Need help with adware

Resolved
By Osbert
Jun 2, 2012
Topic Status:
Not open for further replies.
  1. I already have norton updated and working on my PC

    log from MBAB
    Malwarebytes Anti-Malware 1.61.0.1400
    www.malwarebytes.org

    Database version: v2012.06.01.07

    Windows 7 Service Pack 1 x64 NTFS
    Internet Explorer 8.0.7601.17514
    Jeff :: JEFF-PC [administrator]

    01/06/2012 6:46:02 PM
    mbam-log-2012-06-01 (18-46-02).txt

    Scan type: Quick scan
    Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
    Scan options disabled: P2P
    Objects scanned: 213598
    Time elapsed: 3 minute(s), 19 second(s)

    Memory Processes Detected: 0
    (No malicious items detected)

    Memory Modules Detected: 0
    (No malicious items detected)

    Registry Keys Detected: 0
    (No malicious items detected)

    Registry Values Detected: 0
    (No malicious items detected)

    Registry Data Items Detected: 0
    (No malicious items detected)

    Folders Detected: 0
    (No malicious items detected)

    Files Detected: 17
    C:\Users\Jeff\AppData\Local\Temp\~os149A.tmp\rlvknlg.exe (PUP.Adware.RelevantKnowledge) -> Quarantined and deleted successfully.
    C:\Users\Jeff\AppData\Local\Temp\~os149A.tmp\rlvknlg64.exe (PUP.Adware.RelevantKnowledge) -> Quarantined and deleted successfully.
    C:\Users\Jeff\AppData\Local\Temp\~os149A.tmp\rlxf.dll (PUP.Adware.RelevantKnowledge) -> Quarantined and deleted successfully.
    C:\Users\Jeff\AppData\Local\Temp\~os149A.tmp\rlxg.dll (PUP.Adware.RelevantKnowledge) -> Quarantined and deleted successfully.
    C:\Users\Jeff\AppData\Local\Temp\~osAEE4.tmp\rlvknlg.exe (PUP.Adware.RelevantKnowledge) -> Quarantined and deleted successfully.
    C:\Users\Jeff\AppData\Local\Temp\~osAEE4.tmp\rlvknlg64.exe (PUP.Adware.RelevantKnowledge) -> Quarantined and deleted successfully.
    C:\Users\Jeff\AppData\Local\Temp\~osAEE4.tmp\rlxf.dll (PUP.Adware.RelevantKnowledge) -> Quarantined and deleted successfully.
    C:\Users\Jeff\AppData\Local\Temp\~osAEE4.tmp\rlxg.dll (PUP.Adware.RelevantKnowledge) -> Quarantined and deleted successfully.
    C:\Users\Jeff\AppData\Local\Temp\~osAEE4.tmp\rlxh.dll (PUP.Adware.RelevantKnowledge) -> Quarantined and deleted successfully.
    C:\Users\Jeff\AppData\Local\Temp\~osAEE4.tmp\rlxi.dll (PUP.Adware.RelevantKnowledge) -> Quarantined and deleted successfully.
    C:\Users\Jeff\AppData\Local\Temp\~osCBDE.tmp\rlvknlg.exe (PUP.Adware.RelevantKnowledge) -> Quarantined and deleted successfully.
    C:\Users\Jeff\AppData\Local\Temp\~osCBDE.tmp\rlvknlg64.exe (PUP.Adware.RelevantKnowledge) -> Quarantined and deleted successfully.
    C:\Users\Jeff\AppData\Local\Temp\~osCBDE.tmp\rlxf.dll (PUP.Adware.RelevantKnowledge) -> Quarantined and deleted successfully.
    C:\Users\Jeff\AppData\Local\Temp\~osCBDE.tmp\rlxg.dll (PUP.Adware.RelevantKnowledge) -> Quarantined and deleted successfully.
    C:\Users\Jeff\AppData\Local\Temp\~osCBDE.tmp\rlxh.dll (PUP.Adware.RelevantKnowledge) -> Quarantined and deleted successfully.
    C:\Users\Jeff\AppData\Local\Temp\~osCBDE.tmp\rlxi.dll (PUP.Adware.RelevantKnowledge) -> Quarantined and deleted successfully.
    C:\Users\Jeff\AppData\Local\Temp\~osCBDE.tmp\rlxj.dll (PUP.Adware.RelevantKnowledge) -> Quarantined and deleted successfully.

    (end)

    GMER didn't produce a log
    results of DDS -

    .
    DDS (Ver_2011-08-26.01) - NTFSAMD64
    Internet Explorer: 8.0.7601.17514 BrowserJavaVersion: 1.6.0_26
    Run by Jeff at 11:56:26 on 2012-06-02
    Microsoft Windows 7 Professional 6.1.7601.1.1252.2.1033.18.8191.6397 [GMT -4:00]
    .
    AV: Norton AntiVirus *Enabled/Updated* {63DF5164-9100-186D-2187-8DC619EFD8BF}
    SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
    SP: Norton AntiVirus *Enabled/Updated* {D8BEB080-B73A-17E3-1B37-B6B462689202}
    .
    ============== Running Processes ===============
    .
    C:\Windows\system32\wininit.exe
    C:\Windows\system32\lsm.exe
    C:\Windows\system32\svchost.exe -k DcomLaunch
    C:\Windows\system32\svchost.exe -k RPCSS
    C:\Windows\system32\atiesrxx.exe
    C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
    C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
    C:\Windows\system32\svchost.exe -k LocalService
    C:\Windows\system32\atieclxx.exe
    C:\Windows\System32\spoolsv.exe
    C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
    C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe
    C:\Program Files (x86)\Norton AntiVirus\Engine\19.7.1.5\ccSvcHst.exe
    c:\Program Files (x86)\Common Files\Protexis\License Service\PsiService_2.exe
    C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted
    C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
    C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
    C:\Windows\system32\taskhost.exe
    C:\Program Files (x86)\Norton AntiVirus\Engine\19.7.1.5\ccSvcHst.exe
    C:\Windows\system32\Dwm.exe
    C:\Windows\Explorer.EXE
    C:\Windows\system32\svchost.exe -k netsvcs
    C:\Windows\System32\svchost.exe -k NetworkService
    C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
    C:\Windows\System32\StikyNot.exe
    C:\Program Files (x86)\Common Files\Corel\Corel PhotoDownloader\Corel Photo Downloader.exe
    C:\Program Files (x86)\OpenOffice.org 3\program\soffice.exe
    C:\Windows\system32\svchost.exe -k imgsvc
    C:\Program Files (x86)\NEC Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe
    C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin
    C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
    C:\Windows\system32\SearchIndexer.exe
    C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
    C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
    C:\Program Files (x86)\Mozilla Firefox\firefox.exe
    C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe
    C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbam.exe
    C:\Windows\SysWOW64\NOTEPAD.EXE
    C:\Windows\SysWOW64\NOTEPAD.EXE
    C:\Windows\system32\SearchProtocolHost.exe
    C:\Windows\system32\SearchFilterHost.exe
    C:\Windows\system32\DllHost.exe
    C:\Windows\system32\DllHost.exe
    C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\conhost.exe
    C:\Windows\SysWOW64\cscript.exe
    C:\Windows\system32\wbem\wmiprvse.exe
    .
    ============== Pseudo HJT Report ===============
    .
    uStart Page = hxxp://start.facemoods.com/?a=w7th1
    mSearchAssistant = hxxp://start.facemoods.com/?a=w7th1&s={searchTerms}&f=4
    uURLSearchHooks: H - No File
    mWinlogon: Userinit=userinit.exe,
    BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
    BHO: SteadyVideoBHO Class: {6c680bae-655c-4e3d-8fc4-e6a520c3d928} - C:\Program Files (x86)\amd\SteadyVideo\SteadyVideo.dll
    BHO: Norton Vulnerability Protection: {6d53ec84-6aae-4787-aeee-f4628f01010c} - C:\Program Files (x86)\Norton AntiVirus\Engine\19.7.1.5\IPS\IPSBHO.DLL
    BHO: Windows Live ID Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    BHO: Office Document Cache Handler: {b4f3a835-0e21-4959-ba22-42b3008e02ff} - C:\PROGRA~2\MICROS~1\Office14\URLREDIR.DLL
    BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll
    TB: {50FAFAF0-70A9-419D-A109-FA4B4FFD4E37} - No File
    uRun: [RESTART_STICKY_NOTES] C:\Windows\System32\StikyNot.exe
    uRun: [EA Core] "C:\Program Files (x86)\Electronic Arts\EADM\Core.exe" -silent
    uRun: [Corel Photo Downloader] "c:\Program Files (x86)\Common Files\Corel\Corel PhotoDownloader\Corel Photo Downloader.exe" -startup
    mRun: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
    mRun: [StartCCC] "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
    mRun: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime
    mRun: [NUSB3MON] "C:\Program Files (x86)\NEC Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe"
    mRun: [Corel File Shell Monitor] c:\Program Files (x86)\Corel\Corel PaintShop Photo Pro\X3\PSPClassic\CorelIOMonitor.exe
    mRun: [ATICustomerCare] "C:\Program Files (x86)\ATI\ATICustomerCare\ATICustomerCare.exe"
    mRun: [Adobe Reader Speed Launcher] "C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Reader_sl.exe"
    mRun: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
    StartupFolder: C:\Users\Jeff\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\OPENOF~1.LNK - C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe
    StartupFolder: C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\Startup\AMLDEV~1.LNK - C:\Program Files (x86)\AMD AVT\bin\kdbsync.exe
    mPolicies-explorer: NoActiveDesktop = 1 (0x1)
    mPolicies-explorer: NoActiveDesktopChanges = 1 (0x1)
    mPolicies-system: ConsentPromptBehaviorAdmin = 5 (0x5)
    mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3)
    mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
    DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab
    DPF: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab
    DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab
    TCP: DhcpNameServer = 192.168.2.1
    TCP: Interfaces\{10809AC6-7DD8-4AFC-BBB6-898221AB9DCE} : DhcpNameServer = 192.168.2.1
    Filter: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\MSOXMLMF.DLL
    Filter: video/mp4 - {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files (x86)\AMD\SteadyVideo\VideoMIMEFilter.dll
    Filter: video/x-flv - {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files (x86)\AMD\SteadyVideo\VideoMIMEFilter.dll
    BHO-X64: Adobe PDF Link Helper: {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
    BHO-X64: AcroIEHelperStub - No File
    BHO-X64: SteadyVideoBHO Class: {6C680BAE-655C-4E3D-8FC4-E6A520C3D928} - C:\Program Files (x86)\amd\SteadyVideo\SteadyVideo.dll
    BHO-X64: AMD SteadyVideo BHO - No File
    BHO-X64: Norton Vulnerability Protection: {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files (x86)\Norton AntiVirus\Engine\19.7.1.5\IPS\IPSBHO.DLL
    BHO-X64: Norton Vulnerability Protection - No File
    BHO-X64: Windows Live ID Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    BHO-X64: Office Document Cache Handler: {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~2\MICROS~1\Office14\URLREDIR.DLL
    BHO-X64: URLRedirectionBHO - No File
    BHO-X64: Java(tm) Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll
    TB-X64: {50FAFAF0-70A9-419D-A109-FA4B4FFD4E37} - No File
    mRun-x64: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
    mRun-x64: [StartCCC] "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
    mRun-x64: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime
    mRun-x64: [NUSB3MON] "C:\Program Files (x86)\NEC Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe"
    mRun-x64: [Corel File Shell Monitor] c:\Program Files (x86)\Corel\Corel PaintShop Photo Pro\X3\PSPClassic\CorelIOMonitor.exe
    mRun-x64: [ATICustomerCare] "C:\Program Files (x86)\ATI\ATICustomerCare\ATICustomerCare.exe"
    mRun-x64: [Adobe Reader Speed Launcher] "C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Reader_sl.exe"
    mRun-x64: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
    .
    ================= FIREFOX ===================
    .
    FF - ProfilePath - C:\Users\Jeff\AppData\Roaming\Mozilla\Firefox\Profiles\f7m7sz3w.default\
    FF - prefs.js: browser.search.defaulturl - hxxp://www.bing.com/search?FORM=WLETDF&PC=WLEM&q=
    FF - prefs.js: browser.search.selectedEngine - Google
    FF - prefs.js: browser.startup.homepage - about:home
    FF - prefs.js: keyword.URL - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT3106777&SearchSource=2&q=
    FF - plugin: C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL
    FF - plugin: C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL
    FF - plugin: C:\Program Files (x86)\Downloader\npdd.dll
    FF - plugin: C:\Program Files (x86)\Google\Update\1.3.21.111\npGoogleUpdate3.dll
    FF - plugin: C:\Program Files (x86)\Java\jre6\bin\new_plugin\npdeployJava1.dll
    FF - plugin: C:\Program Files (x86)\Mozilla Firefox\plugins\npdeployJava1.dll
    FF - plugin: C:\Users\Jeff\AppData\Roaming\Mozilla\Firefox\Profiles\f7m7sz3w.default\extensions\{50fafaf0-70a9-419d-a109-fa4b4ffd4e37}\plugins\np-mswmp.dll
    FF - plugin: C:\Windows\system32\Wat\npWatWeb.dll
    FF - plugin: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_2_202_235.dll
    .
    ============= SERVICES / DRIVERS ===============
    .
    R0 SymDS;Symantec Data Store;C:\Windows\system32\drivers\NAVx64\1307010.005\SYMDS64.SYS --> C:\Windows\system32\drivers\NAVx64\1307010.005\SYMDS64.SYS [?]
    R0 SymEFA;Symantec Extended File Attributes;C:\Windows\system32\drivers\NAVx64\1307010.005\SYMEFA64.SYS --> C:\Windows\system32\drivers\NAVx64\1307010.005\SYMEFA64.SYS [?]
    R1 BHDrvx64;BHDrvx64;C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NAV_19.6.2.10\Definitions\BASHDefs\20120517.001\BHDrvx64.sys [2012-5-24 1160824]
    R1 ccSet_NAV;Norton AntiVirus Settings Manager;C:\Windows\system32\drivers\NAVx64\1307010.005\ccSetx64.sys --> C:\Windows\system32\drivers\NAVx64\1307010.005\ccSetx64.sys [?]
    R1 IDSVia64;IDSVia64;C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NAV_19.6.2.10\Definitions\IPSDefs\20120601.001\IDSviA64.sys [2012-6-1 488568]
    R1 SymIRON;Symantec Iron Driver;C:\Windows\system32\drivers\NAVx64\1307010.005\Ironx64.SYS --> C:\Windows\system32\drivers\NAVx64\1307010.005\Ironx64.SYS [?]
    R1 SymNetS;Symantec Network Security WFP Driver;C:\Windows\system32\Drivers\NAVx64\1307010.005\SYMNETS.SYS --> C:\Windows\system32\Drivers\NAVx64\1307010.005\SYMNETS.SYS [?]
    R2 AMD External Events Utility;AMD External Events Utility;C:\Windows\system32\atiesrxx.exe --> C:\Windows\system32\atiesrxx.exe [?]
    R2 AMD FUEL Service;AMD FUEL Service;C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [2012-2-14 361984]
    R2 AODDriver4.01;AODDriver4.01;C:\Program Files\ATI Technologies\ATI.ACE\Fuel\amd64\aoddriver2.sys [2012-1-3 55936]
    R2 NAV;Norton AntiVirus;C:\Program Files (x86)\Norton AntiVirus\Engine\19.7.1.5\ccsvchst.exe [2012-5-18 138232]
    R3 amdiox64;AMD IO Driver;C:\Windows\system32\DRIVERS\amdiox64.sys --> C:\Windows\system32\DRIVERS\amdiox64.sys [?]
    R3 amdkmdag;amdkmdag;C:\Windows\system32\DRIVERS\atikmdag.sys --> C:\Windows\system32\DRIVERS\atikmdag.sys [?]
    R3 amdkmdap;amdkmdap;C:\Windows\system32\DRIVERS\atikmpag.sys --> C:\Windows\system32\DRIVERS\atikmpag.sys [?]
    R3 AtiHDAudioService;AMD Function Driver for HD Audio Service;C:\Windows\system32\drivers\AtihdW76.sys --> C:\Windows\system32\drivers\AtihdW76.sys [?]
    R3 EraserUtilRebootDrv;EraserUtilRebootDrv;C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [2012-5-31 138912]
    R3 nusb3hub;NEC Electronics USB 3.0 Hub Driver;C:\Windows\system32\DRIVERS\nusb3hub.sys --> C:\Windows\system32\DRIVERS\nusb3hub.sys [?]
    R3 nusb3xhc;NEC Electronics USB 3.0 Host Controller Driver;C:\Windows\system32\DRIVERS\nusb3xhc.sys --> C:\Windows\system32\DRIVERS\nusb3xhc.sys [?]
    R3 RTL8167;Realtek 8167 NT Driver;C:\Windows\system32\DRIVERS\Rt64win7.sys --> C:\Windows\system32\DRIVERS\Rt64win7.sys [?]
    S2 AODDriver4.1;AODDriver4.1;C:\Program Files\ATI Technologies\ATI.ACE\Fuel\amd64\aoddriver2.sys [2012-1-3 55936]
    S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]
    S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-3-18 138576]
    S2 gupdate;Google Update Service (gupdate);C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2010-10-18 135664]
    S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-4-25 257696]
    S3 gupdatem;Google Update Service (gupdatem);C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2010-10-18 135664]
    S3 MozillaMaintenance;Mozilla Maintenance Service;C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe [2012-4-25 129976]
    S3 ose64;Office 64 Source Engine;C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2010-1-9 174440]
    S3 osppsvc;Office Software Protection Platform;C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-1-9 4925184]
    S3 StorSvc;Storage Service;C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted [2009-7-13 20992]
    S3 TsUsbFlt;TsUsbFlt;C:\Windows\system32\drivers\tsusbflt.sys --> C:\Windows\system32\drivers\tsusbflt.sys [?]
    S3 WatAdminSvc;WatAdminSvc;C:\Windows\system32\Wat\WatAdminSvc.exe --> C:\Windows\system32\Wat\WatAdminSvc.exe [?]
    .
    =============== Created Last 30 ================
    .
    2012-06-02 12:49:30 -------- d-----w- C:\Users\Jeff\AppData\Local\{3CD9A34B-4A7B-47E5-9168-DD1676D9D435}
    2012-06-02 12:49:18 -------- d-----w- C:\Users\Jeff\AppData\Local\{F5A922FF-B834-4089-B7F0-302468EE4E92}
    2012-06-02 03:38:12 -------- d-----w- C:\Users\Jeff\AppData\Local\{3C484DEC-AB63-49C1-940E-69AAE850FB14}
    2012-06-01 22:44:03 -------- d-----w- C:\Users\Jeff\AppData\Roaming\Malwarebytes
    2012-06-01 22:43:56 -------- d-----w- C:\ProgramData\Malwarebytes
    2012-06-01 22:43:55 24904 ----a-w- C:\Windows\System32\drivers\mbam.sys
    2012-06-01 22:43:55 -------- d-----w- C:\Program Files (x86)\Malwarebytes' Anti-Malware
    2012-06-01 22:20:57 -------- d-----w- C:\Users\Jeff\AppData\Roaming\SpeedyPC Software
    2012-06-01 22:20:57 -------- d-----w- C:\Users\Jeff\AppData\Roaming\DriverCure
    2012-06-01 22:20:40 -------- d-----w- C:\ProgramData\SpeedyPC Software
    2012-06-01 22:20:40 -------- d-----w- C:\Program Files (x86)\SpeedyPC Software
    2012-06-01 22:20:40 -------- d-----w- C:\Program Files (x86)\Common Files\SpeedyPC Software
    2012-06-01 13:48:26 -------- d-----w- C:\Users\Jeff\AppData\Local\{E6499A0C-CE61-4172-B4A6-8391A503B96F}
    2012-06-01 13:48:14 -------- d-----w- C:\Users\Jeff\AppData\Local\{66EFBB36-95BE-4F74-A6D2-911E5112A63B}
    2012-06-01 01:47:49 -------- d-----w- C:\Users\Jeff\AppData\Local\{B81D245B-14AC-4F5F-ADD8-880ED227DB81}
    2012-06-01 01:47:38 -------- d-----w- C:\Users\Jeff\AppData\Local\{459737A4-00AB-48AD-8823-47AB6FC6A0FC}
    2012-05-31 12:27:49 -------- d-----w- C:\Users\Jeff\AppData\Local\{78E98722-CC03-4927-B44B-3BD1FA2771DE}
    2012-05-31 12:27:37 -------- d-----w- C:\Users\Jeff\AppData\Local\{77580430-ACC0-4036-9863-B74CFEE99D2C}
    2012-05-30 23:54:14 -------- d-----w- C:\Users\Jeff\AppData\Local\{18D5EE31-2E27-416B-970D-383A8B8C7526}
    2012-05-30 23:54:03 -------- d-----w- C:\Users\Jeff\AppData\Local\{0CE57CBB-92E4-41F8-987C-12B119A7D3A5}
    2012-05-30 22:39:21 -------- d-----w- C:\Windows\pss
    2012-05-30 22:28:54 -------- d-----w- C:\Users\Jeff\AppData\Local\NPE
    2012-05-30 11:47:45 -------- d-----w- C:\Users\Jeff\AppData\Local\{D9CE3664-930D-4154-A5C6-01EEE508B224}
    2012-05-30 11:47:34 -------- d-----w- C:\Users\Jeff\AppData\Local\{9B2E8B6A-0A40-43CD-A7AF-9BBE2BD63533}
    2012-05-29 23:47:09 -------- d-----w- C:\Users\Jeff\AppData\Local\{6DC0B8B5-2145-4AC8-8D10-528DE205EF15}
    2012-05-29 23:46:58 -------- d-----w- C:\Users\Jeff\AppData\Local\{FE10F476-CAE9-4555-BACB-C99D3F7CD3B2}
    2012-05-29 11:46:33 -------- d-----w- C:\Users\Jeff\AppData\Local\{0B57D882-293C-4C8E-A2BC-26422753AC09}
    2012-05-29 11:46:21 -------- d-----w- C:\Users\Jeff\AppData\Local\{33E1845E-F70F-4E5D-B100-EDE7910229D7}
    2012-05-28 23:40:58 -------- d-----w- C:\Users\Jeff\AppData\Local\{11EB0140-6A16-454E-A6E2-AA706AF7AB6E}
    2012-05-28 23:40:47 -------- d-----w- C:\Users\Jeff\AppData\Local\{927EE053-6D42-4252-89CC-2129D466360F}
    2012-05-28 17:24:22 -------- d-----w- C:\Program Files (x86)\Puppetshow - Return to Joyville
    2012-05-28 11:40:34 -------- d-----w- C:\Users\Jeff\AppData\Local\{0346E2E6-3A4C-45D7-9E29-6C09F8048206}
    2012-05-28 11:40:22 -------- d-----w- C:\Users\Jeff\AppData\Local\{3407BD16-DD7C-4E25-9E11-90D8C6317E4C}
    2012-05-27 22:49:37 -------- d-----w- C:\Users\Jeff\AppData\Local\{8539D024-2E4B-4857-BA90-9157C015AFF6}
    2012-05-27 22:49:26 -------- d-----w- C:\Users\Jeff\AppData\Local\{CF08C270-9471-4EE0-B613-C453BFD7328A}
    2012-05-27 10:49:13 -------- d-----w- C:\Users\Jeff\AppData\Local\{B0308D60-B172-4D4E-A666-AFDA030F5CD0}
    2012-05-27 10:49:02 -------- d-----w- C:\Users\Jeff\AppData\Local\{E61C985C-2A8C-4910-8D17-8F0DDE6C8674}
    2012-05-26 13:14:12 -------- d-----w- C:\Users\Jeff\AppData\Local\{02C22AD7-0F12-4FB8-AA11-A4394E9FDE4D}
    2012-05-26 13:14:00 -------- d-----w- C:\Users\Jeff\AppData\Local\{67B72299-F761-4338-A4AE-6E4EA8C6884B}
    2012-05-26 01:13:34 -------- d-----w- C:\Users\Jeff\AppData\Local\{FB91A34B-9312-4C94-9E72-A398B91C61EA}
    2012-05-26 01:13:22 -------- d-----w- C:\Users\Jeff\AppData\Local\{BAB0BA65-0FA4-47C6-AEC7-3E658592C74E}
    2012-05-25 08:25:10 -------- d-----w- C:\Users\Jeff\AppData\Local\{49D94C31-10F5-45B5-A152-62F95B3726D8}
    2012-05-25 08:24:59 -------- d-----w- C:\Users\Jeff\AppData\Local\{91BBD089-D1D1-498B-B30D-845BD9E39720}
    2012-05-24 20:24:46 -------- d-----w- C:\Users\Jeff\AppData\Local\{6FC463A6-A517-45A4-929B-7953D017A00C}
    2012-05-24 20:24:35 -------- d-----w- C:\Users\Jeff\AppData\Local\{C5F1E87E-78C5-46ED-B3E2-39D92028B8B5}
    2012-05-24 08:24:10 -------- d-----w- C:\Users\Jeff\AppData\Local\{6EA184B4-4071-4A89-8D73-C1A2B2800DEB}
    2012-05-24 08:23:59 -------- d-----w- C:\Users\Jeff\AppData\Local\{43EBB88C-62A4-4B4D-9D60-5D7D8D48D865}
    2012-05-23 20:23:46 -------- d-----w- C:\Users\Jeff\AppData\Local\{4FC24D6D-5B73-44B5-8DE6-EABB373F4D97}
    2012-05-23 20:23:35 -------- d-----w- C:\Users\Jeff\AppData\Local\{27ED64B8-A80A-48F0-99DC-7AF73A5407C4}
    2012-05-23 07:46:26 -------- d-----w- C:\Users\Jeff\AppData\Local\{E569250D-B8D0-4993-A805-19EF425A9148}
    2012-05-23 07:46:14 -------- d-----w- C:\Users\Jeff\AppData\Local\{F8425572-DF86-4602-A874-86B276771A92}
    2012-05-22 19:23:23 -------- d-----w- C:\Users\Jeff\AppData\Local\{67B57BF1-2BF6-4448-98A4-3303AD9342C1}
    2012-05-22 19:23:12 -------- d-----w- C:\Users\Jeff\AppData\Local\{AF62797D-A3FE-4CE2-B279-F367602A024F}
    2012-05-22 07:22:39 -------- d-----w- C:\Users\Jeff\AppData\Local\{21871802-60E1-4231-8116-6752C5C2B5C8}
    2012-05-22 07:21:51 -------- d-----w- C:\Users\Jeff\AppData\Local\{332B6B2D-2F5E-45C1-A942-6F8914863C0F}
    2012-05-21 13:56:43 -------- d-----w- C:\Users\Jeff\AppData\Local\{C46DC0B1-BE7D-4D44-AD84-D16F927F9F40}
    2012-05-21 13:56:32 -------- d-----w- C:\Users\Jeff\AppData\Local\{A6486E20-C2D9-4C2A-8F84-00FD8D408E99}
    2012-05-21 01:56:16 -------- d-----w- C:\Users\Jeff\AppData\Local\{11B298A8-B497-4EE0-A10D-6367A80BFDA2}
    2012-05-21 01:56:07 -------- d-----w- C:\Users\Jeff\AppData\Local\{105C7889-6F8D-4FAF-9561-7BBD2170DF55}
    2012-05-20 11:40:07 -------- d-----w- C:\Users\Jeff\AppData\Local\{8B790C8C-6923-4FFD-82B5-DBDE5F2FBB55}
    2012-05-20 11:39:56 -------- d-----w- C:\Users\Jeff\AppData\Local\{8F191DFC-598D-48A6-95E4-F882B949E5A3}
    2012-05-19 21:50:23 -------- d-----w- C:\Users\Jeff\AppData\Local\{1C913E32-75C9-4099-B3FA-1EE6E530EFD6}
    2012-05-19 21:50:11 -------- d-----w- C:\Users\Jeff\AppData\Local\{A47C4771-CB92-4376-BC21-27A9378D7238}
    2012-05-19 09:49:59 -------- d-----w- C:\Users\Jeff\AppData\Local\{45C5432F-B190-49F0-B1F4-40EDFCB90B28}
    2012-05-19 09:49:47 -------- d-----w- C:\Users\Jeff\AppData\Local\{EFE4B869-4D27-4EE8-8891-3D022EF1B69C}
    2012-05-18 21:49:35 -------- d-----w- C:\Users\Jeff\AppData\Local\{685E36CA-B179-4856-83C4-5864B94C6801}
    2012-05-18 21:49:23 -------- d-----w- C:\Users\Jeff\AppData\Local\{4FE3E11E-BE7A-4D11-86DC-FD61DA534096}
    2012-05-18 07:27:22 737912 ----a-w- C:\Windows\System32\drivers\NAVx64\1307010.005\srtsp64.sys
    2012-05-18 07:27:22 451192 ----a-r- C:\Windows\System32\drivers\NAVx64\1307010.005\symds64.sys
    2012-05-18 07:27:22 405624 ----a-w- C:\Windows\System32\drivers\NAVx64\1307010.005\symnets.sys
    2012-05-18 07:27:22 37496 ----a-w- C:\Windows\System32\drivers\NAVx64\1307010.005\srtspx64.sys
    2012-05-18 07:27:22 190072 ----a-w- C:\Windows\System32\drivers\NAVx64\1307010.005\ironx64.sys
    2012-05-18 07:27:22 167048 ----a-w- C:\Windows\System32\drivers\NAVx64\1307010.005\ccsetx64.sys
    2012-05-18 07:27:22 1092728 ----a-w- C:\Windows\System32\drivers\NAVx64\1307010.005\symefa64.sys
    2012-05-18 07:27:18 -------- d-----w- C:\Windows\System32\drivers\NAVx64\1307010.005
    2012-05-18 05:15:02 -------- d-----w- C:\Users\Jeff\AppData\Local\{20121257-6C57-4D4D-8951-8A3AE1A8DB5F}
    2012-05-18 05:14:51 -------- d-----w- C:\Users\Jeff\AppData\Local\{FA7E2CFC-C169-4A73-BC8C-49B41850AA9E}
    2012-05-17 17:14:38 -------- d-----w- C:\Users\Jeff\AppData\Local\{76283022-6375-4735-B8C5-70E01F6FD7BD}
    2012-05-17 17:14:26 -------- d-----w- C:\Users\Jeff\AppData\Local\{650CD7A0-AACA-445E-A3E3-F179182AF171}
    2012-05-17 04:19:37 -------- d-----w- C:\Users\Jeff\AppData\Local\{82D384EC-C48B-4CC0-9BFB-143088556DD6}
    2012-05-17 04:19:26 -------- d-----w- C:\Users\Jeff\AppData\Local\{EEEBAF90-94C9-4D54-9542-1A4C9D26B890}
    2012-05-16 16:18:59 -------- d-----w- C:\Users\Jeff\AppData\Local\{6D849FD5-F4CB-4A04-9A96-957F2E880EC3}
    2012-05-16 16:18:47 -------- d-----w- C:\Users\Jeff\AppData\Local\{F667B0AA-19E5-4A84-B538-CE3910FE2577}
    2012-05-15 22:05:42 -------- d-----w- C:\Users\Jeff\AppData\Local\{8A27697E-903F-4062-8CDC-C619601A289D}
    2012-05-15 22:05:30 -------- d-----w- C:\Users\Jeff\AppData\Local\{6DCADE1A-64B2-49D0-B44D-9C66E1A5F02E}
    2012-05-15 21:38:15 -------- d-----w- C:\Users\Jeff\AppData\Local\LogMeIn Rescue Applet
    2012-05-13 19:01:11 -------- d-----w- C:\Users\Jeff\AppData\Local\{28208645-F74B-49A9-BAE7-6A7C8E9E5AFD}
    2012-05-13 19:01:00 -------- d-----w- C:\Users\Jeff\AppData\Local\{E89DD03F-1A18-4A06-A3D3-009EBE3781C1}
    2012-05-12 07:29:26 -------- d-----w- C:\Users\Jeff\AppData\Local\{C417D30A-FBFD-4D7D-9D71-132B706CA6FD}
    2012-05-12 07:29:15 -------- d-----w- C:\Users\Jeff\AppData\Local\{E7D852AC-BF8D-4701-A8A1-1246C3334E4A}
    2012-05-12 02:50:59 1544704 ----a-w- C:\Windows\System32\DWrite.dll
    2012-05-12 02:50:59 1077248 ----a-w- C:\Windows\SysWow64\DWrite.dll
    2012-05-12 02:50:58 5559664 ----a-w- C:\Windows\System32\ntoskrnl.exe
    2012-05-12 02:50:57 3968368 ----a-w- C:\Windows\SysWow64\ntkrnlpa.exe
    2012-05-12 02:50:57 3913072 ----a-w- C:\Windows\SysWow64\ntoskrnl.exe
    2012-05-12 02:50:57 3146240 ----a-w- C:\Windows\System32\win32k.sys
    2012-05-12 02:50:03 75120 ----a-w- C:\Windows\System32\drivers\partmgr.sys
    2012-05-12 02:49:41 1918320 ----a-w- C:\Windows\System32\drivers\tcpip.sys
    2012-05-12 02:49:39 936960 ----a-w- C:\Program Files (x86)\Common Files\Microsoft Shared\ink\journal.dll
    2012-05-12 02:49:39 1732096 ----a-w- C:\Program Files\Windows Journal\NBDoc.DLL
    2012-05-12 02:49:39 1402880 ----a-w- C:\Program Files\Windows Journal\JNWDRV.dll
    2012-05-12 02:49:39 1393664 ----a-w- C:\Program Files\Windows Journal\JNTFiltr.dll
    2012-05-12 02:49:39 1367552 ----a-w- C:\Program Files\Common Files\Microsoft Shared\ink\journal.dll
    2012-05-10 16:20:31 -------- d-----w- C:\Users\Jeff\AppData\Local\{4DED0C47-E9B4-49AE-BC03-0843A2A78585}
    2012-05-10 16:20:19 -------- d-----w- C:\Users\Jeff\AppData\Local\{6EB0B220-241F-4CAF-BEED-A592517B2AC3}
    2012-05-09 05:06:54 -------- d-----w- C:\Users\Jeff\AppData\Local\{64638BB0-30EB-47D6-8E1B-AAE9393B09AA}
    2012-05-09 05:06:43 -------- d-----w- C:\Users\Jeff\AppData\Local\{BC45ED5A-C692-427E-8B74-7CD14D3CAAEF}
    2012-05-07 20:03:32 -------- d-----w- C:\Users\Jeff\AppData\Local\{20EF32A5-5179-47DD-9C8E-1647C4BB6BA3}
    2012-05-07 20:03:21 -------- d-----w- C:\Users\Jeff\AppData\Local\{F78A23A3-F644-47DB-8F41-12CD417FB058}
    2012-05-07 07:01:51 -------- d-----w- C:\Users\Jeff\AppData\Local\{B33C1871-BBC4-4FDB-812E-FE09BFE9145D}
    2012-05-07 07:01:39 -------- d-----w- C:\Users\Jeff\AppData\Local\{373DC5D3-093E-47CC-9797-258328BB668A}
    2012-05-06 17:14:52 -------- d-----w- C:\Users\Jeff\AppData\Local\{C7CA2E56-C73F-4B76-8B2D-3603BB9FE9EE}
    2012-05-06 06:22:19 -------- d-----w- C:\Users\Jeff\AppData\Local\{1B8C9F26-969F-4117-B183-06808ECC6664}
    2012-05-06 06:22:08 -------- d-----w- C:\Users\Jeff\AppData\Local\{879BB8B9-DA91-44A6-B473-84CBF41B36AD}
    2012-05-05 19:00:13 -------- d-----w- C:\Users\Jeff\AppData\Local\{F1B318E8-0B18-44F4-A55B-05B1B81E273F}
    2012-05-05 19:00:01 -------- d-----w- C:\Users\Jeff\AppData\Local\{DB320363-B674-47B5-B35A-A3CD350D48AD}
    2012-05-05 00:24:27 8744608 ----a-w- C:\Windows\SysWow64\FlashPlayerInstaller.exe
    2012-05-04 14:06:25 -------- d-----w- C:\Users\Jeff\AppData\Local\{D63005E5-972A-4E3E-BF59-FB2B840047FD}
    2012-05-04 14:06:14 -------- d-----w- C:\Users\Jeff\AppData\Local\{FE96D90D-471F-47EB-BCDA-3CC49309FC4F}
    2012-05-04 06:43:15 -------- d-----w- C:\Users\Jeff\AppData\Local\{4C93D8A6-F16A-443E-A13A-5AADEA5758D0}
    2012-05-04 06:43:04 -------- d-----w- C:\Users\Jeff\AppData\Local\{4AFD204F-B66C-4AB0-86E6-831C4A70039F}
    .
    ==================== Find3M ====================
    .
    2012-05-30 21:29:36 2828 --sha-w- C:\ProgramData\KGyGaAvL.sys
    2012-05-05 00:24:36 70304 ----a-w- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl
    2012-05-05 00:24:36 419488 ----a-w- C:\Windows\SysWow64\FlashPlayerApp.exe
    2012-04-19 19:06:36 175736 ----a-w- C:\Windows\System32\drivers\SYMEVENT64x86.SYS
    2011-08-23 22:42:54 332144 ----a-w- C:\Program Files (x86)\Common Files\MediaOrganizer.dll
    2011-08-23 22:35:38 33136 ----a-w- C:\Program Files (x86)\Common Files\FlickrProvider.dll
    2011-08-23 22:35:14 402800 ----a-w- C:\Program Files (x86)\Common Files\facebook.dll
    2011-08-23 22:35:14 130416 ----a-w- C:\Program Files (x86)\Common Files\PluginCommon.dll
    2011-08-23 22:34:26 465264 ----a-w- C:\Program Files (x86)\Common Files\AppFramework.dll
    .
    ============= FINISH: 11:57:05.99 ===============
  2. Bobbye

    Bobbye Helper on the Fringe Posts: 16,392   +35

    Welcome to TechSpot! Leaving logs without any description of what you are experiencing doesn't give me much information.

    I will help find and remove the malware, but need some description from you.

    There is also another log for DDS- it's named Attach.txt and should have been pasted in with the DDS.txt log. If you can find it, please leave in the next reply. But most likely you will need to repeat the scan to get the log.
    ==============================================
    Please note: If you have previously run Combofix and it's still on the system, please uninstall it. Then download the current version and do the scan: Uninstall directions, if needed
    • Click START> then RUN
    • Now type Combofix /Uninstall in the runbox and click OK. Note the space between the X and the U, it needs to be there.
    --------------------------------------

    • Download Combofix from HERE or HEREand save to the desktop
      • Double click combofix.exe [​IMG]& follow the prompts.
      • If prompted for Recovery Console, please allow.
      • Once installed, you should see a blue screen prompt that says:
      • Note: If Combofix was downloaded to a flash drive, the Recovery Console will not install- just bypass and go on.[/b]
      • Note: No query will be made if the Recovery Console is already on the system.
    • Close any open browsers.
    • Before you run the Combofix scan, please disable any security software you have running.
      (If you need help with this, please see HERE)
    • Click on Yes, to continue scanning for malware
    • If Combofix asks you to update the program, allow
    • When the scan completes , a report will be generated-it will open a text window. Please paste the C:\ComboFix.txt in next reply..
    Re-enable your Antivirus software.
    Note 1:Do not mouse-click Combofix's window while it is running. That may cause it to stall.
    Note 2:If you receive an error "Illegal operation attempted on a registry key that has been marked for deletion", restart the computer.
    Note 3:CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficultyand terminates prematurely, the connection can be manually restored by restarting your machine.
    ======================================================

    To run the Eset Online Virus Scan:
    If you use Internet Explorer:
    1. Open the ESETOnlineScan
    2. Skip to #4 to "Continue with the directions"

      If you are using a browser other than Internet Explorer
    3. Open Eset Smart Installer
      [o] Click on the esetsmartinstaller_enu.exelink and save to the desktop.
      [o] Double click on the desktop icon to run.
      [o] After successful installation of the ESET Smart Installer, the ESET Online Scanner will be launched in a new Window
    4. Continue with the directions.
    5. Check 'Yes I accept terms of use.'
    6. Click Start button
    7. Accept any security warnings from your browser.
      [​IMG]
    8. Uncheck 'Remove found threats'
    9. Check 'Scan archives/
    10. Leave remaining settings as is.
    11. Press the Start button.
    12. ESET will then download updates for itself, install itself, and begin scanning your computer. Please wait for the scan to finish.
    13. When the scan completes, press List of found threats
    14. Push Export of text file and save the file to your desktop using a unique name, such as ESETScan. Paste this log in your next reply.
    15. Push the Back button, then Finish
    NOTE: If no malware is found then no log will be produced. Let me know if this is the case.
    =============================================
    My Guidelines: please read and follow:
    • Be patient. Malware cleaning takes time. I am also working with other members while I am helping you.
    • Read my instructions carefully. If you don't understand or have a problem, ask me. Follow the order of the tasks I give you. Order is crucial in cleaning process.
    • If you have questions, or if a program doesn't work, stop and tell me about it. Don't try to get around it yourself.
    • File sharing programs should be uninstalled or disabled during the cleaning process..
    • Observe these:
      [o] Don't follow directions given to someone else
      [o] Don't use any other cleaning programs or scans while I'm helping you.
      [o] Don't use a Registry cleaner or make any changes in the Registry.
      [o] Don't download and install new programs- except those I give you.
    Threads are closed after 5 days if there is no reply.

    Please include a description of your problem and the logs for Attach.txt, Combofix and the Eset scan in your next reply.

    Please uninstall the following:
    SpeedupMyPC
    Relavant Knowledge
    Facemods.

    After they have been uninstalled, use Windows explorer to access Computer> Local Drive(C)> Programs> Find the program folder for each of the programs you uninstalled and do a right click> Delete.

    I have renamed your thread to something more appropriate.
  3. Osbert

    Osbert Newcomer, in training Topic Starter

    sorry - I'm a total computer noob so thanks for your patience
    the problem with my computer is increasingly frequent crashes which makes me suspect some kind of malware but my norton can't seem to find it. in fact, I can't run the Eset scan - I've tried for three hours, but my computer consistently crashes before it is finished. is there another program I could try?
    in any case...the attach.txt log...

    .
    UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
    IF REQUESTED, ZIP IT UP & ATTACH IT
    .
    DDS (Ver_2011-08-26.01)
    .
    Microsoft Windows 7 Professional
    Boot Device: \Device\HarddiskVolume3
    Install Date: 17/10/2010 11:17:56 PM
    System Uptime: 02/06/2012 6:52:13 PM (0 hours ago)
    .
    Motherboard: ASUSTeK Computer INC. | | M4A88TD-V EVO/USB3
    Processor: AMD Phenom(tm) II X4 965 Processor | AM3 | 3400/200mhz
    .
    ==== Disk Partitions =========================
    .
    C: is FIXED (NTFS) - 931 GiB total, 806.354 GiB free.
    D: is FIXED (NTFS) - 292 GiB total, 14.978 GiB free.
    E: is FIXED (NTFS) - 6 GiB total, 0.881 GiB free.
    F: is CDROM (UDF)
    .
    ==== Disabled Device Manager Items =============
    .
    ==== System Restore Points ===================
    .
    RP194: 01/06/2012 2:54:31 PM - Scheduled Checkpoint
    .
    ==== Installed Programs ======================
    .
    Adobe AIR
    Adobe Flash Player 10 ActiveX
    Adobe Reader X
    All My Gods
    AMD VISION Engine Control Center
    Aquapolis
    ATI Catalyst Registration
    Avination Viewer
    Big Fish Games: Game Manager
    BugBits
    Catalyst Control Center - Branding
    Catalyst Control Center Graphics Previews Common
    Catalyst Control Center InstallProxy
    Catalyst Control Center Localization All
    CCC Help Chinese Standard
    CCC Help Chinese Traditional
    CCC Help Czech
    CCC Help Danish
    CCC Help Dutch
    CCC Help English
    CCC Help Finnish
    CCC Help French
    CCC Help German
    CCC Help Greek
    CCC Help Hungarian
    CCC Help Italian
    CCC Help Japanese
    CCC Help Korean
    CCC Help Norwegian
    CCC Help Polish
    CCC Help Portuguese
    CCC Help Russian
    CCC Help Spanish
    CCC Help Swedish
    CCC Help Thai
    CCC Help Turkish
    Corel KPT Collection
    Corel Painter Essentials 4
    Corel PaintShop Photo Pro X3
    D3DX10
    Dark Dimensions: City of Fog
    Downloader
    Dracula: Love Kills
    Dream Inn: Driftwood
    DUNGEONS
    EAX Unified
    ESET Online Scanner v3
    Fairy Maids
    Farm Frenzy 3: Madagascar
    Farm Frenzy Pizza Party
    Font Management System
    GhostMaster
    Google Chrome
    Google Update Helper
    Gourmania 3: Zoo Zoom
    ICA
    IPM_PSP_CL
    IPM_PSP_COM
    Java Auto Updater
    Java(TM) 6 Update 26
    Junk Mail filter update
    Life Quest®
    Magic Bullet PhotoLooks for PaintShop Photo Pro
    Malwarebytes Anti-Malware version 1.61.0.1400
    Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
    Microsoft Visual C++ 2005 Redistributable
    Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
    Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022
    Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
    Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
    Microsoft Visual C++ 2010 x86 Redistributable - 10.0.30319
    Microsoft WSE 3.0 Runtime
    Mozilla Firefox 12.0 (x86 en-US)
    Mozilla Maintenance Service
    Mr Jones' Graveyard Shift
    MSVCRT
    MSVCRT_amd64
    Mystery of Mortlake Mansion
    NEC Electronics USB 3.0 Host Controller Driver
    Norton AntiVirus
    OpenOffice.org 3.2
    Orchard
    Origin
    Phoenix Viewer 1.6.0.1691
    Plants vs. Zombies
    Poser Debut
    PSPPContent
    PSPPRO_DCRAW
    Puppetshow: Return to Joyville
    QuickTime
    Realtek Ethernet Controller Driver For Windows 7
    Realtek High Definition Audio Driver
    Redrum: Time Lies
    Security Update for Microsoft .NET Framework 4 Client Profile (KB2160841)
    Security Update for Microsoft .NET Framework 4 Client Profile (KB2446708)
    Security Update for Microsoft .NET Framework 4 Client Profile (KB2478663)
    Security Update for Microsoft .NET Framework 4 Client Profile (KB2518870)
    Security Update for Microsoft .NET Framework 4 Client Profile (KB2539636)
    Security Update for Microsoft .NET Framework 4 Client Profile (KB2572078)
    Security Update for Microsoft .NET Framework 4 Client Profile (KB2604121)
    Security Update for Microsoft .NET Framework 4 Client Profile (KB2633870)
    Security Update for Microsoft .NET Framework 4 Client Profile (KB2656351)
    Security Update for Microsoft .NET Framework 4 Client Profile (KB2656368)
    Security Update for Microsoft .NET Framework 4 Client Profile (KB2656405)
    Security Update for Microsoft .NET Framework 4 Extended (KB2416472)
    Security Update for Microsoft .NET Framework 4 Extended (KB2487367)
    Security Update for Microsoft .NET Framework 4 Extended (KB2656351)
    Setup
    SpeedyPC Pro
    Stray Souls: Dollhouse Story Collector's Edition
    The Lord of the Rings FREE Trial
    The Sims™ 3
    The Sims™ 3 Ambitions
    The Sims™ 3 Generations
    Update for Microsoft .NET Framework 4 Client Profile (KB2468871)
    Update for Microsoft .NET Framework 4 Client Profile (KB2473228)
    Update for Microsoft .NET Framework 4 Client Profile (KB2533523)
    Update for Microsoft .NET Framework 4 Client Profile (KB2600217)
    Update for Microsoft .NET Framework 4 Extended (KB2468871)
    Update for Microsoft .NET Framework 4 Extended (KB2533523)
    Update for Microsoft .NET Framework 4 Extended (KB2600217)
    Windows Live Communications Platform
    Windows Live Essentials
    Windows Live Installer
    Windows Live Mail
    Windows Live Photo Common
    Windows Live PIMT Platform
    Windows Live SOXE
    Windows Live SOXE Definitions
    Windows Live UX Platform
    Windows Live UX Platform Language Pack
    Windows Live Writer
    Windows Live Writer Resources
    .
    ==== Event Viewer Messages From Past Week ========
    .
    31/05/2012 5:49:16 PM, Error: Service Control Manager [7031] - The Norton AntiVirus service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 120000 milliseconds: Restart the service.
    31/05/2012 11:23:04 PM, Error: volsnap [36] - The shadow copies of volume C: were aborted because the shadow copy storage could not grow due to a user imposed limit.
    31/05/2012 10:45:43 PM, Error: Service Control Manager [7034] - The Windows Error Reporting Service service terminated unexpectedly. It has done this 8 time(s).
    31/05/2012 10:40:22 PM, Error: Service Control Manager [7034] - The Windows Error Reporting Service service terminated unexpectedly. It has done this 7 time(s).
    31/05/2012 10:39:57 PM, Error: Service Control Manager [7032] - The Service Control Manager tried to take a corrective action (Restart the service) after the unexpected termination of the Windows Error Reporting Service service, but this action failed with the following error: An instance of the service is already running.
    31/05/2012 10:39:15 PM, Error: Service Control Manager [7034] - The Windows Error Reporting Service service terminated unexpectedly. It has done this 6 time(s).
    31/05/2012 10:38:43 PM, Error: Service Control Manager [7034] - The Windows Error Reporting Service service terminated unexpectedly. It has done this 5 time(s).
    31/05/2012 10:37:16 PM, Error: Service Control Manager [7034] - The Windows Error Reporting Service service terminated unexpectedly. It has done this 4 time(s).
    31/05/2012 10:36:49 PM, Error: Service Control Manager [7034] - The Windows Error Reporting Service service terminated unexpectedly. It has done this 3 time(s).
    31/05/2012 10:35:30 PM, Error: Service Control Manager [7031] - The Windows Installer service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 120000 milliseconds: Restart the service.
    31/05/2012 10:34:57 PM, Error: Service Control Manager [7031] - The Windows Error Reporting Service service terminated unexpectedly. It has done this 2 time(s). The following corrective action will be taken in 300000 milliseconds: Restart the service.
    31/05/2012 10:33:09 PM, Error: Service Control Manager [7031] - The Windows Error Reporting Service service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 120000 milliseconds: Restart the service.
    31/05/2012 10:31:56 PM, Error: Microsoft-Windows-Kernel-General [5] - {Registry Hive Recovered} Registry hive (file): '\SystemRoot\System32\Config\SOFTWARE' was corrupted and it has been recovered. Some data might have been lost.
    31/05/2012 10:28:08 PM, Error: Service Control Manager [7009] - A timeout was reached (30000 milliseconds) while waiting for the Google Update Service (gupdate) service to connect.
    31/05/2012 10:28:08 PM, Error: Service Control Manager [7000] - The Google Update Service (gupdate) service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
    31/05/2012 10:27:38 PM, Error: Service Control Manager [7009] - A timeout was reached (30000 milliseconds) while waiting for the Microsoft .NET Framework NGEN v4.0.30319_X64 service to connect.
    30/05/2012 5:07:33 PM, Error: Microsoft-Windows-WER-SystemErrorReporting [1001] - The computer has rebooted from a bugcheck. The bugcheck was: 0x0000001a (0x0000000000005003, 0xfffff780c0000000, 0x000000000001f6f1, 0x0001abf70003edc2). A dump was saved in: C:\Windows\MEMORY.DMP. Report Id: 053012-26660-01.
    30/05/2012 12:28:46 PM, Error: Microsoft-Windows-WER-SystemErrorReporting [1001] - The computer has rebooted from a bugcheck. The bugcheck was: 0x0000003b (0x00000000c0000005, 0xfffff80002eb7f60, 0xfffff88003f1af00, 0x0000000000000000). A dump was saved in: C:\Windows\MEMORY.DMP. Report Id: 053012-24694-01.
    02/06/2012 9:19:29 AM, Error: Service Control Manager [7031] - The Superfetch service terminated unexpectedly. It has done this 2 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service.
    02/06/2012 6:52:46 PM, Error: Service Control Manager [7000] - The AODDriver4.1 service failed to start due to the following error: The system cannot find the file specified.
    02/06/2012 6:52:44 PM, Error: Microsoft-Windows-WER-SystemErrorReporting [1001] - The computer has rebooted from a bugcheck. The bugcheck was: 0x0000000a (0x0000000000000068, 0x0000000000000002, 0x0000000000000000, 0xfffff80002ee8925). A dump was saved in: C:\Windows\MEMORY.DMP. Report Id: 060212-30934-01.
    02/06/2012 6:26:36 PM, Error: Microsoft-Windows-WER-SystemErrorReporting [1001] - The computer has rebooted from a bugcheck. The bugcheck was: 0x00000034 (0x0000000000050853, 0xfffff88003385738, 0xfffff88003384f90, 0xfffff80002ed0df7). A dump was saved in: C:\Windows\MEMORY.DMP. Report Id: 060212-22183-01.
    02/06/2012 5:36:54 PM, Error: Microsoft-Windows-WER-SystemErrorReporting [1001] - The computer has rebooted from a bugcheck. The bugcheck was: 0x0000001e (0xffffffffc0000005, 0xfffff88008cce010, 0x0000000000000000, 0x0000000000000000). A dump was saved in: C:\Windows\MEMORY.DMP. Report Id: 060212-20373-01.
    02/06/2012 5:17:31 PM, Error: Microsoft-Windows-WER-SystemErrorReporting [1001] - The computer has rebooted from a bugcheck. The bugcheck was: 0x0000003b (0x00000000c0000005, 0xfffff80003002617, 0xfffff88008b2a6e0, 0x0000000000000000). A dump was saved in: C:\Windows\MEMORY.DMP. Report Id: 060212-21590-01.
    02/06/2012 4:46:00 PM, Error: Service Control Manager [7023] - The Windows Defender service terminated with the following error: The specified module could not be found.
    02/06/2012 4:44:52 PM, Error: Service Control Manager [7030] - The PEVSystemStart service is marked as an interactive service. However, the system is configured to not allow interactive services. This service may not function properly.
    02/06/2012 4:43:36 PM, Error: Application Popup [1060] - \??\C:\ComboFix\catchme.sys has been blocked from loading due to incompatibility with this system. Please contact your software vendor for a compatible version of the driver.
    02/06/2012 3:47:46 PM, Error: Service Control Manager [7031] - The Superfetch service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service.
    02/06/2012 3:18:46 PM, Error: Service Control Manager [7034] - The Network Location Awareness service terminated unexpectedly. It has done this 3 time(s).
    02/06/2012 3:18:46 PM, Error: Service Control Manager [7034] - The Cryptographic Services service terminated unexpectedly. It has done this 2 time(s).
    02/06/2012 3:18:46 PM, Error: Service Control Manager [7031] - The Workstation service terminated unexpectedly. It has done this 2 time(s). The following corrective action will be taken in 120000 milliseconds: Restart the service.
    02/06/2012 3:18:46 PM, Error: Service Control Manager [7031] - The Network Location Awareness service terminated unexpectedly. It has done this 2 time(s). The following corrective action will be taken in 100 milliseconds: Restart the service.
    02/06/2012 3:18:46 PM, Error: Service Control Manager [7031] - The DNS Client service terminated unexpectedly. It has done this 2 time(s). The following corrective action will be taken in 300000 milliseconds: Restart the service.
    02/06/2012 11:21:54 AM, Error: Service Control Manager [7032] - The Service Control Manager tried to take a corrective action (Restart the service) after the unexpected termination of the Windows Management Instrumentation service, but this action failed with the following error: An instance of the service is already running.
    02/06/2012 11:21:54 AM, Error: Service Control Manager [7032] - The Service Control Manager tried to take a corrective action (Restart the service) after the unexpected termination of the User Profile Service service, but this action failed with the following error: An instance of the service is already running.
    02/06/2012 11:21:54 AM, Error: Service Control Manager [7032] - The Service Control Manager tried to take a corrective action (Restart the service) after the unexpected termination of the Multimedia Class Scheduler service, but this action failed with the following error: An instance of the service is already running.
    02/06/2012 11:21:54 AM, Error: Service Control Manager [7032] - The Service Control Manager tried to take a corrective action (Restart the service) after the unexpected termination of the DNS Client service, but this action failed with the following error: An instance of the service is already running.
    02/06/2012 11:20:54 AM, Error: Service Control Manager [7032] - The Service Control Manager tried to take a corrective action (Restart the service) after the unexpected termination of the Shell Hardware Detection service, but this action failed with the following error: An instance of the service is already running.
    02/06/2012 11:19:56 AM, Error: Service Control Manager [7009] - A timeout was reached (30000 milliseconds) while waiting for the IPsec Policy Agent service to connect.
    02/06/2012 11:19:56 AM, Error: Service Control Manager [7000] - The IPsec Policy Agent service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
    02/06/2012 11:19:54 AM, Error: Service Control Manager [7032] - The Service Control Manager tried to take a corrective action (Restart the service) after the unexpected termination of the Network Location Awareness service, but this action failed with the following error: An instance of the service is already running.
    02/06/2012 11:19:54 AM, Error: Service Control Manager [7031] - The Workstation service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service.
    02/06/2012 11:19:54 AM, Error: Service Control Manager [7031] - The Windows Management Instrumentation service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 120000 milliseconds: Restart the service.
    02/06/2012 11:19:54 AM, Error: Service Control Manager [7031] - The User Profile Service service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 120000 milliseconds: Restart the service.
    02/06/2012 11:19:54 AM, Error: Service Control Manager [7031] - The Themes service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service.
    02/06/2012 11:19:54 AM, Error: Service Control Manager [7031] - The Task Scheduler service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service.
    02/06/2012 11:19:54 AM, Error: Service Control Manager [7031] - The Shell Hardware Detection service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service.
    02/06/2012 11:19:54 AM, Error: Service Control Manager [7031] - The Server service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service.
    02/06/2012 11:19:54 AM, Error: Service Control Manager [7031] - The Network Location Awareness service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 100 milliseconds: Restart the service.
    02/06/2012 11:19:54 AM, Error: Service Control Manager [7031] - The Multimedia Class Scheduler service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 120000 milliseconds: Restart the service.
    02/06/2012 11:19:54 AM, Error: Service Control Manager [7031] - The IP Helper service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 120000 milliseconds: Restart the service.
    02/06/2012 11:19:54 AM, Error: Service Control Manager [7031] - The Group Policy Client service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 120000 milliseconds: Restart the service.
    02/06/2012 11:19:54 AM, Error: Service Control Manager [7031] - The DNS Client service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 120000 milliseconds: Restart the service.
    02/06/2012 11:19:54 AM, Error: Service Control Manager [7031] - The Cryptographic Services service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service.
    02/06/2012 11:19:35 AM, Error: Service Control Manager [7009] - A timeout was reached (30000 milliseconds) while waiting for the COM+ Event System service to connect.
    02/06/2012 11:19:35 AM, Error: Service Control Manager [7001] - The System Event Notification Service service depends on the COM+ Event System service which failed to start because of the following error: The service did not respond to the start or control request in a timely fashion.
    02/06/2012 11:19:35 AM, Error: Service Control Manager [7000] - The COM+ Event System service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
    02/06/2012 11:17:47 AM, Error: Service Control Manager [7031] - The Portable Device Enumerator Service service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 120000 milliseconds: Restart the service.
    02/06/2012 11:17:46 AM, Error: Service Control Manager [7009] - A timeout was reached (30000 milliseconds) while waiting for the Windows Event Log service to connect.
    02/06/2012 11:17:46 AM, Error: Service Control Manager [7009] - A timeout was reached (30000 milliseconds) while waiting for the Windows Driver Foundation - User-mode Driver Framework service to connect.
    02/06/2012 11:17:46 AM, Error: Service Control Manager [7009] - A timeout was reached (30000 milliseconds) while waiting for the Windows Audio Endpoint Builder service to connect.
    02/06/2012 11:17:46 AM, Error: Service Control Manager [7009] - A timeout was reached (30000 milliseconds) while waiting for the Themes service to connect.
    02/06/2012 11:17:46 AM, Error: Service Control Manager [7009] - A timeout was reached (30000 milliseconds) while waiting for the TCP/IP NetBIOS Helper service to connect.
    02/06/2012 11:17:46 AM, Error: Service Control Manager [7009] - A timeout was reached (30000 milliseconds) while waiting for the Network Store Interface Service service to connect.
    02/06/2012 11:17:46 AM, Error: Service Control Manager [7009] - A timeout was reached (30000 milliseconds) while waiting for the Multimedia Class Scheduler service to connect.
    02/06/2012 11:17:46 AM, Error: Service Control Manager [7009] - A timeout was reached (30000 milliseconds) while waiting for the Diagnostic Policy Service service to connect.
    02/06/2012 11:17:46 AM, Error: Service Control Manager [7009] - A timeout was reached (30000 milliseconds) while waiting for the Desktop Window Manager Session Manager service to connect.
    02/06/2012 11:17:46 AM, Error: Service Control Manager [7009] - A timeout was reached (30000 milliseconds) while waiting for the AMD External Events Utility service to connect.
    02/06/2012 11:17:46 AM, Error: Service Control Manager [7001] - The Windows Audio service depends on the Remote Procedure Call (RPC) service which failed to start because of the following error: The dependency service or group failed to start.
    02/06/2012 11:17:46 AM, Error: Service Control Manager [7001] - The User Profile Service service depends on the Remote Procedure Call (RPC) service which failed to start because of the following error: The dependency service or group failed to start.
    02/06/2012 11:17:46 AM, Error: Service Control Manager [7001] - The Task Scheduler service depends on the Windows Event Log service which failed to start because of the following error: The service did not respond to the start or control request in a timely fashion.
    02/06/2012 11:17:46 AM, Error: Service Control Manager [7001] - The System Event Notification Service service depends on the COM+ Event System service which failed to start because of the following error: The dependency service or group failed to start.
    02/06/2012 11:17:46 AM, Error: Service Control Manager [7001] - The Server service depends on the Security Accounts Manager service which failed to start because of the following error: The dependency service or group failed to start.
    02/06/2012 11:17:46 AM, Error: Service Control Manager [7001] - The Security Accounts Manager service depends on the Remote Procedure Call (RPC) service which failed to start because of the following error: The dependency service or group failed to start.
    02/06/2012 11:17:46 AM, Error: Service Control Manager [7001] - The Program Compatibility Assistant Service service depends on the Remote Procedure Call (RPC) service which failed to start because of the following error: The dependency service or group failed to start.
    02/06/2012 11:17:46 AM, Error: Service Control Manager [7001] - The Print Spooler service depends on the Remote Procedure Call (RPC) service which failed to start because of the following error: The dependency service or group failed to start.
    02/06/2012 11:17:46 AM, Error: Service Control Manager [7001] - The Offline Files service depends on the Remote Procedure Call (RPC) service which failed to start because of the following error: The dependency service or group failed to start.
    02/06/2012 11:17:46 AM, Error: Service Control Manager [7001] - The Norton AntiVirus service depends on the Remote Procedure Call (RPC) service which failed to start because of the following error: The dependency service or group failed to start.
    02/06/2012 11:17:46 AM, Error: Service Control Manager [7001] - The Network Location Awareness service depends on the Remote Procedure Call (RPC) service which failed to start because of the following error: The dependency service or group failed to start.
    02/06/2012 11:17:46 AM, Error: Service Control Manager [7001] - The IP Helper service depends on the Network Store Interface Service service which failed to start because of the following error: The service did not respond to the start or control request in a timely fashion.
    02/06/2012 11:17:46 AM, Error: Service Control Manager [7001] - The Group Policy Client service depends on the Remote Procedure Call (RPC) service which failed to start because of the following error: The dependency service or group failed to start.
    02/06/2012 11:17:46 AM, Error: Service Control Manager [7001] - The DNS Client service depends on the Network Store Interface Service service which failed to start because of the following error: The service did not respond to the start or control request in a timely fashion.
    02/06/2012 11:17:46 AM, Error: Service Control Manager [7001] - The DHCP Client service depends on the Network Store Interface Service service which failed to start because of the following error: The service did not respond to the start or control request in a timely fashion.
    02/06/2012 11:17:46 AM, Error: Service Control Manager [7001] - The Cryptographic Services service depends on the Remote Procedure Call (RPC) service which failed to start because of the following error: The dependency service or group failed to start.
    02/06/2012 11:17:46 AM, Error: Service Control Manager [7001] - The COM+ Event System service depends on the Remote Procedure Call (RPC) service which failed to start because of the following error: The dependency service or group failed to start.
    02/06/2012 11:17:46 AM, Error: Service Control Manager [7000] - The Windows Event Log service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
    02/06/2012 11:17:46 AM, Error: Service Control Manager [7000] - The Windows Driver Foundation - User-mode Driver Framework service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
    02/06/2012 11:17:46 AM, Error: Service Control Manager [7000] - The Windows Audio Endpoint Builder service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
    02/06/2012 11:17:46 AM, Error: Service Control Manager [7000] - The Themes service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
    02/06/2012 11:17:46 AM, Error: Service Control Manager [7000] - The TCP/IP NetBIOS Helper service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
    02/06/2012 11:17:46 AM, Error: Service Control Manager [7000] - The Network Store Interface Service service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
    02/06/2012 11:17:46 AM, Error: Service Control Manager [7000] - The Multimedia Class Scheduler service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
    02/06/2012 11:17:46 AM, Error: Service Control Manager [7000] - The Diagnostic Policy Service service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
    02/06/2012 11:17:46 AM, Error: Service Control Manager [7000] - The Desktop Window Manager Session Manager service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
    02/06/2012 11:17:46 AM, Error: Service Control Manager [7000] - The AMD External Events Utility service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
    02/06/2012 11:17:19 AM, Error: Microsoft-Windows-Directory-Services-SAM [12291] - SAM failed to start the TCP/IP or SPX/IPX listening thread
    02/06/2012 11:16:04 AM, Error: Service Control Manager [7022] - The DHCP Client service hung on starting.
    02/06/2012 11:16:04 AM, Error: Service Control Manager [7001] - The WinHTTP Web Proxy Auto-Discovery Service service depends on the DHCP Client service which failed to start because of the following error: After starting, the service hung in a start-pending state.
    02/06/2012 11:16:01 AM, Error: Service Control Manager [7043] - The Group Policy Client service did not shut down properly after receiving a preshutdown control.
    02/06/2012 11:14:40 AM, Error: Service Control Manager [7022] - The TCP/IP NetBIOS Helper service hung on starting.
    02/06/2012 11:14:40 AM, Error: Service Control Manager [7001] - The Task Scheduler service depends on the Windows Event Log service which failed to start because of the following error: After starting, the service hung in a start-pending state.
    02/06/2012 11:13:16 AM, Error: Service Control Manager [7022] - The Windows Audio service hung on starting.
    02/06/2012 11:11:54 AM, Error: Service Control Manager [7022] - The Windows Event Log service hung on starting.
    01/06/2012 2:55:53 PM, Error: Microsoft-Windows-Kernel-General [5] - {Registry Hive Recovered} Registry hive (file): '\??\Volume{3d6529a6-da65-11df-8aea-806e6f6e6963}\System Volume Information\SPP\SppCbsHiveStore\{cd42efe1-f6f1-427c-b004-033192c625a4}{6FD7FADD-8166-4AC3-8629-EF7F5A85E2E1}' was corrupted and it has been recovered. Some data might have been lost.
    01/06/2012 2:54:43 PM, Error: Service Control Manager [7034] - The Volume Shadow Copy service terminated unexpectedly. It has done this 2 time(s).
    01/06/2012 2:54:30 PM, Error: Service Control Manager [7034] - The Volume Shadow Copy service terminated unexpectedly. It has done this 1 time(s).
    01/06/2012 2:19:31 AM, Error: Microsoft-Windows-WER-SystemErrorReporting [1001] - The computer has rebooted from a bugcheck. The bugcheck was: 0x00000024 (0x00000000001904fb, 0xfffff8800337e758, 0xfffff8800337dfb0, 0xfffff880014c88f5). A dump was saved in: C:\Windows\MEMORY.DMP. Report Id: 060112-21637-01.
    01/06/2012 12:51:59 AM, Error: Service Control Manager [7034] - The Superfetch service terminated unexpectedly. It has done this 3 time(s).
    .
    ==== End Of File ===========================

    and the combofix log...


    ComboFix 12-06-02.03 - Jeff 02/06/2012 16:38:30.1.4 - x64
    Microsoft Windows 7 Professional 6.1.7601.1.1252.2.1033.18.8191.6210 [GMT -4:00]
    Running from: c:\users\Jeff\Downloads\ComboFix.exe
    AV: Norton AntiVirus *Disabled/Updated* {63DF5164-9100-186D-2187-8DC619EFD8BF}
    SP: Norton AntiVirus *Enabled/Updated* {D8BEB080-B73A-17E3-1B37-B6B462689202}
    SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
    .
    .
    ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    C:\Install.exe
    c:\programdata\08E3CD68F7.sys
    c:\users\Jeff\Documents\~WRL0004.tmp
    .
    .
    ((((((((((((((((((((((((( Files Created from 2012-05-02 to 2012-06-02 )))))))))))))))))))))))))))))))
    .
    .
    2012-06-02 20:43 . 2012-06-02 20:43 -------- d-----w- c:\users\Default\AppData\Local\temp
    2012-06-01 22:44 . 2012-06-01 22:44 -------- d-----w- c:\users\Jeff\AppData\Roaming\Malwarebytes
    2012-06-01 22:43 . 2012-06-01 22:43 -------- d-----w- c:\programdata\Malwarebytes
    2012-06-01 22:43 . 2012-06-01 22:43 -------- d-----w- c:\program files (x86)\Malwarebytes' Anti-Malware
    2012-06-01 22:43 . 2012-04-04 19:56 24904 ----a-w- c:\windows\system32\drivers\mbam.sys
    2012-06-01 22:20 . 2012-06-01 22:20 -------- d-----w- c:\users\Jeff\AppData\Roaming\SpeedyPC Software
    2012-06-01 22:20 . 2012-06-01 22:20 -------- d-----w- c:\users\Jeff\AppData\Roaming\DriverCure
    2012-06-01 22:20 . 2012-06-01 22:20 -------- d-----w- c:\programdata\SpeedyPC Software
    2012-06-01 22:20 . 2012-06-01 22:20 -------- d-----w- c:\program files (x86)\SpeedyPC Software
    2012-06-01 22:20 . 2012-06-01 22:20 -------- d-----w- c:\program files (x86)\Common Files\SpeedyPC Software
    2012-05-30 22:28 . 2012-05-30 22:32 -------- d-----w- c:\users\Jeff\AppData\Local\NPE
    2012-05-28 17:24 . 2012-05-28 17:25 -------- d-----w- c:\program files (x86)\Puppetshow - Return to Joyville
    2012-05-18 07:27 . 2012-05-23 11:08 -------- d-----w- c:\windows\system32\drivers\NAVx64\1307010.005
    2012-05-15 22:08 . 2012-05-15 22:08 -------- d-----w- c:\program files\Windows Live
    2012-05-15 21:38 . 2012-05-15 22:04 -------- d-----w- c:\users\Jeff\AppData\Local\LogMeIn Rescue Applet
    2012-05-12 02:50 . 2012-03-03 06:35 1544704 ----a-w- c:\windows\system32\DWrite.dll
    2012-05-12 02:50 . 2012-03-03 05:31 1077248 ----a-w- c:\windows\SysWow64\DWrite.dll
    2012-05-12 02:50 . 2012-03-31 06:05 5559664 ----a-w- c:\windows\system32\ntoskrnl.exe
    2012-05-12 02:50 . 2012-03-31 04:39 3968368 ----a-w- c:\windows\SysWow64\ntkrnlpa.exe
    2012-05-12 02:50 . 2012-03-31 04:39 3913072 ----a-w- c:\windows\SysWow64\ntoskrnl.exe
    2012-05-12 02:50 . 2012-03-31 03:10 3146240 ----a-w- c:\windows\system32\win32k.sys
    2012-05-12 02:50 . 2012-03-17 07:58 75120 ----a-w- c:\windows\system32\drivers\partmgr.sys
    2012-05-12 02:49 . 2012-03-30 11:35 1918320 ----a-w- c:\windows\system32\drivers\tcpip.sys
    2012-05-12 02:49 . 2012-03-31 05:42 1732096 ----a-w- c:\program files\Windows Journal\NBDoc.DLL
    2012-05-12 02:49 . 2012-03-31 05:40 1402880 ----a-w- c:\program files\Windows Journal\JNWDRV.dll
    2012-05-12 02:49 . 2012-03-31 05:40 1367552 ----a-w- c:\program files\Common Files\Microsoft Shared\ink\journal.dll
    2012-05-12 02:49 . 2012-03-31 05:40 1393664 ----a-w- c:\program files\Windows Journal\JNTFiltr.dll
    2012-05-12 02:49 . 2012-03-31 04:29 936960 ----a-w- c:\program files (x86)\Common Files\Microsoft Shared\ink\journal.dll
    2012-05-05 00:24 . 2012-05-05 00:24 8744608 ----a-w- c:\windows\SysWow64\FlashPlayerInstaller.exe
    .
    .
    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2012-05-30 21:29 . 2010-10-18 19:47 2828 --sha-w- c:\programdata\KGyGaAvL.sys
    2012-05-15 22:07 . 2010-06-24 15:33 19736 ----a-w- c:\programdata\Microsoft\IdentityCRL\production\ppcrlconfig600.dll
    2012-05-05 00:24 . 2012-04-25 15:35 419488 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe
    2012-05-05 00:24 . 2011-08-25 01:35 70304 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
    2012-04-19 19:06 . 2011-06-17 08:01 175736 ----a-w- c:\windows\system32\drivers\SYMEVENT64x86.SYS
    2011-08-23 22:42 . 2011-09-29 05:24 332144 ----a-w- c:\program files (x86)\Common Files\MediaOrganizer.dll
    2011-08-23 22:35 . 2011-09-29 05:24 33136 ----a-w- c:\program files (x86)\Common Files\FlickrProvider.dll
    2011-08-23 22:35 . 2011-09-29 05:24 130416 ----a-w- c:\program files (x86)\Common Files\PluginCommon.dll
    2011-08-23 22:35 . 2011-09-29 05:24 402800 ----a-w- c:\program files (x86)\Common Files\facebook.dll
    2011-08-23 22:34 . 2011-09-29 05:24 465264 ----a-w- c:\program files (x86)\Common Files\AppFramework.dll
    .
    .
    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4
    .
    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "Corel Photo Downloader"="c:\program files (x86)\Common Files\Corel\Corel PhotoDownloader\Corel Photo Downloader.exe" [2011-09-07 522752]
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
    "SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2010-02-18 248040]
    "StartCCC"="c:\program files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2012-02-15 636032]
    "QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" [2008-09-06 413696]
    "NUSB3MON"="c:\program files (x86)\NEC Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe" [2010-03-30 113296]
    "ATICustomerCare"="c:\program files (x86)\ATI\ATICustomerCare\ATICustomerCare.exe" [2010-03-04 311296]
    "Adobe Reader Speed Launcher"="c:\program files (x86)\Adobe\Reader 10.0\Reader\Reader_sl.exe" [2010-11-10 35736]
    "Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-11-10 932288]
    .
    c:\users\Jeff\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
    OpenOffice.org 3.2.lnk - c:\program files (x86)\OpenOffice.org 3\program\quickstart.exe [2010-5-20 1195008]
    .
    c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
    AML Device Install.lnk - c:\program files (x86)\AMD AVT\bin\kdbsync.exe [2012-1-31 10752]
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
    "ConsentPromptBehaviorAdmin"= 5 (0x5)
    "ConsentPromptBehaviorUser"= 3 (0x3)
    "EnableUIADesktopToggle"= 0 (0x0)
    .
    [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
    Security Packages REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp
    .
    R2 AODDriver4.1;AODDriver4.1;c:\program files\ATI Technologies\ATI.ACE\Fuel\amd64\AODDriver2.sys [2012-01-04 55936]
    R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
    R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
    R2 gupdate;Google Update Service (gupdate);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-10-18 135664]
    R3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-05-05 257696]
    R3 EraserUtilDrv11122;EraserUtilDrv11122;c:\program files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilDrv11122.sys [x]
    R3 gupdatem;Google Update Service (gupdatem);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-10-18 135664]
    R3 MozillaMaintenance;Mozilla Maintenance Service;c:\program files (x86)\Mozilla Maintenance Service\maintenanceservice.exe [2012-04-25 129976]
    R3 ose64;Office 64 Source Engine;c:\program files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2010-01-10 174440]
    R3 osppsvc;Office Software Protection Platform;c:\program files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-01-10 4925184]
    R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [x]
    R3 WatAdminSvc;WatAdminSvc;c:\windows\system32\Wat\WatAdminSvc.exe [x]
    S0 SymDS;Symantec Data Store;c:\windows\system32\drivers\NAVx64\1307010.005\SYMDS64.SYS [x]
    S0 SymEFA;Symantec Extended File Attributes;c:\windows\system32\drivers\NAVx64\1307010.005\SYMEFA64.SYS [x]
    S1 BHDrvx64;BHDrvx64;c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NAV_19.6.2.10\Definitions\BASHDefs\20120517.001\BHDrvx64.sys [2012-04-13 1160824]
    S1 ccSet_NAV;Norton AntiVirus Settings Manager;c:\windows\system32\drivers\NAVx64\1307010.005\ccSetx64.sys [x]
    S1 IDSVia64;IDSVia64;c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NAV_19.6.2.10\Definitions\IPSDefs\20120601.001\IDSvia64.sys [2012-04-28 488568]
    S1 SymIRON;Symantec Iron Driver;c:\windows\system32\drivers\NAVx64\1307010.005\Ironx64.SYS [x]
    S1 SymNetS;Symantec Network Security WFP Driver;c:\windows\System32\Drivers\NAVx64\1307010.005\SYMNETS.SYS [x]
    S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [x]
    S2 AMD FUEL Service;AMD FUEL Service;c:\program files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [2012-02-15 361984]
    S2 AODDriver4.01;AODDriver4.01;c:\program files\ATI Technologies\ATI.ACE\Fuel\amd64\AODDriver2.sys [2012-01-04 55936]
    S2 NAV;Norton AntiVirus;c:\program files (x86)\Norton AntiVirus\Engine\19.7.1.5\ccSvcHst.exe [2012-03-27 138232]
    S3 amdiox64;AMD IO Driver;c:\windows\system32\DRIVERS\amdiox64.sys [x]
    S3 amdkmdag;amdkmdag;c:\windows\system32\DRIVERS\atikmdag.sys [x]
    S3 amdkmdap;amdkmdap;c:\windows\system32\DRIVERS\atikmpag.sys [x]
    S3 AtiHDAudioService;AMD Function Driver for HD Audio Service;c:\windows\system32\drivers\AtihdW76.sys [x]
    S3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [2012-05-31 138912]
    S3 nusb3hub;NEC Electronics USB 3.0 Hub Driver;c:\windows\system32\DRIVERS\nusb3hub.sys [x]
    S3 nusb3xhc;NEC Electronics USB 3.0 Host Controller Driver;c:\windows\system32\DRIVERS\nusb3xhc.sys [x]
    S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [x]
    .
    .
    --- Other Services/Drivers In Memory ---
    .
    *NewlyCreated* - WS2IFSL
    .
    Contents of the 'Scheduled Tasks' folder
    .
    2012-06-02 c:\windows\Tasks\Adobe Flash Player Updater.job
    - c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-25 00:24]
    .
    2012-06-02 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
    - c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-10-18 19:28]
    .
    2012-06-02 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
    - c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-10-18 19:28]
    .
    2012-06-02 c:\windows\Tasks\SpeedyPC Pro.job
    - c:\program files (x86)\SpeedyPC Software\SpeedyPC\SpeedyPC.exe [2011-10-09 01:19]
    .
    2012-06-01 c:\windows\Tasks\SpeedyPC Registration3.job
    - c:\windows\system32\rundll32.exe [2009-07-13 01:14]
    .
    2012-06-01 c:\windows\Tasks\SpeedyPC Update Version3.job
    - c:\program files (x86)\Common Files\SpeedyPC Software\UUS3\SpeedyPC_Update3.exe [2011-10-06 16:18]
    .
    .
    --------- x86-64 -----------
    .
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2010-05-20 10151968]
    "BCSSync"="c:\program files\Microsoft Office\Office14\BCSSync.exe" [2010-03-13 112512]
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
    "LoadAppInit_DLLs"=0x0
    .
    ------- Supplementary Scan -------
    .
    uLocal Page = c:\windows\system32\blank.htm
    uStart Page = hxxp://start.facemoods.com/?a=w7th1
    mLocal Page = c:\windows\SysWOW64\blank.htm
    TCP: DhcpNameServer = 192.168.2.1
    FF - ProfilePath - c:\users\Jeff\AppData\Roaming\Mozilla\Firefox\Profiles\f7m7sz3w.default\
    FF - prefs.js: browser.search.defaulturl - hxxp://www.bing.com/search?FORM=WLETDF&PC=WLEM&q=
    FF - prefs.js: browser.search.selectedEngine - Google
    FF - prefs.js: browser.startup.homepage - about:home
    FF - prefs.js: keyword.URL - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT3106777&SearchSource=2&q=
    .
    - - - - ORPHANS REMOVED - - - -
    .
    URLSearchHooks-{50fafaf0-70a9-419d-a109-fa4b4ffd4e37} - (no file)
    Wow6432Node-HKCU-Run-RESTART_STICKY_NOTES - c:\windows\System32\StikyNot.exe
    Wow6432Node-HKCU-Run-EA Core - c:\program files (x86)\Electronic Arts\EADM\Core.exe
    Wow6432Node-HKLM-Run-Corel File Shell Monitor - c:\program files (x86)\Corel\Corel PaintShop Photo Pro\X3\PSPClassic\CorelIOMonitor.exe
    WebBrowser-{50FAFAF0-70A9-419D-A109-FA4B4FFD4E37} - (no file)
    AddRemove-_{A3CF662F-5DEF-46C0-BAF5-0E00E1B4C5B0} - c:\program files (x86)\Corel\Corel Painter Essentials 4\MSILauncher {A3CF662F-5DEF-46C0-BAF5-0E00E1B4C5B0}
    .
    .
    .
    [HKEY_LOCAL_MACHINE\system\ControlSet001\services\NAV]
    "ImagePath"="\"c:\program files (x86)\Norton AntiVirus\Engine\19.7.1.5\ccSvcHst.exe\" /s \"NAV\" /m \"c:\program files (x86)\Norton AntiVirus\Engine\19.7.1.5\diMaster.dll\" /prefetch:1"
    .
    --------------------- LOCKED REGISTRY KEYS ---------------------
    .
    [HKEY_USERS\S-1-5-21-4120525190-1002349284-178691253-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.eml\UserChoice]
    @Denied: (2) (LocalSystem)
    "Progid"="WindowsLiveMail.Email.1"
    .
    [HKEY_USERS\S-1-5-21-4120525190-1002349284-178691253-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.vcf\UserChoice]
    @Denied: (2) (LocalSystem)
    "Progid"="WindowsLiveMail.VCard.1"
    .
    [HKEY_USERS\S-1-5-21-4120525190-1002349284-178691253-1000\Software\SecuROM\License information*]
    @Allowed: (Read) (RestrictedCode)
    .
    [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}]
    @Denied: (A 2) (Everyone)
    @="FlashBroker"
    "LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil10c.exe,-101"
    .
    [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\Elevation]
    "Enabled"=dword:00000001
    .
    [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\LocalServer32]
    @="c:\\Windows\\SysWow64\\Macromed\\Flash\\FlashUtil10c.exe"
    .
    [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\TypeLib]
    @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
    .
    [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
    @Denied: (A 2) (Everyone)
    @="Shockwave Flash Object"
    .
    [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
    @="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10c.ocx"
    "ThreadingModel"="Apartment"
    .
    [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
    @="0"
    .
    [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
    @="ShockwaveFlash.ShockwaveFlash.10"
    .
    [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
    @="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10c.ocx, 1"
    .
    [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
    @="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
    .
    [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
    @="1.0"
    .
    [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
    @="ShockwaveFlash.ShockwaveFlash"
    .
    [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
    @Denied: (A 2) (Everyone)
    @="Macromedia Flash Factory Object"
    .
    [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
    @="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10c.ocx"
    "ThreadingModel"="Apartment"
    .
    [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
    @="FlashFactory.FlashFactory.1"
    .
    [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
    @="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10c.ocx, 1"
    .
    [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
    @="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
    .
    [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
    @="1.0"
    .
    [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
    @="FlashFactory.FlashFactory"
    .
    [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}]
    @Denied: (A 2) (Everyone)
    @="IFlashBroker3"
    .
    [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}\ProxyStubClsid32]
    @="{00020424-0000-0000-C000-000000000046}"
    .
    [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}\TypeLib]
    @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
    "Version"="1.0"
    .
    [HKEY_LOCAL_MACHINE\software\Wow6432Node\Nico Mak Computing\WinZip]
    "SymbolicLinkValue"=hex(6):5c,00,52,00,65,00,67,00,69,00,73,00,74,00,72,00,79,
    00,5c,00,4d,00,41,00,43,00,48,00,49,00,4e,00,45,00,5c,00,53,00,6f,00,66,00,\
    .
    [HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]
    @Denied: (Full) (Everyone)
    .
    ------------------------ Other Running Processes ------------------------
    .
    c:\program files (x86)\Common Files\Protexis\License Service\PsiService_2.exe
    .
    **************************************************************************
    .
    Completion time: 2012-06-02 16:50:19 - machine was rebooted
    ComboFix-quarantined-files.txt 2012-06-02 20:50
    .
    Pre-Run: 864,401,981,440 bytes free
    Post-Run: 866,343,198,720 bytes free
    .
    - - End Of File - - 1292A3536402D817AA5486A81F390B51

    thanks so much
  4. Bobbye

    Bobbye Helper on the Fringe Posts: 16,392   +35

    Okay- allow me to say this from experience: the majority of computer users don't know how to troubleshoot a problem. The "assume" if things don't work right, that there must be malware messing up the system. I usually do find some malware-even if it's toolbars the user would be better off without. But I also usually find settings that need to be fixed> maybe changed by malware- or maybe just not set correctly.

    So what you have to help with is give me as much information as you can about something that happens:

    I see a lot of errors from today. But this is what started yesterday:
    =======================================
    We'll have to wait and see how much damage this caused.
    ======================================

    At some point, you got a popup inviting you to get SpeedyPC Pro. You were probably told it would fix everything, that you needed to get the program to make the system run right. Unfortunately, you fell for this and installed this scam on the system. Here's what you got:
    ===================================================================
    I am finishing up writing some script for entries to be removed using Combofix. While I am doing that:

    1. Do NOT pay for SpeedUpMyPC
    2. If payment is already in the works, stop the payment.
    3. Uninstall SpeedUpMyPC. After it is uninstalled, right click on Start> Explore> Local Drive (C)> Programs. find the program folder(s) for SpeedUpMyPC and do a right click> Delete..
    4. Reboot the computer.

    Please follow the same uninstall/delete program folder for RelevantKnowledge.

    If you get any error messages when you try to remove this program:

    Boot into Safe Mode with Networking
    • Restart your computer and start pressing the F8 key on your keyboard.
    • Select the Safe Mode with Networking option when the Windows Advanced Options menu appears, and then press ENTER.
    Then do the uninstall and folder removal.

    I will include the processes I see running, so as soon as my script is up, go ahead with it. Nothing else
  5. Bobbye

    Bobbye Helper on the Fringe Posts: 16,392   +35

    Please run this Custom CFScript:

    • [1]. Close any open browsers.
      [2]. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
      [3]. Open notepad> click on Format> Uncheck 'Word Wrap> and copy/paste the text in the code below into it:
    Code:
    KillAll::
    File::
    
    Folder::
    c:\users\Jeff\AppData\Roaming\SpeedyPC Software
    c:\users\Jeff\AppData\Roaming\DriverCure
    c:\programdata\SpeedyPC Software
    c:\program files (x86)\SpeedyPC Software
    c:\program files (x86)\Common Files\SpeedyPC Software
    c:\users\Jeff\AppData\Local\LogMeIn Rescue Applet
    DDS::
    uStart Page = hxxp://start.facemoods.com/?a=w7th1
    mSearchAssistant = hxxp://start.facemoods.com/?a=w7th1&s={searchTerms}&f=4
    uRun: [RESTART_STICKY_NOTES] C:\Windows\System32\StikyNot.exe
    uRun: [EA Core] "C:\Program Files (x86)\Electronic Arts\EADM\Core.exe" -silent
    uRun: [Corel Photo Downloader] "c:\Program Files (x86)\Common Files\Corel\Corel PhotoDownloader\Corel Photo Downloader.exe" -startup
    DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab
    DPF: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab
    DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab
    Extra::
    File::
    Firefox::
    Firefox-: - Profile - c:\users\Jeff\AppData\Roaming\Mozilla\Firefox\Profiles\f7m7sz3w.default\
    Firefox-: - prefs.js - Search.DefaultURL
    Firefox-: - prefs.js- Startup.Homepage 
    Registry::
    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "Corel Photo Downloader"=-
    RegLock::
    [HKEY_LOCAL_MACHINE\software\Wow6432Node\Nico Mak Computing\WinZip]
    
    Clearjavacache::
    
    
    Save this as CFScript.txt, in the same location as ComboFix.exe
    [​IMG]

    Referring to the picture above, drag CFScript into ComboFix.exe

    When finished, it will produce a log for you at C:\ComboFix.txt . Please paste into to your next reply.
    ====================
    Firefox Keyword Reset:

    • [1]. Open FireFox and instead of a url, type about:config in the Address Bar.
      [2]. Firefox will give you a warning, but go in anyway.
      [3]. Locate the keyword.url line. It should look like the image below.
      [​IMG]
      [4]. Right click on keyword.url, then select Reset
    =======================
    The following Scheduled Tasks should all be removed:

    Opening scheduled tasks to modify or delete them:
    Access Scheduled Tasks with Click on Start> All Programs> Accessories> System Tools> Scheduled Tasks.
    To delete a task> right-click on each task below> click Delete.
    Reboot the computer and leave the new log from Combofix.


    [*] To prevent task from running until you run again>
    [o] right-click the task> Properties> On the General tab>
    [o] clear the Enabled check box> Select the check box again when you are ready to run it again. [/list]
    ======================================
  6. Osbert

    Osbert Newcomer, in training Topic Starter

    Edit: Quoted directions deleted by Bobbye.

    Thanks very much. The SpeedyPC was actually downloaded from this site (my computer friend told me that there was a 5 step diagnostic and I thought that that was it). Once it started asking for money I realized I'd hit the wrong thing and backtracked to the forums - no money was exchanged. I got everything on your list (I hope) tho RelevantKnowledge isn't in my files and the SpeedyPC registration, updates etc. apparently disappeared when I uninstalled it. Here's the results of the combofix -

    ComboFix 12-06-02.03 - Jeff 02/06/2012 21:38:44.2.4 - x64
    Microsoft Windows 7 Professional 6.1.7601.1.1252.2.1033.18.8191.6575 [GMT -4:00]
    Running from: c:\users\Jeff\Downloads\ComboFix.exe
    Command switches used :: c:\users\Jeff\Desktop\CFScript.txt
    AV: Norton AntiVirus *Disabled/Updated* {63DF5164-9100-186D-2187-8DC619EFD8BF}
    SP: Norton AntiVirus *Disabled/Updated* {D8BEB080-B73A-17E3-1B37-B6B462689202}
    SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
    .
    /wow section - STAGE 3
    .
    .
    ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    c:\program files (x86)\Common Files\Corel\Corel PhotoDownloader\Corel Photo Downloader.exe
    c:\users\Jeff\AppData\Local\LogMeIn Rescue Applet
    c:\users\Jeff\AppData\Roaming\DriverCure
    c:\users\Jeff\AppData\Roaming\DriverCure\LogFile.txt
    c:\users\Jeff\AppData\Roaming\SpeedyPC Software
    .
    .
    ((((((((((((((((((((((((( Files Created from 2012-05-03 to 2012-06-03 )))))))))))))))))))))))))))))))
    .
    .
    2012-06-03 01:43 . 2012-06-03 01:43 -------- d-----w- c:\users\Default\AppData\Local\temp
    2012-06-02 21:07 . 2012-06-02 21:07 -------- d-----w- c:\program files (x86)\ESET
    2012-06-01 22:44 . 2012-06-01 22:44 -------- d-----w- c:\users\Jeff\AppData\Roaming\Malwarebytes
    2012-06-01 22:43 . 2012-06-01 22:43 -------- d-----w- c:\programdata\Malwarebytes
    2012-06-01 22:43 . 2012-06-01 22:43 -------- d-----w- c:\program files (x86)\Malwarebytes' Anti-Malware
    2012-06-01 22:43 . 2012-04-04 19:56 24904 ----a-w- c:\windows\system32\drivers\mbam.sys
    2012-05-30 22:28 . 2012-05-30 22:32 -------- d-----w- c:\users\Jeff\AppData\Local\NPE
    2012-05-28 17:24 . 2012-05-28 17:25 -------- d-----w- c:\program files (x86)\Puppetshow - Return to Joyville
    2012-05-18 07:27 . 2012-05-23 11:08 -------- d-----w- c:\windows\system32\drivers\NAVx64\1307010.005
    2012-05-15 22:08 . 2012-05-15 22:08 -------- d-----w- c:\program files\Windows Live
    2012-05-12 02:50 . 2012-03-03 06:35 1544704 ----a-w- c:\windows\system32\DWrite.dll
    2012-05-12 02:50 . 2012-03-03 05:31 1077248 ----a-w- c:\windows\SysWow64\DWrite.dll
    2012-05-12 02:50 . 2012-03-31 06:05 5559664 ----a-w- c:\windows\system32\ntoskrnl.exe
    2012-05-12 02:50 . 2012-03-31 04:39 3968368 ----a-w- c:\windows\SysWow64\ntkrnlpa.exe
    2012-05-12 02:50 . 2012-03-31 04:39 3913072 ----a-w- c:\windows\SysWow64\ntoskrnl.exe
    2012-05-12 02:50 . 2012-03-31 03:10 3146240 ----a-w- c:\windows\system32\win32k.sys
    2012-05-12 02:50 . 2012-03-17 07:58 75120 ----a-w- c:\windows\system32\drivers\partmgr.sys
    2012-05-12 02:49 . 2012-03-30 11:35 1918320 ----a-w- c:\windows\system32\drivers\tcpip.sys
    2012-05-12 02:49 . 2012-03-31 05:42 1732096 ----a-w- c:\program files\Windows Journal\NBDoc.DLL
    2012-05-12 02:49 . 2012-03-31 05:40 1402880 ----a-w- c:\program files\Windows Journal\JNWDRV.dll
    2012-05-12 02:49 . 2012-03-31 05:40 1367552 ----a-w- c:\program files\Common Files\Microsoft Shared\ink\journal.dll
    2012-05-12 02:49 . 2012-03-31 05:40 1393664 ----a-w- c:\program files\Windows Journal\JNTFiltr.dll
    2012-05-12 02:49 . 2012-03-31 04:29 936960 ----a-w- c:\program files (x86)\Common Files\Microsoft Shared\ink\journal.dll
    2012-05-05 00:24 . 2012-05-05 00:24 8744608 ----a-w- c:\windows\SysWow64\FlashPlayerInstaller.exe
    .
    .
    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2012-05-30 21:29 . 2010-10-18 19:47 2828 --sha-w- c:\programdata\KGyGaAvL.sys
    2012-05-15 22:07 . 2010-06-24 15:33 19736 ----a-w- c:\programdata\Microsoft\IdentityCRL\production\ppcrlconfig600.dll
    2012-05-05 00:24 . 2012-04-25 15:35 419488 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe
    2012-05-05 00:24 . 2011-08-25 01:35 70304 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
    2012-04-19 19:06 . 2011-06-17 08:01 175736 ----a-w- c:\windows\system32\drivers\SYMEVENT64x86.SYS
    2011-08-23 22:42 . 2011-09-29 05:24 332144 ----a-w- c:\program files (x86)\Common Files\MediaOrganizer.dll
    2011-08-23 22:35 . 2011-09-29 05:24 33136 ----a-w- c:\program files (x86)\Common Files\FlickrProvider.dll
    2011-08-23 22:35 . 2011-09-29 05:24 130416 ----a-w- c:\program files (x86)\Common Files\PluginCommon.dll
    2011-08-23 22:35 . 2011-09-29 05:24 402800 ----a-w- c:\program files (x86)\Common Files\facebook.dll
    2011-08-23 22:34 . 2011-09-29 05:24 465264 ----a-w- c:\program files (x86)\Common Files\AppFramework.dll
    .
    .
    ((((((((((((((((((((((((((((( SnapShot@2012-06-02_20.46.32 )))))))))))))))))))))))))))))))))))))))))
    .
    + 2010-10-18 06:09 . 2012-06-02 21:03 30124 c:\windows\system32\wdi\ShutdownPerformanceDiagnostics_SystemData.bin
    + 2009-07-14 05:10 . 2012-06-03 01:17 33490 c:\windows\system32\wdi\BootPerformanceDiagnostics_SystemData.bin
    + 2010-10-18 06:09 . 2012-06-03 01:17 15660 c:\windows\system32\wdi\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-4120525190-1002349284-178691253-1000_UserData.bin
    + 2011-08-25 09:38 . 2012-06-03 01:02 67584 c:\windows\system32\LogFiles\Srt\bootstat.dat
    - 2011-08-25 09:38 . 2012-06-01 19:05 67584 c:\windows\system32\LogFiles\Srt\bootstat.dat
    - 2010-10-18 03:14 . 2012-06-02 20:45 16384 c:\windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
    + 2010-10-18 03:14 . 2012-06-03 01:44 16384 c:\windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
    - 2010-10-18 03:14 . 2012-06-02 20:45 32768 c:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
    + 2010-10-18 03:14 . 2012-06-03 01:44 32768 c:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
    - 2009-07-14 04:54 . 2012-06-02 20:45 16384 c:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
    + 2009-07-14 04:54 . 2012-06-03 01:44 16384 c:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
    + 2010-10-18 06:20 . 2012-06-03 01:01 16384 c:\windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
    - 2010-10-18 06:20 . 2012-06-02 19:11 16384 c:\windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
    + 2010-10-18 06:20 . 2012-06-03 01:01 16384 c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
    - 2010-10-18 06:20 . 2012-06-02 19:11 16384 c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
    + 2010-11-07 23:27 . 2012-06-02 21:00 3630 c:\windows\system32\wdi\ERCQueuedResolutions.dat
    - 2012-06-02 20:45 . 2012-06-02 20:45 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
    + 2012-06-03 01:44 . 2012-06-03 01:44 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
    + 2012-06-03 01:44 . 2012-06-03 01:44 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
    - 2012-06-02 20:45 . 2012-06-02 20:45 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
    - 2009-07-14 05:01 . 2012-06-02 20:44 301904 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-System.dat
    + 2009-07-14 05:01 . 2012-06-03 01:43 301904 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-System.dat
    + 2011-03-09 12:16 . 2012-06-03 01:43 1229088 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache3.0.0.0.dat
    - 2011-03-09 12:16 . 2012-06-01 22:50 1229088 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache3.0.0.0.dat
    + 2009-07-14 02:34 . 2012-06-03 05:14 11010048 c:\windows\system32\SMI\Store\Machine\schema.dat
    - 2009-07-14 02:34 . 2012-05-12 07:26 11010048 c:\windows\system32\SMI\Store\Machine\schema.dat
    + 2010-10-22 22:30 . 2012-06-03 01:43 57464864 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-S-1-5-21-4120525190-1002349284-178691253-1000-8192.dat
    .
    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
    "SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2010-02-18 248040]
    "StartCCC"="c:\program files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2012-02-15 636032]
    "QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" [2008-09-06 413696]
    "NUSB3MON"="c:\program files (x86)\NEC Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe" [2010-03-30 113296]
    "ATICustomerCare"="c:\program files (x86)\ATI\ATICustomerCare\ATICustomerCare.exe" [2010-03-04 311296]
    "Adobe Reader Speed Launcher"="c:\program files (x86)\Adobe\Reader 10.0\Reader\Reader_sl.exe" [2010-11-10 35736]
    "Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-11-10 932288]
    .
    c:\users\Jeff\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
    OpenOffice.org 3.2.lnk - c:\program files (x86)\OpenOffice.org 3\program\quickstart.exe [2010-5-20 1195008]
    .
    c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
    AML Device Install.lnk - c:\program files (x86)\AMD AVT\bin\kdbsync.exe [2012-1-31 10752]
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
    "ConsentPromptBehaviorAdmin"= 5 (0x5)
    "ConsentPromptBehaviorUser"= 3 (0x3)
    "EnableUIADesktopToggle"= 0 (0x0)
    .
    [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
    Security Packages REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp
    .
    R2 AODDriver4.1;AODDriver4.1;c:\program files\ATI Technologies\ATI.ACE\Fuel\amd64\AODDriver2.sys [2012-01-04 55936]
    R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
    R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
    R2 gupdate;Google Update Service (gupdate);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-10-18 135664]
    R3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-05-05 257696]
    R3 EraserUtilDrv11122;EraserUtilDrv11122;c:\program files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilDrv11122.sys [x]
    R3 gupdatem;Google Update Service (gupdatem);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-10-18 135664]
    R3 MozillaMaintenance;Mozilla Maintenance Service;c:\program files (x86)\Mozilla Maintenance Service\maintenanceservice.exe [2012-04-25 129976]
    R3 ose64;Office 64 Source Engine;c:\program files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2010-01-10 174440]
    R3 osppsvc;Office Software Protection Platform;c:\program files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-01-10 4925184]
    R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [x]
    R3 WatAdminSvc;WatAdminSvc;c:\windows\system32\Wat\WatAdminSvc.exe [x]
    S0 SymDS;Symantec Data Store;c:\windows\system32\drivers\NAVx64\1307010.005\SYMDS64.SYS [x]
    S0 SymEFA;Symantec Extended File Attributes;c:\windows\system32\drivers\NAVx64\1307010.005\SYMEFA64.SYS [x]
    S1 BHDrvx64;BHDrvx64;c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NAV_19.6.2.10\Definitions\BASHDefs\20120517.001\BHDrvx64.sys [2012-04-13 1160824]
    S1 ccSet_NAV;Norton AntiVirus Settings Manager;c:\windows\system32\drivers\NAVx64\1307010.005\ccSetx64.sys [x]
    S1 IDSVia64;IDSVia64;c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NAV_19.6.2.10\Definitions\IPSDefs\20120601.001\IDSvia64.sys [2012-04-28 488568]
    S1 SymIRON;Symantec Iron Driver;c:\windows\system32\drivers\NAVx64\1307010.005\Ironx64.SYS [x]
    S1 SymNetS;Symantec Network Security WFP Driver;c:\windows\System32\Drivers\NAVx64\1307010.005\SYMNETS.SYS [x]
    S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [x]
    S2 AMD FUEL Service;AMD FUEL Service;c:\program files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [2012-02-15 361984]
    S2 AODDriver4.01;AODDriver4.01;c:\program files\ATI Technologies\ATI.ACE\Fuel\amd64\AODDriver2.sys [2012-01-04 55936]
    S2 NAV;Norton AntiVirus;c:\program files (x86)\Norton AntiVirus\Engine\19.7.1.5\ccSvcHst.exe [2012-03-27 138232]
    S3 amdiox64;AMD IO Driver;c:\windows\system32\DRIVERS\amdiox64.sys [x]
    S3 amdkmdag;amdkmdag;c:\windows\system32\DRIVERS\atikmdag.sys [x]
    S3 amdkmdap;amdkmdap;c:\windows\system32\DRIVERS\atikmpag.sys [x]
    S3 AtiHDAudioService;AMD Function Driver for HD Audio Service;c:\windows\system32\drivers\AtihdW76.sys [x]
    S3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [2012-05-31 138912]
    S3 nusb3hub;NEC Electronics USB 3.0 Hub Driver;c:\windows\system32\DRIVERS\nusb3hub.sys [x]
    S3 nusb3xhc;NEC Electronics USB 3.0 Host Controller Driver;c:\windows\system32\DRIVERS\nusb3xhc.sys [x]
    S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [x]
    .
    .
    Contents of the 'Scheduled Tasks' folder
    .
    2012-06-03 c:\windows\Tasks\Adobe Flash Player Updater.job
    - c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-25 00:24]
    .
    2012-06-03 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
    - c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-10-18 19:28]
    .
    2012-06-03 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
    - c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-10-18 19:28]
    .
    .
    --------- x86-64 -----------
    .
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2010-05-20 10151968]
    "BCSSync"="c:\program files\Microsoft Office\Office14\BCSSync.exe" [2010-03-13 112512]
    .
    ------- Supplementary Scan -------
    .
    uLocal Page = c:\windows\system32\blank.htm
    mLocal Page = c:\windows\SysWOW64\blank.htm
    TCP: DhcpNameServer = 192.168.2.1
    FF - ProfilePath - c:\users\Jeff\AppData\Roaming\Mozilla\Firefox\Profiles\f7m7sz3w.default\
    FF - prefs.js: browser.search.defaulturl - hxxp://www.bing.com/search?FORM=WLETDF&PC=WLEM&q=
    FF - prefs.js: browser.search.selectedEngine - Google
    FF - prefs.js: browser.startup.homepage - about:home
    FF - prefs.js: keyword.URL - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT3106777&SearchSource=2&q=
    .
    .
    [HKEY_LOCAL_MACHINE\system\ControlSet001\services\NAV]
    "ImagePath"="\"c:\program files (x86)\Norton AntiVirus\Engine\19.7.1.5\ccSvcHst.exe\" /s \"NAV\" /m \"c:\program files (x86)\Norton AntiVirus\Engine\19.7.1.5\diMaster.dll\" /prefetch:1"
    .
    --------------------- LOCKED REGISTRY KEYS ---------------------
    .
    [HKEY_USERS\S-1-5-21-4120525190-1002349284-178691253-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.eml\UserChoice]
    @Denied: (2) (LocalSystem)
    "Progid"="WindowsLiveMail.Email.1"
    .
    [HKEY_USERS\S-1-5-21-4120525190-1002349284-178691253-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.vcf\UserChoice]
    @Denied: (2) (LocalSystem)
    "Progid"="WindowsLiveMail.VCard.1"
    .
    [HKEY_USERS\S-1-5-21-4120525190-1002349284-178691253-1000\Software\SecuROM\License information*]
    @Allowed: (Read) (RestrictedCode)
    .
    [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}]
    @Denied: (A 2) (Everyone)
    @="FlashBroker"
    "LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil10c.exe,-101"
    .
    [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\Elevation]
    "Enabled"=dword:00000001
    .
    [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\LocalServer32]
    @="c:\\Windows\\SysWow64\\Macromed\\Flash\\FlashUtil10c.exe"
    .
    [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\TypeLib]
    @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
    .
    [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
    @Denied: (A 2) (Everyone)
    @="Shockwave Flash Object"
    .
    [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
    @="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10c.ocx"
    "ThreadingModel"="Apartment"
    .
    [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
    @="0"
    .
    [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
    @="ShockwaveFlash.ShockwaveFlash.10"
    .
    [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
    @="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10c.ocx, 1"
    .
    [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
    @="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
    .
    [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
    @="1.0"
    .
    [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
    @="ShockwaveFlash.ShockwaveFlash"
    .
    [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
    @Denied: (A 2) (Everyone)
    @="Macromedia Flash Factory Object"
    .
    [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
    @="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10c.ocx"
    "ThreadingModel"="Apartment"
    .
    [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
    @="FlashFactory.FlashFactory.1"
    .
    [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
    @="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10c.ocx, 1"
    .
    [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
    @="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
    .
    [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
    @="1.0"
    .
    [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
    @="FlashFactory.FlashFactory"
    .
    [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}]
    @Denied: (A 2) (Everyone)
    @="IFlashBroker3"
    .
    [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}\ProxyStubClsid32]
    @="{00020424-0000-0000-C000-000000000046}"
    .
    [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}\TypeLib]
    @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
    "Version"="1.0"
    .
    [HKEY_LOCAL_MACHINE\software\Wow6432Node\Nico Mak Computing\WinZip]
    "SymbolicLinkValue"=hex(6):5c,00,52,00,65,00,67,00,69,00,73,00,74,00,72,00,79,
    00,5c,00,4d,00,41,00,43,00,48,00,49,00,4e,00,45,00,5c,00,53,00,6f,00,66,00,\
    .
    [HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]
    @Denied: (Full) (Everyone)
    .
    ------------------------ Other Running Processes ------------------------
    .
    c:\program files (x86)\Common Files\Protexis\License Service\PsiService_2.exe
    .
    **************************************************************************
    .
    Completion time: 2012-06-02 21:48:06 - machine was rebooted
    ComboFix-quarantined-files.txt 2012-06-03 01:48
    ComboFix2.txt 2012-06-02 20:50
    .
    Pre-Run: 866,354,212,864 bytes free
    Post-Run: 866,269,777,920 bytes free
    .
    - - End Of File - - 52695DD9C7C389E16D8DED35CED3F85B


    Thanks again!
  7. Bobbye

    Bobbye Helper on the Fringe Posts: 16,392   +35

    Install Date: 17/10/2010 > 1 year, 8 months- 1 restore point set 6 months ago!
    ==== System Restore Points ===================
    .
    RP194: 01/06/2012 2:54:31 PM - Scheduled Checkpoint

    -----------------------------
    Some day, a System Restore point may save your system! A SRP may be the only way you can get into the system- A SRP may undo the damage done by a bad download or update. Be good to yourself and set you own restore points:

    1. Before you uninstall a program
    2. Before you install a new program.
    3. Before you do ANY updates!
    4. Once in a while, just because
    ---------------------------------------
    Create a Restore Point> Win 7

    It is recommended that you create a restore point before installing new software or making any major changes to your computer.
    • Right click on Computer> Properties> Choose System Protectiom
    • Click on Create
    • Type in a descriptive name for the Restore Point (like 'before ><name> program update)
    • Click on Create
    • You will see this when finished:
    • [​IMG]
    • Click on Close
    Now if whatever you did turns out not to have gone well, you can go back into System Protection and choose this restore point to put the system back as it was.
    ==================================
    If the script worked, you don't have to make any changes, but FYI- because it's a better way:

    You can choose a location on your computer where downloads should be saved by default. This means that whenever you using Save As in the File> Save As or when you choose to Save a download, it will automatically default to the location you have set/

    You may find that setting the Default Download Location to your Desktop the most convenient. If you want to move the file later, you can. If you want to delete the file, it will be most handy on the Desktop. For the cleaning and scanning programs we use, almost all are directed to be saved to the desktop.

    Set Default Download Location in Browsers:

    Chrome:
    Open Chrome> Customize and control> Options> Under the Hood> Downloads> Change> Select Desktop> OK
    (Don't check 'ask where to save each time....')

    Firefox:
    Open Firefox> Tools> Options> Main/General> Downloads Section> Save Files to> Browse> Navigate to and select Desktop> OK

    IE9
    Open IE> Gear icon> View Downloads> Options> Browse to and select Desktop> OK

    There may be a slight difference in the path dependent on the browser version. There may also be a box to check to "Ask me the location each time". I do not asvise checking that box.
    =======================================================
    Please be advised that you are no longer allowed to call yourself this. You now know at least 2 things more than you knew before we started![​IMG]
  8. Bobbye

    Bobbye Helper on the Fringe Posts: 16,392   +35

    Combofix looks good. There are 3 settings in Firefox that I tried to change and will try again. There is also a WinZup entry in the Registry I wanted open, but it's still locked. I don't want you to do anything with this file other than identifying it if you can:

    Are you still having the crashes? Do they come with a blue screen? What are you trying to do when it happens?

    Please go back and update, then try the Eset scan again.
  9. Osbert

    Osbert Newcomer, in training Topic Starter

    sorry for the late reply - out of town and wanted to let the computer work for a bit to see what its doing
    no more crashes - yay! - tho I do still get pop up windows especially when I'm accessing a site that I have to log into.
    I'm not sure what the file is except that I downloaded winzip a while ago and it came with a (somewhat annoying) toolbar. could that be what it is? going to try the eset and will repost. thx!
  10. Osbert

    Osbert Newcomer, in training Topic Starter

    results of my eset scan...

    D:\JEFF-PC\Backup Set 2012-04-04 163128\Backup Files 2012-04-04 170806\Backup files 5.zip Java/TrojanDownloader.Agent.NCJ trojan
    D:\Program Files\Uniblue\RegistryBooster\Launcher.exe a variant of Win32/RegistryBooster application
    D:\Users\Jeff\Downloads\registrybooster.exe a variant of Win32/RegistryBooster application
  11. Bobbye

    Bobbye Helper on the Fringe Posts: 16,392   +35

    WinZip puts a lot of trash on the system!. Please remove the Registry Booster. We don't advise a registry cleaner for anyone- the risk is greater than any small benefit you might get.

    Just in case your friend's wants to refer anyone else here for help with malware removal: Please follow these steps: Preliminary Virus and Malware Removal.
    ==================================================
    Explain please.
     
  12. Osbert

    Osbert Newcomer, in training Topic Starter

    Well, as an example, I have a flickr account that asks for a username and password. I have it set to 'remember me', so I usually just hit the username space and my information appears. However, lately when I hit the space, I get a (separate) pop up window with some sort of advertizing in it. My information will not appear in the username/password boxes if this happens, and I have to either type it in myself or go to the site again. The second time I access the site, my information will appear with no pop-up. It does happen at other times as well, usually when I'm hitting a link within a site.
    And I guess I'm not a noob now:) but I'm still prone to making critical errors so how exactly should I go about removing the registry booster?
  13. Bobbye

    Bobbye Helper on the Fringe Posts: 16,392   +35

    Please download OTMovit by Old Timer and save to your desktop.
    • Double-click OTMoveIt3.exe to run it. (Vista users, please right click on OTMoveit3.exe and select "Run as an Administrator")
    • Copy the file paths below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose Copy):

      Code:
      :Processes 
      D:\Program Files\Uniblue\RegistryBooster\Launcher.exe
      :Files
      D:\JEFF-PC\Backup Set 2012-04-04 163128\Backup Files 2012-04-04 170806\Backup files 5.zip 
      D:\Users\Jeff\Downloads\registrybooster.exe 
      :Commands
      [purity]
      [emptytemp]
      [start explorer]
      [Reboot]
    • Return to OTMoveIt3, right click in the "Paste Instructions for Items to be Moved" window and choose Paste.
    • Click the red Moveit! button.
    • A log of files and folders moved will be created in the c:\_OTMoveIt\MovedFiles folder in the form of Date and Time (mmddyyyy_hhmmss.log). Please open this log in Notepad and post its contents in your next reply.
    • Close OTMoveIt3
    If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes.
    --------------------------------------
    The Uniblue Registry Booster is on the D Drive> Is that a flash drive or external hard drive? That is where you need to uninstall it.
    Then right click on Start> Explore> Computer> Double click on D Drive< Find the program folder and do a right click> Delete.
    =================================================
    Please run this Security Check:
    Download Security Check by screen317 and save to the desktop
    • Double click SecurityCheck.exe and follow the onscreen instructions inside of the black box.
    • A Notepad document should open automatically called checkup.txt please
    • Post the contents of that document.
  14. Osbert

    Osbert Newcomer, in training Topic Starter

    results of MoveIt:

    All processes killed
    ========== PROCESSES ==========
    No active process named D:\Program Files\Uniblue\RegistryBooster\Launcher.exe was found!
    ========== FILES ==========
    D:\JEFF-PC\Backup Set 2012-04-04 163128\Backup Files 2012-04-04 170806\Backup files 5.zip moved successfully.
    D:\Users\Jeff\Downloads\registrybooster.exe moved successfully.
    ========== COMMANDS ==========

    [EMPTYTEMP]

    User: All Users

    User: Default
    ->Temp folder emptied: 0 bytes
    ->Temporary Internet Files folder emptied: 67 bytes
    ->Flash cache emptied: 56502 bytes

    User: Default User
    ->Temp folder emptied: 0 bytes
    ->Temporary Internet Files folder emptied: 0 bytes
    ->Flash cache emptied: 0 bytes

    User: Jeff
    ->Temp folder emptied: 132255474 bytes
    ->Temporary Internet Files folder emptied: 10104927 bytes
    ->Java cache emptied: 0 bytes
    ->FireFox cache emptied: 1112214027 bytes
    ->Google Chrome cache emptied: 8200642 bytes
    ->Flash cache emptied: 31970 bytes

    User: Public
    ->Temp folder emptied: 0 bytes

    %systemdrive% .tmp files removed: 0 bytes
    %systemroot% .tmp files removed: 0 bytes
    %systemroot%\System32 .tmp files removed: 0 bytes
    %systemroot%\System32 (64bit) .tmp files removed: 0 bytes
    %systemroot%\System32\drivers .tmp files removed: 0 bytes
    Windows Temp folder emptied: 2945 bytes
    %systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 67563 bytes
    RecycleBin emptied: 0 bytes

    Total Files Cleaned = 1,204.00 mb


    OTM by OldTimer - Version 3.1.19.0 log created on 06122012_040129

    Files moved on Reboot...
    C:\Users\Jeff\AppData\Local\Temp\FXSAPIDebugLogFile.txt moved successfully.

    Registry entries deleted on Reboot...

    results of security check:

    Results of screen317's Security Check version 0.99.41
    Windows 7 Service Pack 1 x64 (UAC is enabled)
    Internet Explorer 8 Out of date!
    ``````````````Antivirus/Firewall Check:``````````````
    Windows Firewall Enabled!
    Norton AntiVirus
    WMI entry may not exist for antivirus; attempting automatic update.
    `````````Anti-malware/Other Utilities Check:`````````
    Malwarebytes Anti-Malware version 1.61.0.1400
    Java(TM) 6 Update 26
    Java version out of date!
    Adobe Flash Player 10 Flash Player out of date!
    Adobe Flash Player 11.2.202.235
    Mozilla Firefox (13.0)
    Google Chrome 19.0.1084.52
    Google Chrome 19.0.1084.56
    ````````Process Check: objlist.exe by Laurent````````
    Norton ccSvcHst.exe
    Norton AntiVirus Engine 19.7.1.5 ccSvcHst.exe
    `````````````````System Health check`````````````````
    Total Fragmentation on Drive C: 0%
    ````````````````````End of Log``````````````````````
  15. Bobbye

    Bobbye Helper on the Fringe Posts: 16,392   +35

    From OTM: Total Files Cleaned = 1,204.00 mb. This is a huge amount of files. Best you set up a regular maintenance schedule to include:
    Delete temporary internet files & Cookies
    Disc Cleanup
    Error Check
    Defrag
    Occasional review of installed programs to remove what is not being used.
    ===============================================
    Be sure to check all download screens for any pre-check toolbars or BHO> if found, remove the check before the download..

    1.Please update Java: Java Updates . Uninstall any earlier versions in Add/Remove Programs as they are vulnerabilities for the system.
    2, Please Uninstall: Adobe Flash Player 10. You have the current version
    ================================================
    About the prompts you're getting on site you have registered on:
    User name and password are stored on a Coockie. If you remove all of the Cookies, this information will be removed and you will have to re-register. When cleaning Coockiies originally, it's best to remove them all- then reset the Cookies to stop Tracking Coockies.
    The next time you remove Cookies, you can delete them selectively, leaving those that have registraqtion information. You will need to re-enter user name and pw once to store:

    [​IMG]
    SuperAntiSpyware Home Edition Free Version
    • Please download SuperAntiSpyware from HERE
    • Launch SuperAntiSpyware and click on 'Check for updates'.
    • Wait for the updates to be installed
    • On the main screen click on 'Scan your computer'.
    • Check: 'Perform Complete Scan then Click 'Next' to start the scan.
    • Superantispyware will now scan your computer,when it's finished it will list all/any infections found.
    • Make sure everything found has a checkmark next to it,then press 'Next'.
    • Click on 'Finish' when you've done.
    It's possible that the program will ask you to reboot in order to delete some files.

    Obtain the SuperAntiSpyware log as follows:
    • Click on 'Preferences'.
    • Click on the 'Statistics/Logs' tab.
    • Under 'Scanner Logs' double click on 'SuperAntiSpyware Scan Log'.
    It will then open in your default text editor,such as Notepad. Paste the notepad file here on your reply
    -----------------------------
    SAS will delete the Tracking Cookies on the system now. Then do the following to prevent in future:

    Reset Cookies

    For Internet Explorer: Internet Options (through Tools or Control Panel) Privacy tab> Advanced button> CHECK 'override automatic Cookie handling'> CHECK 'accept first party Cookies'> CHECK 'Block third party Cookies'> CHECK 'allow per session Cookies'> Apply> OK.

    For Firefox: Tools> Options> Privacy> Cookies> CHECK ‘accept Cookies from Sites’> UNCHECK 'accept third party Cookies'> Set Keep until 'they expire'. This will allow you to keep Cookies for registered sites and prevent or remove others. (Note: for Firefox v3.5, after Privacy click on 'use custom settings for History.')

    For Chrome: Tools> Options> Under The Hood> Privacy Section> CHECK 'Restrict how third party Cookies can be used'> Close.
    (First-party and third-party cookies can be set by the website you're visiting and websites that have items embedded in the website you're visiting. But when you next visit the website, only first-party cookie information is sent to the website. Third-party cookie information isn't sent back to the websites that originally set the third-party cookies.)
    =======================================
    I'd also like you to add the following for increased security:
    Antispyware/Security: I recommend all of the following:
    And if Norton doesn't have a firewall, consider adding one of the following:
    Use a Site Advisor: I recommend Use WOT Site Advisor..
    ===============================================
    Are there any problems remaining?
Topic Status:
Not open for further replies.


Add New Comment

TechSpot Members
Login or sign up for free,
it takes about 30 seconds.
You may also...


Get complete access to the TechSpot community. Join thousands of technology enthusiasts that contribute and share knowledge in our forum. Get a private inbox, upload your own photo gallery and more.