Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Registry infected with broken file associations


  • This topic is locked This topic is locked
64 replies to this topic

#1 ctsllc

ctsllc

  • Members
  • 68 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:usa
  • Local time:10:06 AM

Posted 02 December 2011 - 09:27 AM

dds would not run, came up with a screen with jibberish

Like this
Z   @  !L!This program cannot be run in DOS mode.

$ 1:uiuiuiֵiwiuiiַidi!iiitiRichui PE L K   P   0   @               `    ` UPX0    UPX1 P  F  @ .rsrc    J @ 3.07 UPX!
 $И 'C & "U\} t+FEu
H
>Bl HPu Hr@  uS݌}V5EWPLel1E P}Dp; FRVVUu+M‰M3ҊQNUM1Tv>PE3m sPBprEP T޾9}qw ~Xtev453tn۶/jW: "͹* )XWKpgXh -PgWjh6%Xr 9Yw\_^3[_L$FSiAVWTtOq3;5sBi}YDGt /BOt 
u 3ڃ9ٴ۳F1Art[w7QQUi{3W?BF^~ 9M t$B;DiG|B
,R#u(@Ewt ;Ar7
͈,l t/N@狀?? V3 s49v,P $uGzt ~^$F[? seZmB=#+39tK;sEr5db(p۠<@w#ȋ;vCxw[w{rt
V rmCDN}@m @e
+Q;Jqvt$jxkt]8C\P!0=k iCu@FH+&|$ /{jv7{w5th0u
u0qu/PheDޯa{}^[|'Ctljhps˝? Qo8^Mʡ"JWjcY}NKcm
]
M܉
hM؃A׷$(S?(
ll߽9]c
!S9vBH-9w_S
ՃP8-׈|Fܿ-
^u" ?s7y`<-k){/4a;#ǶC64VÆ[ /Wp]`xl7+tRQ%ǜ<>[j=V}ຄ=!XWF_f;tBj\V
SWE c:u |=j5ۆW
x,{'F:utjBwmWh Kb.t<>j`SnN]co vjj}E#WVpj<1o?ؿfk
WHjani M~Po:Hl#;v%8c!C;t,`Vv mD#6I7WhdB{QVzSmd>9o,jh
j1VuckzFVpVYI

Attached Files

  • Attached File  ARK.log   82.01KB   0 downloads


BC AdBot (Login to Remove)

 


#2 ctsllc

ctsllc
  • Topic Starter

  • Members
  • 68 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:usa
  • Local time:10:06 AM

Posted 05 December 2011 - 11:26 AM

this has gotten progressively worse, tough to reboot and loss of icon on reboot all drives look empty although the data is still there.

#3 HelpBot

HelpBot

    Bleepin' Binary Bot


  • Bots
  • 12,733 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:10:06 AM

Posted 07 December 2011 - 09:30 AM

Hello and welcome to Bleeping Computer!

I am HelpBot: an automated program designed to help the Bleeping Computer Staff better assist you! This message contains very important information, so please read through all of it before doing anything.

We apologize for the delay in responding to your request for help. Here at Bleeping Computer we get overwhelmed at times, and we are trying our best to keep up. Please note that your topic was not intentionally overlooked. Our mission is to help everyone in need, but sometimes it takes just a little longer to get to every request for help. No one is ignored here.

To help Bleeping Computer better assist you please perform the following steps:

***************************************************

Posted Image In order to continue receiving help at BleepingComputer.com, YOU MUST tell me if you still need help or if your issue has already been resolved on your own or through another resource! To tell me this, please click on the following link and follow the instructions there.

CLICK THIS LINK >>> http://www.bleepingcomputer.com/logreply/430371 <<< CLICK THIS LINK



If you no longer need help, then all you needed to do was the previous instructions of telling me so. You can skip the rest of this post. If you do need help please continue with Step 2 below.

***************************************************

Posted Image If you still need help, I would like you to post a Reply to this topic (click the "Add Reply" button in the lower right hand of this page). In that reply, please include the following information:

  • If you have not done so already, include a clear description of the problems you're having, along with any steps you may have performed so far.
  • A new DDS and GMER log. For your convenience, you will find the instructions for generating these logs repeated at the bottom of this post.
    • Please do this even if you have previously posted logs for us.
    • If you were unable to produce the logs originally please try once more.
    • If you are unable to create a log please provide detailed information about your installed Windows Operating System including the Version, Edition and if it is a 32bit or a 64bit system.
    • If you are unsure about any of these characteristics just post what you can and we will guide you.
  • Please tell us if you have your original Windows CD/DVD available.
  • Upon completing the above steps and posting a reply, another staff member will review your topic and do their best to resolve your issues.

Thank you for your patience, and again sorry for the delay.

***************************************************

We need to see some information about what is happening in your machine. Please perform the following scan again:

  • Download DDS by sUBs from one of the following links if you no longer have it available. Save it to your desktop.
  • Double click on the DDS icon, allow it to run.
  • A small box will open, with an explanation about the tool. No input is needed, the scan is running.
  • Notepad will open with the results.
  • Follow the instructions that pop up for posting the results.
  • Close the program window, and delete the program from your desktop.
Please note: You may have to disable any script protection running if the scan fails to run. After downloading the tool, disconnect from the internet and disable all antivirus protection. Run the scan, enable your A/V and reconnect to the internet.

Information on A/V control HERE


We also need a new log from the GMER anti-rootkit Scanner.

Please note that if you are running a 64-bit version of Windows you will not be able to run GMER and you may skip this step.

Please first disable any CD emulation programs using the steps found in this topic:

Why we request you disable CD Emulation when receiving Malware Removal Advice


Then create another GMER log and post it as an attachment to the reply where you post your new DDS log. Instructions on how to properly create a GMER log can be found here:

How to create a GMER log


As I am just a silly little program running on the BleepingComputer.com servers, please do not send me private messages as I do not know how to read and reply to them! Thanks!

#4 Elise

Elise

    Bleepin' Blonde


  • Malware Study Hall Admin
  • 61,257 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:Romania
  • Local time:05:06 PM

Posted 07 December 2011 - 03:23 PM

If you still need help, please run the following scan.

OTL
-----
Please download OTL from one of the following mirrors:
  • Save it to your desktop.
  • Double click on the Posted Image icon on your desktop.
  • Click the "Scan All Users" checkbox.
  • Push the Posted Image button.
  • Two reports will open, copy and paste them in a reply here:
    • OTL.txt <-- Will be opened
    • Extra.txt <-- Will be minimized

regards, Elise


"Now faith is the substance of things hoped for, the evidence of things not seen."

 

Follow BleepingComputer on: Facebook | Twitter | Google+ | lockerdome

 

Malware analyst @ Emsisoft


#5 ctsllc

ctsllc
  • Topic Starter

  • Members
  • 68 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:usa
  • Local time:10:06 AM

Posted 08 December 2011 - 07:43 AM

Elise,

Thanks so much for taking the time to help me. Here are the resluts of OTL. Sorry it took so long to get back to you, this machine is at my office.

OTL logfile created on: 12/8/2011 7:25:15 AM - Run 1
OTL by OldTimer - Version 3.2.31.0 Folder = N:\virus fix
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

1.99 Gb Total Physical Memory | 1.23 Gb Available Physical Memory | 62.02% Memory free
3.84 Gb Paging File | 3.17 Gb Available in Paging File | 82.59% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 59.95 Gb Total Space | 25.80 Gb Free Space | 43.04% Space Free | Partition Type: NTFS
Drive D: | 60.00 Gb Total Space | 40.37 Gb Free Space | 67.29% Space Free | Partition Type: NTFS
Drive N: | 3.81 Gb Total Space | 3.45 Gb Free Space | 90.35% Space Free | Partition Type: FAT32

Computer Name: ACER-0A04F1A0D2 | User Name: Barrett Vukmer | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2011/12/08 07:22:46 | 000,584,192 | ---- | M] (OldTimer Tools) -- N:\virus fix\OTL.exe
PRC - [2011/11/04 16:27:48 | 000,045,056 | -H-- | M] (Intuit) -- C:\Program Files\Common Files\Intuit\QuickBooks\QBCFMonitorService.exe
PRC - [2011/10/18 14:32:30 | 000,150,856 | -H-- | M] (McAfee, Inc.) -- C:\Program Files\Common Files\McAfee\SystemCore\mfevtps.exe
PRC - [2011/10/18 14:28:34 | 000,160,608 | -H-- | M] (McAfee, Inc.) -- C:\Program Files\Common Files\McAfee\SystemCore\mfefire.exe
PRC - [2011/10/18 14:28:18 | 000,166,288 | -H-- | M] (McAfee, Inc.) -- C:\Program Files\Common Files\McAfee\SystemCore\mcshield.exe
PRC - [2011/09/16 17:38:10 | 001,318,552 | -H-- | M] (McAfee, Inc.) -- C:\Program Files\McAfee.com\Agent\mcagent.exe
PRC - [2011/06/30 12:25:52 | 001,248,256 | -H-- | M] (Intuit Inc.) -- C:\Program Files\Common Files\Intuit\DataProtect\QBIDPService.exe
PRC - [2011/03/16 17:24:21 | 002,423,752 | ---- | M] (SUPERAntiSpyware.com) -- C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
PRC - [2011/01/27 17:28:14 | 000,214,904 | -H-- | M] (McAfee, Inc.) -- C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe
PRC - [2010/12/06 00:58:50 | 001,828,216 | -H-- | M] (BUFFALO INC.) -- C:\Program Files\BUFFALO\Backup_Utility\BUTray.exe
PRC - [2010/10/19 01:13:18 | 000,169,336 | -H-- | M] (BUFFALO INC.) -- C:\Program Files\BUFFALO\BuffaloTools\BuffaloTools.exe
PRC - [2010/09/22 17:11:26 | 000,640,440 | -H-- | M] (Adobe Systems Inc.) -- C:\Program Files\Adobe\Acrobat 9.0\Acrobat\acrotray.exe
PRC - [2010/08/19 21:55:14 | 000,320,888 | -H-- | M] (BUFFALO INC.) -- C:\Program Files\BUFFALO\Backup_Utility\BUService.exe
PRC - [2010/06/29 12:48:46 | 000,114,416 | ---- | M] (SUPERAntiSpyware.com) -- C:\Program Files\SUPERAntiSpyware\SASCore.exe
PRC - [2010/06/29 12:48:44 | 000,355,056 | ---- | M] (SUPERAntiSpyware.com) -- C:\Documents and Settings\Barrett Vukmer\Local Settings\Temp\SSUPDATE.EXE
PRC - [2010/04/27 23:17:38 | 000,247,160 | -H-- | M] (BUFFALO INC.) -- C:\Program Files\BUFFALO\Backup_Utility\BUVSSServiceXp.exe
PRC - [2010/04/13 19:11:14 | 000,229,688 | -H-- | M] (McAfee, Inc.) -- C:\Program Files\McAfee Online Backup\MOBKbackup.exe
PRC - [2009/08/25 09:38:06 | 000,935,208 | -H-- | M] (Nero AG) -- C:\Program Files\Common Files\Nero\Nero BackItUp 4\NBService.exe
PRC - [2009/08/12 14:04:44 | 000,062,208 | -H-- | M] (NewTech Infosystems, Inc.) -- C:\Program Files\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe
PRC - [2009/08/12 13:58:28 | 000,261,888 | -H-- | M] (NewTech Infosystems, Inc.) -- C:\Program Files\NewTech Infosystems\Acer Backup Manager\BackupManagerTray.exe
PRC - [2009/07/27 12:42:10 | 000,656,696 | -H-- | M] (Wave Systems Corp.) -- C:\Program Files\Wave Systems Corp\SecureUpgrade.exe
PRC - [2009/07/27 11:17:48 | 000,145,920 | -H-- | M] (Wave Systems Corp.) -- C:\Program Files\Wave Systems Corp\Services Manager\DocMgr\bin\WavXDocMgr.exe
PRC - [2009/07/03 17:47:12 | 000,240,160 | -H-- | M] (Acer) -- C:\Program Files\Acer\Acer Updater\UpdaterService.exe
PRC - [2009/06/04 16:44:32 | 000,225,280 | -H-- | M] (Acer) -- C:\Program Files\Acer\Acer eRecovery Management\NotificationLauncher.exe
PRC - [2009/05/15 14:36:50 | 000,251,184 | RH-- | M] (BUFFALO INC.) -- C:\Program Files\BUFFALO\NASNAVI\nassvc.exe
PRC - [2009/04/15 22:52:06 | 000,091,432 | -H-- | M] (CyberLink Corp.) -- C:\Program Files\CyberLink\PowerDVD8\PDVD8Serv.exe
PRC - [2008/04/14 07:00:00 | 001,033,728 | -H-- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe
PRC - [2008/02/02 01:19:22 | 000,791,840 | -H-- | M] (Nuance Communications, Inc.) -- C:\Program Files\Nuance\PDF Create! 5\PdfCreate5Hook.exe
PRC - [2008/01/11 16:50:16 | 000,030,312 | -H-- | M] (Microsoft Corporation) -- C:\Program Files\Microsoft Small Business\Business Contact Manager\BcmSqlStartupSvc.exe
PRC - [2006/03/03 20:03:10 | 000,069,632 | -H-- | M] (HP) -- C:\WINDOWS\system32\HPZipm12.exe
PRC - [2004/09/10 06:00:00 | 000,189,536 | -H-- | M] (SafeNet, Inc) -- C:\Program Files\Common Files\SafeNet Sentinel\Sentinel Protection Server\WinNT\spnsrvnt.exe


========== Modules (No Company Name) ==========

MOD - [2011/10/12 15:43:12 | 000,212,992 | -H-- | M] () -- C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.ServiceProce#\abef85f2fb8ba830eda73e2d12e8d41e\System.ServiceProcess.ni.dll
MOD - [2011/10/12 15:32:51 | 007,950,848 | -H-- | M] () -- C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System\af39f6e644af02873b9bae319f2bfb13\System.ni.dll
MOD - [2011/10/12 15:32:40 | 011,490,816 | -H-- | M] () -- C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\mscorlib\ca87ba84221991839abbe7d4bc9c6721\mscorlib.ni.dll
MOD - [2011/08/22 08:41:34 | 000,052,736 | -H-- | M] () -- C:\Documents and Settings\Barrett Vukmer\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\SD10007.dll
MOD - [2011/08/08 06:47:46 | 000,063,488 | -H-- | M] () -- C:\Documents and Settings\Barrett Vukmer\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\SD10006.dll
MOD - [2011/08/08 06:47:44 | 000,052,224 | -H-- | M] () -- C:\Documents and Settings\Barrett Vukmer\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\SD10005.dll
MOD - [2011/08/08 06:47:42 | 000,117,760 | -H-- | M] () -- C:\Documents and Settings\Barrett Vukmer\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\UIREPAIR.DLL
MOD - [2010/04/13 19:11:16 | 000,077,624 | -H-- | M] () -- C:\Program Files\McAfee Online Backup\librs2.dll
MOD - [2010/03/15 10:28:22 | 000,141,824 | -H-- | M] () -- C:\Program Files\WinRAR\RarExt.dll
MOD - [2009/07/27 11:15:32 | 000,249,856 | -H-- | M] () -- C:\WINDOWS\system32\wxvault.dll
MOD - [2009/06/03 11:07:50 | 000,010,752 | -H-- | M] () -- C:\WINDOWS\system32\Wavx_ESC_Logging.dll
MOD - [2009/02/27 15:39:29 | 000,019,968 | -H-- | M] () -- C:\Program Files\Adobe\Acrobat 9.0\Acrobat\AcroTray.DEU
MOD - [2009/02/27 15:32:27 | 000,020,480 | -H-- | M] () -- C:\Program Files\Adobe\Acrobat 9.0\Acrobat\AcroTray.FRA
MOD - [2009/02/02 16:33:56 | 000,460,199 | -H-- | M] () -- C:\Program Files\NewTech Infosystems\Acer Backup Manager\sqlite3.dll
MOD - [2008/09/28 16:55:26 | 001,076,224 | -H-- | M] () -- C:\Program Files\NewTech Infosystems\Acer Backup Manager\ACE.dll
MOD - [2001/07/31 09:17:12 | 000,094,274 | -H-- | M] () -- C:\WINDOWS\system32\HPBHEALR.DLL


========== Win32 Services (SafeList) ==========

SRV - File not found [On_Demand | Stopped] -- -- (gusvc)
SRV - [2011/11/04 16:27:48 | 000,045,056 | -H-- | M] (Intuit) [Auto | Running] -- C:\Program Files\Common Files\Intuit\QuickBooks\QBCFMonitorService.exe -- (QBCFMonitorService)
SRV - [2011/10/18 14:32:30 | 000,150,856 | -H-- | M] (McAfee, Inc.) [Auto | Running] -- C:\Program Files\Common Files\McAfee\SystemCore\mfevtps.exe -- (mfevtp)
SRV - [2011/10/18 14:28:34 | 000,160,608 | -H-- | M] (McAfee, Inc.) [Auto | Running] -- C:\Program Files\Common Files\McAfee\SystemCore\mfefire.exe -- (mfefire)
SRV - [2011/10/18 14:28:18 | 000,166,288 | -H-- | M] () [Unknown | Running] -- C:\Program Files\Common Files\McAfee\SystemCore\\mcshield.exe -- (McShield)
SRV - [2011/06/30 12:25:52 | 001,248,256 | -H-- | M] (Intuit Inc.) [Auto | Running] -- C:\Program Files\Common Files\Intuit\DataProtect\QBIDPService.exe -- (QBVSS)
SRV - [2011/03/17 15:38:42 | 000,361,712 | -H-- | M] (McAfee, Inc.) [On_Demand | Stopped] -- C:\Program Files\McAfee\VirusScan\mcods.exe -- (McODS)
SRV - [2011/02/05 13:17:30 | 000,651,720 | -H-- | M] (Macrovision Europe Ltd.) [On_Demand | Stopped] -- C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe -- (FLEXnet Licensing Service)
SRV - [2011/01/27 17:28:14 | 000,214,904 | -H-- | M] (McAfee, Inc.) [Auto | Running] -- C:\Program Files\Common Files\Mcafee\McSvcHost\McSvHost.exe -- (MSK80Service)
SRV - [2011/01/27 17:28:14 | 000,214,904 | -H-- | M] (McAfee, Inc.) [Auto | Running] -- C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe -- (McProxy)
SRV - [2011/01/27 17:28:14 | 000,214,904 | -H-- | M] (McAfee, Inc.) [Auto | Running] -- C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe -- (McNASvc)
SRV - [2011/01/27 17:28:14 | 000,214,904 | -H-- | M] (McAfee, Inc.) [Auto | Running] -- C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe -- (McNaiAnn)
SRV - [2011/01/27 17:28:14 | 000,214,904 | -H-- | M] (McAfee, Inc.) [Auto | Running] -- C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe -- (mcmscsvc)
SRV - [2011/01/27 17:28:14 | 000,214,904 | -H-- | M] (McAfee, Inc.) [Unknown | Running] -- C:\Program Files\Common Files\Mcafee\McSvcHost\McSvHost.exe -- (McMPFSvc)
SRV - [2011/01/27 17:28:14 | 000,214,904 | -H-- | M] (McAfee, Inc.) [Auto | Running] -- C:\Program Files\Common Files\Mcafee\McSvcHost\McSvHost.exe -- (McAfee SiteAdvisor Service)
SRV - [2010/08/19 21:55:14 | 000,320,888 | -H-- | M] (BUFFALO INC.) [Auto | Running] -- C:\Program Files\BUFFALO\Backup_Utility\BUService.exe -- (BFBackupUtilityService)
SRV - [2010/06/29 12:48:46 | 000,114,416 | ---- | M] (SUPERAntiSpyware.com) [Auto | Running] -- C:\Program Files\SUPERAntiSpyware\SASCORE.EXE -- (!SASCORE)
SRV - [2010/04/27 23:17:38 | 000,247,160 | -H-- | M] (BUFFALO INC.) [Auto | Running] -- C:\Program Files\BUFFALO\Backup_Utility\BUVSSServiceXP.exe -- (BFBackupUtilityVSSService)
SRV - [2010/04/13 19:11:14 | 000,229,688 | -H-- | M] (McAfee, Inc.) [Auto | Running] -- C:\Program Files\McAfee Online Backup\MOBKbackup.exe -- (MOBKbackup)
SRV - [2009/08/25 09:38:06 | 000,935,208 | -H-- | M] (Nero AG) [Auto | Running] -- C:\Program Files\Common Files\Nero\Nero BackItUp 4\NBService.exe -- (Nero BackItUp Scheduler 4.0)
SRV - [2009/08/12 14:04:44 | 000,062,208 | -H-- | M] (NewTech Infosystems, Inc.) [Auto | Running] -- C:\Program Files\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe -- (NTI IScheduleSvc)
SRV - [2009/07/23 20:10:38 | 000,061,440 | -H-- | M] (Intuit Inc.) [On_Demand | Stopped] -- C:\Program Files\Common Files\Intuit\QuickBooks\FCS\Intuit.QuickBooks.FCS.exe -- (QBFCService)
SRV - [2009/07/03 17:47:12 | 000,240,160 | -H-- | M] (Acer) [Auto | Running] -- C:\Program Files\Acer\Acer Updater\UpdaterService.exe -- (Updater Service)
SRV - [2009/06/03 11:15:24 | 001,019,904 | -H-- | M] (Wave Systems Corp.) [On_Demand | Stopped] -- C:\Program Files\Wave Systems Corp\Secure Storage Manager\SecureStorageService.exe -- (SecureStorageService)
SRV - [2009/05/15 14:36:50 | 000,251,184 | RH-- | M] (BUFFALO INC.) [Auto | Running] -- C:\Program Files\BUFFALO\NASNAVI\nassvc.exe -- (NasPmService)
SRV - [2008/01/11 16:50:16 | 000,030,312 | -H-- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Microsoft Small Business\Business Contact Manager\BcmSqlStartupSvc.exe -- (BcmSqlStartupSvc)
SRV - [2006/03/03 20:03:10 | 000,069,632 | -H-- | M] (HP) [Unknown | Running] -- C:\WINDOWS\system32\HPZipm12.exe -- (Pml Driver HPZ12)
SRV - [2004/09/10 06:00:00 | 000,189,536 | -H-- | M] (SafeNet, Inc) [Auto | Running] -- C:\Program Files\Common Files\SafeNet Sentinel\Sentinel Protection Server\WinNT\spnsrvnt.exe -- (SentinelProtectionServer)


========== Driver Services (SafeList) ==========

DRV - [2011/10/15 13:16:16 | 000,464,176 | -H-- | M] (McAfee, Inc.) [Kernel | Unknown | Running] -- C:\WINDOWS\system32\drivers\mfehidk.sys -- (mfehidk)
DRV - [2011/10/15 13:16:16 | 000,338,176 | -H-- | M] (McAfee, Inc.) [Kernel | Unknown | Running] -- C:\WINDOWS\system32\drivers\mfefirek.sys -- (mfefirek)
DRV - [2011/10/15 13:16:16 | 000,180,816 | -H-- | M] (McAfee, Inc.) [Kernel | Unknown | Running] -- C:\WINDOWS\system32\drivers\mfeavfk.sys -- (mfeavfk)
DRV - [2011/10/15 13:16:16 | 000,121,256 | -H-- | M] (McAfee, Inc.) [Kernel | Unknown | Running] -- C:\WINDOWS\system32\drivers\mfeapfk.sys -- (mfeapfk)
DRV - [2011/10/15 13:16:16 | 000,089,792 | -H-- | M] (McAfee, Inc.) [Kernel | Unknown | Running] -- C:\WINDOWS\system32\drivers\mfetdi2k.sys -- (mfetdi2k)
DRV - [2011/10/15 13:16:16 | 000,087,656 | -H-- | M] (McAfee, Inc.) [Kernel | Unknown | Stopped] -- C:\WINDOWS\system32\drivers\mferkdet.sys -- (mferkdet)
DRV - [2011/10/15 13:16:16 | 000,083,856 | -H-- | M] (McAfee, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\mfendisk.sys -- (mfendiskmp)
DRV - [2011/10/15 13:16:16 | 000,083,856 | -H-- | M] (McAfee, Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\mfendisk.sys -- (mfendisk)
DRV - [2011/10/15 13:16:16 | 000,059,456 | -H-- | M] (McAfee, Inc.) [Kernel | Unknown | Running] -- C:\WINDOWS\system32\drivers\mfebopk.sys -- (mfebopk)
DRV - [2011/10/15 13:16:16 | 000,057,600 | -H-- | M] (McAfee, Inc.) [Kernel | Unknown | Running] -- C:\WINDOWS\system32\drivers\cfwids.sys -- (cfwids)
DRV - [2010/10/14 20:36:34 | 000,041,472 | -H-- | M] (BUFFALO INC.) [Kernel | Boot | Running] -- C:\WINDOWS\system32\drivers\bftpdskc.sys -- (bftpdskc)
DRV - [2010/09/21 20:43:09 | 000,011,776 | -H-- | M] (BUFFALO INC.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\bftpusbx.sys -- (bftpusbx)
DRV - [2010/05/10 13:41:30 | 000,067,656 | ---- | M] (SUPERAdBlocker.com and SUPERAntiSpyware.com) [Kernel | System | Running] -- C:\Program Files\SUPERAntiSpyware\SASKUTIL.SYS -- (SASKUTIL)
DRV - [2010/04/13 19:10:22 | 000,054,776 | -H-- | M] (Mozy, Inc.) [File_System | System | Running] -- C:\WINDOWS\system32\drivers\MOBK.sys -- (MOBKFilter)
DRV - [2010/03/09 21:29:00 | 000,036,344 | -H-- | M] (BUFFALO INC.) [Kernel | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\BFRD4G.sys -- (BFRD4G)
DRV - [2010/02/17 13:25:48 | 000,012,872 | ---- | M] (SUPERAdBlocker.com and SUPERAntiSpyware.com) [Kernel | System | Running] -- C:\Program Files\SUPERAntiSpyware\sasdifsv.sys -- (SASDIFSV)
DRV - [2009/07/27 12:42:12 | 000,209,208 | -H-- | M] (Wave Systems Corp.) [File_System | Auto | Running] -- C:\WINDOWS\system32\drivers\WavxDMgr.sys -- (WavxDMgr)
DRV - [2009/06/29 06:59:14 | 000,142,592 | -H-- | M] (Realtek Semiconductor Corporation ) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\Rtenicxp.sys -- (RTLE8023xp)
DRV - [2007/07/01 12:02:46 | 004,432,384 | -H-- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\RtkHDAud.sys -- (IntcAzAudAddService) Service for Realtek HD Audio (WDM)
DRV - [2004/09/10 06:00:00 | 000,084,064 | -H-- | M] (Rainbow Technologies, Inc.) [Kernel | Auto | Running] -- C:\WINDOWS\System32\Drivers\SENTINEL.SYS -- (Sentinel)
DRV - [2004/09/10 06:00:00 | 000,027,056 | -H-- | M] (Rainbow Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\SNTNLUSB.SYS -- (SNTNLUSB)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://homepage.acer.com/rdr.aspx?b=ACAW&l=1009&m=veriton_m265&r=0xpp06104906p04e5u265z45915277
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://homepage.acer.com/rdr.aspx?b=ACAW&l=1009&m=veriton_m265&r=0xpp06104906p04e5u265z45915277
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant =


IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0



IE - HKU\S-1-5-21-582103443-214099845-2681017343-1008\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://homepage.acer.com/rdr.aspx?b=ACAW&l=1009&m=veriton_m265&r=0xpp06104906p04e5u265z45915277
IE - HKU\S-1-5-21-582103443-214099845-2681017343-1008\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar =
IE - HKU\S-1-5-21-582103443-214099845-2681017343-1008\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page =
IE - HKU\S-1-5-21-582103443-214099845-2681017343-1008\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.msn.com/
IE - HKU\S-1-5-21-582103443-214099845-2681017343-1008\..\URLSearchHook: {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\Program Files\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
IE - HKU\S-1-5-21-582103443-214099845-2681017343-1008\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..browser.search.defaultenginename: "Secure Search"
FF - prefs.js..browser.search.selectedEngine: "Secure Search"
FF - prefs.js..browser.search.update: false
FF - prefs.js..browser.startup.homepage: "www.msn.com"
FF - prefs.js..extensions.enabledItems: {B7082FAA-CB62-4872-9106-E42DD88EDE45}:3.3.1
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20
FF - prefs.js..extensions.enabledItems: jqs@sun.com:1.0
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}:6.0.22
FF - prefs.js..keyword.URL: "http://search.yahoo.com/search?fr=mcafee&p="


FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@mcafee.com/MSC,version=10: c:\progra~1\mcafee\msc\npmcsn~1.dll ()
FF - HKLM\Software\MozillaPlugins\@mcafee.com/SAFFPlugin: C:\Program Files\McAfee\SiteAdvisor\npmcffplg32.dll (McAfee, Inc.)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files\Microsoft Silverlight\4.0.60831.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@PegasusImaging.com/PrizmViewer9 Plugin,PrizmViewer v9.0: C:\Program Files\Pegasus Imaging\Prizm Viewer\PrizmPlugin\NP_PrizmPLUGIN.dll (http://www.accusoft.com)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.79\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.79\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\Adobe Acrobat: C:\Program Files\Adobe\Acrobat 9.0\Acrobat\Air\nppdf32.dll (Adobe Systems Inc.)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\searchpredict@speedbit.com: C:\Program Files\SearchPredict\PRFireFox
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{0329E7D6-6F54-462D-93F6-F5C3118BADF2}: C:\Program Files\SpeedBit Video Downloader\SPFireFox
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{4ED1F68A-5463-4931-9384-8FFF5ED91D92}: C:\Program Files\McAfee\SiteAdvisor [2011/11/16 12:38:25 | 000,000,000 | -H-D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{D19CA586-DD6C-4a0a-96F8-14644F340D60}: C:\Program Files\Common Files\McAfee\SystemCore [2011/12/08 07:26:25 | 000,000,000 | -H-D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 8.0\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2011/11/08 12:26:29 | 000,000,000 | -H-D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 8.0\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2011/09/16 06:47:27 | 000,000,000 | -H-D | M]

[2010/06/09 13:00:29 | 000,000,000 | -H-D | M] (No name found) -- C:\Documents and Settings\Barrett Vukmer\Application Data\Mozilla\Extensions
[2011/11/30 14:40:47 | 000,000,000 | -H-D | M] (No name found) -- C:\Documents and Settings\Barrett Vukmer\Application Data\Mozilla\Firefox\Profiles\ni4w2sc4.default\extensions
[2010/06/12 10:47:55 | 000,000,000 | -H-D | M] (Microsoft .NET Framework Assistant) -- C:\Documents and Settings\Barrett Vukmer\Application Data\Mozilla\Firefox\Profiles\ni4w2sc4.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2011/07/08 08:04:54 | 000,002,055 | -H-- | M] () -- C:\Documents and Settings\Barrett Vukmer\Application Data\Mozilla\Firefox\Profiles\ni4w2sc4.default\searchplugins\daemon-search.xml
[2011/11/09 10:30:29 | 000,000,000 | -H-D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions
() (No name found) -- C:\DOCUMENTS AND SETTINGS\BARRETT VUKMER\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\NI4W2SC4.DEFAULT\EXTENSIONS\SKIPSCREEN@SKIPSCREEN.XPI
[2011/12/08 07:26:25 | 000,000,000 | -H-D | M] (McAfee ScriptScan for Firefox) -- C:\PROGRAM FILES\COMMON FILES\MCAFEE\SYSTEMCORE
[2011/11/16 12:38:25 | 000,000,000 | -H-D | M] (McAfee SiteAdvisor) -- C:\PROGRAM FILES\MCAFEE\SITEADVISOR
[2011/11/08 12:26:27 | 000,134,104 | -H-- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll
[2011/04/14 13:01:38 | 000,024,376 | -H-- | M] (McAfee, Inc.) -- C:\Program Files\mozilla firefox\components\Scriptff.dll
[2011/05/04 03:52:23 | 000,476,904 | -H-- | M] (Sun Microsystems, Inc.) -- C:\Program Files\mozilla firefox\plugins\npdeployJava1.dll
[2011/10/03 06:44:03 | 000,002,252 | -H-- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml
[2011/11/30 11:45:54 | 000,002,024 | -H-- | M] () -- C:\Program Files\mozilla firefox\searchplugins\McSiteAdvisor.xml
[2011/11/08 12:26:28 | 000,002,040 | -H-- | M] () -- C:\Program Files\mozilla firefox\searchplugins\twitter.xml

O1 HOSTS File: ([2011/05/06 14:37:42 | 000,000,098 | -H-- | M]) - C:\WINDOWS\system32\drivers\etc\Hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: ::1 localhost
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - No CLSID value found.
O2 - BHO: (McAfee Phishing Filter) - {27B4851A-3207-45A2-B947-BE8AFE6163AB} - c:\progra~1\mcafee\msk\mskapbho.dll File not found
O2 - BHO: (scriptproxy) - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\Common Files\McAfee\SystemCore\ScriptSn.20111205231838.dll (McAfee, Inc.)
O2 - BHO: (Adobe PDF Conversion Toolbar Helper) - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O2 - BHO: (McAfee SiteAdvisor BHO) - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - c:\Program Files\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
O2 - BHO: (ZeonIEEventHelper Class) - {DA986D7D-CCAF-47B2-84FE-BFA1549BEBF9} - C:\Program Files\Nuance\PDF Create! 5\bin\ZeonIEFavClient.dll (Zeon Corporation)
O2 - BHO: (SmartSelect Class) - {F4971EE7-DAA0-4053-9964-665D8EE6A077} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O3 - HKLM\..\Toolbar: (McAfee SiteAdvisor Toolbar) - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\Program Files\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
O3 - HKLM\..\Toolbar: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O3 - HKLM\..\Toolbar: (Nuance PDF) - {E3286BF1-E654-42FF-B4A6-5E111731DF6B} - C:\Program Files\Nuance\PDF Create! 5\bin\ZeonIEFavClient.dll (Zeon Corporation)
O3 - HKU\S-1-5-21-582103443-214099845-2681017343-1008\..\Toolbar\WebBrowser: (no name) - {32099AAC-C132-4136-9E9A-4E364A424E17} - No CLSID value found.
O3 - HKU\S-1-5-21-582103443-214099845-2681017343-1008\..\Toolbar\WebBrowser: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O4 - HKLM..\Run: [Acrobat Assistant 8.0] C:\Program Files\Adobe\Acrobat 9.0\Acrobat\Acrotray.exe (Adobe Systems Inc.)
O4 - HKLM..\Run: [Adobe Acrobat Speed Launcher] C:\Program Files\Adobe\Acrobat 9.0\Acrobat\Acrobat_sl.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [Alcmtr] C:\WINDOWS\Alcmtr.exe (Realtek Semiconductor Corp.)
O4 - HKLM..\Run: [Backup Utility TaskTray Tool] C:\Program Files\BUFFALO\Backup_Utility\BUTray.exe (BUFFALO INC.)
O4 - HKLM..\Run: [BackupManagerTray] C:\Program Files\NewTech Infosystems\Acer Backup Manager\BackupManagerTray.exe (NewTech Infosystems, Inc.)
O4 - HKLM..\Run: [BuffaloTools] C:\Program Files\BUFFALO\BuffaloTools\BuffaloTools.exe (BUFFALO INC.)
O4 - HKLM..\Run: [IMJPMIG8.1] C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE (Microsoft Corporation)
O4 - HKLM..\Run: [Intuit SyncManager] C:\Program Files\Common Files\Intuit\Sync\IntuitSyncManager.exe (Intuit Inc. All rights reserved.)
O4 - HKLM..\Run: [mcui_exe] C:\Program Files\McAfee.com\Agent\mcagent.exe (McAfee, Inc.)
O4 - HKLM..\Run: [MSPY2002] C:\WINDOWS\System32\IME\PINTLGNT\ImScInst.exe ()
O4 - HKLM..\Run: [NotificationCenterLauncher] C:\Program Files\Acer\Acer eRecovery Management\NotificationLauncher.exe (Acer)
O4 - HKLM..\Run: [Nuance PDF Create! 5-reminder] C:\Program Files\Nuance\PDF Create! 5\Ereg\Ereg.exe (Nuance Communications, Inc.)
O4 - HKLM..\Run: [PDF5 Registry Controller] C:\Program Files\Nuance\PDF Create! 5\RegistryController.exe (Nuance Communications, Inc.)
O4 - HKLM..\Run: [PDFHook] C:\Program Files\Nuance\PDF Create! 5\PdfCreate5Hook.exe (Nuance Communications, Inc.)
O4 - HKLM..\Run: [PDVD8LanguageShortcut] C:\Program Files\CyberLink\PowerDVD8\Language\Language.exe (CyberLink Corp.)
O4 - HKLM..\Run: [PHIME2002A] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE (Microsoft Corporation)
O4 - HKLM..\Run: [PHIME2002ASync] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE (Microsoft Corporation)
O4 - HKLM..\Run: [QtTaQTQPPkVP.exe] C:\Documents and Settings\All Users\Application Data\QtTaQTQPPkVP.exe File not found
O4 - HKLM..\Run: [RemoteControl8] C:\Program Files\CyberLink\PowerDVD8\PDVD8Serv.exe (CyberLink Corp.)
O4 - HKLM..\Run: [SecureUpgrade] C:\Program Files\Wave Systems Corp\SecureUpgrade.exe (Wave Systems Corp.)
O4 - HKLM..\Run: [WavXMgr] C:\Program Files\Wave Systems Corp\Services Manager\DocMgr\bin\WavXDocMgr.exe (Wave Systems Corp.)
O4 - HKU\S-1-5-21-582103443-214099845-2681017343-1008..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe (SUPERAntiSpyware.com)
O4 - Startup: C:\Documents and Settings\Barrett Vukmer\Start Menu\Programs\Startup\BUFFALO NAS Navigator2.lnk = C:\Program Files\BUFFALO\NASNAVI\NasNavi.exe (BUFFALO INC.)
O4 - Startup: C:\Documents and Settings\Barrett Vukmer\Start Menu\Programs\Startup\NAS Scheduler.lnk = C:\Program Files\BUFFALO\NASNAVI\nassche.exe (BUFFALO INC.)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoControlPanel = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKU\S-1-5-21-582103443-214099845-2681017343-1008\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O8 - Extra context menu item: Append Link Target to Existing PDF - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Append the content of the link to existing PDF file - C:\Program Files\Nuance\PDF Create! 5\bin\ZeonIEFavClient.dll (Zeon Corporation)
O8 - Extra context menu item: Append the content of the selected links to existing PDF file - C:\Program Files\Nuance\PDF Create! 5\bin\ZeonIEFavClient.dll (Zeon Corporation)
O8 - Extra context menu item: Append to Existing PDF - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Append to existing PDF file - C:\Program Files\Nuance\PDF Create! 5\bin\ZeonIEFavClient.dll (Zeon Corporation)
O8 - Extra context menu item: Convert Link Target to Adobe PDF - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Convert to Adobe PDF - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Create PDF file - C:\Program Files\Nuance\PDF Create! 5\bin\ZeonIEFavClient.dll (Zeon Corporation)
O8 - Extra context menu item: Create PDF file from the content of the link - C:\Program Files\Nuance\PDF Create! 5\bin\ZeonIEFavClient.dll (Zeon Corporation)
O8 - Extra context menu item: Create PDF files from the selected links - C:\Program Files\Nuance\PDF Create! 5\bin\ZeonIEFavClient.dll (Zeon Corporation)
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000 File not found
O9 - Extra 'Tools' menuitem : Uninstall BitDefender Online Scanner - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - mswsock.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - mswsock.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000003 - mswsock.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000004 - mswsock.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000005 - mswsock.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000006 - mswsock.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000007 - mswsock.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000008 - mswsock.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000009 - mswsock.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000010 - mswsock.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000011 - mswsock.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000012 - mswsock.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000013 - mswsock.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000014 - mswsock.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000015 - mswsock.dll File not found
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab (Java Plug-in 1.6.0_26)
O16 - DPF: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab (Java Plug-in 1.6.0_26)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab (Java Plug-in 1.6.0_26)
O18 - Protocol\Handler\dssrequest {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\Program Files\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
O18 - Protocol\Handler\intu-help-qb4 {ACE22922-D07C-4860-B51B-8CF472FEC2CB} - C:\Program Files\Intuit\QuickBooks 2008\HelpAsyncPluggableProtocol.dll (Intuit, Inc.)
O18 - Protocol\Handler\sacore {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\Program Files\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
O18 - Protocol\Filter\application/x-mfe-ipt {3EF5086B-5478-4598-A054-786C45D75692} - c:\Program Files\McAfee\MSC\McSnIePl.dll (McAfee, Inc.)
O20 - HKLM Winlogon: Shell - (Explorer.exe) -C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) -C:\WINDOWS\system32\userinit.exe (Microsoft Corporation)
O20 - Winlogon\Notify\!SASWinLogon: DllName - (C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL) - C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL (SUPERAntiSpyware.com)
O24 - Desktop WallPaper: C:\Documents and Settings\Barrett Vukmer\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\Barrett Vukmer\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O28 - HKLM ShellExecuteHooks: {5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} - C:\Program Files\SUPERAntiSpyware\SASSEH.DLL (SuperAdBlocker.com)
O30 - LSA: Authentication Packages - (wvauth) -C:\WINDOWS\System32\wvauth.dll (Wave Systems Corp.)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2010/12/02 12:58:12 | 000,000,000 | -H-D | M] - C:\Autodesk -- [ NTFS ]
O32 - AutoRun File - [2009/10/12 04:52:19 | 000,000,000 | -H-- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2011/12/08 07:27:52 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\McAfee
[2011/12/08 07:23:41 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Barrett Vukmer\Start Menu\Programs\CyberLink PowerDVD 8
[2011/12/05 16:04:46 | 000,000,000 | -HSD | C] -- C:\$RECYCLE.BIN
[2011/12/05 14:28:47 | 000,094,896 | ---- | C] (Kaspersky Lab, GERT) -- C:\WINDOWS\System32\drivers\62579830.sys
[2011/12/05 14:21:19 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\!SASCORE
[2011/12/04 13:32:44 | 000,000,000 | ---D | C] -- C:\bd_logs
[2011/12/04 13:10:03 | 000,000,000 | ---D | C] -- C:\New Folder
[2011/12/02 10:52:52 | 000,000,000 | RH-D | C] -- C:\Documents and Settings\Barrett Vukmer\Recent
[2011/12/01 11:31:53 | 000,607,260 | -H-- | C] (Swearware) -- C:\Documents and Settings\Barrett Vukmer\Desktop\dds.scr
[2011/11/20 14:47:01 | 000,000,000 | -H-D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\Google Earth
[2011/11/19 11:02:12 | 000,000,000 | -H-D | C] -- C:\Documents and Settings\Barrett Vukmer\Desktop\TRENDNET
[2011/11/15 08:28:26 | 000,000,000 | -H-D | C] -- C:\Documents and Settings\Barrett Vukmer\My Documents\critical areas
[2011/11/11 07:59:40 | 000,000,000 | -H-D | C] -- C:\Documents and Settings\Barrett Vukmer\Application Data\GRETECH
[2011/11/10 15:08:21 | 000,000,000 | -H-D | C] -- C:\Documents and Settings\Barrett Vukmer\Local Settings\Application Data\MPlayer
[2011/11/10 15:07:18 | 000,000,000 | -H-D | C] -- C:\Program Files\UMPlayer

========== Files - Modified Within 30 Days ==========

[2011/12/08 07:23:36 | 000,000,882 | -H-- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2011/12/08 07:23:36 | 000,000,276 | -H-- | M] () -- C:\WINDOWS\tasks\WGASetup.job
[2011/12/08 07:23:06 | 2137,247,744 | -HS- | M] () -- C:\hiberfil.sys
[2011/12/08 07:23:06 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2011/12/07 08:06:35 | 000,001,324 | ---- | M] () -- C:\WINDOWS\System32\d3d9caps.dat
[2011/12/07 07:10:00 | 000,000,902 | -H-- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2011/12/06 14:40:45 | 000,000,181 | -H-- | M] () -- C:\WINDOWS\hpbafd.ini
[2011/12/05 14:28:47 | 000,094,896 | ---- | M] (Kaspersky Lab, GERT) -- C:\WINDOWS\System32\drivers\62579830.sys
[2011/12/05 13:41:23 | 000,001,682 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\SUPERAntiSpyware Free Edition.lnk
[2011/12/04 12:41:34 | 000,001,158 | -H-- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2011/12/03 11:55:44 | 000,013,064 | -HS- | M] () -- C:\Documents and Settings\Barrett Vukmer\Local Settings\Application Data\4v17o80h6m6l121160xc020m51l8v73g14pob
[2011/12/03 11:55:44 | 000,013,064 | -HS- | M] () -- C:\Documents and Settings\All Users\Application Data\4v17o80h6m6l121160xc020m51l8v73g14pob
[2011/12/02 10:07:24 | 000,000,090 | -H-- | M] () -- C:\WINDOWS\QBChanUtil_Trigger.ini
[2011/12/02 09:47:05 | 000,000,000 | -H-- | M] () -- C:\Documents and Settings\Barrett Vukmer\Local Settings\Application Data\WavXMapDrive.bat
[2011/12/01 13:24:51 | 000,030,208 | -H-- | M] () -- C:\Documents and Settings\Barrett Vukmer\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011/12/01 11:30:57 | 000,607,260 | -H-- | M] (Swearware) -- C:\Documents and Settings\Barrett Vukmer\Desktop\dds.scr
[2011/11/30 14:07:34 | 000,013,102 | -HS- | M] () -- C:\Documents and Settings\Barrett Vukmer\Local Settings\Application Data\8m47be7y13p205
[2011/11/30 14:07:34 | 000,013,102 | -HS- | M] () -- C:\Documents and Settings\All Users\Application Data\8m47be7y13p205
[2011/11/29 08:07:00 | 000,000,284 | -H-- | M] () -- C:\WINDOWS\tasks\AppleSoftwareUpdate.job
[2011/11/28 14:41:38 | 000,010,866 | -HS- | M] () -- C:\Documents and Settings\All Users\Application Data\5n80nt8p31r817
[2011/11/28 14:41:37 | 000,010,866 | -HS- | M] () -- C:\Documents and Settings\Barrett Vukmer\Local Settings\Application Data\5n80nt8p31r817
[2011/11/21 13:47:04 | 000,003,396 | -H-- | M] () -- C:\Documents and Settings\Barrett Vukmer\Desktop\GIFCON25.CFG
[2011/11/21 13:28:11 | 000,414,368 | -H-- | M] (Adobe Systems Incorporated) -- C:\WINDOWS\System32\FlashPlayerCPLApp.cpl
[2011/11/16 07:50:12 | 001,545,858 | -H-- | M] () -- C:\tdsskiller.zip
[2011/11/16 07:50:12 | 001,545,858 | -H-- | M] () -- C:\Documents and Settings\Barrett Vukmer\Desktop\tdsskiller.zip
[2011/11/11 03:00:36 | 000,001,393 | -H-- | M] () -- C:\WINDOWS\imsins.BAK
[2011/11/10 09:24:00 | 000,132,767 | -H-- | M] () -- C:\Documents and Settings\Barrett Vukmer\My Documents\IMG958646.jpg

========== Files Created - No Company Name ==========

[2011/12/08 07:16:55 | 2137,247,744 | -HS- | C] () -- C:\hiberfil.sys
[2011/12/05 16:36:58 | 001,545,858 | -H-- | C] () -- C:\Documents and Settings\Barrett Vukmer\Desktop\tdsskiller.zip
[2011/12/05 16:36:51 | 001,545,858 | -H-- | C] () -- C:\tdsskiller.zip
[2011/12/05 13:41:23 | 000,001,682 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\SUPERAntiSpyware Free Edition.lnk
[2011/12/02 16:59:28 | 000,013,064 | -HS- | C] () -- C:\Documents and Settings\Barrett Vukmer\Local Settings\Application Data\4v17o80h6m6l121160xc020m51l8v73g14pob
[2011/12/02 16:59:28 | 000,013,064 | -HS- | C] () -- C:\Documents and Settings\All Users\Application Data\4v17o80h6m6l121160xc020m51l8v73g14pob
[2011/11/30 14:03:15 | 000,013,102 | -HS- | C] () -- C:\Documents and Settings\Barrett Vukmer\Local Settings\Application Data\8m47be7y13p205
[2011/11/30 14:03:15 | 000,013,102 | -HS- | C] () -- C:\Documents and Settings\All Users\Application Data\8m47be7y13p205
[2011/11/28 14:30:04 | 000,010,866 | -HS- | C] () -- C:\Documents and Settings\Barrett Vukmer\Local Settings\Application Data\5n80nt8p31r817
[2011/11/28 14:30:04 | 000,010,866 | -HS- | C] () -- C:\Documents and Settings\All Users\Application Data\5n80nt8p31r817
[2011/11/11 03:17:11 | 000,313,496 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\FontCache3.0.0.0.dat
[2011/11/10 09:24:00 | 000,132,767 | -H-- | C] () -- C:\Documents and Settings\Barrett Vukmer\My Documents\IMG958646.jpg
[2011/08/27 10:52:22 | 000,021,434 | -H-- | C] () -- C:\WINDOWS\UN091222.INI
[2011/08/27 10:52:19 | 000,013,535 | -H-- | C] () -- C:\WINDOWS\UN091114.INI
[2011/08/27 10:52:15 | 000,033,735 | -H-- | C] () -- C:\WINDOWS\UN091111.INI
[2011/08/27 10:52:12 | 000,013,076 | -H-- | C] () -- C:\WINDOWS\UN091201.INI
[2011/06/20 13:36:07 | 000,109,216 | -H-- | C] () -- C:\WINDOWS\System32\EasyHook64.dll
[2011/06/20 13:36:07 | 000,090,784 | -H-- | C] () -- C:\WINDOWS\System32\EasyHook32.dll
[2011/04/20 07:50:48 | 000,001,324 | ---- | C] () -- C:\WINDOWS\System32\d3d9caps.dat
[2011/04/16 10:26:13 | 000,000,090 | -H-- | C] () -- C:\WINDOWS\QBChanUtil_Trigger.ini
[2011/03/27 11:28:40 | 000,000,036 | -H-- | C] () -- C:\Documents and Settings\Barrett Vukmer\Local Settings\Application Data\housecall.guid.cache
[2011/03/23 07:24:58 | 000,000,181 | -H-- | C] () -- C:\WINDOWS\hpbafd.ini
[2011/02/06 14:22:40 | 000,061,678 | -H-- | C] () -- C:\Documents and Settings\Barrett Vukmer\Application Data\PFP100JPR.{PB
[2011/02/06 14:22:40 | 000,012,358 | -H-- | C] () -- C:\Documents and Settings\Barrett Vukmer\Application Data\PFP100JCM.{PB
[2011/02/05 12:57:38 | 000,000,161 | -H-- | C] () -- C:\WINDOWS\DISPARAM.INI
[2011/01/08 11:50:27 | 000,079,360 | -H-- | C] () -- C:\WINDOWS\System32\acdbres.dll
[2010/12/06 11:53:50 | 000,115,040 | -H-- | C] () -- C:\WINDOWS\System32\mlfcache.dat
[2010/09/29 13:09:18 | 000,000,418 | -H-- | C] () -- C:\WINDOWS\dload32.INI
[2010/09/29 13:09:18 | 000,000,059 | -H-- | C] () -- C:\WINDOWS\COMWRK32.INI
[2010/09/29 12:48:42 | 000,045,056 | -H-- | C] () -- C:\WINDOWS\System32\usbmgln.dll
[2010/08/25 07:09:38 | 000,123,108 | -H-- | C] () -- C:\WINDOWS\HPHins12.dat.temp
[2010/08/25 07:09:38 | 000,014,916 | -H-- | C] () -- C:\WINDOWS\hphmdl12.dat.temp
[2010/08/16 10:21:37 | 000,123,108 | -H-- | C] () -- C:\WINDOWS\HPHins12.dat
[2010/08/16 10:21:37 | 000,014,916 | -H-- | C] () -- C:\WINDOWS\hphmdl12.dat
[2010/08/16 09:59:02 | 000,077,824 | -H-- | C] () -- C:\WINDOWS\System32\hpzids01.dll
[2010/06/09 14:23:32 | 000,006,960 | -H-- | C] () -- C:\WINDOWS\DESGNJT2.INI
[2010/06/09 10:39:06 | 000,030,208 | -H-- | C] () -- C:\Documents and Settings\Barrett Vukmer\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010/06/09 10:03:21 | 000,000,000 | -H-- | C] () -- C:\WINDOWS\nsreg.dat
[2010/06/09 10:00:16 | 000,000,056 | -H-- | C] () -- C:\WINDOWS\hpdj500.ini
[2010/06/09 07:44:29 | 000,001,447 | -H-- | C] () -- C:\WINDOWS\hpbvnstp.ini
[2010/06/08 15:09:26 | 000,502,272 | -H-- | C] () -- C:\WINDOWS\System32\snbd7w95.dll
[2010/06/08 14:52:28 | 000,000,376 | -H-- | C] () -- C:\WINDOWS\ODBC.INI
[2010/06/08 14:31:03 | 000,000,000 | -H-- | C] () -- C:\Documents and Settings\Barrett Vukmer\Local Settings\Application Data\WavXMapDrive.bat
[2010/06/08 14:12:33 | 000,022,016 | -H-- | C] () -- C:\WINDOWS\System32\TSP1.dll
[2010/06/08 14:10:59 | 000,143,360 | -H-- | C] () -- C:\WINDOWS\System32\bioapi_mds300.dll.bak
[2010/06/08 14:10:59 | 000,143,360 | -H-- | C] () -- C:\WINDOWS\System32\bioapi_mds300.dll
[2010/06/08 14:10:59 | 000,106,496 | -H-- | C] () -- C:\WINDOWS\System32\bioapi100.dll.bak
[2010/06/08 14:10:59 | 000,106,496 | -H-- | C] () -- C:\WINDOWS\System32\bioapi100.dll
[2010/06/08 14:07:20 | 000,049,152 | -H-- | C] () -- C:\WINDOWS\System32\ChCfg.exe
[2010/05/07 16:31:36 | 000,015,046 | -H-- | C] () -- C:\WINDOWS\UN060501.INI
[2009/10/19 11:01:38 | 000,004,376 | -H-- | C] () -- C:\WINDOWS\UN090928.INI
[2009/10/12 08:38:01 | 000,006,782 | -H-- | C] () -- C:\WINDOWS\System32\OEMINFO.INI
[2009/10/12 08:38:00 | 000,020,480 | -H-- | C] () -- C:\WINDOWS\LauncheRyDiscCalc.exe
[2009/10/12 08:37:53 | 000,147,456 | -H-- | C] () -- C:\WINDOWS\System32\igfxCoIn_v4926.dll
[2009/10/12 08:37:49 | 000,073,728 | -H-- | C] () -- C:\WINDOWS\System32\RtNicProp32.dll
[2009/10/12 08:37:41 | 000,491,028 | -H-- | C] () -- C:\WINDOWS\System32\perfh009.dat
[2009/10/12 08:37:41 | 000,272,128 | -H-- | C] () -- C:\WINDOWS\System32\perfi009.dat
[2009/10/12 08:37:41 | 000,090,790 | -H-- | C] () -- C:\WINDOWS\System32\perfc009.dat
[2009/10/12 08:37:41 | 000,028,626 | -H-- | C] () -- C:\WINDOWS\System32\perfd009.dat
[2009/10/12 08:37:41 | 000,004,569 | -H-- | C] () -- C:\WINDOWS\System32\secupd.dat
[2009/10/12 08:37:40 | 013,107,200 | -H-- | C] () -- C:\WINDOWS\System32\oembios.bin
[2009/10/12 08:37:40 | 000,004,524 | -H-- | C] () -- C:\WINDOWS\System32\oembios.dat
[2009/10/12 08:37:40 | 000,000,741 | -H-- | C] () -- C:\WINDOWS\System32\noise.dat
[2009/10/12 08:37:39 | 000,673,088 | -H-- | C] () -- C:\WINDOWS\System32\mlang.dat
[2009/10/12 08:37:39 | 000,046,258 | -H-- | C] () -- C:\WINDOWS\System32\mib.bin
[2009/10/12 08:37:37 | 000,218,003 | -H-- | C] () -- C:\WINDOWS\System32\dssec.dat
[2009/10/12 08:37:36 | 000,001,804 | -H-- | C] () -- C:\WINDOWS\System32\Dcache.bin
[2009/10/12 07:00:47 | 000,000,061 | -H-- | C] () -- C:\WINDOWS\smscfg.ini
[2009/10/12 04:54:55 | 000,032,768 | -H-- | C] () -- C:\WINDOWS\AMove.exe
[2009/10/12 04:53:50 | 000,002,048 | --S- | C] () -- C:\WINDOWS\bootstat.dat
[2009/10/12 04:50:17 | 000,021,640 | -H-- | C] () -- C:\WINDOWS\System32\emptyregdb.dat
[2009/10/12 04:49:40 | 000,001,793 | -H-- | C] () -- C:\WINDOWS\System32\fxsperf.ini
[2009/10/12 00:45:43 | 000,004,161 | -H-- | C] () -- C:\WINDOWS\ODBCINST.INI
[2009/10/12 00:45:07 | 000,483,520 | -H-- | C] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2009/07/27 11:15:32 | 000,249,856 | -H-- | C] () -- C:\WINDOWS\System32\wxvault.dll
[2009/06/05 14:41:18 | 000,557,056 | -H-- | C] () -- C:\WINDOWS\System32\AmRes_fr.dll
[2009/06/05 14:41:18 | 000,528,384 | -H-- | C] () -- C:\WINDOWS\System32\AmRes_en.dll
[2009/06/05 14:41:16 | 000,552,960 | -H-- | C] () -- C:\WINDOWS\System32\AmRes_it.dll
[2009/06/05 14:41:16 | 000,552,960 | -H-- | C] () -- C:\WINDOWS\System32\AmRes_es.dll
[2009/06/05 14:41:16 | 000,536,576 | -H-- | C] () -- C:\WINDOWS\System32\AmRes_ja.dll
[2009/06/05 14:41:14 | 000,540,672 | -H-- | C] () -- C:\WINDOWS\System32\AmRes_pt-BR.dll
[2009/06/05 14:41:14 | 000,520,192 | -H-- | C] () -- C:\WINDOWS\System32\AmRes_ko.dll
[2009/06/05 14:41:12 | 000,581,632 | -H-- | C] () -- C:\WINDOWS\System32\AmRes_ru.dll
[2009/06/05 14:41:12 | 000,491,520 | -H-- | C] () -- C:\WINDOWS\System32\AmRes_zh-CHT.dll
[2009/06/05 14:41:12 | 000,491,520 | -H-- | C] () -- C:\WINDOWS\System32\AmRes_zh-CHS.dll
[2009/06/05 14:41:10 | 000,557,056 | -H-- | C] () -- C:\WINDOWS\System32\AmRes_nl.dll
[2009/06/05 14:41:10 | 000,540,672 | -H-- | C] () -- C:\WINDOWS\System32\AmRes_cs.dll
[2009/06/05 14:41:10 | 000,528,384 | -H-- | C] () -- C:\WINDOWS\System32\AmRes_da.dll
[2009/06/05 14:41:08 | 000,544,768 | -H-- | C] () -- C:\WINDOWS\System32\AmRes_pl.dll
[2009/06/05 14:41:08 | 000,532,480 | -H-- | C] () -- C:\WINDOWS\System32\AmRes_sv.dll
[2009/06/05 14:41:08 | 000,528,384 | -H-- | C] () -- C:\WINDOWS\System32\AmRes_no.dll
[2009/06/05 14:41:06 | 000,552,960 | -H-- | C] () -- C:\WINDOWS\System32\AmRes_el.dll
[2009/06/05 14:41:06 | 000,524,288 | -H-- | C] () -- C:\WINDOWS\System32\AmRes_ar.dll
[2009/06/05 14:41:04 | 000,548,864 | -H-- | C] () -- C:\WINDOWS\System32\AmRes_pt-PT.dll
[2009/06/05 14:41:04 | 000,544,768 | -H-- | C] () -- C:\WINDOWS\System32\AmRes_hu.dll
[2009/06/05 14:41:04 | 000,536,576 | -H-- | C] () -- C:\WINDOWS\System32\AmRes_fi.dll
[2009/06/05 14:41:04 | 000,516,096 | -H-- | C] () -- C:\WINDOWS\System32\AmRes_he.dll
[2009/06/05 14:41:02 | 000,548,864 | -H-- | C] () -- C:\WINDOWS\System32\AmRes_ro.dll
[2009/06/05 14:41:00 | 000,540,672 | -H-- | C] () -- C:\WINDOWS\System32\AmRes_tr.dll
[2009/06/05 14:31:18 | 000,561,152 | -H-- | C] () -- C:\WINDOWS\System32\AmRes_de.dll
[2009/06/03 12:08:48 | 000,098,304 | -H-- | C] () -- C:\WINDOWS\System32\Internationalization_tr.dll
[2009/06/03 12:08:46 | 000,102,400 | -H-- | C] () -- C:\WINDOWS\System32\Internationalization_ro.dll
[2009/06/03 12:08:46 | 000,102,400 | -H-- | C] () -- C:\WINDOWS\System32\Internationalization_pt-BR.dll
[2009/06/03 12:08:44 | 000,102,400 | -H-- | C] () -- C:\WINDOWS\System32\Internationalization_hu.dll
[2009/06/03 12:08:42 | 000,098,304 | -H-- | C] () -- C:\WINDOWS\System32\Internationalization_fi.dll
[2009/06/03 12:08:42 | 000,094,208 | -H-- | C] () -- C:\WINDOWS\System32\Internationalization_he.dll
[2009/06/03 12:08:40 | 000,106,496 | -H-- | C] () -- C:\WINDOWS\System32\Internationalization_el.dll
[2009/06/03 12:08:38 | 000,098,304 | -H-- | C] () -- C:\WINDOWS\System32\Internationalization_cs.dll
[2009/06/03 12:08:36 | 000,094,208 | -H-- | C] () -- C:\WINDOWS\System32\Internationalization_ar.dll
[2009/06/03 12:08:36 | 000,081,920 | -H-- | C] () -- C:\WINDOWS\System32\Internationalization_zh-CHT.dll
[2009/06/03 12:08:34 | 000,081,920 | -H-- | C] () -- C:\WINDOWS\System32\Internationalization_zh-CHS.dll
[2009/06/03 12:08:32 | 000,098,304 | -H-- | C] () -- C:\WINDOWS\System32\Internationalization_sv.dll
[2009/06/03 12:08:32 | 000,098,304 | -H-- | C] () -- C:\WINDOWS\System32\Internationalization_ru.dll
[2009/06/03 12:08:30 | 000,102,400 | -H-- | C] () -- C:\WINDOWS\System32\Internationalization_pt.dll
[2009/06/03 12:08:28 | 000,102,400 | -H-- | C] () -- C:\WINDOWS\System32\Internationalization_pl.dll
[2009/06/03 12:08:28 | 000,098,304 | -H-- | C] () -- C:\WINDOWS\System32\Internationalization_no.dll
[2009/06/03 12:08:26 | 000,106,496 | -H-- | C] () -- C:\WINDOWS\System32\Internationalization_nl.dll
[2009/06/03 12:08:24 | 000,090,112 | -H-- | C] () -- C:\WINDOWS\System32\Internationalization_ko.dll
[2009/06/03 12:08:24 | 000,090,112 | -H-- | C] () -- C:\WINDOWS\System32\Internationalization_ja.dll
[2009/06/03 12:08:22 | 000,102,400 | -H-- | C] () -- C:\WINDOWS\System32\Internationalization_it.dll
[2009/06/03 12:08:20 | 000,102,400 | -H-- | C] () -- C:\WINDOWS\System32\Internationalization_fr.dll
[2009/06/03 12:08:20 | 000,102,400 | -H-- | C] () -- C:\WINDOWS\System32\Internationalization_es.dll
[2009/06/03 12:08:16 | 000,102,400 | -H-- | C] () -- C:\WINDOWS\System32\Internationalization_de.dll
[2009/06/03 12:08:16 | 000,102,400 | -H-- | C] () -- C:\WINDOWS\System32\Internationalization_da.dll
[2009/06/03 11:07:50 | 000,010,752 | -H-- | C] () -- C:\WINDOWS\System32\Wavx_ESC_Logging.dll
[2009/05/05 09:34:22 | 000,839,680 | -H-- | C] () -- C:\WINDOWS\System32\DemoLicense.dll
[2006/06/12 07:01:16 | 000,348,160 | -H-- | C] () -- C:\WINDOWS\tsp.dll
[2004/09/10 12:34:00 | 000,917,504 | -H-- | C] () -- C:\WINDOWS\System32\lmgr10.dll
[2004/09/10 12:34:00 | 000,057,344 | -H-- | C] () -- C:\WINDOWS\System32\ADsSecurity.dll
[2004/04/02 13:01:22 | 000,192,512 | -H-- | C] () -- C:\WINDOWS\System32\HPB1320V.DLL
[2004/02/09 17:21:38 | 000,000,319 | -H-- | C] () -- C:\WINDOWS\System32\HPB1320V.DAT
[2001/07/31 09:17:12 | 000,094,274 | -H-- | C] () -- C:\WINDOWS\System32\HPBHEALR.DLL

========== Alternate Data Streams ==========

@Alternate Data Stream - 171 bytes -> C:\Documents and Settings\All Users\Application Data\Temp:DFC5A2B2
@Alternate Data Stream - 127 bytes -> C:\Documents and Settings\All Users\Application Data\Temp:430C6D84
@Alternate Data Stream - 125 bytes -> C:\Documents and Settings\All Users\Application Data\Temp:553CA6CA

< End of report >




OTL Extras logfile created on: 12/8/2011 7:25:15 AM - Run 1
OTL by OldTimer - Version 3.2.31.0 Folder = N:\virus fix
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

1.99 Gb Total Physical Memory | 1.23 Gb Available Physical Memory | 62.02% Memory free
3.84 Gb Paging File | 3.17 Gb Available in Paging File | 82.59% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 59.95 Gb Total Space | 25.80 Gb Free Space | 43.04% Space Free | Partition Type: NTFS
Drive D: | 60.00 Gb Total Space | 40.37 Gb Free Space | 67.29% Space Free | Partition Type: NTFS
Drive N: | 3.81 Gb Total Space | 3.45 Gb Free Space | 90.35% Space Free | Partition Type: FAT32

Computer Name: ACER-0A04F1A0D2 | User Name: Barrett Vukmer | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========


========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
.html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
exefile [open] -- "%1" %*
http [open] -- "C:\Program Files\Mozilla Firefox\firefox.exe" -requestPending -osint -url "%1" (Mozilla Corporation)
https [open] -- "C:\Program Files\Mozilla Firefox\firefox.exe" -requestPending -osint -url "%1" (Mozilla Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" = 1
"AntiVirusOverride" = 1
"FirewallOverride" = 1
"ANTIVIRUSDISABLENOTIFY" = 0
"FIREWALLDISABLENOTIFY" = 0
"UPDATESDISABLENOTIFY" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]
"DisableMonitoring" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]
"DisableMonitoring" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]

========== System Restore Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sr]
"Start" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SrService]
"Start" = 2

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 1
"EnableFirewall" = 0
"DoNotAllowExceptions" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List]
"139:TCP" = 139:TCP:*:Enabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:*:Enabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:*:Enabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:*:Enabled:@xpsp2res.dll,-22002

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 0
"DisableNotifications" = 1
"DoNotAllowExceptions" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"1900:UDP" = 1900:UDP:LocalSubNet:Disabled:@xpsp2res.dll,-22007
"2869:TCP" = 2869:TCP:LocalSubNet:Disabled:@xpsp2res.dll,-22008
"139:TCP" = 139:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22002

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
"C:\Program Files\CyberLink\PowerDVD8\PowerDVD8.exe" = C:\Program Files\CyberLink\PowerDVD8\PowerDVD8.exe:*:Enabled:CyberLink PowerDVD 8.0 -- (CyberLink Corp.)

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Program Files\CyberLink\PowerDVD8\PowerDVD8.exe" = C:\Program Files\CyberLink\PowerDVD8\PowerDVD8.exe:*:Enabled:CyberLink PowerDVD 8.0 -- (CyberLink Corp.)
"C:\Program Files\Common Files\SafeNet Sentinel\Sentinel Protection Server\WinNT\spnsrvnt.exe" = C:\Program Files\Common Files\SafeNet Sentinel\Sentinel Protection Server\WinNT\spnsrvnt.exe:*:Disabled:Sentinel Protection Server -- (SafeNet, Inc)
"C:\Program Files\TRENDnet\PS Utility\PSUTILITY.EXE" = C:\Program Files\TRENDnet\PS Utility\PSUTILITY.EXE:*:Enabled:PsUtility -- ()
"C:\Program Files\Google\Google Earth\plugin\geplugin.exe" = C:\Program Files\Google\Google Earth\plugin\geplugin.exe:*:Enabled:Google Earth -- (Google)
"C:\WINDOWS\explorer.exe" = C:\WINDOWS\explorer.exe:*:Disabled:Windows Explorer -- (Microsoft Corporation)
"C:\Program Files\Intuit\QuickBooks 2008\QBDBMgrN.exe" = C:\Program Files\Intuit\QuickBooks 2008\QBDBMgrN.exe:*:Enabled:QuickBooks 2011 Data Manager -- (Intuit, Inc.)
"C:\Program Files\BUFFALO\NASNAVI\NasNavi.exe" = C:\Program Files\BUFFALO\NASNAVI\NasNavi.exe:*:Enabled:BUFFALO NASNavigator2 -- (BUFFALO INC.)
"C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe" = C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe:*:Enabled:McAfee Shared Service Host -- (McAfee, Inc.)


========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{0456ebd7-5f67-4ab6-852e-63781e3f389c}" = Macromedia Flash Player
"{068724F8-D8BE-4B43-8DDD-B9FE9E49FD76}" = Scansoft PDF Create
"{07D618CD-B016-438A-ADC9-A75BD23F85CE}" = Wave Support Software
"{087E06A0-4514-4CEA-918A-D6A9AB0F8433}" = upekmsi
"{0B0A2153-58A6-4244-B458-25EDF5FCD809}" = Private Information Manager
"{11E0AC7D-6822-4F67-865F-EE1C13D28C38}" = QuickBooks Pro 2011
"{131A2659-99A9-4A89-B012-22A898EAE9DA}" = EMBASSY Security Center Lite
"{15D967B5-A4BE-42AE-9E84-64CD062B25AA}" = eSobi v2
"{17424F35-8B77-4ADF-BC63-BF9B81418539}" = Apple Application Support
"{1D70AABC-CB59-4700-A708-EA56D1CA07B0}" = QuickBooks
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{20400dbd-e6db-45b8-9b6b-1dd7033818ec}" = Nero InfoTool Help
"{21E6C8E8-C2DF-46B9-8C50-3538C26AEDCC}" = Designjet Software & Driver Installation Wizard
"{2348b586-c9ae-46ce-936c-a68e9426e214}" = Nero StartSmart Help
"{24A494F3-5B5F-4183-9F7D-9CE82812C1FC}" = tsp patch
"{26A24AE4-039D-4CA4-87B4-2F83216025FF}" = Java™ 6 Update 26
"{27C467F8-F8EF-4f68-BD72-D63632B2096C}" = McAfee Online Backup
"{287ECFA4-719A-2143-A09B-D6A12DE54E40}" = Acrobat.com
"{29D88826-2AB9-11D5-8854-00902761A46D}" = WordPerfect Office 2002
"{2AFFFDD7-ED85-4A90-8C52-5DA9EBDC9B8F}" = Microsoft SQL Server 2005 Express Edition (MSSMLBIZ)
"{2BF2E31F-B8BB-40A7-B650-98D28E0F7D47}" = CyberLink PowerDVD 8
"{2CC5FCAE-51BA-4926-8C2B-4F07E54F6EA3}" = ScanSnap
"{30075A70-B5D2-440B-AFA3-FB2021740121}" = Backup Manager Advance
"{33cf58f5-48d8-4575-83d6-96f574e4d83a}" = Nero DriveSpeed
"{350C97B0-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{45B8A76B-57EC-4242-B019-066400CD8428}" = BufferChm
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4D43D635-6FDA-4fa5-AA9B-23CF73D058EA}" = Nero StartSmart OEM
"{50120000-1105-0000-0000-0000000FF1CE}" = Microsoft Office 2007 Primary Interop Assemblies
"{51AE9E42-640D-4C14-A9B6-43F64AA4E3E2}" = Document Manager Lite
"{53333479-6A52-4816-8497-5C52B67ED339}" = EMBASSY Security Setup
"{53F5C3EE-05ED-4830-994B-50B2F0D50FCE}" = Microsoft SQL Server Setup Support Files (English)
"{547D4265-AF45-42E9-A62A-C58182AA35B9}" = Sentinel Protection Installer 7.0.0
"{55E63724-2BFE-49BC-B03E-9BE0F62E18C2}" = ScanSnap Organizer
"{56C049BE-79E9-4502-BEA7-9754A3E60F9B}" = neroxml
"{5783F2D7-9028-0409-0000-0060B0CE6BBA}" = DWG TrueView 2011
"{595a3116-40bb-4e0f-a2e8-d7951da56270}" = NeroExpress
"{5A3C1721-F8ED-11E0-8AFB-B8AC6F97B88E}" = Google Earth
"{5A3F6A80-7913-475E-8B96-477A952CFA43}" = SupportSoft Assisted Service
"{6909F917-5499-482e-9AA1-FAD06A99F231}" = Toolbox
"{6956856F-B6B3-4BE0-BA0B-8F495BE32033}" = Apple Software Update
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{716E0306-8318-4364-8B8F-0CC4E9376BAC}" = MSXML 4.0 SP2 Parser and SDK
"{7670D32F-DAE6-4E49-8C8B-B3F08B5B1686}" = Microsoft SQL Server Native Client
"{7748ac8c-18e3-43bb-959b-088faea16fb2}" = Nero StartSmart
"{79B520D5-CE72-4661-A054-804BC3412516}" = Wave Infrastructure Installer
"{7F04B06D-1D3C-4468-B3CE-B5791AF04BAF}" = Nuance PDF Create! 5
"{7F811A54-5A09-4579-90E1-C93498E230D9}" = Acer eRecovery Management
"{8048F0F3-C5AB-4C3C-8518-2B5E41DDFABA}" = AuthenTec Fingerprint Sensor Minimum Install
"{821A1432-2058-4CEA-8ACF-F6A726FA2A46}" = Trimble Link 3.0 for LDD R3
"{83202942-84b3-4c50-8622-b8c0aa2d2885}" = Nero Express Help
"{869200db-287a-4dc0-b02b-2b6787fbcd4c}" = Nero DiscSpeed
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8DCD0779-8811-4060-9227-871E2FD48E45}" = CardMinder V4.1
"{90120000-0020-0409-0000-0000000FF1CE}" = Compatibility Pack for the 2007 Office system
"{90300409-6000-11D3-8CFE-0050048383C9}" = Microsoft Office XP Media Content
"{90A40409-6000-11D3-8CFE-0150048383C9}" = Microsoft Office 2003 Web Components
"{91110409-6000-11D3-8CFE-0050048383C9}" = Microsoft Office XP Professional
"{91190409-6000-11D3-8CFE-0050048383C9}" = Microsoft Publisher 2002
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{9D9FC46E-5F53-41F5-8730-813583C27429}" = Accusoft Prizm Viewer 9
"{a0fe116e-9a8a-466f-aee0-625cb7c207e3}" = Microsoft Visual C++ 2005 Redistributable - KB2467175
"{A1E572BD-5E4C-41BA-BA73-8994885ED606}" = Trimble Terramodel 10.43
"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2
"{A43BF6A5-D5F0-4AAA-BF41-65995063EC44}" = MSXML 6.0 Parser
"{A8F2089B-1F79-4BF6-B385-A2C2B0B9A74D}" = ImagXpress
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{A939D341-5A04-4E0A-BB55-3E65B386432D}" = Microsoft Office Small Business Connectivity Components
"{AB5D51AE-EBC3-438D-872C-705C7C2084B0}" = DeviceManagementQFolder
"{ABBA2EA4-740E-4052-902B-9CA70B081E3F}" = Embassy Trust Suite - Acer Edition
"{AC76BA86-1033-F400-BA7E-000000000004}" = Adobe Acrobat 9 Standard - English, Franais, Deutsch
"{AC76BA86-1033-F400-BA7E-000000000004}_946" = Adobe Acrobat 9.4.6 - CPSID_83708
"{AC76BA86-1033-F400-BA7E-000000000004}{AC76BA86-1033-F400-BA7E-000000000004}" = Adobe Acrobat 9 Standard - English, Franais, Deutsch
"{AC76BA86-7AD7-1033-7B44-AA1000000001}" = Adobe Reader X (10.1.1)
"{B19F9155-9337-4807-B5EF-ED471DDB2CCE}" = hph_software_req
"{b2ec4a38-b545-4a00-8214-13fe0e915e6d}" = Advertising Center
"{B32C4059-6E7A-41EF-AD20-56DF1872B923}" = Business Contact Manager for Outlook 2007 SP2
"{bd5ca0da-71ad-43da-b19e-6eee0c9adc9a}" = Nero ControlCenter
"{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{cc019e3f-59d2-4486-8d4b-878105b62a71}" = Nero DiscSpeed Help
"{CDDCBBF1-2703-46BC-938B-BCC81A1EEAAA}" = SUPERAntiSpyware
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{CFF4500E-C5D6-695D-A027-B3D4DDED2CC3}" = McAfee Online Backup
"{D1AE6D4D-C37A-487d-83D8-C333125B2459}" = HP Photosmart and Deskjet 7.0 Software
"{D1E829E9-88B8-47C6-A75E-0D40E2C09D50}" = Secure Update
"{D4F2AFD3-0167-4464-B92F-78AB6DA8A0AA}" = CardMinder
"{dba84796-8503-4ff0-af57-1747dd9a166d}" = Nero Online Upgrade
"{DBCDB997-EEEB-4BE9-BAFF-26B4094DBDE6}" = ScanSnap Manager
"{E031338C-839D-4EDD-9537-99B653C39D81}" = Autodesk MapGuide® Viewer ActiveX Control Release 6.5
"{E50AE784-FABE-46DA-A1F8-7B6B56DCB22E}" = Microsoft Office Suite Activation Assistant
"{E58F3B88-3B3E-4F85-9323-04789D979C15}" = ScanSnap Organizer
"{e5c7d048-f9b4-4219-b323-8bdb01a2563d}" = Nero DriveSpeed Help
"{E7084B89-69E0-46B3-A118-8F99D06988CD}" = Microsoft SQL Server VSS Writer
"{E738A392-F690-4A9D-808E-7BAF80E0B398}" = ESC Home Page Plugin
"{e8a80433-302b-4ff1-815d-fcc8eac482ff}" = Nero Installer
"{e93386ed-2c4e-4696-99d4-c696345f8d65}" = Nero 9 Essentials
"{EE171732-BEB4-4576-887D-CB62727F01CA}" = Acer Updater
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{f4041dce-3fe1-4e18-8a9e-9de65231ee36}" = Nero ControlCenter
"{FB400000-0002-0000-0000-074957833700}" = ABBYY FineReader for ScanSnap ™ 4.1
"{fbcdfd61-7dcf-4e71-9226-873ba0053139}" = Nero InfoTool
"Acer Screensaver" = Acer ScreenSaver
"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"AnswerWorks" = AnswerWorks Runtime
"Ashtech Solutions" = Ashtech Solutions
"Buffalo BFRD4G" = Buffalo RAMDISK Utility
"Business Contact Manager" = Business Contact Manager for Outlook 2007 SP2
"Corpscon" = Corpscon 6.0.1
"DWG TrueView 2011" = DWG TrueView 2011
"ESET Online Scanner" = ESET Online Scanner v3
"GOM Player" = GOM Player
"HDMI" = Intel® Graphics Media Accelerator Driver
"HP Imaging Device Functions" = HP Imaging Device Functions 7.0
"Identity Card" = Identity Card
"ie8" = Windows Internet Explorer 8
"InstallShield_{07D618CD-B016-438A-ADC9-A75BD23F85CE}" = Wave Support Software
"InstallShield_{0B0A2153-58A6-4244-B458-25EDF5FCD809}" = Private Information Manager
"InstallShield_{131A2659-99A9-4A89-B012-22A898EAE9DA}" = EMBASSY Security Center Lite
"InstallShield_{15D967B5-A4BE-42AE-9E84-64CD062B25AA}" = eSobi v2
"InstallShield_{2BF2E31F-B8BB-40A7-B650-98D28E0F7D47}" = CyberLink PowerDVD 8
"InstallShield_{30075A70-B5D2-440B-AFA3-FB2021740121}" = Acer Backup Manager
"InstallShield_{51AE9E42-640D-4C14-A9B6-43F64AA4E3E2}" = Document Manager Lite
"InstallShield_{53333479-6A52-4816-8497-5C52B67ED339}" = EMBASSY Security Setup
"InstallShield_{9D9FC46E-5F53-41F5-8730-813583C27429}" = Accusoft Prizm Viewer 9
"InstallShield_{D1E829E9-88B8-47C6-A75E-0D40E2C09D50}" = Secure Update
"InstallShield_{E738A392-F690-4A9D-808E-7BAF80E0B398}" = ESC Home Page Plugin
"Leica SurveyOffice" = Leica Survey Office
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware version 1.51.2.1300
"Microsoft .NET Framework 1.1 (1033)" = Microsoft .NET Framework 1.1
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Microsoft SQL Server 2005" = Microsoft SQL Server 2005
"Mozilla Firefox 8.0 (x86 en-US)" = Mozilla Firefox 8.0 (x86 en-US)
"MSC" = McAfee Total Protection
"MSCompPackV1" = Microsoft Compression Client Pack 1.0 for Windows XP
"PandoraRecovery" = PandoraRecovery (Remove Only)
"PSUTILITY_DEINSTKEY" = PS-Utility
"Rainbow Sentinel Driver" = Sentinel System Driver
"UN060501" = BUFFALO NAS Navigator2
"UN090928" = BUFFALO LinkStation(LX-WXL) Setup Guide
"UN091111" = BUFFALO TurboPC for FLASH/HDD
"UN091114" = BUFFALO TurboCopy
"UN091201" = BUFFALO BuffaloTools Launcher
"UN091222" = BUFFALO Backup Utility
"Windows Media Format Runtime" = Windows Media Format 11 runtime
"Windows Media Player" = Windows Media Player 11
"WinRAR archiver" = WinRAR archiver
"WMFDist11" = Windows Media Format 11 runtime
"wmp11" = Windows Media Player 11
"WordPerfect Office 2002" = WordPerfect Office 2002
"Wudf01000" = Microsoft User-Mode Driver Framework Feature Pack 1.0

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 12/5/2011 3:24:43 PM | Computer Name = ACER-0A04F1A0D2 | Source = crypt32 | ID = 131080
Description = Failed auto update retrieval of third-party root list sequence number
from: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt>
with error: This network connection does not exist.

Error - 12/5/2011 3:24:43 PM | Computer Name = ACER-0A04F1A0D2 | Source = crypt32 | ID = 131080
Description = Failed auto update retrieval of third-party root list sequence number
from: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt>
with error: This network connection does not exist.

Error - 12/5/2011 3:24:44 PM | Computer Name = ACER-0A04F1A0D2 | Source = crypt32 | ID = 131080
Description = Failed auto update retrieval of third-party root list sequence number
from: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt>
with error: This network connection does not exist.

Error - 12/5/2011 3:24:44 PM | Computer Name = ACER-0A04F1A0D2 | Source = crypt32 | ID = 131080
Description = Failed auto update retrieval of third-party root list sequence number
from: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt>
with error: This network connection does not exist.

Error - 12/5/2011 3:24:44 PM | Computer Name = ACER-0A04F1A0D2 | Source = crypt32 | ID = 131080
Description = Failed auto update retrieval of third-party root list sequence number
from: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt>
with error: This network connection does not exist.

Error - 12/5/2011 3:24:44 PM | Computer Name = ACER-0A04F1A0D2 | Source = crypt32 | ID = 131080
Description = Failed auto update retrieval of third-party root list sequence number
from: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt>
with error: This network connection does not exist.

Error - 12/5/2011 5:17:30 PM | Computer Name = ACER-0A04F1A0D2 | Source = Application Error | ID = 1000
Description = Faulting application mcsync.exe, version 11.0.623.0, faulting module
mcsync.exe, version 11.0.623.0, fault address 0x0000d698.

Error - 12/6/2011 12:10:13 AM | Computer Name = ACER-0A04F1A0D2 | Source = Microsoft Fax | ID = 32045
Description = Fax Service failed to initialize because it could not initialize the
TAPI devices. Verify that the fax modem was installed and configured correctly. Win32
error code: -2147483576. This error code indicates the cause of the error.

Error - 12/6/2011 12:14:16 AM | Computer Name = ACER-0A04F1A0D2 | Source = Microsoft Fax | ID = 32045
Description = Fax Service failed to initialize because it could not initialize the
TAPI devices. Verify that the fax modem was installed and configured correctly. Win32
error code: -2147483576. This error code indicates the cause of the error.

Error - 12/7/2011 8:36:04 AM | Computer Name = ACER-0A04F1A0D2 | Source = Application Error | ID = 1000
Description = Faulting application iexplore.exe, version 0.0.0.0, faulting module
iexplore.exe, version 0.0.0.0, fault address 0x0008cb40.

[ Application Events ]
Error - 12/5/2011 3:24:43 PM | Computer Name = ACER-0A04F1A0D2 | Source = crypt32 | ID = 131080
Description = Failed auto update retrieval of third-party root list sequence number
from: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt>
with error: This network connection does not exist.

Error - 12/5/2011 3:24:43 PM | Computer Name = ACER-0A04F1A0D2 | Source = crypt32 | ID = 131080
Description = Failed auto update retrieval of third-party root list sequence number
from: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt>
with error: This network connection does not exist.

Error - 12/5/2011 3:24:44 PM | Computer Name = ACER-0A04F1A0D2 | Source = crypt32 | ID = 131080
Description = Failed auto update retrieval of third-party root list sequence number
from: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt>
with error: This network connection does not exist.

Error - 12/5/2011 3:24:44 PM | Computer Name = ACER-0A04F1A0D2 | Source = crypt32 | ID = 131080
Description = Failed auto update retrieval of third-party root list sequence number
from: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt>
with error: This network connection does not exist.

Error - 12/5/2011 3:24:44 PM | Computer Name = ACER-0A04F1A0D2 | Source = crypt32 | ID = 131080
Description = Failed auto update retrieval of third-party root list sequence number
from: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt>
with error: This network connection does not exist.

Error - 12/5/2011 3:24:44 PM | Computer Name = ACER-0A04F1A0D2 | Source = crypt32 | ID = 131080
Description = Failed auto update retrieval of third-party root list sequence number
from: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt>
with error: This network connection does not exist.

Error - 12/5/2011 5:17:30 PM | Computer Name = ACER-0A04F1A0D2 | Source = Application Error | ID = 1000
Description = Faulting application mcsync.exe, version 11.0.623.0, faulting module
mcsync.exe, version 11.0.623.0, fault address 0x0000d698.

Error - 12/6/2011 12:10:13 AM | Computer Name = ACER-0A04F1A0D2 | Source = Microsoft Fax | ID = 32045
Description = Fax Service failed to initialize because it could not initialize the
TAPI devices. Verify that the fax modem was installed and configured correctly. Win32
error code: -2147483576. This error code indicates the cause of the error.

Error - 12/6/2011 12:14:16 AM | Computer Name = ACER-0A04F1A0D2 | Source = Microsoft Fax | ID = 32045
Description = Fax Service failed to initialize because it could not initialize the
TAPI devices. Verify that the fax modem was installed and configured correctly. Win32
error code: -2147483576. This error code indicates the cause of the error.

Error - 12/7/2011 8:36:04 AM | Computer Name = ACER-0A04F1A0D2 | Source = Application Error | ID = 1000
Description = Faulting application iexplore.exe, version 0.0.0.0, faulting module
iexplore.exe, version 0.0.0.0, fault address 0x0008cb40.

[ System Events ]
Error - 12/7/2011 9:07:44 AM | Computer Name = ACER-0A04F1A0D2 | Source = DCOM | ID = 10005
Description = DCOM got error "%1084" attempting to start the service netman with
arguments "" in order to run the server: {BA126AE5-2166-11D1-B1D0-00805FC1270E}

Error - 12/7/2011 9:08:28 AM | Computer Name = ACER-0A04F1A0D2 | Source = DCOM | ID = 10005
Description = DCOM got error "%1084" attempting to start the service netman with
arguments "" in order to run the server: {BA126AE5-2166-11D1-B1D0-00805FC1270E}

Error - 12/7/2011 9:10:28 AM | Computer Name = ACER-0A04F1A0D2 | Source = DCOM | ID = 10005
Description = DCOM got error "%1084" attempting to start the service netman with
arguments "" in order to run the server: {BA126AE5-2166-11D1-B1D0-00805FC1270E}

Error - 12/7/2011 9:10:34 AM | Computer Name = ACER-0A04F1A0D2 | Source = DCOM | ID = 10005
Description = DCOM got error "%1084" attempting to start the service netman with
arguments "" in order to run the server: {BA126AE5-2166-11D1-B1D0-00805FC1270E}

Error - 12/7/2011 9:10:34 AM | Computer Name = ACER-0A04F1A0D2 | Source = DCOM | ID = 10005
Description = DCOM got error "%1084" attempting to start the service netman with
arguments "" in order to run the server: {BA126AE5-2166-11D1-B1D0-00805FC1270E}

Error - 12/7/2011 9:31:43 AM | Computer Name = ACER-0A04F1A0D2 | Source = DCOM | ID = 10005
Description = DCOM got error "%1084" attempting to start the service StiSvc with
arguments "" in order to run the server: {A1F4E726-8CF1-11D1-BF92-0060081ED811}

Error - 12/7/2011 9:31:57 AM | Computer Name = ACER-0A04F1A0D2 | Source = DCOM | ID = 10005
Description = DCOM got error "%1084" attempting to start the service StiSvc with
arguments "" in order to run the server: {A1F4E726-8CF1-11D1-BF92-0060081ED811}

Error - 12/7/2011 9:33:19 AM | Computer Name = ACER-0A04F1A0D2 | Source = DCOM | ID = 10005
Description = DCOM got error "%1084" attempting to start the service StiSvc with
arguments "" in order to run the server: {A1F4E726-8CF1-11D1-BF92-0060081ED811}

Error - 12/7/2011 9:37:02 AM | Computer Name = ACER-0A04F1A0D2 | Source = DCOM | ID = 10005
Description = DCOM got error "%1084" attempting to start the service StiSvc with
arguments "" in order to run the server: {A1F4E726-8CF1-11D1-BF92-0060081ED811}

Error - 12/8/2011 8:18:47 AM | Computer Name = ACER-0A04F1A0D2 | Source = DCOM | ID = 10010
Description = The server {4EB61BAC-A3B6-4760-9581-655041EF4D69} did not register
with DCOM within the required timeout.


< End of report >

#6 Elise

Elise

    Bleepin' Blonde


  • Malware Study Hall Admin
  • 61,257 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:Romania
  • Local time:05:06 PM

Posted 08 December 2011 - 08:31 AM

Hi, unfortunately you have a nasty rootkit on your computer. Please read the following information first.

BACKDOOR WARNING
------------------------------
One or more of the identified infections is known to use a backdoor.

This allows hackers to remotely control your computer, steal critical system information and download and execute files.

I would advice you to disconnect this PC from the Internet immediately. If you do any banking or other financial transactions on the PC or if it should contain any other sensitive information, please get to a known clean computer and change all passwords where applicable, and it would be wise to contact those same financial institutions to apprise them of your situation.

Though the infection has been identified and can be killed, because of it's backdoor functionality, your PC is very likely compromised and there is no way to be sure your computer can ever again be trusted. Many experts in the security community believe that once infected with this type of trojan, the best course of action would be a reformat and reinstall of the OS. Please read these for more information:

How Do I Handle Possible Identify Theft, Internet Fraud and CC Fraud?
When Should I Format, How Should I Reinstall

We can still clean this machine but I can't guarantee that it will be 100% secure afterwards. Let me know what you decide to do. If you decide to go through with the cleanup, please proceed with the following steps.


COMBOFIX
---------------
Please download ComboFix from one of these locations:
Bleepingcomputer
ForoSpyware
  • Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. (Click on this link to see a list of programs that should be disabled. The list is not all inclusive.)
  • Double click on Combofix.exe and follow the prompts.
  • As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
  • Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.
**Please note: If the Microsoft Windows Recovery Console is already installed, or if you are running Vista, ComboFix will continue it's malware removal procedures.

Posted Image


Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

Posted Image


Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\Combofix.txt in your next reply.

regards, Elise


"Now faith is the substance of things hoped for, the evidence of things not seen."

 

Follow BleepingComputer on: Facebook | Twitter | Google+ | lockerdome

 

Malware analyst @ Emsisoft


#7 ctsllc

ctsllc
  • Topic Starter

  • Members
  • 68 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:usa
  • Local time:10:06 AM

Posted 08 December 2011 - 12:46 PM

here is the log, couldnt install the console and the error cant find nirkmd kept coming up.


ComboFix 11-12-06.02 - Barrett Vukmer 12/08/2011 10:26:08.1.2 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.2.1033.18.2038.1418 [GMT -5:00]
Running from: c:\documents and settings\Barrett Vukmer\Desktop\ComboFix.exe
AV: McAfee Anti-Virus and Anti-Spyware *Enabled/Updated* {84B5EE75-6421-4CDE-A33A-DD43BA9FAD83}
FW: McAfee Firewall *Enabled* {94894B63-8C7F-4050-BDA4-813CA00DA3E8}
* Resident AV is active
.
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\documents and settings\All Users\Application Data\TEMP
c:\documents and settings\All Users\Application Data\TEMP\{22249312-26C2-492E-B0B5-E73EFF2939D8}\PostBuild.exe
c:\documents and settings\All Users\Application Data\TEMP\{2BF2E31F-B8BB-40A7-B650-98D28E0F7D47}\PostBuild.exe
c:\documents and settings\Barrett Vukmer\Application Data\PriceGong
c:\documents and settings\Barrett Vukmer\Application Data\PriceGong\Data\1.xml
c:\documents and settings\Barrett Vukmer\Application Data\PriceGong\Data\a.xml
c:\documents and settings\Barrett Vukmer\Application Data\PriceGong\Data\b.xml
c:\documents and settings\Barrett Vukmer\Application Data\PriceGong\Data\c.xml
c:\documents and settings\Barrett Vukmer\Application Data\PriceGong\Data\d.xml
c:\documents and settings\Barrett Vukmer\Application Data\PriceGong\Data\e.xml
c:\documents and settings\Barrett Vukmer\Application Data\PriceGong\Data\f.xml
c:\documents and settings\Barrett Vukmer\Application Data\PriceGong\Data\g.xml
c:\documents and settings\Barrett Vukmer\Application Data\PriceGong\Data\h.xml
c:\documents and settings\Barrett Vukmer\Application Data\PriceGong\Data\i.xml
c:\documents and settings\Barrett Vukmer\Application Data\PriceGong\Data\J.xml
c:\documents and settings\Barrett Vukmer\Application Data\PriceGong\Data\k.xml
c:\documents and settings\Barrett Vukmer\Application Data\PriceGong\Data\l.xml
c:\documents and settings\Barrett Vukmer\Application Data\PriceGong\Data\m.xml
c:\documents and settings\Barrett Vukmer\Application Data\PriceGong\Data\mru.xml
c:\documents and settings\Barrett Vukmer\Application Data\PriceGong\Data\n.xml
c:\documents and settings\Barrett Vukmer\Application Data\PriceGong\Data\o.xml
c:\documents and settings\Barrett Vukmer\Application Data\PriceGong\Data\p.xml
c:\documents and settings\Barrett Vukmer\Application Data\PriceGong\Data\q.xml
c:\documents and settings\Barrett Vukmer\Application Data\PriceGong\Data\r.xml
c:\documents and settings\Barrett Vukmer\Application Data\PriceGong\Data\s.xml
c:\documents and settings\Barrett Vukmer\Application Data\PriceGong\Data\t.xml
c:\documents and settings\Barrett Vukmer\Application Data\PriceGong\Data\u.xml
c:\documents and settings\Barrett Vukmer\Application Data\PriceGong\Data\v.xml
c:\documents and settings\Barrett Vukmer\Application Data\PriceGong\Data\w.xml
c:\documents and settings\Barrett Vukmer\Application Data\PriceGong\Data\x.xml
c:\documents and settings\Barrett Vukmer\Application Data\PriceGong\Data\y.xml
c:\documents and settings\Barrett Vukmer\Application Data\PriceGong\Data\z.xml
c:\documents and settings\Barrett Vukmer\Application Data\Toolbar4
c:\documents and settings\Barrett Vukmer\WINDOWS
c:\windows\$NtUninstallKB2877$
c:\windows\$NtUninstallKB2877$\2695343002\@
c:\windows\$NtUninstallKB2877$\2695343002\bckfg.tmp
c:\windows\$NtUninstallKB2877$\2695343002\cfg.ini
c:\windows\$NtUninstallKB2877$\2695343002\Desktop.ini
c:\windows\$NtUninstallKB2877$\2695343002\kwrd.dll
c:\windows\$NtUninstallKB2877$\2695343002\L\metoieaq
c:\windows\$NtUninstallKB2877$\2695343002\U\00000001.@
c:\windows\$NtUninstallKB2877$\2695343002\U\00000002.@
c:\windows\$NtUninstallKB2877$\2695343002\U\00000004.@
c:\windows\$NtUninstallKB2877$\2695343002\U\80000000.@
c:\windows\$NtUninstallKB2877$\2695343002\U\80000004.@
c:\windows\$NtUninstallKB2877$\2695343002\U\80000032.@
c:\windows\$NtUninstallKB2877$\4173725208
c:\windows\CSC\d6
F:\Autorun.inf
.
.
((((((((((((((((((((((((( Files Created from 2011-11-08 to 2011-12-08 )))))))))))))))))))))))))))))))
.
.
2011-12-05 19:28 . 2011-12-05 19:28 94896 ----a-w- c:\windows\system32\drivers\62579830.sys
2011-12-05 19:21 . 2011-12-05 19:21 -------- d-----w- c:\documents and settings\All Users\Application Data\!SASCORE
2011-12-05 18:40 . 2011-12-05 18:40 -------- d-----w- c:\documents and settings\Administrator\Local Settings\Application Data\Temp
2011-12-05 18:12 . 2011-12-05 18:12 -------- d-----w- c:\documents and settings\Administrator\Application Data\Zeon
2011-12-04 18:32 . 2011-12-06 18:36 -------- d-----w- C:\bd_logs
2011-12-04 18:10 . 2011-12-04 18:10 -------- d-----w- C:\New Folder
2011-11-28 20:02 . 2011-11-28 20:02 -------- d--h--w- c:\documents and settings\Administrator\Application Data\SUPERAntiSpyware.com
2011-11-28 20:02 . 2011-11-28 20:02 -------- d--h--w- c:\documents and settings\Administrator\Application Data\Malwarebytes
2011-11-28 19:45 . 2011-11-28 19:45 -------- d--h--w- c:\windows\system32\wbem\Repository
2011-11-11 12:59 . 2011-11-11 12:59 -------- d--h--w- c:\documents and settings\Barrett Vukmer\Application Data\GRETECH
2011-11-10 20:08 . 2011-11-10 20:08 -------- d--h--w- c:\documents and settings\Barrett Vukmer\Local Settings\Application Data\MPlayer
2011-11-10 20:07 . 2011-11-10 20:11 -------- d-----w- c:\program files\UMPlayer
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-12-02 14:47 . 2010-06-08 19:31 0 ---ha-w- c:\documents and settings\Barrett Vukmer\Local Settings\Application Data\WavXMapDrive.bat
2011-11-21 18:28 . 2011-05-21 13:59 414368 ---ha-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2011-11-16 12:50 . 2011-12-05 21:36 1545858 ---ha-w- C:\tdsskiller.zip
2011-10-15 18:16 . 2010-06-08 20:29 9608 ---ha-w- c:\windows\system32\drivers\mfeclnk.sys
2011-10-15 18:16 . 2010-06-08 20:29 89792 ---ha-w- c:\windows\system32\drivers\mfetdi2k.sys
2011-10-15 18:16 . 2010-06-08 20:29 87656 ---ha-w- c:\windows\system32\drivers\mferkdet.sys
2011-10-15 18:16 . 2010-06-08 20:29 83856 ---ha-w- c:\windows\system32\drivers\mfendisk.sys
2011-10-15 18:16 . 2010-06-08 20:29 59456 ---ha-w- c:\windows\system32\drivers\mfebopk.sys
2011-10-15 18:16 . 2010-06-08 20:29 57600 ---ha-w- c:\windows\system32\drivers\cfwids.sys
2011-10-15 18:16 . 2010-06-08 20:29 338176 ---ha-w- c:\windows\system32\drivers\mfefirek.sys
2011-10-15 18:16 . 2010-06-08 20:29 180816 ---ha-w- c:\windows\system32\drivers\mfeavfk.sys
2011-10-15 18:16 . 2010-04-14 16:50 121256 ---ha-w- c:\windows\system32\drivers\mfeapfk.sys
2011-10-15 18:16 . 2009-10-12 11:13 464176 ---ha-w- c:\windows\system32\drivers\mfehidk.sys
2011-10-10 14:22 . 2009-10-12 09:50 692736 ---ha-w- c:\windows\system32\inetcomm.dll
2011-09-28 07:06 . 2009-10-12 13:37 599040 ---ha-w- c:\windows\system32\crypt32.dll
2011-09-26 15:41 . 2009-10-12 13:37 220160 ---ha-w- c:\windows\system32\oleacc.dll
2011-09-26 15:41 . 2008-07-29 23:59 611328 ---ha-w- c:\windows\system32\uiautomationcore.dll
2011-09-26 15:41 . 2009-10-12 13:37 20480 ---ha-w- c:\windows\system32\oleaccrc.dll
2011-11-08 17:26 . 2011-05-06 19:49 134104 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll
2011-04-14 18:01 . 2010-06-09 18:24 24376 ----a-w- c:\program files\mozilla firefox\components\Scriptff.dll
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\MOBK]
@="{3c3f3c1a-9153-7c05-f938-622e7003894d}"
[HKEY_CLASSES_ROOT\CLSID\{3c3f3c1a-9153-7c05-f938-622e7003894d}]
2010-04-14 00:11 2872120 ----a-w- c:\program files\McAfee Online Backup\MOBKshell.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\MOBK2]
@="{e6ea1d7d-144e-b977-98c4-84c53c1a69d0}"
[HKEY_CLASSES_ROOT\CLSID\{e6ea1d7d-144e-b977-98c4-84c53c1a69d0}]
2010-04-14 00:11 2872120 ----a-w- c:\program files\McAfee Online Backup\MOBKshell.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\MOBK3]
@="{b4caf489-1eec-c617-49ad-8d7088598c06}"
[HKEY_CLASSES_ROOT\CLSID\{b4caf489-1eec-c617-49ad-8d7088598c06}]
2010-04-14 00:11 2872120 ----a-w- c:\program files\McAfee Online Backup\MOBKshell.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SUPERAntiSpyware"="c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2011-03-16 2423752]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"BackupManagerTray"="c:\program files\NewTech Infosystems\Acer Backup Manager\BackupManagerTray.exe" [2009-08-12 261888]
"NotificationCenterLauncher"="c:\program files\Acer\Acer eRecovery Management\NotificationLauncher.exe" [2009-06-04 225280]
"IMJPMIG8.1"="c:\windows\IME\imjp8_1\IMJPMIG.EXE" [2008-04-14 208952]
"MSPY2002"="c:\windows\system32\IME\PINTLGNT\ImScInst.exe" [2008-04-14 59392]
"PHIME2002ASync"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2008-04-14 455168]
"PHIME2002A"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2008-04-14 455168]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2008-02-28 141848]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2008-02-28 166424]
"Persistence"="c:\windows\system32\igfxpers.exe" [2008-02-28 137752]
"RTHDCPL"="RTHDCPL.EXE" [2007-07-01 16377344]
"WavXMgr"="c:\program files\Wave Systems Corp\Services Manager\Docmgr\bin\WavXDocMgr.exe" [2009-07-27 145920]
"SecureUpgrade"="c:\program files\Wave Systems Corp\SecureUpgrade.exe" [2009-07-27 656696]
"RemoteControl8"="c:\program files\CyberLink\PowerDVD8\PDVD8Serv.exe" [2009-04-16 91432]
"PDVD8LanguageShortcut"="c:\program files\CyberLink\PowerDVD8\Language\Language.exe" [2009-04-16 50472]
"mcui_exe"="c:\program files\McAfee.com\Agent\mcagent.exe" [2011-09-16 1318552]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2011-03-30 937920]
"PDFHook"="c:\program files\Nuance\PDF Create! 5\pdfcreate5hook.exe" [2008-02-02 791840]
"PDF5 Registry Controller"="c:\program files\Nuance\PDF Create! 5\RegistryController.exe" [2008-02-02 58656]
"SSBkgdUpdate"="c:\program files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" [2007-03-26 210472]
"ISUSPM Startup"="c:\progra~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2005-02-16 221184]
"ISUSScheduler"="c:\program files\Common Files\InstallShield\UpdateService\issch.exe" [2005-02-16 81920]
"Nuance PDF Create! 5-reminder"="c:\program files\Nuance\PDF Create! 5\Ereg\Ereg.exe" [2007-08-31 328992]
"Adobe Acrobat Speed Launcher"="c:\program files\Adobe\Acrobat 9.0\Acrobat\Acrobat_sl.exe" [2011-09-07 40376]
"Acrobat Assistant 8.0"="c:\program files\Adobe\Acrobat 9.0\Acrobat\Acrotray.exe" [2010-09-22 640440]
"Intuit SyncManager"="c:\program files\Common Files\Intuit\Sync\IntuitSyncManager.exe" [2011-09-30 2215768]
"BuffaloTools"="c:\program files\BUFFALO\BuffaloTools\BuffaloTools.exe" [2010-10-19 169336]
"Backup Utility TaskTray Tool"="c:\program files\BUFFALO\Backup_Utility\BUTray.exe" [2010-12-06 1828216]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2011-04-08 254696]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
.
c:\documents and settings\Barrett Vukmer\Start Menu\Programs\Startup\
BUFFALO NAS Navigator2.lnk - c:\program files\BUFFALO\NASNAVI\NasNavi.exe [2011-1-26 1897952]
NAS Scheduler.lnk - c:\program files\BUFFALO\NASNAVI\nassche.exe [2011-1-26 206128]
.
c:\documents and settings\All Users\Start Menu\Programs\Startup\
BUFFALO RAMDISK Tray Utility.lnk - c:\program files\BUFFALO\BFRD4G\BRDUtilTray.exe [2011-8-27 1766776]
BUFFALO RAMDISK Utility.lnk - c:\program files\BUFFALO\BFRD4G\BRDUtil.exe [2011-8-27 1284984]
CardMinder Viewer.lnk - c:\program files\PFU\ScanSnap\CardMinder\CardLauncher.exe [2011-2-5 77824]
Conversion to PDF with ScanSnap Organizer.lnk - c:\program files\PFU\ScanSnap\Organizer\PfuSsOrgOcrChk.exe [2011-2-5 15360]
Intuit Data Protect.lnk - c:\program files\Common Files\Intuit\DataProtect\IntuitDataProtect.exe [2011-11-9 5889880]
Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2001-2-13 83360]
QuickBooks Update Agent.lnk - c:\program files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe [2011-11-9 1156968]
QuickBooks_Standard_21.lnk - c:\program files\Intuit\QuickBooks 2008\QBW32.EXE [2011-11-9 1178984]
ScanSnap Manager.lnk - c:\program files\PFU\ScanSnap\Driver\PfuSsMon.exe [2011-2-5 1146880]
.
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2009-09-03 22:21 548352 ----a-w- c:\program files\SUPERAntiSpyware\SASWINLO.DLL
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Authentication Packages REG_MULTI_SZ msv1_0 wvauth
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\!SASCORE]
@=""
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcmscsvc]
@=""
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]
@=""
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
"FirewallOverride"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiVirus]
"DisableMonitoring"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeFirewall]
"DisableMonitoring"=dword:00000001
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
"DisableNotifications"= 1 (0x1)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\CyberLink\\PowerDVD8\\PowerDVD8.exe"=
"c:\\Program Files\\Common Files\\SafeNet Sentinel\\Sentinel Protection Server\\WinNT\\spnsrvnt.exe"=
"c:\\Program Files\\TRENDnet\\PS Utility\\PSUTILITY.EXE"=
"c:\\Program Files\\Google\\Google Earth\\plugin\\geplugin.exe"=
"c:\\Program Files\\Intuit\\QuickBooks 2008\\QBDBMgrN.exe"=
"c:\\Program Files\\BUFFALO\\NASNAVI\\NasNavi.exe"=
"c:\\Program Files\\Common Files\\McAfee\\McSvcHost\\McSvHost.exe"=
.
R0 BFRD4G;BUFFALO RAM Disk Driver;c:\windows\system32\drivers\BFRD4G.sys [12/1/2010 6:16 AM 36344]
R0 bftpdskc;BUFFALO TurboPC Cache Filter;c:\windows\system32\drivers\bftpdskc.sys [8/27/2011 10:52 AM 41472]
R1 mfetdi2k;McAfee Inc. mfetdi2k;c:\windows\system32\drivers\mfetdi2k.sys [6/8/2010 3:29 PM 89792]
R1 MOBKFilter;MOBKFilter;c:\windows\system32\drivers\MOBK.sys [6/8/2010 3:30 PM 54776]
R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [2/17/2010 1:25 PM 12872]
R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [5/10/2010 1:41 PM 67656]
R2 !SASCORE;SAS Core Service;c:\program files\SUPERAntiSpyware\SASCore.exe [6/29/2010 12:48 PM 114416]
R2 BFBackupUtilityService;Backup Utility Service;c:\program files\BUFFALO\Backup_Utility\BUService.exe -Service_Execute --> c:\program files\BUFFALO\Backup_Utility\BUService.exe -Service_Execute [?]
R2 BFBackupUtilityVSSService;Backup Utility VSS Service for Windows XP;c:\program files\BUFFALO\Backup_Utility\BUVSSServiceXP.exe -Service_Execute --> c:\program files\BUFFALO\Backup_Utility\BUVSSServiceXP.exe -Service_Execute [?]
R2 McAfee SiteAdvisor Service;McAfee SiteAdvisor Service;"c:\program files\Common Files\Mcafee\McSvcHost\McSvHost.exe" /McCoreSvc [6/8/2010 3:28 PM 214904]
R2 McMPFSvc;McAfee Personal Firewall Service;"c:\program files\Common Files\Mcafee\McSvcHost\McSvHost.exe" /McCoreSvc [6/8/2010 3:28 PM 214904]
R2 McNaiAnn;McAfee VirusScan Announcer;"c:\program files\Common Files\McAfee\McSvcHost\McSvHost.exe" /McCoreSvc [6/8/2010 3:28 PM 214904]
R2 mfefire;McAfee Firewall Core Service;c:\program files\Common Files\McAfee\SystemCore\mfefire.exe [6/8/2010 3:29 PM 160608]
R2 mfevtp;McAfee Validation Trust Protection Service;c:\program files\Common Files\McAfee\SystemCore\mfevtps.exe [6/8/2010 3:29 PM 150856]
R2 MOBKbackup;McAfee Online Backup;c:\program files\McAfee Online Backup\MOBKbackup.exe [4/13/2010 7:11 PM 229688]
R2 NasPmService;NAS PM Service;c:\program files\BUFFALO\NASNAVI\nassvc.exe -Service_Execute -dcyc=60 -dto=3 -dluc=0 -dmin=1 -dmax=60 -dflc=0 -apc=0 -log=0 -pm=1 -pall=1 -phttp=0 -pbc=0 -ppro=0 -pcyc=0 -pmin=1 -pmax=60 -pflc=0 --> c:\program files\BUFFALO\NASNAVI\nassvc.exe -Service_Execute -dcyc=60 -dto=3 -dluc=0 -dmin=1 -dmax=60 -dflc=0 -apc=0 -log=0 -pm=1 -pall=1 -phttp=0 -pbc=0 -ppro=0 -pcyc=0 -pmin=1 -pmax=60 -pflc=0 [?]
R2 NTI IScheduleSvc;NTI IScheduleSvc;c:\program files\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe [8/12/2009 2:04 PM 62208]
R2 QBVSS;QBIDPService;c:\program files\Common Files\Intuit\DataProtect\QBIDPService.exe [6/30/2011 12:25 PM 1248256]
R2 Updater Service;Updater Service;c:\program files\Acer\Acer Updater\UpdaterService.exe [10/12/2009 6:05 AM 240160]
R3 bftpusbx;BUFFALO TurboPC USB Filter;c:\windows\system32\drivers\bftpusbx.sys [8/27/2011 10:52 AM 11776]
R3 cfwids;McAfee Inc. cfwids;c:\windows\system32\drivers\cfwids.sys [6/8/2010 3:29 PM 57600]
R3 mfefirek;McAfee Inc. mfefirek;c:\windows\system32\drivers\mfefirek.sys [6/8/2010 3:29 PM 338176]
R3 mfendiskmp;mfendiskmp;c:\windows\system32\drivers\mfendisk.sys [6/8/2010 3:29 PM 83856]
S2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [6/8/2010 2:29 PM 136176]
S3 12721527;12721527; [x]
S3 gupdatem;Google Update Service (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [6/8/2010 2:29 PM 136176]
S3 MBAMSwissArmy;MBAMSwissArmy;\??\c:\windows\system32\drivers\mbamswissarmy.sys --> c:\windows\system32\drivers\mbamswissarmy.sys [?]
S3 mfendisk;McAfee Core NDIS Intermediate Filter;c:\windows\system32\drivers\mfendisk.sys [6/8/2010 3:29 PM 83856]
S3 mferkdet;McAfee Inc. mferkdet;c:\windows\system32\drivers\mferkdet.sys [6/8/2010 3:29 PM 87656]
.
--- Other Services/Drivers In Memory ---
.
*Deregistered* - mfeavfk01
.
Contents of the 'Scheduled Tasks' folder
.
2011-11-29 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 17:34]
.
2011-12-08 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-06-08 19:29]
.
2011-12-08 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-06-08 19:29]
.
2011-12-08 c:\windows\Tasks\WGASetup.job
- c:\windows\system32\KB905474\wgasetup.exe [2010-06-08 02:18]
.
.
------- Supplementary Scan -------
.
mStart Page = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=1009&m=veriton_m265&r=0xpp06104906p04e5u265z45915277
IE: Append Link Target to Existing PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: Append the content of the link to existing PDF file - c:\program files\Nuance\PDF Create! 5\bin\ZeonIEFavClient.dll/ZeonIEAppend.HTML
IE: Append the content of the selected links to existing PDF file - c:\program files\Nuance\PDF Create! 5\bin\ZeonIEFavClient.dll/ZeonIEAppendSelLinks.HTML
IE: Append to Existing PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html
IE: Append to existing PDF file - c:\program files\Nuance\PDF Create! 5\bin\ZeonIEFavClient.dll/ZeonIEAppend.HTML
IE: Convert Link Target to Adobe PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
IE: Convert to Adobe PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECapture.html
IE: Create PDF file - c:\program files\Nuance\PDF Create! 5\bin\ZeonIEFavClient.dll/ZeonIECapture.HTML
IE: Create PDF file from the content of the link - c:\program files\Nuance\PDF Create! 5\bin\ZeonIEFavClient.dll/ZeonIECapture.HTML
IE: Create PDF files from the selected links - c:\program files\Nuance\PDF Create! 5\bin\ZeonIEFavClient.dll/ZeonIECaptureSelLinks.HTML
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
FF - ProfilePath - c:\documents and settings\Barrett Vukmer\Application Data\Mozilla\Firefox\Profiles\ni4w2sc4.default\
FF - prefs.js: browser.search.selectedEngine - Secure Search
FF - prefs.js: browser.startup.homepage - www.msn.com
FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?fr=mcafee&p=
FF - user.js: network.cookie.cookieBehavior - 0
FF - user.js: privacy.clearOnShutdown.cookies - false
FF - user.js: security.warn_viewing_mixed - false
FF - user.js: security.warn_viewing_mixed.show_once - false
FF - user.js: security.warn_submit_insecure - false
FF - user.js: security.warn_submit_insecure.show_once - false
FF - user.js: yahoo.ytff.general.dontshowhpoffer - true
.
.
------- File Associations -------
.
.scr=DWGTrueViewScriptFile
.
- - - - ORPHANS REMOVED - - - -
.
WebBrowser-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file)
HKLM-Run-QtTaQTQPPkVP.exe - c:\documents and settings\All Users\Application Data\QtTaQTQPPkVP.exe
SafeBoot-49438161.sys
AddRemove-Rainbow Sentinel Driver - c:\windows\SYSTEM32\RNBOSENT\SETUPX86.EXE
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-12-08 11:42
Windows 5.1.2600 Service Pack 3 NTFS
.
scanning hidden processes ...
.
scanning hidden autostart entries ...
.
scanning hidden files ...
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------
.
- - - - - - - > 'winlogon.exe'(1104)
c:\program files\SUPERAntiSpyware\SASWINLO.DLL
c:\windows\system32\WININET.dll
.
- - - - - - - > 'lsass.exe'(1160)
c:\windows\system32\wvauth.dll
c:\windows\system32\WININET.dll
.
- - - - - - - > 'explorer.exe'(1360)
c:\windows\system32\WININET.dll
c:\progra~1\mcafee\SITEAD~1\saHook.dll
c:\windows\system32\AcSignIcon.dll
c:\program files\McAfee Online Backup\MOBKshell.dll
c:\program files\Common Files\Autodesk Shared\AcSignCore16.dll
c:\windows\system32\ieframe.dll
c:\program files\BUFFALO\BuffaloTools\BuffaloTools.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
c:\windows\system32\msi.dll
.
------------------------ Other Running Processes ------------------------
.
c:\program files\Microsoft Small Business\Business Contact Manager\BcmSqlStartupSvc.exe
c:\program files\BUFFALO\Backup_Utility\BUService.exe
c:\program files\BUFFALO\Backup_Utility\BUVSSServiceXP.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
c:\program files\BUFFALO\NASNAVI\nassvc.exe
c:\program files\Common Files\Nero\Nero BackItUp 4\NBService.exe
c:\windows\system32\HPZipm12.exe
c:\program files\Common Files\Intuit\QuickBooks\QBCFMonitorService.exe
c:\program files\Common Files\SafeNet Sentinel\Sentinel Protection Server\WinNT\spnsrvnt.exe
c:\program files\Microsoft SQL Server\90\Shared\sqlbrowser.exe
c:\program files\Microsoft SQL Server\90\Shared\sqlwriter.exe
c:\program files\Common Files\McAfee\SystemCore\mcshield.exe
c:\windows\system32\rundll32.exe
c:\windows\System32\vssvc.exe
c:\windows\system32\igfxsrvc.exe
c:\windows\RTHDCPL.EXE
.
**************************************************************************
.
Completion time: 2011-12-08 11:50:03 - machine was rebooted
ComboFix-quarantined-files.txt 2011-12-08 16:50
.
Pre-Run: 27,560,382,464 bytes free
Post-Run: 28,510,896,128 bytes free
.
- - End Of File - - 3B1473C097909113E859C6E1C85B81E2

#8 Elise

Elise

    Bleepin' Blonde


  • Malware Study Hall Admin
  • 61,257 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:Romania
  • Local time:05:06 PM

Posted 08 December 2011 - 01:12 PM

Hi, how are things running at this point? Is your internet working?

regards, Elise


"Now faith is the substance of things hoped for, the evidence of things not seen."

 

Follow BleepingComputer on: Facebook | Twitter | Google+ | lockerdome

 

Malware analyst @ Emsisoft


#9 ctsllc

ctsllc
  • Topic Starter

  • Members
  • 68 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:usa
  • Local time:10:06 AM

Posted 08 December 2011 - 01:26 PM

still pretty screwed up, some of the file associations are broke and a lot of the program icons are gone. I guess i just want to make it relatively safe and get some data off then I will wipe clean and reinstall. would you use the computer live online without wiping the drive?
oh ya the internet is working now

#10 Elise

Elise

    Bleepin' Blonde


  • Malware Study Hall Admin
  • 61,257 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:Romania
  • Local time:05:06 PM

Posted 08 December 2011 - 01:48 PM

What file associations are broken?

We need to scan the system with this special tool:

* Please download and save:

Junction.zip

* Unzip it and place Junction.exe in the Windows directory (C:\Windows).
* Go to Start => Run... => Copy and paste the following command in the Run box and click OK:

cmd /c junction -s c:\ >log.txt&log.txt& del log.txt

A command window opens starting to scan the system. Wait until a log file opens. Copy and paste the log in your next reply.

regards, Elise


"Now faith is the substance of things hoped for, the evidence of things not seen."

 

Follow BleepingComputer on: Facebook | Twitter | Google+ | lockerdome

 

Malware analyst @ Emsisoft


#11 ctsllc

ctsllc
  • Topic Starter

  • Members
  • 68 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:usa
  • Local time:10:06 AM

Posted 08 December 2011 - 01:53 PM

OK Elsie it wont run window comes up with th eula and when you clik ok everything closes. When you open a folder the searcj box comes up instead of opening the folder

#12 Elise

Elise

    Bleepin' Blonde


  • Malware Study Hall Admin
  • 61,257 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:Romania
  • Local time:05:06 PM

Posted 08 December 2011 - 01:56 PM

Did you put junction.exe in the windows folder (do NOT double click on it, but execute the command as explained!).

regards, Elise


"Now faith is the substance of things hoped for, the evidence of things not seen."

 

Follow BleepingComputer on: Facebook | Twitter | Google+ | lockerdome

 

Malware analyst @ Emsisoft


#13 ctsllc

ctsllc
  • Topic Starter

  • Members
  • 68 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:usa
  • Local time:10:06 AM

Posted 08 December 2011 - 01:59 PM

sorry i read through too fast, i am executing as insgtructed now. sorry:(

#14 ctsllc

ctsllc
  • Topic Starter

  • Members
  • 68 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:usa
  • Local time:10:06 AM

Posted 08 December 2011 - 02:01 PM

Junction v1.06 - Windows junction creator and reparse point viewer
Copyright © 2000-2010 Mark Russinovich
Sysinternals - www.sysinternals.com


Failed to open \\?\c:\\hiberfil.sys: The process cannot access the file because it is being used by another process.



Failed to open \\?\c:\\pagefile.sys: The process cannot access the file because it is being used by another process.


...

...

...

...

...

...

...

...

...

...

...

...

...

...

...

...

...

...

...

...

...

...

...

...

...

...

...

...

...

...

...

...

...

...

...

...

...

...

...

...

...

...

...

...

...

...

...

..
Failed to open \\?\c:\\Qoobox\BackEnv: Access is denied.


.

...

...

...

...

...

...\\?\c:\\WINDOWS\assembly\GAC_32\System.EnterpriseServices\2.0.0.0__b03f5f7f11d50a3a: JUNCTION
Print Name : C:\WINDOWS\WinSxS\x86_System.EnterpriseServices_b03f5f7f11d50a3a_2.0.0.0_x-ww_7d5f3790
Substitute Name: C:\WINDOWS\WinSxS\x86_System.EnterpriseServices_b03f5f7f11d50a3a_2.0.0.0_x-ww_7d5f3790



\\?\c:\\WINDOWS\assembly\GAC_MSIL\IEExecRemote\2.0.0.0__b03f5f7f11d50a3a: JUNCTION
Print Name : C:\WINDOWS\WinSxS\MSIL_IEExecRemote_b03f5f7f11d50a3a_2.0.0.0_x-ww_6e57c34e
Substitute Name: C:\WINDOWS\WinSxS\MSIL_IEExecRemote_b03f5f7f11d50a3a_2.0.0.0_x-ww_6e57c34e

\\?\c:\\WINDOWS\assembly\GAC_MSIL\Intuit.QuickBooks.FCS\1.3.0.0__5b3f47ba29970ccb: JUNCTION
Print Name : C:\WINDOWS\WinSxS\MSIL_Intuit.QuickBooks.FCS_5b3f47ba29970ccb_1.3.0.0_x-ww_d936dcb9
Substitute Name: C:\WINDOWS\WinSxS\MSIL_Intuit.QuickBooks.FCS_5b3f47ba29970ccb_1.3.0.0_x-ww_d936dcb9

...

...

...

...

...

...

...

...

...

...

#15 Elise

Elise

    Bleepin' Blonde


  • Malware Study Hall Admin
  • 61,257 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:Romania
  • Local time:05:06 PM

Posted 08 December 2011 - 02:32 PM

That looks good.
Can you give me an example of a folder you try to open, which opens instead the search function?

regards, Elise


"Now faith is the substance of things hoped for, the evidence of things not seen."

 

Follow BleepingComputer on: Facebook | Twitter | Google+ | lockerdome

 

Malware analyst @ Emsisoft





0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users