Solved MyOSProtect blocking internet connection

RogueKiller V10.5.10.0 [Apr 14 2015] by Adlice Software
mail : http://www.adlice.com/contact/
Feedback : http://forum.adlice.com
Website : http://www.adlice.com/softwares/roguekiller/
Blog : http://www.adlice.com

Operating System : Windows XP (5.1.2600 Service Pack 3) 32 bits version
Started in : Normal mode
User : K [Administrator]
Started from : E:\RogueKiller.exe
Mode : Delete -- Date : 04/15/2015 23:00:57

��� Processes : 0 ���

��� Registry : 21 ���
[PUP] HKEY_CLASSES_ROOT\CLSID\{FB684D26-01F4-4D9D-87CB-F486BEBA56DC} -> Not selected
[PUP] HKEY_LOCAL_MACHINE\System\ControlSet001\Services\CltMngSvc (C:\Program Files\SearchProtect\Main\bin\CltMngSvc.exe) -> Not selected
[PUP] HKEY_LOCAL_MACHINE\System\ControlSet001\Services\globalUpdate (C:\Program Files\globalUpdate\Update\GoogleUpdate.exe /svc) -> Not selected
[PUP] HKEY_LOCAL_MACHINE\System\ControlSet001\Services\globalUpdatem (C:\Program Files\globalUpdate\Update\GoogleUpdate.exe /medsvc) -> Not selected
[Suspicious.Path] HKEY_LOCAL_MACHINE\System\ControlSet001\Services\koyrdhbau ("C:\Documents and Settings\All Users\Application Data\eazyzoom\1.1.0.30\pepdwga.exe" -scm) -> Not selected
[PUP] HKEY_LOCAL_MACHINE\System\ControlSet001\Services\MyOSProtect (C:\Program Files\Web Protect\MyOSProtect.exe) -> Not selected
[PUP] HKEY_LOCAL_MACHINE\System\ControlSet001\Services\pcwatch (\??\C:\WINDOWS\system32\Drivers\pcwatch.sys) -> Not selected
[PUP] HKEY_LOCAL_MACHINE\System\ControlSet001\Services\ProtectMonitor (C:\monitorsvc.exe) -> Not selected
[Suspicious.Path] HKEY_LOCAL_MACHINE\System\ControlSet001\Services\pylywusy (C:\Documents and Settings\K\Application Data\4C4C4544-1428345196-5010-805A-B9C04F533231\jnsg120.tmp) -> Not selected
[PUP] HKEY_LOCAL_MACHINE\System\ControlSet001\Services\WebCake Desktop Updater (C:\Program Files\Betcat\WBDesktop.Updater.1.0.0.16.exe) -> Not selected
[PUM.Dns] HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Tcpip\Parameters | DhcpNameServer : 192.168.0.1 205.171.2.25 [-][UNITED STATES (US)] -> Not selected
[PUM.Dns] HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Tcpip\Parameters | DhcpNameServer : 192.168.0.1 205.171.2.25 [-][UNITED STATES (US)] -> Not selected
[PUM.Dns] HKEY_LOCAL_MACHINE\System\ControlSet002\Services\Tcpip\Parameters | DhcpNameServer : 192.168.0.1 205.171.2.25 [-][UNITED STATES (US)] -> Not selected
[PUM.Dns] HKEY_LOCAL_MACHINE\System\ControlSet003\Services\Tcpip\Parameters | DhcpNameServer : 192.168.0.1 205.171.2.25 [-][UNITED STATES (US)] -> Not selected
[PUM.Dns] HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{CE191B9F-8516-40DB-B6C0-7A520D533607} | DhcpNameServer : 192.168.0.1 205.171.2.25 [-][UNITED STATES (US)] -> Not selected
[PUM.Dns] HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Tcpip\Parameters\Interfaces\{CE191B9F-8516-40DB-B6C0-7A520D533607} | DhcpNameServer : 192.168.0.1 205.171.2.25 [-][UNITED STATES (US)] -> Not selected
[PUM.Dns] HKEY_LOCAL_MACHINE\System\ControlSet002\Services\Tcpip\Parameters\Interfaces\{CE191B9F-8516-40DB-B6C0-7A520D533607} | DhcpNameServer : 192.168.0.1 205.171.2.25 [-][UNITED STATES (US)] -> Not selected
[PUM.Dns] HKEY_LOCAL_MACHINE\System\ControlSet003\Services\Tcpip\Parameters\Interfaces\{CE191B9F-8516-40DB-B6C0-7A520D533607} | DhcpNameServer : 192.168.0.1 205.171.2.25 [-][UNITED STATES (US)] -> Not selected
[PUM.StartMenu] HKEY_USERS\S-1-5-21-725345543-1958367476-682003330-1004\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced | Start_ShowPrinters : 0 -> Not selected
[PUM.StartMenu] HKEY_USERS\S-1-5-21-725345543-1958367476-682003330-1004\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced | Start_ShowRecentDocs : 2 -> Not selected
[PUM.DesktopIcons] HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel | {20D04FE0-3AEA-1069-A2D8-08002B30309D} : 1 -> Not selected

��� Tasks : 0 ���

��� Files : 0 ���

��� Hosts File : 35 ���
[C:\WINDOWS\system32\drivers\etc\hosts] 127.0.0.1 localhost
[C:\WINDOWS\system32\drivers\etc\hosts] 0.0.0.0 0.0.0.0 # fix for traceroute and netstat display anomaly
[C:\WINDOWS\system32\drivers\etc\hosts] 0.0.0.0 tracking.opencandy.com.s3.amazonaws.com
[C:\WINDOWS\system32\drivers\etc\hosts] 0.0.0.0 media.opencandy.com
[C:\WINDOWS\system32\drivers\etc\hosts] 0.0.0.0 cdn.opencandy.com
[C:\WINDOWS\system32\drivers\etc\hosts] 0.0.0.0 tracking.opencandy.com
[C:\WINDOWS\system32\drivers\etc\hosts] 0.0.0.0 api.opencandy.com
[C:\WINDOWS\system32\drivers\etc\hosts] 0.0.0.0 installer.betterinstaller.com
[C:\WINDOWS\system32\drivers\etc\hosts] 0.0.0.0 installer.filebulldog.com
[C:\WINDOWS\system32\drivers\etc\hosts] 0.0.0.0 d3oxtn1x3b8d7i.cloudfront.net
[C:\WINDOWS\system32\drivers\etc\hosts] 0.0.0.0 inno.bisrv.com
[C:\WINDOWS\system32\drivers\etc\hosts] 0.0.0.0 nsis.bisrv.com
[C:\WINDOWS\system32\drivers\etc\hosts] 0.0.0.0 cdn.file2desktop.com
[C:\WINDOWS\system32\drivers\etc\hosts] 0.0.0.0 cdn.goateastcach.us
[C:\WINDOWS\system32\drivers\etc\hosts] 0.0.0.0 cdn.guttastatdk.us
[C:\WINDOWS\system32\drivers\etc\hosts] 0.0.0.0 cdn.inskinmedia.com
[C:\WINDOWS\system32\drivers\etc\hosts] 0.0.0.0 cdn.insta.oibundles2.com
[C:\WINDOWS\system32\drivers\etc\hosts] 0.0.0.0 cdn.insta.playbryte.com
[C:\WINDOWS\system32\drivers\etc\hosts] 0.0.0.0 cdn.llogetfastcach.us
[C:\WINDOWS\system32\drivers\etc\hosts] 0.0.0.0 cdn.montiera.com
[C:\WINDOWS\system32\drivers\etc\hosts] 0.0.0.0 cdn.msdwnld.com
[C:\WINDOWS\system32\drivers\etc\hosts] 0.0.0.0 cdn.mypcbackup.com
[C:\WINDOWS\system32\drivers\etc\hosts] 0.0.0.0 cdn.ppdownload.com
[C:\WINDOWS\system32\drivers\etc\hosts] 0.0.0.0 cdn.riceateastcach.us
[C:\WINDOWS\system32\drivers\etc\hosts] 0.0.0.0 cdn.shyapotato.us
[C:\WINDOWS\system32\drivers\etc\hosts] 0.0.0.0 cdn.solimba.com
[C:\WINDOWS\system32\drivers\etc\hosts] 0.0.0.0 cdn.tuto4pc.com
[C:\WINDOWS\system32\drivers\etc\hosts] 0.0.0.0 cdn.appround.biz
[C:\WINDOWS\system32\drivers\etc\hosts] 0.0.0.0 cdn.bigspeedpro.com
[C:\WINDOWS\system32\drivers\etc\hosts] 0.0.0.0 cdn.bispd.com
[C:\WINDOWS\system32\drivers\etc\hosts] 0.0.0.0 cdn.bisrv.com
[C:\WINDOWS\system32\drivers\etc\hosts] 0.0.0.0 cdn.cdndp.com
[C:\WINDOWS\system32\drivers\etc\hosts] 0.0.0.0 cdn.download.sweetpacks.com
[C:\WINDOWS\system32\drivers\etc\hosts] 0.0.0.0 cdn.dpdownload.com
[C:\WINDOWS\system32\drivers\etc\hosts] 0.0.0.0 cdn.visualbee.net

��� Antirootkit : 0 (Driver: Loaded) ���

��� Web browsers : 0 ���

��� MBR Check : ���
+++++ PhysicalDrive0: Maxtor 4D040H2 +++++
--- User ---
[MBR] 41df9ee50f6288e4655a627d59772f5a
[BSP] cc122299fb619291b292a6ddd259beee : Windows XP MBR Code
Partition table:
0 - [ACTIVE] NTFS (0x7) [VISIBLE] Offset (sectors): 63 | Size: 39072 MB [Windows XP Bootstrap | Windows XP Bootloader]
User = LL1 ... OK
Error reading LL2 MBR! NOT VALID!

+++++ PhysicalDrive1: LEXAR JD FIREFLY USB Device +++++
--- User ---
[MBR] 92aac04658f315e72ba49ab3827cb0c5
[BSP] 33a07a59d299ab4ea9f4ab0156f9d86f : Windows XP MBR Code
Partition table:
0 - [XXXXXX] FAT16 (0x6) [VISIBLE] Offset (sectors): 32 | Size: 483 MB
User = LL1 ... OK
Error reading LL2 MBR! ([32] The request is not supported. )


============================================
RKreport_SCN_04152015_225520.log
 
You did fine.

..and...one computer per topic please.

I'll be signing off for tonight...
 
Malwarebytes Anti-Malware
www.malwarebytes.org

Scan Date: 4/15/2015
Scan Time: 11:14:54 PM
Logfile: Malwarebytes scan.txt
Administrator: Yes

Version: 2.01.4.1018
Malware Database: v2015.04.16.01
Rootkit Database: v2015.03.31.01
License: Free
Malware Protection: Disabled
Malicious Website Protection: Disabled
Self-protection: Disabled

OS: Windows XP Service Pack 3
CPU: x86
File System: NTFS
User: K

Scan Type: Threat Scan
Result: Completed
Objects Scanned: 504522
Time Elapsed: 1 hr, 36 min, 24 sec

Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Disabled
Heuristics: Enabled
PUP: Enabled
PUM: Enabled

Processes: 0
(No malicious items detected)

Modules: 0
(No malicious items detected)

Registry Keys: 15
PUP.Optional.TidyNetwork.A, HKU\S-1-5-21-725345543-1958367476-682003330-1235\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\STATS\{7736C7FA-512D-11E2-B871-DEC36088709B}, Quarantined, [5be61459404a93a321e957eb36cd40c0],
PUP.Optional.WordOV, HKU\S-1-5-21-725345543-1958367476-682003330-1235\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\STATS\{B78F92C8-DEB3-11E2-9A0A-FB64281D6ADE}, Quarantined, [6ed30469c9c1092d7a144f2a43c0d12f],
PUP.Optional.ModGoog, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\GOOGLEUPDATE.EXE, Quarantined, [9da40a63bad06ec8bd348abdaa58619f],
PUP.Optional.CinemaPlus.A, HKLM\SOFTWARE\CinemaPlus-3.2cV06.04-nv, Quarantined, [c77a0b62cdbddf5702608f4806fd6d93],
PUP.Optional.CinemaPlus.A, HKLM\SOFTWARE\CinemaPlus-3.2cV06.04-nv-ie, Quarantined, [d170e38a187258dec59d0acd6e95bd43],
PUP.Optional.Infonaut.A, HKLM\SOFTWARE\Infonaut_1.10.0.13, Quarantined, [df62d4995a308caaa0705070dc27a15f],
PUP.Optional.SolidSavings.A, HKLM\SOFTWARE\Solid Savings, Quarantined, [4ff2313c32582016796eaa4f46bd3dc3],
PUP.Optional.BrowserSafeguard.A, HKLM\SOFTWARE\MICROSOFT\ESENT\PROCESS\Browsersafeguard, Quarantined, [90b1155887038babc12d400753b2926e],
PUP.Optional.PastaLeads.A, HKLM\SOFTWARE\MICROSOFT\ESENT\PROCESS\PastaLeadsApplication, Quarantined, [77cacca1b1d9360090b307ca1ce7c43c],
PUP.Optional.HealthCareGovTool.C, HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\WINPROGRAMS, Quarantined, [4bf6620bd2b8b0864f6be5da91721de3],
PUP.Optional.PastaLeads.A, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\EVENTLOG\APPLICATION\PastaLeadsUpdaterService, Quarantined, [f44db0bdb5d5999d5ae0daefc63d36ca],
PUP.Optional.UpdateAdmin.A, HKU\S-1-5-18\SOFTWARE\DOWNLOADADMIN\UpdateAdmin, Quarantined, [ab96c1ac1377e94d69cfc904d1321fe1],
PUP.Optional.Shopperz.A, HKU\S-1-5-19\SOFTWARE\{4E7638A1-6962-4e44-A6B9-F40E84FD6D09}, Quarantined, [330e9ecfb1d90036d9e8f8cd3bc82fd1],
PUP.Optional.Shopperz.A, HKU\S-1-5-20\SOFTWARE\{4E7638A1-6962-4e44-A6B9-F40E84FD6D09}, Quarantined, [99a89ecf7f0b2610e5dcb31204ffc937],
PUP.Optional.CinemaPlus.A, HKU\S-1-5-21-725345543-1958367476-682003330-1004\SOFTWARE\CinemaPlus-3.2cV06.04-nv-ie, Quarantined, [30110d60a6e4053184dfbf18bb484ab6],

Registry Values: 3
PUP.Optional.HealthCareGovTool.C, HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\WINPROGRAMS|UninstallString, C:\Program Files\SysFiles\uninstall.exe, Quarantined, [4bf6620bd2b8b0864f6be5da91721de3]
PUP.Optional.HealthCareGovTool.C, HKLM\SOFTWARE\WINPROGRAMS|Path, C:\Program Files\SysFiles, Quarantined, [3809056826647db98437a8179b68f60a]
PUP.Optional.RelevantKnowledge.A, HKU\S-1-5-18\SOFTWARE\GUPPY\RKSURVEY|survey, 1, Quarantined, [0f3287e6573395a1a4c88b36a75c44bc]

Registry Data: 0
(No malicious items detected)

Folders: 51
PUP.Optional.HealthCareGovTool.C, C:\Program Files\SysFiles, Quarantined, [3d046eff3b4f2c0aedcb3d820cf70af6],
PUP.Optional.SysHealthController.A, C:\WINDOWS\SysFilesController, Quarantined, [f54c91dc1179ee48fe2712ae01027b85],
PUP.Optional.SysHealthController.A, C:\WINDOWS\SysHealthController, Quarantined, [72cffa73cebc092d80a6fac6c83b8779],
PUP.Optional.StormWatch.A, C:\WINDOWS\system32\config\systemprofile\Start Menu\Programs\StormWatch, Quarantined, [56ebc3aa751586b0be6f20a523e0966a],
PUP.Optional.StormWatch.A, C:\WINDOWS\system32\config\systemprofile\Local Settings\Application Data\StormWatch, Quarantined, [a59c65082c5ebc7ae9d10dc7877c20e0],
PUP.Optional.VBates.A, C:\Documents and Settings\K\Application Data\Company\Product\1.0, Quarantined, [d1703e2f69210d2903eeeeedd72c5ca4],
PUP.Optional.VPLMedia.A, C:\Documents and Settings\K\Application Data\player, Quarantined, [fe4359147515b5819dce33f143c28977],
PUP.Optional.VPLMedia.A, C:\Documents and Settings\K\Application Data\player\images, Quarantined, [fe4359147515b5819dce33f143c28977],
PUP.Optional.Conduit.C, C:\Documents and Settings\K\Local Settings\Application Data\CRE, Quarantined, [9aa77feee8a2310526120c454fb6a25e],
PUP.Optional.MultiPlug.A, C:\Documents and Settings\Administrator\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\bnhfdipdlocbfkdgekmajkeodklniiae\2.1, Quarantined, [80c1c7a6bcce7cba43a4f95c759011ef],
PUP.Optional.MultiPlug.A, C:\Documents and Settings\Administrator\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\bnhfdipdlocbfkdgekmajkeodklniiae, Quarantined, [80c1c7a6bcce7cba43a4f95c759011ef],
PUP.Optional.MultiPlug.A, C:\Documents and Settings\Administrator\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\ohlencieiipommannpdfcmfdpjjmeolj\127, Quarantined, [5fe299d41971d06623c462f3ed182bd5],
PUP.Optional.MultiPlug.A, C:\Documents and Settings\Administrator\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\ohlencieiipommannpdfcmfdpjjmeolj, Quarantined, [5fe299d41971d06623c462f3ed182bd5],
PUP.Optional.MultiPlug.A, C:\Documents and Settings\Guest\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\bnhfdipdlocbfkdgekmajkeodklniiae\2.1, Quarantined, [0f3277f618727abc7374c49115f09769],
PUP.Optional.MultiPlug.A, C:\Documents and Settings\Guest\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\bnhfdipdlocbfkdgekmajkeodklniiae, Quarantined, [0f3277f618727abc7374c49115f09769],
PUP.Optional.MultiPlug.A, C:\Documents and Settings\Guest\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\ohlencieiipommannpdfcmfdpjjmeolj\127, Quarantined, [1928234aafdb55e1ebfc540152b34eb2],
PUP.Optional.MultiPlug.A, C:\Documents and Settings\Guest\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\ohlencieiipommannpdfcmfdpjjmeolj, Quarantined, [1928234aafdb55e1ebfc540152b34eb2],
PUP.Optional.MultiPlug.A, C:\Documents and Settings\HelpAssistant\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\bnhfdipdlocbfkdgekmajkeodklniiae\2.1, Quarantined, [62dfbeaf2169f541df086beab94c5fa1],
PUP.Optional.MultiPlug.A, C:\Documents and Settings\HelpAssistant\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\bnhfdipdlocbfkdgekmajkeodklniiae, Quarantined, [62dfbeaf2169f541df086beab94c5fa1],
PUP.Optional.MultiPlug.A, C:\Documents and Settings\HelpAssistant\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\ohlencieiipommannpdfcmfdpjjmeolj\127, Quarantined, [b78ad09d1f6b280e38af4114c4412bd5],
PUP.Optional.MultiPlug.A, C:\Documents and Settings\HelpAssistant\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\ohlencieiipommannpdfcmfdpjjmeolj, Quarantined, [b78ad09d1f6b280e38af4114c4412bd5],
PUP.Optional.MultiPlug.A, C:\Documents and Settings\SUPPORT_388945a0\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\bnhfdipdlocbfkdgekmajkeodklniiae\2.1, Quarantined, [033e0c6173179f9712d5f362f213b44c],
PUP.Optional.MultiPlug.A, C:\Documents and Settings\SUPPORT_388945a0\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\bnhfdipdlocbfkdgekmajkeodklniiae, Quarantined, [033e0c6173179f9712d5f362f213b44c],
PUP.Optional.MultiPlug.A, C:\Documents and Settings\SUPPORT_388945a0\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\ohlencieiipommannpdfcmfdpjjmeolj\127, Quarantined, [01402d403258fa3c2bbc4114de27a060],
PUP.Optional.MultiPlug.A, C:\Documents and Settings\SUPPORT_388945a0\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\ohlencieiipommannpdfcmfdpjjmeolj, Quarantined, [01402d403258fa3c2bbc4114de27a060],
PUP.Optional.MultiPlug.A, C:\Documents and Settings\K\Local Settings\Application Data\4C4C4544-1428345377-5010-805A-B9C04F533231, Quarantined, [aa97ec8199f19e98d617e76e61a446ba],
PUP.Optional.MultiPlug.A, C:\Documents and Settings\K\Application Data\Mozilla\Firefox\Profiles\8aymfdzx.default\extensions\gliuyio@batooouaiei.com\content, Quarantined, [cb76f6776822cc6a29cc1045f70e6799],
PUP.Optional.MultiPlug.A, C:\Documents and Settings\K\Application Data\Mozilla\Firefox\Profiles\8aymfdzx.default\extensions\gliuyio@batooouaiei.com, Quarantined, [cb76f6776822cc6a29cc1045f70e6799],
PUP.Optional.WebCake.A, C:\Documents and Settings\Fresh\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\fjoijdanhaiflhibkljeklcghcmmfffh, Quarantined, [57ea006d3a50e6500d3cb8d8a65d37c9],
PUP.Optional.WebCake.A, C:\Documents and Settings\Fresh\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\fjoijdanhaiflhibkljeklcghcmmfffh\1.0.3_0, Quarantined, [57ea006d3a50e6500d3cb8d8a65d37c9],
PUP.Optional.GlobalUpdate.A, C:\Documents and Settings\K\Local Settings\Temp\comh.106784, Quarantined, [0f32ff6e0a8066d05d04edb4ee154bb5],
PUP.Optional.GlobalUpdate.A, C:\Documents and Settings\K\Local Settings\Temp\comh.326381, Quarantined, [e65bcda06426c37366fb5f42c93ae719],
PUP.Optional.CrossRider.A, C:\Documents and Settings\K\Local Settings\Application Data\Google\Chrome\User Data\Default\Local Extension Settings\plnkhmnoajbfccclonaeepohggeolcih, Quarantined, [db66e885ccbeae88b51d268448bb43bd],
PUP.Optional.StormWatch.A, C:\WINDOWS\system32\config\systemprofile\Local Settings\Application Data\Weather_Protector_LLC, Quarantined, [e45d3d300189181e1e119c100ef5639d],
PUP.Optional.StormWatch.A, C:\WINDOWS\system32\config\systemprofile\Local Settings\Application Data\Weather_Protector_LLC\StormWatch.exe_Url_drszjp3ixrql2l5dz2b2jvlplwn11r4l, Quarantined, [e45d3d300189181e1e119c100ef5639d],
PUP.Optional.StormWatch.A, C:\WINDOWS\system32\config\systemprofile\Local Settings\Application Data\Weather_Protector_LLC\StormWatch.exe_Url_drszjp3ixrql2l5dz2b2jvlplwn11r4l\2.0.0.0, Quarantined, [e45d3d300189181e1e119c100ef5639d],
PUP.Optional.WList.A, C:\Documents and Settings\K\Application Data\{D2020D47-707D-4E26-B4D9-739C4F4C2E9A}, Quarantined, [95ac64093357a492d5a0397439caf30d],
PUP.Optional.WList.A, C:\Documents and Settings\K\Application Data\{D2020D47-707D-4E26-B4D9-739C4F4C2E9A}\{FBC0652C-7B29-4FB6-8ADA-91F54B267AD4}, Quarantined, [95ac64093357a492d5a0397439caf30d],
PUP.Optional.WList.A, C:\Documents and Settings\K\Application Data\{D2020D47-707D-4E26-B4D9-739C4F4C2E9A}\{FBC0652C-7B29-4FB6-8ADA-91F54B267AD4}\1.5, Quarantined, [95ac64093357a492d5a0397439caf30d],
PUP.Optional.WList.A, C:\Documents and Settings\LocalService\Local Settings\Application Data\{D2020D47-707D-4E26-B4D9-739C4F4C2E9A}, Quarantined, [64ddf5780f7bfc3ad82f7e34fc0719e7],
PUP.Optional.WList.A, C:\Documents and Settings\LocalService\Local Settings\Application Data\{D2020D47-707D-4E26-B4D9-739C4F4C2E9A}\{FBC0652C-7B29-4FB6-8ADA-91F54B267AD4}, Quarantined, [64ddf5780f7bfc3ad82f7e34fc0719e7],
PUP.Optional.WList.A, C:\Documents and Settings\LocalService\Local Settings\Application Data\{D2020D47-707D-4E26-B4D9-739C4F4C2E9A}\{FBC0652C-7B29-4FB6-8ADA-91F54B267AD4}\1.5, Quarantined, [64ddf5780f7bfc3ad82f7e34fc0719e7],
PUP.Optional.SmileysWeLove.A, C:\Documents and Settings\K\Application Data\SmileysWeLove, Quarantined, [41001e4fd5b58aacc776783e34cf847c],
PUP.Optional.SmileysWeLove.A, C:\Documents and Settings\K\Local Settings\Application Data\Google\Chrome\User Data\Default\Local Extension Settings\fjbbjfdilbioabojmcplalojlmdngbjl, Quarantined, [fc4556170585aa8c0dab16a312f1748c],
PUP.Optional.YouTubeDownloadPool.A, C:\Program Files\YouTube Download Pool, Quarantined, [ea571f4eaddd290d8e05ebd256ad8977],
PUP.Optional.YouTubeDownloadPool.A, C:\Program Files\YouTube Download Pool\G4, Quarantined, [ea571f4eaddd290d8e05ebd256ad8977],
PUP.Optional.YouTubeDownloadPool.A, C:\Program Files\YouTube Download Pool\G4\config, Quarantined, [ea571f4eaddd290d8e05ebd256ad8977],
PUP.Optional.Crossbrowse.C, C:\Documents and Settings\Fresh\Local Settings\Application Data\Crossbrowse, Quarantined, [56eb1c5109817cba3991dde013f045bb],
PUP.Optional.Crossbrowse.C, C:\Documents and Settings\Fresh\Local Settings\Application Data\Crossbrowse\Crossbrowse, Quarantined, [56eb1c5109817cba3991dde013f045bb],
PUP.Optional.Crossbrowse.C, C:\Documents and Settings\Fresh\Local Settings\Application Data\Crossbrowse\Crossbrowse\User Data, Quarantined, [56eb1c5109817cba3991dde013f045bb],
PUP.Optional.Crossbrowse.C, C:\Documents and Settings\Fresh\Local Settings\Application Data\Crossbrowse\Crossbrowse\User Data\Default, Quarantined, [56eb1c5109817cba3991dde013f045bb],

Files: 200
PUP.Optional.OptimizerPro, C:\Documents and Settings\All Users\Application Data\{9d39d2a8-4a19-bd4c-9d39-9d2a84a14aa1}\hqghumeaylnlf.exe, Quarantined, [d071abc2444639fdecb2231ec63cc43c],
PUP.Optional.Nova.A, C:\Program Files\9135fa6f-851d-4210-8a06-c060645e7f6d\de63d42d-3559-438c-9aed-23f00183f10e.dll, Quarantined, [c47d8fdefb8fa591f048d53be22018e8],
PUP.Optional.Nova.A, C:\Program Files\AVAST Software\7258fd14-dd22-43ae-bf90-2cfd83e948c8.dll, Quarantined, [42ff6d00602ac47256e234dc768c659b],
PUP.Optional.BestToolBars.A, C:\Program Files\SysFiles\HealthcareGovTool.exe, Quarantined, [b78a0b62e0aacb6b6c42fa2fa65c649c],
PUP.Optional.Winsock.Hijack, C:\Program Files\SysFiles\WebWatcherCert.dll, Quarantined, [122f2746e1a91b1b6eff3110639f6a96],
PUP.Optional.Winsock.Hijack, C:\Program Files\SysFiles\WebWatcherLSP.dll, Quarantined, [4ef36904bad040f6c2ab6cd5aa58649c],
PUP.Optional.Winsock.Hijack, C:\Program Files\SysFiles\WebWatcherLSP.exe, Quarantined, [c77afb72c3c76ec8cba2ea5728daba46],
PUP.Optional.Winsock.Hijack, C:\Program Files\SysFiles\WebWatcherLSP64.dll, Quarantined, [4ef3c8a5bbcf7db98fde4df4a9599769],
PUP.Optional.Winsock.Hijack, C:\Program Files\SysFiles\WebWatcherLSP64.exe, Quarantined, [cd7406672664da5c98d554edec16ad53],
PUP.Optional.Winsock.Hijack, C:\Program Files\SysFiles\WebWatcherProxy.exe, Quarantined, [2c15a9c4e2a8ff3719548bb6dc26e41c],
PUP.Optional.Loadshop, C:\monitorsvc.exe, Quarantined, [44fd4b223753b680273afb5fce34857b],
Trojan.Dropper.NS, C:\RECYCLER\S-1-5-21-725345543-1958367476-682003330-1004\Dc112.exe, Quarantined, [192866074644c47217603f13847ee61a],
Trojan.Downloader, C:\Documents and Settings\K\Local Settings\Temp\nshC2.tmp, Quarantined, [053c2b427515ca6cd6ae4de6f11221df],
PUP.Optional.Bundle, C:\Documents and Settings\K\Local Settings\Temp\nshC3.tmp, Quarantined, [88b9f8752268b086c037c52eeb1a8b75],
PUP.Optional.ModGoog, C:\Documents and Settings\K\Local Settings\Temp\comh.106784\GoogleCrashHandler.exe, Quarantined, [f0515d1016743303f7faf156cd35e21e],
PUP.Optional.ModGoog, C:\Documents and Settings\K\Local Settings\Temp\comh.106784\GoogleUpdate.exe, Quarantined, [9da40a63bad06ec8bd348abdaa58619f],
PUP.Optional.ModGoog, C:\Documents and Settings\K\Local Settings\Temp\comh.106784\GoogleUpdateBroker.exe, Quarantined, [4cf5fc715e2c59dd708181c616ec11ef],
PUP.Optional.ModGoog, C:\Documents and Settings\K\Local Settings\Temp\comh.106784\GoogleUpdateOnDemand.exe, Quarantined, [ac9569042c5ebc7a3eb39daa52b08a76],
PUP.Optional.ModGoog, C:\Documents and Settings\K\Local Settings\Temp\comh.106784\goopdate.dll, Quarantined, [5ee35419e7a3f046fff267e00cf6817f],
PUP.Optional.ModGoog, C:\Documents and Settings\K\Local Settings\Temp\comh.106784\goopdateres_en.dll, Quarantined, [3b067df08efc9e98a0514007c83a5ba5],
PUP.Optional.ModGoog, C:\Documents and Settings\K\Local Settings\Temp\comh.106784\npGoogleUpdate4.dll, Quarantined, [6bd6511cfd8d2b0b836e470008fae61a],
PUP.Optional.ModGoog, C:\Documents and Settings\K\Local Settings\Temp\comh.106784\psmachine.dll, Quarantined, [87ba76f72c5ee2546091e85f18eabf41],
PUP.Optional.ModGoog, C:\Documents and Settings\K\Local Settings\Temp\comh.106784\psuser.dll, Quarantined, [72cfea8394f657df70814700ba484ab6],
PUP.Optional.ModGoog, C:\Documents and Settings\K\Local Settings\Temp\comh.326381\GoogleCrashHandler.exe, Quarantined, [cb76d29bd3b7a393d91836117d856d93],
PUP.Optional.ModGoog, C:\Documents and Settings\K\Local Settings\Temp\comh.326381\GoogleUpdate.exe, Quarantined, [1c25a3caafdb55e1747d91b6fb071fe1],
PUP.Optional.ModGoog, C:\Documents and Settings\K\Local Settings\Temp\comh.326381\GoogleUpdateBroker.exe, Quarantined, [76cb343944468fa743aeda6dbb47a35d],
PUP.Optional.ModGoog, C:\Documents and Settings\K\Local Settings\Temp\comh.326381\GoogleUpdateOnDemand.exe, Quarantined, [5fe23b3239519b9b747d82c516ec6a96],
PUP.Optional.ModGoog, C:\Documents and Settings\K\Local Settings\Temp\comh.326381\goopdate.dll, Quarantined, [b48d6c010e7c162010e1a99ea0629e62],
PUP.Optional.ModGoog, C:\Documents and Settings\K\Local Settings\Temp\comh.326381\goopdateres_en.dll, Quarantined, [af92323bb5d52a0c0fe268dffe047a86],
PUP.Optional.ModGoog, C:\Documents and Settings\K\Local Settings\Temp\comh.326381\npGoogleUpdate4.dll, Quarantined, [c47dd39aa0ea092d6889e760758d629e],
PUP.Optional.ModGoog, C:\Documents and Settings\K\Local Settings\Temp\comh.326381\psmachine.dll, Quarantined, [fd44ce9fcac054e246ab093e4eb4c937],
PUP.Optional.ModGoog, C:\Documents and Settings\K\Local Settings\Temp\comh.326381\psuser.dll, Quarantined, [61e077f6761462d41bd6ac9b689a26da],
PUP.Optional.BPlug, C:\Documents and Settings\K\Local Settings\Temp\is366025459\64C2F02D_stp.EXE, Quarantined, [be83cca14a402a0cf2d85d7db948cb35],
PUP.Optional.OfferInstaller.C, C:\Documents and Settings\K\Local Settings\Temp\f9626892-7a78-3199-abd2-97bbce96297b\OfferInstaller.exe, Quarantined, [fe43f17c8a0063d3838dc37847bbfa06],
PUP.Optional.StormWatch.A, C:\WINDOWS\system32\config\systemprofile\Local Settings\Temp\setup_607.exe, Quarantined, [e65bde8fc0ca3afc9be17dda34cce11f],
PUP.Optional.OptimizerPro, C:\WINDOWS\system32\config\systemprofile\Local Settings\Temp\f9626892-7a78-3199-abd2-97bbce96297b\adv_78.exe, Quarantined, [83be9bd21773d95d0698db6662a039c7],
PUP.Optional.OfferInstaller.C, C:\WINDOWS\system32\config\systemprofile\Local Settings\Temp\f9626892-7a78-3199-abd2-97bbce96297b\OfferInstaller.exe, Quarantined, [b889f974b9d147ef53bdb7843dc59d63],
PUP.Optional.Mypcbackup, C:\WINDOWS\system32\config\systemprofile\Local Settings\Temp\f9626892-7a78-3199-abd2-97bbce96297b\Extracted\adv_33.exe, Quarantined, [84bd402df69460d66c3c3d01ff077090],
PUP.Optional.Clara.A, C:\WINDOWS\system32\config\systemprofile\Local Settings\Temp\f9626892-7a78-3199-abd2-97bbce96297b\Extracted\adv_67.exe, Quarantined, [bf821a530981ea4c9cce40a2d52c8f71],
PUP.Optional.PastaLeads.A, C:\WINDOWS\system32\config\systemprofile\Local Settings\Temp\f9626892-7a78-3199-abd2-97bbce96297b\Extracted\adv_87.exe, Quarantined, [7dc42a43c6c453e3be73b18c1ee82ed2],
PUP.Optional.BestToolBars.A, C:\WINDOWS\system32\config\systemprofile\Local Settings\Temp\f9626892-7a78-3199-abd2-97bbce96297b\Extracted\adv_88.exe, Quarantined, [a899d19c5634b284535bcd5ce1211ee2],
PUP.Optional.OutBrowse, C:\Documents and Settings\K\Local Settings\Temporary Internet Files\Content.IE5\NBOBR3XH\setup[1].exe, Quarantined, [52ef026baddda096373d1c2348ba41bf],
PUP.Optional.DownloadAdmin, C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\5IWI5I0L\ie-update[1].exe, Quarantined, [ac951855d4b60b2b61f51c3eb9478080],
PUP.Optional.Imali.SID.A, C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\0SKX4Q6P\setup_362[1].exe, Quarantined, [3f02402dd6b471c508700539ef1727d9],
PUP.Optional.StormWatch.A, C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\0SKX4Q6P\StormWatchSetup[1].exe, Quarantined, [64dd8fde5c2e2214d0ac96c1847c8b75],
PUP.Optional.RelevantKnowledge, C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\4LA9KBMB\rkverify[1].iok, Quarantined, [3f026409b8d243f3cdd11eee27df17e9],
PUP.Optional.RelevantKnowledge, C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\I3EL2X67\rkinstaller[1].iok, Quarantined, [073a89e4a3e7f73f323a6fa9a264a957],
PUP.Optional.StormWatch.A, C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\WZSBKX6V\stormwatch2_0[1].exe, Quarantined, [bf8290dd1278132337456fe8a06047b9],
PUP.Optional.HealthCareGovTool.C, C:\Program Files\SysFiles\HealthcareHelp.exe, Quarantined, [3d046eff3b4f2c0aedcb3d820cf70af6],
PUP.Optional.HealthCareGovTool.C, C:\Program Files\SysFiles\freebl3.dll, Quarantined, [3d046eff3b4f2c0aedcb3d820cf70af6],
PUP.Optional.HealthCareGovTool.C, C:\Program Files\SysFiles\libnspr4.dll, Quarantined, [3d046eff3b4f2c0aedcb3d820cf70af6],
PUP.Optional.HealthCareGovTool.C, C:\Program Files\SysFiles\libplc4.dll, Quarantined, [3d046eff3b4f2c0aedcb3d820cf70af6],
PUP.Optional.HealthCareGovTool.C, C:\Program Files\SysFiles\libplds4.dll, Quarantined, [3d046eff3b4f2c0aedcb3d820cf70af6],
PUP.Optional.HealthCareGovTool.C, C:\Program Files\SysFiles\nss3.dll, Quarantined, [3d046eff3b4f2c0aedcb3d820cf70af6],
PUP.Optional.HealthCareGovTool.C, C:\Program Files\SysFiles\nssckbi.dll, Quarantined, [3d046eff3b4f2c0aedcb3d820cf70af6],
PUP.Optional.HealthCareGovTool.C, C:\Program Files\SysFiles\nssdbm3.dll, Quarantined, [3d046eff3b4f2c0aedcb3d820cf70af6],
PUP.Optional.HealthCareGovTool.C, C:\Program Files\SysFiles\nssutil3.dll, Quarantined, [3d046eff3b4f2c0aedcb3d820cf70af6],
PUP.Optional.HealthCareGovTool.C, C:\Program Files\SysFiles\smime3.dll, Quarantined, [3d046eff3b4f2c0aedcb3d820cf70af6],
PUP.Optional.HealthCareGovTool.C, C:\Program Files\SysFiles\softokn3.dll, Quarantined, [3d046eff3b4f2c0aedcb3d820cf70af6],
PUP.Optional.HealthCareGovTool.C, C:\Program Files\SysFiles\sqlite3.dll, Quarantined, [3d046eff3b4f2c0aedcb3d820cf70af6],
PUP.Optional.HealthCareGovTool.C, C:\Program Files\SysFiles\ssl3.dll, Quarantined, [3d046eff3b4f2c0aedcb3d820cf70af6],
PUP.Optional.HealthCareGovTool.C, C:\Program Files\SysFiles\WebWatcherProxy.tlb, Quarantined, [3d046eff3b4f2c0aedcb3d820cf70af6],
PUP.Optional.SysHealthController.A, C:\WINDOWS\SysFilesController\SysFiles_backup.exe, Quarantined, [f54c91dc1179ee48fe2712ae01027b85],
PUP.Optional.SysHealthController.A, C:\WINDOWS\SysHealthController\SysFiles_backup.exe, Quarantined, [72cffa73cebc092d80a6fac6c83b8779],
PUP.Optional.WebWatcher.A, C:\WINDOWS\system32\config\systemprofile\Local Settings\Temp\WebWatcherLSP.ini.log, Quarantined, [10313538a9e176c02d3ad5eb2bd86b95],
PUP.Optional.WebWatcher.A, C:\WINDOWS\system32\config\systemprofile\Local Settings\Temp\WebWatcherProxyr.log, Quarantined, [fe43fb720189d75fd791546cc34033cd],
PUP.Optional.HealthCareGovTool.A, C:\Program Files\Mozilla Firefox\browser\extensions\healthcare@healthcaregovtool.com.xpi, Quarantined, [86bbb6b76e1c40f6680cfec2d62ddc24],
PUP.Optional.HealthCareGovTool.A, C:\Program Files\Mozilla Firefox\extensions\healthcare@healthcaregovtool.com.xpi, Quarantined, [98a9521b276381b54d284878aa59b848],
PUP.Optional.StormWatch.A, C:\WINDOWS\system32\config\systemprofile\Start Menu\Programs\StormWatch\StormWatch.lnk, Quarantined, [56ebc3aa751586b0be6f20a523e0966a],
PUP.Optional.DynamoCombo.A, C:\Documents and Settings\K\Application Data\Mozilla\Firefox\Profiles\8aymfdzx.default\extensions\{bf5001a3-ae7a-4910-925a-5060ef2c0508}.xpi, Quarantined, [8cb5006db6d4fc3afd9a7253f70c60a0],
PUP.Optional.StormWatch.A, C:\WINDOWS\system32\config\systemprofile\Local Settings\Application Data\StormWatch\StormWatchApp.dat, Quarantined, [a59c65082c5ebc7ae9d10dc7877c20e0],
PUP.Optional.VBates.A, C:\Documents and Settings\K\Application Data\Company\Product\1.0\localStorageIE.txt, Quarantined, [d1703e2f69210d2903eeeeedd72c5ca4],
PUP.Optional.VBates.A, C:\Documents and Settings\K\Application Data\Company\Product\1.0\localStorageIE_backup.txt, Quarantined, [d1703e2f69210d2903eeeeedd72c5ca4],
PUP.Optional.StormWatch.A, C:\WINDOWS\system32\config\systemprofile\Start Menu\Programs\Startup\StormWatch.lnk, Quarantined, [76cb69047317bf77edb8b924c043f808],
PUP.Optional.MyOSProtect.A, C:\WINDOWS\Temp\MyOSProtect.log, Quarantined, [68d94e1f4644ad89436eb031e221b34d],
PUP.Optional.SmileysWeLove.A, C:\Documents and Settings\K\Application Data\Mozilla\Firefox\Profiles\8aymfdzx.default\extensions\jid1-vW9nopuIAJiRHw@jetpack.xpi, Quarantined, [60e1e8851c6e181e5bae767d11f26d93],
PUP.Optional.VPLMedia.A, C:\Documents and Settings\K\Application Data\player\playlist.vpl, Quarantined, [fe4359147515b5819dce33f143c28977],
PUP.Optional.VPLMedia.A, C:\Documents and Settings\K\Application Data\player\images\channel_ld_11.png, Quarantined, [fe4359147515b5819dce33f143c28977],
PUP.Optional.VPLMedia.A, C:\Documents and Settings\K\Application Data\player\images\channel_ld_193.png, Quarantined, [fe4359147515b5819dce33f143c28977],
PUP.Optional.VPLMedia.A, C:\Documents and Settings\K\Application Data\player\images\channel_ld_103.png, Quarantined, [fe4359147515b5819dce33f143c28977],
PUP.Optional.VPLMedia.A, C:\Documents and Settings\K\Application Data\player\images\channel_ld_199.png, Quarantined, [fe4359147515b5819dce33f143c28977],
PUP.Optional.VPLMedia.A, C:\Documents and Settings\K\Application Data\player\images\channel_ld_200.png, Quarantined, [fe4359147515b5819dce33f143c28977],
PUP.Optional.VPLMedia.A, C:\Documents and Settings\K\Application Data\player\images\channel_ld_201.png, Quarantined, [fe4359147515b5819dce33f143c28977],
PUP.Optional.VPLMedia.A, C:\Documents and Settings\K\Application Data\player\images\channel_ld_204.png, Quarantined, [fe4359147515b5819dce33f143c28977],
PUP.Optional.VPLMedia.A, C:\Documents and Settings\K\Application Data\player\images\channel_ld_221.png, Quarantined, [fe4359147515b5819dce33f143c28977],
PUP.Optional.VPLMedia.A, C:\Documents and Settings\K\Application Data\player\images\channel_ld_224.png, Quarantined, [fe4359147515b5819dce33f143c28977],
PUP.Optional.VPLMedia.A, C:\Documents and Settings\K\Application Data\player\images\channel_ld_28.png, Quarantined, [fe4359147515b5819dce33f143c28977],
PUP.Optional.VPLMedia.A, C:\Documents and Settings\K\Application Data\player\images\channel_ld_34.png, Quarantined, [fe4359147515b5819dce33f143c28977],
PUP.Optional.VPLMedia.A, C:\Documents and Settings\K\Application Data\player\images\channel_ld_37.png, Quarantined, [fe4359147515b5819dce33f143c28977],
PUP.Optional.VPLMedia.A, C:\Documents and Settings\K\Application Data\player\images\channel_ld_49.png, Quarantined, [fe4359147515b5819dce33f143c28977],
PUP.Optional.VPLMedia.A, C:\Documents and Settings\K\Application Data\player\images\channel_ld_57.png, Quarantined, [fe4359147515b5819dce33f143c28977],
PUP.Optional.VPLMedia.A, C:\Documents and Settings\K\Application Data\player\images\channel_ld_86.png, Quarantined, [fe4359147515b5819dce33f143c28977],
PUP.Optional.VPLMedia.A, C:\Documents and Settings\K\Application Data\player\images\channel_ld_99.png, Quarantined, [fe4359147515b5819dce33f143c28977],
PUP.Optional.VPLMedia.A, C:\Documents and Settings\K\Application Data\player\images\channel_ld_120.png, Quarantined, [fe4359147515b5819dce33f143c28977],
PUP.Optional.VPLMedia.A, C:\Documents and Settings\K\Application Data\player\images\channel_ld_121.png, Quarantined, [fe4359147515b5819dce33f143c28977],
PUP.Optional.VPLMedia.A, C:\Documents and Settings\K\Application Data\player\images\channel_ld_122.png, Quarantined, [fe4359147515b5819dce33f143c28977],
PUP.Optional.VPLMedia.A, C:\Documents and Settings\K\Application Data\player\images\channel_ld_123.png, Quarantined, [fe4359147515b5819dce33f143c28977],
PUP.Optional.VPLMedia.A, C:\Documents and Settings\K\Application Data\player\images\channel_ld_124.png, Quarantined, [fe4359147515b5819dce33f143c28977],
PUP.Optional.VPLMedia.A, C:\Documents and Settings\K\Application Data\player\images\channel_ld_125.png, Quarantined, [fe4359147515b5819dce33f143c28977],
PUP.Optional.VPLMedia.A, C:\Documents and Settings\K\Application Data\player\images\channel_ld_126.png, Quarantined, [fe4359147515b5819dce33f143c28977],
PUP.Optional.VPLMedia.A, C:\Documents and Settings\K\Application Data\player\images\channel_ld_127.png, Quarantined, [fe4359147515b5819dce33f143c28977],
PUP.Optional.VPLMedia.A, C:\Documents and Settings\K\Application Data\player\images\channel_ld_136.png, Quarantined, [fe4359147515b5819dce33f143c28977],
PUP.Optional.VPLMedia.A, C:\Documents and Settings\K\Application Data\player\images\channel_ld_137.png, Quarantined, [fe4359147515b5819dce33f143c28977],
PUP.Optional.VPLMedia.A, C:\Documents and Settings\K\Application Data\player\images\channel_ld_140.png, Quarantined, [fe4359147515b5819dce33f143c28977],
PUP.Optional.VPLMedia.A, C:\Documents and Settings\K\Application Data\player\images\channel_ld_141.png, Quarantined, [fe4359147515b5819dce33f143c28977],
PUP.Optional.VPLMedia.A, C:\Documents and Settings\K\Application Data\player\images\channel_ld_149.png, Quarantined, [fe4359147515b5819dce33f143c28977],
PUP.Optional.VPLMedia.A, C:\Documents and Settings\K\Application Data\player\images\channel_ld_150.png, Quarantined, [fe4359147515b5819dce33f143c28977],
PUP.Optional.VPLMedia.A, C:\Documents and Settings\K\Application Data\player\images\channel_ld_160.png, Quarantined, [fe4359147515b5819dce33f143c28977],
PUP.Optional.VPLMedia.A, C:\Documents and Settings\K\Application Data\player\images\channel_ld_165.png, Quarantined, [fe4359147515b5819dce33f143c28977],
PUP.Optional.VPLMedia.A, C:\Documents and Settings\K\Application Data\player\images\channel_ld_181.png, Quarantined, [fe4359147515b5819dce33f143c28977],
PUP.Optional.VPLMedia.A, C:\Documents and Settings\K\Application Data\player\images\channel_ld_191.png, Quarantined, [fe4359147515b5819dce33f143c28977],
PUP.Optional.Vitruvian.A, C:\Documents and Settings\K\Local Settings\Temp\vitruvian-installer-hardwareprofile-v0001, Quarantined, [6bd6d9946d1d9e98a5ecfc52709523dd],
PUP.Optional.Vitruvian.A, C:\Documents and Settings\K\Local Settings\Temp\vitruvian-installer-install-v0003, Quarantined, [4df434396525ee4893fe5ef01de833cd],
PUP.Optional.Vitruvian.A, C:\Documents and Settings\K\Local Settings\Temp\vitruvian-installer-processes-v0002, Quarantined, [49f8c2aba2e869cd3a574c029a6bdc24],
PUP.Optional.Vitruvian.A, C:\Documents and Settings\K\Local Settings\Temp\vitruvian-installer-uninstall-v0002, Quarantined, [370aacc1f3973ff7b1e008467095af51],
PUP.Optional.Conduit.C, C:\Documents and Settings\K\Local Settings\Application Data\CRE\opfedmikikmahmpaimpfelmikhaigobp.crx, Quarantined, [9aa77feee8a2310526120c454fb6a25e],
PUP.Optional.MultiPlug.A, C:\Documents and Settings\Administrator\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\bnhfdipdlocbfkdgekmajkeodklniiae\2.1\lsdb.js, Quarantined, [80c1c7a6bcce7cba43a4f95c759011ef],
PUP.Optional.MultiPlug.A, C:\Documents and Settings\Administrator\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\bnhfdipdlocbfkdgekmajkeodklniiae\2.1\background.html, Quarantined, [80c1c7a6bcce7cba43a4f95c759011ef],
PUP.Optional.MultiPlug.A, C:\Documents and Settings\Administrator\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\bnhfdipdlocbfkdgekmajkeodklniiae\2.1\content.js, Quarantined, [80c1c7a6bcce7cba43a4f95c759011ef],
PUP.Optional.MultiPlug.A, C:\Documents and Settings\Administrator\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\bnhfdipdlocbfkdgekmajkeodklniiae\2.1\manifest.json, Quarantined, [80c1c7a6bcce7cba43a4f95c759011ef],
PUP.Optional.MultiPlug.A, C:\Documents and Settings\Administrator\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\bnhfdipdlocbfkdgekmajkeodklniiae\2.1\newtab.html, Quarantined, [80c1c7a6bcce7cba43a4f95c759011ef],
PUP.Optional.MultiPlug.A, C:\Documents and Settings\Administrator\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\bnhfdipdlocbfkdgekmajkeodklniiae\2.1\VZny10RMk7.js, Quarantined, [80c1c7a6bcce7cba43a4f95c759011ef],
PUP.Optional.MultiPlug.A, C:\Documents and Settings\Administrator\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\ohlencieiipommannpdfcmfdpjjmeolj\127\lsdb.js, Quarantined, [5fe299d41971d06623c462f3ed182bd5],
PUP.Optional.MultiPlug.A, C:\Documents and Settings\Administrator\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\ohlencieiipommannpdfcmfdpjjmeolj\127\background.html, Quarantined, [5fe299d41971d06623c462f3ed182bd5],
PUP.Optional.MultiPlug.A, C:\Documents and Settings\Administrator\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\ohlencieiipommannpdfcmfdpjjmeolj\127\content.js, Quarantined, [5fe299d41971d06623c462f3ed182bd5],
PUP.Optional.MultiPlug.A, C:\Documents and Settings\Administrator\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\ohlencieiipommannpdfcmfdpjjmeolj\127\KMwsZ.js, Quarantined, [5fe299d41971d06623c462f3ed182bd5],
PUP.Optional.MultiPlug.A, C:\Documents and Settings\Administrator\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\ohlencieiipommannpdfcmfdpjjmeolj\127\manifest.json, Quarantined, [5fe299d41971d06623c462f3ed182bd5],
PUP.Optional.MultiPlug.A, C:\Documents and Settings\Guest\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\bnhfdipdlocbfkdgekmajkeodklniiae\2.1\lsdb.js, Quarantined, [0f3277f618727abc7374c49115f09769],
PUP.Optional.MultiPlug.A, C:\Documents and Settings\Guest\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\bnhfdipdlocbfkdgekmajkeodklniiae\2.1\background.html, Quarantined, [0f3277f618727abc7374c49115f09769],
PUP.Optional.MultiPlug.A, C:\Documents and Settings\Guest\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\bnhfdipdlocbfkdgekmajkeodklniiae\2.1\content.js, Quarantined, [0f3277f618727abc7374c49115f09769],
PUP.Optional.MultiPlug.A, C:\Documents and Settings\Guest\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\bnhfdipdlocbfkdgekmajkeodklniiae\2.1\manifest.json, Quarantined, [0f3277f618727abc7374c49115f09769],
PUP.Optional.MultiPlug.A, C:\Documents and Settings\Guest\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\bnhfdipdlocbfkdgekmajkeodklniiae\2.1\newtab.html, Quarantined, [0f3277f618727abc7374c49115f09769],
PUP.Optional.MultiPlug.A, C:\Documents and Settings\Guest\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\bnhfdipdlocbfkdgekmajkeodklniiae\2.1\VZny10RMk7.js, Quarantined, [0f3277f618727abc7374c49115f09769],
PUP.Optional.MultiPlug.A, C:\Documents and Settings\Guest\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\ohlencieiipommannpdfcmfdpjjmeolj\127\lsdb.js, Quarantined, [1928234aafdb55e1ebfc540152b34eb2],
PUP.Optional.MultiPlug.A, C:\Documents and Settings\Guest\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\ohlencieiipommannpdfcmfdpjjmeolj\127\background.html, Quarantined, [1928234aafdb55e1ebfc540152b34eb2],
PUP.Optional.MultiPlug.A, C:\Documents and Settings\Guest\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\ohlencieiipommannpdfcmfdpjjmeolj\127\content.js, Quarantined, [1928234aafdb55e1ebfc540152b34eb2],
PUP.Optional.MultiPlug.A, C:\Documents and Settings\Guest\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\ohlencieiipommannpdfcmfdpjjmeolj\127\KMwsZ.js, Quarantined, [1928234aafdb55e1ebfc540152b34eb2],
PUP.Optional.MultiPlug.A, C:\Documents and Settings\Guest\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\ohlencieiipommannpdfcmfdpjjmeolj\127\manifest.json, Quarantined, [1928234aafdb55e1ebfc540152b34eb2],
PUP.Optional.MultiPlug.A, C:\Documents and Settings\HelpAssistant\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\bnhfdipdlocbfkdgekmajkeodklniiae\2.1\lsdb.js, Quarantined, [62dfbeaf2169f541df086beab94c5fa1],
PUP.Optional.MultiPlug.A, C:\Documents and Settings\HelpAssistant\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\bnhfdipdlocbfkdgekmajkeodklniiae\2.1\background.html, Quarantined, [62dfbeaf2169f541df086beab94c5fa1],
PUP.Optional.MultiPlug.A, C:\Documents and Settings\HelpAssistant\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\bnhfdipdlocbfkdgekmajkeodklniiae\2.1\content.js, Quarantined, [62dfbeaf2169f541df086beab94c5fa1],
PUP.Optional.MultiPlug.A, C:\Documents and Settings\HelpAssistant\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\bnhfdipdlocbfkdgekmajkeodklniiae\2.1\manifest.json, Quarantined, [62dfbeaf2169f541df086beab94c5fa1],
PUP.Optional.MultiPlug.A, C:\Documents and Settings\HelpAssistant\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\bnhfdipdlocbfkdgekmajkeodklniiae\2.1\newtab.html, Quarantined, [62dfbeaf2169f541df086beab94c5fa1],
PUP.Optional.MultiPlug.A, C:\Documents and Settings\HelpAssistant\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\bnhfdipdlocbfkdgekmajkeodklniiae\2.1\VZny10RMk7.js, Quarantined, [62dfbeaf2169f541df086beab94c5fa1],
PUP.Optional.MultiPlug.A, C:\Documents and Settings\HelpAssistant\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\ohlencieiipommannpdfcmfdpjjmeolj\127\lsdb.js, Quarantined, [b78ad09d1f6b280e38af4114c4412bd5],
PUP.Optional.MultiPlug.A, C:\Documents and Settings\HelpAssistant\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\ohlencieiipommannpdfcmfdpjjmeolj\127\background.html, Quarantined, [b78ad09d1f6b280e38af4114c4412bd5],
PUP.Optional.MultiPlug.A, C:\Documents and Settings\HelpAssistant\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\ohlencieiipommannpdfcmfdpjjmeolj\127\content.js, Quarantined, [b78ad09d1f6b280e38af4114c4412bd5],
PUP.Optional.MultiPlug.A, C:\Documents and Settings\HelpAssistant\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\ohlencieiipommannpdfcmfdpjjmeolj\127\KMwsZ.js, Quarantined, [b78ad09d1f6b280e38af4114c4412bd5],
PUP.Optional.MultiPlug.A, C:\Documents and Settings\HelpAssistant\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\ohlencieiipommannpdfcmfdpjjmeolj\127\manifest.json, Quarantined, [b78ad09d1f6b280e38af4114c4412bd5],
PUP.Optional.MultiPlug.A, C:\Documents and Settings\SUPPORT_388945a0\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\bnhfdipdlocbfkdgekmajkeodklniiae\2.1\lsdb.js, Quarantined, [033e0c6173179f9712d5f362f213b44c],
PUP.Optional.MultiPlug.A, C:\Documents and Settings\SUPPORT_388945a0\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\bnhfdipdlocbfkdgekmajkeodklniiae\2.1\background.html, Quarantined, [033e0c6173179f9712d5f362f213b44c],
PUP.Optional.MultiPlug.A, C:\Documents and Settings\SUPPORT_388945a0\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\bnhfdipdlocbfkdgekmajkeodklniiae\2.1\content.js, Quarantined, [033e0c6173179f9712d5f362f213b44c],
PUP.Optional.MultiPlug.A, C:\Documents and Settings\SUPPORT_388945a0\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\bnhfdipdlocbfkdgekmajkeodklniiae\2.1\manifest.json, Quarantined, [033e0c6173179f9712d5f362f213b44c],
PUP.Optional.MultiPlug.A, C:\Documents and Settings\SUPPORT_388945a0\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\bnhfdipdlocbfkdgekmajkeodklniiae\2.1\newtab.html, Quarantined, [033e0c6173179f9712d5f362f213b44c],
PUP.Optional.MultiPlug.A, C:\Documents and Settings\SUPPORT_388945a0\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\bnhfdipdlocbfkdgekmajkeodklniiae\2.1\VZny10RMk7.js, Quarantined, [033e0c6173179f9712d5f362f213b44c],
PUP.Optional.MultiPlug.A, C:\Documents and Settings\SUPPORT_388945a0\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\ohlencieiipommannpdfcmfdpjjmeolj\127\lsdb.js, Quarantined, [01402d403258fa3c2bbc4114de27a060],
PUP.Optional.MultiPlug.A, C:\Documents and Settings\SUPPORT_388945a0\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\ohlencieiipommannpdfcmfdpjjmeolj\127\background.html, Quarantined, [01402d403258fa3c2bbc4114de27a060],
PUP.Optional.MultiPlug.A, C:\Documents and Settings\SUPPORT_388945a0\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\ohlencieiipommannpdfcmfdpjjmeolj\127\content.js, Quarantined, [01402d403258fa3c2bbc4114de27a060],
PUP.Optional.MultiPlug.A, C:\Documents and Settings\SUPPORT_388945a0\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\ohlencieiipommannpdfcmfdpjjmeolj\127\KMwsZ.js, Quarantined, [01402d403258fa3c2bbc4114de27a060],
PUP.Optional.MultiPlug.A, C:\Documents and Settings\SUPPORT_388945a0\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\ohlencieiipommannpdfcmfdpjjmeolj\127\manifest.json, Quarantined, [01402d403258fa3c2bbc4114de27a060],
PUP.Optional.MultiPlug.A, C:\Documents and Settings\K\Local Settings\Application Data\4C4C4544-1428345377-5010-805A-B9C04F533231\onsi14C.tmp, Quarantined, [aa97ec8199f19e98d617e76e61a446ba],
PUP.Optional.MultiPlug.A, C:\Documents and Settings\K\Local Settings\Application Data\4C4C4544-1428345377-5010-805A-B9C04F533231\pnso14D.exe, Quarantined, [aa97ec8199f19e98d617e76e61a446ba],
PUP.Optional.MultiPlug.A, C:\Documents and Settings\K\Local Settings\Application Data\4C4C4544-1428345377-5010-805A-B9C04F533231\rnsi14B.exe, Quarantined, [aa97ec8199f19e98d617e76e61a446ba],
PUP.Optional.MultiPlug.A, C:\Documents and Settings\K\Local Settings\Application Data\4C4C4544-1428345377-5010-805A-B9C04F533231\snsi14A.tmp, Quarantined, [aa97ec8199f19e98d617e76e61a446ba],
PUP.Optional.MultiPlug.A, C:\Documents and Settings\K\Local Settings\Application Data\4C4C4544-1428345377-5010-805A-B9C04F533231\Uninstall.exe, Quarantined, [aa97ec8199f19e98d617e76e61a446ba],
PUP.Optional.MultiPlug.A, C:\Documents and Settings\K\Application Data\Mozilla\Firefox\Profiles\8aymfdzx.default\extensions\gliuyio@batooouaiei.com\content\bg.js, Quarantined, [cb76f6776822cc6a29cc1045f70e6799],
PUP.Optional.MultiPlug.A, C:\Documents and Settings\K\Application Data\Mozilla\Firefox\Profiles\8aymfdzx.default\extensions\gliuyio@batooouaiei.com\bootstrap.js, Quarantined, [cb76f6776822cc6a29cc1045f70e6799],
PUP.Optional.MultiPlug.A, C:\Documents and Settings\K\Application Data\Mozilla\Firefox\Profiles\8aymfdzx.default\extensions\gliuyio@batooouaiei.com\install.rdf, Quarantined, [cb76f6776822cc6a29cc1045f70e6799],
PUP.Optional.WebCake.A, C:\Documents and Settings\Fresh\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\fjoijdanhaiflhibkljeklcghcmmfffh\1.0.3_0\background.js, Quarantined, [57ea006d3a50e6500d3cb8d8a65d37c9],
PUP.Optional.WebCake.A, C:\Documents and Settings\Fresh\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\fjoijdanhaiflhibkljeklcghcmmfffh\1.0.3_0\manifest.json, Quarantined, [57ea006d3a50e6500d3cb8d8a65d37c9],
PUP.Optional.WebCake.A, C:\Documents and Settings\Fresh\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\fjoijdanhaiflhibkljeklcghcmmfffh\1.0.3_0\wc_48.png, Quarantined, [57ea006d3a50e6500d3cb8d8a65d37c9],
PUP.Optional.WebCake.A, C:\Documents and Settings\Fresh\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\fjoijdanhaiflhibkljeklcghcmmfffh\1.0.3_0\yl.js, Quarantined, [57ea006d3a50e6500d3cb8d8a65d37c9],
PUP.Optional.GlobalUpdate.A, C:\Documents and Settings\K\Local Settings\Temp\comh.106784\GoogleUpdateHelper.msi, Quarantined, [0f32ff6e0a8066d05d04edb4ee154bb5],
PUP.Optional.GlobalUpdate.A, C:\Documents and Settings\K\Local Settings\Temp\comh.326381\GoogleUpdateHelper.msi, Quarantined, [e65bcda06426c37366fb5f42c93ae719],
PUP.Optional.StormWatch.A, C:\WINDOWS\system32\config\systemprofile\Local Settings\Application Data\Weather_Protector_LLC\StormWatch.exe_Url_drszjp3ixrql2l5dz2b2jvlplwn11r4l\2.0.0.0\user.config, Quarantined, [e45d3d300189181e1e119c100ef5639d],
PUP.Optional.WList.A, C:\Documents and Settings\K\Application Data\{D2020D47-707D-4E26-B4D9-739C4F4C2E9A}\{FBC0652C-7B29-4FB6-8ADA-91F54B267AD4}\1.5\config.js, Quarantined, [95ac64093357a492d5a0397439caf30d],
PUP.Optional.WList.A, C:\Documents and Settings\K\Application Data\{D2020D47-707D-4E26-B4D9-739C4F4C2E9A}\{FBC0652C-7B29-4FB6-8ADA-91F54B267AD4}\1.5\tree.js, Quarantined, [95ac64093357a492d5a0397439caf30d],
PUP.Optional.WList.A, C:\Documents and Settings\K\Application Data\{D2020D47-707D-4E26-B4D9-739C4F4C2E9A}\{FBC0652C-7B29-4FB6-8ADA-91F54B267AD4}\1.5\wlist.js, Quarantined, [95ac64093357a492d5a0397439caf30d],
PUP.Optional.WList.A, C:\Documents and Settings\LocalService\Local Settings\Application Data\{D2020D47-707D-4E26-B4D9-739C4F4C2E9A}\{FBC0652C-7B29-4FB6-8ADA-91F54B267AD4}\1.5\config.js, Quarantined, [64ddf5780f7bfc3ad82f7e34fc0719e7],
PUP.Optional.WList.A, C:\Documents and Settings\LocalService\Local Settings\Application Data\{D2020D47-707D-4E26-B4D9-739C4F4C2E9A}\{FBC0652C-7B29-4FB6-8ADA-91F54B267AD4}\1.5\sts.js, Quarantined, [64ddf5780f7bfc3ad82f7e34fc0719e7],
PUP.Optional.WList.A, C:\Documents and Settings\LocalService\Local Settings\Application Data\{D2020D47-707D-4E26-B4D9-739C4F4C2E9A}\{FBC0652C-7B29-4FB6-8ADA-91F54B267AD4}\1.5\wlist.js, Quarantined, [64ddf5780f7bfc3ad82f7e34fc0719e7],
PUP.Optional.SmileysWeLove.A, C:\Documents and Settings\K\Application Data\SmileysWeLove\swl_altPopupFile.htm, Quarantined, [41001e4fd5b58aacc776783e34cf847c],
PUP.Optional.SmileysWeLove.A, C:\Documents and Settings\K\Application Data\SmileysWeLove\swl_chatPopupFile.htm, Quarantined, [41001e4fd5b58aacc776783e34cf847c],
PUP.Optional.SmileysWeLove.A, C:\Documents and Settings\K\Application Data\SmileysWeLove\swl_popupFile.htm, Quarantined, [41001e4fd5b58aacc776783e34cf847c],
PUP.Optional.YouTubeDownloadPool.A, C:\Program Files\YouTube Download Pool\G4\load_config.ini, Quarantined, [ea571f4eaddd290d8e05ebd256ad8977],
PUP.Optional.YouTubeDownloadPool.A, C:\Program Files\YouTube Download Pool\G4\netclean.exe, Quarantined, [ea571f4eaddd290d8e05ebd256ad8977],
PUP.Optional.YouTubeDownloadPool.A, C:\Program Files\YouTube Download Pool\G4\youtubeserv.exe, Quarantined, [ea571f4eaddd290d8e05ebd256ad8977],
PUP.Optional.YouTubeDownloadPool.A, C:\Program Files\YouTube Download Pool\G4\config\load_config.ini, Quarantined, [ea571f4eaddd290d8e05ebd256ad8977],
PUP.Optional.Crossbrowse.C, C:\Documents and Settings\Fresh\Local Settings\Application Data\Crossbrowse\Crossbrowse\User Data\Local State, Quarantined, [56eb1c5109817cba3991dde013f045bb],
PUP.Optional.Crossbrowse.C, C:\Documents and Settings\Fresh\Local Settings\Application Data\Crossbrowse\Crossbrowse\User Data\Default\Bookmarks, Quarantined, [56eb1c5109817cba3991dde013f045bb],
PUP.Optional.Crossbrowse.C, C:\Documents and Settings\Fresh\Local Settings\Application Data\Crossbrowse\Crossbrowse\User Data\Default\Cookies, Quarantined, [56eb1c5109817cba3991dde013f045bb],
PUP.Optional.Crossbrowse.C, C:\Documents and Settings\Fresh\Local Settings\Application Data\Crossbrowse\Crossbrowse\User Data\Default\Current Session, Quarantined, [56eb1c5109817cba3991dde013f045bb],
PUP.Optional.Crossbrowse.C, C:\Documents and Settings\Fresh\Local Settings\Application Data\Crossbrowse\Crossbrowse\User Data\Default\Current Tabs, Quarantined, [56eb1c5109817cba3991dde013f045bb],
PUP.Optional.Crossbrowse.C, C:\Documents and Settings\Fresh\Local Settings\Application Data\Crossbrowse\Crossbrowse\User Data\Default\Favicons, Quarantined, [56eb1c5109817cba3991dde013f045bb],
PUP.Optional.Crossbrowse.C, C:\Documents and Settings\Fresh\Local Settings\Application Data\Crossbrowse\Crossbrowse\User Data\Default\History, Quarantined, [56eb1c5109817cba3991dde013f045bb],
PUP.Optional.Crossbrowse.C, C:\Documents and Settings\Fresh\Local Settings\Application Data\Crossbrowse\Crossbrowse\User Data\Default\Last Session, Quarantined, [56eb1c5109817cba3991dde013f045bb],
PUP.Optional.Crossbrowse.C, C:\Documents and Settings\Fresh\Local Settings\Application Data\Crossbrowse\Crossbrowse\User Data\Default\Last Tabs, Quarantined, [56eb1c5109817cba3991dde013f045bb],
PUP.Optional.Crossbrowse.C, C:\Documents and Settings\Fresh\Local Settings\Application Data\Crossbrowse\Crossbrowse\User Data\Default\Shortcuts, Quarantined, [56eb1c5109817cba3991dde013f045bb],
PUP.Optional.Crossbrowse.C, C:\Documents and Settings\Fresh\Local Settings\Application Data\Crossbrowse\Crossbrowse\User Data\Default\Top Sites, Quarantined, [56eb1c5109817cba3991dde013f045bb],
PUP.Optional.Crossbrowse.C, C:\Documents and Settings\Fresh\Local Settings\Application Data\Crossbrowse\Crossbrowse\User Data\Default\Visited Links, Quarantined, [56eb1c5109817cba3991dde013f045bb],

Physical Sectors: 0
(No malicious items detected)


(end)
 
# AdwCleaner v4.201 - Logfile created 16/04/2015 at 03:00:04
# Updated 08/04/2015 by Xplode
# Database : 2015-04-15.1 [Server]
# Operating system : Microsoft Windows XP Service Pack 3 (x86)
# Username : K - DESTINY
# Running from : C:\Documents and Settings\K\Desktop\adwcleaner_4.201.exe
# Option : Cleaning

***** [ Services ] *****


***** [ Files / Folders ] *****


***** [ Scheduled tasks ] *****


***** [ Shortcuts ] *****


***** [ Registry ] *****

Key Deleted : HKLM\SOFTWARE\WebProtect

***** [ Web browsers ] *****

-\\ Internet Explorer v8.0.6001.18702


-\\ Mozilla Firefox v


-\\ Google Chrome v


-\\ Comodo Dragon v


-\\ Chrome Canary v


*************************

AdwCleaner[R0].txt - [8150 bytes] - [11/04/2015 18:36:34]
AdwCleaner[R1].txt - [21911 bytes] - [11/04/2015 18:58:00]
AdwCleaner[R2].txt - [1728 bytes] - [11/04/2015 19:40:42]
AdwCleaner[R3].txt - [1216 bytes] - [16/04/2015 02:56:24]
AdwCleaner[S0].txt - [8039 bytes] - [11/04/2015 18:40:12]
AdwCleaner[S1].txt - [22408 bytes] - [11/04/2015 19:03:33]
AdwCleaner[S2].txt - [1758 bytes] - [11/04/2015 19:48:43]
AdwCleaner[S3].txt - [1144 bytes] - [16/04/2015 03:00:04]

########## EOF - C:\AdwCleaner\AdwCleaner[S3].txt - [1203 bytes] ##########
 
I tried running the junkremoval tool, but once it gets to 'checking startup' It stops and says 'file not found'
 
That's fine.

Please download ComboFix from Here, Here or Here to your Desktop.

**Note: In the event you already have Combofix, this is a new version that I need you to download. It is important that it is saved directly to your desktop**
  • Never rename Combofix unless instructed.
  • Close any open browsers.
  • Very Important! Temporarily disable your anti-virus and any anti-malware real-time protection before performing a scan. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
  • Click on this link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.
  • Close any open browsers.
  • WARNING: Combofix will disconnect your machine from the Internet as soon as it starts
  • Please do not attempt to re-connect your machine back to the Internet until Combofix has completely finished.
  • If there is no internet connection after running Combofix, then restart your computer to restore back your connection.
    If the connection is not there use restore point you created prior to running Combofix.
  • Double click on combofix.exe & follow the prompts.

  • NOTE1. If Combofix asks you to install Recovery Console, please allow it.
    NOTE 2. If Combofix asks you to update the program, always do so.
  • When finished, it will produce a report for you.
  • Please post the "C:\ComboFix.txt"
**Note 1: Do not mouseclick combofix's window while it's running. That may cause it to stall
**Note 2 for AVG and CA Internet Security (Total Defense Internet Security) users: ComboFix will not run until AVG/CA Internet Security is uninstalled as a protective measure against the anti-virus. This is because AVG/CA Internet Security "falsely" detects ComboFix (or its embedded files) as a threat and may remove them resulting in the tool not working correctly which in turn can cause "unpredictable results". Since AVG/CA Internet Security cannot be effectively disabled before running ComboFix, the author recommends you to uninstall AVG/CA Internet Security first.
Use AppRemover to uninstall it: https://www.techspot.com/downloads/5514-appremover.html
We can reinstall it when we're done with CF.
**Note 3: If you receive an error Illegal operation attempted on a registery key that has been marked for deletion, restart computer to fix the issue.
**Note 4: Some infections may take some significant time to be cured. As long as your computer clock is running Combofix is still working. Be patient.


Make sure, you re-enable your security programs, when you're done with Combofix.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

NOTE.
If, for some reason, Combofix refuses to run, try the following...

Delete Combofix file, download fresh one, but rename combofix.exe to your_name.exe BEFORE saving it to your desktop.
Do NOT run it yet.
Download Rkill (courtesy of BleepingComputer.com) to your desktop.
There are 2 different versions. If one of them won't run then download and try to run the other one.
You only need to get one of these to run, not all of them. You may get warnings from your antivirus about this tool, ignore them or shutdown your antivirus.

rKill.exe: http://www.bleepingcomputer.com/download/rkill/dl/10/
iExplore.exe (renamed rKill.exe): http://www.bleepingcomputer.com/download/rkill/dl/11/

Restart computer in safe mode

  • Double-click on the Rkill desktop icon to run the tool.
  • If using Windows Vista, 7 or 8 right-click on it and choose Run As Administrator.
  • A black DOS box will briefly flash and then disappear. This is normal and indicates the tool ran successfully.
  • If not, delete the file, then download and use the one provided in Link 2.
  • Do not reboot until instructed.
  • If the tool does not run from any of the links provided, please let me know.

When the scan is done Notepad will open with rKill.txt log.
NOTE. rKill.txt log will also be present on your desktop.

Once you've gotten one of them to run, immediately run your_name.exe by double clicking on it.

IF you had to run rKill post BOTH logs, rKill.txt and Combofix.txt.
 
ComboFix 15-04-16.01 - K 04/16/2015 19:44:18.1.1 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.1023.393 [GMT -6:00]
Running from: c:\documents and settings\K\Desktop\ComboFix.exe
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\documents and settings\Administrator\Local Settings\Application Data\Comodo\Dragon\User Data\Default\Extensions\bnhfdipdlocbfkdgekmajkeodklniiae
c:\documents and settings\Administrator\Local Settings\Application Data\Comodo\Dragon\User Data\Default\Extensions\bnhfdipdlocbfkdgekmajkeodklniiae\2.1\background.html
c:\documents and settings\Administrator\Local Settings\Application Data\Comodo\Dragon\User Data\Default\Extensions\bnhfdipdlocbfkdgekmajkeodklniiae\2.1\content.js
c:\documents and settings\Administrator\Local Settings\Application Data\Comodo\Dragon\User Data\Default\Extensions\bnhfdipdlocbfkdgekmajkeodklniiae\2.1\lsdb.js
c:\documents and settings\Administrator\Local Settings\Application Data\Comodo\Dragon\User Data\Default\Extensions\bnhfdipdlocbfkdgekmajkeodklniiae\2.1\manifest.json
c:\documents and settings\Administrator\Local Settings\Application Data\Comodo\Dragon\User Data\Default\Extensions\bnhfdipdlocbfkdgekmajkeodklniiae\2.1\newtab.html
c:\documents and settings\Administrator\Local Settings\Application Data\Comodo\Dragon\User Data\Default\Extensions\bnhfdipdlocbfkdgekmajkeodklniiae\2.1\VZny10RMk7.js
c:\documents and settings\Administrator\Local Settings\Application Data\Comodo\Dragon\User Data\Default\Extensions\ohlencieiipommannpdfcmfdpjjmeolj
c:\documents and settings\Administrator\Local Settings\Application Data\Comodo\Dragon\User Data\Default\Extensions\ohlencieiipommannpdfcmfdpjjmeolj\127\background.html
c:\documents and settings\Administrator\Local Settings\Application Data\Comodo\Dragon\User Data\Default\Extensions\ohlencieiipommannpdfcmfdpjjmeolj\127\content.js
c:\documents and settings\Administrator\Local Settings\Application Data\Comodo\Dragon\User Data\Default\Extensions\ohlencieiipommannpdfcmfdpjjmeolj\127\KMwsZ.js
c:\documents and settings\Administrator\Local Settings\Application Data\Comodo\Dragon\User Data\Default\Extensions\ohlencieiipommannpdfcmfdpjjmeolj\127\lsdb.js
c:\documents and settings\Administrator\Local Settings\Application Data\Comodo\Dragon\User Data\Default\Extensions\ohlencieiipommannpdfcmfdpjjmeolj\127\manifest.json
c:\documents and settings\Administrator\Local Settings\Application Data\Google\Chrome SxS\User Data\Default\Extensions\bnhfdipdlocbfkdgekmajkeodklniiae
c:\documents and settings\Administrator\Local Settings\Application Data\Google\Chrome SxS\User Data\Default\Extensions\bnhfdipdlocbfkdgekmajkeodklniiae\2.1\background.html
c:\documents and settings\Administrator\Local Settings\Application Data\Google\Chrome SxS\User Data\Default\Extensions\bnhfdipdlocbfkdgekmajkeodklniiae\2.1\content.js
c:\documents and settings\Administrator\Local Settings\Application Data\Google\Chrome SxS\User Data\Default\Extensions\bnhfdipdlocbfkdgekmajkeodklniiae\2.1\lsdb.js
c:\documents and settings\Administrator\Local Settings\Application Data\Google\Chrome SxS\User Data\Default\Extensions\bnhfdipdlocbfkdgekmajkeodklniiae\2.1\manifest.json
c:\documents and settings\Administrator\Local Settings\Application Data\Google\Chrome SxS\User Data\Default\Extensions\bnhfdipdlocbfkdgekmajkeodklniiae\2.1\newtab.html
c:\documents and settings\Administrator\Local Settings\Application Data\Google\Chrome SxS\User Data\Default\Extensions\bnhfdipdlocbfkdgekmajkeodklniiae\2.1\VZny10RMk7.js
c:\documents and settings\Administrator\Local Settings\Application Data\Google\Chrome SxS\User Data\Default\Extensions\ohlencieiipommannpdfcmfdpjjmeolj
c:\documents and settings\Administrator\Local Settings\Application Data\Google\Chrome SxS\User Data\Default\Extensions\ohlencieiipommannpdfcmfdpjjmeolj\127\background.html
c:\documents and settings\Administrator\Local Settings\Application Data\Google\Chrome SxS\User Data\Default\Extensions\ohlencieiipommannpdfcmfdpjjmeolj\127\content.js
c:\documents and settings\Administrator\Local Settings\Application Data\Google\Chrome SxS\User Data\Default\Extensions\ohlencieiipommannpdfcmfdpjjmeolj\127\KMwsZ.js
c:\documents and settings\Administrator\Local Settings\Application Data\Google\Chrome SxS\User Data\Default\Extensions\ohlencieiipommannpdfcmfdpjjmeolj\127\lsdb.js
c:\documents and settings\Administrator\Local Settings\Application Data\Google\Chrome SxS\User Data\Default\Extensions\ohlencieiipommannpdfcmfdpjjmeolj\127\manifest.json
c:\documents and settings\All Users\Application Data\TEMP
c:\documents and settings\All Users\Application Data\TEMP\058E79EB.TMP
c:\documents and settings\All Users\Application Data\TEMP\RAIDTest
c:\documents and settings\Guest\Local Settings\Application Data\Comodo\Dragon\User Data\Default\Extensions\bnhfdipdlocbfkdgekmajkeodklniiae
c:\documents and settings\Guest\Local Settings\Application Data\Comodo\Dragon\User Data\Default\Extensions\bnhfdipdlocbfkdgekmajkeodklniiae\2.1\background.html
c:\documents and settings\Guest\Local Settings\Application Data\Comodo\Dragon\User Data\Default\Extensions\bnhfdipdlocbfkdgekmajkeodklniiae\2.1\content.js
c:\documents and settings\Guest\Local Settings\Application Data\Comodo\Dragon\User Data\Default\Extensions\bnhfdipdlocbfkdgekmajkeodklniiae\2.1\lsdb.js
c:\documents and settings\Guest\Local Settings\Application Data\Comodo\Dragon\User Data\Default\Extensions\bnhfdipdlocbfkdgekmajkeodklniiae\2.1\manifest.json
c:\documents and settings\Guest\Local Settings\Application Data\Comodo\Dragon\User Data\Default\Extensions\bnhfdipdlocbfkdgekmajkeodklniiae\2.1\newtab.html
c:\documents and settings\Guest\Local Settings\Application Data\Comodo\Dragon\User Data\Default\Extensions\bnhfdipdlocbfkdgekmajkeodklniiae\2.1\VZny10RMk7.js
c:\documents and settings\Guest\Local Settings\Application Data\Comodo\Dragon\User Data\Default\Extensions\ohlencieiipommannpdfcmfdpjjmeolj
c:\documents and settings\Guest\Local Settings\Application Data\Comodo\Dragon\User Data\Default\Extensions\ohlencieiipommannpdfcmfdpjjmeolj\127\background.html
c:\documents and settings\Guest\Local Settings\Application Data\Comodo\Dragon\User Data\Default\Extensions\ohlencieiipommannpdfcmfdpjjmeolj\127\content.js
c:\documents and settings\Guest\Local Settings\Application Data\Comodo\Dragon\User Data\Default\Extensions\ohlencieiipommannpdfcmfdpjjmeolj\127\KMwsZ.js
c:\documents and settings\Guest\Local Settings\Application Data\Comodo\Dragon\User Data\Default\Extensions\ohlencieiipommannpdfcmfdpjjmeolj\127\lsdb.js
c:\documents and settings\Guest\Local Settings\Application Data\Comodo\Dragon\User Data\Default\Extensions\ohlencieiipommannpdfcmfdpjjmeolj\127\manifest.json
c:\documents and settings\Guest\Local Settings\Application Data\Google\Chrome SxS\User Data\Default\Extensions\bnhfdipdlocbfkdgekmajkeodklniiae
c:\documents and settings\Guest\Local Settings\Application Data\Google\Chrome SxS\User Data\Default\Extensions\bnhfdipdlocbfkdgekmajkeodklniiae\2.1\background.html
c:\documents and settings\Guest\Local Settings\Application Data\Google\Chrome SxS\User Data\Default\Extensions\bnhfdipdlocbfkdgekmajkeodklniiae\2.1\content.js
c:\documents and settings\Guest\Local Settings\Application Data\Google\Chrome SxS\User Data\Default\Extensions\bnhfdipdlocbfkdgekmajkeodklniiae\2.1\lsdb.js
c:\documents and settings\Guest\Local Settings\Application Data\Google\Chrome SxS\User Data\Default\Extensions\bnhfdipdlocbfkdgekmajkeodklniiae\2.1\manifest.json
c:\documents and settings\Guest\Local Settings\Application Data\Google\Chrome SxS\User Data\Default\Extensions\bnhfdipdlocbfkdgekmajkeodklniiae\2.1\newtab.html
c:\documents and settings\Guest\Local Settings\Application Data\Google\Chrome SxS\User Data\Default\Extensions\bnhfdipdlocbfkdgekmajkeodklniiae\2.1\VZny10RMk7.js
c:\documents and settings\Guest\Local Settings\Application Data\Google\Chrome SxS\User Data\Default\Extensions\ohlencieiipommannpdfcmfdpjjmeolj
c:\documents and settings\Guest\Local Settings\Application Data\Google\Chrome SxS\User Data\Default\Extensions\ohlencieiipommannpdfcmfdpjjmeolj\127\background.html
c:\documents and settings\Guest\Local Settings\Application Data\Google\Chrome SxS\User Data\Default\Extensions\ohlencieiipommannpdfcmfdpjjmeolj\127\content.js
c:\documents and settings\Guest\Local Settings\Application Data\Google\Chrome SxS\User Data\Default\Extensions\ohlencieiipommannpdfcmfdpjjmeolj\127\KMwsZ.js
c:\documents and settings\Guest\Local Settings\Application Data\Google\Chrome SxS\User Data\Default\Extensions\ohlencieiipommannpdfcmfdpjjmeolj\127\lsdb.js
c:\documents and settings\Guest\Local Settings\Application Data\Google\Chrome SxS\User Data\Default\Extensions\ohlencieiipommannpdfcmfdpjjmeolj\127\manifest.json
c:\documents and settings\HelpAssistant\Local Settings\Application Data\Comodo\Dragon\User Data\Default\Extensions\bnhfdipdlocbfkdgekmajkeodklniiae
c:\documents and settings\HelpAssistant\Local Settings\Application Data\Comodo\Dragon\User Data\Default\Extensions\bnhfdipdlocbfkdgekmajkeodklniiae\2.1\background.html
c:\documents and settings\HelpAssistant\Local Settings\Application Data\Comodo\Dragon\User Data\Default\Extensions\bnhfdipdlocbfkdgekmajkeodklniiae\2.1\content.js
c:\documents and settings\HelpAssistant\Local Settings\Application Data\Comodo\Dragon\User Data\Default\Extensions\bnhfdipdlocbfkdgekmajkeodklniiae\2.1\lsdb.js
c:\documents and settings\HelpAssistant\Local Settings\Application Data\Comodo\Dragon\User Data\Default\Extensions\bnhfdipdlocbfkdgekmajkeodklniiae\2.1\manifest.json
c:\documents and settings\HelpAssistant\Local Settings\Application Data\Comodo\Dragon\User Data\Default\Extensions\bnhfdipdlocbfkdgekmajkeodklniiae\2.1\newtab.html
c:\documents and settings\HelpAssistant\Local Settings\Application Data\Comodo\Dragon\User Data\Default\Extensions\bnhfdipdlocbfkdgekmajkeodklniiae\2.1\VZny10RMk7.js
c:\documents and settings\HelpAssistant\Local Settings\Application Data\Comodo\Dragon\User Data\Default\Extensions\ohlencieiipommannpdfcmfdpjjmeolj
c:\documents and settings\HelpAssistant\Local Settings\Application Data\Comodo\Dragon\User Data\Default\Extensions\ohlencieiipommannpdfcmfdpjjmeolj\127\background.html
c:\documents and settings\HelpAssistant\Local Settings\Application Data\Comodo\Dragon\User Data\Default\Extensions\ohlencieiipommannpdfcmfdpjjmeolj\127\content.js
c:\documents and settings\HelpAssistant\Local Settings\Application Data\Comodo\Dragon\User Data\Default\Extensions\ohlencieiipommannpdfcmfdpjjmeolj\127\KMwsZ.js
c:\documents and settings\HelpAssistant\Local Settings\Application Data\Comodo\Dragon\User Data\Default\Extensions\ohlencieiipommannpdfcmfdpjjmeolj\127\lsdb.js
c:\documents and settings\HelpAssistant\Local Settings\Application Data\Comodo\Dragon\User Data\Default\Extensions\ohlencieiipommannpdfcmfdpjjmeolj\127\manifest.json
c:\documents and settings\HelpAssistant\Local Settings\Application Data\Google\Chrome SxS\User Data\Default\Extensions\bnhfdipdlocbfkdgekmajkeodklniiae
c:\documents and settings\HelpAssistant\Local Settings\Application Data\Google\Chrome SxS\User Data\Default\Extensions\bnhfdipdlocbfkdgekmajkeodklniiae\2.1\background.html
c:\documents and settings\HelpAssistant\Local Settings\Application Data\Google\Chrome SxS\User Data\Default\Extensions\bnhfdipdlocbfkdgekmajkeodklniiae\2.1\content.js
c:\documents and settings\HelpAssistant\Local Settings\Application Data\Google\Chrome SxS\User Data\Default\Extensions\bnhfdipdlocbfkdgekmajkeodklniiae\2.1\lsdb.js
c:\documents and settings\HelpAssistant\Local Settings\Application Data\Google\Chrome SxS\User Data\Default\Extensions\bnhfdipdlocbfkdgekmajkeodklniiae\2.1\manifest.json
c:\documents and settings\HelpAssistant\Local Settings\Application Data\Google\Chrome SxS\User Data\Default\Extensions\bnhfdipdlocbfkdgekmajkeodklniiae\2.1\newtab.html
c:\documents and settings\HelpAssistant\Local Settings\Application Data\Google\Chrome SxS\User Data\Default\Extensions\bnhfdipdlocbfkdgekmajkeodklniiae\2.1\VZny10RMk7.js
c:\documents and settings\HelpAssistant\Local Settings\Application Data\Google\Chrome SxS\User Data\Default\Extensions\ohlencieiipommannpdfcmfdpjjmeolj
c:\documents and settings\HelpAssistant\Local Settings\Application Data\Google\Chrome SxS\User Data\Default\Extensions\ohlencieiipommannpdfcmfdpjjmeolj\127\background.html
c:\documents and settings\HelpAssistant\Local Settings\Application Data\Google\Chrome SxS\User Data\Default\Extensions\ohlencieiipommannpdfcmfdpjjmeolj\127\content.js
c:\documents and settings\HelpAssistant\Local Settings\Application Data\Google\Chrome SxS\User Data\Default\Extensions\ohlencieiipommannpdfcmfdpjjmeolj\127\KMwsZ.js
c:\documents and settings\HelpAssistant\Local Settings\Application Data\Google\Chrome SxS\User Data\Default\Extensions\ohlencieiipommannpdfcmfdpjjmeolj\127\lsdb.js
c:\documents and settings\HelpAssistant\Local Settings\Application Data\Google\Chrome SxS\User Data\Default\Extensions\ohlencieiipommannpdfcmfdpjjmeolj\127\manifest.json
c:\documents and settings\K\Application Data\Company\Product
c:\documents and settings\K\Application Data\Mozilla\Firefox\Profiles\8aymfdzx.default\extensions\staged
c:\documents and settings\K\Application Data\windows
c:\documents and settings\K\Local Settings\Application Data\Comodo\Dragon\User Data\Default\Extensions\bnhfdipdlocbfkdgekmajkeodklniiae
c:\documents and settings\K\Local Settings\Application Data\Comodo\Dragon\User Data\Default\Extensions\bnhfdipdlocbfkdgekmajkeodklniiae\2.1\background.html
c:\documents and settings\K\Local Settings\Application Data\Comodo\Dragon\User Data\Default\Extensions\bnhfdipdlocbfkdgekmajkeodklniiae\2.1\content.js
c:\documents and settings\K\Local Settings\Application Data\Comodo\Dragon\User Data\Default\Extensions\bnhfdipdlocbfkdgekmajkeodklniiae\2.1\lsdb.js
c:\documents and settings\K\Local Settings\Application Data\Comodo\Dragon\User Data\Default\Extensions\bnhfdipdlocbfkdgekmajkeodklniiae\2.1\manifest.json
c:\documents and settings\K\Local Settings\Application Data\Comodo\Dragon\User Data\Default\Extensions\bnhfdipdlocbfkdgekmajkeodklniiae\2.1\newtab.html
c:\documents and settings\K\Local Settings\Application Data\Comodo\Dragon\User Data\Default\Extensions\bnhfdipdlocbfkdgekmajkeodklniiae\2.1\VZny10RMk7.js
c:\documents and settings\K\Local Settings\Application Data\Comodo\Dragon\User Data\Default\Extensions\ohlencieiipommannpdfcmfdpjjmeolj
c:\documents and settings\K\Local Settings\Application Data\Comodo\Dragon\User Data\Default\Extensions\ohlencieiipommannpdfcmfdpjjmeolj\127\background.html
c:\documents and settings\K\Local Settings\Application Data\Comodo\Dragon\User Data\Default\Extensions\ohlencieiipommannpdfcmfdpjjmeolj\127\content.js
c:\documents and settings\K\Local Settings\Application Data\Comodo\Dragon\User Data\Default\Extensions\ohlencieiipommannpdfcmfdpjjmeolj\127\KMwsZ.js
c:\documents and settings\K\Local Settings\Application Data\Comodo\Dragon\User Data\Default\Extensions\ohlencieiipommannpdfcmfdpjjmeolj\127\lsdb.js
c:\documents and settings\K\Local Settings\Application Data\Comodo\Dragon\User Data\Default\Extensions\ohlencieiipommannpdfcmfdpjjmeolj\127\manifest.json
c:\documents and settings\K\Local Settings\Application Data\Google\Chrome SxS\User Data\Default\Extensions\bnhfdipdlocbfkdgekmajkeodklniiae
c:\documents and settings\K\Local Settings\Application Data\Google\Chrome SxS\User Data\Default\Extensions\bnhfdipdlocbfkdgekmajkeodklniiae\2.1\background.html
c:\documents and settings\K\Local Settings\Application Data\Google\Chrome SxS\User Data\Default\Extensions\bnhfdipdlocbfkdgekmajkeodklniiae\2.1\content.js
c:\documents and settings\K\Local Settings\Application Data\Google\Chrome SxS\User Data\Default\Extensions\bnhfdipdlocbfkdgekmajkeodklniiae\2.1\lsdb.js
c:\documents and settings\K\Local Settings\Application Data\Google\Chrome SxS\User Data\Default\Extensions\bnhfdipdlocbfkdgekmajkeodklniiae\2.1\manifest.json
c:\documents and settings\K\Local Settings\Application Data\Google\Chrome SxS\User Data\Default\Extensions\bnhfdipdlocbfkdgekmajkeodklniiae\2.1\newtab.html
c:\documents and settings\K\Local Settings\Application Data\Google\Chrome SxS\User Data\Default\Extensions\bnhfdipdlocbfkdgekmajkeodklniiae\2.1\VZny10RMk7.js
c:\documents and settings\K\Local Settings\Application Data\Google\Chrome SxS\User Data\Default\Extensions\ohlencieiipommannpdfcmfdpjjmeolj
c:\documents and settings\K\Local Settings\Application Data\Google\Chrome SxS\User Data\Default\Extensions\ohlencieiipommannpdfcmfdpjjmeolj\127\background.html
c:\documents and settings\K\Local Settings\Application Data\Google\Chrome SxS\User Data\Default\Extensions\ohlencieiipommannpdfcmfdpjjmeolj\127\content.js
c:\documents and settings\K\Local Settings\Application Data\Google\Chrome SxS\User Data\Default\Extensions\ohlencieiipommannpdfcmfdpjjmeolj\127\KMwsZ.js
c:\documents and settings\K\Local Settings\Application Data\Google\Chrome SxS\User Data\Default\Extensions\ohlencieiipommannpdfcmfdpjjmeolj\127\lsdb.js
c:\documents and settings\K\Local Settings\Application Data\Google\Chrome SxS\User Data\Default\Extensions\ohlencieiipommannpdfcmfdpjjmeolj\127\manifest.json
c:\documents and settings\K\Local Settings\Application Data\Google\Chrome\User Data\Default\Preferences
c:\documents and settings\K\Local Settings\Temporary Internet Files\Dynamo Combo_iels
c:\documents and settings\SUPPORT_388945a0\Local Settings\Application Data\Comodo\Dragon\User Data\Default\Extensions\bnhfdipdlocbfkdgekmajkeodklniiae
c:\documents and settings\SUPPORT_388945a0\Local Settings\Application Data\Comodo\Dragon\User Data\Default\Extensions\bnhfdipdlocbfkdgekmajkeodklniiae\2.1\background.html
c:\documents and settings\SUPPORT_388945a0\Local Settings\Application Data\Comodo\Dragon\User Data\Default\Extensions\bnhfdipdlocbfkdgekmajkeodklniiae\2.1\content.js
c:\documents and settings\SUPPORT_388945a0\Local Settings\Application Data\Comodo\Dragon\User Data\Default\Extensions\bnhfdipdlocbfkdgekmajkeodklniiae\2.1\lsdb.js
c:\documents and settings\SUPPORT_388945a0\Local Settings\Application Data\Comodo\Dragon\User Data\Default\Extensions\bnhfdipdlocbfkdgekmajkeodklniiae\2.1\manifest.json
c:\documents and settings\SUPPORT_388945a0\Local Settings\Application Data\Comodo\Dragon\User Data\Default\Extensions\bnhfdipdlocbfkdgekmajkeodklniiae\2.1\newtab.html
c:\documents and settings\SUPPORT_388945a0\Local Settings\Application Data\Comodo\Dragon\User Data\Default\Extensions\bnhfdipdlocbfkdgekmajkeodklniiae\2.1\VZny10RMk7.js
c:\documents and settings\SUPPORT_388945a0\Local Settings\Application Data\Comodo\Dragon\User Data\Default\Extensions\ohlencieiipommannpdfcmfdpjjmeolj
c:\documents and settings\SUPPORT_388945a0\Local Settings\Application Data\Comodo\Dragon\User Data\Default\Extensions\ohlencieiipommannpdfcmfdpjjmeolj\127\background.html
c:\documents and settings\SUPPORT_388945a0\Local Settings\Application Data\Comodo\Dragon\User Data\Default\Extensions\ohlencieiipommannpdfcmfdpjjmeolj\127\content.js
c:\documents and settings\SUPPORT_388945a0\Local Settings\Application Data\Comodo\Dragon\User Data\Default\Extensions\ohlencieiipommannpdfcmfdpjjmeolj\127\KMwsZ.js
c:\documents and settings\SUPPORT_388945a0\Local Settings\Application Data\Comodo\Dragon\User Data\Default\Extensions\ohlencieiipommannpdfcmfdpjjmeolj\127\lsdb.js
c:\documents and settings\SUPPORT_388945a0\Local Settings\Application Data\Comodo\Dragon\User Data\Default\Extensions\ohlencieiipommannpdfcmfdpjjmeolj\127\manifest.json
c:\documents and settings\SUPPORT_388945a0\Local Settings\Application Data\Google\Chrome SxS\User Data\Default\Extensions\bnhfdipdlocbfkdgekmajkeodklniiae
c:\documents and settings\SUPPORT_388945a0\Local Settings\Application Data\Google\Chrome SxS\User Data\Default\Extensions\bnhfdipdlocbfkdgekmajkeodklniiae\2.1\background.html
c:\documents and settings\SUPPORT_388945a0\Local Settings\Application Data\Google\Chrome SxS\User Data\Default\Extensions\bnhfdipdlocbfkdgekmajkeodklniiae\2.1\content.js
c:\documents and settings\SUPPORT_388945a0\Local Settings\Application Data\Google\Chrome SxS\User Data\Default\Extensions\bnhfdipdlocbfkdgekmajkeodklniiae\2.1\lsdb.js
c:\documents and settings\SUPPORT_388945a0\Local Settings\Application Data\Google\Chrome SxS\User Data\Default\Extensions\bnhfdipdlocbfkdgekmajkeodklniiae\2.1\manifest.json
c:\documents and settings\SUPPORT_388945a0\Local Settings\Application Data\Google\Chrome SxS\User Data\Default\Extensions\bnhfdipdlocbfkdgekmajkeodklniiae\2.1\newtab.html
c:\documents and settings\SUPPORT_388945a0\Local Settings\Application Data\Google\Chrome SxS\User Data\Default\Extensions\bnhfdipdlocbfkdgekmajkeodklniiae\2.1\VZny10RMk7.js
c:\documents and settings\SUPPORT_388945a0\Local Settings\Application Data\Google\Chrome SxS\User Data\Default\Extensions\ohlencieiipommannpdfcmfdpjjmeolj
c:\documents and settings\SUPPORT_388945a0\Local Settings\Application Data\Google\Chrome SxS\User Data\Default\Extensions\ohlencieiipommannpdfcmfdpjjmeolj\127\background.html
c:\documents and settings\SUPPORT_388945a0\Local Settings\Application Data\Google\Chrome SxS\User Data\Default\Extensions\ohlencieiipommannpdfcmfdpjjmeolj\127\content.js
c:\documents and settings\SUPPORT_388945a0\Local Settings\Application Data\Google\Chrome SxS\User Data\Default\Extensions\ohlencieiipommannpdfcmfdpjjmeolj\127\KMwsZ.js
c:\documents and settings\SUPPORT_388945a0\Local Settings\Application Data\Google\Chrome SxS\User Data\Default\Extensions\ohlencieiipommannpdfcmfdpjjmeolj\127\lsdb.js
c:\documents and settings\SUPPORT_388945a0\Local Settings\Application Data\Google\Chrome SxS\User Data\Default\Extensions\ohlencieiipommannpdfcmfdpjjmeolj\127\manifest.json
C:\LIL255.tmp
C:\nsh3B0.tmp
C:\nsh3B1.tmp
C:\nst307.tmp
C:\nst308.tmp
c:\windows\system32\drivers\etc\hosts.ics
.
.
((((((((((((((((((((((((( Files Created from 2015-03-17 to 2015-04-17 )))))))))))))))))))))))))))))))
.
.
2015-04-16 09:13 . 2015-04-16 09:13 -------- dc----w- C:\RegBackup
2015-04-16 04:37 . 2015-04-16 04:37 35064 ----a-w- c:\windows\system32\drivers\TrueSight.sys
2015-04-16 04:36 . 2015-04-16 04:36 -------- dc----w- c:\documents and settings\All Users\Application Data\RogueKiller
2015-04-16 02:40 . 2015-04-16 02:40 -------- dc----w- c:\documents and settings\All Users\Application Data\Panda Security
2015-04-16 02:39 . 2015-04-16 02:39 -------- d-----w- c:\program files\Panda USB Vaccine
2015-04-12 04:10 . 2015-04-16 02:22 -------- dc----w- C:\FRST
2015-04-12 01:23 . 2015-04-12 01:23 -------- dc----w- C:\TDSSKiller_Quarantine
2015-04-12 00:36 . 2015-04-16 09:00 -------- dc----w- C:\AdwCleaner
2015-04-11 08:41 . 2015-04-17 01:11 119512 ----a-w- c:\windows\system32\drivers\MBAMSwissArmy.sys
2015-04-11 08:25 . 2015-04-16 05:12 -------- d-----w- c:\program files\Malwarebytes Anti-Malware
2015-04-11 08:25 . 2015-03-17 12:15 23256 ----a-w- c:\windows\system32\drivers\mbam.sys
2015-04-09 11:30 . 2015-04-09 11:30 -------- d--h--w- c:\windows\PIF
2015-04-09 05:15 . 2015-04-09 11:30 -------- dc-h--w- c:\windows\ie8
2015-04-09 00:56 . 2015-03-17 12:15 120024 ----a-w- c:\windows\system32\drivers\mbamchameleon.sys
2015-04-08 10:22 . 2015-04-08 11:21 -------- dc----w- c:\documents and settings\Administrator.KEIONA.000
2015-04-08 09:22 . 2015-04-08 09:22 -------- d-----w- c:\program files\Windows Audio
2015-04-07 11:52 . 2015-04-07 11:52 -------- d-----w- c:\windows\system32\wbem\Repository
2015-04-07 11:48 . 2015-04-07 11:48 -------- d-----w- c:\documents and settings\K\Application Data\youtube-downloader-and-converter
2015-04-07 04:31 . 2015-04-07 04:31 -------- dc----w- c:\documents and settings\All Users\Application Data\Windows VXM
2015-04-07 03:41 . 2015-04-07 03:41 -------- d-----w- c:\program files\app_setup
2015-04-07 03:41 . 2015-04-07 03:41 -------- d-----w- c:\program files\setup
2015-04-07 03:40 . 2015-04-16 08:37 -------- d-----w- c:\program files\9135fa6f-851d-4210-8a06-c060645e7f6d
2015-04-07 03:40 . 2015-04-07 11:14 -------- d-----w- c:\program files\user extensions
2015-04-07 03:34 . 2015-04-16 09:42 -------- d-----w- c:\documents and settings\K\Local Settings\Application Data\Deployment
2015-04-07 02:56 . 2015-04-07 02:56 -------- dc----w- c:\documents and settings\All Users\Application Data\McAfee Security Scan
2015-04-07 02:56 . 2015-04-07 02:56 -------- d-----w- c:\program files\McAfee Security Scan
2015-04-07 02:56 . 2015-04-07 02:56 -------- d-----w- c:\documents and settings\K\.FamilySearchIndexing
2015-04-07 02:56 . 2015-04-07 02:56 -------- d-----w- c:\program files\FamilySearch Indexing
2015-04-07 01:11 . 2015-04-17 02:02 -------- d-----w- c:\documents and settings\K\Application Data\Company
2015-04-07 01:11 . 2015-04-16 08:37 -------- dc----w- c:\documents and settings\All Users\Application Data\{9d39d2a8-4a19-bd4c-9d39-9d2a84a14aa1}
2015-04-07 01:06 . 2015-04-07 01:06 -------- d-sh--w- c:\windows\system32\config\systemprofile\IETldCache
2015-04-07 00:41 . 2015-04-07 00:41 -------- dc----w- c:\documents and settings\All Users\Application Data\COMODO
2015-04-07 00:40 . 2015-04-07 00:40 -------- d-----w- c:\program files\COMODO
2015-04-07 00:38 . 2015-04-13 03:15 -------- dc----w- c:\documents and settings\All Users\Application Data\{d57a658c-02a3-56a6-d57a-a658c02a9630}
2015-04-06 10:32 . 2015-04-07 02:54 -------- dc----w- C:\138efef433ac4b7a372a18dc
2015-03-25 20:34 . 2015-03-25 20:34 18475704 ----a-w- c:\program files\Common Files\Microsoft Shared\OFFICE14\MSO.DLL
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2015-04-06 12:37 . 2013-10-10 10:19 636704 ----a-w- c:\windows\system32\PerfStringBackup.TMP
2015-02-17 21:26 . 2015-02-17 21:26 1217184 ----a-w- c:\windows\system32\FM20.DLL
.
.
------- Sigcheck -------
Note: Unsigned files aren't necessarily malware.
.
[-] 2012-07-06 . CFD4E51402DA9838B5A04AE680AF54A0 . 78336 . . [5.1.2600.6260] . . c:\windows\system32\browser.dll
[-] 2012-07-06 . CFD4E51402DA9838B5A04AE680AF54A0 . 78336 . . [5.1.2600.6260] . . c:\windows\system32\dllcache\browser.dll
[-] 2012-07-06 . FC6D1D80588D371F0321E15A75B2F8F2 . 78336 . . [5.1.2600.6260] . . c:\windows\$hf_mig$\KB2705219-v2\SP3QFE\browser.dll
[7] 2008-04-14 . A06CE3399D16DB864F55FAEB1F1927A9 . 77824 . . [5.1.2600.5512] . . c:\windows\$NtUninstallKB2705219-v2$\browser.dll
[7] 2008-04-14 . A06CE3399D16DB864F55FAEB1F1927A9 . 77824 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\browser.dll
[7] 2006-02-28 . E3CFCCDDA4EDD1D0DC9168B2E18F27B8 . 77312 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\browser.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"WUAppSetup"="c:\program files\Common Files\logishrd\WUApp32.exe" [2007-02-03 430080]
.
c:\documents and settings\K\Start Menu\Programs\Startup\
PandaUSBVaccine.lnk - c:\program files\Panda USB Vaccine\USBVaccine.exe /resident /agreelicense [2015-4-15 1287176]
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"c:\\WINDOWS\\system32\\dxdiag.exe"=
"c:\\WINDOWS\\system32\\mmc.exe"=
"c:\\WINDOWS\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\WINDOWS\\system32\\dpvsetup.exe"=
"c:\\WINDOWS\\system32\\dpnsvr.exe"=
"c:\\Program Files\\Microsoft Office\\Office14\\OUTLOOK.EXE"=
"c:\\Program Files\\Microsoft Office\\Office14\\ONENOTE.EXE"=
"c:\\Program Files\\Microsoft Office\\Office14\\GROOVE.EXE"=
"c:\\Documents and Settings\\Fresh\\Application Data\\mjusbsp\\magicJack.exe"=
"c:\\WINDOWS\\system32\\sessmgr.exe"=
"c:\\Program Files\\VideoLAN\\VLC\\vlc.exe"=
"c:\\Program Files\\Google\\Chrome\\Application\\chrome.exe"=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"443:TCP"= 443:TCP:ftp
"3389:TCP"= 3389:TCP:mad:xpsp2res.dll,-22009
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\IcmpSettings]
"AllowInboundEchoRequest"= 1 (0x1)
"AllowInboundTimestampRequest"= 1 (0x1)
"AllowInboundMaskRequest"= 1 (0x1)
"AllowInboundRouterRequest"= 1 (0x1)
"AllowOutboundDestinationUnreachable"= 1 (0x1)
"AllowOutboundSourceQuench"= 1 (0x1)
"AllowOutboundParameterProblem"= 1 (0x1)
"AllowOutboundTimeExceeded"= 1 (0x1)
"AllowRedirect"= 1 (0x1)
"AllowOutboundPacketTooBig"= 1 (0x1)
.
R2 MBAMScheduler;MBAMScheduler;c:\program files\Malwarebytes Anti-Malware\mbamscheduler.exe [4/11/2015 2:25 AM 1871160]
R2 MBAMService;MBAMService;c:\program files\Malwarebytes Anti-Malware\mbamservice.exe [4/11/2015 2:25 AM 1080120]
R2 UDisk Monitor;UDisk Monitor;c:\program files\Froyo_Android_Driver\Bin\MonServiceUDisk.exe [11/1/2013 11:02 PM 517960]
R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [4/11/2015 2:25 AM 23256]
R3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\system32\drivers\MBAMSwissArmy.sys [4/11/2015 2:41 AM 119512]
S2 WinAudioSrv_R1;Windows Audio Services (R1);c:\program files\Windows Audio\R1\AudioSrv.exe [4/8/2015 3:22 AM 4024920]
S3 eustub;Usb Stub (Eltima software);c:\windows\system32\drivers\eusbstub.sys [10/26/2013 5:56 AM 13800]
S3 Generalusbserialser20675;USB Legacy Serial Communication 20675;c:\windows\system32\drivers\CT_U_USBSER.sys [11/1/2013 11:02 PM 112456]
S3 HPKBCCID;HP Keyboard Smart Card Driver;c:\windows\system32\drivers\HPKBCCID.sys [3/5/2012 11:04 PM 48000]
S3 mbamchameleon;mbamchameleon;c:\windows\system32\drivers\mbamchameleon.sys [4/8/2015 6:56 PM 120024]
S3 McComponentHostService;McAfee Security Scan Component Host Service;c:\program files\McAfee Security Scan\3.8.130\McCHSvc.exe [9/6/2013 11:29 AM 235216]
S3 RTL8192su;%RTL8192su.DeviceDesc.DispName%;c:\windows\system32\drivers\RTL8192su.sys [8/29/2013 9:10 PM 606440]
S3 vuhub;Virtual Usb Hub;c:\windows\system32\drivers\vuhub.sys [10/26/2013 5:56 AM 63848]
.
--- Other Services/Drivers In Memory ---
.
*NewlyCreated* - MBAMSWISSARMY
.
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]
2015-04-16 09:45 988488 ----a-w- c:\program files\Google\Chrome\Application\42.0.2311.90\Installer\chrmstp.exe
.
Contents of the 'Scheduled Tasks' folder
.
2015-04-16 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2015-04-16 09:42]
.
2015-04-17 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2015-04-16 09:42]
.
2015-04-16 c:\windows\Tasks\Microsoft Windows XP End of Service Notification Logon.job
- c:\windows\system32\xp_eos.exe [2003-02-26 01:59]
.
2015-04-08 c:\windows\Tasks\Microsoft Windows XP End of Service Notification Monthly.job
- c:\windows\system32\xp_eos.exe [2003-02-26 01:59]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com/
uInternet Connection Wizard,ShellNext = iexplore
TCP: DhcpNameServer = 192.168.0.1 205.171.2.25
.
- - - - ORPHANS REMOVED - - - -
.
Toolbar-Locked - (no file)
AddRemove-{090001FD-6A8C-4105-8843-50FE37FFCD0F} - c:\documents and settings\All Users\Application Data\eazyzoom\1.1.0.30\Uninstaller.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2015-04-16 20:05
Windows 5.1.2600 Service Pack 3 NTFS
.
scanning hidden processes ...
.
scanning hidden autostart entries ...
.
scanning hidden files ...
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_USERS\S-1-5-21-725345543-1958367476-682003330-1004\Software\Microsoft\SystemCertificates\AddressBook*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
.
[HKEY_USERS\S-1-5-21-725345543-1958367476-682003330-1004\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.*e%e%%*]
@Class="Shell"
.
[HKEY_USERS\S-1-5-21-725345543-1958367476-682003330-1004\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.*e%e%%*\OpenWithList]
@Class="Shell"
.
Completion time: 2015-04-16 20:11:45
ComboFix-quarantined-files.txt 2015-04-17 02:11
.
Pre-Run: 6,121,209,856 bytes free
Post-Run: 6,671,454,208 bytes free
.
WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
UnsupportedDebug="do not select this" /debug
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Home Edition" /fastdetect /NoExecute=OptOut
.
- - End Of File - - 16942138AA87370F1E1B76EF9A6C5032
8F558EB6672622401DA993E1E865C861
 
It's been a long journey but we seem to begetting there :)

redtarget.gif
Uninstall McAfee Security Scan, typical foistware.

redtarget.gif
It's time to install some AV program.
Install ONE of these:

- Avast! free antivirus: http://www.avast.com/eng/download-avast-home.html

- free Microsoft Security Essentials: http://windows.microsoft.com/en-GB/windows/products/security-essentials
Note for Windows 8 users: Microsoft Security Essentials comes preinstalled and renamed as Windows Defender.
You can keep it or you have to disable it before installing another AV program. How to...

- free Comodo Antivirus: http://www.comodo.com/home/internet-security/antivirus.php

redtarget.gif
Re-run Farbar Recovery Scan Tool (FRST/FRST64) you ran at the very beginning of this topic.

  • Double-click to run it. When the tool opens click Yes to disclaimer.
  • Make sure you checkmark Addition.txt box.
  • Press Scan button.
  • Scan will create two logs, FRST.txt and Addition.txt in the same directory the tool is run. Please copy and paste them to your reply.
 
Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 15-04-2015 04
Ran by K (administrator) on DESTINY on 16-04-2015 22:34:33
Running from C:\Documents and Settings\K\Desktop
Loaded Profiles: K (Available profiles: K & Administrator)
Platform: Microsoft Windows XP Home Edition Service Pack 3 (X86) OS Language: English (United States)
Internet Explorer Version 8 (Default browser: Chrome)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool:

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(Microsoft Corporation) C:\WINDOWS\system32\scardsvr.exe
(Malwarebytes Corporation) C:\Program Files\Malwarebytes Anti-Malware\mbamscheduler.exe
(Malwarebytes Corporation) C:\Program Files\Malwarebytes Anti-Malware\mbamservice.exe
() C:\Program Files\Froyo_Android_Driver\Bin\MonServiceUDisk.exe
(Hefei Hejunzhengce Info Tech Co., Ltd.) C:\Program Files\Windows Audio\R1\AudioSrv.exe
(Malwarebytes Corporation) C:\Program Files\Malwarebytes Anti-Malware\mbam.exe
(Microsoft Corporation) C:\WINDOWS\system32\wscntfy.exe
(Panda Security) C:\Program Files\Panda USB Vaccine\USBVaccine.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Avast Software s.r.o.) C:\Program Files\AVAST Software\Avast\AvastSvc.exe
(Avast Software s.r.o.) C:\Program Files\AVAST Software\Avast\AvastUI.exe
(Microsoft Corporation) C:\WINDOWS\system32\wbem\unsecapp.exe
(Avast Software s.r.o.) C:\Program Files\AVAST Software\Avast\AvastUI.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [AvastUI.exe] => C:\Program Files\AVAST Software\Avast\AvastUI.exe [5512912 2015-04-16] (Avast Software s.r.o.)
HKLM\...\RunOnce: [20150107] => C:\Program Files\AVAST Software\Avast\setup\emupdate\70de5e11-e698-41bc-b1c2-0e96a99cfc02.exe [183232 2015-04-16] (AVAST Software)
HKU\S-1-5-21-725345543-1958367476-682003330-1004\...\Run: [GoogleChromeAutoLaunch_5D127BC0EA07A5E5B655D16FC1A25316] => C:\Program Files\Google\Chrome\Application\chrome.exe [812872 2015-04-13] (Google Inc.)
HKU\S-1-5-18\...\RunOnce: [WUAppSetup] => C:\Program Files\Common Files\logishrd\WUApp32.exe [430080 2007-02-03] ()
Startup: C:\Documents and Settings\K\Start Menu\Programs\Startup\PandaUSBVaccine.lnk
ShortcutTarget: PandaUSBVaccine.lnk -> C:\Program Files\Panda USB Vaccine\USBVaccine.exe (Panda Security)
ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVAST Software\Avast\ashShell.dll (Avast Software s.r.o.)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
HKU\S-1-5-21-725345543-1958367476-682003330-1004\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=msnhome
HKU\S-1-5-21-725345543-1958367476-682003330-1004\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
BHO: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL [2013-12-19] (Microsoft Corporation)
BHO: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll [2015-04-16] (Avast Software s.r.o.)
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL [2013-03-06] (Microsoft Corporation)
DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} http://windowsupdate.microsoft.com/...ls/en/x86/client/wuweb_site.cab?1046191103890
DPF: {6A060448-60F9-11D5-A6CD-0002B31F7455}
Tcpip\Parameters: [DhcpNameServer] 192.168.0.1 205.171.2.25

FireFox:
========
FF ProfilePath: C:\Documents and Settings\K\Application Data\Mozilla\Firefox\Profiles\8aymfdzx.default
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL [2010-01-09] (Microsoft Corporation)
FF Plugin: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~1\MICROS~2\Office14\NPSPWRAP.DLL [2010-03-24] (Microsoft Corporation)
FF Plugin: @microsoft.com/WPF,version=3.5 -> c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll [2008-07-29] (Microsoft Corporation)
FF Plugin: @tools.google.com/Google Update;version=3 -> C:\Program Files\Google\Update\1.3.26.9\npGoogleUpdate3.dll [2015-04-16] (Google Inc.)
FF Plugin: @tools.google.com/Google Update;version=9 -> C:\Program Files\Google\Update\1.3.26.9\npGoogleUpdate3.dll [2015-04-16] (Google Inc.)
FF Plugin: @videolan.org/vlc,version=2.0.8 -> C:\Program Files\VideoLAN\VLC\npvlc.dll [2014-07-22] (VideoLAN)
FF Plugin: @videolan.org/vlc,version=2.1.1 -> C:\Program Files\VideoLAN\VLC\npvlc.dll [2014-07-22] (VideoLAN)
FF Plugin: @videolan.org/vlc,version=2.1.2 -> C:\Program Files\VideoLAN\VLC\npvlc.dll [2014-07-22] (VideoLAN)
FF Plugin: @videolan.org/vlc,version=2.1.5 -> C:\Program Files\VideoLAN\VLC\npvlc.dll [2014-07-22] (VideoLAN)
FF Plugin: Adobe Reader -> C:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll [2014-08-05] (Adobe Systems Inc.)
FF HKLM\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] - c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
FF Extension: Microsoft .NET Framework Assistant - c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension [2013-07-22]
FF HKLM\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\AVAST Software\Avast\WebRep\FF
FF Extension: No Name - C:\Program Files\AVAST Software\Avast\WebRep\FF [2015-04-16]

Chrome:
=======
CHR HomePage: Default -> hxxp://www.google.com/
CHR StartupUrls: Default -> "https://www.google.com/"
CHR DefaultSuggestURL: Default -> {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client={google:suggestClient}&gs_ri={google:suggestRid}&xssi=t&q={searchTerms}&{google:inputType}{google:cursorPosition}{google:currentPageUrl}{google:pageClassification}{google:searchVersion}{google:sessionToken}{google:prefetchQuery}sugkey={google:suggestAPIKeyParameter}
CHR Profile: C:\Documents and Settings\K\Local Settings\Application Data\Google\Chrome\User Data\Default
CHR Extension: (Mp3Skull Toolbar) - C:\Documents and Settings\K\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\anaehjnjgheaikfecjlfokolkoalpnda [2015-04-16]
CHR Extension: (YouTube) - C:\Documents and Settings\K\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2015-04-16]
CHR Extension: (Mahjongg) - C:\Documents and Settings\K\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\dfhgecpiaaideopgfehpomehflocnphd [2015-04-16]
CHR Extension: (Mahjongg Mahjongg) - C:\Documents and Settings\K\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\djgifnjpclblfhjamijejgmmmajndglm [2015-04-16]
CHR Extension: (Free Smileys & Emoticons) - C:\Documents and Settings\K\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\eadohofilecbkoopckifdpenihdpdbfm [2015-04-16]
CHR Extension: (Mahjongg) - C:\Documents and Settings\K\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\eegpopcingfghbompjfejakfeaolmbop [2015-04-16]
CHR Extension: (Whist Card Game) - C:\Documents and Settings\K\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\hnogegkomblljannepeelpenlmbdolna [2015-04-16]
CHR Extension: (Chrome Hotword Shared Module) - C:\Documents and Settings\K\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\lccekmodgklaepjeofjdjpbminllajkg [2015-04-16]
CHR Extension: (Comic Webcam) - C:\Documents and Settings\K\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\lfffhmndpldceogndeognocbpmlgdemi [2015-04-16]
CHR Extension: (Dice) - C:\Documents and Settings\K\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\mkomhldhkbggnefgdjggpfaaljlfmahe [2015-04-16]
CHR Extension: (Mahjong Games with High Scores) - C:\Documents and Settings\K\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\ngcmfkldebnlhhnohafeahjkeihmcjjd [2015-04-16]
CHR Extension: (Google Wallet) - C:\Documents and Settings\K\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2015-04-16]
CHR Extension: (UserZoom Survey Tool) - C:\Documents and Settings\K\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\npeidojcmghjibnbnmjloedchcgdkbeo [2015-04-16]
CHR Extension: (My Chrome Theme) - C:\Documents and Settings\K\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\oehpjpccmlcalbenfhnacjeocbjdonic [2015-04-16]
CHR Extension: (10,000) - C:\Documents and Settings\K\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\olabdgcmaiboddccbiajlekdekkkjjkb [2015-04-16]
CHR Extension: (Text Design) - C:\Documents and Settings\K\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\olnkgiapbjhdboldbhkagdodklkphaip [2015-04-16]
CHR HKLM\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChrome.crx [2015-04-16]

========================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [343336 2015-04-16] (Avast Software s.r.o.)
R2 Browser; C:\WINDOWS\System32\browser.dll [78336 2012-07-06] (Microsoft Corporation) [File not signed]
S3 LPDSVC; C:\WINDOWS\system32\tcpsvcs.exe [19456 2006-02-28] (Microsoft Corporation)
R2 MBAMScheduler; C:\Program Files\Malwarebytes Anti-Malware\mbamscheduler.exe [1871160 2015-03-17] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files\Malwarebytes Anti-Malware\mbamservice.exe [1080120 2015-03-17] (Malwarebytes Corporation)
R2 UDisk Monitor; C:\Program Files\Froyo_Android_Driver\Bin\MonServiceUDisk.exe [517960 2012-04-20] ()
R2 WinAudioSrv_R1; C:\Program Files\Windows Audio\R1\AudioSrv.exe [4024920 2015-04-07] (Hefei Hejunzhengce Info Tech Co., Ltd.)

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 aswHwid; C:\WINDOWS\system32\drivers\aswHwid.sys [24144 2015-04-16] ()
R2 aswMonFlt; C:\WINDOWS\system32\drivers\aswMonFlt.sys [73440 2015-04-16] (Avast Software s.r.o.)
R1 aswRdr; C:\WINDOWS\system32\drivers\aswRdr.sys [55200 2015-04-16] (Avast Software s.r.o.)
S0 aswRvrt; C:\WINDOWS\system32\Drivers\aswRvrt.sys [49904 2015-04-16] ()
R1 aswSnx; C:\WINDOWS\system32\drivers\aswSnx.sys [788272 2015-04-16] (Avast Software s.r.o.)
R1 aswSP; C:\WINDOWS\system32\drivers\aswSP.sys [427736 2015-04-16] (Avast Software s.r.o.)
R1 aswTdi; C:\WINDOWS\system32\drivers\aswTdi.sys [57888 2015-04-16] (Avast Software s.r.o.)
R0 aswVmm; C:\WINDOWS\system32\Drivers\aswVmm.sys [208024 2015-04-16] ()
S3 CamDrL; C:\WINDOWS\System32\DRIVERS\Camdrl.sys [1075360 2007-02-03] (Logitech Inc.)
S3 CCDECODE; C:\WINDOWS\System32\DRIVERS\CCDECODE.sys [17024 2008-04-14] (Microsoft Corporation)
R3 E1000; C:\WINDOWS\System32\DRIVERS\e1000325.sys [99840 2002-11-12] (Intel Corporation)
S3 eustub; C:\WINDOWS\System32\DRIVERS\eusbstub.sys [13800 2014-09-27] (ELTIMA Software)
S3 Generalusbserialser20675; C:\WINDOWS\System32\DRIVERS\CT_U_USBSER.sys [112456 2012-04-20] (Incorporated)
S3 HPKBCCID; C:\WINDOWS\System32\DRIVERS\HPKBCCID.sys [48000 2012-03-05] (Hewlett-Packard Company)
S3 LVUSBSta; C:\WINDOWS\System32\drivers\LVUSBSta.sys [41504 2007-02-03] (Logitech Inc.)
S3 mbamchameleon; C:\WINDOWS\system32\drivers\mbamchameleon.sys [120024 2015-03-17] (Malwarebytes Corporation)
R3 MBAMProtector; C:\WINDOWS\system32\drivers\mbam.sys [23256 2015-03-17] (Malwarebytes Corporation)
R3 MBAMSwissArmy; C:\WINDOWS\system32\drivers\MBAMSwissArmy.sys [119512 2015-04-16] (Malwarebytes Corporation)
S3 NdisIP; C:\WINDOWS\System32\DRIVERS\NdisIP.sys [10880 2008-04-14] (Microsoft Corporation)
S3 nm; C:\WINDOWS\System32\DRIVERS\NMnt.sys [40320 2008-04-14] (Microsoft Corporation)
S3 PID_0928; C:\WINDOWS\System32\DRIVERS\LV561AV.SYS [495768 2009-04-30] (Logitech Inc.)
U3 TrueSight; C:\WINDOWS\system32\drivers\TrueSight.sys [35064 2015-04-15] ()
S3 vuhub; C:\WINDOWS\System32\DRIVERS\vuhub.sys [63848 2013-12-10] (ELTIMA Software)
S3 catchme; \??\C:\DOCUME~1\K\LOCALS~1\Temp\catchme.sys [X]
U5 ScsiPort; C:\WINDOWS\system32\drivers\scsiport.sys [96384 2008-04-14] (Microsoft Corporation)
U3 TlntSvr; No ImagePath

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-04-16 22:43 - 2015-04-16 22:44 - 00000000 ____D () C:\Documents and Settings\K\Application Data\Dropbox
2015-04-16 22:34 - 2015-04-16 22:39 - 00014236 _____ () C:\Documents and Settings\K\Desktop\FRST.txt
2015-04-16 22:33 - 2015-04-16 22:33 - 00000000 ____D () C:\Documents and Settings\K\Desktop\FRST-OlderVersion
2015-04-16 22:32 - 2015-04-16 22:32 - 00000000 ____D () C:\Documents and Settings\K\Application Data\AVAST Software
2015-04-16 22:28 - 2015-04-16 22:28 - 00000000 ____D () C:\WINDOWS\jumpshot.com
2015-04-16 22:26 - 2015-04-16 22:26 - 00001694 _____ () C:\Documents and Settings\All Users\Desktop\Avast Free Antivirus.lnk
2015-04-16 22:26 - 2015-04-16 22:26 - 00000000 ____D () C:\Documents and Settings\All Users\Start Menu\Programs\AVAST Software
2015-04-16 22:25 - 2015-04-16 22:25 - 00356232 _____ (Dropbox, Inc.) C:\Documents and Settings\All Users\Desktop\DropboxInstallerAvast.exe
2015-04-16 22:25 - 2015-04-16 22:25 - 00000306 ____H () C:\WINDOWS\Tasks\avast! Emergency Update.job
2015-04-16 22:17 - 2015-04-16 22:16 - 00427736 _____ (Avast Software s.r.o.) C:\WINDOWS\system32\Drivers\aswSP.sys
2015-04-16 22:17 - 2015-04-16 22:16 - 00208024 _____ () C:\WINDOWS\system32\Drivers\aswVmm.sys
2015-04-16 22:17 - 2015-04-16 22:16 - 00073440 _____ (Avast Software s.r.o.) C:\WINDOWS\system32\Drivers\aswMonFlt.sys
2015-04-16 22:17 - 2015-04-16 22:16 - 00057888 _____ (Avast Software s.r.o.) C:\WINDOWS\system32\Drivers\aswTdi.sys
2015-04-16 22:17 - 2015-04-16 22:16 - 00055200 _____ (Avast Software s.r.o.) C:\WINDOWS\system32\Drivers\aswRdr.sys
2015-04-16 22:17 - 2015-04-16 22:16 - 00049904 _____ () C:\WINDOWS\system32\Drivers\aswRvrt.sys
2015-04-16 22:17 - 2015-04-16 22:16 - 00024144 _____ () C:\WINDOWS\system32\Drivers\aswHwid.sys
2015-04-16 22:17 - 2015-04-16 22:11 - 00788272 _____ (Avast Software s.r.o.) C:\WINDOWS\system32\Drivers\aswSnx.sys
2015-04-16 22:16 - 2015-04-16 22:13 - 00291312 _____ (Avast Software s.r.o.) C:\WINDOWS\system32\aswBoot.exe
2015-04-16 22:13 - 2015-04-16 22:13 - 00043112 _____ (Avast Software s.r.o.) C:\WINDOWS\avastSS.scr
2015-04-16 20:11 - 2015-04-16 22:43 - 00000000 ____D () C:\Documents and Settings\K\Local Settings\temp
2015-04-16 20:11 - 2015-04-16 20:11 - 00000000 ___DC () C:\Documents and Settings\Administrator.KEIONA.000\Local Settings\temp
2015-04-16 20:11 - 2015-04-16 20:11 - 00000000 ____D () C:\Documents and Settings\NetworkService\Local Settings\temp
2015-04-16 20:11 - 2015-04-16 20:11 - 00000000 ____D () C:\Documents and Settings\Default User\Local Settings\temp
2015-04-16 19:22 - 2015-04-16 19:22 - 00000000 RSHDC () C:\cmdcons
2015-04-16 19:22 - 2013-10-07 20:30 - 00000212 ____C () C:\Boot.bak
2015-04-16 19:22 - 2004-08-03 23:00 - 00260272 _RSHC () C:\cmldr
2015-04-16 19:14 - 2015-04-16 20:11 - 00000000 ___DC () C:\Qoobox
2015-04-16 19:14 - 2011-06-26 00:45 - 00256000 _____ () C:\WINDOWS\PEV.exe
2015-04-16 19:14 - 2010-11-07 11:20 - 00208896 _____ () C:\WINDOWS\MBR.exe
2015-04-16 19:14 - 2009-04-19 22:56 - 00060416 _____ (NirSoft) C:\WINDOWS\NIRCMD.exe
2015-04-16 19:14 - 2000-08-30 18:00 - 00518144 _____ (SteelWerX) C:\WINDOWS\SWREG.exe
2015-04-16 19:14 - 2000-08-30 18:00 - 00406528 _____ (SteelWerX) C:\WINDOWS\SWSC.exe
2015-04-16 19:14 - 2000-08-30 18:00 - 00212480 _____ (SteelWerX) C:\WINDOWS\SWXCACLS.exe
2015-04-16 19:14 - 2000-08-30 18:00 - 00098816 _____ () C:\WINDOWS\sed.exe
2015-04-16 19:14 - 2000-08-30 18:00 - 00080412 _____ () C:\WINDOWS\grep.exe
2015-04-16 19:14 - 2000-08-30 18:00 - 00068096 _____ () C:\WINDOWS\zip.exe
2015-04-16 19:09 - 2015-04-16 20:07 - 00000000 ____D () C:\WINDOWS\erdnt
2015-04-16 18:24 - 2015-04-16 18:24 - 14839808 _____ () C:\Documents and Settings\K\Desktop\Uninstaller.msi
2015-04-16 05:25 - 2015-04-16 05:33 - 00000000 ____D () C:\Documents and Settings\K\Desktop\TomJerry
2015-04-16 05:21 - 2015-04-16 05:21 - 00004608 _____ () C:\Documents and Settings\K\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2015-04-16 03:49 - 2015-04-16 04:54 - 00000000 ____D () C:\Documents and Settings\K\My Documents\DestinyCD
2015-04-16 03:49 - 2015-04-16 03:49 - 00001818 _____ () C:\Documents and Settings\All Users\Desktop\Google Chrome.lnk
2015-04-16 03:49 - 2015-04-16 03:49 - 00000000 ____D () C:\Documents and Settings\All Users\Start Menu\Programs\Google Chrome
2015-04-16 03:42 - 2015-04-16 21:51 - 00000872 _____ () C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job
2015-04-16 03:42 - 2015-04-16 21:47 - 00000876 _____ () C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job
2015-04-16 03:13 - 2015-04-16 03:13 - 00000000 ___DC () C:\RegBackup
2015-04-15 23:12 - 2015-04-15 23:12 - 00000782 _____ () C:\Documents and Settings\All Users\Desktop\Malwarebytes Anti-Malware.lnk
2015-04-15 22:37 - 2015-04-15 22:37 - 00035064 _____ () C:\WINDOWS\system32\Drivers\TrueSight.sys
2015-04-15 22:36 - 2015-04-15 22:36 - 00000000 ___DC () C:\Documents and Settings\All Users\Application Data\RogueKiller
2015-04-15 20:40 - 2015-04-15 20:40 - 00000000 ___DC () C:\Documents and Settings\All Users\Application Data\Panda Security
2015-04-15 20:39 - 2015-04-15 20:39 - 00000000 ____D () C:\Program Files\Panda USB Vaccine
2015-04-15 20:39 - 2015-04-15 20:39 - 00000000 ____D () C:\Documents and Settings\All Users\Start Menu\Programs\Panda Security
2015-04-12 21:11 - 2015-04-16 22:33 - 01137152 ____C (Farbar) C:\Documents and Settings\K\Desktop\FRST.exe
2015-04-12 20:54 - 2015-04-16 03:11 - 00000000 ____D () C:\Documents and Settings\K\My Documents\Techspot
2015-04-11 23:08 - 2015-04-11 23:08 - 00001919 _____ () C:\WINDOWS\epplauncher.mif
2015-04-11 22:10 - 2015-04-16 22:36 - 00000000 ___DC () C:\FRST
2015-04-11 19:23 - 2015-04-11 19:23 - 00000000 ___DC () C:\TDSSKiller_Quarantine
2015-04-11 18:36 - 2015-04-16 03:00 - 00000000 ___DC () C:\AdwCleaner
2015-04-11 02:41 - 2015-04-16 21:51 - 00119512 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\MBAMSwissArmy.sys
2015-04-11 02:25 - 2015-04-15 23:12 - 00000000 ____D () C:\Program Files\Malwarebytes Anti-Malware
2015-04-11 02:25 - 2015-04-15 23:12 - 00000000 ____D () C:\Documents and Settings\All Users\Start Menu\Programs\Malwarebytes Anti-Malware
2015-04-11 02:25 - 2015-03-17 06:15 - 00023256 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mbam.sys
2015-04-11 02:15 - 2012-05-18 17:09 - 44753295 ____N () C:\Documents and Settings\K\Desktop\forMybabe3gp.mp4
2015-04-10 03:59 - 2015-04-11 20:47 - 00000101 _____ () C:\Documents and Settings\K\Desktop\Commands.txt
2015-04-10 01:05 - 2015-04-10 01:05 - 00000000 ____D () C:\Documents and Settings\K\Application Data\Help
2015-04-10 00:18 - 2015-04-10 00:18 - 00001548 _____ () C:\Documents and Settings\K\Desktop\Command Prompt.lnk
2015-04-09 05:30 - 2015-04-09 05:30 - 00000000 ___HD () C:\WINDOWS\PIF
2015-04-08 23:15 - 2015-04-09 05:30 - 00000000 __HDC () C:\WINDOWS\ie8
2015-04-08 22:18 - 2015-04-08 22:21 - 00034548 _____ () C:\WINDOWS\ie8Uninst.log
2015-04-08 22:17 - 2015-04-08 22:17 - 16883056 _____ (Microsoft Corporation) C:\Documents and Settings\LocalService\My Documents\IE8-WinXp-x86.exe
2015-04-08 18:56 - 2015-03-17 06:15 - 00120024 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mbamchameleon.sys
2015-04-08 05:21 - 2015-04-08 05:21 - 00000000 _SHDC () C:\Documents and Settings\Administrator.KEIONA.000\PrivacIE
2015-04-08 04:22 - 2015-04-11 18:51 - 00000178 __SHC () C:\Documents and Settings\Administrator.KEIONA.000\ntuser.ini
2015-04-08 04:22 - 2015-04-08 05:21 - 00000000 ___DC () C:\Documents and Settings\Administrator.KEIONA.000
2015-04-08 04:22 - 2015-04-08 04:22 - 00000000 _SHDC () C:\Documents and Settings\Administrator.KEIONA.000\IETldCache
2015-04-08 04:22 - 2013-11-18 07:15 - 00001604 ___HC () C:\Documents and Settings\Administrator.KEIONA.000\Start Menu\Programs\Remote Assistance.lnk
2015-04-08 04:22 - 2013-07-09 03:09 - 00000000 __HDC () C:\Documents and Settings\Administrator.KEIONA.000\Local Settings\Application Data\Microsoft Help
2015-04-08 04:22 - 2003-02-25 07:57 - 00000000 _RHDC () C:\Documents and Settings\Administrator.KEIONA.000\Start Menu\Programs\Accessories
2015-04-08 03:22 - 2015-04-08 03:22 - 00000000 ____D () C:\Program Files\Windows Audio
2015-04-07 05:48 - 2015-04-07 05:48 - 00000000 ____D () C:\Documents and Settings\K\Application Data\youtube-downloader-and-converter
2015-04-07 05:48 - 2015-04-07 05:48 - 00000000 ____D () C:\Documents and Settings\All Users\Start Menu\Programs\Optimizer Pro v3.2
2015-04-07 02:27 - 2015-04-07 05:11 - 00002136 ____C () C:\Documents and Settings\All Users\Application Data\tempimage.bmp
2015-04-06 22:31 - 2015-04-06 22:31 - 00000000 ___DC () C:\Documents and Settings\All Users\Application Data\Windows VXM
2015-04-06 21:40 - 2015-04-16 02:37 - 00000000 ____D () C:\Program Files\9135fa6f-851d-4210-8a06-c060645e7f6d
2015-04-06 21:40 - 2015-04-07 05:14 - 00000000 ____D () C:\Program Files\user extensions
2015-04-06 21:34 - 2015-04-16 03:42 - 00000000 ____D () C:\Documents and Settings\K\Local Settings\Application Data\Deployment
2015-04-06 20:56 - 2015-04-06 20:56 - 00000000 ____D () C:\Program Files\FamilySearch Indexing
2015-04-06 20:56 - 2015-04-06 20:56 - 00000000 ____D () C:\Documents and Settings\K\.FamilySearchIndexing
2015-04-06 20:56 - 2015-04-06 20:56 - 00000000 ____D () C:\Documents and Settings\All Users\Start Menu\Programs\FamilySearch
2015-04-06 19:32 - 2015-04-09 03:21 - 00000004 _____ () C:\WINDOWS\system32\029B560A371F4E00AB32838EBC01B9E7
2015-04-06 19:11 - 2015-04-16 20:02 - 00000000 ____D () C:\Documents and Settings\K\Application Data\Company
2015-04-06 19:11 - 2015-04-16 02:37 - 00000000 ___DC () C:\Documents and Settings\All Users\Application Data\{9d39d2a8-4a19-bd4c-9d39-9d2a84a14aa1}
2015-04-06 18:41 - 2015-04-06 18:41 - 00000000 ___DC () C:\Documents and Settings\All Users\Application Data\COMODO
2015-04-06 18:40 - 2015-04-06 18:40 - 00000000 ____D () C:\Program Files\COMODO
2015-04-06 18:38 - 2015-04-12 21:15 - 00000000 ___DC () C:\Documents and Settings\All Users\Application Data\{d57a658c-02a3-56a6-d57a-a658c02a9630}
2015-04-06 04:32 - 2015-04-06 20:54 - 00000000 ___DC () C:\138efef433ac4b7a372a18dc

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-04-16 21:59 - 2013-07-01 08:27 - 00000000 ____D () C:\Documents and Settings\All Users\Application Data\AVAST Software
2015-04-16 21:59 - 2003-02-25 07:55 - 01170339 _____ () C:\WINDOWS\WindowsUpdate.log
2015-04-16 21:51 - 2014-03-16 08:48 - 00000214 _____ () C:\WINDOWS\Tasks\Microsoft Windows XP End of Service Notification Logon.job
2015-04-16 21:26 - 2003-02-25 00:44 - 00000159 _____ () C:\WINDOWS\wiadebug.log
2015-04-16 21:26 - 2003-02-25 00:44 - 00000049 _____ () C:\WINDOWS\wiaservc.log
2015-04-16 21:25 - 2003-02-25 08:01 - 00000006 ____H () C:\WINDOWS\Tasks\SA.DAT
2015-04-16 21:23 - 2003-02-25 08:17 - 00000178 ___SH () C:\Documents and Settings\K\ntuser.ini
2015-04-16 20:24 - 2003-02-25 08:01 - 00032558 _____ () C:\WINDOWS\SchedLgU.Txt
2015-04-16 20:05 - 2006-02-28 06:00 - 00000227 ____C () C:\WINDOWS\system.ini
2015-04-16 20:00 - 2014-03-20 23:26 - 00000000 ____D () C:\Documents and Settings\K\Local Settings\Application Data\Temp
2015-04-16 19:22 - 2003-02-25 00:39 - 00000328 __RSH () C:\boot.ini
2015-04-16 18:56 - 2013-07-27 16:29 - 00726672 _____ () C:\WINDOWS\pfirewall.log
2015-04-16 06:00 - 2014-09-13 13:32 - 00000000 ____D () C:\Documents and Settings\K\Application Data\vlc
2015-04-16 05:38 - 2006-02-28 06:00 - 00000454 _____ () C:\WINDOWS\win.ini
2015-04-16 04:56 - 2003-02-25 07:52 - 00022231 ____C () C:\WINDOWS\wmsetup.log
2015-04-16 03:47 - 2014-09-14 05:49 - 00000178 _____ () C:\Documents and Settings\K\Desktop\converter.url
2015-04-16 03:42 - 2013-07-01 23:12 - 00000000 ____D () C:\Program Files\Google
2015-04-16 02:41 - 2013-06-28 15:36 - 00000000 __HDC () C:\WINDOWS\$NtUninstallKB978338$
2015-04-15 20:25 - 2014-03-02 23:29 - 00494436 _____ () C:\WINDOWS\setupapi.log
2015-04-14 19:49 - 2013-07-01 09:34 - 00000000 ____D () C:\Documents and Settings\All Users\Application Data\Microsoft Help
2015-04-14 19:48 - 2013-07-17 03:01 - 00000000 ____D () C:\WINDOWS\system32\MRT
2015-04-14 19:32 - 2013-06-28 15:45 - 125832184 _____ (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe
2015-04-12 21:19 - 2013-10-03 12:30 - 00000000 ___HD () C:\Documents and Settings\Fresh\Local Settings\Temp
2015-04-12 21:19 - 2003-02-25 08:17 - 00000000 ____D () C:\Documents and Settings\K
2015-04-12 20:51 - 2006-02-28 06:00 - 00013646 ____H () C:\WINDOWS\system32\wpa.dbl
2015-04-11 23:44 - 2014-09-07 03:57 - 00039473 _____ () C:\WINDOWS\KB2964358-IE8.log
2015-04-11 23:44 - 2014-09-07 01:58 - 00075198 _____ () C:\WINDOWS\KB2936068-IE8.log
2015-04-11 23:44 - 2013-07-01 09:43 - 00065536 _____ () C:\WINDOWS\system32\config\OAlerts.evt
2015-04-11 23:27 - 2013-07-28 00:25 - 00000000 ____D () C:\WINDOWS\system32\NtmsData
2015-04-11 16:10 - 2013-11-25 01:22 - 00001585 _____ () C:\Documents and Settings\K\Desktop\Event.lnk
2015-04-11 16:10 - 2013-11-18 18:01 - 00001292 _____ () C:\Documents and Settings\K\Desktop\Shared.lnk
2015-04-11 02:25 - 2013-07-01 08:41 - 00000000 ____D () C:\Documents and Settings\All Users\Application Data\Malwarebytes
2015-04-11 01:56 - 2003-02-25 00:40 - 36953687 _____ () C:\WINDOWS\setupact.log
2015-04-10 01:46 - 2014-09-17 00:46 - 00000128 _____ () C:\Documents and Settings\NetworkService\Application Data\WB.CFG
2015-04-10 01:16 - 2003-02-25 08:01 - 00000000 __SHD () C:\Documents and Settings\NetworkService
2015-04-10 01:05 - 2003-02-25 00:33 - 00000000 ____D () C:\WINDOWS\Help
2015-04-09 07:13 - 2013-07-27 16:29 - 04050606 _____ () C:\WINDOWS\pfirewall.log.old
2015-04-09 05:32 - 2013-06-28 15:49 - 00000000 ____D () C:\WINDOWS\ie8updates
2015-04-09 02:11 - 2013-06-28 14:36 - 00217689 _____ () C:\WINDOWS\updspapi.log
2015-04-09 02:11 - 2003-02-25 00:41 - 01740669 _____ () C:\WINDOWS\FaxSetup.log
2015-04-09 02:11 - 2003-02-25 00:41 - 01065035 _____ () C:\WINDOWS\ocgen.log
2015-04-09 02:11 - 2003-02-25 00:41 - 00724719 _____ () C:\WINDOWS\tsoc.log
2015-04-09 02:11 - 2003-02-25 00:41 - 00623449 _____ () C:\WINDOWS\comsetup.log
2015-04-09 02:11 - 2003-02-25 00:41 - 00416651 _____ () C:\WINDOWS\ntdtcsetup.log
2015-04-09 02:11 - 2003-02-25 00:41 - 00265582 _____ () C:\WINDOWS\iis6.log
2015-04-09 02:11 - 2003-02-25 00:41 - 00103451 _____ () C:\WINDOWS\ocmsn.log
2015-04-09 02:11 - 2003-02-25 00:41 - 00095469 _____ () C:\WINDOWS\msgsocm.log
2015-04-09 02:11 - 2003-02-25 00:41 - 00001355 _____ () C:\WINDOWS\imsins.log
2015-04-09 02:10 - 2014-02-16 22:31 - 00008661 ____C () C:\WINDOWS\KB2909210-IE8.log
2015-04-09 02:10 - 2003-02-25 00:41 - 00001355 _____ () C:\WINDOWS\imsins.BAK
2015-04-09 02:09 - 2013-07-01 08:31 - 00014279 ____C () C:\WINDOWS\KB2510531-IE8.log
2015-04-09 00:46 - 2015-01-04 22:50 - 00000010 _____ () C:\Documents and Settings\NetworkService\Local Settings\Application Data\DSI.DAT
2015-04-08 23:33 - 2013-06-28 14:42 - 00101340 ____C () C:\WINDOWS\spupdsvc.log
2015-04-08 23:29 - 2013-06-28 15:42 - 00253271 ____C () C:\WINDOWS\ie8_main.log
2015-04-08 23:27 - 2014-02-16 22:31 - 00046693 ____C () C:\WINDOWS\KB2909921-IE8.log
2015-04-08 23:26 - 2013-06-28 15:50 - 00090681 ____C () C:\WINDOWS\KB2598845-IE8.log
2015-04-08 23:25 - 2013-06-28 15:49 - 00108252 ____C () C:\WINDOWS\KB982381-IE8.log
2015-04-08 23:21 - 2013-06-28 15:47 - 00109348 ____C () C:\WINDOWS\ie8.log
2015-04-08 23:19 - 2003-02-25 00:33 - 00000000 ____D () C:\WINDOWS\Media
2015-04-08 22:29 - 2003-02-25 08:17 - 00000000 ___RD () C:\Documents and Settings\K\Start Menu\Programs\Accessories
2015-04-08 22:08 - 2003-02-25 08:01 - 00000000 __SHD () C:\Documents and Settings\LocalService
2015-04-08 18:54 - 2014-09-28 06:57 - 00000000 ____D () C:\Documents and Settings\K\Desktop\status
2015-04-08 17:16 - 2003-02-25 07:57 - 00001568 _____ () C:\Documents and Settings\All Users\Start Menu\Set Program Access and Defaults.lnk
2015-04-08 17:16 - 2003-02-25 07:57 - 00001512 _____ () C:\Documents and Settings\All Users\Start Menu\Windows Update.lnk
2015-04-08 15:01 - 2014-03-16 08:48 - 00000208 _____ () C:\WINDOWS\Tasks\Microsoft Windows XP End of Service Notification Monthly.job
2015-04-08 12:08 - 2013-07-22 22:52 - 00001603 _____ () C:\Documents and Settings\K\Desktop\Restore.lnk
2015-04-08 11:13 - 2013-12-15 20:10 - 00001324 _____ () C:\WINDOWS\system32\d3d9caps.dat
2015-04-07 05:53 - 2013-10-03 12:30 - 00000000 ___HD () C:\Documents and Settings\Fresh
2015-04-07 05:52 - 2003-02-25 07:53 - 00000000 ____D () C:\WINDOWS\Registration
2015-04-07 05:14 - 2013-11-07 18:34 - 00568474 ____C () C:\Documents and Settings\LocalService\Local Settings\Application Data\WPFFontCache_v0400-S-1-5-21-725345543-1958367476-682003330-1004-0.dat
2015-04-07 05:14 - 2013-11-04 12:02 - 00284450 ____C () C:\Documents and Settings\LocalService\Local Settings\Application Data\WPFFontCache_v0400-System.dat
2015-04-06 21:04 - 2015-01-06 21:20 - 00000000 ____D () C:\Program Files\Mozilla Firefox
2015-04-06 21:04 - 2015-01-06 21:10 - 00000000 ____D () C:\Program Files\Unchecky
2015-04-06 20:56 - 2015-01-13 23:20 - 00000000 ____D () C:\Documents and Settings\K\Application Data\BitTorrent
2015-04-06 20:32 - 2015-01-12 04:09 - 00000000 __SDC () C:\Documents and Settings\Administrator.KEIONA
2015-04-06 19:49 - 2013-07-01 08:27 - 00000000 ____D () C:\Program Files\AVAST Software
2015-04-06 19:06 - 2014-09-13 20:22 - 00070776 _____ () C:\Documents and Settings\LocalService\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2015-04-06 17:06 - 2014-06-24 15:36 - 00000000 ____D () C:\Documents and Settings\K\My Documents\Cartoons
2015-04-06 15:14 - 2013-07-01 10:47 - 00000000 ____D () C:\WINDOWS\Microsoft.NET
2015-04-06 06:37 - 2013-10-10 04:19 - 00636704 _____ () C:\WINDOWS\system32\PerfStringBackup.TMP
2015-04-06 04:49 - 2003-02-25 00:41 - 00000000 ____D () C:\Program Files\Common Files\Microsoft Shared

==================== Files in the root of some directories =======

2015-04-16 05:21 - 2015-04-16 05:21 - 0004608 _____ () C:\Documents and Settings\K\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\WINDOWS\explorer.exe => File is digitally signed
C:\WINDOWS\system32\winlogon.exe => File is digitally signed
C:\WINDOWS\system32\svchost.exe => File is digitally signed
C:\WINDOWS\system32\services.exe => File is digitally signed
C:\WINDOWS\system32\User32.dll => File is digitally signed
C:\WINDOWS\system32\userinit.exe => File is digitally signed
C:\WINDOWS\system32\rpcss.dll => File is digitally signed
C:\WINDOWS\system32\Drivers\volsnap.sys => File is digitally signed

==================== End Of Log ============================
 
Additional scan result of Farbar Recovery Scan Tool (x86) Version: 15-04-2015 04
Ran by K at 2015-04-16 22:46:25
Running from C:\Documents and Settings\K\Desktop
Boot Mode: Normal
==========================================================


==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: avast! Antivirus (Enabled - Up to date) {7591DB91-41F0-48A3-B128-1A293FD8233D}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

Adobe Reader XI (11.0.08) (HKLM\...\{AC76BA86-7AD7-1033-7B44-AB0000000001}) (Version: 11.0.08 - Adobe Systems Incorporated)
Android USB Driver (HKLM\...\Android USB Driver_is1) (Version: - )
Avast Free Antivirus (HKLM\...\Avast) (Version: 10.2.2215 - AVAST Software)
Belkin USB Wireless Adapter (HKLM\...\InstallShield_{549CE1BD-88E4-4C5E-BF75-B155624714CC}) (Version: 1.0.0.13 - Belkin)
Belkin USB Wireless Adapter (Version: 1.0.0.13 - Belkin) Hidden
FamilySearch Indexing 3.24.2 (HKLM\...\0591-8077-9297-0833) (Version: 3.24.2 - FamilySearch)
Google Chrome (HKLM\...\Google Chrome) (Version: 42.0.2311.90 - Google Inc.)
Google Update Helper (Version: 1.3.26.9 - Google Inc.) Hidden
Intel(R) PRO Ethernet Adapter and Software (HKLM\...\PROSet) (Version: - )
Itibiti RTC (Version: 0.0.1 - Itibiti Inc) Hidden
Java 7 Update 51 (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F83217051FF}) (Version: 7.0.510 - Oracle)
Malwarebytes Anti-Malware version 2.1.4.1018 (HKLM\...\Malwarebytes Anti-Malware_is1) (Version: 2.1.4.1018 - Malwarebytes Corporation)
Microsoft .NET Framework 2.0 Service Pack 2 (HKLM\...\{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}) (Version: 2.2.30729 - Microsoft Corporation)
Microsoft .NET Framework 3.0 Service Pack 2 (HKLM\...\{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}) (Version: 3.2.30729 - Microsoft Corporation)
Microsoft .NET Framework 3.5 SP1 (HKLM\...\Microsoft .NET Framework 3.5 SP1) (Version: - Microsoft Corporation)
Microsoft .NET Framework 4 Client Profile (HKLM\...\Microsoft .NET Framework 4 Client Profile) (Version: 4.0.30319 - Microsoft Corporation)
Microsoft Compression Client Pack 1.0 for Windows XP (HKLM\...\MSCompPackV1) (Version: 1 - Microsoft Corporation)
Microsoft Office Professional Plus 2010 (HKLM\...\Office14.PROPLUSR) (Version: 14.0.7015.1000 - Microsoft Corporation)
Microsoft User-Mode Driver Framework Feature Pack 1.0 (HKLM\...\Wudf01000) (Version: - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual Studio 2010 Tools for Office Runtime (x86) (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x86)) (Version: 10.0.50903 - Microsoft Corporation)
MotoHelper MergeModules (Version: 1.2.0 - Motorola) Hidden
MSXML 4.0 SP2 (KB954430) (HKLM\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (HKLM\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
Panda USB Vaccine 1.0.1.4 (HKLM\...\{55A41219-9B22-4098-BAE7-AE289B3C569A}_is1) (Version: - Panda Security)
Service Pack 2 for Microsoft Office 2010 (KB2687455) 32-Bit Edition (HKLM\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{DE28B448-32E8-4E8F-84F0-A52B21A49B5B}) (Version: - Microsoft)
VLC media player (HKLM\...\VLC media player) (Version: 2.1.5 - VideoLAN)
WebFldrs XP (Version: 9.50.7523 - Microsoft Corporation) Hidden
Windows Genuine Advantage Validation Tool (KB892130) (HKLM\...\KB892130) (Version: - Microsoft Corporation)
Windows Genuine Advantage Validation Tool (KB892130) (HKLM\...\WGA) (Version: 1.7.0069.2 - Microsoft Corporation)
Windows Internet Explorer 8 (HKLM\...\ie8) (Version: 20090308.140743 - Microsoft Corporation)
Windows Media Format 11 runtime (HKLM\...\Windows Media Format Runtime) (Version: - )
Windows Media Player 11 (HKLM\...\Windows Media Player) (Version: - )
Windows XP Service Pack 3 (HKLM\...\Windows XP Service Pack) (Version: 20080414.031525 - Microsoft Corporation)

==================== Custom CLSID (selected items): ==========================

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)


==================== Restore Points =========================

07-04-2015 03:35:15 Restore Operation
07-04-2015 03:50:30 Restore Operation
07-04-2015 05:13:53 Restore Operation
07-04-2015 05:46:08 Restore Operation
08-04-2015 11:26:59 Removed GeekBuddy.
08-04-2015 22:13:30 Software Distribution Service 3.0
08-04-2015 23:18:55 Installed Windows Internet Explorer 8.
08-04-2015 23:22:13 Software Distribution Service 3.0
09-04-2015 02:07:49 Software Distribution Service 3.0
09-04-2015 04:37:38 Removed UpdateAdmin
09-04-2015 04:59:07 Restore Operation
09-04-2015 05:18:11 Restore Operation
09-04-2015 05:37:48 Restore Operation
11-04-2015 04:28:09 System Checkpoint
11-04-2015 23:41:19 Software Distribution Service 3.0
13-04-2015 00:02:59 System Checkpoint
14-04-2015 03:35:14 System Checkpoint
14-04-2015 19:09:15 Software Distribution Service 3.0
15-04-2015 21:34:10 System Checkpoint
16-04-2015 19:06:18 Before
16-04-2015 19:07:23 Before ComboFix
16-04-2015 22:03:33 avast! antivirus system restore point

==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2006-02-28 06:00 - 2015-04-16 20:05 - 00000027 ____A C:\WINDOWS\system32\Drivers\etc\hosts
127.0.0.1 localhost

==================== Scheduled Tasks (whitelisted) =============

(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)

Task: C:\WINDOWS\Tasks\avast! Emergency Update.job => C:\Program Files\AVAST Software\Avast\AvastEmUpdate.exe
Task: C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files\Google\Update\GoogleUpdate.exe
Task: C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files\Google\Update\GoogleUpdate.exe
Task: C:\WINDOWS\Tasks\Microsoft Windows XP End of Service Notification Logon.job => C:\WINDOWS\system32\xp_eos.exe
Task: C:\WINDOWS\Tasks\Microsoft Windows XP End of Service Notification Monthly.job => C:\WINDOWS\system32\xp_eos.exe

==================== Loaded Modules (whitelisted) ==============

2013-11-01 23:02 - 2012-04-20 14:13 - 00517960 _____ () C:\Program Files\Froyo_Android_Driver\Bin\MonServiceUDisk.exe
2013-09-05 01:14 - 2013-09-05 01:14 - 04300456 _____ () C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\OFFICE.ODF
2010-10-20 15:45 - 2010-10-20 15:45 - 08801120 _____ () C:\Program Files\Microsoft Office\Office14\1033\GrooveIntlResource.dll
2006-02-28 06:00 - 2008-04-14 05:41 - 00059904 ____H () C:\WINDOWS\system32\devenum.dll
2006-02-28 06:00 - 2008-04-14 05:42 - 00014336 ____H () C:\WINDOWS\system32\msdmo.dll
2015-04-16 22:13 - 2015-04-16 22:13 - 00104400 _____ () C:\Program Files\AVAST Software\Avast\log.dll
2015-04-16 22:13 - 2015-04-16 22:13 - 00081728 _____ () C:\Program Files\AVAST Software\Avast\JsonRpcServer.dll
2015-04-16 22:23 - 2015-04-16 22:23 - 02926080 _____ () C:\Program Files\AVAST Software\Avast\defs\15041601\algo.dll
2015-04-16 22:15 - 2015-04-16 22:16 - 40540672 _____ () C:\Program Files\AVAST Software\Avast\libcef.dll
2015-04-16 22:14 - 2015-04-16 22:14 - 00985600 _____ () C:\Program Files\AVAST Software\Avast\ffmpegsumo.dll

==================== Alternate Data Streams (whitelisted) =========

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)

AlternateDataStreams: C:\WINDOWS\system32\appwiz.cpl:SummaryInformation
AlternateDataStreams: C:\WINDOWS\system32\sndrec32.exe:SummaryInformation
AlternateDataStreams: C:\WINDOWS\system32\Drivers\eusbstub.sys:SummaryInformation

==================== Safe Mode (whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)


==================== EXE Association (whitelisted) ===============

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)


==================== Other Areas ============================

(Currently there is no automatic fix for this section.)

HKU\S-1-5-21-725345543-1958367476-682003330-1004\Control Panel\Desktop\\Wallpaper ->
DNS Servers: 192.168.0.1 - 205.171.2.25

==================== MSCONFIG/TASK MANAGER disabled items ==

(Currently there is no automatic fix for this section.)


==================== Accounts: =============================

Administrator (S-1-5-21-725345543-1958367476-682003330-500 - Administrator - Enabled) => %SystemDrive%\Documents and Settings\Administrator.KEIONA.000
Guest (S-1-5-21-725345543-1958367476-682003330-501 - Limited - Enabled)
HelpAssistant (S-1-5-21-725345543-1958367476-682003330-1000 - Limited - Disabled)
K (S-1-5-21-725345543-1958367476-682003330-1004 - Administrator - Enabled) => %SystemDrive%\Documents and Settings\K
SUPPORT_388945a0 (S-1-5-21-725345543-1958367476-682003330-1002 - Limited - Disabled)

==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================
Error: (04/16/2015 07:06:36 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Hanging application rstrui.exe, version 5.1.2600.5512, hang module hungapp, version 0.0.0.0, hang address 0x00000000.

Error: (04/16/2015 07:06:32 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Hanging application rstrui.exe, version 5.1.2600.5512, hang module hungapp, version 0.0.0.0, hang address 0x00000000.

Error: (04/16/2015 06:20:55 AM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Hanging application explorer.exe, version 6.0.2900.5512, hang module hungapp, version 0.0.0.0, hang address 0x00000000.

Error: (04/16/2015 06:20:42 AM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Hanging application ImgBurn.exe, version 2.5.1.0, hang module hungapp, version 0.0.0.0, hang address 0x00000000.

Error: (04/16/2015 06:14:00 AM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Hanging application OTLPENet.exe, version 4.65.0.0, hang module hungapp, version 0.0.0.0, hang address 0x00000000.

Error: (04/16/2015 05:17:04 AM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Hanging application rundll32.exe, version 5.1.2600.5512, hang module hungapp, version 0.0.0.0, hang address 0x00000000.

Error: (04/16/2015 05:16:34 AM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Hanging application rundll32.exe, version 5.1.2600.5512, hang module hungapp, version 0.0.0.0, hang address 0x00000000.

Error: (04/16/2015 05:16:14 AM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Hanging application rundll32.exe, version 5.1.2600.5512, hang module hungapp, version 0.0.0.0, hang address 0x00000000.

Error: (04/15/2015 10:40:09 PM) (Source: Ci) (EventID: 4126) (User: )
Description: Cleaning up corrupt content index metadata on c:\system volume information\catalog.wci. Index will
be automatically restored by refiltering all documents.

Error: (04/15/2015 10:40:09 PM) (Source: Ci) (EventID: 4124) (User: )
Description: Content index on c:\system volume information\catalog.wci is corrupt. Please shutdown and restart
the Indexing Service (cisvc).


System errors:
=============
Error: (04/16/2015 09:51:12 PM) (Source: Service Control Manager) (EventID: 7011) (User: )
Description: Timeout (30000 milliseconds) waiting for a transaction response from the MBAMService service.

Error: (04/16/2015 09:23:55 PM) (Source: DCOM) (EventID: 10005) (User: NT AUTHORITY)
Description: DCOM got error "%%1084" attempting to start the service EventSystem with arguments ""
in order to run the server:
{1BE1F766-5536-11D1-B726-00C04FB926AF}

Error: (04/16/2015 09:17:00 PM) (Source: DCOM) (EventID: 10005) (User: DESTINY)
Description: DCOM got error "%%1084" attempting to start the service StiSvc with arguments ""
in order to run the server:
{A1F4E726-8CF1-11D1-BF92-0060081ED811}

Error: (04/16/2015 09:15:59 PM) (Source: DCOM) (EventID: 10005) (User: DESTINY)
Description: DCOM got error "%%1084" attempting to start the service StiSvc with arguments ""
in order to run the server:
{A1F4E726-8CF1-11D1-BF92-0060081ED811}

Error: (04/16/2015 08:54:35 PM) (Source: Service Control Manager) (EventID: 7026) (User: )
Description: The following boot-start or system-start driver(s) failed to load:
AFD
Fips
intelppm
IPSec
MRxSmb
NetBIOS
NetBT
RasAcd
Rdbss
Tcpip
WS2IFSL

Error: (04/16/2015 08:54:35 PM) (Source: Service Control Manager) (EventID: 7001) (User: )
Description: The IPSEC Services service depends on the IPSEC driver service which failed to start because of the following error:
%%31

Error: (04/16/2015 08:54:35 PM) (Source: Service Control Manager) (EventID: 7001) (User: )
Description: The TCP/IP NetBIOS Helper service depends on the AFD service which failed to start because of the following error:
%%31

Error: (04/16/2015 08:54:35 PM) (Source: Service Control Manager) (EventID: 7001) (User: )
Description: The DNS Client service depends on the TCP/IP Protocol Driver service which failed to start because of the following error:
%%31

Error: (04/16/2015 08:54:35 PM) (Source: Service Control Manager) (EventID: 7001) (User: )
Description: The DHCP Client service depends on the NetBios over Tcpip service which failed to start because of the following error:
%%31

Error: (04/16/2015 08:54:22 PM) (Source: DCOM) (EventID: 10005) (User: NT AUTHORITY)
Description: DCOM got error "%%1084" attempting to start the service EventSystem with arguments ""
in order to run the server:
{1BE1F766-5536-11D1-B726-00C04FB926AF}


Microsoft Office Sessions:
=========================
Error: (04/16/2015 07:06:36 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: rstrui.exe5.1.2600.5512hungapp0.0.0.000000000

Error: (04/16/2015 07:06:32 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: rstrui.exe5.1.2600.5512hungapp0.0.0.000000000

Error: (04/16/2015 06:20:55 AM) (Source: Application Hang) (EventID: 1002) (User: )
Description: explorer.exe6.0.2900.5512hungapp0.0.0.000000000

Error: (04/16/2015 06:20:42 AM) (Source: Application Hang) (EventID: 1002) (User: )
Description: ImgBurn.exe2.5.1.0hungapp0.0.0.000000000

Error: (04/16/2015 06:14:00 AM) (Source: Application Hang) (EventID: 1002) (User: )
Description: OTLPENet.exe4.65.0.0hungapp0.0.0.000000000

Error: (04/16/2015 05:17:04 AM) (Source: Application Hang) (EventID: 1002) (User: )
Description: rundll32.exe5.1.2600.5512hungapp0.0.0.000000000

Error: (04/16/2015 05:16:34 AM) (Source: Application Hang) (EventID: 1002) (User: )
Description: rundll32.exe5.1.2600.5512hungapp0.0.0.000000000

Error: (04/16/2015 05:16:14 AM) (Source: Application Hang) (EventID: 1002) (User: )
Description: rundll32.exe5.1.2600.5512hungapp0.0.0.000000000

Error: (04/15/2015 10:40:09 PM) (Source: Ci) (EventID: 4126) (User: )
Description: c:\system volume information\catalog.wci

Error: (04/15/2015 10:40:09 PM) (Source: Ci) (EventID: 4124) (User: )
Description: c:\system volume information\catalog.wci


==================== Memory info ===========================

Processor: Intel(R) Pentium(R) 4 CPU 2.40GHz
Percentage of memory in use: 78%
Total physical RAM: 1022.99 MB
Available physical RAM: 219.04 MB
Total Pagefile: 3928.54 MB
Available Pagefile: 3070.94 MB
Total Virtual: 2047.88 MB
Available Virtual: 1953.39 MB

==================== Drives ================================

Drive c: (Local) (Fixed) (Total:38.16 GB) (Free:5.6 GB) NTFS ==>[Drive with boot components (Windows XP)]
Drive e: (LEXAR) (Removable) (Total:0.47 GB) (Free:0.47 GB) FAT

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows XP) (Size: 38.2 GB) (Disk ID: 15911591)
Partition 1: (Active) - (Size=38.2 GB) - (Type=07 NTFS)

========================================================
Disk: 1 (MBR Code: Windows XP) (Size: 483.5 MB) (Disk ID: C3072E18)
Partition 1: (Not Active) - (Size=483 MB) - (Type=06)

==================== End Of Log ============================
 
Download attached fixlist.txt file and save it to the Desktop.
NOTE. It's important that both files, FRST and fixlist.txt are in the same location or the fix will not work.

NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system

Run FRST(FRST64) and press the Fix button just once and wait.
The tool will make a log on the Desktop (Fixlog.txt). Please post it to your reply.
 

Attachments

  • fixlist.txt
    899 bytes · Views: 2
Fix result of Farbar Recovery Tool (FRST written by Farbar) (x86) Version: 15-04-2015 04
Ran by K at 2015-04-17 22:04:43 Run:8
Running from C:\Documents and Settings\K\Desktop
Loaded Profiles: K (Available profiles: K & Administrator)
Boot Mode: Normal

==============================================

Content of fixlist:
*****************
HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
HKU\S-1-5-21-725345543-1958367476-682003330-1004\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
S3 catchme; \??\C:\DOCUME~1\K\LOCALS~1\Temp\catchme.sys [X]
U3 TlntSvr; No ImagePath
2015-04-06 18:41 - 2015-04-06 18:41 - 00000000 ___DC () C:\Documents and Settings\All Users\Application Data\COMODO
2015-04-06 18:40 - 2015-04-06 18:40 - 00000000 ____D () C:\Program Files\COMODO
2015-04-16 05:21 - 2015-04-16 05:21 - 0004608 _____ () C:\Documents and Settings\K\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
AlternateDataStreams: C:\WINDOWS\system32\appwiz.cpl:SummaryInformation
AlternateDataStreams: C:\WINDOWS\system32\sndrec32.exe:SummaryInformation
AlternateDataStreams: C:\WINDOWS\system32\Drivers\eusbstub.sys:SummaryInformation

*****************

"HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer" => Key deleted successfully.
"HKU\S-1-5-21-725345543-1958367476-682003330-1004\SOFTWARE\Policies\Microsoft\Internet Explorer" => Key deleted successfully.
catchme => Service deleted successfully.
TlntSvr => Service deleted successfully.
C:\Documents and Settings\All Users\Application Data\COMODO => Moved successfully.
C:\Program Files\COMODO => Moved successfully.
C:\Documents and Settings\K\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini => Moved successfully.
"C:\WINDOWS\system32\appwiz.cpl" => ":SummaryInformation" ADS not found.
"C:\WINDOWS\system32\sndrec32.exe" => ":SummaryInformation" ADS not found.
"C:\WINDOWS\system32\Drivers\eusbstub.sys" => ":SummaryInformation" ADS not found.

==== End of Fixlog 22:05:02 ====
 
Good :)

Last scans...

redtarget.gif
Download Security Check from here or here and save it to your Desktop.
  • Double-click SecurityCheck.exe
  • Follow the onscreen instructions inside of the black box.
  • A Notepad document should open automatically called checkup.txt; please post the contents of that document.
NOTE 1. If one of your security applications (e.g., third-party firewall) requests permission to allow DIG.EXE access the Internet, allow it to do so.
NOTE 2. SecurityCheck may produce some false warning(s), so leave the results reading to me.
NOTE 3. If you receive UNSUPPORTED OPERATING SYSTEM! ABORTED! message restart computer and Security Check should run


redtarget.gif
Please download Farbar Service Scanner (FSS) and run it on the computer with the issue.
  • Make sure the following options are checked:
    • Internet Services
    • Windows Firewall
    • System Restore
    • Security Center
    • Windows Update
    • Windows Defender
    • Other Services
  • Press "Scan".
  • It will create a log (FSS.txt) in the same directory the tool is run.
  • Please copy and paste the log to your reply.

redtarget.gif
Download Temp File Cleaner (TFC)
Alternate download: http://www.itxassociates.com/OT-Tools/TFC.exe
  • Double click on TFC.exe to run the program.
  • Click on Start button to begin cleaning process.
  • TFC will close all running programs, and it may ask you to restart computer.

redtarget.gif
Download Sophos Free Virus Removal Tool and save it to your desktop.
  • Double click the icon and select Run
  • Click Next
  • Select I accept the terms in this license agreement, then click Next twice
  • Click Install
  • Click Finish to launch the program
  • Once the virus database has been updated click Start Scanning
  • If any threats are found click Details, then View log file... (bottom left hand corner)
  • Copy and paste the results in your reply
  • Close the Notepad document, close the Threat Details screen, then click Start cleanup
  • Click Exit to close the program
 
Farbar Service Scanner Version: 17-01-2015
Ran by K (administrator) on 17-04-2015 at 22:57:57
Running from "C:\Documents and Settings\K\Desktop"
Microsoft Windows XP Home Edition Service Pack 3 (X86)
Boot Mode: Normal
****************************************************************

Internet Services:
============

Connection Status:
==============
Localhost is accessible.
LAN connected.
Google IP is accessible.
Google.com is accessible.
Yahoo.com is accessible.


Windows Firewall:
=============

Firewall Disabled Policy:
==================


System Restore:
============

System Restore Policy:
========================


Security Center:
============


Windows Update:
============

Windows Autoupdate Disabled Policy:
============================


Other Services:
==============


File Check:
========
C:\WINDOWS\system32\dhcpcsvc.dll => File is digitally signed
C:\WINDOWS\system32\Drivers\afd.sys => File is digitally signed
C:\WINDOWS\system32\Drivers\netbt.sys => File is digitally signed
C:\WINDOWS\system32\Drivers\tcpip.sys => File is digitally signed
C:\WINDOWS\system32\Drivers\ipsec.sys => File is digitally signed
C:\WINDOWS\system32\dnsrslvr.dll => File is digitally signed
C:\WINDOWS\system32\ipnathlp.dll => File is digitally signed
C:\WINDOWS\system32\netman.dll => File is digitally signed
C:\WINDOWS\system32\wbem\WMIsvc.dll => File is digitally signed
C:\WINDOWS\system32\srsvc.dll => File is digitally signed
C:\WINDOWS\system32\Drivers\sr.sys => File is digitally signed
C:\WINDOWS\system32\wscsvc.dll => File is digitally signed
C:\WINDOWS\system32\wbem\WMIsvc.dll => File is digitally signed
C:\WINDOWS\system32\wuauserv.dll => File is digitally signed
C:\WINDOWS\system32\qmgr.dll => File is digitally signed
C:\WINDOWS\system32\es.dll => File is digitally signed
C:\WINDOWS\system32\cryptsvc.dll => File is digitally signed
C:\WINDOWS\system32\svchost.exe => File is digitally signed
C:\WINDOWS\system32\rpcss.dll => File is digitally signed
C:\WINDOWS\system32\services.exe => File is digitally signed

Extra List:
=======
aswTdi(11) Gpc(3) IPSec(5) NetBT(6) PSched(7) Tcpip(4)
0x0B00000005000000010000000200000003000000040000000B0000000A00000009000000080000000600000007000000
IpSec Tag value is correct.

**** End of log ****
 
Results of screen317's Security Check version 1.00
Windows XP Service Pack 3 x86
Internet Explorer 8
``````````````Antivirus/Firewall Check:``````````````
Windows Firewall Enabled!
Avast Free Antivirus
`````````Anti-malware/Other Utilities Check:`````````
Java 7 Update 51
Java version 32-bit out of Date!
Adobe Reader XI
Google Chrome (42.0.2311.90)
````````Process Check: objlist.exe by Laurent````````
Malwarebytes Anti-Malware mbamservice.exe
Malwarebytes Anti-Malware mbam.exe
Malwarebytes Anti-Malware mbamscheduler.exe
AVAST Software Avast AvastSvc.exe
AVAST Software Avast AvastUI.exe
`````````````````System Health check`````````````````
Total Fragmentation on Drive C:: 20% Defragment your hard drive soon! (Do NOT defrag if SSD!)
````````````````````End of Log``````````````````````
 
2015-04-18 05:50:28.078 Sophos Virus Removal Tool version 2.5.4
2015-04-18 05:50:28.078 Copyright (c) 2009-2014 Sophos Limited. All rights reserved.

2015-04-18 05:50:28.078 This tool will scan your computer for viruses and other threats. If it finds any, it will give you the option to remove them.

2015-04-18 05:50:28.078 Windows version 5.1 SP 3.0 Service Pack 3 build 2600 SM=0x300 PT=0x1 Win32
2015-04-18 05:50:28.078 Checking for updates...
2015-04-18 05:50:30.687 Update progress: proxy server not available
2015-04-18 05:51:12.156 Option all = no
2015-04-18 05:51:12.156 Option recurse = yes
2015-04-18 05:51:12.156 Option archive = no
2015-04-18 05:51:12.156 Option service = yes
2015-04-18 05:51:12.156 Option confirm = yes
2015-04-18 05:51:12.156 Option sxl = yes
2015-04-18 05:51:12.156 Option max-data-age = 35
2015-04-18 05:51:12.156 Option EnableSafeClean = yes
2015-04-18 05:51:14.484 Option vdl-logging = yes
2015-04-18 05:51:14.531 Customer ID: 094260ca9b3af99f9d4a3909fc47a743
2015-04-18 05:51:14.531 Machine ID: f386f28a1138479196d958fac984f5a7
2015-04-18 05:51:14.718 Component SVRTcli.exe version 2.5.4
2015-04-18 05:51:14.718 Component control.dll version 2.5.4
2015-04-18 05:51:14.718 Component SVRTservice.exe version 2.5.4
2015-04-18 05:51:14.718 Component engine\osdp.dll version 1.44.1.2200
2015-04-18 05:51:14.718 Component engine\veex.dll version 3.60.0.2200
2015-04-18 05:51:14.718 Component engine\savi.dll version 8.1.7.2200
2015-04-18 05:51:14.734 Component rkdisk.dll version 1.5.30.0
2015-04-18 05:51:14.734 Version info: Product version 2.5.4
2015-04-18 05:51:14.750 Version info: Detection engine 3.60.0
2015-04-18 05:51:14.750 Version info: Detection data 5.13
2015-04-18 05:51:14.750 Version info: Build date 3/31/2015
2015-04-18 05:51:14.750 Version info: Data files added 264
2015-04-18 05:51:14.750 Version info: Last successful update (not yet updated)
2015-04-18 05:51:47.343 Downloading updates...
2015-04-18 05:51:47.343 Update progress: [I96736] Looking for package C1A903B2-E63E-483b-982D-04BB9C457C60 1.0
2015-04-18 05:51:47.343 Update progress: [I49502] Found supplement SAVIW32 LATEST
2015-04-18 05:51:47.343 Update progress: [I49502] Found supplement IDE514 LATEST
2015-04-18 05:51:47.343 Update progress: [I49502] Found supplement IDE515 LATEST
2015-04-18 05:51:47.343 Update progress: [I49502] Found supplement IDE516 LATEST
2015-04-18 05:51:47.343 Update progress: [I19463] Syncing product C1A903B2-E63E-483b-982D-04BB9C457C60 1
2015-04-18 05:51:47.343 Update progress: [I19463] Syncing product SAVIW32 53
2015-04-18 05:52:39.328 Update progress: [I19463] Syncing product IDE514 161
2015-04-18 05:52:45.750 Installing updates...
2015-04-18 05:52:50.359 Error level 1
2015-04-18 05:52:51.140 Update progress: [I19463] Syncing product IDE515 106
2015-04-18 05:52:51.140 Update progress: [I19463] Syncing product IDE516 1
2015-04-18 05:53:56.593 Update successful
2015-04-18 05:54:44.015 Option all = no
2015-04-18 05:54:44.015 Option recurse = yes
2015-04-18 05:54:44.015 Option archive = no
2015-04-18 05:54:44.015 Option service = yes
2015-04-18 05:54:44.015 Option confirm = yes
2015-04-18 05:54:44.015 Option sxl = yes
2015-04-18 05:54:44.031 Option max-data-age = 35
2015-04-18 05:54:44.031 Option EnableSafeClean = yes
2015-04-18 05:54:44.171 Option vdl-logging = yes
2015-04-18 05:54:44.265 Customer ID: 094260ca9b3af99f9d4a3909fc47a743
2015-04-18 05:54:44.265 Machine ID: f386f28a1138479196d958fac984f5a7
2015-04-18 05:54:44.375 Component SVRTcli.exe version 2.5.4
2015-04-18 05:54:44.375 Component control.dll version 2.5.4
2015-04-18 05:54:44.375 Component SVRTservice.exe version 2.5.4
2015-04-18 05:54:44.375 Component engine\osdp.dll version 1.44.1.2200
2015-04-18 05:54:44.375 Component engine\veex.dll version 3.60.0.2200
2015-04-18 05:54:44.375 Component engine\savi.dll version 8.1.7.2200
2015-04-18 05:54:44.453 Component rkdisk.dll version 1.5.30.0
2015-04-18 05:54:44.453 Version info: Product version 2.5.4
2015-04-18 05:54:44.453 Version info: Detection engine 3.60.0
2015-04-18 05:54:44.453 Version info: Detection data 5.13G
2015-04-18 05:54:44.453 Version info: Build date 3/31/2015
2015-04-18 05:54:44.453 Version info: Data files added 264
2015-04-18 05:54:44.453 Version info: Last successful update 4/17/2015 11:53:56 PM


2015-04-18 06:47:58.281 Scan cancelled by user.
2015-04-18 06:47:58.281

------------------------------------------------------------

2015-04-18 06:55:30.546 Sophos Virus Removal Tool version 2.5.4
2015-04-18 06:55:30.546 Copyright (c) 2009-2014 Sophos Limited. All rights reserved.

2015-04-18 06:55:30.546 This tool will scan your computer for viruses and other threats. If it finds any, it will give you the option to remove them.

2015-04-18 06:55:30.546 Windows version 5.1 SP 3.0 Service Pack 3 build 2600 SM=0x300 PT=0x1 Win32
2015-04-18 06:55:30.562 Checking for updates...
2015-04-18 06:55:34.265 Update progress: proxy server not available
2015-04-18 07:01:38.890 Update not required
2015-04-18 07:01:40.046 Option all = no
2015-04-18 07:01:40.046 Option recurse = yes
2015-04-18 07:01:40.046 Option archive = no
2015-04-18 07:01:40.046 Option service = yes
2015-04-18 07:01:40.046 Option confirm = yes
2015-04-18 07:01:40.046 Option sxl = yes
2015-04-18 07:01:40.046 Option max-data-age = 35
2015-04-18 07:01:40.046 Option EnableSafeClean = yes
2015-04-18 07:01:40.281 Option vdl-logging = yes
2015-04-18 07:01:40.562 Customer ID: 094260ca9b3af99f9d4a3909fc47a743
2015-04-18 07:01:40.562 Machine ID: f386f28a1138479196d958fac984f5a7
2015-04-18 07:01:41.578 Component SVRTcli.exe version 2.5.4
2015-04-18 07:01:41.578 Component control.dll version 2.5.4
2015-04-18 07:01:41.578 Component SVRTservice.exe version 2.5.4
2015-04-18 07:01:41.578 Component engine\osdp.dll version 1.44.1.2200
2015-04-18 07:01:41.578 Component engine\veex.dll version 3.60.0.2200
2015-04-18 07:01:41.609 Component engine\savi.dll version 8.1.7.2200
2015-04-18 07:01:42.000 Component rkdisk.dll version 1.5.30.0
2015-04-18 07:01:42.000 Version info: Product version 2.5.4
2015-04-18 07:01:42.000 Version info: Detection engine 3.60.0
2015-04-18 07:01:42.000 Version info: Detection data 5.13G
2015-04-18 07:01:42.031 Version info: Build date 3/31/2015
2015-04-18 07:01:42.031 Version info: Data files added 264
2015-04-18 07:01:42.031 Version info: Last successful update 4/17/2015 11:53:56 PM

2015-04-18 08:40:22.156 Could not check C:\Documents and Settings\K\Local Settings\Application Data\Google\Chrome\User Data\Default\Extension Rules\LOCK (virus scan failed)
2015-04-18 08:40:22.296 Could not check C:\Documents and Settings\K\Local Settings\Application Data\Google\Chrome\User Data\Default\Extension State\LOCK (virus scan failed)
2015-04-18 08:40:49.453 Could not check C:\Documents and Settings\K\Local Settings\Application Data\Google\Chrome\User Data\Default\File System\Origins\LOCK (virus scan failed)
2015-04-18 08:40:49.625 Could not check C:\Documents and Settings\K\Local Settings\Application Data\Google\Chrome\User Data\Default\GCM Store\LOCK (virus scan failed)
2015-04-18 08:40:51.796 Could not check C:\Documents and Settings\K\Local Settings\Application Data\Google\Chrome\User Data\Default\IndexedDB\chrome-extension_oehpjpccmlcalbenfhnacjeocbjdonic_0.indexeddb.leveldb\LOCK (virus scan failed)
2015-04-18 08:40:53.078 Could not check C:\Documents and Settings\K\Local Settings\Application Data\Google\Chrome\User Data\Default\Local Extension Settings\pafkbggdmjlpgkdkcbjmhmfcdpncadgh\LOCK (virus scan failed)
2015-04-18 08:41:01.796 Could not check C:\Documents and Settings\K\Local Settings\Application Data\Google\Chrome\User Data\Default\Session Storage\LOCK (virus scan failed)
2015-04-18 08:51:37.218 Could not open C:\hiberfil.sys
2015-04-18 09:53:21.406 Warning: failed to stop service (1053: The service did not respond to the start or control request in a timely fashion.)
2015-04-18 09:53:21.546 SafeClean bin directory is empty.

2015-04-18 09:53:38.234 Scan cancelled by user.
2015-04-18 09:53:38.234

------------------------------------------------------------

2015-04-18 09:55:20.781 Sophos Virus Removal Tool version 2.5.4
2015-04-18 09:55:20.781 Copyright (c) 2009-2014 Sophos Limited. All rights reserved.

2015-04-18 09:55:20.781 This tool will scan your computer for viruses and other threats. If it finds any, it will give you the option to remove them.

2015-04-18 09:55:20.781 Windows version 5.1 SP 3.0 Service Pack 3 build 2600 SM=0x300 PT=0x1 Win32
2015-04-18 09:55:20.781 Checking for updates...
2015-04-18 09:55:29.312 Update progress: proxy server not available
2015-04-18 09:58:44.718 Downloading updates...
2015-04-18 09:58:45.031 Update progress: [I96736] Looking for package C1A903B2-E63E-483b-982D-04BB9C457C60 1.0
2015-04-18 09:58:45.031 Update progress: [I49502] Found supplement SAVIW32 LATEST
2015-04-18 09:58:45.031 Update progress: [I49502] Found supplement IDE514 LATEST
2015-04-18 09:58:45.031 Update progress: [I49502] Found supplement IDE515 LATEST
2015-04-18 09:58:45.031 Update progress: [I49502] Found supplement IDE516 LATEST
2015-04-18 09:58:45.031 Update progress: [I19463] Syncing product C1A903B2-E63E-483b-982D-04BB9C457C60 1
2015-04-18 09:58:45.031 Update progress: [I19463] Syncing product SAVIW32 53
2015-04-18 09:58:45.031 Update progress: [I19463] Syncing product IDE514 161
2015-04-18 09:59:11.375 Update progress: [I19463] Syncing product IDE515 107
2015-04-18 09:59:13.953 Installing updates...
2015-04-18 09:59:45.187 Update progress: [I19463] Syncing product IDE516 1
2015-04-18 09:59:45.593 Update successful
2015-04-18 09:59:49.625 Error: an instance of this application is already running.
2015-04-18 10:00:33.359 Option all = no
2015-04-18 10:00:40.718 Option recurse = yes
2015-04-18 10:00:40.718 Option archive = no
2015-04-18 10:00:40.718 Option service = yes
2015-04-18 10:00:40.718 Option confirm = yes
2015-04-18 10:00:40.718 Option sxl = yes
2015-04-18 10:00:40.718 Option max-data-age = 35
2015-04-18 10:00:40.718 Option EnableSafeClean = yes
2015-04-18 10:00:40.718 Option vdl-logging = yes
2015-04-18 10:00:40.718 Customer ID: 094260ca9b3af99f9d4a3909fc47a743
2015-04-18 10:00:40.718 Machine ID: f386f28a1138479196d958fac984f5a7
2015-04-18 10:00:40.718 Component SVRTcli.exe version 2.5.4
2015-04-18 10:00:40.718 Component control.dll version 2.5.4
2015-04-18 10:00:40.718 Component SVRTservice.exe version 2.5.4
2015-04-18 10:00:40.718 Component engine\osdp.dll version 1.44.1.2200
2015-04-18 10:00:40.718 Component engine\veex.dll version 3.60.0.2200
2015-04-18 10:00:40.718 Component engine\savi.dll version 8.1.7.2200
2015-04-18 10:00:40.718 Component rkdisk.dll version 1.5.30.0
2015-04-18 10:00:40.718 Version info: Product version 2.5.4
2015-04-18 10:00:40.718 Version info: Detection engine 3.60.0
2015-04-18 10:00:40.718 Version info: Detection data 5.13G
2015-04-18 10:00:40.718 Version info: Build date 3/31/2015
2015-04-18 10:00:40.718 Version info: Data files added 265
2015-04-18 10:00:40.718 Version info: Last successful update 4/18/2015 3:59:45 AM
2015-04-18 10:00:40.718 Error level 1

2015-04-18 10:01:23.593 Scan failed due to fatal error.
2015-04-18 10:01:23.593

------------------------------------------------------------

2015-04-18 10:15:27.109 Sophos Virus Removal Tool version 2.5.4
2015-04-18 10:15:27.109 Copyright (c) 2009-2014 Sophos Limited. All rights reserved.

2015-04-18 10:15:27.109 This tool will scan your computer for viruses and other threats. If it finds any, it will give you the option to remove them.

2015-04-18 10:15:27.109 Windows version 5.1 SP 3.0 Service Pack 3 build 2600 SM=0x300 PT=0x1 Win32
2015-04-18 10:15:27.109 Checking for updates...
2015-04-18 10:15:31.750 Update progress: proxy server not available
2015-04-18 10:18:57.250 Update not required
2015-04-18 10:19:06.203 Option all = no
2015-04-18 10:19:06.203 Option recurse = yes
2015-04-18 10:19:06.203 Option archive = no
2015-04-18 10:19:06.203 Option service = yes
2015-04-18 10:19:06.203 Option confirm = yes
2015-04-18 10:19:06.203 Option sxl = yes
2015-04-18 10:19:06.218 Option max-data-age = 35
2015-04-18 10:19:06.218 Option EnableSafeClean = yes
2015-04-18 10:19:06.796 Option vdl-logging = yes
2015-04-18 10:19:06.906 Customer ID: 094260ca9b3af99f9d4a3909fc47a743
2015-04-18 10:19:06.906 Machine ID: f386f28a1138479196d958fac984f5a7
2015-04-18 10:19:07.562 Component SVRTcli.exe version 2.5.4
2015-04-18 10:19:07.562 Component control.dll version 2.5.4
2015-04-18 10:19:07.562 Component SVRTservice.exe version 2.5.4
2015-04-18 10:19:07.562 Component engine\osdp.dll version 1.44.1.2200
2015-04-18 10:19:07.562 Component engine\veex.dll version 3.60.0.2200
2015-04-18 10:19:07.562 Component engine\savi.dll version 8.1.7.2200
2015-04-18 10:19:07.812 Component rkdisk.dll version 1.5.30.0
2015-04-18 10:19:07.812 Version info: Product version 2.5.4
2015-04-18 10:19:07.828 Version info: Detection engine 3.60.0
2015-04-18 10:19:07.828 Version info: Detection data 5.13G
2015-04-18 10:19:07.828 Version info: Build date 3/31/2015
2015-04-18 10:19:07.828 Version info: Data files added 265
2015-04-18 10:19:07.828 Version info: Last successful update 4/18/2015 3:59:45 AM

2015-04-18 11:20:38.046 Could not check C:\Documents and Settings\K\Local Settings\Application Data\Google\Chrome\User Data\Default\Extension Rules\LOCK (virus scan failed)
2015-04-18 11:20:38.093 Could not check C:\Documents and Settings\K\Local Settings\Application Data\Google\Chrome\User Data\Default\Extension State\LOCK (virus scan failed)
2015-04-18 11:20:51.750 Could not check C:\Documents and Settings\K\Local Settings\Application Data\Google\Chrome\User Data\Default\File System\Origins\LOCK (virus scan failed)
2015-04-18 11:20:51.796 Could not check C:\Documents and Settings\K\Local Settings\Application Data\Google\Chrome\User Data\Default\GCM Store\LOCK (virus scan failed)
2015-04-18 11:20:52.609 Could not check C:\Documents and Settings\K\Local Settings\Application Data\Google\Chrome\User Data\Default\IndexedDB\chrome-extension_oehpjpccmlcalbenfhnacjeocbjdonic_0.indexeddb.leveldb\LOCK (virus scan failed)
2015-04-18 11:20:53.359 Could not check C:\Documents and Settings\K\Local Settings\Application Data\Google\Chrome\User Data\Default\Local Extension Settings\pafkbggdmjlpgkdkcbjmhmfcdpncadgh\LOCK (virus scan failed)
2015-04-18 11:20:57.843 Could not check C:\Documents and Settings\K\Local Settings\Application Data\Google\Chrome\User Data\Default\Session Storage\LOCK (virus scan failed)
2015-04-18 11:27:20.140 Could not open C:\hiberfil.sys
2015-04-18 12:03:03.781 >>> Virus 'Troj/Bprotect-F' found in file C:\System Volume Information\_restore{3E602A38-F5E5-47DB-93C5-0571F454F258}\RP496\A0404172.dll
2015-04-18 12:03:03.781 >>> Virus 'Troj/Bprotect-F' found in file HKLM\SOFTWARE\Microsoft\Security Center\AntiVirusOverride
2015-04-18 12:03:03.796 >>> Virus 'Troj/Bprotect-F' found in file HKU\S-1-5-21-725345543-1958367476-682003330-1004\Software\Microsoft\Windows\CurrentVersion\Internet Settings\WarnOnPostRedirect
2015-04-18 12:03:03.796 >>> Virus 'Troj/Bprotect-F' found in file HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\WarnOnPostRedirect
2015-04-18 12:03:03.796 >>> Virus 'Troj/Bprotect-F' found in file HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\2500
2015-04-18 12:03:03.796 >>> Virus 'Troj/Bprotect-F' found in file HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\2500
2015-04-18 12:03:03.796 >>> Virus 'Troj/Bprotect-F' found in file HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\1208
2015-04-18 12:03:03.796 >>> Virus 'Troj/Bprotect-F' found in file HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\1208
2015-04-18 12:59:34.359 The following items will be cleaned up:
2015-04-18 12:59:34.375 Troj/Bprotect-F
 
I forgot to do the fix error thing on the sophos, so I gotta rerun it. It took a few hours to finish yesterday. just wanted to let you know.
 
Some of your startups must be corrupted.
Is there any more info in that popup, like any header?

Go Start>Run (Start Search in Vista/7), type in:
msconfig
Click OK (hit Enter in Vista/7).
Windows 8/8.1 users. Press Windows logo key
aa922834-ed43-40f1-8830-d5507badb56c_91.jpg
and start typing the following:
msconfig
Press Enter.

Click on Startup tab.
Click Disable all
IMPORTANT! In case of laptop, make sure, you do NOT disable any keyboard, or touchpad entries.

Click Services tab.
Put checkmark in Hide all Microsoft services
Click Disable all.

Click OK.
Restart computer in Normal Mode.

NOTE. If you use different firewall, than Windows firewall, turn Windows firewall on, just for this test, since your regular firewall won't be running.
If you use Windows firewall, you're fine.

Same problem?
 
I will restart it again to see if there is any more info on the message.I will let you know as soon as athe sophos program is done, it stalls if I try to do anything while it's running.
 
K the new scan is finished, here is the log after the cleanup. when I tried to submit it it says 'submission failed, check your internet connection' and before I tred to submit it it said
1of 1 threats cleaned and now it says 0 of 1.

I will restart my computer now to get the other information from what we talked of earlier.

2015-04-18 05:50:28.078 Sophos Virus Removal Tool version 2.5.4
2015-04-18 05:50:28.078 Copyright (c) 2009-2014 Sophos Limited. All rights reserved.

2015-04-18 05:50:28.078 This tool will scan your computer for viruses and other threats. If it finds any, it will give you the option to remove them.

2015-04-18 05:50:28.078 Windows version 5.1 SP 3.0 Service Pack 3 build 2600 SM=0x300 PT=0x1 Win32
2015-04-18 05:50:28.078 Checking for updates...
2015-04-18 05:50:30.687 Update progress: proxy server not available
2015-04-18 05:51:12.156 Option all = no
2015-04-18 05:51:12.156 Option recurse = yes
2015-04-18 05:51:12.156 Option archive = no
2015-04-18 05:51:12.156 Option service = yes
2015-04-18 05:51:12.156 Option confirm = yes
2015-04-18 05:51:12.156 Option sxl = yes
2015-04-18 05:51:12.156 Option max-data-age = 35
2015-04-18 05:51:12.156 Option EnableSafeClean = yes
2015-04-18 05:51:14.484 Option vdl-logging = yes
2015-04-18 05:51:14.531 Customer ID: 094260ca9b3af99f9d4a3909fc47a743
2015-04-18 05:51:14.531 Machine ID: f386f28a1138479196d958fac984f5a7
2015-04-18 05:51:14.718 Component SVRTcli.exe version 2.5.4
2015-04-18 05:51:14.718 Component control.dll version 2.5.4
2015-04-18 05:51:14.718 Component SVRTservice.exe version 2.5.4
2015-04-18 05:51:14.718 Component engine\osdp.dll version 1.44.1.2200
2015-04-18 05:51:14.718 Component engine\veex.dll version 3.60.0.2200
2015-04-18 05:51:14.718 Component engine\savi.dll version 8.1.7.2200
2015-04-18 05:51:14.734 Component rkdisk.dll version 1.5.30.0
2015-04-18 05:51:14.734 Version info: Product version 2.5.4
2015-04-18 05:51:14.750 Version info: Detection engine 3.60.0
2015-04-18 05:51:14.750 Version info: Detection data 5.13
2015-04-18 05:51:14.750 Version info: Build date 3/31/2015
2015-04-18 05:51:14.750 Version info: Data files added 264
2015-04-18 05:51:14.750 Version info: Last successful update (not yet updated)
2015-04-18 05:51:47.343 Downloading updates...
2015-04-18 05:51:47.343 Update progress: [I96736] Looking for package C1A903B2-E63E-483b-982D-04BB9C457C60 1.0
2015-04-18 05:51:47.343 Update progress: [I49502] Found supplement SAVIW32 LATEST
2015-04-18 05:51:47.343 Update progress: [I49502] Found supplement IDE514 LATEST
2015-04-18 05:51:47.343 Update progress: [I49502] Found supplement IDE515 LATEST
2015-04-18 05:51:47.343 Update progress: [I49502] Found supplement IDE516 LATEST
2015-04-18 05:51:47.343 Update progress: [I19463] Syncing product C1A903B2-E63E-483b-982D-04BB9C457C60 1
2015-04-18 05:51:47.343 Update progress: [I19463] Syncing product SAVIW32 53
2015-04-18 05:52:39.328 Update progress: [I19463] Syncing product IDE514 161
2015-04-18 05:52:45.750 Installing updates...
2015-04-18 05:52:50.359 Error level 1
2015-04-18 05:52:51.140 Update progress: [I19463] Syncing product IDE515 106
2015-04-18 05:52:51.140 Update progress: [I19463] Syncing product IDE516 1
2015-04-18 05:53:56.593 Update successful
2015-04-18 05:54:44.015 Option all = no
2015-04-18 05:54:44.015 Option recurse = yes
2015-04-18 05:54:44.015 Option archive = no
2015-04-18 05:54:44.015 Option service = yes
2015-04-18 05:54:44.015 Option confirm = yes
2015-04-18 05:54:44.015 Option sxl = yes
2015-04-18 05:54:44.031 Option max-data-age = 35
2015-04-18 05:54:44.031 Option EnableSafeClean = yes
2015-04-18 05:54:44.171 Option vdl-logging = yes
2015-04-18 05:54:44.265 Customer ID: 094260ca9b3af99f9d4a3909fc47a743
2015-04-18 05:54:44.265 Machine ID: f386f28a1138479196d958fac984f5a7
2015-04-18 05:54:44.375 Component SVRTcli.exe version 2.5.4
2015-04-18 05:54:44.375 Component control.dll version 2.5.4
2015-04-18 05:54:44.375 Component SVRTservice.exe version 2.5.4
2015-04-18 05:54:44.375 Component engine\osdp.dll version 1.44.1.2200
2015-04-18 05:54:44.375 Component engine\veex.dll version 3.60.0.2200
2015-04-18 05:54:44.375 Component engine\savi.dll version 8.1.7.2200
2015-04-18 05:54:44.453 Component rkdisk.dll version 1.5.30.0
2015-04-18 05:54:44.453 Version info: Product version 2.5.4
2015-04-18 05:54:44.453 Version info: Detection engine 3.60.0
2015-04-18 05:54:44.453 Version info: Detection data 5.13G
2015-04-18 05:54:44.453 Version info: Build date 3/31/2015
2015-04-18 05:54:44.453 Version info: Data files added 264
2015-04-18 05:54:44.453 Version info: Last successful update 4/17/2015 11:53:56 PM


2015-04-18 06:47:58.281 Scan cancelled by user.
2015-04-18 06:47:58.281

------------------------------------------------------------

2015-04-18 06:55:30.546 Sophos Virus Removal Tool version 2.5.4
2015-04-18 06:55:30.546 Copyright (c) 2009-2014 Sophos Limited. All rights reserved.

2015-04-18 06:55:30.546 This tool will scan your computer for viruses and other threats. If it finds any, it will give you the option to remove them.

2015-04-18 06:55:30.546 Windows version 5.1 SP 3.0 Service Pack 3 build 2600 SM=0x300 PT=0x1 Win32
2015-04-18 06:55:30.562 Checking for updates...
2015-04-18 06:55:34.265 Update progress: proxy server not available
2015-04-18 07:01:38.890 Update not required
2015-04-18 07:01:40.046 Option all = no
2015-04-18 07:01:40.046 Option recurse = yes
2015-04-18 07:01:40.046 Option archive = no
2015-04-18 07:01:40.046 Option service = yes
2015-04-18 07:01:40.046 Option confirm = yes
2015-04-18 07:01:40.046 Option sxl = yes
2015-04-18 07:01:40.046 Option max-data-age = 35
2015-04-18 07:01:40.046 Option EnableSafeClean = yes
2015-04-18 07:01:40.281 Option vdl-logging = yes
2015-04-18 07:01:40.562 Customer ID: 094260ca9b3af99f9d4a3909fc47a743
2015-04-18 07:01:40.562 Machine ID: f386f28a1138479196d958fac984f5a7
2015-04-18 07:01:41.578 Component SVRTcli.exe version 2.5.4
2015-04-18 07:01:41.578 Component control.dll version 2.5.4
2015-04-18 07:01:41.578 Component SVRTservice.exe version 2.5.4
2015-04-18 07:01:41.578 Component engine\osdp.dll version 1.44.1.2200
2015-04-18 07:01:41.578 Component engine\veex.dll version 3.60.0.2200
2015-04-18 07:01:41.609 Component engine\savi.dll version 8.1.7.2200
2015-04-18 07:01:42.000 Component rkdisk.dll version 1.5.30.0
2015-04-18 07:01:42.000 Version info: Product version 2.5.4
2015-04-18 07:01:42.000 Version info: Detection engine 3.60.0
2015-04-18 07:01:42.000 Version info: Detection data 5.13G
2015-04-18 07:01:42.031 Version info: Build date 3/31/2015
2015-04-18 07:01:42.031 Version info: Data files added 264
2015-04-18 07:01:42.031 Version info: Last successful update 4/17/2015 11:53:56 PM

2015-04-18 08:40:22.156 Could not check C:\Documents and Settings\K\Local Settings\Application Data\Google\Chrome\User Data\Default\Extension Rules\LOCK (virus scan failed)
2015-04-18 08:40:22.296 Could not check C:\Documents and Settings\K\Local Settings\Application Data\Google\Chrome\User Data\Default\Extension State\LOCK (virus scan failed)
2015-04-18 08:40:49.453 Could not check C:\Documents and Settings\K\Local Settings\Application Data\Google\Chrome\User Data\Default\File System\Origins\LOCK (virus scan failed)
2015-04-18 08:40:49.625 Could not check C:\Documents and Settings\K\Local Settings\Application Data\Google\Chrome\User Data\Default\GCM Store\LOCK (virus scan failed)
2015-04-18 08:40:51.796 Could not check C:\Documents and Settings\K\Local Settings\Application Data\Google\Chrome\User Data\Default\IndexedDB\chrome-extension_oehpjpccmlcalbenfhnacjeocbjdonic_0.indexeddb.leveldb\LOCK (virus scan failed)
2015-04-18 08:40:53.078 Could not check C:\Documents and Settings\K\Local Settings\Application Data\Google\Chrome\User Data\Default\Local Extension Settings\pafkbggdmjlpgkdkcbjmhmfcdpncadgh\LOCK (virus scan failed)
2015-04-18 08:41:01.796 Could not check C:\Documents and Settings\K\Local Settings\Application Data\Google\Chrome\User Data\Default\Session Storage\LOCK (virus scan failed)
2015-04-18 08:51:37.218 Could not open C:\hiberfil.sys
2015-04-18 09:53:21.406 Warning: failed to stop service (1053: The service did not respond to the start or control request in a timely fashion.)
2015-04-18 09:53:21.546 SafeClean bin directory is empty.

2015-04-18 09:53:38.234 Scan cancelled by user.
2015-04-18 09:53:38.234

------------------------------------------------------------

2015-04-18 09:55:20.781 Sophos Virus Removal Tool version 2.5.4
2015-04-18 09:55:20.781 Copyright (c) 2009-2014 Sophos Limited. All rights reserved.

2015-04-18 09:55:20.781 This tool will scan your computer for viruses and other threats. If it finds any, it will give you the option to remove them.

2015-04-18 09:55:20.781 Windows version 5.1 SP 3.0 Service Pack 3 build 2600 SM=0x300 PT=0x1 Win32
2015-04-18 09:55:20.781 Checking for updates...
2015-04-18 09:55:29.312 Update progress: proxy server not available
2015-04-18 09:58:44.718 Downloading updates...
2015-04-18 09:58:45.031 Update progress: [I96736] Looking for package C1A903B2-E63E-483b-982D-04BB9C457C60 1.0
2015-04-18 09:58:45.031 Update progress: [I49502] Found supplement SAVIW32 LATEST
2015-04-18 09:58:45.031 Update progress: [I49502] Found supplement IDE514 LATEST
2015-04-18 09:58:45.031 Update progress: [I49502] Found supplement IDE515 LATEST
2015-04-18 09:58:45.031 Update progress: [I49502] Found supplement IDE516 LATEST
2015-04-18 09:58:45.031 Update progress: [I19463] Syncing product C1A903B2-E63E-483b-982D-04BB9C457C60 1
2015-04-18 09:58:45.031 Update progress: [I19463] Syncing product SAVIW32 53
2015-04-18 09:58:45.031 Update progress: [I19463] Syncing product IDE514 161
2015-04-18 09:59:11.375 Update progress: [I19463] Syncing product IDE515 107
2015-04-18 09:59:13.953 Installing updates...
2015-04-18 09:59:45.187 Update progress: [I19463] Syncing product IDE516 1
2015-04-18 09:59:45.593 Update successful
2015-04-18 09:59:49.625 Error: an instance of this application is already running.
2015-04-18 10:00:33.359 Option all = no
2015-04-18 10:00:40.718 Option recurse = yes
2015-04-18 10:00:40.718 Option archive = no
2015-04-18 10:00:40.718 Option service = yes
2015-04-18 10:00:40.718 Option confirm = yes
2015-04-18 10:00:40.718 Option sxl = yes
2015-04-18 10:00:40.718 Option max-data-age = 35
2015-04-18 10:00:40.718 Option EnableSafeClean = yes
2015-04-18 10:00:40.718 Option vdl-logging = yes
2015-04-18 10:00:40.718 Customer ID: 094260ca9b3af99f9d4a3909fc47a743
2015-04-18 10:00:40.718 Machine ID: f386f28a1138479196d958fac984f5a7
2015-04-18 10:00:40.718 Component SVRTcli.exe version 2.5.4
2015-04-18 10:00:40.718 Component control.dll version 2.5.4
2015-04-18 10:00:40.718 Component SVRTservice.exe version 2.5.4
2015-04-18 10:00:40.718 Component engine\osdp.dll version 1.44.1.2200
2015-04-18 10:00:40.718 Component engine\veex.dll version 3.60.0.2200
2015-04-18 10:00:40.718 Component engine\savi.dll version 8.1.7.2200
2015-04-18 10:00:40.718 Component rkdisk.dll version 1.5.30.0
2015-04-18 10:00:40.718 Version info: Product version 2.5.4
2015-04-18 10:00:40.718 Version info: Detection engine 3.60.0
2015-04-18 10:00:40.718 Version info: Detection data 5.13G
2015-04-18 10:00:40.718 Version info: Build date 3/31/2015
2015-04-18 10:00:40.718 Version info: Data files added 265
2015-04-18 10:00:40.718 Version info: Last successful update 4/18/2015 3:59:45 AM
2015-04-18 10:00:40.718 Error level 1

2015-04-18 10:01:23.593 Scan failed due to fatal error.
2015-04-18 10:01:23.593

------------------------------------------------------------

2015-04-18 10:15:27.109 Sophos Virus Removal Tool version 2.5.4
2015-04-18 10:15:27.109 Copyright (c) 2009-2014 Sophos Limited. All rights reserved.

2015-04-18 10:15:27.109 This tool will scan your computer for viruses and other threats. If it finds any, it will give you the option to remove them.

2015-04-18 10:15:27.109 Windows version 5.1 SP 3.0 Service Pack 3 build 2600 SM=0x300 PT=0x1 Win32
2015-04-18 10:15:27.109 Checking for updates...
2015-04-18 10:15:31.750 Update progress: proxy server not available
2015-04-18 10:18:57.250 Update not required
2015-04-18 10:19:06.203 Option all = no
2015-04-18 10:19:06.203 Option recurse = yes
2015-04-18 10:19:06.203 Option archive = no
2015-04-18 10:19:06.203 Option service = yes
2015-04-18 10:19:06.203 Option confirm = yes
2015-04-18 10:19:06.203 Option sxl = yes
2015-04-18 10:19:06.218 Option max-data-age = 35
2015-04-18 10:19:06.218 Option EnableSafeClean = yes
2015-04-18 10:19:06.796 Option vdl-logging = yes
2015-04-18 10:19:06.906 Customer ID: 094260ca9b3af99f9d4a3909fc47a743
2015-04-18 10:19:06.906 Machine ID: f386f28a1138479196d958fac984f5a7
2015-04-18 10:19:07.562 Component SVRTcli.exe version 2.5.4
2015-04-18 10:19:07.562 Component control.dll version 2.5.4
2015-04-18 10:19:07.562 Component SVRTservice.exe version 2.5.4
2015-04-18 10:19:07.562 Component engine\osdp.dll version 1.44.1.2200
2015-04-18 10:19:07.562 Component engine\veex.dll version 3.60.0.2200
2015-04-18 10:19:07.562 Component engine\savi.dll version 8.1.7.2200
2015-04-18 10:19:07.812 Component rkdisk.dll version 1.5.30.0
2015-04-18 10:19:07.812 Version info: Product version 2.5.4
2015-04-18 10:19:07.828 Version info: Detection engine 3.60.0
2015-04-18 10:19:07.828 Version info: Detection data 5.13G
2015-04-18 10:19:07.828 Version info: Build date 3/31/2015
2015-04-18 10:19:07.828 Version info: Data files added 265
2015-04-18 10:19:07.828 Version info: Last successful update 4/18/2015 3:59:45 AM

2015-04-18 11:20:38.046 Could not check C:\Documents and Settings\K\Local Settings\Application Data\Google\Chrome\User Data\Default\Extension Rules\LOCK (virus scan failed)
2015-04-18 11:20:38.093 Could not check C:\Documents and Settings\K\Local Settings\Application Data\Google\Chrome\User Data\Default\Extension State\LOCK (virus scan failed)
2015-04-18 11:20:51.750 Could not check C:\Documents and Settings\K\Local Settings\Application Data\Google\Chrome\User Data\Default\File System\Origins\LOCK (virus scan failed)
2015-04-18 11:20:51.796 Could not check C:\Documents and Settings\K\Local Settings\Application Data\Google\Chrome\User Data\Default\GCM Store\LOCK (virus scan failed)
2015-04-18 11:20:52.609 Could not check C:\Documents and Settings\K\Local Settings\Application Data\Google\Chrome\User Data\Default\IndexedDB\chrome-extension_oehpjpccmlcalbenfhnacjeocbjdonic_0.indexeddb.leveldb\LOCK (virus scan failed)
2015-04-18 11:20:53.359 Could not check C:\Documents and Settings\K\Local Settings\Application Data\Google\Chrome\User Data\Default\Local Extension Settings\pafkbggdmjlpgkdkcbjmhmfcdpncadgh\LOCK (virus scan failed)
2015-04-18 11:20:57.843 Could not check C:\Documents and Settings\K\Local Settings\Application Data\Google\Chrome\User Data\Default\Session Storage\LOCK (virus scan failed)
2015-04-18 11:27:20.140 Could not open C:\hiberfil.sys
2015-04-18 12:03:03.781 >>> Virus 'Troj/Bprotect-F' found in file C:\System Volume Information\_restore{3E602A38-F5E5-47DB-93C5-0571F454F258}\RP496\A0404172.dll
2015-04-18 12:03:03.781 >>> Virus 'Troj/Bprotect-F' found in file HKLM\SOFTWARE\Microsoft\Security Center\AntiVirusOverride
2015-04-18 12:03:03.796 >>> Virus 'Troj/Bprotect-F' found in file HKU\S-1-5-21-725345543-1958367476-682003330-1004\Software\Microsoft\Windows\CurrentVersion\Internet Settings\WarnOnPostRedirect
2015-04-18 12:03:03.796 >>> Virus 'Troj/Bprotect-F' found in file HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\WarnOnPostRedirect
2015-04-18 12:03:03.796 >>> Virus 'Troj/Bprotect-F' found in file HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\2500
2015-04-18 12:03:03.796 >>> Virus 'Troj/Bprotect-F' found in file HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\2500
2015-04-18 12:03:03.796 >>> Virus 'Troj/Bprotect-F' found in file HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\1208
2015-04-18 12:03:03.796 >>> Virus 'Troj/Bprotect-F' found in file HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\1208
2015-04-18 12:59:34.359 The following items will be cleaned up:
2015-04-18 12:59:34.375 Troj/Bprotect-F
2015-04-18 20:36:28.328 SafeClean bin directory is empty.
2015-04-18 20:36:28.328 Error level 0

2015-04-18 20:36:28.687 Scan completed.
2015-04-18 20:36:28.687

------------------------------------------------------------

2015-04-18 21:06:45.250 Sophos Virus Removal Tool version 2.5.4
2015-04-18 21:06:45.250 Copyright (c) 2009-2014 Sophos Limited. All rights reserved.

2015-04-18 21:06:45.250 This tool will scan your computer for viruses and other threats. If it finds any, it will give you the option to remove them.

2015-04-18 21:06:45.250 Windows version 5.1 SP 3.0 Service Pack 3 build 2600 SM=0x300 PT=0x1 Win32
2015-04-18 21:06:45.265 Checking for updates...
2015-04-18 21:06:46.921 Update progress: proxy server not available
2015-04-18 21:07:59.203 Downloading updates...
2015-04-18 21:07:59.203 Update progress: [I96736] Looking for package C1A903B2-E63E-483b-982D-04BB9C457C60 1.0
2015-04-18 21:07:59.203 Update progress: [I49502] Found supplement SAVIW32 LATEST
2015-04-18 21:07:59.203 Update progress: [I49502] Found supplement IDE514 LATEST
2015-04-18 21:07:59.203 Update progress: [I49502] Found supplement IDE515 LATEST
2015-04-18 21:07:59.203 Update progress: [I49502] Found supplement IDE516 LATEST
2015-04-18 21:07:59.203 Update progress: [I19463] Syncing product C1A903B2-E63E-483b-982D-04BB9C457C60 1
2015-04-18 21:07:59.203 Update progress: [I19463] Syncing product SAVIW32 53
2015-04-18 21:07:59.203 Update progress: [I19463] Syncing product IDE514 161
2015-04-18 21:08:05.062 Update progress: [I19463] Syncing product IDE515 108
2015-04-18 21:08:06.656 Installing updates...
2015-04-18 21:08:40.421 Update progress: [I19463] Syncing product IDE516 1
2015-04-18 21:08:40.828 Update successful
2015-04-18 21:08:44.859 Error: an instance of this application is already running.
2015-04-18 21:09:01.921 Option all = no
2015-04-18 21:09:03.765 Option recurse = yes
2015-04-18 21:09:03.765 Option archive = no
2015-04-18 21:09:03.765 Option service = yes
2015-04-18 21:09:03.765 Option confirm = yes
2015-04-18 21:09:03.765 Option sxl = yes
2015-04-18 21:09:03.765 Option max-data-age = 35
2015-04-18 21:09:03.765 Option EnableSafeClean = yes
2015-04-18 21:09:03.765 Option vdl-logging = yes
2015-04-18 21:09:03.765 Customer ID: 094260ca9b3af99f9d4a3909fc47a743
2015-04-18 21:09:03.765 Machine ID: f386f28a1138479196d958fac984f5a7
2015-04-18 21:09:03.765 Component SVRTcli.exe version 2.5.4
2015-04-18 21:09:03.765 Component control.dll version 2.5.4
2015-04-18 21:09:03.765 Component SVRTservice.exe version 2.5.4
2015-04-18 21:09:03.765 Component engine\osdp.dll version 1.44.1.2200
2015-04-18 21:09:03.765 Component engine\veex.dll version 3.60.0.2200
2015-04-18 21:09:03.765 Component engine\savi.dll version 8.1.7.2200
2015-04-18 21:09:03.765 Component rkdisk.dll version 1.5.30.0
2015-04-18 21:09:03.765 Version info: Product version 2.5.4
2015-04-18 21:09:03.765 Version info: Detection engine 3.60.0
2015-04-18 21:09:03.765 Version info: Detection data 5.13G
2015-04-18 21:09:03.765 Version info: Build date 3/31/2015
2015-04-18 21:09:03.765 Version info: Data files added 266
2015-04-18 21:09:03.765 Version info: Last successful update 4/18/2015 3:08:40 PM
2015-04-18 21:09:03.765 Error level 1

2015-04-18 21:27:26.359 Scan failed due to fatal error.
2015-04-18 21:27:26.359

------------------------------------------------------------

2015-04-18 21:49:02.390 Sophos Virus Removal Tool version 2.5.4
2015-04-18 21:49:02.390 Copyright (c) 2009-2014 Sophos Limited. All rights reserved.

2015-04-18 21:49:02.390 This tool will scan your computer for viruses and other threats. If it finds any, it will give you the option to remove them.

2015-04-18 21:49:02.390 Windows version 5.1 SP 3.0 Service Pack 3 build 2600 SM=0x300 PT=0x1 Win32
2015-04-18 21:49:02.390 Checking for updates...
2015-04-18 21:49:03.562 Update progress: proxy server not available
2015-04-18 21:50:17.578 Update not required
2015-04-18 21:51:07.125 Option all = no
2015-04-18 21:51:07.125 Option recurse = yes
2015-04-18 21:51:07.125 Option archive = no
2015-04-18 21:51:07.125 Option service = yes
2015-04-18 21:51:07.125 Option confirm = yes
2015-04-18 21:51:07.125 Option sxl = yes
2015-04-18 21:51:07.140 Option max-data-age = 35
2015-04-18 21:51:07.140 Option EnableSafeClean = yes
2015-04-18 21:51:07.296 Option vdl-logging = yes
2015-04-18 21:51:07.359 Customer ID: 094260ca9b3af99f9d4a3909fc47a743
2015-04-18 21:51:07.359 Machine ID: f386f28a1138479196d958fac984f5a7
2015-04-18 21:51:07.593 Component SVRTcli.exe version 2.5.4
2015-04-18 21:51:07.593 Component control.dll version 2.5.4
2015-04-18 21:51:07.593 Component SVRTservice.exe version 2.5.4
2015-04-18 21:51:07.593 Component engine\osdp.dll version 1.44.1.2200
2015-04-18 21:51:07.593 Component engine\veex.dll version 3.60.0.2200
2015-04-18 21:51:07.593 Component engine\savi.dll version 8.1.7.2200
2015-04-18 21:51:07.828 Component rkdisk.dll version 1.5.30.0
2015-04-18 21:51:07.828 Version info: Product version 2.5.4
2015-04-18 21:51:07.843 Version info: Detection engine 3.60.0
2015-04-18 21:51:07.843 Version info: Detection data 5.13G
2015-04-18 21:51:07.843 Version info: Build date 3/31/2015
2015-04-18 21:51:07.843 Version info: Data files added 266
2015-04-18 21:51:07.843 Version info: Last successful update 4/18/2015 3:08:40 PM

2015-04-18 22:49:58.625 Could not check C:\Documents and Settings\K\Local Settings\Application Data\Google\Chrome\User Data\Default\Extension Rules\LOCK (virus scan failed)
2015-04-18 22:49:58.703 Could not check C:\Documents and Settings\K\Local Settings\Application Data\Google\Chrome\User Data\Default\Extension State\LOCK (virus scan failed)
2015-04-18 22:50:16.125 Could not check C:\Documents and Settings\K\Local Settings\Application Data\Google\Chrome\User Data\Default\File System\Origins\LOCK (virus scan failed)
2015-04-18 22:50:16.203 Could not check C:\Documents and Settings\K\Local Settings\Application Data\Google\Chrome\User Data\Default\GCM Store\LOCK (virus scan failed)
2015-04-18 22:50:17.640 Could not check C:\Documents and Settings\K\Local Settings\Application Data\Google\Chrome\User Data\Default\IndexedDB\chrome-extension_oehpjpccmlcalbenfhnacjeocbjdonic_0.indexeddb.leveldb\LOCK (virus scan failed)
2015-04-18 22:50:18.203 Could not check C:\Documents and Settings\K\Local Settings\Application Data\Google\Chrome\User Data\Default\Local Extension Settings\pafkbggdmjlpgkdkcbjmhmfcdpncadgh\LOCK (virus scan failed)
2015-04-18 22:50:23.265 Could not check C:\Documents and Settings\K\Local Settings\Application Data\Google\Chrome\User Data\Default\Session Storage\LOCK (virus scan failed)
2015-04-18 22:57:19.203 Could not open C:\hiberfil.sys
2015-04-18 23:45:00.875 >>> Virus 'Troj/Bprotect-F' found in file C:\System Volume Information\_restore{3E602A38-F5E5-47DB-93C5-0571F454F258}\RP496\A0404172.dll
2015-04-18 23:45:00.875 >>> Virus 'Troj/Bprotect-F' found in file HKLM\SOFTWARE\Microsoft\Security Center\AntiVirusOverride
2015-04-18 23:45:00.875 >>> Virus 'Troj/Bprotect-F' found in file HKU\S-1-5-21-725345543-1958367476-682003330-1004\Software\Microsoft\Windows\CurrentVersion\Internet Settings\WarnOnPostRedirect
2015-04-18 23:45:00.875 >>> Virus 'Troj/Bprotect-F' found in file HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\WarnOnPostRedirect
2015-04-18 23:45:00.875 >>> Virus 'Troj/Bprotect-F' found in file HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\2500
2015-04-18 23:45:00.875 >>> Virus 'Troj/Bprotect-F' found in file HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\2500
2015-04-18 23:45:00.875 >>> Virus 'Troj/Bprotect-F' found in file HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\1208
2015-04-18 23:45:00.875 >>> Virus 'Troj/Bprotect-F' found in file HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\1208
2015-04-19 00:44:46.421 The following items will be cleaned up:
2015-04-19 00:44:46.421 Troj/Bprotect-F
2015-04-19 00:51:03.937 Threat 'Troj/Bprotect-F' has been cleaned up.
2015-04-19 00:51:03.984 File "C:\System Volume Information\_restore{3E602A38-F5E5-47DB-93C5-0571F454F258}\RP496\A0404172.dll" belongs to 'Troj/Bprotect-F'.
2015-04-19 00:51:03.984 File "C:\System Volume Information\_restore{3E602A38-F5E5-47DB-93C5-0571F454F258}\RP496\A0404172.dll" has been cleaned up.
2015-04-19 00:51:04.015 Registry value "HKLM\SOFTWARE\Microsoft\Security Center\AntiVirusOverride" belongs to 'Troj/Bprotect-F'.
2015-04-19 00:51:04.015 Registry value "HKLM\SOFTWARE\Microsoft\Security Center\AntiVirusOverride" has been cleaned up.
2015-04-19 00:51:04.015 Registry value "HKU\S-1-5-21-725345543-1958367476-682003330-1004\Software\Microsoft\Windows\CurrentVersion\Internet Settings\WarnOnPostRedirect" belongs to 'Troj/Bprotect-F'.
2015-04-19 00:51:04.015 Registry value "HKU\S-1-5-21-725345543-1958367476-682003330-1004\Software\Microsoft\Windows\CurrentVersion\Internet Settings\WarnOnPostRedirect" has been cleaned up.
2015-04-19 00:51:04.015 Registry value "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\WarnOnPostRedirect" belongs to 'Troj/Bprotect-F'.
2015-04-19 00:51:04.046 Registry value "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\WarnOnPostRedirect" has been cleaned up.
2015-04-19 00:51:04.046 Registry value "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\2500" belongs to 'Troj/Bprotect-F'.
2015-04-19 00:51:04.046 Registry value "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\2500" has been cleaned up.
2015-04-19 00:51:04.046 Registry value "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\2500" belongs to 'Troj/Bprotect-F'.
2015-04-19 00:51:04.046 Registry value "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\2500" has been cleaned up.
2015-04-19 00:51:04.046 Registry value "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\1208" belongs to 'Troj/Bprotect-F'.
2015-04-19 00:51:04.046 Registry value "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\1208" has been cleaned up.
2015-04-19 00:51:04.046 Registry value "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\1208" belongs to 'Troj/Bprotect-F'.
2015-04-19 00:51:04.046 Registry value "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\1208" has been cleaned up.
2015-04-19 00:51:04.046 Removal successful
2015-04-19 00:51:05.140 Contents of SafeClean bin directory:
2015-04-19 00:51:05.218 {
2015-04-19 00:51:05.218 RecordID : "0000000000000001",
2015-04-19 00:51:05.218 ItemType : "1",
2015-04-19 00:51:05.218 Location : "C:\System Volume Information\_restore{3E602A38-F5E5-47DB-93C5-0571F454F258}\RP496\",
2015-04-19 00:51:05.218 FileName : "A0404172.dll",
2015-04-19 00:51:05.218 ThreatName : "Troj/Bprotect-F",
2015-04-19 00:51:05.218 Checksum : "cb802bdae9c1661b8c0691aa2d85c3430b54355a9fa589fc12710cc98facaf00",
2015-04-19 00:51:05.218 TimeStamp : "Sat Apr 18 18:50:52 2015"
2015-04-19 00:51:05.218 }
2015-04-19 00:51:19.671 Error level 0
 
You must log in or register to reply here.

Similar threads

D
Windows xp home cannot connect to internet
Replies
4
Views
2K
bazz2004
B
M
Web Meeting disconnects even though internet is connected
Replies
1
Views
612
madhav04
M
Mickey1
PC Freezes & won't open anything
Replies
3
Views
524
info12345
info12345

Latest posts

Back