Virus help - Newbie Help Forum

Forums

Likey.com, Personalized News

FreeProductsForBloggers.com

Terms of Service

Welcome Guest ( Log In | Register )

Newbie Help Forum > Viruses, Trojans, Spyware, etc.. > PC Cleanup

Reply to this topic

Start new topic

Virus help, can't log onto email or other sights. Something to do with cookie

soycarne View Member Profile Find Member's Posts	May 16 2010, 03:31 AM Post #1
Newbie Group: Members+ Posts: 8 Joined: 29-April 10 Member No.: 5,486	Any help will be GREATLY appreciated! Rooter.exe (v1.0.2) by Eric_71 . The token does not have the SeDebugPrivilege privilege ! (error:1300) Can not acquire SeDebugPrivilege ! Please run the tool as administrator .. . Windows Vista Home Edition (6.0.6002) Service Pack 2 [32_bits] - x86 Family 16 Model 2 Stepping 3, AuthenticAMD . Error OpenService (wscsvc) : 6 Error OpenSCManager : 5 Error OpenService (MpsSvc) : 6 Windows Defender -> Enabled User Account Control (UAC) -> Enabled . Internet Explorer 8.0.6001.18904 Mozilla Firefox 3.6.3 (en-US) . C:\ [Fixed-NTFS] .. ( Total:142 Go - Free:89 Go ) D:\ [Removable] E:\ [Removable] F:\ [Fixed-NTFS] .. ( Total:142 Go - Free:21 Go ) G:\ [CD_Rom] . Scan : 20:08.46 Path : C:\Users\Donald\Downloads\Rooter.exe User : Donald ( Administrator -> YES ) . ----------------------\\ Processes . Locked [System Process] (0) Locked System (4) Locked smss.exe (444) Locked csrss.exe (576) Locked csrss.exe (628) Locked wininit.exe (636) Locked services.exe (672) Locked lsass.exe (684) Locked lsm.exe (692) Locked svchost.exe (844) Locked nvvsvc.exe (892) Locked svchost.exe (920) Locked svchost.exe (964) Locked svchost.exe (1020) Locked svchost.exe (1060) Locked svchost.exe (1076) Locked audiodg.exe (1148) Locked svchost.exe (1168) Locked SLsvc.exe (1184) Locked svchost.exe (1216) Locked winlogon.exe (1336) Locked svchost.exe (1392) Locked spoolsv.exe (1556) Locked svchost.exe (1592) Locked rundll32.exe (1784) Locked CLMSServer.exe (456) Locked agrsmsvc.exe (12) Locked AppleMobileDeviceService.exe (564) Locked AVRedirector.exe (688) Locked mDNSResponder.exe (1132) Locked eDSService.exe (1372) Locked ETService.exe (740) Locked McSACore.exe (2144) Locked McProxy.exe (2212) Locked Mcshield.exe (2260) Locked MpfSrv.exe (2296) Locked rundll32.exe (2304) Locked msksrver.exe (2476) Locked SchedulerSvc.exe (2500) Locked svchost.exe (2624) Locked RichVideo.exe (2868) Locked svchost.exe (2932) Locked svchost.exe (2976) Locked SearchIndexer.exe (3064) Locked YahooAUService.exe (3096) Locked WUDFHost.exe (3132) Locked taskeng.exe (3140) Locked nSvcAppFlt.exe (3188) Locked nSvcIp.exe (3240) ______ C:\Windows\system32\Dwm.exe (3492) ______ C:\Windows\system32\taskeng.exe (3516) ______ C:\Windows\Explorer.EXE (3580) Locked mcmscsvc.exe (3820) ______ C:\Program Files\Windows Defender\MSASCui.exe (1740) ______ C:\Program Files\Acer\Empowering Technology\SysMonitor.exe (3232) ______ C:\Program Files\Acer\Empowering Technology\Framework.Launcher.exe (3324) ______ C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\eDSLoader.exe (1992) ______ C:\Windows\RtHDVCpl.exe (852) ______ c:\PROGRA~1\mcafee.com\agent\mcagent.exe (1980) ______ C:\Program Files\Common Files\Java\Java Update\jusched.exe (4480) ______ C:\Program Files\iTunes\iTunesHelper.exe (4596) ______ C:\Windows\ehome\ehtray.exe (4612) Locked GoogleToolbarNotifier.exe (4628) ______ C:\Windows\ehome\ehmsas.exe (5152) Locked ehsched.exe (5256) Locked iPodService.exe (5280) ______ C:\Program Files\Windows Media Player\wmpnscfg.exe (5328) Locked wmpnetwk.exe (5504) ______ C:\Program Files\Mozilla Firefox\firefox.exe (5528) Locked ehrecvr.exe (5712) ______ C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe (4416) Locked mcsysmon.exe (2092) Locked McNASvc.exe (5104) ______ C:\Windows\system32\wuauclt.exe (5540) Locked notepad.exe (5128) ______ C:\Windows\system32\NOTEPAD.EXE (3268) Locked taskeng.exe (3964) Locked SearchProtocolHost.exe (2696) Locked SearchFilterHost.exe (4296) ______ C:\Users\Donald\Downloads\Rooter.exe (6048) ______ C:\Windows\system32\NOTEPAD.EXE (4540) . ----------------------\\ Device\Harddisk0\ . \Device\Harddisk0 [Sectors : 63 x 512 Bytes] . \Device\Harddisk0\Partition1 (Start_Offset:1048576 \| Length:15032385536) \Device\Harddisk0\Partition2 --[ MBR ]-- (Start_Offset:15033434112 \| Length:152518524928) \Device\Harddisk0\Partition3 (Start_Offset:167551959040 \| Length:152519573504) . ----------------------\\ Scheduled Tasks . C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job C:\Windows\Tasks\McDefragTask.job C:\Windows\Tasks\McQcTask.job C:\Windows\Tasks\SA.DAT C:\Windows\Tasks\SCHEDLGU.TXT . ----------------------\\ Registry . . ----------------------\\ Files & Folders . C:\PROGRA~2\MICROS~1\Windows\STARTM~1\Programs\Privacy Guardian C:\PROGRA~1\Privacy Guardian ==> Rogues <== . ----------------------\\ Scan completed at 20:08.48 . C:\Rooter$\Rooter_3.txt - (15/05/2010 \| 20:08.48) GMER 1.0.15.15281 - http://www.gmer.net Rootkit scan 2010-04-28 22:09:58 Windows 6.0.6002 Service Pack 2 Running: gmer.exe; Driver: C:\Users\Donald\AppData\Local\Temp\uwlyrpow.sys ---- System - GMER 1.0.15 ---- Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwCreateFile [0x8EC2579E] Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwCreateProcess [0x8EC25738] Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwCreateProcessEx [0x8EC2574C] Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwMapViewOfSection [0x8EC257DC] Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwNotifyChangeKey [0x8EC2581F] Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwOpenProcess [0x8EC25710] Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwOpenThread [0x8EC25724] Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwProtectVirtualMemory [0x8EC257B2] Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwReplaceKey [0x8EC25847] Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwRestoreKey [0x8EC25833] Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwSetContextThread [0x8EC2578A] Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwSetInformationProcess [0x8EC25776] Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwTerminateProcess [0x8EC2580B] Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwUnmapViewOfSection [0x8EC257F2] Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwYieldExecution [0x8EC257C8] Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwCreateUserProcess [0x8EC25762] Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) NtCreateFile Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) NtMapViewOfSection Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) NtOpenProcess Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) NtOpenThread Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) NtSetInformationProcess ---- Kernel code sections - GMER 1.0.15 ---- .text ntkrnlpa.exe!ZwYieldExecution 822499D2 5 Bytes JMP 8EC257CC \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) .text C:\Windows\system32\DRIVERS\nvlddmkm.sys section is writeable [0x8DA00340, 0x3DF2F7, 0xE8000020] ---- User code sections - GMER 1.0.15 ---- .text C:\Windows\system32\services.exe[672] kernel32.dll!GetStartupInfoW 762E1929 5 Bytes JMP 009A007B .text C:\Windows\system32\services.exe[672] kernel32.dll!GetStartupInfoA 762E19C9 5 Bytes JMP 009A006A .text C:\Windows\system32\services.exe[672] kernel32.dll!CreateProcessW 762E1BF3 5 Bytes JMP 009A00B1 .text C:\Windows\system32\services.exe[672] kernel32.dll!CreateProcessA 762E1C28 5 Bytes JMP 009A0F1A .text C:\Windows\system32\services.exe[672] kernel32.dll!VirtualProtect 762E1DC3 5 Bytes JMP 009A0F75 .text C:\Windows\system32\services.exe[672] kernel32.dll!CreateNamedPipeA 762E2EF5 5 Bytes JMP 009A0FDE .text C:\Windows\system32\services.exe[672] kernel32.dll!CreateNamedPipeW 762E5C0C 5 Bytes JMP 009A0FCD .text C:\Windows\system32\services.exe[672] kernel32.dll!CreatePipe 76308E6E 5 Bytes JMP 009A0F3F .text C:\Windows\system32\services.exe[672] kernel32.dll!LoadLibraryExW 76309109 5 Bytes JMP 009A0F86 .text C:\Windows\system32\services.exe[672] kernel32.dll!LoadLibraryW 76309362 5 Bytes JMP 009A0FA1 .text C:\Windows\system32\services.exe[672] kernel32.dll!LoadLibraryExA 763094B4 5 Bytes JMP 009A0043 .text C:\Windows\system32\services.exe[672] kernel32.dll!LoadLibraryA 763094DC 5 Bytes JMP 009A0FBC .text C:\Windows\system32\services.exe[672] kernel32.dll!VirtualProtectEx 7630DBDA 5 Bytes JMP 009A0F5A .text C:\Windows\system32\services.exe[672] kernel32.dll!GetProcAddress 7632903B 5 Bytes JMP 009A00CC .text C:\Windows\system32\services.exe[672] kernel32.dll!CreateFileW 7632AECB 5 Bytes JMP 009A0FEF .text C:\Windows\system32\services.exe[672] kernel32.dll!CreateFileA 7632CE5F 5 Bytes JMP 009A0000 .text C:\Windows\system32\services.exe[672] kernel32.dll!WinExec 76375CF7 5 Bytes JMP 009A0096 .text C:\Windows\system32\services.exe[672] ADVAPI32.dll!RegCreateKeyExA 764D39AB 5 Bytes JMP 009B0039 .text C:\Windows\system32\services.exe[672] ADVAPI32.dll!RegCreateKeyA 764D3BA9 5 Bytes JMP 009B0F97 .text C:\Windows\system32\services.exe[672] ADVAPI32.dll!RegOpenKeyA 764D89C7 5 Bytes JMP 009B0FEF .text C:\Windows\system32\services.exe[672] ADVAPI32.dll!RegCreateKeyW 764E391E 5 Bytes JMP 009B0028 .text C:\Windows\system32\services.exe[672] ADVAPI32.dll!RegCreateKeyExW 764E41F1 5 Bytes JMP 009B0054 .text C:\Windows\system32\services.exe[672] ADVAPI32.dll!RegOpenKeyExA 764E7C42 5 Bytes JMP 009B0FCD .text C:\Windows\system32\services.exe[672] ADVAPI32.dll!RegOpenKeyW 764EE2B5 5 Bytes JMP 009B0FDE .text C:\Windows\system32\services.exe[672] ADVAPI32.dll!RegOpenKeyExW 764F7BA1 5 Bytes JMP 009B0FB2 .text C:\Windows\system32\services.exe[672] msvcrt.dll!_wsystem 76767F2F 5 Bytes JMP 009D0050 .text C:\Windows\system32\services.exe[672] msvcrt.dll!system 7676804B 5 Bytes JMP 009D003F .text C:\Windows\system32\services.exe[672] msvcrt.dll!_creat 7676BBE1 5 Bytes JMP 009D0FD9 .text C:\Windows\system32\services.exe[672] msvcrt.dll!_open 7676D106 5 Bytes JMP 009D0000 .text C:\Windows\system32\services.exe[672] msvcrt.dll!_wcreat 7676D326 5 Bytes JMP 009D002E .text C:\Windows\system32\services.exe[672] msvcrt.dll!_wopen 7676D501 5 Bytes JMP 009D001D .text C:\Windows\system32\services.exe[672] WS2_32.dll!socket 765836D1 5 Bytes JMP 009C0FEF .text C:\Windows\system32\lsass.exe[684] kernel32.dll!GetStartupInfoW 762E1929 5 Bytes JMP 00150F30 .text C:\Windows\system32\lsass.exe[684] kernel32.dll!GetStartupInfoA 762E19C9 5 Bytes JMP 00150080 .text C:\Windows\system32\lsass.exe[684] kernel32.dll!CreateProcessW 762E1BF3 5 Bytes JMP 00150EF0 .text C:\Windows\system32\lsass.exe[684] kernel32.dll!CreateProcessA 762E1C28 5 Bytes JMP 00150091 .text C:\Windows\system32\lsass.exe[684] kernel32.dll!VirtualProtect 762E1DC3 5 Bytes JMP 00150051 .text C:\Windows\system32\lsass.exe[684] kernel32.dll!CreateNamedPipeA 762E2EF5 5 Bytes JMP 00150011 .text C:\Windows\system32\lsass.exe[684] kernel32.dll!CreateNamedPipeW 762E5C0C 5 Bytes JMP 0015002C .text C:\Windows\system32\lsass.exe[684] kernel32.dll!CreatePipe 76308E6E 5 Bytes JMP 00150F4B .text C:\Windows\system32\lsass.exe[684] kernel32.dll!LoadLibraryExW 76309109 5 Bytes JMP 00150F83 .text C:\Windows\system32\lsass.exe[684] kernel32.dll!LoadLibraryW 76309362 5 Bytes JMP 00150FAF .text C:\Windows\system32\lsass.exe[684] kernel32.dll!LoadLibraryExA 763094B4 5 Bytes JMP 00150F94 .text C:\Windows\system32\lsass.exe[684] kernel32.dll!LoadLibraryA 763094DC 5 Bytes JMP 00150FC0 .text C:\Windows\system32\lsass.exe[684] kernel32.dll!VirtualProtectEx 7630DBDA 5 Bytes JMP 00150F66 .text C:\Windows\system32\lsass.exe[684] kernel32.dll!GetProcAddress 7632903B 5 Bytes JMP 00150EDF .text C:\Windows\system32\lsass.exe[684] kernel32.dll!CreateFileW 7632AECB 5 Bytes JMP 00150FDB .text C:\Windows\system32\lsass.exe[684] kernel32.dll!CreateFileA 7632CE5F 5 Bytes JMP 00150000 .text C:\Windows\system32\lsass.exe[684] kernel32.dll!WinExec 76375CF7 5 Bytes JMP 00150F1F .text C:\Windows\system32\lsass.exe[684] ADVAPI32.dll!RegCreateKeyExA 764D39AB 5 Bytes JMP 00160FA5 .text C:\Windows\system32\lsass.exe[684] ADVAPI32.dll!RegCreateKeyA 764D3BA9 5 Bytes JMP 00160FDB .text C:\Windows\system32\lsass.exe[684] ADVAPI32.dll!RegOpenKeyA 764D89C7 5 Bytes JMP 00160000 .text C:\Windows\system32\lsass.exe[684] ADVAPI32.dll!RegCreateKeyW 764E391E 5 Bytes JMP 00160FC0 .text C:\Windows\system32\lsass.exe[684] ADVAPI32.dll!RegCreateKeyExW 764E41F1 5 Bytes JMP 00160062 .text C:\Windows\system32\lsass.exe[684] ADVAPI32.dll!RegOpenKeyExA 764E7C42 5 Bytes JMP 0016002C .text C:\Windows\system32\lsass.exe[684] ADVAPI32.dll!RegOpenKeyW 764EE2B5 5 Bytes JMP 0016001B .text C:\Windows\system32\lsass.exe[684] ADVAPI32.dll!RegOpenKeyExW 764F7BA1 5 Bytes JMP 00160047 .text C:\Windows\system32\lsass.exe[684] msvcrt.dll!_wsystem 76767F2F 5 Bytes JMP 003F005D .text C:\Windows\system32\lsass.exe[684] msvcrt.dll!system 7676804B 5 Bytes JMP 003F004C .text C:\Windows\system32\lsass.exe[684] msvcrt.dll!_creat 7676BBE1 5 Bytes JMP 003F001D .text C:\Windows\system32\lsass.exe[684] msvcrt.dll!_open 7676D106 3 Bytes JMP 003F0000 .text C:\Windows\system32\lsass.exe[684] msvcrt.dll!_open + 4 7676D10A 1 Byte [89] .text C:\Windows\system32\lsass.exe[684] msvcrt.dll!_wcreat 7676D326 5 Bytes JMP 003F0FD2 .text C:\Windows\system32\lsass.exe[684] msvcrt.dll!_wopen 7676D501 3 Bytes JMP 003F0FEF .text C:\Windows\system32\lsass.exe[684] msvcrt.dll!_wopen + 4 7676D505 1 Byte [89] .text C:\Windows\system32\lsass.exe[684] WS2_32.dll!socket 765836D1 5 Bytes JMP 00170FEF .text C:\Windows\system32\svchost.exe[872] kernel32.dll!GetStartupInfoW 762E1929 5 Bytes JMP 00250082 .text C:\Windows\system32\svchost.exe[872] kernel32.dll!GetStartupInfoA 762E19C9 5 Bytes JMP 00250F46 .text C:\Windows\system32\svchost.exe[872] kernel32.dll!CreateProcessW 762E1BF3 5 Bytes JMP 002500A7 .text C:\Windows\system32\svchost.exe[872] kernel32.dll!CreateProcessA 762E1C28 5 Bytes JMP 00250F10 .text C:\Windows\system32\svchost.exe[872] kernel32.dll!VirtualProtect 762E1DC3 5 Bytes JMP 00250067 .text C:\Windows\system32\svchost.exe[872] kernel32.dll!CreateNamedPipeA 762E2EF5 5 Bytes JMP 00250FC3 .text C:\Windows\system32\svchost.exe[872] kernel32.dll!CreateNamedPipeW 762E5C0C 5 Bytes JMP 00250014 .text C:\Windows\system32\svchost.exe[872] kernel32.dll!CreatePipe 76308E6E 5 Bytes JMP 00250F57 .text C:\Windows\system32\svchost.exe[872] kernel32.dll!LoadLibraryExW 76309109 5 Bytes JMP 00250040 .text C:\Windows\system32\svchost.exe[872] kernel32.dll!LoadLibraryW 76309362 5 Bytes JMP 00250F97 .text C:\Windows\system32\svchost.exe[872] kernel32.dll!LoadLibraryExA 763094B4 5 Bytes JMP 0025002F .text C:\Windows\system32\svchost.exe[872] kernel32.dll!LoadLibraryA 763094DC 5 Bytes JMP 00250FA8 .text C:\Windows\system32\svchost.exe[872] kernel32.dll!VirtualProtectEx 7630DBDA 5 Bytes JMP 00250F72 .text C:\Windows\system32\svchost.exe[872] kernel32.dll!GetProcAddress 7632903B 5 Bytes JMP 00250EF5 .text C:\Windows\system32\svchost.exe[872] kernel32.dll!CreateFileW 7632AECB 5 Bytes JMP 00250FD4 .text C:\Windows\system32\svchost.exe[872] kernel32.dll!CreateFileA 7632CE5F 5 Bytes JMP 00250FEF .text C:\Windows\system32\svchost.exe[872] kernel32.dll!WinExec 76375CF7 5 Bytes JMP 00250F21 .text C:\Windows\system32\svchost.exe[872] msvcrt.dll!_wsystem 76767F2F 5 Bytes JMP 00280F9C .text C:\Windows\system32\svchost.exe[872] msvcrt.dll!system 7676804B 5 Bytes JMP 00280031 .text C:\Windows\system32\svchost.exe[872] msvcrt.dll!_creat 7676BBE1 5 Bytes JMP 00280FD2 .text C:\Windows\system32\svchost.exe[872] msvcrt.dll!_open 7676D106 5 Bytes JMP 00280000 .text C:\Windows\system32\svchost.exe[872] msvcrt.dll!_wcreat 7676D326 5 Bytes JMP 00280FC1 .text C:\Windows\system32\svchost.exe[872] msvcrt.dll!_wopen 7676D501 5 Bytes JMP 00280FEF .text C:\Windows\system32\svchost.exe[872] ADVAPI32.dll!RegCreateKeyExA 764D39AB 5 Bytes JMP 00260FB9 .text C:\Windows\system32\svchost.exe[872] ADVAPI32.dll!RegCreateKeyA 764D3BA9 5 Bytes JMP 0026005B .text C:\Windows\system32\svchost.exe[872] ADVAPI32.dll!RegOpenKeyA 764D89C7 5 Bytes JMP 00260FEF .text C:\Windows\system32\svchost.exe[872] ADVAPI32.dll!RegCreateKeyW 764E391E 5 Bytes JMP 00260FD4 .text C:\Windows\system32\svchost.exe[872] ADVAPI32.dll!RegCreateKeyExW 764E41F1 5 Bytes JMP 00260F9E .text C:\Windows\system32\svchost.exe[872] ADVAPI32.dll!RegOpenKeyExA 764E7C42 5 Bytes JMP 00260025 .text C:\Windows\system32\svchost.exe[872] ADVAPI32.dll!RegOpenKeyW 764EE2B5 5 Bytes JMP 00260014 .text C:\Windows\system32\svchost.exe[872] ADVAPI32.dll!RegOpenKeyExW 764F7BA1 5 Bytes JMP 00260036 .text C:\Windows\system32\svchost.exe[872] WS2_32.dll!socket 765836D1 5 Bytes JMP 00270000 .text C:\Windows\system32\svchost.exe[964] kernel32.dll!GetStartupInfoW 762E1929 5 Bytes JMP 00600F3C .text C:\Windows\system32\svchost.exe[964] kernel32.dll!GetStartupInfoA 762E19C9 5 Bytes JMP 00600082 .text C:\Windows\system32\svchost.exe[964] kernel32.dll!CreateProcessW 762E1BF3 5 Bytes JMP 006000B1 .text C:\Windows\system32\svchost.exe[964] kernel32.dll!CreateProcessA 762E1C28 5 Bytes JMP 00600F1A .text C:\Windows\system32\svchost.exe[964] kernel32.dll!VirtualProtect 762E1DC3 5 Bytes JMP 00600F68 .text C:\Windows\system32\svchost.exe[964] kernel32.dll!CreateNamedPipeA 762E2EF5 5 Bytes JMP 0060000A .text C:\Windows\system32\svchost.exe[964] kernel32.dll!CreateNamedPipeW 762E5C0C 5 Bytes JMP 00600FB9 .text C:\Windows\system32\svchost.exe[964] kernel32.dll!CreatePipe 76308E6E 5 Bytes JMP 00600F4D .text C:\Windows\system32\svchost.exe[964] kernel32.dll!LoadLibraryExW 76309109 5 Bytes JMP 00600036 .text C:\Windows\system32\svchost.exe[964] kernel32.dll!LoadLibraryW 76309362 5 Bytes JMP 00600F8D .text C:\Windows\system32\svchost.exe[964] kernel32.dll!LoadLibraryExA 763094B4 5 Bytes JMP 00600025 .text C:\Windows\system32\svchost.exe[964] kernel32.dll!LoadLibraryA 763094DC 5 Bytes JMP 00600F9E .text C:\Windows\system32\svchost.exe[964] kernel32.dll!VirtualProtectEx 7630DBDA 5 Bytes JMP 0060005D .text C:\Windows\system32\svchost.exe[964] kernel32.dll!GetProcAddress 7632903B 5 Bytes JMP 006000C2 .text C:\Windows\system32\svchost.exe[964] kernel32.dll!CreateFileW 7632AECB 5 Bytes JMP 00600FD4 .text C:\Windows\system32\svchost.exe[964] kernel32.dll!CreateFileA 7632CE5F 5 Bytes JMP 00600FEF .text C:\Windows\system32\svchost.exe[964] kernel32.dll!WinExec 76375CF7 5 Bytes JMP 00600F2B .text C:\Windows\system32\svchost.exe[964] msvcrt.dll!_wsystem 76767F2F 5 Bytes JMP 006C0F8B .text C:\Windows\system32\svchost.exe[964] msvcrt.dll!system 7676804B 5 Bytes JMP 006C0FB0 .text C:\Windows\system32\svchost.exe[964] msvcrt.dll!_creat 7676BBE1 5 Bytes JMP 006C0FD2 .text C:\Windows\system32\svchost.exe[964] msvcrt.dll!_open 7676D106 5 Bytes JMP 006C0000 .text C:\Windows\system32\svchost.exe[964] msvcrt.dll!_wcreat 7676D326 5 Bytes JMP 006C0FC1 .text C:\Windows\system32\svchost.exe[964] msvcrt.dll!_wopen 7676D501 5 Bytes JMP 006C0FEF .text C:\Windows\system32\svchost.exe[964] ADVAPI32.dll!RegCreateKeyExA 764D39AB 1 Byte [E9] .text C:\Windows\system32\svchost.exe[964] ADVAPI32.dll!RegCreateKeyExA 764D39AB 5 Bytes JMP 006A0FAF .text C:\Windows\system32\svchost.exe[964] ADVAPI32.dll!RegCreateKeyA 764D3BA9 5 Bytes JMP 006A0036 .text C:\Windows\system32\svchost.exe[964] ADVAPI32.dll!RegOpenKeyA 764D89C7 5 Bytes JMP 006A0FEF .text C:\Windows\system32\svchost.exe[964] ADVAPI32.dll!RegCreateKeyW 764E391E 5 Bytes JMP 006A0047 .text C:\Windows\system32\svchost.exe[964] ADVAPI32.dll!RegCreateKeyExW 764E41F1 5 Bytes JMP 006A0062 .text C:\Windows\system32\svchost.exe[964] ADVAPI32.dll!RegOpenKeyExA 764E7C42 5 Bytes JMP 006A0014 .text C:\Windows\system32\svchost.exe[964] ADVAPI32.dll!RegOpenKeyW 764EE2B5 5 Bytes JMP 006A0FD4 .text C:\Windows\system32\svchost.exe[964] ADVAPI32.dll!RegOpenKeyExW 764F7BA1 5 Bytes JMP 006A0025 .text C:\Windows\system32\svchost.exe[964] WS2_32.dll!socket 765836D1 5 Bytes JMP 006B0FEF .text C:\Windows\System32\svchost.exe[1016] kernel32.dll!GetStartupInfoW 762E1929 5 Bytes JMP 00F9007D .text C:\Windows\System32\svchost.exe[1016] kernel32.dll!GetStartupInfoA 762E19C9 5 Bytes JMP 00F90062 .text C:\Windows\System32\svchost.exe[1016] kernel32.dll!CreateProcessW 762E1BF3 5 Bytes JMP 00F90F04 .text C:\Windows\System32\svchost.exe[1016] kernel32.dll!CreateProcessA 762E1C28 5 Bytes JMP 00F90F15 .text C:\Windows\System32\svchost.exe[1016] kernel32.dll!VirtualProtect 762E1DC3 5 Bytes JMP 00F9002F .text C:\Windows\System32\svchost.exe[1016] kernel32.dll!CreateNamedPipeA 762E2EF5 5 Bytes JMP 00F90FD4 .text C:\Windows\System32\svchost.exe[1016] kernel32.dll!CreateNamedPipeW 762E5C0C 5 Bytes JMP 00F90FC3 .text C:\Windows\System32\svchost.exe[1016] kernel32.dll!CreatePipe 76308E6E 5 Bytes JMP 00F90051 .text C:\Windows\System32\svchost.exe[1016] kernel32.dll!LoadLibraryExW 76309109 5 Bytes JMP 00F90F61 .text C:\Windows\System32\svchost.exe[1016] kernel32.dll!LoadLibraryW 76309362 5 Bytes JMP 00F90F8D .text C:\Windows\System32\svchost.exe[1016] kernel32.dll!LoadLibraryExA 763094B4 5 Bytes JMP 00F90F7C .text C:\Windows\System32\svchost.exe[1016] kernel32.dll!LoadLibraryA 763094DC 5 Bytes JMP 00F90FA8 .text C:\Windows\System32\svchost.exe[1016] kernel32.dll!VirtualProtectEx 7630DBDA 5 Bytes JMP 00F90040 .text C:\Windows\System32\svchost.exe[1016] kernel32.dll!GetProcAddress 7632903B 5 Bytes JMP 00F90EE9 .text C:\Windows\System32\svchost.exe[1016] kernel32.dll!CreateFileW 7632AECB 5 Bytes JMP 00F90FE5 .text C:\Windows\System32\svchost.exe[1016] kernel32.dll!CreateFileA 7632CE5F 5 Bytes JMP 00F90000 .text C:\Windows\System32\svchost.exe[1016] kernel32.dll!WinExec 76375CF7 5 Bytes JMP 00F90F26 .text C:\Windows\System32\svchost.exe[1016] msvcrt.dll!_wsystem 76767F2F 5 Bytes JMP 01FD0FB2 .text C:\Windows\System32\svchost.exe[1016] msvcrt.dll!system 7676804B 5 Bytes JMP 01FD0033 .text C:\Windows\System32\svchost.exe[1016] msvcrt.dll!_creat 7676BBE1 5 Bytes JMP 01FD0FDE .text C:\Windows\System32\svchost.exe[1016] msvcrt.dll!_open 7676D106 5 Bytes JMP 01FD000C .text C:\Windows\System32\svchost.exe[1016] msvcrt.dll!_wcreat 7676D326 5 Bytes JMP 01FD0FCD .text C:\Windows\System32\svchost.exe[1016] msvcrt.dll!_wopen 7676D501 5 Bytes JMP 01FD0FEF .text C:\Windows\System32\svchost.exe[1016] ADVAPI32.dll!RegCreateKeyExA 764D39AB 5 Bytes JMP 00FA0F9E .text C:\Windows\System32\svchost.exe[1016] ADVAPI32.dll!RegCreateKeyA 764D3BA9 5 Bytes JMP 00FA0FB9 .text C:\Windows\System32\svchost.exe[1016] ADVAPI32.dll!RegOpenKeyA 764D89C7 5 Bytes JMP 00FA0000 .text C:\Windows\System32\svchost.exe[1016] ADVAPI32.dll!RegCreateKeyW 764E391E 5 Bytes JMP 00FA0040 .text C:\Windows\System32\svchost.exe[1016] ADVAPI32.dll!RegCreateKeyExW 764E41F1 5 Bytes JMP 00FA0F8D .text C:\Windows\System32\svchost.exe[1016] ADVAPI32.dll!RegOpenKeyExA 764E7C42 5 Bytes JMP 00FA0FCA .text C:\Windows\System32\svchost.exe[1016] ADVAPI32.dll!RegOpenKeyW 764EE2B5 5 Bytes JMP 00FA0FE5 .text C:\Windows\System32\svchost.exe[1016] ADVAPI32.dll!RegOpenKeyExW 764F7BA1 5 Bytes JMP 00FA0025 .text C:\Windows\System32\svchost.exe[1016] WS2_32.dll!socket 765836D1 5 Bytes JMP 00FB0000 .text C:\Windows\System32\svchost.exe[1016] wininet.dll!InternetOpenA 7793D690 5 Bytes JMP 01FE0000 .text C:\Windows\System32\svchost.exe[1016] wininet.dll!InternetOpenW 7793DB09 5 Bytes JMP 01FE001B .text C:\Windows\System32\svchost.exe[1016] wininet.dll!InternetOpenUrlA 7793F3A4 5 Bytes JMP 01FE002C .text C:\Windows\System32\svchost.exe[1016] wininet.dll!InternetOpenUrlW 77986DDF 5 Bytes JMP 01FE0FE5 .text C:\Windows\System32\svchost.exe[1068] kernel32.dll!GetStartupInfoW 762E1929 5 Bytes JMP 00880F52 .text C:\Windows\System32\svchost.exe[1068] kernel32.dll!GetStartupInfoA 762E19C9 5 Bytes JMP 00880098 .text C:\Windows\System32\svchost.exe[1068] kernel32.dll!CreateProcessW 762E1BF3 5 Bytes JMP 008800CE .text C:\Windows\System32\svchost.exe[1068] kernel32.dll!CreateProcessA 762E1C28 5 Bytes JMP 00880F2D .text C:\Windows\System32\svchost.exe[1068] kernel32.dll!VirtualProtect 762E1DC3 5 Bytes JMP 00880F77 .text C:\Windows\System32\svchost.exe[1068] kernel32.dll!CreateNamedPipeA 762E2EF5 5 Bytes JMP 00880FB9 .text C:\Windows\System32\svchost.exe[1068] kernel32.dll!CreateNamedPipeW 762E5C0C 5 Bytes JMP 0088000A .text C:\Windows\System32\svchost.exe[1068] kernel32.dll!CreatePipe 76308E6E 5 Bytes JMP 0088007D .text C:\Windows\System32\svchost.exe[1068] kernel32.dll!LoadLibraryExW 76309109 5 Bytes JMP 00880051 .text C:\Windows\System32\svchost.exe[1068] kernel32.dll!LoadLibraryW 76309362 5 Bytes JMP 00880036 .text C:\Windows\System32\svchost.exe[1068] kernel32.dll!LoadLibraryExA 763094B4 5 Bytes JMP 00880F94 .text C:\Windows\System32\svchost.exe[1068] kernel32.dll!LoadLibraryA 763094DC 5 Bytes JMP 00880025 .text C:\Windows\System32\svchost.exe[1068] kernel32.dll!VirtualProtectEx 7630DBDA 5 Bytes JMP 00880062 .text C:\Windows\System32\svchost.exe[1068] kernel32.dll!GetProcAddress 7632903B 5 Bytes JMP 008800DF .text C:\Windows\System32\svchost.exe[1068] kernel32.dll!CreateFileW 7632AECB 5 Bytes JMP 00880FD4 .text C:\Windows\System32\svchost.exe[1068] kernel32.dll!CreateFileA 7632CE5F 5 Bytes JMP 00880FEF .text C:\Windows\System32\svchost.exe[1068] kernel32.dll!WinExec 76375CF7 5 Bytes JMP 008800B3 .text C:\Windows\System32\svchost.exe[1068] msvcrt.dll!_wsystem 76767F2F 5 Bytes JMP 00B0002C .text C:\Windows\System32\svchost.exe[1068] msvcrt.dll!system 7676804B 5 Bytes JMP 00B00011 .text C:\Windows\System32\svchost.exe[1068] msvcrt.dll!_creat 7676BBE1 5 Bytes JMP 00B00000 .text C:\Windows\System32\svchost.exe[1068] msvcrt.dll!_open 7676D106 5 Bytes JMP 00B00FE3 .text C:\Windows\System32\svchost.exe[1068] msvcrt.dll!_wcreat 7676D326 5 Bytes JMP 00B00FAB .text C:\Windows\System32\svchost.exe[1068] msvcrt.dll!_wopen 7676D501 5 Bytes JMP 00B00FC6 .text C:\Windows\System32\svchost.exe[1068] ADVAPI32.dll!RegCreateKeyExA 764D39AB 5 Bytes JMP 0089005B .text C:\Windows\System32\svchost.exe[1068] ADVAPI32.dll!RegCreateKeyA 764D3BA9 5 Bytes JMP 00890FB9 .text C:\Windows\System32\svchost.exe[1068] ADVAPI32.dll!RegOpenKeyA 764D89C7 5 Bytes JMP 00890000 .text C:\Windows\System32\svchost.exe[1068] ADVAPI32.dll!RegCreateKeyW 764E391E 5 Bytes JMP 00890040 .text C:\Windows\System32\svchost.exe[1068] ADVAPI32.dll!RegCreateKeyExW 764E41F1 5 Bytes JMP 0089006C .text C:\Windows\System32\svchost.exe[1068] ADVAPI32.dll!RegOpenKeyExA 764E7C42 5 Bytes JMP 00890FE5 .text C:\Windows\System32\svchost.exe[1068] ADVAPI32.dll!RegOpenKeyW 764EE2B5 5 Bytes JMP 0089001B .text C:\Windows\System32\svchost.exe[1068] ADVAPI32.dll!RegOpenKeyExW 764F7BA1 5 Bytes JMP 00890FCA .text C:\Windows\System32\svchost.exe[1068] WS2_32.dll!socket 765836D1 5 Bytes JMP 008C0000 .text C:\Windows\System32\svchost.exe[1068] WININET.dll!InternetOpenA 7793D690 5 Bytes JMP 01600000 .text C:\Windows\System32\svchost.exe[1068] WININET.dll!InternetOpenW 7793DB09 5 Bytes JMP 01600011 .text C:\Windows\System32\svchost.exe[1068] WININET.dll!InternetOpenUrlA 7793F3A4 5 Bytes JMP 01600FDB .text C:\Windows\System32\svchost.exe[1068] WININET.dll!InternetOpenUrlW 77986DDF 5 Bytes JMP 01600FCA .text C:\Windows\System32\svchost.exe[1096] kernel32.dll!GetStartupInfoW 762E1929 5 Bytes JMP 00A70F52 .text C:\Windows\System32\svchost.exe[1096] kernel32.dll!GetStartupInfoA 762E19C9 5 Bytes JMP 00A70098 .text C:\Windows\System32\svchost.exe[1096] kernel32.dll!CreateProcessW 762E1BF3 5 Bytes JMP 00A700A9 .text C:\Windows\System32\svchost.exe[1096] kernel32.dll!CreateProcessA 762E1C28 5 Bytes JMP 00A70F1C .text C:\Windows\System32\svchost.exe[1096] kernel32.dll!VirtualProtect 762E1DC3 5 Bytes JMP 00A70F63 .text C:\Windows\System32\svchost.exe[1096] kernel32.dll!CreateNamedPipeA 762E2EF5 5 Bytes JMP 00A70000 .text C:\Windows\System32\svchost.exe[1096] kernel32.dll!CreateNamedPipeW 762E5C0C 5 Bytes JMP 00A70FAF .text C:\Windows\System32\svchost.exe[1096] kernel32.dll!CreatePipe 76308E6E 5 Bytes JMP 00A70073 .text C:\Windows\System32\svchost.exe[1096] kernel32.dll!LoadLibraryExW 76309109 5 Bytes JMP 00A70047 .text C:\Windows\System32\svchost.exe[1096] kernel32.dll!LoadLibraryW 76309362 5 Bytes JMP 00A70025 .text C:\Windows\System32\svchost.exe[1096] kernel32.dll!LoadLibraryExA 763094B4 5 Bytes JMP 00A70036 .text C:\Windows\System32\svchost.exe[1096] kernel32.dll!LoadLibraryA 763094DC 5 Bytes JMP 00A70F9E .text C:\Windows\System32\svchost.exe[1096] kernel32.dll!VirtualProtectEx 7630DBDA 5 Bytes JMP 00A70058 .text C:\Windows\System32\svchost.exe[1096] kernel32.dll!GetProcAddress 7632903B 5 Bytes JMP 00A700C4 .text C:\Windows\System32\svchost.exe[1096] kernel32.dll!CreateFileW 7632AECB 5 Bytes JMP 00A70FCA .text C:\Windows\System32\svchost.exe[1096] kernel32.dll!CreateFileA 7632CE5F 5 Bytes JMP 00A70FEF .text C:\Windows\System32\svchost.exe[1096] kernel32.dll!WinExec 76375CF7 5 Bytes JMP 00A70F2D .text C:\Windows\System32\svchost.exe[1096] msvcrt.dll!_wsystem 76767F2F 5 Bytes JMP 00AE0F90 .text C:\Windows\System32\svchost.exe[1096] msvcrt.dll!system 7676804B 5 Bytes JMP 00AE001B .text C:\Windows\System32\svchost.exe[1096] msvcrt.dll!_creat 7676BBE1 5 Bytes JMP 00AE0FC6 .text C:\Windows\System32\svchost.exe[1096] msvcrt.dll!_open 7676D106 5 Bytes JMP 00AE0000 .text C:\Windows\System32\svchost.exe[1096] msvcrt.dll!_wcreat 7676D326 5 Bytes JMP 00AE0FB5 .text C:\Windows\System32\svchost.exe[1096] msvcrt.dll!_wopen 7676D501 5 Bytes JMP 00AE0FE3 .text C:\Windows\System32\svchost.exe[1096] ADVAPI32.dll!RegCreateKeyExA 764D39AB 5 Bytes JMP 00A80F9E .text C:\Windows\System32\svchost.exe[1096] ADVAPI32.dll!RegCreateKeyA 764D3BA9 5 Bytes JMP 00A80036 .text C:\Windows\System32\svchost.exe[1096] ADVAPI32.dll!RegOpenKeyA 764D89C7 5 Bytes JMP 00A80000 .text C:\Windows\System32\svchost.exe[1096] ADVAPI32.dll!RegCreateKeyW 764E391E 5 Bytes JMP 00A80FAF .text C:\Windows\System32\svchost.exe[1096] ADVAPI32.dll!RegCreateKeyExW 764E41F1 5 Bytes JMP 00A80F83 .text C:\Windows\System32\svchost.exe[1096] ADVAPI32.dll!RegOpenKeyExA 764E7C42 5 Bytes JMP 00A80025 .text C:\Windows\System32\svchost.exe[1096] ADVAPI32.dll!RegOpenKeyW 764EE2B5 5 Bytes JMP 00A80FE5 .text C:\Windows\System32\svchost.exe[1096] ADVAPI32.dll!RegOpenKeyExW 764F7BA1 5 Bytes JMP 00A80FCA .text C:\Windows\System32\svchost.exe[1096] WS2_32.dll!socket 765836D1 5 Bytes JMP 00AD0000 .text C:\Windows\system32\svchost.exe[1120] kernel32.dll!GetStartupInfoW 762E1929 3 Bytes JMP 00BA0098 .text C:\Windows\system32\svchost.exe[1120] kernel32.dll!GetStartupInfoW + 4 762E192D 1 Byte [8A] .text C:\Windows\system32\svchost.exe[1120] kernel32.dll!GetStartupInfoA 762E19C9 3 Bytes JMP 00BA0F5C .text C:\Windows\system32\svchost.exe[1120] kernel32.dll!GetStartupInfoA + 4 762E19CD 1 Byte [8A] .text C:\Windows\system32\svchost.exe[1120] kernel32.dll!CreateProcessW 762E1BF3 3 Bytes JMP 00BA00B3 .text C:\Windows\system32\svchost.exe[1120] kernel32.dll!CreateProcessW + 4 762E1BF7 1 Byte [8A] .text C:\Windows\system32\svchost.exe[1120] kernel32.dll!CreateProcessA 762E1C28 3 Bytes JMP 00BA0F1C .text C:\Windows\system32\svchost.exe[1120] kernel32.dll!CreateProcessA + 4 762E1C2C 1 Byte [8A] .text C:\Windows\system32\svchost.exe[1120] kernel32.dll!VirtualProtect 762E1DC3 3 Bytes JMP 00BA0F88 .text C:\Windows\system32\svchost.exe[1120] kernel32.dll!VirtualProtect + 4 762E1DC7 1 Byte [8A] .text C:\Windows\system32\svchost.exe[1120] kernel32.dll!CreateNamedPipeA 762E2EF5 3 Bytes JMP 00BA0FD4 .text C:\Windows\system32\svchost.exe[1120] kernel32.dll!CreateNamedPipeA + 4 762E2EF9 1 Byte [8A] .text C:\Windows\system32\svchost.exe[1120] kernel32.dll!CreateNamedPipeW 762E5C0C 3 Bytes JMP 00BA0025 .text C:\Windows\system32\svchost.exe[1120] kernel32.dll!CreateNamedPipeW + 4 762E5C10 1 Byte [8A] .text C:\Windows\system32\svchost.exe[1120] kernel32.dll!CreatePipe 76308E6E 5 Bytes JMP 00BA0F77 .text C:\Windows\system32\svchost.exe[1120] kernel32.dll!LoadLibraryExW 76309109 5 Bytes JMP 00BA006C .text C:\Windows\system32\svchost.exe[1120] kernel32.dll!LoadLibraryW 76309362 5 Bytes JMP 00BA0036 .text C:\Windows\system32\svchost.exe[1120] kernel32.dll!LoadLibraryExA 763094B4 5 Bytes JMP 00BA005B .text C:\Windows\system32\svchost.exe[1120] kernel32.dll!LoadLibraryA 763094DC 5 Bytes JMP 00BA0FB9 .text C:\Windows\system32\svchost.exe[1120] kernel32.dll!VirtualProtectEx 7630DBDA 5 Bytes JMP 00BA0087 .text C:\Windows\system32\svchost.exe[1120] kernel32.dll!GetProcAddress 7632903B 5 Bytes JMP 00BA0F01 .text C:\Windows\system32\svchost.exe[1120] kernel32.dll!CreateFileW 7632AECB 5 Bytes JMP 00BA0FEF .text C:\Windows\system32\svchost.exe[1120] kernel32.dll!CreateFileA 7632CE5F 5 Bytes JMP 00BA0000 .text C:\Windows\system32\svchost.exe[1120] kernel32.dll!WinExec 76375CF7 5 Bytes JMP 00BA0F37 .text C:\Windows\system32\svchost.exe[1120] msvcrt.dll!_wsystem 76767F2F 5 Bytes JMP 00FE0F88 .text C:\Windows\system32\svchost.exe[1120] msvcrt.dll!system 7676804B 5 Bytes JMP 00FE001D .text C:\Windows\system32\svchost.exe[1120] msvcrt.dll!_creat 7676BBE1 5 Bytes JMP 00FE0FC1 .text C:\Windows\system32\svchost.exe[1120] msvcrt.dll!_open 7676D106 5 Bytes JMP 00FE0FEF .text C:\Windows\system32\svchost.exe[1120] msvcrt.dll!_wcreat 7676D326 5 Bytes JMP 00FE000C .text C:\Windows\system32\svchost.exe[1120] msvcrt.dll!_wopen 7676D501 5 Bytes JMP 00FE0FD2 .text C:\Windows\system32\svchost.exe[1120] ADVAPI32.dll!RegCreateKeyExA 764D39AB 5 Bytes JMP 00F80F94 .text C:\Windows\system32\svchost.exe[1120] ADVAPI32.dll!RegCreateKeyA 764D3BA9 5 Bytes JMP 00F80040 .text C:\Windows\system32\svchost.exe[1120] ADVAPI32.dll!RegOpenKeyA 764D89C7 5 Bytes JMP 00F80FE5 .text C:\Windows\system32\svchost.exe[1120] ADVAPI32.dll!RegCreateKeyW 764E391E 5 Bytes JMP 00F80FB9 .text C:\Windows\system32\svchost.exe[1120] ADVAPI32.dll!RegCreateKeyExW 764E41F1 5 Bytes JMP 00F80051 .text C:\Windows\system32\svchost.exe[1120] ADVAPI32.dll!RegOpenKeyExA 764E7C42 5 Bytes JMP 00F80025 .text C:\Windows\system32\svchost.exe[1120] ADVAPI32.dll!RegOpenKeyW 764EE2B5 5 Bytes JMP 00F8000A .text C:\Windows\system32\svchost.exe[1120] ADVAPI32.dll!RegOpenKeyExW 764F7BA1 5 Bytes JMP 00F80FCA .text C:\Windows\system32\svchost.exe[1120] WS2_32.dll!socket 765836D1 5 Bytes JMP 00F90FEF .text C:\Windows\system32\svchost.exe[1296] kernel32.dll!GetStartupInfoW 762E1929 5 Bytes JMP 00070F33 .text C:\Windows\system32\svchost.exe[1296] kernel32.dll!GetStartupInfoA 762E19C9 5 Bytes JMP 00070F4E .text C:\Windows\system32\svchost.exe[1296] kernel32.dll!CreateProcessW 762E1BF3 5 Bytes JMP 00070EFD .text C:\Windows\system32\svchost.exe[1296] kernel32.dll!CreateProcessA 762E1C28 5 Bytes JMP 00070F18 .text C:\Windows\system32\svchost.exe[1296] kernel32.dll!VirtualProtect 762E1DC3 5 Bytes JMP 0007006F .text C:\Windows\system32\svchost.exe[1296] kernel32.dll!CreateNamedPipeA 762E2EF5 5 Bytes JMP 00070FD4 .text C:\Windows\system32\svchost.exe[1296] kernel32.dll!CreateNamedPipeW 762E5C0C 5 Bytes JMP 0007001B .text C:\Windows\system32\svchost.exe[1296] kernel32.dll!CreatePipe 76308E6E 5 Bytes JMP 00070F69 .text C:\Windows\system32\svchost.exe[1296] kernel32.dll!LoadLibraryExW 76309109 5 Bytes JMP 00070F8B .text C:\Windows\system32\svchost.exe[1296] kernel32.dll!LoadLibraryW 76309362 5 Bytes JMP 0007004A .text C:\Windows\system32\svchost.exe[1296] kernel32.dll!LoadLibraryExA 763094B4 5 Bytes JMP 00070FA8 .text C:\Windows\system32\svchost.exe[1296] kernel32.dll!LoadLibraryA 763094DC 5 Bytes JMP 00070FB9 .text C:\Windows\system32\svchost.exe[1296] kernel32.dll!VirtualProtectEx 7630DBDA 5 Bytes JMP 00070F7A .text C:\Windows\system32\svchost.exe[1296] kernel32.dll!GetProcAddress 7632903B 5 Bytes JMP 00070EEC .text C:\Windows\system32\svchost.exe[1296] kernel32.dll!CreateFileW 7632AECB 5 Bytes JMP 0007000A .text C:\Windows\system32\svchost.exe[1296] kernel32.dll!CreateFileA 7632CE5F 5 Bytes JMP 00070FEF .text C:\Windows\system32\svchost.exe[1296] kernel32.dll!WinExec 76375CF7 5 Bytes JMP 0007009E .text C:\Windows\system32\svchost.exe[1296] msvcrt.dll!_wsystem 76767F2F 5 Bytes JMP 00130FAA .text C:\Windows\system32\svchost.exe[1296] msvcrt.dll!system 7676804B 5 Bytes JMP 0013003F .text C:\Windows\system32\svchost.exe[1296] msvcrt.dll!_creat 7676BBE1 5 Bytes JMP 0013001D .text C:\Windows\system32\svchost.exe[1296] msvcrt.dll!_open 7676D106 5 Bytes JMP 00130000 .text C:\Windows\system32\svchost.exe[1296] msvcrt.dll!_wcreat 7676D326 5 Bytes JMP 0013002E .text C:\Windows\system32\svchost.exe[1296] msvcrt.dll!_wopen 7676D501 5 Bytes JMP 00130FE3 .text C:\Windows\system32\svchost.exe[1296] ADVAPI32.dll!RegCreateKeyExA 764D39AB 5 Bytes JMP 00080F97 .text C:\Windows\system32\svchost.exe[1296] ADVAPI32.dll!RegCreateKeyA 764D3BA9 5 Bytes JMP 00080FCD .text C:\Windows\system32\svchost.exe[1296] ADVAPI32.dll!RegOpenKeyA 764D89C7 5 Bytes JMP 0008000A .text C:\Windows\system32\svchost.exe[1296] ADVAPI32.dll!RegCreateKeyW 764E391E 5 Bytes JMP 00080FA8 .text C:\Windows\system32\svchost.exe[1296] ADVAPI32.dll!RegCreateKeyExW 764E41F1 5 Bytes JMP 00080F7C .text C:\Windows\system32\svchost.exe[1296] ADVAPI32.dll!RegOpenKeyExA 764E7C42 5 Bytes JMP 00080FEF .text C:\Windows\system32\svchost.exe[1296] ADVAPI32.dll!RegOpenKeyW 764EE2B5 5 Bytes JMP 0008001B .text C:\Windows\system32\svchost.exe[1296] ADVAPI32.dll!RegOpenKeyExW 764F7BA1 5 Bytes JMP 00080FDE .text C:\Windows\system32\svchost.exe[1296] WS2_32.dll!socket 765836D1 5 Bytes JMP 00120000 .text C:\Windows\system32\svchost.exe[1448] kernel32.dll!GetStartupInfoW 762E1929 5 Bytes JMP 00A500C0 .text C:\Windows\system32\svchost.exe[1448] kernel32.dll!GetStartupInfoA 762E19C9 5 Bytes JMP 00A500A5 .text C:\Windows\system32\svchost.exe[1448] kernel32.dll!CreateProcessW 762E1BF3 5 Bytes JMP 00A50107 .text C:\Windows\system32\svchost.exe[1448] kernel32.dll!CreateProcessA 762E1C28 5 Bytes JMP 00A500F6 .text C:\Windows\system32\svchost.exe[1448] kernel32.dll!VirtualProtect 762E1DC3 5 Bytes JMP 00A50076 .text C:\Windows\system32\svchost.exe[1448] kernel32.dll!CreateNamedPipeA 762E2EF5 5 Bytes JMP 00A50FC3 .text C:\Windows\system32\svchost.exe[1448] kernel32.dll!CreateNamedPipeW 762E5C0C 5 Bytes JMP 00A5000A .text C:\Windows\system32\svchost.exe[1448] kernel32.dll!CreatePipe 76308E6E 5 Bytes JMP 00A50F70 .text C:\Windows\system32\svchost.exe[1448] kernel32.dll!LoadLibraryExW 76309109 5 Bytes JMP 00A5005B .text C:\Windows\system32\svchost.exe[1448] kernel32.dll!LoadLibraryW 76309362 5 Bytes JMP 00A50040 .text C:\Windows\system32\svchost.exe[1448] kernel32.dll!LoadLibraryExA 763094B4 5 Bytes JMP 00A50F9E .text C:\Windows\system32\svchost.exe[1448] kernel32.dll!LoadLibraryA 763094DC 5 Bytes JMP 00A5001B .text C:\Windows\system32\svchost.exe[1448] kernel32.dll!VirtualProtectEx 7630DBDA 5 Bytes JMP 00A50F81 .text C:\Windows\system32\svchost.exe[1448] kernel32.dll!GetProcAddress 7632903B 5 Bytes JMP 00A50F5F .text C:\Windows\system32\svchost.exe[1448] kernel32.dll!CreateFileW 7632AECB 5 Bytes JMP 00A50FD4 .text C:\Windows\system32\svchost.exe[1448] kernel32.dll!CreateFileA 7632CE5F 5 Bytes JMP 00A50FE5 .text C:\Windows\system32\svchost.exe[1448] kernel32.dll!WinExec 76375CF7 5 Bytes JMP 00A500DB .text C:\Windows\system32\svchost.exe[1448] msvcrt.dll!_wsystem 76767F2F 5 Bytes JMP 00B6004C .text C:\Windows\system32\svchost.exe[1448] msvcrt.dll!system 7676804B 5 Bytes JMP 00B60FB7 .text C:\Windows\system32\svchost.exe[1448] msvcrt.dll!_creat 7676BBE1 5 Bytes JMP 00B60FE3 .text C:\Windows\system32\svchost.exe[1448] msvcrt.dll!_open 7676D106 5 Bytes JMP 00B60000 .text C:\Windows\system32\svchost.exe[1448] msvcrt.dll!_wcreat 7676D326 5 Bytes JMP 00B60FC8 .text C:\Windows\system32\svchost.exe[1448] msvcrt.dll!_wopen 7676D501 5 Bytes JMP 00B6001D .text C:\Windows\system32\svchost.exe[1448] ADVAPI32.dll!RegCreateKeyExA 764D39AB 5 Bytes JMP 00AA0FA8 .text C:\Windows\system32\svchost.exe[1448] ADVAPI32.dll!RegCreateKeyA 764D3BA9 5 Bytes JMP 00AA0040 .text C:\Windows\system32\svchost.exe[1448] ADVAPI32.dll!RegOpenKeyA 764D89C7 5 Bytes JMP 00AA0FEF .text C:\Windows\system32\svchost.exe[1448] ADVAPI32.dll!RegCreateKeyW 764E391E 5 Bytes JMP 00AA0FC3 .text C:\Windows\system32\svchost.exe[1448] ADVAPI32.dll!RegCreateKeyExW 764E41F1 5 Bytes JMP 00AA0F8D .text C:\Windows\system32\svchost.exe[1448] ADVAPI32.dll!RegOpenKeyExA 764E7C42 5 Bytes JMP 00AA0FD4 .text C:\Windows\system32\svchost.exe[1448] ADVAPI32.dll!RegOpenKeyW 764EE2B5 5 Bytes JMP 00AA000A .text C:\Windows\system32\svchost.exe[1448] ADVAPI32.dll!RegOpenKeyExW 764F7BA1 5 Bytes JMP 00AA0025 .text C:\Windows\system32\svchost.exe[1448] WS2_32.dll!socket 765836D1 5 Bytes JMP 00B10FEF .text C:\Windows\system32\svchost.exe[1448] WinInet.dll!InternetOpenA 7793D690 5 Bytes JMP 00F80000 .text C:\Windows\system32\svchost.exe[1448] WinInet.dll!InternetOpenW 7793DB09 5 Bytes JMP 00F80011 .text C:\Windows\system32\svchost.exe[1448] WinInet.dll!InternetOpenUrlA 7793F3A4 5 Bytes JMP 00F80FDB .text C:\Windows\system32\svchost.exe[1448] WinInet.dll!InternetOpenUrlW 77986DDF 5 Bytes JMP 00F80036 .text C:\Windows\system32\svchost.exe[1608] kernel32.dll!GetStartupInfoW 762E1929 5 Bytes JMP 008D0F5C .text C:\Windows\system32\svchost.exe[1608] kernel32.dll!GetStartupInfoA 762E19C9 5 Bytes JMP 008D00A2 .text C:\Windows\system32\svchost.exe[1608] kernel32.dll!CreateProcessW 762E1BF3 5 Bytes JMP 008D00D8 .text C:\Windows\system32\svchost.exe[1608] kernel32.dll!CreateProcessA 762E1C28 5 Bytes JMP 008D00C7 .text C:\Windows\system32\svchost.exe[1608] kernel32.dll!VirtualProtect 762E1DC3 5 Bytes JMP 008D0F8B .text C:\Windows\system32\svchost.exe[1608] kernel32.dll!CreateNamedPipeA 762E2EF5 5 Bytes JMP 008D0FD4 .text C:\Windows\system32\svchost.exe[1608] kernel32.dll!CreateNamedPipeW 762E5C0C 5 Bytes JMP 008D002F .text C:\Windows\system32\svchost.exe[1608] kernel32.dll!CreatePipe 76308E6E 5 Bytes JMP 008D0091 .text C:\Windows\system32\svchost.exe[1608] kernel32.dll!LoadLibraryExW 76309109 5 Bytes JMP 008D0FA8 .text C:\Windows\system32\svchost.exe[1608] kernel32.dll!LoadLibraryW 76309362 5 Bytes JMP 008D0FB9 .text C:\Windows\system32\svchost.exe[1608] kernel32.dll!LoadLibraryExA 763094B4 5 Bytes JMP 008D0065 .text C:\Windows\system32\svchost.exe[1608] kernel32.dll!LoadLibraryA 763094DC 5 Bytes JMP 008D0040 .text C:\Windows\system32\svchost.exe[1608] kernel32.dll!VirtualProtectEx 7630DBDA 5 Bytes JMP 008D0080 .text C:\Windows\system32\svchost.exe[1608] kernel32.dll!GetProcAddress 7632903B 5 Bytes JMP 008D00E9 .text C:\Windows\system32\svchost.exe[1608] kernel32.dll!CreateFileW 7632AECB 5 Bytes JMP 008D0FE5 .text C:\Windows\system32\svchost.exe[1608] kernel32.dll!CreateFileA 7632CE5F 5 Bytes JMP 008D0000 .text C:\Windows\system32\svchost.exe[1608] kernel32.dll!WinExec 76375CF7 5 Bytes JMP 008D0F4B .text C:\Windows\system32\svchost.exe[1608] msvcrt.dll!_wsystem 76767F2F 5 Bytes JMP 00950049 .text C:\Windows\system32\svchost.exe[1608] msvcrt.dll!system 7676804B 5 Bytes JMP 00950038 .text C:\Windows\system32\svchost.exe[1608] msvcrt.dll!_creat 7676BBE1 5 Bytes JMP 00950FD2 .text C:\Windows\system32\svchost.exe[1608] msvcrt.dll!_open 7676D106 5 Bytes JMP 00950000 .text C:\Windows\system32\svchost.exe[1608] msvcrt.dll!_wcreat 7676D326 5 Bytes JMP 00950027 .text C:\Windows\system32\svchost.exe[1608] msvcrt.dll!_wopen 7676D501 5 Bytes JMP 00950FE3 .text C:\Windows\system32\svchost.exe[1608] ADVAPI32.dll!RegCreateKeyExA 764D39AB 5 Bytes JMP 00930073 .text C:\Windows\system32\svchost.exe[1608] ADVAPI32.dll!RegCreateKeyA 764D3BA9 5 Bytes JMP 00930051 .text C:\Windows\system32\svchost.exe[1608] ADVAPI32.dll!RegOpenKeyA 764D89C7 5 Bytes JMP 00930FEF .text C:\Windows\system32\svchost.exe[1608] ADVAPI32.dll!RegCreateKeyW 764E391E 5 Bytes JMP 00930062 .text C:\Windows\system32\svchost.exe[1608] ADVAPI32.dll!RegCreateKeyExW 764E41F1 5 Bytes JMP 00930084 .text C:\Windows\system32\svchost.exe[1608] ADVAPI32.dll!RegOpenKeyExA 764E7C42 5 Bytes JMP 00930025 .text C:\Windows\system32\svchost.exe[1608] ADVAPI32.dll!RegOpenKeyW 764EE2B5 5 Bytes JMP 0093000A .text C:\Windows\system32\svchost.exe[1608] ADVAPI32.dll!RegOpenKeyExW 764F7BA1 5 Bytes JMP 00930040 .text C:\Windows\system32\svchost.exe[1608] WS2_32.dll!socket 765836D1 5 Bytes JMP 00940FEF .text C:\Windows\system32\svchost.exe[1820] kernel32.dll!GetStartupInfoW 762E1929 5 Bytes JMP 00280096 .text C:\Windows\system32\svchost.exe[1820] kernel32.dll!GetStartupInfoA 762E19C9 5 Bytes JMP 00280F5A .text C:\Windows\system32\svchost.exe[1820] kernel32.dll!CreateProcessW 762E1BF3 5 Bytes JMP 00280F10 .text C:\Windows\system32\svchost.exe[1820] kernel32.dll!CreateProcessA 762E1C28 5 Bytes JMP 002800B1 .text C:\Windows\system32\svchost.exe[1820] kernel32.dll!VirtualProtect 762E1DC3 5 Bytes JMP 00280F6B .text C:\Windows\system32\svchost.exe[1820] kernel32.dll!CreateNamedPipeA 762E2EF5 5 Bytes JMP 00280FC3 .text C:\Windows\system32\svchost.exe[1820] kernel32.dll!CreateNamedPipeW 762E5C0C 5 Bytes JMP 00280FB2 .text C:\Windows\system32\svchost.exe[1820] kernel32.dll!CreatePipe 76308E6E 5 Bytes JMP 0028007B .text C:\Windows\system32\svchost.exe[1820] kernel32.dll!LoadLibraryExW 76309109 5 Bytes JMP 00280043 .text C:\Windows\system32\svchost.exe[1820] kernel32.dll!LoadLibraryW 76309362 5 Bytes JMP 00280F97 .text C:\Windows\system32\svchost.exe[1820] kernel32.dll!LoadLibraryExA 763094B4 5 Bytes JMP 00280F86 .text C:\Windows\system32\svchost.exe[1820] kernel32.dll!LoadLibraryA 763094DC 5 Bytes JMP 0028001E .text C:\Windows\system32\svchost.exe[1820] kernel32.dll!VirtualProtectEx 7630DBDA 5 Bytes JMP 00280060 .text C:\Windows\system32\svchost.exe[1820] kernel32.dll!GetProcAddress 7632903B 5 Bytes JMP 00280EF5 .text C:\Windows\system32\svchost.exe[1820] kernel32.dll!CreateFileW 7632AECB 5 Bytes JMP 00280FD4 .text C:\Windows\system32\svchost.exe[1820] kernel32.dll!CreateFileA 7632CE5F 5 Bytes JMP 00280FEF .text C:\Windows\system32\svchost.exe[1820] kernel32.dll!WinExec 76375CF7 5 Bytes JMP 00280F35 .text C:\Windows\system32\svchost.exe[1820] msvcrt.dll!_wsystem 76767F2F 5 Bytes JMP 00730F8D .text C:\Windows\system32\svchost.exe[1820] msvcrt.dll!system 7676804B 5 Bytes JMP 00730FA8 .text C:\Windows\system32\svchost.exe[1820] msvcrt.dll!_creat 7676BBE1 5 Bytes JMP 00730FC3 .text C:\Windows\system32\svchost.exe[1820] msvcrt.dll!_open 7676D106 5 Bytes JMP 00730FEF .text C:\Windows\system32\svchost.exe[1820] msvcrt.dll!_wcreat 7676D326 5 Bytes JMP 00730018 .text C:\Windows\system32\svchost.exe[1820] msvcrt.dll!_wopen 7676D501 5 Bytes JMP 00730FDE .text C:\Windows\system32\svchost.exe[1820] ADVAPI32.dll!RegCreateKeyExA 764D39AB 5 Bytes JMP 00290FAC .text C:\Windows\system32\svchost.exe[1820] ADVAPI32.dll!RegCreateKeyA 764D3BA9 5 Bytes JMP 00290047 .text C:\Windows\system32\svchost.exe[1820] ADVAPI32.dll!RegOpenKeyA 764D89C7 5 Bytes JMP 00290000 .text C:\Windows\system32\svchost.exe[1820] ADVAPI32.dll!RegCreateKeyW 764E391E 5 Bytes JMP 00290058 .text C:\Windows\system32\svchost.exe[1820] ADVAPI32.dll!RegCreateKeyExW 764E41F1 5 Bytes JMP 00290F9B .text C:\Windows\system32\svchost.exe[1820] ADVAPI32.dll!RegOpenKeyExA 764E7C42 5 Bytes JMP 00290036 .text C:\Windows\system32\svchost.exe[1820] ADVAPI32.dll!RegOpenKeyW 764EE2B5 5 Bytes JMP 0029001B .text C:\Windows\system32\svchost.exe[1820] ADVAPI32.dll!RegOpenKeyExW 764F7BA1 5 Bytes JMP 00290FDB .text C:\Windows\system32\svchost.exe[1820] WS2_32.dll!socket 765836D1 5 Bytes JMP 002A0FE5 .text c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe[2104] kernel32.dll!LoadLibraryW 76309362 5 Bytes JMP 0041C1B0 c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe (McAfee Proxy Service Module/McAfee, Inc.) .text c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe[2104] kernel32.dll!LoadLibraryA 763094DC 5 Bytes JMP 0041C130 c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe (McAfee Proxy Service Module/McAfee, Inc.) .text C:\Windows\system32\svchost.exe[2504] kernel32.dll!GetStartupInfoW 762E1929 5 Bytes JMP 000B0F39 .text C:\Windows\system32\svchost.exe[2504] kernel32.dll!GetStartupInfoA 762E19C9 5 Bytes JMP 000B0F4A .text C:\Windows\system32\svchost.exe[2504] kernel32.dll!CreateProcessW 762E1BF3 5 Bytes JMP 000B0F0D .text C:\Windows\system32\svchost.exe[2504] kernel32.dll!CreateProcessA 762E1C28 5 Bytes JMP 000B0F28 .text C:\Windows\system32\svchost.exe[2504] kernel32.dll!VirtualProtect 762E1DC3 5 Bytes JMP 000B0049 .text C:\Windows\system32\svchost.exe[2504] kernel32.dll!CreateNamedPipeA 762E2EF5 5 Bytes JMP 000B0FCA .text C:\Windows\system32\svchost.exe[2504] kernel32.dll!CreateNamedPipeW 762E5C0C 5 Bytes JMP 000B001B .text C:\Windows\system32\svchost.exe[2504] kernel32.dll!CreatePipe 76308E6E 5 Bytes JMP 000B0075 .text C:\Windows\system32\svchost.exe[2504] kernel32.dll!LoadLibraryExW 76309109 5 Bytes JMP 000B0F6F .text C:\Windows\system32\svchost.exe[2504] kernel32.dll!LoadLibraryW 76309362 5 Bytes JMP 000B0F94 .text C:\Windows\system32\svchost.exe[2504] kernel32.dll!LoadLibraryExA 763094B4 5 Bytes JMP 000B002C .text C:\Windows\system32\svchost.exe[2504] kernel32.dll!LoadLibraryA 763094DC 5 Bytes JMP 000B0FA5 .text C:\Windows\system32\svchost.exe[2504] kernel32.dll!VirtualProtectEx 7630DBDA 5 Bytes JMP 000B005A .text C:\Windows\system32\svchost.exe[2504] kernel32.dll!GetProcAddress 7632903B 5 Bytes JMP 000B0EFC .text C:\Windows\system32\svchost.exe[2504] kernel32.dll!CreateFileW 7632AECB 5 Bytes JMP 000B000A .text C:\Windows\system32\svchost.exe[2504] kernel32.dll!CreateFileA 7632CE5F 5 Bytes JMP 000B0FEF .text C:\Windows\system32\svchost.exe[2504] kernel32.dll!WinExec 76375CF7 5 Bytes JMP 000B009A .text C:\Windows\system32\svchost.exe[2504] msvcrt.dll!_wsystem 76767F2F 1 Byte [E9] .text C:\Windows\system32\svchost.exe[2504] msvcrt.dll!_wsystem 76767F2F 5 Bytes JMP 008B0033 .text C:\Windows\system32\svchost.exe[2504] msvcrt.dll!system 7676804B 5 Bytes JMP 008B0FB2 .text C:\Windows\system32\svchost.exe[2504] msvcrt.dll!_creat 7676BBE1 5 Bytes JMP 008B0FCD .text C:\Windows\system32\svchost.exe[2504] msvcrt.dll!_open 7676D106 5 Bytes JMP 008B0FEF .text C:\Windows\system32\svchost.exe[2504] msvcrt.dll!_wcreat 7676D326 5 Bytes JMP 008B0022 .text C:\Windows\system32\svchost.exe[2504] msvcrt.dll!_wopen 7676D501 5 Bytes JMP 008B0FDE .text C:\Windows\system32\svchost.exe[2504] ADVAPI32.dll!RegCreateKeyExA 764D39AB 5 Bytes JMP 0024004A .text C:\Windows\system32\svchost.exe[2504] ADVAPI32.dll!RegCreateKeyA 764D3BA9 5 Bytes JMP 00240FB2 .text C:\Windows\system32\svchost.exe[2504] ADVAPI32.dll!RegOpenKeyA 764D89C7 5 Bytes JMP 0024000A .text C:\Windows\system32\svchost.exe[2504] ADVAPI32.dll!RegCreateKeyW 764E391E 5 Bytes JMP 00240039 .text C:\Windows\system32\svchost.exe[2504] ADVAPI32.dll!RegCreateKeyExW 764E41F1 5 Bytes JMP 0024005B .text C:\Windows\system32\svchost.exe[2504] ADVAPI32.dll!RegOpenKeyExA 764E7C42 5 Bytes JMP 00240FDE .text C:\Windows\system32\svchost.exe[2504] ADVAPI32.dll!RegOpenKeyW 764EE2B5 5 Bytes JMP 00240FEF .text C:\Windows\system32\svchost.exe[2504] ADVAPI32.dll!RegOpenKeyExW 764F7BA1 5 Bytes JMP 00240FCD .text C:\Windows\system32\svchost.exe[2504] WS2_32.dll!socket 765836D1 5 Bytes JMP 00880FEF .text C:\Windows\system32\svchost.exe[2632] kernel32.dll!GetStartupInfoW 762E1929 5 Bytes JMP 01010F83 .text C:\Windows\system32\svchost.exe[2632] kernel32.dll!GetStartupInfoA 762E19C9 5 Bytes JMP 01010F94 .text C:\Windows\system32\svchost.exe[2632] kernel32.dll!CreateProcessW 762E1BF3 5 Bytes JMP 010100FF .text C:\Windows\system32\svchost.exe[2632] kernel32.dll!CreateProcessA 762E1C28 5 Bytes JMP 01010F5E .text C:\Windows\system32\svchost.exe[2632] kernel32.dll!VirtualProtect 762E1DC3 5 Bytes JMP 01010FC0 .text C:\Windows\system32\svchost.exe[2632] kernel32.dll!CreateNamedPipeA 762E2EF5 5 Bytes JMP 01010036 .text C:\Windows\system32\svchost.exe[2632] kernel32.dll!CreateNamedPipeW 762E5C0C 5 Bytes JMP 01010FEF .text C:\Windows\system32\svchost.exe[2632] kernel32.dll!CreatePipe 76308E6E 5 Bytes JMP 010100BF .text C:\Windows\system32\svchost.exe[2632] kernel32.dll!LoadLibraryExW 76309109 5 Bytes JMP 0101009A .text C:\Windows\system32\svchost.exe[2632] kernel32.dll!LoadLibraryW 76309362 5 Bytes JMP 0101006C .text C:\Windows\system32\svchost.exe[2632] kernel32.dll!LoadLibraryExA 763094B4 5 Bytes JMP 0101007D .text C:\Windows\system32\svchost.exe[2632] kernel32.dll!LoadLibraryA 763094DC 5 Bytes JMP 0101005B .text C:\Windows\system32\svchost.exe[2632] kernel32.dll!VirtualProtectEx 7630DBDA 5 Bytes JMP 01010FAF .text C:\Windows\system32\svchost.exe[2632] kernel32.dll!GetProcAddress 7632903B 5 Bytes JMP 01010F4D .text C:\Windows\system32\svchost.exe[2632] kernel32.dll!CreateFileW 7632AECB 5 Bytes JMP 0101001B .text C:\Windows\system32\svchost.exe[2632] kernel32.dll!CreateFileA 7632CE5F 5 Bytes JMP 0101000A .text C:\Windows\system32\svchost.exe[2632] kernel32.dll!WinExec 76375CF7 5 Bytes JMP 010100DA .text C:\Windows\system32\svchost.exe[2632] msvcrt.dll!_wsystem 76767F2F 5 Bytes JMP 0105005D .text C:\Windows\system32\svchost.exe[2632] msvcrt.dll!system 7676804B 5 Bytes JMP 01050042 .text C:\Windows\system32\svchost.exe[2632] msvcrt.dll!_creat 7676BBE1 5 Bytes JMP 01050FD2 .text C:\Windows\system32\svchost.exe[2632] msvcrt.dll!_open 7676D106 5 Bytes JMP 01050FEF .text C:\Windows\system32\svchost.exe[2632] msvcrt.dll!_wcreat 7676D326 5 Bytes JMP 01050027 .text C:\Windows\system32\svchost.exe[2632] msvcrt.dll!_wopen 7676D501 5 Bytes JMP 0105000C .text C:\Windows\system32\svchost.exe[2632] ADVAPI32.dll!RegCreateKeyExA 764D39AB 5 Bytes JMP 01020F91 .text C:\Windows\system32\svchost.exe[2632] ADVAPI32.dll!RegCreateKeyA 764D3BA9 5 Bytes JMP 01020FB6 .text C:\Windows\system32\svchost.exe[2632] ADVAPI32.dll!RegOpenKeyA 764D89C7 5 Bytes JMP 01020000 .text C:\Windows\system32\svchost.exe[2632] ADVAPI32.dll!RegCreateKeyW 764E391E 5 Bytes JMP 0102003D .text C:\Windows\system32\svchost.exe[2632] ADVAPI32.dll!RegCreateKeyExW 764E41F1 5 Bytes JMP 01020F80 .text C:\Windows\system32\svchost.exe[2632] ADVAPI32.dll!RegOpenKeyExA 764E7C42 5 Bytes JMP 01020FDB .text C:\Windows\system32\svchost.exe[2632] ADVAPI32.dll!RegOpenKeyW 764EE2B5 5 Bytes JMP 01020011 .text C:\Windows\system32\svchost.exe[2632] ADVAPI32.dll!RegOpenKeyExW 764F7BA1 5 Bytes JMP 0102002C .text C:\Windows\system32\svchost.exe[2632] WS2_32.dll!socket 765836D1 5 Bytes JMP 01040000 .text C:\Windows\System32\svchost.exe[2680] kernel32.dll!GetStartupInfoW 762E1929 1 Byte [E9] .text C:\Windows\System32\svchost.exe[2680] kernel32.dll!GetStartupInfoW 762E1929 5 Bytes JMP 00050F2D .text C:\Windows\System32\svchost.exe[2680] kernel32.dll!GetStartupInfoA 762E19C9 5 Bytes JMP 00050069 .text C:\Windows\System32\svchost.exe[2680] kernel32.dll!CreateProcessW 762E1BF3 1 Byte [E9] .text C:\Windows\System32\svchost.exe[2680] kernel32.dll!CreateProcessW 762E1BF3 5 Bytes JMP 00050EF7 .text C:\Windows\System32\svchost.exe[2680] kernel32.dll!CreateProcessA 762E1C28 5 Bytes JMP 00050F12 .text C:\Windows\System32\svchost.exe[2680] kernel32.dll!VirtualProtect 762E1DC3 5 Bytes JMP 00050F63 .text C:\Windows\System32\svchost.exe[2680] kernel32.dll!CreateNamedPipeA 762E2EF5 5 Bytes JMP 00050FCA .text C:\Windows\System32\svchost.exe[2680] kernel32.dll!CreateNamedPipeW 762E5C0C 5 Bytes JMP 0005001B .text C:\Windows\System32\svchost.exe[2680] kernel32.dll!CreatePipe 76308E6E 5 Bytes JMP 00050058 .text C:\Windows\System32\svchost.exe[2680] kernel32.dll!LoadLibraryExW 76309109 5 Bytes JMP 00050F8A .text C:\Windows\System32\svchost.exe[2680] kernel32.dll!LoadLibraryW 76309362 5 Bytes JMP 0005002C .text C:\Windows\System32\svchost.exe[2680] kernel32.dll!LoadLibraryExA 763094B4 5 Bytes JMP 0005003D .text C:\Windows\System32\svchost.exe[2680] kernel32.dll!LoadLibraryA 763094DC 5 Bytes JMP 00050FAF .text C:\Windows\System32\svchost.exe[2680] kernel32.dll!VirtualProtectEx 7630DBDA 5 Bytes JMP 00050F52 .text C:\Windows\System32\svchost.exe[2680] kernel32.dll!GetProcAddress 7632903B 5 Bytes JMP 000500A9 .text C:\Windows\System32\svchost.exe[2680] kernel32.dll!CreateFileW 7632AECB 5 Bytes JMP 00050000 .text C:\Windows\System32\svchost.exe[2680] kernel32.dll!CreateFileA 7632CE5F 5 Bytes JMP 00050FE5 .text C:\Windows\System32\svchost.exe[2680] kernel32.dll!WinExec 76375CF7 5 Bytes JMP 0005008E .text C:\Windows\System32\svchost.exe[2680] msvcrt.dll!_wsystem 76767F2F 5 Bytes JMP 00070042 .text C:\Windows\System32\svchost.exe[2680] msvcrt.dll!system 7676804B 5 Bytes JMP 00070027 .text C:\Windows\System32\svchost.exe[2680] msvcrt.dll!_creat 7676BBE1 5 Bytes JMP 00070FD2 .text C:\Windows\System32\svchost.exe[2680] msvcrt.dll!_open 7676D106 5 Bytes JMP 00070000 .text C:\Windows\System32\svchost.exe[2680] msvcrt.dll!_wcreat 7676D326 5 Bytes JMP 00070FB7 .text C:\Windows\System32\svchost.exe[2680] msvcrt.dll!_wopen 7676D501 5 Bytes JMP 00070FE3 .text C:\Windows\System32\svchost.exe[2680] ADVAPI32.dll!RegCreateKeyExA 764D39AB 5 Bytes JMP 00060F9E .text C:\Windows\System32\svchost.exe[2680] ADVAPI32.dll!RegCreateKeyA 764D3BA9 5 Bytes JMP 00060040 .text C:\Windows\System32\svchost.exe[2680] ADVAPI32.dll!RegOpenKeyA 764D89C7 5 Bytes JMP 00060000 .text C:\Windows\System32\svchost.exe[2680] ADVAPI32.dll!RegCreateKeyW 764E391E 5 Bytes JMP 00060FB9 .text C:\Windows\System32\svchost.exe[2680] ADVAPI32.dll!RegCreateKeyExW 764E41F1 5 Bytes JMP 00060F8D .text C:\Windows\System32\svchost.exe[2680] ADVAPI32.dll!RegOpenKeyExA 764E7C42 5 Bytes JMP 00060025 .text C:\Windows\System32\svchost.exe[2680] ADVAPI32.dll!RegOpenKeyW 764EE2B5 5 Bytes JMP 00060FE5 .text C:\Windows\System32\svchost.exe[2680] ADVAPI32.dll!RegOpenKeyExW 764F7BA1 5 Bytes JMP 00060FCA .text C:\Windows\Explorer.EXE[2836] kernel32.dll!GetStartupInfoW 762E1929 5 Bytes JMP 00010F4B .text C:\Windows\Explorer.EXE[2836] kernel32.dll!GetStartupInfoA 762E19C9 5 Bytes JMP 00010091 .text C:\Windows\Explorer.EXE[2836] kernel32.dll!CreateProcessW 762E1BF3 5 Bytes JMP 00010F26 .text C:\Windows\Explorer.EXE[2836] kernel32.dll!CreateProcessA 762E1C28 5 Bytes JMP 000100BD .text C:\Windows\Explorer.EXE[2836] kernel32.dll!VirtualProtect 762E1DC3 5 Bytes JMP 00010F6D .text C:\Windows\Explorer.EXE[2836] kernel32.dll!CreateNamedPipeA 762E2EF5 5 Bytes JMP 0001001B .text C:\Windows\Explorer.EXE[2836] kernel32.dll!CreateNamedPipeW 762E5C0C 5 Bytes JMP 0001002C .text C:\Windows\Explorer.EXE[2836] kernel32.dll!CreatePipe 76308E6E 5 Bytes JMP 0001006C .text C:\Windows\Explorer.EXE[2836] kernel32.dll!LoadLibraryExW 76309109 5 Bytes JMP 00010051 .text C:\Windows\Explorer.EXE[2836] kernel32.dll!LoadLibraryW 76309362 5 Bytes JMP 00010FAF .text C:\Windows\Explorer.EXE[2836] kernel32.dll!LoadLibraryExA 763094B4 5 Bytes JMP 00010F94 .text C:\Windows\Explorer.EXE[2836] kernel32.dll!LoadLibraryA 763094DC 5 Bytes JMP 00010FC0 .text C:\Windows\Explorer.EXE[2836] kernel32.dll!VirtualProtectEx 7630DBDA 5 Bytes JMP 00010F5C .text C:\Windows\Explorer.EXE[2836] kernel32.dll!GetProcAddress 7632903B 5 Bytes JMP 00010F0B .text C:\Windows\Explorer.EXE[2836] kernel32.dll!CreateFileW 7632AECB 5 Bytes JMP 00010FE5 .text C:\Windows\Explorer.EXE[2836] kernel32.dll!CreateFileA 7632CE5F 5 Bytes JMP 00010000 .text C:\Windows\Explorer.EXE[2836] kernel32.dll!WinExec 76375CF7 5 Bytes JMP 000100AC .text C:\Windows\Explorer.EXE[2836] ADVAPI32.dll!RegCreateKeyExA 764D39AB 5 Bytes JMP 0005006C .text C:\Windows\Explorer.EXE[2836] ADVAPI32.dll!RegCreateKeyA 764D3BA9 5 Bytes JMP 00050036 .text C:\Windows\Explorer.EXE[2836] ADVAPI32.dll!RegOpenKeyA 764D89C7 5 Bytes JMP 00050FE5 .text C:\Windows\Explorer.EXE[2836] ADVAPI32.dll!RegCreateKeyW 764E391E 5 Bytes JMP 0005005B .text C:\Windows\Explorer.EXE[2836] ADVAPI32.dll!RegCreateKeyExW 764E41F1 5 Bytes JMP 00050FA5 .text C:\Windows\Explorer.EXE[2836] ADVAPI32.dll!RegOpenKeyExA 764E7C42 5 Bytes JMP 00050011 .text C:\Windows\Explorer.EXE[2836] ADVAPI32.dll!RegOpenKeyW 764EE2B5 5 Bytes JMP 00050000 .text C:\Windows\Explorer.EXE[2836] ADVAPI32.dll!RegOpenKeyExW 764F7BA1 5 Bytes JMP 00050FCA .text C:\Windows\Explorer.EXE[2836] msvcrt.dll!_wsystem 76767F2F 5 Bytes JMP 00060F9C .text C:\Windows\Explorer.EXE[2836] msvcrt.dll!system 7676804B 5 Bytes JMP 00060FAD .text C:\Windows\Explorer.EXE[2836] msvcrt.dll!_creat 7676BBE1 5 Bytes JMP 00060FC8 .text C:\Windows\Explorer.EXE[2836] msvcrt.dll!_open 7676D106 5 Bytes JMP 00060000 .text C:\Windows\Explorer.EXE[2836] msvcrt.dll!_wcreat 7676D326 5 Bytes JMP 0006001D .text C:\Windows\Explorer.EXE[2836] msvcrt.dll!_wopen 7676D501 5 Bytes JMP 00060FE3 .text C:\Windows\Explorer.EXE[2836] SHELL32.dll!SHGetFolderPathAndSubDirW + 81C9 767FB364 4 Bytes [00, 26, 8D, 00] {ADD [ESI], AH; LEA EAX, [EAX]} .text C:\Windows\Explorer.EXE[2836] WS2_32.dll!socket 765836D1 5 Bytes JMP 0273000A .text C:\Windows\Explorer.EXE[2836] WININET.dll!InternetOpenA 7793D690 5 Bytes JMP 02C60000 .text C:\Windows\Explorer.EXE[2836] WININET.dll!InternetOpenW 7793DB09 5 Bytes JMP 02C60FE5 .text C:\Windows\Explorer.EXE[2836] WININET.dll!InternetOpenUrlA 7793F3A4 5 Bytes JMP 02C6001B .text C:\Windows\Explorer.EXE[2836] WININET.dll!InternetOpenUrlW 77986DDF 5 Bytes JMP 02C60036 .text C:\Program Files\Mozilla Firefox\firefox.exe[4304] ntdll.dll!LdrLoadDll 77A29390 5 Bytes JMP 009F13F0 C:\Program Files\Mozilla Firefox\firefox.exe (Firefox/Mozilla Corporation) .text C:\Windows\system32\wuauclt.exe[5956] kernel32.dll!GetStartupInfoW 762E1929 5 Bytes JMP 00010F29 .text C:\Windows\system32\wuauclt.exe[5956] kernel32.dll!GetStartupInfoA 762E19C9 5 Bytes JMP 00010F44 .text C:\Windows\system32\wuauclt.exe[5956] kernel32.dll!CreateProcessW 762E1BF3 5 Bytes JMP 000100AC .text C:\Windows\system32\wuauclt.exe[5956] kernel32.dll!CreateProcessA 762E1C28 5 Bytes JMP 0001009B .text C:\Windows\system32\wuauclt.exe[5956] kernel32.dll!VirtualProtect 762E1DC3 5 Bytes JMP 00010F81 .text C:\Windows\system32\wuauclt.exe[5956] kernel32.dll!CreateNamedPipeA 762E2EF5 5 Bytes JMP 0001001B .text C:\Windows\system32\wuauclt.exe[5956] kernel32.dll!CreateNamedPipeW 762E5C0C 5 Bytes JMP 00010FCA .text C:\Windows\system32\wuauclt.exe[5956] kernel32.dll!CreatePipe 76308E6E 5 Bytes JMP 00010F5F .text C:\Windows\system32\wuauclt.exe[5956] kernel32.dll!LoadLibraryExW 76309109 5 Bytes JMP 0001005B .text C:\Windows\system32\wuauclt.exe[5956] kernel32.dll!LoadLibraryW 76309362 5 Bytes JMP 00010040 .text C:\Windows\system32\wuauclt.exe[5956] kernel32.dll!LoadLibraryExA 763094B4 5 Bytes JMP 00010F9E .text C:\Windows\system32\wuauclt.exe[5956] kernel32.dll!LoadLibraryA 763094DC 5 Bytes JMP 00010FB9 .text C:\Windows\system32\wuauclt.exe[5956] kernel32.dll!VirtualProtectEx 7630DBDA 5 Bytes JMP 00010F70 .text C:\Windows\system32\wuauclt.exe[5956] kernel32.dll!GetProcAddress 7632903B 5 Bytes JMP 00010EFA .text C:\Windows\system32\wuauclt.exe[5956] kernel32.dll!CreateFileW 7632AECB 5 Bytes JMP 0001000A .text C:\Windows\system32\wuauclt.exe[5956] kernel32.dll!CreateFileA 7632CE5F 5 Bytes JMP 00010FE5 .text C:\Windows\system32\wuauclt.exe[5956] kernel32.dll!WinExec 76375CF7 5 Bytes JMP 0001008A .text C:\Windows\system32\wuauclt.exe[5956] msvcrt.dll!_wsystem 76767F2F 5 Bytes JMP 00060FBC .text C:\Windows\system32\wuauclt.exe[5956] msvcrt.dll!system 7676804B 5 Bytes JMP 0006003D .text C:\Windows\system32\wuauclt.exe[5956] msvcrt.dll!_creat 7676BBE1 5 Bytes JMP 00060FD7 .text C:\Windows\system32\wuauclt.exe[5956] msvcrt.dll!_open 7676D106 5 Bytes JMP 00060000 .text C:\Windows\system32\wuauclt.exe[5956] msvcrt.dll!_wcreat 7676D326 5 Bytes JMP 00060022 .text C:\Windows\system32\wuauclt.exe[5956] msvcrt.dll!_wopen 7676D501 5 Bytes JMP 00060011 .text C:\Windows\system32\wuauclt.exe[5956] ADVAPI32.dll!RegCreateKeyExA 764D39AB 5 Bytes JMP 00070F9E .text C:\Windows\system32\wuauclt.exe[5956] ADVAPI32.dll!RegCreateKeyA 764D3BA9 5 Bytes JMP 00070FB9 .text C:\Windows\system32\wuauclt.exe[5956] ADVAPI32.dll!RegOpenKeyA 764D89C7 5 Bytes JMP 00070FEF .text C:\Windows\system32\wuauclt.exe[5956] ADVAPI32.dll!RegCreateKeyW 764E391E 5 Bytes JMP 00070040 .text C:\Windows\system32\wuauclt.exe[5956] ADVAPI32.dll!RegCreateKeyExW 764E41F1 5 Bytes JMP 0007005B .text C:\Windows\system32\wuauclt.exe[5956] ADVAPI32.dll!RegOpenKeyExA 764E7C42 5 Bytes JMP 00070000 .text C:\Windows\system32\wuauclt.exe[5956] ADVAPI32.dll!RegOpenKeyW 764EE2B5 5 Bytes JMP 00070FD4 .text C:\Windows\system32\wuauclt.exe[5956] ADVAPI32.dll!RegOpenKeyExW 764F7BA1 5 Bytes JMP 0007001B ---- Devices - GMER 1.0.15 ---- AttachedDevice \FileSystem\Ntfs \Ntfs mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) AttachedDevice \Driver\tdx \Device\Tcp Mpfp.sys (McAfee Personal Firewall Plus Driver/McAfee, Inc.) AttachedDevice \Driver\tdx \Device\Udp Mpfp.sys (McAfee Personal Firewall Plus Driver/McAfee, Inc.) AttachedDevice \Driver\tdx \Device\RawIp Mpfp.sys (McAfee Personal Firewall Plus Driver/McAfee, Inc.) ---- Registry - GMER 1.0.15 ---- Reg HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Media Center\Service\Scheduler@Heartbeat 0x81 0x21 0xA5 0xC9 ... ---- EOF - GMER 1.0.15 ---- TL logfile created on: 4/28/2010 10:15:07 PM - Run 1 OTL by OldTimer - Version 3.2.3.0 Folder = C:\Users\Donald\Downloads Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation Internet Explorer (Version = 8.0.6001.18904) Locale: 00000409 \| Country: United States \| Language: ENU \| Date Format: M/d/yyyy 3.00 Gb Total Physical Memory \| 2.00 Gb Available Physical Memory \| 60.00% Memory free 6.00 Gb Paging File \| 5.00 Gb Available in Paging File \| 80.00% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: \| %SystemRoot% = C:\Windows \| %ProgramFiles% = C:\Program Files Drive C: \| 142.04 Gb Total Space \| 90.98 Gb Free Space \| 64.05% Space Free \| Partition Type: NTFS D: Drive not present or media not loaded E: Drive not present or media not loaded Drive F: \| 142.04 Gb Total Space \| 141.95 Gb Free Space \| 99.94% Space Free \| Partition Type: NTFS G: Drive not present or media not loaded H: Drive not present or media not loaded I: Drive not present or media not loaded Computer Name: DONALD-PC Current User Name: Donald Logged in as Administrator. Current Boot Mode: Normal Scan Mode: Current user Company Name Whitelist: Off Skip Microsoft Files: Off File Age = 30 Days Output = Standard ========== Processes (SafeList) ========== PRC - [2010/04/28 22:10:22 \| 000,563,712 \| ---- \| M] (OldTimer Tools) -- C:\Users\Donald\Downloads\OTL.exe PRC - [2010/04/05 00:10:16 \| 000,910,296 \| ---- \| M] (Mozilla Corporation) -- C:\Program Files\Mozilla Firefox\firefox.exe PRC - [2009/12/08 15:25:28 \| 000,093,320 \| ---- \| M] (McAfee, Inc.) -- C:\Program Files\McAfee\SiteAdvisor\McSACore.exe PRC - [2009/11/28 09:57:48 \| 002,381,120 \| ---- \| M] () -- C:\Program Files\Hide The IP 2010\AVRedirector.exe PRC - [2009/10/29 07:54:44 \| 001,218,008 \| ---- \| M] (McAfee, Inc.) -- c:\Program Files\McAfee.com\Agent\mcagent.exe PRC - [2009/10/27 12:19:46 \| 000,895,696 \| ---- \| M] (McAfee, Inc.) -- C:\Program Files\McAfee\MPF\MpfSrv.exe PRC - [2009/09/26 19:18:01 \| 000,068,856 \| ---- \| M] (Google Inc.) -- C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe PRC - [2009/09/16 10:22:08 \| 000,144,704 \| ---- \| M] (McAfee, Inc.) -- C:\Program Files\McAfee\VirusScan\Mcshield.exe PRC - [2009/09/16 09:28:38 \| 000,606,736 \| ---- \| M] (McAfee, Inc.) -- C:\Program Files\McAfee\VirusScan\mcsysmon.exe PRC - [2009/07/10 00:26:20 \| 000,865,832 \| ---- \| M] (McAfee, Inc.) -- C:\Program Files\McAfee\MSC\mcmscsvc.exe PRC - [2009/07/08 14:48:48 \| 000,026,640 \| ---- \| M] (McAfee, Inc.) -- C:\Program Files\McAfee\MSK\msksrver.exe PRC - [2009/07/08 11:54:34 \| 000,359,952 \| ---- \| M] (McAfee, Inc.) -- c:\Program Files\Common Files\McAfee\McProxy\McProxy.exe PRC - [2009/07/07 19:10:02 \| 002,482,848 \| ---- \| M] (McAfee, Inc.) -- c:\Program Files\Common Files\McAfee\MNA\McNASvc.exe PRC - [2009/04/10 23:27:36 \| 002,926,592 \| ---- \| M] (Microsoft Corporation) -- C:\Windows\explorer.exe PRC - [2008/11/09 13:48:14 \| 000,602,392 \| ---- \| M] (Yahoo! Inc.) -- C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe PRC - [2008/10/01 12:44:00 \| 000,323,584 \| ---- \| M] () -- C:\Program Files\Acer\Empowering Technology\Framework.Launcher.exe PRC - [2008/10/01 12:44:00 \| 000,319,488 \| ---- \| M] () -- C:\Program Files\Acer\Empowering Technology\SysMonitor.exe PRC - [2008/10/01 12:43:56 \| 000,024,576 \| ---- \| M] () -- C:\Program Files\Acer\Empowering Technology\Service\ETService.exe PRC - [2008/09/23 15:11:34 \| 000,144,632 \| ---- \| M] (NewTech Infosystems, Inc.) -- C:\Program Files\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe PRC - [2008/07/29 18:53:00 \| 000,500,784 \| ---- \| M] (Egis Incorporated) -- C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\eDSService.exe PRC - [2008/07/29 18:52:50 \| 000,526,896 \| ---- \| M] (Egis Incorporated) -- C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\eDSLoader.exe PRC - [2008/05/20 18:50:50 \| 000,269,448 \| ---- \| M] (CyberLink) -- C:\Program Files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\CLMSServer.exe PRC - [2008/03/25 22:21:30 \| 005,369,856 \| ---- \| M] (Realtek Semiconductor) -- C:\Windows\RtHDVCpl.exe PRC - [2008/01/29 13:25:10 \| 000,598,016 \| ---- \| M] () -- C:\Program Files\bin32\nSvcAppFlt.exe PRC - [2008/01/29 13:24:46 \| 000,163,840 \| ---- \| M] () -- C:\Program Files\bin32\nSvcIp.exe PRC - [2008/01/20 19:23:32 \| 001,008,184 \| ---- \| M] (Microsoft Corporation) -- C:\Program Files\Windows Defender\MSASCui.exe PRC - [2007/12/10 20:15:04 \| 000,012,800 \| ---- \| M] (Agere Systems) -- C:\Windows\System32\agrsmsvc.exe ========== Modules (SafeList) ========== MOD - [2010/04/28 22:10:22 \| 000,563,712 \| ---- \| M] (OldTimer Tools) -- C:\Users\Donald\Downloads\OTL.exe MOD - [2009/12/08 14:12:24 \| 000,014,544 \| ---- \| M] (McAfee, Inc.) -- c:\Program Files\McAfee\SiteAdvisor\sahook.dll MOD - [2009/04/10 23:21:38 \| 001,686,016 \| ---- \| M] (Microsoft Corporation) -- C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6002.18005_none_5cb72f96088b0de0\comctl32.dll ========== Win32 Services (SafeList) ========== SRV - [2009/12/08 15:25:28 \| 000,093,320 \| ---- \| M] (McAfee, Inc.) [Auto \| Running] -- C:\Program Files\McAfee\SiteAdvisor\McSACore.exe -- (McAfee SiteAdvisor Service) SRV - [2009/11/28 09:57:48 \| 002,381,120 \| ---- \| M] () [Auto \| Running] -- C:\Program Files\Hide The IP 2010\AVRedirector.exe -- (AVRedirector) SRV - [2009/10/27 12:19:46 \| 000,895,696 \| ---- \| M] (McAfee, Inc.) [Auto \| Running] -- C:\Program Files\McAfee\MPF\MPFSrv.exe -- (MpfService) SRV - [2009/09/24 18:27:04 \| 000,793,088 \| ---- \| M] (Microsoft Corporation) [On_Demand \| Stopped] -- C:\Windows\System32\FntCache.dll -- (FontCache) SRV - [2009/09/16 11:23:32 \| 000,365,072 \| ---- \| M] (McAfee, Inc.) [On_Demand \| Stopped] -- C:\Program Files\McAfee\VirusScan\mcods.exe -- (McODS) SRV - [2009/09/16 10:22:08 \| 000,144,704 \| ---- \| M] (McAfee, Inc.) [Unknown \| Running] -- C:\Program Files\McAfee\VirusScan\Mcshield.exe -- (McShield) SRV - [2009/09/16 09:28:38 \| 000,606,736 \| ---- \| M] (McAfee, Inc.) [On_Demand \| Running] -- C:\Program Files\McAfee\VirusScan\mcsysmon.exe -- (McSysmon) SRV - [2009/07/10 00:26:20 \| 000,865,832 \| ---- \| M] (McAfee, Inc.) [Auto \| Running] -- C:\Program Files\McAfee\MSC\mcmscsvc.exe -- (mcmscsvc) SRV - [2009/07/08 14:48:48 \| 000,026,640 \| ---- \| M] (McAfee, Inc.) [Auto \| Running] -- C:\Program Files\McAfee\MSK\MskSrver.exe -- (MSK80Service) SRV - [2009/07/08 11:54:34 \| 000,359,952 \| ---- \| M] (McAfee, Inc.) [Auto \| Running] -- c:\Program Files\Common Files\McAfee\McProxy\McProxy.exe -- (McProxy) SRV - [2009/07/07 19:10:02 \| 002,482,848 \| ---- \| M] (McAfee, Inc.) [Auto \| Running] -- c:\Program Files\Common Files\McAfee\MNA\McNASvc.exe -- (McNASvc) SRV - [2008/11/09 13:48:14 \| 000,602,392 \| ---- \| M] (Yahoo! Inc.) [Auto \| Running] -- C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe -- (YahooAUService) SRV - [2008/10/01 12:43:56 \| 000,024,576 \| ---- \| M] () [Auto \| Running] -- C:\Program Files\Acer\Empowering Technology\Service\ETService.exe -- (ETService) SRV - [2008/09/23 15:11:34 \| 000,144,632 \| ---- \| M] (NewTech Infosystems, Inc.) [Auto \| Running] -- C:\Program Files\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe -- (NTISchedulerSvc) SRV - [2008/09/23 15:11:32 \| 000,050,424 \| ---- \| M] (NewTech InfoSystems, Inc.) [On_Demand \| Stopped] -- C:\Program Files\NewTech Infosystems\NTI Backup Now 5\BackupSvc.exe -- (NTIBackupSvc) SRV - [2008/07/29 18:53:00 \| 000,500,784 \| ---- \| M] (Egis Incorporated) [Auto \| Running] -- C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\eDSService.exe -- (eDataSecurity Service) SRV - [2008/05/20 18:50:50 \| 000,269,448 \| ---- \| M] (CyberLink) [Auto \| Running] -- C:\Program Files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\CLMSServer.exe -- (Acer HomeMedia Connect Service) SRV - [2008/01/29 13:25:10 \| 000,598,016 \| ---- \| M] () [Auto \| Running] -- C:\Program Files\bin32\nSvcAppFlt.exe -- (ForceWare Intelligent Application Manager (IAM)) ForceWare Intelligent Application Manager (IAM) SRV - [2008/01/29 13:24:46 \| 000,163,840 \| ---- \| M] () [Auto \| Running] -- C:\Program Files\bin32\nSvcIp.exe -- (nSvcIp) SRV - [2008/01/20 19:23:32 \| 000,272,952 \| ---- \| M] (Microsoft Corporation) [Auto \| Running] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend) SRV - [2007/12/10 20:15:04 \| 000,012,800 \| ---- \| M] (Agere Systems) [Auto \| Running] -- C:\Windows\System32\agrsmsvc.exe -- (AgereModemAudio) ========== Driver Services (SafeList) ========== DRV - [2009/09/16 10:22:48 \| 000,214,664 \| ---- \| M] (McAfee, Inc.) [Kernel \| System \| Running] -- C:\Windows\System32\drivers\mfehidk.sys -- (mfehidk) DRV - [2009/09/16 10:22:48 \| 000,079,816 \| ---- \| M] (McAfee, Inc.) [Kernel \| On_Demand \| Running] -- C:\Windows\System32\drivers\mfeavfk.sys -- (mfeavfk) DRV - [2009/09/16 10:22:48 \| 000,040,552 \| ---- \| M] (McAfee, Inc.) [Kernel \| On_Demand \| Running] -- C:\Windows\System32\drivers\mfesmfk.sys -- (mfesmfk) DRV - [2009/09/16 10:22:48 \| 000,035,272 \| ---- \| M] (McAfee, Inc.) [Kernel \| On_Demand \| Running] -- C:\Windows\System32\drivers\mfebopk.sys -- (mfebopk) DRV - [2009/09/16 10:22:14 \| 000,034,248 \| ---- \| M] (McAfee, Inc.) [Kernel \| On_Demand \| Stopped] -- C:\Windows\System32\drivers\mferkdk.sys -- (mferkdk) DRV - [2009/07/16 12:32:26 \| 000,130,424 \| ---- \| M] (McAfee, Inc.) [Kernel \| System \| Running] -- C:\Windows\System32\drivers\Mpfp.sys -- (MPFP) DRV - [2009/05/09 01:14:20 \| 000,014,736 \| ---- \| M] (Microsoft Corporation) [Kernel \| On_Demand \| Running] -- C:\Windows\System32\drivers\nuidfltr.sys -- (NuidFltr) DRV - [2008/12/08 10:57:00 \| 007,391,712 \| ---- \| M] (NVIDIA Corporation) [Kernel \| On_Demand \| Running] -- C:\Windows\System32\drivers\nvlddmkm.sys -- (nvlddmkm) DRV - [2008/10/01 11:04:16 \| 000,012,832 \| ---- \| M] (Acer, Inc.) [Kernel \| Auto \| Running] -- C:\Windows\System32\drivers\int15.sys -- (int15) DRV - [2008/07/29 18:53:12 \| 000,060,464 \| ---- \| M] (Egis Incorporated) [Kernel \| Auto \| Running] -- C:\Windows\System32\drivers\PSDVdisk.sys -- (psdvdisk) DRV - [2008/07/29 18:53:10 \| 000,018,992 \| ---- \| M] (Egis Incorporated) [File_System \| Boot \| Running] -- C:\Windows\system32\DRIVERS\psdfilter.sys -- (PSDFilter) DRV - [2008/07/29 18:53:10 \| 000,016,944 \| ---- \| M] (Egis Incorporated) [Kernel \| Auto \| Running] -- C:\Windows\System32\drivers\PSDNServ.sys -- (PSDNServ) DRV - [2008/03/26 03:35:54 \| 002,103,512 \| ---- \| M] (Realtek Semiconductor Corp.) [Kernel \| On_Demand \| Running] -- C:\Windows\System32\drivers\RTKVHDA.sys -- (IntcAzAudAddService) Service for Realtek HD Audio (WDM) DRV - [2008/03/22 08:18:44 \| 000,043,552 \| ---- \| M] (NVIDIA Corporation) [Kernel \| On_Demand \| Running] -- C:\Windows\System32\drivers\nvhda32v.sys -- (NVHDA) DRV - [2008/03/04 22:10:54 \| 001,203,808 \| ---- \| M] (Agere Systems) [Kernel \| On_Demand \| Running] -- C:\Windows\System32\drivers\AGRSM.sys -- (AgereSoftModem) DRV - [2008/01/30 02:52:06 \| 000,014,848 \| ---- \| M] (NewTech Infosystems, Inc.) [Kernel \| On_Demand \| Running] -- C:\Windows\System32\drivers\NTIDrvr.sys -- (NTIDrvr) DRV - [2008/01/30 02:51:50 \| 000,013,824 \| ---- \| M] (NewTech Infosystems Corporation) [Kernel \| Boot \| Running] -- C:\Windows\System32\drivers\UBHelper.sys -- (UBHelper) DRV - [2008/01/28 22:55:00 \| 001,042,464 \| ---- \| M] (NVIDIA Corporation) [Kernel \| On_Demand \| Running] -- C:\Windows\System32\drivers\nvmfdx32.sys -- (NVENETFD) DRV - [2008/01/25 05:02:02 \| 000,140,832 \| ---- \| M] (NVIDIA Corporation) [Kernel \| Boot \| Running] -- C:\Windows\system32\DRIVERS\nvstor32.sys -- (nvstor32) DRV - [2008/01/20 19:23:27 \| 000,386,616 \| ---- \| M] (LSI Corporation, Inc.) [Kernel \| Disabled \| Stopped] -- C:\Windows\system32\drivers\megasr.sys -- (MegaSR) DRV - [2008/01/20 19:23:27 \| 000,149,560 \| ---- \| M] (Adaptec, Inc.) [Kernel \| Disabled \| Stopped] -- C:\Windows\system32\drivers\adpu320.sys -- (adpu320) DRV - [2008/01/20 19:23:27 \| 000,031,288 \| ---- \| M] (LSI Corporation) [Kernel \| Disabled \| Stopped] -- C:\Windows\system32\drivers\megasas.sys -- (megasas) DRV - [2008/01/20 19:23:26 \| 000,101,432 \| ---- \| M] (Adaptec, Inc.) [Kernel \| Disabled \| Stopped] -- C:\Windows\system32\drivers\adpu160m.sys -- (adpu160m) DRV - [2008/01/20 19:23:26 \| 000,074,808 \| ---- \| M] (Silicon Integrated Systems) [Kernel \| Disabled \| Stopped] -- C:\Windows\system32\drivers\sisraid4.sys -- (SiSRaid4) DRV - [2008/01/20 19:23:26 \| 000,040,504 \| ---- \| M] (Hewlett-Packard Company) [Kernel \| Disabled \| Stopped] -- C:\Windows\system32\drivers\hpcisss.sys -- (HpCISSs) DRV - [2008/01/20 19:23:25 \| 000,300,600 \| ---- \| M] (Adaptec, Inc.) [Kernel \| Disabled \| Stopped] -- C:\Windows\system32\drivers\adpahci.sys -- (adpahci) DRV - [2008/01/20 19:23:25 \| 000,089,656 \| ---- \| M] (LSI Logic) [Kernel \| Disabled \| Stopped] -- C:\Windows\system32\drivers\lsi_sas.sys -- (LSI_SAS) DRV - [2008/01/20 19:23:24 \| 001,122,360 \| ---- \| M] (QLogic Corporation) [Kernel \| Disabled \| Stopped] -- C:\Windows\system32\drivers\ql2300.sys -- (ql2300) DRV - [2008/01/20 19:23:24 \| 000,118,784 \| ---- \| M] (Intel Corporation) [Kernel \| On_Demand \| Stopped] -- C:\Windows\System32\drivers\E1G60I32.sys -- (E1G60) Intel® DRV - [2008/01/20 19:23:24 \| 000,079,928 \| ---- \| M] (Adaptec, Inc.) [Kernel \| Disabled \| Stopped] -- C:\Windows\system32\drivers\arcsas.sys -- (arcsas) DRV - [2008/01/20 19:23:23 \| 000,235,064 \| ---- \| M] (Intel Corporation) [Kernel \| Disabled \| Stopped] -- C:\Windows\system32\drivers\iastorv.sys -- (iaStorV) DRV - [2008/01/20 19:23:23 \| 000,130,616 \| ---- \| M] (VIA Technologies Inc.,Ltd) [Kernel \| Disabled \| Stopped] -- C:\Windows\system32\drivers\vsmraid.sys -- (vsmraid) DRV - [2008/01/20 19:23:23 \| 000,115,816 \| ---- \| M] (Promise Technology, Inc.) [Kernel \| Disabled \| Stopped] -- C:\Windows\system32\drivers\ulsata2.sys -- (ulsata2) DRV - [2008/01/20 19:23:23 \| 000,096,312 \| ---- \| M] (LSI Logic) [Kernel \| Disabled \| Stopped] -- C:\Windows\system32\drivers\lsi_scsi.sys -- (LSI_SCSI) DRV - [2008/01/20 19:23:23 \| 000,096,312 \| ---- \| M] (LSI Logic) [Kernel \| Disabled \| Stopped] -- C:\Windows\system32\drivers\lsi_fc.sys -- (LSI_FC) DRV - [2008/01/20 19:23:23 \| 000,079,416 \| ---- \| M] (Adaptec, Inc.) [Kernel \| Disabled \| Stopped] -- C:\Windows\system32\drivers\arc.sys -- (arc) DRV - [2008/01/20 19:23:22 \| 000,342,584 \| ---- \| M] (Emulex) [Kernel \| Disabled \| Stopped] -- C:\Windows\system32\drivers\elxstor.sys -- (elxstor) DRV - [2008/01/20 19:23:21 \| 000,422,968 \| ---- \| M] (Adaptec, Inc.) [Kernel \| Disabled \| Stopped] -- C:\Windows\system32\drivers\adp94xx.sys -- (adp94xx) DRV - [2008/01/20 19:23:21 \| 000,102,968 \| ---- \| M] (NVIDIA Corporation) [Kernel \| Disabled \| Stopped] -- C:\Windows\system32\drivers\nvraid.sys -- (nvraid) DRV - [2008/01/20 19:23:21 \| 000,045,112 \| ---- \| M] (NVIDIA Corporation) [Kernel \| Disabled \| Stopped] -- C:\Windows\system32\drivers\nvstor.sys -- (nvstor) DRV - [2008/01/20 19:23:20 \| 000,238,648 \| ---- \| M] (ULi Electronics Inc.) [Kernel \| Disabled \| Stopped] -- C:\Windows\system32\drivers\uliahci.sys -- (uliahci) DRV - [2008/01/20 19:23:00 \| 000,020,024 \| ---- \| M] (VIA Technologies, Inc.) [Kernel \| Disabled \| Stopped] -- C:\Windows\system32\drivers\viaide.sys -- (viaide) DRV - [2008/01/20 19:23:00 \| 000,019,000 \| ---- \| M] (CMD Technology, Inc.) [Kernel \| Disabled \| Stopped] -- C:\Windows\system32\drivers\cmdide.sys -- (cmdide) DRV - [2008/01/20 19:23:00 \| 000,017,464 \| ---- \| M] (Acer Laboratories Inc.) [Kernel \| Disabled \| Stopped] -- C:\Windows\system32\drivers\aliide.sys -- (aliide) DRV - [2007/10/12 01:53:10 \| 000,013,312 \| ---- \| M] (NVIDIA Corporation) [Kernel \| On_Demand \| Running] -- C:\Windows\System32\drivers\nvsmu.sys -- (nvsmu) DRV - [2006/11/02 02:50:35 \| 000,106,088 \| ---- \| M] (QLogic Corporation) [Kernel \| Disabled \| Stopped] -- C:\Windows\system32\drivers\ql40xx.sys -- (ql40xx) DRV - [2006/11/02 02:50:35 \| 000,098,408 \| ---- \| M] (Promise Technology, Inc.) [Kernel \| Disabled \| Stopped] -- C:\Windows\system32\drivers\ulsata.sys -- (UlSata) DRV - [2006/11/02 02:50:19 \| 000,045,160 \| ---- \| M] (IBM Corporation) [Kernel \| Disabled \| Stopped] -- C:\Windows\system32\drivers\nfrd960.sys -- (nfrd960) DRV - [2006/11/02 02:50:17 \| 000,041,576 \| ---- \| M] (Intel Corp./ICP vortex GmbH) [Kernel \| Disabled \| Stopped] -- C:\Windows\system32\drivers\iirsp.sys -- (iirsp) DRV - [2006/11/02 02:50:11 \| 000,071,272 \| ---- \| M] (Adaptec, Inc.) [Kernel \| Disabled \| Stopped] -- C:\Windows\system32\drivers\djsvs.sys -- (aic78xx) DRV - [2006/11/02 02:50:09 \| 000,035,944 \| ---- \| M] (Integrated Technology Express, Inc.) [Kernel \| Disabled \| Stopped] -- C:\Windows\system32\drivers\iteraid.sys -- (iteraid) DRV - [2006/11/02 02:50:07 \| 000,035,944 \| ---- \| M] (Integrated Technology Express, Inc.) [Kernel \| Disabled \| Stopped] -- C:\Windows\system32\drivers\iteatapi.sys -- (iteatapi) DRV - [2006/11/02 02:50:05 \| 000,035,944 \| ---- \| M] (LSI Logic) [Kernel \| Disabled \| Stopped] -- C:\Windows\system32\drivers\symc8xx.sys -- (Symc8xx) DRV - [2006/11/02 02:50:03 \| 000,034,920 \| ---- \| M] (LSI Logic) [Kernel \| Disabled \| Stopped] -- C:\Windows\system32\drivers\sym_u3.sys -- (Sym_u3) DRV - [2006/11/02 02:49:59 \| 000,033,384 \| ---- \| M] (LSI Logic Corporation) [Kernel \| Disabled \| Stopped] -- C:\Windows\system32\drivers\mraid35x.sys -- (Mraid35x) DRV - [2006/11/02 02:49:56 \| 000,031,848 \| ---- \| M] (LSI Logic) [Kernel \| Disabled \| Stopped] -- C:\Windows\system32\drivers\sym_hi.sys -- (Sym_hi) DRV - [2006/11/02 01:25:24 \| 000,071,808 \| ---- \| M] (Brother Industries Ltd.) [Kernel \| Disabled \| Stopped] -- C:\Windows\system32\drivers\brserid.sys -- (Brserid) Brother MFC Serial Port Interface Driver (WDM) DRV - [2006/11/02 01:24:47 \| 000,011,904 \| ---- \| M] (Brother Industries Ltd.) [Kernel \| On_Demand \| Stopped] -- C:\Windows\system32\drivers\brusbser.sys -- (BrUsbSer) DRV - [2006/11/02 01:24:46 \| 000,005,248 \| ---- \| M] (Brother Industries, Ltd.) [Kernel \| On_Demand \| Stopped] -- C:\Windows\system32\drivers\brfiltup.sys -- (BrFiltUp) DRV - [2006/11/02 01:24:45 \| 000,013,568 \| ---- \| M] (Brother Industries, Ltd.) [Kernel \| On_Demand \| Stopped] -- C:\Windows\system32\drivers\brfiltlo.sys -- (BrFiltLo) DRV - [2006/11/02 01:24:44 \| 000,062,336 \| ---- \| M] (Brother Industries Ltd.) [Kernel \| Disabled \| Stopped] -- C:\Windows\system32\drivers\brserwdm.sys -- (BrSerWdm) DRV - [2006/11/02 01:24:44 \| 000,012,160 \| ---- \| M] (Brother Industries Ltd.) [Kernel \| Disabled \| Stopped] -- C:\Windows\system32\drivers\brusbmdm.sys -- (BrUsbMdm) DRV - [2006/11/02 00:36:50 \| 000,020,608 \| ---- \| M] (N-trig Innovative Technologies) [Kernel \| Disabled \| Stopped] -- C:\Windows\system32\drivers\ntrigdigi.sys -- (ntrigdigi) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://homepage.acer.com/rdr.aspx?b=ACAW&a...;m=aspire_x1300 IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://homepage.acer.com/rdr.aspx?b=ACAW&a...;m=aspire_x1300 IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.google.com IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchDefaultBranded = 1 IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Secondary Start Pages = http://www.acer.com/worldwide/selection.html [binary data] IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com/ IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = http= ========== FireFox ========== FF - prefs.js..browser.startup.homepage: "http://www.google.com/\|http://www.acer.com/worldwide/selection.html" FF - prefs.js..extensions.enabledItems: {B7082FAA-CB62-4872-9106-E42DD88EDE45}:3.0 FF - prefs.js..extensions.enabledItems: support@auto-hide-ip.com:1.0 FF - prefs.js..network.proxy.no_proxies_on: ".local" FF - prefs.js..network.proxy.share_proxy_settings: true FF - HKLM\software\mozilla\Firefox\Extensions\\{B7082FAA-CB62-4872-9106-E42DD88EDE45}: C:\Program Files\McAfee\SiteAdvisor [2010/04/21 13:51:06 \| 000,000,000 \| ---D \| M] FF - HKLM\software\mozilla\Mozilla Firefox 3.6.3\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010/04/05 00:10:23 \| 000,000,000 \| ---D \| M] FF - HKLM\software\mozilla\Mozilla Firefox 3.6.3\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010/04/05 00:10:23 \| 000,000,000 \| ---D \| M] [2010/01/24 14:13:58 \| 000,000,000 \| ---D \| M] -- C:\Users\Donald\AppData\Roaming\Mozilla\Extensions [2010/04/28 21:35:02 \| 000,000,000 \| ---D \| M] -- C:\Users\Donald\AppData\Roaming\Mozilla\Firefox\Profiles\vigv4rv2.default\extensions [2010/03/08 10:26:34 \| 000,000,000 \| ---D \| M] (Microsoft .NET Framework Assistant) -- C:\Users\Donald\AppData\Roaming\Mozilla\Firefox\Profiles\vigv4rv2.default\extensions\{20a82645-c095-46ed-80e3-08825760534b} [2010/04/17 01:08:09 \| 000,000,000 \| ---D \| M] -- C:\Users\Donald\AppData\Roaming\Mozilla\Firefox\Profiles\vigv4rv2.default\extensions\support@auto-hide-ip.com [2010/04/04 21:38:37 \| 000,000,000 \| ---D \| M] -- C:\Program Files\Mozilla Firefox\extensions O1 HOSTS File: ([2006/09/18 14:41:30 \| 000,000,761 \| ---- \| M]) - C:\Windows\System32\drivers\etc\hosts O1 - Hosts: 127.0.0.1 localhost O1 - Hosts: ::1 localhost O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - No CLSID value found. O2 - BHO: (McAfee Phishing Filter) - {27B4851A-3207-45A2-B947-BE8AFE6163AB} - c:\Program Files\McAfee\MSK\mskapbho.dll () O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found. O2 - BHO: (scriptproxy) - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\McAfee\VirusScan\scriptsn.dll (McAfee, Inc.) O2 - BHO: (ShowBarObj Class) - {83A2F9B1-01A2-4AA5-87D1-45B6B8505E96} - C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\ActiveToolBand.dll (Egis) O2 - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.) O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.5.4723.1820\swg.dll (Google Inc.) O2 - BHO: (McAfee SiteAdvisor BHO) - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - c:\Program Files\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.) O2 - BHO: (Java™ Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll File not found O3 - HKLM\..\Toolbar: (McAfee SiteAdvisor Toolbar) - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\Program Files\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.) O3 - HKLM\..\Toolbar: (Google Toolbar) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.) O3 - HKLM\..\Toolbar: (Acer eDataSecurity Management) - {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\eDStoolbar.dll (Egis Incorporated.) O3 - HKLM\..\Toolbar: (no name) - {D4027C7F-154A-4066-A1AD-4243D8127440} - No CLSID value found. O3 - HKCU\..\Toolbar\ShellBrowser: (Acer eDataSecurity Management) - {5CBE3B7C-1E47-477E-A7DD-396DB0476E29} - C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\eDStoolbar.dll (Egis Incorporated.) O3 - HKCU\..\Toolbar\WebBrowser: (Google Toolbar) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.) O4 - HKLM..\Run: [Acer Assist Launcher] C:\Program Files\Acer\Acer Assist\launcher.exe () O4 - HKLM..\Run: [Acer Empowering Technology Monitor] C:\Program Files\Acer\Empowering Technology\SysMonitor.exe () O4 - HKLM..\Run: [Acer Product Registration] C:\Program Files\Acer\Acer Registration\ACE1.exe (Leader Technologies) O4 - HKLM..\Run: [eDataSecurity Loader] C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\eDSLoader.exe (Egis Incorporated) O4 - HKLM..\Run: [EmpoweringTechnology] C:\Program Files\Acer\Empowering Technology\Framework.Lau File not found O4 - HKLM..\Run: [eRecoveryService] File not found O4 - HKLM..\Run: [mcagent_exe] C:\Program Files\McAfee.com\Agent\mcagent.exe (McAfee, Inc.) O4 - HKLM..\Run: [NvCplDaemon] C:\Windows\System32\NvCpl.DLL (NVIDIA Corporation) O4 - HKLM..\Run: [PCMMediaSharing] C:\Program Files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\PCMMediaSharing.exe () O4 - HKLM..\Run: [RtHDVCpl] C:\Windows\RtHDVCpl.exe (Realtek Semiconductor) O4 - HKLM..\Run: [Skytel] C:\Windows\SkyTel.exe (Realtek Semiconductor Corp.) O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation) O4 - HKLM..\Run: [WPCUMI] C:\Windows\System32\wpcumi.exe (Microsoft Corporation) O4 - HKCU..\Run: [BitComet] C:\Program Files\BitComet\BitComet.exe File not found O4 - HKCU..\Run: [Hide-The-IP] C:\Program Files\Hide The IP 2010\HideTheIP.exe (AVSoftware) O4 - HKCU..\Run: [Messenger (Yahoo!)] C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe (Yahoo! Inc.) O4 - HKCU..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (Google Inc.) O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoLowDiskSpaceChecks = 1 O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: LogonHoursAction = 2 O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DontDisplayLogonHoursWarnings = 1 O9 - Extra Button: Blog This - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll (Microsoft Corporation) O9 - Extra 'Tools' menuitem : &Blog This in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll (Microsoft Corporation) O9 - Extra Button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation) O9 - Extra 'Tools' menuitem : S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation) O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Program Files\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation) O10 - NameSpace_Catalog5\Catalog_Entries00000000007 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.) O10 - Protocol_Catalog9\Catalog_Entries00000000001 - C:\Windows\System32\AVLibrary.dll () O10 - Protocol_Catalog9\Catalog_Entries00000000002 - C:\Windows\System32\AVLibrary.dll () O10 - Protocol_Catalog9\Catalog_Entries00000000003 - C:\Windows\System32\AVLibrary.dll () O10 - Protocol_Catalog9\Catalog_Entries00000000004 - C:\Windows\System32\AVLibrary.dll () O10 - Protocol_Catalog9\Catalog_Entries00000000015 - C:\Windows\System32\AVLibrary.dll () O13 - gopher Prefix: missing O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} http://download.microsoft.com/download/C/0...heckControl.cab (Windows Genuine Advantage Validation Tool) O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab (Java Plug-in 1.6.0_19) O16 - DPF: {CAFEEFAC-0016-0000-0019-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab (Java Plug-in 1.6.0_19) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab (Java Plug-in 1.6.0_19) O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 209.18.47.61 209.18.47.62 O18 - Protocol\Handler\dssrequest {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\Program Files\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.) O18 - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\Windows Live\Messenger\msgrapp.14.0.8050.1202.dll (Microsoft Corporation) O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Program Files\Common Files\microsoft shared\Help\hxds.dll (Microsoft Corporation) O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\Windows Live\Messenger\msgrapp.14.0.8050.1202.dll (Microsoft Corporation) O18 - Protocol\Handler\sacore {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\Program Files\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.) O18 - Protocol\Handler\wlmailhtml {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - C:\Program Files\Windows Live\Mail\mailcomm.dll (Microsoft Corporation) O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\microsoft shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation) O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation) O24 - Desktop WallPaper: C:\Users\Donald\AppData\Roaming\Microsoft\Windows Photo Gallery\Windows Photo Gallery Wallpaper.jpg O24 - Desktop BackupWallPaper: C:\Users\Donald\AppData\Roaming\Microsoft\Windows Photo Gallery\Windows Photo Gallery Wallpaper.jpg O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2006/09/18 14:43:36 \| 000,000,024 \| ---- \| M] () - C:\autoexec.bat -- [ NTFS ] O34 - HKLM BootExecute: (autocheck autochk ) - File not found O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* NetSvcs: FastUserSwitchingCompatibility - File not found NetSvcs: Ias - C:\Windows\System32\ias [2008/01/20 19:34:27 \| 000,000,000 \| ---D \| M] NetSvcs: Nla - File not found NetSvcs: Ntmssvc - File not found NetSvcs: NWCWorkstation - File not found NetSvcs: Nwsapagent - File not found NetSvcs: SRService - File not found NetSvcs: Wmi - C:\Windows\System32\wmi.dll (Microsoft Corporation) NetSvcs: WmdmPmSp - File not found NetSvcs: LogonHours - File not found NetSvcs: PCAudit - File not found NetSvcs: helpsvc - File not found NetSvcs: uploadmgr - File not found SafeBootMin: AppMgmt - Service SafeBootMin: Base - Driver Group SafeBootMin: Boot Bus Extender - Driver Group SafeBootMin: Boot file system - Driver Group SafeBootMin: File system - Driver Group SafeBootMin: Filter - Driver Group SafeBootMin: HelpSvc - Service SafeBootMin: mcmscsvc - C:\Program Files\McAfee\MSC\mcmscsvc.exe (McAfee, Inc.) SafeBootMin: MCODS - C:\Program Files\McAfee\VirusScan\mcods.exe (McAfee, Inc.) SafeBootMin: NTDS - File not found SafeBootMin: PCI Configuration - Driver Group SafeBootMin: PNP Filter - Driver Group SafeBootMin: Primary disk - Driver Group SafeBootMin: sacsvr - Service SafeBootMin: SCSI Class - Driver Group SafeBootMin: System Bus Extender - Driver Group SafeBootMin: WinDefend - C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation) SafeBootMin: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers SafeBootMin: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive SafeBootMin: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive SafeBootMin: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller SafeBootMin: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc SafeBootMin: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard SafeBootMin: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse SafeBootMin: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters SafeBootMin: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter SafeBootMin: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System SafeBootMin: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive SafeBootMin: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy SafeBootMin: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers SafeBootMin: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume SafeBootMin: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices SafeBootMin: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices SafeBootMin: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices SafeBootNet: AppMgmt - Service SafeBootNet: Base - Driver Group SafeBootNet: Boot Bus Extender - Driver Group SafeBootNet: Boot file system - Driver Group SafeBootNet: File system - Driver Group SafeBootNet: Filter - Driver Group SafeBootNet: HelpSvc - Service SafeBootNet: mcmscsvc - C:\Program Files\McAfee\MSC\mcmscsvc.exe (McAfee, Inc.) SafeBootNet: MCODS - C:\Program Files\McAfee\VirusScan\mcods.exe (McAfee, Inc.) SafeBootNet: Messenger - Service SafeBootNet: MpfService - C:\Program Files\McAfee\MPF\MPFSrv.exe (McAfee, Inc.) SafeBootNet: NDIS Wrapper - Driver Group SafeBootNet: NetBIOSGroup - Driver Group SafeBootNet: NetDDEGroup - Driver Group SafeBootNet: Network - Driver Group SafeBootNet: NetworkProvider - Driver Group SafeBootNet: NTDS - File not found SafeBootNet: PCI Configuration - Driver Group SafeBootNet: PNP Filter - Driver Group SafeBootNet: PNP_TDI - Driver Group SafeBootNet: Primary disk - Driver Group SafeBootNet: rdsessmgr - Service SafeBootNet: sacsvr - Service SafeBootNet: SCSI Class - Driver Group SafeBootNet: Streams Drivers - Driver Group SafeBootNet: System Bus Extender - Driver Group SafeBootNet: TDI - Driver Group SafeBootNet: WinDefend - C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation) SafeBootNet: WudfPf - Driver SafeBootNet: WudfUsbccidDriver - Driver SafeBootNet: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers SafeBootNet: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive SafeBootNet: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive SafeBootNet: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller SafeBootNet: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc SafeBootNet: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard SafeBootNet: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse SafeBootNet: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net SafeBootNet: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient SafeBootNet: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService SafeBootNet: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans SafeBootNet: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters SafeBootNet: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter SafeBootNet: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System SafeBootNet: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive SafeBootNet: {50DD5230-BA8A-11D1-BF5D-0000F805F530} - Smart card readers SafeBootNet: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy SafeBootNet: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers SafeBootNet: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume SafeBootNet: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices SafeBootNet: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices SafeBootNet: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun) ActiveX: {2179C5D3-EBFF-11CF-B6FD-00AA00B4E220} - ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 11.0 ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE ActiveX: {44BBA848-CC51-11CF-AAFA-00AA00B6015C} - ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6 ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access ActiveX: {73FA19D0-2D75-11D2-995D-00C04F98BBC9} - Web Folders ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7 ActiveX: {7C028AF8-F614-47B3-82DA-BA94E41B1089} - .NET Framework ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\system32\ie4uinit.exe -BaseSettings ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts ActiveX: {CDD7975E-60F8-41d5-8149-19E51D6F71D0} - Windows Movie Maker v2.1 ActiveX: {D27CDB6E-AE6D-11CF-96B8-444553540000} - Macromedia Shockwave Flash ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help ActiveX: {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - Reg Error: Value error. ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - C:\Windows\system32\unregmp2.exe /ShowWMP ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\system32\ie4uinit.exe -UserIconConfig ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP Drivers32: msacm.l3acm - C:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS) Drivers32: msacm.mkdmp3enc - C:\PROGRA~1\ACERAR~1\ACERVI~1\Kernel\Burner\MKDMP3Enc.ACM File not found Drivers32: msacm.siren - C:\Windows\System32\sirenacm.dll (Microsoft Corporation) Drivers32: vidc.cvid - C:\Windows\System32\iccvid.dll (Radius Inc.) OTL cannot create restorepoints on Vista OSs! ========== Files/Folders - Created Within 30 Days ========== [2010/04/28 22:01:29 \| 000,000,000 \| ---D \| C] -- C:\Rooter$ [2010/04/23 00:28:59 \| 000,000,000 \| ---D \| C] -- C:\Windows\ERDNT [2010/04/23 00:27:54 \| 000,000,000 \| ---D \| C] -- C:\Program Files\ERUNT [2010/04/23 00:16:27 \| 000,000,000 \| ---D \| C] -- C:\Program Files\Trend Micro [2010/04/22 00:15:38 \| 000,000,000 \| -H-D \| C] -- C:\Users\Donald\AppData\Local\{30DBD114-A456-4D8A-8442-43F29691AE83} [2010/04/18 22:37:08 \| 000,000,000 \| ---D \| C] -- C:\Program Files\Hide The IP 2010 [2010/04/18 22:36:33 \| 000,000,000 \| ---D \| C] -- C:\Users\Donald\AppData\Local\PackageAware [2010/04/17 01:07:53 \| 000,000,000 \| ---D \| C] -- C:\Users\Donald\AppData\Roaming\AutoHideIP [2010/04/17 01:07:53 \| 000,000,000 \| ---D \| C] -- C:\ProgramData\AutoHideIP [2010/04/17 00:42:47 \| 000,008,704 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\SpOrder.dll [2010/04/14 21:15:48 \| 003,600,776 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\ntkrnlpa.exe [2010/04/14 21:15:48 \| 003,548,040 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\ntoskrnl.exe [2010/04/14 21:15:29 \| 000,420,352 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\vbscript.dll [2010/04/14 21:09:14 \| 000,220,672 \| ---- \| C] (Fraunhofer Institut Integrierte Schaltungen IIS) -- C:\Windows\System32\l3codecp.acm [2010/04/14 21:09:14 \| 000,062,464 \| ---- \| C] (Fraunhofer Institut Integrierte Schaltungen IIS) -- C:\Windows\System32\l3codeca.acm [2010/04/05 00:50:45 \| 000,000,000 \| ---D \| C] -- C:\Users\Donald\Shared [2010/04/05 00:50:45 \| 000,000,000 \| ---D \| C] -- C:\Users\Donald\Incomplete [2010/04/05 00:49:53 \| 000,000,000 \| ---D \| C] -- C:\Users\Donald\AppData\Roaming\SkyDownloader [2010/04/05 00:49:45 \| 000,000,000 \| ---D \| C] -- C:\Program Files\Ask.com [2010/04/04 21:38:46 \| 000,000,000 \| ---D \| C] -- C:\ProgramData\Sun [2010/04/04 21:38:45 \| 000,000,000 \| ---D \| C] -- C:\Program Files\Common Files\Java [2010/04/04 21:38:35 \| 000,153,376 \| ---- \| C] (Sun Microsystems, Inc.) -- C:\Windows\System32\javaws.exe [2010/04/04 21:38:35 \| 000,145,184 \| ---- \| C] (Sun Microsystems, Inc.) -- C:\Windows\System32\javaw.exe [2010/04/04 21:38:35 \| 000,145,184 \| ---- \| C] (Sun Microsystems, Inc.) -- C:\Windows\System32\java.exe [2010/03/30 11:21:13 \| 001,638,912 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\mshtml.tlb [2010/03/30 11:21:13 \| 001,469,440 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\inetcpl.cpl [2010/03/30 11:21:13 \| 000,611,840 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\mstime.dll [2010/03/30 11:21:13 \| 000,594,432 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\msfeeds.dll [2010/03/30 11:21:13 \| 000,387,584 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\iedkcs32.dll [2010/03/30 11:21:13 \| 000,184,320 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\iepeers.dll [2010/03/30 11:21:13 \| 000,173,056 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\ie4uinit.exe [2010/03/30 11:21:13 \| 000,164,352 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\ieui.dll [2010/03/30 11:21:13 \| 000,133,632 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\ieUnatt.exe [2010/03/30 11:21:13 \| 000,109,056 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\iesysprep.dll [2010/03/30 11:21:13 \| 000,071,680 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\iesetup.dll [2010/03/30 11:21:13 \| 000,055,808 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\iernonce.dll [2010/03/30 11:21:13 \| 000,055,296 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\msfeedsbs.dll [2010/03/30 11:21:13 \| 000,025,600 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\jsproxy.dll [2010/03/30 11:21:13 \| 000,013,312 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\msfeedssync.exe [2009/01/19 16:37:43 \| 000,049,152 \| R--- \| C] ( ) -- C:\Windows\Interop.IWshRuntimeLibrary.dll ========== Files - Modified Within 30 Days ========== [2010/04/28 22:14:25 \| 002,359,296 \| -HS- \| M] () -- C:\Users\Donald\NTUSER.DAT [2010/04/28 22:13:03 \| 000,021,389 \| ---- \| M] () -- C:\Windows\System32\Config.MPF [2010/04/28 22:12:44 \| 000,000,000 \| ---- \| M] () -- C:\Windows\System32\LogConfigTemp.xml [2010/04/28 22:12:38 \| 000,000,882 \| ---- \| M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job [2010/04/28 22:12:29 \| 000,003,344 \| -H-- \| M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0 [2010/04/28 22:12:29 \| 000,003,344 \| -H-- \| M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0 [2010/04/28 22:12:26 \| 000,306,912 \| ---- \| M] () -- C:\Windows\System32\FNTCACHE.DAT [2010/04/28 22:12:24 \| 000,000,006 \| -H-- \| M] () -- C:\Windows\tasks\SA.DAT [2010/04/28 22:12:19 \| 000,067,584 \| --S- \| M] () -- C:\Windows\bootstat.dat [2010/04/28 22:11:47 \| 2951,168,000 \| -HS- \| M] () -- C:\hiberfil.sys [2010/04/28 22:11:46 \| 357,142,276 \| ---- \| M] () -- C:\Windows\MEMORY.DMP [2010/04/28 21:22:00 \| 000,000,886 \| ---- \| M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job [2010/04/28 20:43:19 \| 000,690,960 \| ---- \| M] () -- C:\Windows\System32\PerfStringBackup.INI [2010/04/28 20:43:19 \| 000,595,446 \| ---- \| M] () -- C:\Windows\System32\perfh009.dat [2010/04/28 20:43:19 \| 000,101,144 \| ---- \| M] () -- C:\Windows\System32\perfc009.dat [2010/04/28 20:37:22 \| 000,524,288 \| -HS- \| M] () -- C:\Users\Donald\NTUSER.DAT{3a539871-6a70-11db-887c-d362bd253390}.TMContainer00000000000000000001.regtrans-ms [2010/04/28 20:37:22 \| 000,065,536 \| -HS- \| M] () -- C:\Users\Donald\NTUSER.DAT{3a539871-6a70-11db-887c-d362bd253390}.TM.blf [2010/04/28 01:38:58 \| 000,002,096 \| ---- \| M] () -- C:\Windows\System32\avr.ini [2010/04/23 00:56:05 \| 002,976,057 \| -H-- \| M] () -- C:\Users\Donald\AppData\Local\IconCache.db [2010/04/23 00:27:55 \| 000,000,737 \| ---- \| M] () -- C:\Users\Donald\Desktop\NTREGOPT.lnk [2010/04/23 00:27:55 \| 000,000,718 \| ---- \| M] () -- C:\Users\Donald\Desktop\ERUNT.lnk [2010/04/23 00:16:27 \| 000,001,878 \| ---- \| M] () -- C:\Users\Donald\Desktop\HijackThis.lnk [2010/04/22 00:15:38 \| 000,000,913 \| ---- \| M] () -- C:\Users\Donald\Desktop\Hide The IP 2010.lnk [2010/04/18 18:17:02 \| 000,002,595 \| ---- \| M] () -- C:\Users\Donald\Desktop\Microsoft Word.lnk [2010/04/17 00:42:47 \| 000,008,704 \| ---- \| M] (Microsoft Corporation) -- C:\Windows\System32\SpOrder.dll [2010/04/17 00:42:46 \| 000,073,728 \| ---- \| M] () -- C:\Windows\System32\VistaInfo32.dll [2010/04/17 00:42:43 \| 000,000,068 \| ---- \| M] () -- C:\Windows\MyProg.ini [2010/04/09 18:59:23 \| 000,000,376 \| ---- \| M] () -- C:\Windows\ODBC.INI [2010/04/05 01:13:09 \| 000,000,542 \| ---- \| M] () -- C:\Windows\wininit.ini [2010/03/30 00:46:30 \| 000,038,224 \| ---- \| M] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbamswissarmy.sys [2010/03/30 00:45:52 \| 000,020,824 \| ---- \| M] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys ========== Files Created - No Company Name ========== [2010/04/23 00:27:55 \| 000,000,737 \| ---- \| C] () -- C:\Users\Donald\Desktop\NTREGOPT.lnk [2010/04/23 00:27:55 \| 000,000,718 \| ---- \| C] () -- C:\Users\Donald\Desktop\ERUNT.lnk [2010/04/23 00:16:27 \| 000,001,878 \| ---- \| C] () -- C:\Users\Donald\Desktop\HijackThis.lnk [2010/04/22 00:26:00 \| 000,002,096 \| ---- \| C] () -- C:\Windows\System32\avr.ini [2010/04/22 00:15:38 \| 000,000,913 \| ---- \| C] () -- C:\Users\Donald\Desktop\Hide The IP 2010.lnk [2010/04/17 00:42:46 \| 000,073,728 \| ---- \| C] () -- C:\Windows\System32\VistaInfo32.dll [2010/04/17 00:42:43 \| 000,000,068 \| ---- \| C] () -- C:\Windows\MyProg.ini [2009/10/23 13:21:24 \| 000,202,048 \| ---- \| C] () -- C:\Windows\System32\AVLibrary.dll [2009/10/05 00:27:56 \| 000,000,542 \| ---- \| C] () -- C:\Windows\wininit.ini [2009/10/03 01:37:06 \| 000,000,376 \| ---- \| C] () -- C:\Windows\ODBC.INI [2009/09/27 17:02:53 \| 000,117,248 \| ---- \| C] () -- C:\Windows\System32\EhStorAuthn.dll [2009/01/19 18:42:29 \| 000,487,424 \| ---- \| C] () -- C:\Windows\System32\INT15.dll [2009/01/19 18:20:09 \| 000,001,694 \| ---- \| C] () -- C:\Windows\RtDefLvl.ini [2006/11/02 05:35:32 \| 000,005,632 \| ---- \| C] () -- C:\Windows\System32\sysprepMCE.dll [2006/11/02 00:40:29 \| 000,013,750 \| ---- \| C] () -- C:\Windows\System32\pacerprf.ini [2006/10/11 01:40:49 \| 000,000,044 \| ---- \| C] () -- C:\Windows\Acer(Normal).ini [2006/10/11 01:40:49 \| 000,000,042 \| ---- \| C] () -- C:\Windows\Acer(Wide).ini ========== Custom Scans ========== < %SYSTEMDRIVE%\. > [2006/09/18 14:43:36 \| 000,000,024 \| ---- \| M] () -- C:\autoexec.bat [2009/04/10 23:36:36 \| 000,333,257 \| RHS- \| M] () -- C:\bootmgr [2009/01/19 16:38:19 \| 000,008,192 \| R-S- \| M] () -- C:\BOOTSECT.BAK [2006/09/18 14:43:37 \| 000,000,010 \| ---- \| M] () -- C:\config.sys [2010/04/28 22:11:47 \| 2951,168,000 \| -HS- \| M] () -- C:\hiberfil.sys [2010/04/28 22:11:46 \| 3265,060,864 \| -HS- \| M] () -- C:\pagefile.sys [2009/01/19 18:20:47 \| 000,000,426 \| ---- \| M] () -- C:\RHDSetup.log < MD5 for: AGP440.SYS > [2008/01/20 19:23:01 \| 000,056,376 \| ---- \| M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\System32\drivers\AGP440.sys [2008/01/20 19:23:01 \| 000,056,376 \| ---- \| M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\System32\DriverStore\FileRepository\machine.inf_51b95d75\AGP440.sys [2008/01/20 19:23:01 \| 000,056,376 \| ---- \| M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\System32\DriverStore\FileRepository\machine.inf_f750e484\AGP440.sys [2008/01/20 19:23:01 \| 000,056,376 \| ---- \| M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.0.6001.18000_none_ba12ed3bbeb0d97a\AGP440.sys [2008/01/20 19:23:01 \| 000,056,376 \| ---- \| M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.0.6002.18005_none_bbfe6647bbd2a4c6\AGP440.sys [2006/11/02 02:49:52 \| 000,053,864 \| ---- \| M] (Microsoft Corporation) MD5=EF23439CDD587F64C2C1B8825CEAD7D8 -- C:\Windows\System32\DriverStore\FileRepository\machine.inf_920a2c1f\AGP440.sys < MD5 for: ATAPI.SYS > [2009/04/10 23:32:26 \| 000,019,944 \| ---- \| M] (Microsoft Corporation) MD5=1F05B78AB91C9075565A9D8A4B880BC4 -- C:\Windows\System32\drivers\atapi.sys [2009/04/10 23:32:26 \| 000,019,944 \| ---- \| M] (Microsoft Corporation) MD5=1F05B78AB91C9075565A9D8A4B880BC4 -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_b12d8e84\atapi.sys [2009/04/10 23:32:26 \| 000,019,944 \| ---- \| M] (Microsoft Corporation) MD5=1F05B78AB91C9075565A9D8A4B880BC4 -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6002.18005_none_df23a1261eab99e8\atapi.sys [2008/01/20 19:23:00 \| 000,021,560 \| ---- \| M] (Microsoft Corporation) MD5=2D9C903DC76A66813D350A562DE40ED9 -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_cc18792d\atapi.sys [2008/01/20 19:23:00 \| 000,021,560 \| ---- \| M] (Microsoft Corporation) MD5=2D9C903DC76A66813D350A562DE40ED9 -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6001.18000_none_dd38281a2189ce9c\atapi.sys [2006/11/02 02:49:36 \| 000,019,048 \| ---- \| M] (Microsoft Corporation) MD5=4F4FCB8B6EA06784FB6D475B7EC7300F -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_c6c2e699\atapi.sys < MD5 for: CNGAUDIT.DLL > [2006/11/02 02:46:03 \| 000,011,776 \| ---- \| M] (Microsoft Corporation) MD5=7F15B4953378C8B5161D65C26D5FED4D -- C:\Windows\System32\cngaudit.dll [2006/11/02 02:46:03 \| 000,011,776 \| ---- \| M] (Microsoft Corporation) MD5=7F15B4953378C8B5161D65C26D5FED4D -- C:\Windows\winsxs\x86_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.0.6000.16386_none_e62d292932a96ce6\cngaudit.dll < MD5 for: IASTORV.SYS > [2008/01/20 19:23:23 \| 000,235,064 \| ---- \| M] (Intel Corporation) MD5=54155EA1B0DF185878E0FC9EC3AC3A14 -- C:\Windows\System32\drivers\iaStorV.sys [2008/01/20 19:23:23 \| 000,235,064 \| ---- \| M] (Intel Corporation) MD5=54155EA1B0DF185878E0FC9EC3AC3A14 -- C:\Windows\System32\DriverStore\FileRepository\iastorv.inf_c9df7691\iaStorV.sys [2008/01/20 19:23:23 \| 000,235,064 \| ---- \| M] (Intel Corporation) MD5=54155EA1B0DF185878E0FC9EC3AC3A14 -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.0.6001.18000_none_af11527887c7fa8f\iaStorV.sys [2006/11/02 02:51:25 \| 000,232,040 \| ---- \| M] (Intel Corporation) MD5=C957BF4B5D80B46C5017BF0101E6C906 -- C:\Windows\System32\DriverStore\FileRepository\iastorv.inf_37cdafa4\iaStorV.sys < MD5 for: NETLOGON.DLL > [2009/04/10 23:28:23 \| 000,592,896 \| ---- \| M] (Microsoft Corporation) MD5=95DAECF0FB120A7B5DA679CC54E37DDE -- C:\Windows\System32\netlogon.dll [2009/04/10 23:28:23 \| 000,592,896 \| ---- \| M] (Microsoft Corporation) MD5=95DAECF0FB120A7B5DA679CC54E37DDE -- C:\Windows\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.0.6002.18005_none_ffa3304f351bb3a3\netlogon.dll [2008/01/20 19:24:05 \| 000,592,384 \| ---- \| M] (Microsoft Corporation) MD5=A8EFC0B6E75B789F7FD3BA5025D4E37F -- C:\Windows\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.0.6001.18000_none_fdb7b74337f9e857\netlogon.dll < MD5 for: NVRAID.SYS > [2008/01/20 19:23:21 \| 000,102,968 \| ---- \| M] (NVIDIA Corporation) MD5=2EDF9E7751554B42CBB60116DE727101 -- C:\Windows\System32\drivers\nvraid.sys [2008/01/20 19:23:21 \| 000,102,968 \| ---- \| M] (NVIDIA Corporation) MD5=2EDF9E7751554B42CBB60116DE727101 -- C:\Windows\System32\DriverStore\FileRepository\nvraid.inf_31c3d71d\nvraid.sys [2008/01/20 19:23:21 \| 000,102,968 \| ---- \| M] (NVIDIA Corporation) MD5=2EDF9E7751554B42CBB60116DE727101 -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.0.6001.18000_none_39dac327befea467\nvraid.sys [2006/11/02 02:50:24 \| 000,088,680 \| ---- \| M] (NVIDIA Corporation) MD5=E69E946F80C1C31C53003BFBF50CBB7C -- C:\Windows\System32\DriverStore\FileRepository\nvraid.inf_733654ff\nvraid.sys < MD5 for: NVRD32.SYS > [2008/01/25 05:02:04 \| 000,132,128 \| ---- \| M] (NVIDIA Corporation) MD5=0D15327134E5871C922760ACD7449E84 -- C:\ACER\Preload\Autorun\DRV\nVidia Chipset MCP78PV\IDE\WinVista\sataraid\nvrd32.sys < MD5 for: NVSTOR.SYS > [2006/11/02 02:50:13 \| 000,040,040 \| ---- \| M] (NVIDIA Corporation) MD5=9E0BA19A28C498A6D323D065DB76DFFC -- C:\Windows\System32\DriverStore\FileRepository\nvraid.inf_733654ff\nvstor.sys [2008/01/20 19:23:21 \| 000,045,112 \| ---- \| M] (NVIDIA Corporation) MD5=ABED0C09758D1D97DB0042DBB2688177 -- C:\Windows\System32\drivers\nvstor.sys [2008/01/20 19:23:21 \| 000,045,112 \| ---- \| M] (NVIDIA Corporation) MD5=ABED0C09758D1D97DB0042DBB2688177 -- C:\Windows\System32\DriverStore\FileRepository\nvraid.inf_31c3d71d\nvstor.sys [2008/01/20 19:23:21 \| 000,045,112 \| ---- \| M] (NVIDIA Corporation) MD5=ABED0C09758D1D97DB0042DBB2688177 -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.0.6001.18000_none_39dac327befea467\nvstor.sys < MD5 for: NVSTOR32.SYS > [2008/01/25 05:02:04 \| 000,140,832 \| ---- \| M] (NVIDIA Corporation) MD5=7DF63192BCF9C20EC2F7492E7F7544F9 -- C:\ACER\Preload\Autorun\DRV\nVidia Chipset MCP78PV\IDE\WinVista\sataraid\nvstor32.sys [2008/01/25 05:02:02 \| 000,140,832 \| ---- \| M] (NVIDIA Corporation) MD5=FA7B8ECA6E845B244B7E30A9DCD82C6C -- C:\ACER\Preload\Autorun\DRV\nVidia Chipset MCP78PV\IDE\WinVista\sata_ide\nvstor32.sys [2008/01/25 05:02:02 \| 000,140,832 \| ---- \| M] (NVIDIA Corporation) MD5=FA7B8ECA6E845B244B7E30A9DCD82C6C -- C:\Windows\System32\drivers\nvstor32.sys [2008/01/25 05:02:02 \| 000,140,832 \| ---- \| M] (NVIDIA Corporation) MD5=FA7B8ECA6E845B244B7E30A9DCD82C6C -- C:\Windows\System32\DriverStore\FileRepository\nvstor32.inf_1d63ff55\nvstor32.sys < MD5 for: SCECLI.DLL > [2008/01/20 19:24:50 \| 000,177,152 \| ---- \| M] (Microsoft Corporation) MD5=28B84EB538F7E8A0FE8B9299D591E0B9 -- C:\Windows\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.0.6001.18000_none_380de25bd91b6f12\scecli.dll [2009/04/10 23:28:24 \| 000,177,152 \| ---- \| M] (Microsoft Corporation) MD5=8FC182167381E9915651267044105EE1 -- C:\Windows\System32\scecli.dll [2009/04/10 23:28:24 \| 000,177,152 \| ---- \| M] (Microsoft Corporation) MD5=8FC182167381E9915651267044105EE1 -- C:\Windows\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.0.6002.18005_none_39f95b67d63d3a5e\scecli.dll < %systemroot%\. /mp /s > < %systemroot%\system32\.dll /lockedfiles > [2009/04/10 23:27:47 \| 000,241,128 \| ---- \| M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\System32\rsaenh.dll [2009/04/10 23:28:23 \| 000,228,352 \| ---- \| M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\System32\SLC.dll < %systemroot%\system32\.exe /lockedfiles > < %systemroot%\Tasks\.job /lockedfiles > < %systemroot%\system32\drivers\.sys /lockedfiles > < %systemroot%\System32\config\.sav > [2008/01/20 20:14:18 \| 016,846,848 \| ---- \| M] () -- C:\Windows\System32\config\COMPONENTS.SAV [2008/01/20 20:14:08 \| 000,106,496 \| ---- \| M] () -- C:\Windows\System32\config\DEFAULT.SAV [2008/01/20 20:14:18 \| 000,020,480 \| ---- \| M] () -- C:\Windows\System32\config\SECURITY.SAV [2006/11/02 03:34:08 \| 010,133,504 \| ---- \| M] () -- C:\Windows\System32\config\SOFTWARE.SAV [2006/11/02 03:34:08 \| 001,826,816 \| ---- \| M] () -- C:\Windows\System32\config\SYSTEM.SAV < %systemroot%\system32\drivers\.sys /90 > [2010/02/20 13:53:34 \| 000,411,648 \| ---- \| M] (Microsoft Corporation) -- C:\Windows\System32\drivers\http.sys [2010/03/30 00:45:52 \| 000,020,824 \| ---- \| M] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys [2010/03/30 00:46:30 \| 000,038,224 \| ---- \| M] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbamswissarmy.sys [2010/02/23 04:10:13 \| 000,106,496 \| ---- \| M] (Microsoft Corporation) -- C:\Windows\System32\drivers\mrxsmb.sys [2010/02/23 04:10:19 \| 000,212,992 \| ---- \| M] (Microsoft Corporation) -- C:\Windows\System32\drivers\mrxsmb10.sys [2010/02/23 04:10:13 \| 000,079,360 \| ---- \| M] (Microsoft Corporation) -- C:\Windows\System32\drivers\mrxsmb20.sys [2010/02/18 07:07:16 \| 000,904,576 \| ---- \| M] (Microsoft Corporation) -- C:\Windows\System32\drivers\tcpip.sys [2010/02/18 04:28:13 \| 000,025,088 \| ---- \| M] (Microsoft Corporation) -- C:\Windows\System32\drivers\tunnel.sys < %PROGRAMFILES%\. > [2009/09/26 19:19:10 \| 000,000,000 \| ---D \| M] -- C:\Program Files\Acer [2009/01/19 19:02:44 \| 000,000,000 \| ---D \| M] -- C:\Program Files\Acer Arcade Live [2010/04/10 21:27:59 \| 000,000,000 \| ---D \| M] -- C:\Program Files\Acer GameZone [2006/10/11 01:40:48 \| 000,000,000 \| ---D \| M] -- C:\Program Files\Acer Incorporated [2009/01/19 19:02:25 \| 000,000,000 \| ---D \| M] -- C:\Program Files\Adobe [2010/01/03 04:27:01 \| 000,000,000 \| ---D \| M] -- C:\Program Files\Apple Software Update [2010/04/23 00:21:31 \| 000,000,000 \| ---D \| M] -- C:\Program Files\Ask.com [2009/01/19 18:12:28 \| 000,000,000 \| ---D \| M] -- C:\Program Files\bin32 [2010/01/25 13:30:14 \| 000,000,000 \| ---D \| M] -- C:\Program Files\BitComet [2010/01/03 04:28:03 \| 000,000,000 \| ---D \| M] -- C:\Program Files\Bonjour [2009/09/27 11:50:25 \| 000,000,000 \| ---D \| M] -- C:\Program Files\Carbonite [2010/04/23 00:03:15 \| 000,000,000 \| ---D \| M] -- C:\Program Files\CometBird [2010/04/04 21:38:45 \| 000,000,000 \| ---D \| M] -- C:\Program Files\Common Files [2009/01/19 18:57:28 \| 000,000,000 \| ---D \| M] -- C:\Program Files\CyberLink [2010/04/23 00:28:02 \| 000,000,000 \| ---D \| M] -- C:\Program Files\ERUNT [2009/01/19 19:20:15 \| 000,000,000 \| ---D \| M] -- C:\Program Files\eSobi [2010/04/11 07:24:15 \| 000,000,000 \| ---D \| M] -- C:\Program Files\Google [2010/04/17 00:48:56 \| 000,000,000 \| ---D \| M] -- C:\Program Files\Hide The IP [2010/04/22 00:15:38 \| 000,000,000 \| ---D \| M] -- C:\Program Files\Hide The IP 2010 [2009/09/27 20:51:09 \| 000,000,000 \| -H-D \| M] -- C:\Program Files\InstallShield Installation Information [2010/03/31 17:34:00 \| 000,000,000 \| ---D \| M] -- C:\Program Files\Internet Explorer [2010/02/13 10:39:43 \| 000,000,000 \| ---D \| M] -- C:\Program Files\iPod [2010/02/13 10:40:19 \| 000,000,000 \| ---D \| M] -- C:\Program Files\iTunes [2010/04/04 21:38:32 \| 000,000,000 \| ---D \| M] -- C:\Program Files\Java [2009/01/19 18:12:18 \| 000,000,000 \| ---D \| M] -- C:\Program Files\log [2010/04/21 20:41:53 \| 000,000,000 \| ---D \| M] -- C:\Program Files\Malwarebytes' Anti-Malware [2010/04/01 07:06:09 \| 000,000,000 \| ---D \| M] -- C:\Program Files\McAfee [2009/01/19 18:48:23 \| 000,000,000 \| ---D \| M] -- C:\Program Files\McAfee.com [2009/01/19 18:45:01 \| 000,000,000 \| ---D \| M] -- C:\Program Files\Microsoft [2009/10/03 01:36:27 \| 000,000,000 \| ---D \| M] -- C:\Program Files\Microsoft ActiveSync [2009/09/26 21:23:17 \| 000,000,000 \| ---D \| M] -- C:\Program Files\Microsoft Games [2009/10/03 01:35:34 \| 000,000,000 \| ---D \| M] -- C:\Program Files\Microsoft Office [2009/01/19 18:36:15 \| 000,000,000 \| ---D \| M] -- C:\Program Files\Microsoft Office Suite Activation Assistant [2010/01/22 04:27:43 \| 000,000,000 \| ---D \| M] -- C:\Program Files\Microsoft Silverlight [2009/01/19 18:46:17 \| 000,000,000 \| ---D \| M] -- C:\Program Files\Microsoft SQL Server Compact Edition [2010/03/13 10:26:39 \| 000,000,000 \| ---D \| M] -- C:\Program Files\Microsoft Works [2009/01/19 18:33:48 \| 000,000,000 \| ---D \| M] -- C:\Program Files\Microsoft.NET [2010/03/10 04:20:05 \| 000,000,000 \| ---D \| M] -- C:\Program Files\Movie Maker [2010/04/05 00:10:23 \| 000,000,000 \| ---D \| M] -- C:\Program Files\Mozilla Firefox [2006/11/02 05:37:34 \| 000,000,000 \| ---D \| M] -- C:\Program Files\MSBuild [2009/09/26 19:28:33 \| 000,000,000 \| ---D \| M] -- C:\Program Files\MSXML 4.0 [2009/01/19 18:56:37 \| 000,000,000 \| ---D \| M] -- C:\Program Files\NewTech Infosystems [2009/01/19 18:30:55 \| 000,000,000 \| ---D \| M] -- C:\Program Files\PlayReady [2009/01/19 18:31:57 \| 000,000,000 \| ---D \| M] -- C:\Program Files\Preload [2010/04/28 01:38:48 \| 000,000,000 \| ---D \| M] -- C:\Program Files\Privacy Guardian [2009/01/19 18:12:27 \| 000,000,000 \| ---D \| M] -- C:\Program Files\profile [2010/01/03 04:27:55 \| 000,000,000 \| ---D \| M] -- C:\Program Files\QuickTime [2009/01/19 18:19:55 \| 000,000,000 \| ---D \| M] -- C:\Program Files\Realtek [2006/11/02 05:37:34 \| 000,000,000 \| ---D \| M] -- C:\Program Files\Reference Assemblies [2010/04/23 00:16:27 \| 000,000,000 \| ---D \| M] -- C:\Program Files\Trend Micro [2006/11/02 06:01:55 \| 000,000,000 \| -H-D \| M] -- C:\Program Files\Uninstall Information [2009/10/04 11:07:34 \| 000,000,000 \| ---D \| M] -- C:\Program Files\Windows Calendar [2009/10/04 11:07:33 \| 000,000,000 \| ---D \| M] -- C:\Program Files\Windows Collaboration [2009/10/04 11:07:31 \| 000,000,000 \| ---D \| M] -- C:\Program Files\Windows Defender [2009/10/04 11:07:33 \| 000,000,000 \| ---D \| M] -- C:\Program Files\Windows Journal [2009/10/11 10:01:03 \| 000,000,000 \| ---D \| M] -- C:\Program Files\Windows Live [2010/04/15 08:52:11 \| 000,000,000 \| ---D \| M] -- C:\Program Files\Windows Mail [2009/10/28 03:24:53 \| 000,000,000 \| ---D \| M] -- C:\Program Files\Windows Media Player [2006/11/02 05:37:34 \| 000,000,000 \| ---D \| M] -- C:\Program Files\Windows NT [2009/10/04 11:07:32 \| 000,000,000 \| ---D \| M] -- C:\Program Files\Windows Photo Gallery [2009/11/18 04:26:45 \| 000,000,000 \| ---D \| M] -- C:\Program Files\Windows Portable Devices [2009/10/04 11:07:33 \| 000,000,000 \| ---D \| M] -- C:\Program Files\Windows Sidebar [2009/10/11 10:10:00 \| 000,000,000 \| ---D \| M] -- C:\Program Files\Yahoo! [2006/10/11 01:40:20 \| 000,000,000 \| ---D \| M] -- C:\Program Files\YUAN < HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install\|LastSuccessTime /rs > HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install\\LastSuccessTime: 2010-04-29 03:21:47 ========== Alternate Data Streams ========== @Alternate Data Stream - 103 bytes -> C:\ProgramData\TEMP:DAFD38AE < End of report > OTL Extras logfile created on: 4/28/2010 10:15:07 PM - Run 1 OTL by OldTimer - Version 3.2.3.0 Folder = C:\Users\Donald\Downloads Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation Internet Explorer (Version = 8.0.6001.18904) Locale: 00000409 \| Country: United States \| Language: ENU \| Date Format: M/d/yyyy 3.00 Gb Total Physical Memory \| 2.00 Gb Available Physical Memory \| 60.00% Memory free 6.00 Gb Paging File \| 5.00 Gb Available in Paging File \| 80.00% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: \| %SystemRoot% = C:\Windows \| %ProgramFiles% = C:\Program Files Drive C: \| 142.04 Gb Total Space \| 90.98 Gb Free Space \| 64.05% Space Free \| Partition Type: NTFS D: Drive not present or media not loaded E: Drive not present or media not loaded Drive F: \| 142.04 Gb Total Space \| 141.95 Gb Free Space \| 99.94% Space Free \| Partition Type: NTFS G: Drive not present or media not loaded H: Drive not present or media not loaded I: Drive not present or media not loaded Computer Name: DONALD-PC Current User Name: Donald Logged in as Administrator. Current Boot Mode: Normal Scan Mode: Current user Company Name Whitelist: Off Skip Microsoft Files: Off File Age = 30 Days Output = Standard ========== Extra Registry (SafeList) ========== ========== File Associations ========== [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>] .cpl [@ = cplfile] -- C:\Windows\System32\control.exe (Microsoft Corporation) .hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation) [HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>] .html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation) ========== Shell Spawning ========== [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command] batfile [open] -- "%1" %* cmdfile [open] -- "%1" %* comfile [open] -- "%1" %* cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation) exefile [open] -- "%1" %* helpfile [open] -- Reg Error: Key error. hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation) htmlfile [edit] -- "C:\Program Files\Microsoft Office\Office10\msohtmed.exe" %1 (Microsoft Corporation) htmlfile [print] -- "C:\Program Files\Microsoft Office\Office10\msohtmed.exe" /p %1 (Microsoft Corporation) inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation) piffile [open] -- "%1" %* regfile [merge] -- Reg Error: Key error. scrfile [config] -- "%1" scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation) scrfile [open] -- "%1" /S txtfile [edit] -- Reg Error: Key error. Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1 Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation) Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation) Directory [OneNote.Open] -- C:\PROGRA~1\MICROS~2\Office12\ONENOTE.EXE "%L" (Microsoft Corporation) Folder [open] -- %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation) Folder [explore] -- %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation) Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation) ========== Security Center Settings ========== [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center] "cval" = 1 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc] "AntiVirusOverride" = 0 "AntiSpywareOverride" = 0 "FirewallOverride" = 0 "VistaSp1" = Reg Error: Unknown registry data type -- File not found "VistaSp2" = Reg Error: Unknown registry data type -- File not found [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile] "EnableFirewall" = 0 "DisableNotifications" = 0 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile] "EnableFirewall" = 0 "DisableNotifications" = 0 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile] "EnableFirewall" = 0 "DisableNotifications" = 0 ========== Authorized Applications List ========== [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] "C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\eDSfsu.exe" = C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\eDSfsu.exe::Enabled:eDSfsu -- (Egis Incorporated.) "C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\encryption.exe" = C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\encryption.exe::Enabled:encryption -- ( Egis Incorporated.) "C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\decryption.exe" = C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\decryption.exe::Enabled:decryption -- ( Egis Incorporated.) "C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\eDSMgr.exe" = C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\eDSMgr.exe::Enabled:eDSMgr -- File not found "C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\eDStbmngr.exe" = C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\eDStbmngr.exe::Enabled:eDStbmngr -- (Egis Incorporated.) "C:\Program Files\Acer\Empowering Technology\eDataSecurity\x64\eDSfsu.exe" = C:\Program Files\Acer\Empowering Technology\eDataSecurity\x64\eDSfsu.exe::Enabled:eDSfsu -- (Egis Incorporated.) "C:\Program Files\Acer\Empowering Technology\eDataSecurity\x64\encryption.exe" = C:\Program Files\Acer\Empowering Technology\eDataSecurity\x64\encryption.exe::Enabled:encryption -- File not found "C:\Program Files\Acer\Empowering Technology\eDataSecurity\x64\decryption.exe" = C:\Program Files\Acer\Empowering Technology\eDataSecurity\x64\decryption.exe::Enabled:decryption -- File not found "C:\Program Files\Acer\Empowering Technology\eDataSecurity\x64\eDSMgr.exe" = C:\Program Files\Acer\Empowering Technology\eDataSecurity\x64\eDSMgr.exe::Enabled:eDSMgr -- File not found "C:\Program Files\Acer\Empowering Technology\eDataSecurity\x64\eDStbmngr.exe" = C:\Program Files\Acer\Empowering Technology\eDataSecurity\x64\eDStbmngr.exe::Enabled:eDStbmngr -- (Egis Incorporated.) ========== Vista Active Open Ports Exception List ========== [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules] "{89670FF6-4324-4909-B564-5ECC98934206}" = lport=1900 \| protocol=17 \| dir=in \| svc=ssdpsrv \| app=svchost.exe \| "{B43F2B87-BA91-4E33-BA12-EC8E2F6A9060}" = lport=2869 \| protocol=6 \| dir=in \| app=system \| ========== Vista Active Application Exception List ========== [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules] "{00F3B3EA-A1DB-4A04-98FD-20C44F07C5B6}" = dir=in \| app=c:\program files\windows live\messenger\wlcsdk.exe \| "{17B26786-8B9C-4322-87F5-714C3550682C}" = protocol=6 \| dir=in \| app=c:\program files\newtech infosystems\nti backup now 5\schedulersvc.exe \| "{1F2A0765-C9A3-4AD7-A438-AD1CA13FE20F}" = dir=in \| app=c:\program files\acer arcade live\acer dv magician\acer dv magician.exe \| "{55DA2ED7-0452-469B-B146-32B31C806321}" = protocol=6 \| dir=in \| app=c:\program files\microsoft office\office12\onenote.exe \| "{572CB191-026C-4F51-9267-5A0DA5478521}" = protocol=6 \| dir=in \| app=c:\program files\yahoo!\messenger\yahoomessenger.exe \| "{5D6B01B3-61EA-4995-BABF-9E3CF7DDD992}" = dir=in \| app=c:\program files\acer arcade live\acer homemedia\acer homemedia.exe \| "{5F06D05D-569A-41B4-BCC5-B8308A189B5D}" = protocol=17 \| dir=in \| app=c:\program files\itunes\itunes.exe \| "{69AC4762-70F6-4105-84EA-61C2D9F2B0A3}" = protocol=17 \| dir=in \| app=c:\program files\microsoft office\office12\onenote.exe \| "{7AF2AB31-77ED-4D76-8695-DEB2D8D65A8D}" = protocol=6 \| dir=in \| app=c:\program files\newtech infosystems\nti backup now 5\backupsvc.exe \| "{828125FB-4B2B-4892-89CE-DFD0297A4A99}" = dir=in \| app=c:\program files\acer arcade live\acer arcade live main page\acer arcade live.exe \| "{85AC0D7A-1DFE-4827-9A20-4F47725D0BCE}" = dir=in \| app=c:\program files\windows live\messenger\msnmsgr.exe \| "{89B2D2D0-A035-47E3-9B34-ABC22B85C7ED}" = protocol=17 \| dir=in \| app=c:\program files\yahoo!\messenger\yahoomessenger.exe \| "{8C0251F1-2E22-4CA4-8ADF-B1E1FF819CD1}" = dir=in \| app=c:\program files\acer arcade live\acer videomagician\acer videomagician.exe \| "{914F42F1-2C07-4FAA-823D-9D5764BCE676}" = protocol=17 \| dir=in \| app=c:\program files\newtech infosystems\nti backup now 5\schedulersvc.exe \| "{948B0315-30B0-49D1-B09C-33BF8EB08262}" = dir=in \| app=c:\program files\acer arcade live\acer dvdivine\acer dvdivine.exe \| "{AEB65238-33A3-489D-BBCA-65FD0AD8F323}" = protocol=17 \| dir=in \| app=c:\program files\bonjour\mdnsresponder.exe \| "{B121609F-BE7C-4CBE-8038-2553FAB415D0}" = protocol=17 \| dir=in \| app=c:\program files\newtech infosystems\nti backup now 5\backupsvc.exe \| "{B136E457-6896-40F4-AB93-CD9F457B588F}" = dir=in \| app=c:\program files\common files\mcafee\mna\mcnasvc.exe \| "{B76FBDD2-2B2D-40C9-B63F-28C86E7FEE84}" = dir=in \| app=c:\program files\acer arcade live\acer homemedia connect\kernel\dms\clmsserver.exe \| "{CCC08F5A-3B3A-4EBC-9FC9-52F53E3ED329}" = protocol=6 \| dir=in \| app=c:\program files\hide the ip 2010\hidetheip.exe \| "{D03AFF1D-21E0-4231-90E0-156C65B1FF5A}" = dir=in \| app=c:\program files\acer arcade live\acer slideshow dvd\acer slideshow dvd.exe \| "{D69BCE88-F15C-454C-BC9D-8ADF0797EAC2}" = protocol=6 \| dir=in \| app=c:\program files\itunes\itunes.exe \| "{E188365E-98B5-4AB2-AF6C-72E61EA849CF}" = protocol=6 \| dir=in \| app=c:\program files\bitcomet\bitcomet.exe \| "{E62CAB24-76BC-487B-8B31-42C6F687019D}" = protocol=17 \| dir=in \| app=c:\program files\hide the ip 2010\hidetheip.exe \| "{F1DE6163-8175-4D47-8CC4-E58A7D2E16EF}" = dir=in \| app=c:\program files\acer arcade live\acer homemedia connect\acer homemedia connect.exe \| "{F2E14084-A17B-4AF0-81C6-58F18F2E6838}" = dir=in \| app=c:\program files\acer arcade live\acer homemedia trial creator\acer homemedia trial creator.exe \| "{F425CF10-FDF5-41BD-B02D-9CE1178E4C96}" = protocol=17 \| dir=in \| app=c:\program files\bitcomet\bitcomet.exe \| "{F8B08A0A-430E-4B15-ADD5-C4C592D854AE}" = protocol=6 \| dir=in \| app=c:\program files\bonjour\mdnsresponder.exe \| ========== HKEY_LOCAL_MACHINE Uninstall List ========== [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall] "{00203668-8170-44A0-BE44-B632FA4D780F}" = Adobe AIR "{020D8396-D6D9-4B53-A9A1-83C47E2E27AA}" = Windows Live Call "{07287123-B8AC-41CE-8346-3D777245C35B}" = Bonjour "{0AAA9C97-74D4-47CE-B089-0B147EF3553C}" = Windows Live Messenger "{12EFA1A4-AC3B-443C-8143-237EDE760403}" = NTI Backup Now Standard "{132888AE-EF67-41C5-BCA2-7D5D2488AB63}" = Acer HomeMedia Connect "{1451DE6B-ABE1-4F62-BE9A-B363A17588A2}" = QuickTime "{15D967B5-A4BE-42AE-9E84-64CD062B25AA}" = eSobi v2 "{18455581-E099-4BA8-BC6B-F34B2F06600C}" = Google Toolbar for Internet Explorer "{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}" = MSVCRT "{2318C2B1-4965-11d4-9B18-009027A5CD4F}" = Google Toolbar for Internet Explorer "{2413930C-8309-47A6-BC61-5EF27A4222BC}" = NTI Media Maker 8 "{26A24AE4-039D-4CA4-87B4-2F83216016FF}" = Java™ 6 Update 19 "{3FA365DF-2D68-45ED-8F83-8C8A33E65143}" = Apple Application Support "{41581EF5-45A7-11DA-9D78-000129760D75}" = Acer SlideShow DVD "{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater "{4AB8B41B-3AF1-46BE-99B0-0ACD3B300C0A}" = Junk Mail filter update "{50897E53-4A8B-4C0C-81C0-DCFA6893C753}" = Hide The IP 2010 "{63C1109E-D977-49ED-BCE3-D00D0BF187D6}" = Windows Live Mail "{6956856F-B6B3-4BE0-BA0B-8F495BE32033}" = Apple Software Update "{6A92E5C5-0578-443D-91F3-92ECE5F2CAE2}" = Windows Live Writer "{6D52C408-B09A-4520-9B18-475B81D393F1}" = Microsoft Works "{71C2828F-2678-4675-BDEC-895424861262}_is1" = C:\Program Files\Acer GameZone\GameConsole "{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable "{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 "{77DCDCE3-2DED-62F3-8154-05E745472D07}" = Acrobat.com "{79DD56FC-DB8B-47F5-9C80-78B62E05F9BC}" = Acer ScreenSaver "{7B9CC60A-9B81-46A3-A953-76B6BF9EEC97}" = Age of Empires III "{7CFA46E3-CC2F-4355-82AE-6012DC3633FD}" = NVIDIA ForceWare Network Access Manager "{7F811A54-5A09-4579-90E1-C93498E230D9}" = Acer eRecovery Management "{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-110082360}" = Alien Shooter "{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-111307457}" = Galapago "{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-111796363}" = Mystery Solitaire - Secret Island "{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-111940693}" = Bookworm Adventures "{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-112920767}" = Alice Greenfingers "{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-113786380}" = Heroes of Hellas "{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-113832110}" = Dream Day First Home "{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-114072167}" = Go-Go Gourmet "{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-114717227}" = Magic Farm "{86D4B82A-ABED-442A-BE86-96357B70F4FE}" = Ask Toolbar "{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight "{8F1B6239-FEA0-450A-A950-B05276CE177C}" = Acer Empowering Technology "{8FFC5648-FAF8-43A3-BC8F-42BA1E275C4E}" = Choice Guard "{90120000-0016-0409-0000-0000000FF1CE}" = Microsoft Office Excel MUI (English) 2007 "{90120000-0016-0409-0000-0000000FF1CE}_HOMESTUDENTR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2) "{90120000-0018-0409-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (English) 2007 "{90120000-0018-0409-0000-0000000FF1CE}_HOMESTUDENTR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2) "{90120000-001B-0409-0000-0000000FF1CE}" = Microsoft Office Word MUI (English) 2007 "{90120000-001B-0409-0000-0000000FF1CE}_HOMESTUDENTR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2) "{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007 "{90120000-001F-0409-0000-0000000FF1CE}_HOMESTUDENTR_{ABDDE972-355B-4AF1-89A8-DA50B7B5C045}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2) "{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007 "{90120000-001F-040C-0000-0000000FF1CE}_HOMESTUDENTR_{F580DDD5-8D37-4998-968E-EBB76BB86787}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2) "{90120000-001F-0C0A-0000-0000000FF1CE}" = Microsoft Office Proof (Spanish) 2007 "{90120000-001F-0C0A-0000-0000000FF1CE}_HOMESTUDENTR_{187308AB-5FA7-4F14-9AB9-D290383A10D9}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2) "{90120000-002C-0409-0000-0000000FF1CE}" = Microsoft Office Proofing (English) 2007 "{90120000-006E-0409-0000-0000000FF1CE}" = Microsoft Office Shared MUI (English) 2007 "{90120000-006E-0409-0000-0000000FF1CE}_HOMESTUDENTR_{DE5A002D-8122-4278-A7EE-3121E7EA254E}" = Microsoft Office 2007 Service Pack 2 (SP2) "{90120000-00A1-0409-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (English) 2007 "{90120000-00A1-0409-0000-0000000FF1CE}_HOMESTUDENTR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2) "{90120000-0115-0409-0000-0000000FF1CE}" = Microsoft Office Shared Setup Metadata MUI (English) 2007 "{90120000-0115-0409-0000-0000000FF1CE}_HOMESTUDENTR_{DE5A002D-8122-4278-A7EE-3121E7EA254E}" = Microsoft Office 2007 Service Pack 2 (SP2) "{90280409-6000-11D3-8CFE-0050048383C9}" = Microsoft Office XP Professional with FrontPage "{91120000-002F-0000-0000-0000000FF1CE}" = Microsoft Office Home and Student 2007 "{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{0B36C6D6-F5D8-4EAF-BF94-4376A230AD5B}" = Microsoft Office 2007 Service Pack 2 (SP2) "{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{3D019598-7B59-447A-80AE-815B703B84FF}" = Security Update for Microsoft Office system 2007 (972581) "{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting "{A5633652-3795-4829-BB0B-644F0279E279}" = Acer eDataSecurity Management "{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper "{AA4BF92B-2AAF-11DA-9D78-000129760D75}" = Acer HomeMedia "{AADEA55D-C834-4BCB-98A3-4B8D1C18F4EE}" = Apple Mobile Device Support "{AC76BA86-7AD7-1033-7B44-A90000000001}" = Adobe Reader 9 "{B0E5D7E7-A106-458F-BA7B-2F8CAEA3BF16}" = PlayReady PC runtime "{B145EC69-66F5-11D8-9D75-000129760D75}" = Acer DVDivine "{B580C409-E16F-44FF-904D-3AE94E113BE0}" = Acer HomeMedia Trial Creator "{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1 "{D9D754A1-EAC5-406C-A28B-C49B1E846711}" = Windows Live Essentials "{E50AE784-FABE-46DA-A1F8-7B6B56DCB22E}" = Microsoft Office Suite Activation Assistant "{EFBDC2B0-FAA8-4B78-8DE1-AEBE7958FA37}" = Acer Arcade Live Main Page "{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}" = Microsoft SQL Server 2005 Compact Edition [ENU] "{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver "{F429ED71-4A8B-457A-85E4-F6398CE73E58}" = AV Input Selection "{F439D7AF-03F3-4F8E-AEC4-571BFE977C61}" = iTunes "{F69E83CF-B440-43F8-89E6-6EA80712109B}" = Windows Live Communications Platform "{F6EFFB76-4A07-11DA-9D78-000129760D75}" = Acer DV Magician "{F73A5B18-EB75-4B2C-B32D-9457576E2417}" = Windows Live Photo Gallery "{F79A208D-D929-11D9-9D77-000129760D75}" = Acer VideoMagician "Acer Assist" = Acer Assist "Acer Registration" = Acer Registration "Adobe AIR" = Adobe AIR "Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin "Agere Systems Soft Modem" = Agere Systems PCI-SV92EX Soft Modem "com.adobe.mauby.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1" = Acrobat.com "ERUNT_is1" = ERUNT 1.1j "HijackThis" = HijackThis 2.0.2 "HOMESTUDENTR" = Microsoft Office Home and Student 2007 "InstallShield_{12EFA1A4-AC3B-443C-8143-237EDE760403}" = NTI Backup Now 5 "InstallShield_{15D967B5-A4BE-42AE-9E84-64CD062B25AA}" = eSobi v2 "InstallShield_{2413930C-8309-47A6-BC61-5EF27A4222BC}" = NTI Media Maker 8 "InstallShield_{7B9CC60A-9B81-46A3-A953-76B6BF9EEC97}" = Age of Empires III "InstallShield_{7CFA46E3-CC2F-4355-82AE-6012DC3633FD}" = NVIDIA ForceWare Network Access Manager "Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware "Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1 "Mozilla Firefox (3.6.3)" = Mozilla Firefox (3.6.3) "MSC" = McAfee SecurityCenter "NVIDIA Drivers" = NVIDIA Drivers "Privacy Guardian_is1" = Privacy Guardian 4.1 "WinLiveSuite_Wave3" = Windows Live Essentials "Yahoo! Messenger" = Yahoo! Messenger "Yahoo! Software Update" = Yahoo! Software Update ========== HKEY_CURRENT_USER Uninstall List ========== [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall] "Hide The IP 2010" = Hide The IP 2010 ========== Last 10 Event Log Errors ========== [ Application Events ] Error - 4/10/2010 12:13:06 PM \| Computer Name = Donald-PC \| Source = MsiInstaller \| ID = 1024 Description = Error - 4/10/2010 12:13:34 PM \| Computer Name = Donald-PC \| Source = MsiInstaller \| ID = 11606 Description = Error - 4/10/2010 12:13:34 PM \| Computer Name = Donald-PC \| Source = MsiInstaller \| ID = 11606 Description = Error - 4/10/2010 12:13:34 PM \| Computer Name = Donald-PC \| Source = MsiInstaller \| ID = 1024 Description = Error - 4/10/2010 12:14:02 PM \| Computer Name = Donald-PC \| Source = MsiInstaller \| ID = 11606 Description = Error - 4/10/2010 12:14:02 PM \| Computer Name = Donald-PC \| Source = MsiInstaller \| ID = 11606 Description = Error - 4/10/2010 12:14:02 PM \| Computer Name = Donald-PC \| Source = MsiInstaller \| ID = 1024 Description = Error - 4/10/2010 12:14:30 PM \| Computer Name = Donald-PC \| Source = MsiInstaller \| ID = 11606 Description = Error - 4/10/2010 12:14:30 PM \| Computer Name = Donald-PC \| Source = MsiInstaller \| ID = 11606 Description = Error - 4/10/2010 12:14:30 PM \| Computer Name = Donald-PC \| Source = MsiInstaller \| ID = 1024 Description = [ System Events ] Error - 4/28/2010 11:18:55 PM \| Computer Name = Donald-PC \| Source = Microsoft-Windows-WindowsUpdateClient \| ID = 20 Description = Error - 4/28/2010 11:19:24 PM \| Computer Name = Donald-PC \| Source = Microsoft-Windows-WindowsUpdateClient \| ID = 20 Description = Error - 4/28/2010 11:19:57 PM \| Computer Name = Donald-PC \| Source = Microsoft-Windows-WindowsUpdateClient \| ID = 20 Description = Error - 4/28/2010 11:20:25 PM \| Computer Name = Donald-PC \| Source = Microsoft-Windows-WindowsUpdateClient \| ID = 20 Description = Error - 4/28/2010 11:20:53 PM \| Computer Name = Donald-PC \| Source = Microsoft-Windows-WindowsUpdateClient \| ID = 20 Description = Error - 4/28/2010 11:21:24 PM \| Computer Name = Donald-PC \| Source = Microsoft-Windows-WindowsUpdateClient \| ID = 20 Description = Error - 4/28/2010 11:25:26 PM \| Computer Name = Donald-PC \| Source = Microsoft-Windows-WindowsUpdateClient \| ID = 20 Description = Error - 4/28/2010 11:39:40 PM \| Computer Name = Donald-PC \| Source = Service Control Manager \| ID = 7026 Description = Error - 4/29/2010 1:12:20 AM \| Computer Name = Donald-PC \| Source = EventLog \| ID = 6008 Description = The previous system shutdown at 10:10:53 PM on 4/28/2010 was unexpected. Error - 4/29/2010 1:13:34 AM \| Computer Name = Donald-PC \| Source = Service Control Manager \| ID = 7026 Description = < End of report >

Rorschach112 View Member Profile Find Member's Posts	May 16 2010, 12:41 PM Post #2
Malware Expert Group: Experts Posts: 797 Joined: 7-July 08 Member No.: 3,889	got the ckscanner, mbam and locksearch logs ? Please download OTM Save it to your desktop. Please double-click OTM to run it. (Note: If you are running on Vista, right-click on the file and choose Run As Administrator). Copy the lines in the codebox below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose Copy): CODE :Processes :Services :Reg :Files C:\PROGRA~2\MICROS~1\Windows\STARTM~1\Programs\Privacy Guardian C:\PROGRA~1\Privacy Guardian :Commands [purity] [resethosts] [emptytemp] [CREATERESTOREPOINT] [EMPTYFLASH] [Reboot] Return to OTM, right click in the "Paste Instructions for Items to be Moved" window (under the yellow bar) and choose Paste. Click the red Moveit! button. Copy everything in the Results window (under the green bar) to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy), and paste it in your next reply. Close OTM and reboot your PC. Note: If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes. In this case, after the reboot, open Notepad (Start->All Programs->Accessories->Notepad), click File->Open, in the File Name box enter .log and press the Enter key, navigate to the C:\_OTMoveIt\MovedFiles* folder, and open the newest .log file present, and copy/paste the contents of that document back here in your next post. Download TFC to your desktop Open the file and close any other windows. It will close all programs itself when run, make sure to let it run uninterrupted. Click the Start button to begin the process. The program should not take long to finish its job Once its finished it should reboot your machine, if not, do this yourself to ensure a complete clean Please download Malwarebytes' Anti-Malware from Here Double Click mbam-setup.exe to install the application. Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish. If an update is found, it will download and install the latest version. Once the program has loaded, select "Perform Quick Scan", then click Scan. The scan may take some time to finish,so please be patient. When the scan is complete, click OK, then Show Results to view the results. Make sure that everything is checked, and click Remove Selected. When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note) The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM. Copy&Paste the entire report in your next reply. Extra Note: If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process,if asked to restart the computer,please do so immediatly. Go to Kaspersky website and perform an online antivirus scan. Read through the requirements and privacy statement and click on Accept button. It will start downloading and installing the scanner and virus definitions. You will be prompted to install an application from Kaspersky. Click Run. When the downloads have finished, click on Settings. Make sure these boxes are checked (ticked). If they are not, please tick them and click on the Save button: Spyware, Adware, Dialers, and other potentially dangerous programs Archives Mail databases Click on My Computer under Scan. Once the scan is complete, it will display the results. Click on View Scan Report. You will see a list of infected items there. Click on Save Report As.... Save this report to a convenient place. Change the Files of type to Text file (.txt) before clicking on the Save button. Then post it here. -------------------- By the power of truth, I, while living, have conquered the universe. ~Scratch~ My help is always free, but if you want to donate to help me continue my fight against malware then click here

soycarne View Member Profile Find Member's Posts	May 16 2010, 07:42 PM Post #3
Newbie Group: Members+ Posts: 8 Joined: 29-April 10 Member No.: 5,486	QUOTE(Rorschach112 @ May 16 2010, 12:41 PM) got the ckscanner, mbam and locksearch logs ? Please download OTM Save it to your desktop. Please double-click OTM to run it. (Note: If you are running on Vista, right-click on the file and choose Run As Administrator). Copy the lines in the codebox below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose Copy): CODE :Processes :Services :Reg :Files C:\PROGRA~2\MICROS~1\Windows\STARTM~1\Programs\Privacy Guardian C:\PROGRA~1\Privacy Guardian :Commands [purity] [resethosts] [emptytemp] [CREATERESTOREPOINT] [EMPTYFLASH] [Reboot] Return to OTM, right click in the "Paste Instructions for Items to be Moved" window (under the yellow bar) and choose Paste. Click the red Moveit! button. Copy everything in the Results window (under the green bar) to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy), and paste it in your next reply. Close OTM and reboot your PC. Note: If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes. In this case, after the reboot, open Notepad (Start->All Programs->Accessories->Notepad), click File->Open, in the File Name box enter .log and press the Enter key, navigate to the C:\_OTMoveIt\MovedFiles* folder, and open the newest .log file present, and copy/paste the contents of that document back here in your next post. Download TFC to your desktop Open the file and close any other windows. It will close all programs itself when run, make sure to let it run uninterrupted. Click the Start button to begin the process. The program should not take long to finish its job Once its finished it should reboot your machine, if not, do this yourself to ensure a complete clean Please download Malwarebytes' Anti-Malware from Here Double Click mbam-setup.exe to install the application. Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish. If an update is found, it will download and install the latest version. Once the program has loaded, select "Perform Quick Scan", then click Scan. The scan may take some time to finish,so please be patient. When the scan is complete, click OK, then Show Results to view the results. Make sure that everything is checked, and click Remove Selected. When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note) The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM. Copy&Paste the entire report in your next reply. Extra Note: If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process,if asked to restart the computer,please do so immediatly. Go to Kaspersky website and perform an online antivirus scan. Read through the requirements and privacy statement and click on Accept button. It will start downloading and installing the scanner and virus definitions. You will be prompted to install an application from Kaspersky. Click Run. When the downloads have finished, click on Settings. Make sure these boxes are checked (ticked). If they are not, please tick them and click on the Save button: Spyware, Adware, Dialers, and other potentially dangerous programs Archives Mail databases Click on My Computer under Scan. Once the scan is complete, it will display the results. Click on View Scan Report. You will see a list of infected items there. Click on Save Report As.... Save this report to a convenient place. Change the Files of type to Text file (.txt) before clicking on the Save button. Then post it here. Here's the first requested log. Others to follow soon: All processes killed ========== PROCESSES ========== ========== SERVICES/DRIVERS ========== ========== REGISTRY ========== ========== FILES ========== C:\PROGRA~2\MICROS~1\Windows\STARTM~1\Programs\Privacy Guardian folder moved successfully. C:\PROGRA~1\Privacy Guardian\~tmp folder moved successfully. C:\PROGRA~1\Privacy Guardian\Shredder folder moved successfully. C:\PROGRA~1\Privacy Guardian\ref folder moved successfully. C:\PROGRA~1\Privacy Guardian\LuLng folder moved successfully. C:\PROGRA~1\Privacy Guardian\CleanLogs folder moved successfully. C:\PROGRA~1\Privacy Guardian\AppLogs folder moved successfully. C:\PROGRA~1\Privacy Guardian folder moved successfully. ========== COMMANDS ========== C:\Windows\System32\drivers\etc\Hosts moved successfully. HOSTS file reset successfully [EMPTYTEMP] User: All Users User: Aza ->Temp folder emptied: 374367 bytes ->Temporary Internet Files folder emptied: 12386166 bytes ->Java cache emptied: 0 bytes ->FireFox cache emptied: 29892721 bytes ->Flash cache emptied: 434 bytes User: Default ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 33170 bytes User: Default User ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes User: Donald ->Temp folder emptied: 2948253 bytes ->Temporary Internet Files folder emptied: 200818 bytes ->Java cache emptied: 12117938 bytes ->FireFox cache emptied: 35595149 bytes ->Flash cache emptied: 11344 bytes User: Guest ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes ->Flash cache emptied: 0 bytes User: Public %systemdrive% .tmp files removed: 0 bytes %systemroot% .tmp files removed: 0 bytes %systemroot%\System32 .tmp files removed: 0 bytes %systemroot%\System32\drivers .tmp files removed: 0 bytes Windows Temp folder emptied: 202076 bytes %systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 0 bytes %systemroot%\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 33170 bytes %systemroot%\system32\config\systemprofile\AppData\LocalLow\Sun\Java\Deployment folder emptied: 0 bytes RecycleBin emptied: 0 bytes Total Files Cleaned = 89.00 mb Restore point Set: OTM Restore Point OTM by OldTimer - Version 3.1.12.0 log created on 05162010_122203 Files moved on Reboot... File move failed. C:\Windows\temp\CLDigitalHome\CLMS_AGENT_LOG1.txt scheduled to be moved on reboot. File move failed. C:\Windows\temp\CLDigitalHome\PCMMediaServer.log scheduled to be moved on reboot. File C:\Windows\temp\mcmsc_gHvWvPkfkHDU6Lx not found! File C:\Windows\temp\mcmsc_peqgVAI4Gghs7Jm not found! File C:\Windows\temp\sqlite_5ROc4C3zhMRgoNh not found! File C:\Windows\temp\sqlite_OtQKY5HGDfFhyvi not found! File C:\Windows\temp\sqlite_y7CxaujlV0o7DOb not found! File C:\Windows\temp\sqlite_ze3xKE3HKYaPQiJ not found! Registry entries deleted on Reboot...

soycarne View Member Profile Find Member's Posts	May 16 2010, 08:09 PM Post #4
Newbie Group: Members+ Posts: 8 Joined: 29-April 10 Member No.: 5,486	QUOTE(soycarne @ May 16 2010, 07:42 PM) Here's the first requested log. Others to follow soon: All processes killed ========== PROCESSES ========== ========== SERVICES/DRIVERS ========== ========== REGISTRY ========== ========== FILES ========== C:\PROGRA~2\MICROS~1\Windows\STARTM~1\Programs\Privacy Guardian folder moved successfully. C:\PROGRA~1\Privacy Guardian\~tmp folder moved successfully. C:\PROGRA~1\Privacy Guardian\Shredder folder moved successfully. C:\PROGRA~1\Privacy Guardian\ref folder moved successfully. C:\PROGRA~1\Privacy Guardian\LuLng folder moved successfully. C:\PROGRA~1\Privacy Guardian\CleanLogs folder moved successfully. C:\PROGRA~1\Privacy Guardian\AppLogs folder moved successfully. C:\PROGRA~1\Privacy Guardian folder moved successfully. ========== COMMANDS ========== C:\Windows\System32\drivers\etc\Hosts moved successfully. HOSTS file reset successfully [EMPTYTEMP] User: All Users User: Aza ->Temp folder emptied: 374367 bytes ->Temporary Internet Files folder emptied: 12386166 bytes ->Java cache emptied: 0 bytes ->FireFox cache emptied: 29892721 bytes ->Flash cache emptied: 434 bytes User: Default ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 33170 bytes User: Default User ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes User: Donald ->Temp folder emptied: 2948253 bytes ->Temporary Internet Files folder emptied: 200818 bytes ->Java cache emptied: 12117938 bytes ->FireFox cache emptied: 35595149 bytes ->Flash cache emptied: 11344 bytes User: Guest ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes ->Flash cache emptied: 0 bytes User: Public %systemdrive% .tmp files removed: 0 bytes %systemroot% .tmp files removed: 0 bytes %systemroot%\System32 .tmp files removed: 0 bytes %systemroot%\System32\drivers .tmp files removed: 0 bytes Windows Temp folder emptied: 202076 bytes %systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 0 bytes %systemroot%\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 33170 bytes %systemroot%\system32\config\systemprofile\AppData\LocalLow\Sun\Java\Deployment folder emptied: 0 bytes RecycleBin emptied: 0 bytes Total Files Cleaned = 89.00 mb Restore point Set: OTM Restore Point OTM by OldTimer - Version 3.1.12.0 log created on 05162010_122203 Files moved on Reboot... File move failed. C:\Windows\temp\CLDigitalHome\CLMS_AGENT_LOG1.txt scheduled to be moved on reboot. File move failed. C:\Windows\temp\CLDigitalHome\PCMMediaServer.log scheduled to be moved on reboot. File C:\Windows\temp\mcmsc_gHvWvPkfkHDU6Lx not found! File C:\Windows\temp\mcmsc_peqgVAI4Gghs7Jm not found! File C:\Windows\temp\sqlite_5ROc4C3zhMRgoNh not found! File C:\Windows\temp\sqlite_OtQKY5HGDfFhyvi not found! File C:\Windows\temp\sqlite_y7CxaujlV0o7DOb not found! File C:\Windows\temp\sqlite_ze3xKE3HKYaPQiJ not found! Registry entries deleted on Reboot... Malwarebytes' Anti-Malware 1.46 www.malwarebytes.org Database version: 4052 Windows 6.0.6002 Service Pack 2 Internet Explorer 8.0.6001.18904 5/16/2010 1:00:39 PM mbam-log-2010-05-16 (13-00-39).txt Scan type: Quick scan Objects scanned: 136407 Time elapsed: 5 minute(s), 57 second(s) Memory Processes Infected: 0 Memory Modules Infected: 0 Registry Keys Infected: 0 Registry Values Infected: 0 Registry Data Items Infected: 0 Folders Infected: 0 Files Infected: 0 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: (No malicious items detected) Registry Keys Infected: (No malicious items detected) Registry Values Infected: (No malicious items detected) Registry Data Items Infected: (No malicious items detected) Folders Infected: (No malicious items detected) Files Infected: (No malicious items detected) *Kaspersky won't let me run the scan because it says "Please enable browser support for Java and JavaScript." I suspect whatever virus/malware I have has attacked Java and Javascript because I have seen other pop-up windows come up regarding Java. Is there anything else I can do or post here?

soycarne View Member Profile Find Member's Posts	May 16 2010, 08:22 PM Post #5
Newbie Group: Members+ Posts: 8 Joined: 29-April 10 Member No.: 5,486	QUOTE(soycarne @ May 16 2010, 08:09 PM) Malwarebytes' Anti-Malware 1.46 www.malwarebytes.org Database version: 4052 Windows 6.0.6002 Service Pack 2 Internet Explorer 8.0.6001.18904 5/16/2010 1:00:39 PM mbam-log-2010-05-16 (13-00-39).txt Scan type: Quick scan Objects scanned: 136407 Time elapsed: 5 minute(s), 57 second(s) Memory Processes Infected: 0 Memory Modules Infected: 0 Registry Keys Infected: 0 Registry Values Infected: 0 Registry Data Items Infected: 0 Folders Infected: 0 Files Infected: 0 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: (No malicious items detected) Registry Keys Infected: (No malicious items detected) Registry Values Infected: (No malicious items detected) Registry Data Items Infected: (No malicious items detected) Folders Infected: (No malicious items detected) Files Infected: (No malicious items detected) *Kaspersky won't let me run the scan because it says "Please enable browser support for Java and JavaScript." I suspect whatever virus/malware I have has attacked Java and Javascript because I have seen other pop-up windows come up regarding Java. Is there anything else I can do or post here? Note: I installed the recommended Java plugins that came up on the Kaspersky website. The download appeared to be successful and I even restarted my computer but the same message "Please enable browser support for Java and JavaScript" comes up.

Rorschach112 View Member Profile Find Member's Posts	May 16 2010, 10:32 PM Post #6
Malware Expert Group: Experts Posts: 797 Joined: 7-July 08 Member No.: 3,889	got the ckscanner and locksearch logs ? -------------------- By the power of truth, I, while living, have conquered the universe. ~Scratch~ My help is always free, but if you want to donate to help me continue my fight against malware then click here

soycarne View Member Profile Find Member's Posts	May 17 2010, 08:16 AM Post #7
Newbie Group: Members+ Posts: 8 Joined: 29-April 10 Member No.: 5,486	QUOTE(Rorschach112 @ May 16 2010, 10:32 PM) got the ckscanner and locksearch logs ? OK. Sorry for the delay. I didn't see instructions for those two programs on the "Read This First" post but I managed to get the logs. Here they are: CKScanner - Additional Security Risks - These are not necessarily bad c:\program files\acer gamezone\go-go gourmet\sound\firecracks.ogg scanner sequence 3.NA.11 ----- EOF ----- LockSearch by jpshortstuff (05.11.09.1) Log created at 01:04 on 17/05/2010 (Donald) Scanning C:\ C:\hiberfil.sys ------------------------- C:\pagefile.sys ------------------------- -=E.O.F=-

Rorschach112 View Member Profile Find Member's Posts	May 17 2010, 10:45 AM Post #8
Malware Expert Group: Experts Posts: 797 Joined: 7-July 08 Member No.: 3,889	* Go here to run an online scannner from ESET. Note: You will need to use Internet explorer for this scan Tick the box next to YES, I accept the Terms of Use. Click Start When asked, allow the activex control to install Click Start Check next options: Remove found threats and Scan unwanted applications. Click Scan Wait for the scan to finish Use notepad to open the logfile located at C:\Program Files\ESET\ESET Online Scanner\log.txt Copy and paste that log as a reply to this topic -------------------- By the power of truth, I, while living, have conquered the universe. ~Scratch~ My help is always free, but if you want to donate to help me continue my fight against malware then click here

soycarne View Member Profile Find Member's Posts	May 20 2010, 03:44 AM Post #9
Newbie Group: Members+ Posts: 8 Joined: 29-April 10 Member No.: 5,486	ESETSmartInstaller@High as CAB hook log: OnlineScanner.ocx - registred OK

Rorschach112 View Member Profile Find Member's Posts	May 20 2010, 11:18 AM Post #10
Malware Expert Group: Experts Posts: 797 Joined: 7-July 08 Member No.: 3,889	Your logs are clean *Set a New Restore Point to prevent possible reinfection* from an old one. Some of the malware you picked up could have been saved in System Restore. Since System Restore is a protected directory, your tools can not access it to delete these bad files which sometimes can reinfect your system. Setting a new restore point AFTER cleaning your system will help prevent this and enable your computer to "roll-back" to a clean working state. The easiest and safest way to do this is: 1. Create a new Restore Point Click on the Start button to open your Start Menu. Click on the Control Panel menu option. Click on the System and Maintenance menu option. Click on the System menu option. Click on System Protection in the left-hand task list. Create the manual restore point you should click on the Create button. When you press this button a prompt will appear asking you to provide a title for this manual restore point. Type in a title for the manual restore point and press the Create button. Close the System window after you have been advised that the procedure has been successfully completed. . 2. Clear your existing system restore points except for the new clean restore point you just created: Go to Start > Run and type in cleanmgr Select the More options tab Next to System Restore click Clean up This will remove all restore points except the new one you just created. Open OTL Under the Custom Scans/Fixes box at the bottom, paste the following: CODE :Commands [clearallrestorepoints] Click the Run Fix button at the top It might ask you to reboot, if so click YES Open OTL to run it. (Vista users, right click on OTL and "Run as administrator") Click on the CleanUp button. Click Yes to begin the cleanup process and remove tools, including this application You may be asked to reboot the machine to finish the cleanup process - if so, choose Yes Please read my guide on how to prevent malware and about safe computing here** Thank you for your patience, and performing all of the procedures requested. -------------------- By the power of truth, I, while living, have conquered the universe. ~Scratch~ My help is always free, but if you want to donate to help me continue my fight against malware then click here

soycarne View Member Profile Find Member's Posts	May 20 2010, 04:01 PM Post #11
Newbie Group: Members+ Posts: 8 Joined: 29-April 10 Member No.: 5,486	My problems still remain. I can't log onto any site that requires a password.

Rorschach112 View Member Profile Find Member's Posts	May 20 2010, 08:19 PM Post #12
Malware Expert Group: Experts Posts: 797 Joined: 7-July 08 Member No.: 3,889	what browser does it happen in ? -------------------- By the power of truth, I, while living, have conquered the universe. ~Scratch~ My help is always free, but if you want to donate to help me continue my fight against malware then click here

soycarne View Member Profile Find Member's Posts	May 21 2010, 07:44 PM Post #13
Newbie Group: Members+ Posts: 8 Joined: 29-April 10 Member No.: 5,486	Explorer and Firefox

Rorschach112 View Member Profile Find Member's Posts	May 22 2010, 10:18 AM Post #14
Malware Expert Group: Experts Posts: 797 Joined: 7-July 08 Member No.: 3,889	reinstall firefox, it work normally then ? if not, boot into safe mode with networking, it work normally then ? -------------------- By the power of truth, I, while living, have conquered the universe. ~Scratch~ My help is always free, but if you want to donate to help me continue my fight against malware then click here

« Next Oldest · PC Cleanup · Next Newest »

Reply to this topic

Start new topic

2 User(s) are reading this topic (2 Guests and 0 Anonymous Users)

0 Members:

Display Mode: Standard · Switch to: Linear+ · Switch to: Outline

Track this topic · Email this topic · Print this topic · Subscribe to this forum

Lo-Fi Version

Time is now: 9th September 2010 - 05:25 PM

Powered By IP.Board 2.2.1 © 2010 IPS, Inc.