Inactive Game lockup: event viewer errors result

[Inactive] Game lockup: event viewer errors result

I am posting the result logs requested in "http://www.windowsbbs.com/windows-7/102728-game-lockup-event-viewer-errors-result.html ":

===

1-Malwarebytes (MBAM):

NO log was created by program, as NO errors/viruses were found.

===

2-GMER:

NO log was created by program, as no issues were found.
(Got message "GMER hasn't found any system modification. ")

===

3-MBRCheck:

aswMBR version 0.9.9.1665 Copyright(c) 2011 AVAST Software
Run date: 2012-05-27 12:37:06
-----------------------------
12:37:06.107 OS Version: Windows x64 6.1.7601 Service Pack 1
12:37:06.107 Number of processors: 2 586 0x170A
12:37:06.108 ComputerName: MIKE UserName: mike
12:37:07.200 Initialize success
12:37:07.403 AVAST engine defs: 12052700
12:37:12.868 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP3T0L0-3
12:37:12.872 Disk 0 Vendor: WDC_WD10EADX-22TDHB0 77.04D77 Size: 953869MB BusType: 3
12:37:12.889 Disk 0 MBR read successfully
12:37:12.893 Disk 0 MBR scan
12:37:12.899 Disk 0 Windows 7 default MBR code
12:37:12.903 Disk 0 Partition 1 00 27 Hidden NTFS WinRE NTFS 20000 MB offset 2048
12:37:12.920 Disk 0 Partition 2 80 (A) 07 HPFS/NTFS NTFS 100 MB offset 40962048
12:37:12.936 Disk 0 Partition 3 00 07 HPFS/NTFS NTFS 469494 MB offset 41166848
12:37:12.942 Disk 0 Partition - 00 0F Extended LBA 464272 MB offset 1002692608
12:37:12.978 Disk 0 Partition 4 00 07 HPFS/NTFS NTFS 230000 MB offset 1002694656
12:37:12.985 Disk 0 Partition - 00 05 Extended 234271 MB offset 1473734656
12:37:13.008 Disk 0 Partition 5 00 07 HPFS/NTFS NTFS 234270 MB offset 1473736704
12:37:13.041 Disk 0 scanning C:\Windows\system32\drivers
12:37:18.102 Service scanning
12:37:29.523 Modules scanning
12:37:29.533 Disk 0 trace - called modules:
12:37:29.552 ntoskrnl.exe CLASSPNP.SYS disk.sys ACPI.sys ataport.SYS intelide.sys PCIIDEX.SYS hal.dll atapi.sys
12:37:29.561 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0xfffffa80048df060]
12:37:29.569 3 CLASSPNP.SYS[fffff8800165143f] -> nt!IofCallDriver -> [0xfffffa8004474670]
12:37:29.578 5 ACPI.sys[fffff88000f947a1] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP3T0L0-3[0xfffffa800447c060]
12:37:30.166 AVAST engine scan C:\Windows
12:37:32.288 AVAST engine scan C:\Windows\system32
12:38:51.764 AVAST engine scan C:\Windows\system32\drivers
12:38:58.153 AVAST engine scan C:\Users\mike
12:40:01.921 Disk 0 MBR has been saved successfully to "C:\Users\mike\Desktop\MBR.dat "
12:40:01.929 The log file has been saved successfully to "C:\Users\mike\Desktop\aswMBR.txt "


aswMBR version 0.9.9.1665 Copyright(c) 2011 AVAST Software
Run date: 2012-05-27 12:56:21
-----------------------------
12:56:21.955 OS Version: Windows x64 6.1.7601 Service Pack 1
12:56:21.955 Number of processors: 2 586 0x170A
12:56:21.956 ComputerName: MIKE UserName: mike
12:56:24.186 Initialize success
12:56:24.772 AVAST engine defs: 12052700
12:56:30.424 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP3T0L0-3
12:56:30.426 Disk 0 Vendor: WDC_WD10EADX-22TDHB0 77.04D77 Size: 953869MB BusType: 3
12:56:30.453 Disk 0 MBR read successfully
12:56:30.455 Disk 0 MBR scan
12:56:30.457 Disk 0 Windows 7 default MBR code
12:56:30.460 Disk 0 Partition 1 00 27 Hidden NTFS WinRE NTFS 20000 MB offset 2048
12:56:30.472 Disk 0 Partition 2 80 (A) 07 HPFS/NTFS NTFS 100 MB offset 40962048
12:56:30.477 Disk 0 Partition 3 00 07 HPFS/NTFS NTFS 469494 MB offset 41166848
12:56:30.480 Disk 0 Partition - 00 0F Extended LBA 464272 MB offset 1002692608
12:56:30.508 Disk 0 Partition 4 00 07 HPFS/NTFS NTFS 230000 MB offset 1002694656
12:56:30.512 Disk 0 Partition - 00 05 Extended 234271 MB offset 1473734656
12:56:30.583 Disk 0 Partition 5 00 07 HPFS/NTFS NTFS 234270 MB offset 1473736704
12:56:30.634 Disk 0 scanning C:\Windows\system32\drivers
12:56:42.421 Service scanning
12:56:59.754 Modules scanning
12:56:59.760 Disk 0 trace - called modules:
12:56:59.782 ntoskrnl.exe CLASSPNP.SYS disk.sys ACPI.sys ataport.SYS intelide.sys PCIIDEX.SYS hal.dll atapi.sys
12:56:59.787 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0xfffffa80048e23b0]
12:56:59.792 3 CLASSPNP.SYS[fffff8800195d43f] -> nt!IofCallDriver -> [0xfffffa8004483520]
12:56:59.796 5 ACPI.sys[fffff88000f8e7a1] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP3T0L0-3[0xfffffa8004480060]
12:57:02.558 AVAST engine scan C:\Windows
12:57:08.972 AVAST engine scan C:\Windows\system32
13:00:09.802 AVAST engine scan C:\Windows\system32\drivers
13:00:16.879 AVAST engine scan C:\Users\mike
13:07:14.013 AVAST engine scan C:\ProgramData
13:08:54.694 Scan finished successfully
13:13:16.858 Disk 0 MBR has been saved successfully to "C:\Users\mike\Desktop\MBR.dat "
13:13:16.864 The log file has been saved successfully to "C:\Users\mike\Desktop\aswMBR.txt "

===

4-DDS(2 logs):

---

DDS.txt:

.
DDS (Ver_2011-08-26.01) - NTFSAMD64
Internet Explorer: 8.0.7601.17514 BrowserJavaVersion: 1.6.0_31
Run by mike at 13:16:05 on 2012-05-27
Microsoft Windows 7 Home Premium 6.1.7601.1.1252.2.1033.18.4061.1977 [GMT -4:00]
.
AV: avast! Antivirus *Enabled/Updated* {2B2D1395-420B-D5C9-657E-930FE358FC3C}
AV: Lavasoft Ad-Aware *Enabled/Updated* {445B48C3-0FA4-6B16-8F07-6506F305D800}
SP: Lavasoft Ad-Aware *Enabled/Updated* {FF3AA927-299E-6498-B5B7-5E74888292BD}
SP: avast! Antivirus *Enabled/Updated* {904CF271-6431-DA47-5FCE-A87D98DFB681}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
FW: Lavasoft Ad-Aware *Disabled* {7C60C9E6-45CB-6A4E-A458-CC330DD69F7B}
.
============== Running Processes ===============
.
C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\svchost.exe -k RPCSS
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k NetworkService
d:\AVAST Software\Avast\AvastSvc.exe
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Program Files (x86)\Ad-Aware Antivirus\AdAwareService.exe
C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
C:\Windows\SysWOW64\svchost.exe -k Akamai
C:\Program Files (x86)\Acer\Registration\GREGsvc.exe
C:\Program Files\Acer\Acer Updater\UpdaterService.exe
C:\Windows\system32\lxczcoms.exe
C:\Program Files (x86)\Common Files\Motive\McciCMService.exe
C:\Windows\system32\taskhost.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Common Files\Motive\McciCMService.exe
C:\Program Files\Microsoft LifeCam\MSCamS64.exe
C:\Windows\SysWOW64\PnkBstrA.exe
C:\Windows\system32\taskeng.exe
C:\Program Files (x86)\Acer\clear.fi\MVP\clear.fiAgent.exe
C:\Program Files (x86)\Bell\Internet Service Advisor\ServicepointService.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
D:\Spybot - Search & Destroy\SDWinSec.exe
C:\Windows\system32\WUDFHost.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
C:\Program Files (x86)\Lexmark 1200 Series\LXCZbmgr.exe
C:\Windows\System32\igfxtray.exe
C:\Windows\System32\hkcmd.exe
C:\Windows\System32\igfxpers.exe
C:\Program Files\BellCanada\McciTrayApp.exe
C:\Program Files\Common Files\Common Desktop Agent\CDASrv.exe
D:\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files (x86)\Lexmark 1200 Series\lxczbmon.exe
C:\Windows\system32\SearchIndexer.exe
C:\Users\mike\AppData\Local\Akamai\netsession_win.exe
C:\Users\mike\AppData\Local\Akamai\netsession_win.exe
D:\tinySpell\tinyspell.exe
C:\Program Files (x86)\Skype\Phone\Skype.exe
D:\PhraseExpress\phraseexpress.exe
C:\Program Files (x86)\Common Files\Motive\McciContextHookShim.exe
D:\VirtualCloneDrive\VCDDaemon.exe
D:\MagicDisc\MagicDisc.exe
C:\Program Files (x86)\Acer\Hotkey Utility\HotkeyUtility.exe
D:\AVAST Software\Avast\AvastUI.exe
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Program Files (x86)\Bell\Internet Service Advisor\BISA.exe
C:\Program Files (x86)\Ask.com\Updater\Updater.exe
C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
C:\Program Files (x86)\Real\RealPlayer\Update\realsched.exe
C:\ProgramData\Ad-Aware Browsing Protection\adawarebp.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
D:\Malwarebytes' Anti-Malware\mbamgui.exe
C:\PROGRA~2\AD-AWA~1\AdAware.exe
C:\Program Files (x86)\Bell\Internet Service Advisor\BISAComHandler.exe
C:\Program Files (x86)\Ad-Aware Antivirus\SBAMSvc.exe
d:\Malwarebytes' Anti-Malware\mbamservice.exe
C:\Program Files (x86)\Mozilla Firefox\firefox.exe
C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe
C:\Windows\system32\taskeng.exe
C:\Windows\sysWOW64\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe
D:\Agent Ransack\AgentRansack.exe
C:\Windows\system32\taskeng.exe
C:\Users\mike\Downloads\43urshly.exe
C:\Windows\system32\SearchProtocolHost.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Windows\System32\svchost.exe -k WerSvcGroup
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\conhost.exe
C:\Windows\SysWOW64\cscript.exe
.
============== Pseudo HJT Report ===============
.
uStart Page = about:blank
uDefault_Page_URL = hxxp://acer.msn.com
mDefault_Page_URL = hxxp://acer.msn.com
mStart Page = hxxp://acer.msn.com
uInternet Settings,ProxyOverride = <local>
uURLSearchHooks: UrlSearchHook Class: {00000000-6e41-4fd3-8538-502f5495e5fc} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll
uURLSearchHooks: XfireXO Toolbar: {5e5ab302-7f65-44cd-8211-c1d4caaccea3} - C:\Program Files (x86)\XfireXO\prxtbXfir.dll
mURLSearchHooks: XfireXO Toolbar: {5e5ab302-7f65-44cd-8211-c1d4caaccea3} - C:\Program Files (x86)\XfireXO\prxtbXfir.dll
mWinlogon: Userinit=userinit.exe,
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
BHO: McAfee Phishing Filter: {27b4851a-3207-45a2-b947-be8afe6163ab} - c:\progra~1\mcafee\msk\mskapbho.dll
BHO: RealNetworks Download and Record Plugin for Internet Explorer: {3049c3e9-b461-4bc5-8870-4c09146192ca} - C:\Program Files (x86)\RealNetworks\RealDownloader\BrowserPlugins\IE\rndlbrowserrecordplugin.dll
BHO: XfireXO Toolbar: {5e5ab302-7f65-44cd-8211-c1d4caaccea3} - C:\Program Files (x86)\XfireXO\prxtbXfir.dll
BHO: Ad-Aware Security Toolbar: {6c97a91e-4524-4019-86af-2aa2d567bf5c} - C:\Program Files (x86)\adawaretb\adawareDx.dll
BHO: Java(tm) Plug-In SSV Helper: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - C:\Program Files (x86)\Java\jre6\bin\ssv.dll
BHO: avast! WebRep: {8e5e2654-ad2d-48bf-ac2d-d17f00898d06} - d:\AVAST Software\Avast\aswWebRepIE.dll
BHO: Windows Live ID Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
BHO: Ask Toolbar: {d4027c7f-154a-4066-a1ad-4243d8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll
BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll
TB: avast! WebRep: {8e5e2654-ad2d-48bf-ac2d-d17f00898d06} - d:\AVAST Software\Avast\aswWebRepIE.dll
TB: Ask Toolbar: {d4027c7f-154a-4066-a1ad-4243d8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll
TB: XfireXO Toolbar: {5e5ab302-7f65-44cd-8211-c1d4caaccea3} - C:\Program Files (x86)\XfireXO\prxtbXfir.dll
TB: Ad-Aware Security Toolbar: {6c97a91e-4524-4019-86af-2aa2d567bf5c} - C:\Program Files (x86)\adawaretb\adawareDx.dll
uRun: [SpybotSD TeaTimer] d:\Spybot - Search & Destroy\TeaTimer.exe
uRun: [Akamai NetSession Interface] "C:\Users\mike\AppData\Local\Akamai\netsession_win.exe "
uRun: [tinySpell] D:\tinySpell\tinyspell.exe
uRun: [Skype] "C:\Program Files (x86)\Skype\Phone\Skype.exe" /minimized /regrun
mRun: [VirtualCloneDrive] "d:\VirtualCloneDrive\VCDDaemon.exe" /s
mRun: [Hotkey Utility] C:\Program Files (x86)\Acer\Hotkey Utility\HotkeyUtility.exe
mRun: [avast] "d:\AVAST Software\Avast\avastUI.exe" /nogui
mRun: [BISA.exe] "C:\Program Files (x86)\Bell\Internet Service Advisor\BISA.exe" /AUTORUN
mRun: [<NO NAME>]
mRun: [ApnUpdater] "C:\Program Files (x86)\Ask.com\Updater\Updater.exe "
mRun: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe "
mRun: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe "
mRun: [Wondershare Helper Compact.exe] C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe
mRun: [Aimersoft Helper Compact.exe] C:\Program Files (x86)\Common Files\Aimersoft\Aimersoft Helper Compact\ASHelper.exe
mRun: [TkBellExe] "C:\Program Files (x86)\Real\RealPlayer\update\realsched.exe" -osboot
mRun: [Ad-Aware Browsing Protection] "C:\ProgramData\Ad-Aware Browsing Protection\adawarebp.exe "
mRun: [Ad-Aware Antivirus] "C:\Program Files (x86)\Ad-Aware Antivirus\AdAwareLauncher" --windows-run
mRun: [Malwarebytes' Anti-Malware] "d:\Malwarebytes' Anti-Malware\mbamgui.exe" /starttray
dRunOnce: [IsMyWinLockerReboot] msiexec.exe /qn /x{voidguid}
dRunOnce: [adaware] reg.exe delete "HKCU\Software\AppDataLow\Software\adaware" /f
dRunOnce: [adaware_XP] reg.exe delete "HKCU\Software\adaware" /f
StartupFolder: C:\Users\mike\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\DynDNS.lnk - D:\DynDNS Updater\DynDNS.exe
StartupFolder: C:\Users\mike\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\MAGICD~1.LNK - D:\MagicDisc\MagicDisc.exe
StartupFolder: C:\Users\mike\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\SETALA~1.LNK - D:\Time Tools\Set Alarm Clock\Set Alarm Clock.exe
StartupFolder: C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\Startup\PHRASE~1.LNK - D:\PhraseExpress\phraseexpress.exe
uPolicies-explorer: NoThumbnailCache = 1 (0x1)
mPolicies-explorer: NoActiveDesktop = 1 (0x1)
mPolicies-explorer: NoActiveDesktopChanges = 1 (0x1)
mPolicies-system: ConsentPromptBehaviorAdmin = 5 (0x5)
mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3)
mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
IE: Download with &Media Finder - C:\Program Files (x86)\Media Finder\hook.html
IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
Trusted Zone: clonewarsadventures.com
Trusted Zone: freerealms.com
Trusted Zone: samsungsetup.com\www
Trusted Zone: soe.com
Trusted Zone: sony.com
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab
TCP: Interfaces\{83D6996F-51DC-48F5-9043-B743536D8B8A} : NameServer = 8.8.8.8,8.8.4.4
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL
Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files (x86)\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll
mASetup: {2D46B6DC-2207-486B-B523-A557E6D54B47} - C:\Windows\system32\cmd.exe /D /C start C:\Windows\system32\ie4uinit.exe -ClearIconCache
BHO-X64: Adobe PDF Link Helper: {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
BHO-X64: AcroIEHelperStub - No File
BHO-X64: McAfee Phishing Filter: {27B4851A-3207-45A2-B947-BE8AFE6163AB} - c:\progra~1\mcafee\msk\mskapbho.dll
BHO-X64: McAfee Phishing Filter - No File
BHO-X64: RealNetworks Download and Record Plugin for Internet Explorer: {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files (x86)\RealNetworks\RealDownloader\BrowserPlugins\IE\rndlbrowserrecordplugin.dll
BHO-X64: XfireXO Toolbar: {5e5ab302-7f65-44cd-8211-c1d4caaccea3} - C:\Program Files (x86)\XfireXO\prxtbXfir.dll
BHO-X64: XfireXO - No File
BHO-X64: Ad-Aware Security Toolbar: {6c97a91e-4524-4019-86af-2aa2d567bf5c} - C:\Program Files (x86)\adawaretb\adawareDx.dll
BHO-X64: Ad-Aware Security Toolbar - No File
BHO-X64: Java(tm) Plug-In SSV Helper: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre6\bin\ssv.dll
BHO-X64: avast! WebRep: {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - d:\AVAST Software\Avast\aswWebRepIE.dll
BHO-X64: Windows Live ID Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
BHO-X64: Ask Toolbar: {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll
BHO-X64: Ask Toolbar BHO - No File
BHO-X64: Java(tm) Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll
TB-X64: avast! WebRep: {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - d:\AVAST Software\Avast\aswWebRepIE.dll
TB-X64: Ask Toolbar: {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll
TB-X64: XfireXO Toolbar: {5e5ab302-7f65-44cd-8211-c1d4caaccea3} - C:\Program Files (x86)\XfireXO\prxtbXfir.dll
TB-X64: Ad-Aware Security Toolbar: {6c97a91e-4524-4019-86af-2aa2d567bf5c} - C:\Program Files (x86)\adawaretb\adawareDx.dll
mRun-x64: [VirtualCloneDrive] "d:\VirtualCloneDrive\VCDDaemon.exe" /s
mRun-x64: [Hotkey Utility] C:\Program Files (x86)\Acer\Hotkey Utility\HotkeyUtility.exe
mRun-x64: [avast] "d:\AVAST Software\Avast\avastUI.exe" /nogui
mRun-x64: [BISA.exe] "C:\Program Files (x86)\Bell\Internet Service Advisor\BISA.exe" /AUTORUN
mRun-x64: [(Default)]
mRun-x64: [ApnUpdater] "C:\Program Files (x86)\Ask.com\Updater\Updater.exe "
mRun-x64: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe "
mRun-x64: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe "
mRun-x64: [Wondershare Helper Compact.exe] C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe
mRun-x64: [Aimersoft Helper Compact.exe] C:\Program Files (x86)\Common Files\Aimersoft\Aimersoft Helper Compact\ASHelper.exe
mRun-x64: [TkBellExe] "C:\Program Files (x86)\Real\RealPlayer\update\realsched.exe" -osboot
mRun-x64: [Ad-Aware Browsing Protection] "C:\ProgramData\Ad-Aware Browsing Protection\adawarebp.exe "
mRun-x64: [Ad-Aware Antivirus] "C:\Program Files (x86)\Ad-Aware Antivirus\AdAwareLauncher" --windows-run
mRun-x64: [Malwarebytes' Anti-Malware] "d:\Malwarebytes' Anti-Malware\mbamgui.exe" /starttray
.
================= FIREFOX ===================
.
FF - ProfilePath - C:\Users\mike\AppData\Roaming\Mozilla\Firefox\Profiles\1t1n6t9q.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://www.google.ca/
FF - prefs.js: keyword.URL - hxxp://search.babylon.com/?AF=100490&babsrc=adbartrp&mntrId=c49c11c6000000000000c89cdc2923d8&q=
FF - plugin: C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll
FF - plugin: C:\Program Files (x86)\Bell\Internet Service Advisor\nprpspa.dll
FF - plugin: C:\Program Files (x86)\Common Files\Motive\npMotive.dll
FF - plugin: C:\Program Files (x86)\Google\Update\1.3.21.111\npGoogleUpdate3.dll
FF - plugin: C:\Program Files (x86)\Java\jre6\bin\plugin2\npdeployJava1.dll
FF - plugin: C:\Program Files (x86)\Java\jre6\bin\plugin2\npjp2.dll
FF - plugin: c:\Program Files (x86)\Microsoft Silverlight\4.1.10329.0\npctrlui.dll
FF - plugin: C:\Program Files (x86)\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlchromebrowserrecordext.dll
FF - plugin: C:\Program Files (x86)\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlhtml5videoshim.dll
FF - plugin: C:\Program Files (x86)\WildTangent Games\App\BrowserIntegration\Registered\0\NP_wtapp.dll
FF - plugin: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll
FF - plugin: C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprpchromebrowserrecordext.dll
FF - plugin: C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll
FF - plugin: C:\Windows\system32\Wat\npWatWeb.dll
FF - plugin: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_2_202_235.dll
.
---- FIREFOX POLICIES ----
FF - user.js: extensions.BabylonToolbar_i.id - c49c11c6000000000000c89cdc2923d8
FF - user.js: extensions.BabylonToolbar_i.hardId - c49c11c6000000000000c89cdc2923d8
FF - user.js: extensions.BabylonToolbar_i.instlDay - 15392
FF - user.js: extensions.BabylonToolbar_i.vrsn - 1.5.3.17
FF - user.js: extensions.BabylonToolbar_i.vrsni - 1.5.3.17
FF - user.js: extensions.BabylonToolbar_i.vrsnTs - 1.5.3.1722:29:28
FF - user.js: extensions.BabylonToolbar_i.prtnrId - babylon
FF - user.js: extensions.BabylonToolbar_i.prdct - BabylonToolbar
FF - user.js: extensions.BabylonToolbar_i.aflt - babsst
FF - user.js: extensions.BabylonToolbar_i.smplGrp - none
FF - user.js: extensions.BabylonToolbar_i.tlbrId - base
FF - user.js: extensions.BabylonToolbar_i.newTab - false
FF - user.js: extensions.BabylonToolbar_i.babTrack - affID=110482
FF - user.js: extensions.BabylonToolbar_i.babExt -
FF - user.js: extensions.BabylonToolbar_i.srcExt - ss
FF - user.js: extensions.BabylonToolbar_i.instlRef - sst
.
============= SERVICES / DRIVERS ===============
.
R1 aswSnx;aswSnx;C:\Windows\system32\drivers\aswSnx.sys --> C:\Windows\system32\drivers\aswSnx.sys [?]
R1 aswSP;aswSP;C:\Windows\system32\drivers\aswSP.sys --> C:\Windows\system32\drivers\aswSP.sys [?]
R1 mwlPSDFilter;mwlPSDFilter;C:\Windows\system32\DRIVERS\mwlPSDFilter.sys --> C:\Windows\system32\DRIVERS\mwlPSDFilter.sys [?]
R1 mwlPSDNServ;mwlPSDNServ;C:\Windows\system32\DRIVERS\mwlPSDNServ.sys --> C:\Windows\system32\DRIVERS\mwlPSDNServ.sys [?]
R1 mwlPSDVDisk;mwlPSDVDisk;C:\Windows\system32\DRIVERS\mwlPSDVDisk.sys --> C:\Windows\system32\DRIVERS\mwlPSDVDisk.sys [?]
R1 SbFw;SbFw;C:\Windows\system32\drivers\SbFw.sys --> C:\Windows\system32\drivers\SbFw.sys [?]
R1 SBRE;SBRE;C:\Windows\System32\drivers\SBREDrv.sys [2011-10-26 101112]
R2 Ad-Aware Service;Ad-Aware Service;C:\Program Files (x86)\Ad-Aware Antivirus\AdAwareService.exe [2012-5-3 1226096]
R2 AdobeARMservice;Adobe Acrobat Update Service;C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2012-1-3 63928]
R2 Akamai;Akamai NetSession Interface;C:\Windows\System32\svchost.exe -k Akamai [2009-7-13 20992]
R2 aswFsBlk;aswFsBlk;C:\Windows\system32\drivers\aswFsBlk.sys --> C:\Windows\system32\drivers\aswFsBlk.sys [?]
R2 aswMonFlt;aswMonFlt;\??\C:\Windows\system32\drivers\aswMonFlt.sys --> C:\Windows\system32\drivers\aswMonFlt.sys [?]
R2 avast! Antivirus;avast! Antivirus;D:\AVAST Software\Avast\AvastSvc.exe [2012-3-25 44768]
R2 GREGService;GREGService;C:\Program Files (x86)\Acer\Registration\GREGsvc.exe [2010-1-8 23584]
R2 Live Updater Service;Live Updater Service;C:\Program Files\Acer\Acer Updater\UpdaterService.exe [2011-3-31 244624]
R2 MBAMService;MBAMService;D:\Malwarebytes' Anti-Malware\mbamservice.exe [2012-5-27 654408]
R2 McciCMService64;McciCMService64;C:\Program Files\Common Files\Motive\McciCMService.exe [2012-2-14 517632]
R2 regi;regi;\??\C:\Windows\system32\drivers\regi.sys --> C:\Windows\system32\drivers\regi.sys [?]
R2 SBAMSvc;Ad-Aware;C:\Program Files (x86)\Ad-Aware Antivirus\SBAMSvc.exe [2011-12-19 3289032]
R2 sbapifs;sbapifs;C:\Windows\system32\DRIVERS\sbapifs.sys --> C:\Windows\system32\DRIVERS\sbapifs.sys [?]
R2 SBSDWSCService;SBSD Security Center Service;D:\Spybot - Search & Destroy\SDWinSec.exe [2011-12-10 1153368]
R2 ServicepointService;ServicepointService;C:\Program Files (x86)\Bell\Internet Service Advisor\ServicepointService.exe [2012-2-14 689464]
R2 SSPORT;SSPORT;\??\C:\Windows\system32\Drivers\SSPORT.sys --> C:\Windows\system32\Drivers\SSPORT.sys [?]
R3 MBAMProtector;MBAMProtector;\??\C:\Windows\system32\drivers\mbam.sys --> C:\Windows\system32\drivers\mbam.sys [?]
R3 MSHUSBVideo;NX6000/NX3000/VX2000/VX5000/VX5500/VX7000/Cinema Filter Driver;C:\Windows\system32\Drivers\nx6000.sys --> C:\Windows\system32\Drivers\nx6000.sys [?]
R3 RTL8167;Realtek 8167 NT Driver;C:\Windows\system32\DRIVERS\Rt64win7.sys --> C:\Windows\system32\DRIVERS\Rt64win7.sys [?]
R3 SBFWIMCLMP;GFI Software Firewall NDIS IM Filter Miniport;C:\Windows\system32\DRIVERS\SBFWIM.sys --> C:\Windows\system32\DRIVERS\SBFWIM.sys [?]
R3 sbwtis;sbwtis;C:\Windows\system32\DRIVERS\sbwtis.sys --> C:\Windows\system32\DRIVERS\sbwtis.sys [?]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]
S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-3-18 138576]
S2 gupdate;Google Update Service (gupdate);C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2012-2-26 136176]
S2 SkypeUpdate;Skype Updater;C:\Program Files (x86)\Skype\Updater\Updater.exe [2012-2-29 158856]
S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-4-4 257696]
S3 gupdatem;Google Update Service (gupdatem);C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2012-2-26 136176]
S3 MozillaMaintenance;Mozilla Maintenance Service;C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe [2012-4-27 129976]
S3 npggsvc;nProtect GameGuard Service;C:\Windows\system32\GameMon.des -service --> C:\Windows\system32\GameMon.des -service [?]
S3 OverwolfUpdaterService;Overwolf Updater Service;C:\Program Files (x86)\Overwolf\OverwolfUpdater.exe [2011-12-19 18360]
S3 SBFWIMCL;GFI Software Firewall NDIS IM Filter Service;C:\Windows\system32\DRIVERS\sbfwim.sys --> C:\Windows\system32\DRIVERS\sbfwim.sys [?]
S3 sbhips;sbhips;C:\Windows\system32\drivers\sbhips.sys --> C:\Windows\system32\drivers\sbhips.sys [?]
S3 TsUsbFlt;TsUsbFlt;C:\Windows\system32\drivers\tsusbflt.sys --> C:\Windows\system32\drivers\tsusbflt.sys [?]
S3 TsUsbGD;Remote Desktop Generic USB Device;C:\Windows\system32\drivers\TsUsbGD.sys --> C:\Windows\system32\drivers\TsUsbGD.sys [?]
S3 WatAdminSvc;Windows Activation Technologies Service;C:\Windows\system32\Wat\WatAdminSvc.exe --> C:\Windows\system32\Wat\WatAdminSvc.exe [?]
S4 EgisTec Ticket Service;EgisTec Ticket Service;C:\Program Files (x86)\Common Files\EgisTec\Services\EgisTicketService.exe [2010-9-27 172912]
S4 GamesAppService;GamesAppService;C:\Program Files (x86)\WildTangent Games\App\GamesAppService.exe [2010-10-12 206072]
S4 NAUpdate;Nero Update;C:\Program Files (x86)\Nero\Update\NASvc.exe [2010-5-4 503080]
S4 NOBU;Norton Online Backup;C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe [2010-6-1 2804568]
S4 RealNetworks Downloader Resolver Service;RealNetworks Downloader Resolver Service;C:\Program Files (x86)\RealNetworks\RealDownloader\rndlresolversvc.exe [2011-12-2 31408]
S4 wlcrasvc;Windows Live Mesh remote connections service;C:\Program Files\Windows Live\Mesh\wlcrasvc.exe [2010-9-22 57184]
.
=============== Created Last 30 ================
.
2012-05-27 16:02:09 24904 ----a-w- C:\Windows\System32\drivers\mbam.sys
2012-05-27 15:56:10 -------- d-----w- C:\Users\mike\AppData\Local\{E19463A4-7BD9-4EE1-9399-2B468DB91B20}
2012-05-27 15:55:58 -------- d-----w- C:\Users\mike\AppData\Local\{2E2EB7E1-EFCA-4D6F-B6E0-A133908ADEC6}
2012-05-27 08:53:43 -------- d-----w- C:\Users\mike\AppData\Local\{4614D616-52AF-4BC8-82FD-6050C111C59E}
2012-05-26 16:00:15 -------- d-----w- C:\TDSSKiller_Quarantine
2012-05-26 03:02:35 -------- d-----w- C:\Users\mike\AppData\Local\{A0918EEA-D54D-49F2-987B-394BACFEC08C}
2012-05-26 03:02:22 -------- d-----w- C:\Users\mike\AppData\Local\{5EA1BD6F-DE9D-4C76-8843-C1EAFB07A7EB}
2012-05-26 01:01:47 -------- d-----w- C:\Users\mike\AppData\Local\{55390141-9632-42C4-A23E-16D497055B73}
2012-05-26 01:00:59 -------- d-----w- C:\Users\mike\AppData\Local\{BBDAE467-EA9D-4C90-8BF3-509390136D56}
2012-05-25 10:19:51 -------- d-----w- C:\Users\mike\AppData\Local\{33EDB575-8B66-4556-B0BF-32A2805996FB}
2012-05-25 10:19:37 -------- d-----w- C:\Users\mike\AppData\Local\{C3588AA2-DCFF-40F4-B017-73038F8FEA71}
2012-05-24 22:02:02 -------- d-----w- C:\Users\mike\AppData\Local\{82BC006E-4A36-4337-A9AC-0474176428C5}
2012-05-24 22:01:47 -------- d-----w- C:\Users\mike\AppData\Local\{4739DE01-5808-4866-B390-0B94C2F47498}
2012-05-23 15:23:59 -------- d-----w- C:\Users\mike\AppData\Local\{84F0EB27-B9DB-4A99-94F1-607980415422}
2012-05-23 15:23:42 -------- d-----w- C:\Users\mike\AppData\Local\{24D38967-F835-4DA8-901C-AF8CAF6CC989}
2012-05-22 15:58:18 -------- d-----w- C:\Users\mike\AppData\Local\{0C6F4FCB-F9E9-46DA-9129-C5E12307076A}
2012-05-22 15:58:07 -------- d-----w- C:\Users\mike\AppData\Local\{0780A86A-C6B6-43AF-BE9F-ADF57EF8EC00}
2012-05-22 03:57:31 -------- d-----w- C:\Users\mike\AppData\Local\{347899AB-6DA2-4408-8A33-15B7CDF685CC}
2012-05-22 03:57:19 -------- d-----w- C:\Users\mike\AppData\Local\{93EC5692-00C3-4D91-8CC6-96635F8FA8B2}
2012-05-21 10:47:38 -------- d-----w- C:\Users\mike\AppData\Local\{EF3640B4-D8EF-41C8-A1DC-79A23A9287B0}
2012-05-21 10:47:23 -------- d-----w- C:\Users\mike\AppData\Local\{D9E9EDDF-F7F2-4C8C-8C83-608AC630DAC0}
2012-05-20 04:28:22 -------- d-----w- C:\Users\mike\AppData\Local\{39FBCD73-F947-4C51-B5DA-540C3AC102CA}
2012-05-20 04:28:09 -------- d-----w- C:\Users\mike\AppData\Local\{ACC03CD3-232A-43B5-8FAB-EF0CF6864BFA}
2012-05-19 14:49:52 -------- d-----w- C:\Users\mike\AppData\Local\{CECA59B2-CEBD-49C0-8C4B-0DE71DB00AD3}
2012-05-19 14:49:41 -------- d-----w- C:\Users\mike\AppData\Local\{7AF21402-05B9-46C5-9EC9-2E6C4E422AF4}
2012-05-19 05:52:22 -------- d-----w- C:\Users\mike\AppData\Local\{AB4C5BC0-D8A3-4BE2-8001-1DEE7AB484EA}
2012-05-18 05:12:54 -------- d-----w- C:\Users\mike\AppData\Local\{0CE15D26-65CA-4101-AB09-2ED66A0BFAE1}
2012-05-18 05:12:42 -------- d-----w- C:\Users\mike\AppData\Local\{9DB03206-C802-4772-BE8F-9999C1195112}
2012-05-17 15:13:55 -------- d-----w- C:\Users\mike\AppData\Local\{6DF2876B-55C3-44B2-BB37-FD41EDC117EF}
2012-05-17 15:13:44 -------- d-----w- C:\Users\mike\AppData\Local\{4914DBD3-1D5E-405C-A34F-2627FCA156D5}
2012-05-16 23:54:26 -------- d-----w- C:\Users\mike\AppData\Local\{A3D3BDDA-5533-4C32-87D1-21C2804A9FFE}
2012-05-16 23:54:07 -------- d-----w- C:\Users\mike\AppData\Local\{C6782C89-74F3-4F26-ABC4-F8519E453E10}
2012-05-16 07:59:45 -------- d-----w- C:\Users\mike\AppData\Local\{62E54035-DD0E-4D0B-8ED1-1FF6199706FF}
2012-05-16 07:59:33 -------- d-----w- C:\Users\mike\AppData\Local\{7A922CF8-80C3-4213-ABC7-6A1CFAAFEFEF}
2012-05-15 17:52:54 -------- d-----w- C:\Users\mike\AppData\Local\{8DF0C742-5E06-45C7-89A4-9B0ABA389BE5}
2012-05-15 17:51:15 -------- d-----w- C:\Users\mike\AppData\Local\{BACC792B-3BDD-4149-9385-541817D9D9B7}
2012-05-14 16:24:20 -------- d-----w- C:\Users\mike\AppData\Local\adawarebp
2012-05-14 15:57:29 -------- d-----w- C:\Users\mike\AppData\Local\adaware
2012-05-14 15:56:57 60536 ----a-w- C:\Windows\System32\drivers\sbhips.sys
2012-05-14 15:56:39 119416 ----a-w- C:\Windows\System32\drivers\SbFwIm.sys
2012-05-14 15:56:37 256632 ----a-w- C:\Windows\System32\drivers\SbFw.sys
2012-05-14 15:56:32 45936 ----a-w- C:\Windows\System32\sbbd.exe
2012-05-14 15:56:22 -------- d-----w- C:\Program Files (x86)\Ad-Aware Antivirus
2012-05-14 15:55:41 -------- d-----w- C:\Program Files (x86)\adawaretb
2012-05-14 15:45:30 -------- d-----w- C:\Users\mike\AppData\Roaming\Ad-Aware Antivirus
2012-05-14 09:15:59 -------- d-----w- C:\Users\mike\AppData\Local\{46F84DA8-C63F-4B72-9D1D-BC5F27CA2DEE}
2012-05-14 09:15:44 -------- d-----w- C:\Users\mike\AppData\Local\{E8458EEA-B66A-404C-933B-13B865928433}
2012-05-13 20:57:36 -------- d-----w- C:\Users\mike\AppData\Local\{5750CDC9-AEBF-4213-B167-A4A257DD5131}
2012-05-13 20:57:23 -------- d-----w- C:\Users\mike\AppData\Local\{5B43B7F8-A7B9-494B-A499-762301701033}
2012-05-13 06:15:55 -------- d-----w- C:\Users\mike\AppData\Local\{50440B6D-2562-4E13-AFE0-B9486F474E5B}
2012-05-13 06:15:43 -------- d-----w- C:\Users\mike\AppData\Local\{AE6EF017-5CA4-4AB4-87A3-8E9A131E1170}
2012-05-12 08:06:38 8917360 ----a-w- C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{91499680-BDEF-4E5C-9C45-2461C4478F96}\mpengine.dll
2012-05-12 07:52:21 -------- d-----w- C:\Users\mike\AppData\Local\{32AF11BA-778D-48B6-B808-57457F6FE40D}
2012-05-12 07:52:09 -------- d-----w- C:\Users\mike\AppData\Local\{1592100C-48DB-4839-9685-C0A026D2AE7E}
2012-05-11 18:58:02 1544704 ----a-w- C:\Windows\System32\DWrite.dll
2012-05-11 18:58:02 1077248 ----a-w- C:\Windows\SysWow64\DWrite.dll
2012-05-11 18:57:59 5559664 ----a-w- C:\Windows\System32\ntoskrnl.exe
2012-05-11 18:57:58 3146240 ----a-w- C:\Windows\System32\win32k.sys
2012-05-11 18:57:57 3968368 ----a-w- C:\Windows\SysWow64\ntkrnlpa.exe
2012-05-11 18:57:56 3913072 ----a-w- C:\Windows\SysWow64\ntoskrnl.exe
2012-05-11 18:56:41 75120 ----a-w- C:\Windows\System32\drivers\partmgr.sys
2012-05-11 18:56:04 1918320 ----a-w- C:\Windows\System32\drivers\tcpip.sys
2012-05-11 18:55:59 1732096 ----a-w- C:\Program Files\Windows Journal\NBDoc.DLL
2012-05-11 18:55:59 1367552 ----a-w- C:\Program Files\Common Files\Microsoft Shared\ink\journal.dll
2012-05-11 18:55:58 936960 ----a-w- C:\Program Files (x86)\Common Files\Microsoft Shared\ink\journal.dll
2012-05-11 18:55:57 1402880 ----a-w- C:\Program Files\Windows Journal\JNWDRV.dll
2012-05-11 18:55:57 1393664 ----a-w- C:\Program Files\Windows Journal\JNTFiltr.dll
2012-05-11 13:46:53 -------- d-----w- C:\Users\mike\AppData\Local\{4D16D864-6656-461C-A8B2-DC29F5668F71}
2012-05-11 13:46:36 -------- d-----w- C:\Users\mike\AppData\Local\{9261ADA5-C525-4964-8EB1-4CC32DD80307}
2012-05-10 21:59:18 -------- d-----w- C:\Users\mike\AppData\Local\{3E831E12-BE2E-40D4-ADED-192BB4B78C36}
2012-05-10 21:59:06 -------- d-----w- C:\Users\mike\AppData\Local\{5F829D11-43D8-4905-9E50-FADEA0AD23E6}
2012-05-10 07:34:09 -------- d-----w- C:\Users\mike\AppData\Local\{0247AC4A-DD7E-4605-89E2-2B2FD9E38D82}
2012-05-10 07:33:57 -------- d-----w- C:\Users\mike\AppData\Local\{C24503AA-EA00-4E77-ACF3-4794B9E04D6B}
2012-05-09 16:09:44 -------- d-----w- C:\Users\mike\AppData\Local\{8D309B9D-5D10-4B05-8327-5146E8211E73}
2012-05-09 16:09:32 -------- d-----w- C:\Users\mike\AppData\Local\{D89EC065-5DDA-4A9D-A3C7-EB8C7F5928BF}
2012-05-07 17:36:38 -------- d-----w- C:\Users\mike\AppData\Local\{20E9B258-5DDC-4D9A-8EE0-83B91E77511C}
2012-05-07 17:36:23 -------- d-----w- C:\Users\mike\AppData\Local\{68AEB5ED-515F-4A10-94A9-4896BAFB91C8}
2012-05-04 08:38:30 -------- d-----w- C:\Users\mike\AppData\Local\{FD9B731A-0A4F-4E79-9669-7EF50D800D0D}
2012-05-04 08:38:18 -------- d-----w- C:\Users\mike\AppData\Local\{0ED80716-10AB-4959-ABB7-A01D2664447E}
2012-05-02 14:39:23 -------- d-----w- C:\Users\mike\AppData\Local\{873978A7-1CD1-4BE5-917F-1FD5D036BA38}
2012-05-02 14:39:06 -------- d-----w- C:\Users\mike\AppData\Local\{BDA70CDE-3F14-4395-B755-0A8EE6178230}
2012-05-01 16:12:08 -------- d-----w- C:\Users\mike\AppData\Local\{1DF5FB86-2B51-4EC4-815F-8A720FF3DE9A}
2012-05-01 16:11:57 -------- d-----w- C:\Users\mike\AppData\Local\{ED2A019C-5CA7-4E6B-8C80-8C1CAE0FD33B}
2012-05-01 01:24:42 -------- d-----w- C:\Users\mike\AppData\Local\{C9858595-72AC-4CC1-8214-E7B8E0C10CFD}
2012-05-01 01:24:19 -------- d-----w- C:\Users\mike\AppData\Local\{C2756BEE-C915-437D-8C83-86435DB73290}
2012-04-30 22:43:13 -------- d-----w- C:\Users\mike\AppData\Local\{374F3FD1-9CC5-47A0-8506-FCDE22F55801}
2012-04-30 06:41:00 -------- d-----w- C:\Users\mike\AppData\Local\{72A7178C-D73A-4623-8614-2B97F9B02D85}
2012-04-30 06:40:30 -------- d-----w- C:\Users\mike\AppData\Local\{EFE1AE21-6F6D-406F-B687-A0FB826874C6}
2012-04-29 08:15:42 -------- d-----w- C:\Users\mike\AppData\Local\{E7D8953F-2869-4671-B12F-9857529D0E65}
2012-04-29 08:15:31 -------- d-----w- C:\Users\mike\AppData\Local\{C6F853D0-45C7-413B-A9F0-F3EC9E2F0218}
2012-04-28 15:42:45 -------- d-----w- C:\Users\mike\AppData\Local\{39C922C7-DF96-4CC3-8DA9-63745E1F5AF4}
2012-04-28 15:42:33 -------- d-----w- C:\Users\mike\AppData\Local\{1784783E-0A60-4C8C-8B99-9402984BA2C2}
2012-04-28 08:10:53 -------- d-----w- C:\Users\mike\AppData\Local\{780DB162-0B6C-4715-BFC5-F9E790D23C6A}
2012-04-28 08:10:41 -------- d-----w- C:\Users\mike\AppData\Local\{74C43A17-7A73-4717-A501-BB8065441260}
.
==================== Find3M ====================
.
2012-05-09 02:13:35 70304 ----a-w- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl
2012-05-09 02:13:35 419488 ----a-w- C:\Windows\SysWow64\FlashPlayerApp.exe
2012-05-09 02:13:20 8744608 ----a-w- C:\Windows\SysWow64\FlashPlayerInstaller.exe
2012-04-14 06:51:27 608 --sha-w- C:\Windows\System32\winzvprt5.sys
2012-03-24 02:34:20 24576 ----a-w- C:\Windows\System32\img_localmon.dll
2012-03-24 02:34:20 15872 ----a-w- C:\Windows\System32\img_localui.dll
2012-03-10 19:33:34 66936 --sha-w- C:\Windows\dlinfo_0.drv
2012-03-10 19:23:05 86528 ----a-w- C:\Windows\bnetunin.exe
2012-03-08 22:50:28 49016 ----a-w- C:\Windows\SysWow64\sirenacm.dll
2012-03-08 22:37:20 302448 ----a-w- C:\Windows\WLXPGSS.SCR
2012-03-06 23:15:19 41184 ----a-w- C:\Windows\avastSS.scr
2012-03-06 23:04:06 819032 ----a-w- C:\Windows\System32\drivers\aswSnx.sys
2012-03-06 23:02:20 53080 ----a-w- C:\Windows\System32\drivers\aswRdr2.sys
2012-03-06 23:01:52 69976 ----a-w- C:\Windows\System32\drivers\aswMonFlt.sys
2012-03-01 06:46:16 23408 ----a-w- C:\Windows\System32\drivers\fs_rec.sys
2012-03-01 06:38:27 220672 ----a-w- C:\Windows\System32\wintrust.dll
2012-03-01 06:33:50 81408 ----a-w- C:\Windows\System32\imagehlp.dll
2012-03-01 06:28:47 5120 ----a-w- C:\Windows\System32\wmi.dll
2012-03-01 05:37:41 172544 ----a-w- C:\Windows\SysWow64\wintrust.dll
2012-03-01 05:33:23 159232 ----a-w- C:\Windows\SysWow64\imagehlp.dll
2012-03-01 05:29:16 5120 ----a-w- C:\Windows\SysWow64\wmi.dll
2012-02-29 19:26:36 42392 ----a-w- C:\Windows\SysWow64\xfcodec.dll
2012-02-29 19:26:36 28056 ----a-w- C:\Windows\System32\xfcodec64.dll
2012-02-28 06:39:37 1188864 ----a-w- C:\Windows\System32\wininet.dll
2012-02-28 05:38:52 981504 ----a-w- C:\Windows\SysWow64\wininet.dll
2012-02-28 04:31:38 1638912 ----a-w- C:\Windows\System32\mshtml.tlb
2012-02-28 03:52:27 1638912 ----a-w- C:\Windows\SysWow64\mshtml.tlb
2012-02-28 00:43:56 4207616 ----a-w- C:\Windows\System32\ffdshow.ax
2012-02-28 00:43:02 3350528 ----a-w- C:\Windows\SysWow64\ffdshow.ax
2012-02-28 00:41:52 4492800 ----a-w- C:\Windows\System32\ffmpeg.dll
2012-02-28 00:39:54 4414976 ----a-w- C:\Windows\SysWow64\ffmpeg.dll
.
============= FINISH: 13:19:26.38 ===============

---

Attach.txt

.
UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT
.
DDS (Ver_2011-08-26.01)
.
Microsoft Windows 7 Home Premium
Boot Device: \Device\HarddiskVolume2
Install Date: 2011-12-09 3:12:08 PM
System Uptime: 2012-05-27 12:47:24 PM (1 hours ago)
.
Motherboard: Acer | | Aspire X1920
Processor: Pentium(R) Dual-Core CPU E5800 @ 3.20GHz | CPU 1 | 3203/200mhz
.
==== Disk Partitions =========================
.
C: is FIXED (NTFS) - 458 GiB total, 367.57 GiB free.
D: is FIXED (NTFS) - 225 GiB total, 204.727 GiB free.
E: is FIXED (NTFS) - 229 GiB total, 46.136 GiB free.
F: is CDROM ()
X: is CDROM (CDFS)
Y: is Removable
Z: is CDROM ()
.
==== Disabled Device Manager Items =============
.
Class GUID: {4d36e96f-e325-11ce-bfc1-08002be10318}
Description: Microsoft PS/2 Mouse
Device ID: ACPI\PNP0F03\4&2C13614F&0
Manufacturer: Microsoft
Name: Microsoft PS/2 Mouse
PNP Device ID: ACPI\PNP0F03\4&2C13614F&0
Service: i8042prt
.
==== System Restore Points ===================
.
RP125: 2012-05-12 4:06:01 AM - Windows Update
RP126: 2012-05-14 11:52:58 AM - Removed Ad-Aware
RP127: 2012-05-25 8:23:51 AM - Scheduled Checkpoint
.
==== Installed Programs ======================
.
Leawo DVD to MP4 Converter version 4.3.0.0
Acer eRecovery Management
Acer Games
Acer Registration
Acer ScreenSaver
Acer Updater
Ad-Aware Antivirus
Ad-Aware Browsing Protection
Ad-Aware Security Toolbar
Adobe AIR
Adobe Reader X (10.1.3)
Adobe Shockwave Player 11.6
Agatha Christie - 4:50 from Paddington
Akamai NetSession Interface
Allods Online 2.0.06.65.1
Any Video Converter 3.3.2
ArcSoft Print Creations
ArcSoft Print Creations - Album Page
ArcSoft Print Creations - Funhouse
ArcSoft Print Creations - Greeting Card
ArcSoft Print Creations - Photo Book
ArcSoft Print Creations - Photo Calendar
ArcSoft Print Creations - Scrapbook
ArcSoft Print Creations - Slimline Card
Ask Toolbar
Ask Toolbar Updater
avast! Free Antivirus
Battle.net
Bejeweled 2 Deluxe
Bell Internet Check-up
Bell Internet Service Advisor 3.7.44
BitTorrent
Build-a-lot 2
CCScore
Chuzzle Deluxe
clear.fi
clear.fi Client
Contrôle ActiveX Windows Live Mesh pour connexions à distance
ConvertHelper 2.2
D3DX10
DC Universe Online Live
Dev-C++ 5 beta 9 release (4.9.9.2)
Diablo
Diner Dash 2 Restaurant Rescue
Dora's World Adventure
DVD Flick 1.3.0.7
Easy DVD Player
eBay Worldwide
Eligium
ESSBrwr
ESSCDBK
ESScore
ESSgui
ESSini
ESSPCD
ESSPDock
ESSTOOLS
essvatgt
EverQuest II
Fallout
Fast Folder Eraser Free v2.6
Final Drive: Nitro
Forsaken World
Galerie de photos Windows Live
GIMP 2.6.12-2
GOG.com Downloader version 3.0.25
Google Chrome
Google Update Helper
Hotkey Utility
Iconoid version 3.8.6
Identity Card
ImgBurn
Intel(R) Control Center
Intel(R) Graphics Media Accelerator Driver
Java Auto Updater
Java(TM) 6 Update 31
Jewel Quest Heritage
Junk Mail filter update
Kobo
Kodak EasyShare software
Magic ISO Maker v5.5 (build 0281)
MagicDisc 2.7.106
Malwarebytes Anti-Malware version 1.61.0.1400
Media Player Codec Pack 4.1.8
MediaEspresso
Mesh Runtime
Microsoft .NET Framework 1.1
Microsoft Corporation
Microsoft Office 2000 SR-1 Premium
Microsoft Office 2010
Microsoft Silverlight
Microsoft SQL Server 2005 Compact Edition [ENU]
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
Microsoft Visual C++ 2005 Redistributable
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219
Mozilla Firefox 12.0 (x86 en-US)
Mozilla Maintenance Service
MSVCRT
MSVCRT_amd64
MSXML 4.0 SP2 (KB954430)
MSXML 4.0 SP2 (KB973688)
MSXML 4.0 SP2 Parser and SDK
Mumble 1.2.3
Mystery P.I. - Stolen in San Francisco
MyWinLocker 4
MyWinLocker Suite
Namco All-Stars: PAC-MAN
Nero Control Center 10
Nero ControlCenter 10 Help (CHM)
Nero Core Components 10
Nero DiscSpeed 10
Nero DiscSpeed 10 Help (CHM)
Nero Express 10
Nero Express 10 Help (CHM)
Nero Multimedia Suite 10 Essentials
Nero StartSmart 10
Nero StartSmart 10 Help (CHM)
Nero Update
netbrdg
newsXpresso
Norton Online Backup
NVIDIA PhysX
OfotoXMI
OpenAL
Overwolf
Penguins!
PhraseExpress v8.0.152
Plants vs. Zombies - Game of the Year
Poker Superstars III
Polar Bowler
Polar Golfer
PunkBuster Services
QuickTime
RAD Video Tools
RealDownloader
RealNetworks - Microsoft Visual C++ 2008 Runtime
RealPlayer
Realtek Ethernet Controller Driver For Windows Vista and Later
Realtek High Definition Audio Driver
RealUpgrade 1.1
RuneScape Launcher 1.2
Sacred Underworld
Samsung Easy Printer Manager
Samsung ML-1670 Series
Samsung Printer Live Update
Security Update for Microsoft .NET Framework 4 Client Profile (KB2478663)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2518870)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2539636)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2572078)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2604121)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2633870)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2656351)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2656368)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2656405)
SFR
Shaiya(US)
SHASTA
Shredder
SIW version 2011.10.29
skin0001
SKINXSDK
Skypeâ„¢ 5.8
Spybot - Search & Destroy
staticcr
Steam
swMSM
System Requirements Lab CYRI
System Requirements Lab for Intel
The Lord of the Rings Onlineâ„¢: Shadows of Angmarâ„¢ v07.12.30.54
tinySpell 1.9.43
Tom Clancy's Splinter Cell Chaos Theory
Torchlight
Update for Microsoft .NET Framework 4 Client Profile (KB2468871)
Update for Microsoft .NET Framework 4 Client Profile (KB2533523)
Update for Microsoft .NET Framework 4 Client Profile (KB2600217)
Update Installer for WildTangent Games App
Virtual Villagers 4 - The Tree of Life
VirtualCloneDrive
VPRINTOL
Welcome Center
WildTangent Games App (Acer Games)
Windows Live
Windows Live Communications Platform
Windows Live Essentials
Windows Live Installer
Windows Live Mail
Windows Live Mesh
Windows Live Mesh ActiveX Control for Remote Connections
Windows Live Messenger
Windows Live Movie Maker
Windows Live Photo Common
Windows Live Photo Gallery
Windows Live PIMT Platform
Windows Live SOXE
Windows Live SOXE Definitions
Windows Live UX Platform
Windows Live UX Platform Language Pack
Windows Live Writer
Windows Live Writer Resources
WIRELESS
Xfire (remove only)
XfireXO Toolbar
Zuma's Revenge
.
==== Event Viewer Messages From Past Week ========
.
2012-05-27 12:47:49 PM, Error: Microsoft-Windows-TaskScheduler [413] - Task Scheduler service failed to load tasks at service startup. Additional Data: Error Value: 2147549183.
2012-05-27 12:47:43 PM, Error: Microsoft-Windows-WER-SystemErrorReporting [1001] - The computer has rebooted from a bugcheck. The bugcheck was: 0x00000109 (0xa3a039d89d195702, 0xb3b7465eef979240, 0xfffff80000b95080, 0x0000000000000002). A dump was saved in: C:\Windows\MEMORY.DMP. Report Id: 052712-15771-01.
2012-05-27 11:48:16 AM, Error: Service Control Manager [7009] - A timeout was reached (30000 milliseconds) while waiting for the Microsoft .NET Framework NGEN v4.0.30319_X64 service to connect.
2012-05-27 11:44:53 AM, Error: cdrom [11] - The driver detected a controller error on \Device\CdRom1.
2012-05-27 11:43:36 AM, Error: Service Control Manager [7009] - A timeout was reached (30000 milliseconds) while waiting for the Volume Shadow Copy service to connect.
2012-05-27 11:43:36 AM, Error: Service Control Manager [7000] - The Volume Shadow Copy service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
2012-05-27 11:33:52 AM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1053" attempting to start the service VSS with arguments " " in order to run the server: {E579AB5F-1CC4-44B4-BED9-DE0991FF0623}
2012-05-27 11:16:02 AM, Error: Service Control Manager [7009] - A timeout was reached (30000 milliseconds) while waiting for the Adobe Flash Player Update Service service to connect.
2012-05-27 11:16:02 AM, Error: Service Control Manager [7000] - The Adobe Flash Player Update Service service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
2012-05-27 11:10:04 AM, Error: Service Control Manager [7009] - A timeout was reached (30000 milliseconds) while waiting for the Google Update Service (gupdate) service to connect.
2012-05-27 11:10:04 AM, Error: Service Control Manager [7000] - The Google Update Service (gupdate) service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
2012-05-26 11:58:32 AM, Error: Service Control Manager [7001] - The Computer Browser service depends on the Server service which failed to start because of the following error: The dependency service or group failed to start.
2012-05-26 11:42:35 AM, Error: Service Control Manager [7001] - The HomeGroup Provider service depends on the Function Discovery Provider Host service which failed to start because of the following error: The dependency service or group failed to start.
2012-05-26 11:42:34 AM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service WSearch with arguments " " in order to run the server: {9E175B6D-F52A-11D8-B9A5-505054503030}
2012-05-26 11:42:34 AM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service WSearch with arguments " " in order to run the server: {7D096C5F-AC08-4F1F-BEB7-5C22C517CE39}
2012-05-26 11:42:33 AM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service EventSystem with arguments " " in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF}
2012-05-26 11:42:27 AM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service ShellHWDetection with arguments " " in order to run the server: {DD522ACC-F821-461A-A407-50B198B896DC}
2012-05-26 11:42:09 AM, Error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: aswSnx aswSP aswTdi discache ElbyCDIO mwlPSDFilter mwlPSDNServ mwlPSDVDisk spldr Wanarpv6
2012-05-26 10:20:25 AM, Error: Service Control Manager [7009] - A timeout was reached (30000 milliseconds) while waiting for the Windows Error Reporting Service service to connect.
2012-05-26 10:13:00 AM, Error: Service Control Manager [7009] - A timeout was reached (30000 milliseconds) while waiting for the Software Protection service to connect.
2012-05-26 10:13:00 AM, Error: Service Control Manager [7000] - The Software Protection service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
2012-05-25 9:56:04 AM, Error: Service Control Manager [7000] - The MRESP50a64 NDIS Protocol Driver service failed to start due to the following error: The system cannot find the file specified.
2012-05-25 6:15:39 AM, Error: Service Control Manager [7009] - A timeout was reached (30000 milliseconds) while waiting for the SBSD Security Center Service service to connect.
2012-05-25 6:15:39 AM, Error: Service Control Manager [7000] - The SBSD Security Center Service service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
2012-05-25 5:42:43 PM, Error: Service Control Manager [7009] - A timeout was reached (30000 milliseconds) while waiting for the Ad-Aware service to connect.
2012-05-25 5:42:43 PM, Error: Service Control Manager [7000] - The Ad-Aware service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
2012-05-25 5:42:43 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1053" attempting to start the service SBAMSvc with arguments " " in order to run the server: {FE7E09CE-BBF4-4698-8BC1-37C9002DAA43}
2012-05-25 4:23:05 AM, Error: Disk [11] - The driver detected a controller error on \Device\Harddisk2\DR2.
2012-05-23 11:20:22 AM, Error: Service Control Manager [7009] - A timeout was reached (30000 milliseconds) while waiting for the Adobe Acrobat Update Service service to connect.
2012-05-22 1:08:11 AM, Error: Service Control Manager [7023] - The Server service terminated with the following error: Not enough storage is available to complete this operation.
2012-05-21 3:59:06 PM, Error: Service Control Manager [7009] - A timeout was reached (30000 milliseconds) while waiting for the Microsoft .NET Framework NGEN v4.0.30319_X86 service to connect.
.
==== End Of File ===========================

===


*********
***END***
*********

 

Here is the result log for ComboFix, as requested:

---

ComboFix 12-05-27.02 - mike 2012-05-28 2:13.2.2 - x64
Microsoft Windows 7 Home Premium 6.1.7601.1.1252.2.1033.18.4061.2982 [GMT -4:00]
Running from: c:\users\mike\Downloads\www.windowsbbs.com-malware-virus-removal\ComboFix.exe
AV: avast! Antivirus *Disabled/Updated* {2B2D1395-420B-D5C9-657E-930FE358FC3C}
AV: Lavasoft Ad-Aware *Disabled/Updated* {445B48C3-0FA4-6B16-8F07-6506F305D800}
FW: Lavasoft Ad-Aware *Disabled* {7C60C9E6-45CB-6A4E-A458-CC330DD69F7B}
SP: avast! Antivirus *Disabled/Updated* {904CF271-6431-DA47-5FCE-A87D98DFB681}
SP: Lavasoft Ad-Aware *Disabled/Updated* {FF3AA927-299E-6498-B5B7-5E74888292BD}
SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\programdata\F95B173EBC.sys
.
.
((((((((((((((((((((((((( Files Created from 2012-04-28 to 2012-05-28 )))))))))))))))))))))))))))))))
.
.
2012-05-28 06:19 . 2012-05-28 06:19 -------- d-----w- c:\users\Default\AppData\Local\temp
2012-05-28 06:19 . 2012-05-28 06:19 -------- d-----w- c:\users\arathornv\AppData\Local\temp
2012-05-27 16:02 . 2012-04-04 19:56 24904 ----a-w- c:\windows\system32\drivers\mbam.sys
2012-05-27 15:46 . 2012-05-27 15:46 -------- d-----w- c:\users\arathornv\AppData\Roaming\Ad-Aware Antivirus
2012-05-27 15:46 . 2012-05-27 15:46 -------- d-----w- c:\users\arathornv\AppData\Local\adawarebp
2012-05-26 16:00 . 2012-05-26 16:00 -------- d-----w- C:\TDSSKiller_Quarantine
2012-05-14 15:57 . 2012-05-14 15:57 -------- d-----w- c:\users\mike\AppData\Local\adaware
2012-05-14 15:56 . 2011-12-19 16:44 60536 ----a-w- c:\windows\system32\drivers\sbhips.sys
2012-05-14 15:56 . 2011-09-29 16:16 119416 ----a-w- c:\windows\system32\drivers\SbFwIm.sys
2012-05-14 15:56 . 2011-12-19 16:44 256632 ----a-w- c:\windows\system32\drivers\SbFw.sys
2012-05-14 15:56 . 2011-12-19 17:21 45936 ----a-w- c:\windows\system32\sbbd.exe
2012-05-14 15:56 . 2012-05-14 17:08 -------- d-----w- c:\program files (x86)\Ad-Aware Antivirus
2012-05-14 15:55 . 2012-05-14 15:55 -------- d-----w- c:\program files (x86)\adawaretb
2012-05-14 15:45 . 2012-05-28 00:47 -------- d-----w- c:\users\mike\AppData\Roaming\Ad-Aware Antivirus
2012-05-12 08:06 . 2012-04-13 08:46 8917360 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{91499680-BDEF-4E5C-9C45-2461C4478F96}\mpengine.dll
2012-05-11 18:58 . 2012-03-03 06:35 1544704 ----a-w- c:\windows\system32\DWrite.dll
2012-05-11 18:58 . 2012-03-03 05:31 1077248 ----a-w- c:\windows\SysWow64\DWrite.dll
2012-05-11 18:57 . 2012-03-31 06:05 5559664 ----a-w- c:\windows\system32\ntoskrnl.exe
2012-05-11 18:57 . 2012-03-31 03:10 3146240 ----a-w- c:\windows\system32\win32k.sys
2012-05-11 18:57 . 2012-03-31 04:39 3968368 ----a-w- c:\windows\SysWow64\ntkrnlpa.exe
2012-05-11 18:57 . 2012-03-31 04:39 3913072 ----a-w- c:\windows\SysWow64\ntoskrnl.exe
2012-05-11 18:56 . 2012-03-17 07:58 75120 ----a-w- c:\windows\system32\drivers\partmgr.sys
2012-05-11 18:56 . 2012-03-30 11:35 1918320 ----a-w- c:\windows\system32\drivers\tcpip.sys
2012-05-11 18:55 . 2012-03-31 05:42 1732096 ----a-w- c:\program files\Windows Journal\NBDoc.DLL
2012-05-11 18:55 . 2012-03-31 05:40 1367552 ----a-w- c:\program files\Common Files\Microsoft Shared\ink\journal.dll
2012-05-11 18:55 . 2012-03-31 04:29 936960 ----a-w- c:\program files (x86)\Common Files\Microsoft Shared\ink\journal.dll
2012-05-11 18:55 . 2012-03-31 05:40 1402880 ----a-w- c:\program files\Windows Journal\JNWDRV.dll
2012-05-11 18:55 . 2012-03-31 05:40 1393664 ----a-w- c:\program files\Windows Journal\JNTFiltr.dll
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-05-09 02:13 . 2012-04-04 13:28 419488 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe
2012-05-09 02:13 . 2011-12-11 04:01 70304 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2012-05-09 02:13 . 2012-04-19 16:13 8744608 ----a-w- c:\windows\SysWow64\FlashPlayerInstaller.exe
2012-04-14 06:51 . 2012-04-14 06:51 608 --sha-w- c:\windows\system32\winzvprt5.sys
2012-03-24 02:34 . 2012-04-14 06:27 24576 ----a-w- c:\windows\system32\img_localmon.dll
2012-03-24 02:34 . 2012-04-14 06:27 15872 ----a-w- c:\windows\system32\img_localui.dll
2012-03-10 19:23 . 2012-03-10 19:23 86528 ----a-w- c:\windows\bnetunin.exe
2012-03-08 22:50 . 2012-03-08 22:50 49016 ----a-w- c:\windows\SysWow64\sirenacm.dll
2012-03-08 22:37 . 2012-03-08 22:37 302448 ----a-w- c:\windows\WLXPGSS.SCR
2012-03-06 23:15 . 2011-12-11 01:14 41184 ----a-w- c:\windows\avastSS.scr
2012-03-06 23:15 . 2011-12-11 01:14 201352 ----a-w- c:\windows\SysWow64\aswBoot.exe
2012-03-06 23:15 . 2011-12-11 00:13 258520 ----a-w- c:\windows\system32\aswBoot.exe
2012-03-06 23:04 . 2011-12-11 01:14 819032 ----a-w- c:\windows\system32\drivers\aswSnx.sys
2012-03-06 23:04 . 2011-12-11 01:14 337240 ----a-w- c:\windows\system32\drivers\aswSP.sys
2012-03-06 23:02 . 2012-02-25 20:20 53080 ----a-w- c:\windows\system32\drivers\aswRdr2.sys
2012-03-06 23:01 . 2011-12-11 01:14 59224 ----a-w- c:\windows\system32\drivers\aswTdi.sys
2012-03-06 23:01 . 2011-12-11 01:14 69976 ----a-w- c:\windows\system32\drivers\aswMonFlt.sys
2012-03-06 23:01 . 2011-12-11 01:14 24408 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys
2012-03-01 06:46 . 2012-04-12 00:28 23408 ----a-w- c:\windows\system32\drivers\fs_rec.sys
2012-03-01 06:38 . 2012-04-12 00:28 220672 ----a-w- c:\windows\system32\wintrust.dll
2012-03-01 06:33 . 2012-04-12 00:28 81408 ----a-w- c:\windows\system32\imagehlp.dll
2012-03-01 06:28 . 2012-04-12 00:28 5120 ----a-w- c:\windows\system32\wmi.dll
2012-03-01 05:37 . 2012-04-12 00:28 172544 ----a-w- c:\windows\SysWow64\wintrust.dll
2012-03-01 05:33 . 2012-04-12 00:28 159232 ----a-w- c:\windows\SysWow64\imagehlp.dll
2012-03-01 05:29 . 2012-04-12 00:28 5120 ----a-w- c:\windows\SysWow64\wmi.dll
2012-02-29 19:26 . 2012-02-29 19:26 42392 ----a-w- c:\windows\SysWow64\xfcodec.dll
2012-02-29 19:26 . 2012-02-29 19:26 28056 ----a-w- c:\windows\system32\xfcodec64.dll
2012-02-28 06:39 . 2012-04-11 15:21 1188864 ----a-w- c:\windows\system32\wininet.dll
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{5e5ab302-7f65-44cd-8211-c1d4caaccea3} "= "c:\program files (x86)\XfireXO\prxtbXfir.dll" [2011-05-09 176936]
.
[HKEY_CLASSES_ROOT\clsid\{5e5ab302-7f65-44cd-8211-c1d4caaccea3}]
.
[HKEY_LOCAL_MACHINE\Wow6432Node\~\Browser Helper Objects\{5e5ab302-7f65-44cd-8211-c1d4caaccea3}]
2011-05-09 08:49 176936 ----a-w- c:\program files (x86)\XfireXO\prxtbXfir.dll
.
[HKEY_LOCAL_MACHINE\Wow6432Node\~\Browser Helper Objects\{6c97a91e-4524-4019-86af-2aa2d567bf5c}]
2012-04-11 20:08 87440 ----a-w- c:\program files (x86)\adawaretb\adawareDx.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar]
"{5e5ab302-7f65-44cd-8211-c1d4caaccea3} "= "c:\program files (x86)\XfireXO\prxtbXfir.dll" [2011-05-09 176936]
"{6c97a91e-4524-4019-86af-2aa2d567bf5c} "= "c:\program files (x86)\adawaretb\adawareDx.dll" [2012-04-11 87440]
.
[HKEY_CLASSES_ROOT\clsid\{5e5ab302-7f65-44cd-8211-c1d4caaccea3}]
.
[HKEY_CLASSES_ROOT\clsid\{6c97a91e-4524-4019-86af-2aa2d567bf5c}]
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SpybotSD TeaTimer "= "d:\spybot - search & destroy\TeaTimer.exe" [2009-03-05 2260480]
"Akamai NetSession Interface "= "c:\users\mike\AppData\Local\Akamai\netsession_win.exe" [2012-05-08 3331872]
"tinySpell "= "d:\tinyspell\tinyspell.exe" [2012-04-05 286208]
"Skype "= "c:\program files (x86)\Skype\Phone\Skype.exe" [2012-02-29 17148552]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"Ad-Aware Antivirus "= "c:\program files (x86)\Ad-Aware Antivirus\AdAwareLauncher --windows-run" [X]
"VirtualCloneDrive "= "d:\virtualclonedrive\VCDDaemon.exe" [2011-03-07 89456]
"Hotkey Utility "= "c:\program files (x86)\Acer\Hotkey Utility\HotkeyUtility.exe" [2011-01-19 620136]
"avast "= "d:\avast software\Avast\avastUI.exe" [2012-03-06 4241512]
"BISA.exe "= "c:\program files (x86)\Bell\Internet Service Advisor\BISA.exe" [2011-01-06 4318520]
"SunJavaUpdateSched "= "c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2012-01-18 254696]
"Adobe ARM "= "c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-01-03 843712]
"TkBellExe "= "c:\program files (x86)\Real\RealPlayer\update\realsched.exe" [2012-01-09 296056]
"Ad-Aware Browsing Protection "= "c:\programdata\Ad-Aware Browsing Protection\adawarebp.exe" [2012-05-09 201112]
"Malwarebytes' Anti-Malware "= "d:\malwarebytes' anti-malware\mbamgui.exe" [2012-04-04 462408]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"adaware "= "reg.exe delete HKCU\Software\AppDataLow\Software\adaware" [X]
"adaware_XP "= "reg.exe delete HKCU\Software\adaware" [X]
"IsMyWinLockerReboot "= "msiexec.exe" [2010-11-21 73216]
.
c:\users\mike\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
DynDNS.lnk - d:\dyndns updater\DynDNS.exe [2011-12-10 1352704]
MagicDisc.lnk - d:\magicdisc\MagicDisc.exe [2011-12-12 576000]
Set Alarm Clock.lnk - d:\time tools\Set Alarm Clock\Set Alarm Clock.exe [2011-12-10 928768]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
PhraseExpress.lnk - d:\phraseexpress\phraseexpress.exe [2011-12-10 7345736]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin "= 5 (0x5)
"ConsentPromptBehaviorUser "= 3 (0x3)
"EnableUIADesktopToggle "= 0 (0x0)
.
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoThumbnailCache "= 1 (0x1)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]
"aux9 "=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Security Packages REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Ad-Aware Service]
@= "Ad-Aware Service "
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]
@=" "
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\SBAMSvc]
@= "Service "
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\ServicepointService]
@= "Service "
.
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R2 gupdate;Google Update Service (gupdate);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-02-26 136176]
R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe [2012-02-29 158856]
R3 1394hub;1394 Enabled Hub;c:\windows\System32\svchost.exe [2009-07-14 27136]
R3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-05-09 257696]
R3 dump_wmimmc;dump_wmimmc;e:\rappelz\GameGuard\dump_wmimmc.sys [x]
R3 gupdatem;Google Update Service (gupdatem);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-02-26 136176]
R3 MozillaMaintenance;Mozilla Maintenance Service;c:\program files (x86)\Mozilla Maintenance Service\maintenanceservice.exe [2012-04-27 129976]
R3 OverwolfUpdaterService;Overwolf Updater Service;c:\program files (x86)\Overwolf\\OverwolfUpdater.exe [2012-03-07 18360]
R3 SBFWIMCL;GFI Software Firewall NDIS IM Filter Service;c:\windows\system32\DRIVERS\sbfwim.sys [x]
R3 sbhips;sbhips;c:\windows\system32\drivers\sbhips.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [x]
R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys [x]
R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [x]
R4 EgisTec Ticket Service;EgisTec Ticket Service;c:\program files (x86)\Common Files\EgisTec\Services\EgisTicketService.exe [2010-09-28 172912]
R4 GamesAppService;GamesAppService;c:\program files (x86)\WildTangent Games\App\GamesAppService.exe [2010-10-12 206072]
R4 NAUpdate;Nero Update;c:\program files (x86)\Nero\Update\NASvc.exe [2010-05-04 503080]
R4 NOBU;Norton Online Backup;c:\program files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe SERVICE [x]
R4 RealNetworks Downloader Resolver Service;RealNetworks Downloader Resolver Service;c:\program files (x86)\RealNetworks\RealDownloader\rndlresolversvc.exe [2011-12-02 31408]
R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe [2010-09-23 57184]
S1 aswSnx;aswSnx; [x]
S1 aswSP;aswSP; [x]
S1 mwlPSDFilter;mwlPSDFilter;c:\windows\system32\DRIVERS\mwlPSDFilter.sys [x]
S1 mwlPSDNServ;mwlPSDNServ;c:\windows\system32\DRIVERS\mwlPSDNServ.sys [x]
S1 mwlPSDVDisk;mwlPSDVDisk;c:\windows\system32\DRIVERS\mwlPSDVDisk.sys [x]
S1 SbFw;SbFw;c:\windows\system32\drivers\SbFw.sys [x]
S1 SBRE;SBRE;c:\windows\system32\drivers\SBREdrv.sys [2011-10-26 57976]
S2 Ad-Aware Service;Ad-Aware Service;c:\program files (x86)\Ad-Aware Antivirus\AdAwareService.exe [2012-05-03 1226096]
S2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2012-01-03 63928]
S2 Akamai;Akamai NetSession Interface;c:\windows\System32\svchost.exe [2009-07-14 27136]
S2 aswFsBlk;aswFsBlk; [x]
S2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys [x]
S2 GREGService;GREGService;c:\program files (x86)\Acer\Registration\GREGsvc.exe [2010-01-08 23584]
S2 Live Updater Service;Live Updater Service;c:\program files\Acer\Acer Updater\UpdaterService.exe [2011-01-31 244624]
S2 MBAMService;MBAMService;d:\malwarebytes' anti-malware\mbamservice.exe [2012-04-04 654408]
S2 McciCMService64;McciCMService64;c:\program files\Common Files\Motive\McciCMService.exe [2010-01-27 517632]
S2 regi;regi;c:\windows\system32\drivers\regi.sys [x]
S2 SBAMSvc;Ad-Aware;c:\program files (x86)\Ad-Aware Antivirus\SBAMSvc.exe [2011-12-19 3289032]
S2 sbapifs;sbapifs;c:\windows\system32\DRIVERS\sbapifs.sys [x]
S2 SBSDWSCService;SBSD Security Center Service;d:\spybot - search & destroy\SDWinSec.exe [2009-01-26 1153368]
S2 ServicepointService;ServicepointService;c:\program files (x86)\Bell\Internet Service Advisor\ServicepointService.exe [2011-01-06 689464]
S2 SSPORT;SSPORT;c:\windows\system32\Drivers\SSPORT.sys [x]
S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [x]
S3 MSHUSBVideo;NX6000/NX3000/VX2000/VX5000/VX5500/VX7000/Cinema Filter Driver;c:\windows\system32\Drivers\nx6000.sys [x]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [x]
S3 SBFWIMCLMP;GFI Software Firewall NDIS IM Filter Miniport;c:\windows\system32\DRIVERS\SBFWIM.sys [x]
S3 sbwtis;sbwtis;c:\windows\system32\DRIVERS\sbwtis.sys [x]
.
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\svchost]
Akamai REG_MULTI_SZ Akamai
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{2D46B6DC-2207-486B-B523-A557E6D54B47}]
2010-11-21 03:24 302592 ----a-w- c:\windows\System32\cmd.exe
.
Contents of the 'Scheduled Tasks' folder
.
2012-05-28 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-04 02:13]
.
2011-12-11 c:\windows\Tasks\EasyShare Registration RunOnce Task.job
- c:\windows\system32\rundll32.exe [2009-07-13 01:14]
.
2011-12-11 c:\windows\Tasks\EasyShare Registration Task.job
- c:\windows\system32\rundll32.exe [2009-07-13 01:14]
.
2012-04-09 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-02-26 04:22]
.
2012-04-09 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-02-26 04:22]
.
.
--------- x86-64 -----------
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]
@= "{472083B0-C522-11CF-8763-00608CC02F24} "
[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]
2012-03-06 23:15 135408 ----a-w- d:\avast software\Avast\ashShA64.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RtHDVCpl "= "c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2010-02-09 10060320]
"lxczbmgr.exe "= "c:\program files (x86)\Lexmark 1200 Series\lxczbmgr.exe" [2009-04-27 74408]
"IgfxTray "= "c:\windows\system32\igfxtray.exe" [2011-10-13 162584]
"HotKeysCmds "= "c:\windows\system32\hkcmd.exe" [2011-10-13 386840]
"Persistence "= "c:\windows\system32\igfxpers.exe" [2011-10-13 417560]
"BellCanada_McciTrayApp "= "c:\program files\BellCanada\McciTrayApp.exe" [2010-01-19 3432448]
"CDAServer "= "c:\program files\Common Files\Common Desktop Agent\CDASrv.exe" [2010-12-17 438784]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"LoadAppInit_DLLs "=0x0
.
------- Supplementary Scan -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = about:blank
mStart Page = hxxp://acer.msn.com
mLocal Page = c:\windows\SysWOW64\blank.htm
uInternet Settings,ProxyOverride = <local>
IE: Download with &Media Finder - c:\program files (x86)\Media Finder\hook.html
Trusted Zone: clonewarsadventures.com
Trusted Zone: freerealms.com
Trusted Zone: samsungsetup.com\www
Trusted Zone: soe.com
Trusted Zone: sony.com
TCP: Interfaces\{83D6996F-51DC-48F5-9043-B743536D8B8A}: NameServer = 8.8.8.8,8.8.4.4
FF - ProfilePath - c:\users\mike\AppData\Roaming\Mozilla\Firefox\Profiles\1t1n6t9q.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://www.google.ca/
FF - prefs.js: keyword.URL - hxxp://search.babylon.com/?AF=100490&babsrc=adbartrp&mntrId=c49c11c6000000000000c89cdc2923d8&q=
FF - user.js: extensions.BabylonToolbar_i.id - c49c11c6000000000000c89cdc2923d8
FF - user.js: extensions.BabylonToolbar_i.hardId - c49c11c6000000000000c89cdc2923d8
FF - user.js: extensions.BabylonToolbar_i.instlDay - 15392
FF - user.js: extensions.BabylonToolbar_i.vrsn - 1.5.3.17
FF - user.js: extensions.BabylonToolbar_i.vrsni - 1.5.3.17
FF - user.js: extensions.BabylonToolbar_i.vrsnTs - 1.5.3.1722:29
FF - user.js: extensions.BabylonToolbar_i.prtnrId - babylon
FF - user.js: extensions.BabylonToolbar_i.prdct - BabylonToolbar
FF - user.js: extensions.BabylonToolbar_i.aflt - babsst
FF - user.js: extensions.BabylonToolbar_i.smplGrp - none
FF - user.js: extensions.BabylonToolbar_i.tlbrId - base
FF - user.js: extensions.BabylonToolbar_i.newTab - false
FF - user.js: extensions.BabylonToolbar_i.babTrack - affID=110482
FF - user.js: extensions.BabylonToolbar_i.babExt -
FF - user.js: extensions.BabylonToolbar_i.srcExt - ss
FF - user.js: extensions.BabylonToolbar_i.instlRef - sst
.
- - - - ORPHANS REMOVED - - - -
.
Toolbar-Locked - (no file)
Wow6432Node-HKLM-Run-Wondershare Helper Compact.exe - c:\program files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe
Wow6432Node-HKLM-Run-Aimersoft Helper Compact.exe - c:\program files (x86)\Common Files\Aimersoft\Aimersoft Helper Compact\ASHelper.exe
Toolbar-Locked - (no file)
WebBrowser-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file)
WebBrowser-{5E5AB302-7F65-44CD-8211-C1D4CAACCEA3} - (no file)
AddRemove-Adobe Shockwave Player - c:\windows\system32\Adobe\Shockwave 11\uninstaller.exe
AddRemove-Diablo - c:\windows\diabunin.exe
.
.
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\services\Akamai]
"ServiceDll "= "c:\program files (x86)\common files\akamai/netsession_win_6c825ce.dll "
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\services\npggsvc]
"ImagePath "= "c:\windows\system32\GameMon.des -service "
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\UserChoice]
@Denied: (2) (LocalSystem)
"Progid "= "ChromeHTML "
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\UserChoice]
@Denied: (2) (LocalSystem)
"Progid "= "ChromeHTML "
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\UserChoice]
@Denied: (2) (LocalSystem)
"Progid "= "ChromeHTML "
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\UserChoice]
@Denied: (2) (LocalSystem)
"Progid "= "ChromeHTML "
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\UserChoice]
@Denied: (2) (LocalSystem)
"Progid "= "ChromeHTML "
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@= "FlashBroker "
"LocalizedString "= "@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_2_202_235_ActiveX.exe,-101 "
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled "=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@= "c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_2_202_235_ActiveX.exe "
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@= "{FAB3E735-69C7-453B-A446-B6823C6DF1C9} "
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@= "Shockwave Flash Object "
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@= "c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_2_202_235.ocx "
"ThreadingModel "= "Apartment "
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@= "0 "
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@= "ShockwaveFlash.ShockwaveFlash.11 "
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@= "c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_2_202_235.ocx, 1 "
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@= "{D27CDB6B-AE6D-11cf-96B8-444553540000} "
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@= "1.0 "
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@= "ShockwaveFlash.ShockwaveFlash "
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@= "Macromedia Flash Factory Object "
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@= "c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_2_202_235.ocx "
"ThreadingModel "= "Apartment "
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@= "FlashFactory.FlashFactory.1 "
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@= "c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_2_202_235.ocx, 1 "
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@= "{D27CDB6B-AE6D-11cf-96B8-444553540000} "
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@= "1.0 "
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@= "FlashFactory.FlashFactory "
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@= "IFlashBroker4 "
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@= "{00020424-0000-0000-C000-000000000046} "
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@= "{FAB3E735-69C7-453B-A446-B6823C6DF1C9} "
"Version "= "1.0 "
.
[HKEY_LOCAL_MACHINE\software\McAfee]
"SymbolicLinkValue "=hex(6):5c,00,72,00,65,00,67,00,69,00,73,00,74,00,72,00,79,
00,5c,00,6d,00,61,00,63,00,68,00,69,00,6e,00,65,00,5c,00,53,00,6f,00,66,00,\
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
------------------------ Other Running Processes ------------------------
.
d:\avast software\Avast\AvastSvc.exe
c:\program files (x86)\Common Files\Motive\McciCMService.exe
c:\windows\SysWOW64\PnkBstrA.exe
c:\program files (x86)\Acer\clear.fi\MVP\clear.fiAgent.exe
.
**************************************************************************
.
Completion time: 2012-05-28 02:24:46 - machine was rebooted
ComboFix-quarantined-files.txt 2012-05-28 06:24
.
Pre-Run: 394,139,029,504 bytes free
Post-Run: 395,284,475,904 bytes free
.
- - End Of File - - 7C3356D57FB6DF71D765179D115578BA