# Firefox issue



## Motorcharge

Tried googling this first but really didn't know how to phrase it.

Anyway often times when I'm typing in Firefox the cursor randomly disappears as if I've clicked another window and I have to click Firefox again for it to be the top window. It's not minimizing and nothing else is popping up in it's place. It's very random. Sometimes it will do it back to back constantly, sometimes it will happen at random intervals a few seconds apart and sometimes it wont happen for hours then start doing it again. The best way I can describe it is if I had a window on my second monitor and someone clicked that window as I was typing this and I had to take and click this window again to be able to type or use Firefox.

I've scanned in both regular and safe mode with Malware Bytes, Advanced System Care and Windows Malicious Software Removal tool. None of the scans have found anything. I've also tried closing out of as many programs as I can that are running in the background and that hasn't helped either.

It seems to happen most when I'm typing on vBulletin based forums. It happens all the time here and over on Jeepforum.


----------



## gamblingman

I'm wondering if it happens even if you aren't typing or working online. 

Also, do you have another mouse you can use? If so then try a different mouse. If the problem persists then it isn't the mouse, and if it stops then you have your answer.

Have you had any os error pop-ups lately?


----------



## Motorcharge

Only when I'm typing in vbulletin it seems. I can sit on facebook for hours and it never happens. No OS errors or any other errors to speak of.


----------



## gamblingman

Sounds like might be an issue with firefox. Try another browser for awhile and see what happens. If it stops happening use firefox again, but with addons disabled. If it still doesnt happen, good chance its one of your addons.


----------



## Motorcharge

Well it's not Firefox or the mouse. Did everything I could think of to FF from disabling/removing add ons to reinstalling. Moved the mouse to another USB port and reinstalled it, problem persists.

It's now doing it no matter what program I'm in and far more frequently (almost constantly). Firefox, Chrome, VLC, notepad, anything. I'm also occasionally (1-2 times a night) getting download pop ups for an mp3 download from some blog site.


----------



## johnb35

Run malwarebytes and hijackthis and post the logs.


----------



## Motorcharge

Ran malware earlier today in safe mode, full scan and it came up clean. Really don't want to redo it unless necessary. 

_______________________________________________________

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 7:13:02 PM, on 6/20/2012
Platform: Windows 7 SP1 (WinNT 6.00.3505)
MSIE: Internet Explorer v9.00 (9.00.8112.16421)
Boot mode: Normal

Running processes:
C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAAnotif.exe
C:\Program Files (x86)\RocketDock\RocketDock.exe
C:\Program Files (x86)\IObit\Advanced SystemCare 5\ASCTray.exe
C:\Program Files (x86)\NewTech Infosystems\Gateway MyBackup\BackupManagerTray.exe
C:\Program Files (x86)\Belkin\Router Setup and Monitor\BelkinRouterMonitor.exe
C:\Program Files (x86)\Common Files\Research In Motion\USB Drivers\RIMBBLaunchAgent.exe
C:\Program Files (x86)\Common Files\Spigot\Search Settings\SearchSettings.exe
C:\Program Files (x86)\Belkin\Router Setup and Monitor\BelkinSetup.exe
C:\Program Files (x86)\Windows Media Player\wmplayer.exe
C:\Program Files (x86)\Mozilla Firefox\firefox.exe
C:\Program Files (x86)\Common Files\Realtime Soft\RTSHookInterop\x32\RTSHookInterop.exe
C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe
C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe
C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe
C:\Users\Bre\Downloads\HijackThis.exe
C:\Windows\SysWOW64\svchost.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://homepage.gateway.com/rdr.aspx?b=ACGW&l=0409&m=sx2800&r=173604117307p0358v115k49i15222
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://homepage.gateway.com/rdr.aspx?b=ACGW&l=0409&m=sx2800&r=173604117307p0358v115k49i15222
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://homepage.gateway.com/rdr.aspx?b=ACGW&l=0409&m=sx2800&r=173604117307p0358v115k49i15222
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = 
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = 
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = 
R3 - URLSearchHook: IObit Toolbar - {0BDA0769-FD72-49F4-9266-E1FB004F4D8F} - C:\Program Files (x86)\IObit Toolbar\IE\5.9\iobitToolbarIE.dll
F2 - REG:system.ini: UserInit=userinit.exe,
O2 - BHO: HP Print Enhancer - {0347C33E-8762-4905-BF09-768834316C61} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll
O2 - BHO: IObit Toolbar - {0BDA0769-FD72-49F4-9266-E1FB004F4D8F} - C:\Program Files (x86)\IObit Toolbar\IE\5.9\iobitToolbarIE.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Freecorder Toolbar - {70dd86e8-b5bc-4e4a-9d5c-b6234c24323c} - C:\Program Files (x86)\freecordertoolbar\vmntemplateX.dll
O2 - BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: SkypeIEPluginBHO - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll
O2 - BHO: HP Smart BHO Class - {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll
O3 - Toolbar: (no name) - {bf7380fa-e3b4-4db2-af3e-9d8783a45bfc} - (no file)
O3 - Toolbar: (no name) - {D4027C7F-154A-4066-A1AD-4243D8127440} - (no file)
O3 - Toolbar: Freecorder Toolbar - {70dd86e8-b5bc-4e4a-9d5c-b6234c24323c} - C:\Program Files (x86)\freecordertoolbar\vmntemplateX.dll
O3 - Toolbar: IObit Toolbar - {0BDA0769-FD72-49F4-9266-E1FB004F4D8F} - C:\Program Files (x86)\IObit Toolbar\IE\5.9\iobitToolbarIE.dll
O4 - HKLM\..\Run: [BackupManagerTray] "C:\Program Files (x86)\NewTech Infosystems\Gateway MyBackup\BackupManagerTray.exe" -h -k
O4 - HKLM\..\Run: [InstaLAN] "C:\Program Files (x86)\Belkin\Router Setup and Monitor\BelkinRouterMonitor.exe" startup
O4 - HKLM\..\Run: [SwitchBoard] C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe
O4 - HKLM\..\Run: [AdobeCS5.5ServiceManager] "C:\Program Files (x86)\Common Files\Adobe\CS5.5ServiceManager\CS5.5ServiceManager.exe" -launchedbylogin
O4 - HKLM\..\Run: [APSDaemon] "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe"
O4 - HKLM\..\Run: [RIMBBLaunchAgent.exe] C:\Program Files (x86)\Common Files\Research In Motion\USB Drivers\RIMBBLaunchAgent.exe
O4 - HKLM\..\Run: [SearchSettings] "C:\Program Files (x86)\Common Files\Spigot\Search Settings\SearchSettings.exe"
O4 - HKCU\..\Run: [RocketDock] "C:\Program Files (x86)\RocketDock\RocketDock.exe"
O4 - HKCU\..\Run: [Advanced SystemCare 5] "C:\Program Files (x86)\IObit\Advanced SystemCare 5\ASCTray.exe" /AutoStart
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'NETWORK SERVICE')
O4 - Startup: Adobe Gamma.lnk = C:\Program Files (x86)\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Startup: CurseClientStartup.ccip
O4 - Startup: Rainmeter.lnk = C:\Program Files\Rainmeter\Rainmeter.exe
O4 - Global Startup: UltraMon.lnk = ?
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~2\MICROS~1\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Google Sidewiki... - res://C:\Program Files (x86)\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_D183CA64F05FDD98.dll/cmsidewiki.html
O9 - Extra button: @C:\Program Files (x86)\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1004 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: @C:\Program Files (x86)\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1003 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~1\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~1\Office12\ONBttnIE.dll
O9 - Extra button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O9 - Extra 'Tools' menuitem: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~2\MICROS~1\Office12\REFIEBAR.DLL
O9 - Extra button: Show or hide HP Smart Web Printing - {DDE87865-83C5-48c4-8357-2F5B1AA84522} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll
O10 - Unknown file in Winsock LSP: c:\program files (x86)\common files\microsoft shared\windows live\wlidnsp.dll
O10 - Unknown file in Winsock LSP: c:\program files (x86)\common files\microsoft shared\windows live\wlidnsp.dll
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O18 - Protocol: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL
O18 - Protocol: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files (x86)\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files (x86)\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Advanced SystemCare Service 5 (AdvancedSystemCareService5) - IObit - C:\Program Files (x86)\IObit\Advanced SystemCare 5\ASCService.exe
O23 - Service: AffinegyService - Affinegy, Inc. - C:\Program Files (x86)\Belkin\Router Setup and Monitor\BelkinService.exe
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
O23 - Service: Application Updater - Spigot, Inc. - C:\Program Files (x86)\Application Updater\ApplicationUpdater.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing)
O23 - Service: GRegService (Greg_Service) - Acer Incorporated - C:\Program Files (x86)\Gateway\Registration\GregHSRW.exe
O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: Google Update Service (gupdatem) (gupdatem) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAANTMon.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Mozilla Maintenance Service (MozillaMaintenance) - Mozilla Foundation - C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)
O23 - Service: NTI IScheduleSvc - NewTech Infosystems, Inc. - C:\Program Files (x86)\NewTech Infosystems\Gateway MyBackup\IScheduleSvc.exe
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Skype C2C Service - Skype Technologies S.A. - C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe
O23 - Service: Skype Updater (SkypeUpdate) - Skype Technologies - C:\Program Files (x86)\Skype\Updater\Updater.exe
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing)
O23 - Service: Adobe SwitchBoard (SwitchBoard) - Adobe Systems Incorporated - C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe
O23 - Service: TuneUp Utilities Service (TuneUp.UtilitiesSvc) - TuneUp Software - C:\Program Files (x86)\TuneUp Utilities 2012\TuneUpUtilitiesService64.exe
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)
O23 - Service: Updater Service - Acer - C:\Program Files\Gateway\Gateway Updater\UpdaterService.exe
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\Wat\WatUX.exe,-601 (WatAdminSvc) - Unknown owner - C:\Windows\system32\Wat\WatAdminSvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)

--
End of file - 12744 bytes


----------



## johnb35

Ok, Download and run combofix. I see some issues.

*Download and Run ComboFix*
*If you already have Combofix, please delete this copy and download it again as it's being updated regularly.*

*Download this file* here :

*Combofix*


When the page loads click on the blue combofix download link next to the BleepingComputer Mirror.
Save the file to your windows desktop.  The combofix icon will look like this when it has downloaded to your desktop.





We are almost ready to start ComboFix, but before we do so, we need to take some preventative measures so that there are no conflicts with other programs when running ComboFix. At this point you should do the following:


Close all open Windows including this one. 

Close or disable all running Antivirus, Antispyware, and Firewall programs as they may interfere with the proper running of ComboFix. Instructions on disabling these type of programs can be found *here*.
Once these two steps have been completed, double-click on the ComboFix icon found on your desktop. Please note, that once you start ComboFix you should not click anywhere on the ComboFix window as it can cause the program to stall. In fact, when ComboFix is running, do not touch your computer at all. The scan could take a while, so please be patient.

Please click on I agree on the disclaimer window.
ComboFix will now install itself on to your computer. When it is done, a blue screen will appear as shown below.





ComboFix is now preparing to run. When it has finished ComboFix will automatically attempt to create a System Restore point so that if any problems occur while using the program you can restore back to your previous configuration. When ComboFix has finished creating the restore point, it will then backup your Windows Registry as shown in the image below.





Once the Windows Registry has finished being backed up, ComboFix will attempt to detect if you have the Windows Recovery Console installed. If you already have it installed, you can skip to this section and continue reading. Otherwise you will see the following message as shown below:





At the above message box, please click on the Yes button in order for ComboFix to continue. Please follow the steps and instructions given by ComboFix in order to finish the installation of the Recovery Console.

Please click on yes in the next window to continue scanning for malware.

ComboFix will now disconnect your computer from the Internet, so do not be surprised or concerned if you receive any warnings stating that you are no longer on the Internet. When ComboFix has finished it will automatically restore your Internet connection.

ComboFix will now start scanning your computer for known infections. This procedure can take some time, so please be patient.

While the program is scanning your computer, it will change your clock format, so do not be concerned when you see this happen. When ComboFix is finished it will restore your clock settings to their previous settings. You will also see the text in the ComboFix window being updated as it goes through the various stages of its scan. An example of this can be seen below.





When ComboFix has finished running, you will see a screen stating that it is preparing the log report.

This can take a while, so please be patient. If you see your Windows desktop disappear, do not worry. This is normal and ComboFix will restore your desktop before it is finished. Eventually you will see a new screen that states the program is almost finished and telling you the programs log file, or report, will be located at C:\ComboFix.txt.

When ComboFix has finished, it will automatically close the program and change your clock back to its original format. It will then display the log file automatically for you.  

Now you just click on the edit menu and click on select all, then click on the edit menu again and click on copy.  Then come to the forum in your reply and right click on your mouse and click on paste.  



In your next reply please post:

The ComboFix log
A fresh HiJackThis log
An update on how your computer is running


----------



## Motorcharge

Downloaded it and ran the installer and it just disappears when it finishes and nothing happens. Deleted it and tried again, same result.


----------



## johnb35

Try in safe mode. 




Also try running tdsskiller to make sure you don't have a rootkit running.

Please download and run TDSSkiller

When the program opens, click on the start scan button.

TDSSKiller will now scan your computer for the TDSS infection. When the scan has finished it will display a result screen stating whether or not the infection was found on your computer. If it was found it will display a screen similar to the one below.






To remove the infection simply click on the Continue button and TDSSKiller will attempt to clean the infection.

When it has finished cleaning the infection you will see a report stating whether or not it was successful as shown below.






If the log says will be cured after reboot, please reboot the system by pressing the reboot now button.

After running there will be a log that will be located at the root of your c:\ drive labeled tdsskiller with a series of numbers after it.  Please open the log and copy and paste it back here.


If all else fails, run rkill and then try running combofix.

Rkill - http://download.bleepingcomputer.com/grinler/rkill.scr


----------



## Motorcharge

*Combofix results:*

ComboFix 12-06-20.02 - Bre 06/20/2012  20:02:49.1.4 - x64
Microsoft Windows 7 Home Premium   6.1.7601.1.1252.1.1033.18.4061.2156 [GMT -4:00]
Running from: c:\users\Bre\Downloads\ComboFix.exe
SP: Windows Defender *Enabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
(((((((((((((((((((((((((((((((((((((((   Other Deletions   )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\users\Bre\AppData\Local\{604e7576-ec0d-7231-cc64-a8dfba4e3e1f}
c:\users\Bre\AppData\Local\{604e7576-ec0d-7231-cc64-a8dfba4e3e1f}\@
c:\users\Bre\AppData\Local\{604e7576-ec0d-7231-cc64-a8dfba4e3e1f}\L\00000004.@
c:\users\Bre\AppData\Local\{604e7576-ec0d-7231-cc64-a8dfba4e3e1f}\L\1afb2d56
c:\users\Bre\AppData\Local\{604e7576-ec0d-7231-cc64-a8dfba4e3e1f}\L\80000032.@
c:\users\Bre\AppData\Local\{604e7576-ec0d-7231-cc64-a8dfba4e3e1f}\n
c:\users\Bre\AppData\Local\{604e7576-ec0d-7231-cc64-a8dfba4e3e1f}\U\00000004.@
c:\users\Bre\AppData\Local\{604e7576-ec0d-7231-cc64-a8dfba4e3e1f}\U\00000008.@
c:\users\Bre\AppData\Local\{604e7576-ec0d-7231-cc64-a8dfba4e3e1f}\U\000000cb.@
c:\users\Bre\AppData\Local\{604e7576-ec0d-7231-cc64-a8dfba4e3e1f}\U\80000000.@
c:\users\Bre\AppData\Local\{604e7576-ec0d-7231-cc64-a8dfba4e3e1f}\U\80000032.@
c:\users\Bre\AppData\Local\{604e7576-ec0d-7231-cc64-a8dfba4e3e1f}\U\80000064.@
c:\users\Bre\AppData\Local\Temp\1.tmp\F_IN_BOX.dll
c:\users\Bre\AppData\Roaming\Mozilla\Firefox\Profiles\y7r4no5l.default\searchplugins\bing-zugo.xml
c:\windows\assembly\GAC_32\Desktop.ini
c:\windows\assembly\GAC_64\Desktop.ini
c:\windows\system32\consrv.dll
c:\windows\system32\dds_trash_log.cmd
c:\windows\system32\drivers\etc\lmhosts
c:\windows\System64
.
.
(((((((((((((((((((((((((   Files Created from 2012-05-21 to 2012-06-21  )))))))))))))))))))))))))))))))
.
.
2012-06-19 00:25 . 2012-06-19 00:25	--------	d-----w-	c:\program files (x86)\Application Updater
2012-06-19 00:25 . 2012-06-19 00:25	--------	d-----w-	c:\program files (x86)\IObit Toolbar
2012-06-19 00:25 . 2012-06-19 00:25	--------	d-----w-	c:\program files (x86)\Common Files\Spigot
2012-06-17 21:10 . 2012-06-17 21:10	--------	d-----w-	c:\program files\Microsoft Silverlight
2012-06-17 21:10 . 2012-06-17 21:10	--------	d-----w-	c:\program files (x86)\Microsoft Silverlight
2012-06-17 19:36 . 2011-07-20 18:58	44032	----a-w-	c:\windows\system32\drivers\RimSerial_AMD64.sys
2012-06-17 19:36 . 2012-06-17 19:48	--------	d-----w-	c:\program files (x86)\Common Files\Research In Motion
2012-06-17 19:36 . 2012-06-17 19:36	--------	d-----w-	c:\program files (x86)\Research In Motion
2012-06-12 20:50 . 2011-10-12 22:14	34624	----a-w-	c:\windows\system32\TURegOpt.exe
2012-06-12 20:50 . 2011-10-12 22:14	25920	----a-w-	c:\windows\system32\authuitu.dll
2012-06-12 20:50 . 2011-10-12 22:14	21312	----a-w-	c:\windows\SysWow64\authuitu.dll
2012-06-12 20:49 . 2012-06-12 20:49	--------	d-----w-	c:\users\Bre\AppData\Roaming\TuneUp Software
2012-06-12 20:49 . 2012-06-12 20:50	--------	d-----w-	c:\program files (x86)\TuneUp Utilities 2012
2012-06-12 20:49 . 2012-06-12 20:50	--------	d-----w-	c:\programdata\TuneUp Software
2012-06-12 20:48 . 2012-06-12 20:48	--------	d-sh--w-	c:\programdata\{32364CEA-7855-4A3C-B674-53D8E9B97936}
2012-06-06 14:46 . 2012-06-06 14:46	770384	----a-w-	c:\program files (x86)\Mozilla Firefox\msvcr100.dll
2012-06-06 14:46 . 2012-06-06 14:46	421200	----a-w-	c:\program files (x86)\Mozilla Firefox\msvcp100.dll
2012-06-05 19:17 . 2012-06-05 19:17	--------	d-----w-	c:\program files (x86)\Hobbyist Software
2012-05-30 17:59 . 2012-05-30 17:59	4966600	----a-w-	c:\program files (x86)\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}\components\SkypeFfComponent.dll
2012-05-24 20:48 . 2012-05-24 20:48	--------	d-----w-	c:\programdata\Adobe Systems
2012-05-24 20:46 . 2012-05-24 20:46	--------	d-----w-	c:\program files (x86)\Common Files\Adobe Systems Shared
.
.
.
((((((((((((((((((((((((((((((((((((((((   Find3M Report   ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-05-17 23:51 . 2012-05-17 23:51	283200	----a-w-	c:\windows\system32\drivers\dtsoftbus01.sys
2012-05-17 22:50 . 2012-05-17 22:50	71680	----a-w-	c:\windows\system32\frapsv64.dll
2012-05-17 22:50 . 2012-05-17 22:50	65536	----a-w-	c:\windows\SysWow64\frapsvid.dll
2012-04-26 07:09 . 2012-04-26 07:09	91648	----a-w-	c:\windows\system32\SetIEInstalledDate.exe
2012-04-26 07:09 . 2012-04-26 07:09	89088	----a-w-	c:\windows\system32\RegisterIEPKEYs.exe
2012-04-26 07:09 . 2012-04-26 07:09	86528	----a-w-	c:\windows\SysWow64\iesysprep.dll
2012-04-26 07:09 . 2012-04-26 07:09	85504	----a-w-	c:\windows\system32\iesetup.dll
2012-04-26 07:09 . 2012-04-26 07:09	76800	----a-w-	c:\windows\SysWow64\SetIEInstalledDate.exe
2012-04-26 07:09 . 2012-04-26 07:09	76800	----a-w-	c:\windows\system32\tdc.ocx
2012-04-26 07:09 . 2012-04-26 07:09	74752	----a-w-	c:\windows\SysWow64\RegisterIEPKEYs.exe
2012-04-26 07:09 . 2012-04-26 07:09	74752	----a-w-	c:\windows\SysWow64\iesetup.dll
2012-04-26 07:09 . 2012-04-26 07:09	63488	----a-w-	c:\windows\SysWow64\tdc.ocx
2012-04-26 07:09 . 2012-04-26 07:09	603648	----a-w-	c:\windows\system32\vbscript.dll
2012-04-26 07:09 . 2012-04-26 07:09	49664	----a-w-	c:\windows\system32\imgutil.dll
2012-04-26 07:09 . 2012-04-26 07:09	48640	----a-w-	c:\windows\SysWow64\mshtmler.dll
2012-04-26 07:09 . 2012-04-26 07:09	48640	----a-w-	c:\windows\system32\mshtmler.dll
2012-04-26 07:09 . 2012-04-26 07:09	448512	----a-w-	c:\windows\system32\html.iec
2012-04-26 07:09 . 2012-04-26 07:09	420864	----a-w-	c:\windows\SysWow64\vbscript.dll
2012-04-26 07:09 . 2012-04-26 07:09	367104	----a-w-	c:\windows\SysWow64\html.iec
2012-04-26 07:09 . 2012-04-26 07:09	35840	----a-w-	c:\windows\SysWow64\imgutil.dll
2012-04-26 07:09 . 2012-04-26 07:09	30720	----a-w-	c:\windows\system32\licmgr10.dll
2012-04-26 07:09 . 2012-04-26 07:09	23552	----a-w-	c:\windows\SysWow64\licmgr10.dll
2012-04-26 07:09 . 2012-04-26 07:09	222208	----a-w-	c:\windows\system32\msls31.dll
2012-04-26 07:09 . 2012-04-26 07:09	173056	----a-w-	c:\windows\system32\ieUnatt.exe
2012-04-26 07:09 . 2012-04-26 07:09	165888	----a-w-	c:\windows\system32\iexpress.exe
2012-04-26 07:09 . 2012-04-26 07:09	161792	----a-w-	c:\windows\SysWow64\msls31.dll
2012-04-26 07:09 . 2012-04-26 07:09	160256	----a-w-	c:\windows\system32\wextract.exe
2012-04-26 07:09 . 2012-04-26 07:09	152064	----a-w-	c:\windows\SysWow64\wextract.exe
2012-04-26 07:09 . 2012-04-26 07:09	150528	----a-w-	c:\windows\SysWow64\iexpress.exe
2012-04-26 07:09 . 2012-04-26 07:09	142848	----a-w-	c:\windows\SysWow64\ieUnatt.exe
2012-04-26 07:09 . 2012-04-26 07:09	135168	----a-w-	c:\windows\system32\IEAdvpack.dll
2012-04-26 07:09 . 2012-04-26 07:09	12288	----a-w-	c:\windows\system32\mshta.exe
2012-04-26 07:09 . 2012-04-26 07:09	11776	----a-w-	c:\windows\SysWow64\mshta.exe
2012-04-26 07:09 . 2012-04-26 07:09	114176	----a-w-	c:\windows\system32\admparse.dll
2012-04-26 07:09 . 2012-04-26 07:09	111616	----a-w-	c:\windows\system32\iesysprep.dll
2012-04-26 07:09 . 2012-04-26 07:09	110592	----a-w-	c:\windows\SysWow64\IEAdvpack.dll
2012-04-26 07:09 . 2012-04-26 07:09	101888	----a-w-	c:\windows\SysWow64\admparse.dll
2012-04-25 22:44 . 2012-04-25 22:44	23112	----a-w-	c:\windows\system32\drivers\hitmanpro35.sys
2012-04-25 22:36 . 2012-04-25 22:36	81408	----a-w-	c:\windows\system32\imagehlp.dll
2012-04-25 22:36 . 2012-04-25 22:36	5120	----a-w-	c:\windows\SysWow64\wmi.dll
2012-04-25 22:36 . 2012-04-25 22:36	5120	----a-w-	c:\windows\system32\wmi.dll
2012-04-25 22:36 . 2012-04-25 22:36	23408	----a-w-	c:\windows\system32\drivers\fs_rec.sys
2012-04-25 22:36 . 2012-04-25 22:36	220672	----a-w-	c:\windows\system32\wintrust.dll
2012-04-25 22:36 . 2012-04-25 22:36	172544	----a-w-	c:\windows\SysWow64\wintrust.dll
2012-04-25 22:36 . 2012-04-25 22:36	159232	----a-w-	c:\windows\SysWow64\imagehlp.dll
2012-04-25 22:33 . 2012-04-25 22:33	9216	----a-w-	c:\windows\system32\rdrmemptylst.exe
2012-04-25 22:33 . 2012-04-25 22:33	77312	----a-w-	c:\windows\system32\rdpwsx.dll
2012-04-25 22:33 . 2012-04-25 22:33	149504	----a-w-	c:\windows\system32\rdpcorekmts.dll
2012-04-25 22:32 . 2012-04-25 22:32	826880	----a-w-	c:\windows\SysWow64\rdpcore.dll
2012-04-25 22:32 . 2012-04-25 22:32	23552	----a-w-	c:\windows\system32\drivers\tdtcp.sys
2012-04-25 22:32 . 2012-04-25 22:32	210944	----a-w-	c:\windows\system32\drivers\rdpwd.sys
2012-04-25 22:32 . 2012-04-25 22:32	1031680	----a-w-	c:\windows\system32\rdpcore.dll
2012-04-25 22:27 . 2012-04-25 22:27	509952	----a-w-	c:\windows\system32\ntshrui.dll
2012-04-25 22:27 . 2012-04-25 22:27	442880	----a-w-	c:\windows\SysWow64\ntshrui.dll
2012-04-25 22:26 . 2012-04-25 22:26	515584	----a-w-	c:\windows\system32\timedate.cpl
2012-04-25 22:26 . 2012-04-25 22:26	478720	----a-w-	c:\windows\SysWow64\timedate.cpl
2012-04-25 22:26 . 2012-04-25 22:26	498688	----a-w-	c:\windows\system32\drivers\afd.sys
2012-04-25 22:23 . 2012-04-25 22:23	690688	----a-w-	c:\windows\SysWow64\msvcrt.dll
2012-04-25 22:23 . 2012-04-25 22:23	634880	----a-w-	c:\windows\system32\msvcrt.dll
2012-04-25 22:21 . 2012-04-25 22:21	1731920	----a-w-	c:\windows\system32\ntdll.dll
2012-04-25 22:21 . 2012-04-25 22:21	1292080	----a-w-	c:\windows\SysWow64\ntdll.dll
2012-04-25 22:21 . 2012-04-25 22:21	96768	----a-w-	c:\windows\SysWow64\sspicli.dll
2012-04-25 22:21 . 2012-04-25 22:21	95600	----a-w-	c:\windows\system32\drivers\ksecdd.sys
2012-04-25 22:21 . 2012-04-25 22:21	459232	----a-w-	c:\windows\system32\drivers\cng.sys
2012-04-25 22:21 . 2012-04-25 22:21	395776	----a-w-	c:\windows\system32\webio.dll
2012-04-25 22:21 . 2012-04-25 22:21	340992	----a-w-	c:\windows\system32\schannel.dll
2012-04-25 22:21 . 2012-04-25 22:21	314880	----a-w-	c:\windows\SysWow64\webio.dll
2012-04-25 22:21 . 2012-04-25 22:21	31232	----a-w-	c:\windows\system32\lsass.exe
2012-04-25 22:21 . 2012-04-25 22:21	29184	----a-w-	c:\windows\system32\sspisrv.dll
2012-04-25 22:21 . 2012-04-25 22:21	28160	----a-w-	c:\windows\system32\secur32.dll
2012-04-25 22:21 . 2012-04-25 22:21	224768	----a-w-	c:\windows\SysWow64\schannel.dll
2012-04-25 22:21 . 2012-04-25 22:21	22016	----a-w-	c:\windows\SysWow64\secur32.dll
2012-04-25 22:21 . 2012-04-25 22:21	152432	----a-w-	c:\windows\system32\drivers\ksecpkg.sys
2012-04-25 22:21 . 2012-04-25 22:21	1447936	----a-w-	c:\windows\system32\lsasrv.dll
2012-04-25 22:21 . 2012-04-25 22:21	136192	----a-w-	c:\windows\system32\sspicli.dll
2012-04-25 22:21 . 2012-04-25 22:21	514560	----a-w-	c:\windows\SysWow64\qdvd.dll
2012-04-25 22:21 . 2012-04-25 22:21	366592	----a-w-	c:\windows\system32\qdvd.dll
2012-04-25 22:21 . 2012-04-25 22:21	1572864	----a-w-	c:\windows\system32\quartz.dll
2012-04-25 22:21 . 2012-04-25 22:21	1328128	----a-w-	c:\windows\SysWow64\quartz.dll
2012-04-25 22:20 . 2012-04-25 22:20	77312	----a-w-	c:\windows\system32\packager.dll
2012-04-25 22:20 . 2012-04-25 22:20	67072	----a-w-	c:\windows\SysWow64\packager.dll
2012-04-25 22:16 . 2012-04-25 22:16	2048	----a-w-	c:\windows\SysWow64\tzres.dll
2012-04-25 22:16 . 2012-04-25 22:16	2048	----a-w-	c:\windows\system32\tzres.dll
2012-04-25 22:16 . 2012-04-25 22:16	43520	----a-w-	c:\windows\system32\csrsrv.dll
2012-04-25 22:16 . 2012-04-25 22:16	723456	----a-w-	c:\windows\system32\EncDec.dll
2012-04-25 22:16 . 2012-04-25 22:16	534528	----a-w-	c:\windows\SysWow64\EncDec.dll
2012-04-25 22:07 . 2012-04-25 22:07	75776	----a-w-	c:\windows\SysWow64\psisrndr.ax
2012-04-25 22:07 . 2012-04-25 22:07	613888	----a-w-	c:\windows\system32\psisdecd.dll
2012-04-25 22:07 . 2012-04-25 22:07	465408	----a-w-	c:\windows\SysWow64\psisdecd.dll
2012-04-25 22:07 . 2012-04-25 22:07	108032	----a-w-	c:\windows\system32\psisrndr.ax
2012-04-25 22:06 . 2012-04-25 22:06	861696	----a-w-	c:\windows\system32\oleaut32.dll
2012-04-25 22:06 . 2012-04-25 22:06	571904	----a-w-	c:\windows\SysWow64\oleaut32.dll
2012-04-25 22:06 . 2012-04-25 22:06	331776	----a-w-	c:\windows\system32\oleacc.dll
2012-04-25 22:06 . 2012-04-25 22:06	233472	----a-w-	c:\windows\SysWow64\oleacc.dll
2012-04-19 00:56 . 2012-04-19 00:56	94208	----a-w-	c:\windows\SysWow64\QuickTimeVR.qtx
2012-04-19 00:56 . 2012-04-19 00:56	69632	----a-w-	c:\windows\SysWow64\QuickTime.qts
2012-04-13 08:46 . 2012-04-25 07:33	8917360	----a-w-	c:\programdata\Microsoft\Windows Defender\Definition Updates\{41CB3D6F-1963-4E87-B780-A71E76739471}\mpengine.dll
2012-04-04 19:56 . 2012-04-25 22:50	24904	----a-w-	c:\windows\system32\drivers\mbam.sys
2012-03-31 06:05 . 2012-05-11 18:13	5559664	----a-w-	c:\windows\system32\ntoskrnl.exe
2012-03-31 04:39 . 2012-05-11 18:13	3968368	----a-w-	c:\windows\SysWow64\ntkrnlpa.exe
.
.
------- Sigcheck -------
Note: Unsigned files aren't necessarily malware.
.
[7] 2011-02-26 . E38899074D4951D31B4040E994DD7C8D . 2870784 . . [6.1.7600.16385] .. c:\windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20910_none_ae79ed04ac56c4a9\explorer.exe
[7] 2011-02-26 . 0862495E0C825893DB75EF44FAEA8E93 . 2870272 . . [6.1.7600.16385] .. c:\windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16768_none_adc24107935a7e25\explorer.exe
[7] 2011-02-26 . 3B69712041F3D63605529BD66DC00C48 . 2871808 . . [6.1.7600.16385] .. c:\windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.21669_none_b0333b22a99da332\explorer.exe
[7] 2011-02-25 . 332FEAB1435662FC6C672E25BEB37BE3 . 2871808 . . [6.1.7600.16385] .. c:\windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17567_none_afa79dc39081d0ba\explorer.exe
[7] 2010-11-20 . AC4C51EB24AA95B77F705AB159189E24 . 2872320 . . [6.1.7600.16385] .. c:\windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17514_none_afdaac81905bf900\explorer.exe
[7] 2009-10-31 . B8EC4BD49CE8F6FC457721BFC210B67F . 2870272 . . [6.1.7600.16385] .. c:\windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20563_none_ae46d6aeac7ca7c7\explorer.exe
[-] 2009-10-31 . D5A67267C4C3879E63E9BFBA991D823A . 2387456 . . [6.1.7600.16385] .. c:\windows\explorer.exe
[7] 2009-10-31 . 9AAAEC8DAC27AA17B053E6352AD233AE . 2870272 . . [6.1.7600.16385] .. c:\windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16450_none_adc508f19359a007\explorer.exe
[7] 2009-08-03 . 700073016DAC1C3D2E7E2CE4223334B6 . 2868224 . . [6.1.7600.16385] .. c:\windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20500_none_ae84b558ac4eb41c\explorer.exe
[7] 2009-08-03 . F170B4A061C9E026437B193B4D571799 . 2868224 . . [6.1.7600.16385] .. c:\windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16404_none_adff19b5932d79ae\explorer.exe
[7] 2009-07-14 . C235A51CB740E45FFA0EBFB9BAFCDA64 . 2868224 . . [6.1.7600.16385] .. c:\windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16385_none_ada998b9936d7566\explorer.exe
.
(((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown 
REGEDIT4
.
[HKEY_LOCAL_MACHINE\Wow6432Node\~\Browser Helper Objects\{70dd86e8-b5bc-4e4a-9d5c-b6234c24323c}]
2011-06-24 15:04	81920	----a-w-	c:\program files (x86)\freecordertoolbar\vmntemplateX.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar]
"{70dd86e8-b5bc-4e4a-9d5c-b6234c24323c}"= "c:\program files (x86)\freecordertoolbar\vmntemplateX.dll" [2011-06-24 81920]
.
[HKEY_CLASSES_ROOT\clsid\{70dd86e8-b5bc-4e4a-9d5c-b6234c24323c}]
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RocketDock"="c:\program files (x86)\RocketDock\RocketDock.exe" [2007-09-02 495616]
"Advanced SystemCare 5"="c:\program files (x86)\IObit\Advanced SystemCare 5\ASCTray.exe" [2012-05-28 288128]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"BackupManagerTray"="c:\program files (x86)\NewTech Infosystems\Gateway MyBackup\BackupManagerTray.exe" [2009-08-12 244480]
"InstaLAN"="c:\program files (x86)\Belkin\Router Setup and Monitor\BelkinRouterMonitor.exe" [2011-02-25 1770400]
"SwitchBoard"="c:\program files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe" [2010-02-19 517096]
"AdobeCS5.5ServiceManager"="c:\program files (x86)\Common Files\Adobe\CS5.5ServiceManager\CS5.5ServiceManager.exe" [2011-01-12 1523360]
"APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2012-02-21 59240]
"RIMBBLaunchAgent.exe"="c:\program files (x86)\Common Files\Research In Motion\USB Drivers\RIMBBLaunchAgent.exe" [2011-11-02 90448]
"SearchSettings"="c:\program files (x86)\Common Files\Spigot\Search Settings\SearchSettings.exe" [2012-06-13 1088904]
.
c:\users\Bre\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Adobe Gamma.lnk - c:\program files (x86)\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2005-3-16 113664]
CurseClientStartup.ccip [2011-10-9 0]
Rainmeter.lnk - c:\program files\Rainmeter\Rainmeter.exe [2011-9-18 102912]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
UltraMon.lnk - c:\windows\Installer\{537056B7-32A4-4408-9B54-0341963C7C9C}\IcoUltraMon.ico [2011-9-18 29310]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 0 (0x0)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Security Packages	REG_MULTI_SZ   	kerberos msv1_0 schannel wdigest tspkg pku2u livessp
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\run-]
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe"
"HP Software Update"=c:\program files (x86)\HP\HP Software Update\HPWuSchd2.exe
"iTunesHelper"="c:\program files (x86)\iTunes\iTunesHelper.exe"
"ConduitHelper"="c:\users\Public\Conduit\ConduitHelper\ConduitHelper.exe"
"Freecorder FLV Service"="c:\program files (x86)\Freecorder\FLVSrvc.exe" /run
"Gateway Photo Frame"="c:\program files (x86)\Gateway Photo Frame\ButtonMonitor.exe" -A
"QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" -atboottime
.
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R2 gupdate;Google Update Service (gupdate);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-09-18 136176]
R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe [2012-06-05 160944]
R3 BTCFilterService;USB Networking Driver Filter Service;c:\windows\system32\DRIVERS\motfilt.sys [x]
R3 BVRPMPR5a64;BVRPMPR5a64 NDIS Protocol Driver;c:\windows\system32\drivers\BVRPMPR5a64.SYS [x]
R3 gupdatem;Google Update Service (gupdatem);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-09-18 136176]
R3 LGVirHid;Logitech Gamepanel Virtual HID Device Driver;c:\windows\system32\drivers\LGVirHid.sys [x]
R3 motandroidusb;Mot ADB Interface Driver;c:\windows\system32\Drivers\motoandroid.sys [x]
R3 motccgp;Motorola USB Composite Device Driver;c:\windows\system32\DRIVERS\motccgp.sys [x]
R3 motccgpfl;MotCcgpFlService;c:\windows\system32\DRIVERS\motccgpfl.sys [x]
R3 Motousbnet;Motorola USB Networking Driver Service;c:\windows\system32\DRIVERS\Motousbnet.sys [x]
R3 MozillaMaintenance;Mozilla Maintenance Service;c:\program files (x86)\Mozilla Maintenance Service\maintenanceservice.exe [2012-06-16 113120]
R3 pbfilter;pbfilter;c:\program files\PeerBlock\pbfilter.sys [2010-11-07 24176]
R3 RTL8192su;Realtek RTL8192SU Wireless LAN 802.11n USB 2.0 Network Adapter;c:\windows\system32\DRIVERS\RTL8192su.sys [x]
R3 SwitchBoard;Adobe SwitchBoard;c:\program files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [2010-02-19 517096]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [x]
R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [x]
R3 WinRing0_1_2_0;WinRing0_1_2_0;c:\program files (x86)\IObit\Game Booster 3\Driver\WinRing0x64.sys [2010-11-01 14544]
R3 WMZuneComm;Zune Windows Mobile Connectivity Service;c:\program files\Zune\WMZuneComm.exe [2011-08-05 306400]
S1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;c:\windows\system32\DRIVERS\dtsoftbus01.sys [x]
S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [x]
S2 AdvancedSystemCareService5;Advanced SystemCare Service 5;c:\program files (x86)\IObit\Advanced SystemCare 5\ASCService.exe [2012-05-26 913792]
S2 Application Updater;Application Updater;c:\program files (x86)\Application Updater\ApplicationUpdater.exe [2012-06-13 792512]
S2 cpuz135;cpuz135;c:\windows\system32\drivers\cpuz135_x64.sys [x]
S2 Greg_Service;GRegService;c:\program files (x86)\Gateway\Registration\GregHSRW.exe [2009-08-28 1150496]
S2 NTI IScheduleSvc;NTI IScheduleSvc;c:\program files (x86)\NewTech Infosystems\Gateway MyBackup\IScheduleSvc.exe [2009-08-12 62208]
S2 Skype C2C Service;Skype C2C Service;c:\programdata\Skype\Toolbars\Skype C2C Service\c2c_service.exe [2012-05-30 3048136]
S2 TuneUp.UtilitiesSvc;TuneUp Utilities Service;c:\program files (x86)\TuneUp Utilities 2012\TuneUpUtilitiesService64.exe [2011-10-12 2072896]
S2 UltraMonUtility;UltraMon Utility Driver;c:\program files (x86)\Common Files\Realtime Soft\UltraMonMirrorDrv\x64\UltraMonUtility.sys [2008-11-14 20512]
S2 Updater Service;Updater Service;c:\program files\Gateway\Gateway Updater\UpdaterService.exe [2009-07-04 240160]
S3 e1yexpress;Intel(R) Gigabit Network Connections Driver;c:\windows\system32\DRIVERS\e1y60x64.sys [x]
S3 EuMusDesignVirtualAudioCableWdm;Virtual Audio Cable (WDM);c:\windows\system32\DRIVERS\vrtaucbl.sys [x]
S3 IntcHdmiAddService;Intel(R) High Definition Audio HDMI;c:\windows\system32\drivers\IntcHdmi.sys [x]
S3 LGBusEnum;Logitech GamePanel Virtual Bus Enumerator Driver;c:\windows\system32\drivers\LGBusEnum.sys [x]
S3 ManyCam;ManyCam Virtual Webcam, WDM Video Capture Driver;c:\windows\system32\DRIVERS\ManyCam_x64.sys [x]
S3 phaudlwr;Philips Audio Filter;c:\windows\system32\DRIVERS\phaudlwr.sys [x]
S3 pneteth;PdaNet Broadband;c:\windows\system32\DRIVERS\pneteth.sys [x]
S3 SPC620;Philips SPC620NC PC Camera;c:\windows\system32\drivers\SPC620.sys [x]
S3 SPC620m;Philips SPC620NC PC Cameram;c:\windows\system32\drivers\SPC620m.sys [x]
S3 TuneUpUtilitiesDrv;TuneUpUtilitiesDrv;c:\program files (x86)\TuneUp Utilities 2012\TuneUpUtilitiesDriver64.sys [2011-09-22 11856]
.
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\svchost]
hpdevmgmt	REG_MULTI_SZ   	hpqcxs08 hpqddsvc
.
Contents of the 'Scheduled Tasks' folder
.
2012-06-21 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-09-18 22:04]
.
2012-06-21 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-09-18 22:04]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IAAnotif"="c:\program files (x86)\Intel\Intel Matrix Storage Manager\iaanotif.exe" [2009-06-05 186904]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2009-07-20 7981088]
"Launch LCore"="c:\program files\Logitech Gaming Software\LCore.exe" [2011-07-28 110360]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2011-02-12 162328]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2011-02-12 386584]
"Persistence"="c:\windows\system32\igfxpers.exe" [2011-02-12 417304]
"AdobeAAMUpdater-1.0"="c:\program files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe" [2011-03-15 499608]
"combofix"="c:\combofix\CF24505.3XE" [2010-11-20 345088]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"LoadAppInit_DLLs"=0x0
.
------- Supplementary Scan -------
.
uLocal Page = c:\windows\system32\blank.htm
mStart Page = hxxp://homepage.gateway.com/rdr.aspx?b=ACGW&l=0409&m=sx2800&r=173604117307p0358v115k49i15222
mLocal Page = c:\windows\SysWOW64\blank.htm
uInternet Settings,ProxyOverride = *.local
IE: E&xport to Microsoft Excel - c:\progra~2\MICROS~1\Office12\EXCEL.EXE/3000
IE: Google Sidewiki... - c:\program files (x86)\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_D183CA64F05FDD98.dll/cmsidewiki.html
TCP: DhcpNameServer = 192.168.2.1
FF - ProfilePath - c:\users\Bre\AppData\Roaming\Mozilla\Firefox\Profiles\y7r4no5l.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://www.facebook.com/
FF - prefs.js: keyword.URL - hxxp://www.google.co.in/search?btnG=Google+Search&q=
.
- - - - ORPHANS REMOVED - - - -
.
Toolbar-Locked - (no file)
Toolbar-{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc} - (no file)
Toolbar-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file)
SafeBoot-77211938.sys
Toolbar-Locked - (no file)
AddRemove-Zune Explorer Enabler - c:\windows\system32\tpuninst.exe
.
.
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_USERS\S-1-5-21-520610219-17727062-633966983-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.eml\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="WindowsLiveMail.Email.1"
.
[HKEY_USERS\S-1-5-21-520610219-17727062-633966983-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.vcf\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="WindowsLiveMail.VCard.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil10c.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\LocalServer32]
@="c:\\Windows\\SysWow64\\Macromed\\Flash\\FlashUtil10c.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10c.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.10"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10c.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10c.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10c.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}]
@Denied: (A 2) (Everyone)
@="IFlashBroker3"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
------------------------ Other Running Processes ------------------------
.
c:\program files (x86)\Belkin\Router Setup and Monitor\BelkinService.exe
c:\program files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
c:\program files (x86)\Intel\Intel Matrix Storage Manager\IAANTMon.exe
c:\program files (x86)\Belkin\Router Setup and Monitor\BelkinSetup.exe
.
**************************************************************************
.
Completion time: 2012-06-20  20:13:31 - machine was rebooted
ComboFix-quarantined-files.txt  2012-06-21 00:13
.
Pre-Run: 138,700,808,192 bytes free
Post-Run: 138,163,802,112 bytes free
.
- - End Of File - - 7B268CA3A23D6FDCA2C55A96BF239AC0


----------



## johnb35

How's the system reacting now?

I need you to upload this file to www.virustotal.com and give me the web page link to the results.

c:\windows\explorer.exe


----------



## Motorcharge

https://www.virustotal.com/file/68d...df6fba1da0a0501eb9d83ec4/analysis/1340239932/

Been acting fine since, but it doesn't always act up so it's too early to totally tell.


----------



## johnb35

Ok, in the mean time while you are testing it out, lets get a couple other things done.

1.

Please download and run the ESET Online Scanner
Disable any antivirus/security programs.
IMPORTANT! UN-check Remove found threats 
Accept any security warnings from your browser. 
Check Scan archives 
Click Start 
ESET will then download updates, install and then start scanning your system. 
When the scan is done, push list of found threats 
Click on Export to text file , and save the file to your desktop using a file name, such as ESETlog. Include the contents of this report in your next reply. 
If no threats are found then it won't produce a log.

2.

1. Go to Start > Run > type Notepad.exe and click OK to open Notepad.
It must be Notepad, not Wordpad.
2. Copy the text in the below code box



		Code:
	

Reglock::

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]


3. Go to the Notepad window and click Edit > Paste
4. Then click File > Save
5. Name the file CFScript.txt - Save the file to your Desktop
6. Then drag the CFScript (hold the left mouse button while dragging the file) and drop it (release the left mouse button) into ComboFix.exe as you see in the screenshot below. Important: Perform this instruction carefully!







ComboFix will begin to execute, just follow the prompts.
After reboot (in case it asks to reboot), it will produce a log for you.
Post that log (Combofix.txt) in your next reply.

3.

Post a fresh hijackthis log.


Also, go into add/remove programs and uninstall any entries that relate to Spigot or Search settings.


----------



## Motorcharge

*ESETlog:*

C:\Qoobox\Quarantine\C\Users\Bre\AppData\Local\{604e7576-ec0d-7231-cc64-a8dfba4e3e1f}\n.vir	Win64/Sirefef.W trojan
C:\Qoobox\Quarantine\C\Users\Bre\AppData\Local\{604e7576-ec0d-7231-cc64-a8dfba4e3e1f}\L\80000032.@.vir	probably a variant of Win32/Sirefef.EU trojan
C:\Qoobox\Quarantine\C\Users\Bre\AppData\Local\{604e7576-ec0d-7231-cc64-a8dfba4e3e1f}\U\00000008.@.vir	Win64/Agent.BA trojan
C:\Qoobox\Quarantine\C\Users\Bre\AppData\Local\{604e7576-ec0d-7231-cc64-a8dfba4e3e1f}\U\80000000.@.vir	Win64/Sirefef.AE trojan
C:\Qoobox\Quarantine\C\Users\Bre\AppData\Local\{604e7576-ec0d-7231-cc64-a8dfba4e3e1f}\U\80000032.@.vir	probably a variant of Win32/Sirefef.EU trojan
C:\Qoobox\Quarantine\C\Users\Bre\AppData\Local\{604e7576-ec0d-7231-cc64-a8dfba4e3e1f}\U\80000064.@.vir	Win64/Sirefef.AE trojan
C:\Qoobox\Quarantine\C\Windows\assembly\GAC_32\Desktop.ini.vir	Win32/Sirefef.DN trojan
C:\Qoobox\Quarantine\C\Windows\assembly\GAC_64\Desktop.ini.vir	Win64/Sirefef.G trojan
C:\Qoobox\Quarantine\C\Windows\System32\consrv.dll.vir	Win64/Sirefef.G trojan
C:\TDSSKiller_Quarantine\20.06.2012_19.53.47\zaea0000\svc0000\tsk0000.dta	Win64/Sirefef.W trojan


----------



## johnb35

OK, those are already in quarantine so no worries there.


----------



## Motorcharge

ComboFix 12-06-20.02 - Bre 06/20/2012  21:50:59.2.4 - x64
Microsoft Windows 7 Home Premium   6.1.7601.1.1252.1.1033.18.4061.2355 [GMT -4:00]
Running from: C:\Users\Bre\Downloads\ComboFix.exe
Command switches used :: C:\Users\Bre\Desktop\CFScript.txt
SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}


(((((((((((((((((((((((((((((((((((((((   Other Deletions   )))))))))))))))))))))))))))))))))))))))))))))))))


C:\Users\Bre\AppData\Local\Temp\1.tmp\F_IN_BOX.dll


(((((((((((((((((((((((((   Files Created from 2012-05-21 to 2012-06-21  )))))))))))))))))))))))))))))))


2012-06-21 01:55:54 . 2012-06-21 01:55:54	--------	d-----w-	C:\Users\Default\AppData\Local\temp
2012-06-21 01:01:10 . 2012-06-21 01:01:10	--------	d-----w-	C:\Program Files (x86)\ESET
2012-06-20 23:54:17 . 2012-06-20 23:54:17	--------	d-----w-	C:\TDSSKiller_Quarantine
2012-06-19 00:25:45 . 2012-06-19 00:25:46	--------	d-----w-	C:\Program Files (x86)\Application Updater
2012-06-19 00:25:45 . 2012-06-19 00:25:45	--------	d-----w-	C:\Program Files (x86)\IObit Toolbar
2012-06-19 00:25:45 . 2012-06-19 00:25:45	--------	d-----w-	C:\Program Files (x86)\Common Files\Spigot
2012-06-17 21:10:03 . 2012-06-17 21:10:03	--------	d-----w-	C:\Program Files\Microsoft Silverlight
2012-06-17 21:10:03 . 2012-06-17 21:10:03	--------	d-----w-	C:\Program Files (x86)\Microsoft Silverlight
2012-06-17 19:36:58 . 2011-07-20 18:58:22	44032	----a-w-	C:\Windows\system32\drivers\RimSerial_AMD64.sys
2012-06-17 19:36:43 . 2012-06-17 19:48:57	--------	d-----w-	C:\Program Files (x86)\Common Files\Research In Motion
2012-06-17 19:36:43 . 2012-06-17 19:36:43	--------	d-----w-	C:\Program Files (x86)\Research In Motion
2012-06-12 20:50:21 . 2011-10-12 22:14:20	34624	----a-w-	C:\Windows\system32\TURegOpt.exe
2012-06-12 20:50:21 . 2011-10-12 22:14:08	25920	----a-w-	C:\Windows\system32\authuitu.dll
2012-06-12 20:50:21 . 2011-10-12 22:14:08	21312	----a-w-	C:\Windows\SysWow64\authuitu.dll
2012-06-12 20:49:41 . 2012-06-12 20:49:41	--------	d-----w-	C:\Users\Bre\AppData\Roaming\TuneUp Software
2012-06-12 20:49:33 . 2012-06-12 20:50:19	--------	d-----w-	C:\Program Files (x86)\TuneUp Utilities 2012
2012-06-12 20:49:13 . 2012-06-12 20:50:24	--------	d-----w-	C:\ProgramData\TuneUp Software
2012-06-12 20:48:59 . 2012-06-12 20:48:59	--------	d-sh--w-	C:\ProgramData\{32364CEA-7855-4A3C-B674-53D8E9B97936}
2012-06-06 14:46:38 . 2012-06-06 14:46:38	770384	----a-w-	C:\Program Files (x86)\Mozilla Firefox\msvcr100.dll
2012-06-06 14:46:38 . 2012-06-06 14:46:38	421200	----a-w-	C:\Program Files (x86)\Mozilla Firefox\msvcp100.dll
2012-06-05 19:17:59 . 2012-06-05 19:17:59	--------	d-----w-	C:\Program Files (x86)\Hobbyist Software
2012-05-30 17:59:30 . 2012-05-30 17:59:30	4966600	----a-w-	C:\Program Files (x86)\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}\components\SkypeFfComponent.dll
2012-05-24 20:48:57 . 2012-05-24 20:48:57	--------	d-----w-	C:\ProgramData\Adobe Systems
2012-05-24 20:46:41 . 2012-05-24 20:46:41	--------	d-----w-	C:\Program Files (x86)\Common Files\Adobe Systems Shared
.


((((((((((((((((((((((((((((((((((((((((   Find3M Report   ))))))))))))))))))))))))))))))))))))))))))))))))))))

2012-05-17 23:51:45 . 2012-05-17 23:51:45	283200	----a-w-	C:\Windows\system32\drivers\dtsoftbus01.sys
2012-05-17 22:50:06 . 2012-05-17 22:50:06	71680	----a-w-	C:\Windows\system32\frapsv64.dll
2012-05-17 22:50:04 . 2012-05-17 22:50:04	65536	----a-w-	C:\Windows\SysWow64\frapsvid.dll
2012-04-26 07:09:34 . 2012-04-26 07:09:34	91648	----a-w-	C:\Windows\system32\SetIEInstalledDate.exe
2012-04-26 07:09:34 . 2012-04-26 07:09:34	89088	----a-w-	C:\Windows\system32\RegisterIEPKEYs.exe
2012-04-26 07:09:34 . 2012-04-26 07:09:34	86528	----a-w-	C:\Windows\SysWow64\iesysprep.dll
2012-04-26 07:09:34 . 2012-04-26 07:09:34	85504	----a-w-	C:\Windows\system32\iesetup.dll
2012-04-26 07:09:34 . 2012-04-26 07:09:34	76800	----a-w-	C:\Windows\SysWow64\SetIEInstalledDate.exe
2012-04-26 07:09:34 . 2012-04-26 07:09:34	76800	----a-w-	C:\Windows\system32\tdc.ocx
2012-04-26 07:09:34 . 2012-04-26 07:09:34	74752	----a-w-	C:\Windows\SysWow64\RegisterIEPKEYs.exe
2012-04-26 07:09:34 . 2012-04-26 07:09:34	74752	----a-w-	C:\Windows\SysWow64\iesetup.dll
2012-04-26 07:09:34 . 2012-04-26 07:09:34	63488	----a-w-	C:\Windows\SysWow64\tdc.ocx
2012-04-26 07:09:34 . 2012-04-26 07:09:34	603648	----a-w-	C:\Windows\system32\vbscript.dll
2012-04-26 07:09:34 . 2012-04-26 07:09:34	49664	----a-w-	C:\Windows\system32\imgutil.dll
2012-04-26 07:09:34 . 2012-04-26 07:09:34	48640	----a-w-	C:\Windows\SysWow64\mshtmler.dll
2012-04-26 07:09:34 . 2012-04-26 07:09:34	48640	----a-w-	C:\Windows\system32\mshtmler.dll
2012-04-26 07:09:34 . 2012-04-26 07:09:34	448512	----a-w-	C:\Windows\system32\html.iec
2012-04-26 07:09:34 . 2012-04-26 07:09:34	420864	----a-w-	C:\Windows\SysWow64\vbscript.dll
2012-04-26 07:09:34 . 2012-04-26 07:09:34	367104	----a-w-	C:\Windows\SysWow64\html.iec
2012-04-26 07:09:34 . 2012-04-26 07:09:34	35840	----a-w-	C:\Windows\SysWow64\imgutil.dll
2012-04-26 07:09:34 . 2012-04-26 07:09:34	30720	----a-w-	C:\Windows\system32\licmgr10.dll
2012-04-26 07:09:34 . 2012-04-26 07:09:34	23552	----a-w-	C:\Windows\SysWow64\licmgr10.dll
2012-04-26 07:09:34 . 2012-04-26 07:09:34	222208	----a-w-	C:\Windows\system32\msls31.dll
2012-04-26 07:09:34 . 2012-04-26 07:09:34	173056	----a-w-	C:\Windows\system32\ieUnatt.exe
2012-04-26 07:09:34 . 2012-04-26 07:09:34	165888	----a-w-	C:\Windows\system32\iexpress.exe
2012-04-26 07:09:34 . 2012-04-26 07:09:34	161792	----a-w-	C:\Windows\SysWow64\msls31.dll
2012-04-26 07:09:34 . 2012-04-26 07:09:34	160256	----a-w-	C:\Windows\system32\wextract.exe
2012-04-26 07:09:34 . 2012-04-26 07:09:34	152064	----a-w-	C:\Windows\SysWow64\wextract.exe
2012-04-26 07:09:34 . 2012-04-26 07:09:34	150528	----a-w-	C:\Windows\SysWow64\iexpress.exe
2012-04-26 07:09:34 . 2012-04-26 07:09:34	142848	----a-w-	C:\Windows\SysWow64\ieUnatt.exe
2012-04-26 07:09:34 . 2012-04-26 07:09:34	135168	----a-w-	C:\Windows\system32\IEAdvpack.dll
2012-04-26 07:09:34 . 2012-04-26 07:09:34	12288	----a-w-	C:\Windows\system32\mshta.exe
2012-04-26 07:09:34 . 2012-04-26 07:09:34	11776	----a-w-	C:\Windows\SysWow64\mshta.exe
2012-04-26 07:09:34 . 2012-04-26 07:09:34	114176	----a-w-	C:\Windows\system32\admparse.dll
2012-04-26 07:09:34 . 2012-04-26 07:09:34	111616	----a-w-	C:\Windows\system32\iesysprep.dll
2012-04-26 07:09:34 . 2012-04-26 07:09:34	110592	----a-w-	C:\Windows\SysWow64\IEAdvpack.dll
2012-04-26 07:09:34 . 2012-04-26 07:09:34	101888	----a-w-	C:\Windows\SysWow64\admparse.dll
2012-04-25 22:44:34 . 2012-04-25 22:44:34	23112	----a-w-	C:\Windows\system32\drivers\hitmanpro35.sys
2012-04-25 22:36:56 . 2012-04-25 22:36:56	81408	----a-w-	C:\Windows\system32\imagehlp.dll
2012-04-25 22:36:56 . 2012-04-25 22:36:56	5120	----a-w-	C:\Windows\SysWow64\wmi.dll
2012-04-25 22:36:56 . 2012-04-25 22:36:56	5120	----a-w-	C:\Windows\system32\wmi.dll
2012-04-25 22:36:56 . 2012-04-25 22:36:56	23408	----a-w-	C:\Windows\system32\drivers\fs_rec.sys
2012-04-25 22:36:56 . 2012-04-25 22:36:56	220672	----a-w-	C:\Windows\system32\wintrust.dll
2012-04-25 22:36:56 . 2012-04-25 22:36:56	172544	----a-w-	C:\Windows\SysWow64\wintrust.dll
2012-04-25 22:36:56 . 2012-04-25 22:36:56	159232	----a-w-	C:\Windows\SysWow64\imagehlp.dll
2012-04-25 22:33:29 . 2012-04-25 22:33:29	9216	----a-w-	C:\Windows\system32\rdrmemptylst.exe
2012-04-25 22:33:29 . 2012-04-25 22:33:29	77312	----a-w-	C:\Windows\system32\rdpwsx.dll
2012-04-25 22:33:29 . 2012-04-25 22:33:29	149504	----a-w-	C:\Windows\system32\rdpcorekmts.dll
2012-04-25 22:32:27 . 2012-04-25 22:32:27	826880	----a-w-	C:\Windows\SysWow64\rdpcore.dll
2012-04-25 22:32:27 . 2012-04-25 22:32:27	23552	----a-w-	C:\Windows\system32\drivers\tdtcp.sys
2012-04-25 22:32:27 . 2012-04-25 22:32:27	210944	----a-w-	C:\Windows\system32\drivers\rdpwd.sys
2012-04-25 22:32:27 . 2012-04-25 22:32:27	1031680	----a-w-	C:\Windows\system32\rdpcore.dll
2012-04-25 22:27:10 . 2012-04-25 22:27:10	509952	----a-w-	C:\Windows\system32\ntshrui.dll
2012-04-25 22:27:10 . 2012-04-25 22:27:10	442880	----a-w-	C:\Windows\SysWow64\ntshrui.dll
2012-04-25 22:26:52 . 2012-04-25 22:26:52	515584	----a-w-	C:\Windows\system32\timedate.cpl
2012-04-25 22:26:52 . 2012-04-25 22:26:52	478720	----a-w-	C:\Windows\SysWow64\timedate.cpl
2012-04-25 22:26:38 . 2012-04-25 22:26:38	498688	----a-w-	C:\Windows\system32\drivers\afd.sys
2012-04-25 22:23:05 . 2012-04-25 22:23:05	690688	----a-w-	C:\Windows\SysWow64\msvcrt.dll
2012-04-25 22:23:05 . 2012-04-25 22:23:05	634880	----a-w-	C:\Windows\system32\msvcrt.dll
2012-04-25 22:21:56 . 2012-04-25 22:21:56	1731920	----a-w-	C:\Windows\system32\ntdll.dll
2012-04-25 22:21:56 . 2012-04-25 22:21:56	1292080	----a-w-	C:\Windows\SysWow64\ntdll.dll
2012-04-25 22:21:30 . 2012-04-25 22:21:30	96768	----a-w-	C:\Windows\SysWow64\sspicli.dll
2012-04-25 22:21:30 . 2012-04-25 22:21:30	95600	----a-w-	C:\Windows\system32\drivers\ksecdd.sys
2012-04-25 22:21:30 . 2012-04-25 22:21:30	459232	----a-w-	C:\Windows\system32\drivers\cng.sys
2012-04-25 22:21:30 . 2012-04-25 22:21:30	395776	----a-w-	C:\Windows\system32\webio.dll
2012-04-25 22:21:30 . 2012-04-25 22:21:30	340992	----a-w-	C:\Windows\system32\schannel.dll
2012-04-25 22:21:30 . 2012-04-25 22:21:30	314880	----a-w-	C:\Windows\SysWow64\webio.dll
2012-04-25 22:21:30 . 2012-04-25 22:21:30	31232	----a-w-	C:\Windows\system32\lsass.exe
2012-04-25 22:21:30 . 2012-04-25 22:21:30	29184	----a-w-	C:\Windows\system32\sspisrv.dll
2012-04-25 22:21:30 . 2012-04-25 22:21:30	28160	----a-w-	C:\Windows\system32\secur32.dll
2012-04-25 22:21:30 . 2012-04-25 22:21:30	224768	----a-w-	C:\Windows\SysWow64\schannel.dll
2012-04-25 22:21:30 . 2012-04-25 22:21:30	22016	----a-w-	C:\Windows\SysWow64\secur32.dll
2012-04-25 22:21:30 . 2012-04-25 22:21:30	152432	----a-w-	C:\Windows\system32\drivers\ksecpkg.sys
2012-04-25 22:21:30 . 2012-04-25 22:21:30	1447936	----a-w-	C:\Windows\system32\lsasrv.dll
2012-04-25 22:21:30 . 2012-04-25 22:21:30	136192	----a-w-	C:\Windows\system32\sspicli.dll
2012-04-25 22:21:05 . 2012-04-25 22:21:05	514560	----a-w-	C:\Windows\SysWow64\qdvd.dll
2012-04-25 22:21:05 . 2012-04-25 22:21:05	366592	----a-w-	C:\Windows\system32\qdvd.dll
2012-04-25 22:21:05 . 2012-04-25 22:21:05	1572864	----a-w-	C:\Windows\system32\quartz.dll
2012-04-25 22:21:05 . 2012-04-25 22:21:05	1328128	----a-w-	C:\Windows\SysWow64\quartz.dll
2012-04-25 22:20:37 . 2012-04-25 22:20:37	77312	----a-w-	C:\Windows\system32\packager.dll
2012-04-25 22:20:37 . 2012-04-25 22:20:37	67072	----a-w-	C:\Windows\SysWow64\packager.dll
2012-04-25 22:16:43 . 2012-04-25 22:16:43	2048	----a-w-	C:\Windows\SysWow64\tzres.dll
2012-04-25 22:16:43 . 2012-04-25 22:16:43	2048	----a-w-	C:\Windows\system32\tzres.dll
2012-04-25 22:16:17 . 2012-04-25 22:16:17	43520	----a-w-	C:\Windows\system32\csrsrv.dll
2012-04-25 22:16:00 . 2012-04-25 22:16:00	723456	----a-w-	C:\Windows\system32\EncDec.dll
2012-04-25 22:16:00 . 2012-04-25 22:16:00	534528	----a-w-	C:\Windows\SysWow64\EncDec.dll
2012-04-25 22:07:28 . 2012-04-25 22:07:28	75776	----a-w-	C:\Windows\SysWow64\psisrndr.ax
2012-04-25 22:07:28 . 2012-04-25 22:07:28	613888	----a-w-	C:\Windows\system32\psisdecd.dll
2012-04-25 22:07:28 . 2012-04-25 22:07:28	465408	----a-w-	C:\Windows\SysWow64\psisdecd.dll
2012-04-25 22:07:28 . 2012-04-25 22:07:28	108032	----a-w-	C:\Windows\system32\psisrndr.ax
2012-04-25 22:06:58 . 2012-04-25 22:06:58	861696	----a-w-	C:\Windows\system32\oleaut32.dll
2012-04-25 22:06:58 . 2012-04-25 22:06:58	571904	----a-w-	C:\Windows\SysWow64\oleaut32.dll
2012-04-25 22:06:58 . 2012-04-25 22:06:58	331776	----a-w-	C:\Windows\system32\oleacc.dll
2012-04-25 22:06:58 . 2012-04-25 22:06:58	233472	----a-w-	C:\Windows\SysWow64\oleacc.dll
2012-04-19 00:56:30 . 2012-04-19 00:56:30	94208	----a-w-	C:\Windows\SysWow64\QuickTimeVR.qtx
2012-04-19 00:56:30 . 2012-04-19 00:56:30	69632	----a-w-	C:\Windows\SysWow64\QuickTime.qts
2012-04-13 08:46:11 . 2012-04-25 07:33:21	8917360	----a-w-	C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{41CB3D6F-1963-4E87-B780-A71E76739471}\mpengine.dll
2012-04-04 19:56:40 . 2012-04-25 22:50:39	24904	----a-w-	C:\Windows\system32\drivers\mbam.sys
2012-03-31 06:05:57 . 2012-05-11 18:13:08	5559664	----a-w-	C:\Windows\system32\ntoskrnl.exe
2012-03-31 04:39:37 . 2012-05-11 18:13:06	3968368	----a-w-	C:\Windows\SysWow64\ntkrnlpa.exe


------- Sigcheck -------
Note: Unsigned files aren't necessarily malware.

[7] 2011-02-26 06:26:45 . E38899074D4951D31B4040E994DD7C8D . 2870784 . . [6.1.7600.16385 (win7_rtm.090713-1255)] .. C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20910_none_ae79ed04ac56c4a9\explorer.exe
[7] 2011-02-26 06:23:14 . 0862495E0C825893DB75EF44FAEA8E93 . 2870272 . . [6.1.7600.16385 (win7_rtm.090713-1255)] .. C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16768_none_adc24107935a7e25\explorer.exe
[7] 2011-02-26 06:14:34 . 3B69712041F3D63605529BD66DC00C48 . 2871808 . . [6.1.7600.16385 (win7_rtm.090713-1255)] .. C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.21669_none_b0333b22a99da332\explorer.exe
[7] 2011-02-25 06:19:30 . 332FEAB1435662FC6C672E25BEB37BE3 . 2871808 . . [6.1.7600.16385 (win7_rtm.090713-1255)] .. C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17567_none_afa79dc39081d0ba\explorer.exe
[7] 2010-11-20 13:24:45 . AC4C51EB24AA95B77F705AB159189E24 . 2872320 . . [6.1.7600.16385 (win7_rtm.090713-1255)] .. C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17514_none_afdaac81905bf900\explorer.exe
[7] 2009-10-31 06:38:38 . B8EC4BD49CE8F6FC457721BFC210B67F . 2870272 . . [6.1.7600.16385 (win7_rtm.090713-1255)] .. C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20563_none_ae46d6aeac7ca7c7\explorer.exe
[-] 2009-10-31 06:34:59 . D5A67267C4C3879E63E9BFBA991D823A . 2387456 . . [6.1.7600.16385 (win7_rtm.090713-1255)] .. C:\Windows\explorer.exe
[7] 2009-10-31 06:34:59 . 9AAAEC8DAC27AA17B053E6352AD233AE . 2870272 . . [6.1.7600.16385 (win7_rtm.090713-1255)] .. C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16450_none_adc508f19359a007\explorer.exe
[7] 2009-08-03 06:19:07 . 700073016DAC1C3D2E7E2CE4223334B6 . 2868224 . . [6.1.7600.16385 (win7_rtm.090713-1255)] .. C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20500_none_ae84b558ac4eb41c\explorer.exe
[7] 2009-08-03 06:17:37 . F170B4A061C9E026437B193B4D571799 . 2868224 . . [6.1.7600.16385 (win7_rtm.090713-1255)] .. C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16404_none_adff19b5932d79ae\explorer.exe
[7] 2009-07-14 01:39:10 . C235A51CB740E45FFA0EBFB9BAFCDA64 . 2868224 . . [6.1.7600.16385 (win7_rtm.090713-1255)] .. C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16385_none_ada998b9936d7566\explorer.exe

(((((((((((((((((((((((((((((   SnapShot@2012-06-21_00.09.10   )))))))))))))))))))))))))))))))))))))))))

+ 2009-07-14 05:10:35 . 2012-06-21 00:10:37	29994              C:\Windows\system32\wdi\BootPerformanceDiagnostics_SystemData.bin
+ 2011-04-20 19:48:56 . 2012-06-21 00:10:37	12686              C:\Windows\system32\wdi\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-520610219-17727062-633966983-1000_UserData.bin
+ 2012-06-21 01:57:25 . 2012-06-21 01:57:25	2048              C:\Windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
- 2012-06-21 00:08:48 . 2012-06-21 00:08:48	2048              C:\Windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
+ 2012-06-21 01:57:25 . 2012-06-21 01:57:25	2048              C:\Windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
+ 2009-07-14 04:54:17 . 2012-06-21 00:08:53	131072              C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
- 2009-07-14 04:54:17 . 2012-06-20 23:55:41	131072              C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
+ 2009-07-14 04:54:17 . 2012-06-21 00:08:53	229376              C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
- 2009-07-14 04:54:17 . 2012-06-20 23:55:41	229376              C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
- 2009-07-14 02:36:59 . 2012-06-21 00:00:23	623940              C:\Windows\system32\perfh009.dat
+ 2009-07-14 02:36:59 . 2012-06-21 00:14:17	623940              C:\Windows\system32\perfh009.dat
+ 2009-07-14 02:36:59 . 2012-06-21 00:14:17	106316              C:\Windows\system32\perfc009.dat
- 2009-07-14 02:36:59 . 2012-06-21 00:00:23	106316              C:\Windows\system32\perfc009.dat
+ 2009-07-14 05:01:48 . 2012-06-21 01:56:03	513088              C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache-System.dat
- 2009-07-14 05:01:48 . 2012-06-21 00:08:11	513088              C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache-System.dat
+ 2009-07-14 04:54:17 . 2012-06-21 00:08:53	2539520              C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
- 2009-07-14 04:54:17 . 2012-06-20 23:55:41	2539520              C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
+ 2011-09-19 10:39:14 . 2012-06-21 01:56:08	54977874              C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache-S-1-5-21-520610219-17727062-633966983-1000-12288.dat

(((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))))


*Note* empty entries & legit default entries are not shown 
REGEDIT4

[HKEY_LOCAL_MACHINE\Wow6432Node\~\Browser Helper Objects\{70dd86e8-b5bc-4e4a-9d5c-b6234c24323c}]
2011-06-24 15:04:00	81920	----a-w-	C:\Program Files (x86)\freecordertoolbar\vmntemplateX.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar]
"{70dd86e8-b5bc-4e4a-9d5c-b6234c24323c}"= "C:\Program Files (x86)\freecordertoolbar\vmntemplateX.dll" [2011-06-24 15:04:00 81920]

[HKEY_CLASSES_ROOT\clsid\{70dd86e8-b5bc-4e4a-9d5c-b6234c24323c}]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RocketDock"="C:\Program Files (x86)\RocketDock\RocketDock.exe" [2007-09-02 20:58:52 495616]
"Advanced SystemCare 5"="C:\Program Files (x86)\IObit\Advanced SystemCare 5\ASCTray.exe" [2012-05-28 19:56:36 288128]

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"BackupManagerTray"="C:\Program Files (x86)\NewTech Infosystems\Gateway MyBackup\BackupManagerTray.exe" [2009-08-12 21:58:52 244480]
"InstaLAN"="C:\Program Files (x86)\Belkin\Router Setup and Monitor\BelkinRouterMonitor.exe" [2011-02-25 02:08:32 1770400]
"SwitchBoard"="C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe" [2010-02-19 17:37:14 517096]
"AdobeCS5.5ServiceManager"="C:\Program Files (x86)\Common Files\Adobe\CS5.5ServiceManager\CS5.5ServiceManager.exe" [2011-01-12 11:08:56 1523360]
"APSDaemon"="C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2012-02-21 01:28:32 59240]
"RIMBBLaunchAgent.exe"="C:\Program Files (x86)\Common Files\Research In Motion\USB Drivers\RIMBBLaunchAgent.exe" [2011-11-02 06:00:44 90448]
"SearchSettings"="C:\Program Files (x86)\Common Files\Spigot\Search Settings\SearchSettings.exe" [2012-06-13 21:37:04 1088904]

C:\Users\Bre\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Adobe Gamma.lnk - C:\Program Files (x86)\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2005-3-16 113664]
CurseClientStartup.ccip [2011-10-9 0]
Rainmeter.lnk - C:\Program Files\Rainmeter\Rainmeter.exe [2011-9-18 102912]

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\
UltraMon.lnk - C:\Windows\Installer\{537056B7-32A4-4408-9B54-0341963C7C9C}\IcoUltraMon.ico [2011-9-18 29310]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 0 (0x0)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Security Packages	REG_MULTI_SZ   	kerberos msv1_0 schannel wdigest tspkg pku2u livessp

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\run-]
"SunJavaUpdateSched"="C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
"HP Software Update"=C:\Program Files (x86)\HP\HP Software Update\HPWuSchd2.exe
"iTunesHelper"="C:\Program Files (x86)\iTunes\iTunesHelper.exe"
"ConduitHelper"="C:\Users\Public\Conduit\ConduitHelper\ConduitHelper.exe"
"Freecorder FLV Service"="C:\Program Files (x86)\Freecorder\FLVSrvc.exe" /run
"Gateway Photo Frame"="C:\Program Files (x86)\Gateway Photo Frame\ButtonMonitor.exe" -A
"QuickTime Task"="C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime

R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 21:27:14 138576]
R2 gupdate;Google Update Service (gupdate);C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2011-09-18 22:04:08 136176]
R2 SkypeUpdate;Skype Updater;C:\Program Files (x86)\Skype\Updater\Updater.exe [2012-06-05 19:17:44 160944]
R3 BTCFilterService;USB Networking Driver Filter Service;C:\Windows\system32\DRIVERS\motfilt.sys [x]
R3 BVRPMPR5a64;BVRPMPR5a64 NDIS Protocol Driver;C:\Windows\system32\drivers\BVRPMPR5a64.SYS [x]
R3 gupdatem;Google Update Service (gupdatem);C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2011-09-18 22:04:08 136176]
R3 LGVirHid;Logitech Gamepanel Virtual HID Device Driver;C:\Windows\system32\drivers\LGVirHid.sys [x]
R3 motandroidusb;Mot ADB Interface Driver;C:\Windows\system32\Drivers\motoandroid.sys [x]
R3 motccgp;Motorola USB Composite Device Driver;C:\Windows\system32\DRIVERS\motccgp.sys [x]
R3 motccgpfl;MotCcgpFlService;C:\Windows\system32\DRIVERS\motccgpfl.sys [x]
R3 Motousbnet;Motorola USB Networking Driver Service;C:\Windows\system32\DRIVERS\Motousbnet.sys [x]
R3 MozillaMaintenance;Mozilla Maintenance Service;C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe [2012-06-16 10:21:03 113120]
R3 pbfilter;pbfilter;C:\Program Files\PeerBlock\pbfilter.sys [2010-11-07 02:24:34 24176]
R3 RTL8192su;Realtek RTL8192SU Wireless LAN 802.11n USB 2.0 Network Adapter;C:\Windows\system32\DRIVERS\RTL8192su.sys [x]
R3 SwitchBoard;Adobe SwitchBoard;C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [2010-02-19 17:37:14 517096]
R3 TsUsbFlt;TsUsbFlt;C:\Windows\system32\drivers\tsusbflt.sys [x]
R3 WatAdminSvc;Windows Activation Technologies Service;C:\Windows\system32\Wat\WatAdminSvc.exe [x]
R3 WinRing0_1_2_0;WinRing0_1_2_0;C:\Program Files (x86)\IObit\Game Booster 3\Driver\WinRing0x64.sys [2010-11-01 10:08:46 14544]
R3 WMZuneComm;Zune Windows Mobile Connectivity Service;C:\Program Files\Zune\WMZuneComm.exe [2011-08-05 16:53:12 306400]
S1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;C:\Windows\system32\DRIVERS\dtsoftbus01.sys [x]
S1 vwififlt;Virtual WiFi Filter Driver;C:\Windows\system32\DRIVERS\vwififlt.sys [x]
S2 AdvancedSystemCareService5;Advanced SystemCare Service 5;C:\Program Files (x86)\IObit\Advanced SystemCare 5\ASCService.exe [2012-05-26 16:04:52 913792]
S2 Application Updater;Application Updater;C:\Program Files (x86)\Application Updater\ApplicationUpdater.exe [2012-06-13 21:27:26 792512]
S2 cpuz135;cpuz135;C:\Windows\system32\drivers\cpuz135_x64.sys [x]
S2 Greg_Service;GRegService;C:\Program Files (x86)\Gateway\Registration\GregHSRW.exe [2009-08-28 09:38:58 1150496]
S2 NTI IScheduleSvc;NTI IScheduleSvc;C:\Program Files (x86)\NewTech Infosystems\Gateway MyBackup\IScheduleSvc.exe [2009-08-12 22:04:44 62208]
S2 Skype C2C Service;Skype C2C Service;C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe [2012-05-30 17:56:52 3048136]
S2 TuneUp.UtilitiesSvc;TuneUp Utilities Service;C:\Program Files (x86)\TuneUp Utilities 2012\TuneUpUtilitiesService64.exe [2011-10-12 22:14:14 2072896]
S2 UltraMonUtility;UltraMon Utility Driver;C:\Program Files (x86)\Common Files\Realtime Soft\UltraMonMirrorDrv\x64\UltraMonUtility.sys [2008-11-14 09:11:42 20512]
S2 Updater Service;Updater Service;C:\Program Files\Gateway\Gateway Updater\UpdaterService.exe [2009-07-04 01:47:12 240160]
S3 e1yexpress;Intel(R) Gigabit Network Connections Driver;C:\Windows\system32\DRIVERS\e1y60x64.sys [x]
S3 EuMusDesignVirtualAudioCableWdm;Virtual Audio Cable (WDM);C:\Windows\system32\DRIVERS\vrtaucbl.sys [x]
S3 IntcHdmiAddService;Intel(R) High Definition Audio HDMI;C:\Windows\system32\drivers\IntcHdmi.sys [x]
S3 LGBusEnum;Logitech GamePanel Virtual Bus Enumerator Driver;C:\Windows\system32\drivers\LGBusEnum.sys [x]
S3 ManyCam;ManyCam Virtual Webcam, WDM Video Capture Driver;C:\Windows\system32\DRIVERS\ManyCam_x64.sys [x]
S3 phaudlwr;Philips Audio Filter;C:\Windows\system32\DRIVERS\phaudlwr.sys [x]
S3 pneteth;PdaNet Broadband;C:\Windows\system32\DRIVERS\pneteth.sys [x]
S3 SPC620;Philips SPC620NC PC Camera;C:\Windows\system32\drivers\SPC620.sys [x]
S3 SPC620m;Philips SPC620NC PC Cameram;C:\Windows\system32\drivers\SPC620m.sys [x]
S3 TuneUpUtilitiesDrv;TuneUpUtilitiesDrv;C:\Program Files (x86)\TuneUp Utilities 2012\TuneUpUtilitiesDriver64.sys [2011-09-22 17:08:26 11856]


[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\svchost]
hpdevmgmt	REG_MULTI_SZ   	hpqcxs08 hpqddsvc

Contents of the 'Scheduled Tasks' folder

2012-06-21 C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
- C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2011-09-18 22:04:09 . 2011-09-18 22:04:08]

2012-06-21 C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
- C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2011-09-18 22:04:09 . 2011-09-18 22:04:08]


--------- X64 Entries -----------


[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IAAnotif"="C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\iaanotif.exe" [2009-06-05 02:03:32 186904]
"RtHDVCpl"="C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe" [2009-07-20 11:23:26 7981088]
"Launch LCore"="C:\Program Files\Logitech Gaming Software\LCore.exe" [2011-07-28 20:25:56 110360]
"IgfxTray"="C:\Windows\system32\igfxtray.exe" [2011-02-12 02:25:56 162328]
"HotKeysCmds"="C:\Windows\system32\hkcmd.exe" [2011-02-12 02:25:38 386584]
"Persistence"="C:\Windows\system32\igfxpers.exe" [2011-02-12 02:25:46 417304]
"AdobeAAMUpdater-1.0"="C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe" [2011-03-15 21:42:18 499608]

------- Supplementary Scan -------

uLocal Page = C:\Windows\system32\blank.htm
mStart Page = hxxp://homepage.gateway.com/rdr.aspx?b=ACGW&l=0409&m=sx2800&r=173604117307p0358v115k49i15222
mLocal Page = C:\Windows\SysWOW64\blank.htm
uInternet Settings,ProxyOverride = *.local
IE: E&xport to Microsoft Excel - C:\PROGRA~2\MICROS~1\Office12\EXCEL.EXE/3000
IE: Google Sidewiki... - C:\Program Files (x86)\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_D183CA64F05FDD98.dll/cmsidewiki.html
TCP: DhcpNameServer = 192.168.2.1
FF - ProfilePath - C:\Users\Bre\AppData\Roaming\Mozilla\Firefox\Profiles\y7r4no5l.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://www.facebook.com/
FF - prefs.js: keyword.URL - hxxp://www.google.co.in/search?btnG=Google+Search&q=

- - - - ORPHANS REMOVED - - - -

Toolbar-Locked - (no file)
Toolbar-{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc} - (no file)
Toolbar-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file)


----------



## Motorcharge

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 10:04:29 PM, on 6/20/2012
Platform: Windows 7 SP1 (WinNT 6.00.3505)
MSIE: Internet Explorer v9.00 (9.00.8112.16421)
Boot mode: Normal

Running processes:
C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAAnotif.exe
C:\Program Files (x86)\RocketDock\RocketDock.exe
C:\Program Files (x86)\IObit\Advanced SystemCare 5\ASCTray.exe
C:\Program Files (x86)\NewTech Infosystems\Gateway MyBackup\BackupManagerTray.exe
C:\Program Files (x86)\Belkin\Router Setup and Monitor\BelkinRouterMonitor.exe
C:\Program Files (x86)\Common Files\Research In Motion\USB Drivers\RIMBBLaunchAgent.exe
C:\Program Files (x86)\Belkin\Router Setup and Monitor\BelkinSetup.exe
C:\Program Files (x86)\Common Files\Spigot\Search Settings\SearchSettings.exe
C:\Program Files (x86)\Mozilla Firefox\firefox.exe
C:\Program Files (x86)\Common Files\Realtime Soft\RTSHookInterop\x32\RTSHookInterop.exe
C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe
C:\Users\Bre\Downloads\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://homepage.gateway.com/rdr.aspx?b=ACGW&l=0409&m=sx2800&r=173604117307p0358v115k49i15222
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = 
O2 - BHO: HP Print Enhancer - {0347C33E-8762-4905-BF09-768834316C61} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Freecorder Toolbar - {70dd86e8-b5bc-4e4a-9d5c-b6234c24323c} - C:\Program Files (x86)\freecordertoolbar\vmntemplateX.dll
O2 - BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: SkypeIEPluginBHO - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll
O2 - BHO: HP Smart BHO Class - {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll
O3 - Toolbar: (no name) - {bf7380fa-e3b4-4db2-af3e-9d8783a45bfc} - (no file)
O3 - Toolbar: (no name) - {D4027C7F-154A-4066-A1AD-4243D8127440} - (no file)
O3 - Toolbar: Freecorder Toolbar - {70dd86e8-b5bc-4e4a-9d5c-b6234c24323c} - C:\Program Files (x86)\freecordertoolbar\vmntemplateX.dll
O4 - HKLM\..\Run: [BackupManagerTray] "C:\Program Files (x86)\NewTech Infosystems\Gateway MyBackup\BackupManagerTray.exe" -h -k
O4 - HKLM\..\Run: [InstaLAN] "C:\Program Files (x86)\Belkin\Router Setup and Monitor\BelkinRouterMonitor.exe" startup
O4 - HKLM\..\Run: [SwitchBoard] C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe
O4 - HKLM\..\Run: [AdobeCS5.5ServiceManager] "C:\Program Files (x86)\Common Files\Adobe\CS5.5ServiceManager\CS5.5ServiceManager.exe" -launchedbylogin
O4 - HKLM\..\Run: [APSDaemon] "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe"
O4 - HKLM\..\Run: [RIMBBLaunchAgent.exe] C:\Program Files (x86)\Common Files\Research In Motion\USB Drivers\RIMBBLaunchAgent.exe
O4 - HKLM\..\Run: [SearchSettings] "C:\Program Files (x86)\Common Files\Spigot\Search Settings\SearchSettings.exe"
O4 - HKCU\..\Run: [RocketDock] "C:\Program Files (x86)\RocketDock\RocketDock.exe"
O4 - HKCU\..\Run: [Advanced SystemCare 5] "C:\Program Files (x86)\IObit\Advanced SystemCare 5\ASCTray.exe" /AutoStart
O4 - Startup: Adobe Gamma.lnk = C:\Program Files (x86)\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Startup: CurseClientStartup.ccip
O4 - Startup: Rainmeter.lnk = C:\Program Files\Rainmeter\Rainmeter.exe
O4 - Global Startup: UltraMon.lnk = ?
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~2\MICROS~1\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Google Sidewiki... - res://C:\Program Files (x86)\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_D183CA64F05FDD98.dll/cmsidewiki.html
O9 - Extra button: @C:\Program Files (x86)\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1004 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: @C:\Program Files (x86)\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1003 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~1\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~1\Office12\ONBttnIE.dll
O9 - Extra button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O9 - Extra 'Tools' menuitem: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~2\MICROS~1\Office12\REFIEBAR.DLL
O9 - Extra button: Show or hide HP Smart Web Printing - {DDE87865-83C5-48c4-8357-2F5B1AA84522} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll
O10 - Broken Internet access because of LSP provider 'c:\windows\system32\nwprovau.dll' missing
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O18 - Protocol: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL
O18 - Protocol: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files (x86)\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files (x86)\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Advanced SystemCare Service 5 (AdvancedSystemCareService5) - IObit - C:\Program Files (x86)\IObit\Advanced SystemCare 5\ASCService.exe
O23 - Service: AffinegyService - Affinegy, Inc. - C:\Program Files (x86)\Belkin\Router Setup and Monitor\BelkinService.exe
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
O23 - Service: Application Updater - Spigot, Inc. - C:\Program Files (x86)\Application Updater\ApplicationUpdater.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing)
O23 - Service: GRegService (Greg_Service) - Acer Incorporated - C:\Program Files (x86)\Gateway\Registration\GregHSRW.exe
O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: Google Update Service (gupdatem) (gupdatem) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAANTMon.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Mozilla Maintenance Service (MozillaMaintenance) - Mozilla Foundation - C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)
O23 - Service: NTI IScheduleSvc - NewTech Infosystems, Inc. - C:\Program Files (x86)\NewTech Infosystems\Gateway MyBackup\IScheduleSvc.exe
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Skype C2C Service - Skype Technologies S.A. - C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe
O23 - Service: Skype Updater (SkypeUpdate) - Skype Technologies - C:\Program Files (x86)\Skype\Updater\Updater.exe
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing)
O23 - Service: Adobe SwitchBoard (SwitchBoard) - Adobe Systems Incorporated - C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe
O23 - Service: TuneUp Utilities Service (TuneUp.UtilitiesSvc) - TuneUp Software - C:\Program Files (x86)\TuneUp Utilities 2012\TuneUpUtilitiesService64.exe
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)
O23 - Service: Updater Service - Acer - C:\Program Files\Gateway\Gateway Updater\UpdaterService.exe
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\Wat\WatUX.exe,-601 (WatAdminSvc) - Unknown owner - C:\Windows\system32\Wat\WatAdminSvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)

--
End of file - 11043 bytes


----------



## johnb35

I still see certain entries in your log.  Please navigate to C:\Qoobox and in that folder will be a file named add-remove programs.txt  Open that file and copy and paste the contents of it back here.


----------



## Motorcharge

Update for Microsoft Office 2007 (KB2508958)
µTorrent
4500_G510gm_Help
4500G510gm
4500G510gm_Software_Min
Acrobat.com
Adobe AIR
Adobe Bridge 1.0
Adobe Common File Installer
Adobe Community Help
Adobe Flash Player 10 ActiveX
Adobe Flash Player 10 Plugin
Adobe Help Center 1.0
Adobe Media Player
Adobe Photoshop CS2
Adobe Photoshop CS5.1
Adobe Reader 9.1 MUI
Adobe Stock Photos 1.0
Advanced SystemCare 5
Advertising Center
Aiseesoft FLV to MP3 Converter 6.2.16
Apple Application Support
Apple Software Update
Backup Manager Advance
Belkin Setup and Router Monitor
Belkin USB Wireless Adaptor
BlackBerry USB and Modem Drivers 7.0
BlackBerry v4.2.2 for the 8320 Series Wireless Handheld
BufferChm
Camtasia Studio 7
Compatibility Pack for the 2007 Office system
Counter-Strike: Source
Curse Client
D3DX10
DAEMON Tools Lite
Destinations
DeviceDiscovery
Diablo III
DocMgr
DocProc
ESET Online Scanner v3
Fallout
Fax
FLV To MP3 Converter V3.0.4
Fraps (remove only)
Free FLAC to MP3 Converter 1.0
Free FLV Converter V 7.2.0
Freecorder 5
Freecorder Toolbar
Game Booster 3
Gateway InfoCentre
Gateway MyBackup
Gateway Photo Frame 4.2.3.10
Gateway Recovery Management
Gateway Registration
Gateway ScreenSaver
Gateway Updater
Google Chrome
Google Update Helper
GPBaseService2
HP Update
HPProductAssistant
HPSSupply
Identity Card
ImageShack Uploader 2.2.0
ImagXpress
IObit Toolbar v5.9
Java Auto Updater
Java(TM) 6 Update 26
Joli OS
Junk Mail filter update
K-Lite Codec Pack 7.8.0 (Basic)
KENWOOD Music Editor Light
Launchpad Enhanced
Malwarebytes Anti-Malware version 1.61.0.1400
ManyCam 2.6.55 (remove only)
MarketResearch
Microsoft Office 2007 Service Pack 3 (SP3)
Microsoft Office Excel MUI (English) 2007
Microsoft Office File Validation Add-In
Microsoft Office Home and Student 2007
Microsoft Office OneNote MUI (English) 2007
Microsoft Office PowerPoint MUI (English) 2007
Microsoft Office PowerPoint Viewer 2007 (English)
Microsoft Office Proof (English) 2007
Microsoft Office Proof (French) 2007
Microsoft Office Proof (Spanish) 2007
Microsoft Office Proofing (English) 2007
Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
Microsoft Office Shared MUI (English) 2007
Microsoft Office Shared Setup Metadata MUI (English) 2007
Microsoft Office Suite Activation Assistant
Microsoft Office Word MUI (English) 2007
Microsoft SQL Server 2005 Compact Edition [ENU]
Microsoft Visual C++ 2005 Redistributable
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
Microsoft Works
Microsoft_VC80_ATL_x86
Microsoft_VC80_CRT_x86
Microsoft_VC80_MFC_x86
Microsoft_VC80_MFCLOC_x86
Microsoft_VC90_ATL_x86
Microsoft_VC90_CRT_x86
Microsoft_VC90_MFC_x86
Microsoft_VC90_MFCLOC_x86
Minecraft Cracked
Mozilla Firefox 13.0.1 (x86 en-US)
Mozilla Maintenance Service
MSVCRT
MSVCRT_amd64
MSXML 4.0 SP2 (KB954430)
MSXML 4.0 SP2 (KB973688)
Nero DriveSpeed
Nero Express Help
Nero InfoTool
Nero Installer
Nero StartSmart
Nero StartSmart OEM
neroxml
Opera 11.61
PdaNet for Android 3.02
PDF Settings CS5
Philips SPC620NC Webcam
Plants vs. Zombies
puzzle.watype.net/jigsawlite
QuickTime
Rainmeter
Realtek High Definition Audio Driver
RocketDock 1.3.5
Scan
Screenshot It Enabler
Security Update for Microsoft .NET Framework 4 Client Profile (KB2478663)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2518870)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2539636)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2572078)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2604121)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2633870)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2656351)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2656368)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2656405)
Security Update for Microsoft Office 2007 suites (KB2596672) 32-Bit Edition 
Security Update for Microsoft Office 2007 suites (KB2596785) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2596792) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2596871) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2596880) 32-Bit Edition 
Security Update for Microsoft Office 2007 suites (KB2597162) 32-Bit Edition 
Security Update for Microsoft Office 2007 suites (KB2597969) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2598041) 32-Bit Edition
Security Update for Microsoft Office Excel 2007 (KB2597161) 32-Bit Edition 
Security Update for Microsoft Office PowerPoint 2007 (KB2596764) 32-Bit Edition
Security Update for Microsoft Office PowerPoint 2007 (KB2596912) 32-Bit Edition
Security Update for Microsoft Office Word 2007 (KB2596917) 32-Bit Edition 
Sibelius 7 OpenType Fonts
Skype Click to Call
Skype™ 5.9
SmartWebPrinting
SolutionCenter
SoulSeek 157 NS 13e
Star Wars Galaxies
Status
Steam
System Requirements Lab CYRI
Toolbox
TrayApp
TuneUp Utilities 2012
TuneUp Utilities Language Pack (en-US)
Update for 2007 Microsoft Office System (KB967642)
Update for Microsoft .NET Framework 4 Client Profile (KB2468871)
Update for Microsoft .NET Framework 4 Client Profile (KB2533523)
Update for Microsoft .NET Framework 4 Client Profile (KB2600217)
Update for Microsoft Office 2007 Help for Common Features (KB963673)
Update for Microsoft Office Excel 2007 Help (KB963678)
Update for Microsoft Office OneNote 2007 Help (KB963670)
Update for Microsoft Office Powerpoint 2007 Help (KB963669)
Update for Microsoft Office Script Editor Help (KB963671)
Update for Microsoft Office Word 2007 Help (KB963665)
VLC media player 2.0.1
VLC Setup Helper
WebReg
Winamp
Winamp Detector Plug-in
Windows Live Communications Platform
Windows Live Essentials
Windows Live Installer
Windows Live Mail
Windows Live Messenger
Windows Live Movie Maker
Windows Live Photo Common
Windows Live Photo Gallery
Windows Live PIMT Platform
Windows Live SOXE
Windows Live SOXE Definitions
Windows Live Sync
Windows Live UX Platform
Windows Live UX Platform Language Pack
Windows Live Writer
Windows Live Writer Resources
Windows Remote Service
World of Warcraft
World of Warcraft Public Test
Zune Explorer Enabler


----------



## johnb35

Please uninstall the following.

µTorrent - Your discretion of course. 
Advertising Center
Java Auto Updater
Java(TM) 6 Update 26
MarketResearch
TuneUp Utilities 2012 - Your discretion but highly recommended to uninstall it as its not needed.  
TuneUp Utilities Language Pack (en-US)


Then download the latest version of java here.

www.java.com


----------



## Motorcharge

Removed most of it. I'm assuming the issue is taken care of because it hasn't acted up since last night.


----------



## johnb35

Thats a good sign.  Let me know if it comes back.  You would be surprised what the smallest little malware will do to a system.


----------



## Motorcharge

First time I've had trouble finding it on my system in at least 5 years lol


----------



## Motorcharge

New issue, not sure if it's related, but if it's not it's odd timing. Anyway I'm getting Adobe flash player installer pop ups every 30 minutes or so. 15-20 of them will pop up overnight. I'm also getting occasional pop ups in new tabs (firefox) for womenshealthbase.com and redirects about half the time I click links after a Google search. The pic below is what pops up.






Same as before, scanned in regular and safemode and nothing came up.


----------



## johnb35

Run tdsskiller since you are having redirects.  Download and run the flash player uninstaller and then install the latest version of flash.

http://helpx.adobe.com/flash-player...n_Download_the_Adobe_Flash_Player_uninstaller

If tdsskiller doesn't find anything then run goored fix.

Please download Gooredfix to your desktop from *here* or *here*


Ensure all Firefox windows are closed. 
To run the tool, double-click it (XP), or right-click and select Run As Administrator (Vista/Win 7). 
When prompted to run the scan, click Yes. 
GooredFix will check for infections, and then a log will appear. 
Please copy and paste  the Goored.txt log in your next reply (it can be found on your desktop).


----------



## Motorcharge

I've already totally uninstalled and reinstalled it already. Working on the other stuff now.


----------



## Motorcharge

Went ahead and tried the second program first.

GooredFix by jpshortstuff (03.07.10.1)
Log created at 20:54 on 24/06/2012 (Bre)
Firefox version 13.0.1 (en-US)

========== GooredScan ==========

(none)

========== GooredLog ==========

C:\Program Files (x86)\Mozilla Firefox\extensions\
{972ce4c6-7e08-4474-a285-3208198ce6fd} [21:51 18/09/2011]

C:\Users\Bre\Application Data\Mozilla\Firefox\Profiles\y7r4no5l.default\extensions\
(none)

[HKEY_LOCAL_MACHINE\Software\Mozilla\Firefox\Extensions]
"smartwebprinting@hp.com"="C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3" [16:07 22/10/2011]

---------- Old Logs ----------
GooredFix[00.54.29_25-06-2012].txt

-=E.O.F=-


----------



## johnb35

Nothing on that one.  Run tdsskiller.


----------



## Motorcharge

Ran the first and nothing as well.


----------



## Motorcharge

The initial problem is happening again as well. It's far less often though.


----------



## johnb35

Then run combofix again.  Redownload the latest version from the original link I gave you.


----------



## Motorcharge

Where does it store the logs? Just ran it and it instantly restarted my comp after about 45 seconds without warning. Not sure if it ran or not since it didn't come back up after the comp came back on.


----------



## johnb35

Combofix takes at least 10 minutes or so to run.  If it rebooted your system, it may have found a rootkit but would start right back up.  Try running it again and watch to see what happens.


----------



## Motorcharge

ComboFix 12-06-24.03 - Bre 06/24/2012  21:19:31.3.4 - x64
Microsoft Windows 7 Home Premium   6.1.7601.1.1252.1.1033.18.4061.2591 [GMT -4:00]
Running from: c:\users\Bre\Downloads\ComboFix.exe
SP: Windows Defender *Enabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
(((((((((((((((((((((((((((((((((((((((   Other Deletions   )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\users\Bre\AppData\Local\{604e7576-ec0d-7231-cc64-a8dfba4e3e1f}\@
c:\users\Bre\AppData\Local\{604e7576-ec0d-7231-cc64-a8dfba4e3e1f}\n
c:\users\Bre\AppData\Local\Temp\1.tmp\F_IN_BOX.dll
c:\windows\assembly\GAC_32\Desktop.ini
c:\windows\assembly\GAC_64\Desktop.ini
c:\windows\Installer\{604e7576-ec0d-7231-cc64-a8dfba4e3e1f}\@
c:\windows\Installer\{604e7576-ec0d-7231-cc64-a8dfba4e3e1f}\L\00000004.@
c:\windows\Installer\{604e7576-ec0d-7231-cc64-a8dfba4e3e1f}\L\201d3dde
c:\windows\Installer\{604e7576-ec0d-7231-cc64-a8dfba4e3e1f}\L\55490ac4
c:\windows\Installer\{604e7576-ec0d-7231-cc64-a8dfba4e3e1f}\n
c:\windows\Installer\{604e7576-ec0d-7231-cc64-a8dfba4e3e1f}\U\00000004.@
c:\windows\Installer\{604e7576-ec0d-7231-cc64-a8dfba4e3e1f}\U\00000008.@
c:\windows\Installer\{604e7576-ec0d-7231-cc64-a8dfba4e3e1f}\U\000000cb.@
c:\windows\Installer\{604e7576-ec0d-7231-cc64-a8dfba4e3e1f}\U\80000000.@
c:\windows\Installer\{604e7576-ec0d-7231-cc64-a8dfba4e3e1f}\U\80000032.@
c:\windows\Installer\{604e7576-ec0d-7231-cc64-a8dfba4e3e1f}\U\80000064.@
.
---- Previous Run -------
.
c:\users\Bre\AppData\Local\Temp\1.tmp\F_IN_BOX.dll
.
Infected copy of c:\windows\system32\services.exe was found and disinfected 
Restored copy from - c:\windows\erdnt\cache64\services.exe 
.
.
(((((((((((((((((((((((((   Files Created from 2012-05-25 to 2012-06-25  )))))))))))))))))))))))))))))))
.
.
2012-06-25 01:24 . 2012-06-25 01:24	--------	d-----w-	c:\users\Default\AppData\Local\temp
2012-06-24 21:47 . 2012-06-24 21:47	--------	d-----w-	c:\users\Bre\AppData\Local\Macromedia
2012-06-24 21:45 . 2012-06-24 21:45	--------	d-----w-	c:\programdata\McAfee
2012-06-24 21:45 . 2012-06-24 21:45	70344	----a-w-	c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2012-06-24 21:45 . 2012-06-24 21:45	426184	----a-w-	c:\windows\SysWow64\FlashPlayerApp.exe
2012-06-23 12:12 . 2012-06-23 12:12	--------	d-sh--w-	c:\windows\SysWow64\%APPDATA%
2012-06-21 01:01 . 2012-06-21 01:01	--------	d-----w-	c:\program files (x86)\ESET
2012-06-20 23:54 . 2012-06-20 23:54	--------	d-----w-	C:\TDSSKiller_Quarantine
2012-06-17 21:10 . 2012-06-17 21:10	--------	d-----w-	c:\program files\Microsoft Silverlight
2012-06-17 21:10 . 2012-06-17 21:10	--------	d-----w-	c:\program files (x86)\Microsoft Silverlight
2012-06-17 19:36 . 2011-07-20 18:58	44032	----a-w-	c:\windows\system32\drivers\RimSerial_AMD64.sys
2012-06-17 19:36 . 2012-06-24 13:47	--------	d-----w-	c:\program files (x86)\Common Files\Research In Motion
2012-06-12 20:49 . 2012-06-12 20:49	--------	d-----w-	c:\users\Bre\AppData\Roaming\TuneUp Software
2012-06-12 20:49 . 2012-06-12 20:50	--------	d-----w-	c:\program files (x86)\TuneUp Utilities 2012
2012-06-12 20:49 . 2012-06-12 20:50	--------	d-----w-	c:\programdata\TuneUp Software
2012-06-12 20:48 . 2012-06-12 20:48	--------	d-sh--w-	c:\programdata\{32364CEA-7855-4A3C-B674-53D8E9B97936}
2012-06-06 14:46 . 2012-06-06 14:46	770384	----a-w-	c:\program files (x86)\Mozilla Firefox\msvcr100.dll
2012-06-06 14:46 . 2012-06-06 14:46	421200	----a-w-	c:\program files (x86)\Mozilla Firefox\msvcp100.dll
2012-06-05 19:17 . 2012-06-05 19:17	--------	d-----w-	c:\program files (x86)\Hobbyist Software
.
.
.
((((((((((((((((((((((((((((((((((((((((   Find3M Report   ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-05-17 23:51 . 2012-05-17 23:51	283200	----a-w-	c:\windows\system32\drivers\dtsoftbus01.sys
2012-05-17 22:50 . 2012-05-17 22:50	71680	----a-w-	c:\windows\system32\frapsv64.dll
2012-05-17 22:50 . 2012-05-17 22:50	65536	----a-w-	c:\windows\SysWow64\frapsvid.dll
2012-04-26 07:09 . 2012-04-26 07:09	91648	----a-w-	c:\windows\system32\SetIEInstalledDate.exe
2012-04-26 07:09 . 2012-04-26 07:09	89088	----a-w-	c:\windows\system32\RegisterIEPKEYs.exe
2012-04-26 07:09 . 2012-04-26 07:09	86528	----a-w-	c:\windows\SysWow64\iesysprep.dll
2012-04-26 07:09 . 2012-04-26 07:09	85504	----a-w-	c:\windows\system32\iesetup.dll
2012-04-26 07:09 . 2012-04-26 07:09	76800	----a-w-	c:\windows\SysWow64\SetIEInstalledDate.exe
2012-04-26 07:09 . 2012-04-26 07:09	76800	----a-w-	c:\windows\system32\tdc.ocx
2012-04-26 07:09 . 2012-04-26 07:09	74752	----a-w-	c:\windows\SysWow64\RegisterIEPKEYs.exe
2012-04-26 07:09 . 2012-04-26 07:09	74752	----a-w-	c:\windows\SysWow64\iesetup.dll
2012-04-26 07:09 . 2012-04-26 07:09	63488	----a-w-	c:\windows\SysWow64\tdc.ocx
2012-04-26 07:09 . 2012-04-26 07:09	603648	----a-w-	c:\windows\system32\vbscript.dll
2012-04-26 07:09 . 2012-04-26 07:09	49664	----a-w-	c:\windows\system32\imgutil.dll
2012-04-26 07:09 . 2012-04-26 07:09	48640	----a-w-	c:\windows\SysWow64\mshtmler.dll
2012-04-26 07:09 . 2012-04-26 07:09	48640	----a-w-	c:\windows\system32\mshtmler.dll
2012-04-26 07:09 . 2012-04-26 07:09	448512	----a-w-	c:\windows\system32\html.iec
2012-04-26 07:09 . 2012-04-26 07:09	420864	----a-w-	c:\windows\SysWow64\vbscript.dll
2012-04-26 07:09 . 2012-04-26 07:09	367104	----a-w-	c:\windows\SysWow64\html.iec
2012-04-26 07:09 . 2012-04-26 07:09	35840	----a-w-	c:\windows\SysWow64\imgutil.dll
2012-04-26 07:09 . 2012-04-26 07:09	30720	----a-w-	c:\windows\system32\licmgr10.dll
2012-04-26 07:09 . 2012-04-26 07:09	23552	----a-w-	c:\windows\SysWow64\licmgr10.dll
2012-04-26 07:09 . 2012-04-26 07:09	222208	----a-w-	c:\windows\system32\msls31.dll
2012-04-26 07:09 . 2012-04-26 07:09	173056	----a-w-	c:\windows\system32\ieUnatt.exe
2012-04-26 07:09 . 2012-04-26 07:09	165888	----a-w-	c:\windows\system32\iexpress.exe
2012-04-26 07:09 . 2012-04-26 07:09	161792	----a-w-	c:\windows\SysWow64\msls31.dll
2012-04-26 07:09 . 2012-04-26 07:09	160256	----a-w-	c:\windows\system32\wextract.exe
2012-04-26 07:09 . 2012-04-26 07:09	152064	----a-w-	c:\windows\SysWow64\wextract.exe
2012-04-26 07:09 . 2012-04-26 07:09	150528	----a-w-	c:\windows\SysWow64\iexpress.exe
2012-04-26 07:09 . 2012-04-26 07:09	142848	----a-w-	c:\windows\SysWow64\ieUnatt.exe
2012-04-26 07:09 . 2012-04-26 07:09	135168	----a-w-	c:\windows\system32\IEAdvpack.dll
2012-04-26 07:09 . 2012-04-26 07:09	12288	----a-w-	c:\windows\system32\mshta.exe
2012-04-26 07:09 . 2012-04-26 07:09	11776	----a-w-	c:\windows\SysWow64\mshta.exe
2012-04-26 07:09 . 2012-04-26 07:09	114176	----a-w-	c:\windows\system32\admparse.dll
2012-04-26 07:09 . 2012-04-26 07:09	111616	----a-w-	c:\windows\system32\iesysprep.dll
2012-04-26 07:09 . 2012-04-26 07:09	110592	----a-w-	c:\windows\SysWow64\IEAdvpack.dll
2012-04-26 07:09 . 2012-04-26 07:09	101888	----a-w-	c:\windows\SysWow64\admparse.dll
2012-04-25 22:44 . 2012-04-25 22:44	23112	----a-w-	c:\windows\system32\drivers\hitmanpro35.sys
2012-04-25 22:36 . 2012-04-25 22:36	81408	----a-w-	c:\windows\system32\imagehlp.dll
2012-04-25 22:36 . 2012-04-25 22:36	5120	----a-w-	c:\windows\SysWow64\wmi.dll
2012-04-25 22:36 . 2012-04-25 22:36	5120	----a-w-	c:\windows\system32\wmi.dll
2012-04-25 22:36 . 2012-04-25 22:36	23408	----a-w-	c:\windows\system32\drivers\fs_rec.sys
2012-04-25 22:36 . 2012-04-25 22:36	220672	----a-w-	c:\windows\system32\wintrust.dll
2012-04-25 22:36 . 2012-04-25 22:36	172544	----a-w-	c:\windows\SysWow64\wintrust.dll
2012-04-25 22:36 . 2012-04-25 22:36	159232	----a-w-	c:\windows\SysWow64\imagehlp.dll
2012-04-25 22:33 . 2012-04-25 22:33	9216	----a-w-	c:\windows\system32\rdrmemptylst.exe
2012-04-25 22:33 . 2012-04-25 22:33	77312	----a-w-	c:\windows\system32\rdpwsx.dll
2012-04-25 22:33 . 2012-04-25 22:33	149504	----a-w-	c:\windows\system32\rdpcorekmts.dll
2012-04-25 22:32 . 2012-04-25 22:32	826880	----a-w-	c:\windows\SysWow64\rdpcore.dll
2012-04-25 22:32 . 2012-04-25 22:32	23552	----a-w-	c:\windows\system32\drivers\tdtcp.sys
2012-04-25 22:32 . 2012-04-25 22:32	210944	----a-w-	c:\windows\system32\drivers\rdpwd.sys
2012-04-25 22:32 . 2012-04-25 22:32	1031680	----a-w-	c:\windows\system32\rdpcore.dll
2012-04-25 22:27 . 2012-04-25 22:27	509952	----a-w-	c:\windows\system32\ntshrui.dll
2012-04-25 22:27 . 2012-04-25 22:27	442880	----a-w-	c:\windows\SysWow64\ntshrui.dll
2012-04-25 22:26 . 2012-04-25 22:26	515584	----a-w-	c:\windows\system32\timedate.cpl
2012-04-25 22:26 . 2012-04-25 22:26	478720	----a-w-	c:\windows\SysWow64\timedate.cpl
2012-04-25 22:26 . 2012-04-25 22:26	498688	----a-w-	c:\windows\system32\drivers\afd.sys
2012-04-25 22:23 . 2012-04-25 22:23	690688	----a-w-	c:\windows\SysWow64\msvcrt.dll
2012-04-25 22:23 . 2012-04-25 22:23	634880	----a-w-	c:\windows\system32\msvcrt.dll
2012-04-25 22:21 . 2012-04-25 22:21	1731920	----a-w-	c:\windows\system32\ntdll.dll
2012-04-25 22:21 . 2012-04-25 22:21	1292080	----a-w-	c:\windows\SysWow64\ntdll.dll
2012-04-25 22:21 . 2012-04-25 22:21	96768	----a-w-	c:\windows\SysWow64\sspicli.dll
2012-04-25 22:21 . 2012-04-25 22:21	95600	----a-w-	c:\windows\system32\drivers\ksecdd.sys
2012-04-25 22:21 . 2012-04-25 22:21	459232	----a-w-	c:\windows\system32\drivers\cng.sys
2012-04-25 22:21 . 2012-04-25 22:21	395776	----a-w-	c:\windows\system32\webio.dll
2012-04-25 22:21 . 2012-04-25 22:21	340992	----a-w-	c:\windows\system32\schannel.dll
2012-04-25 22:21 . 2012-04-25 22:21	314880	----a-w-	c:\windows\SysWow64\webio.dll
2012-04-25 22:21 . 2012-04-25 22:21	31232	----a-w-	c:\windows\system32\lsass.exe
2012-04-25 22:21 . 2012-04-25 22:21	29184	----a-w-	c:\windows\system32\sspisrv.dll
2012-04-25 22:21 . 2012-04-25 22:21	28160	----a-w-	c:\windows\system32\secur32.dll
2012-04-25 22:21 . 2012-04-25 22:21	224768	----a-w-	c:\windows\SysWow64\schannel.dll
2012-04-25 22:21 . 2012-04-25 22:21	22016	----a-w-	c:\windows\SysWow64\secur32.dll
2012-04-25 22:21 . 2012-04-25 22:21	152432	----a-w-	c:\windows\system32\drivers\ksecpkg.sys
2012-04-25 22:21 . 2012-04-25 22:21	1447936	----a-w-	c:\windows\system32\lsasrv.dll
2012-04-25 22:21 . 2012-04-25 22:21	136192	----a-w-	c:\windows\system32\sspicli.dll
2012-04-25 22:21 . 2012-04-25 22:21	514560	----a-w-	c:\windows\SysWow64\qdvd.dll
2012-04-25 22:21 . 2012-04-25 22:21	366592	----a-w-	c:\windows\system32\qdvd.dll
2012-04-25 22:21 . 2012-04-25 22:21	1572864	----a-w-	c:\windows\system32\quartz.dll
2012-04-25 22:21 . 2012-04-25 22:21	1328128	----a-w-	c:\windows\SysWow64\quartz.dll
2012-04-25 22:20 . 2012-04-25 22:20	77312	----a-w-	c:\windows\system32\packager.dll
2012-04-25 22:20 . 2012-04-25 22:20	67072	----a-w-	c:\windows\SysWow64\packager.dll
2012-04-25 22:16 . 2012-04-25 22:16	2048	----a-w-	c:\windows\SysWow64\tzres.dll
2012-04-25 22:16 . 2012-04-25 22:16	2048	----a-w-	c:\windows\system32\tzres.dll
2012-04-25 22:16 . 2012-04-25 22:16	43520	----a-w-	c:\windows\system32\csrsrv.dll
2012-04-25 22:16 . 2012-04-25 22:16	723456	----a-w-	c:\windows\system32\EncDec.dll
2012-04-25 22:16 . 2012-04-25 22:16	534528	----a-w-	c:\windows\SysWow64\EncDec.dll
2012-04-25 22:07 . 2012-04-25 22:07	75776	----a-w-	c:\windows\SysWow64\psisrndr.ax
2012-04-25 22:07 . 2012-04-25 22:07	613888	----a-w-	c:\windows\system32\psisdecd.dll
2012-04-25 22:07 . 2012-04-25 22:07	465408	----a-w-	c:\windows\SysWow64\psisdecd.dll
2012-04-25 22:07 . 2012-04-25 22:07	108032	----a-w-	c:\windows\system32\psisrndr.ax
2012-04-25 22:06 . 2012-04-25 22:06	861696	----a-w-	c:\windows\system32\oleaut32.dll
2012-04-25 22:06 . 2012-04-25 22:06	571904	----a-w-	c:\windows\SysWow64\oleaut32.dll
2012-04-25 22:06 . 2012-04-25 22:06	331776	----a-w-	c:\windows\system32\oleacc.dll
2012-04-25 22:06 . 2012-04-25 22:06	233472	----a-w-	c:\windows\SysWow64\oleacc.dll
2012-04-19 00:56 . 2012-04-19 00:56	94208	----a-w-	c:\windows\SysWow64\QuickTimeVR.qtx
2012-04-19 00:56 . 2012-04-19 00:56	69632	----a-w-	c:\windows\SysWow64\QuickTime.qts
2012-04-13 08:46 . 2012-04-25 07:33	8917360	----a-w-	c:\programdata\Microsoft\Windows Defender\Definition Updates\{41CB3D6F-1963-4E87-B780-A71E76739471}\mpengine.dll
2012-04-04 19:56 . 2012-04-25 22:50	24904	----a-w-	c:\windows\system32\drivers\mbam.sys
2012-03-31 06:05 . 2012-05-11 18:13	5559664	----a-w-	c:\windows\system32\ntoskrnl.exe
2012-03-31 04:39 . 2012-05-11 18:13	3968368	----a-w-	c:\windows\SysWow64\ntkrnlpa.exe
.
.
------- Sigcheck -------
Note: Unsigned files aren't necessarily malware.
.
[7] 2011-02-26 . E38899074D4951D31B4040E994DD7C8D . 2870784 . . [6.1.7600.16385] .. c:\windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20910_none_ae79ed04ac56c4a9\explorer.exe
[7] 2011-02-26 . 0862495E0C825893DB75EF44FAEA8E93 . 2870272 . . [6.1.7600.16385] .. c:\windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16768_none_adc24107935a7e25\explorer.exe
[7] 2011-02-26 . 3B69712041F3D63605529BD66DC00C48 . 2871808 . . [6.1.7600.16385] .. c:\windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.21669_none_b0333b22a99da332\explorer.exe
[7] 2011-02-25 . 332FEAB1435662FC6C672E25BEB37BE3 . 2871808 . . [6.1.7600.16385] .. c:\windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17567_none_afa79dc39081d0ba\explorer.exe
[7] 2010-11-20 . AC4C51EB24AA95B77F705AB159189E24 . 2872320 . . [6.1.7600.16385] .. c:\windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17514_none_afdaac81905bf900\explorer.exe
[7] 2009-10-31 . B8EC4BD49CE8F6FC457721BFC210B67F . 2870272 . . [6.1.7600.16385] .. c:\windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20563_none_ae46d6aeac7ca7c7\explorer.exe
[-] 2009-10-31 . D5A67267C4C3879E63E9BFBA991D823A . 2387456 . . [6.1.7600.16385] .. c:\windows\explorer.exe
[7] 2009-10-31 . 9AAAEC8DAC27AA17B053E6352AD233AE . 2870272 . . [6.1.7600.16385] .. c:\windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16450_none_adc508f19359a007\explorer.exe
[7] 2009-08-03 . 700073016DAC1C3D2E7E2CE4223334B6 . 2868224 . . [6.1.7600.16385] .. c:\windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20500_none_ae84b558ac4eb41c\explorer.exe
[7] 2009-08-03 . F170B4A061C9E026437B193B4D571799 . 2868224 . . [6.1.7600.16385] .. c:\windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16404_none_adff19b5932d79ae\explorer.exe
[7] 2009-07-14 . C235A51CB740E45FFA0EBFB9BAFCDA64 . 2868224 . . [6.1.7600.16385] .. c:\windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16385_none_ada998b9936d7566\explorer.exe
.
(((((((((((((((((((((((((((((   SnapShot@2012-06-21_00.09.10   )))))))))))))))))))))))))))))))))))))))))
.
+ 2012-06-24 04:01 . 2012-06-25 00:40	32768              c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012012062420120625\index.dat
+ 2012-06-23 12:21 . 2012-06-24 03:54	32768              c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012012062320120624\index.dat
+ 2012-04-25 20:24 . 2012-06-23 12:12	49120              c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\MSIMGSIZ.DAT
- 2012-04-25 20:24 . 2012-04-25 22:05	32768              c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\DOMStore\index.dat
+ 2012-04-25 20:24 . 2012-06-25 01:02	32768              c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\DOMStore\index.dat
+ 2009-10-30 05:01 . 2012-06-25 01:14	52910              c:\windows\system32\wdi\ShutdownPerformanceDiagnostics_SystemData.bin
+ 2009-07-14 05:10 . 2012-06-25 01:14	30378              c:\windows\system32\wdi\BootPerformanceDiagnostics_SystemData.bin
+ 2011-04-20 19:48 . 2012-06-25 01:14	13278              c:\windows\system32\wdi\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-520610219-17727062-633966983-1000_UserData.bin
- 2009-07-14 05:30 . 2012-06-17 19:49	86016              c:\windows\system32\DriverStore\infpub.dat
+ 2009-07-14 05:30 . 2012-06-24 13:47	86016              c:\windows\system32\DriverStore\infpub.dat
+ 2011-04-20 19:20 . 2012-06-24 04:50	16384              c:\windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
- 2011-04-20 19:20 . 2012-06-14 00:23	16384              c:\windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
+ 2011-04-20 19:20 . 2012-06-24 04:50	32768              c:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
- 2011-04-20 19:20 . 2012-06-14 00:23	32768              c:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
- 2009-07-14 04:54 . 2012-06-14 00:23	32768              c:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2009-07-14 04:54 . 2012-06-24 04:50	32768              c:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2012-06-25 01:25 . 2012-06-25 01:25	2048              c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
- 2012-06-21 00:08 . 2012-06-21 00:08	2048              c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
+ 2012-06-24 21:45 . 2012-06-24 21:45	686280              c:\windows\SysWOW64\Macromed\Flash\FlashUtil32_11_3_300_262_Plugin.exe
+ 2012-06-24 21:45 . 2012-06-24 21:45	250056              c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
+ 2009-07-14 04:54 . 2012-06-25 01:08	294912              c:\windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
+ 2012-06-23 12:12 . 2012-06-25 01:08	262144              c:\windows\SysWOW64\%APPDATA%\Microsoft\Windows\IETldCache\index.dat
- 2009-07-14 02:36 . 2012-06-21 00:00	623940              c:\windows\system32\perfh009.dat
+ 2009-07-14 02:36 . 2012-06-25 01:17	623940              c:\windows\system32\perfh009.dat
- 2009-07-14 02:36 . 2012-06-21 00:00	106316              c:\windows\system32\perfc009.dat
+ 2009-07-14 02:36 . 2012-06-25 01:17	106316              c:\windows\system32\perfc009.dat
+ 2012-06-24 21:45 . 2012-06-24 21:45	417992              c:\windows\system32\Macromed\Flash\FlashUtil64_11_3_300_262_Plugin.exe
+ 2009-07-14 05:30 . 2012-06-24 13:47	143360              c:\windows\system32\DriverStore\infstrng.dat
- 2009-07-14 05:30 . 2012-06-17 19:49	143360              c:\windows\system32\DriverStore\infstrng.dat
- 2009-07-14 05:30 . 2012-06-17 19:49	143360              c:\windows\system32\DriverStore\infstor.dat
+ 2009-07-14 05:30 . 2012-06-24 13:47	143360              c:\windows\system32\DriverStore\infstor.dat
- 2009-07-14 05:01 . 2012-06-21 00:08	513088              c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-System.dat
+ 2009-07-14 05:01 . 2012-06-25 01:25	513088              c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-System.dat
+ 2012-06-24 21:45 . 2012-06-24 21:45	9459912              c:\windows\SysWOW64\Macromed\Flash\NPSWF32_11_3_300_262.dll
+ 2012-06-24 21:45 . 2012-06-24 21:45	1535176              c:\windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_3_300_262.exe
+ 2009-07-14 04:54 . 2012-06-25 01:08	2539520              c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
- 2009-07-14 04:54 . 2012-06-20 23:55	2539520              c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
+ 2009-07-14 04:54 . 2012-06-25 01:08	7094272              c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2009-07-14 04:45 . 2012-06-25 01:13	6366312              c:\windows\system32\FNTCACHE.DAT
+ 2012-06-24 21:45 . 2012-06-24 21:45	12310216              c:\windows\system32\Macromed\Flash\NPSWF64_11_3_300_262.dll
+ 2011-09-19 10:39 . 2012-06-25 01:25	56912760              c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-S-1-5-21-520610219-17727062-633966983-1000-12288.dat
+ 2012-06-24 03:25 . 2012-06-25 01:12	10330864              c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-S-1-5-18-16384.dat
.
(((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown 
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RocketDock"="c:\program files (x86)\RocketDock\RocketDock.exe" [2007-09-02 495616]
"Advanced SystemCare 5"="c:\program files (x86)\IObit\Advanced SystemCare 5\ASCTray.exe" [2012-05-28 288128]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"InstaLAN"="c:\program files (x86)\Belkin\Router Setup and Monitor\BelkinRouterMonitor.exe" [2011-02-25 1770400]
"APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2012-02-21 59240]
.
c:\users\Bre\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
CurseClientStartup.ccip [2011-10-9 0]
Rainmeter.lnk - c:\program files\Rainmeter\Rainmeter.exe [2011-9-18 102912]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
UltraMon.lnk - c:\windows\Installer\{537056B7-32A4-4408-9B54-0341963C7C9C}\IcoUltraMon.ico [2011-9-18 29310]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 0 (0x0)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Security Packages	REG_MULTI_SZ   	kerberos msv1_0 schannel wdigest tspkg pku2u livessp
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\run-]
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe"
"HP Software Update"=c:\program files (x86)\HP\HP Software Update\HPWuSchd2.exe
"iTunesHelper"="c:\program files (x86)\iTunes\iTunesHelper.exe"
"ConduitHelper"="c:\users\Public\Conduit\ConduitHelper\ConduitHelper.exe"
"Freecorder FLV Service"="c:\program files (x86)\Freecorder\FLVSrvc.exe" /run
"Gateway Photo Frame"="c:\program files (x86)\Gateway Photo Frame\ButtonMonitor.exe" -A
"QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" -atboottime
.
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R2 gupdate;Google Update Service (gupdate);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-09-18 136176]
R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe [2012-06-05 160944]
R3 BTCFilterService;USB Networking Driver Filter Service;c:\windows\system32\DRIVERS\motfilt.sys [x]
R3 BVRPMPR5a64;BVRPMPR5a64 NDIS Protocol Driver;c:\windows\system32\drivers\BVRPMPR5a64.SYS [x]
R3 gupdatem;Google Update Service (gupdatem);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-09-18 136176]
R3 LGVirHid;Logitech Gamepanel Virtual HID Device Driver;c:\windows\system32\drivers\LGVirHid.sys [x]
R3 motandroidusb;Mot ADB Interface Driver;c:\windows\system32\Drivers\motoandroid.sys [x]
R3 motccgp;Motorola USB Composite Device Driver;c:\windows\system32\DRIVERS\motccgp.sys [x]
R3 motccgpfl;MotCcgpFlService;c:\windows\system32\DRIVERS\motccgpfl.sys [x]
R3 Motousbnet;Motorola USB Networking Driver Service;c:\windows\system32\DRIVERS\Motousbnet.sys [x]
R3 MozillaMaintenance;Mozilla Maintenance Service;c:\program files (x86)\Mozilla Maintenance Service\maintenanceservice.exe [2012-06-16 113120]
R3 pbfilter;pbfilter;c:\program files\PeerBlock\pbfilter.sys [2010-11-07 24176]
R3 RTL8192su;Realtek RTL8192SU Wireless LAN 802.11n USB 2.0 Network Adapter;c:\windows\system32\DRIVERS\RTL8192su.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [x]
R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [x]
R3 WinRing0_1_2_0;WinRing0_1_2_0;c:\program files (x86)\IObit\Game Booster 3\Driver\WinRing0x64.sys [2010-11-01 14544]
R3 WMZuneComm;Zune Windows Mobile Connectivity Service;c:\program files\Zune\WMZuneComm.exe [2011-08-05 306400]
S1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;c:\windows\system32\DRIVERS\dtsoftbus01.sys [x]
S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [x]
S2 AdvancedSystemCareService5;Advanced SystemCare Service 5;c:\program files (x86)\IObit\Advanced SystemCare 5\ASCService.exe [2012-05-26 913792]
S2 cpuz135;cpuz135;c:\windows\system32\drivers\cpuz135_x64.sys [x]
S2 Greg_Service;GRegService;c:\program files (x86)\Gateway\Registration\GregHSRW.exe [2009-08-28 1150496]
S2 TuneUp.UtilitiesSvc;TuneUp Utilities Service;c:\program files (x86)\TuneUp Utilities 2012\TuneUpUtilitiesService64.exe [2011-10-12 2072896]
S2 UltraMonUtility;UltraMon Utility Driver;c:\program files (x86)\Common Files\Realtime Soft\UltraMonMirrorDrv\x64\UltraMonUtility.sys [2008-11-14 20512]
S2 Updater Service;Updater Service;c:\program files\Gateway\Gateway Updater\UpdaterService.exe [2009-07-04 240160]
S3 e1yexpress;Intel(R) Gigabit Network Connections Driver;c:\windows\system32\DRIVERS\e1y60x64.sys [x]
S3 EuMusDesignVirtualAudioCableWdm;Virtual Audio Cable (WDM);c:\windows\system32\DRIVERS\vrtaucbl.sys [x]
S3 IntcHdmiAddService;Intel(R) High Definition Audio HDMI;c:\windows\system32\drivers\IntcHdmi.sys [x]
S3 LGBusEnum;Logitech GamePanel Virtual Bus Enumerator Driver;c:\windows\system32\drivers\LGBusEnum.sys [x]
S3 ManyCam;ManyCam Virtual Webcam, WDM Video Capture Driver;c:\windows\system32\DRIVERS\ManyCam_x64.sys [x]
S3 phaudlwr;Philips Audio Filter;c:\windows\system32\DRIVERS\phaudlwr.sys [x]
S3 pneteth;PdaNet Broadband;c:\windows\system32\DRIVERS\pneteth.sys [x]
S3 SPC620;Philips SPC620NC PC Camera;c:\windows\system32\drivers\SPC620.sys [x]
S3 SPC620m;Philips SPC620NC PC Cameram;c:\windows\system32\drivers\SPC620m.sys [x]
S3 TuneUpUtilitiesDrv;TuneUpUtilitiesDrv;c:\program files (x86)\TuneUp Utilities 2012\TuneUpUtilitiesDriver64.sys [2011-09-22 11856]
.
.
Contents of the 'Scheduled Tasks' folder
.
2012-06-25 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-09-18 22:04]
.
2012-06-25 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-09-18 22:04]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IAAnotif"="c:\program files (x86)\Intel\Intel Matrix Storage Manager\iaanotif.exe" [2009-06-05 186904]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2009-07-20 7981088]
"Launch LCore"="c:\program files\Logitech Gaming Software\LCore.exe" [2011-07-28 110360]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2011-02-12 162328]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2011-02-12 386584]
"Persistence"="c:\windows\system32\igfxpers.exe" [2011-02-12 417304]
.
------- Supplementary Scan -------
.
uLocal Page = c:\windows\system32\blank.htm
mStart Page = hxxp://homepage.gateway.com/rdr.aspx?b=ACGW&l=0409&m=sx2800&r=173604117307p0358v115k49i15222
mLocal Page = c:\windows\SysWOW64\blank.htm
IE: E&xport to Microsoft Excel - c:\progra~2\MICROS~1\Office12\EXCEL.EXE/3000
IE: Google Sidewiki... - c:\program files (x86)\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_D183CA64F05FDD98.dll/cmsidewiki.html
TCP: DhcpNameServer = 192.168.2.1
FF - ProfilePath - c:\users\Bre\AppData\Roaming\Mozilla\Firefox\Profiles\y7r4no5l.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://www.facebook.com/
FF - prefs.js: keyword.URL - hxxp://www.google.co.in/search?btnG=Google+Search&q=
.
- - - - ORPHANS REMOVED - - - -
.
Toolbar-Locked - (no file)
Toolbar-{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc} - (no file)
Toolbar-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file)
.
.
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_USERS\S-1-5-21-520610219-17727062-633966983-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.eml\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="WindowsLiveMail.Email.1"
.
[HKEY_USERS\S-1-5-21-520610219-17727062-633966983-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.vcf\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="WindowsLiveMail.VCard.1"
.
------------------------ Other Running Processes ------------------------
.
c:\program files (x86)\Belkin\Router Setup and Monitor\BelkinService.exe
c:\program files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
c:\program files (x86)\Intel\Intel Matrix Storage Manager\IAANTMon.exe
c:\program files (x86)\Belkin\Router Setup and Monitor\BelkinSetup.exe
.
**************************************************************************
.
Completion time: 2012-06-24  21:30:16 - machine was rebooted
ComboFix-quarantined-files.txt  2012-06-25 01:30
ComboFix2.txt  2012-06-21 00:13
.
Pre-Run: 143,897,649,152 bytes free
Post-Run: 144,305,987,584 bytes free
.
- - End Of File - - 09446167A785C504120DC911DF9512A4


----------



## johnb35

Did you install any software since the last combofix was ran?  It seems you have the same infections as the first time.  The redirecting should be gone again.


----------



## Motorcharge

None of it's acting up anymore. Haven't downloaded anything other than the flash player again after the uninstall and I downloaded that directly from Adobe's website.


----------



## Motorcharge

Last issue is back after not happening since my last post. Have not downloaded anything other than a photo or two off tumblr since.


----------



## johnb35

Rerun combofix again, lets see if your getting the same infections back.


----------



## Motorcharge

ComboFix 12-06-28.03 - Bre 07/13/2012  21:02:35.4.4 - x64
Microsoft Windows 7 Home Premium   6.1.7601.1.1252.1.1033.18.4061.2056 [GMT -4:00]
Running from: c:\users\Bre\Downloads\ComboFix.exe
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
 * Created a new restore point
.
.
(((((((((((((((((((((((((((((((((((((((   Other Deletions   )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\users\Bre\AppData\Local\pmybgvbos.exe
c:\users\Bre\AppData\Local\Temp\1.tmp\F_IN_BOX.dll
c:\users\Bre\AppData\Roaming\ianex.dll
c:\users\Bre\AppData\Roaming\picop.dll
c:\windows\assembly\GAC_32\Desktop.ini
c:\windows\assembly\GAC_64\Desktop.ini
c:\windows\Installer\{604e7576-ec0d-7231-cc64-a8dfba4e3e1f}\@
c:\windows\Installer\{604e7576-ec0d-7231-cc64-a8dfba4e3e1f}\L\00000004.@
c:\windows\Installer\{604e7576-ec0d-7231-cc64-a8dfba4e3e1f}\L\201d3dde
c:\windows\Installer\{604e7576-ec0d-7231-cc64-a8dfba4e3e1f}\L\55490ac4
c:\windows\Installer\{604e7576-ec0d-7231-cc64-a8dfba4e3e1f}\n
c:\windows\Installer\{604e7576-ec0d-7231-cc64-a8dfba4e3e1f}\U\00000004.@
c:\windows\Installer\{604e7576-ec0d-7231-cc64-a8dfba4e3e1f}\U\00000008.@
c:\windows\Installer\{604e7576-ec0d-7231-cc64-a8dfba4e3e1f}\U\000000cb.@
c:\windows\Installer\{604e7576-ec0d-7231-cc64-a8dfba4e3e1f}\U\80000000.@
c:\windows\Installer\{604e7576-ec0d-7231-cc64-a8dfba4e3e1f}\U\80000032.@
c:\windows\Installer\{604e7576-ec0d-7231-cc64-a8dfba4e3e1f}\U\80000064.@
.
Infected copy of c:\windows\system32\services.exe was found and disinfected 
Restored copy from - c:\windows\erdnt\cache64\services.exe 
.
.
(((((((((((((((((((((((((   Files Created from 2012-06-14 to 2012-07-14  )))))))))))))))))))))))))))))))
.
.
2012-07-14 01:07 . 2012-07-14 01:07	--------	d-----w-	c:\users\Default\AppData\Local\temp
2012-07-13 06:21 . 2012-06-18 07:12	9013136	----a-w-	c:\programdata\Microsoft\Windows Defender\Definition Updates\{97D554BF-9C7C-49C2-AF51-E0B1D30B51EF}\mpengine.dll
2012-07-08 04:16 . 2012-07-08 04:16	--------	d-----w-	c:\users\Bre\AppData\Roaming\HideIPEasy
2012-07-08 04:16 . 2012-07-08 04:16	--------	d-----w-	c:\programdata\HideIPEasy
2012-07-08 04:15 . 2012-07-08 04:15	--------	d-----w-	c:\program files (x86)\Ask.com
2012-07-08 04:15 . 2012-07-08 04:15	--------	d-----w-	c:\users\Bre\AppData\Local\APN
2012-07-08 04:14 . 2012-07-08 04:16	--------	d-----w-	c:\program files (x86)\HideIPEasy
2012-07-06 00:01 . 2012-07-06 00:01	--------	d-----w-	c:\users\Bre\AppData\Local\{B4F8B799-C6FD-11E1-8270-B8AC6F996F26}
2012-06-24 21:47 . 2012-06-24 21:47	--------	d-----w-	c:\users\Bre\AppData\Local\Macromedia
2012-06-24 21:45 . 2012-06-24 21:45	--------	d-----w-	c:\programdata\McAfee
2012-06-24 21:45 . 2012-06-24 21:45	70344	----a-w-	c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2012-06-24 21:45 . 2012-06-24 21:45	426184	----a-w-	c:\windows\SysWow64\FlashPlayerApp.exe
2012-06-23 12:12 . 2012-06-23 12:12	--------	d-sh--w-	c:\windows\SysWow64\%APPDATA%
2012-06-21 01:01 . 2012-06-21 01:01	--------	d-----w-	c:\program files (x86)\ESET
2012-06-20 23:54 . 2012-06-20 23:54	--------	d-----w-	C:\TDSSKiller_Quarantine
2012-06-17 21:10 . 2012-06-17 21:10	--------	d-----w-	c:\program files\Microsoft Silverlight
2012-06-17 21:10 . 2012-06-17 21:10	--------	d-----w-	c:\program files (x86)\Microsoft Silverlight
2012-06-17 19:36 . 2011-07-20 18:58	44032	----a-w-	c:\windows\system32\drivers\RimSerial_AMD64.sys
2012-06-17 19:36 . 2012-06-24 13:47	--------	d-----w-	c:\program files (x86)\Common Files\Research In Motion
.
.
.
((((((((((((((((((((((((((((((((((((((((   Find3M Report   ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-05-17 23:51 . 2012-05-17 23:51	283200	----a-w-	c:\windows\system32\drivers\dtsoftbus01.sys
2012-05-17 22:50 . 2012-05-17 22:50	71680	----a-w-	c:\windows\system32\frapsv64.dll
2012-05-17 22:50 . 2012-05-17 22:50	65536	----a-w-	c:\windows\SysWow64\frapsvid.dll
2012-04-26 07:09 . 2012-04-26 07:09	91648	----a-w-	c:\windows\system32\SetIEInstalledDate.exe
2012-04-26 07:09 . 2012-04-26 07:09	89088	----a-w-	c:\windows\system32\RegisterIEPKEYs.exe
2012-04-26 07:09 . 2012-04-26 07:09	86528	----a-w-	c:\windows\SysWow64\iesysprep.dll
2012-04-26 07:09 . 2012-04-26 07:09	85504	----a-w-	c:\windows\system32\iesetup.dll
2012-04-26 07:09 . 2012-04-26 07:09	76800	----a-w-	c:\windows\SysWow64\SetIEInstalledDate.exe
2012-04-26 07:09 . 2012-04-26 07:09	76800	----a-w-	c:\windows\system32\tdc.ocx
2012-04-26 07:09 . 2012-04-26 07:09	74752	----a-w-	c:\windows\SysWow64\RegisterIEPKEYs.exe
2012-04-26 07:09 . 2012-04-26 07:09	74752	----a-w-	c:\windows\SysWow64\iesetup.dll
2012-04-26 07:09 . 2012-04-26 07:09	63488	----a-w-	c:\windows\SysWow64\tdc.ocx
2012-04-26 07:09 . 2012-04-26 07:09	603648	----a-w-	c:\windows\system32\vbscript.dll
2012-04-26 07:09 . 2012-04-26 07:09	49664	----a-w-	c:\windows\system32\imgutil.dll
2012-04-26 07:09 . 2012-04-26 07:09	48640	----a-w-	c:\windows\SysWow64\mshtmler.dll
2012-04-26 07:09 . 2012-04-26 07:09	48640	----a-w-	c:\windows\system32\mshtmler.dll
2012-04-26 07:09 . 2012-04-26 07:09	448512	----a-w-	c:\windows\system32\html.iec
2012-04-26 07:09 . 2012-04-26 07:09	420864	----a-w-	c:\windows\SysWow64\vbscript.dll
2012-04-26 07:09 . 2012-04-26 07:09	367104	----a-w-	c:\windows\SysWow64\html.iec
2012-04-26 07:09 . 2012-04-26 07:09	35840	----a-w-	c:\windows\SysWow64\imgutil.dll
2012-04-26 07:09 . 2012-04-26 07:09	30720	----a-w-	c:\windows\system32\licmgr10.dll
2012-04-26 07:09 . 2012-04-26 07:09	23552	----a-w-	c:\windows\SysWow64\licmgr10.dll
2012-04-26 07:09 . 2012-04-26 07:09	222208	----a-w-	c:\windows\system32\msls31.dll
2012-04-26 07:09 . 2012-04-26 07:09	173056	----a-w-	c:\windows\system32\ieUnatt.exe
2012-04-26 07:09 . 2012-04-26 07:09	165888	----a-w-	c:\windows\system32\iexpress.exe
2012-04-26 07:09 . 2012-04-26 07:09	161792	----a-w-	c:\windows\SysWow64\msls31.dll
2012-04-26 07:09 . 2012-04-26 07:09	160256	----a-w-	c:\windows\system32\wextract.exe
2012-04-26 07:09 . 2012-04-26 07:09	152064	----a-w-	c:\windows\SysWow64\wextract.exe
2012-04-26 07:09 . 2012-04-26 07:09	150528	----a-w-	c:\windows\SysWow64\iexpress.exe
2012-04-26 07:09 . 2012-04-26 07:09	142848	----a-w-	c:\windows\SysWow64\ieUnatt.exe
2012-04-26 07:09 . 2012-04-26 07:09	135168	----a-w-	c:\windows\system32\IEAdvpack.dll
2012-04-26 07:09 . 2012-04-26 07:09	12288	----a-w-	c:\windows\system32\mshta.exe
2012-04-26 07:09 . 2012-04-26 07:09	11776	----a-w-	c:\windows\SysWow64\mshta.exe
2012-04-26 07:09 . 2012-04-26 07:09	114176	----a-w-	c:\windows\system32\admparse.dll
2012-04-26 07:09 . 2012-04-26 07:09	111616	----a-w-	c:\windows\system32\iesysprep.dll
2012-04-26 07:09 . 2012-04-26 07:09	110592	----a-w-	c:\windows\SysWow64\IEAdvpack.dll
2012-04-26 07:09 . 2012-04-26 07:09	101888	----a-w-	c:\windows\SysWow64\admparse.dll
2012-04-25 22:44 . 2012-04-25 22:44	23112	----a-w-	c:\windows\system32\drivers\hitmanpro35.sys
2012-04-25 22:36 . 2012-04-25 22:36	81408	----a-w-	c:\windows\system32\imagehlp.dll
2012-04-25 22:36 . 2012-04-25 22:36	5120	----a-w-	c:\windows\SysWow64\wmi.dll
2012-04-25 22:36 . 2012-04-25 22:36	5120	----a-w-	c:\windows\system32\wmi.dll
2012-04-25 22:36 . 2012-04-25 22:36	23408	----a-w-	c:\windows\system32\drivers\fs_rec.sys
2012-04-25 22:36 . 2012-04-25 22:36	220672	----a-w-	c:\windows\system32\wintrust.dll
2012-04-25 22:36 . 2012-04-25 22:36	172544	----a-w-	c:\windows\SysWow64\wintrust.dll
2012-04-25 22:36 . 2012-04-25 22:36	159232	----a-w-	c:\windows\SysWow64\imagehlp.dll
2012-04-25 22:33 . 2012-04-25 22:33	9216	----a-w-	c:\windows\system32\rdrmemptylst.exe
2012-04-25 22:33 . 2012-04-25 22:33	77312	----a-w-	c:\windows\system32\rdpwsx.dll
2012-04-25 22:33 . 2012-04-25 22:33	149504	----a-w-	c:\windows\system32\rdpcorekmts.dll
2012-04-25 22:32 . 2012-04-25 22:32	826880	----a-w-	c:\windows\SysWow64\rdpcore.dll
2012-04-25 22:32 . 2012-04-25 22:32	23552	----a-w-	c:\windows\system32\drivers\tdtcp.sys
2012-04-25 22:32 . 2012-04-25 22:32	210944	----a-w-	c:\windows\system32\drivers\rdpwd.sys
2012-04-25 22:32 . 2012-04-25 22:32	1031680	----a-w-	c:\windows\system32\rdpcore.dll
2012-04-25 22:27 . 2012-04-25 22:27	509952	----a-w-	c:\windows\system32\ntshrui.dll
2012-04-25 22:27 . 2012-04-25 22:27	442880	----a-w-	c:\windows\SysWow64\ntshrui.dll
2012-04-25 22:26 . 2012-04-25 22:26	515584	----a-w-	c:\windows\system32\timedate.cpl
2012-04-25 22:26 . 2012-04-25 22:26	478720	----a-w-	c:\windows\SysWow64\timedate.cpl
2012-04-25 22:26 . 2012-04-25 22:26	498688	----a-w-	c:\windows\system32\drivers\afd.sys
2012-04-25 22:23 . 2012-04-25 22:23	690688	----a-w-	c:\windows\SysWow64\msvcrt.dll
2012-04-25 22:23 . 2012-04-25 22:23	634880	----a-w-	c:\windows\system32\msvcrt.dll
2012-04-25 22:21 . 2012-04-25 22:21	1731920	----a-w-	c:\windows\system32\ntdll.dll
2012-04-25 22:21 . 2012-04-25 22:21	1292080	----a-w-	c:\windows\SysWow64\ntdll.dll
2012-04-25 22:21 . 2012-04-25 22:21	96768	----a-w-	c:\windows\SysWow64\sspicli.dll
2012-04-25 22:21 . 2012-04-25 22:21	95600	----a-w-	c:\windows\system32\drivers\ksecdd.sys
2012-04-25 22:21 . 2012-04-25 22:21	459232	----a-w-	c:\windows\system32\drivers\cng.sys
2012-04-25 22:21 . 2012-04-25 22:21	395776	----a-w-	c:\windows\system32\webio.dll
2012-04-25 22:21 . 2012-04-25 22:21	340992	----a-w-	c:\windows\system32\schannel.dll
2012-04-25 22:21 . 2012-04-25 22:21	314880	----a-w-	c:\windows\SysWow64\webio.dll
2012-04-25 22:21 . 2012-04-25 22:21	31232	----a-w-	c:\windows\system32\lsass.exe
2012-04-25 22:21 . 2012-04-25 22:21	29184	----a-w-	c:\windows\system32\sspisrv.dll
2012-04-25 22:21 . 2012-04-25 22:21	28160	----a-w-	c:\windows\system32\secur32.dll
2012-04-25 22:21 . 2012-04-25 22:21	224768	----a-w-	c:\windows\SysWow64\schannel.dll
2012-04-25 22:21 . 2012-04-25 22:21	22016	----a-w-	c:\windows\SysWow64\secur32.dll
2012-04-25 22:21 . 2012-04-25 22:21	152432	----a-w-	c:\windows\system32\drivers\ksecpkg.sys
2012-04-25 22:21 . 2012-04-25 22:21	1447936	----a-w-	c:\windows\system32\lsasrv.dll
2012-04-25 22:21 . 2012-04-25 22:21	136192	----a-w-	c:\windows\system32\sspicli.dll
2012-04-25 22:21 . 2012-04-25 22:21	514560	----a-w-	c:\windows\SysWow64\qdvd.dll
2012-04-25 22:21 . 2012-04-25 22:21	366592	----a-w-	c:\windows\system32\qdvd.dll
2012-04-25 22:21 . 2012-04-25 22:21	1572864	----a-w-	c:\windows\system32\quartz.dll
2012-04-25 22:21 . 2012-04-25 22:21	1328128	----a-w-	c:\windows\SysWow64\quartz.dll
2012-04-25 22:20 . 2012-04-25 22:20	77312	----a-w-	c:\windows\system32\packager.dll
2012-04-25 22:20 . 2012-04-25 22:20	67072	----a-w-	c:\windows\SysWow64\packager.dll
2012-04-25 22:16 . 2012-04-25 22:16	2048	----a-w-	c:\windows\SysWow64\tzres.dll
2012-04-25 22:16 . 2012-04-25 22:16	2048	----a-w-	c:\windows\system32\tzres.dll
2012-04-25 22:16 . 2012-04-25 22:16	43520	----a-w-	c:\windows\system32\csrsrv.dll
2012-04-25 22:16 . 2012-04-25 22:16	723456	----a-w-	c:\windows\system32\EncDec.dll
2012-04-25 22:16 . 2012-04-25 22:16	534528	----a-w-	c:\windows\SysWow64\EncDec.dll
2012-04-25 22:07 . 2012-04-25 22:07	75776	----a-w-	c:\windows\SysWow64\psisrndr.ax
2012-04-25 22:07 . 2012-04-25 22:07	613888	----a-w-	c:\windows\system32\psisdecd.dll
2012-04-25 22:07 . 2012-04-25 22:07	465408	----a-w-	c:\windows\SysWow64\psisdecd.dll
2012-04-25 22:07 . 2012-04-25 22:07	108032	----a-w-	c:\windows\system32\psisrndr.ax
2012-04-25 22:06 . 2012-04-25 22:06	861696	----a-w-	c:\windows\system32\oleaut32.dll
2012-04-25 22:06 . 2012-04-25 22:06	571904	----a-w-	c:\windows\SysWow64\oleaut32.dll
2012-04-25 22:06 . 2012-04-25 22:06	331776	----a-w-	c:\windows\system32\oleacc.dll
2012-04-25 22:06 . 2012-04-25 22:06	233472	----a-w-	c:\windows\SysWow64\oleacc.dll
2012-04-19 00:56 . 2012-04-19 00:56	94208	----a-w-	c:\windows\SysWow64\QuickTimeVR.qtx
2012-04-19 00:56 . 2012-04-19 00:56	69632	----a-w-	c:\windows\SysWow64\QuickTime.qts
.
.
------- Sigcheck -------
Note: Unsigned files aren't necessarily malware.
.
[7] 2011-02-26 . E38899074D4951D31B4040E994DD7C8D . 2870784 . . [6.1.7600.16385] .. c:\windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20910_none_ae79ed04ac56c4a9\explorer.exe
[7] 2011-02-26 . 0862495E0C825893DB75EF44FAEA8E93 . 2870272 . . [6.1.7600.16385] .. c:\windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16768_none_adc24107935a7e25\explorer.exe
[7] 2011-02-26 . 3B69712041F3D63605529BD66DC00C48 . 2871808 . . [6.1.7600.16385] .. c:\windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.21669_none_b0333b22a99da332\explorer.exe
[7] 2011-02-25 . 332FEAB1435662FC6C672E25BEB37BE3 . 2871808 . . [6.1.7600.16385] .. c:\windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17567_none_afa79dc39081d0ba\explorer.exe
[7] 2010-11-20 . AC4C51EB24AA95B77F705AB159189E24 . 2872320 . . [6.1.7600.16385] .. c:\windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17514_none_afdaac81905bf900\explorer.exe
[7] 2009-10-31 . B8EC4BD49CE8F6FC457721BFC210B67F . 2870272 . . [6.1.7600.16385] .. c:\windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20563_none_ae46d6aeac7ca7c7\explorer.exe
[-] 2009-10-31 . D5A67267C4C3879E63E9BFBA991D823A . 2387456 . . [6.1.7600.16385] .. c:\windows\explorer.exe
[7] 2009-10-31 . 9AAAEC8DAC27AA17B053E6352AD233AE . 2870272 . . [6.1.7600.16385] .. c:\windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16450_none_adc508f19359a007\explorer.exe
[7] 2009-08-03 . 700073016DAC1C3D2E7E2CE4223334B6 . 2868224 . . [6.1.7600.16385] .. c:\windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20500_none_ae84b558ac4eb41c\explorer.exe
[7] 2009-08-03 . F170B4A061C9E026437B193B4D571799 . 2868224 . . [6.1.7600.16385] .. c:\windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16404_none_adff19b5932d79ae\explorer.exe
[7] 2009-07-14 . C235A51CB740E45FFA0EBFB9BAFCDA64 . 2868224 . . [6.1.7600.16385] .. c:\windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16385_none_ada998b9936d7566\explorer.exe
.
(((((((((((((((((((((((((((((   SnapShot@2012-06-21_00.09.10   )))))))))))))))))))))))))))))))))))))))))
.
+ 2010-03-18 13:15 . 2010-03-18 13:15	51024              c:\windows\SysWOW64\vcomp100.dll
+ 2010-03-18 13:15 . 2010-03-18 13:15	80720              c:\windows\SysWOW64\mfcm100u.dll
+ 2010-03-18 13:15 . 2010-03-18 13:15	80208              c:\windows\SysWOW64\mfcm100.dll
+ 2010-03-18 13:15 . 2010-03-18 13:15	60752              c:\windows\SysWOW64\mfc100rus.dll
+ 2010-03-18 13:15 . 2010-03-18 13:15	43344              c:\windows\SysWOW64\mfc100kor.dll
+ 2010-03-18 13:15 . 2010-03-18 13:15	43856              c:\windows\SysWOW64\mfc100jpn.dll
+ 2010-03-18 13:15 . 2010-03-18 13:15	62288              c:\windows\SysWOW64\mfc100ita.dll
+ 2010-03-18 13:15 . 2010-03-18 13:15	64336              c:\windows\SysWOW64\mfc100fra.dll
+ 2010-03-18 13:15 . 2010-03-18 13:15	63824              c:\windows\SysWOW64\mfc100esn.dll
+ 2010-03-18 13:15 . 2010-03-18 13:15	55120              c:\windows\SysWOW64\mfc100enu.dll
+ 2010-03-18 13:15 . 2010-03-18 13:15	64336              c:\windows\SysWOW64\mfc100deu.dll
+ 2010-03-18 13:15 . 2010-03-18 13:15	36176              c:\windows\SysWOW64\mfc100cht.dll
+ 2010-03-18 13:15 . 2010-03-18 13:15	36176              c:\windows\SysWOW64\mfc100chs.dll
+ 2012-07-08 04:14 . 2012-07-08 04:14	84507              c:\windows\SysWOW64\Macromed\Flash\uninstall_activeX.exe
+ 2012-06-28 22:26 . 2012-06-28 22:25	32768              c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012012062820120629\index.dat
+ 2012-06-28 22:26 . 2012-06-28 22:25	32768              c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012012061820120625\index.dat
+ 2012-04-25 20:24 . 2012-06-23 12:12	49120              c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\MSIMGSIZ.DAT
+ 2012-04-25 20:24 . 2012-06-28 22:25	32768              c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\DOMStore\index.dat
- 2012-04-25 20:24 . 2012-04-25 22:05	32768              c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\DOMStore\index.dat
+ 2010-03-18 20:47 . 2010-03-18 20:47	17760              c:\windows\SysWOW64\aspnet_counters.dll
+ 2009-10-30 05:01 . 2012-06-28 22:43	53156              c:\windows\system32\wdi\ShutdownPerformanceDiagnostics_SystemData.bin
+ 2009-07-14 05:10 . 2012-07-01 23:20	30546              c:\windows\system32\wdi\BootPerformanceDiagnostics_SystemData.bin
+ 2011-04-20 19:48 . 2012-07-01 23:20	13576              c:\windows\system32\wdi\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-520610219-17727062-633966983-1000_UserData.bin
+ 2009-07-14 05:30 . 2012-06-24 13:47	86016              c:\windows\system32\DriverStore\infpub.dat
- 2009-07-14 05:30 . 2012-06-17 19:49	86016              c:\windows\system32\DriverStore\infpub.dat
+ 2011-04-20 19:20 . 2012-07-08 10:06	16384              c:\windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
- 2011-04-20 19:20 . 2012-06-14 00:23	16384              c:\windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
- 2011-04-20 19:20 . 2012-06-14 00:23	32768              c:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
+ 2011-04-20 19:20 . 2012-07-08 10:06	32768              c:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
+ 2009-07-14 04:54 . 2012-07-08 10:06	32768              c:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
- 2009-07-14 04:54 . 2012-06-14 00:23	32768              c:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2010-03-18 21:23 . 2010-03-18 21:23	20832              c:\windows\system32\aspnet_counters.dll
+ 2009-07-14 04:46 . 2012-07-06 03:35	16768              c:\windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\SoftwareProtectionPlatform\Cache\cache.dat
+ 2010-03-18 20:47 . 2010-03-18 20:47	97624              c:\windows\Microsoft.NET\Framework64\v4.0.30319\XamlBuildTask.dll
+ 2010-03-18 21:23 . 2010-03-18 21:23	15696              c:\windows\Microsoft.NET\Framework64\v4.0.30319\webengine.dll
+ 2010-03-18 21:23 . 2010-03-18 21:23	81224              c:\windows\Microsoft.NET\Framework64\v4.0.30319\TLBREF.DLL
+ 2010-03-18 20:47 . 2010-03-18 20:47	29544              c:\windows\Microsoft.NET\Framework64\v4.0.30319\System.Xaml.Hosting.dll
+ 2010-03-18 20:47 . 2010-03-18 20:47	70040              c:\windows\Microsoft.NET\Framework64\v4.0.30319\System.Windows.Forms.DataVisualization.Design.dll
+ 2010-03-18 20:47 . 2010-03-18 20:47	24928              c:\windows\Microsoft.NET\Framework64\v4.0.30319\System.Web.Routing.dll
+ 2010-03-18 20:47 . 2010-03-18 20:47	81272              c:\windows\Microsoft.NET\Framework64\v4.0.30319\System.Web.RegularExpressions.dll
+ 2010-03-18 20:47 . 2010-03-18 20:47	33144              c:\windows\Microsoft.NET\Framework64\v4.0.30319\System.Web.DynamicData.Design.dll
+ 2010-03-18 20:47 . 2010-03-18 20:47	93576              c:\windows\Microsoft.NET\Framework64\v4.0.30319\System.Web.DataVisualization.Design.dll
+ 2010-03-18 20:47 . 2010-03-18 20:47	24944              c:\windows\Microsoft.NET\Framework64\v4.0.30319\System.Web.Abstractions.dll
+ 2010-03-18 20:47 . 2010-03-18 20:47	28024              c:\windows\Microsoft.NET\Framework64\v4.0.30319\System.ServiceModel.WasHosting.dll
+ 2010-03-18 20:47 . 2010-03-18 20:47	12168              c:\windows\Microsoft.NET\Framework64\v4.0.30319\System.ServiceModel.ServiceMoniker40.dll
+ 2010-03-18 20:47 . 2010-03-18 20:47	95592              c:\windows\Microsoft.NET\Framework64\v4.0.30319\System.Runtime.Caching.dll
+ 2010-03-18 20:47 . 2010-03-18 20:47	86888              c:\windows\Microsoft.NET\Framework64\v4.0.30319\System.Drawing.Design.dll
+ 2010-03-18 19:58 . 2010-03-18 19:58	96088              c:\windows\Microsoft.NET\Framework64\v4.0.30319\SetupCache\Extended\SetupUtility.exe
+ 2010-03-18 20:16 . 2010-03-18 20:16	78152              c:\windows\Microsoft.NET\Framework64\v4.0.30319\SetupCache\Extended\Setup.exe
+ 2010-03-18 20:16 . 2010-03-18 20:16	18776              c:\windows\Microsoft.NET\Framework64\v4.0.30319\SetupCache\Extended\3082\SetupResources.dll
+ 2010-03-18 20:16 . 2010-03-18 20:16	14168              c:\windows\Microsoft.NET\Framework64\v4.0.30319\SetupCache\Extended\3076\SetupResources.dll
+ 2010-03-18 20:16 . 2010-03-18 20:16	18776              c:\windows\Microsoft.NET\Framework64\v4.0.30319\SetupCache\Extended\2070\SetupResources.dll
+ 2010-03-18 20:16 . 2010-03-18 20:16	14168              c:\windows\Microsoft.NET\Framework64\v4.0.30319\SetupCache\Extended\2052\SetupResources.dll
+ 2010-03-18 20:16 . 2010-03-18 20:16	17752              c:\windows\Microsoft.NET\Framework64\v4.0.30319\SetupCache\Extended\1055\SetupResources.dll
+ 2010-03-18 20:16 . 2010-03-18 20:16	17752              c:\windows\Microsoft.NET\Framework64\v4.0.30319\SetupCache\Extended\1053\SetupResources.dll
+ 2010-03-18 20:16 . 2010-03-18 20:16	18264              c:\windows\Microsoft.NET\Framework64\v4.0.30319\SetupCache\Extended\1049\SetupResources.dll
+ 2010-03-18 20:16 . 2010-03-18 20:16	18264              c:\windows\Microsoft.NET\Framework64\v4.0.30319\SetupCache\Extended\1046\SetupResources.dll
+ 2010-03-18 20:16 . 2010-03-18 20:16	18264              c:\windows\Microsoft.NET\Framework64\v4.0.30319\SetupCache\Extended\1045\SetupResources.dll
+ 2010-03-18 20:16 . 2010-03-18 20:16	17752              c:\windows\Microsoft.NET\Framework64\v4.0.30319\SetupCache\Extended\1044\SetupResources.dll
+ 2010-03-18 20:16 . 2010-03-18 20:16	19288              c:\windows\Microsoft.NET\Framework64\v4.0.30319\SetupCache\Extended\1043\SetupResources.dll
+ 2010-03-18 20:16 . 2010-03-18 20:16	15192              c:\windows\Microsoft.NET\Framework64\v4.0.30319\SetupCache\Extended\1042\SetupResources.dll
+ 2010-03-18 20:16 . 2010-03-18 20:16	15704              c:\windows\Microsoft.NET\Framework64\v4.0.30319\SetupCache\Extended\1041\SetupResources.dll
+ 2010-03-18 20:16 . 2010-03-18 20:16	18264              c:\windows\Microsoft.NET\Framework64\v4.0.30319\SetupCache\Extended\1040\SetupResources.dll
+ 2010-03-18 20:16 . 2010-03-18 20:16	18776              c:\windows\Microsoft.NET\Framework64\v4.0.30319\SetupCache\Extended\1038\SetupResources.dll
+ 2010-03-18 20:16 . 2010-03-18 20:16	16728              c:\windows\Microsoft.NET\Framework64\v4.0.30319\SetupCache\Extended\1037\SetupResources.dll
+ 2010-03-18 20:16 . 2010-03-18 20:16	18776              c:\windows\Microsoft.NET\Framework64\v4.0.30319\SetupCache\Extended\1036\SetupResources.dll
+ 2010-03-18 20:16 . 2010-03-18 20:16	18264              c:\windows\Microsoft.NET\Framework64\v4.0.30319\SetupCache\Extended\1035\SetupResources.dll
+ 2010-03-18 20:16 . 2010-03-18 20:16	17240              c:\windows\Microsoft.NET\Framework64\v4.0.30319\SetupCache\Extended\1033\SetupResources.dll
+ 2010-03-18 20:16 . 2010-03-18 20:16	19288              c:\windows\Microsoft.NET\Framework64\v4.0.30319\SetupCache\Extended\1032\SetupResources.dll
+ 2010-03-18 20:16 . 2010-03-18 20:16	18776              c:\windows\Microsoft.NET\Framework64\v4.0.30319\SetupCache\Extended\1031\SetupResources.dll
+ 2010-03-18 20:16 . 2010-03-18 20:16	18264              c:\windows\Microsoft.NET\Framework64\v4.0.30319\SetupCache\Extended\1030\SetupResources.dll
+ 2010-03-18 20:16 . 2010-03-18 20:16	18264              c:\windows\Microsoft.NET\Framework64\v4.0.30319\SetupCache\Extended\1029\SetupResources.dll
+ 2010-03-18 20:16 . 2010-03-18 20:16	14168              c:\windows\Microsoft.NET\Framework64\v4.0.30319\SetupCache\Extended\1028\SetupResources.dll
+ 2010-03-18 20:16 . 2010-03-18 20:16	17240              c:\windows\Microsoft.NET\Framework64\v4.0.30319\SetupCache\Extended\1025\SetupResources.dll
+ 2010-03-18 21:23 . 2010-03-18 21:23	20840              c:\windows\Microsoft.NET\Framework64\v4.0.30319\ServiceMonikerSupport.dll
+ 2010-03-18 21:23 . 2010-03-18 21:23	16208              c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsn.dll
+ 2010-03-18 20:47 . 2010-03-18 20:47	21880              c:\windows\Microsoft.NET\Framework64\v4.0.30319\Microsoft.Workflow.Compiler.exe
+ 2010-03-18 20:47 . 2010-03-18 20:47	40304              c:\windows\Microsoft.NET\Framework64\v4.0.30319\Microsoft.VisualC.STLCLR.dll
+ 2010-03-18 20:47 . 2010-03-18 20:47	38784              c:\windows\Microsoft.NET\Framework64\v4.0.30319\Microsoft.Data.Entity.Build.Tasks.dll
+ 2010-03-18 20:47 . 2010-03-18 20:47	67968              c:\windows\Microsoft.NET\Framework64\v4.0.30319\Microsoft.Build.Conversion.v4.0.dll
+ 2010-03-18 20:47 . 2010-03-18 20:47	84296              c:\windows\Microsoft.NET\Framework64\v4.0.30319\EdmGen.exe
+ 2010-03-18 20:47 . 2010-03-18 20:47	60248              c:\windows\Microsoft.NET\Framework64\v4.0.30319\DataSvcUtil.exe
+ 2010-03-18 21:23 . 2010-03-18 21:23	40784              c:\windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe
+ 2010-03-18 21:23 . 2010-03-18 21:23	44376              c:\windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe
+ 2010-03-18 21:23 . 2010-03-18 21:23	36696              c:\windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regiis.exe
+ 2010-03-18 21:23 . 2010-03-18 21:23	19296              c:\windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regbrowsers.exe
+ 2010-03-18 21:23 . 2010-03-18 21:23	78160              c:\windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_rc.dll
+ 2010-03-18 21:23 . 2010-03-18 21:23	36184              c:\windows\Microsoft.NET\Framework64\v4.0.30319\Aspnet_perf.dll
+ 2010-03-18 21:23 . 2010-03-18 21:23	15704              c:\windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_isapi.dll
+ 2010-03-18 21:23 . 2010-03-18 21:23	29528              c:\windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_filter.dll
+ 2010-03-18 21:23 . 2010-03-18 21:23	29536              c:\windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe
+ 2010-03-18 21:23 . 2010-03-18 21:23	11608              c:\windows\Microsoft.NET\Framework64\v4.0.30319\1033\FileTrackerUI.dll
+ 2010-03-18 20:47 . 2010-03-18 20:47	97624              c:\windows\Microsoft.NET\Framework\v4.0.30319\XamlBuildTask.dll
+ 2010-03-18 20:47 . 2010-03-18 20:47	14160              c:\windows\Microsoft.NET\Framework\v4.0.30319\webengine.dll
+ 2010-03-18 20:47 . 2010-03-18 20:47	69960              c:\windows\Microsoft.NET\Framework\v4.0.30319\TLBREF.DLL
+ 2010-03-18 20:47 . 2010-03-18 20:47	29544              c:\windows\Microsoft.NET\Framework\v4.0.30319\System.Xaml.Hosting.dll
+ 2010-03-18 20:47 . 2010-03-18 20:47	70040              c:\windows\Microsoft.NET\Framework\v4.0.30319\System.Windows.Forms.DataVisualization.Design.dll
+ 2010-03-18 20:47 . 2010-03-18 20:47	24928              c:\windows\Microsoft.NET\Framework\v4.0.30319\System.Web.Routing.dll
+ 2010-03-18 20:47 . 2010-03-18 20:47	81272              c:\windows\Microsoft.NET\Framework\v4.0.30319\System.Web.RegularExpressions.dll
+ 2010-03-18 20:47 . 2010-03-18 20:47	33144              c:\windows\Microsoft.NET\Framework\v4.0.30319\System.Web.DynamicData.Design.dll
+ 2010-03-18 20:47 . 2010-03-18 20:47	93576              c:\windows\Microsoft.NET\Framework\v4.0.30319\System.Web.DataVisualization.Design.dll
+ 2010-03-18 20:47 . 2010-03-18 20:47	24944              c:\windows\Microsoft.NET\Framework\v4.0.30319\System.Web.Abstractions.dll
+ 2010-03-18 20:47 . 2010-03-18 20:47	28024              c:\windows\Microsoft.NET\Framework\v4.0.30319\System.ServiceModel.WasHosting.dll
+ 2010-03-18 20:47 . 2010-03-18 20:47	12168              c:\windows\Microsoft.NET\Framework\v4.0.30319\System.ServiceModel.ServiceMoniker40.dll
+ 2010-03-18 20:47 . 2010-03-18 20:47	95592              c:\windows\Microsoft.NET\Framework\v4.0.30319\System.Runtime.Caching.dll
+ 2010-03-18 20:47 . 2010-03-18 20:47	86888              c:\windows\Microsoft.NET\Framework\v4.0.30319\System.Drawing.Design.dll
+ 2010-03-18 20:47 . 2010-03-18 20:47	17256              c:\windows\Microsoft.NET\Framework\v4.0.30319\ServiceMonikerSupport.dll
+ 2010-03-18 20:47 . 2010-03-18 20:47	15184              c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsn.dll
+ 2010-03-18 20:47 . 2010-03-18 20:47	96592              c:\windows\Microsoft.NET\Framework\v4.0.30319\MmcAspExt.dll
+ 2010-03-18 20:47 . 2010-03-18 20:47	21880              c:\windows\Microsoft.NET\Framework\v4.0.30319\Microsoft.Workflow.Compiler.exe
+ 2010-03-18 20:47 . 2010-03-18 20:47	40304              c:\windows\Microsoft.NET\Framework\v4.0.30319\Microsoft.VisualC.STLCLR.dll
+ 2010-03-18 20:47 . 2010-03-18 20:47	38784              c:\windows\Microsoft.NET\Framework\v4.0.30319\Microsoft.Data.Entity.Build.Tasks.dll
+ 2010-03-18 20:47 . 2010-03-18 20:47	67968              c:\windows\Microsoft.NET\Framework\v4.0.30319\Microsoft.Build.Conversion.v4.0.dll
+ 2010-03-18 20:47 . 2010-03-18 20:47	84296              c:\windows\Microsoft.NET\Framework\v4.0.30319\EdmGen.exe
+ 2010-03-18 20:47 . 2010-03-18 20:47	60248              c:\windows\Microsoft.NET\Framework\v4.0.30319\DataSvcUtil.exe
+ 2010-03-18 20:47 . 2010-03-18 20:47	32592              c:\windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe
+ 2010-03-18 20:47 . 2010-03-18 20:47	35160              c:\windows\Microsoft.NET\Framework\v4.0.30319\aspnet_state.exe
+ 2010-03-18 20:47 . 2010-03-18 20:47	30040              c:\windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe
+ 2010-03-18 20:47 . 2010-03-18 20:47	19808              c:\windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe
+ 2010-03-18 20:47 . 2010-03-18 20:47	78160              c:\windows\Microsoft.NET\Framework\v4.0.30319\aspnet_rc.dll
+ 2010-03-18 20:47 . 2010-03-18 20:47	30040              c:\windows\Microsoft.NET\Framework\v4.0.30319\Aspnet_perf.dll
+ 2010-03-18 20:47 . 2010-03-18 20:47	14168              c:\windows\Microsoft.NET\Framework\v4.0.30319\aspnet_isapi.dll
+ 2010-03-18 20:47 . 2010-03-18 20:47	24408              c:\windows\Microsoft.NET\Framework\v4.0.30319\aspnet_filter.dll
+ 2010-03-18 20:47 . 2010-03-18 20:47	30048              c:\windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
+ 2010-03-18 20:47 . 2010-03-18 20:47	11608              c:\windows\Microsoft.NET\Framework\v4.0.30319\1033\FileTrackerUI.dll
+ 2012-07-03 23:40 . 2012-07-03 23:40	97624              c:\windows\Microsoft.NET\assembly\GAC_MSIL\XamlBuildTask\v4.0_4.0.0.0__31bf3856ad364e35\XamlBuildTask.dll
+ 2012-07-03 23:40 . 2012-07-03 23:40	29544              c:\windows\Microsoft.NET\assembly\GAC_MSIL\System.Xaml.Hosting\v4.0_4.0.0.0__31bf3856ad364e35\System.Xaml.Hosting.dll
+ 2012-07-03 23:40 . 2012-07-03 23:40	70040              c:\windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms.DataVisualization.Design\v4.0_4.0.0.0__31bf3856ad364e35\System.Windows.Forms.DataVisualization.Design.dll
+ 2012-07-03 23:40 . 2012-07-03 23:40	24928              c:\windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Routing\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Routing.dll
+ 2012-07-03 23:40 . 2012-07-03 23:40	81272              c:\windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.RegularExpressions\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.RegularExpressions.dll
+ 2012-07-03 23:40 . 2012-07-03 23:40	33144              c:\windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.DynamicData.Design\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.DynamicData.Design.dll
+ 2012-07-03 23:40 . 2012-07-03 23:40	93576              c:\windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.DataVisualization.Design\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.DataVisualization.Design.dll
+ 2012-07-03 23:40 . 2012-07-03 23:40	24944              c:\windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Abstractions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Abstractions.dll
+ 2012-07-03 23:40 . 2012-07-03 23:40	28024              c:\windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.WasHosting\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.WasHosting.dll
+ 2012-07-03 23:40 . 2012-07-03 23:40	12168              c:\windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.ServiceMoniker40\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.ServiceMoniker40.dll
+ 2012-07-03 23:40 . 2012-07-03 23:40	95592              c:\windows\Microsoft.NET\assembly\GAC_MSIL\System.Runtime.Caching\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Runtime.Caching.dll
+ 2012-07-03 23:40 . 2012-07-03 23:40	86888              c:\windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing.Design\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.Design.dll
+ 2012-07-03 23:40 . 2012-07-03 23:40	21880              c:\windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Workflow.Compiler\v4.0_4.0.0.0__31bf3856ad364e35\Microsoft.Workflow.Compiler.exe
+ 2012-07-03 23:40 . 2012-07-03 23:40	40304              c:\windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualC.STLCLR\v4.0_2.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualC.STLCLR.dll
+ 2012-07-03 23:40 . 2012-07-03 23:40	67968              c:\windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Build.Conversion.v4.0\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.Conversion.v4.0.dll
+ 2012-07-13 16:05 . 2012-07-13 16:05	25600              c:\windows\Installer\3c43fd25.msi
+ 2012-07-04 00:54 . 2012-07-04 00:54	70656              c:\windows\assembly\NativeImages_v4.0.30319_64\System.Xaml.Hosting\f84681d68eb182cc7e26d26fe96f757b\System.Xaml.Hosting.ni.dll
+ 2012-07-04 03:00 . 2012-07-04 03:00	26112              c:\windows\assembly\NativeImages_v4.0.30319_64\System.Web.Routing\df33d56dcdde38c15a777ebc79836fc5\System.Web.Routing.ni.dll
+ 2012-07-04 03:00 . 2012-07-04 03:00	53760              c:\windows\assembly\NativeImages_v4.0.30319_64\System.Web.DynamicD#\4d80937fb3cbed37c5692c616ff87719\System.Web.DynamicData.Design.ni.dll
+ 2012-07-04 03:00 . 2012-07-04 03:00	26112              c:\windows\assembly\NativeImages_v4.0.30319_64\System.Web.Abstract#\4f6bef518b1bb0ae5d892588eccdcf25\System.Web.Abstractions.ni.dll
+ 2012-07-04 03:00 . 2012-07-04 03:00	13824              c:\windows\assembly\NativeImages_v4.0.30319_64\System.ServiceModel#\a8258e28b61cad85c49c97273a2aae55\System.ServiceModel.ServiceMoniker40.ni.dll
+ 2012-07-04 00:52 . 2012-07-04 00:52	47616              c:\windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Workflow.#\c74328b7d9f2b5cf7f74cd4b55041ee7\Microsoft.Workflow.Compiler.ni.exe
+ 2012-07-04 02:59 . 2012-07-04 02:59	54784              c:\windows\assembly\NativeImages_v4.0.30319_32\System.Xaml.Hosting\93813207354e9ee0cf07912339da8fb0\System.Xaml.Hosting.ni.dll
+ 2012-07-04 03:00 . 2012-07-04 03:00	24064              c:\windows\assembly\NativeImages_v4.0.30319_32\System.Web.Routing\d8f7bf8ce78d0785e68c589c1e64a6dd\System.Web.Routing.ni.dll
+ 2012-07-04 03:00 . 2012-07-04 03:00	46592              c:\windows\assembly\NativeImages_v4.0.30319_32\System.Web.DynamicD#\f3fc1752bb41778b7fcc005edeb20410\System.Web.DynamicData.Design.ni.dll
+ 2012-07-04 02:59 . 2012-07-04 02:59	24576              c:\windows\assembly\NativeImages_v4.0.30319_32\System.Web.Abstract#\31ec874a9482ad1a99ba24ca4a6ec914\System.Web.Abstractions.ni.dll
+ 2012-07-04 02:59 . 2012-07-04 02:59	12288              c:\windows\assembly\NativeImages_v4.0.30319_32\System.ServiceModel#\703ffb7a271059d40edeff9eb0e2b7e3\System.ServiceModel.ServiceMoniker40.ni.dll
+ 2012-07-04 02:59 . 2012-07-04 02:59	37888              c:\windows\assembly\NativeImages_v4.0.30319_32\Microsoft.Workflow.#\f519738a47ffedaa4c04ec6e16a6b7b1\Microsoft.Workflow.Compiler.ni.exe
+ 2012-07-14 01:10 . 2012-07-14 01:10	2048              c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
+ 2012-07-14 01:10 . 2012-07-14 01:10	2048              c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
- 2012-06-21 00:08 . 2012-06-21 00:08	2048              c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
+ 2010-03-18 13:15 . 2010-03-18 13:15	770384              c:\windows\SysWOW64\msvcr100.dll
+ 2010-03-18 13:15 . 2010-03-18 13:15	421200              c:\windows\SysWOW64\msvcp100.dll
+ 2012-06-24 21:45 . 2012-06-24 21:45	686280              c:\windows\SysWOW64\Macromed\Flash\FlashUtil32_11_3_300_262_Plugin.exe
+ 2010-01-27 00:58 . 2010-01-27 00:58	256280              c:\windows\SysWOW64\Macromed\Flash\FlashUtil10e.exe
+ 2012-06-24 21:45 . 2012-06-24 21:45	250056              c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
+ 2009-07-14 04:54 . 2012-06-28 22:33	311296              c:\windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
+ 2010-03-18 13:15 . 2010-03-18 13:15	138056              c:\windows\SysWOW64\atl100.dll
+ 2012-06-23 12:12 . 2012-06-28 22:25	262144              c:\windows\SysWOW64\%APPDATA%\Microsoft\Windows\IETldCache\index.dat
+ 2009-07-14 02:36 . 2012-07-07 22:14	660172              c:\windows\system32\perfh009.dat
+ 2009-07-14 02:36 . 2012-07-07 22:14	121100              c:\windows\system32\perfc009.dat
+ 2011-04-20 19:42 . 2012-02-23 14:18	279656              c:\windows\system32\MpSigStub.exe
+ 2012-06-24 21:45 . 2012-06-24 21:45	417992              c:\windows\system32\Macromed\Flash\FlashUtil64_11_3_300_262_Plugin.exe
+ 2009-07-14 05:30 . 2012-06-24 13:47	143360              c:\windows\system32\DriverStore\infstrng.dat
- 2009-07-14 05:30 . 2012-06-17 19:49	143360              c:\windows\system32\DriverStore\infstrng.dat
- 2009-07-14 05:30 . 2012-06-17 19:49	143360              c:\windows\system32\DriverStore\infstor.dat
+ 2009-07-14 05:30 . 2012-06-24 13:47	143360              c:\windows\system32\DriverStore\infstor.dat
+ 2009-07-14 05:01 . 2012-07-14 01:10	513088              c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-System.dat
- 2009-07-14 05:01 . 2012-06-21 00:08	513088              c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-System.dat
+ 2010-03-18 20:47 . 2010-03-18 20:47	142672              c:\windows\Microsoft.NET\Framework64\v4.0.30319\WsatConfig.exe
+ 2010-03-18 20:47 . 2010-03-18 20:47	587624              c:\windows\Microsoft.NET\Framework64\v4.0.30319\WPF\PresentationBuildTasks.dll
+ 2010-03-18 21:23 . 2010-03-18 21:23	717136              c:\windows\Microsoft.NET\Framework64\v4.0.30319\webengine4.dll
+ 2010-03-18 20:47 . 2010-03-18 20:47	431984              c:\windows\Microsoft.NET\Framework64\v4.0.30319\System.WorkflowServices.dll
+ 2010-03-18 20:47 . 2010-03-18 20:47	511344              c:\windows\Microsoft.NET\Framework64\v4.0.30319\System.Workflow.Runtime.dll
+ 2010-03-18 20:47 . 2010-03-18 20:47	826208              c:\windows\Microsoft.NET\Framework64\v4.0.30319\System.Web.Mobile.dll
+ 2010-03-18 20:47 . 2010-03-18 20:47	321912              c:\windows\Microsoft.NET\Framework64\v4.0.30319\System.Web.Extensions.Design.dll
+ 2010-03-18 20:47 . 2010-03-18 20:47	137568              c:\windows\Microsoft.NET\Framework64\v4.0.30319\System.Web.Entity.dll
+ 2010-03-18 20:47 . 2010-03-18 20:47	132464              c:\windows\Microsoft.NET\Framework64\v4.0.30319\System.Web.Entity.Design.dll
+ 2010-03-18 20:47 . 2010-03-18 20:47	237928              c:\windows\Microsoft.NET\Framework64\v4.0.30319\System.Web.DynamicData.dll
+ 2010-03-18 20:47 . 2010-03-18 20:47	316272              c:\windows\Microsoft.NET\Framework64\v4.0.30319\System.ServiceModel.Web.dll
+ 2010-03-18 20:47 . 2010-03-18 20:47	170872              c:\windows\Microsoft.NET\Framework64\v4.0.30319\System.ServiceModel.Activation.dll
+ 2010-03-18 20:47 . 2010-03-18 20:47	683368              c:\windows\Microsoft.NET\Framework64\v4.0.30319\System.Data.Services.dll
+ 2010-03-18 20:47 . 2010-03-18 20:47	178040              c:\windows\Microsoft.NET\Framework64\v4.0.30319\System.Data.Services.Design.dll
+ 2010-03-18 21:23 . 2010-03-18 21:23	512368              c:\windows\Microsoft.NET\Framework64\v4.0.30319\System.Data.OracleClient.dll
+ 2010-03-18 20:47 . 2010-03-18 20:47	804720              c:\windows\Microsoft.NET\Framework64\v4.0.30319\System.Data.Entity.Design.dll
+ 2009-08-31 10:44 . 2009-08-31 10:44	144416              c:\windows\Microsoft.NET\Framework64\v4.0.30319\SetupCache\Extended\sqmapi.dll
+ 2010-03-18 20:16 . 2010-03-18 20:16	295248              c:\windows\Microsoft.NET\Framework64\v4.0.30319\SetupCache\Extended\SetupUi.dll
+ 2010-03-18 20:16 . 2010-03-18 20:16	807256              c:\windows\Microsoft.NET\Framework64\v4.0.30319\SetupCache\Extended\SetupEngine.dll
+ 2010-03-19 00:29 . 2010-03-19 00:29	872448              c:\windows\Microsoft.NET\Framework64\v4.0.30319\SetupCache\Extended\netfx_extended_x64.msi
+ 2010-03-18 21:23 . 2010-03-18 21:23	222544              c:\windows\Microsoft.NET\Framework64\v4.0.30319\peverify.dll
+ 2010-03-18 21:23 . 2010-03-18 21:23	132432              c:\windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe
+ 2010-03-18 21:23 . 2010-03-18 21:23	108880              c:\windows\Microsoft.NET\Framework64\v4.0.30319\MmcAspExt.dll
+ 2010-03-18 20:47 . 2010-03-18 20:47	220024              c:\windows\Microsoft.NET\Framework64\v4.0.30319\Microsoft.Build.Utilities.v4.0.dll
+ 2010-03-18 20:47 . 2010-03-18 20:47	107376              c:\windows\Microsoft.NET\Framework64\v4.0.30319\Microsoft.Build.Framework.dll
+ 2010-03-18 20:47 . 2010-03-18 20:47	714600              c:\windows\Microsoft.NET\Framework64\v4.0.30319\Microsoft.Build.Engine.dll
+ 2010-03-18 21:23 . 2010-03-18 21:23	351560              c:\windows\Microsoft.NET\Framework64\v4.0.30319\ilasm.exe
+ 2010-03-18 21:23 . 2010-03-18 21:23	221016              c:\windows\Microsoft.NET\Framework64\v4.0.30319\FileTracker.dll
+ 2010-03-18 20:47 . 2010-03-18 20:47	163672              c:\windows\Microsoft.NET\Framework64\v4.0.30319\ComSvcConfig.exe
+ 2010-03-18 21:23 . 2010-03-18 21:23	155984              c:\windows\Microsoft.NET\Framework64\v4.0.30319\clretwrc.dll
+ 2010-03-18 20:47 . 2010-03-18 20:47	498520              c:\windows\Microsoft.NET\Framework64\v4.0.30319\AspNetMMCExt.dll
+ 2010-03-18 21:23 . 2010-03-18 21:23	102232              c:\windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regsql.exe
+ 2010-03-18 20:47 . 2010-03-18 20:47	142672              c:\windows\Microsoft.NET\Framework\v4.0.30319\WsatConfig.exe
+ 2010-03-18 20:47 . 2010-03-18 20:47	587624              c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\PresentationBuildTasks.dll
+ 2010-03-18 20:47 . 2010-03-18 20:47	492368              c:\windows\Microsoft.NET\Framework\v4.0.30319\webengine4.dll
+ 2010-03-18 20:47 . 2010-03-18 20:47	431984              c:\windows\Microsoft.NET\Framework\v4.0.30319\System.WorkflowServices.dll
+ 2010-03-18 20:47 . 2010-03-18 20:47	511344              c:\windows\Microsoft.NET\Framework\v4.0.30319\System.Workflow.Runtime.dll
+ 2010-03-18 20:47 . 2010-03-18 20:47	826208              c:\windows\Microsoft.NET\Framework\v4.0.30319\System.Web.Mobile.dll
+ 2010-03-18 20:47 . 2010-03-18 20:47	321912              c:\windows\Microsoft.NET\Framework\v4.0.30319\System.Web.Extensions.Design.dll
+ 2010-03-18 20:47 . 2010-03-18 20:47	137568              c:\windows\Microsoft.NET\Framework\v4.0.30319\System.Web.Entity.dll
+ 2010-03-18 20:47 . 2010-03-18 20:47	132464              c:\windows\Microsoft.NET\Framework\v4.0.30319\System.Web.Entity.Design.dll
+ 2010-03-18 20:47 . 2010-03-18 20:47	237928              c:\windows\Microsoft.NET\Framework\v4.0.30319\System.Web.DynamicData.dll
+ 2010-03-18 20:47 . 2010-03-18 20:47	316272              c:\windows\Microsoft.NET\Framework\v4.0.30319\System.ServiceModel.Web.dll
+ 2010-03-18 20:47 . 2010-03-18 20:47	170872              c:\windows\Microsoft.NET\Framework\v4.0.30319\System.ServiceModel.Activation.dll
+ 2010-03-18 20:47 . 2010-03-18 20:47	683368              c:\windows\Microsoft.NET\Framework\v4.0.30319\System.Data.Services.dll
+ 2010-03-18 20:47 . 2010-03-18 20:47	178040              c:\windows\Microsoft.NET\Framework\v4.0.30319\System.Data.Services.Design.dll
+ 2010-03-18 20:47 . 2010-03-18 20:47	495984              c:\windows\Microsoft.NET\Framework\v4.0.30319\System.Data.OracleClient.dll
+ 2010-03-18 20:47 . 2010-03-18 20:47	804720              c:\windows\Microsoft.NET\Framework\v4.0.30319\System.Data.Entity.Design.dll
+ 2010-03-18 20:47 . 2010-03-18 20:47	181584              c:\windows\Microsoft.NET\Framework\v4.0.30319\peverify.dll
+ 2010-03-18 20:47 . 2010-03-18 20:47	132944              c:\windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
+ 2010-03-18 20:47 . 2010-03-18 20:47	220024              c:\windows\Microsoft.NET\Framework\v4.0.30319\Microsoft.Build.Utilities.v4.0.dll
+ 2010-03-18 20:47 . 2010-03-18 20:47	107376              c:\windows\Microsoft.NET\Framework\v4.0.30319\Microsoft.Build.Framework.dll
+ 2010-03-18 20:47 . 2010-03-18 20:47	714600              c:\windows\Microsoft.NET\Framework\v4.0.30319\Microsoft.Build.Engine.dll
+ 2010-03-18 20:47 . 2010-03-18 20:47	294728              c:\windows\Microsoft.NET\Framework\v4.0.30319\ilasm.exe
+ 2010-03-18 20:47 . 2010-03-18 20:47	173400              c:\windows\Microsoft.NET\Framework\v4.0.30319\FileTracker.dll
+ 2010-03-18 20:47 . 2010-03-18 20:47	163672              c:\windows\Microsoft.NET\Framework\v4.0.30319\ComSvcConfig.exe
+ 2010-03-18 20:47 . 2010-03-18 20:47	155472              c:\windows\Microsoft.NET\Framework\v4.0.30319\clretwrc.dll
+ 2010-03-18 20:47 . 2010-03-18 20:47	498520              c:\windows\Microsoft.NET\Framework\v4.0.30319\AspNetMMCExt.dll
+ 2010-03-18 20:47 . 2010-03-18 20:47	102744              c:\windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regsql.exe
+ 2012-07-03 23:40 . 2012-07-03 23:40	431984              c:\windows\Microsoft.NET\assembly\GAC_MSIL\System.WorkflowServices\v4.0_4.0.0.0__31bf3856ad364e35\System.WorkflowServices.dll
+ 2012-07-03 23:40 . 2012-07-03 23:40	511344              c:\windows\Microsoft.NET\assembly\GAC_MSIL\System.Workflow.Runtime\v4.0_4.0.0.0__31bf3856ad364e35\System.Workflow.Runtime.dll
+ 2012-07-03 23:40 . 2012-07-03 23:40	826208              c:\windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Mobile\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.Mobile.dll
+ 2012-07-03 23:40 . 2012-07-03 23:40	321912              c:\windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions.Design\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.Design.dll
+ 2012-07-03 23:40 . 2012-07-03 23:40	137568              c:\windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Entity\v4.0_4.0.0.0__b77a5c561934e089\System.Web.Entity.dll
+ 2012-07-03 23:40 . 2012-07-03 23:40	132464              c:\windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Entity.Design\v4.0_4.0.0.0__b77a5c561934e089\System.Web.Entity.Design.dll
+ 2012-07-03 23:40 . 2012-07-03 23:40	237928              c:\windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.DynamicData\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.DynamicData.dll
+ 2012-07-03 23:40 . 2012-07-03 23:40	316272              c:\windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Web\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Web.dll
+ 2012-07-03 23:40 . 2012-07-03 23:40	170872              c:\windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Activation\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Activation.dll
+ 2012-07-03 23:40 . 2012-07-03 23:40	683368              c:\windows\Microsoft.NET\assembly\GAC_MSIL\System.Data.Services\v4.0_4.0.0.0__b77a5c561934e089\System.Data.Services.dll
+ 2012-07-03 23:40 . 2012-07-03 23:40	178040              c:\windows\Microsoft.NET\assembly\GAC_MSIL\System.Data.Services.Design\v4.0_4.0.0.0__b77a5c561934e089\System.Data.Services.Design.dll
+ 2012-07-03 23:40 . 2012-07-03 23:40	804720              c:\windows\Microsoft.NET\assembly\GAC_MSIL\System.Data.Entity.Design\v4.0_4.0.0.0__b77a5c561934e089\System.Data.Entity.Design.dll
+ 2012-07-03 23:40 . 2012-07-03 23:40	587624              c:\windows\Microsoft.NET\assembly\GAC_MSIL\PresentationBuildTasks\v4.0_4.0.0.0__31bf3856ad364e35\PresentationBuildTasks.dll
+ 2012-07-03 23:40 . 2012-07-03 23:40	220024              c:\windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Build.Utilities.v4.0\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.Utilities.v4.0.dll
+ 2012-07-03 23:40 . 2012-07-03 23:40	107376              c:\windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Build.Framework\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.Framework.dll
+ 2012-07-03 23:40 . 2012-07-03 23:40	714600              c:\windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Build.Engine\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.Engine.dll
+ 2012-07-03 23:40 . 2012-07-03 23:40	498520              c:\windows\Microsoft.NET\assembly\GAC_MSIL\AspNetMMCExt\v4.0_4.0.0.0__b03f5f7f11d50a3a\AspNetMMCExt.dll
+ 2012-07-03 23:40 . 2012-07-03 23:40	512368              c:\windows


----------



## Motorcharge

\Microsoft.NET\assembly\GAC_64\System.Data.OracleClient\v4.0_4.0.0.0__b77a5c561934e089\System.Data.OracleClient.dll
+ 2012-07-03 23:39 . 2012-07-03 23:39	495984              c:\windows\Microsoft.NET\assembly\GAC_32\System.Data.OracleClient\v4.0_4.0.0.0__b77a5c561934e089\System.Data.OracleClient.dll
+ 2010-03-19 13:19 . 2010-03-19 13:19	155136              c:\windows\Installer\a628639.msi
+ 2010-03-19 00:29 . 2010-03-19 00:29	872448              c:\windows\Installer\a5ff4f3.msi
+ 2012-07-08 07:05 . 2012-07-08 07:05	371272              c:\windows\Installer\{EE7257A2-39A2-4D2F-9DAC-F9F25B8AE1D8}\SkypeIcon.exe
- 2012-06-08 14:13 . 2012-06-08 14:13	371272              c:\windows\Installer\{EE7257A2-39A2-4D2F-9DAC-F9F25B8AE1D8}\SkypeIcon.exe
+ 2012-07-08 04:15 . 2012-07-08 04:15	102400              c:\windows\Installer\{86D4B82A-ABED-442A-BE86-96357B70F4FE}\ARPPRODUCTICON.exe
+ 2012-07-04 03:01 . 2012-07-04 03:01	553984              c:\windows\assembly\NativeImages_v4.0.30319_64\XamlBuildTask\d7ba8f0a500f25cbed7daa07e8d748ec\XamlBuildTask.ni.dll
+ 2012-07-04 00:52 . 2012-07-04 00:52	462336              c:\windows\assembly\NativeImages_v4.0.30319_64\WsatConfig\c87183cbec623926230118ddb9c93662\WsatConfig.ni.exe
+ 2012-07-04 03:00 . 2012-07-04 03:00	243712              c:\windows\assembly\NativeImages_v4.0.30319_64\System.Windows.Form#\6ade3ca0064ec4387fd905877e1d56b8\System.Windows.Forms.DataVisualization.Design.ni.dll
+ 2012-07-04 00:53 . 2012-07-04 00:53	314880              c:\windows\assembly\NativeImages_v4.0.30319_64\System.Web.RegularE#\31c9a177e71d9ded2a09252d362bab1d\System.Web.RegularExpressions.ni.dll
+ 2012-07-04 03:00 . 2012-07-04 03:00	446464              c:\windows\assembly\NativeImages_v4.0.30319_64\System.Web.Entity\39d7c8787069c77987c558d814cac079\System.Web.Entity.ni.dll
+ 2012-07-04 03:00 . 2012-07-04 03:00	366592              c:\windows\assembly\NativeImages_v4.0.30319_64\System.Web.Entity.D#\3ff2fa87603d75f313a66cc051b0f5c7\System.Web.Entity.Design.ni.dll
+ 2012-07-04 03:00 . 2012-07-04 03:00	970240              c:\windows\assembly\NativeImages_v4.0.30319_64\System.Web.DynamicD#\85c01837b7d52831601939d52c0cd04e\System.Web.DynamicData.ni.dll
+ 2012-07-04 03:00 . 2012-07-04 03:00	329728              c:\windows\assembly\NativeImages_v4.0.30319_64\System.Web.DataVisu#\e6e7ba45676b869bf66bfd909d7e4fd0\System.Web.DataVisualization.Design.ni.dll
+ 2012-07-04 00:54 . 2012-07-04 00:54	578048              c:\windows\assembly\NativeImages_v4.0.30319_64\System.ServiceModel#\9b43e24c0322e7c075406de9f8c24f37\System.ServiceModel.Activation.ni.dll
+ 2012-07-04 00:53 . 2012-07-04 00:53	994304              c:\windows\assembly\NativeImages_v4.0.30319_64\System.Runtime.Remo#\9b42e3a6e2cd58e1859d8f503e2f3808\System.Runtime.Remoting.ni.dll
+ 2012-07-04 00:53 . 2012-07-04 00:53	308224              c:\windows\assembly\NativeImages_v4.0.30319_64\System.Runtime.Cach#\df3f39d99e99235afbdce9c30b3a9d48\System.Runtime.Caching.ni.dll
+ 2012-07-04 00:53 . 2012-07-04 00:53	292352              c:\windows\assembly\NativeImages_v4.0.30319_64\System.Drawing.Desi#\cfe9bb29ab62c2263c904bc321a26bec\System.Drawing.Design.ni.dll
+ 2012-07-04 00:54 . 2012-07-04 00:54	661504              c:\windows\assembly\NativeImages_v4.0.30319_64\System.Data.Service#\1e723235ab95da7e59d03da7901857d9\System.Data.Services.Design.ni.dll
+ 2012-07-04 00:52 . 2012-07-04 00:52	364544              c:\windows\assembly\NativeImages_v4.0.30319_64\MSBuild\d448d55698c8471a921d17e20c0ac885\MSBuild.ni.exe
+ 2012-07-04 00:53 . 2012-07-04 00:53	851456              c:\windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Build.Uti#\0e541d178a5797ec61d0b97058e6cc2e\Microsoft.Build.Utilities.v4.0.ni.dll
+ 2012-07-04 00:52 . 2012-07-04 00:52	353792              c:\windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Build.Fra#\60fcea7acc6c048071451efa6d2f5fa6\Microsoft.Build.Framework.ni.dll
+ 2012-07-04 00:52 . 2012-07-04 00:52	661504              c:\windows\assembly\NativeImages_v4.0.30319_64\ComSvcConfig\57a507991f1e7aeb0d3014fa0d3bbd2c\ComSvcConfig.ni.exe
+ 2012-07-04 03:00 . 2012-07-04 03:00	404992              c:\windows\assembly\NativeImages_v4.0.30319_32\XamlBuildTask\09f78ad9517d5d19de8498bac32fc9f8\XamlBuildTask.ni.dll
+ 2012-07-04 02:59 . 2012-07-04 02:59	356864              c:\windows\assembly\NativeImages_v4.0.30319_32\WsatConfig\a61f64155e6b58da21013a5e4d6805c2\WsatConfig.ni.exe
+ 2012-07-04 03:00 . 2012-07-04 03:00	194560              c:\windows\assembly\NativeImages_v4.0.30319_32\System.Windows.Form#\4cf2b2fb097e9f0e86bb6282ae407f38\System.Windows.Forms.DataVisualization.Design.ni.dll
+ 2012-07-04 02:59 . 2012-07-04 02:59	224256              c:\windows\assembly\NativeImages_v4.0.30319_32\System.Web.RegularE#\ea0b825a2dd1a056f6171170eb072d4a\System.Web.RegularExpressions.ni.dll
+ 2012-07-04 03:00 . 2012-07-04 03:00	861696              c:\windows\assembly\NativeImages_v4.0.30319_32\System.Web.Extensio#\a894d26d652bfc6ac4830fb2f70617a9\System.Web.Extensions.Design.ni.dll
+ 2012-07-04 03:00 . 2012-07-04 03:00	333824              c:\windows\assembly\NativeImages_v4.0.30319_32\System.Web.Entity\e2af30b84b1578b6f104141c1599dd8a\System.Web.Entity.ni.dll
+ 2012-07-04 03:00 . 2012-07-04 03:00	297472              c:\windows\assembly\NativeImages_v4.0.30319_32\System.Web.Entity.D#\4470016734a7207843be5ab103e54617\System.Web.Entity.Design.ni.dll
+ 2012-07-04 03:00 . 2012-07-04 03:00	709632              c:\windows\assembly\NativeImages_v4.0.30319_32\System.Web.DynamicD#\c3531459f26b999ebc43cabbcf160f52\System.Web.DynamicData.ni.dll
+ 2012-07-04 03:00 . 2012-07-04 03:00	259584              c:\windows\assembly\NativeImages_v4.0.30319_32\System.Web.DataVisu#\5e61ee5474c0f76a50932fbb5c7c4df3\System.Web.DataVisualization.Design.ni.dll
+ 2012-07-04 02:59 . 2012-07-04 02:59	423424              c:\windows\assembly\NativeImages_v4.0.30319_32\System.ServiceModel#\c43f1fd03a4b2e3d5d2f7bc5cab6d4d9\System.ServiceModel.Activation.ni.dll
+ 2012-07-04 02:59 . 2012-07-04 02:59	771072              c:\windows\assembly\NativeImages_v4.0.30319_32\System.Runtime.Remo#\8c5442df8c423c3f53641723ab202576\System.Runtime.Remoting.ni.dll
+ 2012-07-04 02:59 . 2012-07-04 02:59	241664              c:\windows\assembly\NativeImages_v4.0.30319_32\System.Runtime.Cach#\422adb7d24779c5c2e89a02e183f35bb\System.Runtime.Caching.ni.dll
+ 2012-07-03 23:40 . 2012-07-03 23:40	226304              c:\windows\assembly\NativeImages_v4.0.30319_32\System.Drawing.Desi#\02fbf9c53252572c65734e4058139abc\System.Drawing.Design.ni.dll
+ 2012-07-04 02:59 . 2012-07-04 02:59	508928              c:\windows\assembly\NativeImages_v4.0.30319_32\System.Data.Service#\88d1242f0f9f61cdcd171ff51f61005e\System.Data.Services.Design.ni.dll
+ 2012-07-04 02:59 . 2012-07-04 02:59	274432              c:\windows\assembly\NativeImages_v4.0.30319_32\MSBuild\d47740fc85ad70c686adc9fc9dc6e7f5\MSBuild.ni.exe
+ 2012-07-04 02:59 . 2012-07-04 02:59	631296              c:\windows\assembly\NativeImages_v4.0.30319_32\Microsoft.Build.Uti#\3ad065635e1e0cd413081be61993cd38\Microsoft.Build.Utilities.v4.0.ni.dll
+ 2012-07-04 02:59 . 2012-07-04 02:59	258048              c:\windows\assembly\NativeImages_v4.0.30319_32\Microsoft.Build.Fra#\71a3a98ff5fb128d3abf6ecc3224ba6b\Microsoft.Build.Framework.ni.dll
+ 2012-07-04 02:59 . 2012-07-04 02:59	136192              c:\windows\assembly\NativeImages_v4.0.30319_32\Microsoft.Build.Con#\f18a2a149b3e7f9cf74de1263c2ee337\Microsoft.Build.Conversion.v4.0.ni.dll
+ 2012-07-04 02:59 . 2012-07-04 02:59	475136              c:\windows\assembly\NativeImages_v4.0.30319_32\ComSvcConfig\d1a54aac4ba266fc0ba95fd2be09098f\ComSvcConfig.ni.exe
+ 2012-07-04 02:59 . 2012-07-04 02:59	846336              c:\windows\assembly\NativeImages_v4.0.30319_32\AspNetMMCExt\f92703eb43edd152461756ff2d56ea46\AspNetMMCExt.ni.dll
+ 2010-03-18 13:15 . 2010-03-18 13:15	4368720              c:\windows\SysWOW64\mfc100u.dll
+ 2010-03-18 13:15 . 2010-03-18 13:15	4342088              c:\windows\SysWOW64\mfc100.dll
+ 2012-06-24 21:45 . 2012-06-24 21:45	9459912              c:\windows\SysWOW64\Macromed\Flash\NPSWF32_11_3_300_262.dll
+ 2012-06-24 21:45 . 2012-06-24 21:45	1535176              c:\windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_3_300_262.exe
+ 2009-07-14 04:54 . 2012-06-28 22:33	2539520              c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
- 2009-07-14 04:54 . 2012-06-20 23:55	2539520              c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
+ 2009-07-14 04:54 . 2012-06-28 22:33	7094272              c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2009-07-14 04:45 . 2012-06-25 01:13	6366312              c:\windows\system32\FNTCACHE.DAT
+ 2010-03-18 20:47 . 2010-03-18 20:47	1587064              c:\windows\Microsoft.NET\Framework64\v4.0.30319\System.Workflow.ComponentModel.dll
+ 2010-03-18 20:47 . 2010-03-18 20:47	1070960              c:\windows\Microsoft.NET\Framework64\v4.0.30319\System.Workflow.Activities.dll
+ 2010-03-18 20:47 . 2010-03-18 20:47	1836904              c:\windows\Microsoft.NET\Framework64\v4.0.30319\System.Web.Extensions.dll
+ 2010-03-18 21:23 . 2010-03-18 21:23	5145936              c:\windows\Microsoft.NET\Framework64\v4.0.30319\System.Web.dll
+ 2010-03-18 20:47 . 2010-03-18 20:47	1697144              c:\windows\Microsoft.NET\Framework64\v4.0.30319\System.Web.DataVisualization.dll
+ 2010-03-18 20:47 . 2010-03-18 20:47	5078360              c:\windows\Microsoft.NET\Framework64\v4.0.30319\System.Design.dll
+ 2010-03-18 20:47 . 2010-03-18 20:47	1064816              c:\windows\Microsoft.NET\Framework64\v4.0.30319\Microsoft.Build.Tasks.v4.0.dll
+ 2010-03-18 20:47 . 2010-03-18 20:47	1327968              c:\windows\Microsoft.NET\Framework64\v4.0.30319\Microsoft.Build.dll
+ 2010-03-18 20:47 . 2010-03-18 20:47	1587064              c:\windows\Microsoft.NET\Framework\v4.0.30319\System.Workflow.ComponentModel.dll
+ 2010-03-18 20:47 . 2010-03-18 20:47	1070960              c:\windows\Microsoft.NET\Framework\v4.0.30319\System.Workflow.Activities.dll
+ 2010-03-18 20:47 . 2010-03-18 20:47	1836904              c:\windows\Microsoft.NET\Framework\v4.0.30319\System.Web.Extensions.dll
+ 2010-03-18 20:47 . 2010-03-18 20:47	5174608              c:\windows\Microsoft.NET\Framework\v4.0.30319\System.Web.dll
+ 2010-03-18 20:47 . 2010-03-18 20:47	1697144              c:\windows\Microsoft.NET\Framework\v4.0.30319\System.Web.DataVisualization.dll
+ 2010-03-18 20:47 . 2010-03-18 20:47	5078360              c:\windows\Microsoft.NET\Framework\v4.0.30319\System.Design.dll
+ 2010-03-18 20:47 . 2010-03-18 20:47	1064816              c:\windows\Microsoft.NET\Framework\v4.0.30319\Microsoft.Build.Tasks.v4.0.dll
+ 2010-03-18 20:47 . 2010-03-18 20:47	1327968              c:\windows\Microsoft.NET\Framework\v4.0.30319\Microsoft.Build.dll
+ 2012-07-03 23:40 . 2012-07-03 23:40	1587064              c:\windows\Microsoft.NET\assembly\GAC_MSIL\System.Workflow.ComponentModel\v4.0_4.0.0.0__31bf3856ad364e35\System.Workflow.ComponentModel.dll
+ 2012-07-03 23:40 . 2012-07-03 23:40	1070960              c:\windows\Microsoft.NET\assembly\GAC_MSIL\System.Workflow.Activities\v4.0_4.0.0.0__31bf3856ad364e35\System.Workflow.Activities.dll
+ 2012-07-03 23:40 . 2012-07-03 23:40	1836904              c:\windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll
+ 2012-07-03 23:40 . 2012-07-03 23:40	1697144              c:\windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.DataVisualization\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.DataVisualization.dll
+ 2012-07-03 23:40 . 2012-07-03 23:40	5078360              c:\windows\Microsoft.NET\assembly\GAC_MSIL\System.Design\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Design.dll
+ 2012-07-03 23:40 . 2012-07-03 23:40	1327968              c:\windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Build\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.dll
+ 2012-07-03 23:40 . 2012-07-03 23:40	1064816              c:\windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Build.Tasks.v4.0\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.Tasks.v4.0.dll
+ 2012-07-03 23:40 . 2012-07-03 23:40	5145936              c:\windows\Microsoft.NET\assembly\GAC_64\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll
+ 2012-07-03 23:40 . 2012-07-03 23:40	5174608              c:\windows\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll
+ 2012-07-08 04:15 . 2012-07-08 04:15	3809280              c:\windows\Installer\1ff590f6.msi
+ 2012-07-04 03:00 . 2012-07-04 03:00	1601536              c:\windows\assembly\NativeImages_v4.0.30319_64\System.WorkflowServ#\72007285279e0d6357db504999c8e124\System.WorkflowServices.ni.dll
+ 2012-07-04 03:00 . 2012-07-04 03:00	2886656              c:\windows\assembly\NativeImages_v4.0.30319_64\System.Workflow.Run#\71539c40fc382c7e30eb5e1717f6fac7\System.Workflow.Runtime.ni.dll
+ 2012-07-04 03:00 . 2012-07-04 03:00	5921792              c:\windows\assembly\NativeImages_v4.0.30319_64\System.Workflow.Com#\7bd32fb577201b5240b2558d8d1f9a7e\System.Workflow.ComponentModel.ni.dll
+ 2012-07-04 03:00 . 2012-07-04 03:00	3743744              c:\windows\assembly\NativeImages_v4.0.30319_64\System.Workflow.Act#\ec781c38aff4dff4f53675068f55ced8\System.Workflow.Activities.ni.dll
+ 2012-07-04 00:53 . 2012-07-04 00:53	2284544              c:\windows\assembly\NativeImages_v4.0.30319_64\System.Web.Services\13fa0cee801d37b2238052e053863f24\System.Web.Services.ni.dll
+ 2012-07-04 03:00 . 2012-07-04 03:00	2957312              c:\windows\assembly\NativeImages_v4.0.30319_64\System.Web.Mobile\547a0c7acf453e3c8919568476c6ee60\System.Web.Mobile.ni.dll
+ 2012-07-04 00:54 . 2012-07-04 00:54	3767296              c:\windows\assembly\NativeImages_v4.0.30319_64\System.Web.Extensio#\7b05d9433656ff2319a30220a6787ca6\System.Web.Extensions.ni.dll
+ 2012-07-04 03:00 . 2012-07-04 03:00	1096704              c:\windows\assembly\NativeImages_v4.0.30319_64\System.Web.Extensio#\660210d6d0196c39c9feea68e0332ece\System.Web.Extensions.Design.ni.dll
+ 2012-07-04 03:00 . 2012-07-04 03:00	5561856              c:\windows\assembly\NativeImages_v4.0.30319_64\System.Web.DataVisu#\32fcfe726e565e6169522c55dacc84e8\System.Web.DataVisualization.ni.dll
+ 2012-07-04 00:54 . 2012-07-04 00:54	1495552              c:\windows\assembly\NativeImages_v4.0.30319_64\System.ServiceModel#\adcbcc0533c70ad5fe0b7646932c4228\System.ServiceModel.Web.ni.dll
+ 2012-07-04 00:54 . 2012-07-04 00:54	2701312              c:\windows\assembly\NativeImages_v4.0.30319_64\System.Data.Services\2cd5f29ccbcceb62c1b875ad4cedab00\System.Data.Services.ni.dll
+ 2012-07-04 00:53 . 2012-07-04 00:53	1498112              c:\windows\assembly\NativeImages_v4.0.30319_64\System.Data.OracleC#\9ae2ebd5a18f5e129b09e1691126fce4\System.Data.OracleClient.ni.dll
+ 2012-07-04 00:54 . 2012-07-04 00:54	1733120              c:\windows\assembly\NativeImages_v4.0.30319_64\System.Data.Entity.#\20ec470ecb250aa5c95d14b8793cba5b\System.Data.Entity.Design.ni.dll
+ 2012-07-04 00:52 . 2012-07-04 00:52	1891328              c:\windows\assembly\NativeImages_v4.0.30319_64\PresentationBuildTa#\f1a22e22627669cfa6df30d1b4051988\PresentationBuildTasks.ni.dll
+ 2012-07-04 00:52 . 2012-07-04 00:52	1828864              c:\windows\assembly\NativeImages_v4.0.30319_64\Microsoft.VisualBas#\a1c3a7e4ca00d2ee5f2ce009831d22b9\Microsoft.VisualBasic.Compatibility.ni.dll
+ 2012-07-04 00:52 . 2012-07-04 00:52	6004736              c:\windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Build\8186ee6e68fbefb30dca7b41ec0386c4\Microsoft.Build.ni.dll
+ 2012-07-04 00:53 . 2012-07-04 00:53	3815936              c:\windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Build.Tas#\fc1a938d40998cf260926846cc958bd6\Microsoft.Build.Tasks.v4.0.ni.dll
+ 2012-07-04 00:52 . 2012-07-04 00:52	2521088              c:\windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Build.Eng#\d0d3c1cf8ab4b8b5534a1e5a77d34f09\Microsoft.Build.Engine.ni.dll
+ 2012-07-04 00:52 . 2012-07-04 00:52	1003520              c:\windows\assembly\NativeImages_v4.0.30319_64\AspNetMMCExt\8aec154d31e76cd786ed5de7c1d0fbb3\AspNetMMCExt.ni.dll
+ 2012-07-04 03:00 . 2012-07-04 03:00	1226752              c:\windows\assembly\NativeImages_v4.0.30319_32\System.WorkflowServ#\d999b56c109e96bd8118b2104dca1d82\System.WorkflowServices.ni.dll
+ 2012-07-04 03:00 . 2012-07-04 03:00	1971200              c:\windows\assembly\NativeImages_v4.0.30319_32\System.Workflow.Run#\4055aa50edd533ff57682a696cd70b97\System.Workflow.Runtime.ni.dll
+ 2012-07-04 03:00 . 2012-07-04 03:00	4476416              c:\windows\assembly\NativeImages_v4.0.30319_32\System.Workflow.Com#\a8d5bc70ddc43116bb89d96b172f5c3a\System.Workflow.ComponentModel.ni.dll
+ 2012-07-04 03:00 . 2012-07-04 03:00	2871296              c:\windows\assembly\NativeImages_v4.0.30319_32\System.Workflow.Act#\a58ab54e96487ccd5744a5c5707e7544\System.Workflow.Activities.ni.dll
+ 2012-07-04 02:59 . 2012-07-04 02:59	1923584              c:\windows\assembly\NativeImages_v4.0.30319_32\System.Web.Services\e79c46b4fc7cff1216f7b2ecdc6ec075\System.Web.Services.ni.dll
+ 2012-07-04 03:00 . 2012-07-04 03:00	2329088              c:\windows\assembly\NativeImages_v4.0.30319_32\System.Web.Mobile\1965fa47442aefcadaa6b45f4811c710\System.Web.Mobile.ni.dll
+ 2012-07-04 02:59 . 2012-07-04 02:59	3092480              c:\windows\assembly\NativeImages_v4.0.30319_32\System.Web.Extensio#\32e81dde72f32b62d1f111bbd9959110\System.Web.Extensions.ni.dll
+ 2012-07-04 03:00 . 2012-07-04 03:00	4518400              c:\windows\assembly\NativeImages_v4.0.30319_32\System.Web.DataVisu#\5c4640a3048142037f9a78371d6598a7\System.Web.DataVisualization.ni.dll
+ 2012-07-04 02:59 . 2012-07-04 02:59	1075200              c:\windows\assembly\NativeImages_v4.0.30319_32\System.ServiceModel#\3a2630d3ac7eca019bdf7cd898983a61\System.ServiceModel.Web.ni.dll
+ 2012-07-04 02:59 . 2012-07-04 02:59	2026496              c:\windows\assembly\NativeImages_v4.0.30319_32\System.Data.Services\6878488ae42f08b42ea032b6bb68e75e\System.Data.Services.ni.dll
+ 2012-07-04 02:59 . 2012-07-04 02:59	1189376              c:\windows\assembly\NativeImages_v4.0.30319_32\System.Data.OracleC#\d62b53e7a5528b03ff512c624a1fdb83\System.Data.OracleClient.ni.dll
+ 2012-07-04 02:59 . 2012-07-04 02:59	1409536              c:\windows\assembly\NativeImages_v4.0.30319_32\System.Data.Entity.#\390d46839913e46c70f45f7a4b9070ba\System.Data.Entity.Design.ni.dll
+ 2012-07-04 02:59 . 2012-07-04 02:59	1479168              c:\windows\assembly\NativeImages_v4.0.30319_32\PresentationBuildTa#\96e437d1e82e54e63ed96af50e96d03d\PresentationBuildTasks.ni.dll
+ 2012-07-04 02:59 . 2012-07-04 02:59	1138688              c:\windows\assembly\NativeImages_v4.0.30319_32\Microsoft.VisualBas#\a35ab055e66ff3e4a163dda05b501086\Microsoft.VisualBasic.Compatibility.ni.dll
+ 2012-07-04 02:59 . 2012-07-04 02:59	4248064              c:\windows\assembly\NativeImages_v4.0.30319_32\Microsoft.Build\5246fa832baabf6e3706fd537fe19062\Microsoft.Build.ni.dll
+ 2012-07-04 02:59 . 2012-07-04 02:59	2873856              c:\windows\assembly\NativeImages_v4.0.30319_32\Microsoft.Build.Tas#\4c844fa0efbb47fd2307109f0ace11dc\Microsoft.Build.Tasks.v4.0.ni.dll
+ 2012-07-04 02:59 . 2012-07-04 02:59	1931264              c:\windows\assembly\NativeImages_v4.0.30319_32\Microsoft.Build.Eng#\520f23eeaf6b5241a74a56338e8b89f8\Microsoft.Build.Engine.ni.dll
+ 2012-06-24 21:45 . 2012-06-24 21:45	12310216              c:\windows\system32\Macromed\Flash\NPSWF64_11_3_300_262.dll
+ 2011-09-19 10:39 . 2012-07-14 01:10	10036408              c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-S-1-5-21-520610219-17727062-633966983-1000-12288.dat
+ 2012-06-24 03:25 . 2012-06-25 01:12	10330864              c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-S-1-5-18-16384.dat
+ 2012-07-08 07:04 . 2012-07-08 07:04	19333120              c:\windows\Installer\209123bb.msi
+ 2012-07-04 00:53 . 2012-07-04 00:53	15657984              c:\windows\assembly\NativeImages_v4.0.30319_64\System.Web\22352c9c1091b0fefc587c26a6b03429\System.Web.ni.dll
+ 2012-07-04 00:53 . 2012-07-04 00:53	13271040              c:\windows\assembly\NativeImages_v4.0.30319_64\System.Design\62b07636b9cefe089c666cb26bf71597\System.Design.ni.dll
+ 2012-07-04 02:59 . 2012-07-04 02:59	11993088              c:\windows\assembly\NativeImages_v4.0.30319_32\System.Web\00171f60d3512845972c1dbbebf36278\System.Web.ni.dll
+ 2012-07-03 23:40 . 2012-07-03 23:40	10992128              c:\windows\assembly\NativeImages_v4.0.30319_32\System.Design\0cd11cee6f646aa41fffcf00cf0bc791\System.Design.ni.dll
.
-- Snapshot reset to current date --
.
(((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown 
REGEDIT4
.
[HKEY_LOCAL_MACHINE\Wow6432Node\~\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}]
2012-06-07 01:33	1519304	----a-w-	c:\program files (x86)\Ask.com\GenericAskToolbar.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar]
"{D4027C7F-154A-4066-A1AD-4243D8127440}"= "c:\program files (x86)\Ask.com\GenericAskToolbar.dll" [2012-06-07 1519304]
.
[HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]
[HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RocketDock"="c:\program files (x86)\RocketDock\RocketDock.exe" [2007-09-02 495616]
"Advanced SystemCare 5"="c:\program files (x86)\IObit\Advanced SystemCare 5\ASCTray.exe" [2012-05-28 288128]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"InstaLAN"="c:\program files (x86)\Belkin\Router Setup and Monitor\BelkinRouterMonitor.exe" [2011-02-25 1770400]
"APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2012-02-21 59240]
"ApnUpdater"="c:\program files (x86)\Ask.com\Updater\Updater.exe" [2012-06-07 1564872]
.
c:\users\Bre\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
CurseClientStartup.ccip [2011-10-9 0]
Rainmeter.lnk - c:\program files\Rainmeter\Rainmeter.exe [2011-9-18 102912]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
UltraMon.lnk - c:\windows\Installer\{537056B7-32A4-4408-9B54-0341963C7C9C}\IcoUltraMon.ico [2011-9-18 29310]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 0 (0x0)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Security Packages	REG_MULTI_SZ   	kerberos msv1_0 schannel wdigest tspkg pku2u livessp
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\run-]
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe"
"HP Software Update"=c:\program files (x86)\HP\HP Software Update\HPWuSchd2.exe
"iTunesHelper"="c:\program files (x86)\iTunes\iTunesHelper.exe"
"ConduitHelper"="c:\users\Public\Conduit\ConduitHelper\ConduitHelper.exe"
"Freecorder FLV Service"="c:\program files (x86)\Freecorder\FLVSrvc.exe" /run
"Gateway Photo Frame"="c:\program files (x86)\Gateway Photo Frame\ButtonMonitor.exe" -A
"QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" -atboottime
.
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R2 gupdate;Google Update Service (gupdate);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-09-18 136176]
R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe [2012-07-03 160944]
R3 BTCFilterService;USB Networking Driver Filter Service;c:\windows\system32\DRIVERS\motfilt.sys [2009-01-29 6144]
R3 BVRPMPR5a64;BVRPMPR5a64 NDIS Protocol Driver;c:\windows\system32\drivers\BVRPMPR5a64.SYS [2010-06-30 35840]
R3 gupdatem;Google Update Service (gupdatem);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-09-18 136176]
R3 LGVirHid;Logitech Gamepanel Virtual HID Device Driver;c:\windows\system32\drivers\LGVirHid.sys [2011-09-19 16008]
R3 motandroidusb;Mot ADB Interface Driver;c:\windows\system32\Drivers\motoandroid.sys [2009-07-10 31744]
R3 motccgp;Motorola USB Composite Device Driver;c:\windows\system32\DRIVERS\motccgp.sys [2011-04-04 21504]
R3 motccgpfl;MotCcgpFlService;c:\windows\system32\DRIVERS\motccgpfl.sys [2009-01-29 9216]
R3 Motousbnet;Motorola USB Networking Driver Service;c:\windows\system32\DRIVERS\Motousbnet.sys [2010-04-01 26624]
R3 MozillaMaintenance;Mozilla Maintenance Service;c:\program files (x86)\Mozilla Maintenance Service\maintenanceservice.exe [2012-06-16 113120]
R3 pbfilter;pbfilter;c:\program files\PeerBlock\pbfilter.sys [2010-11-07 24176]
R3 phaudlwr;Philips Audio Filter;c:\windows\system32\DRIVERS\phaudlwr.sys [2009-10-20 114608]
R3 RTL8192su;Realtek RTL8192SU Wireless LAN 802.11n USB 2.0 Network Adapter;c:\windows\system32\DRIVERS\RTL8192su.sys [2010-09-29 695400]
R3 SPC620;Philips SPC620NC PC Camera;c:\windows\system32\drivers\SPC620.sys [2007-09-28 581120]
R3 SPC620m;Philips SPC620NC PC Cameram;c:\windows\system32\drivers\SPC620m.sys [2007-09-28 8192]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-20 59392]
R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [2011-04-20 1255736]
R3 WinRing0_1_2_0;WinRing0_1_2_0;c:\program files (x86)\IObit\Game Booster 3\Driver\WinRing0x64.sys [2010-11-01 14544]
R3 WMZuneComm;Zune Windows Mobile Connectivity Service;c:\program files\Zune\WMZuneComm.exe [2011-08-05 306400]
S1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;c:\windows\system32\DRIVERS\dtsoftbus01.sys [2012-05-17 283200]
S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [2009-07-14 59904]
S2 AdvancedSystemCareService5;Advanced SystemCare Service 5;c:\program files (x86)\IObit\Advanced SystemCare 5\ASCService.exe [2012-05-26 913792]
S2 cpuz135;cpuz135;c:\windows\system32\drivers\cpuz135_x64.sys [2010-11-09 21992]
S2 Greg_Service;GRegService;c:\program files (x86)\Gateway\Registration\GregHSRW.exe [2009-08-28 1150496]
S2 UltraMonUtility;UltraMon Utility Driver;c:\program files (x86)\Common Files\Realtime Soft\UltraMonMirrorDrv\x64\UltraMonUtility.sys [2008-11-14 20512]
S2 Updater Service;Updater Service;c:\program files\Gateway\Gateway Updater\UpdaterService.exe [2009-07-04 240160]
S3 e1yexpress;Intel(R) Gigabit Network Connections Driver;c:\windows\system32\DRIVERS\e1y60x64.sys [2009-06-10 281088]
S3 EuMusDesignVirtualAudioCableWdm;Virtual Audio Cable (WDM);c:\windows\system32\DRIVERS\vrtaucbl.sys [2012-01-28 66728]
S3 IntcHdmiAddService;Intel(R) High Definition Audio HDMI;c:\windows\system32\drivers\IntcHdmi.sys [2009-05-25 138752]
S3 LGBusEnum;Logitech GamePanel Virtual Bus Enumerator Driver;c:\windows\system32\drivers\LGBusEnum.sys [2009-11-24 22408]
S3 ManyCam;ManyCam Virtual Webcam, WDM Video Capture Driver;c:\windows\system32\DRIVERS\ManyCam_x64.sys [2008-03-13 27136]
S3 pneteth;PdaNet Broadband;c:\windows\system32\DRIVERS\pneteth.sys [2011-07-19 15360]
.
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\svchost]
hpdevmgmt	REG_MULTI_SZ   	hpqcxs08 hpqddsvc
.
Contents of the 'Scheduled Tasks' folder
.
2012-07-14 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-09-18 22:04]
.
2012-07-14 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-09-18 22:04]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IAAnotif"="c:\program files (x86)\Intel\Intel Matrix Storage Manager\iaanotif.exe" [2009-06-05 186904]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2009-07-20 7981088]
"Launch LCore"="c:\program files\Logitech Gaming Software\LCore.exe" [2011-07-28 110360]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2011-02-12 162328]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2011-02-12 386584]
"Persistence"="c:\windows\system32\igfxpers.exe" [2011-02-12 417304]
.
------- Supplementary Scan -------
.
uLocal Page = c:\windows\system32\blank.htm
mStart Page = hxxp://homepage.gateway.com/rdr.aspx?b=ACGW&l=0409&m=sx2800&r=173604117307p0358v115k49i15222
mLocal Page = c:\windows\SysWOW64\blank.htm
uInternet Settings,ProxyServer = http=;ftp=;https=;
IE: E&xport to Microsoft Excel - c:\progra~2\MICROS~1\Office12\EXCEL.EXE/3000
IE: Google Sidewiki... - c:\program files (x86)\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_D183CA64F05FDD98.dll/cmsidewiki.html
TCP: DhcpNameServer = 192.168.2.1
FF - ProfilePath - c:\users\Bre\AppData\Roaming\Mozilla\Firefox\Profiles\y7r4no5l.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://www.facebook.com/
FF - prefs.js: keyword.URL - hxxp://www.google.co.in/search?btnG=Google+Search&q=
FF - prefs.js: network.proxy.gopher - 
FF - prefs.js: network.proxy.gopher_port - 0
FF - prefs.js: network.proxy.type - 0
.
- - - - ORPHANS REMOVED - - - -
.
Toolbar-Locked - (no file)
Toolbar-{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc} - (no file)
HKLM-Run-picop - c:\users\Bre\AppData\Roaming\picop.dll
HKLM-Run-ianex - c:\users\Bre\AppData\Roaming\ianex.dll
.
.
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_USERS\S-1-5-21-520610219-17727062-633966983-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.eml\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="WindowsLiveMail.Email.1"
.
[HKEY_USERS\S-1-5-21-520610219-17727062-633966983-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.vcf\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="WindowsLiveMail.VCard.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil10e.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\LocalServer32]
@="c:\\Windows\\SysWow64\\Macromed\\Flash\\FlashUtil10e.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10e.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.10"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10e.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10e.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10e.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}]
@Denied: (A 2) (Everyone)
@="IFlashBroker3"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
------------------------ Other Running Processes ------------------------
.
c:\program files (x86)\Belkin\Router Setup and Monitor\BelkinService.exe
c:\program files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
c:\program files (x86)\Intel\Intel Matrix Storage Manager\IAANTMon.exe
c:\program files (x86)\Belkin\Router Setup and Monitor\BelkinSetup.exe
.
**************************************************************************
.
Completion time: 2012-07-13  21:16:15 - machine was rebooted
ComboFix-quarantined-files.txt  2012-07-14 01:16
ComboFix2.txt  2012-06-25 01:30
ComboFix3.txt  2012-06-21 00:13
.
Pre-Run: 140,212,453,376 bytes free
Post-Run: 143,948,693,504 bytes free
.
- - End Of File - - 3D47FEFFCD85DAFB75DD37E0EA6A38C1


----------



## johnb35

All right, lets see if we can nail this once and for all.

Please do the following.

1. Go to Start > Run > type Notepad.exe and click OK to open Notepad.
It must be Notepad, not Wordpad.
2. Copy the text in the below code box



		Code:
	

Dirlook::

c:\users\Bre\AppData\Local\{B4F8B799-C6FD-11E1-8270-B8AC6F996F26}
c:\programdata\{32364CEA-7855-4A3C-B674-53D8E9B97936}


3. Go to the Notepad window and click Edit > Paste
4. Then click File > Save
5. Name the file CFScript.txt - Save the file to your Desktop
6. Then drag the CFScript (hold the left mouse button while dragging the file) and drop it (release the left mouse button) into ComboFix.exe as you see in the screenshot below. Important: Perform this instruction carefully!







ComboFix will begin to execute, just follow the prompts.
After reboot (in case it asks to reboot), it will produce a log for you.
Post that log (Combofix.txt) in your next reply.


----------



## Motorcharge

ComboFix 12-06-28.03 - Bre 07/14/2012   8:24.5.4 - x64
Microsoft Windows 7 Home Premium   6.1.7601.1.1252.1.1033.18.4061.2620 [GMT -4:00]
Running from: c:\users\Bre\Downloads\ComboFix.exe
Command switches used :: c:\users\Bre\Downloads\CFScript.txt
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
(((((((((((((((((((((((((((((((((((((((   Other Deletions   )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\users\Bre\AppData\Local\{604e7576-ec0d-7231-cc64-a8dfba4e3e1f}
c:\users\Bre\AppData\Local\{604e7576-ec0d-7231-cc64-a8dfba4e3e1f}\@
c:\users\Bre\AppData\Local\{604e7576-ec0d-7231-cc64-a8dfba4e3e1f}\n
c:\users\Bre\AppData\Local\Temp\1.tmp\F_IN_BOX.dll
c:\windows\Installer\{604e7576-ec0d-7231-cc64-a8dfba4e3e1f}
.
.
(((((((((((((((((((((((((   Files Created from 2012-06-14 to 2012-07-14  )))))))))))))))))))))))))))))))
.
.
2012-07-14 12:29 . 2012-07-14 12:29	--------	d-----w-	c:\users\Default\AppData\Local\temp
2012-07-13 06:21 . 2012-06-18 07:12	9013136	----a-w-	c:\programdata\Microsoft\Windows Defender\Definition Updates\{97D554BF-9C7C-49C2-AF51-E0B1D30B51EF}\mpengine.dll
2012-07-08 04:16 . 2012-07-08 04:16	--------	d-----w-	c:\users\Bre\AppData\Roaming\HideIPEasy
2012-07-08 04:16 . 2012-07-08 04:16	--------	d-----w-	c:\programdata\HideIPEasy
2012-07-08 04:15 . 2012-07-08 04:15	--------	d-----w-	c:\program files (x86)\Ask.com
2012-07-08 04:15 . 2012-07-08 04:15	--------	d-----w-	c:\users\Bre\AppData\Local\APN
2012-07-08 04:14 . 2012-07-08 04:16	--------	d-----w-	c:\program files (x86)\HideIPEasy
2012-07-06 00:01 . 2012-07-06 00:01	--------	d-----w-	c:\users\Bre\AppData\Local\{B4F8B799-C6FD-11E1-8270-B8AC6F996F26}
2012-06-24 21:47 . 2012-06-24 21:47	--------	d-----w-	c:\users\Bre\AppData\Local\Macromedia
2012-06-24 21:45 . 2012-06-24 21:45	--------	d-----w-	c:\programdata\McAfee
2012-06-24 21:45 . 2012-06-24 21:45	70344	----a-w-	c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2012-06-24 21:45 . 2012-06-24 21:45	426184	----a-w-	c:\windows\SysWow64\FlashPlayerApp.exe
2012-06-23 12:12 . 2012-06-23 12:12	--------	d-sh--w-	c:\windows\SysWow64\%APPDATA%
2012-06-21 01:01 . 2012-06-21 01:01	--------	d-----w-	c:\program files (x86)\ESET
2012-06-20 23:54 . 2012-06-20 23:54	--------	d-----w-	C:\TDSSKiller_Quarantine
2012-06-17 21:10 . 2012-06-17 21:10	--------	d-----w-	c:\program files\Microsoft Silverlight
2012-06-17 21:10 . 2012-06-17 21:10	--------	d-----w-	c:\program files (x86)\Microsoft Silverlight
2012-06-17 19:36 . 2011-07-20 18:58	44032	----a-w-	c:\windows\system32\drivers\RimSerial_AMD64.sys
2012-06-17 19:36 . 2012-06-24 13:47	--------	d-----w-	c:\program files (x86)\Common Files\Research In Motion
.
.
.
((((((((((((((((((((((((((((((((((((((((   Find3M Report   ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-05-17 23:51 . 2012-05-17 23:51	283200	----a-w-	c:\windows\system32\drivers\dtsoftbus01.sys
2012-05-17 22:50 . 2012-05-17 22:50	71680	----a-w-	c:\windows\system32\frapsv64.dll
2012-05-17 22:50 . 2012-05-17 22:50	65536	----a-w-	c:\windows\SysWow64\frapsvid.dll
2012-04-26 07:09 . 2012-04-26 07:09	91648	----a-w-	c:\windows\system32\SetIEInstalledDate.exe
2012-04-26 07:09 . 2012-04-26 07:09	89088	----a-w-	c:\windows\system32\RegisterIEPKEYs.exe
2012-04-26 07:09 . 2012-04-26 07:09	86528	----a-w-	c:\windows\SysWow64\iesysprep.dll
2012-04-26 07:09 . 2012-04-26 07:09	85504	----a-w-	c:\windows\system32\iesetup.dll
2012-04-26 07:09 . 2012-04-26 07:09	76800	----a-w-	c:\windows\SysWow64\SetIEInstalledDate.exe
2012-04-26 07:09 . 2012-04-26 07:09	76800	----a-w-	c:\windows\system32\tdc.ocx
2012-04-26 07:09 . 2012-04-26 07:09	74752	----a-w-	c:\windows\SysWow64\RegisterIEPKEYs.exe
2012-04-26 07:09 . 2012-04-26 07:09	74752	----a-w-	c:\windows\SysWow64\iesetup.dll
2012-04-26 07:09 . 2012-04-26 07:09	63488	----a-w-	c:\windows\SysWow64\tdc.ocx
2012-04-26 07:09 . 2012-04-26 07:09	603648	----a-w-	c:\windows\system32\vbscript.dll
2012-04-26 07:09 . 2012-04-26 07:09	49664	----a-w-	c:\windows\system32\imgutil.dll
2012-04-26 07:09 . 2012-04-26 07:09	48640	----a-w-	c:\windows\SysWow64\mshtmler.dll
2012-04-26 07:09 . 2012-04-26 07:09	48640	----a-w-	c:\windows\system32\mshtmler.dll
2012-04-26 07:09 . 2012-04-26 07:09	448512	----a-w-	c:\windows\system32\html.iec
2012-04-26 07:09 . 2012-04-26 07:09	420864	----a-w-	c:\windows\SysWow64\vbscript.dll
2012-04-26 07:09 . 2012-04-26 07:09	367104	----a-w-	c:\windows\SysWow64\html.iec
2012-04-26 07:09 . 2012-04-26 07:09	35840	----a-w-	c:\windows\SysWow64\imgutil.dll
2012-04-26 07:09 . 2012-04-26 07:09	30720	----a-w-	c:\windows\system32\licmgr10.dll
2012-04-26 07:09 . 2012-04-26 07:09	23552	----a-w-	c:\windows\SysWow64\licmgr10.dll
2012-04-26 07:09 . 2012-04-26 07:09	222208	----a-w-	c:\windows\system32\msls31.dll
2012-04-26 07:09 . 2012-04-26 07:09	173056	----a-w-	c:\windows\system32\ieUnatt.exe
2012-04-26 07:09 . 2012-04-26 07:09	165888	----a-w-	c:\windows\system32\iexpress.exe
2012-04-26 07:09 . 2012-04-26 07:09	161792	----a-w-	c:\windows\SysWow64\msls31.dll
2012-04-26 07:09 . 2012-04-26 07:09	160256	----a-w-	c:\windows\system32\wextract.exe
2012-04-26 07:09 . 2012-04-26 07:09	152064	----a-w-	c:\windows\SysWow64\wextract.exe
2012-04-26 07:09 . 2012-04-26 07:09	150528	----a-w-	c:\windows\SysWow64\iexpress.exe
2012-04-26 07:09 . 2012-04-26 07:09	142848	----a-w-	c:\windows\SysWow64\ieUnatt.exe
2012-04-26 07:09 . 2012-04-26 07:09	135168	----a-w-	c:\windows\system32\IEAdvpack.dll
2012-04-26 07:09 . 2012-04-26 07:09	12288	----a-w-	c:\windows\system32\mshta.exe
2012-04-26 07:09 . 2012-04-26 07:09	11776	----a-w-	c:\windows\SysWow64\mshta.exe
2012-04-26 07:09 . 2012-04-26 07:09	114176	----a-w-	c:\windows\system32\admparse.dll
2012-04-26 07:09 . 2012-04-26 07:09	111616	----a-w-	c:\windows\system32\iesysprep.dll
2012-04-26 07:09 . 2012-04-26 07:09	110592	----a-w-	c:\windows\SysWow64\IEAdvpack.dll
2012-04-26 07:09 . 2012-04-26 07:09	101888	----a-w-	c:\windows\SysWow64\admparse.dll
2012-04-25 22:44 . 2012-04-25 22:44	23112	----a-w-	c:\windows\system32\drivers\hitmanpro35.sys
2012-04-25 22:36 . 2012-04-25 22:36	81408	----a-w-	c:\windows\system32\imagehlp.dll
2012-04-25 22:36 . 2012-04-25 22:36	5120	----a-w-	c:\windows\SysWow64\wmi.dll
2012-04-25 22:36 . 2012-04-25 22:36	5120	----a-w-	c:\windows\system32\wmi.dll
2012-04-25 22:36 . 2012-04-25 22:36	23408	----a-w-	c:\windows\system32\drivers\fs_rec.sys
2012-04-25 22:36 . 2012-04-25 22:36	220672	----a-w-	c:\windows\system32\wintrust.dll
2012-04-25 22:36 . 2012-04-25 22:36	172544	----a-w-	c:\windows\SysWow64\wintrust.dll
2012-04-25 22:36 . 2012-04-25 22:36	159232	----a-w-	c:\windows\SysWow64\imagehlp.dll
2012-04-25 22:33 . 2012-04-25 22:33	9216	----a-w-	c:\windows\system32\rdrmemptylst.exe
2012-04-25 22:33 . 2012-04-25 22:33	77312	----a-w-	c:\windows\system32\rdpwsx.dll
2012-04-25 22:33 . 2012-04-25 22:33	149504	----a-w-	c:\windows\system32\rdpcorekmts.dll
2012-04-25 22:32 . 2012-04-25 22:32	826880	----a-w-	c:\windows\SysWow64\rdpcore.dll
2012-04-25 22:32 . 2012-04-25 22:32	23552	----a-w-	c:\windows\system32\drivers\tdtcp.sys
2012-04-25 22:32 . 2012-04-25 22:32	210944	----a-w-	c:\windows\system32\drivers\rdpwd.sys
2012-04-25 22:32 . 2012-04-25 22:32	1031680	----a-w-	c:\windows\system32\rdpcore.dll
2012-04-25 22:27 . 2012-04-25 22:27	509952	----a-w-	c:\windows\system32\ntshrui.dll
2012-04-25 22:27 . 2012-04-25 22:27	442880	----a-w-	c:\windows\SysWow64\ntshrui.dll
2012-04-25 22:26 . 2012-04-25 22:26	515584	----a-w-	c:\windows\system32\timedate.cpl
2012-04-25 22:26 . 2012-04-25 22:26	478720	----a-w-	c:\windows\SysWow64\timedate.cpl
2012-04-25 22:26 . 2012-04-25 22:26	498688	----a-w-	c:\windows\system32\drivers\afd.sys
2012-04-25 22:23 . 2012-04-25 22:23	690688	----a-w-	c:\windows\SysWow64\msvcrt.dll
2012-04-25 22:23 . 2012-04-25 22:23	634880	----a-w-	c:\windows\system32\msvcrt.dll
2012-04-25 22:21 . 2012-04-25 22:21	1731920	----a-w-	c:\windows\system32\ntdll.dll
2012-04-25 22:21 . 2012-04-25 22:21	1292080	----a-w-	c:\windows\SysWow64\ntdll.dll
2012-04-25 22:21 . 2012-04-25 22:21	96768	----a-w-	c:\windows\SysWow64\sspicli.dll
2012-04-25 22:21 . 2012-04-25 22:21	95600	----a-w-	c:\windows\system32\drivers\ksecdd.sys
2012-04-25 22:21 . 2012-04-25 22:21	459232	----a-w-	c:\windows\system32\drivers\cng.sys
2012-04-25 22:21 . 2012-04-25 22:21	395776	----a-w-	c:\windows\system32\webio.dll
2012-04-25 22:21 . 2012-04-25 22:21	340992	----a-w-	c:\windows\system32\schannel.dll
2012-04-25 22:21 . 2012-04-25 22:21	314880	----a-w-	c:\windows\SysWow64\webio.dll
2012-04-25 22:21 . 2012-04-25 22:21	31232	----a-w-	c:\windows\system32\lsass.exe
2012-04-25 22:21 . 2012-04-25 22:21	29184	----a-w-	c:\windows\system32\sspisrv.dll
2012-04-25 22:21 . 2012-04-25 22:21	28160	----a-w-	c:\windows\system32\secur32.dll
2012-04-25 22:21 . 2012-04-25 22:21	224768	----a-w-	c:\windows\SysWow64\schannel.dll
2012-04-25 22:21 . 2012-04-25 22:21	22016	----a-w-	c:\windows\SysWow64\secur32.dll
2012-04-25 22:21 . 2012-04-25 22:21	152432	----a-w-	c:\windows\system32\drivers\ksecpkg.sys
2012-04-25 22:21 . 2012-04-25 22:21	1447936	----a-w-	c:\windows\system32\lsasrv.dll
2012-04-25 22:21 . 2012-04-25 22:21	136192	----a-w-	c:\windows\system32\sspicli.dll
2012-04-25 22:21 . 2012-04-25 22:21	514560	----a-w-	c:\windows\SysWow64\qdvd.dll
2012-04-25 22:21 . 2012-04-25 22:21	366592	----a-w-	c:\windows\system32\qdvd.dll
2012-04-25 22:21 . 2012-04-25 22:21	1572864	----a-w-	c:\windows\system32\quartz.dll
2012-04-25 22:21 . 2012-04-25 22:21	1328128	----a-w-	c:\windows\SysWow64\quartz.dll
2012-04-25 22:20 . 2012-04-25 22:20	77312	----a-w-	c:\windows\system32\packager.dll
2012-04-25 22:20 . 2012-04-25 22:20	67072	----a-w-	c:\windows\SysWow64\packager.dll
2012-04-25 22:16 . 2012-04-25 22:16	2048	----a-w-	c:\windows\SysWow64\tzres.dll
2012-04-25 22:16 . 2012-04-25 22:16	2048	----a-w-	c:\windows\system32\tzres.dll
2012-04-25 22:16 . 2012-04-25 22:16	43520	----a-w-	c:\windows\system32\csrsrv.dll
2012-04-25 22:16 . 2012-04-25 22:16	723456	----a-w-	c:\windows\system32\EncDec.dll
2012-04-25 22:16 . 2012-04-25 22:16	534528	----a-w-	c:\windows\SysWow64\EncDec.dll
2012-04-25 22:07 . 2012-04-25 22:07	75776	----a-w-	c:\windows\SysWow64\psisrndr.ax
2012-04-25 22:07 . 2012-04-25 22:07	613888	----a-w-	c:\windows\system32\psisdecd.dll
2012-04-25 22:07 . 2012-04-25 22:07	465408	----a-w-	c:\windows\SysWow64\psisdecd.dll
2012-04-25 22:07 . 2012-04-25 22:07	108032	----a-w-	c:\windows\system32\psisrndr.ax
2012-04-25 22:06 . 2012-04-25 22:06	861696	----a-w-	c:\windows\system32\oleaut32.dll
2012-04-25 22:06 . 2012-04-25 22:06	571904	----a-w-	c:\windows\SysWow64\oleaut32.dll
2012-04-25 22:06 . 2012-04-25 22:06	331776	----a-w-	c:\windows\system32\oleacc.dll
2012-04-25 22:06 . 2012-04-25 22:06	233472	----a-w-	c:\windows\SysWow64\oleacc.dll
2012-04-19 00:56 . 2012-04-19 00:56	94208	----a-w-	c:\windows\SysWow64\QuickTimeVR.qtx
2012-04-19 00:56 . 2012-04-19 00:56	69632	----a-w-	c:\windows\SysWow64\QuickTime.qts
.
.
((((((((((((((((((((((((((((((((((((((((((((   Look   )))))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
---- Directory of c:\programdata\{32364CEA-7855-4A3C-B674-53D8E9B97936} ----
.
2012-06-12 20:48 . 2012-06-12 20:48	23762944	----a-w-	c:\programdata\{32364CEA-7855-4A3C-B674-53D8E9B97936}\{D3742F82-1C1A-4DCC-ABBD-0E831C0185CC}.msi
.
---- Directory of c:\users\Bre\AppData\Local\{B4F8B799-C6FD-11E1-8270-B8AC6F996F26} ----
.
2012-07-06 00:01 . 2012-07-06 00:01	6529	----a-w-	c:\users\Bre\AppData\Local\{B4F8B799-C6FD-11E1-8270-B8AC6F996F26}\chrome\content\browser.xul
2012-07-06 00:01 . 2012-07-06 00:01	804	----a-w-	c:\users\Bre\AppData\Local\{B4F8B799-C6FD-11E1-8270-B8AC6F996F26}\install.rdf
2012-07-06 00:01 . 2012-07-06 00:01	129	----a-w-	c:\users\Bre\AppData\Local\{B4F8B799-C6FD-11E1-8270-B8AC6F996F26}\chrome.manifest
.
.
------- Sigcheck -------
Note: Unsigned files aren't necessarily malware.
.
[7] 2011-02-26 . E38899074D4951D31B4040E994DD7C8D . 2870784 . . [6.1.7600.16385] .. c:\windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20910_none_ae79ed04ac56c4a9\explorer.exe
[7] 2011-02-26 . 0862495E0C825893DB75EF44FAEA8E93 . 2870272 . . [6.1.7600.16385] .. c:\windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16768_none_adc24107935a7e25\explorer.exe
[7] 2011-02-26 . 3B69712041F3D63605529BD66DC00C48 . 2871808 . . [6.1.7600.16385] .. c:\windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.21669_none_b0333b22a99da332\explorer.exe
[7] 2011-02-25 . 332FEAB1435662FC6C672E25BEB37BE3 . 2871808 . . [6.1.7600.16385] .. c:\windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17567_none_afa79dc39081d0ba\explorer.exe
[7] 2010-11-20 . AC4C51EB24AA95B77F705AB159189E24 . 2872320 . . [6.1.7600.16385] .. c:\windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17514_none_afdaac81905bf900\explorer.exe
[7] 2009-10-31 . B8EC4BD49CE8F6FC457721BFC210B67F . 2870272 . . [6.1.7600.16385] .. c:\windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20563_none_ae46d6aeac7ca7c7\explorer.exe
[-] 2009-10-31 . D5A67267C4C3879E63E9BFBA991D823A . 2387456 . . [6.1.7600.16385] .. c:\windows\explorer.exe
[7] 2009-10-31 . 9AAAEC8DAC27AA17B053E6352AD233AE . 2870272 . . [6.1.7600.16385] .. c:\windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16450_none_adc508f19359a007\explorer.exe
[7] 2009-08-03 . 700073016DAC1C3D2E7E2CE4223334B6 . 2868224 . . [6.1.7600.16385] .. c:\windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20500_none_ae84b558ac4eb41c\explorer.exe
[7] 2009-08-03 . F170B4A061C9E026437B193B4D571799 . 2868224 . . [6.1.7600.16385] .. c:\windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16404_none_adff19b5932d79ae\explorer.exe
[7] 2009-07-14 . C235A51CB740E45FFA0EBFB9BAFCDA64 . 2868224 . . [6.1.7600.16385] .. c:\windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16385_none_ada998b9936d7566\explorer.exe
.
(((((((((((((((((((((((((((((   SnapShot_2012-07-14_01.11.56   )))))))))))))))))))))))))))))))))))))))))
.
+ 2009-10-30 05:01 . 2012-07-14 01:13	53532              c:\windows\system32\wdi\ShutdownPerformanceDiagnostics_SystemData.bin
- 2009-07-14 05:10 . 2012-07-01 23:20	30546              c:\windows\system32\wdi\BootPerformanceDiagnostics_SystemData.bin
+ 2009-07-14 05:10 . 2012-07-14 01:13	30546              c:\windows\system32\wdi\BootPerformanceDiagnostics_SystemData.bin
+ 2011-04-20 19:48 . 2012-07-14 01:13	13624              c:\windows\system32\wdi\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-520610219-17727062-633966983-1000_UserData.bin
- 2011-04-20 19:20 . 2012-07-08 10:06	16384              c:\windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
+ 2011-04-20 19:20 . 2012-07-14 03:15	16384              c:\windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
- 2011-04-20 19:20 . 2012-07-08 10:06	32768              c:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
+ 2011-04-20 19:20 . 2012-07-14 03:15	32768              c:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
- 2009-07-14 04:54 . 2012-07-08 10:06	32768              c:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2009-07-14 04:54 . 2012-07-14 03:15	32768              c:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2009-07-14 04:46 . 2012-07-14 01:14	91888              c:\windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\SoftwareProtectionPlatform\Cache\cache.dat
+ 2011-09-19 10:39 . 2012-07-14 12:29	3266              c:\windows\system32\wdi\ERCQueuedResolutions.dat
+ 2012-07-14 12:29 . 2012-07-14 12:29	2048              c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
- 2012-07-14 01:10 . 2012-07-14 01:10	2048              c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
- 2012-07-14 01:10 . 2012-07-14 01:10	2048              c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
+ 2012-07-14 12:29 . 2012-07-14 12:29	2048              c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
- 2009-07-14 02:36 . 2012-07-07 22:14	660172              c:\windows\system32\perfh009.dat
+ 2009-07-14 02:36 . 2012-07-14 01:16	660172              c:\windows\system32\perfh009.dat
+ 2009-07-14 02:36 . 2012-07-14 01:16	121100              c:\windows\system32\perfc009.dat
- 2009-07-14 02:36 . 2012-07-07 22:14	121100              c:\windows\system32\perfc009.dat
- 2009-07-14 05:01 . 2012-07-14 01:10	513088              c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-System.dat
+ 2009-07-14 05:01 . 2012-07-14 12:29	513088              c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-System.dat
+ 2011-09-19 10:39 . 2012-07-14 12:29	10326528              c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-S-1-5-21-520610219-17727062-633966983-1000-12288.dat
.
(((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown 
REGEDIT4
.
[HKEY_LOCAL_MACHINE\Wow6432Node\~\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}]
2012-06-07 01:33	1519304	----a-w-	c:\program files (x86)\Ask.com\GenericAskToolbar.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar]
"{D4027C7F-154A-4066-A1AD-4243D8127440}"= "c:\program files (x86)\Ask.com\GenericAskToolbar.dll" [2012-06-07 1519304]
.
[HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]
[HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RocketDock"="c:\program files (x86)\RocketDock\RocketDock.exe" [2007-09-02 495616]
"Advanced SystemCare 5"="c:\program files (x86)\IObit\Advanced SystemCare 5\ASCTray.exe" [2012-05-28 288128]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"InstaLAN"="c:\program files (x86)\Belkin\Router Setup and Monitor\BelkinRouterMonitor.exe" [2011-02-25 1770400]
"APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2012-02-21 59240]
"ApnUpdater"="c:\program files (x86)\Ask.com\Updater\Updater.exe" [2012-06-07 1564872]
.
c:\users\Bre\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
CurseClientStartup.ccip [2011-10-9 0]
Rainmeter.lnk - c:\program files\Rainmeter\Rainmeter.exe [2011-9-18 102912]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
UltraMon.lnk - c:\windows\Installer\{537056B7-32A4-4408-9B54-0341963C7C9C}\IcoUltraMon.ico [2011-9-18 29310]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 0 (0x0)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Security Packages	REG_MULTI_SZ   	kerberos msv1_0 schannel wdigest tspkg pku2u livessp
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\run-]
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe"
"HP Software Update"=c:\program files (x86)\HP\HP Software Update\HPWuSchd2.exe
"iTunesHelper"="c:\program files (x86)\iTunes\iTunesHelper.exe"
"ConduitHelper"="c:\users\Public\Conduit\ConduitHelper\ConduitHelper.exe"
"Freecorder FLV Service"="c:\program files (x86)\Freecorder\FLVSrvc.exe" /run
"Gateway Photo Frame"="c:\program files (x86)\Gateway Photo Frame\ButtonMonitor.exe" -A
"QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" -atboottime
.
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R2 gupdate;Google Update Service (gupdate);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-09-18 136176]
R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe [2012-07-03 160944]
R3 BTCFilterService;USB Networking Driver Filter Service;c:\windows\system32\DRIVERS\motfilt.sys [2009-01-29 6144]
R3 BVRPMPR5a64;BVRPMPR5a64 NDIS Protocol Driver;c:\windows\system32\drivers\BVRPMPR5a64.SYS [2010-06-30 35840]
R3 gupdatem;Google Update Service (gupdatem);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-09-18 136176]
R3 LGVirHid;Logitech Gamepanel Virtual HID Device Driver;c:\windows\system32\drivers\LGVirHid.sys [2011-09-19 16008]
R3 motandroidusb;Mot ADB Interface Driver;c:\windows\system32\Drivers\motoandroid.sys [2009-07-10 31744]
R3 motccgp;Motorola USB Composite Device Driver;c:\windows\system32\DRIVERS\motccgp.sys [2011-04-04 21504]
R3 motccgpfl;MotCcgpFlService;c:\windows\system32\DRIVERS\motccgpfl.sys [2009-01-29 9216]
R3 Motousbnet;Motorola USB Networking Driver Service;c:\windows\system32\DRIVERS\Motousbnet.sys [2010-04-01 26624]
R3 MozillaMaintenance;Mozilla Maintenance Service;c:\program files (x86)\Mozilla Maintenance Service\maintenanceservice.exe [2012-06-16 113120]
R3 pbfilter;pbfilter;c:\program files\PeerBlock\pbfilter.sys [2010-11-07 24176]
R3 phaudlwr;Philips Audio Filter;c:\windows\system32\DRIVERS\phaudlwr.sys [2009-10-20 114608]
R3 RTL8192su;Realtek RTL8192SU Wireless LAN 802.11n USB 2.0 Network Adapter;c:\windows\system32\DRIVERS\RTL8192su.sys [2010-09-29 695400]
R3 SPC620;Philips SPC620NC PC Camera;c:\windows\system32\drivers\SPC620.sys [2007-09-28 581120]
R3 SPC620m;Philips SPC620NC PC Cameram;c:\windows\system32\drivers\SPC620m.sys [2007-09-28 8192]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-20 59392]
R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [2011-04-20 1255736]
R3 WinRing0_1_2_0;WinRing0_1_2_0;c:\program files (x86)\IObit\Game Booster 3\Driver\WinRing0x64.sys [2010-11-01 14544]
R3 WMZuneComm;Zune Windows Mobile Connectivity Service;c:\program files\Zune\WMZuneComm.exe [2011-08-05 306400]
S1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;c:\windows\system32\DRIVERS\dtsoftbus01.sys [2012-05-17 283200]
S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [2009-07-14 59904]
S2 AdvancedSystemCareService5;Advanced SystemCare Service 5;c:\program files (x86)\IObit\Advanced SystemCare 5\ASCService.exe [2012-05-26 913792]
S2 cpuz135;cpuz135;c:\windows\system32\drivers\cpuz135_x64.sys [2010-11-09 21992]
S2 Greg_Service;GRegService;c:\program files (x86)\Gateway\Registration\GregHSRW.exe [2009-08-28 1150496]
S2 UltraMonUtility;UltraMon Utility Driver;c:\program files (x86)\Common Files\Realtime Soft\UltraMonMirrorDrv\x64\UltraMonUtility.sys [2008-11-14 20512]
S2 Updater Service;Updater Service;c:\program files\Gateway\Gateway Updater\UpdaterService.exe [2009-07-04 240160]
S3 e1yexpress;Intel(R) Gigabit Network Connections Driver;c:\windows\system32\DRIVERS\e1y60x64.sys [2009-06-10 281088]
S3 EuMusDesignVirtualAudioCableWdm;Virtual Audio Cable (WDM);c:\windows\system32\DRIVERS\vrtaucbl.sys [2012-01-28 66728]
S3 IntcHdmiAddService;Intel(R) High Definition Audio HDMI;c:\windows\system32\drivers\IntcHdmi.sys [2009-05-25 138752]
S3 LGBusEnum;Logitech GamePanel Virtual Bus Enumerator Driver;c:\windows\system32\drivers\LGBusEnum.sys [2009-11-24 22408]
S3 ManyCam;ManyCam Virtual Webcam, WDM Video Capture Driver;c:\windows\system32\DRIVERS\ManyCam_x64.sys [2008-03-13 27136]
S3 pneteth;PdaNet Broadband;c:\windows\system32\DRIVERS\pneteth.sys [2011-07-19 15360]
.
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\svchost]
hpdevmgmt	REG_MULTI_SZ   	hpqcxs08 hpqddsvc
.
Contents of the 'Scheduled Tasks' folder
.
2012-07-14 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-09-18 22:04]
.
2012-07-14 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-09-18 22:04]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IAAnotif"="c:\program files (x86)\Intel\Intel Matrix Storage Manager\iaanotif.exe" [2009-06-05 186904]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2009-07-20 7981088]
"Launch LCore"="c:\program files\Logitech Gaming Software\LCore.exe" [2011-07-28 110360]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2011-02-12 162328]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2011-02-12 386584]
"Persistence"="c:\windows\system32\igfxpers.exe" [2011-02-12 417304]
"picop"="c:\users\Bre\AppData\Roaming\picop.dll" [BU]
"ianex"="c:\users\Bre\AppData\Roaming\ianex.dll" [BU]
.
------- Supplementary Scan -------
.
uLocal Page = c:\windows\system32\blank.htm
mStart Page = hxxp://homepage.gateway.com/rdr.aspx?b=ACGW&l=0409&m=sx2800&r=173604117307p0358v115k49i15222
mLocal Page = c:\windows\SysWOW64\blank.htm
uInternet Settings,ProxyServer = http=;ftp=;https=;
IE: E&xport to Microsoft Excel - c:\progra~2\MICROS~1\Office12\EXCEL.EXE/3000
IE: Google Sidewiki... - c:\program files (x86)\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_D183CA64F05FDD98.dll/cmsidewiki.html
TCP: DhcpNameServer = 192.168.2.1
FF - ProfilePath - c:\users\Bre\AppData\Roaming\Mozilla\Firefox\Profiles\y7r4no5l.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://www.facebook.com/
FF - prefs.js: keyword.URL - hxxp://www.google.co.in/search?btnG=Google+Search&q=
FF - prefs.js: network.proxy.gopher - 
FF - prefs.js: network.proxy.gopher_port - 0
FF - prefs.js: network.proxy.type - 0
.
- - - - ORPHANS REMOVED - - - -
.
Toolbar-Locked - (no file)
Toolbar-{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc} - (no file)
.
.
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_USERS\S-1-5-21-520610219-17727062-633966983-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.eml\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="WindowsLiveMail.Email.1"
.
[HKEY_USERS\S-1-5-21-520610219-17727062-633966983-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.vcf\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="WindowsLiveMail.VCard.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil10e.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\LocalServer32]
@="c:\\Windows\\SysWow64\\Macromed\\Flash\\FlashUtil10e.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10e.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.10"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10e.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10e.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10e.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}]
@Denied: (A 2) (Everyone)
@="IFlashBroker3"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
------------------------ Other Running Processes ------------------------
.
c:\program files (x86)\Belkin\Router Setup and Monitor\BelkinService.exe
c:\program files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
c:\program files (x86)\Intel\Intel Matrix Storage Manager\IAANTMon.exe
c:\program files (x86)\Belkin\Router Setup and Monitor\BelkinSetup.exe
.
**************************************************************************
.
Completion time: 2012-07-14  08:34:32 - machine was rebooted
ComboFix-quarantined-files.txt  2012-07-14 12:34
ComboFix2.txt  2012-07-14 01:16
ComboFix3.txt  2012-06-25 01:30
ComboFix4.txt  2012-06-21 00:13
.
Pre-Run: 143,757,914,112 bytes free
Post-Run: 143,700,901,888 bytes free
.
- - End Of File - - 3618AB4EC679BCCBFA2D7FBE69AD9AEA


----------



## johnb35

I've been trying to go through your log very thoroughly.  I think we are getting closer.  However, can you please rerun tdsskiller and do a full scan with malwarebytes and post the logs.  Also noticed you had a new issue with Services.exe being infected.  That wasn't on the previous combofix logs.  Have you been doing anything new?


----------



## Motorcharge

tds killer, nothing found


Malwarebytes Anti-Malware 1.61.0.1400
www.malwarebytes.org

Database version: v2012.06.23.06

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 9.0.8112.16421
Bre :: LEE [administrator]

7/16/2012 4:37:23 PM
mbam-log-2012-07-16 (16-37-23).txt

Scan type: Quick scan
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
Scan options disabled: P2P
Objects scanned: 211852
Time elapsed: 1 minute(s), 56 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 0
(No malicious items detected)

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 0
(No malicious items detected)

Files Detected: 0
(No malicious items detected)

(end)


Running full scan atm, and nope, nothing new at all.


----------



## Motorcharge

Malwarebytes Anti-Malware 1.62.0.1300
www.malwarebytes.org

Database version: v2012.07.16.11

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 9.0.8112.16421
Bre :: LEE [administrator]

7/16/2012 4:42:16 PM
mbam-log-2012-07-16 (16-42-16).txt

Scan type: Full scan (C:\|)
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
Scan options disabled: P2P
Objects scanned: 402620
Time elapsed: 35 minute(s), 45 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 0
(No malicious items detected)

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 0
(No malicious items detected)

Files Detected: 7
C:\Qoobox\Quarantine\C\Users\Bre\AppData\Local\pmybgvbos.exe.vir (Trojan.Lameshield) -> Quarantined and deleted successfully.
C:\Qoobox\Quarantine\C\Users\Bre\AppData\Local\{604e7576-ec0d-7231-cc64-a8dfba4e3e1f}\n.vir (Rootkit.0Access) -> Quarantined and deleted successfully.
C:\Qoobox\Quarantine\C\Users\Bre\AppData\Local\{604e7576-ec0d-7231-cc64-a8dfba4e3e1f}\U\00000008.@.vir (Trojan.Dropper.BCMiner) -> Quarantined and deleted successfully.
C:\Qoobox\Quarantine\C\Users\Bre\AppData\Roaming\picop.dll.vir (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Qoobox\Quarantine\C\Windows\Installer\{604e7576-ec0d-7231-cc64-a8dfba4e3e1f}\n.vir (Rootkit.0Access) -> Quarantined and deleted successfully.
C:\Qoobox\Quarantine\C\Windows\Installer\{604e7576-ec0d-7231-cc64-a8dfba4e3e1f}\U\00000008.@.vir (Trojan.Dropper.BCMiner) -> Quarantined and deleted successfully.
C:\Qoobox\Quarantine\C\Windows\System32\consrv.dll.vir (Rootkit.0Access) -> Quarantined and deleted successfully.

(end)


----------



## johnb35

It seems you are visiting a website that is infecting you with the zero access rootkit.  Are you or another member of the family visiting shotty websites?


----------



## Motorcharge

I'm the only one that uses this computer and I go to the same sites I've been going to for years.

Here, Jeepforum, facebook, tumblr, my gmail, NAXJA, and Netflix are about it.

Seems like everytime I get rid of something something new pops up in it's place now. I'm getting Google redirects now that are installing this Security Shield shit. Combofix can't seem to do anything better than a very temporary fix.


----------



## johnb35

Manually delete this folder.

c:\programdata\{32364CEA-7855-4A3C-B674-53D8E9B97936}

It was created on june 12th. The file inside that folder is considered malware.

{D3742F82-1C1A-4DCC-ABBD-0E831C0185CC}.msi

If it won't let you delete it let me know.


----------



## Motorcharge

Restarted and booted into safe mode to run malwarbytes.

Results:

Malwarebytes Anti-Malware 1.62.0.1300
www.malwarebytes.org

Database version: v2012.07.16.11

Windows 7 Service Pack 1 x64 NTFS (Safe Mode)
Internet Explorer 9.0.8112.16421
Bre :: LEE [administrator]

7/16/2012 6:15:35 PM
mbam-log-2012-07-16 (18-15-35).txt

Scan type: Quick scan
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
Scan options disabled: P2P
Objects scanned: 213836
Time elapsed: 1 minute(s), 43 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 0
(No malicious items detected)

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 0
(No malicious items detected)

Files Detected: 2
C:\Users\Bre\Local Settings\hdyahm.exe (Trojan.Lameshield) -> Quarantined and deleted successfully.
C:\Users\Bre\Local Settings\Application Data\hdyahm.exe (Trojan.Lameshield) -> Quarantined and deleted successfully.

(end)


----------



## Motorcharge

johnb35 said:


> Manually delete this folder.
> 
> c:\programdata\{32364CEA-7855-4A3C-B674-53D8E9B97936}
> 
> It was created on june 12th. The file inside that folder is considered malware.
> 
> {D3742F82-1C1A-4DCC-ABBD-0E831C0185CC}.msi
> 
> If it won't let you delete it let me know.



That filepath isn't visible and I have hidden folders viewable.


----------



## johnb35

It may also help to make sure show protected operating system files is enabled.   However, if its still not showing do the following.

1. Go to Start > Run > type Notepad.exe and click OK to open Notepad.
It must be Notepad, not Wordpad.
2. Copy the text in the below code box



		Code:
	

Killall::

Folder::

c:\programdata\{32364CEA-7855-4A3C-B674-53D8E9B97936}




3. Go to the Notepad window and click Edit > Paste
4. Then click File > Save
5. Name the file CFScript.txt - Save the file to your Desktop
6. Then drag the CFScript (hold the left mouse button while dragging the file) and drop it (release the left mouse button) into ComboFix.exe as you see in the screenshot below. Important: Perform this instruction carefully!







ComboFix will begin to execute, just follow the prompts.
After reboot (in case it asks to reboot), it will produce a log for you.
Post that log (Combofix.txt) in your next reply.


----------



## Motorcharge

ComboFix 12-06-28.03 - Bre 07/16/2012  18:38:06.6.4 - x64
Microsoft Windows 7 Home Premium   6.1.7601.1.1252.1.1033.18.4061.2631 [GMT -4:00]
Running from: c:\users\Bre\Downloads\ComboFix.exe
Command switches used :: c:\users\Bre\Downloads\CFScript.txt
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
 * Created a new restore point
.
.
(((((((((((((((((((((((((((((((((((((((   Other Deletions   )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\programdata\{32364CEA-7855-4A3C-B674-53D8E9B97936}
c:\programdata\{32364CEA-7855-4A3C-B674-53D8E9B97936}\{D3742F82-1C1A-4DCC-ABBD-0E831C0185CC}.msi
c:\users\Bre\AppData\Local\Temp\1.tmp\F_IN_BOX.dll
.
.
(((((((((((((((((((((((((   Files Created from 2012-06-16 to 2012-07-16  )))))))))))))))))))))))))))))))
.
.
2012-07-16 22:42 . 2012-07-16 22:42	--------	d-----w-	c:\users\Default\AppData\Local\temp
2012-07-13 06:21 . 2012-06-18 07:12	9013136	----a-w-	c:\programdata\Microsoft\Windows Defender\Definition Updates\{97D554BF-9C7C-49C2-AF51-E0B1D30B51EF}\mpengine.dll
2012-07-08 04:16 . 2012-07-08 04:16	--------	d-----w-	c:\users\Bre\AppData\Roaming\HideIPEasy
2012-07-08 04:16 . 2012-07-08 04:16	--------	d-----w-	c:\programdata\HideIPEasy
2012-07-08 04:15 . 2012-07-08 04:15	--------	d-----w-	c:\program files (x86)\Ask.com
2012-07-08 04:15 . 2012-07-08 04:15	--------	d-----w-	c:\users\Bre\AppData\Local\APN
2012-07-08 04:14 . 2012-07-08 04:16	--------	d-----w-	c:\program files (x86)\HideIPEasy
2012-07-06 00:01 . 2012-07-06 00:01	--------	d-----w-	c:\users\Bre\AppData\Local\{B4F8B799-C6FD-11E1-8270-B8AC6F996F26}
2012-06-24 21:47 . 2012-06-24 21:47	--------	d-----w-	c:\users\Bre\AppData\Local\Macromedia
2012-06-24 21:45 . 2012-06-24 21:45	--------	d-----w-	c:\programdata\McAfee
2012-06-24 21:45 . 2012-06-24 21:45	70344	----a-w-	c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2012-06-24 21:45 . 2012-06-24 21:45	426184	----a-w-	c:\windows\SysWow64\FlashPlayerApp.exe
2012-06-23 12:12 . 2012-06-23 12:12	--------	d-sh--w-	c:\windows\SysWow64\%APPDATA%
2012-06-21 01:01 . 2012-06-21 01:01	--------	d-----w-	c:\program files (x86)\ESET
2012-06-20 23:54 . 2012-06-20 23:54	--------	d-----w-	C:\TDSSKiller_Quarantine
2012-06-17 21:10 . 2012-06-17 21:10	--------	d-----w-	c:\program files\Microsoft Silverlight
2012-06-17 21:10 . 2012-06-17 21:10	--------	d-----w-	c:\program files (x86)\Microsoft Silverlight
2012-06-17 19:36 . 2011-07-20 18:58	44032	----a-w-	c:\windows\system32\drivers\RimSerial_AMD64.sys
2012-06-17 19:36 . 2012-06-24 13:47	--------	d-----w-	c:\program files (x86)\Common Files\Research In Motion
.
.
.
((((((((((((((((((((((((((((((((((((((((   Find3M Report   ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-07-03 17:46 . 2012-04-25 22:50	24904	----a-w-	c:\windows\system32\drivers\mbam.sys
2012-05-17 23:51 . 2012-05-17 23:51	283200	----a-w-	c:\windows\system32\drivers\dtsoftbus01.sys
2012-05-17 22:50 . 2012-05-17 22:50	71680	----a-w-	c:\windows\system32\frapsv64.dll
2012-05-17 22:50 . 2012-05-17 22:50	65536	----a-w-	c:\windows\SysWow64\frapsvid.dll
2012-04-26 07:09 . 2012-04-26 07:09	91648	----a-w-	c:\windows\system32\SetIEInstalledDate.exe
2012-04-26 07:09 . 2012-04-26 07:09	89088	----a-w-	c:\windows\system32\RegisterIEPKEYs.exe
2012-04-26 07:09 . 2012-04-26 07:09	86528	----a-w-	c:\windows\SysWow64\iesysprep.dll
2012-04-26 07:09 . 2012-04-26 07:09	85504	----a-w-	c:\windows\system32\iesetup.dll
2012-04-26 07:09 . 2012-04-26 07:09	76800	----a-w-	c:\windows\SysWow64\SetIEInstalledDate.exe
2012-04-26 07:09 . 2012-04-26 07:09	76800	----a-w-	c:\windows\system32\tdc.ocx
2012-04-26 07:09 . 2012-04-26 07:09	74752	----a-w-	c:\windows\SysWow64\RegisterIEPKEYs.exe
2012-04-26 07:09 . 2012-04-26 07:09	74752	----a-w-	c:\windows\SysWow64\iesetup.dll
2012-04-26 07:09 . 2012-04-26 07:09	63488	----a-w-	c:\windows\SysWow64\tdc.ocx
2012-04-26 07:09 . 2012-04-26 07:09	603648	----a-w-	c:\windows\system32\vbscript.dll
2012-04-26 07:09 . 2012-04-26 07:09	49664	----a-w-	c:\windows\system32\imgutil.dll
2012-04-26 07:09 . 2012-04-26 07:09	48640	----a-w-	c:\windows\SysWow64\mshtmler.dll
2012-04-26 07:09 . 2012-04-26 07:09	48640	----a-w-	c:\windows\system32\mshtmler.dll
2012-04-26 07:09 . 2012-04-26 07:09	448512	----a-w-	c:\windows\system32\html.iec
2012-04-26 07:09 . 2012-04-26 07:09	420864	----a-w-	c:\windows\SysWow64\vbscript.dll
2012-04-26 07:09 . 2012-04-26 07:09	367104	----a-w-	c:\windows\SysWow64\html.iec
2012-04-26 07:09 . 2012-04-26 07:09	35840	----a-w-	c:\windows\SysWow64\imgutil.dll
2012-04-26 07:09 . 2012-04-26 07:09	30720	----a-w-	c:\windows\system32\licmgr10.dll
2012-04-26 07:09 . 2012-04-26 07:09	23552	----a-w-	c:\windows\SysWow64\licmgr10.dll
2012-04-26 07:09 . 2012-04-26 07:09	222208	----a-w-	c:\windows\system32\msls31.dll
2012-04-26 07:09 . 2012-04-26 07:09	173056	----a-w-	c:\windows\system32\ieUnatt.exe
2012-04-26 07:09 . 2012-04-26 07:09	165888	----a-w-	c:\windows\system32\iexpress.exe
2012-04-26 07:09 . 2012-04-26 07:09	161792	----a-w-	c:\windows\SysWow64\msls31.dll
2012-04-26 07:09 . 2012-04-26 07:09	160256	----a-w-	c:\windows\system32\wextract.exe
2012-04-26 07:09 . 2012-04-26 07:09	152064	----a-w-	c:\windows\SysWow64\wextract.exe
2012-04-26 07:09 . 2012-04-26 07:09	150528	----a-w-	c:\windows\SysWow64\iexpress.exe
2012-04-26 07:09 . 2012-04-26 07:09	142848	----a-w-	c:\windows\SysWow64\ieUnatt.exe
2012-04-26 07:09 . 2012-04-26 07:09	135168	----a-w-	c:\windows\system32\IEAdvpack.dll
2012-04-26 07:09 . 2012-04-26 07:09	12288	----a-w-	c:\windows\system32\mshta.exe
2012-04-26 07:09 . 2012-04-26 07:09	11776	----a-w-	c:\windows\SysWow64\mshta.exe
2012-04-26 07:09 . 2012-04-26 07:09	114176	----a-w-	c:\windows\system32\admparse.dll
2012-04-26 07:09 . 2012-04-26 07:09	111616	----a-w-	c:\windows\system32\iesysprep.dll
2012-04-26 07:09 . 2012-04-26 07:09	110592	----a-w-	c:\windows\SysWow64\IEAdvpack.dll
2012-04-26 07:09 . 2012-04-26 07:09	101888	----a-w-	c:\windows\SysWow64\admparse.dll
2012-04-25 22:44 . 2012-04-25 22:44	23112	----a-w-	c:\windows\system32\drivers\hitmanpro35.sys
2012-04-25 22:36 . 2012-04-25 22:36	81408	----a-w-	c:\windows\system32\imagehlp.dll
2012-04-25 22:36 . 2012-04-25 22:36	5120	----a-w-	c:\windows\SysWow64\wmi.dll
2012-04-25 22:36 . 2012-04-25 22:36	5120	----a-w-	c:\windows\system32\wmi.dll
2012-04-25 22:36 . 2012-04-25 22:36	23408	----a-w-	c:\windows\system32\drivers\fs_rec.sys
2012-04-25 22:36 . 2012-04-25 22:36	220672	----a-w-	c:\windows\system32\wintrust.dll
2012-04-25 22:36 . 2012-04-25 22:36	172544	----a-w-	c:\windows\SysWow64\wintrust.dll
2012-04-25 22:36 . 2012-04-25 22:36	159232	----a-w-	c:\windows\SysWow64\imagehlp.dll
2012-04-25 22:33 . 2012-04-25 22:33	9216	----a-w-	c:\windows\system32\rdrmemptylst.exe
2012-04-25 22:33 . 2012-04-25 22:33	77312	----a-w-	c:\windows\system32\rdpwsx.dll
2012-04-25 22:33 . 2012-04-25 22:33	149504	----a-w-	c:\windows\system32\rdpcorekmts.dll
2012-04-25 22:32 . 2012-04-25 22:32	826880	----a-w-	c:\windows\SysWow64\rdpcore.dll
2012-04-25 22:32 . 2012-04-25 22:32	23552	----a-w-	c:\windows\system32\drivers\tdtcp.sys
2012-04-25 22:32 . 2012-04-25 22:32	210944	----a-w-	c:\windows\system32\drivers\rdpwd.sys
2012-04-25 22:32 . 2012-04-25 22:32	1031680	----a-w-	c:\windows\system32\rdpcore.dll
2012-04-25 22:27 . 2012-04-25 22:27	509952	----a-w-	c:\windows\system32\ntshrui.dll
2012-04-25 22:27 . 2012-04-25 22:27	442880	----a-w-	c:\windows\SysWow64\ntshrui.dll
2012-04-25 22:26 . 2012-04-25 22:26	515584	----a-w-	c:\windows\system32\timedate.cpl
2012-04-25 22:26 . 2012-04-25 22:26	478720	----a-w-	c:\windows\SysWow64\timedate.cpl
2012-04-25 22:26 . 2012-04-25 22:26	498688	----a-w-	c:\windows\system32\drivers\afd.sys
2012-04-25 22:23 . 2012-04-25 22:23	690688	----a-w-	c:\windows\SysWow64\msvcrt.dll
2012-04-25 22:23 . 2012-04-25 22:23	634880	----a-w-	c:\windows\system32\msvcrt.dll
2012-04-25 22:21 . 2012-04-25 22:21	1731920	----a-w-	c:\windows\system32\ntdll.dll
2012-04-25 22:21 . 2012-04-25 22:21	1292080	----a-w-	c:\windows\SysWow64\ntdll.dll
2012-04-25 22:21 . 2012-04-25 22:21	96768	----a-w-	c:\windows\SysWow64\sspicli.dll
2012-04-25 22:21 . 2012-04-25 22:21	95600	----a-w-	c:\windows\system32\drivers\ksecdd.sys
2012-04-25 22:21 . 2012-04-25 22:21	459232	----a-w-	c:\windows\system32\drivers\cng.sys
2012-04-25 22:21 . 2012-04-25 22:21	395776	----a-w-	c:\windows\system32\webio.dll
2012-04-25 22:21 . 2012-04-25 22:21	340992	----a-w-	c:\windows\system32\schannel.dll
2012-04-25 22:21 . 2012-04-25 22:21	314880	----a-w-	c:\windows\SysWow64\webio.dll
2012-04-25 22:21 . 2012-04-25 22:21	31232	----a-w-	c:\windows\system32\lsass.exe
2012-04-25 22:21 . 2012-04-25 22:21	29184	----a-w-	c:\windows\system32\sspisrv.dll
2012-04-25 22:21 . 2012-04-25 22:21	28160	----a-w-	c:\windows\system32\secur32.dll
2012-04-25 22:21 . 2012-04-25 22:21	224768	----a-w-	c:\windows\SysWow64\schannel.dll
2012-04-25 22:21 . 2012-04-25 22:21	22016	----a-w-	c:\windows\SysWow64\secur32.dll
2012-04-25 22:21 . 2012-04-25 22:21	152432	----a-w-	c:\windows\system32\drivers\ksecpkg.sys
2012-04-25 22:21 . 2012-04-25 22:21	1447936	----a-w-	c:\windows\system32\lsasrv.dll
2012-04-25 22:21 . 2012-04-25 22:21	136192	----a-w-	c:\windows\system32\sspicli.dll
2012-04-25 22:21 . 2012-04-25 22:21	514560	----a-w-	c:\windows\SysWow64\qdvd.dll
2012-04-25 22:21 . 2012-04-25 22:21	366592	----a-w-	c:\windows\system32\qdvd.dll
2012-04-25 22:21 . 2012-04-25 22:21	1572864	----a-w-	c:\windows\system32\quartz.dll
2012-04-25 22:21 . 2012-04-25 22:21	1328128	----a-w-	c:\windows\SysWow64\quartz.dll
2012-04-25 22:20 . 2012-04-25 22:20	77312	----a-w-	c:\windows\system32\packager.dll
2012-04-25 22:20 . 2012-04-25 22:20	67072	----a-w-	c:\windows\SysWow64\packager.dll
2012-04-25 22:16 . 2012-04-25 22:16	2048	----a-w-	c:\windows\SysWow64\tzres.dll
2012-04-25 22:16 . 2012-04-25 22:16	2048	----a-w-	c:\windows\system32\tzres.dll
2012-04-25 22:16 . 2012-04-25 22:16	43520	----a-w-	c:\windows\system32\csrsrv.dll
2012-04-25 22:16 . 2012-04-25 22:16	723456	----a-w-	c:\windows\system32\EncDec.dll
2012-04-25 22:16 . 2012-04-25 22:16	534528	----a-w-	c:\windows\SysWow64\EncDec.dll
2012-04-25 22:07 . 2012-04-25 22:07	75776	----a-w-	c:\windows\SysWow64\psisrndr.ax
2012-04-25 22:07 . 2012-04-25 22:07	613888	----a-w-	c:\windows\system32\psisdecd.dll
2012-04-25 22:07 . 2012-04-25 22:07	465408	----a-w-	c:\windows\SysWow64\psisdecd.dll
2012-04-25 22:07 . 2012-04-25 22:07	108032	----a-w-	c:\windows\system32\psisrndr.ax
2012-04-25 22:06 . 2012-04-25 22:06	861696	----a-w-	c:\windows\system32\oleaut32.dll
2012-04-25 22:06 . 2012-04-25 22:06	571904	----a-w-	c:\windows\SysWow64\oleaut32.dll
2012-04-25 22:06 . 2012-04-25 22:06	331776	----a-w-	c:\windows\system32\oleacc.dll
2012-04-25 22:06 . 2012-04-25 22:06	233472	----a-w-	c:\windows\SysWow64\oleacc.dll
2012-04-19 00:56 . 2012-04-19 00:56	94208	----a-w-	c:\windows\SysWow64\QuickTimeVR.qtx
2012-04-19 00:56 . 2012-04-19 00:56	69632	----a-w-	c:\windows\SysWow64\QuickTime.qts
.
.
------- Sigcheck -------
Note: Unsigned files aren't necessarily malware.
.
[7] 2011-02-26 . E38899074D4951D31B4040E994DD7C8D . 2870784 . . [6.1.7600.16385] .. c:\windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20910_none_ae79ed04ac56c4a9\explorer.exe
[7] 2011-02-26 . 0862495E0C825893DB75EF44FAEA8E93 . 2870272 . . [6.1.7600.16385] .. c:\windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16768_none_adc24107935a7e25\explorer.exe
[7] 2011-02-26 . 3B69712041F3D63605529BD66DC00C48 . 2871808 . . [6.1.7600.16385] .. c:\windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.21669_none_b0333b22a99da332\explorer.exe
[7] 2011-02-25 . 332FEAB1435662FC6C672E25BEB37BE3 . 2871808 . . [6.1.7600.16385] .. c:\windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17567_none_afa79dc39081d0ba\explorer.exe
[7] 2010-11-20 . AC4C51EB24AA95B77F705AB159189E24 . 2872320 . . [6.1.7600.16385] .. c:\windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17514_none_afdaac81905bf900\explorer.exe
[7] 2009-10-31 . B8EC4BD49CE8F6FC457721BFC210B67F . 2870272 . . [6.1.7600.16385] .. c:\windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20563_none_ae46d6aeac7ca7c7\explorer.exe
[-] 2009-10-31 . D5A67267C4C3879E63E9BFBA991D823A . 2387456 . . [6.1.7600.16385] .. c:\windows\explorer.exe
[7] 2009-10-31 . 9AAAEC8DAC27AA17B053E6352AD233AE . 2870272 . . [6.1.7600.16385] .. c:\windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16450_none_adc508f19359a007\explorer.exe
[7] 2009-08-03 . 700073016DAC1C3D2E7E2CE4223334B6 . 2868224 . . [6.1.7600.16385] .. c:\windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20500_none_ae84b558ac4eb41c\explorer.exe
[7] 2009-08-03 . F170B4A061C9E026437B193B4D571799 . 2868224 . . [6.1.7600.16385] .. c:\windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16404_none_adff19b5932d79ae\explorer.exe
[7] 2009-07-14 . C235A51CB740E45FFA0EBFB9BAFCDA64 . 2868224 . . [6.1.7600.16385] .. c:\windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16385_none_ada998b9936d7566\explorer.exe
.
(((((((((((((((((((((((((((((   SnapShot_2012-07-14_01.11.56   )))))))))))))))))))))))))))))))))))))))))
.
+ 2009-10-30 05:01 . 2012-07-16 22:19	53792              c:\windows\system32\wdi\ShutdownPerformanceDiagnostics_SystemData.bin
+ 2009-07-14 05:10 . 2012-07-16 22:19	30586              c:\windows\system32\wdi\BootPerformanceDiagnostics_SystemData.bin
+ 2011-04-20 19:48 . 2012-07-16 22:19	13672              c:\windows\system32\wdi\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-520610219-17727062-633966983-1000_UserData.bin
- 2011-04-20 19:20 . 2012-07-08 10:06	16384              c:\windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
+ 2011-04-20 19:20 . 2012-07-14 03:15	16384              c:\windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
- 2011-04-20 19:20 . 2012-07-08 10:06	32768              c:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
+ 2011-04-20 19:20 . 2012-07-14 03:15	32768              c:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
- 2009-07-14 04:54 . 2012-07-08 10:06	32768              c:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2009-07-14 04:54 . 2012-07-14 03:15	32768              c:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2009-07-14 04:46 . 2012-07-14 01:14	91888              c:\windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\SoftwareProtectionPlatform\Cache\cache.dat
+ 2011-09-19 10:39 . 2012-07-16 22:43	3266              c:\windows\system32\wdi\ERCQueuedResolutions.dat
+ 2012-07-16 22:43 . 2012-07-16 22:43	2048              c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
- 2012-07-14 01:10 . 2012-07-14 01:10	2048              c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
+ 2012-07-16 22:43 . 2012-07-16 22:43	2048              c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
- 2012-07-14 01:10 . 2012-07-14 01:10	2048              c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
+ 2009-07-14 02:36 . 2012-07-16 22:23	660172              c:\windows\system32\perfh009.dat
- 2009-07-14 02:36 . 2012-07-07 22:14	660172              c:\windows\system32\perfh009.dat
+ 2009-07-14 02:36 . 2012-07-16 22:23	121100              c:\windows\system32\perfc009.dat
- 2009-07-14 02:36 . 2012-07-07 22:14	121100              c:\windows\system32\perfc009.dat
+ 2009-07-14 05:01 . 2012-07-16 22:43	513088              c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-System.dat
- 2009-07-14 05:01 . 2012-07-14 01:10	513088              c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-System.dat
+ 2012-07-15 20:36 . 2012-07-15 20:36	245760              c:\windows\Installer\6e3f34b.msi
+ 2011-09-19 10:39 . 2012-07-16 22:43	10326528              c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-S-1-5-21-520610219-17727062-633966983-1000-12288.dat
.
(((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown 
REGEDIT4
.
[HKEY_LOCAL_MACHINE\Wow6432Node\~\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}]
2012-06-07 01:33	1519304	----a-w-	c:\program files (x86)\Ask.com\GenericAskToolbar.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar]
"{D4027C7F-154A-4066-A1AD-4243D8127440}"= "c:\program files (x86)\Ask.com\GenericAskToolbar.dll" [2012-06-07 1519304]
.
[HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]
[HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RocketDock"="c:\program files (x86)\RocketDock\RocketDock.exe" [2007-09-02 495616]
"Advanced SystemCare 5"="c:\program files (x86)\IObit\Advanced SystemCare 5\ASCTray.exe" [2012-05-28 288128]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"InstaLAN"="c:\program files (x86)\Belkin\Router Setup and Monitor\BelkinRouterMonitor.exe" [2011-02-25 1770400]
"APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2012-02-21 59240]
"ApnUpdater"="c:\program files (x86)\Ask.com\Updater\Updater.exe" [2012-06-07 1564872]
.
c:\users\Bre\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
CurseClientStartup.ccip [2011-10-9 0]
Rainmeter.lnk - c:\program files\Rainmeter\Rainmeter.exe [2011-9-18 102912]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
UltraMon.lnk - c:\windows\Installer\{537056B7-32A4-4408-9B54-0341963C7C9C}\IcoUltraMon.ico [2011-9-18 29310]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 0 (0x0)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Security Packages	REG_MULTI_SZ   	kerberos msv1_0 schannel wdigest tspkg pku2u livessp
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\run-]
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe"
"HP Software Update"=c:\program files (x86)\HP\HP Software Update\HPWuSchd2.exe
"iTunesHelper"="c:\program files (x86)\iTunes\iTunesHelper.exe"
"ConduitHelper"="c:\users\Public\Conduit\ConduitHelper\ConduitHelper.exe"
"Freecorder FLV Service"="c:\program files (x86)\Freecorder\FLVSrvc.exe" /run
"Gateway Photo Frame"="c:\program files (x86)\Gateway Photo Frame\ButtonMonitor.exe" -A
"QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" -atboottime
.
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R2 gupdate;Google Update Service (gupdate);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-09-18 136176]
R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe [2012-07-03 160944]
R3 BTCFilterService;USB Networking Driver Filter Service;c:\windows\system32\DRIVERS\motfilt.sys [2009-01-29 6144]
R3 BVRPMPR5a64;BVRPMPR5a64 NDIS Protocol Driver;c:\windows\system32\drivers\BVRPMPR5a64.SYS [2010-06-30 35840]
R3 gupdatem;Google Update Service (gupdatem);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-09-18 136176]
R3 LGVirHid;Logitech Gamepanel Virtual HID Device Driver;c:\windows\system32\drivers\LGVirHid.sys [2011-09-19 16008]
R3 motandroidusb;Mot ADB Interface Driver;c:\windows\system32\Drivers\motoandroid.sys [2009-07-10 31744]
R3 motccgp;Motorola USB Composite Device Driver;c:\windows\system32\DRIVERS\motccgp.sys [2011-04-04 21504]
R3 motccgpfl;MotCcgpFlService;c:\windows\system32\DRIVERS\motccgpfl.sys [2009-01-29 9216]
R3 Motousbnet;Motorola USB Networking Driver Service;c:\windows\system32\DRIVERS\Motousbnet.sys [2010-04-01 26624]
R3 MozillaMaintenance;Mozilla Maintenance Service;c:\program files (x86)\Mozilla Maintenance Service\maintenanceservice.exe [2012-06-16 113120]
R3 pbfilter;pbfilter;c:\program files\PeerBlock\pbfilter.sys [2010-11-07 24176]
R3 phaudlwr;Philips Audio Filter;c:\windows\system32\DRIVERS\phaudlwr.sys [2009-10-20 114608]
R3 RTL8192su;Realtek RTL8192SU Wireless LAN 802.11n USB 2.0 Network Adapter;c:\windows\system32\DRIVERS\RTL8192su.sys [2010-09-29 695400]
R3 SPC620;Philips SPC620NC PC Camera;c:\windows\system32\drivers\SPC620.sys [2007-09-28 581120]
R3 SPC620m;Philips SPC620NC PC Cameram;c:\windows\system32\drivers\SPC620m.sys [2007-09-28 8192]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-20 59392]
R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [2011-04-20 1255736]
R3 WinRing0_1_2_0;WinRing0_1_2_0;c:\program files (x86)\IObit\Game Booster 3\Driver\WinRing0x64.sys [2010-11-01 14544]
R3 WMZuneComm;Zune Windows Mobile Connectivity Service;c:\program files\Zune\WMZuneComm.exe [2011-08-05 306400]
S1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;c:\windows\system32\DRIVERS\dtsoftbus01.sys [2012-05-17 283200]
S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [2009-07-14 59904]
S2 AdvancedSystemCareService5;Advanced SystemCare Service 5;c:\program files (x86)\IObit\Advanced SystemCare 5\ASCService.exe [2012-05-26 913792]
S2 cpuz135;cpuz135;c:\windows\system32\drivers\cpuz135_x64.sys [2010-11-09 21992]
S2 Greg_Service;GRegService;c:\program files (x86)\Gateway\Registration\GregHSRW.exe [2009-08-28 1150496]
S2 UltraMonUtility;UltraMon Utility Driver;c:\program files (x86)\Common Files\Realtime Soft\UltraMonMirrorDrv\x64\UltraMonUtility.sys [2008-11-14 20512]
S2 Updater Service;Updater Service;c:\program files\Gateway\Gateway Updater\UpdaterService.exe [2009-07-04 240160]
S3 e1yexpress;Intel(R) Gigabit Network Connections Driver;c:\windows\system32\DRIVERS\e1y60x64.sys [2009-06-10 281088]
S3 EuMusDesignVirtualAudioCableWdm;Virtual Audio Cable (WDM);c:\windows\system32\DRIVERS\vrtaucbl.sys [2012-01-28 66728]
S3 IntcHdmiAddService;Intel(R) High Definition Audio HDMI;c:\windows\system32\drivers\IntcHdmi.sys [2009-05-25 138752]
S3 LGBusEnum;Logitech GamePanel Virtual Bus Enumerator Driver;c:\windows\system32\drivers\LGBusEnum.sys [2009-11-24 22408]
S3 ManyCam;ManyCam Virtual Webcam, WDM Video Capture Driver;c:\windows\system32\DRIVERS\ManyCam_x64.sys [2008-03-13 27136]
S3 pneteth;PdaNet Broadband;c:\windows\system32\DRIVERS\pneteth.sys [2011-07-19 15360]
.
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\svchost]
hpdevmgmt	REG_MULTI_SZ   	hpqcxs08 hpqddsvc
.
Contents of the 'Scheduled Tasks' folder
.
2012-07-16 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-09-18 22:04]
.
2012-07-16 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-09-18 22:04]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IAAnotif"="c:\program files (x86)\Intel\Intel Matrix Storage Manager\iaanotif.exe" [2009-06-05 186904]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2009-07-20 7981088]
"Launch LCore"="c:\program files\Logitech Gaming Software\LCore.exe" [2011-07-28 110360]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2011-02-12 162328]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2011-02-12 386584]
"Persistence"="c:\windows\system32\igfxpers.exe" [2011-02-12 417304]
.
------- Supplementary Scan -------
.
uLocal Page = c:\windows\system32\blank.htm
mStart Page = hxxp://homepage.gateway.com/rdr.aspx?b=ACGW&l=0409&m=sx2800&r=173604117307p0358v115k49i15222
mLocal Page = c:\windows\SysWOW64\blank.htm
uInternet Settings,ProxyServer = http=;ftp=;https=;
IE: E&xport to Microsoft Excel - c:\progra~2\MICROS~1\Office12\EXCEL.EXE/3000
IE: Google Sidewiki... - c:\program files (x86)\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_D183CA64F05FDD98.dll/cmsidewiki.html
TCP: DhcpNameServer = 192.168.2.1
FF - ProfilePath - c:\users\Bre\AppData\Roaming\Mozilla\Firefox\Profiles\y7r4no5l.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://www.facebook.com/
FF - prefs.js: keyword.URL - hxxp://www.google.co.in/search?btnG=Google+Search&q=
FF - prefs.js: network.proxy.gopher - 
FF - prefs.js: network.proxy.gopher_port - 0
FF - prefs.js: network.proxy.type - 0
.
- - - - ORPHANS REMOVED - - - -
.
Toolbar-Locked - (no file)
Toolbar-{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc} - (no file)
.
.
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_USERS\S-1-5-21-520610219-17727062-633966983-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.eml\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="WindowsLiveMail.Email.1"
.
[HKEY_USERS\S-1-5-21-520610219-17727062-633966983-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.vcf\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="WindowsLiveMail.VCard.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil10e.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\LocalServer32]
@="c:\\Windows\\SysWow64\\Macromed\\Flash\\FlashUtil10e.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10e.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.10"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10e.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10e.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10e.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}]
@Denied: (A 2) (Everyone)
@="IFlashBroker3"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
------------------------ Other Running Processes ------------------------
.
c:\program files (x86)\Belkin\Router Setup and Monitor\BelkinService.exe
c:\program files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
c:\program files (x86)\Intel\Intel Matrix Storage Manager\IAANTMon.exe
c:\program files (x86)\Belkin\Router Setup and Monitor\BelkinSetup.exe
c:\program files (x86)\Mozilla Firefox\firefox.exe
.
**************************************************************************
.
Completion time: 2012-07-16  18:48:23 - machine was rebooted
ComboFix-quarantined-files.txt  2012-07-16 22:48
ComboFix2.txt  2012-07-14 12:34
ComboFix3.txt  2012-07-14 01:16
ComboFix4.txt  2012-06-25 01:30
ComboFix5.txt  2012-07-16 22:36
.
Pre-Run: 139,012,124,672 bytes free
Post-Run: 138,937,561,088 bytes free
.
- - End Of File - - AA37C970046F71850A659722DBED13D6


----------



## johnb35

Just curious, are you still using utorrent?  Thats a possibility as well.


----------



## Motorcharge

It's installed but I only run it when downloading a torrent which I haven't done in weeks. Otherwise everything is removed from it and it's not run.

edit: it doesn't run at start up either


----------



## Motorcharge

Security Shield crap came back after a redirect this time. Had to run Combofix in safe mode.

ComboFix 12-06-28.03 - Bre 07/18/2012  16:13:20.7.4 - x64 MINIMAL
Microsoft Windows 7 Home Premium   6.1.7601.1.1252.1.1033.18.4061.3039 [GMT -4:00]
Running from: c:\users\Bre\Downloads\ComboFix.exe
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
 * Created a new restore point
.
.
(((((((((((((((((((((((((((((((((((((((   Other Deletions   )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\users\Bre\AppData\Local\nkhir.exe
.
.
(((((((((((((((((((((((((   Files Created from 2012-06-18 to 2012-07-18  )))))))))))))))))))))))))))))))
.
.
2012-07-18 20:18 . 2012-07-18 20:18	--------	d-----w-	c:\users\Default\AppData\Local\temp
2012-07-13 06:21 . 2012-06-18 07:12	9013136	----a-w-	c:\programdata\Microsoft\Windows Defender\Definition Updates\{97D554BF-9C7C-49C2-AF51-E0B1D30B51EF}\mpengine.dll
2012-07-08 04:16 . 2012-07-08 04:16	--------	d-----w-	c:\users\Bre\AppData\Roaming\HideIPEasy
2012-07-08 04:16 . 2012-07-08 04:16	--------	d-----w-	c:\programdata\HideIPEasy
2012-07-08 04:15 . 2012-07-08 04:15	--------	d-----w-	c:\program files (x86)\Ask.com
2012-07-08 04:15 . 2012-07-08 04:15	--------	d-----w-	c:\users\Bre\AppData\Local\APN
2012-07-08 04:14 . 2012-07-08 04:16	--------	d-----w-	c:\program files (x86)\HideIPEasy
2012-07-06 00:01 . 2012-07-06 00:01	--------	d-----w-	c:\users\Bre\AppData\Local\{B4F8B799-C6FD-11E1-8270-B8AC6F996F26}
2012-06-24 21:47 . 2012-06-24 21:47	--------	d-----w-	c:\users\Bre\AppData\Local\Macromedia
2012-06-24 21:45 . 2012-06-24 21:45	--------	d-----w-	c:\programdata\McAfee
2012-06-24 21:45 . 2012-06-24 21:45	70344	----a-w-	c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2012-06-24 21:45 . 2012-06-24 21:45	426184	----a-w-	c:\windows\SysWow64\FlashPlayerApp.exe
2012-06-23 12:12 . 2012-06-23 12:12	--------	d-sh--w-	c:\windows\SysWow64\%APPDATA%
2012-06-21 01:01 . 2012-06-21 01:01	--------	d-----w-	c:\program files (x86)\ESET
2012-06-20 23:54 . 2012-06-20 23:54	--------	d-----w-	C:\TDSSKiller_Quarantine
.
.
.
((((((((((((((((((((((((((((((((((((((((   Find3M Report   ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-07-03 17:46 . 2012-04-25 22:50	24904	----a-w-	c:\windows\system32\drivers\mbam.sys
2012-05-17 23:51 . 2012-05-17 23:51	283200	----a-w-	c:\windows\system32\drivers\dtsoftbus01.sys
2012-05-17 22:50 . 2012-05-17 22:50	71680	----a-w-	c:\windows\system32\frapsv64.dll
2012-05-17 22:50 . 2012-05-17 22:50	65536	----a-w-	c:\windows\SysWow64\frapsvid.dll
2012-04-26 07:09 . 2012-04-26 07:09	91648	----a-w-	c:\windows\system32\SetIEInstalledDate.exe
2012-04-26 07:09 . 2012-04-26 07:09	89088	----a-w-	c:\windows\system32\RegisterIEPKEYs.exe
2012-04-26 07:09 . 2012-04-26 07:09	86528	----a-w-	c:\windows\SysWow64\iesysprep.dll
2012-04-26 07:09 . 2012-04-26 07:09	85504	----a-w-	c:\windows\system32\iesetup.dll
2012-04-26 07:09 . 2012-04-26 07:09	76800	----a-w-	c:\windows\SysWow64\SetIEInstalledDate.exe
2012-04-26 07:09 . 2012-04-26 07:09	76800	----a-w-	c:\windows\system32\tdc.ocx
2012-04-26 07:09 . 2012-04-26 07:09	74752	----a-w-	c:\windows\SysWow64\RegisterIEPKEYs.exe
2012-04-26 07:09 . 2012-04-26 07:09	74752	----a-w-	c:\windows\SysWow64\iesetup.dll
2012-04-26 07:09 . 2012-04-26 07:09	63488	----a-w-	c:\windows\SysWow64\tdc.ocx
2012-04-26 07:09 . 2012-04-26 07:09	603648	----a-w-	c:\windows\system32\vbscript.dll
2012-04-26 07:09 . 2012-04-26 07:09	49664	----a-w-	c:\windows\system32\imgutil.dll
2012-04-26 07:09 . 2012-04-26 07:09	48640	----a-w-	c:\windows\SysWow64\mshtmler.dll
2012-04-26 07:09 . 2012-04-26 07:09	48640	----a-w-	c:\windows\system32\mshtmler.dll
2012-04-26 07:09 . 2012-04-26 07:09	448512	----a-w-	c:\windows\system32\html.iec
2012-04-26 07:09 . 2012-04-26 07:09	420864	----a-w-	c:\windows\SysWow64\vbscript.dll
2012-04-26 07:09 . 2012-04-26 07:09	367104	----a-w-	c:\windows\SysWow64\html.iec
2012-04-26 07:09 . 2012-04-26 07:09	35840	----a-w-	c:\windows\SysWow64\imgutil.dll
2012-04-26 07:09 . 2012-04-26 07:09	30720	----a-w-	c:\windows\system32\licmgr10.dll
2012-04-26 07:09 . 2012-04-26 07:09	23552	----a-w-	c:\windows\SysWow64\licmgr10.dll
2012-04-26 07:09 . 2012-04-26 07:09	222208	----a-w-	c:\windows\system32\msls31.dll
2012-04-26 07:09 . 2012-04-26 07:09	173056	----a-w-	c:\windows\system32\ieUnatt.exe
2012-04-26 07:09 . 2012-04-26 07:09	165888	----a-w-	c:\windows\system32\iexpress.exe
2012-04-26 07:09 . 2012-04-26 07:09	161792	----a-w-	c:\windows\SysWow64\msls31.dll
2012-04-26 07:09 . 2012-04-26 07:09	160256	----a-w-	c:\windows\system32\wextract.exe
2012-04-26 07:09 . 2012-04-26 07:09	152064	----a-w-	c:\windows\SysWow64\wextract.exe
2012-04-26 07:09 . 2012-04-26 07:09	150528	----a-w-	c:\windows\SysWow64\iexpress.exe
2012-04-26 07:09 . 2012-04-26 07:09	142848	----a-w-	c:\windows\SysWow64\ieUnatt.exe
2012-04-26 07:09 . 2012-04-26 07:09	135168	----a-w-	c:\windows\system32\IEAdvpack.dll
2012-04-26 07:09 . 2012-04-26 07:09	12288	----a-w-	c:\windows\system32\mshta.exe
2012-04-26 07:09 . 2012-04-26 07:09	11776	----a-w-	c:\windows\SysWow64\mshta.exe
2012-04-26 07:09 . 2012-04-26 07:09	114176	----a-w-	c:\windows\system32\admparse.dll
2012-04-26 07:09 . 2012-04-26 07:09	111616	----a-w-	c:\windows\system32\iesysprep.dll
2012-04-26 07:09 . 2012-04-26 07:09	110592	----a-w-	c:\windows\SysWow64\IEAdvpack.dll
2012-04-26 07:09 . 2012-04-26 07:09	101888	----a-w-	c:\windows\SysWow64\admparse.dll
2012-04-25 22:44 . 2012-04-25 22:44	23112	----a-w-	c:\windows\system32\drivers\hitmanpro35.sys
2012-04-25 22:36 . 2012-04-25 22:36	81408	----a-w-	c:\windows\system32\imagehlp.dll
2012-04-25 22:36 . 2012-04-25 22:36	5120	----a-w-	c:\windows\SysWow64\wmi.dll
2012-04-25 22:36 . 2012-04-25 22:36	5120	----a-w-	c:\windows\system32\wmi.dll
2012-04-25 22:36 . 2012-04-25 22:36	23408	----a-w-	c:\windows\system32\drivers\fs_rec.sys
2012-04-25 22:36 . 2012-04-25 22:36	220672	----a-w-	c:\windows\system32\wintrust.dll
2012-04-25 22:36 . 2012-04-25 22:36	172544	----a-w-	c:\windows\SysWow64\wintrust.dll
2012-04-25 22:36 . 2012-04-25 22:36	159232	----a-w-	c:\windows\SysWow64\imagehlp.dll
2012-04-25 22:33 . 2012-04-25 22:33	9216	----a-w-	c:\windows\system32\rdrmemptylst.exe
2012-04-25 22:33 . 2012-04-25 22:33	77312	----a-w-	c:\windows\system32\rdpwsx.dll
2012-04-25 22:33 . 2012-04-25 22:33	149504	----a-w-	c:\windows\system32\rdpcorekmts.dll
2012-04-25 22:32 . 2012-04-25 22:32	826880	----a-w-	c:\windows\SysWow64\rdpcore.dll
2012-04-25 22:32 . 2012-04-25 22:32	23552	----a-w-	c:\windows\system32\drivers\tdtcp.sys
2012-04-25 22:32 . 2012-04-25 22:32	210944	----a-w-	c:\windows\system32\drivers\rdpwd.sys
2012-04-25 22:32 . 2012-04-25 22:32	1031680	----a-w-	c:\windows\system32\rdpcore.dll
2012-04-25 22:27 . 2012-04-25 22:27	509952	----a-w-	c:\windows\system32\ntshrui.dll
2012-04-25 22:27 . 2012-04-25 22:27	442880	----a-w-	c:\windows\SysWow64\ntshrui.dll
2012-04-25 22:26 . 2012-04-25 22:26	515584	----a-w-	c:\windows\system32\timedate.cpl
2012-04-25 22:26 . 2012-04-25 22:26	478720	----a-w-	c:\windows\SysWow64\timedate.cpl
2012-04-25 22:26 . 2012-04-25 22:26	498688	----a-w-	c:\windows\system32\drivers\afd.sys
2012-04-25 22:23 . 2012-04-25 22:23	690688	----a-w-	c:\windows\SysWow64\msvcrt.dll
2012-04-25 22:23 . 2012-04-25 22:23	634880	----a-w-	c:\windows\system32\msvcrt.dll
2012-04-25 22:21 . 2012-04-25 22:21	1731920	----a-w-	c:\windows\system32\ntdll.dll
2012-04-25 22:21 . 2012-04-25 22:21	1292080	----a-w-	c:\windows\SysWow64\ntdll.dll
2012-04-25 22:21 . 2012-04-25 22:21	96768	----a-w-	c:\windows\SysWow64\sspicli.dll
2012-04-25 22:21 . 2012-04-25 22:21	95600	----a-w-	c:\windows\system32\drivers\ksecdd.sys
2012-04-25 22:21 . 2012-04-25 22:21	459232	----a-w-	c:\windows\system32\drivers\cng.sys
2012-04-25 22:21 . 2012-04-25 22:21	395776	----a-w-	c:\windows\system32\webio.dll
2012-04-25 22:21 . 2012-04-25 22:21	340992	----a-w-	c:\windows\system32\schannel.dll
2012-04-25 22:21 . 2012-04-25 22:21	314880	----a-w-	c:\windows\SysWow64\webio.dll
2012-04-25 22:21 . 2012-04-25 22:21	31232	----a-w-	c:\windows\system32\lsass.exe
2012-04-25 22:21 . 2012-04-25 22:21	29184	----a-w-	c:\windows\system32\sspisrv.dll
2012-04-25 22:21 . 2012-04-25 22:21	28160	----a-w-	c:\windows\system32\secur32.dll
2012-04-25 22:21 . 2012-04-25 22:21	224768	----a-w-	c:\windows\SysWow64\schannel.dll
2012-04-25 22:21 . 2012-04-25 22:21	22016	----a-w-	c:\windows\SysWow64\secur32.dll
2012-04-25 22:21 . 2012-04-25 22:21	152432	----a-w-	c:\windows\system32\drivers\ksecpkg.sys
2012-04-25 22:21 . 2012-04-25 22:21	1447936	----a-w-	c:\windows\system32\lsasrv.dll
2012-04-25 22:21 . 2012-04-25 22:21	136192	----a-w-	c:\windows\system32\sspicli.dll
2012-04-25 22:21 . 2012-04-25 22:21	514560	----a-w-	c:\windows\SysWow64\qdvd.dll
2012-04-25 22:21 . 2012-04-25 22:21	366592	----a-w-	c:\windows\system32\qdvd.dll
2012-04-25 22:21 . 2012-04-25 22:21	1572864	----a-w-	c:\windows\system32\quartz.dll
2012-04-25 22:21 . 2012-04-25 22:21	1328128	----a-w-	c:\windows\SysWow64\quartz.dll
2012-04-25 22:20 . 2012-04-25 22:20	77312	----a-w-	c:\windows\system32\packager.dll
2012-04-25 22:20 . 2012-04-25 22:20	67072	----a-w-	c:\windows\SysWow64\packager.dll
2012-04-25 22:16 . 2012-04-25 22:16	2048	----a-w-	c:\windows\SysWow64\tzres.dll
2012-04-25 22:16 . 2012-04-25 22:16	2048	----a-w-	c:\windows\system32\tzres.dll
2012-04-25 22:16 . 2012-04-25 22:16	43520	----a-w-	c:\windows\system32\csrsrv.dll
2012-04-25 22:16 . 2012-04-25 22:16	723456	----a-w-	c:\windows\system32\EncDec.dll
2012-04-25 22:16 . 2012-04-25 22:16	534528	----a-w-	c:\windows\SysWow64\EncDec.dll
2012-04-25 22:07 . 2012-04-25 22:07	75776	----a-w-	c:\windows\SysWow64\psisrndr.ax
2012-04-25 22:07 . 2012-04-25 22:07	613888	----a-w-	c:\windows\system32\psisdecd.dll
2012-04-25 22:07 . 2012-04-25 22:07	465408	----a-w-	c:\windows\SysWow64\psisdecd.dll
2012-04-25 22:07 . 2012-04-25 22:07	108032	----a-w-	c:\windows\system32\psisrndr.ax
2012-04-25 22:06 . 2012-04-25 22:06	861696	----a-w-	c:\windows\system32\oleaut32.dll
2012-04-25 22:06 . 2012-04-25 22:06	571904	----a-w-	c:\windows\SysWow64\oleaut32.dll
2012-04-25 22:06 . 2012-04-25 22:06	331776	----a-w-	c:\windows\system32\oleacc.dll
2012-04-25 22:06 . 2012-04-25 22:06	233472	----a-w-	c:\windows\SysWow64\oleacc.dll
.
.
------- Sigcheck -------
Note: Unsigned files aren't necessarily malware.
.
[7] 2011-02-26 . E38899074D4951D31B4040E994DD7C8D . 2870784 . . [6.1.7600.20910] .. c:\windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20910_none_ae79ed04ac56c4a9\explorer.exe
[7] 2011-02-26 . 0862495E0C825893DB75EF44FAEA8E93 . 2870272 . . [6.1.7600.16768] .. c:\windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16768_none_adc24107935a7e25\explorer.exe
[7] 2011-02-26 . 3B69712041F3D63605529BD66DC00C48 . 2871808 . . [6.1.7601.21669] .. c:\windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.21669_none_b0333b22a99da332\explorer.exe
[7] 2011-02-25 . 332FEAB1435662FC6C672E25BEB37BE3 . 2871808 . . [6.1.7601.17567] .. c:\windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17567_none_afa79dc39081d0ba\explorer.exe
[7] 2010-11-20 . AC4C51EB24AA95B77F705AB159189E24 . 2872320 . . [6.1.7601.17514] .. c:\windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17514_none_afdaac81905bf900\explorer.exe
[7] 2009-10-31 . B8EC4BD49CE8F6FC457721BFC210B67F . 2870272 . . [6.1.7600.20563] .. c:\windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20563_none_ae46d6aeac7ca7c7\explorer.exe
[-] 2009-10-31 . D5A67267C4C3879E63E9BFBA991D823A . 2387456 . . [6.1.7600.16385] .. c:\windows\explorer.exe
[7] 2009-10-31 . 9AAAEC8DAC27AA17B053E6352AD233AE . 2870272 . . [6.1.7600.16450] .. c:\windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16450_none_adc508f19359a007\explorer.exe
[7] 2009-08-03 . 700073016DAC1C3D2E7E2CE4223334B6 . 2868224 . . [6.1.7600.20500] .. c:\windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20500_none_ae84b558ac4eb41c\explorer.exe
[7] 2009-08-03 . F170B4A061C9E026437B193B4D571799 . 2868224 . . [6.1.7600.16404] .. c:\windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16404_none_adff19b5932d79ae\explorer.exe
[7] 2009-07-14 . C235A51CB740E45FFA0EBFB9BAFCDA64 . 2868224 . . [6.1.7600.16385] .. c:\windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16385_none_ada998b9936d7566\explorer.exe
.
(((((((((((((((((((((((((((((   SnapShot_2012-07-14_01.11.56   )))))))))))))))))))))))))))))))))))))))))
.
+ 2009-10-30 05:01 . 2012-07-18 20:08	54510              c:\windows\system32\wdi\ShutdownPerformanceDiagnostics_SystemData.bin
+ 2009-07-14 05:10 . 2012-07-18 20:08	30730              c:\windows\system32\wdi\BootPerformanceDiagnostics_SystemData.bin
+ 2011-04-20 19:48 . 2012-07-18 20:08	14004              c:\windows\system32\wdi\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-520610219-17727062-633966983-1000_UserData.bin
- 2011-04-20 19:20 . 2012-07-08 10:06	16384              c:\windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
+ 2011-04-20 19:20 . 2012-07-14 03:15	16384              c:\windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
- 2011-04-20 19:20 . 2012-07-08 10:06	32768              c:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
+ 2011-04-20 19:20 . 2012-07-14 03:15	32768              c:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
- 2009-07-14 04:54 . 2012-07-08 10:06	32768              c:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2009-07-14 04:54 . 2012-07-14 03:15	32768              c:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2009-07-14 04:46 . 2012-07-14 01:14	91888              c:\windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\SoftwareProtectionPlatform\Cache\cache.dat
+ 2011-09-19 10:39 . 2012-07-17 03:13	3266              c:\windows\system32\wdi\ERCQueuedResolutions.dat
+ 2012-07-18 20:11 . 2012-07-18 20:11	2048              c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
- 2012-07-14 01:10 . 2012-07-14 01:10	2048              c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
+ 2012-07-18 20:11 . 2012-07-18 20:11	2048              c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
- 2012-07-14 01:10 . 2012-07-14 01:10	2048              c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
+ 2009-07-14 02:36 . 2012-07-17 23:36	660172              c:\windows\system32\perfh009.dat
- 2009-07-14 02:36 . 2012-07-07 22:14	660172              c:\windows\system32\perfh009.dat
+ 2009-07-14 02:36 . 2012-07-17 23:36	121100              c:\windows\system32\perfc009.dat
- 2009-07-14 02:36 . 2012-07-07 22:14	121100              c:\windows\system32\perfc009.dat
+ 2009-07-14 05:01 . 2012-07-18 20:10	513088              c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-System.dat
- 2009-07-14 05:01 . 2012-07-14 01:10	513088              c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-System.dat
+ 2012-07-15 20:36 . 2012-07-15 20:36	245760              c:\windows\Installer\6e3f34b.msi
+ 2011-09-19 10:39 . 2012-07-18 20:10	10411486              c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-S-1-5-21-520610219-17727062-633966983-1000-12288.dat
.
(((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown 
REGEDIT4
.
[HKEY_LOCAL_MACHINE\Wow6432Node\~\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}]
2012-06-07 01:33	1519304	----a-w-	c:\program files (x86)\Ask.com\GenericAskToolbar.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar]
"{D4027C7F-154A-4066-A1AD-4243D8127440}"= "c:\program files (x86)\Ask.com\GenericAskToolbar.dll" [2012-06-07 1519304]
.
[HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]
[HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RocketDock"="c:\program files (x86)\RocketDock\RocketDock.exe" [2007-09-02 495616]
"Advanced SystemCare 5"="c:\program files (x86)\IObit\Advanced SystemCare 5\ASCTray.exe" [2012-05-28 288128]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"InstaLAN"="c:\program files (x86)\Belkin\Router Setup and Monitor\BelkinRouterMonitor.exe" [2011-02-25 1770400]
"APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2012-02-21 59240]
"ApnUpdater"="c:\program files (x86)\Ask.com\Updater\Updater.exe" [2012-06-07 1564872]
.
c:\users\Bre\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
CurseClientStartup.ccip [2011-10-9 0]
Rainmeter.lnk - c:\program files\Rainmeter\Rainmeter.exe [2011-9-18 102912]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
UltraMon.lnk - c:\windows\Installer\{537056B7-32A4-4408-9B54-0341963C7C9C}\IcoUltraMon.ico [2011-9-18 29310]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 0 (0x0)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Security Packages	REG_MULTI_SZ   	kerberos msv1_0 schannel wdigest tspkg pku2u livessp
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\run-]
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe"
"HP Software Update"=c:\program files (x86)\HP\HP Software Update\HPWuSchd2.exe
"iTunesHelper"="c:\program files (x86)\iTunes\iTunesHelper.exe"
"ConduitHelper"="c:\users\Public\Conduit\ConduitHelper\ConduitHelper.exe"
"Freecorder FLV Service"="c:\program files (x86)\Freecorder\FLVSrvc.exe" /run
"Gateway Photo Frame"="c:\program files (x86)\Gateway Photo Frame\ButtonMonitor.exe" -A
"QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" -atboottime
.
R1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [2009-07-14 59904]
R2 AdvancedSystemCareService5;Advanced SystemCare Service 5;c:\program files (x86)\IObit\Advanced SystemCare 5\ASCService.exe [2012-05-26 913792]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R2 cpuz135;cpuz135;c:\windows\system32\drivers\cpuz135_x64.sys [2010-11-09 21992]
R2 Greg_Service;GRegService;c:\program files (x86)\Gateway\Registration\GregHSRW.exe [2009-08-28 1150496]
R2 gupdate;Google Update Service (gupdate);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-09-18 136176]
R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe [2012-07-03 160944]
R2 UltraMonUtility;UltraMon Utility Driver;c:\program files (x86)\Common Files\Realtime Soft\UltraMonMirrorDrv\x64\UltraMonUtility.sys [2008-11-14 20512]
R2 Updater Service;Updater Service;c:\program files\Gateway\Gateway Updater\UpdaterService.exe [2009-07-04 240160]
R3 BTCFilterService;USB Networking Driver Filter Service;c:\windows\system32\DRIVERS\motfilt.sys [2009-01-29 6144]
R3 BVRPMPR5a64;BVRPMPR5a64 NDIS Protocol Driver;c:\windows\system32\drivers\BVRPMPR5a64.SYS [2010-06-30 35840]
R3 e1yexpress;Intel(R) Gigabit Network Connections Driver;c:\windows\system32\DRIVERS\e1y60x64.sys [2009-06-10 281088]
R3 EuMusDesignVirtualAudioCableWdm;Virtual Audio Cable (WDM);c:\windows\system32\DRIVERS\vrtaucbl.sys [2012-01-28 66728]
R3 gupdatem;Google Update Service (gupdatem);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-09-18 136176]
R3 IntcHdmiAddService;Intel(R) High Definition Audio HDMI;c:\windows\system32\drivers\IntcHdmi.sys [2009-05-25 138752]
R3 LGVirHid;Logitech Gamepanel Virtual HID Device Driver;c:\windows\system32\drivers\LGVirHid.sys [2011-09-19 16008]
R3 ManyCam;ManyCam Virtual Webcam, WDM Video Capture Driver;c:\windows\system32\DRIVERS\ManyCam_x64.sys [2008-03-13 27136]
R3 motandroidusb;Mot ADB Interface Driver;c:\windows\system32\Drivers\motoandroid.sys [2009-07-10 31744]
R3 motccgp;Motorola USB Composite Device Driver;c:\windows\system32\DRIVERS\motccgp.sys [2011-04-04 21504]
R3 motccgpfl;MotCcgpFlService;c:\windows\system32\DRIVERS\motccgpfl.sys [2009-01-29 9216]
R3 Motousbnet;Motorola USB Networking Driver Service;c:\windows\system32\DRIVERS\Motousbnet.sys [2010-04-01 26624]
R3 MozillaMaintenance;Mozilla Maintenance Service;c:\program files (x86)\Mozilla Maintenance Service\maintenanceservice.exe [2012-06-16 113120]
R3 pbfilter;pbfilter;c:\program files\PeerBlock\pbfilter.sys [2010-11-07 24176]
R3 phaudlwr;Philips Audio Filter;c:\windows\system32\DRIVERS\phaudlwr.sys [2009-10-20 114608]
R3 pneteth;PdaNet Broadband;c:\windows\system32\DRIVERS\pneteth.sys [2011-07-19 15360]
R3 RTL8192su;Realtek RTL8192SU Wireless LAN 802.11n USB 2.0 Network Adapter;c:\windows\system32\DRIVERS\RTL8192su.sys [2010-09-29 695400]
R3 SPC620;Philips SPC620NC PC Camera;c:\windows\system32\drivers\SPC620.sys [2007-09-28 581120]
R3 SPC620m;Philips SPC620NC PC Cameram;c:\windows\system32\drivers\SPC620m.sys [2007-09-28 8192]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-20 59392]
R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [2011-04-20 1255736]
R3 WinRing0_1_2_0;WinRing0_1_2_0;c:\program files (x86)\IObit\Game Booster 3\Driver\WinRing0x64.sys [2010-11-01 14544]
R3 WMZuneComm;Zune Windows Mobile Connectivity Service;c:\program files\Zune\WMZuneComm.exe [2011-08-05 306400]
S1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;c:\windows\system32\DRIVERS\dtsoftbus01.sys [2012-05-17 283200]
S3 LGBusEnum;Logitech GamePanel Virtual Bus Enumerator Driver;c:\windows\system32\drivers\LGBusEnum.sys [2009-11-24 22408]
.
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\svchost]
hpdevmgmt	REG_MULTI_SZ   	hpqcxs08 hpqddsvc
.
Contents of the 'Scheduled Tasks' folder
.
2012-07-18 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-09-18 22:04]
.
2012-07-18 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-09-18 22:04]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IAAnotif"="c:\program files (x86)\Intel\Intel Matrix Storage Manager\iaanotif.exe" [2009-06-05 186904]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2009-07-20 7981088]
"Launch LCore"="c:\program files\Logitech Gaming Software\LCore.exe" [2011-07-28 110360]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2011-02-12 162328]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2011-02-12 386584]
"Persistence"="c:\windows\system32\igfxpers.exe" [2011-02-12 417304]
.
------- Supplementary Scan -------
.
uLocal Page = c:\windows\system32\blank.htm
mStart Page = hxxp://homepage.gateway.com/rdr.aspx?b=ACGW&l=0409&m=sx2800&r=173604117307p0358v115k49i15222
mLocal Page = c:\windows\SysWOW64\blank.htm
uInternet Settings,ProxyServer = http=;ftp=;https=;
IE: E&xport to Microsoft Excel - c:\progra~2\MICROS~1\Office12\EXCEL.EXE/3000
IE: Google Sidewiki... - c:\program files (x86)\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_D183CA64F05FDD98.dll/cmsidewiki.html
TCP: DhcpNameServer = 75.75.75.75 75.75.76.76
FF - ProfilePath - c:\users\Bre\AppData\Roaming\Mozilla\Firefox\Profiles\y7r4no5l.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://www.facebook.com/
FF - prefs.js: keyword.URL - hxxp://www.google.co.in/search?btnG=Google+Search&q=
FF - prefs.js: network.proxy.gopher - 
FF - prefs.js: network.proxy.gopher_port - 0
FF - prefs.js: network.proxy.type - 0
.
- - - - ORPHANS REMOVED - - - -
.
Toolbar-Locked - (no file)
Toolbar-{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc} - (no file)
.
.
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_USERS\S-1-5-21-520610219-17727062-633966983-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.eml\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="WindowsLiveMail.Email.1"
.
[HKEY_USERS\S-1-5-21-520610219-17727062-633966983-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.vcf\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="WindowsLiveMail.VCard.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil10e.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\LocalServer32]
@="c:\\Windows\\SysWow64\\Macromed\\Flash\\FlashUtil10e.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10e.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.10"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10e.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10e.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10e.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}]
@Denied: (A 2) (Everyone)
@="IFlashBroker3"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
Completion time: 2012-07-18  16:20:44
ComboFix-quarantined-files.txt  2012-07-18 20:20
ComboFix2.txt  2012-07-16 22:48
ComboFix3.txt  2012-07-14 12:34
ComboFix4.txt  2012-07-14 01:16
ComboFix5.txt  2012-07-18 20:12
.
Pre-Run: 153,532,559,360 bytes free
Post-Run: 153,368,715,264 bytes free
.
- - End Of File - - CA479C9A5915DB64D891DE06A4234F80


----------



## johnb35

Please download *Farbar Recovery Scan Tool* and save it to a flash drive.



Plug the flashdrive into the infected PC.

Enter System Recovery Options. 

To enter System Recovery Options from the Advanced Boot Options:

•  Restart the computer.

•  As soon as the BIOS is loaded begin tapping the F8 key until Advanced Boot Options appears.

•  Use the arrow keys to select the Repair your computer menu item.

•  Select US as the keyboard language settings, and then click Next.

•  Select the operating system you want to repair, and then click Next.

•  Select your user account an click Next.

To enter System Recovery Options by using Windows installation disc:

•  Insert the installation disc.

•  Restart your computer.

•  If prompted, press any key to start Windows from the installation disc. If your computer is not configured to start from a CD or DVD, check your BIOS settings.

•  Click Repair your computer.

•  Select US as the keyboard language settings, and then click Next.

•  Select the operating system you want to repair, and then click Next.

•  Select your user account and click Next.

On the System Recovery Options menu you will get the following options:
Startup Repair
System Restore
Windows Complete PC Restore
Windows Memory Diagnostic Tool
Command Prompt

•  Select Command Prompt

•  In the command window type in notepad and press Enter.

•  The notepad opens. Under File menu select Open.

•  Select "Computer" and find your flash drive letter and close the notepad.

•  In the command window type e:\frst64 and press Enter 
Note: Replace letter e with the drive letter of your flash drive.

•  The tool will start to run.

•  When the tool opens click Yes to disclaimer.

•  Press Scan button.

•  It will make a log (FRST.txt) on the flash drive. Please copy and paste it to your reply


----------



## Motorcharge

Don't own or have access to a flash drive unfortunately nor the Windows disk.


----------



## johnb35

Can you access the advanced boot options?  I'm not sure if this program will work being saved on windows drive itself.  You can try saving the file to your c drive directly.


----------



## Motorcharge

That's what I get when I run it.






here is what I got running the scan:

Scan result of Farbar Recovery Scan Tool Version: 16-07-2012 02
Ran by Bre at 18-07-2012 19:13:23
Running from C:\Users\Bre\Downloads
  Service Pack 1 (X64) OS Language: English(US) 
Attention: Could not load system hive.ERROR: The process cannot access the file because it is being used by another process.

ATTENTION:=====> THE TOOL IS NOT RUN FROM RECOVERY ENVIRONMENT AND WILL NOT FUNTION PROPERLY.


============ One Month Created Files and Folders ==============

2012-07-18 19:10 - 2012-07-18 19:13 - 00000000 ____D C:\FRST
2012-07-18 18:01 - 2012-07-18 18:01 - 01437107 ____A (Farbar) C:\Users\Bre\Downloads\FRST64.exe
2012-07-18 16:51 - 2012-07-18 16:53 - 00000000 ____D C:\Users\Bre\Desktop\Ratrod
2012-07-18 16:36 - 2012-07-18 16:36 - 00028971 ____A C:\Users\Bre\Desktop\lol.txt
2012-07-18 16:20 - 2012-07-18 16:20 - 00028971 ____A C:\ComboFix.txt
2012-07-17 19:20 - 2012-07-17 19:20 - 00003224 ____N C:\bootsqm.dat
2012-07-17 19:11 - 2012-07-17 19:11 - 01368912 ____A C:\Users\Bre\Downloads\F9K1002_WW_1.00.14.bin
2012-07-17 19:10 - 2012-07-17 19:10 - 00993290 ____A C:\Users\Bre\Downloads\F9K1002_WW_2.00.08.bin
2012-07-17 16:03 - 2012-07-17 16:03 - 493940160 ____A C:\Windows\MEMORY.DMP
2012-07-17 16:03 - 2012-07-17 16:03 - 00278016 ____A C:\Windows\Minidump\071712-15506-01.dmp
2012-07-16 18:18 - 2012-07-18 16:37 - 00001176 ____A C:\Windows\setupact.log
2012-07-16 18:18 - 2012-07-18 16:36 - 00002032 ____A C:\Windows\PFRO.log
2012-07-16 18:18 - 2012-07-16 18:18 - 00000000 ____A C:\Windows\setuperr.log
2012-07-15 16:51 - 2012-07-15 16:51 - 00086666 ____A C:\Users\Bre\AppData\Roaming\icarus-dxdiag.xml
2012-07-15 11:02 - 2012-07-16 19:21 - 00000000 ____D C:\Users\Bre\Desktop\Front tube bumper build
2012-07-08 00:16 - 2012-07-08 00:16 - 00000000 ____D C:\Users\Bre\AppData\Roaming\HideIPEasy
2012-07-08 00:16 - 2012-07-08 00:16 - 00000000 ____D C:\Users\All Users\HideIPEasy
2012-07-08 00:15 - 2012-07-08 00:15 - 00000000 ____D C:\Users\Bre\AppData\Local\APN
2012-07-08 00:15 - 2012-07-08 00:15 - 00000000 ____D C:\Program Files (x86)\Ask.com
2012-07-08 00:14 - 2012-07-08 00:16 - 00000000 ____D C:\Program Files (x86)\HideIPEasy
2012-07-05 20:01 - 2012-07-05 20:01 - 00000000 ____D C:\Users\Bre\AppData\Local\{B4F8B799-C6FD-11E1-8270-B8AC6F996F26}
2012-07-03 21:12 - 2012-07-03 21:12 - 10949969 ____A C:\Users\Bre\Downloads\Occult 45 - Grind Funk Railroad (Demo).zip
2012-07-03 19:40 - 2012-07-03 19:40 - 00772398 ____A C:\Windows\SysWOW64\PerfStringBackup.INI
2012-07-03 19:38 - 2012-07-03 19:38 - 07964033 ____A C:\Users\Bre\Downloads\RemoteControl_for_Winamp_1.00_setup.exe
2012-07-03 16:12 - 2012-07-03 16:12 - 00061552 ____A C:\Users\Bre\Downloads\RemoteDroidServer_v1.5.zip
2012-06-24 21:00 - 2012-06-24 21:00 - 02109806 ____A C:\Users\Bre\Downloads\tdsskiller.zip
2012-06-24 20:54 - 2012-06-24 20:54 - 00071398 ____A (jpshortstuff) C:\Users\Bre\Downloads\GooredFix.exe
2012-06-24 17:47 - 2012-06-24 17:47 - 00000000 ____D C:\Users\Bre\AppData\Local\Macromedia
2012-06-24 17:45 - 2012-06-24 17:45 - 00426184 ____A (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2012-06-24 17:45 - 2012-06-24 17:45 - 00070344 ____A (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2012-06-24 17:45 - 2012-06-24 17:45 - 00000000 ____D C:\Users\All Users\McAfee
2012-06-24 10:08 - 2012-06-24 10:08 - 00686792 ____A (Adobe Systems Incorporated) C:\Users\Bre\Downloads\uninstall_flash_player.exe
2012-06-23 08:12 - 2012-06-23 08:12 - 00000000 __SHD C:\Windows\SysWOW64\%APPDATA%
2012-06-23 08:05 - 2012-06-23 08:05 - 05312793 ____A C:\Users\Bre\Downloads\pairing_utility_1.00.009.zip
2012-06-20 22:04 - 2012-06-20 22:04 - 00011045 ____A C:\Users\Bre\Downloads\hijackthis.log
2012-06-20 21:01 - 2012-06-20 21:01 - 00000000 ____D C:\Program Files (x86)\ESET
2012-06-20 20:01 - 2011-06-26 02:45 - 00256000 ____A C:\Windows\PEV.exe
2012-06-20 20:01 - 2010-11-07 13:20 - 00208896 ____A C:\Windows\MBR.exe
2012-06-20 20:01 - 2009-04-20 00:56 - 00060416 ____A (NirSoft) C:\Windows\NIRCMD.exe
2012-06-20 20:01 - 2000-08-30 20:00 - 00518144 ____A (SteelWerX) C:\Windows\SWREG.exe
2012-06-20 20:01 - 2000-08-30 20:00 - 00406528 ____A (SteelWerX) C:\Windows\SWSC.exe
2012-06-20 20:01 - 2000-08-30 20:00 - 00098816 ____A C:\Windows\sed.exe
2012-06-20 20:01 - 2000-08-30 20:00 - 00080412 ____A C:\Windows\grep.exe
2012-06-20 20:01 - 2000-08-30 20:00 - 00068096 ____A C:\Windows\zip.exe
2012-06-20 19:59 - 2012-06-20 19:59 - 00000490 ____A C:\rkill.log
2012-06-20 19:54 - 2012-06-20 19:54 - 00000000 ____D C:\TDSSKiller_Quarantine
2012-06-20 19:33 - 2012-07-18 16:20 - 00000000 ____D C:\Qoobox
2012-06-20 19:33 - 2012-07-13 21:11 - 00000000 ____D C:\Windows\erdnt
2012-06-20 19:32 - 2012-06-28 18:42 - 04566027 ____R (Swearware) C:\Users\Bre\Downloads\ComboFix.exe
2012-06-18 18:44 - 2012-07-07 14:09 - 00000000 ____D C:\Users\Bre\Downloads\New folder3


============ 3 Months Modified Files ========================

2012-07-18 19:10 - 2011-09-18 18:04 - 00000892 ____A C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2012-07-18 18:01 - 2012-07-18 18:01 - 01437107 ____A (Farbar) C:\Users\Bre\Downloads\FRST64.exe
2012-07-18 16:44 - 2009-07-14 00:45 - 00009920 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2012-07-18 16:44 - 2009-07-14 00:45 - 00009920 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2012-07-18 16:43 - 2009-07-14 01:13 - 00779018 ____A C:\Windows\System32\PerfStringBackup.INI
2012-07-18 16:40 - 2011-04-20 15:14 - 01292300 ____A C:\Windows\WindowsUpdate.log
2012-07-18 16:37 - 2012-07-16 18:18 - 00001176 ____A C:\Windows\setupact.log
2012-07-18 16:37 - 2011-09-18 18:04 - 00000888 ____A C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2012-07-18 16:37 - 2009-07-14 01:08 - 00000006 ___AH C:\Windows\Tasks\SA.DAT
2012-07-18 16:36 - 2012-07-18 16:36 - 00028971 ____A C:\Users\Bre\Desktop\lol.txt
2012-07-18 16:36 - 2012-07-16 18:18 - 00002032 ____A C:\Windows\PFRO.log
2012-07-18 16:20 - 2012-07-18 16:20 - 00028971 ____A C:\ComboFix.txt
2012-07-18 16:19 - 2009-07-13 22:34 - 00000215 ____A C:\Windows\system.ini
2012-07-17 19:20 - 2012-07-17 19:20 - 00003224 ____N C:\bootsqm.dat
2012-07-17 19:11 - 2012-07-17 19:11 - 01368912 ____A C:\Users\Bre\Downloads\F9K1002_WW_1.00.14.bin
2012-07-17 19:10 - 2012-07-17 19:10 - 00993290 ____A C:\Users\Bre\Downloads\F9K1002_WW_2.00.08.bin
2012-07-17 16:03 - 2012-07-17 16:03 - 493940160 ____A C:\Windows\MEMORY.DMP
2012-07-17 16:03 - 2012-07-17 16:03 - 00278016 ____A C:\Windows\Minidump\071712-15506-01.dmp
2012-07-16 18:18 - 2012-07-16 18:18 - 00000000 ____A C:\Windows\setuperr.log
2012-07-15 16:51 - 2012-07-15 16:51 - 00086666 ____A C:\Users\Bre\AppData\Roaming\icarus-dxdiag.xml
2012-07-07 13:37 - 2011-11-22 22:14 - 00056832 ____A C:\Users\Bre\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2012-07-03 21:12 - 2012-07-03 21:12 - 10949969 ____A C:\Users\Bre\Downloads\Occult 45 - Grind Funk Railroad (Demo).zip
2012-07-03 19:40 - 2012-07-03 19:40 - 00772398 ____A C:\Windows\SysWOW64\PerfStringBackup.INI
2012-07-03 19:38 - 2012-07-03 19:38 - 07964033 ____A C:\Users\Bre\Downloads\RemoteControl_for_Winamp_1.00_setup.exe
2012-07-03 16:12 - 2012-07-03 16:12 - 00061552 ____A C:\Users\Bre\Downloads\RemoteDroidServer_v1.5.zip
2012-07-03 13:46 - 2012-04-25 18:50 - 00024904 ____A (Malwarebytes Corporation) C:\Windows\System32\Drivers\mbam.sys
2012-06-28 18:42 - 2012-06-20 19:32 - 04566027 ____R (Swearware) C:\Users\Bre\Downloads\ComboFix.exe
2012-06-24 21:13 - 2011-04-20 18:26 - 00104208 ____A C:\Users\Bre\AppData\Local\GDIPFONTCACHEV1.DAT
2012-06-24 21:13 - 2009-07-14 00:45 - 06366312 ____A C:\Windows\System32\FNTCACHE.DAT
2012-06-24 21:00 - 2012-06-24 21:00 - 02109806 ____A C:\Users\Bre\Downloads\tdsskiller.zip
2012-06-24 20:54 - 2012-06-24 20:54 - 00071398 ____A (jpshortstuff) C:\Users\Bre\Downloads\GooredFix.exe
2012-06-24 17:45 - 2012-06-24 17:45 - 00426184 ____A (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2012-06-24 17:45 - 2012-06-24 17:45 - 00070344 ____A (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2012-06-24 10:08 - 2012-06-24 10:08 - 00686792 ____A (Adobe Systems Incorporated) C:\Users\Bre\Downloads\uninstall_flash_player.exe
2012-06-23 08:05 - 2012-06-23 08:05 - 05312793 ____A C:\Users\Bre\Downloads\pairing_utility_1.00.009.zip
2012-06-20 22:04 - 2012-06-20 22:04 - 00011045 ____A C:\Users\Bre\Downloads\hijackthis.log
2012-06-20 20:08 - 2009-07-13 22:34 - 67108864 ____A C:\Windows\System32\config\SOFTWARE.bak
2012-06-20 20:08 - 2009-07-13 22:34 - 22544384 ____A C:\Windows\System32\config\SYSTEM.bak
2012-06-20 20:08 - 2009-07-13 22:34 - 00524288 ____A C:\Windows\System32\config\DEFAULT.bak
2012-06-20 20:08 - 2009-07-13 22:34 - 00057344 ____A C:\Windows\System32\config\SAM.bak
2012-06-20 20:08 - 2009-07-13 22:34 - 00028672 ____A C:\Windows\System32\config\SECURITY.bak
2012-06-20 19:59 - 2012-06-20 19:59 - 00000490 ____A C:\rkill.log
2012-06-17 15:37 - 2012-06-17 15:37 - 00000000 ___AH C:\Windows\System32\Drivers\Msft_Kernel_RimSerial_AMD64_01007.Wdf
2012-06-17 15:36 - 2012-06-17 15:36 - 00000000 ___AH C:\Windows\System32\Drivers\Msft_Kernel_RimUsb_AMD64_01007.Wdf
2012-05-26 15:05 - 2012-05-26 15:05 - 00000000 ___AH C:\Windows\System32\Drivers\Msft_Kernel_phaudlwr_01005.Wdf
2012-05-17 19:51 - 2012-05-17 19:51 - 00283200 ____A (DT Soft Ltd) C:\Windows\System32\Drivers\dtsoftbus01.sys
2012-05-17 18:50 - 2012-05-17 18:50 - 00071680 ____A (Beepa P/L) C:\Windows\System32\frapsv64.dll
2012-05-17 18:50 - 2012-05-17 18:50 - 00065536 ____A (Beepa P/L) C:\Windows\SysWOW64\frapsvid.dll
2012-05-12 03:08 - 2011-04-21 01:20 - 57848688 ____A (Microsoft Corporation) C:\Windows\System32\MRT.exe
2012-04-26 03:09 - 2012-04-26 03:09 - 03695416 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dat
2012-04-26 03:09 - 2012-04-26 03:09 - 03695416 ____A (Microsoft Corporation) C:\Windows\System32\ieapfltr.dat
2012-04-26 03:09 - 2012-04-26 03:09 - 00697344 ____A (Microsoft Corporation) C:\Windows\System32\msfeeds.dll
2012-04-26 03:09 - 2012-04-26 03:09 - 00603648 ____A (Microsoft Corporation) C:\Windows\System32\vbscript.dll
2012-04-26 03:09 - 2012-04-26 03:09 - 00580608 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2012-04-26 03:09 - 2012-04-26 03:09 - 00534528 ____A (Microsoft Corporation) C:\Windows\System32\ieapfltr.dll
2012-04-26 03:09 - 2012-04-26 03:09 - 00452608 ____A (Microsoft Corporation) C:\Windows\System32\dxtmsft.dll
2012-04-26 03:09 - 2012-04-26 03:09 - 00448512 ____A (Microsoft Corporation) C:\Windows\System32\html.iec
2012-04-26 03:09 - 2012-04-26 03:09 - 00434176 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2012-04-26 03:09 - 2012-04-26 03:09 - 00420864 ____A (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2012-04-26 03:09 - 2012-04-26 03:09 - 00403248 ____A (Microsoft Corporation) C:\Windows\System32\iedkcs32.dll
2012-04-26 03:09 - 2012-04-26 03:09 - 00367104 ____A (Microsoft Corporation) C:\Windows\SysWOW64\html.iec
2012-04-26 03:09 - 2012-04-26 03:09 - 00353792 ____A (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2012-04-26 03:09 - 2012-04-26 03:09 - 00353584 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2012-04-26 03:09 - 2012-04-26 03:09 - 00282112 ____A (Microsoft Corporation) C:\Windows\System32\dxtrans.dll
2012-04-26 03:09 - 2012-04-26 03:09 - 00267776 ____A (Microsoft Corporation) C:\Windows\System32\ieaksie.dll
2012-04-26 03:09 - 2012-04-26 03:09 - 00249344 ____A (Microsoft Corporation) C:\Windows\System32\webcheck.dll
2012-04-26 03:09 - 2012-04-26 03:09 - 00227840 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieaksie.dll
2012-04-26 03:09 - 2012-04-26 03:09 - 00223232 ____A (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2012-04-26 03:09 - 2012-04-26 03:09 - 00222208 ____A (Microsoft Corporation) C:\Windows\System32\msls31.dll
2012-04-26 03:09 - 2012-04-26 03:09 - 00203776 ____A (Microsoft Corporation) C:\Windows\SysWOW64\webcheck.dll
2012-04-26 03:09 - 2012-04-26 03:09 - 00197120 ____A (Microsoft Corporation) C:\Windows\System32\msrating.dll
2012-04-26 03:09 - 2012-04-26 03:09 - 00173056 ____A (Microsoft Corporation) C:\Windows\System32\ieUnatt.exe
2012-04-26 03:09 - 2012-04-26 03:09 - 00165888 ____A (Microsoft Corporation) C:\Windows\System32\iexpress.exe
2012-04-26 03:09 - 2012-04-26 03:09 - 00163840 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieakui.dll
2012-04-26 03:09 - 2012-04-26 03:09 - 00163840 ____A (Microsoft Corporation) C:\Windows\System32\ieakui.dll
2012-04-26 03:09 - 2012-04-26 03:09 - 00162304 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2012-04-26 03:09 - 2012-04-26 03:09 - 00161792 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msls31.dll
2012-04-26 03:09 - 2012-04-26 03:09 - 00160256 ____A (Microsoft Corporation) C:\Windows\System32\wextract.exe
2012-04-26 03:09 - 2012-04-26 03:09 - 00160256 ____A (Microsoft Corporation) C:\Windows\System32\ieakeng.dll
2012-04-26 03:09 - 2012-04-26 03:09 - 00152064 ____A (Microsoft Corporation) C:\Windows\SysWOW64\wextract.exe
2012-04-26 03:09 - 2012-04-26 03:09 - 00150528 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iexpress.exe
2012-04-26 03:09 - 2012-04-26 03:09 - 00149504 ____A (Microsoft Corporation) C:\Windows\System32\occache.dll
2012-04-26 03:09 - 2012-04-26 03:09 - 00145920 ____A (Microsoft Corporation) C:\Windows\System32\iepeers.dll
2012-04-26 03:09 - 2012-04-26 03:09 - 00142848 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2012-04-26 03:09 - 2012-04-26 03:09 - 00135168 ____A (Microsoft Corporation) C:\Windows\System32\IEAdvpack.dll
2012-04-26 03:09 - 2012-04-26 03:09 - 00130560 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieakeng.dll
2012-04-26 03:09 - 2012-04-26 03:09 - 00123392 ____A (Microsoft Corporation) C:\Windows\SysWOW64\occache.dll
2012-04-26 03:09 - 2012-04-26 03:09 - 00118784 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iepeers.dll
2012-04-26 03:09 - 2012-04-26 03:09 - 00114176 ____A (Microsoft Corporation) C:\Windows\System32\admparse.dll
2012-04-26 03:09 - 2012-04-26 03:09 - 00111616 ____A (Microsoft Corporation) C:\Windows\System32\iesysprep.dll
2012-04-26 03:09 - 2012-04-26 03:09 - 00110592 ____A (Microsoft Corporation) C:\Windows\SysWOW64\IEAdvpack.dll
2012-04-26 03:09 - 2012-04-26 03:09 - 00103936 ____A (Microsoft Corporation) C:\Windows\System32\inseng.dll
2012-04-26 03:09 - 2012-04-26 03:09 - 00101888 ____A (Microsoft Corporation) C:\Windows\SysWOW64\admparse.dll
2012-04-26 03:09 - 2012-04-26 03:09 - 00091648 ____A (Microsoft Corporation) C:\Windows\System32\SetIEInstalledDate.exe
2012-04-26 03:09 - 2012-04-26 03:09 - 00089088 ____A (Microsoft Corporation) C:\Windows\System32\RegisterIEPKEYs.exe
2012-04-26 03:09 - 2012-04-26 03:09 - 00089088 ____A (Microsoft Corporation) C:\Windows\System32\ie4uinit.exe
2012-04-26 03:09 - 2012-04-26 03:09 - 00086528 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2012-04-26 03:09 - 2012-04-26 03:09 - 00085504 ____A (Microsoft Corporation) C:\Windows\System32\iesetup.dll
2012-04-26 03:09 - 2012-04-26 03:09 - 00082432 ____A (Microsoft Corporation) C:\Windows\System32\icardie.dll
2012-04-26 03:09 - 2012-04-26 03:09 - 00078848 ____A (Microsoft Corporation) C:\Windows\SysWOW64\inseng.dll
2012-04-26 03:09 - 2012-04-26 03:09 - 00076800 ____A (Microsoft Corporation) C:\Windows\SysWOW64\SetIEInstalledDate.exe
2012-04-26 03:09 - 2012-04-26 03:09 - 00076800 ____A (Microsoft Corporation) C:\Windows\System32\tdc.ocx
2012-04-26 03:09 - 2012-04-26 03:09 - 00074752 ____A (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe
2012-04-26 03:09 - 2012-04-26 03:09 - 00074752 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2012-04-26 03:09 - 2012-04-26 03:09 - 00074240 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ie4uinit.exe
2012-04-26 03:09 - 2012-04-26 03:09 - 00066048 ____A (Microsoft Corporation) C:\Windows\SysWOW64\icardie.dll
2012-04-26 03:09 - 2012-04-26 03:09 - 00065024 ____A (Microsoft Corporation) C:\Windows\System32\pngfilt.dll
2012-04-26 03:09 - 2012-04-26 03:09 - 00063488 ____A (Microsoft Corporation) C:\Windows\SysWOW64\tdc.ocx
2012-04-26 03:09 - 2012-04-26 03:09 - 00055296 ____A (Microsoft Corporation) C:\Windows\System32\msfeedsbs.dll
2012-04-26 03:09 - 2012-04-26 03:09 - 00054272 ____A (Microsoft Corporation) C:\Windows\SysWOW64\pngfilt.dll
2012-04-26 03:09 - 2012-04-26 03:09 - 00049664 ____A (Microsoft Corporation) C:\Windows\System32\imgutil.dll
2012-04-26 03:09 - 2012-04-26 03:09 - 00048640 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtmler.dll
2012-04-26 03:09 - 2012-04-26 03:09 - 00048640 ____A (Microsoft Corporation) C:\Windows\System32\mshtmler.dll
2012-04-26 03:09 - 2012-04-26 03:09 - 00041472 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msfeedsbs.dll
2012-04-26 03:09 - 2012-04-26 03:09 - 00039936 ____A (Microsoft Corporation) C:\Windows\System32\iernonce.dll
2012-04-26 03:09 - 2012-04-26 03:09 - 00035840 ____A (Microsoft Corporation) C:\Windows\SysWOW64\imgutil.dll
2012-04-26 03:09 - 2012-04-26 03:09 - 00031744 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2012-04-26 03:09 - 2012-04-26 03:09 - 00030720 ____A (Microsoft Corporation) C:\Windows\System32\licmgr10.dll
2012-04-26 03:09 - 2012-04-26 03:09 - 00023552 ____A (Microsoft Corporation) C:\Windows\SysWOW64\licmgr10.dll
2012-04-26 03:09 - 2012-04-26 03:09 - 00012288 ____A (Microsoft Corporation) C:\Windows\System32\mshta.exe
2012-04-26 03:09 - 2012-04-26 03:09 - 00011776 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshta.exe
2012-04-26 03:09 - 2012-04-26 03:09 - 00010752 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msfeedssync.exe
2012-04-26 03:09 - 2012-04-26 03:09 - 00010752 ____A (Microsoft Corporation) C:\Windows\System32\msfeedssync.exe
2012-04-25 18:44 - 2012-04-25 18:44 - 00023112 ____A C:\Windows\System32\Drivers\hitmanpro35.sys
2012-04-25 18:36 - 2012-04-25 18:36 - 00220672 ____A (Microsoft Corporation) C:\Windows\System32\wintrust.dll
2012-04-25 18:36 - 2012-04-25 18:36 - 00172544 ____A (Microsoft Corporation) C:\Windows\SysWOW64\wintrust.dll
2012-04-25 18:36 - 2012-04-25 18:36 - 00159232 ____A (Microsoft Corporation) C:\Windows\SysWOW64\imagehlp.dll
2012-04-25 18:36 - 2012-04-25 18:36 - 00081408 ____A (Microsoft Corporation) C:\Windows\System32\imagehlp.dll
2012-04-25 18:36 - 2012-04-25 18:36 - 00023408 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\fs_rec.sys
2012-04-25 18:36 - 2012-04-25 18:36 - 00005120 ____A (Microsoft Corporation) C:\Windows\SysWOW64\wmi.dll
2012-04-25 18:36 - 2012-04-25 18:36 - 00005120 ____A (Microsoft Corporation) C:\Windows\System32\wmi.dll
2012-04-25 18:33 - 2012-04-25 18:33 - 00149504 ____A (Microsoft Corporation) C:\Windows\System32\rdpcorekmts.dll
2012-04-25 18:33 - 2012-04-25 18:33 - 00077312 ____A (Microsoft Corporation) C:\Windows\System32\rdpwsx.dll
2012-04-25 18:33 - 2012-04-25 18:33 - 00009216 ____A (Microsoft Corporation) C:\Windows\System32\rdrmemptylst.exe
2012-04-25 18:32 - 2012-04-25 18:32 - 01031680 ____A (Microsoft Corporation) C:\Windows\System32\rdpcore.dll
2012-04-25 18:32 - 2012-04-25 18:32 - 00826880 ____A (Microsoft Corporation) C:\Windows\SysWOW64\rdpcore.dll
2012-04-25 18:32 - 2012-04-25 18:32 - 00210944 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\rdpwd.sys
2012-04-25 18:32 - 2012-04-25 18:32 - 00023552 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\tdtcp.sys
2012-04-25 18:27 - 2012-04-25 18:27 - 14172672 ____A (Microsoft Corporation) C:\Windows\System32\shell32.dll
2012-04-25 18:27 - 2012-04-25 18:27 - 12872704 ____A (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll
2012-04-25 18:27 - 2012-04-25 18:27 - 00509952 ____A (Microsoft Corporation) C:\Windows\System32\ntshrui.dll
2012-04-25 18:27 - 2012-04-25 18:27 - 00442880 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ntshrui.dll
2012-04-25 18:26 - 2012-04-25 18:26 - 00515584 ____A (Microsoft Corporation) C:\Windows\System32\timedate.cpl
2012-04-25 18:26 - 2012-04-25 18:26 - 00498688 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\afd.sys
2012-04-25 18:26 - 2012-04-25 18:26 - 00478720 ____A (Microsoft Corporation) C:\Windows\SysWOW64\timedate.cpl
2012-04-25 18:23 - 2012-04-25 18:23 - 00690688 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msvcrt.dll
2012-04-25 18:23 - 2012-04-25 18:23 - 00634880 ____A (Microsoft Corporation) C:\Windows\System32\msvcrt.dll
2012-04-25 18:21 - 2012-04-25 18:21 - 01731920 ____A (Microsoft Corporation) C:\Windows\System32\ntdll.dll
2012-04-25 18:21 - 2012-04-25 18:21 - 01572864 ____A (Microsoft Corporation) C:\Windows\System32\quartz.dll
2012-04-25 18:21 - 2012-04-25 18:21 - 01447936 ____A (Microsoft Corporation) C:\Windows\System32\lsasrv.dll
2012-04-25 18:21 - 2012-04-25 18:21 - 01328128 ____A (Microsoft Corporation) C:\Windows\SysWOW64\quartz.dll
2012-04-25 18:21 - 2012-04-25 18:21 - 01292080 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll
2012-04-25 18:21 - 2012-04-25 18:21 - 00514560 ____A (Microsoft Corporation) C:\Windows\SysWOW64\qdvd.dll
2012-04-25 18:21 - 2012-04-25 18:21 - 00459232 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\cng.sys
2012-04-25 18:21 - 2012-04-25 18:21 - 00395776 ____A (Microsoft Corporation) C:\Windows\System32\webio.dll
2012-04-25 18:21 - 2012-04-25 18:21 - 00366592 ____A (Microsoft Corporation) C:\Windows\System32\qdvd.dll
2012-04-25 18:21 - 2012-04-25 18:21 - 00340992 ____A (Microsoft Corporation) C:\Windows\System32\schannel.dll
2012-04-25 18:21 - 2012-04-25 18:21 - 00314880 ____A (Microsoft Corporation) C:\Windows\SysWOW64\webio.dll
2012-04-25 18:21 - 2012-04-25 18:21 - 00224768 ____A (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2012-04-25 18:21 - 2012-04-25 18:21 - 00152432 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\ksecpkg.sys
2012-04-25 18:21 - 2012-04-25 18:21 - 00136192 ____A (Microsoft Corporation) C:\Windows\System32\sspicli.dll
2012-04-25 18:21 - 2012-04-25 18:21 - 00096768 ____A (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
2012-04-25 18:21 - 2012-04-25 18:21 - 00095600 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\ksecdd.sys
2012-04-25 18:21 - 2012-04-25 18:21 - 00031232 ____A (Microsoft Corporation) C:\Windows\System32\lsass.exe
2012-04-25 18:21 - 2012-04-25 18:21 - 00029184 ____A (Microsoft Corporation) C:\Windows\System32\sspisrv.dll
2012-04-25 18:21 - 2012-04-25 18:21 - 00028160 ____A (Microsoft Corporation) C:\Windows\System32\secur32.dll
2012-04-25 18:21 - 2012-04-25 18:21 - 00022016 ____A (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
2012-04-25 18:20 - 2012-04-25 18:20 - 00077312 ____A (Microsoft Corporation) C:\Windows\System32\packager.dll
2012-04-25 18:20 - 2012-04-25 18:20 - 00067072 ____A (Microsoft Corporation) C:\Windows\SysWOW64\packager.dll
2012-04-25 18:16 - 2012-04-25 18:16 - 00723456 ____A (Microsoft Corporation) C:\Windows\System32\EncDec.dll
2012-04-25 18:16 - 2012-04-25 18:16 - 00534528 ____A (Microsoft Corporation) C:\Windows\SysWOW64\EncDec.dll
2012-04-25 18:16 - 2012-04-25 18:16 - 00043520 ____A (Microsoft Corporation) C:\Windows\System32\csrsrv.dll
2012-04-25 18:16 - 2012-04-25 18:16 - 00002048 ____A (Microsoft Corporation) C:\Windows\SysWOW64\tzres.dll
2012-04-25 18:16 - 2012-04-25 18:16 - 00002048 ____A (Microsoft Corporation) C:\Windows\System32\tzres.dll
2012-04-25 18:11 - 2009-07-14 01:08 - 00025686 ____A C:\Windows\Tasks\SCHEDLGU.TXT
2012-04-25 18:07 - 2012-04-25 18:07 - 00613888 ____A (Microsoft Corporation) C:\Windows\System32\psisdecd.dll
2012-04-25 18:07 - 2012-04-25 18:07 - 00465408 ____A (Microsoft Corporation) C:\Windows\SysWOW64\psisdecd.dll
2012-04-25 18:07 - 2012-04-25 18:07 - 00108032 ____A (Microsoft Corporation) C:\Windows\System32\psisrndr.ax
2012-04-25 18:07 - 2012-04-25 18:07 - 00075776 ____A (Microsoft Corporation) C:\Windows\SysWOW64\psisrndr.ax
2012-04-25 18:06 - 2012-04-25 18:06 - 00861696 ____A (Microsoft Corporation) C:\Windows\System32\oleaut32.dll
2012-04-25 18:06 - 2012-04-25 18:06 - 00571904 ____A (Microsoft Corporation) C:\Windows\SysWOW64\oleaut32.dll
2012-04-25 18:06 - 2012-04-25 18:06 - 00331776 ____A (Microsoft Corporation) C:\Windows\System32\oleacc.dll
2012-04-25 18:06 - 2012-04-25 18:06 - 00233472 ____A (Microsoft Corporation) C:\Windows\SysWOW64\oleacc.dll

========================= Bamital & volsnap Check ============

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe
[2011-09-18 19:12] - [2009-10-31 02:34] - 2387456 ____A (Microsoft Corporation) D5A67267C4C3879E63E9BFBA991D823A

C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit

========================= Memory info ====================== 

Percentage of memory in use: 37%
Total physical RAM: 4061.18 MB
Available physical RAM: 2526.48 MB
Total Pagefile: 8120.54 MB
Available Pagefile: 6276.28 MB
Total Virtual: 8192 MB
Available Virtual: 8191.85 MB

======================= Partitions =========================

1 Drive c: (Gateway) (Fixed) (Total:582.4 GB) (Free:142.78 GB) NTFS
2 Drive d: (Belkin Setup CD) (CDROM) (Total:0.22 GB) (Free:0 GB) UDF

  Disk ###  Status         Size     Free     Dyn  Gpt
  --------  -------------  -------  -------  ---  ---
  Disk 0    Online          596 GB      0 B         
  Disk 1    No Media           0 B      0 B         
  Disk 2    No Media           0 B      0 B         

Partitions of Disk 0:
===============

  Partition ###  Type              Size     Offset
  -------------  ----------------  -------  -------
  Partition 1    Recovery            13 GB  1024 KB
  Partition 2    Primary            100 MB    13 GB
  Partition 3    Primary            582 GB    13 GB

==================================================================================

Disk: 0
Partition 1
Type  : 27
Hidden: Yes
Active: No

  Volume ###  Ltr  Label        Fs     Type        Size     Status     Info
  ----------  ---  -----------  -----  ----------  -------  ---------  --------
* Volume 4         PQSERVICE    NTFS   Partition     13 GB  Healthy    Hidden  

==================================================================================

Disk: 0
Partition 2
Type  : 07
Hidden: No
Active: Yes

  Volume ###  Ltr  Label        Fs     Type        Size     Status     Info
  ----------  ---  -----------  -----  ----------  -------  ---------  --------
* Volume 2         SYSTEM RESE  NTFS   Partition    100 MB  Healthy    System (partition with boot components)  

==================================================================================

Disk: 0
Partition 3
Type  : 07
Hidden: No
Active: No

  Volume ###  Ltr  Label        Fs     Type        Size     Status     Info
  ----------  ---  -----------  -----  ----------  -------  ---------  --------
* Volume 3     C   Gateway      NTFS   Partition    582 GB  Healthy    Boot    

==================================================================================

==========================================================

Last Boot: 2012-07-08 05:10

======================= End Of Log ==========================


----------



## johnb35

But can you access the recovery mode options this way?



> Enter System Recovery Options.
> 
> To enter System Recovery Options from the Advanced Boot Options:
> 
> •  Restart the computer.
> 
> •  As soon as the BIOS is loaded begin tapping the F8 key until Advanced Boot Options appears.
> 
> •  Use the arrow keys to select the Repair your computer menu item.
> 
> •  Select US as the keyboard language settings, and then click Next.
> 
> •  Select the operating system you want to repair, and then click Next.
> 
> •  Select your user account an click Next.



I'm gonna send you a pm.


----------



## Motorcharge

PM'd back. Restarting to try that now.


----------



## Motorcharge

Following the previous instructions I can get as far as opening notepad but can't access the filepath where the program is.

I have a rooted Droid 3 if that will work instead of a flash drive.


----------



## johnb35

•Download *RogueKiller* to the desktop 
•Close all the running programs
•Windows Vista/7 users: right click on RogueKiller.exe, click Run as Administrator
•Otherwise just double-click on RogueKiller.exe
•Pre-scan will start. Let it finish.
•Click on SCAN button.
•A report (RKreport.txt) should open. Post its content in your next reply. (RKreport could also be found on your desktop)
•If RogueKiller has been blocked, do not hesitate to try a few times more. If really won't run, rename it to winlogon.exe (or winlogon.com) and try again


----------



## Motorcharge

RogueKiller V7.6.4 [07/17/2012]  by Tigzy
mail: tigzyRK<at>gmail<dot>com
Feedback: http://www.geekstogo.com/forum/files/file/413-roguekiller/
Blog: http://tigzyrk.blogspot.com

Operating System: Windows 7 (6.1.7601 Service Pack 1) 64 bits version
Started in : Normal mode
User: Bre [Admin rights]
Mode: Scan -- Date: 07/18/2012 21:23:09

¤¤¤ Bad processes: 0 ¤¤¤

¤¤¤ Registry Entries: 8 ¤¤¤
[PROXY IE] HKCU\[...]\Internet Settings : ProxyServer (hxxp=;ftp=;hxxps= -> FOUND
[HJ] HKLM\[...]\System : ConsentPromptBehaviorAdmin (0) -> FOUND
[HJ] HKLM\[...]\System : EnableLUA (0) -> FOUND
[HJ] HKCU\[...]\Advanced : Start_TrackProgs (0) -> FOUND
[HJ] HKLM\[...]\NewStartPanel : {59031a47-3f72-44a7-89c5-5595fe6b30ee} (1) -> FOUND
[HJ] HKLM\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> FOUND
[HJ] HKCU\[...]\ClassicStartMenu : {645FF040-5081-101B-9F08-00AA002F954E} (1) -> FOUND
[HJ] HKCU\[...]\NewStartPanel : {645FF040-5081-101B-9F08-00AA002F954E} (1) -> FOUND

¤¤¤ Particular Files / Folders: ¤¤¤

¤¤¤ Driver: [NOT LOADED] ¤¤¤

¤¤¤ Infection :  ¤¤¤

¤¤¤ HOSTS File: ¤¤¤
127.0.0.1       localhost


¤¤¤ MBR Check: ¤¤¤

+++++ PhysicalDrive0: WDC WD6400AAKS-22A7B2 +++++
--- User ---
[MBR] 1572628a880e7883b927d6da91d4d687
[BSP] bd0347d93b6c2fb26b1f3cc1ba92f202 : Windows 7 MBR Code
Partition table:
0 - [XXXXXX] ACER (0x27) [VISIBLE] Offset (sectors): 2048 | Size: 14000 Mo
1 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 28674048 | Size: 100 Mo
2 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 28878848 | Size: 596378 Mo
User = LL1 ... OK!
User = LL2 ... OK!

Finished : << RKreport[1].txt >>
RKreport[1].txt


----------

