Solved Fynloski.A infection

[Resolved] Fynloski.A infection

I have been unable to remove this problem on my own. Any help would be great.

I have run Virus Scans of Bit Defender and MSE and neither of them worked.
Malwarebytes Anti-Malware 1.62.0.1300
www.malwarebytes.org

Database version: v2012.07.18.11

Windows 7 Service Pack 1 x64 NTFS (Safe Mode/Networking)
Internet Explorer 9.0.8112.16421
AdmSirRed :: ADMSIRRED-PC [administrator]

7/18/2012 3:54:38 PM
mbam-log-2012-07-18 (15-54-38).txt

Scan type: Quick scan
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
Scan options disabled: P2P
Objects scanned: 202665
Time elapsed: 25 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 0
(No malicious items detected)

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 0
(No malicious items detected)

Files Detected: 12
C:\Windows\Temp\tmp00007222\tmp000f156c (Backdoor.MSIL.P) -> Quarantined and deleted successfully.
C:\Windows\Temp\tmp00007222\tmp000f1570 (Backdoor.MSIL.P) -> Quarantined and deleted successfully.
C:\Windows\Temp\tmp00007222\tmp000f1574 (Backdoor.MSIL.P) -> Quarantined and deleted successfully.
C:\Windows\Temp\tmp00007222\tmp000f157a (Backdoor.MSIL.P) -> Quarantined and deleted successfully.
C:\Windows\Temp\tmp00007222\tmp000f157c (Backdoor.MSIL.P) -> Quarantined and deleted successfully.
C:\Windows\Temp\tmp00007222\tmp000f1592 (Backdoor.MSIL.P) -> Quarantined and deleted successfully.
C:\Windows\Temp\tmp00007222\tmp000f1595 (Backdoor.MSIL.P) -> Quarantined and deleted successfully.
C:\Windows\Temp\tmp00007222\tmp000f1596 (Backdoor.MSIL.P) -> Quarantined and deleted successfully.
C:\Windows\Temp\tmp00007222\tmp000f1598 (Backdoor.MSIL.P) -> Quarantined and deleted successfully.
C:\Windows\Temp\tmp00007222\tmp000f159c (Backdoor.MSIL.P) -> Quarantined and deleted successfully.
C:\Windows\Temp\tmp00007222\tmp000f15a2 (Backdoor.MSIL.P) -> Quarantined and deleted successfully.
C:\Windows\Temp\tmp00007222\tmp000f15a4 (Backdoor.MSIL.P) -> Quarantined and deleted successfully.

(end)

GMER 1.0.15.15641 - http://www.gmer.net
Rootkit scan 2012-07-18 16:04:46
Windows 6.1.7601 Service Pack 1
Running: xgrl7ikm.exe


---- Files - GMER 1.0.15 ----

File C:\Windows\Temp\~bdB502.tmp 0 bytes

---- EOF - GMER 1.0.15 ----




aswMBR version 0.9.9.1665 Copyright(c) 2011 AVAST Software
Run date: 2012-07-18 16:06:06
-----------------------------
16:06:06.371 OS Version: Windows x64 6.1.7601 Service Pack 1
16:06:06.371 Number of processors: 4 586 0x3A09
16:06:06.371 ComputerName: ADMSIRRED-PC UserName: AdmSirRed
16:06:06.532 Initialize success
16:06:21.544 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP3T0L0-3
16:06:21.545 Disk 0 Vendor: M4-CT128M4SSD2 0309 Size: 122104MB BusType: 11
16:06:21.547 Disk 0 MBR read successfully
16:06:21.548 Disk 0 MBR scan
16:06:21.549 Disk 0 Windows 7 default MBR code
16:06:21.550 Disk 0 Partition 1 80 (A) 07 HPFS/NTFS NTFS 100 MB offset 2048
16:06:21.551 Disk 0 Partition 2 00 07 HPFS/NTFS NTFS 122002 MB offset 206848
16:06:21.554 Disk 0 scanning C:\Windows\system32\drivers
16:06:22.754 Service scanning
16:06:24.862 Modules scanning
16:06:24.870 Disk 0 trace - called modules:
16:06:24.875 ntoskrnl.exe CLASSPNP.SYS disk.sys ataport.SYS PCIIDEX.SYS hal.dll asahci64.sys
16:06:24.879 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0xfffffa800d00c790]
16:06:24.883 3 CLASSPNP.SYS[fffff880021bf43f] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP3T0L0-3[0xfffffa800d020680]
16:06:25.208 Scan finished successfully
16:06:32.444 Disk 0 MBR has been saved successfully to "C:\Users\AdmSirRed\Documents\MBR.dat "
16:06:32.448 The log file has been saved successfully to "C:\Users\AdmSirRed\Documents\aswMBR.txt "





.
DDS (Ver_2011-08-26.01) - NTFSAMD64
Internet Explorer: 9.0.8112.16421
Run by AdmSirRed at 16:07:24 on 2012-07-18
Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.16339.14078 [GMT -6:00]
.
AV: Bitdefender Antivirus *Enabled/Updated* {50909708-FF80-02AF-F814-B28405891E92}
AV: Microsoft Security Essentials *Enabled/Updated* {9765EA51-0D3C-7DFB-6091-10E4E1F341F6}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
SP: Microsoft Security Essentials *Enabled/Updated* {2C040BB5-2B06-7275-5A21-2B969A740B4B}
SP: Bitdefender Antispyware *Enabled/Updated* {EBF176EC-D9BA-0D21-C2A4-89F67E0E542F}
FW: Bitdefender Firewall *Enabled* {68AB162D-B5EF-03F7-D34B-1BB1FB5A59E9}
.
============== Running Processes ===============
.
C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Program Files\Bitdefender\Bitdefender 2012\vsserv.exe
C:\Windows\system32\nvvsvc.exe
C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
C:\Windows\system32\svchost.exe -k RPCSS
c:\Program Files\Microsoft Security Client\MsMpEng.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k LocalService
C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
C:\Windows\system32\nvvsvc.exe
C:\Windows\system32\WUDFHost.exe
C:\Windows\system32\WUDFHost.exe
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
C:\Windows\system32\taskhost.exe
C:\Windows\system32\Dwm.exe
C:\Program Files\Bitdefender\Bitdefender 2012\bdagent.exe
C:\Windows\Explorer.EXE
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Intel\iCLS Client\HeciServer.exe
C:\Windows\system32\IProsetMonitor.exe
C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe
C:\Program Files\Bitdefender\Bitdefender 2012\updatesrv.exe
C:\Program Files (x86)\WinZip System Utilities Suite\WINZIPSSDefragSrv64.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe
C:\Program Files\Microsoft Security Client\msseces.exe
C:\Program Files\Logitech\GamePanel Software\LGDevAgt.exe
C:\Program Files\Logitech\GamePanel Software\LCD Manager\lcdmon.exe
C:\Program Files\Logitech\GamePanel Software\G-series Software\LGDCore.exe
C:\Program Files (x86)\Skype\Phone\Skype.exe
C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe
C:\Program Files (x86)\McAfee Security Scan\3.0.207\SSScheduler.exe
C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
C:\Program Files (x86)\iTunes\iTunesHelper.exe
C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
C:\Program Files\Bitdefender\Bitdefender 2012\antispam32\bdimguiaux.exe
C:\Program Files\Logitech\GamePanel Software\Applets\LCDCountdown.exe
C:\Program Files\Logitech\GamePanel Software\Applets\LCDClock.exe
C:\Program Files\Logitech\GamePanel Software\Applets\LCDPop3.exe
C:\Program Files\Logitech\GamePanel Software\Applets\LCDRSS.exe
C:\Program Files\Logitech\GamePanel Software\Applets\LCDMedia.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
C:\Program Files\iPod\bin\iPodService.exe
C:\Windows\system32\SearchIndexer.exe
C:\Program Files\Windows Media Player\WMPSideShowGadget.exe
C:\Program Files (x86)\Windows Media Player\wmplayer.exe
C:\Program Files (x86)\Mozilla Firefox\firefox.exe
C:\Windows\system32\taskhost.exe
C:\Program Files\Bitdefender\Bitdefender 2012\seccenter.exe
C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
C:\Windows\servicing\TrustedInstaller.exe
C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\conhost.exe
C:\Windows\SysWOW64\cscript.exe
C:\Windows\system32\wbem\wmiprvse.exe
.
============== Pseudo HJT Report ===============
.
uStart Page = about:blank
mStart Page = about:blank
uInternet Settings,ProxyOverride = *.local
BHO: Windows Live ID Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
TB: {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No File
uRun: [Skype] "C:\Program Files (x86)\Skype\Phone\Skype.exe" /minimized /regrun
uRun: [msnmsgr] "C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe" /background
mRun: [IAStorIcon] C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
mRun: [APSDaemon] "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe "
mRun: [iTunesHelper] "C:\Program Files (x86)\iTunes\iTunesHelper.exe "
StartupFolder: C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\Startup\MCAFEE~1.LNK - C:\Program Files (x86)\McAfee Security Scan\3.0.207\SSScheduler.exe
mPolicies-explorer: NoActiveDesktop = 1 (0x1)
mPolicies-explorer: NoActiveDesktopChanges = 1 (0x1)
mPolicies-system: ConsentPromptBehaviorAdmin = 5 (0x5)
mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3)
mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
IE: Google Sidewiki... - C:\Program Files (x86)\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_6CE5017F567343CA.dll/cmsidewiki.html
TCP: DhcpNameServer = 192.168.2.1
TCP: Interfaces\{843E1C77-AFD7-4674-A370-ABABECDFF4F3} : NameServer = 8.8.8.8,8.8.4.4
TCP: Interfaces\{843E1C77-AFD7-4674-A370-ABABECDFF4F3} : DhcpNameServer = 192.168.2.1
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL
BHO-X64: Windows Live ID Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
TB-X64: {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No File
mRun-x64: [IAStorIcon] C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
mRun-x64: [APSDaemon] "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe "
mRun-x64: [iTunesHelper] "C:\Program Files (x86)\iTunes\iTunesHelper.exe "
.
================= FIREFOX ===================
.
FF - ProfilePath - C:\Users\AdmSirRed\AppData\Roaming\Mozilla\Firefox\Profiles\kljwythy.default\
FF - plugin: C:\Program Files (x86)\Google\Update\1.3.21.115\npGoogleUpdate3.dll
FF - plugin: C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll
FF - plugin: C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll
FF - plugin: C:\Program Files (x86)\Microsoft Silverlight\4.1.10329.0\npctrlui.dll
FF - plugin: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll
FF - plugin: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll
FF - plugin: C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll
FF - plugin: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_3_300_265.dll
.
============= SERVICES / DRIVERS ===============
.
R0 asahci64;asahci64;C:\Windows\system32\DRIVERS\asahci64.sys --> C:\Windows\system32\DRIVERS\asahci64.sys [?]
R0 avc3;avc3;C:\Windows\system32\DRIVERS\avc3.sys --> C:\Windows\system32\DRIVERS\avc3.sys [?]
R0 iusb3hcs;Intel(R) USB 3.0 Host Controller Switch Driver;C:\Windows\system32\DRIVERS\iusb3hcs.sys --> C:\Windows\system32\DRIVERS\iusb3hcs.sys [?]
R0 MpFilter;Microsoft Malware Protection Driver;C:\Windows\system32\DRIVERS\MpFilter.sys --> C:\Windows\system32\DRIVERS\MpFilter.sys [?]
R1 BdfNdisf;BitDefender Firewall NDIS 6 Filter Driver;C:\Program Files\Common Files\Bitdefender\Bitdefender Firewall\bdfndisf6.sys [2011-11-14 90192]
R1 bdfwfpf;bdfwfpf;C:\Program Files\Common Files\Bitdefender\Bitdefender Firewall\bdfwfpf.sys [2011-11-14 103504]
R1 BDVEDISK;BDVEDISK;C:\Windows\system32\DRIVERS\bdvedisk.sys --> C:\Windows\system32\DRIVERS\bdvedisk.sys [?]
R2 IAStorDataMgrSvc;Intel(R) Rapid Storage Technology;C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [2012-6-2 13592]
R2 Intel(R) Capability Licensing Service Interface;Intel(R) Capability Licensing Service Interface;C:\Program Files\Intel\iCLS Client\HeciServer.exe [2012-1-10 627936]
R2 Intel(R) PROSet Monitoring Service;Intel(R) PROSet Monitoring Service;C:\Windows\system32\IProsetMonitor.exe --> C:\Windows\system32\IProsetMonitor.exe [?]
R2 jhi_service;Intel(R) Dynamic Application Loader Host Interface Service;C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\Jhi_service.exe [2012-6-2 161560]
R2 nvUpdatusService;NVIDIA Update Service Daemon;C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe [2012-6-2 1262400]
R2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [2012-5-15 382272]
R2 UNS;Intel(R) Management and Security Application User Notification Service;C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [2012-6-2 363800]
R2 UPDATESRV;BitDefender Desktop Update Service;C:\Program Files\Bitdefender\Bitdefender 2012\updatesrv.exe [2012-3-13 66096]
R2 WINZIPSSDiskOptimizer;WINZIPSSDiskOptimizer;C:\Program Files (x86)\WinZip System Utilities Suite\WINZIPSSDefragSrv64.exe [2012-6-6 628040]
R3 asmthub3;ASMedia USB3 Hub Service;C:\Windows\system32\DRIVERS\asmthub3.sys --> C:\Windows\system32\DRIVERS\asmthub3.sys [?]
R3 asmtxhci;ASMEDIA XHCI Service;C:\Windows\system32\DRIVERS\asmtxhci.sys --> C:\Windows\system32\DRIVERS\asmtxhci.sys [?]
R3 avchv;avchv Function Driver;C:\Windows\system32\DRIVERS\avchv.sys --> C:\Windows\system32\DRIVERS\avchv.sys [?]
R3 avckf;avckf;C:\Windows\system32\DRIVERS\avckf.sys --> C:\Windows\system32\DRIVERS\avckf.sys [?]
R3 e1cexpress;Intel(R) PRO/1000 PCI Express Network Connection Driver C;C:\Windows\system32\DRIVERS\e1c62x64.sys --> C:\Windows\system32\DRIVERS\e1c62x64.sys [?]
R3 iusb3hub;Intel(R) USB 3.0 Hub Driver;C:\Windows\system32\DRIVERS\iusb3hub.sys --> C:\Windows\system32\DRIVERS\iusb3hub.sys [?]
R3 iusb3xhc;Intel(R) USB 3.0 eXtensible Host Controller Driver;C:\Windows\system32\DRIVERS\iusb3xhc.sys --> C:\Windows\system32\DRIVERS\iusb3xhc.sys [?]
R3 LGBusEnum;Logitech GamePanel Virtual Bus Enumerator Driver;C:\Windows\system32\drivers\LGBusEnum.sys --> C:\Windows\system32\drivers\LGBusEnum.sys [?]
R3 LGVirHid;Logitech Gamepanel Virtual HID Device Driver;C:\Windows\system32\drivers\LGVirHid.sys --> C:\Windows\system32\drivers\LGVirHid.sys [?]
R3 MEIx64;Intel(R) Management Engine Interface ;C:\Windows\system32\DRIVERS\HECIx64.sys --> C:\Windows\system32\DRIVERS\HECIx64.sys [?]
R3 NVHDA;Service for NVIDIA High Definition Audio Driver;C:\Windows\system32\drivers\nvhda64v.sys --> C:\Windows\system32\drivers\nvhda64v.sys [?]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]
S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-3-18 138576]
S2 gupdate;Google Update Service (gupdate);C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2012-6-2 136176]
S2 Norton PC Checkup Application Launcher;Norton PC Checkup Application Launcher;C:\Program Files (x86)\Norton PC Checkup\Engine\2.0.15.96\SymcPCCULaunchSvc.exe /s --> C:\Program Files (x86)\Norton PC Checkup\Engine\2.0.15.96\SymcPCCULaunchSvc.exe [?]
S2 PCCUJobMgr;Common Client Job Manager Service; "C:\Program Files (x86)\Norton PC Checkup\Engine\2.0.15.96\ccSvcHst.exe" /s "PCCUJobMgr" /m "C:\Program Files (x86)\Norton PC Checkup\Engine\2.0.15.96\diMaster.dll" /prefetch:1 --> C:\Program Files (x86)\Norton PC Checkup\Engine\2.0.15.96\ccSvcHst.exe [?]
S2 SkypeUpdate;Skype Updater;C:\Program Files (x86)\Skype\Updater\Updater.exe [2012-5-3 158856]
S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-6-4 250056]
S3 bdsandbox;bdsandbox;\??\C:\Windows\system32\drivers\bdsandbox.sys --> C:\Windows\system32\drivers\bdsandbox.sys [?]
S3 gupdatem;Google Update Service (gupdatem);C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2012-6-2 136176]
S3 McComponentHostService;McAfee Security Scan Component Host Service;C:\Program Files (x86)\McAfee Security Scan\3.0.207\McCHSvc.exe [2011-6-17 237008]
S3 MozillaMaintenance;Mozilla Maintenance Service;C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe [2012-6-2 113120]
S3 NisDrv;Microsoft Network Inspection System;C:\Windows\system32\DRIVERS\NisDrvWFP.sys --> C:\Windows\system32\DRIVERS\NisDrvWFP.sys [?]
S3 NisSrv;Microsoft Network Inspection;C:\Program Files\Microsoft Security Client\NisSrv.exe [2012-3-26 291696]
S3 SafeBox;SafeBox;C:\Program Files\Bitdefender\Bitdefender Safebox\safeboxservice.exe [2012-2-21 75384]
S3 TsUsbFlt;TsUsbFlt;C:\Windows\system32\drivers\tsusbflt.sys --> C:\Windows\system32\drivers\tsusbflt.sys [?]
S3 TsUsbGD;Remote Desktop Generic USB Device;C:\Windows\system32\drivers\TsUsbGD.sys --> C:\Windows\system32\drivers\TsUsbGD.sys [?]
S3 Update Server;BitDefender Update Server v2;C:\Program Files\Common Files\Bitdefender\Bitdefender Arrakis Server\bin\arrakis3.exe [2011-10-15 466736]
S3 WatAdminSvc;Windows Activation Technologies Service;C:\Windows\system32\Wat\WatAdminSvc.exe --> C:\Windows\system32\Wat\WatAdminSvc.exe [?]
.
=============== Created Last 30 ================
.
2012-07-18 22:05:08 9133488 ----a-w- C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{B9F83861-F103-401F-99D5-0AF176031A6F}\mpengine.dll
2012-07-18 21:52:48 -------- d-----w- C:\Users\AdmSirRed\AppData\Roaming\Malwarebytes
2012-07-18 21:46:23 24904 ----a-w- C:\Windows\System32\drivers\mbam.sys
2012-07-18 21:46:23 -------- d-----w- C:\ProgramData\Malwarebytes
2012-07-18 21:45:57 -------- d-----w- C:\Program Files (x86)\Malwarebytes' Anti-Malware
2012-07-18 14:03:40 -------- d-----w- C:\Users\AdmSirRed\AppData\Local\{C77E6CA8-6574-4510-8252-F0C5115B9642}
2012-07-18 14:03:30 -------- d-----w- C:\Users\AdmSirRed\AppData\Local\{D3997366-3698-47C3-B0A8-5FF03E7CE8C5}
2012-07-18 01:29:38 9133488 ----a-w- C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
2012-07-17 14:55:27 -------- d-----w- C:\Users\AdmSirRed\AppData\Local\{7E6918DB-B649-45E1-AAF7-4AA2433216C0}
2012-07-17 02:54:54 -------- d-----w- C:\Users\AdmSirRed\AppData\Local\{528BF5D0-AF54-455E-AB23-884332656ABB}
2012-07-17 02:54:44 -------- d-----w- C:\Users\AdmSirRed\AppData\Local\{ADA689EE-FF5A-442F-B986-D215D9D40D01}
2012-07-17 02:47:18 -------- d-----w- C:\Users\AdmSirRed\AppData\Local\{2B0E71C0-FF6B-450F-90FF-80F1AB0C2BBD}
2012-07-17 02:47:08 -------- d-----w- C:\Users\AdmSirRed\AppData\Local\{DF2E9330-2B2A-47FB-BC30-8556C2243E98}
2012-07-17 01:55:59 -------- d-----w- C:\Users\AdmSirRed\AppData\Local\{EC9E218B-381D-4439-8198-0D0226FFD17A}
2012-07-17 01:55:49 -------- d-----w- C:\Users\AdmSirRed\AppData\Local\{4D8E55F2-8ABE-4100-B9CF-2654162B92C1}
2012-07-15 16:33:56 -------- d-----w- C:\Users\AdmSirRed\AppData\Local\{B612C438-828C-4053-9381-D6D7063A47EC}
2012-07-15 16:33:35 -------- d-----w- C:\Users\AdmSirRed\AppData\Local\{0D4A8492-7783-4492-9FD3-9473E9932966}
2012-07-14 13:32:22 -------- d-----w- C:\Users\AdmSirRed\AppData\Local\{50ADD90C-6BE4-45A5-8EA9-73873D67601A}
2012-07-14 13:32:01 -------- d-----w- C:\Users\AdmSirRed\AppData\Local\{21538009-A62E-4147-A3E2-E6C5F4B795D5}
2012-07-13 13:35:51 -------- d-----w- C:\Users\AdmSirRed\AppData\Local\{B3B45741-ED1F-48BC-ACB6-6F6D421B8C78}
2012-07-13 13:35:31 -------- d-----w- C:\Users\AdmSirRed\AppData\Local\{3538BB2D-5AB5-4882-93D0-5CB200D51606}
2012-07-12 13:31:27 -------- d-----w- C:\Users\AdmSirRed\AppData\Local\{B31D6124-46CA-4717-A1BB-8BCE388470B1}
2012-07-12 13:31:05 -------- d-----w- C:\Users\AdmSirRed\AppData\Local\{7D6BDEA6-0E19-4E95-8FCE-E1F2DF97E143}
2012-07-11 11:22:14 -------- d-----w- C:\Users\AdmSirRed\AppData\Local\{9A2A729B-468F-4B30-960B-3A62686B9710}
2012-07-11 11:21:52 -------- d-----w- C:\Users\AdmSirRed\AppData\Local\{435A9FF2-E052-4A47-BD54-2D49AA63504D}
2012-07-11 09:02:08 3148800 ----a-w- C:\Windows\System32\win32k.sys
2012-07-10 23:57:56 2048 ----a-w- C:\Windows\SysWow64\msxml3r.dll
2012-07-10 23:21:29 -------- d-----w- C:\Users\AdmSirRed\AppData\Local\{66ACA72A-55B5-489B-A744-14CF7D403DB2}
2012-07-10 23:21:08 -------- d-----w- C:\Users\AdmSirRed\AppData\Local\{FBDA3606-025D-4807-BEF6-D4167705EF3D}
2012-07-10 11:20:45 -------- d-----w- C:\Users\AdmSirRed\AppData\Local\{4110D491-4680-48B2-881C-1791594895D6}
2012-07-10 11:20:35 -------- d-----w- C:\Users\AdmSirRed\AppData\Local\{B164E7DE-D59B-4ED0-8218-53F8D7456419}
2012-07-08 16:03:32 -------- d-----w- C:\Users\AdmSirRed\riotsGamesLogs
2012-07-08 01:57:41 -------- d-----w- C:\Users\AdmSirRed\AppData\Local\{8CE48805-1D71-4188-8460-C6C449BFF62C}
2012-07-08 01:57:20 -------- d-----w- C:\Users\AdmSirRed\AppData\Local\{B72CB961-CF76-46DE-ABF6-DC91CA89411D}
2012-07-07 13:34:33 -------- d-----w- C:\Users\AdmSirRed\AppData\Local\{DC97053A-2DF3-469F-B392-2649EF324C67}
2012-07-07 13:34:13 -------- d-----w- C:\Users\AdmSirRed\AppData\Local\{2878F86F-95A5-4A1B-A19A-930EF8AECC1B}
2012-07-06 13:41:58 -------- d-----w- C:\Users\AdmSirRed\AppData\Local\{06F59B4A-D2BD-4A7A-9DF7-E893144D5B0B}
2012-07-06 13:41:37 -------- d-----w- C:\Users\AdmSirRed\AppData\Local\{F0F14B46-3FE2-483D-9B3E-18892710C3BB}
2012-07-03 22:09:35 -------- d-----w- C:\Users\AdmSirRed\AppData\Local\{E2A67940-9805-47CE-9F96-98D7AD99BDD6}
2012-07-03 22:09:14 -------- d-----w- C:\Users\AdmSirRed\AppData\Local\{B4D5B7B4-C4AB-4B71-A9C8-12313CCEC8FF}
2012-07-03 17:44:09 927800 ------w- C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{B43F6C8E-76FB-4222-83F6-5A0029556BD1}\gapaengine.dll
2012-07-03 13:15:10 -------- d-----w- C:\Users\AdmSirRed\AppData\Local\Apple Computer
2012-07-03 13:15:03 34152 ----a-w- C:\Windows\System32\drivers\GEARAspiWDM.sys
2012-07-03 13:15:03 126312 ----a-w- C:\Windows\System32\GEARAspi64.dll
2012-07-03 13:15:03 107368 ----a-w- C:\Windows\SysWow64\GEARAspi.dll
2012-07-03 13:14:50 -------- d-----w- C:\ProgramData\{93E26451-CD9A-43A5-A2FA-C42392EA4001}
2012-07-03 13:14:50 -------- d-----w- C:\Program Files\iTunes
2012-07-03 13:14:50 -------- d-----w- C:\Program Files\iPod
2012-07-03 13:14:50 -------- d-----w- C:\Program Files (x86)\iTunes
2012-07-03 13:14:39 -------- d-----w- C:\Users\AdmSirRed\AppData\Local\Apple
2012-07-03 13:14:28 -------- d-----w- C:\Program Files\Bonjour
2012-07-03 13:14:28 -------- d-----w- C:\Program Files (x86)\Bonjour
2012-07-03 08:10:49 -------- d-----w- C:\Users\AdmSirRed\AppData\Local\{6ABB8931-63C0-4208-AAE0-319D92F35289}
2012-07-03 08:10:30 -------- d-----w- C:\Users\AdmSirRed\AppData\Local\{131D3853-CBBE-42E0-A5BE-06BC2DB432D0}
2012-07-01 13:46:19 -------- d-----w- C:\Users\AdmSirRed\AppData\Roaming\LolClient
2012-06-30 13:41:09 -------- d-----w- C:\Users\AdmSirRed\AppData\Local\{C9B03604-B24B-4839-8058-8E26023CE219}
2012-06-30 13:40:48 -------- d-----w- C:\Users\AdmSirRed\AppData\Local\{0E257B9A-0B79-46A8-BF60-0E17BFA83EE4}
2012-06-30 01:19:07 -------- d-----w- C:\Users\AdmSirRed\AppData\Local\{C3946A79-9137-4227-92AF-8AF806B086CB}
2012-06-30 01:18:46 -------- d-----w- C:\Users\AdmSirRed\AppData\Local\{E28AC9CF-AD87-4278-8155-F3E68F4B36E0}
2012-06-26 17:33:42 -------- d-----w- C:\Users\AdmSirRed\AppData\Local\{37966F44-C344-4567-AFB9-EBDDB9624F5D}
2012-06-26 17:33:32 -------- d-----w- C:\Users\AdmSirRed\AppData\Local\{77308B7C-E0EB-4EB1-8BF7-47615FBF38FB}
2012-06-23 20:52:08 -------- d-----w- C:\Users\AdmSirRed\AppData\Local\{B9087E4E-2FEF-40CB-B3C0-DF6DCF49A130}
2012-06-23 20:51:46 -------- d-----w- C:\Users\AdmSirRed\AppData\Local\{F87139D6-D88D-4AD8-BD5C-6E73BA0BC39E}
2012-06-22 21:17:56 -------- d-----w- C:\Users\AdmSirRed\AppData\Local\{991BF248-BD30-4EEF-91CF-1D9FA263E80D}
2012-06-22 09:17:23 -------- d-----w- C:\Users\AdmSirRed\AppData\Local\{11967A79-66F2-477D-B4E5-DEF4C7E74BF3}
2012-06-22 09:17:13 -------- d-----w- C:\Users\AdmSirRed\AppData\Local\{6ADFDAF6-808D-486E-BA0A-787B8A44A7B0}
2012-06-21 12:56:28 902656 ----a-w- C:\Windows\System32\d2d1.dll
2012-06-21 12:56:28 739840 ----a-w- C:\Windows\SysWow64\d2d1.dll
2012-06-21 12:56:28 1139200 ----a-w- C:\Windows\System32\FntCache.dll
2012-06-21 12:53:33 2622464 ----a-w- C:\Windows\System32\wucltux.dll
2012-06-21 12:53:31 99840 ----a-w- C:\Windows\System32\wudriver.dll
2012-06-21 12:53:29 36864 ----a-w- C:\Windows\System32\wuapp.exe
2012-06-21 12:53:29 186752 ----a-w- C:\Windows\System32\wuwebv.dll
2012-06-19 13:30:04 -------- d-----w- C:\Users\AdmSirRed\AppData\Local\{129457E0-52FF-4DA8-8E3F-F67333B04FBF}
2012-06-19 01:29:24 -------- d-----w- C:\Users\AdmSirRed\AppData\Local\{333E1355-9C3F-41E4-848E-AC7D5AFF2E57}
2012-06-19 01:29:14 -------- d-----w- C:\Users\AdmSirRed\AppData\Local\{4BE84071-BCCE-4BB0-B487-EEB32CD5A713}
.
==================== Find3M ====================
.
2012-07-12 17:57:24 70344 ----a-w- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl
2012-07-12 17:57:24 426184 ----a-w- C:\Windows\SysWow64\FlashPlayerApp.exe
2012-06-06 06:06:16 2004480 ----a-w- C:\Windows\System32\msxml6.dll
2012-06-06 06:06:16 1881600 ----a-w- C:\Windows\System32\msxml3.dll
2012-06-06 06:02:54 1133568 ----a-w- C:\Windows\System32\cdosys.dll
2012-06-06 05:05:52 1390080 ----a-w- C:\Windows\SysWow64\msxml6.dll
2012-06-06 05:05:52 1236992 ----a-w- C:\Windows\SysWow64\msxml3.dll
2012-06-06 05:03:06 805376 ----a-w- C:\Windows\SysWow64\cdosys.dll
2012-06-02 15:49:58 246032 ----a-w- C:\ProgramData\1338651797.bdinstall.bin
2012-06-02 12:12:17 2311680 ----a-w- C:\Windows\System32\jscript9.dll
2012-06-02 12:05:28 1392128 ----a-w- C:\Windows\System32\wininet.dll
2012-06-02 12:04:50 1494528 ----a-w- C:\Windows\System32\inetcpl.cpl
2012-06-02 12:01:40 173056 ----a-w- C:\Windows\System32\ieUnatt.exe
2012-06-02 11:57:08 2382848 ------w- C:\Windows\System32\mshtml.tlb
2012-06-02 08:33:25 1800192 ----a-w- C:\Windows\SysWow64\jscript9.dll
2012-06-02 08:25:08 1129472 ----a-w- C:\Windows\SysWow64\wininet.dll
2012-06-02 08:25:03 1427968 ----a-w- C:\Windows\SysWow64\inetcpl.cpl
2012-06-02 08:20:33 142848 ----a-w- C:\Windows\SysWow64\ieUnatt.exe
2012-06-02 08:16:52 2382848 ----a-w- C:\Windows\SysWow64\mshtml.tlb
2012-06-02 05:50:10 458704 ----a-w- C:\Windows\System32\drivers\cng.sys
2012-06-02 05:48:16 95600 ----a-w- C:\Windows\System32\drivers\ksecdd.sys
2012-06-02 05:48:16 151920 ----a-w- C:\Windows\System32\drivers\ksecpkg.sys
2012-06-02 05:45:31 340992 ----a-w- C:\Windows\System32\schannel.dll
2012-06-02 05:44:21 307200 ----a-w- C:\Windows\System32\ncrypt.dll
2012-06-02 04:40:42 22016 ----a-w- C:\Windows\SysWow64\secur32.dll
2012-06-02 04:40:39 225280 ----a-w- C:\Windows\SysWow64\schannel.dll
2012-06-02 04:39:10 219136 ----a-w- C:\Windows\SysWow64\ncrypt.dll
2012-06-02 04:34:09 96768 ----a-w- C:\Windows\SysWow64\sspicli.dll
2012-05-15 09:29:47 889664 ------w- C:\Windows\System32\nvvsvc.exe
2012-05-15 09:29:46 63296 ----a-w- C:\Windows\System32\nvshext.dll
2012-05-15 09:29:46 118080 ----a-w- C:\Windows\System32\nvmctray.dll
2012-05-15 09:29:45 2621723 ----a-w- C:\Windows\System32\nvcoproc.bin
2012-05-15 09:29:25 3149632 ----a-w- C:\Windows\System32\nvsvc64.dll
2012-05-15 09:28:42 6151488 ----a-w- C:\Windows\System32\nvcpl.dll
2012-05-15 09:21:50 423744 ----a-w- C:\Windows\SysWow64\nvStreaming.exe
2012-05-04 11:06:22 5559664 ----a-w- C:\Windows\System32\ntoskrnl.exe
2012-05-04 10:03:53 3968368 ----a-w- C:\Windows\SysWow64\ntkrnlpa.exe
2012-05-04 10:03:50 3913072 ----a-w- C:\Windows\SysWow64\ntoskrnl.exe
2012-05-01 05:40:20 209920 ----a-w- C:\Windows\System32\profsvc.dll
2012-04-28 03:55:21 210944 ----a-w- C:\Windows\System32\drivers\rdpwd.sys
2012-04-26 05:41:56 77312 ----a-w- C:\Windows\System32\rdpwsx.dll
2012-04-26 05:41:55 149504 ----a-w- C:\Windows\System32\rdpcorekmts.dll
2012-04-26 05:34:27 9216 ----a-w- C:\Windows\System32\rdrmemptylst.exe
2012-04-24 05:37:37 184320 ----a-w- C:\Windows\System32\cryptsvc.dll
2012-04-24 05:37:37 140288 ----a-w- C:\Windows\System32\cryptnet.dll
2012-04-24 05:37:36 1462272 ----a-w- C:\Windows\System32\crypt32.dll
2012-04-24 04:36:42 140288 ----a-w- C:\Windows\SysWow64\cryptsvc.dll
2012-04-24 04:36:42 1158656 ----a-w- C:\Windows\SysWow64\crypt32.dll
2012-04-24 04:36:42 103936 ----a-w- C:\Windows\SysWow64\cryptnet.dll
.
============= FINISH: 16:07:43.75 ===============


.
UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT
.
DDS (Ver_2011-08-26.01)
.
Microsoft Windows 7 Home Premium
Boot Device: \Device\HarddiskVolume1
Install Date: 6/2/2012 9:08:11 PM
System Uptime: 7/18/2012 3:56:59 PM (1 hours ago)
.
Motherboard: ASUSTeK COMPUTER INC. | | SABERTOOTH Z77
Processor: Intel(R) Core(TM) i5-3570K CPU @ 3.40GHz | LGA1155 | 3401/100mhz
.
==== Disk Partitions =========================
.
C: is FIXED (NTFS) - 119 GiB total, 7.096 GiB free.
D: is CDROM (CDFS)
.
==== Disabled Device Manager Items =============
.
==== System Restore Points ===================
.
RP37: 7/16/2012 9:06:01 PM - Windows Update
.
==== Installed Programs ======================
.
Adobe Flash Player 11 Plugin
Apple Application Support
Apple Software Update
Asmedia ASM104x USB 3.0 Host Controller Driver
Asmedia ASM106x SATA Host Controller Driver
Chat Messenger
D3DX10
Diablo III
Google Chrome
Google Update Helper
Intel(R) Control Center
Intel(R) Management Engine Components
Intel(R) Rapid Storage Technology
League of Legends
Malwarebytes Anti-Malware version 1.62.0.1300
McAfee Security Scan Plus
Microsoft Silverlight
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219
Mozilla Firefox 14.0.1 (x86 en-US)
Mozilla Maintenance Service
MSVCRT
Norton PC Checkup
NVIDIA PhysX
NVIDIA Stereoscopic 3D Driver
Pando Media Booster
Realtek High Definition Audio Driver
Security Update for Microsoft .NET Framework 4 Client Profile (KB2604121)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2656351)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2656368v2)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2656405)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2686827)
Skype™ 5.9
Update for Microsoft .NET Framework 4 Client Profile (KB2468871)
Update for Microsoft .NET Framework 4 Client Profile (KB2533523)
Update for Microsoft .NET Framework 4 Client Profile (KB2600217)
VLC media player 2.0.1
Windows Live Communications Platform
Windows Live Essentials
Windows Live Installer
Windows Live Messenger
Windows Live Photo Common
Windows Live PIMT Platform
Windows Live SOXE
Windows Live SOXE Definitions
Windows Live UX Platform
Windows Live UX Platform Language Pack
WinZip System Utilities Suite
.
==== Event Viewer Messages From Past Week ========
.
7/18/2012 9:48:37 AM, Error: Service Control Manager [7009] - A timeout was reached (30000 milliseconds) while waiting for the Google Update Service (gupdate) service to connect.
7/18/2012 9:48:37 AM, Error: Service Control Manager [7000] - The Google Update Service (gupdate) service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
7/18/2012 9:48:37 AM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1053" attempting to start the service gupdate with arguments "/comsvc" in order to run the server: {4EB61BAC-A3B6-4760-9581-655041EF4D69}
7/18/2012 9:10:36 AM, Error: Service Control Manager [7009] - A timeout was reached (30000 milliseconds) while waiting for the Adobe Flash Player Update Service service to connect.
7/18/2012 9:10:36 AM, Error: Service Control Manager [7000] - The Adobe Flash Player Update Service service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
7/18/2012 9:03:40 AM, Error: Service Control Manager [7009] - A timeout was reached (30000 milliseconds) while waiting for the Volume Shadow Copy service to connect.
7/18/2012 9:03:40 AM, Error: Service Control Manager [7000] - The Volume Shadow Copy service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
7/18/2012 8:45:49 AM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1053" attempting to start the service VSS with arguments " " in order to run the server: {E579AB5F-1CC4-44B4-BED9-DE0991FF0623}
7/18/2012 8:09:16 AM, Error: Service Control Manager [7009] - A timeout was reached (30000 milliseconds) while waiting for the Intel(R) Rapid Storage Technology service to connect.
7/18/2012 8:09:16 AM, Error: Service Control Manager [7000] - The Intel(R) Rapid Storage Technology service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
7/18/2012 7:08:11 AM, Error: Microsoft Antimalware [1119] - Microsoft Antimalware has encountered a critical error when taking action on malware or other potentially unwanted software. For more information please see the following: http://go.microsoft.com/fwlink/?linkid=37020&name=Backdoor:Win32/Fynloski.A&threatid=2147640184 Name: Backdoor:Win32/Fynloski.A ID: 2147640184 Severity: Severe Category: Backdoor Path: file:_C:\Windows\Temp\tmp00001d3c\tmp00000882;file:_C:\Windows\Temp\tmp00001d3c\tmp0000088c;file:_C:\Windows\Temp\tmp000023de\tmp0001deb2;file:_C:\Windows\Temp\tmp000023de\tmp0001deb4;file:_C:\Windows\Temp\tmp000023de\tmp0001deb6;file:_C:\Windows\Temp\tmp000023de\tmp0001dec6;file:_C:\Windows\Temp\tmp000023de\tmp0001def8;file:_C:\Windows\Temp\tmp000023de\tmp0001df29;file:_C:\Windows\Temp\tmp00004b22\tmp00000051;file:_C:\Windows\Temp\tmp00004b22\tmp00000052;file:_C:\Windows\Temp\tmp00004b22\tmp0000005a;file:_C:\Windows\Temp\tmp00004b22\tmp0000005c;file:_C:\Windows\Temp\tmp00004b22\tmp00000060;file:_C:\Windows\Temp\tmp00004b22\tmp00000064;file:_C:\Windows\Temp\tmp00004b22\tmp00000066;file:_C:\Windows\Temp\tmp00004b22\tmp00000068;file:_C:\Windows\Temp\tmp00004b22\tmp0000006a;file:_C:\Windows\Temp\tmp00004b22\tmp0000006c;file:_C:\Windows\Temp\tmp00004b22\tmp0000006e;file:_C:\Windows\Temp\tmp00004b22\tmp00000071;file:_C:\Windows\Temp\tmp00004b22\tmp00000072;file:_C:\Windows\Temp\tmp00004b22\tmp00000074;file:_C:\Wi Detection Origin: Local machine Detection Type: Concrete Detection Source: Real-Time Protection User: NT AUTHORITY\SYSTEM Process Name: C:\Program Files\Bitdefender\Bitdefender 2012\vsserv.exe Action: Quarantine Action Status: No additional actions required Error Code: 0x8007001d Error description: The system cannot write to the specified device. Signature Version: AV: 1.131.132.0, AS: 1.131.132.0, NIS: 11.159.0.0 Engine Version: AM: 1.1.8601.0, NIS: 2.0.8001.0
7/18/2012 4:54:33 AM, Error: Microsoft Antimalware [1119] - Microsoft Antimalware has encountered a critical error when taking action on malware or other potentially unwanted software. For more information please see the following: http://go.microsoft.com/fwlink/?linkid=37020&name=Backdoor:Win32/Fynloski.A&threatid=2147640184 Name: Backdoor:Win32/Fynloski.A ID: 2147640184 Severity: Severe Category: Backdoor Path: file:_C:\Windows\Temp\tmp00001d3c\tmp00000873;file:_C:\Windows\Temp\tmp00001d3c\tmp00000882;file:_C:\Windows\Temp\tmp00001d3c\tmp0000088c;file:_C:\Windows\Temp\tmp00001d3c\tmp00000890;file:_C:\Windows\Temp\tmp00001d3c\tmp000008a2;file:_C:\Windows\Temp\tmp00001d3c\tmp000008a6;file:_C:\Windows\Temp\tmp000023de\tmp0001dec6;file:_C:\Windows\Temp\tmp000023de\tmp0001def6;file:_C:\Windows\Temp\tmp000023de\tmp0001def8;file:_C:\Windows\Temp\tmp000023de\tmp0001defb;file:_C:\Windows\Temp\tmp000023de\tmp0001df02;file:_C:\Windows\Temp\tmp000023de\tmp0001df04;file:_C:\Windows\Temp\tmp00003acf\tmp0000ff2c;file:_C:\Windows\Temp\tmp00003acf\tmp0000ff2e;file:_C:\Windows\Temp\tmp00003acf\tmp0000ff32;file:_C:\Windows\Temp\tmp00003acf\tmp0000ff38;file:_C:\Windows\Temp\tmp00003acf\tmp0000ff3e;file:_C:\Windows\Temp\tmp00003acf\tmp0000ff40;file:_C:\Windows\Temp\tmp00003acf\tmp0000ff46;file:_C:\Windows\Temp\tmp00003acf\tmp0000ff4a;file:_C:\Windows\Temp\tmp00003acf\tmp0000ff4c;file:_C:\Windows\Temp\tmp00003acf\tmp0000ff4e;file:_C:\Wi Detection Origin: Local machine Detection Type: Concrete Detection Source: Real-Time Protection User: NT AUTHORITY\SYSTEM Process Name: C:\Program Files\Bitdefender\Bitdefender 2012\vsserv.exe Action: Quarantine Action Status: No additional actions required Error Code: 0x80070005 Error description: Access is denied. Signature Version: AV: 1.131.132.0, AS: 1.131.132.0, NIS: 11.159.0.0 Engine Version: AM: 1.1.8601.0, NIS: 2.0.8001.0
7/18/2012 3:59:14 PM, Error: Service Control Manager [7000] - The Norton PC Checkup Application Launcher service failed to start due to the following error: The system cannot find the file specified.
7/18/2012 3:57:11 PM, Error: Service Control Manager [7000] - The Common Client Job Manager Service service failed to start due to the following error: The system cannot find the file specified.
7/18/2012 3:52:11 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service WSearch with arguments " " in order to run the server: {7D096C5F-AC08-4F1F-BEB7-5C22C517CE39}
7/18/2012 3:52:10 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service WSearch with arguments " " in order to run the server: {9E175B6D-F52A-11D8-B9A5-505054503030}
7/18/2012 3:52:10 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service EventSystem with arguments " " in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF}
7/18/2012 3:52:04 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service ShellHWDetection with arguments " " in order to run the server: {DD522ACC-F821-461A-A407-50B198B896DC}
7/18/2012 3:52:03 PM, Error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: avc3 bdfsfltr bdfwfpf BDVEDISK discache MpFilter spldr trufos Wanarpv6
7/18/2012 3:33:48 PM, Error: Microsoft Antimalware [1012] - Microsoft Antimalware has encountered an error trying to delete an item from quarantine. For more information please see the following: http://go.microsoft.com/fwlink/?linkid=37020&name=Backdoor:Win32/Fynloski.A&threatid=2147640184 Name: Backdoor:Win32/Fynloski.A ID: 2147640184 Severity: Severe Category: Backdoor Path: file:_C:\Windows\Temp\tmp000026c0\tmp00100f37 User: AdmSirRed-PC\AdmSirRed Error Code: 0x8050800c Error description: An unexpected problem occurred. Install any available updates, and then try to start the program again. For information on installing updates, see Help and Support. Signature Version: AV: 1.131.132.0, AS: 1.131.132.0 Engine Version: 1.1.8601.0
7/18/2012 3:33:48 PM, Error: Microsoft Antimalware [1012] - Microsoft Antimalware has encountered an error trying to delete an item from quarantine. For more information please see the following: http://go.microsoft.com/fwlink/?linkid=37020&name=Backdoor:Win32/Fynloski.A&threatid=2147640184 Name: Backdoor:Win32/Fynloski.A ID: 2147640184 Severity: Severe Category: Backdoor Path: file:_C:\Windows\Temp\tmp000023de\tmp0001df29 User: AdmSirRed-PC\AdmSirRed Error Code: 0x8050800c Error description: An unexpected problem occurred. Install any available updates, and then try to start the program again. For information on installing updates, see Help and Support. Signature Version: AV: 1.131.132.0, AS: 1.131.132.0 Engine Version: 1.1.8601.0
7/18/2012 3:33:48 PM, Error: Microsoft Antimalware [1012] - Microsoft Antimalware has encountered an error trying to delete an item from quarantine. For more information please see the following: http://go.microsoft.com/fwlink/?linkid=37020&name=Backdoor:Win32/Fynloski.A&threatid=2147640184 Name: Backdoor:Win32/Fynloski.A ID: 2147640184 Severity: Severe Category: Backdoor Path: file:_C:\Windows\Temp\tmp000023de\tmp0001deb0 User: AdmSirRed-PC\AdmSirRed Error Code: 0x8050800c Error description: An unexpected problem occurred. Install any available updates, and then try to start the program again. For information on installing updates, see Help and Support. Signature Version: AV: 1.131.132.0, AS: 1.131.132.0 Engine Version: 1.1.8601.0
7/18/2012 3:33:48 PM, Error: Microsoft Antimalware [1012] - Microsoft Antimalware has encountered an error trying to delete an item from quarantine. For more information please see the following: http://go.microsoft.com/fwlink/?linkid=37020&name=Backdoor:Win32/Fynloski.A&threatid=2147640184 Name: Backdoor:Win32/Fynloski.A ID: 2147640184 Severity: Severe Category: Backdoor Path: file:_C:\Windows\Temp\tmp00001d3c\tmp0000088c User: AdmSirRed-PC\AdmSirRed Error Code: 0x8050800c Error description: An unexpected problem occurred. Install any available updates, and then try to start the program again. For information on installing updates, see Help and Support. Signature Version: AV: 1.131.132.0, AS: 1.131.132.0 Engine Version: 1.1.8601.0
7/18/2012 3:33:48 PM, Error: Microsoft Antimalware [1012] - Microsoft Antimalware has encountered an error trying to delete an item from quarantine. For more information please see the following: http://go.microsoft.com/fwlink/?linkid=37020&name=Backdoor:Win32/Fynloski.A&threatid=2147640184 Name: Backdoor:Win32/Fynloski.A ID: 2147640184 Severity: Severe Category: Backdoor Path: file:_C:\Windows\Temp\tmp00001d3c\tmp00000867 User: AdmSirRed-PC\AdmSirRed Error Code: 0x8050800c Error description: An unexpected problem occurred. Install any available updates, and then try to start the program again. For information on installing updates, see Help and Support. Signature Version: AV: 1.131.132.0, AS: 1.131.132.0 Engine Version: 1.1.8601.0
7/18/2012 3:25:50 AM, Error: Microsoft Antimalware [1119] - Microsoft Antimalware has encountered a critical error when taking action on malware or other potentially unwanted software. For more information please see the following: http://go.microsoft.com/fwlink/?linkid=37020&name=Backdoor:Win32/Fynloski.A&threatid=2147640184 Name: Backdoor:Win32/Fynloski.A ID: 2147640184 Severity: Severe Category: Backdoor Path: file:_C:\Windows\Temp\tmp00001d3c\tmp00000873;file:_C:\Windows\Temp\tmp000023de\tmp0001dec6;file:_C:\Windows\Temp\tmp000023de\tmp0001def6;file:_C:\Windows\Temp\tmp00003acf\tmp0000ff2c;file:_C:\Windows\Temp\tmp00003acf\tmp0000ff2e;file:_C:\Windows\Temp\tmp00003acf\tmp0000ff32;file:_C:\Windows\Temp\tmp00003acf\tmp0000ff38;file:_C:\Windows\Temp\tmp00003acf\tmp0000ff3e;file:_C:\Windows\Temp\tmp00003acf\tmp0000ff40;file:_C:\Windows\Temp\tmp00003acf\tmp0000ff46;file:_C:\Windows\Temp\tmp00003acf\tmp0000ff4a;file:_C:\Windows\Temp\tmp00003acf\tmp0000ff4c;file:_C:\Windows\Temp\tmp00003acf\tmp0000ff4e;file:_C:\Windows\Temp\tmp00003acf\tmp0000ff54;file:_C:\Windows\Temp\tmp00003acf\tmp0000ff63;file:_C:\Windows\Temp\tmp00003acf\tmp0000ff65;file:_C:\Windows\Temp\tmp00003acf\tmp0000ff67;file:_C:\Windows\Temp\tmp00003acf\tmp0000ff6b;file:_C:\Windows\Temp\tmp00003acf\tmp0000ff6d Detection Origin: Local machine Detection Type: Concrete Detection Source: Real-Time Protection User: NT AUTHORITY\SYSTEM Process Name: C:\Program Files\Bitdefender\Bitdefender 2012\vsserv.exe Action: Quarantine Action Status: No additional actions required Error Code: 0x80070005 Error description: Access is denied. Signature Version: AV: 1.131.132.0, AS: 1.131.132.0, NIS: 11.159.0.0 Engine Version: AM: 1.1.8601.0, NIS: 2.0.8001.0
7/18/2012 3:12:47 PM, Error: Microsoft Antimalware [1119] - Microsoft Antimalware has encountered a critical error when taking action on malware or other potentially unwanted software. For more information please see the following: http://go.microsoft.com/fwlink/?linkid=37020&name=Backdoor:Win32/Fynloski.A&threatid=2147640184 Name: Backdoor:Win32/Fynloski.A ID: 2147640184 Severity: Severe Category: Backdoor Path: file:_C:\Windows\Temp\tmp00004b22\tmp00001c17;file:_C:\Windows\Temp\tmp00004b22\tmp00002885;file:_C:\Windows\Temp\tmp00004b22\tmp0000288b;file:_C:\Windows\Temp\tmp00004b22\tmp0000288e;file:_C:\Windows\Temp\tmp00004b22\tmp00002892;file:_C:\Windows\Temp\tmp00004b22\tmp00002893;file:_C:\Windows\Temp\tmp00004b22\tmp00002897;file:_C:\Windows\Temp\tmp00004b22\tmp00002899;file:_C:\Windows\Temp\tmp00004b22\tmp000028a0;file:_C:\Windows\Temp\tmp00004b22\tmp000028a8;file:_C:\Windows\Temp\tmp00004b22\tmp000028ab;file:_C:\Windows\Temp\tmp00004b22\tmp000028ac;file:_C:\Windows\Temp\tmp00004b22\tmp000028be;file:_C:\Windows\Temp\tmp00004b22\tmp000028c6;file:_C:\Windows\Temp\tmp00004b22\tmp000028c8;file:_C:\Windows\Temp\tmp00004b22\tmp000028cc;file:_C:\Windows\Temp\tmp00004b22\tmp000028ce;file:_C:\Windows\Temp\tmp00004b22\tmp000028d0;file:_C:\Windows\Temp\tmp00004b22\tmp000028d5;file:_C:\Windows\Temp\tmp00004b22\tmp000028d6;file:_C:\Windows\Temp\tmp00004b22\tmp000028da;file:_C:\Windows\Temp\tmp00004b22\tmp000028e2;file:_C:\Wi Detection Origin: Local machine Detection Type: Concrete Detection Source: System User: NT AUTHORITY\SYSTEM Process Name: Unknown Action: Quarantine Action Status: No additional actions required Error Code: 0x80070050 Error description: The file exists. Signature Version: AV: 1.131.132.0, AS: 1.131.132.0, NIS: 0.0.0.0 Engine Version: AM: 1.1.8601.0, NIS: 0.0.0.0
7/18/2012 3:11:58 PM, Error: Service Control Manager [7001] - The Network List Service service depends on the Network Location Awareness service which failed to start because of the following error: The dependency service or group failed to start.
7/18/2012 3:11:58 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1068" attempting to start the service netprofm with arguments " " in order to run the server: {A47979D2-C419-11D9-A5B4-001185AD2B89}
7/18/2012 3:11:58 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1068" attempting to start the service netman with arguments " " in order to run the server: {BA126AD1-2166-11D1-B1D0-00805FC1270E}
7/18/2012 3:11:49 PM, Error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: AFD avc3 BdfNdisf bdfsfltr bdfwfpf BDVEDISK DfsC discache MpFilter NetBIOS NetBT nsiproxy Psched rdbss spldr tdx trufos Wanarpv6 WfpLwf
7/18/2012 3:11:49 PM, Error: Service Control Manager [7001] - The Workstation service depends on the Network Store Interface Service service which failed to start because of the following error: The dependency service or group failed to start.
7/18/2012 3:11:49 PM, Error: Service Control Manager [7001] - The TCP/IP NetBIOS Helper service depends on the Ancillary Function Driver for Winsock service which failed to start because of the following error: A device attached to the system is not functioning.
7/18/2012 3:11:49 PM, Error: Service Control Manager [7001] - The SMB MiniRedirector Wrapper and Engine service depends on the Redirected Buffering Sub Sysytem service which failed to start because of the following error: A device attached to the system is not functioning.
7/18/2012 3:11:49 PM, Error: Service Control Manager [7001] - The SMB 2.0 MiniRedirector service depends on the SMB MiniRedirector Wrapper and Engine service which failed to start because of the following error: The dependency service or group failed to start.
7/18/2012 3:11:49 PM, Error: Service Control Manager [7001] - The SMB 1.x MiniRedirector service depends on the SMB MiniRedirector Wrapper and Engine service which failed to start because of the following error: The dependency service or group failed to start.
7/18/2012 3:11:49 PM, Error: Service Control Manager [7001] - The Network Store Interface Service service depends on the NSI proxy service driver. service which failed to start because of the following error: A device attached to the system is not functioning.
7/18/2012 3:11:49 PM, Error: Service Control Manager [7001] - The Network Location Awareness service depends on the Network Store Interface Service service which failed to start because of the following error: The dependency service or group failed to start.
7/18/2012 3:11:49 PM, Error: Service Control Manager [7001] - The IP Helper service depends on the Network Store Interface Service service which failed to start because of the following error: The dependency service or group failed to start.
7/18/2012 3:11:49 PM, Error: Service Control Manager [7001] - The DNS Client service depends on the NetIO Legacy TDI Support Driver service which failed to start because of the following error: A device attached to the system is not functioning.
7/18/2012 3:11:49 PM, Error: Service Control Manager [7001] - The DHCP Client service depends on the Ancillary Function Driver for Winsock service which failed to start because of the following error: A device attached to the system is not functioning.
7/18/2012 2:19:02 PM, Error: Microsoft Antimalware [1119] - Microsoft Antimalware has encountered a critical error when taking action on malware or other potentially unwanted software. For more information please see the following: http://go.microsoft.com/fwlink/?linkid=37020&name=Backdoor:Win32/Fynloski.A&threatid=2147640184 Name: Backdoor:Win32/Fynloski.A ID: 2147640184 Severity: Severe Category: Backdoor Path: file:_C:\Windows\Temp\tmp000021f5\tmp0004935e;file:_C:\Windows\Temp\tmp000021f5\tmp000493af;file:_C:\Windows\Temp\tmp000021f5\tmp00049683;file:_C:\Windows\Temp\tmp000021f5\tmp00049b02;file:_C:\Windows\Temp\tmp000021f5\tmp0004a32e;file:_C:\Windows\Temp\tmp000021f5\tmp0004ac71;file:_C:\Windows\Temp\tmp000021f5\tmp0004b2c3;file:_C:\Windows\Temp\tmp000021f5\tmp0004b2c6;file:_C:\Windows\Temp\tmp000021f5\tmp0004b2e6;file:_C:\Windows\Temp\tmp000021f5\tmp0004b309;file:_C:\Windows\Temp\tmp000021f5\tmp0004b310;file:_C:\Windows\Temp\tmp000021f5\tmp0004b326;file:_C:\Windows\Temp\tmp000021f5\tmp0004b327;file:_C:\Windows\Temp\tmp000021f5\tmp0004b328;file:_C:\Windows\Temp\tmp000021f5\tmp0004b32a;file:_C:\Windows\Temp\tmp000021f5\tmp0004b32c;file:_C:\Windows\Temp\tmp000021f5\tmp0004b333;file:_C:\Windows\Temp\tmp000021f5\tmp0004b339;file:_C:\Windows\Temp\tmp000021f5\tmp0004b33e;file:_C:\Windows\Temp\tmp000021f5\tmp0004b33f;file:_C:\Windows\Temp\tmp000021f5\tmp0004b346;file:_C:\Windows\Temp\tmp000021f5\tmp0004b34d;file:_C:\Wi Detection Origin: Local machine Detection Type: Concrete Detection Source: Real-Time Protection User: NT AUTHORITY\SYSTEM Process Name: C:\Program Files\Bitdefender\Bitdefender 2012\vsserv.exe Action: Quarantine Action Status: No additional actions required Error Code: 0x8007001d Error description: The system cannot write to the specified device. Signature Version: AV: 1.131.132.0, AS: 1.131.132.0, NIS: 11.159.0.0 Engine Version: AM: 1.1.8601.0, NIS: 2.0.8001.0
7/18/2012 11:25:12 AM, Error: Service Control Manager [7009] - A timeout was reached (30000 milliseconds) while waiting for the Windows Modules Installer service to connect.
7/18/2012 11:25:12 AM, Error: Service Control Manager [7000] - The Windows Modules Installer service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
7/18/2012 11:25:12 AM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1053" attempting to start the service TrustedInstaller with arguments " " in order to run the server: {752073A1-23F2-4396-85F0-8FDB879ED0ED}
7/17/2012 9:09:44 AM, Error: Service Control Manager [7034] - The BitDefender Virus Shield service terminated unexpectedly. It has done this 1 time(s).
7/17/2012 7:54:24 PM, Error: Service Control Manager [7009] - A timeout was reached (30000 milliseconds) while waiting for the Microsoft .NET Framework NGEN v4.0.30319_X86 service to connect.
7/17/2012 7:53:19 PM, Error: Service Control Manager [7011] - A timeout (30000 milliseconds) was reached while waiting for a transaction response from the ShellHWDetection service.
7/16/2012 8:54:14 PM, Error: Microsoft Antimalware [2004] - Microsoft Antimalware has encountered an error trying to load signatures and will attempt reverting back to a known-good set of signatures. Signatures Attempted: Current Error Code: 0x80070002 Error description: The system cannot find the file specified. Signature version: 1.129.1616.0;1.129.1616.0 Engine version: 1.1.8502.0
7/16/2012 8:51:34 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service wuauserv with arguments " " in order to run the server: {E60687F7-01A1-40AA-86AC-DB1CBF673334}
.
==== End Of File ===========================



That should be all the required logs. thank you for your help on this matter.

On a side note after running the Mbam scan and deleting the files it mentioned my MSE ran better and did not pick up any warnings as it had been doing. Nor did my computer slow down or freeze like before.

 

Why must i uninstall one *i uninstalled MSE* i was under the impression that most people did have 2. is their any specific reason why i can't have MSE as well as Bit Defender?. I have not noticed any problems having both.

RogueKiller V7.6.4 [07/17/2012] by Tigzy
mail: tigzyRK<at>gmail<dot>com
Feedback: http://www.geekstogo.com/forum/files/file/413-roguekiller/
Blog: http://tigzyrk.blogspot.com

Operating System: Windows 7 (6.1.7601 Service Pack 1) 64 bits version
Started in : Normal mode
User: AdmSirRed [Admin rights]
Mode: Scan -- Date: 07/19/2012 07:46:48

¤¤¤ Bad processes: 0 ¤¤¤

¤¤¤ Registry Entries: 2 ¤¤¤
[HJ] HKLM\[...]\NewStartPanel : {59031a47-3f72-44a7-89c5-5595fe6b30ee} (1) -> FOUND
[HJ] HKLM\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> FOUND

¤¤¤ Particular Files / Folders: ¤¤¤

¤¤¤ Driver: [NOT LOADED] ¤¤¤

¤¤¤ Infection : ¤¤¤

¤¤¤ HOSTS File: ¤¤¤


¤¤¤ MBR Check: ¤¤¤

+++++ PhysicalDrive0: M4-CT128M4SSD2 ATA Device +++++
--- User ---
[MBR] 269ce9da3f9705b6c3251a46b4aa9a1b
[BSP] f419469149c76878eadf0e8a6efe259f : Windows 7 MBR Code
Partition table:
0 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 2048 | Size: 100 Mo
1 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 206848 | Size: 122002 Mo
User = LL1 ... OK!
User = LL2 ... OK!

Finished : << RKreport[1].txt >>
RKreport[1].txt

 

Because the way the definitions are written. The other AV program may think that it is a virus downloading and will kill it and the program will not be up to date. You can have more than one, but only one active at a time. Find something that you are comfortable with and stick with it.

 

ComboFix 12-07-20.02 - AdmSirRed 07/20/2012 17:21:46.1.4 - x64
Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.16339.13363 [GMT -6:00]
Running from: c:\users\AdmSirRed\Desktop\ComboFix.exe
AV: Bitdefender Antivirus *Enabled/Updated* {50909708-FF80-02AF-F814-B28405891E92}
FW: Bitdefender Firewall *Disabled* {68AB162D-B5EF-03F7-D34B-1BB1FB5A59E9}
SP: Bitdefender Antispyware *Enabled/Updated* {EBF176EC-D9BA-0D21-C2A4-89F67E0E542F}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\programdata\1338651797.bdinstall.bin
.
.
((((((((((((((((((((((((( Files Created from 2012-06-20 to 2012-07-20 )))))))))))))))))))))))))))))))
.
.
2012-07-20 11:25 . 2012-07-16 08:40 9133488 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{BAEB7F10-6AE8-40AD-8D8A-D7D06CE62A76}\mpengine.dll
2012-07-18 21:52 . 2012-07-18 21:52 -------- d-----w- c:\users\AdmSirRed\AppData\Roaming\Malwarebytes
2012-07-18 21:46 . 2012-07-18 21:46 -------- d-----w- c:\programdata\Malwarebytes
2012-07-18 21:46 . 2012-07-03 19:46 24904 ----a-w- c:\windows\system32\drivers\mbam.sys
2012-07-18 21:45 . 2012-07-18 21:49 -------- d-----w- c:\program files (x86)\Malwarebytes' Anti-Malware
2012-07-11 09:02 . 2012-06-12 03:08 3148800 ----a-w- c:\windows\system32\win32k.sys
2012-07-10 23:57 . 2012-06-06 06:06 2004480 ----a-w- c:\windows\system32\msxml6.dll
2012-07-08 16:03 . 2012-07-11 13:46 -------- d-----w- c:\users\AdmSirRed\riotsGamesLogs
2012-07-03 13:15 . 2012-07-03 13:15 -------- d-----w- c:\users\AdmSirRed\AppData\Roaming\Apple Computer
2012-07-03 13:15 . 2012-07-03 13:15 -------- d-----w- c:\users\AdmSirRed\AppData\Local\Apple Computer
2012-07-03 13:15 . 2012-07-03 13:15 -------- dc----w- c:\windows\system32\DRVSTORE
2012-07-03 13:15 . 2009-05-18 19:17 34152 ----a-w- c:\windows\system32\drivers\GEARAspiWDM.sys
2012-07-03 13:15 . 2008-04-17 18:12 126312 ----a-w- c:\windows\system32\GEARAspi64.dll
2012-07-03 13:15 . 2008-04-17 18:12 107368 ----a-w- c:\windows\SysWow64\GEARAspi.dll
2012-07-03 13:14 . 2012-07-03 13:15 -------- d-----w- c:\programdata\{93E26451-CD9A-43A5-A2FA-C42392EA4001}
2012-07-03 13:14 . 2012-07-03 13:15 -------- d-----w- c:\program files\iTunes
2012-07-03 13:14 . 2012-07-03 13:15 -------- d-----w- c:\program files (x86)\iTunes
2012-07-03 13:14 . 2012-07-03 13:14 -------- d-----w- c:\programdata\Apple Computer
2012-07-03 13:14 . 2012-07-03 13:14 -------- d-----w- c:\program files\iPod
2012-07-03 13:14 . 2012-07-03 13:14 -------- d-----w- c:\users\AdmSirRed\AppData\Local\Apple
2012-07-03 13:14 . 2012-07-03 13:14 -------- d-----w- c:\program files (x86)\Apple Software Update
2012-07-03 13:14 . 2012-07-03 13:14 -------- d-----w- c:\program files\Common Files\Apple
2012-07-03 13:14 . 2012-07-03 13:14 -------- d-----w- c:\program files\Bonjour
2012-07-03 13:14 . 2012-07-03 13:14 -------- d-----w- c:\program files (x86)\Bonjour
2012-07-03 13:14 . 2012-07-03 13:14 -------- d-----w- c:\program files (x86)\Common Files\Apple
2012-07-03 13:14 . 2012-07-03 13:14 -------- d-----w- c:\programdata\Apple
2012-07-01 13:46 . 2012-07-01 13:46 -------- d-----w- c:\users\AdmSirRed\AppData\Roaming\LolClient
2012-06-21 12:56 . 2011-02-19 12:05 1139200 ----a-w- c:\windows\system32\FntCache.dll
2012-06-21 12:56 . 2011-02-19 12:04 902656 ----a-w- c:\windows\system32\d2d1.dll
2012-06-21 12:56 . 2011-02-19 06:30 739840 ----a-w- c:\windows\SysWow64\d2d1.dll
2012-06-21 12:53 . 2012-06-02 22:19 2428952 ----a-w- c:\windows\system32\wuaueng.dll
2012-06-21 12:53 . 2012-06-02 22:19 57880 ----a-w- c:\windows\system32\wuauclt.exe
2012-06-21 12:53 . 2012-06-02 22:19 44056 ----a-w- c:\windows\system32\wups2.dll
2012-06-21 12:53 . 2012-06-02 22:15 2622464 ----a-w- c:\windows\system32\wucltux.dll
2012-06-21 12:53 . 2012-06-02 22:19 38424 ----a-w- c:\windows\system32\wups.dll
2012-06-21 12:53 . 2012-06-02 22:19 701976 ----a-w- c:\windows\system32\wuapi.dll
2012-06-21 12:53 . 2012-06-02 22:15 99840 ----a-w- c:\windows\system32\wudriver.dll
2012-06-21 12:53 . 2012-06-02 21:19 186752 ----a-w- c:\windows\system32\wuwebv.dll
2012-06-21 12:53 . 2012-06-02 21:15 36864 ----a-w- c:\windows\system32\wuapp.exe
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-07-12 17:57 . 2012-06-05 04:08 70344 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2012-07-12 17:57 . 2012-06-05 04:08 426184 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe
2012-07-11 09:01 . 2012-06-07 14:37 59701280 ----a-w- c:\windows\system32\MRT.exe
2012-06-12 15:46 . 2011-03-29 00:36 19736 ----a-w- c:\programdata\Microsoft\IdentityCRL\production\ppcrlconfig600.dll
2012-06-03 22:42 . 2012-06-03 22:42 163048 ----a-w- c:\programdata\Microsoft\Windows\Sqm\Manifest\Sqm10141.bin
2012-06-03 01:12 . 2012-06-03 01:12 86528 ----a-w- c:\windows\SysWow64\iesysprep.dll
2012-06-03 01:12 . 2012-06-03 01:12 76800 ----a-w- c:\windows\SysWow64\SetIEInstalledDate.exe
2012-06-03 01:12 . 2012-06-03 01:12 74752 ----a-w- c:\windows\SysWow64\RegisterIEPKEYs.exe
2012-06-03 01:12 . 2012-06-03 01:12 74752 ----a-w- c:\windows\SysWow64\iesetup.dll
2012-06-03 01:12 . 2012-06-03 01:12 63488 ----a-w- c:\windows\SysWow64\tdc.ocx
2012-06-03 01:12 . 2012-06-03 01:12 48640 ----a-w- c:\windows\SysWow64\mshtmler.dll
2012-06-03 01:12 . 2012-06-03 01:12 420864 ----a-w- c:\windows\SysWow64\vbscript.dll
2012-06-03 01:12 . 2012-06-03 01:12 367104 ----a-w- c:\windows\SysWow64\html.iec
2012-06-03 01:12 . 2012-06-03 01:12 23552 ----a-w- c:\windows\SysWow64\licmgr10.dll
2012-06-03 01:12 . 2012-06-03 01:12 161792 ----a-w- c:\windows\SysWow64\msls31.dll
2012-06-03 01:12 . 2012-06-03 01:12 152064 ----a-w- c:\windows\SysWow64\wextract.exe
2012-06-03 01:12 . 2012-06-03 01:12 150528 ----a-w- c:\windows\SysWow64\iexpress.exe
2012-06-03 01:12 . 2012-06-03 01:12 110592 ----a-w- c:\windows\SysWow64\IEAdvpack.dll
2012-06-03 01:12 . 2012-06-03 01:12 91648 ----a-w- c:\windows\system32\SetIEInstalledDate.exe
2012-06-03 01:12 . 2012-06-03 01:12 89088 ----a-w- c:\windows\system32\RegisterIEPKEYs.exe
2012-06-03 01:12 . 2012-06-03 01:12 89088 ----a-w- c:\windows\system32\ie4uinit.exe
2012-06-03 01:12 . 2012-06-03 01:12 85504 ----a-w- c:\windows\system32\iesetup.dll
2012-06-03 01:12 . 2012-06-03 01:12 82432 ----a-w- c:\windows\system32\icardie.dll
2012-06-03 01:12 . 2012-06-03 01:12 76800 ----a-w- c:\windows\system32\tdc.ocx
2012-06-03 01:12 . 2012-06-03 01:12 65024 ----a-w- c:\windows\system32\pngfilt.dll
2012-06-03 01:12 . 2012-06-03 01:12 55296 ----a-w- c:\windows\system32\msfeedsbs.dll
2012-06-03 01:12 . 2012-06-03 01:12 534528 ----a-w- c:\windows\system32\ieapfltr.dll
2012-06-03 01:12 . 2012-06-03 01:12 49664 ----a-w- c:\windows\system32\imgutil.dll
2012-06-03 01:12 . 2012-06-03 01:12 48640 ----a-w- c:\windows\system32\mshtmler.dll
2012-06-03 01:12 . 2012-06-03 01:12 452608 ----a-w- c:\windows\system32\dxtmsft.dll
2012-06-03 01:12 . 2012-06-03 01:12 448512 ----a-w- c:\windows\system32\html.iec
2012-06-03 01:12 . 2012-06-03 01:12 39936 ----a-w- c:\windows\system32\iernonce.dll
2012-06-03 01:12 . 2012-06-03 01:12 3695416 ----a-w- c:\windows\system32\ieapfltr.dat
2012-06-03 01:12 . 2012-06-03 01:12 35840 ----a-w- c:\windows\SysWow64\imgutil.dll
2012-06-03 01:12 . 2012-06-03 01:12 282112 ----a-w- c:\windows\system32\dxtrans.dll
2012-06-03 01:12 . 2012-06-03 01:12 267776 ----a-w- c:\windows\system32\ieaksie.dll
2012-06-03 01:12 . 2012-06-03 01:12 222208 ----a-w- c:\windows\system32\msls31.dll
2012-06-03 01:12 . 2012-06-03 01:12 197120 ----a-w- c:\windows\system32\msrating.dll
2012-06-03 01:12 . 2012-06-03 01:12 163840 ----a-w- c:\windows\system32\ieakui.dll
2012-06-03 01:12 . 2012-06-03 01:12 160256 ----a-w- c:\windows\system32\ieakeng.dll
2012-06-03 01:12 . 2012-06-03 01:12 149504 ----a-w- c:\windows\system32\occache.dll
2012-06-03 01:12 . 2012-06-03 01:12 145920 ----a-w- c:\windows\system32\iepeers.dll
2012-06-03 01:12 . 2012-06-03 01:12 135168 ----a-w- c:\windows\system32\IEAdvpack.dll
2012-06-03 01:12 . 2012-06-03 01:12 12288 ----a-w- c:\windows\system32\mshta.exe
2012-06-03 01:12 . 2012-06-03 01:12 11776 ----a-w- c:\windows\SysWow64\mshta.exe
2012-06-03 01:12 . 2012-06-03 01:12 114176 ----a-w- c:\windows\system32\admparse.dll
2012-06-03 01:12 . 2012-06-03 01:12 111616 ----a-w- c:\windows\system32\iesysprep.dll
2012-06-03 01:12 . 2012-06-03 01:12 10752 ----a-w- c:\windows\system32\msfeedssync.exe
2012-06-03 01:12 . 2012-06-03 01:12 101888 ----a-w- c:\windows\SysWow64\admparse.dll
2012-06-03 01:12 . 2012-06-03 01:12 403248 ----a-w- c:\windows\system32\iedkcs32.dll
2012-06-03 01:12 . 2012-06-03 01:12 697344 ----a-w- c:\windows\system32\msfeeds.dll
2012-06-03 01:12 . 2012-06-03 01:12 603648 ----a-w- c:\windows\system32\vbscript.dll
2012-06-03 01:12 . 2012-06-03 01:12 30720 ----a-w- c:\windows\system32\licmgr10.dll
2012-06-03 01:12 . 2012-06-03 01:12 249344 ----a-w- c:\windows\system32\webcheck.dll
2012-06-03 01:12 . 2012-06-03 01:12 165888 ----a-w- c:\windows\system32\iexpress.exe
2012-06-03 01:12 . 2012-06-03 01:12 160256 ----a-w- c:\windows\system32\wextract.exe
2012-06-03 01:12 . 2012-06-03 01:12 103936 ----a-w- c:\windows\system32\inseng.dll
2012-05-31 18:25 . 2010-11-21 03:27 279656 ------w- c:\windows\system32\MpSigStub.exe
2012-05-15 10:48 . 2012-06-02 14:34 68928 ----a-w- c:\windows\system32\OpenCL.dll
2012-05-15 10:48 . 2012-06-02 14:34 61248 ----a-w- c:\windows\SysWow64\OpenCL.dll
2012-05-15 10:48 . 2012-06-02 14:34 949056 ----a-w- c:\windows\system32\nvumdshimx.dll
2012-05-15 10:48 . 2012-06-02 14:34 818496 ----a-w- c:\windows\SysWow64\nvumdshim.dll
2012-05-15 10:48 . 2012-06-02 14:34 8139072 ----a-w- c:\windows\system32\nvcuda.dll
2012-05-15 10:48 . 2012-06-02 14:34 8105280 ----a-w- c:\windows\SysWow64\nvwgf2um.dll
2012-05-15 10:48 . 2012-06-02 14:34 5982528 ----a-w- c:\windows\SysWow64\nvcuda.dll
2012-05-15 10:48 . 2012-06-02 14:34 364352 ----a-w- c:\windows\system32\nvdecodemft.dll
2012-05-15 10:48 . 2012-06-02 14:34 301376 ----a-w- c:\windows\SysWow64\nvdecodemft.dll
2012-05-15 10:48 . 2012-06-02 14:34 2881856 ----a-w- c:\windows\system32\nvcuvenc.dll
2012-05-15 10:48 . 2012-06-02 14:34 2741568 ----a-w- c:\windows\system32\nvapi64.dll
2012-05-15 10:48 . 2012-06-02 14:34 2681664 ----a-w- c:\windows\system32\nvcuvid.dll
2012-05-15 10:48 . 2012-06-02 14:34 25743168 ----a-w- c:\windows\system32\nvoglv64.dll
2012-05-15 10:48 . 2012-06-02 14:34 2524992 ----a-w- c:\windows\SysWow64\nvcuvid.dll
2012-05-15 10:48 . 2012-06-02 14:34 25248064 ----a-w- c:\windows\system32\nvcompiler.dll
2012-05-15 10:48 . 2012-06-02 14:34 246592 ----a-w- c:\windows\system32\nvinitx.dll
2012-05-15 10:48 . 2012-06-02 14:34 2445120 ----a-w- c:\windows\SysWow64\nvcuvenc.dll
2012-05-15 10:48 . 2012-06-02 14:34 2368832 ----a-w- c:\windows\SysWow64\nvapi.dll
2012-05-15 10:48 . 2012-06-02 14:34 202048 ----a-w- c:\windows\SysWow64\nvinit.dll
2012-05-15 10:48 . 2012-06-02 14:34 19607872 ----a-w- c:\windows\SysWow64\nvoglv32.dll
2012-05-15 10:48 . 2012-06-02 14:34 18044224 ----a-w- c:\windows\system32\nvd3dumx.dll
2012-05-15 10:48 . 2012-06-02 14:34 17551680 ----a-w- c:\windows\SysWow64\nvcompiler.dll
2012-05-15 10:48 . 2012-06-02 14:34 1738048 ----a-w- c:\windows\system32\nvdispco64.dll
2012-05-15 10:48 . 2012-06-02 14:34 15322432 ----a-w- c:\windows\SysWow64\nvd3dum.dll
2012-05-15 10:48 . 2012-06-02 14:34 1468224 ----a-w- c:\windows\system32\nvgenco64.dll
2012-05-15 10:48 . 2012-06-02 14:34 14298944 ----a-w- c:\windows\system32\drivers\nvlddmkm.sys
2012-05-15 10:48 . 2012-06-02 14:34 10194752 ----a-w- c:\windows\system32\nvwgf2umx.dll
2012-05-15 09:29 . 2012-06-02 14:34 889664 ------w- c:\windows\system32\nvvsvc.exe
2012-05-15 09:29 . 2012-06-02 14:34 63296 ----a-w- c:\windows\system32\nvshext.dll
2012-05-15 09:29 . 2012-06-02 14:34 118080 ----a-w- c:\windows\system32\nvmctray.dll
2012-05-15 09:29 . 2012-06-02 14:34 2621723 ----a-w- c:\windows\system32\nvcoproc.bin
2012-05-15 09:29 . 2012-06-02 14:34 3149632 ----a-w- c:\windows\system32\nvsvc64.dll
2012-05-15 09:28 . 2012-06-02 14:34 6151488 ----a-w- c:\windows\system32\nvcpl.dll
2012-05-15 09:21 . 2012-05-15 09:21 423744 ----a-w- c:\windows\SysWow64\nvStreaming.exe
2012-05-04 11:06 . 2012-06-13 21:24 5559664 ----a-w- c:\windows\system32\ntoskrnl.exe
2012-05-04 10:03 . 2012-06-13 21:24 3968368 ----a-w- c:\windows\SysWow64\ntkrnlpa.exe
2012-05-04 10:03 . 2012-06-13 21:24 3913072 ----a-w- c:\windows\SysWow64\ntoskrnl.exe
2012-05-01 05:40 . 2012-06-13 21:24 209920 ----a-w- c:\windows\system32\profsvc.dll
2012-04-28 03:55 . 2012-06-13 21:24 210944 ----a-w- c:\windows\system32\drivers\rdpwd.sys
2012-04-26 05:41 . 2012-06-13 21:24 77312 ----a-w- c:\windows\system32\rdpwsx.dll
2012-04-26 05:41 . 2012-06-13 21:24 149504 ----a-w- c:\windows\system32\rdpcorekmts.dll
2012-04-26 05:34 . 2012-06-13 21:24 9216 ----a-w- c:\windows\system32\rdrmemptylst.exe
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Skype "= "c:\program files (x86)\Skype\Phone\Skype.exe" [2012-05-03 17355912]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"IAStorIcon "= "c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe" [2011-11-30 284440]
"APSDaemon "= "c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2012-05-31 59280]
"iTunesHelper "= "c:\program files (x86)\iTunes\iTunesHelper.exe" [2012-06-08 421776]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
McAfee Security Scan Plus.lnk - c:\program files (x86)\McAfee Security Scan\3.0.207\SSScheduler.exe [2011-6-17 272528]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin "= 5 (0x5)
"ConsentPromptBehaviorUser "= 3 (0x3)
"EnableUIADesktopToggle "= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]
"mixer4 "=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Security Packages REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp
.
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R2 gupdate;Google Update Service (gupdate);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-06-03 136176]
R2 IAStorDataMgrSvc;Intel(R) Rapid Storage Technology;c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [2011-11-30 13592]
R2 Norton PC Checkup Application Launcher;Norton PC Checkup Application Launcher;c:\program files (x86)\Norton PC Checkup\Engine\2.0.15.96\SymcPCCULaunchSvc.exe [x]
R2 nvUpdatusService;NVIDIA Update Service Daemon;c:\program files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe [2012-05-15 1262400]
R2 PCCUJobMgr;Common Client Job Manager Service;c:\program files (x86)\Norton PC Checkup\Engine\2.0.15.96\ccSvcHst.exe [x]
R2 UNS;Intel(R) Management and Security Application User Notification Service;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [2012-01-20 363800]
R3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-07-12 250056]
R3 bdsandbox;bdsandbox;c:\windows\system32\drivers\bdsandbox.sys [2011-11-18 79952]
R3 gupdatem;Google Update Service (gupdatem);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-06-03 136176]
R3 McComponentHostService;McAfee Security Scan Component Host Service;c:\program files (x86)\McAfee Security Scan\3.0.207\McCHSvc.exe [2011-06-17 237008]
R3 MozillaMaintenance;Mozilla Maintenance Service;c:\program files (x86)\Mozilla Maintenance Service\maintenanceservice.exe [2012-07-18 113120]
R3 SafeBox;SafeBox;c:\program files\Bitdefender\Bitdefender SafeBox\safeboxservice.exe [2012-02-21 75384]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-21 59392]
R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys [2010-11-21 31232]
R3 Update Server;BitDefender Update Server v2;c:\program files\Common Files\Bitdefender\Bitdefender Arrakis Server\bin\arrakis3.exe [2011-10-15 466736]
R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [2012-06-03 1255736]
S0 asahci64;asahci64;c:\windows\system32\DRIVERS\asahci64.sys [2012-01-06 49760]
S0 avc3;avc3;c:\windows\system32\DRIVERS\avc3.sys [2012-03-21 691896]
S0 iusb3hcs;Intel(R) USB 3.0 Host Controller Switch Driver;c:\windows\system32\DRIVERS\iusb3hcs.sys [2012-01-04 16152]
S1 BdfNdisf;BitDefender Firewall NDIS 6 Filter Driver;c:\program files\common files\bitdefender\bitdefender firewall\bdfndisf6.sys [2011-11-15 90192]
S1 bdfwfpf;bdfwfpf;c:\program files\Common Files\Bitdefender\Bitdefender Firewall\bdfwfpf.sys [2011-11-15 103504]
S1 BDVEDISK;BDVEDISK;c:\windows\system32\DRIVERS\bdvedisk.sys [2010-01-20 103944]
S2 Intel(R) Capability Licensing Service Interface;Intel(R) Capability Licensing Service Interface;c:\program files\Intel\iCLS Client\HeciServer.exe [2012-01-11 627936]
S2 Intel(R) PROSet Monitoring Service;Intel(R) PROSet Monitoring Service;c:\windows\system32\IProsetMonitor.exe [2011-08-16 178344]
S2 jhi_service;Intel(R) Dynamic Application Loader Host Interface Service;c:\program files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [2012-01-20 161560]
S2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe [2012-05-03 158856]
S2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [2012-05-15 382272]
S2 UPDATESRV;BitDefender Desktop Update Service;c:\program files\Bitdefender\Bitdefender 2012\updatesrv.exe [2012-03-14 66096]
S2 WINZIPSSDiskOptimizer;WINZIPSSDiskOptimizer;c:\program files (x86)\WinZip System Utilities Suite\WINZIPSSDefragSrv64.exe [2011-11-10 628040]
S3 asmthub3;ASMedia USB3 Hub Service;c:\windows\system32\DRIVERS\asmthub3.sys [2011-11-03 130536]
S3 asmtxhci;ASMEDIA XHCI Service;c:\windows\system32\DRIVERS\asmtxhci.sys [2011-11-03 395752]
S3 avchv;avchv Function Driver;c:\windows\system32\DRIVERS\avchv.sys [2011-11-25 258736]
S3 avckf;avckf;c:\windows\system32\DRIVERS\avckf.sys [2012-02-17 545064]
S3 e1cexpress;Intel(R) PRO/1000 PCI Express Network Connection Driver C;c:\windows\system32\DRIVERS\e1c62x64.sys [2011-07-20 342704]
S3 iusb3hub;Intel(R) USB 3.0 Hub Driver;c:\windows\system32\DRIVERS\iusb3hub.sys [2012-01-04 355096]
S3 iusb3xhc;Intel(R) USB 3.0 eXtensible Host Controller Driver;c:\windows\system32\DRIVERS\iusb3xhc.sys [2012-01-04 786200]
S3 LGBusEnum;Logitech GamePanel Virtual Bus Enumerator Driver;c:\windows\system32\drivers\LGBusEnum.sys [2009-11-24 22408]
S3 LGVirHid;Logitech Gamepanel Virtual HID Device Driver;c:\windows\system32\drivers\LGVirHid.sys [2009-11-24 16008]
S3 MEIx64;Intel(R) Management Engine Interface ;c:\windows\system32\DRIVERS\HECIx64.sys [2011-11-10 60184]
S3 NVHDA;Service for NVIDIA High Definition Audio Driver;c:\windows\system32\drivers\nvhda64v.sys [2012-04-18 188736]
.
.
--- Other Services/Drivers In Memory ---
.
*NewlyCreated* - WS2IFSL
.
Contents of the 'Scheduled Tasks' folder
.
2012-07-20 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-06-05 17:57]
.
2012-07-20 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-06-03 03:11]
.
2012-07-20 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-06-03 03:11]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\__SafeBox1]
@= "{152C96EB-288E-4EDC-B7C6-D21F8250ADF3} "
[HKEY_CLASSES_ROOT\CLSID\{152C96EB-288E-4EDC-B7C6-D21F8250ADF3}]
2012-02-22 20:55 266952 ----a-w- c:\program files\Bitdefender\Bitdefender Safebox\safeboxshell.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\__SafeBox2]
@= "{342DAA0B-D796-460D-8566-901E08A1CCAD} "
[HKEY_CLASSES_ROOT\CLSID\{342DAA0B-D796-460D-8566-901E08A1CCAD}]
2012-02-22 20:55 266952 ----a-w- c:\program files\Bitdefender\Bitdefender Safebox\safeboxshell.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\__SafeBox3]
@= "{57595DAE-1AE1-4D97-A49E-67CBB53B52DF} "
[HKEY_CLASSES_ROOT\CLSID\{57595DAE-1AE1-4D97-A49E-67CBB53B52DF}]
2012-02-22 20:55 266952 ----a-w- c:\program files\Bitdefender\Bitdefender Safebox\safeboxshell.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\__SafeBox4]
@= "{33816773-98AE-4723-ADE0-EBE54C8B5A67} "
[HKEY_CLASSES_ROOT\CLSID\{33816773-98AE-4723-ADE0-EBE54C8B5A67}]
2012-02-22 20:55 266952 ----a-w- c:\program files\Bitdefender\Bitdefender Safebox\safeboxshell.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RTHDVCPL "= "c:\program files\Realtek\Audio\HDA\RtkNGUI64.exe" [2011-12-28 6457960]
"BDAgent "= "c:\program files\Bitdefender\Bitdefender 2012\bdagent.exe" [2012-03-22 1067256]
"Launch LgDeviceAgent "= "c:\program files\Logitech\GamePanel Software\LgDevAgt.exe" [2010-06-11 415816]
"Launch LCDMon "= "c:\program files\Logitech\GamePanel Software\LCD Manager\LCDMon.exe" [2010-06-11 2413128]
"Launch LGDCore "= "c:\program files\Logitech\GamePanel Software\G-series Software\LGDCore.exe" [2010-06-11 4725320]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"LoadAppInit_DLLs "=0x0
.
------- Supplementary Scan -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = about:blank
mStart Page = about:blank
mLocal Page = c:\windows\SysWOW64\blank.htm
uInternet Settings,ProxyOverride = *.local
IE: Google Sidewiki... - c:\program files (x86)\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_6CE5017F567343CA.dll/cmsidewiki.html
TCP: DhcpNameServer = 192.168.2.1
TCP: Interfaces\{843E1C77-AFD7-4674-A370-ABABECDFF4F3}: NameServer = 8.8.8.8,8.8.4.4
FF - ProfilePath - c:\users\AdmSirRed\AppData\Roaming\Mozilla\Firefox\Profiles\kljwythy.default\
.
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\services\PCCUJobMgr]
"ImagePath "= "\ "c:\program files (x86)\Norton PC Checkup\Engine\2.0.15.96\ccSvcHst.exe\" /s \ "PCCUJobMgr\" /m \ "c:\program files (x86)\Norton PC Checkup\Engine\2.0.15.96\diMaster.dll\" /prefetch:1 "
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
------------------------ Other Running Processes ------------------------
.
c:\program files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
c:\program files (x86)\Windows Media Player\wmplayer.exe
.
**************************************************************************
.
Completion time: 2012-07-20 17:28:33 - machine was rebooted
ComboFix-quarantined-files.txt 2012-07-20 23:28
.
Pre-Run: 7,947,710,464 bytes free
Post-Run: 8,863,690,752 bytes free
.
- - End Of File - - 36EF9727539F2A818B56EC3E33E2E4AC

 

no everything is working fine, i have not seen any problem since the Mbam scan, thank you very much for all your help on this. and thanks for the advice on the Virus scanners. running the new scan now.

 

OTL logfile created on: 7/20/2012 10:29:34 PM - Run 1
OTL by OldTimer - Version 3.2.53.1 Folder = C:\Users\AdmSirRed\Downloads
64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

15.96 Gb Total Physical Memory | 14.14 Gb Available Physical Memory | 88.60% Memory free
31.91 Gb Paging File | 30.03 Gb Available in Paging File | 94.12% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 119.14 Gb Total Space | 8.83 Gb Free Space | 7.41% Space Free | Partition Type: NTFS
Drive D: | 244.75 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS

Computer Name: ADMSIRRED-PC | User Name: AdmSirRed | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2012/07/20 22:27:05 | 000,595,968 | ---- | M] (OldTimer Tools) -- C:\Users\AdmSirRed\Downloads\OTL.exe
PRC - [2012/05/15 04:48:00 | 001,262,400 | ---- | M] (NVIDIA Corporation) -- C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
PRC - [2012/05/15 03:21:40 | 000,382,272 | ---- | M] (NVIDIA Corporation) -- C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
PRC - [2012/01/20 17:29:28 | 000,363,800 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
PRC - [2012/01/20 17:29:26 | 000,277,784 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
PRC - [2012/01/20 12:45:40 | 000,161,560 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\Jhi_service.exe
PRC - [2011/11/29 21:04:56 | 000,013,592 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
PRC - [2011/11/29 21:04:54 | 000,284,440 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
PRC - [2011/06/17 11:33:04 | 000,272,528 | ---- | M] (McAfee, Inc.) -- C:\Program Files (x86)\McAfee Security Scan\3.0.207\SSScheduler.exe
PRC - [2010/11/20 21:25:10 | 000,164,864 | ---- | M] (Microsoft Corporation) -- C:\Program Files (x86)\Windows Media Player\wmplayer.exe


========== Modules (No Company Name) ==========

MOD - [2012/06/14 03:28:16 | 000,487,424 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\IAStorUtil\33e53ffe7ba7362a2d483ef4ea79bfe3\IAStorUtil.ni.dll
MOD - [2012/06/14 03:22:20 | 012,436,480 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\7b7fbe651c6e72f12099a298654c9594\System.Windows.Forms.ni.dll
MOD - [2012/06/14 03:22:17 | 001,591,808 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\6bb439b3f87736d3248ae27d43e2c0d6\System.Drawing.ni.dll
MOD - [2012/06/06 04:14:24 | 003,347,968 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\WindowsBase\46fce56db7685a586d3eeb7c373e3c1c\WindowsBase.ni.dll
MOD - [2012/06/06 04:14:24 | 000,771,584 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Runtime.Remo#\03dee80574f4ec770b6f77ca030ded6c\System.Runtime.Remoting.ni.dll
MOD - [2012/06/06 04:14:24 | 000,014,336 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\IAStorCommon\acc563eb665e430df4375afb9697a5d9\IAStorCommon.ni.dll
MOD - [2012/06/06 04:14:14 | 005,452,800 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Xml\ba3d70b651454c7d49b407b93663bfed\System.Xml.ni.dll
MOD - [2012/06/06 04:14:12 | 007,967,232 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System\ce9ff6baf9053ed2ed673d948179195c\System.ni.dll
MOD - [2012/06/06 04:14:12 | 000,971,264 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Configuration\cfa9c506bfb9254c89dace7b83bc9f9d\System.Configuration.ni.dll
MOD - [2012/06/06 04:14:09 | 011,492,864 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\acfc1391e45fedd2a359778ea57d914c\mscorlib.ni.dll
MOD - [2012/05/30 20:06:48 | 000,087,912 | ---- | M] () -- C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll
MOD - [2012/05/30 20:06:30 | 001,242,512 | ---- | M] () -- C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll


========== Win32 Services (SafeList) ==========

SRV:64bit: - [2012/03/23 17:44:02 | 001,956,616 | ---- | M] (Bitdefender) [Auto | Running] -- C:\Program Files\Bitdefender\Bitdefender 2012\vsserv.exe -- (VSSERV)
SRV:64bit: - [2012/03/13 19:26:10 | 000,066,096 | ---- | M] (Bitdefender) [Auto | Running] -- C:\Program Files\Bitdefender\Bitdefender 2012\updatesrv.exe -- (UPDATESRV)
SRV:64bit: - [2012/02/21 15:04:12 | 000,075,384 | ---- | M] (Bitdefender) [On_Demand | Stopped] -- C:\Program Files\Bitdefender\Bitdefender Safebox\safeboxservice.exe -- (SafeBox)
SRV:64bit: - [2012/01/10 22:01:52 | 000,627,936 | ---- | M] (Intel(R) Corporation) [Auto | Running] -- C:\Program Files\Intel\iCLS Client\HeciServer.exe -- (Intel(R) Capability Licensing Service Interface) Intel(R)
SRV:64bit: - [2011/10/15 00:57:26 | 000,466,736 | ---- | M] (BitDefender) [On_Demand | Stopped] -- C:\Program Files\Common Files\Bitdefender\Bitdefender Arrakis Server\bin\arrakis3.exe -- (Update Server)
SRV:64bit: - [2011/08/15 18:38:50 | 000,178,344 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Windows\SysNative\IPROSetMonitor.exe -- (Intel(R) PROSet Monitoring Service) Intel(R)
SRV:64bit: - [2009/07/13 19:41:27 | 001,011,712 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)
SRV - [2012/07/18 15:14:27 | 000,113,120 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)
SRV - [2012/07/12 11:57:25 | 000,250,056 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)
SRV - [2012/05/15 04:48:00 | 001,262,400 | ---- | M] (NVIDIA Corporation) [Auto | Running] -- C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe -- (nvUpdatusService)
SRV - [2012/05/15 03:21:40 | 000,382,272 | ---- | M] (NVIDIA Corporation) [Auto | Running] -- C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe -- (Stereo Service)
SRV - [2012/05/03 09:31:10 | 000,158,856 | R--- | M] (Skype Technologies) [Auto | Stopped] -- C:\Program Files (x86)\Skype\Updater\Updater.exe -- (SkypeUpdate)
SRV - [2012/01/20 17:29:28 | 000,363,800 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe -- (UNS) Intel(R)
SRV - [2012/01/20 17:29:26 | 000,277,784 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe -- (LMS) Intel(R)
SRV - [2012/01/20 12:45:40 | 000,161,560 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\Jhi_service.exe -- (jhi_service) Intel(R)
SRV - [2011/11/29 21:04:56 | 000,013,592 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe -- (IAStorDataMgrSvc) Intel(R)
SRV - [2011/11/10 11:33:10 | 000,628,040 | ---- | M] (WinZip Computing, S.L. (WinZip Computing)) [Auto | Running] -- C:\Program Files (x86)\WinZip System Utilities Suite\WINZIPSSDefragSrv64.exe -- (WINZIPSSDiskOptimizer)
SRV - [2011/06/17 11:33:04 | 000,237,008 | ---- | M] (McAfee, Inc.) [On_Demand | Stopped] -- C:\Program Files (x86)\McAfee Security Scan\3.0.207\McCHSvc.exe -- (McComponentHostService)
SRV - [2010/03/18 14:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)
SRV - [2009/06/10 15:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)


========== Driver Services (SafeList) ==========

DRV:64bit: - [2012/04/18 11:08:03 | 000,188,736 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\nvhda64v.sys -- (NVHDA)
DRV:64bit: - [2012/03/20 21:22:46 | 000,691,896 | ---- | M] (BitDefender) [File_System | Boot | Running] -- C:\Windows\SysNative\drivers\avc3.sys -- (avc3)
DRV:64bit: - [2012/03/01 00:46:16 | 000,023,408 | ---- | M] (Microsoft Corporation) [Recognizer | Boot | Unknown] -- C:\Windows\SysNative\drivers\fs_rec.sys -- (Fs_Rec)
DRV:64bit: - [2012/02/17 17:45:56 | 000,545,064 | ---- | M] (BitDefender) [File_System | On_Demand | Running] -- C:\Windows\SysNative\drivers\avckf.sys -- (avckf)
DRV:64bit: - [2012/01/06 11:44:12 | 000,049,760 | ---- | M] (Asmedia Technology) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\asahci64.sys -- (asahci64)
DRV:64bit: - [2012/01/04 13:58:50 | 000,786,200 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\iusb3xhc.sys -- (iusb3xhc) Intel(R)
DRV:64bit: - [2012/01/04 13:58:50 | 000,355,096 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\iusb3hub.sys -- (iusb3hub) Intel(R)
DRV:64bit: - [2012/01/04 13:58:50 | 000,016,152 | ---- | M] (Intel Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\iusb3hcs.sys -- (iusb3hcs) Intel(R)
DRV:64bit: - [2011/11/29 20:40:32 | 000,568,600 | ---- | M] (Intel Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\iaStor.sys -- (iaStor)
DRV:64bit: - [2011/11/25 16:00:36 | 000,258,736 | ---- | M] (BitDefender) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\avchv.sys -- (avchv)
DRV:64bit: - [2011/11/17 18:38:34 | 000,079,952 | ---- | M] (BitDefender SRL) [File_System | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bdsandbox.sys -- (bdsandbox)
DRV:64bit: - [2011/11/14 21:16:42 | 000,090,192 | ---- | M] (BitDefender LLC) [Kernel | System | Running] -- c:\Program Files\Common Files\Bitdefender\Bitdefender Firewall\bdfndisf6.sys -- (BdfNdisf)
DRV:64bit: - [2011/11/14 21:16:38 | 000,103,504 | ---- | M] (BitDefender LLC) [Kernel | System | Running] -- C:\Program Files\Common Files\Bitdefender\Bitdefender Firewall\bdfwfpf.sys -- (bdfwfpf)
DRV:64bit: - [2011/11/10 02:04:14 | 000,060,184 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\HECIx64.sys -- (MEIx64) Intel(R)
DRV:64bit: - [2011/11/03 12:10:42 | 000,395,752 | ---- | M] (ASMedia Technology Inc) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\asmtxhci.sys -- (asmtxhci)
DRV:64bit: - [2011/11/03 12:10:42 | 000,130,536 | ---- | M] (ASMedia Technology Inc) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\asmthub3.sys -- (asmthub3)
DRV:64bit: - [2011/10/27 16:07:05 | 000,329,800 | ---- | M] (BitDefender S.R.L.) [File_System | Boot | Running] -- C:\Windows\SysNative\drivers\trufos.sys -- (trufos)
DRV:64bit: - [2011/08/16 15:59:12 | 000,442,088 | ---- | M] (BitDefender) [File_System | Boot | Running] -- C:\Windows\SysNative\drivers\bdfsfltr.sys -- (bdfsfltr)
DRV:64bit: - [2011/07/19 19:37:56 | 000,342,704 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\e1c62x64.sys -- (e1cexpress) Intel(R)
DRV:64bit: - [2011/03/11 00:41:12 | 000,107,904 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata)
DRV:64bit: - [2011/03/11 00:41:12 | 000,027,008 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata)
DRV:64bit: - [2010/11/20 21:24:33 | 000,059,392 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbFlt.sys -- (TsUsbFlt)
DRV:64bit: - [2010/11/20 21:23:47 | 000,078,720 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD)
DRV:64bit: - [2010/11/20 21:23:47 | 000,031,232 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbGD.sys -- (TsUsbGD)
DRV:64bit: - [2010/01/19 20:32:40 | 000,103,944 | ---- | M] (BitDefender) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\bdvedisk.sys -- (BDVEDISK)
DRV:64bit: - [2009/11/23 18:38:00 | 000,016,008 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\LGVirHid.sys -- (LGVirHid)
DRV:64bit: - [2009/11/23 18:37:50 | 000,022,408 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\LGBusEnum.sys -- (LGBusEnum)
DRV:64bit: - [2009/07/13 19:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs)
DRV:64bit: - [2009/07/13 19:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2)
DRV:64bit: - [2009/07/13 19:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor)
DRV:64bit: - [2009/06/10 14:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv)
DRV:64bit: - [2009/06/10 14:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv)
DRV:64bit: - [2009/06/10 14:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a)
DRV:64bit: - [2009/06/10 14:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir)
DRV:64bit: - [2009/05/18 13:17:08 | 000,034,152 | ---- | M] (GEAR Software Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\GEARAspiWDM.sys -- (GEARAspiWDM)
DRV - [2009/07/13 19:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = about:blank
IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC


IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0



IE - HKU\S-1-5-21-2548554056-3466161380-310394626-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = about:blank
IE - HKU\S-1-5-21-2548554056-3466161380-310394626-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = en-US
IE - HKU\S-1-5-21-2548554056-3466161380-310394626-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 81 94 DB E0 E9 59 CD 01 [binary data]
IE - HKU\S-1-5-21-2548554056-3466161380-310394626-1000\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKU\S-1-5-21-2548554056-3466161380-310394626-1000\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC
IE - HKU\S-1-5-21-2548554056-3466161380-310394626-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-21-2548554056-3466161380-310394626-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local


========== FireFox ==========

FF - user.js - File not found

FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_3_300_265.dll File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_3_300_265.dll ()
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@intel-webapi.intel.com/Intel WebAPI ipt;version=2.0.59: C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation)
FF - HKLM\Software\MozillaPlugins\@intel-webapi.intel.com/Intel WebAPI updater: C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files (x86)\Microsoft Silverlight\4.1.10329.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVision: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVisionStreaming: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF - HKLM\Software\MozillaPlugins\@pandonetworks.com/PandoWebPlugin: C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.21.115\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.21.115\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=2.0.1: C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF - HKCU\Software\MozillaPlugins\pandonetworks.com/PandoWebPlugin: C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)

64bit-FF - HKEY_LOCAL_MACHINE\software\mozilla\Thunderbird\Extensions\\bdThunderbird@bitdefender.com: C:\PROGRAM FILES\BITDEFENDER\BITDEFENDER 2012\BDTBEXT\ [2012/06/02 09:49:20 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 14.0.1\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012/07/18 15:14:27 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 14.0.1\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins
FF - HKEY_LOCAL_MACHINE\software\mozilla\Thunderbird\Extensions\\bdThunderbird@bitdefender.com: C:\Program Files\Bitdefender\Bitdefender 2012\bdtbext\ [2012/06/02 09:49:20 | 000,000,000 | ---D | M]

[2012/06/02 08:33:31 | 000,000,000 | ---D | M] (No name found) -- C:\Users\AdmSirRed\AppData\Roaming\Mozilla\Extensions
[2012/06/07 08:33:05 | 000,000,000 | ---D | M] (No name found) -- C:\Users\AdmSirRed\AppData\Roaming\Mozilla\Firefox\Profiles\kljwythy.default\extensions
[2012/06/07 08:33:05 | 000,000,000 | ---D | M] (WOT) -- C:\Users\AdmSirRed\AppData\Roaming\Mozilla\Firefox\Profiles\kljwythy.default\extensions\{a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7}
[2012/06/02 08:33:20 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\Mozilla Firefox\extensions
[2012/07/18 15:14:27 | 000,136,672 | ---- | M] (Mozilla Foundation) -- C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll
[2012/06/18 04:13:15 | 000,002,252 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml
[2012/06/18 04:13:15 | 000,002,040 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\twitter.xml

========== Chrome ==========

CHR - default_search_provider: Google (Enabled)
CHR - default_search_provider: search_url = {google:baseURL}search?{google:RLZ}{google:acceptedSuggestion}{googleriginalQueryForSuggestion}{google:searchFieldtrialParameter}{google:instantFieldTrialGroupParameter}sourceid=chrome&ie={inputEncoding}&q={searchTerms}
CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}{google:instantFieldTrialGroupParameter}client=chrome&hl={language}&q={searchTerms}
CHR - plugin: Remoting Viewer (Enabled) = internal-remoting-viewer
CHR - plugin: Native Client (Enabled) = C:\Program Files (x86)\Google\Chrome\Application\19.0.1084.52\ppGoogleNaClPluginChrome.dll
CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Program Files (x86)\Google\Chrome\Application\19.0.1084.52\pdf.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Program Files (x86)\Google\Chrome\Application\19.0.1084.52\gcswf32.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_2_202_235.dll
CHR - plugin: Google Update (Enabled) = C:\Program Files (x86)\Google\Update\1.3.21.111\npGoogleUpdate3.dll
CHR - plugin: Intel\u00AE Identity Protection Technology (Enabled) = C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll
CHR - plugin: Intel\u00AE Identity Protection Technology (Enabled) = C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll
CHR - plugin: NVIDIA 3D Vision (Enabled) = C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll
CHR - plugin: NVIDIA 3D VISION (Enabled) = C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll
CHR - plugin: Pando Web Plugin (Enabled) = C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll
CHR - plugin: VLC Web Plugin (Enabled) = C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll
CHR - Extension: WOT = C:\Users\AdmSirRed\AppData\Local\Google\Chrome\User Data\Default\Extensions\bhmmomiinigofkjcapegjjndpbikblnp\1.2.14_0\

O1 HOSTS File: ([2012/07/20 17:26:43 | 000,000,027 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O3 - HKU\S-1-5-21-2548554056-3466161380-310394626-1000\..\Toolbar\WebBrowser: (no name) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No CLSID value found.
O4:64bit: - HKLM..\Run: [BDAgent] C:\Program Files\Bitdefender\Bitdefender 2012\bdagent.exe (Bitdefender)
O4:64bit: - HKLM..\Run: [Launch LCDMon] C:\Program Files\Logitech\GamePanel Software\LCD Manager\LCDMon.exe (Logitech Inc.)
O4:64bit: - HKLM..\Run: [Launch LGDCore] C:\Program Files\Logitech\GamePanel Software\G-series Software\LGDCore.exe (Logitech Inc.)
O4:64bit: - HKLM..\Run: [Launch LgDeviceAgent] C:\Program Files\Logitech\GamePanel Software\LgDevAgt.exe (Logitech Inc.)
O4:64bit: - HKLM..\Run: [RTHDVCPL] C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe (Realtek Semiconductor)
O4 - HKLM..\Run: [APSDaemon] C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
O4 - HKLM..\Run: [IAStorIcon] C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe (Intel Corporation)
O4 - HKU\S-1-5-21-2548554056-3466161380-310394626-1001..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
O4 - HKU\S-1-5-21-2548554056-3466161380-310394626-1001..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-2548554056-3466161380-310394626-1000\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-2548554056-3466161380-310394626-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKU\S-1-5-21-2548554056-3466161380-310394626-1001\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8:64bit: - Extra context menu item: Google Sidewiki... - res://C:\Program Files (x86)\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_6CE5017F567343CA.dll/cmsidewiki.html File not found
O8 - Extra context menu item: Google Sidewiki... - res://C:\Program Files (x86)\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_6CE5017F567343CA.dll/cmsidewiki.html File not found
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000009 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000009 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{843E1C77-AFD7-4674-A370-ABABECDFF4F3}: DhcpNameServer = 192.168.2.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{843E1C77-AFD7-4674-A370-ABABECDFF4F3}: NameServer = 8.8.8.8,8.8.4.4
O18:64bit: - Protocol\Handler\livecall - No CLSID value found
O18:64bit: - Protocol\Handler\msnim - No CLSID value found
O18:64bit: - Protocol\Handler\skype4com - No CLSID value found
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O20:64bit: - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysNative\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysWOW64\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009/08/14 08:50:55 | 000,000,046 | R--- | M] () - D:\Autorun.inf -- [ CDFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:64bit: - HKLM\...com [@ = ComFile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = ComFile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)

========== Files/Folders - Created Within 30 Days ==========

[2012/07/20 17:21:14 | 000,518,144 | ---- | C] (SteelWerX) -- C:\Windows\SWREG.exe
[2012/07/20 17:21:14 | 000,406,528 | ---- | C] (SteelWerX) -- C:\Windows\SWSC.exe
[2012/07/20 17:21:14 | 000,060,416 | ---- | C] (NirSoft) -- C:\Windows\NIRCMD.exe
[2012/07/20 17:20:50 | 000,000,000 | ---D | C] -- C:\Qoobox
[2012/07/20 17:20:44 | 000,000,000 | ---D | C] -- C:\Windows\erdnt
[2012/07/19 17:54:16 | 004,582,461 | R--- | C] (Swearware) -- C:\Users\AdmSirRed\Desktop\ComboFix.exe
[2012/07/19 07:46:32 | 000,000,000 | ---D | C] -- C:\Users\AdmSirRed\Desktop\RK_Quarantine
[2012/07/18 20:04:24 | 000,000,000 | ---D | C] -- C:\Users\AdmSirRed\AppData\Local\{486D5A1C-0B1E-4E81-8B39-440E2D39B8A3}
[2012/07/18 20:04:03 | 000,000,000 | ---D | C] -- C:\Users\AdmSirRed\AppData\Local\{31756B3B-0B8B-44E1-8933-DDDE384E9710}
[2012/07/18 15:52:48 | 000,000,000 | ---D | C] -- C:\Users\AdmSirRed\AppData\Roaming\Malwarebytes
[2012/07/18 15:47:23 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2012/07/18 15:46:23 | 000,024,904 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys
[2012/07/18 15:46:23 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2012/07/18 15:45:57 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware
[2012/07/18 08:03:40 | 000,000,000 | ---D | C] -- C:\Users\AdmSirRed\AppData\Local\{C77E6CA8-6574-4510-8252-F0C5115B9642}
[2012/07/18 08:03:30 | 000,000,000 | ---D | C] -- C:\Users\AdmSirRed\AppData\Local\{D3997366-3698-47C3-B0A8-5FF03E7CE8C5}
[2012/07/17 08:55:27 | 000,000,000 | ---D | C] -- C:\Users\AdmSirRed\AppData\Local\{7E6918DB-B649-45E1-AAF7-4AA2433216C0}
[2012/07/16 20:54:54 | 000,000,000 | ---D | C] -- C:\Users\AdmSirRed\AppData\Local\{528BF5D0-AF54-455E-AB23-884332656ABB}
[2012/07/16 20:54:44 | 000,000,000 | ---D | C] -- C:\Users\AdmSirRed\AppData\Local\{ADA689EE-FF5A-442F-B986-D215D9D40D01}
[2012/07/16 20:47:18 | 000,000,000 | ---D | C] -- C:\Users\AdmSirRed\AppData\Local\{2B0E71C0-FF6B-450F-90FF-80F1AB0C2BBD}
[2012/07/16 20:47:08 | 000,000,000 | ---D | C] -- C:\Users\AdmSirRed\AppData\Local\{DF2E9330-2B2A-47FB-BC30-8556C2243E98}
[2012/07/16 19:55:59 | 000,000,000 | ---D | C] -- C:\Users\AdmSirRed\AppData\Local\{EC9E218B-381D-4439-8198-0D0226FFD17A}
[2012/07/16 19:55:49 | 000,000,000 | ---D | C] -- C:\Users\AdmSirRed\AppData\Local\{4D8E55F2-8ABE-4100-B9CF-2654162B92C1}
[2012/07/15 10:33:56 | 000,000,000 | ---D | C] -- C:\Users\AdmSirRed\AppData\Local\{B612C438-828C-4053-9381-D6D7063A47EC}
[2012/07/15 10:33:35 | 000,000,000 | ---D | C] -- C:\Users\AdmSirRed\AppData\Local\{0D4A8492-7783-4492-9FD3-9473E9932966}
[2012/07/14 07:32:22 | 000,000,000 | ---D | C] -- C:\Users\AdmSirRed\AppData\Local\{50ADD90C-6BE4-45A5-8EA9-73873D67601A}
[2012/07/14 07:32:01 | 000,000,000 | ---D | C] -- C:\Users\AdmSirRed\AppData\Local\{21538009-A62E-4147-A3E2-E6C5F4B795D5}
[2012/07/13 07:35:51 | 000,000,000 | ---D | C] -- C:\Users\AdmSirRed\AppData\Local\{B3B45741-ED1F-48BC-ACB6-6F6D421B8C78}
[2012/07/13 07:35:31 | 000,000,000 | ---D | C] -- C:\Users\AdmSirRed\AppData\Local\{3538BB2D-5AB5-4882-93D0-5CB200D51606}
[2012/07/12 07:31:27 | 000,000,000 | ---D | C] -- C:\Users\AdmSirRed\AppData\Local\{B31D6124-46CA-4717-A1BB-8BCE388470B1}
[2012/07/12 07:31:05 | 000,000,000 | ---D | C] -- C:\Users\AdmSirRed\AppData\Local\{7D6BDEA6-0E19-4E95-8FCE-E1F2DF97E143}
[2012/07/11 05:22:14 | 000,000,000 | ---D | C] -- C:\Users\AdmSirRed\AppData\Local\{9A2A729B-468F-4B30-960B-3A62686B9710}
[2012/07/11 05:21:52 | 000,000,000 | ---D | C] -- C:\Users\AdmSirRed\AppData\Local\{435A9FF2-E052-4A47-BD54-2D49AA63504D}
[2012/07/11 03:00:35 | 000,096,768 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\mshtmled.dll
[2012/07/11 03:00:35 | 000,073,216 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\mshtmled.dll
[2012/07/11 03:00:34 | 000,237,056 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\url.dll
[2012/07/11 03:00:34 | 000,231,936 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\url.dll
[2012/07/11 03:00:34 | 000,176,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieui.dll
[2012/07/11 03:00:33 | 000,248,320 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieui.dll
[2012/07/11 03:00:32 | 000,173,056 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieUnatt.exe
[2012/07/11 03:00:32 | 000,142,848 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieUnatt.exe
[2012/07/11 03:00:31 | 002,311,680 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\jscript9.dll
[2012/07/11 03:00:31 | 001,494,528 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\inetcpl.cpl
[2012/07/11 03:00:31 | 001,427,968 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\inetcpl.cpl
[2012/07/11 03:00:31 | 000,818,688 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\jscript.dll
[2012/07/11 03:00:31 | 000,716,800 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\jscript.dll
[2012/07/10 17:57:56 | 000,002,048 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\msxml3r.dll
[2012/07/10 17:57:56 | 000,002,048 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\msxml3r.dll
[2012/07/10 17:57:55 | 000,307,200 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ncrypt.dll
[2012/07/10 17:57:54 | 000,805,376 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\cdosys.dll
[2012/07/10 17:57:53 | 001,133,568 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\cdosys.dll
[2012/07/10 17:21:29 | 000,000,000 | ---D | C] -- C:\Users\AdmSirRed\AppData\Local\{66ACA72A-55B5-489B-A744-14CF7D403DB2}
[2012/07/10 17:21:08 | 000,000,000 | ---D | C] -- C:\Users\AdmSirRed\AppData\Local\{FBDA3606-025D-4807-BEF6-D4167705EF3D}
[2012/07/10 05:20:45 | 000,000,000 | ---D | C] -- C:\Users\AdmSirRed\AppData\Local\{4110D491-4680-48B2-881C-1791594895D6}
[2012/07/10 05:20:35 | 000,000,000 | ---D | C] -- C:\Users\AdmSirRed\AppData\Local\{B164E7DE-D59B-4ED0-8218-53F8D7456419}
[2012/07/08 10:03:32 | 000,000,000 | ---D | C] -- C:\Users\AdmSirRed\riotsGamesLogs
[2012/07/07 19:57:41 | 000,000,000 | ---D | C] -- C:\Users\AdmSirRed\AppData\Local\{8CE48805-1D71-4188-8460-C6C449BFF62C}
[2012/07/07 19:57:20 | 000,000,000 | ---D | C] -- C:\Users\AdmSirRed\AppData\Local\{B72CB961-CF76-46DE-ABF6-DC91CA89411D}
[2012/07/07 07:34:33 | 000,000,000 | ---D | C] -- C:\Users\AdmSirRed\AppData\Local\{DC97053A-2DF3-469F-B392-2649EF324C67}
[2012/07/07 07:34:13 | 000,000,000 | ---D | C] -- C:\Users\AdmSirRed\AppData\Local\{2878F86F-95A5-4A1B-A19A-930EF8AECC1B}
[2012/07/06 07:41:58 | 000,000,000 | ---D | C] -- C:\Users\AdmSirRed\AppData\Local\{06F59B4A-D2BD-4A7A-9DF7-E893144D5B0B}
[2012/07/06 07:41:37 | 000,000,000 | ---D | C] -- C:\Users\AdmSirRed\AppData\Local\{F0F14B46-3FE2-483D-9B3E-18892710C3BB}
[2012/07/03 16:09:35 | 000,000,000 | ---D | C] -- C:\Users\AdmSirRed\AppData\Local\{E2A67940-9805-47CE-9F96-98D7AD99BDD6}
[2012/07/03 16:09:14 | 000,000,000 | ---D | C] -- C:\Users\AdmSirRed\AppData\Local\{B4D5B7B4-C4AB-4B71-A9C8-12313CCEC8FF}
[2012/07/03 07:15:10 | 000,000,000 | ---D | C] -- C:\Users\AdmSirRed\AppData\Roaming\Apple Computer
[2012/07/03 07:15:10 | 000,000,000 | ---D | C] -- C:\Users\AdmSirRed\AppData\Local\Apple Computer
[2012/07/03 07:15:09 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes
[2012/07/03 07:15:03 | 000,126,312 | ---- | C] (GEAR Software Inc.) -- C:\Windows\SysNative\GEARAspi64.dll
[2012/07/03 07:15:03 | 000,107,368 | ---- | C] (GEAR Software Inc.) -- C:\Windows\SysWow64\GEARAspi.dll
[2012/07/03 07:15:03 | 000,034,152 | ---- | C] (GEAR Software Inc.) -- C:\Windows\SysNative\drivers\GEARAspiWDM.sys
[2012/07/03 07:15:03 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\DRVSTORE
[2012/07/03 07:14:50 | 000,000,000 | ---D | C] -- C:\Program Files\iTunes
[2012/07/03 07:14:50 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\iTunes
[2012/07/03 07:14:50 | 000,000,000 | ---D | C] -- C:\Program Files\iPod
[2012/07/03 07:14:50 | 000,000,000 | ---D | C] -- C:\ProgramData\Apple Computer
[2012/07/03 07:14:50 | 000,000,000 | ---D | C] -- C:\ProgramData\{93E26451-CD9A-43A5-A2FA-C42392EA4001}
[2012/07/03 07:14:39 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Apple Software Update
[2012/07/03 07:14:39 | 000,000,000 | ---D | C] -- C:\Users\AdmSirRed\AppData\Local\Apple
[2012/07/03 07:14:33 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Apple
[2012/07/03 07:14:28 | 000,000,000 | ---D | C] -- C:\Program Files\Bonjour
[2012/07/03 07:14:28 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Bonjour
[2012/07/03 07:14:24 | 000,000,000 | ---D | C] -- C:\ProgramData\Apple
[2012/07/03 07:14:24 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Apple
[2012/07/03 02:10:49 | 000,000,000 | ---D | C] -- C:\Users\AdmSirRed\AppData\Local\{6ABB8931-63C0-4208-AAE0-319D92F35289}
[2012/07/03 02:10:30 | 000,000,000 | ---D | C] -- C:\Users\AdmSirRed\AppData\Local\{131D3853-CBBE-42E0-A5BE-06BC2DB432D0}
[2012/07/01 07:46:19 | 000,000,000 | ---D | C] -- C:\Users\AdmSirRed\AppData\Roaming\LolClient
[2012/06/30 07:41:09 | 000,000,000 | ---D | C] -- C:\Users\AdmSirRed\AppData\Local\{C9B03604-B24B-4839-8058-8E26023CE219}
[2012/06/30 07:40:48 | 000,000,000 | ---D | C] -- C:\Users\AdmSirRed\AppData\Local\{0E257B9A-0B79-46A8-BF60-0E17BFA83EE4}
[2012/06/29 19:19:07 | 000,000,000 | ---D | C] -- C:\Users\AdmSirRed\AppData\Local\{C3946A79-9137-4227-92AF-8AF806B086CB}
[2012/06/29 19:18:46 | 000,000,000 | ---D | C] -- C:\Users\AdmSirRed\AppData\Local\{E28AC9CF-AD87-4278-8155-F3E68F4B36E0}
[2012/06/26 11:33:42 | 000,000,000 | ---D | C] -- C:\Users\AdmSirRed\AppData\Local\{37966F44-C344-4567-AFB9-EBDDB9624F5D}
[2012/06/26 11:33:32 | 000,000,000 | ---D | C] -- C:\Users\AdmSirRed\AppData\Local\{77308B7C-E0EB-4EB1-8BF7-47615FBF38FB}
[2012/06/23 14:52:08 | 000,000,000 | ---D | C] -- C:\Users\AdmSirRed\AppData\Local\{B9087E4E-2FEF-40CB-B3C0-DF6DCF49A130}
[2012/06/23 14:51:46 | 000,000,000 | ---D | C] -- C:\Users\AdmSirRed\AppData\Local\{F87139D6-D88D-4AD8-BD5C-6E73BA0BC39E}
[2012/06/22 15:17:56 | 000,000,000 | ---D | C] -- C:\Users\AdmSirRed\AppData\Local\{991BF248-BD30-4EEF-91CF-1D9FA263E80D}
[2012/06/22 03:17:23 | 000,000,000 | ---D | C] -- C:\Users\AdmSirRed\AppData\Local\{11967A79-66F2-477D-B4E5-DEF4C7E74BF3}
[2012/06/22 03:17:13 | 000,000,000 | ---D | C] -- C:\Users\AdmSirRed\AppData\Local\{6ADFDAF6-808D-486E-BA0A-787B8A44A7B0}
[2012/06/21 06:56:28 | 000,902,656 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d2d1.dll
[2012/06/21 06:53:33 | 002,622,464 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wucltux.dll
[2012/06/21 06:53:33 | 000,057,880 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wuauclt.exe
[2012/06/21 06:53:33 | 000,044,056 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wups2.dll
[2012/06/21 06:53:31 | 000,701,976 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wuapi.dll
[2012/06/21 06:53:31 | 000,099,840 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wudriver.dll
[2012/06/21 06:53:31 | 000,038,424 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wups.dll
[2012/06/21 06:53:29 | 000,186,752 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wuwebv.dll
[2012/06/21 06:53:29 | 000,036,864 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wuapp.exe

========== Files - Modified Within 30 Days ==========

[2012/07/20 22:30:41 | 000,000,323 | ---- | M] () -- C:\Windows\SysNative\checkdnsid.xml
[2012/07/20 22:30:00 | 000,000,904 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2012/07/20 21:56:00 | 000,000,830 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job
[2012/07/20 17:33:44 | 000,022,064 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2012/07/20 17:33:44 | 000,022,064 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2012/07/20 17:31:18 | 000,798,252 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
[2012/07/20 17:31:18 | 000,797,006 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
[2012/07/20 17:31:18 | 000,164,784 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
[2012/07/20 17:26:43 | 000,000,027 | ---- | M] () -- C:\Windows\SysNative\drivers\etc\hosts
[2012/07/20 17:26:42 | 000,000,900 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2012/07/20 17:26:36 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2012/07/20 17:26:34 | 4259,778,558 | -HS- | M] () -- C:\hiberfil.sys
[2012/07/20 17:20:40 | 004,582,461 | R--- | M] (Swearware) -- C:\Users\AdmSirRed\Desktop\ComboFix.exe
[2012/07/19 07:45:27 | 000,001,945 | ---- | M] () -- C:\Windows\epplauncher.mif
[2012/07/18 17:52:47 | 001,552,384 | ---- | M] () -- C:\Users\AdmSirRed\Desktop\RogueKiller.exe
[2012/07/18 16:06:32 | 000,000,512 | ---- | M] () -- C:\Users\AdmSirRed\Documents\MBR.dat
[2012/07/18 15:47:55 | 000,001,109 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2012/07/12 11:57:24 | 000,426,184 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\FlashPlayerApp.exe
[2012/07/12 11:57:24 | 000,070,344 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl
[2012/07/11 12:23:48 | 000,002,340 | ---- | M] () -- C:\Users\Public\Desktop\Google Chrome.lnk
[2012/07/11 03:18:38 | 000,274,320 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT
[2012/07/03 13:46:44 | 000,024,904 | ---- | M] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys
[2012/07/03 08:59:07 | 004,441,362 | ---- | M] () -- C:\Users\AdmSirRed\Desktop\150 - Van Morrison - Domino.mp3
[2012/07/03 07:15:09 | 000,001,783 | ---- | M] () -- C:\Users\Public\Desktop\iTunes.lnk
[2012/06/24 11:20:31 | 003,967,875 | ---- | M] () -- C:\Users\AdmSirRed\Desktop\Dreamtale - The Dawn.mp3

========== Files Created - No Company Name ==========

[2012/07/20 17:21:14 | 000,256,000 | ---- | C] () -- C:\Windows\PEV.exe
[2012/07/20 17:21:14 | 000,208,896 | ---- | C] () -- C:\Windows\MBR.exe
[2012/07/20 17:21:14 | 000,098,816 | ---- | C] () -- C:\Windows\sed.exe
[2012/07/20 17:21:14 | 000,080,412 | ---- | C] () -- C:\Windows\grep.exe
[2012/07/20 17:21:14 | 000,068,096 | ---- | C] () -- C:\Windows\zip.exe
[2012/07/18 17:52:46 | 001,552,384 | ---- | C] () -- C:\Users\AdmSirRed\Desktop\RogueKiller.exe
[2012/07/18 16:06:32 | 000,000,512 | ---- | C] () -- C:\Users\AdmSirRed\Documents\MBR.dat
[2012/07/18 15:47:55 | 000,001,109 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2012/07/18 11:38:43 | 000,000,323 | ---- | C] () -- C:\Windows\SysNative\checkdnsid.xml
[2012/07/07 20:14:26 | 004,441,362 | ---- | C] () -- C:\Users\AdmSirRed\Desktop\150 - Van Morrison - Domino.mp3
[2012/07/03 07:15:09 | 000,001,783 | ---- | C] () -- C:\Users\Public\Desktop\iTunes.lnk
[2012/07/03 07:14:39 | 000,002,519 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Apple Software Update.lnk
[2012/06/24 21:00:23 | 003,967,875 | ---- | C] () -- C:\Users\AdmSirRed\Desktop\Dreamtale - The Dawn.mp3
[2012/06/11 00:29:46 | 000,000,262 | ---- | C] () -- C:\Windows\{EEB3F6BB-318D-4CE5-989F-8191FCBFB578}_WiseFW.ini
[2012/06/02 21:11:45 | 000,057,099 | ---- | C] () -- C:\Windows\Ascd_log.ini
[2012/06/02 21:10:55 | 000,001,769 | ---- | C] () -- C:\Windows\Language_trs.ini
[2012/06/02 21:10:53 | 000,040,227 | ---- | C] () -- C:\Windows\Ascd_tmp.ini
[2012/06/02 08:36:14 | 000,730,638 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI
[2012/05/15 03:21:50 | 000,423,744 | ---- | C] () -- C:\Windows\SysWow64\nvStreaming.exe
[2012/01/10 21:39:16 | 000,001,536 | ---- | C] () -- C:\Windows\SysWow64\IusEventLog.dll

< End of report >

 

All processes killed
========== OTL ==========
Registry value HKEY_USERS\S-1-5-21-2548554056-3466161380-310394626-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{2318C2B1-4965-11D4-9B18-009027A5CD4F} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2318C2B1-4965-11D4-9B18-009027A5CD4F}\ not found.
Registry value HKEY_USERS\S-1-5-21-2548554056-3466161380-310394626-1001\Software\Microsoft\Windows\CurrentVersion\RunOnce\\mctadmin deleted successfully.
64bit-Registry key HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\MenuExt\Google Sidewiki...\ deleted successfully.
Registry key HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\MenuExt\Google Sidewiki...\ not found.
========== COMMANDS ==========

[EMPTYTEMP]

User: AdmSirRed
->Temp folder emptied: 329790 bytes
->Temporary Internet Files folder emptied: 3505417 bytes
->FireFox cache emptied: 59444184 bytes
->Google Chrome cache emptied: 6468977 bytes
->Flash cache emptied: 529 bytes

User: All Users

User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: Public
->Temp folder emptied: 0 bytes

User: UpdatusUser
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32 (64bit) .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 882 bytes
%systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 36030444 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 101.00 mb


[EMPTYJAVA]

User: AdmSirRed

User: All Users

User: Default

User: Default User

User: Public

User: UpdatusUser

Total Java Files Cleaned = 0.00 mb


[EMPTYFLASH]

User: AdmSirRed
->Flash cache emptied: 0 bytes

User: All Users

User: Default

User: Default User

User: Public

User: UpdatusUser

Total Flash Files Cleaned = 0.00 mb


OTL by OldTimer - Version 3.2.53.1 log created on 07212012_185656

Files\Folders moved on Reboot...
C:\Users\AdmSirRed\AppData\Local\Temp\FXSAPIDebugLogFile.txt moved successfully.
File\Folder C:\Windows\temp\~bd649C.tmp not found!

PendingFileRenameOperations files...
File C:\Users\AdmSirRed\AppData\Local\Temp\FXSAPIDebugLogFile.txt not found!
File C:\Windows\temp\~bd649C.tmp not found!

Registry entries deleted on Reboot...

 

Results of screen317's Security Check version 0.99.24
Windows 7 x64 (UAC is enabled)
Internet Explorer 9
``````````````````````````````
Antivirus/Firewall Check:
Windows Firewall Enabled!
WMI entry may not exist for antivirus; attempting automatic update.
```````````````````````````````
Anti-malware/Other Utilities Check:
Adobe Flash Player 11.3.300.265
Mozilla Firefox (x86 en-US..)
````````````````````````````````
Process Check:
objlist.exe by Laurent
Bitdefender Bitdefender 2012 vsserv.exe
Bitdefender Bitdefender 2012 bdagent.exe
Bitdefender Bitdefender 2012 updatesrv.exe
Bitdefender Bitdefender 2012 antispam32 bdimguiaux.exe
Bitdefender Bitdefender 2012 seccenter.exe
``````````End of Log````````````


Farbar Service Scanner Version: 19-07-2012
Ran by AdmSirRed (administrator) on 21-07-2012 at 19:04:09
Running from "C:\Users\AdmSirRed\Desktop "
Microsoft Windows 7 Home Premium Service Pack 1 (X64)
Boot Mode: Normal
****************************************************************

Internet Services:
============

Connection Status:
==============
Localhost is accessible.
LAN connected.
Google IP is accessible.
Google.com is accessible.
Yahoo IP is accessible.
Yahoo.com is accessible.


Windows Firewall:
=============

Firewall Disabled Policy:
==================


System Restore:
============

System Restore Disabled Policy:
========================


Action Center:
============

Windows Update:
============

Windows Autoupdate Disabled Policy:
============================


Windows Defender:
==============

Other Services:
==============

sharedaccess Service is not running. Checking service configuration:
The start type of sharedaccess service is set to Auto
The ImagePath of sharedaccess service is OK.
The ServiceDll of sharedaccess service is OK.


File Check:
========
C:\Windows\System32\nsisvc.dll => MD5 is legit
C:\Windows\System32\drivers\nsiproxy.sys => MD5 is legit
C:\Windows\System32\dhcpcore.dll => MD5 is legit
C:\Windows\System32\drivers\afd.sys => MD5 is legit
C:\Windows\System32\drivers\tdx.sys => MD5 is legit
C:\Windows\System32\Drivers\tcpip.sys => MD5 is legit
C:\Windows\System32\dnsrslvr.dll => MD5 is legit
C:\Windows\System32\mpssvc.dll => MD5 is legit
C:\Windows\System32\bfe.dll => MD5 is legit
C:\Windows\System32\drivers\mpsdrv.sys => MD5 is legit
C:\Windows\System32\SDRSVC.dll => MD5 is legit
C:\Windows\System32\vssvc.exe => MD5 is legit
C:\Windows\System32\wscsvc.dll => MD5 is legit
C:\Windows\System32\wbem\WMIsvc.dll => MD5 is legit
C:\Windows\System32\wuaueng.dll => MD5 is legit
C:\Windows\System32\qmgr.dll => MD5 is legit
C:\Windows\System32\es.dll => MD5 is legit
C:\Windows\System32\cryptsvc.dll => MD5 is legit
C:\Program Files\Windows Defender\MpSvc.dll => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit


**** End of log ****

H:\System Volume Information\_restore{B969F7FE-A4C5-4D5A-AAD9-D868C5C8DAF3}\RP250\A0034089.exe a variant of Win32/Toolbar.Widgi application cleaned by deleting - quarantined
H:\System Volume Information\_restore{B969F7FE-A4C5-4D5A-AAD9-D868C5C8DAF3}\RP251\A0034125.exe Win32/Toolbar.Zugo application cleaned by deleting - quarantined
H:\Send to 2012\Desktop\Other\tinyburn_blue.exe a variant of Win32/InstallIQ application cleaned by deleting - quarantined
H:\Send to 2012\Desktop\Other\VLC_32.exe a variant of Win32/InstallIQ application cleaned by deleting - quarantined


should be all of them

 

I would like to thank you very much, i still have to run the cleaning but everything works perfectly fine again.