Solved Thread transfer for evaluation per Arie

[Solved] Thread transfer for evaluation per Arie

Thread transferred from here: http://www.windowsbbs.com/pc-hardware/107443-laptop-hd-running-constantly.html

MALWAREBYTES LOG "
Malwarebytes Anti-Malware
www.malwarebytes.org

Scan Date: 4/21/2014
Scan Time: 12:42:52 PM
Logfile: 2014-04-21_Malwarebytes Scan Results.txt
Administrator: Yes

Version: 2.00.1.1004
Malware Database: v2014.04.21.05
Rootkit Database: v2014.03.27.01
License: Free
Malware Protection: Disabled
Malicious Website Protection: Disabled
Chameleon: Disabled

OS: Windows XP Service Pack 3
CPU: x86
File System: NTFS
User: Owner

Scan Type: Threat Scan
Result: Completed
Objects Scanned: 260412
Time Elapsed: 29 min, 31 sec

Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Disabled
Shuriken: Enabled
PUP: Warn
PUM: Enabled

Processes: 0
(No malicious items detected)

Modules: 0
(No malicious items detected)

Registry Keys: 0
(No malicious items detected)

Registry Values: 0
(No malicious items detected)

Registry Data: 0
(No malicious items detected)

Folders: 0
(No malicious items detected)

Files: 0
(No malicious items detected)

Physical Sectors: 0
(No malicious items detected)


(end)
----------------------------------------------------
DDS.txt Logs

DDS (Ver_2012-11-20.01) - NTFS_x86
Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 10.51.2
Run by Owner at 13:11:01 on 2014-04-21
.
============== Running Processes ================
.
C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Spybot - Search & Destroy 2\SDTray.exe
C:\Program Files\BillP Studios\WinPatrol\winpatrol.exe
C:\Documents and Settings\Owner\Application Data\Dropbox\bin\Dropbox.exe
C:\Program Files\Xcalday\xcalday.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Spybot - Search & Destroy 2\SDFSSvc.exe
C:\Program Files\Spybot - Search & Destroy 2\SDUpdSvc.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\system32\RunDLL32.exe
C:\Program Files\COMODO\COMODO Internet Security\cistray.exe
C:\Program Files\COMODO\COMODO Internet Security\cis.exe
C:\WINDOWS\system32\winrdlv3.exe
C:\WINDOWS\system32\winrdlv3.exe
C:\WINDOWS\system32\winrdlv3.exe
C:\Program Files\COMODO\COMODO Internet Security\cavwp.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\WINDOWS\system32\svchost.exe -k netsvcs
C:\WINDOWS\system32\svchost.exe -k NetworkService
C:\WINDOWS\system32\svchost.exe -k LocalService
C:\WINDOWS\System32\svchost.exe -k HTTPFilter
.
============== Pseudo HJT Report ===============
.
uStart Page = hxxp://www.google.com
uInternet Connection Wizard,ShellNext = hxxp://www.google.com/
uProxyServer = localhost:21320
uProxyOverride = <-loopback>
mSearchAssistant = ${SEARCH_URL_IE7}
BHO: DivX Plus Web Player HTML5 <video>: {326E768D-4182-46FD-9C16-1449A49795F4} - c:\program files\divx\divx plus web

player\ie\divxhtml5\DivXHTML5.dll
BHO: Java(tm) Plug-In SSV Helper: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - c:\program files\java\jre7\bin\ssv.dll
BHO: Java(tm) Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - c:\program files\java\jre7\bin\jp2ssv.dll
uRun: [WinPatrol] c:\program files\billp studios\winpatrol\winpatrol.exe -expressboot
mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup
mRun: [SDTray] "c:\program files\spybot - search & destroy 2\SDTray.exe "
mRun: [COMODO Internet Security] c:\program files\comodo\comodo internet security\cistray.exe
uPolicies-Explorer: NoDriveTypeAutoRun = dword:145
mPolicies-Explorer: NoDriveTypeAutoRun = dword:145
IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office11\EXCEL.EXE/3000
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503}
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
.
INFO: HKCU has more than 50 listed domains.
If you wish to scan all of them, select the 'Force scan all domains' option.
.
.
INFO: HKLM has more than 50 listed domains.
If you wish to scan all of them, select the 'Force scan all domains' option.
.
DPF: {02BCC737-B171-4746-94C9-0D8A0B2C0089} - hxxp://office.microsoft.com/_layouts/ClientBin/ieawsdc32.cab
DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} -

hxxp://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1368282000312
TCP: NameServer = 192.168.254.254
TCP: Interfaces\{FA9CAED8-EF6C-4E64-9703-86F0D919EB74} : NameServer = 192.168.254.254
TCP: Interfaces\{FA9CAED8-EF6C-4E64-9703-86F0D919EB74} : DHCPNameServer = 192.168.254.254
Handler: belarc - {6318E0AB-2E93-11D1-B8ED-00608CC9A71F} - c:\program files\belarc\advisor\system\BAVoilaX.dll
Notify: LMIinit - LMIinit.dll
Notify: psfus - c:\windows\system32\psqlpwd.dll
Notify: SDWinLogon - SDWinLogon.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
SEH: watch Class - {A16CA976-4B8D-47FC-A9F4-651C17B636EF} - c:\windows\system32\msowcnv3.dll
SEH: {4F07DA45-8170-4859-9B5F-037EF2970034} - <orphaned>
SEH: Windows Desktop Search Namespace Manager - {56F9679E-7826-4C84-81F3-532071A8BCC5} - c:\program files\windows desktop

search\MSNLNamespaceMgr.dll
LSA: Notification Packages = scecli psqlpwd
Hosts: 127.0.0.1 www.spywareinfo.com
.
================= FIREFOX ===================
.
FF - ProfilePath - c:\documents and settings\owner\application data\mozilla\firefox\profiles\29v635vw.default-1395516145859\
FF - prefs.js: network.proxy.type - 0
FF - plugin: c:\program files\divx\divx ovs helper\npovshelper.dll
FF - plugin: c:\program files\divx\divx plus web player\npdivx32.dll
FF - plugin: c:\program files\java\jre7\bin\dtplugin\npdeployJava1.dll
FF - plugin: c:\program files\java\jre7\bin\plugin2\npjp2.dll
FF - plugin: c:\program files\microsoft silverlight\5.1.30214.0\npctrlui.dll
FF - plugin: c:\windows\system32\adobe\director\np32dsw_1210150.dll
FF - plugin: c:\windows\system32\macromed\flash\NPSWF32_13_0_0_182.dll
.
============= SERVICES / DRIVERS ===============
.
R? .Winhlpsvr;Windows Helper Service
R? BoxSyncUpdateService;Box Sync Update Service
R? clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86
R? cmdvirth;COMODO Virtual Service Manager
R? cpudrv;cpudrv
R? LMIGuardianSvc;LMIGuardianSvc
R? LMIRfsClientNP;LMIRfsClientNP
R? SDWSCService;Spybot-S&D 2 Security Center Service
R? TVDisk;TVDisk
R? WinRM;Windows Remote Management (WS-Management)
R? WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0
S? bbcap;bbcap
S? cmdAgent;COMODO Internet Security Helper Service
S? cmderd;COMODO Internet Security Eradication Driver
S? cmdGuard;COMODO Internet Security Driver
S? cmdHlp;COMODO Internet Security Helper Driver
S? IPNPF;WinPcap Packet Driver (IPNPF)
S? jumi;%Jumi%
S? LMIInfo;LogMeIn Kernel Information Provider
S? LMIRfsDriver;LogMeIn Remote File System Driver
S? SCRCAMHRDRV;ScreenCamera Video Camera
S? SDScannerService;Spybot-S&D 2 Scanner Service
S? SDUpdateService;Spybot-S&D 2 Updating Service
S? stdriver;SoundTap Upper Filter Driver v6.05.00
S? TFsfltdrv;TFsfltdrv
S? Thpevm;TOSHIBA HDD Protection - Shock Sensor Driver
S? TPacket;TPacket Driver
S? TSysDrv;TSysDrv
.
=============== File Associations ===============
.
ShellExec: CrazyTalk60.exe: Open=c:\program files\reallusion\crazytalk 6\ct program\CTIEMain.exe "%1 "
.
=============== Created Last 30 ================
.
2014-04-21 16:11:17 107736 ----a-w- c:\windows\system32\drivers\MBAMSwissArmy.sys
2014-04-21 16:10:15 50648 ----a-w- c:\windows\system32\drivers\mbamchameleon.sys
2014-04-21 16:10:14 -------- d-----w- c:\program files\Malwarebytes Anti-Malware
2014-04-15 19:51:04 -------- d--h--w- C:\VTRoot
2014-04-15 19:50:57 5128 ----a-w- c:\windows\system32\drivers\fvstore.dat
2014-04-13 23:08:28 56088 ----a-w- c:\windows\system32\winrdlv3.exe
2014-04-13 18:03:35 677313 ----a-w- c:\windows\system32\drivers\sfi.dat
2014-04-13 17:52:26 -------- d-s---w- c:\documents and settings\all users\application data\Shared Space
2014-04-13 17:49:39 -------- d-----w- c:\program files\COMODO
2014-04-13 17:49:12 -------- d-----w- c:\documents and settings\all users\application data\Comodo
2014-04-13 17:49:05 -------- d-----w- c:\documents and settings\all users\application data\Comodo Downloader
2014-04-11 16:52:48 -------- d-----w- C:\Autoruns
2014-04-07 17:27:01 170496 ----a-w- c:\windows\system32\LXCASUI.DLL
2014-04-01 14:17:21 -------- d-----w- c:\documents and settings\owner\application data\DropboxMaster
2014-03-26 23:08:09 13312 -c----w- c:\windows\system32\dllcache\xp_eos.exe
2014-03-26 23:08:09 13312 ------w- c:\windows\system32\xp_eos.exe
2014-03-23 19:38:28 -------- d--h--w- c:\documents and settings\owner\.Box Sync
2014-03-23 19:14:36 -------- d-----w- c:\documents and settings\owner\Box Sync
.
==================== Find3M ====================
.
2014-04-16 21:12:47 607448 ----a-w- c:\windows\system32\drivers\cmdGuard.sys
2014-04-16 21:12:47 29912 ----a-w- c:\windows\system32\drivers\cmdhlp.sys
2014-04-16 21:12:47 15704 ----a-w- c:\windows\system32\drivers\cmderd.sys
2014-04-15 21:25:58 692400 ----a-w- c:\windows\system32\FlashPlayerApp.exe
2014-04-15 21:25:57 70832 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2014-04-03 13:50:56 23256 ----a-w- c:\windows\system32\drivers\mbam.sys
2014-03-25 19:22:37 36000 ----a-w- c:\windows\system32\cmdcsr.dll
2014-03-25 19:22:36 363504 ----a-w- c:\windows\system32\guard32.dll
2014-03-25 19:22:25 284888 ----a-w- c:\windows\system32\cmdvrt32.dll
2014-03-25 19:22:23 40664 ----a-w- c:\windows\system32\cmdkbd32.dll
2014-03-18 20:20:36 4608 ----a-w- c:\windows\system32\bbchlp.dll
2014-03-18 20:20:36 4096 ----a-w- c:\windows\system32\drivers\bbcap.sys
2014-03-18 20:20:36 30720 ----a-w- c:\windows\system32\bbcap.dll
2014-03-06 17:59:23 920064 ----a-w- c:\windows\system32\wininet.dll
2014-03-06 17:59:22 43520 ------w- c:\windows\system32\licmgr10.dll
2014-03-06 17:59:22 18944 ------w- c:\windows\system32\corpol.dll
2014-03-06 17:59:22 1469440 ------w- c:\windows\system32\inetcpl.cpl
2014-03-06 00:46:54 385024 ------w- c:\windows\system32\html.iec
2014-02-07 02:01:37 1879040 ----a-w- c:\windows\system32\win32k.sys
2014-02-05 08:55:04 562688 ----a-w- c:\windows\system32\qedit.dll
.
============= FINISH: 13:12:15.06 ===============


DDS Log - attach.txt
This log just produced a blank page. I ran it twice just to make sure

 

Thanks. I'll give it my best shot and I will stay in touch. Will start working on this later this PM as I am working now and don't need an interruption. I want to fully focus on this.

 

OK Here are the results:


RogueKiller V8.8.15 [Mar 27 2014] by Adlice Software
mail : http://www.adlice.com/contact/
Feedback : http://forum.adlice.com
Website : http://www.adlice.com/softwares/roguekiller/
Blog : http://www.adlice.com

Operating System : Windows XP (5.1.2600 Service Pack 3) 32 bits version
Started in : Normal mode
User : Owner [Admin rights]
Mode : Scan -- Date : 04/22/2014 16:50:53
| ARK || FAK || MBR |

¤¤¤ Bad processes : 1 ¤¤¤
[SUSP PATH][DLL] explorer.exe -- C:\Documents and Settings\All Users\Application Data\IDriveSync\IDSyncIcon.dll [x] -> UNLOADED

¤¤¤ Registry Entries : 5 ¤¤¤
[PROXY IE][PUM] HKCU\[...]\Internet Settings : ProxyServer (localhost:21320 [Country: (Private Address) (XX), City: (Private Address)]) -> FOUND
[PROXY IE][PUM] HKCU\[...]\Internet Settings : ProxyEnable (1) -> FOUND
[HJ POL][PUM] HKCU\[...]\System : DisableTaskMgr (0) -> FOUND
[HJ POL][PUM] HKCU\[...]\System : DisableRegistryTools (0) -> FOUND
[HJ DESK][PUM] HKLM\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> FOUND

¤¤¤ Scheduled tasks : 0 ¤¤¤

¤¤¤ Startup Entries : 0 ¤¤¤

¤¤¤ Web browsers : 0 ¤¤¤

¤¤¤ Browser Addons : 0 ¤¤¤

¤¤¤ Particular Files / Folders: ¤¤¤

¤¤¤ Driver : [LOADED] ¤¤¤

¤¤¤ External Hives: ¤¤¤

¤¤¤ Infection : ¤¤¤

¤¤¤ HOSTS File: ¤¤¤
--> %SystemRoot%\System32\drivers\etc\hosts


127.0.0.1 localhost
127.0.0.1 www.007guard.com
127.0.0.1 007guard.com
127.0.0.1 008i.com
127.0.0.1 www.008k.com
127.0.0.1 008k.com
127.0.0.1 www.00hq.com
127.0.0.1 00hq.com
127.0.0.1 010402.com
127.0.0.1 www.032439.com
127.0.0.1 032439.com
127.0.0.1 www.0scan.com
127.0.0.1 0scan.com
127.0.0.1 www.1000gratisproben.com
127.0.0.1 1000gratisproben.com
127.0.0.1 1001namen.com
127.0.0.1 www.1001namen.com
127.0.0.1 100888290cs.com
127.0.0.1 www.100888290cs.com
127.0.0.1 www.100sexlinks.com
[...]


¤¤¤ MBR Check: ¤¤¤

+++++ PhysicalDrive0: (\\.\PHYSICALDRIVE0 @ IDE) Hitachi HTS541680J9SA00 +++++
--- User ---
[MBR] 8a1619889a5e39e44ce8d6d578a964dc
[BSP] 4023b638ea21144fdc3c693a1631a0a0 : Windows XP MBR Code
Partition table:
0 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 63 | Size: 76308 MB
User = LL1 ... OK!
User = LL2 ... OK!

+++++ PhysicalDrive1: (\\.\PHYSICALDRIVE1 @ USB) USB Device +++++
--- User ---
[MBR] 0cdf1c879f0918b09e6459e6bc8b99f9
[BSP] 79744c3f93fa689e475227afc1063ee1 : MBR Code unknown
Partition table:
0 - [ACTIVE] FAT32-LBA (0x0c) [VISIBLE] Offset (sectors): 3216 | Size: 14798 MB
User = LL1 ... OK!
Error reading LL2 MBR! ([0x32] The request is not supported. )

+++++ PhysicalDrive2: (\\.\PHYSICALDRIVE2 @ USB) USB Device +++++
--- User ---
[MBR] 61087ae8ec58ccfe37f9663a8bb46f8d
[BSP] 33a07a59d299ab4ea9f4ab0156f9d86f : Windows XP MBR Code
Partition table:
0 - [ACTIVE] FAT32-LBA (0x0c) [VISIBLE] Offset (sectors): 32 | Size: 30399 MB
User = LL1 ... OK!
Error reading LL2 MBR! ([0x32] The request is not supported. )

+++++ PhysicalDrive3: (\\.\PHYSICALDRIVE3 @ USB) USB Device +++++
--- User ---
[MBR] 61087ae8ec58ccfe37f9663a8bb46f8d
[BSP] 33a07a59d299ab4ea9f4ab0156f9d86f : Windows XP MBR Code
Partition table:
0 - [ACTIVE] FAT32-LBA (0x0c) [VISIBLE] Offset (sectors): 32 | Size: 30399 MB
User = LL1 ... OK!
Error reading LL2 MBR! ([0x32] The request is not supported. )

Finished : << RKreport[0]_S_04222014_165053.txt >>


RogueKiller V8.8.15 [Mar 27 2014] by Adlice Software
mail : http://www.adlice.com/contact/
Feedback : http://forum.adlice.com
Website : http://www.adlice.com/softwares/roguekiller/
Blog : http://www.adlice.com

Operating System : Windows XP (5.1.2600 Service Pack 3) 32 bits version
Started in : Normal mode
User : Owner [Admin rights]
Mode : Remove -- Date : 04/22/2014 17:10:22
| ARK || FAK || MBR |

¤¤¤ Bad processes : 1 ¤¤¤
[SUSP PATH][DLL] explorer.exe -- C:\Documents and Settings\All Users\Application Data\IDriveSync\IDSyncIcon.dll [x] -> UNLOADED

¤¤¤ Registry Entries : 3 ¤¤¤
[HJ POL][PUM] HKCU\[...]\System : DisableTaskMgr (0) -> DELETED
[HJ POL][PUM] HKCU\[...]\System : DisableRegistryTools (0) -> DELETED
[HJ DESK][PUM] HKLM\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> REPLACED (0)

¤¤¤ Scheduled tasks : 0 ¤¤¤

¤¤¤ Startup Entries : 0 ¤¤¤

¤¤¤ Web browsers : 0 ¤¤¤

¤¤¤ Browser Addons : 0 ¤¤¤

¤¤¤ Particular Files / Folders: ¤¤¤

¤¤¤ Driver : [LOADED] ¤¤¤

¤¤¤ External Hives: ¤¤¤

¤¤¤ Infection : ¤¤¤

¤¤¤ HOSTS File: ¤¤¤
--> %SystemRoot%\System32\drivers\etc\hosts


127.0.0.1 localhost
127.0.0.1 www.007guard.com
127.0.0.1 007guard.com
127.0.0.1 008i.com
127.0.0.1 www.008k.com
127.0.0.1 008k.com
127.0.0.1 www.00hq.com
127.0.0.1 00hq.com
127.0.0.1 010402.com
127.0.0.1 www.032439.com
127.0.0.1 032439.com
127.0.0.1 www.0scan.com
127.0.0.1 0scan.com
127.0.0.1 www.1000gratisproben.com
127.0.0.1 1000gratisproben.com
127.0.0.1 1001namen.com
127.0.0.1 www.1001namen.com
127.0.0.1 100888290cs.com
127.0.0.1 www.100888290cs.com
127.0.0.1 www.100sexlinks.com
[...]


¤¤¤ MBR Check: ¤¤¤

+++++ PhysicalDrive0: (\\.\PHYSICALDRIVE0 @ IDE) Hitachi HTS541680J9SA00 +++++
--- User ---
[MBR] 8a1619889a5e39e44ce8d6d578a964dc
[BSP] 4023b638ea21144fdc3c693a1631a0a0 : Windows XP MBR Code
Partition table:
0 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 63 | Size: 76308 MB
User = LL1 ... OK!
User = LL2 ... OK!

+++++ PhysicalDrive1: (\\.\PHYSICALDRIVE1 @ USB) USB Device +++++
--- User ---
[MBR] 0cdf1c879f0918b09e6459e6bc8b99f9
[BSP] 79744c3f93fa689e475227afc1063ee1 : MBR Code unknown
Partition table:
0 - [ACTIVE] FAT32-LBA (0x0c) [VISIBLE] Offset (sectors): 3216 | Size: 14798 MB
User = LL1 ... OK!
Error reading LL2 MBR! ([0x32] The request is not supported. )

+++++ PhysicalDrive2: (\\.\PHYSICALDRIVE2 @ USB) USB Device +++++
--- User ---
[MBR] 61087ae8ec58ccfe37f9663a8bb46f8d
[BSP] 33a07a59d299ab4ea9f4ab0156f9d86f : Windows XP MBR Code
Partition table:
0 - [ACTIVE] FAT32-LBA (0x0c) [VISIBLE] Offset (sectors): 32 | Size: 30399 MB
User = LL1 ... OK!
Error reading LL2 MBR! ([0x32] The request is not supported. )

+++++ PhysicalDrive3: (\\.\PHYSICALDRIVE3 @ USB) USB Device +++++
--- User ---
[MBR] 61087ae8ec58ccfe37f9663a8bb46f8d
[BSP] 33a07a59d299ab4ea9f4ab0156f9d86f : Windows XP MBR Code
Partition table:
0 - [ACTIVE] FAT32-LBA (0x0c) [VISIBLE] Offset (sectors): 32 | Size: 30399 MB
User = LL1 ... OK!
Error reading LL2 MBR! ([0x32] The request is not supported. )

Finished : << RKreport[0]_D_04222014_171022.txt >>
RKreport[0]_S_04222014_165053.txt




Malwarebytes Anti-Rootkit BETA 1.07.0.1009
www.malwarebytes.org

Database version: v2014.04.22.05

Windows XP Service Pack 3 x86 NTFS
Internet Explorer 8.0.6001.18702
:: NEWTECRA_F [administrator]

4/22/2014 5:20:09 PM
mbar-log-2014-04-22 (17-20-09).txt

Scan type: Quick scan
Scan options enabled: Anti-Rootkit | Drivers | MBR | Physical Sectors | Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken
Scan options disabled:
Objects scanned: 261592
Time elapsed: 40 minute(s), 45 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 0
(No malicious items detected)

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 0
(No malicious items detected)

Files Detected: 0
(No malicious items detected)

Physical Sectors Detected: 0
(No malicious items detected)

(end)


---------------------------------------
Malwarebytes Anti-Rootkit BETA 1.07.0.1009

(c) Malwarebytes Corporation 2011-2012

OS version: 5.1.2600 Windows XP Service Pack 3 x86

Account is Administrative

Internet Explorer version: 8.0.6001.18702

File system is: NTFS
Disk drives: C:\ DRIVE_FIXED
CPU speed: 1.828000 GHz
Memory total: 1071558656, free: 370864128

Downloaded database version: v2014.04.22.05
Downloaded database version: v2014.03.27.01
Initializing...
======================
------------ Kernel report ------------
04/22/2014 17:19:54
------------ Loaded modules -----------
\WINDOWS\system32\ntoskrnl.exe
\WINDOWS\system32\hal.dll
\WINDOWS\system32\KDCOM.DLL
\WINDOWS\system32\BOOTVID.dll
ACPI.sys
\WINDOWS\system32\DRIVERS\WMILIB.SYS
pci.sys
isapnp.sys
ohci1394.sys
\WINDOWS\system32\DRIVERS\1394BUS.SYS
compbatt.sys
\WINDOWS\system32\DRIVERS\BATTC.SYS
pciide.sys
\WINDOWS\system32\DRIVERS\PCIIDEX.SYS
pcmcia.sys
MountMgr.sys
ftdisk.sys
dmload.sys
dmio.sys
ACPIEC.sys
\WINDOWS\system32\DRIVERS\OPRGHDLR.SYS
PartMgr.sys
VolSnap.sys
atapi.sys
disk.sys
\WINDOWS\system32\DRIVERS\CLASSPNP.SYS
fltMgr.sys
sr.sys
KSecDD.sys
Ntfs.sys
inspect.sys
\WINDOWS\System32\DRIVERS\NDIS.SYS
\WINDOWS\System32\DRIVERS\TDI.SYS
tpacket.sys
Thpevm.SYS
Mup.sys
\SystemRoot\system32\DRIVERS\intelppm.sys
\SystemRoot\system32\DRIVERS\CmBatt.sys
\SystemRoot\system32\DRIVERS\nv4_mini.sys
\SystemRoot\system32\DRIVERS\VIDEOPRT.SYS
\SystemRoot\system32\DRIVERS\HDAudBus.sys
\SystemRoot\system32\DRIVERS\e1e5132.sys
\SystemRoot\system32\DRIVERS\NETw5x32.sys
\SystemRoot\system32\DRIVERS\usbuhci.sys
\SystemRoot\system32\DRIVERS\USBPORT.SYS
\SystemRoot\system32\DRIVERS\usbehci.sys
\SystemRoot\system32\drivers\tifm21.sys
\SystemRoot\system32\DRIVERS\sdbus.sys
\SystemRoot\system32\DRIVERS\serial.sys
\SystemRoot\system32\DRIVERS\serenum.sys
\SystemRoot\system32\DRIVERS\parport.sys
\SystemRoot\system32\DRIVERS\i8042prt.sys
\SystemRoot\system32\DRIVERS\kbdclass.sys
\SystemRoot\system32\DRIVERS\mouclass.sys
\SystemRoot\system32\DRIVERS\imapi.sys
\SystemRoot\system32\DRIVERS\cdrom.sys
\SystemRoot\system32\DRIVERS\redbook.sys
\SystemRoot\system32\DRIVERS\ks.sys
\SystemRoot\system32\DRIVERS\lmimirr.sys
\SystemRoot\system32\DRIVERS\bbcap.sys
\SystemRoot\system32\DRIVERS\jumi.sys
\SystemRoot\system32\DRIVERS\HIDCLASS.SYS
\SystemRoot\system32\DRIVERS\HIDPARSE.SYS
\SystemRoot\system32\DRIVERS\SCRCAMHRDRV.sys
\SystemRoot\system32\DRIVERS\STREAM.SYS
\SystemRoot\system32\DRIVERS\stdriverx86.sys
\SystemRoot\system32\DRIVERS\audstub.sys
\SystemRoot\system32\DRIVERS\rasl2tp.sys
\SystemRoot\system32\DRIVERS\ndistapi.sys
\SystemRoot\system32\DRIVERS\ndiswan.sys
\SystemRoot\system32\DRIVERS\raspppoe.sys
\SystemRoot\system32\DRIVERS\raspptp.sys
\SystemRoot\system32\DRIVERS\ptilink.sys
\SystemRoot\system32\DRIVERS\raspti.sys
\SystemRoot\system32\DRIVERS\rdpdr.sys
\SystemRoot\system32\DRIVERS\termdd.sys
\SystemRoot\system32\DRIVERS\swenum.sys
\SystemRoot\system32\DRIVERS\update.sys
\SystemRoot\system32\DRIVERS\mssmbios.sys
\SystemRoot\system32\DRIVERS\mouhid.sys
\SystemRoot\system32\DRIVERS\kbdhid.sys
\SystemRoot\System32\Drivers\NDProxy.SYS
\SystemRoot\system32\drivers\RtkHDAud.sys
\SystemRoot\system32\drivers\portcls.sys
\SystemRoot\system32\drivers\drmk.sys
\SystemRoot\system32\DRIVERS\AGRSM.sys
\SystemRoot\system32\DRIVERS\USBD.SYS
\SystemRoot\System32\Drivers\Modem.SYS
\SystemRoot\system32\DRIVERS\usbhub.sys
\SystemRoot\System32\DRIVERS\cmderd.sys
\SystemRoot\System32\Drivers\tcusb.sys
\SystemRoot\System32\DRIVERS\cmdguard.sys
\SystemRoot\system32\DRIVERS\hidusb.sys
\SystemRoot\System32\Drivers\Fs_Rec.SYS
\SystemRoot\System32\Drivers\Null.SYS
\SystemRoot\System32\Drivers\Beep.SYS
\SystemRoot\System32\drivers\vga.sys
\SystemRoot\System32\Drivers\mnmdd.SYS
\SystemRoot\System32\DRIVERS\RDPCDD.sys
\SystemRoot\System32\Drivers\Msfs.SYS
\SystemRoot\System32\Drivers\Npfs.SYS
\SystemRoot\system32\DRIVERS\rasacd.sys
\SystemRoot\system32\DRIVERS\ipsec.sys
\SystemRoot\system32\DRIVERS\msgpc.sys
\SystemRoot\system32\DRIVERS\tcpip.sys
\SystemRoot\System32\DRIVERS\cmdhlp.sys
\SystemRoot\system32\DRIVERS\ipnat.sys
\SystemRoot\system32\DRIVERS\wanarp.sys
\SystemRoot\system32\DRIVERS\netbt.sys
\SystemRoot\System32\drivers\afd.sys
\SystemRoot\system32\DRIVERS\netbios.sys
\??\C:\WINDOWS\system32\drivers\TSysDrv.sys
\SystemRoot\system32\DRIVERS\rdbss.sys
\SystemRoot\system32\DRIVERS\mrxsmb.sys
\SystemRoot\system32\drivers\IPNPF.sys
\SystemRoot\System32\Drivers\Fips.SYS
\SystemRoot\System32\Drivers\BANTExt.sys
\SystemRoot\system32\DRIVERS\USBSTOR.SYS
\SystemRoot\System32\Drivers\Cdfs.SYS
\SystemRoot\System32\Drivers\dump_atapi.sys
\SystemRoot\System32\Drivers\dump_WMILIB.SYS
\SystemRoot\System32\win32k.sys
\SystemRoot\System32\drivers\Dxapi.sys
\SystemRoot\System32\watchdog.sys
\SystemRoot\System32\drivers\dxg.sys
\SystemRoot\System32\drivers\dxgthk.sys
\SystemRoot\System32\nv4_disp.dll
\SystemRoot\System32\ATMFD.DLL
\SystemRoot\system32\DRIVERS\ndisuio.sys
\SystemRoot\System32\Drivers\Fastfat.SYS
\SystemRoot\system32\drivers\wdmaud.sys
\SystemRoot\system32\drivers\sysaudio.sys
\SystemRoot\System32\Drivers\ParVdm.SYS
\SystemRoot\System32\drivers\aspi32.sys
\SystemRoot\System32\Drivers\DgiVecp.sys
\??\C:\Program Files\LogMeIn\x86\RaInfo.sys
\??\C:\WINDOWS\system32\drivers\LMIRfsDriver.sys
\SystemRoot\system32\DRIVERS\srv.sys
\SystemRoot\System32\Drivers\HTTP.sys
\??\C:\WINDOWS\system32\drivers\tfsfltdrv.sys
\SystemRoot\system32\DRIVERS\usbprint.sys
\SystemRoot\system32\drivers\kmixer.sys
\??\C:\WINDOWS\system32\drivers\mbamchameleon.sys
\??\C:\WINDOWS\system32\drivers\MBAMSwissArmy.sys
\WINDOWS\system32\ntdll.dll
----------- End -----------
Done!
<<<1>>>
Upper Device Name: \Device\Harddisk3\DR5
Upper Device Object: 0xffffffff83c114a8
Upper Device Driver Name: \Driver\Disk\
Lower Device Name: \Device\000000ab\
Lower Device Object: 0xffffffff839ed850
Lower Device Driver Name: \Driver\USBSTOR\
<<<1>>>
Upper Device Name: \Device\Harddisk2\DR4
Upper Device Object: 0xffffffff83b89030
Upper Device Driver Name: \Driver\Disk\
Lower Device Name: \Device\000000aa\
Lower Device Object: 0xffffffff870f1ea0
Lower Device Driver Name: \Driver\USBSTOR\
<<<1>>>
Upper Device Name: \Device\Harddisk1\DR2
Upper Device Object: 0xffffffff83a35ab8
Upper Device Driver Name: \Driver\Disk\
Lower Device Name: \Device\000000a5\
Lower Device Object: 0xffffffff83a52ea0
Lower Device Driver Name: \Driver\USBSTOR\
<<<1>>>
Upper Device Name: \Device\Harddisk0\DR0
Upper Device Object: 0xffffffff87352ab8
Upper Device Driver Name: \Driver\Disk\
Lower Device Name: \Device\Ide\IdeDeviceP0T0L0-3\
Lower Device Object: 0xffffffff8735a840
Lower Device Driver Name: \Driver\atapi\
<<<2>>>
Physical Sector Size: 512
Drive: 0, DevicePointer: 0xffffffff87352ab8, DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\Disk\
--------- Disk Stack ------
DevicePointer: 0xffffffff87354a70, DeviceName: Unknown, DriverName: \Driver\PartMgr\
DevicePointer: 0xffffffff87352ab8, DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\Disk\
DevicePointer: 0xffffffff872c6178, DeviceName: \Device\00000088\, DriverName: \Driver\ACPI\
DevicePointer: 0xffffffff8735a840, DeviceName: \Device\Ide\IdeDeviceP0T0L0-3\, DriverName: \Driver\atapi\
------------ End ----------
Alternate DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\Disk\
Upper DeviceData: 0x0, 0x0, 0x0
Lower DeviceData: 0x0, 0x0, 0x0
<<<3>>>
Volume: C:
File system type: NTFS
SectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytes
<<<2>>>
<<<3>>>
Volume: C:
File system type: NTFS
SectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytes
Scanning drivers directory: C:\WINDOWS\SYSTEM32\drivers...
<<<2>>>
<<<3>>>
Volume: C:
File system type: NTFS
SectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytes
Done!
Drive 0
Scanning MBR on drive 0...
Inspecting partition table:
MBR Signature: 55AA
Disk Signature: 4110410F

Partition information:

Partition 0 type is Primary (0x7)
Partition is ACTIVE.
Partition starts at LBA: 63 Numsec = 156280257
Partition file system is NTFS
Partition is bootable

Partition 1 type is Empty (0x0)
Partition is NOT ACTIVE.
Partition starts at LBA: 0 Numsec = 0

Partition 2 type is Empty (0x0)
Partition is NOT ACTIVE.
Partition starts at LBA: 0 Numsec = 0

Partition 3 type is Empty (0x0)
Partition is NOT ACTIVE.
Partition starts at LBA: 0 Numsec = 0

Disk Size: 80026361856 bytes
Sector size: 512 bytes

Scanning physical sectors of unpartitioned space on drive 0 (1-62-156281488-156301488)...
Done!
Physical Sector Size: 512
Drive: 1, DevicePointer: 0xffffffff83a35ab8, DeviceName: \Device\Harddisk1\DR2\, DriverName: \Driver\Disk\
--------- Disk Stack ------
DevicePointer: 0xffffffff83aae020, DeviceName: Unknown, DriverName: \Driver\PartMgr\
DevicePointer: 0xffffffff83a35ab8, DeviceName: \Device\Harddisk1\DR2\, DriverName: \Driver\Disk\
DevicePointer: 0xffffffff83a52ea0, DeviceName: \Device\000000a5\, DriverName: \Driver\USBSTOR\
------------ End ----------
Alternate DeviceName: \Device\Harddisk1\DR2\, DriverName: \Driver\Disk\
Upper DeviceData: 0x0, 0x0, 0x0
Lower DeviceData: 0x0, 0x0, 0x0
Drive 1
Scanning MBR on drive 1...
Inspecting partition table:
MBR Signature: 55AA
Disk Signature: 48930

Partition information:

Partition 0 type is Other (0xc)
Partition is ACTIVE.
Partition starts at LBA: 3216 Numsec = 30307184
Partition file system is FAT32
Partition is not bootable

Partition 1 type is Empty (0x0)
Partition is NOT ACTIVE.
Partition starts at LBA: 0 Numsec = 0

Partition 2 type is Empty (0x0)
Partition is NOT ACTIVE.
Partition starts at LBA: 0 Numsec = 0

Partition 3 type is Empty (0x0)
Partition is NOT ACTIVE.
Partition starts at LBA: 0 Numsec = 0

Disk Size: 15518924800 bytes
Sector size: 512 bytes

Done!
Physical Sector Size: 512
Drive: 2, DevicePointer: 0xffffffff83b89030, DeviceName: \Device\Harddisk2\DR4\, DriverName: \Driver\Disk\
--------- Disk Stack ------
DevicePointer: 0xffffffff83b83748, DeviceName: Unknown, DriverName: \Driver\PartMgr\
DevicePointer: 0xffffffff83b89030, DeviceName: \Device\Harddisk2\DR4\, DriverName: \Driver\Disk\
DevicePointer: 0xffffffff870f1ea0, DeviceName: \Device\000000aa\, DriverName: \Driver\USBSTOR\
------------ End ----------
Alternate DeviceName: \Device\Harddisk2\DR4\, DriverName: \Driver\Disk\
Upper DeviceData: 0x0, 0x0, 0x0
Lower DeviceData: 0x0, 0x0, 0x0
Drive 2
Scanning MBR on drive 2...
Inspecting partition table:
MBR Signature: 55AA
Disk Signature: C3072E18

Partition information:

Partition 0 type is Other (0xc)
Partition is ACTIVE.
Partition starts at LBA: 32 Numsec = 62259168
Partition file system is FAT32
Partition is not bootable

Partition 1 type is Empty (0x0)
Partition is NOT ACTIVE.
Partition starts at LBA: 0 Numsec = 0

Partition 2 type is Empty (0x0)
Partition is NOT ACTIVE.
Partition starts at LBA: 0 Numsec = 0

Partition 3 type is Empty (0x0)
Partition is NOT ACTIVE.
Partition starts at LBA: 0 Numsec = 0

Disk Size: 31876710400 bytes
Sector size: 512 bytes

Done!
Physical Sector Size: 512
Drive: 3, DevicePointer: 0xffffffff83c114a8, DeviceName: \Device\Harddisk3\DR5\, DriverName: \Driver\Disk\
--------- Disk Stack ------
DevicePointer: 0xffffffff871a9020, DeviceName: Unknown, DriverName: \Driver\PartMgr\
DevicePointer: 0xffffffff83c114a8, DeviceName: \Device\Harddisk3\DR5\, DriverName: \Driver\Disk\
DevicePointer: 0xffffffff839ed850, DeviceName: \Device\000000ab\, DriverName: \Driver\USBSTOR\
------------ End ----------
Alternate DeviceName: \Device\Harddisk3\DR5\, DriverName: \Driver\Disk\
Upper DeviceData: 0x0, 0x0, 0x0
Lower DeviceData: 0x0, 0x0, 0x0
Drive 3
Scanning MBR on drive 3...
Inspecting partition table:
MBR Signature: 55AA
Disk Signature: C3072E18

Partition information:

Partition 0 type is Other (0xc)
Partition is ACTIVE.
Partition starts at LBA: 32 Numsec = 62259168
Partition file system is FAT32
Partition is not bootable

Partition 1 type is Empty (0x0)
Partition is NOT ACTIVE.
Partition starts at LBA: 0 Numsec = 0

Partition 2 type is Empty (0x0)
Partition is NOT ACTIVE.
Partition starts at LBA: 0 Numsec = 0

Partition 3 type is Empty (0x0)
Partition is NOT ACTIVE.
Partition starts at LBA: 0 Numsec = 0

Disk Size: 31876710400 bytes
Sector size: 512 bytes

Done!
Scan finished
=======================================


Removal queue found; removal started
Removing C:\Documents and Settings\All Users\Application Data\Malwarebytes' Anti-Malware (portable)\MBR-0-i.mbam...
Removing C:\Documents and Settings\All Users\Application Data\Malwarebytes' Anti-Malware (portable)\VBR-0-0-63-i.mbam...
Removing C:\Documents and Settings\All Users\Application Data\Malwarebytes' Anti-Malware (portable)\MBR-0-r.mbam...
Removing C:\Documents and Settings\All Users\Application Data\Malwarebytes' Anti-Malware (portable)\MBR-1-i.mbam...
Removing C:\Documents and Settings\All Users\Application Data\Malwarebytes' Anti-Malware (portable)\VBR-1-0-3216-i.mbam...
Removing C:\Documents and Settings\All Users\Application Data\Malwarebytes' Anti-Malware (portable)\MBR-1-r.mbam...
Removing C:\Documents and Settings\All Users\Application Data\Malwarebytes' Anti-Malware (portable)\MBR-2-i.mbam...
Removing C:\Documents and Settings\All Users\Application Data\Malwarebytes' Anti-Malware (portable)\VBR-2-0-32-i.mbam...
Removing C:\Documents and Settings\All Users\Application Data\Malwarebytes' Anti-Malware (portable)\MBR-2-r.mbam...
Removing C:\Documents and Settings\All Users\Application Data\Malwarebytes' Anti-Malware (portable)\MBR-3-i.mbam...
Removing C:\Documents and Settings\All Users\Application Data\Malwarebytes' Anti-Malware (portable)\VBR-3-0-32-i.mbam...
Removing C:\Documents and Settings\All Users\Application Data\Malwarebytes' Anti-Malware (portable)\MBR-3-r.mbam...
Removal finished

 

Here are several notes regarding the process with Combofix.

1. Comodo Internet disabled. Choices were for 15,30, 60 minutes or permanently. I chose 60 minutes, however just before reboot, that time ran out and Comodo restarted. Combofix continued but I don't know if it was affected at all with the end log.

2. I totally forgot about Winpatrol and it was not disabled.

3. At the completion of Stage 5 the following error appeared:
PEV.exe application error. The instruction at "0x7c910b2" referenced memory at "0x00363488." The memory could not be "written ". Click on OK to terminate the program, Cancel to debug. I chose OK and Combofix continued.

4. This message appeared when getting ready to reboot via Combofix:
Unable to create file: C:\Windodws\erdnt\subs\ERDNT.INF
Registry backup will continue but no restore information for the ERDNT program will be saved. This means that later restoration of the registry can only be done manually, by using another OS to copy back the files.

5. After rebooting, the hard drive is still running constantly. There was a dropbox update that occurred just after internet service was restored, but it is still running almost constant. 10 minutes later: It just now slowed down so I'll give it some time to maybe straighten itself out.

Here is the log:
ComboFix 14-04-20.01 - Owner 04/22/2014 20:47:34.1.2 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1022.460 [GMT -4:00]
Running from: f:\diagnostics\ComboFix.exe
AV: COMODO Antivirus *Disabled/Updated* {043803A5-4F86-4ef7-AFC5-F6E02A79969B}
AV: ZoneAlarm Free Firewall Antivirus *Disabled/Updated* {5D467B10-818C-4CAB-9FF7-6893B5B8F3CF}
FW: COMODO Firewall *Disabled* {043803A3-4F86-4ef6-AFC5-F6E02A79969B}
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\documents and settings\Owner\My Documents\83.tmp
c:\documents and settings\Owner\My Documents\C9.tmp
C:\install.exe
c:\program files\Hola\app
c:\program files\Hola\app\audio_res_ui_cm_app_start.mp2
c:\program files\Hola\app\audio_res_ui_cm_connect_btn_hover_050.mp2
c:\program files\Hola\app\audio_res_ui_cm_hola.mp2
c:\program files\Hola\app\audio_res_ui_util_btn_hover.mp2
c:\program files\Hola\app\hola_cert.spc
c:\program files\Hola\app\hola_drv.sys
c:\program files\Hola\app\hola_drv5.cat
c:\program files\Hola\app\hola_drv5.inf
c:\program files\Hola\app\hola_drv6.cat
c:\program files\Hola\app\hola_drv6.inf
c:\program files\Hola\app\hola_mon_drv.cat
c:\program files\Hola\app\hola_mon_drv.inf
c:\program files\Hola\app\hola_mon_drv.sys
c:\program files\Hola\app\hola_net.cat
c:\program files\Hola\app\hola_net.inf
c:\program files\Hola\app\hola_net.sys
c:\program files\Hola\app\hola_setup.exe
c:\program files\Hola\app\image\Hola-Setup-1.0.241.1.exe
c:\program files\Hola\app\image\Hola-Setup-1.0.241.exe
c:\program files\Hola\app\lsp_1.0.241.dll
c:\windows\system32\c.bat
c:\windows\system32\SETD6.tmp
c:\windows\system32\SETDB.tmp
.
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
-------\Legacy_HOLA-DRV
-------\Service_npf
.
.
((((((((((((((((((((((((( Files Created from 2014-03-23 to 2014-04-23 )))))))))))))))))))))))))))))))
.
.
2014-04-22 21:19 . 2014-04-22 22:16 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes' Anti-Malware (portable)
2014-04-21 16:11 . 2014-04-22 21:19 107224 ----a-w- c:\windows\system32\drivers\MBAMSwissArmy.sys
2014-04-21 16:10 . 2014-04-22 21:17 52312 ----a-w- c:\windows\system32\drivers\mbamchameleon.sys
2014-04-21 16:10 . 2014-04-21 16:10 -------- d-----w- c:\program files\Malwarebytes Anti-Malware
2014-04-15 19:51 . 2014-04-15 19:51 -------- d-----w- C:\VTRoot
2014-04-15 19:50 . 2014-04-15 19:52 5128 ----a-w- c:\windows\system32\drivers\fvstore.dat
2014-04-13 23:08 . 2012-03-05 21:53 56088 ----a-w- c:\windows\system32\winrdlv3.exe
2014-04-13 18:12 . 2014-04-13 18:12 -------- d-sh--w- c:\windows\system32\config\systemprofile\IETldCache
2014-04-13 18:03 . 2014-04-23 01:34 909201 ----a-w- c:\windows\system32\drivers\sfi.dat
2014-04-13 17:52 . 2014-04-13 17:53 -------- d-s---w- c:\documents and settings\All Users\Application Data\Shared Space
2014-04-13 17:49 . 2014-04-13 17:49 -------- d-----w- c:\program files\COMODO
2014-04-13 17:49 . 2014-04-13 18:05 -------- d-----w- c:\documents and settings\All Users\Application Data\Comodo
2014-04-13 17:49 . 2014-04-13 17:49 -------- d-----w- c:\documents and settings\All Users\Application Data\Comodo Downloader
2014-04-11 16:52 . 2014-04-11 16:52 -------- d-----w- C:\Autoruns
2014-04-11 16:38 . 2014-04-11 16:42 -------- d-----w- c:\documents and settings\Administrator
2014-04-10 13:50 . 2014-04-10 13:50 -------- d-----w- c:\documents and settings\LocalService\Application Data\Box Sync
2014-04-07 17:27 . 2001-08-18 02:36 170496 ----a-w- c:\windows\system32\LXCASUI.DLL
2014-04-01 14:17 . 2014-04-01 14:17 -------- d-----w- c:\documents and settings\Owner\Application Data\DropboxMaster
2014-03-26 23:08 . 2014-02-26 01:59 13312 ------w- c:\windows\system32\xp_eos.exe
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2014-04-16 21:12 . 2013-06-18 20:16 104920 ----a-w- c:\windows\system32\drivers\inspect.sys
2014-04-16 21:12 . 2013-07-09 01:59 607448 ----a-w- c:\windows\system32\drivers\cmdGuard.sys
2014-04-16 21:12 . 2013-06-18 20:16 29912 ----a-w- c:\windows\system32\drivers\cmdhlp.sys
2014-04-16 21:12 . 2013-06-18 20:16 15704 ----a-w- c:\windows\system32\drivers\cmderd.sys
2014-04-15 21:25 . 2014-02-23 18:22 692400 ----a-w- c:\windows\system32\FlashPlayerApp.exe
2014-04-15 21:25 . 2014-02-23 18:22 70832 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2014-04-11 01:35 . 2014-04-11 01:36 550371 ----a-w- C:\Autoruns.zip
2014-04-03 13:50 . 2013-04-12 16:06 23256 ----a-w- c:\windows\system32\drivers\mbam.sys
2014-03-25 19:22 . 2013-06-18 20:15 36000 ----a-w- c:\windows\system32\cmdcsr.dll
2014-03-25 19:22 . 2013-06-18 20:15 363504 ----a-w- c:\windows\system32\guard32.dll
2014-03-25 19:22 . 2013-06-18 20:15 284888 ----a-w- c:\windows\system32\cmdvrt32.dll
2014-03-25 19:22 . 2013-06-18 20:15 40664 ----a-w- c:\windows\system32\cmdkbd32.dll
2014-03-18 20:20 . 2014-03-18 20:20 4608 ----a-w- c:\windows\system32\bbchlp.dll
2014-03-18 20:20 . 2014-03-18 20:20 4096 ----a-w- c:\windows\system32\drivers\bbcap.sys
2014-03-18 20:20 . 2014-03-18 20:20 30720 ----a-w- c:\windows\system32\bbcap.dll
2014-03-06 17:59 . 2008-04-14 09:42 920064 ----a-w- c:\windows\system32\wininet.dll
2014-03-06 17:59 . 2008-04-14 09:42 1469440 ------w- c:\windows\system32\inetcpl.cpl
2014-03-06 17:59 . 2008-04-14 09:41 43520 ------w- c:\windows\system32\licmgr10.dll
2014-03-06 17:59 . 2008-04-14 09:41 18944 ------w- c:\windows\system32\corpol.dll
2014-03-06 00:46 . 2008-04-14 04:07 385024 ------w- c:\windows\system32\html.iec
2014-02-07 02:01 . 2008-04-14 05:00 1879040 ----a-w- c:\windows\system32\win32k.sys
2014-02-05 08:55 . 2008-04-14 09:42 562688 ----a-w- c:\windows\system32\qedit.dll
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\0000BoxSyncFileLocked]
@= "{1b9c95e1-ce36-3737-81c8-1ec9807f03c1} "
[HKEY_CLASSES_ROOT\CLSID\{1b9c95e1-ce36-3737-81c8-1ec9807f03c1}]
2009-11-07 06:07 297808 ----a-w- c:\windows\system32\mscoree.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\0000BoxSyncNotSynced]
@= "{e22ccf16-2db6-3de8-9a2c-acb66b571b69} "
[HKEY_CLASSES_ROOT\CLSID\{e22ccf16-2db6-3de8-9a2c-acb66b571b69}]
2009-11-07 06:07 297808 ----a-w- c:\windows\system32\mscoree.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\0000BoxSyncProblem]
@= "{84878798-e5c4-3e6b-b7c4-b51c4ac4e7dc} "
[HKEY_CLASSES_ROOT\CLSID\{84878798-e5c4-3e6b-b7c4-b51c4ac4e7dc}]
2009-11-07 06:07 297808 ----a-w- c:\windows\system32\mscoree.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\0000BoxSyncSynced]
@= "{01fcd170-7f0a-3b6a-b992-66a7a20289b5} "
[HKEY_CLASSES_ROOT\CLSID\{01fcd170-7f0a-3b6a-b992-66a7a20289b5}]
2009-11-07 06:07 297808 ----a-w- c:\windows\system32\mscoree.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\001IDriveSyncExt1]
@= "{A30768B3-9C38-4810-AAC3-422B73A0B25C} "
[HKEY_CLASSES_ROOT\CLSID\{A30768B3-9C38-4810-AAC3-422B73A0B25C}]
2012-10-03 09:02 673912 ----a-w- c:\documents and settings\All Users\Application Data\IDriveSync\IDSyncIcon.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\001IDriveSyncExt2]
@= "{906E4756-73EC-4A58-A3B1-461B759D8F7B} "
[HKEY_CLASSES_ROOT\CLSID\{906E4756-73EC-4A58-A3B1-461B759D8F7B}]
2012-10-03 09:02 673912 ----a-w- c:\documents and settings\All Users\Application Data\IDriveSync\IDSyncIcon.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\001IDriveSyncExt3]
@= "{5DF1669E-DBBC-4C36-918E-8E470774D7AF} "
[HKEY_CLASSES_ROOT\CLSID\{5DF1669E-DBBC-4C36-918E-8E470774D7AF}]
2012-10-03 09:02 673912 ----a-w- c:\documents and settings\All Users\Application Data\IDriveSync\IDSyncIcon.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@= "{FB314ED9-A251-47B7-93E1-CDD82E34AF8B} "
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2013-09-11 02:09 131248 ----a-w- c:\documents and settings\Owner\Application Data\Dropbox\bin\DropboxExt.22.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@= "{FB314EDA-A251-47B7-93E1-CDD82E34AF8B} "
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2013-09-11 02:09 131248 ----a-w- c:\documents and settings\Owner\Application Data\Dropbox\bin\DropboxExt.22.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@= "{FB314EDB-A251-47B7-93E1-CDD82E34AF8B} "
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2013-09-11 02:09 131248 ----a-w- c:\documents and settings\Owner\Application Data\Dropbox\bin\DropboxExt.22.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt4]
@= "{FB314EDC-A251-47B7-93E1-CDD82E34AF8B} "
[HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}]
2013-09-11 02:09 131248 ----a-w- c:\documents and settings\Owner\Application Data\Dropbox\bin\DropboxExt.22.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\UEAFOverlay]
@= "{F2F31467-B1AC-4df0-AE79-FD5FA085E22B} "
[HKEY_CLASSES_ROOT\CLSID\{F2F31467-B1AC-4df0-AE79-FD5FA085E22B}]
2007-11-14 17:22 3186440 ----a-w- c:\program files\Protector Suite QL\farchns.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\UEAFOverlayOpen]
@= "{A3E208F7-0E3A-4182-A7A6-B169D5D691AA} "
[HKEY_CLASSES_ROOT\CLSID\{A3E208F7-0E3A-4182-A7A6-B169D5D691AA}]
2007-11-14 17:22 3186440 ----a-w- c:\program files\Protector Suite QL\farchns.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"WinPatrol "= "c:\program files\BillP Studios\WinPatrol\winpatrol.exe" [2013-08-13 439360]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon "= "c:\windows\system32\NvCpl.dll" [2009-01-30 13594624]
"SDTray "= "c:\program files\Spybot - Search & Destroy 2\SDTray.exe" [2013-07-25 5624784]
"COMODO Internet Security "= "c:\program files\COMODO\COMODO Internet Security\cistray.exe" [2014-03-25 1225944]
.
c:\documents and settings\Owner\Start Menu\Programs\Startup\
Dropbox.lnk - c:\documents and settings\Owner\Application Data\Dropbox\bin\Dropbox.exe /systemstartup [2014-3-19 32667896]
Xcalday.lnk - c:\program files\Xcalday\xcalday.exe [2007-10-22 184320]
.
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{A16CA976-4B8D-47FC-A9F4-651C17B636EF} "= "c:\windows\system32\msowcnv3.dll" [2012-03-05 437032]
"{56F9679E-7826-4C84-81F3-532071A8BCC5} "= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2009-05-25 304128]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LMIinit]
2013-06-09 15:12 92488 ----a-w- c:\windows\system32\LMIinit.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\psfus]
2007-11-14 17:07 96008 ----a-w- c:\windows\system32\psqlpwd.dll
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk *\0\0sdnclean.exe
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Notification Packages REG_MULTI_SZ scecli psqlpwd
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\.Winhlpsvr]
@= "Service "
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\ipnpf.sys]
@= "Driver "
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^McAfee Security Scan Plus.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk
backup=c:\windows\pss\McAfee Security Scan Plus.lnkCommon Startup
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Windows Search.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Windows Search.lnk
backup=c:\windows\pss\Windows Search.lnkCommon Startup
.
[HKLM\~\startupfolder\C:^Documents and Settings^Owner^Start Menu^Programs^Startup^IDriveSync.lnk]
path=c:\documents and settings\Owner\Start Menu\Programs\Startup\IDriveSync.lnk
backup=c:\windows\pss\IDriveSync.lnkStartup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KernelFaultCheck]
c:\windows\system32\dumprep 0 -k [X]
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AGRSMMSG]
2011-01-20 11:14 88203 ----a-w- c:\windows\agrsmmsg.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Alcmtr]
2005-05-03 23:43 69632 ----a-w- c:\windows\ALCMTR.EXE
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Box Sync]
2014-04-07 14:09 12247336 ----a-w- c:\program files\Box\Box Sync\BoxSync.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BoxSync]
2014-04-07 14:09 12247336 ----a-w- c:\program files\Box\Box Sync\BoxSync.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DivXMediaServer]
2013-01-30 03:34 450560 ----a-w- c:\program files\DivX\DivX Media Server\DivXMediaServer.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\JumiController]
2012-09-07 18:55 3631616 ----a-w- c:\program files\Jumi\jumi.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogMeIn GUI]
2010-09-17 20:40 63048 ----a-w- c:\program files\LogMeIn\x86\LogMeInSystray.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
2008-04-14 10:42 1695232 --sh--w- c:\program files\Messenger\msmsgs.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon]
2009-01-30 14:12 13594624 ----a-w- c:\windows\system32\nvcpl.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]
2009-01-30 14:12 1657376 ----a-w- c:\windows\system32\nwiz.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PSQLLauncher]
2007-11-14 16:38 49416 ----a-w- c:\program files\Protector Suite QL\launcher.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RTHDCPL]
2005-09-22 18:36 14854144 ----a-w- c:\windows\RTHDCPL.EXE
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2013-07-02 13:16 254336 ----a-w- c:\program files\Common Files\Java\Java Update\jusched.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Tresorit]
2013-04-30 14:02 1201000 ----a-w- c:\documents and settings\Owner\Application Data\Tresorit\v0.5\Tresorit.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"SplashtopRemoteService "=2 (0x2)
"vsmon "=2 (0x2)
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"FirewallOverride "=dword:00000001
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall "= 0 (0x0)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe "=
"%windir%\\system32\\sessmgr.exe "=
"c:\\Documents and Settings\\Owner\\Application Data\\Dropbox\\bin\\Dropbox.exe "=
"c:\\Documents and Settings\\Owner\\Application Data\\IDriveSync\\IDriveSync_Service.exe "=
"c:\\Documents and Settings\\Owner\\Application Data\\IDriveSync\\idevsutil.exe "=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe "=
"c:\\Program Files\\Spybot - Search & Destroy 2\\SDTray.exe "=
"c:\\Program Files\\Spybot - Search & Destroy 2\\SDFSSvc.exe "=
"c:\\Program Files\\Spybot - Search & Destroy 2\\SDUpdate.exe "=
"c:\\Program Files\\Spybot - Search & Destroy 2\\SDUpdSvc.exe "=
"c:\\a\\internetport3.exe "=
"c:\\WINDOWS\\system32\\mmc.exe "=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"9235:TCP "= 9235:TCP:Net Management V3 TCP 1
"9235:UDP "= 9235:UDP:Net Management V3 UDP 1
"9237:TCP "= 9237:TCP:Net Management V3 TCP 2
"9237:UDP "= 9237:UDP:Net Management V3 UDP 2
"8643:UDP "= 8643:UDP:Net Management V3 UDP 3
"8200:TCP "= 8200:TCP:Net Management V3 TCP 5
"8226:TCP "= 8226:TCP:Net Management V3 TCP 6
"5985:TCP "= 5985:TCP:*isabled:Windows Remote Management
.
R0 Thpevm;TOSHIBA HDD Protection - Shock Sensor Driver;c:\windows\system32\drivers\Thpevm.sys [9/4/2007 2:14 AM 6528]
R0 TPacket;TPacket Driver;c:\windows\system32\drivers\tpacket.sys [12/24/2012 1:38 PM 75336]
R1 cmderd;COMODO Internet Security Eradication Driver;c:\windows\system32\drivers\cmderd.sys [6/18/2013 4:16 PM 15704]
R1 cmdGuard;COMODO Internet Security Driver;c:\windows\system32\drivers\cmdGuard.sys [7/8/2013 9:59 PM 607448]
R1 cmdHlp;COMODO Internet Security Helper Driver;c:\windows\system32\drivers\cmdhlp.sys [6/18/2013 4:16 PM 29912]
R1 IPNPF;WinPcap Packet Driver (IPNPF);c:\windows\system32\drivers\ipnpf.sys [12/24/2012 1:38 PM 42704]
R1 TSysDrv;TSysDrv;c:\windows\system32\drivers\tsysdrv.sys [12/24/2012 1:38 PM 78024]
R2 LMIInfo;LogMeIn Kernel Information Provider;c:\program files\LogMeIn\x86\rainfo.sys [9/17/2010 4:40 PM 13624]
R2 SCRCAMHRDRV;ScreenCamera Video Camera;c:\windows\system32\drivers\SCRCAMHRDRV.sys [10/9/2012 8:38 PM 233096]
R2 SDScannerService;Spybot-S&D 2 Scanner Service;c:\program files\Spybot - Search & Destroy 2\SDFSSvc.exe [11/25/2013 11:43 AM 3921880]
R2 SDUpdateService;Spybot-S&D 2 Updating Service;c:\program files\Spybot - Search & Destroy 2\SDUpdSvc.exe [11/25/2013 11:44 AM 1042272]
R3 bbcap;bbcap;c:\windows\system32\drivers\bbcap.sys [3/18/2014 4:20 PM 4096]
R3 jumi;%Jumi%;c:\windows\system32\drivers\jumi.sys [6/3/2010 11:07 AM 13112]
R3 stdriver;SoundTap Upper Filter Driver v6.05.00;c:\windows\system32\drivers\stdriverx86.sys [9/11/2012 6:32 PM 40344]
S2 .Winhlpsvr;Windows Helper Service;c:\program files\Common Files\System\winrdgv3.exe [12/24/2012 1:38 PM 629544]
S2 SDWSCService;Spybot-S&D 2 Security Center Service;c:\program files\Spybot - Search & Destroy 2\SDWSCSvc.exe [11/25/2013 11:44 AM 171416]
S3 BoxSyncUpdateService;Box Sync Update Service;c:\program files\Box\Box Sync\SyncUpdaterService.exe [2/23/2014 11:22 AM 22016]
S3 cmdvirth;COMODO Virtual Service Manager;c:\program files\COMODO\COMODO Internet Security\cmdvirth.exe [6/18/2013 4:15 PM 1663192]
S3 cpudrv;cpudrv;\??\c:\program files\SystemRequirementsLab\cpudrv.sys --> c:\program files\SystemRequirementsLab\cpudrv.sys [?]
S3 LMIGuardianSvc;LMIGuardianSvc;c:\program files\LogMeIn\x86\LMIGuardianSvc.exe [12/8/2010 2:11 PM 375120]
S3 TFsfltdrv;TFsfltdrv;c:\windows\system32\drivers\tfsfltdrv.sys [12/24/2012 1:38 PM 35272]
S3 TVDisk;TVDisk;c:\windows\system32\drivers\tvdisk.sys [12/24/2012 1:38 PM 334672]
.
--- Other Services/Drivers In Memory ---
.
*NewlyCreated* - WS2IFSL
*Deregistered* - mbamchameleon
.
Contents of the 'Scheduled Tasks' folder
.
2014-04-16 c:\windows\Tasks\Backup.job
- c:\windows\system32\ntbackup.exe [2008-04-14 09:42]
.
2014-04-22 c:\windows\Tasks\Check for updates (Spybot - Search & Destroy).job
- c:\program files\Spybot - Search & Destroy 2\SDUpdate.exe [2013-11-25 15:57]
.
2014-04-23 c:\windows\Tasks\COMODO Cache Builder {0FB77674-7905-4F34-A362-C5A9A26F8CF9}.job
- c:\program files\COMODO\COMODO Internet Security\cfpconfg.exe [2013-07-09 21:12]
.
2014-04-23 c:\windows\Tasks\COMODO Scan {F140D794-60B6-4F00-9235-D6457AA25B22}.job
- c:\program files\COMODO\COMODO Internet Security\cfpconfg.exe [2013-07-09 21:12]
.
2014-04-23 c:\windows\Tasks\COMODO Signature Update {B9D5C6F9-17D2-4917-8BD0-614BAA1C6A59}.job
- c:\program files\COMODO\COMODO Internet Security\cfpconfg.exe [2013-07-09 21:12]
.
2014-04-23 c:\windows\Tasks\COMODO Update {A6D52E4F-569B-4756-B3D8-DF217313DA85}.job
- c:\program files\COMODO\COMODO Internet Security\cfpconfg.exe [2013-07-09 21:12]
.
2014-04-03 c:\windows\Tasks\Refresh immunization (Spybot - Search & Destroy).job
- c:\program files\Spybot - Search & Destroy 2\SDImmunize.exe [2013-11-25 15:49]
.
2014-01-23 c:\windows\Tasks\Scan the system (Spybot - Search & Destroy).job
- c:\program files\Spybot - Search & Destroy 2\SDScan.exe [2013-11-25 15:51]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com
uInternet Connection Wizard,ShellNext = hxxp://www.google.com/
uInternet Settings,ProxyOverride = <-loopback>
uInternet Settings,ProxyServer = localhost:21320
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
TCP: DhcpNameServer = 192.168.254.254
TCP: Interfaces\{FA9CAED8-EF6C-4E64-9703-86F0D919EB74}: NameServer = 192.168.254.254
FF - ProfilePath - c:\documents and settings\Owner\Application Data\Mozilla\Firefox\Profiles\29v635vw.default-1395516145859\
FF - prefs.js: network.proxy.type - 0
.
- - - - ORPHANS REMOVED - - - -
.
ShellExecuteHooks-{4F07DA45-8170-4859-9B5F-037EF2970034} - (no file)
Notify-SDWinLogon - SDWinLogon.dll
MSConfigStartUp-SugarSync - c:\program files\SugarSync\SugarSyncManager.exe
AddRemove-TwistedBrush Pro Studio - c:\program files\Pixarra\TwistedBrush\Uninstal.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2014-04-22 21:36
Windows 5.1.2600 Service Pack 3 NTFS
.
detected NTDLL code modification:
ZwClose
.
scanning hidden processes ...
.
scanning hidden autostart entries ...
.
scanning hidden files ...
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_LOCAL_MACHINE\software\COMODO\CIS\Installer\Sym_Cam\CIS]
"SymbolicLinkValue "=hex(6):5c,00,52,00,65,00,67,00,69,00,73,00,74,00,72,00,79,
00,5c,00,4d,00,41,00,43,00,48,00,49,00,4e,00,45,00,5c,00,53,00,4f,00,46,00,\
.
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\cmdAgent\Mode\Configurations]
"SymbolicLinkValue "=hex(6):5c,00,52,00,65,00,67,00,69,00,73,00,74,00,72,00,79,
00,5c,00,4d,00,41,00,43,00,48,00,49,00,4e,00,45,00,5c,00,53,00,59,00,53,00,\
.
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\cmdAgent\Mode\Data]
"SymbolicLinkValue "=hex(6):5c,00,52,00,65,00,67,00,69,00,73,00,74,00,72,00,79,
00,5c,00,4d,00,41,00,43,00,48,00,49,00,4e,00,45,00,5c,00,53,00,4f,00,46,00,\
.
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\cmdAgent\Mode\Options]
"SymbolicLinkValue "=hex(6):5c,00,52,00,65,00,67,00,69,00,73,00,74,00,72,00,79,
00,5c,00,4d,00,41,00,43,00,48,00,49,00,4e,00,45,00,5c,00,53,00,4f,00,46,00,\
.
[HKEY_LOCAL_MACHINE\System\Software\COMODO\Cam]
"SymbolicLinkValue "=hex(6):5c,00,52,00,65,00,67,00,69,00,73,00,74,00,72,00,79,
00,5c,00,4d,00,41,00,43,00,48,00,49,00,4e,00,45,00,5c,00,53,00,4f,00,46,00,\
.
[HKEY_LOCAL_MACHINE\System\Software\COMODO\Firewall Pro]
"SymbolicLinkValue "=hex(6):5c,00,52,00,65,00,67,00,69,00,73,00,74,00,72,00,79,
00,5c,00,4d,00,41,00,43,00,48,00,49,00,4e,00,45,00,5c,00,53,00,59,00,53,00,\
.
--------------------- DLLs Loaded Under Running Processes ---------------------
.
- - - - - - - > 'winlogon.exe'(600)
c:\windows\system32\LMIinit.dll
c:\windows\system32\psqlpwd.dll
c:\program files\Protector Suite QL\homefus2.dll
c:\program files\Protector Suite QL\infql2.dll
c:\program files\Protector Suite QL\homepass.dll
c:\program files\Protector Suite QL\bio.dll
c:\program files\Protector Suite QL\qlbase.dll
c:\windows\system32\LMIRfsClientNP.dll
c:\windows\system32\winwdgv3.dll
.
- - - - - - - > 'lsass.exe'(656)
c:\windows\system32\guard32.dll
c:\windows\system32\psqlpwd.dll
c:\program files\Protector Suite QL\homefus2.dll
c:\program files\Protector Suite QL\infql2.dll
c:\windows\system32\mswsock.dll
c:\windows\System32\wshtcpip.dll
.
- - - - - - - > 'explorer.exe'(2880)
c:\windows\system32\WININET.dll
c:\windows\system32\guard32.dll
c:\program files\BillP Studios\WinPatrol\PATROLPRO.DLL
c:\documents and settings\All Users\Application Data\IDriveSync\IDSyncIcon.dll
c:\documents and settings\Owner\Application Data\Dropbox\bin\DropboxExt.22.dll
c:\program files\Windows Media Player\wmpband.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WS2_32.dll
c:\windows\system32\WS2HELP.dll
c:\windows\system32\mswsock.dll
c:\windows\System32\wshtcpip.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
c:\windows\system32\LMIRfsClientNP.dll
.
- - - - - - - > 'csrss.exe'(568)
c:\windows\system32\cmdcsr.dll
.
------------------------ Other Running Processes ------------------------
.
c:\program files\COMODO\COMODO Internet Security\cmdagent.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\windows\system32\winrdlv3.exe
c:\program files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
c:\windows\system32\nvsvc32.exe
c:\documents and settings\Owner\Application Data\Dropbox\bin\Dropbox.exe
c:\windows\system32\winrdlv3.exe
c:\program files\COMODO\COMODO Internet Security\cavwp.exe
.
**************************************************************************
.
Completion time: 2014-04-22 21:58:17 - machine was rebooted
ComboFix-quarantined-files.txt 2014-04-23 01:57
.
Pre-Run: 46,722,449,408 bytes free
Post-Run: 46,574,690,304 bytes free
.
WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT= "Microsoft Windows Recovery Console" /cmdcons
UnsupportedDebug= "do not select this" /debug
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS= "Microsoft Windows XP Professional" /fastdetect /NoExecute=OptOut
[spybotsd]
timeout.old=30
.
- - End Of File - - 7D7B1E1115F9CF8180B944AC9FE205D6
8F558EB6672622401DA993E1E865C861

 

I can't seem to find McAfee Security Scan Plus. I checked my programs list and also Add/Remove Programs list. Would it be under something else or another name?

 

Ok - Skipped

Here are the latest results:

# AdwCleaner v3.202 - Report created 23/04/2014 at 16:56:49
# Updated 23/04/2014 by Xplode
# Operating System : Microsoft Windows XP Service Pack 3 (32 bits)
# Username : Owner - NEWTECRA_F
# Running from : C:\Documents and Settings\Owner\Desktop\Diagnostics\adwcleaner.exe
# Option : Clean

***** [ Services ] *****


***** [ Files / Folders ] *****

Folder Deleted : C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\mf2ucerz.KAL 2013-04\Extensions\cyyejnq@vfhaubxr-.net
Folder Deleted : C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\mf2ucerz.KAL 2013-04\Extensions\uvz@oyuyzfyr.edu

***** [ Shortcuts ] *****


***** [ Registry ] *****

Key Deleted : HKLM\SOFTWARE\Classes\AppID\{C007DADD-132A-624C-088E-59EE6CF0711F}

***** [ Browsers ] *****

-\\ Internet Explorer v8.0.6001.18702


-\\ Mozilla Firefox v28.0 (en-US)

[ File : C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\29v635vw.default-1395516145859\prefs.js ]


[ File : C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\mf2ucerz.KAL 2013-04\prefs.js ]


[ File : C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\tjqnwqmw.default-1395513112421\prefs.js ]

Line Deleted : user_pref( "extensions.fvd_single.surfcanyon.ramp.start_time ", "1395530084554 ");

*************************

AdwCleaner[R0].txt - [4238 octets] - [22/11/2013 20:07:28]
AdwCleaner[R1].txt - [1660 octets] - [23/04/2014 16:54:44]
AdwCleaner[S0].txt - [4387 octets] - [22/11/2013 20:15:45]
AdwCleaner[S1].txt - [1589 octets] - [23/04/2014 16:56:49]

########## EOF - C:\AdwCleaner\AdwCleaner[S1].txt - [1649 octets] ##########


~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.1.4 (04.06.2014:1)
OS: Microsoft Windows XP x86
Ran by Owner on Wed 04/23/2014 at 17:11:29.04
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




~~~ Services



~~~ Registry Values

Successfully repaired: [Registry Value] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\\DisplayName
Successfully repaired: [Registry Value] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\\URL



~~~ Registry Keys



~~~ Files



~~~ Folders

Successfully deleted: [Folder] "C:\Documents and Settings\Owner\Application Data\getrighttogo "





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on Wed 04/23/2014 at 17:58:27.75
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

 

OTL Extras logfile created on: 4/23/2014 6:02:00 PM - Run 1
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Documents and Settings\Owner\Desktop\Diagnostics
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

1021.92 Mb Total Physical Memory | 194.93 Mb Available Physical Memory | 19.07% Memory free
2.40 Gb Paging File | 1.67 Gb Available in Paging File | 69.50% Paging File free
Paging file location(s): C:\pagefile.sys 0 0 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 74.52 Gb Total Space | 43.18 Gb Free Space | 57.94% Space Free | Partition Type: NTFS
Drive E: | 29.67 Gb Total Space | 29.00 Gb Free Space | 97.74% Space Free | Partition Type: FAT32
Drive F: | 29.67 Gb Total Space | 13.27 Gb Free Space | 44.71% Space Free | Partition Type: FAT32
Drive G: | 14.44 Gb Total Space | 5.94 Gb Free Space | 41.12% Space Free | Partition Type: FAT32

Computer Name: NEWTECRA_F | User Name: Owner | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========


========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- rundll32.exe shell32.dll,Control_RunDLL "%1 ",%*
.url [@ = InternetShortcut] -- rundll32.exe ieframe.dll,OpenURL %l

[HKEY_USERS\S-1-5-21-484763869-602162358-1606980848-1003\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- rundll32.exe shell32.dll,Control_RunDLL "%1 ",%*
exefile [open] -- "%1" %*
InternetShortcut [open] -- rundll32.exe ieframe.dll,OpenURL %l
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1 "
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" (VideoLAN)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" (VideoLAN)
Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" = 1
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 0
"FirewallOverride" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]

========== System Restore Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sr]
"Start" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SrService]
"Start" = 2

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List]
"139:TCP" = 139:TCP:*:Enabledxpsp2res.dll,-22004
"445:TCP" = 445:TCP:*:Enabledxpsp2res.dll,-22005
"137:UDP" = 137:UDP:*:Enabledxpsp2res.dll,-22001
"138:UDP" = 138:UDP:*:Enabledxpsp2res.dll,-22002
"1900:UDP" = 1900:UDP:LocalSubNet:Enabledxpsp2res.dll,-22007
"2869:TCP" = 2869:TCP:LocalSubNet:Enabledxpsp2res.dll,-22008

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 0
"DoNotAllowExceptions" = 0
"DisableNotifications" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"1900:UDP" = 1900:UDP:LocalSubNet:Enabledxpsp2res.dll,-22007
"2869:TCP" = 2869:TCP:LocalSubNet:Enabledxpsp2res.dll,-22008
"139:TCP" = 139:TCP:LocalSubNet:Enabledxpsp2res.dll,-22004
"445:TCP" = 445:TCP:LocalSubNet:Enabledxpsp2res.dll,-22005
"137:UDP" = 137:UDP:LocalSubNet:Enabledxpsp2res.dll,-22001
"138:UDP" = 138:UDP:LocalSubNet:Enabledxpsp2res.dll,-22002
"9235:TCP" = 9235:TCP:*:Enabled:Net Management V3 TCP 1
"9235:UDP" = 9235:UDP:*:Enabled:Net Management V3 UDP 1
"9237:TCP" = 9237:TCP:*:Enabled:Net Management V3 TCP 2
"9237:UDP" = 9237:UDP:*:Enabled:Net Management V3 UDP 2
"8643:UDP" = 8643:UDP:*:Enabled:Net Management V3 UDP 3
"8200:TCP" = 8200:TCP:*:Enabled:Net Management V3 TCP 5
"8226:TCP" = 8226:TCP:*:Enabled:Net Management V3 TCP 6
"5985:TCP" = 5985:TCP:*isabled:Windows Remote Management

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
"%windir%\Network Diagnostic\xpnetdiag.exe" = %windir%\Network Diagnostic\xpnetdiag.exe:*:Enabledxpsp3res.dll,-20000 -- (Microsoft Corporation)
"%windir%\system32\sessmgr.exe" = %windir%\system32\sessmgr.exe:*:enabledxpsp2res.dll,-22019 -- (Microsoft Corporation)

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"%windir%\Network Diagnostic\xpnetdiag.exe" = %windir%\Network Diagnostic\xpnetdiag.exe:*:Enabledxpsp3res.dll,-20000 -- (Microsoft Corporation)
"%windir%\system32\sessmgr.exe" = %windir%\system32\sessmgr.exe:*:enabledxpsp2res.dll,-22019 -- (Microsoft Corporation)
"C:\Documents and Settings\Owner\Application Data\Dropbox\bin\Dropbox.exe" = C:\Documents and Settings\Owner\Application Data\Dropbox\bin\Dropbox.exe:*:Enabledropbox -- (Dropbox, Inc.)
"C:\Documents and Settings\Owner\Application Data\IDriveSync\IDriveSync_Service.exe" = C:\Documents and Settings\Owner\Application Data\IDriveSync\IDriveSync_Service.exe:*:Enabled:IDriveSync_Service -- ()
"C:\Documents and Settings\Owner\Application Data\IDriveSync\idevsutil.exe" = C:\Documents and Settings\Owner\Application Data\IDriveSync\idevsutil.exe:*:Enabled:IDriveSync_Util -- ()
"C:\Program Files\Bonjour\mDNSResponder.exe" = C:\Program Files\Bonjour\mDNSResponder.exe:*:Enabled:Bonjour Service -- (Apple Inc.)
"C:\Program Files\Spybot - Search & Destroy 2\SDTray.exe" = C:\Program Files\Spybot - Search & Destroy 2\SDTray.exe:*:Enabled:Spybot-S&D 2 Tray Icon -- (Safer-Networking Ltd.)
"C:\Program Files\Spybot - Search & Destroy 2\SDFSSvc.exe" = C:\Program Files\Spybot - Search & Destroy 2\SDFSSvc.exe:*:Enabled:Spybot-S&D 2 Scanner Service -- (Safer-Networking Ltd.)
"C:\Program Files\Spybot - Search & Destroy 2\SDUpdate.exe" = C:\Program Files\Spybot - Search & Destroy 2\SDUpdate.exe:*:Enabled:Spybot-S&D 2 Updater -- (Safer-Networking Ltd.)
"C:\Program Files\Spybot - Search & Destroy 2\SDUpdSvc.exe" = C:\Program Files\Spybot - Search & Destroy 2\SDUpdSvc.exe:*:Enabled:Spybot-S&D 2 Background update service -- (Safer-Networking Ltd.)
"C:\a\internetport3.exe" = C:\a\internetport3.exe:*:Enabled:Internetport3 -- ()
"C:\WINDOWS\system32\mmc.exe" = C:\WINDOWS\system32\mmc.exe:*:Enabled:Microsoft Management Console -- (Microsoft Corporation)


========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{02E89EFC-7B07-4D5A-AA03-9EC0902914EE}" = VC 9.0 Runtime
"{196467F1-C11F-4F76-858B-5812ADC83B94}" = MSXML 4.0 SP3 Parser
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{26A24AE4-039D-4CA4-87B4-2F83217040FF}" = Java 7 Update 51
"{2CD82D77-8D1E-44FC-9A90-BBA95AC8D6B7}" = Protector Suite QL 5.8
"{2E0DFC24-7C4B-4DCF-BCC7-81C513BED3BC}" = Python 2.5.4
"{350C97B0-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
"{3CC9FB6A-D981-4C54-BD47-DF1A63665337}" = Tresorit
"{45A66726-69BC-466B-A7A4-12FCBA4883D7}" = HiJackThis
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4BB7A109-FDB5-45E3-9DB9-ECB2EA7B80EE}" = WinPatrol
"{4F9F49B9-DCE9-E38E-1AC9-ABE838E38E11}" = FedEx Desktop
"{5969857A-B3B6-4CB8-8AC0-240E1A099246}" = COMODO Internet Security Premium
"{60CE924D-12CB-4A96-8B75-18F92CE1D585}" = CrazyTalk v6.21 SE
"{612C34C7-5E90-47D8-9B5C-0F717DD82726}" = swMSM
"{62D82EC1-0D3A-DF54-8E3E-07E1337A5311}" = saveNshare
"{63ea056b-184b-4da1-baeb-5e3cfba5b0d7}" = Box Sync
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{7216871F-869E-437C-B9BF-2A13F2DCE63F}_is1" = Auslogics BoostSpeed
"{73DBF28A-8E1B-44C5-BBB1-132859C27149}" = QFX2QIF
"{75BAE677-F65A-45A4-9931-363FE0CF5E58}_is1" = iSkysoft PDF Editor(Build 2.0.1)
"{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}" = Apple Software Update
"{79155F2B-9895-49D7-8612-D92580E0DE5B}" = Bonjour
"{8927E07C-97F7-4A54-88FB-D976F50DD46E}" = Turbo Lister 2
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{90110409-6000-11D3-8CFE-0150048383C9}" = Microsoft Office Professional Edition 2003
"{90140000-2005-0000-0000-0000000FF1CE}" = Microsoft Office File Validation Add-In
"{933B4015-4618-4716-A828-5289FC03165F}" = VC80CRTRedist - 8.0.50727.6195
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{95120000-0122-0409-0000-0000000FF1CE}" = Microsoft Office Outlook Connector
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{A0087DDE-69D0-11E2-AD57-43CA6188709B}" = Adobe AIR
"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2
"{A66DC1B4-F357-405F-9E27-533970F85053}" = Glide Desktop Applications
"{ADA51746-4979-4C3F-880D-15AE210CA2F1}" = Silhouette Studio
"{B4092C6D-E886-4CB2-BA68-FE5A99D31DE7}_is1" = Spybot - Search & Destroy
"{BAA0E38F-B7C0-456D-8660-4DE0572152E2}" = Box Sync
"{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{D3AE96EE-2876-4B3F-847C-D3A4AD689E43}" = LogMeIn
"{D627784F-B3EE-44E8-96B1-9509B991EA34}_is1" = Auslogics Registry Defrag
"{DD1865F0-AD73-40FB-B23E-1822E02396FF}" = NVIDIA PhysX
"{DF6A13C0-77DF-41FE-BD05-6D5201EB0CE7}_is1" = Auslogics DiskDefrag
"{E78FC917-C21B-11D2-99FE-00105A98B681}" = Microsoft Picture It! 2000
"{E7E3114A-CA9F-481A-94FD-41346EDE67CF}" = ML-2150 Series
"{EA2D9BC0-75E9-4975-9A0A-DD82198DDC53}" = MSXML 6.0 Parser
"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219
"{F0E12BBA-AD66-4022-A453-A1C8A0C4D570}" = Microsoft Choice Guard
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022
"Adobe AIR" = Adobe AIR
"Adobe Flash Player Plugin" = Adobe Flash Player 13 Plugin
"Adobe Shockwave Player" = Adobe Shockwave Player 12.1
"Ashampoo Burning Studio 2012_is1" = Ashampoo Burning Studio 2012 v.10.0.15
"Ashampoo Gadge It_is1" = Ashampoo Gadge It v.1.0.1
"Ashampoo Music Studio 2012_is1" = Ashampoo Music Studio 2012 v.1.0.0
"Ashampoo Photo Optimizer 4_is1" = Ashampoo Photo Optimizer 4 v.4.0.3
"Ashampoo Slideshow Studio 2012_is1" = Ashampoo Slideshow Studio 2012 v.1.0.2
"BB FlashBack Express" = BB FlashBack Express
"Belarc Advisor" = Belarc Advisor 8.2
"Cashbook Complete" = Cashbook Complete
"CCleaner" = CCleaner
"CPUID CPU-Z_is1" = CPUID CPU-Z 1.63.0
"DAZ 3D Install Manager 1 1.0.0.112" = DAZ 3D Install Manager 1
"Debenu PDF Tools" = Debenu PDF Tools 3.0.0.6
"Defraggler" = Defraggler
"DivX Setup" = DivX Setup
"doPDF 7 printer_is1" = doPDF 7.3 printer
"eFlip Standard_is1" = eFlip Standard
"Folder Marker_is1" = Folder Marker Home v 3.2 BDJ Edition
"Foxit Reader" = Foxit Reader
"ie8" = Windows Internet Explorer 8
"ImagePrinter" = ImagePrinter 2.1
"Malwarebytes Anti-Malware_is1" = Malwarebytes Anti-Malware version 2.0.1.1004
"Microsoft .NET Framework 1.1 (1033)" = Microsoft .NET Framework 1.1
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Mozilla Firefox 28.0 (x86 en-US)" = Mozilla Firefox 28.0 (x86 en-US)
"MozillaMaintenanceService" = Mozilla Maintenance Service
"MSCompPackV1" = Microsoft Compression Client Pack 1.0 for Windows XP
"NVIDIA Drivers" = NVIDIA Drivers
"PROSet" = Intel(R) Network Connections Drivers
"Recuva" = Recuva
"SeaMonkey (2.0.11)" = SeaMonkey (2.0.11)
"SmartCodeStudio" = SmartCodeStudio
"SpywareBlaster_is1" = SpywareBlaster 5.0
"Textaizer Pro_is1" = Textaizer Pro v4.3
"TOSHIBA Software Modem" = TOSHIBA Software Modem
"VLC media player" = VLC media player 2.1.2
"Windows Media Format Runtime" = Windows Media Format 11 runtime
"Windows Media Player" = Windows Media Player 11
"WMFDist11" = Windows Media Format 11 runtime
"wmp11" = Windows Media Player 11
"WMV9_VCM" = Microsoft Windows Media Video 9 VCM
"Wudf01000" = Microsoft User-Mode Driver Framework Feature Pack 1.0
"Xcalday" = Xcalday 1.3

========== HKEY_USERS Uninstall List ==========

[HKEY_USERS\S-1-5-21-484763869-602162358-1606980848-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Dropbox" = Dropbox
"e891758400ca417b" = Jays Snipping Tool
"IDriveSync" = IDriveSync

========== Last 20 Event Log Errors ==========

[ Application Events ]
Error - 4/22/2014 9:00:20 PM | Computer Name = NEWTECRA_F | Source = Application Error | ID = 1000
Description = Faulting application pev.exe, version 0.0.0.0, faulting module unknown,
version 0.0.0.0, fault address 0x00bf3fb1.

Error - 4/22/2014 11:15:41 PM | Computer Name = NEWTECRA_F | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: Continuously busy for more than a second

Error - 4/22/2014 11:15:41 PM | Computer Name = NEWTECRA_F | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledEvent 1953

Error - 4/22/2014 11:15:41 PM | Computer Name = NEWTECRA_F | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledSPRetry 1953

Error - 4/22/2014 11:15:43 PM | Computer Name = NEWTECRA_F | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: Continuously busy for more than a second

Error - 4/22/2014 11:15:43 PM | Computer Name = NEWTECRA_F | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledEvent 4344

Error - 4/22/2014 11:15:43 PM | Computer Name = NEWTECRA_F | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledSPRetry 4344

Error - 4/22/2014 11:15:45 PM | Computer Name = NEWTECRA_F | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: Continuously busy for more than a second

Error - 4/22/2014 11:15:45 PM | Computer Name = NEWTECRA_F | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledEvent 6297

Error - 4/22/2014 11:15:45 PM | Computer Name = NEWTECRA_F | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledSPRetry 6297

[ System Events ]
Error - 4/20/2014 11:14:34 AM | Computer Name = NEWTECRA_F | Source = Service Control Manager | ID = 7009
Description = Timeout (30000 milliseconds) waiting for the Spybot-S&D 2 Security
Center Service service to connect.

Error - 4/20/2014 11:14:34 AM | Computer Name = NEWTECRA_F | Source = Service Control Manager | ID = 7000
Description = The Spybot-S&D 2 Security Center Service service failed to start due
to the following error: %%1053

Error - 4/20/2014 7:20:38 PM | Computer Name = NEWTECRA_F | Source = DCOM | ID = 10010
Description = The server {1F87137D-0E7C-44D5-8C73-4EFFB68962F2} did not register
with DCOM within the required timeout.

Error - 4/22/2014 2:00:09 PM | Computer Name = NEWTECRA_F | Source = DCOM | ID = 10010
Description = The server {1F87137D-0E7C-44D5-8C73-4EFFB68962F2} did not register
with DCOM within the required timeout.

Error - 4/22/2014 9:34:50 PM | Computer Name = NEWTECRA_F | Source = SMCIRDA | ID = 458819
Description = During hardware self-test, this driver could not find an SMSC IrCC
SCE device at the second set of hardware I/O ports. If any new hardware has been
added to the system recently, then it is likely that the new hardware is conflicting
with this device. Otherwise, it is possible that this device has been set incorrectly
in the Device Manager.

Error - 4/22/2014 9:36:00 PM | Computer Name = NEWTECRA_F | Source = Service Control Manager | ID = 7009
Description = Timeout (30000 milliseconds) waiting for the Spybot-S&D 2 Security
Center Service service to connect.

Error - 4/22/2014 9:36:00 PM | Computer Name = NEWTECRA_F | Source = Service Control Manager | ID = 7000
Description = The Spybot-S&D 2 Security Center Service service failed to start due
to the following error: %%1053

Error - 4/23/2014 5:00:10 PM | Computer Name = NEWTECRA_F | Source = SMCIRDA | ID = 458819
Description = During hardware self-test, this driver could not find an SMSC IrCC
SCE device at the second set of hardware I/O ports. If any new hardware has been
added to the system recently, then it is likely that the new hardware is conflicting
with this device. Otherwise, it is possible that this device has been set incorrectly
in the Device Manager.

Error - 4/23/2014 5:00:34 PM | Computer Name = NEWTECRA_F | Source = Service Control Manager | ID = 7009
Description = Timeout (30000 milliseconds) waiting for the Spybot-S&D 2 Security
Center Service service to connect.

Error - 4/23/2014 5:00:34 PM | Computer Name = NEWTECRA_F | Source = Service Control Manager | ID = 7000
Description = The Spybot-S&D 2 Security Center Service service failed to start due
to the following error: %%1053


< End of report >

 

OTL logfile created on: 4/23/2014 6:01:58 PM - Run 1
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Documents and Settings\Owner\Desktop\Diagnostics
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

1021.92 Mb Total Physical Memory | 194.93 Mb Available Physical Memory | 19.07% Memory free
2.40 Gb Paging File | 1.67 Gb Available in Paging File | 69.50% Paging File free
Paging file location(s): C:\pagefile.sys 0 0 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 74.52 Gb Total Space | 43.18 Gb Free Space | 57.94% Space Free | Partition Type: NTFS
Drive E: | 29.67 Gb Total Space | 29.00 Gb Free Space | 97.74% Space Free | Partition Type: FAT32
Drive F: | 29.67 Gb Total Space | 13.27 Gb Free Space | 44.71% Space Free | Partition Type: FAT32
Drive G: | 14.44 Gb Total Space | 5.94 Gb Free Space | 41.12% Space Free | Partition Type: FAT32

Computer Name: NEWTECRA_F | User Name: Owner | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2014/04/23 16:39:23 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Owner\Desktop\Diagnostics\OTL.exe
PRC - [2014/04/18 14:50:52 | 033,604,728 | ---- | M] (Dropbox, Inc.) -- C:\Documents and Settings\Owner\Application Data\Dropbox\bin\Dropbox.exe
PRC - [2014/04/16 17:12:44 | 005,306,504 | ---- | M] (COMODO) -- C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe
PRC - [2014/03/25 15:22:14 | 001,864,408 | ---- | M] (COMODO) -- C:\Program Files\COMODO\COMODO Internet Security\cavwp.exe
PRC - [2013/10/15 13:27:38 | 003,921,880 | ---- | M] (Safer-Networking Ltd.) -- C:\Program Files\Spybot - Search & Destroy 2\SDFSSvc.exe
PRC - [2013/09/20 11:57:26 | 001,042,272 | ---- | M] (Safer-Networking Ltd.) -- C:\Program Files\Spybot - Search & Destroy 2\SDUpdSvc.exe
PRC - [2013/08/12 21:34:11 | 000,439,360 | ---- | M] (BillP Studios) -- C:\Program Files\BillP Studios\WinPatrol\WinPatrol.exe
PRC - [2013/07/25 12:19:26 | 005,624,784 | ---- | M] (Safer-Networking Ltd.) -- C:\Program Files\Spybot - Search & Destroy 2\SDTray.exe
PRC - [2012/03/05 17:53:48 | 000,056,088 | ---- | M] (SurveilStar Inc. ) -- C:\WINDOWS\system32\winrdlv3.exe
PRC - [2008/04/14 05:42:20 | 001,033,728 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe


========== Modules (No Company Name) ==========

MOD - [2014/04/23 17:00:40 | 000,041,984 | ---- | M] () -- c:\Documents and Settings\Owner\Local Settings\temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpo3wqf9.dll
MOD - [2014/02/13 13:56:17 | 018,109,952 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.ServiceModel\a95ac0b02617b9dadbc5f625586b2aac\System.ServiceModel.ni.dll
MOD - [2014/02/13 13:55:39 | 001,079,296 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.IdentityModel\6769297ceb522c4fe6de2c5e3575812d\System.IdentityModel.ni.dll
MOD - [2014/02/13 13:53:27 | 001,021,952 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.Runtime.Dura#\cd626ecab8e1657628451408aba720cd\System.Runtime.DurableInstancing.ni.dll
MOD - [2014/02/13 13:53:24 | 002,659,328 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.Runtime.Seri#\be0a1bb51a0d8fb41140c8111ed56d19\System.Runtime.Serialization.ni.dll
MOD - [2014/02/13 13:53:24 | 000,143,360 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\SMDiagnostics\88aec4231adca9f5a4226c83911c4dad\SMDiagnostics.ni.dll
MOD - [2014/02/13 13:53:19 | 001,801,728 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.Xaml\d116eda30a35c490e59221b0ebac6fcd\System.Xaml.ni.dll
MOD - [2014/02/13 13:32:20 | 005,628,928 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.Xml\850fa7110c7423c324762c1ad3130219\System.Xml.ni.dll
MOD - [2014/02/13 13:32:06 | 001,014,272 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.Configuration\991c4e11f571a4074b9c4a5841222338\System.Configuration.ni.dll
MOD - [2014/02/13 13:31:07 | 007,070,720 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.Core\354a5906fd46f4374f86916debf3ebcb\System.Core.ni.dll
MOD - [2014/02/13 13:30:51 | 001,667,584 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.Drawing\243ff1822abc8282cb8fee37538170b4\System.Drawing.ni.dll
MOD - [2014/02/13 13:30:29 | 009,099,776 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System\4c906eb82e6f56aea01b2a7291fab7ea\System.ni.dll
MOD - [2014/02/13 13:30:00 | 014,416,896 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\mscorlib\4e62d1d9b7dd2c2d14915abb73c22d50\mscorlib.ni.dll
MOD - [2014/01/02 23:42:50 | 003,610,624 | ---- | M] () -- C:\Documents and Settings\Owner\Application Data\Dropbox\bin\wxmsw28uh_vc.dll
MOD - [2013/10/18 19:55:02 | 025,100,288 | ---- | M] () -- C:\Documents and Settings\Owner\Application Data\Dropbox\bin\libcef.dll
MOD - [2013/07/15 13:29:04 | 000,620,718 | ---- | M] () -- C:\Program Files\BillP Studios\WinPatrol\sqlite3.dll
MOD - [2013/05/16 11:55:28 | 000,161,112 | ---- | M] () -- C:\Program Files\Spybot - Search & Destroy 2\snlFileFormats150.bpl
MOD - [2013/05/16 11:55:26 | 000,113,496 | ---- | M] () -- C:\Program Files\Spybot - Search & Destroy 2\snlThirdParty150.bpl
MOD - [2013/05/16 11:55:24 | 000,416,600 | ---- | M] () -- C:\Program Files\Spybot - Search & Destroy 2\DEC150.bpl
MOD - [2012/08/23 11:38:24 | 000,574,840 | ---- | M] () -- C:\Program Files\Spybot - Search & Destroy 2\sqlite3.dll
MOD - [2012/04/03 18:06:14 | 000,565,640 | ---- | M] () -- C:\Program Files\Spybot - Search & Destroy 2\av\BDSmartDB.dll
MOD - [2011/05/19 21:34:22 | 000,056,224 | ---- | M] () -- \\?\C:\Program Files\Spybot - Search & Destroy 2\av\avxdisk.dll
MOD - [2010/03/15 18:00:02 | 000,190,976 | ---- | M] () -- C:\WINDOWS\system32\WgaLogon.dll


========== Services (SafeList) ==========

SRV - File not found [Auto | Stopped] -- C:\Program Files\Spybot -- (SDWSCService)
SRV - File not found [Auto | Running] -- C:\Program Files\Spybot -- (SDUpdateService)
SRV - File not found [Auto | Running] -- C:\Program Files\Spybot -- (SDScannerService)
SRV - File not found [Disabled | Stopped] -- %SystemRoot%\System32\hidserv.dll -- (HidServ)
SRV - [2014/04/16 17:12:44 | 005,306,504 | ---- | M] (COMODO) [Auto | Running] -- C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe -- (cmdAgent)
SRV - [2014/03/29 10:12:20 | 000,119,408 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)
SRV - [2014/03/25 15:22:15 | 001,663,192 | ---- | M] (COMODO) [On_Demand | Stopped] -- C:\Program Files\COMODO\COMODO Internet Security\cmdvirth.exe -- (cmdvirth)
SRV - [2014/02/23 11:22:24 | 000,022,016 | ---- | M] (Box Inc.) [On_Demand | Stopped] -- C:\Program Files\Box\Box Sync\SyncUpdaterService.exe -- (BoxSyncUpdateService)
SRV - [2013/12/18 22:05:43 | 000,182,696 | ---- | M] (Oracle Corporation) [On_Demand | Stopped] -- C:\Program Files\Java\jre7\bin\jqs.exe -- (JavaQuickStarterService)
SRV - [2013/06/09 11:13:01 | 000,202,576 | ---- | M] (LogMeIn, Inc.) [Disabled | Stopped] -- C:\Program Files\LogMeIn\x86\ramaint.exe -- (LMIMaint)
SRV - [2013/06/09 11:12:08 | 000,375,120 | ---- | M] (LogMeIn, Inc.) [On_Demand | Stopped] -- C:\Program Files\LogMeIn\x86\LMIGuardianSvc.exe -- (LMIGuardianSvc)
SRV - [2012/03/05 17:53:42 | 000,629,544 | ---- | M] (SurveilStar Inc. ) [Auto | Stopped] -- C:\Program Files\Common Files\System\winrdgv3.exe -- (.Winhlpsvr)
SRV - [2010/11/08 13:04:20 | 000,390,528 | ---- | M] (LogMeIn, Inc.) [Disabled | Stopped] -- C:\Program Files\LogMeIn\x86\LogMeIn.exe -- (LogMeIn)


========== Driver Services (SafeList) ==========

DRV - File not found [Kernel | On_Demand | Stopped] -- -- (WDICA)
DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDRFRAME)
DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDRELI)
DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDFRAME)
DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDCOMP)
DRV - File not found [Kernel | System | Stopped] -- -- (PCIDump)
DRV - File not found [Kernel | System | Stopped] -- -- (lbrtfdc)
DRV - File not found [Kernel | System | Stopped] -- -- (i2omgmt)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\Program Files\SystemRequirementsLab\cpudrv.sys -- (cpudrv)
DRV - File not found [Kernel | System | Stopped] -- -- (Changer)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\ComboFix\catchme.sys -- (catchme)
DRV - [2014/04/16 17:12:48 | 000,104,920 | ---- | M] (COMODO) [Kernel | Boot | Running] -- C:\WINDOWS\system32\drivers\inspect.sys -- (Inspect)
DRV - [2014/04/16 17:12:47 | 000,607,448 | ---- | M] (COMODO) [File_System | System | Running] -- C:\WINDOWS\system32\drivers\cmdGuard.sys -- (cmdGuard)
DRV - [2014/04/16 17:12:47 | 000,029,912 | ---- | M] (COMODO) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\cmdhlp.sys -- (cmdHlp)
DRV - [2014/04/16 17:12:47 | 000,015,704 | ---- | M] (COMODO) [File_System | System | Running] -- C:\WINDOWS\system32\drivers\cmderd.sys -- (cmderd)
DRV - [2014/03/18 16:20:36 | 000,004,096 | ---- | M] (Windows (R) Codename Longhorn DDK provider) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\bbcap.sys -- (bbcap)
DRV - [2013/06/09 11:12:12 | 000,086,888 | ---- | M] (LogMeIn, Inc.) [File_System | Disabled | Stopped] -- C:\WINDOWS\System32\LMIRfsClientNP.dll -- (LMIRfsClientNP)
DRV - [2013/06/01 21:10:49 | 000,013,624 | ---- | M] (LogMeIn, Inc.) [Kernel | Auto | Running] -- C:\Program Files\LogMeIn\x86\rainfo.sys -- (LMIInfo)
DRV - [2012/09/12 10:47:18 | 000,040,344 | ---- | M] () [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\stdriverx86.sys -- (stdriver)
DRV - [2012/05/09 15:03:36 | 000,233,096 | ---- | M] (Windows (R) Server 2003 DDK provider) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\SCRCAMHRDRV.sys -- (SCRCAMHRDRV)
DRV - [2012/03/05 17:55:16 | 000,334,672 | ---- | M] (SurveilStar Inc. ) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\tvdisk.sys -- (TVDisk)
DRV - [2012/03/05 17:55:04 | 000,035,272 | ---- | M] (SurveilStar Inc. ) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\tfsfltdrv.sys -- (TFsfltdrv)
DRV - [2012/03/05 17:55:00 | 000,078,024 | ---- | M] (SurveilStar Inc. ) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\tsysdrv.sys -- (TSysDrv)
DRV - [2012/03/05 17:54:48 | 000,075,336 | ---- | M] (SurveilStar Inc. ) [Kernel | Boot | Running] -- C:\WINDOWS\system32\drivers\tpacket.sys -- (TPacket)
DRV - [2012/03/05 17:54:38 | 000,042,704 | ---- | M] (SurveilStar Inc. ) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\ipnpf.sys -- (IPNPF)
DRV - [2011/08/09 17:33:58 | 000,003,840 | ---- | M] () [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\BANTExt.sys -- (BANTExt)
DRV - [2011/01/20 07:14:52 | 001,122,656 | ---- | M] (Agere Systems) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\AGRSM.sys -- (AgereSoftModem)
DRV - [2010/09/17 16:40:06 | 000,047,640 | ---- | M] (LogMeIn, Inc.) [File_System | Auto | Running] -- C:\WINDOWS\system32\drivers\LMIRfsDriver.sys -- (LMIRfsDriver)
DRV - [2010/06/03 11:07:18 | 000,013,112 | ---- | M] (Windows (R) Win 7 DDK provider) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\jumi.sys -- (jumi)
DRV - [2008/11/17 16:23:16 | 003,636,864 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\NETw5x32.sys -- (NETw5x32)
DRV - [2007/09/04 02:14:06 | 000,006,528 | ---- | M] (TOSHIBA Corporation) [Kernel | Boot | Running] -- C:\WINDOWS\system32\drivers\Thpevm.sys -- (Thpevm)
DRV - [2007/08/24 14:08:30 | 000,438,891 | ---- | M] (Atheros Communications, Inc. and WildPackets, Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\ar5211.sys -- (AR5211)
DRV - [2005/11/30 11:12:36 | 000,162,560 | ---- | M] (Texas Instruments) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\tifm21.sys -- (tifm21)
DRV - [2005/09/23 19:56:28 | 003,966,976 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\RtkHDAud.sys -- (IntcAzAudAddService)
DRV - [2002/07/17 08:53:02 | 000,016,877 | ---- | M] (Adaptec) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\ASPI32.SYS -- (Aspi32)
DRV - [2001/08/17 08:10:28 | 000,035,913 | ---- | M] (SMC) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\smcirda.sys -- (SMCIRDA)
DRV - [2001/03/05 07:20:08 | 000,040,448 | ---- | M] (DeviceGuys, Inc.) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\DGIVECP.SYS -- (DgiVecp)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\..\SearchScopes,DefaultScope =
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC


IE - HKU\.DEFAULT\..\SearchScopes,DefaultScope =
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-18\..\SearchScopes,DefaultScope =
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-19\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com
IE - HKU\S-1-5-19\..\SearchScopes,DefaultScope =

IE - HKU\S-1-5-20\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com
IE - HKU\S-1-5-20\..\SearchScopes,DefaultScope =
IE - HKU\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-21-484763869-602162358-1606980848-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com
IE - HKU\S-1-5-21-484763869-602162358-1606980848-1003\..\SearchScopes,DefaultScope =
IE - HKU\S-1-5-21-484763869-602162358-1606980848-1003\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search
IE - HKU\S-1-5-21-484763869-602162358-1606980848-1003\..\SearchScopes\{5C5360F5-5F2D-4E4A-84B1-ABD053DB35A9}: "URL" =
IE - HKU\S-1-5-21-484763869-602162358-1606980848-1003\..\SearchScopes\{66503CF1-5231-48FC-A76A-23406DCBFFAE}: "URL" = https://www.google.com/search?q={searchTerms}
IE - HKU\S-1-5-21-484763869-602162358-1606980848-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-21-484763869-602162358-1606980848-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = <-loopback>
IE - HKU\S-1-5-21-484763869-602162358-1606980848-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = localhost:21320

========== FireFox ==========

FF - prefs.js..extensions.enabledAddons: %7Bd40f5e7b-d2cf-4856-b441-cc613eeffbe3%7D:1.68
FF - prefs.js..extensions.enabledAddons: %7B3d7eb24f-2740-49df-8937-200b1cc08f8a%7D:1.5.17
FF - prefs.js..extensions.enabledAddons: %7B1A2D0EC4-75F5-4c91-89C4-3656F6E44B68%7D:0.6.3
FF - prefs.js..extensions.enabledAddons: yesscript%40userstyles.org:1.9.1
FF - prefs.js..extensions.enabledAddons: savedpasswordeditor%40daniel.dawson:2.7.2
FF - prefs.js..extensions.enabledAddons: mail%40sindre.at:0.5
FF - prefs.js..extensions.enabledAddons: donottrackplus%40abine.com:3.2.1072
FF - prefs.js..extensions.enabledAddons: adblockpopups%40jessehakanen.net:0.9.1
FF - prefs.js..extensions.enabledAddons: %7B677a8f98-fd64-40b0-a883-b8c95d0cbf17%7D:0.6
FF - prefs.js..extensions.enabledAddons: %7B0538E3E3-7E9B-4d49-8831-A227C80A7AD3%7D:2.2.2
FF - prefs.js..extensions.enabledAddons: %7B88c7b321-2eb8-11da-8cd6-0800200c9a66%7D:0.2.10
FF - prefs.js..extensions.enabledAddons: %7B972ce4c6-7e08-4474-a285-3208198ce6fd%7D:28.0
FF - prefs.js..network.proxy.type: 0
FF - user.js - File not found

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32_13_0_0_182.dll ()
FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\WINDOWS\system32\Adobe\Director\np32dsw_1210150.dll (Adobe Systems, Inc.)
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX VOD Helper,version=1.0.0: C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.51.2: C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.51.2: C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=2.1.0: C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=2.1.2: C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{23fcfd51-4958-4f00-80a3-ae97e717ed8b}: C:\Program Files\DivX\DivX Plus Web Player\firefox\DivXHTML5 [2013/02/24 21:06:14 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 28.0\extensions\\Components: C:\Program Files\Mozilla Firefox\components
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 28.0\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2014/03/29 10:10:51 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\SeaMonkey 2.0.11\extensions\\Components: C:\Program Files\SeaMonkey\components [2011/02/13 11:06:24 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\SeaMonkey 2.0.11\extensions\\Plugins: C:\Program Files\SeaMonkey\plugins [2013/07/13 21:58:47 | 000,000,000 | ---D | M]

[2013/03/10 18:20:38 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Owner\Application Data\Mozilla\Extensions
[2011/02/13 11:06:26 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Owner\Application Data\Mozilla\Extensions\{92650c4d-4b8e-4d2a-b7eb-24ecf4f6b63a}
[2013/03/10 18:20:42 | 000,000,000 | ---D | M] (SpeedAnalysis.com) -- C:\Documents and Settings\Owner\Application Data\Mozilla\Extensions\speedanalysis@SpeedAnalysis.com
[2014/04/20 11:33:04 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\29v635vw.default-1395516145859\extensions
[2014/04/03 18:47:12 | 000,000,000 | ---D | M] (Forecastfox) -- C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\29v635vw.default-1395516145859\extensions\{0538E3E3-7E9B-4d49-8831-A227C80A7AD3}
[2014/03/23 15:42:59 | 000,000,000 | ---D | M] (Flashblock) -- C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\29v635vw.default-1395516145859\extensions\{3d7eb24f-2740-49df-8937-200b1cc08f8a}
[2014/03/23 15:43:02 | 000,000,000 | ---D | M] (DoNotTrackMe: Online Privacy Protection) -- C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\29v635vw.default-1395516145859\extensions\donottrackplus@abine.com
[2014/04/23 16:56:51 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\mf2ucerz.KAL 2013-04\extensions
[2014/04/08 14:33:36 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\tjqnwqmw.default-1395513112421\extensions
[2014/03/22 18:02:58 | 000,000,000 | ---D | M] (Forecastfox) -- C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\tjqnwqmw.default-1395513112421\extensions\{0538E3E3-7E9B-4d49-8831-A227C80A7AD3}
[2014/04/08 14:33:36 | 000,000,000 | ---D | M] (IE Tab 2 (FF 3.6+)) -- C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\tjqnwqmw.default-1395513112421\extensions\{1BC9BA34-1EED-42ca-A505-6D2F1A935BBB}
[2014/03/22 18:02:57 | 000,000,000 | ---D | M] (Flashblock) -- C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\tjqnwqmw.default-1395513112421\extensions\{3d7eb24f-2740-49df-8937-200b1cc08f8a}
[2014/03/22 18:02:57 | 000,000,000 | ---D | M] (FEBE) -- C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\tjqnwqmw.default-1395513112421\extensions\{4BBDD651-70CF-4821-84F8-2B918CF89CA3}
[2014/03/22 19:14:39 | 000,000,000 | ---D | M] ( "Flash Video Downloader - Full HD Download ") -- C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\tjqnwqmw.default-1395513112421\extensions\artur.dubovoy@gmail.com
[2014/03/22 18:03:01 | 000,000,000 | ---D | M] (DoNotTrackMe: Online Privacy Protection) -- C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\tjqnwqmw.default-1395513112421\extensions\donottrackplus@abine.com
[2012/12/18 12:21:04 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Owner\Application Data\Mozilla\SeaMonkey\Profiles\17zwy929.Toby\extensions
[2012/09/21 18:59:27 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Owner\Application Data\Mozilla\SeaMonkey\Profiles\tj66gul5.default\extensions
[2012/09/21 18:59:26 | 000,000,000 | ---D | M] (ChatZilla) -- C:\Documents and Settings\Owner\Application Data\Mozilla\SeaMonkey\Profiles\tj66gul5.default\extensions\{59c81df5-4b7a-477b-912d-4e0fdf64e5f2}
[2012/09/21 18:59:27 | 000,000,000 | ---D | M] (JavaScript Debugger) -- C:\Documents and Settings\Owner\Application Data\Mozilla\SeaMonkey\Profiles\tj66gul5.default\extensions\{f13b157f-b174-47e7-a34d-4815ddfdfeb8}
[2012/09/21 18:59:27 | 000,000,000 | ---D | M] (DOM Inspector) -- C:\Documents and Settings\Owner\Application Data\Mozilla\SeaMonkey\Profiles\tj66gul5.default\extensions\inspector@mozilla.org
[2014/03/23 15:43:02 | 000,128,676 | ---- | M] () (No name found) -- C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\29v635vw.default-1395516145859\extensions\adblockpopups@jessehakanen.net.xpi
[2014/03/23 15:42:59 | 000,019,278 | ---- | M] () (No name found) -- C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\29v635vw.default-1395516145859\extensions\mail@sindre.at.xpi
[2014/03/23 15:42:59 | 000,215,649 | ---- | M] () (No name found) -- C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\29v635vw.default-1395516145859\extensions\savedpasswordeditor@daniel.dawson.xpi
[2014/03/23 15:42:59 | 000,053,101 | ---- | M] () (No name found) -- C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\29v635vw.default-1395516145859\extensions\yesscript@userstyles.org.xpi
[2014/03/23 15:42:59 | 000,096,207 | ---- | M] () (No name found) -- C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\29v635vw.default-1395516145859\extensions\{1A2D0EC4-75F5-4c91-89C4-3656F6E44B68}.xpi
[2014/04/01 15:11:02 | 000,021,105 | ---- | M] () (No name found) -- C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\29v635vw.default-1395516145859\extensions\{677a8f98-fd64-40b0-a883-b8c95d0cbf17}.xpi
[2014/04/20 11:33:04 | 000,011,273 | ---- | M] () (No name found) -- C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\29v635vw.default-1395516145859\extensions\{88c7b321-2eb8-11da-8cd6-0800200c9a66}.xpi
[2014/03/23 15:38:05 | 000,957,290 | ---- | M] () (No name found) -- C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\29v635vw.default-1395516145859\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi
[2014/03/23 15:42:58 | 000,138,614 | ---- | M] () (No name found) -- C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\29v635vw.default-1395516145859\extensions\{d40f5e7b-d2cf-4856-b441-cc613eeffbe3}.xpi
[2014/03/22 18:03:01 | 000,128,676 | ---- | M] () (No name found) -- C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\tjqnwqmw.default-1395513112421\extensions\adblockpopups@jessehakanen.net.xpi
[2014/03/22 18:02:58 | 000,124,632 | ---- | M] () (No name found) -- C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\tjqnwqmw.default-1395513112421\extensions\helper@savefrom.net.xpi
[2014/03/22 18:02:58 | 000,019,278 | ---- | M] () (No name found) -- C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\tjqnwqmw.default-1395513112421\extensions\mail@sindre.at.xpi
[2014/03/22 18:02:58 | 000,215,649 | ---- | M] () (No name found) -- C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\tjqnwqmw.default-1395513112421\extensions\savedpasswordeditor@daniel.dawson.xpi
[2014/03/22 18:02:58 | 000,053,101 | ---- | M] () (No name found) -- C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\tjqnwqmw.default-1395513112421\extensions\yesscript@userstyles.org.xpi
[2014/03/22 18:02:57 | 000,096,207 | ---- | M] () (No name found) -- C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\tjqnwqmw.default-1395513112421\extensions\{1A2D0EC4-75F5-4c91-89C4-3656F6E44B68}.xpi
[2014/03/22 19:14:36 | 000,151,038 | ---- | M] () (No name found) -- C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\tjqnwqmw.default-1395513112421\extensions\{5C655500-E712-41e7-9349-CE462F844B19}.xpi
[2014/03/28 13:21:47 | 000,021,105 | ---- | M] () (No name found) -- C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\tjqnwqmw.default-1395513112421\extensions\{677a8f98-fd64-40b0-a883-b8c95d0cbf17}.xpi
[2014/03/22 17:48:22 | 000,957,290 | ---- | M] () (No name found) -- C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\tjqnwqmw.default-1395513112421\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi
[2014/03/22 18:02:44 | 000,138,614 | ---- | M] () (No name found) -- C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\tjqnwqmw.default-1395513112421\extensions\{d40f5e7b-d2cf-4856-b441-cc613eeffbe3}.xpi
[2014/03/22 17:50:17 | 000,001,362 | ---- | M] () (No name found) -- C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\tjqnwqmw.default-1395513112421\extensions\{4BBDD651-70CF-4821-84F8-2B918CF89CA3}\chrome\skin\xpinstallItemGeneric.png
[2014/03/29 10:10:35 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions
[2014/03/29 10:10:38 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA}
[2014/03/29 10:10:24 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\browser\extensions
[2014/03/29 10:12:26 | 000,000,000 | ---D | M] (Default) -- C:\Program Files\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}

O1 HOSTS File: ([2014/04/23 10:54:13 | 000,449,906 | R--- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: 127.0.0.1 www.007guard.com
O1 - Hosts: 127.0.0.1 007guard.com
O1 - Hosts: 127.0.0.1 008i.com
O1 - Hosts: 127.0.0.1 www.008k.com
O1 - Hosts: 127.0.0.1 008k.com
O1 - Hosts: 127.0.0.1 www.00hq.com
O1 - Hosts: 127.0.0.1 00hq.com
O1 - Hosts: 127.0.0.1 010402.com
O1 - Hosts: 127.0.0.1 www.032439.com
O1 - Hosts: 127.0.0.1 032439.com
O1 - Hosts: 127.0.0.1 www.0scan.com
O1 - Hosts: 127.0.0.1 0scan.com
O1 - Hosts: 127.0.0.1 1000gratisproben.com
O1 - Hosts: 127.0.0.1 www.1000gratisproben.com
O1 - Hosts: 127.0.0.1 1001namen.com
O1 - Hosts: 127.0.0.1 www.1001namen.com
O1 - Hosts: 127.0.0.1 100888290cs.com
O1 - Hosts: 127.0.0.1 www.100888290cs.com
O1 - Hosts: 127.0.0.1 www.100sexlinks.com
O1 - Hosts: 127.0.0.1 100sexlinks.com
O1 - Hosts: 127.0.0.1 10sek.com
O1 - Hosts: 127.0.0.1 www.10sek.com
O1 - Hosts: 127.0.0.1 www.1-2005-search.com
O1 - Hosts: 127.0.0.1 1-2005-search.com
O1 - Hosts: 15470 more lines...
O2 - BHO: (DivX Plus Web Player HTML5 <video>) - {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Program Files\DivX\DivX Plus Web Player\ie\DivXHTML5\DivXHTML5.dll (DivX, LLC)
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O3 - HKU\S-1-5-21-484763869-602162358-1606980848-1003\..\Toolbar\WebBrowser: (no name) - {EE2AC4E5-B0B0-4EC6-88A9-BCA1A32AB107} - No CLSID value found.
O4 - HKLM..\Run: [COMODO Internet Security] C:\Program Files\COMODO\COMODO Internet Security\cistray.exe (COMODO)
O4 - HKLM..\Run: [NvCplDaemon] C:\WINDOWS\System32\NvCpl.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [SDTray] C:\Program Files\Spybot - Search & Destroy 2\SDTray.exe (Safer-Networking Ltd.)
O4 - HKU\S-1-5-21-484763869-602162358-1606980848-1003..\Run: [WinPatrol] C:\Program Files\BillP Studios\WinPatrol\winpatrol.exe (BillP Studios)
O4 - Startup: C:\Documents and Settings\Owner\Start Menu\Programs\Startup\Dropbox.lnk = C:\Documents and Settings\Owner\Application Data\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
O4 - Startup: C:\Documents and Settings\Owner\Start Menu\Programs\Startup\Xcalday.lnk = C:\Program Files\Xcalday\xcalday.exe ()
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-21-484763869-602162358-1606980848-1003\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-484763869-602162358-1606980848-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKU\S-1-5-21-484763869-602162358-1606980848-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKU\S-1-5-21-484763869-602162358-1606980848-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O16 - DPF: {02BCC737-B171-4746-94C9-0D8A0B2C0089} http://office.microsoft.com/_layouts/ClientBin/ieawsdc32.cab (Microsoft Office Template and Media Control)
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} http://www.update.microsoft.com/win...ls/en/x86/client/wuweb_site.cab?1368282000312 (WUWebControl Class)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.254.254
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{FA9CAED8-EF6C-4E64-9703-86F0D919EB74}: DhcpNameServer = 192.168.254.254
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{FA9CAED8-EF6C-4E64-9703-86F0D919EB74}: NameServer = 192.168.254.254
O18 - Protocol\Handler\belarc {6318E0AB-2E93-11D1-B8ED-00608CC9A71F} - C:\Program Files\Belarc\Advisor\System\BAVoilaX.dll (Belarc, Inc.)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) - C:\WINDOWS\system32\userinit.exe (Microsoft Corporation)
O20 - Winlogon\Notify\LMIinit: DllName - (LMIinit.dll) - C:\WINDOWS\System32\LMIinit.dll (LogMeIn, Inc.)
O20 - Winlogon\Notify\psfus: DllName - (C:\WINDOWS\system32\psqlpwd.dll) - C:\WINDOWS\system32\psqlpwd.dll (UPEK Inc.)
O20 - Winlogon\Notify\WgaLogon: DllName - (WgaLogon.dll) - C:\WINDOWS\System32\WgaLogon.dll ()
O24 - Desktop WallPaper: C:\Documents and Settings\Owner\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\Owner\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O28 - HKLM ShellExecuteHooks: {56F9679E-7826-4C84-81F3-532071A8BCC5} - C:\Program Files\Windows Desktop Search\MsnlNamespaceMgr.dll (Microsoft Corporation)
O28 - HKLM ShellExecuteHooks: {A16CA976-4B8D-47FC-A9F4-651C17B636EF} - C:\WINDOWS\system32\msowcnv3.dll (SurveilStar Inc. )
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2011/01/20 01:18:56 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O32 - AutoRun File - [2014/04/11 12:52:55 | 000,000,000 | ---D | M] - C:\Autoruns -- [ NTFS ]
O32 - AutoRun File - [2014/04/10 21:35:31 | 000,550,371 | ---- | M] () - C:\Autoruns.zip -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = ComFile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)

========== Files/Folders - Created Within 30 Days ==========

[2014/04/22 20:40:17 | 000,000,000 | RHSD | C] -- C:\cmdcons
[2014/04/22 20:33:59 | 000,518,144 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWREG.exe
[2014/04/22 20:33:59 | 000,406,528 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWSC.exe
[2014/04/22 20:33:59 | 000,212,480 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWXCACLS.exe
[2014/04/22 20:33:59 | 000,060,416 | ---- | C] (NirSoft) -- C:\WINDOWS\NIRCMD.exe
[2014/04/22 20:27:34 | 000,000,000 | ---D | C] -- C:\Qoobox
[2014/04/22 20:24:08 | 000,000,000 | ---D | C] -- C:\WINDOWS\erdnt
[2014/04/22 17:19:54 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Malwarebytes' Anti-Malware (portable)
[2014/04/21 12:11:17 | 000,107,224 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\MBAMSwissArmy.sys
[2014/04/21 12:10:40 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\Malwarebytes Anti-Malware
[2014/04/21 12:10:15 | 000,052,312 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamchameleon.sys
[2014/04/21 12:10:14 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes Anti-Malware
[2014/04/20 10:30:00 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Owner\My Documents\Comodo Logs
[2014/04/15 15:51:04 | 000,000,000 | ---D | C] -- C:\VTRoot
[2014/04/15 15:21:23 | 000,000,000 | ---D | C] -- C:\Config.Msi
[2014/04/15 15:03:22 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Owner\My Documents\New Folder
[2014/04/13 19:08:28 | 000,056,088 | ---- | C] (SurveilStar Inc. ) -- C:\WINDOWS\System32\winrdlv3.exe
[2014/04/13 13:53:44 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\COMODO
[2014/04/13 13:52:26 | 000,000,000 | --SD | C] -- C:\Documents and Settings\All Users\Application Data\Shared Space
[2014/04/13 13:49:39 | 000,000,000 | ---D | C] -- C:\Program Files\COMODO
[2014/04/13 13:49:12 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Comodo
[2014/04/13 13:49:05 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Comodo Downloader
[2014/04/11 12:52:48 | 000,000,000 | ---D | C] -- C:\Autoruns
[2014/04/10 09:50:21 | 000,000,000 | ---D | C] -- C:\Documents and Settings\LocalService\Application Data\Box Sync
[2014/04/08 16:46:21 | 000,000,000 | RH-D | C] -- C:\Documents and Settings\Owner\Recent
[2014/04/07 13:27:01 | 000,170,496 | ---- | C] (Lexmark) -- C:\WINDOWS\System32\LXCASUI.DLL
[2014/04/01 10:17:21 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Owner\Application Data\DropboxMaster
[2014/03/29 10:10:21 | 000,000,000 | ---D | C] -- C:\Program Files\Mozilla Firefox
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[1 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2014/04/23 18:09:49 | 001,034,145 | ---- | M] () -- C:\WINDOWS\System32\drivers\sfi.dat
[2014/04/23 18:08:25 | 000,000,440 | ---- | M] () -- C:\WINDOWS\tasks\COMODO Cache Builder {0FB77674-7905-4F34-A362-C5A9A26F8CF9}.job
[2014/04/23 18:01:03 | 000,000,644 | ---- | M] () -- C:\WINDOWS\tasks\Check for updates (Spybot - Search & Destroy).job
[2014/04/23 17:01:26 | 000,000,440 | ---- | M] () -- C:\WINDOWS\tasks\COMODO Update {A6D52E4F-569B-4756-B3D8-DF217313DA85}.job
[2014/04/23 17:01:26 | 000,000,440 | ---- | M] () -- C:\WINDOWS\tasks\COMODO Signature Update {B9D5C6F9-17D2-4917-8BD0-614BAA1C6A59}.job
[2014/04/23 17:01:26 | 000,000,440 | ---- | M] () -- C:\WINDOWS\tasks\COMODO Scan {F140D794-60B6-4F00-9235-D6457AA25B22}.job
[2014/04/23 17:01:22 | 000,201,679 | ---- | M] () -- C:\WINDOWS\System32\nvapps.xml
[2014/04/23 16:59:53 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2014/04/23 16:59:52 | 000,000,031 | ---- | M] () -- C:\WINDOWS\System32\bbcap.err
[2014/04/23 10:54:13 | 000,449,906 | R--- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts
[2014/04/23 10:42:52 | 000,449,906 | R--- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts.20140423-105413.backup
[2014/04/22 22:23:34 | 000,001,024 | ---- | M] () -- C:\Documents and Settings\Owner\Start Menu\Programs\Startup\Dropbox.lnk
[2014/04/22 22:21:16 | 000,001,008 | ---- | M] () -- C:\Documents and Settings\Owner\Desktop\Dropbox.lnk
[2014/04/22 21:34:50 | 000,000,027 | ---- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts.20140423-104242.backup
[2014/04/22 21:34:35 | 000,002,206 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2014/04/22 20:40:41 | 000,000,356 | RHS- | M] () -- C:\boot.ini
[2014/04/22 17:19:53 | 000,107,224 | ---- | M] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\MBAMSwissArmy.sys
[2014/04/22 17:17:32 | 000,052,312 | ---- | M] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamchameleon.sys
[2014/04/20 11:01:57 | 000,001,894 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\COMODO Internet Security.lnk
[2014/04/16 18:48:49 | 001,137,664 | ---- | M] () -- C:\Documents and Settings\Owner\Desktop\2013-01 Revision Menu-HOURS.pub
[2014/04/16 17:12:48 | 000,104,920 | ---- | M] (COMODO) -- C:\WINDOWS\System32\drivers\inspect.sys
[2014/04/16 17:12:47 | 000,607,448 | ---- | M] (COMODO) -- C:\WINDOWS\System32\drivers\cmdGuard.sys
[2014/04/16 17:12:47 | 000,029,912 | ---- | M] (COMODO) -- C:\WINDOWS\System32\drivers\cmdhlp.sys
[2014/04/16 17:12:47 | 000,015,704 | ---- | M] (COMODO) -- C:\WINDOWS\System32\drivers\cmderd.sys
[2014/04/16 01:25:06 | 000,000,260 | ---- | M] () -- C:\WINDOWS\tasks\Backup.job
[2014/04/15 18:44:55 | 000,001,945 | ---- | M] () -- C:\WINDOWS\epplauncher.mif
[2014/04/15 15:52:52 | 000,005,128 | ---- | M] () -- C:\WINDOWS\System32\drivers\fvstore.dat
[2014/04/14 12:11:17 | 074,717,696 | ---- | M] () -- C:\Documents and Settings\Owner\Desktop\GyroBucks - 8x11.pub
[2014/04/13 13:53:39 | 000,000,753 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Shared Space.lnk
[2014/04/10 21:35:31 | 000,550,371 | ---- | M] () -- C:\Autoruns.zip
[2014/04/09 10:42:25 | 000,001,355 | ---- | M] () -- C:\WINDOWS\imsins.BAK
[2014/04/08 16:45:32 | 000,000,682 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\CCleaner.lnk
[2014/04/07 09:58:55 | 000,139,876 | -H-- | M] () -- C:\WINDOWS\System32\mlfcache.dat
[2014/04/07 08:59:22 | 000,450,613 | R--- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts.20140418-113653.backup
[2014/04/06 12:57:53 | 000,450,613 | R--- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts.20140407-085922.backup
[2014/04/06 12:55:10 | 000,450,613 | R--- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts.20140406-125753.backup
[2014/04/06 11:48:47 | 000,499,984 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat
[2014/04/06 11:48:47 | 000,086,278 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat
[2014/04/03 09:50:56 | 000,023,256 | ---- | M] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys
[2014/04/02 22:54:51 | 000,000,616 | ---- | M] () -- C:\WINDOWS\tasks\Refresh immunization (Spybot - Search & Destroy).job
[2014/04/02 22:54:40 | 000,450,613 | R--- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts.20140406-125509.backup
[2014/03/26 21:35:24 | 000,450,613 | R--- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts.20140402-225439.backup
[2014/03/25 15:22:37 | 000,036,000 | ---- | M] (COMODO) -- C:\WINDOWS\System32\cmdcsr.dll
[2014/03/25 15:22:36 | 000,363,504 | ---- | M] (COMODO) -- C:\WINDOWS\System32\guard32.dll
[2014/03/25 15:22:25 | 000,284,888 | ---- | M] (COMODO) -- C:\WINDOWS\System32\cmdvrt32.dll
[2014/03/25 15:22:23 | 000,040,664 | ---- | M] (COMODO) -- C:\WINDOWS\System32\cmdkbd32.dll
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[1 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

========== Files Created - No Company Name ==========

[2014/04/22 22:23:33 | 000,001,024 | ---- | C] () -- C:\Documents and Settings\Owner\Start Menu\Programs\Startup\Dropbox.lnk
[2014/04/22 20:40:40 | 000,000,246 | ---- | C] () -- C:\Boot.bak
[2014/04/22 20:40:33 | 000,260,272 | RHS- | C] () -- C:\cmldr
[2014/04/22 20:33:59 | 000,256,000 | ---- | C] () -- C:\WINDOWS\PEV.exe
[2014/04/22 20:33:59 | 000,208,896 | ---- | C] () -- C:\WINDOWS\MBR.exe
[2014/04/22 20:33:59 | 000,098,816 | ---- | C] () -- C:\WINDOWS\sed.exe
[2014/04/22 20:33:59 | 000,080,412 | ---- | C] () -- C:\WINDOWS\grep.exe
[2014/04/22 20:33:59 | 000,068,096 | ---- | C] () -- C:\WINDOWS\zip.exe
[2014/04/15 15:50:57 | 000,005,128 | ---- | C] () -- C:\WINDOWS\System32\drivers\fvstore.dat
[2014/04/13 14:07:08 | 000,000,440 | ---- | C] () -- C:\WINDOWS\tasks\COMODO Update {A6D52E4F-569B-4756-B3D8-DF217313DA85}.job
[2014/04/13 14:07:01 | 000,000,440 | ---- | C] () -- C:\WINDOWS\tasks\COMODO Cache Builder {0FB77674-7905-4F34-A362-C5A9A26F8CF9}.job
[2014/04/13 14:06:55 | 000,000,440 | ---- | C] () -- C:\WINDOWS\tasks\COMODO Scan {F140D794-60B6-4F00-9235-D6457AA25B22}.job
[2014/04/13 14:06:49 | 000,000,440 | ---- | C] () -- C:\WINDOWS\tasks\COMODO Signature Update {B9D5C6F9-17D2-4917-8BD0-614BAA1C6A59}.job
[2014/04/13 14:03:35 | 000,917,456 | ---- | C] () -- C:\WINDOWS\System32\drivers\sfi.dat
[2014/04/13 13:53:45 | 000,001,894 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\COMODO Internet Security.lnk
[2014/04/13 13:53:32 | 000,000,753 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Shared Space.lnk
[2014/04/10 21:36:02 | 000,550,371 | ---- | C] () -- C:\Autoruns.zip
[2014/04/09 10:42:19 | 000,001,355 | ---- | C] () -- C:\WINDOWS\imsins.BAK
[2013/09/24 11:37:58 | 000,000,075 | RHS- | C] () -- C:\WINDOWS\CT6STET.BIN
[2013/09/14 12:38:32 | 000,015,129 | -H-- | C] () -- C:\WINDOWS\System32\BTImages.dat
[2013/05/09 12:41:23 | 000,001,152 | ---- | C] () -- C:\WINDOWS\wininit.ini
[2013/05/01 12:48:37 | 000,357,798 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\WPFFontCache_v0400-S-1-5-21-484763869-602162358-1606980848-1003-0.dat
[2013/04/26 23:05:10 | 000,445,594 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\WPFFontCache_v0400-System.dat
[2013/04/15 15:17:58 | 000,006,264 | ---- | C] () -- C:\Documents and Settings\Owner\r
[2012/12/24 13:38:50 | 000,320,952 | ---- | C] () -- C:\WINDOWS\LInstSvr.exe
[2012/12/24 13:38:48 | 000,596,752 | ---- | C] () -- C:\WINDOWS\Agt3Tool.exe
[2012/12/24 13:38:48 | 000,003,430 | ---- | C] () -- C:\WINDOWS\pwddict.ini
[2012/12/24 13:38:47 | 000,041,060 | ---- | C] () -- C:\WINDOWS\baktpkt9.sys
[2012/12/24 13:38:46 | 000,022,629 | ---- | C] () -- C:\WINDOWS\toa32pd9.sys
[2012/12/18 12:41:38 | 000,139,876 | -H-- | C] () -- C:\WINDOWS\System32\mlfcache.dat
[2012/11/19 15:21:14 | 000,094,208 | ---- | C] () -- C:\WINDOWS\System32\getpntid.exe
[2012/11/18 14:56:16 | 000,000,014 | ---- | C] () -- C:\WINDOWS\System32\sysvflc.dll
[2012/11/18 14:41:32 | 000,200,704 | ---- | C] () -- C:\WINDOWS\System32\SvcMan.exe
[2012/11/18 14:41:32 | 000,040,960 | ---- | C] () -- C:\WINDOWS\System32\W2KUSBIF.DLL
[2012/09/11 18:32:18 | 000,040,344 | ---- | C] () -- C:\WINDOWS\System32\drivers\stdriverx86.sys
[2012/07/20 18:01:08 | 000,003,840 | ---- | C] () -- C:\WINDOWS\System32\drivers\BANTExt.sys
[2012/07/01 16:47:39 | 000,001,126 | ---- | C] () -- C:\Documents and Settings\Owner\Application Data\qfx2qif.ini
[2012/05/20 14:13:52 | 000,012,288 | ---- | C] () -- C:\WINDOWS\System32\Hlinkprx.dll
[2012/05/14 17:19:18 | 000,003,072 | ---- | C] () -- C:\WINDOWS\System32\iacenc.dll

========== ZeroAccess Check ==========

[2011/01/20 06:16:37 | 000,000,227 | RHS- | M] () -- C:\WINDOWS\assembly\Desktop.ini

[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
" " = %SystemRoot%\system32\shdocvw.dll -- [2013/10/12 10:54:28 | 001,510,400 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
" " = %systemroot%\system32\wbem\fastprox.dll -- [2009/02/09 08:10:48 | 000,473,600 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]
" " = %systemroot%\system32\wbem\wbemess.dll -- [2008/04/14 05:42:10 | 000,273,920 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Both

 

====== REMAINDER OF ZERO ACCESS CHECK ========


========== LOP Check ==========

[2014/04/11 12:52:24 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Administrator\Application Data\Box Sync
[2013/05/09 09:58:19 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Administrator\Application Data\TuneUp Software
[2013/03/17 13:15:15 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\3dpageflip
[2013/04/25 12:28:20 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\3dpf
[2013/06/09 17:16:44 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\A-PDF
[2013/01/19 13:14:18 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\APP
[2012/07/09 18:08:11 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\ashampoo
[2014/04/18 11:56:14 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Auslogics
[2013/05/06 17:21:39 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\AVG April 2013 Campaign
[2012/12/09 13:20:54 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\BlazeVideo
[2014/03/18 16:36:48 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Blueberry
[2012/11/08 14:10:06 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\com.aspexsoftware.Silhouette_Studio.8
[2012/11/08 14:08:15 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\com.aspexsoftware.Silhouette_Studio.license
[2013/04/29 13:21:52 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\All Users\Application Data\Common Files
[2013/09/23 18:23:51 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Debenu
[2013/06/09 17:16:59 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\flipBook
[2012/10/07 18:42:07 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\IDriveSync
[2013/08/15 22:58:12 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\InstallMate
[2013/01/31 17:20:18 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\install_clap
[2013/03/03 15:22:21 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Licenses
[2013/09/14 03:01:53 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\LogMeIn
[2014/03/18 16:16:52 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\LogSys
[2013/10/29 13:05:11 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\MAGIX
[2013/05/23 09:23:39 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\MFAData
[2014/03/03 18:27:57 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Package Cache
[2014/04/13 13:53:26 | 000,000,000 | --SD | M] -- C:\Documents and Settings\All Users\Application Data\Shared Space
[2014/04/22 21:16:27 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\TEMP
[2011/01/20 07:30:28 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\UIB
[2013/05/09 09:58:19 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Default User\Application Data\TuneUp Software
[2014/04/10 09:50:21 | 000,000,000 | ---D | M] -- C:\Documents and Settings\LocalService\Application Data\Box Sync
[2012/08/06 14:26:00 | 000,000,000 | ---D | M] -- C:\Documents and Settings\LocalService\Application Data\Softland
[2014/03/23 19:17:53 | 000,000,000 | ---D | M] -- C:\Documents and Settings\NetworkService\Application Data\Box Sync
[2013/11/23 22:23:55 | 000,000,000 | ---D | M] -- C:\Documents and Settings\NetworkService\Application Data\Softland
[2013/01/30 15:25:43 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Owner\Application Data\ArcticLine
[2012/07/09 18:09:09 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Owner\Application Data\Ashampoo
[2012/07/24 14:00:39 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Owner\Application Data\Ashampoo Slideshow Studio 2012
[2012/11/08 13:53:29 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Owner\Application Data\Aspex Research & Technology
[2012/09/11 15:49:55 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Owner\Application Data\Audacity
[2014/03/18 16:37:51 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Owner\Application Data\Blueberry
[2014/04/15 15:58:30 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Owner\Application Data\Box Sync
[2013/11/22 20:15:50 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Owner\Application Data\CheckPoint
[2013/04/20 10:03:15 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Owner\Application Data\com.AccuWeather.air.stratus.6AF67E59E785A9A644FCA43BED05A7731922EF40.1
[2012/10/26 21:57:56 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Owner\Application Data\com.adobe.newhope.NHProject.prod.E7BED6E5DDA59983786DD72EBFA46B1598278E07.1
[2012/11/08 15:11:29 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Owner\Application Data\com.aspexsoftware.Silhouette_Studio
[2012/10/29 14:05:12 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Owner\Application Data\com.leawo.imediago
[2012/10/22 10:47:25 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Owner\Application Data\CommonDataMSI
[2013/04/04 21:05:40 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Owner\Application Data\Dashlane
[2013/03/24 18:44:20 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Owner\Application Data\DAZ 3D
[2013/02/24 22:35:31 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Owner\Application Data\DDMSettings
[2014/04/23 17:09:26 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Owner\Application Data\Dropbox
[2014/04/01 10:17:25 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Owner\Application Data\DropboxMaster
[2012/11/17 11:13:16 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Owner\Application Data\FedEx
[2012/10/11 16:01:30 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Owner\Application Data\FedExDesktop.026F9BDCA0F141E500950436A5D33181EE6B8EF5.1
[2011/02/13 23:59:34 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Owner\Application Data\Foxit Software
[2012/11/24 23:07:48 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Owner\Application Data\Glarysoft Giveaway
[2012/10/22 10:45:40 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Owner\Application Data\Iconico
[2014/04/13 13:45:28 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Owner\Application Data\IDriveSync
[2013/11/16 20:25:20 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Owner\Application Data\iSkysoft
[2014/03/18 16:23:13 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Owner\Application Data\LogSys
[2012/11/29 17:38:05 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Owner\Application Data\MAGIX
[2012/08/06 14:26:00 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Owner\Application Data\Softland
[2014/02/15 12:34:50 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Owner\Application Data\StreamTorrent
[2012/12/09 12:12:34 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Owner\Application Data\TFP
[2013/01/07 14:23:18 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Owner\Application Data\TransMedia
[2013/04/24 19:32:32 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Owner\Application Data\Tresorit
[2013/04/29 13:33:49 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Owner\Application Data\TuneUp Software
[2013/11/24 17:05:28 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Owner\Application Data\Windows Desktop Search
[2014/03/18 20:23:22 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Owner\Application Data\Windows Search
[2013/11/02 11:48:32 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Owner\Application Data\WinPatrol

========== Purity Check ==========



========== Files - Unicode (All) ==================== Alternate Data Streams ==========

@Alternate Data Stream - 226 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:B1CD2545
@Alternate Data Stream - 221 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:820563D3
@Alternate Data Stream - 210 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:CB9FA647
@Alternate Data Stream - 171 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:F8B88761
@Alternate Data Stream - 139 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:392AA8A9
@Alternate Data Stream - 119 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:5C321E34

< End of report >

 

WHEW!! That's a lot of stuff to look through. So glad you are the expert. You help is GREATLY appreciated.

 

Comodo was not disabled when Security Check was run and at one point during the scan, Comodo isolated a procedure and I tagged it not to isolate again, but I don't know if it let that one thing go ahead and function as it should. In the end, Security Check did continue with the scan, just don't know if it is as complete as it should be. As of now, this am, my hard drive is acting pretty normal. I see that Java is out of date. I have it disabled (ask to activate). Do you want me to remove older versions and update to current?
===============================================


All processes killed
========== OTL ==========
Service SDWSCService stopped successfully!
Service SDWSCService deleted successfully!
File C:\Program Files\Spybot not found.
Service SDUpdateService stopped successfully!
Service SDUpdateService deleted successfully!
File C:\Program Files\Spybot not found.
Service SDScannerService stopped successfully!
Service SDScannerService deleted successfully!
File C:\Program Files\Spybot not found.
Service HidServ stopped successfully!
Service HidServ deleted successfully!
File %SystemRoot%\System32\hidserv.dll not found.
Service WDICA stopped successfully!
Service WDICA deleted successfully!
Service PDRFRAME stopped successfully!
Service PDRFRAME deleted successfully!
Service PDRELI stopped successfully!
Service PDRELI deleted successfully!
Service PDFRAME stopped successfully!
Service PDFRAME deleted successfully!
Service PDCOMP stopped successfully!
Service PDCOMP deleted successfully!
Service PCIDump stopped successfully!
Service PCIDump deleted successfully!
Service lbrtfdc stopped successfully!
Service lbrtfdc deleted successfully!
Service i2omgmt stopped successfully!
Service i2omgmt deleted successfully!
Service cpudrv stopped successfully!
Service cpudrv deleted successfully!
File C:\Program Files\SystemRequirementsLab\cpudrv.sys not found.
Service Changer stopped successfully!
Service Changer deleted successfully!
Service catchme stopped successfully!
Service catchme deleted successfully!
File C:\ComboFix\catchme.sys not found.
HKU\S-1-5-21-484763869-602162358-1606980848-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyOverride| /E : value set successfully!
HKU\S-1-5-21-484763869-602162358-1606980848-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyServer| /E : value set successfully!
Registry value HKEY_USERS\S-1-5-21-484763869-602162358-1606980848-1003\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{EE2AC4E5-B0B0-4EC6-88A9-BCA1A32AB107} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{EE2AC4E5-B0B0-4EC6-88A9-BCA1A32AB107}\ not found.
ADS C:\Documents and Settings\All Users\Application Data\TEMP:B1CD2545 deleted successfully.
ADS C:\Documents and Settings\All Users\Application Data\TEMP:820563D3 deleted successfully.
ADS C:\Documents and Settings\All Users\Application Data\TEMP:CB9FA647 deleted successfully.
ADS C:\Documents and Settings\All Users\Application Data\TEMP:F8B88761 deleted successfully.
ADS C:\Documents and Settings\All Users\Application Data\TEMP:392AA8A9 deleted successfully.
ADS C:\Documents and Settings\All Users\Application Data\TEMP:5C321E34 deleted successfully.
========== SERVICES/DRIVERS ==========
========== REGISTRY ==========
========== FILES ==========
File\Folder C:\FRST not found.
========== COMMANDS ==========

[EMPTYTEMP]

User: Administrator
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 67 bytes
->Flash cache emptied: 57472 bytes

User: All Users

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 67 bytes
->Flash cache emptied: 57472 bytes

User: LocalService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 67 bytes

User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 1409158 bytes

User: Owner
->Temp folder emptied: 5328338 bytes
->Temporary Internet Files folder emptied: 180603 bytes
->Java cache emptied: 6441150 bytes
->FireFox cache emptied: 178690154 bytes
->Apple Safari cache emptied: 0 bytes
->Flash cache emptied: 2885888 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 2577 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 19008 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 0 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 33170 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 186.00 mb


[EMPTYJAVA]

User: Administrator

User: All Users

User: Default User

User: LocalService

User: NetworkService

User: Owner
->Java cache emptied: 0 bytes

Total Java Files Cleaned = 0.00 mb


[EMPTYFLASH]

User: Administrator
->Flash cache emptied: 0 bytes

User: All Users

User: Default User
->Flash cache emptied: 0 bytes

User: LocalService

User: NetworkService

User: Owner
->Flash cache emptied: 0 bytes

Total Flash Files Cleaned = 0.00 mb


OTL by OldTimer - Version 3.2.69.0 log created on 04232014_215800

Files\Folders moved on Reboot...

PendingFileRenameOperations files...

Registry entries deleted on Reboot...

==========================================

Results of screen317's Security Check version 0.99.82
Windows XP Service Pack 3 x86
Internet Explorer 8
``````````````Antivirus/Firewall Check:``````````````
Windows Firewall Disabled!
COMODO Antivirus
ZoneAlarm Free Firewall Antivirus
Antivirus up to date! (On Access scanning disabled!)
`````````Anti-malware/Other Utilities Check:`````````
WinPatrol
MVPS Hosts File
SpywareBlaster 5.0
Spybot - Search & Destroy
CCleaner
Java 7 Update 51
Java version out of Date!
Mozilla Firefox (28.0)
````````Process Check: objlist.exe by Laurent````````
WinPatrol winpatrol.exe is disabled!
`````````````````System Health check`````````````````
Total Fragmentation on Drive C:: 11% Defragment your hard drive soon! (Do NOT defrag if SSD!)
````````````````````End of Log``````````````````````


=======================================

Farbar Service Scanner Version: 25-02-2014
Ran by Owner (administrator) on 23-04-2014 at 22:51:05
Running from "C:\Documents and Settings\Owner\Desktop\Diagnostics "
Microsoft Windows XP Professional Service Pack 3 (X86)
Boot Mode: Normal
****************************************************************

Internet Services:
============

Connection Status:
==============
Localhost is accessible.
LAN connected.
Google IP is accessible.
Google.com is accessible.
Yahoo.com is accessible.


Windows Firewall:
=============

Firewall Disabled Policy:
==================
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall "=DWORD:0


System Restore:
============

System Restore Disabled Policy:
========================


Security Center:
============


Windows Update:
============

Windows Autoupdate Disabled Policy:
============================


Other Services:
==============


File Check:
========
C:\WINDOWS\system32\dhcpcsvc.dll => MD5 is legit
C:\WINDOWS\system32\Drivers\afd.sys => MD5 is legit
C:\WINDOWS\system32\Drivers\netbt.sys => MD5 is legit
C:\WINDOWS\system32\Drivers\tcpip.sys => MD5 is legit
C:\WINDOWS\system32\Drivers\ipsec.sys => MD5 is legit
C:\WINDOWS\system32\dnsrslvr.dll => MD5 is legit
C:\WINDOWS\system32\ipnathlp.dll => MD5 is legit
C:\WINDOWS\system32\netman.dll => MD5 is legit
C:\WINDOWS\system32\wbem\WMIsvc.dll => MD5 is legit
C:\WINDOWS\system32\srsvc.dll => MD5 is legit
C:\WINDOWS\system32\Drivers\sr.sys => MD5 is legit
C:\WINDOWS\system32\wscsvc.dll => MD5 is legit
C:\WINDOWS\system32\wbem\WMIsvc.dll => MD5 is legit
C:\WINDOWS\system32\wuauserv.dll => MD5 is legit
C:\WINDOWS\system32\qmgr.dll => MD5 is legit
C:\WINDOWS\system32\es.dll => MD5 is legit
C:\WINDOWS\system32\cryptsvc.dll => MD5 is legit
C:\WINDOWS\system32\svchost.exe => MD5 is legit
C:\WINDOWS\system32\rpcss.dll => MD5 is legit
C:\WINDOWS\system32\services.exe => MD5 is legit

Extra List:
=======
cmdHlp(91) Gpc(7) IPSec(5) NetBT(6) Tcpip(4)
0x0900000005000000040000005B0000005A0000000100000006000000070000000800000002000000
IpSec Tag value is correct.

**** End of log ****

C:\Documents and Settings\All Users\Application Data\Comodo\Cis\Quarantine\data\{B764F9EE-2DB5-4EF9-9C15-CDF637338F96} Win32/AdWare.1ClickDownload.AR application

 

Did and read all you requested on the last post. However, when the Secunia finished I got an error " script on this page is causing IE to run slowly." The first time I quit it and re ran the program. It happened again but this time I chose no so I could take a look at what needed updated. I don't know how to fix that so I need your assistance with that.

Over all the computer is running fantastic. I am still having a problem with Firefox "not responding" occasionally, so I think I'll just have to remove it and re install a clean version. I've done everything FF support suggests but it still wants to do the same thing. Spit and sputter - I have the female version - very unpredictable/finicky - good days and bad days - You guys understand what I'm saying because who would know better than another female. LOL!!

I'll follow your prescription Dr. Broni and religiously run my weekly programs.