1. Computer problem? Tech Support Guy is completely free -- paid for by advertisers and donations. Click here to join today! If you're new to Tech Support Guy, we highly recommend that you visit our Guide for New Members.

"Bad Image" error in Vista x64

Discussion in 'Virus & Other Malware Removal' started by doctordoctor, Mar 10, 2012.

Thread Status:
Not open for further replies.
Advertisement
  1. doctordoctor

    doctordoctor Thread Starter

    Joined:
    Mar 10, 2012
    Messages:
    3
    I am baffled by this.

    When I try to open a variety of programs, I get an error saying "C:\Program Files\Adobe\Adobe Media Encoder\CS5\ASLMessaging.dll is either not designed to run on Windows or it contains an error. Try installing etc etc etc"

    I have run virus scans and malwarebytes but nothing has come up. But it's DEFINITELY running slower and I'm getting more errors than I used to.

    Here is my hijackthis log:

    Logfile of Trend Micro HijackThis v2.0.4
    Scan saved at 3:55:51 AM, on 3/10/2012
    Platform: Windows Vista SP2 (WinNT 6.00.1906)
    MSIE: Internet Explorer v8.00 (8.00.6001.19048)
    Boot mode: Normal

    Running processes:
    C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAAnotif.exe
    C:\Program Files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe
    C:\Program Files (x86)\Google\Gmail Notifier\gnotify.exe
    C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe
    C:\Users\Ben\AppData\Roaming\Dropbox\bin\Dropbox.exe
    C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe
    C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
    C:\Program Files (x86)\Hewlett-Packard\KBD\kbd.exe
    C:\Program Files (x86)\Mozilla Firefox\firefox.exe
    C:\Program Files (x86)\Sophos\Sophos Anti-Rootkit\sargui.exe
    C:\Program Files (x86)\TweetDeck\TweetDeck.exe
    C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe
    C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe
    C:\Users\Ben\AppData\Local\Google\Google Talk Plugin\googletalkplugin.exe
    C:\Users\Ben\AppData\Local\Temp\bzllbt.exe
    C:\Users\Ben\Downloads\HijackThis(1).exe
    C:\Windows\SysWOW64\NOTEPAD.EXE
    C:\Windows\SysWOW64\NOTEPAD.EXE
    C:\Windows\SysWOW64\NOTEPAD.EXE

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TY...vilion&pf=cndt
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TY...vilion&pf=cndt
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?TY...vilion&pf=cndt
    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
    O1 - Hosts: ::1 localhost
    O1 - Hosts: ::1 localhost
    O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
    O2 - BHO: Babylon toolbar helper - {2EECD738-5844-4a99-B4B6-146BF802613B} - C:\Program Files (x86)\BabylonToolbar\BabylonToolbar\1.5.3.17\bh\BabylonToolbar.dll
    O2 - BHO: Increase performance and video formats for your HTML5 <video> - {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Program Files (x86)\DivX\DivX Plus Web Player\ie\DivXHTML5\DivXHTML5.dll
    O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~2\MICROS~3\Office12\GRA8E1~1.DLL
    O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre6\bin\ssv.dll
    O2 - BHO: avast! WebRep - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\Alwil Software\Avast5\aswWebRepIE.dll (file missing)
    O2 - BHO: (no name) - {9D425283-D487-4337-BAB6-AB8354A81457} - (no file)
    O2 - BHO: (no name) - {9D717F81-9148-4f12-8568-69135F087DB0} - (no file)
    O2 - BHO: SkypeIEPluginBHO - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
    O2 - BHO: Microsoft Live Search Toolbar Helper - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - c:\Program Files (x86)\MSN\Toolbar\3.0.0541.0\msneshellx.dll
    O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll
    O3 - Toolbar: Microsoft Live Search Toolbar - {1E61ED7C-7CB8-49d6-B9E9-AB4C880C8414} - c:\Program Files (x86)\MSN\Toolbar\3.0.0541.0\msneshellx.dll
    O3 - Toolbar: avast! WebRep - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\Alwil Software\Avast5\aswWebRepIE.dll (file missing)
    O3 - Toolbar: Babylon Toolbar - {98889811-442D-49dd-99D7-DC866BE87DBC} - C:\Program Files (x86)\BabylonToolbar\BabylonToolbar\1.5.3.17\BabylonToolbarTlbr.dll
    O4 - HKLM\..\Run: [KBD] C:\Program Files (x86)\Hewlett-Packard\KBD\KbdStub.EXE
    O4 - HKLM\..\Run: [{0228e555-4f9c-4e35-a3ec-b109a192b4c2}] "C:\Program Files (x86)\Google\Gmail Notifier\gnotify.exe"
    O4 - HKLM\..\Run: [APSDaemon] "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe"
    O4 - HKLM\..\Run: [DivXUpdate] "C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe" /CHECKNOW
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
    O4 - HKCU\..\Run: [Google Update] "C:\Users\Ben\AppData\Local\Google\Update\GoogleUpdate.exe" /c
    O4 - HKCU\..\Run: [ApplePhotoStreams] C:\Program Files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe
    O4 - HKUS\S-1-5-21-2765256803-2373232923-3968329771-1001\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'UpdatusUser')
    O4 - HKUS\S-1-5-21-2765256803-2373232923-3968329771-1001\..\Run: [HPADVISOR] C:\Program Files (x86)\Hewlett-Packard\HP Advisor\HPAdvisor.exe autorun=AUTORUN (User 'UpdatusUser')
    O4 - Startup: Dropbox.lnk = Ben\AppData\Roaming\Dropbox\bin\Dropbox.exe
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~2\MICROS~3\Office12\EXCEL.EXE/3000
    O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~3\Office12\ONBttnIE.dll
    O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~3\Office12\ONBttnIE.dll
    O9 - Extra button: Run WinHTTrack - {36ECAF82-3300-8F84-092E-AFF36D6C7040} - C:\Program Files\WinHTTrack\WinHTTrackIEBar.dll
    O9 - Extra 'Tools' menuitem: Launch WinHTTrack - {36ECAF82-3300-8F84-092E-AFF36D6C7040} - C:\Program Files\WinHTTrack\WinHTTrackIEBar.dll
    O9 - Extra button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
    O9 - Extra 'Tools' menuitem: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~2\MICROS~3\Office12\REFIEBAR.DLL
    O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files (x86)\AIM\aim.exe
    O15 - Trusted Zone: http://www.medialauncher.com
    O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~2\MICROS~3\Office12\GR99D3~1.DLL
    O18 - Protocol: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
    O20 - AppInit_DLLs: C:\PROGRA~2\WI9130~1\Datamngr\datamngr.dll
    O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\Windows\system32\browseui.dll
    O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)
    O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
    O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
    O23 - Service: @dfsrres.dll,-101 (DFSR) - Unknown owner - C:\Windows\system32\DFSR.exe (file missing)
    O23 - Service: FlowFinder3MonstersAE64 - Unknown owner - C:\Program Files\GenArts\Monsters-AE64\bin\FlowFinder3MonstersAE64.exe
    O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
    O23 - Service: Google Update Service (gupdatem) (gupdatem) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
    O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAANTMon.exe
    O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: JawsServerAE64 - Unknown owner - C:\Program Files (x86)\GenArts\Monsters-AE64\bin\JawsServerAE64.exe
    O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
    O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - c:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe
    O23 - Service: LMIGuardianSvc - LogMeIn, Inc. - C:\Program Files (x86)\LogMeIn\x64\LMIGuardianSvc.exe
    O23 - Service: LogMeIn Maintenance Service (LMIMaint) - LogMeIn, Inc. - C:\Program Files (x86)\LogMeIn\x64\RaMaint.exe
    O23 - Service: LogMeIn - LogMeIn, Inc. - C:\Program Files (x86)\LogMeIn\x64\LogMeIn.exe
    O23 - Service: Mediafour M4LIC service (M4LIC) - Mediafour Corporation - C:\Program Files (x86)\Common Files\Mediafour\M4LIC.EXE
    O23 - Service: MacDrive 8 service (MacDrive8Service) - Mediafour Corporation - C:\Program Files\Mediafour\MacDrive 8\MacDrive8Service.exe
    O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)
    O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
    O23 - Service: NVIDIA Display Driver Service (nvsvc) - Unknown owner - C:\Windows\system32\nvvsvc.exe (file missing)
    O23 - Service: NVIDIA Update Service Daemon (nvUpdatusService) - NVIDIA Corporation - C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe
    O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
    O23 - Service: RLM-GenArts - Reprise Software Inc. - C:\Program Files (x86)\GenArts\rlm\rlm.exe
    O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies, Inc. - C:\Program Files (x86)\WinPcap\rpcapd.exe
    O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)
    O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
    O23 - Service: Contour Shuttle Device Engine (ShuttleEngine) - Contour Design, Inc. - C:\Program Files (x86)\Contour Shuttle\ShuttleEngine.exe
    O23 - Service: @%SystemRoot%\system32\SLsvc.exe,-101 (slsvc) - Unknown owner - C:\Windows\system32\SLsvc.exe (file missing)
    O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)
    O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)
    O23 - Service: NVIDIA Stereoscopic 3D Driver Service (Stereo Service) - NVIDIA Corporation - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
    O23 - Service: Adobe SwitchBoard (SwitchBoard) - Adobe Systems Incorporated - C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe
    O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)
    O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
    O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)
    O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)
    O23 - Service: @%ProgramFiles%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)

    --
    End of file - 12095 bytes


    Here is my Combofix log:
    ComboFix 12-03-10.01 - Ben 03/10/2012 4:40.1.4 - x64
    Microsoft® Windows Vista&#8482; Home Premium 6.0.6002.2.1252.1.1033.18.8190.5751 [GMT -5:00]
    Running from: c:\users\Ben\Downloads\ComboFix.exe
    AV: Microsoft Security Essentials *Disabled/Updated* {108DAC43-C256-20B7-BB05-914135DA5160}
    SP: Microsoft Security Essentials *Disabled/Updated* {ABEC4DA7-E46C-2F39-81B5-AA334E5D1BDD}
    SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
    * Created a new restore point
    .
    .
    ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    C:\install.exe
    c:\program files (x86)\Windows Searchqu Toolbar
    c:\program files (x86)\Windows Searchqu Toolbar\Datamngr\datamngr.dll
    c:\program files (x86)\Windows Searchqu Toolbar\Datamngr\x64\BrowserConnection.dll
    c:\users\Ben\AppData\Roaming\cacaoweb
    c:\users\Ben\AppData\Roaming\cacaoweb\npdfile.dat
    c:\users\Ben\AppData\Roaming\cacaoweb\replicating02C4D22FD83FFA967B5489FB60B35C6E.cacao
    c:\users\Ben\AppData\Roaming\cacaoweb\replicating0F59C0D5BFE4C7161C0C66590E1F62F7.cacao
    c:\users\Ben\AppData\Roaming\cacaoweb\replicating111E9FCAD5FD4E4D9A61A0FD021D6752.cacao
    c:\users\Ben\AppData\Roaming\cacaoweb\replicating1726A3F352269D95AD60662C017F28BF.cacao
    c:\users\Ben\AppData\Roaming\cacaoweb\replicating1C24912029428FF640CF0C23F4E22C21.cacao
    c:\users\Ben\AppData\Roaming\cacaoweb\replicating29D9B2182991535C562FC6CE68D94E5D.cacao
    c:\users\Ben\AppData\Roaming\cacaoweb\replicating37809368A66065D50D8049072A20764F.cacao
    c:\users\Ben\AppData\Roaming\cacaoweb\replicating39F1ED64B92B24C47B80EF4E04E599FC.cacao
    c:\users\Ben\AppData\Roaming\cacaoweb\replicating3A7013F42C33099A44B86E16E0D70D9F.cacao
    c:\users\Ben\AppData\Roaming\cacaoweb\replicating3BF2268A5C84C0B08E3E10FD77DB6BA2.cacao
    c:\users\Ben\AppData\Roaming\cacaoweb\replicating3C04426093885B41E52986D8FD1992BF.cacao
    c:\users\Ben\AppData\Roaming\cacaoweb\replicating3D106BAE125A63C17C871A0932D629CB.cacao
    c:\users\Ben\AppData\Roaming\cacaoweb\replicating4E0356869A18B3ABB555015C12F106C8.cacao
    c:\users\Ben\AppData\Roaming\cacaoweb\replicating572E9C83A5C2110C4BF546B725BEF90E.cacao
    c:\users\Ben\AppData\Roaming\cacaoweb\replicating68CB7823EDEB68F008FACF2996479493.cacao
    c:\users\Ben\AppData\Roaming\cacaoweb\replicating8D576029C0F949FDF41E4CA0C361A0E3.cacao
    c:\users\Ben\AppData\Roaming\cacaoweb\replicating8D9D8B893E406241CF1B5C8329F299F4.cacao
    c:\users\Ben\AppData\Roaming\cacaoweb\replicating9523219FF891BD1E066759B6E0F054DF.cacao
    c:\users\Ben\AppData\Roaming\cacaoweb\replicatingAED806900D90AE01207C7AD44936377D.cacao
    c:\users\Ben\AppData\Roaming\cacaoweb\replicatingBB4D579C9969593D084AFD1BE0E97273.cacao
    c:\users\Ben\AppData\Roaming\cacaoweb\replicatingC1D08037E603F55C80EB2C9AC5B21E88.cacao
    c:\users\Ben\AppData\Roaming\cacaoweb\replicatingD90F63CB15EF1F66B68FC4F2A12DC041.cacao
    c:\users\Ben\AppData\Roaming\cacaoweb\replicatingDB06B8AE074A76EA5B78B42D6CEAAC63.cacao
    c:\users\Ben\AppData\Roaming\cacaoweb\replicatingDF21E995C34EAE0AFEDAF2F3540CEEB6.cacao
    c:\users\Ben\AppData\Roaming\cacaoweb\replicatingEA2A654C5013DD312442CA473B616441.cacao
    c:\users\Ben\AppData\Roaming\cacaoweb\replicatingED243D9C0BEE83495D3DE8DE8E56BA8E.cacao
    c:\users\Ben\AppData\Roaming\cacaoweb\replicatingED4DDAD402BC66F3E7943A9E805E38D9.cacao
    c:\users\Ben\AppData\Roaming\cacaoweb\storage.db
    c:\users\Ben\AppData\Roaming\Mozilla\Firefox\Profiles\etzyi3rl.default\searchplugins\bing-zugo.xml
    c:\users\Ben\g2mdlhlpx.exe
    .
    .
    ((((((((((((((((((((((((( Files Created from 2012-02-10 to 2012-03-10 )))))))))))))))))))))))))))))))
    .
    .
    2020-04-01 05:18 . 2020-04-01 05:18 -------- d-----w- c:\programdata\eSellerate
    2020-04-01 05:18 . 2020-04-01 05:18 -------- d-----w- c:\program files (x86)\Common Files\eSellerate
    2012-03-10 09:48 . 2012-03-10 09:55 -------- d-----w- c:\users\Ben\AppData\Local\temp
    2012-03-10 09:48 . 2012-03-10 09:48 -------- d-----w- c:\users\UpdatusUser\AppData\Local\temp
    2012-03-10 09:48 . 2012-03-10 09:48 -------- d-----w- c:\users\UpdatusUser.Ben-Reformat\AppData\Local\temp
    2012-03-10 09:48 . 2012-03-10 09:48 -------- d-----w- c:\users\Default\AppData\Local\temp
    2012-03-10 09:04 . 2012-03-10 09:04 35712 ----a-w- c:\windows\SysWow64\drivers\BlackBox.sys
    2012-03-10 08:54 . 2012-03-10 08:54 -------- d-----w- c:\users\Ben\AppData\Roaming\Wireshark
    2012-03-10 08:49 . 2012-03-10 08:49 -------- d-----w- c:\program files (x86)\WinPcap
    2012-03-10 08:49 . 2012-03-10 08:49 -------- d-----w- c:\program files\Wireshark
    2012-03-10 08:46 . 2011-05-12 19:03 6144 ------w- c:\windows\system32\CF3.tmp
    2012-03-10 08:45 . 2011-05-12 19:03 6144 ------w- c:\windows\system32\E1FC.tmp
    2012-03-10 08:45 . 2012-03-10 08:45 -------- d-----w- c:\program files (x86)\Sophos
    2012-03-10 02:44 . 2012-03-10 02:44 927800 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{C3F2A2FE-F592-410E-AAAD-EAE180DFB1F6}\gapaengine.dll
    2012-03-10 02:44 . 2012-02-08 04:14 8643640 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{38F3E9E9-8133-4383-A88B-59D3C85517AC}\mpengine.dll
    2012-03-10 02:10 . 2012-03-10 02:10 -------- d-----w- c:\program files (x86)\Microsoft Security Client
    2012-03-10 02:09 . 2012-03-10 02:10 -------- d-----w- c:\program files\Microsoft Security Client
    2012-03-10 02:08 . 2010-04-06 08:34 345984 ----a-w- c:\windows\system32\drivers\netio.sys
    2012-03-10 01:17 . 2012-02-08 07:13 8643640 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{1CC71278-DBF6-4984-A2FF-7C5C7A92A310}\mpengine.dll
    2012-03-10 00:25 . 2012-03-10 00:25 -------- d-----w- c:\users\Ben\AppData\Roaming\DisplayFusion
    2012-03-05 21:50 . 2012-03-10 01:26 -------- d-----w- c:\program files (x86)\DisplayFusion
    2012-02-22 03:13 . 2012-03-01 20:16 -------- d-----w- c:\program files (x86)\Common Files\Spigot
    2012-02-22 03:13 . 2012-02-22 03:13 -------- d-----w- c:\users\Ben\AppData\Roaming\pdfforge
    2012-02-22 03:13 . 2004-03-09 06:00 662288 ----a-w- c:\windows\SysWow64\MSCOMCT2.OCX
    2012-02-22 03:13 . 1998-06-24 06:00 137000 ----a-w- c:\windows\SysWow64\MSMAPI32.OCX
    2012-02-22 03:13 . 2005-03-12 06:07 87040 ----a-w- c:\windows\system32\pdfcmnnt.dll
    2012-02-22 03:13 . 1998-07-06 06:00 23552 ----a-w- c:\windows\SysWow64\MSMPIDE.DLL
    2012-02-22 03:13 . 2012-02-22 03:14 -------- d-----w- c:\program files (x86)\PDFCreator
    .
    .
    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2012-03-01 11:50 . 2011-02-16 17:37 472808 ----a-w- c:\windows\SysWow64\deployJava1.dll
    2012-02-29 01:00 . 2011-06-30 07:00 414368 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
    2012-02-06 23:56 . 2011-02-25 02:01 87456 ----a-w- c:\windows\system32\LMIRfsClientNP.dll
    2012-02-06 23:56 . 2011-02-25 02:01 34688 ----a-w- c:\windows\system32\LMIport.dll
    2012-02-06 23:56 . 2011-02-25 02:01 80768 ----a-w- c:\windows\system32\LMIinit.dll
    2012-02-01 04:20 . 2011-07-16 19:29 323584 ----a-w- c:\windows\SysWow64\AUDIOGENIE2.DLL
    2012-01-31 12:44 . 2011-02-16 08:13 279656 ------w- c:\windows\system32\MpSigStub.exe
    2012-01-20 21:25 . 2012-01-20 21:25 57344 ----a-r- c:\users\Ben\AppData\Roaming\Microsoft\Installer\{8FE3E922-C58B-4E18-A923-FC85530C23C5}\NewShortcut7_B56E5B51EA954C948003CC703E2AFAD5.exe
    2012-01-20 21:25 . 2012-01-20 21:25 57344 ----a-r- c:\users\Ben\AppData\Roaming\Microsoft\Installer\{8FE3E922-C58B-4E18-A923-FC85530C23C5}\NewShortcut1_B56E5B51EA954C948003CC703E2AFAD5.exe
    2012-01-04 20:55 . 2010-12-20 19:23 22737920 ----a-w- c:\windows\system32\BCC7_AE_8Bit.dll
    2012-01-04 20:55 . 2010-12-20 19:14 22771200 ----a-w- c:\windows\system32\BCC7_AE_16Bit.dll
    2012-01-04 20:54 . 2010-12-21 20:07 10463744 ----a-w- c:\windows\system32\BCC7_3DObjects_AE.dll
    2012-01-04 00:48 . 2012-01-04 00:48 354176 ----a-w- c:\windows\SysWow64\DivXControlPanelApplet.cpl
    2011-12-18 05:39 . 2011-02-25 02:01 87456 ----a-w- c:\windows\system32\LMIRfsClientNP.dll.000.bak
    2009-03-30 15:22 . 2009-03-30 15:22 61440 ----a-w- c:\program files (x86)\RGSGrowBounds.aex
    2006-05-03 17:06 163328 --sha-r- c:\windows\SysWOW64\flvDX.dll
    2007-02-21 18:47 31232 --sha-r- c:\windows\SysWOW64\msfDX.dll
    2008-03-16 20:30 216064 --sha-r- c:\windows\SysWOW64\nbDX.dll
    2010-01-07 05:00 107520 --sha-r- c:\windows\SysWOW64\TAKDSDecoder.dll
    .
    .
    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4
    .
    [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
    @="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
    [HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
    2010-10-06 23:36 94208 ----a-w- c:\users\Ben\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll
    .
    [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
    @="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
    [HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
    2010-10-06 23:36 94208 ----a-w- c:\users\Ben\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll
    .
    [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
    @="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
    [HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
    2010-10-06 23:36 94208 ----a-w- c:\users\Ben\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll
    .
    [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt4]
    @="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}"
    [HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}]
    2010-10-06 23:36 94208 ----a-w- c:\users\Ben\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll
    .
    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "ApplePhotoStreams"="c:\program files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe" [2011-11-11 59240]
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
    "KBD"="c:\program files (x86)\Hewlett-Packard\KBD\KbdStub.EXE" [2008-07-21 12288]
    "{0228e555-4f9c-4e35-a3ec-b109a192b4c2}"="c:\program files (x86)\Google\Gmail Notifier\gnotify.exe" [2005-07-15 479232]
    "APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2011-11-02 59240]
    "DivXUpdate"="c:\program files (x86)\DivX\DivX Update\DivXUpdate.exe" [2011-07-28 1259376]
    "SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2012-01-18 254696]
    .
    c:\users\Ben\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
    Dropbox.lnk - c:\users\Ben\AppData\Roaming\Dropbox\bin\Dropbox.exe [2012-2-14 24246216]
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
    "EnableLUA"= 0 (0x0)
    "EnableUIADesktopToggle"= 0 (0x0)
    .
    [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]
    "aux4"=wdmaud.drv
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
    @="Service"
    .
    --- Other Services/Drivers In Memory ---
    .
    *NewlyCreated* - WS2IFSL
    .
    Contents of the 'Scheduled Tasks' folder
    .
    2012-03-10 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
    - c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-02-16 07:14]
    .
    2012-03-10 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
    - c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-02-16 07:14]
    .
    2012-03-09 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2765256803-2373232923-3968329771-1000Core.job
    - c:\users\Ben\AppData\Local\Google\Update\GoogleUpdate.exe [2011-07-01 05:24]
    .
    2012-03-10 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2765256803-2373232923-3968329771-1000UA.job
    - c:\users\Ben\AppData\Local\Google\Update\GoogleUpdate.exe [2011-07-01 05:24]
    .
    2012-02-13 c:\windows\Tasks\PCDRScheduledMaintenance.job
    - c:\program files\PC-Doctor for Windows\pcdr5cuiw32.exe [2008-09-10 16:43]
    .
    .
    --------- x86-64 -----------
    .
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
    @="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
    [HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
    2010-10-06 23:36 97792 ----a-w- c:\users\Ben\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
    @="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
    [HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
    2010-10-06 23:36 97792 ----a-w- c:\users\Ben\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
    @="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
    [HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
    2010-10-06 23:36 97792 ----a-w- c:\users\Ben\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt4]
    @="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}"
    [HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}]
    2010-10-06 23:36 97792 ----a-w- c:\users\Ben\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "IAAnotif"="c:\program files (x86)\Intel\Intel Matrix Storage Manager\iaanotif.exe" [2008-10-06 182808]
    "LogMeIn GUI"="c:\program files (x86)\LogMeIn\x64\LogMeInSystray.exe" [2010-09-17 57928]
    "MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2011-06-15 1436736]
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
    "LoadAppInit_DLLs"=0x1
    .
    ------- Supplementary Scan -------
    .
    uStart Page = about:blank
    uLocal Page = c:\windows\system32\blank.htm
    mStart Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=en_us&c=91&bd=Pavilion&pf=cndt
    mLocal Page = c:\windows\SysWOW64\blank.htm
    IE: E&xport to Microsoft Excel - c:\progra~2\MICROS~3\Office12\EXCEL.EXE/3000
    Trusted Zone: medialauncher.com\www
    TCP: DhcpNameServer = 192.168.1.1
    CLSID: {603d3801-bd81-11d0-a3a5-00c04fd706ec} - %SystemRoot%\SysWow64\browseui.dll
    FF - ProfilePath - c:\users\Ben\AppData\Roaming\Mozilla\Firefox\Profiles\etzyi3rl.default\
    FF - prefs.js: browser.search.selectedEngine - Google
    FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/firefox
    FF - prefs.js: keyword.URL - www.google.com
    FF - user.js: extensions.BabylonToolbar_i.babTrack - affID=101641
    FF - user.js: extensions.BabylonToolbar_i.babExt -
    FF - user.js: extensions.BabylonToolbar_i.srcExt - ss
    FF - user.js: extensions.BabylonToolbar_i.id - 9a21ceea0000000000000021008720ba
    FF - user.js: extensions.BabylonToolbar_i.hardId - 9a21ceea0000000000000021008720ba
    FF - user.js: extensions.BabylonToolbar_i.instlDay - 15363
    FF - user.js: extensions.BabylonToolbar_i.vrsn - 1.5.3.17
    FF - user.js: extensions.BabylonToolbar_i.vrsni - 1.5.3.17
    FF - user.js: extensions.BabylonToolbar_i.vrsnTs - 1.5.3.171:11
    FF - user.js: extensions.BabylonToolbar_i.prtnrId - babylon
    FF - user.js: extensions.BabylonToolbar_i.prdct - BabylonToolbar
    FF - user.js: extensions.BabylonToolbar_i.aflt - babsst
    FF - user.js: extensions.BabylonToolbar_i.smplGrp - none
    FF - user.js: extensions.BabylonToolbar_i.tlbrId - base
    FF - user.js: extensions.BabylonToolbar_i.instlRef - sst
    .
    - - - - ORPHANS REMOVED - - - -
    .
    Toolbar-10 - (no file)
    Wow6432Node-HKCU-Run-AdobeBridge - (no file)
    BHO-{9D717F81-9148-4f12-8568-69135F087DB0} - c:\progra~2\WI9130~1\Datamngr\x64\BROWSE~1.DLL
    Toolbar-10 - (no file)
    ShellIconOverlayIdentifiers-{472083B0-C522-11CF-8763-00608CC02F24} - (no file)
    ShellIconOverlayIdentifiers-MacDrive volume icons - (no file)
    HKLM-Run-Windows Defender - c:\program files (x86)\Windows Defender\MSASCui.exe
    .
    .
    .
    [HKEY_LOCAL_MACHINE\system\ControlSet001\Services\PCD5SRVC{8AAF211B-043E02A9-05040000}]
    "ImagePath"="\??\c:\progra~1\PC-DOC~1\PCD5SRVC_x64.pkms"
    .
    --------------------- LOCKED REGISTRY KEYS ---------------------
    .
    [HKEY_USERS\S-1-5-21-2765256803-2373232923-3968329771-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.*1*-*ÔD´?\OpenWithList]
    @Class="Shell"
    "a"="vlc.exe"
    "MRUList"="a"
    .
    [HKEY_USERS\S-1-5-21-2765256803-2373232923-3968329771-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.*F*u*-*Y&#8211;é3\OpenWithList]
    @Class="Shell"
    "a"="vlc.exe"
    "MRUList"="a"
    .
    [HKEY_USERS\S-1-5-21-2765256803-2373232923-3968329771-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.*V*O*B*&#732;
    ÐH\OpenWithList]
    @Class="Shell"
    "a"="vlc.exe"
    "MRUList"="a"
    .
    [HKEY_USERS\S-1-5-21-2765256803-2373232923-3968329771-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.*v*o*K0Í?\OpenWithList]
    @Class="Shell"
    "a"="vlc.exe"
    "MRUList"="a"
    .
    [HKEY_USERS\S-1-5-21-2765256803-2373232923-3968329771-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.*v*o*&#8212;7Í?\OpenWithList]
    @Class="Shell"
    "a"="vlc.exe"
    "MRUList"="a"
    .
    [HKEY_USERS\S-1-5-21-2765256803-2373232923-3968329771-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.*v*Y&#8211;é3]
    @Class="Shell"
    @Allowed: (Read) (RestrictedCode)
    .
    [HKEY_USERS\S-1-5-21-2765256803-2373232923-3968329771-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.*v*Y&#8211;é3\OpenWithList]
    @Class="Shell"
    "a"="vlc.exe"
    "MRUList"="a"
    .
    [HKEY_USERS\S-1-5-21-2765256803-2373232923-3968329771-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.*v*&#8230;¸&#8224;o]
    @Class="Shell"
    @Allowed: (Read) (RestrictedCode)
    .
    [HKEY_USERS\S-1-5-21-2765256803-2373232923-3968329771-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.*v*&#8230;¸&#8224;o\OpenWithList]
    @Class="Shell"
    "a"="vlc.exe"
    "MRUList"="a"
    .
    [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{BEB3C0C7-B648-4257-96D9-B5D024816E27}\Version*Version]
    "Version"=hex:11,16,3d,8d,7b,88,a0,2c,65,ef,30,b2,56,6a,33,5e,5b,c9,e4,43,2d,
    bd,36,eb,07,7b,36,1d,0b,85,06,e6,79,a8,cf,93,f0,c0,52,4e,d1,71,9c,bb,55,9b,\
    .
    [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
    @Denied: (A 2) (Everyone)
    @="FlashBroker"
    "LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil11e_ActiveX.exe,-101"
    .
    [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
    "Enabled"=dword:00000001
    .
    [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
    @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil11e_ActiveX.exe"
    .
    [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
    @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
    .
    [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
    @Denied: (A 2) (Everyone)
    @="Shockwave Flash Object"
    .
    [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
    @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11e.ocx"
    "ThreadingModel"="Apartment"
    .
    [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
    @="0"
    .
    [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
    @="ShockwaveFlash.ShockwaveFlash.10"
    .
    [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
    @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11e.ocx, 1"
    .
    [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
    @="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
    .
    [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
    @="1.0"
    .
    [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
    @="ShockwaveFlash.ShockwaveFlash"
    .
    [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
    @Denied: (A 2) (Everyone)
    @="Macromedia Flash Factory Object"
    .
    [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
    @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11e.ocx"
    "ThreadingModel"="Apartment"
    .
    [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
    @="FlashFactory.FlashFactory.1"
    .
    [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
    @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11e.ocx, 1"
    .
    [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
    @="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
    .
    [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
    @="1.0"
    .
    [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
    @="FlashFactory.FlashFactory"
    .
    [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
    @Denied: (A 2) (Everyone)
    @="IFlashBroker4"
    .
    [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
    @="{00020424-0000-0000-C000-000000000046}"
    .
    [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
    @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
    "Version"="1.0"
    .
    [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\TypeLib\{D27CDB6B-AE6D-11CF-96B8-444553540000}]
    @Denied: (A 2) (Everyone)
    .
    [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\TypeLib\{D27CDB6B-AE6D-11CF-96B8-444553540000}\1.0]
    @="Shockwave Flash"
    .
    [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\TypeLib\{FAB3E735-69C7-453B-A446-B6823C6DF1C9}]
    @Denied: (A 2) (Everyone)
    @=""
    .
    [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\TypeLib\{FAB3E735-69C7-453B-A446-B6823C6DF1C9}\1.0]
    @="FlashBroker"
    .
    [HKEY_LOCAL_MACHINE\software\Minnetonka Audio Software\SurCode Dolby Digital Premiere\Version*Version]
    "Version"=hex:11,16,3d,8d,7b,88,a0,2c,65,ef,30,b2,56,6a,33,5e,5b,c9,e4,43,2d,
    bd,36,eb,07,7b,36,1d,0b,85,06,e6,79,a8,cf,93,f0,c0,52,4e,d1,71,9c,bb,55,9b,\
    .
    [HKEY_LOCAL_MACHINE\software\Wow6432Node\Classes]
    "SymbolicLinkValue"=hex(6):5c,00,52,00,45,00,47,00,49,00,53,00,54,00,52,00,59,
    00,5c,00,4d,00,41,00,43,00,48,00,49,00,4e,00,45,00,5c,00,53,00,4f,00,46,00,\
    .
    ------------------------ Other Running Processes ------------------------
    .
    c:\program files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
    c:\program files (x86)\GenArts\Monsters-AE64\bin\JawsServerAE64.exe
    c:\program files (x86)\Common Files\LightScribe\LSSrvc.exe
    c:\program files (x86)\Common Files\Mediafour\M4LIC.EXE
    c:\program files (x86)\GenArts\rlm\rlm.exe
    c:\program files (x86)\Contour Shuttle\ShuttleEngine.exe
    c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
    c:\program files (x86)\Intel\Intel Matrix Storage Manager\IAANTMon.exe
    c:\program files (x86)\GenArts\rlm\rlm.exe
    c:\program files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe
    .
    **************************************************************************
    .
    Completion time: 2012-03-10 05:03:52 - machine was rebooted
    ComboFix-quarantined-files.txt 2012-03-10 10:03
    .
    Pre-Run: 45,532,184,576 bytes free
    Post-Run: 46,697,762,816 bytes free
    .
    - - End Of File - - 973CCCA51297FF7360A0A2E56D888B54


    Any ideas?

    Thank you guys so much!!
     
  2. Macboatmaster

    Macboatmaster Trusted Advisor Spam Fighter

    Joined:
    Jan 14, 2010
    Messages:
    20,950
    doctordoctor

    Welcome to TechSupportGuy
    The best advice I can give you is
    ComboFix is only to be used with a malware removal expert's assistance. It's a powerful tool that could potentially render your computer inoperable.

    I would URGE that you do not attempt to make any changes to the computer.
    You should seek the opinion of one of our Malware experts, to ensure you have a clean bill of health and then if problems remain, you may return to the Vista forum where we can attempt to ascertain why you are experiencing the problems.

    Please wait and someone will post further instructions.
    Normally I would simply refer you to the Malware forum, but in view of the logs attached to your post here, we may adopt a different approach.
     
  3. doctordoctor

    doctordoctor Thread Starter

    Joined:
    Mar 10, 2012
    Messages:
    3
    I ran Combofix after trying everything else -- I don't think it deleted anything of significance.

    That said, thank you. I look forward to seeing what people have to say.
     
  4. Macboatmaster

    Macboatmaster Trusted Advisor Spam Fighter

    Joined:
    Jan 14, 2010
    Messages:
    20,950
    Your topic has been moved to our Malware forum.
    Good luck with it.
     
  5. doctordoctor

    doctordoctor Thread Starter

    Joined:
    Mar 10, 2012
    Messages:
    3
    Thank you!!
     
  6. Sponsor

As Seen On
As Seen On...

Welcome to Tech Support Guy!

Are you looking for the solution to your computer problem? Join our site today to ask your question. This site is completely free -- paid for by advertisers and donations.

If you're not already familiar with forums, watch our Welcome Guide to get started.

Join over 733,556 other people just like you!

Loading...
Thread Status:
Not open for further replies.

Short URL to this thread: https://techguy.org/1044598

  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.
    Dismiss Notice