell\\"" ->  [AutoRun] -> File not found
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{36c3763f-7cce-11e0-937a-705ab60d3aef}\shell\AutoRun\command
\{36c3763f-7cce-11e0-937a-705ab60d3aef}\shell\AutoRun\command\\"" ->  [F:\setup.exe -a] -> File not found
\{af889771-f760-11e0-a6f0-705ab60d3aef}
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{af889771-f760-11e0-a6f0-705ab60d3aef}\shell
\{af889771-f760-11e0-a6f0-705ab60d3aef}\shell\\"" ->  [AutoRun] -> File not found
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{af889771-f760-11e0-a6f0-705ab60d3aef}\shell\AutoRun\command
\{af889771-f760-11e0-a6f0-705ab60d3aef}\shell\AutoRun\command\\"" ->  [E:\LaunchU3.exe -a] -> File not found
< Registry Shell Spawning - Select to Repair > -> HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command -> 
64bit-comfile [open] -> "%1" %*
64bit-exefile [open] -> "%1" %*
comfile [open] -> "%1" %* -> 
exefile [open] -> "%1" %* -> 
< 64bit-File Associations - Select to Repair > -> HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>\ -> 
.com [@ = comfile] -> "%1" %* -> 
.exe [@ = exefile] -> "%1" %* -> 
< File Associations - Select to Repair > -> HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>\ -> 
.com [@ = comfile] -> "%1" %* -> 
.exe [@ = exefile] -> "%1" %* -> 
< File Associations - Select to Repair > -> HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>\ -> 
.exe [@ = exefile] -> "%1" %* -> 
 
 
[Files/Folders - Created Within 30 Days]
 OTS.exe -> C:\Users\Midnight Mistress\Desktop\OTS.exe -> [2011/12/02 04:52:59 | 000,646,144 | ---- | C] (OldTimer Tools)
 tdsskiller.exe -> C:\Users\Midnight Mistress\Desktop\tdsskiller.exe -> [2011/12/02 04:49:42 | 001,566,512 | ---- | C] (Kaspersky Lab ZAO)
 Comp-Fix -> C:\Users\Midnight Mistress\Desktop\Comp-Fix -> [2011/11/30 10:52:43 | 000,000,000 | ---D | C]
 Common Files -> C:\ProgramData\Common Files -> [2011/11/29 01:15:38 | 000,000,000 | -H-D | C]
 AVG -> C:\Windows\SysWow64\drivers\AVG -> [2011/11/29 01:12:49 | 000,000,000 | ---D | C]
 AVG2012 -> C:\ProgramData\AVG2012 -> [2011/11/29 01:11:35 | 000,000,000 | ---D | C]
 Malwarebytes -> C:\Users\Midnight Mistress\AppData\Roaming\Malwarebytes -> [2011/11/29 00:36:20 | 000,000,000 | ---D | C]
 Malwarebytes' Anti-Malware -> C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware -> [2011/11/29 00:36:03 | 000,000,000 | ---D | C]
 Malwarebytes -> C:\ProgramData\Malwarebytes -> [2011/11/29 00:36:00 | 000,000,000 | ---D | C]
 mbam.sys -> C:\Windows\SysNative\drivers\mbam.sys -> [2011/11/29 00:35:56 | 000,025,416 | ---- | C] (Malwarebytes Corporation)
 Malwarebytes' Anti-Malware -> C:\Program Files (x86)\Malwarebytes' Anti-Malware -> [2011/11/29 00:35:56 | 000,000,000 | ---D | C]
 MFAData -> C:\ProgramData\MFAData -> [2011/11/29 00:35:19 | 000,000,000 | ---D | C]
 {F6D58509-EB60-4089-AF6E-2BB2B7E11DDB} -> C:\Users\Midnight Mistress\AppData\Local\{F6D58509-EB60-4089-AF6E-2BB2B7E11DDB} -> [2011/11/28 02:45:24 | 000,000,000 | ---D | C]
 {6F46F398-6339-4BC3-981B-B02309073DE6} -> C:\Users\Midnight Mistress\AppData\Local\{6F46F398-6339-4BC3-981B-B02309073DE6} -> [2011/11/28 00:44:43 | 000,000,000 | ---D | C]
 {FB995FF2-11C0-4A43-BB0F-2461192D85B1} -> C:\Users\Midnight Mistress\AppData\Local\{FB995FF2-11C0-4A43-BB0F-2461192D85B1} -> [2011/11/28 00:44:42 | 000,000,000 | ---D | C]
 system64 -> C:\Windows\system64 -> [2011/11/27 06:56:43 | 000,000,000 | ---D | C]
 AnimeNew -> C:\Users\Midnight Mistress\Documents\AnimeNew -> [2011/11/24 06:19:40 | 000,000,000 | ---D | C]
 Akamai -> C:\Users\Midnight Mistress\AppData\Local\Akamai -> [2011/11/10 01:48:27 | 000,000,000 | ---D | C]
 
[Files/Folders - Modified Within 30 Days]
 OTS.exe -> C:\Users\Midnight Mistress\Desktop\OTS.exe -> [2011/12/02 04:53:11 | 000,646,144 | ---- | M] (OldTimer Tools)
 tdsskiller.exe -> C:\Users\Midnight Mistress\Desktop\tdsskiller.exe -> [2011/12/02 04:50:12 | 001,566,512 | ---- | M] (Kaspersky Lab ZAO)
 At10.job -> C:\Windows\tasks\At10.job -> [2011/12/02 04:36:00 | 000,000,354 | ---- | M] ()
 At9.job -> C:\Windows\tasks\At9.job -> [2011/12/02 04:36:00 | 000,000,352 | ---- | M] ()
 GoogleUpdateTaskMachineUA.job -> C:\Windows\tasks\GoogleUpdateTaskMachineUA.job -> [2011/12/02 04:29:06 | 000,000,898 | ---- | M] ()
 At8.job -> C:\Windows\tasks\At8.job -> [2011/12/02 03:36:00 | 000,000,354 | ---- | M] ()
 At7.job -> C:\Windows\tasks\At7.job -> [2011/12/02 03:36:00 | 000,000,352 | ---- | M] ()
 At6.job -> C:\Windows\tasks\At6.job -> [2011/12/02 02:36:00 | 000,000,354 | ---- | M] ()
 At5.job -> C:\Windows\tasks\At5.job -> [2011/12/02 02:36:00 | 000,000,352 | ---- | M] ()
 At4.job -> C:\Windows\tasks\At4.job -> [2011/12/02 01:36:00 | 000,000,354 | ---- | M] ()
 At3.job -> C:\Windows\tasks\At3.job -> [2011/12/02 01:36:00 | 000,000,352 | ---- | M] ()
 At2.job -> C:\Windows\tasks\At2.job -> [2011/12/02 00:36:00 | 000,000,354 | ---- | M] ()
 At1.job -> C:\Windows\tasks\At1.job -> [2011/12/02 00:36:00 | 000,000,352 | ---- | M] ()
 At48.job -> C:\Windows\tasks\At48.job -> [2011/12/01 23:36:00 | 000,000,354 | ---- | M] ()
 At47.job -> C:\Windows\tasks\At47.job -> [2011/12/01 23:36:00 | 000,000,352 | ---- | M] ()
 At46.job -> C:\Windows\tasks\At46.job -> [2011/12/01 22:36:05 | 000,000,354 | ---- | M] ()
 At45.job -> C:\Windows\tasks\At45.job -> [2011/12/01 22:36:05 | 000,000,352 | ---- | M] ()
 GoogleUpdateTaskMachineCore.job -> C:\Windows\tasks\GoogleUpdateTaskMachineCore.job -> [2011/12/01 22:29:07 | 000,000,894 | ---- | M] ()
 At44.job -> C:\Windows\tasks\At44.job -> [2011/12/01 21:36:00 | 000,000,354 | ---- | M] ()
 At43.job -> C:\Windows\tasks\At43.job -> [2011/12/01 21:36:00 | 000,000,352 | ---- | M] ()
 7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 -> C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 -> [2011/12/01 21:35:44 | 000,009,920 | -H-- | M] ()
 7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 -> C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 -> [2011/12/01 21:35:44 | 000,009,920 | -H-- | M] ()
 At42.job -> C:\Windows\tasks\At42.job -> [2011/12/01 21:19:53 | 000,000,354 | ---- | M] ()
 At40.job -> C:\Windows\tasks\At40.job -> [2011/12/01 21:19:53 | 000,000,354 | ---- | M] ()
 At38.job -> C:\Windows\tasks\At38.job -> [2011/12/01 21:19:53 | 000,000,354 | ---- | M] ()
 At36.job -> C:\Windows\tasks\At36.job -> [2011/12/01 21:19:53 | 000,000,354 | ---- | M] ()
 At34.job -> C:\Windows\tasks\At34.job -> [2011/12/01 21:19:53 | 000,000,354 | ---- | M] ()
 At32.job -> C:\Windows\tasks\At32.job -> [2011/12/01 21:19:53 | 000,000,354 | ---- | M] ()
 At30.job -> C:\Windows\tasks\At30.job -> [2011/12/01 21:19:53 | 000,000,354 | ---- | M] ()
 At28.job -> C:\Windows\tasks\At28.job -> [2011/12/01 21:19:53 | 000,000,354 | ---- | M] ()
 At41.job -> C:\Windows\tasks\At41.job -> [2011/12/01 21:19:53 | 000,000,352 | ---- | M] ()
 At39.job -> C:\Windows\tasks\At39.job -> [2011/12/01 21:19:53 | 000,000,352 | ---- | M] ()
 At37.job -> C:\Windows\tasks\At37.job -> [2011/12/01 21:19:53 | 000,000,352 | ---- | M] ()
 At35.job -> C:\Windows\tasks\At35.job -> [2011/12/01 21:19:53 | 000,000,352 | ---- | M] ()
 At33.job -> C:\Windows\tasks\At33.job -> [2011/12/01 21:19:53 | 000,000,352 | ---- | M] ()
 At31.job -> C:\Windows\tasks\At31.job -> [2011/12/01 21:19:53 | 000,000,352 | ---- | M] ()
 At29.job -> C:\Windows\tasks\At29.job -> [2011/12/01 21:19:53 | 000,000,352 | ---- | M] ()
 At27.job -> C:\Windows\tasks\At27.job -> [2011/12/01 21:19:53 | 000,000,352 | ---- | M] ()
 At26.job -> C:\Windows\tasks\At26.job -> [2011/12/01 21:19:52 | 000,000,354 | ---- | M] ()
 At24.job -> C:\Windows\tasks\At24.job -> [2011/12/01 21:19:52 | 000,000,354 | ---- | M] ()
 At22.job -> C:\Windows\tasks\At22.job -> [2011/12/01 21:19:52 | 000,000,354 | ---- | M] ()
 At20.job -> C:\Windows\tasks\At20.job -> [2011/12/01 21:19:52 | 000,000,354 | ---- | M] ()
 At18.job -> C:\Windows\tasks\At18.job -> [2011/12/01 21:19:52 | 000,000,354 | ---- | M] ()
 At16.job -> C:\Windows\tasks\At16.job -> [2011/12/01 21:19:52 | 000,000,354 | ---- | M] ()
 At14.job -> C:\Windows\tasks\At14.job -> [2011/12/01 21:19:52 | 000,000,354 | ---- | M] ()
 At12.job -> C:\Windows\tasks\At12.job -> [2011/12/01 21:19:52 | 000,000,354 | ---- | M] ()
 At25.job -> C:\Windows\tasks\At25.job -> [2011/12/01 21:19:52 | 000,000,352 | ---- | M] ()
 At23.job -> C:\Windows\tasks\At23.job -> [2011/12/01 21:19:52 | 000,000,352 | ---- | M] ()
 At21.job -> C:\Windows\tasks\At21.job -> [2011/12/01 21:19:52 | 000,000,352 | ---- | M] ()
 At19.job -> C:\Windows\tasks\At19.job -> [2011/12/01 21:19:52 | 000,000,352 | ---- | M] ()
 At17.job -> C:\Windows\tasks\At17.job -> [2011/12/01 21:19:52 | 000,000,352 | ---- | M] ()
 At15.job -> C:\Windows\tasks\At15.job -> [2011/12/01 21:19:52 | 000,000,352 | ---- | M] ()
 At13.job -> C:\Windows\tasks\At13.job -> [2011/12/01 21:19:52 | 000,000,352 | ---- | M] ()
 At11.job -> C:\Windows\tasks\At11.job -> [2011/12/01 21:19:52 | 000,000,352 | ---- | M] ()
 bootstat.dat -> C:\Windows\bootstat.dat -> [2011/12/01 21:19:41 | 000,067,584 | --S- | M] ()
 PerfStringBackup.INI -> C:\Windows\SysNative\PerfStringBackup.INI -> [2011/11/30 08:01:30 | 000,739,918 | ---- | M] ()
 perfh009.dat -> C:\Windows\SysNative\perfh009.dat -> [2011/11/30 08:01:30 | 000,633,180 | ---- | M] ()
 perfc009.dat -> C:\Windows\SysNative\perfc009.dat -> [2011/11/30 08:01:30 | 000,110,782 | ---- | M] ()
 hiberfil.sys -> C:\hiberfil.sys -> [2011/11/30 07:56:12 | 1406,177,280 | -HS- | M] ()
 incavi.avm -> C:\Windows\SysWow64\drivers\AVG\incavi.avm -> [2011/11/29 01:12:49 | 000,000,000 | ---- | M] ()
 iavichjw.avm -> C:\Windows\SysWow64\drivers\AVG\iavichjw.avm -> [2011/11/29 01:12:49 | 000,000,000 | ---- | M] ()
 Malwarebytes' Anti-Malware.lnk -> C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk -> [2011/11/29 00:36:03 | 000,001,122 | ---- | M] ()
 aoekmg7h0xsk3fhh0kqq1s574o1q -> C:\Users\Midnight Mistress\AppData\Local\aoekmg7h0xsk3fhh0kqq1s574o1q -> [2011/11/29 00:18:55 | 000,009,556 | -HS- | M] ()
 aoekmg7h0xsk3fhh0kqq1s574o1q -> C:\ProgramData\aoekmg7h0xsk3fhh0kqq1s574o1q -> [2011/11/29 00:18:55 | 000,009,556 | -HS- | M] ()
 bookmarks-2011-11-29.json -> C:\Users\Midnight Mistress\Documents\bookmarks-2011-11-29.json -> [2011/11/29 00:08:14 | 000,210,927 | ---- | M] ()
 fm6jqc.dat -> C:\ProgramData\fm6jqc.dat -> [2011/11/27 07:16:46 | 000,000,112 | ---- | M] ()
 j4066k2to.com_ -> C:\Windows\SysWow64\j4066k2to.com_ -> [2011/11/27 07:16:45 | 000,111,616 | ---- | M] ()
 j4066k2to.com -> C:\Windows\SysWow64\j4066k2to.com -> [2011/11/27 07:16:45 | 000,111,616 | ---- | M] ()
 j4066k2to.com.b -> C:\Windows\SysWow64\j4066k2to.com.b -> [2011/11/27 07:13:43 | 000,000,000 | ---- | M] ()
 .recently-used.xbel -> C:\Users\Midnight Mistress\.recently-used.xbel -> [2011/11/23 22:57:13 | 000,024,351 | ---- | M] ()
 FNTCACHE.DAT -> C:\Windows\SysNative\FNTCACHE.DAT -> [2011/11/14 14:43:27 | 004,948,856 | ---- | M] ()
 73 C:\Users\Midnight Mistress\AppData\Local\Temp\*.tmp files -> C:\Users\Midnight Mistress\AppData\Local\Temp\*.tmp -> 
 73 C:\Users\Midnight Mistress\AppData\Local\Temp\*.tmp files -> C:\Users\Midnight Mistress\AppData\Local\Temp\*.tmp -> 
 40 C:\Windows\Temp\*.tmp files -> C:\Windows\Temp\*.tmp -> 
 40 C:\Windows\Temp\*.tmp files -> C:\Windows\Temp\*.tmp -> 
 
[Files - No Company Name]
 incavi.avm -> C:\Windows\SysWow64\drivers\AVG\incavi.avm -> [2011/11/29 01:12:49 | 000,000,000 | ---- | C] ()
 iavichjw.avm -> C:\Windows\SysWow64\drivers\AVG\iavichjw.avm -> [2011/11/29 01:12:49 | 000,000,000 | ---- | C] ()
 Malwarebytes' Anti-Malware.lnk -> C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk -> [2011/11/29 00:36:03 | 000,001,122 | ---- | C] ()
 bookmarks-2011-11-29.json -> C:\Users\Midnight Mistress\Documents\bookmarks-2011-11-29.json -> [2011/11/29 00:03:49 | 000,210,927 | ---- | C] ()
 j4066k2to.com -> C:\Windows\SysWow64\j4066k2to.com -> [2011/11/27 08:07:40 | 000,111,616 | ---- | C] ()
 j4066k2to.com.b -> C:\Windows\SysWow64\j4066k2to.com.b -> [2011/11/27 07:13:43 | 000,000,000 | ---- | C] ()
 fm6jqc.dat -> C:\ProgramData\fm6jqc.dat -> [2011/11/27 07:08:47 | 000,000,112 | ---- | C] ()
 At48.job -> C:\Windows\tasks\At48.job -> [2011/11/27 07:08:46 | 000,000,354 | ---- | C] ()
 At47.job -> C:\Windows\tasks\At47.job -> [2011/11/27 07:08:45 | 000,000,352 | ---- | C] ()
 At46.job -> C:\Windows\tasks\At46.job -> [2011/11/27 07:08:44 | 000,000,354 | ---- | C] ()
 At45.job -> C:\Windows\tasks\At45.job -> [2011/11/27 07:08:43 | 000,000,352 | ---- | C] ()
 At44.job -> C:\Windows\tasks\At44.job -> [2011/11/27 07:08:42 | 000,000,354 | ---- | C] ()
 At43.job -> C:\Windows\tasks\At43.job -> [2011/11/27 07:08:42 | 000,000,352 | ---- | C] ()
 At42.job -> C:\Windows\tasks\At42.job -> [2011/11/27 07:08:41 | 000,000,354 | ---- | C] ()
 At41.job -> C:\Windows\tasks\At41.job -> [2011/11/27 07:08:41 | 000,000,352 | ---- | C] ()
 At40.job -> C:\Windows\tasks\At40.job -> [2011/11/27 07:08:40 | 000,000,354 | ---- | C] ()
 At38.job -> C:\Windows\tasks\At38.job -> [2011/11/27 07:08:39 | 000,000,354 | ---- | C] ()
 At39.job -> C:\Windows\tasks\At39.job -> [2011/11/27 07:08:39 | 000,000,352 | ---- | C] ()
 At36.job -> C:\Windows\tasks\At36.job -> [2011/11/27 07:08:37 | 000,000,354 | ---- | C] ()
 At37.job -> C:\Windows\tasks\At37.job -> [2011/11/27 07:08:37 | 000,000,352 | ---- | C] ()
 At34.job -> C:\Windows\tasks\At34.job -> [2011/11/27 07:08:36 | 000,000,354 | ---- | C] ()
 At35.job -> C:\Windows\tasks\At35.job -> [2011/11/27 07:08:36 | 000,000,352 | ---- | C] ()
 At33.job -> C:\Windows\tasks\At33.job -> [2011/11/27 07:08:35 | 000,000,352 | ---- | C] ()
 At32.job -> C:\Windows\tasks\At32.job -> [2011/11/27 07:08:34 | 000,000,354 | ---- | C] ()
 At31.job -> C:\Windows\tasks\At31.job -> [2011/11/27 07:08:33 | 000,000,352 | ---- | C] ()
 At30.job -> C:\Windows\tasks\At30.job -> [2011/11/27 07:08:32 | 000,000,354 | ---- | C] ()
 At29.job -> C:\Windows\tasks\At29.job -> [2011/11/27 07:08:31 | 000,000,352 | ---- | C] ()
 At28.job -> C:\Windows\tasks\At28.job -> [2011/11/27 07:08:30 | 000,000,354 | ---- | C] ()
 At27.job -> C:\Windows\tasks\At27.job -> [2011/11/27 07:08:29 | 000,000,352 | ---- | C] ()
 At26.job -> C:\Windows\tasks\At26.job -> [2011/11/27 07:08:28 | 000,000,354 | ---- | C] ()
 At25.job -> C:\Windows\tasks\At25.job -> [2011/11/27 07:08:26 | 000,000,352 | ---- | C] ()
 At24.job -> C:\Windows\tasks\At24.job -> [2011/11/27 07:08:25 | 000,000,354 | ---- | C] ()
 At23.job -> C:\Windows\tasks\At23.job -> [2011/11/27 07:08:24 | 000,000,352 | ---- | C] ()
 At22.job -> C:\Windows\tasks\At22.job -> [2011/11/27 07:08:23 | 000,000,354 | ---- | C] ()
 At21.job -> C:\Windows\tasks\At21.job -> [2011/11/27 07:08:23 | 000,000,352 | ---- | C] ()
 At20.job -> C:\Windows\tasks\At20.job -> [2011/11/27 07:08:22 | 000,000,354 | ---- | C] ()
 At18.job -> C:\Windows\tasks\At18.job -> [2011/11/27 07:08:21 | 000,000,354 | ---- | C] ()
 At19.job -> C:\Windows\tasks\At19.job -> [2011/11/27 07:08:21 | 000,000,352 | ---- | C] ()
 At17.job -> C:\Windows\tasks\At17.job -> [2011/11/27 07:08:20 | 000,000,352 | ---- | C] ()
 At16.job -> C:\Windows\tasks\At16.job -> [2011/11/27 07:08:19 | 000,000,354 | ---- | C] ()
 At15.job -> C:\Windows\tasks\At15.job -> [2011/11/27 07:08:19 | 000,000,352 | ---- | C] ()
 At14.job -> C:\Windows\tasks\At14.job -> [2011/11/27 07:08:18 | 000,000,354 | ---- | C] ()
 At12.job -> C:\Windows\tasks\At12.job -> [2011/11/27 07:08:17 | 000,000,354 | ---- | C] ()
 At13.job -> C:\Windows\tasks\At13.job -> [2011/11/27 07:08:17 | 000,000,352 | ---- | C] ()
 At11.job -> C:\Windows\tasks\At11.job -> [2011/11/27 07:08:15 | 000,000,352 | ---- | C] ()
 At10.job -> C:\Windows\tasks\At10.job -> [2011/11/27 07:08:14 | 000,000,354 | ---- | C] ()
 At9.job -> C:\Windows\tasks\At9.job -> [2011/11/27 07:08:13 | 000,000,352 | ---- | C] ()
 At8.job -> C:\Windows\tasks\At8.job -> [2011/11/27 07:08:12 | 000,000,354 | ---- | C] ()
 At7.job -> C:\Windows\tasks\At7.job -> [2011/11/27 07:08:12 | 000,000,352 | ---- | C] ()
 At6.job -> C:\Windows\tasks\At6.job -> [2011/11/27 07:08:11 | 000,000,354 | ---- | C] ()
 At5.job -> C:\Windows\tasks\At5.job -> [2011/11/27 07:08:09 | 000,000,352 | ---- | C] ()
 At4.job -> C:\Windows\tasks\At4.job -> [2011/11/27 07:08:08 | 000,000,354 | ---- | C] ()
 At3.job -> C:\Windows\tasks\At3.job -> [2011/11/27 07:08:08 | 000,000,352 | ---- | C] ()
 At2.job -> C:\Windows\tasks\At2.job -> [2011/11/27 07:08:07 | 000,000,354 | ---- | C] ()
 j4066k2to.com_ -> C:\Windows\SysWow64\j4066k2to.com_ -> [2011/11/27 07:08:06 | 000,111,616 | ---- | C] ()
 At1.job -> C:\Windows\tasks\At1.job -> [2011/11/27 07:08:06 | 000,000,352 | ---- | C] ()
 aoekmg7h0xsk3fhh0kqq1s574o1q -> C:\Users\Midnight Mistress\AppData\Local\aoekmg7h0xsk3fhh0kqq1s574o1q -> [2011/11/27 06:55:37 | 000,009,556 | -HS- | C] ()
 aoekmg7h0xsk3fhh0kqq1s574o1q -> C:\ProgramData\aoekmg7h0xsk3fhh0kqq1s574o1q -> [2011/11/27 06:55:37 | 000,009,556 | -HS- | C] ()
 .recently-used.xbel -> C:\Users\Midnight Mistress\.recently-used.xbel -> [2011/11/23 22:57:13 | 000,024,351 | ---- | C] ()
 0EBC.AD9 -> C:\Users\Midnight Mistress\AppData\Roaming\0EBC.AD9 -> [2011/07/07 00:03:42 | 000,003,828 | ---- | C] ()
 Adobe Save for Web 12.0 Prefs -> C:\Users\Midnight Mistress\AppData\Local\Adobe Save for Web 12.0 Prefs -> [2011/05/11 15:56:28 | 000,001,456 | ---- | C] ()
 ezsidmv.dat -> C:\ProgramData\ezsidmv.dat -> [2010/10/29 22:18:26 | 000,000,056 | -H-- | C] ()
 mp3Media2.dll -> C:\Windows\SysWow64\mp3Media2.dll -> [2010/10/12 05:20:49 | 008,676,883 | ---- | C] ()
 wininit.ini -> C:\Windows\wininit.ini -> [2010/09/29 19:26:43 | 000,000,120 | ---- | C] ()
 fusioncache.dat -> C:\Users\Midnight Mistress\AppData\Local\fusioncache.dat -> [2010/09/19 13:23:23 | 000,000,105 | ---- | C] ()
 PerfStringBackup.INI -> C:\Windows\SysWow64\PerfStringBackup.INI -> [2010/09/19 13:18:14 | 000,743,594 | ---- | C] ()
 nsreg.dat -> C:\Windows\nsreg.dat -> [2010/08/31 13:41:54 | 000,000,000 | ---- | C] ()
 PLFSetI.exe -> C:\Windows\PLFSetI.exe -> [2010/08/31 01:43:05 | 000,200,704 | ---- | C] ()
 PidList.ini -> C:\Windows\PidList.ini -> [2010/08/31 01:43:05 | 000,000,074 | ---- | C] ()
 FixUVC.exe -> C:\Windows\FixUVC.exe -> [2010/08/31 01:43:04 | 000,106,496 | ---- | C] ()
 SETUP.INI -> C:\Windows\SETUP.INI -> [2009/11/05 13:18:51 | 000,000,000 | ---- | C] ()
 ativpsrm.bin -> C:\Windows\ativpsrm.bin -> [2009/11/05 13:13:46 | 000,000,000 | ---- | C] ()
 bootstat.dat -> C:\Windows\bootstat.dat -> [2009/07/14 00:38:36 | 000,067,584 | --S- | C] ()
 NOISE.DAT -> C:\Windows\SysWow64\NOISE.DAT -> [2009/07/13 21:35:51 | 000,000,741 | ---- | C] ()
 dssec.dat -> C:\Windows\SysWow64\dssec.dat -> [2009/07/13 21:34:42 | 000,215,943 | ---- | C] ()
 mib.bin -> C:\Windows\mib.bin -> [2009/07/13 19:10:29 | 000,043,131 | ---- | C] ()
 BWContextHandler.dll -> C:\Windows\SysWow64\BWContextHandler.dll -> [2009/07/13 18:42:10 | 000,064,000 | ---- | C] ()
 msjetoledb40.dll -> C:\Windows\SysWow64\msjetoledb40.dll -> [2009/07/13 16:03:59 | 000,364,544 | ---- | C] ()
 mlang.dat -> C:\Windows\SysWow64\mlang.dat -> [2009/06/10 16:26:10 | 000,673,088 | ---- | C] ()
< End of report >




Faerin

#4 SweetTech

SweetTech

    Agent ST


  • Members
  • 13,421 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Antarctica
  • Local time:12:26 PM

Posted 03 December 2011 - 02:15 AM

Hi Faerin!

Hello there Agent ST! :) It's a pleasure meeting you as well. No worries for the delayed response -- I see how many threads there are to get to in such a short amount of time, and of course you all have other things going on, so it's totally understandable.

Thanks for understanding!

I am still sometimes getting new windows popping up with three or so tabs open on it. I'm not exactly sure what the tabs are trying to open, because usually they're all a "page could not be opened" or some such error.

Is this also occurring in Internet Explorer or is it just isolated to Firefox?

From the looks of your OTS log you definitely have some malicious files still lingering.

Lets get starting with removing this beast of an infection!

Running OTS Fix
Start OTS Copy/Paste the information inside the codebox below into the panel where it says "Paste fix here" and then click the Run Fix button.

[Kill All Processes]
[Unregister Dlls]
[Registry - Safe List]
< FireFox Settings [Prefs.js] > -> C:\Users\Midnight Mistress\AppData\Roaming\Mozilla\FireFox\Profiles\1m3fs8fu.default\prefs.js
YN -> network.proxy.http -> "127.0.0.1"
YN -> network.proxy.http_port -> 62808
YN -> network.proxy.type -> 0
< 64bit-Internet Explorer ToolBars [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\ToolBar
YN -> "Locked" [HKLM] -> Reg Error: Key error. [Reg Error: Key error.]
< Internet Explorer ToolBars [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\ToolBar
YN -> "Locked" [HKLM] -> Reg Error: Key error. [Reg Error: Key error.]
< Run [HKEY_LOCAL_MACHINE\] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
YN -> "AdobeCS5.5ServiceManager" -> ["C:\Program Files (x86)\Common Files\Adobe\CS5.5ServiceManager\CS5.5ServiceManager.exe" -launchedbylogin]
< Run [HKEY_CURRENT_USER\] > -> HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
YN -> "conhost" -> [C:\Users\Midnight Mistress\AppData\Roaming\Microsoft\conhost.exe]
< CurrentVersion Policy Settings - Explorer [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer
YN -> \\"NoActiveDesktop" -> [1]
YN -> \\"NoActiveDesktopChanges" -> [1]
< Downloaded Program Files > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\
YN -> {8AD9C840-044E-11D1-B3E9-00805F499D93} [HKLM] -> http://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab [Java Plug-in 1.6.0_22]
YN -> {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} [HKLM] -> http://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab [Java Plug-in 1.6.0_22]
YN -> {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} [HKLM] -> http://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab [Java Plug-in 1.6.0_22]
< Winlogon\Notify settings [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\
YY -> klartew -> C:\Windows\SysWOW64\config\systemprofile\AppData\Local\klartew.dll
< 64bit-SSODL [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad
YN -> "{E6FB5E20-DE35-11CF-9C87-00AA005127ED}" [HKLM] -> Reg Error: Key error. [WebCheck]
< SSODL [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad
YN -> "{E6FB5E20-DE35-11CF-9C87-00AA005127ED}" [HKLM] -> Reg Error: Key error. [WebCheck]
[Files/Folders - Created Within 30 Days]
NY ->  {F6D58509-EB60-4089-AF6E-2BB2B7E11DDB} -> C:\Users\Midnight Mistress\AppData\Local\{F6D58509-EB60-4089-AF6E-2BB2B7E11DDB}
NY ->  {6F46F398-6339-4BC3-981B-B02309073DE6} -> C:\Users\Midnight Mistress\AppData\Local\{6F46F398-6339-4BC3-981B-B02309073DE6}
NY ->  {FB995FF2-11C0-4A43-BB0F-2461192D85B1} -> C:\Users\Midnight Mistress\AppData\Local\{FB995FF2-11C0-4A43-BB0F-2461192D85B1}
[Files/Folders - Modified Within 30 Days]
NY ->  aoekmg7h0xsk3fhh0kqq1s574o1q -> C:\Users\Midnight Mistress\AppData\Local\aoekmg7h0xsk3fhh0kqq1s574o1q
NY ->  aoekmg7h0xsk3fhh0kqq1s574o1q -> C:\ProgramData\aoekmg7h0xsk3fhh0kqq1s574o1q
NY ->  fm6jqc.dat -> C:\ProgramData\fm6jqc.dat
NY ->  j4066k2to.com_ -> C:\Windows\SysWow64\j4066k2to.com_
NY ->  j4066k2to.com -> C:\Windows\SysWow64\j4066k2to.com
NY ->  j4066k2to.com.b -> C:\Windows\SysWow64\j4066k2to.com.b
[Files - No Company Name]
NY ->  j4066k2to.com -> C:\Windows\SysWow64\j4066k2to.com
NY ->  j4066k2to.com.b -> C:\Windows\SysWow64\j4066k2to.com.b
NY ->  fm6jqc.dat -> C:\ProgramData\fm6jqc.dat
NY ->  j4066k2to.com_ -> C:\Windows\SysWow64\j4066k2to.com_
NY ->  At1.job -> C:\Windows\tasks\At1.job
NY ->  aoekmg7h0xsk3fhh0kqq1s574o1q -> C:\Users\Midnight Mistress\AppData\Local\aoekmg7h0xsk3fhh0kqq1s574o1q
NY ->  aoekmg7h0xsk3fhh0kqq1s574o1q -> C:\ProgramData\aoekmg7h0xsk3fhh0kqq1s574o1q
NY ->  0EBC.AD9 -> C:\Users\Midnight Mistress\AppData\Roaming\0EBC.AD9
[Custom Items]
:Files
C:\Windows\tasks\At*.job
:end
[EmptyFlash]
[CreateRestorePoint]
[Reboot]

The fix should only take a very short time. When the fix is completed a message box will popup either telling you that it is finished, or that a reboot is needed to complete the fix. If the fix is complete, click the Ok button and Notepad will open with a log of actions taken during the fix. Post that log back here in your next reply.

If a reboot is required, click the "Yes" button to reboot the machine. After the reboot, OTS will finish moving any files that could not be moved during the fix and NotePad will open with the final results at that time. Post that log back here in your next reply.


NEXT:



Running ComboFix
Download Combofix from either of the links below, and save it to your desktop.

Link 1
Link 2

**Note: It is important that it is saved directly to your desktop**

--------------------------------------------------------------------
IMPORTANT - Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link here

Note: If AVG or CA Internet Security Suite is installed, you must remove these programs before using Combofix. If for some reason these applications will not uninstall, try uninstalling with AppRemover by Opswat.
--------------------------------------------------------------------

Double click on ComboFix.exe & follow the prompts.
  • When finished, it will produce a report for you.
  • Please post the C:\ComboFix.txt for further review.

Have I helped you? If you'd like to assist in the fight against malware, click here Posted Image


The instructions seen in this post have been specifically tailored to this user and the issues they are experiencing with their computer. If you think you have a similar problem, please first read this topic, and then begin your own, new thread. I do not offer private support via Private Message.


#5 Faerin

Faerin
  • Topic Starter

  • Members
  • 7 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:Cleveland, OH
  • Local time:11:26 AM

Posted 03 December 2011 - 03:32 PM

Alrighty.

First, I checked Internet Explorer to double check, and it's definitely having the same problems as I was having in Firefox.

Then, I ran the OTS Fix. It asked me to reboot, so I clicked yes, but when my computer rebooted, no Notepad file opened. I'm not sure if the log might have saved somewhere else, but I don't see it on the desktop.

I do however now see two different transparent-ish files named desktop.ini. I'm not quite sure what those are. Also, every time I reboot my computer now, it automatically connects me to some other wireless connection that isn't the one it should be connecting to. And I think once or twice my laptop randomly decided to shut down on its own. I'm getting a little nervous over here. haha!

But I went ahead and ran the ComboFix and that seemed to run just fine and after it rebooted and finished, it gave me the log, as can be viewed below.



ComboFix 11-12-03.01 - Midnight Mistress 12/03/2011 14:52:43.1.1 - x64
Microsoft Windows 7 Home Premium 6.1.7600.0.1252.1.1033.18.1788.941 [GMT -5:00]
Running from: c:\users\Midnight Mistress\Desktop\ComboFix.exe
AV: Norton Internet Security *Disabled/Outdated* {63DF5164-9100-186D-2187-8DC619EFD8BF}
FW: Norton Internet Security *Disabled* {5BE4D041-DB6F-1935-0AD8-24F3E73C9FC4}
SP: Norton Internet Security *Disabled/Updated* {D8BEB080-B73A-17E3-1B37-B6B462689202}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\windows\system32\consrv.dll
c:\windows\System64
.
.
((((((((((((((((((((((((( Files Created from 2011-11-03 to 2011-12-03 )))))))))))))))))))))))))))))))
.
.
2011-12-03 20:06 . 2011-12-03 20:06 -------- d-----w- c:\users\Default\AppData\Local\temp
2011-12-03 19:26 . 2011-12-03 19:26 -------- d-----w- C:\_OTS
2011-12-03 19:06 . 2011-11-21 11:40 8822856 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{2C2BDAFD-2B7D-4947-A788-DF30688AAFFB}\mpengine.dll
2011-11-29 06:15 . 2011-11-29 06:15 -------- d--h--w- c:\programdata\Common Files
2011-11-29 06:12 . 2011-11-29 06:12 -------- d-----w- c:\windows\SysWow64\drivers\AVG
2011-11-29 06:11 . 2011-11-29 06:13 -------- d-----w- c:\programdata\AVG2012
2011-11-29 05:36 . 2011-11-29 05:36 -------- d-----w- c:\users\Midnight Mistress\AppData\Roaming\Malwarebytes
2011-11-29 05:36 . 2011-11-29 05:36 -------- d-----w- c:\programdata\Malwarebytes
2011-11-29 05:35 . 2011-11-29 05:36 -------- d-----w- c:\program files (x86)\Malwarebytes' Anti-Malware
2011-11-29 05:35 . 2011-08-31 22:00 25416 ----a-w- c:\windows\system32\drivers\mbam.sys
2011-11-29 05:35 . 2011-11-29 06:16 -------- d-----w- c:\programdata\MFAData
2011-11-10 07:06 . 2011-10-01 05:28 886784 ----a-w- c:\program files\Common Files\System\wab32.dll
2011-11-10 07:06 . 2011-10-01 04:43 708608 ----a-w- c:\program files (x86)\Common Files\System\wab32.dll
2011-11-10 07:05 . 2011-09-29 16:24 1897328 ----a-w- c:\windows\system32\drivers\tcpip.sys
2011-11-10 07:05 . 2011-09-29 04:09 3141120 ----a-w- c:\windows\system32\win32k.sys
2011-11-10 06:48 . 2011-11-18 01:15 -------- d-----w- c:\users\Midnight Mistress\AppData\Local\Akamai
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-12-03 20:10 . 2011-12-03 20:10 0 ---ha-w- c:\users\Midnight Mistress\AppData\Local\BITA0F0.tmp
2011-10-11 08:41 . 2011-10-11 08:41 561800 ----a-w- c:\windows\system32\drivers\NISx64\1008030.006\cchpx64.sys
2011-10-01 03:21 . 2011-10-12 16:15 1638912 ----a-w- c:\windows\system32\mshtml.tlb
2011-10-01 02:59 . 2011-10-12 16:15 1638912 ----a-w- c:\windows\SysWow64\mshtml.tlb
2011-09-22 00:35 . 2011-10-11 08:41 56952 ----a-w- c:\windows\system32\drivers\NISx64\1008030.006\symndisv.sys
2011-09-22 00:35 . 2011-10-11 08:41 44152 ----a-w- c:\windows\system32\drivers\NISx64\1008030.006\symndis.sys
2011-09-22 00:35 . 2011-10-11 08:41 43640 ----a-w- c:\windows\system32\drivers\NISx64\1008030.006\symids.sys
2011-09-22 00:35 . 2011-10-11 08:41 279160 ----a-w- c:\windows\system32\drivers\NISx64\1008030.006\symtdi.sys
2011-09-22 00:35 . 2011-10-11 08:41 120952 ----a-w- c:\windows\system32\drivers\NISx64\1008030.006\symfw.sys
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Akamai NetSession Interface"="c:\users\Midnight Mistress\AppData\Local\Akamai\netsession_win.exe" [2011-11-17 3303000]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"LManager"="c:\program files (x86)\Launch Manager\LManager.exe" [2009-08-18 1157128]
"Adobe Reader Speed Launcher"="c:\program files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-28 35696]
"NortonOnlineBackupReminder"="c:\program files (x86)\Symantec\Norton Online Backup\Activation\NobuActivation.exe" [2009-07-25 588648]
"StartCCC"="c:\program files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2009-07-30 98304]
"AdobeCS4ServiceManager"="c:\program files (x86)\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe" [2008-08-14 611712]
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2010-05-14 248552]
"SwitchBoard"="c:\program files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe" [2010-02-19 517096]
"AdobeCS5ServiceManager"="c:\program files (x86)\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe" [2010-02-22 406992]
"QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" [2010-11-29 421888]
.
c:\users\Midnight Mistress\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
OpenOffice.org 3.3.lnk - c:\program files (x86)\OpenOffice.org 3\program\quickstart.exe [2010-12-13 1198592]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
McAfee Security Scan Plus.lnk - c:\program files (x86)\McAfee Security Scan\2.0.181\SSScheduler.exe [2010-1-15 255536]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk *\0c:\progra~2\AVG\AVG2012\avgrsa.exe /sync /restart
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Security Packages REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\SymEFA.sys]
@="FSFilter Activity Monitor"
.
R1 bjoxgftv;bjoxgftv;c:\windows\system32\drivers\bjoxgftv.sys [x]
R1 ehvkvdtc;ehvkvdtc;c:\windows\system32\drivers\ehvkvdtc.sys [x]
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R2 gupdate;Google Update Service (gupdate);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-08-31 135664]
R3 dump_wmimmc;dump_wmimmc;c:\program files (x86)\Gpotato\Flyff\GameGuard\dump_wmimmc.sys [x]
R3 gupdatem;Google Update Service (gupdatem);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-08-31 135664]
R3 McComponentHostService;McAfee Security Scan Component Host Service;c:\program files (x86)\McAfee Security Scan\2.0.181\McCHSvc.exe [2010-01-15 227232]
R3 NTIBackupSvc;NTI Backup Now 5 Backup Service;c:\program files (x86)\NewTech Infosystems\NTI Backup Now 5\BackupSvc.exe [2009-06-18 50432]
R3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;c:\windows\system32\Drivers\RtsUStor.sys [x]
R3 SwitchBoard;Adobe SwitchBoard;c:\program files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [2010-02-19 517096]
R3 SYMNDISV;Symantec Network Filter Driver;c:\windows\System32\Drivers\NISx64\1008000.029\SYMNDISV.SYS [x]
R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys [x]
S0 SymEFA;Symantec Extended File Attributes;c:\windows\system32\drivers\NISx64\1008030.006\SYMEFA64.SYS [x]
S1 BHDrvx64;Symantec Heuristics Driver;c:\windows\System32\Drivers\NISx64\1008030.006\BHDrvx64.sys [x]
S1 ccHP;Symantec Hash Provider;c:\windows\System32\Drivers\NISx64\1008030.006\ccHPx64.sys [x]
S1 IDSVia64;IDSVia64;c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\ipsdefs\20101103.001\IDSvia64.sys [2010-10-19 476720]
S2 Akamai;Akamai NetSession Interface;c:\windows\System32\svchost.exe [2009-07-14 27136]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [x]
S2 ePowerSvc;Acer ePower Service;c:\program files\eMachines\eMachines Power Management\ePowerSvc.exe [2009-09-30 844320]
S2 Greg_Service;GRegService;c:\program files (x86)\eMachines\Registration\GregHSRW.exe [2009-08-28 1150496]
S2 Norton Internet Security;Norton Internet Security;c:\program files (x86)\Norton Internet Security\Engine\16.8.3.6\ccSvcHst.exe [2011-09-22 117648]
S2 NTISchedulerSvc;NTI Backup Now 5 Scheduler Service;c:\program files (x86)\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe [2009-06-18 144640]
S2 Updater Service;Updater Service;c:\program files\eMachines\eMachines Updater\UpdaterService.exe [2009-07-04 240160]
S3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [2010-09-10 132656]
S3 L1C;NDIS Miniport Driver for Atheros AR8131/AR8132 PCI-E Ethernet Controller (NDIS 6.20);c:\windows\system32\DRIVERS\L1C62x64.sys [x]
S3 usbfilter;AMD USB Filter Driver;c:\windows\system32\DRIVERS\usbfilter.sys [x]
.
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\svchost]
Akamai REG_MULTI_SZ Akamai
.
Contents of the 'Scheduled Tasks' folder
.
2011-12-03 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-08-31 20:32]
.
2011-12-03 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-08-31 20:32]
.
.
--------- x86-64 -----------
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2009-07-28 7982112]
"Acer ePower Management"="c:\program files\eMachines\eMachines Power Management\ePowerTray.exe" [2009-09-30 823840]
"PLFSetI"="c:\windows\PLFSetI.exe" [2010-08-31 200704]
"AdobeAAMUpdater-1.0"="c:\program files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe" [2011-03-30 499608]
"combofix"="c:\combofix\CF5256.3XE" [2009-07-14 344576]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"LoadAppInit_DLLs"=0x0
.
------- Supplementary Scan -------
.
uStart Page = hxxp://homepage.emachines.com/rdr.aspx?b=ACEW&l=0409&m=e627&r=273608101005l04h4z125r44j2393o
uLocal Page = c:\windows\system32\blank.htm
mStart Page = hxxp://homepage.emachines.com/rdr.aspx?b=ACEW&l=0409&m=e627&r=273608101005l04h4z125r44j2393o
mLocal Page = c:\windows\SysWOW64\blank.htm
uInternet Settings,ProxyOverride = *.local
IE: E&xport to Microsoft Excel - c:\progra~2\MICROS~1\Office12\EXCEL.EXE/3000
IE: Google Sidewiki... - c:\program files (x86)\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_E11712C84EA7E12B.dll/cmsidewiki.html
FF - ProfilePath - c:\users\Midnight Mistress\AppData\Roaming\Mozilla\Firefox\Profiles\1m3fs8fu.default\
FF - prefs.js: browser.startup.homepage - hxxp://homepage.emachines.com/rdr.aspx?b=ACEW&l=0409&m=e627&r=273608101005l04h4z125r44j2393o
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files (x86)\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} - c:\program files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}
FF - Ext: Skype Click to Call: {82AF8DCA-6DE9-405D-BD5E-43525BDAD38A} - c:\program files (x86)\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}
FF - Ext: Adblock Plus: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d} - %profile%\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}
FF - Ext: Memory Fox: {E173B749-DB5B-4fd2-BA0E-94ECEA0CA55B} - %profile%\extensions\{E173B749-DB5B-4fd2-BA0E-94ECEA0CA55B}
FF - Ext: NoScript: {73a6fe31-595d-460b-a920-fcc0f8843232} - %profile%\extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}
.
- - - - ORPHANS REMOVED - - - -
.
ShellIconOverlayIdentifiers-{FB314ED9-A251-47B7-93E1-CDD82E34AF8B} - (no file)
ShellIconOverlayIdentifiers-{FB314EDA-A251-47B7-93E1-CDD82E34AF8B} - (no file)
ShellIconOverlayIdentifiers-{FB314EDB-A251-47B7-93E1-CDD82E34AF8B} - (no file)
HKLM-Run-SynTPEnh - c:\program files (x86)\Synaptics\SynTP\SynTPEnh.exe
AddRemove-Adobe Shockwave Player - c:\windows\system32\Adobe\Shockwave 11\uninstaller.exe
.
.
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Norton Internet Security]
"ImagePath"="\"c:\program files (x86)\Norton Internet Security\Engine\16.8.3.6\ccSvcHst.exe\" /s \"Norton Internet Security\" /m \"c:\program files (x86)\Norton Internet Security\Engine\16.8.3.6\diMaster.dll\" /prefetch:1"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Akamai]
"ServiceDll"="c:\program files (x86)\common files\akamai/netsession_win_d768ebc.dll"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\npggsvc]
"ImagePath"="c:\windows\system32\GameMon.des -service"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\X6va002]
"ImagePath"="\??\c:\users\MIDNIG~1\AppData\Local\Temp\002C3BA.tmp"
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_USERS\S-1-5-21-2442572287-2061610231-3535897721-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.eml\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="WindowsLiveMail.Email.1"
.
[HKEY_USERS\S-1-5-21-2442572287-2061610231-3535897721-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.vcf\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="WindowsLiveMail.VCard.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil10o_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil10o_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10o.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.10"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10o.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10o.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10o.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
------------------------ Other Running Processes ------------------------
.
c:\program files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
c:\program files (x86)\Bonjour\mDNSResponder.exe
c:\program files (x86)\OpenOffice.org 3\program\soffice.exe
c:\program files (x86)\OpenOffice.org 3\program\soffice.bin
.
**************************************************************************
.
Completion time: 2011-12-03 15:19:35 - machine was rebooted
ComboFix-quarantined-files.txt 2011-12-03 20:19
.
Pre-Run: 23,474,806,784 bytes free
Post-Run: 23,283,109,888 bytes free
.
- - End Of File - - 2A41AE758766D3B806B15C702F2145D0



I eagerly await your next instructions! Many thanks again! :)

Faerin

#6 SweetTech

SweetTech

    Agent ST


  • Members
  • 13,421 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Antarctica
  • Local time:12:26 PM

Posted 04 December 2011 - 02:08 AM

Hi Faerin!

First, I checked Internet Explorer to double check, and it's definitely having the same problems as I was having in Firefox.

Thanks for checking Internet Explorer for me. That helps me by telling me that this isn't an issue that is strictly isolated to Firefox only.

Then, I ran the OTS Fix. It asked me to reboot, so I clicked yes, but when my computer rebooted, no Notepad file opened. I'm not sure if the log might have saved somewhere else, but I don't see it on the desktop.

Please don't worry about the OTS log file for right now.

I do however now see two different transparent-ish files named desktop.ini. I'm not quite sure what those are. Also, every time I reboot my computer now, it automatically connects me to some other wireless connection that isn't the one it should be connecting to. And I think once or twice my laptop randomly decided to shut down on its own. I'm getting a little nervous over here. haha!

The two different transparent files that you see named desktop.ini are normally hidden, but when you ran one of the tools it changed a setting to show all of your hidden files and folders, don't worry, this is something that will go back to the way it was when we clean-up our tools.

Is it possible that the wireless connection your computer is connecting to on reboot is one that was set as default to automatically connect to each time? Can you check the settings for the wireless connection you want to be connected to and ensure that those settings are set properly?

You may find the images at this location to be especially useful: http://www.7tutorials.com/how-connect-wireless-networks

In regards to the computer randomly restarting on you. Are you doing anything in particular when this happens?


Lets see what these scans find, and see where we stand then.

Malwarebytes' Anti-Malware

I see that you have Malwarebytes' Anti-Malware installed on your computer could you please do a scan using these settings:

  • Open Malwarebytes' Anti-Malware
  • Select the Update tab
  • Click Check for Updates
  • After the update have been completed, Select the Scanner tab.
  • Select Perform quick scan, then click on Scan
  • Leave the default options as it is and click on Start Scan
  • When done, you will be prompted. Click OK, then click on Show Results
  • Checked (ticked) all items and click on Remove Selected
  • After it has removed the items, Notepad will open. Please post this log in your next reply. You can also find the log in the Logs tab. The bottom most log is the latest
Extra Note: If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts, click OK to either and let MBAM proceed with the disinfection process, if asked to restart the computer, please do so immediately.



NEXT:



ESET Online Scanner
I'd like us to scan your machine with ESET Online Scan

Note: It is recommended to disable on-board anti-virus program and anti-spyware programs while performing scans so there are no conflicts and it will speed up scan time.
Please don't go surfing while your resident protection is disabled!
Once the scan is finished remember to re-enable your anti-virus along with your anti-spyware programs.



  • Hold down Control and click on the following link to open ESET OnlineScan in a new window.
    ESET OnlineScan
  • Click the Posted Image button.
  • For alternate browsers only: (Microsoft Internet Explorer users can skip these steps)
    • Click on Posted Image to download the ESET Smart Installer. Save it to your desktop.
    • Double click on the Posted Image icon on your desktop.
  • Check Posted Image
  • Click the Posted Image button.
  • Accept any security warnings from your browser.
  • Check Posted Image
  • Make sure that the option "Remove found threats" is Unchecked
  • When the Computer scan settings display shows, click the Advanced option, the place a check next to the following (if it is not already checked):
    • Enable Anti-Stealth technology
  • Push the Start button.
  • ESET will then download updates for itself, install itself, and begin
    scanning your computer. Please be patient as this can take some time.
  • When the scan completes, push Posted Image
  • Push Posted Image, and save the file to your desktop using a unique name, such as
    ESETScan. Include the contents of this report in your next reply.
  • Push the Posted Image button.
  • Push Posted Image


NEXT:



Security Check
Download Security Check by screen317 from here or here.
  • Save it to your Desktop.
  • Double click SecurityCheck.exe and follow the onscreen instructions inside of the black box.
  • A Notepad document should open automatically called checkup.txt; please post the contents of that document.

Have I helped you? If you'd like to assist in the fight against malware, click here Posted Image


The instructions seen in this post have been specifically tailored to this user and the issues they are experiencing with their computer. If you think you have a similar problem, please first read this topic, and then begin your own, new thread. I do not offer private support via Private Message.


#7 Faerin

Faerin
  • Topic Starter

  • Members
  • 7 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:Cleveland, OH
  • Local time:11:26 AM

Posted 05 December 2011 - 03:46 PM

Hello again! Sorry for the slight delay in posting back! I ran all three of those, and I'll post the logs right after this brief response. :)

The wireless connection it was connecting to was some random unprotected network, which it's never done before. I have it set to automatically connect to my own wireless connection, so I'm not sure why it decided to do that, but it seems that since then it's gone back to automatically connecting to my connection.

I haven't had the computer shut down on me randomly since either. The one or two times it did it, I just had basic things open like my browser window or Notepad. And it appears that it's showing me the options for Windows Firewall again, so I can only assume that that's a good thing.

And possibly the best news! It doesn't seem that my browser is redirecting anymore. I did a few test searches in Firefox and IE, and both seem to go to their relevant pages. :)

So after I ran the three, MBAM says there's nothing infected but ESET says there are some threats. Here are the logs:



Malwarebytes' Anti-Malware 1.51.2.1300
www.malwarebytes.org

Database version: 8307

Windows 6.1.7600
Internet Explorer 8.0.7600.16385

12/4/2011 6:28:29 AM
mbam-log-2011-12-04 (06-28-29).txt

Scan type: Quick scan
Objects scanned: 172866
Time elapsed: 5 minute(s), 41 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)




C:\Qoobox\Quarantine\C\Windows\System32\consrv.dll.vir Win64/Sirefef.E trojan
C:\Users\Midnight Mistress\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\21\4b89915-7a44b3d3 a variant of Java/TrojanDownloader.OpenStream.NBF trojan
C:\Users\Midnight Mistress\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\62\5024297e-2347643f a variant of Java/Exploit.CVE-2010-4452.B trojan
C:\Users\Midnight Mistress\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\62\5024297e-3d723624 a variant of Java/Exploit.CVE-2010-4452.B trojan
C:\Users\Midnight Mistress\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\62\5024297e-44d01dea a variant of Java/Exploit.CVE-2010-4452.B trojan
C:\Users\Midnight Mistress\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\62\5024297e-4990d347 a variant of Java/Exploit.CVE-2010-4452.B trojan
C:\Users\Midnight Mistress\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\62\5024297e-49f84395 a variant of Java/Exploit.CVE-2010-4452.B trojan
C:\Users\Midnight Mistress\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\62\5024297e-561da018 a variant of Java/Exploit.CVE-2010-4452.B trojan
C:\Users\Midnight Mistress\Downloads\SonyVegasPro9e_xlj\Keygen.exe a variant of Win32/Keygen.AR application
C:\_OTS\MovedFiles\12032011_142615\C_Windows\SysWOW64\j4066k2to.com a variant of Win32/Kryptik.VRX trojan
C:\_OTS\MovedFiles\12032011_142615\C_Windows\SysWOW64\j4066k2to.com_ a variant of Win32/Kryptik.VRX trojan
C:\_OTS\MovedFiles\12032011_142615\C_Windows\SysWOW64\config\systemprofile\AppData\Local\klartew.dll a variant of Win32/TrojanProxy.Agent.NIB trojan




Results of screen317's Security Check version 0.99.28
Windows 7 x64 (UAC is enabled)
Internet Explorer 8 Out of date!
``````````````````````````````
Antivirus/Firewall Check:

Windows Firewall Enabled!
ESET Online Scanner v3
Norton Internet Security
McAfee Security Scan Plus
WMI entry may not exist for antivirus; attempting automatic update.
```````````````````````````````
Anti-malware/Other Utilities Check:

Malwarebytes' Anti-Malware
Java™ 6 Update 22
Java version out of date!
Adobe Reader 9 Adobe Reader out of date!
Mozilla Firefox ((3.6.24)) Firefox out of Date!
````````````````````````````````
Process Check:
objlist.exe by Laurent

Norton ccSvcHst.exe
``````````End of Log````````````



Thanks so much again for the help!

Faerin

#8 SweetTech

SweetTech

    Agent ST


  • Members
  • 13,421 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Antarctica
  • Local time:12:26 PM

Posted 06 December 2011 - 01:40 AM

Hi Faerin,

No worries on the delay.

The wireless connection it was connecting to was some random unprotected network, which it's never done before. I have it set to automatically connect to my own wireless connection, so I'm not sure why it decided to do that, but it seems that since then it's gone back to automatically connecting to my connection.

I haven't had the computer shut down on me randomly since either. The one or two times it did it, I just had basic things open like my browser window or Notepad. And it appears that it's showing me the options for Windows Firewall again, so I can only assume that that's a good thing.

And possibly the best news! It doesn't seem that my browser is redirecting anymore. I did a few test searches in Firefox and IE, and both seem to go to their relevant pages. :)

That indeed is great news!! So happy to hear that. It seems like we are making some excellent progress here.

You're doing a fantastic job running all of these scans and fixes! :)

Hi!

These threat(s) below are currently in Quarantine/System Restore and shall be removed when we clean up our tools later on.

C:\Qoobox\Quarantine\C\Windows\System32\consrv.dll.vir Win64/Sirefef.E trojan
C:\_OTS\MovedFiles\12032011_142615\C_Windows\SysWOW64\j4066k2to.com a variant of Win32/Kryptik.VRX trojan
C:\_OTS\MovedFiles\12032011_142615\C_Windows\SysWOW64\j4066k2to.com_ a variant of Win32/Kryptik.VRX trojan
C:\_OTS\MovedFiles\12032011_142615\C_Windows\SysWOW64\config\systemprofile\AppData\Local\klartew.dll a variant of Win32/TrojanProxy.Agent.NIB trojan


These threat(s) below will be removed very shortly:

C:\Users\Midnight Mistress\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\21\4b89915-7a44b3d3 a variant of Java/TrojanDownloader.OpenStream.NBF trojan
C:\Users\Midnight Mistress\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\62\5024297e-2347643f a variant of Java/Exploit.CVE-2010-4452.B trojan
C:\Users\Midnight Mistress\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\62\5024297e-3d723624 a variant of Java/Exploit.CVE-2010-4452.B trojan
C:\Users\Midnight Mistress\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\62\5024297e-44d01dea a variant of Java/Exploit.CVE-2010-4452.B trojan
C:\Users\Midnight Mistress\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\62\5024297e-4990d347 a variant of Java/Exploit.CVE-2010-4452.B trojan
C:\Users\Midnight Mistress\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\62\5024297e-49f84395 a variant of Java/Exploit.CVE-2010-4452.B trojan
C:\Users\Midnight Mistress\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\62\5024297e-561da018 a variant of Java/Exploit.CVE-2010-4452.B trojan
C:\Users\Midnight Mistress\Downloads\SonyVegasPro9e_xlj\Keygen.exe a variant of Win32/Keygen.AR application


____________________________________________________

From the looks of your SecurityCheck log, I can see that we have some outdated programs that need to be updated.

Lets address those programs that need updating now!

Java Outdated

Important Note: Your version of Java is out of date. Older versions have vulnerabilities that malicious sites can use to exploit and infect your system.Please follow these steps to remove older version Java components and update:
  • Download the latest version of Java Runtime Environment (JRE) Version 7 and save it to your desktop.
  • Look for "Java Platform, Standard Edition".
  • Click the "Download JRE" button to the right.
  • Read the License Agreement, and then check the box that says: "Accept License Agreement".
  • From the list, select your OS and Platform:
    • 32-bit Select: Windows x86 Offline.
    • 64-bit Select: Windows x64.
  • If a download for an Offline Installation is available, it is recommended to choose that and save the file to your desktop.
  • Close any programs you may have running - especially your web browser.
Go to Posted Image > Control Panel, double-click on Add/Remove Programs or Programs and Features in Vista/Windows 7 and remove all older versions of Java.
  • Check (highlight) any item with Java Runtime Environment (JRE or J2SE) in the name.
  • Click the Remove or Change/Remove button and follow the onscreen instructions for the Java uninstaller.
  • Repeat as many times as necessary to remove each Java versions.
  • Reboot your computer once all Java components are removed.
  • Then from your desktop double-click on jre-7-windows-i586.exe to install the newest version.
  • If using Windows 7 or Vista and the installer refuses to launch due to insufficient user permissions, then Run As Administrator.
  • When the Java Setup - Welcome window opens, click the Install > button.
  • If offered to install a Toolbar, just uncheck the box before continuing unless you want it.
  • The McAfee Security Scan Plus tool is installed by default unless you uncheck the McAfee installation box when updating Java.
Note: The Java Quick Starter (JQS.exe) adds a service to improve the initial startup time of Java applets and applications but it's not necessary.
To disable the JQS service if you don't want to use it:
  • Go to Start > Control Panel > Java > Advanced > Miscellaneous and uncheck the box for Java Quick Starter.
  • Click Ok and reboot your computer.


NEXT



Update Adobe Reader
Earlier versions of Adobe Reader have known security flaws so it is recommended that you update your copy
  • Go to Start > Control Panel > Add/Remove Programs
  • Remove ALL instances of Adobe Reader
  • Re-boot your computer as required.
  • Once ALL versions of Adobe Reader have been uninstalled, visit: <<here>> and download the latest version of Adobe Reader
Alternative Option: after uninstalling Adobe Reader, you could try installing Foxit Reader from >here< Foxit Reader has fewer add-ons therefore loads more quickly.



NEXT:



OTL Fix

We need to run an OTL Fix
  • Please reopen Posted Image on your desktop.
  • Copy and Paste the following code into the Posted Image textbox.
    :Services
    :OTL
    
    :Reg
    
    :Files
    C:\Users\Midnight Mistress\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\21\4b89915-7a44b3d3
    C:\Users\Midnight Mistress\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\62\5024297e-2347643f
    C:\Users\Midnight Mistress\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\62\5024297e-3d723624
    C:\Users\Midnight Mistress\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\62\5024297e-44d01dea
    C:\Users\Midnight Mistress\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\62\5024297e-4990d347
    C:\Users\Midnight Mistress\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\62\5024297e-49f84395
    C:\Users\Midnight Mistress\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\62\5024297e-561da018
    C:\Users\Midnight Mistress\Downloads\SonyVegasPro9e_xlj\
    ipconfig /flushdns /c
    :Commands
    [purity]
    [resethosts]
    [CreateRestorePoint]
    [emptytemp]
    [EMPTYFLASH]
    
  • Push Posted Image
  • OTL may ask to reboot the machine. Please do so if asked.
  • Click the OK button.
  • A report will open. Copy and Paste that report in your next reply.
  • If the machine reboots, the log will be located at C:\_OTL\MovedFiles\mmddyyyy_hhmmss.log, where mmddyyyy_hhmmss is the date of the tool run.


NEXT:



Update FireFox
You're currently using an outdated version of Firefox. The latest version of Firefox is 8.0.1

You can get the latest version of Firefox by accessing the Posted Image menu in Firefox and then selecting Posted Image.

Please make sure that you Posted Image again after updating to the latest version to make sure that you have in fact received the latest version.



NEXT:



OTL Custom Scan

We need to run an OTL Custom Scan
  • Please reopen Posted Image on your desktop.
  • Copy and Paste the following code into the Posted Image textbox.


    netsvcs
    drivers32
    hklm\software\clients\startmenuinternet|command /rs
    %USERPROFILE%\AppData\Local\Google\Chrome\User Data\*.* /s
    HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs

  • Push the Posted Image button.
  • A report will open. Copy and Paste that report in your next reply.


NEXT:



What outstanding issues (if any) are you still experiencing with your computer?

Have I helped you? If you'd like to assist in the fight against malware, click here Posted Image


The instructions seen in this post have been specifically tailored to this user and the issues they are experiencing with their computer. If you think you have a similar problem, please first read this topic, and then begin your own, new thread. I do not offer private support via Private Message.


#9 Faerin

Faerin
  • Topic Starter

  • Members
  • 7 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:Cleveland, OH
  • Local time:11:26 AM

Posted 08 December 2011 - 09:52 AM

Okay, I just finished going through those steps and here are the logs. The OTL quick scan opened two text files after running, so I'm posting both just in case. So far, all is good. I haven't really had any more issues at all. :) I just want to make sure I get my computer completely cleaned up and protected so I can browse safely. What programs would you suggest having at the end of this to make sure I keep my computer protected?



All processes killed
========== SERVICES/DRIVERS ==========
========== OTL ==========
========== REGISTRY ==========
========== FILES ==========
C:\Users\Midnight Mistress\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\21\4b89915-7a44b3d3 moved successfully.
C:\Users\Midnight Mistress\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\62\5024297e-2347643f moved successfully.
C:\Users\Midnight Mistress\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\62\5024297e-3d723624 moved successfully.
C:\Users\Midnight Mistress\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\62\5024297e-44d01dea moved successfully.
C:\Users\Midnight Mistress\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\62\5024297e-4990d347 moved successfully.
C:\Users\Midnight Mistress\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\62\5024297e-49f84395 moved successfully.
C:\Users\Midnight Mistress\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\62\5024297e-561da018 moved successfully.
C:\Users\Midnight Mistress\Downloads\SonyVegasPro9e_xlj folder moved successfully.
< ipconfig /flushdns /c >
Windows IP Configuration
Successfully flushed the DNS Resolver Cache.
C:\Users\Midnight Mistress\Desktop\cmd.bat deleted successfully.
C:\Users\Midnight Mistress\Desktop\cmd.txt deleted successfully.
========== COMMANDS ==========
C:\Windows\System32\drivers\etc\Hosts moved successfully.
HOSTS file reset successfully
Restore point Set: OTL Restore Point

[EMPTYTEMP]

User: All Users

User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 67 bytes
->Flash cache emptied: 0 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: Midnight Mistress
->Temp folder emptied: 1725456 bytes
->Temporary Internet Files folder emptied: 68415024 bytes
->Java cache emptied: 25776800 bytes
->FireFox cache emptied: 63301520 bytes
->Google Chrome cache emptied: 46886880 bytes
->Flash cache emptied: 2429 bytes

User: Public
->Temp folder emptied: 0 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32 (64bit) .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 4726 bytes
%systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 33170 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 197.00 mb


[EMPTYFLASH]

User: All Users

User: Default
->Flash cache emptied: 0 bytes

User: Default User
->Flash cache emptied: 0 bytes

User: Midnight Mistress
->Flash cache emptied: 0 bytes

User: Public

Total Flash Files Cleaned = 0.00 mb


OTL by OldTimer - Version 3.2.31.0 log created on 12082011_004543

Files\Folders moved on Reboot...
C:\Users\Midnight Mistress\AppData\Local\Temp\FXSAPIDebugLogFile.txt moved successfully.
File\Folder C:\Windows\temp\JETB337.tmp not found!

Registry entries deleted on Reboot...




OTL logfile created on: 12/8/2011 9:17:14 AM - Run 1
OTL by OldTimer - Version 3.2.31.0 Folder = C:\Users\Midnight Mistress\Desktop
64bit- Home Premium Edition (Version = 6.1.7600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7600.16385)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

1.75 Gb Total Physical Memory | 0.85 Gb Available Physical Memory | 48.76% Memory free
3.49 Gb Paging File | 2.23 Gb Available in Paging File | 63.82% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 136.95 Gb Total Space | 25.19 Gb Free Space | 18.39% Space Free | Partition Type: NTFS

Computer Name: MIDNIGHT-PC | User Name: Midnight Mistress | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan | Include 64bit Scans
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2011/12/08 09:07:09 | 000,924,632 | ---- | M] (Mozilla Corporation) -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe
PRC - [2011/12/08 00:44:19 | 000,584,192 | ---- | M] (OldTimer Tools) -- C:\Users\Midnight Mistress\Desktop\OTL.exe
PRC - [2011/11/17 06:58:04 | 003,303,000 | ---- | M] (Akamai Technologies, Inc) -- C:\Users\Midnight Mistress\AppData\Local\Akamai\netsession_win.exe
PRC - [2011/09/21 19:35:57 | 000,117,648 | R--- | M] (Symantec Corporation) -- C:\Program Files (x86)\Norton Internet Security\Engine\16.8.3.6\ccSvcHst.exe
PRC - [2011/06/06 12:55:28 | 000,064,952 | ---- | M] (Adobe Systems Incorporated) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
PRC - [2011/01/17 18:37:40 | 011,322,880 | ---- | M] (OpenOffice.org) -- C:\Program Files (x86)\OpenOffice.org 3\program\soffice.exe
PRC - [2011/01/17 18:37:40 | 011,314,688 | ---- | M] (OpenOffice.org) -- C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin
PRC - [2010/08/31 01:42:43 | 000,200,704 | ---- | M] () -- C:\Windows\PLFSetI.exe
PRC - [2010/01/15 07:49:20 | 000,255,536 | ---- | M] (McAfee, Inc.) -- C:\Program Files (x86)\McAfee Security Scan\2.0.181\SSScheduler.exe
PRC - [2009/08/28 04:38:58 | 001,150,496 | ---- | M] (Acer Incorporated) -- C:\Program Files (x86)\eMachines\Registration\GregHSRW.exe
PRC - [2009/08/18 04:42:08 | 001,157,128 | ---- | M] (Dritek System Inc.) -- C:\Program Files (x86)\Launch Manager\LManager.exe
PRC - [2009/07/03 21:47:12 | 000,240,160 | ---- | M] (Acer) -- C:\Program Files\eMachines\eMachines Updater\UpdaterService.exe


========== Modules (No Company Name) ==========

MOD - [2011/12/08 09:07:08 | 001,989,592 | ---- | M] () -- C:\Program Files (x86)\Mozilla Firefox\mozjs.dll
MOD - [2011/02/21 07:41:15 | 000,985,088 | ---- | M] () -- C:\Program Files (x86)\OpenOffice.org 3\program\libxml2.dll
MOD - [2010/08/31 01:42:43 | 000,200,704 | ---- | M] () -- C:\Windows\PLFSetI.exe


========== Win32 Services (SafeList) ==========

SRV:64bit: - [2009/09/30 17:44:58 | 000,844,320 | ---- | M] (Acer Incorporated) [Auto | Running] -- C:\Program Files\eMachines\eMachines Power Management\ePowerSvc.exe -- (ePowerSvc)
SRV:64bit: - [2009/07/29 07:03:42 | 000,203,264 | ---- | M] (AMD) [Auto | Running] -- C:\Windows\SysNative\atiesrxx.exe -- (AMD External Events Utility)
SRV:64bit: - [2009/07/13 20:41:27 | 001,011,712 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)
SRV:64bit: - [2009/07/03 21:47:12 | 000,240,160 | ---- | M] (Acer) [Auto | Running] -- C:\Program Files\eMachines\eMachines Updater\UpdaterService.exe -- (Updater Service)
SRV - [2011/11/17 20:54:33 | 003,313,752 | ---- | M] () [Auto | Running] -- c:\program files (x86)\common files\akamai/netsession_win_d768ebc.dll -- (Akamai)
SRV - [2011/09/21 19:35:57 | 000,117,648 | R--- | M] (Symantec Corporation) [Auto | Running] -- C:\Program Files (x86)\Norton Internet Security\Engine\16.8.3.6\ccSvcHst.exe -- (Norton Internet Security)
SRV - [2011/06/06 12:55:28 | 000,064,952 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice)
SRV - [2011/02/10 10:20:12 | 000,655,624 | ---- | M] (Acresso Software Inc.) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe -- (FLEXnet Licensing Service)
SRV - [2010/12/21 20:06:22 | 004,304,808 | ---- | M] (INCA Internet Co., Ltd.) [On_Demand | Stopped] -- C:\Windows\SysWow64\GameMon.des -- (npggsvc)
SRV - [2010/11/03 21:37:35 | 000,068,096 | ---- | M] () [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe -- (Macromedia Licensing Service)
SRV - [2010/03/18 13:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)
SRV - [2010/02/19 12:37:14 | 000,517,096 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe -- (SwitchBoard)
SRV - [2010/01/15 07:49:20 | 000,227,232 | ---- | M] (McAfee, Inc.) [On_Demand | Stopped] -- C:\Program Files (x86)\McAfee Security Scan\2.0.181\McCHSvc.exe -- (McComponentHostService)
SRV - [2009/08/28 04:38:58 | 001,150,496 | ---- | M] (Acer Incorporated) [Auto | Running] -- C:\Program Files (x86)\eMachines\Registration\GregHSRW.exe -- (Greg_Service)
SRV - [2009/06/10 16:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)
SRV - [2009/05/22 13:02:20 | 000,250,616 | ---- | M] (WildTangent, Inc.) [On_Demand | Stopped] -- C:\Program Files (x86)\eMachines Games\eMachines Game Console\GameConsoleService.exe -- (GameConsoleService)


========== Driver Services (SafeList) ==========

DRV:64bit: - [2011/10/11 03:41:31 | 000,561,800 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\NISx64\1008030.006\cchpx64.sys -- (ccHP)
DRV:64bit: - [2011/09/21 19:35:58 | 000,279,160 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\NISx64\1008030.006\symtdi.sys -- (SYMTDI)
DRV:64bit: - [2011/03/11 01:22:41 | 000,107,904 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata)
DRV:64bit: - [2011/03/11 01:22:40 | 000,027,008 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata)
DRV:64bit: - [2011/02/18 15:36:58 | 000,051,712 | ---- | M] (Apple, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\usbaapl64.sys -- (USBAAPL64)
DRV:64bit: - [2010/09/05 23:03:55 | 000,172,592 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\SYMEVENT64x86.SYS -- (SymEvent)
DRV:64bit: - [2010/01/20 16:18:24 | 000,334,384 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\NISx64\1008030.006\BHDrvx64.sys -- (BHDrvx64)
DRV:64bit: - [2009/11/05 13:50:46 | 000,476,720 | ---- | M] (Symantec Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\NISx64\1008030.006\srtsp64.sys -- (SRTSP)
DRV:64bit: - [2009/11/05 13:50:46 | 000,402,992 | ---- | M] (Symantec Corporation) [File_System | Boot | Running] -- C:\Windows\SysNative\drivers\NISx64\1008030.006\SymEFA64.sys -- (SymEFA)
DRV:64bit: - [2009/11/05 13:50:46 | 000,032,304 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\NISx64\1008030.006\srtspx64.sys -- (SRTSPX) Symantec Real Time Storage Protection (PEL)
DRV:64bit: - [2009/11/05 13:50:46 | 000,031,280 | R--- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\SymIMV.sys -- (SymIM)
DRV:64bit: - [2009/08/21 04:18:16 | 002,978,296 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\BCMWL664.SYS -- (BCM43XX)
DRV:64bit: - [2009/08/09 22:07:14 | 000,222,208 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\RtsUStor.sys -- (RSUSBSTOR)
DRV:64bit: - [2009/07/29 17:11:24 | 006,038,016 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\atikmdag.sys -- (atikmdag)
DRV:64bit: - [2009/07/27 02:04:36 | 000,058,880 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\L1C62x64.sys -- (L1C) NDIS Miniport Driver for Atheros AR8131/AR8132 PCI-E Ethernet Controller (NDIS 6.20)
DRV:64bit: - [2009/07/13 20:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs)
DRV:64bit: - [2009/07/13 20:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2)
DRV:64bit: - [2009/07/13 20:47:48 | 000,077,888 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD)
DRV:64bit: - [2009/07/13 20:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor)
DRV:64bit: - [2009/06/18 07:12:32 | 000,272,432 | ---- | M] (Synaptics Incorporated) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\SynTP.sys -- (SynTP)
DRV:64bit: - [2009/06/10 15:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv)
DRV:64bit: - [2009/06/10 15:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv)
DRV:64bit: - [2009/06/10 15:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a)
DRV:64bit: - [2009/06/10 15:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir)
DRV:64bit: - [2009/05/05 03:46:08 | 000,018,432 | ---- | M] (NewTech Infosystems, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\NTIDrvr.sys -- (NTIDrvr)
DRV:64bit: - [2009/05/05 03:46:08 | 000,016,896 | ---- | M] (NewTech Infosystems Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\UBHelper.sys -- (UBHelper)
DRV:64bit: - [2009/05/04 08:30:28 | 000,016,440 | ---- | M] (Advanced Micro Devices Inc.) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\AtiPcie.sys -- (AtiPcie) AMD PCI Express (3GIO)
DRV:64bit: - [2009/04/03 08:39:58 | 000,034,872 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\usbfilter.sys -- (usbfilter)
DRV - [2010/10/19 15:36:20 | 000,476,720 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20101103.001\IDSviA64.sys -- (IDSVia64)
DRV - [2010/09/28 03:00:00 | 001,804,336 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Stopped] -- C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20101105.003\EX64.SYS -- (NAVEX15)
DRV - [2010/09/28 03:00:00 | 000,117,808 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Stopped] -- C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20101105.003\ENG64.SYS -- (NAVENG)
DRV - [2010/09/10 10:42:52 | 000,475,696 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys -- (eeCtrl)
DRV - [2010/09/10 10:42:52 | 000,132,656 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys -- (EraserUtilRebootDrv)
DRV - [2009/07/13 20:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount)
DRV - [2009/03/25 22:16:08 | 000,025,608 | ---- | M] (Dritek System Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysWOW64\Drivers\DKbFltr.sys -- (DKbFltr) Dritek Keyboard Filter Driver (64-bit)
DRV - [2005/01/04 13:43:08 | 000,004,682 | ---- | M] (INCA Internet Co., Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysWOW64\npptNT2.sys -- (NPPTNT2)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://homepage.emachines.com/rdr.aspx?b=ACEW&l=0409&m=e627&r=273608101005l04h4z125r44j2393o
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://homepage.emachines.com/rdr.aspx?b=ACEW&l=0409&m=e627&r=273608101005l04h4z125r44j2393o

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://homepage.emachines.com/rdr.aspx?b=ACEW&l=0409&m=e627&r=273608101005l04h4z125r44j2393o
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

========== FireFox ==========

FF - prefs.js..browser.startup.homepage: "http://homepage.emachines.com/rdr.aspx?b=ACEW&l=0409&m=e627&r=273608101005l04h4z125r44j2393o"
FF - prefs.js..extensions.enabledItems: {82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}:5.6.0.8442
FF - prefs.js..extensions.enabledItems: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:1.3.10
FF - prefs.js..extensions.enabledItems: {E173B749-DB5B-4fd2-BA0E-94ECEA0CA55B}:7.4
FF - prefs.js..extensions.enabledItems: {73a6fe31-595d-460b-a920-fcc0f8843232}:2.2.1

FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre7\bin\new_plugin\npjp2.dll (Oracle Corporation)
FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\Windows\system32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files (x86)\Microsoft Silverlight\4.0.60831.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3508.1109: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@pandonetworks.com/PandoWebPlugin: C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.21.79\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.21.79\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKCU\Software\MozillaPlugins\pandonetworks.com/PandoWebPlugin: C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{7BA52691-1876-45ce-9EE6-54BCB3B04BBC}: C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\coFFPlgn\ [2011/10/15 14:08:31 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 8.0.1\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2011/12/08 09:07:10 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 8.0.1\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2011/12/08 09:07:10 | 000,000,000 | ---D | M]

[2010/08/31 14:53:08 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Midnight Mistress\AppData\Roaming\Mozilla\Extensions
[2010/08/31 14:53:08 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Midnight Mistress\AppData\Roaming\Mozilla\Extensions\IMVUClientXUL@imvu.com
[2011/12/08 09:07:48 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Midnight Mistress\AppData\Roaming\Mozilla\Firefox\Profiles\1m3fs8fu.default\extensions
[2011/11/30 05:26:38 | 000,000,000 | ---D | M] (Adblock Plus) -- C:\Users\Midnight Mistress\AppData\Roaming\Mozilla\Firefox\Profiles\1m3fs8fu.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}
[2011/11/30 05:26:38 | 000,000,000 | ---D | M] (Memory Fox) -- C:\Users\Midnight Mistress\AppData\Roaming\Mozilla\Firefox\Profiles\1m3fs8fu.default\extensions\{E173B749-DB5B-4fd2-BA0E-94ECEA0CA55B}
[2011/12/08 09:07:17 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\Mozilla Firefox\extensions
[2011/10/28 02:42:03 | 000,000,000 | ---D | M] (Skype Click to Call) -- C:\Program Files (x86)\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}
() (No name found) -- C:\USERS\MIDNIGHT MISTRESS\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\1M3FS8FU.DEFAULT\EXTENSIONS\{73A6FE31-595D-460B-A920-FCC0F8843232}.XPI
[2011/12/08 09:07:09 | 000,134,104 | ---- | M] (Mozilla Foundation) -- C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll
[2011/02/21 07:37:49 | 000,472,808 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files (x86)\mozilla firefox\plugins\npdeployJava1.dll
[2011/12/08 09:07:06 | 000,002,252 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml
[2011/12/08 09:07:06 | 000,002,040 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\twitter.xml

========== Chrome ==========

CHR - default_search_provider: Google (Enabled)
CHR - default_search_provider: search_url = {google:baseURL}search?{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}sourceid=chrome&ie={inputEncoding}&q={searchTerms}
CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?client=chrome&hl={language}&q={searchTerms}
CHR - plugin: Shockwave Flash (Enabled) = C:\Program Files (x86)\Google\Chrome\Application\13.0.782.218\gcswf32.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin2.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin3.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin4.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin5.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin6.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin7.dll
CHR - plugin: Java Deployment Toolkit 6.0.220.4 (Enabled) = C:\Program Files (x86)\Java\jre6\bin\new_plugin\npdeployJava1.dll
CHR - plugin: Java™ Platform SE 6 U22 (Enabled) = C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll
CHR - plugin: Silverlight Plug-In (Enabled) = c:\Program Files (x86)\Microsoft Silverlight\4.0.60531.0\npctrl.dll
CHR - plugin: Shockwave for Director (Enabled) = C:\Windows\system32\Adobe\Director\np32dsw.dll
CHR - plugin: Chrome NaCl (Disabled) = C:\Program Files (x86)\Google\Chrome\Application\13.0.782.218\ppGoogleNaClPluginChrome.dll
CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Program Files (x86)\Google\Chrome\Application\13.0.782.218\pdf.dll
CHR - plugin: Adobe Acrobat (Disabled) = C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\nppdf32.dll
CHR - plugin: Google Update (Enabled) = C:\Users\Midnight Mistress\AppData\Local\Google\Update\1.3.21.69\npGoogleUpdate3.dll
CHR - plugin: Pando Web Plugin (Enabled) = C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll
CHR - plugin: Windows Live\u0099 Photo Gallery (Enabled) = C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll
CHR - plugin: Default Plug-in (Enabled) = default_plugin

O1 HOSTS File: ([2011/12/08 00:45:48 | 000,000,098 | ---- | M]) - C:\Windows\SysNative\drivers\etc\Hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: ::1 localhost
O2:64bit: - BHO: (Java™ Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O2 - BHO: (Symantec NCO BHO) - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files (x86)\Norton Internet Security\Engine\16.8.3.6\CoIEPlg.dll (Symantec Corporation)
O2 - BHO: (Symantec Intrusion Prevention) - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files (x86)\Norton Internet Security\Engine\16.8.3.6\IPSBHO.dll (Symantec Corporation)
O2 - BHO: (Skype Browser Helper) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O2 - BHO: (Java™ Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll File not found
O3 - HKLM\..\Toolbar: (Norton Toolbar) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton Internet Security\Engine\16.8.3.6\CoIEPlg.dll (Symantec Corporation)
O3 - HKCU\..\Toolbar\WebBrowser: (Norton Toolbar) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton Internet Security\Engine\16.8.3.6\CoIEPlg.dll (Symantec Corporation)
O4:64bit: - HKLM..\Run: [Acer ePower Management] C:\Program Files\eMachines\eMachines Power Management\ePowerTray.exe (Acer Incorporated)
O4:64bit: - HKLM..\Run: [AdobeAAMUpdater-1.0] C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe (Adobe Systems Incorporated)
O4:64bit: - HKLM..\Run: [PLFSetI] C:\Windows\PLFSetI.exe ()
O4:64bit: - HKLM..\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Realtek Semiconductor)
O4 - HKLM..\Run: [AdobeCS4ServiceManager] C:\Program Files (x86)\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [AdobeCS5ServiceManager] C:\Program Files (x86)\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [LManager] C:\Program Files (x86)\Launch Manager\LManager.exe (Dritek System Inc.)
O4 - HKLM..\Run: [NortonOnlineBackupReminder] C:\Program Files (x86)\Symantec\Norton Online Backup\Activation\NobuActivation.exe (Symantec Corporation)
O4 - HKLM..\Run: [StartCCC] C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.)
O4 - HKLM..\Run: [SwitchBoard] C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe (Adobe Systems Incorporated)
O4 - HKCU..\Run: [Akamai NetSession Interface] C:\Users\Midnight Mistress\AppData\Local\Akamai\netsession_win.exe (Akamai Technologies, Inc)
O4 - Startup: C:\Users\Midnight Mistress\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.3.lnk = C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe ()
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O8:64bit: - Extra context menu item: Google Sidewiki... - res://C:\Program Files (x86)\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_E11712C84EA7E12B.dll/cmsidewiki.html File not found
O8 - Extra context menu item: Google Sidewiki... - res://C:\Program Files (x86)\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_E11712C84EA7E12B.dll/cmsidewiki.html File not found
O9 - Extra Button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra 'Tools' menuitem : Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000009 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000004 - mmswsock.dll File not found
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000005 - mmswsock.dll File not found
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000006 - mmswsock.dll File not found
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000007 - mmswsock.dll File not found
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - %SystemRoot%\System32\nwprovau.dll File not found
O10 - NameSpace_Catalog5\Catalog_Entries\000000000009 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000025 - C:\Program Files (x86)\Bonjour\mdnsNSP.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000026 - C:\Program Files (x86)\Bonjour\mdnsNSP.dll File not found
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.7.0/jinstall-1_7_0_01-windows-i586.cab (Java Plug-in 10.1.0)
O16 - DPF: {CAFEEFAC-0017-0000-0001-ABCDEFFEDCBA} http://java.sun.com/update/1.7.0/jinstall-1_7_0_01-windows-i586.cab (Java Plug-in 1.7.0_01)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.7.0/jinstall-1_7_0_01-windows-i586.cab (Java Plug-in 1.7.0_01)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.254
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{98E60A81-E364-4AE1-93D3-2372EABF7DF9}: DhcpNameServer = 192.168.1.254
O18:64bit: - Protocol\Handler\livecall - No CLSID value found
O18:64bit: - Protocol\Handler\ms-help - No CLSID value found
O18:64bit: - Protocol\Handler\ms-itss - No CLSID value found
O18:64bit: - Protocol\Handler\msnim - No CLSID value found
O18:64bit: - Protocol\Handler\skype-ie-addon-data - No CLSID value found
O18:64bit: - Protocol\Handler\symres - No CLSID value found
O18:64bit: - Protocol\Handler\wlmailhtml - No CLSID value found
O18:64bit: - Protocol\Handler\wlpg - No CLSID value found
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O18 - Protocol\Handler\symres {AA1061FE-6C41-421f-9344-69640C9732AB} - C:\Program Files (x86)\Norton Internet Security\Engine\16.8.3.6\CoIEPlg.dll (Symantec Corporation)
O20:64bit: - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysNative\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O20 - HKLM Winlogon: Shell - (Explorer.exe) -C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) -C:\Windows\SysWOW64\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O32 - HKLM CDRom: AutoRun - 1
O34 - HKLM BootExecute: (autocheck autochk *)
O34 - HKLM BootExecute: (C:\PROGRA~2\AVG\AVG2012\avgrsa.exe /sync /restart)
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O35 - HKCU\..exefile [open] -- "%1" %*
O37:64bit: - HKLM\...com [@ = ComFile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = ComFile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKCU\...exe [@ = exefile] -- "%1" %*


Drivers32:64bit: msacm.l3acm - C:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.l3acm - C:\Windows\SysWOW64\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: vidc.cvid - C:\Windows\SysWow64\iccvid.dll (Radius Inc.)

========== Files/Folders - Created Within 30 Days ==========

[2011/12/08 00:45:43 | 000,000,000 | ---D | C] -- C:\_OTL
[2011/12/08 00:44:06 | 000,584,192 | ---- | C] (OldTimer Tools) -- C:\Users\Midnight Mistress\Desktop\OTL.exe
[2011/12/07 23:54:56 | 000,000,000 | -HSD | C] -- C:\Config.Msi
[2011/12/07 23:49:18 | 000,000,000 | ---D | C] -- C:\Program Files\Java
[2011/12/07 15:01:34 | 000,000,000 | -HSD | C] -- C:\$RECYCLE.BIN
[2011/12/04 06:41:40 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\ESET
[2011/12/04 06:39:37 | 002,322,184 | ---- | C] (ESET) -- C:\Users\Midnight Mistress\Desktop\esetsmartinstaller_enu.exe
[2011/12/03 14:49:41 | 000,518,144 | ---- | C] (SteelWerX) -- C:\Windows\SWREG.exe
[2011/12/03 14:49:41 | 000,406,528 | ---- | C] (SteelWerX) -- C:\Windows\SWSC.exe
[2011/12/03 14:49:41 | 000,060,416 | ---- | C] (NirSoft) -- C:\Windows\NIRCMD.exe
[2011/12/03 14:49:31 | 000,000,000 | ---D | C] -- C:\Windows\ERDNT
[2011/12/03 14:49:24 | 000,000,000 | ---D | C] -- C:\Qoobox
[2011/12/03 14:46:18 | 004,326,308 | R--- | C] (Swearware) -- C:\Users\Midnight Mistress\Desktop\ComboFix.exe
[2011/12/03 14:26:15 | 000,000,000 | ---D | C] -- C:\_OTS
[2011/12/02 04:52:59 | 000,646,144 | ---- | C] (OldTimer Tools) -- C:\Users\Midnight Mistress\Desktop\OTS.exe
[2011/12/02 04:49:42 | 001,566,512 | ---- | C] (Kaspersky Lab ZAO) -- C:\Users\Midnight Mistress\Desktop\tdsskiller.exe
[2011/11/30 10:52:43 | 000,000,000 | ---D | C] -- C:\Users\Midnight Mistress\Desktop\Comp-Fix
[2011/11/29 01:15:38 | 000,000,000 | -H-D | C] -- C:\ProgramData\Common Files
[2011/11/29 01:12:49 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\drivers\AVG
[2011/11/29 01:11:35 | 000,000,000 | ---D | C] -- C:\ProgramData\AVG2012
[2011/11/29 00:36:20 | 000,000,000 | ---D | C] -- C:\Users\Midnight Mistress\AppData\Roaming\Malwarebytes
[2011/11/29 00:36:03 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2011/11/29 00:36:00 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2011/11/29 00:35:56 | 000,025,416 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys
[2011/11/29 00:35:56 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware
[2011/11/29 00:35:19 | 000,000,000 | ---D | C] -- C:\ProgramData\MFAData
[2011/11/24 06:19:40 | 000,000,000 | ---D | C] -- C:\Users\Midnight Mistress\Documents\AnimeNew
[2011/11/10 01:48:27 | 000,000,000 | ---D | C] -- C:\Users\Midnight Mistress\AppData\Local\Akamai

========== Files - Modified Within 30 Days ==========

[2011/12/08 09:08:16 | 000,002,065 | ---- | M] () -- C:\Users\Midnight Mistress\Application Data\Microsoft\Internet Explorer\Quick Launch\Mozilla Firefox.lnk
[2011/12/08 08:44:22 | 000,000,898 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2011/12/08 08:44:09 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2011/12/08 02:13:53 | 000,000,894 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2011/12/08 00:57:42 | 000,009,920 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2011/12/08 00:57:42 | 000,009,920 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2011/12/08 00:54:45 | 000,739,918 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
[2011/12/08 00:54:45 | 000,633,180 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
[2011/12/08 00:54:45 | 000,110,782 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
[2011/12/08 00:49:45 | 1406,177,280 | -HS- | M] () -- C:\hiberfil.sys
[2011/12/08 00:45:48 | 000,000,098 | ---- | M] () -- C:\Windows\SysNative\drivers\etc\Hosts
[2011/12/08 00:44:19 | 000,584,192 | ---- | M] (OldTimer Tools) -- C:\Users\Midnight Mistress\Desktop\OTL.exe
[2011/12/08 00:28:16 | 000,002,028 | ---- | M] () -- C:\Users\Public\Desktop\Adobe Reader X.lnk
[2011/12/05 15:30:07 | 000,879,649 | ---- | M] () -- C:\Users\Midnight Mistress\Desktop\SecurityCheck.exe
[2011/12/04 06:40:14 | 002,322,184 | ---- | M] (ESET) -- C:\Users\Midnight Mistress\Desktop\esetsmartinstaller_enu.exe
[2011/12/03 14:47:27 | 004,326,308 | R--- | M] (Swearware) -- C:\Users\Midnight Mistress\Desktop\ComboFix.exe
[2011/12/02 04:53:11 | 000,646,144 | ---- | M] (OldTimer Tools) -- C:\Users\Midnight Mistress\Desktop\OTS.exe
[2011/12/02 04:50:12 | 001,566,512 | ---- | M] (Kaspersky Lab ZAO) -- C:\Users\Midnight Mistress\Desktop\tdsskiller.exe
[2011/11/29 01:12:49 | 000,000,000 | ---- | M] () -- C:\Windows\SysWow64\drivers\AVG\incavi.avm
[2011/11/29 01:12:49 | 000,000,000 | ---- | M] () -- C:\Windows\SysWow64\drivers\AVG\iavichjw.avm
[2011/11/29 00:36:03 | 000,001,122 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
[2011/11/29 00:08:14 | 000,210,927 | ---- | M] () -- C:\Users\Midnight Mistress\Documents\bookmarks-2011-11-29.json
[2011/11/23 22:57:13 | 000,024,351 | ---- | M] () -- C:\Users\Midnight Mistress\.recently-used.xbel
[2011/11/14 14:43:27 | 004,948,856 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT

========== Files Created - No Company Name ==========

[2011/12/08 09:07:15 | 000,001,163 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
[2011/12/08 00:28:16 | 000,002,028 | ---- | C] () -- C:\Users\Public\Desktop\Adobe Reader X.lnk
[2011/12/08 00:28:14 | 000,002,441 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader X.lnk
[2011/12/05 15:29:46 | 000,879,649 | ---- | C] () -- C:\Users\Midnight Mistress\Desktop\SecurityCheck.exe
[2011/12/03 14:49:41 | 000,256,000 | ---- | C] () -- C:\Windows\PEV.exe
[2011/12/03 14:49:41 | 000,208,896 | ---- | C] () -- C:\Windows\MBR.exe
[2011/12/03 14:49:41 | 000,098,816 | ---- | C] () -- C:\Windows\sed.exe
[2011/12/03 14:49:41 | 000,080,412 | ---- | C] () -- C:\Windows\grep.exe
[2011/12/03 14:49:41 | 000,068,096 | ---- | C] () -- C:\Windows\zip.exe
[2011/11/29 01:12:49 | 000,000,000 | ---- | C] () -- C:\Windows\SysWow64\drivers\AVG\incavi.avm
[2011/11/29 01:12:49 | 000,000,000 | ---- | C] () -- C:\Windows\SysWow64\drivers\AVG\iavichjw.avm
[2011/11/29 00:36:03 | 000,001,122 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
[2011/11/29 00:03:49 | 000,210,927 | ---- | C] () -- C:\Users\Midnight Mistress\Documents\bookmarks-2011-11-29.json
[2011/11/23 22:57:13 | 000,024,351 | ---- | C] () -- C:\Users\Midnight Mistress\.recently-used.xbel
[2011/05/11 15:56:28 | 000,001,456 | ---- | C] () -- C:\Users\Midnight Mistress\AppData\Local\Adobe Save for Web 12.0 Prefs
[2010/10/29 22:18:26 | 000,000,056 | -H-- | C] () -- C:\ProgramData\ezsidmv.dat
[2010/10/12 05:20:49 | 008,676,883 | ---- | C] () -- C:\Windows\SysWow64\mp3Media2.dll
[2010/09/29 19:26:43 | 000,000,120 | ---- | C] () -- C:\Windows\wininit.ini
[2010/09/19 13:23:23 | 000,000,105 | ---- | C] () -- C:\Users\Midnight Mistress\AppData\Local\fusioncache.dat
[2010/09/19 13:18:14 | 000,743,594 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI
[2010/08/31 13:41:54 | 000,000,000 | ---- | C] () -- C:\Windows\nsreg.dat
[2010/08/31 01:43:05 | 000,200,704 | ---- | C] () -- C:\Windows\PLFSetI.exe
[2010/08/31 01:43:05 | 000,000,074 | ---- | C] () -- C:\Windows\PidList.ini
[2010/08/31 01:43:04 | 000,106,496 | ---- | C] () -- C:\Windows\FixUVC.exe
[2009/11/05 13:18:51 | 000,000,000 | ---- | C] () -- C:\Windows\SETUP.INI
[2009/11/05 13:13:46 | 000,000,000 | ---- | C] () -- C:\Windows\ativpsrm.bin
[2009/07/14 00:38:36 | 000,067,584 | --S- | C] () -- C:\Windows\bootstat.dat
[2009/07/13 21:35:51 | 000,000,741 | ---- | C] () -- C:\Windows\SysWow64\NOISE.DAT
[2009/07/13 21:34:42 | 000,215,943 | ---- | C] () -- C:\Windows\SysWow64\dssec.dat
[2009/07/13 19:10:29 | 000,043,131 | ---- | C] () -- C:\Windows\mib.bin
[2009/07/13 18:42:10 | 000,064,000 | ---- | C] () -- C:\Windows\SysWow64\BWContextHandler.dll
[2009/07/13 16:03:59 | 000,364,544 | ---- | C] () -- C:\Windows\SysWow64\msjetoledb40.dll
[2009/06/10 16:26:10 | 000,673,088 | ---- | C] () -- C:\Windows\SysWow64\mlang.dat

========== LOP Check ==========

[2011/02/01 12:04:39 | 000,000,000 | ---D | M] -- C:\Users\Midnight Mistress\AppData\Roaming\Audacity
[2011/05/09 23:17:22 | 000,000,000 | ---D | M] -- C:\Users\Midnight Mistress\AppData\Roaming\com.adobe.downloadassistant.AdobeDownloadAssistant
[2010/10/16 14:29:26 | 000,000,000 | ---D | M] -- C:\Users\Midnight Mistress\AppData\Roaming\Dropbox
[2010/12/01 04:45:59 | 000,000,000 | ---D | M] -- C:\Users\Midnight Mistress\AppData\Roaming\FOG Downloader
[2011/11/16 04:17:39 | 000,000,000 | ---D | M] -- C:\Users\Midnight Mistress\AppData\Roaming\gtk-2.0
[2010/12/01 04:56:31 | 000,000,000 | ---D | M] -- C:\Users\Midnight Mistress\AppData\Roaming\IMVU
[2010/12/01 04:54:52 | 000,000,000 | ---D | M] -- C:\Users\Midnight Mistress\AppData\Roaming\IMVUClient
[2010/09/14 00:54:41 | 000,000,000 | ---D | M] -- C:\Users\Midnight Mistress\AppData\Roaming\Leawo
[2010/09/14 00:54:41 | 000,000,000 | ---D | M] -- C:\Users\Midnight Mistress\AppData\Roaming\Moyea
[2011/02/21 07:57:57 | 000,000,000 | ---D | M] -- C:\Users\Midnight Mistress\AppData\Roaming\OpenOffice.org
[2010/10/19 23:01:18 | 000,000,000 | ---D | M] -- C:\Users\Midnight Mistress\AppData\Roaming\Publish Providers
[2010/10/19 23:01:08 | 000,000,000 | ---D | M] -- C:\Users\Midnight Mistress\AppData\Roaming\Sony
[2010/10/21 07:30:01 | 000,000,000 | ---D | M] -- C:\Users\Midnight Mistress\AppData\Roaming\Sony Creative Software
[2011/01/12 16:40:40 | 000,000,000 | ---D | M] -- C:\Users\Midnight Mistress\AppData\Roaming\uTorrent
[2010/08/31 15:00:18 | 000,000,000 | ---D | M] -- C:\Users\Midnight Mistress\AppData\Roaming\Vivox
[2010/10/03 02:11:28 | 000,000,000 | ---D | M] -- C:\Users\Midnight Mistress\AppData\Roaming\WildTangent
[2011/05/14 00:09:01 | 000,000,000 | ---D | M] -- C:\Users\Midnight Mistress\AppData\Roaming\WindSolutions
[2009/07/14 00:08:49 | 000,012,404 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT

========== Purity Check ==========



========== Custom Scans ==========


< hklm\software\clients\startmenuinternet|command /rs >
HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\FIREFOX.EXE\InstallInfo\\HideIconsCommand: "C:\Program Files (x86)\Mozilla Firefox\uninstall\helper.exe" /HideShortcuts [2011/12/08 09:07:06 | 000,713,600 | ---- | M] (Mozilla Corporation)
HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\FIREFOX.EXE\InstallInfo\\ShowIconsCommand: "C:\Program Files (x86)\Mozilla Firefox\uninstall\helper.exe" /ShowShortcuts [2011/12/08 09:07:06 | 000,713,600 | ---- | M] (Mozilla Corporation)
HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\FIREFOX.EXE\InstallInfo\\ReinstallCommand: "C:\Program Files (x86)\Mozilla Firefox\uninstall\helper.exe" /SetAsDefaultAppGlobal [2011/12/08 09:07:06 | 000,713,600 | ---- | M] (Mozilla Corporation)
HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\FIREFOX.EXE\shell\open\command\\: C:\Program Files (x86)\Mozilla Firefox\firefox.exe [2011/12/08 09:07:09 | 000,924,632 | ---- | M] (Mozilla Corporation)
HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\FIREFOX.EXE\shell\properties\command\\: "C:\Program Files (x86)\Mozilla Firefox\firefox.exe" -preferences [2011/12/08 09:07:09 | 000,924,632 | ---- | M] (Mozilla Corporation)
HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\FIREFOX.EXE\shell\safemode\command\\: "C:\Program Files (x86)\Mozilla Firefox\firefox.exe" -safe-mode [2011/12/08 09:07:09 | 000,924,632 | ---- | M] (Mozilla Corporation)
HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\Google Chrome\InstallInfo\\ShowIconsCommand: "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --show-icons [2011/11/15 00:39:56 | 001,036,344 | ---- | M] (Google Inc.)
HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\Google Chrome\InstallInfo\\HideIconsCommand: "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --hide-icons [2011/11/15 00:39:56 | 001,036,344 | ---- | M] (Google Inc.)
HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\Google Chrome\InstallInfo\\ReinstallCommand: "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --make-default-browser [2011/11/15 00:39:56 | 001,036,344 | ---- | M] (Google Inc.)
HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\Google Chrome\shell\open\command\\: "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" [2011/11/15 00:39:56 | 001,036,344 | ---- | M] (Google Inc.)
HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\IEXPLORE.EXE\InstallInfo\\ShowIconsCommand: "C:\Windows\System32\ie4uinit.exe" -show [2009/07/13 20:14:21 | 000,176,128 | ---- | M] (Microsoft Corporation)
HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\IEXPLORE.EXE\InstallInfo\\ReinstallCommand: "C:\Windows\System32\ie4uinit.exe" -reinstall [2009/07/13 20:14:21 | 000,176,128 | ---- | M] (Microsoft Corporation)
HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\IEXPLORE.EXE\InstallInfo\\HideIconsCommand: "C:\Windows\System32\ie4uinit.exe" -hide [2009/07/13 20:14:21 | 000,176,128 | ---- | M] (Microsoft Corporation)
HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\IEXPLORE.EXE\shell\naom\command\\: "C:\Program Files (x86)\Internet Explorer\iexplore.exe" -extoff [2011/08/19 23:35:15 | 000,673,024 | ---- | M] (Microsoft Corporation)
HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\IEXPLORE.EXE\shell\open\command\\: "C:\Program Files (x86)\Internet Explorer\iexplore.exe" [2011/08/19 23:35:15 | 000,673,024 | ---- | M] (Microsoft Corporation)

< %USERPROFILE%\AppData\Local\Google\Chrome\User Data\*.* /s >
[2011/09/01 07:56:46 | 000,000,005 | ---- | M] () -- C:\Users\Midnight Mistress\AppData\Local\Google\Chrome\User Data\chrome_shutdown_ms.txt
[2011/08/27 15:24:16 | 000,441,089 | ---- | M] () -- C:\Users\Midnight Mistress\AppData\Local\Google\Chrome\User Data\en-US-2-1.bdic
[2011/08/27 15:08:01 | 000,000,000 | ---- | M] () -- C:\Users\Midnight Mistress\AppData\Local\Google\Chrome\User Data\First Run
[2011/09/01 07:56:45 | 000,026,314 | ---- | M] () -- C:\Users\Midnight Mistress\AppData\Local\Google\Chrome\User Data\Local State
[2011/09/01 07:45:48 | 006,008,104 | ---- | M] () -- C:\Users\Midnight Mistress\AppData\Local\Google\Chrome\User Data\Safe Browsing Bloom
[2011/09/01 07:45:51 | 001,677,206 | ---- | M] () -- C:\Users\Midnight Mistress\AppData\Local\Google\Chrome\User Data\Safe Browsing Bloom Filter 2
[2011/09/01 07:45:47 | 000,219,864 | ---- | M] () -- C:\Users\Midnight Mistress\AppData\Local\Google\Chrome\User Data\Safe Browsing Download
[2011/08/27 15:08:33 | 000,000,055 | ---- | M] () -- C:\Users\Midnight Mistress\AppData\Local\Google\Chrome\User Data\Service State
[2010/10/29 22:18:29 | 000,053,248 | ---- | M] () -- C:\Users\Midnight Mistress\AppData\Local\Google\Chrome\User Data\Default\Archived History
[2010/10/29 22:18:29 | 000,000,505 | ---- | M] () -- C:\Users\Midnight Mistress\AppData\Local\Google\Chrome\User Data\Default\Bookmarks
[2010/10/29 22:18:29 | 000,000,505 | ---- | M] () -- C:\Users\Midnight Mistress\AppData\Local\Google\Chrome\User Data\Default\Bookmarks.bak
[2011/09/01 07:56:46 | 000,022,528 | ---- | M] () -- C:\Users\Midnight Mistress\AppData\Local\Google\Chrome\User Data\Default\Cookies
[2011/09/01 07:56:45 | 000,513,857 | ---- | M] () -- C:\Users\Midnight Mistress\AppData\Local\Google\Chrome\User Data\Default\Current Session
[2011/09/01 07:56:45 | 000,525,329 | ---- | M] () -- C:\Users\Midnight Mistress\AppData\Local\Google\Chrome\User Data\Default\Current Tabs
[2010/10/29 22:18:39 | 000,006,144 | ---- | M] () -- C:\Users\Midnight Mistress\AppData\Local\Google\Chrome\User Data\Default\Extension Cookies
[2011/09/01 06:21:01 | 000,043,008 | ---- | M] () -- C:\Users\Midnight Mistress\AppData\Local\Google\Chrome\User Data\Default\Favicons
[2011/09/01 07:56:45 | 000,118,784 | ---- | M] () -- C:\Users\Midnight Mistress\AppData\Local\Google\Chrome\User Data\Default\History
[2011/08/31 22:51:26 | 000,118,784 | ---- | M] () -- C:\Users\Midnight Mistress\AppData\Local\Google\Chrome\User Data\Default\History Index 2011-08
[2011/09/01 06:21:02 | 000,475,136 | ---- | M] () -- C:\Users\Midnight Mistress\AppData\Local\Google\Chrome\User Data\Default\History Index 2011-09
[2011/09/01 07:56:45 | 000,000,000 | ---- | M] () -- C:\Users\Midnight Mistress\AppData\Local\Google\Chrome\User Data\Default\History Provider Cache
[2011/08/31 23:18:06 | 000,096,952 | ---- | M] () -- C:\Users\Midnight Mistress\AppData\Local\Google\Chrome\User Data\Default\Last Session
[2011/08/31 23:18:06 | 000,038,498 | ---- | M] () -- C:\Users\Midnight Mistress\AppData\Local\Google\Chrome\User Data\Default\Last Tabs
[2011/08/27 15:24:42 | 000,012,288 | ---- | M] () -- C:\Users\Midnight Mistress\AppData\Local\Google\Chrome\User Data\Default\Login Data
[2011/09/01 07:56:45 | 000,016,001 | ---- | M] () -- C:\Users\Midnight Mistress\AppData\Local\Google\Chrome\User Data\Default\Preferences
[2011/09/01 06:04:43 | 000,036,864 | ---- | M] () -- C:\Users\Midnight Mistress\AppData\Local\Google\Chrome\User Data\Default\Top Sites
[2011/09/01 07:56:45 | 000,131,072 | ---- | M] () -- C:\Users\Midnight Mistress\AppData\Local\Google\Chrome\User Data\Default\Visited Links
[2011/09/01 04:58:34 | 000,067,584 | ---- | M] () -- C:\Users\Midnight Mistress\AppData\Local\Google\Chrome\User Data\Default\Web Data
[5 C:\Users\Midnight Mistress\AppData\Local\Google\Chrome\User Data\Default\JumpListIcons\*.tmp files -> C:\Users\Midnight Mistress\AppData\Local\Google\Chrome\User Data\Default\JumpListIcons\*.tmp -> ]
[4 C:\Users\Midnight Mistress\AppData\Local\Google\Chrome\User Data\Default\JumpListIconsOld\*.tmp files -> C:\Users\Midnight Mistress\AppData\Local\Google\Chrome\User Data\Default\JumpListIconsOld\*.tmp -> ]
[2010/10/29 22:18:28 | 000,000,000 | ---- | M] () -- C:\Users\Midnight Mistress\AppData\Local\Google\Chrome\User Data\Default\User StyleSheets\Custom.css

< HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >

< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs >

< End of report >




OTL Extras logfile created on: 12/8/2011 9:17:15 AM - Run 1
OTL by OldTimer - Version 3.2.31.0 Folder = C:\Users\Midnight Mistress\Desktop
64bit- Home Premium Edition (Version = 6.1.7600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7600.16385)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

1.75 Gb Total Physical Memory | 0.85 Gb Available Physical Memory | 48.76% Memory free
3.49 Gb Paging File | 2.23 Gb Available in Paging File | 63.82% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 136.95 Gb Total Space | 25.19 Gb Free Space | 18.39% Space Free | Partition Type: NTFS

Computer Name: MIDNIGHT-PC | User Name: Midnight Mistress | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan | Include 64bit Scans
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========


========== File Associations ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.url[@ = InternetShortcut] -- C:\Windows\SysNative\rundll32.exe (Microsoft Corporation)

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\SysWow64\control.exe (Microsoft Corporation)

[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation)

========== Shell Spawning ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
htmlfile [print] -- rundll32.exe %SystemRoot%\system32\mshtml.dll,PrintHTML "%1" (Microsoft Corporation)
inffile [install] -- %SystemRoot%\System32\rundll32.exe setupapi,InstallHinfSection DefaultInstall 132 %1 (Microsoft Corporation)
InternetShortcut [open] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l (Microsoft Corporation)
InternetShortcut [print] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [Bridge] -- C:\Program Files (x86)\Adobe\Adobe Bridge CS5.1\Bridge.exe "%L" (Adobe Systems, Inc.)
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [Bridge] -- C:\Program Files (x86)\Adobe\Adobe Bridge CS5.1\Bridge.exe "%L" (Adobe Systems, Inc.)
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
"FirewallDisableNotify" = 0
"AntiVirusDisableNotify" = 0
"UpdatesDisableNotify" = 0

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = 28 4D B2 76 41 04 CA 01 [binary data]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirewallDisableNotify" = 0
"AntiVirusDisableNotify" = 0
"UpdatesDisableNotify" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]

========== System Restore Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0

========== Firewall Settings ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]


========== HKEY_LOCAL_MACHINE Uninstall List ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{071c9b48-7c32-4621-a0ac-3f809523288f}" = Microsoft Visual C++ 2005 Redistributable (x64)
"{0E543634-7E25-4B8F-8D5B-97880E5E5088}" = Bonjour
"{1B8ABA62-74F0-47ED-B18C-A43128E591B8}" = Windows Live ID Sign-in Assistant
"{1E9FC118-651D-4934-97BE-E53CAE5C7D45}" = Microsoft_VC80_MFCLOC_x86_x64
"{26A24AE4-039D-4CA4-87B4-2F86417001FF}" = Java™ 7 Update 1 (64-bit)
"{4569AD91-47F4-4D9E-8FC9-717EC32D7AE1}" = Microsoft_VC80_CRT_x86_x64
"{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148
"{5EB6F3CB-46F4-451F-A028-7F6D8D35D7D0}" = Windows Live Language Selector
"{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161
"{8338783A-0968-3B85-AFC7-BAAE0A63DC50}" = Microsoft Visual C++ 2008 Redistributable - KB2467174 - x64 9.0.30729.5570
"{8557397C-A42D-486F-97B3-A2CBC2372593}" = Microsoft_VC90_ATL_x86_x64
"{8DAA31EB-6830-4006-A99F-4DF8AB24714F}" = Adobe CSI CS4 x64
"{8F473675-D702-45F9-8EBC-342B40C17BF5}" = Apple Mobile Device Support
"{90120000-002A-0000-1000-0000000FF1CE}" = Microsoft Office Office 64-bit Components 2007
"{90120000-002A-0409-1000-0000000FF1CE}" = Microsoft Office Shared 64-bit MUI (English) 2007
"{90120000-0116-0409-1000-0000000FF1CE}" = Microsoft Office Shared 64-bit Setup Metadata MUI (English) 2007
"{90BF0360-A1DB-4599-A643-95AB90A52C1E}" = Microsoft_VC90_MFCLOC_x86_x64
"{925D058B-564A-443A-B4B2-7E90C6432E55}" = Microsoft_VC80_ATL_x86_x64
"{92A3CA0D-55CD-4C5D-BA95-5C2600C20F26}" = Microsoft_VC90_CRT_x86_x64
"{95120000-00B9-0409-1000-0000000FF1CE}" = Microsoft Application Error Reporting
"{A2422B02-0D41-43F5-B62E-C7A5E55FCBA8}" = Vegas Pro 9.0 (64-bit)
"{A472B9E4-0AFF-4F7B-B25D-F64F8E928AAB}" = Microsoft_VC90_MFC_x86_x64
"{aac9fcc4-dd9e-4add-901c-b5496a07ab2e}" = Microsoft Visual C++ 2005 Redistributable (x64) - KB2467175
"{ACCA82EB-7088-919E-5E1C-100A24F11CCF}" = ATI Catalyst Install Manager
"{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}" = Microsoft Visual C++ 2005 Redistributable (x64)
"{B6E3757B-5E77-3915-866A-CCFC4B8D194C}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x64 8.0.50727.4053
"{C8C1BAD5-54E6-4146-AD07-3A8AD36569C3}" = Microsoft_VC80_MFC_x86_x64
"{DA54F80E-261C-41A2-A855-549A144F2F59}" = Windows Live MIME IFilter
"{E2FCA441-6D7B-CD78-3ADF-42EA9FA06065}" = ccc-utility64
"{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"SynTPDeinstKey" = Synaptics Pointing Device Driver

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{00ADFB20-AE75-46F4-AD2C-F48B15AC3100}" = Adobe Color NA Recommended Settings CS4
"{033E378E-6AD3-4AD5-BDEB-CBD69B31046C}" = Microsoft_VC90_ATL_x86
"{05308C4E-7285-4066-BAE3-6B50DA6ED755}" = Adobe Update Manager CS4
"{08D2E121-7F6A-43EB-97FD-629B44903403}" = Microsoft_VC90_CRT_x86
"{098727E1-775A-4450-B573-3F441F1CA243}" = kuler
"{0B0F231F-CE6A-483D-AA23-77B364F75917}" = Windows Live Installer
"{0D6013AB-A0C7-41DC-973C-E93129C9A29F}" = Adobe Color JA Extra Settings CS4
"{0F3647F8-E51D-4FCC-8862-9A8D0C5ACF25}" = Microsoft_VC80_ATL_x86
"{0F723FC1-7606-4867-866C-CE80AD292DAF}" = Adobe CSI CS4
"{12EFA1A4-AC3B-443C-8143-237EDE760403}" = NTI Backup Now Standard
"{1618734A-3957-4ADD-8199-F973763109A8}" = Adobe Anchor Service CS4
"{16E6D2C1-7C90-4309-8EC4-D2212690AAA4}" = AdobeColorCommonSetRGB
"{17C50809-F2E0-4DD8-84D7-55FF74615723}" = Video Web Camera Ver:1.0.4.115
"{183F0908-AD5E-8B3B-5F06-28B1A8C65C62}" = CCC Help Japanese
"{19BA08F7-C728-469C-8A35-BFBD3633BE08}" = Windows Live Movie Maker
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{1F6AB0E7-8CDD-4B93-8A23-AA9EB2FEFCE4}" = Junk Mail filter update
"{200FEC62-3C34-4D60-9CE8-EC372E01C08F}" = Windows Live SOXE Definitions
"{2168245A-B5AD-40D8-A641-48E3E070B5B6}" = Adobe Flash CS4 STI-en
"{23E9588B-05ED-BC2F-EB69-101A96511EF1}" = ccc-core-static
"{2413930C-8309-47A6-BC61-5EF27A4222BC}" = NTI Media Maker 8
"{2484D1EA-CBA4-60BB-82B9-F8477D25C47A}" = CCC Help Dutch
"{287ECFA4-719A-2143-A09B-D6A12DE54E40}" = Acrobat.com
"{29802D65-9514-DB20-36CD-E47A94C8AEB9}" = Catalyst Control Center Graphics Full Existing
"{2F353D44-73BB-4971-B31D-F7642E9E9531}" = Macromedia Flash MX 2004
"{2F61E9D7-CD05-643E-A04E-CC1A8B6610BA}" = CCC Help Finnish
"{2FA3CDD8-1436-497D-6339-789936561E99}" = CCC Help German
"{3108C217-BE83-42E4-AE9E-A56A2A92E549}" = Atheros Communications Inc.® AR81Family Gigabit/Fast Ethernet Driver
"{331ED3CF-3A1B-467C-9A62-899E2D3B20C4}_is1" = Leawo Video Converter version 3.0.0.1
"{3336F667-9049-4D46-98B6-4C743EEBC5B1}" = Windows Live Photo Gallery
"{34123E80-BE96-6282-1167-6696730AF6D2}" = CCC Help Korean
"{34F4D9A4-42C2-4348-BEF4-E553C84549E7}" = Windows Live Photo Gallery
"{3521BDBD-D453-5D9F-AA55-44B75D214629}" = Adobe Community Help
"{35D94F92-1D3A-43C5-8605-EA268B1A7BD9}" = PDF Settings CS4
"{39F6E2B4-CFE8-C30A-66E8-489651F0F34C}" = Adobe Media Player
"{3A4E8896-C2E7-4084-A4A4-B8FD1894E739}" = Adobe XMP Panels CS4
"{3D20EF26-2E9A-D388-851D-E7675BBACFF5}" = Catalyst Control Center Core Implementation
"{3DA8DF9A-044E-46C4-8531-DEDBB0EE37FF}" = Adobe WinSoft Linguistics Plugin
"{3DB0448D-AD82-4923-B305-D001E521A964}" = eMachines Power Management
"{3E171899-0175-47CC-84C4-562ACDD4C021}" = OpenOffice.org 3.3
"{4024F49B-65D4-D6B2-2A1D-6DBF6F09F181}" = CCC Help Greek
"{43509E18-076E-40FE-AF38-CA5ED400A5A9}" = Pixel Bender Toolkit
"{4943EFF5-229F-435D-BEA9-BE3CAEA783A7}" = Adobe Service Manager Extension
"{49A63237-FD38-AE77-6DF6-FFB41499A4E6}" = CCC Help Hungarian
"{4CBABDFD-49F8-47FD-BE7D-ECDE7270525A}" = Windows Live PIMT Platform
"{4F0FC827-B693-F166-612E-EA89D798540C}" = CCC Help Chinese Traditional
"{52FBF90E-D2EF-A2A3-1CCA-6984596B1B02}" = CCC Help English
"{5570C7F0-43D0-4916-8A9E-AEDD52FA86F4}" = Adobe Color EU Extra Settings CS4
"{57752979-A1C9-4C02-856B-FBB27AC4E02C}" = QuickTime
"{60DB5894-B5A1-4B62-B0F3-669A22C0EE5D}" = Adobe Dynamiclink Support
"{628CBFE4-3823-67FB-26D2-566899C3BB5C}" = CCC Help Italian
"{635FED5B-2C6D-49BE-87E6-7A6FCD22BC5A}" = Microsoft_VC90_MFC_x86
"{63F26DAE-CB0D-98B6-3019-D4FC3D0DD203}" = Catalyst Control Center InstallProxy
"{652EB559-6865-DEF4-2409-D506963C15FD}" = CCC Help Polish
"{66336E9B-5482-B5FB-94F0-405874EE3541}" = Adobe Download Assistant
"{67E03279-F703-408F-B4BF-46B5FC8D70CD}" = Microsoft Works
"{682B3E4F-696A-42DE-A41C-4C07EA1678B4}" = Windows Live SOXE
"{68987945-A387-4C25-0C59-21F2AF657E65}" = CCC Help Thai
"{6A05FEDF-662E-46BF-8A25-010E3F1C9C69}" = Windows Live UX Platform Language Pack
"{6B45E33B-6BB4-234B-2F5F-65B1A103801D}" = CCC Help Russian
"{6B99737C-9FDC-50F9-C9A4-AB7DA5C9A336}" = Catalyst Control Center Graphics Full New
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{793D1D88-6141-43DE-BE58-59BCE31B4090}" = Adobe Flash CS4 Extension - Flash Lite STI en
"{7BE74C0E-F300-D0A6-780B-C93BB78DE58C}" = CCC Help Norwegian
"{7E75ACC5-B0EC-7006-183A-374974019911}" = Catalyst Control Center Graphics Light
"{7F811A54-5A09-4579-90E1-C93498E230D9}" = eMachines Recovery Management
"{80956555-A512-4190-9CAD-B000C36D6B6B}" = Windows Live Messenger
"{820D3F45-F6EE-4AAF-81EF-CE21FF21D230}" = Adobe Type Support CS4
"{82809116-D1EE-443C-AE31-F19E709DDF7A}" = AMD USB Filter Driver
"{83877DB1-8B77-45BC-AB43-2BAC22E093E0}" = Adobe Bridge CS4
"{842B4B72-9E8F-4962-B3C1-1C422A5C4434}" = Suite Shared Configuration CS4
"{84EBDF39-4B33-49D7-A0BD-EB6E2C4E81C1}" = Windows Live Sync
"{853A4763-6643-4604-8D64-28BDD8925F4C}" = Apple Application Support
"{86CE85E6-DBAC-3FFD-B977-E4B79F83C909}" = Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8DD46C6A-0056-4FEC-B70A-28BB16A1F11F}" = MSVCRT
"{90120000-0016-0409-0000-0000000FF1CE}" = Microsoft Office Excel MUI (English) 2007
"{90120000-0016-0409-0000-0000000FF1CE}_HOMESTUDENTR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90120000-0018-0409-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (English) 2007
"{90120000-0018-0409-0000-0000000FF1CE}_HOMESTUDENTR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90120000-001B-0409-0000-0000000FF1CE}" = Microsoft Office Word MUI (English) 2007
"{90120000-001B-0409-0000-0000000FF1CE}_HOMESTUDENTR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-0409-0000-0000000FF1CE}_HOMESTUDENTR_{ABDDE972-355B-4AF1-89A8-DA50B7B5C045}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-040C-0000-0000000FF1CE}_HOMESTUDENTR_{F580DDD5-8D37-4998-968E-EBB76BB86787}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90120000-001F-0C0A-0000-0000000FF1CE}" = Microsoft Office Proof (Spanish) 2007
"{90120000-001F-0C0A-0000-0000000FF1CE}_HOMESTUDENTR_{187308AB-5FA7-4F14-9AB9-D290383A10D9}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90120000-0020-0409-0000-0000000FF1CE}" = Compatibility Pack for the 2007 Office system
"{90120000-002A-0000-1000-0000000FF1CE}_HOMESTUDENTR_{E64BA721-2310-4B55-BE5A-2925F9706192}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90120000-002A-0409-1000-0000000FF1CE}_HOMESTUDENTR_{DE5A002D-8122-4278-A7EE-3121E7EA254E}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90120000-002C-0409-0000-0000000FF1CE}" = Microsoft Office Proofing (English) 2007
"{90120000-006E-0409-0000-0000000FF1CE}" = Microsoft Office Shared MUI (English) 2007
"{90120000-006E-0409-0000-0000000FF1CE}_HOMESTUDENTR_{DE5A002D-8122-4278-A7EE-3121E7EA254E}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90120000-00A1-0409-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (English) 2007
"{90120000-00A1-0409-0000-0000000FF1CE}_HOMESTUDENTR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90120000-0115-0409-0000-0000000FF1CE}" = Microsoft Office Shared Setup Metadata MUI (English) 2007
"{90120000-0115-0409-0000-0000000FF1CE}_HOMESTUDENTR_{DE5A002D-8122-4278-A7EE-3121E7EA254E}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90120000-0116-0409-1000-0000000FF1CE}_HOMESTUDENTR_{DE5A002D-8122-4278-A7EE-3121E7EA254E}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{91120000-002F-0000-0000-0000000FF1CE}" = Microsoft Office Home and Student 2007
"{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{0B36C6D6-F5D8-4EAF-BF94-4376A230AD5B}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{3D019598-7B59-447A-80AE-815B703B84FF}" = Security Update for Microsoft Office system 2007 (972581)
"{92D58719-BBC1-4CC3-A08B-56C9E884CC2C}" = Microsoft_VC80_CRT_x86
"{92EA4134-10D1-418A-91E1-5A0453131A38}" = Windows Live Movie Maker
"{931AB7EA-3656-4BB7-864D-022B09E3DD67}" = Adobe Linguistics CS4
"{94D398EB-D2FD-4FD1-B8C4-592635E8A191}" = Adobe CMaps CS4
"{95120000-00AF-0409-0000-0000000FF1CE}" = Microsoft Office PowerPoint Viewer 2007 (English)
"{96AE7E41-E34E-47D0-AC07-1091A8127911}" = Realtek USB 2.0 Card Reader
"{97124B44-C17B-C352-44B1-403D0D706173}" = CCC Help Czech
"{980A182F-E0A2-4A40-94C1-AE0C1235902E}" = Pando Media Booster
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9ACA8261-11D1-F8A1-C154-7F8B23515C79}" = CCC Help Swedish
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{9C542173-96F0-435D-A95C-468CAAC75EA0}" = Adobe Flash Player 10 Plugin
"{9D56775A-93F3-44A3-8092-840E3826DE30}" = Windows Live Mail
"{A726AE06-AAA3-43D1-87E3-70F510314F04}" = Windows Live Writer
"{A78FE97A-C0C8-49CE-89D0-EDD524A17392}" = PDF Settings CS5
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{A9574A7E-C024-EED1-7A81-CC4786A1915A}" = CCC Help Portuguese
"{A9BDCA6B-3653-467B-AC83-94367DA3BFE3}" = Windows Live Photo Common
"{AA32D2A6-1299-0F05-BF8D-04075A9F69EB}" = CCC Help Turkish
"{AA59DDE4-B672-4621-A016-4C248204957A}" = Skype™ 5.5
"{AAAFC670-569B-4A2F-82B4-42945E0DE3EF}" = Windows Live Writer
"{AAF4238F-7C29-451D-9925-C753271A5728}" = Microsoft Visual C++ Run Time Lib Setup
"{AAF454FC-82CA-4F29-AB31-6A109485E76E}" = Windows Live Writer
"{AC76BA86-7AD7-1033-7B44-AA1000000001}" = Adobe Reader X (10.1.1)
"{AFF7E080-1974-45BF-9310-10DE1A1F5ED0}" = Adobe AIR
"{B001064C-D061-4BAE-9031-416A838D5536}" = Adobe Flash Player 10 ActiveX
"{B29AD377-CC12-490A-A480-1452337C618D}" = Connect
"{B4749B38-C5BD-4A02-8E9F-C1EF7CCEA651}" = Adobe Creative Suite 5.5 Web Premium
"{B6CF2967-C81E-40C0-9815-C05774FEF120}" = Skype Click to Call
"{B6D38690-755E-4F40-A35A-23F8BC2B86AC}" = Microsoft_VC90_MFCLOC_x86
"{BB4E33EC-8181-4685-96F7-8554293DEC6A}" = Adobe Output Module
"{BCC05B1F-7397-799A-9EDB-AC10123BB17A}" = CCC Help Chinese Standard
"{BDE646E8-86E0-50E1-37BC-0AEBB2185D76}" = Adobe Widget Browser
"{BEF4FD8A-29FF-C250-468A-5FC55F0E3451}" = Catalyst Control Center Localization All
"{C41300B9-185D-475E-BFEC-39EF732F19B1}" = Apple Software Update
"{C52E3EC1-048C-45E1-8D53-10B0C6509683}" = Adobe Default Language CS4
"{C57BCDE1-7CB9-467D-B3BA-7E119916CDC1}" = Norton Online Backup
"{C66824E4-CBB3-4851-BB3F-E8CFD6350923}" = Windows Live Mail
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{CC75AB5C-2110-4A7F-AF52-708680D22FE8}" = Photoshop Camera Raw
"{CE95A79E-E4FC-4FFF-8A75-29F04B942FF2}" = Windows Live UX Platform
"{CF7A62B6-F712-412E-9914-D80033A7F8B8}" = Catalyst Control Center - Branding
"{D0B44725-3666-492D-BEF6-587A14BD9BD9}" = MSVCRT_amd64
"{D1A19B02-817E-4296-A45B-07853FD74D57}" = Microsoft_VC80_MFC_x86
"{D41301F8-90FD-9CE8-CD2C-ED2B9D5F07E3}" = CCC Help Spanish
"{D436F577-1695-4D2F-8B44-AC76C99E0002}" = Windows Live Photo Common
"{D43AD08C-BE76-8C5B-FD90-4B665EF60E2E}" = CCC Help Danish
"{D45240D3-B6B3-4FF9-B243-54ECE3E10066}" = Windows Live Communications Platform
"{D92BBB52-82FF-42ED-8A3C-4E062F944AB7}" = Microsoft_VC80_MFCLOC_x86
"{DA4CA661-5ABF-9218-6E42-84BF89F43655}" = CCC Help French
"{DDC8BDEE-DCAC-404D-8257-3E8D4B782467}" = Windows Live Writer Resources
"{E09C4DB7-630C-4F06-A631-8EA7239923AF}" = D3DX10
"{E0B19DF7-B1C7-4937-82C4-0E4B1E346965}" = eBay Worldwide
"{E50AE784-FABE-46DA-A1F8-7B6B56DCB22E}" = Microsoft Office Suite Activation Assistant
"{E5FCED12-3E77-4C0E-A305-5AEB38A52A70}" = AdobeColorCommonSetCMYK
"{EB4DF488-AAEF-406F-A341-CB2AAA315B90}" = Windows Live Messenger
"{EE171732-BEB4-4576-887D-CB62727F01CA}" = eMachines Updater
"{EED50C97-C79E-4149-BD82-7C5A22437708}" = Adobe Setup
"{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}" = Microsoft SQL Server 2005 Compact Edition [ENU]
"{F0E64E2E-3A60-40D8-A55D-92F6831875DA}" = Adobe Search for Help
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F6E99614-F042-4459-82B7-8B38B2601356}" = Adobe Flash CS4
"{F8EF2B3F-C345-4F20-8FE4-791A20333CD5}" = Adobe ExtendScript Toolkit CS4
"{F93C84A6-0DC6-42AF-89FA-776F7C377353}" = Adobe PDF Library Files CS4
"{F9766AC1-1461-1033-B862-DF8FE1C033BE}" = Adobe InDesign CS5
"{FCDBEA60-79F0-4FAE-BBA8-55A26C609A49}" = Visual Studio 2008 x64 Redistributables
"{FE044230-9CA5-43F7-9B58-5AC5A28A1F33}" = Windows Live Essentials
"12bbe590-c890-11d9-9669-0800200c9a66_is1" = The Lord of the Rings Online™ v03.02.03.8013
"Adobe AIR" = Adobe AIR
"Adobe Shockwave Player" = Adobe Shockwave Player 11.5
"Adobe_a68eec966ce913ddaa63251dc82ed31" = Adobe Flash CS4 Professional
"Akamai" = Akamai NetSession Interface Service
"Audacity 1.3 Beta (Unicode)_is1" = Audacity 1.3.12 (Unicode)
"chc.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1" = Adobe Community Help
"com.adobe.amp.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1" = Adobe Media Player
"com.adobe.downloadassistant.AdobeDownloadAssistant" = Adobe Download Assistant
"com.adobe.WidgetBrowser.E7BED6E5DDA59983786DD72EBFA46B1598278E07.1" = Adobe Widget Browser
"eMachines Registration" = eMachines Registration
"eMachines Screensaver" = eMachines ScreenSaver
"eMachines Welcome Center" = Welcome Center
"ESET Online Scanner" = ESET Online Scanner v3
"Free WMV to AVI MPEG Converter_is1" = Free WMV to AVI MPEG Converter v1.2
"Freez FLV to MP3 Converter v1.5_is1" = Freez FLV to MP3 Converter
"Google Chrome" = Google Chrome
"HOMESTUDENTR" = Microsoft Office Home and Student 2007
"Identity Card" = Identity Card
"InstallShield_{12EFA1A4-AC3B-443C-8143-237EDE760403}" = NTI Backup Now 5
"InstallShield_{2413930C-8309-47A6-BC61-5EF27A4222BC}" = NTI Media Maker 8
"LManager" = Launch Manager
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware version 1.51.2.1300
"McAfee Security Scan" = McAfee Security Scan Plus
"Microsoft .NET Framework 1.1 (1033)" = Microsoft .NET Framework 1.1
"Mozilla Firefox 8.0.1 (x86 en-US)" = Mozilla Firefox 8.0.1 (x86 en-US)
"NIS" = Norton Internet Security
"ShowRoom" = ShowRoom for PowerPoint
"Swiff Player_is1" = Swiff Player 1.7.1
"uTorrent" = µTorrent
"WildTangent emachines Master Uninstall" = eMachines Games
"WinGimp-2.0_is1" = GIMP 2.6.10
"WinLiveSuite" = Windows Live Essentials
"World of Warcraft" = World of Warcraft

========== HKEY_CURRENT_USER Uninstall List ==========

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"AikaOnline" = AikaOnline
"Akamai" = Akamai NetSession Interface
"CopyTrans Suite" = CopyTrans Suite Remove Only
"IMVU Avatar chat client software BETA" = IMVU Avatar Chat Software

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 11/4/2011 10:45:12 PM | Computer Name = Midnight-PC | Source = SideBySide | ID = 16842827
Description = Activation context generation failed for "C:\Program Files (x86)\Skype\Toolbars\Internet
Explorer\SkypeIEPluginBroker.exe".Error in manifest or policy file "C:\Program
Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPluginBroker.exe" on line 2.
Multiple
requestedPrivileges elements are not allowed in manifest.

Error - 11/9/2011 1:06:44 AM | Computer Name = Midnight-PC | Source = Application Error | ID = 1000
Description = Faulting application name: plugin-container.exe, version: 1.9.2.4280,
time stamp: 0x4e78bec7 Faulting module name: ntdll.dll, version: 6.1.7600.16695,
time stamp: 0x4cc7ab86 Exception code: 0xc0000005 Fault offset: 0x00022262 Faulting
process id: 0xd70 Faulting application start time: 0x01cc9d9b403e041b Faulting application
path: C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe Faulting module
path: C:\Windows\SysWOW64\ntdll.dll Report Id: 9d96fde9-0a90-11e1-a6f0-705ab60d3aef

Error - 11/10/2011 5:37:20 AM | Computer Name = Midnight-PC | Source = SideBySide | ID = 16842827
Description = Activation context generation failed for "C:\Program Files (x86)\Skype\Toolbars\Internet
Explorer\SkypeIEPluginBroker.exe".Error in manifest or policy file "C:\Program
Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPluginBroker.exe" on line 2.
Multiple
requestedPrivileges elements are not allowed in manifest.

Error - 11/15/2011 2:03:28 AM | Computer Name = Midnight-PC | Source = Application Error | ID = 1000
Description = Faulting application name: firefox.exe, version: 1.9.2.4324, time
stamp: 0x4eb2a5bf Faulting module name: js3250.dll, version: 0.0.0.0, time stamp:
0x4eb29e6e Exception code: 0xc0000005 Fault offset: 0x000812dc Faulting process id:
0xc70 Faulting application start time: 0x01cca32d157ad2c8 Faulting application path:
C:\Program Files (x86)\Mozilla Firefox\firefox.exe Faulting module path: C:\Program
Files (x86)\Mozilla Firefox\js3250.dll Report Id: 88d1bf42-0f4f-11e1-88d0-705ab60d3aef

Error - 11/15/2011 4:49:35 AM | Computer Name = Midnight-PC | Source = SideBySide | ID = 16842827
Description = Activation context generation failed for "C:\Program Files (x86)\Skype\Toolbars\Internet
Explorer\SkypeIEPluginBroker.exe".Error in manifest or policy file "C:\Program
Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPluginBroker.exe" on line 2.
Multiple
requestedPrivileges elements are not allowed in manifest.

Error - 11/16/2011 6:52:17 PM | Computer Name = Midnight-PC | Source = SideBySide | ID = 16842827
Description = Activation context generation failed for "C:\Program Files (x86)\Skype\Toolbars\Internet
Explorer\SkypeIEPluginBroker.exe".Error in manifest or policy file "C:\Program
Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPluginBroker.exe" on line 2.
Multiple
requestedPrivileges elements are not allowed in manifest.

Error - 11/18/2011 1:30:37 AM | Computer Name = Midnight-PC | Source = SideBySide | ID = 16842827
Description = Activation context generation failed for "C:\Program Files (x86)\Skype\Toolbars\Internet
Explorer\SkypeIEPluginBroker.exe".Error in manifest or policy file "C:\Program
Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPluginBroker.exe" on line 2.
Multiple
requestedPrivileges elements are not allowed in manifest.

Error - 11/19/2011 1:30:35 AM | Computer Name = Midnight-PC | Source = SideBySide | ID = 16842827
Description = Activation context generation failed for "C:\Program Files (x86)\Skype\Toolbars\Internet
Explorer\SkypeIEPluginBroker.exe".Error in manifest or policy file "C:\Program
Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPluginBroker.exe" on line 2.
Multiple
requestedPrivileges elements are not allowed in manifest.

Error - 11/24/2011 1:40:44 PM | Computer Name = Midnight-PC | Source = Application Hang | ID = 1002
Description = The program vegas90.exe version 9.0.0.1146 stopped interacting with
Windows and was closed. To see if more information about the problem is available,
check the problem history in the Action Center control panel. Process ID: 1180 Start
Time: 01ccaacfcbdab550 Termination Time: 5 Application Path: C:\Program Files\Sony\Vegas
Pro 9.0\vegas90.exe Report Id:

Error - 11/24/2011 2:37:51 PM | Computer Name = Midnight-PC | Source = SideBySide | ID = 16842827
Description = Activation context generation failed for "C:\Program Files (x86)\Skype\Toolbars\Internet
Explorer\SkypeIEPluginBroker.exe".Error in manifest or policy file "C:\Program
Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPluginBroker.exe" on line 2.
Multiple
requestedPrivileges elements are not allowed in manifest.

[ OSession Events ]
Error - 5/14/2011 5:25:29 PM | Computer Name = Midnight-PC | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 3, Application Name: Microsoft Office PowerPoint, Application
Version: 12.0.6545.5000, Microsoft Office Version: 12.0.6425.1000. This session
lasted 76072 seconds with 240 seconds of active time. This session ended with a
crash.

[ System Events ]
Error - 12/3/2011 4:07:08 PM | Computer Name = Midnight-PC | Source = Microsoft-Windows-Kernel-General | ID = 5
Description =

Error - 12/3/2011 4:07:10 PM | Computer Name = Midnight-PC | Source = Service Control Manager | ID = 7030
Description = The PEVSystemStart service is marked as an interactive service. However,
the system is configured to not allow interactive services. This service may not
function properly.

Error - 12/3/2011 4:08:53 PM | Computer Name = Midnight-PC | Source = atikmdag | ID = 52236
Description = CPLIB :: General - Invalid Parameter

Error - 12/3/2011 4:08:53 PM | Computer Name = Midnight-PC | Source = atikmdag | ID = 43029
Description = Display is not active

Error - 12/3/2011 5:42:47 PM | Computer Name = Midnight-PC | Source = atikmdag | ID = 43029
Description = Display is not active

Error - 12/3/2011 6:37:28 PM | Computer Name = Midnight-PC | Source = atikmdag | ID = 43029
Description = Display is not active

Error - 12/3/2011 9:36:23 PM | Computer Name = Midnight-PC | Source = atikmdag | ID = 43029
Description = Display is not active

Error - 12/4/2011 6:43:55 AM | Computer Name = Midnight-PC | Source = atikmdag | ID = 43029
Description = Display is not active

Error - 12/5/2011 7:41:56 AM | Computer Name = Midnight-PC | Source = atikmdag | ID = 43029
Description = Display is not active

Error - 12/5/2011 3:35:40 PM | Computer Name = Midnight-PC | Source = atikmdag | ID = 43029
Description = Display is not active


< End of report >



Thanks again for all the help! :)

Faerin

#10 SweetTech

SweetTech

    Agent ST


  • Members
  • 13,421 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Antarctica
  • Local time:12:26 PM

Posted 09 December 2011 - 01:24 AM

Good Evening!

What programs would you suggest having at the end of this to make sure I keep my computer protected?

This is something that I will cover more in depth in my all clean post which will come later in this post.

Your logs appear to be clean, so if you have no further issues with your computer, then please proceed with the following housekeeping procedures outlined below.



Time for some housekeeping
The following will implement some cleanup procedures as well as reset System Restore points:

Click Start > Run and copy/paste the following bolded text into the Run box and click OK: ComboFix /Uninstall



NEXT:



OTL Fix

We need to run an OTL Fix
  • Please reopen Posted Image on your desktop.
  • Copy and Paste the following code into the Posted Image textbox.
    :Commands
    [ClearAllRestorePoints]
    
  • Push Posted Image
  • OTL may ask to reboot the machine. Please do so if asked.
  • Click the OK button.
  • A report will open. Copy and Paste that report in your next reply.


NEXT:



OTL Clean-Up

We Need to Clean Up our Mess
Our work on your machine has left considerable leftovers on your box. Let's clean those up real quick:
  • Reopen Posted Image on your desktop.
  • Click on Posted Image
  • You will be prompted to reboot your system. Please do so.
If you still have any tools or logs leftover on your computer you can go ahead and delete those off of your computer now.


NEXT:



All Clean Speech

===> Make sure you've re-enabled any Security Programs that we may have disabled during the malware removal process. <===



Below I have included a number of recommendations for how to protect your computer against malware infections.


Updated Anti-Virus Program
It's essential that you have an updated anti-virus program running on your computer. You don't want to run more than one as it can cause program conflicts, as well as false positives

You can view an excellent list of Free Security Software programs that has been compiled by GeekstoGo.


Avoid P2P Programs

Remember that no matter how clean the program you're using for peer-to-peer filesharing may be, it offers no guarantees regarding the cleanliness of files you may choose to download. All files available via p2p filesharing carry a high risk, particularly those that offer you illegitimate methods of using legitimate software programs without paying for them. Some further readings on this subject, along the included links, are as follows: File-Sharing, otherwise known as Peer To Peer and Risks of File-Sharing Technology.

If you have any of these programs installed then I highly suggest you uninstall them.

NOTE: Take care when answering any questions posed by an uninstaller. Some questions may be worded to deceive you into keeping the program.


Internet Browsers

Many of the users that I assist here on the forums, ask me which programs they can use to prevent themselves from getting infected again in the future. The best answer I can give you is too practice safe browsing.

Please consider using an alternative browser such as Google Chrome or Opera. They are both much more secure than Internet Explorer, immune to almost all known browser hijackers, and also have great built-in pop-up blockers.

I also suggest you make your Internet Explore more secure.


Make Internet Explorer more secure

  • Click Start > Run
  • Type Inetcpl.cpl & click OK
  • Click on the Security tab
  • Click Reset all zones to default level
  • Make sure the Internet Zone is selected & Click Custom level
  • In the ActiveX section, set the first two options ("Download signed and unsigned ActiveX controls) to "Prompt", and ("Initialize and Script ActiveX controls not marked as safe") to "Disable".
  • Next Click OK, then Apply button and then OK to exit the Internet Properties page.



Extra Goodies

  • It is good security practice to change your passwords to all your online accounts on a fairly regular basis, this is especially true after an infection. Refer to this Microsoft article
    Strong passwords: How to create and use them
    then consider a password keeper, to keep all your passwords safe.
  • Keep Windows updated by regularly checking their website at: http://windowsupdate.microsoft.com/
    This will ensure your computer has always the latest security updates available installed on your computer.
  • You should run an updated scan with MalwareBytes' Anti-Malware weekly. Instructions are included below:

    • Open Malwarebytes' Anti-Malware
    • Select the Update tab
    • Click Check for Updates

  • Be weary of e-mails from unknown senders. Keep the following in mind as well: If it's to good to be true, then it more than likely is.

  • FileHippo Update Checker is an extremely helpful program that will tell you which of your programs need to be updated. Its important to keep programs up to date so that malware doesn't exploit any old security flaws.
  • WOT, Web of Trust, warns you about risky websites that try to scam visitors, deliver malware or send spam. Protect your computer against online threats by using WOT as your front-line layer of protection when browsing or searching in unfamiliar territory. WOT's color-coded icons show you ratings for 21 million websites, helping you avoid the dangerous sites:
    • Green to go
    • Yellow for caution
    • Red to stop
    WOT has an addon available for Chrome and Opera.
  • Keep a backup of your important files - Now, more than ever, it's especially important to protect your digital files and memories. This article is full of good information on alternatives for home backup solutions.
  • In light of your recent issue, I'm sure you'd like to avoid any future infections. Please take a look at these well written articles:
    Think Prevention.
    PC Safety and Security--What Do I Need?.
**Be very wary with any security software that is advertised in popups or in other ways. They are not only usually of no use, but often have malware in them.

Thank you for your patience, and performing all of the procedures requested.

Please respond one last time so we can consider the thread resolved and close it, thank-you.

Cheers,
SweetTech.

Have I helped you? If you'd like to assist in the fight against malware, click here Posted Image


The instructions seen in this post have been specifically tailored to this user and the issues they are experiencing with their computer. If you think you have a similar problem, please first read this topic, and then begin your own, new thread. I do not offer private support via Private Message.


#11 Faerin

Faerin
  • Topic Starter

  • Members
  • 7 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:Cleveland, OH
  • Local time:11:26 AM

Posted 09 December 2011 - 12:03 PM

Hey again!

I've gone through all the last steps you've given me. I lost the log after the computer restarted though since I did the clean up and it removed all the programs and whatnot. But it was just a really short log that basically said that the restore points had been cleared. I'm currently checking out a bunch of the links you gave me and getting some of that good software onto my PC to help keep it protected. Thanks again for all of your help!! :)

Faerin

#12 SweetTech

SweetTech

    Agent ST


  • Members
  • 13,421 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Antarctica
  • Local time:12:26 PM

Posted 10 December 2011 - 01:38 AM

You're more than welcome! I'm glad that we were able to work together to solve the issues you were experiencing with your computer.

Please take care!

Kindest Regards,
SweetTech.

____________________________________________________

Since it appears that the issues you were experiencing with your computer have been resolved, I am going to close this thread. If you should need the thread re-opened please send me a Private Message (PM) with a request to re-open the thread, as well as the link to the thread in question, and I'd be happy to re-open the thread.


Have I helped you? If you'd like to assist in the fight against malware, click here Posted Image


The instructions seen in this post have been specifically tailored to this user and the issues they are experiencing with their computer. If you think you have a similar problem, please first read this topic, and then begin your own, new thread. I do not offer private support via Private Message.





0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users