Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Windows 7 won't boot after using TDSSkiller


  • This topic is locked This topic is locked
15 replies to this topic

#1 PokerHandfull

PokerHandfull

  • Members
  • 7 posts
  • OFFLINE
  •  
  • Local time:05:06 AM

Posted 21 February 2012 - 12:36 PM

Hello everyone. While trying to fix a problem I had with some sort of spyware that was giving me a fake google and ad redirects, I used TDSSKiller as directed by another website. Upon restart I cannot get Windows 7 64bit to load. All I have is a black screen with a blinking cursor.

Here are some things to know about my problem and what I have tried.

I cannot access safe mode or any other Windows utilities at all, pressing F8 does not bring up anything but a quick boot menu.

I do NOT have a Windows CD, so I have not been able to try boot from a disk.

I do NOT have a BSOD anywhere.

The only thing I can do is press Ctrl Alt Del, which restarts my computer.


What can I do at this point? I appreciate any help anyone can give me. Thanks much!

BC AdBot (Login to Remove)

 


#2 rotor123

rotor123

  • Moderator
  • 8,093 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:New Jersey
  • Local time:06:06 AM

Posted 21 February 2012 - 06:18 PM

Hi, I have referred you to a specialist that deals with these type of problems. Please be patient.

Good Luck
Roger

Fortune Cookie says: Fortune not Found: Abort, Retry, Ignore?

Sent from my All-In-One Desktop. Perfect for Internet, Not for heavy usage or gaming however.

How Does a computer get Infected? http://www.bleepingcomputer.com/forums/t/2520/how-did-i-get-infected/
Forum Rules,    The BC Welcome Guide

167 @ June 2015


#3 JSntgRvr

JSntgRvr

    Master Surgeon General


  • Malware Response Team
  • 11,762 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Puerto Rico
  • Local time:06:06 AM

Posted 21 February 2012 - 08:14 PM

:welcome:

We will need to view the system status from an external environment. You will need a USB drive and a CD to burn. There will be several steps to follow.

Download GETxPUD.exe to the desktop of your clean computer
  • Run GETxPUD.exe
  • A new folder will appear on the desktop.
  • Open the GETxPUD folder and click on the get&burn.bat
  • The program will download xpud_0.9.2.iso, and upon finished will open BurnCDCC ready to burn the image.
  • Click on Start and follow the prompts to burn the image to a CD.
  • Next download driver.sh by noahdfear to your USB drive
  • Also Download Query.exe by noahdfear to the USB drive. In your working computer, navigate to the USB drive and click on the Query.exe. A folder and a file, query.sh, will be extracted.
  • Once this process is completed, download Dumpit by noahdfear to the USB drive.
  • Remove the USB & CD and insert them in the sick computer
  • Boot the Sick computer with the CD you just burned
  • The computer must be set to boot from the CD
  • In some computers you need to tap F12 and choose to boot from the CD, in others is the Esc key. Please consult your computer's documentation.
  • Follow the prompts
  • A Welcome to xPUD screen will appear
  • Press File
  • Expand mnt
  • sda1,2...usually corresponds to your HDD
  • sdb1 is likely your USB
  • Click on the folder that represents your USB drive (sdb1 ?)
  • Confirm that you see driver.sh that you downloaded there
  • Press Tool at the top
  • Choose Open Terminal
  • Type bash driver.sh
  • Press Enter
  • After it has finished a report will be located on your USB drive named report.txt
  • Then type bash driver.sh -af
  • Press Enter
  • You will be prompted to input a filename.
  • Type the following:

    Winlogon.exe

  • Press Enter
  • If successful, the script will search for this file.
  • After it has completed the search enter the next file to be searched
  • Type the following:

    volsnap.sys

  • Press Enter
  • If successful, the script will search for this file.
  • After it has completed the search enter the next file to be searched
  • Type the following:

    explorer.exe

  • Press Enter
  • After it has completed the search enter the next file to be searched
  • Type the following:

    Userinit.exe

  • Press Enter
  • After the search is completed type Exit and press Enter.
  • After it has finished a report will be located in the USB drive as filefind.txt
  • While still in the Open Terminal, type bash query.sh
  • Press Enter
  • After it has finished a report will be located in the USB drive as RegReport.txt
  • Confirm that you see the file dumpit in your USB drive and double click on it.
  • After it has finished a report will be located in your USB drive named mbr.zip
  • Plug the USB back into the clean computer post the contents of the report.txt, filefind.txt and RegReport.txt in your next reply. The mbr.zip file must be attached to your reply.

No request for help throughout private messaging will be attended.

If I have helped you, consider making a donation to help me continue the fight against Malware!
btn_donate_SM.gif


#4 boopme

boopme

    To Insanity and Beyond


  • Global Moderator
  • 73,490 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:NJ USA
  • Local time:06:06 AM

Posted 21 February 2012 - 08:26 PM

Hello, just letting you know I moved this topic to Here in the Virus, Trojan, Spyware, and Malware Removal Logs forum where it will stay.

Please remember to click the Watch Topic button at the top right and select Immediate Notification so you do not miss any replies now that you were moved.
How do I get help? Who is helping me?For the time will come when men will not put up with sound doctrine. Instead, to suit their own desires, they will gather around them a great number of teachers to say what their itching ears want to hear....Become a BleepingComputer fan: Facebook

#5 PokerHandfull

PokerHandfull
  • Topic Starter

  • Members
  • 7 posts
  • OFFLINE
  •  
  • Local time:05:06 AM

Posted 22 February 2012 - 11:11 PM

Ok thank you so much. I have finished the steps, I am posting the three reports and attaching the mbr.zip file.

RegReport.txt

Remote Registry Report

Hive </mnt/sda1/Windows/System32/config/SOFTWARE>
\Microsoft\Windows NT\CurrentVersion> Value <ProductName> of type REG_SZ, data length 38 [0x26]
Windows 7 Ultimate
\Microsoft\Windows NT\CurrentVersion> cat_vk: No such value <CSDVersion>
\Microsoft\Windows NT\CurrentVersion> Value <SystemRoot> of type REG_SZ, data length 22 [0x16]
C:\Windows
\Microsoft\Windows NT\CurrentVersion\Windows> cat_vk: No such value <AppInit_DLLs>
(...)\Windows NT\CurrentVersion\Winlogon> Value <Shell> of type REG_SZ, data length 26 [0x1a]
Explorer.exe
(...)\Windows NT\CurrentVersion\Winlogon> Value <Userinit> of type REG_SZ, data length 68 [0x44]
C:\Windows\system32\userinit.exe,
(...)\Windows NT\CurrentVersion\Winlogon\Notify> Node has 0 subkeys and 0 values
\Microsoft\Windows\CurrentVersion\Run> Node has 0 subkeys and 1 values
size type value name [value if type DWORD]
170 REG_SZ <AdobeAAMUpdater-1.0>
(...)\Windows\CurrentVersion\Policies\System> Node has 1 subkeys and 17 values
<UIPI>
4 REG_DWORD <ConsentPromptBehaviorAdmin> 0 [0x0]
4 REG_DWORD <ConsentPromptBehaviorUser> 3 [0x3]
4 REG_DWORD <EnableInstallerDetection> 1 [0x1]
4 REG_DWORD <EnableLUA> 0 [0x0]
4 REG_DWORD <EnableSecureUIAPaths> 1 [0x1]
4 REG_DWORD <EnableUIADesktopToggle> 0 [0x0]
4 REG_DWORD <EnableVirtualization> 1 [0x1]
4 REG_DWORD <PromptOnSecureDesktop> 0 [0x0]
4 REG_DWORD <ValidateAdminCodeSignatures> 0 [0x0]
4 REG_DWORD <dontdisplaylastusername> 0 [0x0]
2 REG_SZ <legalnoticecaption>
4 REG_SZ <legalnoticetext>
4 REG_DWORD <scforceoption> 0 [0x0]
4 REG_DWORD <shutdownwithoutlogon> 1 [0x1]
4 REG_DWORD <undockwithoutlogon> 1 [0x1]
4 REG_DWORD <FilterAdministratorToken> 0 [0x0]
4 REG_DWORD <DisableRegistryTools> 0 [0x0]


Hive </mnt/sda1/Windows/ERDNT/Hiv-backup/Users/00000001/NTUSER.DAT>
> Node has 10 subkeys and 0 values
<AppEvents>
<Console>
<Control Panel>
<Environment>
<EUDC>
<Keyboard Layout>
<Network>
<Printers>
<Software>
<System>
\System> Node has 1 subkeys and 0 values
<CurrentControlSet>


Hive </mnt/sda1/Windows/ERDNT/Hiv-backup/Users/00000002/NTUSER.DAT>
> Node has 10 subkeys and 0 values
<AppEvents>
<Console>
<Control Panel>
<Environment>
<EUDC>
<Keyboard Layout>
<Network>
<Printers>
<Software>
<System>
\System> Node has 1 subkeys and 0 values
<CurrentControlSet>


Hive </mnt/sda1/Windows/ERDNT/Hiv-backup/Users/00000003/ntuser.dat>
(...)\Microsoft\Windows\CurrentVersion\Run> Node has 0 subkeys and 2 values
size type value name [value if type DWORD]
168 REG_SZ <LightScribe Control Panel>
142 REG_SZ <RoboForm>
(...)\Windows\CurrentVersion\Policies\Explorer> Node has 0 subkeys and 1 values
4 REG_DWORD <NoDrives> 0 [0x0]
(...)\Windows\CurrentVersion\Policies\System> Node has 0 subkeys and 1 values
4 REG_DWORD <disableregistrytools> 0 [0x0]
\Software\Policies\Microsoft\Windows\System> Node has 0 subkeys and 1 values
4 REG_DWORD <disablecmd> 0 [0x0]


Hive </mnt/sda1/Windows/ERDNT/subs/Users/00000001/NTUSER.DAT>
> Node has 10 subkeys and 0 values
<AppEvents>
<Console>
<Control Panel>
<Environment>
<EUDC>
<Keyboard Layout>
<Network>
<Printers>
<Software>
<System>
\System> Node has 1 subkeys and 0 values
<CurrentControlSet>


Hive </mnt/sda1/Windows/ERDNT/subs/Users/00000002/NTUSER.DAT>
> Node has 10 subkeys and 0 values
<AppEvents>
<Console>
<Control Panel>
<Environment>
<EUDC>
<Keyboard Layout>
<Network>
<Printers>
<Software>
<System>
\System> Node has 1 subkeys and 0 values
<CurrentControlSet>


Hive </mnt/sda1/Windows/ERDNT/subs/Users/00000003/ntuser.dat>
(...)\Microsoft\Windows\CurrentVersion\Run> Node has 0 subkeys and 2 values
size type value name [value if type DWORD]
168 REG_SZ <LightScribe Control Panel>
142 REG_SZ <RoboForm>
(...)\Windows\CurrentVersion\Policies\Explorer> Node has 1 subkeys and 1 values
<Run>
4 REG_DWORD <NoDrives> 0 [0x0]
(...)\Windows\CurrentVersion\Policies\System> Node has 0 subkeys and 0 values
\Software\Policies\Microsoft\Windows\System> Node has 0 subkeys and 0 values


Hive </mnt/sda1/Users/Mcx1-PASTAPETE/ntuser.dat>
(...)\Microsoft\Windows\CurrentVersion\Run> Node has 0 subkeys and 0 values


Hive </mnt/sda1/Users/Rigatoni/ntuser.dat>
(...)\Microsoft\Windows\CurrentVersion\Run> Node has 0 subkeys and 2 values
size type value name [value if type DWORD]
168 REG_SZ <LightScribe Control Panel>
142 REG_SZ <RoboForm>
(...)\Windows\CurrentVersion\Policies\Explorer> Node has 0 subkeys and 1 values
4 REG_DWORD <NoDrives> 0 [0x0]
(...)\Windows\CurrentVersion\Policies\System> Node has 0 subkeys and 1 values
4 REG_DWORD <disableregistrytools> 0 [0x0]
\Software\Policies\Microsoft\Windows\System> Node has 0 subkeys and 1 values
4 REG_DWORD <disablecmd> 0 [0x0]


Hive </mnt/sda1/Users/UpdatusUser/NTUSER.DAT>
(...)\Microsoft\Windows\CurrentVersion\Run> Node has 0 subkeys and 1 values
size type value name [value if type DWORD]
104 REG_EXPAND_SZ <Sidebar>




FileFind.txt

Search results for Winlogon.exe

63eec8a8b221ab79045e776e5f592868 /mnt/sda1/Program Files (x86)/Malwarebytes' Anti-Malware/Chameleon/winlogon.exe
178.6K Jan 13 19:53

132328df455b0028f13bf0abee51a63a /mnt/sda1/Windows/ERDNT/cache64/winlogon.exe
380.0K Jul 14 2009

132328df455b0028f13bf0abee51a63a /mnt/sda1/Windows/System32/winlogon.exe
380.0K Jul 14 2009

132328df455b0028f13bf0abee51a63a /mnt/sda1/Windows/winsxs/amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16385_none_cbb7f2bdeea2829c/winlogon.exe
380.0K Jul 14 2009


Search results for volsnap.sys

58f82eed8ca24b461441f9c3e4f0bf5c /mnt/sda1/Windows/System32/drivers/volsnap.sys
288.1K Jul 14 2009

58f82eed8ca24b461441f9c3e4f0bf5c /mnt/sda1/Windows/System32/DriverStore/FileRepository/volume.inf_amd64_neutral_1b1a512d99c5b72c/volsnap.sys
288.1K Jul 14 2009

58f82eed8ca24b461441f9c3e4f0bf5c /mnt/sda1/Windows/winsxs/amd64_volume.inf_31bf3856ad364e35_6.1.7600.16385_none_71aba92815c60174/volsnap.sys
288.1K Jul 14 2009


Search results for explorer.exe

c235a51cb740e45ffa0ebfb9bafcda64 /mnt/sda1/Windows/ERDNT/cache86/explorer.exe
2.7M Jul 14 2009

c235a51cb740e45ffa0ebfb9bafcda64 /mnt/sda1/Windows/explorer.exe
2.7M Jul 14 2009

15bc38a7492befe831966adb477cf76f /mnt/sda1/Windows/SysWOW64/explorer.exe
2.5M Jul 14 2009

c235a51cb740e45ffa0ebfb9bafcda64 /mnt/sda1/Windows/winsxs/amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16385_none_ada998b9936d7566/explorer.exe
2.7M Jul 14 2009

15bc38a7492befe831966adb477cf76f /mnt/sda1/Windows/winsxs/wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16385_none_b7fe430bc7ce3761/explorer.exe
2.5M Jul 14 2009


Search results for Userinit.exe

6f8f1376a13114cc10c0e69274f5a4de /mnt/sda1/Windows/ERDNT/cache64/userinit.exe
29.5K Jul 14 2009

6de80f60d7de9ce6b8c2ddfdf79ef175 /mnt/sda1/Windows/ERDNT/cache86/userinit.exe
25.5K Jul 14 2009

6f8f1376a13114cc10c0e69274f5a4de /mnt/sda1/Windows/System32/userinit.exe
29.5K Jul 14 2009

6de80f60d7de9ce6b8c2ddfdf79ef175 /mnt/sda1/Windows/SysWOW64/userinit.exe
25.5K Jul 14 2009

6f8f1376a13114cc10c0e69274f5a4de /mnt/sda1/Windows/winsxs/amd64_microsoft-windows-userinit_31bf3856ad364e35_6.1.7600.16385_none_381dabbceb60feb2/userinit.exe
29.5K Jul 14 2009

6de80f60d7de9ce6b8c2ddfdf79ef175 /mnt/sda1/Windows/winsxs/x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7600.16385_none_dbff103933038d7c/userinit.exe
25.5K Jul 14 2009



report.txt

Wed Feb 22 22:35:14 UTC 2012
Driver report for /mnt/sda1/Windows/System32/drivers

64edd3f59db321947969fdf1dd747323 1394bus.sys
Microsoft Corporation

1b00662092f9f9568b995902f0cc40d5 1394ohci.sys
Microsoft Corporation

63b05a0420ce4bf0e4af6dcc7cada254 acpipmi.sys
Microsoft Corporation

6f11e88748cdefd2f76aa215f97ddfe5 acpi.sys
Microsoft Corporation

2f6b34b83843f0c5118b63ac634f5bf4 adp94xx.sys
Adaptec

597f78224ee9224ea1a13d6350ced962 adpahci.sys
Adaptec

e109549c90f62fb570b9540c4b148e54 adpu320.sys
Adaptec

b9384e03479d2506bc924c16a3db87bc afd.sys
Microsoft Corporation

7ecff9b22276b73f43a99a15a6094e90 agilevpn.sys
Microsoft Corporation

608c14dba7299d8cb6ed035a68a15799 AGP440.sys
Microsoft Corporation

5812713a477a3ad7363c7438ca2ee038 aliide.sys
Acer Laboratories

1ff8b4431c353ce385c875f194924c0c amdide.sys
Microsoft Corporation

7024f087cff1833a806193ef9d22cda9 amdk8.sys
Microsoft Corporation

1e56388b3fe0d031c44144eb8c4d6217 amdppm.sys
Microsoft Corporation

7a4b413614c055935567cf88a9734d38 amdsata.sys
Advanced Micro Devices

f67f933e79241ed32ff46a4f29b5120b amdsbs.sys
AMD Technologies

b4ad0cacbab298671dd6f6ef7e20679d amdxata.sys
Advanced Micro Devices

42fd751b27fa0e9c69bb39f39e409594 appid.sys
Microsoft Corporation

019af6924aefe7839f61c830227fe79c arcsas.sys
Adaptec

c484f8ceb1717c540242531db7845c4e arc.sys
Adaptec

03b7145c889603537e9ffeabb1ad1089 ASACPI.sys
tH`p((VS_VERSION_INFO%?(aStringFileInfodbCommentsCompanyNameRFileDescriptionATKACPIUtility@FileVersion,,,bInternalNameATK$LegalCopyright(LegalTrademarksbOriginalFilenameATKPrivateBuildJProductNameATKACPIUtility@ProductVersion,,,SpecialBuildDVarFileInfo$Translationt*

769765ce2cc62867468cea93969b2242 asyncmac.sys
Microsoft Corporation

02062c0b390b7729edc9e69c680a6f3c atapi.sys
Microsoft Corporation

aa2186f7944104a16d6ed176ed462cec ataport.sys
Microsoft Corporation

b5ace6968304a3900eeb1ebfd9622df2 b57nd60a.sys
Broadcom Corporation

f4de2ae7a9e1badac70bc71ea2c17612 battc.sys
Microsoft Corporation

16a47ce2decc9b099349a5f840654746 beep.sys
Microsoft Corporation

61583ee3c3a17003c4acd0475646b4d3 blbdrive.sys
Microsoft Corporation

91ce0d3dc57dd377e690a2d324022b08 bowser.sys
Microsoft Corporation

f09eee9edc320b5e1501f749fde686c8 BrFiltLo.sys
Brother Industries

b114d3098e9bdb8bea8b053685831be6 BrFiltUp.sys
Brother Industries

5c2f352a4e961d72518261257aae204b bridge.sys
Microsoft Corporation

43bea8d483bf1870f018e2d02e06a5bd BrSerId.sys
Brother Industries
Brother Industries
Brother Industries
Brother Industries
Brother Industries
Brother Industries
Brother Industries
Brother Industries
Brother Industries
Brother Industries
Brother Industries
Brother Industries
Brother Industries
Brother Industries
Brother Industries
Brother Industries
Brother Industries

a6eca2151b08a09caceca35c07f05b42 BrSerWdm.sys
Brother Industries

b79968002c277e869cf38bd22cd61524 BrUsbMdm.sys
Brother Industries

a87528880231c54e75ea7a44943b38bf BrUsbSer.sys
Brother Industries

9da669f11d1f894ab4eb69bf546a42e8 bthmodem.sys
Microsoft Corporation

3e5b191307609f7514148c6832bb0842 bxvbda.sys
Broadcom Corporation

b8bd2bb284668c84865658c77574381a cdfs.sys
Microsoft Corporation

7dc54d1d7b66ebfc09f1defcf32dfa3f cdr4_xp.sys
Sonic Solutions

bf22b3f663e6d1662e6159ab8ea7d113 cdralw2k.sys
Sonic Solutions

83d2d75e1efb81b3450c18131443f7db cdrom.sys
Microsoft Corporation

d7cd5c4e1b71fa62050515314cfb52cf circlass.sys
Microsoft Corporation

62f1ed63f0cb0b5a2f65d15a6490c2fd Classpnp.sys
Microsoft Corporation

0840155d0bddf1190f84a663c284bd33 CmBatt.sys
Microsoft Corporation

e19d3f095812725d88f9001985b94edd cmdide.sys
CMD Technology

f95fd4cb7da00ba2a63ce9f6b5c053e1 cng.sys
Microsoft Corporation

102de219c3f61415f964c88e9085ad14 compbatt.sys
Microsoft Corporation

f26b3a86f6fa87ca360b879581ab4123 CompositeBus.sys
Microsoft Corporation

3e588b60ec061686ba05d33574a344c6 crashdmp.sys
Microsoft Corporation

1c827878a998c18847245fe1f34ee597 crcdisk.sys
Microsoft Corporation

4a6173c2279b498cd8f57cae504564cb csc.sys
Microsoft Corporation

3f1dc527070acb87e40afe46ef6da749 dfsc.sys
Microsoft Corporation

13096b05847ec78f0977f2c0f79e9ab3 discache.sys
Microsoft Corporation

77a4b22c0be4568872521dd5e4279cee Diskdump.sys
Microsoft Corporation

9819eee8b5ea3784ec4af3b137a5244c disk.sys
Microsoft Corporation

9b19f34400d24df84c858a421c205754 drmkaud.sys
Microsoft Corporation

21d26064aedb4988f785bb4a3a2c051e drmk.sys
Microsoft Corporation

839b5fe3d48e9f35b22c21a3d5103f6c Dumpata.sys
Microsoft Corporation

814db88f2641691575a455cf25354098 dumpfve.sys
Microsoft Corporation

bf24d6f2ed97fe830bfd52b246f98e67 dxapi.sys
Microsoft Corporation

7cb7d2b73813ce05c7bc0f5f95d27cec dxgkrnl.sys
Microsoft Corporation

ddb7ad1ba01005521010db3e30adc972 dxgmms1.sys
Microsoft Corporation

fede0629ecb23650d48989517d4914da dxg.sys
Microsoft Corporation

0e5da5369a0fcaea12456dd852545184 elxstor.sys
Emulex

34a3c54752046e79a126e15c51db409b errdev.sys
Microsoft Corporation

dc5d737f51be844d8c82c695eb17372f evbda.sys
Broadcom Corporation

a510c654ec00c1e9bdd91eeb3a59823b exfat.sys
Microsoft Corporation

0adc83218b66a6db380c330836f3e36d fastfat.sys
Microsoft Corporation

d765d19cd8ef61f650c384f62fac00ab fdc.sys
Microsoft Corporation

655661be46b5f5f3fd454e2c3095b930 fileinfo.sys
Microsoft Corporation

5f671ab5bc87eea04ec38a6cd5962a47 filetrace.sys
Microsoft Corporation

c172a0f53008eaeb8ea33fe10e177af5 flpydisk.sys
Microsoft Corporation

f7866af72abbaf84b1fa5aa195378c59 fltMgr.sys
Microsoft Corporation

d43703496149971890703b4b1b723eac fsdepends.sys
Microsoft Corporation

e95ef8547de20cf0603557c0cf7a9462 fs_rec.sys
Microsoft Corporation

b8b2a6e1558f8f5de5ce431c5b2c7b09 fvevol.sys
Microsoft Corporation

50555005e22a56aef10be607472d0bdc FWPKCLNT.SYS
Microsoft Corporation

8c778d335c9d272cfd3298ab02abe3b6 GAGP30KX.SYS
Microsoft Corporation

e403aacf8c7bb11375122d2464560311 GEARAspiWDM.sys
GEAR Software

f2523ef6460fc42405b12248338ab2f0 hcw85cir.sys
Hauppauge Computer Works

0a49913402747a0b67de940fb42cbdbb hdaudbus.sys
Microsoft Corporation

6410f6f415b2a5a9037224c41da8bf12 HdAudio.sys
Microsoft Corporation

78e86380454a7b10a5eb255dc44a355f hidbatt.sys
Microsoft Corporation

7fd2a313f7afe5c4dab14798c48dd104 hidbth.sys
Microsoft Corporation

685fec2407fc121eb937cb658b3c0f35 hidclass.sys
Microsoft Corporation

0a77d29f311b88cfae3b13f9c1a73825 hidir.sys
Microsoft Corporation

49ee2e52e6cd03947dad72f65367be06 hidparse.sys
Microsoft Corporation

b3bf6b5b50006def50b66306d99fcf6f hidusb.sys
Microsoft Corporation

0886d440058f203eba0e1825e4355914 HpSAMD.sys
Hewlett-Packard

cee049cac4efa7f4e1e4ad014414a5d4 http.sys
Microsoft Corporation

f17766a19145f111856378df337a5d79 hwpolicy.sys
Microsoft Corporation

fa55c73d4affa7ee23ac4be53b4592d3 i8042prt.sys
Microsoft Corporation

d83efb6fd45df9d55e9a1afc63640d50 iaStorV.sys
Intel Corporation

5c18831c61933628f5bb0ea2675b9d21 iirsp.sys
Intel Corp

f00f20e70c6ec3aa366910083a0518aa intelide.sys
Microsoft Corporation

ada036632c664caa754079041cf1f8c1 intelppm.sys
Microsoft Corporation

722dd294df62483cecaae6e094b4d695 ipfltdrv.sys
Microsoft Corporation

e2b4a4494db7cb9b89b55ca268c337c5 IPMIDrv.sys
Microsoft Corporation

af9b39a7e7b6caa203b3862582e9f2d0 ipnat.sys
Microsoft Corporation

05360b1ea5a2abf620d1d96ebd8bd8f1 irda.sys
Microsoft Corporation

3abf5e7213eb28966d55d58b515d5ce9 irenum.sys
Microsoft Corporation

2f7b28dc3e1183e5eb418df55c204f38 isapnp.sys
Microsoft Corporation

bc02336f1cba7dcc7d1213bb588a68a5 kbdclass.sys
Microsoft Corporation

6def98f8541e1b5dceb2c822a11f7323 kbdhid.sys
Microsoft Corporation

e8b6fcc9c83535c67f835d407620bd27 ksecdd.sys
Microsoft Corporation

bbe1bf6d9b661c354d4857d5fadb943b ksecpkg.sys
Microsoft Corporation

3e099cc843c4233e5af147c8ea8ba32b ks.sys
Microsoft Corporation

6869281e78cb31a43e969f06b57347c4 ksthunk.sys
Microsoft Corporation

1538831cf8ad2979a04c423779465827 lltdio.sys
Microsoft Corporation

1a93e54eb0ece102495a51266dcdb6a6 lsi_fc.sys
LSI Corporation

30f5c0de1ee8b5bc9306c1f0e4a75f93 lsi_sas2.sys
LSI Corporation

1047184a9fdc8bdbff857175875ee810 lsi_sas.sys
LSI Corporation

0504eacaff0d3c8aed161c4b0d369d4a lsi_scsi.sys
LSI Corporation

43d0f98e1d56ccddb0d5254cff7b356e luafv.sys
Microsoft Corporation

79da94b35371b9e7104460c7693dcb2c mbam.sys
Malwarebytes Corporation

3c9f072f9dca856b9fb7a20cbd4281ac mcd.sys
Microsoft Corporation

a55805f747c6edb6a9080d7c633bd0f4 megasas.sys
LSI Corporation

baf74ce0072480c3b6b7c13b2a94d6b3 MegaSR.sys
LSI Corporation

800ba92f7010378b09f9ed9270f07137 modem.sys
Microsoft Corporation

b03d591dc7da45ece20b3b467e6aadaa monitor.sys
Microsoft Corporation

7d27ea49f3c1f687d357e77a470aea99 mouclass.sys
Microsoft Corporation

d3bf052c40b0c4166d9fd86a4288c1e6 mouhid.sys
Microsoft Corporation

791af66c4d0e7c90a3646066386fb571 mountmgr.sys
Microsoft Corporation

609d1d87649ecc19796f4d76d4c15cea mpio.sys
Microsoft Corporation

6c38c9e45ae0ea2fa5e551f2ed5e978f mpsdrv.sys
Microsoft Corporation

30524261bb51d96d6fcbac20c810183c mrxdav.sys
Microsoft Corporation

1bee517b220b7f024f411aec1571dd5a mrxsmb10.sys
Microsoft Corporation

6b2d5fef385828b6e485c1c90afb8195 mrxsmb20.sys
Microsoft Corporation

cfdcd8ca87c2a657debc150ac35b5e08 mrxsmb.sys
Microsoft Corporation

5c37497276e3b3a5488b23a326a754b7 msahci.sys
Microsoft Corporation

8d27b597229aed79430fb9db3bcbfbd0 msdsm.sys
Microsoft Corporation

aa3fb40e17ce1388fa1bedab50ea8f96 msfs.sys
Microsoft Corporation

f9d215a46a8b9753f61767fa72a20326 mshidkmdf.sys
Microsoft Corporation

d916874bbd4f8b07bfb7fa9b3ccae29d msisadrv.sys
Microsoft Corporation

fa4d2557de56d45b0a346f93564be6e1 msiscsi.sys
Microsoft Corporation

49ccf2c4fea34ffad8b1b59d49439366 mskssrv.sys
Microsoft Corporation

bdd71ace35a232104ddd349ee70e1ab3 mspclock.sys
Microsoft Corporation

4ed981241db27c3383d72092b618a1d0 mspqm.sys
Microsoft Corporation

89cb141aa8616d8c6a4610fa26c60964 msrpc.sys
Microsoft Corporation

0eed230e37515a0eaee3c2e1bc97b288 mssmbios.sys
Microsoft Corporation

2e66f9ecb30b4221a318c92ac2250779 mstee.sys
Microsoft Corporation

7ea404308934e675bffde8edf0757bcd MTConfig.sys
Microsoft Corporation

f9a18612fd3526fe473c1bda678d61c8 mup.sys
Microsoft Corporation

9f9a1f53aad7da4d6fef5bb73ab811ac ndiscap.sys
Microsoft Corporation

cad515dbd07d082bb317d9928ce8962c ndis.sys
Microsoft Corporation

30639c932d9fef22b31268fe25a1b6e5 ndistapi.sys
Microsoft Corporation

f105ba1e22bf1f2ee8f005d4305e4bec ndisuio.sys
Microsoft Corporation

557dfab9ca1fcb036ac77564c010dad3 ndiswan.sys
Microsoft Corporation

659b74fb74b86228d6338d643cd3e3cf ndproxy.sys
Microsoft Corporation

86743d9f5d2b1048062b14b1d84501c4 netbios.sys
Microsoft Corporation

9162b273a44ab9dce5b44362731d062a netbt.sys
64edd3f59db321947969fdf1dd747323 1394bus.sys
Microsoft Corporation

1b00662092f9f9568b995902f0cc40d5 1394ohci.sys
Microsoft Corporation

7b8403912673a87ea6622f5cb867a670 netio.sys
Microsoft Corporation

63b05a0420ce4bf0e4af6dcc7cada254 acpipmi.sys
Microsoft Corporation

6f11e88748cdefd2f76aa215f97ddfe5 acpi.sys
Microsoft Corporation

2f6b34b83843f0c5118b63ac634f5bf4 adp94xx.sys
Adaptec

597f78224ee9224ea1a13d6350ced962 adpahci.sys
Microsoft Corporation

51f0fd171844de3d9b9a0f4492db7aa4 netr6164.sys
Adaptec

e109549c90f62fb570b9540c4b148e54 adpu320.sys
Adaptec

b9384e03479d2506bc924c16a3db87bc afd.sys
Ralink Technology

77889813be4d166cdab78ddba990da92 nfrd960.sys
IBM Corp

1e4c4ab5c9b8dd13179bbdc75a2a01f7 npfs.sys
Microsoft Corporation

e7f5ae18af4168178a642a9247c63001 nsiproxy.sys
Microsoft Corporation

356698a13c4630d5b31c37378d469196 ntfs.sys
Microsoft Corporation

7ecff9b22276b73f43a99a15a6094e90 agilevpn.sys
Microsoft Corporation

608c14dba7299d8cb6ed035a68a15799 AGP440.sys
Microsoft Corporation

5812713a477a3ad7363c7438ca2ee038 aliide.sys
Acer Laboratories

1ff8b4431c353ce385c875f194924c0c amdide.sys
Microsoft Corporation

7024f087cff1833a806193ef9d22cda9 amdk8.sys
Microsoft Corporation

1e56388b3fe0d031c44144eb8c4d6217 amdppm.sys
Microsoft Corporation

7a4b413614c055935567cf88a9734d38 amdsata.sys
Advanced Micro Devices

f67f933e79241ed32ff46a4f29b5120b amdsbs.sys
AMD Technologies

b4ad0cacbab298671dd6f6ef7e20679d amdxata.sys
Advanced Micro Devices

42fd751b27fa0e9c69bb39f39e409594 appid.sys
Microsoft Corporation

019af6924aefe7839f61c830227fe79c arcsas.sys
Adaptec

c484f8ceb1717c540242531db7845c4e arc.sys
Adaptec

03b7145c889603537e9ffeabb1ad1089 ASACPI.sys
tH`p((VS_VERSION_INFO%?(aStringFileInfodbCommentsCompanyNameRFileDescriptionATKACPIUtility@FileVersion,,,bInternalNameATK$LegalCopyright(LegalTrademarksbOriginalFilenameATKPrivateBuildJProductNameATKACPIUtility@ProductVersion,,,SpecialBuildDVarFileInfo$Translationt*

769765ce2cc62867468cea93969b2242 asyncmac.sys
Microsoft Corporation

02062c0b390b7729edc9e69c680a6f3c atapi.sys
Microsoft Corporation

aa2186f7944104a16d6ed176ed462cec ataport.sys
Microsoft Corporation

b5ace6968304a3900eeb1ebfd9622df2 b57nd60a.sys
Broadcom Corporation

f4de2ae7a9e1badac70bc71ea2c17612 battc.sys
Microsoft Corporation

16a47ce2decc9b099349a5f840654746 beep.sys
Microsoft Corporation

61583ee3c3a17003c4acd0475646b4d3 blbdrive.sys
Microsoft Corporation

91ce0d3dc57dd377e690a2d324022b08 bowser.sys
Microsoft Corporation

f09eee9edc320b5e1501f749fde686c8 BrFiltLo.sys
Brother Industries

b114d3098e9bdb8bea8b053685831be6 BrFiltUp.sys
Brother Industries

5c2f352a4e961d72518261257aae204b bridge.sys
Microsoft Corporation

43bea8d483bf1870f018e2d02e06a5bd BrSerId.sys
Brother Industries
Brother Industries
Brother Industries
Brother Industries
Brother Industries
Brother Industries
Brother Industries
Brother Industries
Brother Industries
Brother Industries
Brother Industries
Brother Industries
Brother Industries
Brother Industries
Brother Industries
Brother Industries
Brother Industries

a6eca2151b08a09caceca35c07f05b42 BrSerWdm.sys
Brother Industries

b79968002c277e869cf38bd22cd61524 BrUsbMdm.sys
Brother Industries

a87528880231c54e75ea7a44943b38bf BrUsbSer.sys
Brother Industries

9da669f11d1f894ab4eb69bf546a42e8 bthmodem.sys
Microsoft Corporation

3e5b191307609f7514148c6832bb0842 bxvbda.sys
Broadcom Corporation

b8bd2bb284668c84865658c77574381a cdfs.sys
Microsoft Corporation

7dc54d1d7b66ebfc09f1defcf32dfa3f cdr4_xp.sys
Sonic Solutions

bf22b3f663e6d1662e6159ab8ea7d113 cdralw2k.sys
Sonic Solutions

83d2d75e1efb81b3450c18131443f7db cdrom.sys
Microsoft Corporation

d7cd5c4e1b71fa62050515314cfb52cf circlass.sys
Microsoft Corporation

62f1ed63f0cb0b5a2f65d15a6490c2fd Classpnp.sys
Microsoft Corporation

0840155d0bddf1190f84a663c284bd33 CmBatt.sys
Microsoft Corporation

e19d3f095812725d88f9001985b94edd cmdide.sys
CMD Technology

f95fd4cb7da00ba2a63ce9f6b5c053e1 cng.sys
Microsoft Corporation

102de219c3f61415f964c88e9085ad14 compbatt.sys
Microsoft Corporation

f26b3a86f6fa87ca360b879581ab4123 CompositeBus.sys
Microsoft Corporation

3e588b60ec061686ba05d33574a344c6 crashdmp.sys
Microsoft Corporation

1c827878a998c18847245fe1f34ee597 crcdisk.sys
Microsoft Corporation

4a6173c2279b498cd8f57cae504564cb csc.sys
Microsoft Corporation

3f1dc527070acb87e40afe46ef6da749 dfsc.sys
Microsoft Corporation

13096b05847ec78f0977f2c0f79e9ab3 discache.sys
Microsoft Corporation

77a4b22c0be4568872521dd5e4279cee Diskdump.sys
Microsoft Corporation

9819eee8b5ea3784ec4af3b137a5244c disk.sys
Microsoft Corporation

9b19f34400d24df84c858a421c205754 drmkaud.sys
Microsoft Corporation

21d26064aedb4988f785bb4a3a2c051e drmk.sys
Microsoft Corporation

839b5fe3d48e9f35b22c21a3d5103f6c Dumpata.sys
Microsoft Corporation

814db88f2641691575a455cf25354098 dumpfve.sys
Microsoft Corporation

bf24d6f2ed97fe830bfd52b246f98e67 dxapi.sys
Microsoft Corporation

7cb7d2b73813ce05c7bc0f5f95d27cec dxgkrnl.sys
Microsoft Corporation

ddb7ad1ba01005521010db3e30adc972 dxgmms1.sys
Microsoft Corporation

fede0629ecb23650d48989517d4914da dxg.sys
Microsoft Corporation

0e5da5369a0fcaea12456dd852545184 elxstor.sys
Emulex

34a3c54752046e79a126e15c51db409b errdev.sys
Microsoft Corporation

dc5d737f51be844d8c82c695eb17372f evbda.sys
Microsoft Corporation

9899284589f75fa8724ff3d16aed75c1 null.sys
Microsoft Corporation

270d7cd42d6e3979f6dd0146650f0e05 NV_AGP.SYS
Microsoft Corporation

b15258b1f45f9571758ac6bb2f043b01 nvlddmkm.sys
Broadcom Corporation

a510c654ec00c1e9bdd91eeb3a59823b exfat.sys
Microsoft Corporation

0adc83218b66a6db380c330836f3e36d fastfat.sys
Microsoft Corporation

d765d19cd8ef61f650c384f62fac00ab fdc.sys
Microsoft Corporation

655661be46b5f5f3fd454e2c3095b930 fileinfo.sys
Microsoft Corporation

5f671ab5bc87eea04ec38a6cd5962a47 filetrace.sys
Microsoft Corporation

c172a0f53008eaeb8ea33fe10e177af5 flpydisk.sys
Microsoft Corporation

f7866af72abbaf84b1fa5aa195378c59 fltMgr.sys
Microsoft Corporation

d43703496149971890703b4b1b723eac fsdepends.sys
Microsoft Corporation

e95ef8547de20cf0603557c0cf7a9462 fs_rec.sys
Microsoft Corporation

b8b2a6e1558f8f5de5ce431c5b2c7b09 fvevol.sys
Microsoft Corporation

50555005e22a56aef10be607472d0bdc FWPKCLNT.SYS
Microsoft Corporation

8c778d335c9d272cfd3298ab02abe3b6 GAGP30KX.SYS
Microsoft Corporation

e403aacf8c7bb11375122d2464560311 GEARAspiWDM.sys
GEAR Software

f2523ef6460fc42405b12248338ab2f0 hcw85cir.sys
Hauppauge Computer Works

0a49913402747a0b67de940fb42cbdbb hdaudbus.sys
Microsoft Corporation

6410f6f415b2a5a9037224c41da8bf12 HdAudio.sys
Microsoft Corporation

78e86380454a7b10a5eb255dc44a355f hidbatt.sys
Microsoft Corporation

7fd2a313f7afe5c4dab14798c48dd104 hidbth.sys
Microsoft Corporation

685fec2407fc121eb937cb658b3c0f35 hidclass.sys
Microsoft Corporation

0a77d29f311b88cfae3b13f9c1a73825 hidir.sys
Microsoft Corporation

49ee2e52e6cd03947dad72f65367be06 hidparse.sys
Microsoft Corporation

b3bf6b5b50006def50b66306d99fcf6f hidusb.sys
Microsoft Corporation

0886d440058f203eba0e1825e4355914 HpSAMD.sys
Hewlett-Packard

cee049cac4efa7f4e1e4ad014414a5d4 http.sys
Microsoft Corporation

f17766a19145f111856378df337a5d79 hwpolicy.sys
Microsoft Corporation

fa55c73d4affa7ee23ac4be53b4592d3 i8042prt.sys
Microsoft Corporation

d83efb6fd45df9d55e9a1afc63640d50 iaStorV.sys
Intel Corporation

5c18831c61933628f5bb0ea2675b9d21 iirsp.sys
Intel Corp

f00f20e70c6ec3aa366910083a0518aa intelide.sys
Microsoft Corporation

ada036632c664caa754079041cf1f8c1 intelppm.sys
Microsoft Corporation

722dd294df62483cecaae6e094b4d695 ipfltdrv.sys
Microsoft Corporation

e2b4a4494db7cb9b89b55ca268c337c5 IPMIDrv.sys
Microsoft Corporation

af9b39a7e7b6caa203b3862582e9f2d0 ipnat.sys
Microsoft Corporation

05360b1ea5a2abf620d1d96ebd8bd8f1 irda.sys
Microsoft Corporation

3abf5e7213eb28966d55d58b515d5ce9 irenum.sys
Microsoft Corporation

2f7b28dc3e1183e5eb418df55c204f38 isapnp.sys
Microsoft Corporation

bc02336f1cba7dcc7d1213bb588a68a5 kbdclass.sys
Microsoft Corporation

6def98f8541e1b5dceb2c822a11f7323 kbdhid.sys
Microsoft Corporation

e8b6fcc9c83535c67f835d407620bd27 ksecdd.sys
Microsoft Corporation

bbe1bf6d9b661c354d4857d5fadb943b ksecpkg.sys
Microsoft Corporation

3e099cc843c4233e5af147c8ea8ba32b ks.sys
Microsoft Corporation

6869281e78cb31a43e969f06b57347c4 ksthunk.sys
Microsoft Corporation

1538831cf8ad2979a04c423779465827 lltdio.sys
Microsoft Corporation

1a93e54eb0ece102495a51266dcdb6a6 lsi_fc.sys
LSI Corporation

30f5c0de1ee8b5bc9306c1f0e4a75f93 lsi_sas2.sys
LSI Corporation

1047184a9fdc8bdbff857175875ee810 lsi_sas.sys
LSI Corporation

0504eacaff0d3c8aed161c4b0d369d4a lsi_scsi.sys
LSI Corporation

43d0f98e1d56ccddb0d5254cff7b356e luafv.sys
Microsoft Corporation

79da94b35371b9e7104460c7693dcb2c mbam.sys
Malwarebytes Corporation

3c9f072f9dca856b9fb7a20cbd4281ac mcd.sys
Microsoft Corporation

a55805f747c6edb6a9080d7c633bd0f4 megasas.sys
LSI Corporation

baf74ce0072480c3b6b7c13b2a94d6b3 MegaSR.sys
LSI Corporation

800ba92f7010378b09f9ed9270f07137 modem.sys
Microsoft Corporation

b03d591dc7da45ece20b3b467e6aadaa monitor.sys
Microsoft Corporation

7d27ea49f3c1f687d357e77a470aea99 mouclass.sys
Microsoft Corporation

d3bf052c40b0c4166d9fd86a4288c1e6 mouhid.sys
Microsoft Corporation

791af66c4d0e7c90a3646066386fb571 mountmgr.sys
Microsoft Corporation

609d1d87649ecc19796f4d76d4c15cea mpio.sys
Microsoft Corporation

6c38c9e45ae0ea2fa5e551f2ed5e978f mpsdrv.sys
Microsoft Corporation

30524261bb51d96d6fcbac20c810183c mrxdav.sys
Microsoft Corporation

1bee517b220b7f024f411aec1571dd5a mrxsmb10.sys
Microsoft Corporation

6b2d5fef385828b6e485c1c90afb8195 mrxsmb20.sys
Microsoft Corporation

cfdcd8ca87c2a657debc150ac35b5e08 mrxsmb.sys
Microsoft Corporation

5c37497276e3b3a5488b23a326a754b7 msahci.sys
Microsoft Corporation

8d27b597229aed79430fb9db3bcbfbd0 msdsm.sys
Microsoft Corporation

aa3fb40e17ce1388fa1bedab50ea8f96 msfs.sys
Microsoft Corporation

f9d215a46a8b9753f61767fa72a20326 mshidkmdf.sys
Microsoft Corporation

d916874bbd4f8b07bfb7fa9b3ccae29d msisadrv.sys
Microsoft Corporation

fa4d2557de56d45b0a346f93564be6e1 msiscsi.sys
Microsoft Corporation

49ccf2c4fea34ffad8b1b59d49439366 mskssrv.sys
Microsoft Corporation

bdd71ace35a232104ddd349ee70e1ab3 mspclock.sys
Microsoft Corporation

4ed981241db27c3383d72092b618a1d0 mspqm.sys
Microsoft Corporation

89cb141aa8616d8c6a4610fa26c60964 msrpc.sys
Microsoft Corporation

0eed230e37515a0eaee3c2e1bc97b288 mssmbios.sys
Microsoft Corporation

2e66f9ecb30b4221a318c92ac2250779 mstee.sys
Microsoft Corporation

7ea404308934e675bffde8edf0757bcd MTConfig.sys
Microsoft Corporation

f9a18612fd3526fe473c1bda678d61c8 mup.sys
Microsoft Corporation

9f9a1f53aad7da4d6fef5bb73ab811ac ndiscap.sys
Microsoft Corporation

cad515dbd07d082bb317d9928ce8962c ndis.sys
Microsoft Corporation

30639c932d9fef22b31268fe25a1b6e5 ndistapi.sys
Microsoft Corporation

f105ba1e22bf1f2ee8f005d4305e4bec ndisuio.sys
Microsoft Corporation

557dfab9ca1fcb036ac77564c010dad3 ndiswan.sys
Microsoft Corporation

659b74fb74b86228d6338d643cd3e3cf ndproxy.sys
Microsoft Corporation

86743d9f5d2b1048062b14b1d84501c4 netbios.sys
Microsoft Corporation

9162b273a44ab9dce5b44362731d062a netbt.sys
Microsoft Corporation

7b8403912673a87ea6622f5cb867a670 netio.sys
Microsoft Corporation

51f0fd171844de3d9b9a0f4492db7aa4 netr6164.sys
Ralink Technology

77889813be4d166cdab78ddba990da92 nfrd960.sys
IBM Corp

1e4c4ab5c9b8dd13179bbdc75a2a01f7 npfs.sys
Microsoft Corporation

e7f5ae18af4168178a642a9247c63001 nsiproxy.sys
Microsoft Corporation

356698a13c4630d5b31c37378d469196 ntfs.sys
Microsoft Corporation

9899284589f75fa8724ff3d16aed75c1 null.sys
Microsoft Corporation

270d7cd42d6e3979f6dd0146650f0e05 NV_AGP.SYS
Microsoft Corporation

b15258b1f45f9571758ac6bb2f043b01 nvlddmkm.sys
NVIDIA Corporation

a85b4f2ef3a7304a5399ef0526423040 nvm62x64.sys
NVIDIA Corporation

3e38712941e9bb4ddbee00affe3fed3d nvraid.sys
NVIDIA Corporation

477dc4d6deb99be37084c9ac6d013da1 nvstor.sys
NVIDIA Corporation

1ea3749c4114db3e3161156ffffa6b33 nwifi.sys
Microsoft Corporation

3589478e4b22ce21b41fa1bfc0b8b8a0 ohci1394.sys
Microsoft Corporation

ee992183bd8eaefd9973f352e587a299 pacer.sys
Microsoft Corporation

0086431c29c35be1dbc43f52cc273887 parport.sys
Microsoft Corporation

7daa117143316c4a1537e074a5a9eaf0 partmgr.sys
Microsoft Corporation

b5b8b5ef2e5cb34df8dcf8831e3534fa pciide.sys
Microsoft Corporation

144497daa145ba0f7be896064146c058 pciidex.sys
Microsoft Corporation

f36f6504009f2fb0dfd1b17a116ad74b pci.sys
Microsoft Corporation

b2e81d4e87ce48589f98cb8c05b01f2f pcmcia.sys
Microsoft Corporation

54e013b6d55b81c0aa1ebea80ff42383 PCTCore64.sys
PC Tools

ff43e3b1687e4e2140de6349ea5c7372 pctDS64.sys
PC Tools

60e9a05852af7e9cb11237c00aee4ccf pctEFA64.sys
PC Tools

24b8461b247824e0a8af9671e81a5553 pctgntdi64.sys
PC Tools

db7a3311c4ede70f3115308533ae9fb9 pctplsg64.sys
PC Tools

851bb5d303225970d7a2240bd6e5daf3 pctwfpfilter64.sys
PC Tools

d6b9c2e1a11a3a4b26a182ffef18f603 pcw.sys
Microsoft Corporation

68769c3356b3be5d1c732c97b9a80d6e PEAuth.sys
Microsoft Corporation

32e11315b5126921ffd9074840ef13d3 portcls.sys
Microsoft Corporation

0d922e23c041efb1c3fac2a6f943c9bf processr.sys
Microsoft Corporation

4712cc14e720ecccc0aa16949d18aaf1 PxHlpa64.sys
Sonic Solutions

a53a15a11ebfd21077463ee2c7afeef0 ql2300.sys
QLogic Corporation

4f6d12b51de1aaeff7dc58c4d75423c8 ql40xx.sys
QLogic Corporation

76707bb36430888d9ce9d705398adb6c qwavedrv.sys
Microsoft Corporation

5a0da8ad5762fa2d91678a8a01311704 rasacd.sys
Microsoft Corporation

87a6e852a22991580d6d39adc4790463 rasl2tp.sys
Microsoft Corporation

855c9b1cd4756c5e9a2aa58a15f58c25 raspppoe.sys
Microsoft Corporation

27cc19e81ba5e3403c48302127bda717 raspptp.sys
Microsoft Corporation

e8b1e447b008d07ff47d016c2b0eeecb rassstp.sys
Microsoft Corporation

3bac8142102c15d59a87757c1d41dce5 rdbss.sys
Microsoft Corporation

302da2a0539f2cf54d7c6cc30c1f2d8d rdpbus.sys
Microsoft Corporation

cea6cc257fc9b7715f1c2b4849286d24 RDPCDD.sys
Microsoft Corporation

9706b84dbabfc4b4ca46c5a82b14dfa3 rdpdr.sys
Microsoft Corporation

bb5971a4f00659529a5c44831af22365 RDPENCDD.sys
Microsoft Corporation

216f3fa57533d98e1f74ded70113177a RDPREFMP.sys
Microsoft Corporation

8a3e6bea1c53ea6177fe2b6eba2c80d7 rdpwd.sys
Microsoft Corporation

634b9a2181d98f15941236886164ec8b rdyboost.sys
Microsoft Corporation

77b3b747eb2413072b8e4306018d0c9b rmcast.sys
Microsoft Corporation

fc6d5c50d846b795335deb3fce8b33f3 RNDISMP.sys
Microsoft Corporation

388d3dd1a6457280f3badba9f3acd6b1 rootmdm.sys
Microsoft Corporation

ddc86e4f8e7456261e637e3552e804ff rspndr.sys
Microsoft Corporation

baefee35d27a5440d35092ce10267bec Rt64win7.sys
Realtek Corporation

e3bbb89983daf5622c1d50cf49f28227 sbp2port.sys
Microsoft Corporation

c94da20c7e3ba1dca269bc8460d98387 scfilter.sys
Microsoft Corporation

ad3a6838a059d65fb55d2f61cf0a6c1f scsiport.sys
Microsoft Corporation

3ea8a16169c26afbeb544e0e48421186 secdrv.sys
Macrovision Corporation

cb624c0035412af0debec78c41f5ca1b serenum.sys
Microsoft Corporation

c1d8e28b2c2adfaec4ba89e9fda69bd6 serial.sys
Microsoft Corporation

1c545a7d0691cc4a027396535691c3e3 sermouse.sys
Microsoft Corporation

a554811bcd09279536440c964ae35bbf sffdisk.sys
Microsoft Corporation

ff414f0baefeba59bc6c04b3db0b87bf sffp_mmc.sys
Microsoft Corporation

5588b8c6193eb1522490c122eb94dffa sffp_sd.sys
Microsoft Corporation

a9d601643a1647211a1ee2ec4e433ff4 sfloppy.sys
Microsoft Corporation

d5183ed285d2795491dc15bddcbee5ad Sftfslh.sys
Microsoft Corporation

00f118b68c50d2206dd51634f9142b83 Sftplaylh.sys
Microsoft Corporation

76a827df5640bfe16a0cdbb4108adeca Sftredirlh.sys
Microsoft Corporation

1b4c9701645086bab8cafffce30ed284 Sftvollh.sys
Microsoft Corporation

843caf1e5fde1ffd5ff768f23a51e2e1 sisraid2.sys
Silicon Integrated Systems

6a6c106d42e9ffff8b9fcb4f754f6da4 sisraid4.sys
Silicon Integrated Systems

548260a7b8654e024dc30bf8a7c5baa4 smb.sys
Microsoft Corporation

a80348ba03e96c70852959655ca3e084 smclib.sys
Microsoft Corporation

b9e31e5cacdfe584f34f730a677803f9 spldr.sys
Microsoft Corporation

fff95479c7ab1550f0750a5d01744211 spsys.sys
Microsoft Corporation

f773d2ed090b7baa1c1a034f3ca476c8 srv2.sys
Microsoft Corporation

26e84d3649019c3244622e654dfcd75b srvnet.sys
Microsoft Corporation

ec8f67289105bf270498095f14963464 srv.sys
Microsoft Corporation

f3817967ed533d08327dc73bc4d5542a stexstor.sys
Promise Technology

141e6f0b54da421b8de146f5ad947760 storport.sys
Microsoft Corporation

8fccbefc5c440b3c23454656e551b09a storvsc.sys
Microsoft Corporation

001cc10fa5e71ae1119115e126c8750d stream.sys
Microsoft Corporation

d01ec09b6711a5f8e7e6564a4d0fbc90 swenum.sys
Microsoft Corporation

6e316c01cba8b785fe495f5cc4f48c6f tape.sys
Microsoft Corporation

76d078af6f587b162d50210f761eb9ed tcpipreg.sys
Microsoft Corporation

912107716bab424c7870e8e6af5e07e1 tcpip.sys
Microsoft Corporation

0ca6fe26acc7ffee1bd0463f40835f32 tdi.sys
Microsoft Corporation

3371d21011695b16333a3934340c4e7c tdpipe.sys
Microsoft Corporation

e4245bda3190a582d55ed09e137401a9 tdtcp.sys
Microsoft Corporation

079125c4b17b01fcaeebce0bcb290c0f tdx.sys
Microsoft Corporation

c448651339196c0e869a355171875522 termdd.sys
Microsoft Corporation

61b96c26131e37b24e93327a0bd1fb95 tssecsrv.sys
Microsoft Corporation

3836171a2cdf3af8ef10856db9835a70 tunnel.sys
Microsoft Corporation

b4dd609bd7e282bfc683cec7eaaaad67 UAGP35.SYS
Microsoft Corporation

d47baead86c65d4f4069d7ce0a4edceb udfs.sys
Microsoft Corporation

4bfe1bc28391222894cbf1e7d0e42320 ULIAGPKX.SYS
Microsoft Corporation

eab6c35e62b1b0db0d1b48b671d3a117 umbus.sys
Microsoft Corporation

b2e8e8cb557b156da5493bbddcc1474d umpass.sys
Microsoft Corporation

d0fe8cb5f84303e73ff0754437fad3d1 usb8023.sys
Microsoft Corporation

aa33fc47ed58c34e6e9261e4f850b7eb usbaapl64.sys
Apple

77b01bc848298223a95d4ec23e1785a1 USBAUDIO.sys
Microsoft Corporation

faec06c1d24e2770ecc4f7c37659824d USBCAMD2.sys
Microsoft Corporation

b26afb54a534d634523c4fb66765b026 usbccgp.sys
Microsoft Corporation

af0892a803fdda7492f595368e3b68e7 usbcir.sys
Microsoft Corporation

63c8d74bed9f80f4dd0aa7a3101eb639 usbd.sys
Microsoft Corporation

2ea4aff7be7eb4632e3aa8595b0803b5 usbehci.sys
Microsoft Corporation

4c9042b8df86c1e8e6240c218b99b39b usbhub.sys
Microsoft Corporation

58e546bbaf87664fc57e0f6081e4f609 usbohci.sys
Microsoft Corporation

a91291136d1e70966645252f6b828711 usbport.sys
Microsoft Corporation

73188f58fb384e75c4063d29413cee3d usbprint.sys
Microsoft Corporation

8f0d9d2ea6cfed2730b5bafb9b5b11c2 usbrpm.sys
Microsoft Corporation

aaa2513c8aed8b54b189fd0c6b1634c0 usbscan.sys
Microsoft Corporation

080d3820da6c046be82fc8b45a893e83 USBSTOR.SYS
Microsoft Corporation

81fb2216d3a60d1284455d511797db3d usbuhci.sys
Microsoft Corporation

d501e12614b00a3252073101d6a1a74b usbvideo.sys
Microsoft Corporation

c5c876ccfc083ff3b128f933823e87bd vdrvroot.sys
Microsoft Corporation

da4da3f5e02943c2dc8c6ed875de68dd vgapnp.sys
Microsoft Corporation

53e92a310193cb3c03bea963de7d9cfc vga.sys
Microsoft Corporation

c82e748660f62a242b2dfac1442f22a4 vhdmp.sys
Microsoft Corporation

e5689d93ffe4e5d66c0178761240dd54 viaide.sys
VIA Technologies

e7353d59c9842bc7299faeb7e7e09340 videoprt.sys
Microsoft Corporation

ae10c35761889e65a6f7176937c5592c VMBusHID.sys
Microsoft Corporation

1501699d7eda984abc4155a7da5738d1 vmbus.sys
Microsoft Corporation

88af6e02ab19df7fd07ecdf9c91e9af6 vms3cap.sys
Microsoft Corporation

ffd7a6f15b14234b5b0e5d49e7961895 vmstorfl.sys
Microsoft Corporation

2b1a3dae2b4e70dbba822b7a03fbd4a3 volmgr.sys
Microsoft Corporation

99b0cbb569ca79acaed8c91461d765fb volmgrx.sys
Microsoft Corporation

58f82eed8ca24b461441f9c3e4f0bf5c volsnap.sys
Microsoft Corporation

5e2016ea6ebaca03c04feac5f330d997 vsmraid.sys
VIA Technologies

36d4720b72b5c5d9cb2b9c29e9df67a1 vwifibus.sys
Microsoft Corporation

6a3d66263414ff0d6fa754c646612f3f vwififlt.sys
Microsoft Corporation

6a638fc4bfddc4d9b186c28c91bd1a01 vwifimp.sys
Microsoft Corporation

4e9440f4f152a7b944cb1663d3935a3e wacompen.sys
Microsoft Corporation

47ca49400643effd3f1c9a27e1d69324 wanarp.sys
Microsoft Corporation

fc438d1430b28618e2d0c7c332a710ad watchdog.sys
Microsoft Corporation

441bd2d7b4f98134c3a4f9fa570fd250 Wdf01000.sys
Microsoft Corporation

1b409454d7a00110fdb06f7e0f155a88 WdfLdr.sys
Microsoft Corporation

72889e16ff12ba0f235467d6091b17dc wd.sys
Microsoft Corporation

611b23304bf067451a9fdee01fbdd725 wfplwf.sys
Microsoft Corporation

05ecaec3e4529a7153b3136ceb49f0ec wimmount.sys
Microsoft Corporation

aaefb9193b31d7eb2425dd3fb6766640 winhv.sys
Microsoft Corporation

817eaff5d38674edd7713b9dfb8e9791 winusb.sys
Microsoft Corporation

f6ff8944478594d0e414d3f048f0d778 wmiacpi.sys
Microsoft Corporation

fc146f46872d4c5b529b89a5131fd1e6 wmilib.sys
Microsoft Corporation

6bcc1d7d2fd2453957c5479a32364e52 ws2ifsl.sys
Microsoft Corporation

7cadc74271dd6461c452c271b30bd378 WUDFPf.sys
Microsoft Corporation

3b197af0fff08aa66b6b2241ca538d64 WUDFRd.sys
Microsoft Corporation



a85b4f2ef3a7304a5399ef0526423040 nvm62x64.sys
NVIDIA Corporation

3e38712941e9bb4ddbee00affe3fed3d nvraid.sys
NVIDIA Corporation

477dc4d6deb99be37084c9ac6d013da1 nvstor.sys
NVIDIA Corporation

1ea3749c4114db3e3161156ffffa6b33 nwifi.sys
Microsoft Corporation

3589478e4b22ce21b41fa1bfc0b8b8a0 ohci1394.sys
Microsoft Corporation

ee992183bd8eaefd9973f352e587a299 pacer.sys
Microsoft Corporation

0086431c29c35be1dbc43f52cc273887 parport.sys
Microsoft Corporation

7daa117143316c4a1537e074a5a9eaf0 partmgr.sys
Microsoft Corporation

b5b8b5ef2e5cb34df8dcf8831e3534fa pciide.sys
Microsoft Corporation

144497daa145ba0f7be896064146c058 pciidex.sys
Microsoft Corporation

f36f6504009f2fb0dfd1b17a116ad74b pci.sys
Microsoft Corporation

b2e81d4e87ce48589f98cb8c05b01f2f pcmcia.sys
Microsoft Corporation

54e013b6d55b81c0aa1ebea80ff42383 PCTCore64.sys
PC Tools

ff43e3b1687e4e2140de6349ea5c7372 pctDS64.sys
PC Tools

60e9a05852af7e9cb11237c00aee4ccf pctEFA64.sys
PC Tools

24b8461b247824e0a8af9671e81a5553 pctgntdi64.sys
PC Tools

db7a3311c4ede70f3115308533ae9fb9 pctplsg64.sys
PC Tools

851bb5d303225970d7a2240bd6e5daf3 pctwfpfilter64.sys
PC Tools

d6b9c2e1a11a3a4b26a182ffef18f603 pcw.sys
Microsoft Corporation

68769c3356b3be5d1c732c97b9a80d6e PEAuth.sys
Microsoft Corporation

32e11315b5126921ffd9074840ef13d3 portcls.sys
Microsoft Corporation

0d922e23c041efb1c3fac2a6f943c9bf processr.sys
Microsoft Corporation

4712cc14e720ecccc0aa16949d18aaf1 PxHlpa64.sys
Sonic Solutions

a53a15a11ebfd21077463ee2c7afeef0 ql2300.sys
QLogic Corporation

4f6d12b51de1aaeff7dc58c4d75423c8 ql40xx.sys
QLogic Corporation

76707bb36430888d9ce9d705398adb6c qwavedrv.sys
Microsoft Corporation

5a0da8ad5762fa2d91678a8a01311704 rasacd.sys
Microsoft Corporation

87a6e852a22991580d6d39adc4790463 rasl2tp.sys
Microsoft Corporation

855c9b1cd4756c5e9a2aa58a15f58c25 raspppoe.sys
Microsoft Corporation

27cc19e81ba5e3403c48302127bda717 raspptp.sys
Microsoft Corporation

e8b1e447b008d07ff47d016c2b0eeecb rassstp.sys
Microsoft Corporation

3bac8142102c15d59a87757c1d41dce5 rdbss.sys
Microsoft Corporation

302da2a0539f2cf54d7c6cc30c1f2d8d rdpbus.sys
Microsoft Corporation

cea6cc257fc9b7715f1c2b4849286d24 RDPCDD.sys
Microsoft Corporation

9706b84dbabfc4b4ca46c5a82b14dfa3 rdpdr.sys
Microsoft Corporation

bb5971a4f00659529a5c44831af22365 RDPENCDD.sys
Microsoft Corporation

216f3fa57533d98e1f74ded70113177a RDPREFMP.sys
Microsoft Corporation

8a3e6bea1c53ea6177fe2b6eba2c80d7 rdpwd.sys
Microsoft Corporation

634b9a2181d98f15941236886164ec8b rdyboost.sys
Microsoft Corporation

77b3b747eb2413072b8e4306018d0c9b rmcast.sys
Microsoft Corporation

fc6d5c50d846b795335deb3fce8b33f3 RNDISMP.sys
Microsoft Corporation

388d3dd1a6457280f3badba9f3acd6b1 rootmdm.sys
Microsoft Corporation

ddc86e4f8e7456261e637e3552e804ff rspndr.sys
Microsoft Corporation

baefee35d27a5440d35092ce10267bec Rt64win7.sys
Realtek Corporation

e3bbb89983daf5622c1d50cf49f28227 sbp2port.sys
Microsoft Corporation

c94da20c7e3ba1dca269bc8460d98387 scfilter.sys
Microsoft Corporation

ad3a6838a059d65fb55d2f61cf0a6c1f scsiport.sys
Microsoft Corporation

3ea8a16169c26afbeb544e0e48421186 secdrv.sys
Macrovision Corporation

cb624c0035412af0debec78c41f5ca1b serenum.sys
Microsoft Corporation

c1d8e28b2c2adfaec4ba89e9fda69bd6 serial.sys
Microsoft Corporation

1c545a7d0691cc4a027396535691c3e3 sermouse.sys
Microsoft Corporation

a554811bcd09279536440c964ae35bbf sffdisk.sys
Microsoft Corporation

ff414f0baefeba59bc6c04b3db0b87bf sffp_mmc.sys
Microsoft Corporation

5588b8c6193eb1522490c122eb94dffa sffp_sd.sys
Microsoft Corporation

a9d601643a1647211a1ee2ec4e433ff4 sfloppy.sys
Microsoft Corporation

d5183ed285d2795491dc15bddcbee5ad Sftfslh.sys
Microsoft Corporation

00f118b68c50d2206dd51634f9142b83 Sftplaylh.sys
Microsoft Corporation

76a827df5640bfe16a0cdbb4108adeca Sftredirlh.sys
Microsoft Corporation

1b4c9701645086bab8cafffce30ed284 Sftvollh.sys
Microsoft Corporation

843caf1e5fde1ffd5ff768f23a51e2e1 sisraid2.sys
Silicon Integrated Systems

6a6c106d42e9ffff8b9fcb4f754f6da4 sisraid4.sys
Silicon Integrated Systems

548260a7b8654e024dc30bf8a7c5baa4 smb.sys
Microsoft Corporation

a80348ba03e96c70852959655ca3e084 smclib.sys
Microsoft Corporation

b9e31e5cacdfe584f34f730a677803f9 spldr.sys
Microsoft Corporation

fff95479c7ab1550f0750a5d01744211 spsys.sys
Microsoft Corporation

f773d2ed090b7baa1c1a034f3ca476c8 srv2.sys
Microsoft Corporation

26e84d3649019c3244622e654dfcd75b srvnet.sys
Microsoft Corporation

ec8f67289105bf270498095f14963464 srv.sys
Microsoft Corporation

f3817967ed533d08327dc73bc4d5542a stexstor.sys
Promise Technology

141e6f0b54da421b8de146f5ad947760 storport.sys
Microsoft Corporation

8fccbefc5c440b3c23454656e551b09a storvsc.sys
Microsoft Corporation

001cc10fa5e71ae1119115e126c8750d stream.sys
Microsoft Corporation

d01ec09b6711a5f8e7e6564a4d0fbc90 swenum.sys
Microsoft Corporation

6e316c01cba8b785fe495f5cc4f48c6f tape.sys
Microsoft Corporation

76d078af6f587b162d50210f761eb9ed tcpipreg.sys
Microsoft Corporation

912107716bab424c7870e8e6af5e07e1 tcpip.sys
Microsoft Corporation

0ca6fe26acc7ffee1bd0463f40835f32 tdi.sys
Microsoft Corporation

3371d21011695b16333a3934340c4e7c tdpipe.sys
Microsoft Corporation

e4245bda3190a582d55ed09e137401a9 tdtcp.sys
Microsoft Corporation

079125c4b17b01fcaeebce0bcb290c0f tdx.sys
Microsoft Corporation

c448651339196c0e869a355171875522 termdd.sys
Microsoft Corporation

61b96c26131e37b24e93327a0bd1fb95 tssecsrv.sys
Microsoft Corporation

3836171a2cdf3af8ef10856db9835a70 tunnel.sys
Microsoft Corporation

b4dd609bd7e282bfc683cec7eaaaad67 UAGP35.SYS
Microsoft Corporation

d47baead86c65d4f4069d7ce0a4edceb udfs.sys
Microsoft Corporation

4bfe1bc28391222894cbf1e7d0e42320 ULIAGPKX.SYS
Microsoft Corporation

eab6c35e62b1b0db0d1b48b671d3a117 umbus.sys
Microsoft Corporation

b2e8e8cb557b156da5493bbddcc1474d umpass.sys
Microsoft Corporation

d0fe8cb5f84303e73ff0754437fad3d1 usb8023.sys
Microsoft Corporation

aa33fc47ed58c34e6e9261e4f850b7eb usbaapl64.sys
Apple

77b01bc848298223a95d4ec23e1785a1 USBAUDIO.sys
Microsoft Corporation

faec06c1d24e2770ecc4f7c37659824d USBCAMD2.sys
Microsoft Corporation

b26afb54a534d634523c4fb66765b026 usbccgp.sys
Microsoft Corporation

af0892a803fdda7492f595368e3b68e7 usbcir.sys
Microsoft Corporation

63c8d74bed9f80f4dd0aa7a3101eb639 usbd.sys
Microsoft Corporation

2ea4aff7be7eb4632e3aa8595b0803b5 usbehci.sys
Microsoft Corporation

4c9042b8df86c1e8e6240c218b99b39b usbhub.sys
Microsoft Corporation

58e546bbaf87664fc57e0f6081e4f609 usbohci.sys
Microsoft Corporation

a91291136d1e70966645252f6b828711 usbport.sys
Microsoft Corporation

73188f58fb384e75c4063d29413cee3d usbprint.sys
Microsoft Corporation

8f0d9d2ea6cfed2730b5bafb9b5b11c2 usbrpm.sys
Microsoft Corporation

aaa2513c8aed8b54b189fd0c6b1634c0 usbscan.sys
Microsoft Corporation

080d3820da6c046be82fc8b45a893e83 USBSTOR.SYS
Microsoft Corporation

81fb2216d3a60d1284455d511797db3d usbuhci.sys
Microsoft Corporation

d501e12614b00a3252073101d6a1a74b usbvideo.sys
Microsoft Corporation

c5c876ccfc083ff3b128f933823e87bd vdrvroot.sys
Microsoft Corporation

da4da3f5e02943c2dc8c6ed875de68dd vgapnp.sys
Microsoft Corporation

53e92a310193cb3c03bea963de7d9cfc vga.sys
Microsoft Corporation

c82e748660f62a242b2dfac1442f22a4 vhdmp.sys
Microsoft Corporation

e5689d93ffe4e5d66c0178761240dd54 viaide.sys
VIA Technologies

e7353d59c9842bc7299faeb7e7e09340 videoprt.sys
Microsoft Corporation

ae10c35761889e65a6f7176937c5592c VMBusHID.sys
Microsoft Corporation

1501699d7eda984abc4155a7da5738d1 vmbus.sys
Microsoft Corporation

88af6e02ab19df7fd07ecdf9c91e9af6 vms3cap.sys
Microsoft Corporation

ffd7a6f15b14234b5b0e5d49e7961895 vmstorfl.sys
Microsoft Corporation

2b1a3dae2b4e70dbba822b7a03fbd4a3 volmgr.sys
Microsoft Corporation

99b0cbb569ca79acaed8c91461d765fb volmgrx.sys
Microsoft Corporation

58f82eed8ca24b461441f9c3e4f0bf5c volsnap.sys
Microsoft Corporation

5e2016ea6ebaca03c04feac5f330d997 vsmraid.sys
VIA Technologies

36d4720b72b5c5d9cb2b9c29e9df67a1 vwifibus.sys
Microsoft Corporation

6a3d66263414ff0d6fa754c646612f3f vwififlt.sys
Microsoft Corporation

6a638fc4bfddc4d9b186c28c91bd1a01 vwifimp.sys
Microsoft Corporation

4e9440f4f152a7b944cb1663d3935a3e wacompen.sys
Microsoft Corporation

47ca49400643effd3f1c9a27e1d69324 wanarp.sys
Microsoft Corporation

fc438d1430b28618e2d0c7c332a710ad watchdog.sys
Microsoft Corporation

441bd2d7b4f98134c3a4f9fa570fd250 Wdf01000.sys
Microsoft Corporation

1b409454d7a00110fdb06f7e0f155a88 WdfLdr.sys
Microsoft Corporation

72889e16ff12ba0f235467d6091b17dc wd.sys
Microsoft Corporation

611b23304bf067451a9fdee01fbdd725 wfplwf.sys
Microsoft Corporation

05ecaec3e4529a7153b3136ceb49f0ec wimmount.sys
Microsoft Corporation

aaefb9193b31d7eb2425dd3fb6766640 winhv.sys
Microsoft Corporation

817eaff5d38674edd7713b9dfb8e9791 winusb.sys
Microsoft Corporation

f6ff8944478594d0e414d3f048f0d778 wmiacpi.sys
Microsoft Corporation

fc146f46872d4c5b529b89a5131fd1e6 wmilib.sys
Microsoft Corporation

6bcc1d7d2fd2453957c5479a32364e52 ws2ifsl.sys
Microsoft Corporation

7cadc74271dd6461c452c271b30bd378 WUDFPf.sys
Microsoft Corporation

3b197af0fff08aa66b6b2241ca538d64 WUDFRd.sys
Microsoft Corporation




Thanks so much. Please let me know what else I can do. I greatly appreciate your help!

Attached Files

  • Attached File  mbr.zip   1.7KB   4 downloads

Edited by PokerHandfull, 22 February 2012 - 11:17 PM.


#6 JSntgRvr

JSntgRvr

    Master Surgeon General


  • Malware Response Team
  • 11,762 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Puerto Rico
  • Local time:06:06 AM

Posted 22 February 2012 - 11:32 PM

The MBR is infected.

Download xPUD_MBRfix and save it in the USB drive.

  • Boot the ailing computer to xPUD
  • Click on the folder that represents your USB drive (sdb1 ?)
  • Double click on xPUD_MBRfix to execute the script and wait.
  • Upon finishes, its actions will produce a report (mlog.txt)
  • Post that report in your next reply
Boot in Normal Mode. If successful, run Combofix as follows:

Please download ComboFix from Here or Here to your Desktop.

**Note: In the event you already have Combofix, this is a new version that I need you to download. It is important that it is saved directly to your desktop**
  • Please, never rename Combofix unless instructed.
  • Close any open browsers.
  • Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

    -----------------------------------------------------------

    • Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before performing a scan. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
    • Click on this link or this link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.

      -----------------------------------------------------------

    • Close any open browsers.
    • WARNING: Combofix will disconnect your machine from the Internet as soon as it starts
    • Please do not attempt to re-connect your machine back to the Internet until Combofix has completely finished.
    • If there is no internet connection after running Combofix, then restart your computer to restore back your connection.

    -----------------------------------------------------------

  • Double click on combofix.exe & follow the prompts.
  • Install the Recovery Console if prompted.
  • When finished, it will produce a report for you.
  • Please post the "C:\ComboFix.txt" .
**Note: Do not mouseclick combofix's window while it's running. That may cause it to stall**

Note: ComboFix may reset a number of Internet Explorer's settings, including making it the default browser.
Note: Combofix prevents autorun of ALL CDs, floppies and USB devices to assist with malware removal & increase security.

Please do not install any new programs or update anything (always allow your antivirus/antispyware to update) unless told to do so while we are fixing your problem. If combofix alerts to a new version and offers to update, please let it. It is essential we always use the latest version.

Edited by JSntgRvr, 22 February 2012 - 11:33 PM.

No request for help throughout private messaging will be attended.

If I have helped you, consider making a donation to help me continue the fight against Malware!
btn_donate_SM.gif


#7 PokerHandfull

PokerHandfull
  • Topic Starter

  • Members
  • 7 posts
  • OFFLINE
  •  
  • Local time:05:06 AM

Posted 23 February 2012 - 10:06 AM

Ok I did the fix, but it wasn't enough to get Windows to boot up. I'm past the blinking cursor situation - now I get a "Starting Windows" screen where an animation starts and freezes as the computer restarts. I can access Windows startup repair but haven't had any positive results. I have not been able to access safe mode. Here are my mlog.txt results.


Thu Feb 23 09:28:15 UTC 2012

User has chosen Windows 7 boot code
User has chosen drive sda
Backing up mbr to backup_sda.bin

Boot code structure before fix
/dev/sda has an x86 boot sector,
it is an unknown boot record

Boot code structure after repairing
/dev/sda has an x86 boot sector,
it is a Microsoft 7 master boot record, like the one this
program creates with the switch -7 on a hard disk device.


I really, really appreciate the help so far.

#8 JSntgRvr

JSntgRvr

    Master Surgeon General


  • Malware Response Team
  • 11,762 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Puerto Rico
  • Local time:06:06 AM

Posted 23 February 2012 - 12:29 PM

Attempt to reach the Advanced Menu now (Tap on F8 during startup to reach the Advanced menu) If successful, follow these steps:

For x32 (x86) bit systems download Farbar Recovery Scan Tool and save it to a flash drive.
For x64 bit systems download Farbar Recovery Scan Tool x64 and save it to a flash drive.

Plug the flashdrive into the infected PC.

Enter System Recovery Options.

To enter System Recovery Options from the Advanced Boot Options:
  • Restart the computer.
  • As soon as the BIOS is loaded begin tapping the F8 key until Advanced Boot Options appears.
  • Click on Repair your computer menu item.
  • Select US as the keyboard language settings, and then click Next.
  • Select the operating system you want to repair, and then click Next.
  • Select your user account and click Next.
On the System Recovery Options menu you will get the following options:

Startup Repair
System Restore
Windows Complete PC Restore
Windows Memory Diagnostic Tool
Command Prompt

  • Select Command Prompt
  • In the command window type in notepad and press Enter.
  • The notepad opens. Under File menu select Open.
  • Select "Computer" and find your flash drive letter and close the notepad.
  • In the command window type e:\frst.exe (for x64 bit version type e:\frst64) and press Enter
    Note: Replace letter e with the drive letter of your flash drive.
  • The tool will start to run.
  • When the tool opens click Yes to disclaimer.
  • Press Scan button.
  • It will make a log (FRST.txt) in the flash drive. Please copy and paste it to your reply.

No request for help throughout private messaging will be attended.

If I have helped you, consider making a donation to help me continue the fight against Malware!
btn_donate_SM.gif


#9 PokerHandfull

PokerHandfull
  • Topic Starter

  • Members
  • 7 posts
  • OFFLINE
  •  
  • Local time:05:06 AM

Posted 23 February 2012 - 01:59 PM

Again, I really appreciate this.

Here is my FRST.txt

Scan result of Farbar Recovery Scan Tool Version: 23-02-2012
Ran by SYSTEM at 2012-02-23 13:55:25
Running from H:\
Windows 7 Ultimate (X64) OS Language: English(US)
The current controlset is ControlSet001

========================== Registry (Whitelisted) =============

HKLM\...\Run: [AdobeAAMUpdater-1.0] "C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe" [499608 2011-03-15] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [WinPatrol] C:\Program Files (x86)\BillP Studios\WinPatrol\winpatrol.exe -expressboot [325512 2011-05-15] (BillP Studios)
HKLM-x32\...\Run: [iTunesHelper] "C:\Program Files (x86)\iTunes\iTunesHelper.exe" [421736 2012-01-16] (Apple Inc.)
HKU\Mcx1-PASTAPETE\...\Winlogon: [Shell] C:\Windows\eHome\McrMgr.exe [343552 2009-07-13] (Microsoft Corporation)
HKU\Rigatoni\...\Run: [LightScribe Control Panel] C:\Program Files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe -hidden [2741616 2011-03-04] (Hewlett-Packard Company)
HKU\Rigatoni\...\Run: [RoboForm] "C:\Program Files (x86)\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe" [107000 2011-09-05] (Siber Systems)
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1

==================== Services (Whitelisted) ======

2 Bonjour Service; "C:\Program Files\Bonjour\mDNSResponder.exe" [462184 2011-08-30] (Apple Inc.)
3 McComponentHostService; "C:\Program Files (x86)\McAfee Security Scan\2.0.181\McCHSvc.exe" [227232 2010-01-15] (McAfee, Inc.)
2 Akamai; c:\program files (x86)\common files\akamai/netsession_win_7de0ed9.dll [x]

========================== Drivers (Whitelisted) =============

3 BridgeMP; C:\Windows\System32\DRIVERS\bridge.sys [95232 2009-07-13] (Microsoft Corporation)
3 MTsensor; C:\Windows\System32\DRIVERS\ASACPI.sys [8192 2005-03-28] ()
3 NVENETFD; C:\Windows\System32\DRIVERS\nvm62x64.sys [408960 2009-06-10] (NVIDIA Corporation)
3 rt61x64; C:\Windows\System32\DRIVERS\netr6164.sys [362496 2006-12-12] (Ralink Technology Inc.)
3 catchme; \??\C:\ComboFix\catchme.sys [x]

========================== NetSvcs (Whitelisted) ===========

============ One Month Created Files and Folders ==============

2012-02-21 07:41 - 2012-02-21 07:41 - 0000000 ____D C:\TDSSKiller_Quarantine
2012-02-21 07:40 - 2012-02-21 07:41 - 0077936 ____A C:\TDSSKiller.2.7.13.0_21.02.2012_10.40.39_log.txt
2012-02-17 15:24 - 2012-02-23 09:34 - 0000000 ___SD C:\ComboFix
2012-02-17 13:47 - 2012-02-23 09:34 - 0000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2012-02-17 13:47 - 2012-02-17 13:47 - 0000000 ____D C:\Users\Rigatoni\AppData\Roaming\Malwarebytes
2012-02-17 13:47 - 2012-02-17 13:47 - 0000000 ____D C:\Users\All Users\Malwarebytes
2012-02-17 13:47 - 2012-02-17 13:47 - 0000000 ____D C:\ProgramData\Malwarebytes
2012-02-17 13:40 - 2012-02-23 09:34 - 0000000 ____D C:\Program Files (x86)\PC Tools Security
2012-02-17 13:40 - 2012-02-17 13:40 - 0000000 ____D C:\Users\Rigatoni\AppData\Roaming\PC Tools
2012-02-17 13:38 - 2012-02-17 13:40 - 0000000 ____D C:\Users\All Users\PC Tools
2012-02-17 13:38 - 2012-02-17 13:40 - 0000000 ____D C:\ProgramData\PC Tools
2012-02-17 13:08 - 2012-02-17 13:08 - 0980480 ____A C:\Users\Rigatoni\Downloads\MicrosoftFixit50267.msi
2012-02-14 21:07 - 2012-02-16 12:29 - 0000000 ____D C:\Users\Rigatoni\AppData\Roaming\.minecraft
2012-02-14 21:06 - 2012-02-14 21:06 - 0270142 ____A C:\Users\Rigatoni\Downloads\Minecraft.exe
2012-02-14 20:55 - 2012-02-23 09:33 - 0000000 __SHD C:\$RECYCLE.BIN
2012-02-14 20:03 - 2012-02-14 20:03 - 0000000 ____D C:\Users\Rigatoni\AppData\Roaming\NVIDIA
2012-02-14 19:56 - 2012-02-23 09:35 - 0000000 ____D C:\users\UpdatusUser
2012-02-14 19:56 - 2012-02-14 19:56 - 0000020 __ASH C:\Users\UpdatusUser\ntuser.ini
2012-02-14 19:56 - 2012-02-14 19:56 - 0000000 __SHD C:\Users\UpdatusUser\Templates
2012-02-14 19:56 - 2012-02-14 19:56 - 0000000 __SHD C:\Users\UpdatusUser\Start Menu
2012-02-14 19:56 - 2012-02-14 19:56 - 0000000 __SHD C:\Users\UpdatusUser\PrintHood
2012-02-14 19:56 - 2012-02-14 19:56 - 0000000 __SHD C:\Users\UpdatusUser\NetHood
2012-02-14 19:56 - 2012-02-14 19:56 - 0000000 __SHD C:\Users\UpdatusUser\My Documents
2012-02-14 19:56 - 2012-02-14 19:56 - 0000000 __SHD C:\Users\UpdatusUser\Documents\My Videos
2012-02-14 19:56 - 2012-02-14 19:56 - 0000000 __SHD C:\Users\UpdatusUser\Documents\My Pictures
2012-02-14 19:56 - 2012-02-14 19:56 - 0000000 __SHD C:\Users\UpdatusUser\Documents\My Music
2012-02-14 19:56 - 2012-02-14 19:56 - 0000000 __SHD C:\Users\UpdatusUser\AppData\Local\Temporary Internet Files
2012-02-14 19:56 - 2012-02-14 19:56 - 0000000 __SHD C:\Users\UpdatusUser\AppData\Local\History
2012-02-14 19:56 - 2012-02-14 19:56 - 0000000 ____D C:\Users\UpdatusUser\AppData\LocalLow
2012-02-14 19:56 - 2012-02-14 19:56 - 0000000 ____D C:\Users\All Users\NVIDIA Corporation
2012-02-14 19:56 - 2012-02-14 19:56 - 0000000 ____D C:\Users\All Users\NVIDIA
2012-02-14 19:56 - 2012-02-14 19:56 - 0000000 ____D C:\ProgramData\NVIDIA Corporation
2012-02-14 19:56 - 2012-02-14 19:56 - 0000000 ____D C:\ProgramData\NVIDIA
2012-02-14 19:56 - 2012-02-14 19:56 - 0000000 ____D C:\Program Files (x86)\NVIDIA Corporation
2012-02-14 19:56 - 2011-10-15 00:53 - 5067584 ____A (NVIDIA Corporation) C:\Windows\System32\nvsvc64.dll
2012-02-14 19:56 - 2011-10-15 00:53 - 1640768 ____A (NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
2012-02-14 19:56 - 2011-10-15 00:53 - 10406208 ____A (NVIDIA Corporation) C:\Windows\System32\nvcpl.dll
2012-02-14 19:56 - 2011-10-15 00:53 - 0837952 ____A (NVIDIA Corporation) C:\Windows\System32\easyupdatusapiu64.dll
2012-02-14 19:56 - 2011-10-15 00:53 - 0222528 ____A (NVIDIA Corporation) C:\Windows\System32\nvmctray.dll
2012-02-14 19:56 - 2011-10-15 00:53 - 0137536 ____A (NVIDIA Corporation) C:\Windows\System32\nvshext.dll
2012-02-14 19:56 - 2011-04-06 20:14 - 0000000 ____D C:\Users\UpdatusUser\AppData\Roaming\Macromedia
2012-02-14 19:56 - 2009-07-13 23:45 - 0000000 ____D C:\Users\UpdatusUser\AppData\Roaming\Media Center Programs
2012-02-14 19:55 - 2011-10-15 00:53 - 7581504 ____A (NVIDIA Corporation) C:\Windows\System32\nvcuda.dll
2012-02-14 19:55 - 2011-10-15 00:53 - 5578560 ____A (NVIDIA Corporation) C:\Windows\SysWOW64\nvcuda.dll
2012-02-14 19:55 - 2011-10-15 00:53 - 2808128 ____A (NVIDIA Corporation) C:\Windows\System32\nvapi64.dll
2012-02-14 19:55 - 2011-10-15 00:53 - 2542912 ____A (NVIDIA Corporation) C:\Windows\System32\nvcuvid.dll
2012-02-14 19:55 - 2011-10-15 00:53 - 24796992 ____A (NVIDIA Corporation) C:\Windows\System32\nvcompiler.dll
2012-02-14 19:55 - 2011-10-15 00:53 - 24742720 ____A (NVIDIA Corporation) C:\Windows\System32\nvoglv64.dll
2012-02-14 19:55 - 2011-10-15 00:53 - 2458432 ____A (NVIDIA Corporation) C:\Windows\SysWOW64\nvapi.dll
2012-02-14 19:55 - 2011-10-15 00:53 - 2401088 ____A (NVIDIA Corporation) C:\Windows\SysWOW64\nvcuvid.dll
2012-02-14 19:55 - 2011-10-15 00:53 - 2232128 ____A (NVIDIA Corporation) C:\Windows\System32\nvcuvenc.dll
2012-02-14 19:55 - 2011-10-15 00:53 - 2099520 ____A (NVIDIA Corporation) C:\Windows\SysWOW64\nvcuvenc.dll
2012-02-14 19:55 - 2011-10-15 00:53 - 18871616 ____A (NVIDIA Corporation) C:\Windows\SysWOW64\nvoglv32.dll
2012-02-14 19:55 - 2011-10-15 00:53 - 17248576 ____A (NVIDIA Corporation) C:\Windows\SysWOW64\nvcompiler.dll
2012-02-14 19:55 - 2011-10-15 00:53 - 1533248 ____A (NVIDIA Corporation) C:\Windows\System32\nvdispco64.dll
2012-02-14 19:55 - 2011-10-15 00:53 - 1454400 ____A (NVIDIA Corporation) C:\Windows\System32\nvgenco64.dll
2012-02-14 19:55 - 2011-10-15 00:53 - 12971840 ____A (NVIDIA Corporation) C:\Windows\System32\Drivers\nvlddmkm.sys
2012-02-14 19:55 - 2011-10-15 00:53 - 0068928 ____A (Khronos Group) C:\Windows\System32\OpenCL.dll
2012-02-14 19:55 - 2011-10-15 00:53 - 0061248 ____A (Khronos Group) C:\Windows\SysWOW64\OpenCL.dll
2012-02-14 19:55 - 2011-10-15 00:53 - 0007384 ____A C:\Windows\System32\nvinfo.pb
2012-02-14 19:13 - 2011-06-25 22:45 - 0256000 ____A C:\Windows\PEV.exe
2012-02-14 19:13 - 2010-11-07 09:20 - 0208896 ____A C:\Windows\MBR.exe
2012-02-14 19:13 - 2009-04-19 20:56 - 0060416 ____A (NirSoft) C:\Windows\NIRCMD.exe
2012-02-14 19:13 - 2000-08-30 16:00 - 0518144 ____A (SteelWerX) C:\Windows\SWREG.exe
2012-02-14 19:13 - 2000-08-30 16:00 - 0406528 ____A (SteelWerX) C:\Windows\SWSC.exe
2012-02-14 19:13 - 2000-08-30 16:00 - 0098816 ____A C:\Windows\sed.exe
2012-02-14 19:13 - 2000-08-30 16:00 - 0080412 ____A C:\Windows\grep.exe
2012-02-14 19:13 - 2000-08-30 16:00 - 0068096 ____A C:\Windows\zip.exe
2012-02-14 19:12 - 2012-02-14 19:11 - 4403246 ___RA (Swearware) C:\Users\Rigatoni\Desktop\ComboFix.exe
2012-02-14 18:56 - 2012-02-14 19:56 - 0000000 ____D C:\Program Files\NVIDIA Corporation
2012-02-14 18:50 - 2012-02-14 18:50 - 0909088 ____A (Sun Microsystems, Inc.) C:\Users\Rigatoni\Downloads\jxpiinstall.exe
2012-02-14 18:48 - 2012-02-14 18:49 - 0000000 ____D C:\Users\Rigatoni\Downloads\MineCraft 1.0.0
2012-02-14 18:45 - 2012-02-23 09:33 - 0000000 ____D C:\NVIDIA
2012-02-14 18:04 - 2012-02-05 19:41 - 53545909 ____A () C:\Users\Rigatoni\Desktop\minecraft cracked istaller v1.0.0.exe
2012-02-14 18:03 - 2012-02-14 18:03 - 0000000 ____D C:\Users\Rigatoni\Downloads\Minecraft Installer Cracked Easy Install + ServerList
2012-02-14 18:03 - 2012-02-07 08:52 - 0004820 ____A C:\Users\Rigatoni\Desktop\README.txt
2012-02-14 18:02 - 2012-02-14 18:02 - 53548372 ____A C:\Users\Rigatoni\Downloads\Minecraft Installer Cracked Easy Install + ServerList.rar
2012-02-14 17:57 - 2012-02-14 18:42 - 155182440 ____A (NVIDIA Corporation) C:\Users\Rigatoni\Downloads\285.62-desktop-win7-winvista-64bit-english-whql.exe
2012-02-14 17:56 - 2012-02-14 17:56 - 0000000 ____D C:\Users\Rigatoni\AppData\Roaming\SystemRequirementsLab
2012-02-08 10:41 - 2012-02-08 10:41 - 0135818 ____A C:\Users\Rigatoni\Downloads\chopgrmenu.pdf
2012-02-07 11:53 - 2012-02-07 11:53 - 1200936 ____A C:\Users\Rigatoni\Downloads\wgt624_4_2_11_1_0_1.chk
2012-02-02 18:44 - 2012-02-02 18:44 - 0000000 ____D C:\Users\Rigatoni\Downloads\Make Money Using Torrent Sites Xvid [Audio]
2012-02-02 18:25 - 2012-02-02 18:25 - 0000000 ____D C:\Users\Rigatoni\Downloads\500 Million Ways to Make Money on Facebook
2012-02-02 18:24 - 2012-02-02 18:24 - 0000000 ____D C:\Users\Rigatoni\Downloads\21 Income Streams- Multiple Ways to Make Money Online[Team Nanban][TPB]
2012-02-01 23:21 - 2012-02-01 23:21 - 0291624 ____A C:\Windows\Minidump\020212-31262-01.dmp
2012-01-28 16:07 - 2012-01-28 16:51 - 0000000 ____D C:\Users\Rigatoni\Desktop\New folder (2)
2012-01-25 22:43 - 2012-01-25 22:43 - 0001200 ____A C:\Users\Rigatoni\Desktop\55.csv
2012-01-25 22:42 - 2012-01-25 22:42 - 0000047 ____A C:\Users\Rigatoni\Desktop\44.csv
2012-01-25 09:39 - 2012-01-25 09:42 - 7207708 ____A C:\Users\Rigatoni\Desktop\JobsFLV.flv
2012-01-25 09:35 - 2012-01-25 09:37 - 1249514904 ____A C:\Users\Rigatoni\Desktop\avi.avi
2012-01-25 09:30 - 2012-01-25 09:32 - 1365208 ____A C:\Users\Rigatoni\Desktop\Comp 1.mp4
2012-01-25 09:27 - 2012-01-25 09:27 - 0003828 ____A C:\Users\Rigatoni\Desktop\JobsAllOver.com.xmp
2012-01-25 09:25 - 2012-01-25 09:27 - 13434405 ____A C:\Users\Rigatoni\Desktop\JobsAllOver.com.m2v
2012-01-25 09:22 - 2012-01-25 09:24 - 2488394068 ____A C:\Users\Rigatoni\Downloads\Comp 1_1.avi
2012-01-25 09:14 - 2012-01-25 09:17 - 3317831028 ____A C:\Users\Rigatoni\Downloads\Comp 1.avi
2012-01-25 08:41 - 2012-01-25 08:59 - 33410726 ____A C:\Users\Rigatoni\Downloads\JobsAllOver.mov
2012-01-24 07:05 - 2012-01-24 07:05 - 0001199 ____A C:\Users\Rigatoni\Desktop\hh.csv


============ 3 Months Modified Files and Folders =============

2012-02-23 13:55 - 2012-02-23 13:55 - 0000000 ____D C:\FRST
2012-02-23 09:35 - 2012-02-14 19:56 - 0000000 ____D C:\users\UpdatusUser
2012-02-23 09:35 - 2011-12-08 09:28 - 0000000 ____D C:\Windows\ERDNT
2012-02-23 09:35 - 2011-11-10 06:13 - 0000000 ____D C:\Users\Rigatoni\AppData\Roaming\WinPatrol
2012-02-23 09:35 - 2011-06-17 16:40 - 0000000 ____D C:\users\Mcx1-PASTAPETE
2012-02-23 09:35 - 2011-04-06 18:54 - 0000000 ____D C:\Program Files (x86)\Mozilla Firefox
2012-02-23 09:35 - 2011-04-06 18:51 - 0000000 ____D C:\users\Rigatoni
2012-02-23 09:34 - 2012-02-17 15:24 - 0000000 ___SD C:\ComboFix
2012-02-23 09:34 - 2012-02-17 13:47 - 0000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2012-02-23 09:34 - 2012-02-17 13:40 - 0000000 ____D C:\Program Files (x86)\PC Tools Security
2012-02-23 09:34 - 2012-01-19 19:16 - 0000000 ____D C:\Program Files (x86)\B3B5D
2012-02-23 09:34 - 2011-12-18 12:02 - 0000000 ____D C:\Windows\System32\Macromed
2012-02-23 09:34 - 2009-07-13 21:37 - 0000000 ____D C:\Windows\SysWOW64\winrm
2012-02-23 09:34 - 2009-07-13 21:37 - 0000000 ____D C:\Windows\System32\winrm
2012-02-23 09:34 - 2009-07-13 21:37 - 0000000 ____D C:\Windows\System32\WCN
2012-02-23 09:34 - 2009-07-13 21:32 - 0000000 ____D C:\Windows\System32\WindowsPowerShell
2012-02-23 09:34 - 2009-07-13 21:32 - 0000000 ____D C:\Windows\System32\WinBioPlugIns
2012-02-23 09:34 - 2009-07-13 21:32 - 0000000 ____D C:\Windows\Performance
2012-02-23 09:34 - 2009-07-13 20:45 - 0000000 ____D C:\Windows\ServiceProfiles
2012-02-23 09:34 - 2009-07-13 19:20 - 0000000 ____D C:\Windows\Vss
2012-02-23 09:34 - 2009-07-13 19:20 - 0000000 ____D C:\Windows\SysWOW64\Dism
2012-02-23 09:34 - 2009-07-13 19:20 - 0000000 ____D C:\Windows\SysWOW64\com
2012-02-23 09:34 - 2009-07-13 19:20 - 0000000 ____D C:\Windows\System32\sysprep
2012-02-23 09:34 - 2009-07-13 19:20 - 0000000 ____D C:\Windows\System32\Dism
2012-02-23 09:34 - 2009-07-13 19:20 - 0000000 ____D C:\Windows\System32\com
2012-02-23 09:34 - 2009-07-13 19:20 - 0000000 ____D C:\Windows\registration
2012-02-23 09:33 - 2012-02-14 20:55 - 0000000 __SHD C:\$RECYCLE.BIN
2012-02-23 09:33 - 2012-02-14 18:45 - 0000000 ____D C:\NVIDIA
2012-02-23 09:33 - 2011-12-07 16:35 - 0000000 ____D C:\Users\Rigatoni\Desktop\Adobe CS5
2012-02-23 09:33 - 2011-12-07 05:05 - 0000000 ____D C:\Users\Rigatoni\Documents\Adobe Flash Professional CS5.5
2012-02-23 09:33 - 2011-12-06 16:06 - 0000000 ____D C:\Users\Rigatoni\AppData\Local\WBFSManager
2012-02-23 09:33 - 2011-12-06 16:05 - 0000000 ____D C:\Program Files\WBFS
2012-02-23 09:33 - 2011-11-10 06:13 - 0000000 ____D C:\Program Files (x86)\BillP Studios
2012-02-23 09:33 - 2011-09-13 16:57 - 0000000 ____D C:\Program Files (x86)\StarCraft II
2012-02-23 09:33 - 2011-09-12 06:51 - 0000000 ____D C:\Users\Rigatoni\AppData\Roaming\Canon
2012-02-23 09:33 - 2011-09-12 06:43 - 0000000 ____D C:\Program Files (x86)\Canon
2012-02-23 09:33 - 2011-09-11 10:47 - 0000000 ____D C:\Program Files (x86)\Apple Software Update
2012-02-23 09:33 - 2011-09-11 10:46 - 0000000 ____D C:\Users\All Users\Apple
2012-02-23 09:33 - 2011-09-11 10:46 - 0000000 ____D C:\ProgramData\Apple
2012-02-23 09:33 - 2011-09-11 10:46 - 0000000 ____D C:\Program Files\Common Files\Apple
2012-02-23 09:33 - 2011-09-05 11:50 - 0000000 ____D C:\Program Files (x86)\McAfee Security Scan
2012-02-23 09:33 - 2011-09-04 10:54 - 0000000 ____D C:\Program Files (x86)\DVDStyler
2012-02-23 09:33 - 2011-07-29 16:55 - 0000000 ____D C:\Program Files (x86)\RALINK
2012-02-23 09:33 - 2011-07-20 07:52 - 0000000 ____D C:\Program Files (x86)\Gabest
2012-02-23 09:33 - 2011-06-17 16:40 - 0000000 ____D C:\Users\Mcx1-PASTAPETE\AppData\Roaming\Macromedia
2012-02-23 09:33 - 2011-04-23 11:52 - 0000000 ____D C:\Program Files\WinRAR
2012-02-23 09:33 - 2011-04-06 20:11 - 0000000 ____D C:\Users\Rigatoni\AppData\Roaming\Macromedia
2012-02-23 09:33 - 2011-04-06 18:54 - 0000000 ____D C:\Users\Rigatoni\AppData\Roaming\Mozilla
2012-02-23 09:33 - 2011-04-06 18:54 - 0000000 ____D C:\Users\Rigatoni\AppData\Local\Mozilla
2012-02-23 09:33 - 2011-03-02 21:36 - 0000000 ____D C:\Qoobox
2012-02-23 09:33 - 2009-07-13 19:20 - 0000000 ___RD C:\users\Public
2012-02-23 09:33 - 2009-07-13 19:20 - 0000000 ___RD C:\users\Default
2012-02-23 09:33 - 2009-07-13 19:20 - 0000000 ___AD C:\Program Files\Common Files\Microsoft Shared
2012-02-23 09:33 - 2009-07-13 19:20 - 0000000 ____D C:\Windows\Branding
2012-02-23 09:33 - 2009-07-13 19:20 - 0000000 ____D C:\Windows\AppCompat
2012-02-23 09:33 - 2009-07-13 10:23 - 0000000 ____D C:\Users\Rigatoni\Desktop\Wii
2012-02-21 07:41 - 2012-02-21 07:41 - 0000000 ____D C:\TDSSKiller_Quarantine
2012-02-21 07:41 - 2012-02-21 07:40 - 0077936 ____A C:\TDSSKiller.2.7.13.0_21.02.2012_10.40.39_log.txt
2012-02-21 07:14 - 2011-03-05 11:28 - 535732224 __ASH C:\hiberfil.sys
2012-02-17 13:47 - 2012-02-17 13:47 - 0000000 ____D C:\Users\Rigatoni\AppData\Roaming\Malwarebytes
2012-02-17 13:47 - 2012-02-17 13:47 - 0000000 ____D C:\Users\All Users\Malwarebytes
2012-02-17 13:47 - 2012-02-17 13:47 - 0000000 ____D C:\ProgramData\Malwarebytes
2012-02-17 13:40 - 2012-02-17 13:40 - 0000000 ____D C:\Users\Rigatoni\AppData\Roaming\PC Tools
2012-02-17 13:40 - 2012-02-17 13:38 - 0000000 ____D C:\Users\All Users\PC Tools
2012-02-17 13:40 - 2012-02-17 13:38 - 0000000 ____D C:\ProgramData\PC Tools
2012-02-17 13:08 - 2012-02-17 13:08 - 0980480 ____A C:\Users\Rigatoni\Downloads\MicrosoftFixit50267.msi
2012-02-17 13:02 - 2012-01-20 08:55 - 0001376 ____A C:\Windows\System32\Drivers\etc\hosts.umbrella
2012-02-17 12:28 - 2011-04-07 00:38 - 1667497 ____A C:\Windows\WindowsUpdate.log
2012-02-17 11:27 - 2011-12-08 07:19 - 0000348 ____A C:\Windows\Tasks\At29.job
2012-02-17 10:27 - 2011-12-08 07:19 - 0000348 ____A C:\Windows\Tasks\At27.job
2012-02-17 06:27 - 2011-12-08 07:19 - 0000348 ____A C:\Windows\Tasks\At19.job
2012-02-17 01:27 - 2011-12-08 07:19 - 0000348 ____A C:\Windows\Tasks\At9.job
2012-02-17 00:27 - 2011-12-08 07:19 - 0000348 ____A C:\Windows\Tasks\At7.job
2012-02-16 23:27 - 2011-12-08 07:19 - 0000348 ____A C:\Windows\Tasks\At5.job
2012-02-16 20:27 - 2011-12-08 07:19 - 0000348 ____A C:\Windows\Tasks\At47.job
2012-02-16 19:27 - 2011-12-08 07:19 - 0000348 ____A C:\Windows\Tasks\At45.job
2012-02-16 18:27 - 2011-12-08 07:19 - 0000348 ____A C:\Windows\Tasks\At43.job
2012-02-16 16:27 - 2011-12-08 07:19 - 0000348 ____A C:\Windows\Tasks\At39.job
2012-02-16 15:27 - 2011-12-08 07:19 - 0000348 ____A C:\Windows\Tasks\At37.job
2012-02-16 14:27 - 2011-12-08 07:19 - 0000348 ____A C:\Windows\Tasks\At35.job
2012-02-16 13:27 - 2011-12-08 07:19 - 0000348 ____A C:\Windows\Tasks\At33.job
2012-02-16 12:29 - 2012-02-14 21:07 - 0000000 ____D C:\Users\Rigatoni\AppData\Roaming\.minecraft
2012-02-16 10:40 - 2009-07-13 20:45 - 0016624 ____A C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2012-02-16 10:40 - 2009-07-13 20:45 - 0016624 ____A C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2012-02-16 10:32 - 2011-04-08 13:03 - 0025590 ____A C:\Windows\PFRO.log
2012-02-16 10:32 - 2009-07-13 21:08 - 0000006 ___AH C:\Windows\Tasks\SA.DAT
2012-02-16 10:32 - 2009-07-13 20:51 - 0029181 ____A C:\Windows\setupact.log
2012-02-14 21:50 - 2011-07-13 08:45 - 0000000 ____D C:\Users\Rigatoni\AppData\Roaming\uTorrent
2012-02-14 21:06 - 2012-02-14 21:06 - 0270142 ____A C:\Users\Rigatoni\Downloads\Minecraft.exe
2012-02-14 20:03 - 2012-02-14 20:03 - 0000000 ____D C:\Users\Rigatoni\AppData\Roaming\NVIDIA
2012-02-14 19:56 - 2012-02-14 19:56 - 0000020 __ASH C:\Users\UpdatusUser\ntuser.ini
2012-02-14 19:56 - 2012-02-14 19:56 - 0000000 __SHD C:\Users\UpdatusUser\Templates
2012-02-14 19:56 - 2012-02-14 19:56 - 0000000 __SHD C:\Users\UpdatusUser\Start Menu
2012-02-14 19:56 - 2012-02-14 19:56 - 0000000 __SHD C:\Users\UpdatusUser\PrintHood
2012-02-14 19:56 - 2012-02-14 19:56 - 0000000 __SHD C:\Users\UpdatusUser\NetHood
2012-02-14 19:56 - 2012-02-14 19:56 - 0000000 __SHD C:\Users\UpdatusUser\My Documents
2012-02-14 19:56 - 2012-02-14 19:56 - 0000000 __SHD C:\Users\UpdatusUser\Documents\My Videos
2012-02-14 19:56 - 2012-02-14 19:56 - 0000000 __SHD C:\Users\UpdatusUser\Documents\My Pictures
2012-02-14 19:56 - 2012-02-14 19:56 - 0000000 __SHD C:\Users\UpdatusUser\Documents\My Music
2012-02-14 19:56 - 2012-02-14 19:56 - 0000000 __SHD C:\Users\UpdatusUser\AppData\Local\Temporary Internet Files
2012-02-14 19:56 - 2012-02-14 19:56 - 0000000 __SHD C:\Users\UpdatusUser\AppData\Local\History
2012-02-14 19:56 - 2012-02-14 19:56 - 0000000 ____D C:\Users\UpdatusUser\AppData\LocalLow
2012-02-14 19:56 - 2012-02-14 19:56 - 0000000 ____D C:\Users\All Users\NVIDIA Corporation
2012-02-14 19:56 - 2012-02-14 19:56 - 0000000 ____D C:\Users\All Users\NVIDIA
2012-02-14 19:56 - 2012-02-14 19:56 - 0000000 ____D C:\ProgramData\NVIDIA Corporation
2012-02-14 19:56 - 2012-02-14 19:56 - 0000000 ____D C:\ProgramData\NVIDIA
2012-02-14 19:56 - 2012-02-14 19:56 - 0000000 ____D C:\Program Files (x86)\NVIDIA Corporation
2012-02-14 19:56 - 2012-02-14 18:56 - 0000000 ____D C:\Program Files\NVIDIA Corporation
2012-02-14 19:56 - 2009-07-13 19:20 - 0000000 ____D C:\Windows\Help
2012-02-14 19:49 - 2009-07-13 18:34 - 0000215 ____A C:\Windows\system.ini
2012-02-14 19:26 - 2011-06-17 15:54 - 0000258 _RASH C:\Users\All Users\ntuser.pol
2012-02-14 19:26 - 2011-06-17 15:54 - 0000258 _RASH C:\ProgramData\ntuser.pol
2012-02-14 19:11 - 2012-02-14 19:12 - 4403246 ___RA (Swearware) C:\Users\Rigatoni\Desktop\ComboFix.exe
2012-02-14 19:05 - 2011-12-31 12:37 - 0222700 ____A C:\Windows\ntbtlog.txt
2012-02-14 18:50 - 2012-02-14 18:50 - 0909088 ____A (Sun Microsystems, Inc.) C:\Users\Rigatoni\Downloads\jxpiinstall.exe
2012-02-14 18:49 - 2012-02-14 18:48 - 0000000 ____D C:\Users\Rigatoni\Downloads\MineCraft 1.0.0
2012-02-14 18:42 - 2012-02-14 17:57 - 155182440 ____A (NVIDIA Corporation) C:\Users\Rigatoni\Downloads\285.62-desktop-win7-winvista-64bit-english-whql.exe
2012-02-14 18:03 - 2012-02-14 18:03 - 0000000 ____D C:\Users\Rigatoni\Downloads\Minecraft Installer Cracked Easy Install + ServerList
2012-02-14 18:02 - 2012-02-14 18:02 - 53548372 ____A C:\Users\Rigatoni\Downloads\Minecraft Installer Cracked Easy Install + ServerList.rar
2012-02-14 17:56 - 2012-02-14 17:56 - 0000000 ____D C:\Users\Rigatoni\AppData\Roaming\SystemRequirementsLab
2012-02-13 13:39 - 2009-07-13 21:13 - 0714754 ____A C:\Windows\System32\PerfStringBackup.INI
2012-02-08 10:41 - 2012-02-08 10:41 - 0135818 ____A C:\Users\Rigatoni\Downloads\chopgrmenu.pdf
2012-02-07 11:53 - 2012-02-07 11:53 - 1200936 ____A C:\Users\Rigatoni\Downloads\wgt624_4_2_11_1_0_1.chk
2012-02-07 08:52 - 2012-02-14 18:03 - 0004820 ____A C:\Users\Rigatoni\Desktop\README.txt
2012-02-06 08:36 - 2012-01-12 08:02 - 0000000 ____D C:\Users\Rigatoni\Desktop\Jobs All Over
2012-02-05 19:41 - 2012-02-14 18:04 - 53545909 ____A () C:\Users\Rigatoni\Desktop\minecraft cracked istaller v1.0.0.exe
2012-02-02 18:44 - 2012-02-02 18:44 - 0000000 ____D C:\Users\Rigatoni\Downloads\Make Money Using Torrent Sites Xvid [Audio]
2012-02-02 18:25 - 2012-02-02 18:25 - 0000000 ____D C:\Users\Rigatoni\Downloads\500 Million Ways to Make Money on Facebook
2012-02-02 18:24 - 2012-02-02 18:24 - 0000000 ____D C:\Users\Rigatoni\Downloads\21 Income Streams- Multiple Ways to Make Money Online[Team Nanban][TPB]
2012-02-01 23:21 - 2012-02-01 23:21 - 0291624 ____A C:\Windows\Minidump\020212-31262-01.dmp
2012-02-01 23:21 - 2011-07-18 15:15 - 625716170 ____A C:\Windows\MEMORY.DMP
2012-02-01 23:21 - 2011-07-18 15:15 - 0000000 ____D C:\Windows\Minidump
2012-01-28 16:51 - 2012-01-28 16:07 - 0000000 ____D C:\Users\Rigatoni\Desktop\New folder (2)
2012-01-28 15:23 - 2012-01-22 11:25 - 0000000 ____D C:\Users\Rigatoni\Downloads\Dangerous Minds 1995 DvDrip[Eng]-greenbud1969
2012-01-25 22:43 - 2012-01-25 22:43 - 0001200 ____A C:\Users\Rigatoni\Desktop\55.csv
2012-01-25 22:42 - 2012-01-25 22:42 - 0000047 ____A C:\Users\Rigatoni\Desktop\44.csv
2012-01-25 09:43 - 2011-04-06 20:11 - 0000000 ____D C:\Users\Rigatoni\AppData\Roaming\Adobe
2012-01-25 09:42 - 2012-01-25 09:39 - 7207708 ____A C:\Users\Rigatoni\Desktop\JobsFLV.flv
2012-01-25 09:37 - 2012-01-25 09:35 - 1249514904 ____A C:\Users\Rigatoni\Desktop\avi.avi
2012-01-25 09:32 - 2012-01-25 09:30 - 1365208 ____A C:\Users\Rigatoni\Desktop\Comp 1.mp4
2012-01-25 09:27 - 2012-01-25 09:27 - 0003828 ____A C:\Users\Rigatoni\Desktop\JobsAllOver.com.xmp
2012-01-25 09:27 - 2012-01-25 09:25 - 13434405 ____A C:\Users\Rigatoni\Desktop\JobsAllOver.com.m2v
2012-01-25 09:24 - 2012-01-25 09:22 - 2488394068 ____A C:\Users\Rigatoni\Downloads\Comp 1_1.avi
2012-01-25 09:17 - 2012-01-25 09:14 - 3317831028 ____A C:\Users\Rigatoni\Downloads\Comp 1.avi
2012-01-25 08:59 - 2012-01-25 08:41 - 33410726 ____A C:\Users\Rigatoni\Downloads\JobsAllOver.mov
2012-01-25 08:45 - 2011-05-06 14:02 - 0000000 ____D C:\Users\Rigatoni\AppData\Roaming\vlc
2012-01-25 08:44 - 2011-09-11 10:48 - 0000000 ____D C:\Users\Rigatoni\AppData\Local\Apple Computer
2012-01-24 18:17 - 2012-01-22 19:14 - 0000000 ____D C:\Users\Rigatoni\AppData\Roaming\CoreFTP
2012-01-24 07:05 - 2012-01-24 07:05 - 0001199 ____A C:\Users\Rigatoni\Desktop\hh.csv
2012-01-24 07:05 - 2011-08-18 07:21 - 0000000 ____D C:\Users\Rigatoni\AppData\Roaming\SoftGrid Client
2012-01-23 17:17 - 2012-01-23 17:17 - 0008714 ____A C:\Users\Rigatoni\Downloads\Fpoll.zip
2012-01-22 20:19 - 2012-01-22 20:19 - 0717271 ____A C:\Users\Rigatoni\Downloads\How to Setup an Elite Proxy Server.rar
2012-01-22 17:30 - 2012-01-22 17:30 - 0000000 __SHD C:\Windows\SysWOW64\%USERPROFILE%
2012-01-22 11:26 - 2011-04-19 13:02 - 0000000 ____D C:\Users\Rigatoni\AppData\Roaming\GrabIt
2012-01-22 11:23 - 2011-04-23 11:50 - 0000000 ____D C:\Users\Rigatoni\AppData\Local\QuickPar
2012-01-22 11:15 - 2011-04-19 13:02 - 0000000 ____D C:\Users\Rigatoni\Downloads\GrabIt Downloads
2012-01-21 22:00 - 2011-08-31 14:50 - 0000000 ____D C:\Users\Rigatoni\AppData\Local\ElevatedDiagnostics
2012-01-21 09:36 - 2012-01-21 09:36 - 0001513 ____A C:\Users\Rigatoni\Downloads\gplus.png
2012-01-21 09:36 - 2012-01-21 09:36 - 0000991 ____A C:\Users\Rigatoni\Downloads\facebook.png
2012-01-21 09:35 - 2012-01-21 09:35 - 0001937 ____A C:\Users\Rigatoni\Downloads\Twitter.png
2012-01-21 07:29 - 2012-01-21 07:29 - 0000776 ____A C:\Users\Rigatoni\Desktop\Core FTP LE.lnk
2012-01-21 07:29 - 2012-01-21 07:29 - 0000000 ____D C:\Program Files (x86)\CoreFTP
2012-01-21 07:28 - 2012-01-21 07:28 - 4496398 ____A C:\Users\Rigatoni\Downloads\coreftplite.exe
2012-01-21 07:26 - 2012-01-21 07:26 - 4518720 ____A (FileZilla Project) C:\Users\Rigatoni\Downloads\FileZilla_3.5.3_win32-setup.exe
2012-01-20 10:51 - 2009-07-13 18:34 - 46137344 ____A C:\Windows\System32\config\SOFTWARE.bak
2012-01-20 10:51 - 2009-07-13 18:34 - 13631488 ____A C:\Windows\System32\config\SYSTEM.bak
2012-01-20 10:51 - 2009-07-13 18:34 - 0786432 ____A C:\Windows\System32\config\DEFAULT.bak
2012-01-20 10:51 - 2009-07-13 18:34 - 0065536 ____A C:\Windows\System32\config\SAM.bak
2012-01-20 10:51 - 2009-07-13 18:34 - 0024576 ____A C:\Windows\System32\config\SECURITY.bak
2012-01-20 10:00 - 2012-01-20 08:09 - 0000000 ____D C:\Users\Rigatoni\AppData\Roaming\redsn0w
2012-01-20 09:11 - 2012-01-20 08:55 - 0109419 ____A C:\Users\Rigatoni\umbrella0.log
2012-01-20 09:11 - 2012-01-20 08:55 - 0109419 ____A C:\Users\Rigatoni\Downloads\umbrella.log
2012-01-20 08:55 - 2012-01-20 08:55 - 2246144 ____A () C:\Users\Rigatoni\Downloads\tinyumbrella-5.10.06(2).exe
2012-01-20 08:55 - 2012-01-20 08:55 - 0463215 ____A C:\Users\Rigatoni\Downloads\fixrecovery-win(1).zip
2012-01-20 08:55 - 2012-01-20 08:55 - 0000000 ____D C:\Users\Rigatoni\Downloads\fixrecovery-win(1)
2012-01-20 08:55 - 2012-01-20 08:55 - 0000000 ____D C:\Users\Rigatoni\.shsh
2012-01-20 08:50 - 2012-01-20 08:50 - 0480165 ____A C:\Users\Rigatoni\Downloads\RecBoot.zip
2012-01-20 08:50 - 2012-01-20 08:50 - 0000000 ____D C:\Users\Rigatoni\Downloads\RecBoot
2012-01-20 08:46 - 2012-01-20 08:46 - 0463215 ____A C:\Users\Rigatoni\Downloads\fixrecovery-win.zip
2012-01-20 08:46 - 2012-01-20 08:46 - 0000000 ____A C:\Users\Rigatoni\Downloads\tinyumbrella-5.10.06(1).exe
2012-01-20 08:45 - 2012-01-20 08:45 - 0000000 ____A C:\Users\Rigatoni\Downloads\tinyumbrella-5.10.06.exe
2012-01-20 08:33 - 2012-01-20 08:33 - 0398715 ____A C:\Users\Rigatoni\Downloads\iREB-r5.zip
2012-01-20 08:13 - 2012-01-20 08:12 - 695695299 ____A C:\Users\Rigatoni\Downloads\NO_BB_OLDROM_iPhone2,1_5.0.1_9A405_Restore.ipsw
2012-01-20 08:06 - 2011-09-11 10:48 - 0000000 ____D C:\Users\Rigatoni\AppData\Roaming\Apple Computer
2012-01-20 07:59 - 2012-01-20 07:59 - 0001784 ____A C:\Users\Public\Desktop\iTunes.lnk
2012-01-20 07:59 - 2012-01-20 07:58 - 0000000 ____D C:\Program Files\iTunes
2012-01-20 07:59 - 2012-01-20 07:58 - 0000000 ____D C:\Program Files (x86)\iTunes
2012-01-20 07:58 - 2012-01-20 07:58 - 0000000 ____D C:\Program Files\iPod
2012-01-20 07:58 - 2011-09-11 10:47 - 0000000 ____D C:\Users\All Users\Apple Computer
2012-01-20 07:58 - 2011-09-11 10:47 - 0000000 ____D C:\ProgramData\Apple Computer
2012-01-20 07:56 - 2012-01-20 07:56 - 0000000 ____D C:\Program Files\Bonjour
2012-01-20 07:56 - 2012-01-20 07:56 - 0000000 ____D C:\Program Files (x86)\Bonjour
2012-01-20 07:53 - 2012-01-20 07:44 - 718181968 ____A C:\Users\Rigatoni\Downloads\iPhone2,1_5.0.1_9A405_Restore.ipsw
2012-01-20 07:46 - 2012-01-20 07:45 - 14820003 ____A C:\Users\Rigatoni\Downloads\redsn0w_win_0.9.10b4.zip
2012-01-20 07:46 - 2012-01-20 07:44 - 71279472 ____A (Apple Inc.) C:\Users\Rigatoni\Downloads\iTunes64Setup.exe
2012-01-19 21:36 - 2012-01-19 21:36 - 0147835 ____A C:\Users\Rigatoni\Desktop\JobsMarketingImage2.jpg
2012-01-19 21:36 - 2012-01-10 20:20 - 1181160 ____A C:\Users\Rigatoni\Desktop\JobsMarketingImage.psd
2012-01-19 19:19 - 2011-12-22 08:15 - 0001401 _RASH C:\Windows\System32\Drivers\etc\hosts
2012-01-19 19:14 - 2012-01-19 19:14 - 0000012 ____A C:\Windows\sruna.log
2012-01-19 16:08 - 2012-01-19 16:08 - 0002234 ____A C:\Users\Rigatoni\Downloads\cssmenubuilder(1).zip
2012-01-19 15:59 - 2012-01-19 15:59 - 0002285 ____A C:\Users\Rigatoni\Downloads\cssmenubuilder.zip
2012-01-19 15:59 - 2011-12-07 15:22 - 0063712 ____A C:\Windows\System32\GDIPFONTCACHEV1.DAT
2012-01-19 15:56 - 2012-01-19 15:56 - 0000574 ____A C:\Users\Rigatoni\Downloads\verMenuImages.png
2012-01-19 15:56 - 2011-12-07 05:17 - 0063712 ____A C:\Windows\SysWOW64\GDIPFONTCACHEV1.DAT
2012-01-19 14:26 - 2009-07-13 20:45 - 4842832 ____A C:\Windows\System32\FNTCACHE.DAT
2012-01-19 14:25 - 2012-01-19 14:25 - 0291632 ____A C:\Windows\Minidump\011912-36769-01.dmp
2012-01-17 19:55 - 2012-01-17 11:16 - 0000132 ____A C:\Users\Rigatoni\AppData\Roaming\Adobe PNG Format CS5 Prefs
2012-01-17 19:44 - 2012-01-17 19:44 - 0125297 ____A C:\Users\Rigatoni\Downloads\coolvetica.zip
2012-01-17 19:43 - 2012-01-17 19:43 - 0022711 ____A C:\Users\Rigatoni\Downloads\harabara.zip
2012-01-17 16:07 - 2012-01-17 16:06 - 0000132 ____A C:\Users\Rigatoni\AppData\Roaming\Adobe GIF Format CS5 Prefs
2012-01-17 15:44 - 2012-01-17 15:00 - 0556473 ____A C:\Users\Rigatoni\Downloads\Jobs actual work with gradient.psd
2012-01-17 15:37 - 2012-01-17 15:37 - 0028639 ____A C:\Users\Rigatoni\Downloads\bubblegum.zip
2012-01-17 15:33 - 2012-01-17 15:33 - 0017083 ____A C:\Users\Rigatoni\Downloads\grobold.zip
2012-01-17 15:31 - 2012-01-17 15:31 - 0020696 ____A C:\Users\Rigatoni\Downloads\agent_orange.zip
2012-01-17 14:33 - 2012-01-17 13:20 - 0381957 ____A C:\Users\Rigatoni\Downloads\Jobs actual work.psd
2012-01-17 12:18 - 2012-01-17 12:18 - 0248549 ____A C:\Users\Rigatoni\Downloads\JobsInProgress.psd
2012-01-17 12:04 - 2012-01-17 12:04 - 0393731 ____A C:\Users\Rigatoni\Downloads\Untitled-3.psd
2012-01-17 11:33 - 2011-12-19 09:29 - 0000000 ____D C:\Users\Rigatoni\Desktop\images
2012-01-17 08:40 - 2011-12-19 09:29 - 0000000 ____D C:\Users\Rigatoni\Downloads\intheclouds
2012-01-16 22:02 - 2012-01-16 22:01 - 0296024 ____A C:\Windows\Minidump\011712-36457-01.dmp
2012-01-16 22:02 - 2012-01-12 18:49 - 0010600 __ASH C:\Users\Rigatoni\AppData\Local\580g3r5s2317
2012-01-16 22:02 - 2012-01-11 08:03 - 0010600 __ASH C:\Users\All Users\580g3r5s2317
2012-01-16 22:02 - 2012-01-11 08:03 - 0010600 __ASH C:\ProgramData\580g3r5s2317
2012-01-14 10:23 - 2012-01-14 10:23 - 0002374 ____A C:\Users\Rigatoni\Desktop\ff.csv
2012-01-13 23:18 - 2012-01-13 09:55 - 0000000 ____D C:\Users\Rigatoni\AppData\Local\WMTools Downloaded Files
2012-01-13 23:12 - 2012-01-13 09:50 - 0016384 ____A C:\Users\Rigatoni\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2012-01-13 22:21 - 2012-01-13 22:21 - 7934114 ____A C:\sexy-girls-heat-things-up_1.xvid.avi
2012-01-13 22:16 - 2012-01-13 22:16 - 6649116 ____A C:\sexy-filipino-justene_1.xvid.avi
2012-01-13 22:15 - 2012-01-13 22:15 - 6820938 ____A C:\sexy-blond-in-nuts_1.xvid.avi
2012-01-13 22:12 - 2012-01-13 22:12 - 7939934 ____A C:\sexy-babe-makes-her-bed_1.xvid.avi
2012-01-13 22:04 - 2012-01-13 22:03 - 10162482 ____A C:\sexy-babe-and-her-ass_1.xvid.avi
2012-01-13 22:03 - 2012-01-13 22:01 - 15369432 ____A C:\sexy-asian-nurse_1.xvid.avi
2012-01-13 21:56 - 2012-01-13 21:55 - 8225022 ____A C:\playboy-summe_1.xvid.avi
2012-01-13 21:46 - 2012-01-13 21:46 - 8257114 ____A C:\kylie-on-the-beach_1.xvid.avi
2012-01-13 21:43 - 2012-01-13 21:42 - 7644698 ____A C:\hot-tease-celeste_1.xvid.avi
2012-01-13 21:39 - 2012-01-13 21:38 - 11794862 ____A C:\hot-girl-by-the-fountain_1.xvid.avi
2012-01-13 21:37 - 2012-01-13 21:36 - 17253734 ____A C:\hot-fitness-babe_1.xvid.avi
2012-01-13 21:35 - 2012-01-13 21:34 - 14963844 ____A C:\girls-in-red-know-how-to-dance_1.xvid.avi
2012-01-13 21:29 - 2012-01-13 21:29 - 8165536 ____A C:\georgia-the-hot-brunette_1.xvid.avi
2012-01-13 21:28 - 2012-01-13 21:27 - 11193278 ____A C:\exotic-dark-haired-lela_1.xvid.avi
2012-01-13 21:26 - 2012-01-13 21:24 - 19802616 ____A C:\dancing-brazilian-babe_1.xvid.avi
2012-01-13 21:23 - 2012-01-13 21:22 - 17324072 ____A C:\crazy-hot-asian-dancer_1.xvid.avi
2012-01-13 21:21 - 2012-01-13 21:20 - 12968854 ____A C:\calista-brunette-funny_1.xvid.avi
2012-01-13 21:14 - 2012-01-13 21:13 - 8804342 ____A C:\blonde-bombshell-in-blue_1.xvid.avi
2012-01-13 21:13 - 2012-01-13 21:12 - 17477458 ____A C:\beautiful-blonde-vanessa_1.xvid.avi
2012-01-13 21:10 - 2012-01-13 21:10 - 8497285 ____A C:\Users\Rigatoni\Downloads\exotic-dark-haired-lela_1.flv
2012-01-13 21:09 - 2012-01-13 21:09 - 6266637 ____A C:\Users\Rigatoni\Downloads\kylie-on-the-beach_1.flv
2012-01-13 21:09 - 2012-01-13 21:08 - 13248118 ____A C:\Users\Rigatoni\Downloads\hot-fitness-babe_1.flv
2012-01-13 21:07 - 2012-01-13 21:07 - 13554365 ____A C:\Users\Rigatoni\Downloads\beautiful-blonde-vanessa_1.flv
2012-01-13 21:03 - 2012-01-13 21:03 - 6441693 ____A C:\Users\Rigatoni\Downloads\playboy-summe_1.flv
2012-01-13 21:02 - 2012-01-13 21:00 - 13965408 ____A C:\black-bikini-shay_1.xvid.avi
2012-01-13 21:01 - 2012-01-13 21:01 - 5142513 ____A C:\Users\Rigatoni\Downloads\sexy-blond-in-nuts_1.flv
2012-01-13 21:00 - 2012-01-13 21:00 - 6661448 ____A C:\Users\Rigatoni\Downloads\blonde-bombshell-in-blue_1.flv
2012-01-13 20:59 - 2012-01-13 20:59 - 6044276 ____A C:\asian-girl-in-umbrella-suit_1.xvid.avi
2012-01-13 20:57 - 2012-01-13 20:57 - 11368940 ____A C:\asian-bikini-babe-dances_1.xvid.avi
2012-01-13 20:57 - 2012-01-13 20:57 - 10609305 ____A C:\Users\Rigatoni\Downloads\black-bikini-shay_1.flv
2012-01-13 20:57 - 2012-01-13 20:56 - 2224090 ____A C:\1463884_28b2a7df-655f-4b3c-a1f2-2d290fbbfb2b_prod_1.xvid.avi
2012-01-13 20:56 - 2012-01-13 20:55 - 4076202 ____A C:\759003_9e7e30fd-9044-41c7-ac32-1603cd067ed8_prod_1.xvid.avi
2012-01-13 20:55 - 2012-01-13 20:55 - 5782019 ____A C:\Users\Rigatoni\Downloads\hot-tease-celeste_1.flv
2012-01-13 20:54 - 2012-01-13 20:54 - 6051700 ____A C:\Users\Rigatoni\Downloads\georgia-the-hot-brunette_1.flv
2012-01-13 20:54 - 2012-01-13 20:53 - 13182148 ____A C:\758991_86022fe4-c812-49b6-9851-274edf7cd127_prod_1.xvid.avi
2012-01-13 20:53 - 2012-01-13 20:53 - 9787156 ____A C:\Users\Rigatoni\Downloads\calista-brunette-funny_1.flv
2012-01-13 20:50 - 2012-01-13 20:50 - 5895877 ____A C:\Users\Rigatoni\Downloads\sexy-girls-heat-things-up_1.flv
2012-01-13 20:49 - 2012-01-13 20:49 - 4957148 ____A C:\Users\Rigatoni\Downloads\sexy-filipino-justene_1.flv
2012-01-13 20:48 - 2012-01-13 20:48 - 11103203 ____A C:\Users\Rigatoni\Downloads\girls-in-red-know-how-to-dance_1.flv
2012-01-13 20:48 - 2012-01-13 20:47 - 4981007 ____A C:\Users\Rigatoni\Downloads\my-big-ass-and-tits-hotness_1.flv
2012-01-13 20:47 - 2012-01-13 20:47 - 7783450 ____A C:\Users\Rigatoni\Downloads\sexy-babe-and-her-ass_1.flv
2012-01-13 20:47 - 2012-01-13 20:47 - 11474708 ____A C:\Users\Rigatoni\Downloads\blondes-love-to-dance_1.flv
2012-01-13 20:46 - 2012-01-13 20:46 - 13543720 ____A C:\Users\Rigatoni\Downloads\crazy-hot-asian-dancer_1.flv
2012-01-13 20:45 - 2012-01-13 20:45 - 5936424 ____A C:\Users\Rigatoni\Downloads\sexy-babe-makes-her-bed_1.flv
2012-01-13 20:41 - 2012-01-13 20:41 - 8693954 ____A C:\Users\Rigatoni\Downloads\asian-bikini-babe-dances_1.flv
2012-01-13 20:41 - 2012-01-13 20:41 - 11866213 ____A C:\Users\Rigatoni\Downloads\dancing-brazilian-babe_1.flv
2012-01-13 20:39 - 2012-01-13 20:39 - 11243521 ____A C:\Users\Rigatoni\Downloads\sexy-asian-nurse_1.flv
2012-01-13 20:35 - 2012-01-13 20:35 - 4519720 ____A C:\Users\Rigatoni\Downloads\asian-girl-in-umbrella-suit_1.flv
2012-01-13 20:34 - 2012-01-13 20:34 - 8863220 ____A C:\Users\Rigatoni\Downloads\hot-girl-by-the-fountain_1.flv
2012-01-13 20:30 - 2012-01-13 20:28 - 33808796 ____A C:\652487_edf02093-47ac-48b5-a06e-183bf086315a_prod_1.xvid.avi
2012-01-13 20:26 - 2012-01-13 20:26 - 25656093 ____A C:\Users\Rigatoni\Downloads\652487_edf02093-47ac-48b5-a06e-183bf086315a_prod_1.flv
2012-01-13 20:24 - 2012-01-13 20:24 - 1577408 ____A C:\Users\Rigatoni\Downloads\1463884_28b2a7df-655f-4b3c-a1f2-2d290fbbfb2b_prod_1.flv
2012-01-13 20:23 - 2012-01-13 20:23 - 2679345 ____A C:\Users\Rigatoni\Downloads\759003_9e7e30fd-9044-41c7-ac32-1603cd067ed8_prod_1.flv
2012-01-13 20:22 - 2012-01-13 20:22 - 9497419 ____A C:\Users\Rigatoni\Downloads\758991_86022fe4-c812-49b6-9851-274edf7cd127_prod_1.flv
2012-01-13 15:03 - 2012-01-13 15:03 - 7706654 ____A C:\two_girls_kissing_compilation.xvid.avi
2012-01-13 10:54 - 2012-01-13 10:54 - 5162947 ____A C:\Users\Rigatoni\Downloads\flvtoavi_setup.zip
2012-01-13 10:50 - 2012-01-13 10:50 - 1707366 ____A C:\Users\Rigatoni\Downloads\VirtualDub-1.9.11.zip
2012-01-13 09:45 - 2012-01-13 09:45 - 0000000 ____D C:\Program Files (x86)\Movie Maker 2.6
2012-01-13 09:45 - 2012-01-13 09:44 - 7357440 ____A C:\Users\Rigatoni\Downloads\MM26_ENU.msi
2012-01-12 18:48 - 2012-01-12 18:48 - 0291648 ____A C:\Windows\Minidump\011212-24726-01.dmp
2012-01-12 08:02 - 2012-01-12 08:02 - 0040611 ____A C:\Users\Rigatoni\Desktop\rewrite.zip
2012-01-11 08:03 - 2012-01-11 08:03 - 0000012 ____A C:\Windows\srun.log
2012-01-11 07:17 - 2012-01-11 07:17 - 0291600 ____A C:\Windows\Minidump\011112-23977-01.dmp
2012-01-10 20:20 - 2012-01-10 20:20 - 0146875 ____A C:\Users\Rigatoni\Desktop\JobsMarketingImage.jpg
2012-01-10 18:35 - 2012-01-10 18:26 - 0001612 ____A C:\Users\Rigatoni\Desktop\PlasmaTEXT.txt
2012-01-10 17:53 - 2012-01-10 12:38 - 0001159 ____A C:\Users\Rigatoni\Desktop\EbayTEXT.txt
2012-01-10 11:47 - 2012-01-10 11:47 - 0001924 ____A C:\Users\Rigatoni\Desktop\CraigslistTEXT.txt
2012-01-10 11:31 - 2012-01-10 11:30 - 0002521 ____A C:\Users\Rigatoni\Desktop\ResaleTEXT.txt
2012-01-10 11:15 - 2012-01-10 11:15 - 0001425 ____A C:\Users\Rigatoni\Desktop\ClinicalTrialsText.txt
2012-01-10 10:52 - 2012-01-10 10:52 - 0157920 ____A C:\Users\Rigatoni\Desktop\jobs.jpg
2012-01-10 10:50 - 2011-12-19 10:43 - 1350392 ____A C:\Users\Rigatoni\Desktop\jobs.psd
2012-01-10 10:41 - 2011-04-06 20:10 - 0000000 ____D C:\Users\Rigatoni\AppData\Local\Adobe
2012-01-01 16:33 - 2011-12-19 10:02 - 0003565 ____A C:\Users\Rigatoni\Downloads\1324317725_briefcase.png
2012-01-01 16:05 - 2012-01-01 16:05 - 0001078 ____A C:\Users\Rigatoni\favicon.ico
2012-01-01 16:01 - 2012-01-01 15:52 - 0000000 ____D C:\Users\Rigatoni\Desktop\icon
2012-01-01 15:57 - 2012-01-01 15:57 - 0001903 ____A C:\Users\Rigatoni\icon-16.png
2012-01-01 15:57 - 2012-01-01 15:56 - 0001456 ____A C:\Users\Rigatoni\AppData\Local\Adobe Save for Web 12.0 Prefs
2012-01-01 15:56 - 2012-01-01 15:56 - 0002753 ____A C:\Users\Rigatoni\icon-32.png
2012-01-01 15:52 - 2012-01-01 15:52 - 0000000 ____D C:\Users\Rigatoni\doc
2012-01-01 15:49 - 2012-01-01 15:49 - 0092047 ____A C:\Users\Rigatoni\Downloads\png2ico-win-2002-12-08.zip
2011-12-31 12:50 - 2011-12-31 12:50 - 0271000 ____A C:\Windows\Minidump\123111-20155-01.dmp
2011-12-31 12:37 - 2011-12-31 12:37 - 0284440 ____A C:\Windows\Minidump\123111-18673-01.dmp
2011-12-30 21:21 - 2011-12-30 21:21 - 0000000 __SHD C:\Windows\SysWOW64\%APPDATA%
2011-12-29 19:01 - 2011-12-29 19:00 - 0296008 ____A C:\Windows\Minidump\122911-18532-01.dmp
2011-12-28 19:18 - 2011-12-28 19:17 - 0005610 __ASH C:\Users\Rigatoni\AppData\Local\q5576fr1610ec6c4v252440vydshs0lso3cf36
2011-12-28 19:18 - 2011-12-28 19:17 - 0005610 __ASH C:\Users\All Users\q5576fr1610ec6c4v252440vydshs0lso3cf36
2011-12-28 19:18 - 2011-12-28 19:17 - 0005610 __ASH C:\ProgramData\q5576fr1610ec6c4v252440vydshs0lso3cf36
2011-12-22 15:57 - 2011-12-22 15:57 - 0067227 ____A C:\Users\Rigatoni\Desktop\KobeShaq6.jpg
2011-12-22 08:08 - 2011-12-21 19:06 - 0010364 __ASH C:\Users\Rigatoni\AppData\Local\eaobxq8b3hgh6kfp1iyw6q758a4y
2011-12-22 08:08 - 2011-12-21 19:06 - 0010364 __ASH C:\Users\All Users\eaobxq8b3hgh6kfp1iyw6q758a4y
2011-12-22 08:08 - 2011-12-21 19:06 - 0010364 __ASH C:\ProgramData\eaobxq8b3hgh6kfp1iyw6q758a4y
2011-12-22 08:05 - 2011-12-22 08:05 - 9852544 ____A (Malwarebytes Corporation ) C:\Users\Rigatoni\Downloads\mbam-setup-1.51.2.1300.exe
2011-12-22 08:04 - 2011-12-22 08:04 - 0013982 ____A C:\Users\Rigatoni\Desktop\DraftMock.txt
2011-12-22 06:53 - 2011-12-22 06:53 - 0057220 ____A C:\Users\Rigatoni\Downloads\shaquille-oneal.jpg
2011-12-20 13:18 - 2011-12-20 13:17 - 14761224 ____A (Mozilla) C:\Users\Rigatoni\Downloads\Firefox Setup 8.0.1.exe
2011-12-19 10:11 - 2011-12-19 10:11 - 0107824 ____A C:\Users\Rigatoni\Downloads\3301-Girl-Cartoon.jpg
2011-12-19 09:24 - 2011-12-19 09:24 - 0484112 ____A C:\Users\Rigatoni\Downloads\intheclouds.zip
2011-12-19 08:04 - 2011-12-18 10:38 - 0000000 ____D C:\Program Files (x86)\Notepad++
2011-12-18 12:02 - 2011-06-12 21:44 - 0414368 ____A (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2011-12-18 11:56 - 2011-12-18 11:25 - 0001799 ____A C:\Users\Rigatoni\Desktop\new4.html
2011-12-18 11:49 - 2011-12-18 11:49 - 0221596 ____A C:\Users\Rigatoni\Downloads\swffit_2_4_beta.zip
2011-12-18 11:22 - 2011-12-18 11:07 - 0001806 ____A C:\Users\Rigatoni\Desktop\new3.html
2011-12-18 11:06 - 2011-12-18 10:39 - 0008157 ____A C:\Users\Rigatoni\Desktop\new2.html
2011-12-18 11:06 - 2011-12-18 10:38 - 0000000 ____D C:\Users\Rigatoni\AppData\Roaming\Notepad++
2011-12-18 10:38 - 2011-12-18 10:38 - 5599854 ____A C:\Users\Rigatoni\Downloads\npp.5.9.6.2.Installer.exe
2011-12-18 10:37 - 2011-12-18 10:37 - 0011514 ____A C:\Users\Rigatoni\Desktop\index.txt
2011-12-18 02:06 - 2009-07-13 19:20 - 0000000 ____D C:\Windows\System32\NDF
2011-12-15 18:40 - 2011-12-15 18:40 - 1047510 ____A C:\Users\Rigatoni\Downloads\photo(1).JPG
2011-12-15 18:38 - 2011-12-15 18:38 - 1105502 ____A C:\Users\Rigatoni\Downloads\photo.JPG
2011-12-15 18:34 - 2011-12-15 18:34 - 0982672 ____A C:\Users\Rigatoni\Downloads\picsies.zip
2011-12-15 04:41 - 2011-12-15 04:41 - 0000000 ____D C:\Windows\Sun
2011-12-13 14:48 - 2011-12-13 14:48 - 0009370 ____A C:\Users\Rigatoni\Documents\12-14.odt
2011-12-08 11:14 - 2011-04-06 20:14 - 0000000 ____D C:\Program Files\Common Files\Adobe
2011-12-08 11:10 - 2011-04-06 20:12 - 0000000 ____D C:\Users\All Users\Adobe
2011-12-08 11:10 - 2011-04-06 20:12 - 0000000 ____D C:\ProgramData\Adobe
2011-12-08 11:02 - 2011-04-06 20:18 - 0000000 ____D C:\Users\All Users\regid.1986-12.com.adobe
2011-12-08 11:02 - 2011-04-06 20:18 - 0000000 ____D C:\ProgramData\regid.1986-12.com.adobe
2011-12-08 10:58 - 2011-12-07 05:14 - 0000000 ____D C:\Program Files\Adobe
2011-12-08 10:53 - 2011-04-06 20:14 - 0000000 ____D C:\Program Files (x86)\Adobe
2011-12-08 10:07 - 2011-12-08 10:07 - 0001195 ____A C:\Users\Rigatoni\Desktop\Adobe After Effects CS5.lnk
2011-12-08 10:07 - 2011-12-08 10:07 - 0001178 ____A C:\Users\Rigatoni\Desktop\Adobe Flash Professional CS5.5.lnk
2011-12-08 10:05 - 2011-12-08 10:05 - 0010623 ____A C:\Users\Rigatoni\Desktop\Untitled Project.aep
2011-12-08 09:45 - 2011-12-08 09:25 - 0000021 ____A C:\Windows\SurCode.INI
2011-12-08 09:45 - 2011-01-07 01:03 - 0000000 ___AD C:\Users\Rigatoni\AppData\Local\FB4Zcy0Xqpljfg
2011-12-08 09:45 - 2010-07-29 22:49 - 0000000 ___AD C:\Users\Rigatoni\AppData\Local\tASlEdmvq
2011-12-08 09:36 - 2011-12-08 09:36 - 0000000 __ASH C:\Windows\System32\config\SYSTEM.tmp.LOG2
2011-12-08 09:36 - 2011-12-08 09:36 - 0000000 __ASH C:\Windows\System32\config\SYSTEM.tmp.LOG1
2011-12-08 09:36 - 2011-12-08 09:36 - 0000000 __ASH C:\Windows\System32\config\SOFTWARE.tmp.LOG2
2011-12-08 09:36 - 2011-12-08 09:36 - 0000000 __ASH C:\Windows\System32\config\SOFTWARE.tmp.LOG1
2011-12-08 09:36 - 2011-12-08 09:36 - 0000000 __ASH C:\Windows\System32\config\SECURITY.tmp.LOG2
2011-12-08 09:36 - 2011-12-08 09:36 - 0000000 __ASH C:\Windows\System32\config\SECURITY.tmp.LOG1
2011-12-08 09:36 - 2011-12-08 09:36 - 0000000 __ASH C:\Windows\System32\config\SAM.tmp.LOG2
2011-12-08 09:36 - 2011-12-08 09:36 - 0000000 __ASH C:\Windows\System32\config\SAM.tmp.LOG1
2011-12-08 09:36 - 2011-12-08 09:36 - 0000000 __ASH C:\Windows\System32\config\DEFAULT.tmp.LOG2
2011-12-08 09:36 - 2011-12-08 09:36 - 0000000 __ASH C:\Windows\System32\config\DEFAULT.tmp.LOG1
2011-12-08 09:27 - 2011-04-08 10:17 - 0000000 ____D C:\Users\Rigatoni\Documents\Adobe
2011-12-08 09:25 - 2011-12-08 09:25 - 0000000 ____D C:\Users\Rigatoni\AppData\Roaming\PACE Anti-Piracy
2011-12-08 09:25 - 2011-12-08 09:25 - 0000000 ____D C:\Users\Rigatoni\AppData\Local\PACE Anti-Piracy
2011-12-08 09:25 - 2011-12-08 09:25 - 0000000 ____D C:\Users\All Users\PACE Anti-Piracy
2011-12-08 09:25 - 2011-12-08 09:25 - 0000000 ____D C:\ProgramData\PACE Anti-Piracy
2011-12-08 09:25 - 2011-12-08 09:25 - 0000000 ____D C:\Program Files\Common Files\PACE Anti-Piracy
2011-12-08 07:19 - 2011-12-08 07:19 - 0000000 ____A C:\Users\All Users\V3c5furc.dat
2011-12-08 07:19 - 2011-12-08 07:19 - 0000000 ____A C:\ProgramData\V3c5furc.dat
2011-12-08 07:18 - 2011-12-08 07:19 - 0032256 ____A (TWX Corp.) C:\Windows\SysWOW64\Q6D2T3M.com
2011-12-07 15:23 - 2011-12-07 15:23 - 0034322 ____A C:\Users\Rigatoni\Desktop\Untitled-1.psd
2011-12-07 14:55 - 2011-12-07 14:55 - 0000000 ____D C:\Users\Rigatoni\AppData\Roaming\com.adobe.downloadassistant.AdobeDownloadAssistant
2011-12-07 14:55 - 2011-12-07 14:55 - 0000000 ____D C:\Program Files (x86)\Adobe Download Assistant
2011-12-07 14:55 - 2011-12-07 14:54 - 2479184 ____A C:\Users\Rigatoni\Downloads\AdobeDownloadAssistant.exe
2011-12-07 05:07 - 2011-12-07 05:07 - 0000000 ____D C:\Users\Rigatoni\Documents\Goodies
2011-12-06 16:06 - 2011-12-06 16:05 - 0000000 ____D C:\Users\Rigatoni\Documents\WBFS Manager Covers
2011-12-06 16:05 - 2011-12-06 16:05 - 2845640 ____A C:\Users\Rigatoni\Downloads\WBFSManager3.0-RTW-x64.zip
2011-12-06 16:05 - 2011-12-06 16:05 - 0000959 ____A C:\Users\Rigatoni\Desktop\WBFS Manager 3.0.lnk
2011-12-06 16:05 - 2011-12-06 16:04 - 2620922 ____A C:\Users\Rigatoni\Downloads\WBFSManager3.0-RTW-x86.zip
2011-12-06 16:04 - 2011-12-06 16:04 - 0001400 ____A C:\Users\Rigatoni\Downloads\WBFSManager3.0.1-RTW-x86.zip
2011-12-06 16:04 - 2011-12-06 16:04 - 0001400 ____A C:\Users\Rigatoni\Downloads\WBFSManager3.0.1-RTW-x86(1).zip
2011-12-06 16:02 - 2011-12-06 13:40 - 0000000 ____D C:\Users\Rigatoni\Downloads\The Legend of Zelda Skyward Sword [Wii][NTSC][Srubbed]-TLS
2011-12-06 11:10 - 2011-03-04 08:13 - 0000000 ____D C:\Users\Rigatoni\Desktop\Microsoft Windows 7 Sp1 All In One 64Bit Retail 6.1.7601.17514 NL
2011-12-06 11:09 - 2011-03-02 20:56 - 0000000 ____D C:\Users\Rigatoni\Desktop\Someday
2011-12-06 11:02 - 2011-11-10 06:13 - 0000000 ____D C:\Users\All Users\InstallMate
2011-12-06 11:02 - 2011-11-10 06:13 - 0000000 ____D C:\ProgramData\InstallMate
2011-12-06 10:57 - 2011-12-06 10:57 - 0010798 ____A C:\Users\Rigatoni\Documents\to do.odt
2011-12-05 21:17 - 2011-12-05 21:17 - 0020279 ____A C:\Users\Rigatoni\Documents\resume so far.odt
2011-12-05 07:33 - 2011-12-05 07:33 - 0000000 ____D C:\Users\Rigatoni\AppData\Roaming\OpenOffice.org
2011-12-05 07:31 - 2011-12-05 07:31 - 0000000 ____D C:\Program Files (x86)\JRE
2011-12-05 07:31 - 2011-12-05 07:30 - 0000000 ____D C:\Program Files (x86)\OpenOffice.org 3
2011-12-05 07:25 - 2009-07-13 19:20 - 0000000 ____D C:\Windows\Resources

========================= Known DLLs (Whitelisted) ============


========================= Bamital & volsnap Check ============

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe
[2009-07-13 15:41] - [2009-07-13 17:14] - 2613248 ____A (Microsoft Corporation) 15BC38A7492BEFE831966ADB477CF76F

C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit

========================= Memory info ======================

Percentage of memory in use: 10%
Total physical RAM: 6142.55 MB
Available physical RAM: 5491.48 MB
Total Pagefile: 6140.7 MB
Available Pagefile: 5478.97 MB
Total Virtual: 8192 MB
Available Virtual: 8191.9 MB

======================= Partitions =========================

2 Drive c: © (Fixed) (Total:298.09 GB) (Free:131.37 GB) NTFS ==>[Drive with boot components (obtanied from BCD)]
3 Drive d: (xPUD) (CDROM) (Total:0.06 GB) (Free:0 GB) CDFS
7 Drive h: () (Removable) (Total:3.74 GB) (Free:3.73 GB) FAT32
8 Drive x: (Boot) (Fixed) (Total:0.03 GB) (Free:0.03 GB) NTFS

Disk ### Status Size Free Dyn Gpt
-------- ------------- ------- ------- --- ---
Disk 0 Online 298 GB 1024 KB
Disk 1 No Media 0 B 0 B
Disk 2 No Media 0 B 0 B
Disk 3 Online 3827 MB 0 B

Partitions of Disk 0:
===============

Partition ### Type Size Offset
------------- ---------------- ------- -------
Partition 1 Primary 298 GB 31 KB

Disk: 0
Partition 1
Type : 07
Hidden: No
Active: Yes

Volume ### Ltr Label Fs Type Size Status Info
---------- --- ----------- ----- ---------- ------- --------- --------
* Volume 2 C C NTFS Partition 298 GB Healthy

Partitions of Disk 3:
===============

Partition ### Type Size Offset
------------- ---------------- ------- -------
Partition 1 Primary 3826 MB 16 KB

Disk: 3
Partition 1
Type : 0B
Hidden: No
Active: No

Volume ### Ltr Label Fs Type Size Status Info
---------- --- ----------- ----- ---------- ------- --------- --------
* Volume 5 H FAT32 Removable 3826 MB Healthy


==========================================================
TDL4: custom:26000022


==========================================================

Last Boot: 2012-02-09 19:37

======================= End Of Log ==========================

#10 JSntgRvr

JSntgRvr

    Master Surgeon General


  • Malware Response Team
  • 11,762 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Puerto Rico
  • Local time:06:06 AM

Posted 23 February 2012 - 06:48 PM

Download the enclosed file.

Save it next to FRST in the USB drive.

Run FRST as you did before. This time around click on the Fix button and wait.

The tool will make a log on the flashdrive (Fixlog.txt) please post it to your reply.

Boot in normal Mode. If able, run Combofix as previously suggested.

No request for help throughout private messaging will be attended.

If I have helped you, consider making a donation to help me continue the fight against Malware!
btn_donate_SM.gif


#11 PokerHandfull

PokerHandfull
  • Topic Starter

  • Members
  • 7 posts
  • OFFLINE
  •  
  • Local time:05:06 AM

Posted 24 February 2012 - 11:50 AM

Fixed! Windows boots normally, I ran ComboFix and it even fixed the original problem I was hoping to solve. Thank you so much. I'm posting my fixitlog and combofix logs just in case. Other than that I believe a donation is in order, I'm new here so not sure how it works - will the donate button suffice or is a personal donation customary as well?


Fix result of Farbar Recovery Scan Tool (FRST written by farbar) Version: 23-02-2012
Ran by SYSTEM at 2012-02-24 00:46:24 R:1
Running from H:\

==============================================

C:\Users\Rigatoni\AppData\Local\580g3r5s2317 moved successfully.
C:\Users\All Users\580g3r5s2317 moved successfully.
C:\ProgramData\580g3r5s2317 not found.
C:\Users\Rigatoni\AppData\Local\q5576fr1610ec6c4v252440vydshs0lso3cf36 moved successfully.
C:\Users\All Users\q5576fr1610ec6c4v252440vydshs0lso3cf36 moved successfully.
C:\ProgramData\q5576fr1610ec6c4v252440vydshs0lso3cf36 not found.
C:\Users\Rigatoni\AppData\Local\eaobxq8b3hgh6kfp1iyw6q758a4y moved successfully.
C:\Users\All Users\eaobxq8b3hgh6kfp1iyw6q758a4y moved successfully.
C:\ProgramData\eaobxq8b3hgh6kfp1iyw6q758a4y not found.

The operation completed successfully.
The operation completed successfully.

==== End of Fixlog ====



ComboFix log -

ComboFix 12-02-23.01 - Rigatoni 02/24/2012 0:57.10.2 - x64
Microsoft Windows 7 Ultimate 6.1.7600.0.1252.1.1033.18.6143.4983 [GMT -5:00]
Running from: c:\users\Rigatoni\Desktop\ComboFix.exe
SP: Windows Defender *Enabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
* Created a new restore point
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\windows\svchost.exe
.
.
((((((((((((((((((((((((( Files Created from 2012-01-24 to 2012-02-24 )))))))))))))))))))))))))))))))
.
.
2012-02-24 06:05 . 2012-02-24 06:05 -------- d-----w- c:\users\Public\AppData\Local\temp
2012-02-24 06:05 . 2012-02-24 06:05 -------- d-----w- c:\users\Mcx1-PASTAPETE\AppData\Local\temp
2012-02-24 06:05 . 2012-02-24 06:05 -------- d-----w- c:\users\Default\AppData\Local\temp
2012-02-23 21:55 . 2012-02-23 21:56 -------- d-----w- C:\FRST
2012-02-21 15:41 . 2012-02-21 15:41 -------- d-----w- C:\TDSSKiller_Quarantine
2012-02-17 21:47 . 2012-02-17 21:47 -------- d-----w- c:\users\Rigatoni\AppData\Roaming\Malwarebytes
2012-02-17 21:47 . 2012-02-17 21:47 -------- d-----w- c:\programdata\Malwarebytes
2012-02-17 21:47 . 2012-02-23 17:34 -------- d-----w- c:\program files (x86)\Malwarebytes' Anti-Malware
2012-02-17 21:40 . 2012-02-23 17:34 -------- d-----w- c:\program files (x86)\Common Files\PC Tools
2012-02-17 21:40 . 2012-02-23 17:34 -------- d-----w- c:\program files (x86)\PC Tools Security
2012-02-17 21:40 . 2012-02-17 21:40 -------- d-----w- c:\users\Rigatoni\AppData\Roaming\PC Tools
2012-02-17 21:38 . 2012-02-17 21:40 -------- d-----w- c:\programdata\PC Tools
2012-02-15 05:07 . 2012-02-16 20:29 -------- d-----w- c:\users\Rigatoni\AppData\Roaming\.minecraft
2012-02-15 04:03 . 2012-02-15 04:03 -------- d-----w- c:\users\Rigatoni\AppData\Roaming\NVIDIA
2012-02-15 03:56 . 2012-02-24 05:49 -------- d-----w- c:\users\UpdatusUser
2012-02-15 03:56 . 2012-02-15 03:56 -------- d-----w- c:\program files (x86)\NVIDIA Corporation
2012-02-15 03:56 . 2012-02-15 03:56 -------- d-----w- c:\programdata\NVIDIA
2012-02-15 03:56 . 2011-10-15 08:53 837952 ----a-w- c:\windows\system32\easyupdatusapiu64.dll
2012-02-15 03:56 . 2011-10-15 08:53 5067584 ----a-w- c:\windows\system32\nvsvc64.dll
2012-02-15 03:56 . 2011-10-15 08:53 222528 ----a-w- c:\windows\system32\nvmctray.dll
2012-02-15 03:56 . 2011-10-15 08:53 1640768 ----a-w- c:\windows\system32\nvvsvc.exe
2012-02-15 03:56 . 2011-10-15 08:53 137536 ----a-w- c:\windows\system32\nvshext.dll
2012-02-15 03:56 . 2011-10-15 08:53 10406208 ----a-w- c:\windows\system32\nvcpl.dll
2012-02-15 03:56 . 2012-02-15 03:56 -------- d-----w- c:\programdata\NVIDIA Corporation
2012-02-15 02:56 . 2012-02-15 03:56 -------- d-----w- c:\program files\NVIDIA Corporation
2012-02-15 02:45 . 2012-02-23 17:33 -------- d-----w- C:\NVIDIA
2012-02-15 01:56 . 2012-02-15 01:56 -------- d-----w- c:\users\Rigatoni\AppData\Roaming\SystemRequirementsLab
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-12-18 20:02 . 2011-06-13 05:44 414368 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2011-12-08 15:18 . 2011-12-08 15:19 32256 ----a-w- c:\windows\SysWow64\Q6D2T3M.com
.
.
((((((((((((((((((((((((((((( SnapShot_2012-02-15_03.49.31 )))))))))))))))))))))))))))))))))))))))))
.
+ 2012-02-15 03:55 . 2011-10-15 08:53 61248 c:\windows\SysWOW64\OpenCL.dll
+ 2011-04-11 16:58 . 2012-02-21 15:17 35254 c:\windows\system32\wdi\ShutdownPerformanceDiagnostics_SystemData.bin
+ 2009-07-14 05:10 . 2012-02-24 05:50 35770 c:\windows\system32\wdi\BootPerformanceDiagnostics_SystemData.bin
+ 2011-04-08 21:06 . 2012-02-24 05:50 10496 c:\windows\system32\wdi\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-911654618-2236601301-3508037184-1001_UserData.bin
+ 2012-02-15 03:55 . 2011-10-15 08:53 68928 c:\windows\system32\OpenCL.dll
+ 2012-02-23 17:35 . 2012-02-21 15:41 67584 c:\windows\system32\LogFiles\Srt\bootstat.dat
+ 2009-07-14 05:30 . 2012-02-15 03:56 86016 c:\windows\system32\DriverStore\infpub.dat
- 2009-07-14 05:30 . 2012-01-20 16:06 86016 c:\windows\system32\DriverStore\infpub.dat
+ 2012-02-15 03:55 . 2011-10-15 08:53 68928 c:\windows\system32\DriverStore\FileRepository\nv_disp.inf_amd64_neutral_a28ee7c3523ba145\OpenCL64.dll
+ 2012-02-15 03:55 . 2011-10-15 08:53 61248 c:\windows\system32\DriverStore\FileRepository\nv_disp.inf_amd64_neutral_a28ee7c3523ba145\OpenCL.dll
+ 2011-04-07 05:48 . 2012-02-17 21:40 16384 c:\windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
- 2011-04-07 05:48 . 2012-02-07 18:32 16384 c:\windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
+ 2011-04-07 05:48 . 2012-02-17 21:40 32768 c:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
- 2011-04-07 05:48 . 2012-02-07 18:32 32768 c:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
+ 2009-07-14 04:54 . 2012-02-17 21:40 16384 c:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
- 2009-07-14 04:54 . 2012-02-07 18:32 16384 c:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
- 2011-04-07 04:47 . 2012-02-15 03:25 16384 c:\windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
+ 2011-04-07 04:47 . 2012-02-24 05:50 16384 c:\windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
- 2011-04-07 04:47 . 2012-02-15 03:28 32768 c:\windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
+ 2011-04-07 04:47 . 2012-02-24 05:50 32768 c:\windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
+ 2011-04-07 04:47 . 2012-02-24 05:50 16384 c:\windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
- 2011-04-07 04:47 . 2012-02-15 03:25 16384 c:\windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
- 2011-04-07 04:47 . 2012-02-15 03:25 16384 c:\windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
+ 2011-04-07 04:47 . 2012-02-24 05:50 16384 c:\windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
- 2011-04-07 04:47 . 2012-02-15 03:25 16384 c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2011-04-07 04:47 . 2012-02-24 05:50 16384 c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2011-06-18 00:49 . 2012-02-21 04:42 9212 c:\windows\system32\wdi\ERCQueuedResolutions.dat
- 2011-04-22 21:35 . 2011-12-18 09:27 1630 c:\windows\system32\wdi\{88d4896f-f553-446a-9c75-9dec124ff8b7}.bin
+ 2011-04-22 21:35 . 2012-02-16 08:12 1630 c:\windows\system32\wdi\{88d4896f-f553-446a-9c75-9dec124ff8b7}.bin
+ 2012-02-24 05:48 . 2012-02-24 05:48 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
- 2012-02-15 03:25 . 2012-02-15 03:25 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
+ 2012-02-24 05:48 . 2012-02-24 05:48 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
- 2012-02-15 03:25 . 2012-02-15 03:25 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
- 2009-07-14 04:54 . 2012-02-15 03:26 671744 c:\windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
+ 2009-07-14 04:54 . 2012-02-24 05:48 671744 c:\windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
+ 2011-04-07 04:47 . 2012-02-18 16:14 292326 c:\windows\system32\wdi\SuspendPerformanceDiagnostics_SystemData_FastS4.bin
+ 2009-07-14 02:36 . 2012-02-24 05:52 615566 c:\windows\system32\perfh009.dat
- 2009-07-14 02:36 . 2012-02-13 21:39 615566 c:\windows\system32\perfh009.dat
+ 2009-07-14 02:36 . 2012-02-24 05:52 103682 c:\windows\system32\perfc009.dat
- 2009-07-14 02:36 . 2012-02-13 21:39 103682 c:\windows\system32\perfc009.dat
- 2009-07-14 05:30 . 2012-01-20 16:06 143360 c:\windows\system32\DriverStore\infstrng.dat
+ 2009-07-14 05:30 . 2012-02-15 03:56 143360 c:\windows\system32\DriverStore\infstrng.dat
- 2009-07-14 05:30 . 2012-01-20 15:57 143360 c:\windows\system32\DriverStore\infstor.dat
+ 2009-07-14 05:30 . 2012-02-15 03:56 143360 c:\windows\system32\DriverStore\infstor.dat
+ 2012-02-15 03:55 . 2011-10-15 08:53 283456 c:\windows\system32\DriverStore\FileRepository\nv_disp.inf_amd64_neutral_a28ee7c3523ba145\nvml.dll
+ 2012-02-15 03:55 . 2011-10-15 08:53 200512 c:\windows\system32\DriverStore\FileRepository\nv_disp.inf_amd64_neutral_a28ee7c3523ba145\nvidia-smi.exe
+ 2012-02-15 03:55 . 2011-10-15 08:53 316496 c:\windows\system32\DriverStore\FileRepository\nv_disp.inf_amd64_neutral_a28ee7c3523ba145\nvdrsdb.bin
+ 2012-02-15 03:55 . 2011-10-15 08:53 224064 c:\windows\system32\DriverStore\FileRepository\nv_disp.inf_amd64_neutral_a28ee7c3523ba145\dbInstaller.exe
- 2009-07-14 05:38 . 2011-11-10 14:33 262144 c:\windows\system32\config\systemprofile\ntuser.dat
+ 2009-07-14 05:38 . 2012-02-23 17:35 262144 c:\windows\system32\config\systemprofile\ntuser.dat
- 2012-02-06 02:06 . 2012-02-15 03:25 327680 c:\windows\ServiceProfiles\NetworkService\AppData\Local\Temp\History\History.IE5\index.dat
+ 2012-02-06 02:06 . 2012-02-21 15:15 327680 c:\windows\ServiceProfiles\NetworkService\AppData\Local\Temp\History\History.IE5\index.dat
+ 2012-02-06 02:06 . 2012-02-21 15:15 114688 c:\windows\ServiceProfiles\NetworkService\AppData\Local\Temp\Cookies\index.dat
- 2012-02-06 02:06 . 2012-02-15 03:25 114688 c:\windows\ServiceProfiles\NetworkService\AppData\Local\Temp\Cookies\index.dat
- 2009-07-14 05:01 . 2012-02-15 03:24 358868 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-System.dat
+ 2009-07-14 05:01 . 2012-02-21 15:41 358868 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-System.dat
+ 2012-02-15 03:55 . 2011-10-15 08:53 2401088 c:\windows\SysWOW64\nvcuvid.dll
+ 2012-02-15 03:55 . 2011-10-15 08:53 2099520 c:\windows\SysWOW64\nvcuvenc.dll
+ 2012-02-15 03:55 . 2011-10-15 08:53 5578560 c:\windows\SysWOW64\nvcuda.dll
+ 2012-02-15 03:55 . 2011-10-15 08:53 2458432 c:\windows\SysWOW64\nvapi.dll
+ 2009-07-14 04:54 . 2012-02-24 05:48 5586944 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
- 2009-07-14 04:54 . 2012-02-15 03:26 5586944 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
- 2009-07-14 04:54 . 2012-02-15 03:26 4538368 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2009-07-14 04:54 . 2012-02-24 05:48 4538368 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2009-07-14 02:34 . 2012-02-23 17:51 9437184 c:\windows\system32\SMI\Store\Machine\schema.dat
- 2009-07-14 02:34 . 2012-02-15 02:48 9437184 c:\windows\system32\SMI\Store\Machine\schema.dat
+ 2012-02-15 03:55 . 2011-10-15 08:53 1454400 c:\windows\system32\nvgenco64.dll
+ 2012-02-15 03:55 . 2011-10-15 08:53 1533248 c:\windows\system32\nvdispco64.dll
+ 2012-02-15 03:55 . 2011-10-15 08:53 2542912 c:\windows\system32\nvcuvid.dll
+ 2012-02-15 03:55 . 2011-10-15 08:53 2232128 c:\windows\system32\nvcuvenc.dll
+ 2012-02-15 03:55 . 2011-10-15 08:53 7581504 c:\windows\system32\nvcuda.dll
+ 2012-02-15 03:55 . 2011-10-15 08:53 2808128 c:\windows\system32\nvapi64.dll
+ 2012-02-15 03:55 . 2011-10-15 08:53 8791360 c:\windows\system32\DriverStore\FileRepository\nv_disp.inf_amd64_neutral_a28ee7c3523ba145\nvwgf2umx.dll
+ 2012-02-15 03:55 . 2011-10-15 08:53 7041856 c:\windows\system32\DriverStore\FileRepository\nv_disp.inf_amd64_neutral_a28ee7c3523ba145\nvwgf2um.dll
+ 2012-02-15 03:55 . 2011-10-15 08:53 1454400 c:\windows\system32\DriverStore\FileRepository\nv_disp.inf_amd64_neutral_a28ee7c3523ba145\nvgenco64.dll
+ 2012-02-15 03:55 . 2011-10-15 08:53 1533248 c:\windows\system32\DriverStore\FileRepository\nv_disp.inf_amd64_neutral_a28ee7c3523ba145\nvdispco64.dll
+ 2012-02-15 03:55 . 2011-10-15 08:53 2401088 c:\windows\system32\DriverStore\FileRepository\nv_disp.inf_amd64_neutral_a28ee7c3523ba145\nvcuvid32.dll
+ 2012-02-15 03:55 . 2011-10-15 08:53 2542912 c:\windows\system32\DriverStore\FileRepository\nv_disp.inf_amd64_neutral_a28ee7c3523ba145\nvcuvid.dll
+ 2012-02-15 03:55 . 2011-10-15 08:53 2232128 c:\windows\system32\DriverStore\FileRepository\nv_disp.inf_amd64_neutral_a28ee7c3523ba145\nvcuvenc64.dll
+ 2012-02-15 03:55 . 2011-10-15 08:53 2099520 c:\windows\system32\DriverStore\FileRepository\nv_disp.inf_amd64_neutral_a28ee7c3523ba145\nvcuvenc.dll
+ 2012-02-15 03:55 . 2011-10-15 08:53 5578560 c:\windows\system32\DriverStore\FileRepository\nv_disp.inf_amd64_neutral_a28ee7c3523ba145\nvcuda32.dll
+ 2012-02-15 03:55 . 2011-10-15 08:53 7581504 c:\windows\system32\DriverStore\FileRepository\nv_disp.inf_amd64_neutral_a28ee7c3523ba145\nvcuda.dll
+ 2012-02-15 03:55 . 2011-10-15 08:53 2808128 c:\windows\system32\DriverStore\FileRepository\nv_disp.inf_amd64_neutral_a28ee7c3523ba145\nvapi64.dll
+ 2012-02-15 03:55 . 2011-10-15 08:53 2458432 c:\windows\system32\DriverStore\FileRepository\nv_disp.inf_amd64_neutral_a28ee7c3523ba145\nvapi.dll
- 2012-02-06 02:06 . 2012-02-15 03:28 1785856 c:\windows\ServiceProfiles\NetworkService\AppData\Local\Temp\Temporary Internet Files\Content.IE5\index.dat
+ 2012-02-06 02:06 . 2012-02-21 15:18 1785856 c:\windows\ServiceProfiles\NetworkService\AppData\Local\Temp\Temporary Internet Files\Content.IE5\index.dat
+ 2012-02-15 03:55 . 2011-10-15 08:53 18871616 c:\windows\SysWOW64\nvoglv32.dll
+ 2009-06-10 20:37 . 2011-10-15 08:53 13205312 c:\windows\SysWOW64\nvd3dum.dll
+ 2012-02-15 03:55 . 2011-10-15 08:53 17248576 c:\windows\SysWOW64\nvcompiler.dll
+ 2012-02-15 03:55 . 2011-10-15 08:53 24742720 c:\windows\system32\nvoglv64.dll
+ 2009-07-13 21:59 . 2011-10-15 08:53 15693120 c:\windows\system32\nvd3dumx.dll
+ 2012-02-15 03:55 . 2011-10-15 08:53 24796992 c:\windows\system32\nvcompiler.dll
+ 2012-02-15 03:55 . 2011-10-15 08:53 24742720 c:\windows\system32\DriverStore\FileRepository\nv_disp.inf_amd64_neutral_a28ee7c3523ba145\nvoglv64.dll
+ 2012-02-15 03:55 . 2011-10-15 08:53 18871616 c:\windows\system32\DriverStore\FileRepository\nv_disp.inf_amd64_neutral_a28ee7c3523ba145\nvoglv32.dll
+ 2012-02-15 03:55 . 2011-10-15 08:53 12971840 c:\windows\system32\DriverStore\FileRepository\nv_disp.inf_amd64_neutral_a28ee7c3523ba145\nvlddmkm.sys
+ 2012-02-15 03:55 . 2011-10-15 08:53 15693120 c:\windows\system32\DriverStore\FileRepository\nv_disp.inf_amd64_neutral_a28ee7c3523ba145\nvd3dumx.dll
+ 2012-02-15 03:55 . 2011-10-15 08:53 13205312 c:\windows\system32\DriverStore\FileRepository\nv_disp.inf_amd64_neutral_a28ee7c3523ba145\nvd3dum.dll
+ 2012-02-15 03:55 . 2011-10-15 08:53 17248576 c:\windows\system32\DriverStore\FileRepository\nv_disp.inf_amd64_neutral_a28ee7c3523ba145\nvcompiler32.dll
+ 2012-02-15 03:55 . 2011-10-15 08:53 24796992 c:\windows\system32\DriverStore\FileRepository\nv_disp.inf_amd64_neutral_a28ee7c3523ba145\nvcompiler.dll
+ 2012-02-15 03:55 . 2011-10-15 08:53 12971840 c:\windows\system32\drivers\nvlddmkm.sys
+ 2011-09-10 17:40 . 2012-02-21 15:41 27271564 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-S-1-5-21-911654618-2236601301-3508037184-1001-12288.dat
- 2011-09-10 17:40 . 2012-02-15 03:24 27271564 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-S-1-5-21-911654618-2236601301-3508037184-1001-12288.dat
.
-- Snapshot reset to current date --
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"LightScribe Control Panel"="c:\program files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe" [2011-03-04 2741616]
"RoboForm"="c:\program files (x86)\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe" [2011-09-05 107000]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"WinPatrol"="c:\program files (x86)\BillP Studios\WinPatrol\winpatrol.exe" [2011-05-15 325512]
"iTunesHelper"="c:\program files (x86)\iTunes\iTunesHelper.exe" [2012-01-16 421736]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"Smad"="c:\windows\system32\config\systemprofile\AppData\Local\SanctionedMedia\Smad\Smad.exe" [2012-01-11 37376]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 0 (0x0)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"HideSCAHealth"= 1 (0x1)
.
[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"HideSCAHealth"= 1 (0x1)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]
"aux1"=wdmaud.drv
.
R3 McComponentHostService;McAfee Security Scan Component Host Service;c:\program files (x86)\McAfee Security Scan\2.0.181\McCHSvc.exe [2010-01-15 227232]
R3 osppsvc;Office Software Protection Platform;c:\program files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-01-10 4925184]
R3 rt61x64;Ralink RT61 Wireless Driver for Windows Vista;c:\windows\system32\DRIVERS\netr6164.sys [x]
R3 SwitchBoard;Adobe SwitchBoard;c:\program files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [2010-02-19 517096]
R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys [x]
S0 PxHlpa64;PxHlpa64;c:\windows\System32\Drivers\PxHlpa64.sys [x]
S2 Akamai;Akamai NetSession Interface;c:\windows\System32\svchost.exe [2009-07-14 27136]
S2 cvhsvc;Client Virtualization Handler;c:\program files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE [2010-02-28 821664]
S2 nvUpdatusService;NVIDIA Update Service Daemon;c:\program files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe [2011-10-15 2253120]
S2 sftlist;Application Virtualization Client;c:\program files (x86)\Microsoft Application Virtualization Client\sftlist.exe [2009-12-03 483688]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [x]
S3 Sftfs;Sftfs;c:\windows\system32\DRIVERS\Sftfslh.sys [x]
S3 Sftplay;Sftplay;c:\windows\system32\DRIVERS\Sftplaylh.sys [x]
S3 Sftredir;Sftredir;c:\windows\system32\DRIVERS\Sftredirlh.sys [x]
S3 Sftvol;Sftvol;c:\windows\system32\DRIVERS\Sftvollh.sys [x]
S3 sftvsa;Application Virtualization Service Agent;c:\program files (x86)\Microsoft Application Virtualization Client\sftvsa.exe [2009-12-03 209768]
.
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\svchost]
Akamai REG_MULTI_SZ Akamai
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
2011-03-04 16:29 451872 ----a-w- c:\program files (x86)\Common Files\LightScribe\LSRunOnce.exe
.
Contents of the 'Scheduled Tasks' folder
.
2012-02-17 c:\windows\Tasks\At19.job
- c:\windows\system32\Q6D2T3M.com [2011-12-08 15:18]
.
2012-02-17 c:\windows\Tasks\At27.job
- c:\windows\system32\Q6D2T3M.com [2011-12-08 15:18]
.
2012-02-17 c:\windows\Tasks\At29.job
- c:\windows\system32\Q6D2T3M.com [2011-12-08 15:18]
.
2012-02-16 c:\windows\Tasks\At33.job
- c:\windows\system32\Q6D2T3M.com [2011-12-08 15:18]
.
2012-02-16 c:\windows\Tasks\At35.job
- c:\windows\system32\Q6D2T3M.com [2011-12-08 15:18]
.
2012-02-16 c:\windows\Tasks\At37.job
- c:\windows\system32\Q6D2T3M.com [2011-12-08 15:18]
.
2012-02-17 c:\windows\Tasks\At39.job
- c:\windows\system32\Q6D2T3M.com [2011-12-08 15:18]
.
2012-02-17 c:\windows\Tasks\At43.job
- c:\windows\system32\Q6D2T3M.com [2011-12-08 15:18]
.
2012-02-17 c:\windows\Tasks\At45.job
- c:\windows\system32\Q6D2T3M.com [2011-12-08 15:18]
.
2012-02-17 c:\windows\Tasks\At47.job
- c:\windows\system32\Q6D2T3M.com [2011-12-08 15:18]
.
2012-02-17 c:\windows\Tasks\At5.job
- c:\windows\system32\Q6D2T3M.com [2011-12-08 15:18]
.
2012-02-17 c:\windows\Tasks\At7.job
- c:\windows\system32\Q6D2T3M.com [2011-12-08 15:18]
.
2012-02-17 c:\windows\Tasks\At9.job
- c:\windows\system32\Q6D2T3M.com [2011-12-08 15:18]
.
.
--------- x86-64 -----------
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AdobeAAMUpdater-1.0"="c:\program files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe" [2011-03-15 499608]
.
------- Supplementary Scan -------
.
uLocal Page = c:\windows\system32\blank.htm
mLocal Page = c:\windows\SysWOW64\blank.htm
uInternet Settings,ProxyOverride = *.local
uInternet Settings,ProxyServer = http=127.0.0.1:56606
IE: Customize Menu - file://c:\program files (x86)\Siber Systems\AI RoboForm\RoboFormComCustomizeIEMenu.html
IE: Fill Forms - file://c:\program files (x86)\Siber Systems\AI RoboForm\RoboFormComFillForms.html
IE: RoboForm Toolbar - file://c:\program files (x86)\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
IE: Save Forms - file://c:\program files (x86)\Siber Systems\AI RoboForm\RoboFormComSavePass.html
TCP: DhcpNameServer = 192.168.1.1
FF - ProfilePath - c:\users\Rigatoni\AppData\Roaming\Mozilla\Firefox\Profiles\vrfry1vt.default\
FF - prefs.js: network.proxy.http_port - 56606
FF - prefs.js: network.proxy.type - 0
.
- - - - ORPHANS REMOVED - - - -
.
WebBrowser-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file)
.
.
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\services\Akamai]
"ServiceDll"="c:\program files (x86)\common files\akamai/netsession_win_7de0ed9.dll"
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{BEB3C0C7-B648-4257-96D9-B5D024816E27}\Version*Version]
"Version"=hex:de,1d,be,b5,20,fd,5f,9f,68,61,85,69,1d,1e,14,b5,63,2d,1b,0a,25,
b6,d4,67,ea,c8,6d,43,c4,a6,ea,bc,48,6f,b9,f8,86,78,71,a4,29,95,60,06,a8,9f,\
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil10o_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil10o_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10o.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.10"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10o.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10o.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10o.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\software\Minnetonka Audio Software\SurCode Dolby Digital Premiere\Version*Version]
"Version"=hex:de,1d,be,b5,20,fd,5f,9f,68,61,85,69,1d,1e,14,b5,63,2d,1b,0a,25,
b6,d4,67,ea,c8,6d,43,c4,a6,ea,bc,48,6f,b9,f8,86,78,71,a4,29,95,60,06,a8,9f,\
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Completion time: 2012-02-24 01:07:58
ComboFix-quarantined-files.txt 2012-02-24 06:07
ComboFix2.txt 2012-02-17 21:32
ComboFix3.txt 2012-02-15 03:52
ComboFix4.txt 2012-01-23 01:24
ComboFix5.txt 2012-02-17 23:24
.
Pre-Run: 141,047,136,256 bytes free
Post-Run: 140,998,381,568 bytes free
.
- - End Of File - - 0E7B2531E665BCE2548190530C40D3EB



Thank you so much.

#12 JSntgRvr

JSntgRvr

    Master Surgeon General


  • Malware Response Team
  • 11,762 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Puerto Rico
  • Local time:06:06 AM

Posted 24 February 2012 - 01:47 PM

Download the enclosed file.

Save it next to Combofix.

Posted Image

Once saved, referring to the picture above, drag CFScript.txt into ComboFix.exe, and post back the resulting report.

Lets scan for remnants:

Posted Image Please download Malwarebytes' Anti-Malware from Here. Never download Malwarebytes' Anti-Malware from other sources.

Double Click mbam-setup.exe to install the application.
  • Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
  • If an update is found, it will download and install the latest version.
  • Once the program has loaded, select "Perform Quick Scan", then click Scan.
  • The scan may take some time to finish,so please be patient.
  • When the scan is complete, click OK, then Show Results to view the results.
  • Make sure that everything is checked, and click Remove Selected.
  • When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
  • The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
  • Copy&Paste the entire report in your next reply.
Extra Note:

If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process. If asked to restart the computer, please do so immediatly.

ESET online scannner

Note: You can use either Internet Explorer or Mozilla FireFox for this scan.

Note: If you are using Windows Vista or Windows 7, open your browser by right-clicking on its icon and select 'Run as administrator' to perform this scan.

  • First please Disable any Antivirus you have active, as shown in This topic.
  • Note: Don't forget to re-enable it after the scan.
  • Next hold down Control then click on the following link to open a new window to ESET online scannner.
  • Select the option YES, I accept the Terms of Use then click on Start.

    Note: If using Mozilla Firefox you will need to download esetsmartinstaller_enu.exe when prompted then double click on it to install.

  • All of the below instructions are compatible with either Internet Explorer or Mozilla FireFox.
  • When prompted allow the Add-On/Active X to install.
  • Make sure that the option Remove found threats is NOT checked, and the option Scan archives is checked.
  • Now click on Advanced Settings and select the following:

    Scan for potentially unwanted applications
    Scan for potentially unsafe applications
    Enable Anti-Stealth Technology

  • Now click on Start.
  • The virus signature database... will begin to download. Be patient this make take some time depending on the speed of your Internet Connection.
  • When completed the Online Scan will begin automatically.
  • Do not touch either the Mouse or keyboard during the scan otherwise it may stall.
  • When completed select Uninstall application on close if you so wish, make sure you copy the logfile first!
  • Now click on Finish.
  • Use notepad to open the logfile located at C:\Program Files\ESET\EsetOnlineScanner\log.txt.
  • Copy and paste that log as a reply to this topic.

No request for help throughout private messaging will be attended.

If I have helped you, consider making a donation to help me continue the fight against Malware!
btn_donate_SM.gif


#13 PokerHandfull

PokerHandfull
  • Topic Starter

  • Members
  • 7 posts
  • OFFLINE
  •  
  • Local time:05:06 AM

Posted 27 February 2012 - 12:08 PM

This is my new comofix log after using the cfscript on it. I'm doing the rest shortly.

ComboFix 12-02-23.01 - Rigatoni 02/27/2012 11:19:16.11.2 - x64
Microsoft Windows 7 Ultimate 6.1.7600.0.1252.1.1033.18.6143.4741 [GMT -5:00]
Running from: c:\users\Rigatoni\Desktop\ComboFix.exe
Command switches used :: c:\users\Rigatoni\Desktop\CFScript.txt
SP: Windows Defender *Enabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
* Created a new restore point
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\windows\Tasks\At19.job
c:\windows\Tasks\At27.job
c:\windows\Tasks\At29.job
c:\windows\Tasks\At33.job
c:\windows\Tasks\At35.job
c:\windows\Tasks\At37.job
c:\windows\Tasks\At39.job
c:\windows\Tasks\At43.job
c:\windows\Tasks\At45.job
c:\windows\Tasks\At47.job
c:\windows\Tasks\At5.job
c:\windows\Tasks\At7.job
c:\windows\Tasks\At9.job
.
.
((((((((((((((((((((((((( Files Created from 2012-01-27 to 2012-02-27 )))))))))))))))))))))))))))))))
.
.
2012-02-27 16:26 . 2012-02-27 16:26 -------- d-----w- c:\users\Public\AppData\Local\temp
2012-02-27 16:26 . 2012-02-27 16:26 -------- d-----w- c:\users\Mcx1-PASTAPETE\AppData\Local\temp
2012-02-27 16:26 . 2012-02-27 16:26 -------- d-----w- c:\users\Default\AppData\Local\temp
2012-02-23 21:55 . 2012-02-23 21:56 -------- d-----w- C:\FRST
2012-02-21 15:41 . 2012-02-21 15:41 -------- d-----w- C:\TDSSKiller_Quarantine
2012-02-17 21:47 . 2012-02-17 21:47 -------- d-----w- c:\users\Rigatoni\AppData\Roaming\Malwarebytes
2012-02-17 21:47 . 2012-02-17 21:47 -------- d-----w- c:\programdata\Malwarebytes
2012-02-17 21:47 . 2012-02-23 17:34 -------- d-----w- c:\program files (x86)\Malwarebytes' Anti-Malware
2012-02-17 21:40 . 2012-02-23 17:34 -------- d-----w- c:\program files (x86)\Common Files\PC Tools
2012-02-17 21:40 . 2012-02-23 17:34 -------- d-----w- c:\program files (x86)\PC Tools Security
2012-02-17 21:40 . 2012-02-17 21:40 -------- d-----w- c:\users\Rigatoni\AppData\Roaming\PC Tools
2012-02-17 21:38 . 2012-02-17 21:40 -------- d-----w- c:\programdata\PC Tools
2012-02-15 05:07 . 2012-02-16 20:29 -------- d-----w- c:\users\Rigatoni\AppData\Roaming\.minecraft
2012-02-15 04:03 . 2012-02-15 04:03 -------- d-----w- c:\users\Rigatoni\AppData\Roaming\NVIDIA
2012-02-15 03:56 . 2012-02-24 05:49 -------- d-----w- c:\users\UpdatusUser
2012-02-15 03:56 . 2012-02-15 03:56 -------- d-----w- c:\program files (x86)\NVIDIA Corporation
2012-02-15 03:56 . 2012-02-15 03:56 -------- d-----w- c:\programdata\NVIDIA
2012-02-15 03:56 . 2011-10-15 08:53 837952 ----a-w- c:\windows\system32\easyupdatusapiu64.dll
2012-02-15 03:56 . 2011-10-15 08:53 5067584 ----a-w- c:\windows\system32\nvsvc64.dll
2012-02-15 03:56 . 2011-10-15 08:53 222528 ----a-w- c:\windows\system32\nvmctray.dll
2012-02-15 03:56 . 2011-10-15 08:53 1640768 ----a-w- c:\windows\system32\nvvsvc.exe
2012-02-15 03:56 . 2011-10-15 08:53 137536 ----a-w- c:\windows\system32\nvshext.dll
2012-02-15 03:56 . 2011-10-15 08:53 10406208 ----a-w- c:\windows\system32\nvcpl.dll
2012-02-15 03:56 . 2012-02-15 03:56 -------- d-----w- c:\programdata\NVIDIA Corporation
2012-02-15 02:56 . 2012-02-15 03:56 -------- d-----w- c:\program files\NVIDIA Corporation
2012-02-15 02:45 . 2012-02-23 17:33 -------- d-----w- C:\NVIDIA
2012-02-15 01:56 . 2012-02-15 01:56 -------- d-----w- c:\users\Rigatoni\AppData\Roaming\SystemRequirementsLab
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-12-18 20:02 . 2011-06-13 05:44 414368 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2011-12-08 15:18 . 2011-12-08 15:19 32256 ----a-w- c:\windows\SysWow64\Q6D2T3M.com
.
.
((((((((((((((((((((((((((((( SnapShot_2012-02-24_06.05.44 )))))))))))))))))))))))))))))))))))))))))
.
+ 2011-04-11 16:58 . 2012-02-24 16:35 35374 c:\windows\system32\wdi\ShutdownPerformanceDiagnostics_SystemData.bin
+ 2009-07-14 05:10 . 2012-02-24 16:35 35770 c:\windows\system32\wdi\BootPerformanceDiagnostics_SystemData.bin
- 2009-07-14 05:10 . 2012-02-24 05:50 35770 c:\windows\system32\wdi\BootPerformanceDiagnostics_SystemData.bin
+ 2011-04-08 21:06 . 2012-02-24 16:35 10504 c:\windows\system32\wdi\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-911654618-2236601301-3508037184-1001_UserData.bin
+ 2011-04-07 05:48 . 2012-02-24 18:06 16384 c:\windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
- 2011-04-07 05:48 . 2012-02-17 21:40 16384 c:\windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
- 2011-04-07 05:48 . 2012-02-17 21:40 32768 c:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
+ 2011-04-07 05:48 . 2012-02-24 18:06 32768 c:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
+ 2009-07-14 04:54 . 2012-02-24 18:06 16384 c:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
- 2009-07-14 04:54 . 2012-02-17 21:40 16384 c:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2011-04-07 04:47 . 2012-02-24 16:35 16384 c:\windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
- 2011-04-07 04:47 . 2012-02-24 05:50 16384 c:\windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
+ 2011-04-07 04:47 . 2012-02-24 16:35 32768 c:\windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
- 2011-04-07 04:47 . 2012-02-24 05:50 32768 c:\windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
+ 2011-04-07 04:47 . 2012-02-24 16:35 16384 c:\windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
- 2011-04-07 04:47 . 2012-02-24 05:50 16384 c:\windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
- 2011-04-07 04:47 . 2012-02-24 05:50 16384 c:\windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
+ 2011-04-07 04:47 . 2012-02-24 16:35 16384 c:\windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
- 2011-04-07 04:47 . 2012-02-24 05:50 16384 c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2011-04-07 04:47 . 2012-02-24 16:35 16384 c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
- 2012-02-24 05:48 . 2012-02-24 05:48 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
+ 2012-02-24 16:33 . 2012-02-24 16:33 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
+ 2012-02-24 16:33 . 2012-02-24 16:33 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
- 2012-02-24 05:48 . 2012-02-24 05:48 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
+ 2009-07-14 04:54 . 2012-02-24 16:33 671744 c:\windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
- 2009-07-14 04:54 . 2012-02-24 05:48 671744 c:\windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
+ 2011-04-07 04:47 . 2012-02-27 15:50 293766 c:\windows\system32\wdi\SuspendPerformanceDiagnostics_SystemData_FastS4.bin
- 2009-07-14 02:36 . 2012-02-24 05:52 615566 c:\windows\system32\perfh009.dat
+ 2009-07-14 02:36 . 2012-02-24 16:38 615566 c:\windows\system32\perfh009.dat
- 2009-07-14 02:36 . 2012-02-24 05:52 103682 c:\windows\system32\perfc009.dat
+ 2009-07-14 02:36 . 2012-02-24 16:38 103682 c:\windows\system32\perfc009.dat
+ 2009-07-14 05:12 . 2012-02-24 16:58 245760 c:\windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\IETldCache\index.dat
- 2009-07-14 05:12 . 2012-01-01 05:02 245760 c:\windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\IETldCache\index.dat
+ 2009-07-14 05:01 . 2012-02-24 06:19 358868 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-System.dat
- 2009-07-14 05:01 . 2012-02-21 15:41 358868 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-System.dat
+ 2009-07-14 04:54 . 2012-02-24 16:33 5586944 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
- 2009-07-14 04:54 . 2012-02-24 05:48 5586944 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
+ 2009-07-14 04:54 . 2012-02-24 16:33 4538368 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
- 2009-07-14 04:54 . 2012-02-24 05:48 4538368 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2009-07-14 02:34 . 2012-02-24 18:22 9437184 c:\windows\system32\SMI\Store\Machine\schema.dat
- 2009-07-14 02:34 . 2012-02-23 17:51 9437184 c:\windows\system32\SMI\Store\Machine\schema.dat
+ 2011-09-10 17:40 . 2012-02-24 06:19 27271564 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-S-1-5-21-911654618-2236601301-3508037184-1001-12288.dat
- 2011-09-10 17:40 . 2012-02-21 15:41 27271564 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-S-1-5-21-911654618-2236601301-3508037184-1001-12288.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"LightScribe Control Panel"="c:\program files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe" [2011-03-04 2741616]
"RoboForm"="c:\program files (x86)\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe" [2011-09-05 107000]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"WinPatrol"="c:\program files (x86)\BillP Studios\WinPatrol\winpatrol.exe" [2011-05-15 325512]
"iTunesHelper"="c:\program files (x86)\iTunes\iTunesHelper.exe" [2012-01-16 421736]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"Smad"="c:\windows\system32\config\systemprofile\AppData\Local\SanctionedMedia\Smad\Smad.exe" [2012-01-11 37376]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 0 (0x0)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"HideSCAHealth"= 1 (0x1)
.
[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"HideSCAHealth"= 1 (0x1)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]
"aux1"=wdmaud.drv
.
R3 McComponentHostService;McAfee Security Scan Component Host Service;c:\program files (x86)\McAfee Security Scan\2.0.181\McCHSvc.exe [2010-01-15 227232]
R3 osppsvc;Office Software Protection Platform;c:\program files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-01-10 4925184]
R3 rt61x64;Ralink RT61 Wireless Driver for Windows Vista;c:\windows\system32\DRIVERS\netr6164.sys [x]
R3 SwitchBoard;Adobe SwitchBoard;c:\program files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [2010-02-19 517096]
R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys [x]
S0 PxHlpa64;PxHlpa64;c:\windows\System32\Drivers\PxHlpa64.sys [x]
S2 Akamai;Akamai NetSession Interface;c:\windows\System32\svchost.exe [2009-07-14 27136]
S2 cvhsvc;Client Virtualization Handler;c:\program files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE [2010-02-28 821664]
S2 nvUpdatusService;NVIDIA Update Service Daemon;c:\program files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe [2011-10-15 2253120]
S2 sftlist;Application Virtualization Client;c:\program files (x86)\Microsoft Application Virtualization Client\sftlist.exe [2009-12-03 483688]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [x]
S3 Sftfs;Sftfs;c:\windows\system32\DRIVERS\Sftfslh.sys [x]
S3 Sftplay;Sftplay;c:\windows\system32\DRIVERS\Sftplaylh.sys [x]
S3 Sftredir;Sftredir;c:\windows\system32\DRIVERS\Sftredirlh.sys [x]
S3 Sftvol;Sftvol;c:\windows\system32\DRIVERS\Sftvollh.sys [x]
S3 sftvsa;Application Virtualization Service Agent;c:\program files (x86)\Microsoft Application Virtualization Client\sftvsa.exe [2009-12-03 209768]
.
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\svchost]
Akamai REG_MULTI_SZ Akamai
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
2011-03-04 16:29 451872 ----a-w- c:\program files (x86)\Common Files\LightScribe\LSRunOnce.exe
.
.
--------- x86-64 -----------
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AdobeAAMUpdater-1.0"="c:\program files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe" [2011-03-15 499608]
.
------- Supplementary Scan -------
.
uLocal Page = c:\windows\system32\blank.htm
mLocal Page = c:\windows\SysWOW64\blank.htm
uInternet Settings,ProxyOverride = *.local
uInternet Settings,ProxyServer = http=127.0.0.1:56606
IE: Customize Menu - file://c:\program files (x86)\Siber Systems\AI RoboForm\RoboFormComCustomizeIEMenu.html
IE: Fill Forms - file://c:\program files (x86)\Siber Systems\AI RoboForm\RoboFormComFillForms.html
IE: RoboForm Toolbar - file://c:\program files (x86)\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
IE: Save Forms - file://c:\program files (x86)\Siber Systems\AI RoboForm\RoboFormComSavePass.html
TCP: DhcpNameServer = 192.168.1.1
FF - ProfilePath - c:\users\Rigatoni\AppData\Roaming\Mozilla\Firefox\Profiles\vrfry1vt.default\
FF - prefs.js: network.proxy.http_port - 56606
FF - prefs.js: network.proxy.type - 0
.
- - - - ORPHANS REMOVED - - - -
.
WebBrowser-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file)
.
.
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\services\Akamai]
"ServiceDll"="c:\program files (x86)\common files\akamai/netsession_win_7de0ed9.dll"
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{BEB3C0C7-B648-4257-96D9-B5D024816E27}\Version*Version]
"Version"=hex:de,1d,be,b5,20,fd,5f,9f,68,61,85,69,1d,1e,14,b5,63,2d,1b,0a,25,
b6,d4,67,ea,c8,6d,43,c4,a6,ea,bc,48,6f,b9,f8,86,78,71,a4,29,95,60,06,a8,9f,\
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil10o_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil10o_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10o.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.10"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10o.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10o.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10o.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\software\Minnetonka Audio Software\SurCode Dolby Digital Premiere\Version*Version]
"Version"=hex:de,1d,be,b5,20,fd,5f,9f,68,61,85,69,1d,1e,14,b5,63,2d,1b,0a,25,
b6,d4,67,ea,c8,6d,43,c4,a6,ea,bc,48,6f,b9,f8,86,78,71,a4,29,95,60,06,a8,9f,\
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Completion time: 2012-02-27 11:36:36
ComboFix-quarantined-files.txt 2012-02-27 16:36
ComboFix2.txt 2012-02-24 16:49
ComboFix3.txt 2012-02-17 21:32
ComboFix4.txt 2012-02-15 03:52
ComboFix5.txt 2012-02-27 16:16
.
Pre-Run: 139,093,909,504 bytes free
Post-Run: 139,040,063,488 bytes free
.
- - End Of File - - 4DC400DD5DB8A30BC6532A6BC2F51CA7

#14 PokerHandfull

PokerHandfull
  • Topic Starter

  • Members
  • 7 posts
  • OFFLINE
  •  
  • Local time:05:06 AM

Posted 27 February 2012 - 02:23 PM

Done, both programs found things. Any further steps?




And my Malware bytes log -

Malwarebytes Anti-Malware (Trial) 1.60.1.1000
www.malwarebytes.org

Database version: v2012.02.27.02

Windows 7 x64 NTFS
Internet Explorer 8.0.7600.16385
Rigatoni :: PASTAPETE [administrator]

Protection: Disabled

2/27/2012 12:09:40 PM
mbam-log-2012-02-27 (12-09-40).txt

Scan type: Quick scan
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
Scan options disabled: P2P
Objects scanned: 225371
Time elapsed: 3 minute(s),

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 0
(No malicious items detected)

Registry Values Detected: 1
HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Run|Smad (Trojan.Agent) -> Data: "C:\Windows\system32\config\systemprofile\AppData\Local\SanctionedMedia\Smad\Smad.exe" -> Quarantined and deleted successfully.

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 0
(No malicious items detected)

Files Detected: 4
C:\Windows\System32\config\systemprofile\AppData\Local\SanctionedMedia\Smad\Smad.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Windows\System32\config\systemprofile\AppData\Roaming\D88B3\0A616.exe (Trojan.Dropper.PE4) -> Quarantined and deleted successfully.
C:\Windows\System32\Q6D2T3M.com (Trojan.Email) -> Quarantined and deleted successfully.
C:\Windows\SysWOW64\Q6D2T3M.com (Trojan.Email) -> Quarantined and deleted successfully.

(end)

And my ESET log -

C:\Program Files (x86)\B3B5D\lvvm.exe a variant of Win32/Kryptik.ZGB trojan cleaned by deleting - quarantined
C:\Qoobox\Quarantine\C\Windows\System32\consrv.dll.vir Win64/Sirefef.G trojan cleaned by deleting - quarantined
C:\Users\Rigatoni\AppData\Roaming\FrostWire\.AppSpecialShare\frostwire-4.21.8.windows.exe Win32/OpenCandy application deleted - quarantined
C:\Users\Rigatoni\AppData\Roaming\FrostWire\.AppSpecialShare\frostwire-5.0.8.windows.exe Win32/OpenCandy application deleted - quarantined
C:\Users\Rigatoni\Desktop\keygen.exe multiple threats deleted - quarantined
C:\Users\Rigatoni\Downloads\GrabIt Downloads\Adobe Flash Catalyst CS5 5 v1 5 Multilingual Incl Keymaker-CORE.NFO\CORE10k.exe Win32/TrojanDownloader.Small.PEF trojan deleted - quarantined
C:\Users\Rigatoni\Downloads\GrabIt Downloads\Adobe Flash Catalyst CS5 5 v1 5 Multilingual Incl Keymaker-CORE.NFO\keygen.exe multiple threats deleted - quarantined
C:\Users\Rigatoni\Downloads\GrabIt Downloads\Adobe Flash Catalyst CS5 5 v1 5 Multilingual Incl Keymaker-CORE.NFO\setup.exe Win32/TrojanDownloader.Small.PEF trojan deleted - quarantined
C:\Users\Rigatoni\Downloads\GrabIt Downloads\Adobe Flash Professional CS5 5 v11 5 Incl Keymaker-CORE.NFO\CORE10k.exe Win32/TrojanDownloader.Small.PEF trojan deleted - quarantined
C:\Users\Rigatoni\Downloads\GrabIt Downloads\Adobe Photoshop CS5 Extended v12 0.nfo\keygen.exe multiple threats deleted - quarantined
C:\Users\Rigatoni\Downloads\GrabIt Downloads\Adobe Photoshop CS5 Extended v12 0.nfo\photoshop_12_ls1.exe Win32/TrojanDownloader.Small.PEF trojan deleted - quarantined
C:\Users\Rigatoni\Downloads\GrabIt Downloads\Adobe.After.Effects.CS5.v10.0.x64.Incl.Keymaker-EMBRACE.nfo\keygen.exe a variant of Win32/HackTool.Patcher.P application cleaned by deleting - quarantined
C:\Users\Rigatoni\Downloads\GrabIt Downloads\Adobe.After.Effects.CS5.v10.0.x64.Incl.Keymaker-EMBRACE.nfo\keygen_plugin.exe a variant of Win32/Keygen.BK application cleaned by deleting - quarantined
C:\Windows\System32\config\systemprofile\AppData\Local\oql.exe a variant of Win32/Kryptik.YUY trojan cleaned by deleting - quarantined
C:\Windows\System32\config\systemprofile\AppData\Local\uwv.exe a variant of Win32/Kryptik.YUY trojan cleaned by deleting - quarantined
C:\Windows\System32\config\systemprofile\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\9\7ce9e4c9-2e8d7f5a a variant of Win32/Kryptik.ZEX trojan cleaned by deleting - quarantined

#15 JSntgRvr

JSntgRvr

    Master Surgeon General


  • Malware Response Team
  • 11,762 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Puerto Rico
  • Local time:06:06 AM

Posted 27 February 2012 - 06:26 PM

You should now be able to reach the Advanced menu tapping F8 at startup.

For x32 (x86) bit systems download Farbar Recovery Scan Tool and save it to a flash drive.

For x64 bit systems download Farbar Recovery Scan Tool x64 and save it to a flash drive.

Plug the flashdrive into the infected PC.

Enter System Recovery Options.

To enter System Recovery Options from the Advanced Boot Options:
  • Restart the computer.
  • As soon as the BIOS is loaded begin tapping the F8 key until Advanced Boot Options appears.
  • Use the arrow keys to select the Repair your computer menu item.
  • Select US as the keyboard language settings, and then click Next.
  • Select the operating system you want to repair, and then click Next.
  • Select your user account an click Next.

To enter System Recovery Options by using Windows installation disc:
  • Insert the installation disc.
  • Restart your computer.
  • If prompted, press any key to start Windows from the installation disc. If your computer is not configured to start from a CD or DVD, check your BIOS settings.
  • Click Repair your computer.
  • Select US as the keyboard language settings, and then click Next.
  • Select the operating system you want to repair, and then click Next.
  • Select your user account and click Next.
On the System Recovery Options menu you will get the following options:
Startup Repair
System Restore
Windows Complete PC Restore
Windows Memory Diagnostic ToolCommand Prompt
[*]Select Command Prompt
[*]In the command window type in notepad and press Enter.
[*]The notepad opens. Under File menu select Open.
[*]Select "Computer" and find your flash drive letter and close the notepad.
[*]In the command window type e:\frst.exe (for x64 bit version type e:\frst64) and press Enter

Note: Replace letter e with the drive letter of your flash drive.

[*]The tool will start to run.
[*]When the tool opens click Yes to disclaimer.
[*]Press Scan button.
[*]It will make a log (FRST.txt) on the flash drive. Please copy and paste it to your reply.[/list]

No request for help throughout private messaging will be attended.

If I have helped you, consider making a donation to help me continue the fight against Malware!
btn_donate_SM.gif





0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users