Jump to content

Welcome to Geeks to Go - Register now for FREE

Need help with your computer or device? Want to learn new tech skills? You're in the right place!
Geeks to Go is a friendly community of tech experts who can solve any problem you have. Just create a free account and post your question. Our volunteers will reply quickly and guide you through the steps. Don't let tech troubles stop you. Join Geeks to Go now and get the support you need!

How it Works Create Account
Photo

Keylogger, CPU usage hits 100% constantly, even when idle and nothing&


  • Please log in to reply

#1
Dolch10Years

Dolch10Years

    New Member

  • Member
  • Pip
  • 5 posts
Hey GeeksToGo
So after months and months of ignoring these problems due to being busy with other things, I finally have time to pay attention to it.

What prompted me to look into my computer's problems just happened like an hour ago.
I turn on my computer, I open up Task Manager as I usually do, and I see like 6 wmpnscfg.exe processes open taking up a lot of cpu, and in a couple seconds, they all close.
Hmmmm....

I might have a keylogger running in the background.
Task Manager always shows two csrss.exe and rundll32.exe processes.
I asked someone if it was anything and they said it's a keylogger.
I'm concerned about that because, as badly as I want to buy stuff off Amazon and like shop for stuff on the internet, I'm paranoid to use my credit card now.

I often keep Task Manager running in the background, and every time I use my computer, Task Manager will show that my CPU Usage lingers around like 90 to 100, even when I leave my computer alone for a couple minutes.
When this happens, usually constantly, my CPU fan will blow like crazy.
Also, what's even weirder is that whenever I try to look into the problem, CPU usage drops to normal, shifting from 0 to 40 percent, like it is right now as I'm typing this.
In the past, my internet has dropped out and lagged on me, like even when it's sunny and my internet bill's been paid so maybe it's related to the CPU usage?


Another problem I've been having in the past is that Windows will randomly notify me that "new" people would connect to my home network.
That's a problem.
It could be like neighbors using my internet connection, or it could be something else that's far more dangerous, right?

Explorer.exe sometimes takes up a lot of memory, like pushing 50,000 and more.
Usually this happens when my comp is idle.
That's something I've been worried about.

Things I've used to try and fix these problems include using McAfee Antivirus and scanning, which usually comes up empty with 0 problems to be fixed, which I find hard to believe.
I've used CCleaner just to like empty out my internet cache, cookies, stuff like that, not really messing with the registry, log files and all that.
I downloaded MalwareBytes, had it scan my comp, again nothing popped up.

Basically, my problem is a laggy, sometimes slow computer with some suspect things going on.
When I bought this computer last year, it was a rocket, and it was only 512MB of RAM and running Windows XP.
Around Fall of last year to January of this year, it started to really lag on me, like I couldn't even run anything smoothly, so I had a guy look into it and clean it up, and it helped somewhat, but it was still slow.
Last month, I had my computer upgraded to Windows 7, put 2GB of RAM in my computer, and even though it's faster and things aren't freezing up on me or crashing, I still have these little annoying problems.

I've attached my OTL scan as well as the Extras.txt that came with it.

Some help would be greatly appreciated.

Thanks

OTL logfile created on: 4/14/2012 10:43:27 PM - Run 1
OTL by OldTimer - Version 3.2.39.2 Folder = C:\Users\Mark\Downloads
Ultimate Edition (Version = 6.1.7600) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

1.99 Gb Total Physical Memory | 1.40 Gb Available Physical Memory | 70.15% Memory free
3.98 Gb Paging File | 3.02 Gb Available in Paging File | 75.73% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 74.52 Gb Total Space | 35.80 Gb Free Space | 48.04% Space Free | Partition Type: NTFS

Computer Name: COMPAQ | User Name: Mark | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2012/04/14 22:42:44 | 000,593,920 | ---- | M] (OldTimer Tools) -- C:\Users\Mark\Downloads\OTL.exe
PRC - [2012/04/14 22:26:31 | 000,388,608 | ---- | M] (Trend Micro Inc.) -- C:\Users\Mark\Downloads\HijackThis.exe
PRC - [2012/02/18 07:59:28 | 000,282,648 | ---- | M] (McAfee, Inc.) -- c:\Program Files\McAfee\SiteAdvisor\saUI.exe
PRC - [2011/12/06 17:25:42 | 000,150,856 | ---- | M] (McAfee, Inc.) -- C:\Windows\System32\mfevtps.exe
PRC - [2011/12/06 17:21:24 | 000,160,608 | ---- | M] (McAfee, Inc.) -- C:\Program Files\Common Files\Mcafee\SystemCore\mfefire.exe
PRC - [2011/12/06 17:21:08 | 000,166,288 | ---- | M] (McAfee, Inc.) -- C:\Program Files\Common Files\Mcafee\SystemCore\mcshield.exe
PRC - [2011/11/22 17:18:26 | 001,318,816 | ---- | M] (McAfee, Inc.) -- C:\Program Files\McAfee.com\Agent\mcagent.exe
PRC - [2011/06/02 16:09:14 | 000,579,584 | ---- | M] (LOUD Technologies, Inc.) -- C:\Program Files\LoudAudio\MackieTaskBar.exe
PRC - [2011/04/08 13:59:50 | 000,419,904 | ---- | M] (McAfee, Inc.) -- C:\Program Files\McAfee\MAT\McPvTray.exe
PRC - [2011/02/25 22:33:07 | 002,614,784 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe
PRC - [2011/02/07 16:42:10 | 000,477,560 | ---- | M] (McAfee, Inc.) -- C:\Program Files\Common Files\Mcafee\MSC\McUICnt.exe
PRC - [2011/01/27 18:28:14 | 000,214,904 | ---- | M] (McAfee, Inc.) -- C:\Program Files\Common Files\Mcafee\McSvcHost\McSvHost.exe
PRC - [2010/12/14 07:31:12 | 000,184,552 | ---- | M] (McAfee, Inc.) -- C:\Program Files\McAfee\MSM\McSmtFwk.exe
PRC - [2009/07/13 18:14:42 | 000,049,152 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\taskhost.exe
PRC - [2009/04/14 07:43:42 | 000,604,704 | ---- | M] (Realtek Semiconductor Corp.) -- C:\Windows\SOUNDMAN.EXE
PRC - [2008/06/24 16:06:06 | 001,840,424 | ---- | M] (Nero AG) -- C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe


========== Modules (No Company Name) ==========

MOD - [2012/04/09 13:28:48 | 000,444,400 | ---- | M] () -- C:\Users\Mark\AppData\Local\Google\Chrome\Application\18.0.1025.152\ppgooglenaclpluginchrome.dll
MOD - [2012/04/09 13:28:46 | 003,915,248 | ---- | M] () -- C:\Users\Mark\AppData\Local\Google\Chrome\Application\18.0.1025.152\pdf.dll
MOD - [2012/04/09 13:27:21 | 000,122,880 | ---- | M] () -- C:\Users\Mark\AppData\Local\Google\Chrome\Application\18.0.1025.152\avutil-51.dll
MOD - [2012/04/09 13:27:20 | 000,220,672 | ---- | M] () -- C:\Users\Mark\AppData\Local\Google\Chrome\Application\18.0.1025.152\avformat-53.dll
MOD - [2012/04/09 13:27:19 | 001,747,456 | ---- | M] () -- C:\Users\Mark\AppData\Local\Google\Chrome\Application\18.0.1025.152\avcodec-53.dll
MOD - [2012/04/09 12:42:11 | 008,743,584 | ---- | M] () -- C:\Users\Mark\AppData\Local\Google\Chrome\Application\18.0.1025.152\gcswf32.dll


========== Win32 Services (SafeList) ==========

SRV - [2012/04/02 23:54:07 | 001,343,400 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\Wat\WatAdminSvc.exe -- (WatAdminSvc)
SRV - [2011/12/06 17:25:42 | 000,150,856 | ---- | M] (McAfee, Inc.) [Auto | Running] -- C:\Windows\System32\mfevtps.exe -- (mfevtp)
SRV - [2011/12/06 17:21:24 | 000,160,608 | ---- | M] () [Auto | Running] -- C:\Program Files\Common Files\McAfee\SystemCore\\mfefire.exe -- (mfefire)
SRV - [2011/12/06 17:21:08 | 000,166,288 | ---- | M] () [Auto | Running] -- C:\Program Files\Common Files\McAfee\SystemCore\\mcshield.exe -- (McShield)
SRV - [2011/10/18 16:59:54 | 000,361,976 | ---- | M] (McAfee, Inc.) [On_Demand | Stopped] -- C:\Program Files\McAfee\VirusScan\mcods.exe -- (McODS)
SRV - [2011/01/28 12:28:50 | 000,203,080 | ---- | M] (McAfee, Inc.) [On_Demand | Stopped] -- c:\Program Files\McAfee\MSC\McAWFwk.exe -- (McAWFwk)
SRV - [2011/01/27 18:28:14 | 000,214,904 | ---- | M] (McAfee, Inc.) [Auto | Running] -- C:\Program Files\Common Files\Mcafee\McSvcHost\McSvHost.exe -- (MSK80Service)
SRV - [2011/01/27 18:28:14 | 000,214,904 | ---- | M] (McAfee, Inc.) [Auto | Running] -- C:\Program Files\Common Files\Mcafee\McSvcHost\McSvHost.exe -- (McProxy)
SRV - [2011/01/27 18:28:14 | 000,214,904 | ---- | M] (McAfee, Inc.) [Disabled | Stopped] -- C:\Program Files\Common Files\Mcafee\McSvcHost\McSvHost.exe -- (McOobeSv)
SRV - [2011/01/27 18:28:14 | 000,214,904 | ---- | M] (McAfee, Inc.) [Auto | Running] -- C:\Program Files\Common Files\Mcafee\McSvcHost\McSvHost.exe -- (McNASvc)
SRV - [2011/01/27 18:28:14 | 000,214,904 | ---- | M] (McAfee, Inc.) [Auto | Running] -- C:\Program Files\Common Files\Mcafee\McSvcHost\McSvHost.exe -- (McNaiAnn)
SRV - [2011/01/27 18:28:14 | 000,214,904 | ---- | M] (McAfee, Inc.) [Auto | Running] -- C:\Program Files\Common Files\Mcafee\McSvcHost\McSvHost.exe -- (mcmscsvc)
SRV - [2011/01/27 18:28:14 | 000,214,904 | ---- | M] (McAfee, Inc.) [Auto | Running] -- C:\Program Files\Common Files\Mcafee\McSvcHost\McSvHost.exe -- (McMPFSvc)
SRV - [2011/01/27 18:28:14 | 000,214,904 | ---- | M] (McAfee, Inc.) [Auto | Running] -- C:\Program Files\Common Files\Mcafee\McSvcHost\McSvHost.exe -- (McAfee SiteAdvisor Service)
SRV - [2009/07/13 18:16:13 | 000,025,088 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\sensrsvc.dll -- (SensrSvc)
SRV - [2009/07/13 18:16:12 | 001,004,544 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\PeerDistSvc.dll -- (PeerDistSvc)
SRV - [2009/07/13 18:15:41 | 000,680,960 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)
SRV - [2003/04/18 16:06:26 | 000,008,192 | ---- | M] () [On_Demand | Stopped] -- C:\Program Files\Hawkes Learning Systems\Hawkes Update Service Manager\srvany.exe -- (HawkesUpdater)


========== Driver Services (SafeList) ==========

DRV - File not found [Kernel | On_Demand | Unknown] -- -- (mfeavfk01)
DRV - [2011/10/15 12:16:16 | 000,464,176 | ---- | M] (McAfee, Inc.) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\mfehidk.sys -- (mfehidk)
DRV - [2011/10/15 12:16:16 | 000,338,176 | ---- | M] (McAfee, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\mfefirek.sys -- (mfefirek)
DRV - [2011/10/15 12:16:16 | 000,180,816 | ---- | M] (McAfee, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\mfeavfk.sys -- (mfeavfk)
DRV - [2011/10/15 12:16:16 | 000,165,680 | ---- | M] (McAfee, Inc.) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\mfewfpk.sys -- (mfewfpk)
DRV - [2011/10/15 12:16:16 | 000,121,256 | ---- | M] (McAfee, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\mfeapfk.sys -- (mfeapfk)
DRV - [2011/10/15 12:16:16 | 000,087,656 | ---- | M] (McAfee, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\mferkdet.sys -- (mferkdet)
DRV - [2011/10/15 12:16:16 | 000,064,880 | ---- | M] (McAfee, Inc.) [Kernel | System | Running] -- C:\Windows\System32\drivers\mfenlfk.sys -- (mfenlfk)
DRV - [2011/10/15 12:16:16 | 000,059,456 | ---- | M] (McAfee, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\mfebopk.sys -- (mfebopk)
DRV - [2011/10/15 12:16:16 | 000,057,600 | ---- | M] (McAfee, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\cfwids.sys -- (cfwids)
DRV - [2011/06/02 16:14:46 | 000,063,552 | ---- | M] (LOUD Technologies, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\MackieUSB.sys -- (MackieUSB)
DRV - [2011/04/11 14:29:16 | 000,064,048 | ---- | M] (McAfee, Inc.) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\McPvDrv.sys -- (McPvDrv)
DRV - [2009/07/13 18:19:10 | 000,175,824 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\vmbus.sys -- (vmbus)
DRV - [2009/07/13 18:19:10 | 000,040,896 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\vmstorfl.sys -- (storflt)
DRV - [2009/07/13 18:19:10 | 000,028,224 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\storvsc.sys -- (storvsc)
DRV - [2009/07/13 16:51:11 | 000,034,944 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\winusb.sys -- (WinUsb)
DRV - [2009/07/13 16:28:47 | 000,005,632 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\vms3cap.sys -- (s3cap)
DRV - [2009/07/13 16:28:45 | 000,017,920 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\VMBusHID.sys -- (VMBusHID)
DRV - [2009/07/13 15:02:53 | 000,545,792 | ---- | M] (Ralink Technology, Corp.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\netr73.sys -- (netr73)
DRV - [2009/07/13 15:02:52 | 000,043,008 | ---- | M] (Realtek Semiconductor Corporation ) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\Rtnicxp.sys -- (RTL8023xp)
DRV - [2009/06/18 19:45:02 | 004,172,832 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\RTKVAC.SYS -- (ALCXWDM) Service for Realtek AC97 Audio (WDM)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/...ms}&FORM=IE8SRC

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://www.msn.com/?ocid=iehp
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = en-US
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 24 80 7C BE 29 15 CD 01 [binary data]
IE - HKCU\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/...Box&FORM=IE8SRC
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0


========== FireFox ==========

FF - HKLM\Software\MozillaPlugins\@mcafee.com/MSC,version=10: c:\progra~1\mcafee\msc\npmcsn~1.dll ()
FF - HKLM\Software\MozillaPlugins\@mcafee.com/SAFFPlugin: C:\Program Files\McAfee\SiteAdvisor\npmcffplg32.dll (McAfee, Inc.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=2.0.1: C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Users\Mark\AppData\Local\Google\Update\1.3.21.111\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Users\Mark\AppData\Local\Google\Update\1.3.21.111\npGoogleUpdate3.dll (Google Inc.)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{4ED1F68A-5463-4931-9384-8FFF5ED91D92}: C:\Program Files\McAfee\SiteAdvisor [2012/04/03 22:38:22 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{D19CA586-DD6C-4a0a-96F8-14644F340D60}: C:\Program Files\Common Files\McAfee\SystemCore [2012/04/14 22:20:11 | 000,000,000 | ---D | M]


========== Chrome ==========

CHR - default_search_provider: Google (Enabled)
CHR - default_search_provider: search_url = {google:baseURL}search?{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}{google:searchFieldtrialParameter}{google:instantFieldTrialGroupParameter}sourceid=chrome&ie={inputEncoding}&q={searchTerms}
CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}{google:instantFieldTrialGroupParameter}client=chrome&hl={language}&q={searchTerms}
CHR - plugin: Remoting Viewer (Enabled) = internal-remoting-viewer
CHR - plugin: Native Client (Enabled) = C:\Users\Mark\AppData\Local\Google\Chrome\Application\18.0.1025.152\ppGoogleNaClPluginChrome.dll
CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Users\Mark\AppData\Local\Google\Chrome\Application\18.0.1025.152\pdf.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Users\Mark\AppData\Local\Google\Chrome\Application\18.0.1025.152\gcswf32.dll
CHR - plugin: VLC Web Plugin (Enabled) = C:\Program Files\VideoLAN\VLC\npvlc.dll
CHR - plugin: Google Update (Enabled) = C:\Users\Mark\AppData\Local\Google\Update\1.3.21.111\npGoogleUpdate3.dll
CHR - Extension: YouTube = C:\Users\Mark\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\
CHR - Extension: Google Search = C:\Users\Mark\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\
CHR - Extension: SiteAdvisor = C:\Users\Mark\AppData\Local\Google\Chrome\User Data\Default\Extensions\fheoggkfdfchfphceeifdbepaooicaho\3.41.123.2_0\
CHR - Extension: Gmail = C:\Users\Mark\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\

O1 HOSTS File: ([2009/06/10 14:39:37 | 000,000,824 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O2 - BHO: (scriptproxy) - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\Common Files\Mcafee\SystemCore\ScriptSn.20120404013900.dll (McAfee, Inc.)
O2 - BHO: (McAfee SiteAdvisor BHO) - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - c:\Program Files\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
O3 - HKLM\..\Toolbar: (McAfee SiteAdvisor Toolbar) - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\Program Files\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
O4 - HKLM..\Run: [Loud Taskbar] C:\Program Files\LoudAudio\MackieTaskBar.exe (LOUD Technologies, Inc.)
O4 - HKLM..\Run: [McPvTray_exe] C:\Program Files\McAfee\MAT\McPvTray.exe (McAfee, Inc.)
O4 - HKLM..\Run: [mcui_exe] C:\Program Files\McAfee.com\Agent\mcagent.exe (McAfee, Inc.)
O4 - HKLM..\Run: [NeroFilterCheck] C:\Windows\System32\NeroCheck.exe (Ahead Software Gmbh)
O4 - HKLM..\Run: [SoundMan] C:\Windows\SOUNDMAN.EXE (Realtek Semiconductor Corp.)
O4 - HKCU..\Run: [IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe (Nero AG)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O13 - gopher Prefix: missing
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.254
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{23FA1743-221B-4F35-89CA-14FE78318388}: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{2C5E10F7-F8D0-4216-A6AE-89427D7C534A}: DhcpNameServer = 192.168.1.254
O18 - Protocol\Handler\dssrequest {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\Program Files\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
O18 - Protocol\Handler\sacore {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\Program Files\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
O18 - Protocol\Filter\application/x-mfe-ipt {3EF5086B-5478-4598-A054-786C45D75692} - c:\Program Files\McAfee\MSC\McSnIePl.dll (McAfee, Inc.)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009/06/10 14:42:20 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2012/04/14 22:31:45 | 000,000,000 | ---D | C] -- C:\Users\Mark\Documents\Other
[2012/04/07 18:35:27 | 000,000,000 | ---D | C] -- C:\Users\Mark\Desktop\Beats Rough
[2012/04/04 23:25:55 | 000,000,000 | ---D | C] -- C:\Users\Mark\Documents\Hawkes Learning Systems
[2012/04/04 23:13:20 | 000,000,000 | ---D | C] -- C:\Users\Mark\AppData\Roaming\Malwarebytes
[2012/04/04 23:13:13 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2012/04/04 23:13:12 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2012/04/04 23:13:11 | 000,020,464 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys
[2012/04/04 23:13:11 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware
[2012/04/03 22:38:34 | 000,000,000 | ---D | C] -- C:\Windows\Minidump
[2012/04/02 23:54:08 | 000,000,000 | ---D | C] -- C:\Windows\System32\Wat
[2012/04/02 01:39:35 | 000,000,000 | ---D | C] -- C:\Program Files\MSXML 4.0
[2012/04/02 01:39:23 | 000,000,000 | ---D | C] -- C:\a756b714c39790502327d4c32bb8986c
[2012/04/02 01:26:39 | 000,000,000 | ---D | C] -- C:\Users\Mark\AppData\Roaming\Audacity
[2012/04/01 22:37:31 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Camel Audio
[2012/04/01 22:37:30 | 000,000,000 | ---D | C] -- C:\Program Files\Camel Audio
[2012/04/01 22:37:29 | 000,000,000 | ---D | C] -- C:\ProgramData\Camel Audio
[2012/04/01 22:08:24 | 000,000,000 | ---D | C] -- C:\Users\Mark\Documents\BullzipPDFPrinter_7_2_0_1338
[2012/04/01 22:06:45 | 000,000,000 | ---D | C] -- C:\Users\Mark\Documents\School
[2012/04/01 22:05:17 | 000,000,000 | -H-D | C] -- C:\ProgramData\{93906220-8503-45CF-87CB-5A54C8DE1AB2}
[2012/04/01 21:54:59 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Hawkes Learning Systems
[2012/04/01 21:54:55 | 000,344,064 | ---- | C] (RSP Software - http://rspsoftware.clic3.net) -- C:\Windows\System32\rsp_ogg_player_ocx2.dll
[2012/04/01 21:54:54 | 000,344,064 | ---- | C] (RSP Software - http://rspsoftware.clic3.net) -- C:\Windows\System32\rsp_ogg_player_ocx1.dll
[2012/04/01 21:54:53 | 000,372,736 | ---- | C] (Aivosto Oy) -- C:\Windows\System32\vbwExtender.ocx
[2012/04/01 21:54:53 | 000,205,848 | ---- | C] (Sheridan Software Systems, Inc.) -- C:\Windows\System32\THREED32.OCX
[2012/04/01 21:54:52 | 001,328,824 | ---- | C] (FarPoint Technologies, Inc.) -- C:\Windows\System32\SPR32X60.ocx
[2012/04/01 21:54:51 | 000,159,744 | ---- | C] (RSP Software - http://svansa.tripod.com) -- C:\Windows\System32\rsp_ogg_vorbis_ocx_320reg.ocx
[2012/04/01 21:53:35 | 000,000,000 | ---D | C] -- C:\Program Files\Hawkes Learning Systems
[2012/04/01 21:52:06 | 000,000,000 | ---D | C] -- C:\Windows\System32\Macromed
[2012/04/01 21:51:21 | 000,000,000 | -H-D | C] -- C:\ProgramData\{A77F137D-236E-4155-A17D-2DA1AC94D44C}
[2012/04/01 21:50:54 | 000,000,000 | ---D | C] -- C:\Users\Mark\AppData\Local\PackageAware
[2012/04/01 21:17:53 | 000,064,048 | ---- | C] (McAfee, Inc.) -- C:\Windows\System32\drivers\McPvDrv.sys
[2012/04/01 21:17:52 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\McAfee
[2012/04/01 21:17:51 | 000,000,000 | R-SD | C] -- C:\Users\Mark\Documents\McAfee Vaults
[2012/04/01 21:17:51 | 000,000,000 | ---D | C] -- C:\Users\Mark\AppData\Local\McAfee Anti-Theft
[2012/04/01 21:17:05 | 000,009,608 | ---- | C] (McAfee, Inc.) -- C:\Windows\System32\drivers\mfeclnk.sys
[2012/04/01 21:15:59 | 000,165,680 | ---- | C] (McAfee, Inc.) -- C:\Windows\System32\drivers\mfewfpk.sys
[2012/04/01 21:15:59 | 000,064,880 | ---- | C] (McAfee, Inc.) -- C:\Windows\System32\drivers\mfenlfk.sys
[2012/04/01 21:15:58 | 000,464,176 | ---- | C] (McAfee, Inc.) -- C:\Windows\System32\drivers\mfehidk.sys
[2012/04/01 21:15:58 | 000,338,176 | ---- | C] (McAfee, Inc.) -- C:\Windows\System32\drivers\mfefirek.sys
[2012/04/01 21:15:58 | 000,180,816 | ---- | C] (McAfee, Inc.) -- C:\Windows\System32\drivers\mfeavfk.sys
[2012/04/01 21:15:58 | 000,121,256 | ---- | C] (McAfee, Inc.) -- C:\Windows\System32\drivers\mfeapfk.sys
[2012/04/01 21:15:58 | 000,087,656 | ---- | C] (McAfee, Inc.) -- C:\Windows\System32\drivers\mferkdet.sys
[2012/04/01 21:15:58 | 000,059,456 | ---- | C] (McAfee, Inc.) -- C:\Windows\System32\drivers\mfebopk.sys
[2012/04/01 21:15:58 | 000,057,600 | ---- | C] (McAfee, Inc.) -- C:\Windows\System32\drivers\cfwids.sys
[2012/04/01 21:15:46 | 000,000,000 | ---D | C] -- C:\Program Files\McAfee.com
[2012/04/01 21:15:46 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Mcafee
[2012/04/01 21:15:40 | 000,000,000 | ---D | C] -- C:\Program Files\McAfee
[2012/04/01 21:08:21 | 000,000,000 | ---D | C] -- C:\ProgramData\McAfee
[2012/04/01 21:01:46 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CCleaner
[2012/04/01 21:01:45 | 000,000,000 | ---D | C] -- C:\Program Files\CCleaner
[2012/04/01 20:48:02 | 000,225,280 | ---- | C] (Propellerhead Software AB) -- C:\Windows\System32\rewire.dll
[2012/04/01 20:48:02 | 000,000,000 | ---D | C] -- C:\Program Files\VstPlugins
[2012/04/01 20:48:00 | 000,000,000 | ---D | C] -- C:\Users\Mark\Documents\Image-Line
[2012/04/01 20:47:48 | 000,000,000 | ---D | C] -- C:\Users\Mark\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Image-Line
[2012/04/01 20:47:37 | 000,000,000 | ---D | C] -- C:\Program Files\Outsim
[2012/04/01 20:44:15 | 000,000,000 | ---D | C] -- C:\Program Files\Image-Line
[2012/04/01 20:42:18 | 000,000,000 | ---D | C] -- C:\Program Files\Audacity
[2012/04/01 20:26:22 | 000,000,000 | ---D | C] -- C:\Program Files\DIFX
[2012/04/01 20:17:22 | 000,000,000 | ---D | C] -- C:\Program Files\LoudAudio
[2012/04/01 20:15:41 | 000,232,448 | ---- | C] (LOUD Technologies, Inc.) -- C:\Windows\Mackie64.exe
[2012/04/01 20:15:41 | 000,204,800 | ---- | C] (LOUD Technologies, Inc.) -- C:\Windows\Mackie.exe
[2012/04/01 20:15:41 | 000,063,552 | ---- | C] (LOUD Technologies, Inc.) -- C:\Windows\System32\drivers\MackieUSB.sys
[2012/04/01 20:14:02 | 000,000,000 | ---D | C] -- C:\Users\Mark\AppData\Roaming\WinRAR
[2012/04/01 20:14:01 | 000,000,000 | ---D | C] -- C:\Users\Mark\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WinRAR
[2012/04/01 20:14:01 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinRAR
[2012/04/01 20:13:34 | 000,000,000 | ---D | C] -- C:\Program Files\WinRAR
[2012/04/01 20:12:48 | 000,000,000 | ---D | C] -- C:\Users\Mark\AppData\Roaming\Macromedia
[2012/04/01 20:12:48 | 000,000,000 | ---D | C] -- C:\Users\Mark\AppData\Roaming\Adobe
[2012/04/01 20:09:32 | 000,000,000 | ---D | C] -- C:\Users\Mark\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Google Chrome
[2012/04/01 20:07:05 | 000,000,000 | ---D | C] -- C:\Users\Mark\AppData\Local\Google
[2012/04/01 19:39:34 | 000,000,000 | ---D | C] -- C:\Users\Mark\AppData\Local\Diagnostics
[2012/04/01 19:37:11 | 000,000,000 | ---D | C] -- C:\Users\Mark\Documents\Music
[2012/04/01 18:06:37 | 000,000,000 | ---D | C] -- C:\Users\Mark\AppData\Roaming\dvdcss
[2012/04/01 18:04:49 | 000,000,000 | ---D | C] -- C:\Users\Mark\AppData\Roaming\vlc
[2012/04/01 18:04:41 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VideoLAN
[2012/04/01 18:04:04 | 000,000,000 | ---D | C] -- C:\Program Files\VideoLAN
[2012/03/31 22:56:24 | 000,000,000 | ---D | C] -- C:\Users\Mark\AppData\Local\Babylon
[2012/03/31 22:56:22 | 000,000,000 | ---D | C] -- C:\Program Files\FoxTabVideoConverter
[2012/03/31 22:56:18 | 000,000,000 | ---D | C] -- C:\Users\Mark\AppData\Roaming\Babylon
[2012/03/31 22:56:18 | 000,000,000 | ---D | C] -- C:\ProgramData\Babylon
[2012/03/31 22:19:28 | 000,000,000 | ---D | C] -- C:\Users\Mark\AppData\Roaming\CyberLink
[2012/03/31 22:19:11 | 000,000,000 | ---D | C] -- C:\Users\Mark\Documents\CyberLink
[2012/03/31 22:18:07 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CyberLink PowerDVD
[2012/03/31 22:18:02 | 000,000,000 | ---D | C] -- C:\ProgramData\CyberLink
[2012/03/31 22:17:57 | 000,000,000 | -H-D | C] -- C:\Program Files\InstallShield Installation Information
[2012/03/31 22:17:55 | 000,000,000 | ---D | C] -- C:\Program Files\CyberLink
[2012/03/31 22:11:52 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\InstallShield
[2012/03/31 21:46:52 | 000,000,000 | ---D | C] -- C:\Users\Mark\AppData\Roaming\Nero
[2012/03/31 21:42:42 | 000,000,000 | ---D | C] -- C:\Users\Mark\AppData\Local\Ahead
[2012/03/31 21:42:06 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Nero 8
[2012/03/31 21:39:04 | 000,000,000 | ---D | C] -- C:\ProgramData\Nero
[2012/03/31 21:39:04 | 000,000,000 | ---D | C] -- C:\Program Files\Nero
[2012/03/31 21:39:04 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Nero
[2012/03/31 21:12:32 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Nero
[2012/03/31 21:11:36 | 000,106,496 | ---- | C] (Pegasus Software) -- C:\Windows\System32\TwnLib20.dll
[2012/03/31 21:11:32 | 000,038,912 | ---- | C] (Pegasus Imaging Corp.) -- C:\Windows\System32\picn20.dll
[2012/03/31 21:11:30 | 000,569,344 | ---- | C] (Pegasus Software,LLC) -- C:\Windows\System32\imagr5.dll
[2012/03/31 21:11:30 | 000,544,768 | ---- | C] (Pegasus Software, LLC) -- C:\Windows\System32\imagx5.dll
[2012/03/31 21:11:30 | 000,283,920 | ---- | C] (Pegasus Software, LLC) -- C:\Windows\System32\ImagXpr5.dll
[2012/03/31 21:11:27 | 000,155,648 | ---- | C] (Ahead Software Gmbh) -- C:\Windows\System32\NeroCheck.exe
[2012/03/31 21:11:27 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Ahead
[2012/03/31 21:11:22 | 000,000,000 | ---D | C] -- C:\Program Files\Ahead
[2012/03/31 20:47:37 | 000,000,000 | ---D | C] -- C:\Windows\Panther
[2012/03/31 20:47:22 | 000,000,000 | -HSD | C] -- C:\Boot
[2012/03/31 20:35:15 | 000,000,000 | ---D | C] -- C:\Windows.old
[2012/03/31 20:34:08 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office
[2012/03/31 20:34:00 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft ActiveSync
[2012/03/31 20:33:39 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\DESIGNER
[2012/03/31 20:33:24 | 000,000,000 | ---D | C] -- C:\Windows\PCHEALTH
[2012/03/31 20:33:24 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft.NET
[2012/03/31 20:24:28 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft Office
[2012/03/31 20:08:56 | 000,000,000 | ---D | C] -- C:\Users\Mark\AppData\Local\Microsoft Help
[2012/03/31 20:08:51 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft Help
[2012/03/31 20:08:44 | 000,000,000 | -HSD | C] -- C:\Windows\Installer
[2012/03/31 20:02:37 | 000,000,000 | R--D | C] -- C:\Users\Mark\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
[2012/03/31 20:02:37 | 000,000,000 | R--D | C] -- C:\Users\Mark\Searches
[2012/03/31 20:02:37 | 000,000,000 | R--D | C] -- C:\Users\Mark\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools
[2012/03/31 20:02:36 | 000,000,000 | -H-D | C] -- C:\Users\Mark\Application Data\Microsoft\Internet Explorer\Quick Launch\User Pinned
[2012/03/31 20:02:23 | 000,000,000 | ---D | C] -- C:\Users\Mark\AppData\Roaming\Identities
[2012/03/31 20:02:15 | 000,000,000 | R--D | C] -- C:\Users\Mark\Contacts
[2012/03/31 20:01:53 | 000,000,000 | ---D | C] -- C:\Users\Mark\AppData\Local\VirtualStore
[2012/03/31 20:01:48 | 000,000,000 | --SD | C] -- C:\Users\Mark\AppData\Roaming\Microsoft
[2012/03/31 20:01:48 | 000,000,000 | R--D | C] -- C:\Users\Mark\Videos
[2012/03/31 20:01:48 | 000,000,000 | R--D | C] -- C:\Users\Mark\Saved Games
[2012/03/31 20:01:48 | 000,000,000 | R--D | C] -- C:\Users\Mark\Pictures
[2012/03/31 20:01:48 | 000,000,000 | R--D | C] -- C:\Users\Mark\Music
[2012/03/31 20:01:48 | 000,000,000 | R--D | C] -- C:\Users\Mark\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance
[2012/03/31 20:01:48 | 000,000,000 | R--D | C] -- C:\Users\Mark\Links
[2012/03/31 20:01:48 | 000,000,000 | R--D | C] -- C:\Users\Mark\Favorites
[2012/03/31 20:01:48 | 000,000,000 | R--D | C] -- C:\Users\Mark\Downloads
[2012/03/31 20:01:48 | 000,000,000 | R--D | C] -- C:\Users\Mark\Documents
[2012/03/31 20:01:48 | 000,000,000 | R--D | C] -- C:\Users\Mark\Desktop
[2012/03/31 20:01:48 | 000,000,000 | R--D | C] -- C:\Users\Mark\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories
[2012/03/31 20:01:48 | 000,000,000 | -HSD | C] -- C:\Users\Mark\AppData\Local\Temporary Internet Files
[2012/03/31 20:01:48 | 000,000,000 | -HSD | C] -- C:\Users\Mark\Templates
[2012/03/31 20:01:48 | 000,000,000 | -HSD | C] -- C:\Users\Mark\Start Menu
[2012/03/31 20:01:48 | 000,000,000 | -HSD | C] -- C:\Users\Mark\SendTo
[2012/03/31 20:01:48 | 000,000,000 | -HSD | C] -- C:\Users\Mark\Recent
[2012/03/31 20:01:48 | 000,000,000 | -HSD | C] -- C:\Users\Mark\PrintHood
[2012/03/31 20:01:48 | 000,000,000 | -HSD | C] -- C:\Users\Mark\NetHood
[2012/03/31 20:01:48 | 000,000,000 | -HSD | C] -- C:\Users\Mark\Documents\My Videos
[2012/03/31 20:01:48 | 000,000,000 | -HSD | C] -- C:\Users\Mark\Documents\My Pictures
[2012/03/31 20:01:48 | 000,000,000 | -HSD | C] -- C:\Users\Mark\Documents\My Music
[2012/03/31 20:01:48 | 000,000,000 | -HSD | C] -- C:\Users\Mark\My Documents
[2012/03/31 20:01:48 | 000,000,000 | -HSD | C] -- C:\Users\Mark\Local Settings
[2012/03/31 20:01:48 | 000,000,000 | -HSD | C] -- C:\Users\Mark\AppData\Local\History
[2012/03/31 20:01:48 | 000,000,000 | -HSD | C] -- C:\Users\Mark\Cookies
[2012/03/31 20:01:48 | 000,000,000 | -HSD | C] -- C:\Users\Mark\Application Data
[2012/03/31 20:01:48 | 000,000,000 | -HSD | C] -- C:\Users\Mark\AppData\Local\Application Data
[2012/03/31 20:01:48 | 000,000,000 | -H-D | C] -- C:\Users\Mark\AppData
[2012/03/31 20:01:48 | 000,000,000 | ---D | C] -- C:\Users\Mark\AppData\Local\Temp
[2012/03/31 20:01:48 | 000,000,000 | ---D | C] -- C:\Users\Mark\AppData\Local\Microsoft
[2012/03/31 20:01:48 | 000,000,000 | ---D | C] -- C:\Users\Mark\AppData\Roaming\Media Center Programs
[2012/03/31 20:01:29 | 000,000,000 | -HSD | C] -- C:\Recovery
[2012/03/31 19:52:15 | 000,000,000 | ---D | C] -- C:\Windows\SoftwareDistribution
[2012/03/31 19:49:02 | 000,000,000 | ---D | C] -- C:\Windows\Prefetch

========== Files - Modified Within 30 Days ==========

[2012/04/14 22:24:37 | 000,014,224 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2012/04/14 22:24:37 | 000,014,224 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2012/04/14 22:23:17 | 000,623,940 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2012/04/14 22:23:17 | 000,106,316 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2012/04/14 22:21:24 | 000,001,828 | ---- | M] () -- C:\Users\Public\Desktop\McAfee Total Protection.lnk
[2012/04/14 22:15:58 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2012/04/14 22:15:52 | 1603,969,024 | -HS- | M] () -- C:\hiberfil.sys
[2012/04/14 00:12:00 | 000,000,904 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-406179606-2168368824-3621562350-1000UA.job
[2012/04/13 20:12:02 | 000,000,852 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-406179606-2168368824-3621562350-1000Core.job
[2012/04/09 19:20:55 | 000,002,354 | ---- | M] () -- C:\Users\Mark\Desktop\Google Chrome.lnk
[2012/04/03 10:21:45 | 000,001,407 | ---- | M] () -- C:\Users\Mark\Application Data\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk
[2012/04/03 10:19:28 | 000,359,352 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT
[2012/04/03 00:02:02 | 000,072,822 | ---- | M] () -- C:\Windows\System32\ieuinit.inf
[2012/04/01 23:49:40 | 000,000,000 | -H-- | M] () -- C:\Windows\System32\drivers\Msft_User_WpdMtpDr_01_09_00.Wdf
[2012/04/01 21:54:59 | 000,001,275 | ---- | M] () -- C:\Users\Public\Desktop\Intermediate Algebra.lnk
[2012/04/01 21:01:46 | 000,000,965 | ---- | M] () -- C:\Users\Public\Desktop\CCleaner.lnk
[2012/04/01 20:48:02 | 000,001,104 | ---- | M] () -- C:\Users\Mark\Desktop\FL Studio 10.lnk
[2012/04/01 20:42:40 | 000,000,965 | ---- | M] () -- C:\Users\Mark\Desktop\Audacity.lnk
[2012/04/01 19:41:13 | 000,000,000 | -H-- | M] () -- C:\Users\Mark\Documents\Default.rdp
[2012/04/01 18:04:41 | 000,001,024 | ---- | M] () -- C:\Users\Public\Desktop\VLC media player.lnk
[2012/03/31 22:30:09 | 000,000,042 | ---- | M] () -- C:\Users\Mark\AppData\Roaming\default.pls
[2012/03/31 21:42:04 | 000,002,703 | ---- | M] () -- C:\Users\Mark\Application Data\Microsoft\Internet Explorer\Quick Launch\Nero StartSmart Essentials.lnk
[2012/03/31 21:42:04 | 000,002,679 | ---- | M] () -- C:\Users\Public\Desktop\Nero StartSmart Essentials.lnk
[2012/03/31 21:42:04 | 000,002,605 | ---- | M] () -- C:\Users\Mark\Application Data\Microsoft\Internet Explorer\Quick Launch\Nero Home Essentials SE.lnk
[2012/03/31 21:42:04 | 000,002,581 | ---- | M] () -- C:\Users\Public\Desktop\Nero Home Essentials SE.lnk
[2012/03/31 21:41:13 | 000,001,024 | ---- | M] () -- C:\Users\Mark\.rnd
[2012/03/31 21:12:40 | 000,001,568 | ---- | M] () -- C:\Users\Mark\Application Data\Microsoft\Internet Explorer\Quick Launch\Nero StartSmart.lnk
[2012/03/31 20:47:25 | 000,008,192 | RHS- | M] () -- C:\BOOTSECT.BAK
[2012/03/31 20:47:23 | 000,000,355 | RHS- | M] () -- C:\Boot.ini.saved
[2012/03/31 20:47:08 | 000,001,345 | ---- | M] () -- C:\Users\Mark\Desktop\Media Center.lnk
[2012/03/31 20:46:59 | 000,001,326 | ---- | M] () -- C:\Users\Mark\Desktop\Windows DVD Maker.lnk
[2012/03/31 20:46:52 | 000,002,645 | ---- | M] () -- C:\Users\Mark\Desktop\Microsoft Office PowerPoint 2003.lnk
[2012/03/31 20:46:45 | 000,002,693 | ---- | M] () -- C:\Users\Mark\Desktop\Microsoft Office Outlook 2003.lnk
[2012/03/31 20:46:39 | 000,002,675 | ---- | M] () -- C:\Users\Mark\Desktop\Microsoft Office Word 2003.lnk
[2012/03/31 20:35:39 | 000,000,376 | ---- | M] () -- C:\Windows\ODBC.INI
[2012/03/31 20:04:49 | 000,000,003 | RHS- | M] () -- C:\win7ldr
[2012/03/31 20:04:49 | 000,000,003 | ---- | M] () -- C:\Windows\7Loader.TAG
[2012/03/31 20:04:06 | 000,203,316 | RHS- | M] () -- C:\grldr
[2012/03/31 19:53:18 | 000,042,045 | ---- | M] () -- C:\Windows\System32\license.rtf
[2012/03/31 19:51:07 | 000,000,000 | -H-- | M] () -- C:\Windows\System32\drivers\Msft_User_WpdFs_01_09_00.Wdf

========== Files Created - No Company Name ==========

[2012/04/03 10:21:45 | 000,001,413 | ---- | C] () -- C:\Users\Mark\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
[2012/04/03 00:02:02 | 000,072,822 | ---- | C] () -- C:\Windows\System32\ieuinit.inf
[2012/04/01 23:49:40 | 000,000,000 | -H-- | C] () -- C:\Windows\System32\drivers\Msft_User_WpdMtpDr_01_09_00.Wdf
[2012/04/01 21:54:59 | 000,001,275 | ---- | C] () -- C:\Users\Public\Desktop\Intermediate Algebra.lnk
[2012/04/01 21:20:06 | 000,001,828 | ---- | C] () -- C:\Users\Public\Desktop\McAfee Total Protection.lnk
[2012/04/01 21:01:46 | 000,000,965 | ---- | C] () -- C:\Users\Public\Desktop\CCleaner.lnk
[2012/04/01 20:48:02 | 000,001,104 | ---- | C] () -- C:\Users\Mark\Desktop\FL Studio 10.lnk
[2012/04/01 20:42:40 | 000,000,977 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Audacity.lnk
[2012/04/01 20:42:40 | 000,000,965 | ---- | C] () -- C:\Users\Mark\Desktop\Audacity.lnk
[2012/04/01 20:15:41 | 000,193,088 | ---- | C] () -- C:\Windows\System32\LoudAudioProp.dll
[2012/04/01 20:15:41 | 000,122,944 | ---- | C] () -- C:\Windows\System32\MackieAsio.dll
[2012/04/01 20:09:36 | 000,002,354 | ---- | C] () -- C:\Users\Mark\Desktop\Google Chrome.lnk
[2012/04/01 20:07:10 | 000,000,904 | ---- | C] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-406179606-2168368824-3621562350-1000UA.job
[2012/04/01 20:07:05 | 000,000,852 | ---- | C] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-406179606-2168368824-3621562350-1000Core.job
[2012/04/01 19:41:13 | 000,000,000 | -H-- | C] () -- C:\Users\Mark\Documents\Default.rdp
[2012/04/01 18:04:41 | 000,001,024 | ---- | C] () -- C:\Users\Public\Desktop\VLC media player.lnk
[2012/03/31 22:30:09 | 000,000,042 | ---- | C] () -- C:\Users\Mark\AppData\Roaming\default.pls
[2012/03/31 21:42:04 | 000,002,703 | ---- | C] () -- C:\Users\Mark\Application Data\Microsoft\Internet Explorer\Quick Launch\Nero StartSmart Essentials.lnk
[2012/03/31 21:42:04 | 000,002,679 | ---- | C] () -- C:\Users\Public\Desktop\Nero StartSmart Essentials.lnk
[2012/03/31 21:42:04 | 000,002,605 | ---- | C] () -- C:\Users\Mark\Application Data\Microsoft\Internet Explorer\Quick Launch\Nero Home Essentials SE.lnk
[2012/03/31 21:42:04 | 000,002,581 | ---- | C] () -- C:\Users\Public\Desktop\Nero Home Essentials SE.lnk
[2012/03/31 21:41:12 | 000,001,024 | ---- | C] () -- C:\Users\Mark\.rnd
[2012/03/31 21:12:40 | 000,001,568 | ---- | C] () -- C:\Users\Mark\Application Data\Microsoft\Internet Explorer\Quick Launch\Nero StartSmart.lnk
[2012/03/31 20:47:25 | 000,008,192 | RHS- | C] () -- C:\BOOTSECT.BAK
[2012/03/31 20:47:23 | 000,383,562 | RHS- | C] () -- C:\bootmgr
[2012/03/31 20:47:23 | 000,000,211 | -H-- | C] () -- C:\Boot.BAK
[2012/03/31 20:47:08 | 000,001,345 | ---- | C] () -- C:\Users\Mark\Desktop\Media Center.lnk
[2012/03/31 20:46:59 | 000,001,326 | ---- | C] () -- C:\Users\Mark\Desktop\Windows DVD Maker.lnk
[2012/03/31 20:46:52 | 000,002,645 | ---- | C] () -- C:\Users\Mark\Desktop\Microsoft Office PowerPoint 2003.lnk
[2012/03/31 20:46:45 | 000,002,693 | ---- | C] () -- C:\Users\Mark\Desktop\Microsoft Office Outlook 2003.lnk
[2012/03/31 20:46:39 | 000,002,675 | ---- | C] () -- C:\Users\Mark\Desktop\Microsoft Office Word 2003.lnk
[2012/03/31 20:35:39 | 000,000,376 | ---- | C] () -- C:\Windows\ODBC.INI
[2012/03/31 20:23:26 | 000,001,407 | ---- | C] () -- C:\Users\Mark\Application Data\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk
[2012/03/31 20:04:49 | 000,203,316 | RHS- | C] () -- C:\grldr
[2012/03/31 20:04:49 | 000,000,003 | RHS- | C] () -- C:\win7ldr
[2012/03/31 20:04:49 | 000,000,003 | ---- | C] () -- C:\Windows\7Loader.TAG
[2012/03/31 20:01:48 | 000,000,290 | ---- | C] () -- C:\Users\Mark\Application Data\Microsoft\Internet Explorer\Quick Launch\Shows Desktop.lnk
[2012/03/31 20:01:48 | 000,000,272 | ---- | C] () -- C:\Users\Mark\Application Data\Microsoft\Internet Explorer\Quick Launch\Window Switcher.lnk
[2012/03/31 19:53:03 | 000,001,345 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Media Center.lnk
[2012/03/31 19:52:55 | 000,001,326 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows DVD Maker.lnk
[2012/03/31 19:51:07 | 000,000,000 | -H-- | C] () -- C:\Windows\System32\drivers\Msft_User_WpdFs_01_09_00.Wdf
[2012/03/31 19:48:32 | 1603,969,024 | -HS- | C] () -- C:\hiberfil.sys

========== LOP Check ==========

[2012/04/10 23:59:53 | 000,000,000 | ---D | M] -- C:\Users\Mark\AppData\Roaming\Audacity
[2012/03/31 22:56:18 | 000,000,000 | ---D | M] -- C:\Users\Mark\AppData\Roaming\Babylon
[2009/07/13 21:53:46 | 000,011,582 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT

========== Purity Check ==========



< End of report >

Attached Files


  • 0

Advertisements


#2
Gammo

Gammo

    Member 2k

  • Malware Removal
  • 2,299 posts
Hello and welcome to Geekstogo!

We apologize for the delay in responding to your request for help.
If you have since resolved the original problem you were having, we would appreciate you letting us know. If not please perform the following steps below so we can have a look at the current condition of your machine.

Please include a clear description of the problems you're having, along with any steps you may have performed so far.

Please refrain from running tools or applying updates other than those we suggest while we are cleaning up your computer. The reason for this is so we know what is going on with the machine at any time. Some programs can interfere with others and hamper the recovery process.

If you haven't done so yet, please go to Malware and Spyware Cleaning Guide and follow the steps instructed there. If you have already done this, we still need a new log to see what has changed since you originally posted your problem.

We need to create an OTL Report
Download OTL to your Desktop
  • Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
  • Check the box that says Scan All Users.
  • Click the Quick Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
  • When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.
  • Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time and post them in your topic.

In the upper right hand corner of the topic you will see a button called Options. If you click on this in the drop-down menu you can choose Track this topic. I suggest you do this and select Immediate E-Mail notification and click on Proceed. This way you will be advised when we respond to your topic and facilitate the cleaning of your machine.

After 5 days if a topic is not replied to we assume it has been abandoned and it is closed.
  • 0

#3
Dolch10Years

Dolch10Years

    New Member

  • Topic Starter
  • Member
  • Pip
  • 5 posts
Hi GeeksToGo
Sorry for posting so late.
Um, I posted my OTL report in my original post?
Anyway, the problems are still persisting as I'm typing this.

Any help would be greatly appreciated

Thanks
  • 0

#4
Gammo

Gammo

    Member 2k

  • Malware Removal
  • 2,299 posts
That log file in your start post is from the 14th. I'd like a fresh OTL log to work with. :)

We need to create an OTL Report
Download OTL to your Desktop
  • Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
  • Check the box that says Scan All Users.
  • Click the Quick Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
  • When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.
  • Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time and post them in your topic.

  • 0

#5
Dolch10Years

Dolch10Years

    New Member

  • Topic Starter
  • Member
  • Pip
  • 5 posts
Alright, no problem.
I'll do it once I get home.
  • 0

#6
Dolch10Years

Dolch10Years

    New Member

  • Topic Starter
  • Member
  • Pip
  • 5 posts
Hey Gammo

Scanned my computer with OTL again.
Here ya go, work your magic.

OTL logfile created on: 4/23/2012 7:12:27 PM - Run 2
OTL by OldTimer - Version 3.2.39.2 Folder = C:\Users\Mark\Downloads
Ultimate Edition (Version = 6.1.7600) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

1.99 Gb Total Physical Memory | 1.24 Gb Available Physical Memory | 62.36% Memory free
3.98 Gb Paging File | 3.20 Gb Available in Paging File | 80.45% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 74.52 Gb Total Space | 37.03 Gb Free Space | 49.70% Space Free | Partition Type: NTFS

Computer Name: COMPAQ | User Name: Mark | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2012/04/14 22:42:44 | 000,593,920 | ---- | M] (OldTimer Tools) -- C:\Users\Mark\Downloads\OTL.exe
PRC - [2012/04/03 22:53:50 | 000,063,928 | ---- | M] (Adobe Systems Incorporated) -- C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe
PRC - [2011/12/06 17:25:42 | 000,150,856 | ---- | M] (McAfee, Inc.) -- C:\Windows\System32\mfevtps.exe
PRC - [2011/12/06 17:21:24 | 000,160,608 | ---- | M] (McAfee, Inc.) -- C:\Program Files\Common Files\Mcafee\SystemCore\mfefire.exe
PRC - [2011/12/06 17:21:08 | 000,166,288 | ---- | M] (McAfee, Inc.) -- C:\Program Files\Common Files\Mcafee\SystemCore\mcshield.exe
PRC - [2011/11/22 17:18:26 | 001,318,816 | ---- | M] (McAfee, Inc.) -- C:\Program Files\McAfee.com\Agent\mcagent.exe
PRC - [2011/06/02 16:09:14 | 000,579,584 | ---- | M] (LOUD Technologies, Inc.) -- C:\Program Files\LoudAudio\MackieTaskBar.exe
PRC - [2011/04/08 13:59:50 | 000,419,904 | ---- | M] (McAfee, Inc.) -- C:\Program Files\McAfee\MAT\McPvTray.exe
PRC - [2011/02/25 22:33:07 | 002,614,784 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe
PRC - [2011/01/27 18:28:14 | 000,214,904 | ---- | M] (McAfee, Inc.) -- C:\Program Files\Common Files\Mcafee\McSvcHost\McSvHost.exe
PRC - [2009/07/13 18:14:46 | 000,115,200 | ---- | M] () -- \\?\C:\Windows\System32\wbem\WMIADAP.EXE
PRC - [2009/07/13 18:14:42 | 000,049,152 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\taskhost.exe
PRC - [2009/04/14 07:43:42 | 000,604,704 | ---- | M] (Realtek Semiconductor Corp.) -- C:\Windows\SOUNDMAN.EXE
PRC - [2008/06/24 16:06:06 | 001,840,424 | ---- | M] (Nero AG) -- C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe


========== Modules (No Company Name) ==========


========== Win32 Services (SafeList) ==========

SRV - [2012/04/03 22:53:50 | 000,063,928 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice)
SRV - [2012/04/02 23:54:07 | 001,343,400 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\Wat\WatAdminSvc.exe -- (WatAdminSvc)
SRV - [2011/12/06 17:25:42 | 000,150,856 | ---- | M] (McAfee, Inc.) [Auto | Running] -- C:\Windows\System32\mfevtps.exe -- (mfevtp)
SRV - [2011/12/06 17:21:24 | 000,160,608 | ---- | M] () [Auto | Running] -- C:\Program Files\Common Files\McAfee\SystemCore\\mfefire.exe -- (mfefire)
SRV - [2011/12/06 17:21:08 | 000,166,288 | ---- | M] () [Auto | Running] -- C:\Program Files\Common Files\McAfee\SystemCore\\mcshield.exe -- (McShield)
SRV - [2011/10/18 16:59:54 | 000,361,976 | ---- | M] (McAfee, Inc.) [On_Demand | Stopped] -- C:\Program Files\McAfee\VirusScan\mcods.exe -- (McODS)
SRV - [2011/01/28 12:28:50 | 000,203,080 | ---- | M] (McAfee, Inc.) [On_Demand | Stopped] -- c:\Program Files\McAfee\MSC\McAWFwk.exe -- (McAWFwk)
SRV - [2011/01/27 18:28:14 | 000,214,904 | ---- | M] (McAfee, Inc.) [Auto | Running] -- C:\Program Files\Common Files\Mcafee\McSvcHost\McSvHost.exe -- (MSK80Service)
SRV - [2011/01/27 18:28:14 | 000,214,904 | ---- | M] (McAfee, Inc.) [Auto | Running] -- C:\Program Files\Common Files\Mcafee\McSvcHost\McSvHost.exe -- (McProxy)
SRV - [2011/01/27 18:28:14 | 000,214,904 | ---- | M] (McAfee, Inc.) [Disabled | Stopped] -- C:\Program Files\Common Files\Mcafee\McSvcHost\McSvHost.exe -- (McOobeSv)
SRV - [2011/01/27 18:28:14 | 000,214,904 | ---- | M] (McAfee, Inc.) [Auto | Running] -- C:\Program Files\Common Files\Mcafee\McSvcHost\McSvHost.exe -- (McNASvc)
SRV - [2011/01/27 18:28:14 | 000,214,904 | ---- | M] (McAfee, Inc.) [Auto | Running] -- C:\Program Files\Common Files\Mcafee\McSvcHost\McSvHost.exe -- (McNaiAnn)
SRV - [2011/01/27 18:28:14 | 000,214,904 | ---- | M] (McAfee, Inc.) [Auto | Running] -- C:\Program Files\Common Files\Mcafee\McSvcHost\McSvHost.exe -- (mcmscsvc)
SRV - [2011/01/27 18:28:14 | 000,214,904 | ---- | M] (McAfee, Inc.) [Auto | Running] -- C:\Program Files\Common Files\Mcafee\McSvcHost\McSvHost.exe -- (McMPFSvc)
SRV - [2011/01/27 18:28:14 | 000,214,904 | ---- | M] (McAfee, Inc.) [Auto | Running] -- C:\Program Files\Common Files\Mcafee\McSvcHost\McSvHost.exe -- (McAfee SiteAdvisor Service)
SRV - [2009/07/13 18:16:13 | 000,025,088 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\sensrsvc.dll -- (SensrSvc)
SRV - [2009/07/13 18:16:12 | 001,004,544 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\PeerDistSvc.dll -- (PeerDistSvc)
SRV - [2009/07/13 18:15:41 | 000,680,960 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)
SRV - [2003/04/18 16:06:26 | 000,008,192 | ---- | M] () [On_Demand | Stopped] -- C:\Program Files\Hawkes Learning Systems\Hawkes Update Service Manager\srvany.exe -- (HawkesUpdater)


========== Driver Services (SafeList) ==========

DRV - File not found [Kernel | On_Demand | Unknown] -- -- (mfeavfk01)
DRV - [2011/10/15 12:16:16 | 000,464,176 | ---- | M] (McAfee, Inc.) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\mfehidk.sys -- (mfehidk)
DRV - [2011/10/15 12:16:16 | 000,338,176 | ---- | M] (McAfee, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\mfefirek.sys -- (mfefirek)
DRV - [2011/10/15 12:16:16 | 000,180,816 | ---- | M] (McAfee, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\mfeavfk.sys -- (mfeavfk)
DRV - [2011/10/15 12:16:16 | 000,165,680 | ---- | M] (McAfee, Inc.) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\mfewfpk.sys -- (mfewfpk)
DRV - [2011/10/15 12:16:16 | 000,121,256 | ---- | M] (McAfee, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\mfeapfk.sys -- (mfeapfk)
DRV - [2011/10/15 12:16:16 | 000,087,656 | ---- | M] (McAfee, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\mferkdet.sys -- (mferkdet)
DRV - [2011/10/15 12:16:16 | 000,064,880 | ---- | M] (McAfee, Inc.) [Kernel | System | Running] -- C:\Windows\System32\drivers\mfenlfk.sys -- (mfenlfk)
DRV - [2011/10/15 12:16:16 | 000,059,456 | ---- | M] (McAfee, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\mfebopk.sys -- (mfebopk)
DRV - [2011/10/15 12:16:16 | 000,057,600 | ---- | M] (McAfee, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\cfwids.sys -- (cfwids)
DRV - [2011/06/02 16:14:46 | 000,063,552 | ---- | M] (LOUD Technologies, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\MackieUSB.sys -- (MackieUSB)
DRV - [2011/04/11 14:29:16 | 000,064,048 | ---- | M] (McAfee, Inc.) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\McPvDrv.sys -- (McPvDrv)
DRV - [2009/07/13 18:19:10 | 000,175,824 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\vmbus.sys -- (vmbus)
DRV - [2009/07/13 18:19:10 | 000,040,896 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\vmstorfl.sys -- (storflt)
DRV - [2009/07/13 18:19:10 | 000,028,224 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\storvsc.sys -- (storvsc)
DRV - [2009/07/13 16:51:11 | 000,034,944 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\winusb.sys -- (WinUsb)
DRV - [2009/07/13 16:28:47 | 000,005,632 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\vms3cap.sys -- (s3cap)
DRV - [2009/07/13 16:28:45 | 000,017,920 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\VMBusHID.sys -- (VMBusHID)
DRV - [2009/07/13 15:02:53 | 000,545,792 | ---- | M] (Ralink Technology, Corp.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\netr73.sys -- (netr73)
DRV - [2009/07/13 15:02:52 | 000,043,008 | ---- | M] (Realtek Semiconductor Corporation ) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\Rtnicxp.sys -- (RTL8023xp)
DRV - [2009/06/18 19:45:02 | 004,172,832 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\RTKVAC.SYS -- (ALCXWDM) Service for Realtek AC97 Audio (WDM)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/...ms}&FORM=IE8SRC

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://www.msn.com/?ocid=iehp
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = en-US
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 24 80 7C BE 29 15 CD 01 [binary data]
IE - HKCU\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/...Box&FORM=IE8SRC
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0


========== FireFox ==========

FF - HKLM\Software\MozillaPlugins\@mcafee.com/MSC,version=10: c:\progra~1\mcafee\msc\npmcsn~1.dll ()
FF - HKLM\Software\MozillaPlugins\@mcafee.com/SAFFPlugin: C:\Program Files\McAfee\SiteAdvisor\npmcffplg32.dll (McAfee, Inc.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=2.0.1: C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Users\Mark\AppData\Local\Google\Update\1.3.21.111\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Users\Mark\AppData\Local\Google\Update\1.3.21.111\npGoogleUpdate3.dll (Google Inc.)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{4ED1F68A-5463-4931-9384-8FFF5ED91D92}: C:\Program Files\McAfee\SiteAdvisor [2012/04/03 22:38:22 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{D19CA586-DD6C-4a0a-96F8-14644F340D60}: C:\Program Files\Common Files\McAfee\SystemCore [2012/04/22 23:35:28 | 000,000,000 | ---D | M]


========== Chrome ==========

CHR - default_search_provider: Google (Enabled)
CHR - default_search_provider: search_url = {google:baseURL}search?{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}{google:searchFieldtrialParameter}{google:instantFieldTrialGroupParameter}sourceid=chrome&ie={inputEncoding}&q={searchTerms}
CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}{google:instantFieldTrialGroupParameter}client=chrome&hl={language}&q={searchTerms}
CHR - plugin: Remoting Viewer (Enabled) = internal-remoting-viewer
CHR - plugin: Native Client (Enabled) = C:\Users\Mark\AppData\Local\Google\Chrome\Application\18.0.1025.162\ppGoogleNaClPluginChrome.dll
CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Users\Mark\AppData\Local\Google\Chrome\Application\18.0.1025.162\pdf.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Users\Mark\AppData\Local\Google\Chrome\Application\18.0.1025.162\gcswf32.dll
CHR - plugin: VLC Web Plugin (Enabled) = C:\Program Files\VideoLAN\VLC\npvlc.dll
CHR - plugin: Google Update (Enabled) = C:\Users\Mark\AppData\Local\Google\Update\1.3.21.111\npGoogleUpdate3.dll
CHR - Extension: YouTube = C:\Users\Mark\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\
CHR - Extension: Google Search = C:\Users\Mark\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\
CHR - Extension: SiteAdvisor = C:\Users\Mark\AppData\Local\Google\Chrome\User Data\Default\Extensions\fheoggkfdfchfphceeifdbepaooicaho\3.41.123.2_0\
CHR - Extension: Gmail = C:\Users\Mark\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\

O1 HOSTS File: ([2009/06/10 14:39:37 | 000,000,824 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O2 - BHO: (scriptproxy) - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\Common Files\Mcafee\SystemCore\ScriptSn.20120404013900.dll (McAfee, Inc.)
O2 - BHO: (McAfee SiteAdvisor BHO) - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - c:\Program Files\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
O2 - BHO: (Yontoo) - {FD72061E-9FDE-484D-A58A-0BAB4151CAD8} - C:\Program Files\Yontoo\YontooIEClient.dll (Yontoo LLC)
O3 - HKLM\..\Toolbar: (McAfee SiteAdvisor Toolbar) - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\Program Files\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
O4 - HKLM..\Run: [Loud Taskbar] C:\Program Files\LoudAudio\MackieTaskBar.exe (LOUD Technologies, Inc.)
O4 - HKLM..\Run: [McPvTray_exe] C:\Program Files\McAfee\MAT\McPvTray.exe (McAfee, Inc.)
O4 - HKLM..\Run: [mcui_exe] C:\Program Files\McAfee.com\Agent\mcagent.exe (McAfee, Inc.)
O4 - HKLM..\Run: [NeroFilterCheck] C:\Windows\System32\NeroCheck.exe (Ahead Software Gmbh)
O4 - HKLM..\Run: [SoundMan] C:\Windows\SOUNDMAN.EXE (Realtek Semiconductor Corp.)
O4 - HKCU..\Run: [IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe (Nero AG)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O13 - gopher Prefix: missing
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.254
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{23FA1743-221B-4F35-89CA-14FE78318388}: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{2C5E10F7-F8D0-4216-A6AE-89427D7C534A}: DhcpNameServer = 192.168.1.254
O18 - Protocol\Handler\dssrequest {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\Program Files\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
O18 - Protocol\Handler\sacore {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\Program Files\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
O18 - Protocol\Filter\application/x-mfe-ipt {3EF5086B-5478-4598-A054-786C45D75692} - c:\Program Files\McAfee\MSC\McSnIePl.dll (McAfee, Inc.)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009/06/10 14:42:20 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2012/04/15 01:55:58 | 000,000,000 | ---D | C] -- C:\Users\Mark\AppData\Local\Adobe
[2012/04/15 01:54:01 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Adobe
[2012/04/15 01:54:01 | 000,000,000 | ---D | C] -- C:\Program Files\Adobe
[2012/04/15 01:53:21 | 000,000,000 | ---D | C] -- C:\ProgramData\Adobe
[2012/04/14 23:59:18 | 000,000,000 | ---D | C] -- C:\Program Files\Yontoo
[2012/04/14 23:59:03 | 000,000,000 | ---D | C] -- C:\ProgramData\Tarma Installer
[2012/04/14 23:58:59 | 000,000,000 | ---D | C] -- C:\Program Files\uTorrent
[2012/04/14 23:57:26 | 000,000,000 | ---D | C] -- C:\Users\Mark\AppData\Roaming\uTorrent
[2012/04/14 22:31:45 | 000,000,000 | ---D | C] -- C:\Users\Mark\Documents\Other
[2012/04/07 18:35:27 | 000,000,000 | ---D | C] -- C:\Users\Mark\Desktop\Beats Rough
[2012/04/04 23:25:55 | 000,000,000 | ---D | C] -- C:\Users\Mark\Documents\Hawkes Learning Systems
[2012/04/04 23:13:20 | 000,000,000 | ---D | C] -- C:\Users\Mark\AppData\Roaming\Malwarebytes
[2012/04/04 23:13:13 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2012/04/04 23:13:12 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2012/04/04 23:13:11 | 000,020,464 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys
[2012/04/04 23:13:11 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware
[2012/04/03 22:38:34 | 000,000,000 | ---D | C] -- C:\Windows\Minidump
[2012/04/02 23:54:08 | 000,000,000 | ---D | C] -- C:\Windows\System32\Wat
[2012/04/02 01:39:35 | 000,000,000 | ---D | C] -- C:\Program Files\MSXML 4.0
[2012/04/02 01:39:23 | 000,000,000 | ---D | C] -- C:\a756b714c39790502327d4c32bb8986c
[2012/04/02 01:26:39 | 000,000,000 | ---D | C] -- C:\Users\Mark\AppData\Roaming\Audacity
[2012/04/01 22:37:31 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Camel Audio
[2012/04/01 22:37:30 | 000,000,000 | ---D | C] -- C:\Program Files\Camel Audio
[2012/04/01 22:37:29 | 000,000,000 | ---D | C] -- C:\ProgramData\Camel Audio
[2012/04/01 22:08:24 | 000,000,000 | ---D | C] -- C:\Users\Mark\Documents\BullzipPDFPrinter_7_2_0_1338
[2012/04/01 22:06:45 | 000,000,000 | ---D | C] -- C:\Users\Mark\Documents\School
[2012/04/01 22:05:17 | 000,000,000 | -H-D | C] -- C:\ProgramData\{93906220-8503-45CF-87CB-5A54C8DE1AB2}
[2012/04/01 21:54:59 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Hawkes Learning Systems
[2012/04/01 21:54:55 | 000,344,064 | ---- | C] (RSP Software - http://rspsoftware.clic3.net) -- C:\Windows\System32\rsp_ogg_player_ocx2.dll
[2012/04/01 21:54:54 | 000,344,064 | ---- | C] (RSP Software - http://rspsoftware.clic3.net) -- C:\Windows\System32\rsp_ogg_player_ocx1.dll
[2012/04/01 21:54:53 | 000,372,736 | ---- | C] (Aivosto Oy) -- C:\Windows\System32\vbwExtender.ocx
[2012/04/01 21:54:53 | 000,205,848 | ---- | C] (Sheridan Software Systems, Inc.) -- C:\Windows\System32\THREED32.OCX
[2012/04/01 21:54:52 | 001,328,824 | ---- | C] (FarPoint Technologies, Inc.) -- C:\Windows\System32\SPR32X60.ocx
[2012/04/01 21:54:51 | 000,159,744 | ---- | C] (RSP Software - http://svansa.tripod.com) -- C:\Windows\System32\rsp_ogg_vorbis_ocx_320reg.ocx
[2012/04/01 21:53:35 | 000,000,000 | ---D | C] -- C:\Program Files\Hawkes Learning Systems
[2012/04/01 21:52:06 | 000,000,000 | ---D | C] -- C:\Windows\System32\Macromed
[2012/04/01 21:51:21 | 000,000,000 | -H-D | C] -- C:\ProgramData\{A77F137D-236E-4155-A17D-2DA1AC94D44C}
[2012/04/01 21:50:54 | 000,000,000 | ---D | C] -- C:\Users\Mark\AppData\Local\PackageAware
[2012/04/01 21:17:53 | 000,064,048 | ---- | C] (McAfee, Inc.) -- C:\Windows\System32\drivers\McPvDrv.sys
[2012/04/01 21:17:52 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\McAfee
[2012/04/01 21:17:51 | 000,000,000 | R-SD | C] -- C:\Users\Mark\Documents\McAfee Vaults
[2012/04/01 21:17:51 | 000,000,000 | ---D | C] -- C:\Users\Mark\AppData\Local\McAfee Anti-Theft
[2012/04/01 21:17:05 | 000,009,608 | ---- | C] (McAfee, Inc.) -- C:\Windows\System32\drivers\mfeclnk.sys
[2012/04/01 21:15:59 | 000,165,680 | ---- | C] (McAfee, Inc.) -- C:\Windows\System32\drivers\mfewfpk.sys
[2012/04/01 21:15:59 | 000,064,880 | ---- | C] (McAfee, Inc.) -- C:\Windows\System32\drivers\mfenlfk.sys
[2012/04/01 21:15:58 | 000,464,176 | ---- | C] (McAfee, Inc.) -- C:\Windows\System32\drivers\mfehidk.sys
[2012/04/01 21:15:58 | 000,338,176 | ---- | C] (McAfee, Inc.) -- C:\Windows\System32\drivers\mfefirek.sys
[2012/04/01 21:15:58 | 000,180,816 | ---- | C] (McAfee, Inc.) -- C:\Windows\System32\drivers\mfeavfk.sys
[2012/04/01 21:15:58 | 000,121,256 | ---- | C] (McAfee, Inc.) -- C:\Windows\System32\drivers\mfeapfk.sys
[2012/04/01 21:15:58 | 000,087,656 | ---- | C] (McAfee, Inc.) -- C:\Windows\System32\drivers\mferkdet.sys
[2012/04/01 21:15:58 | 000,059,456 | ---- | C] (McAfee, Inc.) -- C:\Windows\System32\drivers\mfebopk.sys
[2012/04/01 21:15:58 | 000,057,600 | ---- | C] (McAfee, Inc.) -- C:\Windows\System32\drivers\cfwids.sys
[2012/04/01 21:15:46 | 000,000,000 | ---D | C] -- C:\Program Files\McAfee.com
[2012/04/01 21:15:46 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Mcafee
[2012/04/01 21:15:40 | 000,000,000 | ---D | C] -- C:\Program Files\McAfee
[2012/04/01 21:08:21 | 000,000,000 | ---D | C] -- C:\ProgramData\McAfee
[2012/04/01 21:01:46 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CCleaner
[2012/04/01 21:01:45 | 000,000,000 | ---D | C] -- C:\Program Files\CCleaner
[2012/04/01 20:48:02 | 000,225,280 | ---- | C] (Propellerhead Software AB) -- C:\Windows\System32\rewire.dll
[2012/04/01 20:48:02 | 000,000,000 | ---D | C] -- C:\Program Files\VstPlugins
[2012/04/01 20:48:00 | 000,000,000 | ---D | C] -- C:\Users\Mark\Documents\Image-Line
[2012/04/01 20:47:48 | 000,000,000 | ---D | C] -- C:\Users\Mark\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Image-Line
[2012/04/01 20:47:37 | 000,000,000 | ---D | C] -- C:\Program Files\Outsim
[2012/04/01 20:44:15 | 000,000,000 | ---D | C] -- C:\Program Files\Image-Line
[2012/04/01 20:42:18 | 000,000,000 | ---D | C] -- C:\Program Files\Audacity
[2012/04/01 20:26:22 | 000,000,000 | ---D | C] -- C:\Program Files\DIFX
[2012/04/01 20:17:22 | 000,000,000 | ---D | C] -- C:\Program Files\LoudAudio
[2012/04/01 20:15:41 | 000,232,448 | ---- | C] (LOUD Technologies, Inc.) -- C:\Windows\Mackie64.exe
[2012/04/01 20:15:41 | 000,204,800 | ---- | C] (LOUD Technologies, Inc.) -- C:\Windows\Mackie.exe
[2012/04/01 20:15:41 | 000,063,552 | ---- | C] (LOUD Technologies, Inc.) -- C:\Windows\System32\drivers\MackieUSB.sys
[2012/04/01 20:14:02 | 000,000,000 | ---D | C] -- C:\Users\Mark\AppData\Roaming\WinRAR
[2012/04/01 20:14:01 | 000,000,000 | ---D | C] -- C:\Users\Mark\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WinRAR
[2012/04/01 20:14:01 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinRAR
[2012/04/01 20:13:34 | 000,000,000 | ---D | C] -- C:\Program Files\WinRAR
[2012/04/01 20:12:48 | 000,000,000 | ---D | C] -- C:\Users\Mark\AppData\Roaming\Macromedia
[2012/04/01 20:12:48 | 000,000,000 | ---D | C] -- C:\Users\Mark\AppData\Roaming\Adobe
[2012/04/01 20:09:32 | 000,000,000 | ---D | C] -- C:\Users\Mark\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Google Chrome
[2012/04/01 20:07:05 | 000,000,000 | ---D | C] -- C:\Users\Mark\AppData\Local\Google
[2012/04/01 19:39:34 | 000,000,000 | ---D | C] -- C:\Users\Mark\AppData\Local\Diagnostics
[2012/04/01 19:38:01 | 000,000,000 | ---D | C] -- C:\Users\Mark\Desktop\Herbie Hancock - Takin off(www.distintodelaire.blogspot.com)
[2012/04/01 19:37:11 | 000,000,000 | ---D | C] -- C:\Users\Mark\Documents\Music
[2012/04/01 18:06:37 | 000,000,000 | ---D | C] -- C:\Users\Mark\AppData\Roaming\dvdcss
[2012/04/01 18:04:49 | 000,000,000 | ---D | C] -- C:\Users\Mark\AppData\Roaming\vlc
[2012/04/01 18:04:41 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VideoLAN
[2012/04/01 18:04:04 | 000,000,000 | ---D | C] -- C:\Program Files\VideoLAN
[2012/03/31 22:56:24 | 000,000,000 | ---D | C] -- C:\Users\Mark\AppData\Local\Babylon
[2012/03/31 22:56:22 | 000,000,000 | ---D | C] -- C:\Program Files\FoxTabVideoConverter
[2012/03/31 22:56:18 | 000,000,000 | ---D | C] -- C:\Users\Mark\AppData\Roaming\Babylon
[2012/03/31 22:56:18 | 000,000,000 | ---D | C] -- C:\ProgramData\Babylon
[2012/03/31 22:19:28 | 000,000,000 | ---D | C] -- C:\Users\Mark\AppData\Roaming\CyberLink
[2012/03/31 22:19:11 | 000,000,000 | ---D | C] -- C:\Users\Mark\Documents\CyberLink
[2012/03/31 22:18:07 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CyberLink PowerDVD
[2012/03/31 22:18:02 | 000,000,000 | ---D | C] -- C:\ProgramData\CyberLink
[2012/03/31 22:17:57 | 000,000,000 | -H-D | C] -- C:\Program Files\InstallShield Installation Information
[2012/03/31 22:17:55 | 000,000,000 | ---D | C] -- C:\Program Files\CyberLink
[2012/03/31 22:11:52 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\InstallShield
[2012/03/31 21:46:52 | 000,000,000 | ---D | C] -- C:\Users\Mark\AppData\Roaming\Nero
[2012/03/31 21:42:42 | 000,000,000 | ---D | C] -- C:\Users\Mark\AppData\Local\Ahead
[2012/03/31 21:42:06 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Nero 8
[2012/03/31 21:39:04 | 000,000,000 | ---D | C] -- C:\ProgramData\Nero
[2012/03/31 21:39:04 | 000,000,000 | ---D | C] -- C:\Program Files\Nero
[2012/03/31 21:39:04 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Nero
[2012/03/31 21:12:32 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Nero
[2012/03/31 21:11:36 | 000,106,496 | ---- | C] (Pegasus Software) -- C:\Windows\System32\TwnLib20.dll
[2012/03/31 21:11:32 | 000,038,912 | ---- | C] (Pegasus Imaging Corp.) -- C:\Windows\System32\picn20.dll
[2012/03/31 21:11:30 | 000,569,344 | ---- | C] (Pegasus Software,LLC) -- C:\Windows\System32\imagr5.dll
[2012/03/31 21:11:30 | 000,544,768 | ---- | C] (Pegasus Software, LLC) -- C:\Windows\System32\imagx5.dll
[2012/03/31 21:11:30 | 000,283,920 | ---- | C] (Pegasus Software, LLC) -- C:\Windows\System32\ImagXpr5.dll
[2012/03/31 21:11:27 | 000,155,648 | ---- | C] (Ahead Software Gmbh) -- C:\Windows\System32\NeroCheck.exe
[2012/03/31 21:11:27 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Ahead
[2012/03/31 21:11:22 | 000,000,000 | ---D | C] -- C:\Program Files\Ahead
[2012/03/31 20:47:37 | 000,000,000 | ---D | C] -- C:\Windows\Panther
[2012/03/31 20:47:22 | 000,000,000 | -HSD | C] -- C:\Boot
[2012/03/31 20:35:15 | 000,000,000 | ---D | C] -- C:\Windows.old
[2012/03/31 20:34:08 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office
[2012/03/31 20:34:00 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft ActiveSync
[2012/03/31 20:33:39 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\DESIGNER
[2012/03/31 20:33:24 | 000,000,000 | ---D | C] -- C:\Windows\PCHEALTH
[2012/03/31 20:33:24 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft.NET
[2012/03/31 20:24:28 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft Office
[2012/03/31 20:08:56 | 000,000,000 | ---D | C] -- C:\Users\Mark\AppData\Local\Microsoft Help
[2012/03/31 20:08:51 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft Help
[2012/03/31 20:08:44 | 000,000,000 | -HSD | C] -- C:\Windows\Installer
[2012/03/31 20:02:37 | 000,000,000 | R--D | C] -- C:\Users\Mark\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
[2012/03/31 20:02:37 | 000,000,000 | R--D | C] -- C:\Users\Mark\Searches
[2012/03/31 20:02:37 | 000,000,000 | R--D | C] -- C:\Users\Mark\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools
[2012/03/31 20:02:36 | 000,000,000 | -H-D | C] -- C:\Users\Mark\Application Data\Microsoft\Internet Explorer\Quick Launch\User Pinned
[2012/03/31 20:02:23 | 000,000,000 | ---D | C] -- C:\Users\Mark\AppData\Roaming\Identities
[2012/03/31 20:02:15 | 000,000,000 | R--D | C] -- C:\Users\Mark\Contacts
[2012/03/31 20:01:53 | 000,000,000 | ---D | C] -- C:\Users\Mark\AppData\Local\VirtualStore
[2012/03/31 20:01:48 | 000,000,000 | --SD | C] -- C:\Users\Mark\AppData\Roaming\Microsoft
[2012/03/31 20:01:48 | 000,000,000 | R--D | C] -- C:\Users\Mark\Videos
[2012/03/31 20:01:48 | 000,000,000 | R--D | C] -- C:\Users\Mark\Saved Games
[2012/03/31 20:01:48 | 000,000,000 | R--D | C] -- C:\Users\Mark\Pictures
[2012/03/31 20:01:48 | 000,000,000 | R--D | C] -- C:\Users\Mark\Music
[2012/03/31 20:01:48 | 000,000,000 | R--D | C] -- C:\Users\Mark\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance
[2012/03/31 20:01:48 | 000,000,000 | R--D | C] -- C:\Users\Mark\Links
[2012/03/31 20:01:48 | 000,000,000 | R--D | C] -- C:\Users\Mark\Favorites
[2012/03/31 20:01:48 | 000,000,000 | R--D | C] -- C:\Users\Mark\Downloads
[2012/03/31 20:01:48 | 000,000,000 | R--D | C] -- C:\Users\Mark\Documents
[2012/03/31 20:01:48 | 000,000,000 | R--D | C] -- C:\Users\Mark\Desktop
[2012/03/31 20:01:48 | 000,000,000 | R--D | C] -- C:\Users\Mark\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories
[2012/03/31 20:01:48 | 000,000,000 | -HSD | C] -- C:\Users\Mark\AppData\Local\Temporary Internet Files
[2012/03/31 20:01:48 | 000,000,000 | -HSD | C] -- C:\Users\Mark\Templates
[2012/03/31 20:01:48 | 000,000,000 | -HSD | C] -- C:\Users\Mark\Start Menu
[2012/03/31 20:01:48 | 000,000,000 | -HSD | C] -- C:\Users\Mark\SendTo
[2012/03/31 20:01:48 | 000,000,000 | -HSD | C] -- C:\Users\Mark\Recent
[2012/03/31 20:01:48 | 000,000,000 | -HSD | C] -- C:\Users\Mark\PrintHood
[2012/03/31 20:01:48 | 000,000,000 | -HSD | C] -- C:\Users\Mark\NetHood
[2012/03/31 20:01:48 | 000,000,000 | -HSD | C] -- C:\Users\Mark\Documents\My Videos
[2012/03/31 20:01:48 | 000,000,000 | -HSD | C] -- C:\Users\Mark\Documents\My Pictures
[2012/03/31 20:01:48 | 000,000,000 | -HSD | C] -- C:\Users\Mark\Documents\My Music
[2012/03/31 20:01:48 | 000,000,000 | -HSD | C] -- C:\Users\Mark\My Documents
[2012/03/31 20:01:48 | 000,000,000 | -HSD | C] -- C:\Users\Mark\Local Settings
[2012/03/31 20:01:48 | 000,000,000 | -HSD | C] -- C:\Users\Mark\AppData\Local\History
[2012/03/31 20:01:48 | 000,000,000 | -HSD | C] -- C:\Users\Mark\Cookies
[2012/03/31 20:01:48 | 000,000,000 | -HSD | C] -- C:\Users\Mark\Application Data
[2012/03/31 20:01:48 | 000,000,000 | -HSD | C] -- C:\Users\Mark\AppData\Local\Application Data
[2012/03/31 20:01:48 | 000,000,000 | -H-D | C] -- C:\Users\Mark\AppData
[2012/03/31 20:01:48 | 000,000,000 | ---D | C] -- C:\Users\Mark\AppData\Local\Temp
[2012/03/31 20:01:48 | 000,000,000 | ---D | C] -- C:\Users\Mark\AppData\Local\Microsoft
[2012/03/31 20:01:48 | 000,000,000 | ---D | C] -- C:\Users\Mark\AppData\Roaming\Media Center Programs
[2012/03/31 20:01:29 | 000,000,000 | -HSD | C] -- C:\Recovery
[2012/03/31 19:52:15 | 000,000,000 | ---D | C] -- C:\Windows\SoftwareDistribution
[2012/03/31 19:49:02 | 000,000,000 | ---D | C] -- C:\Windows\Prefetch

========== Files - Modified Within 30 Days ==========

[2012/04/23 19:18:44 | 000,623,940 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2012/04/23 19:18:44 | 000,106,316 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2012/04/23 19:16:09 | 000,014,224 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2012/04/23 19:16:09 | 000,014,224 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2012/04/23 19:13:07 | 000,001,828 | ---- | M] () -- C:\Users\Public\Desktop\McAfee Total Protection.lnk
[2012/04/23 19:12:11 | 000,000,904 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-406179606-2168368824-3621562350-1000UA.job
[2012/04/23 19:08:05 | 000,359,352 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT
[2012/04/23 19:07:59 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2012/04/23 19:07:42 | 1603,969,024 | -HS- | M] () -- C:\hiberfil.sys
[2012/04/17 20:12:00 | 000,000,852 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-406179606-2168368824-3621562350-1000Core.job
[2012/04/15 16:20:59 | 000,002,354 | ---- | M] () -- C:\Users\Mark\Desktop\Google Chrome.lnk
[2012/04/15 01:54:26 | 000,001,989 | ---- | M] () -- C:\Users\Public\Desktop\Adobe Reader X.lnk
[2012/04/14 23:58:59 | 000,000,937 | ---- | M] () -- C:\Users\Mark\Application Data\Microsoft\Internet Explorer\Quick Launch\µTorrent.lnk
[2012/04/14 23:58:59 | 000,000,913 | ---- | M] () -- C:\Users\Public\Desktop\µTorrent.lnk
[2012/04/03 10:21:45 | 000,001,407 | ---- | M] () -- C:\Users\Mark\Application Data\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk
[2012/04/03 00:02:02 | 000,072,822 | ---- | M] () -- C:\Windows\System32\ieuinit.inf
[2012/04/01 23:49:40 | 000,000,000 | -H-- | M] () -- C:\Windows\System32\drivers\Msft_User_WpdMtpDr_01_09_00.Wdf
[2012/04/01 21:54:59 | 000,001,275 | ---- | M] () -- C:\Users\Public\Desktop\Intermediate Algebra.lnk
[2012/04/01 21:01:46 | 000,000,965 | ---- | M] () -- C:\Users\Public\Desktop\CCleaner.lnk
[2012/04/01 20:48:02 | 000,001,104 | ---- | M] () -- C:\Users\Mark\Desktop\FL Studio 10.lnk
[2012/04/01 20:42:40 | 000,000,965 | ---- | M] () -- C:\Users\Mark\Desktop\Audacity.lnk
[2012/04/01 19:41:13 | 000,000,000 | -H-- | M] () -- C:\Users\Mark\Documents\Default.rdp
[2012/04/01 18:04:41 | 000,001,024 | ---- | M] () -- C:\Users\Public\Desktop\VLC media player.lnk
[2012/03/31 22:30:09 | 000,000,042 | ---- | M] () -- C:\Users\Mark\AppData\Roaming\default.pls
[2012/03/31 21:42:04 | 000,002,703 | ---- | M] () -- C:\Users\Mark\Application Data\Microsoft\Internet Explorer\Quick Launch\Nero StartSmart Essentials.lnk
[2012/03/31 21:42:04 | 000,002,679 | ---- | M] () -- C:\Users\Public\Desktop\Nero StartSmart Essentials.lnk
[2012/03/31 21:42:04 | 000,002,605 | ---- | M] () -- C:\Users\Mark\Application Data\Microsoft\Internet Explorer\Quick Launch\Nero Home Essentials SE.lnk
[2012/03/31 21:42:04 | 000,002,581 | ---- | M] () -- C:\Users\Public\Desktop\Nero Home Essentials SE.lnk
[2012/03/31 21:41:13 | 000,001,024 | ---- | M] () -- C:\Users\Mark\.rnd
[2012/03/31 21:12:40 | 000,001,568 | ---- | M] () -- C:\Users\Mark\Application Data\Microsoft\Internet Explorer\Quick Launch\Nero StartSmart.lnk
[2012/03/31 20:47:25 | 000,008,192 | RHS- | M] () -- C:\BOOTSECT.BAK
[2012/03/31 20:47:23 | 000,000,355 | RHS- | M] () -- C:\Boot.ini.saved
[2012/03/31 20:47:08 | 000,001,345 | ---- | M] () -- C:\Users\Mark\Desktop\Media Center.lnk
[2012/03/31 20:46:59 | 000,001,326 | ---- | M] () -- C:\Users\Mark\Desktop\Windows DVD Maker.lnk
[2012/03/31 20:46:52 | 000,002,645 | ---- | M] () -- C:\Users\Mark\Desktop\Microsoft Office PowerPoint 2003.lnk
[2012/03/31 20:46:45 | 000,002,693 | ---- | M] () -- C:\Users\Mark\Desktop\Microsoft Office Outlook 2003.lnk
[2012/03/31 20:46:39 | 000,002,675 | ---- | M] () -- C:\Users\Mark\Desktop\Microsoft Office Word 2003.lnk
[2012/03/31 20:35:39 | 000,000,376 | ---- | M] () -- C:\Windows\ODBC.INI
[2012/03/31 20:04:49 | 000,000,003 | RHS- | M] () -- C:\win7ldr
[2012/03/31 20:04:49 | 000,000,003 | ---- | M] () -- C:\Windows\7Loader.TAG
[2012/03/31 20:04:06 | 000,203,316 | RHS- | M] () -- C:\grldr
[2012/03/31 19:53:18 | 000,042,045 | ---- | M] () -- C:\Windows\System32\license.rtf
[2012/03/31 19:51:07 | 000,000,000 | -H-- | M] () -- C:\Windows\System32\drivers\Msft_User_WpdFs_01_09_00.Wdf

========== Files Created - No Company Name ==========

[2012/04/23 19:07:44 | 000,359,352 | ---- | C] () -- C:\Windows\System32\FNTCACHE.DAT
[2012/04/15 01:54:26 | 000,001,989 | ---- | C] () -- C:\Users\Public\Desktop\Adobe Reader X.lnk
[2012/04/15 01:54:25 | 000,002,441 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader X.lnk
[2012/04/14 23:58:59 | 000,000,937 | ---- | C] () -- C:\Users\Mark\Application Data\Microsoft\Internet Explorer\Quick Launch\µTorrent.lnk
[2012/04/14 23:58:59 | 000,000,913 | ---- | C] () -- C:\Users\Public\Desktop\µTorrent.lnk
[2012/04/03 10:21:45 | 000,001,413 | ---- | C] () -- C:\Users\Mark\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
[2012/04/03 00:02:02 | 000,072,822 | ---- | C] () -- C:\Windows\System32\ieuinit.inf
[2012/04/01 23:49:40 | 000,000,000 | -H-- | C] () -- C:\Windows\System32\drivers\Msft_User_WpdMtpDr_01_09_00.Wdf
[2012/04/01 21:54:59 | 000,001,275 | ---- | C] () -- C:\Users\Public\Desktop\Intermediate Algebra.lnk
[2012/04/01 21:20:06 | 000,001,828 | ---- | C] () -- C:\Users\Public\Desktop\McAfee Total Protection.lnk
[2012/04/01 21:01:46 | 000,000,965 | ---- | C] () -- C:\Users\Public\Desktop\CCleaner.lnk
[2012/04/01 20:48:02 | 000,001,104 | ---- | C] () -- C:\Users\Mark\Desktop\FL Studio 10.lnk
[2012/04/01 20:42:40 | 000,000,977 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Audacity.lnk
[2012/04/01 20:42:40 | 000,000,965 | ---- | C] () -- C:\Users\Mark\Desktop\Audacity.lnk
[2012/04/01 20:15:41 | 000,193,088 | ---- | C] () -- C:\Windows\System32\LoudAudioProp.dll
[2012/04/01 20:15:41 | 000,122,944 | ---- | C] () -- C:\Windows\System32\MackieAsio.dll
[2012/04/01 20:09:36 | 000,002,354 | ---- | C] () -- C:\Users\Mark\Desktop\Google Chrome.lnk
[2012/04/01 20:07:10 | 000,000,904 | ---- | C] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-406179606-2168368824-3621562350-1000UA.job
[2012/04/01 20:07:05 | 000,000,852 | ---- | C] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-406179606-2168368824-3621562350-1000Core.job
[2012/04/01 19:41:13 | 000,000,000 | -H-- | C] () -- C:\Users\Mark\Documents\Default.rdp
[2012/04/01 18:04:41 | 000,001,024 | ---- | C] () -- C:\Users\Public\Desktop\VLC media player.lnk
[2012/03/31 22:30:09 | 000,000,042 | ---- | C] () -- C:\Users\Mark\AppData\Roaming\default.pls
[2012/03/31 21:42:04 | 000,002,703 | ---- | C] () -- C:\Users\Mark\Application Data\Microsoft\Internet Explorer\Quick Launch\Nero StartSmart Essentials.lnk
[2012/03/31 21:42:04 | 000,002,679 | ---- | C] () -- C:\Users\Public\Desktop\Nero StartSmart Essentials.lnk
[2012/03/31 21:42:04 | 000,002,605 | ---- | C] () -- C:\Users\Mark\Application Data\Microsoft\Internet Explorer\Quick Launch\Nero Home Essentials SE.lnk
[2012/03/31 21:42:04 | 000,002,581 | ---- | C] () -- C:\Users\Public\Desktop\Nero Home Essentials SE.lnk
[2012/03/31 21:41:12 | 000,001,024 | ---- | C] () -- C:\Users\Mark\.rnd
[2012/03/31 21:12:40 | 000,001,568 | ---- | C] () -- C:\Users\Mark\Application Data\Microsoft\Internet Explorer\Quick Launch\Nero StartSmart.lnk
[2012/03/31 20:47:25 | 000,008,192 | RHS- | C] () -- C:\BOOTSECT.BAK
[2012/03/31 20:47:23 | 000,383,562 | RHS- | C] () -- C:\bootmgr
[2012/03/31 20:47:23 | 000,000,211 | -H-- | C] () -- C:\Boot.BAK
[2012/03/31 20:47:08 | 000,001,345 | ---- | C] () -- C:\Users\Mark\Desktop\Media Center.lnk
[2012/03/31 20:46:59 | 000,001,326 | ---- | C] () -- C:\Users\Mark\Desktop\Windows DVD Maker.lnk
[2012/03/31 20:46:52 | 000,002,645 | ---- | C] () -- C:\Users\Mark\Desktop\Microsoft Office PowerPoint 2003.lnk
[2012/03/31 20:46:45 | 000,002,693 | ---- | C] () -- C:\Users\Mark\Desktop\Microsoft Office Outlook 2003.lnk
[2012/03/31 20:46:39 | 000,002,675 | ---- | C] () -- C:\Users\Mark\Desktop\Microsoft Office Word 2003.lnk
[2012/03/31 20:35:39 | 000,000,376 | ---- | C] () -- C:\Windows\ODBC.INI
[2012/03/31 20:23:26 | 000,001,407 | ---- | C] () -- C:\Users\Mark\Application Data\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk
[2012/03/31 20:04:49 | 000,203,316 | RHS- | C] () -- C:\grldr
[2012/03/31 20:04:49 | 000,000,003 | RHS- | C] () -- C:\win7ldr
[2012/03/31 20:04:49 | 000,000,003 | ---- | C] () -- C:\Windows\7Loader.TAG
[2012/03/31 20:01:48 | 000,000,290 | ---- | C] () -- C:\Users\Mark\Application Data\Microsoft\Internet Explorer\Quick Launch\Shows Desktop.lnk
[2012/03/31 20:01:48 | 000,000,272 | ---- | C] () -- C:\Users\Mark\Application Data\Microsoft\Internet Explorer\Quick Launch\Window Switcher.lnk
[2012/03/31 19:53:03 | 000,001,345 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Media Center.lnk
[2012/03/31 19:52:55 | 000,001,326 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows DVD Maker.lnk
[2012/03/31 19:51:07 | 000,000,000 | -H-- | C] () -- C:\Windows\System32\drivers\Msft_User_WpdFs_01_09_00.Wdf
[2012/03/31 19:48:32 | 1603,969,024 | -HS- | C] () -- C:\hiberfil.sys

========== LOP Check ==========

[2012/04/17 03:44:11 | 000,000,000 | ---D | M] -- C:\Users\Mark\AppData\Roaming\Audacity
[2012/03/31 22:56:18 | 000,000,000 | ---D | M] -- C:\Users\Mark\AppData\Roaming\Babylon
[2012/04/15 03:50:45 | 000,000,000 | ---D | M] -- C:\Users\Mark\AppData\Roaming\uTorrent
[2009/07/13 21:53:46 | 000,015,086 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT

========== Purity Check ==========



< End of report >

Attached Files


Edited by Gammo, 24 April 2012 - 09:39 AM.

  • 0

#7
Gammo

Gammo

    Member 2k

  • Malware Removal
  • 2,299 posts
Run OTL
  • Under the Custom Scans/Fixes box at the bottom, paste in the following

    :OTL
    O2 - BHO: (Yontoo) - {FD72061E-9FDE-484D-A58A-0BAB4151CAD8} - C:\Program Files\Yontoo\YontooIEClient.dll (Yontoo LLC)
    [2012/04/14 23:59:18 | 000,000,000 | ---D | C] -- C:\Program Files\Yontoo
    [2012/03/31 22:56:24 | 000,000,000 | ---D | C] -- C:\Users\Mark\AppData\Local\Babylon
    2012/03/31 22:56:18 | 000,000,000 | ---D | C] -- C:\Users\Mark\AppData\Roaming\Babylon
    [2012/03/31 22:56:18 | 000,000,000 | ---D | C] -- C:\ProgramData\Babylon
    
    :Services
    
    :Reg
    
    :Files
    ipconfig /flushdns /c
    
    :Commands
    [purity]
    [resethosts]
    [emptytemp]
    [emptyflash]
    [createrestorepoint]
    [reboot]
  • Then click the Run Fix button at the top
  • Let the program run unhindered, reboot the PC when it is done



Download and Install Combofix

Download ComboFix from one of the following locations:
Link 1
Link 2

VERY IMPORTANT !!! Save ComboFix.exe to your Desktop

* IMPORTANT - Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link here
  • Double click on ComboFix.exe & follow the prompts.
  • Accept the disclaimer and allow to update if it asks

    Posted Image

    Posted Image
  • When finished, it shall produce a log for you.
  • Please include the C:\ComboFix.txt in your next reply.

Notes:
1. Do not mouse-click Combofix's window while it is running. That may cause it to stall.
2. Do not "re-run" Combofix. If you have a problem, reply back for further instructions.
3. If after the reboot you get errors about programmes being marked for deletion then reboot, that will cure it.



Please make sure you include the combo fix log in your next reply as well as describe how your computer is running now
  • 0

#8
Dolch10Years

Dolch10Years

    New Member

  • Topic Starter
  • Member
  • Pip
  • 5 posts
Hey Gammo
So I did everything according to plan.
I've attached the resulting log from ComboFix.

As of right now, I can't see any significant changes.
CPU still hitting and hovering around 100% as I'm checking task manager right now.

I just noticed I have two csrss.exe and rundll32.exe processes running, one under SYSTEM, and one under Mark.
That's something that's not normal, right?

ComboFix 12-04-25.02 - Mark 04/26/2012 1:31.1.1 - x86
Running from: c:\users\Mark\Desktop\ComboFix.exe
AV: McAfee Anti-Virus and Anti-Spyware *Disabled/Updated* {86355677-4064-3EA7-ABB3-1B136EB04637}
FW: McAfee Firewall *Disabled* {BE0ED752-0A0B-3FFF-80EC-B2269063014C}
SP: McAfee Anti-Virus and Anti-Spyware *Disabled/Updated* {3D54B793-665E-3129-9103-206115370C8A}
SP: Windows Defender *Enabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((( Files Created from 2012-03-26 to 2012-04-26 )))))))))))))))))))))))))))))))
.
.
2012-04-26 08:48 . 2012-04-26 08:48 -------- d-----w- c:\users\Default\AppData\Local\temp
2012-04-26 08:34 . 2012-04-26 08:34 56200 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{2AB9E180-B5D9-4ABD-BF26-441A7DD82AEC}\offreg.dll
2012-04-26 08:06 . 2012-04-26 08:06 -------- d-----w- C:\_OTL
2012-04-15 08:54 . 2012-04-15 08:54 -------- d-----w- c:\program files\Common Files\Adobe
2012-04-15 06:59 . 2012-04-15 06:59 -------- d-----w- c:\programdata\Tarma Installer
2012-04-15 06:58 . 2012-04-15 06:58 -------- d-----w- c:\program files\uTorrent
2012-04-05 06:13 . 2012-04-05 06:13 -------- d-----w- c:\programdata\Malwarebytes
2012-04-05 06:13 . 2012-04-05 06:13 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2012-04-05 06:13 . 2011-12-10 22:24 20464 ----a-w- c:\windows\system32\drivers\mbam.sys
2012-04-04 05:13 . 2012-03-20 10:53 6582328 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{2AB9E180-B5D9-4ABD-BF26-441A7DD82AEC}\mpengine.dll
2012-04-03 07:57 . 2009-09-10 05:52 257024 ----a-w- c:\windows\system32\msv1_0.dll
2012-04-03 06:54 . 2012-04-03 06:54 -------- d-----w- c:\windows\system32\Wat
2012-04-03 05:29 . 2009-11-25 19:47 99176 ----a-w- c:\windows\system32\PresentationHostProxy.dll
2012-04-03 05:29 . 2009-11-25 19:47 297808 ----a-w- c:\windows\system32\mscoree.dll
2012-04-03 05:29 . 2009-11-25 19:47 295264 ----a-w- c:\windows\system32\PresentationHost.exe
2012-04-03 05:29 . 2009-11-25 19:47 49472 ----a-w- c:\windows\system32\netfxperf.dll
2012-04-03 05:29 . 2009-11-25 19:47 1130824 ----a-w- c:\windows\system32\dfshim.dll
2012-04-03 01:25 . 2010-03-04 03:57 190976 ----a-w- c:\windows\system32\drivers\ks.sys
2012-04-02 08:39 . 2012-04-02 08:39 -------- d-----w- c:\program files\MSXML 4.0
2012-04-02 08:39 . 2012-04-02 08:39 -------- d-----w- C:\a756b714c39790502327d4c32bb8986c
2012-04-02 08:39 . 2010-09-14 06:07 276992 ----a-w- c:\windows\system32\wcncsvc.dll
2012-04-02 08:38 . 2011-11-19 14:25 3957616 ----a-w- c:\windows\system32\ntkrnlpa.exe
2012-04-02 08:38 . 2011-11-19 14:25 3902320 ----a-w- c:\windows\system32\ntoskrnl.exe
2012-04-02 05:37 . 2012-04-02 05:37 -------- d-----w- c:\program files\Camel Audio
2012-04-02 05:37 . 2012-04-02 05:37 -------- d-----w- c:\programdata\Camel Audio
2012-04-02 05:05 . 2012-04-02 05:05 -------- dc-h--w- c:\programdata\{93906220-8503-45CF-87CB-5A54C8DE1AB2}
2012-04-02 04:54 . 2008-06-04 21:56 344064 ----a-w- c:\windows\system32\rsp_ogg_player_ocx2.dll
2012-04-02 04:54 . 2000-07-15 05:00 101888 ----a-w- c:\windows\system32\VB6STKIT.DLL
2012-04-02 04:54 . 1998-06-18 05:00 89360 ----a-w- c:\windows\system32\VB5DB.DLL
2012-04-02 04:54 . 2008-06-04 21:56 344064 ----a-w- c:\windows\system32\rsp_ogg_player_ocx1.dll
2012-04-02 04:54 . 2003-05-10 00:01 372736 ----a-w- c:\windows\system32\vbwExtender.ocx
2012-04-02 04:54 . 1998-06-27 01:22 205848 ----a-w- c:\windows\system32\THREED32.OCX
2012-04-02 04:54 . 2004-03-10 11:15 224016 ----a-w- c:\windows\system32\TABCTL32.OCX
2012-04-02 04:54 . 2002-02-19 20:20 1328824 ----a-w- c:\windows\system32\SPR32X60.ocx
2012-04-02 04:54 . 2008-06-04 23:02 159744 ----a-w- c:\windows\system32\rsp_ogg_vorbis_ocx_320reg.ocx
2012-04-02 04:54 . 2004-03-10 11:15 212240 ----a-w- c:\windows\system32\RICHTX32.OCX
2012-04-02 04:54 . 2004-03-10 11:15 662288 ----a-w- c:\windows\system32\MSCOMCT2.OCX
2012-04-02 04:54 . 1999-12-07 22:30 557328 ----a-w- c:\windows\system32\DAO360.DLL
2012-04-02 04:53 . 2012-04-02 05:05 -------- d-----w- c:\program files\Hawkes Learning Systems
2012-04-02 04:52 . 2012-04-02 04:52 -------- d-----w- c:\windows\system32\Macromed
2012-04-02 04:51 . 2012-04-02 04:55 -------- d--h--w- c:\programdata\{A77F137D-236E-4155-A17D-2DA1AC94D44C}
2012-04-02 04:17 . 2011-04-11 21:29 64048 ----a-w- c:\windows\system32\drivers\McPvDrv.sys
2012-04-02 04:17 . 2011-10-15 19:16 9608 ----a-w- c:\windows\system32\drivers\mfeclnk.sys
2012-04-02 04:15 . 2011-10-15 19:16 64880 ----a-w- c:\windows\system32\drivers\mfenlfk.sys
2012-04-02 04:15 . 2011-10-15 19:16 165680 ----a-w- c:\windows\system32\drivers\mfewfpk.sys
2012-04-02 04:15 . 2011-10-15 19:16 87656 ----a-w- c:\windows\system32\drivers\mferkdet.sys
2012-04-02 04:15 . 2011-10-15 19:16 59456 ----a-w- c:\windows\system32\drivers\mfebopk.sys
2012-04-02 04:15 . 2011-10-15 19:16 57600 ----a-w- c:\windows\system32\drivers\cfwids.sys
2012-04-02 04:15 . 2011-10-15 19:16 464176 ----a-w- c:\windows\system32\drivers\mfehidk.sys
2012-04-02 04:15 . 2011-10-15 19:16 338176 ----a-w- c:\windows\system32\drivers\mfefirek.sys
2012-04-02 04:15 . 2011-10-15 19:16 180816 ----a-w- c:\windows\system32\drivers\mfeavfk.sys
2012-04-02 04:15 . 2011-10-15 19:16 121256 ----a-w- c:\windows\system32\drivers\mfeapfk.sys
2012-04-02 04:15 . 2012-04-02 04:17 -------- d-----w- c:\program files\Common Files\Mcafee
2012-04-02 04:15 . 2012-04-24 02:08 -------- d-----w- c:\program files\McAfee
2012-04-02 04:08 . 2012-04-02 07:26 -------- d-----w- c:\programdata\McAfee
2012-04-02 04:01 . 2012-04-02 04:01 -------- d-----w- c:\program files\CCleaner
2012-04-02 04:01 . 2010-06-29 05:02 1413632 ----a-w- c:\windows\system32\ole32.dll
2012-04-02 04:01 . 2010-06-29 04:57 4247040 ----a-w- c:\program files\Windows NT\Accessories\wordpad.exe
2012-04-02 03:59 . 2011-02-19 05:32 34304 ----a-w- c:\windows\system32\atmlib.dll
2012-04-02 03:58 . 2011-11-05 04:30 2048 ----a-w- c:\windows\system32\tzres.dll
2012-04-02 03:58 . 2011-05-24 10:35 294912 ----a-w- c:\windows\system32\umpnpmgr.dll
2012-04-02 03:56 . 2010-09-01 04:23 12625408 ----a-w- c:\windows\system32\wmploc.DLL
2012-04-02 03:56 . 2011-11-19 14:06 67072 ----a-w- c:\windows\system32\packager.dll
2012-04-02 03:56 . 2011-05-04 04:53 1553920 ----a-w- c:\windows\system32\tquery.dll
2012-04-02 03:56 . 2011-05-04 04:52 1401856 ----a-w- c:\windows\system32\mssrch.dll
2012-04-02 03:56 . 2011-05-04 04:52 666624 ----a-w- c:\windows\system32\mssvp.dll
2012-04-02 03:56 . 2011-05-04 04:52 428032 ----a-w- c:\windows\system32\SearchIndexer.exe
2012-04-02 03:56 . 2011-05-04 04:52 337408 ----a-w- c:\windows\system32\mssph.dll
2012-04-02 03:56 . 2011-05-04 04:52 59392 ----a-w- c:\windows\system32\msscntrs.dll
2012-04-02 03:56 . 2011-05-04 04:52 197120 ----a-w- c:\windows\system32\mssphtb.dll
2012-04-02 03:56 . 2011-05-04 04:52 86528 ----a-w- c:\windows\system32\SearchFilterHost.exe
2012-04-02 03:56 . 2011-05-04 04:52 164352 ----a-w- c:\windows\system32\SearchProtocolHost.exe
2012-04-02 03:54 . 2011-11-17 05:39 224768 ----a-w- c:\windows\system32\schannel.dll
2012-04-02 03:52 . 2011-12-16 07:59 690688 ----a-w- c:\windows\system32\msvcrt.dll
2012-04-02 03:52 . 2010-08-27 05:46 168448 ----a-w- c:\windows\system32\srvsvc.dll
2012-04-02 03:48 . 2012-04-09 08:18 -------- d-----w- c:\program files\VstPlugins
2012-04-02 03:48 . 2006-06-20 08:56 225280 ----a-w- c:\windows\system32\rewire.dll
2012-04-02 03:47 . 2009-09-15 09:14 1554944 ----a-w- c:\windows\system32\vorbis.acm
2012-04-02 03:47 . 2012-04-02 03:47 -------- d-----w- c:\program files\Outsim
2012-04-02 03:44 . 2012-04-02 03:47 -------- d-----w- c:\program files\Image-Line
2012-04-02 03:42 . 2010-08-21 05:36 738816 ----a-w- c:\windows\system32\wmpmde.dll
2012-04-02 03:41 . 2010-05-05 06:46 363520 ----a-w- c:\windows\system32\StructuredQuery.dll
2012-04-02 03:40 . 2011-02-03 05:45 219008 ----a-w- c:\windows\system32\drivers\dxgmms1.sys
2012-04-02 03:40 . 2010-11-02 04:46 728448 ----a-w- c:\windows\system32\drivers\dxgkrnl.sys
2012-04-02 03:40 . 2010-11-02 04:23 107520 ----a-w- c:\windows\system32\cdd.dll
2012-04-02 03:26 . 2012-04-02 03:26 -------- d-----w- c:\program files\DIFX
2012-04-02 03:17 . 2012-04-02 03:17 -------- d-----w- c:\program files\LoudAudio
2012-04-02 03:15 . 2011-06-02 23:14 193088 ----a-w- c:\windows\system32\LoudAudioProp.dll
2012-04-02 03:15 . 2011-06-02 23:14 122944 ----a-w- c:\windows\system32\MackieAsio.dll
2012-04-02 03:15 . 2011-06-02 23:14 63552 ----a-w- c:\windows\system32\drivers\MackieUSB.sys
2012-04-02 03:15 . 2011-06-02 23:13 232448 ----a-w- c:\windows\Mackie64.exe
2012-04-02 03:15 . 2011-06-02 23:09 204800 ----a-w- c:\windows\Mackie.exe
2012-04-02 01:04 . 2012-04-02 01:04 -------- d-----w- c:\program files\VideoLAN
2012-04-01 05:56 . 2012-04-01 06:02 -------- d-----w- c:\program files\FoxTabVideoConverter
2012-04-01 05:18 . 2012-04-01 05:18 -------- d-----w- c:\programdata\CyberLink
2012-04-01 05:17 . 2012-04-01 05:17 -------- d--h--w- c:\program files\InstallShield Installation Information
2012-04-01 05:17 . 2012-04-01 05:18 -------- d-----w- c:\program files\CyberLink
2012-04-01 05:11 . 2012-04-01 05:11 -------- d-----w- c:\program files\Common Files\InstallShield
2012-04-01 04:39 . 2012-04-01 06:02 -------- d-----w- c:\programdata\Nero
2012-04-01 04:39 . 2012-04-01 06:02 -------- d-----w- c:\program files\Common Files\Nero
2012-04-01 04:39 . 2012-04-01 06:02 -------- d-----w- c:\program files\Nero
2012-04-01 04:11 . 2000-06-26 18:45 106496 ----a-w- c:\windows\system32\TwnLib20.dll
2012-04-01 04:11 . 2001-06-26 15:15 38912 ----a-w- c:\windows\system32\picn20.dll
2012-04-01 04:11 . 2001-07-07 01:24 283920 ----a-w- c:\windows\system32\ImagXpr5.dll
2012-04-01 04:11 . 2001-07-06 21:41 569344 ----a-w- c:\windows\system32\imagr5.dll
2012-04-01 04:11 . 2001-07-06 19:44 544768 ----a-w- c:\windows\system32\imagx5.dll
2012-04-01 04:11 . 2012-04-01 04:12 -------- d-----w- c:\program files\Common Files\Ahead
2012-04-01 04:11 . 2001-07-09 18:50 155648 ----a-w- c:\windows\system32\NeroCheck.exe
2012-04-01 04:11 . 2012-04-01 04:27 -------- d-----w- c:\program files\Ahead
2012-04-01 03:47 . 2012-04-03 17:35 -------- d-----w- c:\windows\Panther
2012-04-01 03:47 . 2012-04-01 03:47 -------- d-----w- C:\Boot
2012-04-01 03:35 . 2003-06-19 00:31 18944 ----a-w- c:\windows\system32\Spool\prtprocs\w32x86\mdippr.dll
2012-04-01 03:35 . 2003-06-19 00:31 17920 ----a-w- c:\windows\system32\mdimon.dll
2012-04-01 03:35 . 2012-04-01 03:35 -------- d-----w- C:\Windows.old
2012-04-01 03:34 . 2012-04-01 03:34 -------- d-----w- c:\program files\Microsoft ActiveSync
2012-04-01 03:33 . 2012-04-03 05:32 -------- d-----w- c:\program files\Microsoft.NET
2012-04-01 03:33 . 2012-04-01 03:33 -------- d-----w- c:\windows\PCHEALTH
2012-04-01 03:24 . 2012-02-23 16:18 237072 ------w- c:\windows\system32\MpSigStub.exe
2012-04-01 03:18 . 2012-01-25 05:44 57856 ----a-w- c:\windows\system32\rdpwsx.dll
2012-04-01 03:18 . 2012-01-25 05:44 129536 ----a-w- c:\windows\system32\rdpcorekmts.dll
2012-04-01 03:18 . 2012-01-25 05:40 8192 ----a-w- c:\windows\system32\rdrmemptylst.exe
2012-04-01 03:18 . 2009-12-29 06:55 172032 ----a-w- c:\windows\system32\wintrust.dll
2012-04-01 03:17 . 2012-02-15 05:44 826368 ----a-w- c:\windows\system32\rdpcore.dll
2012-04-01 03:17 . 2012-02-15 04:22 177152 ----a-w- c:\windows\system32\drivers\rdpwd.sys
2012-04-01 03:17 . 2012-02-15 04:22 24064 ----a-w- c:\windows\system32\drivers\tdtcp.sys
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files\Common Files\Nero\Lib\NMIndexStoreSvr.exe" [2008-06-24 1840424]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SoundMan"="SOUNDMAN.EXE" [2009-04-14 604704]
"NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]
"Loud Taskbar"="c:\program files\LoudAudio\MackieTaskbar.exe" [2011-06-02 579584]
"mcui_exe"="c:\program files\McAfee.com\Agent\mcagent.exe" [2011-11-23 1318816]
"McPvTray_exe"="c:\program files\McAfee\MAT\McPvTray.exe" [2011-04-08 419904]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-04-04 843712]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcmscsvc]
@=""
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]
@=""
.
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R3 HawkesUpdater;Hawkes Unattended Updater;c:\program files\Hawkes Learning Systems\Hawkes Update Service Manager\srvany.exe [2003-04-18 8192]
R3 McAWFwk;McAfee Activation Service;c:\progra~1\mcafee\msc\mcawfwk.exe [2011-01-28 203080]
R3 mferkdet;McAfee Inc. mferkdet;c:\windows\system32\drivers\mferkdet.sys [2011-10-15 87656]
R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [2012-04-03 1343400]
R4 McOobeSv;McAfee OOBE Service;c:\program files\Common Files\Mcafee\McSvcHost\McSvHost.exe [2011-01-28 214904]
S0 McPvDrv;McPvDrv Driver;c:\windows\system32\drivers\McPvDrv.sys [2011-04-11 64048]
S0 mfewfpk;McAfee Inc. mfewfpk;c:\windows\system32\drivers\mfewfpk.sys [2011-10-15 165680]
S1 mfenlfk;McAfee NDIS Light Filter;c:\windows\system32\DRIVERS\mfenlfk.sys [2011-10-15 64880]
S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [2009-07-13 48128]
S2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files\Common Files\Adobe\ARM\1.0\armsvc.exe [2012-04-04 63928]
S2 McAfee SiteAdvisor Service;McAfee SiteAdvisor Service;c:\program files\Common Files\Mcafee\McSvcHost\McSvHost.exe [2011-01-28 214904]
S2 McMPFSvc;McAfee Personal Firewall Service;c:\program files\Common Files\Mcafee\McSvcHost\McSvHost.exe [2011-01-28 214904]
S2 McNaiAnn;McAfee VirusScan Announcer;c:\program files\Common Files\Mcafee\McSvcHost\McSvHost.exe [2011-01-28 214904]
S2 mfefire;McAfee Firewall Core Service;c:\program files\Common Files\McAfee\SystemCore\\mfefire.exe [2011-12-07 160608]
S2 mfevtp;McAfee Validation Trust Protection Service;c:\windows\system32\mfevtps.exe [2011-12-07 150856]
S3 cfwids;McAfee Inc. cfwids;c:\windows\system32\drivers\cfwids.sys [2011-10-15 57600]
S3 MackieUSB;Mackie Audio USB Driver;c:\windows\system32\DRIVERS\MackieUSB.sys [2011-06-02 63552]
S3 mfefirek;McAfee Inc. mfefirek;c:\windows\system32\drivers\mfefirek.sys [2011-10-15 338176]
S3 netr73;Netopia RT73 Wireless Driver for Vista;c:\windows\system32\DRIVERS\netr73.sys [2009-07-13 545792]
.
.
--- Other Services/Drivers In Memory ---
.
*Deregistered* - mfeavfk01
.
Contents of the 'Scheduled Tasks' folder
.
2012-04-25 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-406179606-2168368824-3621562350-1000Core.job
- c:\users\Mark\AppData\Local\Google\Update\GoogleUpdate.exe [2012-04-02 03:07]
.
2012-04-26 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-406179606-2168368824-3621562350-1000UA.job
- c:\users\Mark\AppData\Local\Google\Update\GoogleUpdate.exe [2012-04-02 03:07]
.
.
------- Supplementary Scan -------
.
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
TCP: DhcpNameServer = 192.168.1.254
.
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Completion time: 2012-04-26 01:56:03
ComboFix-quarantined-files.txt 2012-04-26 08:55
.
Pre-Run: 39,862,603,776 bytes free
Post-Run: 39,636,246,528 bytes free
.
- - End Of File - - 6442CDB8497F4FFA0791D522775FFF15

Attached Files


Edited by Gammo, 26 April 2012 - 09:46 AM.

  • 0

#9
Gammo

Gammo

    Member 2k

  • Malware Removal
  • 2,299 posts
Please download Malwarebytes' Anti-Malware

Double Click mbam-setup.exe to install the application.
  • Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
  • If an update is found, it will download and install the latest version.
  • Once the program has loaded, select "Perform Quick Scan", then click Scan.
  • The scan may take some time to finish, so please be patient.
  • When the scan is complete, click OK, then Show Results to view the results.
  • Make sure that everything is checked, and click Remove Selected.
  • When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
  • The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
  • Copy&Paste the entire report in your next reply.
Extra Note:
If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts, click OK to either and let MBAM proceed with the disinfection process, if asked to restart the computer, please do so immediately.




Download the latest version of TDSSKiller from here and save it to your Desktop.


  • Doubleclick on TDSSKiller.exe to run the application, then click on Change parameters.

    Posted Image
  • Check the boxes beside Verify Driver Digital Signature and Detect TDLFS file system, then click OK.

    Posted Image
  • Click the Start Scan button.

    Posted Image
  • If a suspicious object is detected, the default action will be Skip, click on Continue.

    Posted Image
  • If malicious objects are found, they will show in the Scan results and offer three (3) options.
  • Ensure Cure is selected, then click Continue => Reboot now to finish the cleaning process.

    Posted Image
  • Note: If Cure is not available, please choose Skip instead, do not choose Delete unless instructed.

A report will be created in your root directory, (usually C:\ folder) in the form of "TDSSKiller.[Version]_[Date]_[Time]_log.txt". Please copy and paste its contents on your next reply.
  • 0






Similar Topics

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users

As Featured On:

Microsoft Yahoo BBC MSN PC Magazine Washington Post HP