Solved Possible Mebroot bot/torpig infection.

[Resolved] Possible Mebroot bot/torpig infection.

First as a new member let me say Hi.

I seem to have a serious problem that I would like some help with, if possible.

I have recently received a message from my ISP saying that my computer has a possible infection of Mebroot bot/torpig
I have unfortunately got 3 laptops and a Media Centre connected to the system and therefore have little idea which M/C is the infected one. (although I have my suspicions) 3 of the m/c's are running Win7 (2 ultimate and 1 Home Premium) and one Win XP There is also an HP web connected printer on the wireless (home) network all connected by a D-Link Router.
I have downloaded and run Malwarebytes Full scan with the latest update on all 4 m/c's and it has found nothing.

Could someone please advise what I should do next.

Regards
Brian

 

Sorry, I thought I would say hello first and give a brief resume of my problem.
Here are the requested logs.

I did have a slight problem with disabling AVG as it will only allow you to suspend it for a max of 15 minutes so it probably started up again whilst MBRCheck was still running.

The logs have been generated from the laptop that I suspect most. As explained in my first post the problem could potentially be on any one of 4 machines.

MalwareBytes Log

Malwarebytes' Anti-Malware 1.50.1.1100
www.malwarebytes.org

Database version: 6716

Windows 6.1.7600
Internet Explorer 8.0.7600.16385

30/05/2011 07:34:03
mbam-log-2011-05-30 (07-34-03).txt

Scan type: Quick scan
Objects scanned: 171158
Time elapsed: 6 minute(s), 22 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

GMER Log

GMER 1.0.15.15640 - http://www.gmer.net
Rootkit scan 2011-05-30 08:21:39
Windows 6.1.7600 Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1 Hitachi_ rev.PB2O
Running: qlh4vt31.exe; Driver: C:\Users\Brian\AppData\Local\Temp\pwlcifow.sys


---- System - GMER 1.0.15 ----

SSDT \SystemRoot\system32\DRIVERS\AVGIDSShim.Sys (IDS Application Activity Monitor Loader Driver./AVG Technologies CZ, s.r.o. ) ZwOpenProcess [0x9A56E7A0]
SSDT \SystemRoot\system32\DRIVERS\AVGIDSShim.Sys (IDS Application Activity Monitor Loader Driver./AVG Technologies CZ, s.r.o. ) ZwTerminateProcess [0x9A56E848]
SSDT \SystemRoot\system32\DRIVERS\AVGIDSShim.Sys (IDS Application Activity Monitor Loader Driver./AVG Technologies CZ, s.r.o. ) ZwTerminateThread [0x9A56E8E4]
SSDT \SystemRoot\system32\DRIVERS\AVGIDSShim.Sys (IDS Application Activity Monitor Loader Driver./AVG Technologies CZ, s.r.o. ) ZwWriteVirtualMemory [0x9A56E980]

---- Kernel code sections - GMER 1.0.15 ----

.text ntkrnlpa.exe!ZwSaveKeyEx + 13AD 82E56599 1 Byte [06]
.text ntkrnlpa.exe!KiDispatchInterrupt + 5A2 82E7AF52 19 Bytes [E0, 0F, BA, F0, 07, 73, 09, ...] {LOOPNZ 0x11; MOV EDX, 0x97307f0; MOV CR4, EAX; OR AL, 0x80; MOV CR4, EAX; RET ; MOV ECX, CR3}
.text ntkrnlpa.exe!RtlSidHashLookup + 4E8 82E829F8 4 Bytes [A0, E7, 56, 9A]
.text ntkrnlpa.exe!RtlSidHashLookup + 7B8 82E82CC8 8 Bytes [48, E8, 56, 9A, E4, E8, 56, ...]
.text ntkrnlpa.exe!RtlSidHashLookup + 82C 82E82D3C 4 Bytes [80, E9, 56, 9A]
PAGE peauth.sys 9BC45BF5 102 Bytes JMP C3826B5A
PAGE peauth.sys 9BC45E20 101 Bytes JMP DDFAE422
PAGE peauth.sys 9BC4602C 102 Bytes JMP 8577158A

---- User code sections - GMER 1.0.15 ----

.text C:\Program Files\Mozilla Firefox\firefox.exe[4596] ntdll.dll!LdrLoadDll 77B6F625 5 Bytes JMP 010C1410 C:\Program Files\Mozilla Firefox\firefox.exe (Firefox/Mozilla Corporation)

---- User IAT/EAT - GMER 1.0.15 ----

IAT C:\Program Files\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe[1588] @ C:\Windows\system32\SHELL32.dll [USER32.dll!ExitWindowsEx] [00821210] C:\Program Files\NewTech Infosystems\Acer Backup Manager\Pehook.DLL (Backup Manager Module/NewTech Infosystems, Inc.)
IAT C:\Windows\Explorer.EXE[1592] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipAlloc] [73EC2494] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7600.16385_none_72fc7cbf861225ca\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[1592] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdiplusStartup] [73EA5624] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7600.16385_none_72fc7cbf861225ca\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[1592] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdiplusShutdown] [73EA56E2] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7600.16385_none_72fc7cbf861225ca\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[1592] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipFree] [73EC250F] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7600.16385_none_72fc7cbf861225ca\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[1592] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipDeleteGraphics] [73EB8573] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7600.16385_none_72fc7cbf861225ca\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[1592] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipDisposeImage] [73EB4D27] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7600.16385_none_72fc7cbf861225ca\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[1592] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipGetImageWidth] [73EB50CE] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7600.16385_none_72fc7cbf861225ca\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[1592] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipGetImageHeight] [73EB51A3] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7600.16385_none_72fc7cbf861225ca\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[1592] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipCreateBitmapFromHBITMAP] [73EB66D0] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7600.16385_none_72fc7cbf861225ca\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[1592] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipCreateFromHDC] [73EB82CA] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7600.16385_none_72fc7cbf861225ca\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[1592] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipSetCompositingMode] [73EB8819] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7600.16385_none_72fc7cbf861225ca\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[1592] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipSetInterpolationMode] [73EB907A] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7600.16385_none_72fc7cbf861225ca\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[1592] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipDrawImageRectI] [73EBE21D] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7600.16385_none_72fc7cbf861225ca\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[1592] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipCloneImage] [73EB4C59] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7600.16385_none_72fc7cbf861225ca\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Program Files\uTorrent\uTorrent.exe[2956] @ C:\Windows\system32\ADVAPI32.dll [KERNEL32.dll!GetProcAddress] [753F5E25] C:\Windows\system32\apphelp.dll (Application Compatibility Client Library/Microsoft Corporation)
IAT C:\Program Files\uTorrent\uTorrent.exe[2956] @ C:\Windows\system32\GDI32.dll [KERNEL32.dll!GetProcAddress] [753F5E25] C:\Windows\system32\apphelp.dll (Application Compatibility Client Library/Microsoft Corporation)
IAT C:\Program Files\uTorrent\uTorrent.exe[2956] @ C:\Windows\system32\USER32.dll [KERNEL32.dll!GetProcAddress] [753F5E25] C:\Windows\system32\apphelp.dll (Application Compatibility Client Library/Microsoft Corporation)
IAT C:\Program Files\uTorrent\uTorrent.exe[2956] @ C:\Windows\system32\SHLWAPI.dll [KERNEL32.dll!GetProcAddress] [753F5E25] C:\Windows\system32\apphelp.dll (Application Compatibility Client Library/Microsoft Corporation)
IAT C:\Program Files\uTorrent\uTorrent.exe[2956] @ C:\Windows\system32\CRYPT32.dll [KERNEL32.dll!GetProcAddress] [753F5E25] C:\Windows\system32\apphelp.dll (Application Compatibility Client Library/Microsoft Corporation)
IAT C:\Program Files\uTorrent\uTorrent.exe[2956] @ C:\Windows\system32\WININET.dll [KERNEL32.dll!GetProcAddress] [753F5E25] C:\Windows\system32\apphelp.dll (Application Compatibility Client Library/Microsoft Corporation)
IAT C:\Program Files\Acer\Acer PowerSmart Manager\ePowerTray.exe[4872] @ C:\Windows\system32\USER32.dll [KERNEL32.dll!GetProcAddress] [753F5E25] C:\Windows\system32\apphelp.dll (Application Compatibility Client Library/Microsoft Corporation)
IAT C:\Program Files\Acer\Acer PowerSmart Manager\ePowerTray.exe[4872] @ C:\Windows\system32\GDI32.dll [KERNEL32.dll!GetProcAddress] [753F5E25] C:\Windows\system32\apphelp.dll (Application Compatibility Client Library/Microsoft Corporation)
IAT C:\Program Files\Acer\Acer PowerSmart Manager\ePowerTray.exe[4872] @ C:\Windows\system32\ADVAPI32.dll [KERNEL32.dll!GetProcAddress] [753F5E25] C:\Windows\system32\apphelp.dll (Application Compatibility Client Library/Microsoft Corporation)
IAT C:\Program Files\Acer\Acer PowerSmart Manager\ePowerTray.exe[4872] @ C:\Windows\system32\SHLWAPI.dll [KERNEL32.dll!GetProcAddress] [753F5E25] C:\Windows\system32\apphelp.dll (Application Compatibility Client Library/Microsoft Corporation)

---- Devices - GMER 1.0.15 ----

AttachedDevice \FileSystem\Ntfs \Ntfs AVGIDSFilter.Sys (IDS Application Activity Monitor Filter Driver./AVG Technologies CZ, s.r.o. )

---- Registry - GMER 1.0.15 ----

Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\000b0d4b764f
Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\000b0d4b764f@0023d6400172 0xB0 0xE2 0xC6 0x02 ...
Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\00116758b1e2
Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\00116758b1e2@0023d7d292ab 0xE0 0x6F 0xF2 0x9F ...
Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\000b0d4b764f (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\000b0d4b764f@0023d6400172 0xB0 0xE2 0xC6 0x02 ...
Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\00116758b1e2 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\00116758b1e2@0023d7d292ab 0xE0 0x6F 0xF2 0x9F ...

---- EOF - GMER 1.0.15 ----

 

The next 3 requested logs

MBRCheck log

MBRCheck, version 1.2.3
(c) 2010, AD

Command-line:
Windows Version: Windows 7 Home Premium Edition
Windows Information: (build 7600), 32-bit
Base Board Manufacturer: Acer
BIOS Manufacturer: INSYDE
System Manufacturer: Acer
System Product Name: Aspire 5410
Logical Drives Mask: 0x00000014

Kernel Drivers (total 163):
0x82E13000 \SystemRoot\system32\ntkrnlpa.exe
0x83223000 \SystemRoot\system32\halmacpi.dll
0x80B9D000 \SystemRoot\system32\kdcom.dll
0x8AC3D000 \SystemRoot\system32\mcupdate_GenuineIntel.dll
0x8ACB5000 \SystemRoot\system32\PSHED.dll
0x8ACC6000 \SystemRoot\system32\BOOTVID.dll
0x8ACCE000 \SystemRoot\system32\CLFS.SYS
0x8AD10000 \SystemRoot\system32\CI.dll
0x8AE02000 \SystemRoot\system32\drivers\Wdf01000.sys
0x8AE73000 \SystemRoot\system32\drivers\WDFLDR.SYS
0x8AE81000 \SystemRoot\system32\DRIVERS\ACPI.sys
0x8AEC9000 \SystemRoot\system32\DRIVERS\WMILIB.SYS
0x8AED2000 \SystemRoot\system32\DRIVERS\msisadrv.sys
0x8AEDA000 \SystemRoot\system32\DRIVERS\pci.sys
0x8AF04000 \SystemRoot\system32\DRIVERS\vdrvroot.sys
0x8AF0F000 \SystemRoot\System32\drivers\partmgr.sys
0x8AF20000 \SystemRoot\system32\DRIVERS\volmgr.sys
0x8AF30000 \SystemRoot\System32\drivers\volmgrx.sys
0x8AF7B000 \SystemRoot\system32\DRIVERS\compbatt.sys
0x8AF83000 \SystemRoot\system32\DRIVERS\BATTC.SYS
0x8AF8E000 \SystemRoot\System32\drivers\mountmgr.sys
0x8B019000 \SystemRoot\system32\DRIVERS\iaStor.sys
0x8B0F3000 \SystemRoot\system32\DRIVERS\amdxata.sys
0x8B0FC000 \SystemRoot\system32\drivers\fltmgr.sys
0x8B130000 \SystemRoot\system32\drivers\fileinfo.sys
0x8B141000 \SystemRoot\System32\Drivers\PxHelp20.sys
0x8B222000 \SystemRoot\System32\Drivers\Ntfs.sys
0x8B351000 \SystemRoot\System32\Drivers\msrpc.sys
0x8B37C000 \SystemRoot\System32\Drivers\ksecdd.sys
0x8B38F000 \SystemRoot\System32\Drivers\cng.sys
0x8B3EC000 \SystemRoot\System32\drivers\pcw.sys
0x8B200000 \SystemRoot\System32\Drivers\Fs_Rec.sys
0x8B432000 \SystemRoot\system32\drivers\ndis.sys
0x8B4E9000 \SystemRoot\system32\drivers\NETIO.SYS
0x8B527000 \SystemRoot\System32\Drivers\ksecpkg.sys
0x8B63D000 \SystemRoot\System32\drivers\tcpip.sys
0x8B786000 \SystemRoot\System32\drivers\fwpkclnt.sys
0x8B7B7000 \SystemRoot\system32\DRIVERS\volsnap.sys
0x8B7F6000 \SystemRoot\System32\Drivers\spldr.sys
0x8B600000 \SystemRoot\System32\drivers\rdyboost.sys
0x8B62D000 \SystemRoot\System32\Drivers\mup.sys
0x8B54C000 \SystemRoot\System32\drivers\hwpolicy.sys
0x8B554000 \SystemRoot\System32\DRIVERS\fvevol.sys
0x8B586000 \SystemRoot\system32\DRIVERS\disk.sys
0x8B597000 \SystemRoot\system32\DRIVERS\CLASSPNP.SYS
0x8B5BC000 \SystemRoot\system32\DRIVERS\avgrkx86.sys
0x8B5C3000 \SystemRoot\system32\DRIVERS\AVGIDSEH.Sys
0x90B05000 \SystemRoot\system32\DRIVERS\cdrom.sys
0x90B24000 \SystemRoot\system32\DRIVERS\avgmfx86.sys
0x90B30000 \SystemRoot\System32\Drivers\Null.SYS
0x90B37000 \SystemRoot\System32\Drivers\Beep.SYS
0x90B3E000 \SystemRoot\System32\drivers\vga.sys
0x90B4A000 \SystemRoot\System32\drivers\VIDEOPRT.SYS
0x90B6B000 \SystemRoot\System32\drivers\watchdog.sys
0x90B78000 \SystemRoot\System32\DRIVERS\RDPCDD.sys
0x90B80000 \SystemRoot\system32\drivers\rdpencdd.sys
0x90B88000 \SystemRoot\system32\drivers\rdprefmp.sys
0x90B90000 \SystemRoot\System32\Drivers\Msfs.SYS
0x90B9B000 \SystemRoot\System32\Drivers\Npfs.SYS
0x90BA9000 \SystemRoot\system32\DRIVERS\tdx.sys
0x90BC0000 \SystemRoot\system32\DRIVERS\TDI.SYS
0x8B14B000 \SystemRoot\system32\DRIVERS\avgtdix.sys
0x90BCB000 \SystemRoot\System32\DRIVERS\netbt.sys
0x8B192000 \SystemRoot\system32\drivers\afd.sys
0x90A00000 \SystemRoot\system32\DRIVERS\wfplwf.sys
0x8B5D4000 \SystemRoot\system32\DRIVERS\pacer.sys
0x90A07000 \SystemRoot\system32\DRIVERS\vwififlt.sys
0x8B400000 \SystemRoot\system32\DRIVERS\netbios.sys
0x8B40E000 \SystemRoot\System32\Drivers\StarOpen.SYS
0x8B414000 \SystemRoot\system32\DRIVERS\wanarp.sys
0x8B209000 \SystemRoot\system32\DRIVERS\termdd.sys
0x8AFA4000 \SystemRoot\system32\DRIVERS\rdbss.sys
0x8B427000 \SystemRoot\system32\drivers\nsiproxy.sys
0x8B5F3000 \SystemRoot\system32\DRIVERS\mssmbios.sys
0x8B1EC000 \SystemRoot\System32\drivers\discache.sys
0x8B000000 \SystemRoot\System32\Drivers\dfsc.sys
0x8AFE5000 \SystemRoot\system32\DRIVERS\blbdrive.sys
0x8ADBB000 \SystemRoot\system32\DRIVERS\avgldx86.sys
0x8AC00000 \SystemRoot\system32\DRIVERS\tunnel.sys
0x8AC21000 \SystemRoot\system32\DRIVERS\intelppm.sys
0x9160F000 \SystemRoot\system32\DRIVERS\igdkmd32.sys
0x91C36000 \SystemRoot\System32\drivers\dxgkrnl.sys
0x91CED000 \SystemRoot\System32\drivers\dxgmms1.sys
0x91D26000 \SystemRoot\system32\DRIVERS\usbuhci.sys
0x91D31000 \SystemRoot\system32\DRIVERS\USBPORT.SYS
0x91D7C000 \SystemRoot\system32\DRIVERS\usbehci.sys
0x91D8B000 \SystemRoot\system32\DRIVERS\HDAudBus.sys
0x91DAA000 \SystemRoot\system32\DRIVERS\L1C62x86.sys
0x90428000 \SystemRoot\system32\DRIVERS\athr.sys
0x90555000 \SystemRoot\system32\DRIVERS\vwifibus.sys
0x9055F000 \SystemRoot\system32\DRIVERS\i8042prt.sys
0x90577000 \SystemRoot\system32\DRIVERS\DKbFltr.sys
0x90581000 \SystemRoot\system32\DRIVERS\kbdclass.sys
0x9058E000 \SystemRoot\system32\DRIVERS\SynTP.sys
0x905BF000 \SystemRoot\system32\DRIVERS\USBD.SYS
0x905C1000 \SystemRoot\system32\DRIVERS\mouclass.sys
0x905CE000 \SystemRoot\system32\DRIVERS\CmBatt.sys
0x905D2000 \??\C:\Windows\system32\drivers\UBHelper.sys
0x905DA000 \??\C:\Windows\system32\drivers\NTIDrvr.sys
0x905E2000 \SystemRoot\system32\DRIVERS\GEARAspiWDM.sys
0x905E8000 \SystemRoot\system32\DRIVERS\wmiacpi.sys
0x905F1000 \SystemRoot\system32\DRIVERS\CompositeBus.sys
0x91DBC000 \SystemRoot\system32\drivers\windrvr6.sys
0x90408000 \SystemRoot\system32\DRIVERS\AgileVpn.sys
0x91025000 \SystemRoot\system32\DRIVERS\rasl2tp.sys
0x9103D000 \SystemRoot\system32\DRIVERS\ndistapi.sys
0x91048000 \SystemRoot\system32\DRIVERS\ndiswan.sys
0x9106A000 \SystemRoot\system32\DRIVERS\raspppoe.sys
0x91082000 \SystemRoot\system32\DRIVERS\raspptp.sys
0x91099000 \SystemRoot\system32\DRIVERS\rassstp.sys
0x910B0000 \SystemRoot\system32\DRIVERS\taphss.sys
0x910B7000 \SystemRoot\system32\DRIVERS\swenum.sys
0x910B9000 \SystemRoot\system32\DRIVERS\ks.sys
0x910ED000 \SystemRoot\system32\DRIVERS\umbus.sys
0x910FB000 \SystemRoot\system32\DRIVERS\usbhub.sys
0x9113F000 \SystemRoot\System32\Drivers\NDProxy.SYS
0x9243F000 \SystemRoot\system32\drivers\RTKVHDA.sys
0x926DC000 \SystemRoot\system32\drivers\portcls.sys
0x9270B000 \SystemRoot\system32\drivers\drmk.sys
0x92724000 \SystemRoot\system32\drivers\IntcHdmi.sys
0x92745000 \SystemRoot\System32\Drivers\fastfat.SYS
0x9276F000 \SystemRoot\system32\DRIVERS\usbccgp.sys
0x92786000 \SystemRoot\System32\Drivers\usbvideo.sys
0x927AA000 \SystemRoot\system32\DRIVERS\cdfs.sys
0x927C0000 \SystemRoot\System32\Drivers\crashdmp.sys
0x90A18000 \SystemRoot\System32\Drivers\dump_iaStor.sys
0x927CD000 \SystemRoot\System32\Drivers\dump_dumpfve.sys
0x97E50000 \SystemRoot\System32\win32k.sys
0x927DE000 \SystemRoot\System32\drivers\Dxapi.sys
0x927E8000 \SystemRoot\system32\DRIVERS\monitor.sys
0x980B0000 \SystemRoot\System32\TSDDD.dll
0x980E0000 \SystemRoot\System32\cdd.dll
0x92400000 \SystemRoot\system32\drivers\luafv.sys
0x9241B000 \SystemRoot\system32\drivers\WudfPf.sys
0x91150000 \SystemRoot\system32\DRIVERS\irda.sys
0x9116E000 \SystemRoot\system32\DRIVERS\lltdio.sys
0x9117E000 \SystemRoot\system32\DRIVERS\nwifi.sys
0x911C4000 \SystemRoot\system32\DRIVERS\ndisuio.sys
0x911D4000 \SystemRoot\system32\DRIVERS\rspndr.sys
0x92435000 \SystemRoot\system32\DRIVERS\vwifimp.sys
0x9A42C000 \SystemRoot\system32\drivers\HTTP.sys
0x9A4B1000 \SystemRoot\system32\DRIVERS\bowser.sys
0x9A4CA000 \SystemRoot\System32\drivers\mpsdrv.sys
0x9A4DC000 \SystemRoot\system32\DRIVERS\mrxsmb.sys
0x9A4FF000 \SystemRoot\system32\DRIVERS\mrxsmb10.sys
0x9A53A000 \SystemRoot\system32\DRIVERS\mrxsmb20.sys
0x9A56D000 \SystemRoot\system32\DRIVERS\AVGIDSShim.Sys
0x9BC3A000 \SystemRoot\system32\drivers\peauth.sys
0x9BCD1000 \??\C:\Windows\system32\Drivers\SBKUPNT.SYS
0x9BCD5000 \SystemRoot\System32\Drivers\secdrv.SYS
0x9BCDF000 \SystemRoot\System32\DRIVERS\srvnet.sys
0x9BD00000 \SystemRoot\System32\drivers\tcpipreg.sys
0x9BD0D000 \SystemRoot\system32\DRIVERS\AVGIDSFilter.Sys
0x9BD12000 \SystemRoot\System32\DRIVERS\srv2.sys
0x9BD61000 \SystemRoot\system32\DRIVERS\AVGIDSDriver.Sys
0x9BD81000 \SystemRoot\System32\DRIVERS\srv.sys
0x9BDD2000 \??\C:\Program Files\TuneUp Utilities 2011\TuneUpUtilitiesDriver32.sys
0x9BDD3000 \??\C:\Windows\system32\FsUsbExDisk.SYS
0x9BDDC000 \SystemRoot\system32\DRIVERS\asyncmac.sys
0x9BC00000 \??\C:\Users\Brian\AppData\Local\Temp\pwlcifow.sys
0x77B10000 \Windows\System32\ntdll.dll
0x47700000 \Windows\System32\smss.exe
0x77D50000 \Windows\System32\apisetschema.dll

Processes (total 94):
0 System Idle Process
4 SYSTEM
292 C:\Windows\System32\smss.exe
556 csrss.exe
612 C:\Windows\System32\wininit.exe
624 csrss.exe
680 C:\Windows\System32\winlogon.exe
708 C:\Windows\System32\services.exe
716 C:\Windows\System32\lsass.exe
724 C:\Windows\System32\lsm.exe
884 C:\Windows\System32\svchost.exe
956 C:\Windows\System32\svchost.exe
1004 C:\Windows\System32\svchost.exe
1096 C:\Windows\System32\svchost.exe
1144 C:\Windows\System32\svchost.exe
1280 C:\Windows\System32\svchost.exe
1420 C:\Windows\System32\svchost.exe
1540 C:\Windows\System32\dwm.exe
1592 C:\Windows\explorer.exe
1660 C:\Windows\System32\spoolsv.exe
1696 C:\Windows\System32\svchost.exe
1740 C:\Windows\System32\taskhost.exe
1852 C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
1892 C:\Program Files\AVG\AVG10\avgwdsvc.exe
1956 C:\Program Files\Bonjour\mDNSResponder.exe
1996 C:\Program Files\Launch Manager\dsiwmis.exe
2032 C:\Program Files\Acer\Acer PowerSmart Manager\ePowerSvc.exe
416 C:\Program Files\Expat Shield\bin\openvpnas.exe
832 C:\Program Files\Expat Shield\bin\hsswd.exe
1320 C:\Windows\System32\FsUsbExService.Exe
1352 C:\Windows\System32\svchost.exe
1332 C:\Windows\System32\svchost.exe
1588 C:\Program Files\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe
696 C:\Program Files\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe
540 C:\Program Files\Acer\Optical Drive Power Management\ODDPWRSvc.exe
508 C:\Windows\System32\svchost.exe
2052 C:\Program Files\Acer\Acer VCM\RS_Service.exe
2120 C:\Windows\System32\svchost.exe
2180 C:\Program Files\TuneUp Utilities 2011\TuneUpUtilitiesService32.exe
2256 C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTmon.exe
2420 C:\Program Files\TuneUp Utilities 2011\TuneUpUtilitiesApp32.exe
2772 C:\Windows\System32\svchost.exe
3188 C:\Windows\System32\svchost.exe
3568 C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
3964 C:\Program Files\Launch Manager\LManager.exe
3976 C:\Program Files\Acer\Optical Drive Power Management\ODDPWR.exe
3984 C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe
3992 C:\Windows\PLFSetI.exe
4000 C:\Windows\System32\igfxtray.exe
4012 C:\Windows\System32\hkcmd.exe
4020 C:\Windows\System32\igfxpers.exe
4032 C:\Program Files\AVG\AVG10\avgtray.exe
2508 C:\Windows\System32\wbem\unsecapp.exe
2612 C:\Windows\System32\igfxsrvc.exe
1908 C:\Program Files\iTunes\iTunesHelper.exe
1712 C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
2756 C:\Program Files\Windows Sidebar\sidebar.exe
2956 C:\Program Files\uTorrent\uTorrent.exe
2912 C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
3124 C:\Program Files\BBC iPlayer Desktop\BBC iPlayer Desktop.exe
3724 C:\Program Files\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSMonitor.exe
800 C:\Windows\System32\igfxext.exe
2896 WmiPrvSE.exe
4112 C:\Windows\System32\igfxsrvc.exe
4532 C:\Program Files\Common Files\HP\Digital Imaging\Bin\hpqPhotoCrm.exe
4640 C:\Program Files\Expat Shield\bin\openvpntray.exe
4872 C:\Program Files\Acer\Acer PowerSmart Manager\ePowerTray.exe
5008 C:\Windows\System32\igfxext.exe
5100 C:\Program Files\Acer\Acer PowerSmart Manager\ePowerEvent.exe
5124 C:\Program Files\HP\Digital Imaging\bin\hpqste08.exe
5264 C:\Program Files\HP\Digital Imaging\bin\hpqbam08.exe
5292 C:\Program Files\iPod\bin\iPodService.exe
5516 C:\Program Files\HP\Digital Imaging\bin\hpqgpc01.exe
3812 C:\Program Files\Windows Media Player\wmpnetwk.exe
4596 C:\Program Files\Mozilla Firefox\firefox.exe
564 C:\Windows\System32\wuauclt.exe
5536 C:\Program Files\AVG\AVG10\avgsrmax.exe
5284 C:\Windows\System32\notepad.exe
5496 hpqgpc01.exe
5164 hpqbam08.exe
6096 C:\Program Files\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSAgent.exe
3224 C:\Program Files\AVG\AVG10\avgemcx.exe
4664 C:\Program Files\AVG\AVG10\avgnsx.exe
5160 C:\PROGRA~1\AVG\AVG10\avgchsvx.exe
5628 C:\Windows\System32\conhost.exe
2188 C:\PROGRA~1\AVG\AVG10\avgrsx.exe
2640 C:\Program Files\AVG\AVG10\avgcsrvx.exe
5512 C:\Windows\System32\audiodg.exe
6032 C:\Windows\System32\notepad.exe
5212 C:\Windows\explorer.exe
3900 dllhost.exe
160 dllhost.exe
5340 C:\Users\Brian\Downloads\MBRCheck.exe
3660 C:\Windows\System32\conhost.exe

\\.\C: --> \\.\PhysicalDrive0 at offset 0x00000002`71100000 (NTFS)

PhysicalDrive0 Model Number: HitachiHTS545025B9A300, Rev: PB2OC60F

Size Device Name MBR Status
--------------------------------------------
232 GB \\.\PhysicalDrive0 Windows 7 MBR code detected
SHA1: 4379A3D43019B46FA357F7DD6A53B45A3CA8FB79


Done!

DDS.txt log

.
DDS (Ver_11-05-19.01) - NTFSx86
Internet Explorer: 8.0.7600.16385 BrowserJavaVersion: 1.6.0_22
Run by Brian at 8:27:04 on 2011-05-30
Microsoft Windows 7 Home Premium 6.1.7600.0.1252.44.1033.18.3002.1445 [GMT 3:00]
.
AV: AVG Anti-Virus Free Edition 2011 *Enabled/Updated* {5A2746B1-DEE9-F85A-FBCD-ADB11639C5F0}
SP: AVG Anti-Virus Free Edition 2011 *Enabled/Updated* {E146A755-F8D3-F7D4-C17D-96C36DBE8F4D}
SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
============== Running Processes ===============
.
C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\svchost.exe -k RPCSS
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Windows\system32\taskhost.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
C:\Program Files\AVG\AVG10\avgwdsvc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Launch Manager\dsiwmis.exe
C:\Program Files\Acer\Acer PowerSmart Manager\ePowerSvc.exe
C:\Program Files\Expat Shield\bin\openvpnas.exe
C:\Program Files\Expat Shield\bin\hsswd.exe
C:\Windows\system32\FsUsbExService.Exe
C:\Windows\system32\svchost.exe -k hpdevmgmt
C:\Windows\System32\svchost.exe -k HPZ12
C:\Program Files\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe
C:\Program Files\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe
C:\Program Files\Acer\Optical Drive Power Management\ODDPWRSvc.exe
C:\Windows\System32\svchost.exe -k HPZ12
C:\Program Files\Acer\Acer VCM\RS_Service.exe
C:\Windows\system32\svchost.exe -k imgsvc
C:\Program Files\TuneUp Utilities 2011\TuneUpUtilitiesService32.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMon.exe
C:\Program Files\TuneUp Utilities 2011\TuneUpUtilitiesApp32.exe
C:\Windows\system32\svchost.exe -k HPService
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
C:\Program Files\Launch Manager\LManager.exe
C:\Program Files\Acer\Optical Drive Power Management\ODDPWR.exe
C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe
C:\Windows\PLFSetI.exe
C:\Windows\System32\igfxtray.exe
C:\Windows\System32\igfxpers.exe
C:\Program Files\AVG\AVG10\avgtray.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\igfxsrvc.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\uTorrent\uTorrent.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\BBC iPlayer Desktop\BBC iPlayer Desktop.exe
C:\Program Files\AVG\AVG10\Identity Protection\agent\bin\avgidsmonitor.exe
C:\Windows\system32\igfxext.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\igfxsrvc.exe
C:\Program Files\Common Files\HP\Digital Imaging\Bin\hpqPhotoCrm.exe
C:\Program Files\Expat Shield\bin\openvpntray.exe
C:\Program Files\Acer\Acer PowerSmart Manager\ePowerTray.exe
C:\Windows\system32\igfxext.exe
C:\Program Files\Acer\Acer PowerSmart Manager\ePowerEvent.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\HP\Digital Imaging\bin\hpqbam08.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\HP\Digital Imaging\bin\hpqgpc01.exe
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Windows\system32\wuauclt.exe
C:\Program Files\AVG\AVG10\avgsrmax.exe
C:\Program Files\HP\Digital Imaging\bin\hpqgpc01.exe
C:\Program Files\HP\Digital Imaging\bin\hpqbam08.exe
C:\Program Files\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSAgent.exe
C:\Program Files\AVG\AVG10\avgemcx.exe
C:\Program Files\AVG\AVG10\avgnsx.exe
C:\Program Files\AVG\AVG10\avgchsvx.exe
C:\Windows\system32\conhost.exe
C:\Program Files\AVG\AVG10\avgrsx.exe
C:\Program Files\AVG\AVG10\avgcsrvx.exe
C:\Windows\explorer.exe
C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe
C:\Users\Brian\Downloads\dds.scr
C:\Windows\system32\WSCRIPT.exe
C:\Windows\system32\wbem\wmiprvse.exe
.
============== Pseudo HJT Report ===============
.
uDefault_Page_URL = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0809&s=2&o=vp32&d=0310&m=aspire_5410
uSearch Page = hxxp://www.google.com
uStart Page = hxxp://search.conduit.com?SearchSource=10&ctid=CT2786678
uSearch Bar = hxxp://www.google.com/ie
mDefault_Page_URL = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0809&s=2&o=vp32&d=0310&m=aspire_5410
mStart Page = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0809&s=2&o=vp32&d=0310&m=aspire_5410
uInternet Settings,ProxyOverride = *.local
uSearchURL,(Default) = hxxp://www.google.com/search/?q=%s
uURLSearchHooks: Expat Shield Toolbar: {a060276a-53be-45ec-8ebe-b94b1e803179} - c:\program files\expat_shield\tbExp0.dll
uURLSearchHooks: uTorrentBar Toolbar: {bf7380fa-e3b4-4db2-af3e-9d8783a45bfc} - c:\program files\utorrentbar\tbuTor.dll
mURLSearchHooks: Expat Shield Toolbar: {a060276a-53be-45ec-8ebe-b94b1e803179} - c:\program files\expat_shield\tbExp0.dll
mURLSearchHooks: uTorrentBar Toolbar: {bf7380fa-e3b4-4db2-af3e-9d8783a45bfc} - c:\program files\utorrentbar\tbuTor.dll
BHO: HP Print Enhancer: {0347c33e-8762-4905-bf09-768834316c61} - c:\program files\hp\digital imaging\smart web printing\hpswp_printenhancer.dll
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: Conduit Engine: {30f9b915-b755-4826-820b-08fba6bd249d} - c:\program files\conduitengine\ConduitEngine.dll
BHO: Expat Shield Class: {3706ee7c-3cad-445d-8a43-03ebc3b75908} - c:\program files\expat shield\hssie\ExpatIE.dll
BHO: AVG Safe Search: {3ca2f312-6f6e-4b53-a66e-4e65e497c8c0} - c:\program files\avg\avg10\avgssie.dll
BHO: Windows Live Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
BHO: Expat Shield Toolbar: {a060276a-53be-45ec-8ebe-b94b1e803179} - c:\program files\expat_shield\tbExp0.dll
BHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - c:\program files\google\google toolbar\GoogleToolbar_32.dll
BHO: Skype Plug-In: {ae805869-2e5c-4ed4-8f7b-f1f7851a4497} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll
BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - c:\program files\google\googletoolbarnotifier\5.6.5805.1910\swg.dll
BHO: uTorrentBar Toolbar: {bf7380fa-e3b4-4db2-af3e-9d8783a45bfc} - c:\program files\utorrentbar\tbuTor.dll
BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: HP Smart BHO Class: {ffffffff-cf4e-4f2b-bdc2-0e72e116a856} - c:\program files\hp\digital imaging\smart web printing\hpswp_BHO.dll
TB: Expat Shield Toolbar: {a060276a-53be-45ec-8ebe-b94b1e803179} - c:\program files\expat_shield\tbExp0.dll
TB: uTorrentBar Toolbar: {bf7380fa-e3b4-4db2-af3e-9d8783a45bfc} - c:\program files\utorrentbar\tbuTor.dll
TB: Conduit Engine: {30f9b915-b755-4826-820b-08fba6bd249d} - c:\program files\conduitengine\ConduitEngine.dll
TB: Google Toolbar: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program files\google\google toolbar\GoogleToolbar_32.dll
TB: {D4027C7F-154A-4066-A1AD-4243D8127440} - No File
EB: HP Smart Web Printing: {555d4d79-4bd2-4094-a395-cfc534424a05} - c:\program files\hp\digital imaging\smart web printing\hpswp_bho.dll
uRun: [swg] "c:\program files\google\googletoolbarnotifier\GoogleToolbarNotifier.exe "
uRun: [Sidebar] c:\program files\windows sidebar\sidebar.exe /autoRun
uRun: [uTorrent] "c:\program files\utorrent\uTorrent.exe "
mRun: [Acer ePower Management] c:\program files\acer\acer powersmart manager\ePowerTrayLauncher.exe
mRun: [IAAnotif] c:\program files\intel\intel matrix storage manager\iaanotif.exe
mRun: [LManager] c:\program files\launch manager\LManager.exe
mRun: [ODDPwr] "c:\program files\acer\optical drive power management\ODDPwr.exe "
mRun: [RtHDVCpl] c:\program files\realtek\audio\hda\RtHDVCpl.exe -s
mRun: [PLFSetI] c:\windows\PLFSetI.exe
mRun: [IgfxTray] c:\windows\system32\igfxtray.exe
mRun: [HotKeysCmds] c:\windows\system32\hkcmd.exe
mRun: [Persistence] c:\windows\system32\igfxpers.exe
mRun: [AVG_TRAY] c:\program files\avg\avg10\avgtray.exe
mRun: [<NO NAME>]
mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe "
mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe "
mRun: [B2C_AGENT] c:\programdata\lgmobileax\b2c_client\B2CNotiAgent.exe
mRun: [Malwarebytes' Anti-Malware (reboot)] "c:\program files\malwarebytes' anti-malware\mbam.exe" /runcleanupscript
mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe "
StartupFolder: c:\users\brian\appdata\roaming\micros~1\windows\startm~1\programs\startup\bbcipl~1.lnk - c:\program files\bbc iplayer desktop\BBC iPlayer Desktop.exe
StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\hpdigi~1.lnk - c:\program files\hp\digital imaging\bin\hpqtra08.exe
mPolicies-system: ConsentPromptBehaviorAdmin = 0 (0x0)
mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3)
mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
mPolicies-system: PromptOnSecureDesktop = 0 (0x0)
IE: E&xport to Microsoft Excel - c:\progra~1\micros~3\office12\EXCEL.EXE/3000
IE: Google Sidewiki... - c:\program files\google\google toolbar\component\GoogleToolbarDynamic_mui_en_E11712C84EA7E12B.dll/cmsidewiki.html
IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - c:\program files\windows live\writer\WriterBrowserExtension.dll
IE: {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~3\office11\REFIEBAR.DLL
IE: {DDE87865-83C5-48c4-8357-2F5B1AA84522} - {DDE87865-83C5-48c4-8357-2F5B1AA84522} - c:\program files\hp\digital imaging\smart web printing\hpswp_BHO.dll
DPF: {1C11B948-582A-433F-A98D-A8C4D5CC64F2} - hxxp://magnet.2020.net/virtualplanner/Core/Player/2020PlayerAX_Win32.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab
DPF: {F27237D7-93C8-44C2-AC6E-D6057B9A918F} - hxxps://juniper.net/dana-cached/sc/JuniperSetupClient.cab
TCP: {FDF2F20C-A723-4070-95F2-77AF65C46B4B} = 10.201.56.1
Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - c:\program files\avg\avg10\avgpp.dll
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~1\common~1\skype\SKYPE4~1.DLL
Notify: igfxcui - igfxdev.dll
.
================= FIREFOX ===================
.
FF - ProfilePath - c:\users\brian\appdata\roaming\mozilla\firefox\profiles\1cb9zoqr.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2786678&SearchSource=3&q={searchTerms}
FF - prefs.js: browser.startup.homepage - hxxp://www.google.co.uk/
FF - prefs.js: keyword.URL - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2786678&q=
FF - component: c:\program files\avg\avg10\firefox4\components\avgssff4.dll
FF - component: c:\program files\mozilla firefox\extensions\{ab2ce124-6272-4b12-94a9-7303c7397bd1}\components\SkypeFfComponent.dll
FF - component: c:\users\brian\appdata\roaming\mozilla\firefox\profiles\1cb9zoqr.default\extensions\{a060276a-53be-45ec-8ebe-b94b1e803179}\components\RadioWMPCoreGecko19.dll
FF - component: c:\users\brian\appdata\roaming\mozilla\firefox\profiles\1cb9zoqr.default\extensions\{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}\components\RadioWMPCoreGecko19.dll
FF - component: c:\users\brian\appdata\roaming\mozilla\firefox\profiles\1cb9zoqr.default\extensions\engine@conduit.com\components\RadioWMPCoreGecko19.dll
FF - plugin: c:\program files\google\google earth\plugin\npgeplugin.dll
FF - plugin: c:\program files\google\update\1.3.21.53\npGoogleUpdate3.dll
FF - plugin: c:\program files\java\jre6\bin\new_plugin\npdeployJava1.dll
FF - plugin: c:\program files\microsoft silverlight\4.0.60310.0\npctrlui.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npCouponPrinter.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npdeployJava1.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npMozCouponPrinter.dll
FF - plugin: c:\program files\windows live\photo gallery\NPWLPG.dll
FF - plugin: c:\users\brian\appdata\roaming\mozilla\firefox\profiles\1cb9zoqr.default\extensions\2020player@2020technologies.com\plugins\NP2020Player.dll
FF - plugin: c:\users\brian\appdata\roaming\mozilla\firefox\profiles\1cb9zoqr.default\extensions\ietab@ip.cn\plugins\npCoralIETab.dll
.
---- FIREFOX POLICIES ----
FF - user.js: network.http.max-persistent-connections-per-server - 4
FF - user.js: nglayout.initialpaint.delay - 600
FF - user.js: content.notify.interval - 600000
FF - user.js: content.max.tokenizing.time - 1800000
FF - user.js: content.switch.threshold - 600000
.
============= SERVICES / DRIVERS ===============
.
R0 AVGIDSEH;AVGIDSEH;c:\windows\system32\drivers\AVGIDSEH.sys [2011-2-22 22992]
R0 Avgrkx86;AVG Anti-Rootkit Driver;c:\windows\system32\drivers\avgrkx86.sys [2011-3-16 32592]
R1 Avgldx86;AVG AVI Loader Driver;c:\windows\system32\drivers\avgldx86.sys [2011-1-7 248656]
R1 Avgmfx86;AVG Mini-Filter Resident Anti-Virus Shield;c:\windows\system32\drivers\avgmfx86.sys [2011-3-1 34896]
R1 Avgtdix;AVG TDI Driver;c:\windows\system32\drivers\avgtdix.sys [2011-4-5 297168]
R1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\drivers\vwififlt.sys [2009-7-14 48128]
R2 AVGIDSAgent;AVGIDSAgent;c:\program files\avg\avg10\identity protection\agent\bin\AVGIDSAgent.exe [2011-4-18 7398752]
R2 avgwd;AVG WatchDog;c:\program files\avg\avg10\avgwdsvc.exe [2011-2-8 269520]
R2 DsiWMIService;Dritek WMI Service;c:\program files\launch manager\dsiwmis.exe [2010-3-15 117256]
R2 ePowerSvc;Acer ePower Service;c:\program files\acer\acer powersmart manager\ePowerSvc.exe [2010-3-15 688128]
R2 ExpatShieldService;Expat Shield Service;c:\program files\expat shield\bin\openvpnas.exe [2010-5-6 248368]
R2 ExpatWd;Expat Shield Monitoring Service;c:\program files\expat shield\bin\hsswd.exe -product expat --> c:\program files\expat shield\bin\hsswd.exe -product Expat [?]
R2 FsUsbExService;FsUsbExService;c:\windows\system32\FsUsbExService.Exe [2011-1-30 238952]
R2 NTI IScheduleSvc;NTI IScheduleSvc;c:\program files\newtech infosystems\acer backup manager\IScheduleSvc.exe [2009-5-26 62208]
R2 NTISchedulerSvc;NTI Backup Now 5 Scheduler Service;c:\program files\newtech infosystems\nti backup now 5\SchedulerSvc.exe [2008-9-23 144632]
R2 ODDPwrSvc;Acer ODD Power Service;c:\program files\acer\optical drive power management\ODDPWRSvc.exe [2010-3-15 125472]
R2 RS_Service;Raw Socket Service;c:\program files\acer\acer vcm\RS_Service.exe [2010-3-15 237568]
R2 SBKUPNT;SBKUPNT;c:\windows\system32\drivers\SBKUPNT.SYS [2011-4-15 14976]
R2 TuneUp.UtilitiesSvc;TuneUp Utilities Service;c:\program files\tuneup utilities 2011\TuneUpUtilitiesService32.exe [2010-10-27 1483072]
R3 AVGIDSDriver;AVGIDSDriver;c:\windows\system32\drivers\AVGIDSDriver.sys [2011-4-14 134480]
R3 AVGIDSFilter;AVGIDSFilter;c:\windows\system32\drivers\AVGIDSFilter.sys [2011-2-10 24144]
R3 AVGIDSShim;AVGIDSShim;c:\windows\system32\drivers\AVGIDSShim.sys [2011-2-10 21968]
R3 FsUsbExDisk;FsUsbExDisk;c:\windows\system32\FsUsbExDisk.Sys [2011-1-30 36608]
R3 IntcHdmiAddService;Intel(R) High Definition Audio HDMI;c:\windows\system32\drivers\IntcHdmi.sys [2010-3-15 112640]
R3 L1C;NDIS Miniport Driver for Atheros AR813x/AR815x PCI-E Ethernet Controller;c:\windows\system32\drivers\L1C62x86.sys [2009-11-13 58368]
R3 TuneUpUtilitiesDrv;TuneUpUtilitiesDrv;c:\program files\tuneup utilities 2011\TuneUpUtilitiesDriver32.sys [2010-10-7 10064]
R3 vwifimp;Microsoft Virtual WiFi Miniport Service;c:\windows\system32\drivers\vwifimp.sys [2009-7-14 14336]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]
S2 gupdate;Google Update Service (gupdate);c:\program files\google\update\GoogleUpdate.exe [2010-3-15 135664]
S3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0;c:\windows\system32\drivers\b57nd60x.sys [2009-7-14 229888]
S3 btusbflt;Bluetooth USB Filter;c:\windows\system32\drivers\btusbflt.sys [2010-4-14 45736]
S3 ExpatTrayService;Expat Shield Tray Service;c:\program files\expat shield\bin\ExpatTrayService.exe [2010-5-6 54516]
S3 FlashUSB;FlashUSB;c:\windows\system32\drivers\FlashUSB.sys [2011-1-21 16896]
S3 gupdatem;Google Update Service (gupdatem);c:\program files\google\update\GoogleUpdate.exe [2010-3-15 135664]
S3 NTIBackupSvc;NTI Backup Now 5 Backup Service;c:\program files\newtech infosystems\nti backup now 5\BackupSvc.exe [2008-9-23 50424]
S3 usb2vcom;USB to Serial Bridge Controller;c:\windows\system32\drivers\usb2vcom.sys [2010-8-14 28928]
S3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\wat\WatAdminSvc.exe [2010-5-20 1343400]
S4 Raisngsvc;Raisngsvc; [x]
.
=============== Created Last 30 ================
.
2011-05-26 10:47:33 -------- d-----w- c:\program files\iPod
2011-05-26 10:47:32 -------- d-----w- c:\program files\iTunes
2011-05-26 10:44:16 -------- d-----w- c:\program files\Bonjour
2011-05-26 06:22:09 -------- d-----w- c:\program files\BBC iPlayer Desktop
2011-05-26 06:01:38 276992 ----a-w- c:\windows\system32\wcncsvc.dll
2011-05-15 19:14:10 781272 ----a-w- c:\program files\mozilla firefox\mozsqlite3.dll
2011-05-15 19:14:09 89048 ----a-w- c:\program files\mozilla firefox\libEGL.dll
2011-05-15 19:14:09 465880 ----a-w- c:\program files\mozilla firefox\libGLESv2.dll
2011-05-15 19:14:09 1874904 ----a-w- c:\program files\mozilla firefox\mozjs.dll
2011-05-15 19:14:09 15832 ----a-w- c:\program files\mozilla firefox\mozalloc.dll
2011-05-15 19:14:08 1974616 ----a-w- c:\program files\mozilla firefox\D3DCompiler_42.dll
2011-05-15 19:14:08 1892184 ----a-w- c:\program files\mozilla firefox\d3dx9_42.dll
2011-05-15 19:14:08 142296 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll
2011-05-13 08:32:27 -------- d-----w- c:\users\brian\appdata\roaming\GPS Utility
2011-05-13 08:31:57 -------- d-----w- c:\program files\GPS Utility
2011-05-13 08:24:05 -------- d-----w- c:\users\brian\appdata\local\TopoGrafix
2011-05-13 08:24:04 -------- d-----w- c:\program files\EasyGPS
2011-05-13 07:51:33 35892 ----a-w- c:\windows\system32\SER9PL.sys
2011-05-13 07:51:33 26719 ----a-w- c:\windows\system32\SERSPL.VXD
2011-05-12 13:11:31 -------- d-----w- c:\users\brian\appdata\roaming\Malwarebytes
2011-05-12 12:47:41 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2011-05-12 12:47:40 -------- d-----w- c:\programdata\Malwarebytes
2011-05-12 12:47:37 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
2011-05-12 12:47:37 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2011-05-10 20:22:23 2331136 ----a-w- c:\windows\system32\win32k.sys
2011-05-06 04:46:08 -------- d-----w- c:\program files\SoundTells
.
==================== Find3M ====================
.
2024-03-21 09:44:18 246272 ----a-w- c:\windows\UNINST16.EXE
2011-04-14 18:28:30 134480 ----a-w- c:\windows\system32\drivers\AVGIDSDriver.sys
2011-04-06 13:20:16 91424 ----a-w- c:\windows\system32\dnssd.dll
2011-04-06 13:20:16 107808 ----a-w- c:\windows\system32\dns-sd.exe
2011-04-04 21:59:56 297168 ----a-w- c:\windows\system32\drivers\avgtdix.sys
2011-03-18 10:46:26 61704 ----a-w- c:\windows\system32\drivers\ftdibus.sys
2011-03-18 10:46:24 203144 ----a-w- c:\windows\system32\ftd2xx.dll
2011-03-18 10:46:16 69000 ----a-w- c:\windows\system32\ftcserco.dll
2011-03-18 10:46:16 105352 ----a-w- c:\windows\system32\ftbusui.dll
2011-03-18 10:46:10 73096 ----a-w- c:\windows\system32\drivers\ftser2k.sys
2011-03-18 10:46:10 201096 ----a-w- c:\windows\system32\FTLang.dll
2011-03-18 10:46:04 52616 ----a-w- c:\windows\system32\ftserui2.dll
2011-03-16 13:03:20 32592 ----a-w- c:\windows\system32\drivers\avgrkx86.sys
.
============= FINISH: 8:28:10.40 ===============


Attach.log

.
UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT
.
DDS (Ver_11-05-19.01)
.
Microsoft Windows 7 Home Premium
Boot Device: \Device\HarddiskVolume2
Install Date: 15/03/2010 14:16:08
System Uptime: 30/05/2011 07:12:32 (1 hours ago)
.
Motherboard: Acer | | Aspire 5410
Processor: Intel(R) Celeron(R) CPU 723 @ 1.20GHz | CPU | 1197/800mhz
.
==== Disk Partitions =========================
.
C: is FIXED (NTFS) - 223 GiB total, 96.172 GiB free.
E: is CDROM (CDFS)
.
==== Disabled Device Manager Items =============
.
Class GUID: {4d36e971-e325-11ce-bfc1-08002be10318}
Description: Deskjet D5500 series
Device ID: ROOT\MULTIFUNCTION\0000
Manufacturer: HP
Name: Deskjet D5500 series
PNP Device ID: ROOT\MULTIFUNCTION\0000
Service:
.
Class GUID: {4d36e971-e325-11ce-bfc1-08002be10318}
Description: Photosmart B110 series
Device ID: ROOT\MULTIFUNCTION\0001
Manufacturer: HP
Name: Photosmart B110 series
PNP Device ID: ROOT\MULTIFUNCTION\0001
Service:
.
==== System Restore Points ===================
.
RP162: 28/03/2011 00:00:16 - Scheduled Checkpoint
RP163: 06/04/2011 09:55:11 - Scheduled Checkpoint
RP164: 15/04/2011 11:35:13 - Scheduled Checkpoint
RP165: 23/04/2011 10:23:12 - Scheduled Checkpoint
RP166: 02/05/2011 08:29:50 - Scheduled Checkpoint
RP167: 10/05/2011 18:48:28 - Scheduled Checkpoint
RP169: 13/05/2011 10:51:13 - Installed PL-2303 USB-to-Serial
RP170: 14/05/2011 14:10:07 - Windows Update
RP171: 22/05/2011 07:25:14 - Installed AVG 2011
RP172: 26/05/2011 09:01:12 - Windows Update
.
==== Installed Programs ======================
.
32 Bit HP CIO Components Installer
Acer Backup Manager
Acer Crystal Eye Webcam
Acer Crystal Eye webcam Ver:1.1.92.624
Acer GridVista
Acer PowerSmart Manager
Acer Product Registration
Acer ScreenSaver
Acer VCM
Acrobat.com
Adobe AIR
Adobe Flash Player 10 ActiveX
Adobe Flash Player 10 Plugin
Adobe Photoshop CS
Adobe Photoshop Lightroom 3
Adobe Reader 9.4.4
Airport Mania First Flight
Amazon Kindle
Apple Application Support
Apple Mobile Device Support
Apple Software Update
Atheros Communications Inc.(R) AR81Family Gigabit/Fast Ethernet Driver
µTorrent
AVG 2011
AviSynth 2.5
B110
Backup Manager Basic
BBC iPlayer Desktop
Blood Pressure Tracker
Bonjour
BufferChm
C:\Program Files\Acer GameZone\GameConsole
Cake Mania 2
Canon Digital Camera Solution Disk 40-46 Software Starter Guide
Canon MOV Decoder
Canon MOV Encoder
Canon MovieEdit Task for ZoomBrowser EX
Canon Personal Printing Guide
Canon RAW Image Task for ZoomBrowser EX
Canon Utilities CameraWindow
Canon Utilities CameraWindow DC
Canon Utilities CameraWindow DC 8
Canon Utilities CameraWindow DC_DV 6 for ZoomBrowser EX
Canon Utilities Digital Photo Professional 3.8
Canon Utilities EOS Utility
Canon Utilities MyCamera
Canon Utilities MyCamera DC
Canon Utilities PhotoStitch
Canon Utilities RemoteCapture Task for ZoomBrowser EX
Canon Utilities ZoomBrowser EX
Canon ZoomBrowser EX Memory Card Utility
CAS Interface Studio 8.7.1
Compatibility Pack for the 2007 Office system
Conduit Engine
Cooking Dash
Coupon Printer for Windows
Cradle of Rome
CyberLink PowerDVD 8
D5500
Dairy Dash
Destinations
DeviceDiscovery
DJ_SF_06_D5500_SW_Min
Dream Day Honeymoon
EasyGPS 4.18
Elecard MPEG-2 PlugIn for WMP
Expat Shield 1.43
Expat_Shield Toolbar
ffdshow (remove only)
Galapago
Google Earth
Google Toolbar for Internet Explorer
Google Update Helper
GorbTrack 0.4
GPBaseService2
GPSU version 5.10
HP Customer Participation Program 14.0
HP Deskjet D5500 Driver Software 13.0 Rel .6
HP Imaging Device Functions 14.0
HP Photo Creations
HP Photosmart Wireless B110 All-In-One Driver Software 14.0 Rel. 7
HP Print Projects 1.0
HP Smart Web Printing 4.60
HP Solution Center 14.0
HP Update
HPAppStudio
HPDiagnosticAlert
hpPrintProjects
HPProductAssistant
HPSSupply
hpWLPGInstaller
Huge Pine USB to UART Driver
Image Resizer Powertoy Clone for Windows
Intel(R) Graphics Media Accelerator Driver
Intel(R) TV Wizard
Intel® Matrix Storage Manager
iTunes
Java Auto Updater
Java(TM) 6 Update 22
Jewel Quest Solitaire
Juniper Networks Setup Client
Juniper Networks Setup Client Activex Control
Juniper Terminal Services Client
Junk Mail filter update
Launch Manager
LG PC Suite II
LG United Mobile Driver
LG USB Modem driver
Luxor 2
Mahjong Escape Ancient China
Malwarebytes' Anti-Malware
MarketResearch
MCCI(r)Firmware Update Driver for MTK
Media Player Classic - Home Cinema v. 1.3.1249.0
Microsoft .NET Framework 4 Client Profile
Microsoft Application Error Reporting
Microsoft Choice Guard
Microsoft Office PowerPoint Viewer 2007 (English)
Microsoft Office Professional Edition 2003
Microsoft Office Suite Activation Assistant
Microsoft Silverlight
Microsoft SQL Server 2005 Compact Edition [ENU]
Microsoft Visual C++ 2005 Redistributable
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
Microsoft Works
Mozilla Firefox 4.0.1 (x86 en-GB)
Mozilla Thunderbird (3.1.10)
MSVCRT
MSXML 4.0 SP2 (KB954430)
MSXML 4.0 SP2 (KB973688)
MyWinLocker
Nero 7 Ultra Edition
Network
NTI Backup Now 5
NTI Backup Now Standard
NTI Media Maker 8
Ocean Express
Optical Drive Power Management
Parking Dash
PL-2303 USB-to-Serial
PS_AIO_07_B110_SW_Min
Puzzle Express
QuickTime
QuickTransfer
Rainbow Web
Real Alternative 2.0.2
Realtek High Definition Audio Driver
Realtek USB 2.0 Card Reader
RescuePROâ„¢ 3.0
Safari
Samsung New PC Studio
Samsung PC Studio 3
SAMSUNG USB Driver for Mobile Phones
Scan
Shop for HP Supplies
Skype Toolbars
Skypeâ„¢ 5.1
SmartWebPrinting
SolutionCenter
Status
Synaptics Pointing Device Driver
Toolbox
Tradewinds 2
TrayApp
Tri-Peaks Solitaire To Go
TuneUp Utilities 2011
TuneUp Utilities Language Pack (en-US)
Turbo Pizza
uTorrentBar Toolbar
Videora iPod Converter 5.04
VLC media player 1.0.3
VoipBuster
WebReg
Wedding Dash
Windows Live Call
Windows Live Communications Platform
Windows Live Essentials
Windows Live Mail
Windows Live Photo Gallery
Windows Live Sign-in Assistant
Windows Live Sync
Windows Live Upload Tool
Windows Live Writer
Windows Media Player Firefox Plugin
WinZip 14.5
WinZip Self-Extractor
Zuma Deluxe
.
==== Event Viewer Messages From Past Week ========
.
30/05/2011 08:25:44, Error: Service Control Manager [7001] - The HomeGroup Provider service depends on the Function Discovery Provider Host service which failed to start because of the following error: The service cannot be started, either because it is disabled or because it has no enabled devices associated with it.
30/05/2011 07:14:22, Error: Microsoft-Windows-WMPNSS-Service [14332] - Service 'WMPNetworkSvc' did not start correctly because CoCreateInstance(CLSID_UPnPDeviceFinder) encountered error '0x80004005'. Verify that the UPnPHost service is running and that the UPnPHost component of Windows is installed properly.
29/05/2011 23:00:16, Error: Service Control Manager [7024] - The Dritek WMI Service service terminated with service-specific error The operation completed successfully..
26/05/2011 13:45:50, Error: Service Control Manager [7032] - The Service Control Manager tried to take a corrective action (Restart the service) after the unexpected termination of the Apple Mobile Device service, but this action failed with the following error: An instance of the service is already running.
26/05/2011 13:44:50, Error: Service Control Manager [7031] - The Apple Mobile Device service terminated unexpectedly. It has done this 2 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service.
26/05/2011 13:44:29, Error: Service Control Manager [7031] - The Apple Mobile Device service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service.
.
==== End Of File ===========================


Thanks in advance for any help you can provide.

 

Thanks for the warning re file sharing.
I am reasonably aware of the dangers but will give your suggested links a look.
The only P2P program I use is Utorrent and whilst I accept that there are increased dangers from using this program it is rarely used and then only for non executables. Mostly it is downloaded to a removable drive and is scanned before it is opened and is generally opened on a non networked machine.

 

Thanks for picking this up.
It is much appreciated.

Here is the requested scan report:

SystemScan - www.suspectfile.com - ver. 3.6.7 (code: holifay & bReAkdOWn)

Running on: Windows 7 (7600.6.1)
System directory: C:\Windows
SystemScan file: C:\Users\Brian\Downloads\sys32966.exe
Running in: User mode
Date: 31/05/2011
Time: 08:24:56

Output limited to:
-PC accounts

===================== ACCOUNTS ON THIS PC =====================


Users on this computer:
Is Admin? | Username
------------------
Yes | Administrator (Disabled)
Yes | Brian
| Guest (Disabled)
| HomeGroupUser$

### users folders


### startup files in users folders


==========================================
Scan completed in 0 minutes
End of report


~~~~~~~~~~~~~~~~~~~~~-----CREDITS-----~~~~~~~~~~~~~~~~~~~~~
SystemScan uses some freeware tools that remain property of their authors:

* SteelWerX Registry Console Tool, Who Am I (Bobby Flekman: www.xs4all.nl/~fstaal01) --> "Registry scan ", "PC accounts "
* dumphive (Markus Stephany)--> "Registry scan "
* Listdlls (M.Russinovich, B.Cogswell: www.sysinternals.com) --> "Loaded modules "
* Catchme & MBR Rootkit detector (gmer: www.gmer.net) --> "Hidden objects ", "Alternate Data Streams" & "Master Boot Record "
---> NOTE: SystemScan integrates "The Avenger" from Swandog46 (http://swandog46.geekstogo.com) to allow you to remove malwares found in this log

Thanks to all of them for their hard work

 

Here are the 2 requested reports:

RkU Version: 3.8.389.593, Type LE (SR2)
==============================================
OS Name: Windows 7
Version 6.1.7600
Number of processors #1
==============================================
>Drivers
==============================================
0x9160F000 C:\Windows\system32\DRIVERS\igdkmd32.sys 6451200 bytes (Intel Corporation, Intel Graphics Kernel Mode Driver)
0x82E13000 C:\Windows\system32\ntkrnlpa.exe 4259840 bytes (Microsoft Corporation, NT Kernel & System)
0x82E13000 PnpManager 4259840 bytes
0x82E13000 RAW 4259840 bytes
0x82E13000 WMIxWDM 4259840 bytes
0x9243F000 C:\Windows\system32\drivers\RTKVHDA.sys 2740224 bytes (Realtek Semiconductor Corp., Realtek(r) High Definition Audio Function Driver)
0x97E50000 Win32k 2404352 bytes
0x97E50000 C:\Windows\System32\win32k.sys 2404352 bytes (Microsoft Corporation, Multi-User Win32 Driver)
0x8B63D000 C:\Windows\System32\drivers\tcpip.sys 1347584 bytes (Microsoft Corporation, TCP/IP Driver)
0x8B222000 C:\Windows\System32\Drivers\Ntfs.sys 1241088 bytes (Microsoft Corporation, NT File System Driver)
0x90428000 C:\Windows\system32\DRIVERS\athr.sys 1232896 bytes (Atheros Communications, Inc., Atheros Extensible Wireless LAN device driver)
0x90A18000 C:\Windows\System32\Drivers\dump_iaStor.sys 892928 bytes
0x8B019000 C:\Windows\system32\DRIVERS\iaStor.sys 892928 bytes (Intel Corporation, Intel Matrix Storage Manager driver - ia32)
0x91C36000 C:\Windows\System32\drivers\dxgkrnl.sys 749568 bytes (Microsoft Corporation, DirectX Graphics Kernel)
0x8B432000 C:\Windows\system32\drivers\ndis.sys 749568 bytes (Microsoft Corporation, NDIS 6.20 driver)
0x8AD10000 C:\Windows\system32\CI.dll 700416 bytes (Microsoft Corporation, Code Integrity Module)
0x9BC3A000 C:\Windows\system32\drivers\peauth.sys 618496 bytes (Microsoft Corporation, Protected Environment Authentication and Authorization Export Driver)
0x9A42C000 C:\Windows\system32\drivers\HTTP.sys 544768 bytes (Microsoft Corporation, HTTP Protocol Stack)
0x8AC3D000 C:\Windows\system32\mcupdate_GenuineIntel.dll 491520 bytes (Microsoft Corporation, Intel Microcode Update Library)
0x8AE02000 C:\Windows\system32\drivers\Wdf01000.sys 462848 bytes (Microsoft Corporation, Kernel Mode Driver Framework Runtime)
0x8B38F000 C:\Windows\System32\Drivers\cng.sys 380928 bytes (Microsoft Corporation, Kernel Cryptography, Next Generation)
0x8B192000 C:\Windows\system32\drivers\afd.sys 368640 bytes (Microsoft Corporation, Ancillary Function Driver for WinSock)
0x9BD81000 C:\Windows\System32\DRIVERS\srv.sys 331776 bytes (Microsoft Corporation, Server driver)
0x9BD12000 C:\Windows\System32\DRIVERS\srv2.sys 323584 bytes (Microsoft Corporation, Smb 2.0 Server driver)
0x91D31000 C:\Windows\system32\DRIVERS\USBPORT.SYS 307200 bytes (Microsoft Corporation, USB 1.1 & 2.0 Port Driver)
0x8AF30000 C:\Windows\System32\drivers\volmgrx.sys 307200 bytes (Microsoft Corporation, Volume Manager Extension Driver)
0x8AE81000 C:\Windows\system32\DRIVERS\ACPI.sys 294912 bytes (Microsoft Corporation, ACPI Driver for NT)
0x8B14B000 C:\Windows\system32\DRIVERS\avgtdix.sys 290816 bytes (AVG Technologies CZ, s.r.o., AVG Network connection watcher)
0x9117E000 C:\Windows\system32\DRIVERS\nwifi.sys 286720 bytes (Microsoft Corporation, NativeWiFi Miniport Driver)
0x910FB000 C:\Windows\system32\DRIVERS\usbhub.sys 278528 bytes (Microsoft Corporation, Default Hub Driver for USB)
0x8ACCE000 C:\Windows\system32\CLFS.SYS 270336 bytes (Microsoft Corporation, Common Log File System Driver)
0x8AFA4000 C:\Windows\system32\DRIVERS\rdbss.sys 266240 bytes (Microsoft Corporation, Redirected Drive Buffering SubSystem Driver)
0x8B7B7000 C:\Windows\system32\DRIVERS\volsnap.sys 258048 bytes (Microsoft Corporation, Volume Shadow Copy Driver)
0x8B4E9000 C:\Windows\system32\drivers\NETIO.SYS 253952 bytes (Microsoft Corporation, Network I/O Subsystem)
0x8ADBB000 C:\Windows\system32\DRIVERS\avgldx86.sys 245760 bytes (AVG Technologies CZ, s.r.o., AVG AVI Loader Driver)
0x9A4FF000 C:\Windows\system32\DRIVERS\mrxsmb10.sys 241664 bytes (Microsoft Corporation, Longhorn SMB Downlevel SubRdr)
0x91CED000 C:\Windows\System32\drivers\dxgmms1.sys 233472 bytes (Microsoft Corporation, DirectX Graphics MMS)
0x83223000 ACPI_HAL 225280 bytes
0x83223000 C:\Windows\system32\halmacpi.dll 225280 bytes (Microsoft Corporation, Hardware Abstraction Layer DLL)
0x8B0FC000 C:\Windows\system32\drivers\fltmgr.sys 212992 bytes (Microsoft Corporation, Microsoft Filesystem Filter Manager)
0x910B9000 C:\Windows\system32\DRIVERS\ks.sys 212992 bytes (Microsoft Corporation, Kernel CSA Library)
0x8B554000 C:\Windows\System32\DRIVERS\fvevol.sys 204800 bytes (Microsoft Corporation, BitLocker Drive Encryption Driver)
0x90BCB000 C:\Windows\System32\DRIVERS\netbt.sys 204800 bytes (Microsoft Corporation, MBT Transport driver)
0x8B786000 C:\Windows\System32\drivers\fwpkclnt.sys 200704 bytes (Microsoft Corporation, FWP/IPsec Kernel-Mode API)
0x9058E000 C:\Windows\system32\DRIVERS\SynTP.sys 200704 bytes (Synaptics Incorporated, Synaptics Touchpad Driver)
0x926DC000 C:\Windows\system32\drivers\portcls.sys 192512 bytes (Microsoft Corporation, Port Class (Class Driver for Port/Miniport Devices))
0x91DBC000 C:\Windows\system32\drivers\windrvr6.sys 188416 bytes (Jungo, WinDriver Device Driver 9.01)
0x8B600000 C:\Windows\System32\drivers\rdyboost.sys 184320 bytes (Microsoft Corporation, ReadyBoost Driver)
0x8B351000 C:\Windows\System32\Drivers\msrpc.sys 176128 bytes (Microsoft Corporation, Kernel Remote Procedure Call Provider)
0x92745000 C:\Windows\System32\Drivers\fastfat.SYS 172032 bytes (Microsoft Corporation, Fast FAT File System Driver)
0x8AEDA000 C:\Windows\system32\DRIVERS\pci.sys 172032 bytes (Microsoft Corporation, NT Plug and Play PCI Enumerator)
0x8B597000 C:\Windows\system32\DRIVERS\CLASSPNP.SYS 151552 bytes (Microsoft Corporation, SCSI Class System Dll)
0x8B527000 C:\Windows\System32\Drivers\ksecpkg.sys 151552 bytes (Microsoft Corporation, Kernel Security Support Provider Interface Packages)
0x92786000 C:\Windows\System32\Drivers\usbvideo.sys 147456 bytes (Microsoft Corporation, USB Video Class Driver)
0x9A4DC000 C:\Windows\system32\DRIVERS\mrxsmb.sys 143360 bytes (Microsoft Corporation, Windows NT SMB Minirdr)
0x91048000 C:\Windows\system32\DRIVERS\ndiswan.sys 139264 bytes (Microsoft Corporation, MS PPP Framing Driver (Strong Encryption))
0x92724000 C:\Windows\system32\drivers\IntcHdmi.sys 135168 bytes (Intel(R) Corporation, Intel(R) High Definition Audio HDMI)
0x9BCDF000 C:\Windows\System32\DRIVERS\srvnet.sys 135168 bytes (Microsoft Corporation, Server Network driver)
0x8AC00000 C:\Windows\system32\DRIVERS\tunnel.sys 135168 bytes (Microsoft Corporation, Microsoft Tunnel Interface Driver)
0x90B4A000 C:\Windows\System32\drivers\VIDEOPRT.SYS 135168 bytes (Microsoft Corporation, Video Port Driver)
0x9BD61000 C:\Windows\system32\DRIVERS\AVGIDSDriver.Sys 131072 bytes (AVG Technologies CZ, s.r.o. , IDS Application Activity Monitor Driver.)
0x90B05000 C:\Windows\system32\DRIVERS\cdrom.sys 126976 bytes (Microsoft Corporation, SCSI CD-ROM Driver)
0x91D8B000 C:\Windows\system32\DRIVERS\HDAudBus.sys 126976 bytes (Microsoft Corporation, High Definition Audio Bus Driver)
0x8B5D4000 C:\Windows\system32\DRIVERS\pacer.sys 126976 bytes (Microsoft Corporation, QoS Packet Scheduler)
0x980E0000 C:\Windows\System32\cdd.dll 122880 bytes (Microsoft Corporation, Canonical Display Driver)
0x91150000 C:\Windows\system32\DRIVERS\irda.sys 122880 bytes (Microsoft Corporation, IRDA Protocol Driver)
0x92400000 C:\Windows\system32\drivers\luafv.sys 110592 bytes (Microsoft Corporation, LUA File Virtualization Filter Driver)
0x9A53A000 C:\Windows\system32\DRIVERS\mrxsmb20.sys 110592 bytes (Microsoft Corporation, Longhorn SMB 2.0 Redirector)
0x9241B000 C:\Windows\system32\drivers\WudfPf.sys 106496 bytes (Microsoft Corporation, Windows Driver Foundation - User-mode Driver Framework Platform Driver)
0x9A4B1000 C:\Windows\system32\DRIVERS\bowser.sys 102400 bytes (Microsoft Corporation, NT Lan Manager Datagram Receiver Driver)
0x9270B000 C:\Windows\system32\drivers\drmk.sys 102400 bytes (Microsoft Corporation, Microsoft Trusted Audio Drivers)
0x9BC00000 C:\Users\Brian\AppData\Local\Temp\pwlcifow.sys 102400 bytes
0x8B000000 C:\Windows\System32\Drivers\dfsc.sys 98304 bytes (Microsoft Corporation, DFS Namespace Client Driver)
0x9055F000 C:\Windows\system32\DRIVERS\i8042prt.sys 98304 bytes (Microsoft Corporation, i8042 Port Driver)
0x91025000 C:\Windows\system32\DRIVERS\rasl2tp.sys 98304 bytes (Microsoft Corporation, RAS L2TP mini-port/call-manager driver)
0x9106A000 C:\Windows\system32\DRIVERS\raspppoe.sys 98304 bytes (Microsoft Corporation, RAS PPPoE mini-port/call-manager driver)
0x91082000 C:\Windows\system32\DRIVERS\raspptp.sys 94208 bytes (Microsoft Corporation, Peer-to-Peer Tunneling Protocol)
0x91099000 C:\Windows\system32\DRIVERS\rassstp.sys 94208 bytes (Microsoft Corporation, RAS SSTP Miniport Call Manager)
0x90BA9000 C:\Windows\system32\DRIVERS\tdx.sys 94208 bytes (Microsoft Corporation, TDI Translation Driver)
0x9276F000 C:\Windows\system32\DRIVERS\usbccgp.sys 94208 bytes (Microsoft Corporation, USB Common Class Generic Parent Driver)
0x927AA000 C:\Windows\system32\DRIVERS\cdfs.sys 90112 bytes (Microsoft Corporation, CD-ROM File System Driver)
0x8AF8E000 C:\Windows\System32\drivers\mountmgr.sys 90112 bytes (Microsoft Corporation, Mount Point Manager)
0x8B37C000 C:\Windows\System32\Drivers\ksecdd.sys 77824 bytes (Microsoft Corporation, Kernel Security Support Provider Interface)
0x911D4000 C:\Windows\system32\DRIVERS\rspndr.sys 77824 bytes (Microsoft Corporation, Link-Layer Topology Responder Driver for NDIS 6)
0x8B414000 C:\Windows\system32\DRIVERS\wanarp.sys 77824 bytes (Microsoft Corporation, MS Remote Access and Routing ARP Driver)
0x90408000 C:\Windows\system32\DRIVERS\AgileVpn.sys 73728 bytes (Microsoft Corporation, RAS Agile Vpn Miniport Call Manager)
0x8AC21000 C:\Windows\system32\DRIVERS\intelppm.sys 73728 bytes (Microsoft Corporation, Processor Device Driver)
0x91DAA000 C:\Windows\system32\DRIVERS\L1C62x86.sys 73728 bytes (Atheros Communications, Inc., Atheros L1c PCI-E Gigabit Ethernet Controller)
0x9A4CA000 C:\Windows\System32\drivers\mpsdrv.sys 73728 bytes (Microsoft Corporation, Microsoft Protection Service Driver)
0x8B586000 C:\Windows\system32\DRIVERS\disk.sys 69632 bytes (Microsoft Corporation, PnP Disk Driver)
0x927CD000 C:\Windows\System32\Drivers\dump_dumpfve.sys 69632 bytes
0x8B130000 C:\Windows\system32\drivers\fileinfo.sys 69632 bytes (Microsoft Corporation, FileInfo Filter Driver)
0x9113F000 C:\Windows\System32\Drivers\NDProxy.SYS 69632 bytes (Microsoft Corporation, NDIS Proxy)
0x8AF0F000 C:\Windows\System32\drivers\partmgr.sys 69632 bytes (Microsoft Corporation, Partition Management Driver)
0x8ACB5000 C:\Windows\system32\PSHED.dll 69632 bytes (Microsoft Corporation, Platform Specific Hardware Error Driver)
0x90A07000 C:\Windows\system32\DRIVERS\vwififlt.sys 69632 bytes (Microsoft Corporation, Virtual WiFi Filter Driver)
0x9116E000 C:\Windows\system32\DRIVERS\lltdio.sys 65536 bytes (Microsoft Corporation, Link-Layer Topology Mapper I/O Driver)
0x8B62D000 C:\Windows\System32\Drivers\mup.sys 65536 bytes (Microsoft Corporation, Multiple UNC Provider Driver)
0x911C4000 C:\Windows\system32\DRIVERS\ndisuio.sys 65536 bytes (Microsoft Corporation, NDIS User mode I/O driver)
0x8B209000 C:\Windows\system32\DRIVERS\termdd.sys 65536 bytes (Microsoft Corporation, Remote Desktop Server Driver)
0x8AF20000 C:\Windows\system32\DRIVERS\volmgr.sys 65536 bytes (Microsoft Corporation, Volume Manager Driver)
0x91D7C000 C:\Windows\system32\DRIVERS\usbehci.sys 61440 bytes (Microsoft Corporation, EHCI eUSB Miniport Driver)
0x8AFE5000 C:\Windows\system32\DRIVERS\blbdrive.sys 57344 bytes (Microsoft Corporation, BLB Drive Driver)
0x8B400000 C:\Windows\system32\DRIVERS\netbios.sys 57344 bytes (Microsoft Corporation, NetBIOS interface driver)
0x90B9B000 C:\Windows\System32\Drivers\Npfs.SYS 57344 bytes (Microsoft Corporation, NPFS Driver)
0x8B3EC000 C:\Windows\System32\drivers\pcw.sys 57344 bytes (Microsoft Corporation, Performance Counters for Windows Driver)
0x910ED000 C:\Windows\system32\DRIVERS\umbus.sys 57344 bytes (Microsoft Corporation, User-Mode Bus Enumerator)
0x8AE73000 C:\Windows\system32\drivers\WDFLDR.SYS 57344 bytes (Microsoft Corporation, Kernel Mode Driver Framework Loader)
0x905F1000 C:\Windows\system32\DRIVERS\CompositeBus.sys 53248 bytes (Microsoft Corporation, Multi-Transport Composite Bus Enumerator)
0x927C0000 C:\Windows\System32\Drivers\crashdmp.sys 53248 bytes (Microsoft Corporation, Crash Dump Driver)
0x90581000 C:\Windows\system32\DRIVERS\kbdclass.sys 53248 bytes (Microsoft Corporation, Keyboard Class Driver)
0x905C1000 C:\Windows\system32\DRIVERS\mouclass.sys 53248 bytes (Microsoft Corporation, Mouse Class Driver)
0x9BD00000 C:\Windows\System32\drivers\tcpipreg.sys 53248 bytes (Microsoft Corporation, TCP/IP Registry Compatibility Driver)
0x90B6B000 C:\Windows\System32\drivers\watchdog.sys 53248 bytes (Microsoft Corporation, Watchdog Driver)
0x90B24000 C:\Windows\system32\DRIVERS\avgmfx86.sys 49152 bytes (AVG Technologies CZ, s.r.o., AVG Resident Shield Minifilter Driver)
0x8B1EC000 C:\Windows\System32\drivers\discache.sys 49152 bytes (Microsoft Corporation, System Indexer/Cache Driver)
0x90B3E000 C:\Windows\System32\drivers\vga.sys 49152 bytes (Microsoft Corporation, VGA/Super VGA Video Driver)
0x8AF83000 C:\Windows\system32\DRIVERS\BATTC.SYS 45056 bytes (Microsoft Corporation, Battery Class Driver)
0x927E8000 C:\Windows\system32\DRIVERS\monitor.sys 45056 bytes (Microsoft Corporation, Monitor Driver)
0x90B90000 C:\Windows\System32\Drivers\Msfs.SYS 45056 bytes (Microsoft Corporation, Mailslot driver)
0x9103D000 C:\Windows\system32\DRIVERS\ndistapi.sys 45056 bytes (Microsoft Corporation, NDIS 3.0 connection wrapper driver)
0x90BC0000 C:\Windows\system32\DRIVERS\TDI.SYS 45056 bytes (Microsoft Corporation, TDI Wrapper)
0x91D26000 C:\Windows\system32\DRIVERS\usbuhci.sys 45056 bytes (Microsoft Corporation, UHCI USB Miniport Driver)
0x8AF04000 C:\Windows\system32\DRIVERS\vdrvroot.sys 45056 bytes (Microsoft Corporation, Virtual Drive Root Enumerator)
0x90577000 C:\Windows\system32\DRIVERS\DKbFltr.sys 40960 bytes (Dritek System Inc., Dritek PS2 Keyboard Filter Driver)
0x927DE000 C:\Windows\System32\drivers\Dxapi.sys 40960 bytes (Microsoft Corporation, DirectX API Driver)
0x8B5F3000 C:\Windows\system32\DRIVERS\mssmbios.sys 40960 bytes (Microsoft Corporation, System Management BIOS Driver)
0x8B427000 C:\Windows\system32\drivers\nsiproxy.sys 40960 bytes (Microsoft Corporation, NSI Proxy)
0x8B141000 C:\Windows\System32\Drivers\PxHelp20.sys 40960 bytes (Sonic Solutions, Px Engine Device Driver for Windows 2000/XP)
0x9BCD5000 C:\Windows\System32\Drivers\secdrv.SYS 40960 bytes (Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K., Macrovision SECURITY Driver)
0x90555000 C:\Windows\system32\DRIVERS\vwifibus.sys 40960 bytes (Microsoft Corporation, Virtual WiFi Bus Driver)
0x8B0F3000 C:\Windows\system32\DRIVERS\amdxata.sys 36864 bytes (Advanced Micro Devices, Storage Filter Driver)
0x9BDDC000 C:\Windows\system32\DRIVERS\asyncmac.sys 36864 bytes (Microsoft Corporation, MS Remote Access serial network driver)
0x9BC31000 C:\Windows\System32\Drivers\BlackBox.SYS 36864 bytes (RKU Driver)
0x9BDD3000 C:\Windows\system32\FsUsbExDisk.SYS 36864 bytes
0x8B200000 C:\Windows\System32\Drivers\Fs_Rec.sys 36864 bytes (Microsoft Corporation, File System Recognizer Driver)
0x980B0000 C:\Windows\System32\TSDDD.dll 36864 bytes (Microsoft Corporation, Framebuffer Display Driver)
0x92435000 C:\Windows\system32\DRIVERS\vwifimp.sys 36864 bytes (Microsoft Corporation, Virtual WiFi Miniport Driver)
0x905E8000 C:\Windows\system32\DRIVERS\wmiacpi.sys 36864 bytes (Microsoft Corporation, Windows Management Interface for ACPI)
0x8AEC9000 C:\Windows\system32\DRIVERS\WMILIB.SYS 36864 bytes (Microsoft Corporation, WMILIB WMI support library Dll)
0x8ACC6000 C:\Windows\system32\BOOTVID.dll 32768 bytes (Microsoft Corporation, VGA Boot Driver)
0x8AF7B000 C:\Windows\system32\DRIVERS\compbatt.sys 32768 bytes (Microsoft Corporation, Composite Battery Driver)
0x8B54C000 C:\Windows\System32\drivers\hwpolicy.sys 32768 bytes (Microsoft Corporation, Hardware Policy Driver)
0x80B9D000 C:\Windows\system32\kdcom.dll 32768 bytes (Microsoft Corporation, Serial Kernel Debugger)
0x8AED2000 C:\Windows\system32\DRIVERS\msisadrv.sys 32768 bytes (Microsoft Corporation, ISA Driver)
0x905DA000 C:\Windows\system32\drivers\NTIDrvr.sys 32768 bytes (NewTech Infosystems, Inc., NTI CD-ROM Filter Driver)
0x90B78000 C:\Windows\System32\DRIVERS\RDPCDD.sys 32768 bytes (Microsoft Corporation, RDP Miniport)
0x90B80000 C:\Windows\system32\drivers\rdpencdd.sys 32768 bytes (Microsoft Corporation, RDP Encoder Miniport)
0x90B88000 C:\Windows\system32\drivers\rdprefmp.sys 32768 bytes (Microsoft Corporation, RDP Reflector Driver Miniport)
0x9BDF5000 C:\Windows\system32\DRIVERS\serscan.sys 32768 bytes (Microsoft Corporation, Serial Imaging Device Driver)
0x8B7F6000 C:\Windows\System32\Drivers\spldr.sys 32768 bytes (Microsoft Corporation, loader for security processor)
0x905D2000 C:\Windows\system32\drivers\UBHelper.sys 32768 bytes (NewTech Infosystems Corporation, NTI CDROM Filter Driver)
0x8B5BC000 C:\Windows\system32\DRIVERS\avgrkx86.sys 28672 bytes (AVG Technologies CZ, s.r.o., AVG Anti-Rootkit Driver)
0x90B37000 C:\Windows\System32\Drivers\Beep.SYS 28672 bytes (Microsoft Corporation, BEEP Driver)
0x9BC21000 C:\Users\Brian\AppData\Local\Temp\mbr.sys 28672 bytes
0x90B30000 C:\Windows\System32\Drivers\Null.SYS 28672 bytes (Microsoft Corporation, NULL Driver)
0x910B0000 C:\Windows\system32\DRIVERS\taphss.sys 28672 bytes (AnchorFree Inc, TAP-Win32 Virtual Network Driver)
0x90A00000 C:\Windows\system32\DRIVERS\wfplwf.sys 28672 bytes (Microsoft Corporation, WFP NDIS 6.20 Lightweight Filter Driver)
0x905E2000 C:\Windows\system32\DRIVERS\GEARAspiWDM.sys 24576 bytes (GEAR Software Inc., CD DVD Filter)
0x8B40E000 C:\Windows\System32\Drivers\StarOpen.SYS 24576 bytes
0x9BD0D000 C:\Windows\system32\DRIVERS\AVGIDSFilter.Sys 20480 bytes (AVG Technologies CZ, s.r.o. , IDS Application Activity Monitor Filter Driver.)
0x8B5C3000 C:\Windows\system32\DRIVERS\AVGIDSEH.Sys 16384 bytes (AVG Technologies CZ, s.r.o. , IDS Application Activity Monitor Helper Driver.)
0x9A56D000 C:\Windows\system32\DRIVERS\AVGIDSShim.Sys 16384 bytes (AVG Technologies CZ, s.r.o. , IDS Application Activity Monitor Loader Driver.)
0x905CE000 C:\Windows\system32\DRIVERS\CmBatt.sys 16384 bytes (Microsoft Corporation, Control Method Battery Driver)
0x9BCD1000 C:\Windows\system32\Drivers\SBKUPNT.SYS 16384 bytes
0x910B7000 C:\Windows\system32\DRIVERS\swenum.sys 8192 bytes (Microsoft Corporation, Plug and Play Software Device Enumerator)
0x905BF000 C:\Windows\system32\DRIVERS\USBD.SYS 8192 bytes (Microsoft Corporation, Universal Serial Bus Driver)
0x9BDD2000 C:\Program Files\TuneUp Utilities 2011\TuneUpUtilitiesDriver32.sys 4096 bytes (TuneUp Software, TuneUp Utilities Driver)
==============================================
>Stealth
==============================================



ComboFix 11-05-31.01 - Brian 31/05/2011 23:33:54.1.1 - x86
Microsoft Windows 7 Home Premium 6.1.7600.0.1252.44.1033.18.3002.2079 [GMT 3:00]
Running from: c:\users\Brian\Desktop\ComboFix.exe
SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
* Created a new restore point
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\users\Brian\AppData\Local\Microsoft\Windows\Temporary Internet Files\2020RP_TempGeneratedImage.jpg
c:\users\Brian\AppData\Roaming\.#
.
.
((((((((((((((((((((((((( Files Created from 2011-04-28 to 2011-05-31 )))))))))))))))))))))))))))))))
.
.
2011-05-31 20:46 . 2011-05-31 20:46 -------- d-----w- c:\users\Default\AppData\Local\temp
2011-05-31 20:46 . 2011-05-31 20:46 -------- d-----w- c:\users\Administrator\AppData\Local\temp
2011-05-31 20:27 . 2011-05-31 20:31 -------- d-----w- C:\32788R22FWJFW
2011-05-26 10:47 . 2011-05-26 10:47 -------- d-----w- c:\program files\iPod
2011-05-26 10:47 . 2011-05-26 10:48 -------- d-----w- c:\program files\iTunes
2011-05-26 10:44 . 2011-05-26 10:44 -------- d-----w- c:\program files\Bonjour
2011-05-26 06:22 . 2011-05-26 06:22 -------- d-----w- c:\program files\BBC iPlayer Desktop
2011-05-26 06:01 . 2010-09-14 06:07 276992 ----a-w- c:\windows\system32\wcncsvc.dll
2011-05-15 19:14 . 2011-05-15 19:14 781272 ----a-w- c:\program files\Mozilla Firefox\mozsqlite3.dll
2011-05-15 19:14 . 2011-05-15 19:14 1874904 ----a-w- c:\program files\Mozilla Firefox\mozjs.dll
2011-05-15 19:14 . 2011-05-15 19:14 89048 ----a-w- c:\program files\Mozilla Firefox\libEGL.dll
2011-05-15 19:14 . 2011-05-15 19:14 465880 ----a-w- c:\program files\Mozilla Firefox\libGLESv2.dll
2011-05-15 19:14 . 2011-05-15 19:14 15832 ----a-w- c:\program files\Mozilla Firefox\mozalloc.dll
2011-05-15 19:14 . 2011-05-15 19:14 1974616 ----a-w- c:\program files\Mozilla Firefox\D3DCompiler_42.dll
2011-05-15 19:14 . 2011-05-15 19:14 1892184 ----a-w- c:\program files\Mozilla Firefox\d3dx9_42.dll
2011-05-15 19:14 . 2011-05-15 19:14 142296 ----a-w- c:\program files\Mozilla Firefox\components\browsercomps.dll
2011-05-13 08:32 . 2011-05-13 08:32 -------- d-----w- c:\users\Brian\AppData\Roaming\GPS Utility
2011-05-13 08:31 . 2011-05-13 08:31 -------- d-----w- c:\program files\GPS Utility
2011-05-13 08:24 . 2011-05-13 08:24 -------- d-----w- c:\users\Brian\AppData\Local\TopoGrafix
2011-05-13 08:24 . 2011-05-13 08:24 -------- d-----w- c:\program files\EasyGPS
2011-05-13 07:51 . 2005-08-03 13:05 35892 ----a-w- c:\windows\system32\SER9PL.sys
2011-05-13 07:51 . 2005-08-03 13:04 26719 ----a-w- c:\windows\system32\SERSPL.VXD
2011-05-12 13:11 . 2011-05-12 13:11 -------- d-----w- c:\users\Brian\AppData\Roaming\Malwarebytes
2011-05-12 12:47 . 2010-12-20 15:09 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2011-05-12 12:47 . 2011-05-12 12:47 -------- d-----w- c:\programdata\Malwarebytes
2011-05-12 12:47 . 2011-05-29 17:00 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2011-05-12 12:47 . 2010-12-20 15:08 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
2011-05-10 20:22 . 2011-03-03 03:31 2331136 ----a-w- c:\windows\system32\win32k.sys
2011-05-06 04:46 . 2011-05-06 04:46 -------- d-----w- c:\program files\SoundTells
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2024-03-21 09:44 . 2010-08-26 16:31 246272 ----a-w- c:\windows\UNINST16.EXE
2011-05-20 05:03 . 2010-06-26 10:27 737072 ----a-w- c:\programdata\Microsoft\eHome\Packages\SportsV2\SportsTemplateCore\Microsoft.MediaCenter.Sports.UI.dll
2011-05-20 05:02 . 2011-03-21 03:53 4283672 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCEClientUX\UpdateableMarkup\markup.dll
2011-05-20 04:43 . 2010-08-27 05:35 42776 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCEClientUX\dSM-2\StartResources.dll
2011-05-20 04:43 . 2010-08-27 05:34 539968 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCESpotlight\MCESpotlight-2\SpotlightResources.dll
2011-04-14 12:48 . 2010-08-27 05:36 737072 ----a-w- c:\programdata\Microsoft\eHome\Packages\SportsV2\SportsTemplateCore-2\Microsoft.MediaCenter.Sports.UI.dll
2011-04-14 12:48 . 2010-08-27 05:35 4283672 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCEClientUX\UpdateableMarkup-2\markup.dll
2011-04-14 12:47 . 2010-06-26 07:01 42776 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCEClientUX\dSM\StartResources.dll
2011-04-06 13:20 . 2011-04-06 13:20 91424 ----a-w- c:\windows\system32\dnssd.dll
2011-04-06 13:20 . 2011-04-06 13:20 107808 ----a-w- c:\windows\system32\dns-sd.exe
2011-03-30 04:06 . 2011-03-30 04:06 4277016 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCEClientUX\UpdateableMarkup-3\markup.dll
2011-03-27 00:11 . 2011-03-24 07:08 737072 ----a-w- c:\programdata\Microsoft\eHome\Packages\SportsV2\SportsTemplateCore-4\Microsoft.MediaCenter.Sports.UI.dll
2011-03-25 12:19 . 2010-06-26 07:00 539968 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCESpotlight\MCESpotlight\SpotlightResources.dll
2011-03-22 12:52 . 2011-03-22 12:52 737072 ----a-w- c:\programdata\Microsoft\eHome\Packages\SportsV2\SportsTemplateCore-3\Microsoft.MediaCenter.Sports.UI.dll
2011-03-18 10:46 . 2011-03-18 10:46 61704 ----a-w- c:\windows\system32\drivers\ftdibus.sys
2011-03-18 10:46 . 2011-03-18 10:46 203144 ----a-w- c:\windows\system32\ftd2xx.dll
2011-03-18 10:46 . 2011-03-18 10:46 69000 ----a-w- c:\windows\system32\ftcserco.dll
2011-03-18 10:46 . 2011-03-18 10:46 105352 ----a-w- c:\windows\system32\ftbusui.dll
2011-03-18 10:46 . 2011-03-18 10:46 73096 ----a-w- c:\windows\system32\drivers\ftser2k.sys
2011-03-18 10:46 . 2011-03-18 10:46 201096 ----a-w- c:\windows\system32\FTLang.dll
2011-03-18 10:46 . 2011-03-18 10:46 52616 ----a-w- c:\windows\system32\ftserui2.dll
2011-05-15 19:14 . 2011-05-15 19:14 142296 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{a060276a-53be-45ec-8ebe-b94b1e803179} "= "c:\program files\Expat_Shield\tbExp0.dll" [2010-10-18 3908192]
"{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc} "= "c:\program files\uTorrentBar\tbuTor.dll" [2010-11-29 3908192]
.
[HKEY_CLASSES_ROOT\clsid\{a060276a-53be-45ec-8ebe-b94b1e803179}]
.
[HKEY_CLASSES_ROOT\clsid\{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}]
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{30F9B915-B755-4826-820B-08FBA6BD249D}]
2010-11-29 13:26 3908192 ----a-w- c:\program files\ConduitEngine\ConduitEngine.dll
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{3706EE7C-3CAD-445D-8A43-03EBC3B75908}]
2010-04-30 21:32 220208 ----a-w- c:\program files\Expat Shield\HssIE\ExpatIE.dll
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{a060276a-53be-45ec-8ebe-b94b1e803179}]
2010-10-18 10:26 3908192 ----a-w- c:\program files\Expat_Shield\tbExp0.dll
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}]
2010-11-29 13:26 3908192 ----a-w- c:\program files\uTorrentBar\tbuTor.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{a060276a-53be-45ec-8ebe-b94b1e803179} "= "c:\program files\Expat_Shield\tbExp0.dll" [2010-10-18 3908192]
"{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc} "= "c:\program files\uTorrentBar\tbuTor.dll" [2010-11-29 3908192]
"{30F9B915-B755-4826-820B-08FBA6BD249D} "= "c:\program files\ConduitEngine\ConduitEngine.dll" [2010-11-29 3908192]
.
[HKEY_CLASSES_ROOT\clsid\{a060276a-53be-45ec-8ebe-b94b1e803179}]
.
[HKEY_CLASSES_ROOT\clsid\{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}]
.
[HKEY_CLASSES_ROOT\clsid\{30f9b915-b755-4826-820b-08fba6bd249d}]
.
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{A060276A-53BE-45EC-8EBE-B94B1E803179} "= "c:\program files\Expat_Shield\tbExp0.dll" [2010-10-18 3908192]
"{BF7380FA-E3B4-4DB2-AF3E-9D8783A45BFC} "= "c:\program files\uTorrentBar\tbuTor.dll" [2010-11-29 3908192]
.
[HKEY_CLASSES_ROOT\clsid\{a060276a-53be-45ec-8ebe-b94b1e803179}]
.
[HKEY_CLASSES_ROOT\clsid\{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}]
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg "= "c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2010-03-15 68856]
"Sidebar "= "c:\program files\Windows Sidebar\sidebar.exe" [2009-07-14 1173504]
"uTorrent "= "c:\program files\uTorrent\uTorrent.exe" [2011-03-25 399736]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Acer ePower Management "= "c:\program files\Acer\Acer PowerSmart Manager\ePowerTrayLauncher.exe" [2009-08-19 487424]
"IAAnotif "= "c:\program files\Intel\Intel Matrix Storage Manager\iaanotif.exe" [2009-02-12 186904]
"LManager "= "c:\program files\Launch Manager\LManager.exe" [2009-04-09 1071624]
"ODDPwr "= "c:\program files\Acer\Optical Drive Power Management\ODDPwr.exe" [2009-09-04 186912]
"RtHDVCpl "= "c:\program files\Realtek\Audio\HDA\RtHDVCpl.exe" [2009-08-05 7703072]
"PLFSetI "= "c:\windows\PLFSetI.exe" [2008-07-29 200704]
"IgfxTray "= "c:\windows\system32\igfxtray.exe" [2009-09-02 135168]
"HotKeysCmds "= "c:\windows\system32\hkcmd.exe" [2009-09-02 167424]
"Persistence "= "c:\windows\system32\igfxpers.exe" [2009-09-02 144384]
"Adobe Reader Speed Launcher "= "c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2011-01-31 35760]
"Adobe ARM "= "c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-09-20 932288]
"B2C_AGENT "= "c:\programdata\LGMOBILEAX\B2C_Client\B2CNotiAgent.exe" [2011-01-13 395192]
"Malwarebytes' Anti-Malware (reboot) "= "c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2010-12-20 963976]
"iTunesHelper "= "c:\program files\iTunes\iTunesHelper.exe" [2011-04-26 421160]
.
c:\users\Brian\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
BBC iPlayer Desktop.lnk - c:\program files\BBC iPlayer Desktop\BBC iPlayer Desktop.exe [2011-5-26 142848]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2009-11-18 275072]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin "= 0 (0x0)
"ConsentPromptBehaviorUser "= 3 (0x3)
"EnableUIADesktopToggle "= 0 (0x0)
"PromptOnSecureDesktop "= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk *\0c:\progra~1\AVG\AVG10\avgchsvx.exe /sync\0c:\progra~1\AVG\AVG10\avgrsx.exe /sync /restart
.
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"ProductReg "= "c:\program files\Acer\WR_PopUp\ProductReg.exe "
"uTorrent "= "c:\program files\uTorrent\uTorrent.exe "
"swg "= "c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe "
"AutoStartNPSAgent "=c:\program files\Samsung\Samsung New PC Studio\NPSAgent.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"EgisTecLiveUpdate "= "c:\program files\EgisTec Egis Software Update\EgisUpdate.exe "
"SunJavaUpdateSched "= "c:\program files\Common Files\Java\Java Update\jusched.exe "
"QuickTime Task "= "c:\program files\QuickTime\QTTask.exe" -atboottime
"HP Software Update "=c:\program files\HP\HP Software Update\HPWuSchd2.exe
"iTunesHelper "= "c:\program files\iTunes\iTunesHelper.exe "
"Adobe Reader Speed Launcher "= "c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe "
"Adobe ARM "= "c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe "
"PDVD8LanguageShortcut "= "c:\program files\CyberLink\PowerDVD8\Language\Language.exe "
"RemoteControl8 "= "c:\program files\CyberLink\PowerDVD8\PDVD8Serv.exe "
"SynTPEnh "=c:\program files\Synaptics\SynTP\SynTPEnh.exe
"B2C_AGENT "=c:\programdata\LGMOBILEAX\B2C_Client\B2CNotiAgent.exe
"BackupManagerTray "= "c:\program files\NewTech Infosystems\Acer Backup Manager\BackupManagerTray.exe" -k
"NeroFilterCheck "=c:\program files\Common Files\Ahead\Lib\NeroCheck.exe
.
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 ExpatWd;Expat Shield Monitoring Service;c:\program files\Expat Shield\bin\hsswd.exe [2010-04-30 199728]
R2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [2010-03-15 135664]
R3 btusbflt;Bluetooth USB Filter;c:\windows\system32\drivers\btusbflt.sys [2010-04-13 45736]
R3 ExpatTrayService;Expat Shield Tray Service;c:\program files\Expat Shield\bin\ExpatTrayService.EXE [2010-05-06 54516]
R3 FlashUSB;FlashUSB;c:\windows\system32\DRIVERS\FlashUSB.sys [2010-05-12 16896]
R3 gupdatem;Google Update Service (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [2010-03-15 135664]
R3 NTIBackupSvc;NTI Backup Now 5 Backup Service;c:\program files\NewTech Infosystems\NTI Backup Now 5\BackupSvc.exe [2008-09-23 50424]
R3 usb2vcom;USB to Serial Bridge Controller;c:\windows\system32\Drivers\usb2vcom.sys [2005-09-02 28928]
R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [2010-05-20 1343400]
R4 Raisngsvc;Raisngsvc; [x]
S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [2009-07-13 48128]
S2 DsiWMIService;Dritek WMI Service;c:\program files\Launch Manager\dsiwmis.exe [2009-04-11 117256]
S2 ePowerSvc;Acer ePower Service;c:\program files\Acer\Acer PowerSmart Manager\ePowerSvc.exe [2009-08-19 688128]
S2 ExpatShieldService;Expat Shield Service;c:\program files\Expat Shield\bin\openvpnas.exe [2010-05-06 248368]
S2 FsUsbExService;FsUsbExService;c:\windows\system32\FsUsbExService.Exe [2010-07-04 238952]
S2 NTI IScheduleSvc;NTI IScheduleSvc;c:\program files\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe [2009-05-26 62208]
S2 NTISchedulerSvc;NTI Backup Now 5 Scheduler Service;c:\program files\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe [2008-09-23 144632]
S2 ODDPwrSvc;Acer ODD Power Service;c:\program files\Acer\Optical Drive Power Management\ODDPWRSvc.exe [2009-09-04 125472]
S2 RS_Service;Raw Socket Service;c:\program files\Acer\Acer VCM\RS_Service.exe [2009-02-05 237568]
S2 SBKUPNT;SBKUPNT;c:\windows\system32\Drivers\SBKUPNT.SYS [2001-07-13 14976]
S2 TuneUp.UtilitiesSvc;TuneUp Utilities Service;c:\program files\TuneUp Utilities 2011\TuneUpUtilitiesService32.exe [2010-10-27 1483072]
S3 FsUsbExDisk;FsUsbExDisk;c:\windows\system32\FsUsbExDisk.SYS [2010-06-14 36608]
S3 IntcHdmiAddService;Intel(R) High Definition Audio HDMI;c:\windows\system32\drivers\IntcHdmi.sys [2008-12-05 112640]
S3 L1C;NDIS Miniport Driver for Atheros AR813x/AR815x PCI-E Ethernet Controller;c:\windows\system32\DRIVERS\L1C62x86.sys [2009-11-13 58368]
S3 TuneUpUtilitiesDrv;TuneUpUtilitiesDrv;c:\program files\TuneUp Utilities 2011\TuneUpUtilitiesDriver32.sys [2010-10-07 10064]
S3 vwifimp;Microsoft Virtual WiFi Miniport Service;c:\windows\system32\DRIVERS\vwifimp.sys [2009-07-13 14336]
.
.
--- Other Services/Drivers In Memory ---
.
*Deregistered* - mwlPSDFilter
*Deregistered* - mwlPSDNServ
*Deregistered* - mwlPSDVDisk
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPService REG_MULTI_SZ HPSLPSVC
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp
.
Contents of the 'Scheduled Tasks' folder
.
2011-05-31 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-03-15 12:48]
.
2011-05-31 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-03-15 12:48]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://search.conduit.com?SearchSource=10&ctid=CT2786678
mStart Page = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0809&s=2&o=vp32&d=0310&m=aspire_5410
uInternet Settings,ProxyOverride = *.local
uSearchURL,(Default) = hxxp://www.google.com/search/?q=%s
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000
IE: Google Sidewiki... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_E11712C84EA7E12B.dll/cmsidewiki.html
TCP: DhcpNameServer = 192.168.0.1
TCP: Interfaces\{FDF2F20C-A723-4070-95F2-77AF65C46B4B}: NameServer = 10.201.56.1
FF - ProfilePath - c:\users\Brian\AppData\Roaming\Mozilla\Firefox\Profiles\1cb9zoqr.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2786678&SearchSource=3&q={searchTerms}
FF - prefs.js: browser.startup.homepage - hxxp://www.google.co.uk/
FF - prefs.js: keyword.URL - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2786678&q=
FF - user.js: network.http.max-persistent-connections-per-server - 4
FF - user.js: nglayout.initialpaint.delay - 600
FF - user.js: content.notify.interval - 600000
FF - user.js: content.max.tokenizing.time - 1800000
FF - user.js: content.switch.threshold - 600000
.
- - - - ORPHANS REMOVED - - - -
.
WebBrowser-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file)
AddRemove-01_Simmental - c:\program files\Samsung\USB Drivers\01_Simmental\Uninstall.exe
AddRemove-02_Siberian - c:\program files\Samsung\USB Drivers\02_Siberian\Uninstall.exe
AddRemove-03_Swallowtail - c:\program files\Samsung\USB Drivers\03_Swallowtail\Uninstall.exe
AddRemove-04_semseyite - c:\program files\Samsung\USB Drivers\04_semseyite\Uninstall.exe
AddRemove-05_Sloan - c:\program files\Samsung\USB Drivers\05_Sloan\Uninstall.exe
AddRemove-06_Spencer - c:\program files\Samsung\USB Drivers\06_Spencer\Uninstall.exe
AddRemove-07_Schorl - c:\program files\Samsung\USB Drivers\07_Schorl\Uninstall.exe
AddRemove-08_EMPChipset - c:\program files\Samsung\USB Drivers\08_EMPChipset\Uninstall.exe
AddRemove-09_Hsp - c:\program files\Samsung\USB Drivers\09_Hsp\Uninstall.exe
AddRemove-11_HSP_Plus_Default - c:\program files\Samsung\USB Drivers\11_HSP_Plus_Default\Uninstall.exe
AddRemove-16_Shrewsbury - c:\program files\Samsung\USB Drivers\16_Shrewsbury\Uninstall.exe
AddRemove-17_EMP_Chipset2 - c:\program files\Samsung\USB Drivers\17_EMP_Chipset2\Uninstall.exe
AddRemove-18_Zinia_Serial_Driver - c:\program files\Samsung\USB Drivers\18_Zinia_Serial_Driver\Uninstall.exe
AddRemove-19_VIA_driver - c:\program files\Samsung\USB Drivers\19_VIA_driver\Uninstall.exe
AddRemove-20_NXP_Driver - c:\program files\Samsung\USB Drivers\20_NXP_Driver\Uninstall.exe
AddRemove-21_Searsburg - c:\program files\Samsung\USB Drivers\21_Searsburg\Uninstall.exe
AddRemove-22_WiBro_WiMAX - c:\program files\Samsung\USB Drivers\22_WiBro_WiMAX\Uninstall.exe
.
.
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial "=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial "=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial "=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0003\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial "=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0004\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial "=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0005\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial "=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0006\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial "=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0007\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial "=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0008\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial "=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Completion time: 2011-06-01 00:00:38
ComboFix-quarantined-files.txt 2011-05-31 21:00
.
Pre-Run: 108,396,900,352 bytes free
Post-Run: 108,705,853,440 bytes free
.
- - End Of File - - C5BF718F1184CDDDDF314C90F60F93DC

 

Here is the requested file.

ComboFix 11-05-31.01 - Brian 01/06/2011 8:21.2.1 - x86
Microsoft Windows 7 Home Premium 6.1.7600.0.1252.44.1033.18.3002.2013 [GMT 3:00]
Running from: c:\users\Brian\Desktop\ComboFix.exe
Command switches used :: c:\users\Brian\Desktop\CFScript.txt
SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
-------\Service_Raisngsvc
.
.
((((((((((((((((((((((((( Files Created from 2011-05-01 to 2011-06-01 )))))))))))))))))))))))))))))))
.
.
2011-05-26 10:47 . 2011-05-26 10:47 -------- d-----w- c:\program files\iPod
2011-05-26 10:47 . 2011-05-26 10:48 -------- d-----w- c:\program files\iTunes
2011-05-26 10:44 . 2011-05-26 10:44 -------- d-----w- c:\program files\Bonjour
2011-05-26 06:22 . 2011-05-26 06:22 -------- d-----w- c:\program files\BBC iPlayer Desktop
2011-05-26 06:01 . 2010-09-14 06:07 276992 ----a-w- c:\windows\system32\wcncsvc.dll
2011-05-15 19:14 . 2011-05-15 19:14 781272 ----a-w- c:\program files\Mozilla Firefox\mozsqlite3.dll
2011-05-15 19:14 . 2011-05-15 19:14 1874904 ----a-w- c:\program files\Mozilla Firefox\mozjs.dll
2011-05-15 19:14 . 2011-05-15 19:14 89048 ----a-w- c:\program files\Mozilla Firefox\libEGL.dll
2011-05-15 19:14 . 2011-05-15 19:14 465880 ----a-w- c:\program files\Mozilla Firefox\libGLESv2.dll
2011-05-15 19:14 . 2011-05-15 19:14 15832 ----a-w- c:\program files\Mozilla Firefox\mozalloc.dll
2011-05-15 19:14 . 2011-05-15 19:14 1974616 ----a-w- c:\program files\Mozilla Firefox\D3DCompiler_42.dll
2011-05-15 19:14 . 2011-05-15 19:14 1892184 ----a-w- c:\program files\Mozilla Firefox\d3dx9_42.dll
2011-05-15 19:14 . 2011-05-15 19:14 142296 ----a-w- c:\program files\Mozilla Firefox\components\browsercomps.dll
2011-05-13 08:32 . 2011-05-13 08:32 -------- d-----w- c:\users\Brian\AppData\Roaming\GPS Utility
2011-05-13 08:31 . 2011-05-13 08:31 -------- d-----w- c:\program files\GPS Utility
2011-05-13 08:24 . 2011-05-13 08:24 -------- d-----w- c:\users\Brian\AppData\Local\TopoGrafix
2011-05-13 08:24 . 2011-05-13 08:24 -------- d-----w- c:\program files\EasyGPS
2011-05-13 07:51 . 2005-08-03 13:05 35892 ----a-w- c:\windows\system32\SER9PL.sys
2011-05-13 07:51 . 2005-08-03 13:04 26719 ----a-w- c:\windows\system32\SERSPL.VXD
2011-05-12 13:11 . 2011-05-12 13:11 -------- d-----w- c:\users\Brian\AppData\Roaming\Malwarebytes
2011-05-12 12:47 . 2010-12-20 15:09 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2011-05-12 12:47 . 2011-05-12 12:47 -------- d-----w- c:\programdata\Malwarebytes
2011-05-12 12:47 . 2011-05-29 17:00 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2011-05-12 12:47 . 2010-12-20 15:08 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
2011-05-10 20:22 . 2011-03-03 03:31 2331136 ----a-w- c:\windows\system32\win32k.sys
2011-05-06 04:46 . 2011-05-06 04:46 -------- d-----w- c:\program files\SoundTells
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2024-03-21 09:44 . 2010-08-26 16:31 246272 ----a-w- c:\windows\UNINST16.EXE
2011-05-20 05:03 . 2010-06-26 10:27 737072 ----a-w- c:\programdata\Microsoft\eHome\Packages\SportsV2\SportsTemplateCore\Microsoft.MediaCenter.Sports.UI.dll
2011-05-20 05:02 . 2011-03-21 03:53 4283672 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCEClientUX\UpdateableMarkup\markup.dll
2011-05-20 04:43 . 2010-08-27 05:35 42776 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCEClientUX\dSM-2\StartResources.dll
2011-05-20 04:43 . 2010-08-27 05:34 539968 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCESpotlight\MCESpotlight-2\SpotlightResources.dll
2011-04-14 12:48 . 2010-08-27 05:36 737072 ----a-w- c:\programdata\Microsoft\eHome\Packages\SportsV2\SportsTemplateCore-2\Microsoft.MediaCenter.Sports.UI.dll
2011-04-14 12:48 . 2010-08-27 05:35 4283672 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCEClientUX\UpdateableMarkup-2\markup.dll
2011-04-14 12:47 . 2010-06-26 07:01 42776 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCEClientUX\dSM\StartResources.dll
2011-04-06 13:20 . 2011-04-06 13:20 91424 ----a-w- c:\windows\system32\dnssd.dll
2011-04-06 13:20 . 2011-04-06 13:20 107808 ----a-w- c:\windows\system32\dns-sd.exe
2011-03-30 04:06 . 2011-03-30 04:06 4277016 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCEClientUX\UpdateableMarkup-3\markup.dll
2011-03-27 00:11 . 2011-03-24 07:08 737072 ----a-w- c:\programdata\Microsoft\eHome\Packages\SportsV2\SportsTemplateCore-4\Microsoft.MediaCenter.Sports.UI.dll
2011-03-25 12:19 . 2010-06-26 07:00 539968 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCESpotlight\MCESpotlight\SpotlightResources.dll
2011-03-22 12:52 . 2011-03-22 12:52 737072 ----a-w- c:\programdata\Microsoft\eHome\Packages\SportsV2\SportsTemplateCore-3\Microsoft.MediaCenter.Sports.UI.dll
2011-03-18 10:46 . 2011-03-18 10:46 61704 ----a-w- c:\windows\system32\drivers\ftdibus.sys
2011-03-18 10:46 . 2011-03-18 10:46 203144 ----a-w- c:\windows\system32\ftd2xx.dll
2011-03-18 10:46 . 2011-03-18 10:46 69000 ----a-w- c:\windows\system32\ftcserco.dll
2011-03-18 10:46 . 2011-03-18 10:46 105352 ----a-w- c:\windows\system32\ftbusui.dll
2011-03-18 10:46 . 2011-03-18 10:46 73096 ----a-w- c:\windows\system32\drivers\ftser2k.sys
2011-03-18 10:46 . 2011-03-18 10:46 201096 ----a-w- c:\windows\system32\FTLang.dll
2011-03-18 10:46 . 2011-03-18 10:46 52616 ----a-w- c:\windows\system32\ftserui2.dll
2011-05-15 19:14 . 2011-05-15 19:14 142296 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{a060276a-53be-45ec-8ebe-b94b1e803179} "= "c:\program files\Expat_Shield\tbExp0.dll" [2010-10-18 3908192]
"{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc} "= "c:\program files\uTorrentBar\tbuTor.dll" [2010-11-29 3908192]
.
[HKEY_CLASSES_ROOT\clsid\{a060276a-53be-45ec-8ebe-b94b1e803179}]
.
[HKEY_CLASSES_ROOT\clsid\{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}]
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{30F9B915-B755-4826-820B-08FBA6BD249D}]
2010-11-29 13:26 3908192 ----a-w- c:\program files\ConduitEngine\ConduitEngine.dll
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{3706EE7C-3CAD-445D-8A43-03EBC3B75908}]
2010-04-30 21:32 220208 ----a-w- c:\program files\Expat Shield\HssIE\ExpatIE.dll
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{a060276a-53be-45ec-8ebe-b94b1e803179}]
2010-10-18 10:26 3908192 ----a-w- c:\program files\Expat_Shield\tbExp0.dll
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}]
2010-11-29 13:26 3908192 ----a-w- c:\program files\uTorrentBar\tbuTor.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{a060276a-53be-45ec-8ebe-b94b1e803179} "= "c:\program files\Expat_Shield\tbExp0.dll" [2010-10-18 3908192]
"{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc} "= "c:\program files\uTorrentBar\tbuTor.dll" [2010-11-29 3908192]
"{30F9B915-B755-4826-820B-08FBA6BD249D} "= "c:\program files\ConduitEngine\ConduitEngine.dll" [2010-11-29 3908192]
.
[HKEY_CLASSES_ROOT\clsid\{a060276a-53be-45ec-8ebe-b94b1e803179}]
.
[HKEY_CLASSES_ROOT\clsid\{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}]
.
[HKEY_CLASSES_ROOT\clsid\{30f9b915-b755-4826-820b-08fba6bd249d}]
.
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{A060276A-53BE-45EC-8EBE-B94B1E803179} "= "c:\program files\Expat_Shield\tbExp0.dll" [2010-10-18 3908192]
"{BF7380FA-E3B4-4DB2-AF3E-9D8783A45BFC} "= "c:\program files\uTorrentBar\tbuTor.dll" [2010-11-29 3908192]
.
[HKEY_CLASSES_ROOT\clsid\{a060276a-53be-45ec-8ebe-b94b1e803179}]
.
[HKEY_CLASSES_ROOT\clsid\{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}]
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg "= "c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2010-03-15 68856]
"Sidebar "= "c:\program files\Windows Sidebar\sidebar.exe" [2009-07-14 1173504]
"uTorrent "= "c:\program files\uTorrent\uTorrent.exe" [2011-03-25 399736]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Acer ePower Management "= "c:\program files\Acer\Acer PowerSmart Manager\ePowerTrayLauncher.exe" [2009-08-19 487424]
"IAAnotif "= "c:\program files\Intel\Intel Matrix Storage Manager\iaanotif.exe" [2009-02-12 186904]
"LManager "= "c:\program files\Launch Manager\LManager.exe" [2009-04-09 1071624]
"ODDPwr "= "c:\program files\Acer\Optical Drive Power Management\ODDPwr.exe" [2009-09-04 186912]
"RtHDVCpl "= "c:\program files\Realtek\Audio\HDA\RtHDVCpl.exe" [2009-08-05 7703072]
"PLFSetI "= "c:\windows\PLFSetI.exe" [2008-07-29 200704]
"IgfxTray "= "c:\windows\system32\igfxtray.exe" [2009-09-02 135168]
"HotKeysCmds "= "c:\windows\system32\hkcmd.exe" [2009-09-02 167424]
"Persistence "= "c:\windows\system32\igfxpers.exe" [2009-09-02 144384]
"Adobe Reader Speed Launcher "= "c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2011-01-31 35760]
"Adobe ARM "= "c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-09-20 932288]
"B2C_AGENT "= "c:\programdata\LGMOBILEAX\B2C_Client\B2CNotiAgent.exe" [2011-01-13 395192]
"Malwarebytes' Anti-Malware (reboot) "= "c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2010-12-20 963976]
"iTunesHelper "= "c:\program files\iTunes\iTunesHelper.exe" [2011-04-26 421160]
.
c:\users\Brian\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
BBC iPlayer Desktop.lnk - c:\program files\BBC iPlayer Desktop\BBC iPlayer Desktop.exe [2011-5-26 142848]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2009-11-18 275072]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin "= 0 (0x0)
"ConsentPromptBehaviorUser "= 3 (0x3)
"EnableUIADesktopToggle "= 0 (0x0)
"PromptOnSecureDesktop "= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk *\0c:\progra~1\AVG\AVG10\avgchsvx.exe /sync\0c:\progra~1\AVG\AVG10\avgrsx.exe /sync /restart
.
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"ProductReg "= "c:\program files\Acer\WR_PopUp\ProductReg.exe "
"uTorrent "= "c:\program files\uTorrent\uTorrent.exe "
"swg "= "c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe "
"AutoStartNPSAgent "=c:\program files\Samsung\Samsung New PC Studio\NPSAgent.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"EgisTecLiveUpdate "= "c:\program files\EgisTec Egis Software Update\EgisUpdate.exe "
"SunJavaUpdateSched "= "c:\program files\Common Files\Java\Java Update\jusched.exe "
"QuickTime Task "= "c:\program files\QuickTime\QTTask.exe" -atboottime
"HP Software Update "=c:\program files\HP\HP Software Update\HPWuSchd2.exe
"iTunesHelper "= "c:\program files\iTunes\iTunesHelper.exe "
"Adobe Reader Speed Launcher "= "c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe "
"Adobe ARM "= "c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe "
"PDVD8LanguageShortcut "= "c:\program files\CyberLink\PowerDVD8\Language\Language.exe "
"RemoteControl8 "= "c:\program files\CyberLink\PowerDVD8\PDVD8Serv.exe "
"SynTPEnh "=c:\program files\Synaptics\SynTP\SynTPEnh.exe
"B2C_AGENT "=c:\programdata\LGMOBILEAX\B2C_Client\B2CNotiAgent.exe
"BackupManagerTray "= "c:\program files\NewTech Infosystems\Acer Backup Manager\BackupManagerTray.exe" -k
"NeroFilterCheck "=c:\program files\Common Files\Ahead\Lib\NeroCheck.exe
.
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [2010-03-15 135664]
R3 btusbflt;Bluetooth USB Filter;c:\windows\system32\drivers\btusbflt.sys [2010-04-13 45736]
R3 ExpatTrayService;Expat Shield Tray Service;c:\program files\Expat Shield\bin\ExpatTrayService.EXE [2010-05-06 54516]
R3 FlashUSB;FlashUSB;c:\windows\system32\DRIVERS\FlashUSB.sys [2010-05-12 16896]
R3 gupdatem;Google Update Service (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [2010-03-15 135664]
R3 NTIBackupSvc;NTI Backup Now 5 Backup Service;c:\program files\NewTech Infosystems\NTI Backup Now 5\BackupSvc.exe [2008-09-23 50424]
R3 usb2vcom;USB to Serial Bridge Controller;c:\windows\system32\Drivers\usb2vcom.sys [2005-09-02 28928]
R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [2010-05-20 1343400]
S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [2009-07-13 48128]
S2 DsiWMIService;Dritek WMI Service;c:\program files\Launch Manager\dsiwmis.exe [2009-04-11 117256]
S2 ePowerSvc;Acer ePower Service;c:\program files\Acer\Acer PowerSmart Manager\ePowerSvc.exe [2009-08-19 688128]
S2 ExpatShieldService;Expat Shield Service;c:\program files\Expat Shield\bin\openvpnas.exe [2010-05-06 248368]
S2 ExpatWd;Expat Shield Monitoring Service;c:\program files\Expat Shield\bin\hsswd.exe [2010-04-30 199728]
S2 FsUsbExService;FsUsbExService;c:\windows\system32\FsUsbExService.Exe [2010-07-04 238952]
S2 NTI IScheduleSvc;NTI IScheduleSvc;c:\program files\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe [2009-05-26 62208]
S2 NTISchedulerSvc;NTI Backup Now 5 Scheduler Service;c:\program files\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe [2008-09-23 144632]
S2 ODDPwrSvc;Acer ODD Power Service;c:\program files\Acer\Optical Drive Power Management\ODDPWRSvc.exe [2009-09-04 125472]
S2 RS_Service;Raw Socket Service;c:\program files\Acer\Acer VCM\RS_Service.exe [2009-02-05 237568]
S2 SBKUPNT;SBKUPNT;c:\windows\system32\Drivers\SBKUPNT.SYS [2001-07-13 14976]
S2 TuneUp.UtilitiesSvc;TuneUp Utilities Service;c:\program files\TuneUp Utilities 2011\TuneUpUtilitiesService32.exe [2010-10-27 1483072]
S3 FsUsbExDisk;FsUsbExDisk;c:\windows\system32\FsUsbExDisk.SYS [2010-06-14 36608]
S3 IntcHdmiAddService;Intel(R) High Definition Audio HDMI;c:\windows\system32\drivers\IntcHdmi.sys [2008-12-05 112640]
S3 L1C;NDIS Miniport Driver for Atheros AR813x/AR815x PCI-E Ethernet Controller;c:\windows\system32\DRIVERS\L1C62x86.sys [2009-11-13 58368]
S3 TuneUpUtilitiesDrv;TuneUpUtilitiesDrv;c:\program files\TuneUp Utilities 2011\TuneUpUtilitiesDriver32.sys [2010-10-07 10064]
S3 vwifimp;Microsoft Virtual WiFi Miniport Service;c:\windows\system32\DRIVERS\vwifimp.sys [2009-07-13 14336]
.
.
--- Other Services/Drivers In Memory ---
.
*Deregistered* - mwlPSDFilter
*Deregistered* - mwlPSDNServ
*Deregistered* - mwlPSDVDisk
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPService REG_MULTI_SZ HPSLPSVC
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp
.
Contents of the 'Scheduled Tasks' folder
.
2011-06-01 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-03-15 12:48]
.
2011-06-01 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-03-15 12:48]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://search.conduit.com?SearchSource=10&ctid=CT2786678
mStart Page = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0809&s=2&o=vp32&d=0310&m=aspire_5410
uInternet Settings,ProxyOverride = *.local
uSearchURL,(Default) = hxxp://www.google.com/search/?q=%s
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000
IE: Google Sidewiki... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_E11712C84EA7E12B.dll/cmsidewiki.html
TCP: DhcpNameServer = 192.168.0.1
TCP: Interfaces\{FDF2F20C-A723-4070-95F2-77AF65C46B4B}: NameServer = 10.201.56.1
FF - ProfilePath - c:\users\Brian\AppData\Roaming\Mozilla\Firefox\Profiles\1cb9zoqr.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2786678&SearchSource=3&q={searchTerms}
FF - prefs.js: browser.startup.homepage - hxxp://www.google.co.uk/
FF - prefs.js: keyword.URL - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2786678&q=
FF - user.js: network.http.max-persistent-connections-per-server - 4
FF - user.js: nglayout.initialpaint.delay - 600
FF - user.js: content.notify.interval - 600000
FF - user.js: content.max.tokenizing.time - 1800000
FF - user.js: content.switch.threshold - 600000
.
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial "=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial "=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial "=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0003\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial "=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0004\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial "=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0005\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial "=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0006\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial "=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0007\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial "=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0008\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial "=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
------------------------ Other Running Processes ------------------------
.
c:\windows\system32\taskhost.exe
c:\program files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Intel\Intel Matrix Storage Manager\IAANTMon.exe
c:\program files\TuneUp Utilities 2011\TuneUpUtilitiesApp32.exe
c:\windows\system32\conhost.exe
c:\windows\system32\wbem\unsecapp.exe
c:\windows\system32\igfxsrvc.exe
c:\windows\system32\igfxext.exe
c:\windows\system32\igfxsrvc.exe
c:\program files\iPod\bin\iPodService.exe
c:\program files\Common Files\HP\Digital Imaging\Bin\hpqPhotoCrm.exe
c:\program files\Windows Media Player\wmpnetwk.exe
c:\program files\HP\Digital Imaging\bin\hpqSTE08.exe
c:\program files\HP\Digital Imaging\bin\hpqbam08.exe
c:\program files\HP\Digital Imaging\bin\hpqgpc01.exe
c:\windows\system32\sppsvc.exe
.
**************************************************************************
.
Completion time: 2011-06-01 08:37:56 - machine was rebooted
ComboFix-quarantined-files.txt 2011-06-01 05:37
ComboFix2.txt 2011-05-31 21:00
.
Pre-Run: 107,647,959,040 bytes free
Post-Run: 107,469,357,056 bytes free
.
- - End Of File - - 82C14D7B75A6368C0FEB72E4FB50CE3A

 

You say it "looks good" was there an infection or should I be looking at one of the other machines connected to my network?

Here in the first of the two requested reports. (OTL.txt)

OTL logfile created on: 02/06/2011 03:55:32 - Run 1
OTL by OldTimer - Version 3.2.23.0 Folder = C:\Users\Brian\Desktop
Home Premium Edition (Version = 6.1.7600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7600.16385)
Locale: 00000809 | Country: United Kingdom | Language: ENG | Date Format: dd/MM/yyyy

2.93 Gb Total Physical Memory | 1.70 Gb Available Physical Memory | 58.11% Memory free
5.86 Gb Paging File | 4.65 Gb Available in Paging File | 79.28% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 223.12 Gb Total Space | 101.08 Gb Free Space | 45.30% Space Free | Partition Type: NTFS
Drive E: | 36.40 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS

Computer Name: BRIAN-5410 | User Name: Brian | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2011/06/02 03:53:02 | 000,580,096 | ---- | M] (OldTimer Tools) -- C:\Users\Brian\Desktop\OTL.exe
PRC - [2011/05/26 09:21:39 | 000,142,848 | ---- | M] () -- C:\Program Files\BBC iPlayer Desktop\BBC iPlayer Desktop.exe
PRC - [2011/04/18 17:40:08 | 002,334,560 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG10\avgtray.exe
PRC - [2011/04/18 17:39:42 | 007,398,752 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSAgent.exe
PRC - [2011/04/14 05:36:42 | 001,080,672 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG10\avgnsx.exe
PRC - [2011/03/28 03:00:52 | 000,351,072 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG10\avgcsrvx.exe
PRC - [2011/03/25 22:33:10 | 000,399,736 | ---- | M] (BitTorrent, Inc.) -- C:\Program Files\uTorrent\uTorrent.exe
PRC - [2011/03/16 16:05:20 | 001,025,888 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG10\avgemcx.exe
PRC - [2011/03/16 16:05:14 | 000,656,736 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG10\avgchsvx.exe
PRC - [2011/02/10 07:55:18 | 001,148,256 | ---- | M] () -- C:\Program Files\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSMonitor.exe
PRC - [2011/02/08 05:33:42 | 000,269,520 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG10\avgwdsvc.exe
PRC - [2011/02/08 05:33:20 | 000,658,784 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG10\avgrsx.exe
PRC - [2010/10/27 19:24:42 | 000,645,952 | ---- | M] (TuneUp Software) -- C:\Program Files\TuneUp Utilities 2011\TuneUpUtilitiesApp32.exe
PRC - [2010/10/27 19:23:16 | 001,483,072 | ---- | M] (TuneUp Software) -- C:\Program Files\TuneUp Utilities 2011\TuneUpUtilitiesService32.exe
PRC - [2010/07/04 20:07:40 | 000,238,952 | ---- | M] (Teruten) -- C:\Windows\System32\FsUsbExService.Exe
PRC - [2010/05/06 20:48:48 | 000,248,368 | ---- | M] () -- C:\Program Files\Expat Shield\bin\openvpnas.exe
PRC - [2010/05/01 00:32:14 | 000,199,728 | ---- | M] () -- C:\Program Files\Expat Shield\bin\hsswd.exe
PRC - [2009/10/31 08:45:39 | 002,614,272 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe
PRC - [2009/09/04 16:42:12 | 000,125,472 | ---- | M] (Acer Incorporated) -- C:\Program Files\Acer\Optical Drive Power Management\ODDPWRSvc.exe
PRC - [2009/09/04 16:42:10 | 000,186,912 | ---- | M] (Acer Incorporated) -- C:\Program Files\Acer\Optical Drive Power Management\ODDPWR.exe
PRC - [2009/08/19 16:15:32 | 000,688,128 | ---- | M] (Acer Incorporated) -- C:\Program Files\Acer\Acer PowerSmart Manager\ePowerSvc.exe
PRC - [2009/07/14 04:14:42 | 000,049,152 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\taskhost.exe
PRC - [2009/07/14 04:14:15 | 000,271,360 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\conhost.exe
PRC - [2009/05/26 16:26:20 | 000,062,208 | ---- | M] (NewTech Infosystems, Inc.) -- C:\Program Files\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe
PRC - [2009/05/21 19:58:14 | 000,413,496 | ---- | M] (Hewlett-Packard Co.) -- C:\Program Files\Common Files\HP\Digital Imaging\Bin\hpqPhotoCrm.exe
PRC - [2009/04/11 05:11:20 | 000,117,256 | ---- | M] (Dritek System Inc.) -- C:\Program Files\Launch Manager\dsiwmis.exe
PRC - [2009/04/09 03:56:14 | 001,071,624 | ---- | M] (Dritek System Inc.) -- C:\Program Files\Launch Manager\LManager.exe
PRC - [2009/02/12 03:38:40 | 000,354,840 | ---- | M] (Intel Corporation) -- C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTmon.exe
PRC - [2009/02/05 09:14:56 | 000,237,568 | ---- | M] (Acer Incorporated) -- C:\Program Files\Acer\Acer VCM\RS_Service.exe


========== Modules (SafeList) ==========

MOD - [2011/06/02 03:53:02 | 000,580,096 | ---- | M] (OldTimer Tools) -- C:\Users\Brian\Desktop\OTL.exe
MOD - [2009/07/14 04:03:50 | 001,680,896 | ---- | M] (Microsoft Corporation) -- C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7600.16385_none_421189da2b7fabfc\comctl32.dll


========== Win32 Services (SafeList) ==========

SRV - [2011/04/18 17:39:42 | 007,398,752 | ---- | M] (AVG Technologies CZ, s.r.o.) [Auto | Running] -- C:\Program Files\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSAgent.exe -- (AVGIDSAgent)
SRV - [2011/02/08 05:33:42 | 000,269,520 | ---- | M] (AVG Technologies CZ, s.r.o.) [Auto | Running] -- C:\Program Files\AVG\AVG10\avgwdsvc.exe -- (avgwd)
SRV - [2010/10/27 19:23:16 | 001,483,072 | ---- | M] (TuneUp Software) [Auto | Running] -- C:\Program Files\TuneUp Utilities 2011\TuneUpUtilitiesService32.exe -- (TuneUp.UtilitiesSvc)
SRV - [2010/10/27 19:21:08 | 000,029,504 | ---- | M] (TuneUp Software) [Auto | Running] -- C:\Windows\System32\uxtuneup.dll -- (UxTuneUp)
SRV - [2010/07/04 20:07:40 | 000,238,952 | ---- | M] (Teruten) [Auto | Running] -- C:\Windows\System32\FsUsbExService.Exe -- (FsUsbExService)
SRV - [2010/05/20 20:24:37 | 001,343,400 | ---- | M] (Microsoft Corporation) [Unknown | Stopped] -- C:\Windows\System32\Wat\WatAdminSvc.exe -- (WatAdminSvc)
SRV - [2010/05/06 20:50:32 | 000,054,516 | ---- | M] () [On_Demand | Stopped] -- C:\Program Files\Expat Shield\bin\ExpatTrayService.exe -- (ExpatTrayService)
SRV - [2010/05/06 20:48:48 | 000,248,368 | ---- | M] () [Auto | Running] -- C:\Program Files\Expat Shield\bin\openvpnas.exe -- (ExpatShieldService)
SRV - [2010/05/01 00:32:14 | 000,199,728 | ---- | M] () [Auto | Running] -- C:\Program Files\Expat Shield\bin\hsswd.exe -- (ExpatWd)
SRV - [2009/09/04 16:42:12 | 000,125,472 | ---- | M] (Acer Incorporated) [Auto | Running] -- C:\Program Files\Acer\Optical Drive Power Management\ODDPWRSvc.exe -- (ODDPwrSvc)
SRV - [2009/08/19 16:15:32 | 000,688,128 | ---- | M] (Acer Incorporated) [Auto | Running] -- C:\Program Files\Acer\Acer PowerSmart Manager\ePowerSvc.exe -- (ePowerSvc)
SRV - [2009/07/14 04:16:13 | 000,025,088 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\sensrsvc.dll -- (SensrSvc)
SRV - [2009/07/14 04:15:41 | 000,680,960 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)
SRV - [2009/05/26 16:26:20 | 000,062,208 | ---- | M] (NewTech Infosystems, Inc.) [Auto | Running] -- C:\Program Files\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe -- (NTI IScheduleSvc)
SRV - [2009/04/11 05:11:20 | 000,117,256 | ---- | M] (Dritek System Inc.) [Auto | Running] -- C:\Program Files\Launch Manager\dsiwmis.exe -- (DsiWMIService)
SRV - [2009/02/12 03:38:40 | 000,354,840 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTmon.exe -- (IAANTMON) Intel(R)
SRV - [2009/02/05 09:14:56 | 000,237,568 | ---- | M] (Acer Incorporated) [Auto | Running] -- C:\Program Files\Acer\Acer VCM\RS_Service.exe -- (RS_Service)


========== Driver Services (SafeList) ==========

DRV - [2011/04/14 21:28:30 | 000,134,480 | ---- | M] (AVG Technologies CZ, s.r.o. ) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\AVGIDSDriver.sys -- (AVGIDSDriver)
DRV - [2011/04/05 00:59:56 | 000,297,168 | ---- | M] (AVG Technologies CZ, s.r.o.) [Kernel | System | Running] -- C:\Windows\System32\drivers\avgtdix.sys -- (Avgtdix)
DRV - [2011/03/18 13:46:26 | 000,061,704 | ---- | M] (FTDI Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ftdibus.sys -- (FTDIBUS)
DRV - [2011/03/18 13:46:10 | 000,073,096 | ---- | M] (FTDI Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ftser2k.sys -- (FTSER2K)
DRV - [2011/03/16 16:03:20 | 000,032,592 | ---- | M] (AVG Technologies CZ, s.r.o.) [File_System | Boot | Running] -- C:\Windows\system32\DRIVERS\avgrkx86.sys -- (Avgrkx86)
DRV - [2011/03/01 14:25:18 | 000,034,896 | ---- | M] (AVG Technologies CZ, s.r.o.) [File_System | System | Running] -- C:\Windows\System32\drivers\avgmfx86.sys -- (Avgmfx86)
DRV - [2011/02/22 08:12:50 | 000,022,992 | ---- | M] (AVG Technologies CZ, s.r.o. ) [Kernel | Boot | Stopped] -- C:\Windows\system32\DRIVERS\AVGIDSEH.Sys -- (AVGIDSEH)
DRV - [2011/02/10 07:53:42 | 000,021,968 | ---- | M] (AVG Technologies CZ, s.r.o. ) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\AVGIDSShim.sys -- (AVGIDSShim)
DRV - [2011/02/10 07:53:40 | 000,024,144 | ---- | M] (AVG Technologies CZ, s.r.o. ) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\AVGIDSFilter.sys -- (AVGIDSFilter)
DRV - [2011/01/07 06:41:46 | 000,248,656 | ---- | M] (AVG Technologies CZ, s.r.o.) [Kernel | System | Running] -- C:\Windows\System32\drivers\avgldx86.sys -- (Avgldx86)
DRV - [2010/10/07 14:34:32 | 000,010,064 | ---- | M] (TuneUp Software) [Kernel | On_Demand | Running] -- C:\Program Files\TuneUp Utilities 2011\TuneUpUtilitiesDriver32.sys -- (TuneUpUtilitiesDrv)
DRV - [2010/06/14 10:32:54 | 000,036,608 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\System32\FsUsbExDisk.Sys -- (FsUsbExDisk)
DRV - [2010/05/12 13:23:04 | 000,016,896 | ---- | M] (Danish Wireless Design A/S) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\FlashUSB.sys -- (FlashUSB)
DRV - [2010/05/01 00:32:12 | 000,032,768 | ---- | M] (AnchorFree Inc) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\taphss.sys -- (taphss)
DRV - [2010/04/27 05:25:20 | 000,132,424 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\sscdmdm.sys -- (sscdmdm)
DRV - [2010/04/27 05:25:20 | 000,104,648 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\sscdbus.sys -- (sscdbus) SAMSUNG USB Composite Device driver (WDM)
DRV - [2010/04/27 05:25:20 | 000,014,920 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\sscdmdfl.sys -- (sscdmdfl)
DRV - [2010/04/27 05:25:12 | 000,123,776 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ss_mdm.sys -- (ss_mdm)
DRV - [2010/04/27 05:25:12 | 000,098,560 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ss_bus.sys -- (ss_bus) SAMSUNG Mobile USB Device 1.0 driver (WDM)
DRV - [2010/04/27 05:25:12 | 000,014,848 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ss_mdfl.sys -- (ss_mdfl)
DRV - [2010/04/14 01:01:48 | 000,045,736 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\btusbflt.sys -- (btusbflt)
DRV - [2010/03/15 19:03:38 | 000,005,632 | ---- | M] () [File_System | System | Running] -- C:\Windows\System32\drivers\StarOpen.sys -- (StarOpen)
DRV - [2009/11/13 09:47:50 | 000,058,368 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\L1C62x86.sys -- (L1C)
DRV - [2009/10/05 16:31:50 | 001,221,632 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\athr.sys -- (athr)
DRV - [2009/07/14 02:52:10 | 000,014,336 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\vwifimp.sys -- (vwifimp)
DRV - [2009/07/14 02:51:11 | 000,034,944 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\winusb.sys -- (WinUsb)
DRV - [2008/12/05 13:25:38 | 000,112,640 | ---- | M] (Intel(R) Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\IntcHdmi.sys -- (IntcHdmiAddService) Intel(R)
DRV - [2008/11/11 14:42:00 | 000,024,832 | ---- | M] (LG Electronics Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\lgusbmodem.sys -- (USBModem)
DRV - [2008/11/11 14:41:00 | 000,019,968 | ---- | M] (LG Electronics Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\lgusbdiag.sys -- (UsbDiag)
DRV - [2008/11/11 14:41:00 | 000,013,056 | ---- | M] (LG Electronics Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\lgusbbus.sys -- (usbbus)
DRV - [2008/01/19 06:49:30 | 000,030,208 | ---- | M] (SigmaTel, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\irstusb.sys -- (STIrUsb)
DRV - [2007/06/17 13:43:50 | 000,186,592 | ---- | M] (Jungo) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\windrvr6.sys -- (WinDriver6)
DRV - [2005/09/02 17:49:46 | 000,028,928 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\usb2vcom.sys -- (usb2vcom)
DRV - [2001/07/13 13:56:14 | 000,014,976 | ---- | M] () [Kernel | Auto | Running] -- C:\Windows\System32\drivers\SBKUPNT.SYS -- (SBKUPNT)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://homepage.acer.com/rdr.aspx?b=ACAW&l=0809&s=2&o=vp32&d=0310&m=aspire_5410
IE - HKLM\..\URLSearchHook: {a060276a-53be-45ec-8ebe-b94b1e803179} - C:\Program Files\Expat_Shield\tbExp0.dll (Conduit Ltd.)
IE - HKLM\..\URLSearchHook: {bf7380fa-e3b4-4db2-af3e-9d8783a45bfc} - C:\Program Files\uTorrentBar\tbuTor.dll (Conduit Ltd.)

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = http://global.acer.com [binary data]
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchDefaultBranded = 1
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://search.conduit.com?SearchSource=10&ctid=CT2786678
IE - HKCU\..\URLSearchHook: {a060276a-53be-45ec-8ebe-b94b1e803179} - C:\Program Files\Expat_Shield\tbExp0.dll (Conduit Ltd.)
IE - HKCU\..\URLSearchHook: {bf7380fa-e3b4-4db2-af3e-9d8783a45bfc} - C:\Program Files\uTorrentBar\tbuTor.dll (Conduit Ltd.)
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

========== FireFox ==========

FF - prefs.js..browser.search.defaultthis.engineName: " "
FF - prefs.js..browser.search.defaulturl: "http://search.conduit.com/ResultsExt.aspx?ctid=CT2786678&SearchSource=3&q={searchTerms} "
FF - prefs.js..browser.startup.homepage: "http://www.google.co.uk/ "
FF - prefs.js..extensions.enabledItems: ietab@ip.cn:1.98.20110322
FF - prefs.js..extensions.enabledItems: {AB2CE124-6272-4b12-94A9-7303C7397BD1}:5.0.0.6906
FF - prefs.js..extensions.enabledItems: en-GB@dictionaries.addons.mozilla.org:1.19.1
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}:6.0.21
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}:6.0.22
FF - prefs.js..extensions.enabledItems: {a060276a-53be-45ec-8ebe-b94b1e803179}:3.3.3.2
FF - prefs.js..extensions.enabledItems: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:1.3.7
FF - prefs.js..extensions.enabledItems: 2020Player@2020Technologies.com:4.5.2.0
FF - prefs.js..extensions.enabledItems: engine@conduit.com:3.3.3.2
FF - prefs.js..extensions.enabledItems: {bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}:3.3.3.2
FF - prefs.js..extensions.enabledItems: {1E73965B-8B48-48be-9C8D-68B920ABC1C4}:10.0.0.1209
FF - prefs.js..keyword.URL: "http://search.conduit.com/ResultsExt.aspx?ctid=CT2786678&q= "


FF - HKLM\software\mozilla\Firefox\Extensions\\smartwebprinting@hp.com: C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2010/05/26 20:54:55 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Firefox\Extensions\\{1E73965B-8B48-48be-9C8D-68B920ABC1C4}: C:\Program Files\AVG\AVG10\Firefox4\ [2011/06/01 10:11:02 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 4.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2011/05/15 22:14:16 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 4.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2011/05/15 22:14:16 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Thunderbird 3.1.10\extensions\\Components: C:\Program Files\Mozilla Thunderbird\components [2011/04/30 21:24:00 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Thunderbird 3.1.10\extensions\\Plugins: C:\Program Files\Mozilla Thunderbird\plugins

[2010/05/27 20:24:26 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Brian\AppData\Roaming\Mozilla\Extensions
[2010/05/27 20:24:26 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Brian\AppData\Roaming\Mozilla\Extensions\{3550f703-e582-4d05-9a08-453d09bdfdc6}
[2011/05/26 07:04:22 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Brian\AppData\Roaming\Mozilla\Firefox\Profiles\1cb9zoqr.default\extensions
[2011/05/08 07:06:26 | 000,000,000 | ---D | M] (Expat Shield Community Toolbar) -- C:\Users\Brian\AppData\Roaming\Mozilla\Firefox\Profiles\1cb9zoqr.default\extensions\{a060276a-53be-45ec-8ebe-b94b1e803179}
[2011/05/08 07:06:28 | 000,000,000 | ---D | M] (uTorrentBar Community Toolbar) -- C:\Users\Brian\AppData\Roaming\Mozilla\Firefox\Profiles\1cb9zoqr.default\extensions\{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}
[2010/11/21 10:04:36 | 000,000,000 | ---D | M] (20-20 3D Viewer) -- C:\Users\Brian\AppData\Roaming\Mozilla\Firefox\Profiles\1cb9zoqr.default\extensions\2020Player@2020Technologies.com
[2010/12/16 18:44:37 | 000,000,000 | ---D | M] (British English Dictionary) -- C:\Users\Brian\AppData\Roaming\Mozilla\Firefox\Profiles\1cb9zoqr.default\extensions\en-GB@dictionaries.addons.mozilla.org
[2011/05/08 07:06:25 | 000,000,000 | ---D | M] (Conduit Engine) -- C:\Users\Brian\AppData\Roaming\Mozilla\Firefox\Profiles\1cb9zoqr.default\extensions\engine@conduit.com
[2011/03/26 17:09:51 | 000,000,000 | ---D | M] (IE Tab Plus) -- C:\Users\Brian\AppData\Roaming\Mozilla\Firefox\Profiles\1cb9zoqr.default\extensions\ietab@ip.cn
[2010/12/14 23:22:48 | 000,000,863 | ---- | M] () -- C:\Users\Brian\AppData\Roaming\Mozilla\Firefox\Profiles\1cb9zoqr.default\searchplugins\conduit.xml
[2010/12/15 06:52:02 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions
[2011/02/20 15:18:50 | 000,000,000 | ---D | M] (Skype extension) -- C:\Program Files\Mozilla Firefox\extensions\{AB2CE124-6272-4b12-94A9-7303C7397BD1}
[2010/08/15 12:52:47 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}
[2010/11/11 20:59:00 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}
File not found (No name found) --
[2011/06/01 10:11:02 | 000,000,000 | ---D | M] (AVG Safe Search) -- C:\PROGRAM FILES\AVG\AVG10\FIREFOX4
() (No name found) -- C:\USERS\BRIAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\1CB9ZOQR.DEFAULT\EXTENSIONS\{D10D0BF8-F5B5-C8B4-A8B2-2B9879E08C5D}.XPI
[2011/05/15 22:14:08 | 000,142,296 | ---- | M] (Mozilla Foundation) -- C:\Program Files\Mozilla Firefox\components\browsercomps.dll
[2009/11/06 19:37:19 | 000,091,552 | ---- | M] (Coupons, Inc.) -- C:\Program Files\Mozilla Firefox\plugins\npCouponPrinter.dll
[2010/09/15 05:50:38 | 000,472,808 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\Mozilla Firefox\plugins\npdeployJava1.dll
[2009/11/06 19:37:20 | 000,091,552 | ---- | M] (Coupons, Inc.) -- C:\Program Files\Mozilla Firefox\plugins\npMozCouponPrinter.dll
[2011/05/15 22:14:11 | 000,001,538 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\amazon-en-GB.xml
[2011/05/15 22:14:11 | 000,002,252 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\bing.xml
[2011/05/15 22:14:11 | 000,000,947 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\chambers-en-GB.xml
[2011/05/15 22:14:11 | 000,001,180 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\eBay-en-GB.xml
[2011/05/15 22:14:11 | 000,001,135 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\yahoo-en-GB.xml

O1 HOSTS File: ([2011/06/01 08:32:38 | 000,000,027 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (Conduit Engine) - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Program Files\ConduitEngine\ConduitEngine.dll (Conduit Ltd.)
O2 - BHO: (Expat Shield Class) - {3706EE7C-3CAD-445D-8A43-03EBC3B75908} - C:\Program Files\Expat Shield\HssIE\ExpatIE.dll (AnchorFree Inc.)
O2 - BHO: (AVG Safe Search) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG10\avgssie.dll (AVG Technologies CZ, s.r.o.)
O2 - BHO: (Expat Shield Toolbar) - {a060276a-53be-45ec-8ebe-b94b1e803179} - C:\Program Files\Expat_Shield\tbExp0.dll (Conduit Ltd.)
O2 - BHO: (Skype Plug-In) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.6.5805.1910\swg.dll (Google Inc.)
O2 - BHO: (uTorrentBar Toolbar) - {bf7380fa-e3b4-4db2-af3e-9d8783a45bfc} - C:\Program Files\uTorrentBar\tbuTor.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (Conduit Engine) - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Program Files\ConduitEngine\ConduitEngine.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (Expat Shield Toolbar) - {a060276a-53be-45ec-8ebe-b94b1e803179} - C:\Program Files\Expat_Shield\tbExp0.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (uTorrentBar Toolbar) - {bf7380fa-e3b4-4db2-af3e-9d8783a45bfc} - C:\Program Files\uTorrentBar\tbuTor.dll (Conduit Ltd.)
O3 - HKCU\..\Toolbar\WebBrowser: (Expat Shield Toolbar) - {A060276A-53BE-45EC-8EBE-B94B1E803179} - C:\Program Files\Expat_Shield\tbExp0.dll (Conduit Ltd.)
O3 - HKCU\..\Toolbar\WebBrowser: (uTorrentBar Toolbar) - {BF7380FA-E3B4-4DB2-AF3E-9D8783A45BFC} - C:\Program Files\uTorrentBar\tbuTor.dll (Conduit Ltd.)
O4 - HKLM..\Run: [Acer ePower Management] C:\Program Files\Acer\Acer PowerSmart Manager\ePowerTrayLauncher.exe (Acer Incorporated)
O4 - HKLM..\Run: [AVG_TRAY] C:\Program Files\AVG\AVG10\avgtray.exe (AVG Technologies CZ, s.r.o.)
O4 - HKLM..\Run: [B2C_AGENT] C:\ProgramData\LGMOBILEAX\B2C_Client\B2CNotiAgent.exe (LG Electronics)
O4 - HKLM..\Run: [IAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe (Intel Corporation)
O4 - HKLM..\Run: [LManager] C:\Program Files\Launch Manager\LManager.exe (Dritek System Inc.)
O4 - HKLM..\Run: [Malwarebytes' Anti-Malware (reboot)] C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe (Malwarebytes Corporation)
O4 - HKLM..\Run: [ODDPwr] C:\Program Files\Acer\Optical Drive Power Management\ODDPwr.exe (Acer Incorporated)
O4 - HKLM..\Run: [PLFSetI] C:\Windows\PLFSetI.exe ()
O4 - HKCU..\Run: [uTorrent] C:\Program Files\uTorrent\uTorrent.exe (BitTorrent, Inc.)
O4 - Startup: C:\Users\Brian\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\BBC iPlayer Desktop.lnk = C:\Program Files\BBC iPlayer Desktop\BBC iPlayer Desktop.exe ()
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Low Rights present
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O8 - Extra context menu item: Google Sidewiki... - C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_E11712C84EA7E12B.dll (Google Inc.)
O9 - Extra Button: Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra 'Tools' menuitem : Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000008 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O16 - DPF: {1C11B948-582A-433F-A98D-A8C4D5CC64F2} http://magnet.2020.net/virtualplanner/Core/Player/2020PlayerAX_Win32.cab (20-20 3D Viewer)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {F27237D7-93C8-44C2-AC6E-D6057B9A918F} https://juniper.net/dana-cached/sc/JuniperSetupClient.cab (JuniperSetupClientControl Class)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.0.1
O18 - Protocol\Handler\linkscanner {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG10\avgpp.dll (AVG Technologies CZ, s.r.o.)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O24 - Desktop WallPaper:
O24 - Desktop BackupWallPaper:
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009/06/11 00:42:20 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O32 - AutoRun File - [2010/08/15 11:22:36 | 045,871,448 | ---- | M] () - C:\autotuna.zip -- [ NTFS ]
O32 - AutoRun File - [2005/08/08 08:27:48 | 000,000,050 | R--- | M] () - E:\autorun.bat -- [ CDFS ]
O32 - AutoRun File - [2005/08/03 08:36:34 | 000,000,028 | R--- | M] () - E:\autorun.inf -- [ CDFS ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O34 - HKLM BootExecute: (C:\PROGRA~1\AVG\AVG10\avgchsvx.exe /sync) - C:\Program Files\AVG\AVG10\avgchsvx.exe (AVG Technologies CZ, s.r.o.)
O34 - HKLM BootExecute: (C:\PROGRA~1\AVG\AVG10\avgrsx.exe /sync /restart) - C:\Program Files\AVG\AVG10\avgrsx.exe (AVG Technologies CZ, s.r.o.)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = ComFile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*

NetSvcs: FastUserSwitchingCompatibility - File not found
NetSvcs: Ias - File not found
NetSvcs: Nla - File not found
NetSvcs: Ntmssvc - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: SRService - File not found
NetSvcs: UxTuneUp - C:\Windows\System32\uxtuneup.dll (TuneUp Software)
NetSvcs: WmdmPmSp - File not found
NetSvcs: LogonHours - File not found
NetSvcs: PCAudit - File not found
NetSvcs: helpsvc - File not found
NetSvcs: uploadmgr - File not found

Drivers32: msacm.l3acm - C:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: MSVideo8 - C:\Windows\System32\vfwwdm32.dll (Microsoft Corporation)
Drivers32: vidc.cvid - C:\Windows\System32\iccvid.dll (Radius Inc.)
Drivers32: vidc.ffds - C:\Program Files\ffdshow\ffdshow.ax ()


========== Files/Folders - Created Within 30 Days ==========

[2011/06/02 03:52:27 | 000,580,096 | ---- | C] (OldTimer Tools) -- C:\Users\Brian\Desktop\OTL.exe
[2011/06/01 10:20:40 | 000,000,000 | ---D | C] -- C:\Users\Brian\AppData\Roaming\AVG10
[2011/06/01 10:11:05 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AVG 2011
[2011/06/01 10:10:09 | 000,000,000 | ---D | C] -- C:\ProgramData\AVG10
[2011/06/01 10:09:23 | 000,000,000 | ---D | C] -- C:\Program Files\AVG
[2011/06/01 08:44:45 | 000,000,000 | ---D | C] -- C:\ProgramData\MFAData
[2011/06/01 08:37:02 | 000,000,000 | -HSD | C] -- C:\$RECYCLE.BIN
[2011/05/31 23:31:11 | 000,518,144 | ---- | C] (SteelWerX) -- C:\Windows\SWREG.exe
[2011/05/31 23:31:11 | 000,406,528 | ---- | C] (SteelWerX) -- C:\Windows\SWSC.exe
[2011/05/31 23:31:11 | 000,060,416 | ---- | C] (NirSoft) -- C:\Windows\NIRCMD.exe
[2011/05/31 23:27:55 | 004,109,019 | R--- | C] (Swearware) -- C:\Users\Brian\Desktop\ComboFix.exe
[2011/05/31 23:27:43 | 000,000,000 | ---D | C] -- C:\Windows\ERDNT
[2011/05/31 23:27:38 | 000,000,000 | ---D | C] -- C:\Qoobox
[2011/05/31 08:24:55 | 000,000,000 | ---D | C] -- C:\Users\Brian\Desktop\suspectfile
[2011/05/26 13:48:25 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes
[2011/05/26 13:47:33 | 000,000,000 | ---D | C] -- C:\Program Files\iPod
[2011/05/26 13:47:32 | 000,000,000 | ---D | C] -- C:\Program Files\iTunes
[2011/05/26 13:44:16 | 000,000,000 | ---D | C] -- C:\Program Files\Bonjour
[2011/05/26 09:22:09 | 000,000,000 | ---D | C] -- C:\Program Files\BBC iPlayer Desktop
[2011/05/13 11:32:27 | 000,000,000 | ---D | C] -- C:\Users\Brian\AppData\Roaming\GPS Utility
[2011/05/13 11:31:58 | 000,000,000 | ---D | C] -- C:\Users\Brian\Documents\My GPSU
[2011/05/13 11:31:58 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\GPS Utility
[2011/05/13 11:31:57 | 000,000,000 | ---D | C] -- C:\Program Files\GPS Utility
[2011/05/13 11:24:05 | 000,000,000 | ---D | C] -- C:\Users\Brian\AppData\Local\TopoGrafix
[2011/05/13 11:24:04 | 000,000,000 | ---D | C] -- C:\Program Files\EasyGPS
[2011/05/13 10:51:33 | 000,035,892 | ---- | C] (Prolific Technology Inc.) -- C:\Windows\System32\SER9PL.sys
[2011/05/12 16:11:31 | 000,000,000 | ---D | C] -- C:\Users\Brian\AppData\Roaming\Malwarebytes
[2011/05/12 15:47:41 | 000,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbamswissarmy.sys
[2011/05/12 15:47:41 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2011/05/12 15:47:40 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2011/05/12 15:47:37 | 000,020,952 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys
[2011/05/12 15:47:37 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware
[2011/05/06 07:46:09 | 000,000,000 | ---D | C] -- C:\Users\Brian\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Blood Pressure Tracker
[2011/05/06 07:46:09 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Blood Pressure Tracker
[2011/05/06 07:46:08 | 000,000,000 | ---D | C] -- C:\Program Files\SoundTells
[2010/03/15 18:00:22 | 000,049,152 | ---- | C] ( ) -- C:\Windows\Interop.IWshRuntimeLibrary.dll

========== Files - Modified Within 30 Days ==========

[2024/03/21 12:44:18 | 000,246,272 | ---- | M] (Stirling Technologies, Inc.) -- C:\Windows\UNINST16.EXE
[2011/06/02 03:53:02 | 000,580,096 | ---- | M] (OldTimer Tools) -- C:\Users\Brian\Desktop\OTL.exe
[2011/06/02 03:47:00 | 000,000,886 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2011/06/01 18:47:00 | 000,000,882 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2011/06/01 18:46:50 | 116,835,025 | ---- | M] () -- C:\Windows\System32\drivers\AVG\incavi.avm
[2011/06/01 10:11:06 | 000,000,927 | ---- | M] () -- C:\Users\Public\Desktop\AVG 2011.lnk
[2011/06/01 08:42:17 | 000,011,104 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2011/06/01 08:42:17 | 000,011,104 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2011/06/01 08:33:21 | 000,001,063 | ---- | M] () -- C:\Users\Brian\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\BBC iPlayer Desktop.lnk
[2011/06/01 08:32:38 | 000,000,027 | ---- | M] () -- C:\Windows\System32\drivers\etc\hosts
[2011/06/01 08:31:42 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2011/06/01 08:31:31 | 2360,709,120 | -HS- | M] () -- C:\hiberfil.sys
[2011/05/31 23:30:40 | 004,109,019 | R--- | M] (Swearware) -- C:\Users\Brian\Desktop\ComboFix.exe
[2011/05/31 22:51:37 | 000,139,264 | ---- | M] () -- C:\Users\Brian\Desktop\RKUnhookerLE.EXE
[2011/05/29 20:00:35 | 000,001,071 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
[2011/05/26 13:48:25 | 000,001,757 | ---- | M] () -- C:\Users\Public\Desktop\iTunes.lnk
[2011/05/26 13:23:26 | 000,002,503 | ---- | M] () -- C:\Users\Brian\Application Data\Microsoft\Internet Explorer\Quick Launch\Apple Safari.lnk
[2011/05/26 13:23:26 | 000,002,479 | ---- | M] () -- C:\Users\Public\Desktop\Safari.lnk
[2011/05/26 09:22:11 | 000,000,955 | ---- | M] () -- C:\Users\Public\Desktop\BBC iPlayer Desktop.lnk
[2011/05/26 09:12:48 | 000,384,800 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT
[2011/05/26 08:38:59 | 000,206,796 | ---- | M] () -- C:\Windows\hpoins47.dat
[2011/05/25 20:46:23 | 000,177,141 | ---- | M] () -- C:\Windows\System32\drivers\AVG\iavichjg.avm
[2011/05/23 15:47:24 | 000,628,460 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2011/05/23 15:47:24 | 000,110,612 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2011/05/16 07:12:41 | 000,002,002 | ---- | M] () -- C:\Users\Brian\Application Data\Microsoft\Internet Explorer\Quick Launch\Mozilla Firefox.lnk
[2011/05/13 11:36:10 | 000,000,915 | ---- | M] () -- C:\Users\Brian\Desktop\EasyGPS.lnk
[2011/05/13 11:31:59 | 000,000,983 | ---- | M] () -- C:\Users\Brian\Desktop\GPS Utility.lnk
[2011/05/10 23:33:56 | 000,001,988 | ---- | M] () -- C:\Users\Public\Desktop\Adobe Reader 9.lnk
[2011/05/06 07:46:09 | 000,001,074 | ---- | M] () -- C:\Users\Brian\Desktop\SoundTells Blood Pressure Tracker.lnk

========== Files Created - No Company Name ==========

[2011/06/01 10:11:06 | 000,000,927 | ---- | C] () -- C:\Users\Public\Desktop\AVG 2011.lnk
[2011/05/31 23:31:11 | 000,256,512 | ---- | C] () -- C:\Windows\PEV.exe
[2011/05/31 23:31:11 | 000,208,896 | ---- | C] () -- C:\Windows\MBR.exe
[2011/05/31 23:31:11 | 000,098,816 | ---- | C] () -- C:\Windows\sed.exe
[2011/05/31 23:31:11 | 000,080,412 | ---- | C] () -- C:\Windows\grep.exe
[2011/05/31 23:31:11 | 000,068,096 | ---- | C] () -- C:\Windows\zip.exe
[2011/05/31 22:51:36 | 000,139,264 | ---- | C] () -- C:\Users\Brian\Desktop\RKUnhookerLE.EXE
[2011/05/26 13:48:25 | 000,001,757 | ---- | C] () -- C:\Users\Public\Desktop\iTunes.lnk
[2011/05/26 08:38:58 | 000,000,601 | ---- | C] () -- C:\Windows\hpomdl47.dat.temp
[2011/05/15 22:14:20 | 000,001,112 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
[2011/05/13 11:36:10 | 000,000,915 | ---- | C] () -- C:\Users\Brian\Desktop\EasyGPS.lnk
[2011/05/13 11:31:59 | 000,000,983 | ---- | C] () -- C:\Users\Brian\Desktop\GPS Utility.lnk
[2011/05/13 11:24:09 | 000,000,915 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\EasyGPS.lnk
[2011/05/13 10:51:33 | 000,026,719 | ---- | C] () -- C:\Windows\System32\SERSPL.VXD
[2011/05/12 15:47:41 | 000,001,071 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
[2011/05/06 07:46:09 | 000,001,074 | ---- | C] () -- C:\Users\Brian\Desktop\SoundTells Blood Pressure Tracker.lnk
[2011/04/15 16:03:33 | 000,014,976 | ---- | C] () -- C:\Windows\System32\drivers\SBKUPNT.SYS
[2011/04/15 16:03:33 | 000,013,312 | ---- | C] () -- C:\Windows\System32\DEVLOAD.EXE
[2011/04/15 16:03:20 | 000,002,799 | ---- | C] () -- C:\Windows\SKLANG.INI
[2011/02/25 18:48:14 | 000,206,796 | ---- | C] () -- C:\Windows\hpoins47.dat
[2011/01/30 21:34:10 | 000,110,592 | ---- | C] () -- C:\Windows\System32\FsUsbExDevice.Dll
[2011/01/30 21:34:10 | 000,036,608 | ---- | C] () -- C:\Windows\System32\FsUsbExDisk.Sys
[2011/01/21 18:45:39 | 000,053,248 | ---- | C] () -- C:\Windows\System32\CommonDL.dll
[2011/01/21 18:45:39 | 000,002,413 | ---- | C] () -- C:\Windows\System32\lgAxconfig.ini
[2011/01/16 10:47:54 | 000,000,000 | ---- | C] () -- C:\ProgramData\LauncherAccess.dt
[2010/11/04 19:53:10 | 000,000,606 | ---- | C] () -- C:\Windows\hphmdl34.dat.temp
[2010/09/19 11:02:30 | 000,000,151 | ---- | C] () -- C:\Windows\PhotoSnapViewer.INI
[2010/08/14 10:10:37 | 000,086,016 | ---- | C] () -- C:\Windows\removeark.exe
[2010/08/14 10:10:37 | 000,028,928 | ---- | C] () -- C:\Windows\System32\drivers\usb2vcom.sys
[2010/05/27 20:24:26 | 000,000,000 | ---- | C] () -- C:\Windows\nsreg.dat
[2010/05/26 20:54:13 | 000,023,112 | ---- | C] () -- C:\Windows\hpqins15.dat
[2010/05/12 10:03:47 | 000,201,417 | ---- | C] () -- C:\Windows\hphins34.dat
[2010/05/10 16:07:18 | 000,626,688 | ---- | C] () -- C:\Windows\Image.dll
[2010/05/10 16:07:18 | 000,200,704 | ---- | C] () -- C:\Windows\PLFSetI.exe
[2010/05/10 16:07:18 | 000,020,480 | ---- | C] () -- C:\Windows\USB_VIDEO_REG.exe
[2010/05/10 16:07:18 | 000,000,323 | ---- | C] () -- C:\Windows\PidList.ini
[2010/05/10 14:36:57 | 000,106,496 | ---- | C] () -- C:\Windows\FixUVC.exe
[2010/05/10 09:35:51 | 000,000,056 | -H-- | C] () -- C:\Windows\System32\ezsidmv.dat
[2010/03/16 10:02:50 | 000,000,376 | ---- | C] () -- C:\Windows\ODBC.INI
[2010/03/15 18:21:29 | 000,005,632 | ---- | C] () -- C:\Windows\System32\drivers\StarOpen.sys
[2010/03/15 17:50:24 | 000,004,608 | ---- | C] () -- C:\Windows\System32\HdmiCoin.dll
[2010/03/15 16:33:37 | 000,003,584 | ---- | C] () -- C:\Users\Brian\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010/03/15 15:30:17 | 000,140,288 | ---- | C] () -- C:\Windows\System32\igfxtvcx.dll
[2010/03/15 14:58:26 | 000,021,316 | ---- | C] () -- C:\Windows\System32\emptyregdb.dat
[2010/03/15 08:38:26 | 000,189,796 | ---- | C] () -- C:\Windows\System32\drivers\RTConvEQ.dat
[2010/03/15 08:38:26 | 000,001,112 | ---- | C] () -- C:\Windows\System32\drivers\RtHdatEx.dat
[2010/03/15 08:38:26 | 000,000,712 | ---- | C] () -- C:\Windows\System32\drivers\SamSfPa.dat
[2010/03/15 08:38:26 | 000,000,520 | ---- | C] () -- C:\Windows\System32\drivers\RTEQEX2.dat
[2010/03/15 08:38:26 | 000,000,520 | ---- | C] () -- C:\Windows\System32\drivers\RTEQEX1.dat
[2010/03/15 08:38:26 | 000,000,520 | ---- | C] () -- C:\Windows\System32\drivers\RTEQEX0.dat
[2010/03/15 08:38:26 | 000,000,008 | ---- | C] () -- C:\Windows\System32\drivers\rtkhdaud.dat
[2009/12/01 10:00:09 | 000,000,601 | ---- | C] () -- C:\Windows\hpomdl47.dat
[2009/09/02 18:46:40 | 000,439,300 | ---- | C] () -- C:\Windows\System32\igcompkrng500.bin
[2009/07/14 07:57:37 | 000,067,584 | --S- | C] () -- C:\Windows\bootstat.dat
[2009/07/14 07:33:53 | 000,384,800 | ---- | C] () -- C:\Windows\System32\FNTCACHE.DAT
[2009/07/14 05:05:48 | 000,628,460 | ---- | C] () -- C:\Windows\System32\perfh009.dat
[2009/07/14 05:05:48 | 000,291,294 | ---- | C] () -- C:\Windows\System32\perfi009.dat
[2009/07/14 05:05:48 | 000,110,612 | ---- | C] () -- C:\Windows\System32\perfc009.dat
[2009/07/14 05:05:48 | 000,031,548 | ---- | C] () -- C:\Windows\System32\perfd009.dat
[2009/07/14 05:05:05 | 000,000,741 | ---- | C] () -- C:\Windows\System32\NOISE.DAT
[2009/07/14 05:04:11 | 000,215,943 | ---- | C] () -- C:\Windows\System32\dssec.dat
[2009/07/14 02:55:01 | 000,043,131 | ---- | C] () -- C:\Windows\mib.bin
[2009/07/14 02:51:43 | 000,073,728 | ---- | C] () -- C:\Windows\System32\BthpanContextHandler.dll
[2009/07/14 02:42:10 | 000,064,000 | ---- | C] () -- C:\Windows\System32\BWContextHandler.dll
[2009/06/12 13:20:52 | 000,000,606 | ---- | C] () -- C:\Windows\hphmdl34.dat
[2009/06/11 00:26:10 | 000,673,088 | ---- | C] () -- C:\Windows\System32\mlang.dat
[2009/06/03 19:07:52 | 000,982,220 | ---- | C] () -- C:\Windows\System32\igkrng500.bin
[2009/06/03 19:07:52 | 000,134,592 | ---- | C] () -- C:\Windows\System32\igfcg500.bin
[2009/06/03 19:07:52 | 000,092,216 | ---- | C] () -- C:\Windows\System32\igfcg500m.bin
[2009/04/01 03:46:06 | 000,872,448 | ---- | C] () -- C:\Windows\iconv.dll
[2009/04/01 03:46:06 | 000,743,424 | ---- | C] () -- C:\Windows\libxml2.dll
[2009/04/01 03:46:05 | 000,000,061 | ---- | C] () -- C:\Windows\Prelaunch.ini
[2009/04/01 03:46:05 | 000,000,028 | ---- | C] () -- C:\Windows\WisLangCode.ini

========== LOP Check ==========

[2010/03/15 14:54:14 | 000,000,000 | ---D | M] -- C:\Users\Brian\AppData\Roaming\Acer
[2010/03/15 14:54:14 | 000,000,000 | ---D | M] -- C:\Users\Brian\AppData\Roaming\Acer GameZone Console
[2011/04/22 20:08:03 | 000,000,000 | ---D | M] -- C:\Users\Brian\AppData\Roaming\Amazon
[2011/06/01 10:20:40 | 000,000,000 | ---D | M] -- C:\Users\Brian\AppData\Roaming\AVG10
[2011/01/19 22:32:13 | 000,000,000 | ---D | M] -- C:\Users\Brian\AppData\Roaming\BBCiPlayerDesktop.61DB7A798358575D6A969CCD73DDBBD723A6DA9D.1
[2010/03/16 13:53:23 | 000,000,000 | ---D | M] -- C:\Users\Brian\AppData\Roaming\Canon
[2010/03/15 14:54:14 | 000,000,000 | ---D | M] -- C:\Users\Brian\AppData\Roaming\eSobi
[2011/05/13 11:32:27 | 000,000,000 | ---D | M] -- C:\Users\Brian\AppData\Roaming\GPS Utility
[2011/03/17 20:11:58 | 000,000,000 | ---D | M] -- C:\Users\Brian\AppData\Roaming\Juniper Networks
[2011/01/21 21:46:47 | 000,000,000 | ---D | M] -- C:\Users\Brian\AppData\Roaming\LG Electronics
[2011/03/20 20:15:55 | 000,000,000 | ---D | M] -- C:\Users\Brian\AppData\Roaming\moovida-1
[2011/03/29 14:45:37 | 000,000,000 | ---D | M] -- C:\Users\Brian\AppData\Roaming\Samsung
[2010/05/27 20:24:26 | 000,000,000 | ---D | M] -- C:\Users\Brian\AppData\Roaming\Thunderbird
[2010/11/26 08:21:32 | 000,000,000 | ---D | M] -- C:\Users\Brian\AppData\Roaming\TuneUp Software
[2011/06/02 03:55:07 | 000,000,000 | ---D | M] -- C:\Users\Brian\AppData\Roaming\uTorrent
[2011/03/16 00:21:08 | 000,000,000 | ---D | M] -- C:\Users\Brian\AppData\Roaming\VoipBuster
[2010/10/21 20:03:32 | 000,032,546 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT

========== Purity Check ==========



========== Custom Scans ==========


< %SYSTEMDRIVE%\*.* >
[2010/08/15 21:12:57 | 590,421,606 | ---- | M] () -- C:\98.zip
[2009/06/11 00:42:20 | 000,000,024 | ---- | M] () -- C:\autoexec.bat
[2010/08/15 11:22:36 | 045,871,448 | ---- | M] () -- C:\autotuna.zip
[2009/07/14 04:38:58 | 000,383,562 | RHS- | M] () -- C:\bootmgr
[2010/03/16 00:39:17 | 000,008,192 | RHS- | M] () -- C:\BOOTSECT.BAK
[2011/06/01 08:37:56 | 000,020,497 | ---- | M] () -- C:\ComboFix.txt
[2011/04/11 20:07:26 | 000,000,010 | RHS- | M] () -- C:\config.sys
[2011/06/01 08:31:31 | 2360,709,120 | -HS- | M] () -- C:\hiberfil.sys
[2010/08/15 09:44:34 | 010,855,084 | ---- | M] () -- C:\innovate.zip
[2010/08/26 19:31:16 | 000,000,000 | RHS- | M] () -- C:\IO.SYS
[2010/08/26 19:31:16 | 000,000,000 | RHS- | M] () -- C:\MSDOS.SYS
[2011/06/01 08:31:33 | 3147,616,256 | -HS- | M] () -- C:\pagefile.sys
[2009/06/20 11:32:16 | 000,015,911 | -HS- | M] () -- C:\Patch.rev
[2010/03/15 18:00:24 | 000,000,192 | RHS- | M] () -- C:\Preload.rev

< %systemroot%\Fonts\*.com >
[2009/07/14 07:52:25 | 000,026,040 | ---- | M] () -- C:\Windows\Fonts\GlobalMonospace.CompositeFont
[2009/07/14 07:52:25 | 000,026,489 | ---- | M] () -- C:\Windows\Fonts\GlobalSansSerif.CompositeFont
[2009/07/14 07:52:25 | 000,029,779 | ---- | M] () -- C:\Windows\Fonts\GlobalSerif.CompositeFont
[2009/07/14 07:52:25 | 000,043,318 | ---- | M] () -- C:\Windows\Fonts\GlobalUserInterface.CompositeFont

< %systemroot%\Fonts\*.dll >

< %systemroot%\Fonts\*.ini >
[2009/06/11 00:31:19 | 000,000,065 | ---- | M] () -- C:\Windows\Fonts\desktop.ini

< %systemroot%\Fonts\*.ini2 >

< %systemroot%\Fonts\*.exe >

< %systemroot%\system32\spool\prtprocs\w32x86\*.* >
[2006/09/13 05:00:00 | 000,027,136 | ---- | M] (CANON INC.) -- C:\Windows\System32\spool\prtprocs\w32x86\CNMPD7K.DLL
[2006/09/13 05:00:00 | 000,069,632 | ---- | M] (CANON INC.) -- C:\Windows\System32\spool\prtprocs\w32x86\CNMPP7K.DLL
[2009/10/21 16:29:40 | 000,320,512 | ---- | M] (Hewlett-Packard Corporation) -- C:\Windows\System32\spool\prtprocs\w32x86\hpfpp101.dll
[2009/04/16 14:08:20 | 000,312,832 | ---- | M] (Hewlett-Packard Corporation) -- C:\Windows\System32\spool\prtprocs\w32x86\hpfpp70v.dll
[2009/07/14 04:15:35 | 000,022,528 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\spool\prtprocs\w32x86\jnwppr.dll
[2007/04/09 13:23:54 | 000,028,552 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\spool\prtprocs\w32x86\mdippr.dll
[2006/10/26 21:56:12 | 000,033,104 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\spool\prtprocs\w32x86\msonpppr.dll
[2009/07/14 04:16:19 | 000,029,696 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\spool\prtprocs\w32x86\winprint.dll

< %systemroot%\REPAIR\*.bak1 >

< %systemroot%\REPAIR\*.ini >

< %systemroot%\system32\*.jpg >

< %systemroot%\*.jpg >

< %systemroot%\*.png >

< %systemroot%\*.scr >
[2008/12/05 00:55:20 | 000,307,560 | ---- | M] (Microsoft Corporation) -- C:\Windows\WLXPGSS.SCR

< %systemroot%\*._sy >

< %APPDATA%\Adobe\Update\*.* >

< %ALLUSERSPROFILE%\Favorites\*.* >

< %APPDATA%\Microsoft\*.* >

< %PROGRAMFILES%\*.* >
[2009/07/14 07:41:57 | 000,000,174 | -HS- | M] () -- C:\Program Files\desktop.ini

< %APPDATA%\Update\*.* >

< %systemroot%\*. /mp /s >

< %systemroot%\System32\config\*.sav >

< %PROGRAMFILES%\bak. /s >

< %systemroot%\system32\bak. /s >

< %ALLUSERSPROFILE%\Start Menu\*.lnk /x >

< %systemroot%\system32\config\systemprofile\*.dat /x >

< %systemroot%\*.config >

< %systemroot%\system32\*.db >

< %APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x >
[2010/03/15 08:56:44 | 000,000,221 | -HS- | M] () -- C:\Users\Brian\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop (1).ini
[2010/03/15 15:16:23 | 000,000,221 | -HS- | M] () -- C:\Users\Brian\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini

< %USERPROFILE%\Desktop\*.exe >
[2011/05/31 23:30:40 | 004,109,019 | R--- | M] (Swearware) -- C:\Users\Brian\Desktop\ComboFix.exe
[2011/06/02 03:53:02 | 000,580,096 | ---- | M] (OldTimer Tools) -- C:\Users\Brian\Desktop\OTL.exe
[2011/05/31 22:51:37 | 000,139,264 | ---- | M] () -- C:\Users\Brian\Desktop\RKUnhookerLE.EXE

< %PROGRAMFILES%\Common Files\*.* >

< %systemroot%\*.src >

< %systemroot%\install\*.* >

< %systemroot%\system32\DLL\*.* >

< %systemroot%\system32\HelpFiles\*.* >

< %systemroot%\system32\rundll\*.* >

< %systemroot%\winn32\*.* >

< %systemroot%\Java\*.* >

< %systemroot%\system32\test\*.* >

< %systemroot%\system32\Rundll32\*.* >

< %systemroot%\AppPatch\Custom\*.* >

< %APPDATA%\Roaming\Microsoft\Windows\Recent\*.lnk /x >

< %PROGRAMFILES%\PC-Doctor\Downloads\*.* >

< %PROGRAMFILES%\Internet Explorer\*.tmp >

< %PROGRAMFILES%\Internet Explorer\*.dat >

< %USERPROFILE%\My Documents\*.exe >

< %USERPROFILE%\*.exe >

< %systemroot%\ADDINS\*.* >
[2009/06/11 00:20:04 | 000,000,802 | ---- | M] () -- C:\Windows\addins\FXSEXT.ecf

< %systemroot%\assembly\*.bak2 >

< %systemroot%\Config\*.* >

< %systemroot%\REPAIR\*.bak2 >

< %systemroot%\SECURITY\Database\*.sdb /x >

< %systemroot%\SYSTEM\*.bak2 >

< %systemroot%\Web\*.bak2 >

< %systemroot%\Driver Cache\*.* >

< %PROGRAMFILES%\Mozilla Firefox\0*.exe >

< %ProgramFiles%\Microsoft Common\*.* >

< %ProgramFiles%\TinyProxy. >

< %USERPROFILE%\Favorites\*.url /x >
[2010/08/25 15:42:47 | 000,000,402 | -HS- | M] () -- C:\Users\Brian\Favorites\desktop.ini

< %systemroot%\system32\*.bk >

< %systemroot%\*.te >

< %systemroot%\system32\system32\*.* >

< %ALLUSERSPROFILE%\*.dat /x >
[2011/05/26 08:39:07 | 000,004,070 | ---- | M] () -- C:\ProgramData\hpzinstall.log
[2011/03/29 14:44:24 | 000,000,000 | ---- | M] () -- C:\ProgramData\LauncherAccess.dt

< %systemroot%\system32\drivers\*.rmv >

< dir /b "%systemroot%\system32\*.exe" | find /i " " /c >

< dir /b "%systemroot%\*.exe" | find /i " " /c >
Acer Crystal Eye webcam.EXE

< %PROGRAMFILES%\Microsoft\*.* >

< %systemroot%\System32\Wbem\proquota.exe >

< %PROGRAMFILES%\Mozilla Firefox\*.dat >

< %USERPROFILE%\Cookies\*.txt /x >

< %SystemRoot%\system32\fonts\*.* >

< %systemroot%\system32\winlog\*.* >

< %systemroot%\system32\Language\*.* >

< %systemroot%\system32\Settings\*.* >

< %systemroot%\system32\*.quo >

< %SYSTEMROOT%\AppPatch\*.exe >

< %SYSTEMROOT%\inf\*.exe >

< %SYSTEMROOT%\Installer\*.exe >

< %systemroot%\system32\config\*.bak2 >

< %systemroot%\system32\Computers\*.* >

< %SystemRoot%\system32\Sound\*.* >

< %SystemRoot%\system32\SpecialImg\*.* >

< %SystemRoot%\system32\code\*.* >

< %SystemRoot%\system32\draft\*.* >

< %SystemRoot%\system32\MSSSys\*.* >

< %ProgramFiles%\Javascript\*.* >

< %systemroot%\pchealth\helpctr\System\*.exe /s >

< %systemroot%\Web\*.exe >

< %systemroot%\system32\msn\*.* >

< %systemroot%\system32\*.tro >

< %AppData%\Microsoft\Installer\msupdates\*.* >

< %ProgramFiles%\Messenger\*.* >

< %systemroot%\system32\systhem32\*.* >

< %systemroot%\system\*.exe >

< HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >

< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\ Auto Update\Results\Install|LastSuccessTime /rs >


========== Alternate Data Streams ==========

@Alternate Data Stream - 121 bytes -> C:\ProgramData\TempFC5A2B2
@Alternate Data Stream - 120 bytes -> C:\ProgramData\TempCAF903C
@Alternate Data Stream - 109 bytes -> C:\ProgramData\Temp:A8ADE5D8
@Alternate Data Stream - 105 bytes -> C:\ProgramData\Temp:6108D5DF

< End of report >

 

Here is the second of the requested files (extras.txt)

OTL Extras logfile created on: 02/06/2011 03:55:32 - Run 1
OTL by OldTimer - Version 3.2.23.0 Folder = C:\Users\Brian\Desktop
Home Premium Edition (Version = 6.1.7600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7600.16385)
Locale: 00000809 | Country: United Kingdom | Language: ENG | Date Format: dd/MM/yyyy

2.93 Gb Total Physical Memory | 1.70 Gb Available Physical Memory | 58.11% Memory free
5.86 Gb Paging File | 4.65 Gb Available in Paging File | 79.28% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 223.12 Gb Total Space | 101.08 Gb Free Space | 45.30% Space Free | Partition Type: NTFS
Drive E: | 36.40 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS

Computer Name: BRIAN-5410 | User Name: Brian | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========


========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\System32\control.exe (Microsoft Corporation)
.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)

[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1 ",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1 "
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [Digital Photo Professional] -- C:\Program Files\Canon\Digital Photo Professional\DPPViewer.exe /path "%1" (CANON INC.)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
"FirewallDisableNotify" = 0
"AntiVirusDisableNotify" = 0
"UpdatesDisableNotify" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = Reg Error: Unknown registry data type -- File not found
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]

========== System Restore Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]


========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{014E482A-0C27-47E3-BA82-307E9DCA2F47}" = HP Photosmart Wireless B110 All-In-One Driver Software 14.0 Rel. 7
"{047F790A-7A2A-4B6A-AD02-38092BA63DAC}" = Acer VCM
"{05D08C4D-58A2-438B-A419-EE994E64E15D}" = B110
"{07035AB3-5C70-3315-35A9-CFFECA140880}" = BBC iPlayer Desktop
"{07FB17D8-7DB6-4F06-80C4-8BE1719CB6A1}" = hpWLPGInstaller
"{0F367CA3-3B2F-43F9-A44A-25A8EE69E45D}" = Scan
"{12EFA1A4-AC3B-443C-8143-237EDE760403}" = NTI Backup Now Standard
"{13E92303-C1AC-4012-9E22-54EACBF54888}" = MCCI(r)Firmware Update Driver for MTK
"{1458BB78-1DC5-4BC0-B9A3-2B644F5A8105}" = DeviceDiscovery
"{14DCD95A-EBA3-4BF0-B7EF-533852E99BE6}" = LG PC Suite II
"{150B6201-E9E6-4DFB-960E-CCBD53FBDDED}" = HPProductAssistant
"{18455581-E099-4BA8-BC6B-F34B2F06600C}" = Google Toolbar for Internet Explorer
"{1E5F3CC6-D390-4393-A2AA-6CEC04F1705A}" = Image Resizer Powertoy Clone for Windows
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{205C6BDD-7B73-42DE-8505-9A093F35A238}" = Windows Live Upload Tool
"{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}" = MSVCRT
"{230E8DDC-FB78-4F9F-8461-22ED20DBC3BA}" = AVG 2011
"{2318C2B1-4965-11d4-9B18-009027A5CD4F}" = Google Toolbar for Internet Explorer
"{23BE4DF2-293D-4077-82F4-1FD8C269277C}" = TuneUp Utilities Language Pack (en-US)
"{23DD8A17-65DB-4D49-A2E0-164C6F460E3F}" = Adobe Photoshop Lightroom 3
"{24036256-BFDB-4CD3-BE8A-A3D6160F2E16}" = TuneUp Utilities 2011
"{2413930C-8309-47A6-BC61-5EF27A4222BC}" = NTI Media Maker 8
"{2624B969-7135-4EB1-B0F6-2D8C397B45F7}_is1" = Media Player Classic - Home Cinema v. 1.3.1249.0
"{26A24AE4-039D-4CA4-87B4-2F83216016FF}" = Java(TM) 6 Update 22
"{2A3A4BD6-6CE0-4E2A-80D2-1D0FF6ACBFBA}" = LG United Mobile Driver
"{2BCF80C8-C84F-43C6-A721-8AF93D64EA3D}" = CAS Interface Studio 8.7.1
"{2BF2E31F-B8BB-40A7-B650-98D28E0F7D47}" = CyberLink PowerDVD 8
"{2FB9EA69-51D4-4913-9AD5-762C034DE811}" = Status
"{3108C217-BE83-42E4-AE9E-A56A2A92E549}" = Atheros Communications Inc.(R) AR81Family Gigabit/Fast Ethernet Driver
"{3175E049-F9A9-4A3D-8F19-AC9FB04514D1}" = Windows Live Communications Platform
"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
"{3DB0448D-AD82-4923-B305-D001E521A964}" = Acer PowerSmart Manager
"{4286E640-B5FB-11DF-AC4B-005056C00008}" = Google Earth
"{45338B07-A236-4270-9A77-EBB4115517B5}" = Windows Live Sign-in Assistant
"{474F25F5-BDC9-40E5-B1B6-F6BF23FC106F}" = Windows Live Essentials
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{565E7B0E-B76B-4EAD-9753-F1E72A5CF12E}" = HPAppStudio
"{57752979-A1C9-4C02-856B-FBB27AC4E02C}" = QuickTime
"{5A320CD8-D712-4339-BCC3-87311FD162CB}" = D5500
"{60FFB3E0-6D5B-4D73-AE5B-07E58B83AF0C}" = 32 Bit HP CIO Components Installer
"{6412CECE-8172-4BE5-935B-6CECACD2CA87}" = Windows Live Mail
"{67E03279-F703-408F-B4BF-46B5FC8D70CD}" = Microsoft Works
"{68301905-2DEA-41CE-A4D4-E8B443B099BA}" = MyWinLocker
"{6956856F-B6B3-4BE0-BA0B-8F495BE32033}" = Apple Software Update
"{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}" = Windows Media Player Firefox Plugin
"{6A92E5C5-0578-443D-91F3-92ECE5F2CAE2}" = Windows Live Writer
"{6C1E7AA1-44E9-446D-AAB2-0DE6D9EFEAB1}" = Safari
"{71C2828F-2678-4675-BDEC-895424861262}_is1" = C:\Program Files\Acer GameZone\GameConsole
"{72B776E5-4530-4C4B-9453-751DF87D9D93}" = Backup Manager Basic
"{74DC0593-6BC6-4001-AD5F-D810AFB68D86}" = HP Update
"{7760D94E-B1B5-40A0-9AA0-ABF942108755}" = Acer Crystal Eye Webcam
"{77DCDCE3-2DED-62F3-8154-05E745472D07}" = Acrobat.com
"{78EA684E-97ED-4F0C-8E13-BAF78D5BFE14}" = HP Deskjet D5500 Driver Software 13.0 Rel .6
"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-110111700}" = Zuma Deluxe
"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-110184263}" = Puzzle Express
"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-11037623}" = Tradewinds 2
"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-111125700}" = Rainbow Web
"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-111205743}" = Tri-Peaks Solitaire To Go
"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-111232687}" = Ocean Express
"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-111252743}" = Mahjong Escape Ancient China
"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-111307457}" = Galapago
"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-11170417}" = Luxor 2
"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-111771833}" = Jewel Quest Solitaire
"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-11219217}" = Cradle of Rome
"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-113009953}" = Turbo Pizza
"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-113056167}" = Dream Day Honeymoon
"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-113297350}" = Cake Mania 2
"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-113494430}" = Wedding Dash
"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-11505173}" = Airport Mania First Flight
"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-115053100}" = Dairy Dash
"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-115443300}" = Cooking Dash
"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-11551977}" = Parking Dash
"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
"{846B5DED-DC8C-4E1A-B5B4-9F5B39A0CACE}" = HPDiagnosticAlert
"{853A4763-6643-4604-8D64-28BDD8925F4C}" = Apple Application Support
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8E4B1BE8-DCF3-4B90-A726-B28107442623}" = SolutionCenter
"{8E5233E1-7495-44FB-8DEB-4BE906D59619}" = Junk Mail filter update
"{8EE94FD8-5F52-4463-A340-185D16328158}" = WebReg
"{8FF6F5CA-4E30-4E3B-B951-204CAAA2716A}" = SmartWebPrinting
"{90110409-6000-11D3-8CFE-0150048383C9}" = Microsoft Office Professional Edition 2003
"{90120000-0020-0409-0000-0000000FF1CE}" = Compatibility Pack for the 2007 Office system
"{9068B2BE-D93A-4C0A-861C-5E35E2C0E09E}" = Intel® Matrix Storage Manager
"{95120000-00AF-0409-0000-0000000FF1CE}" = Microsoft Office PowerPoint Viewer 2007 (English)
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{AC35A885-0F8F-4857-B7DA-6E8DFB43E6B3}" = HPSSupply
"{AC76BA86-7AD7-1033-7B44-A94000000001}" = Adobe Reader 9.4.4
"{AE09C972-EEB2-4DA5-8090-0FCF54576854}" = Optical Drive Power Management
"{AFF7E080-1974-45BF-9310-10DE1A1F5ED0}" = Adobe AIR
"{BB3447F6-9553-4AA9-960E-0DB5310C5779}" = GPBaseService2
"{BBFB2E59-B0DB-42C8-8F4D-CF4E85471667}" = Toolbox
"{BD7204BA-DD64-499E-9B55-6A282CDF4FA4}" = Destinations
"{C2E4B5BD-32DB-4817-A060-341AB17C3F90}" = Bonjour
"{C3ABE126-2BB2-4246-BFE1-6797679B3579}" = LG USB Modem driver
"{C4A4722E-79F9-417C-BD72-8D359A090C97}" = Samsung PC Studio 3
"{C75CDBA2-3C86-481e-BD10-BDDA758F9DFF}" = hpPrintProjects
"{C79A37F3-C076-48BE-B290-F4C8676ABD74}" = Samsung PC Studio 3
"{CACAEB5F-174D-4C7C-AC56-A33289A807CA}" = Apple Mobile Device Support
"{CC40FA96-9445-4EF4-8DDB-5DADF5F01BA8}" = AVG 2011
"{CD31E63D-47FD-491C-8117-CF201D0AFAB5}" = TrayApp
"{CD95D125-2992-4858-B3EF-5F6FB52FBAD6}" = Skype Toolbars
"{CD95F661-A5C4-44F5-A6AA-ECDD91C240BD}" = WinZip 14.5
"{D0795B21-0CDA-4a92-AB9E-6E92D8111E44}" = SAMSUNG USB Driver for Mobile Phones
"{D0ACE89D-EC7F-470F-80BE-4C98ED366B32}" = Acer Crystal Eye webcam Ver:1.1.92.624
"{D360FA88-17C8-4F14-B67F-13AAF9607B12}" = MarketResearch
"{DA20E1A8-07CB-4EE7-9B72-A7E28C953F0E}" = Acer Product Registration
"{DC24971E-1946-445D-8A82-CE685433FA7D}" = Realtek USB 2.0 Card Reader
"{E50AE784-FABE-46DA-A1F8-7B6B56DCB22E}" = Microsoft Office Suite Activation Assistant
"{E517094C-06B6-419F-8FFD-EF4F57972130}" = QuickTransfer
"{E6158D07-2637-4ECF-B576-37C489669174}" = Windows Live Call
"{E633D396-5188-4E9D-8F6B-BFB8BF3467E8}" = Skypeâ„¢ 5.1
"{EC23E72A-3E5D-4F0F-B5FB-C6945D1580C5}" = DJ_SF_06_D5500_SW_Min
"{ECC3713C-08A4-40E3-95F1-7D0704F1CE5E}" = PL-2303 USB-to-Serial
"{EF5B1E83-1403-4F0E-A8E6-C169DF0CCE8C}" = LG PC Suite II
"{EFB21DE7-8C19-4A88-BB28-A766E16493BC}" = Adobe Photoshop CS
"{F06FCDEC-5AB3-4927-A3E7-36AF98A8E05C}" = Huge Pine USB to UART Driver
"{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}" = Microsoft SQL Server 2005 Compact Edition [ENU]
"{F0E12BBA-AD66-4022-A453-A1C8A0C4D570}" = Microsoft Choice Guard
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F14B8ECC-BDA0-4987-9201-D7B7DBE11033}" = Nero 7 Ultra Edition
"{F193FC0E-9E18-40FC-A974-509A1BDD240A}" = Samsung New PC Studio
"{F59A9E08-A6A4-4ACF-91F2-D0344956C30B}" = iTunes
"{F73A5B18-EB75-4B2C-B32D-9457576E2417}" = Windows Live Photo Gallery
"{F80BD4BC-06B8-488E-A62E-C4755013DD71}" = Network
"{F868B421-3F6C-466D-818C-48F49204866A}" = GorbTrack 0.4
"{F88E2E04-7EF5-488C-8E38-C94EB808458E}" = PS_AIO_07_B110_SW_Min
"{FA0FF682-CC70-4C57-93CD-E276F3E7537E}" = BufferChm
"{FDD810CA-D5E3-40E9-AB7B-36440B0D41EF}" = Windows Live Sync
"{FF1C62C5-AF43-46F7-87A4-8B4B9CAEDF23}" = Blood Pressure Tracker
"Acer Screensaver" = Acer ScreenSaver
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"AVG" = AVG 2011
"AviSynth" = AviSynth 2.5
"BBCiPlayerDesktop.61DB7A798358575D6A969CCD73DDBBD723A6DA9D.1" = BBC iPlayer Desktop
"CameraWindowDC" = Canon Utilities CameraWindow DC
"CameraWindowDC8" = Canon Utilities CameraWindow DC 8
"CameraWindowDVC6" = Canon Utilities CameraWindow DC_DV 6 for ZoomBrowser EX
"CameraWindowLauncher" = Canon Utilities CameraWindow
"Canon MOV Decoder" = Canon MOV Decoder
"Canon MOV Encoder" = Canon MOV Encoder
"com.adobe.mauby.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1" = Acrobat.com
"conduitEngine" = Conduit Engine
"Coupon Printer for Windows5.0.0.0" = Coupon Printer for Windows
"DPP" = Canon Utilities Digital Photo Professional 3.8
"EasyGPS_is1" = EasyGPS 4.18
"Elecard MPEG-2 PlugIn for WMP 4.1.100318" = Elecard MPEG-2 PlugIn for WMP
"EOS Utility" = Canon Utilities EOS Utility
"Expat_Shield Toolbar" = Expat_Shield Toolbar
"ExpatShield" = Expat Shield 1.43
"ffdshow" = ffdshow (remove only)
"GPS Utility_is1" = GPSU version 5.10
"GridVista" = Acer GridVista
"HDMI" = Intel(R) Graphics Media Accelerator Driver
"HP Imaging Device Functions" = HP Imaging Device Functions 14.0
"HP Photo Creations" = HP Photo Creations
"HP Print Projects" = HP Print Projects 1.0
"HP Smart Web Printing" = HP Smart Web Printing 4.60
"HP Solution Center & Imaging Support Tools" = HP Solution Center 14.0
"HPExtendedCapabilities" = HP Customer Participation Program 14.0
"InstallShield_{12EFA1A4-AC3B-443C-8143-237EDE760403}" = NTI Backup Now 5
"InstallShield_{2413930C-8309-47A6-BC61-5EF27A4222BC}" = NTI Media Maker 8
"InstallShield_{2BF2E31F-B8BB-40A7-B650-98D28E0F7D47}" = CyberLink PowerDVD 8
"InstallShield_{72B776E5-4530-4C4B-9453-751DF87D9D93}" = Acer Backup Manager
"InstallShield_{F193FC0E-9E18-40FC-A974-509A1BDD240A}" = Samsung New PC Studio
"Juniper_Setup_Client Activex Control" = Juniper Networks Setup Client Activex Control
"LManager" = Launch Manager
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"MovieEditTask" = Canon MovieEdit Task for ZoomBrowser EX
"Mozilla Firefox 4.0.1 (x86 en-GB)" = Mozilla Firefox 4.0.1 (x86 en-GB)
"Mozilla Thunderbird (3.1.10)" = Mozilla Thunderbird (3.1.10)
"MyCamera" = Canon Utilities MyCamera
"MyCameraDC" = Canon Utilities MyCamera DC
"Personal Printing Guide" = Canon Personal Printing Guide
"PhotoStitch" = Canon Utilities PhotoStitch
"RAW Image Task" = Canon RAW Image Task for ZoomBrowser EX
"RealAlt_is1" = Real Alternative 2.0.2
"RemoteCaptureTask" = Canon Utilities RemoteCapture Task for ZoomBrowser EX
"RescuePRO-3.0" = RescuePROâ„¢ 3.0
"Shop for HP Supplies" = Shop for HP Supplies
"SoftwareStarterGuide-DCSD40_46" = Canon Digital Camera Solution Disk 40-46 Software Starter Guide
"SynTPDeinstKey" = Synaptics Pointing Device Driver
"TuneUp Utilities 2011" = TuneUp Utilities 2011
"TVWiz" = Intel(R) TV Wizard
"uTorrent" = µTorrent
"uTorrentBar Toolbar" = uTorrentBar Toolbar
"Videora iPod Converter" = Videora iPod Converter 5.04
"VLC media player" = VLC media player 1.0.3
"VoipBuster_is1" = VoipBuster
"WinLiveSuite_Wave3" = Windows Live Essentials
"WinZip Self-Extractor" = WinZip Self-Extractor
"ZoomBrowser EX" = Canon Utilities ZoomBrowser EX
"ZoomBrowser EX Memory Card Utility" = Canon ZoomBrowser EX Memory Card Utility

========== HKEY_CURRENT_USER Uninstall List ==========

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Amazon Kindle" = Amazon Kindle
"Juniper_Setup_Client" = Juniper Networks Setup Client
"Juniper_Term_Services" = Juniper Terminal Services Client

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 31/05/2011 18:19:11 | Computer Name = Brian-5410 | Source = SideBySide | ID = 16842785
Description = Activation context generation failed for "c:\program files\windows
live\messenger\wlcsdk.exe ". Dependent Assembly UCCAPI,processorArchitecture= "x86 ",type= "win32 ",version= "2.0.0.0 "
could not be found. Please use sxstrace.exe for detailed diagnosis.

Error - 31/05/2011 18:19:32 | Computer Name = Brian-5410 | Source = SideBySide | ID = 16842785
Description = Activation context generation failed for "c:\program files\mstrgen\64bit\MSPInstall_64bit.exe ".
Dependent
Assembly Microsoft.Windows.Common-Controls,language= "* ",processorArchitecture= "amd64 ",publicKeyToken= "6595b64144ccf1df ",type= "win32 ",version= "6.0.0.0 "
could not be found. Please use sxstrace.exe for detailed diagnosis.

Error - 31/05/2011 18:19:32 | Computer Name = Brian-5410 | Source = SideBySide | ID = 16842785
Description = Activation context generation failed for "c:\program files\mstrgen\64bit\MSPUnInstall_64bit.exe ".
Dependent
Assembly Microsoft.Windows.Common-Controls,language= "* ",processorArchitecture= "amd64 ",publicKeyToken= "6595b64144ccf1df ",type= "win32 ",version= "6.0.0.0 "
could not be found. Please use sxstrace.exe for detailed diagnosis.

Error - 01/06/2011 01:16:51 | Computer Name = Brian-5410 | Source = WinMgmt | ID = 10
Description =

Error - 01/06/2011 01:33:11 | Computer Name = Brian-5410 | Source = WinMgmt | ID = 10
Description =

Error - 01/06/2011 17:30:40 | Computer Name = Brian-5410 | Source = SideBySide | ID = 16842785
Description = Activation context generation failed for "C:\Program Files\mstrgen\64bit\MSPInstall_64bit.exe ".
Dependent
Assembly Microsoft.Windows.Common-Controls,language= "* ",processorArchitecture= "amd64 ",publicKeyToken= "6595b64144ccf1df ",type= "win32 ",version= "6.0.0.0 "
could not be found. Please use sxstrace.exe for detailed diagnosis.

Error - 01/06/2011 17:30:40 | Computer Name = Brian-5410 | Source = SideBySide | ID = 16842785
Description = Activation context generation failed for "C:\Program Files\mstrgen\64bit\MSPUnInstall_64bit.exe ".
Dependent
Assembly Microsoft.Windows.Common-Controls,language= "* ",processorArchitecture= "amd64 ",publicKeyToken= "6595b64144ccf1df ",type= "win32 ",version= "6.0.0.0 "
could not be found. Please use sxstrace.exe for detailed diagnosis.

Error - 01/06/2011 17:34:56 | Computer Name = Brian-5410 | Source = SideBySide | ID = 16842785
Description = Activation context generation failed for "c:\program files\windows
live\messenger\wlcsdk.exe ". Dependent Assembly UCCAPI,processorArchitecture= "x86 ",type= "win32 ",version= "2.0.0.0 "
could not be found. Please use sxstrace.exe for detailed diagnosis.

Error - 01/06/2011 17:35:12 | Computer Name = Brian-5410 | Source = SideBySide | ID = 16842785
Description = Activation context generation failed for "c:\program files\mstrgen\64bit\MSPInstall_64bit.exe ".
Dependent
Assembly Microsoft.Windows.Common-Controls,language= "* ",processorArchitecture= "amd64 ",publicKeyToken= "6595b64144ccf1df ",type= "win32 ",version= "6.0.0.0 "
could not be found. Please use sxstrace.exe for detailed diagnosis.

Error - 01/06/2011 17:35:12 | Computer Name = Brian-5410 | Source = SideBySide | ID = 16842785
Description = Activation context generation failed for "c:\program files\mstrgen\64bit\MSPUnInstall_64bit.exe ".
Dependent
Assembly Microsoft.Windows.Common-Controls,language= "* ",processorArchitecture= "amd64 ",publicKeyToken= "6595b64144ccf1df ",type= "win32 ",version= "6.0.0.0 "
could not be found. Please use sxstrace.exe for detailed diagnosis.

[ Media Center Events ]
Error - 13/04/2011 20:37:00 | Computer Name = Brian-5410 | Source = MCUpdate | ID = 0
Description = 3:36:58 AM - Error connecting to the internet. 3:36:58 AM - Unable
to contact server..

Error - 13/04/2011 21:37:33 | Computer Name = Brian-5410 | Source = MCUpdate | ID = 0
Description = 4:37:33 AM - Error connecting to the internet. 4:37:33 AM - Unable
to contact server..

Error - 13/04/2011 21:38:04 | Computer Name = Brian-5410 | Source = MCUpdate | ID = 0
Description = 4:38:02 AM - Error connecting to the internet. 4:38:02 AM - Unable
to contact server..

Error - 13/04/2011 22:38:36 | Computer Name = Brian-5410 | Source = MCUpdate | ID = 0
Description = 5:38:36 AM - Error connecting to the internet. 5:38:36 AM - Unable
to contact server..

Error - 13/04/2011 22:39:07 | Computer Name = Brian-5410 | Source = MCUpdate | ID = 0
Description = 5:39:05 AM - Error connecting to the internet. 5:39:05 AM - Unable
to contact server..

Error - 13/04/2011 23:39:40 | Computer Name = Brian-5410 | Source = MCUpdate | ID = 0
Description = 6:39:40 AM - Error connecting to the internet. 6:39:40 AM - Unable
to contact server..

Error - 13/04/2011 23:40:11 | Computer Name = Brian-5410 | Source = MCUpdate | ID = 0
Description = 6:40:09 AM - Error connecting to the internet. 6:40:09 AM - Unable
to contact server..

Error - 10/05/2011 09:50:47 | Computer Name = Brian-5410 | Source = MCUpdate | ID = 0
Description = 4:50:45 PM - Failed to retrieve SportsV2 (Error: The remote name could
not be resolved: 'data.tvdownload.microsoft.com')

Error - 14/05/2011 23:42:49 | Computer Name = Brian-5410 | Source = MCUpdate | ID = 0
Description = 6:42:49 AM - Error connecting to the internet. 6:42:49 AM - Unable
to contact server..

Error - 14/05/2011 23:43:01 | Computer Name = Brian-5410 | Source = MCUpdate | ID = 0
Description = 6:42:56 AM - Error connecting to the internet. 6:42:56 AM - Unable
to contact server..

[ System Events ]
Error - 02/09/2010 15:45:38 | Computer Name = Brian-5410 | Source = DCOM | ID = 10010
Description =

Error - 04/09/2010 02:16:04 | Computer Name = Brian-5410 | Source = Service Control Manager | ID = 7011
Description = A timeout (30000 milliseconds) was reached while waiting for a transaction
response from the HPSLPSVC service.

Error - 04/09/2010 08:00:04 | Computer Name = Brian-5410 | Source = Service Control Manager | ID = 7011
Description = A timeout (30000 milliseconds) was reached while waiting for a transaction
response from the HPSLPSVC service.

Error - 04/09/2010 08:33:21 | Computer Name = Brian-5410 | Source = Service Control Manager | ID = 7024
Description = The Dritek WMI Service service terminated with service-specific error
%%0.

Error - 04/09/2010 16:32:48 | Computer Name = Brian-5410 | Source = Service Control Manager | ID = 7026
Description = The following boot-start or system-start driver(s) failed to load:
cdrom PxHelp20

Error - 05/09/2010 05:47:18 | Computer Name = Brian-5410 | Source = Service Control Manager | ID = 7030
Description = The NBService service is marked as an interactive service. However,
the system is configured to not allow interactive services. This service may not
function properly.

Error - 05/09/2010 06:05:42 | Computer Name = Brian-5410 | Source = Service Control Manager | ID = 7024
Description = The Dritek WMI Service service terminated with service-specific error
%%0.

Error - 05/09/2010 09:31:02 | Computer Name = Brian-5410 | Source = Service Control Manager | ID = 7011
Description = A timeout (30000 milliseconds) was reached while waiting for a transaction
response from the HPSLPSVC service.

Error - 05/09/2010 11:15:26 | Computer Name = Brian-5410 | Source = bowser | ID = 8003
Description =

Error - 06/09/2010 11:03:38 | Computer Name = Brian-5410 | Source = Service Control Manager | ID = 7024
Description = The Dritek WMI Service service terminated with service-specific error
%%0.


< End of report >

 

OTL runfix log: (others to follow)

All processes killed
========== OTL ==========
ADS C:\ProgramData\TempFC5A2B2 deleted successfully.
ADS C:\ProgramData\TempCAF903C deleted successfully.
ADS C:\ProgramData\Temp:A8ADE5D8 deleted successfully.
ADS C:\ProgramData\Temp:6108D5DF deleted successfully.
========== COMMANDS ==========

[EMPTYTEMP]

User: Administrator
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 67 bytes
->Flash cache emptied: 321 bytes

User: All Users

User: Brian
->Temp folder emptied: 1269574 bytes
->Temporary Internet Files folder emptied: 31555951 bytes
->Java cache emptied: 35701125 bytes
->FireFox cache emptied: 63062858 bytes
->Google Chrome cache emptied: 1905008 bytes
->Flash cache emptied: 105286 bytes

User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 56541 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: Public
->Temp folder emptied: 0 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 289103 bytes
RecycleBin emptied: 580096 bytes

Total Files Cleaned = 128.00 mb


[EMPTYFLASH]

User: Administrator
->Flash cache emptied: 0 bytes

User: All Users

User: Brian
->Flash cache emptied: 0 bytes

User: Default
->Flash cache emptied: 0 bytes

User: Default User
->Flash cache emptied: 0 bytes

User: Public

Total Flash Files Cleaned = 0.00 mb


OTL by OldTimer - Version 3.2.23.0 log created on 06022011_045712

Files\Folders moved on Reboot...
C:\Users\Brian\AppData\Local\Temp\HPVAD3.tmp.vdf moved successfully.
C:\Users\Brian\AppData\Local\Temp\HPVEB3A.tmp.vdf moved successfully.
C:\Users\Brian\AppData\Local\Temp\HPVEB3B.tmp.vdf moved successfully.
C:\Users\Brian\AppData\Local\Temp\HPVF192.tmp.vdf moved successfully.

Registry entries deleted on Reboot...

 

Security check results log:

Results of screen317's Security Check version 0.99.7
Windows 7 (UAC is enabled)
Internet Explorer 8
``````````````````````````````
Antivirus/Firewall Check:
Windows Firewall Enabled!
AVG 2011
WMI entry may not exist for antivirus; attempting automatic update.
```````````````````````````````
Anti-malware/Other Utilities Check:
Malwarebytes' Anti-Malware
TuneUp Utilities 2011
TuneUp Utilities Language Pack (en-US)
TuneUp Utilities 2011
Java(TM) 6 Update 25
Out of date Java installed!
Adobe Flash Player 10.2.153.1
Adobe Reader 9.4.4
Out of date Adobe Reader installed!
Mozilla Thunderbird (3.1.10) Thunderbird Out of Date!
````````````````````````````````
Process Check:
objlist.exe by Laurent
AVG avgwdsvc.exe
AVG avgtray.exe
AVG avgrsx.exe
AVG avgnsx.exe
AVG avgemc.exe
``````````End of Log````````````

 

Haven't done this one yet as I have to uninstall AVG as you cannot disable it for more than 15 mins at a time. Will post results when done.