ComboFix 10-03-26.02 - Luke 03/26/2010 18:57:01.1.1 - x86 Microsoft Windows 7 Ultimate 6.1.7600.0.1252.1.1033.18.1023.490 [GMT -4:00] Running from: C:\Users\[removed]\Desktop\ComboFix.exe * Created a new restore point . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\$RECYCLE.BIN\S-1-5-21-3273455095-3707038803-153338724-1001 C:\Program Files\Cheat Engine\dbk32.sys C:\Users\Luke\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MagicDisc.lnk C:\Windows\system32\SIntf16.dll Infected copy of C:\Windows\system32\DRIVERS\atapi.sys was found and disinfected Restored copy from - Kitty ate it :p . ((((((((((((((((((((((((( Files Created from 2010-02-26 to 2010-03-26 ))))))))))))))))))))))))))))))) . 2010-03-26 23:09:21 . 2010-03-26 23:19:38 -------- d-----w- C:\Users\Luke\AppData\Local\temp 2010-03-26 23:09:21 . 2010-03-26 23:09:21 -------- d-----w- C:\Users\Mcx1-LUKE-PC\AppData\Local\temp 2010-03-26 23:09:21 . 2010-03-26 23:09:21 -------- d-----w- C:\Users\Guest\AppData\Local\temp 2010-03-26 23:09:21 . 2010-03-26 23:09:21 -------- d-----w- C:\Users\Default\AppData\Local\temp 2010-03-25 23:51:09 . 2010-02-10 17:13:48 165376 ----a-w- C:\Windows\system32\unrar.dll 2010-03-25 23:51:06 . 2004-01-25 16:18:44 217088 ----a-w- C:\Windows\system32\yv12vfw.dll 2010-03-25 23:51:05 . 2009-05-29 21:37:40 205824 ----a-w- C:\Windows\system32\xvidvfw.dll 2010-03-25 23:51:05 . 2009-05-29 21:31:52 881664 ----a-w- C:\Windows\system32\xvidcore.dll 2010-03-25 23:50:57 . 2010-03-14 18:00:00 85504 ----a-w- C:\Windows\system32\ff_vfw.dll 2010-03-25 23:50:53 . 2010-03-25 23:51:50 -------- d-----w- C:\Program Files\K-Lite Codec Pack 2010-03-23 01:13:36 . 2010-03-23 01:13:51 -------- d-----w- C:\Program Files\R4 2010-03-22 22:48:03 . 2010-03-22 22:48:43 -------- d-----w- C:\Program Files\QuickTime 2010-03-22 03:21:30 . 2010-03-22 03:21:27 95024 ----a-w- C:\Windows\system32\drivers\SBREDrv.sys 2010-03-22 03:18:26 . 2010-03-25 21:52:14 -------- d-----w- C:\ProgramData\Lavasoft 2010-03-21 22:06:28 . 2010-03-21 22:06:28 -------- d-----w- C:\Users\Luke\AppData\Roaming\ImgBurn 2010-03-21 21:59:56 . 2010-03-21 22:00:02 -------- d-----w- C:\Program Files\ImgBurn 2010-03-21 05:43:37 . 2010-03-24 04:43:46 -------- d-----w- C:\Downloads 2010-03-21 01:14:48 . 2010-03-21 01:14:48 -------- d-----w- C:\Program Files\Trend Micro 2010-03-20 21:13:12 . 2010-03-20 21:13:12 1022544 ----a-w- C:\Users\Luke\AppData\Roaming\DisplayFusion\DisplayFusionSetup.exe 2010-03-20 20:24:12 . 2010-03-20 20:24:16 -------- d-----w- C:\Windows\A8B9466986544126BD28D0D2412CDED6.TMP 2010-03-20 19:55:34 . 2010-03-20 19:55:39 -------- d-----w- C:\ProgramData\SUPERAntiSpyware.com 2010-03-19 02:37:47 . 2010-03-19 02:37:47 -------- d-----w- C:\Users\Luke\AppData\Roaming\Malwarebytes 2010-03-19 02:37:19 . 2010-03-19 02:37:19 -------- d-----w- C:\ProgramData\Malwarebytes 2010-03-19 02:06:13 . 2010-03-19 02:08:16 -------- d-----w- C:\Users\Luke\AppData\Roaming\TrueCrypt 2010-03-19 02:05:44 . 2010-03-19 02:05:44 -------- d-----w- C:\ProgramData\TrueCrypt 2010-03-19 02:05:36 . 2010-03-19 02:05:36 223440 ----a-w- C:\Windows\system32\drivers\truecrypt.sys 2010-03-19 02:05:35 . 2010-03-19 02:05:36 -------- d-----w- C:\Program Files\TrueCrypt 2010-03-17 00:58:03 . 2010-03-17 00:58:03 -------- d-----w- C:\Users\Luke\AppData\Local\Opera 2010-03-17 00:57:46 . 2010-03-17 00:57:50 -------- d-----w- C:\Program Files\Opera 2010-03-16 23:47:04 . 2010-03-16 23:47:04 7168 ----a-w- C:\Users\Luke\AppData\Roaming\Thinstall\CuteFTP 8 Professional\40000035700002i\cuteftppro.exe 2010-03-16 23:18:20 . 2010-03-16 23:18:20 -------- d-----w- C:\Users\Luke\AppData\Roaming\Thinstall 2010-03-16 23:18:20 . 2010-03-16 23:18:20 -------- d-----w- C:\Users\Luke\AppData\Local\Thinstall 2010-03-16 23:07:52 . 2010-03-21 14:20:34 -------- d-----w- C:\Program Files\Xlight 2010-03-16 23:07:52 . 2010-03-16 23:07:52 -------- d-----w- C:\Windows\system32\embedded 2010-03-16 20:33:58 . 2010-03-16 23:10:30 -------- d-----w- C:\Users\Luke\AppData\Roaming\FileZilla 2010-03-16 17:48:52 . 2010-03-16 17:48:52 -------- d-----w- C:\Users\Luke\AppData\Roaming\TightVNC 2010-03-06 22:12:19 . 2010-03-06 22:12:19 -------- d-----w- C:\Users\Luke\AppData\Roaming\dBpoweramp 2010-03-06 16:47:22 . 2010-03-06 16:47:22 177024 ----a-w- C:\Users\Luke\AppData\Roaming\Mozilla\Firefox\Profiles\f1l2kbu1.default\FlashGot.exe 2010-03-06 15:38:25 . 2010-03-26 22:53:35 -------- d-----w- C:\Users\Luke\AppData\Roaming\Free Download Manager 2010-03-06 15:38:21 . 2010-03-06 15:38:21 -------- d-----w- C:\ProgramData\FreeDownloadManager.ORG 2010-03-06 15:38:20 . 2010-03-06 15:42:12 -------- d-----w- C:\Program Files\Free Download Manager 2010-03-06 15:03:50 . 2010-03-06 15:04:30 -------- d-----w- C:\Program Files\Common Files\DivX Shared 2010-03-06 15:03:49 . 2010-03-06 15:04:44 -------- d-----w- C:\Program Files\DivX 2010-03-05 21:16:55 . 2010-03-05 21:35:25 -------- d-----w- C:\Users\Luke\AppData\Roaming\CD Art Display 2010-03-05 21:16:50 . 2009-09-06 01:28:40 69632 ----a-w- C:\Windows\cadSSaver.scr 2010-03-05 21:16:50 . 2003-01-27 19:27:26 94208 ----a-w- C:\Windows\system32\wmpuice.dll 2010-03-05 21:16:48 . 2010-03-05 21:55:17 -------- d-----w- C:\Program Files\CD Art Display 2010-03-04 02:41:08 . 2010-03-04 02:46:12 -------- d-----w- C:\Users\Luke\AppData\Roaming\Mp3tag 2010-03-04 02:41:02 . 2010-03-04 02:41:04 -------- d-----w- C:\Program Files\Mp3tag 2010-03-03 04:11:24 . 2010-03-03 04:11:58 -------- d-----w- C:\Users\Luke\AppData\Roaming\HpUpdate 2010-03-03 04:11:10 . 2010-03-03 04:11:10 -------- d-----w- C:\Windows\Hewlett-Packard 2010-03-02 02:18:59 . 2010-03-02 02:55:15 2613248 ----a-w- C:\Windows\explorer.exe 2010-03-02 02:18:59 . 2009-11-16 16:01:24 2613248 ----a-w- C:\Windows\explorer Backup.exe 2010-03-02 02:17:49 . 2009-07-14 01:14:20 2613248 ----a-w- C:\Windows\explorer - Copy.exe 2010-03-01 21:00:31 . 2010-03-01 21:00:31 -------- d-----w- C:\Program Files\RocketDock1 2010-03-01 03:42:36 . 2010-03-01 03:42:49 -------- d-----w- C:\Users\Luke\AppData\Roaming\Launchy 2010-03-01 03:29:07 . 2010-03-01 03:29:07 -------- d-----w- C:\Program Files\StartKiller 2010-02-28 23:46:26 . 2010-02-28 23:46:26 495104 ----a-w- C:\Windows\system32\sqlite3.dll 2010-02-28 23:42:35 . 2010-03-01 02:12:54 -------- d-----w- C:\Users\Luke\AppData\Roaming\Rainmeter 2010-02-28 22:56:34 . 2010-02-28 22:56:34 -------- d-----w- C:\Program Files\Microsoft 2010-02-28 19:24:57 . 2010-03-01 21:00:02 -------- d-----w- C:\Program Files\RocketDock 2010-02-28 18:32:35 . 2010-02-28 18:32:35 -------- d-----w- C:\Users\Luke\AppData\Local\Frameworkx.com 2010-02-26 22:15:50 . 2010-02-26 22:35:22 -------- d-----w- C:\Users\Luke\AppData\Local\Microsoft Games 2010-02-26 22:05:41 . 2010-02-26 22:05:41 -------- d-----w- C:\Users\Luke\AppData\Roaming\My Games 2010-02-26 19:58:19 . 2010-02-26 19:58:19 -------- d-----w- C:\Users\Luke\AppData\Roaming\InstallShield Installation Information 2010-02-26 19:58:19 . 2006-12-19 17:22:42 552214 ----a-w- C:\Users\Luke\AppData\Roaming\InstallShield Installation Information\{CFBCE791-2D53-4FCE-B3FB-D6E01F4112E8}\ISSetup.dll 2010-02-26 19:58:19 . 2006-05-24 17:10:42 455600 ----a-w- C:\Users\Luke\AppData\Roaming\InstallShield Installation Information\{CFBCE791-2D53-4FCE-B3FB-D6E01F4112E8}\setup.exe 2010-02-26 19:58:19 . 2006-05-17 16:21:08 373680 ----a-w- C:\Users\Luke\AppData\Roaming\InstallShield Installation Information\{CFBCE791-2D53-4FCE-B3FB-D6E01F4112E8}\_setup.dll 2010-02-26 19:58:18 . 2010-02-26 19:58:18 -------- d-----w- C:\Program Files\Firaxis Games 2010-02-26 19:57:56 . 2010-02-26 19:57:56 -------- d-----w- C:\Users\Luke\AppData\Roaming\InstallShield 2010-02-26 01:11:03 . 2010-03-01 20:43:30 -------- d-----w- C:\Users\Luke\AppData\Local\Stardock 2010-02-26 01:04:48 . 2003-03-19 03:05:50 89088 ----a-w- C:\Windows\system32\atl71.dll 2010-02-26 01:01:07 . 2010-03-01 20:42:05 -------- d-----w- C:\Program Files\Common Files\Stardock 2010-02-26 01:01:06 . 2010-02-26 01:01:08 -------- d-----w- C:\Program Files\Object Desktop . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2010-03-26 23:15:03 . 2009-10-18 20:21:46 -------- d-----w- C:\ProgramData\VMware 2010-03-26 23:08:43 . 2010-01-17 18:28:42 -------- d-----w- C:\Program Files\Cheat Engine 2010-03-24 02:36:06 . 2009-10-21 04:12:37 -------- d-----w- C:\Users\Luke\AppData\Roaming\DisplayFusion 2010-03-23 01:22:01 . 2009-10-18 18:20:48 -------- d-----w- C:\Program Files\Winamp 2010-03-22 22:46:10 . 2009-10-19 00:43:47 -------- d-----w- C:\Program Files\Common Files\Apple 2010-03-21 21:21:39 . 2009-10-18 19:11:03 1392304 ----a-w- C:\Windows\system32\AutoPartNt.exe 2010-03-21 01:07:49 . 2009-10-23 23:28:06 -------- d-----w- C:\Program Files\Common Files\Wise Installation Wizard 2010-03-20 21:13:40 . 2009-10-21 04:35:49 -------- d-----w- C:\Program Files\DisplayFusion 2010-03-20 20:30:17 . 2009-10-18 17:53:47 -------- d-----w- C:\Program Files\Viewpoint 2010-03-20 20:29:32 . 2009-11-23 11:04:53 -------- d-----w- C:\ProgramData\River Past G5 2010-03-20 20:27:42 . 2009-10-25 01:12:56 -------- d-----w- C:\Program Files\Common Files\AVSMedia 2010-03-20 20:27:34 . 2009-10-25 01:12:33 -------- d-----w- C:\Program Files\AVS4YOU 2010-03-20 20:14:18 . 2010-02-17 21:23:09 -------- d-----w- C:\Program Files\PurgeIE 2010-03-20 14:53:54 . 2009-11-12 03:50:10 -------- d-----w- C:\Program Files\HP 2010-03-20 14:41:08 . 2009-11-12 03:57:28 -------- d-----w- C:\Program Files\Common Files\HP 2010-03-10 03:03:36 . 2009-10-18 18:20:48 -------- d-----w- C:\Users\Luke\AppData\Roaming\Winamp 2010-03-05 23:43:05 . 2009-10-19 00:08:26 -------- d-----w- C:\Users\Luke\AppData\Roaming\VMware 2010-03-05 21:56:27 . 2009-10-18 23:56:41 91616 ----a-w- C:\Users\Luke\AppData\Local\GDIPFONTCACHEV1.DAT 2010-03-02 02:00:41 . 2009-07-13 23:40:46 249856 ----a-w- C:\Windows\system32\uxtheme.dll 2010-03-02 02:00:39 . 2009-07-13 23:39:20 2755072 ----a-w- C:\Windows\system32\themeui.dll 2010-03-02 02:00:36 . 2009-07-13 23:39:00 37376 ----a-w- C:\Windows\system32\themeservice.dll 2010-03-01 20:42:05 . 2009-10-19 00:26:12 -------- d-----w- C:\Program Files\Stardock 2010-02-24 23:02:26 . 2010-02-24 23:02:26 -------- d-----w- C:\Program Files\Winamp Detect 2010-02-23 04:04:23 . 2010-02-23 04:04:23 3065 ----a-w- C:\Windows\system32\SpoonUninstall-dBpoweramp Ogg Vorbis Codec.dat 2010-02-23 04:04:17 . 2010-02-23 04:02:15 652152 ----a-w- C:\Windows\system32\SpoonUninstall.exe 2010-02-23 04:04:14 . 2010-02-23 04:04:14 3153 ----a-w- C:\Windows\system32\SpoonUninstall-dBpoweramp mp3 (Fraunhofer IIS) Codec.dat 2010-02-23 04:04:06 . 2010-02-23 04:04:06 3107 ----a-w- C:\Windows\system32\SpoonUninstall-dBpoweramp Monkeys Audio Codec.dat 2010-02-23 04:03:57 . 2010-02-23 04:03:57 2987 ----a-w- C:\Windows\system32\SpoonUninstall-dBpoweramp FLAC Codec.dat 2010-02-23 04:03:49 . 2010-02-23 04:03:49 2843 ----a-w- C:\Windows\system32\SpoonUninstall-dBpoweramp [Calculate Audio CRC] Codec.dat 2010-02-23 04:03:31 . 2010-02-23 04:02:23 11024 ----a-w- C:\Windows\system32\SpoonUninstall-dBpoweramp DSP Effects.dat 2010-02-23 04:02:15 . 2010-02-23 04:02:15 15607 ----a-w- C:\Windows\system32\SpoonUninstall-dBpoweramp Music Converter.dat 2010-02-23 04:02:11 . 2010-02-23 04:02:11 -------- d-----w- C:\Program Files\Illustrate 2010-02-21 23:17:28 . 2010-02-21 23:04:06 -------- d-----w- C:\Program Files\FlacSquisher 2010-02-21 22:25:16 . 2010-02-21 22:25:14 -------- d-----w- C:\Program Files\FLAC 2010-02-21 22:04:11 . 2010-02-21 22:04:11 -------- d-----w- C:\Program Files\lame3.99.a1 2010-02-21 20:24:34 . 2010-02-21 20:24:34 -------- d-----w- C:\Program Files\Emerald Editor Community 2010-02-21 19:11:20 . 2010-02-21 19:07:09 -------- d-----w- C:\Program Files\Mr QuestionMan 2010-02-21 00:31:41 . 2010-02-21 00:16:03 -------- d-----w- C:\Users\Luke\AppData\Roaming\AccurateRip 2010-02-21 00:16:09 . 2010-02-21 00:15:52 -------- d-----w- C:\Program Files\Exact Audio Copy 2010-02-20 21:35:10 . 2010-02-20 20:59:04 -------- d-----w- C:\Users\Luke\AppData\Roaming\mIRC 2010-02-18 21:32:24 . 2010-02-18 21:31:20 -------- d-----w- C:\ProgramData\Paragon 2010-02-18 21:24:36 . 2010-02-18 21:24:36 -------- d-----w- C:\Program Files\Paragon Software 2010-02-17 23:33:15 . 2010-02-17 23:33:15 -------- d-----w- C:\ProgramData\Reflexive 2010-02-17 23:29:53 . 2010-02-17 23:29:53 -------- d-----w- C:\Program Files\ReflexiveArcade 2010-02-17 23:17:56 . 2010-01-26 20:50:11 -------- d-----w- C:\Program Files\SystemRequirementsLab 2010-02-17 23:17:54 . 2010-02-17 23:17:54 84480 ----a-w- C:\Users\Luke\AppData\Roaming\SystemRequirementsLab\srlproxy_cyri_4.1.64.0A.dll 2010-02-17 23:17:54 . 2010-02-17 23:17:54 -------- d-----w- C:\Users\Luke\AppData\Roaming\SystemRequirementsLab 2010-02-17 21:23:11 . 2010-02-17 21:23:11 -------- d-----w- C:\Users\Luke\AppData\Roaming\DelinvFile 2010-02-17 21:23:11 . 2010-02-17 21:23:11 -------- d-----w- C:\ProgramData\DelinvFile 2010-02-17 02:49:22 . 2010-02-17 02:48:08 -------- d-----w- C:\Program Files\wamp 2010-02-15 23:58:33 . 2010-02-15 23:58:33 -------- d-----w- C:\Program Files\Common Files\Java 2010-02-15 23:57:38 . 2010-02-15 23:57:53 411368 ----a-w- C:\Windows\system32\deploytk.dll 2010-02-15 23:57:37 . 2010-02-15 23:57:37 -------- d-----w- C:\Program Files\Java 2010-02-15 04:04:35 . 2009-12-26 00:17:15 -------- d-----w- C:\Users\Luke\AppData\Roaming\Skype 2010-02-15 00:46:59 . 2009-12-26 00:21:10 -------- d-----w- C:\Users\Luke\AppData\Roaming\skypePM 2010-02-10 23:01:30 . 2010-02-10 23:01:30 -------- d-----w- C:\Users\Luke\AppData\Roaming\Realtime Soft 2010-02-10 23:01:23 . 2010-02-10 23:01:23 -------- d-----w- C:\Program Files\Common Files\Realtime Soft 2010-02-10 23:01:22 . 2010-02-10 23:01:21 -------- d-----w- C:\Program Files\UltraMon 2010-02-10 23:01:21 . 2010-02-10 23:01:21 -------- d-----w- C:\ProgramData\Realtime Soft 2010-02-10 18:08:32 . 2010-01-23 04:42:48 -------- d-----w- C:\Users\Luke\AppData\Roaming\vlc 2010-02-10 02:20:49 . 2010-02-10 02:10:22 -------- d-----w- C:\Users\Luke\AppData\Roaming\gtk-2.0 2010-02-10 02:08:47 . 2010-02-10 02:08:47 -------- d-----w- C:\Users\Luke\AppData\Roaming\Participatory Culture Foundation 2010-02-10 01:28:46 . 2010-02-09 22:17:36 -------- d-----w- C:\Program Files\NO$GBA.2.6a 2010-02-07 00:37:23 . 2010-02-07 00:33:09 21840 ----atw- C:\Windows\system32\SIntfNT.dll 2010-02-07 00:37:23 . 2010-02-07 00:33:09 17212 ----atw- C:\Windows\system32\SIntf32.dll 2010-02-02 11:31:20 . 2009-10-25 00:15:47 91608 ----a-w- C:\Users\Guest\AppData\Local\GDIPFONTCACHEV1.DAT 2010-01-26 22:16:00 . 2009-12-25 23:41:14 -------- d-----r- C:\Program Files\Skype 2010-01-20 00:45:13 . 2010-01-20 00:45:13 2678 ----a-w- C:\Windows\Java\Packages\Data\PJ3NBL73.DAT 2010-01-20 00:45:12 . 2010-01-20 00:45:12 2678 ----a-w- C:\Windows\Java\Packages\Data\YPJDZ7BZ.DAT 2010-01-20 00:45:12 . 2010-01-20 00:45:12 2678 ----a-w- C:\Windows\Java\Packages\Data\S1JJHJJL.DAT 2010-01-20 00:45:12 . 2010-01-20 00:45:12 2678 ----a-w- C:\Windows\Java\Packages\Data\O2TVB5RZ.DAT 2010-01-19 22:12:18 . 2010-01-23 22:55:09 21704 ----a-w- C:\Windows\system32\dopdfmn7.dll 2010-01-19 22:12:16 . 2010-01-23 22:55:09 18632 ----a-w- C:\Windows\system32\dopdfmi7.dll 2010-01-15 06:03:38 . 2010-01-15 06:03:38 239104 ----a-w- C:\Windows\UltraMon.scr 2010-01-14 22:23:40 . 2010-01-14 22:23:40 219648 ----a-w- C:\Windows\system32\UltraMonIndDisp.exe 2010-01-14 22:23:32 . 2010-01-14 22:23:32 320512 ----a-w- C:\Windows\system32\UltraMon.dll 2010-01-14 22:23:14 . 2010-01-14 22:23:14 87552 ----a-w- C:\Windows\system32\UltraMonHook.dll 2010-01-14 22:23:12 . 2010-01-14 22:23:12 81920 ----a-w- C:\Windows\system32\UltraMonIndDispHook.dll 2009-06-10 21:26:35 . 2009-07-14 02:04:20 9633792 --sha-r- C:\Windows\Fonts\StaticCache.dat 2009-07-14 01:14:45 . 2009-07-13 23:42:17 396800 --sha-w- C:\Windows\winsxs\x86_microsoft-windows-mail-app_31bf3856ad364e35_6.1.7600.16385_none_f12e83abb108c86c\WinMail.exe . ------- Sigcheck ------- [-] 2010-03-02 02:55:15 . C180E652E3C911D177953A976913A856 . 2613248 . . [6.1.7600.16385 (win7_rtm.090713-1255)] . . C:\Windows\explorer.exe . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Sidebar"="C:\Program Files\Windows Sidebar\sidebar.exe" [2009-07-14 01:14:38 1173504] "DisplayFusion"="C:\Program Files\DisplayFusion\DisplayFusion.exe" [2010-03-17 22:17:28 800944] "RocketDock"="C:\Program Files\RocketDock\RocketDock.exe" [2007-09-02 18:58:52 495616] "Free Download Manager"="C:\Program Files\Free Download Manager\fdm.exe" [2009-01-31 07:45:14 3399727] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SoundMan"="SOUNDMAN.EXE" [2009-04-14 22:43:42 604704] "WinampAgent"="C:\Program Files\Winamp\winampa.exe" [2010-01-13 22:44:52 37888] "Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-10-03 11:08:38 35696] "Adobe ARM"="C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2009-09-04 19:08:30 935288] "SunJavaUpdateSched"="C:\Program Files\Common Files\Java\Java Update\jusched.exe" [2010-01-11 20:21:52 246504] "QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2010-02-15 22:50:12 417792] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "ConsentPromptBehaviorAdmin"= 0 (0x0) "ConsentPromptBehaviorUser"= 3 (0x3) "EnableLUA"= 0 (0x0) "EnableUIADesktopToggle"= 0 (0x0) "PromptOnSecureDesktop"= 0 (0x0) [hkey_local_machine\software\microsoft\windows\currentversion\explorer\SharedTaskScheduler] "{1984DD45-52CF-49cd-AB77-18F378FEA264}"= "C:\Program Files\Stardock\Fences\FencesMenu.dll" [2009-10-02 17:38:46 128360] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\MCPClient] 2005-01-31 20:13:38 49152 ----a-w- C:\PROGRA~1\COMMON~1\Stardock\MCPStub.dll [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sr.sys] @="FSFilter System Recovery" [HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Rainmeter.lnk] path=C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Rainmeter.lnk backup=C:\Windows\pss\Rainmeter.lnk.CommonStartup backupExtension=.CommonStartup [HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^UltraMon.lnk] path=C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\UltraMon.lnk backup=C:\Windows\pss\UltraMon.lnk.CommonStartup backupExtension=.CommonStartup [HKLM\~\startupfolder\C:^Users^Luke^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^Stardock ObjectDock.lnk] path=C:\Users\Luke\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stardock ObjectDock.lnk backup=C:\Windows\pss\Stardock ObjectDock.lnk.Startup backupExtension=.Startup [HKLM\~\startupfolder\C:^Users^Luke^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^Taskbar Eliminator.lnk] path=C:\Users\Luke\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Taskbar Eliminator.lnk backup=C:\Windows\pss\Taskbar Eliminator.lnk.Startup backupExtension=.Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Update] 2009-10-19 00:32:44 133104 ----atw- C:\Users\Luke\AppData\Local\Google\Update\GoogleUpdate.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update] 2008-12-08 20:50:04 54576 ----a-w- C:\Program Files\HP\HP Software Update\hpwuschd2.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper] 2009-09-21 23:36:12 305440 ----a-w- C:\Program Files\iTunes\iTunesHelper.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LifeCam] 2009-07-24 23:05:24 118640 ----a-w- C:\Program Files\Microsoft LifeCam\LifeExp.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\VX6000] 2009-07-24 23:05:26 764256 ----a-w- C:\Windows\vVX6000.exe R3 VX6000;Microsoft LifeCam VX-6000;C:\Windows\system32\DRIVERS\VX6000Xp.sys [2009-07-24 23:05:26 2074464] R3 WSDPrintDevice;WSD Print Support via UMB;C:\Windows\system32\DRIVERS\WSDPrint.sys [2009-07-14 00:18:07 17920] S2 UltraMonUtility;UltraMon Utility Driver;C:\Program Files\Common Files\Realtime Soft\UltraMonMirrorDrv\x32\UltraMonUtility.sys [2008-11-14 07:11:30 17184] S2 Viewpoint Manager Service;Viewpoint Manager Service;C:\Program Files\Viewpoint\Common\ViewpointService.exe [2007-01-04 21:38:08 24652] S2 vmci;VMware vmci;C:\Windows\system32\Drivers\vmci.sys [2008-10-29 06:08:58 54960] S2 Xlight FTP Server;Xlight FTP Server;C:\Program Files\Xlight\xlight.exe [2009-11-11 03:13:30 527360] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost] HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12 HPService REG_MULTI_SZ HPSLPSVC hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc . Contents of the 'Scheduled Tasks' folder 2010-03-25 C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1244716592-558563257-1463856194-1002Core.job - C:\Users\Luke\AppData\Local\Google\Update\GoogleUpdate.exe [2009-10-19 00:32:45 . 2009-10-19 00:32:44] 2010-03-26 C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1244716592-558563257-1463856194-1002UA.job - C:\Users\Luke\AppData\Local\Google\Update\GoogleUpdate.exe [2009-10-19 00:32:45 . 2009-10-19 00:32:44] . . ------- Supplementary Scan ------- . IE: Download all with Free Download Manager - file://C:\Program Files\Free Download Manager\dlall.htm IE: Download selected with Free Download Manager - file://C:\Program Files\Free Download Manager\dlselected.htm IE: Download video with Free Download Manager - file://C:\Program Files\Free Download Manager\dlfvideo.htm IE: Download with Free Download Manager - file://C:\Program Files\Free Download Manager\dllink.htm IE: E&xport to Microsoft Excel - C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000 LSP: C:\Program Files\VMware\VMware Workstation\vsocklib.dll FF - ProfilePath - C:\Users\Luke\AppData\Roaming\Mozilla\Firefox\Profiles\f1l2kbu1.default\ FF - prefs.js: browser.search.defaulturl - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT1060933&SearchSource=3&q={searchTerms} FF - prefs.js: browser.search.selectedEngine - ThePirateBay.org FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/ FF - prefs.js: keyword.URL - hxxp://www.google.com/search?ie=UTF-8&oe=UTF-8&sourceid=navclient&gfns=1&q= FF - component: C:\Program Files\Free Download Manager\Firefox\Extension\components\vmsfdmff.dll FF - component: C:\Users\Luke\AppData\Roaming\Mozilla\Firefox\Profiles\f1l2kbu1.default\extensions\{463F6CA5-EE3C-4be1-B7E6-7FEE11953374}\platform\WINNT\components\FoxyTunes.dll FF - plugin: C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll FF - plugin: C:\Program Files\Mozilla Firefox\plugins\npwachk.dll FF - plugin: C:\Users\Luke\AppData\Local\Google\Update\1.2.183.23\npGoogleOneClick8.dll FF - plugin: C:\Users\Luke\AppData\Roaming\Mozilla\Firefox\Profiles\f1l2kbu1.default\extensions\{E2883E8F-472F-4fb0-9522-AC9BF37916A7}\plugins\np_gp.dll ---- FIREFOX POLICIES ---- FF - user.js: network.protocol-handler.warn-external.dnupdate - false. - - - - ORPHANS REMOVED - - - - Toolbar-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file) HKCU-Run-Aim6 - (no file) SafeBoot-dmboot.sys SafeBoot-dmio.sys SafeBoot-dmload.sys SafeBoot-dmadmin SafeBoot-dmserver SafeBoot-SRService MSConfigStartUp-Taskbar Shuffle - C:\Program Files\Taskbar Shuffle\taskbarshuffle.exe AddRemove-DelinvFile_is1 - C:\PurgeIE\unins000.exe AddRemove-Rainmeter - C:\Program Files\Rainmeter\uninst.exe AddRemove-WampServer 2_is1 - c:\wamp\unins000.exe