Solved Laggy Computer

[Resolved] Laggy Computer

Hello, my computer has been running quite slow lately. It doesn't have the best hardware but its pretty decent. My brother, Arin, told me that I most likely have some malware/virus related issues and said this was the best place to come for help with those sorts of issues. I posted the required logs down below. Thanks in advance for any and all help.


Malwarebytes' Anti-Malware 1.51.1.1800
www.malwarebytes.org

Database version: 7587

Windows 6.0.6002 Service Pack 2
Internet Explorer 8.0.6001.19120

8/27/2011 12:27:09 PM
mbam-log-2011-08-27 (12-27-09).txt

Scan type: Quick scan
Objects scanned: 173559
Time elapsed: 6 minute(s), 42 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)




aswMBR version 0.9.8.986 Copyright(c) 2011 AVAST Software
Run date: 2011-08-27 12:07:45
-----------------------------
12:07:45.377 OS Version: Windows 6.0.6002 Service Pack 2
12:07:45.377 Number of processors: 2 586 0x4B02
12:07:45.393 ComputerName: COBALTGIRL-PC UserName: Cobaltgirl
12:07:47.998 Initialize success
12:08:04.524 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\0000005c
12:08:04.524 Disk 0 Vendor: ST332082 3.AH Size: 305245MB BusType: 6
12:08:06.568 Disk 0 MBR read successfully
12:08:06.568 Disk 0 MBR scan
12:08:06.568 Disk 0 unknown MBR code
12:08:06.584 Disk 0 scanning sectors +625136400
12:08:06.662 Disk 0 scanning C:\Windows\system32\drivers
12:08:22.745 Service scanning
12:08:24.524 Modules scanning
12:08:33.026 Disk 0 trace - called modules:
12:08:33.057 ntkrnlpa.exe CLASSPNP.SYS disk.sys acpi.sys hal.dll storport.sys nvstor32.sys
12:08:33.057 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x86448498]
12:08:33.057 3 CLASSPNP.SYS[881a18b3] -> nt!IofCallDriver -> [0x8592ea60]
12:08:33.072 5 acpi.sys[806096bc] -> nt!IofCallDriver -> \Device\0000005c[0x84b87c90]
12:08:33.572 Scan finished successfully
12:08:49.858 Disk 0 MBR has been saved successfully to "C:\Users\Cobaltgirl\Desktop\MBR.dat "
12:08:49.858 The log file has been saved successfully to "C:\Users\Cobaltgirl\Desktop\aswMBR.txt "



DDS (Ver_2011-08-26.01) - NTFSx86
Internet Explorer: 8.0.6001.19120 BrowserJavaVersion: 1.6.0_20
Run by Cobaltgirl at 12:11:25 on 2011-08-27
Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.1.1033.18.1918.737 [GMT -4:00]
.
AV: Norton AntiVirus *Enabled/Updated* {88C95A36-8C3B-2F2C-1B8B-30FCCFDC4855}
SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
SP: Norton AntiVirus *Enabled/Updated* {33A8BBD2-AA01-20A2-213B-0B8EB45B02E8}
.
============== Running Processes ===============
.
C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\nvvsvc.exe
C:\Windows\system32\svchost.exe -k rpcss
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k GPSvcGroup
C:\Windows\system32\SLsvc.exe
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\rundll32.exe
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Program Files\Adobe\Photoshop Elements 4.0\PhotoshopElementsFileAgent.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
c:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Norton AntiVirus\Engine\17.8.0.5\ccSvcHst.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\Windows\system32\svchost.exe -k imgsvc
C:\Windows\System32\svchost.exe -k WerSvcGroup
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
C:\Windows\system32\SearchIndexer.exe
C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe
C:\Windows\system32\WUDFHost.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\DllHost.exe
C:\Windows\system32\SearchProtocolHost.exe
C:\Windows\ehome\ehsched.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
C:\Windows\ehome\ehRecvr.exe
C:\Program Files\Norton AntiVirus\Engine\17.8.0.5\ccSvcHst.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\ehome\ehtray.exe
C:\Users\Cobaltgirl\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Cobaltgirl\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Cobaltgirl\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Cobaltgirl\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Cobaltgirl\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Windows\ehome\ehmsas.exe
C:\Users\Cobaltgirl\AppData\Local\Google\Update\1.3.21.65\GoogleCrashHandler.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Windows\system32\conime.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Windows\system32\wbem\wmiprvse.exe
.
============== Pseudo HJT Report ===============
.
uStart Page = hxxp://securityresponse.symantec.com/avcenter/fix_homepage
uDefault_Search_URL = hxxp://www.google.com/ie
mStart Page = hxxp://www.yahoo.com
uInternet Settings,ProxyOverride = <local>;*.local
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
uURLSearchHooks: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} -
uURLSearchHooks: H - No File
uURLSearchHooks: H - No File
BHO: 1 (0x1): {02478d38-c3f9-4efb-9b51-7695eca05670} - &Yahoo! Toolbar Helper
BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelper.dll
BHO: DivX Plus Web Player HTML5 <video>: {326e768d-4182-46fd-9c16-1449a49795f4} - c:\program files\divx\divx plus web player\npdivx32.dll
BHO: Spybot-S&D IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - c:\progra~1\spybot~1\SDHelper.dll
BHO: DivX HiQ: {593ddec6-7468-4cdd-90e1-42dadaa222e9} - c:\program files\divx\divx plus web player\npdivx32.dll
BHO: Symantec Intrusion Prevention: {6d53ec84-6aae-4787-aeee-f4628f01010c} - c:\program files\norton antivirus\engine\17.8.0.5\IPSBHO.DLL
BHO: Windows Live ID Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
BHO: Windows Live Messenger Companion Helper: {9fdde16b-836f-4806-ab1f-1455cbeff289} - c:\program files\windows live\companion\companioncore.dll
BHO: Skype add-on for Internet Explorer: {ae805869-2e5c-4ed4-8f7b-f1f7851a4497} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll
BHO: {c6185c12-9907-7356-0e99-52cb65b7cc1c} - 47f9269
BHO: Ask Toolbar BHO: {d4027c7f-154a-4066-a1ad-4243d8127440} - Ask Toolbar
BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: {fdad4da1-61a2-4fd8-9c17-86f7ac245081} - SingleInstance Class
TB: FlashGet Bar: {e0e899ab-f487-11d5-8d29-0050ba6940e3} - c:\progra~1\flashget\fgiebar.dll
TB: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} -
TB: Ask Toolbar: {d4027c7f-154a-4066-a1ad-4243d8127440} -
TB: {E67C74F4-A00A-4F2C-9FEC-FD9DC004A67F} - No File
TB: {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No File
TB: {B9D63C58-90CC-428B-8D3B-CBB88EB07E7E} - No File
uRun: [ehTray.exe] c:\windows\ehome\ehTray.exe
uRun: [Google Update] "c:\users\cobaltgirl\appdata\local\google\update\GoogleUpdate.exe" /c
mRun: [LogMeIn GUI] "c:\program files\logmein\x86\LogMeInSystray.exe "
mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime
mRun: [DivX Download Manager] "c:\program files\divx\divx plus web player\DDmService.exe" start
mRun: [DivXUpdate] "c:\program files\divx\divx update\DivXUpdate.exe" /CHECKNOW
mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe "
mPolicies-explorer: BindDirectlyToPropertySetStorage = 0 (0x0)
mPolicies-system: ConsentPromptBehaviorAdmin = 0 (0x0)
mPolicies-system: EnableLUA = 0 (0x0)
mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
IE: E&xport to Microsoft Excel - c:\progra~1\micros~3\office12\EXCEL.EXE/3000
IE: {53F6FCCD-9E22-4d71-86EA-6E43136192AB}
IE: {925DAB62-F9AC-4221-806A-057BFB1014AA}
IE: {0000036B-C524-4050-81A0-243669A86B9F} - {B63DBA5F-523F-4B9C-A43D-65DF1977EAD3} - c:\program files\windows live\companion\companioncore.dll
IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - c:\program files\windows live\writer\WriterBrowserExtension.dll
IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\progra~1\micros~3\office12\ONBttnIE.dll
IE: {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~3\office12\REFIEBAR.DLL
IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - c:\progra~1\spybot~1\SDHelper.dll
DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab
TCP: DhcpNameServer = 192.168.2.1 192.168.1.254
TCP: Interfaces\{4941E980-ED4C-47C7-AB02-298721120AFC} : DhcpNameServer = 192.168.2.1 192.168.1.254
TCP: Interfaces\{C72E7ECC-A52E-44E5-BB8C-DE04629CEB0B} : DhcpNameServer = 192.168.0.1 192.168.1.254
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~1\common~1\skype\SKYPE4~1.DLL
Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - c:\program files\windows live\photo gallery\AlbumDownloadProtocolHandler.dll
mASetup: {A509B1FF-37FF-4bFF-8CFF-4F3A747040FF} - c:\windows\system32\rundll32.exe c:\windows\system32\advpack.dll,launchinfsectionex c:\program files\internet explorer\clrtour.inf,DefaultInstall.ResetTour,,12
Hosts: 127.0.0.1 www.spywareinfo.com
.
============= SERVICES / DRIVERS ===============
.
R0 AFS;AFS;c:\windows\system32\drivers\AFS.SYS [2008-4-29 79052]
R0 SymDS;Symantec Data Store;c:\windows\system32\drivers\nav\1108000.005\symds.sys [2010-9-21 328752]
R0 SymEFA;Symantec Extended File Attributes;c:\windows\system32\drivers\nav\1108000.005\symefa.sys [2010-9-21 173104]
R1 BHDrvx86;BHDrvx86;c:\programdata\norton\{0c55c096-0f1d-4f28-aaa2-85ef591126e7}\nav_17.1.0.19\definitions\bashdefs\20110812.001\BHDrvx86.sys [2011-8-15 815736]
R1 ccHP;Symantec Hash Provider;c:\windows\system32\drivers\nav\1108000.005\cchpx86.sys [2010-9-21 501888]
R1 IDSVix86;IDSVix86;c:\programdata\norton\{0c55c096-0f1d-4f28-aaa2-85ef591126e7}\nav_17.1.0.19\definitions\ipsdefs\20110826.030\IDSvix86.sys [2011-8-26 368248]
R1 SymIRON;Symantec Iron Driver;c:\windows\system32\drivers\nav\1108000.005\ironx86.sys [2010-9-21 116784]
R1 SYMTDIv;Symantec Vista Network Dispatch Driver;c:\windows\system32\drivers\nav\1108000.005\symtdiv.sys [2010-9-21 339504]
R2 FontCache;Windows Font Cache Service;c:\windows\system32\svchost.exe -k LocalServiceAndNoImpersonation [2008-5-30 21504]
R2 LMIRfsDriver;LogMeIn Remote File System Driver;c:\windows\system32\drivers\LMIRfsDriver.sys [2010-10-11 47640]
R2 NAV;Norton AntiVirus;c:\program files\norton antivirus\engine\17.8.0.5\ccsvchst.exe [2010-9-21 126392]
R2 SBSDWSCService;SBSD Security Center Service;c:\program files\spybot - search & destroy\SDWinSec.exe [2007-12-21 1153368]
R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\common files\symantec shared\eengine\EraserUtilRebootDrv.sys [2011-8-10 105592]
R3 netr73;USB Wireless 802.11 b/g Adaptor Driver for Vista;c:\windows\system32\drivers\netr73.sys [2009-5-24 501248]
R3 xcbdaNtsc;ViXS Tuner Card (NTSC);c:\windows\system32\drivers\xcbda.sys [2007-9-7 156928]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]
S2 gupdate;Google Update Service (gupdate);c:\program files\google\update\GoogleUpdate.exe [2010-3-5 135664]
S3 dc3d;USBCCGP filter driver (dc3d);c:\windows\system32\drivers\dc3d.sys [2009-1-15 15360]
S3 fssfltr;FssFltr;c:\windows\system32\drivers\fssfltr.sys [2010-10-20 39272]
S3 fsssvc;Windows Live Family Safety Service;c:\program files\windows live\family safety\fsssvc.exe [2010-9-23 1493352]
S3 gupdatem;Google Update Service (gupdatem);c:\program files\google\update\GoogleUpdate.exe [2010-3-5 135664]
S3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\system32\drivers\mbamswissarmy.sys [2011-8-27 41272]
S3 npggsvc;nProtect GameGuard Service;c:\windows\system32\gamemon.des -service --> c:\windows\system32\GameMon.des -service [?]
S3 radpms;Driver for RADPMS Device;c:\windows\system32\drivers\radpms.sys [2010-5-31 13408]
S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\microsoft.net\framework\v4.0.30319\wpf\WPFFontCache_v0400.exe [2010-3-18 753504]
S4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\windows live\mesh\wlcrasvc.exe [2010-9-22 51040]
.
=============== Created Last 30 ================
.
2011-08-27 15:22:22 -------- d-----w- c:\users\cobaltgirl\appdata\roaming\Malwarebytes
2011-08-27 15:22:11 41272 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2011-08-27 15:22:09 -------- d-----w- c:\programdata\Malwarebytes
2011-08-27 15:22:04 22712 ----a-w- c:\windows\system32\drivers\mbam.sys
2011-08-27 15:22:03 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2011-08-27 00:56:33 -------- d-----w- c:\users\cobaltgirl\riotsGamesLogs
2011-08-24 05:52:51 2048 ----a-w- c:\windows\system32\tzres.dll
2011-08-24 00:05:36 -------- d-----w- C:\Riot Games
2011-08-23 17:45:46 -------- d-----w- c:\users\cobaltgirl\appdata\local\{72B2B647-49C0-4555-9E6E-335D1A0D7501}
2011-08-23 17:45:35 -------- d-----w- c:\users\cobaltgirl\appdata\local\{94F5AEB2-E062-4AF5-AF5C-C28906D27A60}
2011-08-23 17:27:54 -------- d-----w- c:\users\cobaltgirl\appdata\local\{9C1C50A5-07AD-4D26-AA85-B06F0AFBDA41}
2011-08-23 17:26:02 -------- d-----w- c:\users\cobaltgirl\appdata\local\{19786FA2-D822-44CB-B9BF-FF51AF673765}
2011-08-23 17:24:07 -------- d-----w- c:\users\cobaltgirl\appdata\local\{A2465770-AEA2-4AEF-825B-16B0E009F3D3}
2011-08-23 16:40:36 -------- d-----w- c:\users\cobaltgirl\appdata\local\{68F04704-ECF0-4ABC-B6C1-EED9D0A6BC9D}
2011-08-23 16:40:16 -------- d-----w- c:\users\cobaltgirl\appdata\local\{07587A7C-E0AC-4627-B8A4-8243BBA0E3A4}
2011-08-01 17:08:39 -------- d-----w- c:\users\cobaltgirl\appdata\local\{1A8C1AD1-3069-4773-AE8B-C0EB0BAA479A}
.
==================== Find3M ====================
.
2011-07-23 11:04:29 916480 ----a-w- c:\windows\system32\wininet.dll
2011-07-23 11:00:05 43520 ----a-w- c:\windows\system32\licmgr10.dll
2011-07-23 10:59:52 1469440 ----a-w- c:\windows\system32\inetcpl.cpl
2011-07-23 10:59:34 71680 ----a-w- c:\windows\system32\iesetup.dll
2011-07-23 10:59:34 109056 ----a-w- c:\windows\system32\iesysprep.dll
2011-07-23 10:03:47 385024 ----a-w- c:\windows\system32\html.iec
2011-07-23 09:27:04 133632 ----a-w- c:\windows\system32\ieUnatt.exe
2011-07-23 09:25:38 1638912 ----a-w- c:\windows\system32\mshtml.tlb
2011-07-06 15:31:47 214016 ----a-w- c:\windows\system32\drivers\mrxsmb10.sys
2011-06-20 08:54:36 3602832 ----a-w- c:\windows\system32\ntkrnlpa.exe
2011-06-20 08:54:36 3550096 ----a-w- c:\windows\system32\ntoskrnl.exe
2011-06-17 20:13:55 905104 ----a-w- c:\windows\system32\drivers\tcpip.sys
2011-06-17 16:03:18 375808 ----a-w- c:\windows\system32\winsrv.dll
2011-06-02 13:34:49 2043392 ----a-w- c:\windows\system32\win32k.sys
.
============= FINISH: 12:12:42.45 ===============



.
UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT
.
DDS (Ver_2011-08-26.01)
.
Microsoft® Windows Vista™ Home Premium
Boot Device: \Device\HarddiskVolume1
Install Date: 6/26/2007 2:40:16 AM
System Uptime: 8/27/2011 12:01:00 PM (0 hours ago)
.
Motherboard: ASUSTek Computer INC. | | Hematite-XL
Processor: AMD Athlon(tm) 64 X2 Dual Core Processor 4200+ | Socket AM2 | 1800/200mhz
.
==== Disk Partitions =========================
.
C: is FIXED (NTFS) - 289 GiB total, 102.02 GiB free.
D: is FIXED (NTFS) - 9 GiB total, 1.004 GiB free.
E: is CDROM (CDFS)
F: is Removable
G: is Removable
H: is Removable
I: is Removable
.
==== Disabled Device Manager Items =============
.
==== System Restore Points ===================
.
.
==== Installed Programs ======================
.
Update for Microsoft Office 2007 (KB2508958)
Activation Assistant for the 2007 Microsoft Office suites
Adobe Flash Player 10 ActiveX
Adobe Flash Player 10 Plugin
Adobe Photoshop Elements 4.0
Adobe Reader 8.2.5
Adobe Shockwave Player
Apple Application Support
Apple Mobile Device Support
Apple Software Update
Bonjour
CCleaner
D3DX10
DivX Setup
Enhanced Multimedia Keyboard Solution
FlashGet(JetCar)
Google Chrome
Google Earth Plug-in
Google Update Helper
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)
HP Customer Experience Enhancements
HP Customer Feedback
HP Easy Setup - Frontend
HP On-Screen Cap/Num/Scroll Lock Indicator
HP Picasso Media Center Add-In
HP Total Care Advisor
iTunes
Java Auto Updater
Java(TM) 6 Update 2
Java(TM) 6 Update 20
Java(TM) 6 Update 3
Junk Mail filter update
League of Legends
LightScribe 1.4.142.1
Macromedia Shockwave Player
Malwarebytes' Anti-Malware version 1.51.1.1800
Mesh Runtime
Messenger Companion
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1 Security Update (KB2416447)
Microsoft .NET Framework 1.1 Security Update (KB979906)
Microsoft .NET Framework 3.5 SP1
Microsoft .NET Framework 4 Client Profile
Microsoft Application Error Reporting
Microsoft IntelliPoint 6.1
Microsoft Office 2007 Service Pack 2 (SP2)
Microsoft Office Excel MUI (English) 2007
Microsoft Office File Validation Add-In
Microsoft Office Home and Student 2007
Microsoft Office Live Add-in 1.5
Microsoft Office OneNote MUI (English) 2007
Microsoft Office PowerPoint MUI (English) 2007
Microsoft Office Proof (English) 2007
Microsoft Office Proof (French) 2007
Microsoft Office Proof (Spanish) 2007
Microsoft Office Proofing (English) 2007
Microsoft Office Shared MUI (English) 2007
Microsoft Office Shared Setup Metadata MUI (English) 2007
Microsoft Office Word MUI (English) 2007
Microsoft Silverlight
Microsoft SQL Server 2005 Compact Edition [ENU]
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
Microsoft Visual C++ 2005 Redistributable
Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
Microsoft Web Publishing Wizard 1.52
Microsoft Works
Mirar
MSVCRT
MSXML 4.0 SP2 (KB927978)
MSXML 4.0 SP2 (KB936181)
MSXML 4.0 SP2 (KB941833)
MSXML 4.0 SP2 (KB954430)
MSXML 4.0 SP2 (KB973688)
MSXML 4.0 SP2 Parser and SDK
Norton AntiVirus
Norton Security Scan
NVIDIA Drivers
OGA Notifier 2.0.0048.0
Pando Media Booster
Python 2.4.3
QuickTime
Realtek High Definition Audio Driver
Roxio Activation Module
Roxio Creator Audio
Roxio Creator Basic v9
Roxio Creator Copy
Roxio Creator Data
Roxio Creator EasyArchive
Roxio Creator Tools
Roxio Express Labeler 3
Roxio MyDVD Basic v9
Security Update for 2007 Microsoft Office System (KB2288621)
Security Update for 2007 Microsoft Office System (KB2288931)
Security Update for 2007 Microsoft Office System (KB2345043)
Security Update for 2007 Microsoft Office System (KB2509488)
Security Update for 2007 Microsoft Office System (KB969559)
Security Update for 2007 Microsoft Office System (KB976321)
Security Update for CAPICOM (KB931906)
Security Update for Microsoft .NET Framework 3.5 SP1 (KB2416473)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2446708)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2478663)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2518870)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2539636)
Security Update for Microsoft Office 2007 System (KB2541012)
Security Update for Microsoft Office Excel 2007 (KB2541007)
Security Update for Microsoft Office InfoPath 2007 (KB979441)
Security Update for Microsoft Office PowerPoint 2007 (KB2535818)
Security Update for Microsoft Office PowerPoint Viewer 2007 (KB2464623)
Security Update for Microsoft Office system 2007 (972581)
Security Update for Microsoft Office system 2007 (KB974234)
Security Update for Microsoft Office Visio Viewer 2007 (KB973709)
Security Update for Microsoft Office Word 2007 (KB2344993)
Segoe UI
Skype Toolbars
Skype™ 4.2
Spelling Dictionaries Support For Adobe Reader 8
Spybot - Search & Destroy
Update for 2007 Microsoft Office System (KB967642)
Update for Microsoft .NET Framework 3.5 SP1 (KB963707)
Update for Microsoft .NET Framework 4 Client Profile (KB2468871)
Update for Microsoft .NET Framework 4 Client Profile (KB2533523)
Update for Microsoft Office 2007 System (KB2539530)
Update for Microsoft Office OneNote 2007 (KB980729)
VC80CRTRedist - 8.0.50727.4053
Viewpoint Media Player
Warcraft III
Windows Live Communications Platform
Windows Live Essentials
Windows Live Family Safety
Windows Live ID Sign-in Assistant
Windows Live Installer
Windows Live Mail
Windows Live Mesh
Windows Live Mesh ActiveX Control for Remote Connections
Windows Live Messenger
Windows Live Messenger Companion Core
Windows Live MIME IFilter
Windows Live Movie Maker
Windows Live Photo Common
Windows Live Photo Gallery
Windows Live PIMT Platform
Windows Live Remote Client
Windows Live Remote Client Resources
Windows Live Remote Service
Windows Live Remote Service Resources
Windows Live SOXE
Windows Live SOXE Definitions
Windows Live Sync
Windows Live UX Platform
Windows Live UX Platform Language Pack
Windows Live Writer
Windows Live Writer Resources
Windows Media Player Firefox Plugin
WinRAR archiver
.
==== Event Viewer Messages From Past Week ========
.
8/27/2011 12:06:44 PM, Error: Service Control Manager [7022] - The Windows Update service hung on starting.
8/27/2011 12:01:52 PM, Error: Service Control Manager [7000] - The Parallel port driver service failed to start due to the following error: The service cannot be started, either because it is disabled or because it has no enabled devices associated with it.
8/27/2011 12:01:52 PM, Error: Service Control Manager [7000] - The LogMeIn Kernel Information Provider service failed to start due to the following error: The system cannot find the path specified.
8/27/2011 12:01:39 PM, Error: EventLog [6008] - The previous system shutdown at 11:59:15 AM on 8/27/2011 was unexpected.
8/24/2011 12:00:04 PM, Error: Microsoft-Windows-Dhcp-Client [1002] - The IP address lease 192.168.2.103 for the Network Card with network address 001BFC5EBAA5 has been denied by the DHCP server 192.168.2.1 (The DHCP Server sent a DHCPNACK message).
8/24/2011 12:00:01 PM, Error: EventLog [6008] - The previous system shutdown at 6:06:18 AM on 8/24/2011 was unexpected.
8/22/2011 8:11:51 PM, Error: Service Control Manager [7011] - A timeout (30000 milliseconds) was reached while waiting for a transaction response from the SysMain service.
8/22/2011 8:11:21 PM, Error: Service Control Manager [7011] - A timeout (30000 milliseconds) was reached while waiting for a transaction response from the TrkWks service.
.
==== End Of File ===========================



GMER 1.0.15.15641 - http://www.gmer.net
Rootkit scan 2011-08-27 19:38:08
Windows 6.0.6002 Service Pack 2 Harddisk0\DR0 -> \Device\0000005c ST332082 rev.3.AH
Running: d5g54j24.exe; Driver: C:\Users\COBALT~1\AppData\Local\Temp\fwriquob.sys


---- System - GMER 1.0.15 ----

SSDT 919014B0 ZwAlertResumeThread
SSDT 90DFC110 ZwAlertThread
SSDT 9207E670 ZwAllocateVirtualMemory
SSDT 8E17E9A0 ZwAlpcConnectPort
SSDT 914A1C98 ZwAssignProcessToJobObject
SSDT 920F6070 ZwCreateMutant
SSDT 920FB698 ZwCreateSymbolicLinkObject
SSDT 9207C950 ZwCreateThread
SSDT 914AE2B8 ZwDebugActiveProcess
SSDT 9207E888 ZwDuplicateObject
SSDT 9207DFC0 ZwFreeVirtualMemory
SSDT 919C3108 ZwImpersonateAnonymousToken
SSDT 91462120 ZwImpersonateThread
SSDT 8E151488 ZwLoadDriver
SSDT 9207DEA0 ZwMapViewOfSection
SSDT 919B9880 ZwOpenEvent
SSDT 9207EAE8 ZwOpenProcess
SSDT 90D77030 ZwOpenProcessToken
SSDT 9146CE00 ZwOpenSection
SSDT 9207E998 ZwOpenThread
SSDT 920FA3B0 ZwProtectVirtualMemory
SSDT 90DF9118 ZwResumeThread
SSDT 8E2BCD50 ZwSetContextThread
SSDT 9207DCC8 ZwSetInformationProcess
SSDT 919DF700 ZwSetSystemInformation
SSDT 919B9120 ZwSuspendProcess
SSDT 90DFB068 ZwSuspendThread
SSDT 90D75030 ZwTerminateProcess
SSDT 915FF658 ZwTerminateThread
SSDT 90D91030 ZwUnmapViewOfSection
SSDT 9207E360 ZwWriteVirtualMemory
SSDT 920FBB68 ZwCreateThreadEx

---- Kernel code sections - GMER 1.0.15 ----

.text ntkrnlpa.exe!KeSetEvent + 11D 826C68A0 8 Bytes [B0, 14, 90, 91, 10, C1, DF, ...]
.text ntkrnlpa.exe!KeSetEvent + 131 826C68B4 4 Bytes [70, E6, 07, 92] {JO 0xffffffffffffffe8; POP ES; XCHG EDX, EAX}
.text ntkrnlpa.exe!KeSetEvent + 13D 826C68C0 4 Bytes JMP CBDFF6DC
.text ntkrnlpa.exe!KeSetEvent + 191 826C6914 4 Bytes [98, 1C, 4A, 91] {CWDE ; SBB AL, 0x4a; XCHG ECX, EAX}
.text ntkrnlpa.exe!KeSetEvent + 1F5 826C6978 4 Bytes [70, 60, 0F, 92]
.text ...
.text C:\Windows\system32\DRIVERS\nvlddmkm.sys section is writeable [0x8C800340, 0x3DA8C7, 0xE8000020]
? C:\Users\COBALT~1\AppData\Local\Temp\aswMBR.sys The system cannot find the file specified. !
? C:\Users\COBALT~1\AppData\Local\Temp\mbr.sys The system cannot find the file specified. !

---- User IAT/EAT - GMER 1.0.15 ----

IAT C:\Windows\Explorer.EXE[3168] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdiplusShutdown] [74377817] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18342_none_9e54f8aaca13c773\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[3168] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipCloneImage] [743CA86D] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18342_none_9e54f8aaca13c773\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[3168] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipDrawImageRectI] [7437BB22] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18342_none_9e54f8aaca13c773\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[3168] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipSetInterpolationMode] [7436F695] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18342_none_9e54f8aaca13c773\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[3168] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdiplusStartup] [743775E9] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18342_none_9e54f8aaca13c773\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[3168] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipCreateFromHDC] [7436E7CA] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18342_none_9e54f8aaca13c773\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[3168] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipCreateBitmapFromStreamICM] [743A8395] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18342_none_9e54f8aaca13c773\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[3168] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipCreateBitmapFromStream] [7437DA60] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18342_none_9e54f8aaca13c773\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[3168] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipGetImageHeight] [7436FFFA] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18342_none_9e54f8aaca13c773\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[3168] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipGetImageWidth] [7436FF61] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18342_none_9e54f8aaca13c773\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[3168] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipDisposeImage] [743671CF] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18342_none_9e54f8aaca13c773\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[3168] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipLoadImageFromFileICM] [743FCAE2] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18342_none_9e54f8aaca13c773\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[3168] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipLoadImageFromFile] [7439C8D8] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18342_none_9e54f8aaca13c773\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[3168] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipDeleteGraphics] [7436D968] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18342_none_9e54f8aaca13c773\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[3168] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipFree] [74366853] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18342_none_9e54f8aaca13c773\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[3168] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipAlloc] [7436687E] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18342_none_9e54f8aaca13c773\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[3168] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipSetCompositingMode] [74372AD1] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18342_none_9e54f8aaca13c773\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)

---- Registry - GMER 1.0.15 ----

Reg HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Media Center\Service\Scheduler@Heartbeat 0x37 0x28 0xC8 0xBC ...

---- EOF - GMER 1.0.15 ----

 

Update: All logs have been posted.

 

ComboFix 11-08-27.01 - Cobaltgirl 08/28/2011 12:25:02.1.2 - x86
Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.1.1033.18.1918.859 [GMT -4:00]
Running from: c:\users\Cobaltgirl\Desktop\ComboFix.exe
AV: Norton AntiVirus *Disabled/Updated* {88C95A36-8C3B-2F2C-1B8B-30FCCFDC4855}
SP: Norton AntiVirus *Disabled/Updated* {33A8BBD2-AA01-20A2-213B-0B8EB45B02E8}
SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
C:\desktop.ini
c:\programdata\120
c:\programdata\120\{9F0F9D4B-C80F-47E8-A0AA-4BC747B44776}.swf
c:\programdata\244
c:\programdata\244\{8E8A05F8-02A3-4306-8670-262AD8D0E345}.swf
c:\users\Cobaltgirl\AppData\Roaming\Local
c:\users\Cobaltgirl\AppData\Roaming\Local\Temp\DDM\Settings\0.ddi
c:\users\Cobaltgirl\AppData\Roaming\Local\Temp\DDM\Settings\1.ddi
c:\users\Cobaltgirl\AppData\Roaming\Local\Temp\DDM\Settings\10.ddi
c:\users\Cobaltgirl\AppData\Roaming\Local\Temp\DDM\Settings\2.ddi
c:\users\Cobaltgirl\AppData\Roaming\Local\Temp\DDM\Settings\3.ddi
c:\users\Cobaltgirl\AppData\Roaming\Local\Temp\DDM\Settings\4.ddi
c:\users\Cobaltgirl\AppData\Roaming\Local\Temp\DDM\Settings\5.ddi
c:\users\Cobaltgirl\AppData\Roaming\Local\Temp\DDM\Settings\6.ddi
c:\users\Cobaltgirl\AppData\Roaming\Local\Temp\DDM\Settings\7.ddi
c:\users\Cobaltgirl\AppData\Roaming\Local\Temp\DDM\Settings\8.ddi
c:\users\Cobaltgirl\AppData\Roaming\Local\Temp\DDM\Settings\Chck0101_ns.avi(2).ddr
c:\users\Cobaltgirl\AppData\Roaming\Local\Temp\DDM\Settings\Chck0101_ns.avi(3).ddr
c:\users\Cobaltgirl\AppData\Roaming\Local\Temp\DDM\Settings\Chck0101_ns.avi.ddr
c:\users\Cobaltgirl\AppData\Roaming\Local\Temp\DDM\Settings\chuck.110.hdtv-lol.www.therebels.com.br_ns.avi.ddr
c:\users\Cobaltgirl\AppData\Roaming\Local\Temp\DDM\Settings\Chuck101_ns.avi(2).ddr
c:\users\Cobaltgirl\AppData\Roaming\Local\Temp\DDM\Settings\Chuck101_ns.avi(3).ddr
c:\users\Cobaltgirl\AppData\Roaming\Local\Temp\DDM\Settings\Chuck101_ns.avi.ddr
c:\users\Cobaltgirl\AppData\Roaming\Local\Temp\DDM\Settings\settings.ddi
c:\users\Cobaltgirl\AppData\Roaming\Local\Temp\DDM\Settings\Temporary Downloaded Files\Chck0101_ns.avi(2).ddp
c:\users\Cobaltgirl\AppData\Roaming\Local\Temp\DDM\Settings\Temporary Downloaded Files\Chck0101_ns.avi(3).ddp
c:\users\Cobaltgirl\AppData\Roaming\Local\Temp\DDM\Settings\Temporary Downloaded Files\Chck0101_ns.avi(4).ddp
c:\users\Cobaltgirl\AppData\Roaming\Local\Temp\DDM\Settings\Temporary Downloaded Files\Chck0101_ns.avi(5).ddp
c:\users\Cobaltgirl\AppData\Roaming\Local\Temp\DDM\Settings\Temporary Downloaded Files\Chck0101_ns.avi.ddp
c:\users\Cobaltgirl\AppData\Roaming\Local\Temp\DDM\Settings\Temporary Downloaded Files\chuck.110.hdtv-lol.www.therebels.com.br_ns.avi
c:\users\Cobaltgirl\AppData\Roaming\Local\Temp\DDM\Settings\Temporary Downloaded Files\Chuck101_ns.avi
c:\users\Cobaltgirl\AppData\Roaming\Local\Temp\DDM\Settings\Temporary Downloaded Files\Chuck101_ns.avi(3).ddp
c:\users\Cobaltgirl\AppData\Roaming\Local\Temp\DDM\Settings\Temporary Downloaded Files\Chuck101_ns.avi.ddp
c:\users\Cobaltgirl\AppData\Roaming\Local\Temp\DDM\Settings\Temporary Downloaded Files\video(2).avi
c:\users\Cobaltgirl\AppData\Roaming\Local\Temp\DDM\Settings\Temporary Downloaded Files\video.avi
c:\users\Cobaltgirl\AppData\Roaming\Local\Temp\DDM\Settings\Temporary Downloaded Files\video.avi.ddp
c:\users\Cobaltgirl\AppData\Roaming\Local\Temp\DDM\Settings\video.avi(2).ddr
c:\users\Cobaltgirl\AppData\Roaming\Local\Temp\DDM\Settings\video.avi(3).ddr
c:\users\Cobaltgirl\AppData\Roaming\Local\Temp\DDM\Settings\video.avi.ddr
c:\windows\system32\comct332.ocx
.
.
((((((((((((((((((((((((( Files Created from 2011-07-28 to 2011-08-28 )))))))))))))))))))))))))))))))
.
.
2011-08-28 16:33 . 2011-08-28 16:33 -------- d-----w- c:\users\Cobaltgirl\AppData\Local\temp
2011-08-28 16:33 . 2011-08-28 16:33 -------- d-----w- c:\users\Public\AppData\Local\temp
2011-08-28 16:33 . 2011-08-28 16:33 -------- d-----w- c:\users\Default\AppData\Local\temp
2011-08-27 15:22 . 2011-08-27 15:22 -------- d-----w- c:\users\Cobaltgirl\AppData\Roaming\Malwarebytes
2011-08-27 15:22 . 2011-07-06 23:52 41272 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2011-08-27 15:22 . 2011-08-27 15:22 -------- d-----w- c:\programdata\Malwarebytes
2011-08-27 15:22 . 2011-07-06 23:52 22712 ----a-w- c:\windows\system32\drivers\mbam.sys
2011-08-27 15:22 . 2011-08-27 15:22 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2011-08-27 00:56 . 2011-08-27 00:56 -------- d-----w- c:\users\Cobaltgirl\riotsGamesLogs
2011-08-24 05:52 . 2011-07-11 13:25 2048 ----a-w- c:\windows\system32\tzres.dll
2011-08-24 00:05 . 2011-08-24 00:05 -------- d-----w- C:\Riot Games
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-06-02 13:34 . 2011-07-14 16:55 2043392 ----a-w- c:\windows\system32\win32k.sys
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ehTray.exe "= "c:\windows\ehome\ehTray.exe" [2008-01-19 125952]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"QuickTime Task "= "c:\program files\QuickTime\QTTask.exe" [2010-11-29 421888]
"DivX Download Manager "= "c:\program files\DivX\DivX Plus Web Player\DDmService.exe" [2010-12-08 63360]
"DivXUpdate "= "c:\program files\DivX\DivX Update\DivXUpdate.exe" [2011-01-10 1230704]
"iTunesHelper "= "c:\program files\iTunes\iTunesHelper.exe" [2011-01-25 421160]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin "= 0 (0x0)
"EnableLUA "= 0 (0x0)
"EnableUIADesktopToggle "= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux "=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring "=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring "=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring "=dword:00000001
.
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [2010-03-06 135664]
R2 LMIInfo;LogMeIn Kernel Information Provider;c:\program files\LogMeIn\x86\RaInfo.sys [x]
R3 dc3d;USBCCGP filter driver (dc3d);c:\windows\system32\DRIVERS\dc3d.sys [2009-01-15 15360]
R3 gupdatem;Google Update Service (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [2010-03-06 135664]
R3 npggsvc;nProtect GameGuard Service;c:\windows\system32\GameMon.des [2010-06-02 3623304]
R3 radpms;Driver for RADPMS Device;c:\windows\system32\DRIVERS\radpms.sys [2010-09-17 13408]
R3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [2010-03-18 753504]
R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe [2010-09-22 51040]
S0 AFS;AFS; [x]
S0 SymDS;Symantec Data Store;c:\windows\system32\drivers\NAV\1108000.005\SYMDS.SYS [2009-11-05 328752]
S0 SymEFA;Symantec Extended File Attributes;c:\windows\system32\drivers\NAV\1108000.005\SYMEFA.SYS [2010-04-22 173104]
S1 BHDrvx86;BHDrvx86;c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NAV_17.1.0.19\Definitions\BASHDefs\20110812.001\BHDrvx86.sys [2011-07-23 815736]
S1 ccHP;Symantec Hash Provider;c:\windows\system32\drivers\NAV\1108000.005\ccHPx86.sys [2010-02-26 501888]
S1 IDSVix86;IDSVix86;c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NAV_17.1.0.19\Definitions\IPSDefs\20110826.030\IDSvix86.sys [2011-08-23 368248]
S1 SymIRON;Symantec Iron Driver;c:\windows\system32\drivers\NAV\1108000.005\Ironx86.SYS [2010-04-29 116784]
S1 SYMTDIv;Symantec Vista Network Dispatch Driver;c:\windows\System32\Drivers\NAV\1108000.005\SYMTDIV.SYS [2010-05-06 339504]
S2 NAV;Norton AntiVirus;c:\program files\Norton AntiVirus\Engine\17.8.0.5\ccSvcHst.exe [2010-02-26 126392]
S2 SBSDWSCService;SBSD Security Center Service;c:\program files\Spybot - Search & Destroy\SDWinSec.exe [2009-01-26 1153368]
S3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [2011-07-27 105592]
S3 netr73;USB Wireless 802.11 b/g Adaptor Driver for Vista;c:\windows\system32\DRIVERS\netr73.sys [2009-05-24 501248]
S3 xcbdaNtsc;ViXS Tuner Card (NTSC);c:\windows\system32\DRIVERS\xcbda.sys [2007-09-07 156928]
.
.
--- Other Services/Drivers In Memory ---
.
*NewlyCreated* - ASWMBR
*Deregistered* - aswMBR
*Deregistered* - fwriquob
*Deregistered* - MBAMSwissArmy
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache
.
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{A509B1FF-37FF-4bFF-8CFF-4F3A747040FF}]
2009-03-08 11:32 128512 ----a-w- c:\windows\System32\advpack.dll
.
Contents of the 'Scheduled Tasks' folder
.
2011-08-27 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-03-06 01:18]
.
2011-08-28 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-03-06 01:18]
.
2011-08-28 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-4070133263-2202993839-2431433440-1000Core.job
- c:\users\Cobaltgirl\AppData\Local\Google\Update\GoogleUpdate.exe [2010-03-17 01:18]
.
2011-08-28 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-4070133263-2202993839-2431433440-1000UA.job
- c:\users\Cobaltgirl\AppData\Local\Google\Update\GoogleUpdate.exe [2010-03-17 01:18]
.
2008-05-30 c:\windows\Tasks\HPCeeScheduleForCobaltgirl.job
- c:\program files\Hewlett-Packard\SDP\Ceement\HPCEE.exe [2007-05-09 18:56]
.
2011-08-27 c:\windows\Tasks\User_Feed_Synchronization-{5189F636-EF84-46D1-95C3-D8746B17B93F}.job
- c:\windows\system32\msfeedssync.exe [2011-08-10 09:26]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://securityresponse.symantec.com/avcenter/fix_homepage
uDefault_Search_URL = hxxp://www.google.com/ie
mStart Page = hxxp://www.yahoo.com
uInternet Settings,ProxyOverride = <local>;*.local
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000
TCP: DhcpNameServer = 192.168.2.1 192.168.1.254
.
- - - - ORPHANS REMOVED - - - -
.
URLSearchHooks-{ba14329e-9550-4989-b3f2-9732e92d17cc} - (no file)
URLSearchHooks-{b9d63c58-90cc-428b-8d3b-cbb88eb07e7e} - (no file)
BHO-{C6185C12-9907-7356-0E99-52CB65B7CC1C} - (no file)
BHO-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file)
Toolbar-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file)
WebBrowser-{B9D63C58-90CC-428B-8D3B-CBB88EB07E7E} - (no file)
HKLM-Run-LogMeIn GUI - c:\program files\LogMeIn\x86\LogMeInSystray.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-08-28 12:33
Windows 6.0.6002 Service Pack 2 NTFS
.
scanning hidden processes ...
.
scanning hidden autostart entries ...
.
scanning hidden files ...
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\NAV]
"ImagePath "= "\ "c:\program files\Norton AntiVirus\Engine\17.8.0.5\ccSvcHst.exe\" /s \ "NAV\" /m \ "c:\program files\Norton AntiVirus\Engine\17.8.0.5\diMaster.dll\" /prefetch:1 "
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\npggsvc]
"ImagePath "= "c:\windows\system32\GameMon.des -service "
.
Completion time: 2011-08-28 12:36:47
ComboFix-quarantined-files.txt 2011-08-28 16:36
.
Pre-Run: 110,799,671,296 bytes free
Post-Run: 112,270,905,344 bytes free
.
- - End Of File - - 93D6FC455B24DF941711B26B26035386

This log file is located at C:\rkill.log.
Please post this only if requested to by the person helping you.
Otherwise you can close this log when you wish.

Rkill was run on 08/28/2011 at 12:38:04.
Operating System: Windows Vista (TM) Home Premium


Processes terminated by Rkill or while it was running:

C:\Users\Cobaltgirl\AppData\Local\Google\Update\1.3.21.65\GoogleCrashHandler.exe


Rkill completed on 08/28/2011 at 12:38:09.

 

OTL logfile created on: 8/28/2011 4:28:42 PM - Run 1
OTL by OldTimer - Version 3.2.26.6 Folder = C:\Users\Cobaltgirl\Downloads
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.19120)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

1.87 Gb Total Physical Memory | 0.46 Gb Available Physical Memory | 24.49% Memory free
3.98 Gb Paging File | 2.43 Gb Available in Paging File | 61.05% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 289.30 Gb Total Space | 104.63 Gb Free Space | 36.17% Space Free | Partition Type: NTFS
Drive D: | 8.79 Gb Total Space | 1.00 Gb Free Space | 11.42% Space Free | Partition Type: NTFS
Drive E: | 579.41 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS

Computer Name: COBALTGIRL-PC | User Name: Cobaltgirl | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2011/08/28 16:27:31 | 000,580,096 | ---- | M] (OldTimer Tools) -- C:\Users\Cobaltgirl\Downloads\OTL.exe
PRC - [2010/02/25 20:21:50 | 000,126,392 | R--- | M] (Symantec Corporation) -- C:\Program Files\Norton AntiVirus\Engine\17.8.0.5\ccsvchst.exe
PRC - [2009/04/11 02:27:36 | 002,926,592 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe
PRC - [2009/04/11 02:27:28 | 000,069,120 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\conime.exe
PRC - [2009/01/26 16:31:10 | 001,153,368 | ---- | M] (Safer Networking Ltd.) -- C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe
PRC - [2008/11/09 16:48:14 | 000,602,392 | ---- | M] (Yahoo! Inc.) -- C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe


========== Modules (No Company Name) ==========

MOD - [2011/08/17 05:49:17 | 000,400,440 | ---- | M] () -- C:\Users\Cobaltgirl\AppData\Local\Google\Chrome\Application\13.0.782.215\ppGoogleNaClPluginChrome.dll
MOD - [2011/08/17 05:49:15 | 004,118,072 | ---- | M] () -- C:\Users\Cobaltgirl\AppData\Local\Google\Chrome\Application\13.0.782.215\pdf.dll
MOD - [2011/08/17 05:47:49 | 000,104,520 | ---- | M] () -- C:\Users\Cobaltgirl\AppData\Local\Google\Chrome\Application\13.0.782.215\avutil-50.dll
MOD - [2011/08/17 05:47:48 | 000,203,848 | ---- | M] () -- C:\Users\Cobaltgirl\AppData\Local\Google\Chrome\Application\13.0.782.215\avformat-52.dll
MOD - [2011/08/17 05:47:47 | 001,846,344 | ---- | M] () -- C:\Users\Cobaltgirl\AppData\Local\Google\Chrome\Application\13.0.782.215\avcodec-52.dll


========== Win32 Services (SafeList) ==========

SRV - [2010/06/02 13:12:00 | 003,623,304 | ---- | M] (INCA Internet Co., Ltd.) [On_Demand | Stopped] -- C:\Windows\System32\GameMon.des -- (npggsvc)
SRV - [2010/02/25 20:21:50 | 000,126,392 | R--- | M] (Symantec Corporation) [Unknown | Running] -- C:\Program Files\Norton AntiVirus\Engine\17.8.0.5\ccSvcHst.exe -- (NAV)
SRV - [2009/01/26 16:31:10 | 001,153,368 | ---- | M] (Safer Networking Ltd.) [Auto | Running] -- C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe -- (SBSDWSCService)
SRV - [2008/11/09 16:48:14 | 000,602,392 | ---- | M] (Yahoo! Inc.) [Auto | Running] -- C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe -- (YahooAUService)
SRV - [2008/01/19 03:38:24 | 000,272,952 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)
SRV - [2005/10/03 12:04:04 | 000,102,400 | ---- | M] () [Auto | Stopped] -- C:\Program Files\Adobe\Photoshop Elements 4.0\PhotoshopElementsFileAgent.exe -- (AdobeActiveFileMonitor4.0)


========== Driver Services (SafeList) ==========

DRV - [2011/08/23 00:17:32 | 000,368,248 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NAV_17.1.0.19\Definitions\IPSDefs\20110826.030\IDSvix86.sys -- (IDSVix86)
DRV - [2011/08/03 21:24:00 | 001,576,312 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NAV_17.1.0.19\Definitions\VirusDefs\20110828.002\NAVEX15.SYS -- (NAVEX15)
DRV - [2011/08/03 21:24:00 | 000,086,136 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NAV_17.1.0.19\Definitions\VirusDefs\20110828.002\NAVENG.SYS -- (NAVENG)
DRV - [2011/07/27 18:56:28 | 000,105,592 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\Program Files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys -- (EraserUtilRebootDrv)
DRV - [2011/07/27 18:56:27 | 000,374,392 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\Program Files\Common Files\Symantec Shared\EENGINE\eeCtrl.sys -- (eeCtrl)
DRV - [2011/07/22 20:27:23 | 000,815,736 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NAV_17.1.0.19\Definitions\BASHDefs\20110812.001\BHDrvx86.sys -- (BHDrvx86)
DRV - [2010/12/08 14:12:02 | 000,083,360 | ---- | M] (LogMeIn, Inc.) [File_System | Disabled | Stopped] -- C:\Windows\System32\LMIRfsClientNP.dll -- (LMIRfsClientNP)
DRV - [2010/09/17 16:40:06 | 000,047,640 | ---- | M] (LogMeIn, Inc.) [File_System | Auto | Running] -- C:\Windows\System32\drivers\LMIRfsDriver.sys -- (LMIRfsDriver)
DRV - [2010/09/17 16:39:58 | 000,013,408 | ---- | M] (LogMeIn, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\radpms.sys -- (radpms)
DRV - [2010/05/06 00:01:59 | 000,339,504 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\Windows\System32\Drivers\NAV\1108000.005\SYMTDIV.SYS -- (SYMTDIv)
DRV - [2010/04/29 01:03:51 | 000,116,784 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\Windows\system32\drivers\NAV\1108000.005\Ironx86.SYS -- (SymIRON)
DRV - [2010/04/21 23:02:20 | 000,173,104 | ---- | M] (Symantec Corporation) [File_System | Boot | Running] -- C:\Windows\system32\drivers\NAV\1108000.005\SYMEFA.SYS -- (SymEFA)
DRV - [2010/04/21 22:29:50 | 000,325,680 | ---- | M] (Symantec Corporation) [File_System | System | Running] -- C:\Windows\System32\Drivers\NAV\1108000.005\SRTSP.SYS -- (SRTSP)
DRV - [2010/04/21 22:29:50 | 000,043,696 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\Windows\system32\drivers\NAV\1108000.005\SRTSPX.SYS -- (SRTSPX) Symantec Real Time Storage Protection (PEL)
DRV - [2010/02/25 20:22:57 | 000,501,888 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\Windows\system32\drivers\NAV\1108000.005\ccHPx86.sys -- (ccHP)
DRV - [2009/12/28 14:40:30 | 000,124,976 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\SYMEVENT.SYS -- (SymEvent)
DRV - [2009/11/05 18:06:13 | 000,328,752 | R--- | M] (Symantec Corporation) [Kernel | Boot | Running] -- C:\Windows\system32\drivers\NAV\1108000.005\SYMDS.SYS -- (SymDS)
DRV - [2009/05/24 08:36:42 | 000,501,248 | ---- | M] (Ralink Technology, Corp.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\netr73.sys -- (netr73)
DRV - [2009/05/23 23:53:45 | 000,025,280 | ---- | M] (LogMeIn, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\hamachi.sys -- (hamachi)
DRV - [2009/01/15 10:15:26 | 000,015,360 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\dc3d.sys -- (dc3d) USBCCGP filter driver (dc3d)
DRV - [2008/08/01 20:51:14 | 001,052,704 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nvmfdx32.sys -- (NVENETFD)
DRV - [2008/05/22 22:49:00 | 007,465,312 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nvlddmkm.sys -- (nvlddmkm)
DRV - [2008/04/29 21:57:38 | 000,079,052 | ---- | M] (Oak Technology Inc.) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\AFS.SYS -- (AFS)
DRV - [2007/11/13 20:11:55 | 000,008,413 | ---- | M] (RealNetworks, Inc.) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\mcstrm.sys -- (MCSTRM)
DRV - [2007/10/26 19:51:22 | 000,110,624 | ---- | M] (NVIDIA Corporation) [Kernel | Boot | Running] -- C:\Windows\system32\drivers\nvstor32.sys -- (nvstor32)
DRV - [2007/09/07 07:36:08 | 000,156,928 | ---- | M] (ViXS Systems Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\xcbda.sys -- (xcbdaNtsc) ViXS Tuner Card (NTSC)
DRV - [2006/11/08 03:02:40 | 000,024,064 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\point32k.sys -- (Point32)
DRV - [2005/12/12 13:27:00 | 000,019,072 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\PS2.sys -- (Ps2)
DRV - [2001/05/07 06:56:02 | 000,019,805 | ---- | M] (Thesycon GmbH, Germany) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\usbio.sys -- (USBIO) USBIO Driver (usbio.sys)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,CustomSearch = http://us.rd.yahoo.com/customize/ie/defaults/cs/msgr9/*http://www.yahoo.com/ext/search/search.html


IE - HKU\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\Main,XMLHTTP_UUID_Default = 5F 0A 65 01 2F 6A 47 4A A4 80 CF B4 6E 28 AC C7 [binary data]
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-18\SOFTWARE\Microsoft\Internet Explorer\Main,XMLHTTP_UUID_Default = 5F 0A 65 01 2F 6A 47 4A A4 80 CF B4 6E 28 AC C7 [binary data]
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-19\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = http://search.msn.com/spbasic.htm
IE - HKU\S-1-5-19\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://securityresponse.symantec.com/avcenter/fix_homepage
IE - HKU\S-1-5-19\SOFTWARE\Microsoft\Internet Explorer\Main,XMLHTTP_UUID_Default = 5F 0A 65 01 2F 6A 47 4A A4 80 CF B4 6E 28 AC C7 [binary data]

IE - HKU\S-1-5-20\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = http://search.msn.com/spbasic.htm
IE - HKU\S-1-5-20\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://securityresponse.symantec.com/avcenter/fix_homepage
IE - HKU\S-1-5-20\SOFTWARE\Microsoft\Internet Explorer\Main,XMLHTTP_UUID_Default = 5F 0A 65 01 2F 6A 47 4A A4 80 CF B4 6E 28 AC C7 [binary data]

IE - HKU\S-1-5-21-4070133263-2202993839-2431433440-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.google.com/ie
IE - HKU\S-1-5-21-4070133263-2202993839-2431433440-1000\SOFTWARE\Microsoft\Internet Explorer\Main,SearchDefaultBranded = 1
IE - HKU\S-1-5-21-4070133263-2202993839-2431433440-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://securityresponse.symantec.com/avcenter/fix_homepage
IE - HKU\S-1-5-21-4070133263-2202993839-2431433440-1000\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKU\S-1-5-21-4070133263-2202993839-2431433440-1000\SOFTWARE\Microsoft\Internet Explorer\Main,XMLHTTP_UUID_Default = 5F 0A 65 01 2F 6A 47 4A A4 80 CF B4 6E 28 AC C7 [binary data]
IE - HKU\S-1-5-21-4070133263-2202993839-2431433440-1000\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = http://www.google.com/ie
IE - HKU\S-1-5-21-4070133263-2202993839-2431433440-1000\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ie
IE - HKU\S-1-5-21-4070133263-2202993839-2431433440-1000\..\URLSearchHook: {EF99BD32-C1FB-11D2-892F-0090271D4F88} - Reg Error: Key error. File not found
IE - HKU\S-1-5-21-4070133263-2202993839-2431433440-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-21-4070133263-2202993839-2431433440-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = <local>;*.local

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\Windows\system32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Content Upload Plugin,version=1.0.0: File not found
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX OVS Helper,version=1.0.0: C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF - HKLM\Software\MozillaPlugins\@messenger.yahoo.com/YahooMessengerStatePlugin;version=1.0.0.6: File not found
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\4.0.60531.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeLive,version=1.5: C:\Program Files\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3508.1109: C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@pandonetworks.com/PandoWebPlugin: C:\Program Files\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.65\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.65\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@viewpoint.com/VMP: File not found
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Users\Cobaltgirl\AppData\Local\Google\Update\1.3.21.65\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Users\Cobaltgirl\AppData\Local\Google\Update\1.3.21.65\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\pandonetworks.com/PandoWebPlugin: C:\Program Files\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{BBDA0591-3099-440a-AA10-41764D9DB4DB}: C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NAV_17.1.0.19\IPSFFPlgn\ [2011/07/23 16:14:48 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{23fcfd51-4958-4f00-80a3-ae97e717ed8b}: C:\Program Files\DivX\DivX Plus Web Player\firefox\html5video [2011/02/01 19:19:52 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{6904342A-8307-11DF-A508-4AE2DFD72085}: C:\Program Files\DivX\DivX Plus Web Player\firefox\wpa [2011/02/01 19:19:52 | 000,000,000 | ---D | M]

[2011/06/04 13:19:49 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Cobaltgirl\AppData\Roaming\mozilla\Extensions
[2009/04/26 20:38:04 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Cobaltgirl\AppData\Roaming\mozilla\Extensions\mozswing@mozswing.org
[2011/06/04 13:19:54 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions
[2010/09/29 22:07:00 | 000,000,000 | ---D | M] (Skype extension for Firefox) -- C:\Program Files\Mozilla Firefox\extensions\{AB2CE124-6272-4b12-94A9-7303C7397BD1}
[2010/05/27 17:35:11 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
[2011/01/26 17:22:27 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions\plugin@yontoo.com
[2010/04/12 17:29:19 | 000,411,368 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\mozilla firefox\plugins\npdeployJava1.dll

O1 HOSTS File: ([2011/08/28 12:33:07 | 000,000,027 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - No CLSID value found.
O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (DivX Plus Web Player HTML5 <video>) - {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
O2 - BHO: (Spybot-S&D IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O2 - BHO: (DivX HiQ) - {593DDEC6-7468-4cdd-90E1-42DADAA222E9} - C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
O2 - BHO: (Symantec Intrusion Prevention) - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files\Norton AntiVirus\Engine\17.8.0.5\ipsbho.dll (Symantec Corporation)
O2 - BHO: (Skype add-on for Internet Explorer) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O2 - BHO: (no name) - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - No CLSID value found.
O3 - HKLM\..\Toolbar: (FlashGet Bar) - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - C:\Program Files\FlashGet\fgiebar.dll (Amaze Soft)
O3 - HKLM\..\Toolbar: (no name) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - No CLSID value found.
O3 - HKU\S-1-5-21-4070133263-2202993839-2431433440-1000\..\Toolbar\WebBrowser: (no name) - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No CLSID value found.
O3 - HKU\S-1-5-21-4070133263-2202993839-2431433440-1000\..\Toolbar\WebBrowser: (no name) - {E67C74F4-A00A-4F2C-9FEC-FD9DC004A67F} - No CLSID value found.
O4 - HKLM..\Run: [DivX Download Manager] C:\Program Files\DivX\DivX Plus Web Player\DDmService.exe (DivX, LLC)
O4 - HKLM..\Run: [DivXUpdate] C:\Program Files\DivX\DivX Update\DivXUpdate.exe ()
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0
O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-4070133263-2202993839-2431433440-1000\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-4070133263-2202993839-2431433440-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-21-4070133263-2202993839-2431433440-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKU\S-1-5-21-4070133263-2202993839-2431433440-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: LogonHoursAction = 2
O7 - HKU\S-1-5-21-4070133263-2202993839-2431433440-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DontDisplayLogonHoursWarnings = 1
O9 - Extra Button: Skype add-on for Internet Explorer - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra 'Tools' menuitem : Skype add-on for Internet Explorer - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra 'Tools' menuitem : Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O15 - HKU\.DEFAULT\..Trusted Ranges: Range1 ([http] in Local intranet)
O15 - HKU\S-1-5-18\..Trusted Ranges: Range1 ([http] in Local intranet)
O15 - HKU\S-1-5-21-4070133263-2202993839-2431433440-1000\..Trusted Ranges: Range1 ([http] in Local intranet)
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab (Java Plug-in 1.6.0_20)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1 192.168.1.254
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\Users\Cobaltgirl\AppData\Roaming\Microsoft\Windows Photo Gallery\Windows Photo Gallery Wallpaper.jpg
O24 - Desktop BackupWallPaper: C:\Users\Cobaltgirl\AppData\Roaming\Microsoft\Windows Photo Gallery\Windows Photo Gallery Wallpaper.jpg
O28 - HKLM ShellExecuteHooks: {AEB6717E-7E19-11d0-97EE-00C04FD91972} - Reg Error: Key error. File not found
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2007/05/09 02:02:39 | 000,000,074 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O32 - AutoRun File - [2008/02/19 12:22:43 | 000,000,051 | R--- | M] () - E:\autorun.inf -- [ CDFS ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKU\S-1-5-21-4070133263-2202993839-2431433440-1000\...com [@ = ComFile] -- Reg Error: Key error. File not found

NetSvcs: FastUserSwitchingCompatibility - File not found
NetSvcs: Ias - C:\Windows\System32\ias.dll (Microsoft Corporation)
NetSvcs: Nla - File not found
NetSvcs: Ntmssvc - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: SRService - File not found
NetSvcs: WmdmPmSp - File not found
NetSvcs: LogonHours - File not found
NetSvcs: PCAudit - File not found
NetSvcs: helpsvc - File not found
NetSvcs: uploadmgr - File not found

Drivers32: msacm.l3acm - C:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: MSVideo8 - C:\Windows\System32\vfwwdm32.dll (Microsoft Corporation)
Drivers32: vidc.cvid - C:\Windows\System32\iccvid.dll (Radius Inc.)
Drivers32: vidc.DIVX - C:\Windows\System32\DivX.dll (DivX, Inc.)
Drivers32: vidc.yv12 - C:\Windows\System32\DivX.dll (DivX, Inc.)

CREATERESTOREPOINT
Restore point Set: OTL Restore Point

========== Files/Folders - Created Within 30 Days ==========

[2011/08/28 12:36:53 | 000,000,000 | -HSD | C] -- C:\$RECYCLE.BIN
[2011/08/28 12:36:50 | 000,000,000 | ---D | C] -- C:\Windows\temp
[2011/08/28 12:36:50 | 000,000,000 | ---D | C] -- C:\Users\Cobaltgirl\AppData\Local\temp
[2011/08/28 12:22:55 | 000,000,000 | ---D | C] -- C:\ComboFix
[2011/08/28 12:16:44 | 004,187,178 | R--- | C] (Swearware) -- C:\Users\Cobaltgirl\Desktop\ComboFix.exe
[2011/08/27 17:26:57 | 000,000,000 | ---D | C] -- C:\Users\Cobaltgirl\Desktop\gmer
[2011/08/27 11:22:22 | 000,000,000 | ---D | C] -- C:\Users\Cobaltgirl\AppData\Roaming\Malwarebytes
[2011/08/27 11:22:12 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2011/08/27 11:22:11 | 000,041,272 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbamswissarmy.sys
[2011/08/27 11:22:09 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2011/08/27 11:22:04 | 000,022,712 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys
[2011/08/27 11:22:03 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware
[2011/08/26 20:56:33 | 000,000,000 | ---D | C] -- C:\Users\Cobaltgirl\riotsGamesLogs
[2011/08/23 20:05:36 | 000,000,000 | ---D | C] -- C:\Riot Games
[2011/08/23 20:05:36 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Riot Games
[2011/08/23 18:26:49 | 000,000,000 | ---D | C] -- C:\Users\Cobaltgirl\Documents\LeagueOfLegends
[2011/08/23 13:45:46 | 000,000,000 | ---D | C] -- C:\Users\Cobaltgirl\AppData\Local\{72B2B647-49C0-4555-9E6E-335D1A0D7501}
[2011/08/23 13:45:35 | 000,000,000 | ---D | C] -- C:\Users\Cobaltgirl\AppData\Local\{94F5AEB2-E062-4AF5-AF5C-C28906D27A60}
[2011/08/23 13:27:54 | 000,000,000 | ---D | C] -- C:\Users\Cobaltgirl\AppData\Local\{9C1C50A5-07AD-4D26-AA85-B06F0AFBDA41}
[2011/08/23 13:26:02 | 000,000,000 | ---D | C] -- C:\Users\Cobaltgirl\AppData\Local\{19786FA2-D822-44CB-B9BF-FF51AF673765}
[2011/08/23 13:24:07 | 000,000,000 | ---D | C] -- C:\Users\Cobaltgirl\AppData\Local\{A2465770-AEA2-4AEF-825B-16B0E009F3D3}
[2011/08/23 12:40:36 | 000,000,000 | ---D | C] -- C:\Users\Cobaltgirl\AppData\Local\{68F04704-ECF0-4ABC-B6C1-EED9D0A6BC9D}
[2011/08/23 12:40:16 | 000,000,000 | ---D | C] -- C:\Users\Cobaltgirl\AppData\Local\{07587A7C-E0AC-4627-B8A4-8243BBA0E3A4}
[2011/08/01 13:08:39 | 000,000,000 | ---D | C] -- C:\Users\Cobaltgirl\AppData\Local\{1A8C1AD1-3069-4773-AE8B-C0EB0BAA479A}
[2 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
[1 C:\Windows\System32\*.tmp files -> C:\Windows\System32\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2011/08/28 16:01:46 | 000,004,864 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2011/08/28 16:01:46 | 000,004,864 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2011/08/28 15:58:00 | 000,000,928 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-4070133263-2202993839-2431433440-1000UA.job
[2011/08/28 15:58:00 | 000,000,894 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2011/08/28 15:44:51 | 000,000,428 | -H-- | M] () -- C:\Windows\tasks\User_Feed_Synchronization-{5189F636-EF84-46D1-95C3-D8746B17B93F}.job
[2011/08/28 14:58:00 | 000,000,890 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2011/08/28 12:33:07 | 000,000,027 | ---- | M] () -- C:\Windows\System32\drivers\etc\hosts
[2011/08/28 12:17:19 | 004,187,178 | R--- | M] (Swearware) -- C:\Users\Cobaltgirl\Desktop\ComboFix.exe
[2011/08/28 12:17:03 | 001,008,092 | ---- | M] () -- C:\Users\Cobaltgirl\Desktop\rkill.exe
[2011/08/28 06:58:00 | 000,000,876 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-4070133263-2202993839-2431433440-1000Core.job
[2011/08/27 12:08:21 | 000,612,592 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2011/08/27 12:08:21 | 000,107,654 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2011/08/27 12:01:38 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2011/08/27 12:01:32 | 319,671,948 | ---- | M] () -- C:\Windows\MEMORY.DMP
[2011/08/27 11:22:12 | 000,000,868 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
[2011/08/25 01:55:00 | 000,002,031 | ---- | M] () -- C:\Users\Cobaltgirl\Application Data\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk
[2011/08/25 01:54:59 | 000,002,069 | ---- | M] () -- C:\Users\Cobaltgirl\Desktop\Google Chrome.lnk
[2011/08/24 06:06:31 | 000,000,680 | ---- | M] () -- C:\Users\Cobaltgirl\AppData\Local\d3d9caps.dat
[2011/08/23 20:15:47 | 000,001,670 | ---- | M] () -- C:\Users\Public\Desktop\Play League of Legends.lnk
[2011/08/14 15:56:05 | 000,002,337 | ---- | M] () -- C:\Users\Cobaltgirl\Desktop\Skype.lnk
[2 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
[1 C:\Windows\System32\*.tmp files -> C:\Windows\System32\*.tmp -> ]

========== Files Created - No Company Name ==========

[2011/08/28 12:17:01 | 001,008,092 | ---- | C] () -- C:\Users\Cobaltgirl\Desktop\rkill.exe
[2011/08/27 12:01:32 | 319,671,948 | ---- | C] () -- C:\Windows\MEMORY.DMP
[2011/08/27 11:22:12 | 000,000,868 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
[2011/08/24 05:56:56 | 000,000,680 | ---- | C] () -- C:\Users\Cobaltgirl\AppData\Local\d3d9caps.dat
[2011/08/23 20:15:47 | 000,001,670 | ---- | C] () -- C:\Users\Public\Desktop\Play League of Legends.lnk
[2010/11/30 07:38:45 | 000,000,554 | ---- | C] () -- C:\Windows\wininit.ini
[2010/11/02 20:23:49 | 000,000,641 | -HS- | C] () -- C:\ProgramData\610046572
[2010/11/02 20:23:47 | 000,001,185 | ---- | C] () -- C:\ProgramData\74889536
[2010/10/14 18:35:21 | 000,001,940 | ---- | C] () -- C:\Users\Cobaltgirl\AppData\Local\{96C87F53-AC72-4604-A9CC-186A49F17F3C}.ini
[2010/09/29 22:09:24 | 000,000,056 | -H-- | C] () -- C:\Windows\System32\ezsidmv.dat
[2010/08/19 21:22:42 | 000,153,700 | -H-- | C] () -- C:\Windows\System32\mlfcache.dat
[2010/07/09 13:12:40 | 000,001,946 | ---- | C] () -- C:\Windows\System32\msexcr.ini
[2010/03/15 15:59:55 | 000,256,000 | ---- | C] () -- C:\Windows\PEV.exe
[2010/03/15 15:59:55 | 000,208,896 | ---- | C] () -- C:\Windows\MBR.exe
[2010/03/15 15:59:55 | 000,098,816 | ---- | C] () -- C:\Windows\sed.exe
[2010/03/15 15:59:55 | 000,080,412 | ---- | C] () -- C:\Windows\grep.exe
[2010/03/15 15:59:55 | 000,068,096 | ---- | C] () -- C:\Windows\zip.exe
[2010/01/25 12:58:06 | 000,462,848 | ---- | C] () -- C:\Windows\System32\ractrlkeyhook.dll
[2009/08/03 15:07:42 | 000,403,816 | ---- | C] () -- C:\Windows\System32\OGACheckControl.dll
[2009/08/03 15:07:42 | 000,230,768 | ---- | C] () -- C:\Windows\System32\OGAEXEC.exe
[2009/08/02 15:57:43 | 000,107,612 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchema.bin
[2009/08/02 15:57:42 | 000,117,248 | ---- | C] () -- C:\Windows\System32\EhStorAuthn.dll
[2009/05/06 20:39:57 | 000,000,209 | ---- | C] () -- C:\Windows\ODBCINST.INI
[2009/03/17 17:08:35 | 000,002,560 | ---- | C] () -- C:\Windows\System32\drivers\mchInjDrv.sys
[2008/10/18 14:06:06 | 000,000,615 | ---- | C] () -- C:\Windows\System32\RaCoInst.dat
[2008/09/12 03:00:33 | 000,018,904 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchemaTrivial.bin
[2008/04/30 21:33:22 | 000,002,560 | ---- | C] () -- C:\Windows\_MSRSTRT.EXE
[2008/03/24 14:57:05 | 000,000,000 | ---- | C] () -- C:\Users\Cobaltgirl\AppData\Roaming\wklnhst.dat
[2008/01/30 04:01:17 | 000,004,984 | ---- | C] () -- C:\Windows\System32\drivers\nvphy.bin
[2007/09/11 19:23:32 | 000,069,120 | ---- | C] () -- C:\Users\Cobaltgirl\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2007/09/10 22:10:17 | 000,000,010 | ---- | C] () -- C:\Windows\popcinfo.dat
[2007/08/14 14:32:26 | 000,001,834 | ---- | C] () -- C:\Windows\hpdj3740.ini
[2007/05/09 01:51:49 | 000,103,521 | ---- | C] () -- C:\Windows\hpqins13.dat
[2007/05/09 01:34:27 | 000,061,440 | ---- | C] () -- C:\Windows\System32\OsdRemove.exe
[2007/05/09 01:30:45 | 000,327,680 | ---- | C] () -- C:\Windows\System32\pythoncom24.dll
[2007/05/09 01:30:45 | 000,102,400 | ---- | C] () -- C:\Windows\System32\pywintypes24.dll
[2007/03/06 04:47:24 | 000,000,000 | ---- | C] () -- C:\Windows\System32\px.ini
[2007/01/12 10:07:48 | 000,520,192 | ---- | C] () -- C:\Windows\System32\CddbPlaylist2Roxio.dll
[2007/01/12 10:07:48 | 000,204,800 | ---- | C] () -- C:\Windows\System32\CddbFileTaggerRoxio.dll
[2006/11/02 08:57:28 | 000,067,584 | --S- | C] () -- C:\Windows\bootstat.dat
[2006/11/02 08:47:37 | 000,432,376 | ---- | C] () -- C:\Windows\System32\FNTCACHE.DAT
[2006/11/02 08:35:32 | 000,005,632 | ---- | C] () -- C:\Windows\System32\sysprepMCE.dll
[2006/11/02 06:33:01 | 000,612,592 | ---- | C] () -- C:\Windows\System32\perfh009.dat
[2006/11/02 06:33:01 | 000,287,440 | ---- | C] () -- C:\Windows\System32\perfi009.dat
[2006/11/02 06:33:01 | 000,107,654 | ---- | C] () -- C:\Windows\System32\perfc009.dat
[2006/11/02 06:33:01 | 000,030,674 | ---- | C] () -- C:\Windows\System32\perfd009.dat
[2006/11/02 06:23:21 | 000,215,943 | ---- | C] () -- C:\Windows\System32\dssec.dat
[2006/11/02 04:58:30 | 000,043,131 | ---- | C] () -- C:\Windows\mib.bin
[2006/11/02 04:19:00 | 000,000,741 | ---- | C] () -- C:\Windows\System32\NOISE.DAT
[2006/11/02 03:40:29 | 000,013,750 | ---- | C] () -- C:\Windows\System32\pacerprf.ini
[2006/11/02 03:25:31 | 000,673,088 | ---- | C] () -- C:\Windows\System32\mlang.dat

========== LOP Check ==========

[2010/08/26 21:46:19 | 000,000,000 | ---D | M] -- C:\Users\Cobaltgirl\AppData\Roaming\ImTOO
[2010/07/13 22:28:55 | 000,000,000 | ---D | M] -- C:\Users\Cobaltgirl\AppData\Roaming\LolClient
[2009/04/10 18:10:32 | 000,000,000 | ---D | M] -- C:\Users\Cobaltgirl\AppData\Roaming\MusicNet
[2009/06/27 22:53:43 | 000,000,000 | ---D | M] -- C:\Users\Cobaltgirl\AppData\Roaming\Nexon
[2008/03/24 14:57:07 | 000,000,000 | ---D | M] -- C:\Users\Cobaltgirl\AppData\Roaming\Template
[2010/08/19 12:08:04 | 000,000,000 | ---D | M] -- C:\Users\Cobaltgirl\AppData\Roaming\Tific
[2007/08/03 21:59:28 | 000,000,000 | ---D | M] -- C:\Users\Cobaltgirl\AppData\Roaming\WinBatch
[2011/03/29 20:57:27 | 000,000,000 | ---D | M] -- C:\Users\Cobaltgirl\AppData\Roaming\Windows Live Writer
[2011/08/27 11:34:15 | 000,032,550 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT
[2011/08/28 15:44:51 | 000,000,428 | -H-- | M] () -- C:\Windows\Tasks\User_Feed_Synchronization-{5189F636-EF84-46D1-95C3-D8746B17B93F}.job

========== Purity Check ==========



========== Custom Scans ==========


< %SYSTEMDRIVE%\*.* >
[2007/05/09 02:02:39 | 000,000,074 | ---- | M] () -- C:\autoexec.bat
[2009/04/11 02:36:36 | 000,333,257 | RHS- | M] () -- C:\bootmgr
[2007/05/09 02:17:34 | 000,008,192 | R-S- | M] () -- C:\BOOTSECT.BAK
[2011/08/28 12:36:48 | 000,012,493 | ---- | M] () -- C:\ComboFix.txt
[2006/09/18 17:43:37 | 000,000,010 | ---- | M] () -- C:\config.sys
[2009/09/26 15:10:55 | 000,171,136 | RHS- | M] () -- C:\grldr
[2010/12/16 18:59:31 | 000,000,000 | RHS- | M] () -- C:\IO.SYS
[2010/12/16 18:59:31 | 000,000,000 | RHS- | M] () -- C:\MSDOS.SYS
[2011/08/27 12:01:32 | 2325,553,152 | -HS- | M] () -- C:\pagefile.sys
[2008/05/12 19:11:22 | 000,000,477 | ---- | M] () -- C:\RHDSetup.log
[2011/08/28 12:38:09 | 000,000,452 | ---- | M] () -- C:\rkill.log
[2008/04/30 21:09:50 | 000,000,156 | ---- | M] () -- C:\YServer.txt

< %systemroot%\Fonts\*.com >
[2006/11/02 08:37:12 | 000,026,040 | ---- | M] () -- C:\Windows\Fonts\GlobalMonospace.CompositeFont
[2006/11/02 08:37:12 | 000,026,489 | ---- | M] () -- C:\Windows\Fonts\GlobalSansSerif.CompositeFont
[2006/11/02 08:37:12 | 000,029,779 | ---- | M] () -- C:\Windows\Fonts\GlobalSerif.CompositeFont
[2009/09/11 15:30:50 | 000,037,665 | ---- | M] () -- C:\Windows\Fonts\GlobalUserInterface.CompositeFont

< %systemroot%\Fonts\*.dll >

< %systemroot%\Fonts\*.ini >
[2006/09/18 17:37:34 | 000,000,065 | ---- | M] () -- C:\Windows\Fonts\desktop.ini

< %systemroot%\Fonts\*.ini2 >

< %systemroot%\Fonts\*.exe >

< %systemroot%\system32\spool\prtprocs\w32x86\*.* >
[2008/01/19 03:34:28 | 000,089,600 | ---- | M] (Hewlett-Packard Corporation) -- C:\Windows\system32\spool\prtprocs\w32x86\HPZPPLHN.DLL
[2006/11/02 08:35:48 | 000,022,528 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\spool\prtprocs\w32x86\jnwppr.dll
[2010/12/08 14:11:54 | 000,053,632 | ---- | M] (LogMeIn, Inc.) -- C:\Windows\system32\spool\prtprocs\w32x86\LMIproc.dll
[2006/10/26 22:56:12 | 000,033,104 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\spool\prtprocs\w32x86\msonpppr.dll

< %systemroot%\REPAIR\*.bak1 >

< %systemroot%\REPAIR\*.ini >

< %systemroot%\system32\*.jpg >

< %systemroot%\*.jpg >

< %systemroot%\*.png >

< %systemroot%\*.scr >
[2010/11/10 02:28:46 | 000,301,936 | ---- | M] (Microsoft Corporation) -- C:\Windows\WLXPGSS.SCR
[2 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]

< %systemroot%\*._sy >

< %APPDATA%\Adobe\Update\*.* >

< %ALLUSERSPROFILE%\Favorites\*.* >

< %APPDATA%\Microsoft\*.* >

< %PROGRAMFILES%\*.* >
[2008/05/30 19:18:34 | 000,000,174 | -HS- | M] () -- C:\Program Files\desktop.ini

< %APPDATA%\Update\*.* >

< %systemroot%\*. /mp /s >

< %systemroot%\System32\config\*.sav >
[2006/11/02 06:34:05 | 000,008,192 | ---- | M] () -- C:\Windows\System32\config\COMPONENTS.SAV
[2006/11/02 06:34:05 | 000,020,480 | ---- | M] () -- C:\Windows\System32\config\DEFAULT.SAV
[2006/11/02 06:34:05 | 000,008,192 | ---- | M] () -- C:\Windows\System32\config\SECURITY.SAV
[2006/11/02 06:34:08 | 010,133,504 | ---- | M] () -- C:\Windows\System32\config\SOFTWARE.SAV
[2006/11/02 06:34:08 | 001,826,816 | ---- | M] () -- C:\Windows\System32\config\SYSTEM.SAV

< %PROGRAMFILES%\bak. /s >

< %systemroot%\system32\bak. /s >

< %ALLUSERSPROFILE%\Start Menu\*.lnk /x >

< %systemroot%\system32\config\systemprofile\*.dat /x >

< %systemroot%\*.config >

< %systemroot%\system32\*.db >

< %APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x >
[2010/01/27 16:24:53 | 000,000,470 | -HS- | M] () -- C:\Users\Cobaltgirl\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini

< %USERPROFILE%\Desktop\*.exe >
[2011/08/28 12:17:19 | 004,187,178 | R--- | M] (Swearware) -- C:\Users\Cobaltgirl\Desktop\ComboFix.exe
[2011/08/28 12:17:03 | 001,008,092 | ---- | M] () -- C:\Users\Cobaltgirl\Desktop\rkill.exe

< %PROGRAMFILES%\Common Files\*.* >

< %systemroot%\*.src >

< %systemroot%\install\*.* >

< %systemroot%\system32\DLL\*.* >

< %systemroot%\system32\HelpFiles\*.* >

< %systemroot%\system32\rundll\*.* >

< %systemroot%\winn32\*.* >

< %systemroot%\Java\*.* >

< %systemroot%\system32\test\*.* >

< %systemroot%\system32\Rundll32\*.* >

< %systemroot%\AppPatch\Custom\*.* >

< %APPDATA%\Roaming\Microsoft\Windows\Recent\*.lnk /x >

< %PROGRAMFILES%\PC-Doctor\Downloads\*.* >

< %PROGRAMFILES%\Internet Explorer\*.tmp >

< %PROGRAMFILES%\Internet Explorer\*.dat >

< %USERPROFILE%\My Documents\*.exe >

< %USERPROFILE%\*.exe >

< %systemroot%\ADDINS\*.* >

< %systemroot%\assembly\*.bak2 >

< %systemroot%\Config\*.* >

< %systemroot%\REPAIR\*.bak2 >

< %systemroot%\SECURITY\Database\*.sdb /x >

< %systemroot%\SYSTEM\*.bak2 >

< %systemroot%\Web\*.bak2 >

< %systemroot%\Driver Cache\*.* >

< %PROGRAMFILES%\Mozilla Firefox\0*.exe >

< %ProgramFiles%\Microsoft Common\*.* >

< %ProgramFiles%\TinyProxy. >

< %USERPROFILE%\Favorites\*.url /x >
[2007/08/30 16:41:40 | 000,000,402 | -HS- | M] () -- C:\Users\Cobaltgirl\Favorites\desktop.ini

< %systemroot%\system32\*.bk >

< %systemroot%\*.te >

< %systemroot%\system32\system32\*.* >

< %ALLUSERSPROFILE%\*.dat /x >
[2010/11/15 21:34:13 | 000,000,641 | -HS- | M] () -- C:\ProgramData\610046572
[2010/11/15 21:41:53 | 000,001,185 | ---- | M] () -- C:\ProgramData\74889536
[2008/06/12 13:43:25 | 000,002,681 | ---- | M] () -- C:\ProgramData\hpzinstall.log

< %systemroot%\system32\drivers\*.rmv >

< dir /b "%systemroot%\system32\*.exe" | find /i " " /c >

< dir /b "%systemroot%\*.exe" | find /i " " /c >

< %PROGRAMFILES%\Microsoft\*.* >

< %systemroot%\System32\Wbem\proquota.exe >

< %PROGRAMFILES%\Mozilla Firefox\*.dat >

< %USERPROFILE%\Cookies\*.txt /x >

< %SystemRoot%\system32\fonts\*.* >

< %systemroot%\system32\winlog\*.* >

< %systemroot%\system32\Language\*.* >

< %systemroot%\system32\Settings\*.* >

< %systemroot%\system32\*.quo >

< %SYSTEMROOT%\AppPatch\*.exe >

< %SYSTEMROOT%\inf\*.exe >

< %SYSTEMROOT%\Installer\*.exe >

< %systemroot%\system32\config\*.bak2 >

< %systemroot%\system32\Computers\*.* >

< %SystemRoot%\system32\Sound\*.* >

< %SystemRoot%\system32\SpecialImg\*.* >

< %SystemRoot%\system32\code\*.* >

< %SystemRoot%\system32\draft\*.* >

< %SystemRoot%\system32\MSSSys\*.* >

< %ProgramFiles%\Javascript\*.* >

< %systemroot%\pchealth\helpctr\System\*.exe /s >

< %systemroot%\Web\*.exe >

< %systemroot%\system32\msn\*.* >

< %systemroot%\system32\*.tro >

< %AppData%\Microsoft\Installer\msupdates\*.* >

< %ProgramFiles%\Messenger\*.* >

< %systemroot%\system32\systhem32\*.* >

< %systemroot%\system\*.exe >

< HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >

< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\ Auto Update\Results\Install|LastSuccessTime /rs >


========== Alternate Data Streams ==========

@Alternate Data Stream - 104 bytes -> C:\ProgramData\TEMPFC5A2B2

< End of report >

 

OTL Extras logfile created on: 8/28/2011 4:28:42 PM - Run 1
OTL by OldTimer - Version 3.2.26.6 Folder = C:\Users\Cobaltgirl\Downloads
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.19120)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

1.87 Gb Total Physical Memory | 0.46 Gb Available Physical Memory | 24.49% Memory free
3.98 Gb Paging File | 2.43 Gb Available in Paging File | 61.05% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 289.30 Gb Total Space | 104.63 Gb Free Space | 36.17% Space Free | Partition Type: NTFS
Drive D: | 8.79 Gb Total Space | 1.00 Gb Free Space | 11.42% Space Free | Partition Type: NTFS
Drive E: | 579.41 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS

Computer Name: COBALTGIRL-PC | User Name: Cobaltgirl | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========


========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- rundll32.exe shell32.dll,Control_RunDLL "%1 ",%*
.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)

[HKEY_USERS\S-1-5-21-4070133263-2202993839-2431433440-1000\SOFTWARE\Classes\<extension>]
.bat [@ = batfile] -- Reg Error: Key error. File not found
.cmd [@ = cmdfile] -- Reg Error: Key error. File not found
.com [@ = ComFile] -- Reg Error: Key error. File not found
.pif [@ = piffile] -- Reg Error: Key error. File not found
.vbs [@ = VBSFile] -- Reg Error: Key error. File not found

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- rundll32.exe shell32.dll,Control_RunDLL "%1 ",%*
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1 "
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
"AntiVirusDisableNotify" = 0
"AntiVirusOverride" = 0
"FirewallDisableNotify" = 0
"FirewallOverride" = 0
"FirstRunDisabled" = 1
"UpdatesDisableNotify" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
"DisableMonitoring" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]
"DisableMonitoring" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]
"DisableMonitoring" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
"VistaSp1" = Reg Error: Unknown registry data type -- File not found
"VistaSp2" = Reg Error: Unknown registry data type -- File not found

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]

========== System Restore Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Program Files\EarthLink TotalAccess\TaskPanl.exe" = C:\Program Files\EarthLink TotalAccess\TaskPanl.exe:*:Enabled:Earthlink -- (EarthLink, Inc.)


========== Vista Active Open Ports Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{167E81BE-DD93-44C3-AA44-CBDF4F92B90C}" = lport=8378 | protocol=6 | dir=in | name=league of legends launcher |
"{1C66AFF9-4993-4631-9027-46C90E464402}" = lport=57428 | protocol=6 | dir=in | name=akamai netsession interface |
"{48BAF336-3ECA-4A53-BC3C-176700C0A833}" = lport=52553 | protocol=6 | dir=in | name=akamai netsession interface |
"{61E43FB3-6824-442B-ABFA-38C71045F984}" = lport=8380 | protocol=17 | dir=in | name=league of legends launcher |
"{799BF4B9-A33B-4F97-AC66-3D9989BA9B23}" = lport=8380 | protocol=6 | dir=in | name=league of legends launcher |
"{85CDAF8E-BF92-4646-BB57-89935596434E}" = lport=5000 | protocol=17 | dir=in | name=akamai netsession interface |
"{87E6526D-4B5D-4FCE-8BAF-CF2ABFDFABD9}" = lport=8379 | protocol=6 | dir=in | name=league of legends launcher |
"{91E43896-6AE9-4A2B-80DE-CAA9CDD7194E}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=svchost.exe |
"{98F9D797-4D7B-4FC8-9152-F11B5AD9EEB6}" = lport=49160 | protocol=6 | dir=in | name=akamai netsession interface |
"{9A42DAEC-81E6-450B-B01B-0F3065CCAEBE}" = lport=1900 | protocol=17 | dir=in | name=windows live communications platform (ssdp) |
"{A36E9F19-D992-49F1-B810-95D4BFBCE91F}" = lport=8379 | protocol=17 | dir=in | name=league of legends launcher |
"{B2A21493-3FF1-4E6D-B87D-EBEDD50C86E3}" = lport=2869 | protocol=6 | dir=in | app=system |
"{BD5E7AB7-8065-4BE3-91A6-533D0084566F}" = lport=8378 | protocol=17 | dir=in | name=league of legends launcher |
"{C6CBE649-031B-47BC-84B6-67B419FA6A7F}" = lport=5000 | protocol=17 | dir=in | name=akamai netsession interface |
"{F13FF93C-F5F1-4B97-BDFF-BC220B4F99FF}" = lport=2869 | protocol=6 | dir=in | name=windows live communications platform (upnp) |

========== Vista Active Application Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{055AF423-FBB3-4815-84E5-639E9DEC2252}" = dir=in | app=c:\program files\windows live\mesh\moe.exe |
"{179ECDB5-D7CE-44AC-8311-02C91590ED8F}" = protocol=17 | dir=in | app=c:\program files\windows media player\wmplayer.exe |
"{1A2E405D-7C0B-46EA-A2E9-94DF816CF972}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{30FF7439-A850-4AE9-B3A0-80A05E3C596F}" = protocol=6 | dir=in | app=c:\program files\microsoft office\office12\onenote.exe |
"{33C86C4B-6DCC-40B3-A6F6-A8AF83F1EE17}" = protocol=17 | dir=in | app=c:\program files\earthlink totalaccess\taskpanl.exe |
"{3F50A161-C382-4875-9C53-C82087975618}" = protocol=6 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{4031305D-AA16-45E4-8484-832B37E71427}" = protocol=6 | dir=in | app=c:\program files\earthlink totalaccess\taskpanl.exe |
"{40CB42EF-39D7-42F9-A332-6689713CA028}" = protocol=17 | dir=in | app=c:\program files\pando networks\media booster\pmb.exe |
"{43A4850E-D0A3-417F-AFA7-0EB3D051CD11}" = protocol=6 | dir=out | app=c:\program files\windows media player\wmplayer.exe |
"{49562A65-2A0B-4F08-8268-66FBD070E490}" = protocol=17 | dir=in | app=c:\program files\windows media player\wmplayer.exe |
"{52BE38D1-171F-4D15-924C-14AEA90F2107}" = dir=in | app=c:\program files\skype\plugin manager\skypepm.exe |
"{675AF63E-1B9E-408B-893E-31E1B3CA928B}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{6D3254DC-5705-4A77-8B94-6DEE95B84EDD}" = protocol=6 | dir=in | app=c:\program files\itunes\itunes.exe |
"{6D84A92A-B0DD-4237-B492-F280D8B28831}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{7283A006-BD13-4919-B582-254D60AE33D9}" = protocol=17 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{7ACCE093-080A-4EFB-8BAB-3CA780D4FE7D}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{8041A475-FF73-478C-B894-99B095ABC698}" = protocol=17 | dir=out | app=c:\program files\windows media player\wmplayer.exe |
"{86DD5ADF-DA08-4B15-9BFF-C19E5EC2BDF3}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{8C4C922D-A56B-49E9-A331-B85FC0524B1D}" = protocol=6 | dir=in | app=c:\program files\pando networks\media booster\pmb.exe |
"{8F5627EC-A195-4CF5-BD56-8A38AA07EA6F}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{91E9840D-60B4-4566-BD35-7F62A1A59239}" = dir=in | app=c:\program files\windows live\sync\windowslivesync.exe |
"{974BF2DE-2369-4A67-8B04-ACEFFA3CDE16}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{9A2C1AEB-21E0-4EE9-8D73-0B01501982CB}" = protocol=17 | dir=in | app=c:\program files\pando networks\media booster\pmb.exe |
"{B0F635BF-F8E0-4AEF-B208-5DD7966CC68D}" = protocol=17 | dir=in | app=c:\program files\earthlink totalaccess\taskpanl.exe |
"{B3E5580D-C609-4585-8F92-09DD9272D8A2}" = protocol=17 | dir=out | app=c:\program files\windows media player\wmplayer.exe |
"{B4BBC36B-515C-42E4-8B6D-F491D324BAE9}" = protocol=6 | dir=in | app=c:\program files\earthlink totalaccess\taskpanl.exe |
"{BC6A330B-F5D0-4FD0-9C62-BC4E812AE03A}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{C5F9F26B-B060-4A8A-8F5C-A8A56025A8B4}" = protocol=17 | dir=in | app=c:\program files\microsoft office\office12\onenote.exe |
"{C9C814BE-B7C0-4751-8DFE-E58D5B9815FC}" = protocol=6 | dir=in | app=c:\program files\starcraft ii\starcraft ii.exe |
"{CDD27895-B875-40BE-92D6-CD6E9B2900D5}" = dir=in | app=c:\program files\pando networks\media booster\pmb.exe |
"{D3656C8A-5107-4639-8C48-B3F7B2A58470}" = dir=in | app=c:\program files\windows live\messenger\msnmsgr.exe |
"{D4B47F4B-DE6B-4E9A-A774-EE7C06328B48}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{DD085032-E49C-4CD8-AC32-2C6EBD56166B}" = dir=in | app=c:\program files\windows live\contacts\wlcomm.exe |
"{DFEF26EF-8AC0-47F4-B282-2D6617BB0B30}" = protocol=6 | dir=in | app=c:\program files\pando networks\media booster\pmb.exe |
"{E0F430A5-7BD5-4543-9C5C-24CA891FF24B}" = protocol=6 | dir=out | app=c:\program files\windows media player\wmplayer.exe |
"{E3D7443F-545D-4FC0-B31D-F9793B127264}" = protocol=17 | dir=in | app=c:\program files\itunes\itunes.exe |
"{EA721212-BD82-444C-8E3F-342A6C59F557}" = protocol=17 | dir=in | app=c:\program files\starcraft ii\starcraft ii.exe |
"{EAD93E40-AEBF-4D13-B44B-B40DBF987728}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{FC4B7F94-DDD1-485E-9F84-215E73F76830}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"TCP Query User{2E534A35-4B36-4AFD-B846-6D54FC6D495D}C:\program files\logmein ignition\lmiignition.exe" = protocol=6 | dir=in | app=c:\program files\logmein ignition\lmiignition.exe |
"TCP Query User{3E872BC1-E563-4370-9357-61A0578E512B}C:\users\cobaltgirl\appdata\local\google\chrome\application\chrome.exe" = protocol=6 | dir=in | app=c:\users\cobaltgirl\appdata\local\google\chrome\application\chrome.exe |
"TCP Query User{6103198B-53DB-4C74-80D7-5E8E065396D7}C:\program files\internet explorer\iexplore.exe" = protocol=6 | dir=in | app=c:\program files\internet explorer\iexplore.exe |
"TCP Query User{781689B8-1E52-4C5C-A8F6-90B755F91F07}C:\program files\warcraft iii\war3.exe" = protocol=6 | dir=in | app=c:\program files\warcraft iii\war3.exe |
"TCP Query User{BCF54D43-59FD-405F-8E32-EDEB928AF841}C:\program files\google\google earth\plugin\geplugin.exe" = protocol=6 | dir=in | app=c:\program files\google\google earth\plugin\geplugin.exe |
"TCP Query User{BD3AD2C6-72A1-44BD-A4F1-D4528751F793}C:\program files\logmein ignition\lmiignition.exe" = protocol=6 | dir=in | app=c:\program files\logmein ignition\lmiignition.exe |
"TCP Query User{DD25C6BD-C18F-4486-A2A5-558FD3742FBA}C:\program files\videolan\vlc\vlc.exe" = protocol=6 | dir=in | app=c:\program files\videolan\vlc\vlc.exe |
"UDP Query User{0A32D786-E983-418C-9751-86AAF25F65DE}C:\users\cobaltgirl\appdata\local\google\chrome\application\chrome.exe" = protocol=17 | dir=in | app=c:\users\cobaltgirl\appdata\local\google\chrome\application\chrome.exe |
"UDP Query User{50A0E2F3-FB6C-4A7C-82C6-87EB1D79ABE1}C:\program files\videolan\vlc\vlc.exe" = protocol=17 | dir=in | app=c:\program files\videolan\vlc\vlc.exe |
"UDP Query User{61EBFB43-C7B0-42E8-B741-F7EEA4CCAEB5}C:\program files\internet explorer\iexplore.exe" = protocol=17 | dir=in | app=c:\program files\internet explorer\iexplore.exe |
"UDP Query User{AD9C65A3-0EF5-42D2-89FB-2BEE747B86D7}C:\program files\google\google earth\plugin\geplugin.exe" = protocol=17 | dir=in | app=c:\program files\google\google earth\plugin\geplugin.exe |
"UDP Query User{CE7EE6C0-2AB0-4A93-8D1C-2F914BE2AAB0}C:\program files\logmein ignition\lmiignition.exe" = protocol=17 | dir=in | app=c:\program files\logmein ignition\lmiignition.exe |
"UDP Query User{D6662B99-595D-42E6-8F4D-2711F9B2A8F1}C:\program files\warcraft iii\war3.exe" = protocol=17 | dir=in | app=c:\program files\warcraft iii\war3.exe |
"UDP Query User{D97E66C3-69E8-460F-98C7-63BD9B73CAAF}C:\program files\logmein ignition\lmiignition.exe" = protocol=17 | dir=in | app=c:\program files\logmein ignition\lmiignition.exe |

========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
"{0394CDC8-FABD-4ed8-B104-03393876DFDF}" = Roxio Creator Tools
"{0B0F231F-CE6A-483D-AA23-77B364F75917}" = Windows Live Installer
"{0D397393-9B50-4c52-84D5-77E344289F87}" = Roxio Creator Data
"{0E4BC542-9CFD-4E97-B586-9F1E5516E7B9}" = Microsoft IntelliPoint 6.1
"{11F93B4B-48F0-4A4E-AE77-DFA96A99664B}" = Roxio Creator EasyArchive
"{17504ED4-DB08-40A8-81C2-27D8C01581DA}" = Windows Live Remote Service Resources
"{19A4A990-5343-4FF7-B3B5-6F046C091EDF}" = Windows Live Remote Client
"{19BA08F7-C728-469C-8A35-BFBD3633BE08}" = Windows Live Movie Maker
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{1F6AB0E7-8CDD-4B93-8A23-AA9EB2FEFCE4}" = Junk Mail filter update
"{200FEC62-3C34-4D60-9CE8-EC372E01C08F}" = Windows Live SOXE Definitions
"{227E8782-B2F4-4E97-B0EE-49DE9CC1C0C0}" = Windows Live Remote Service
"{26A24AE4-039D-4CA4-87B4-2F83216010FF}" = Java(TM) 6 Update 20
"{2902F983-B4C1-44BA-B85D-5C6D52E2C441}" = Windows Live Mesh ActiveX Control for Remote Connections
"{294BF709-D758-4363-8D75-01479AD20927}" = Windows Live Family Safety
"{2990BC81-3B19-4E53-A53E-30DE3F1BFFA8}" = HP Total Care Advisor
"{2A981294-F14C-4F0F-9627-D793270922F8}" = Bonjour
"{3248F0A8-6813-11D6-A77B-00B0D0160020}" = Java(TM) 6 Update 2
"{3248F0A8-6813-11D6-A77B-00B0D0160030}" = Java(TM) 6 Update 3
"{3336F667-9049-4D46-98B6-4C743EEBC5B1}" = Windows Live Photo Gallery
"{34F4D9A4-42C2-4348-BEF4-E553C84549E7}" = Windows Live Photo Gallery
"{35E1EC43-D4FC-4E4A-AAB3-20DDA27E8BB0}" = Roxio Activation Module
"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
"{40F7AED3-0C7D-4582-99F6-484A515C73F2}" = HP Easy Setup - Frontend
"{464B3406-A4D0-4914-910F-7CA4380DCC13}" = Windows Live Remote Client Resources
"{48B82226-75E3-4E90-92CC-D30F79EA6380}" = Norton Security Scan
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4CBABDFD-49F8-47FD-BE7D-ECDE7270525A}" = Windows Live PIMT Platform
"{50816F92-1652-4A7C-B9BC-48F682742C4B}" = Messenger Companion
"{55979C41-7D6A-49CC-B591-64AC1BBE2C8B}" = HP Picasso Media Center Add-In
"{57752979-A1C9-4C02-856B-FBB27AC4E02C}" = QuickTime
"{5BF5F9C5-E95B-4AFA-94BE-F2A9CA73B61D}" = Apple Mobile Device Support
"{5DD4FCBD-A3C1-4155-9E17-4161C70AAABA}" = Segoe UI
"{5EE7D259-D137-4438-9A5F-42F432EC0421}" = VC80CRTRedist - 8.0.50727.4053
"{619CDD8A-14B6-43a1-AB6C-0F4EE48CE048}" = Roxio Creator Copy
"{61AD15B2-50DB-4686-A739-14FE180D4429}" = Windows Live ID Sign-in Assistant
"{65DA2EC9-0642-47E9-AAE2-B5267AA14D75}" = Activation Assistant for the 2007 Microsoft Office suites
"{6675CA7F-E51B-4F6A-99D4-F8F0124C6EAA}" = Roxio Express Labeler 3
"{682B3E4F-696A-42DE-A41C-4C07EA1678B4}" = Windows Live SOXE
"{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}" = Windows Media Player Firefox Plugin
"{6A05FEDF-662E-46BF-8A25-010E3F1C9C69}" = Windows Live UX Platform Language Pack
"{6D52C408-B09A-4520-9B18-475B81D393F1}" = Microsoft Works
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{716E0306-8318-4364-8B8F-0CC4E9376BAC}" = MSXML 4.0 SP2 Parser and SDK
"{75E71ADD-042C-4F30-BFAC-A9EC42351313}" = Python 2.4.3
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{78A96B4C-A643-4D0F-98C2-A8E16A6669F9}" = Windows Live Messenger Companion Core
"{80956555-A512-4190-9CAD-B000C36D6B6B}" = Windows Live Messenger
"{83FFCFC7-88C6-41c6-8752-958A45325C82}" = Roxio Creator Audio
"{84EBDF39-4B33-49D7-A0BD-EB6E2C4E81C1}" = Windows Live Sync
"{86CE85E6-DBAC-3FFD-B977-E4B79F83C909}" = Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8C6D6116-B724-4810-8F2D-D047E6B7D68E}" = Mesh Runtime
"{8DD46C6A-0056-4FEC-B70A-28BB16A1F11F}" = MSVCRT
"{90120000-0016-0409-0000-0000000FF1CE}" = Microsoft Office Excel MUI (English) 2007
"{90120000-0018-0409-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (English) 2007
"{90120000-001B-0409-0000-0000000FF1CE}" = Microsoft Office Word MUI (English) 2007
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-0C0A-0000-0000000FF1CE}" = Microsoft Office Proof (Spanish) 2007
"{90120000-002C-0409-0000-0000000FF1CE}" = Microsoft Office Proofing (English) 2007
"{90120000-006E-0409-0000-0000000FF1CE}" = Microsoft Office Shared MUI (English) 2007
"{90120000-00A1-0409-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (English) 2007
"{90120000-0115-0409-0000-0000000FF1CE}" = Microsoft Office Shared Setup Metadata MUI (English) 2007
"{90140000-2005-0000-0000-0000000FF1CE}" = Microsoft Office File Validation Add-In
"{91120000-002F-0000-0000-0000000FF1CE}" = Microsoft Office Home and Student 2007
"{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{0B36C6D6-F5D8-4EAF-BF94-4376A230AD5B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{3D019598-7B59-447A-80AE-815B703B84FF}" = Security Update for Microsoft Office system 2007 (972581)
"{92606477-9366-4D3B-8AE3-6BE4B29727AB}" = League of Legends
"{92EA4134-10D1-418A-91E1-5A0453131A38}" = Windows Live Movie Maker
"{938B1CD7-7C60-491E-AA90-1F1888168240}" = Roxio MyDVD Basic v9
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{980A182F-E0A2-4A40-94C1-AE0C1235902E}" = Pando Media Booster
"{981029E0-7FC9-4CF3-AB39-6F133621921A}" = Skype Toolbars
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{9D56775A-93F3-44A3-8092-840E3826DE30}" = Windows Live Mail
"{9DBA770F-BF73-4D39-B1DF-6035D95268FC}" = HP Customer Feedback
"{A0C91188-C88F-4E86-93E6-CD7C9A266649}" = Windows Live Mesh
"{A726AE06-AAA3-43D1-87E3-70F510314F04}" = Windows Live Writer
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{A9BDCA6B-3653-467B-AC83-94367DA3BFE3}" = Windows Live Photo Common
"{A9F6CFB0-806D-11E0-8EA1-B8AC6F97B88E}" = Google Earth Plug-in
"{AAAFC670-569B-4A2F-82B4-42945E0DE3EF}" = Windows Live Writer
"{AAD47011-8518-4608-9656-951DA35B587B}" = iTunes
"{AAF454FC-82CA-4F29-AB31-6A109485E76E}" = Windows Live Writer
"{AB5E289E-76BF-4251-9F3F-9B763F681AE0}" = HP Customer Experience Enhancements
"{AC76BA86-7AD7-1033-7B44-A82000000003}" = Adobe Reader 8.2.5
"{AC76BA86-7AD7-5464-3428-800000000003}" = Spelling Dictionaries Support For Adobe Reader 8
"{AF844339-2F8A-4593-81B3-9F4C54038C4E}" = Windows Live MIME IFilter
"{B2544A03-10D0-4E5E-BA69-0362FFC20D18}" = OGA Notifier 2.0.0048.0
"{B4092C6D-E886-4CB2-BA68-FE5A88D31DE6}_is1" = Spybot - Search & Destroy
"{B9CA59A0-3B70-48F8-9054-67595DE6E72B}" = League of Legends
"{C41300B9-185D-475E-BFEC-39EF732F19B1}" = Apple Software Update
"{C66824E4-CBB3-4851-BB3F-E8CFD6350923}" = Windows Live Mail
"{C8B0680B-CDAE-4809-9F91-387B6DE00F7C}" = Roxio Creator Basic v9
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{CE386A4E-D0DA-4208-8235-BCE43275C694}" = LightScribe 1.4.142.1
"{CE95A79E-E4FC-4FFF-8A75-29F04B942FF2}" = Windows Live UX Platform
"{D103C4BA-F905-437A-8049-DB24763BBE36}" = Skype™ 4.2
"{D436F577-1695-4D2F-8B44-AC76C99E0002}" = Windows Live Photo Common
"{D45240D3-B6B3-4FF9-B243-54ECE3E10066}" = Windows Live Communications Platform
"{DDC8BDEE-DCAC-404D-8257-3E8D4B782467}" = Windows Live Writer Resources
"{DECDCB7C-58CC-4865-91AF-627F9798FE48}" = Windows Live Mesh
"{E09C4DB7-630C-4F06-A631-8EA7239923AF}" = D3DX10
"{EB4DF488-AAEF-406F-A341-CB2AAA315B90}" = Windows Live Messenger
"{EBB7C1C1-D439-4D9B-9FDC-954C10F266B0}" = Adobe Photoshop Elements 4.0
"{EE6097DD-05F4-4178-9719-D3170BF098E8}" = Apple Application Support
"{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}" = Microsoft SQL Server 2005 Compact Edition [ENU]
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F40BBEC7-C2A4-4A00-9B24-7A055A2C5262}" = Microsoft Office Live Add-in 1.5
"{F53D678E-238F-4A71-9742-08BB6774E9DC}" = Windows Live Family Safety
"{F85A6B22-853C-4FA2-9681-B2D462625E42}" = Mirar
"{FE044230-9CA5-43F7-9B58-5AC5A28A1F33}" = Windows Live Essentials
"Activation Assistant for the 2007 Microsoft Office suites" = Activation Assistant for the 2007 Microsoft Office suites
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Adobe Shockwave Player" = Adobe Shockwave Player
"CCleaner" = CCleaner
"DivX Setup.divx.com" = DivX Setup
"FlashGet(JetCar)" = FlashGet(JetCar)
"HOMESTUDENTR" = Microsoft Office Home and Student 2007
"Macromedia Shockwave Player" = Macromedia Shockwave Player
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware version 1.51.1.1800
"Microsoft .NET Framework 1.1 (1033)" = Microsoft .NET Framework 1.1
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"NAV" = Norton AntiVirus
"NVIDIA Drivers" = NVIDIA Drivers
"OsdMaestro" = HP On-Screen Cap/Num/Scroll Lock Indicator
"ViewpointMediaPlayer" = Viewpoint Media Player
"Warcraft III" = Warcraft III
"WebPost" = Microsoft Web Publishing Wizard 1.52
"WinLiveSuite" = Windows Live Essentials
"WinRAR archiver" = WinRAR archiver

========== HKEY_USERS Uninstall List ==========

[HKEY_USERS\S-1-5-21-4070133263-2202993839-2431433440-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Google Chrome" = Google Chrome

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 8/27/2011 12:12:18 PM | Computer Name = Cobaltgirl-PC | Source = Windows Search Service | ID = 3013
Description =

Error - 8/27/2011 12:14:28 PM | Computer Name = Cobaltgirl-PC | Source = Windows Search Service | ID = 3013
Description =

Error - 8/27/2011 12:16:45 PM | Computer Name = Cobaltgirl-PC | Source = Windows Search Service | ID = 3013
Description =

Error - 8/27/2011 12:45:02 PM | Computer Name = Cobaltgirl-PC | Source = Windows Search Service | ID = 3013
Description =

Error - 8/27/2011 12:45:02 PM | Computer Name = Cobaltgirl-PC | Source = Windows Search Service | ID = 3013
Description =

Error - 8/27/2011 12:45:06 PM | Computer Name = Cobaltgirl-PC | Source = Windows Search Service | ID = 3013
Description =

Error - 8/27/2011 5:40:32 PM | Computer Name = Cobaltgirl-PC | Source = Perflib | ID = 1010
Description =

Error - 8/28/2011 12:17:59 PM | Computer Name = Cobaltgirl-PC | Source = Windows Search Service | ID = 3013
Description =

Error - 8/28/2011 12:18:38 PM | Computer Name = Cobaltgirl-PC | Source = Windows Search Service | ID = 3013
Description =

Error - 8/28/2011 4:29:06 PM | Computer Name = Cobaltgirl-PC | Source = Windows Search Service | ID = 3013
Description =

[ Media Center Events ]
Error - 8/28/2008 7:41:51 AM | Computer Name = Cobaltgirl-PC | Source = MCUpdate | ID = 0
Description = DownloadPackgeTask.SubTasksComplete: failed downloading package SportsSchedule.

Error - 1/1/2009 4:51:23 AM | Computer Name = Cobaltgirl-PC | Source = MCUpdate | ID = 0
Description = DownloadPackgeTask.SubTasksComplete: failed downloading package SportsSchedule.

Error - 1/8/2009 5:00:22 AM | Computer Name = Cobaltgirl-PC | Source = MCUpdate | ID = 0
Description = DownloadPackgeTask.SubTasksComplete: failed downloading package SportsSchedule.

[ OSession Events ]
Error - 5/19/2009 7:51:20 PM | Computer Name = Cobaltgirl-PC | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 1, Application Name: Microsoft Office Excel, Application Version:
12.0.6341.5001, Microsoft Office Version: 12.0.6215.1000. This session lasted 474
seconds with 420 seconds of active time. This session ended with a crash.

Error - 9/20/2010 2:51:31 PM | Computer Name = Cobaltgirl-PC | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 0, Application Name: Microsoft Office Word, Application Version:
12.0.6541.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 14
seconds with 0 seconds of active time. This session ended with a crash.

Error - 9/30/2010 12:01:35 AM | Computer Name = Cobaltgirl-PC | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 0, Application Name: Microsoft Office Word, Application Version:
12.0.6541.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 229
seconds with 0 seconds of active time. This session ended with a crash.

[ System Events ]
Error - 8/27/2011 11:36:34 AM | Computer Name = Cobaltgirl-PC | Source = Service Control Manager | ID = 7000
Description =

Error - 8/27/2011 11:36:34 AM | Computer Name = Cobaltgirl-PC | Source = Service Control Manager | ID = 7000
Description =

Error - 8/27/2011 12:01:39 PM | Computer Name = Cobaltgirl-PC | Source = EventLog | ID = 6008
Description = The previous system shutdown at 11:59:15 AM on 8/27/2011 was unexpected.

Error - 8/27/2011 12:01:52 PM | Computer Name = Cobaltgirl-PC | Source = Service Control Manager | ID = 7000
Description =

Error - 8/27/2011 12:01:52 PM | Computer Name = Cobaltgirl-PC | Source = Service Control Manager | ID = 7000
Description =

Error - 8/27/2011 12:06:44 PM | Computer Name = Cobaltgirl-PC | Source = Service Control Manager | ID = 7022
Description =

Error - 8/28/2011 12:24:42 PM | Computer Name = Cobaltgirl-PC | Source = Service Control Manager | ID = 7034
Description =

Error - 8/28/2011 12:24:44 PM | Computer Name = Cobaltgirl-PC | Source = Service Control Manager | ID = 7030
Description =

Error - 8/28/2011 12:29:19 PM | Computer Name = Cobaltgirl-PC | Source = Service Control Manager | ID = 7030
Description =

Error - 8/28/2011 12:33:10 PM | Computer Name = Cobaltgirl-PC | Source = Service Control Manager | ID = 7030
Description =


< End of report >

 

Results of screen317's Security Check version 0.99.7
Windows Vista Service Pack 2 (UAC is disabled!)
Internet Explorer 8
``````````````````````````````
Antivirus/Firewall Check:
Windows Firewall Enabled!
Norton AntiVirus
WMI entry may not exist for antivirus; attempting automatic update.
```````````````````````````````
Anti-malware/Other Utilities Check:
Malwarebytes' Anti-Malware
CCleaner
Java(TM) 6 Update 27
Java(TM) 6 Update 2
Java(TM) 6 Update 3
Out of date Java installed!
Adobe Flash Player 10.1.53.64
Adobe Reader 8.2.5
Out of date Adobe Reader installed!
````````````````````````````````
Process Check:
objlist.exe by Laurent
Norton ccSvcHst.exe
Spybot Teatimer.exe is disabled!
``````````End of Log````````````

 

C:\ProgramData\Spybot - Search & Destroy\Recovery\CNwAQdN.zip Win32/Bagle.gen.zip worm
C:\Qoobox\Quarantine\C\Program Files\Mozilla Firefox\plugins\npclntax_ZangoSA.dll.vir Win32/Adware.HotBar application
C:\Users\All Users\Spybot - Search & Destroy\Recovery\CNwAQdN.zip Win32/Bagle.gen.zip worm
C:\Users\Cobaltgirl\AppData\Local\Google\Chrome\User Data\Default\Default\fijpiccfiipebfoibkoippggobgnalgm\contentscript.js Win32/TrojanDownloader.Tracur.F trojan