Solved Whitesmoke infection and problems with updates to function

[Resolved] Whitesmoke infection and problems with updates to function

My daughters computer was running poorly and she asked me to take a look at it. I uninstalled 2 bit torrent programs and let her know the danger involved with these type of programs. I also ran the scans you have requested with logs to follow.

I ran combo fix but no longer have the text from it. I also ran tdds but it did not find anything.

For some reason I am still unable to get windows update to function as it should. It seems to find the update but stalls while trying to install it.

Thank you so much for any help you can give. It is appreciated

 

.
DDS (Ver_11-03-05.01) - NTFSx86
Run by Laci Ryan at 20:47:09.11 on Sat 04/02/2011
Internet Explorer: 8.0.7600.16385 BrowserJavaVersion: 1.6.0_24
Microsoft Windows 7 Home Premium 6.1.7600.0.1252.1.1033.18.3002.2109 [GMT -4:00]
.
AV: Microsoft Security Essentials *Disabled/Updated* {108DAC43-C256-20B7-BB05-914135DA5160}
SP: Microsoft Security Essentials *Disabled/Updated* {ABEC4DA7-E46C-2F39-81B5-AA334E5D1BDD}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
============== Running Processes ===============
.
C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\svchost.exe -k RPCSS
c:\Program Files\Microsoft Security Client\Antimalware\MsMpEng.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe
C:\Program Files\LSI SoftModem\agrsmsvc.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
C:\Windows\system32\taskhost.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Acer Arcade Deluxe\HomeMedia\Kernel\DMP\CLHNService.exe
C:\Program Files\Acer\Acer PowerSmart Manager\ePowerSvc.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
C:\Program Files\LeapFrog\LeapFrog Connect\CommandService.exe
C:\Program Files\EgisTec\MyWinLocker 3\x86\MWLService.exe
C:\Program Files\Cisco\Cisco NAC Agent\NACAgent.exe
C:\Program Files\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe
C:\Windows\system32\taskeng.exe
C:\Program Files\Cisco\Cisco NAC Agent\NACAgentUI.exe
C:\Program Files\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe
C:\Program Files\Secunia\PSI\PSIA.exe
C:\Windows\system32\svchost.exe -k imgsvc
C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMon.exe
C:\Program Files\real\realplayer\Update\realsched.exe
C:\Program Files\Microsoft Security Client\msseces.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe
C:\Program Files\Secunia\PSI\psi_tray.exe
C:\Windows\system32\SearchIndexer.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Secunia\PSI\sua.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Windows\system32\Macromed\Flash\FlashUtil10o_ActiveX.exe
C:\Windows\system32\SearchProtocolHost.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Google\Update\GoogleUpdate.exe
C:\Windows\system32\sppsvc.exe
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe
C:\Users\Laci Ryan\Desktop\dds.scr
C:\Windows\system32\conhost.exe
C:\Windows\system32\wbem\wmiprvse.exe
.
============== Pseudo HJT Report ===============
.
uStart Page = hxxp://my.yahoo.com/
mStart Page = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0409&s=2&o=vp32&d=0509&m=aspire_4736z
uInternet Settings,ProxyOverride = *.local
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: RealPlayer Download and Record Plugin for Internet Explorer: {3049c3e9-b461-4bc5-8870-4c09146192ca} - c:\programdata\real\realplayer\browserrecordplugin\ie\rpbrowserrecordplugin.dll
BHO: Windows Live Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
uRun: [ISUSPM] "c:\program files\common files\installshield\updateservice\ISUSPM.exe" -scheduler
mRun: [TkBellExe] "c:\program files\real\realplayer\update\realsched.exe" -osboot
mRun: [MSC] "c:\program files\microsoft security client\msseces.exe" -hide -runkey
mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime
mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe "
mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 10.0\reader\Reader_sl.exe "
mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe "
StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\secuni~1.lnk - c:\program files\secunia\psi\psi_tray.exe
mPolicies-explorer: BindDirectlyToPropertySetStorage = 0 (0x0)
mPolicies-system: ConsentPromptBehaviorAdmin = 5 (0x5)
mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3)
mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
IE: E&xport to Microsoft Excel - c:\progra~1\micros~3\office12\EXCEL.EXE/3000
IE: Google Sidewiki... - c:\program files\google\google toolbar\component\GoogleToolbarDynamic_mui_en_950DF09FAB501E03.dll/cmsidewiki.html
IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - c:\program files\windows live\writer\WriterBrowserExtension.dll
IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\progra~1\micros~3\office12\ONBttnIE.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~3\office12\REFIEBAR.DLL
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~1\common~1\skype\SKYPE4~1.DLL
Notify: igfxcui - igfxdev.dll
AppInit_DLLs: c:\progra~1\google\google~1\GoogleDesktopNetwork3.dll
.
================= FIREFOX ===================
.
FF - ProfilePath - c:\users\laciry~1\appdata\roaming\mozilla\firefox\profiles\f08maq6d.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://www.yahoo.com/?ilc=1
FF - plugin: c:\program files\common files\research in motion\bbwebsllauncher\NPWebSLLauncher.dll
FF - plugin: c:\program files\google\google earth\plugin\npgeplugin.dll
FF - plugin: c:\program files\google\update\1.2.183.39\npGoogleOneClick8.dll
FF - plugin: c:\program files\java\jre6\bin\new_plugin\npdeployJava1.dll
FF - plugin: c:\program files\microsoft silverlight\4.0.60129.0\npctrlui.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npdeployJava1.dll
FF - plugin: c:\program files\windows live\photo gallery\NPWLPG.dll
FF - plugin: c:\programdata\real\realplayer\browserrecordplugin\mozillaplugins\nprphtml5videoshim.dll
FF - plugin: c:\users\laci ryan\appdata\local\google\update\1.2.183.39\npGoogleOneClick8.dll
FF - plugin: c:\users\laci ryan\appdata\local\yahoo!\browserplus\2.9.8\plugins\npybrowserplus_2.9.8.dll
FF - plugin: c:\users\laci ryan\appdata\roaming\facebook\npfbplugin_1_0_3.dll
.
============= SERVICES / DRIVERS ===============
.
R1 MpFilter;Microsoft Malware Protection Driver;c:\windows\system32\drivers\MpFilter.sys [2009-6-18 165264]
R1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\drivers\vwififlt.sys [2009-7-13 48128]
R2 CLHNService;CLHNService;c:\program files\acer arcade deluxe\homemedia\kernel\dmp\CLHNService.exe [2009-5-29 75048]
R2 ePowerSvc;Acer ePower Service;c:\program files\acer\acer powersmart manager\ePowerSvc.exe [2009-5-22 690720]
R2 gupdate;Google Update Service (gupdate);c:\program files\google\update\GoogleUpdate.exe [2010-2-16 135664]
R2 mwlPSDFilter;mwlPSDFilter;c:\windows\system32\drivers\mwlPSDFilter.sys [2008-10-9 19504]
R2 mwlPSDNServ;mwlPSDNServ;c:\windows\system32\drivers\mwlPSDNserv.sys [2008-10-9 16432]
R2 mwlPSDVDisk;mwlPSDVDisk;c:\windows\system32\drivers\mwlPSDVDisk.sys [2008-10-9 59952]
R2 MWLService;MyWinLocker Service;c:\program files\egistec\mywinlocker 3\x86\MWLService.exe [2008-10-27 306736]
R2 NACAgent;Cisco NAC Agent;c:\program files\cisco\cisco nac agent\NACAgent.exe [2010-2-5 742144]
R2 NTI IScheduleSvc;NTI IScheduleSvc;c:\program files\newtech infosystems\acer backup manager\IScheduleSvc.exe [2009-3-20 44800]
R2 NTISchedulerSvc;NTI Backup Now 5 Scheduler Service;c:\program files\newtech infosystems\nti backup now 5\SchedulerSvc.exe [2008-9-23 144632]
R2 Secunia PSI Agent;Secunia PSI Agent;c:\program files\secunia\psi\psia.exe [2011-1-10 993848]
R2 Secunia Update Agent;Secunia Update Agent;c:\program files\secunia\psi\sua.exe [2011-1-10 399416]
R3 IntcHdmiAddService;Intel(R) High Definition Audio HDMI;c:\windows\system32\drivers\IntcHdmi.sys [2009-5-22 112128]
R3 JMCR;JMCR;c:\windows\system32\drivers\jmcr.sys [2009-11-13 119256]
R3 PSI;PSI;c:\windows\system32\drivers\psi_mf.sys [2010-9-1 15544]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]
S3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0;c:\windows\system32\drivers\b57nd60x.sys [2009-7-13 229888]
S3 FlyUsb;FLY Fusion;c:\windows\system32\drivers\FlyUsb.sys [2009-11-10 19456]
S3 GoogleDesktopManager-110309-193829;Google Desktop Manager 5.9.911.3589;c:\program files\google\google desktop search\GoogleDesktop.exe [2009-5-22 30192]
S3 MpNWMon;Microsoft Malware Protection Network Driver;c:\windows\system32\drivers\MpNWMon.sys [2010-10-24 43392]
S3 netr28;Ralink 802.11n Wireless Driver for Windows Vista;c:\windows\system32\drivers\netr28.sys [2009-5-22 517120]
S3 NisDrv;Microsoft Network Inspection System;c:\windows\system32\drivers\NisDrvWFP.sys [2010-10-24 54144]
S3 NisSrv;Microsoft Network Inspection;c:\program files\microsoft security client\antimalware\NisSrv.exe [2010-11-11 206360]
S3 NTIBackupSvc;NTI Backup Now 5 Backup Service;c:\program files\newtech infosystems\nti backup now 5\BackupSvc.exe [2008-9-23 50424]
S3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\wat\WatAdminSvc.exe [2010-5-14 1343400]
.
=============== Created Last 30 ================
.
2011-04-02 23:49:54 6792528 ----a-w- c:\progra~2\microsoft\microsoft antimalware\definition updates\{35924c44-af5d-4edf-b24a-ccce6969989f}\mpengine.dll
2011-04-02 23:44:17 -------- d-sh--w- C:\$RECYCLE.BIN
2011-04-02 23:16:19 98816 ----a-w- c:\windows\sed.exe
2011-04-02 23:16:19 89088 ----a-w- c:\windows\MBR.exe
2011-04-02 23:16:19 256512 ----a-w- c:\windows\PEV.exe
2011-04-02 23:16:19 161792 ----a-w- c:\windows\SWREG.exe
2011-04-02 23:06:19 781272 ----a-w- c:\program files\mozilla firefox\mozsqlite3.dll
2011-04-02 23:06:19 728024 ----a-w- c:\program files\mozilla firefox\libGLESv2.dll
2011-04-02 23:06:19 719832 ----a-w- c:\program files\mozilla firefox\mozcpp19.dll
2011-04-02 23:06:19 1975768 ----a-w- c:\program files\mozilla firefox\D3DCompiler_42.dll
2011-04-02 23:06:19 1893336 ----a-w- c:\program files\mozilla firefox\d3dx9_42.dll
2011-04-02 23:06:19 1874904 ----a-w- c:\program files\mozilla firefox\mozjs.dll
2011-04-02 23:06:19 16856 ----a-w- c:\program files\mozilla firefox\plugin-container.exe
2011-04-02 23:06:19 15832 ----a-w- c:\program files\mozilla firefox\mozalloc.dll
2011-04-02 23:06:19 142296 ----a-w- c:\program files\mozilla firefox\libEGL.dll
2011-04-02 23:06:19 142296 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll
2011-04-02 22:26:42 100480 ----a-w- C:\pwdcrkod.sys
2011-04-02 21:29:35 -------- d-----w- c:\windows\system32\SPReview
2011-04-02 21:21:36 -------- d-----w- c:\program files\iPod
2011-04-02 21:21:35 -------- d-----w- c:\program files\iTunes
2011-04-02 21:14:01 439632 ----a-w- c:\progra~2\microsoft\microsoft antimalware\definition updates\nisbackup\gapaengine.dll
2011-04-02 21:13:59 439632 ----a-w- c:\progra~2\microsoft\microsoft antimalware\definition updates\{657c8fb4-3426-4bee-b302-f579cb850754}\gapaengine.dll
2011-04-02 21:13:55 5890896 ----a-w- c:\progra~2\microsoft\microsoft antimalware\definition updates\backup\mpengine.dll
2011-04-02 21:09:13 6792528 ----a-w- c:\progra~2\microsoft\windows defender\definition updates\{a0ea2fad-7c68-4045-ab1c-8d5f25a7a58b}\mpengine.dll
2011-04-02 20:40:44 -------- d-----w- c:\windows\Temp382200E1-249B-A2C7-A08B-1EC29D429968-Signatures
2011-04-02 20:40:11 -------- d-----w- c:\program files\Microsoft Security Client
2011-04-02 20:38:41 11776 ----a-w- c:\program files\mozilla firefox\plugins\nprjplug.dll
2011-04-02 20:38:01 240008 ----a-w- c:\windows\system32\drivers\netio.sys
2011-04-02 20:37:20 150712 ----a-w- c:\program files\mozilla firefox\plugins\nppl3260.dll
2011-04-02 20:37:01 100864 ----a-w- c:\program files\mozilla firefox\plugins\nprpjplug.dll
2011-04-02 20:24:06 -------- d-----w- c:\users\laciry~1\appdata\local\Secunia PSI
2011-04-02 20:23:58 -------- d-----w- c:\program files\Secunia
2011-04-02 19:52:57 -------- d-----w- c:\users\laci ryan\New folder
2011-03-09 21:49:20 1074176 ----a-w- c:\windows\system32\DWrite.dll
2011-03-09 21:49:19 802304 ----a-w- c:\windows\system32\FntCache.dll
2011-03-09 21:49:19 739840 ----a-w- c:\windows\system32\d2d1.dll
2011-03-09 21:49:18 642048 ----a-w- c:\windows\system32\CPFilters.dll
2011-03-09 21:49:17 534528 ----a-w- c:\windows\system32\EncDec.dll
2011-03-09 21:49:16 850432 ----a-w- c:\windows\system32\sbe.dll
2011-03-09 21:49:16 199680 ----a-w- c:\windows\system32\mpg2splt.ax
2011-03-09 21:49:15 2690560 ----a-w- c:\windows\system32\mstscax.dll
2011-03-09 21:49:15 1034240 ----a-w- c:\windows\system32\mstsc.exe
2011-03-09 21:40:56 -------- d-----w- c:\program files\Amazon
.
==================== Find3M ====================
.
2011-04-02 20:39:43 472808 ----a-w- c:\windows\system32\deployJava1.dll
2011-04-02 20:36:46 499712 ----a-w- c:\windows\system32\msvcp71.dll
2011-04-02 20:36:46 348160 ----a-w- c:\windows\system32\msvcr71.dll
2011-02-02 22:11:20 222080 ------w- c:\windows\system32\MpSigStub.exe
2011-01-07 07:31:10 442880 ----a-w- c:\windows\system32\XpsPrint.dll
2011-01-07 07:31:10 288256 ----a-w- c:\windows\system32\XpsGdiConverter.dll
2011-01-07 07:27:11 34304 ----a-w- c:\windows\system32\atmlib.dll
2011-01-07 05:33:11 294400 ----a-w- c:\windows\system32\atmfd.dll
2011-01-05 05:37:33 428032 ----a-w- c:\windows\system32\vbscript.dll
2011-01-05 03:37:38 2329088 ----a-w- c:\windows\system32\win32k.sys
.
============= FINISH: 20:48:03.91 ===============

 

MBRCheck, version 1.2.3
(c) 2010, AD

Command-line:
Windows Version: Windows 7 Home Premium Edition
Windows Information: (build 7600), 32-bit
Base Board Manufacturer: Acer
BIOS Manufacturer: Acer
System Manufacturer: Acer
System Product Name: Aspire 4736Z
Logical Drives Mask: 0x0000000c

Kernel Drivers (total 194):
0x82E05000 \SystemRoot\system32\ntkrnlpa.exe
0x83215000 \SystemRoot\system32\halmacpi.dll
0x80BA2000 \SystemRoot\system32\kdcom.dll
0x8AC2E000 \SystemRoot\system32\mcupdate_GenuineIntel.dll
0x8ACA6000 \SystemRoot\system32\PSHED.dll
0x8ACB7000 \SystemRoot\system32\BOOTVID.dll
0x8ACBF000 \SystemRoot\system32\CLFS.SYS
0x8AD01000 \SystemRoot\system32\CI.dll
0x8AE3D000 \SystemRoot\system32\drivers\Wdf01000.sys
0x8AEAE000 \SystemRoot\system32\drivers\WDFLDR.SYS
0x8AEBC000 \SystemRoot\system32\DRIVERS\ACPI.sys
0x8AF04000 \SystemRoot\system32\DRIVERS\WMILIB.SYS
0x8AF0D000 \SystemRoot\system32\DRIVERS\msisadrv.sys
0x8AF15000 \SystemRoot\system32\DRIVERS\pci.sys
0x8AF3F000 \SystemRoot\system32\DRIVERS\vdrvroot.sys
0x8AF4A000 \SystemRoot\System32\drivers\partmgr.sys
0x8AF5B000 \SystemRoot\system32\DRIVERS\volmgr.sys
0x8AF6B000 \SystemRoot\System32\drivers\volmgrx.sys
0x8AFB6000 \SystemRoot\system32\DRIVERS\compbatt.sys
0x8AFBE000 \SystemRoot\system32\DRIVERS\BATTC.SYS
0x8AFC9000 \SystemRoot\System32\drivers\mountmgr.sys
0x8AFDF000 \SystemRoot\System32\Drivers\UBHelper.sys
0x8B00A000 \SystemRoot\system32\DRIVERS\iaStor.sys
0x8B0E4000 \SystemRoot\system32\DRIVERS\amdxata.sys
0x8B0ED000 \SystemRoot\system32\drivers\fltmgr.sys
0x8B121000 \SystemRoot\system32\drivers\fileinfo.sys
0x8B209000 \SystemRoot\System32\Drivers\Ntfs.sys
0x8B338000 \SystemRoot\System32\Drivers\msrpc.sys
0x8B363000 \SystemRoot\System32\Drivers\ksecdd.sys
0x8B376000 \SystemRoot\System32\Drivers\cng.sys
0x8B3D3000 \SystemRoot\System32\drivers\pcw.sys
0x8B3E1000 \SystemRoot\System32\Drivers\Fs_Rec.sys
0x8B132000 \SystemRoot\system32\drivers\ndis.sys
0x8ADAC000 \SystemRoot\system32\drivers\NETIO.SYS
0x8AE00000 \SystemRoot\System32\Drivers\ksecpkg.sys
0x8B40B000 \SystemRoot\System32\drivers\tcpip.sys
0x8B554000 \SystemRoot\System32\drivers\fwpkclnt.sys
0x8B585000 \SystemRoot\system32\DRIVERS\volsnap.sys
0x8B5C4000 \SystemRoot\System32\Drivers\spldr.sys
0x8B5CC000 \SystemRoot\System32\drivers\rdyboost.sys
0x8B3EA000 \SystemRoot\System32\Drivers\mup.sys
0x8B400000 \SystemRoot\System32\drivers\hwpolicy.sys
0x8B62A000 \SystemRoot\System32\DRIVERS\fvevol.sys
0x8B65C000 \SystemRoot\system32\DRIVERS\disk.sys
0x8B66D000 \SystemRoot\system32\DRIVERS\CLASSPNP.SYS
0x8B78A000 \SystemRoot\system32\DRIVERS\cdrom.sys
0x8B7A9000 \SystemRoot\system32\DRIVERS\MpFilter.sys
0x8B7D0000 \SystemRoot\System32\Drivers\Null.SYS
0x8B7D7000 \SystemRoot\System32\Drivers\Beep.SYS
0x8B7DE000 \SystemRoot\System32\drivers\vga.sys
0x8B600000 \SystemRoot\System32\drivers\VIDEOPRT.SYS
0x8B7EA000 \SystemRoot\System32\drivers\watchdog.sys
0x8B7F7000 \SystemRoot\System32\DRIVERS\RDPCDD.sys
0x8B621000 \SystemRoot\system32\drivers\rdpencdd.sys
0x8B200000 \SystemRoot\system32\drivers\rdprefmp.sys
0x8B1E9000 \SystemRoot\System32\Drivers\Msfs.SYS
0x8AE25000 \SystemRoot\System32\Drivers\Npfs.SYS
0x8AFE7000 \SystemRoot\system32\DRIVERS\tdx.sys
0x8B1F4000 \SystemRoot\system32\DRIVERS\TDI.SYS
0x9003B000 \SystemRoot\system32\drivers\afd.sys
0x90095000 \SystemRoot\System32\DRIVERS\netbt.sys
0x900C7000 \SystemRoot\system32\DRIVERS\wfplwf.sys
0x900CE000 \SystemRoot\system32\DRIVERS\pacer.sys
0x900ED000 \SystemRoot\system32\DRIVERS\vwififlt.sys
0x900FE000 \SystemRoot\system32\DRIVERS\netbios.sys
0x9010C000 \SystemRoot\system32\DRIVERS\wanarp.sys
0x9011F000 \SystemRoot\system32\DRIVERS\termdd.sys
0x9012F000 \SystemRoot\system32\DRIVERS\rdbss.sys
0x90170000 \SystemRoot\system32\drivers\nsiproxy.sys
0x9017A000 \SystemRoot\system32\DRIVERS\mssmbios.sys
0x90184000 \??\c:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{35924C44-AF5D-4EDF-B24A-CCCE6969989F}\MpKsl445070e9.sys
0x9018A000 \??\C:\Program Files\Launch Manager\DPortIO.sys
0x9018E000 \SystemRoot\System32\drivers\discache.sys
0x9019A000 \SystemRoot\System32\Drivers\dfsc.sys
0x901B2000 \SystemRoot\system32\DRIVERS\blbdrive.sys
0x901C0000 \SystemRoot\system32\DRIVERS\tunnel.sys
0x901E1000 \SystemRoot\system32\DRIVERS\intelppm.sys
0x95C1A000 \SystemRoot\system32\DRIVERS\igdkmd32.sys
0x96537000 \SystemRoot\System32\drivers\dxgkrnl.sys
0x90000000 \SystemRoot\System32\drivers\dxgmms1.sys
0x965EE000 \SystemRoot\system32\DRIVERS\usbuhci.sys
0x93424000 \SystemRoot\system32\DRIVERS\USBPORT.SYS
0x9346F000 \SystemRoot\system32\DRIVERS\usbehci.sys
0x9347E000 \SystemRoot\system32\DRIVERS\HDAudBus.sys
0x9349D000 \SystemRoot\system32\DRIVERS\athr.sys
0x935CA000 \SystemRoot\system32\DRIVERS\vwifibus.sys
0x935D4000 \SystemRoot\system32\DRIVERS\L1E62x86.sys
0x93400000 \SystemRoot\system32\DRIVERS\jmcr.sys
0x8AC00000 \SystemRoot\system32\DRIVERS\SCSIPORT.SYS
0x9341F000 \SystemRoot\system32\DRIVERS\CmBatt.sys
0x935E4000 \SystemRoot\system32\DRIVERS\i8042prt.sys
0x95C00000 \SystemRoot\system32\DRIVERS\DKbFltr.sys
0x95C0A000 \SystemRoot\system32\DRIVERS\kbdclass.sys
0x93C20000 \SystemRoot\system32\DRIVERS\SynTP.sys
0x93C51000 \SystemRoot\system32\DRIVERS\USBD.SYS
0x93C53000 \SystemRoot\system32\DRIVERS\mouclass.sys
0x93C60000 \SystemRoot\system32\drivers\Afc.sys
0x93C68000 \SystemRoot\system32\Drivers\NTIDrvr.sys
0x93C70000 \SystemRoot\system32\DRIVERS\GEARAspiWDM.sys
0x93C76000 \SystemRoot\system32\DRIVERS\wmiacpi.sys
0x93C7F000 \SystemRoot\system32\DRIVERS\CompositeBus.sys
0x93C8C000 \SystemRoot\System32\Drivers\RootMdm.sys
0x93C94000 \SystemRoot\system32\drivers\modem.sys
0x93CA1000 \SystemRoot\system32\DRIVERS\AgileVpn.sys
0x93CB3000 \SystemRoot\system32\DRIVERS\rasl2tp.sys
0x93CCB000 \SystemRoot\system32\DRIVERS\ndistapi.sys
0x93CD6000 \SystemRoot\system32\DRIVERS\ndiswan.sys
0x93CF8000 \SystemRoot\system32\DRIVERS\raspppoe.sys
0x93D10000 \SystemRoot\system32\DRIVERS\raspptp.sys
0x93D27000 \SystemRoot\system32\DRIVERS\rassstp.sys
0x93D3E000 \SystemRoot\system32\DRIVERS\RimSerial.sys
0x93D45000 \SystemRoot\system32\DRIVERS\swenum.sys
0x93D47000 \SystemRoot\system32\DRIVERS\ks.sys
0x93D7B000 \SystemRoot\system32\DRIVERS\umbus.sys
0x93D89000 \SystemRoot\system32\DRIVERS\usbhub.sys
0x93DCD000 \SystemRoot\System32\Drivers\NDProxy.SYS
0x98827000 \SystemRoot\system32\drivers\RTKVHDA.sys
0x98A5F000 \SystemRoot\system32\drivers\portcls.sys
0x98A8E000 \SystemRoot\system32\drivers\drmk.sys
0x98AA7000 \SystemRoot\system32\DRIVERS\AGRSM.sys
0x98BCE000 \SystemRoot\system32\drivers\IntcHdmi.sys
0x82350000 \SystemRoot\System32\win32k.sys
0x98BEF000 \SystemRoot\System32\drivers\Dxapi.sys
0x98800000 \SystemRoot\System32\Drivers\crashdmp.sys
0x8B692000 \SystemRoot\System32\Drivers\dump_iaStor.sys
0x9880D000 \SystemRoot\System32\Drivers\dump_dumpfve.sys
0x93DDE000 \SystemRoot\system32\DRIVERS\usbccgp.sys
0x81E1B000 \SystemRoot\System32\Drivers\usbvideo.sys
0x825B0000 \SystemRoot\System32\TSDDD.dll
0x81E3F000 \SystemRoot\system32\DRIVERS\monitor.sys
0x825E0000 \SystemRoot\System32\cdd.dll
0x81E4A000 \SystemRoot\system32\drivers\luafv.sys
0x81E65000 \SystemRoot\system32\DRIVERS\mwlPSDFilter.sys
0x81E6E000 \SystemRoot\system32\drivers\WudfPf.sys
0x81E88000 \SystemRoot\system32\DRIVERS\lltdio.sys
0x81E98000 \SystemRoot\system32\DRIVERS\nwifi.sys
0x81EDE000 \SystemRoot\system32\DRIVERS\ndisuio.sys
0x81EEE000 \SystemRoot\system32\DRIVERS\rspndr.sys
0x81F01000 \SystemRoot\system32\drivers\HTTP.sys
0x81F86000 \SystemRoot\system32\DRIVERS\bowser.sys
0x81F9F000 \SystemRoot\System32\drivers\mpsdrv.sys
0x81FB1000 \SystemRoot\system32\DRIVERS\mrxsmb.sys
0x99232000 \SystemRoot\system32\DRIVERS\mrxsmb10.sys
0x9926D000 \SystemRoot\system32\DRIVERS\mrxsmb20.sys
0x992A0000 \SystemRoot\system32\DRIVERS\mwlPSDNServ.sys
0x992A9000 \SystemRoot\system32\DRIVERS\mwlPSDVDisk.sys
0x992BB000 \SystemRoot\system32\drivers\peauth.sys
0x99352000 \SystemRoot\System32\Drivers\secdrv.SYS
0x9935C000 \SystemRoot\System32\DRIVERS\srvnet.sys
0x9937D000 \SystemRoot\System32\drivers\tcpipreg.sys
0x9938A000 \SystemRoot\System32\DRIVERS\srv2.sys
0xADE01000 \SystemRoot\System32\DRIVERS\srv.sys
0xADE52000 \SystemRoot\system32\DRIVERS\psi_mf.sys
0xADE55000 \??\C:\Users\LACIRY~1\AppData\Local\Temp\pwdcrkod.sys
0xADED8000 \SystemRoot\system32\DRIVERS\asyncmac.sys
0x770F0000 \Windows\System32\ntdll.dll
0x48050000 \Windows\System32\smss.exe
0x77330000 \Windows\System32\apisetschema.dll
0x00040000 \Windows\System32\autochk.exe
0x77240000 \Windows\System32\kernel32.dll
0x77020000 \Windows\System32\msctf.dll
0x76FA0000 \Windows\System32\comdlg32.dll
0x76F70000 \Windows\System32\imagehlp.dll
0x76F20000 \Windows\System32\gdi32.dll
0x76E80000 \Windows\System32\usp10.dll
0x76CE0000 \Windows\System32\setupapi.dll
0x76C30000 \Windows\System32\msvcrt.dll
0x76C10000 \Windows\System32\sechost.dll
0x76B40000 \Windows\System32\user32.dll
0x769E0000 \Windows\System32\ole32.dll
0x77230000 \Windows\System32\lpk.dll
0x769A0000 \Windows\System32\ws2_32.dll
0x76910000 \Windows\System32\clbcatq.dll
0x767D0000 \Windows\System32\urlmon.dll
0x76740000 \Windows\System32\oleaut32.dll
0x76730000 \Windows\System32\psapi.dll
0x75AE0000 \Windows\System32\shell32.dll
0x759E0000 \Windows\System32\wininet.dll
0x75930000 \Windows\System32\rpcrt4.dll
0x75730000 \Windows\System32\iertutil.dll
0x75690000 \Windows\System32\advapi32.dll
0x75630000 \Windows\System32\shlwapi.dll
0x755E0000 \Windows\System32\Wldap32.dll
0x755C0000 \Windows\System32\imm32.dll
0x755B0000 \Windows\System32\nsi.dll
0x75550000 \Windows\System32\difxapi.dll
0x75540000 \Windows\System32\normaliz.dll
0x754B0000 \Windows\System32\comctl32.dll
0x75390000 \Windows\System32\crypt32.dll
0x75370000 \Windows\System32\devobj.dll
0x75340000 \Windows\System32\cfgmgr32.dll
0x752F0000 \Windows\System32\KernelBase.dll
0x752C0000 \Windows\System32\wintrust.dll
0x752B0000 \Windows\System32\msasn1.dll

Processes (total 55):
0 System Idle Process
4 System
292 C:\Windows\System32\smss.exe
468 csrss.exe
524 C:\Windows\System32\wininit.exe
532 csrss.exe
580 C:\Windows\System32\services.exe
596 C:\Windows\System32\lsass.exe
604 C:\Windows\System32\lsm.exe
704 C:\Windows\System32\svchost.exe
752 C:\Windows\System32\winlogon.exe
832 C:\Windows\System32\svchost.exe
884 C:\Program Files\Microsoft Security Client\Antimalware\MsMpEng.exe
1004 C:\Windows\System32\svchost.exe
1076 C:\Windows\System32\svchost.exe
1116 C:\Windows\System32\svchost.exe
1220 C:\Windows\System32\svchost.exe
1344 C:\Windows\System32\svchost.exe
1568 C:\Windows\System32\spoolsv.exe
1600 C:\Windows\System32\svchost.exe
1692 C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe
1712 C:\Program Files\LSI SoftModem\agrsmsvc.exe
1732 C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
1784 C:\Windows\System32\taskhost.exe
1836 C:\Windows\System32\dwm.exe
1868 C:\Windows\explorer.exe
1892 C:\Program Files\Bonjour\mDNSResponder.exe
1928 C:\Program Files\Acer Arcade Deluxe\HomeMedia\Kernel\DMP\CLHNService.exe
2032 C:\Program Files\Acer\Acer PowerSmart Manager\ePowerSvc.exe
308 C:\Windows\System32\svchost.exe
340 C:\Program Files\LeapFrog\LeapFrog Connect\CommandService.exe
464 C:\Program Files\EgisTec\MyWinLocker 3\x86\MWLService.exe
1296 C:\Program Files\Cisco\Cisco NAC Agent\NACAgent.exe
1884 C:\Program Files\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe
2128 C:\Program Files\Cisco\Cisco NAC Agent\NACAgentUI.exe
2156 C:\Program Files\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe
2200 C:\Program Files\Secunia\PSI\psia.exe
2304 C:\Windows\System32\svchost.exe
2380 C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTmon.exe
3064 C:\Program Files\real\realplayer\Update\realsched.exe
3316 C:\Windows\System32\svchost.exe
3436 C:\Windows\System32\SearchIndexer.exe
3632 C:\Program Files\Microsoft Security Client\msseces.exe
3696 C:\Program Files\iTunes\iTunesHelper.exe
3720 C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe
3748 C:\Program Files\Secunia\PSI\psi_tray.exe
3952 C:\Program Files\iPod\bin\iPodService.exe
4068 C:\Program Files\Secunia\PSI\sua.exe
2420 C:\Program Files\Windows Media Player\wmpnetwk.exe
2476 C:\Windows\System32\wuauclt.exe
1576 C:\Windows\System32\audiodg.exe
2104 dllhost.exe
3020 dllhost.exe
3568 C:\Users\Laci Ryan\Desktop\MBRCheck.exe
3004 C:\Windows\System32\conhost.exe

\\.\C: --> \\.\PhysicalDrive0 at offset 0x00000003`00400000 (NTFS)

PhysicalDrive0 Model Number: TOSHIBAMK2555GSX, Rev: FG001J

Size Device Name MBR Status
--------------------------------------------
232 GB \\.\PhysicalDrive0 Windows 7 MBR code detected
SHA1: 4379A3D43019B46FA357F7DD6A53B45A3CA8FB79


Done!

.
UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT
.
DDS (Ver_11-03-05.01)
.
Microsoft Windows 7 Home Premium
Boot Device: \Device\HarddiskVolume2
Install Date: 11/13/2009 1:24:22 PM
System Uptime: 4/2/2011 8:44:30 PM (0 hours ago)
.
Motherboard: Acer | | Aspire 4736Z
Processor: Pentium(R) Dual-Core CPU T4200 @ 2.00GHz | uPGA-478 | 1200/200mhz
.
==== Disk Partitions =========================
.
C: is FIXED (NTFS) - 221 GiB total, 164.144 GiB free.
D: is CDROM ()
.
==== Disabled Device Manager Items =============
.
==== System Restore Points ===================
.
RP368: 4/2/2011 5:29:26 PM - Windows 7 Service Pack 1
RP369: 4/2/2011 5:34:14 PM - Installed BlackBerry Desktop Software.
RP370: 4/2/2011 5:37:56 PM - Installed Adobe Reader X.
RP371: 4/2/2011 5:58:23 PM - Windows Update
RP372: 4/2/2011 7:53:26 PM - Windows Update
.
==== Installed Programs ======================
.
Acer Arcade Deluxe
Acer Assist
Acer Backup Manager
Acer Crystal Eye Webcam
Acer Crystal Eye webcam Ver:1.1.74.216
Acer GridVista
Acer PowerSmart Manager
Acer Registration
Acer ScreenSaver
Acrobat.com
Adobe Flash Player 10 ActiveX
Adobe Flash Player 10 Plugin
Adobe Reader X (10.0.1)
Amazon MP3 Downloader 1.0.10
Apple Application Support
Apple Mobile Device Support
Apple Software Update
ArcSoft MediaImpression for Kodak
Atheros Communications Inc.(R) AR81Family Gigabit/Fast Ethernet Driver
Backup Manager Basic
BlackBerry Desktop Software 6.0.1
Bonjour
Choice Guard
Cisco NAC Agent
Compatibility Pack for the 2007 Office system
Facebook Plug-In
Google Chrome
Google Desktop
Google Earth
Google Update Helper
Intel(R) Graphics Media Accelerator Driver
Intel(R) TV Wizard
Intel® Matrix Storage Manager
iTunes
Java Auto Updater
Java(TM) 6 Update 24
JMicron Flash Media Controller Driver
Junk Mail filter update
Launch Manager
LeapFrog Connect
LeapFrog My Pals Plugin
LeapFrog Tag Junior Plugin
Malwarebytes' Anti-Malware
Microsoft .NET Framework 4 Client Profile
Microsoft Antimalware
Microsoft Application Error Reporting
Microsoft Office 2007 Service Pack 2 (SP2)
Microsoft Office Excel MUI (English) 2007
Microsoft Office Home and Student 2007
Microsoft Office OneNote MUI (English) 2007
Microsoft Office PowerPoint MUI (English) 2007
Microsoft Office PowerPoint Viewer 2007 (English)
Microsoft Office Proof (English) 2007
Microsoft Office Proof (French) 2007
Microsoft Office Proof (Spanish) 2007
Microsoft Office Proofing (English) 2007
Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
Microsoft Office Shared MUI (English) 2007
Microsoft Office Shared Setup Metadata MUI (English) 2007
Microsoft Office Word MUI (English) 2007
Microsoft Security Client
Microsoft Security Essentials
Microsoft Silverlight
Microsoft SQL Server 2005 Compact Edition [ENU]
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
Microsoft Visual C++ 2005 Redistributable
Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022
Microsoft Works
MobileMe Control Panel
Mozilla Firefox 4.0 (x86 en-US)
MSVCRT
MSXML 4.0 SP2 (KB954430)
MSXML 4.0 SP2 (KB973688)
MyWinLocker
NTI Backup Now 5
NTI Backup Now Standard
NTI Media Maker 8
OGA Notifier 2.0.0048.0
QuickTime
RealNetworks - Microsoft Visual C++ 2008 Runtime
RealPlayer
Realtek High Definition Audio Driver
RealUpgrade 1.1
Safari
Secunia PSI (2.0.0.3001)
Security Update for 2007 Microsoft Office System (KB2288621)
Security Update for 2007 Microsoft Office System (KB2288931)
Security Update for 2007 Microsoft Office System (KB2289158)
Security Update for 2007 Microsoft Office System (KB2344875)
Security Update for 2007 Microsoft Office System (KB2345043)
Security Update for 2007 Microsoft Office System (KB969559)
Security Update for 2007 Microsoft Office System (KB976321)
Security Update for Microsoft Office Excel 2007 (KB2345035)
Security Update for Microsoft Office InfoPath 2007 (KB979441)
Security Update for Microsoft Office PowerPoint 2007 (KB982158)
Security Update for Microsoft Office PowerPoint Viewer (KB2413381)
Security Update for Microsoft Office system 2007 (972581)
Security Update for Microsoft Office system 2007 (KB974234)
Security Update for Microsoft Office Visio Viewer 2007 (KB973709)
Security Update for Microsoft Office Word 2007 (KB2344993)
Skype Toolbars
Skype™ 5.0
Synaptics Pointing Device Driver
Update for 2007 Microsoft Office System (KB967642)
Update for Microsoft Office 2007 Help for Common Features (KB963673)
Update for Microsoft Office Excel 2007 Help (KB963678)
Update for Microsoft Office OneNote 2007 (KB980729)
Update for Microsoft Office OneNote 2007 Help (KB963670)
Update for Microsoft Office Powerpoint 2007 Help (KB963669)
Update for Microsoft Office Script Editor Help (KB963671)
Update for Microsoft Office Word 2007 Help (KB963665)
Upgrade Kit
Use the entry named LeapFrog Connect to uninstall (LeapFrog My Pals Plugin)
Use the entry named LeapFrog Connect to uninstall (LeapFrog Tag Junior Plugin)
Windows Driver Package - LeapFrog (FlyUsb) USB (11/05/2008 1.1.1.0)
Windows Live Call
Windows Live Communications Platform
Windows Live Essentials
Windows Live Mail
Windows Live Messenger
Windows Live Photo Gallery
Windows Live Sign-in Assistant
Windows Live Sync
Windows Live Upload Tool
Windows Live Writer
Yahoo! BrowserPlus 2.9.8
.
==== Event Viewer Messages From Past Week ========
.
4/2/2011 8:45:00 PM, Error: Microsoft-Windows-DNS-Client [1012] - There was an error while attempting to read the local hosts file.
4/2/2011 8:15:20 PM, Error: Service Control Manager [7007] - The system reverted to its last known good configuration. The system is restarting....
4/2/2011 7:43:27 PM, Error: Service Control Manager [7030] - The PEVSystemStart service is marked as an interactive service. However, the system is configured to not allow interactive services. This service may not function properly.
4/2/2011 6:15:00 PM, Error: Service Control Manager [7034] - The ArcSoft Connect Daemon service terminated unexpectedly. It has done this 1 time(s).
4/2/2011 6:06:28 PM, Error: Service Control Manager [7031] - The Microsoft Antimalware Service service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 15000 milliseconds: Restart the service.
4/2/2011 5:41:19 PM, Error: Service Control Manager [7043] - The Windows Update service did not shut down properly after receiving a preshutdown control.
4/2/2011 5:30:09 PM, Error: Microsoft-Windows-WindowsUpdateClient [20] - Installation Failure: Windows failed to install the following update with error 0x80246007: Windows 7 Service Pack 1 (KB976932).
4/2/2011 5:19:17 PM, Error: Service Control Manager [7032] - The Service Control Manager tried to take a corrective action (Restart the service) after the unexpected termination of the Apple Mobile Device service, but this action failed with the following error: An instance of the service is already running.
4/2/2011 5:18:17 PM, Error: Service Control Manager [7031] - The Apple Mobile Device service terminated unexpectedly. It has done this 2 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service.
4/2/2011 5:17:45 PM, Error: Service Control Manager [7031] - The Apple Mobile Device service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service.
4/2/2011 4:58:25 PM, Error: Microsoft Antimalware [2001] - Microsoft Antimalware has encountered an error trying to update signatures. New Signature Version: Previous Signature Version: 0.0.0.0 Update Source: Microsoft Update Server Update Stage: Download Source Path: http://www.microsoft.com Signature Type: AntiVirus Update Type: Full User: NT AUTHORITY\SYSTEM Current Engine Version: Previous Engine Version: 0.0.0.0 Error code: 0x800704c7 Error description: The operation was canceled by the user.
4/2/2011 4:51:43 PM, Error: Microsoft-Windows-WindowsUpdateClient [20] - Installation Failure: Windows failed to install the following update with error 0x80246007: Windows Live Essentials 2011 (KB2434419).
4/2/2011 4:41:41 PM, Error: Microsoft-Windows-WindowsUpdateClient [20] - Installation Failure: Windows failed to install the following update with error 0x800706be: Microsoft Security Essentials Client Update Package - KB2290031 (2.0.657.0).
4/2/2011 4:41:35 PM, Error: Microsoft Antimalware [3002] - Microsoft Antimalware Real-Time Protection feature has encountered an error and failed. Feature: Network Inspection System Error Code: 0x8007042c Error description: The dependency service or group failed to start. Reason: The system is missing updates that are required for running Network Inspection System. Install the required updates and restart the computer.
4/2/2011 4:15:29 PM, Error: Service Control Manager [7000] - The SASDIFSV service failed to start due to the following error: Cannot create a file when that file already exists.
4/2/2011 3:58:23 PM, Error: Microsoft Antimalware [2001] - Microsoft Antimalware has encountered an error trying to update signatures. New Signature Version: Previous Signature Version: 1.101.702.0 Update Source: Microsoft Update Server Update Stage: Search Source Path: http://www.microsoft.com Signature Type: AntiVirus Update Type: Full User: NT AUTHORITY\SYSTEM Current Engine Version: Previous Engine Version: 1.1.6702.0 Error code: 0x8024402c Error description: An unexpected problem occurred while checking for updates. For information on installing or troubleshooting updates, see Help and Support.
4/2/2011 3:58:15 PM, Error: Microsoft Antimalware [2001] - Microsoft Antimalware has encountered an error trying to update signatures. New Signature Version: Previous Signature Version: 1.101.702.0 Update Source: Microsoft Update Server Update Stage: Search Source Path: http://www.microsoft.com Signature Type: AntiVirus Update Type: Full User: NT AUTHORITY\SYSTEM Current Engine Version: Previous Engine Version: 1.1.6702.0 Error code: 0x8024402c Error description: An unexpected problem occurred while checking for updates. For information on installing or troubleshooting updates, see Help and Support.
4/2/2011 3:24:45 PM, Error: Ntfs [55] - The file system structure on the disk is corrupt and unusable. Please run the chkdsk utility on the volume ACER.
4/2/2011 3:22:18 PM, Error: Disk [11] - The driver detected a controller error on \Device\Harddisk1\DR1.
.
==== End Of File ===========================

MBRCheck, version 1.2.3
(c) 2010, AD

Command-line:
Windows Version: Windows 7 Home Premium Edition
Windows Information: (build 7600), 32-bit
Base Board Manufacturer: Acer
BIOS Manufacturer: Acer
System Manufacturer: Acer
System Product Name: Aspire 4736Z
Logical Drives Mask: 0x0000000c

Kernel Drivers (total 194):
0x82E05000 \SystemRoot\system32\ntkrnlpa.exe
0x83215000 \SystemRoot\system32\halmacpi.dll
0x80BA2000 \SystemRoot\system32\kdcom.dll
0x8AC2E000 \SystemRoot\system32\mcupdate_GenuineIntel.dll
0x8ACA6000 \SystemRoot\system32\PSHED.dll
0x8ACB7000 \SystemRoot\system32\BOOTVID.dll
0x8ACBF000 \SystemRoot\system32\CLFS.SYS
0x8AD01000 \SystemRoot\system32\CI.dll
0x8AE3D000 \SystemRoot\system32\drivers\Wdf01000.sys
0x8AEAE000 \SystemRoot\system32\drivers\WDFLDR.SYS
0x8AEBC000 \SystemRoot\system32\DRIVERS\ACPI.sys
0x8AF04000 \SystemRoot\system32\DRIVERS\WMILIB.SYS
0x8AF0D000 \SystemRoot\system32\DRIVERS\msisadrv.sys
0x8AF15000 \SystemRoot\system32\DRIVERS\pci.sys
0x8AF3F000 \SystemRoot\system32\DRIVERS\vdrvroot.sys
0x8AF4A000 \SystemRoot\System32\drivers\partmgr.sys
0x8AF5B000 \SystemRoot\system32\DRIVERS\volmgr.sys
0x8AF6B000 \SystemRoot\System32\drivers\volmgrx.sys
0x8AFB6000 \SystemRoot\system32\DRIVERS\compbatt.sys
0x8AFBE000 \SystemRoot\system32\DRIVERS\BATTC.SYS
0x8AFC9000 \SystemRoot\System32\drivers\mountmgr.sys
0x8AFDF000 \SystemRoot\System32\Drivers\UBHelper.sys
0x8B00A000 \SystemRoot\system32\DRIVERS\iaStor.sys
0x8B0E4000 \SystemRoot\system32\DRIVERS\amdxata.sys
0x8B0ED000 \SystemRoot\system32\drivers\fltmgr.sys
0x8B121000 \SystemRoot\system32\drivers\fileinfo.sys
0x8B209000 \SystemRoot\System32\Drivers\Ntfs.sys
0x8B338000 \SystemRoot\System32\Drivers\msrpc.sys
0x8B363000 \SystemRoot\System32\Drivers\ksecdd.sys
0x8B376000 \SystemRoot\System32\Drivers\cng.sys
0x8B3D3000 \SystemRoot\System32\drivers\pcw.sys
0x8B3E1000 \SystemRoot\System32\Drivers\Fs_Rec.sys
0x8B132000 \SystemRoot\system32\drivers\ndis.sys
0x8ADAC000 \SystemRoot\system32\drivers\NETIO.SYS
0x8AE00000 \SystemRoot\System32\Drivers\ksecpkg.sys
0x8B40B000 \SystemRoot\System32\drivers\tcpip.sys
0x8B554000 \SystemRoot\System32\drivers\fwpkclnt.sys
0x8B585000 \SystemRoot\system32\DRIVERS\volsnap.sys
0x8B5C4000 \SystemRoot\System32\Drivers\spldr.sys
0x8B5CC000 \SystemRoot\System32\drivers\rdyboost.sys
0x8B3EA000 \SystemRoot\System32\Drivers\mup.sys
0x8B400000 \SystemRoot\System32\drivers\hwpolicy.sys
0x8B62A000 \SystemRoot\System32\DRIVERS\fvevol.sys
0x8B65C000 \SystemRoot\system32\DRIVERS\disk.sys
0x8B66D000 \SystemRoot\system32\DRIVERS\CLASSPNP.SYS
0x8B78A000 \SystemRoot\system32\DRIVERS\cdrom.sys
0x8B7A9000 \SystemRoot\system32\DRIVERS\MpFilter.sys
0x8B7D0000 \SystemRoot\System32\Drivers\Null.SYS
0x8B7D7000 \SystemRoot\System32\Drivers\Beep.SYS
0x8B7DE000 \SystemRoot\System32\drivers\vga.sys
0x8B600000 \SystemRoot\System32\drivers\VIDEOPRT.SYS
0x8B7EA000 \SystemRoot\System32\drivers\watchdog.sys
0x8B7F7000 \SystemRoot\System32\DRIVERS\RDPCDD.sys
0x8B621000 \SystemRoot\system32\drivers\rdpencdd.sys
0x8B200000 \SystemRoot\system32\drivers\rdprefmp.sys
0x8B1E9000 \SystemRoot\System32\Drivers\Msfs.SYS
0x8AE25000 \SystemRoot\System32\Drivers\Npfs.SYS
0x8AFE7000 \SystemRoot\system32\DRIVERS\tdx.sys
0x8B1F4000 \SystemRoot\system32\DRIVERS\TDI.SYS
0x9003B000 \SystemRoot\system32\drivers\afd.sys
0x90095000 \SystemRoot\System32\DRIVERS\netbt.sys
0x900C7000 \SystemRoot\system32\DRIVERS\wfplwf.sys
0x900CE000 \SystemRoot\system32\DRIVERS\pacer.sys
0x900ED000 \SystemRoot\system32\DRIVERS\vwififlt.sys
0x900FE000 \SystemRoot\system32\DRIVERS\netbios.sys
0x9010C000 \SystemRoot\system32\DRIVERS\wanarp.sys
0x9011F000 \SystemRoot\system32\DRIVERS\termdd.sys
0x9012F000 \SystemRoot\system32\DRIVERS\rdbss.sys
0x90170000 \SystemRoot\system32\drivers\nsiproxy.sys
0x9017A000 \SystemRoot\system32\DRIVERS\mssmbios.sys
0x90184000 \??\c:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{35924C44-AF5D-4EDF-B24A-CCCE6969989F}\MpKsl445070e9.sys
0x9018A000 \??\C:\Program Files\Launch Manager\DPortIO.sys
0x9018E000 \SystemRoot\System32\drivers\discache.sys
0x9019A000 \SystemRoot\System32\Drivers\dfsc.sys
0x901B2000 \SystemRoot\system32\DRIVERS\blbdrive.sys
0x901C0000 \SystemRoot\system32\DRIVERS\tunnel.sys
0x901E1000 \SystemRoot\system32\DRIVERS\intelppm.sys
0x95C1A000 \SystemRoot\system32\DRIVERS\igdkmd32.sys
0x96537000 \SystemRoot\System32\drivers\dxgkrnl.sys
0x90000000 \SystemRoot\System32\drivers\dxgmms1.sys
0x965EE000 \SystemRoot\system32\DRIVERS\usbuhci.sys
0x93424000 \SystemRoot\system32\DRIVERS\USBPORT.SYS
0x9346F000 \SystemRoot\system32\DRIVERS\usbehci.sys
0x9347E000 \SystemRoot\system32\DRIVERS\HDAudBus.sys
0x9349D000 \SystemRoot\system32\DRIVERS\athr.sys
0x935CA000 \SystemRoot\system32\DRIVERS\vwifibus.sys
0x935D4000 \SystemRoot\system32\DRIVERS\L1E62x86.sys
0x93400000 \SystemRoot\system32\DRIVERS\jmcr.sys
0x8AC00000 \SystemRoot\system32\DRIVERS\SCSIPORT.SYS
0x9341F000 \SystemRoot\system32\DRIVERS\CmBatt.sys
0x935E4000 \SystemRoot\system32\DRIVERS\i8042prt.sys
0x95C00000 \SystemRoot\system32\DRIVERS\DKbFltr.sys
0x95C0A000 \SystemRoot\system32\DRIVERS\kbdclass.sys
0x93C20000 \SystemRoot\system32\DRIVERS\SynTP.sys
0x93C51000 \SystemRoot\system32\DRIVERS\USBD.SYS
0x93C53000 \SystemRoot\system32\DRIVERS\mouclass.sys
0x93C60000 \SystemRoot\system32\drivers\Afc.sys
0x93C68000 \SystemRoot\system32\Drivers\NTIDrvr.sys
0x93C70000 \SystemRoot\system32\DRIVERS\GEARAspiWDM.sys
0x93C76000 \SystemRoot\system32\DRIVERS\wmiacpi.sys
0x93C7F000 \SystemRoot\system32\DRIVERS\CompositeBus.sys
0x93C8C000 \SystemRoot\System32\Drivers\RootMdm.sys
0x93C94000 \SystemRoot\system32\drivers\modem.sys
0x93CA1000 \SystemRoot\system32\DRIVERS\AgileVpn.sys
0x93CB3000 \SystemRoot\system32\DRIVERS\rasl2tp.sys
0x93CCB000 \SystemRoot\system32\DRIVERS\ndistapi.sys
0x93CD6000 \SystemRoot\system32\DRIVERS\ndiswan.sys
0x93CF8000 \SystemRoot\system32\DRIVERS\raspppoe.sys
0x93D10000 \SystemRoot\system32\DRIVERS\raspptp.sys
0x93D27000 \SystemRoot\system32\DRIVERS\rassstp.sys
0x93D3E000 \SystemRoot\system32\DRIVERS\RimSerial.sys
0x93D45000 \SystemRoot\system32\DRIVERS\swenum.sys
0x93D47000 \SystemRoot\system32\DRIVERS\ks.sys
0x93D7B000 \SystemRoot\system32\DRIVERS\umbus.sys
0x93D89000 \SystemRoot\system32\DRIVERS\usbhub.sys
0x93DCD000 \SystemRoot\System32\Drivers\NDProxy.SYS
0x98827000 \SystemRoot\system32\drivers\RTKVHDA.sys
0x98A5F000 \SystemRoot\system32\drivers\portcls.sys
0x98A8E000 \SystemRoot\system32\drivers\drmk.sys
0x98AA7000 \SystemRoot\system32\DRIVERS\AGRSM.sys
0x98BCE000 \SystemRoot\system32\drivers\IntcHdmi.sys
0x82350000 \SystemRoot\System32\win32k.sys
0x98BEF000 \SystemRoot\System32\drivers\Dxapi.sys
0x98800000 \SystemRoot\System32\Drivers\crashdmp.sys
0x8B692000 \SystemRoot\System32\Drivers\dump_iaStor.sys
0x9880D000 \SystemRoot\System32\Drivers\dump_dumpfve.sys
0x93DDE000 \SystemRoot\system32\DRIVERS\usbccgp.sys
0x81E1B000 \SystemRoot\System32\Drivers\usbvideo.sys
0x825B0000 \SystemRoot\System32\TSDDD.dll
0x81E3F000 \SystemRoot\system32\DRIVERS\monitor.sys
0x825E0000 \SystemRoot\System32\cdd.dll
0x81E4A000 \SystemRoot\system32\drivers\luafv.sys
0x81E65000 \SystemRoot\system32\DRIVERS\mwlPSDFilter.sys
0x81E6E000 \SystemRoot\system32\drivers\WudfPf.sys
0x81E88000 \SystemRoot\system32\DRIVERS\lltdio.sys
0x81E98000 \SystemRoot\system32\DRIVERS\nwifi.sys
0x81EDE000 \SystemRoot\system32\DRIVERS\ndisuio.sys
0x81EEE000 \SystemRoot\system32\DRIVERS\rspndr.sys
0x81F01000 \SystemRoot\system32\drivers\HTTP.sys
0x81F86000 \SystemRoot\system32\DRIVERS\bowser.sys
0x81F9F000 \SystemRoot\System32\drivers\mpsdrv.sys
0x81FB1000 \SystemRoot\system32\DRIVERS\mrxsmb.sys
0x99232000 \SystemRoot\system32\DRIVERS\mrxsmb10.sys
0x9926D000 \SystemRoot\system32\DRIVERS\mrxsmb20.sys
0x992A0000 \SystemRoot\system32\DRIVERS\mwlPSDNServ.sys
0x992A9000 \SystemRoot\system32\DRIVERS\mwlPSDVDisk.sys
0x992BB000 \SystemRoot\system32\drivers\peauth.sys
0x99352000 \SystemRoot\System32\Drivers\secdrv.SYS
0x9935C000 \SystemRoot\System32\DRIVERS\srvnet.sys
0x9937D000 \SystemRoot\System32\drivers\tcpipreg.sys
0x9938A000 \SystemRoot\System32\DRIVERS\srv2.sys
0xADE01000 \SystemRoot\System32\DRIVERS\srv.sys
0xADE52000 \SystemRoot\system32\DRIVERS\psi_mf.sys
0xADE55000 \??\C:\Users\LACIRY~1\AppData\Local\Temp\pwdcrkod.sys
0xADED8000 \SystemRoot\system32\DRIVERS\asyncmac.sys
0x770F0000 \Windows\System32\ntdll.dll
0x48050000 \Windows\System32\smss.exe
0x77330000 \Windows\System32\apisetschema.dll
0x00040000 \Windows\System32\autochk.exe
0x77240000 \Windows\System32\kernel32.dll
0x77020000 \Windows\System32\msctf.dll
0x76FA0000 \Windows\System32\comdlg32.dll
0x76F70000 \Windows\System32\imagehlp.dll
0x76F20000 \Windows\System32\gdi32.dll
0x76E80000 \Windows\System32\usp10.dll
0x76CE0000 \Windows\System32\setupapi.dll
0x76C30000 \Windows\System32\msvcrt.dll
0x76C10000 \Windows\System32\sechost.dll
0x76B40000 \Windows\System32\user32.dll
0x769E0000 \Windows\System32\ole32.dll
0x77230000 \Windows\System32\lpk.dll
0x769A0000 \Windows\System32\ws2_32.dll
0x76910000 \Windows\System32\clbcatq.dll
0x767D0000 \Windows\System32\urlmon.dll
0x76740000 \Windows\System32\oleaut32.dll
0x76730000 \Windows\System32\psapi.dll
0x75AE0000 \Windows\System32\shell32.dll
0x759E0000 \Windows\System32\wininet.dll
0x75930000 \Windows\System32\rpcrt4.dll
0x75730000 \Windows\System32\iertutil.dll
0x75690000 \Windows\System32\advapi32.dll
0x75630000 \Windows\System32\shlwapi.dll
0x755E0000 \Windows\System32\Wldap32.dll
0x755C0000 \Windows\System32\imm32.dll
0x755B0000 \Windows\System32\nsi.dll
0x75550000 \Windows\System32\difxapi.dll
0x75540000 \Windows\System32\normaliz.dll
0x754B0000 \Windows\System32\comctl32.dll
0x75390000 \Windows\System32\crypt32.dll
0x75370000 \Windows\System32\devobj.dll
0x75340000 \Windows\System32\cfgmgr32.dll
0x752F0000 \Windows\System32\KernelBase.dll
0x752C0000 \Windows\System32\wintrust.dll
0x752B0000 \Windows\System32\msasn1.dll

Processes (total 55):
0 System Idle Process
4 System
292 C:\Windows\System32\smss.exe
468 csrss.exe
524 C:\Windows\System32\wininit.exe
532 csrss.exe
580 C:\Windows\System32\services.exe
596 C:\Windows\System32\lsass.exe
604 C:\Windows\System32\lsm.exe
704 C:\Windows\System32\svchost.exe
752 C:\Windows\System32\winlogon.exe
832 C:\Windows\System32\svchost.exe
884 C:\Program Files\Microsoft Security Client\Antimalware\MsMpEng.exe
1004 C:\Windows\System32\svchost.exe
1076 C:\Windows\System32\svchost.exe
1116 C:\Windows\System32\svchost.exe
1220 C:\Windows\System32\svchost.exe
1344 C:\Windows\System32\svchost.exe
1568 C:\Windows\System32\spoolsv.exe
1600 C:\Windows\System32\svchost.exe
1692 C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe
1712 C:\Program Files\LSI SoftModem\agrsmsvc.exe
1732 C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
1784 C:\Windows\System32\taskhost.exe
1836 C:\Windows\System32\dwm.exe
1868 C:\Windows\explorer.exe
1892 C:\Program Files\Bonjour\mDNSResponder.exe
1928 C:\Program Files\Acer Arcade Deluxe\HomeMedia\Kernel\DMP\CLHNService.exe
2032 C:\Program Files\Acer\Acer PowerSmart Manager\ePowerSvc.exe
308 C:\Windows\System32\svchost.exe
340 C:\Program Files\LeapFrog\LeapFrog Connect\CommandService.exe
464 C:\Program Files\EgisTec\MyWinLocker 3\x86\MWLService.exe
1296 C:\Program Files\Cisco\Cisco NAC Agent\NACAgent.exe
1884 C:\Program Files\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe
2128 C:\Program Files\Cisco\Cisco NAC Agent\NACAgentUI.exe
2156 C:\Program Files\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe
2200 C:\Program Files\Secunia\PSI\psia.exe
2304 C:\Windows\System32\svchost.exe
2380 C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTmon.exe
3064 C:\Program Files\real\realplayer\Update\realsched.exe
3316 C:\Windows\System32\svchost.exe
3436 C:\Windows\System32\SearchIndexer.exe
3632 C:\Program Files\Microsoft Security Client\msseces.exe
3696 C:\Program Files\iTunes\iTunesHelper.exe
3720 C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe
3748 C:\Program Files\Secunia\PSI\psi_tray.exe
3952 C:\Program Files\iPod\bin\iPodService.exe
4068 C:\Program Files\Secunia\PSI\sua.exe
2420 C:\Program Files\Windows Media Player\wmpnetwk.exe
2476 C:\Windows\System32\wuauclt.exe
1576 C:\Windows\System32\audiodg.exe
2104 dllhost.exe
3020 dllhost.exe
3568 C:\Users\Laci Ryan\Desktop\MBRCheck.exe
3004 C:\Windows\System32\conhost.exe

\\.\C: --> \\.\PhysicalDrive0 at offset 0x00000003`00400000 (NTFS)

PhysicalDrive0 Model Number: TOSHIBAMK2555GSX, Rev: FG001J

Size Device Name MBR Status
--------------------------------------------
232 GB \\.\PhysicalDrive0 Windows 7 MBR code detected
SHA1: 4379A3D43019B46FA357F7DD6A53B45A3CA8FB79


Done!Malwarebytes' Anti-Malware 1.50.1.1100
www.malwarebytes.org

Database version: 6248

Windows 6.1.7600
Internet Explorer 8.0.7600.16385

4/2/2011 4:34:33 PM
mbam-log-2011-04-02 (16-34-33).txt

Scan type: Quick scan
Objects scanned: 152555
Time elapsed: 13 minute(s), 39 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 2
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_CURRENT_USER\SOFTWARE\WhiteSmoke (PUP.Whitesmoke) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\WhiteSmoke (PUP.Whitesmoke) -> Quarantined and deleted successfully.

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

GMER 1.0.15.15570 - http://www.gmer.net
Rootkit scan 2011-04-02 20:42:02
Windows 6.1.7600 Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1 TOSHIBA_ rev.FG00
Running: 0cfbq2kk.exe; Driver: C:\Users\LACIRY~1\AppData\Local\Temp\pwdcrkod.sys


---- Kernel code sections - GMER 1.0.15 ----

.text ntkrnlpa.exe!ZwSaveKeyEx + 13BD 82E48589 1 Byte [06]
.text ntkrnlpa.exe!KiDispatchInterrupt + 5A2 82E6D092 19 Bytes [E0, 0F, BA, F0, 07, 73, 09, ...] {LOOPNZ 0x11; MOV EDX, 0x97307f0; MOV CR4, EAX; OR AL, 0x80; MOV CR4, EAX; RET ; MOV ECX, CR3}
PAGE peauth.sys 992C702C 102 Bytes JMP E35FAF7B
PAGE spsys.sys!?SPRevision@@3PADA + 4F90 ADE8B000 290 Bytes [8B, FF, 55, 8B, EC, 33, C0, ...]
PAGE spsys.sys!?SPRevision@@3PADA + 50B3 ADE8B123 629 Bytes CALL E1EEAFD5
PAGE spsys.sys!?SPRevision@@3PADA + 5329 ADE8B399 101 Bytes [6A, 28, 59, A5, 5E, C6, 03, ...]
PAGE spsys.sys!?SPRevision@@3PADA + 538F ADE8B3FF 148 Bytes [18, 5D, C2, 14, 00, 8B, FF, ...]
PAGE spsys.sys!?SPRevision@@3PADA + 543B ADE8B4AB 2228 Bytes [8B, FF, 55, 8B, EC, FF, 75, ...]
PAGE ...

---- User code sections - GMER 1.0.15 ----

.text C:\Program Files\real\realplayer\Update\realsched.exe[3064] kernel32.dll!SetUnhandledExceptionFilter 77293162 5 Bytes [33, C0, C2, 04, 00] {XOR EAX, EAX; RET 0x4}

---- User IAT/EAT - GMER 1.0.15 ----

IAT C:\Windows\Explorer.EXE[1868] @ C:\Windows\system32\SHLWAPI.dll [KERNEL32.dll!FreeLibraryAndExitThread] [10001DA0] C:\Program Files\EgisTec\MyWinLocker 3\x86\psdprotect.dll (PSD DragDrop Protection/EgisTec Inc.)
IAT C:\Windows\Explorer.EXE[1868] @ C:\Windows\system32\SHLWAPI.dll [KERNEL32.dll!CreateThread] [10002480] C:\Program Files\EgisTec\MyWinLocker 3\x86\psdprotect.dll (PSD DragDrop Protection/EgisTec Inc.)
IAT C:\Windows\Explorer.EXE[1868] @ C:\Windows\system32\SHELL32.dll [KERNEL32.dll!LoadLibraryA] [10001290] C:\Program Files\EgisTec\MyWinLocker 3\x86\psdprotect.dll (PSD DragDrop Protection/EgisTec Inc.)
IAT C:\Program Files\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe[1884] @ C:\Windows\system32\SHELL32.dll [USER32.dll!ExitWindowsEx] [00901210] C:\Program Files\NewTech Infosystems\Acer Backup Manager\Pehook.DLL (Backup Manager Module/NewTech Infosystems, Inc.)

---- EOF - GMER 1.0.15 ----

 

ComboFix 11-04-02.03 - Laci Ryan 04/02/2011 22:04:28.5.2 - x86
Microsoft Windows 7 Home Premium 6.1.7600.0.1252.1.1033.18.3002.1996 [GMT -4:00]
Running from: c:\users\Laci Ryan\Desktop\ComboFix.exe
AV: Microsoft Security Essentials *Disabled/Updated* {108DAC43-C256-20B7-BB05-914135DA5160}
SP: Microsoft Security Essentials *Disabled/Updated* {ABEC4DA7-E46C-2F39-81B5-AA334E5D1BDD}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((( Files Created from 2011-03-03 to 2011-04-03 )))))))))))))))))))))))))))))))
.
.
2011-04-03 02:09 . 2011-04-03 02:09 -------- d-----w- c:\users\Public\AppData\Local\temp
2011-04-03 02:09 . 2011-04-03 02:09 -------- d-----w- c:\users\Default\AppData\Local\temp
2011-04-02 23:49 . 2011-03-15 01:05 6792528 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{35924C44-AF5D-4EDF-B24A-CCCE6969989F}\mpengine.dll
2011-04-02 23:06 . 2011-03-18 17:53 142296 ----a-w- c:\program files\Mozilla Firefox\components\browsercomps.dll
2011-04-02 23:06 . 2011-03-18 17:53 16856 ----a-w- c:\program files\Mozilla Firefox\plugin-container.exe
2011-04-02 23:06 . 2011-03-18 17:53 781272 ----a-w- c:\program files\Mozilla Firefox\mozsqlite3.dll
2011-04-02 23:06 . 2011-03-18 17:53 1874904 ----a-w- c:\program files\Mozilla Firefox\mozjs.dll
2011-04-02 23:06 . 2011-03-18 17:53 719832 ----a-w- c:\program files\Mozilla Firefox\mozcpp19.dll
2011-04-02 23:06 . 2011-03-18 17:53 15832 ----a-w- c:\program files\Mozilla Firefox\mozalloc.dll
2011-04-02 23:06 . 2011-03-18 17:53 728024 ----a-w- c:\program files\Mozilla Firefox\libGLESv2.dll
2011-04-02 23:06 . 2011-03-18 17:53 142296 ----a-w- c:\program files\Mozilla Firefox\libEGL.dll
2011-04-02 23:06 . 2011-03-18 17:53 1893336 ----a-w- c:\program files\Mozilla Firefox\d3dx9_42.dll
2011-04-02 23:06 . 2011-03-18 17:53 1975768 ----a-w- c:\program files\Mozilla Firefox\D3DCompiler_42.dll
2011-04-02 22:26 . 2011-04-02 22:26 100480 ----a-w- C:\pwdcrkod.sys
2011-04-02 21:39 . 2011-04-02 21:39 -------- d-----w- c:\program files\Common Files\Adobe
2011-04-02 21:29 . 2011-04-02 21:29 -------- d-----w- c:\windows\system32\SPReview
2011-04-02 21:21 . 2011-04-02 21:21 -------- d-----w- c:\program files\iPod
2011-04-02 21:21 . 2011-04-02 21:22 -------- d-----w- c:\program files\iTunes
2011-04-02 21:18 . 2011-04-02 21:18 -------- d-----w- c:\program files\Apple Software Update
2011-04-02 21:14 . 2011-04-02 21:12 439632 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\NISBackup\gapaengine.dll
2011-04-02 21:13 . 2011-04-02 21:12 439632 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{657C8FB4-3426-4BEE-B302-F579CB850754}\gapaengine.dll
2011-04-02 21:13 . 2011-01-13 05:41 5890896 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
2011-04-02 21:09 . 2011-03-23 14:11 6792528 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{A0EA2FAD-7C68-4045-AB1C-8D5F25A7A58B}\mpengine.dll
2011-04-02 20:40 . 2011-04-02 20:40 -------- d-----w- c:\windows\Temp382200E1-249B-A2C7-A08B-1EC29D429968-Signatures
2011-04-02 20:40 . 2011-04-02 20:51 -------- d-----w- c:\program files\Microsoft Security Client
2011-04-02 20:38 . 2011-04-02 20:38 11776 ----a-w- c:\program files\Mozilla Firefox\plugins\nprjplug.dll
2011-04-02 20:38 . 2010-04-09 07:24 240008 ----a-w- c:\windows\system32\drivers\netio.sys
2011-04-02 20:37 . 2011-04-02 20:37 150712 ----a-w- c:\program files\Mozilla Firefox\plugins\nppl3260.dll
2011-04-02 20:37 . 2011-04-02 20:37 100864 ----a-w- c:\program files\Mozilla Firefox\plugins\nprpjplug.dll
2011-04-02 20:24 . 2011-04-02 20:24 -------- d-----w- c:\users\Laci Ryan\AppData\Local\Secunia PSI
2011-04-02 20:23 . 2011-04-02 20:23 -------- d-----w- c:\program files\Secunia
2011-04-02 19:52 . 2011-04-02 19:55 -------- d-----w- c:\users\Laci Ryan\New folder
2011-03-09 21:49 . 2011-02-19 05:32 1074176 ----a-w- c:\windows\system32\DWrite.dll
2011-03-09 21:49 . 2011-02-19 05:33 802304 ----a-w- c:\windows\system32\FntCache.dll
2011-03-09 21:49 . 2011-02-19 05:32 739840 ----a-w- c:\windows\system32\d2d1.dll
2011-03-09 21:49 . 2010-12-23 05:28 642048 ----a-w- c:\windows\system32\CPFilters.dll
2011-03-09 21:49 . 2010-12-23 05:28 534528 ----a-w- c:\windows\system32\EncDec.dll
2011-03-09 21:49 . 2010-12-23 05:28 850432 ----a-w- c:\windows\system32\sbe.dll
2011-03-09 21:49 . 2010-12-23 05:24 199680 ----a-w- c:\windows\system32\mpg2splt.ax
2011-03-09 21:49 . 2010-12-18 05:30 2690560 ----a-w- c:\windows\system32\mstscax.dll
2011-03-09 21:49 . 2010-12-18 05:26 1034240 ----a-w- c:\windows\system32\mstsc.exe
2011-03-09 21:43 . 2011-03-09 21:43 -------- d-----w- c:\users\Laci Ryan\AppData\Roaming\Amazon
2011-03-09 21:40 . 2011-03-09 21:40 -------- d-----w- c:\program files\Amazon
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-04-02 20:39 . 2010-05-18 20:15 472808 ----a-w- c:\windows\system32\deployJava1.dll
2011-04-02 20:36 . 2009-02-19 18:25 499712 ----a-w- c:\windows\system32\msvcp71.dll
2011-04-02 20:36 . 2009-02-19 18:25 348160 ----a-w- c:\windows\system32\msvcr71.dll
2011-02-03 05:45 . 2011-02-10 20:46 219008 ----a-w- c:\windows\system32\drivers\dxgmms1.sys
2011-02-02 22:11 . 2009-10-04 17:37 222080 ------w- c:\windows\system32\MpSigStub.exe
2011-01-07 07:31 . 2011-02-22 23:32 442880 ----a-w- c:\windows\system32\XpsPrint.dll
2011-01-07 07:31 . 2011-02-22 23:32 288256 ----a-w- c:\windows\system32\XpsGdiConverter.dll
2011-01-07 07:27 . 2011-02-10 20:46 34304 ----a-w- c:\windows\system32\atmlib.dll
2011-01-07 05:33 . 2011-02-10 20:46 294400 ----a-w- c:\windows\system32\atmfd.dll
2011-01-05 05:37 . 2011-02-10 20:46 428032 ----a-w- c:\windows\system32\vbscript.dll
2011-01-05 03:37 . 2011-02-10 20:46 2329088 ----a-w- c:\windows\system32\win32k.sys
2011-03-18 17:53 . 2011-04-02 23:06 142296 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll
2009-11-29 05:05 . 2009-11-29 05:05 119808 ----a-w- c:\program files\mozilla firefox\components\GoogleDesktopMozilla.dll
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\egisPSDP]
@= "{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA} "
[HKEY_CLASSES_ROOT\CLSID\{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}]
2008-10-27 19:05 40496 ----a-w- c:\program files\EgisTec\MyWinLocker 3\x86\PSDProtect.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ISUSPM "= "c:\program files\Common Files\InstallShield\UpdateService\ISUSPM.exe" [2006-09-11 218032]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"TkBellExe "= "c:\program files\real\realplayer\Update\realsched.exe" [2011-04-02 273544]
"MSC "= "c:\program files\Microsoft Security Client\msseces.exe" [2010-11-30 997408]
"QuickTime Task "= "c:\program files\QuickTime\QTTask.exe" [2010-11-29 421888]
"iTunesHelper "= "c:\program files\iTunes\iTunesHelper.exe" [2011-03-07 421160]
"Adobe Reader Speed Launcher "= "c:\program files\Adobe\Reader 10.0\Reader\Reader_sl.exe" [2011-01-30 35736]
"Adobe ARM "= "c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-11-10 932288]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Secunia PSI Tray.lnk - c:\program files\Secunia\PSI\psi_tray.exe [2011-1-10 291896]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin "= 5 (0x5)
"ConsentPromptBehaviorUser "= 3 (0x3)
"EnableUIADesktopToggle "= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs "=c:\progra~1\Google\GOOGLE~1\GoogleDesktopNetwork3.dll
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@= "Service "
.
[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^McAfee Security Scan.lnk]
backup=c:\windows\pss\McAfee Security Scan.lnk.CommonStartup
backupExtension=.CommonStartup
path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\McAfee Security Scan.lnk
.
[HKLM\~\startupfolder\C:^Users^Laci Ryan^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^LimeWire On Startup.lnk]
path=c:\users\Laci Ryan\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LimeWire On Startup.lnk
backup=c:\windows\pss\LimeWire On Startup.lnk.Startup
backupExtension=.Startup
.
[HKLM\~\startupfolder\C:^Users^Laci Ryan^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^OneNote 2007 Screen Clipper and Launcher.lnk]
backup=c:\windows\pss\OneNote 2007 Screen Clipper and Launcher.lnk.Startup
backupExtension=.Startup
path=c:\users\Laci Ryan\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2007 Screen Clipper and Launcher.lnk
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Windows Defender]
%ProgramFiles%\Windows Defender\MSASCui.exe -hide [X]
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Acer ePower Management]
2009-08-27 01:07 494112 ----a-w- c:\program files\Acer\Acer PowerSmart Manager\ePowerTrayLauncher.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
2010-11-10 16:49 932288 ----a-w- c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AppleSyncNotifier]
2010-12-14 22:17 47904 ----a-w- c:\program files\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ArcadeDeluxeAgent]
2009-02-19 18:25 156968 ----a-w- c:\program files\Acer Arcade Deluxe\Acer Arcade Deluxe\ArcadeDeluxeAgent.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ArcSoft Connection Service]
2009-10-10 18:32 203264 ----a-w- c:\program files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BackupManagerTray]
2009-03-20 17:14 249600 ----a-w- c:\program files\NewTech Infosystems\Acer Backup Manager\BackupManagerTray.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CLMLServer]
2009-02-19 18:25 202024 ----a-w- c:\program files\Acer Arcade Deluxe\Acer Arcade Deluxe\Kernel\CLML\CLMLSvc.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EgisTecLiveUpdate]
2008-10-27 22:09 199464 ----a-w- c:\program files\EgisTec Egis Software Update\EgisUpdate.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ehTray.exe]
2009-07-14 01:14 144384 ----a-w- c:\windows\ehome\ehtray.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Desktop Search]
2009-11-29 05:05 30192 ----a-w- c:\program files\Google\Google Desktop Search\GoogleDesktop.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Update]
2010-10-19 18:30 136176 ----atw- c:\users\Laci Ryan\AppData\Local\Google\Update\GoogleUpdate.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HotKeysCmds]
2010-08-26 00:45 171032 ----a-w- c:\windows\System32\hkcmd.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IAAnotif]
2008-12-04 20:00 186904 ----a-w- c:\program files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IgfxTray]
2010-08-26 00:45 136216 ----a-w- c:\windows\System32\igfxtray.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSPM]
2006-09-11 16:56 218032 ----a-w- c:\program files\Common Files\InstallShield\UpdateService\ISUSPM.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
2011-03-07 19:33 421160 ----a-w- c:\program files\iTunes\iTunesHelper.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LManager]
2009-08-18 09:42 1157640 ----a-w- c:\program files\Launch Manager\LManager.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Malwarebytes Anti-Malware (reboot)]
2010-12-20 22:08 963976 ----a-w- c:\program files\Malwarebytes' Anti-Malware\mbam.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Malwarebytes' Anti-Malware (reboot)]
2010-12-20 22:08 963976 ----a-w- c:\program files\Malwarebytes' Anti-Malware\mbam.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Monitor]
2009-11-10 15:14 443728 ----a-w- c:\program files\LeapFrog\LeapFrog Connect\Monitor.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\mwlDaemon]
2008-10-27 19:05 346672 ----a-w- c:\program files\EgisTec\MyWinLocker 3\x86\mwlDaemon.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NACAgentUI]
2010-02-05 21:29 454400 ----a-w- c:\program files\Cisco\Cisco NAC Agent\NACAgentUI.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Persistence]
2010-08-26 00:45 170520 ----a-w- c:\windows\System32\igfxpers.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PlayMovie]
2009-02-06 20:49 173288 ----a-w- c:\program files\Acer Arcade Deluxe\PlayMovie\PMVService.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PLFSetI]
2008-07-30 00:29 200704 ----a-w- c:\windows\PLFSetI.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2010-11-29 22:38 421888 ----a-w- c:\program files\QuickTime\QTTask.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RESTART_STICKY_NOTES]
2009-07-14 01:14 354304 ----a-w- c:\windows\System32\StikyNot.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RtHDVCpl]
2009-02-28 18:13 6957600 ------w- c:\program files\Realtek\Audio\HDA\RtHDVCpl.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype]
2010-12-03 21:46 14944136 ----a-r- c:\program files\Skype\Phone\Skype.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skytel]
2009-02-28 18:14 1833504 ------w- c:\program files\Realtek\Audio\HDA\SkyTel.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2010-02-18 15:43 248040 ----a-w- c:\program files\Common Files\Java\Java Update\jusched.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SynTPEnh]
2009-02-06 02:32 1430824 ----a-w- c:\program files\Synaptics\SynTP\SynTPEnh.exe
.
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [2010-02-17 135664]
R3 FlyUsb;FLY Fusion;c:\windows\system32\DRIVERS\FlyUsb.sys [2009-11-10 19456]
R3 GoogleDesktopManager-110309-193829;Google Desktop Manager 5.9.911.3589;c:\program files\Google\Google Desktop Search\GoogleDesktop.exe [2009-11-29 30192]
R3 MpNWMon;Microsoft Malware Protection Network Driver;c:\windows\system32\DRIVERS\MpNWMon.sys [2010-10-25 43392]
R3 netr28;Ralink 802.11n Wireless Driver for Windows Vista;c:\windows\system32\DRIVERS\netr28.sys [2009-01-18 517120]
R3 NisDrv;Microsoft Network Inspection System;c:\windows\system32\DRIVERS\NisDrvWFP.sys [2010-10-25 54144]
R3 NisSrv;Microsoft Network Inspection;c:\program files\Microsoft Security Client\Antimalware\NisSrv.exe [2010-11-11 206360]
R3 NTIBackupSvc;NTI Backup Now 5 Backup Service;c:\program files\NewTech Infosystems\NTI Backup Now 5\BackupSvc.exe [2008-09-23 50424]
R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [2010-05-14 1343400]
S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [2009-07-13 48128]
S2 CLHNService;CLHNService;c:\program files\Acer Arcade Deluxe\HomeMedia\Kernel\DMP\CLHNService.exe [2008-12-18 75048]
S2 ePowerSvc;Acer ePower Service;c:\program files\Acer\Acer PowerSmart Manager\ePowerSvc.exe [2009-08-27 690720]
S2 mwlPSDFilter;mwlPSDFilter;c:\windows\system32\DRIVERS\mwlPSDFilter.sys [2008-10-09 19504]
S2 mwlPSDNServ;mwlPSDNServ;c:\windows\system32\DRIVERS\mwlPSDNServ.sys [2008-10-09 16432]
S2 mwlPSDVDisk;mwlPSDVDisk;c:\windows\system32\DRIVERS\mwlPSDVDisk.sys [2008-10-09 59952]
S2 MWLService;MyWinLocker Service;c:\program files\EgisTec\MyWinLocker 3\x86\\MWLService.exe [2008-10-27 306736]
S2 NACAgent;Cisco NAC Agent;c:\program files\Cisco\Cisco NAC Agent\NACAgent.exe [2010-02-05 742144]
S2 NTI IScheduleSvc;NTI IScheduleSvc;c:\program files\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe [2009-03-20 44800]
S2 NTISchedulerSvc;NTI Backup Now 5 Scheduler Service;c:\program files\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe [2008-09-23 144632]
S2 Secunia PSI Agent;Secunia PSI Agent;c:\program files\Secunia\PSI\PSIA.exe [2011-01-10 993848]
S2 Secunia Update Agent;Secunia Update Agent;c:\program files\Secunia\PSI\sua.exe [2011-01-10 399416]
S3 IntcHdmiAddService;Intel(R) High Definition Audio HDMI;c:\windows\system32\drivers\IntcHdmi.sys [2008-09-21 112128]
S3 JMCR;JMCR;c:\windows\system32\DRIVERS\jmcr.sys [2009-05-07 119256]
S3 PSI;PSI;c:\windows\system32\DRIVERS\psi_mf.sys [2010-09-01 15544]
.
.
--- Other Services/Drivers In Memory ---
.
*Deregistered* - aswFsBlk
*Deregistered* - aswMonFlt
*Deregistered* - aswRdr
*Deregistered* - aswSP
*Deregistered* - aswTdi
*Deregistered* - SASKUTIL
.
Contents of the 'Scheduled Tasks' folder
.
2011-04-03 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-02-17 01:02]
.
2011-04-03 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-02-17 01:02]
.
2011-04-02 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-358480402-2928177412-2907725623-1000Core.job
- c:\users\Laci Ryan\AppData\Local\Google\Update\GoogleUpdate.exe [2010-12-16 18:30]
.
2011-04-03 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-358480402-2928177412-2907725623-1000UA.job
- c:\users\Laci Ryan\AppData\Local\Google\Update\GoogleUpdate.exe [2010-12-16 18:30]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://my.yahoo.com/
mStart Page = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0409&s=2&o=vp32&d=0509&m=aspire_4736z
uInternet Settings,ProxyOverride = *.local
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000
IE: Google Sidewiki... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_950DF09FAB501E03.dll/cmsidewiki.html
FF - ProfilePath - c:\users\Laci Ryan\AppData\Roaming\Mozilla\Firefox\Profiles\f08maq6d.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://www.yahoo.com/?ilc=1
.
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@= "FlashBroker "
"LocalizedString "= "@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil10o_ActiveX.exe,-101 "
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled "=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@= "c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil10o_ActiveX.exe "
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@= "{FAB3E735-69C7-453B-A446-B6823C6DF1C9} "
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@= "IFlashBroker4 "
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@= "{00020424-0000-0000-C000-000000000046} "
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@= "{FAB3E735-69C7-453B-A446-B6823C6DF1C9} "
"Version "= "1.0 "
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial "=dword:00000000
"MSCurrentCountry "=dword:000000b5
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial "=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial "=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
--------------------- DLLs Loaded Under Running Processes ---------------------
.
- - - - - - - > 'Explorer.exe'(4464)
c:\program files\EgisTec\MyWinLocker 3\x86\psdprotect.dll
c:\program files\EgisTec\MyWinLocker 3\x86\sysenv.dll
c:\program files\EgisTec\MyWinLocker 3\x86\mwlUI.dll
c:\program files\EgisTec\MyWinLocker 3\x86\GDIExtendCtrl.dll
c:\program files\EgisTec\MyWinLocker 3\x86\mwlOP.dll
c:\program files\EgisTec\MyWinLocker 3\x86\CryptoAPI.dll
c:\program files\EgisTec\MyWinLocker 3\x86\ShowErrMsg.dll
.
Completion time: 2011-04-02 22:11:27
ComboFix-quarantined-files.txt 2011-04-03 02:11
ComboFix2.txt 2011-04-02 23:45
ComboFix3.txt 2011-04-02 23:25
ComboFix4.txt 2009-10-14 20:03
.
Pre-Run: 176,759,955,456 bytes free
Post-Run: 176,374,927,360 bytes free
.
- - End Of File - - 46DD1BD0EC59A00FF919F00073104E17

 

OTL logfile created on: 4/2/2011 10:35:44 PM - Run 1
OTL by OldTimer - Version 3.2.22.3 Folder = C:\Users\Laci Ryan\Desktop
Home Premium Edition (Version = 6.1.7600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7600.16385)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

3.00 Gb Total Physical Memory | 2.00 Gb Available Physical Memory | 56.00% Memory free
6.00 Gb Paging File | 5.00 Gb Available in Paging File | 79.00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 220.88 Gb Total Space | 162.99 Gb Free Space | 73.79% Space Free | Partition Type: NTFS

Computer Name: LACIRYAN-PC | User Name: Laci Ryan | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2011/04/02 22:33:21 | 000,580,608 | ---- | M] (OldTimer Tools) -- C:\Users\Laci Ryan\Desktop\OTL.exe
PRC - [2011/04/02 16:36:49 | 000,273,544 | ---- | M] (RealNetworks, Inc.) -- C:\Program Files\real\realplayer\Update\realsched.exe
PRC - [2011/04/02 16:35:03 | 000,235,168 | ---- | M] (Adobe Systems, Inc.) -- C:\Windows\System32\Macromed\Flash\FlashUtil10o_ActiveX.exe
PRC - [2011/01/10 10:24:20 | 000,993,848 | ---- | M] (Secunia) -- C:\Program Files\Secunia\PSI\psia.exe
PRC - [2011/01/10 10:24:20 | 000,399,416 | ---- | M] (Secunia) -- C:\Program Files\Secunia\PSI\sua.exe
PRC - [2011/01/10 10:24:20 | 000,291,896 | ---- | M] (Secunia) -- C:\Program Files\Secunia\PSI\psi_tray.exe
PRC - [2010/11/30 13:20:36 | 000,997,408 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Microsoft Security Client\msseces.exe
PRC - [2010/11/11 12:26:40 | 000,011,736 | ---- | M] (Microsoft Corporation) -- c:\Program Files\Microsoft Security Client\Antimalware\MsMpEng.exe
PRC - [2010/02/05 17:29:12 | 000,454,400 | ---- | M] (Cisco Systems, Inc.) -- C:\Program Files\Cisco\Cisco NAC Agent\NACAgentUI.exe
PRC - [2010/02/05 17:28:26 | 000,742,144 | ---- | M] (Cisco Systems, Inc.) -- C:\Program Files\Cisco\Cisco NAC Agent\NACAgent.exe
PRC - [2009/11/10 10:28:06 | 001,131,808 | ---- | M] (LeapFrog Enterprises, Inc.) -- C:\Program Files\LeapFrog\LeapFrog Connect\CommandService.exe
PRC - [2009/10/31 01:45:39 | 002,614,272 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe
PRC - [2009/09/28 10:42:50 | 000,109,056 | ---- | M] (ArcSoft Inc.) -- C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe
PRC - [2009/08/26 21:07:22 | 000,690,720 | ---- | M] (Acer Incorporated) -- C:\Program Files\Acer\Acer PowerSmart Manager\ePowerSvc.exe
PRC - [2009/07/13 21:14:42 | 000,049,152 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\taskhost.exe
PRC - [2009/03/20 13:14:50 | 000,044,800 | ---- | M] (NewTech Infosystems, Inc.) -- C:\Program Files\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe
PRC - [2008/12/18 16:51:34 | 000,075,048 | ---- | M] () -- C:\Program Files\Acer Arcade Deluxe\HomeMedia\Kernel\DMP\CLHNService.exe
PRC - [2008/12/04 16:00:26 | 000,354,840 | ---- | M] (Intel Corporation) -- C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTmon.exe
PRC - [2008/10/27 15:05:28 | 000,306,736 | ---- | M] (EgisTec Inc.) -- C:\Program Files\EgisTec\MyWinLocker 3\x86\MWLService.exe
PRC - [2008/08/26 02:02:24 | 000,014,336 | ---- | M] (Agere Systems) -- C:\Program Files\LSI SoftModem\agrsmsvc.exe


========== Modules (SafeList) ==========

MOD - [2011/04/02 22:33:21 | 000,580,608 | ---- | M] (OldTimer Tools) -- C:\Users\Laci Ryan\Desktop\OTL.exe
MOD - [2010/08/21 01:21:32 | 001,680,896 | ---- | M] (Microsoft Corporation) -- C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7600.16661_none_420fe3fa2b8113bd\comctl32.dll


========== Win32 Services (SafeList) ==========

SRV - [2011/01/10 10:24:20 | 000,993,848 | ---- | M] (Secunia) [Auto | Running] -- C:\Program Files\Secunia\PSI\PSIA.exe -- (Secunia PSI Agent)
SRV - [2011/01/10 10:24:20 | 000,399,416 | ---- | M] (Secunia) [Auto | Running] -- C:\Program Files\Secunia\PSI\sua.exe -- (Secunia Update Agent)
SRV - [2010/11/11 12:26:42 | 000,206,360 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- c:\Program Files\Microsoft Security Client\Antimalware\NisSrv.exe -- (NisSrv)
SRV - [2010/11/11 12:26:40 | 000,011,736 | ---- | M] (Microsoft Corporation) [Auto | Running] -- c:\Program Files\Microsoft Security Client\Antimalware\MsMpEng.exe -- (MsMpSvc)
SRV - [2010/05/14 13:05:19 | 001,343,400 | ---- | M] (Microsoft Corporation) [Unknown | Stopped] -- C:\Windows\System32\Wat\WatAdminSvc.exe -- (WatAdminSvc)
SRV - [2010/02/05 17:28:26 | 000,742,144 | ---- | M] (Cisco Systems, Inc.) [Auto | Running] -- C:\Program Files\Cisco\Cisco NAC Agent\NACAgent.exe -- (NACAgent)
SRV - [2009/11/10 10:28:06 | 001,131,808 | ---- | M] (LeapFrog Enterprises, Inc.) [Auto | Running] -- C:\Program Files\LeapFrog\LeapFrog Connect\CommandService.exe -- (LeapFrog Connect Device Service)
SRV - [2009/09/28 10:42:50 | 000,109,056 | ---- | M] (ArcSoft Inc.) [Auto | Running] -- C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe -- (ACDaemon)
SRV - [2009/08/26 21:07:22 | 000,690,720 | ---- | M] (Acer Incorporated) [Auto | Running] -- C:\Program Files\Acer\Acer PowerSmart Manager\ePowerSvc.exe -- (ePowerSvc)
SRV - [2009/07/13 21:16:13 | 000,025,088 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\sensrsvc.dll -- (SensrSvc)
SRV - [2009/07/13 21:15:41 | 000,680,960 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)
SRV - [2009/03/20 13:14:50 | 000,044,800 | ---- | M] (NewTech Infosystems, Inc.) [Auto | Running] -- C:\Program Files\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe -- (NTI IScheduleSvc)
SRV - [2008/12/18 16:51:34 | 000,075,048 | ---- | M] () [Auto | Running] -- C:\Program Files\Acer Arcade Deluxe\HomeMedia\Kernel\DMP\CLHNService.exe -- (CLHNService)
SRV - [2008/12/04 16:00:26 | 000,354,840 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTmon.exe -- (IAANTMON) Intel(R)
SRV - [2008/10/27 15:05:28 | 000,306,736 | ---- | M] () [Auto | Running] -- C:\Program Files\EgisTec\MyWinLocker 3\x86\\MWLService.exe -- (MWLService)
SRV - [2008/08/26 02:02:24 | 000,014,336 | ---- | M] (Agere Systems) [Auto | Running] -- C:\Program Files\LSI SoftModem\agrsmsvc.exe -- (AgereModemAudio)


========== Driver Services (SafeList) ==========

DRV - [2010/10/24 21:25:38 | 000,054,144 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\NisDrvWFP.sys -- (NisDrv)
DRV - [2010/10/24 21:25:38 | 000,043,392 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\MpNWMon.sys -- (MpNWMon)
DRV - [2010/09/01 04:30:58 | 000,015,544 | ---- | M] (Secunia) [File_System | On_Demand | Running] -- C:\Windows\System32\drivers\psi_mf.sys -- (PSI)
DRV - [2009/11/10 10:27:06 | 000,019,456 | ---- | M] (LeapFrog) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\FlyUsb.sys -- (FlyUsb)
DRV - [2009/10/05 17:31:50 | 001,221,632 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\athr.sys -- (athr)
DRV - [2009/08/23 06:06:38 | 000,048,640 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\L1E62x86.sys -- (L1E)
DRV - [2009/07/13 19:51:11 | 000,034,944 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\winusb.sys -- (WinUsb)
DRV - [2009/05/07 05:16:54 | 000,119,256 | ---- | M] (JMicron Technology Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\jmcr.sys -- (JMCR)
DRV - [2009/01/20 04:36:34 | 001,205,312 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\AGRSM.sys -- (AgereSoftModem)
DRV - [2008/10/09 19:47:12 | 000,059,952 | ---- | M] (Egis Incorporated.) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\mwlPSDVDisk.sys -- (mwlPSDVDisk)
DRV - [2008/10/09 19:47:12 | 000,019,504 | ---- | M] (Egis Incorporated.) [File_System | Auto | Running] -- C:\Windows\System32\drivers\mwlPSDFilter.sys -- (mwlPSDFilter)
DRV - [2008/10/09 19:47:12 | 000,016,432 | ---- | M] (Egis Incorporated.) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\mwlPSDNserv.sys -- (mwlPSDNServ)
DRV - [2008/09/21 17:49:36 | 000,112,128 | ---- | M] (Intel(R) Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\IntcHdmi.sys -- (IntcHdmiAddService) Intel(R)
DRV - [2006/11/10 15:05:00 | 000,018,688 | ---- | M] (Arcsoft, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\afc.sys -- (Afc)
DRV - [2006/11/02 09:27:36 | 000,020,112 | ---- | M] (Dritek System Inc.) [Kernel | System | Running] -- C:\Program Files\Launch Manager\DPortIO.sys -- (DritekPortIO)
DRV - [2005/06/24 18:36:16 | 000,039,036 | ---- | M] (LG Electronics Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\lgusbmodem.sys -- (USBModem)
DRV - [2005/05/26 11:01:36 | 000,038,144 | ---- | M] (LG Electronics Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\lgusbdiag.sys -- (UsbDiag)
DRV - [2005/05/26 11:01:18 | 000,021,344 | ---- | M] (LG Electronics Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\lgusbbus.sys -- (usbbus)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://homepage.acer.com/rdr.aspx?b=ACAW&l=0409&s=2&o=vp32&d=0509&m=aspire_4736z


IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0



IE - HKU\S-1-5-21-358480402-2928177412-2907725623-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = http://global.acer.com [binary data]
IE - HKU\S-1-5-21-358480402-2928177412-2907725623-1000\SOFTWARE\Microsoft\Internet Explorer\Main,SearchDefaultBranded = 1
IE - HKU\S-1-5-21-358480402-2928177412-2907725623-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://my.yahoo.com/
IE - HKU\S-1-5-21-358480402-2928177412-2907725623-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Restore = http://my.yahoo.com/
IE - HKU\S-1-5-21-358480402-2928177412-2907725623-1000\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKU\S-1-5-21-358480402-2928177412-2907725623-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-21-358480402-2928177412-2907725623-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

========== FireFox ==========

FF - prefs.js..browser.search.defaultengine: "Ask.com "
FF - prefs.js..browser.search.defaultenginename: "Ask.com "
FF - prefs.js..browser.search.order.1: "Ask.com "
FF - prefs.js..browser.search.selectedEngine: "Google "
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "http://www.yahoo.com/?ilc=1 "
FF - prefs.js..extensions.enabledItems: {ABDE892B-13A8-4d1b-88E6-365A6E755758}:14.0.2
FF - prefs.js..extensions.enabledItems: {AB2CE124-6272-4b12-94A9-7303C7397BD1}:5.0.0.6906
FF - prefs.js..extensions.enabledItems: browserhighlighter@ebay.com:1.0.14908
FF - prefs.js..extensions.enabledItems: {a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7}:20100503
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}:6.0.24

FF - HKLM\software\mozilla\Firefox\Extensions\\{ABDE892B-13A8-4d1b-88E6-365A6E755758}: C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext [2011/04/02 16:37:37 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 4.0\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2011/04/02 19:06:19 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 4.0\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2011/04/02 19:06:18 | 000,000,000 | ---D | M]

[2010/02/06 19:08:03 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Laci Ryan\AppData\Roaming\Mozilla\Extensions
[2010/02/06 19:08:03 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Laci Ryan\AppData\Roaming\Mozilla\Extensions\mozswing@mozswing.org
[2011/04/02 19:06:40 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Laci Ryan\AppData\Roaming\Mozilla\Firefox\Profiles\f08maq6d.default\extensions
[2010/11/22 20:28:55 | 000,002,425 | ---- | M] () -- C:\Users\Laci Ryan\AppData\Roaming\Mozilla\Firefox\Profiles\f08maq6d.default\searchplugins\askcom.xml
[2010/10/24 14:24:15 | 000,001,919 | ---- | M] () -- C:\Users\Laci Ryan\AppData\Roaming\Mozilla\Firefox\Profiles\f08maq6d.default\searchplugins\bing-zugo.xml
[2011/04/02 19:06:19 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions
[2011/01/06 10:21:57 | 000,000,000 | ---D | M] (Skype extension) -- C:\Program Files\Mozilla Firefox\extensions\{AB2CE124-6272-4b12-94A9-7303C7397BD1}
[2011/04/02 16:39:59 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}
[2011/04/02 19:04:34 | 000,000,000 | ---D | M] (The Browser Highlighter) -- C:\Program Files\Mozilla Firefox\extensions\browserhighlighter@ebay.com
File not found (No name found) --
[2011/04/02 16:37:37 | 000,000,000 | ---D | M] (RealPlayer Browser Record Plugin) -- C:\PROGRAMDATA\REAL\REALPLAYER\BROWSERRECORDPLUGIN\FIREFOX\EXT
() (No name found) -- C:\USERS\LACI RYAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\F08MAQ6D.DEFAULT\EXTENSIONS\{A0D7CCB3-214D-498B-B4AA-0E8FDA9A7BF7}.XPI
[2009/11/13 14:01:09 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V3.5\WINDOWS PRESENTATION FOUNDATION\DOTNETASSISTANTEXTENSION
[2011/03/18 13:53:24 | 000,142,296 | ---- | M] (Mozilla Foundation) -- C:\Program Files\Mozilla Firefox\components\browsercomps.dll
[2011/04/02 16:39:45 | 000,472,808 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\Mozilla Firefox\plugins\npdeployJava1.dll
[2010/01/01 04:00:00 | 000,002,252 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\bing.xml

Hosts file not found
O2 - BHO: (RealPlayer Download and Record Plugin for Internet Explorer) - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll (RealPlayer)
O4 - HKLM..\Run: [Adobe Reader Speed Launcher] C:\Program Files\Adobe\Reader 10.0\Reader\Reader_sl.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [MSC] c:\Program Files\Microsoft Security Client\msseces.exe (Microsoft Corporation)
O4 - HKLM..\Run: [TkBellExe] c:\program files\real\realplayer\Update\realsched.exe (RealNetworks, Inc.)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-358480402-2928177412-2907725623-1000\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-358480402-2928177412-2907725623-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O15 - HKU\S-1-5-21-358480402-2928177412-2907725623-1000\..Trusted Domains: localhost ([]http in Local intranet)
O15 - HKU\S-1-5-21-358480402-2928177412-2907725623-1000\..Trusted Ranges: GD ([http] in Local intranet)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 1.6.0_24)
O16 - DPF: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 1.6.0_24)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 1.6.0_24)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.0.1
O18 - Protocol\Handler\linkscanner {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - Reg Error: Key error. File not found
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O20 - AppInit_DLLs: (C:\PROGRA~1\Google\GOOGLE~1\GoogleDesktopNetwork3.dll) - C:\Program Files\Google\Google Desktop Search\GoogleDesktopNetwork3.dll (Google)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O24 - Desktop WallPaper: C:\Users\Laci Ryan\Pictures\frame pics\Easter 2009 071.jpg
O24 - Desktop BackupWallPaper: C:\Users\Laci Ryan\Pictures\frame pics\Easter 2009 071.jpg
O28 - HKLM ShellExecuteHooks: {AEB6717E-7E19-11d0-97EE-00C04FD91972} - Reg Error: Key error. File not found
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009/06/10 17:42:20 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*

NetSvcs: FastUserSwitchingCompatibility - File not found
NetSvcs: Ias - File not found
NetSvcs: Nla - File not found
NetSvcs: Ntmssvc - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: SRService - File not found
NetSvcs: WmdmPmSp - File not found
NetSvcs: LogonHours - File not found
NetSvcs: PCAudit - File not found
NetSvcs: helpsvc - File not found
NetSvcs: uploadmgr - File not found

Drivers32: msacm.l3acm - C:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: MSVideo8 - C:\Windows\System32\vfwwdm32.dll (Microsoft Corporation)
Drivers32: vidc.cvid - C:\Windows\System32\iccvid.dll (Radius Inc.)


========== Files/Folders - Created Within 30 Days ==========

[2011/04/02 22:33:18 | 000,580,608 | ---- | C] (OldTimer Tools) -- C:\Users\Laci Ryan\Desktop\OTL.exe
[2011/04/02 22:14:29 | 000,000,000 | --SD | C] -- C:\ComboFix
[2011/04/02 22:11:29 | 000,000,000 | ---D | C] -- C:\Windows\temp
[2011/04/02 22:10:18 | 000,000,000 | -HSD | C] -- C:\$RECYCLE.BIN
[2011/04/02 22:03:24 | 000,212,480 | ---- | C] (SteelWerX) -- C:\Windows\SWXCACLS.exe
[2011/04/02 19:16:19 | 000,161,792 | ---- | C] (SteelWerX) -- C:\Windows\SWREG.exe
[2011/04/02 19:16:19 | 000,136,704 | ---- | C] (SteelWerX) -- C:\Windows\SWSC.exe
[2011/04/02 19:10:53 | 000,000,000 | ---D | C] -- C:\Qoobox
[2011/04/02 18:26:42 | 000,100,480 | ---- | C] (GMER) -- C:\pwdcrkod.sys
[2011/04/02 17:39:29 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Adobe
[2011/04/02 17:29:35 | 000,000,000 | ---D | C] -- C:\Windows\System32\SPReview
[2011/04/02 17:22:32 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes
[2011/04/02 17:21:36 | 000,000,000 | ---D | C] -- C:\Program Files\iPod
[2011/04/02 17:21:35 | 000,000,000 | ---D | C] -- C:\Program Files\iTunes
[2011/04/02 17:18:33 | 000,000,000 | ---D | C] -- C:\Program Files\Apple Software Update
[2011/04/02 17:17:03 | 000,000,000 | ---D | C] -- C:\Config.Msi
[2011/04/02 16:40:44 | 000,000,000 | ---D | C] -- C:\Windows\Temp382200E1-249B-A2C7-A08B-1EC29D429968-Signatures
[2011/04/02 16:40:11 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft Security Client
[2011/04/02 16:36:54 | 000,272,896 | ---- | C] (Progressive Networks) -- C:\Windows\System32\pncrt.dll
[2011/04/02 16:24:06 | 000,000,000 | ---D | C] -- C:\Users\Laci Ryan\AppData\Local\Secunia PSI
[2011/04/02 16:23:58 | 000,000,000 | ---D | C] -- C:\Program Files\Secunia
[2011/04/02 15:52:57 | 000,000,000 | ---D | C] -- C:\Users\Laci Ryan\New folder
[2011/03/09 17:43:51 | 000,000,000 | ---D | C] -- C:\Users\Laci Ryan\AppData\Roaming\Amazon
[2011/03/09 17:40:58 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Amazon
[2011/03/09 17:40:56 | 000,000,000 | ---D | C] -- C:\Program Files\Amazon
[2010/08/25 19:59:08 | 000,004,096 | ---- | C] ( ) -- C:\Windows\System32\IGFXDEVLib.dll
[2009/05/22 20:59:40 | 000,049,152 | ---- | C] ( ) -- C:\Windows\Interop.IWshRuntimeLibrary.dll
[2 C:\Users\Laci Ryan\Documents\*.tmp files -> C:\Users\Laci Ryan\Documents\*.tmp -> ]
[1 C:\Users\Laci Ryan\Desktop\*.tmp files -> C:\Users\Laci Ryan\Desktop\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2011/04/02 22:35:06 | 000,000,886 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2011/04/02 22:33:21 | 000,580,608 | ---- | M] (OldTimer Tools) -- C:\Users\Laci Ryan\Desktop\OTL.exe
[2011/04/02 22:20:23 | 000,011,104 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2011/04/02 22:20:23 | 000,011,104 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2011/04/02 22:17:32 | 000,626,278 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2011/04/02 22:17:32 | 000,107,522 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2011/04/02 22:13:14 | 000,000,882 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2011/04/02 22:13:02 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2011/04/02 22:12:57 | 2360,848,384 | -HS- | M] () -- C:\hiberfil.sys
[2011/04/02 22:11:00 | 000,000,924 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-358480402-2928177412-2907725623-1000UA.job
[2011/04/02 22:02:25 | 004,312,600 | R--- | M] () -- C:\Users\Laci Ryan\Desktop\ComboFix.exe
[2011/04/02 21:20:53 | 000,002,424 | ---- | M] () -- C:\Users\Laci Ryan\Desktop\Google Chrome.lnk
[2011/04/02 20:46:56 | 000,625,664 | ---- | M] () -- C:\Users\Laci Ryan\Desktop\dds.scr
[2011/04/02 20:05:32 | 000,301,568 | ---- | M] () -- C:\Users\Laci Ryan\Desktop\0cfbq2kk.exe
[2011/04/02 20:04:10 | 000,080,384 | ---- | M] () -- C:\Users\Laci Ryan\Desktop\MBRCheck.exe
[2011/04/02 19:06:43 | 000,001,849 | ---- | M] () -- C:\Users\Laci Ryan\Application Data\Microsoft\Internet Explorer\Quick Launch\Mozilla Firefox.lnk
[2011/04/02 19:06:26 | 000,001,096 | ---- | M] () -- C:\Users\Public\Desktop\Mozilla Firefox.lnk
[2011/04/02 18:26:42 | 000,100,480 | ---- | M] (GMER) -- C:\pwdcrkod.sys
[2011/04/02 17:40:04 | 000,001,993 | ---- | M] () -- C:\Users\Public\Desktop\Adobe Reader X.lnk
[2011/04/02 17:37:08 | 000,002,193 | ---- | M] () -- C:\Users\Public\Desktop\BlackBerry Desktop Software.lnk
[2011/04/02 17:26:51 | 000,002,503 | ---- | M] () -- C:\Users\Laci Ryan\Application Data\Microsoft\Internet Explorer\Quick Launch\Apple Safari.lnk
[2011/04/02 17:26:51 | 000,002,479 | ---- | M] () -- C:\Users\Public\Desktop\Safari.lnk
[2011/04/02 17:22:32 | 000,001,757 | ---- | M] () -- C:\Users\Public\Desktop\iTunes.lnk
[2011/04/02 16:51:26 | 000,001,945 | ---- | M] () -- C:\Windows\epplauncher.mif
[2011/04/02 16:51:09 | 000,001,901 | ---- | M] () -- C:\Users\Laci Ryan\Desktop\Microsoft Security Essentials.lnk
[2011/04/02 16:38:28 | 000,001,012 | ---- | M] () -- C:\Users\Public\Desktop\RealPlayer.lnk
[2011/04/02 16:36:54 | 000,272,896 | ---- | M] (Progressive Networks) -- C:\Windows\System32\pncrt.dll
[2011/04/02 16:24:01 | 000,001,068 | ---- | M] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Secunia PSI Tray.lnk
[2011/04/02 15:30:48 | 000,000,872 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-358480402-2928177412-2907725623-1000Core.job
[2 C:\Users\Laci Ryan\Documents\*.tmp files -> C:\Users\Laci Ryan\Documents\*.tmp -> ]
[1 C:\Users\Laci Ryan\Desktop\*.tmp files -> C:\Users\Laci Ryan\Desktop\*.tmp -> ]

========== Files Created - No Company Name ==========

[2011/04/02 20:46:54 | 000,625,664 | ---- | C] () -- C:\Users\Laci Ryan\Desktop\dds.scr
[2011/04/02 20:05:30 | 000,301,568 | ---- | C] () -- C:\Users\Laci Ryan\Desktop\0cfbq2kk.exe
[2011/04/02 20:04:08 | 000,080,384 | ---- | C] () -- C:\Users\Laci Ryan\Desktop\MBRCheck.exe
[2011/04/02 19:33:31 | 004,312,600 | R--- | C] () -- C:\Users\Laci Ryan\Desktop\ComboFix.exe
[2011/04/02 19:16:19 | 000,256,512 | ---- | C] () -- C:\Windows\PEV.exe
[2011/04/02 19:16:19 | 000,098,816 | ---- | C] () -- C:\Windows\sed.exe
[2011/04/02 19:16:19 | 000,089,088 | ---- | C] () -- C:\Windows\MBR.exe
[2011/04/02 19:16:19 | 000,080,412 | ---- | C] () -- C:\Windows\grep.exe
[2011/04/02 19:16:19 | 000,068,096 | ---- | C] () -- C:\Windows\zip.exe
[2011/04/02 19:06:26 | 000,001,108 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
[2011/04/02 17:40:04 | 000,002,441 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader X.lnk
[2011/04/02 17:40:04 | 000,001,993 | ---- | C] () -- C:\Users\Public\Desktop\Adobe Reader X.lnk
[2011/04/02 17:22:32 | 000,001,757 | ---- | C] () -- C:\Users\Public\Desktop\iTunes.lnk
[2011/04/02 16:51:26 | 000,001,945 | ---- | C] () -- C:\Windows\epplauncher.mif
[2011/04/02 16:51:09 | 000,001,901 | ---- | C] () -- C:\Users\Laci Ryan\Desktop\Microsoft Security Essentials.lnk
[2011/04/02 16:38:28 | 000,001,012 | ---- | C] () -- C:\Users\Public\Desktop\RealPlayer.lnk
[2011/04/02 16:24:01 | 000,001,068 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Secunia PSI Tray.lnk
[2011/04/02 16:24:01 | 000,001,031 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Secunia PSI.lnk
[2010/08/20 18:37:37 | 000,000,000 | ---- | C] () -- C:\Users\Laci Ryan\AppData\Roaming\wklnhst.dat
[2010/07/16 15:14:29 | 000,008,192 | ---- | C] () -- C:\Users\Laci Ryan\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010/02/20 16:16:10 | 000,439,308 | ---- | C] () -- C:\Windows\System32\igcompkrng500.bin
[2010/02/20 16:16:08 | 000,982,240 | ---- | C] () -- C:\Windows\System32\igkrng500.bin
[2010/02/20 16:16:08 | 000,092,356 | ---- | C] () -- C:\Windows\System32\igfcg500m.bin
[2010/02/20 15:32:46 | 000,000,151 | ---- | C] () -- C:\Windows\System32\GfxUI.exe.config
[2010/02/20 15:27:38 | 000,208,896 | ---- | C] () -- C:\Windows\System32\iglhsip32.dll
[2010/02/20 15:27:38 | 000,143,360 | ---- | C] () -- C:\Windows\System32\iglhcp32.dll
[2009/12/25 22:18:25 | 000,000,110 | ---- | C] () -- C:\Windows\{7E7D778E-121D-4BBD-BA29-FAA81B9FBD8C}_WiseFW.ini
[2009/11/18 14:25:13 | 000,140,288 | ---- | C] () -- C:\Windows\System32\igfxtvcx.dll
[2009/11/13 14:58:56 | 000,626,688 | ---- | C] () -- C:\Windows\Image.dll
[2009/11/13 14:58:56 | 000,200,704 | ---- | C] () -- C:\Windows\PLFSetI.exe
[2009/11/13 14:58:56 | 000,020,480 | ---- | C] () -- C:\Windows\USB_VIDEO_REG.exe
[2009/11/13 14:58:56 | 000,000,036 | ---- | C] () -- C:\Windows\PidList.ini
[2009/11/13 14:52:25 | 000,000,056 | -H-- | C] () -- C:\ProgramData\ezsidmv.dat
[2009/11/13 14:48:20 | 000,106,496 | ---- | C] () -- C:\Windows\FixUVC.exe
[2009/11/13 14:12:14 | 000,021,316 | ---- | C] () -- C:\Windows\System32\emptyregdb.dat
[2009/10/02 17:16:26 | 000,000,778 | ---- | C] () -- C:\Windows\cdplayer.ini
[2009/09/16 19:57:59 | 000,117,248 | ---- | C] () -- C:\Windows\System32\EhStorAuthn.dll
[2009/09/03 12:37:26 | 000,000,000 | ---- | C] () -- C:\Windows\nsreg.dat
[2009/08/13 22:45:40 | 000,134,592 | ---- | C] () -- C:\Windows\System32\igfcg500.bin
[2009/08/03 16:07:42 | 000,403,816 | ---- | C] () -- C:\Windows\System32\OGACheckControl.dll
[2009/08/03 16:07:42 | 000,230,768 | ---- | C] () -- C:\Windows\System32\OGAEXEC.exe
[2009/07/14 00:57:37 | 000,067,584 | --S- | C] () -- C:\Windows\bootstat.dat
[2009/07/14 00:33:53 | 000,334,928 | ---- | C] () -- C:\Windows\System32\FNTCACHE.DAT
[2009/07/13 22:05:48 | 000,626,278 | ---- | C] () -- C:\Windows\System32\perfh009.dat
[2009/07/13 22:05:48 | 000,291,294 | ---- | C] () -- C:\Windows\System32\perfi009.dat
[2009/07/13 22:05:48 | 000,107,522 | ---- | C] () -- C:\Windows\System32\perfc009.dat
[2009/07/13 22:05:48 | 000,031,548 | ---- | C] () -- C:\Windows\System32\perfd009.dat
[2009/07/13 22:05:05 | 000,000,741 | ---- | C] () -- C:\Windows\System32\NOISE.DAT
[2009/07/13 22:04:11 | 000,215,943 | ---- | C] () -- C:\Windows\System32\dssec.dat
[2009/07/13 19:55:01 | 000,043,131 | ---- | C] () -- C:\Windows\mib.bin
[2009/07/13 19:51:43 | 000,073,728 | ---- | C] () -- C:\Windows\System32\BthpanContextHandler.dll
[2009/07/13 19:42:10 | 000,064,000 | ---- | C] () -- C:\Windows\System32\BWContextHandler.dll
[2009/06/10 17:26:10 | 000,673,088 | ---- | C] () -- C:\Windows\System32\mlang.dat
[2009/05/22 21:44:49 | 000,090,772 | ---- | C] () -- C:\Windows\System32\drivers\RtConvEQ.DAT
[2009/05/22 21:44:49 | 000,000,536 | ---- | C] () -- C:\Windows\System32\drivers\RtHdatEx.dat
[2009/05/22 21:44:49 | 000,000,008 | ---- | C] () -- C:\Windows\System32\drivers\rtkhdaud.dat
[2009/05/22 20:56:45 | 000,014,713 | ---- | C] () -- C:\Windows\System32\RaCoInst.dat
[2009/05/22 20:56:39 | 000,004,608 | ---- | C] () -- C:\Windows\System32\HdmiCoin.dll

========== LOP Check ==========

[2009/11/13 14:07:12 | 000,000,000 | ---D | M] -- C:\Users\Laci Ryan\AppData\Roaming\Acer
[2009/11/13 14:07:12 | 000,000,000 | ---D | M] -- C:\Users\Laci Ryan\AppData\Roaming\Acer GameZone Console
[2011/03/09 17:43:51 | 000,000,000 | ---D | M] -- C:\Users\Laci Ryan\AppData\Roaming\Amazon
[2010/11/19 17:15:10 | 000,000,000 | ---D | M] -- C:\Users\Laci Ryan\AppData\Roaming\com.w3i.musicoasis
[2010/02/28 01:09:18 | 000,000,000 | ---D | M] -- C:\Users\Laci Ryan\AppData\Roaming\Facebook
[2010/12/22 19:50:24 | 000,000,000 | ---D | M] -- C:\Users\Laci Ryan\AppData\Roaming\FrostWire
[2009/11/17 19:15:52 | 000,000,000 | ---D | M] -- C:\Users\Laci Ryan\AppData\Roaming\HorizonWimba
[2009/11/13 14:07:13 | 000,000,000 | ---D | M] -- C:\Users\Laci Ryan\AppData\Roaming\Leadertech
[2009/11/13 14:07:20 | 000,000,000 | ---D | M] -- C:\Users\Laci Ryan\AppData\Roaming\PowerCinema
[2010/08/13 22:08:02 | 000,000,000 | ---D | M] -- C:\Users\Laci Ryan\AppData\Roaming\Research In Motion
[2011/03/30 09:06:26 | 000,032,628 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT

========== Purity Check ==========



========== Custom Scans ==========


< %SYSTEMDRIVE%\*.* >
[2009/06/10 17:42:20 | 000,000,024 | ---- | M] () -- C:\autoexec.bat
[2009/07/13 21:38:58 | 000,383,562 | RHS- | M] () -- C:\bootmgr
[2009/11/13 16:51:25 | 000,008,192 | RHS- | M] () -- C:\BOOTSECT.BAK
[2011/04/02 22:11:27 | 000,022,197 | ---- | M] () -- C:\ComboFix.txt
[2009/06/10 17:42:20 | 000,000,010 | ---- | M] () -- C:\config.sys
[2011/04/02 22:12:57 | 2360,848,384 | -HS- | M] () -- C:\hiberfil.sys
[2009/09/19 09:53:27 | 000,000,000 | RHS- | M] () -- C:\IO.SYS
[2010/06/08 13:30:49 | 000,000,109 | ---- | M] () -- C:\mbam-error.txt
[2009/09/19 09:53:27 | 000,000,000 | RHS- | M] () -- C:\MSDOS.SYS
[2011/04/02 22:13:00 | 3147,800,576 | -HS- | M] () -- C:\pagefile.sys
[2011/04/02 18:26:42 | 000,100,480 | ---- | M] (GMER) -- C:\pwdcrkod.sys
[2009/05/22 21:45:36 | 000,001,843 | ---- | M] () -- C:\RHDSetup.log
[2011/04/02 19:35:48 | 000,067,240 | ---- | M] () -- C:\TDSSKiller.2.4.21.0_02.04.2011_19.34.33_log.txt

< %systemroot%\Fonts\*.com >
[2009/07/14 00:52:25 | 000,026,040 | ---- | M] () -- C:\Windows\Fonts\GlobalMonospace.CompositeFont
[2009/07/14 00:52:25 | 000,026,489 | ---- | M] () -- C:\Windows\Fonts\GlobalSansSerif.CompositeFont
[2009/07/14 00:52:25 | 000,029,779 | ---- | M] () -- C:\Windows\Fonts\GlobalSerif.CompositeFont
[2009/07/14 00:52:25 | 000,043,318 | ---- | M] () -- C:\Windows\Fonts\GlobalUserInterface.CompositeFont

< %systemroot%\Fonts\*.dll >

< %systemroot%\Fonts\*.ini >
[2009/06/10 17:31:19 | 000,000,065 | ---- | M] () -- C:\Windows\Fonts\desktop.ini

< %systemroot%\Fonts\*.ini2 >

< %systemroot%\Fonts\*.exe >

< %systemroot%\system32\spool\prtprocs\w32x86\*.* >
[2009/07/13 21:15:35 | 000,022,528 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\spool\prtprocs\w32x86\jnwppr.dll
[2006/10/26 22:56:12 | 000,033,104 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\spool\prtprocs\w32x86\msonpppr.dll
[2009/07/13 21:16:19 | 000,029,696 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\spool\prtprocs\w32x86\winprint.dll

< %systemroot%\REPAIR\*.bak1 >

< %systemroot%\REPAIR\*.ini >

< %systemroot%\system32\*.jpg >

< %systemroot%\*.jpg >

< %systemroot%\*.png >

< %systemroot%\*.scr >
[2008/12/05 01:55:20 | 000,307,560 | ---- | M] (Microsoft Corporation) -- C:\Windows\WLXPGSS.SCR

< %systemroot%\*._sy >

< %APPDATA%\Adobe\Update\*.* >

< %ALLUSERSPROFILE%\Favorites\*.* >

< %APPDATA%\Microsoft\*.* >

< %PROGRAMFILES%\*.* >
[2009/07/14 00:41:57 | 000,000,174 | -HS- | M] () -- C:\Program Files\desktop.ini

< %APPDATA%\Update\*.* >

< %systemroot%\*. /mp /s >

< %systemroot%\System32\config\*.sav >

< %PROGRAMFILES%\bak. /s >

< %systemroot%\system32\bak. /s >

< %ALLUSERSPROFILE%\Start Menu\*.lnk /x >

< %systemroot%\system32\config\systemprofile\*.dat /x >

< %systemroot%\*.config >

< %systemroot%\system32\*.db >

< %APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x >
[2009/11/02 21:58:16 | 000,000,574 | -HS- | M] () -- C:\Users\Laci Ryan\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop (1).ini
[2009/11/13 14:25:04 | 000,000,221 | -HS- | M] () -- C:\Users\Laci Ryan\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini

< %USERPROFILE%\Desktop\*.exe >
[2011/04/02 20:05:32 | 000,301,568 | ---- | M] () -- C:\Users\Laci Ryan\Desktop\0cfbq2kk.exe
[2011/04/02 22:02:25 | 004,312,600 | R--- | M] () -- C:\Users\Laci Ryan\Desktop\ComboFix.exe
[2010/02/28 01:09:13 | 002,110,728 | ---- | M] (Facebook, Inc.) -- C:\Users\Laci Ryan\Desktop\Install_Facebook_Plug-In_1.0.3.exe
[2011/04/02 20:04:10 | 000,080,384 | ---- | M] () -- C:\Users\Laci Ryan\Desktop\MBRCheck.exe
[2011/04/02 22:33:21 | 000,580,608 | ---- | M] (OldTimer Tools) -- C:\Users\Laci Ryan\Desktop\OTL.exe
[1 C:\Users\Laci Ryan\Desktop\*.tmp files -> C:\Users\Laci Ryan\Desktop\*.tmp -> ]

< %PROGRAMFILES%\Common Files\*.* >

< %systemroot%\*.src >

< %systemroot%\install\*.* >

< %systemroot%\system32\DLL\*.* >

< %systemroot%\system32\HelpFiles\*.* >

< %systemroot%\system32\rundll\*.* >

< %systemroot%\winn32\*.* >

< %systemroot%\Java\*.* >

< %systemroot%\system32\test\*.* >

< %systemroot%\system32\Rundll32\*.* >

< %systemroot%\AppPatch\Custom\*.* >

< %APPDATA%\Roaming\Microsoft\Windows\Recent\*.lnk /x >

< %PROGRAMFILES%\PC-Doctor\Downloads\*.* >

< %PROGRAMFILES%\Internet Explorer\*.tmp >

< %PROGRAMFILES%\Internet Explorer\*.dat >

< %USERPROFILE%\My Documents\*.exe >

< %USERPROFILE%\*.exe >

< %systemroot%\ADDINS\*.* >
[2009/06/10 17:20:04 | 000,000,802 | ---- | M] () -- C:\Windows\addins\FXSEXT.ecf

< %systemroot%\assembly\*.bak2 >

< %systemroot%\Config\*.* >

< %systemroot%\REPAIR\*.bak2 >

< %systemroot%\SECURITY\Database\*.sdb /x >

< %systemroot%\SYSTEM\*.bak2 >

< %systemroot%\Web\*.bak2 >

< %systemroot%\Driver Cache\*.* >

< %PROGRAMFILES%\Mozilla Firefox\0*.exe >

< %ProgramFiles%\Microsoft Common\*.* >

< %ProgramFiles%\TinyProxy. >

< %USERPROFILE%\Favorites\*.url /x >
[2010/08/07 20:03:54 | 000,000,402 | -HS- | M] () -- C:\Users\Laci Ryan\Favorites\desktop.ini

< %systemroot%\system32\*.bk >

< %systemroot%\*.te >

< %systemroot%\system32\system32\*.* >

< %ALLUSERSPROFILE%\*.dat /x >

< %systemroot%\system32\drivers\*.rmv >

< dir /b "%systemroot%\system32\*.exe" | find /i " " /c >

< dir /b "%systemroot%\*.exe" | find /i " " /c >
Acer Crystal Eye webcam.EXE

< %PROGRAMFILES%\Microsoft\*.* >

< %systemroot%\System32\Wbem\proquota.exe >

< %PROGRAMFILES%\Mozilla Firefox\*.dat >

< %USERPROFILE%\Cookies\*.txt /x >

< %SystemRoot%\system32\fonts\*.* >

< %systemroot%\system32\winlog\*.* >

< %systemroot%\system32\Language\*.* >

< %systemroot%\system32\Settings\*.* >

< %systemroot%\system32\*.quo >

< %SYSTEMROOT%\AppPatch\*.exe >

< %SYSTEMROOT%\inf\*.exe >

< %SYSTEMROOT%\Installer\*.exe >

< %systemroot%\system32\config\*.bak2 >

< %systemroot%\system32\Computers\*.* >

< %SystemRoot%\system32\Sound\*.* >

< %SystemRoot%\system32\SpecialImg\*.* >

< %SystemRoot%\system32\code\*.* >

< %SystemRoot%\system32\draft\*.* >

< %SystemRoot%\system32\MSSSys\*.* >

< %ProgramFiles%\Javascript\*.* >

< %systemroot%\pchealth\helpctr\System\*.exe /s >

< %systemroot%\Web\*.exe >

< %systemroot%\system32\msn\*.* >

< %systemroot%\system32\*.tro >

< %AppData%\Microsoft\Installer\msupdates\*.* >

< %ProgramFiles%\Messenger\*.* >

< %systemroot%\system32\systhem32\*.* >

< %systemroot%\system\*.exe >

< HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >

< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\ Auto Update\Results\Install|LastSuccessTime /rs >


< End of report >

 

The logs came up but I can not seem to post them. Please advise.

 

OTL Extras logfile created on: 4/2/2011 10:35:44 PM - Run 1
OTL by OldTimer - Version 3.2.22.3 Folder = C:\Users\Laci Ryan\Desktop
Home Premium Edition (Version = 6.1.7600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7600.16385)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

3.00 Gb Total Physical Memory | 2.00 Gb Available Physical Memory | 56.00% Memory free
6.00 Gb Paging File | 5.00 Gb Available in Paging File | 79.00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 220.88 Gb Total Space | 162.99 Gb Free Space | 73.79% Space Free | Partition Type: NTFS

Computer Name: LACIRYAN-PC | User Name: Laci Ryan | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========


========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\System32\control.exe (Microsoft Corporation)
.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)

[HKEY_USERS\S-1-5-21-358480402-2928177412-2907725623-1000\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1 ",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1 "
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
"FirewallDisableNotify" = 0
"AntiVirusDisableNotify" = 0
"UpdatesDisableNotify" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = Reg Error: Unknown registry data type -- File not found
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]

========== System Restore Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]


========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
"{020D8396-D6D9-4B53-A9A1-83C47E2E27AA}" = Windows Live Call
"{0AAA9C97-74D4-47CE-B089-0B147EF3553C}" = Windows Live Messenger
"{12EFA1A4-AC3B-443C-8143-237EDE760403}" = NTI Backup Now Standard
"{1D0FDD6D-3C5E-4588-8ED0-02DC88014BF2}" = Upgrade Kit
"{205C6BDD-7B73-42DE-8505-9A093F35A238}" = Windows Live Upload Tool
"{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}" = MSVCRT
"{2413930C-8309-47A6-BC61-5EF27A4222BC}" = NTI Media Maker 8
"{2637C347-9DAD-11D6-9EA2-00055D0CA761}" = Acer Arcade Deluxe
"{26604C7E-A313-4D12-867F-7C6E7820BE4C}" = JMicron Flash Media Controller Driver
"{26A24AE4-039D-4CA4-87B4-2F83216024FF}" = Java(TM) 6 Update 24
"{28C2DED6-325B-4CC7-983A-1777C8F7FBAB}" = RealUpgrade 1.1
"{2A697B53-0DE3-42DA-B41D-C3F804B1C538}" = iTunes
"{2A981294-F14C-4F0F-9627-D793270922F8}" = Bonjour
"{2DC94AFD-A6E2-4AB4-9132-4A3F8E07B386}" = Apple Application Support
"{3108C217-BE83-42E4-AE9E-A56A2A92E549}" = Atheros Communications Inc.(R) AR81Family Gigabit/Fast Ethernet Driver
"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
"{3DB0448D-AD82-4923-B305-D001E521A964}" = Acer PowerSmart Manager
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4AB8B41B-3AF1-46BE-99B0-0ACD3B300C0A}" = Junk Mail filter update
"{57752979-A1C9-4C02-856B-FBB27AC4E02C}" = QuickTime
"{63C1109E-D977-49ED-BCE3-D00D0BF187D6}" = Windows Live Mail
"{6632ABC5-9AEE-4243-9086-FB358DB58147}" = Cisco NAC Agent
"{67E03279-F703-408F-B4BF-46B5FC8D70CD}" = Microsoft Works
"{68301905-2DEA-41CE-A4D4-E8B443B099BA}" = MyWinLocker
"{6A92E5C5-0578-443D-91F3-92ECE5F2CAE2}" = Windows Live Writer
"{72B776E5-4530-4C4B-9453-751DF87D9D93}" = Backup Manager Basic
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{774088D4-0777-4D78-904D-E435B318F5D2}" = Microsoft Antimalware
"{7770E71B-2D43-4800-9CB3-5B6CAAEBEBEA}" = RealNetworks - Microsoft Visual C++ 2008 Runtime
"{77A776C4-D10F-416D-88F0-53F2D9DCD9B3}" = Microsoft Security Client
"{77DCDCE3-2DED-62F3-8154-05E745472D07}" = Acrobat.com
"{7E7D778E-121D-4BBD-BA29-FAA81B9FBD8C}" = LeapFrog Connect
"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
"{84A78614-0E4B-4A4E-BA8C-2B0A05A08E4E}" = BlackBerry Desktop Software 6.0.1
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8FFC5648-FAF8-43A3-BC8F-42BA1E275C4E}" = Choice Guard
"{90120000-0016-0409-0000-0000000FF1CE}" = Microsoft Office Excel MUI (English) 2007
"{90120000-0016-0409-0000-0000000FF1CE}_HOMESTUDENTR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0018-0409-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (English) 2007
"{90120000-0018-0409-0000-0000000FF1CE}_HOMESTUDENTR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001B-0409-0000-0000000FF1CE}" = Microsoft Office Word MUI (English) 2007
"{90120000-001B-0409-0000-0000000FF1CE}_HOMESTUDENTR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-0409-0000-0000000FF1CE}_HOMESTUDENTR_{ABDDE972-355B-4AF1-89A8-DA50B7B5C045}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-040C-0000-0000000FF1CE}_HOMESTUDENTR_{F580DDD5-8D37-4998-968E-EBB76BB86787}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-0C0A-0000-0000000FF1CE}" = Microsoft Office Proof (Spanish) 2007
"{90120000-001F-0C0A-0000-0000000FF1CE}_HOMESTUDENTR_{187308AB-5FA7-4F14-9AB9-D290383A10D9}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-0020-0409-0000-0000000FF1CE}" = Compatibility Pack for the 2007 Office system
"{90120000-002C-0409-0000-0000000FF1CE}" = Microsoft Office Proofing (English) 2007
"{90120000-006E-0409-0000-0000000FF1CE}" = Microsoft Office Shared MUI (English) 2007
"{90120000-006E-0409-0000-0000000FF1CE}_HOMESTUDENTR_{DE5A002D-8122-4278-A7EE-3121E7EA254E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-00A1-0409-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (English) 2007
"{90120000-00A1-0409-0000-0000000FF1CE}_HOMESTUDENTR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0115-0409-0000-0000000FF1CE}" = Microsoft Office Shared Setup Metadata MUI (English) 2007
"{90120000-0115-0409-0000-0000000FF1CE}_HOMESTUDENTR_{DE5A002D-8122-4278-A7EE-3121E7EA254E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{9068B2BE-D93A-4C0A-861C-5E35E2C0E09E}" = Intel® Matrix Storage Manager
"{91120000-002F-0000-0000-0000000FF1CE}" = Microsoft Office Home and Student 2007
"{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{0B36C6D6-F5D8-4EAF-BF94-4376A230AD5B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{3D019598-7B59-447A-80AE-815B703B84FF}" = Security Update for Microsoft Office system 2007 (972581)
"{9422C8EA-B0C6-4197-B8FC-DC797658CA00}" = Windows Live Sign-in Assistant
"{95120000-00AF-0409-0000-0000000FF1CE}" = Microsoft Office PowerPoint Viewer 2007 (English)
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{A71D5E81-B967-43DB-93D7-FD31BFB95748}" = MobileMe Control Panel
"{A77255C4-AFCB-44A3-BF0F-2091A71FFD9E}" = Acer Crystal Eye Webcam
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{AC76BA86-7AD7-1033-7B44-AA0000000001}" = Adobe Reader X (10.0.1)
"{B2544A03-10D0-4E5E-BA69-0362FFC20D18}" = OGA Notifier 2.0.0048.0
"{C41300B9-185D-475E-BFEC-39EF732F19B1}" = Apple Software Update
"{C73F2967-062E-48F2-A462-D335B8950183}" = Safari
"{C768790F-04FB-11E0-9B2C-001AA037B01E}" = Google Earth
"{CA72A82C-7DBC-4814-8CCB-E5BFAC59FAEF}" = ArcSoft MediaImpression for Kodak
"{CACAEB5F-174D-4C7C-AC56-A33289A807CA}" = Apple Mobile Device Support
"{CC33E708-A795-4AB3-908A-8F45919BC097}" = LeapFrog My Pals Plugin
"{CD95D125-2992-4858-B3EF-5F6FB52FBAD6}" = Skype Toolbars
"{D0ACE89D-EC7F-470F-80BE-4C98ED366B32}" = Acer Crystal Eye webcam Ver:1.1.74.216
"{D9D754A1-EAC5-406C-A28B-C49B1E846711}" = Windows Live Essentials
"{D9DE9E03-71CA-423B-B101-57F13A751003}" = LeapFrog Tag Junior Plugin
"{E633D396-5188-4E9D-8F6B-BFB8BF3467E8}" = Skypeâ„¢ 5.0
"{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}" = Microsoft SQL Server 2005 Compact Edition [ENU]
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F69E83CF-B440-43F8-89E6-6EA80712109B}" = Windows Live Communications Platform
"{F73A5B18-EB75-4B2C-B32D-9457576E2417}" = Windows Live Photo Gallery
"{FDD810CA-D5E3-40E9-AB7B-36440B0D41EF}" = Windows Live Sync
"{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022
"781745E87AFF80C0C1388CFF79D19ECAB2E9BB47" = Windows Driver Package - LeapFrog (FlyUsb) USB (11/05/2008 1.1.1.0)
"Acer Assist" = Acer Assist
"Acer Registration" = Acer Registration
"Acer Screensaver" = Acer ScreenSaver
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Amazon MP3 Downloader" = Amazon MP3 Downloader 1.0.10
"BlackBerry_Desktop" = BlackBerry Desktop Software 6.0.1
"Google Desktop" = Google Desktop
"GridVista" = Acer GridVista
"HDMI" = Intel(R) Graphics Media Accelerator Driver
"HOMESTUDENTR" = Microsoft Office Home and Student 2007
"InstallShield_{12EFA1A4-AC3B-443C-8143-237EDE760403}" = NTI Backup Now 5
"InstallShield_{2413930C-8309-47A6-BC61-5EF27A4222BC}" = NTI Media Maker 8
"InstallShield_{2637C347-9DAD-11D6-9EA2-00055D0CA761}" = Acer Arcade Deluxe
"InstallShield_{72B776E5-4530-4C4B-9453-751DF87D9D93}" = Acer Backup Manager
"LManager" = Launch Manager
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft Security Client" = Microsoft Security Essentials
"Mozilla Firefox 4.0 (x86 en-US)" = Mozilla Firefox 4.0 (x86 en-US)
"MyPalsPlugin" = Use the entry named LeapFrog Connect to uninstall (LeapFrog My Pals Plugin)
"RealPlayer 12.0" = RealPlayer
"Secunia PSI" = Secunia PSI (2.0.0.3001)
"SynTPDeinstKey" = Synaptics Pointing Device Driver
"TagJuniorPlugin" = Use the entry named LeapFrog Connect to uninstall (LeapFrog Tag Junior Plugin)
"TVWiz" = Intel(R) TV Wizard
"UPCShell" = LeapFrog Connect
"WinLiveSuite_Wave3" = Windows Live Essentials

========== HKEY_USERS Uninstall List ==========

[HKEY_USERS\S-1-5-21-358480402-2928177412-2907725623-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Facebook Plug-In" = Facebook Plug-In
"Google Chrome" = Google Chrome
"Yahoo! BrowserPlus" = Yahoo! BrowserPlus 2.9.8

========== Last 10 Event Log Errors ==========

Error reading Event Logs: The Event Service is not operating properly or the Event Logs are corrupt!

< End of report >

 

OTL logfile created on: 4/2/2011 10:35:44 PM - Run 1
OTL by OldTimer - Version 3.2.22.3 Folder = C:\Users\Laci Ryan\Desktop
Home Premium Edition (Version = 6.1.7600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7600.16385)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

3.00 Gb Total Physical Memory | 2.00 Gb Available Physical Memory | 56.00% Memory free
6.00 Gb Paging File | 5.00 Gb Available in Paging File | 79.00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 220.88 Gb Total Space | 162.99 Gb Free Space | 73.79% Space Free | Partition Type: NTFS

Computer Name: LACIRYAN-PC | User Name: Laci Ryan | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2011/04/02 22:33:21 | 000,580,608 | ---- | M] (OldTimer Tools) -- C:\Users\Laci Ryan\Desktop\OTL.exe
PRC - [2011/04/02 16:36:49 | 000,273,544 | ---- | M] (RealNetworks, Inc.) -- C:\Program Files\real\realplayer\Update\realsched.exe
PRC - [2011/04/02 16:35:03 | 000,235,168 | ---- | M] (Adobe Systems, Inc.) -- C:\Windows\System32\Macromed\Flash\FlashUtil10o_ActiveX.exe
PRC - [2011/01/10 10:24:20 | 000,993,848 | ---- | M] (Secunia) -- C:\Program Files\Secunia\PSI\psia.exe
PRC - [2011/01/10 10:24:20 | 000,399,416 | ---- | M] (Secunia) -- C:\Program Files\Secunia\PSI\sua.exe
PRC - [2011/01/10 10:24:20 | 000,291,896 | ---- | M] (Secunia) -- C:\Program Files\Secunia\PSI\psi_tray.exe
PRC - [2010/11/30 13:20:36 | 000,997,408 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Microsoft Security Client\msseces.exe
PRC - [2010/11/11 12:26:40 | 000,011,736 | ---- | M] (Microsoft Corporation) -- c:\Program Files\Microsoft Security Client\Antimalware\MsMpEng.exe
PRC - [2010/02/05 17:29:12 | 000,454,400 | ---- | M] (Cisco Systems, Inc.) -- C:\Program Files\Cisco\Cisco NAC Agent\NACAgentUI.exe
PRC - [2010/02/05 17:28:26 | 000,742,144 | ---- | M] (Cisco Systems, Inc.) -- C:\Program Files\Cisco\Cisco NAC Agent\NACAgent.exe
PRC - [2009/11/10 10:28:06 | 001,131,808 | ---- | M] (LeapFrog Enterprises, Inc.) -- C:\Program Files\LeapFrog\LeapFrog Connect\CommandService.exe
PRC - [2009/10/31 01:45:39 | 002,614,272 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe
PRC - [2009/09/28 10:42:50 | 000,109,056 | ---- | M] (ArcSoft Inc.) -- C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe
PRC - [2009/08/26 21:07:22 | 000,690,720 | ---- | M] (Acer Incorporated) -- C:\Program Files\Acer\Acer PowerSmart Manager\ePowerSvc.exe
PRC - [2009/07/13 21:14:42 | 000,049,152 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\taskhost.exe
PRC - [2009/03/20 13:14:50 | 000,044,800 | ---- | M] (NewTech Infosystems, Inc.) -- C:\Program Files\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe
PRC - [2008/12/18 16:51:34 | 000,075,048 | ---- | M] () -- C:\Program Files\Acer Arcade Deluxe\HomeMedia\Kernel\DMP\CLHNService.exe
PRC - [2008/12/04 16:00:26 | 000,354,840 | ---- | M] (Intel Corporation) -- C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTmon.exe
PRC - [2008/10/27 15:05:28 | 000,306,736 | ---- | M] (EgisTec Inc.) -- C:\Program Files\EgisTec\MyWinLocker 3\x86\MWLService.exe
PRC - [2008/08/26 02:02:24 | 000,014,336 | ---- | M] (Agere Systems) -- C:\Program Files\LSI SoftModem\agrsmsvc.exe


========== Modules (SafeList) ==========

MOD - [2011/04/02 22:33:21 | 000,580,608 | ---- | M] (OldTimer Tools) -- C:\Users\Laci Ryan\Desktop\OTL.exe
MOD - [2010/08/21 01:21:32 | 001,680,896 | ---- | M] (Microsoft Corporation) -- C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7600.16661_none_420fe3fa2b8113bd\comctl32.dll


========== Win32 Services (SafeList) ==========

SRV - [2011/01/10 10:24:20 | 000,993,848 | ---- | M] (Secunia) [Auto | Running] -- C:\Program Files\Secunia\PSI\PSIA.exe -- (Secunia PSI Agent)
SRV - [2011/01/10 10:24:20 | 000,399,416 | ---- | M] (Secunia) [Auto | Running] -- C:\Program Files\Secunia\PSI\sua.exe -- (Secunia Update Agent)
SRV - [2010/11/11 12:26:42 | 000,206,360 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- c:\Program Files\Microsoft Security Client\Antimalware\NisSrv.exe -- (NisSrv)
SRV - [2010/11/11 12:26:40 | 000,011,736 | ---- | M] (Microsoft Corporation) [Auto | Running] -- c:\Program Files\Microsoft Security Client\Antimalware\MsMpEng.exe -- (MsMpSvc)
SRV - [2010/05/14 13:05:19 | 001,343,400 | ---- | M] (Microsoft Corporation) [Unknown | Stopped] -- C:\Windows\System32\Wat\WatAdminSvc.exe -- (WatAdminSvc)
SRV - [2010/02/05 17:28:26 | 000,742,144 | ---- | M] (Cisco Systems, Inc.) [Auto | Running] -- C:\Program Files\Cisco\Cisco NAC Agent\NACAgent.exe -- (NACAgent)
SRV - [2009/11/10 10:28:06 | 001,131,808 | ---- | M] (LeapFrog Enterprises, Inc.) [Auto | Running] -- C:\Program Files\LeapFrog\LeapFrog Connect\CommandService.exe -- (LeapFrog Connect Device Service)
SRV - [2009/09/28 10:42:50 | 000,109,056 | ---- | M] (ArcSoft Inc.) [Auto | Running] -- C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe -- (ACDaemon)
SRV - [2009/08/26 21:07:22 | 000,690,720 | ---- | M] (Acer Incorporated) [Auto | Running] -- C:\Program Files\Acer\Acer PowerSmart Manager\ePowerSvc.exe -- (ePowerSvc)
SRV - [2009/07/13 21:16:13 | 000,025,088 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\sensrsvc.dll -- (SensrSvc)
SRV - [2009/07/13 21:15:41 | 000,680,960 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)
SRV - [2009/03/20 13:14:50 | 000,044,800 | ---- | M] (NewTech Infosystems, Inc.) [Auto | Running] -- C:\Program Files\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe -- (NTI IScheduleSvc)
SRV - [2008/12/18 16:51:34 | 000,075,048 | ---- | M] () [Auto | Running] -- C:\Program Files\Acer Arcade Deluxe\HomeMedia\Kernel\DMP\CLHNService.exe -- (CLHNService)
SRV - [2008/12/04 16:00:26 | 000,354,840 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTmon.exe -- (IAANTMON) Intel(R)
SRV - [2008/10/27 15:05:28 | 000,306,736 | ---- | M] () [Auto | Running] -- C:\Program Files\EgisTec\MyWinLocker 3\x86\\MWLService.exe -- (MWLService)
SRV - [2008/08/26 02:02:24 | 000,014,336 | ---- | M] (Agere Systems) [Auto | Running] -- C:\Program Files\LSI SoftModem\agrsmsvc.exe -- (AgereModemAudio)


========== Driver Services (SafeList) ==========

DRV - [2010/10/24 21:25:38 | 000,054,144 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\NisDrvWFP.sys -- (NisDrv)
DRV - [2010/10/24 21:25:38 | 000,043,392 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\MpNWMon.sys -- (MpNWMon)
DRV - [2010/09/01 04:30:58 | 000,015,544 | ---- | M] (Secunia) [File_System | On_Demand | Running] -- C:\Windows\System32\drivers\psi_mf.sys -- (PSI)
DRV - [2009/11/10 10:27:06 | 000,019,456 | ---- | M] (LeapFrog) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\FlyUsb.sys -- (FlyUsb)
DRV - [2009/10/05 17:31:50 | 001,221,632 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\athr.sys -- (athr)
DRV - [2009/08/23 06:06:38 | 000,048,640 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\L1E62x86.sys -- (L1E)
DRV - [2009/07/13 19:51:11 | 000,034,944 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\winusb.sys -- (WinUsb)
DRV - [2009/05/07 05:16:54 | 000,119,256 | ---- | M] (JMicron Technology Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\jmcr.sys -- (JMCR)
DRV - [2009/01/20 04:36:34 | 001,205,312 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\AGRSM.sys -- (AgereSoftModem)
DRV - [2008/10/09 19:47:12 | 000,059,952 | ---- | M] (Egis Incorporated.) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\mwlPSDVDisk.sys -- (mwlPSDVDisk)
DRV - [2008/10/09 19:47:12 | 000,019,504 | ---- | M] (Egis Incorporated.) [File_System | Auto | Running] -- C:\Windows\System32\drivers\mwlPSDFilter.sys -- (mwlPSDFilter)
DRV - [2008/10/09 19:47:12 | 000,016,432 | ---- | M] (Egis Incorporated.) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\mwlPSDNserv.sys -- (mwlPSDNServ)
DRV - [2008/09/21 17:49:36 | 000,112,128 | ---- | M] (Intel(R) Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\IntcHdmi.sys -- (IntcHdmiAddService) Intel(R)
DRV - [2006/11/10 15:05:00 | 000,018,688 | ---- | M] (Arcsoft, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\afc.sys -- (Afc)
DRV - [2006/11/02 09:27:36 | 000,020,112 | ---- | M] (Dritek System Inc.) [Kernel | System | Running] -- C:\Program Files\Launch Manager\DPortIO.sys -- (DritekPortIO)
DRV - [2005/06/24 18:36:16 | 000,039,036 | ---- | M] (LG Electronics Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\lgusbmodem.sys -- (USBModem)
DRV - [2005/05/26 11:01:36 | 000,038,144 | ---- | M] (LG Electronics Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\lgusbdiag.sys -- (UsbDiag)
DRV - [2005/05/26 11:01:18 | 000,021,344 | ---- | M] (LG Electronics Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\lgusbbus.sys -- (usbbus)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://homepage.acer.com/rdr.aspx?b=ACAW&l=0409&s=2&o=vp32&d=0509&m=aspire_4736z


IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0



IE - HKU\S-1-5-21-358480402-2928177412-2907725623-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = http://global.acer.com [binary data]
IE - HKU\S-1-5-21-358480402-2928177412-2907725623-1000\SOFTWARE\Microsoft\Internet Explorer\Main,SearchDefaultBranded = 1
IE - HKU\S-1-5-21-358480402-2928177412-2907725623-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://my.yahoo.com/
IE - HKU\S-1-5-21-358480402-2928177412-2907725623-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Restore = http://my.yahoo.com/
IE - HKU\S-1-5-21-358480402-2928177412-2907725623-1000\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKU\S-1-5-21-358480402-2928177412-2907725623-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-21-358480402-2928177412-2907725623-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

========== FireFox ==========

FF - prefs.js..browser.search.defaultengine: "Ask.com "
FF - prefs.js..browser.search.defaultenginename: "Ask.com "
FF - prefs.js..browser.search.order.1: "Ask.com "
FF - prefs.js..browser.search.selectedEngine: "Google "
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "http://www.yahoo.com/?ilc=1 "
FF - prefs.js..extensions.enabledItems: {ABDE892B-13A8-4d1b-88E6-365A6E755758}:14.0.2
FF - prefs.js..extensions.enabledItems: {AB2CE124-6272-4b12-94A9-7303C7397BD1}:5.0.0.6906
FF - prefs.js..extensions.enabledItems: browserhighlighter@ebay.com:1.0.14908
FF - prefs.js..extensions.enabledItems: {a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7}:20100503
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}:6.0.24

FF - HKLM\software\mozilla\Firefox\Extensions\\{ABDE892B-13A8-4d1b-88E6-365A6E755758}: C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext [2011/04/02 16:37:37 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 4.0\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2011/04/02 19:06:19 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 4.0\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2011/04/02 19:06:18 | 000,000,000 | ---D | M]

[2010/02/06 19:08:03 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Laci Ryan\AppData\Roaming\Mozilla\Extensions
[2010/02/06 19:08:03 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Laci Ryan\AppData\Roaming\Mozilla\Extensions\mozswing@mozswing.org
[2011/04/02 19:06:40 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Laci Ryan\AppData\Roaming\Mozilla\Firefox\Profiles\f08maq6d.default\extensions
[2010/11/22 20:28:55 | 000,002,425 | ---- | M] () -- C:\Users\Laci Ryan\AppData\Roaming\Mozilla\Firefox\Profiles\f08maq6d.default\searchplugins\askcom.xml
[2010/10/24 14:24:15 | 000,001,919 | ---- | M] () -- C:\Users\Laci Ryan\AppData\Roaming\Mozilla\Firefox\Profiles\f08maq6d.default\searchplugins\bing-zugo.xml
[2011/04/02 19:06:19 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions
[2011/01/06 10:21:57 | 000,000,000 | ---D | M] (Skype extension) -- C:\Program Files\Mozilla Firefox\extensions\{AB2CE124-6272-4b12-94A9-7303C7397BD1}
[2011/04/02 16:39:59 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}
[2011/04/02 19:04:34 | 000,000,000 | ---D | M] (The Browser Highlighter) -- C:\Program Files\Mozilla Firefox\extensions\browserhighlighter@ebay.com
File not found (No name found) --
[2011/04/02 16:37:37 | 000,000,000 | ---D | M] (RealPlayer Browser Record Plugin) -- C:\PROGRAMDATA\REAL\REALPLAYER\BROWSERRECORDPLUGIN\FIREFOX\EXT
() (No name found) -- C:\USERS\LACI RYAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\F08MAQ6D.DEFAULT\EXTENSIONS\{A0D7CCB3-214D-498B-B4AA-0E8FDA9A7BF7}.XPI
[2009/11/13 14:01:09 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V3.5\WINDOWS PRESENTATION FOUNDATION\DOTNETASSISTANTEXTENSION
[2011/03/18 13:53:24 | 000,142,296 | ---- | M] (Mozilla Foundation) -- C:\Program Files\Mozilla Firefox\components\browsercomps.dll
[2011/04/02 16:39:45 | 000,472,808 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\Mozilla Firefox\plugins\npdeployJava1.dll
[2010/01/01 04:00:00 | 000,002,252 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\bing.xml

Hosts file not found
O2 - BHO: (RealPlayer Download and Record Plugin for Internet Explorer) - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll (RealPlayer)
O4 - HKLM..\Run: [Adobe Reader Speed Launcher] C:\Program Files\Adobe\Reader 10.0\Reader\Reader_sl.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [MSC] c:\Program Files\Microsoft Security Client\msseces.exe (Microsoft Corporation)
O4 - HKLM..\Run: [TkBellExe] c:\program files\real\realplayer\Update\realsched.exe (RealNetworks, Inc.)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-358480402-2928177412-2907725623-1000\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-358480402-2928177412-2907725623-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O15 - HKU\S-1-5-21-358480402-2928177412-2907725623-1000\..Trusted Domains: localhost ([]http in Local intranet)
O15 - HKU\S-1-5-21-358480402-2928177412-2907725623-1000\..Trusted Ranges: GD ([http] in Local intranet)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 1.6.0_24)
O16 - DPF: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 1.6.0_24)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 1.6.0_24)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.0.1
O18 - Protocol\Handler\linkscanner {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - Reg Error: Key error. File not found
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O20 - AppInit_DLLs: (C:\PROGRA~1\Google\GOOGLE~1\GoogleDesktopNetwork3.dll) - C:\Program Files\Google\Google Desktop Search\GoogleDesktopNetwork3.dll (Google)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O24 - Desktop WallPaper: C:\Users\Laci Ryan\Pictures\frame pics\Easter 2009 071.jpg
O24 - Desktop BackupWallPaper: C:\Users\Laci Ryan\Pictures\frame pics\Easter 2009 071.jpg
O28 - HKLM ShellExecuteHooks: {AEB6717E-7E19-11d0-97EE-00C04FD91972} - Reg Error: Key error. File not found
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009/06/10 17:42:20 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*

NetSvcs: FastUserSwitchingCompatibility - File not found
NetSvcs: Ias - File not found
NetSvcs: Nla - File not found
NetSvcs: Ntmssvc - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: SRService - File not found
NetSvcs: WmdmPmSp - File not found
NetSvcs: LogonHours - File not found
NetSvcs: PCAudit - File not found
NetSvcs: helpsvc - File not found
NetSvcs: uploadmgr - File not found

Drivers32: msacm.l3acm - C:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: MSVideo8 - C:\Windows\System32\vfwwdm32.dll (Microsoft Corporation)
Drivers32: vidc.cvid - C:\Windows\System32\iccvid.dll (Radius Inc.)


========== Files/Folders - Created Within 30 Days ==========

[2011/04/02 22:33:18 | 000,580,608 | ---- | C] (OldTimer Tools) -- C:\Users\Laci Ryan\Desktop\OTL.exe
[2011/04/02 22:14:29 | 000,000,000 | --SD | C] -- C:\ComboFix
[2011/04/02 22:11:29 | 000,000,000 | ---D | C] -- C:\Windows\temp
[2011/04/02 22:10:18 | 000,000,000 | -HSD | C] -- C:\$RECYCLE.BIN
[2011/04/02 22:03:24 | 000,212,480 | ---- | C] (SteelWerX) -- C:\Windows\SWXCACLS.exe
[2011/04/02 19:16:19 | 000,161,792 | ---- | C] (SteelWerX) -- C:\Windows\SWREG.exe
[2011/04/02 19:16:19 | 000,136,704 | ---- | C] (SteelWerX) -- C:\Windows\SWSC.exe
[2011/04/02 19:10:53 | 000,000,000 | ---D | C] -- C:\Qoobox
[2011/04/02 18:26:42 | 000,100,480 | ---- | C] (GMER) -- C:\pwdcrkod.sys
[2011/04/02 17:39:29 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Adobe
[2011/04/02 17:29:35 | 000,000,000 | ---D | C] -- C:\Windows\System32\SPReview
[2011/04/02 17:22:32 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes
[2011/04/02 17:21:36 | 000,000,000 | ---D | C] -- C:\Program Files\iPod
[2011/04/02 17:21:35 | 000,000,000 | ---D | C] -- C:\Program Files\iTunes
[2011/04/02 17:18:33 | 000,000,000 | ---D | C] -- C:\Program Files\Apple Software Update
[2011/04/02 17:17:03 | 000,000,000 | ---D | C] -- C:\Config.Msi
[2011/04/02 16:40:44 | 000,000,000 | ---D | C] -- C:\Windows\Temp382200E1-249B-A2C7-A08B-1EC29D429968-Signatures
[2011/04/02 16:40:11 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft Security Client
[2011/04/02 16:36:54 | 000,272,896 | ---- | C] (Progressive Networks) -- C:\Windows\System32\pncrt.dll
[2011/04/02 16:24:06 | 000,000,000 | ---D | C] -- C:\Users\Laci Ryan\AppData\Local\Secunia PSI
[2011/04/02 16:23:58 | 000,000,000 | ---D | C] -- C:\Program Files\Secunia
[2011/04/02 15:52:57 | 000,000,000 | ---D | C] -- C:\Users\Laci Ryan\New folder
[2011/03/09 17:43:51 | 000,000,000 | ---D | C] -- C:\Users\Laci Ryan\AppData\Roaming\Amazon
[2011/03/09 17:40:58 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Amazon
[2011/03/09 17:40:56 | 000,000,000 | ---D | C] -- C:\Program Files\Amazon
[2010/08/25 19:59:08 | 000,004,096 | ---- | C] ( ) -- C:\Windows\System32\IGFXDEVLib.dll
[2009/05/22 20:59:40 | 000,049,152 | ---- | C] ( ) -- C:\Windows\Interop.IWshRuntimeLibrary.dll
[2 C:\Users\Laci Ryan\Documents\*.tmp files -> C:\Users\Laci Ryan\Documents\*.tmp -> ]
[1 C:\Users\Laci Ryan\Desktop\*.tmp files -> C:\Users\Laci Ryan\Desktop\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2011/04/02 22:35:06 | 000,000,886 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2011/04/02 22:33:21 | 000,580,608 | ---- | M] (OldTimer Tools) -- C:\Users\Laci Ryan\Desktop\OTL.exe
[2011/04/02 22:20:23 | 000,011,104 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2011/04/02 22:20:23 | 000,011,104 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2011/04/02 22:17:32 | 000,626,278 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2011/04/02 22:17:32 | 000,107,522 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2011/04/02 22:13:14 | 000,000,882 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2011/04/02 22:13:02 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2011/04/02 22:12:57 | 2360,848,384 | -HS- | M] () -- C:\hiberfil.sys
[2011/04/02 22:11:00 | 000,000,924 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-358480402-2928177412-2907725623-1000UA.job
[2011/04/02 22:02:25 | 004,312,600 | R--- | M] () -- C:\Users\Laci Ryan\Desktop\ComboFix.exe
[2011/04/02 21:20:53 | 000,002,424 | ---- | M] () -- C:\Users\Laci Ryan\Desktop\Google Chrome.lnk
[2011/04/02 20:46:56 | 000,625,664 | ---- | M] () -- C:\Users\Laci Ryan\Desktop\dds.scr
[2011/04/02 20:05:32 | 000,301,568 | ---- | M] () -- C:\Users\Laci Ryan\Desktop\0cfbq2kk.exe
[2011/04/02 20:04:10 | 000,080,384 | ---- | M] () -- C:\Users\Laci Ryan\Desktop\MBRCheck.exe
[2011/04/02 19:06:43 | 000,001,849 | ---- | M] () -- C:\Users\Laci Ryan\Application Data\Microsoft\Internet Explorer\Quick Launch\Mozilla Firefox.lnk
[2011/04/02 19:06:26 | 000,001,096 | ---- | M] () -- C:\Users\Public\Desktop\Mozilla Firefox.lnk
[2011/04/02 18:26:42 | 000,100,480 | ---- | M] (GMER) -- C:\pwdcrkod.sys
[2011/04/02 17:40:04 | 000,001,993 | ---- | M] () -- C:\Users\Public\Desktop\Adobe Reader X.lnk
[2011/04/02 17:37:08 | 000,002,193 | ---- | M] () -- C:\Users\Public\Desktop\BlackBerry Desktop Software.lnk
[2011/04/02 17:26:51 | 000,002,503 | ---- | M] () -- C:\Users\Laci Ryan\Application Data\Microsoft\Internet Explorer\Quick Launch\Apple Safari.lnk
[2011/04/02 17:26:51 | 000,002,479 | ---- | M] () -- C:\Users\Public\Desktop\Safari.lnk
[2011/04/02 17:22:32 | 000,001,757 | ---- | M] () -- C:\Users\Public\Desktop\iTunes.lnk
[2011/04/02 16:51:26 | 000,001,945 | ---- | M] () -- C:\Windows\epplauncher.mif
[2011/04/02 16:51:09 | 000,001,901 | ---- | M] () -- C:\Users\Laci Ryan\Desktop\Microsoft Security Essentials.lnk
[2011/04/02 16:38:28 | 000,001,012 | ---- | M] () -- C:\Users\Public\Desktop\RealPlayer.lnk
[2011/04/02 16:36:54 | 000,272,896 | ---- | M] (Progressive Networks) -- C:\Windows\System32\pncrt.dll
[2011/04/02 16:24:01 | 000,001,068 | ---- | M] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Secunia PSI Tray.lnk
[2011/04/02 15:30:48 | 000,000,872 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-358480402-2928177412-2907725623-1000Core.job
[2 C:\Users\Laci Ryan\Documents\*.tmp files -> C:\Users\Laci Ryan\Documents\*.tmp -> ]
[1 C:\Users\Laci Ryan\Desktop\*.tmp files -> C:\Users\Laci Ryan\Desktop\*.tmp -> ]

========== Files Created - No Company Name ==========

 

[2011/04/02 20:46:54 | 000,625,664 | ---- | C] () -- C:\Users\Laci Ryan\Desktop\dds.scr
[2011/04/02 20:05:30 | 000,301,568 | ---- | C] () -- C:\Users\Laci Ryan\Desktop\0cfbq2kk.exe
[2011/04/02 20:04:08 | 000,080,384 | ---- | C] () -- C:\Users\Laci Ryan\Desktop\MBRCheck.exe
[2011/04/02 19:33:31 | 004,312,600 | R--- | C] () -- C:\Users\Laci Ryan\Desktop\ComboFix.exe
[2011/04/02 19:16:19 | 000,256,512 | ---- | C] () -- C:\Windows\PEV.exe
[2011/04/02 19:16:19 | 000,098,816 | ---- | C] () -- C:\Windows\sed.exe
[2011/04/02 19:16:19 | 000,089,088 | ---- | C] () -- C:\Windows\MBR.exe
[2011/04/02 19:16:19 | 000,080,412 | ---- | C] () -- C:\Windows\grep.exe
[2011/04/02 19:16:19 | 000,068,096 | ---- | C] () -- C:\Windows\zip.exe
[2011/04/02 19:06:26 | 000,001,108 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
[2011/04/02 17:40:04 | 000,002,441 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader X.lnk
[2011/04/02 17:40:04 | 000,001,993 | ---- | C] () -- C:\Users\Public\Desktop\Adobe Reader X.lnk
[2011/04/02 17:22:32 | 000,001,757 | ---- | C] () -- C:\Users\Public\Desktop\iTunes.lnk
[2011/04/02 16:51:26 | 000,001,945 | ---- | C] () -- C:\Windows\epplauncher.mif
[2011/04/02 16:51:09 | 000,001,901 | ---- | C] () -- C:\Users\Laci Ryan\Desktop\Microsoft Security Essentials.lnk
[2011/04/02 16:38:28 | 000,001,012 | ---- | C] () -- C:\Users\Public\Desktop\RealPlayer.lnk
[2011/04/02 16:24:01 | 000,001,068 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Secunia PSI Tray.lnk
[2011/04/02 16:24:01 | 000,001,031 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Secunia PSI.lnk
[2010/08/20 18:37:37 | 000,000,000 | ---- | C] () -- C:\Users\Laci Ryan\AppData\Roaming\wklnhst.dat
[2010/07/16 15:14:29 | 000,008,192 | ---- | C] () -- C:\Users\Laci Ryan\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010/02/20 16:16:10 | 000,439,308 | ---- | C] () -- C:\Windows\System32\igcompkrng500.bin
[2010/02/20 16:16:08 | 000,982,240 | ---- | C] () -- C:\Windows\System32\igkrng500.bin
[2010/02/20 16:16:08 | 000,092,356 | ---- | C] () -- C:\Windows\System32\igfcg500m.bin
[2010/02/20 15:32:46 | 000,000,151 | ---- | C] () -- C:\Windows\System32\GfxUI.exe.config
[2010/02/20 15:27:38 | 000,208,896 | ---- | C] () -- C:\Windows\System32\iglhsip32.dll
[2010/02/20 15:27:38 | 000,143,360 | ---- | C] () -- C:\Windows\System32\iglhcp32.dll
[2009/12/25 22:18:25 | 000,000,110 | ---- | C] () -- C:\Windows\{7E7D778E-121D-4BBD-BA29-FAA81B9FBD8C}_WiseFW.ini
[2009/11/18 14:25:13 | 000,140,288 | ---- | C] () -- C:\Windows\System32\igfxtvcx.dll
[2009/11/13 14:58:56 | 000,626,688 | ---- | C] () -- C:\Windows\Image.dll
[2009/11/13 14:58:56 | 000,200,704 | ---- | C] () -- C:\Windows\PLFSetI.exe
[2009/11/13 14:58:56 | 000,020,480 | ---- | C] () -- C:\Windows\USB_VIDEO_REG.exe
[2009/11/13 14:58:56 | 000,000,036 | ---- | C] () -- C:\Windows\PidList.ini
[2009/11/13 14:52:25 | 000,000,056 | -H-- | C] () -- C:\ProgramData\ezsidmv.dat
[2009/11/13 14:48:20 | 000,106,496 | ---- | C] () -- C:\Windows\FixUVC.exe
[2009/11/13 14:12:14 | 000,021,316 | ---- | C] () -- C:\Windows\System32\emptyregdb.dat
[2009/10/02 17:16:26 | 000,000,778 | ---- | C] () -- C:\Windows\cdplayer.ini
[2009/09/16 19:57:59 | 000,117,248 | ---- | C] () -- C:\Windows\System32\EhStorAuthn.dll
[2009/09/03 12:37:26 | 000,000,000 | ---- | C] () -- C:\Windows\nsreg.dat
[2009/08/13 22:45:40 | 000,134,592 | ---- | C] () -- C:\Windows\System32\igfcg500.bin
[2009/08/03 16:07:42 | 000,403,816 | ---- | C] () -- C:\Windows\System32\OGACheckControl.dll
[2009/08/03 16:07:42 | 000,230,768 | ---- | C] () -- C:\Windows\System32\OGAEXEC.exe
[2009/07/14 00:57:37 | 000,067,584 | --S- | C] () -- C:\Windows\bootstat.dat
[2009/07/14 00:33:53 | 000,334,928 | ---- | C] () -- C:\Windows\System32\FNTCACHE.DAT
[2009/07/13 22:05:48 | 000,626,278 | ---- | C] () -- C:\Windows\System32\perfh009.dat
[2009/07/13 22:05:48 | 000,291,294 | ---- | C] () -- C:\Windows\System32\perfi009.dat
[2009/07/13 22:05:48 | 000,107,522 | ---- | C] () -- C:\Windows\System32\perfc009.dat
[2009/07/13 22:05:48 | 000,031,548 | ---- | C] () -- C:\Windows\System32\perfd009.dat
[2009/07/13 22:05:05 | 000,000,741 | ---- | C] () -- C:\Windows\System32\NOISE.DAT
[2009/07/13 22:04:11 | 000,215,943 | ---- | C] () -- C:\Windows\System32\dssec.dat
[2009/07/13 19:55:01 | 000,043,131 | ---- | C] () -- C:\Windows\mib.bin
[2009/07/13 19:51:43 | 000,073,728 | ---- | C] () -- C:\Windows\System32\BthpanContextHandler.dll
[2009/07/13 19:42:10 | 000,064,000 | ---- | C] () -- C:\Windows\System32\BWContextHandler.dll
[2009/06/10 17:26:10 | 000,673,088 | ---- | C] () -- C:\Windows\System32\mlang.dat
[2009/05/22 21:44:49 | 000,090,772 | ---- | C] () -- C:\Windows\System32\drivers\RtConvEQ.DAT
[2009/05/22 21:44:49 | 000,000,536 | ---- | C] () -- C:\Windows\System32\drivers\RtHdatEx.dat
[2009/05/22 21:44:49 | 000,000,008 | ---- | C] () -- C:\Windows\System32\drivers\rtkhdaud.dat
[2009/05/22 20:56:45 | 000,014,713 | ---- | C] () -- C:\Windows\System32\RaCoInst.dat
[2009/05/22 20:56:39 | 000,004,608 | ---- | C] () -- C:\Windows\System32\HdmiCoin.dll

========== LOP Check ==========

[2009/11/13 14:07:12 | 000,000,000 | ---D | M] -- C:\Users\Laci Ryan\AppData\Roaming\Acer
[2009/11/13 14:07:12 | 000,000,000 | ---D | M] -- C:\Users\Laci Ryan\AppData\Roaming\Acer GameZone Console
[2011/03/09 17:43:51 | 000,000,000 | ---D | M] -- C:\Users\Laci Ryan\AppData\Roaming\Amazon
[2010/11/19 17:15:10 | 000,000,000 | ---D | M] -- C:\Users\Laci Ryan\AppData\Roaming\com.w3i.musicoasis
[2010/02/28 01:09:18 | 000,000,000 | ---D | M] -- C:\Users\Laci Ryan\AppData\Roaming\Facebook
[2010/12/22 19:50:24 | 000,000,000 | ---D | M] -- C:\Users\Laci Ryan\AppData\Roaming\FrostWire
[2009/11/17 19:15:52 | 000,000,000 | ---D | M] -- C:\Users\Laci Ryan\AppData\Roaming\HorizonWimba
[2009/11/13 14:07:13 | 000,000,000 | ---D | M] -- C:\Users\Laci Ryan\AppData\Roaming\Leadertech
[2009/11/13 14:07:20 | 000,000,000 | ---D | M] -- C:\Users\Laci Ryan\AppData\Roaming\PowerCinema
[2010/08/13 22:08:02 | 000,000,000 | ---D | M] -- C:\Users\Laci Ryan\AppData\Roaming\Research In Motion
[2011/03/30 09:06:26 | 000,032,628 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT

========== Purity Check ==========



========== Custom Scans ==========


< %SYSTEMDRIVE%\*.* >
[2009/06/10 17:42:20 | 000,000,024 | ---- | M] () -- C:\autoexec.bat
[2009/07/13 21:38:58 | 000,383,562 | RHS- | M] () -- C:\bootmgr
[2009/11/13 16:51:25 | 000,008,192 | RHS- | M] () -- C:\BOOTSECT.BAK
[2011/04/02 22:11:27 | 000,022,197 | ---- | M] () -- C:\ComboFix.txt
[2009/06/10 17:42:20 | 000,000,010 | ---- | M] () -- C:\config.sys
[2011/04/02 22:12:57 | 2360,848,384 | -HS- | M] () -- C:\hiberfil.sys
[2009/09/19 09:53:27 | 000,000,000 | RHS- | M] () -- C:\IO.SYS
[2010/06/08 13:30:49 | 000,000,109 | ---- | M] () -- C:\mbam-error.txt
[2009/09/19 09:53:27 | 000,000,000 | RHS- | M] () -- C:\MSDOS.SYS
[2011/04/02 22:13:00 | 3147,800,576 | -HS- | M] () -- C:\pagefile.sys
[2011/04/02 18:26:42 | 000,100,480 | ---- | M] (GMER) -- C:\pwdcrkod.sys
[2009/05/22 21:45:36 | 000,001,843 | ---- | M] () -- C:\RHDSetup.log
[2011/04/02 19:35:48 | 000,067,240 | ---- | M] () -- C:\TDSSKiller.2.4.21.0_02.04.2011_19.34.33_log.txt

< %systemroot%\Fonts\*.com >
[2009/07/14 00:52:25 | 000,026,040 | ---- | M] () -- C:\Windows\Fonts\GlobalMonospace.CompositeFont
[2009/07/14 00:52:25 | 000,026,489 | ---- | M] () -- C:\Windows\Fonts\GlobalSansSerif.CompositeFont
[2009/07/14 00:52:25 | 000,029,779 | ---- | M] () -- C:\Windows\Fonts\GlobalSerif.CompositeFont
[2009/07/14 00:52:25 | 000,043,318 | ---- | M] () -- C:\Windows\Fonts\GlobalUserInterface.CompositeFont

< %systemroot%\Fonts\*.dll >

< %systemroot%\Fonts\*.ini >
[2009/06/10 17:31:19 | 000,000,065 | ---- | M] () -- C:\Windows\Fonts\desktop.ini

< %systemroot%\Fonts\*.ini2 >

< %systemroot%\Fonts\*.exe >

< %systemroot%\system32\spool\prtprocs\w32x86\*.* >
[2009/07/13 21:15:35 | 000,022,528 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\spool\prtprocs\w32x86\jnwppr.dll
[2006/10/26 22:56:12 | 000,033,104 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\spool\prtprocs\w32x86\msonpppr.dll
[2009/07/13 21:16:19 | 000,029,696 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\spool\prtprocs\w32x86\winprint.dll

< %systemroot%\REPAIR\*.bak1 >

< %systemroot%\REPAIR\*.ini >

< %systemroot%\system32\*.jpg >

< %systemroot%\*.jpg >

< %systemroot%\*.png >

< %systemroot%\*.scr >
[2008/12/05 01:55:20 | 000,307,560 | ---- | M] (Microsoft Corporation) -- C:\Windows\WLXPGSS.SCR

< %systemroot%\*._sy >

< %APPDATA%\Adobe\Update\*.* >

< %ALLUSERSPROFILE%\Favorites\*.* >

< %APPDATA%\Microsoft\*.* >

< %PROGRAMFILES%\*.* >
[2009/07/14 00:41:57 | 000,000,174 | -HS- | M] () -- C:\Program Files\desktop.ini

< %APPDATA%\Update\*.* >

< %systemroot%\*. /mp /s >

< %systemroot%\System32\config\*.sav >

< %PROGRAMFILES%\bak. /s >

< %systemroot%\system32\bak. /s >

< %ALLUSERSPROFILE%\Start Menu\*.lnk /x >

< %systemroot%\system32\config\systemprofile\*.dat /x >

< %systemroot%\*.config >

< %systemroot%\system32\*.db >

< %APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x >
[2009/11/02 21:58:16 | 000,000,574 | -HS- | M] () -- C:\Users\Laci Ryan\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop (1).ini
[2009/11/13 14:25:04 | 000,000,221 | -HS- | M] () -- C:\Users\Laci Ryan\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini

< %USERPROFILE%\Desktop\*.exe >
[2011/04/02 20:05:32 | 000,301,568 | ---- | M] () -- C:\Users\Laci Ryan\Desktop\0cfbq2kk.exe
[2011/04/02 22:02:25 | 004,312,600 | R--- | M] () -- C:\Users\Laci Ryan\Desktop\ComboFix.exe
[2010/02/28 01:09:13 | 002,110,728 | ---- | M] (Facebook, Inc.) -- C:\Users\Laci Ryan\Desktop\Install_Facebook_Plug-In_1.0.3.exe
[2011/04/02 20:04:10 | 000,080,384 | ---- | M] () -- C:\Users\Laci Ryan\Desktop\MBRCheck.exe
[2011/04/02 22:33:21 | 000,580,608 | ---- | M] (OldTimer Tools) -- C:\Users\Laci Ryan\Desktop\OTL.exe
[1 C:\Users\Laci Ryan\Desktop\*.tmp files -> C:\Users\Laci Ryan\Desktop\*.tmp -> ]

< %PROGRAMFILES%\Common Files\*.* >

< %systemroot%\*.src >

< %systemroot%\install\*.* >

< %systemroot%\system32\DLL\*.* >

< %systemroot%\system32\HelpFiles\*.* >

< %systemroot%\system32\rundll\*.* >

< %systemroot%\winn32\*.* >

< %systemroot%\Java\*.* >

< %systemroot%\system32\test\*.* >

< %systemroot%\system32\Rundll32\*.* >

< %systemroot%\AppPatch\Custom\*.* >

< %APPDATA%\Roaming\Microsoft\Windows\Recent\*.lnk /x >

< %PROGRAMFILES%\PC-Doctor\Downloads\*.* >

< %PROGRAMFILES%\Internet Explorer\*.tmp >

< %PROGRAMFILES%\Internet Explorer\*.dat >

< %USERPROFILE%\My Documents\*.exe >

< %USERPROFILE%\*.exe >

< %systemroot%\ADDINS\*.* >
[2009/06/10 17:20:04 | 000,000,802 | ---- | M] () -- C:\Windows\addins\FXSEXT.ecf

< %systemroot%\assembly\*.bak2 >

< %systemroot%\Config\*.* >

< %systemroot%\REPAIR\*.bak2 >

< %systemroot%\SECURITY\Database\*.sdb /x >

< %systemroot%\SYSTEM\*.bak2 >

< %systemroot%\Web\*.bak2 >

< %systemroot%\Driver Cache\*.* >

< %PROGRAMFILES%\Mozilla Firefox\0*.exe >

< %ProgramFiles%\Microsoft Common\*.* >

< %ProgramFiles%\TinyProxy. >

< %USERPROFILE%\Favorites\*.url /x >
[2010/08/07 20:03:54 | 000,000,402 | -HS- | M] () -- C:\Users\Laci Ryan\Favorites\desktop.ini

< %systemroot%\system32\*.bk >

< %systemroot%\*.te >

< %systemroot%\system32\system32\*.* >

< %ALLUSERSPROFILE%\*.dat /x >

< %systemroot%\system32\drivers\*.rmv >

< dir /b "%systemroot%\system32\*.exe" | find /i " " /c >

< dir /b "%systemroot%\*.exe" | find /i " " /c >
Acer Crystal Eye webcam.EXE

< %PROGRAMFILES%\Microsoft\*.* >

< %systemroot%\System32\Wbem\proquota.exe >

< %PROGRAMFILES%\Mozilla Firefox\*.dat >

< %USERPROFILE%\Cookies\*.txt /x >

< %SystemRoot%\system32\fonts\*.* >

< %systemroot%\system32\winlog\*.* >

< %systemroot%\system32\Language\*.* >

< %systemroot%\system32\Settings\*.* >

< %systemroot%\system32\*.quo >

< %SYSTEMROOT%\AppPatch\*.exe >

< %SYSTEMROOT%\inf\*.exe >

< %SYSTEMROOT%\Installer\*.exe >

< %systemroot%\system32\config\*.bak2 >

< %systemroot%\system32\Computers\*.* >

< %SystemRoot%\system32\Sound\*.* >

< %SystemRoot%\system32\SpecialImg\*.* >

< %SystemRoot%\system32\code\*.* >

< %SystemRoot%\system32\draft\*.* >

< %SystemRoot%\system32\MSSSys\*.* >

< %ProgramFiles%\Javascript\*.* >

< %systemroot%\pchealth\helpctr\System\*.exe /s >

< %systemroot%\Web\*.exe >

< %systemroot%\system32\msn\*.* >

< %systemroot%\system32\*.tro >

< %AppData%\Microsoft\Installer\msupdates\*.* >

< %ProgramFiles%\Messenger\*.* >

< %systemroot%\system32\systhem32\*.* >

< %systemroot%\system\*.exe >

< HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >

< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\ Auto Update\Results\Install|LastSuccessTime /rs >


< End of report >

 

All processes killed
========== OTL ==========
Prefs.js: "Ask.com" removed from browser.search.defaultengine
Prefs.js: "Ask.com" removed from browser.search.defaultenginename
Prefs.js: "Ask.com" removed from browser.search.order.1
C:\Users\Laci Ryan\AppData\Roaming\Mozilla\Firefox\Profiles\f08maq6d.default\searchplugins\askcom.xml moved successfully.
Registry key HKEY_USERS\S-1-5-21-358480402-2928177412-2907725623-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\localhost\ deleted successfully.
Registry value HKEY_USERS\S-1-5-21-358480402-2928177412-2907725623-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\GD\\http deleted successfully.
Starting removal of ActiveX control {E2883E8F-472F-4FB0-9522-AC9BF37916A7}
C:\Windows\Downloaded Program Files\gp.inf not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{E2883E8F-472F-4FB0-9522-AC9BF37916A7}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E2883E8F-472F-4FB0-9522-AC9BF37916A7}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{E2883E8F-472F-4FB0-9522-AC9BF37916A7}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E2883E8F-472F-4FB0-9522-AC9BF37916A7}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\linkscanner\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F274614C-63F8-47D5-A4D1-FBDDE494F8D1}\ not found.
File {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - Reg Error: Key error. File not found not found.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\\{AEB6717E-7E19-11d0-97EE-00C04FD91972} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{AEB6717E-7E19-11d0-97EE-00C04FD91972}\ not found.
C:\Users\Laci Ryan\Documents\~WRL0003.tmp deleted successfully.
C:\Users\Laci Ryan\Documents\~WRL0478.tmp deleted successfully.
C:\Users\Laci Ryan\Desktop\~WRL0067.tmp deleted successfully.
========== COMMANDS ==========

[EMPTYTEMP]

User: All Users

User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: Laci Ryan
->Temp folder emptied: 20195 bytes
->Temporary Internet Files folder emptied: 21012760 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 5898858 bytes
->Google Chrome cache emptied: 6626177 bytes
->Apple Safari cache emptied: 0 bytes
->Flash cache emptied: 743 bytes

User: Public
->Temp folder emptied: 0 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 2414 bytes
RecycleBin emptied: 1454577804 bytes

Total Files Cleaned = 1,419.00 mb


[EMPTYFLASH]

User: All Users

User: Default

User: Default User

User: Laci Ryan
->Flash cache emptied: 0 bytes

User: Public

Total Flash Files Cleaned = 0.00 mb


OTL by OldTimer - Version 3.2.22.3 log created on 04032011_000148

Files\Folders moved on Reboot...
C:\Users\Laci Ryan\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\U0IGODK8\00b42e3a-b809-49b2-b433-cc45b2bc89d33rd_party_BBS[1].htm moved successfully.
C:\Users\Laci Ryan\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\U0IGODK8\98511-active-whitesmoke-infection-problems-windows-updates-function[1].html moved successfully.
C:\Users\Laci Ryan\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\PVF88A1C\p-01-0VIaSjnOLg[1].gif moved successfully.
C:\Users\Laci Ryan\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\6689M20U\;ord=1152579174[1].htm moved successfully.
C:\Users\Laci Ryan\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\184B5UJY\adsCANWODDR.htm moved successfully.
C:\Users\Laci Ryan\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\184B5UJY\p-01-0VIaSjnOLg[1].gif moved successfully.
C:\Users\Laci Ryan\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\AntiPhishing\2CEDBFBC-DBA8-43AA-B1FD-CC8E6316E3E2.dat moved successfully.
C:\Users\Laci Ryan\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\MSIMGSIZ.DAT moved successfully.

Registry entries deleted on Reboot...

 

Results of screen317's Security Check version 0.99.7
Windows 7 Service Pack 1 (UAC is enabled)
Internet Explorer 8
``````````````````````````````
Antivirus/Firewall Check:
Windows Firewall Enabled!
Microsoft Security Essentials
WMI entry may not exist for antivirus; attempting automatic update.
```````````````````````````````
Anti-malware/Other Utilities Check:
Malwarebytes' Anti-Malware
Java(TM) 6 Update 24
Out of date Java installed!
Adobe Flash Player 10.2.153.1
Adobe Reader X (10.0.1)
Mozilla Firefox (x86 en-US..) Firefox Out of Date!
````````````````````````````````
Process Check:
objlist.exe by Laurent
Windows Defender MSMpEng.exe
Microsoft Security Essentials msseces.exe
Microsoft Security Client Antimalware MsMpEng.exe
Microsoft Security Client Antimalware NisSrv.exe
``````````End of Log````````````

 

ESET found nothing so far but not quite finished. Will let you know the results tomorrow. Thank you for your help and patience. Was able to get Microsoft updates to function manually so that it is a good thing.

I am off to bed so anything else I will have to do tomorrow. Have a great night and thanks again for your help.

 

ESET ultimately found nothing. So no log for you.

 

All processes killed
========== OTL ==========
========== COMMANDS ==========

[EMPTYTEMP]

User: All Users

User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: Laci Ryan
->Temp folder emptied: 1501082 bytes
->Temporary Internet Files folder emptied: 13848128 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 7833364 bytes
->Google Chrome cache emptied: 8937936 bytes
->Apple Safari cache emptied: 0 bytes
->Flash cache emptied: 456 bytes

User: Public
->Temp folder emptied: 0 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 19470 bytes
RecycleBin emptied: 6336950 bytes

Total Files Cleaned = 37.00 mb


[EMPTYFLASH]

User: All Users

User: Default

User: Default User

User: Laci Ryan
->Flash cache emptied: 0 bytes

User: Public

Total Flash Files Cleaned = 0.00 mb



OTL by OldTimer - Version 3.2.22.3 log created on 04032011_135159

Files\Folders moved on Reboot...
C:\Users\Laci Ryan\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\VBYF507H\00b42e3a-b809-49b2-b433-cc45b2bc89d33rd_party_BBS[1].htm moved successfully.
C:\Users\Laci Ryan\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\EGSHK4RC\98511-active-whitesmoke-infection-problems-windows-updates-function-2[1].html moved successfully.
C:\Users\Laci Ryan\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\EGSHK4RC\iframescript[2].htm moved successfully.
C:\Users\Laci Ryan\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\9HHYSO7V\ads[4].htm moved successfully.
C:\Users\Laci Ryan\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\9HHYSO7V\p-01-0VIaSjnOLg[1].gif moved successfully.
C:\Users\Laci Ryan\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\9HHYSO7V\p-01-0VIaSjnOLg[2].gif moved successfully.
C:\Users\Laci Ryan\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\AntiPhishing\2CEDBFBC-DBA8-43AA-B1FD-CC8E6316E3E2.dat moved successfully.
C:\Users\Laci Ryan\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\MSIMGSIZ.DAT moved successfully.

Registry entries deleted on Reboot...

 

She seem to be running fine now. If you are satisfied with the looks of the last OTL log then I will let you know that all of the other steps you have suggested have been implimented.

Thank you so much for your time and effort, we really appreciate it.

If the last log is OK then you may mark the thread resolved with our deepest appreciation!!