Javascript Disabled Detected

You currently have javascript disabled. Several functions may not work. Please re-enable javascript to access full functionality.

Hard Drive Failure Warning/Windows Recovery Virus

Started by dragonledak , Jun 03 2011 11:55 PM

This topic is locked

#16
Essexboy

Posted 04 June 2011 - 12:54 PM

GeekU Moderator

Retired Staff
69,964 posts

Hmm OK run rogue killer again option 6

Then I will use a bigger hammer

Download ComboFix from one of these locations:

Link 1
Link 2

* IMPORTANT !!! Save ComboFix.exe to your Desktop

Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools
Double click on ComboFix.exe & follow the prompts.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.

#17
dragonledak

Posted 04 June 2011 - 11:30 PM

Member

Topic Starter
Member
16 posts

RogueKiller V5.2.2 [06/05/2011] by Tigzy
contact at http://www.sur-la-toile.com
mail: tigzyRK<at>gmail<dot>com
Feedback: http://www.sur-la-to...-Remontees.html

Operating System: Windows 7 (6.1.7600 ) 64 bits version
Started in : Normal mode
User: Chad [Restricted rights]
Mode: Shortcuts HJfix -- Date : 06/04/2011 23:24:00

Bad processes: 0

File attributes restored:
Desktop: Success 0 / Fail 0
Quick launch: Success 0 / Fail 0
Programs: Success 0 / Fail 0
Start menu: Success 0 / Fail 0
User folder: Success 26 / Fail 0
My documents: Success 0 / Fail 0
My favorites: Success 0 / Fail 0
My pictures: Success 0 / Fail 0
My music: Success 0 / Fail 0
My videos: Success 0 / Fail 0
Local drives: Success 0 / Fail 10
Backup: [FOUND] Success 0 / Fail 19

Drives:
[C:] \Device\HarddiskVolume2 -- 0x3 --> Restored
[D:] \Device\CdRom0 -- 0x5 --> Skipped

Finished : << \RKreport[1].txt >>
RKreport[1].txt

As for combo fix it produced no log it gave this messege "Windows cannot find 'NIRCMD'. Make sure you typed the name correctly, and then try again."

#18
Essexboy

Posted 05 June 2011 - 05:16 AM

GeekU Moderator

Retired Staff
69,964 posts

OK lets retry combofix, please download a fresh copy to your desktop

Run OTL

Under the Custom Scans/Fixes box at the bottom, paste in the following

:OTL
[2011/06/03 20:32:25 | 000,000,000 | ---D | C] -- C:\Users\Chad\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows 7 Recovery

:Files
ipconfig /flushdns /c

:Commands
[purity]
[resethosts]
[EMPTYFLASH]
[CREATERESTOREPOINT]
[Reboot]
Then click the Run Fix button at the top
Let the program run unhindered, reboot the PC when it is done
Open OTL again and click the Quick Scan button. Post the log it produces in your next reply.

#19
dragonledak

Posted 05 June 2011 - 12:26 PM

Member

Topic Starter
Member
16 posts

Ok got combofix to run but it has been done with stage 4 for awhile and still no log. Not sure how long it is supposed to take but it has been running for at least an hour, antivirus is disabled so not sure what the problem is becuase it says it typically takes 10 minute so I was thinking like 20ish for my computer.

#20
Essexboy

Posted 05 June 2011 - 12:30 PM

GeekU Moderator

Retired Staff
69,964 posts

OK stop combofix via task manager

Could I have a fresh OTL log please - also what condition is the computer in at the moment

#21
dragonledak

Posted 05 June 2011 - 01:19 PM

Member

Topic Starter
Member
16 posts

Ok my pc is in perfect health according to the health report, I pretty sure the viris is gone my only problem that remains is some files are still hidden from me as in when I go to the microsoft office 2011 folder it says empty. There a total of 19 program files that are empty still. If you want I can make a list of what they are. Other than that mt comp is running like new becuase it is new.

OTL logfile created on: 6/5/2011 1:07:34 PM - Run 4
OTL by OldTimer - Version 3.2.23.0 Folder = C:\Users\Chad
64bit- Home Premium Edition (Version = 6.1.7600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7600.16385)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

3.80 Gb Total Physical Memory | 2.12 Gb Available Physical Memory | 55.76% Memory free
7.60 Gb Paging File | 5.74 Gb Available in Paging File | 75.57% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 582.67 Gb Total Space | 532.19 Gb Free Space | 91.34% Space Free | Partition Type: NTFS

Computer Name: CHAD-PC | User Name: Chad | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Quick Scan | Include 64bit Scans
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2011/06/04 00:07:32 | 000,580,096 | ---- | M] (OldTimer Tools) -- C:\Users\Chad\OTL.exe
PRC - [2011/05/22 13:31:13 | 001,378,352 | ---- | M] (Webroot Software, Inc. ) -- C:\Program Files (x86)\Webroot\Security\Current\Framework\WRTray.exe
PRC - [2011/05/22 13:31:10 | 003,276,136 | ---- | M] (Webroot Software, Inc. ) -- C:\Program Files (x86)\Webroot\Security\Current\Framework\WRConsumerService.exe
PRC - [2011/05/22 13:30:59 | 000,882,440 | ---- | M] (Webroot Software Inc) -- C:\Program Files (x86)\Webroot\Security\Current\Framework\WRFrame.exe
PRC - [2011/05/22 09:39:41 | 000,307,376 | ---- | M] (Google Inc.) -- C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbarUser_32.exe
PRC - [2011/04/26 01:54:18 | 000,232,912 | ---- | M] (Adobe Systems, Inc.) -- C:\Windows\SysWOW64\Macromed\Flash\FlashUtil10i_ActiveX.exe
PRC - [2011/04/18 18:04:58 | 003,900,032 | ---- | M] (Webroot Software, Inc. (www.webroot.com)) -- C:\Program Files (x86)\Webroot\Security\Current\plugins\antimalware\AEI.exe
PRC - [2011/04/16 18:45:11 | 000,130,008 | R--- | M] (Symantec Corporation) -- C:\Program Files (x86)\Norton Internet Security\Engine\18.6.0.29\ccsvchst.exe
PRC - [2010/04/01 10:52:22 | 000,252,728 | ---- | M] (TOSHIBA) -- C:\Program Files (x86)\TOSHIBA\TOSHIBA Sleep Utility\TSleepSrv.exe
PRC - [2010/03/03 15:42:02 | 002,320,920 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe
PRC - [2010/03/03 15:41:58 | 000,268,824 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe
PRC - [2009/12/25 16:21:16 | 000,034,160 | ---- | M] (TOSHIBA CORPORATION) -- C:\Program Files (x86)\TOSHIBA\Utilities\KeNotify.exe

========== Modules (SafeList) ==========

MOD - [2011/06/04 00:07:32 | 000,580,096 | ---- | M] (OldTimer Tools) -- C:\Users\Chad\OTL.exe
MOD - [2010/08/20 23:21:32 | 001,680,896 | ---- | M] (Microsoft Corporation) -- C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7600.16661_none_420fe3fa2b8113bd\comctl32.dll

========== Win32 Services (SafeList) ==========

SRV:64bit: - [2010/09/28 13:30:28 | 000,489,384 | ---- | M] (TOSHIBA Corporation) [Auto | Running] -- C:\Program Files\TOSHIBA\Power Saver\TosCoSrv.exe -- (TosCoSrv)
SRV:64bit: - [2010/09/22 19:10:10 | 000,057,184 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Program Files\Windows Live\Mesh\wlcrasvc.exe -- (wlcrasvc)
SRV:64bit: - [2010/09/01 13:00:06 | 000,911,872 | ---- | M] (Intel® Corporation) [Auto | Running] -- C:\Program Files\Intel\WiMAX\Bin\AppSrv.exe -- (WiMAXAppSrv)
SRV:64bit: - [2010/09/01 12:54:22 | 000,408,576 | ---- | M] (Red Bend Ltd.) [Auto | Running] -- C:\Program Files\Intel\WiMAX\Bin\DMAgent.exe -- (DMAgent)
SRV:64bit: - [2010/07/28 11:27:16 | 000,267,192 | ---- | M] (TOSHIBA Corporation) [Auto | Running] -- C:\Program Files\TOSHIBA\TECO\TecoService.exe -- (TOSHIBA eco Utility Service)
SRV:64bit: - [2010/07/22 17:36:16 | 000,822,192 | ---- | M] (TOSHIBA Corporation) [On_Demand | Running] -- C:\Program Files\TOSHIBA\TPHM\TPCHSrv.exe -- (TPCHSrv)
SRV:64bit: - [2010/07/19 19:08:30 | 001,429,776 | ---- | M] (Intel® Corporation) [Auto | Running] -- C:\Program Files\Intel\WiFi\bin\EvtEng.exe -- (EvtEng)
SRV:64bit: - [2010/07/19 18:48:36 | 000,340,240 | ---- | M] () [On_Demand | Stopped] -- C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe -- (MyWiFiDHCPDNS)
SRV:64bit: - [2010/07/19 18:46:54 | 000,838,928 | ---- | M] (Intel® Corporation) [Auto | Running] -- C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe -- (RegSrvc)
SRV:64bit: - [2010/02/05 18:44:48 | 000,137,560 | ---- | M] (TOSHIBA Corporation) [On_Demand | Running] -- C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSmartSrv.exe -- (TOSHIBA HDD SSD Alert Service)
SRV:64bit: - [2009/10/21 10:30:36 | 000,531,520 | ---- | M] (TOSHIBA Corporation) [Auto | Running] -- C:\Windows\SysNative\ThpSrv.exe -- (Thpsrv)
SRV:64bit: - [2009/07/28 16:48:06 | 000,140,632 | ---- | M] (TOSHIBA Corporation) [Auto | Running] -- C:\Windows\SysNative\TODDSrv.exe -- (TODDSrv)
SRV:64bit: - [2009/07/13 19:41:27 | 001,011,712 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)
SRV:64bit: - [2009/07/13 19:39:46 | 000,027,136 | ---- | M] (Microsoft Corporation) [Unknown | Running] -- C:\Windows\SysNative\svchost.exe -- (gpsvc)
SRV - [2011/05/22 13:31:10 | 003,276,136 | ---- | M] (Webroot Software, Inc. ) [Auto | Running] -- C:\Program Files (x86)\Webroot\Security\Current\Framework\WRConsumerService.exe -- (WRConsumerService)
SRV - [2011/04/18 18:04:58 | 003,900,032 | ---- | M] (Webroot Software, Inc. (www.webroot.com)) [Auto | Running] -- C:\Program Files (x86)\Webroot\Security\current\plugins\antimalware\AEI.exe -- (WebrootSpySweeperService)
SRV - [2011/04/16 18:45:11 | 000,130,008 | R--- | M] (Symantec Corporation) [Unknown | Running] -- C:\Program Files (x86)\Norton Internet Security\Engine\18.6.0.29\ccSvcHst.exe -- (NIS)
SRV - [2010/11/29 14:58:30 | 000,054,136 | ---- | M] (TOSHIBA Corporation) [On_Demand | Running] -- C:\Program Files (x86)\TOSHIBA\TOSHIBA Service Station\TMachInfo.exe -- (TMachInfo)
SRV - [2010/03/18 13:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)
SRV - [2010/03/03 15:42:02 | 002,320,920 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe -- (UNS) Intel®
SRV - [2010/03/03 15:41:58 | 000,268,824 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe -- (LMS) Intel®
SRV - [2009/06/10 15:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)

========== Driver Services (SafeList) ==========

DRV:64bit: - [2011/05/21 07:31:30 | 000,174,200 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\SYMEVENT64x86.SYS -- (SymEvent)
DRV:64bit: - [2011/04/18 18:05:08 | 000,137,760 | ---- | M] (Webroot Software, Inc. (www.webroot.com)) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\ssidrv.sys -- (ssidrv)
DRV:64bit: - [2011/04/18 18:05:06 | 000,058,480 | ---- | M] (Webroot Software, Inc. (www.webroot.com)) [File_System | Auto | Running] -- C:\Windows\SysNative\drivers\ssfmonm.sys -- (ssfmonm)
DRV:64bit: - [2011/03/30 21:00:09 | 000,744,568 | ---- | M] (Symantec Corporation) [File_System | On_Demand | Running] -- C:\Windows\SysNative\drivers\NISx64\1206000.01D\srtsp64.sys -- (SRTSP)
DRV:64bit: - [2011/03/30 21:00:09 | 000,040,568 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\NISx64\1206000.01D\srtspx64.sys -- (SRTSPX) Symantec Real Time Storage Protection (PEL)
DRV:64bit: - [2011/03/21 18:39:49 | 000,382,584 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\NISx64\1206000.01D\symnets.sys -- (SymNetS)
DRV:64bit: - [2011/03/14 20:31:23 | 000,912,504 | ---- | M] (Symantec Corporation) [File_System | Boot | Running] -- C:\Windows\SysNative\drivers\NISx64\1206000.01D\symefa64.sys -- (SymEFA)
DRV:64bit: - [2011/01/27 00:47:10 | 000,450,680 | ---- | M] (Symantec Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\NISx64\1206000.01D\symds64.sys -- (SymDS)
DRV:64bit: - [2011/01/26 23:07:06 | 000,171,128 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\NISx64\1206000.01D\ironx64.sys -- (SymIRON)
DRV:64bit: - [2010/07/29 06:10:42 | 010,610,400 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\igdkmd64.sys -- (igfx)
DRV:64bit: - [2010/07/28 12:46:18 | 007,821,312 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\NETwNs64.sys -- (NETwNs64) ___ Intel®
DRV:64bit: - [2010/06/21 18:45:56 | 000,287,232 | ---- | M] (Intel® Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\IntcDAud.sys -- (IntcDAud) Intel®
DRV:64bit: - [2010/06/18 11:38:06 | 000,039,832 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\WDKMD.sys -- (wdkmd)
DRV:64bit: - [2010/05/18 17:02:48 | 000,164,464 | ---- | M] (JMicron Technology Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\jmcr.sys -- (JMCR)
DRV:64bit: - [2010/05/16 18:28:36 | 000,175,104 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\bpmp.sys -- (bpmp) Intel® Centrino®
DRV:64bit: - [2010/05/16 18:28:28 | 000,081,920 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\bpusb.sys -- (bpusb)
DRV:64bit: - [2010/05/16 18:28:26 | 000,071,168 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\bpenum.sys -- (bpenum)
DRV:64bit: - [2010/05/08 19:38:56 | 000,482,384 | ---- | M] (TOSHIBA Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\tos_sps64.sys -- (tos_sps64)
DRV:64bit: - [2010/05/03 15:44:02 | 000,331,880 | ---- | M] (Realtek ) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Rt64win7.sys -- (RTL8167)
DRV:64bit: - [2010/03/10 19:51:32 | 000,316,464 | ---- | M] (Synaptics Incorporated) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\SynTP.sys -- (SynTP)
DRV:64bit: - [2010/02/27 08:32:14 | 000,158,976 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Impcd.sys -- (Impcd)
DRV:64bit: - [2010/01/15 13:22:08 | 000,538,136 | ---- | M] (Intel Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\iaStor.sys -- (iaStor)
DRV:64bit: - [2009/10/09 20:41:20 | 000,109,056 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\sdbus.sys -- (sdbus)
DRV:64bit: - [2009/09/17 13:54:54 | 000,056,344 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\HECIx64.sys -- (HECIx64) Intel®
DRV:64bit: - [2009/07/30 22:02:36 | 000,044,912 | ---- | M] (COMPAL ELECTRONIC INC.) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\LPCFilter.sys -- (LPCFilter)
DRV:64bit: - [2009/07/30 21:22:04 | 000,027,784 | ---- | M] (TOSHIBA Corporation.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\tdcmdpst.sys -- (tdcmdpst)
DRV:64bit: - [2009/07/14 16:31:18 | 000,026,840 | ---- | M] (TOSHIBA Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\TVALZ_O.SYS -- (TVALZ)
DRV:64bit: - [2009/07/13 19:52:21 | 000,106,576 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata)
DRV:64bit: - [2009/07/13 19:52:21 | 000,028,752 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata)
DRV:64bit: - [2009/07/13 19:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs)
DRV:64bit: - [2009/07/13 19:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2)
DRV:64bit: - [2009/07/13 19:47:48 | 000,077,888 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD)
DRV:64bit: - [2009/07/13 19:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor)
DRV:64bit: - [2009/07/13 18:00:24 | 000,009,728 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\acpials.sys -- (acpials)
DRV:64bit: - [2009/06/29 17:16:20 | 000,014,784 | ---- | M] (TOSHIBA Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\Thpevm.sys -- (Thpevm)
DRV:64bit: - [2009/06/29 11:25:22 | 000,034,880 | ---- | M] (TOSHIBA Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\thpdrv.sys -- (Thpdrv)
DRV:64bit: - [2009/06/22 18:06:38 | 000,035,008 | ---- | M] (TOSHIBA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\PGEffect.sys -- (PGEffect)
DRV:64bit: - [2009/06/19 20:15:22 | 000,014,472 | ---- | M] (TOSHIBA Corporation) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\TVALZFL.sys -- (TVALZFL)
DRV:64bit: - [2009/06/10 14:38:56 | 000,000,308 | ---- | M] () [File_System | On_Demand | Running] -- C:\Windows\SysNative\wbem\ntfs.mof -- (Ntfs)
DRV:64bit: - [2009/06/10 14:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv)
DRV:64bit: - [2009/06/10 14:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv)
DRV:64bit: - [2009/06/10 14:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a)
DRV:64bit: - [2009/06/10 14:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir)
DRV - [2011/05/20 19:11:19 | 002,011,768 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\Definitions\VirusDefs\20110604.003\EX64.SYS -- (NAVEX15)
DRV - [2011/05/20 19:11:19 | 000,481,912 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys -- (eeCtrl)
DRV - [2011/05/20 19:11:19 | 000,136,824 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys -- (EraserUtilRebootDrv)
DRV - [2011/05/20 19:11:19 | 000,117,880 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\Definitions\VirusDefs\20110604.003\ENG64.SYS -- (NAVENG)
DRV - [2011/05/18 00:36:02 | 001,127,032 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\Definitions\BASHDefs\20110518.001\BHDrvx64.sys -- (BHDrvx64)
DRV - [2011/03/14 12:58:28 | 000,476,792 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\Definitions\IPSDefs\20110526.002\IDSviA64.sys -- (IDSVia64)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm

IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-21-3161015757-2683380795-3781861229-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://start.toshiba.com/g/
IE - HKU\S-1-5-21-3161015757-2683380795-3781861229-1000\SOFTWARE\Microsoft\Internet Explorer\Main,SearchDefaultBranded = 1
IE - HKU\S-1-5-21-3161015757-2683380795-3781861229-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://start.toshiba.com/g/
IE - HKU\S-1-5-21-3161015757-2683380795-3781861229-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

FF - HKLM\software\mozilla\Firefox\Extensions\\{BBDA0591-3099-440a-AA10-41764D9DB4DB}: C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\IPSFFPlgn\ [2011/05/22 09:28:02 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Firefox\Extensions\\{2D3F3651-74B9-4795-BDEC-6DA2F431CB62}: C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\coFFPlgn\ [2011/05/21 07:31:15 | 000,000,000 | ---D | M]

O1 HOSTS File: ([2011/06/05 12:58:55 | 000,000,098 | ---- | M]) - C:\Windows\SysNative\drivers\etc\Hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: ::1 localhost
O2:64bit: - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
O2:64bit: - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.7.6406.1642\swg64.dll (Google Inc.)
O2 - BHO: (Symantec NCO BHO) - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files (x86)\Norton Internet Security\Engine\18.6.0.29\coieplg.dll (Symantec Corporation)
O2 - BHO: (Symantec Intrusion Prevention) - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files (x86)\Norton Internet Security\Engine\18.6.0.29\ips\ipsbho.dll (Symantec Corporation)
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files (x86)\Google\GoogleToolbarNotifier\5.7.6406.1642\swg.dll (Google Inc.)
O2 - BHO: (TOSHIBA Media Controller Plug-in) - {F3C88694-EFFA-4d78-B409-54B7B2535B14} - C:\Program Files (x86)\TOSHIBA\TOSHIBA Media Controller Plug-in\TOSHIBAMediaControllerIE.dll (<TOSHIBA>)
O3:64bit: - HKLM\..\Toolbar: (Google Toolbar) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
O3:64bit: - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3 - HKLM\..\Toolbar: (Norton Toolbar) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton Internet Security\Engine\18.6.0.29\coieplg.dll (Symantec Corporation)
O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3:64bit: - HKU\.DEFAULT\..\Toolbar\WebBrowser: (Google Toolbar) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
O3:64bit: - HKU\S-1-5-18\..\Toolbar\WebBrowser: (Google Toolbar) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
O3:64bit: - HKU\S-1-5-21-3161015757-2683380795-3781861229-1000\..\Toolbar\WebBrowser: (Google Toolbar) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
O3 - HKU\S-1-5-21-3161015757-2683380795-3781861229-1000\..\Toolbar\WebBrowser: (Norton Toolbar) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton Internet Security\Engine\18.6.0.29\coieplg.dll (Symantec Corporation)
O4:64bit: - HKLM..\Run: [] File not found
O4:64bit: - HKLM..\Run: [00TCrdMain] C:\Program Files\TOSHIBA\FlashCards\TCrdMain.exe (TOSHIBA Corporation)
O4:64bit: - HKLM..\Run: [HotKeysCmds] C:\windows\SysNative\hkcmd.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [HSON] C:\Program Files\TOSHIBA\TBS\HSON.exe (TOSHIBA Corporation)
O4:64bit: - HKLM..\Run: [IgfxTray] C:\windows\SysNative\igfxtray.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [IntelWireless] C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe (Intel® Corporation)
O4:64bit: - HKLM..\Run: [IntelWirelessWiMAX] C:\Program Files\Intel\WiMAX\Bin\WiMAXCU.exe (Intel® Corporation)
O4:64bit: - HKLM..\Run: [Persistence] C:\windows\SysNative\igfxpers.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [RtHDVBg] C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe (Realtek Semiconductor)
O4:64bit: - HKLM..\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Realtek Semiconductor)
O4:64bit: - HKLM..\Run: [SmartFaceVWatcher] C:\Program Files\TOSHIBA\SmartFaceV\SmartFaceVWatcher.exe (TOSHIBA Corporation)
O4:64bit: - HKLM..\Run: [SmoothView] C:\Program Files\TOSHIBA\SmoothView\SmoothView.exe (TOSHIBA Corporation)
O4:64bit: - HKLM..\Run: [Teco] C:\Program Files\TOSHIBA\TECO\Teco.exe (TOSHIBA Corporation)
O4:64bit: - HKLM..\Run: [ThpSrv] C:\windows\SysNative\thpsrv.exe (TOSHIBA Corporation)
O4:64bit: - HKLM..\Run: [TosNC] C:\Program Files\TOSHIBA\BulletinBoard\TosNcCore.exe (TOSHIBA Corporation)
O4:64bit: - HKLM..\Run: [TosReelTimeMonitor] C:\Program Files\TOSHIBA\ReelTime\TosReelTimeMonitor.exe (TOSHIBA Corporation)
O4:64bit: - HKLM..\Run: [TosSENotify] C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosWaitSrv.exe (TOSHIBA Corporation)
O4:64bit: - HKLM..\Run: [TosVolRegulator] C:\Program Files\TOSHIBA\TosVolRegulator\TosVolRegulator.exe (TOSHIBA Corporation)
O4:64bit: - HKLM..\Run: [TosWaitSrv] C:\Program Files\TOSHIBA\TPHM\TosWaitSrv.exe (TOSHIBA Corporation)
O4:64bit: - HKLM..\Run: [TPwrMain] C:\Program Files\TOSHIBA\Power Saver\TPwrMain.exe (TOSHIBA Corporation)
O4 - HKLM..\Run: [KeNotify] C:\Program Files (x86)\TOSHIBA\Utilities\KeNotify.exe (TOSHIBA CORPORATION)
O4 - HKLM..\Run: [SVPWUTIL] C:\Program Files (x86)\TOSHIBA\Utilities\SVPWUTIL.exe (TOSHIBA CORPORATION)
O4 - HKLM..\Run: [ToshibaAppPlace] C:\Program Files (x86)\Toshiba\Toshiba App Place\ToshibaAppPlace.exe (Toshiba)
O4 - HKLM..\Run: [ToshibaServiceStation] C:\Program Files (x86)\TOSHIBA\TOSHIBA Service Station\ToshibaServiceStation.exe (TOSHIBA Corporation)
O4 - HKLM..\Run: [TSleepSrv] File not found
O4 - HKLM..\Run: [TWebCamera] C:\Program Files (x86)\TOSHIBA\TOSHIBA Web Camera Application\TWebCamera.exe (TOSHIBA CORPORATION.)
O4 - HKLM..\Run: [WebrootTrayApp] C:\Program Files (x86)\Webroot\Security\Current\Framework\WRTray.exe (Webroot Software, Inc. )
O4 - HKU\S-1-5-21-3161015757-2683380795-3781861229-1000..\Run: [AROReminder] File not found
O4 - Startup: C:\Users\Chad\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Neverwinter Nights Registration.lnk = C:\NeverwinterNights\NWN\ereg\ATR1.EXE (Leader Technologies/Atari)
O4 - Startup: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Best Buy pc app.lnk = C:\ProgramData\Best Buy pc app\ClickOnceSetup.exe (Microsoft)
O4 - Startup: C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Best Buy pc app.lnk = C:\ProgramData\Best Buy pc app\ClickOnceSetup.exe (Microsoft)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\control panel present
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\restrictions present
O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\restrictions present
O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\restrictions present
O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\restrictions present
O7 - HKU\S-1-5-21-3161015757-2683380795-3781861229-1000\Software\Policies\Microsoft\Internet Explorer\restrictions present
O8:64bit: - Extra context menu item: Google Sidewiki... - C:\Program Files (x86)\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_6CE5017F567343CA.dll (Google Inc.)
O8 - Extra context menu item: Google Sidewiki... - C:\Program Files (x86)\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_6CE5017F567343CA.dll (Google Inc.)
O13 - gopher Prefix: missing
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_20)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 205.171.3.25 205.171.2.25
O18:64bit: - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\wlmailhtml {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\wlpg {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - Reg Error: Key error. File not found
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\windows\SysNative\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O20:64bit: - Winlogon\Notify\igfxcui: DllName - Reg Error: Key error. - C:\windows\SysNative\igfxdev.dll (Intel Corporation)
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found.
O30:64bit: - LSA: Authentication Packages - (ows\w) - File not found
O30 - LSA: Authentication Packages - (ows\w) - File not found
O30:64bit: - LSA: Security Packages - (椀渀搀漀眀猀) - File not found
O30:64bit: - LSA: Security Packages - (ᘀ堀㄀) - File not found
O30 - LSA: Security Packages - (椀渀搀漀眀猀) - File not found
O30 - LSA: Security Packages - (ᘀ堀㄀) - File not found
O32 - HKLM CDRom: AutoRun - 1
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKU\S-1-5-21-3161015757-2683380795-3781861229-1000\...exe [@ = exefile] -- Reg Error: Key error. File not found

========== Files/Folders - Created Within 30 Days ==========

[2011/06/05 10:43:44 | 000,000,000 | --SD | C] -- C:\ComboFix
[2011/06/05 10:04:08 | 000,518,144 | ---- | C] (SteelWerX) -- C:\windows\SWREG.exe
[2011/06/05 10:04:08 | 000,406,528 | ---- | C] (SteelWerX) -- C:\windows\SWSC.exe
[2011/06/05 10:04:08 | 000,060,416 | ---- | C] (NirSoft) -- C:\windows\NIRCMD.exe
[2011/06/05 10:03:04 | 000,000,000 | ---D | C] -- C:\windows\ERDNT
[2011/06/05 10:02:33 | 000,000,000 | -HSD | C] -- C:\Config.Msi
[2011/06/05 09:54:25 | 000,000,000 | ---D | C] -- C:\Qoobox
[2011/06/05 09:53:32 | 004,111,938 | R--- | C] (Swearware) -- C:\Users\Chad\Desktop\ComboFix.exe
[2011/06/04 23:24:00 | 000,000,000 | ---D | C] -- C:\Users\Chad\Desktop\RK_Quarantine
[2011/06/04 12:00:58 | 000,000,000 | ---D | C] -- C:\Users\Chad\AppData\Roaming\InstallShield
[2011/06/04 11:20:55 | 000,000,000 | ---D | C] -- C:\Users\Chad\AppData\Local\ElevatedDiagnostics
[2011/06/04 09:10:02 | 000,000,000 | ---D | C] -- C:\_OTL
[2011/06/04 00:07:30 | 000,580,096 | ---- | C] (OldTimer Tools) -- C:\Users\Chad\OTL.exe
[2011/06/04 00:01:42 | 000,000,000 | ---D | C] -- C:\Users\Chad\RK_Quarantine
[2011/06/03 22:24:57 | 000,000,000 | ---D | C] -- C:\windows\Minidump
[2011/06/03 20:21:37 | 000,000,000 | ---D | C] -- C:\ProgramData\STOPzilla!
[2011/05/24 12:18:51 | 000,000,000 | ---D | C] -- C:\back up nwn executable
[2011/05/23 22:43:37 | 000,000,000 | ---D | C] -- C:\Users\Chad\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WinRAR
[2011/05/23 22:43:37 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinRAR
[2011/05/23 22:34:39 | 000,000,000 | ---D | C] -- C:\Program Files\WinRAR
[2011/05/23 22:33:00 | 000,000,000 | ---D | C] -- C:\Users\Chad\AppData\Roaming\WinRAR
[2011/05/23 22:04:12 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ARO 2011
[2011/05/23 22:04:10 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\ARO 2011
[2011/05/23 22:01:53 | 000,000,000 | ---D | C] -- C:\Users\Chad\AppData\Local\OpenCandy
[2011/05/23 22:01:50 | 000,000,000 | ---D | C] -- C:\Users\Chad\AppData\Roaming\OpenCandy
[2011/05/23 19:23:07 | 000,000,000 | ---D | C] -- C:\Users\Chad\AppData\Roaming\Leadertech
[2011/05/23 19:23:01 | 000,000,000 | ---D | C] -- C:\Users\Chad\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\GameSpy Arcade
[2011/05/23 19:23:01 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\GameSpy Arcade
[2011/05/23 19:22:54 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\GameSpy Arcade
[2011/05/23 19:18:06 | 000,000,000 | ---D | C] -- C:\Users\Chad\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Neverwinter Nights
[2011/05/23 19:18:06 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Neverwinter Nights
[2011/05/23 19:05:48 | 000,000,000 | ---D | C] -- C:\NeverwinterNights
[2011/05/23 15:06:32 | 000,000,000 | ---D | C] -- C:\ProgramData\FileCure
[2011/05/22 20:31:02 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\EasyInfo
[2011/05/22 20:26:24 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\EA Games
[2011/05/22 13:34:42 | 000,137,760 | ---- | C] (Webroot Software, Inc. (www.webroot.com)) -- C:\windows\SysNative\drivers\ssidrv.sys
[2011/05/22 13:34:42 | 000,058,480 | ---- | C] (Webroot Software, Inc. (www.webroot.com)) -- C:\windows\SysNative\drivers\ssfmonm.sys
[2011/05/22 13:31:21 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Webroot
[2011/05/22 13:31:20 | 000,000,000 | ---D | C] -- C:\ProgramData\{3C707538-83E3-4DAC-9218-6D79F3B9FEA5}
[2011/05/22 13:30:32 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Webroot
[2011/05/22 13:29:23 | 000,000,000 | ---D | C] -- C:\ProgramData\Webroot
[2011/05/22 13:29:22 | 000,000,000 | ---D | C] -- C:\Users\Chad\AppData\Local\PackageAware
[2011/05/22 13:17:17 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office
[2011/05/22 13:16:49 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\DESIGNER
[2011/05/22 13:13:43 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft Office
[2011/05/22 13:13:36 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Microsoft Analysis Services
[2011/05/22 13:13:18 | 000,000,000 | ---D | C] -- C:\Users\Chad\AppData\Local\Microsoft Help
[2011/05/22 13:13:16 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft Help
[2011/05/22 13:13:03 | 000,000,000 | R--D | C] -- C:\MSOCache
[2011/05/22 12:38:01 | 000,000,000 | ---D | C] -- C:\Users\Chad\AppData\Local\Diagnostics
[2011/05/22 12:33:16 | 000,000,000 | ---D | C] -- C:\Users\Chad\AppData\Local\CrashDumps
[2011/05/22 09:34:08 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Microsoft.NET
[2011/05/22 09:25:20 | 000,000,000 | ---D | C] -- C:\windows\SysWow64\Wat
[2011/05/22 09:25:20 | 000,000,000 | ---D | C] -- C:\windows\SysNative\Wat
[2011/05/20 20:42:29 | 000,000,000 | ---D | C] -- C:\Users\Chad\AppData\Roaming\Google
[2011/05/20 20:42:28 | 000,000,000 | ---D | C] -- C:\Users\Chad\AppData\Local\Google
[2011/05/20 20:21:35 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Symantec Shared
[2011/05/20 19:08:44 | 000,000,000 | ---D | C] -- C:\Users\Chad\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Games
[2011/05/20 17:44:12 | 000,000,000 | ---D | C] -- C:\Users\Chad\AppData\Local\TOSHIBA_Corporation
[2011/05/20 17:38:58 | 000,000,000 | ---D | C] -- C:\Users\Chad\AppData\Roaming\Macromedia
[2011/05/20 17:38:56 | 000,000,000 | ---D | C] -- C:\Users\Chad\AppData\Roaming\Adobe
[2011/05/20 17:21:14 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\EA Games
[2011/05/20 17:11:13 | 000,000,000 | ---D | C] -- C:\Users\Chad\AppData\Local\Toshiba
[2011/05/20 17:09:16 | 000,000,000 | ---D | C] -- C:\Users\Chad\AppData\Roaming\Toshiba
[2011/05/20 17:08:48 | 000,000,000 | ---D | C] -- C:\Users\Chad\AppData\Local\Apps
[2011/05/20 17:08:41 | 000,000,000 | ---D | C] -- C:\Users\Chad\AppData\Local\Deployment
[2011/05/20 17:08:13 | 000,000,000 | ---D | C] -- C:\Users\Chad\AppData\Roaming\Intel
[2011/05/20 17:06:29 | 000,000,000 | R--D | C] -- C:\Users\Chad\Searches
[2011/05/20 17:06:29 | 000,000,000 | R--D | C] -- C:\Users\Chad\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools
[2011/05/20 17:06:29 | 000,000,000 | ---D | C] -- C:\Users\Chad\Application Data\Microsoft\Internet Explorer\Quick Launch\User Pinned
[2011/05/20 17:06:19 | 000,000,000 | ---D | C] -- C:\Users\Chad\AppData\Roaming\Identities
[2011/05/20 17:06:15 | 000,000,000 | R--D | C] -- C:\Users\Chad\Contacts
[2011/05/20 17:06:12 | 000,000,000 | ---D | C] -- C:\Users\Chad\AppData\Local\VirtualStore
[2011/05/20 17:05:22 | 000,000,000 | ---D | C] -- C:\Users\Chad\AppData\Roaming\WinBatch
[2011/05/20 17:04:36 | 000,000,000 | -HSD | C] -- C:\Users\Chad\AppData\Local\Temporary Internet Files
[2011/05/20 17:04:36 | 000,000,000 | -HSD | C] -- C:\Users\Chad\Templates
[2011/05/20 17:04:36 | 000,000,000 | -HSD | C] -- C:\Users\Chad\Start Menu
[2011/05/20 17:04:36 | 000,000,000 | -HSD | C] -- C:\Users\Chad\SendTo
[2011/05/20 17:04:36 | 000,000,000 | -HSD | C] -- C:\Users\Chad\Recent
[2011/05/20 17:04:36 | 000,000,000 | -HSD | C] -- C:\Users\Chad\PrintHood
[2011/05/20 17:04:36 | 000,000,000 | -HSD | C] -- C:\Users\Chad\NetHood
[2011/05/20 17:04:36 | 000,000,000 | -HSD | C] -- C:\Users\Chad\Documents\My Videos
[2011/05/20 17:04:36 | 000,000,000 | -HSD | C] -- C:\Users\Chad\Documents\My Pictures
[2011/05/20 17:04:36 | 000,000,000 | -HSD | C] -- C:\Users\Chad\Documents\My Music
[2011/05/20 17:04:36 | 000,000,000 | -HSD | C] -- C:\Users\Chad\My Documents
[2011/05/20 17:04:36 | 000,000,000 | -HSD | C] -- C:\Users\Chad\Local Settings
[2011/05/20 17:04:36 | 000,000,000 | -HSD | C] -- C:\Users\Chad\AppData\Local\History
[2011/05/20 17:04:36 | 000,000,000 | -HSD | C] -- C:\Users\Chad\Cookies
[2011/05/20 17:04:36 | 000,000,000 | -HSD | C] -- C:\Users\Chad\Application Data
[2011/05/20 17:04:36 | 000,000,000 | -HSD | C] -- C:\Users\Chad\AppData\Local\Application Data
[2011/05/20 17:04:30 | 000,000,000 | --SD | C] -- C:\Users\Chad\AppData\Roaming\Microsoft
[2011/05/20 17:04:30 | 000,000,000 | R--D | C] -- C:\Users\Chad\Videos
[2011/05/20 17:04:30 | 000,000,000 | R--D | C] -- C:\Users\Chad\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
[2011/05/20 17:04:30 | 000,000,000 | R--D | C] -- C:\Users\Chad\Saved Games
[2011/05/20 17:04:30 | 000,000,000 | R--D | C] -- C:\Users\Chad\Pictures
[2011/05/20 17:04:30 | 000,000,000 | R--D | C] -- C:\Users\Chad\Music
[2011/05/20 17:04:30 | 000,000,000 | R--D | C] -- C:\Users\Chad\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance
[2011/05/20 17:04:30 | 000,000,000 | R--D | C] -- C:\Users\Chad\Links
[2011/05/20 17:04:30 | 000,000,000 | R--D | C] -- C:\Users\Chad\Favorites
[2011/05/20 17:04:30 | 000,000,000 | R--D | C] -- C:\Users\Chad\Downloads
[2011/05/20 17:04:30 | 000,000,000 | R--D | C] -- C:\Users\Chad\My Documents
[2011/05/20 17:04:30 | 000,000,000 | R--D | C] -- C:\Users\Chad\Desktop
[2011/05/20 17:04:30 | 000,000,000 | R--D | C] -- C:\Users\Chad\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories
[2011/05/20 17:04:30 | 000,000,000 | ---D | C] -- C:\Users\Chad\AppData\Local\Temp
[2011/05/20 17:04:30 | 000,000,000 | ---D | C] -- C:\Users\Chad\AppData\Local\Microsoft
[2011/05/20 17:04:30 | 000,000,000 | ---D | C] -- C:\Users\Chad\AppData\Roaming\Media Center Programs
[2011/05/20 17:04:30 | 000,000,000 | ---D | C] -- C:\Users\Chad\AppData
[2 C:\*.tmp files -> C:\*.tmp -> ]
[1 C:\windows\*.tmp files -> C:\windows\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2011/06/05 13:10:30 | 000,016,304 | -H-- | M] () -- C:\windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2011/06/05 13:10:30 | 000,016,304 | -H-- | M] () -- C:\windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2011/06/05 13:07:25 | 000,726,316 | ---- | M] () -- C:\windows\SysNative\PerfStringBackup.INI
[2011/06/05 13:07:25 | 000,624,178 | ---- | M] () -- C:\windows\SysNative\perfh009.dat
[2011/06/05 13:07:25 | 000,106,522 | ---- | M] () -- C:\windows\SysNative\perfc009.dat
[2011/06/05 13:03:20 | 000,000,908 | ---- | M] () -- C:\windows\tasks\GoogleUpdateTaskMachineCore.job
[2011/06/05 13:02:56 | 000,067,584 | --S- | M] () -- C:\windows\bootstat.dat
[2011/06/05 13:02:49 | 3059,748,864 | -HS- | M] () -- C:\hiberfil.sys
[2011/06/05 12:58:55 | 000,000,098 | ---- | M] () -- C:\windows\SysNative\drivers\etc\Hosts
[2011/06/05 12:58:22 | 001,607,420 | ---- | M] () -- C:\windows\SysNative\drivers\NISx64\1206000.01D\Cat.DB
[2011/06/05 12:13:00 | 000,000,912 | ---- | M] () -- C:\windows\tasks\GoogleUpdateTaskMachineUA.job
[2011/06/05 10:03:38 | 004,111,938 | R--- | M] (Swearware) -- C:\Users\Chad\Desktop\ComboFix.exe
[2011/06/04 23:25:46 | 000,000,104 | ---- | M] () -- C:\windows\SysNative\drivers\kgpfr2.cfg
[2011/06/04 23:25:45 | 000,001,400 | ---- | M] () -- C:\windows\SysNative\drivers\kgpcpy.cfg
[2011/06/04 00:07:32 | 000,580,096 | ---- | M] (OldTimer Tools) -- C:\Users\Chad\OTL.exe
[2011/06/03 22:24:42 | 510,135,446 | ---- | M] () -- C:\windows\MEMORY.DMP
[2011/05/29 19:07:48 | 000,001,092 | ---- | M] () -- C:\Users\Chad\Desktop\nwtoolset - Shortcut.lnk
[2011/05/27 10:30:34 | 000,342,720 | ---- | M] () -- C:\windows\SysNative\FNTCACHE.DAT
[2011/05/24 12:23:52 | 000,001,128 | ---- | M] () -- C:\Users\Chad\Desktop\nwmain-169-hg - Shortcut.lnk
[2011/05/23 22:05:38 | 000,001,883 | ---- | M] () -- C:\Users\Chad\Application Data\Microsoft\Internet Explorer\Quick Launch\Check PC For Errors.lnk
[2011/05/23 19:25:06 | 000,001,055 | ---- | M] () -- C:\Users\Chad\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Neverwinter Nights Registration.lnk
[2011/05/21 07:31:30 | 000,174,200 | ---- | M] (Symantec Corporation) -- C:\windows\SysNative\drivers\SYMEVENT64x86.SYS
[2011/05/21 07:31:30 | 000,007,488 | ---- | M] () -- C:\windows\SysNative\drivers\SYMEVENT64x86.CAT
[2011/05/21 07:31:30 | 000,000,855 | ---- | M] () -- C:\windows\SysNative\drivers\SYMEVENT64x86.INF
[2011/05/20 20:42:19 | 000,001,452 | ---- | M] () -- C:\Users\Chad\Application Data\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk
[2011/05/20 18:03:45 | 000,039,252 | ---- | M] () -- C:\windows\SysWow64\license.rtf
[2011/05/20 18:03:45 | 000,039,252 | ---- | M] () -- C:\windows\SysNative\license.rtf
[2011/05/20 17:05:47 | 000,000,013 | RHS- | M] () -- C:\windows\SysNative\drivers\fbd.sys
[2 C:\*.tmp files -> C:\*.tmp -> ]
[1 C:\windows\*.tmp files -> C:\windows\*.tmp -> ]

========== Files Created - No Company Name ==========

[2011/06/05 10:04:08 | 000,256,512 | ---- | C] () -- C:\windows\PEV.exe
[2011/06/05 10:04:08 | 000,208,896 | ---- | C] () -- C:\windows\MBR.exe
[2011/06/05 10:04:08 | 000,098,816 | ---- | C] () -- C:\windows\sed.exe
[2011/06/05 10:04:08 | 000,080,412 | ---- | C] () -- C:\windows\grep.exe
[2011/06/05 10:04:08 | 000,068,096 | ---- | C] () -- C:\windows\zip.exe
[2011/06/04 23:25:46 | 000,000,104 | ---- | C] () -- C:\windows\SysNative\drivers\kgpfr2.cfg
[2011/06/04 11:54:36 | 000,001,400 | ---- | C] () -- C:\windows\SysNative\drivers\kgpcpy.cfg
[2011/06/03 22:24:42 | 510,135,446 | ---- | C] () -- C:\windows\MEMORY.DMP
[2011/05/29 19:07:48 | 000,001,092 | ---- | C] () -- C:\Users\Chad\Desktop\nwtoolset - Shortcut.lnk
[2011/05/24 12:23:52 | 000,001,128 | ---- | C] () -- C:\Users\Chad\Desktop\nwmain-169-hg - Shortcut.lnk
[2011/05/23 22:04:13 | 000,001,883 | ---- | C] () -- C:\Users\Chad\Application Data\Microsoft\Internet Explorer\Quick Launch\Check PC For Errors.lnk
[2011/05/23 19:25:06 | 000,001,055 | ---- | C] () -- C:\Users\Chad\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Neverwinter Nights Registration.lnk
[2011/05/22 13:34:42 | 000,030,424 | ---- | C] () -- C:\windows\SysWow64\wrLZMA.dll
[2011/05/22 13:34:42 | 000,019,576 | ---- | C] () -- C:\windows\SysNative\SsiEfr.exe
[2011/05/20 20:42:19 | 000,001,452 | ---- | C] () -- C:\Users\Chad\Application Data\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk
[2011/05/20 17:06:32 | 000,001,458 | ---- | C] () -- C:\Users\Chad\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
[2011/05/20 17:05:47 | 000,000,013 | RHS- | C] () -- C:\windows\SysNative\drivers\fbd.sys
[2011/05/20 17:04:30 | 000,000,290 | ---- | C] () -- C:\Users\Chad\Application Data\Microsoft\Internet Explorer\Quick Launch\Shows Desktop.lnk
[2011/05/20 17:04:30 | 000,000,272 | ---- | C] () -- C:\Users\Chad\Application Data\Microsoft\Internet Explorer\Quick Launch\Window Switcher.lnk
[2010/07/29 06:08:46 | 000,127,868 | ---- | C] () -- C:\windows\SysWow64\igcompkrng575.bin
[2010/07/29 06:08:44 | 000,104,796 | ---- | C] () -- C:\windows\SysWow64\igfcg575m.bin
[2010/07/29 06:08:42 | 000,870,560 | ---- | C] () -- C:\windows\SysWow64\igkrng575.bin
[2010/07/29 05:14:38 | 000,208,896 | ---- | C] () -- C:\windows\SysWow64\iglhsip32.dll
[2010/07/29 05:14:38 | 000,143,360 | ---- | C] () -- C:\windows\SysWow64\iglhcp32.dll
[2009/07/13 23:38:36 | 000,067,584 | --S- | C] () -- C:\windows\bootstat.dat
[2009/07/13 20:35:51 | 000,000,741 | ---- | C] () -- C:\windows\SysWow64\NOISE.DAT
[2009/07/13 20:34:42 | 000,215,943 | ---- | C] () -- C:\windows\SysWow64\dssec.dat
[2009/07/13 18:10:29 | 000,043,131 | ---- | C] () -- C:\windows\mib.bin
[2009/07/13 17:42:10 | 000,064,000 | ---- | C] () -- C:\windows\SysWow64\BWContextHandler.dll
[2009/07/13 15:03:59 | 000,364,544 | ---- | C] () -- C:\windows\SysWow64\msjetoledb40.dll
[2009/06/10 15:26:10 | 000,673,088 | ---- | C] () -- C:\windows\SysWow64\mlang.dat
[2009/04/28 05:37:00 | 000,028,672 | ---- | C] () -- C:\windows\SysWow64\SPCtl.dll

========== LOP Check ==========

[2011/05/23 19:23:07 | 000,000,000 | ---D | M] -- C:\Users\Chad\AppData\Roaming\Leadertech
[2011/05/23 22:01:50 | 000,000,000 | ---D | M] -- C:\Users\Chad\AppData\Roaming\OpenCandy
[2011/06/01 09:11:10 | 000,000,000 | ---D | M] -- C:\Users\Chad\AppData\Roaming\Toshiba
[2011/05/20 17:05:22 | 000,000,000 | ---D | M] -- C:\Users\Chad\AppData\Roaming\WinBatch
[2009/07/13 23:08:49 | 000,008,950 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT

========== Purity Check ==========

< End of report >

#22
Essexboy

Posted 05 June 2011 - 03:48 PM

GeekU Moderator

Retired Staff
69,964 posts

Could you run RogueKiller again with option 6 and post the log. What other problems are you experiencing ?

Run OTL

Under the Custom Scans/Fixes box at the bottom, paste in the following

:OTL
O30:64bit: - LSA: Security Packages - (椀渀搀漀眀猀) - File not found
O30:64bit: - LSA: Security Packages - (ᘀ堀㄀) - File not found
O30 - LSA: Security Packages - (椀渀搀漀眀猀) - File not found
O30 - LSA: Security Packages - (ᘀ堀㄀) - File not found


:Files
ipconfig /flushdns /c

:Commands
[purity]
[resethosts]
[emptytemp]
[EMPTYFLASH]
[CREATERESTOREPOINT]
[Reboot]

Then click the Run Fix button at the top
Let the program run unhindered, reboot the PC when it is done
Open OTL again and click the Quick Scan button. Post the log it produces in your next reply.

#23
dragonledak

Posted 05 June 2011 - 05:01 PM

Member

Topic Starter
Member
16 posts

Ok I am only able to get onto my computer by running last good config. Here are all the logs that were produced from what you said to do.

RogueKiller V5.2.2 [06/05/2011] by Tigzy
contact at http://www.sur-la-toile.com
mail: tigzyRK<at>gmail<dot>com
Feedback: http://www.sur-la-to...-Remontees.html

Operating System: Windows 7 (6.1.7600 ) 64 bits version
Started in : Normal mode
User: Chad [Admin rights]
Mode: Shortcuts HJfix -- Date : 06/05/2011 16:09:51

Bad processes: 0

File attributes restored:
Desktop: Success 0 / Fail 0
Quick launch: Success 0 / Fail 0
Programs: Success 0 / Fail 0
Start menu: Success 0 / Fail 0
User folder: Success 22 / Fail 0
My documents: Success 0 / Fail 0
My favorites: Success 0 / Fail 0
My pictures: Success 0 / Fail 0
My music: Success 0 / Fail 0
My videos: Success 0 / Fail 0
Local drives: Success 3 / Fail 12
Backup: [FOUND] Success 0 / Fail 19

Drives:
[C:] \Device\HarddiskVolume2 -- 0x3 --> Restored
[D:] \Device\CdRom0 -- 0x5 --> Skipped

Finished : << RKreport[2].txt >>
RKreport[1].txt ; RKreport[2].txt

All processes killed
========== OTL ==========
64bit-Registry value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\\Security Packages:椀渀搀漀眀猀 deleted successfully.
64bit-Registry value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\\Security Packages:ᘀ堀㄀ deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\\Security Packages:椀渀搀漀眀猀 deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\\Security Packages:ᘀ堀㄀ deleted successfully.
========== FILES ==========
< ipconfig /flushdns /c >
Windows IP Configuration
Successfully flushed the DNS Resolver Cache.
C:\Users\Chad\cmd.bat deleted successfully.
C:\Users\Chad\cmd.txt deleted successfully.
========== COMMANDS ==========
C:\windows\System32\drivers\etc\Hosts moved successfully.
HOSTS file reset successfully

[EMPTYTEMP]

User: All Users

User: Chad
->Temp folder emptied: 20340110 bytes
->Temporary Internet Files folder emptied: 35226850 bytes
->Flash cache emptied: 830 bytes

User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: Public

%systemdrive% .tmp files removed: 33253 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32 (64bit) .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 3423724 bytes
%systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 50199 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 56.00 mb

[EMPTYFLASH]

User: All Users

User: Chad
->Flash cache emptied: 0 bytes

User: Default

User: Default User

User: Public

Total Flash Files Cleaned = 0.00 mb

Restore point Set: OTL Restore Point

OTL by OldTimer - Version 3.2.23.0 log created on 06052011_161159

Files\Folders moved on Reboot...
C:\Users\Chad\AppData\Local\Temp\FXSAPIDebugLogFile.txt moved successfully.
File\Folder C:\Users\Chad\AppData\Local\Temp\~DF19EB048F70ABE8E4.TMP not found!
File\Folder C:\Users\Chad\AppData\Local\Temp\~DF538F3C60E479A941.TMP not found!
File\Folder C:\Users\Chad\AppData\Local\Temp\~DF60EE806C8F793E03.TMP not found!
File\Folder C:\Users\Chad\AppData\Local\Temp\~DF80054D2A8B51E283.TMP not found!
File\Folder C:\Users\Chad\AppData\Local\Temp\~DF8207090A4F911A1B.TMP not found!
File\Folder C:\Users\Chad\AppData\Local\Temp\~DFABC60F6DD7DF113E.TMP not found!
File\Folder C:\Users\Chad\AppData\Local\Temp\~DFD2EA418ADC0A6DE7.TMP not found!
File\Folder C:\Users\Chad\AppData\Local\Temp\~DFED958E1A3007367D.TMP not found!
C:\Users\Chad\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\XUW61Z3J\index[1].htm moved successfully.
C:\Users\Chad\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\XUW61Z3J\like[7].htm moved successfully.
C:\Users\Chad\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\XUW61Z3J\xd_proxy[1].htm moved successfully.
C:\Users\Chad\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\D0LE13JA\301637-hard-drive-failure-warningwindows-recovery-virus[1].txt moved successfully.
C:\Users\Chad\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\D0LE13JA\index[2].htm moved successfully.
C:\Users\Chad\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\AntiPhishing\2CEDBFBC-DBA8-43AA-B1FD-CC8E6316E3E2.dat moved successfully.
C:\Users\Chad\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\MSIMGSIZ.DAT moved successfully.

Registry entries deleted on Reboot...

OTL logfile created on: 6/5/2011 4:56:28 PM - Run 5
OTL by OldTimer - Version 3.2.23.0 Folder = C:\Users\Chad
64bit- Home Premium Edition (Version = 6.1.7600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7600.16385)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

3.80 Gb Total Physical Memory | 2.20 Gb Available Physical Memory | 57.83% Memory free
7.60 Gb Paging File | 5.82 Gb Available in Paging File | 76.65% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 582.67 Gb Total Space | 531.14 Gb Free Space | 91.16% Space Free | Partition Type: NTFS

Computer Name: CHAD-PC | User Name: Chad | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Quick Scan | Include 64bit Scans
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2011/06/04 00:07:32 | 000,580,096 | ---- | M] (OldTimer Tools) -- C:\Users\Chad\OTL.exe
PRC - [2011/05/22 13:31:13 | 001,378,352 | ---- | M] (Webroot Software, Inc. ) -- C:\Program Files (x86)\Webroot\Security\Current\Framework\WRTray.exe
PRC - [2011/05/22 13:31:10 | 003,276,136 | ---- | M] (Webroot Software, Inc. ) -- C:\Program Files (x86)\Webroot\Security\Current\Framework\WRConsumerService.exe
PRC - [2011/05/22 09:39:41 | 000,307,376 | ---- | M] (Google Inc.) -- C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbarUser_32.exe
PRC - [2011/04/26 01:54:18 | 000,232,912 | ---- | M] (Adobe Systems, Inc.) -- C:\Windows\SysWOW64\Macromed\Flash\FlashUtil10i_ActiveX.exe
PRC - [2011/04/18 18:04:58 | 003,900,032 | ---- | M] (Webroot Software, Inc. (www.webroot.com)) -- C:\Program Files (x86)\Webroot\Security\Current\plugins\antimalware\AEI.exe
PRC - [2011/04/16 18:45:11 | 000,130,008 | R--- | M] (Symantec Corporation) -- C:\Program Files (x86)\Norton Internet Security\Engine\18.6.0.29\ccsvchst.exe
PRC - [2010/04/01 10:52:22 | 000,252,728 | ---- | M] (TOSHIBA) -- C:\Program Files (x86)\TOSHIBA\TOSHIBA Sleep Utility\TSleepSrv.exe
PRC - [2010/03/03 15:42:02 | 002,320,920 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe
PRC - [2010/03/03 15:41:58 | 000,268,824 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe
PRC - [2009/12/25 16:21:16 | 000,034,160 | ---- | M] (TOSHIBA CORPORATION) -- C:\Program Files (x86)\TOSHIBA\Utilities\KeNotify.exe

========== Modules (SafeList) ==========

MOD - [2011/06/04 00:07:32 | 000,580,096 | ---- | M] (OldTimer Tools) -- C:\Users\Chad\OTL.exe
MOD - [2010/08/20 23:21:32 | 001,680,896 | ---- | M] (Microsoft Corporation) -- C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7600.16661_none_420fe3fa2b8113bd\comctl32.dll

========== Win32 Services (SafeList) ==========

SRV:64bit: - [2010/09/28 13:30:28 | 000,489,384 | ---- | M] (TOSHIBA Corporation) [Auto | Running] -- C:\Program Files\TOSHIBA\Power Saver\TosCoSrv.exe -- (TosCoSrv)
SRV:64bit: - [2010/09/22 19:10:10 | 000,057,184 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Program Files\Windows Live\Mesh\wlcrasvc.exe -- (wlcrasvc)
SRV:64bit: - [2010/09/01 13:00:06 | 000,911,872 | ---- | M] (Intel® Corporation) [Auto | Running] -- C:\Program Files\Intel\WiMAX\Bin\AppSrv.exe -- (WiMAXAppSrv)
SRV:64bit: - [2010/09/01 12:54:22 | 000,408,576 | ---- | M] (Red Bend Ltd.) [Auto | Running] -- C:\Program Files\Intel\WiMAX\Bin\DMAgent.exe -- (DMAgent)
SRV:64bit: - [2010/07/28 11:27:16 | 000,267,192 | ---- | M] (TOSHIBA Corporation) [Auto | Running] -- C:\Program Files\TOSHIBA\TECO\TecoService.exe -- (TOSHIBA eco Utility Service)
SRV:64bit: - [2010/07/22 17:36:16 | 000,822,192 | ---- | M] (TOSHIBA Corporation) [On_Demand | Stopped] -- C:\Program Files\TOSHIBA\TPHM\TPCHSrv.exe -- (TPCHSrv)
SRV:64bit: - [2010/07/19 19:08:30 | 001,429,776 | ---- | M] (Intel® Corporation) [Auto | Running] -- C:\Program Files\Intel\WiFi\bin\EvtEng.exe -- (EvtEng)
SRV:64bit: - [2010/07/19 18:48:36 | 000,340,240 | ---- | M] () [On_Demand | Stopped] -- C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe -- (MyWiFiDHCPDNS)
SRV:64bit: - [2010/07/19 18:46:54 | 000,838,928 | ---- | M] (Intel® Corporation) [Auto | Running] -- C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe -- (RegSrvc)
SRV:64bit: - [2010/02/05 18:44:48 | 000,137,560 | ---- | M] (TOSHIBA Corporation) [On_Demand | Stopped] -- C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSmartSrv.exe -- (TOSHIBA HDD SSD Alert Service)
SRV:64bit: - [2009/10/21 10:30:36 | 000,531,520 | ---- | M] (TOSHIBA Corporation) [Auto | Running] -- C:\Windows\SysNative\ThpSrv.exe -- (Thpsrv)
SRV:64bit: - [2009/07/28 16:48:06 | 000,140,632 | ---- | M] (TOSHIBA Corporation) [Auto | Running] -- C:\Windows\SysNative\TODDSrv.exe -- (TODDSrv)
SRV:64bit: - [2009/07/13 19:41:27 | 001,011,712 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)
SRV:64bit: - [2009/07/13 19:39:46 | 000,027,136 | ---- | M] (Microsoft Corporation) [Unknown | Running] -- C:\Windows\SysNative\svchost.exe -- (gpsvc)
SRV - [2011/05/22 13:31:10 | 003,276,136 | ---- | M] (Webroot Software, Inc. ) [Auto | Running] -- C:\Program Files (x86)\Webroot\Security\Current\Framework\WRConsumerService.exe -- (WRConsumerService)
SRV - [2011/04/18 18:04:58 | 003,900,032 | ---- | M] (Webroot Software, Inc. (www.webroot.com)) [Auto | Running] -- C:\Program Files (x86)\Webroot\Security\current\plugins\antimalware\AEI.exe -- (WebrootSpySweeperService)
SRV - [2011/04/16 18:45:11 | 000,130,008 | R--- | M] (Symantec Corporation) [Unknown | Running] -- C:\Program Files (x86)\Norton Internet Security\Engine\18.6.0.29\ccSvcHst.exe -- (NIS)
SRV - [2010/11/29 14:58:30 | 000,054,136 | ---- | M] (TOSHIBA Corporation) [On_Demand | Running] -- C:\Program Files (x86)\TOSHIBA\TOSHIBA Service Station\TMachInfo.exe -- (TMachInfo)
SRV - [2010/03/18 13:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)
SRV - [2010/03/03 15:42:02 | 002,320,920 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe -- (UNS) Intel®
SRV - [2010/03/03 15:41:58 | 000,268,824 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe -- (LMS) Intel®
SRV - [2009/06/10 15:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)

========== Driver Services (SafeList) ==========

DRV:64bit: - [2011/05/21 07:31:30 | 000,174,200 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\SYMEVENT64x86.SYS -- (SymEvent)
DRV:64bit: - [2011/04/18 18:05:08 | 000,137,760 | ---- | M] (Webroot Software, Inc. (www.webroot.com)) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\ssidrv.sys -- (ssidrv)
DRV:64bit: - [2011/04/18 18:05:06 | 000,058,480 | ---- | M] (Webroot Software, Inc. (www.webroot.com)) [File_System | Auto | Running] -- C:\Windows\SysNative\drivers\ssfmonm.sys -- (ssfmonm)
DRV:64bit: - [2011/03/30 21:00:09 | 000,744,568 | ---- | M] (Symantec Corporation) [File_System | On_Demand | Running] -- C:\Windows\SysNative\drivers\NISx64\1206000.01D\srtsp64.sys -- (SRTSP)
DRV:64bit: - [2011/03/30 21:00:09 | 000,040,568 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\NISx64\1206000.01D\srtspx64.sys -- (SRTSPX) Symantec Real Time Storage Protection (PEL)
DRV:64bit: - [2011/03/21 18:39:49 | 000,382,584 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\NISx64\1206000.01D\symnets.sys -- (SymNetS)
DRV:64bit: - [2011/03/14 20:31:23 | 000,912,504 | ---- | M] (Symantec Corporation) [File_System | Boot | Running] -- C:\Windows\SysNative\drivers\NISx64\1206000.01D\symefa64.sys -- (SymEFA)
DRV:64bit: - [2011/01/27 00:47:10 | 000,450,680 | ---- | M] (Symantec Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\NISx64\1206000.01D\symds64.sys -- (SymDS)
DRV:64bit: - [2011/01/26 23:07:06 | 000,171,128 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\NISx64\1206000.01D\ironx64.sys -- (SymIRON)
DRV:64bit: - [2010/07/29 06:10:42 | 010,610,400 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\igdkmd64.sys -- (igfx)
DRV:64bit: - [2010/07/28 12:46:18 | 007,821,312 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\NETwNs64.sys -- (NETwNs64) ___ Intel®
DRV:64bit: - [2010/06/21 18:45:56 | 000,287,232 | ---- | M] (Intel® Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\IntcDAud.sys -- (IntcDAud) Intel®
DRV:64bit: - [2010/06/18 11:38:06 | 000,039,832 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\WDKMD.sys -- (wdkmd)
DRV:64bit: - [2010/05/18 17:02:48 | 000,164,464 | ---- | M] (JMicron Technology Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\jmcr.sys -- (JMCR)
DRV:64bit: - [2010/05/16 18:28:36 | 000,175,104 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\bpmp.sys -- (bpmp) Intel® Centrino®
DRV:64bit: - [2010/05/16 18:28:28 | 000,081,920 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\bpusb.sys -- (bpusb)
DRV:64bit: - [2010/05/16 18:28:26 | 000,071,168 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\bpenum.sys -- (bpenum)
DRV:64bit: - [2010/05/08 19:38:56 | 000,482,384 | ---- | M] (TOSHIBA Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\tos_sps64.sys -- (tos_sps64)
DRV:64bit: - [2010/05/03 15:44:02 | 000,331,880 | ---- | M] (Realtek ) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Rt64win7.sys -- (RTL8167)
DRV:64bit: - [2010/03/10 19:51:32 | 000,316,464 | ---- | M] (Synaptics Incorporated) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\SynTP.sys -- (SynTP)
DRV:64bit: - [2010/02/27 08:32:14 | 000,158,976 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Impcd.sys -- (Impcd)
DRV:64bit: - [2010/01/15 13:22:08 | 000,538,136 | ---- | M] (Intel Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\iaStor.sys -- (iaStor)
DRV:64bit: - [2009/10/09 20:41:20 | 000,109,056 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\sdbus.sys -- (sdbus)
DRV:64bit: - [2009/09/17 13:54:54 | 000,056,344 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\HECIx64.sys -- (HECIx64) Intel®
DRV:64bit: - [2009/07/30 22:02:36 | 000,044,912 | ---- | M] (COMPAL ELECTRONIC INC.) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\LPCFilter.sys -- (LPCFilter)
DRV:64bit: - [2009/07/30 21:22:04 | 000,027,784 | ---- | M] (TOSHIBA Corporation.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\tdcmdpst.sys -- (tdcmdpst)
DRV:64bit: - [2009/07/14 16:31:18 | 000,026,840 | ---- | M] (TOSHIBA Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\TVALZ_O.SYS -- (TVALZ)
DRV:64bit: - [2009/07/13 19:52:21 | 000,106,576 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata)
DRV:64bit: - [2009/07/13 19:52:21 | 000,028,752 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata)
DRV:64bit: - [2009/07/13 19:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs)
DRV:64bit: - [2009/07/13 19:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2)
DRV:64bit: - [2009/07/13 19:47:48 | 000,077,888 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD)
DRV:64bit: - [2009/07/13 19:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor)
DRV:64bit: - [2009/07/13 18:00:24 | 000,009,728 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\acpials.sys -- (acpials)
DRV:64bit: - [2009/06/29 17:16:20 | 000,014,784 | ---- | M] (TOSHIBA Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\Thpevm.sys -- (Thpevm)
DRV:64bit: - [2009/06/29 11:25:22 | 000,034,880 | ---- | M] (TOSHIBA Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\thpdrv.sys -- (Thpdrv)
DRV:64bit: - [2009/06/22 18:06:38 | 000,035,008 | ---- | M] (TOSHIBA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\PGEffect.sys -- (PGEffect)
DRV:64bit: - [2009/06/19 20:15:22 | 000,014,472 | ---- | M] (TOSHIBA Corporation) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\TVALZFL.sys -- (TVALZFL)
DRV:64bit: - [2009/06/10 14:38:56 | 000,000,308 | ---- | M] () [File_System | On_Demand | Running] -- C:\Windows\SysNative\wbem\ntfs.mof -- (Ntfs)
DRV:64bit: - [2009/06/10 14:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv)
DRV:64bit: - [2009/06/10 14:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv)
DRV:64bit: - [2009/06/10 14:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a)
DRV:64bit: - [2009/06/10 14:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir)
DRV - [2011/05/20 19:11:19 | 002,011,768 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\Definitions\VirusDefs\20110605.002\EX64.SYS -- (NAVEX15)
DRV - [2011/05/20 19:11:19 | 000,481,912 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys -- (eeCtrl)
DRV - [2011/05/20 19:11:19 | 000,136,824 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys -- (EraserUtilRebootDrv)
DRV - [2011/05/20 19:11:19 | 000,117,880 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\Definitions\VirusDefs\20110605.002\ENG64.SYS -- (NAVENG)
DRV - [2011/05/18 00:36:02 | 001,127,032 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\Definitions\BASHDefs\20110518.001\BHDrvx64.sys -- (BHDrvx64)
DRV - [2011/03/14 12:58:28 | 000,476,792 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\Definitions\IPSDefs\20110526.002\IDSviA64.sys -- (IDSVia64)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm

IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-21-3161015757-2683380795-3781861229-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://start.toshiba.com/g/
IE - HKU\S-1-5-21-3161015757-2683380795-3781861229-1000\SOFTWARE\Microsoft\Internet Explorer\Main,SearchDefaultBranded = 1
IE - HKU\S-1-5-21-3161015757-2683380795-3781861229-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://start.toshiba.com/g/
IE - HKU\S-1-5-21-3161015757-2683380795-3781861229-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

FF - HKLM\software\mozilla\Firefox\Extensions\\{BBDA0591-3099-440a-AA10-41764D9DB4DB}: C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\IPSFFPlgn\ [2011/05/22 09:28:02 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Firefox\Extensions\\{2D3F3651-74B9-4795-BDEC-6DA2F431CB62}: C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\coFFPlgn\ [2011/05/21 07:31:15 | 000,000,000 | ---D | M]

O1 HOSTS File: ([2011/06/05 16:12:11 | 000,000,098 | ---- | M]) - C:\Windows\SysNative\drivers\etc\Hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: ::1 localhost
O2:64bit: - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
O2:64bit: - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.7.6406.1642\swg64.dll (Google Inc.)
O2 - BHO: (Symantec NCO BHO) - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files (x86)\Norton Internet Security\Engine\18.6.0.29\coieplg.dll (Symantec Corporation)
O2 - BHO: (Symantec Intrusion Prevention) - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files (x86)\Norton Internet Security\Engine\18.6.0.29\ips\ipsbho.dll (Symantec Corporation)
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files (x86)\Google\GoogleToolbarNotifier\5.7.6406.1642\swg.dll (Google Inc.)
O2 - BHO: (TOSHIBA Media Controller Plug-in) - {F3C88694-EFFA-4d78-B409-54B7B2535B14} - C:\Program Files (x86)\TOSHIBA\TOSHIBA Media Controller Plug-in\TOSHIBAMediaControllerIE.dll (<TOSHIBA>)
O3:64bit: - HKLM\..\Toolbar: (Google Toolbar) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
O3:64bit: - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3 - HKLM\..\Toolbar: (Norton Toolbar) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton Internet Security\Engine\18.6.0.29\coieplg.dll (Symantec Corporation)
O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3:64bit: - HKU\.DEFAULT\..\Toolbar\WebBrowser: (Google Toolbar) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
O3:64bit: - HKU\S-1-5-18\..\Toolbar\WebBrowser: (Google Toolbar) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
O3:64bit: - HKU\S-1-5-21-3161015757-2683380795-3781861229-1000\..\Toolbar\WebBrowser: (Google Toolbar) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
O3 - HKU\S-1-5-21-3161015757-2683380795-3781861229-1000\..\Toolbar\WebBrowser: (Norton Toolbar) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton Internet Security\Engine\18.6.0.29\coieplg.dll (Symantec Corporation)
O4:64bit: - HKLM..\Run: [] File not found
O4:64bit: - HKLM..\Run: [00TCrdMain] C:\Program Files\TOSHIBA\FlashCards\TCrdMain.exe (TOSHIBA Corporation)
O4:64bit: - HKLM..\Run: [HotKeysCmds] C:\windows\SysNative\hkcmd.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [HSON] C:\Program Files\TOSHIBA\TBS\HSON.exe (TOSHIBA Corporation)
O4:64bit: - HKLM..\Run: [IgfxTray] C:\windows\SysNative\igfxtray.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [IntelWireless] C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe (Intel® Corporation)
O4:64bit: - HKLM..\Run: [IntelWirelessWiMAX] C:\Program Files\Intel\WiMAX\Bin\WiMAXCU.exe (Intel® Corporation)
O4:64bit: - HKLM..\Run: [Persistence] C:\windows\SysNative\igfxpers.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [RtHDVBg] C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe (Realtek Semiconductor)
O4:64bit: - HKLM..\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Realtek Semiconductor)
O4:64bit: - HKLM..\Run: [SmartFaceVWatcher] C:\Program Files\TOSHIBA\SmartFaceV\SmartFaceVWatcher.exe (TOSHIBA Corporation)
O4:64bit: - HKLM..\Run: [SmoothView] C:\Program Files\TOSHIBA\SmoothView\SmoothView.exe (TOSHIBA Corporation)
O4:64bit: - HKLM..\Run: [Teco] C:\Program Files\TOSHIBA\TECO\Teco.exe (TOSHIBA Corporation)
O4:64bit: - HKLM..\Run: [ThpSrv] C:\windows\SysNative\thpsrv.exe (TOSHIBA Corporation)
O4:64bit: - HKLM..\Run: [TosNC] C:\Program Files\TOSHIBA\BulletinBoard\TosNcCore.exe (TOSHIBA Corporation)
O4:64bit: - HKLM..\Run: [TosReelTimeMonitor] C:\Program Files\TOSHIBA\ReelTime\TosReelTimeMonitor.exe (TOSHIBA Corporation)
O4:64bit: - HKLM..\Run: [TosSENotify] C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosWaitSrv.exe (TOSHIBA Corporation)
O4:64bit: - HKLM..\Run: [TosVolRegulator] C:\Program Files\TOSHIBA\TosVolRegulator\TosVolRegulator.exe (TOSHIBA Corporation)
O4:64bit: - HKLM..\Run: [TosWaitSrv] C:\Program Files\TOSHIBA\TPHM\TosWaitSrv.exe (TOSHIBA Corporation)
O4:64bit: - HKLM..\Run: [TPwrMain] C:\Program Files\TOSHIBA\Power Saver\TPwrMain.exe (TOSHIBA Corporation)
O4 - HKLM..\Run: [KeNotify] C:\Program Files (x86)\TOSHIBA\Utilities\KeNotify.exe (TOSHIBA CORPORATION)
O4 - HKLM..\Run: [SVPWUTIL] C:\Program Files (x86)\TOSHIBA\Utilities\SVPWUTIL.exe (TOSHIBA CORPORATION)
O4 - HKLM..\Run: [ToshibaAppPlace] C:\Program Files (x86)\Toshiba\Toshiba App Place\ToshibaAppPlace.exe (Toshiba)
O4 - HKLM..\Run: [ToshibaServiceStation] C:\Program Files (x86)\TOSHIBA\TOSHIBA Service Station\ToshibaServiceStation.exe (TOSHIBA Corporation)
O4 - HKLM..\Run: [TSleepSrv] File not found
O4 - HKLM..\Run: [TWebCamera] C:\Program Files (x86)\TOSHIBA\TOSHIBA Web Camera Application\TWebCamera.exe (TOSHIBA CORPORATION.)
O4 - HKLM..\Run: [WebrootTrayApp] C:\Program Files (x86)\Webroot\Security\Current\Framework\WRTray.exe (Webroot Software, Inc. )
O4 - HKU\S-1-5-21-3161015757-2683380795-3781861229-1000..\Run: [AROReminder] File not found
O4 - Startup: C:\Users\Chad\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Neverwinter Nights Registration.lnk = C:\NeverwinterNights\NWN\ereg\ATR1.EXE (Leader Technologies/Atari)
O4 - Startup: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Best Buy pc app.lnk = C:\ProgramData\Best Buy pc app\ClickOnceSetup.exe (Microsoft)
O4 - Startup: C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Best Buy pc app.lnk = C:\ProgramData\Best Buy pc app\ClickOnceSetup.exe (Microsoft)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\control panel present
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\restrictions present
O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\restrictions present
O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\restrictions present
O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\restrictions present
O7 - HKU\S-1-5-21-3161015757-2683380795-3781861229-1000\Software\Policies\Microsoft\Internet Explorer\restrictions present
O8:64bit: - Extra context menu item: Google Sidewiki... - C:\Program Files (x86)\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_6CE5017F567343CA.dll (Google Inc.)
O8 - Extra context menu item: Google Sidewiki... - C:\Program Files (x86)\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_6CE5017F567343CA.dll (Google Inc.)
O13 - gopher Prefix: missing
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_20)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 205.171.3.25 205.171.2.25
O18:64bit: - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\wlmailhtml {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\wlpg {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - Reg Error: Key error. File not found
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\windows\SysNative\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O20:64bit: - Winlogon\Notify\igfxcui: DllName - Reg Error: Key error. - C:\windows\SysNative\igfxdev.dll (Intel Corporation)
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found.
O30:64bit: - LSA: Authentication Packages - (ows\w) - File not found
O30 - LSA: Authentication Packages - (ows\w) - File not found
O30:64bit: - LSA: Security Packages - (椀渀搀漀眀猀) - File not found
O30:64bit: - LSA: Security Packages - (ᘀ堀㄀) - File not found
O30 - LSA: Security Packages - (椀渀搀漀眀猀) - File not found
O30 - LSA: Security Packages - (ᘀ堀㄀) - File not found
O32 - HKLM CDRom: AutoRun - 1
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKU\S-1-5-21-3161015757-2683380795-3781861229-1000\...exe [@ = exefile] -- Reg Error: Key error. File not found

========== Files/Folders - Created Within 30 Days ==========

[2011/06/05 16:09:41 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\STOPzilla
[2011/06/05 10:43:44 | 000,000,000 | --SD | C] -- C:\ComboFix
[2011/06/05 10:04:08 | 000,518,144 | ---- | C] (SteelWerX) -- C:\windows\SWREG.exe
[2011/06/05 10:04:08 | 000,406,528 | ---- | C] (SteelWerX) -- C:\windows\SWSC.exe
[2011/06/05 10:04:08 | 000,060,416 | ---- | C] (NirSoft) -- C:\windows\NIRCMD.exe
[2011/06/05 10:03:04 | 000,000,000 | ---D | C] -- C:\windows\ERDNT
[2011/06/05 10:02:33 | 000,000,000 | -HSD | C] -- C:\Config.Msi
[2011/06/05 09:54:25 | 000,000,000 | ---D | C] -- C:\Qoobox
[2011/06/05 09:53:32 | 004,111,938 | R--- | C] (Swearware) -- C:\Users\Chad\Desktop\ComboFix.exe
[2011/06/04 23:24:00 | 000,000,000 | ---D | C] -- C:\Users\Chad\Desktop\RK_Quarantine
[2011/06/04 12:00:58 | 000,000,000 | ---D | C] -- C:\Users\Chad\AppData\Roaming\InstallShield
[2011/06/04 11:20:55 | 000,000,000 | ---D | C] -- C:\Users\Chad\AppData\Local\ElevatedDiagnostics
[2011/06/04 09:10:02 | 000,000,000 | ---D | C] -- C:\_OTL
[2011/06/04 00:07:30 | 000,580,096 | ---- | C] (OldTimer Tools) -- C:\Users\Chad\OTL.exe
[2011/06/04 00:01:42 | 000,000,000 | ---D | C] -- C:\Users\Chad\RK_Quarantine
[2011/06/03 22:24:57 | 000,000,000 | ---D | C] -- C:\windows\Minidump
[2011/06/03 20:21:37 | 000,000,000 | ---D | C] -- C:\ProgramData\STOPzilla!
[2011/05/24 12:18:51 | 000,000,000 | ---D | C] -- C:\back up nwn executable
[2011/05/23 22:43:37 | 000,000,000 | ---D | C] -- C:\Users\Chad\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WinRAR
[2011/05/23 22:43:37 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinRAR
[2011/05/23 22:34:39 | 000,000,000 | ---D | C] -- C:\Program Files\WinRAR
[2011/05/23 22:33:00 | 000,000,000 | ---D | C] -- C:\Users\Chad\AppData\Roaming\WinRAR
[2011/05/23 22:04:12 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ARO 2011
[2011/05/23 22:04:10 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\ARO 2011
[2011/05/23 22:01:53 | 000,000,000 | ---D | C] -- C:\Users\Chad\AppData\Local\OpenCandy
[2011/05/23 22:01:50 | 000,000,000 | ---D | C] -- C:\Users\Chad\AppData\Roaming\OpenCandy
[2011/05/23 19:23:07 | 000,000,000 | ---D | C] -- C:\Users\Chad\AppData\Roaming\Leadertech
[2011/05/23 19:23:01 | 000,000,000 | ---D | C] -- C:\Users\Chad\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\GameSpy Arcade
[2011/05/23 19:23:01 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\GameSpy Arcade
[2011/05/23 19:22:54 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\GameSpy Arcade
[2011/05/23 19:18:06 | 000,000,000 | ---D | C] -- C:\Users\Chad\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Neverwinter Nights
[2011/05/23 19:18:06 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Neverwinter Nights
[2011/05/23 19:05:48 | 000,000,000 | ---D | C] -- C:\NeverwinterNights
[2011/05/23 15:06:32 | 000,000,000 | ---D | C] -- C:\ProgramData\FileCure
[2011/05/22 20:31:02 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\EasyInfo
[2011/05/22 20:26:24 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\EA Games
[2011/05/22 13:34:42 | 000,137,760 | ---- | C] (Webroot Software, Inc. (www.webroot.com)) -- C:\windows\SysNative\drivers\ssidrv.sys
[2011/05/22 13:34:42 | 000,058,480 | ---- | C] (Webroot Software, Inc. (www.webroot.com)) -- C:\windows\SysNative\drivers\ssfmonm.sys
[2011/05/22 13:31:21 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Webroot
[2011/05/22 13:31:20 | 000,000,000 | ---D | C] -- C:\ProgramData\{3C707538-83E3-4DAC-9218-6D79F3B9FEA5}
[2011/05/22 13:30:32 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Webroot
[2011/05/22 13:29:23 | 000,000,000 | ---D | C] -- C:\ProgramData\Webroot
[2011/05/22 13:29:22 | 000,000,000 | ---D | C] -- C:\Users\Chad\AppData\Local\PackageAware
[2011/05/22 13:17:17 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office
[2011/05/22 13:16:49 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\DESIGNER
[2011/05/22 13:13:43 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft Office
[2011/05/22 13:13:36 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Microsoft Analysis Services
[2011/05/22 13:13:18 | 000,000,000 | ---D | C] -- C:\Users\Chad\AppData\Local\Microsoft Help
[2011/05/22 13:13:16 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft Help
[2011/05/22 13:13:03 | 000,000,000 | R--D | C] -- C:\MSOCache
[2011/05/22 12:38:01 | 000,000,000 | ---D | C] -- C:\Users\Chad\AppData\Local\Diagnostics
[2011/05/22 12:33:16 | 000,000,000 | ---D | C] -- C:\Users\Chad\AppData\Local\CrashDumps
[2011/05/22 09:34:08 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Microsoft.NET
[2011/05/22 09:25:20 | 000,000,000 | ---D | C] -- C:\windows\SysWow64\Wat
[2011/05/22 09:25:20 | 000,000,000 | ---D | C] -- C:\windows\SysNative\Wat
[2011/05/20 20:42:29 | 000,000,000 | ---D | C] -- C:\Users\Chad\AppData\Roaming\Google
[2011/05/20 20:42:28 | 000,000,000 | ---D | C] -- C:\Users\Chad\AppData\Local\Google
[2011/05/20 20:21:35 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Symantec Shared
[2011/05/20 19:08:44 | 000,000,000 | ---D | C] -- C:\Users\Chad\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Games
[2011/05/20 17:44:12 | 000,000,000 | ---D | C] -- C:\Users\Chad\AppData\Local\TOSHIBA_Corporation
[2011/05/20 17:38:58 | 000,000,000 | ---D | C] -- C:\Users\Chad\AppData\Roaming\Macromedia
[2011/05/20 17:38:56 | 000,000,000 | ---D | C] -- C:\Users\Chad\AppData\Roaming\Adobe
[2011/05/20 17:21:14 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\EA Games
[2011/05/20 17:11:13 | 000,000,000 | ---D | C] -- C:\Users\Chad\AppData\Local\Toshiba
[2011/05/20 17:09:16 | 000,000,000 | ---D | C] -- C:\Users\Chad\AppData\Roaming\Toshiba
[2011/05/20 17:08:48 | 000,000,000 | ---D | C] -- C:\Users\Chad\AppData\Local\Apps
[2011/05/20 17:08:41 | 000,000,000 | ---D | C] -- C:\Users\Chad\AppData\Local\Deployment
[2011/05/20 17:08:13 | 000,000,000 | ---D | C] -- C:\Users\Chad\AppData\Roaming\Intel
[2011/05/20 17:06:29 | 000,000,000 | R--D | C] -- C:\Users\Chad\Searches
[2011/05/20 17:06:29 | 000,000,000 | R--D | C] -- C:\Users\Chad\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools
[2011/05/20 17:06:29 | 000,000,000 | ---D | C] -- C:\Users\Chad\Application Data\Microsoft\Internet Explorer\Quick Launch\User Pinned
[2011/05/20 17:06:19 | 000,000,000 | ---D | C] -- C:\Users\Chad\AppData\Roaming\Identities
[2011/05/20 17:06:15 | 000,000,000 | R--D | C] -- C:\Users\Chad\Contacts
[2011/05/20 17:06:12 | 000,000,000 | ---D | C] -- C:\Users\Chad\AppData\Local\VirtualStore
[2011/05/20 17:05:22 | 000,000,000 | ---D | C] -- C:\Users\Chad\AppData\Roaming\WinBatch
[2011/05/20 17:04:36 | 000,000,000 | -HSD | C] -- C:\Users\Chad\AppData\Local\Temporary Internet Files
[2011/05/20 17:04:36 | 000,000,000 | -HSD | C] -- C:\Users\Chad\Templates
[2011/05/20 17:04:36 | 000,000,000 | -HSD | C] -- C:\Users\Chad\Start Menu
[2011/05/20 17:04:36 | 000,000,000 | -HSD | C] -- C:\Users\Chad\SendTo
[2011/05/20 17:04:36 | 000,000,000 | -HSD | C] -- C:\Users\Chad\Recent
[2011/05/20 17:04:36 | 000,000,000 | -HSD | C] -- C:\Users\Chad\PrintHood
[2011/05/20 17:04:36 | 000,000,000 | -HSD | C] -- C:\Users\Chad\NetHood
[2011/05/20 17:04:36 | 000,000,000 | -HSD | C] -- C:\Users\Chad\Documents\My Videos
[2011/05/20 17:04:36 | 000,000,000 | -HSD | C] -- C:\Users\Chad\Documents\My Pictures
[2011/05/20 17:04:36 | 000,000,000 | -HSD | C] -- C:\Users\Chad\Documents\My Music
[2011/05/20 17:04:36 | 000,000,000 | -HSD | C] -- C:\Users\Chad\My Documents
[2011/05/20 17:04:36 | 000,000,000 | -HSD | C] -- C:\Users\Chad\Local Settings
[2011/05/20 17:04:36 | 000,000,000 | -HSD | C] -- C:\Users\Chad\AppData\Local\History
[2011/05/20 17:04:36 | 000,000,000 | -HSD | C] -- C:\Users\Chad\Cookies
[2011/05/20 17:04:36 | 000,000,000 | -HSD | C] -- C:\Users\Chad\Application Data
[2011/05/20 17:04:36 | 000,000,000 | -HSD | C] -- C:\Users\Chad\AppData\Local\Application Data
[2011/05/20 17:04:30 | 000,000,000 | --SD | C] -- C:\Users\Chad\AppData\Roaming\Microsoft
[2011/05/20 17:04:30 | 000,000,000 | R--D | C] -- C:\Users\Chad\Videos
[2011/05/20 17:04:30 | 000,000,000 | R--D | C] -- C:\Users\Chad\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
[2011/05/20 17:04:30 | 000,000,000 | R--D | C] -- C:\Users\Chad\Saved Games
[2011/05/20 17:04:30 | 000,000,000 | R--D | C] -- C:\Users\Chad\Pictures
[2011/05/20 17:04:30 | 000,000,000 | R--D | C] -- C:\Users\Chad\Music
[2011/05/20 17:04:30 | 000,000,000 | R--D | C] -- C:\Users\Chad\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance
[2011/05/20 17:04:30 | 000,000,000 | R--D | C] -- C:\Users\Chad\Links
[2011/05/20 17:04:30 | 000,000,000 | R--D | C] -- C:\Users\Chad\Favorites
[2011/05/20 17:04:30 | 000,000,000 | R--D | C] -- C:\Users\Chad\Downloads
[2011/05/20 17:04:30 | 000,000,000 | R--D | C] -- C:\Users\Chad\My Documents
[2011/05/20 17:04:30 | 000,000,000 | R--D | C] -- C:\Users\Chad\Desktop
[2011/05/20 17:04:30 | 000,000,000 | R--D | C] -- C:\Users\Chad\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories
[2011/05/20 17:04:30 | 000,000,000 | ---D | C] -- C:\Users\Chad\AppData\Local\Temp
[2011/05/20 17:04:30 | 000,000,000 | ---D | C] -- C:\Users\Chad\AppData\Local\Microsoft
[2011/05/20 17:04:30 | 000,000,000 | ---D | C] -- C:\Users\Chad\AppData\Roaming\Media Center Programs
[2011/05/20 17:04:30 | 000,000,000 | ---D | C] -- C:\Users\Chad\AppData

========== Files - Modified Within 30 Days ==========

[2011/06/05 16:55:46 | 000,016,304 | -H-- | M] () -- C:\windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2011/06/05 16:55:46 | 000,016,304 | -H-- | M] () -- C:\windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2011/06/05 16:54:54 | 000,000,908 | ---- | M] () -- C:\windows\tasks\GoogleUpdateTaskMachineCore.job
[2011/06/05 16:52:40 | 000,726,316 | ---- | M] () -- C:\windows\SysNative\PerfStringBackup.INI
[2011/06/05 16:52:40 | 000,624,178 | ---- | M] () -- C:\windows\SysNative\perfh009.dat
[2011/06/05 16:52:40 | 000,106,522 | ---- | M] () -- C:\windows\SysNative\perfc009.dat
[2011/06/05 16:48:09 | 000,067,584 | --S- | M] () -- C:\windows\bootstat.dat
[2011/06/05 16:47:52 | 3059,748,864 | -HS- | M] () -- C:\hiberfil.sys
[2011/06/05 16:13:00 | 000,000,912 | ---- | M] () -- C:\windows\tasks\GoogleUpdateTaskMachineUA.job
[2011/06/05 16:12:11 | 000,000,098 | ---- | M] () -- C:\windows\SysNative\drivers\etc\Hosts
[2011/06/05 16:09:29 | 000,511,488 | ---- | M] () -- C:\Users\Chad\Desktop\RogueKiller.exe
[2011/06/05 13:30:19 | 000,606,105 | ---- | M] () -- C:\Users\Chad\Desktop\unhide.exe
[2011/06/05 12:58:22 | 001,607,420 | ---- | M] () -- C:\windows\SysNative\drivers\NISx64\1206000.01D\Cat.DB
[2011/06/05 10:03:38 | 004,111,938 | R--- | M] (Swearware) -- C:\Users\Chad\Desktop\ComboFix.exe
[2011/06/04 23:25:46 | 000,000,104 | ---- | M] () -- C:\windows\SysNative\drivers\kgpfr2.cfg
[2011/06/04 23:25:45 | 000,001,400 | ---- | M] () -- C:\windows\SysNative\drivers\kgpcpy.cfg
[2011/06/04 00:07:32 | 000,580,096 | ---- | M] (OldTimer Tools) -- C:\Users\Chad\OTL.exe
[2011/06/03 22:24:42 | 510,135,446 | ---- | M] () -- C:\windows\MEMORY.DMP
[2011/05/29 19:07:48 | 000,001,092 | ---- | M] () -- C:\Users\Chad\Desktop\nwtoolset - Shortcut.lnk
[2011/05/27 10:30:34 | 000,342,720 | ---- | M] () -- C:\windows\SysNative\FNTCACHE.DAT
[2011/05/24 12:23:52 | 000,001,128 | ---- | M] () -- C:\Users\Chad\Desktop\nwmain-169-hg - Shortcut.lnk
[2011/05/23 22:05:38 | 000,001,883 | ---- | M] () -- C:\Users\Chad\Application Data\Microsoft\Internet Explorer\Quick Launch\Check PC For Errors.lnk
[2011/05/23 19:25:06 | 000,001,055 | ---- | M] () -- C:\Users\Chad\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Neverwinter Nights Registration.lnk
[2011/05/21 07:31:30 | 000,174,200 | ---- | M] (Symantec Corporation) -- C:\windows\SysNative\drivers\SYMEVENT64x86.SYS
[2011/05/21 07:31:30 | 000,007,488 | ---- | M] () -- C:\windows\SysNative\drivers\SYMEVENT64x86.CAT
[2011/05/21 07:31:30 | 000,000,855 | ---- | M] () -- C:\windows\SysNative\drivers\SYMEVENT64x86.INF
[2011/05/20 20:42:19 | 000,001,452 | ---- | M] () -- C:\Users\Chad\Application Data\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk
[2011/05/20 18:03:45 | 000,039,252 | ---- | M] () -- C:\windows\SysWow64\license.rtf
[2011/05/20 18:03:45 | 000,039,252 | ---- | M] () -- C:\windows\SysNative\license.rtf
[2011/05/20 17:05:47 | 000,000,013 | RHS- | M] () -- C:\windows\SysNative\drivers\fbd.sys

========== Files Created - No Company Name ==========

[2011/06/05 16:09:26 | 000,511,488 | ---- | C] () -- C:\Users\Chad\Desktop\RogueKiller.exe
[2011/06/05 13:30:16 | 000,606,105 | ---- | C] () -- C:\Users\Chad\Desktop\unhide.exe
[2011/06/05 10:04:08 | 000,256,512 | ---- | C] () -- C:\windows\PEV.exe
[2011/06/05 10:04:08 | 000,208,896 | ---- | C] () -- C:\windows\MBR.exe
[2011/06/05 10:04:08 | 000,098,816 | ---- | C] () -- C:\windows\sed.exe
[2011/06/05 10:04:08 | 000,080,412 | ---- | C] () -- C:\windows\grep.exe
[2011/06/05 10:04:08 | 000,068,096 | ---- | C] () -- C:\windows\zip.exe
[2011/06/04 23:25:46 | 000,000,104 | ---- | C] () -- C:\windows\SysNative\drivers\kgpfr2.cfg
[2011/06/04 11:54:36 | 000,001,400 | ---- | C] () -- C:\windows\SysNative\drivers\kgpcpy.cfg
[2011/06/03 22:24:42 | 510,135,446 | ---- | C] () -- C:\windows\MEMORY.DMP
[2011/05/29 19:07:48 | 000,001,092 | ---- | C] () -- C:\Users\Chad\Desktop\nwtoolset - Shortcut.lnk
[2011/05/24 12:23:52 | 000,001,128 | ---- | C] () -- C:\Users\Chad\Desktop\nwmain-169-hg - Shortcut.lnk
[2011/05/23 22:04:13 | 000,001,883 | ---- | C] () -- C:\Users\Chad\Application Data\Microsoft\Internet Explorer\Quick Launch\Check PC For Errors.lnk
[2011/05/23 19:25:06 | 000,001,055 | ---- | C] () -- C:\Users\Chad\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Neverwinter Nights Registration.lnk
[2011/05/22 13:34:42 | 000,030,424 | ---- | C] () -- C:\windows\SysWow64\wrLZMA.dll
[2011/05/22 13:34:42 | 000,019,576 | ---- | C] () -- C:\windows\SysNative\SsiEfr.exe
[2011/05/20 20:42:19 | 000,001,452 | ---- | C] () -- C:\Users\Chad\Application Data\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk
[2011/05/20 17:06:32 | 000,001,458 | ---- | C] () -- C:\Users\Chad\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
[2011/05/20 17:05:47 | 000,000,013 | RHS- | C] () -- C:\windows\SysNative\drivers\fbd.sys
[2011/05/20 17:04:30 | 000,000,290 | ---- | C] () -- C:\Users\Chad\Application Data\Microsoft\Internet Explorer\Quick Launch\Shows Desktop.lnk
[2011/05/20 17:04:30 | 000,000,272 | ---- | C] () -- C:\Users\Chad\Application Data\Microsoft\Internet Explorer\Quick Launch\Window Switcher.lnk
[2010/07/29 06:08:46 | 000,127,868 | ---- | C] () -- C:\windows\SysWow64\igcompkrng575.bin
[2010/07/29 06:08:44 | 000,104,796 | ---- | C] () -- C:\windows\SysWow64\igfcg575m.bin
[2010/07/29 06:08:42 | 000,870,560 | ---- | C] () -- C:\windows\SysWow64\igkrng575.bin
[2010/07/29 05:14:38 | 000,208,896 | ---- | C] () -- C:\windows\SysWow64\iglhsip32.dll
[2010/07/29 05:14:38 | 000,143,360 | ---- | C] () -- C:\windows\SysWow64\iglhcp32.dll
[2009/07/13 23:38:36 | 000,067,584 | --S- | C] () -- C:\windows\bootstat.dat
[2009/07/13 20:35:51 | 000,000,741 | ---- | C] () -- C:\windows\SysWow64\NOISE.DAT
[2009/07/13 20:34:42 | 000,215,943 | ---- | C] () -- C:\windows\SysWow64\dssec.dat
[2009/07/13 18:10:29 | 000,043,131 | ---- | C] () -- C:\windows\mib.bin
[2009/07/13 17:42:10 | 000,064,000 | ---- | C] () -- C:\windows\SysWow64\BWContextHandler.dll
[2009/07/13 15:03:59 | 000,364,544 | ---- | C] () -- C:\windows\SysWow64\msjetoledb40.dll
[2009/06/10 15:26:10 | 000,673,088 | ---- | C] () -- C:\windows\SysWow64\mlang.dat
[2009/04/28 05:37:00 | 000,028,672 | ---- | C] () -- C:\windows\SysWow64\SPCtl.dll

========== LOP Check ==========

[2011/05/23 19:23:07 | 000,000,000 | ---D | M] -- C:\Users\Chad\AppData\Roaming\Leadertech
[2011/05/23 22:01:50 | 000,000,000 | ---D | M] -- C:\Users\Chad\AppData\Roaming\OpenCandy
[2011/06/01 09:11:10 | 000,000,000 | ---D | M] -- C:\Users\Chad\AppData\Roaming\Toshiba
[2011/05/20 17:05:22 | 000,000,000 | ---D | M] -- C:\Users\Chad\AppData\Roaming\WinBatch
[2009/07/13 23:08:49 | 000,009,198 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT

========== Purity Check ==========

< End of report >

#24
Essexboy

Posted 06 June 2011 - 03:17 AM

GeekU Moderator

Retired Staff
69,964 posts

For some reason RogueKiller is unable to restore the attributes to the backup files.. Which I believe are the ones you are concerned about

Posted Image

Please download Malwarebytes' Anti-Malware from Here.

Double Click mbam-setup.exe to install the application.

Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
If an update is found, it will download and install the latest version.
Once the program has loaded, select "Perform Quick Scan", then click Scan.
The scan may take some time to finish,so please be patient.
When the scan is complete, click OK, then Show Results to view the results.
Make sure that everything is checked, and click Remove Selected.
When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
Copy&Paste the entire report in your next reply.

Extra Note:

If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process. If asked to restart the computer, please do so immediately.

#25
dragonledak

Posted 06 June 2011 - 08:45 AM

Member

Topic Starter
Member
16 posts

It found nothing.

Malwarebytes' Anti-Malware 1.51.0.1200
www.malwarebytes.org

Database version: 6788

Windows 6.1.7600
Internet Explorer 8.0.7600.16385

6/6/2011 8:33:52 AM
mbam-log-2011-06-06 (08-33-52).txt

Scan type: Quick scan
Objects scanned: 160648
Time elapsed: 1 minute(s), 53 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

#26
Essexboy

Posted 06 June 2011 - 09:32 AM

GeekU Moderator

Retired Staff
69,964 posts

Is it just the hidden files now that is a problem

On the files that are still hidden - can you right click them and select properties, then remove the ticks from the hidden box

[attachment=50646:Capture.GIF]

#27
dragonledak

Posted 06 June 2011 - 10:56 AM

Member

Topic Starter
Member
16 posts

Ok yes it is only the files that are a problem now. Do I need to check the hidden box becuase right now it is not checked.

Ok to be more specific both on the start menu and when I search my computer for the items they bring up an empty folder with the name I entered.

EX: Microsoft Office
Microsoft Office Tools
(empty)
TOSHIBA DVD PLAYER
(empty)

Ok when I searched for it is the start menu I was able to find microsoft word and it works, just seems like kind of a pain. It is under the start menu all programs and my computer search that it comes up with these empty folders.

Edited by dragonledak, 06 June 2011 - 10:58 AM.

#28
Essexboy

Posted 06 June 2011 - 11:21 AM

GeekU Moderator

Retired Staff
69,964 posts

I can still see the folders showing the H attributes

Lets see if OTL can fix it

Run OTL

Under the Custom Scans/Fixes box at the bottom, paste in the following

:files
attrib -H c:\*.* /s /d /c
Then click the Run Fix button at the top
Let the program run unhindered, reboot the PC when it is done
Open OTL again and click the Quick Scan button. Post the log it produces in your next reply.

#29
Essexboy

Posted 10 June 2011 - 06:22 AM

GeekU Moderator

Retired Staff
69,964 posts

Subject to no further problems :yes:

I will remove my tools now and give some recommendations, but, I would like you to run for 24 hours or so and come back if you have any problems

Now the best part of the day ----- Your log now appears clean

A good workman always cleans up after himself so..The following will implement some cleanup procedures as well as reset System Restore points:

Run OTL

Under the Custom Scans/Fixes box at the bottom, paste in the following

:Commands
[resethosts]
[purity]
[emptytemp]
[EMPTYFLASH]
[Reboot]

Then click the Run Fix button at the top
Let the program run unhindered, reboot the PC when it is done

Click Start > Run and copy/paste the following bolded text into the Run box and click OK:

ComboFix /Uninstall

Run OTL and hit the cleanup button. It will remove all the programmes we have used plus itself.

We will now confirm that your hidden files are set to that, as some of the tools I use will change that

Click Start.
Open My Computer.
Select the Tools menu and click Folder Options.
Select the View Tab.
Under the Hidden files and folders heading select Do not show hidden files and folders.
Click Yes to confirm.
Click OK.

Your Java is out of date. Older versions have vulnerabilities that malware can use to infect your system. Please follow these steps to remove older version of Java components and upgrade the application.

Upgrading Java:

Go to this site and click Do I have Java
It will check your current version and then offer to update to the latest version

SPRING CLEAN

To manually create a new Restore Point

Go to Control Panel and select System
Select System
On the left select System Protection and accept the warning if you get one
Select System Protection Tab
Select Create at the bottom
Type in a name i.e. Clean
Select Create

Now we can purge the infected ones

GoStart > All programs > Accessories > system tools page
Select Performance Information and Tools
Right click Disc cleanup an select run as administrator
Select Your main drive and accept the warning if you get one
For a few moments the system will make some calculations
Select the More Options tab
In the System Restore and Shadow Backups select Clean up
Select Delete on the pop up
Select OK
Select Delete

Now that you are clean, to help protect your computer in the future I recommend that you get the following free programmes:

Posted Image

Malwarebytes. Update and run weekly to keep your system clean

Download and install FileHippo update checker and run it monthly it will show you which programmes on your system need updating and give a download link

It is critical to have both a firewall and anti virus to protect your system and to keep them updated.

To keep your operating system up to date visit

Microsoft Windows Update

To learn more about how to protect yourself while on the internet read our little guide How did I get infected in the first place ?
Keep safe :unsure:

#30
Essexboy

Posted 14 June 2011 - 11:52 AM

GeekU Moderator

Retired Staff
69,964 posts

Since this issue appears to be resolved ... this Topic has been closed. Glad we could help.

If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread.

Everyone else please begin a New Topic.