Author Topic: Disappearing Programs Problems - Directed Here From Original Thread (Read 28060 times)

smbulger · « **on:** September 15, 2012, 05:44:03 PM »

Beginning in July with the monthly Windows patch update, I noticed that my Flash player needed to be reinstalled after every restart of my system. A tthe time, it was just the Flash player, and it was s two minute fix once a week when I restarted my computer so it was no big deal. Additionally, any new software that I installed after that time also disappeared after any reboot. Now it's a big deal.

I'm running Windows 7 on a computer less than a year old. I am the only user, and all of the permissions appear to be set to give me complete access to everything as the administrator. When I install anything, a window will pop up asking if I am giving this program permission to change my hard drive, and I always answer yes.

Adobe Flash Player was the first one that I noticed. Then I upgraded to Adobe CS6 and I upgraded my Firefox, and have the same issues with those. I use Norton 360 for protection, but I can't get that to open up and run a scan. Everthing says that it is operating and current, but I can't open it up
I've followed the steps as requested and posted all logs her.

Thank you.

AdwCleaner Log

# AdwCleaner v2.001 - Logfile created 09/15/2012 at 19:38:22
# Updated 09/09/2012 by Xplode
# Operating system : Windows 7 Home Premium Service Pack 1 (64 bits)
# User : Scott - SCOTT-HP
# Boot Mode : Normal
# Running from : C:\Users\Scott\Desktop\adwcleaner.exe
# Option [Search]

***** [Services] *****

***** [Files / Folders] *****

Folder Found : C:\Program Files (x86)\iBryte
Folder Found : C:\Users\Scott\AppData\Roaming\Mozilla\Firefox\Profiles\vpk2obyb.default\FCTB

***** [Registry] *****

Key Found : HKCU\Software\AppDataLow\Software\Crossrider
Key Found : HKCU\Software\Cr_Installer
Key Found : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{2FA28606-DE77-4029-AF96-B231E3B8F827}
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{11111111-1111-1111-1111-110011221158}
Key Found : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{65BCD620-07DD-012F-819F-073CF1B8F7C6}
Key Found : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\{2FA28606-DE77-4029-AF96-B231E3B8F827}
Key Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{2FA28606-DE77-4029-AF96-B231E3B8F827}
Key Found : HKU\S-1-5-21-1701188631-4081876279-203721913-1000\Software\Microsoft\Internet Explorer\SearchScopes\{2FA28606-DE77-4029-AF96-B231E3B8F827}
Value Found : HKCU\Software\Microsoft\Internet Explorer\New Windows\Allow [*.crossrider.com]
Value Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\New Windows\Allow [*.crossrider.com]
Value Found : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar [{B278D9F8-0FA9-465E-9938-0C392605D8E3}]

***** [Internet Browsers] *****

-\\ Internet Explorer v8.0.7601.17514

[OK] Registry is clean.

-\\ Mozilla Firefox v15.0 (en-US)

Profile name : default
File : C:\Users\Scott\AppData\Roaming\Mozilla\Firefox\Profiles\vpk2obyb.default\prefs.js

Found : user_pref("browser.search.selectedEngine", "Search the Web");
Found : user_pref("freecause003e1c8febd6f07475514b31c0f547 ec.AutoSearchEventData", "auto%20search");
Found : user_pref("freecause003e1c8febd6f07475514b31c0f547 ec.ClearCacheDate", 3);
Found : user_pref("freecause003e1c8febd6f07475514b31c0f547 ec.DNSCatch", true);
Found : user_pref("freecause003e1c8febd6f07475514b31c0f547 ec.DisplayEULA", true);
Found : user_pref("freecause003e1c8febd6f07475514b31c0f547 ec.DnsCatchEventData", "dns%20catch");
Found : user_pref("freecause003e1c8febd6f07475514b31c0f547 ec.EBOMode", true);
Found : user_pref("freecause003e1c8febd6f07475514b31c0f547 ec.FirstLaunchShown", true);
Found : user_pref("freecause003e1c8febd6f07475514b31c0f547 ec.InstallDomain", "freecause.com");
Found : user_pref("freecause003e1c8febd6f07475514b31c0f547 ec.InstallType", "standard");
Found : user_pref("freecause003e1c8febd6f07475514b31c0f547 ec.LoadLayoutDate.100770", 3);
Found : user_pref("freecause003e1c8febd6f07475514b31c0f547 ec.NewTabSearchEventData", "tab%20search");
Found : user_pref("freecause003e1c8febd6f07475514b31c0f547 ec.ShowRecommendedOptions", true);
Found : user_pref("freecause003e1c8febd6f07475514b31c0f547 ec.StateReportDate", "1341197956928");
Found : user_pref("freecause003e1c8febd6f07475514b31c0f547 ec.TopRightSearchEventData", "top%20right%20search[...]
Found : user_pref("freecause003e1c8febd6f07475514b31c0f547 ec.beforeInstallSaved", true);
Found : user_pref("freecause003e1c8febd6f07475514b31c0f547 ec.beforeinstall.homepage", "hxxp%3A//www.google.c[...]
Found : user_pref("freecause003e1c8febd6f07475514b31c0f547 ec.beforeinstall.search", "Google");
Found : user_pref("freecause003e1c8febd6f07475514b31c0f547 ec.customNewTab", false);
Found : user_pref("freecause003e1c8febd6f07475514b31c0f547 ec.helpUsImprove", true);
Found : user_pref("freecause003e1c8febd6f07475514b31c0f547 ec.hideOthers", true);
Found : user_pref("freecause003e1c8febd6f07475514b31c0f547 ec.partnerauth", false);
Found : user_pref("freecause003e1c8febd6f07475514b31c0f547 ec.processAddrBar", true);
Found : user_pref("freecause003e1c8febd6f07475514b31c0f547 ec.restoreSearch", false);
Found : user_pref("freecause003e1c8febd6f07475514b31c0f547 ec.runcmd.", "bb_acct_status_1341336730");
Found : user_pref("freecause003e1c8febd6f07475514b31c0f547 ec.searchHistory", true);
Found : user_pref("freecause003e1c8febd6f07475514b31c0f547 ec.session", "E06C375DB23EB7B39B884B8BC52C3128FEF9[...]
Found : user_pref("freecause003e1c8febd6f07475514b31c0f547 ec.showFirstLaunchOptions", false);
Found : user_pref("freecause003e1c8febd6f07475514b31c0f547 ec.tb_lang", "en");
Found : user_pref("freecause003e1c8febd6f07475514b31c0f547 ec.tool_id", "100770");
Found : user_pref("freecause003e1c8febd6f07475514b31c0f547 ec.user_id", "108198938");
Found : user_pref("freecause003e1c8febd6f07475514b31c0f547 ec.user_key", "b9f15a883011fd1b4b091cf8a590f6e8da2[...]
Found : user_pref("freecause003e1c8febd6f07475514b31c0f547 ec.user_layouts", "100770");
Found : user_pref("freecause003e1c8febd6f07475514b31c0f547 ec.user_lnames", "fcreward.100770.b");
Found : user_pref("freecause003e1c8febd6f07475514b31c0f547 ec.xml_service_url", "6bb94bbf55fe2f255901a560824a[...]
Found : user_pref("freecause003e1c8febd6f07475514b31c0f547 ec.yahooSearch", true);

Profile name : default-1341337853154 [Profil par défaut]
File : C:\Users\Scott\AppData\Roaming\Mozilla\Firefox\Profiles\x6dvm2ys.default-1341337853154\prefs.js

[OK] File is clean.

-\\ Google Chrome v [Unable to get version]

File : C:\Users\Scott\AppData\Local\Google\Chrome\User Data\Default\Preferences

[OK] File is clean.

*************************

AdwCleaner[R1].txt - [5614 octets] - [15/09/2012 19:38:22]

########## EOF - C:\AdwCleaner[R1].txt - [5674 octets] ##########

smbulger · « **Reply #1 on:** September 15, 2012, 06:00:25 PM »

Malaware Bytes Log

Malwarebytes Anti-Malware (Trial) 1.65.0.1400
www.malwarebytes.org

Database version: v2012.09.15.06

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 8.0.7601.17514
Scott :: SCOTT-HP [administrator]

Protection: Enabled

9/15/2012 7:50:37 PM
mbam-log-2012-09-15 (19-50-37).txt

Scan type: Quick scan
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
Scan options disabled: P2P
Objects scanned: 202018
Time elapsed: 2 minute(s), 43 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 2
HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{65bcd620-07dd-012f-819f-073cf1b8f7c6} (Adware.GamePlayLab) -> Quarantined and deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{11111111-1111-1111-1111-110011221158} (Adware.GamePlayLab) -> Quarantined and deleted successfully.

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 0
(No malicious items detected)

Files Detected: 1
C:\Users\Scott\Downloads\DownloadManager_Setup.exe (PUP.Bundle.Installer.OI) -> Quarantined and deleted successfully.

(end)

smbulger · « **Reply #2 on:** September 15, 2012, 06:04:08 PM »

DDS.txt Log

.
DDS (Ver_2011-08-26.01) - NTFSAMD64
Internet Explorer: 8.0.7601.17514 BrowserJavaVersion: 1.6.0_33
Run by Scott at 20:03:50 on 2012-09-15
Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.7935.6175 [GMT -4:00]
.
AV: Norton 360 *Enabled/Updated* {63DF5164-9100-186D-2187-8DC619EFD8BF}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
SP: Norton 360 *Enabled/Updated* {D8BEB080-B73A-17E3-1B37-B6B462689202}
FW: Norton 360 *Enabled* {5BE4D041-DB6F-1935-0AD8-24F3E73C9FC4}
.
============== Running Processes ===============
.
C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\svchost.exe -k RPCSS
C:\Windows\system32\atiesrxx.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\atieclxx.exe
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Program Files (x86)\Common Files\EPSON\EBAPI\eEBSVC.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
C:\Program Files\Hewlett-Packard\HP Client Services\HPClientServices.exe
C:\Program Files (x86)\Hewlett-Packard\Shared\HPDrvMntSvc.exe
C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe
C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe
C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
C:\Program Files (x86)\Norton 360\Engine\6.3.0.14\ccSvcHst.exe
C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe
C:\Program Files (x86)\PDF Complete\pdfsvc.exe
C:\Program Files (x86)\Roxio\RoxioNow Player\RNowSvc.exe
C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe
C:\Windows\system32\svchost.exe -k imgsvc
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
C:\Windows\system32\taskhost.exe
C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE
C:\Windows\system32\WUDFHost.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\Windows\System32\rundll32.exe
C:\Program Files (x86)\Hewlett-Packard\HP Odometer\hpsysdrv.exe
C:\Program Files\Microsoft IntelliPoint\ipoint.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Microsoft IntelliPoint\dpupdchk.exe
C:\Program Files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe
C:\Program Files (x86)\Hp\HP Software Update\hpwuschd2.exe
C:\Program Files (x86)\Epson Software\Event Manager\EEventManager.exe
C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
C:\Windows\system32\SearchIndexer.exe
C:\Program Files (x86)\Common Files\Nikon\Monitor\NkMonitor.exe
C:\Program Files\Windows Media Player\wmpnetwk.exe
c:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe
C:\Windows\system32\sppsvc.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Program Files (x86)\Mozilla Firefox\firefox.exe
C:\Windows\servicing\TrustedInstaller.exe
C:\Windows\system32\SearchProtocolHost.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe
C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\conhost.exe
C:\Windows\SysWOW64\cscript.exe
C:\Windows\system32\wbem\wmiprvse.exe
.
============== Pseudo HJT Report ===============
.
mWinlogon: Userinit=userinit.exe,
BHO: Norton Identity Protection: {602adb0e-4aff-4217-8aa1-95dac4dfa408} - C:\Program Files (x86)\Norton 360\Engine\6.3.0.14\coIEPlg.dll
BHO: Norton Vulnerability Protection: {6d53ec84-6aae-4787-aeee-f4628f01010c} - C:\Program Files (x86)\Norton 360\Engine\6.3.0.14\IPS\IPSBHO.DLL
BHO: Java(tm) Plug-In SSV Helper: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - C:\Program Files (x86)\Java\jre6\bin\ssv.dll
BHO: Windows Live ID Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
BHO: Office Document Cache Handler: {b4f3a835-0e21-4959-ba22-42b3008e02ff} - C:\PROGRA~2\MICROS~1\Office14\URLREDIR.DLL
BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll
TB: Norton Toolbar: {7febefe3-6b19-4349-98d2-ffb09d4b49ca} - C:\Program Files (x86)\Norton 360\Engine\6.3.0.14\coIEPlg.dll
TB: {b278d9f8-0fa9-465e-9938-0c392605d8e3} - No File
TB: {47833539-D0C5-4125-9FA8-0819E2EAAC93} - No File
uRun: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
uRun: [LightScribe Control Panel] C:\Program Files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe -hidden
uRun: [AdobeBridge]
mRun: [StartCCC] "c:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
mRun: [HP Software Update] c:\Program Files (x86)\HP\HP Software Update\HPWuSchd2.exe
mRun: [Norton Online Backup] C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuClient.exe
mRun: [PDF Complete] C:\Program Files (x86)\PDF Complete\pdfsty.exe
mRun: [AdobeCS4ServiceManager] "C:\Program Files (x86)\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe" -launchedbylogin
mRun: [Adobe_ID0ENQBO] C:\PROGRA~2\COMMON~1\Adobe\ADOBEV~1\Server\bin\VERSIO~2.EXE
mRun: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime
mRun: [EEventManager] C:\PROGRA~2\EPSONS~1\EVENTM~1\EEventManager.exe
mRun: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
StartupFolder: C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\Startup\NIKONM~1.LNK - C:\Program Files (x86)\Common Files\Nikon\Monitor\NkMonitor.exe
mPolicies-explorer: NoActiveDesktop = 1 (0x1)
mPolicies-explorer: NoActiveDesktopChanges = 1 (0x1)
mPolicies-system: ConsentPromptBehaviorAdmin = 5 (0x5)
mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3)
mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
mPolicies-system: PromptOnSecureDesktop = 0 (0x0)
IE: Append Link Target to Existing PDF - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: Append to Existing PDF - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert Link Target to Adobe PDF - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
IE: Convert to Adobe PDF - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECapture.html
IE: E&xport to Microsoft Excel - C:\PROGRA~2\MICROS~1\Office14\EXCEL.EXE/3000
IE: Se&nd to OneNote - C:\PROGRA~2\MICROS~1\Office14\ONBttnIE.dll/105
IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIE.dll
IE: {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - {FFFDC614-B694-4AE6-AB38-5D6374584B52} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIELinkedNotes.dll
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_33-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_33-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_33-windows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxps://fpdownload.macromedia.com/get/shockwave/cabs/flash/swflash.cab
TCP: DhcpNameServer = 156.154.119.11 156.154.129.11
TCP: Interfaces\{44E48F66-46A3-4921-AD0C-C94B6F75A2AD} : DhcpNameServer = 156.154.119.11 156.154.129.11
Filter: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\MSOXMLMF.DLL
Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files (x86)\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll
mASetup: {10880D85-AAD9-4558-ABDC-2AB1552D831F} - "C:\Program Files (x86)\Common Files\LightScribe\LSRunOnce.exe"
BHO-X64: Norton Identity Protection: {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files (x86)\Norton 360\Engine\6.3.0.14\coIEPlg.dll
BHO-X64: Norton Identity Protection - No File
BHO-X64: Norton Vulnerability Protection: {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files (x86)\Norton 360\Engine\6.3.0.14\IPS\IPSBHO.DLL
BHO-X64: Norton Vulnerability Protection - No File
BHO-X64: Java(tm) Plug-In SSV Helper: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre6\bin\ssv.dll
BHO-X64: Windows Live ID Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
BHO-X64: Office Document Cache Handler: {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~2\MICROS~1\Office14\URLREDIR.DLL
BHO-X64: URLRedirectionBHO - No File
BHO-X64: Java(tm) Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll
TB-X64: Norton Toolbar: {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton 360\Engine\6.3.0.14\coIEPlg.dll
TB-X64: {b278d9f8-0fa9-465e-9938-0c392605d8e3} - No File
TB-X64: {47833539-D0C5-4125-9FA8-0819E2EAAC93} - No File
mRun-x64: [StartCCC] "c:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
mRun-x64: [HP Software Update] c:\Program Files (x86)\HP\HP Software Update\HPWuSchd2.exe
mRun-x64: [Norton Online Backup] C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuClient.exe
mRun-x64: [PDF Complete] C:\Program Files (x86)\PDF Complete\pdfsty.exe
mRun-x64: [AdobeCS4ServiceManager] "C:\Program Files (x86)\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe" -launchedbylogin
mRun-x64: [Adobe_ID0ENQBO] C:\PROGRA~2\COMMON~1\Adobe\ADOBEV~1\Server\bin\VERSIO~2.EXE
mRun-x64: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime
mRun-x64: [EEventManager] C:\PROGRA~2\EPSONS~1\EVENTM~1\EEventManager.exe
mRun-x64: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
.
================= FIREFOX ===================
.
FF - ProfilePath - C:\Users\Scott\AppData\Roaming\Mozilla\Firefox\Profiles\x6dvm2ys.default-1341337853154\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/ig?hl=en&source=iglk
FF - plugin: C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL
FF - plugin: C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL
FF - plugin: C:\Program Files (x86)\Java\jre6\bin\plugin2\npjp2.dll
FF - plugin: c:\Program Files (x86)\Microsoft Silverlight\5.1.10411.0\npctrlui.dll
FF - plugin: C:\Program Files (x86)\WildTangent Games\App\BrowserIntegration\Registered\2\NP_wtapp.dll
FF - plugin: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll
FF - plugin: C:\Users\Default\AppData\Local\HuluDesktop\instances\0.9.13.1\nphdplg.dll
FF - plugin: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_4_402_265.dll
FF - plugin: C:\Windows\SysWOW64\npdeployJava1.dll
FF - plugin: C:\Windows\SysWOW64\npmproxy.dll
.
============= SERVICES / DRIVERS ===============
.
R0 amd_sata;amd_sata;C:\Windows\system32\drivers\amd_sata.sys --> C:\Windows\system32\drivers\amd_sata.sys [?]
R0 amd_xata;amd_xata;C:\Windows\system32\drivers\amd_xata.sys --> C:\Windows\system32\drivers\amd_xata.sys [?]
R0 PxHlpa64;PxHlpa64;C:\Windows\system32\Drivers\PxHlpa64.sys --> C:\Windows\system32\Drivers\PxHlpa64.sys [?]
R0 SymDS;Symantec Data Store;C:\Windows\system32\drivers\N360x64\0603000.00E\SYMDS64.SYS --> C:\Windows\system32\drivers\N360x64\0603000.00E\SYMDS64.SYS [?]
R0 SymEFA;Symantec Extended File Attributes;C:\Windows\system32\drivers\N360x64\0603000.00E\SYMEFA64.SYS --> C:\Windows\system32\drivers\N360x64\0603000.00E\SYMEFA64.SYS [?]
R1 IDSVia64;IDSVia64;C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_6.2.0.9\Definitions\IPSDefs\20120906.008\IDSviA64.sys [2012-9-6 513184]
R1 SymNetS;Symantec Network Security WFP Driver;C:\Windows\system32\Drivers\N360x64\0603000.00E\SYMNETS.SYS --> C:\Windows\system32\Drivers\N360x64\0603000.00E\SYMNETS.SYS [?]
R1 vwififlt;Virtual WiFi Filter Driver;C:\Windows\system32\DRIVERS\vwififlt.sys --> C:\Windows\system32\DRIVERS\vwififlt.sys [?]
R2 AMD External Events Utility;AMD External Events Utility;C:\Windows\system32\atiesrxx.exe --> C:\Windows\system32\atiesrxx.exe [?]
R2 cvhsvc;Client Virtualization Handler;C:\Program Files (x86)\Common Files\microsoft shared\Virtualization Handler\CVHSVC.EXE [2012-1-4 822624]
R2 HP Support Assistant Service;HP Support Assistant Service;C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSA_Service.exe [2011-9-9 86072]
R2 HPClientSvc;HP Client Services;C:\Program Files\Hewlett-Packard\HP Client Services\HPClientServices.exe [2010-10-11 346168]
R2 HPDrvMntSvc.exe;HP Quick Synchronization Service;C:\Program Files (x86)\Hewlett-Packard\Shared\HPDrvMntSvc.exe [2011-3-28 94264]
R2 MBAMScheduler;MBAMScheduler;C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [2012-9-15 399432]
R2 MBAMService;MBAMService;C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2012-9-15 676936]
R2 N360;Norton 360;C:\Program Files (x86)\Norton 360\Engine\6.3.0.14\ccsvchst.exe [2012-8-15 138272]
R2 NOBU;Norton Online Backup;C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe [2010-6-1 2804568]
R2 pdfcDispatcher;PDF Document Manager;C:\Program Files (x86)\PDF Complete\pdfsvc.exe [2011-4-11 1127448]
R2 RoxioNow Service;RoxioNow Service;C:\Program Files (x86)\Roxio\RoxioNow Player\RNowSvc.exe [2010-11-26 399344]
R2 sftlist;Application Virtualization Client;C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe [2011-10-1 508776]
R3 amdkmdag;amdkmdag;C:\Windows\system32\DRIVERS\atikmdag.sys --> C:\Windows\system32\DRIVERS\atikmdag.sys [?]
R3 amdkmdap;amdkmdap;C:\Windows\system32\DRIVERS\atikmpag.sys --> C:\Windows\system32\DRIVERS\atikmpag.sys [?]
R3 MBAMProtector;MBAMProtector;\??\C:\Windows\system32\drivers\mbam.sys --> C:\Windows\system32\drivers\mbam.sys [?]
R3 netr28x;Ralink 802.11n Extensible Wireless Driver;C:\Windows\system32\DRIVERS\netr28x.sys --> C:\Windows\system32\DRIVERS\netr28x.sys [?]
R3 RTL8167;Realtek 8167 NT Driver;C:\Windows\system32\DRIVERS\Rt64win7.sys --> C:\Windows\system32\DRIVERS\Rt64win7.sys [?]
R3 Sftfs;Sftfs;C:\Windows\system32\DRIVERS\Sftfslh.sys --> C:\Windows\system32\DRIVERS\Sftfslh.sys [?]
R3 Sftplay;Sftplay;C:\Windows\system32\DRIVERS\Sftplaylh.sys --> C:\Windows\system32\DRIVERS\Sftplaylh.sys [?]
R3 Sftredir;Sftredir;C:\Windows\system32\DRIVERS\Sftredirlh.sys --> C:\Windows\system32\DRIVERS\Sftredirlh.sys [?]
R3 Sftvol;Sftvol;C:\Windows\system32\DRIVERS\Sftvollh.sys --> C:\Windows\system32\DRIVERS\Sftvollh.sys [?]
R3 sftvsa;Application Virtualization Service Agent;C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe [2011-10-1 219496]
R3 usbfilter;AMD USB Filter Driver;C:\Windows\system32\drivers\usbfilter.sys --> C:\Windows\system32\drivers\usbfilter.sys [?]
R3 vwifimp;Microsoft Virtual WiFi Miniport Service;C:\Windows\system32\DRIVERS\vwifimp.sys --> C:\Windows\system32\DRIVERS\vwifimp.sys [?]
R3 WSDPrintDevice;WSD Print Support via UMB;C:\Windows\system32\DRIVERS\WSDPrint.sys --> C:\Windows\system32\DRIVERS\WSDPrint.sys [?]
R3 WSDScan;WSD Scan Support via UMB;C:\Windows\system32\DRIVERS\WSDScan.sys --> C:\Windows\system32\DRIVERS\WSDScan.sys [?]
S1 BHDrvx64;BHDrvx64;C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_6.2.0.9\Definitions\BASHDefs\20120905.001\BHDrvx64.sys [2012-8-31 1385120]
S1 ccSet_N360;Norton 360 Settings Manager;C:\Windows\system32\drivers\N360x64\0603000.00E\ccSetx64.sys --> C:\Windows\system32\drivers\N360x64\0603000.00E\ccSetx64.sys [?]
S1 SymIRON;Symantec Iron Driver;C:\Windows\system32\drivers\N360x64\0603000.00E\Ironx64.SYS --> C:\Windows\system32\drivers\N360x64\0603000.00E\Ironx64.SYS [?]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]
S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-3-18 138576]
S3 Adobe Version Cue CS4;Adobe Version Cue CS4;C:\Program Files (x86)\Common Files\Adobe\Adobe Version Cue CS4\Server\bin\VersionCueCS4.exe [2008-8-15 284016]
S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-4-1 250568]
S3 FLEXnet Licensing Service 64;FLEXnet Licensing Service 64;C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService64.exe [2011-10-4 1038088]
S3 GamesAppService;GamesAppService;C:\Program Files (x86)\WildTangent Games\App\GamesAppService.exe [2010-10-12 206072]
S3 MozillaMaintenance;Mozilla Maintenance Service;C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe [2012-5-3 114144]
S3 osppsvc;Office Software Protection Platform;C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-1-9 4925184]
S3 TsUsbFlt;TsUsbFlt;C:\Windows\system32\drivers\tsusbflt.sys --> C:\Windows\system32\drivers\tsusbflt.sys [?]
S3 TsUsbGD;Remote Desktop Generic USB Device;C:\Windows\system32\drivers\TsUsbGD.sys --> C:\Windows\system32\drivers\TsUsbGD.sys [?]
S3 WatAdminSvc;Windows Activation Technologies Service;C:\Windows\system32\Wat\WatAdminSvc.exe --> C:\Windows\system32\Wat\WatAdminSvc.exe [?]
S4 wlcrasvc;Windows Live Mesh remote connections service;C:\Program Files\Windows Live\Mesh\wlcrasvc.exe [2010-9-22 57184]
.
=============== Created Last 30 ================
.
2012-09-15 23:49:56   --------   d-----w-   C:\Users\Scott\AppData\Roaming\Malwarebytes
2012-09-15 23:49:22   --------   d-----w-   C:\ProgramData\Malwarebytes
2012-09-15 23:49:21   25928   ----a-w-   C:\Windows\System32\drivers\mbam.sys
2012-09-15 23:49:21   --------   d-----w-   C:\Program Files (x86)\Malwarebytes' Anti-Malware
2012-09-15 23:21:05   --------   d-----w-   C:\Program Files\CCleaner
2012-09-15 11:32:47   --------   d-----w-   C:\Program Files (x86)\Panda Security
2012-09-14 12:36:29   950128   ----a-w-   C:\Windows\System32\drivers\ndis.sys
2012-09-14 12:36:29   41472   ----a-w-   C:\Windows\System32\drivers\RNDISMP.sys
2012-09-14 12:36:27   574464   ----a-w-   C:\Windows\System32\d3d10level9.dll
2012-09-14 12:36:27   490496   ----a-w-   C:\Windows\SysWow64\d3d10level9.dll
2012-09-14 12:36:26   376688   ----a-w-   C:\Windows\System32\drivers\netio.sys
2012-09-14 12:36:26   288624   ----a-w-   C:\Windows\System32\drivers\FWPKCLNT.SYS
2012-09-14 12:36:26   1913200   ----a-w-   C:\Windows\System32\drivers\tcpip.sys
2012-09-13 17:41:58   168096   ----a-r-   C:\Windows\System32\drivers\N360x64\1401010.002\ccSetx64.sys
2012-09-13 17:41:51   --------   d-----w-   C:\Windows\System32\drivers\N360x64\1401010.002
2012-09-13 16:56:59   --------   d-----w-   C:\Users\Scott\AppData\Local\ElevatedDiagnostics
2012-09-13 16:47:41   --------   d-----w-   C:\Users\Scott\AppData\Local\Apps
2012-09-13 16:47:40   --------   d-----w-   C:\Users\Scott\AppData\Local\Deployment
2012-08-21 03:22:37   --------   d-----w-   C:\Users\Scott\AppData\Roaming\StageManager.BD092818F67280F4B42B04877600987F0111B594.1
2012-08-21 02:28:41   --------   d-----w-   C:\Users\Scott\AppData\Roaming\AdobeSupportAdvisor.E7BED6E5DDA59983786DD72EBFA46B1598278E07.1
2012-08-21 02:28:38   --------   d-----w-   C:\Program Files (x86)\Adobe Support Advisor
2012-08-20 16:40:48   --------   d-----w-   C:\ProgramData\regid.1986-12.com.adobe
2012-08-20 16:11:56   56208   ------w-   C:\Windows\System32\drivers\PxHlpa64.sys
2012-08-20 16:11:56   10224   ------w-   C:\Windows\System32\drivers\cdralw2k.sys
2012-08-20 16:11:56   10224   ------w-   C:\Windows\System32\drivers\cdr4_xp.sys
2012-08-20 16:11:56   --------   d-----w-   C:\Program Files (x86)\Common Files\Sonic Shared
2012-08-20 16:11:56   --------   d-----w-   C:\Program Files (x86)\Common Files\PX Storage Engine
2012-08-20 16:11:40   --------   d-----w-   C:\Program Files (x86)\My Company Name
.
==================== Find3M ====================
.
2012-09-15 22:14:19   73416   ----a-w-   C:\Windows\SysWow64\FlashPlayerCPLApp.cpl
2012-09-15 22:14:19   696520   ----a-w-   C:\Windows\SysWow64\FlashPlayerApp.exe
2012-07-18 18:15:06   3148800   ----a-w-   C:\Windows\System32\win32k.sys
2012-07-06 02:17:58   37536   ----a-w-   C:\Windows\System32\drivers\N360x64\0603000.00E\srtspx64.sys
2012-07-06 02:17:57   737952   ----a-w-   C:\Windows\System32\drivers\N360x64\0603000.00E\srtsp64.sys
2012-07-04 22:13:27   59392   ----a-w-   C:\Windows\System32\browcli.dll
2012-07-04 22:13:27   136704   ----a-w-   C:\Windows\System32\browser.dll
2012-07-04 21:14:34   41984   ----a-w-   C:\Windows\SysWow64\browcli.dll
2012-06-29 00:23:50   476976   ----a-w-   C:\Windows\SysWow64\npdeployJava1.dll
2012-06-29 00:23:46   472880   ----a-w-   C:\Windows\SysWow64\deployJava1.dll
2012-06-27 07:06:53   1188864   ----a-w-   C:\Windows\System32\wininet.dll
2012-06-27 05:53:07   981504   ----a-w-   C:\Windows\SysWow64\wininet.dll
2012-06-27 04:53:10   1638912   ----a-w-   C:\Windows\System32\mshtml.tlb
2012-06-27 04:10:55   1638912   ----a-w-   C:\Windows\SysWow64\mshtml.tlb
.
============= FINISH: 20:04:53.96 ===============

smbulger · « **Reply #3 on:** September 15, 2012, 06:05:56 PM »

Attach.txt Log

.
UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT
.
DDS (Ver_2011-08-26.01)
.
Microsoft Windows 7 Home Premium
Boot Device: \Device\HarddiskVolume1
Install Date: 10/2/2011 8:25:20 PM
System Uptime: 9/15/2012 7:57:16 PM (1 hours ago)
.
Motherboard: FOXCONN | | 2AB1
Processor: AMD Phenom(tm) II X4 960T Processor | CPU 1 | 3000/200mhz
.
==== Disk Partitions =========================
.
C: is FIXED (NTFS) - 1386 GiB total, 708.092 GiB free.
D: is FIXED (NTFS) - 11 GiB total, 1.362 GiB free.
E: is CDROM ()
F: is Removable
G: is Removable
H: is Removable
I: is Removable
.
==== Disabled Device Manager Items =============
.
Class GUID: {8ECC055D-047F-11D1-A537-0000F8753ED1}
Description: BHDrvx64
Device ID: ROOT\LEGACY_BHDRVX64\0000
Manufacturer:
Name: BHDrvx64
PNP Device ID: ROOT\LEGACY_BHDRVX64\0000
Service: BHDrvx64
.
Class GUID: {8ECC055D-047F-11D1-A537-0000F8753ED1}
Description: Norton 360 Settings Manager
Device ID: ROOT\LEGACY_CCSET_N360\0000
Manufacturer:
Name: Norton 360 Settings Manager
PNP Device ID: ROOT\LEGACY_CCSET_N360\0000
Service: ccSet_N360
.
Class GUID: {8ECC055D-047F-11D1-A537-0000F8753ED1}
Description: Symantec Iron Driver
Device ID: ROOT\LEGACY_SYMIRON\0000
Manufacturer:
Name: Symantec Iron Driver
PNP Device ID: ROOT\LEGACY_SYMIRON\0000
Service: SymIRON
.
==== System Restore Points ===================
.
RP115: 9/14/2012 7:55:08 AM - Restore Operation
RP116: 9/14/2012 11:03:48 AM - Windows Update
.
==== Installed Programs ======================
.
ABBYY FineReader 6.0 Sprint
Acrobat.com
Adobe AIR
Adobe Anchor Service CS4
Adobe Asset Services CS4
Adobe Bridge CS4
Adobe CMaps CS4
Adobe Color - Photoshop Specific CS4
Adobe Color EU Extra Settings CS4
Adobe Color JA Extra Settings CS4
Adobe Color NA Recommended Settings CS4
Adobe Color Video Profiles CS CS4
Adobe Creative Suite 4 Design Premium
Adobe CSI CS4
Adobe Default Language CS4
Adobe Device Central CS4
Adobe Dreamweaver CS4
Adobe Drive CS4
Adobe Dynamiclink Support
Adobe ExtendScript Toolkit CS4
Adobe Extension Manager CS4
Adobe Fireworks CS4
Adobe Flash CS4
Adobe Flash CS4 Extension - Flash Lite STI en
Adobe Flash CS4 STI-en
Adobe Flash Player 11 ActiveX
Adobe Flash Player 11 Plugin
Adobe Fonts All
Adobe Help Manager
Adobe Illustrator CS4
Adobe InDesign CS4
Adobe InDesign CS4 Application Feature Set Files (Roman)
Adobe InDesign CS4 Common Base Files
Adobe InDesign CS4 Icon Handler
Adobe Linguistics CS4
Adobe Media Encoder CS4
Adobe Media Encoder CS4 Importer
Adobe Media Player
Adobe Output Module
Adobe PDF Library Files CS4
Adobe Photoshop CS4
Adobe Photoshop CS4 Support
Adobe Search for Help
Adobe Service Manager Extension
Adobe Setup
Adobe SGM CS4
Adobe SING CS4
Adobe Support Advisor
Adobe Type Support CS4
Adobe Update Manager CS4
Adobe Version Cue CS4 Server
Adobe Widget Browser
Adobe WinSoft Linguistics Plugin
Adobe XMP Panels CS4
AdobeColorCommonSetCMYK
AdobeColorCommonSetRGB
Agatha Christie - Peril at End House
Ashampoo Cover Studio 2.2.0
Bejeweled 2 Deluxe
Bejeweled 3
bl
Blackboard IM 4.0.1-C
Blackhawk Striker 2
Blasterball 3
Blio
BookSmart® 3.2.2 3.2.2
Bounce Symphony
Build-a-lot 2
Cake Mania
Catalyst Control Center - Branding
Catalyst Control Center Core Implementation
Catalyst Control Center Graphics Full Existing
Catalyst Control Center Graphics Full New
Catalyst Control Center Graphics Light
Catalyst Control Center Graphics Previews Vista
Catalyst Control Center InstallProxy
Catalyst Control Center Localization All
ccc-core-static
CCC Help Chinese Standard
CCC Help Chinese Traditional
CCC Help Czech
CCC Help Danish
CCC Help Dutch
CCC Help English
CCC Help Finnish
CCC Help French
CCC Help German
CCC Help Greek
CCC Help Hungarian
CCC Help Italian
CCC Help Japanese
CCC Help Korean
CCC Help Norwegian
CCC Help Polish
CCC Help Portuguese
CCC Help Russian
CCC Help Spanish
CCC Help Swedish
CCC Help Thai
CCC Help Turkish
Chuzzle Deluxe
Connect
D3DX10
Definition Update for Microsoft Office 2010 (KB982726) 32-Bit Edition
Diner Dash 2 Restaurant Rescue
Dora's World Adventure
Epson Copy Utility 3.5
Epson Event Manager
EPSON Perfection V500 Photo Scanner Driver Update
EPSON Perfection V500P User's Guide
Epson Print CD
EPSON Scan
Farm Frenzy
FATE - The Traitor Soul
Hewlett-Packard ACLM.NET v1.1.2.0
HP Customer Experience Enhancements
HP Games
HP LinkUp
HP MediaSmart/TouchSmart Netflix
HP MovieStore
HP Odometer
HP Setup
HP Setup Manager
HP Support Assistant
HP Support Information
HP Update
Hulu Desktop
Java Auto Updater
Java(TM) 6 Update 33
Junk Mail filter update
Kobo
kuler
LabelPrint
LightScribe Applications
LightScribe System Software
LightScribe Template Designs - Architecture Pack 1
LightScribe Template Designs - Business Pack 1
LightScribe Template Labeler
LinkedIn Outlook Connector
Mah Jong Medley
Malwarebytes Anti-Malware version 1.65.0.1400
Mesh Runtime
Microsoft Office 2010 Service Pack 1 (SP1)
Microsoft Office Access MUI (English) 2010
Microsoft Office Access Setup Metadata MUI (English) 2010
Microsoft Office Click-to-Run 2010
Microsoft Office Excel MUI (English) 2010
Microsoft Office OneNote MUI (English) 2010
Microsoft Office Outlook MUI (English) 2010
Microsoft Office PowerPoint MUI (English) 2010
Microsoft Office Professional 2010
Microsoft Office Proof (English) 2010
Microsoft Office Proof (French) 2010
Microsoft Office Proof (Spanish) 2010
Microsoft Office Proofing (English) 2010
Microsoft Office Publisher MUI (English) 2010
Microsoft Office Shared MUI (English) 2010
Microsoft Office Shared Setup Metadata MUI (English) 2010
Microsoft Office Single Image 2010
Microsoft Office Word MUI (English) 2010
Microsoft Outlook Social Connector Provider for Facebook 32-bit
Microsoft SQL Server 2005 Compact Edition [ENU]
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
Microsoft Visual C++ 2005 Redistributable
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219
Microsoft WSE 3.0 Runtime
Microsoft_VC80_CRT_x86
Microsoft_VC90_CRT_x86
Microsoft_VC90_MFC_x86
Microsoft_VC90_MFCLOC_x86
Mozilla Firefox 15.0 (x86 en-US)
Mozilla Maintenance Service
MSVCRT
MSVCRT_amd64
MSXML 4.0 SP2 (KB954430)
MSXML 4.0 SP2 (KB973688)
Mystery P.I. - Stolen in San Francisco
Namco All-Stars PAC-MAN
Nikon Message Center
Nikon RAW Codec
Nikon Transfer
Norton 360
Norton Online Backup
Panda Cloud Cleaner
PDF Complete Special Edition
PDF Settings CS4
Penguins!
ph
Photoshop Camera Raw
Picture Control Utility
Pixel Bender Toolkit
Plants vs. Zombies - Game of the Year
PlayReady PC Runtime x86
Poker Superstars III
Polar Bowler
Polar Golfer
Power2Go
PressReader
QuickTime
Realtek High Definition Audio Driver
Recovery Manager
Remote Graphics Receiver
RoxioNow Player
Security Update for Microsoft .NET Framework 4 Client Profile (KB2478663)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2518870)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2539636)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2572078)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2604121)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2633870)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2656351)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2656368)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2656368v2)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2656405)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2686827)
Security Update for Microsoft .NET Framework 4 Extended (KB2416472)
Security Update for Microsoft .NET Framework 4 Extended (KB2487367)
Security Update for Microsoft .NET Framework 4 Extended (KB2656351)
Security Update for Microsoft Excel 2010 (KB2597166) 32-Bit Edition
Security Update for Microsoft InfoPath 2010 (KB2553322) 32-Bit Edition
Security Update for Microsoft Office 2010 (KB2553091)
Security Update for Microsoft Office 2010 (KB2553096)
Security Update for Microsoft Office 2010 (KB2553260) 32-Bit Edition
Security Update for Microsoft Office 2010 (KB2553371) 32-Bit Edition
Security Update for Microsoft Office 2010 (KB2553447) 32-Bit Edition
Security Update for Microsoft Office 2010 (KB2589320) 32-Bit Edition
Security Update for Microsoft Office 2010 (KB2589322) 32-Bit Edition
Security Update for Microsoft Office 2010 (KB2597986) 32-Bit Edition
Security Update for Microsoft Office 2010 (KB2598243) 32-Bit Edition
Security Update for Microsoft PowerPoint 2010 (KB2553185) 32-Bit Edition
Security Update for Microsoft SharePoint Workspace 2010 (KB2566445)
Security Update for Microsoft Visio Viewer 2010 (KB2598287) 32-Bit Edition
Slingo Supreme
Suite Shared Configuration CS4
Update for Microsoft .NET Framework 4 Client Profile (KB2468871)
Update for Microsoft .NET Framework 4 Client Profile (KB2473228)
Update for Microsoft .NET Framework 4 Client Profile (KB2533523)
Update for Microsoft .NET Framework 4 Client Profile (KB2600217)
Update for Microsoft .NET Framework 4 Extended (KB2468871)
Update for Microsoft .NET Framework 4 Extended (KB2533523)
Update for Microsoft .NET Framework 4 Extended (KB2600217)
Update for Microsoft Office 2010 (KB2494150)
Update for Microsoft Office 2010 (KB2553065)
Update for Microsoft Office 2010 (KB2553181) 32-Bit Edition
Update for Microsoft Office 2010 (KB2553267) 32-Bit Edition
Update for Microsoft Office 2010 (KB2553270) 32-Bit Edition
Update for Microsoft Office 2010 (KB2553272) 32-Bit Edition
Update for Microsoft Office 2010 (KB2553310) 32-Bit Edition
Update for Microsoft Office 2010 (KB2566458)
Update for Microsoft Office 2010 (KB2596964) 32-Bit Edition
Update for Microsoft Office 2010 (KB2598289) 32-Bit Edition
Update for Microsoft OneNote 2010 (KB2553290) 32-Bit Edition
Update for Microsoft OneNote 2010 (KB2589345) 32-Bit Edition
Update for Microsoft Outlook 2010 (KB2553248) 32-Bit Edition
Update for Microsoft Outlook Social Connector 2010 (KB2553406) 32-Bit Edition
Update Installer for WildTangent Games App
ViewNX
Virtual Villagers 4 - The Tree of Life
Wheel of Fortune 2
WildTangent Games App (HP Games)
Windows Live Communications Platform
Windows Live Essentials
Windows Live Installer
Windows Live Mail
Windows Live Mesh
Windows Live Mesh ActiveX Control for Remote Connections
Windows Live Messenger
Windows Live Movie Maker
Windows Live Photo Common
Windows Live Photo Gallery
Windows Live PIMT Platform
Windows Live SOXE
Windows Live SOXE Definitions
Windows Live UX Platform
Windows Live UX Platform Language Pack
Windows Live Writer
Windows Live Writer Resources
WinZip 15.5
Zinio Reader 4
Zuma Deluxe
.
==== Event Viewer Messages From Past Week ========
.
9/15/2012 7:59:34 PM, Error: Microsoft-Windows-DistributedCOM [10016] - The application-specific permission settings do not grant Local Launch permission for the COM Server application with CLSID {C97FCC79-E628-407D-AE68-A06AD6D8B4D1} and APPID {344ED43D-D086-4961-86A6-1106F4ACAD9B} to the user NT AUTHORITY\SYSTEM SID (S-1-5-18) from address LocalHost (Using LRPC). This security permission can be modified using the Component Services administrative tool.
9/15/2012 7:59:16 PM, Error: Microsoft-Windows-DistributedCOM [10016] - The application-specific permission settings do not grant Local Launch permission for the COM Server application with CLSID {C97FCC79-E628-407D-AE68-A06AD6D8B4D1} and APPID {344ED43D-D086-4961-86A6-1106F4ACAD9B} to the user NT AUTHORITY\LOCAL SERVICE SID (S-1-5-19) from address LocalHost (Using LRPC). This security permission can be modified using the Component Services administrative tool.
9/15/2012 7:58:23 PM, Error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: BHDrvx64 ccSet_N360 SRTSP SymIRON
9/15/2012 7:57:28 PM, Error: SRTSP [5] - Error loading Symantec real time Anti-Virus driver.
9/15/2012 7:57:28 PM, Error: SRTSP [4] - Error loading virus definitions.
9/14/2012 8:31:53 AM, Error: Service Control Manager [7011] - A timeout (30000 milliseconds) was reached while waiting for a transaction response from the eventlog service.
9/14/2012 8:27:01 AM, Error: Service Control Manager [7024] - The Windows Firewall service terminated with service-specific error Access is denied..
9/13/2012 1:06:51 PM, Error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: SRTSP
.
==== End Of File ===========================

SuperDave · « **Reply #4 on:** September 15, 2012, 07:34:05 PM »

Update Your Java (JRE)

Old versions of Java have vulnerabilities that malware can use to infect your system.

First Verify your Java Version

If there are any other version(s) installed then update now.

Get the new version (if needed)

If your version is out of date install the newest version of the Sun Java Runtime Environment.

Note: UNCHECK any pre-checked toolbar and/or software offered with the Java update. The pre-checked toolbars/software are not part of the Java update.

Be sure to close ALL open web browsers before starting the installation.

Remove any old versions

1. Download JavaRa and unzip the file to your Desktop.
2. Open JavaRA.exe and choose Remove Older Versions
3. Once complete exit JavaRA.

Additional Note: The Java Quick Starter (JQS.exe) adds a service to improve the initial startup time of Java applets and applications. To disable the JQS service if you don't want to use it, go to Start > Control Panel > Java > Advanced > Miscellaneous and uncheck the box for Java Quick Starter. Click OK and reboot your computer.
**************************************************
I see you are running Poker Stars. Poker Stars has a history of distributing spyware in their products. However, security experts still question this program as good or bad. I recommend to remove it to prevent spyware, but it is up to you to decide if you want to keep it.

If you would like to uninstall it, do so as follows:

Press Start, and navigate to the Control Panel. When in the control panel enter Add or Remove programs. Search for and locate PokerStars, and either click Change/Remove or Remove.
***********************************************************
Remove the Adware:

Please close all open programs and internet browsers.
Double click on adwcleaner.exe to run the tool.
Click on Delete.
Confirm each time with OK
Your computer will be rebooted automatically. A text file will open after the restart.
Please post the content of that logfile in your reply.
You can find the logfile at C:\AdwCleaner[Sn].txt as well - n is the order number.

********************************************************
Download Combofix from any of the links below, and save it to your DESKTOP.

Link 1
Link 2
Link 3

To prevent your anti-virus application interfering with ComboFix we need to disable it. See here for a tutorial regarding how to do so if you are unsure.

Close any open windows and double click ComboFix.exe to run it.

You will see the following image:

Click I Agree to start the program.

ComboFix will then extract the necessary files and you will see this:

As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. This will not occur in Windows Vista and 7

It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.

If you did not have it installed, you will see the prompt below. Choose YES.

Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

Click on Yes, to continue scanning for malware.

When finished, it will produce a report for you. Please post the contents of the log (C:\ComboFix.txt).

Leave your computer alone while ComboFix is running. ComboFix will restart your computer if malware is found; allow it to do so.

Note: Please Do NOT mouseclick combofix's window while its running because it may cause it to stall.

smbulger · « **Reply #5 on:** September 16, 2012, 07:19:03 AM »

Thank you for the quick response.

As requested, I checke dmy version of Java and according to the link you provided it says that I have the appropriate version.

I wen to the control panel to remove the Poker Stars, but didn't see it there. I do have something called Poker Superstars III, but that is a part of the HP games suite that came with the computer and that doesn't show up in the control panel either.

When attempting to download the JavaRa program from SourceForge through the link provided, by browser (Mozilla Firefox 15.0.1) froze and gave me an "unresponsive script" message.

http://s).2mdn.net/879366/InPageGlobalTemplate_v2_69_11_js.72

I then ran the Adaware removal tool. Here is the log after the reboot.

# AdwCleaner v2.001 - Logfile created 09/16/2012 at 09:11:24
# Updated 09/09/2012 by Xplode
# Operating system : Windows 7 Home Premium Service Pack 1 (64 bits)
# User : Scott - SCOTT-HP
# Boot Mode : Normal
# Running from : C:\Users\Scott\Desktop\Operation Help\adwcleaner.exe
# Option [Delete]

***** [Services] *****

***** [Files / Folders] *****

Folder Deleted : C:\Program Files (x86)\iBryte
Folder Deleted : C:\Users\Scott\AppData\Roaming\Mozilla\Firefox\Profiles\vpk2obyb.default\FCTB

***** [Registry] *****

Key Deleted : HKCU\Software\AppDataLow\Software\Crossrider
Key Deleted : HKCU\Software\Cr_Installer
Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{2FA28606-DE77-4029-AF96-B231E3B8F827}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\{2FA28606-DE77-4029-AF96-B231E3B8F827}
Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{2FA28606-DE77-4029-AF96-B231E3B8F827}
Value Deleted : HKCU\Software\Microsoft\Internet Explorer\New Windows\Allow [*.crossrider.com]
Value Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\New Windows\Allow [*.crossrider.com]
Value Deleted : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar [{B278D9F8-0FA9-465E-9938-0C392605D8E3}]

***** [Internet Browsers] *****

-\\ Internet Explorer v8.0.7601.17514

Restored : [HKCU\Software\Wow6432Node\Microsoft\Internet Explorer\SearchScopes - DefaultScope]
Restored : [HKU\S-1-5-18\Software\Microsoft\Internet Explorer\SearchScopes - DefaultScope]
Restored : [HKU\S-1-5-19\Software\Microsoft\Internet Explorer\SearchScopes - DefaultScope]
Restored : [HKU\S-1-5-20\Software\Microsoft\Internet Explorer\SearchScopes - DefaultScope]

-\\ Mozilla Firefox v15.0 (en-US)

Profile name : default
File : C:\Users\Scott\AppData\Roaming\Mozilla\Firefox\Profiles\vpk2obyb.default\prefs.js

C:\Users\Scott\AppData\Roaming\Mozilla\Firefox\Profiles\vpk2obyb.default\user.js ... Deleted !

Deleted : user_pref("browser.search.selectedEngine", "Search the Web");
Deleted : user_pref("freecause003e1c8febd6f07475514b31c0f547 ec.AutoSearchEventData", "auto%20search");
Deleted : user_pref("freecause003e1c8febd6f07475514b31c0f547 ec.ClearCacheDate", 3);
Deleted : user_pref("freecause003e1c8febd6f07475514b31c0f547 ec.DNSCatch", true);
Deleted : user_pref("freecause003e1c8febd6f07475514b31c0f547 ec.DisplayEULA", true);
Deleted : user_pref("freecause003e1c8febd6f07475514b31c0f547 ec.DnsCatchEventData", "dns%20catch");
Deleted : user_pref("freecause003e1c8febd6f07475514b31c0f547 ec.EBOMode", true);
Deleted : user_pref("freecause003e1c8febd6f07475514b31c0f547 ec.FirstLaunchShown", true);
Deleted : user_pref("freecause003e1c8febd6f07475514b31c0f547 ec.InstallDomain", "freecause.com");
Deleted : user_pref("freecause003e1c8febd6f07475514b31c0f547 ec.InstallType", "standard");
Deleted : user_pref("freecause003e1c8febd6f07475514b31c0f547 ec.LoadLayoutDate.100770", 3);
Deleted : user_pref("freecause003e1c8febd6f07475514b31c0f547 ec.NewTabSearchEventData", "tab%20search");
Deleted : user_pref("freecause003e1c8febd6f07475514b31c0f547 ec.ShowRecommendedOptions", true);
Deleted : user_pref("freecause003e1c8febd6f07475514b31c0f547 ec.StateReportDate", "1341197956928");
Deleted : user_pref("freecause003e1c8febd6f07475514b31c0f547 ec.TopRightSearchEventData", "top%20right%20search[...]
Deleted : user_pref("freecause003e1c8febd6f07475514b31c0f547 ec.beforeInstallSaved", true);
Deleted : user_pref("freecause003e1c8febd6f07475514b31c0f547 ec.beforeinstall.homepage", "hxxp%3A//www.google.c[...]
Deleted : user_pref("freecause003e1c8febd6f07475514b31c0f547 ec.beforeinstall.search", "Google");
Deleted : user_pref("freecause003e1c8febd6f07475514b31c0f547 ec.customNewTab", false);
Deleted : user_pref("freecause003e1c8febd6f07475514b31c0f547 ec.helpUsImprove", true);
Deleted : user_pref("freecause003e1c8febd6f07475514b31c0f547 ec.hideOthers", true);
Deleted : user_pref("freecause003e1c8febd6f07475514b31c0f547 ec.partnerauth", false);
Deleted : user_pref("freecause003e1c8febd6f07475514b31c0f547 ec.processAddrBar", true);
Deleted : user_pref("freecause003e1c8febd6f07475514b31c0f547 ec.restoreSearch", false);
Deleted : user_pref("freecause003e1c8febd6f07475514b31c0f547 ec.runcmd.", "bb_acct_status_1341336730");
Deleted : user_pref("freecause003e1c8febd6f07475514b31c0f547 ec.searchHistory", true);
Deleted : user_pref("freecause003e1c8febd6f07475514b31c0f547 ec.session", "E06C375DB23EB7B39B884B8BC52C3128FEF9[...]
Deleted : user_pref("freecause003e1c8febd6f07475514b31c0f547 ec.showFirstLaunchOptions", false);
Deleted : user_pref("freecause003e1c8febd6f07475514b31c0f547 ec.tb_lang", "en");
Deleted : user_pref("freecause003e1c8febd6f07475514b31c0f547 ec.tool_id", "100770");
Deleted : user_pref("freecause003e1c8febd6f07475514b31c0f547 ec.user_id", "108198938");
Deleted : user_pref("freecause003e1c8febd6f07475514b31c0f547 ec.user_key", "b9f15a883011fd1b4b091cf8a590f6e8da2[...]
Deleted : user_pref("freecause003e1c8febd6f07475514b31c0f547 ec.user_layouts", "100770");
Deleted : user_pref("freecause003e1c8febd6f07475514b31c0f547 ec.user_lnames", "fcreward.100770.b");
Deleted : user_pref("freecause003e1c8febd6f07475514b31c0f547 ec.xml_service_url", "6bb94bbf55fe2f255901a560824a[...]
Deleted : user_pref("freecause003e1c8febd6f07475514b31c0f547 ec.yahooSearch", true);

Profile name : default-1341337853154 [Profil par défaut]
File : C:\Users\Scott\AppData\Roaming\Mozilla\Firefox\Profiles\x6dvm2ys.default-1341337853154\prefs.js

[OK] File is clean.

-\\ Google Chrome v [Unable to get version]

File : C:\Users\Scott\AppData\Local\Google\Chrome\User Data\Default\Preferences

[OK] File is clean.

*************************

AdwCleaner[R1].txt - [5739 octets] - [15/09/2012 19:38:22]
AdwCleaner[S1].txt - [5826 octets] - [16/09/2012 09:11:24]

########## EOF - C:\AdwCleaner[S1].txt - [5886 octets] ##########

SuperDave · « **Reply #6 on:** September 16, 2012, 01:25:32 PM »

Sorry, please use this one.

Update Your Java (JRE)

Old versions of Java have vulnerabilities that malware can use to infect your system.

First Verify your Java Version

If there are any other version(s) installed then update now.

Get the new version (if needed)

If your version is out of date install the newest version of the Sun Java Runtime Environment.

Note: UNCHECK any pre-checked toolbar and/or software offered with the Java update. The pre-checked toolbars/software are not part of the Java update.

Be sure to close ALL open web browsers before starting the installation.

Remove any old versions

1. Download JavaRa and unzip the file to your Desktop.
2. Open JavaRA.exe and choose Remove Older Versions
3. Once complete exit JavaRA.

Additional Note: The Java Quick Starter (JQS.exe) adds a service to improve the initial startup time of Java applets and applications. To disable the JQS service if you don't want to use it, go to Start > Control Panel > Java > Advanced > Miscellaneous and uncheck the box for Java Quick Starter. Click OK and reboot your computer.

Please post the ComboFix log after you run the program.

smbulger · « **Reply #7 on:** September 17, 2012, 06:26:26 AM »

After running the ComboFix, I can no longer access any programs on the computer. Any programs that are attempted to open give a message that says: You have attempted an illegal operation on a on a registry key that has been marked for deletion (paraphrasing).

Here is the ComboFix log:

ComboFix 12-09-15.02 - Scott 09/16/2012 9:45.1.4 - x64
Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.7935.6338 [GMT -4:00]
Running from: c:\users\Scott\Desktop\ComboFix.exe
AV: Norton 360 *Enabled/Updated* {63DF5164-9100-186D-2187-8DC619EFD8BF}
FW: Norton 360 *Enabled* {5BE4D041-DB6F-1935-0AD8-24F3E73C9FC4}
SP: Norton 360 *Enabled/Updated* {D8BEB080-B73A-17E3-1B37-B6B462689202}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((( Files Created from 2012-08-16 to 2012-09-16 )))))))))))))))))))))))))))))))
.
.
2012-09-16 02:33 . 2012-09-16 02:33   --------   d-----w-   c:\programdata\ALM
2012-09-16 02:27 . 2012-09-16 02:27   --------   d-----w-   c:\users\Scott\Adobe Flash Builder 4.6
2012-09-15 23:49 . 2012-09-15 23:49   --------   d-----w-   c:\users\Scott\AppData\Roaming\Malwarebytes
2012-09-15 23:49 . 2012-09-15 23:49   --------   d-----w-   c:\programdata\Malwarebytes
2012-09-15 23:49 . 2012-09-15 23:49   --------   d-----w-   c:\program files (x86)\Malwarebytes' Anti-Malware
2012-09-15 23:49 . 2012-09-07 21:04   25928   ----a-w-   c:\windows\system32\drivers\mbam.sys
2012-09-15 23:21 . 2012-09-15 23:21   --------   d-----w-   c:\program files\CCleaner
2012-09-15 11:32 . 2012-09-15 11:32   --------   d-----w-   c:\program files (x86)\Panda Security
2012-09-14 12:36 . 2012-08-22 18:12   950128   ----a-w-   c:\windows\system32\drivers\ndis.sys
2012-09-14 12:36 . 2012-07-04 20:26   41472   ----a-w-   c:\windows\system32\drivers\RNDISMP.sys
2012-09-14 12:36 . 2012-08-02 17:58   574464   ----a-w-   c:\windows\system32\d3d10level9.dll
2012-09-14 12:36 . 2012-08-02 16:57   490496   ----a-w-   c:\windows\SysWow64\d3d10level9.dll
2012-09-14 12:36 . 2012-08-22 18:12   1913200   ----a-w-   c:\windows\system32\drivers\tcpip.sys
2012-09-14 12:36 . 2012-08-22 18:12   376688   ----a-w-   c:\windows\system32\drivers\netio.sys
2012-09-14 12:36 . 2012-08-22 18:12   288624   ----a-w-   c:\windows\system32\drivers\FWPKCLNT.SYS
2012-09-13 17:41 . 2012-09-14 12:23   --------   d-----w-   c:\windows\system32\drivers\N360x64\1401010.002
2012-09-13 16:56 . 2012-09-13 22:31   --------   d-----w-   c:\users\Scott\AppData\Local\ElevatedDiagnostics
2012-09-13 16:47 . 2012-09-13 16:47   --------   d-----w-   c:\users\Scott\AppData\Local\Apps
2012-09-13 16:47 . 2012-09-13 16:48   --------   d-----w-   c:\users\Scott\AppData\Local\Deployment
2012-08-21 03:22 . 2012-08-21 03:22   --------   d-----w-   c:\users\Scott\AppData\Roaming\StageManager.BD092818F67280F4B42B04877600987F0111B594.1
2012-08-21 02:28 . 2012-08-21 02:28   --------   d-----w-   c:\users\Scott\AppData\Roaming\AdobeSupportAdvisor.E7BED6E5DDA59983786DD72EBFA46B1598278E07.1
2012-08-21 02:28 . 2012-08-21 02:28   --------   d-----w-   c:\program files (x86)\Adobe Support Advisor
2012-08-20 16:40 . 2012-09-14 23:23   --------   d-----w-   c:\programdata\regid.1986-12.com.adobe
2012-08-20 16:11 . 2012-09-16 02:16   --------   d-----w-   c:\program files (x86)\Common Files\PX Storage Engine
2012-08-20 16:11 . 2012-08-20 16:11   --------   d-----w-   c:\program files (x86)\Common Files\Sonic Shared
2012-08-20 16:11 . 2011-11-03 07:01   56208   ------w-   c:\windows\system32\drivers\PxHlpa64.sys
2012-08-20 16:11 . 2011-10-17 07:00   10224   ------w-   c:\windows\system32\drivers\cdralw2k.sys
2012-08-20 16:11 . 2011-10-17 07:00   10224   ------w-   c:\windows\system32\drivers\cdr4_xp.sys
2012-08-20 16:11 . 2012-08-20 16:11   --------   d-----w-   c:\program files (x86)\My Company Name
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-09-16 00:28 . 2012-04-02 01:12   696520   ----a-w-   c:\windows\SysWow64\FlashPlayerApp.exe
2012-09-16 00:28 . 2011-10-16 16:03   73416   ----a-w-   c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2012-09-14 15:05 . 2011-10-05 11:08   64462936   ----a-w-   c:\windows\system32\MRT.exe
2012-08-29 00:24 . 2012-04-27 11:28   477168   ----a-w-   c:\windows\SysWow64\npdeployJava1.dll
2012-08-29 00:24 . 2011-10-03 11:05   473072   ----a-w-   c:\windows\SysWow64\deployJava1.dll
2012-07-18 18:15 . 2012-08-15 12:51   3148800   ----a-w-   c:\windows\system32\win32k.sys
2012-07-06 02:17 . 2012-08-15 04:13   37536   ----a-w-   c:\windows\system32\drivers\N360x64\0603000.00E\srtspx64.sys
2012-07-06 02:17 . 2012-08-15 04:13   737952   ----a-w-   c:\windows\system32\drivers\N360x64\0603000.00E\srtsp64.sys
2012-07-04 22:16 . 2012-08-15 12:51   73216   ----a-w-   c:\windows\system32\netapi32.dll
2012-07-04 22:13 . 2012-08-15 12:51   59392   ----a-w-   c:\windows\system32\browcli.dll
2012-07-04 22:13 . 2012-08-15 12:51   136704   ----a-w-   c:\windows\system32\browser.dll
2012-07-04 21:14 . 2012-08-15 12:51   41984   ----a-w-   c:\windows\SysWow64\browcli.dll
2012-06-27 07:06 . 2012-08-15 12:51   1188864   ----a-w-   c:\windows\system32\wininet.dll
2012-06-27 07:06 . 2012-08-15 12:51   1494016   ----a-w-   c:\windows\system32\urlmon.dll
2012-06-27 07:06 . 2012-08-15 12:51   134144   ----a-w-   c:\windows\system32\url.dll
2012-06-27 07:03 . 2012-08-15 12:51   9059840   ----a-w-   c:\windows\system32\mshtml.dll
2012-06-27 07:03 . 2012-08-15 12:51   97792   ----a-w-   c:\windows\system32\mshtmled.dll
2012-06-27 07:03 . 2012-08-15 12:51   735744   ----a-w-   c:\windows\system32\msfeeds.dll
2012-06-27 07:02 . 2012-08-15 12:51   64512   ----a-w-   c:\windows\system32\jsproxy.dll
2012-06-27 07:02 . 2012-08-15 12:51   247808   ----a-w-   c:\windows\system32\ieui.dll
2012-06-27 07:02 . 2012-08-15 12:51   2453504   ----a-w-   c:\windows\system32\iertutil.dll
2012-06-27 07:02 . 2012-08-15 12:51   12297216   ----a-w-   c:\windows\system32\ieframe.dll
2012-06-27 05:53 . 2012-08-15 12:51   981504   ----a-w-   c:\windows\SysWow64\wininet.dll
2012-06-27 04:53 . 2012-08-15 12:51   1638912   ----a-w-   c:\windows\system32\mshtml.tlb
2012-06-27 04:10 . 2012-08-15 12:51   1638912   ----a-w-   c:\windows\SysWow64\mshtml.tlb
.
.
------- Sigcheck -------
Note: Unsigned files aren't necessarily malware.
.
[-] 2012-07-04 . 05F5A0D14A2EE1D8255C2AA0E9E8E694 . 136704 . . [6.1.7601.17887] .. c:\windows\winsxs\amd64_microsoft-windows-browserservice_31bf3856ad364e35_6.1.7601.17887_none_d6c68344b4d406bf\browser.dll
[-] 2012-07-04 . 156768ABAE1DAF29BA0B0C05C21FEF09 . 136704 . . [6.1.7601.22044] .. c:\windows\winsxs\amd64_microsoft-windows-browserservice_31bf3856ad364e35_6.1.7601.22044_none_d7783703cdd41e02\browser.dll
[7] 2010-11-21 . 8EF0D5C41EC907751B8429162B1239ED . 136192 . . [6.1.7601.17514] .. c:\windows\winsxs\amd64_microsoft-windows-browserservice_31bf3856ad364e35_6.1.7601.17514_none_d70f2c28b49dffae\browser.dll
[-] 2012-07-04 . 05F5A0D14A2EE1D8255C2AA0E9E8E694 . 136704 . . [6.1.7600.16385] .. c:\windows\system32\browser.dll
.
[-] 2012-02-11 . 85DAA09A98C9286D4EA2BA8D0E644377 . 559104 . . [6.1.7600.16385] .. c:\windows\winsxs\amd64_microsoft-windows-printing-spooler-core_31bf3856ad364e35_6.1.7601.17777_none_3433cdb2d8563d50\spoolsv.exe
[-] 2012-02-11 . B9D7A4858CF32A6A15D2763F1DE47E0E . 559616 . . [6.1.7600.16385] .. c:\windows\winsxs\amd64_microsoft-windows-printing-spooler-core_31bf3856ad364e35_6.1.7601.21921_none_34ed7a43f150b682\spoolsv.exe
[7] 2010-11-21 . B96C17B5DC1424D56EEA3A99E97428CD . 559104 . . [6.1.7600.16385] .. c:\windows\winsxs\amd64_microsoft-windows-printing-spooler-core_31bf3856ad364e35_6.1.7601.17514_none_3471a890d8284f57\spoolsv.exe
[-] 2012-02-11 . 85DAA09A98C9286D4EA2BA8D0E644377 . 559104 . . [6.1.7600.16385] .. c:\windows\system32\spoolsv.exe
.
[-] 2012-04-24 . 4F5414602E2544A4554D95517948B705 . 184320 . . [6.1.7601.17827] .. c:\windows\winsxs\amd64_microsoft-windows-cryptsvc-dll_31bf3856ad364e35_6.1.7601.17827_none_d41dd577b1743795\cryptsvc.dll
[-] 2012-04-24 . B7337E9C9E5936355BB700AA33E0936E . 186880 . . [6.1.7601.21979] .. c:\windows\winsxs\amd64_microsoft-windows-cryptsvc-dll_31bf3856ad364e35_6.1.7601.21979_none_d473633acab895c2\cryptsvc.dll
[7] 2010-11-21 . 15597883FBE9B056F276ADA3AD87D9AF . 177152 . . [6.1.7601.17514] .. c:\windows\winsxs\amd64_microsoft-windows-cryptsvc-dll_31bf3856ad364e35_6.1.7601.17514_none_d4259ed3b16ed82a\cryptsvc.dll
[-] 2012-04-24 . 4F5414602E2544A4554D95517948B705 . 184320 . . [6.1.7600.16385] .. c:\windows\system32\cryptsvc.dll
.
[-] 2012-06-27 . 788EDEF3241585C2DB7598ABF92377D9 . 9059840 . . [8.00.7600.16385] .. c:\windows\winsxs\amd64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_8.0.7601.17874_none_8be2856caffb9cf5\mshtml.dll
[-] 2012-06-27 . 3171711EA82F3640D09E1CF94DA83C2A . 9058304 . . [8.00.7600.16385] .. c:\windows\winsxs\amd64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_8.0.7601.22032_none_8c953975c8facd8f\mshtml.dll
[-] 2012-04-20 . 0EBA57D758322797E24A0FA2297B36C2 . 9059840 . . [8.00.7600.16385] .. c:\windows\winsxs\amd64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_8.0.7601.17824_none_8c189508afd31140\mshtml.dll
[-] 2012-04-20 . 5B7D113B4B7B46D2633D2EF488521B2A . 9058304 . . [8.00.7600.16385] .. c:\windows\winsxs\amd64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_8.0.7601.21976_none_8c6e22cbc9176f6d\mshtml.dll
[-] 2012-02-28 . 36EEA2478E8AAE2EB616D50AA8A168F4 . 9020928 . . [8.00.7600.16385] .. c:\windows\winsxs\amd64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_8.0.7601.17785_none_8bd8b3e4b002d516\mshtml.dll
[-] 2012-02-28 . 147B4EF618987DEC79BC01348D973891 . 9021440 . . [8.00.7600.16385] .. c:\windows\winsxs\amd64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_8.0.7601.21931_none_8c946109c8fb80f6\mshtml.dll
[7] 2011-12-16 . A668888B8AA45E8C21A451A936B589A2 . 9019904 . . [8.00.7600.16385] .. c:\windows\winsxs\amd64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_8.0.7601.17744_none_8c02f34aafe34bfb\mshtml.dll
[7] 2011-12-16 . 3B3CBA1C6F0F83ED1B869C66EA31E36E . 9019392 . . [8.00.7600.16385] .. c:\windows\winsxs\amd64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_8.0.7601.21878_none_8c702179c915a4f4\mshtml.dll
[7] 2011-11-05 . 312DD305113BE3ACA3A849B45048247E . 9018880 . . [8.00.7600.16385] .. c:\windows\winsxs\amd64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_8.0.7601.17720_none_8c1491faafd6aebd\mshtml.dll
[7] 2011-11-05 . 8CCB66627CF562B7294847277A0F9F68 . 9018368 . . [8.00.7600.16385] .. c:\windows\winsxs\amd64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_8.0.7601.21855_none_8c82c073c908210d\mshtml.dll
[7] 2011-10-01 . 6954EE1BBF29632A73791910E89951A8 . 9011200 . . [8.00.7600.16385] .. c:\windows\winsxs\amd64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_8.0.7601.17699_none_8bd1e33ab007593c\mshtml.dll
[7] 2011-10-01 . 187A4AE835C9C269447A7ACE944744FB . 9011200 . . [8.00.7600.16385] .. c:\windows\winsxs\amd64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_8.0.7601.21830_none_8c935ed9c8fc6a78\mshtml.dll
[7] 2011-07-22 . 80C2158BA5469E75F5F6180B560159E6 . 9007104 . . [8.00.7600.16385] .. c:\windows\winsxs\amd64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_8.0.7601.17655_none_8bf921c2afea841c\mshtml.dll
[7] 2011-07-22 . 65724073869250966E9CB2D92266A08E . 9007104 . . [8.00.7600.16385] .. c:\windows\winsxs\amd64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_8.0.7601.21776_none_8c6e1effc917751f\mshtml.dll
[7] 2010-11-21 . 1C8B787BAA52DEAD1A6FEC1502D652F0 . 8988160 . . [8.00.7600.16385] .. c:\windows\winsxs\amd64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_8.0.7601.17514_none_8c235f42afcafdda\mshtml.dll
[-] 2012-06-27 . 788EDEF3241585C2DB7598ABF92377D9 . 9059840 . . [8.00.7600.16385] .. c:\windows\system32\mshtml.dll
.
[-] 2012-06-27 . ADC0BAC148C957CF51B1F6F658A4FCA6 . 1188864 . . [8.00.7600.16385] .. c:\windows\winsxs\amd64_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_8.0.7601.17874_none_7a88664e2fa533bf\wininet.dll
[-] 2012-06-27 . 69449A3D42AC7000ACF5055172618632 . 1189888 . . [8.00.7600.16385] .. c:\windows\winsxs\amd64_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_8.0.7601.22032_none_7b3b1a5748a46459\wininet.dll
[-] 2012-05-15 . CE5BFBD9685EE37DB942211450AAEA8F . 1188864 . . [8.00.7600.16385] .. c:\windows\winsxs\amd64_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_8.0.7601.17842_none_7aa6d57e2f8ead3e\wininet.dll
[-] 2012-05-15 . 507FBE142C77A32C1AE56CA35B6A7307 . 1189888 . . [8.00.7600.16385] .. c:\windows\winsxs\amd64_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_8.0.7601.21995_none_7afd638b48d224c2\wininet.dll
[-] 2012-02-28 . DE03C917EDED2A999C942A4F943D3068 . 1188864 . . [8.00.7600.16385] .. c:\windows\winsxs\amd64_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_8.0.7601.17785_none_7a7e94c62fac6be0\wininet.dll
[-] 2012-02-28 . 05ED629EB0A11CAFB87EFB7847943312 . 1189376 . . [8.00.7600.16385] .. c:\windows\winsxs\amd64_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_8.0.7601.21931_none_7b3a41eb48a517c0\wininet.dll
[7] 2011-12-16 . F6C45D1D448B38A3298505917710F047 . 1188864 . . [8.00.7600.16385] .. c:\windows\winsxs\amd64_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_8.0.7601.17744_none_7aa8d42c2f8ce2c5\wininet.dll
[7] 2011-12-16 . 7710ECF9F1355F986463D4351562439E . 1189376 . . [8.00.7600.16385] .. c:\windows\winsxs\amd64_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_8.0.7601.21878_none_7b16025b48bf3bbe\wininet.dll
[7] 2011-11-05 . 4EFC156290537BB9706D3A7A1A4B8733 . 1188864 . . [8.00.7600.16385] .. c:\windows\winsxs\amd64_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_8.0.7601.17720_none_7aba72dc2f804587\wininet.dll
[7] 2011-11-05 . 8F2CC83B92626A3B7E1DF360720FAD30 . 1189376 . . [8.00.7600.16385] .. c:\windows\winsxs\amd64_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_8.0.7601.21855_none_7b28a15548b1b7d7\wininet.dll
[7] 2011-08-20 . DB33A1489C1DA1F37AC2D84CB9756DD1 . 1188864 . . [8.00.7600.16385] .. c:\windows\winsxs\amd64_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_8.0.7601.17671_none_7a8561a42fa7ed6c\wininet.dll
[7] 2011-08-20 . 2B4973A8A9D0336EEF6E10DBD6E5B87D . 1189376 . . [8.00.7600.16385] .. c:\windows\winsxs\amd64_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_8.0.7601.21795_none_7afd5fbf48d22a74\wininet.dll
[7] 2011-06-21 . 1A36497983C867FB85FF1DCD4933015F . 1188864 . . [8.00.7600.16385] .. c:\windows\winsxs\amd64_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_8.0.7601.17638_none_7ab7a35a2f812f09\wininet.dll
[7] 2011-06-21 . 6ABD901E178675DFE86CCE75F2FAC9A5 . 1189376 . . [8.00.7600.16385] .. c:\windows\winsxs\amd64_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_8.0.7601.21754_none_7b279f2548b2a159\wininet.dll
[7] 2010-11-21 . F6C5302E1F4813D552F41A0AC82455E5 . 1188864 . . [8.00.7600.16385] .. c:\windows\winsxs\amd64_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_8.0.7601.17514_none_7ac940242f7494a4\wininet.dll
[-] 2012-06-27 . ADC0BAC148C957CF51B1F6F658A4FCA6 . 1188864 . . [8.00.7600.16385] .. c:\windows\system32\wininet.dll
.
[-] 2012-04-24 . 06E771AA596B8761107AB57E99F128D7 . 140288 . . [6.1.7600.16385] .. c:\windows\SysWOW64\cryptsvc.dll
[-] 2012-04-24 . 06E771AA596B8761107AB57E99F128D7 . 140288 . . [6.1.7601.17827] .. c:\windows\winsxs\x86_microsoft-windows-cryptsvc-dll_31bf3856ad364e35_6.1.7601.17827_none_77ff39f3f916c65f\cryptsvc.dll
[-] 2012-04-24 . 21993009E0CCB9B4FA195F14D3408626 . 142336 . . [6.1.7601.21979] .. c:\windows\winsxs\x86_microsoft-windows-cryptsvc-dll_31bf3856ad364e35_6.1.7601.21979_none_7854c7b7125b248c\cryptsvc.dll
[7] 2010-11-21 . A585BEBF7D054BD9618EDA0922D5484A . 136192 . . [6.1.7601.17514] .. c:\windows\winsxs\x86_microsoft-windows-cryptsvc-dll_31bf3856ad364e35_6.1.7601.17514_none_7807034ff91166f4\cryptsvc.dll
.
[-] 2012-06-27 . 3817C93AB6E32D0D00CB87CDEAB7104E . 6027776 . . [8.00.7600.16385] .. c:\windows\SysWOW64\mshtml.dll
[-] 2012-06-27 . 3817C93AB6E32D0D00CB87CDEAB7104E . 6027776 . . [8.00.7600.16385] .. c:\windows\winsxs\wow64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_8.0.7601.17874_none_96372fbee45c5ef0\mshtml.dll
[-] 2012-06-27 . 116201EB8D589286DCE22E5ACC7B1147 . 6028288 . . [8.00.7600.16385] .. c:\windows\winsxs\wow64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_8.0.7601.22032_none_96e9e3c7fd5b8f8a\mshtml.dll
[-] 2012-04-20 . A2C3C40A0633B45809DAA328DBF902E7 . 6027776 . . [8.00.7600.16385] .. c:\windows\winsxs\wow64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_8.0.7601.17824_none_966d3f5ae433d33b\mshtml.dll
[-] 2012-04-20 . 9D29A624DED6C011FD0139D540AA21A0 . 6027776 . . [8.00.7600.16385] .. c:\windows\winsxs\wow64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_8.0.7601.21976_none_96c2cd1dfd783168\mshtml.dll
[-] 2012-02-28 . 624A8FC27001639D08F3558FBB607187 . 5998080 . . [8.00.7600.16385] .. c:\windows\winsxs\wow64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_8.0.7601.17785_none_962d5e36e4639711\mshtml.dll
[-] 2012-02-28 . 07B90528507189F3DD6AA132FDAA23BB . 5998592 . . [8.00.7600.16385] .. c:\windows\winsxs\wow64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_8.0.7601.21931_none_96e90b5bfd5c42f1\mshtml.dll
[7] 2011-12-16 . D829890A3CE83EE4332D2BE11755E590 . 5998080 . . [8.00.7600.16385] .. c:\windows\winsxs\wow64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_8.0.7601.21878_none_96c4cbcbfd7666ef\mshtml.dll
[7] 2011-12-16 . BDB0402589BDD0D47D0CE9B2A0187D94 . 5997568 . . [8.00.7600.16385] .. c:\windows\winsxs\wow64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_8.0.7601.17744_none_96579d9ce4440df6\mshtml.dll
[7] 2011-11-05 . 61C09B5AD2932538659D133C875DBB0F . 5997056 . . [8.00.7600.16385] .. c:\windows\winsxs\wow64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_8.0.7601.17720_none_96693c4ce43770b8\mshtml.dll
[7] 2011-11-05 . 3E218028099F62CA630E2AFE936F1F0D . 5997568 . . [8.00.7600.16385] .. c:\windows\winsxs\wow64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_8.0.7601.21855_none_96d76ac5fd68e308\mshtml.dll
[7] 2011-10-01 . E16F0A71B984E06FE0A90A2E2E227B23 . 5991936 . . [8.00.7600.16385] .. c:\windows\winsxs\wow64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_8.0.7601.21830_none_96e8092bfd5d2c73\mshtml.dll
[7] 2011-10-01 . 009751094A5A9041723D635AF249DC6F . 5990400 . . [8.00.7600.16385] .. c:\windows\winsxs\wow64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_8.0.7601.17699_none_96268d8ce4681b37\mshtml.dll
[7] 2011-07-22 . CF3C3365DC28AB97636BF11E9BB67927 . 5988864 . . [8.00.7600.16385] .. c:\windows\winsxs\wow64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_8.0.7601.21776_none_96c2c951fd78371a\mshtml.dll
[7] 2011-07-22 . DD64818174A695E8EC766E50297AB854 . 5988864 . . [8.00.7600.16385] .. c:\windows\winsxs\wow64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_8.0.7601.17655_none_964dcc14e44b4617\mshtml.dll
[7] 2010-11-21 . C50799F0D47DFB9774F721521B6C41D5 . 5977600 . . [8.00.7600.16385] .. c:\windows\winsxs\wow64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_8.0.7601.17514_none_96780994e42bbfd5\mshtml.dll
.
[-] 2012-06-27 . 58CFAE82CC4092C5988555B73CD557B8 . 981504 . . [8.00.7600.16385] .. c:\windows\SysWOW64\wininet.dll
[-] 2012-06-27 . 58CFAE82CC4092C5988555B73CD557B8 . 981504 . . [8.00.7600.16385] .. c:\windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_8.0.7601.17874_none_1e69caca7747c289\wininet.dll
[-] 2012-06-27 . 54D506A1F7D9E1AF6439F7A06CC6488A . 982016 . . [8.00.7600.16385] .. c:\windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_8.0.7601.22032_none_1f1c7ed39046f323\wininet.dll
[-] 2012-05-15 . 2606B35DDADCA19BEA9A08033C621B97 . 981504 . . [8.00.7600.16385] .. c:\windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_8.0.7601.17842_none_1e8839fa77313c08\wininet.dll
[-] 2012-05-15 . 3E5195AB78F4DCE48E04CC6979D9B428 . 982016 . . [8.00.7600.16385] .. c:\windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_8.0.7601.21995_none_1edec8079074b38c\wininet.dll
[-] 2012-02-28 . 7CCA8574A3B9BB41A4150739E21F1B23 . 981504 . . [8.00.7600.16385] .. c:\windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_8.0.7601.17785_none_1e5ff942774efaaa\wininet.dll
[-] 2012-02-28 . 6A5778483A8023B4DB9C5A509D382392 . 982016 . . [8.00.7600.16385] .. c:\windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_8.0.7601.21931_none_1f1ba6679047a68a\wininet.dll
[7] 2011-12-16 . 808C0CE9D4DBC0A6F72761294EB10FB2 . 982016 . . [8.00.7600.16385] .. c:\windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_8.0.7601.21878_none_1ef766d79061ca88\wininet.dll
[7] 2011-12-16 . BDB7450CC556F238FD973C9DA300FEB8 . 981504 . . [8.00.7600.16385] .. c:\windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_8.0.7601.17744_none_1e8a38a8772f718f\wininet.dll
[7] 2011-11-05 . 19714FA7D7204D9BEE1EE12791DA9010 . 981504 . . [8.00.7600.16385] .. c:\windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_8.0.7601.17720_none_1e9bd7587722d451\wininet.dll
[7] 2011-11-05 . 1903228FE0C7D402B26A217F8D7713FD . 982016 . . [8.00.7600.16385] .. c:\windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_8.0.7601.21855_none_1f0a05d1905446a1\wininet.dll
[7] 2011-08-20 . 7570FA3FC82E08FB637E32D2D95DB41D . 981504 . . [8.00.7600.16385] .. c:\windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_8.0.7601.21795_none_1edec43b9074b93e\wininet.dll
[7] 2011-08-20 . DBF24E87CB605A4F6E7424DD86F7A62C . 981504 . . [8.00.7600.16385] .. c:\windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_8.0.7601.17671_none_1e66c620774a7c36\wininet.dll
[7] 2011-06-21 . D1E7C4FA045B34C32D12BFBB415EBE1B . 981504 . . [8.00.7600.16385] .. c:\windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_8.0.7601.21754_none_1f0903a190553023\wininet.dll
[7] 2011-06-21 . 748FD4CAB1AFFD90A9556EB7D5AA1FEB . 981504 . . [8.00.7600.16385] .. c:\windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_8.0.7601.17638_none_1e9907d67723bdd3\wininet.dll
[7] 2010-11-21 . 44214C94911C7CFB1D52CB64D5E8368D . 980992 . . [8.00.7600.16385] .. c:\windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_8.0.7601.17514_none_1eaaa4a07717236e\wininet.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2010-11-21 1475584]
"LightScribe Control Panel"="c:\program files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe" [2011-06-20 2736128]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"StartCCC"="c:\program files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2010-05-12 102400]
"HP Software Update"="c:\program files (x86)\HP\HP Software Update\HPWuSchd2.exe" [2008-12-08 54576]
"Norton Online Backup"="c:\program files (x86)\Symantec\Norton Online Backup\NOBuClient.exe" [2010-06-01 1155928]
"PDF Complete"="c:\program files (x86)\PDF Complete\pdfsty.exe" [2011-02-01 656920]
"AdobeCS4ServiceManager"="c:\program files (x86)\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe" [2008-08-14 611712]
"QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" [2007-12-11 286720]
"EEventManager"="c:\progra~2\EPSONS~1\EVENTM~1\EEventManager.exe" [2009-04-07 673616]
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2012-01-18 254696]
"SwitchBoard"="c:\program files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe" [2010-02-19 517096]
"AdobeCS6ServiceManager"="c:\program files (x86)\Common Files\Adobe\CS6ServiceManager\CS6ServiceManager.exe" [2012-03-09 1073312]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2011-09-05 937920]
"Adobe Acrobat Speed Launcher"="c:\program files (x86)\Adobe\Acrobat 10.0\Acrobat\Acrobat_sl.exe" [2011-09-05 36760]
"Acrobat Assistant 8.0"="c:\program files (x86)\Adobe\Acrobat 10.0\Acrobat\Acrotray.exe" [2011-09-05 2904984]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Nikon Monitor.lnk - c:\program files (x86)\Common Files\Nikon\Monitor\NkMonitor.exe [2008-4-10 479232]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Security Packages   REG_MULTI_SZ     kerberos msv1_0 schannel wdigest tspkg pku2u livessp
.
R1 BHDrvx64;BHDrvx64;c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_6.2.0.9\Definitions\BASHDefs\20120905.001\BHDrvx64.sys [2012-08-31 1385120]
R1 ccSet_N360;Norton 360 Settings Manager;c:\windows\system32\drivers\N360x64\0603000.00E\ccSetx64.sys [2012-06-07 167072]
R1 SymIRON;Symantec Iron Driver;c:\windows\system32\drivers\N360x64\0603000.00E\Ironx64.SYS [2012-03-29 190072]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R3 Adobe Version Cue CS4;Adobe Version Cue CS4;c:\program files (x86)\Common Files\Adobe\Adobe Version Cue CS4\Server\bin\VersionCueCS4.exe [2008-08-15 284016]
R3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-09-16 250568]
R3 FLEXnet Licensing Service 64;FLEXnet Licensing Service 64;c:\program files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService64.exe [2011-10-05 1038088]
R3 GamesAppService;GamesAppService;c:\program files (x86)\WildTangent Games\App\GamesAppService.exe [2010-10-12 206072]
R3 MozillaMaintenance;Mozilla Maintenance Service;c:\program files (x86)\Mozilla Maintenance Service\maintenanceservice.exe [2012-09-14 114144]
R3 osppsvc;Office Software Protection Platform;c:\program files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-01-10 4925184]
R3 SwitchBoard;Adobe SwitchBoard;c:\program files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [2010-02-19 517096]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-21 59392]
R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys [2010-11-21 31232]
R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [2011-10-04 1255736]
R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe [2010-09-23 57184]
S0 amd_sata;amd_sata;c:\windows\system32\drivers\amd_sata.sys [2010-11-04 75904]
S0 amd_xata;amd_xata;c:\windows\system32\drivers\amd_xata.sys [2010-11-04 38016]
S0 PxHlpa64;PxHlpa64;c:\windows\System32\Drivers\PxHlpa64.sys [2011-11-03 56208]
S0 SymDS;Symantec Data Store;c:\windows\system32\drivers\N360x64\0603000.00E\SYMDS64.SYS [2012-03-29 451192]
S0 SymEFA;Symantec Extended File Attributes;c:\windows\system32\drivers\N360x64\0603000.00E\SYMEFA64.SYS [2012-05-22 1129120]
S1 IDSVia64;IDSVia64;c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_6.2.0.9\Definitions\IPSDefs\20120906.008\IDSvia64.sys [2012-09-06 513184]
S1 SymNetS;Symantec Network Security WFP Driver;c:\windows\System32\Drivers\N360x64\0603000.00E\SYMNETS.SYS [2012-03-29 405624]
S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [2009-07-14 59904]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [2010-05-11 203264]
S2 cvhsvc;Client Virtualization Handler;c:\program files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE [2012-01-04 822624]
S2 HP Support Assistant Service;HP Support Assistant Service;c:\program files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe [2011-09-09 86072]
S2 HPClientSvc;HP Client Services;c:\program files\Hewlett-Packard\HP Client Services\HPClientServices.exe [2010-10-11 346168]
S2 HPDrvMntSvc.exe;HP Quick Synchronization Service;c:\program files (x86)\Hewlett-Packard\Shared\HPDrvMntSvc.exe [2011-03-28 94264]
S2 MBAMScheduler;MBAMScheduler;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [2012-09-07 399432]
S2 MBAMService;MBAMService;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2012-09-07 676936]
S2 N360;Norton 360;c:\program files (x86)\Norton 360\Engine\6.3.0.14\ccSvcHst.exe [2012-06-16 138272]
S2 NOBU;Norton Online Backup;c:\program files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe SERVICE

S2 pdfcDispatcher;PDF Document Manager;c:\program files (x86)\PDF Complete\pdfsvc.exe [2011-02-01 1127448]
S2 RoxioNow Service;RoxioNow Service;c:\program files (x86)\Roxio\RoxioNow Player\RNowSvc.exe [2010-11-26 399344]
S2 sftlist;Application Virtualization Client;c:\program files (x86)\Microsoft Application Virtualization Client\sftlist.exe [2011-10-01 508776]
S3 amdkmdag;amdkmdag;c:\windows\system32\DRIVERS\atikmdag.sys [2010-05-11 6790656]
S3 amdkmdap;amdkmdap;c:\windows\system32\DRIVERS\atikmpag.sys [2010-05-11 221184]
S3 dc3d;MS Hardware Device Detection Driver (USB);c:\windows\system32\DRIVERS\dc3d.sys [2011-07-28 52584]
S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2012-09-07 25928]
S3 netr28x;Ralink 802.11n Extensible Wireless Driver;c:\windows\system32\DRIVERS\netr28x.sys [2010-11-05 1041760]
S3 Point64;Microsoft IntelliPoint Filter Driver;c:\windows\system32\DRIVERS\point64.sys [2011-08-01 45416]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [2010-12-28 412776]
S3 Sftfs;Sftfs;c:\windows\system32\DRIVERS\Sftfslh.sys [2011-10-01 764264]
S3 Sftplay;Sftplay;c:\windows\system32\DRIVERS\Sftplaylh.sys [2011-10-01 268648]
S3 Sftredir;Sftredir;c:\windows\system32\DRIVERS\Sftredirlh.sys [2011-10-01 25960]
S3 Sftvol;Sftvol;c:\windows\system32\DRIVERS\Sftvollh.sys [2011-10-01 22376]
S3 sftvsa;Application Virtualization Service Agent;c:\program files (x86)\Microsoft Application Virtualization Client\sftvsa.exe [2011-10-01 219496]
S3 usbfilter;AMD USB Filter Driver;c:\windows\system32\drivers\usbfilter.sys [2009-12-22 38456]
S3 vwifimp;Microsoft Virtual WiFi Miniport Service;c:\windows\system32\DRIVERS\vwifimp.sys [2009-07-14 17920]
S3 WSDPrintDevice;WSD Print Support via UMB;c:\windows\system32\DRIVERS\WSDPrint.sys [2009-07-14 23040]
S3 WSDScan;WSD Scan Support via UMB;c:\windows\system32\DRIVERS\WSDScan.sys [2009-07-14 25088]
.
.
--- Other Services/Drivers In Memory ---
.
*NewlyCreated* - WS2IFSL
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
2011-06-20 19:05 451872 ----a-w- c:\program files (x86)\Common Files\LightScribe\LSRunOnce.exe
.
Contents of the 'Scheduled Tasks' folder
.
2012-09-16 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-02 00:28]
.
2012-09-14 c:\windows\Tasks\HPCeeScheduleForScott.job
- c:\program files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe [2010-09-14 05:15]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"hpsysdrv"="c:\program files (x86)\hewlett-packard\HP odometer\hpsysdrv.exe" [2008-11-20 62768]
"IntelliPoint"="c:\program files\Microsoft IntelliPoint\ipoint.exe" [2011-08-01 2417032]
"AdobeAAMUpdater-1.0"="c:\program files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe" [2012-04-04 446392]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"LoadAppInit_DLLs"=0x0
.
------- Supplementary Scan -------
.
uLocal Page = c:\windows\system32\blank.htm
mLocal Page = c:\windows\SysWOW64\blank.htm
IE: Append Link Target to Existing PDF - c:\program files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: Append to Existing PDF - c:\program files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert Link Target to Adobe PDF - c:\program files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
IE: Convert to Adobe PDF - c:\program files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECapture.html
IE: E&xport to Microsoft Excel - c:\progra~2\MICROS~1\Office14\EXCEL.EXE/3000
IE: Se&nd to OneNote - c:\progra~2\MICROS~1\Office14\ONBttnIE.dll/105
TCP: DhcpNameServer = 156.154.119.11 156.154.129.11
FF - ProfilePath - c:\users\Scott\AppData\Roaming\Mozilla\Firefox\Profiles\x6dvm2ys.default-1341337853154\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/ig?hl=en&source=iglk
.
- - - - ORPHANS REMOVED - - - -
.
Wow6432Node-HKCU-Run-AdobeBridge - (no file)
ShellIconOverlayIdentifiers-{FB314ED9-A251-47B7-93E1-CDD82E34AF8B} - (no file)
ShellIconOverlayIdentifiers-{FB314EDA-A251-47B7-93E1-CDD82E34AF8B} - (no file)
ShellIconOverlayIdentifiers-{FB314EDB-A251-47B7-93E1-CDD82E34AF8B} - (no file)
ShellIconOverlayIdentifiers-{FB314EDC-A251-47B7-93E1-CDD82E34AF8B} - (no file)
AddRemove-{6F44AF95-3CDE-4513-AD3F-6D45F17BF324} - c:\program files (x86)\InstallShield Installation Information\{6F44AF95-3CDE-4513-AD3F-6D45F17BF324}\setup.exe
.
.
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\N360]
"ImagePath"="\"c:\program files (x86)\Norton 360\Engine\6.3.0.14\ccSvcHst.exe\" /s \"N360\" /m \"c:\program files (x86)\Norton 360\Engine\6.3.0.14\diMaster.dll\" /prefetch:1"
--
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\pdfcDispatcher]
"ImagePath"="c:\program files (x86)\PDF Complete\pdfsvc.exe /startedbyscm:66B66708-40E2BE4D-pdfcService"
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_4_402_265_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_4_402_265_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_4_402_265_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_4_402_265_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_4_402_265.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.11"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_4_402_265.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_4_402_265.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_4_402_265.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Office\Common\Smart Tag\Actions\{B7EFF951-E52F-45CC-9EF7-57124F2177CC}]
@Denied: (A) (Everyone)
"Solution"="{15727DE6-F92D-4E46-ACB4-0E2C58B31A18}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3]
@Denied: (A) (Everyone)
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3\0]
"Key"="ActionsPane3"
"Location"="c:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VSTO\\ActionsPane3.xsd"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
------------------------ Other Running Processes ------------------------
.
c:\program files (x86)\Common Files\EPSON\EBAPI\eEBSVC.exe
c:\program files (x86)\Common Files\LightScribe\LSSrvc.exe
c:\program files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe
.
**************************************************************************
.
Completion time: 2012-09-16 10:08:42 - machine was rebooted
ComboFix-quarantined-files.txt 2012-09-16 14:08
.
Pre-Run: 765,900,161,024 bytes free
Post-Run: 765,758,697,472 bytes free
.
- - End Of File - - 7EB797CF7A83F49A22DF92CC8A7FA65E

SuperDave · « **Reply #8 on:** September 17, 2012, 04:32:00 PM »

Quote

You have attempted an illegal operation on a on a registry key that has been marked for deletion (paraphrasing).

This should disappear after you reboot the computer.

Please read here for more information about WildTangent. Your choice if you want to remove it or not.

If you choose to follow my advice, please follow these instructions.

Go to Start > Control Panel > Add/Remove Programs and remove the following programs.

•WildTangent Web Driveror anything related to WildTangent.
********************************************************
Please download aswMBR.exe ( 511KB ) to your desktop.

Double click the aswMBR.exe to run it

Click the "Scan" button to start scan

Note: Do not take action against any **Rootkit** entries until I have reviewed the log. Often there are false positives

On completion of the scan click save log, save it to your desktop and post in your next reply
**************************************************************
Please download Rooter and Save it to your desktop.

Double click it to start the tool.Vista and Windows7 run as administrator.
Click Scan.
Eventually, a Notepad file containing the report will open, also found at C:\Rooter.txt. Post that log in your next reply.

smbulger · « **Reply #9 on:** September 18, 2012, 06:18:40 AM »

I downloaded the Avast scan, and attempted to run it twice. Both times, it got what I felt like was near the end and I got a blue screen that came up for a couple of seconds and said that "windows had discovered a problem and was shutting don to prevent the loss of information" (paraphrasing due to the speed in which the computer shut down after this and reboored. I also saw something that I think said "crash dump" on the screen.

SuperDave · « **Reply #10 on:** September 18, 2012, 04:41:02 PM »

Ok. Let's try this one.

Please download MBRCheck.exe by a_d_13 from one of the links provided below and save it to your desktop.

Link 1
Link 2
Link 3

•Double-click on MBRCheck.exe to run it.

•It will open a black window...please do not fix anything (if it gives you an option).

•When complete, you should see Done! Press ENTER to exit.... Press Enter on the keyboard.

•A log named MBRCheck_date_time.txt (i.e. MBRCheck_07.21.10_10.22.51.txt) will appear on the desktop.
•Please copy and paste the contents of that log in your next reply.

smbulger · « **Reply #11 on:** September 18, 2012, 06:40:19 PM »

MBRCheck, version 1.2.3
(c) 2010, AD

Command-line:
Windows Version:      Windows 7 Home Premium Edition
Windows Information:      Service Pack 1 (build 7601), 64-bit
Base Board Manufacturer:   FOXCONN
BIOS Manufacturer:      American Megatrends Inc.
System Manufacturer:      Hewlett-Packard
System Product Name:      p7-1020
Logical Drives Mask:      0x000101fc

Kernel Drivers (total 206):
0x02C5C000 \SystemRoot\system32\ntoskrnl.exe
0x02C13000 \SystemRoot\system32\hal.dll
0x00B9C000 \SystemRoot\system32\kdcom.dll
0x00C1E000 \SystemRoot\system32\mcupdate_AuthenticAMD.dll
0x00C2B000 \SystemRoot\system32\PSHED.dll
0x00C3F000 \SystemRoot\system32\CLFS.SYS
0x00C9D000 \SystemRoot\system32\CI.dll
0x00EA5000 \SystemRoot\system32\drivers\Wdf01000.sys
0x00F49000 \SystemRoot\system32\drivers\WDFLDR.SYS
0x00F58000 \SystemRoot\system32\drivers\ACPI.sys
0x00FAF000 \SystemRoot\system32\drivers\WMILIB.SYS
0x00FB8000 \SystemRoot\system32\drivers\msisadrv.sys
0x00FC2000 \SystemRoot\system32\drivers\pci.sys
0x00E00000 \SystemRoot\system32\drivers\vdrvroot.sys
0x00E0D000 \SystemRoot\System32\drivers\partmgr.sys
0x00E22000 \SystemRoot\system32\drivers\volmgr.sys
0x00E37000 \SystemRoot\System32\drivers\volmgrx.sys
0x00D5D000 \SystemRoot\System32\drivers\mountmgr.sys
0x00D77000 \SystemRoot\system32\drivers\amd_sata.sys
0x00D8D000 \SystemRoot\system32\drivers\storport.sys
0x00E93000 \SystemRoot\system32\drivers\amd_xata.sys
0x00FF5000 \SystemRoot\system32\drivers\amdxata.sys
0x01000000 \SystemRoot\system32\drivers\fltmgr.sys
0x0104C000 \SystemRoot\system32\drivers\N360x64\0603000.00E\SYMDS64.SYS
0x010BD000 \SystemRoot\system32\drivers\fileinfo.sys
0x010D1000 \SystemRoot\system32\drivers\N360x64\0603000.00E\SYMEFA64.SYS
0x011E9000 \SystemRoot\System32\Drivers\PxHlpa64.sys
0x0122C000 \SystemRoot\System32\Drivers\Ntfs.sys
0x0146E000 \SystemRoot\System32\Drivers\msrpc.sys
0x014CC000 \SystemRoot\System32\Drivers\ksecdd.sys
0x014E7000 \SystemRoot\System32\Drivers\cng.sys
0x01559000 \SystemRoot\System32\drivers\pcw.sys
0x0156A000 \SystemRoot\System32\Drivers\Fs_Rec.sys
0x01661000 \SystemRoot\system32\drivers\ndis.sys
0x01753000 \SystemRoot\system32\drivers\NETIO.SYS
0x017B3000 \SystemRoot\System32\Drivers\ksecpkg.sys
0x01800000 \SystemRoot\System32\drivers\tcpip.sys
0x01600000 \SystemRoot\System32\drivers\fwpkclnt.sys
0x01574000 \SystemRoot\system32\drivers\volsnap.sys
0x0164A000 \SystemRoot\System32\Drivers\spldr.sys
0x015C0000 \SystemRoot\System32\drivers\rdyboost.sys
0x017DD000 \SystemRoot\System32\Drivers\mup.sys
0x017EF000 \SystemRoot\System32\drivers\hwpolicy.sys
0x01400000 \SystemRoot\System32\DRIVERS\fvevol.sys
0x0143A000 \SystemRoot\system32\drivers\disk.sys
0x013CF000 \SystemRoot\system32\drivers\CLASSPNP.SYS
0x017F8000 \SystemRoot\system32\drivers\AtiPcie64.sys
0x03EC3000 \SystemRoot\system32\DRIVERS\cdrom.sys
0x03E31000 \SystemRoot\system32\drivers\N360x64\0603000.00E\SRTSPX64.SYS
0x03E46000 \??\C:\Windows\system32\Drivers\SYMEVENT64x86.SYS
0x03E7E000 \SystemRoot\System32\Drivers\Null.SYS
0x03E87000 \SystemRoot\System32\Drivers\Beep.SYS
0x03E8E000 \SystemRoot\System32\drivers\vga.sys
0x03E9C000 \SystemRoot\System32\drivers\VIDEOPRT.SYS
0x03EED000 \SystemRoot\System32\drivers\watchdog.sys
0x03EFD000 \SystemRoot\System32\DRIVERS\RDPCDD.sys
0x03F06000 \SystemRoot\system32\drivers\rdpencdd.sys
0x03F0F000 \SystemRoot\system32\drivers\rdprefmp.sys
0x03F18000 \SystemRoot\System32\Drivers\Msfs.SYS
0x03F23000 \SystemRoot\System32\Drivers\Npfs.SYS
0x03F34000 \SystemRoot\system32\DRIVERS\tdx.sys
0x03F56000 \SystemRoot\system32\DRIVERS\TDI.SYS
0x03F63000 \SystemRoot\system32\drivers\afd.sys
0x02C3C000 \SystemRoot\System32\DRIVERS\netbt.sys
0x02C81000 \SystemRoot\system32\drivers\ws2ifsl.sys
0x02C8C000 \SystemRoot\system32\DRIVERS\wfplwf.sys
0x02C95000 \SystemRoot\system32\DRIVERS\pacer.sys
0x02CBB000 \SystemRoot\system32\DRIVERS\vwififlt.sys
0x02CD1000 \SystemRoot\system32\DRIVERS\netbios.sys
0x02CE0000 \SystemRoot\system32\DRIVERS\wanarp.sys
0x02CFB000 \SystemRoot\system32\drivers\termdd.sys
0x02D0F000 \SystemRoot\System32\Drivers\N360x64\0603000.00E\SYMNETS.SYS
0x02D7B000 \SystemRoot\system32\DRIVERS\rdbss.sys
0x02DCC000 \SystemRoot\system32\drivers\nsiproxy.sys
0x02DD8000 \SystemRoot\system32\drivers\mssmbios.sys
0x04289000 \??\C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_6.2.0.9\Definitions\IPSDefs\20120906.008\IDSvia64.sys
0x0430B000 \??\C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys
0x04385000 \SystemRoot\System32\drivers\discache.sys
0x04394000 \SystemRoot\System32\Drivers\dfsc.sys
0x043B2000 \SystemRoot\system32\drivers\blbdrive.sys
0x043C3000 \SystemRoot\system32\DRIVERS\tunnel.sys
0x043E9000 \SystemRoot\system32\drivers\amdppm.sys
0x04200000 \SystemRoot\system32\DRIVERS\atikmpag.sys
0x04874000 \SystemRoot\system32\DRIVERS\atikmdag.sys
0x0501D000 \SystemRoot\System32\drivers\dxgkrnl.sys
0x05111000 \SystemRoot\System32\drivers\dxgmms1.sys
0x05157000 \SystemRoot\system32\DRIVERS\HDAudBus.sys
0x0521C000 \SystemRoot\system32\DRIVERS\netr28x.sys
0x05321000 \SystemRoot\system32\DRIVERS\vwifibus.sys
0x0532E000 \SystemRoot\system32\DRIVERS\Rt64win7.sys
0x05395000 \SystemRoot\system32\DRIVERS\usbohci.sys
0x053A0000 \SystemRoot\system32\DRIVERS\USBPORT.SYS
0x05200000 \SystemRoot\system32\drivers\usbfilter.sys
0x0517B000 \SystemRoot\system32\DRIVERS\usbehci.sys
0x0520D000 \SystemRoot\system32\drivers\wmiacpi.sys
0x0518C000 \SystemRoot\system32\drivers\CompositeBus.sys
0x0519C000 \SystemRoot\system32\DRIVERS\AgileVpn.sys
0x051B2000 \SystemRoot\system32\DRIVERS\rasl2tp.sys
0x051D6000 \SystemRoot\system32\DRIVERS\ndistapi.sys
0x04F3F000 \SystemRoot\system32\DRIVERS\ndiswan.sys
0x051E2000 \SystemRoot\system32\DRIVERS\raspppoe.sys
0x04F6E000 \SystemRoot\system32\DRIVERS\raspptp.sys
0x05000000 \SystemRoot\system32\DRIVERS\rassstp.sys
0x04F8F000 \SystemRoot\system32\DRIVERS\kbdclass.sys
0x04F9E000 \SystemRoot\system32\DRIVERS\mouclass.sys
0x05216000 \SystemRoot\system32\drivers\swenum.sys
0x04FAD000 \SystemRoot\system32\drivers\ks.sys
0x04800000 \SystemRoot\system32\DRIVERS\umbus.sys
0x04812000 \SystemRoot\system32\DRIVERS\usbhub.sys
0x0423B000 \SystemRoot\System32\Drivers\NDProxy.SYS
0x06A75000 \SystemRoot\system32\drivers\HdAudio.sys
0x06AD1000 \SystemRoot\system32\drivers\portcls.sys
0x06B0E000 \SystemRoot\system32\drivers\drmk.sys
0x06B30000 \SystemRoot\system32\drivers\ksthunk.sys
0x06CC6000 \SystemRoot\system32\drivers\RTKVHD64.sys
0x00060000 \SystemRoot\System32\win32k.sys
0x06F37000 \SystemRoot\System32\drivers\Dxapi.sys
0x06F43000 \SystemRoot\System32\Drivers\crashdmp.sys
0x06F51000 \SystemRoot\System32\Drivers\dump_diskdump.sys
0x06F5B000 \SystemRoot\System32\Drivers\dump_amd_sata.sys
0x06F71000 \SystemRoot\System32\Drivers\dump_dumpfve.sys
0x06F84000 \SystemRoot\system32\DRIVERS\usbprint.sys
0x06F90000 \SystemRoot\system32\DRIVERS\USBD.SYS
0x06F92000 \SystemRoot\system32\DRIVERS\usbccgp.sys
0x06FAF000 \SystemRoot\system32\DRIVERS\dc3d.sys
0x06FC1000 \SystemRoot\system32\DRIVERS\HIDPARSE.SYS
0x06FCA000 \SystemRoot\system32\DRIVERS\hidusb.sys
0x06FD8000 \SystemRoot\system32\DRIVERS\HIDCLASS.SYS
0x06FF1000 \SystemRoot\system32\DRIVERS\kbdhid.sys
0x06C00000 \SystemRoot\system32\DRIVERS\mouhid.sys
0x06C0D000 \SystemRoot\system32\DRIVERS\point64.sys
0x06C1D000 \SystemRoot\system32\DRIVERS\monitor.sys
0x005A0000 \SystemRoot\System32\TSDDD.dll
0x06C2B000 \SystemRoot\system32\DRIVERS\usbscan.sys
0x00720000 \SystemRoot\System32\cdd.dll
0x06C3C000 \SystemRoot\system32\DRIVERS\USBSTOR.SYS
0x00800000 \SystemRoot\System32\ATMFD.DLL
0x06C57000 \SystemRoot\system32\drivers\luafv.sys
0x06C7A000 \??\C:\Windows\system32\drivers\mbam.sys
0x06C84000 \SystemRoot\system32\DRIVERS\Sftvollh.sys
0x06C8F000 \SystemRoot\system32\drivers\WudfPf.sys
0x06CB0000 \SystemRoot\system32\DRIVERS\lltdio.sys
0x06B36000 \SystemRoot\system32\DRIVERS\nwifi.sys
0x06B89000 \SystemRoot\system32\DRIVERS\ndisuio.sys
0x06B9C000 \SystemRoot\system32\DRIVERS\rspndr.sys
0x06BB4000 \SystemRoot\system32\DRIVERS\vwifimp.sys
0x03A9C000 \SystemRoot\system32\drivers\HTTP.sys
0x03B65000 \SystemRoot\system32\DRIVERS\bowser.sys
0x03B83000 \SystemRoot\System32\drivers\mpsdrv.sys
0x03B9B000 \SystemRoot\system32\DRIVERS\mrxsmb.sys
0x03A00000 \SystemRoot\system32\DRIVERS\mrxsmb10.sys
0x03A4E000 \SystemRoot\system32\DRIVERS\mrxsmb20.sys
0x03A72000 \SystemRoot\System32\Drivers\adfs.SYS
0x07224000 \SystemRoot\system32\drivers\peauth.sys
0x072CA000 \SystemRoot\System32\Drivers\secdrv.SYS
0x072D5000 \SystemRoot\system32\DRIVERS\Sftfslh.sys
0x07396000 \SystemRoot\system32\DRIVERS\Sftplaylh.sys
0x03BC8000 \SystemRoot\System32\DRIVERS\srvnet.sys
0x073E3000 \SystemRoot\System32\drivers\tcpipreg.sys
0x06A00000 \SystemRoot\System32\DRIVERS\srv2.sys
0x07851000 \SystemRoot\System32\DRIVERS\srv.sys
0x078E9000 \SystemRoot\system32\DRIVERS\Sftredirlh.sys
0x078F4000 \SystemRoot\system32\DRIVERS\WUDFRd.sys
0x07925000 \SystemRoot\system32\DRIVERS\WSDScan.sys
0x07931000 \SystemRoot\system32\DRIVERS\WSDPrint.sys
0x079AD000 \SystemRoot\system32\DRIVERS\asyncmac.sys
0x771E0000 \Windows\System32\ntdll.dll
0x47A80000 \Windows\System32\smss.exe
0xFF500000 \Windows\System32\apisetschema.dll
0xFFB50000 \Windows\System32\autochk.exe
0xFF450000 \Windows\System32\clbcatq.dll
0xFF3E0000 \Windows\System32\gdi32.dll
0xFF3D0000 \Windows\System32\nsi.dll
0xFF350000 \Windows\System32\difxapi.dll
0x773B0000 \Windows\System32\psapi.dll
0xFF220000 \Windows\System32\rpcrt4.dll
0xFF1D0000 \Windows\System32\ws2_32.dll
0xFF130000 \Windows\System32\comdlg32.dll
0xFF120000 \Windows\System32\lpk.dll
0x770C0000 \Windows\System32\kernel32.dll
0x76FC0000 \Windows\System32\user32.dll
0xFEFA0000 \Windows\System32\urlmon.dll
0xFED40000 \Windows\System32\iertutil.dll
0xFEC10000 \Windows\System32\wininet.dll
0xFEB70000 \Windows\System32\msvcrt.dll
0xFDDE0000 \Windows\System32\shell32.dll
0xFDDC0000 \Windows\System32\sechost.dll
0xFDD90000 \Windows\System32\imm32.dll
0xFDD70000 \Windows\System32\imagehlp.dll
0xFDC60000 \Windows\System32\msctf.dll
0xFDA50000 \Windows\System32\ole32.dll
0x773A0000 \Windows\System32\normaliz.dll
0xFD970000 \Windows\System32\oleaut32.dll
0xFD890000 \Windows\System32\advapi32.dll
0xFD830000 \Windows\System32\Wldap32.dll
0xFD760000 \Windows\System32\usp10.dll
0xFD580000 \Windows\System32\setupapi.dll
0xFD500000 \Windows\System32\shlwapi.dll
0xFD460000 \Windows\System32\comctl32.dll
0xFD2F0000 \Windows\System32\crypt32.dll
0xFD280000 \Windows\System32\KernelBase.dll
0xFD260000 \Windows\System32\devobj.dll
0xFD220000 \Windows\System32\cfgmgr32.dll
0xFD1E0000 \Windows\System32\wintrust.dll
0xFD1D0000 \Windows\System32\msasn1.dll
0x75150000 \Windows\SysWOW64\normaliz.dll

Processes (total 68):
0 System Idle Process
4 System
284 C:\Windows\System32\smss.exe
428 csrss.exe
500 csrss.exe
508 C:\Windows\System32\wininit.exe
556 C:\Windows\System32\winlogon.exe
604 C:\Windows\System32\services.exe
620 C:\Windows\System32\lsass.exe
628 C:\Windows\System32\lsm.exe
732 C:\Windows\System32\svchost.exe
812 C:\Windows\System32\svchost.exe
916 C:\Windows\System32\atiesrxx.exe
952 C:\Windows\System32\svchost.exe
992 C:\Windows\System32\svchost.exe
120 C:\Windows\System32\svchost.exe
344 C:\Windows\System32\svchost.exe
1044 C:\Windows\System32\svchost.exe
1308 C:\Windows\System32\spoolsv.exe
1336 C:\Windows\System32\svchost.exe
1388 C:\Windows\System32\atieclxx.exe
1444 C:\Program Files (x86)\Common Files\EPSON\EBAPI\eEBSvc.exe
1812 C:\Windows\System32\svchost.exe
1836 C:\Program Files\Hewlett-Packard\HP Client Services\HPClientServices.exe
1924 C:\Program Files (x86)\Hewlett-Packard\Shared\HPDrvMntSvc.exe
1976 C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe
2008 C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe
2028 C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
708 C:\Program Files (x86)\Norton 360\Engine\6.3.0.14\ccsvchst.exe
1376 C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe
1192 C:\Program Files (x86)\PDF Complete\pdfsvc.exe
1628 C:\Program Files (x86)\Roxio\RoxioNow Player\RNowSvc.exe
2220 C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe
2248 C:\Windows\System32\svchost.exe
2288 C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
2408 C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe
2476 C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
2676 C:\Program Files (x86)\Common Files\microsoft shared\Virtualization Handler\CVHSVC.EXE
2888 C:\Windows\System32\taskhost.exe
2904 C:\Windows\System32\dwm.exe
2948 C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe
2976 C:\Windows\explorer.exe
3388 C:\Windows\System32\svchost.exe
4072 WUDFHost.exe
1572 C:\Program Files (x86)\Hewlett-Packard\HP Odometer\hpsysdrv.exe
3208 C:\Program Files\Microsoft IntelliPoint\ipoint.exe
3328 C:\Program Files\Windows Sidebar\sidebar.exe
3492 C:\Program Files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe
3828 C:\Program Files (x86)\Common Files\Nikon\Monitor\NkMonitor.exe
4048 C:\Program Files (x86)\Hp\HP Software Update\hpwuschd2.exe
3540 C:\Program Files\Microsoft IntelliPoint\dpupdchk.exe
3932 C:\Program Files (x86)\Epson Software\Event Manager\EEventManager.exe
4040 C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
3624 C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\acrotray.exe
4088 C:\Windows\System32\SearchIndexer.exe
3716 C:\Program Files\Windows Media Player\wmpnetwk.exe
3300 C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
3620 C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
3116 C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSA_Service.exe
2380 C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
3888 C:\Windows\System32\SearchProtocolHost.exe
3304 C:\Windows\System32\SearchFilterHost.exe
2148 C:\Windows\System32\taskeng.exe
3092 C:\Program Files (x86)\Mozilla Firefox\firefox.exe
4200 C:\Windows\System32\audiodg.exe
4212 C:\Users\Scott\Desktop\MBRCheck.exe
1500 C:\Windows\System32\conhost.exe
3872 C:\Windows\System32\dllhost.exe

\\.\C: --> \\.\PhysicalDrive0 at offset 0x00000000`06500000 (NTFS)
\\.\D: --> \\.\PhysicalDrive0 at offset 0x0000015a`87700000 (NTFS)
\\.\Q: --> error 5

PhysicalDrive0 Model Number: WDCWD15EARS-60MVWB0, Rev: 51.0AB51

Size Device Name MBR Status
--------------------------------------------
1397 GB \\.\PhysicalDrive0 Unknown MBR code
SHA1: 3BCEDD60C0E461B085E70E6E78D2B6B492B0A44 C

Found non-standard or infected MBR.
Enter 'Y' and hit ENTER for more options, or 'N' to exit:
Options:
[1] Dump the MBR of a physical disk to file.
[2] Restore the MBR of a physical disk with a standard boot code.
[3] Exit.

Enter your choice:

Done!

SuperDave · « **Reply #12 on:** September 18, 2012, 07:13:33 PM »

Please Boot to the System Recovery Options
If you have Windows 7 installation disc, just insert a DVD to the drive, restart computer and it should load automatically (option two presented in the article).
It's possible also that your computer has a pre-installed recovery partition instead - in such a case use a method one (by pressing F8 before Windows starts loading)...
NOTE. If none of the above apply you can create System Repair Disc (link in "Option two") and boot from it.

On the System Recovery Options menu you will get the following options:

Startup Repair
System Restore
Windows Complete PC Restore
Windows Memory Diagnostic Tool
Command Prompt

Choose Command Prompt
You should see X:\SOURCES>...

Execute the following commands in bold.
Press Enter after every one of them.

bootrec /fixmbr (<--- there is a "space" after "bootrec")

bootrec /fixboot (<--- there is a "space" after "bootrec")

exit

Restart computer.

Please run MBRCheck after doing the above and post the log.

smbulger · « **Reply #13 on:** September 19, 2012, 05:16:31 AM »

F8 is not an option while rebooting.

F9 = Diagnostics
F10 = Setup
F11 = System REcovery
F12 = Boot from LAN

smbulger · « **Reply #14 on:** September 19, 2012, 07:43:42 PM »

Further information.

I do not have a Windows 7 Disk. It came installed on the computer.

Since you suggested the "System Recovery", I pressed teh F11 to see what the options were and there are three.

1 - System Recovery
2 - System Repair
3 - System Restore

(but not in that order). At this point I just exited out of it to await further instruction.

Thank you.

SuperDave · « **Reply #15 on:** September 20, 2012, 05:02:20 PM »

We need to fix the Master Boot Record using aswMBR now.

Double click aswMBR.exe to run it like before
Once the scan finishes click FixMBR to remove the infection as illustrated below

Once the scan finishes click Save log to save the log to your Desktop
Copy and paste the contents of aswMBR.txt back here for review

.

smbulger · « **Reply #16 on:** September 21, 2012, 09:48:12 AM »

aswMBR version 0.9.9.1665 Copyright(c) 2011 AVAST Software
Run date: 2012-09-21 09:12:35
-----------------------------
09:12:35.345 OS Version: Windows x64 6.1.7601 Service Pack 1
09:12:35.345 Number of processors: 4 586 0xA00
09:12:35.345 ComputerName: SCOTT-HP UserName: Scott
09:12:39.432 Initialize success
09:13:41.734 AVAST engine defs: 12092100
09:13:58.754 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\0000005f
09:13:58.770 Disk 0 Vendor: WDC_WD15 51.0 Size: 1430799MB BusType: 11
09:13:58.801 Disk 0 MBR read successfully
09:13:58.801 Disk 0 MBR scan
09:13:58.801 Disk 0 unknown MBR code
09:13:58.816 Disk 0 Partition 1 80 (A) 07 HPFS/NTFS NTFS 100 MB offset 2048
09:13:58.832 Disk 0 Partition 2 00 07 HPFS/NTFS NTFS 1419282 MB offset 206848
09:13:58.863 Disk 0 Partition 3 00 07 HPFS/NTFS NTFS 11415 MB offset 2906896384
09:13:58.926 Disk 0 scanning C:\Windows\system32\drivers
09:14:09.268 Service scanning
09:14:29.720 Modules scanning
09:14:29.736 Disk 0 trace - called modules:
09:14:29.767 ntoskrnl.exe CLASSPNP.SYS disk.sys amd_xata.sys storport.sys hal.dll amd_sata.sys
09:14:29.783 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0xfffffa800778f790]
09:14:29.783 3 CLASSPNP.SYS[fffff8800100143f] -> nt!IofCallDriver -> [0xfffffa8007220ac0]
09:14:29.798 5 amd_xata.sys[fffff88000e878b4] -> nt!IofCallDriver -> \Device\0000005f[0xfffffa800721c9c0]
09:14:35.789 AVAST engine scan C:\Windows
09:14:42.575 AVAST engine scan C:\Windows\system32
09:18:19.477 AVAST engine scan C:\Windows\system32\drivers
09:18:34.641 AVAST engine scan C:\Users\Scott
11:10:17.208 AVAST engine scan C:\ProgramData
11:12:20.947 Scan finished successfully
11:34:27.961 Verifying
11:34:38.023 Disk 0 Windows 601 MBR fixed successfully
11:47:31.332 Disk 0 MBR has been saved successfully to "C:\Users\Scott\Desktop\MBR.dat"
11:47:31.348 The log file has been saved successfully to "C:\Users\Scott\Desktop\aswMBR.txt"

SuperDave · « **Reply #17 on:** September 21, 2012, 07:47:16 PM »

Please download MBRCheck.exe by a_d_13 from one of the links provided below and save it to your desktop.

Link 1
Link 2
Link 3

•Double-click on MBRCheck.exe to run it.

•It will open a black window...please do not fix anything (if it gives you an option).

•When complete, you should see Done! Press ENTER to exit.... Press Enter on the keyboard.

•A log named MBRCheck_date_time.txt (i.e. MBRCheck_07.21.10_10.22.51.txt) will appear on the desktop.
•Please copy and paste the contents of that log in your next reply.
*********************************************************
Please download Rooter and Save it to your desktop.

Double click it to start the tool.Vista and Windows7 run as administrator.
Click Scan.
Eventually, a Notepad file containing the report will open, also found at C:\Rooter.txt. Post that log in your next reply.

smbulger · « **Reply #18 on:** September 21, 2012, 08:02:53 PM »

MBRCheck, version 1.2.3
(c) 2010, AD

Command-line:
Windows Version:      Windows 7 Home Premium Edition
Windows Information:      Service Pack 1 (build 7601), 64-bit
Base Board Manufacturer:   FOXCONN
BIOS Manufacturer:      American Megatrends Inc.
System Manufacturer:      Hewlett-Packard
System Product Name:      p7-1020
Logical Drives Mask:      0x000101fc

Kernel Drivers (total 173):
0x02C63000 \SystemRoot\system32\ntoskrnl.exe
0x02C1A000 \SystemRoot\system32\hal.dll
0x00BBB000 \SystemRoot\system32\kdcom.dll
0x00C7B000 \SystemRoot\system32\mcupdate_AuthenticAMD.dll
0x00C88000 \SystemRoot\system32\PSHED.dll
0x00C9C000 \SystemRoot\system32\CLFS.SYS
0x00CFA000 \SystemRoot\system32\CI.dll
0x00E96000 \SystemRoot\system32\drivers\Wdf01000.sys
0x00F3A000 \SystemRoot\system32\drivers\WDFLDR.SYS
0x00F49000 \SystemRoot\system32\drivers\ACPI.sys
0x00FA0000 \SystemRoot\system32\drivers\WMILIB.SYS
0x00FA9000 \SystemRoot\system32\drivers\msisadrv.sys
0x00FB3000 \SystemRoot\system32\drivers\pci.sys
0x00FE6000 \SystemRoot\system32\drivers\vdrvroot.sys
0x00E00000 \SystemRoot\System32\drivers\partmgr.sys
0x00E15000 \SystemRoot\system32\drivers\volmgr.sys
0x00E2A000 \SystemRoot\System32\drivers\volmgrx.sys
0x00DBA000 \SystemRoot\System32\drivers\mountmgr.sys
0x00DD4000 \SystemRoot\system32\drivers\amd_sata.sys
0x00C00000 \SystemRoot\system32\drivers\storport.sys
0x00E86000 \SystemRoot\system32\drivers\amd_xata.sys
0x00FF3000 \SystemRoot\system32\drivers\amdxata.sys
0x01040000 \SystemRoot\system32\drivers\fltmgr.sys
0x0108C000 \SystemRoot\system32\drivers\N360x64\0603000.00E\SYMDS64.SYS
0x010FD000 \SystemRoot\system32\drivers\fileinfo.sys
0x012D0000 \SystemRoot\system32\drivers\N360x64\0603000.00E\SYMEFA64.SYS
0x013E8000 \SystemRoot\System32\Drivers\PxHlpa64.sys
0x0142B000 \SystemRoot\System32\Drivers\Ntfs.sys
0x01200000 \SystemRoot\System32\Drivers\msrpc.sys
0x015CE000 \SystemRoot\System32\Drivers\ksecdd.sys
0x0125E000 \SystemRoot\System32\Drivers\cng.sys
0x015E9000 \SystemRoot\System32\drivers\pcw.sys
0x01400000 \SystemRoot\System32\Drivers\Fs_Rec.sys
0x016E5000 \SystemRoot\system32\drivers\ndis.sys
0x01600000 \SystemRoot\system32\drivers\NETIO.SYS
0x01660000 \SystemRoot\System32\Drivers\ksecpkg.sys
0x01800000 \SystemRoot\System32\drivers\tcpip.sys
0x0168A000 \SystemRoot\System32\drivers\fwpkclnt.sys
0x01111000 \SystemRoot\system32\drivers\volsnap.sys
0x016D4000 \SystemRoot\System32\Drivers\spldr.sys
0x0115D000 \SystemRoot\System32\drivers\rdyboost.sys
0x017D7000 \SystemRoot\System32\Drivers\mup.sys
0x017E9000 \SystemRoot\System32\drivers\hwpolicy.sys
0x01197000 \SystemRoot\System32\DRIVERS\fvevol.sys
0x0140A000 \SystemRoot\system32\drivers\disk.sys
0x01000000 \SystemRoot\system32\drivers\CLASSPNP.SYS
0x017F2000 \SystemRoot\system32\drivers\AtiPcie64.sys
0x03E32000 \SystemRoot\system32\DRIVERS\cdrom.sys
0x03F7A000 \SystemRoot\system32\drivers\N360x64\0603000.00E\SRTSPX64.SYS
0x03F8F000 \??\C:\Windows\system32\Drivers\SYMEVENT64x86.SYS
0x03FC7000 \SystemRoot\System32\Drivers\Null.SYS
0x03FD0000 \SystemRoot\System32\Drivers\Beep.SYS
0x03FD7000 \SystemRoot\System32\drivers\vga.sys
0x03E00000 \SystemRoot\System32\drivers\VIDEOPRT.SYS
0x03E5C000 \SystemRoot\System32\drivers\watchdog.sys
0x03E6C000 \SystemRoot\System32\DRIVERS\RDPCDD.sys
0x03E75000 \SystemRoot\system32\drivers\rdpencdd.sys
0x03E7E000 \SystemRoot\system32\drivers\rdprefmp.sys
0x03E87000 \SystemRoot\System32\Drivers\Msfs.SYS
0x03E92000 \SystemRoot\System32\Drivers\Npfs.SYS
0x03EA3000 \SystemRoot\system32\DRIVERS\tdx.sys
0x03EC5000 \SystemRoot\system32\DRIVERS\TDI.SYS
0x03ED2000 \SystemRoot\system32\drivers\afd.sys
0x040B0000 \SystemRoot\System32\DRIVERS\netbt.sys
0x040F5000 \SystemRoot\system32\drivers\ws2ifsl.sys
0x04100000 \SystemRoot\system32\DRIVERS\wfplwf.sys
0x04109000 \SystemRoot\system32\DRIVERS\pacer.sys
0x0412F000 \SystemRoot\system32\DRIVERS\vwififlt.sys
0x04145000 \SystemRoot\system32\DRIVERS\netbios.sys
0x04154000 \SystemRoot\system32\DRIVERS\wanarp.sys
0x0416F000 \SystemRoot\system32\drivers\termdd.sys
0x04183000 \SystemRoot\System32\Drivers\N360x64\0603000.00E\SYMNETS.SYS
0x04000000 \SystemRoot\system32\DRIVERS\rdbss.sys
0x04051000 \SystemRoot\system32\drivers\nsiproxy.sys
0x0405D000 \SystemRoot\system32\drivers\mssmbios.sys
0x0423E000 \??\C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_6.2.0.9\Definitions\IPSDefs\20120906.008\IDSvia64.sys
0x042C0000 \??\C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys
0x0433A000 \SystemRoot\System32\drivers\discache.sys
0x04349000 \SystemRoot\System32\Drivers\dfsc.sys
0x04367000 \SystemRoot\system32\drivers\blbdrive.sys
0x04378000 \SystemRoot\system32\DRIVERS\tunnel.sys
0x0439E000 \SystemRoot\system32\drivers\amdppm.sys
0x043B3000 \SystemRoot\system32\DRIVERS\atikmpag.sys
0x0487D000 \SystemRoot\system32\DRIVERS\atikmdag.sys
0x02CA4000 \SystemRoot\System32\drivers\dxgkrnl.sys
0x02D98000 \SystemRoot\System32\drivers\dxgmms1.sys
0x02C00000 \SystemRoot\system32\DRIVERS\HDAudBus.sys
0x04423000 \SystemRoot\system32\DRIVERS\netr28x.sys
0x04528000 \SystemRoot\system32\DRIVERS\vwifibus.sys
0x04535000 \SystemRoot\system32\DRIVERS\Rt64win7.sys
0x0459C000 \SystemRoot\system32\DRIVERS\usbohci.sys
0x045A7000 \SystemRoot\system32\DRIVERS\USBPORT.SYS
0x04400000 \SystemRoot\system32\drivers\usbfilter.sys
0x0440D000 \SystemRoot\system32\DRIVERS\usbehci.sys
0x02C24000 \SystemRoot\system32\drivers\wmiacpi.sys
0x02C2D000 \SystemRoot\system32\drivers\CompositeBus.sys
0x02C3D000 \SystemRoot\system32\DRIVERS\AgileVpn.sys
0x02C53000 \SystemRoot\system32\DRIVERS\rasl2tp.sys
0x02C77000 \SystemRoot\system32\DRIVERS\ndistapi.sys
0x04F48000 \SystemRoot\system32\DRIVERS\ndiswan.sys
0x02C83000 \SystemRoot\system32\DRIVERS\raspppoe.sys
0x02DDE000 \SystemRoot\system32\DRIVERS\raspptp.sys
0x04F77000 \SystemRoot\system32\DRIVERS\rassstp.sys
0x04F91000 \SystemRoot\system32\DRIVERS\kbdclass.sys
0x04FA0000 \SystemRoot\system32\DRIVERS\mouclass.sys
0x0441E000 \SystemRoot\system32\drivers\swenum.sys
0x04FAF000 \SystemRoot\system32\drivers\ks.sys
0x04800000 \SystemRoot\system32\DRIVERS\umbus.sys
0x04812000 \SystemRoot\system32\DRIVERS\usbhub.sys
0x04200000 \SystemRoot\System32\Drivers\NDProxy.SYS
0x068AB000 \SystemRoot\system32\drivers\HdAudio.sys
0x06907000 \SystemRoot\system32\drivers\portcls.sys
0x06944000 \SystemRoot\system32\drivers\drmk.sys
0x06966000 \SystemRoot\system32\drivers\ksthunk.sys
0x06A70000 \SystemRoot\system32\drivers\RTKVHD64.sys
0x06CE1000 \SystemRoot\System32\Drivers\crashdmp.sys
0x06CEF000 \SystemRoot\System32\Drivers\dump_diskdump.sys
0x06CF9000 \SystemRoot\System32\Drivers\dump_amd_sata.sys
0x06D0F000 \SystemRoot\System32\Drivers\dump_dumpfve.sys
0x06D22000 \SystemRoot\system32\DRIVERS\usbprint.sys
0x06D2E000 \SystemRoot\system32\DRIVERS\USBD.SYS
0x06D30000 \SystemRoot\system32\DRIVERS\usbccgp.sys
0x06D4D000 \SystemRoot\system32\DRIVERS\dc3d.sys
0x06D5F000 \SystemRoot\system32\DRIVERS\HIDPARSE.SYS
0x06D68000 \SystemRoot\system32\DRIVERS\hidusb.sys
0x06D76000 \SystemRoot\system32\DRIVERS\HIDCLASS.SYS
0x06D8F000 \SystemRoot\system32\DRIVERS\kbdhid.sys
0x06D9D000 \SystemRoot\system32\DRIVERS\mouhid.sys
0x06DAA000 \SystemRoot\system32\DRIVERS\point64.sys
0x06DBA000 \SystemRoot\system32\DRIVERS\usbscan.sys
0x00070000 \SystemRoot\System32\win32k.sys
0x06DCB000 \SystemRoot\System32\drivers\Dxapi.sys
0x06DD7000 \SystemRoot\system32\DRIVERS\USBSTOR.SYS
0x06DF2000 \SystemRoot\system32\DRIVERS\monitor.sys
0x005C0000 \SystemRoot\System32\TSDDD.dll
0x00770000 \SystemRoot\System32\cdd.dll
0x00820000 \SystemRoot\System32\ATMFD.DLL
0x06A00000 \SystemRoot\system32\drivers\luafv.sys
0x06A23000 \??\C:\Windows\system32\drivers\mbam.sys
0x06A2D000 \SystemRoot\system32\DRIVERS\Sftvollh.sys
0x06A38000 \SystemRoot\system32\drivers\WudfPf.sys
0x06A59000 \SystemRoot\system32\DRIVERS\lltdio.sys
0x0696C000 \SystemRoot\system32\DRIVERS\nwifi.sys
0x069BF000 \SystemRoot\system32\DRIVERS\ndisuio.sys
0x069D2000 \SystemRoot\system32\DRIVERS\rspndr.sys
0x069EA000 \SystemRoot\system32\DRIVERS\vwifimp.sys
0x03A3C000 \SystemRoot\system32\drivers\HTTP.sys
0x03B05000 \SystemRoot\system32\DRIVERS\bowser.sys
0x03B23000 \SystemRoot\System32\drivers\mpsdrv.sys
0x03B3B000 \SystemRoot\system32\DRIVERS\mrxsmb.sys
0x03B68000 \SystemRoot\system32\DRIVERS\mrxsmb10.sys
0x03BB6000 \SystemRoot\system32\DRIVERS\mrxsmb20.sys
0x03BDA000 \SystemRoot\System32\Drivers\adfs.SYS
0x06800000 \SystemRoot\system32\drivers\peauth.sys
0x03BF2000 \SystemRoot\System32\Drivers\secdrv.SYS
0x07004000 \SystemRoot\system32\DRIVERS\Sftfslh.sys
0x070C5000 \SystemRoot\system32\DRIVERS\Sftplaylh.sys
0x07112000 \SystemRoot\System32\DRIVERS\srvnet.sys
0x07143000 \SystemRoot\System32\drivers\tcpipreg.sys
0x07155000 \SystemRoot\System32\DRIVERS\srv2.sys
0x078CF000 \SystemRoot\System32\DRIVERS\srv.sys
0x07967000 \SystemRoot\system32\DRIVERS\Sftredirlh.sys
0x07972000 \SystemRoot\system32\DRIVERS\WUDFRd.sys
0x079A3000 \SystemRoot\system32\DRIVERS\asyncmac.sys
0x07871000 \SystemRoot\system32\DRIVERS\udfs.sys
0x0784A000 \??\C:\Users\Scott\AppData\Local\Temp\aswMBR.sys
0x079AE000 \SystemRoot\System32\Drivers\fastfat.SYS
0x079E4000 \SystemRoot\system32\DRIVERS\WSDScan.sys
0x079F0000 \SystemRoot\system32\DRIVERS\WSDPrint.sys
0x77860000 \Windows\System32\ntdll.dll
0x47FD0000 \Windows\System32\smss.exe
0xFFB80000 \Windows\System32\apisetschema.dll
0xFFD80000 \Windows\System32\autochk.exe

Processes (total 70):
0 System Idle Process
4 System
292 C:\Windows\System32\smss.exe
420 csrss.exe
484 C:\Windows\System32\wininit.exe
520 csrss.exe
548 C:\Windows\System32\services.exe
572 C:\Windows\System32\lsass.exe
588 C:\Windows\System32\winlogon.exe
596 C:\Windows\System32\lsm.exe
720 C:\Windows\System32\svchost.exe
800 C:\Windows\System32\svchost.exe
892 C:\Windows\System32\atiesrxx.exe
928 C:\Windows\System32\svchost.exe
964 C:\Windows\System32\svchost.exe
1004 C:\Windows\System32\svchost.exe
536 C:\Windows\System32\svchost.exe
1088 C:\Windows\System32\atieclxx.exe
1156 C:\Windows\System32\svchost.exe
1400 C:\Windows\System32\spoolsv.exe
1428 C:\Windows\System32\svchost.exe
1688 C:\Windows\System32\svchost.exe
1720 C:\Program Files\Hewlett-Packard\HP Client Services\HPClientServices.exe
1844 C:\Program Files (x86)\Hewlett-Packard\Shared\HPDrvMntSvc.exe
1872 C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe
1904 C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe
1924 C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
1944 C:\Program Files (x86)\Norton 360\Engine\6.3.0.14\ccsvchst.exe
1976 C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe
348 C:\Program Files (x86)\PDF Complete\pdfsvc.exe
1292 C:\Program Files (x86)\Roxio\RoxioNow Player\RNowSvc.exe
2252 C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe
2320 C:\Windows\System32\svchost.exe
2388 C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
2452 C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe
2592 C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
2688 C:\Windows\System32\dwm.exe
2312 C:\Windows\System32\taskhost.exe
1236 C:\Windows\explorer.exe
2780 C:\Program Files (x86)\Common Files\microsoft shared\Virtualization Handler\CVHSVC.EXE
2816 C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe
3216 WUDFHost.exe
3292 C:\Windows\System32\svchost.exe
3364 C:\Program Files (x86)\Hewlett-Packard\HP Odometer\hpsysdrv.exe
3584 C:\Program Files\Microsoft IntelliPoint\ipoint.exe
3752 C:\Program Files\Windows Sidebar\sidebar.exe
3812 C:\Program Files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe
4016 C:\Program Files (x86)\Common Files\Nikon\Monitor\NkMonitor.exe
3644 C:\Program Files (x86)\Hp\HP Software Update\hpwuschd2.exe
3704 C:\Program Files\Microsoft IntelliPoint\dpupdchk.exe
4040 C:\Program Files (x86)\Epson Software\Event Manager\EEventManager.exe
3460 C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
2716 C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\acrotray.exe
3436 C:\Windows\System32\SearchIndexer.exe
3528 C:\Program Files\Windows Media Player\wmpnetwk.exe
812 C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
1808 C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
3580 C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
4456 C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSA_Service.exe
4712 C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe
3016 C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe
4568 C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe
2304 C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe
324 C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe
1252 C:\Windows\System32\SearchProtocolHost.exe
3020 C:\Windows\System32\SearchFilterHost.exe
3332 C:\Windows\System32\audiodg.exe
1584 C:\Users\Scott\Desktop\MBRCheck.exe
3212 C:\Windows\System32\conhost.exe
4676 C:\Windows\System32\dllhost.exe

\\.\C: --> \\.\PhysicalDrive0 at offset 0x00000000`06500000 (NTFS)
\\.\D: --> \\.\PhysicalDrive0 at offset 0x0000015a`87700000 (NTFS)
\\.\Q: --> error 5

PhysicalDrive0 Model Number: WDCWD15EARS-60MVWB0, Rev: 51.0AB51

Size Device Name MBR Status
--------------------------------------------
1397 GB \\.\PhysicalDrive0 Windows 7 MBR code detected
SHA1: F37A9776F0E98E38BD78E91425829D97888CEEF C

Done!

smbulger · « **Reply #19 on:** September 21, 2012, 08:06:51 PM »

Rooter.exe (v1.0.2) by Eric_71
.
The token does not have the SeDebugPrivilege privilege ! (error:1300)
Can not acquire SeDebugPrivilege !
Please run the tool as administrator ..
.
Windows 7 Home Edition (6.1.7601) Service Pack 1
[32_bits] - AMD64 Family 16 Model 10 Stepping 0, AuthenticAMD
.
Error OpenService (wscsvc) : 6
Error OpenSCManager : 5
Error OpenService (MpsSvc) : 6
Windows Defender -> Enabled
User Account Control (UAC) -> Enabled
.
Internet Explorer 8.0.7601.17514
Mozilla Firefox 15.0 (en-US)
.
C:\ [Fixed-NTFS] .. ( Total:1386 Go - Free:704 Go )
D:\ [Fixed-NTFS] .. ( Total:11 Go - Free:1 Go )
E:\ [CD_Rom]
F:\ [Removable]
G:\ [Removable]
H:\ [Removable]
I:\ [Removable]
Q:\ [Fixed-NTFS] .. ( Total:0 Go - Free:0 Go )
.
Scan : 22:09.28
Path : C:\Users\Scott\Desktop\Rooter.exe
User : Scott ( Administrator -> YES )
.
----------------------\\ Processes
.
Locked [System Process] (0)
Locked System (4)
Locked smss.exe (292)
Locked csrss.exe (420)
Locked wininit.exe (484)
Locked csrss.exe (520)
Locked services.exe (548)
Locked lsass.exe (572)
Locked winlogon.exe (588)
Locked lsm.exe (596)
Locked svchost.exe (720)
Locked svchost.exe (800)
Locked atiesrxx.exe (892)
Locked svchost.exe (928)
Locked svchost.exe (964)
Locked svchost.exe (1004)
Locked svchost.exe (536)
Locked atieclxx.exe (1088)
Locked svchost.exe (1156)
Locked spoolsv.exe (1400)
Locked svchost.exe (1428)
Locked svchost.exe (1688)
Locked HPClientServices.exe (1720)
Locked HPDrvMntSvc.exe (1844)
Locked LSSrvc.exe (1872)
Locked mbamscheduler.exe (1904)
Locked mbamservice.exe (1924)
Locked ccsvchst.exe (1944)
Locked NOBuAgent.exe (1976)
Locked pdfsvc.exe (348)
Locked RNowSvc.exe (1292)
Locked sftvsa.exe (2252)
Locked svchost.exe (2320)
Locked WLIDSVC.EXE (2388)
Locked sftlist.exe (2452)
Locked WLIDSVCM.EXE (2592)
______

? (2688)
______

? (2312)
______

? (1236)
Locked CVHSVC.EXE (2780)
______ C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe (2816)
Locked WUDFHost.exe (3216)
Locked svchost.exe (3292)
______ C:\Program Files (x86)\Hewlett-Packard\HP Odometer\hpsysdrv.exe (3364)
______

? (3584)
______

? (3752)
______ C:\Program Files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe (3812)
______ C:\Program Files (x86)\Common Files\Nikon\Monitor\NkMonitor.exe (4016)
______ C:\Program Files (x86)\Hp\HP Software Update\hpwuschd2.exe (3644)
______

? (3704)
______ C:\Program Files (x86)\Epson Software\Event Manager\EEventManager.exe (4040)
______ C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe (3460)
______ C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\acrotray.exe (2716)
Locked SearchIndexer.exe (3436)
Locked wmpnetwk.exe (3528)
______

? (812)
______

? (1808)
Locked OSPPSVC.EXE (3580)
Locked HPSA_Service.exe (4456)
______ C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe (4712)
______ C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe (3016)
______ C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe (4568)
______ C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe (2304)
______ C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe (324)
Locked audiodg.exe (3332)
Locked WmiPrvSE.exe (5056)
Locked SearchProtocolHost.exe (2636)
Locked SearchFilterHost.exe (1916)
______ C:\Users\Scott\Desktop\Rooter.exe (4656)
.
----------------------\\ Device\Harddisk0\
.
\Device\Harddisk0 [Sectors : 63 x 512 Bytes]
.
\Device\Harddisk0\Partition1 --[ MBR ]-- (Start_Offset:1048576 | Length:104857600)
\Device\Harddisk0\Partition2 (Start_Offset:105906176 | Length:1488225042432)
\Device\Harddisk0\Partition3 (Start_Offset:1488330948608 | Length:11969495040)
.
----------------------\\ Scheduled Tasks
.
C:\Windows\Tasks\Adobe Flash Player Updater.job
C:\Windows\Tasks\HPCeeScheduleForScott.job
C:\Windows\Tasks\SA.DAT
C:\Windows\Tasks\SCHEDLGU.TXT
.
----------------------\\ Registry
.
.
----------------------\\ Files & Folders
.
----------------------\\ Scan completed at 22:10.00
.
C:\Rooter$\Rooter_1.txt - (21/09/2012 | 22:10.00)

SuperDave · « **Reply #20 on:** September 22, 2012, 12:28:05 PM »

How's your computer running now?

I'd like to scan your machine with ESET OnlineScan

•Hold down Control and click on the following link to open ESET OnlineScan in a new window.
ESET OnlineScan
•Click the

button.
•For alternate browsers only: (Microsoft Internet Explorer users can skip these steps)

Click on to download the ESET Smart Installer. Save it to your desktop.
Double click on the icon on your desktop.

•Check

•Click the

button.
•Accept any security warnings from your browser.
•Check

•Push the Start button.
•ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
•When the scan completes, push

•Push

, and save the file to your desktop using a unique name, such as ESETScan. Include the contents of this report in your next reply.
•Push the

button.
•Push

A log file will be saved here: C:\Program Files\ESET\ESET Online Scanner\log.txt

smbulger · « **Reply #21 on:** September 22, 2012, 06:15:22 PM »

ESETSmartInstaller@High as downloader log:
all ok
# version=7
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6583
# api_version=3.0.2
# EOSSerial=ca2b0d6e1229be4f820757e723f09c1c
# end=finished
# remove_checked=true
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2012-09-23 12:17:42
# local_time=2012-09-22 08:17:42 (-0500, Eastern Daylight Time)
# country="United States"
# lang=1033
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode=3589 16777213 100 65 0 16126428 0 0
# compatibility_mode=5893 16776574 100 82 0 99884562 0 0
# compatibility_mode=8192 67108863 100 0 0 0 0 0
# scanned=451471
# found=1
# cleaned=1
# scan_time=18350
C:\Users\Scott\Downloads\cnet2_ashampoo_cover_studio_2_2_2_0_sm_exe.exe a variant of Win32/InstallCore.D application (cleaned by deleting - quarantined) 00000000000000000000000000000000 C

SuperDave · « **Reply #22 on:** September 23, 2012, 05:01:44 PM »

Ok. If there are no other issues, we can do some cleanup.

To uninstall ComboFix

Click the Start button. Click Run. For Vista: type in Run in the Start search, and click on Run in the results pane.
In the field, type in ComboFix /uninstall

(Note: Make sure there's a space between the word ComboFix and the forward-slash.)

Then, press Enter, or click OK.
This will uninstall ComboFix, delete its folders and files, hides System files and folders, and resets System Restore.

*******************************************************
Click Start> Computer> right click the C Drive and choose Properties> enter
Click Disk Cleanup from there.

Click OK on the Disk Cleanup Screen.
Click Yes on the Confirmation screen.

This runs the Disk Cleanup utility along with other selections if you have chosen any. (if you had a lot System Restore points, you will see a significant change in the free space in C drive)
*****************************************************
Go to Microsoft Windows Update and get all critical updates.

----------

I suggest using WOT - Web of Trust. WOT is a free Internet security addon for your browser. It will keep you safe from online scams, identity theft, spyware, spam, viruses and unreliable shopping sites. WOT warns you before you interact with a risky website. It's easy and it's free.

SpywareBlaster- Secure your Internet Explorer to make it harder for ActiveX programs to run on your computer. Also stop certain cookies from being added to your computer when running Mozilla based browsers like Firefox.
* Using SpywareBlaster to protect your computer from Spyware and Malware
* If you don't know what ActiveX controls are, see here

Protect yourself against spyware using the Immunize feature in Spybot - Search & Destroy. Guide: Use Spybot's Immunize Feature to prevent spyware infection in real-time. Note: To ensure you have the latest Immunizations always update Spybot - Search & Destroy before Immunizing. Spybot - Search & Destroy FAQ

Check out Keeping Yourself Safe On The Web for tips and free tools to help keep you safe in the future.

Also see Slow Computer? It may not be Malware for free cleaning/maintenance tools to help keep your computer running smoothly.
Safe Surfing!

Computer Hope Forum

News:

Author Topic: Disappearing Programs Problems - Directed Here From Original Thread (Read 28060 times)

smbulger

smbulger

smbulger

smbulger

SuperDave

smbulger

SuperDave

smbulger

SuperDave

smbulger

SuperDave

smbulger

SuperDave

smbulger

smbulger

SuperDave

smbulger

SuperDave

smbulger

smbulger

SuperDave

smbulger

SuperDave