[Inactive-A] Google tells me Sirefef.gen!c

Printable View

Show 40 post(s) from this thread on one page

April 30th, 2013, 07:46 AM
Obsession

[Inactive-A] Google tells me Sirefef.gen!c

Hey, How are ya

Google chrome just told me i have sirefef.gen!c and refuses certain sites.. funny enough AVG antivirus doesnt tell me anything.
After some quick google searching it seems to be hard to remove and people keep referring(or reposting the same article) to removing it manually and then provide a guide that doesnt add up.

Im hoping to get some help with this.

ive read this http://discussions.virtualdr.com/sho...d-4-28-2013%29

So im gonna proceed and download the malware and the dds tool and report back in the evening and post the logs.
I also read a topic with a simmilar virus however i cant verify if i should jsut do what he did so i decided to open up a new topic and get advice from people who do know.

Some quick questions, can it steal my hotmail password and can it get my paypal password out of my cache or something like that? do i need to be worried about my paypal account?
im afraid to login because it might steal my password.

thanks for the help so far.
April 30th, 2013, 12:05 PM
Train

Sirefef.gen!C is a computer virus that intercepts secure web connections and can steal passwords and other sensitive data.
April 30th, 2013, 12:51 PM
Obsession

Ok i did the scans Im not sure what i needed to turn off the instructions werent that clear , I didnt turn off AVG wasnt sure how to do it.
LEt me know if thats a mistake and i will try harder to turn it off and do the scans again.

thanks alot for the help so far

Malwarebytes Anti-Malware (-evaluatieversie-) 1.75.0.1300
www.malwarebytes.org

Databaseversie: v2013.04.30.02

Windows Vista Service Pack 1 x86 NTFS
Internet Explorer 7.0.6001.18000
Meo :: PC_VAN_MEO [administrator]

Bescherming: Ingeschakeld

30-4-2013 18:00:21
mbam-log-2013-04-30 (18-00-21).txt

Scan type: Snelle scan
Ingeschakelde scan opties: Geheugen | Opstartitems | Register | Bestanden en mappen | Heuristiek/Extra | Heuristiek/Shuriken | PUP | PUM
Uitgeschakelde scan opties: P2P
Objecten gescand: 204181
Verstreken tijd: 11 minuut/minuten, 43 seconde(n)

Geheugenprocessen gedetecteerd: 0
(Geen kwaadaardige objecten gedetecteerd)

Geheugenmodulen gedetecteerd: 0
(Geen kwaadaardige objecten gedetecteerd)

Registersleutels gedetecteerd: 0
(Geen kwaadaardige objecten gedetecteerd)

Registerwaarden gedetecteerd: 0
(Geen kwaadaardige objecten gedetecteerd)

Registerdata gedetecteerd: 0
(Geen kwaadaardige objecten gedetecteerd)

Mappen gedetecteerd: 0
(Geen kwaadaardige objecten gedetecteerd)

Bestanden gedetecteerd: 0
(Geen kwaadaardige objecten gedetecteerd)

(einde)

DDS LOG

.
UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT
.
DDS (Ver_2012-11-20.01)
.
Microsoft® Windows Vista™ Home Premium
Boot Device: \Device\HarddiskVolume2
Install Date: 10-4-2011 2:45:07
System Uptime: 30-4-2013 15:29:14 (3 hours ago)
.
Motherboard: Acer, Inc. | | Mantasta
Processor: AMD Athlon(tm) X2 Dual-Core QL-64 | Socket S1G2 | 2100/200mhz
.
==== Disk Partitions =========================
.
C: is FIXED (NTFS) - 143 GiB total, 5.978 GiB free.
D: is FIXED (NTFS) - 139 GiB total, 1.369 GiB free.
E: is CDROM (CDFS)
.
==== Disabled Device Manager Items =============
.
==== System Restore Points ===================
.
RP179: 21-4-2013 1:01:24 - Gepland herstelpunt
.
==== Installed Programs ======================
.
2007 Microsoft Office Suite Service Pack 1 (SP1)
Acer Arcade Deluxe
Acer Crystal Eye Webcam 2.0.8.3
Acer eAudio Management
Acer eDataSecurity Management
Acer Empowering Technology
Acer ePower Management
Acer eRecovery Management
Acer eSettings Management
Acer GridVista
Acer Mobility Center Plug-In
Acer Product Registration
Acer ScreenSaver
Adobe Flash Player 11 ActiveX
Adobe Flash Player 11 Plugin
Adobe Reader 9 - Nederlands
Agatha Christie Peril at End House
Agere Systems HDA Modem
Alice Greenfingers
Alien Shooter
AMD USB Audio Driver Filter
Atheros Communications Inc.(R) AR8121/AR8113/AR8114 Gigabit/Fast Ethernet Driver
ATI Catalyst Install Manager
µTorrent
AVG 2011
AVG 2012
AVG Security Toolbar
Bookworm Adventures
C:\Program Files\Acer GameZone\GameConsole
Cake Mania
Catalyst Control Center - Branding
Catalyst Control Center Core Implementation
Catalyst Control Center Graphics Full Existing
Catalyst Control Center Graphics Full New
Catalyst Control Center Graphics Light
Catalyst Control Center Localization Czech
Catalyst Control Center Localization Danish
ccc-core-static
CCC Help Chinese Standard
CCC Help Chinese Traditional
CCC Help Czech
CCC Help Danish
CCC Help Dutch
CCC Help English
CCC Help Finnish
CCC Help French
CCC Help German
CCC Help Greek
CCC Help Hungarian
CCC Help Italian
CCC Help Japanese
CCC Help Korean
CCC Help Norwegian
CCC Help Polish
CCC Help Portuguese
CCC Help Russian
CCC Help Spanish
CCC Help Swedish
CCC Help Thai
CCC Help Turkish
Chicken Invaders 2
Choice Guard
CyberLink PowerDirector
Dream Day First Home
eSobi v2
Galapago
Go-Go Gourmet
Google Chrome
Google Desktop
Google Toolbar for Internet Explorer
Google Update Helper
Heroes of Hellas
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)
Java Auto Updater
Java(TM) 6 Update 22
Junk Mail filter update
Kingsoft Writer (8.1.0.3016)
Launch Manager
LibreOffice 4.0.2.2
Magic Farm
Magic Match Adventures
Malwarebytes Anti-Malware versie 1.75.0.1300
McAfee SiteAdvisor
Microsoft .NET Framework 3.5 Language Pack SP1 - nld
Microsoft .NET Framework 3.5 SP1
Microsoft Application Error Reporting
Microsoft Office Excel MUI (Dutch) 2007
Microsoft Office Home and Student 2007
Microsoft Office Home and Student 2010 - Nederlands
Microsoft Office Klik-en-Klaar 2010
Microsoft Office OneNote MUI (Dutch) 2007
Microsoft Office PowerPoint MUI (Dutch) 2007
Microsoft Office Proof (Dutch) 2007
Microsoft Office Proof (English) 2007
Microsoft Office Proof (French) 2007
Microsoft Office Proof (German) 2007
Microsoft Office Proofing (Dutch) 2007
Microsoft Office Shared MUI (Dutch) 2007
Microsoft Office Suite Activation Assistant
Microsoft Office Word MUI (Dutch) 2007
Microsoft Silverlight
Microsoft SQL Server 2005 Compact Edition [ENU]
Microsoft Visual C++ 2005 Redistributable
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
Microsoft Works
Mozilla Firefox 20.0.1 (x86 nl)
Mozilla Maintenance Service
MSVCRT
MSXML 4.0 SP2 (KB954430)
MSXML 4.0 SP2 (KB973688)
Mystery Solitaire - Secret Island
Mythic Mahjong
NTI Backup Now 5
NTI Backup Now Standard
NTI Media Maker 8
ooVoo
Orion
PhotoNow!
Putt Mania
Realtek High Definition Audio Driver
Realtek USB 2.0 Card Reader
Replay Media Catcher 4 (4.4.3)
Security Update for Microsoft .NET Framework 3.5 SP1 (KB2416473)
Skype Click to Call
Skype™ 5.5
Snagit 10.0.1
Synaptics Pointing Device Driver
Taalpakket voor Microsoft .NET Framework 3.5 SP1 - NL
The Rise of Atlantis
Tiks Texas Hold em
Update for Microsoft .NET Framework 3.5 SP1 (KB963707)
Update for Office 2007 (KB946691)
VBA (2627.01)
VC80CRTRedist - 8.0.50727.4053
VLC media player 1.1.8
Winbond CIR Device Drivers
Windows Live - Hulpprogramma voor uploaden
Windows Live aanmeldhulp
Windows Live Call
Windows Live Communications Platform
Windows Live Essentials
Windows Live Mail
Windows Live Messenger
Windows Live Photo Gallery
Windows Live Sync
Windows Live Writer
Windows Media Player Firefox Plugin
WinRAR 4.00 (32-bit)
Womens Murder Club
XMind 2012 (v3.3.1)
.
==== End Of File ===========================

DDS (Ver_2012-11-20.01) - NTFS_x86
Internet Explorer: 7.0.6001.18602 BrowserJavaVersion: 1.6.0_22
Run by Meo at 18:29:13 on 2013-04-30
Microsoft® Windows Vista™ Home Premium 6.0.6001.1.1252.31.1043.18.3293.1664 [GMT 2:00]
.
AV: AVG Anti-Virus Free Edition 2011 *Enabled/Updated* {5A2746B1-DEE9-F85A-FBCD-ADB11639C5F0}
SP: AVG Anti-Virus Free Edition 2011 *Enabled/Updated* {E146A755-F8D3-F7D4-C17D-96C36DBE8F4D}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
============== Running Processes ================
.
C:\PROGRA~1\AVG\AVG10\avgchsvx.exe
C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\Ati2evxx.exe
C:\Windows\system32\SLsvc.exe
C:\Windows\system32\Ati2evxx.exe
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\agrsmsvc.exe
C:\Program Files\Acer Arcade Deluxe\HomeMedia\Kernel\DMP\CLHNService.exe
C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\eDSService.exe
C:\Program Files\Acer\Empowering Technology\Service\ETService.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
C:\Program Files\AVG\AVG10\avgnsx.exe
C:\Program Files\AVG\AVG10\avgemcx.exe
C:\Program Files\McAfee\SiteAdvisor\McSACore.exe
C:\Acer\Mobility Center\MobilityService.exe
C:\Windows\system32\rundll32.exe
C:\Program Files\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe
C:\Program Files\Cyberlink\Shared files\RichVideo.exe
C:\Program Files\Microsoft Application Virtualization Client\sftvsa.exe
C:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater\14.2.0\ToolbarUpdater.exe
C:\Windows\system32\SearchIndexer.exe
C:\Program Files\Microsoft Application Virtualization Client\sftlist.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\RtHDVCpl.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Windows\system32\taskeng.exe
C:\Program Files\Acer\Empowering Technology\ePower\ePower_DMC.exe
C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\eDSLoader.exe
C:\Program Files\Acer\Empowering Technology\eAudio\eAudio.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Windows\PLFSetI.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\System32\mobsync.exe
C:\Program Files\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE
C:\Users\Meo\AppData\Local\Temp\RtkBtMnt.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
C:\Program Files\Launch Manager\QtZgAcer.EXE
C:\Program Files\Acer Arcade Deluxe\Acer Arcade Deluxe\ArcadeDeluxeAgent.exe
C:\Program Files\Acer Arcade Deluxe\Acer Arcade Deluxe\Kernel\CLML\CLMLSvc.exe
C:\Program Files\Acer Arcade Deluxe\PlayMovie\PMVService.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\Program Files\DivX\DivX Update\DivXUpdate.exe
C:\Program Files\AVG Secure Search\vprot.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
C:\Program Files\AVG\AVG10\Identity Protection\agent\bin\avgidsmonitor.exe
C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
C:\PROGRA~1\AVG\AVG10\avgrsx.exe
C:\Program Files\AVG\AVG10\avgcsrvx.exe
C:\Program Files\Acer\Empowering Technology\NotificationCenter\Framework.NotificationCenter.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\VideoLAN\VLC\vlc.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe
C:\Windows\notepad.exe
C:\Program Files\AVG\AVG10\avgui.exe
C:\Windows\system32\conime.exe
C:\Windows\system32\conime.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\svchost.exe -k rpcss
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\System32\svchost.exe -k LocalServiceNoNetwork
C:\Windows\system32\svchost.exe -k imgsvc
C:\Windows\System32\svchost.exe -k WerSvcGroup
.
============== Pseudo HJT Report ===============
.
uStart Page = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0413&s=2&o=vp32&d=0411&m=aspire_6530g
uSearch Bar = hxxp://www.google.com/ie
uSearch Page = hxxp://www.google.com
uDefault_Page_URL = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0413&s=2&o=vp32&d=0411&m=aspire_6530g
mStart Page = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0413&s=2&o=vp32&d=0411&m=aspire_6530g
mDefault_Page_URL = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0413&s=2&o=vp32&d=0411&m=aspire_6530g
uSearchURL,(Default) = hxxp://www.google.com/search/?q=%s
uURLSearchHooks: {A3BC75A2-1F87-4686-AA43-5347D756017C} - <orphaned>
uURLSearchHooks: McAfee SiteAdvisor Toolbar: {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\program files\mcafee\siteadvisor\McIEPlg.dll
dURLSearchHooks: {A3BC75A2-1F87-4686-AA43-5347D756017C} - <orphaned>
BHO: SnagIt Toolbar Loader: {00C6482D-C502-44C8-8409-FCE54AD9C208} - c:\program files\techsmith\snagit 10\SnagitBHO.dll
BHO: Adobe PDF Link Helper: {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: DivX Plus Web Player HTML5 <video>: {326E768D-4182-46FD-9C16-1449A49795F4} - c:\program files\divx\divx plus web player\npdivx32.dll
BHO: AVG Safe Search: {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - c:\program files\avg\avg10\avgssie.dll
BHO: DivX HiQ: {593DDEC6-7468-4cdd-90E1-42DADAA222E9} - c:\program files\divx\divx plus web player\npdivx32.dll
BHO: {5C255C8A-E604-49b4-9D64-90988571CECB} - <orphaned>
BHO: ShowBarObj Class: {83A2F9B1-01A2-4AA5-87D1-45B6B8505E96} - c:\program files\acer\empowering technology\edatasecurity\x86\ActiveToolBand.dll
BHO: Windows Live Aanmelden - Help: {9030D464-4C02-4ABF-8ECC-5164760863C6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
BHO: AVG Security Toolbar: {95B7759C-8C7F-4BF1-B163-73684A933233} - c:\program files\avg secure search\14.2.0.1\AVG Secure Search_toolbar.dll
BHO: Google Toolbar Helper: {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\google toolbar\GoogleToolbar_32.dll
BHO: Skype Browser Helper: {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll
BHO: Google Toolbar Notifier BHO: {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - c:\program files\google\googletoolbarnotifier\5.7.8313.1002\swg.dll
BHO: McAfee SiteAdvisor BHO: {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - c:\program files\mcafee\siteadvisor\McIEPlg.dll
BHO: Java(tm) Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - c:\program files\java\jre6\bin\jp2ssv.dll
TB: Google Toolbar: {2318C2B1-4965-11D4-9B18-009027A5CD4F} - c:\program files\google\google toolbar\GoogleToolbar_32.dll
TB: <No Name>: {E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39} - LocalServer32 - <no file>
TB: McAfee SiteAdvisor Toolbar: {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\program files\mcafee\siteadvisor\McIEPlg.dll
TB: Acer eDataSecurity Management: {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - c:\program files\acer\empowering technology\edatasecurity\x86\eDStoolbar.dll
TB: Snagit: {8FF5E183-ABDE-46EB-B09E-D2AAB95CABE3} - c:\program files\techsmith\snagit 10\SnagitIEAddin.dll
TB: AVG Security Toolbar: {95B7759C-8C7F-4BF1-B163-73684A933233} - c:\program files\avg secure search\14.2.0.1\AVG Secure Search_toolbar.dll
TB: Google Toolbar: {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\google toolbar\GoogleToolbar_32.dll
uRun: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter
uRun: [ProductReg] "c:\program files\acer\wr_popup\ProductReg.exe"
uRun: [uTorrent] "c:\program files\utorrent\uTorrent.exe"
uRun: [swg] "c:\program files\google\googletoolbarnotifier\GoogleToolbarNotifier.exe"
uRun: [ooVoo.exe] c:\program files\oovoo\oovoo.exe /minimized
uRun: [Skype] "c:\program files\skype\phone\Skype.exe" /nosplash /minimized
mRun: [RtHDVCpl] RtHDVCpl.exe
mRun: [Google Desktop Search] "c:\program files\google\google desktop search\GoogleDesktop.exe" /startup
mRun: [ePower_DMC] c:\program files\acer\empowering technology\epower\ePower_DMC.exe
mRun: [eDataSecurity Loader] c:\program files\acer\empowering technology\edatasecurity\x86\eDSloader.exe
mRun: [eAudio] "c:\program files\acer\empowering technology\eaudio\eAudio.exe"
mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe"
mRun: [StartCCC] "c:\program files\ati technologies\ati.ace\core-static\CLIStart.exe" MSRun
mRun: [Skytel] Skytel.exe
mRun: [SynTPEnh] c:\program files\synaptics\syntp\SynTPEnh.exe
mRun: [PLFSetI] c:\windows\PLFSetI.exe
mRun: [LManager] c:\progra~1\launch~1\QtZgAcer.EXE
mRun: [eRecoveryService] <no file>
StartupFolder: c:\users\meo\appdata\roaming\micros~1\windows\startm~1\programs\startup\onenot~1.lnk - c:\program files\microsoft office\office12\ONENOTEM.EXE
mPolicies-System: EnableUIADesktopToggle = dword:0
IE: E&xporteren naar Microsoft Excel - c:\progra~1\micros~2\office12\EXCEL.EXE/3000
IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - c:\program files\windows live\writer\WriterBrowserExtension.dll
IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\program files\microsoft office\office12\ONBttnIE.dll
IE: {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503}
LSP: mswsock.dll
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab
TCP: NameServer = 192.168.1.254
TCP: Interfaces\{757B1AE9-CE4A-4113-BE9A-A34A6066654C} : DHCPNameServer = 192.168.1.254
Handler: dssrequest - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\program files\mcafee\siteadvisor\McIEPlg.dll
Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - c:\program files\avg\avg10\avgpp.dll
Handler: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\program files\mcafee\siteadvisor\McIEPlg.dll
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll
Handler: viprotocol - {B658800C-F66E-4EF3-AB85-6C0C227862A9} - c:\program files\common files\avg secure search\viprotocolinstaller\14.2.0\ViProtocol.dll
AppInit_DLLs= c:\progra~1\google\google~1\GOEC62~1.DLL
LSA: Security Packages = kerberos msv1_0 schannel wdigest tspkg
mASetup: {8A69D345-D564-463c-AFF1-A69D9E530F96} - "c:\program files\google\chrome\application\26.0.1410.64\installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --multi-install --chrome
.
================= FIREFOX ===================
.
FF - ProfilePath - c:\users\meo\appdata\roaming\mozilla\firefox\profiles\8ehtkf2i.default\
FF - prefs.js: browser.search.selectedEngine - AVG Secure Search
FF - prefs.js: keyword.URL - hxxp://isearch.avg.com/search?cid=%7B6279e5e4-e15c-4282-bc8b-e004207d62be%7D&mid=db4477f097ef47d1976bd16acd100928-bae3ed9ff537164695a82ca2a0aa4b5d0ae193fa&ds=AVG&v=10.2.0.3&lang=nl&pr=pa&d=2011-12-16%2013%3A13%3A03&sap=ku&q=
FF - plugin: c:\progra~1\micros~2\office14\NPSPWRAP.DLL
FF - plugin: c:\program files\common files\avg secure search\sitesafetyinstaller\14.2.0\npsitesafety.dll
FF - plugin: c:\program files\divx\divx ovs helper\npovshelper.dll
FF - plugin: c:\program files\divx\divx plus web player\npdivx32.dll
FF - plugin: c:\program files\google\update\1.3.21.135\npGoogleUpdate3.dll
FF - plugin: c:\program files\java\jre6\bin\new_plugin\npdeployJava1.dll
FF - plugin: c:\program files\mcafee\siteadvisor\NPMcFFPlg32.dll
FF - plugin: c:\program files\microsoft silverlight\4.0.60831.0\npctrlui.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npdeployJava1.dll
FF - plugin: c:\program files\windows live\photo gallery\NPWLPG.dll
FF - plugin: c:\windows\system32\macromed\flash\NPSWF32_11_6_602_180.dll
FF - ExtSQL: !HIDDEN! 2011-04-12 03:05; {20a82645-c095-46ed-80e3-08825760534b}; c:\windows\microsoft.net\framework\v3.5\windows presentation foundation\DotNetAssistantExtension
.
============= SERVICES / DRIVERS ===============
.
R0 AVGIDSEH;AVGIDSEH;c:\windows\system32\drivers\AVGIDSEH.sys [2011-2-22 22992]
R0 Avgrkx86;AVG Anti-Rootkit Driver;c:\windows\system32\drivers\avgrkx86.sys [2011-3-16 32592]
R1 Avgfwfd;AVG network filter service;c:\windows\system32\drivers\avgfwd6x.sys [2010-7-12 54112]
R1 Avgldx86;AVG AVI Loader Driver;c:\windows\system32\drivers\avgldx86.sys [2011-1-7 248656]
R1 Avgmfx86;AVG Mini-Filter Resident Anti-Virus Shield;c:\windows\system32\drivers\avgmfx86.sys [2011-3-1 34896]
R1 Avgtdix;AVG TDI Driver;c:\windows\system32\drivers\avgtdix.sys [2011-4-5 297168]
R1 avgtp;avgtp;c:\windows\system32\drivers\avgtpx86.sys [2012-8-30 33112]
R2 AVGIDSAgent;AVGIDSAgent;c:\program files\avg\avg10\identity protection\agent\bin\AVGIDSAgent.exe [2011-8-18 7390560]
R2 avgwd;AVG WatchDog;c:\program files\avg\avg10\avgwdsvc.exe [2011-2-8 269520]
R2 CLHNService;CLHNService;c:\program files\acer arcade deluxe\homemedia\kernel\dmp\CLHNService.exe [2011-4-10 69632]
R2 cvhsvc;Client Virtualization Handler;c:\program files\common files\microsoft shared\virtualization handler\CVHSVC.EXE [2010-2-28 821664]
R2 ETService;Empowering Technology Service;c:\program files\acer\empowering technology\service\ETService.exe [2009-1-15 24576]
R2 MBAMScheduler;MBAMScheduler;c:\program files\malwarebytes' anti-malware\mbamscheduler.exe [2013-4-30 418376]
R2 MBAMService;MBAMService;c:\program files\malwarebytes' anti-malware\mbamservice.exe [2013-4-30 701512]
R2 McAfee SiteAdvisor Service;McAfee SiteAdvisor Service;c:\program files\mcafee\siteadvisor\McSACore.exe [2009-1-15 95232]
R2 NTISchedulerSvc;NTI Backup Now 5 Scheduler Service;c:\program files\newtech infosystems\nti backup now 5\SchedulerSvc.exe [2008-9-23 144632]
R2 sftlist;Application Virtualization Client;c:\program files\microsoft application virtualization client\sftlist.exe [2009-12-2 483688]
R2 vToolbarUpdater14.2.0;vToolbarUpdater14.2.0;c:\program files\common files\avg secure search\vtoolbarupdater\14.2.0\ToolbarUpdater.exe [2013-2-20 968880]
R3 appliandMP;appliandMP;c:\windows\system32\drivers\appliand.sys [2012-8-6 28256]
R3 AVGIDSDriver;AVGIDSDriver;c:\windows\system32\drivers\AVGIDSDriver.sys [2011-5-27 134480]
R3 AVGIDSFilter;AVGIDSFilter;c:\windows\system32\drivers\AVGIDSFilter.sys [2011-2-10 24144]
R3 AVGIDSShim;AVGIDSShim;c:\windows\system32\drivers\AVGIDSShim.sys [2011-2-10 28624]
R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2013-4-30 22856]
R3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\system32\drivers\mbamswissarmy.sys [2013-4-30 40776]
R3 Sftfs;Sftfs;c:\windows\system32\drivers\Sftfslh.sys [2009-12-2 550760]
R3 Sftplay;Sftplay;c:\windows\system32\drivers\Sftplaylh.sys [2009-12-2 195944]
R3 Sftredir;Sftredir;c:\windows\system32\drivers\Sftredirlh.sys [2009-12-2 21864]
R3 Sftvol;Sftvol;c:\windows\system32\drivers\Sftvollh.sys [2009-12-2 19304]
R3 sftvsa;Application Virtualization Service Agent;c:\program files\microsoft application virtualization client\sftvsa.exe [2009-12-2 209768]
R3 usbfilter;AMD USB Filter Driver;c:\windows\system32\drivers\usbfilter.sys [2009-1-15 22072]
R3 winbondcir;Winbond IR Transceiver;c:\windows\system32\drivers\winbondcir.sys [2007-3-28 43008]
S3 appliand;Applian Network Service;c:\windows\system32\drivers\appliand.sys [2012-8-6 28256]
S3 AVG Security Toolbar Service;AVG Security Toolbar Service;c:\program files\avg\avg10\toolbar\ToolbarBroker.exe [2011-6-29 167264]
S3 GoogleDesktopManager-051210-111108;Google Desktop Manager 5.9.1005.12335;c:\program files\google\google desktop search\GoogleDesktop.exe [2009-1-15 30192]
S3 netr28;Ralink 802.11n Wireless Driver for Windows Vista;c:\windows\system32\drivers\netr28.sys [2009-1-15 419328]
S3 NTIBackupSvc;NTI Backup Now 5 Backup Service;c:\program files\newtech infosystems\nti backup now 5\BackupSvc.exe [2008-9-23 50424]
.
=============== Created Last 30 ================
.
2013-04-30 11:40:00 40776 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2013-04-30 11:40:00 -------- d-----w- c:\users\meo\appdata\roaming\Malwarebytes
2013-04-30 11:39:51 -------- d-----w- c:\programdata\Malwarebytes
2013-04-30 11:39:50 22856 ----a-w- c:\windows\system32\drivers\mbam.sys
2013-04-30 11:39:50 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2013-04-29 12:18:37 224256 ----a-w- c:\programdata\microsoft\media tools\MediaIconsOverlays.dll
2013-04-29 12:18:22 -------- d-----w- c:\program files\Mega Codec Pack
2013-04-11 00:12:03 -------- d-----w- c:\users\meo\appdata\roaming\LibreOffice
2013-04-10 18:36:14 -------- d-----w- c:\windows\System64
2013-04-10 18:26:24 -------- d-----w- c:\program files\LibreOffice 4.0
.
==================== Find3M ====================
.
2013-03-26 21:43:02 773968 ----a-w- c:\windows\system32\msvcr100.dll
2013-03-26 21:43:02 421200 ----a-w- c:\windows\system32\msvcp100.dll
2013-03-13 16:59:30 73432 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2013-03-13 16:59:30 693976 ----a-w- c:\windows\system32\FlashPlayerApp.exe
2013-03-13 16:59:24 16486616 ----a-w- c:\windows\system32\FlashPlayerInstaller.exe
2013-02-20 18:04:11 33112 ----a-w- c:\windows\system32\drivers\avgtpx86.sys
2012-03-28 02:29:09 0 ----a-w- c:\program files\GUTF7CD.tmp
.
============= FINISH: 18:29:57.77 ===============
April 30th, 2013, 04:53 PM
Obsession

So again, i wasnt able to turn off AVG.
Im not sure if AVG falls into the catagory ''script blocking protection''

I wasnt able to turn it off, if i shouldve please let me know il look better, if anybody happens to know thats even better.

Also is it possible for the approval requirement to be taken off for the posts i make? i understand its probably because i registered new on here . But it makes it really hard to make fast responces and get the help. I know you guys are probably busy so it would help if the posts get posted so they can be seen when somebody drops by here.

again appreciate the help. thanks so far.

EDIT the posts show up immediatly now, thanks for taking it off EDIT
April 30th, 2013, 07:16 PM
Broni
Welcome aboard http://dev.discussions.virtualdr.forums.relay.cool/

Please, observe following rules:
- Read all of my instructions very carefully. Your mistakes during cleaning process may have very serious consequences, like unbootable computer.
- If you're stuck, or you're not sure about certain step, always ask before doing anything else.
- Please refrain from running any tools, fixes or applying any changes to your computer other than those I suggest.
- Never run more than one scan at a time.
- Keep updating me regarding your computer behavior, good, or bad.
- The cleaning process, once started, has to be completed. Even if your computer appears to act better, it may still be infected. Once the computer is totally clean, I'll certainly let you know.
- If you leave the topic without explanation in the middle of a cleaning process, you may not be eligible to receive any more help in malware removal forum.
- I close my topics if you have not replied in 5 days. If you need more time, simply let me know. If I closed your topic and you need it to be reopened, simply PM me.
=================================

http://dev.discussions.virtualdr.forums.relay.cool/ Download RogueKiller on the desktop
- Close all the running programs
- Windows Vista/7 users: right click on RogueKiller.exe, click Run as Administrator
- Otherwise just double-click on RogueKiller.exe
- Pre-scan will start. Let it finish.
- Click on SCAN button.
- Wait until the Status box shows Scan Finished
- Click on Delete.
- Wait until the Status box shows Deleting Finished.
- Click on Report and copy/paste the content of the Notepad into your next reply.
- RKreport.txt could also be found on your desktop.
- If more than one log is produced post all logs.
- If RogueKiller has been blocked, do not hesitate to try a few times more. If really won't run, rename it to winlogon.exe (or winlogon.com) and try again
http://dev.discussions.virtualdr.forums.relay.cool/ Download Malwarebytes Anti-Rootkit (MBAR) from HERE
- Unzip downloaded file.
- Open the folder where the contents were unzipped and run mbar.exe
- Follow the instructions in the wizard to update and allow the program to scan your computer for threats.
- Click on the Cleanup button to remove any threats and reboot if prompted to do so.
- Wait while the system shuts down and the cleanup process is performed.
- Perform another scan with Malwarebytes Anti-Rootkit to verify that no threats remain. If they do, then click Cleanup once more and repeat the process.
- When done, please post the two logs produced they will be in the MBAR folder..... mbar-log-xxxxx.txt and system-log.txt
May 1st, 2013, 07:32 PM
Obsession

Ok ran rogue killer twice and malware rootkit 5 times it keeps finding 1 entry to remove.
With rogue killer i cant seem to delete whats under the tab driver. it deletes followed by some quick scan and its there again.

the mbar gave me a message on starting the first time - Registry value ''Appinit_Dlls'' has been found witch may be caused by rootkit activity
Note: press ''no'' if your not sure i the tool chrashes or terminates unexpectedly during a system scan, restart te tool and press ''yes'' should thism essage appear again

Do you want to remove this value and restart the tool?

i selected No, it didnt come up again.

RogueKiller V8.5.4 [Mar 18 2013] by Tigzy
mail : tigzyRK<at>gmail<dot>com
Feedback : http://www.geekstogo.com/forum/files...3-roguekiller/
Website : http://tigzy.geekstogo.com/roguekiller.php
Blog : http://tigzyrk.blogspot.com/

besturingssysteem : Windows Vista (6.0.6001 Service Pack 1) 32 bits version
Gestart vanuit : Normale modus
Gebruiker : Meo [Administrator rechten]
Modus : Scan -- Datum : 05/01/2013 11:55:24
| ARK || FAK || MBR |

¤¤¤ Kwaadaardige processen : 0 ¤¤¤

¤¤¤ Register verwijzingen : 2 ¤¤¤
[HJ DESK] HKLM\[...]\NewStartPanel : {59031a47-3f72-44a7-89c5-5595fe6b30ee} (1) -> gevonden
[HJ DESK] HKLM\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> gevonden

¤¤¤ Speciale Files / Folders: ¤¤¤
[ZeroAccess][FOLDER] $NtUninstallKB5150$ : C:\Windows\$NtUninstallKB5150$ --> gevonden
[Faked.Drv][FILE] netbt.sys : C:\Windows\system32\drivers\netbt.sys [-] --> gevonden

¤¤¤ Driver : [Geladen] ¤¤¤

¤¤¤ Infectie : ZeroAccess ¤¤¤

¤¤¤ HOSTS Bestand: ¤¤¤
--> C:\Windows\system32\drivers\etc\hosts

127.0.0.1 localhost
::1 localhost

¤¤¤ MBR Controle: ¤¤¤

+++++ PhysicalDrive0: Hitachi HTS543232L9A3 SCSI Disk Device +++++
--- User ---
[MBR] 69681679e8af720346c2223858de0196
[BSP] 8e611c03f674eb445ba14e6e1774af73 : Acer MBR Code
Partition table:
0 - [XXXXXX] ACER (0x27) [VISIBLE] Offset (sectors): 2048 | Size: 12288 Mo
1 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 25167872 | Size: 146477 Mo
2 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 325152768 | Size: 142848 Mo
3 - [XXXXXX] COMPAQ (0x12) [VISIBLE] Offset (sectors): 617705472 | Size: 3630 Mo
User = LL1 ... OK!
Error reading LL2 MBR!

Gereed : << RKreport[1]_S_05012013_02d1155.txt >>
RKreport[1]_S_05012013_02d1155.txt

---

RogueKiller V8.5.4 [Mar 18 2013] by Tigzy
mail : tigzyRK<at>gmail<dot>com
Feedback : http://www.geekstogo.com/forum/files...3-roguekiller/
Website : http://tigzy.geekstogo.com/roguekiller.php
Blog : http://tigzyrk.blogspot.com/

besturingssysteem : Windows Vista (6.0.6001 Service Pack 1) 32 bits version
Gestart vanuit : Normale modus
Gebruiker : Meo [Administrator rechten]
Modus : Verwijder -- Datum : 05/01/2013 11:57:49
| ARK || FAK || MBR |

¤¤¤ Kwaadaardige processen : 0 ¤¤¤

¤¤¤ Register verwijzingen : 2 ¤¤¤
[HJ DESK] HKLM\[...]\NewStartPanel : {59031a47-3f72-44a7-89c5-5595fe6b30ee} (1) -> VERVANGEN (0)
[HJ DESK] HKLM\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> VERVANGEN (0)

¤¤¤ Speciale Files / Folders: ¤¤¤
[ZeroAccess][JUNCTION] C:\Windows\$NtUninstallKB5150$ >> \systemroot\system32\config --> VERWIJDERD
[Del.Parent][FILE] 92013100 : C:\Windows\$NtUninstallKB5150$\92013100 [-] --> VERWIJDERD
[Del.Parent][FILE] @ : C:\Windows\$NtUninstallKB5150$\922821407\@ [-] --> VERWIJDERD
[Del.Parent][FILE] Desktop.ini : C:\Windows\$NtUninstallKB5150$\922821407\Desktop.ini [-] --> VERWIJDERD
[Del.Parent][FILE] 00000004.@ : C:\Windows\$NtUninstallKB5150$\922821407\L\00000004.@ [-] --> VERWIJDERD
[Del.Parent][FILE] 201d3dde : C:\Windows\$NtUninstallKB5150$\922821407\L\201d3dde [-] --> VERWIJDERD
[Del.Parent][FILE] 6715e287 : C:\Windows\$NtUninstallKB5150$\922821407\L\6715e287 [-] --> VERWIJDERD
[Del.Parent][FILE] 76603ac3 : C:\Windows\$NtUninstallKB5150$\922821407\L\76603ac3 [-] --> VERWIJDERD
[Del.Parent][FILE] qnbwvoto : C:\Windows\$NtUninstallKB5150$\922821407\L\qnbwvoto [-] --> VERWIJDERD
[Del.Parent][FOLDER] ROOT : C:\Windows\$NtUninstallKB5150$\922821407\L --> VERWIJDERD
[Del.Parent][FILE] 00000004.@ : C:\Windows\$NtUninstallKB5150$\922821407\U\00000004.@ [-] --> VERWIJDERD
[Del.Parent][FILE] 00000008.@ : C:\Windows\$NtUninstallKB5150$\922821407\U\00000008.@ [-] --> VERWIJDERD
[Del.Parent][FILE] 000000cb.@ : C:\Windows\$NtUninstallKB5150$\922821407\U\000000cb.@ [-] --> VERWIJDERD
[Del.Parent][FILE] 80000000.@ : C:\Windows\$NtUninstallKB5150$\922821407\U\80000000.@ [-] --> VERWIJDERD
[Del.Parent][FILE] 80000032.@ : C:\Windows\$NtUninstallKB5150$\922821407\U\80000032.@ [-] --> VERWIJDERD
[Del.Parent][FOLDER] ROOT : C:\Windows\$NtUninstallKB5150$\922821407\U --> VERWIJDERD
[Del.Parent][FOLDER] ROOT : C:\Windows\$NtUninstallKB5150$\922821407 --> VERWIJDERD NA HERSTART
[ZeroAccess][FOLDER] ROOT : C:\Windows\$NtUninstallKB5150$ --> VERWIJDERD NA HERSTART
[Faked.Drv][FILE] netbt.sys : C:\Windows\system32\drivers\netbt.sys [-] --> FIX NIET MOGELIJK

¤¤¤ Driver : [Geladen] ¤¤¤

¤¤¤ Infectie : ZeroAccess ¤¤¤

¤¤¤ HOSTS Bestand: ¤¤¤
--> C:\Windows\system32\drivers\etc\hosts

127.0.0.1 localhost
::1 localhost

¤¤¤ MBR Controle: ¤¤¤

+++++ PhysicalDrive0: Hitachi HTS543232L9A3 SCSI Disk Device +++++
--- User ---
[MBR] 69681679e8af720346c2223858de0196
[BSP] 8e611c03f674eb445ba14e6e1774af73 : Acer MBR Code
Partition table:
0 - [XXXXXX] ACER (0x27) [VISIBLE] Offset (sectors): 2048 | Size: 12288 Mo
1 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 25167872 | Size: 146477 Mo
2 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 325152768 | Size: 142848 Mo
3 - [XXXXXX] COMPAQ (0x12) [VISIBLE] Offset (sectors): 617705472 | Size: 3630 Mo
User = LL1 ... OK!
Error reading LL2 MBR!

Gereed : << RKreport[2]_D_05012013_02d1157.txt >>
RKreport[1]_S_05012013_02d1155.txt ; RKreport[2]_D_05012013_02d1157.txt

----

RogueKiller V8.5.4 [Mar 18 2013] by Tigzy
mail : tigzyRK<at>gmail<dot>com
Feedback : http://www.geekstogo.com/forum/files...3-roguekiller/
Website : http://tigzy.geekstogo.com/roguekiller.php
Blog : http://tigzyrk.blogspot.com/

besturingssysteem : Windows Vista (6.0.6001 Service Pack 1) 32 bits version
Gestart vanuit : Normale modus
Gebruiker : Meo [Administrator rechten]
Modus : Scan -- Datum : 05/01/2013 12:06:20
| ARK || FAK || MBR |

¤¤¤ Kwaadaardige processen : 0 ¤¤¤

¤¤¤ Register verwijzingen : 0 ¤¤¤

¤¤¤ Speciale Files / Folders: ¤¤¤

¤¤¤ Driver : [Geladen] ¤¤¤

¤¤¤ HOSTS Bestand: ¤¤¤
--> C:\Windows\system32\drivers\etc\hosts

127.0.0.1 localhost
::1 localhost

¤¤¤ MBR Controle: ¤¤¤

+++++ PhysicalDrive0: Hitachi HTS543232L9A3 SCSI Disk Device +++++
--- User ---
[MBR] 69681679e8af720346c2223858de0196
[BSP] 8e611c03f674eb445ba14e6e1774af73 : Acer MBR Code
Partition table:
0 - [XXXXXX] ACER (0x27) [VISIBLE] Offset (sectors): 2048 | Size: 12288 Mo
1 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 25167872 | Size: 146477 Mo
2 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 325152768 | Size: 142848 Mo
3 - [XXXXXX] COMPAQ (0x12) [VISIBLE] Offset (sectors): 617705472 | Size: 3630 Mo
User = LL1 ... OK!
Error reading LL2 MBR!

Gereed : << RKreport[3]_S_05012013_02d1206.txt >>
RKreport[1]_S_05012013_02d1155.txt ; RKreport[2]_D_05012013_02d1157.txt ; RKreport[3]_S_05012013_02d1206.txt

----

Malwarebytes Anti-Rootkit BETA 1.05.0.1001
www.malwarebytes.org

Database version: v2013.05.01.05

Windows Vista Service Pack 1 x86 NTFS
Internet Explorer 7.0.6001.18000
Meo :: PC_VAN_MEO [administrator]

1-5-2013 14:27:26
mbar-log-2013-05-01 (14-27-26).txt

Scan type: Quick scan
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM | P2P
Scan options disabled:
Objects scanned: 22114
Time elapsed: 56 second(s) [aborted]

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 0
(No malicious items detected)

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 0
(No malicious items detected)

Files Detected: 0
(No malicious items detected)

(end)

----

Malwarebytes Anti-Rootkit BETA 1.05.0.1001
www.malwarebytes.org

Database version: v2013.05.01.05

Windows Vista Service Pack 1 x86 NTFS
Internet Explorer 7.0.6001.18000
Meo :: PC_VAN_MEO [administrator]

1-5-2013 14:46:18
mbar-log-2013-05-01 (14-46-18).txt

Scan type: Quick scan
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM | P2P
Scan options disabled:
Objects scanned: 28727
Time elapsed: 18 minute(s), 40 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 0
(No malicious items detected)

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 2
c:\Windows\$NtUninstallKB5150$\922821407\U (Backdoor.0Access) -> Delete on reboot.
c:\Windows\$NtUninstallKB5150$\922821407 (Backdoor.0Access) -> Delete on reboot.

Files Detected: 0
(No malicious items detected)

(end)

---

Malwarebytes Anti-Rootkit BETA 1.05.0.1001
www.malwarebytes.org

Database version: v2013.05.01.05

Windows Vista Service Pack 1 x86 NTFS
Internet Explorer 7.0.6001.18000
Meo :: PC_VAN_MEO [administrator]

1-5-2013 15:41:01
mbar-log-2013-05-01 (15-41-01).txt

Scan type: Quick scan
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM | P2P
Scan options disabled:
Objects scanned: 28775
Time elapsed: 18 minute(s), 38 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 0
(No malicious items detected)

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 1
c:\windows\$ntuninstallkb5150$\922821407 (Backdoor.0Access) -> Delete on reboot.

Files Detected: 0
(No malicious items detected)

(end)

--

Malwarebytes Anti-Rootkit BETA 1.05.0.1001
www.malwarebytes.org

Database version: v2013.05.01.08

Windows Vista Service Pack 1 x86 NTFS
Internet Explorer 7.0.6001.18000
Meo :: PC_VAN_MEO [administrator]

2-5-2013 1:00:56
mbar-log-2013-05-02 (01-00-56).txt

Scan type: Quick scan
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM | P2P
Scan options disabled:
Objects scanned: 28757
Time elapsed: 20 minute(s), 41 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 0
(No malicious items detected)

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 1
c:\windows\$ntuninstallkb5150$\922821407 (Backdoor.0Access) -> Delete on reboot.

Files Detected: 0
(No malicious items detected)

(end)

-----

---------------------------------------
Malwarebytes Anti-Rootkit BETA 1.05.0.1001

(c) Malwarebytes Corporation 2011-2012

OS version: 6.0.6001 Windows Vista Service Pack 1 x86

Account is Administrative

Internet Explorer version: 7.0.6001.18000

Java version: 1.6.0_22

File system is: NTFS
Disk drives: C:\ DRIVE_FIXED, D:\ DRIVE_FIXED, G:\ DRIVE_FIXED, Q:\ DRIVE_FIXED
CPU speed: 2.100000 GHz
Memory total: 3453407232, free: 2147049472

---------------------------------------
Malwarebytes Anti-Rootkit BETA 1.05.0.1001

(c) Malwarebytes Corporation 2011-2012

OS version: 6.0.6001 Windows Vista Service Pack 1 x86

Account is Administrative

Internet Explorer version: 7.0.6001.18000

Java version: 1.6.0_22

File system is: NTFS
Disk drives: C:\ DRIVE_FIXED, D:\ DRIVE_FIXED, G:\ DRIVE_FIXED, Q:\ DRIVE_FIXED
CPU speed: 2.100000 GHz
Memory total: 3453407232, free: 2212192256

------------ Kernel report ------------
05/01/2013 14:22:29
------------ Loaded modules -----------
\SystemRoot\system32\ntkrnlpa.exe
\SystemRoot\system32\hal.dll
\SystemRoot\system32\kdcom.dll
\SystemRoot\system32\PSHED.dll
\SystemRoot\system32\BOOTVID.dll
\SystemRoot\system32\CLFS.SYS
\SystemRoot\system32\CI.dll
\SystemRoot\system32\drivers\Wdf01000.sys
\SystemRoot\system32\drivers\WDFLDR.SYS
\SystemRoot\system32\drivers\acpi.sys
\SystemRoot\system32\drivers\WMILIB.SYS
\SystemRoot\system32\drivers\msisadrv.sys
\SystemRoot\system32\drivers\pci.sys
\SystemRoot\System32\drivers\partmgr.sys
\SystemRoot\system32\DRIVERS\compbatt.sys
\SystemRoot\system32\DRIVERS\BATTC.SYS
\SystemRoot\system32\drivers\volmgr.sys
\SystemRoot\System32\drivers\volmgrx.sys
\SystemRoot\system32\drivers\pciide.sys
\SystemRoot\system32\drivers\PCIIDEX.SYS
\SystemRoot\System32\drivers\mountmgr.sys
\SystemRoot\System32\Drivers\UBHelper.sys
\SystemRoot\system32\drivers\atapi.sys
\SystemRoot\system32\drivers\ataport.SYS
\SystemRoot\system32\drivers\msahci.sys
\SystemRoot\system32\drivers\fltmgr.sys
\SystemRoot\system32\drivers\fileinfo.sys
\SystemRoot\system32\DRIVERS\psdfilter.sys
\SystemRoot\System32\Drivers\ksecdd.sys
\SystemRoot\system32\drivers\ndis.sys
\SystemRoot\system32\drivers\msrpc.sys
\SystemRoot\system32\drivers\NETIO.SYS
\SystemRoot\System32\Drivers\Ntfs.sys
\SystemRoot\system32\drivers\volsnap.sys
\SystemRoot\System32\Drivers\spldr.sys
\SystemRoot\System32\Drivers\mup.sys
\SystemRoot\System32\drivers\ecache.sys
\SystemRoot\system32\drivers\disk.sys
\SystemRoot\system32\drivers\CLASSPNP.SYS
\SystemRoot\system32\drivers\crcdisk.sys
\SystemRoot\system32\DRIVERS\avgrkx86.sys
\SystemRoot\system32\DRIVERS\AVGIDSEH.Sys
\SystemRoot\system32\DRIVERS\AtiPcie.sys
\SystemRoot\system32\DRIVERS\ahcix86s.sys
\SystemRoot\system32\DRIVERS\storport.sys
\SystemRoot\system32\DRIVERS\tunnel.sys
\SystemRoot\system32\DRIVERS\tunmp.sys
\SystemRoot\system32\DRIVERS\processr.sys
\SystemRoot\system32\DRIVERS\atikmdag.sys
\SystemRoot\System32\drivers\dxgkrnl.sys
\SystemRoot\System32\drivers\watchdog.sys
\SystemRoot\system32\DRIVERS\HDAudBus.sys
\SystemRoot\system32\DRIVERS\athr.sys
\SystemRoot\system32\DRIVERS\L1E60x86.sys
\SystemRoot\system32\DRIVERS\usbohci.sys
\SystemRoot\system32\DRIVERS\USBPORT.SYS
\SystemRoot\system32\DRIVERS\usbfilter.sys
\SystemRoot\system32\DRIVERS\USBD.SYS
\SystemRoot\system32\DRIVERS\usbehci.sys
\SystemRoot\system32\DRIVERS\cdrom.sys
\SystemRoot\system32\DRIVERS\NTIDrvr.sys
\SystemRoot\system32\DRIVERS\i8042prt.sys
\SystemRoot\system32\DRIVERS\DKbFltr.sys
\SystemRoot\system32\DRIVERS\kbdclass.sys
\SystemRoot\system32\DRIVERS\SynTP.sys
\SystemRoot\system32\DRIVERS\mouclass.sys
\SystemRoot\system32\DRIVERS\winbondcir.sys
\SystemRoot\system32\DRIVERS\CmBatt.sys
\SystemRoot\system32\DRIVERS\wmiacpi.sys
\SystemRoot\system32\DRIVERS\msiscsi.sys
\SystemRoot\system32\DRIVERS\TDI.SYS
\SystemRoot\system32\DRIVERS\rasl2tp.sys
\SystemRoot\system32\DRIVERS\ndistapi.sys
\SystemRoot\system32\DRIVERS\ndiswan.sys
\SystemRoot\system32\DRIVERS\raspppoe.sys
\SystemRoot\system32\DRIVERS\raspptp.sys
\SystemRoot\system32\DRIVERS\rassstp.sys
\SystemRoot\system32\DRIVERS\appliand.sys
\SystemRoot\system32\DRIVERS\termdd.sys
\SystemRoot\system32\DRIVERS\swenum.sys
\SystemRoot\system32\DRIVERS\ks.sys
\SystemRoot\system32\DRIVERS\circlass.sys
\SystemRoot\system32\DRIVERS\mssmbios.sys
\SystemRoot\system32\DRIVERS\umbus.sys
\SystemRoot\system32\DRIVERS\usbhub.sys
\SystemRoot\System32\Drivers\NDProxy.SYS
\SystemRoot\system32\drivers\RtHDMIV.sys
\SystemRoot\system32\drivers\portcls.sys
\SystemRoot\system32\drivers\drmk.sys
\SystemRoot\system32\drivers\RTKVHDA.sys
\SystemRoot\system32\DRIVERS\AGRSM.sys
\SystemRoot\system32\drivers\modem.sys
\SystemRoot\system32\DRIVERS\hidir.sys
\SystemRoot\system32\DRIVERS\HIDCLASS.SYS
\SystemRoot\system32\DRIVERS\HIDPARSE.SYS
\SystemRoot\system32\DRIVERS\kbdhid.sys
\SystemRoot\system32\DRIVERS\mouhid.sys
\SystemRoot\system32\DRIVERS\avgmfx86.sys
\SystemRoot\System32\Drivers\Fs_Rec.SYS
\SystemRoot\System32\Drivers\Null.SYS
\SystemRoot\System32\Drivers\Beep.SYS
\??\C:\Windows\system32\drivers\avgtpx86.sys
\SystemRoot\System32\drivers\vga.sys
\SystemRoot\System32\drivers\VIDEOPRT.SYS
\SystemRoot\System32\DRIVERS\RDPCDD.sys
\SystemRoot\system32\drivers\rdpencdd.sys
\SystemRoot\System32\Drivers\Msfs.SYS
\SystemRoot\System32\Drivers\Npfs.SYS
\SystemRoot\System32\DRIVERS\rasacd.sys
\SystemRoot\System32\drivers\tcpip.sys
\SystemRoot\System32\drivers\fwpkclnt.sys
\SystemRoot\system32\DRIVERS\avgfwd6x.sys
\SystemRoot\system32\DRIVERS\tdx.sys
\SystemRoot\system32\DRIVERS\smb.sys
\SystemRoot\system32\DRIVERS\avgtdix.sys
\SystemRoot\System32\DRIVERS\netbt.sys
\SystemRoot\system32\DRIVERS\USBSTOR.SYS
\SystemRoot\system32\DRIVERS\hidusb.sys
\SystemRoot\system32\DRIVERS\usbccgp.sys
\SystemRoot\system32\drivers\RTSTOR.SYS
\SystemRoot\system32\drivers\afd.sys
\SystemRoot\System32\Drivers\usbvideo.sys
\SystemRoot\system32\DRIVERS\pacer.sys
\SystemRoot\system32\DRIVERS\netbios.sys
\SystemRoot\system32\DRIVERS\wanarp.sys
\SystemRoot\system32\DRIVERS\rdbss.sys
\SystemRoot\system32\drivers\nsiproxy.sys
\SystemRoot\System32\Drivers\dfsc.sys
\SystemRoot\system32\DRIVERS\avgldx86.sys
\SystemRoot\system32\DRIVERS\cdfs.sys
\SystemRoot\System32\Drivers\crashdmp.sys
\SystemRoot\System32\Drivers\dump_diskdump.sys
\SystemRoot\System32\Drivers\dump_ahcix86s.sys
\SystemRoot\System32\win32k.sys
\SystemRoot\System32\drivers\Dxapi.sys
\SystemRoot\system32\DRIVERS\monitor.sys
\SystemRoot\System32\TSDDD.dll
\SystemRoot\System32\cdd.dll
\SystemRoot\system32\drivers\luafv.sys
\??\C:\Windows\system32\drivers\mbam.sys
\SystemRoot\system32\DRIVERS\Sftvollh.sys
\SystemRoot\system32\drivers\spsys.sys
\SystemRoot\system32\DRIVERS\lltdio.sys
\SystemRoot\system32\DRIVERS\nwifi.sys
\SystemRoot\system32\DRIVERS\ndisuio.sys
\SystemRoot\system32\DRIVERS\rspndr.sys
\SystemRoot\system32\drivers\HTTP.sys
\SystemRoot\System32\DRIVERS\srvnet.sys
\SystemRoot\system32\DRIVERS\bowser.sys
\SystemRoot\system32\drivers\mrxdav.sys
\SystemRoot\system32\DRIVERS\mrxsmb.sys
\SystemRoot\system32\DRIVERS\mrxsmb10.sys
\SystemRoot\system32\DRIVERS\mrxsmb20.sys
\SystemRoot\System32\DRIVERS\srv2.sys
\SystemRoot\System32\DRIVERS\srv.sys
\SystemRoot\system32\DRIVERS\AVGIDSShim.Sys
\??\C:\Windows\system32\drivers\int15.sys
\SystemRoot\system32\drivers\peauth.sys
\SystemRoot\system32\DRIVERS\PSDNServ.sys
\SystemRoot\system32\DRIVERS\PSDVdisk.sys
\SystemRoot\System32\Drivers\secdrv.SYS
\SystemRoot\system32\DRIVERS\Sftfslh.sys
\SystemRoot\system32\DRIVERS\Sftplaylh.sys
\SystemRoot\System32\drivers\tcpipreg.sys
\SystemRoot\system32\DRIVERS\AVGIDSFilter.Sys
\SystemRoot\system32\DRIVERS\AVGIDSDriver.Sys
\SystemRoot\system32\DRIVERS\Sftredirlh.sys
\??\C:\Windows\system32\drivers\mbamchameleon.sys
\??\C:\Windows\system32\drivers\mbamswissarmy.sys
\Windows\System32\ntdll.dll
----------- End -----------
<<<1>>>
Upper Device Name: \Device\Harddisk1\DR1
Upper Device Object: 0xffffffff87a74358
Upper Device Driver Name: \Driver\disk\
Lower Device Name: \Device\00000085\
Lower Device Object: 0xffffffff87a85230
Lower Device Driver Name: \Driver\USBSTOR\
Driver name found: USBSTOR
Initialization returned 0x0
Load Function returned 0x0
<<<1>>>
Upper Device Name: \Device\Harddisk0\DR0
Upper Device Object: 0xffffffff8674aac8
Upper Device Driver Name: \Driver\disk\
Lower Device Name: \Device\0000006a\
Lower Device Object: 0xffffffff85bb8a90
Lower Device Driver Name: \Driver\ahcix86s\
Driver name found: ahcix86s
Initialization returned 0x0
Port sub-driver loaded: \??\C:\Windows\System32\drivers\Storport.sys (0x0)
Load Function returned 0x0
Downloaded database version: v2013.05.01.05
Downloaded database version: v2013.04.30.01
Initializing...
Done!
<<<2>>>
Device number: 0, partition: 2
Physical Sector Size: 512
Drive: 0, DevicePointer: 0xffffffff8674aac8, DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\disk\
--------- Disk Stack ------
DevicePointer: 0xffffffff8674a7b8, DeviceName: Unknown, DriverName: \Driver\partmgr\
DevicePointer: 0xffffffff8674aac8, DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\disk\
DevicePointer: 0xffffffff85bb8a90, DeviceName: \Device\0000006a\, DriverName: \Driver\ahcix86s\
------------ End ----------
Alternate DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\disk\
Upper DeviceData: 0xffffffffaa105468, 0xffffffff8674aac8, 0xffffffff853baac8
Lower DeviceData: 0xffffffffaa10bec8, 0xffffffff85bb8a90, 0xffffffff885b0740
<<<3>>>
Volume: C:
File system type: NTFS
SectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytes
Scanning directory: C:\Windows\system32\drivers...
<<<2>>>
Device number: 0, partition: 2
<<<3>>>
Volume: C:
File system type: NTFS
SectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytes
Done!
Drive 0
Scanning MBR on drive 0...
Inspecting partition table:
MBR Signature: 55AA
Disk Signature: A7C79539

Partition information:

Partition 0 type is Other (0x27)
Partition is NOT ACTIVE.
Partition starts at LBA: 2048 Numsec = 25165824

Partition 1 type is Primary (0x7)
Partition is ACTIVE.
Partition starts at LBA: 25167872 Numsec = 299984896
Partition file system is NTFS
Partition is bootable

Partition 2 type is Primary (0x7)
Partition is NOT ACTIVE.
Partition starts at LBA: 325152768 Numsec = 292552704

Partition 3 type is Other (0x12)
Partition is NOT ACTIVE.
Partition starts at LBA: 617705472 Numsec = 7434240

Disk Size: 320072933376 bytes
Sector size: 512 bytes

Scanning physical sectors of unpartitioned space on drive 0 (1-2047-625122448-625142448)...
Physical Sector Size: 512
Drive: 1, DevicePointer: 0xffffffff87a74358, DeviceName: \Device\Harddisk1\DR1\, DriverName: \Driver\disk\
--------- Disk Stack ------
DevicePointer: 0xffffffff87a85ca8, DeviceName: Unknown, DriverName: \Driver\partmgr\
DevicePointer: 0xffffffff87a74358, DeviceName: \Device\Harddisk1\DR1\, DriverName: \Driver\disk\
DevicePointer: 0xffffffff87a85230, DeviceName: \Device\00000085\, DriverName: \Driver\USBSTOR\
------------ End ----------
Alternate DeviceName: \Device\Harddisk1\DR1\, DriverName: \Driver\disk\
Upper DeviceData: 0xffffffffac2d17b8, 0xffffffff87a74358, 0xffffffff853b0040
Lower DeviceData: 0xffffffffaa33dc48, 0xffffffff87a85230, 0xffffffff84f72448
Drive 1
Scanning MBR on drive 1...
Inspecting partition table:
MBR Signature: 55AA
Disk Signature: 2E705

Partition information:

Partition 0 type is Primary (0x7)
Partition is NOT ACTIVE.
Partition starts at LBA: 2048 Numsec = 1953517568

Partition 1 type is Empty (0x0)
Partition is NOT ACTIVE.
Partition starts at LBA: 0 Numsec = 0

Partition 2 type is Empty (0x0)
Partition is NOT ACTIVE.
Partition starts at LBA: 0 Numsec = 0

Partition 3 type is Empty (0x0)
Partition is NOT ACTIVE.
Partition starts at LBA: 0 Numsec = 0

Disk Size: 1000202043392 bytes
Sector size: 512 bytes

Done!
Performing system, memory and registry scan...
Scan Interrupted
Done!
Initializing...
Done!
<<<2>>>
Device number: 0, partition: 2
<<<3>>>
Volume: C:
File system type: NTFS
SectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytes
Scanning directory: C:\Windows\system32\drivers...
<<<2>>>
Device number: 0, partition: 2
<<<3>>>
Volume: C:
File system type: NTFS
SectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytes
Done!
Drive 0
Scanning MBR on drive 0...
Inspecting partition table:
MBR Signature: 55AA
Disk Signature: A7C79539

Partition information:

Partition 0 type is Other (0x27)
Partition is NOT ACTIVE.
Partition starts at LBA: 2048 Numsec = 25165824

Partition 1 type is Primary (0x7)
Partition is ACTIVE.
Partition starts at LBA: 25167872 Numsec = 299984896
Partition file system is NTFS
Partition is bootable

Partition 2 type is Primary (0x7)
Partition is NOT ACTIVE.
Partition starts at LBA: 325152768 Numsec = 292552704

Partition 3 type is Other (0x12)
Partition is NOT ACTIVE.
Partition starts at LBA: 617705472 Numsec = 7434240

Disk Size: 320072933376 bytes
Sector size: 512 bytes

Scanning physical sectors of unpartitioned space on drive 0 (1-2047-625122448-625142448)...
Drive 1
Scanning MBR on drive 1...
Inspecting partition table:
MBR Signature: 55AA
Disk Signature: 2E705

Partition information:

Partition 0 type is Primary (0x7)
Partition is NOT ACTIVE.
Partition starts at LBA: 2048 Numsec = 1953517568

Partition 1 type is Empty (0x0)
Partition is NOT ACTIVE.
Partition starts at LBA: 0 Numsec = 0

Partition 2 type is Empty (0x0)
Partition is NOT ACTIVE.
Partition starts at LBA: 0 Numsec = 0

Partition 3 type is Empty (0x0)
Partition is NOT ACTIVE.
Partition starts at LBA: 0 Numsec = 0

Disk Size: 1000202043392 bytes
Sector size: 512 bytes

Done!
Performing system, memory and registry scan...
Infected: c:\Windows\$NtUninstallKB5150$\922821407\U --> [Backdoor.0Access]
Infected: c:\Windows\$NtUninstallKB5150$\922821407 --> [Backdoor.0Access]
Done!
Scan finished
Creating System Restore point...
Scheduling clean up...
<<<2>>>
Device number: 0, partition: 2
<<<3>>>
Volume: C:
File system type: NTFS
SectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytes
Executing an action fixdamage.exe...
Success!
Removal successful. No system shutdown is required.
=======================================

---------------------------------------
Malwarebytes Anti-Rootkit BETA 1.05.0.1001

(c) Malwarebytes Corporation 2011-2012

OS version: 6.0.6001 Windows Vista Service Pack 1 x86

Account is Administrative

Internet Explorer version: 7.0.6001.18000

Java version: 1.6.0_22

File system is: NTFS
Disk drives: C:\ DRIVE_FIXED, D:\ DRIVE_FIXED, G:\ DRIVE_FIXED, Q:\ DRIVE_FIXED
CPU speed: 2.100000 GHz
Memory total: 3453407232, free: 2036056064

------------ Kernel report ------------
05/01/2013 15:22:14
------------ Loaded modules -----------
\SystemRoot\system32\ntkrnlpa.exe
\SystemRoot\system32\hal.dll
\SystemRoot\system32\kdcom.dll
\SystemRoot\system32\PSHED.dll
\SystemRoot\system32\BOOTVID.dll
\SystemRoot\system32\CLFS.SYS
\SystemRoot\system32\CI.dll
\SystemRoot\system32\drivers\Wdf01000.sys
\SystemRoot\system32\drivers\WDFLDR.SYS
\SystemRoot\system32\drivers\acpi.sys
\SystemRoot\system32\drivers\WMILIB.SYS
\SystemRoot\system32\drivers\msisadrv.sys
\SystemRoot\system32\drivers\pci.sys
\SystemRoot\System32\drivers\partmgr.sys
\SystemRoot\system32\DRIVERS\compbatt.sys
\SystemRoot\system32\DRIVERS\BATTC.SYS
\SystemRoot\system32\drivers\volmgr.sys
\SystemRoot\System32\drivers\volmgrx.sys
\SystemRoot\system32\drivers\pciide.sys
\SystemRoot\system32\drivers\PCIIDEX.SYS
\SystemRoot\System32\drivers\mountmgr.sys
\SystemRoot\System32\Drivers\UBHelper.sys
\SystemRoot\system32\drivers\atapi.sys
\SystemRoot\system32\drivers\ataport.SYS
\SystemRoot\system32\drivers\msahci.sys
\SystemRoot\system32\drivers\fltmgr.sys
\SystemRoot\system32\drivers\fileinfo.sys
\SystemRoot\system32\DRIVERS\psdfilter.sys
\SystemRoot\System32\Drivers\ksecdd.sys
\SystemRoot\system32\drivers\ndis.sys
\SystemRoot\system32\drivers\msrpc.sys
\SystemRoot\system32\drivers\NETIO.SYS
\SystemRoot\System32\Drivers\Ntfs.sys
\SystemRoot\system32\drivers\volsnap.sys
\SystemRoot\System32\Drivers\spldr.sys
\SystemRoot\System32\Drivers\mup.sys
\SystemRoot\System32\drivers\ecache.sys
\SystemRoot\system32\drivers\disk.sys
\SystemRoot\system32\drivers\CLASSPNP.SYS
\SystemRoot\system32\drivers\crcdisk.sys
\SystemRoot\system32\DRIVERS\avgrkx86.sys
\SystemRoot\system32\DRIVERS\AVGIDSEH.Sys
\SystemRoot\system32\DRIVERS\AtiPcie.sys
\SystemRoot\system32\DRIVERS\ahcix86s.sys
\SystemRoot\system32\DRIVERS\storport.sys
\SystemRoot\system32\DRIVERS\tunnel.sys
\SystemRoot\system32\DRIVERS\tunmp.sys
\SystemRoot\system32\DRIVERS\processr.sys
\SystemRoot\system32\DRIVERS\atikmdag.sys
\SystemRoot\System32\drivers\dxgkrnl.sys
\SystemRoot\System32\drivers\watchdog.sys
\SystemRoot\system32\DRIVERS\HDAudBus.sys
\SystemRoot\system32\DRIVERS\athr.sys
\SystemRoot\system32\DRIVERS\L1E60x86.sys
\SystemRoot\system32\DRIVERS\usbohci.sys
\SystemRoot\system32\DRIVERS\USBPORT.SYS
\SystemRoot\system32\DRIVERS\usbfilter.sys
\SystemRoot\system32\DRIVERS\USBD.SYS
\SystemRoot\system32\DRIVERS\usbehci.sys
\SystemRoot\system32\DRIVERS\cdrom.sys
\SystemRoot\system32\DRIVERS\NTIDrvr.sys
\SystemRoot\system32\DRIVERS\i8042prt.sys
\SystemRoot\system32\DRIVERS\DKbFltr.sys
\SystemRoot\system32\DRIVERS\kbdclass.sys
\SystemRoot\system32\DRIVERS\SynTP.sys
\SystemRoot\system32\DRIVERS\mouclass.sys
\SystemRoot\system32\DRIVERS\winbondcir.sys
\SystemRoot\system32\DRIVERS\CmBatt.sys
\SystemRoot\system32\DRIVERS\wmiacpi.sys
\SystemRoot\system32\DRIVERS\msiscsi.sys
\SystemRoot\system32\DRIVERS\TDI.SYS
\SystemRoot\system32\DRIVERS\rasl2tp.sys
\SystemRoot\system32\DRIVERS\ndistapi.sys
\SystemRoot\system32\DRIVERS\ndiswan.sys
\SystemRoot\system32\DRIVERS\raspppoe.sys
\SystemRoot\system32\DRIVERS\raspptp.sys
\SystemRoot\system32\DRIVERS\rassstp.sys
\SystemRoot\system32\DRIVERS\appliand.sys
\SystemRoot\system32\DRIVERS\termdd.sys
\SystemRoot\system32\DRIVERS\swenum.sys
\SystemRoot\system32\DRIVERS\ks.sys
\SystemRoot\system32\DRIVERS\circlass.sys
\SystemRoot\system32\DRIVERS\mssmbios.sys
\SystemRoot\system32\DRIVERS\umbus.sys
\SystemRoot\system32\DRIVERS\usbhub.sys
\SystemRoot\System32\Drivers\NDProxy.SYS
\SystemRoot\system32\drivers\RtHDMIV.sys
\SystemRoot\system32\drivers\portcls.sys
\SystemRoot\system32\drivers\drmk.sys
\SystemRoot\system32\drivers\RTKVHDA.sys
\SystemRoot\system32\DRIVERS\AGRSM.sys
\SystemRoot\system32\drivers\modem.sys
\SystemRoot\system32\DRIVERS\hidir.sys
\SystemRoot\system32\DRIVERS\HIDCLASS.SYS
\SystemRoot\system32\DRIVERS\HIDPARSE.SYS
\SystemRoot\system32\DRIVERS\kbdhid.sys
\SystemRoot\system32\DRIVERS\mouhid.sys
\SystemRoot\system32\DRIVERS\avgmfx86.sys
\SystemRoot\System32\Drivers\Fs_Rec.SYS
\SystemRoot\System32\Drivers\Null.SYS
\SystemRoot\System32\Drivers\Beep.SYS
\??\C:\Windows\system32\drivers\avgtpx86.sys
\SystemRoot\System32\drivers\vga.sys
\SystemRoot\System32\drivers\VIDEOPRT.SYS
\SystemRoot\System32\DRIVERS\RDPCDD.sys
\SystemRoot\system32\drivers\rdpencdd.sys
\SystemRoot\System32\Drivers\Msfs.SYS
\SystemRoot\System32\Drivers\Npfs.SYS
\SystemRoot\System32\DRIVERS\rasacd.sys
\SystemRoot\System32\drivers\tcpip.sys
\SystemRoot\System32\drivers\fwpkclnt.sys
\SystemRoot\system32\DRIVERS\avgfwd6x.sys
\SystemRoot\system32\DRIVERS\tdx.sys
\SystemRoot\system32\DRIVERS\smb.sys
\SystemRoot\system32\DRIVERS\avgtdix.sys
\SystemRoot\System32\DRIVERS\netbt.sys
\SystemRoot\system32\DRIVERS\USBSTOR.SYS
\SystemRoot\system32\DRIVERS\hidusb.sys
\SystemRoot\system32\DRIVERS\usbccgp.sys
\SystemRoot\system32\drivers\RTSTOR.SYS
\SystemRoot\system32\drivers\afd.sys
\SystemRoot\System32\Drivers\usbvideo.sys
\SystemRoot\system32\DRIVERS\pacer.sys
\SystemRoot\system32\DRIVERS\netbios.sys
\SystemRoot\system32\DRIVERS\wanarp.sys
\SystemRoot\system32\DRIVERS\rdbss.sys
\SystemRoot\system32\drivers\nsiproxy.sys
\SystemRoot\System32\Drivers\dfsc.sys
\SystemRoot\system32\DRIVERS\avgldx86.sys
\SystemRoot\system32\DRIVERS\cdfs.sys
\SystemRoot\System32\Drivers\crashdmp.sys
\SystemRoot\System32\Drivers\dump_diskdump.sys
\SystemRoot\System32\Drivers\dump_ahcix86s.sys
\SystemRoot\System32\win32k.sys
\SystemRoot\System32\drivers\Dxapi.sys
\SystemRoot\system32\DRIVERS\monitor.sys
\SystemRoot\System32\TSDDD.dll
\SystemRoot\System32\cdd.dll
\SystemRoot\system32\drivers\luafv.sys
\??\C:\Windows\system32\drivers\mbam.sys
\SystemRoot\system32\DRIVERS\Sftvollh.sys
\SystemRoot\system32\drivers\spsys.sys
\SystemRoot\system32\DRIVERS\lltdio.sys
\SystemRoot\system32\DRIVERS\nwifi.sys
\SystemRoot\system32\DRIVERS\ndisuio.sys
\SystemRoot\system32\DRIVERS\rspndr.sys
\SystemRoot\system32\drivers\HTTP.sys
\SystemRoot\System32\DRIVERS\srvnet.sys
\SystemRoot\system32\DRIVERS\bowser.sys
\SystemRoot\system32\drivers\mrxdav.sys
\SystemRoot\system32\DRIVERS\mrxsmb.sys
\SystemRoot\system32\DRIVERS\mrxsmb10.sys
\SystemRoot\system32\DRIVERS\mrxsmb20.sys
\SystemRoot\System32\DRIVERS\srv2.sys
\SystemRoot\System32\DRIVERS\srv.sys
\SystemRoot\system32\DRIVERS\AVGIDSShim.Sys
\??\C:\Windows\system32\drivers\int15.sys
\SystemRoot\system32\drivers\peauth.sys
\SystemRoot\system32\DRIVERS\PSDNServ.sys
\SystemRoot\system32\DRIVERS\PSDVdisk.sys
\SystemRoot\System32\Drivers\secdrv.SYS
\SystemRoot\system32\DRIVERS\Sftfslh.sys
\SystemRoot\system32\DRIVERS\Sftplaylh.sys
\SystemRoot\System32\drivers\tcpipreg.sys
\SystemRoot\system32\DRIVERS\AVGIDSFilter.Sys
\SystemRoot\system32\DRIVERS\AVGIDSDriver.Sys
\SystemRoot\system32\DRIVERS\Sftredirlh.sys
\SystemRoot\System32\drivers\mpsdrv.sys
\SystemRoot\system32\drivers\MSPQM.sys
\SystemRoot\system32\drivers\MSPCLOCK.sys
\??\C:\Windows\system32\drivers\mbamchameleon.sys
\??\C:\Windows\system32\drivers\mbamswissarmy.sys
\Windows\System32\ntdll.dll
----------- End -----------
<<<1>>>
Upper Device Name: \Device\Harddisk1\DR1
Upper Device Object: 0xffffffff87a74358
Upper Device Driver Name: \Driver\disk\
Lower Device Name: \Device\00000085\
Lower Device Object: 0xffffffff87a85230
Lower Device Driver Name: \Driver\USBSTOR\
Device already Exists: 0xffffffff84f72448
<<<1>>>
Upper Device Name: \Device\Harddisk0\DR0
Upper Device Object: 0xffffffff8674aac8
Upper Device Driver Name: \Driver\disk\
Lower Device Name: \Device\0000006a\
Lower Device Object: 0xffffffff85bb8a90
Lower Device Driver Name: \Driver\ahcix86s\
Device already Exists: 0xffffffff885b0740
Initializing...
Done!
<<<2>>>
Device number: 0, partition: 2
Physical Sector Size: 512
Drive: 0, DevicePointer: 0xffffffff8674aac8, DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\disk\
--------- Disk Stack ------
DevicePointer: 0xffffffff8674a7b8, DeviceName: Unknown, DriverName: \Driver\partmgr\
DevicePointer: 0xffffffff8674aac8, DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\disk\
DevicePointer: 0xffffffff85bb8a90, DeviceName: \Device\0000006a\, DriverName: \Driver\ahcix86s\
------------ End ----------
Alternate DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\disk\
Upper DeviceData: 0xffffffff89a43410, 0xffffffff8674aac8, 0xffffffff853baac8
Lower DeviceData: 0xffffffffaa3400a0, 0xffffffff85bb8a90, 0xffffffff885b0740
<<<3>>>
Volume: C:
File system type: NTFS
SectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytes
Scanning directory: C:\Windows\system32\drivers...
<<<2>>>
Device number: 0, partition: 2
<<<3>>>
Volume: C:
File system type: NTFS
SectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytes
Done!
Drive 0
Scanning MBR on drive 0...
Inspecting partition table:
MBR Signature: 55AA
Disk Signature: A7C79539

Partition information:

Partition 0 type is Other (0x27)
Partition is NOT ACTIVE.
Partition starts at LBA: 2048 Numsec = 25165824

Partition 1 type is Primary (0x7)
Partition is ACTIVE.
Partition starts at LBA: 25167872 Numsec = 299984896
Partition file system is NTFS
Partition is bootable

Partition 2 type is Primary (0x7)
Partition is NOT ACTIVE.
Partition starts at LBA: 325152768 Numsec = 292552704

Partition 3 type is Other (0x12)
Partition is NOT ACTIVE.
Partition starts at LBA: 617705472 Numsec = 7434240

Disk Size: 320072933376 bytes
Sector size: 512 bytes

Scanning physical sectors of unpartitioned space on drive 0 (1-2047-625122448-625142448)...
Physical Sector Size: 512
Drive: 1, DevicePointer: 0xffffffff87a74358, DeviceName: \Device\Harddisk1\DR1\, DriverName: \Driver\disk\
--------- Disk Stack ------
DevicePointer: 0xffffffff87a85ca8, DeviceName: Unknown, DriverName: \Driver\partmgr\
DevicePointer: 0xffffffff87a74358, DeviceName: \Device\Harddisk1\DR1\, DriverName: \Driver\disk\
DevicePointer: 0xffffffff87a85230, DeviceName: \Device\00000085\, DriverName: \Driver\USBSTOR\
------------ End ----------
Alternate DeviceName: \Device\Harddisk1\DR1\, DriverName: \Driver\disk\
Upper DeviceData: 0xffffffff8a21f128, 0xffffffff87a74358, 0xffffffff853b0040
Lower DeviceData: 0xffffffffa59f8218, 0xffffffff87a85230, 0xffffffff84f72448
Drive 1
Scanning MBR on drive 1...
Inspecting partition table:
MBR Signature: 55AA
Disk Signature: 2E705

Partition information:

Partition 0 type is Primary (0x7)
Partition is NOT ACTIVE.
Partition starts at LBA: 2048 Numsec = 1953517568

Partition 1 type is Empty (0x0)
Partition is NOT ACTIVE.
Partition starts at LBA: 0 Numsec = 0

Partition 2 type is Empty (0x0)
Partition is NOT ACTIVE.
Partition starts at LBA: 0 Numsec = 0

Partition 3 type is Empty (0x0)
Partition is NOT ACTIVE.
Partition starts at LBA: 0 Numsec = 0

Disk Size: 1000202043392 bytes
Sector size: 512 bytes

Done!
Performing system, memory and registry scan...
Infected: c:\windows\$ntuninstallkb5150$\922821407 --> [Backdoor.0Access]
Done!
Scan finished
Creating System Restore point...
Scheduling clean up...
<<<2>>>
Device number: 0, partition: 2
<<<3>>>
Volume: C:
File system type: NTFS
SectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytes
Executing an action fixdamage.exe...
Success!
Removal successful. No system shutdown is required.
=======================================

---------------------------------------
Malwarebytes Anti-Rootkit BETA 1.05.0.1001

(c) Malwarebytes Corporation 2011-2012

OS version: 6.0.6001 Windows Vista Service Pack 1 x86

Account is Administrative

Internet Explorer version: 7.0.6001.18000

Java version: 1.6.0_22

File system is: NTFS
Disk drives: C:\ DRIVE_FIXED, D:\ DRIVE_FIXED, G:\ DRIVE_FIXED, Q:\ DRIVE_FIXED
CPU speed: 2.100000 GHz
Memory total: 3453407232, free: 2446151680

Removal queue found; removal started
Removing c:\windows\$ntuninstallkb5150$\922821407...
Removal finished
=======================================
---------------------------------------
Malwarebytes Anti-Rootkit BETA 1.05.0.1001

(c) Malwarebytes Corporation 2011-2012

OS version: 6.0.6001 Windows Vista Service Pack 1 x86

Account is Administrative

Internet Explorer version: 7.0.6001.18000

Java version: 1.6.0_22

File system is: NTFS
Disk drives: C:\ DRIVE_FIXED, D:\ DRIVE_FIXED, G:\ DRIVE_FIXED, Q:\ DRIVE_FIXED
CPU speed: 2.100000 GHz
Memory total: 3453407232, free: 2097541120

------------ Kernel report ------------
05/01/2013 16:17:26
------------ Loaded modules -----------
\SystemRoot\system32\ntkrnlpa.exe
\SystemRoot\system32\hal.dll
\SystemRoot\system32\kdcom.dll
\SystemRoot\system32\PSHED.dll
\SystemRoot\system32\BOOTVID.dll
\SystemRoot\system32\CLFS.SYS
\SystemRoot\system32\CI.dll
\SystemRoot\system32\drivers\Wdf01000.sys
\SystemRoot\system32\drivers\WDFLDR.SYS
\SystemRoot\system32\drivers\acpi.sys
\SystemRoot\system32\drivers\WMILIB.SYS
\SystemRoot\system32\drivers\msisadrv.sys
\SystemRoot\system32\drivers\pci.sys
\SystemRoot\System32\drivers\partmgr.sys
\SystemRoot\system32\DRIVERS\compbatt.sys
\SystemRoot\system32\DRIVERS\BATTC.SYS
\SystemRoot\system32\drivers\volmgr.sys
\SystemRoot\System32\drivers\volmgrx.sys
\SystemRoot\system32\drivers\pciide.sys
\SystemRoot\system32\drivers\PCIIDEX.SYS
\SystemRoot\System32\drivers\mountmgr.sys
\SystemRoot\System32\Drivers\UBHelper.sys
\SystemRoot\system32\drivers\atapi.sys
\SystemRoot\system32\drivers\ataport.SYS
\SystemRoot\system32\drivers\msahci.sys
\SystemRoot\system32\drivers\fltmgr.sys
\SystemRoot\system32\drivers\fileinfo.sys
\SystemRoot\system32\DRIVERS\psdfilter.sys
\SystemRoot\System32\Drivers\ksecdd.sys
\SystemRoot\system32\drivers\ndis.sys
\SystemRoot\system32\drivers\msrpc.sys
\SystemRoot\system32\drivers\NETIO.SYS
\SystemRoot\System32\Drivers\Ntfs.sys
\SystemRoot\system32\drivers\volsnap.sys
\SystemRoot\System32\Drivers\spldr.sys
\SystemRoot\System32\Drivers\mup.sys
\SystemRoot\System32\drivers\ecache.sys
\SystemRoot\system32\drivers\disk.sys
\SystemRoot\system32\drivers\CLASSPNP.SYS
\SystemRoot\system32\drivers\crcdisk.sys
\SystemRoot\system32\DRIVERS\avgrkx86.sys
\SystemRoot\system32\DRIVERS\AVGIDSEH.Sys
\SystemRoot\system32\DRIVERS\AtiPcie.sys
\SystemRoot\system32\DRIVERS\ahcix86s.sys
\SystemRoot\system32\DRIVERS\storport.sys
\SystemRoot\system32\DRIVERS\tunnel.sys
\SystemRoot\system32\DRIVERS\tunmp.sys
\SystemRoot\system32\DRIVERS\processr.sys
\SystemRoot\system32\DRIVERS\atikmdag.sys
\SystemRoot\System32\drivers\dxgkrnl.sys
\SystemRoot\System32\drivers\watchdog.sys
\SystemRoot\system32\DRIVERS\HDAudBus.sys
\SystemRoot\system32\DRIVERS\athr.sys
\SystemRoot\system32\DRIVERS\L1E60x86.sys
\SystemRoot\system32\DRIVERS\usbohci.sys
\SystemRoot\system32\DRIVERS\USBPORT.SYS
\SystemRoot\system32\DRIVERS\usbfilter.sys
\SystemRoot\system32\DRIVERS\USBD.SYS
\SystemRoot\system32\DRIVERS\usbehci.sys
\SystemRoot\system32\DRIVERS\cdrom.sys
\SystemRoot\system32\DRIVERS\NTIDrvr.sys
\SystemRoot\system32\DRIVERS\i8042prt.sys
\SystemRoot\system32\DRIVERS\DKbFltr.sys
\SystemRoot\system32\DRIVERS\kbdclass.sys
\SystemRoot\system32\DRIVERS\SynTP.sys
\SystemRoot\system32\DRIVERS\mouclass.sys
\SystemRoot\system32\DRIVERS\winbondcir.sys
\SystemRoot\system32\DRIVERS\CmBatt.sys
\SystemRoot\system32\DRIVERS\wmiacpi.sys
\SystemRoot\system32\DRIVERS\msiscsi.sys
\SystemRoot\system32\DRIVERS\TDI.SYS
\SystemRoot\system32\DRIVERS\rasl2tp.sys
\SystemRoot\system32\DRIVERS\ndistapi.sys
\SystemRoot\system32\DRIVERS\ndiswan.sys
\SystemRoot\system32\DRIVERS\raspppoe.sys
\SystemRoot\system32\DRIVERS\raspptp.sys
\SystemRoot\system32\DRIVERS\rassstp.sys
\SystemRoot\system32\DRIVERS\appliand.sys
\SystemRoot\system32\DRIVERS\termdd.sys
\SystemRoot\system32\DRIVERS\swenum.sys
\SystemRoot\system32\DRIVERS\ks.sys
\SystemRoot\system32\DRIVERS\circlass.sys
\SystemRoot\system32\DRIVERS\mssmbios.sys
\SystemRoot\system32\DRIVERS\umbus.sys
\SystemRoot\system32\DRIVERS\usbhub.sys
\SystemRoot\System32\Drivers\NDProxy.SYS
\SystemRoot\system32\drivers\RtHDMIV.sys
\SystemRoot\system32\drivers\portcls.sys
\SystemRoot\system32\drivers\drmk.sys
\SystemRoot\system32\drivers\RTKVHDA.sys
\SystemRoot\system32\DRIVERS\AGRSM.sys
\SystemRoot\system32\drivers\modem.sys
\SystemRoot\system32\DRIVERS\hidir.sys
\SystemRoot\system32\DRIVERS\HIDCLASS.SYS
\SystemRoot\system32\DRIVERS\HIDPARSE.SYS
\SystemRoot\system32\DRIVERS\kbdhid.sys
\SystemRoot\system32\DRIVERS\mouhid.sys
\SystemRoot\system32\DRIVERS\avgmfx86.sys
\SystemRoot\System32\Drivers\Fs_Rec.SYS
\SystemRoot\System32\Drivers\Null.SYS
\SystemRoot\System32\Drivers\Beep.SYS
\??\C:\Windows\system32\drivers\avgtpx86.sys
\SystemRoot\System32\drivers\vga.sys
\SystemRoot\System32\drivers\VIDEOPRT.SYS
\SystemRoot\System32\DRIVERS\RDPCDD.sys
\SystemRoot\system32\drivers\rdpencdd.sys
\SystemRoot\System32\Drivers\Msfs.SYS
\SystemRoot\System32\Drivers\Npfs.SYS
\SystemRoot\System32\DRIVERS\rasacd.sys
\SystemRoot\System32\drivers\tcpip.sys
\SystemRoot\System32\drivers\fwpkclnt.sys
\SystemRoot\system32\DRIVERS\avgfwd6x.sys
\SystemRoot\system32\DRIVERS\tdx.sys
\SystemRoot\system32\DRIVERS\smb.sys
\SystemRoot\system32\DRIVERS\avgtdix.sys
\SystemRoot\System32\DRIVERS\netbt.sys
\SystemRoot\system32\drivers\RTSTOR.SYS
\SystemRoot\system32\DRIVERS\USBSTOR.SYS
\SystemRoot\system32\drivers\afd.sys
\SystemRoot\system32\DRIVERS\pacer.sys
\SystemRoot\system32\DRIVERS\netbios.sys
\SystemRoot\system32\DRIVERS\wanarp.sys
\SystemRoot\system32\DRIVERS\rdbss.sys
\SystemRoot\system32\drivers\nsiproxy.sys
\SystemRoot\System32\Drivers\dfsc.sys
\SystemRoot\system32\DRIVERS\avgldx86.sys
\SystemRoot\system32\DRIVERS\hidusb.sys
\SystemRoot\system32\DRIVERS\usbccgp.sys
\SystemRoot\System32\Drivers\usbvideo.sys
\SystemRoot\system32\DRIVERS\cdfs.sys
\SystemRoot\System32\Drivers\crashdmp.sys
\SystemRoot\System32\Drivers\dump_diskdump.sys
\SystemRoot\System32\Drivers\dump_ahcix86s.sys
\SystemRoot\System32\win32k.sys
\SystemRoot\System32\drivers\Dxapi.sys
\SystemRoot\system32\DRIVERS\monitor.sys
\SystemRoot\System32\TSDDD.dll
\SystemRoot\System32\cdd.dll
\SystemRoot\system32\drivers\luafv.sys
\??\C:\Windows\system32\drivers\mbam.sys
\SystemRoot\system32\DRIVERS\Sftvollh.sys
\SystemRoot\system32\drivers\spsys.sys
\SystemRoot\system32\DRIVERS\lltdio.sys
\SystemRoot\system32\DRIVERS\nwifi.sys
\SystemRoot\system32\DRIVERS\ndisuio.sys
\SystemRoot\system32\DRIVERS\rspndr.sys
\SystemRoot\system32\drivers\HTTP.sys
\SystemRoot\System32\DRIVERS\srvnet.sys
\SystemRoot\system32\DRIVERS\bowser.sys
\SystemRoot\System32\drivers\mpsdrv.sys
\SystemRoot\system32\drivers\mrxdav.sys
\SystemRoot\system32\DRIVERS\mrxsmb.sys
\SystemRoot\system32\DRIVERS\mrxsmb10.sys
\SystemRoot\system32\DRIVERS\mrxsmb20.sys
\SystemRoot\System32\DRIVERS\srv2.sys
\SystemRoot\System32\DRIVERS\srv.sys
\SystemRoot\system32\DRIVERS\AVGIDSShim.Sys
\??\C:\Windows\system32\drivers\int15.sys
\SystemRoot\system32\drivers\peauth.sys
\SystemRoot\system32\DRIVERS\PSDNServ.sys
\SystemRoot\system32\DRIVERS\PSDVdisk.sys
\SystemRoot\System32\Drivers\secdrv.SYS
\SystemRoot\system32\DRIVERS\Sftfslh.sys
\SystemRoot\system32\DRIVERS\Sftplaylh.sys
\SystemRoot\System32\drivers\tcpipreg.sys
\SystemRoot\system32\DRIVERS\AVGIDSFilter.Sys
\SystemRoot\system32\DRIVERS\AVGIDSDriver.Sys
\SystemRoot\system32\DRIVERS\Sftredirlh.sys
\??\C:\Windows\system32\drivers\mbamchameleon.sys
\??\C:\Windows\system32\drivers\mbamswissarmy.sys
\Windows\System32\ntdll.dll
----------- End -----------
May 1st, 2013, 07:35 PM
Obsession

<<<1>>>
Upper Device Name: \Device\Harddisk1\DR1
Upper Device Object: 0xffffffff878b6250
Upper Device Driver Name: \Driver\disk\
Lower Device Name: \Device\00000087\
Lower Device Object: 0xffffffff878f3030
Lower Device Driver Name: \Driver\USBSTOR\
Driver name found: USBSTOR
Initialization returned 0x0
Load Function returned 0x0
<<<1>>>
Upper Device Name: \Device\Harddisk0\DR0
Upper Device Object: 0xffffffff86611ac8
Upper Device Driver Name: \Driver\disk\
Lower Device Name: \Device\0000006a\
Lower Device Object: 0xffffffff85bb8c90
Lower Device Driver Name: \Driver\ahcix86s\
Driver name found: ahcix86s
Initialization returned 0x0
Port sub-driver loaded: \??\C:\Windows\System32\drivers\Storport.sys (0x0)
Load Function returned 0x0
Initializing...
Done!
<<<2>>>
Device number: 0, partition: 2
Physical Sector Size: 512
Drive: 0, DevicePointer: 0xffffffff86611ac8, DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\disk\
--------- Disk Stack ------
DevicePointer: 0xffffffff8650e180, DeviceName: Unknown, DriverName: \Driver\partmgr\
DevicePointer: 0xffffffff86611ac8, DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\disk\
DevicePointer: 0xffffffff85bb8c90, DeviceName: \Device\0000006a\, DriverName: \Driver\ahcix86s\
------------ End ----------
Alternate DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\disk\
Upper DeviceData: 0xffffffffa8cb46e8, 0xffffffff86611ac8, 0xffffffff8514f7f0
Lower DeviceData: 0xffffffffa8c24118, 0xffffffff85bb8c90, 0xffffffff84f7eb68
<<<3>>>
Volume: C:
File system type: NTFS
SectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytes
Scanning directory: C:\Windows\system32\drivers...
<<<2>>>
Device number: 0, partition: 2
<<<3>>>
Volume: C:
File system type: NTFS
SectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytes
Done!
Drive 0
Scanning MBR on drive 0...
Inspecting partition table:
MBR Signature: 55AA
Disk Signature: A7C79539

Partition information:

Partition 0 type is Other (0x27)
Partition is NOT ACTIVE.
Partition starts at LBA: 2048 Numsec = 25165824

Partition 1 type is Primary (0x7)
Partition is ACTIVE.
Partition starts at LBA: 25167872 Numsec = 299984896
Partition file system is NTFS
Partition is bootable

Partition 2 type is Primary (0x7)
Partition is NOT ACTIVE.
Partition starts at LBA: 325152768 Numsec = 292552704

Partition 3 type is Other (0x12)
Partition is NOT ACTIVE.
Partition starts at LBA: 617705472 Numsec = 7434240

Disk Size: 320072933376 bytes
Sector size: 512 bytes

Scanning physical sectors of unpartitioned space on drive 0 (1-2047-625122448-625142448)...
Physical Sector Size: 512
Drive: 1, DevicePointer: 0xffffffff878b6250, DeviceName: \Device\Harddisk1\DR1\, DriverName: \Driver\disk\
--------- Disk Stack ------
DevicePointer: 0xffffffff878b6b20, DeviceName: Unknown, DriverName: \Driver\partmgr\
DevicePointer: 0xffffffff878b6250, DeviceName: \Device\Harddisk1\DR1\, DriverName: \Driver\disk\
DevicePointer: 0xffffffff878f3030, DeviceName: \Device\00000087\, DriverName: \Driver\USBSTOR\
------------ End ----------
Alternate DeviceName: \Device\Harddisk1\DR1\, DriverName: \Driver\disk\
Upper DeviceData: 0xffffffffad7e9620, 0xffffffff878b6250, 0xffffffff851c38c8
Lower DeviceData: 0xffffffffaa339ac8, 0xffffffff878f3030, 0xffffffff85400888
Drive 1
Scanning MBR on drive 1...
Inspecting partition table:
MBR Signature: 55AA
Disk Signature: 2E705

Partition information:

Partition 0 type is Primary (0x7)
Partition is NOT ACTIVE.
Partition starts at LBA: 2048 Numsec = 1953517568

Partition 1 type is Empty (0x0)
Partition is NOT ACTIVE.
Partition starts at LBA: 0 Numsec = 0

Partition 2 type is Empty (0x0)
Partition is NOT ACTIVE.
Partition starts at LBA: 0 Numsec = 0

Partition 3 type is Empty (0x0)
Partition is NOT ACTIVE.
Partition starts at LBA: 0 Numsec = 0

Disk Size: 1000202043392 bytes
Sector size: 512 bytes

Done!
Performing system, memory and registry scan...
Scan Interrupted
Done!
=======================================

---------------------------------------
Malwarebytes Anti-Rootkit BETA 1.05.0.1001

(c) Malwarebytes Corporation 2011-2012

OS version: 6.0.6001 Windows Vista Service Pack 1 x86

Account is Administrative

Internet Explorer version: 7.0.6001.18000

Java version: 1.6.0_22

File system is: NTFS
Disk drives: C:\ DRIVE_FIXED, D:\ DRIVE_FIXED, Q:\ DRIVE_FIXED
CPU speed: 2.100000 GHz
Memory total: 3453407232, free: 2436313088

Removal queue found; removal started
Removing c:\windows\$ntuninstallkb5150$\922821407...
Removal finished
=======================================
---------------------------------------
Malwarebytes Anti-Rootkit BETA 1.05.0.1001

(c) Malwarebytes Corporation 2011-2012

OS version: 6.0.6001 Windows Vista Service Pack 1 x86

Account is Administrative

Internet Explorer version: 7.0.6001.18000

Java version: 1.6.0_22

File system is: NTFS
Disk drives: C:\ DRIVE_FIXED, D:\ DRIVE_FIXED, Q:\ DRIVE_FIXED
CPU speed: 2.100000 GHz
Memory total: 3453407232, free: 2089553920

------------ Kernel report ------------
05/02/2013 00:05:27
------------ Loaded modules -----------
\SystemRoot\system32\ntkrnlpa.exe
\SystemRoot\system32\hal.dll
\SystemRoot\system32\kdcom.dll
\SystemRoot\system32\PSHED.dll
\SystemRoot\system32\BOOTVID.dll
\SystemRoot\system32\CLFS.SYS
\SystemRoot\system32\CI.dll
\SystemRoot\system32\drivers\Wdf01000.sys
\SystemRoot\system32\drivers\WDFLDR.SYS
\SystemRoot\system32\drivers\acpi.sys
\SystemRoot\system32\drivers\WMILIB.SYS
\SystemRoot\system32\drivers\msisadrv.sys
\SystemRoot\system32\drivers\pci.sys
\SystemRoot\System32\drivers\partmgr.sys
\SystemRoot\system32\DRIVERS\compbatt.sys
\SystemRoot\system32\DRIVERS\BATTC.SYS
\SystemRoot\system32\drivers\volmgr.sys
\SystemRoot\System32\drivers\volmgrx.sys
\SystemRoot\system32\drivers\pciide.sys
\SystemRoot\system32\drivers\PCIIDEX.SYS
\SystemRoot\System32\drivers\mountmgr.sys
\SystemRoot\System32\Drivers\UBHelper.sys
\SystemRoot\system32\drivers\atapi.sys
\SystemRoot\system32\drivers\ataport.SYS
\SystemRoot\system32\drivers\msahci.sys
\SystemRoot\system32\drivers\fltmgr.sys
\SystemRoot\system32\drivers\fileinfo.sys
\SystemRoot\system32\DRIVERS\psdfilter.sys
\SystemRoot\System32\Drivers\ksecdd.sys
\SystemRoot\system32\drivers\ndis.sys
\SystemRoot\system32\drivers\msrpc.sys
\SystemRoot\system32\drivers\NETIO.SYS
\SystemRoot\System32\Drivers\Ntfs.sys
\SystemRoot\system32\drivers\volsnap.sys
\SystemRoot\System32\Drivers\spldr.sys
\SystemRoot\System32\Drivers\mup.sys
\SystemRoot\System32\drivers\ecache.sys
\SystemRoot\system32\drivers\disk.sys
\SystemRoot\system32\drivers\CLASSPNP.SYS
\SystemRoot\system32\drivers\crcdisk.sys
\SystemRoot\system32\DRIVERS\avgrkx86.sys
\SystemRoot\system32\DRIVERS\AVGIDSEH.Sys
\SystemRoot\system32\DRIVERS\AtiPcie.sys
\SystemRoot\system32\DRIVERS\ahcix86s.sys
\SystemRoot\system32\DRIVERS\storport.sys
\SystemRoot\system32\DRIVERS\tunnel.sys
\SystemRoot\system32\DRIVERS\tunmp.sys
\SystemRoot\system32\DRIVERS\processr.sys
\SystemRoot\system32\DRIVERS\atikmdag.sys
\SystemRoot\System32\drivers\dxgkrnl.sys
\SystemRoot\System32\drivers\watchdog.sys
\SystemRoot\system32\DRIVERS\HDAudBus.sys
\SystemRoot\system32\DRIVERS\athr.sys
\SystemRoot\system32\DRIVERS\L1E60x86.sys
\SystemRoot\system32\DRIVERS\usbohci.sys
\SystemRoot\system32\DRIVERS\USBPORT.SYS
\SystemRoot\system32\DRIVERS\usbfilter.sys
\SystemRoot\system32\DRIVERS\USBD.SYS
\SystemRoot\system32\DRIVERS\usbehci.sys
\SystemRoot\system32\DRIVERS\cdrom.sys
\SystemRoot\system32\DRIVERS\NTIDrvr.sys
\SystemRoot\system32\DRIVERS\i8042prt.sys
\SystemRoot\system32\DRIVERS\DKbFltr.sys
\SystemRoot\system32\DRIVERS\kbdclass.sys
\SystemRoot\system32\DRIVERS\SynTP.sys
\SystemRoot\system32\DRIVERS\mouclass.sys
\SystemRoot\system32\DRIVERS\winbondcir.sys
\SystemRoot\system32\DRIVERS\CmBatt.sys
\SystemRoot\system32\DRIVERS\wmiacpi.sys
\SystemRoot\system32\DRIVERS\msiscsi.sys
\SystemRoot\system32\DRIVERS\TDI.SYS
\SystemRoot\system32\DRIVERS\rasl2tp.sys
\SystemRoot\system32\DRIVERS\ndistapi.sys
\SystemRoot\system32\DRIVERS\ndiswan.sys
\SystemRoot\system32\DRIVERS\raspppoe.sys
\SystemRoot\system32\DRIVERS\raspptp.sys
\SystemRoot\system32\DRIVERS\rassstp.sys
\SystemRoot\system32\DRIVERS\appliand.sys
\SystemRoot\system32\DRIVERS\termdd.sys
\SystemRoot\system32\DRIVERS\swenum.sys
\SystemRoot\system32\DRIVERS\ks.sys
\SystemRoot\system32\DRIVERS\circlass.sys
\SystemRoot\system32\DRIVERS\mssmbios.sys
\SystemRoot\system32\DRIVERS\umbus.sys
\SystemRoot\system32\DRIVERS\usbhub.sys
\SystemRoot\System32\Drivers\NDProxy.SYS
\SystemRoot\system32\drivers\RtHDMIV.sys
\SystemRoot\system32\drivers\portcls.sys
\SystemRoot\system32\drivers\drmk.sys
\SystemRoot\system32\drivers\RTKVHDA.sys
\SystemRoot\system32\DRIVERS\AGRSM.sys
\SystemRoot\system32\drivers\modem.sys
\SystemRoot\system32\DRIVERS\hidir.sys
\SystemRoot\system32\DRIVERS\HIDCLASS.SYS
\SystemRoot\system32\DRIVERS\HIDPARSE.SYS
\SystemRoot\system32\DRIVERS\kbdhid.sys
\SystemRoot\system32\DRIVERS\mouhid.sys
\SystemRoot\system32\DRIVERS\avgmfx86.sys
\SystemRoot\System32\Drivers\Fs_Rec.SYS
\SystemRoot\System32\Drivers\Null.SYS
\SystemRoot\System32\Drivers\Beep.SYS
\??\C:\Windows\system32\drivers\avgtpx86.sys
\SystemRoot\System32\drivers\vga.sys
\SystemRoot\System32\drivers\VIDEOPRT.SYS
\SystemRoot\System32\DRIVERS\RDPCDD.sys
\SystemRoot\system32\drivers\rdpencdd.sys
\SystemRoot\System32\Drivers\Msfs.SYS
\SystemRoot\System32\Drivers\Npfs.SYS
\SystemRoot\System32\DRIVERS\rasacd.sys
\SystemRoot\System32\drivers\tcpip.sys
\SystemRoot\System32\drivers\fwpkclnt.sys
\SystemRoot\system32\DRIVERS\avgfwd6x.sys
\SystemRoot\system32\DRIVERS\tdx.sys
\SystemRoot\system32\DRIVERS\smb.sys
\SystemRoot\system32\DRIVERS\avgtdix.sys
\SystemRoot\System32\DRIVERS\netbt.sys
\SystemRoot\system32\drivers\RTSTOR.SYS
\SystemRoot\system32\drivers\afd.sys
\SystemRoot\system32\DRIVERS\usbccgp.sys
\SystemRoot\system32\DRIVERS\pacer.sys
\SystemRoot\system32\DRIVERS\netbios.sys
\SystemRoot\system32\DRIVERS\wanarp.sys
\SystemRoot\System32\Drivers\usbvideo.sys
\SystemRoot\system32\DRIVERS\rdbss.sys
\SystemRoot\system32\drivers\nsiproxy.sys
\SystemRoot\System32\Drivers\dfsc.sys
\SystemRoot\system32\DRIVERS\avgldx86.sys
\SystemRoot\system32\DRIVERS\cdfs.sys
\SystemRoot\System32\Drivers\crashdmp.sys
\SystemRoot\System32\Drivers\dump_diskdump.sys
\SystemRoot\System32\Drivers\dump_ahcix86s.sys
\SystemRoot\System32\win32k.sys
\SystemRoot\System32\drivers\Dxapi.sys
\SystemRoot\system32\DRIVERS\monitor.sys
\SystemRoot\System32\TSDDD.dll
\SystemRoot\System32\cdd.dll
\SystemRoot\system32\drivers\luafv.sys
\??\C:\Windows\system32\drivers\mbam.sys
\SystemRoot\system32\DRIVERS\Sftvollh.sys
\SystemRoot\system32\drivers\spsys.sys
\SystemRoot\system32\DRIVERS\lltdio.sys
\SystemRoot\system32\DRIVERS\nwifi.sys
\SystemRoot\system32\DRIVERS\ndisuio.sys
\SystemRoot\system32\DRIVERS\rspndr.sys
\SystemRoot\system32\drivers\HTTP.sys
\SystemRoot\System32\DRIVERS\srvnet.sys
\SystemRoot\system32\DRIVERS\bowser.sys
\SystemRoot\System32\drivers\mpsdrv.sys
\SystemRoot\system32\drivers\mrxdav.sys
\SystemRoot\system32\DRIVERS\mrxsmb.sys
\SystemRoot\system32\DRIVERS\mrxsmb10.sys
\SystemRoot\system32\DRIVERS\mrxsmb20.sys
\SystemRoot\System32\DRIVERS\srv2.sys
\SystemRoot\System32\DRIVERS\srv.sys
\SystemRoot\system32\DRIVERS\AVGIDSShim.Sys
\??\C:\Windows\system32\drivers\int15.sys
\SystemRoot\system32\drivers\peauth.sys
\SystemRoot\system32\DRIVERS\PSDNServ.sys
\SystemRoot\system32\DRIVERS\PSDVdisk.sys
\SystemRoot\System32\Drivers\secdrv.SYS
\SystemRoot\system32\DRIVERS\Sftfslh.sys
\SystemRoot\system32\DRIVERS\Sftplaylh.sys
\SystemRoot\System32\drivers\tcpipreg.sys
\SystemRoot\system32\DRIVERS\AVGIDSFilter.Sys
\SystemRoot\system32\DRIVERS\AVGIDSDriver.Sys
\SystemRoot\system32\DRIVERS\Sftredirlh.sys
\??\C:\Windows\system32\drivers\mbamchameleon.sys
\??\C:\Windows\system32\drivers\mbamswissarmy.sys
\Windows\System32\ntdll.dll
----------- End -----------
<<<1>>>
Upper Device Name: \Device\Harddisk0\DR0
Upper Device Object: 0xffffffff865181a0
Upper Device Driver Name: \Driver\disk\
Lower Device Name: \Device\0000006a\
Lower Device Object: 0xffffffff8585aad8
Lower Device Driver Name: \Driver\ahcix86s\
Driver name found: ahcix86s
Initialization returned 0x0
Port sub-driver loaded: \??\C:\Windows\System32\drivers\Storport.sys (0x0)
Load Function returned 0x0
Initializing...
Done!
<<<2>>>
Device number: 0, partition: 2
Physical Sector Size: 512
Drive: 0, DevicePointer: 0xffffffff865181a0, DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\disk\
--------- Disk Stack ------
DevicePointer: 0xffffffff8661bd20, DeviceName: Unknown, DriverName: \Driver\partmgr\
DevicePointer: 0xffffffff865181a0, DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\disk\
DevicePointer: 0xffffffff8585aad8, DeviceName: \Device\0000006a\, DriverName: \Driver\ahcix86s\
------------ End ----------
Alternate DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\disk\
Upper DeviceData: 0xffffffffa9b4f838, 0xffffffff865181a0, 0xffffffff8539dac8
Lower DeviceData: 0xffffffffaaf433a8, 0xffffffff8585aad8, 0xffffffff85387288
<<<3>>>
Volume: C:
File system type: NTFS
SectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytes
Scanning directory: C:\Windows\system32\drivers...
<<<2>>>
Device number: 0, partition: 2
<<<3>>>
Volume: C:
File system type: NTFS
SectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytes
Done!
Drive 0
Scanning MBR on drive 0...
Inspecting partition table:
MBR Signature: 55AA
Disk Signature: A7C79539

Partition information:

Partition 0 type is Other (0x27)
Partition is NOT ACTIVE.
Partition starts at LBA: 2048 Numsec = 25165824

Partition 1 type is Primary (0x7)
Partition is ACTIVE.
Partition starts at LBA: 25167872 Numsec = 299984896
Partition file system is NTFS
Partition is bootable

Partition 2 type is Primary (0x7)
Partition is NOT ACTIVE.
Partition starts at LBA: 325152768 Numsec = 292552704

Partition 3 type is Other (0x12)
Partition is NOT ACTIVE.
Partition starts at LBA: 617705472 Numsec = 7434240

Disk Size: 320072933376 bytes
Sector size: 512 bytes

Scanning physical sectors of unpartitioned space on drive 0 (1-2047-625122448-625142448)...
Done!
Performing system, memory and registry scan...
Infected: c:\windows\$ntuninstallkb5150$\922821407 --> [Backdoor.0Access]
Done!
Scan finished
Creating System Restore point...
Scheduling clean up...
<<<2>>>
Device number: 0, partition: 2
<<<3>>>
Volume: C:
File system type: NTFS
SectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytes
Executing an action fixdamage.exe...
Success!
Removal successful. No system shutdown is required.
=======================================

---------------------------------------
Malwarebytes Anti-Rootkit BETA 1.05.0.1001

(c) Malwarebytes Corporation 2011-2012

OS version: 6.0.6001 Windows Vista Service Pack 1 x86

Account is Administrative

Internet Explorer version: 7.0.6001.18000

Java version: 1.6.0_22

File system is: NTFS
Disk drives: C:\ DRIVE_FIXED, D:\ DRIVE_FIXED, Q:\ DRIVE_FIXED
CPU speed: 2.100000 GHz
Memory total: 3453407232, free: 2463416320

Removal queue found; removal started
Removing c:\windows\$ntuninstallkb5150$\922821407...
Removal finished
=======================================
---------------------------------------
Malwarebytes Anti-Rootkit BETA 1.05.0.1001

(c) Malwarebytes Corporation 2011-2012

OS version: 6.0.6001 Windows Vista Service Pack 1 x86

Account is Administrative

Internet Explorer version: 7.0.6001.18000

Java version: 1.6.0_22

File system is: NTFS
Disk drives: C:\ DRIVE_FIXED, D:\ DRIVE_FIXED, Q:\ DRIVE_FIXED
CPU speed: 2.100000 GHz
Memory total: 3453407232, free: 2210590720

------------ Kernel report ------------
05/02/2013 00:39:48
------------ Loaded modules -----------
\SystemRoot\system32\ntkrnlpa.exe
\SystemRoot\system32\hal.dll
\SystemRoot\system32\kdcom.dll
\SystemRoot\system32\PSHED.dll
\SystemRoot\system32\BOOTVID.dll
\SystemRoot\system32\CLFS.SYS
\SystemRoot\system32\CI.dll
\SystemRoot\system32\drivers\Wdf01000.sys
\SystemRoot\system32\drivers\WDFLDR.SYS
\SystemRoot\system32\drivers\acpi.sys
\SystemRoot\system32\drivers\WMILIB.SYS
\SystemRoot\system32\drivers\msisadrv.sys
\SystemRoot\system32\drivers\pci.sys
\SystemRoot\System32\drivers\partmgr.sys
\SystemRoot\system32\DRIVERS\compbatt.sys
\SystemRoot\system32\DRIVERS\BATTC.SYS
\SystemRoot\system32\drivers\volmgr.sys
\SystemRoot\System32\drivers\volmgrx.sys
\SystemRoot\system32\drivers\pciide.sys
\SystemRoot\system32\drivers\PCIIDEX.SYS
\SystemRoot\System32\drivers\mountmgr.sys
\SystemRoot\System32\Drivers\UBHelper.sys
\SystemRoot\system32\drivers\atapi.sys
\SystemRoot\system32\drivers\ataport.SYS
\SystemRoot\system32\drivers\msahci.sys
\SystemRoot\system32\drivers\fltmgr.sys
\SystemRoot\system32\drivers\fileinfo.sys
\SystemRoot\system32\DRIVERS\psdfilter.sys
\SystemRoot\System32\Drivers\ksecdd.sys
\SystemRoot\system32\drivers\ndis.sys
\SystemRoot\system32\drivers\msrpc.sys
\SystemRoot\system32\drivers\NETIO.SYS
\SystemRoot\System32\Drivers\Ntfs.sys
\SystemRoot\system32\drivers\volsnap.sys
\SystemRoot\System32\Drivers\spldr.sys
\SystemRoot\System32\Drivers\mup.sys
\SystemRoot\System32\drivers\ecache.sys
\SystemRoot\system32\drivers\disk.sys
\SystemRoot\system32\drivers\CLASSPNP.SYS
\SystemRoot\system32\drivers\crcdisk.sys
\SystemRoot\system32\DRIVERS\avgrkx86.sys
\SystemRoot\system32\DRIVERS\AVGIDSEH.Sys
\SystemRoot\system32\DRIVERS\AtiPcie.sys
\SystemRoot\system32\DRIVERS\ahcix86s.sys
\SystemRoot\system32\DRIVERS\storport.sys
\SystemRoot\system32\DRIVERS\tunnel.sys
\SystemRoot\system32\DRIVERS\tunmp.sys
\SystemRoot\system32\DRIVERS\processr.sys
\SystemRoot\system32\DRIVERS\atikmdag.sys
\SystemRoot\System32\drivers\dxgkrnl.sys
\SystemRoot\System32\drivers\watchdog.sys
\SystemRoot\system32\DRIVERS\HDAudBus.sys
\SystemRoot\system32\DRIVERS\athr.sys
\SystemRoot\system32\DRIVERS\L1E60x86.sys
\SystemRoot\system32\DRIVERS\usbohci.sys
\SystemRoot\system32\DRIVERS\USBPORT.SYS
\SystemRoot\system32\DRIVERS\usbfilter.sys
\SystemRoot\system32\DRIVERS\USBD.SYS
\SystemRoot\system32\DRIVERS\usbehci.sys
\SystemRoot\system32\DRIVERS\cdrom.sys
\SystemRoot\system32\DRIVERS\NTIDrvr.sys
\SystemRoot\system32\DRIVERS\i8042prt.sys
\SystemRoot\system32\DRIVERS\DKbFltr.sys
\SystemRoot\system32\DRIVERS\kbdclass.sys
\SystemRoot\system32\DRIVERS\SynTP.sys
\SystemRoot\system32\DRIVERS\mouclass.sys
\SystemRoot\system32\DRIVERS\winbondcir.sys
\SystemRoot\system32\DRIVERS\CmBatt.sys
\SystemRoot\system32\DRIVERS\wmiacpi.sys
\SystemRoot\system32\DRIVERS\msiscsi.sys
\SystemRoot\system32\DRIVERS\TDI.SYS
\SystemRoot\system32\DRIVERS\rasl2tp.sys
\SystemRoot\system32\DRIVERS\ndistapi.sys
\SystemRoot\system32\DRIVERS\ndiswan.sys
\SystemRoot\system32\DRIVERS\raspppoe.sys
\SystemRoot\system32\DRIVERS\raspptp.sys
\SystemRoot\system32\DRIVERS\rassstp.sys
\SystemRoot\system32\DRIVERS\appliand.sys
\SystemRoot\system32\DRIVERS\termdd.sys
\SystemRoot\system32\DRIVERS\swenum.sys
\SystemRoot\system32\DRIVERS\ks.sys
\SystemRoot\system32\DRIVERS\circlass.sys
\SystemRoot\system32\DRIVERS\mssmbios.sys
\SystemRoot\system32\DRIVERS\umbus.sys
\SystemRoot\system32\DRIVERS\usbhub.sys
\SystemRoot\System32\Drivers\NDProxy.SYS
\SystemRoot\system32\drivers\RtHDMIV.sys
\SystemRoot\system32\drivers\portcls.sys
\SystemRoot\system32\drivers\drmk.sys
\SystemRoot\system32\drivers\RTKVHDA.sys
\SystemRoot\system32\DRIVERS\AGRSM.sys
\SystemRoot\system32\drivers\modem.sys
\SystemRoot\system32\DRIVERS\hidir.sys
\SystemRoot\system32\DRIVERS\HIDCLASS.SYS
\SystemRoot\system32\DRIVERS\HIDPARSE.SYS
\SystemRoot\system32\DRIVERS\kbdhid.sys
\SystemRoot\system32\DRIVERS\mouhid.sys
\SystemRoot\system32\DRIVERS\avgmfx86.sys
\SystemRoot\System32\Drivers\Fs_Rec.SYS
\SystemRoot\System32\Drivers\Null.SYS
\SystemRoot\System32\Drivers\Beep.SYS
\??\C:\Windows\system32\drivers\avgtpx86.sys
\SystemRoot\System32\drivers\vga.sys
\SystemRoot\System32\drivers\VIDEOPRT.SYS
\SystemRoot\System32\DRIVERS\RDPCDD.sys
\SystemRoot\system32\drivers\rdpencdd.sys
\SystemRoot\System32\Drivers\Msfs.SYS
\SystemRoot\System32\Drivers\Npfs.SYS
\SystemRoot\System32\DRIVERS\rasacd.sys
\SystemRoot\System32\drivers\tcpip.sys
\SystemRoot\System32\drivers\fwpkclnt.sys
\SystemRoot\system32\DRIVERS\avgfwd6x.sys
\SystemRoot\system32\DRIVERS\tdx.sys
\SystemRoot\system32\DRIVERS\smb.sys
\SystemRoot\system32\DRIVERS\avgtdix.sys
\SystemRoot\System32\DRIVERS\netbt.sys
\SystemRoot\system32\drivers\afd.sys
\SystemRoot\system32\DRIVERS\pacer.sys
\SystemRoot\system32\DRIVERS\netbios.sys
\SystemRoot\system32\DRIVERS\wanarp.sys
\SystemRoot\system32\DRIVERS\rdbss.sys
\SystemRoot\system32\drivers\nsiproxy.sys
\SystemRoot\System32\Drivers\dfsc.sys
\SystemRoot\system32\DRIVERS\avgldx86.sys
\SystemRoot\system32\drivers\RTSTOR.SYS
\SystemRoot\system32\DRIVERS\usbccgp.sys
\SystemRoot\System32\Drivers\usbvideo.sys
\SystemRoot\system32\DRIVERS\cdfs.sys
\SystemRoot\System32\Drivers\crashdmp.sys
\SystemRoot\System32\Drivers\dump_diskdump.sys
\SystemRoot\System32\Drivers\dump_ahcix86s.sys
\SystemRoot\System32\win32k.sys
\SystemRoot\System32\drivers\Dxapi.sys
\SystemRoot\system32\DRIVERS\monitor.sys
\SystemRoot\System32\TSDDD.dll
\SystemRoot\System32\cdd.dll
\SystemRoot\system32\drivers\luafv.sys
\??\C:\Windows\system32\drivers\mbam.sys
\SystemRoot\system32\DRIVERS\Sftvollh.sys
\SystemRoot\system32\drivers\spsys.sys
\SystemRoot\system32\DRIVERS\lltdio.sys
\SystemRoot\system32\DRIVERS\nwifi.sys
\SystemRoot\system32\DRIVERS\ndisuio.sys
\SystemRoot\system32\DRIVERS\rspndr.sys
\SystemRoot\system32\drivers\HTTP.sys
\SystemRoot\System32\DRIVERS\srvnet.sys
\SystemRoot\system32\DRIVERS\bowser.sys
\SystemRoot\System32\drivers\mpsdrv.sys
\SystemRoot\system32\drivers\mrxdav.sys
\SystemRoot\system32\DRIVERS\mrxsmb.sys
\SystemRoot\system32\DRIVERS\mrxsmb10.sys
\SystemRoot\system32\DRIVERS\mrxsmb20.sys
\SystemRoot\System32\DRIVERS\srv2.sys
\SystemRoot\System32\DRIVERS\srv.sys
\SystemRoot\system32\DRIVERS\AVGIDSShim.Sys
\??\C:\Windows\system32\drivers\int15.sys
\SystemRoot\system32\drivers\peauth.sys
\SystemRoot\system32\DRIVERS\PSDNServ.sys
\SystemRoot\system32\DRIVERS\PSDVdisk.sys
\SystemRoot\System32\Drivers\secdrv.SYS
\SystemRoot\system32\DRIVERS\Sftfslh.sys
\SystemRoot\system32\DRIVERS\Sftplaylh.sys
\SystemRoot\System32\drivers\tcpipreg.sys
\SystemRoot\system32\DRIVERS\AVGIDSFilter.Sys
\SystemRoot\system32\DRIVERS\AVGIDSDriver.Sys
\SystemRoot\system32\DRIVERS\Sftredirlh.sys
\??\C:\Windows\system32\drivers\mbamchameleon.sys
\??\C:\Windows\system32\drivers\mbamswissarmy.sys
\Windows\System32\ntdll.dll
----------- End -----------
<<<1>>>
Upper Device Name: \Device\Harddisk0\DR0
Upper Device Object: 0xffffffff865c5ac8
Upper Device Driver Name: \Driver\disk\
Lower Device Name: \Device\0000006a\
Lower Device Object: 0xffffffff85bb87f8
Lower Device Driver Name: \Driver\ahcix86s\
Driver name found: ahcix86s
Initialization returned 0x0
Port sub-driver loaded: \??\C:\Windows\System32\drivers\Storport.sys (0x0)
Load Function returned 0x0
Downloaded database version: v2013.05.01.06
Downloaded database version: v2013.05.01.07
Downloaded database version: v2013.05.01.08
Initializing...
Done!
<<<2>>>
Device number: 0, partition: 2
Physical Sector Size: 512
Drive: 0, DevicePointer: 0xffffffff865c5ac8, DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\disk\
--------- Disk Stack ------
DevicePointer: 0xffffffff864c2258, DeviceName: Unknown, DriverName: \Driver\partmgr\
DevicePointer: 0xffffffff865c5ac8, DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\disk\
DevicePointer: 0xffffffff85bb87f8, DeviceName: \Device\0000006a\, DriverName: \Driver\ahcix86s\
------------ End ----------
Alternate DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\disk\
Upper DeviceData: 0xffffffffaaa13ee8, 0xffffffff865c5ac8, 0xffffffff853bbac8
Lower DeviceData: 0xffffffffaa763cf0, 0xffffffff85bb87f8, 0xffffffff851722a8
<<<3>>>
Volume: C:
File system type: NTFS
SectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytes
Scanning directory: C:\Windows\system32\drivers...
<<<2>>>
Device number: 0, partition: 2
<<<3>>>
Volume: C:
File system type: NTFS
SectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytes
Done!
Drive 0
Scanning MBR on drive 0...
Inspecting partition table:
MBR Signature: 55AA
Disk Signature: A7C79539

Partition information:

Partition 0 type is Other (0x27)
Partition is NOT ACTIVE.
Partition starts at LBA: 2048 Numsec = 25165824

Partition 1 type is Primary (0x7)
Partition is ACTIVE.
Partition starts at LBA: 25167872 Numsec = 299984896
Partition file system is NTFS
Partition is bootable

Partition 2 type is Primary (0x7)
Partition is NOT ACTIVE.
Partition starts at LBA: 325152768 Numsec = 292552704

Partition 3 type is Other (0x12)
Partition is NOT ACTIVE.
Partition starts at LBA: 617705472 Numsec = 7434240

Disk Size: 320072933376 bytes
Sector size: 512 bytes

Scanning physical sectors of unpartitioned space on drive 0 (1-2047-625122448-625142448)...
Done!
Performing system, memory and registry scan...
Infected: c:\windows\$ntuninstallkb5150$\922821407 --> [Backdoor.0Access]
Done!
Scan finished
Creating System Restore point...
Scheduling clean up...
<<<2>>>
Device number: 0, partition: 2
<<<3>>>
Volume: C:
File system type: NTFS
SectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytes
Executing an action fixdamage.exe...
Success!
Removal successful. No system shutdown is required
=======================================
May 1st, 2013, 07:56 PM
Broni
Please download Farbar Recovery Scan Tool and save it to your desktop.

Note: You need to run the version compatibale with your system. If you are not sure which version applies to your system download both of them and try to run them. Only one of them will run on your system, that will be the right version.
- Double-click to run it. When the tool opens click Yes to disclaimer.[/*]
- Press Scan button.[/*]
- It will make a log (FRST.txt) in the same directory the tool is run. Please copy and paste it to your reply.[/*]
- The first time the tool is run, it makes also another log (Addition.txt). Please attach it to your reply.[/*]
May 2nd, 2013, 07:11 AM
Obsession

Ok here we go, thanks for the quick responces,

Note: i didnt close down firefox because it wasnt in the instructions.

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 01-05-2013
Ran by Meo (administrator) on 02-05-2013 12:47:01
Running from C:\Users\Meo\Desktop
Windows Vista (TM) Home Premium Service Pack 1 (X86) OS Language: Dutch Standard
Internet Explorer Version 7
Boot Mode: Normal
==================== Processes (Whitelisted) ===================

(AVG Technologies CZ, s.r.o.) C:\PROGRA~1\AVG\AVG10\avgchsvx.exe
(ATI Technologies Inc.) C:\Windows\system32\Ati2evxx.exe
(Microsoft Corporation) C:\Windows\system32\SLsvc.exe
(ATI Technologies Inc.) C:\Windows\system32\Ati2evxx.exe
(Agere Systems) C:\Windows\system32\agrsmsvc.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files\AVG\AVG10\avgwdsvc.exe
() C:\Program Files\Acer Arcade Deluxe\HomeMedia\Kernel\DMP\CLHNService.exe
(Egis Incorporated) C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\eDSService.exe
() C:\Program Files\Acer\Empowering Technology\Service\ETService.exe
(Malwarebytes Corporation) C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe
(Malwarebytes Corporation) C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
(McAfee, Inc.) C:\Program Files\McAfee\SiteAdvisor\McSACore.exe
() C:\Acer\Mobility Center\MobilityService.exe
(NewTech Infosystems, Inc.) C:\Program Files\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe
() C:\Program Files\Cyberlink\Shared files\RichVideo.exe
(Microsoft Corporation) C:\Program Files\Microsoft Application Virtualization Client\sftvsa.exe
(Malwarebytes Corporation) C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files\AVG\AVG10\avgnsx.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files\AVG\AVG10\avgemcx.exe
() C:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater\14.2.0\ToolbarUpdater.exe
(Microsoft Corporation) C:\Program Files\Microsoft Application Virtualization Client\sftlist.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSAgent.exe
(Microsoft Corporation) C:\Windows\system32\conime.exe
(Realtek Semiconductor) C:\Windows\RtHDVCpl.exe
(Google) C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
(Acer Inc.) C:\Program Files\Acer\Empowering Technology\ePower\ePower_DMC.exe
(Egis Incorporated) C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\eDSLoader.exe
(Acer Incorporated) C:\Program Files\Acer\Empowering Technology\eAudio\eAudio.exe
(Synaptics, Inc.) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
(Advanced Micro Devices Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
() C:\Windows\PLFSetI.exe
(Realtek Semiconductor Corp.) C:\Users\Meo\AppData\Local\Temp\RtkBtMnt.exe
(Dritek System Inc.) C:\Program Files\Launch Manager\QtZgAcer.EXE
(CyberLink Corp.) C:\Program Files\Acer Arcade Deluxe\Acer Arcade Deluxe\ArcadeDeluxeAgent.exe
(CyberLink) C:\Program Files\Acer Arcade Deluxe\Acer Arcade Deluxe\Kernel\CLML\CLMLSvc.exe
(Acer Corp.) C:\Program Files\Acer Arcade Deluxe\PlayMovie\PMVService.exe
(Sun Microsystems, Inc.) C:\Program Files\Common Files\Java\Java Update\jusched.exe
() C:\Program Files\DivX\DivX Update\DivXUpdate.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files\AVG\AVG10\avgtray.exe
() C:\Program Files\AVG Secure Search\vprot.exe
() C:\Program Files\uTorrent\uTorrent.exe
(Google Inc.) C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
(ooVoo LLC) C:\Program Files\ooVoo\ooVoo.exe
(Microsoft Corporation) C:\Windows\system32\wbem\unsecapp.exe
(Skype Technologies S.A.) C:\Program Files\Skype\Phone\Skype.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
(Synaptics, Inc.) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
() C:\Program Files\AVG\AVG10\Identity Protection\agent\bin\avgidsmonitor.exe
(ATI Technologies Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(AVG Technologies CZ, s.r.o.) C:\PROGRA~1\AVG\AVG10\avgrsx.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files\AVG\AVG10\avgcsrvx.exe
(Microsoft Corporation) C:\Windows\system32\wuauclt.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\plugin-container.exe
(Adobe Systems, Inc.) C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_6_602_180.exe
(Adobe Systems, Inc.) C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_6_602_180.exe
(Microsoft Corporation) C:\Windows\system32\UI0Detect.exe
(acer) C:\Program Files\Acer\Empowering Technology\NotificationCenter\Framework.NotificationCenter.exe
(Farbar) C:\Users\Meo\Desktop\FRST.exe

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [RtHDVCpl] RtHDVCpl.exe [x]
HKLM\...\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup [30192 2011-04-10] (Google)
HKLM\...\Run: [ePower_DMC] C:\Program Files\Acer\Empowering Technology\ePower\ePower_DMC.exe [417792 2008-11-28] (Acer Inc.)
HKLM\...\Run: [eDataSecurity Loader] C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\eDSloader.exe [526896 2008-07-29] (Egis Incorporated)
HKLM\...\Run: [eAudio] "C:\Program Files\Acer\Empowering Technology\eAudio\eAudio.exe" [544768 2008-09-11] (Acer Incorporated)
HKLM\...\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [34672 2008-06-12] (Adobe Systems Incorporated)
HKLM\...\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun [61440 2008-08-29] (Advanced Micro Devices, Inc.)
HKLM\...\Run: [Skytel] Skytel.exe [x]
HKLM\...\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [1049896 2008-04-25] (Synaptics, Inc.)
HKLM\...\Run: [PLFSetI] C:\Windows\PLFSetI.exe [200704 2008-06-30] ()
HKLM\...\Run: [LManager] C:\PROGRA~1\LAUNCH~1\QtZgAcer.EXE [817672 2008-06-17] (Dritek System Inc.)
HKLM\...\Run: [eRecoveryService] [x]
HKLM\...\Run: [ArcadeDeluxeAgent] "C:\Program Files\Acer Arcade Deluxe\Acer Arcade Deluxe\ArcadeDeluxeAgent.exe" [147456 2008-10-08] (CyberLink Corp.)
HKLM\...\Run: [CLMLServer] "C:\Program Files\Acer Arcade Deluxe\Acer Arcade Deluxe\Kernel\CLML\CLMLSvc.exe" [167936 2008-10-08] (CyberLink)
HKLM\...\Run: [PlayMovie] "C:\Program Files\Acer Arcade Deluxe\PlayMovie\PMVService.exe" [167936 2008-10-17] (Acer Corp.)
HKLM\...\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe" [248552 2010-05-14] (Sun Microsystems, Inc.)
HKLM\...\Run: [DivXUpdate] "C:\Program Files\DivX\DivX Update\DivXUpdate.exe" /CHECKNOW [1230704 2011-03-21] ()
HKLM\...\Run: [AVG_TRAY] C:\Program Files\AVG\AVG10\avgtray.exe [2338656 2011-09-10] (AVG Technologies CZ, s.r.o.)
HKLM\...\Run: [vProt] "C:\Program Files\AVG Secure Search\vprot.exe" [1151152 2013-02-20] ()
HKCU\...\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter [x]
HKCU\...\Run: [ProductReg] "C:\Program Files\Acer\WR_PopUp\ProductReg.exe" [135168 2008-11-17] (Acer)
HKCU\...\Run: [uTorrent] "C:\Program Files\uTorrent\uTorrent.exe" [224000 2011-04-10] ()
HKCU\...\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [68856 2011-04-10] (Google Inc.)
HKCU\...\Run: [ooVoo.exe] C:\Program Files\ooVoo\oovoo.exe /minimized [22459984 2011-12-12] (ooVoo LLC)
HKCU\...\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized [17351304 2011-10-13] (Skype Technologies S.A.)
HKCU\...\RunOnce: [FlashPlayerUpdate] C:\Windows\system32\Macromed\Flash\FlashUtil32_11_6_602_180_Plugin.exe -update plugin [706776 2013-03-13] (Adobe Systems Incorporated)
HKU\Default\...\Run: [ProductReg] C:\Program Files\Acer\WR_PopUp\ProductReg.exe [ 2008-11-17] (Acer)
HKU\Default\...\RunOnce: [AcerScrSav] C:\Windows\Acer\run_NB.exe [ 2007-08-21] ()
HKU\Default User\...\Run: [ProductReg] C:\Program Files\Acer\WR_PopUp\ProductReg.exe [ 2008-11-17] (Acer)
HKU\Default User\...\RunOnce: [AcerScrSav] C:\Windows\Acer\run_NB.exe [ 2007-08-21] ()
Startup: C:\Users\Meo\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2007 Schermopname en Snel starten.lnk
ShortcutTarget: OneNote 2007 Schermopname en Snel starten.lnk -> C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE (Microsoft Corporation)
BootExecute: autocheck autochk * C:\PROGRA~1\AVG\AVG10\avgchsvx.exe /syncC:\PROGRA~1\AVG\AVG10\avgrsx.exe /sync /restart

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://homepage.acer.com/rdr.aspx?b=...m=aspire_6530g
HKCU\Software\Microsoft\Internet Explorer\Main,Secondary Start Pages = http://global.acer.com
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://homepage.acer.com/rdr.aspx?b=...m=aspire_6530g
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://homepage.acer.com/rdr.aspx?b=...m=aspire_6530g
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://homepage.acer.com/rdr.aspx?b=...m=aspire_6530g
HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
URLSearchHook: (No Name) - {A3BC75A2-1F87-4686-AA43-5347D756017C} - No File
URLSearchHook: McAfee SiteAdvisor Toolbar - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll (McAfee, Inc.)
SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = http://search.live.com/results.aspx?q={searchTerms}&src={referrer:source?}
SearchScopes: HKCU - {70D46D94-BF1E-45ED-B567-48701376298E} URL = http://127.0.0.1:4664/search&s=JqVIWTADqvXmsf_dU0TmpNOw04Y?q={searchTerms}
SearchScopes: HKCU - {95B7759C-8C7F-4BF1-B163-73684A933233} URL = http://isearch.avg.com/search?cid={DF5570F4-F975-4E56-BA74-D25803B7E433}&mid=db4477f097ef47d1976bd16acd100928-bae3ed9ff537164695a82ca2a0aa4b5d0ae193fa&lang=nl&ds=AVG&pr=pa&d=2011-12-16 13:13:03&v=14.2.0.1&pid=avg&sg=&sap=dsp&q={searchTerms}
BHO: SnagIt Toolbar Loader - {00C6482D-C502-44C8-8409-FCE54AD9C208} - C:\Program Files\TechSmith\Snagit 10\SnagitBHO.dll (TechSmith Corporation)
BHO: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
BHO: DivX Plus Web Player HTML5 <video> - {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
BHO: AVG Safe Search - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG10\avgssie.dll (AVG Technologies CZ, s.r.o.)
BHO: DivX HiQ - {593DDEC6-7468-4cdd-90E1-42DADAA222E9} - C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
BHO: No Name - {5C255C8A-E604-49b4-9D64-90988571CECB} - No File
BHO: ShowBarObj Class - {83A2F9B1-01A2-4AA5-87D1-45B6B8505E96} - C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\ActiveToolBand.dll (Egis)
BHO: Windows Live Aanmelden - Help - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
BHO: AVG Security Toolbar - {95B7759C-8C7F-4BF1-B163-73684A933233} - C:\Program Files\AVG Secure Search\14.2.0.1\AVG Secure Search_toolbar.dll ()
BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
BHO: Skype Browser Helper - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.7.8313.1002\swg.dll (Google Inc.)
BHO: McAfee SiteAdvisor BHO - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll (McAfee, Inc.)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)
Toolbar: HKLM - McAfee SiteAdvisor Toolbar - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll (McAfee, Inc.)
Toolbar: HKLM - Acer eDataSecurity Management - {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\eDStoolbar.dll (Egis Incorporated.)
Toolbar: HKLM - No Name - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - No File
Toolbar: HKLM - Snagit - {8FF5E183-ABDE-46EB-B09E-D2AAB95CABE3} - C:\Program Files\TechSmith\Snagit 10\SnagitIEAddin.dll (TechSmith Corporation)
Toolbar: HKLM - AVG Security Toolbar - {95B7759C-8C7F-4BF1-B163-73684A933233} - C:\Program Files\AVG Secure Search\14.2.0.1\AVG Secure Search_toolbar.dll ()
Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
Toolbar: HKCU -Google Toolbar - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
Toolbar: HKCU -No Name - {8FF5E180-ABDE-46EB-B09E-D2AAB95CABE3} - No File
Toolbar: HKCU -No Name - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - No File
Toolbar: HKCU -No Name - {E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39} - No File
PDF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jin...ndows-i586.cab
PDF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jin...ndows-i586.cab
PDF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jin...ndows-i586.cab
Handler: dssrequest - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll (McAfee, Inc.)
Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG10\avgpp.dll (AVG Technologies CZ, s.r.o.)
Handler: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL (Microsoft Corporation)
Handler: ms-help - {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll (Microsoft Corporation)
Handler: ms-itss - {0A9007C0-4076-11D3-8789-0000F8105754} - c:\Program Files\Common Files\Microsoft Shared\Information Retrieval\msitss.dll (Microsoft Corporation)
Handler: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL (Microsoft Corporation)
Handler: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll (McAfee, Inc.)
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
Handler: viprotocol - {B658800C-F66E-4EF3-AB85-6C0C227862A9} - C:\Program Files\Common Files\AVG Secure Search\ViProtocolInstaller\14.2.0\ViProtocol.dll ()
Handler: wlmailhtml - {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - C:\Program Files\Windows Live\Mail\mailcomm.dll (Microsoft Corporation)
Winsock: Catalog5 01 mswsock.dll File Not found () ATTENTION: The LibraryPath should be "%SystemRoot%\system32\NLAapi.dll"
Winsock: Catalog5 05 mswsock.dll [62464] (Microsoft Corporation) ATTENTION: The LibraryPath should be "%SystemRoot%\System32\mswsock.dll"
Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt
Tcpip\Parameters: [DhcpNameServer] 192.168.1.254

FireFox:
========
FF ProfilePath: C:\Users\Meo\AppData\Roaming\Mozilla\Firefox\Profiles\8ehtkf2i.default
FF SearchEngine: AVG Secure Search
FF Keyword.URL: hxxp://isearch.avg.com/search?cid=%7B6279e5e4-e15c-4282-bc8b-e004207d62be%7D&mid=db4477f097ef47d1976bd16acd100928-bae3ed9ff537164695a82ca2a0aa4b5d0ae193fa&ds=AVG&v=10.2.0.3&lang=nl&pr=pa&d=2011-12-16%2013%3A13%3A03&sap=ku&q=
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF32_11_6_602_180.dll ()
FF Plugin: @avg.com/AVG SiteSafety plugin,version=11.0.0.1,application/x-avg-sitesafety-plugin - C:\Program Files\Common Files\AVG Secure Search\SiteSafetyInstaller\14.2.0\\npsitesafety.dll (AVG Technologies)
FF Plugin: @divx.com/DivX Browser Plugin,version=1.0.0 - C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
FF Plugin: @divx.com/DivX VOD Helper,version=1.0.0 - C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF Plugin: @java.com/JavaPlugin - C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF Plugin: @mcafee.com/SAFFPlugin - C:\Program Files\McAfee\SiteAdvisor\npmcffplg32.dll (McAfee, Inc.)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\4.0.60831.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~1\MICROS~2\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin: @microsoft.com/WLPG,version=14.0.8051.1204 - C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin: @microsoft.com/WPF,version=3.5 - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF Plugin: @tools.google.com/Google Update;version=3 - C:\Program Files\Google\Update\1.3.21.145\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: @tools.google.com/Google Update;version=9 - C:\Program Files\Google\Update\1.3.21.145\npGoogleUpdate3.dll (Google Inc.)
FF Extension: No Name - C:\Users\Meo\AppData\Roaming\Mozilla\Firefox\Profiles\8ehtkf2i.default\Extensions\{20a82645-c095-46ed-80e3-08825760534b}.xpi

Chrome:
=======
CHR RestoreOnStartup: "urls_to_restore_on_startup": null
CHR DefaultSearchURL: (AVG Secure Search) - http://isearch.avg.com/search?cid={DF5570F4-F975-4E56-BA74-D25803B7E433}&mid=db4477f097ef47d1976bd16acd100928-bae3ed9ff537164695a82ca2a0aa4b5d0ae193fa&lang=nl&ds=AVG&pr=pa&d=2011-12-16 13:13:03&v=14.2.0.1&pid=avg&sg=&sap=dsp&q={searchTerms}
CHR DefaultSuggestURL: (AVG Secure Search) - http://toolbar.avg.com/acp?q={searchTerms}&o=1
CHR Plugin: (Shockwave Flash) - C:\Program Files\Google\Chrome\Application\26.0.1410.64\PepperFlash\pepflashplayer.dll ()
CHR Plugin: (Chrome Remote Desktop Viewer) - internal-remoting-viewer
CHR Plugin: (Native Client) - C:\Program Files\Google\Chrome\Application\26.0.1410.64\ppGoogleNaClPluginChrome.dll ()
CHR Plugin: (Chrome PDF Viewer) - C:\Program Files\Google\Chrome\Application\26.0.1410.64\pdf.dll ()
CHR Plugin: (Adobe Acrobat) - C:\Program Files\Adobe\Reader 9.0\Reader\Browser\nppdf32.dll (Adobe Systems Inc.)
CHR Plugin: (Java Deployment Toolkit 6.0.220.4) - C:\Program Files\Java\jre6\bin\new_plugin\npdeployJava1.dll (Sun Microsystems, Inc.)
CHR Plugin: (Java(TM) Platform SE 6 U22) - C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
CHR Plugin: (Microsoft\u00AE Windows Media Player Firefox Plugin) - C:\Program Files\Mozilla Firefox\plugins\np-mswmp.dll (Microsoft Corporation)
CHR Plugin: (Microsoft Office 2010) - C:\PROGRA~1\MICROS~2\Office14\NPSPWRAP.DLL (Microsoft Corporation)
CHR Plugin: (AVG SiteSafety plugin) - C:\Program Files\Common Files\AVG Secure Search\SiteSafetyInstaller\14.2.0\\npsitesafety.dll (AVG Technologies)
CHR Plugin: (DivX VOD Helper Plug-in) - C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
CHR Plugin: (DivX Web Player) - C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
CHR Plugin: (Google Update) - C:\Program Files\Google\Update\1.3.21.135\npGoogleUpdate3.dll No File
CHR Plugin: (McAfee SiteAdvisor) - C:\Program Files\McAfee\SiteAdvisor\npmcffplg32.dll (McAfee, Inc.)
CHR Plugin: (Windows Live\u00AE Photo Gallery) - C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
CHR Plugin: (Shockwave Flash) - C:\Windows\system32\Macromed\Flash\NPSWF32_11_6_602_171.dll No File
CHR Plugin: (Silverlight Plug-In) - c:\Program Files\Microsoft Silverlight\4.0.60831.0\npctrl.dll ( Microsoft Corporation)
CHR Plugin: (Windows Presentation Foundation) - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
CHR Extension: (SiteAdvisor) - C:\Users\Meo\AppData\Local\Google\Chrome\User Data\Default\Extensions\fheoggkfdfchfphceeifdbepaooicaho\3.60.126.1_0
CHR Extension: (DivX HiQ) - C:\Users\Meo\AppData\Local\Google\Chrome\User Data\Default\Extensions\fnjbmmemklcjgepojigaapkoodmkgbae\2.1.1.94_0
CHR Extension: (AVG Safe Search) - C:\Users\Meo\AppData\Local\Google\Chrome\User Data\Default\Extensions\jmfkcklnlgedgbglfkkgedjfmejoahla\10.0.0.1409_0
CHR Extension: (Skype Click to Call) - C:\Users\Meo\AppData\Local\Google\Chrome\User Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl\5.6.0.8442_0
CHR Extension: (AVG Security Toolbar) - C:\Users\Meo\AppData\Local\Google\Chrome\User Data\Default\Extensions\ndibdjnfmopecpmkdieinmbadjfpblof\14.2.0.1_0
CHR Extension: (DivX Plus Web Player HTML5 \u003Cvideo\u003E) - C:\Users\Meo\AppData\Local\Google\Chrome\User Data\Default\Extensions\nneajnkjbffgblleaoojgaacokifdkhm\2.1.1.94_0

========================== Services (Whitelisted) =================

S3 AVG Security Toolbar Service; C:\Program Files\AVG\AVG10\Toolbar\ToolbarBroker.exe [167264 2011-11-10] ()
R2 AVGIDSAgent; C:\Program Files\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSAgent.exe [7390560 2011-08-18] (AVG Technologies CZ, s.r.o.)
R2 avgwd; C:\Program Files\AVG\AVG10\avgwdsvc.exe [269520 2011-02-08] (AVG Technologies CZ, s.r.o.)
R2 CLHNService; C:\Program Files\Acer Arcade Deluxe\HomeMedia\Kernel\DMP\CLHNService.exe [69632 2008-10-04] ()
R2 ETService; C:\Program Files\Acer\Empowering Technology\Service\ETService.exe [24576 2008-11-28] ()
S3 GoogleDesktopManager-051210-111108; C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe [30192 2011-04-10] (Google)
R2 MBAMScheduler; C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation)
R2 McAfee SiteAdvisor Service; C:\Program Files\McAfee\SiteAdvisor\McSACore.exe [95232 2012-12-04] (McAfee, Inc.)
R2 MobilityService; C:\Acer\Mobility Center\MobilityService.exe [110592 2007-12-06] ()
R2 NTISchedulerSvc; C:\Program Files\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe [144632 2008-09-23] (NewTech Infosystems, Inc.)
R2 RichVideo; C:\Program Files\Cyberlink\Shared files\RichVideo.exe [272024 2007-01-09] ()
R2 vToolbarUpdater14.2.0; C:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater\14.2.0\ToolbarUpdater.exe [968880 2013-02-20] ()
S3 msiserver; %systemroot%\system32\msiexec /V [x]

==================== Drivers (Whitelisted) ====================

R0 ahcix86s; C:\Windows\System32\DRIVERS\ahcix86s.sys [183312 2009-01-07] (Advanced Micro Devices, Inc)
S3 appliand; C:\Windows\System32\DRIVERS\appliand.sys [28256 2011-06-26] (Applian Technologies Inc.)
R3 appliandMP; C:\Windows\System32\DRIVERS\appliand.sys [28256 2011-06-26] (Applian Technologies Inc.)
R1 Avgfwfd; C:\Windows\System32\DRIVERS\avgfwd6x.sys [54112 2010-07-12] (AVG Technologies CZ, s.r.o.)
R3 AVGIDSDriver; C:\Windows\System32\DRIVERS\AVGIDSDriver.Sys [134480 2011-05-27] (AVG Technologies CZ, s.r.o. )
R0 AVGIDSEH; C:\Windows\System32\DRIVERS\AVGIDSEH.Sys [22992 2011-02-22] (AVG Technologies CZ, s.r.o. )
R3 AVGIDSFilter; C:\Windows\System32\DRIVERS\AVGIDSFilter.Sys [24144 2011-02-10] (AVG Technologies CZ, s.r.o. )
R3 AVGIDSShim; C:\Windows\System32\DRIVERS\AVGIDSShim.Sys [28624 2011-02-10] (AVG Technologies CZ, s.r.o. )
R1 Avgldx86; C:\Windows\System32\DRIVERS\avgldx86.sys [248656 2011-01-07] (AVG Technologies CZ, s.r.o.)
R1 Avgmfx86; C:\Windows\System32\DRIVERS\avgmfx86.sys [34896 2011-03-01] (AVG Technologies CZ, s.r.o.)
R0 Avgrkx86; C:\Windows\System32\DRIVERS\avgrkx86.sys [32592 2011-03-16] (AVG Technologies CZ, s.r.o.)
R1 Avgtdix; C:\Windows\System32\DRIVERS\avgtdix.sys [297168 2011-04-05] (AVG Technologies CZ, s.r.o.)
R1 avgtp; C:\Windows\system32\drivers\avgtpx86.sys [33112 2013-02-20] (AVG Technologies)
R2 int15; C:\Windows\system32\drivers\int15.sys [12832 2008-10-01] (Acer, Inc.)
R3 L1E; C:\Windows\System32\DRIVERS\L1E60x86.sys [47616 2008-07-22] (Atheros Communications, Inc.)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [22856 2013-04-04] (Malwarebytes Corporation)
R1 netbt; C:\Windows\System32\DRIVERS\netbt.sys [184320 2008-01-21] ()
R3 RTHDMIAzAudService; C:\Windows\System32\drivers\RtHDMIV.sys [155808 2008-12-25] (Realtek Semiconductor Corp.)
R3 winbondcir; C:\Windows\System32\DRIVERS\winbondcir.sys [43008 2007-03-28] (Winbond Electronics Corporation)
S3 IpInIp; system32\DRIVERS\ipinip.sys [x]
S3 NwlnkFlt; system32\DRIVERS\nwlnkflt.sys [x]
S3 NwlnkFwd; system32\DRIVERS\nwlnkfwd.sys [x]

==================== NetSvcs (Whitelisted) ===================

==================== One Month Created Files and Folders ========

2013-05-02 12:46 - 2013-05-02 12:46 - 00000000 ____D C:\FRST
2013-05-02 11:55 - 2013-05-02 11:55 - 01712230 ____A (Farbar) C:\Users\Meo\Desktop\FRST64.exe
2013-05-02 11:55 - 2013-05-02 11:55 - 01150947 ____A (Farbar) C:\Users\Meo\Desktop\FRST.exe
2013-05-01 14:15 - 2013-05-01 14:15 - 00002065 ____A C:\Users\Meo\Desktop\RKreport[9]_D_05012013_02d1415.txt
2013-05-01 12:38 - 2013-05-01 12:38 - 00001715 ____A C:\Users\Meo\Desktop\RKreport[8]_D_05012013_02d1238.txt
2013-05-01 12:36 - 2013-05-01 12:36 - 00001673 ____A C:\Users\Meo\Desktop\RKreport[7]_S_05012013_02d1236.txt
2013-05-01 12:11 - 2013-05-01 12:11 - 00001641 ____A C:\Users\Meo\Desktop\RKreport[6]_D_05012013_02d1211.txt
2013-05-01 12:09 - 2013-05-01 12:09 - 00001602 ____A C:\Users\Meo\Desktop\RKreport[5]_D_05012013_02d1209.txt
2013-05-01 12:08 - 2013-05-01 12:08 - 00001565 ____A C:\Users\Meo\Desktop\RKreport[4]_D_05012013_02d1208.txt
2013-05-01 12:06 - 2013-05-01 12:06 - 00001523 ____A C:\Users\Meo\Desktop\RKreport[3]_S_05012013_02d1206.txt
2013-05-01 11:57 - 2013-05-01 11:57 - 00003606 ____A C:\Users\Meo\Desktop\RKreport[2]_D_05012013_02d1157.txt
2013-05-01 11:55 - 2013-05-01 11:55 - 00001848 ____A C:\Users\Meo\Desktop\RKreport[1]_S_05012013_02d1155.txt
2013-05-01 11:54 - 2013-05-01 11:57 - 00184320 ____A C:\Windows\System32\Drivers\netbt.sys.dump
2013-05-01 11:54 - 2013-05-01 11:54 - 00000000 ____D C:\Windows\snack
2013-05-01 11:50 - 2013-05-02 01:00 - 00000000 ____D C:\Users\Meo\Desktop\mbar
2013-05-01 11:50 - 2013-05-01 14:15 - 00000000 ____D C:\Users\Meo\Desktop\RK_Quarantine
2013-05-01 11:41 - 2013-05-01 11:41 - 12917756 ____A C:\Users\Meo\Desktop\mbar-1.05.0.1001.zip
2013-05-01 11:40 - 2013-05-01 11:40 - 00816128 ____A C:\Users\Meo\Desktop\RogueKiller.exe
2013-04-30 18:30 - 2013-04-30 18:30 - 00005034 ____A C:\Users\Meo\Desktop\attach.txt
2013-04-30 18:30 - 2013-04-30 18:29 - 00018240 ____A C:\Users\Meo\Desktop\dds.txt
2013-04-30 13:40 - 2013-04-30 13:40 - 00688992 ____A (Swearware) C:\Users\Meo\Downloads\dds(1).com
2013-04-30 13:40 - 2013-04-30 13:40 - 00000000 ____D C:\Users\Meo\AppData\Roaming\Malwarebytes
2013-04-30 13:39 - 2013-04-30 13:39 - 00688992 ____R (Swearware) C:\Users\Meo\Desktop\dds.com
2013-04-30 13:39 - 2013-04-30 13:39 - 00000910 ____A C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2013-04-30 13:39 - 2013-04-30 13:39 - 00000000 ____D C:\Program Files\Malwarebytes' Anti-Malware
2013-04-30 13:39 - 2013-04-04 14:50 - 00022856 ____A (Malwarebytes Corporation) C:\Windows\System32\Drivers\mbam.sys
2013-04-30 13:38 - 2013-04-30 13:38 - 10285040 ____A (Malwarebytes Corporation ) C:\Users\Meo\Downloads\mbam-setup-1.75.0.1300.exe
2013-04-29 14:18 - 2013-04-29 14:18 - 00000000 ____D C:\Program Files\Mega Codec Pack
2013-04-29 14:16 - 2013-04-29 14:16 - 12179456 ____A (x264 project) C:\Users\Meo\Downloads\x264.exe
2013-04-29 14:13 - 2013-04-29 14:13 - 00015279 ____A C:\Users\Meo\Downloads\Hit+and+Run%5B2012%5DDVDRip+XviD-ETRG.torrent
2013-04-29 09:48 - 2013-04-29 09:48 - 00013054 ____A C:\Users\Meo\Downloads\[kat.ph]pawg.ava.alvares.torrent
2013-04-29 09:47 - 2013-04-29 09:47 - 00014054 ____A C:\Users\Meo\Downloads\[kat.ph]big.tits.round.asses.jasmine.torrent
2013-04-29 09:33 - 2013-04-29 09:33 - 00016099 ____A C:\Users\Meo\Downloads\[kat.ph]blowjobfridays.13.03.22.luna.star.xxx.720p.mp4.ktr.torrent
2013-04-29 09:32 - 2013-04-29 09:32 - 00109684 ____A C:\Users\Meo\Downloads\rm8555_1500.mp4.torrent
2013-04-29 09:31 - 2013-04-29 09:31 - 00008192 ____A C:\Users\Meo\Downloads\[kat.ph]facial.fest.prada.xxx.adduct.mp4.torrent
2013-04-29 09:30 - 2013-04-29 09:30 - 00050504 ____A C:\Users\Meo\Downloads\[kat.ph]big.tits.and.round.asses.stacey.foxxx.hd.720p.torrent
2013-04-29 09:25 - 2013-04-29 09:25 - 00109667 ____A C:\Users\Meo\Downloads\[kat.ph]bangbros.remastered.isabella.remastered.isabelle.july.16.2011(3).torrent
2013-04-29 09:25 - 2013-04-29 09:25 - 00019636 ____A C:\Users\Meo\Downloads\[kat.ph]pawg.savannah.fox.torrent
2013-04-29 09:24 - 2013-04-29 09:24 - 00109667 ____A C:\Users\Meo\Downloads\[kat.ph]bangbros.remastered.isabella.remastered.isabelle.july.16.2011.torrent
2013-04-29 09:24 - 2013-04-29 09:24 - 00109667 ____A C:\Users\Meo\Downloads\[kat.ph]bangbros.remastered.isabella.remastered.isabelle.july.16.2011(2).torrent
2013-04-29 09:24 - 2013-04-29 09:24 - 00109667 ____A C:\Users\Meo\Downloads\[kat.ph]bangbros.remastered.isabella.remastered.isabelle.july.16.2011(1).torrent
2013-04-29 09:21 - 2013-04-29 09:21 - 00011609 ____A C:\Users\Meo\Downloads\BangBrosRemastered - Ana 28 april 2013-[rarbg.com].torrent
2013-04-29 09:08 - 2013-04-29 09:08 - 00107535 ____A C:\Users\Meo\Downloads\[kat.ph]bangbus.yasmine.the.beautiful.yasmine.gets.it.new.january.30.2013.torrent
2013-04-29 09:03 - 2013-04-29 09:03 - 00019253 ____A C:\Users\Meo\Downloads\[kat.ph]milfsoup.priya.rai.mama.knows.best.torrent
2013-04-29 09:03 - 2013-04-29 09:03 - 00017374 ____A C:\Users\Meo\Downloads\[kat.ph]myfriendshotmom.priya.anjali.rai.torrent
2013-04-29 09:03 - 2013-04-29 09:03 - 00014110 ____A C:\Users\Meo\Downloads\[kat.ph]milfsoup.priya.rai.pocahontas.jones.show.her.how.it.39.s.done.m.torrent
2013-04-29 09:03 - 2013-04-29 09:03 - 00013440 ____A C:\Users\Meo\Downloads\[kat.ph]blowjobfridays.priya.rai.heavenly.blow.job.bj11220.01.25.torrent
2013-04-29 08:57 - 2013-04-29 08:57 - 00030070 ____A C:\Users\Meo\Downloads\[kat.ph]chongas.corin.carter.in.love.with.a.stripper.03.09.2013.torrent
2013-04-29 08:57 - 2013-04-29 08:57 - 00030070 ____A C:\Users\Meo\Downloads\[kat.ph]chongas.corin.carter.in.love.with.a.stripper.03.09.2013(1).torrent
2013-04-29 08:36 - 2013-04-29 08:36 - 00022891 ____A C:\Users\Meo\Downloads\[kat.ph]blowjobfridays.13.03.15.corin.carter.xxx.720p.mp4.ktr.torrent
2013-04-29 08:31 - 2013-04-29 08:31 - 00004817 ____A C:\Users\Meo\Downloads\[kat.ph]blowjob.fridays.diamond.kitty.latina.with.big.tits.sucks.the.best.dick.xxx.pornalized.com.avi.torrent
2013-04-29 08:17 - 2013-04-29 08:17 - 00003524 ____A C:\Users\Meo\Downloads\[kat.ph]alanna.triple.d.anal.destruction.bangbrosremastered.2012.torrent
2013-04-29 08:17 - 2013-04-29 08:17 - 00003524 ____A C:\Users\Meo\Downloads\[kat.ph]alanna.triple.d.anal.destruction.bangbrosremastered.2012(1).torrent
2013-04-29 08:06 - 2013-04-29 08:06 - 00040310 ____A C:\Users\Meo\Downloads\[kat.ph]assparade.vanessa.luna.big.latina.ass.bounces.up.and.down.0.torrent
2013-04-29 08:02 - 2013-04-29 08:02 - 00058519 ____A C:\Users\Meo\Downloads\[kat.ph]pornstarspa.luna.star.amazing.ass.to.rub.down.and.****.after.new.april.25.2013.torrent
2013-04-28 21:33 - 2013-04-28 21:33 - 00019025 ____A C:\Users\Meo\Downloads\[kat.ph]nikita.s03e19.hdtv.x264.lol.vtv.mp4.torrent
2013-04-28 21:32 - 2013-04-28 21:32 - 00028869 ____A C:\Users\Meo\Downloads\[kat.ph]nikita.s03e19.hdtv.xvid.fum.ettv.torrent
2013-04-28 21:27 - 2013-04-28 21:27 - 00057342 ____A C:\Users\Meo\Downloads\[kat.ph]here.comes.the.boom.2012.dvdrip.xvid.ptpower.torrent
2013-04-28 20:06 - 2013-04-28 20:06 - 00019321 ____A C:\Users\Meo\Downloads\[kat.ph]nikita.s03e19.hdtv.x264.lol.ettv.torrent
2013-04-28 20:05 - 2013-04-28 20:05 - 00009818 ____A C:\Users\Meo\Downloads\[kat.ph]nikita.s03e19.hdtv.x264.lol.eztv.torrent
2013-04-28 19:51 - 2013-04-28 19:51 - 00014883 ____A C:\Users\Meo\Downloads\Here+Comes+the+Boom+%282012%29+720p+BrRip+x264+-+YIFY.torrent
2013-04-28 19:49 - 2013-04-28 19:49 - 00000000 ____A C:\Users\Meo\Downloads\[kat.ph]red.dawn.2012.dvdrip.xvid.sparks.torrent
2013-04-28 19:49 - 2013-04-28 19:49 - 00000000 ____A C:\Users\Meo\Downloads\[kat.ph]red.dawn.2012.dvdrip.xvid.sparks(1).torrent
2013-04-28 19:36 - 2013-04-28 19:36 - 00030916 ____A C:\Users\Meo\Downloads\Here Comes the Boom 2012 English.[DVDRip] (AC3).torrent
2013-04-28 19:33 - 2013-04-28 19:33 - 00030868 ____A C:\Users\Meo\Downloads\Red Dawn 2012 English DVDRip [x264].torrent
2013-04-28 19:28 - 2013-04-28 19:28 - 00030865 ____A C:\Users\Meo\Downloads\24039AA9AB66E4C4B181BD4717AE6D7A68BE3F49.torrent
2013-04-28 19:27 - 2013-04-28 19:27 - 00000001 ____A C:\Users\Meo\Downloads\Stolen+%282012%29+DVDRip+XD+XviD+-VISION.torrent
2013-04-28 01:42 - 2013-04-28 01:42 - 00029181 ____A C:\Users\Meo\Downloads\Kitchen+Nightmares+US+S05E08+Burger+Kitchen+Part+Two+WS+PDTV+Xvi.torrent
2013-04-28 01:40 - 2013-04-28 01:40 - 00014598 ____A C:\Users\Meo\Downloads\[kat.ph]kitchen.nightmares.us.burger.kitchen.part.two.5x8.ws.pdtv.2hd.torrent
2013-04-27 14:48 - 2013-04-27 14:48 - 00027339 ____A C:\Users\Meo\Downloads\[kat.ph]anthony.robbins.get.the.edge.full.torrent
2013-04-27 14:48 - 2013-04-27 14:48 - 00027339 ____A C:\Users\Meo\Downloads\[kat.ph]anthony.robbins.get.the.edge.full(1).torrent
2013-04-27 14:19 - 2013-04-27 14:19 - 00028670 ____A C:\Users\Meo\Downloads\[kat.ph]rsd.the.jeffy.show.seductiongr.com.dvd6.avi.sgr.torrent
2013-04-27 14:18 - 2013-04-27 14:18 - 00028691 ____A C:\Users\Meo\Downloads\[kat.ph]rsd.the.jeffy.show.seductiongr.com.dvd5.avi.sgr.torrent
2013-04-27 14:18 - 2013-04-27 14:18 - 00028691 ____A C:\Users\Meo\Downloads\[kat.ph]rsd.the.jeffy.show.seductiongr.com.dvd5.avi.sgr(1).torrent
2013-04-27 14:18 - 2013-04-27 14:18 - 00028691 ____A C:\Users\Meo\Downloads\[kat.ph]rsd.the.jeffy.show.seductiongr.com.dvd4.avi.sgr.torrent
2013-04-27 14:18 - 2013-04-27 14:18 - 00028690 ____A C:\Users\Meo\Downloads\[kat.ph]rsd.the.jeffy.show.seductiongr.com.dvd3.avi.sgr.torrent
2013-04-27 14:18 - 2013-04-27 14:18 - 00028690 ____A C:\Users\Meo\Downloads\[kat.ph]rsd.the.jeffy.show.seductiongr.com.dvd2.avi.sgr(1).torrent
2013-04-27 14:17 - 2013-04-27 14:17 - 00028690 ____A C:\Users\Meo\Downloads\[kat.ph]rsd.the.jeffy.show.seductiongr.com.dvd2.avi.sgr.torrent
2013-04-27 14:16 - 2013-04-27 14:16 - 00028690 ____A C:\Users\Meo\Downloads\[kat.ph]rsd.the.jeffy.show.seductiongr.com.dvd1.avi.sgr.torrent
2013-04-27 14:14 - 2013-04-27 14:14 - 00151601 ____A C:\Users\Meo\Downloads\[kat.ph]the.jeffy.show.torrent
2013-04-22 01:20 - 2013-04-22 01:20 - 00300368 ____A (SoftSafe) C:\Users\Meo\Downloads\rlb breakthrough noah gift secret code of success pdf (1).exe
2013-04-20 22:24 - 2013-04-20 22:24 - 00030834 ____A C:\Users\Meo\Downloads\[kat.ph]hawaii.five.0.2010.s03e15.hdtv.x264.lol.vtv.mp4.torrent
2013-04-20 22:23 - 2013-04-20 22:23 - 00016092 ____A C:\Users\Meo\Downloads\[kat.ph]hawaii.five.0.2010.s03e17.hdtv.x264.lol.eztv (1).torrent
2013-04-20 22:06 - 2013-04-20 22:06 - 00011525 ____A C:\Users\Meo\Downloads\[kat.ph]californication.s06e12.hdtv.x264.2hd.eztv(2).torrent
2013-04-20 22:06 - 2013-04-20 22:06 - 00011525 ____A C:\Users\Meo\Downloads\[kat.ph]californication.s06e12.hdtv.x264.2hd.eztv(1).torrent
2013-04-20 22:00 - 2013-04-20 22:00 - 00016092 ____A C:\Users\Meo\Downloads\[kat.ph]hawaii.five.0.2010.s03e17.hdtv.x264.lol.eztv.torrent
2013-04-20 21:18 - 2013-04-20 21:18 - 00018923 ____A C:\Users\Meo\Downloads\Nikita.S03E18.HDTV.x264-LOL-[rarbg.com].torrent
2013-04-20 21:04 - 2013-04-20 21:04 - 00015514 ____A C:\Users\Meo\Downloads\[kat.ph]swordsmen.aka.wu.xia.2011.dvdrip.hc.xvid.xult.torrent
2013-04-20 21:04 - 2013-04-20 21:04 - 00015514 ____A C:\Users\Meo\Downloads\[kat.ph]swordsmen.aka.wu.xia.2011.dvdrip.hc.xvid.xult (2).torrent
2013-04-20 21:04 - 2013-04-20 21:04 - 00015514 ____A C:\Users\Meo\Downloads\[kat.ph]swordsmen.aka.wu.xia.2011.dvdrip.hc.xvid.xult (1).torrent
2013-04-20 20:56 - 2013-04-20 20:56 - 00019061 ____A C:\Users\Meo\Downloads\[kat.ph]nikita.s03e18.hdtv.x264.lol.ettv(5).torrent
2013-04-20 20:56 - 2013-04-20 20:56 - 00009698 ____A C:\Users\Meo\Downloads\[kat.ph]nikita.3x18.hdtv.lol(1).torrent
2013-04-20 20:55 - 2013-04-20 20:55 - 00019061 ____A C:\Users\Meo\Downloads\[kat.ph]nikita.s03e18.hdtv.x264.lol.ettv(4).torrent
2013-04-20 20:55 - 2013-04-20 20:55 - 00019061 ____A C:\Users\Meo\Downloads\[kat.ph]nikita.s03e18.hdtv.x264.lol.ettv(3).torrent
2013-04-20 20:55 - 2013-04-20 20:55 - 00019061 ____A C:\Users\Meo\Downloads\[kat.ph]nikita.s03e18.hdtv.x264.lol.ettv(2).torrent
2013-04-20 20:54 - 2013-04-20 20:55 - 00019061 ____A C:\Users\Meo\Downloads\[kat.ph]nikita.s03e18.hdtv.x264.lol.ettv(1).torrent
2013-04-20 20:53 - 2013-04-20 20:53 - 00019061 ____A C:\Users\Meo\Downloads\[kat.ph]nikita.s03e18.hdtv.x264.lol.ettv.torrent
2013-04-20 20:53 - 2013-04-20 20:53 - 00009698 ____A C:\Users\Meo\Downloads\[kat.ph]nikita.3x18.hdtv.lol.torrent
2013-04-15 01:03 - 2013-04-15 01:03 - 00299344 ____A (SoftSafe) C:\Users\Meo\Downloads\rlb breakthrough
May 2nd, 2013, 07:15 AM
Obsession

noah gift secret code of success pdf.exe
2013-04-14 21:40 - 2013-04-14 21:40 - 00018801 ____A C:\Users\Meo\Downloads\[kat.ph]nikita.s03e17.hdtv.x264.lol.ettv.torrent
2013-04-14 21:40 - 2013-04-14 21:40 - 00009395 ____A C:\Users\Meo\Downloads\[kat.ph]nikita.3x17.hdtv.lol.torrent
2013-04-14 20:12 - 2013-04-14 20:12 - 00001297 ____A C:\Users\Meo\Downloads\[kat.ph]the.secret.code.of.success.by.noah.st.john (1).torrent
2013-04-14 20:00 - 2013-04-14 20:00 - 00001297 ____A C:\Users\Meo\Downloads\[kat.ph]the.secret.code.of.success.by.noah.st.john.torrent
2013-04-14 19:12 - 2013-04-14 19:12 - 00011569 ____A C:\Users\Meo\Downloads\[kat.ph]californication.s06e12.hdtv.x264.2hd.eztv (3).torrent
2013-04-14 19:12 - 2013-04-14 19:12 - 00011569 ____A C:\Users\Meo\Downloads\[kat.ph]californication.s06e12.hdtv.x264.2hd.eztv (2).torrent
2013-04-14 19:11 - 2013-04-14 19:11 - 00009715 ____A C:\Users\Meo\Downloads\[kat.ph]nikita.s03e16.hdtv.x264.lol.eztv.torrent
2013-04-14 19:08 - 2013-04-14 19:08 - 00010375 ____A C:\Users\Meo\Downloads\[kat.ph]nikita.s03e15.hdtv.x264.lol.eztv (2).torrent
2013-04-13 23:27 - 2013-04-13 23:27 - 00010375 ____A C:\Users\Meo\Downloads\[kat.ph]nikita.s03e15.hdtv.x264.lol.eztv (1).torrent
2013-04-13 23:26 - 2013-04-13 23:26 - 00028163 ____A C:\Users\Meo\Downloads\[kat.ph]nikita.s03e14.hdtv.xvid.afg.torrent
2013-04-13 23:25 - 2013-04-13 23:25 - 00010941 ____A C:\Users\Meo\Downloads\[kat.ph]nikita.s03e14.hdtv.x264.lol (2).torrent
2013-04-13 23:25 - 2013-04-13 23:25 - 00010941 ____A C:\Users\Meo\Downloads\[kat.ph]nikita.s03e14.hdtv.x264.lol (1).torrent
2013-04-13 23:25 - 2013-04-13 23:25 - 00010375 ____A C:\Users\Meo\Downloads\[kat.ph]nikita.s03e15.hdtv.x264.lol.eztv.torrent
2013-04-13 16:45 - 2013-04-13 16:45 - 00058446 ____A C:\Users\Meo\Downloads\[kat.ph]seven.psychopaths.2012.dvdrip.xvid.vip3r (1).torrent
2013-04-13 13:35 - 2013-04-13 13:35 - 00028806 ____A C:\Users\Meo\Downloads\[kat.ph]the.cold.light.of.day.2012.dvdrip.xvid.done.torrent
2013-04-13 13:19 - 2013-04-13 13:19 - 00058325 ____A C:\Users\Meo\Downloads\[kat.ph]seven.psychopaths.2012.dvdrip.xvid.vip3r.torrent
2013-04-13 02:52 - 2013-04-13 02:52 - 00014683 ____A C:\Users\Meo\Downloads\[kat.ph]jet.li.fearless.2006.dvdrip.english.torrent
2013-04-13 02:52 - 2013-04-13 02:52 - 00014683 ____A C:\Users\Meo\Downloads\[kat.ph]jet.li.fearless.2006.dvdrip.english (1).torrent
2013-04-13 02:35 - 2013-04-13 02:35 - 00015719 ____A C:\Users\Meo\Downloads\[kat.ph]the.sorcerer.and.the.white.snake.2011.eng.dubbed.dvdrip.xvid.ac3.sc0rp.torrent
2013-04-12 00:14 - 2013-04-24 09:31 - 00000000 ____D C:\Program Files\Mozilla Firefox
2013-04-11 02:12 - 2013-04-11 02:12 - 00000000 ____D C:\Users\Meo\AppData\Roaming\LibreOffice
2013-04-10 20:36 - 2013-04-10 20:36 - 00001013 ____A C:\Users\Public\Desktop\LibreOffice 4.0.lnk
2013-04-10 20:36 - 2013-04-10 20:36 - 00000000 ____D C:\Windows\System64
2013-04-10 20:26 - 2013-04-10 20:36 - 00000000 ____D C:\Program Files\LibreOffice 4.0
2013-04-10 19:30 - 2013-04-10 19:36 - 193572864 ____A C:\Users\Meo\Downloads\LibreOffice_4.0.2_Win_x86.msi
2013-04-10 19:28 - 2013-04-10 19:29 - 08335349 ____A C:\Users\Meo\Downloads\abiword-setup-2.8.6(1).exe
2013-04-10 19:17 - 2013-04-10 19:18 - 08335349 ____A C:\Users\Meo\Downloads\abiword-setup-2.8.6.exe
2013-04-09 20:59 - 2013-04-09 20:59 - 00000000 ____A C:\Users\Meo\Downloads\download (1).htm
2013-04-09 00:21 - 2013-04-09 00:21 - 06912776 ____A C:\Users\Meo\Downloads\HAI Process.zip
2013-04-08 19:05 - 2013-04-08 19:07 - 69843799 ____A C:\Users\Meo\Downloads\EGC - Training Call #2 (1).zip
2013-04-08 19:04 - 2013-04-08 19:05 - 69843799 ____A C:\Users\Meo\Downloads\EGC - Training Call #2.zip
2013-04-07 20:41 - 2013-04-07 20:41 - 00028993 ____A C:\Users\Meo\Downloads\[kat.ph]nikita.s03e11.fastsub.vostfr.hdtv.xvid.mind.torrent
2013-04-07 20:41 - 2013-04-07 20:41 - 00011281 ____A C:\Users\Meo\Downloads\[kat.ph]nikita.s03e11.hdtv.x264.lol (1).torrent
2013-04-07 20:38 - 2013-04-07 20:38 - 00010941 ____A C:\Users\Meo\Downloads\[kat.ph]nikita.s03e14.hdtv.x264.lol.torrent
2013-04-07 10:04 - 2013-04-07 10:04 - 00020642 ____A C:\Users\Meo\Downloads\[kat.ph]nikita.s03e10.hdtv.x264.lol.ettv.torrent
2013-04-07 10:03 - 2013-04-07 10:04 - 00027473 ____A C:\Users\Meo\Downloads\[kat.ph]nikita.s03e10.hdtv.xvid.afg (1).torrent
2013-04-07 09:23 - 2013-04-07 09:23 - 00022334 ____A C:\Users\Meo\Downloads\[kat.ph]nikita.s03e11.hdtv.x264.lol.ettv.torrent
2013-04-07 09:22 - 2013-04-07 09:22 - 00027473 ____A C:\Users\Meo\Downloads\[kat.ph]nikita.s03e10.hdtv.xvid.afg.torrent
2013-04-07 09:21 - 2013-04-07 09:21 - 00028993 ____A C:\Users\Meo\Downloads\[kat.ph]nikita.s03e10.fastsub.vostfr.hdtv.xvid.mind.torrent
2013-04-07 08:56 - 2013-04-07 08:56 - 00010756 ____A C:\Users\Meo\Downloads\[kat.ph]nikita.s03e13.hdtv.x264.lol.torrent
2013-04-07 08:41 - 2013-04-07 08:41 - 00010195 ____A C:\Users\Meo\Downloads\[kat.ph]nikita.s03e12.hdtv.x264.lol.torrent
2013-04-07 08:40 - 2013-04-07 08:40 - 00020324 ____A C:\Users\Meo\Downloads\[kat.ph]nikita.s03e10.hdtv.x264.lol.torrent
2013-04-07 08:40 - 2013-04-07 08:40 - 00011281 ____A C:\Users\Meo\Downloads\[kat.ph]nikita.s03e11.hdtv.x264.lol.torrent
2013-04-07 02:35 - 2013-04-07 02:35 - 00019670 ____A C:\Users\Meo\Downloads\[kat.ph]californication.s06e10.hdtv.xvid.afg.torrent
2013-04-07 01:40 - 2013-04-07 01:40 - 00015315 ____A C:\Users\Meo\Downloads\[kat.ph]the.sweeney.2012.brrip.nl.subs.dutchreleaseteam (1).torrent
2013-04-07 01:39 - 2013-04-07 01:40 - 00015315 ____A C:\Users\Meo\Downloads\[kat.ph]the.sweeney.2012.brrip.nl.subs.dutchreleaseteam.torrent
2013-04-07 00:38 - 2013-04-07 00:38 - 00015113 ____A C:\Users\Meo\Downloads\[kat.ph]the.sweeney.2012.dvdscr.xvid.etrg.torrent
2013-04-07 00:27 - 2013-04-07 00:27 - 00056707 ____A C:\Users\Meo\Downloads\[kat.ph]the.expatriate.2012.bdrip.xvid.noscreens.torrent
2013-04-07 00:25 - 2013-04-07 00:25 - 00015399 ____A C:\Users\Meo\Downloads\[kat.ph]the.expatriate.2012.brrip.nl.subs.dutchreleaseteam.torrent
2013-04-07 00:24 - 2013-04-07 00:24 - 00010889 ____A C:\Users\Meo\Downloads\[kat.ph]californication.s06e10.hdtv.x264.2hd.eztv.torrent
2013-04-07 00:24 - 2013-04-07 00:24 - 00010889 ____A C:\Users\Meo\Downloads\[kat.ph]californication.s06e10.hdtv.x264.2hd.eztv (1).torrent
2013-04-07 00:23 - 2013-04-07 00:23 - 00012145 ____A C:\Users\Meo\Downloads\[kat.ph]californication.s06e11.hdtv.x264.2hd.eztv.torrent
2013-04-07 00:23 - 2013-04-07 00:23 - 00011569 ____A C:\Users\Meo\Downloads\[kat.ph]californication.s06e12.hdtv.x264.2hd.eztv.torrent
2013-04-07 00:23 - 2013-04-07 00:23 - 00011569 ____A C:\Users\Meo\Downloads\[kat.ph]californication.s06e12.hdtv.x264.2hd.eztv (1).torrent
2013-04-07 00:09 - 2013-04-07 00:09 - 00029289 ____A C:\Users\Meo\Downloads\[kat.ph]the.expatriate.2012.brrip.xvid.vip3r.torrent
2013-04-06 20:44 - 2013-04-06 20:44 - 00014485 ____A C:\Users\Meo\Downloads\[kat.ph]shooter.2007.1080p.brrip.x264.1.32gb.yify.torrent
2013-04-06 20:44 - 2013-04-06 20:44 - 00014485 ____A C:\Users\Meo\Downloads\[kat.ph]shooter.2007.1080p.brrip.x264.1.32gb.yify (1).torrent
2013-04-06 20:43 - 2013-04-06 20:43 - 00057019 ____A C:\Users\Meo\Downloads\[kat.ph]shooter.2007.dvdrip.eng.axxo.torrent
2013-04-03 22:55 - 2013-04-03 22:55 - 00017028 ____A C:\Users\Meo\Downloads\[kat.ph]the.a.team.extended.2010.720p.brrip.x264.800mb.yify.torrent
2013-04-03 22:55 - 2013-04-03 22:55 - 00017028 ____A C:\Users\Meo\Downloads\[kat.ph]the.a.team.extended.2010.720p.brrip.x264.800mb.yify (1).torrent
2013-04-03 22:54 - 2013-04-03 22:54 - 00361867 ____A C:\Users\Meo\Downloads\[kat.ph]predators.2010.720p.bluray.x264.dts.vice.torrent

==================== One Month Modified Files and Folders ========

2013-05-02 12:47 - 2011-04-10 21:32 - 00000000 ____D C:\Users\Meo\AppData\Roaming\uTorrent
2013-05-02 12:46 - 2013-05-02 12:46 - 00000000 ____D C:\FRST
2013-05-02 12:04 - 2013-03-10 15:57 - 00000358 ____A C:\Windows\Tasks\WpsUpdateTask_Meo.job
2013-05-02 12:04 - 2011-04-11 03:48 - 00001038 ____A C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-05-02 12:04 - 2011-04-11 03:48 - 00001034 ____A C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-05-02 11:59 - 2012-11-05 02:56 - 00000940 ____A C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-05-02 11:55 - 2013-05-02 11:55 - 01712230 ____A (Farbar) C:\Users\Meo\Desktop\FRST64.exe
2013-05-02 11:55 - 2013-05-02 11:55 - 01150947 ____A (Farbar) C:\Users\Meo\Desktop\FRST.exe
2013-05-02 11:54 - 2011-06-29 00:12 - 00000000 ____D C:\Windows\System32\Drivers\AVG
2013-05-02 11:54 - 2008-01-21 08:47 - 01472908 ____A C:\Windows\System32\PerfStringBackup.INI
2013-05-02 11:54 - 2008-01-21 08:47 - 00667796 ____A C:\Windows\System32\perfh013.dat
2013-05-02 11:54 - 2008-01-21 08:47 - 00127040 ____A C:\Windows\System32\perfc013.dat
2013-05-02 11:51 - 2011-04-27 19:36 - 00000000 ____D C:\Users\Meo\AppData\Roaming\Skype
2013-05-02 11:50 - 2011-04-10 02:15 - 00000000 ____A C:\Windows\System32\LogConfigTemp.xml
2013-05-02 11:47 - 2008-01-21 04:47 - 02216452 ____A C:\Windows\PFRO.log
2013-05-02 11:47 - 2006-11-02 15:01 - 00000006 ___AH C:\Windows\Tasks\SA.DAT
2013-05-02 11:47 - 2006-11-02 14:47 - 00003216 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
2013-05-02 11:47 - 2006-11-02 14:47 - 00003216 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
2013-05-02 01:36 - 2011-04-10 02:37 - 01993045 ____A C:\Windows\WindowsUpdate.log
2013-05-02 01:36 - 2006-11-02 15:01 - 00032542 ____A C:\Windows\Tasks\SCHEDLGU.TXT
2013-05-02 01:00 - 2013-05-01 11:50 - 00000000 ____D C:\Users\Meo\Desktop\mbar
2013-05-01 14:19 - 2011-08-24 17:28 - 00000680 ____A C:\Users\Meo\AppData\Local\d3d9caps.dat
2013-05-01 14:15 - 2013-05-01 14:15 - 00002065 ____A C:\Users\Meo\Desktop\RKreport[9]_D_05012013_02d1415.txt
2013-05-01 14:15 - 2013-05-01 11:50 - 00000000 ____D C:\Users\Meo\Desktop\RK_Quarantine
2013-05-01 13:47 - 2011-04-10 05:24 - 00166400 ____A C:\Users\Meo\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2013-05-01 13:16 - 2013-02-28 20:24 - 00000034 ____A C:\Windows\setupact.log
2013-05-01 12:38 - 2013-05-01 12:38 - 00001715 ____A C:\Users\Meo\Desktop\RKreport[8]_D_05012013_02d1238.txt
2013-05-01 12:36 - 2013-05-01 12:36 - 00001673 ____A C:\Users\Meo\Desktop\RKreport[7]_S_05012013_02d1236.txt
2013-05-01 12:11 - 2013-05-01 12:11 - 00001641 ____A C:\Users\Meo\Desktop\RKreport[6]_D_05012013_02d1211.txt
2013-05-01 12:09 - 2013-05-01 12:09 - 00001602 ____A C:\Users\Meo\Desktop\RKreport[5]_D_05012013_02d1209.txt
2013-05-01 12:08 - 2013-05-01 12:08 - 00001565 ____A C:\Users\Meo\Desktop\RKreport[4]_D_05012013_02d1208.txt
2013-05-01 12:06 - 2013-05-01 12:06 - 00001523 ____A C:\Users\Meo\Desktop\RKreport[3]_S_05012013_02d1206.txt
2013-05-01 11:57 - 2013-05-01 11:57 - 00003606 ____A C:\Users\Meo\Desktop\RKreport[2]_D_05012013_02d1157.txt
2013-05-01 11:57 - 2013-05-01 11:54 - 00184320 ____A C:\Windows\System32\Drivers\netbt.sys.dump
2013-05-01 11:56 - 2006-11-02 13:18 - 00000000 ___DC C:\Windows\$NtUninstallKB5150$
2013-05-01 11:55 - 2013-05-01 11:55 - 00001848 ____A C:\Users\Meo\Desktop\RKreport[1]_S_05012013_02d1155.txt
2013-05-01 11:54 - 2013-05-01 11:54 - 00000000 ____D C:\Windows\snack
2013-05-01 11:41 - 2013-05-01 11:41 - 12917756 ____A C:\Users\Meo\Desktop\mbar-1.05.0.1001.zip
2013-05-01 11:40 - 2013-05-01 11:40 - 00816128 ____A C:\Users\Meo\Desktop\RogueKiller.exe
2013-04-30 18:30 - 2013-04-30 18:30 - 00005034 ____A C:\Users\Meo\Desktop\attach.txt
2013-04-30 18:29 - 2013-04-30 18:30 - 00018240 ____A C:\Users\Meo\Desktop\dds.txt
2013-04-30 13:40 - 2013-04-30 13:40 - 00688992 ____A (Swearware) C:\Users\Meo\Downloads\dds(1).com
2013-04-30 13:40 - 2013-04-30 13:40 - 00000000 ____D C:\Users\Meo\AppData\Roaming\Malwarebytes
2013-04-30 13:39 - 2013-04-30 13:39 - 00688992 ____R (Swearware) C:\Users\Meo\Desktop\dds.com
2013-04-30 13:39 - 2013-04-30 13:39 - 00000910 ____A C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2013-04-30 13:39 - 2013-04-30 13:39 - 00000000 ____D C:\Program Files\Malwarebytes' Anti-Malware
2013-04-30 13:38 - 2013-04-30 13:38 - 10285040 ____A (Malwarebytes Corporation ) C:\Users\Meo\Downloads\mbam-setup-1.75.0.1300.exe
2013-04-29 14:18 - 2013-04-29 14:18 - 00000000 ____D C:\Program Files\Mega Codec Pack
2013-04-29 14:16 - 2013-04-29 14:16 - 12179456 ____A (x264 project) C:\Users\Meo\Downloads\x264.exe
2013-04-29 14:13 - 2013-04-29 14:13 - 00015279 ____A C:\Users\Meo\Downloads\Hit+and+Run%5B2012%5DDVDRip+XviD-ETRG.torrent
2013-04-29 09:48 - 2013-04-29 09:48 - 00013054 ____A C:\Users\Meo\Downloads\[kat.ph]pawg.ava.alvares.torrent
2013-04-29 09:47 - 2013-04-29 09:47 - 00014054 ____A C:\Users\Meo\Downloads\[kat.ph]big.tits.round.asses.jasmine.torrent
2013-04-29 09:33 - 2013-04-29 09:33 - 00016099 ____A C:\Users\Meo\Downloads\[kat.ph]blowjobfridays.13.03.22.luna.star.xxx.720p.mp4.ktr.torrent
2013-04-29 09:32 - 2013-04-29 09:32 - 00109684 ____A C:\Users\Meo\Downloads\rm8555_1500.mp4.torrent
2013-04-29 09:31 - 2013-04-29 09:31 - 00008192 ____A C:\Users\Meo\Downloads\[kat.ph]facial.fest.prada.xxx.adduct.mp4.torrent
2013-04-29 09:30 - 2013-04-29 09:30 - 00050504 ____A C:\Users\Meo\Downloads\[kat.ph]big.tits.and.round.asses.stacey.foxxx.hd.720p.torrent
2013-04-29 09:25 - 2013-04-29 09:25 - 00109667 ____A C:\Users\Meo\Downloads\[kat.ph]bangbros.remastered.isabella.remastered.isabelle.july.16.2011(3).torrent
2013-04-29 09:25 - 2013-04-29 09:25 - 00019636 ____A C:\Users\Meo\Downloads\[kat.ph]pawg.savannah.fox.torrent
2013-04-29 09:24 - 2013-04-29 09:24 - 00109667 ____A C:\Users\Meo\Downloads\[kat.ph]bangbros.remastered.isabella.remastered.isabelle.july.16.2011.torrent
2013-04-29 09:24 - 2013-04-29 09:24 - 00109667 ____A C:\Users\Meo\Downloads\[kat.ph]bangbros.remastered.isabella.remastered.isabelle.july.16.2011(2).torrent
2013-04-29 09:24 - 2013-04-29 09:24 - 00109667 ____A C:\Users\Meo\Downloads\[kat.ph]bangbros.remastered.isabella.remastered.isabelle.july.16.2011(1).torrent
2013-04-29 09:21 - 2013-04-29 09:21 - 00011609 ____A C:\Users\Meo\Downloads\BangBrosRemastered - Ana 28 april 2013-[rarbg.com].torrent
2013-04-29 09:08 - 2013-04-29 09:08 - 00107535 ____A C:\Users\Meo\Downloads\[kat.ph]bangbus.yasmine.the.beautiful.yasmine.gets.it.new.january.30.2013.torrent
2013-04-29 09:03 - 2013-04-29 09:03 - 00019253 ____A C:\Users\Meo\Downloads\[kat.ph]milfsoup.priya.rai.mama.knows.best.torrent
2013-04-29 09:03 - 2013-04-29 09:03 - 00017374 ____A C:\Users\Meo\Downloads\[kat.ph]myfriendshotmom.priya.anjali.rai.torrent
2013-04-29 09:03 - 2013-04-29 09:03 - 00014110 ____A C:\Users\Meo\Downloads\[kat.ph]milfsoup.priya.rai.pocahontas.jones.show.her.how.it.39.s.done.m.torrent
2013-04-29 09:03 - 2013-04-29 09:03 - 00013440 ____A C:\Users\Meo\Downloads\[kat.ph]blowjobfridays.priya.rai.heavenly.blow.job.bj11220.01.25.torrent
2013-04-29 08:57 - 2013-04-29 08:57 - 00030070 ____A C:\Users\Meo\Downloads\[kat.ph]chongas.corin.carter.in.love.with.a.stripper.03.09.2013.torrent
2013-04-29 08:57 - 2013-04-29 08:57 - 00030070 ____A C:\Users\Meo\Downloads\[kat.ph]chongas.corin.carter.in.love.with.a.stripper.03.09.2013(1).torrent
2013-04-29 08:36 - 2013-04-29 08:36 - 00022891 ____A C:\Users\Meo\Downloads\[kat.ph]blowjobfridays.13.03.15.corin.carter.xxx.720p.mp4.ktr.torrent
2013-04-29 08:31 - 2013-04-29 08:31 - 00004817 ____A C:\Users\Meo\Downloads\[kat.ph]blowjob.fridays.diamond.kitty.latina.with.big.tits.sucks.the.best.dick.xxx.pornalized.com.avi.torrent
2013-04-29 08:17 - 2013-04-29 08:17 - 00003524 ____A C:\Users\Meo\Downloads\[kat.ph]alanna.triple.d.anal.destruction.bangbrosremastered.2012.torrent
2013-04-29 08:17 - 2013-04-29 08:17 - 00003524 ____A C:\Users\Meo\Downloads\[kat.ph]alanna.triple.d.anal.destruction.bangbrosremastered.2012(1).torrent
2013-04-29 08:06 - 2013-04-29 08:06 - 00040310 ____A C:\Users\Meo\Downloads\[kat.ph]assparade.vanessa.luna.big.latina.ass.bounces.up.and.down.0.torrent
2013-04-29 08:02 - 2013-04-29 08:02 - 00058519 ____A C:\Users\Meo\Downloads\[kat.ph]pornstarspa.luna.star.amazing.ass.to.rub.down.and.****.after.new.april.25.2013.torrent
2013-04-28 21:33 - 2013-04-28 21:33 - 00019025 ____A C:\Users\Meo\Downloads\[kat.ph]nikita.s03e19.hdtv.x264.lol.vtv.mp4.torrent
2013-04-28 21:32 - 2013-04-28 21:32 - 00028869 ____A C:\Users\Meo\Downloads\[kat.ph]nikita.s03e19.hdtv.xvid.fum.ettv.torrent
2013-04-28 21:27 - 2013-04-28 21:27 - 00057342 ____A C:\Users\Meo\Downloads\[kat.ph]here.comes.the.boom.2012.dvdrip.xvid.ptpower.torrent
2013-04-28 20:06 - 2013-04-28 20:06 - 00019321 ____A C:\Users\Meo\Downloads\[kat.ph]nikita.s03e19.hdtv.x264.lol.ettv.torrent
2013-04-28 20:05 - 2013-04-28 20:05 - 00009818 ____A C:\Users\Meo\Downloads\[kat.ph]nikita.s03e19.hdtv.x264.lol.eztv.torrent
2013-04-28 19:51 - 2013-04-28 19:51 - 00014883 ____A C:\Users\Meo\Downloads\Here+Comes+the+Boom+%282012%29+720p+BrRip+x264+-+YIFY.torrent
2013-04-28 19:49 - 2013-04-28 19:49 - 00000000 ____A C:\Users\Meo\Downloads\[kat.ph]red.dawn.2012.dvdrip.xvid.sparks.torrent
2013-04-28 19:49 - 2013-04-28 19:49 - 00000000 ____A C:\Users\Meo\Downloads\[kat.ph]red.dawn.2012.dvdrip.xvid.sparks(1).torrent
2013-04-28 19:36 - 2013-04-28 19:36 - 00030916 ____A C:\Users\Meo\Downloads\Here Comes the Boom 2012 English.[DVDRip] (AC3).torrent
2013-04-28 19:33 - 2013-04-28 19:33 - 00030868 ____A C:\Users\Meo\Downloads\Red Dawn 2012 English DVDRip [x264].torrent
2013-04-28 19:28 - 2013-04-28 19:28 - 00030865 ____A C:\Users\Meo\Downloads\24039AA9AB66E4C4B181BD4717AE6D7A68BE3F49.torrent
2013-04-28 19:27 - 2013-04-28 19:27 - 00000001 ____A C:\Users\Meo\Downloads\Stolen+%282012%29+DVDRip+XD+XviD+-VISION.torrent
2013-04-28 01:42 - 2013-04-28 01:42 - 00029181 ____A C:\Users\Meo\Downloads\Kitchen+Nightmares+US+S05E08+Burger+Kitchen+Part+Two+WS+PDTV+Xvi.torrent
2013-04-28 01:40 - 2013-04-28 01:40 - 00014598 ____A C:\Users\Meo\Downloads\[kat.ph]kitchen.nightmares.us.burger.kitchen.part.two.5x8.ws.pdtv.2hd.torrent
2013-04-27 14:48 - 2013-04-27 14:48 - 00027339 ____A C:\Users\Meo\Downloads\[kat.ph]anthony.robbins.get.the.edge.full.torrent
2013-04-27 14:48 - 2013-04-27 14:48 - 00027339 ____A C:\Users\Meo\Downloads\[kat.ph]anthony.robbins.get.the.edge.full(1).torrent
2013-04-27 14:19 - 2013-04-27 14:19 - 00028670 ____A C:\Users\Meo\Downloads\[kat.ph]rsd.the.jeffy.show.seductiongr.com.dvd6.avi.sgr.torrent
2013-04-27 14:18 - 2013-04-27 14:18 - 00028691 ____A C:\Users\Meo\Downloads\[kat.ph]rsd.the.jeffy.show.seductiongr.com.dvd5.avi.sgr.torrent
2013-04-27 14:18 - 2013-04-27 14:18 - 00028691 ____A C:\Users\Meo\Downloads\[kat.ph]rsd.the.jeffy.show.seductiongr.com.dvd5.avi.sgr(1).torrent
2013-04-27 14:18 - 2013-04-27 14:18 - 00028691 ____A C:\Users\Meo\Downloads\[kat.ph]rsd.the.jeffy.show.seductiongr.com.dvd4.avi.sgr.torrent
2013-04-27 14:18 - 2013-04-27 14:18 - 00028690 ____A C:\Users\Meo\Downloads\[kat.ph]rsd.the.jeffy.show.seductiongr.com.dvd3.avi.sgr.torrent
2013-04-27 14:18 - 2013-04-27 14:18 - 00028690 ____A C:\Users\Meo\Downloads\[kat.ph]rsd.the.jeffy.show.seductiongr.com.dvd2.avi.sgr(1).torrent
2013-04-27 14:17 - 2013-04-27 14:17 - 00028690 ____A C:\Users\Meo\Downloads\[kat.ph]rsd.the.jeffy.show.seductiongr.com.dvd2.avi.sgr.torrent
2013-04-27 14:16 - 2013-04-27 14:16 - 00028690 ____A C:\Users\Meo\Downloads\[kat.ph]rsd.the.jeffy.show.seductiongr.com.dvd1.avi.sgr.torrent
2013-04-27 14:14 - 2013-04-27 14:14 - 00151601 ____A C:\Users\Meo\Downloads\[kat.ph]the.jeffy.show.torrent
2013-04-24 09:31 - 2013-04-12 00:14 - 00000000 ____D C:\Program Files\Mozilla Firefox
2013-04-22 01:20 - 2013-04-22 01:20 - 00300368 ____A (SoftSafe) C:\Users\Meo\Downloads\rlb breakthrough noah gift secret code of success pdf (1).exe
2013-04-20 22:33 - 2012-11-21 03:23 - 00000000 ____D C:\Program Files\Mozilla Maintenance Service
2013-04-20 22:24 - 2013-04-20 22:24 - 00030834 ____A C:\Users\Meo\Downloads\[kat.ph]hawaii.five.0.2010.s03e15.hdtv.x264.lol.vtv.mp4.torrent
2013-04-20 22:23 - 2013-04-20 22:23 - 00016092 ____A C:\Users\Meo\Downloads\[kat.ph]hawaii.five.0.2010.s03e17.hdtv.x264.lol.eztv (1).torrent
2013-04-20 22:06 - 2013-04-20 22:06 - 00011525 ____A C:\Users\Meo\Downloads\[kat.ph]californication.s06e12.hdtv.x264.2hd.eztv(2).torrent
2013-04-20 22:06 - 2013-04-20 22:06 - 00011525 ____A C:\Users\Meo\Downloads\[kat.ph]californication.s06e12.hdtv.x264.2hd.eztv(1).torrent
2013-04-20 22:00 - 2013-04-20 22:00 - 00016092 ____A C:\Users\Meo\Downloads\[kat.ph]hawaii.five.0.2010.s03e17.hdtv.x264.lol.eztv.torrent
2013-04-20 21:18 - 2013-04-20 21:18 - 00018923 ____A C:\Users\Meo\Downloads\Nikita.S03E18.HDTV.x264-LOL-[rarbg.com].torrent
2013-04-20 21:04 - 2013-04-20 21:04 - 00015514 ____A C:\Users\Meo\Downloads\[kat.ph]swordsmen.aka.wu.xia.2011.dvdrip.hc.xvid.xult.torrent
2013-04-20 21:04 - 2013-04-20 21:04 - 00015514 ____A C:\Users\Meo\Downloads\[kat.ph]swordsmen.aka.wu.xia.2011.dvdrip.hc.xvid.xult (2).torrent
2013-04-20 21:04 - 2013-04-20 21:04 - 00015514 ____A C:\Users\Meo\Downloads\[kat.ph]swordsmen.aka.wu.xia.2011.dvdrip.hc.xvid.xult (1).torrent
2013-04-20 20:56 - 2013-04-20 20:56 - 00019061 ____A C:\Users\Meo\Downloads\[kat.ph]nikita.s03e18.hdtv.x264.lol.ettv(5).torrent
2013-04-20 20:56 - 2013-04-20 20:56 - 00009698 ____A C:\Users\Meo\Downloads\[kat.ph]nikita.3x18.hdtv.lol(1).torrent
2013-04-20 20:55 - 2013-04-20 20:55 - 00019061 ____A C:\Users\Meo\Downloads\[kat.ph]nikita.s03e18.hdtv.x264.lol.ettv(4).torrent
2013-04-20 20:55 - 2013-04-20 20:55 - 00019061 ____A C:\Users\Meo\Downloads\[kat.ph]nikita.s03e18.hdtv.x264.lol.ettv(3).torrent
2013-04-20 20:55 - 2013-04-20 20:55 - 00019061 ____A C:\Users\Meo\Downloads\[kat.ph]nikita.s03e18.hdtv.x264.lol.ettv(2).torrent
2013-04-20 20:55 - 2013-04-20 20:54 - 00019061 ____A C:\Users\Meo\Downloads\[kat.ph]nikita.s03e18.hdtv.x264.lol.ettv(1).torrent
2013-04-20 20:53 - 2013-04-20 20:53 - 00019061 ____A C:\Users\Meo\Downloads\[kat.ph]nikita.s03e18.hdtv.x264.lol.ettv.torrent
2013-04-20 20:53 - 2013-04-20 20:53 - 00009698 ____A C:\Users\Meo\Downloads\[kat.ph]nikita.3x18.hdtv.lol.torrent
2013-04-16 21:59 - 2012-03-16 03:14 - 00000000 ____D C:\Users\Meo\AppData\Roaming\SoftGrid Client
2013-04-16 21:49 - 2012-04-24 01:33 - 00000000 ____D C:\Users\Meo\Documents\2012
2013-04-15 01:03 - 2013-04-15 01:03 - 00299344 ____A (SoftSafe) C:\Users\Meo\Downloads\rlb breakthrough noah gift secret code of success pdf.exe
2013-04-14 21:40 - 2013-04-14 21:40 - 00018801 ____A C:\Users\Meo\Downloads\[kat.ph]nikita.s03e17.hdtv.x264.lol.ettv.torrent
2013-04-14 21:40 - 2013-04-14 21:40 - 00009395 ____A C:\Users\Meo\Downloads\[kat.ph]nikita.3x17.hdtv.lol.torrent
2013-04-14 20:12 - 2013-04-14 20:12 - 00001297 ____A C:\Users\Meo\Downloads\[kat.ph]the.secret.code.of.success.by.noah.st.john (1).torrent
2013-04-14 20:00 - 2013-04-14 20:00 - 00001297 ____A C:\Users\Meo\Downloads\[kat.ph]the.secret.code.of.success.by.noah.st.john.torrent
2013-04-14 19:12 - 2013-04-14 19:12 - 00011569 ____A C:\Users\Meo\Downloads\[kat.ph]californication.s06e12.hdtv.x264.2hd.eztv (3).torrent
2013-04-14 19:12 - 2013-04-14 19:12 - 00011569 ____A C:\Users\Meo\Downloads\[kat.ph]californication.s06e12.hdtv.x264.2hd.eztv (2).torrent
2013-04-14 19:11 - 2013-04-14 19:11 - 00009715 ____A C:\Users\Meo\Downloads\[kat.ph]nikita.s03e16.hdtv.x264.lol.eztv.torrent
2013-04-14 19:08 - 2013-04-14 19:08 - 00010375 ____A C:\Users\Meo\Downloads\[kat.ph]nikita.s03e15.hdtv.x264.lol.eztv (2).torrent
2013-04-13 23:27 - 2013-04-13 23:27 - 00010375 ____A C:\Users\Meo\Downloads\[kat.ph]nikita.s03e15.hdtv.x264.lol.eztv (1).torrent
2013-04-13 23:26 - 2013-04-13 23:26 - 00028163 ____A C:\Users\Meo\Downloads\[kat.ph]nikita.s03e14.hdtv.xvid.afg.torrent
2013-04-13 23:25 - 2013-04-13 23:25 - 00010941 ____A C:\Users\Meo\Downloads\[kat.ph]nikita.s03e14.hdtv.x264.lol (2).torrent
2013-04-13 23:25 - 2013-04-13 23:25 - 00010941 ____A C:\Users\Meo\Downloads\[kat.ph]nikita.s03e14.hdtv.x264.lol (1).torrent
2013-04-13 23:25 - 2013-04-13 23:25 - 00010375 ____A C:\Users\Meo\Downloads\[kat.ph]nikita.s03e15.hdtv.x264.lol.eztv.torrent
2013-04-13 21:02 - 2011-04-10 21:31 - 00000000 ____D C:\Users\Meo\AppData\Roaming\vlc
2013-04-13 16:45 - 2013-04-13 16:45 - 00058446 ____A C:\Users\Meo\Downloads\[kat.ph]seven.psychopaths.2012.dvdrip.xvid.vip3r (1).torrent
2013-04-13 13:35 - 2013-04-13 13:35 - 00028806 ____A C:\Users\Meo\Downloads\[kat.ph]the.cold.light.of.day.2012.dvdrip.xvid.done.torrent
2013-04-13 13:19 - 2013-04-13 13:19 - 00058325 ____A C:\Users\Meo\Downloads\[kat.ph]seven.psychopaths.2012.dvdrip.xvid.vip3r.torrent
2013-04-13 02:52 - 2013-04-13 02:52 - 00014683 ____A C:\Users\Meo\Downloads\[kat.ph]jet.li.fearless.2006.dvdrip.english.torrent
2013-04-13 02:52 - 2013-04-13 02:52 - 00014683 ____A C:\Users\Meo\Downloads\[kat.ph]jet.li.fearless.2006.dvdrip.english (1).torrent
2013-04-13 02:35 - 2013-04-13 02:35 - 00015719 ____A C:\Users\Meo\Downloads\[kat.ph]the.sorcerer.and.the.white.snake.2011.eng.dubbed.dvdrip.xvid.ac3.sc0rp.torrent
2013-04-11 19:04 - 2011-04-11 03:50 - 00001975 ____A C:\Users\Public\Desktop\Google Chrome.lnk
2013-04-11 02:12 - 2013-04-11 02:12 - 00000000 ____D C:\Users\Meo\AppData\Roaming\LibreOffice
2013-04-11 01:30 - 2006-11-02 14:47 - 00352536 ____A C:\Windows\System32\FNTCACHE.DAT
2013-04-10 20:40 - 2011-04-10 02:10 - 00083864 ____A C:\Users\Meo\AppData\Local\GDIPFONTCACHEV1.DAT
2013-04-10 20:36 - 2013-04-10 20:36 - 00001013 ____A C:\Users\Public\Desktop\LibreOffice 4.0.lnk
2013-04-10 20:36 - 2013-04-10 20:36 - 00000000 ____D C:\Windows\System64
2013-04-10 20:36 - 2013-04-10 20:26 - 00000000 ____D C:\Program Files\LibreOffice 4.0
2013-04-10 19:36 - 2013-04-10 19:30 - 193572864 ____A C:\Users\Meo\Downloads\LibreOffice_4.0.2_Win_x86.msi
2013-04-10 19:29 - 2013-04-10 19:28 - 08335349 ____A C:\Users\Meo\Downloads\abiword-setup-2.8.6(1).exe
2013-04-10 19:18 - 2013-04-10 19:17 - 08335349 ____A C:\Users\Meo\Downloads\abiword-setup-2.8.6.exe
2013-04-09 20:59 - 2013-04-09 20:59 - 00000000 ____A C:\Users\Meo\Downloads\download (1).htm
2013-04-09 00:21 - 2013-04-09 00:21 - 06912776 ____A C:\Users\Meo\Downloads\HAI Process.zip
2013-04-08 19:07 - 2013-04-08 19:05 - 69843799 ____A C:\Users\Meo\Downloads\EGC - Training Call #2 (1).zip
2013-04-08 19:05 - 2013-04-08 19:04 - 69843799 ____A C:\Users\Meo\Downloads\EGC - Training Call #2.zip
2013-04-07 20:41 - 2013-04-07 20:41 - 00028993 ____A C:\Users\Meo\Downloads\[kat.ph]nikita.s03e11.fastsub.vostfr.hdtv.xvid.mind.torrent
2013-04-07 20:41 - 2013-04-07 20:41 - 00011281 ____A C:\Users\Meo\Downloads\[kat.ph]nikita.s03e11.hdtv.x264.lol (1).torrent
2013-04-07 20:38 - 2013-04-07 20:38 - 00010941 ____A C:\Users\Meo\Downloads\[kat.ph]nikita.s03e14.hdtv.x264.lol.torrent
2013-04-07 10:04 - 2013-04-07 10:04 - 00020642 ____A C:\Users\Meo\Downloads\[kat.ph]nikita.s03e10.hdtv.x264.lol.ettv.torrent
2013-04-07 10:04 - 2013-04-07 10:03 - 00027473 ____A C:\Users\Meo\Downloads\[kat.ph]nikita.s03e10.hdtv.xvid.afg (1).torrent
2013-04-07 09:23 - 2013-04-07 09:23 - 00022334 ____A C:\Users\Meo\Downloads\[kat.ph]nikita.s03e11.hdtv.x264.lol.ettv.torrent
2013-04-07 09:22 - 2013-04-07 09:22 - 00027473 ____A C:\Users\Meo\Downloads\[kat.ph]nikita.s03e10.hdtv.xvid.afg.torrent
2013-04-07 09:21 - 2013-04-07 09:21 - 00028993 ____A C:\Users\Meo\Downloads\[kat.ph]nikita.s03e10.fastsub.vostfr.hdtv.xvid.mind.torrent
2013-04-07 08:56 - 2013-04-07 08:56 - 00010756 ____A C:\Users\Meo\Downloads\[kat.ph]nikita.s03e13.hdtv.x264.lol.torrent
2013-04-07 08:41 - 2013-04-07 08:41 - 00010195 ____A C:\Users\Meo\Downloads\[kat.ph]nikita.s03e12.hdtv.x264.lol.torrent
2013-04-07 08:40 - 2013-04-07 08:40 - 00020324 ____A C:\Users\Meo\Downloads\[kat.ph]nikita.s03e10.hdtv.x264.lol.torrent
2013-04-07 08:40 - 2013-04-07 08:40 - 00011281 ____A C:\Users\Meo\Downloads\[kat.ph]nikita.s03e11.hdtv.x264.lol.torrent
2013-04-07 02:35 - 2013-04-07 02:35 - 00019670 ____A C:\Users\Meo\Downloads\[kat.ph]californication.s06e10.hdtv.xvid.afg.torrent
2013-04-07 01:40 - 2013-04-07 01:40 - 00015315 ____A C:\Users\Meo\Downloads\[kat.ph]the.sweeney.2012.brrip.nl.subs.dutchreleaseteam (1).torrent
2013-04-07 01:40 - 2013-04-07 01:39 - 00015315 ____A C:\Users\Meo\Downloads\[kat.ph]the.sweeney.2012.brrip.nl.subs.dutchreleaseteam.torrent
2013-04-07 00:38 - 2013-04-07 00:38 - 00015113 ____A C:\Users\Meo\Downloads\[kat.ph]the.sweeney.2012.dvdscr.xvid.etrg.torrent
2013-04-07 00:27 - 2013-04-07 00:27 - 00056707 ____A C:\Users\Meo\Downloads\[kat.ph]the.expatriate.2012.bdrip.xvid.noscreens.torrent
2013-04-07 00:25 - 2013-04-07 00:25 - 00015399 ____A C:\Users\Meo\Downloads\[kat.ph]the.expatriate.2012.brrip.nl.subs.dutchreleaseteam.torrent
2013-04-07 00:24 - 2013-04-07 00:24 - 00010889 ____A C:\Users\Meo\Downloads\[kat.ph]californication.s06e10.hdtv.x264.2hd.eztv.torrent
2013-04-07 00:24 - 2013-04-07 00:24 - 00010889 ____A C:\Users\Meo\Downloads\[kat.ph]californication.s06e10.hdtv.x264.2hd.eztv (1).torrent
2013-04-07 00:23 - 2013-04-07 00:23 - 00012145 ____A C:\Users\Meo\Downloads\[kat.ph]californication.s06e11.hdtv.x264.2hd.eztv.torrent
2013-04-07 00:23 - 2013-04-07 00:23 - 00011569 ____A C:\Users\Meo\Downloads\[kat.ph]californication.s06e12.hdtv.x264.2hd.eztv.torrent
2013-04-07 00:23 - 2013-04-07 00:23 - 00011569 ____A C:\Users\Meo\Downloads\[kat.ph]californication.s06e12.hdtv.x264.2hd.eztv (1).torrent
2013-04-07 00:09 - 2013-04-07 00:09 - 00029289 ____A C:\Users\Meo\Downloads\[kat.ph]the.expatriate.2012.brrip.xvid.vip3r.torrent
2013-04-06 20:44 - 2013-04-06 20:44 - 00014485 ____A C:\Users\Meo\Downloads\[kat.ph]shooter.2007.1080p.brrip.x264.1.32gb.yify.torrent
2013-04-06 20:44 - 2013-04-06 20:44 - 00014485 ____A C:\Users\Meo\Downloads\[kat.ph]shooter.2007.1080p.brrip.x264.1.32gb.yify (1).torrent
2013-04-06 20:43 - 2013-04-06 20:43 - 00057019 ____A C:\Users\Meo\Downloads\[kat.ph]shooter.2007.dvdrip.eng.axxo.torrent
2013-04-04 14:50 - 2013-04-30 13:39 - 00022856 ____A (Malwarebytes Corporation) C:\Windows\System32\Drivers\mbam.sys
2013-04-03 22:55 - 2013-04-03 22:55 - 00017028 ____A C:\Users\Meo\Downloads\[kat.ph]the.a.team.extended.2010.720p.brrip.x264.800mb.yify.torrent
2013-04-03 22:55 - 2013-04-03 22:55 - 00017028 ____A C:\Users\Meo\Downloads\[kat.ph]the.a.team.extended.2010.720p.brrip.x264.800mb.yify (1).torrent
2013-04-03 22:54 - 2013-04-03 22:54 - 00361867 ____A C:\Users\Meo\Downloads\[kat.ph]predators.2010.720p.bluray.x264.dts.vice.torrent

==================== Bamital & volsnap Check =================

C:\Windows\explorer.exe => MD5 is legit
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit

Last Boot: 2013-05-02 11:57

==================== End Of Log ============================
May 2nd, 2013, 07:15 AM
Obsession

Additional scan result of Farbar Recovery Scan Tool (x86) Version: 01-05-2013
Ran by Meo at 2013-05-02 12:48:18 Run:
Running from C:\Users\Meo\Desktop
Boot Mode: Normal
==========================================================

==================== Installed Programs =======================

µTorrent (Version: 1.7.1)
µTorrent (Version: 2.2.1)
2007 Microsoft Office Suite Service Pack 1 (SP1)
Acer Arcade Deluxe (Version: 2.0.5817)
Acer Crystal Eye Webcam 2.0.8.3 (Version: 2.0.8.3)
Acer eAudio Management (Version: 3.0.3009)
Acer eDataSecurity Management (Version: 3.0.3065)
Acer Empowering Technology (Version: 3.0.3013)
Acer ePower Management (Version: 3.0.3016)
Acer eRecovery Management (Version: 3.0.3014)
Acer eSettings Management (Version: 3.0.3011)
Acer GridVista (Version: 2.72.317)
Acer Mobility Center Plug-In (Version: 3.0.3000)
Acer Product Registration (Version: 3.0.0.10)
Acer ScreenSaver (Version: 1.11.0701)
Adobe Flash Player 11 ActiveX (Version: 11.6.602.180)
Adobe Flash Player 11 Plugin (Version: 11.6.602.180)
Adobe Reader 9 - Nederlands (Version: 9.0.0)
Agatha Christie Peril at End House
Agere Systems HDA Modem
Alice Greenfingers
Alien Shooter
AMD USB Audio Driver Filter (Version: 1.0.7.0031)
Atheros Communications Inc.(R) AR8121/AR8113/AR8114 Gigabit/Fast Ethernet Driver (Version: 1.0.0.35)
ATI Catalyst Install Manager (Version: 3.0.704.0)
AVG 2011 (Version: 10.0.1415)
AVG 2012 (Version: 12.0.2108)
AVG Security Toolbar (Version: 14.2.0.1)
Bookworm Adventures
C:\Program Files\Acer GameZone\GameConsole (Version: 2.0.1.4)
Cake Mania
Catalyst Control Center - Branding (Version: 1.00.0000)
Catalyst Control Center Core Implementation (Version: 2008.1210.1623.29379)
Catalyst Control Center Graphics Full Existing (Version: 2008.1210.1623.29379)
Catalyst Control Center Graphics Full New (Version: 2008.1210.1623.29379)
Catalyst Control Center Graphics Light (Version: 2008.1210.1623.29379)
Catalyst Control Center Localization Czech (Version: 2008.1210.1623.29379)
Catalyst Control Center Localization Danish (Version: 2008.1210.1623.29379)
CCC Help Chinese Standard (Version: 2008.1210.1622.29379)
CCC Help Chinese Traditional (Version: 2008.1210.1622.29379)
CCC Help Czech (Version: 2008.1210.1622.29379)
CCC Help Danish (Version: 2008.1210.1622.29379)
CCC Help Dutch (Version: 2008.1210.1622.29379)
CCC Help English (Version: 2008.1210.1622.29379)
CCC Help Finnish (Version: 2008.1210.1622.29379)
CCC Help French (Version: 2008.1210.1622.29379)
CCC Help German (Version: 2008.1210.1622.29379)
CCC Help Greek (Version: 2008.1210.1622.29379)
CCC Help Hungarian (Version: 2008.1210.1622.29379)
CCC Help Italian (Version: 2008.1210.1622.29379)
CCC Help Japanese (Version: 2008.1210.1622.29379)
CCC Help Korean (Version: 2008.1210.1622.29379)
CCC Help Norwegian (Version: 2008.1210.1622.29379)
CCC Help Polish (Version: 2008.1210.1622.29379)
CCC Help Portuguese (Version: 2008.1210.1622.29379)
CCC Help Russian (Version: 2008.1210.1622.29379)
CCC Help Spanish (Version: 2008.1210.1622.29379)
CCC Help Swedish (Version: 2008.1210.1622.29379)
CCC Help Thai (Version: 2008.1210.1622.29379)
CCC Help Turkish (Version: 2008.1210.1622.29379)
ccc-core-static (Version: 2008.1210.1623.29379)
Chicken Invaders 2
Choice Guard (Version: 1.2.87.0)
CyberLink PowerDirector (Version: 6.5.3524)
Dream Day First Home
eSobi v2 (Version: 2.0.3.000223)
Galapago
Go-Go Gourmet
Google Chrome (Version: 26.0.1410.64)
Google Desktop (Version: 5.9.1005.12335)
Google Toolbar for Internet Explorer (Version: 1.0.0)
Google Toolbar for Internet Explorer (Version: 7.4.3607.2246)
Google Update Helper (Version: 1.3.21.145)
Heroes of Hellas
Java Auto Updater (Version: 2.0.2.4)
Java(TM) 6 Update 22 (Version: 6.0.220)
Junk Mail filter update (Version: 14.0.8050.1202)
Kingsoft Writer (8.1.0.3016) (Version: 8.1.0.3016)
Launch Manager
LibreOffice 4.0.2.2 (Version: 4.0.2.2)
Magic Farm
Magic Match Adventures
Malwarebytes Anti-Malware versie 1.75.0.1300 (Version: 1.75.0.1300)
McAfee SiteAdvisor (Version: 3.6.187)
Microsoft .NET Framework 3.5 Language Pack SP1 - nld (Version: 3.5.30729)
Microsoft .NET Framework 3.5 SP1 (Version: 3.5.30729)
Microsoft Application Error Reporting (Version: 12.0.6012.5000)
Microsoft Office Excel MUI (Dutch) 2007 (Version: 12.0.6215.1000)
Microsoft Office Home and Student 2007 (Version: 12.0.6215.1000)
Microsoft Office Home and Student 2010 - Nederlands (Version: 14.0.6114.5002)
Microsoft Office Klik-en-Klaar 2010 (Version: 14.0.4763.1000)
Microsoft Office OneNote MUI (Dutch) 2007 (Version: 12.0.6215.1000)
Microsoft Office PowerPoint MUI (Dutch) 2007 (Version: 12.0.6215.1000)
Microsoft Office Proof (Dutch) 2007 (Version: 12.0.6213.1000)
Microsoft Office Proof (English) 2007 (Version: 12.0.6213.1000)
Microsoft Office Proof (French) 2007 (Version: 12.0.6213.1000)
Microsoft Office Proof (German) 2007 (Version: 12.0.6213.1000)
Microsoft Office Proofing (Dutch) 2007 (Version: 12.0.4518.1017)
Microsoft Office Shared MUI (Dutch) 2007 (Version: 12.0.6215.1000)
Microsoft Office Suite Activation Assistant (Version: 2.9)
Microsoft Office Word MUI (Dutch) 2007 (Version: 12.0.6215.1000)
Microsoft Silverlight (Version: 4.0.60831.0)
Microsoft SQL Server 2005 Compact Edition [ENU] (Version: 3.1.0000)
Microsoft Visual C++ 2005 Redistributable (Version: 8.0.50727.42)
Microsoft Visual C++ 2005 Redistributable (Version: 8.0.56336)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (Version: 9.0.30729.4148)
Microsoft Works (Version: 08.05.0822)
Mozilla Firefox 20.0.1 (x86 nl) (Version: 20.0.1)
Mozilla Maintenance Service (Version: 20.0.1)
MSVCRT (Version: 14.0.1468.721)
MSXML 4.0 SP2 (KB954430) (Version: 4.20.9870.0)
MSXML 4.0 SP2 (KB973688) (Version: 4.20.9876.0)
Mystery Solitaire - Secret Island
Mythic Mahjong
NTI Backup Now 5 (Version: 5.1.2.616)
NTI Backup Now Standard (Version: 5.1.2.616)
NTI Media Maker 8 (Version: 8.0.2.6509)
ooVoo (Version: 3.0.7031)
Orion (Version: 2.0.1)
PhotoNow! (Version: 1.1.5203)
Putt Mania
Realtek High Definition Audio Driver (Version: 6.0.1.5704)
Realtek USB 2.0 Card Reader (Version: )
Replay Media Catcher 4 (4.4.3) (Version: 4.4.3)
Skype Click to Call (Version: 5.6.8442)
Skype™ 5.5 (Version: 5.5.124)
Snagit 10.0.1 (Version: 10.0.1)
Synaptics Pointing Device Driver (Version: 11.1.4.0)
Taalpakket voor Microsoft .NET Framework 3.5 SP1 - NL
The Rise of Atlantis
Tiks Texas Hold em
Update for Microsoft .NET Framework 3.5 SP1 (KB963707) (Version: 1)
Update for Office 2007 (KB946691)
VBA (2627.01) (Version: 6.03.00.9402)
VC80CRTRedist - 8.0.50727.4053 (Version: 1.1.0)
VLC media player 1.1.8 (Version: 1.1.8)
Winbond CIR Device Drivers (Version: 7.60.1012)
Windows Live - Hulpprogramma voor uploaden (Version: 14.0.8014.1029)
Windows Live aanmeldhulp (Version: 5.000.817.1)
Windows Live Call (Version: 14.0.8050.1202)
Windows Live Communications Platform (Version: 14.0.8050.1202)
Windows Live Essentials (Version: 14.0.8050.1202)
Windows Live Mail (Version: 14.0.8050.1202)
Windows Live Messenger (Version: 14.0.8050.1202)
Windows Live Photo Gallery (Version: 14.0.8051.1204)
Windows Live Sync (Version: 14.0.8050.1202)
Windows Live Writer (Version: 14.0.8050.1202)
Windows Media Player Firefox Plugin (Version: 1.0.0.8)
WinRAR 4.00 (32-bit) (Version: 4.00.0)
Womens Murder Club
XMind 2012 (v3.3.1) (Version: 3.3.1.201212250029)

==================== Restore Points =========================

01-05-2013 13:04:11 Malwarebytes Anti-Rootkit Restore Point
01-05-2013 13:45:22 Malwarebytes Anti-Rootkit Restore Point
01-05-2013 22:26:50 Malwarebytes Anti-Rootkit Restore Point
01-05-2013 23:01:25 Malwarebytes Anti-Rootkit Restore Point

==================== Hosts content: ==========================

::1 localhost

127.0.0.1 localhost

==================== Faulty Device Manager Devices =============

==================== Event log errors: =========================

Application errors:
==================
Error: (05/02/2013 11:54:20 AM) (Source: MsiInstaller) (User: NT AUTHORITY)
Description: Product: AVG 2011 -- Installatie met dit pakket is niet mogelijk, omdat er al een hogere versie van het product is geïnstalleerd. Download het meest recente installatiepakket en voer dat uit, of open het menu Start, selecteer Configuratiescherm, Programma's en onderdelen (Programma's wijzigen of verwijderen) en selecteer Wijzigen voor het het AVG-product.

Error: (05/02/2013 11:50:47 AM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (05/02/2013 00:36:56 AM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (05/02/2013 00:05:25 AM) (Source: MsiInstaller) (User: NT AUTHORITY)
Description: Product: AVG 2011 -- Installatie met dit pakket is niet mogelijk, omdat er al een hogere versie van het product is geïnstalleerd. Download het meest recente installatiepakket en voer dat uit, of open het menu Start, selecteer Configuratiescherm, Programma's en onderdelen (Programma's wijzigen of verwijderen) en selecteer Wijzigen voor het het AVG-product.

Error: (05/02/2013 00:02:57 AM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (05/01/2013 04:23:28 PM) (Source: EventSystem) (User: )
Description: 80070005EventSystem.EventSubscription{CEB8B221-89C5-41A8-98CE-79B413BF150B}-{00000000-0000-0000-0000-000000000000}-{00000000-0000-0000-0000-000000000000}

Error: (05/01/2013 04:13:05 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (05/01/2013 03:45:29 PM) (Source: MsiInstaller) (User: NT AUTHORITY)
Description: Product: AVG 2011 -- Installatie met dit pakket is niet mogelijk, omdat er al een hogere versie van het product is geïnstalleerd. Download het meest recente installatiepakket en voer dat uit, of open het menu Start, selecteer Configuratiescherm, Programma's en onderdelen (Programma's wijzigen of verwijderen) en selecteer Wijzigen voor het het AVG-product.

Error: (05/01/2013 02:29:08 PM) (Source: CVHSVC) (User: )
Description: Alleen informatie.
Error: Initialization failed 0x80070424 Type: 88::UnexpectedError.

Error: (05/01/2013 02:18:50 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

System errors:
=============
Error: (05/02/2013 11:50:47 AM) (Source: Service Control Manager) (User: )
Description: Client Virtualization HandlerApplication Virtualization Client%%1070

Error: (05/02/2013 11:50:47 AM) (Source: Service Control Manager) (User: )
Description: Application Virtualization Client

Error: (05/02/2013 11:47:29 AM) (Source: HTTP) (User: )
Description: \Device\Http\ReqQueueKerberos

Error: (05/02/2013 00:36:56 AM) (Source: Service Control Manager) (User: )
Description: Client Virtualization HandlerApplication Virtualization Client%%1070

Error: (05/02/2013 00:36:56 AM) (Source: Service Control Manager) (User: )
Description: Application Virtualization Client

Error: (05/02/2013 00:34:46 AM) (Source: HTTP) (User: )
Description: \Device\Http\ReqQueueKerberos

Error: (05/02/2013 00:02:58 AM) (Source: Service Control Manager) (User: )
Description: Client Virtualization HandlerApplication Virtualization Client%%1070

Error: (05/02/2013 00:02:58 AM) (Source: Service Control Manager) (User: )
Description: Application Virtualization Client

Error: (05/02/2013 00:00:51 AM) (Source: HTTP) (User: )
Description: \Device\Http\ReqQueueKerberos

Error: (05/01/2013 04:13:06 PM) (Source: Service Control Manager) (User: )
Description: Client Virtualization HandlerApplication Virtualization Client%%1070

Microsoft Office Sessions:
=========================

CodeIntegrity Errors:
===================================
Date: 2013-05-02 12:47:32.327
Description: De integriteit van de kopie voor het bestand \Device\HarddiskVolume2\Windows\System32\drivers\AVGIDSEH.sys kan niet worden geverifieerd omdat de reeks kopie-hashes per pagina niet is gevonden op het systeem.

Date: 2013-05-02 12:47:32.177
Description: De integriteit van de kopie voor het bestand \Device\HarddiskVolume2\Windows\System32\drivers\AVGIDSEH.sys kan niet worden geverifieerd omdat de reeks kopie-hashes per pagina niet is gevonden op het systeem.

Date: 2013-05-02 12:47:32.014
Description: De integriteit van de kopie voor het bestand \Device\HarddiskVolume2\Windows\System32\drivers\AVGIDSEH.sys kan niet worden geverifieerd omdat de reeks kopie-hashes per pagina niet is gevonden op het systeem.

Date: 2013-05-02 12:47:31.764
Description: De integriteit van de kopie voor het bestand \Device\HarddiskVolume2\Windows\System32\drivers\AVGIDSEH.sys kan niet worden geverifieerd omdat de reeks kopie-hashes per pagina niet is gevonden op het systeem.

Date: 2013-05-02 11:48:33.667
Description: De integriteit van de kopie voor het bestand \Device\HarddiskVolume2\Windows\System32\drivers\AVGIDSDriver.sys kan niet worden geverifieerd omdat de reeks kopie-hashes per pagina niet is gevonden op het systeem.

Date: 2013-05-02 11:48:33.511
Description: De integriteit van de kopie voor het bestand \Device\HarddiskVolume2\Windows\System32\drivers\AVGIDSDriver.sys kan niet worden geverifieerd omdat de reeks kopie-hashes per pagina niet is gevonden op het systeem.

Date: 2013-05-02 11:48:33.339
Description: De integriteit van de kopie voor het bestand \Device\HarddiskVolume2\Windows\System32\drivers\AVGIDSDriver.sys kan niet worden geverifieerd omdat de reeks kopie-hashes per pagina niet is gevonden op het systeem.

Date: 2013-05-02 11:48:33.152
Description: De integriteit van de kopie voor het bestand \Device\HarddiskVolume2\Windows\System32\drivers\AVGIDSDriver.sys kan niet worden geverifieerd omdat de reeks kopie-hashes per pagina niet is gevonden op het systeem.

Date: 2013-05-02 11:48:32.887
Description: De integriteit van de kopie voor het bestand \Device\HarddiskVolume2\Windows\System32\drivers\AVGIDSDriver.sys kan niet worden geverifieerd omdat de reeks kopie-hashes per pagina niet is gevonden op het systeem.

Date: 2013-05-02 11:48:32.621
Description: De integriteit van de kopie voor het bestand \Device\HarddiskVolume2\Windows\System32\drivers\AVGIDSDriver.sys kan niet worden geverifieerd omdat de reeks kopie-hashes per pagina niet is gevonden op het systeem.

==================== Memory info ===========================

Percentage of memory in use: 48%
Total physical RAM: 3293.43 MB
Available physical RAM: 1698.96 MB
Total Pagefile: 6815.38 MB
Available Pagefile: 4962.17 MB
Total Virtual: 2047.88 MB
Available Virtual: 1921.69 MB

==================== Drives ================================

Drive c: (ACER) (Fixed) (Total:143.04 GB) (Free:6.87 GB) NTFS ==>[Drive with boot components (obtained from BCD)]
Drive d: (DATA) (Fixed) (Total:139.5 GB) (Free:1.37 GB) NTFS

Schf ### Status Grootte Vrij Dyn GPT
-------- ---------- ------- ------- --- ---
Schf 0 Online 298 GB 0 B

Partitions of Disk 0:
===============

Partitie ### Type Grootte Offset
------------- ---------------- ------- -------
Partitie 1 OEM 12 GB 1024 KB
Partitie 2 Primair 143 GB 12 GB
Partitie 3 Primair 140 GB 155 GB
Partitie 4 OEM 3630 MB 295 GB

==================================================================================

Disk: 0
Partitie 1
Type : 27
Verborgen: Ja
Actief : Nee

Er is geen volume aan deze partitie gekoppeld.

=========================================================

Disk: 0
Partitie 2
Type : 07
Verborgen: Nee
Actief : Ja

Volume ### Ltr Label FS Type Grootte Status Info
---------- --- ----------- ----- ---------- ------- --------- --------
* volume 1 C ACER NTFS partitie 143 GB In orde Systeem

=========================================================

Disk: 0
Partitie 3
Type : 07
Verborgen: Nee
Actief : Nee

Volume ### Ltr Label FS Type Grootte Status Info
---------- --- ----------- ----- ---------- ------- --------- --------
* volume 2 D DATA NTFS partitie 140 GB In orde

=========================================================

Disk: 0
Partitie 4
Type : 12
Verborgen: Ja
Actief : Nee

Er is geen volume aan deze partitie gekoppeld.

=========================================================
============================== MBR & Partition Table ==================

====================================================================
Disk: 0 (Size: 298 GB) (Disk ID: A7C79539)
Partition 1: (Not Active) - (Size=12 GB) - (Type=27)
Partition 2: (Active) - (Size=143 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=140 GB) - (Type=07 NTFS)
Partition 4: (Not Active) - (Size=4 GB) - (Type=12)
May 2nd, 2013, 07:19 AM
Obsession

Ok i just tought of something, this is probably really stupid.

I have my External 1 terrabyte drive detached, since chrome gave me the virus error.
The file that gave me the original virus is probably on there.

Though i always tought virusses root mainly on the c:drive where the operating system etc is.
Did i need to include it in the scan?

Apologies for the misunderstanding.
May 2nd, 2013, 07:55 PM
Broni
You did fine.
The file in question is on drive c:
C:\Windows\$NtUninstallKB5150$
But FRST doesn't see it as a rootkit.

http://dev.discussions.virtualdr.forums.relay.cool/ Create new restore point before proceeding with the next step....
How to:
- Windows 8: http://www.vikitech.com/11302/system-restore-windows-8
- Windows 7: http://www.howtogeek.com/howto/3195/...-in-windows-7/
- Vista: http://www.howtogeek.com/howto/windo...ystem-restore/
- XP: http://support.microsoft.com/kb/948247

http://dev.discussions.virtualdr.forums.relay.cool/ Please download ComboFix from Here, Here or Here to your Desktop.

**Note: In the event you already have Combofix, this is a new version that I need you to download. It is important that it is saved directly to your desktop**
- Never rename Combofix unless instructed.
- Close any open browsers.
- Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
- Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before performing a scan. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
- Click on this link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.
- Close any open browsers.
- WARNING: Combofix will disconnect your machine from the Internet as soon as it starts
- Please do not attempt to re-connect your machine back to the Internet until Combofix has completely finished.
- If there is no internet connection after running Combofix, then restart your computer to restore back your connection.
  If the connection is not there use restore point you created prior to running Combofix.
- Double click on combofix.exe & follow the prompts.
- NOTE1. If Combofix asks you to install Recovery Console, please allow it.
  NOTE 2. If Combofix asks you to update the program, always do so.
- When finished, it will produce a report for you.
- Please post the "C:\ComboFix.txt"
**Note 1: Do not mouseclick combofix's window while it's running. That may cause it to stall
**Note 2 for AVG and CA Internet Security (Total Defense Internet Security) users: ComboFix will not run until AVG/CA Internet Security is uninstalled as a protective measure against the anti-virus. This is because AVG/CA Internet Security "falsely" detects ComboFix (or its embedded files) as a threat and may remove them resulting in the tool not working correctly which in turn can cause "unpredictable results". Since AVG/CA Internet Security cannot be effectively disabled before running ComboFix, the author recommends you to uninstall AVG/CA Internet Security first.
Use AppRemover to uninstall it: http://www.appremover.com/
We can reinstall it when we're done with CF.
**Note 3: If you receive an error "Illegal operation attempted on a registery key that has been marked for deletion", restart computer to fix the issue.
**Note 4: Some infections may take some significant time to be cured. As long as your computer clock is running Combofix is still working. Be patient.

Make sure, you re-enable your security programs, when you're done with Combofix.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

NOTE.
If, for some reason, Combofix refuses to run, try the following...

Delete Combofix file, download fresh one, but rename combofix.exe to your_name.exe BEFORE saving it to your desktop.
Do NOT run it yet.
Download Rkill (courtesy of BleepingComputer.com) to your desktop.
There are 2 different versions. If one of them won't run then download and try to run the other one.
You only need to get one of these to run, not all of them. You may get warnings from your antivirus about this tool, ignore them or shutdown your antivirus.

rKill.exe: http://www.bleepingcomputer.com/download/rkill/dl/10/
iExplore.exe (renamed rKill.exe): http://www.bleepingcomputer.com/download/rkill/dl/11/

Restart computer in safe mode
- Double-click on the Rkill desktop icon to run the tool.
- If using Vista or Windows 7 right-click on it and choose Run As Administrator.
- A black DOS box will briefly flash and then disappear. This is normal and indicates the tool ran successfully.
- If not, delete the file, then download and use the one provided in Link 2.
- Do not reboot until instructed.
- If the tool does not run from any of the links provided, please let me know.
When the scan is done Notepad will open with rKill.txt log.
NOTE. rKill.txt log will also be present on your desktop.

Once you've gotten one of them to run, immediately run your_name.exe by double clicking on it.

IF you had to run rKill post BOTH logs, rKill.txt and Combofix.txt.
May 3rd, 2013, 05:33 AM
Obsession

Great, gonna start in a minute. Appremover only detected malware scanner and utorrent,

So im uninstalling AVG through windows, disable the malware scanner and im all set.
Il report back
May 3rd, 2013, 06:37 AM
Obsession

Ok combofix is alldone Log pasted below.

standing by..

ComboFix 13-05-01.03 - Meo 03-05-2013 11:51:41.1.2 - x86
Microsoft® Windows Vista™ Home Premium 6.0.6001.1.1252.31.1043.18.3293.2151 [GMT 2:00]
Gestart vanuit: c:\users\Meo\Desktop\ComboFix.exe
SP: Windows Defender *Enabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
(((((((((((((((((((((((((((((((((( Andere Verwijderingen )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\users\Meo\AppData\Local\assembly\tmp
c:\windows\system64
c:\windows\system64\msvcp100.dll
c:\windows\system64\msvcr100.dll
.
Besmet exemplaar van c:\windows\system32\Drivers\atapi.sys werd aangetroffen en gedesinfecteerd
Hersteld exemplaar van - c:\windows\System32\DriverStore\FileRepository\mshdc.inf_3d9c5057\atapi.sys
.
.
(((((((((((((((((((( Bestanden Gemaakt van 2013-04-03 to 2013-05-03 ))))))))))))))))))))))))))))))
.
.
2013-05-03 09:59 . 2013-05-03 09:59 -------- d-----w- c:\users\Default\AppData\Local\temp
2013-05-02 10:46 . 2013-05-02 10:46 -------- d-----w- C:\FRST
2013-05-01 09:54 . 2013-05-01 09:54 -------- d-----w- c:\windows\snack
2013-04-30 11:40 . 2013-04-30 11:40 -------- d-----w- c:\users\Meo\AppData\Roaming\Malwarebytes
2013-04-30 11:39 . 2013-04-30 11:39 -------- d-----w- c:\programdata\Malwarebytes
2013-04-30 11:39 . 2013-04-30 11:39 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2013-04-30 11:39 . 2013-04-04 12:50 22856 ----a-w- c:\windows\system32\drivers\mbam.sys
2013-04-29 12:18 . 2013-04-29 12:18 224256 ----a-w- c:\programdata\Microsoft\Media Tools\MediaIconsOverlays.dll
2013-04-29 12:18 . 2013-04-29 12:18 -------- d-----w- c:\program files\Mega Codec Pack
2013-04-11 00:12 . 2013-04-11 00:12 -------- d-----w- c:\users\Meo\AppData\Roaming\LibreOffice
2013-04-10 18:26 . 2013-04-10 18:36 -------- d-----w- c:\program files\LibreOffice 4.0
.
.
.
((((((((((((((((((((((((((((((((((((((( Find3M Rapport ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-05-01 09:57 . 2013-05-01 09:54 184320 ----a-w- c:\windows\system32\drivers\netbt.sys.dump
2013-03-26 21:43 . 2013-03-26 21:43 773968 ----a-w- c:\windows\system32\msvcr100.dll
2013-03-26 21:43 . 2013-03-26 21:43 421200 ----a-w- c:\windows\system32\msvcp100.dll
2013-03-13 16:59 . 2012-11-05 00:56 73432 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2013-03-13 16:59 . 2012-11-05 00:56 693976 ----a-w- c:\windows\system32\FlashPlayerApp.exe
2013-03-13 16:59 . 2013-03-13 16:59 16486616 ----a-w- c:\windows\system32\FlashPlayerInstaller.exe
2012-03-28 02:29 . 2012-03-28 02:29 0 ----a-w- c:\program files\GUTF7CD.tmp
2013-04-11 22:14 . 2013-04-11 22:14 263064 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll
2011-04-10 20:13 . 2013-04-11 22:14 119808 ----a-w- c:\program files\mozilla firefox\components\GoogleDesktopMozilla.dll
.
.
((((((((((((((((((((((((((((((((((((( Reg Opstartpunten )))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Nota* lege verwijzingen & legitieme standaard verwijzingen worden niet getoond
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\0MediaIconsOerlay]
@="{1EC23CFF-4C58-458f-924C-8519AEF61B32}"
[HKEY_CLASSES_ROOT\CLSID\{1EC23CFF-4C58-458f-924C-8519AEF61B32}]
2013-04-29 12:18 224256 ----a-w- c:\programdata\Microsoft\Media Tools\MediaIconsOverlays.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\egisPSDP]
@="{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}"
[HKEY_CLASSES_ROOT\CLSID\{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}]
2008-07-29 16:52 121392 ----a-w- c:\program files\Acer\Empowering Technology\eDataSecurity\x86\PSDProtect.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"WindowsWelcomeCenter"="oobefldr.dll" [2008-01-21 2153472]
"ProductReg"="c:\program files\Acer\WR_PopUp\ProductReg.exe" [2008-11-17 135168]
"uTorrent"="c:\program files\uTorrent\uTorrent.exe" [2011-04-10 224000]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2011-04-10 68856]
"ooVoo.exe"="c:\program files\ooVoo\oovoo.exe" [2011-12-12 22459984]
"Skype"="c:\program files\Skype\Phone\Skype.exe" [2011-10-13 17351304]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RtHDVCpl"="RtHDVCpl.exe" [2008-09-18 6294048]
"Google Desktop Search"="c:\program files\Google\Google Desktop Search\GoogleDesktop.exe" [2011-04-10 30192]
"ePower_DMC"="c:\program files\Acer\Empowering Technology\ePower\ePower_DMC.exe" [2008-11-28 417792]
"eDataSecurity Loader"="c:\program files\Acer\Empowering Technology\eDataSecurity\x86\eDSloader.exe" [2008-07-29 526896]
"eAudio"="c:\program files\Acer\Empowering Technology\eAudio\eAudio.exe" [2008-09-11 544768]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2008-06-12 34672]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2008-08-29 61440]
"Skytel"="Skytel.exe" [2008-09-18 1833504]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2008-04-25 1049896]
"PLFSetI"="c:\windows\PLFSetI.exe" [2008-06-30 200704]
"LManager"="c:\progra~1\LAUNCH~1\QtZgAcer.EXE" [2008-06-17 817672]
"ArcadeDeluxeAgent"="c:\program files\Acer Arcade Deluxe\Acer Arcade Deluxe\ArcadeDeluxeAgent.exe" [2008-10-08 147456]
"CLMLServer"="c:\program files\Acer Arcade Deluxe\Acer Arcade Deluxe\Kernel\CLML\CLMLSvc.exe" [2008-10-08 167936]
"PlayMovie"="c:\program files\Acer Arcade Deluxe\PlayMovie\PMVService.exe" [2008-10-17 167936]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-05-14 248552]
"DivXUpdate"="c:\program files\DivX\DivX Update\DivXUpdate.exe" [2011-03-21 1230704]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"AvgUninstallURL"="start http://www.avg.com/nl.special-uninstallation-feedback-appf?lic=NFUyWUMtOTRNQVEtUjRRVkctQUFBQzMtVFVKUVMtS1FPQ1g&inst=NzctMTEyNzMwOTMxOC1GSSsxLUZMMTArMS1ERFQrMC1UVUcrMy1MU0QrMi1TVDEwRkFQUCsxLUYxMFRCKzItU1QxMFRCRisxLUYxME0xMlIrMS1WSVAxMisxLVRMKzEtRjEwTTEyUjIrMQ&prod=90&ver=10.0.1415" [?]
.
c:\users\Meo\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
OneNote 2007 Schermopname en Snel starten.lnk - c:\program files\Microsoft Office\Office12\ONENOTEM.EXE [2007-8-24 101784]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux1"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]
@=""
.
--- Andere Services/Drivers In Geheugen ---
.
*NewlyCreated* - WS2IFSL
.
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]
2013-04-11 17:03 1642448 ----a-w- c:\program files\Google\Chrome\Application\26.0.1410.64\Installer\chrmstp.exe
.
Inhoud van de 'Gedeelde Taken' map
.
2013-05-03 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-11-05 16:59]
.
2013-05-03 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2011-04-11 01:48]
.
2013-05-03 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2011-04-11 01:48]
.
2013-05-03 c:\windows\Tasks\WpsUpdateTask_Meo.job
- c:\program files\Kingsoft\Kingsoft Writer\office6\wpsupdate.exe [2011-10-29 16:00]
.
.
------- Bijkomende Scan -------
.
uStart Page = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0413&s=2&o=vp32&d=0411&m=aspire_6530g
mStart Page = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0413&s=2&o=vp32&d=0411&m=aspire_6530g
uSearchURL,(Default) = hxxp://www.google.com/search/?q=%s
IE: E&xporteren naar Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
TCP: DhcpNameServer = 192.168.1.254
FF - ProfilePath - c:\users\Meo\AppData\Roaming\Mozilla\Firefox\Profiles\8ehtkf2i.default\
FF - prefs.js: browser.search.selectedEngine - AVG Secure Search
FF - prefs.js: keyword.URL - hxxp://isearch.avg.com/search?cid=%7B6279e5e4-e15c-4282-bc8b-e004207d62be%7D&mid=db4477f097ef47d1976bd16acd100928-bae3ed9ff537164695a82ca2a0aa4b5d0ae193fa&ds=AVG&v=10.2.0.3&lang=nl&pr=pa&d=2011-12-16%2013%3A13%3A03&sap=ku&q=
FF - ExtSQL: !HIDDEN! 2011-04-12 03:05; {20a82645-c095-46ed-80e3-08825760534b}; c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
.
- - - - ORPHANS VERWIJDERD - - - -
.
URLSearchHooks-{A3BC75A2-1F87-4686-AA43-5347D756017C} - (no file)
Toolbar-{CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file)
WebBrowser-{CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file)
HKLM-Run-eRecoveryService - (no file)
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2013-05-03 12:03
Windows 6.0.6001 Service Pack 1 NTFS
.
scannen van verborgen processen ...
.
scannen van verborgen autostart items ...
.
scannen van verborgen bestanden ...
.
Scan succesvol afgerond
verborgen bestanden: 0
.
**************************************************************************
.
--------------------- VERGRENDELDE REGISTER SLEUTELS ---------------------
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil32_11_6_602_180_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil32_11_6_602_180_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
"MSCurrentCountry"=dword:000000b5
.
--------------------- DLLs Geladen Onder Lopende Processen ---------------------
.
- - - - - - - > 'Explorer.exe'(5416)
c:\program files\Acer\Empowering Technology\eDataSecurity\x86\PSDProtect.dll
c:\program files\Acer\Empowering Technology\eDataSecurity\x86\sysenv.dll
c:\windows\System32\SysHook.dll
.
------------------------ Andere Aktieve Processen ------------------------
.
c:\windows\system32\Ati2evxx.exe
c:\windows\system32\Ati2evxx.exe
c:\windows\system32\agrsmsvc.exe
c:\program files\Acer Arcade Deluxe\HomeMedia\Kernel\DMP\CLHNService.exe
c:\program files\Acer\Empowering Technology\eDataSecurity\x86\eDSService.exe
c:\program files\Acer\Empowering Technology\Service\ETService.exe
c:\program files\Malwarebytes' Anti-Malware\mbamscheduler.exe
c:\program files\McAfee\SiteAdvisor\McSACore.exe
c:\acer\Mobility Center\MobilityService.exe
c:\windows\system32\rundll32.exe
c:\program files\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe
c:\program files\Cyberlink\Shared files\RichVideo.exe
c:\program files\Microsoft Application Virtualization Client\sftvsa.exe
c:\program files\Microsoft Application Virtualization Client\sftlist.exe
c:\windows\system32\conime.exe
c:\windows\RtHDVCpl.exe
c:\program files\Launch Manager\QtZgAcer.EXE
c:\program files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
c:\program files\Acer\WR_PopUp\AcerRegTool.exe
c:\windows\system32\wbem\unsecapp.exe
c:\program files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
c:\program files\Synaptics\SynTP\SynTPHelper.exe
c:\\?\c:\windows\system32\wbem\WMIADAP.EXE
c:\windows\servicing\TrustedInstaller.exe
.
**************************************************************************
.
Voltooingstijd: 2013-05-03 12:08:25 - machine werd herstart
ComboFix-quarantined-files.txt 2013-05-03 10:08
.
Pre-Run: 9261522944 bytes beschikbaar
Post-Run: 10430545920 bytes beschikbaar
.
- - End Of File - - 6F9D6CC5AE9AF7B960BDCA60D6504B7F

Show 40 post(s) from this thread on one page