Solved Sirefef.B and Sirefef.Y infection

C

Corliss

Posts: 20   +0
I have been reading about all the people you have been helping that have been infected with the Siefef.B and Sirefef.Y. I too have been infected and my computer keeps restarting by itself. I understand that you recommend that I don't follow someone elses instructions because each computer may have a different solution. I would very much appreciate any help you can give me. Thank you.
 
By the way I have Microsoft Security Essentials installed and it identifies the Sirefef.Y trojan but before I can "clean" the computer restarts.
 
Welcome aboard
yahooo.gif


Please, observe following rules:
  • Read all of my instructions very carefully. Your mistakes during cleaning process may have very serious consequences, like unbootable computer.
  • If you're stuck, or you're not sure about certain step, always ask before doing anything else.
  • Please refrain from running tools or applying updates other than those I suggest.
  • Never run more than one scan at a time.
  • Keep updating me regarding your computer behavior, good, or bad.
  • The cleaning process, once started, has to be completed. Even if your computer appears to act better, it may still be infected. Once the computer is totally clean, I'll certainly let you know.
  • If you leave the topic without explanation in the middle of a cleaning process, you may not be eligible to receive any more help in malware removal forum.
  • I close my topics if you have not replied in 5 days. If you need more time, simply let me know. If I closed your topic and you need it to be reopened, simply PM me.

==============================================

What Windows version is it?
 
For x32 (x86) bit systems download Farbar Recovery Scan Tool 32-Bit and save it to a flash drive.
For x64 bit systems download Farbar Recovery Scan Tool 64-Bit and save it to a flash drive.

Plug the flashdrive into the infected PC.

Enter System Recovery Options.

To enter System Recovery Options from the Advanced Boot Options:
  • Restart the computer.
  • As soon as the BIOS is loaded begin tapping the F8 key until Advanced Boot Options appears.
  • Use the arrow keys to select the Repair your computer menu item.
  • Select US as the keyboard language settings, and then click Next.
  • Select the operating system you want to repair, and then click Next.
  • Select your user account an click Next.

To enter System Recovery Options by using Windows installation disc:
  • Insert the installation disc.
  • Restart your computer.
  • If prompted, press any key to start Windows from the installation disc. If your computer is not configured to start from a CD or DVD, check your BIOS settings.
  • Click Repair your computer.
  • Select US as the keyboard language settings, and then click Next.
  • Select the operating system you want to repair, and then click Next.
  • Select your user account and click Next.

On the System Recovery Options menu you will get the following options:

    • Startup Repair
      System Restore
      Windows Complete PC Restore
      Windows Memory Diagnostic Tool
      Command Prompt
  • Select Command Prompt
  • In the command window type in notepad and press Enter.
  • The notepad opens. Under File menu select Open.
  • Select "Computer" and find your flash drive letter and close the notepad.
  • In the command window type e:\frst.exe (for x64 bit version type e:\frst64) and press Enter
    Note: Replace letter e with the drive letter of your flash drive.
  • The tool will start to run.
  • When the tool opens click Yes to disclaimer.
  • Press Scan button.
  • It will make a log (FRST.txt) on the flash drive. Please copy and paste it to your reply.
 
Scan result of Farbar Recovery Scan Tool Version: 28-06-2012 02
Ran by SYSTEM at 29-06-2012 23:24:55
Running from G:\
Windows 7 Home Premium (X64) OS Language: English(US)
The current controlset is ControlSet001
========================== Registry (Whitelisted) =============
HKLM\...\Run: [hpsysdrv] c:\program files (x86)\hewlett-packard\HP odometer\hpsysdrv.exe [62768 2008-11-20] (Hewlett-Packard)
HKLM\...\Run: [SmartMenu] C:\Program Files\Hewlett-Packard\HP MediaSmart\SmartMenu.exe /background [568888 2010-01-18] ()
HKLM\...\Run: [MSC] "c:\Program Files\Microsoft Security Client\msseces.exe" -hide -runkey [1271168 2012-03-26] (Microsoft Corporation)
HKLM-x32\...\Run: [PDF Complete] C:\Program Files (x86)\PDF Complete\pdfsty.exe [563736 2009-10-14] (PDF Complete Inc)
HKLM-x32\...\Run: [StartCCC] "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun [336384 2011-02-08] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [Adobe Acrobat Speed Launcher] "C:\Program Files (x86)\Adobe\Acrobat 9.0\Acrobat\Acrobat_sl.exe" [40376 2012-03-27] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Acrobat Assistant 8.0] "C:\Program Files (x86)\Adobe\Acrobat 9.0\Acrobat\Acrotray.exe" [640440 2012-03-26] (Adobe Systems Inc.)
HKLM-x32\...\Run: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [843712 2012-01-02] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe" [254696 2011-06-09] (Sun Microsystems, Inc.)
HKLM-x32\...\Run: [LifeCam] "C:\Program Files (x86)\Microsoft LifeCam\LifeExp.exe" [135536 2010-12-13] (Microsoft Corporation)
HKLM-x32\...\Run: [APSDaemon] "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [59240 2012-02-20] (Apple Inc.)
HKLM-x32\...\Run: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime [421888 2012-04-18] (Apple Inc.)
HKLM-x32\...\Run: [iTunesHelper] "C:\Program Files (x86)\iTunes\iTunesHelper.exe" [421736 2012-03-27] (Apple Inc.)
HKLM-x32\...\Run: [SearchSettings] "C:\Program Files (x86)\Common Files\Spigot\Search Settings\SearchSettings.exe" [1088904 2012-06-13] (Spigot, Inc.)
HKLM-x32\...\Run: [HP Software Update] C:\Program Files (x86)\HP\HP Software Update\HPWuSchd2.exe [49208 2011-05-09] (Hewlett-Packard)
HKLM-x32\...\Run: [] [x]
HKU\Allen Home Office\...\Run: [Google Update] "C:\Users\Allen Home Office\AppData\Local\Google\Update\GoogleUpdate.exe" /c [136176 2011-06-20] (Google Inc.)
HKU\Allen Home Office\...\Run: [TivoServer] C:\Program Files (x86)\TiVo\Desktop\TiVoServer.exe /service /registry /auto:TivoServer [2264336 2010-08-24] (TiVo Inc.)
HKU\Allen Home Office\...\Run: [TivoTransfer] C:\Program Files (x86)\TiVo\Desktop\TiVoTransfer.exe [608528 2010-08-24] (TiVo Inc.)
HKU\Allen Home Office\...\Run: [TivoNotify] C:\Program Files (x86)\TiVo\Desktop\TiVoNotify.exe /service /registry /auto:TivoNotify [437520 2010-08-24] (TiVo Inc.)
HKU\Allen Home Office\...\Run: [TranscodingService] C:\Program Files (x86)\TiVo\Desktop\Plus\\TranscodingService.exe [856336 2010-08-24] (TiVo Inc.)
HKU\Allen Home Office\...\Run: [swg] "C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [39408 2011-10-10] (Google Inc.)
HKU\Default\...\Run: [HPAdvisorDock] C:\Program Files (x86)\Hewlett-Packard\HP Advisor\DOCK\HPAdvisorDock.exe [1712184 2010-02-09] ()
HKU\Default User\...\Run: [HPAdvisorDock] C:\Program Files (x86)\Hewlett-Packard\HP Advisor\DOCK\HPAdvisorDock.exe [1712184 2010-02-09] ()
Tcpip\Parameters: [DhcpNameServer] 209.18.47.61 209.18.47.62
Startup: C:\Users\All Users\Start Menu\Programs\Startup\Google Calendar Sync.lnk
ShortcutTarget: Google Calendar Sync.lnk -> C:\Program Files (x86)\Google\Google Calendar Sync\GoogleCalendarSync.exe (Google)
Startup: C:\Users\All Users\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk
ShortcutTarget: HP Digital Imaging Monitor.lnk -> C:\Program Files (x86)\Hp\Digital Imaging\bin\hpqtra08.exe (Hewlett-Packard Co.)
Startup: C:\Users\Allen Home Office\Start Menu\Programs\Startup\Dropbox.lnk
ShortcutTarget: Dropbox.lnk -> (No File)
==================== Services (Whitelisted) ======
2 AMD Reservation Manager; "C:\Program Files\ATI Technologies\ATI.ACE\Reservation Manager\AMD Reservation Manager.exe" [194496 2010-06-17] (Advanced Micro Devices)
2 Application Updater; "C:\Program Files (x86)\Application Updater\ApplicationUpdater.exe" [792512 2012-06-13] (Spigot, Inc.)
2 CinemaNow Service; C:\Program Files (x86)\CinemaNow\CinemaNow Media Manager\CinemanowSvc.exe [400368 2010-06-12] (CinemaNow, Inc.)
2 CLKMSVC10_C6F09094; "C:\Program Files (x86)\Hewlett-Packard\Media\DVD\Kernel\HDDVD\NavFilter\kmsvc.exe" /svc [245232 2010-06-29] (CyberLink)
2 MsMpSvc; "C:\Program Files\Microsoft Security Client\MsMpEng.exe" [12600 2012-03-26] (Microsoft Corporation)
4 TivoBeacon2; "C:\Program Files (x86)\TiVo\Desktop\TiVoBeacon.exe" /service [1104656 2010-08-24] (TiVo Inc.)
========================== Drivers (Whitelisted) =============
3 CpqDfw; C:\Windows\System32\Drivers\CpqDfw.sys [24376 2010-03-01] ()
3 cqcpu; C:\Windows\System32\Drivers\cqcpu.sys [24376 2010-03-01] ()
3 MBAMProtector; \??\C:\Windows\system32\drivers\mbam.sys [24904 2012-04-04] (Malwarebytes Corporation)
========================== NetSvcs (Whitelisted) ===========

============ One Month Created Files and Folders ==============
2012-06-29 19:56 - 2012-06-29 19:56 - 00001115 ____A C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2012-06-29 19:56 - 2012-06-29 19:56 - 00000000 ____D C:\Users\Allen Home Office\AppData\Roaming\Malwarebytes
2012-06-29 19:56 - 2012-06-29 19:56 - 00000000 ____D C:\Users\All Users\Malwarebytes
2012-06-29 19:56 - 2012-06-29 19:56 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2012-06-29 19:56 - 2012-04-04 12:56 - 00024904 ____A (Malwarebytes Corporation) C:\Windows\System32\Drivers\mbam.sys
2012-06-29 18:14 - 2012-06-29 18:14 - 00001272 ____A C:\Users\Allen Home Office\Desktop\shutdown.lnk
2012-06-28 15:17 - 2012-06-28 15:17 - 00328704 ____A (Microsoft Corporation) C:\Windows\System32\services.exe.0433AE5091C91772
2012-06-28 15:08 - 2012-06-28 15:08 - 00328704 ____A (Microsoft Corporation) C:\Windows\System32\services.exe.B15E0C318C0FCDF4
2012-06-28 15:05 - 2012-06-28 15:05 - 00328704 ____A (Microsoft Corporation) C:\Windows\System32\services.exe.94CB53B0135B6A24
2012-06-28 15:03 - 2012-06-28 15:03 - 00328704 ____A (Microsoft Corporation) C:\Windows\System32\services.exe.EBA06CAD10D3AD39
2012-06-28 14:55 - 2012-06-28 14:55 - 00328704 ____A (Microsoft Corporation) C:\Windows\System32\services.exe.5A9C54D5505C6E19
2012-06-28 14:53 - 2012-06-28 14:53 - 00328704 ____A (Microsoft Corporation) C:\Windows\System32\services.exe.52153FA17F559C4D
2012-06-28 14:50 - 2012-06-28 14:50 - 00328704 ____A (Microsoft Corporation) C:\Windows\System32\services.exe.5E2EA368C3AB9C95
2012-06-28 14:41 - 2012-06-28 14:41 - 00328704 ____A (Microsoft Corporation) C:\Windows\System32\services.exe.DB17D8DF47318A62
2012-06-28 14:36 - 2012-06-28 14:36 - 00328704 ____A (Microsoft Corporation) C:\Windows\System32\services.exe.60C3126BA8F54837
2012-06-28 14:32 - 2012-06-28 14:32 - 00328704 ____A (Microsoft Corporation) C:\Windows\System32\services.exe.AD32122A40A2C768
2012-06-28 14:28 - 2012-06-28 14:28 - 00328704 ____A (Microsoft Corporation) C:\Windows\System32\services.exe.732ACF4C94138B14
2012-06-28 14:22 - 2012-06-28 14:22 - 00000000 ____D C:\Program Files\Microsoft Security Client
2012-06-28 14:22 - 2012-06-28 14:22 - 00000000 ____D C:\Program Files (x86)\Microsoft Security Client
2012-06-28 14:02 - 2012-05-04 03:00 - 00366592 ____A (Microsoft Corporation) C:\Windows\System32\qdvd.dll
2012-06-28 14:02 - 2012-05-04 01:59 - 00514560 ____A (Microsoft Corporation) C:\Windows\SysWOW64\qdvd.dll
2012-06-28 13:22 - 2012-06-28 16:41 - 00000000 ___AD C:\Kaspersky Rescue Disk 10.0
2012-06-28 13:15 - 2012-06-28 13:15 - 00000000 ____D C:\Windows\Hewlett-Packard
2012-06-28 13:14 - 2012-06-28 13:14 - 00000000 ____D C:\Users\Allen Home Office\Documents\My Scans
2012-06-28 13:00 - 2012-06-28 22:01 - 00000362 ____A C:\Windows\Tasks\HP Photo Creations Communicator.job
2012-06-28 13:00 - 2012-06-28 13:01 - 00000000 ____D C:\Users\All Users\Visan
2012-06-28 12:59 - 2012-06-28 12:59 - 00000000 ____D C:\Users\All Users\WEBREG
2012-06-28 12:46 - 2012-06-28 12:46 - 00000000 ____D C:\Users\Allen Home Office\AppData\Local\HP
2012-06-28 12:38 - 2012-06-28 12:38 - 00001317 ____A C:\Users\Public\Desktop\HP Solution Center.lnk
2012-06-28 12:38 - 2012-06-28 12:38 - 00000000 ____D C:\Users\All Users\HP Product Assistant
2012-06-28 12:25 - 2012-06-28 12:36 - 247732696 ____A C:\Users\Allen Home Office\Downloads\PS_AIO_07_C410_FSW_Full_Win_enu_140_222 (1).exe
2012-06-23 11:11 - 2012-06-23 11:11 - 00000000 __SHD C:\Windows\System32\%APPDATA%
2012-06-18 15:08 - 2012-06-02 14:19 - 02428952 ____A (Microsoft Corporation) C:\Windows\System32\wuaueng.dll
2012-06-18 15:08 - 2012-06-02 14:19 - 00057880 ____A (Microsoft Corporation) C:\Windows\System32\wuauclt.exe
2012-06-18 15:08 - 2012-06-02 14:19 - 00044056 ____A (Microsoft Corporation) C:\Windows\System32\wups2.dll
2012-06-18 15:08 - 2012-06-02 14:15 - 02622464 ____A (Microsoft Corporation) C:\Windows\System32\wucltux.dll
2012-06-18 15:07 - 2012-06-02 14:19 - 00701976 ____A (Microsoft Corporation) C:\Windows\System32\wuapi.dll
2012-06-18 15:07 - 2012-06-02 14:19 - 00038424 ____A (Microsoft Corporation) C:\Windows\System32\wups.dll
2012-06-18 15:07 - 2012-06-02 14:15 - 00099840 ____A (Microsoft Corporation) C:\Windows\System32\wudriver.dll
2012-06-18 15:07 - 2012-06-02 12:19 - 00186752 ____A (Microsoft Corporation) C:\Windows\System32\wuwebv.dll
2012-06-18 15:07 - 2012-06-02 12:15 - 00036864 ____A (Microsoft Corporation) C:\Windows\System32\wuapp.exe
2012-06-18 10:19 - 2012-06-18 10:19 - 00000000 ____D C:\Program Files (x86)\YouTube Downloader Toolbar
2012-06-18 10:19 - 2012-06-18 10:19 - 00000000 ____D C:\Program Files (x86)\Application Updater
2012-06-15 00:00 - 2012-05-17 18:47 - 17807360 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.dll
2012-06-15 00:00 - 2012-05-17 18:16 - 10924032 ____A (Microsoft Corporation) C:\Windows\System32\ieframe.dll
2012-06-15 00:00 - 2012-05-17 18:06 - 02311680 ____A (Microsoft Corporation) C:\Windows\System32\jscript9.dll
2012-06-15 00:00 - 2012-05-17 17:59 - 01392128 ____A (Microsoft Corporation) C:\Windows\System32\wininet.dll
2012-06-15 00:00 - 2012-05-17 17:59 - 01346048 ____A (Microsoft Corporation) C:\Windows\System32\urlmon.dll
2012-06-15 00:00 - 2012-05-17 17:58 - 01494528 ____A (Microsoft Corporation) C:\Windows\System32\inetcpl.cpl
2012-06-15 00:00 - 2012-05-17 17:58 - 00237056 ____A (Microsoft Corporation) C:\Windows\System32\url.dll
2012-06-15 00:00 - 2012-05-17 17:56 - 00085504 ____A (Microsoft Corporation) C:\Windows\System32\jsproxy.dll
2012-06-15 00:00 - 2012-05-17 17:55 - 00818688 ____A (Microsoft Corporation) C:\Windows\System32\jscript.dll
2012-06-15 00:00 - 2012-05-17 17:55 - 00173056 ____A (Microsoft Corporation) C:\Windows\System32\ieUnatt.exe
2012-06-15 00:00 - 2012-05-17 17:54 - 02144768 ____A (Microsoft Corporation) C:\Windows\System32\iertutil.dll
2012-06-15 00:00 - 2012-05-17 17:51 - 02382848 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.tlb
2012-06-15 00:00 - 2012-05-17 17:51 - 00096768 ____A (Microsoft Corporation) C:\Windows\System32\mshtmled.dll
2012-06-15 00:00 - 2012-05-17 17:47 - 00248320 ____A (Microsoft Corporation) C:\Windows\System32\ieui.dll
2012-06-15 00:00 - 2012-05-17 15:11 - 12314624 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2012-06-15 00:00 - 2012-05-17 14:48 - 09737728 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2012-06-15 00:00 - 2012-05-17 14:45 - 01800192 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2012-06-15 00:00 - 2012-05-17 14:36 - 01103872 ____A (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2012-06-15 00:00 - 2012-05-17 14:35 - 01427968 ____A (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2012-06-15 00:00 - 2012-05-17 14:35 - 01129472 ____A (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2012-06-15 00:00 - 2012-05-17 14:33 - 00231936 ____A (Microsoft Corporation) C:\Windows\SysWOW64\url.dll
2012-06-15 00:00 - 2012-05-17 14:31 - 00065024 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2012-06-15 00:00 - 2012-05-17 14:29 - 00716800 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2012-06-15 00:00 - 2012-05-17 14:29 - 00142848 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2012-06-15 00:00 - 2012-05-17 14:27 - 01793024 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2012-06-15 00:00 - 2012-05-17 14:25 - 00073216 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2012-06-15 00:00 - 2012-05-17 14:24 - 02382848 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2012-06-15 00:00 - 2012-05-17 14:20 - 00176640 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2012-06-14 07:04 - 2012-05-14 17:32 - 03146752 ____A (Microsoft Corporation) C:\Windows\System32\win32k.sys
2012-06-14 07:04 - 2012-05-04 03:06 - 05559664 ____A (Microsoft Corporation) C:\Windows\System32\ntoskrnl.exe
2012-06-14 07:04 - 2012-05-04 02:03 - 03968368 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2012-06-14 07:04 - 2012-05-04 02:03 - 03913072 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2012-06-14 07:04 - 2012-04-30 21:40 - 00209920 ____A (Microsoft Corporation) C:\Windows\System32\profsvc.dll
2012-06-14 07:04 - 2012-04-27 19:55 - 00210944 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\rdpwd.sys
2012-06-14 07:04 - 2012-04-25 21:41 - 00149504 ____A (Microsoft Corporation) C:\Windows\System32\rdpcorekmts.dll
2012-06-14 07:04 - 2012-04-25 21:41 - 00077312 ____A (Microsoft Corporation) C:\Windows\System32\rdpwsx.dll
2012-06-14 07:04 - 2012-04-25 21:34 - 00009216 ____A (Microsoft Corporation) C:\Windows\System32\rdrmemptylst.exe
2012-06-14 07:04 - 2012-04-23 21:37 - 01462272 ____A (Microsoft Corporation) C:\Windows\System32\crypt32.dll
2012-06-14 07:04 - 2012-04-23 21:37 - 00184320 ____A (Microsoft Corporation) C:\Windows\System32\cryptsvc.dll
2012-06-14 07:04 - 2012-04-23 21:37 - 00140288 ____A (Microsoft Corporation) C:\Windows\System32\cryptnet.dll
2012-06-14 07:04 - 2012-04-23 20:36 - 01158656 ____A (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll
2012-06-14 07:04 - 2012-04-23 20:36 - 00140288 ____A (Microsoft Corporation) C:\Windows\SysWOW64\cryptsvc.dll
2012-06-14 07:04 - 2012-04-23 20:36 - 00103936 ____A (Microsoft Corporation) C:\Windows\SysWOW64\cryptnet.dll
2012-06-14 07:04 - 2012-04-07 04:31 - 03216384 ____A (Microsoft Corporation) C:\Windows\System32\msi.dll
2012-06-14 07:04 - 2012-04-07 03:26 - 02342400 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msi.dll
2012-06-07 08:04 - 2012-06-07 08:04 - 01402197 ____A C:\Users\Lesley\Downloads\MSNWeather.gadget
2012-06-06 19:09 - 2012-06-06 19:09 - 00013539 ____A C:\Users\Allen Home Office\Downloads\Sharp Punch-SoundBible.com-1947392621.mp3
2012-06-06 15:39 - 2012-06-06 15:39 - 00000000 ____D C:\Users\Allen Home Office\AppData\Local\{9BB68229-3ED6-44DE-A38D-5FB7E12C5A0D}
2012-06-06 15:38 - 2012-06-06 15:39 - 00000000 ____D C:\Users\Allen Home Office\AppData\Local\{E8F6B1D5-740A-4BFF-AAA5-5DB5FDE96FA6}
2012-06-05 20:15 - 2012-06-05 20:15 - 00001393 ____A C:\Users\Public\Desktop\YTD YouTube Downloader & Converter.lnk
2012-06-05 20:15 - 2012-06-05 20:15 - 00000000 ____D C:\Users\All Users\YTD YouTube Downloader & Converter
2012-06-05 20:15 - 2012-06-05 20:15 - 00000000 ____D C:\Program Files (x86)\GreenTree Applications
2012-06-05 17:08 - 2012-06-05 17:08 - 00000000 ____D C:\Users\Allen Home Office\AppData\Local\{7855CDFF-538F-4435-A583-0265BC83E1F7}
2012-06-05 17:08 - 2012-06-05 17:08 - 00000000 ____D C:\Users\Allen Home Office\AppData\Local\{11C3F5D8-5014-42A8-AB1B-0405304CFCDF}
2012-06-02 22:20 - 2012-06-02 22:20 - 00000000 ____D C:\Users\Allen Home Office\AppData\Local\{62EBE100-CB78-4100-9163-9FA6929E28B6}
2012-06-02 14:31 - 2012-06-02 14:31 - 00000000 ____D C:\Program Files (x86)\Lame For Audacity
2012-06-02 14:29 - 2012-06-03 05:47 - 00000000 ____D C:\Users\Allen Home Office\AppData\Roaming\Audacity
2012-06-02 14:29 - 2012-06-02 14:29 - 00000000 ____D C:\Program Files (x86)\Audacity
2012-06-02 10:19 - 2012-06-02 22:20 - 00000000 ____D C:\Users\Allen Home Office\AppData\Local\{D84C9BDB-371D-49CE-872A-E056CA6983F7}
2012-06-02 10:19 - 2012-06-02 10:20 - 00000000 ____D C:\Users\Allen Home Office\AppData\Local\{38D6F2FB-CD17-48AF-A57D-68AE41087D19}
2012-06-02 10:01 - 2012-06-02 10:01 - 00000000 ____D C:\Windows\en
2012-06-02 09:59 - 2012-03-08 15:40 - 00048488 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\fssfltr.sys
2012-06-02 09:54 - 2012-06-02 09:55 - 00000000 ____D C:\Users\Allen Home Office\AppData\Local\{BB2145F5-827C-469A-A69F-46282A492BB3}
2012-06-02 09:54 - 2012-06-02 09:54 - 00000000 ____D C:\Users\Allen Home Office\AppData\Local\{9455B1B1-4E5A-4D57-99E8-8E2F5E7057ED}
2012-06-02 09:21 - 2012-06-02 09:21 - 00000000 ____D C:\Users\Allen Home Office\AppData\Local\{BD8FD565-2D08-447E-9EC9-632DBD001CF6}
2012-06-02 09:21 - 2012-06-02 09:21 - 00000000 ____D C:\Users\Allen Home Office\AppData\Local\{A486477C-F208-4E41-9DE4-50792E2B9DB9}
2012-06-02 05:30 - 2012-06-02 05:30 - 00000000 ____D C:\Users\Allen Home Office\AppData\Local\{4571A3DF-69FC-4DB8-BF33-55C979B70438}

============ 3 Months Modified Files and Folders =============
2012-06-29 23:25 - 2012-06-29 23:24 - 00000000 ____D C:\FRST
2012-06-29 23:11 - 2011-06-20 17:39 - 00000000 ____D C:\Users\All Users\Recovery
2012-06-29 20:14 - 2012-04-18 19:44 - 00000000 ___RD C:\Users\Allen Home Office\Dropbox
2012-06-29 20:14 - 2012-04-18 19:43 - 00000000 ____D C:\Users\Allen Home Office\AppData\Roaming\Dropbox
2012-06-29 20:13 - 2011-10-10 08:27 - 00000894 ____A C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2012-06-29 20:12 - 2009-07-13 21:08 - 00000006 ___AH C:\Windows\Tasks\SA.DAT
2012-06-29 20:12 - 2009-07-13 20:51 - 00082886 ____A C:\Windows\setupact.log
2012-06-29 19:56 - 2012-06-29 19:56 - 00001115 ____A C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2012-06-29 19:56 - 2012-06-29 19:56 - 00000000 ____D C:\Users\Allen Home Office\AppData\Roaming\Malwarebytes
2012-06-29 19:56 - 2012-06-29 19:56 - 00000000 ____D C:\Users\All Users\Malwarebytes
2012-06-29 19:56 - 2012-06-29 19:56 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2012-06-29 19:56 - 2012-04-08 17:55 - 00000830 ____A C:\Windows\Tasks\Adobe Flash Player Updater.job
2012-06-29 18:14 - 2012-06-29 18:14 - 00001272 ____A C:\Users\Allen Home Office\Desktop\shutdown.lnk
2012-06-29 04:29 - 2011-07-17 14:48 - 00118704 ____A C:\Users\Lesley\AppData\Local\GDIPFONTCACHEV1.DAT
2012-06-29 04:22 - 2009-07-13 21:08 - 00032550 ____A C:\Windows\Tasks\SCHEDLGU.TXT
2012-06-28 22:02 - 2009-07-13 21:13 - 00740078 ____A C:\Windows\System32\PerfStringBackup.INI
2012-06-28 22:01 - 2012-06-28 13:00 - 00000362 ____A C:\Windows\Tasks\HP Photo Creations Communicator.job
2012-06-28 16:41 - 2012-06-28 13:22 - 00000000 ___AD C:\Kaspersky Rescue Disk 10.0
2012-06-28 16:17 - 2009-07-13 15:19 - 00328704 ____A (Microsoft Corporation) C:\Windows\System32\services.exe
2012-06-28 15:17 - 2012-06-28 15:17 - 00328704 ____A (Microsoft Corporation) C:\Windows\System32\services.exe.0433AE5091C91772
2012-06-28 15:08 - 2012-06-28 15:08 - 00328704 ____A (Microsoft Corporation) C:\Windows\System32\services.exe.B15E0C318C0FCDF4
2012-06-28 15:05 - 2012-06-28 15:05 - 00328704 ____A (Microsoft Corporation) C:\Windows\System32\services.exe.94CB53B0135B6A24
2012-06-28 15:03 - 2012-06-28 15:03 - 00328704 ____A (Microsoft Corporation) C:\Windows\System32\services.exe.EBA06CAD10D3AD39
2012-06-28 14:55 - 2012-06-28 14:55 - 00328704 ____A (Microsoft Corporation) C:\Windows\System32\services.exe.5A9C54D5505C6E19
2012-06-28 14:53 - 2012-06-28 14:53 - 00328704 ____A (Microsoft Corporation) C:\Windows\System32\services.exe.52153FA17F559C4D
2012-06-28 14:53 - 2011-10-10 08:27 - 00000898 ____A C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2012-06-28 14:50 - 2012-06-28 14:50 - 00328704 ____A (Microsoft Corporation) C:\Windows\System32\services.exe.5E2EA368C3AB9C95
2012-06-28 14:48 - 2011-06-20 17:51 - 00000956 ____A C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1561252055-2272658225-3862106704-1001UA.job
2012-06-28 14:41 - 2012-06-28 14:41 - 00328704 ____A (Microsoft Corporation) C:\Windows\System32\services.exe.DB17D8DF47318A62
2012-06-28 14:41 - 2011-03-30 12:26 - 01797658 ____A C:\Windows\WindowsUpdate.log
2012-06-28 14:36 - 2012-06-28 14:36 - 00328704 ____A (Microsoft Corporation) C:\Windows\System32\services.exe.60C3126BA8F54837
2012-06-28 14:32 - 2012-06-28 14:32 - 00328704 ____A (Microsoft Corporation) C:\Windows\System32\services.exe.AD32122A40A2C768
2012-06-28 14:30 - 2012-01-11 10:22 - 00000000 __SHD C:\Users\Allen Home Office\AppData\Local\{45dc7bf2-8cf7-f4a5-e3aa-4dab29bc091b}
2012-06-28 14:28 - 2012-06-28 14:28 - 00328704 ____A (Microsoft Corporation) C:\Windows\System32\services.exe.732ACF4C94138B14
2012-06-28 14:23 - 2009-07-13 20:45 - 00009920 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2012-06-28 14:23 - 2009-07-13 20:45 - 00009920 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2012-06-28 14:22 - 2012-06-28 14:22 - 00000000 ____D C:\Program Files\Microsoft Security Client
2012-06-28 14:22 - 2012-06-28 14:22 - 00000000 ____D C:\Program Files (x86)\Microsoft Security Client
2012-06-28 14:22 - 2012-05-02 00:01 - 00001945 ____A C:\Windows\epplauncher.mif
2012-06-28 14:22 - 2011-07-12 20:06 - 00753736 ____A C:\Windows\SysWOW64\PerfStringBackup.INI
2012-06-28 14:04 - 2011-03-30 12:20 - 00000000 ____D C:\Windows\SysWOW64\RTCOM
2012-06-28 13:26 - 2009-07-13 20:45 - 00437040 ____A C:\Windows\System32\FNTCACHE.DAT
2012-06-28 13:25 - 2011-06-27 17:25 - 00000000 ____D C:\Users\Allen Home Office\AppData\Roaming\HpUpdate
2012-06-28 13:15 - 2012-06-28 13:15 - 00000000 ____D C:\Windows\Hewlett-Packard
2012-06-28 13:14 - 2012-06-28 13:14 - 00000000 ____D C:\Users\Allen Home Office\Documents\My Scans
2012-06-28 13:14 - 2011-08-01 16:05 - 00000000 ____D C:\Users\All Users\HP
2012-06-28 13:01 - 2012-06-28 13:00 - 00000000 ____D C:\Users\All Users\Visan
2012-06-28 13:01 - 2011-08-05 15:34 - 00000000 ____D C:\Users\All Users\HP Photo Creations
2012-06-28 13:00 - 2011-08-05 15:34 - 00000000 ____D C:\Program Files (x86)\HP Photo Creations
2012-06-28 12:59 - 2012-06-28 12:59 - 00000000 ____D C:\Users\All Users\WEBREG
2012-06-28 12:59 - 2011-10-17 17:04 - 00000000 ____D C:\Users\Allen Home Office\AppData\Roaming\HP
2012-06-28 12:59 - 2011-08-05 15:29 - 00212671 ____A C:\Windows\hpoins52.dat
2012-06-28 12:59 - 2011-08-05 15:29 - 00005179 ____A C:\Users\All Users\hpzinstall.log
2012-06-28 12:46 - 2012-06-28 12:46 - 00000000 ____D C:\Users\Allen Home Office\AppData\Local\HP
2012-06-28 12:46 - 2009-07-13 18:34 - 00000513 ____A C:\Windows\win.ini
2012-06-28 12:44 - 2011-06-20 16:44 - 00118704 ____A C:\Users\Allen Home Office\AppData\Local\GDIPFONTCACHEV1.DAT
2012-06-28 12:38 - 2012-06-28 12:38 - 00001317 ____A C:\Users\Public\Desktop\HP Solution Center.lnk
2012-06-28 12:38 - 2012-06-28 12:38 - 00000000 ____D C:\Users\All Users\HP Product Assistant
2012-06-28 12:36 - 2012-06-28 12:25 - 247732696 ____A C:\Users\Allen Home Office\Downloads\PS_AIO_07_C410_FSW_Full_Win_enu_140_222 (1).exe
2012-06-28 10:39 - 2011-07-17 14:53 - 00000000 ____D C:\Users\Lesley\Documents\Outlook Files
2012-06-28 08:21 - 2011-06-20 17:51 - 00000904 ____A C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1561252055-2272658225-3862106704-1001Core.job
2012-06-27 20:14 - 2011-07-16 19:26 - 00000000 ____D C:\Users\Allen Home Office\Documents\Outlook Files
2012-06-25 13:48 - 2009-07-13 19:20 - 00000000 ____D C:\Windows\rescache
2012-06-24 15:17 - 2011-08-02 08:45 - 00000336 ____A C:\Windows\Tasks\HPCeeScheduleForLesley.job
2012-06-24 06:01 - 2011-03-30 12:26 - 00000000 ____D C:\Users\All Users\PDFC
2012-06-23 11:11 - 2012-06-23 11:11 - 00000000 __SHD C:\Windows\System32\%APPDATA%
2012-06-22 13:58 - 2011-07-17 14:30 - 00000000 ____D C:\users\Lesley
2012-06-21 08:44 - 2011-08-02 08:44 - 00000000 ____D C:\Users\Lesley\AppData\Roaming\HpUpdate
2012-06-21 08:44 - 2011-08-02 08:44 - 00000000 ____D C:\Users\Lesley\AppData\Roaming\HP Support Assistant
2012-06-18 10:19 - 2012-06-18 10:19 - 00000000 ____D C:\Program Files (x86)\YouTube Downloader Toolbar
2012-06-18 10:19 - 2012-06-18 10:19 - 00000000 ____D C:\Program Files (x86)\Application Updater
2012-06-15 00:13 - 2011-07-16 14:03 - 00000000 ____D C:\Users\All Users\Microsoft Help
2012-06-15 00:07 - 2011-06-27 17:40 - 58957832 ____A (Microsoft Corporation) C:\Windows\System32\MRT.exe
2012-06-12 05:21 - 2011-07-12 18:10 - 00000000 ____D C:\Users\Allen Home Office\AppData\Roaming\HP Support Assistant
2012-06-11 17:56 - 2011-08-18 19:29 - 00002472 ____A C:\Users\Allen Home Office\Desktop\Google Chrome.lnk
2012-06-10 09:13 - 2012-04-08 17:55 - 00426184 ____A (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2012-06-10 09:13 - 2011-07-12 20:08 - 00070344 ____A (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2012-06-07 08:04 - 2012-06-07 08:04 - 01402197 ____A C:\Users\Lesley\Downloads\MSNWeather.gadget
2012-06-06 19:09 - 2012-06-06 19:09 - 00013539 ____A C:\Users\Allen Home Office\Downloads\Sharp Punch-SoundBible.com-1947392621.mp3
2012-06-06 15:39 - 2012-06-06 15:39 - 00000000 ____D C:\Users\Allen Home Office\AppData\Local\{9BB68229-3ED6-44DE-A38D-5FB7E12C5A0D}
2012-06-06 15:39 - 2012-06-06 15:38 - 00000000 ____D C:\Users\Allen Home Office\AppData\Local\{E8F6B1D5-740A-4BFF-AAA5-5DB5FDE96FA6}
2012-06-06 15:39 - 2011-07-12 20:17 - 00000000 ____D C:\Users\Allen Home Office\AppData\Local\Windows Live
2012-06-05 20:15 - 2012-06-05 20:15 - 00001393 ____A C:\Users\Public\Desktop\YTD YouTube Downloader & Converter.lnk
2012-06-05 20:15 - 2012-06-05 20:15 - 00000000 ____D C:\Users\All Users\YTD YouTube Downloader & Converter
2012-06-05 20:15 - 2012-06-05 20:15 - 00000000 ____D C:\Program Files (x86)\GreenTree Applications
2012-06-05 17:08 - 2012-06-05 17:08 - 00000000 ____D C:\Users\Allen Home Office\AppData\Local\{7855CDFF-538F-4435-A583-0265BC83E1F7}
2012-06-05 17:08 - 2012-06-05 17:08 - 00000000 ____D C:\Users\Allen Home Office\AppData\Local\{11C3F5D8-5014-42A8-AB1B-0405304CFCDF}
2012-06-03 05:47 - 2012-06-02 14:29 - 00000000 ____D C:\Users\Allen Home Office\AppData\Roaming\Audacity
2012-06-02 22:20 - 2012-06-02 22:20 - 00000000 ____D C:\Users\Allen Home Office\AppData\Local\{62EBE100-CB78-4100-9163-9FA6929E28B6}
2012-06-02 22:20 - 2012-06-02 10:19 - 00000000 ____D C:\Users\Allen Home Office\AppData\Local\{D84C9BDB-371D-49CE-872A-E056CA6983F7}
2012-06-02 14:31 - 2012-06-02 14:31 - 00000000 ____D C:\Program Files (x86)\Lame For Audacity
2012-06-02 14:29 - 2012-06-02 14:29 - 00000000 ____D C:\Program Files (x86)\Audacity
2012-06-02 14:19 - 2012-06-18 15:08 - 02428952 ____A (Microsoft Corporation) C:\Windows\System32\wuaueng.dll
2012-06-02 14:19 - 2012-06-18 15:08 - 00057880 ____A (Microsoft Corporation) C:\Windows\System32\wuauclt.exe
2012-06-02 14:19 - 2012-06-18 15:08 - 00044056 ____A (Microsoft Corporation) C:\Windows\System32\wups2.dll
2012-06-02 14:19 - 2012-06-18 15:07 - 00701976 ____A (Microsoft Corporation) C:\Windows\System32\wuapi.dll
2012-06-02 14:19 - 2012-06-18 15:07 - 00038424 ____A (Microsoft Corporation) C:\Windows\System32\wups.dll
2012-06-02 14:15 - 2012-06-18 15:08 - 02622464 ____A (Microsoft Corporation) C:\Windows\System32\wucltux.dll
2012-06-02 14:15 - 2012-06-18 15:07 - 00099840 ____A (Microsoft Corporation) C:\Windows\System32\wudriver.dll
2012-06-02 12:19 - 2012-06-18 15:07 - 00186752 ____A (Microsoft Corporation) C:\Windows\System32\wuwebv.dll
2012-06-02 12:15 - 2012-06-18 15:07 - 00036864 ____A (Microsoft Corporation) C:\Windows\System32\wuapp.exe
2012-06-02 10:20 - 2012-06-02 10:19 - 00000000 ____D C:\Users\Allen Home Office\AppData\Local\{38D6F2FB-CD17-48AF-A57D-68AE41087D19}
2012-06-02 10:01 - 2012-06-02 10:01 - 00000000 ____D C:\Windows\en
2012-06-02 09:59 - 2011-03-30 12:52 - 00000000 ____D C:\Program Files (x86)\Windows Live
2012-06-02 09:58 - 2011-07-12 20:21 - 00000000 ____D C:\Program Files\Windows Live
2012-06-02 09:57 - 2011-06-20 16:47 - 00032316 ____A C:\Windows\DirectX.log
2012-06-02 09:55 - 2012-06-02 09:54 - 00000000 ____D C:\Users\Allen Home Office\AppData\Local\{BB2145F5-827C-469A-A69F-46282A492BB3}
2012-06-02 09:54 - 2012-06-02 09:54 - 00000000 ____D C:\Users\Allen Home Office\AppData\Local\{9455B1B1-4E5A-4D57-99E8-8E2F5E7057ED}
2012-06-02 09:38 - 2012-04-18 19:44 - 00001064 ____A C:\Users\Allen Home Office\Desktop\Dropbox.lnk
2012-06-02 09:21 - 2012-06-02 09:21 - 00000000 ____D C:\Users\Allen Home Office\AppData\Local\{BD8FD565-2D08-447E-9EC9-632DBD001CF6}
2012-06-02 09:21 - 2012-06-02 09:21 - 00000000 ____D C:\Users\Allen Home Office\AppData\Local\{A486477C-F208-4E41-9DE4-50792E2B9DB9}
2012-06-02 05:30 - 2012-06-02 05:30 - 00000000 ____D C:\Users\Allen Home Office\AppData\Local\{4571A3DF-69FC-4DB8-BF33-55C979B70438}
2012-05-27 18:17 - 2011-03-30 13:49 - 00251464 ____A C:\Windows\PFRO.log
2012-05-27 18:16 - 2012-05-27 18:16 - 00001785 ____A C:\Users\Public\Desktop\iTunes.lnk
2012-05-27 18:16 - 2012-05-27 18:16 - 00000000 ____D C:\Program Files\iTunes
2012-05-27 18:16 - 2012-05-27 18:16 - 00000000 ____D C:\Program Files\iPod
2012-05-27 18:16 - 2012-05-27 18:16 - 00000000 ____D C:\Program Files (x86)\iTunes
2012-05-27 18:14 - 2012-05-27 18:14 - 00000000 ____D C:\Program Files (x86)\QuickTime
2012-05-23 06:58 - 2011-07-18 17:59 - 00000000 ____D C:\Users\Lesley\Documents\Youth Conference 2011
2012-05-22 14:04 - 2012-05-22 14:04 - 00032256 ____A C:\Users\Lesley\Documents\Pioneer Village Sign Up.xls
2012-05-20 18:35 - 2011-11-19 19:23 - 00000000 ____D C:\Users\Lesley\AppData\Roaming\Skype
2012-05-20 06:21 - 2011-07-17 17:21 - 00000000 ____D C:\Users\Allen Home Office\Documents\church
2012-05-17 18:47 - 2012-06-15 00:00 - 17807360 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.dll
2012-05-17 18:16 - 2012-06-15 00:00 - 10924032 ____A (Microsoft Corporation) C:\Windows\System32\ieframe.dll
2012-05-17 18:06 - 2012-06-15 00:00 - 02311680 ____A (Microsoft Corporation) C:\Windows\System32\jscript9.dll
2012-05-17 17:59 - 2012-06-15 00:00 - 01392128 ____A (Microsoft Corporation) C:\Windows\System32\wininet.dll
2012-05-17 17:59 - 2012-06-15 00:00 - 01346048 ____A (Microsoft Corporation) C:\Windows\System32\urlmon.dll
2012-05-17 17:58 - 2012-06-15 00:00 - 01494528 ____A (Microsoft Corporation) C:\Windows\System32\inetcpl.cpl
2012-05-17 17:58 - 2012-06-15 00:00 - 00237056 ____A (Microsoft Corporation) C:\Windows\System32\url.dll
2012-05-17 17:56 - 2012-06-15 00:00 - 00085504 ____A (Microsoft Corporation) C:\Windows\System32\jsproxy.dll
2012-05-17 17:55 - 2012-06-15 00:00 - 00818688 ____A (Microsoft Corporation) C:\Windows\System32\jscript.dll
2012-05-17 17:55 - 2012-06-15 00:00 - 00173056 ____A (Microsoft Corporation) C:\Windows\System32\ieUnatt.exe
2012-05-17 17:54 - 2012-06-15 00:00 - 02144768 ____A (Microsoft Corporation) C:\Windows\System32\iertutil.dll
2012-05-17 17:51 - 2012-06-15 00:00 - 02382848 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.tlb
2012-05-17 17:51 - 2012-06-15 00:00 - 00096768 ____A (Microsoft Corporation) C:\Windows\System32\mshtmled.dll
2012-05-17 17:47 - 2012-06-15 00:00 - 00248320 ____A (Microsoft Corporation) C:\Windows\System32\ieui.dll
2012-05-17 15:11 - 2012-06-15 00:00 - 12314624 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2012-05-17 14:48 - 2012-06-15 00:00 - 09737728 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2012-05-17 14:45 - 2012-06-15 00:00 - 01800192 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2012-05-17 14:36 - 2012-06-15 00:00 - 01103872 ____A (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2012-05-17 14:35 - 2012-06-15 00:00 - 01427968 ____A (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2012-05-17 14:35 - 2012-06-15 00:00 - 01129472 ____A (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2012-05-17 14:33 - 2012-06-15 00:00 - 00231936 ____A (Microsoft Corporation) C:\Windows\SysWOW64\url.dll
2012-05-17 14:31 - 2012-06-15 00:00 - 00065024 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2012-05-17 14:29 - 2012-06-15 00:00 - 00716800 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2012-05-17 14:29 - 2012-06-15 00:00 - 00142848 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2012-05-17 14:27 - 2012-06-15 00:00 - 01793024 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2012-05-17 14:25 - 2012-06-15 00:00 - 00073216 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2012-05-17 14:24 - 2012-06-15 00:00 - 02382848 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2012-05-17 14:20 - 2012-06-15 00:00 - 00176640 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2012-05-17 13:47 - 2011-07-23 10:59 - 00001998 ___AH C:\Users\Allen Home Office\Documents\Default.rdp
2012-05-15 09:56 - 2011-11-10 05:58 - 00060304 ____A C:\Users\Lesley\g2mdlhlpx.exe
2012-05-14 17:32 - 2012-06-14 07:04 - 03146752 ____A (Microsoft Corporation) C:\Windows\System32\win32k.sys
2012-05-14 00:01 - 2012-05-14 00:01 - 00000000 ____D C:\Program Files\Microsoft Silverlight
2012-05-14 00:01 - 2012-05-14 00:01 - 00000000 ____D C:\Program Files (x86)\Microsoft Silverlight
2012-05-13 00:01 - 2009-07-13 23:45 - 00000000 ____D C:\Program Files\Windows Journal
2012-05-10 08:40 - 2012-05-10 08:40 - 00000000 ____D C:\Users\Lesley\Tracing
2012-05-10 08:40 - 2012-05-10 08:40 - 00000000 ____D C:\Users\Lesley\Documents\My Meetings
2012-05-10 08:39 - 2012-05-10 08:39 - 00000000 ____D C:\Users\All Users\Applications
2012-05-10 08:39 - 2011-03-30 12:30 - 00000000 ____D C:\Program Files (x86)\Microsoft Office
2012-05-04 03:06 - 2012-06-14 07:04 - 05559664 ____A (Microsoft Corporation) C:\Windows\System32\ntoskrnl.exe
2012-05-04 03:00 - 2012-06-28 14:02 - 00366592 ____A (Microsoft Corporation) C:\Windows\System32\qdvd.dll
2012-05-04 02:03 - 2012-06-14 07:04 - 03968368 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2012-05-04 02:03 - 2012-06-14 07:04 - 03913072 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2012-05-04 01:59 - 2012-06-28 14:02 - 00514560 ____A (Microsoft Corporation) C:\Windows\SysWOW64\qdvd.dll
2012-04-30 21:40 - 2012-06-14 07:04 - 00209920 ____A (Microsoft Corporation) C:\Windows\System32\profsvc.dll
2012-04-27 19:55 - 2012-06-14 07:04 - 00210944 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\rdpwd.sys
2012-04-26 19:01 - 2012-04-26 19:00 - 164955979 ____A C:\Users\Allen Home Office\Downloads\2007-01-0005-the-mediator-480p-eng.mp4
2012-04-26 03:47 - 2012-04-26 03:47 - 11172864 ____A (Advanced Micro Devices, Inc.) C:\Windows\System32\Drivers\atikmdag.sys
2012-04-26 01:58 - 2012-04-26 01:58 - 00245960 ____A C:\Windows\SysWOW64\atiapfxx.blb
2012-04-26 01:58 - 2012-04-26 01:58 - 00245960 ____A C:\Windows\System32\atiapfxx.blb
2012-04-26 01:56 - 2012-04-26 01:56 - 00159744 ____A (Advanced Micro Devices, Inc.) C:\Windows\System32\atiapfxx.exe
2012-04-26 01:56 - 2011-03-30 13:16 - 00909312 ____A (Advanced Micro Devices, Inc. ) C:\Windows\SysWOW64\aticfx32.dll
2012-04-26 01:54 - 2011-03-30 13:16 - 01067520 ____A (Advanced Micro Devices, Inc. ) C:\Windows\System32\aticfx64.dll
2012-04-26 01:51 - 2011-07-12 18:16 - 00503808 ____A (AMD) C:\Windows\System32\atieclxx.exe
2012-04-26 01:51 - 2011-07-12 18:16 - 00442368 ____A (Advanced Micro Devices, Inc.) C:\Windows\System32\ATIDEMGX.dll
2012-04-26 01:50 - 2011-07-12 18:16 - 00237056 ____A (AMD) C:\Windows\System32\atiesrxx.exe
2012-04-26 01:48 - 2012-04-26 01:48 - 00120320 ____A (AMD) C:\Windows\System32\atitmm64.dll
2012-04-26 01:48 - 2012-04-26 01:48 - 00021504 ____A (AMD) C:\Windows\System32\atimuixx.dll
2012-04-26 01:47 - 2011-07-12 18:16 - 06798848 ____A (Advanced Micro Devices, Inc. ) C:\Windows\SysWOW64\atidxx32.dll
2012-04-26 01:34 - 2012-04-26 01:34 - 26181632 ____A (Advanced Micro Devices, Inc.) C:\Windows\System32\atio6axx.dll
2012-04-26 01:28 - 2011-03-30 13:17 - 00064000 ____A (AMD) C:\Windows\System32\coinst.dll
2012-04-26 01:25 - 2011-03-30 13:16 - 07476736 ____A (Advanced Micro Devices, Inc. ) C:\Windows\System32\atidxx64.dll
2012-04-26 01:14 - 2012-04-26 01:14 - 19753472 ____A (Advanced Micro Devices, Inc.) C:\Windows\SysWOW64\atioglxx.dll
2012-04-26 00:59 - 2011-03-30 13:16 - 06202880 ____A (Advanced Micro Devices, Inc. ) C:\Windows\SysWOW64\atiumdag.dll
2012-04-26 00:55 - 2012-04-26 00:55 - 01053184 ____A (Advanced Micro Devices, Inc. ) C:\Windows\System32\atiumd6v.dll
2012-04-26 00:54 - 2012-04-26 00:54 - 01960448 ____A (Advanced Micro Devices, Inc. ) C:\Windows\SysWOW64\atiumdmv.dll
2012-04-26 00:54 - 2011-03-30 13:16 - 04516352 ____A (Advanced Micro Devices, Inc. ) C:\Windows\System32\atiumd6a.dll
2012-04-26 00:52 - 2012-04-26 00:52 - 16096768 ____A (Advanced Micro Devices Inc.) C:\Windows\System32\aticaldd64.dll
2012-04-26 00:52 - 2012-04-26 00:52 - 02631008 ____A C:\Windows\System32\atiumd6a.cap
2012-04-26 00:52 - 2012-04-26 00:52 - 00204952 ____A C:\Windows\SysWOW64\ativvsvl.dat
2012-04-26 00:52 - 2012-04-26 00:52 - 00204952 ____A C:\Windows\System32\ativvsvl.dat
2012-04-26 00:52 - 2012-04-26 00:52 - 00157144 ____A C:\Windows\SysWOW64\ativvsva.dat
2012-04-26 00:52 - 2012-04-26 00:52 - 00157144 ____A C:\Windows\System32\ativvsva.dat
2012-04-26 00:52 - 2012-04-26 00:52 - 00051200 ____A (Advanced Micro Devices Inc.) C:\Windows\System32\aticalrt64.dll
2012-04-26 00:52 - 2012-04-26 00:52 - 00046080 ____A (Advanced Micro Devices Inc.) C:\Windows\SysWOW64\aticalrt.dll
2012-04-26 00:52 - 2012-04-26 00:52 - 00044544 ____A (Advanced Micro Devices Inc.) C:\Windows\System32\aticalcl64.dll
2012-04-26 00:52 - 2012-04-26 00:52 - 00044032 ____A (Advanced Micro Devices Inc.) C:\Windows\SysWOW64\aticalcl.dll
2012-04-26 00:47 - 2012-04-26 00:47 - 13770752 ____A (Advanced Micro Devices Inc.) C:\Windows\SysWOW64\aticaldd.dll
2012-04-26 00:47 - 2011-03-30 13:17 - 05005824 ____A (Advanced Micro Devices, Inc. ) C:\Windows\SysWOW64\atiumdva.dll
2012-04-26 00:47 - 2011-03-30 13:16 - 07431168 ____A (Advanced Micro Devices, Inc. ) C:\Windows\System32\atiumd64.dll
2012-04-26 00:45 - 2012-04-26 00:45 - 02664704 ____A C:\Windows\SysWOW64\atiumdva.cap
2012-04-26 00:33 - 2012-04-26 00:33 - 00360448 ____A (Advanced Micro Devices, Inc.) C:\Windows\SysWOW64\atiadlxy.dll
2012-04-26 00:33 - 2012-04-26 00:33 - 00041984 ____A (Advanced Micro Devices, Inc. ) C:\Windows\System32\atig6txx.dll
2012-04-26 00:33 - 2012-04-26 00:33 - 00017408 ____A (Advanced Micro Devices, Inc. ) C:\Windows\System32\atig6pxx.dll
2012-04-26 00:33 - 2012-04-26 00:33 - 00014848 ____A (Advanced Micro Devices, Inc. ) C:\Windows\SysWOW64\atiglpxx.dll
2012-04-26 00:33 - 2012-04-26 00:33 - 00014848 ____A (Advanced Micro Devices, Inc. ) C:\Windows\System32\atiglpxx.dll
2012-04-26 00:33 - 2011-07-12 18:16 - 00514560 ____A (Advanced Micro Devices, Inc.) C:\Windows\System32\atiadlxx.dll
2012-04-26 00:32 - 2012-04-26 00:32 - 00339456 ____A (Advanced Micro Devices, Inc.) C:\Windows\System32\Drivers\atikmpag.sys
2012-04-26 00:32 - 2012-04-26 00:32 - 00033280 ____A (Advanced Micro Devices, Inc. ) C:\Windows\SysWOW64\atigktxx.dll
2012-04-26 00:31 - 2011-07-12 18:16 - 00041984 ____A (Advanced Micro Devices, Inc. ) C:\Windows\SysWOW64\atiuxpag.dll
2012-04-26 00:31 - 2011-03-30 13:17 - 00054784 ____A (Advanced Micro Devices, Inc. ) C:\Windows\System32\atiuxp64.dll
2012-04-26 00:31 - 2011-03-30 13:16 - 00044544 ____A (Advanced Micro Devices, Inc. ) C:\Windows\System32\atiu9p64.dll
2012-04-26 00:31 - 2011-03-30 13:16 - 00032256 ____A (Advanced Micro Devices, Inc. ) C:\Windows\SysWOW64\atiu9pag.dll
2012-04-26 00:30 - 2012-04-26 00:30 - 00053248 ____A (Advanced Micro Devices, Inc.) C:\Windows\System32\Drivers\ati2erec.dll
2012-04-26 00:29 - 2012-04-26 00:29 - 00056832 ____A (Advanced Micro Devices, Inc. ) C:\Windows\SysWOW64\atimpc32.dll
2012-04-26 00:29 - 2012-04-26 00:29 - 00056832 ____A (Advanced Micro Devices, Inc. ) C:\Windows\SysWOW64\amdpcom32.dll
2012-04-26 00:29 - 2012-04-26 00:29 - 00056320 ____A (Advanced Micro Devices, Inc. ) C:\Windows\System32\atimpc64.dll
2012-04-26 00:29 - 2012-04-26 00:29 - 00056320 ____A (Advanced Micro Devices, Inc. ) C:\Windows\System32\amdpcom64.dll
2012-04-25 21:41 - 2012-06-14 07:04 - 00149504 ____A (Microsoft Corporation) C:\Windows\System32\rdpcorekmts.dll
2012-04-25 21:41 - 2012-06-14 07:04 - 00077312 ____A (Microsoft Corporation) C:\Windows\System32\rdpwsx.dll
2012-04-25 21:34 - 2012-06-14 07:04 - 00009216 ____A (Microsoft Corporation) C:\Windows\System32\rdrmemptylst.exe
2012-04-23 21:37 - 2012-06-14 07:04 - 01462272 ____A (Microsoft Corporation) C:\Windows\System32\crypt32.dll
2012-04-23 21:37 - 2012-06-14 07:04 - 00184320 ____A (Microsoft Corporation) C:\Windows\System32\cryptsvc.dll
2012-04-23 21:37 - 2012-06-14 07:04 - 00140288 ____A (Microsoft Corporation) C:\Windows\System32\cryptnet.dll
2012-04-23 20:36 - 2012-06-14 07:04 - 01158656 ____A (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll
2012-04-23 20:36 - 2012-06-14 07:04 - 00140288 ____A (Microsoft Corporation) C:\Windows\SysWOW64\cryptsvc.dll
2012-04-23 20:36 - 2012-06-14 07:04 - 00103936 ____A (Microsoft Corporation) C:\Windows\SysWOW64\cryptnet.dll
2012-04-18 19:44 - 2011-06-20 16:44 - 00000000 ____D C:\users\Allen Home Office
2012-04-18 18:58 - 2012-04-18 18:55 - 06233460 ____A C:\Users\Allen Home Office\Downloads\CDi.pps
2012-04-18 17:56 - 2012-04-18 17:56 - 00094208 ____A (Apple Inc.) C:\Windows\SysWOW64\QuickTimeVR.qtx
2012-04-18 17:56 - 2012-04-18 17:56 - 00069632 ____A (Apple Inc.) C:\Windows\SysWOW64\QuickTime.qts
2012-04-18 17:40 - 2012-04-18 16:53 - 00000000 ____D C:\Users\Allen Home Office\AppData\Roaming\vlc
2012-04-18 16:53 - 2012-04-18 16:53 - 00000000 ____D C:\Program Files (x86)\VideoLAN
2012-04-07 04:31 - 2012-06-14 07:04 - 03216384 ____A (Microsoft Corporation) C:\Windows\System32\msi.dll
2012-04-07 03:26 - 2012-06-14 07:04 - 02342400 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msi.dll
2012-04-04 12:56 - 2012-06-29 19:56 - 00024904 ____A (Malwarebytes Corporation) C:\Windows\System32\Drivers\mbam.sys
ZeroAccess:
C:\Windows\Installer\{45dc7bf2-8cf7-f4a5-e3aa-4dab29bc091b}
C:\Windows\Installer\{45dc7bf2-8cf7-f4a5-e3aa-4dab29bc091b}\@
C:\Windows\Installer\{45dc7bf2-8cf7-f4a5-e3aa-4dab29bc091b}\L
C:\Windows\Installer\{45dc7bf2-8cf7-f4a5-e3aa-4dab29bc091b}\U
C:\Windows\Installer\{45dc7bf2-8cf7-f4a5-e3aa-4dab29bc091b}\U\800000cb.@
ZeroAccess:
C:\Users\Allen Home Office\AppData\Local\{45dc7bf2-8cf7-f4a5-e3aa-4dab29bc091b}
C:\Users\Allen Home Office\AppData\Local\{45dc7bf2-8cf7-f4a5-e3aa-4dab29bc091b}\@
C:\Users\Allen Home Office\AppData\Local\{45dc7bf2-8cf7-f4a5-e3aa-4dab29bc091b}\L
C:\Users\Allen Home Office\AppData\Local\{45dc7bf2-8cf7-f4a5-e3aa-4dab29bc091b}\U
========================= Known DLLs (Whitelisted) ============

========================= Bamital & volsnap Check ============
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe FCB084FA3DCB7449F3BAA13312A215B4 ZeroAccess <==== ATTENTION!.
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
==================== EXE ASSOCIATION =====================
HKLM\...\.exe: exefile => OK
HKLM\...\exefile\DefaultIcon: %1 => OK
HKLM\...\exefile\open\command: "%1" %* => OK
========================= Memory info ======================
Percentage of memory in use: 12%
Total physical RAM: 8191.29 MB
Available physical RAM: 7165.61 MB
Total Pagefile: 8189.43 MB
Available Pagefile: 7135.05 MB
Total Virtual: 8192 MB
Available Virtual: 8191.9 MB
======================= Partitions =========================
1 Drive c: (OS) (Fixed) (Total:919.3 GB) (Free:668.88 GB) NTFS
2 Drive e: (HP_RECOVERY) (Fixed) (Total:12.11 GB) (Free:1.48 GB) NTFS
3 Drive f: (KRD10) (CDROM) (Total:0.26 GB) (Free:0 GB) CDFS
4 Drive g: () (Removable) (Total:0.93 GB) (Free:0.92 GB) FAT
9 Drive x: (Boot) (Fixed) (Total:0.03 GB) (Free:0.03 GB) NTFS
10 Drive y: (SYSTEM) (Fixed) (Total:0.1 GB) (Free:0.07 GB) NTFS ==>[System with boot components (obtained from reading drive)]
Disk ### Status Size Free Dyn Gpt
-------- ------------- ------- ------- --- ---
Disk 0 Online 931 GB 0 B
Disk 1 Online 956 MB 0 B
Disk 2 No Media 0 B 0 B
Disk 3 No Media 0 B 0 B
Disk 4 No Media 0 B 0 B
Disk 5 No Media 0 B 0 B
Partitions of Disk 0:
===============
Partition ### Type Size Offset
------------- ---------------- ------- -------
Partition 1 Primary 100 MB 1024 KB
Partition 2 Primary 919 GB 101 MB
Partition 3 Primary 12 GB 919 GB
======================================================================================================
Disk: 0
Partition 1
Type : 07
Hidden: No
Active: Yes
Volume ### Ltr Label Fs Type Size Status Info
---------- --- ----------- ----- ---------- ------- --------- --------
* Volume 1 Y SYSTEM NTFS Partition 100 MB Healthy
======================================================================================================
Disk: 0
Partition 2
Type : 07
Hidden: No
Active: No
Volume ### Ltr Label Fs Type Size Status Info
---------- --- ----------- ----- ---------- ------- --------- --------
* Volume 2 C OS NTFS Partition 919 GB Healthy
======================================================================================================
Disk: 0
Partition 3
Type : 07
Hidden: No
Active: No
Volume ### Ltr Label Fs Type Size Status Info
---------- --- ----------- ----- ---------- ------- --------- --------
* Volume 3 E HP_RECOVERY NTFS Partition 12 GB Healthy
======================================================================================================
Partitions of Disk 1:
===============
Partition ### Type Size Offset
------------- ---------------- ------- -------
Partition 1 Primary 955 MB 16 KB
======================================================================================================
Disk: 1
Partition 1
Type : 06
Hidden: No
Active: Yes
Volume ### Ltr Label Fs Type Size Status Info
---------- --- ----------- ----- ---------- ------- --------- --------
* Volume 4 G FAT Removable 955 MB Healthy
======================================================================================================
==========================================================
Last Boot: 2012-06-28 05:20
======================= End Of Log ==========================
 
In Vista or Windows 7: Boot to System Recovery Options and run FRST.
In Windows XP: Please boot to UBCD and run FRST.
Type the following in the edit box after "Search:".

services.exe

Click Search button and post the log (Search.txt) it makes to your reply.
 
Farbar Recovery Scan Tool Version: 28-06-2012 02
Ran by SYSTEM at 2012-06-29 23:43:26
Running from G:\
================== Search: "services.exe" ===================
C:\Windows\winsxs\amd64_microsoft-windows-s..s-servicecontroller_31bf3856ad364e35_6.1.7600.16385_none_2b54b20ee6fa07b1\services.exe
[2009-07-13 15:19] - [2009-07-13 17:39] - 0328704 ____A (Microsoft Corporation) 24ACB7E5BE595468E3B9AA488B9B4FCB
C:\Windows\System32\services.exe
[2009-07-13 15:19] - [2012-06-28 16:17] - 0328704 ____A (Microsoft Corporation) FCB084FA3DCB7449F3BAA13312A215B4
====== End Of Search ======
 
Download attached fixlist.txt file and save it to the very same USB flash drive you've been using. Plug the drive back in.

NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system

On Vista or Windows 7: Now please enter System Recovery Options.
On Windows XP: Now please boot into the UBCD.
Run FRST/FRST64 and press the Fix button just once and wait.
The tool will make a log on the flashdrive (Fixlog.txt) please post it to your reply.

Next....

See if you can boot normally.

If so...

Please download ComboFix from Here, Here or Here to your Desktop.

**Note: In the event you already have Combofix, this is a new version that I need you to download. It is important that it is saved directly to your desktop**
  • Never rename Combofix unless instructed.
  • Close any open browsers.
  • Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
  • Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before performing a scan. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
  • Click on this link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.
  • Close any open browsers.
  • WARNING: Combofix will disconnect your machine from the Internet as soon as it starts
  • Please do not attempt to re-connect your machine back to the Internet until Combofix has completely finished.
  • If there is no internet connection after running Combofix, then restart your computer to restore back your connection.
  • Double click on combofix.exe & follow the prompts.

  • NOTE1. If Combofix asks you to install Recovery Console, please allow it.
    NOTE 2. If Combofix asks you to update the program, always do so.
  • When finished, it will produce a report for you.
  • Please post the "C:\ComboFix.txt"
**Note 1: Do not mouseclick combofix's window while it's running. That may cause it to stall
**Note 2 for AVG and CA Internet Security (Total Defense Internet Security) users: ComboFix will not run until AVG/CA Internet Security is uninstalled as a protective measure against the anti-virus. This is because AVG/CA Internet Security "falsely" detects ComboFix (or its embedded files) as a threat and may remove them resulting in the tool not working correctly which in turn can cause "unpredictable results". Since AVG/CA Internet Security cannot be effectively disabled before running ComboFix, the author recommends you to uninstall AVG/CA Internet Security first.
Use AppRemover to uninstall it: https://www.techspot.com/downloads/5514-appremover.html
We can reinstall it when we're done with CF.
**Note 3: If you receive an error "Illegal operation attempted on a registery key that has been marked for deletion", restart computer to fix the issue.
**Note 4: Some infections may take some significant time to be cured. As long as your computer clock is running Combofix is still working. Be patient.


Make sure, you re-enable your security programs, when you're done with Combofix.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

NOTE.
If, for some reason, Combofix refuses to run, try one of the following:

1. Run Combofix from Safe Mode.

2. Delete Combofix file, download fresh one, but rename combofix.exe to your_name.exe BEFORE saving it to your desktop.
Do NOT run it yet.
Please download and run the below tool named Rkill (courtesy of BleepingComputer.com) which may help allow other programs to run.
There are 4 different versions. If one of them won't run then download and try to run the other one.
Vista and Win7 users need to right click Rkill and choose Run as Administrator
You only need to get one of these to run, not all of them. You may get warnings from your antivirus about this tool, ignore them or shutdown your antivirus.

* Rkill.com
* Rkill.scr
* Rkill.exe
  • Double-click on the Rkill icon to run the tool.
  • If using Vista or Windows 7 right-click on it and choose Run As Administrator.
  • A black DOS box will briefly flash and then disappear. This is normal and indicates the tool ran successfully.
  • If not, delete the file, then download and use the one provided in Link 2.
  • If it does not work, repeat the process and attempt to use one of the remaining links until the tool runs.
  • Do not reboot until instructed.
  • If the tool does not run from any of the links provided, please let me know.
Once you've gotten one of them to run, immediately run your_name.exe by double clicking on it.

If normal mode still doesn't work, run BOTH tools from safe mode.

In case #2, please post BOTH logs, rKill and Combofix.

DO NOT make any other changes to your computer (like installing programs, using other cleaning tools, etc.), until it's officially declared clean!!!
 

Attachments

  • fixlist.txt
    1.8 KB · Views: 3
Able to reboot and computer is not restarting. Here is the Fixlog.txt. Running ComboFix now.

Fix result of Farbar Recovery Tool (FRST written by Farbar) Version: 28-06-2012 02
Ran by SYSTEM at 2012-06-30 10:40:21 Run:1
Running from G:\
==============================================
HKEY_LOCAL_MACHINE\System\ControlSet001\Control\Session Manager\SubSystems\\Windows Value was restored successfully .
C:\Windows\System32\consrv.dll not found.
HKEY_LOCAL_MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\\ Default Value restored successfully.
C:\Windows\System32\services.exe.0433AE5091C91772 moved successfully.
C:\Windows\System32\services.exe.B15E0C318C0FCDF4 moved successfully.
C:\Windows\System32\services.exe.94CB53B0135B6A24 moved successfully.
C:\Windows\System32\services.exe.EBA06CAD10D3AD39 moved successfully.
C:\Windows\System32\services.exe.5A9C54D5505C6E19 moved successfully.
C:\Windows\System32\services.exe.52153FA17F559C4D moved successfully.
C:\Windows\System32\services.exe.5E2EA368C3AB9C95 moved successfully.
C:\Windows\System32\services.exe.DB17D8DF47318A62 moved successfully.
C:\Windows\System32\services.exe.60C3126BA8F54837 moved successfully.
C:\Windows\System32\services.exe.AD32122A40A2C768 moved successfully.
C:\Windows\System32\services.exe.732ACF4C94138B14 moved successfully.
C:\Windows\Installer\{45dc7bf2-8cf7-f4a5-e3aa-4dab29bc091b} moved successfully.
C:\Users\Allen Home Office\AppData\Local\{45dc7bf2-8cf7-f4a5-e3aa-4dab29bc091b} moved successfully.
C:\Windows\System32\services.exe moved successfully.
C:\Windows\winsxs\amd64_microsoft-windows-s..s-servicecontroller_31bf3856ad364e35_6.1.7600.16385_none_2b54b20ee6fa07b1\services.exe copied successfully to C:\Windows\System32\services.exe
==== End of Fixlog ====
 
Here is the ComboFix log.

ComboFix 12-06-28.03 - Allen Home Office 06/30/2012 10:59:26.1.6 - x64
Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.8191.6326 [GMT -5:00]
Running from: c:\users\Allen Home Office\Desktop\ComboFix.exe
* Created a new restore point
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\users\Lesley\AppData\Local\Microsoft\Windows\Temporary Internet Files\{0C7764EE-2B1A-4B54-9F33-61B3D1DFFB4A}.xps
c:\users\Lesley\AppData\Local\Microsoft\Windows\Temporary Internet Files\{653F203E-8AD7-4253-9C29-01A61F5DDBD6}.xps
c:\users\Lesley\AppData\Local\Microsoft\Windows\Temporary Internet Files\{69E5E7A2-139A-444F-A96D-F67FA087BEFB}.xps
c:\users\Lesley\AppData\Local\Microsoft\Windows\Temporary Internet Files\{936EB1F3-3AA1-4CFC-9EEA-7BEA879E5CBD}.xps
c:\users\Lesley\AppData\Local\Microsoft\Windows\Temporary Internet Files\{E5D1FE2B-12DE-4266-AF91-0A69A906BB5A}.xps
c:\users\Lesley\g2mdlhlpx.exe
.
.
((((((((((((((((((((((((( Files Created from 2012-05-28 to 2012-06-30 )))))))))))))))))))))))))))))))
.
.
2012-06-30 16:08 . 2012-06-30 16:08 69000 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{0232E459-E253-428A-BB4B-8E7623AE348E}\offreg.dll
2012-06-30 16:05 . 2012-06-30 16:05 -------- d-----w- c:\users\Lesley\AppData\Local\temp
2012-06-30 16:05 . 2012-06-30 16:05 -------- d-----w- c:\users\Default\AppData\Local\temp
2012-06-30 15:52 . 2012-05-31 02:04 9013136 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{0232E459-E253-428A-BB4B-8E7623AE348E}\mpengine.dll
2012-06-30 15:48 . 2012-06-30 15:48 -------- d-----w- c:\users\Allen Home Office\AppData\Roaming\HPAppData
2012-06-30 07:24 . 2012-06-30 07:25 -------- d-----w- C:\FRST
2012-06-30 03:56 . 2012-06-30 03:56 -------- d-----w- c:\users\Allen Home Office\AppData\Roaming\Malwarebytes
2012-06-30 03:56 . 2012-06-30 03:56 -------- d-----w- c:\programdata\Malwarebytes
2012-06-30 03:56 . 2012-04-04 20:56 24904 ----a-w- c:\windows\system32\drivers\mbam.sys
2012-06-30 03:56 . 2012-06-30 03:56 -------- d-----w- c:\program files (x86)\Malwarebytes' Anti-Malware
2012-06-28 22:23 . 2012-06-28 22:23 927800 ------w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{7C5378BA-216A-4A57-A0D7-49915FF5DBAB}\gapaengine.dll
2012-06-28 22:23 . 2012-05-31 02:04 9013136 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
2012-06-28 22:22 . 2012-06-28 22:22 -------- d-----w- c:\program files (x86)\Microsoft Security Client
2012-06-28 22:22 . 2012-06-28 22:22 -------- d-----w- c:\program files\Microsoft Security Client
2012-06-28 22:02 . 2012-05-04 11:00 366592 ----a-w- c:\windows\system32\qdvd.dll
2012-06-28 22:02 . 2012-05-04 09:59 514560 ----a-w- c:\windows\SysWow64\qdvd.dll
2012-06-28 21:22 . 2012-06-29 00:41 -------- d---a-w- C:\Kaspersky Rescue Disk 10.0
2012-06-28 21:15 . 2012-06-28 21:15 -------- d-----w- c:\windows\Hewlett-Packard
2012-06-28 21:00 . 2012-06-28 21:01 -------- d-----w- c:\programdata\Visan
2012-06-28 20:59 . 2012-06-28 20:59 -------- d-----w- c:\programdata\WEBREG
2012-06-28 20:46 . 2012-06-28 20:46 -------- d-----w- c:\users\Allen Home Office\AppData\Local\HP
2012-06-28 20:38 . 2012-06-28 20:38 -------- d-----w- c:\programdata\HP Product Assistant
2012-06-23 19:11 . 2012-06-23 19:11 -------- d-sh--w- c:\windows\system32\%APPDATA%
2012-06-18 23:08 . 2012-06-02 22:19 57880 ----a-w- c:\windows\system32\wuauclt.exe
2012-06-18 23:08 . 2012-06-02 22:19 44056 ----a-w- c:\windows\system32\wups2.dll
2012-06-18 23:08 . 2012-06-02 22:15 2622464 ----a-w- c:\windows\system32\wucltux.dll
2012-06-18 23:08 . 2012-06-02 22:19 2428952 ----a-w- c:\windows\system32\wuaueng.dll
2012-06-18 23:07 . 2012-06-02 22:19 38424 ----a-w- c:\windows\system32\wups.dll
2012-06-18 23:07 . 2012-06-02 22:19 701976 ----a-w- c:\windows\system32\wuapi.dll
2012-06-18 23:07 . 2012-06-02 22:15 99840 ----a-w- c:\windows\system32\wudriver.dll
2012-06-18 23:07 . 2012-06-02 20:19 186752 ----a-w- c:\windows\system32\wuwebv.dll
2012-06-18 23:07 . 2012-06-02 20:15 36864 ----a-w- c:\windows\system32\wuapp.exe
2012-06-18 18:19 . 2012-06-18 18:19 -------- d-----w- c:\program files (x86)\YouTube Downloader Toolbar
2012-06-18 18:19 . 2012-06-18 18:19 -------- d-----w- c:\program files (x86)\Common Files\Spigot
2012-06-18 18:19 . 2012-06-18 18:19 -------- d-----w- c:\program files (x86)\Application Updater
2012-06-14 15:04 . 2012-04-26 05:41 77312 ----a-w- c:\windows\system32\rdpwsx.dll
2012-06-06 04:15 . 2012-06-06 04:15 -------- d-----w- c:\programdata\YTD YouTube Downloader & Converter
2012-06-06 04:15 . 2012-06-06 04:15 -------- d-----w- c:\program files (x86)\GreenTree Applications
2012-06-02 22:31 . 2012-06-02 22:31 -------- d-----w- c:\program files (x86)\Lame For Audacity
2012-06-02 22:29 . 2012-06-03 13:47 -------- d-----w- c:\users\Allen Home Office\AppData\Roaming\Audacity
2012-06-02 22:29 . 2012-06-02 22:29 -------- d-----w- c:\program files (x86)\Audacity
2012-06-02 18:01 . 2012-06-02 18:01 -------- d-----w- c:\windows\en
2012-06-02 17:59 . 2012-03-08 23:40 48488 ----a-w- c:\windows\system32\drivers\fssfltr.sys
2012-06-02 17:56 . 2012-06-02 17:56 15712 ----a-w- c:\program files (x86)\Common Files\Windows Live\.cache\60053071cd40e902\MeshBetaRemover.exe
2012-06-02 17:56 . 2012-06-02 17:56 89944 ----a-w- c:\program files (x86)\Common Files\Windows Live\.cache\5a2c8581cd40e901\DSETUP.dll
2012-06-02 17:56 . 2012-06-02 17:56 537432 ----a-w- c:\program files (x86)\Common Files\Windows Live\.cache\5a2c8581cd40e901\DXSETUP.exe
2012-06-02 17:56 . 2012-06-02 17:56 1801048 ----a-w- c:\program files (x86)\Common Files\Windows Live\.cache\5a2c8581cd40e901\dsetup32.dll
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-06-10 17:13 . 2012-04-09 01:55 426184 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe
2012-06-10 17:13 . 2011-07-13 04:08 70344 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2012-04-26 11:47 . 2012-04-26 11:47 11172864 ----a-w- c:\windows\system32\drivers\atikmdag.sys
2012-04-26 09:56 . 2012-04-26 09:56 159744 ----a-w- c:\windows\system32\atiapfxx.exe
2012-04-26 09:56 . 2011-03-30 21:16 909312 ----a-w- c:\windows\SysWow64\aticfx32.dll
2012-04-26 09:54 . 2011-03-30 21:16 1067520 ----a-w- c:\windows\system32\aticfx64.dll
2012-04-26 09:51 . 2011-07-13 02:16 442368 ----a-w- c:\windows\system32\ATIDEMGX.dll
2012-04-26 09:51 . 2011-07-13 02:16 503808 ----a-w- c:\windows\system32\atieclxx.exe
2012-04-26 09:50 . 2011-07-13 02:16 237056 ----a-w- c:\windows\system32\atiesrxx.exe
2012-04-26 09:48 . 2012-04-26 09:48 120320 ----a-w- c:\windows\system32\atitmm64.dll
2012-04-26 09:48 . 2012-04-26 09:48 21504 ----a-w- c:\windows\system32\atimuixx.dll
2012-04-26 09:47 . 2011-07-13 02:16 6798848 ----a-w- c:\windows\SysWow64\atidxx32.dll
2012-04-26 09:34 . 2012-04-26 09:34 26181632 ----a-w- c:\windows\system32\atio6axx.dll
2012-04-26 09:28 . 2011-03-30 21:17 64000 ----a-w- c:\windows\system32\coinst.dll
2012-04-26 09:25 . 2011-03-30 21:16 7476736 ----a-w- c:\windows\system32\atidxx64.dll
2012-04-26 09:14 . 2012-04-26 09:14 19753472 ----a-w- c:\windows\SysWow64\atioglxx.dll
2012-04-26 08:59 . 2011-03-30 21:16 6202880 ----a-w- c:\windows\SysWow64\atiumdag.dll
2012-04-26 08:55 . 2012-04-26 08:55 1053184 ----a-w- c:\windows\system32\atiumd6v.dll
2012-04-26 08:54 . 2012-04-26 08:54 1960448 ----a-w- c:\windows\SysWow64\atiumdmv.dll
2012-04-26 08:54 . 2011-03-30 21:16 4516352 ----a-w- c:\windows\system32\atiumd6a.dll
2012-04-26 08:52 . 2012-04-26 08:52 51200 ----a-w- c:\windows\system32\aticalrt64.dll
2012-04-26 08:52 . 2012-04-26 08:52 46080 ----a-w- c:\windows\SysWow64\aticalrt.dll
2012-04-26 08:52 . 2012-04-26 08:52 44544 ----a-w- c:\windows\system32\aticalcl64.dll
2012-04-26 08:52 . 2012-04-26 08:52 44032 ----a-w- c:\windows\SysWow64\aticalcl.dll
2012-04-26 08:52 . 2012-04-26 08:52 16096768 ----a-w- c:\windows\system32\aticaldd64.dll
2012-04-26 08:47 . 2012-04-26 08:47 13770752 ----a-w- c:\windows\SysWow64\aticaldd.dll
2012-04-26 08:47 . 2011-03-30 21:17 5005824 ----a-w- c:\windows\SysWow64\atiumdva.dll
2012-04-26 08:47 . 2011-03-30 21:16 7431168 ----a-w- c:\windows\system32\atiumd64.dll
2012-04-26 08:33 . 2011-07-13 02:16 514560 ----a-w- c:\windows\system32\atiadlxx.dll
2012-04-26 08:33 . 2012-04-26 08:33 360448 ----a-w- c:\windows\SysWow64\atiadlxy.dll
2012-04-26 08:33 . 2012-04-26 08:33 17408 ----a-w- c:\windows\system32\atig6pxx.dll
2012-04-26 08:33 . 2012-04-26 08:33 14848 ----a-w- c:\windows\SysWow64\atiglpxx.dll
2012-04-26 08:33 . 2012-04-26 08:33 14848 ----a-w- c:\windows\system32\atiglpxx.dll
2012-04-26 08:33 . 2012-04-26 08:33 41984 ----a-w- c:\windows\system32\atig6txx.dll
2012-04-26 08:32 . 2012-04-26 08:32 33280 ----a-w- c:\windows\SysWow64\atigktxx.dll
2012-04-26 08:32 . 2012-04-26 08:32 339456 ----a-w- c:\windows\system32\drivers\atikmpag.sys
2012-04-26 08:31 . 2011-03-30 21:17 54784 ----a-w- c:\windows\system32\atiuxp64.dll
2012-04-26 08:31 . 2011-07-13 02:16 41984 ----a-w- c:\windows\SysWow64\atiuxpag.dll
2012-04-26 08:31 . 2011-03-30 21:16 44544 ----a-w- c:\windows\system32\atiu9p64.dll
2012-04-26 08:31 . 2011-03-30 21:16 32256 ----a-w- c:\windows\SysWow64\atiu9pag.dll
2012-04-26 08:30 . 2012-04-26 08:30 53248 ----a-w- c:\windows\system32\drivers\ati2erec.dll
2012-04-26 08:29 . 2012-04-26 08:29 56320 ----a-w- c:\windows\system32\atimpc64.dll
2012-04-26 08:29 . 2012-04-26 08:29 56320 ----a-w- c:\windows\system32\amdpcom64.dll
2012-04-26 08:29 . 2012-04-26 08:29 56832 ----a-w- c:\windows\SysWow64\atimpc32.dll
2012-04-26 08:29 . 2012-04-26 08:29 56832 ----a-w- c:\windows\SysWow64\amdpcom32.dll
2012-04-19 01:56 . 2012-04-19 01:56 94208 ----a-w- c:\windows\SysWow64\QuickTimeVR.qtx
2012-04-19 01:56 . 2012-04-19 01:56 69632 ----a-w- c:\windows\SysWow64\QuickTime.qts
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2012-02-14 22:58 94208 ----a-w- c:\users\Allen Home Office\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2012-02-14 22:58 94208 ----a-w- c:\users\Allen Home Office\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2012-02-14 22:58 94208 ----a-w- c:\users\Allen Home Office\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt4]
@="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}]
2012-02-14 22:58 94208 ----a-w- c:\users\Allen Home Office\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2010-11-20 1475584]
"TivoServer"="c:\program files (x86)\TiVo\Desktop\TiVoServer.exe" [2010-08-24 2264336]
"TivoTransfer"="c:\program files (x86)\TiVo\Desktop\TiVoTransfer.exe" [2010-08-24 608528]
"TivoNotify"="c:\program files (x86)\TiVo\Desktop\TiVoNotify.exe" [2010-08-24 437520]
"TranscodingService"="c:\program files (x86)\TiVo\Desktop\Plus\\TranscodingService.exe" [2010-08-24 856336]
"swg"="c:\program files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2011-10-10 39408]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"PDF Complete"="c:\program files (x86)\PDF Complete\pdfsty.exe" [2009-10-14 563736]
"StartCCC"="c:\program files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2011-02-09 336384]
"Adobe Acrobat Speed Launcher"="c:\program files (x86)\Adobe\Acrobat 9.0\Acrobat\Acrobat_sl.exe" [2012-03-27 40376]
"Acrobat Assistant 8.0"="c:\program files (x86)\Adobe\Acrobat 9.0\Acrobat\Acrotray.exe" [2012-03-26 640440]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-01-03 843712]
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2011-06-09 254696]
"LifeCam"="c:\program files (x86)\Microsoft LifeCam\LifeExp.exe" [2010-12-13 135536]
"APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2012-02-21 59240]
"QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" [2012-04-19 421888]
"iTunesHelper"="c:\program files (x86)\iTunes\iTunesHelper.exe" [2012-03-27 421736]
"SearchSettings"="c:\program files (x86)\Common Files\Spigot\Search Settings\SearchSettings.exe" [2012-06-13 1088904]
"HP Software Update"="c:\program files (x86)\HP\HP Software Update\HPWuSchd2.exe" [2011-05-10 49208]
.
c:\users\Allen Home Office\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Dropbox.lnk - c:\users\Allen Home Office\AppData\Roaming\Dropbox\bin\Dropbox.exe [2012-5-24 27112840]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Google Calendar Sync.lnk - c:\program files (x86)\Google\Google Calendar Sync\GoogleCalendarSync.exe [2011-4-8 542264]
HP Digital Imaging Monitor.lnk - c:\program files (x86)\Hp\Digital Imaging\bin\hpqtra08.exe [2009-11-18 275072]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 0 (0x0)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Security Packages REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@="Service"
.
R2 CLKMSVC10_C6F09094;CyberLink Product - 2011/03/30 13:36;c:\program files (x86)\Hewlett-Packard\Media\DVD\Kernel\HDDVD\NavFilter\kmsvc.exe [2010-06-30 245232]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R2 gupdate;Google Update Service (gupdate);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-10-10 136176]
R3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-06-10 257224]
R3 BBSvc;Bing Bar Update Service;c:\program files (x86)\Microsoft\BingBar\BBSvc.EXE [2011-04-01 183560]
R3 gupdatem;Google Update Service (gupdatem);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-10-10 136176]
R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2012-04-04 24904]
R3 NisDrv;Microsoft Network Inspection System;c:\windows\system32\DRIVERS\NisDrvWFP.sys [2012-03-21 98688]
R3 NisSrv;Microsoft Network Inspection;c:\program files\Microsoft Security Client\NisSrv.exe [2012-03-26 291696]
R3 osppsvc;Office Software Protection Platform;c:\program files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-01-10 4925184]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-20 59392]
R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys [2012-02-15 52736]
R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [2011-07-13 1255736]
R3 WSDPrintDevice;WSD Print Support via UMB;c:\windows\system32\DRIVERS\WSDPrint.sys [2009-07-14 23040]
R4 TivoBeacon2;TiVo Beacon Service;c:\program files (x86)\TiVo\Desktop\TiVoBeacon.exe [2010-08-24 1104656]
R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe [2010-09-22 57184]
S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [2009-07-14 59904]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [2012-04-26 237056]
S2 AMD FUEL Service;AMD FUEL Service;c:\program files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [2011-02-09 354304]
S2 AMD Reservation Manager;AMD Reservation Manager;c:\program files\ATI Technologies\ATI.ACE\Reservation Manager\AMD Reservation Manager.exe [2010-06-17 194496]
S2 Application Updater;Application Updater;c:\program files (x86)\Application Updater\ApplicationUpdater.exe [2012-06-13 792512]
S2 CinemaNow Service;CinemaNow Service;c:\program files (x86)\CinemaNow\CinemaNow Media Manager\CinemanowSvc.exe [2010-06-13 400368]
S2 IntuitUpdateServiceV4;Intuit Update Service v4;c:\program files (x86)\Common Files\Intuit\Update Service v4\IntuitUpdateService.exe [2011-08-25 13672]
S2 pdfcDispatcher;PDF Document Manager;c:\program files (x86)\PDF Complete\pdfsvc.exe [2009-10-14 635416]
S2 vpnagent;Cisco AnyConnect VPN Agent;c:\program files (x86)\Cisco\Cisco AnyConnect VPN Client\vpnagent.exe [2011-06-10 641464]
S3 amdiox64;AMD IO Driver;c:\windows\system32\DRIVERS\amdiox64.sys [2010-02-18 46136]
S3 amdkmdag;amdkmdag;c:\windows\system32\DRIVERS\atikmdag.sys [2012-04-26 11172864]
S3 amdkmdap;amdkmdap;c:\windows\system32\DRIVERS\atikmpag.sys [2012-04-26 339456]
S3 AtiHDAudioService;ATI Function Driver for HD Audio Service;c:\windows\system32\drivers\AtihdW76.sys [2011-07-13 115216]
S3 MSHUSBVideo;NX6000/NX3000/VX2000/VX5000/VX5500/VX7000/Cinema Filter Driver;c:\windows\system32\Drivers\nx6000.sys [2010-12-13 36720]
S3 netr28x;Ralink 802.11n Extensible Wireless Driver;c:\windows\system32\DRIVERS\netr28x.sys [2009-12-19 852256]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [2010-03-04 346144]
S3 usbfilter;AMD USB Filter Driver;c:\windows\system32\DRIVERS\usbfilter.sys [2009-12-22 38456]
S3 vwifimp;Microsoft Virtual WiFi Miniport Service;c:\windows\system32\DRIVERS\vwifimp.sys [2009-07-14 17920]
.
.
--- Other Services/Drivers In Memory ---
.
*NewlyCreated* - WS2IFSL
*Deregistered* - CLKMDRV10_C6F09094
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\svchost]
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
.
Contents of the 'Scheduled Tasks' folder
.
2012-06-30 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-09 17:13]
.
2012-06-30 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-10-10 16:27]
.
2012-06-30 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-10-10 16:27]
.
2012-06-28 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1561252055-2272658225-3862106704-1001Core.job
- c:\users\Allen Home Office\AppData\Local\Google\Update\GoogleUpdate.exe [2011-06-21 01:51]
.
2012-06-30 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1561252055-2272658225-3862106704-1001UA.job
- c:\users\Allen Home Office\AppData\Local\Google\Update\GoogleUpdate.exe [2011-06-21 01:51]
.
2012-06-30 c:\windows\Tasks\HP Photo Creations Communicator.job
- c:\programdata\HP Photo Creations\Communicator.exe [2012-06-28 21:01]
.
2012-06-24 c:\windows\Tasks\HPCeeScheduleForLesley.job
- c:\program files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe [2010-01-05 10:53]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2012-02-14 22:58 97792 ----a-w- c:\users\Allen Home Office\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2012-02-14 22:58 97792 ----a-w- c:\users\Allen Home Office\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2012-02-14 22:58 97792 ----a-w- c:\users\Allen Home Office\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt4]
@="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}]
2012-02-14 22:58 97792 ----a-w- c:\users\Allen Home Office\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"hpsysdrv"="c:\program files (x86)\hewlett-packard\HP odometer\hpsysdrv.exe" [2008-11-20 62768]
"SmartMenu"="c:\program files\Hewlett-Packard\HP MediaSmart\SmartMenu.exe" [2010-01-18 568888]
"MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2012-03-26 1271168]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"LoadAppInit_DLLs"=0x0
.
------- Supplementary Scan -------
.
uStart Page = hxxp://drudgereport.com/
uLocal Page = c:\windows\system32\blank.htm
mLocal Page = c:\windows\SysWOW64\blank.htm
uInternet Settings,ProxyOverride = *.local
IE: Append Link Target to Existing PDF - c:\program files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: Append to Existing PDF - c:\program files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert Link Target to Adobe PDF - c:\program files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
IE: Convert to Adobe PDF - c:\program files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECapture.html
IE: E&xport to Microsoft Excel - c:\progra~2\MICROS~1\Office14\EXCEL.EXE/3000
IE: Se&nd to OneNote - c:\progra~2\MICROS~1\Office14\ONBttnIE.dll/105
Trusted Zone: fordav.com\favpn
Trusted Zone: intuit.com\ttlc
TCP: DhcpNameServer = 209.18.47.61 209.18.47.62
DPF: {55963676-2F5E-4BAF-AC28-CF26AA587566} - hxxps://favpn.fordav.com/CACHE/stc/1/binaries/vpnweb.cab
.
- - - - ORPHANS REMOVED - - - -
.
AddRemove-{319E272A-B5DB-4939-99D0-1F1F0C55699E} - c:\program files (x86)\InstallShield Installation Information\{319E272A-B5DB-4939-99D0-1F1F0C55699E}\setup.exe
AddRemove-TiVo Photos 2.0 - c:\windows\system32\javaws.exe
.
.
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\pdfcDispatcher]
"ImagePath"="c:\program files (x86)\PDF Complete\pdfsvc.exe /startedbyscm:66B66708-40E2BE4D-pdfcService"
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_USERS\S-1-5-21-1561252055-2272658225-3862106704-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.eml\UserChoice]
@Denied: (2) (S-1-5-21-1561252055-2272658225-3862106704-1001)
@Denied: (2) (LocalSystem)
"Progid"="Outlook.File.eml.14"
.
[HKEY_USERS\S-1-5-21-1561252055-2272658225-3862106704-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.vcf\UserChoice]
@Denied: (2) (S-1-5-21-1561252055-2272658225-3862106704-1001)
@Denied: (2) (LocalSystem)
"Progid"="Outlook.File.vcf.14"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_3_300_257_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_3_300_257_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_3_300_257.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.11"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_3_300_257.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_3_300_257.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_3_300_257.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Office\Common\Smart Tag\Actions\{B7EFF951-E52F-45CC-9EF7-57124F2177CC}]
@Denied: (A) (Everyone)
"Solution"="{15727DE6-F92D-4E46-ACB4-0E2C58B31A18}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3]
@Denied: (A) (Everyone)
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3\0]
"Key"="ActionsPane3"
"Location"="c:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VSTO\\ActionsPane3.xsd"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
------------------------ Other Running Processes ------------------------
.
c:\program files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
c:\program files (x86)\Common Files\LightScribe\LSSrvc.exe
c:\program files (x86)\Microsoft\BingBar\SeaPort.EXE
c:\program files (x86)\HP\Digital Imaging\bin\hpqSTE08.exe
c:\program files (x86)\HP\Digital Imaging\bin\hpqbam08.exe
c:\program files (x86)\HP\Digital Imaging\bin\hpqgpc01.exe
c:\program files (x86)\Java\jre6\bin\javaw.exe
.
**************************************************************************
.
Completion time: 2012-06-30 11:16:05 - machine was rebooted
ComboFix-quarantined-files.txt 2012-06-30 16:16
.
Pre-Run: 720,741,470,208 bytes free
Post-Run: 726,802,407,424 bytes free
.
- - End Of File - - FBD831749AD6C44D32AB5E61A4BC193C
 
Looks good.

Any current issues?

==============================================

Download Malwarebytes' Anti-Malware (MBAM): http://www.malwarebytes.org/products/malwarebytes_free to your desktop.
NOTE. If you already have MBAM installed, update it before running the scan.

* Double-click mbam-setup.exe and follow the prompts to install the program.
* At the end, be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
* If an update is found, it will download and install the latest version.
* Once the program has loaded, select Perform quick scan, then click Scan.
* When the scan is complete, click OK, then Show Results to view the results.
* Be sure that everything is checked, and click Remove Selected.
* When completed, a log will open in Notepad.
* Post the log back here.

Be sure to restart the computer.

The log can also be found here:
C:\Documents and Settings\Username\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\log-date.txt
Or at C:\Program Files\Malwarebytes' Anti-Malware\Logs\log-date.txt

=======================================

Download OTL to your Desktop.

  • Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
  • Click the Scan All Users checkbox.
  • Under the Custom Scan box paste this in:


netsvcs
drivers32
%SYSTEMDRIVE%\*.*
%systemroot%\Fonts\*.com
%systemroot%\Fonts\*.dll
%systemroot%\Fonts\*.ini
%systemroot%\Fonts\*.ini2
%systemroot%\Fonts\*.exe
%systemroot%\system32\spool\prtprocs\w32x86\*.*
%systemroot%\REPAIR\*.bak1
%systemroot%\REPAIR\*.ini
%systemroot%\system32\*.jpg
%systemroot%\*.jpg
%systemroot%\*.png
%systemroot%\*.scr
%systemroot%\*._sy
%APPDATA%\Adobe\Update\*.*
%ALLUSERSPROFILE%\Favorites\*.*
%APPDATA%\Microsoft\*.*
%PROGRAMFILES%\*.*
%APPDATA%\Update\*.*
%systemroot%\*. /mp /s
CREATERESTOREPOINT
%systemroot%\System32\config\*.sav
%PROGRAMFILES%\bak. /s
%systemroot%\system32\bak. /s
%ALLUSERSPROFILE%\Start Menu\*.lnk /x
%systemroot%\system32\config\systemprofile\*.dat /x
%systemroot%\*.config
%systemroot%\system32\*.db
%APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x
%USERPROFILE%\Desktop\*.exe
%PROGRAMFILES%\Common Files\*.*
%systemroot%\*.src
%systemroot%\install\*.*
%systemroot%\system32\DLL\*.*
%systemroot%\system32\HelpFiles\*.*
%systemroot%\tasks\*.*
%systemroot%\system32\rundll\*.*
%systemroot%\winn32\*.*
%systemroot%\Java\*.*
%systemroot%\system32\test\*.*
%systemroot%\system32\Rundll32\*.*
%systemroot%\AppPatch\Custom\*.*
%APPDATA%\Roaming\Microsoft\Windows\Recent\*.lnk /x
%PROGRAMFILES%\PC-Doctor\Downloads\*.*
%PROGRAMFILES%\Internet Explorer\*.tmp
%PROGRAMFILES%\Internet Explorer\*.dat
%USERPROFILE%\My Documents\*.exe
%USERPROFILE%\*.exe
%systemroot%\ADDINS\*.*
%systemroot%\assembly\*.bak2
%systemroot%\Config\*.*
%systemroot%\REPAIR\*.bak2
%systemroot%\SECURITY\Database\*.sdb /x
%systemroot%\SYSTEM\*.bak2
%systemroot%\Web\*.bak2
%systemroot%\Driver Cache\*.*
%PROGRAMFILES%\Mozilla Firefox\0*.exe
%ProgramFiles%\Microsoft Common\*.*
%ProgramFiles%\TinyProxy.
%USERPROFILE%\Favorites\*.url /x
%systemroot%\system32\*.bk
%systemroot%\*.te
%systemroot%\system32\system32\*.*
%ALLUSERSPROFILE%\*.dat /x
%systemroot%\system32\drivers\*.rmv
dir /b "%systemroot%\system32\*.exe" | find /I " " /c
dir /b "%systemroot%\*.exe" | find /I " " /c
%PROGRAMFILES%\Microsoft\*.*
%systemroot%\System32\Wbem\proquota.exe
%PROGRAMFILES%\Mozilla Firefox\*.dat
%USERPROFILE%\Cookies\*.txt /x
%SystemRoot%\system32\fonts\*.*
%systemroot%\system32\winlog\*.*
%systemroot%\system32\Language\*.*
%systemroot%\system32\Settings\*.*
%systemroot%\system32\*.quo
%SYSTEMROOT%\AppPatch\*.exe
%SYSTEMROOT%\inf\*.exe
%SYSTEMROOT%\Installer\*.exe
%systemroot%\system32\config\*.bak2
%systemroot%\system32\Computers\*.*
%SystemRoot%\system32\Sound\*.*
%SystemRoot%\system32\SpecialImg\*.*
%SystemRoot%\system32\code\*.*
%SystemRoot%\system32\draft\*.*
%SystemRoot%\system32\MSSSys\*.*
%ProgramFiles%\Javascript\*.*
%systemroot%\pchealth\helpctr\System\*.exe /s
%systemroot%\Web\*.exe
%systemroot%\system32\msn\*.*
%systemroot%\system32\*.tro
%AppData%\Microsoft\Installer\msupdates\*.*
%ProgramFiles%\Messenger\*.*
%systemroot%\system32\systhem32\*.*
%systemroot%\system\*.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install\LastSuccessTime /rs
/md5start
/md5stop


  • Click the Quick Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
  • When the scan completes, it will open two notepad windows: OTL.txt and Extras.txt. These are saved in the same location as OTL.
  • Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post them back here.
 
Malwarebytes Anti-Malware (Trial) 1.61.0.1400
www.malwarebytes.org
Database version: v2012.06.30.07
Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 9.0.8112.16421
Allen Home Office :: ALLENHOMEOFFICE [administrator]
Protection: Disabled
6/30/2012 3:12:02 PM
mbam-log-2012-06-30 (15-12-02).txt
Scan type: Quick scan
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
Scan options disabled: P2P
Objects scanned: 234854
Time elapsed: 1 minute(s), 3 second(s)
Memory Processes Detected: 0
(No malicious items detected)
Memory Modules Detected: 0
(No malicious items detected)
Registry Keys Detected: 0
(No malicious items detected)
Registry Values Detected: 0
(No malicious items detected)
Registry Data Items Detected: 0
(No malicious items detected)
Folders Detected: 0
(No malicious items detected)
Files Detected: 0
(No malicious items detected)
(end)
 
OTL logfile created on: 6/30/2012 3:20:59 PM - Run 2
OTL by OldTimer - Version 3.2.53.0 Folder = C:\Users\Allen Home Office\Desktop
64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

8.00 Gb Total Physical Memory | 6.26 Gb Available Physical Memory | 78.30% Memory free
16.00 Gb Paging File | 13.98 Gb Available in Paging File | 87.39% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 919.30 Gb Total Space | 676.99 Gb Free Space | 73.64% Space Free | Partition Type: NTFS
Drive D: | 12.11 Gb Total Space | 1.48 Gb Free Space | 12.22% Space Free | Partition Type: NTFS

Computer Name: ALLENHOMEOFFICE | User Name: Allen Home Office | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Quick Scan | Include 64bit Scans
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2012/06/30 15:19:51 | 000,596,992 | ---- | M] (OldTimer Tools) -- C:\Users\Allen Home Office\Desktop\OTL.exe
PRC - [2012/06/13 17:37:04 | 001,088,904 | ---- | M] (Spigot, Inc.) -- C:\Program Files (x86)\Common Files\Spigot\Search Settings\SearchSettings.exe
PRC - [2012/06/13 17:27:26 | 000,792,512 | ---- | M] (Spigot, Inc.) -- C:\Program Files (x86)\Application Updater\ApplicationUpdater.exe
PRC - [2012/05/24 13:39:22 | 027,112,840 | ---- | M] (Dropbox, Inc.) -- C:\Users\Allen Home Office\AppData\Roaming\Dropbox\bin\Dropbox.exe
PRC - [2012/03/26 09:00:48 | 000,640,440 | ---- | M] (Adobe Systems Inc.) -- C:\Program Files (x86)\Adobe\Acrobat 9.0\Acrobat\acrotray.exe
PRC - [2011/10/03 05:06:15 | 000,145,184 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files (x86)\Java\jre6\bin\javaw.exe
PRC - [2011/08/25 18:53:00 | 000,013,672 | ---- | M] (Intuit Inc.) -- C:\Program Files (x86)\Common Files\Intuit\Update Service v4\IntuitUpdateService.exe
PRC - [2011/06/10 15:54:55 | 000,641,464 | ---- | M] (Cisco Systems, Inc.) -- C:\Program Files (x86)\Cisco\Cisco AnyConnect VPN Client\vpnagent.exe
PRC - [2011/06/09 13:06:06 | 000,507,624 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe
PRC - [2011/04/08 07:50:02 | 000,542,264 | ---- | M] (Google) -- C:\Program Files (x86)\Google\Google Calendar Sync\GoogleCalendarSync.exe
PRC - [2011/03/28 11:21:16 | 000,249,648 | ---- | M] (Microsoft Corporation) -- C:\Program Files (x86)\Microsoft\BingBar\SeaPort.EXE
PRC - [2010/08/24 18:02:20 | 000,608,528 | ---- | M] (TiVo Inc.) -- C:\Program Files (x86)\TiVo\Desktop\TiVoTransfer.exe
PRC - [2010/08/24 18:02:18 | 002,264,336 | ---- | M] (TiVo Inc.) -- C:\Program Files (x86)\TiVo\Desktop\TiVoServer.exe
PRC - [2010/08/24 18:02:14 | 000,437,520 | ---- | M] (TiVo Inc.) -- C:\Program Files (x86)\TiVo\Desktop\TiVoNotify.exe
PRC - [2010/06/12 20:06:08 | 000,400,368 | ---- | M] (CinemaNow, Inc.) -- C:\Program Files (x86)\CinemaNow\CinemaNow Media Manager\CinemaNowSvc.exe
PRC - [2010/01/18 12:21:08 | 000,568,888 | ---- | M] () -- C:\Program Files\Hewlett-Packard\HP MediaSmart\SmartMenu.exe
PRC - [2009/10/14 17:53:20 | 000,635,416 | ---- | M] (PDF Complete Inc) -- C:\Program Files (x86)\PDF Complete\pdfsvc.exe
PRC - [2008/11/20 12:47:28 | 000,062,768 | ---- | M] (Hewlett-Packard) -- C:\Program Files (x86)\Hewlett-Packard\HP Odometer\hpsysdrv.exe


========== Modules (No Company Name) ==========

MOD - [2011/06/24 22:56:36 | 000,087,328 | ---- | M] () -- C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll
MOD - [2011/06/24 22:56:14 | 001,241,888 | ---- | M] () -- C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll
MOD - [2010/08/24 17:40:42 | 000,259,584 | ---- | M] () -- C:\Program Files (x86)\TiVo\Desktop\Id3Lib.dll
MOD - [2010/05/17 23:52:16 | 000,684,032 | ---- | M] () -- C:\Program Files (x86)\TiVo\Desktop\LibEay32.dll
MOD - [2010/05/17 23:52:16 | 000,155,648 | ---- | M] () -- C:\Program Files (x86)\TiVo\Desktop\SslEay32.dll
MOD - [2010/05/17 23:51:14 | 000,716,800 | ---- | M] () -- C:\Program Files (x86)\TiVo\Desktop\loudmouth.dll
MOD - [2010/01/18 12:21:08 | 000,568,888 | ---- | M] () -- C:\Program Files\Hewlett-Packard\HP MediaSmart\SmartMenu.exe
MOD - [2003/01/30 08:04:00 | 000,618,496 | ---- | M] () -- C:\Program Files (x86)\TiVo\Desktop\StlpMt45.dll


========== Win32 Services (SafeList) ==========

SRV:64bit: - [2012/04/26 04:50:18 | 000,237,056 | ---- | M] (AMD) [Auto | Running] -- C:\Windows\SysNative\atiesrxx.exe -- (AMD External Events Utility)
SRV:64bit: - [2012/03/26 18:49:56 | 000,291,696 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- c:\Program Files\Microsoft Security Client\NisSrv.exe -- (NisSrv)
SRV:64bit: - [2012/03/26 18:49:56 | 000,012,600 | ---- | M] (Microsoft Corporation) [Auto | Running] -- c:\Program Files\Microsoft Security Client\MsMpEng.exe -- (MsMpSvc)
SRV:64bit: - [2011/02/08 22:13:54 | 000,354,304 | ---- | M] (Advanced Micro Devices, Inc.) [Auto | Running] -- C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe -- (AMD FUEL Service)
SRV:64bit: - [2010/12/13 15:37:16 | 000,194,416 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Microsoft LifeCam\MSCamS64.exe -- (MSCamSvc)
SRV:64bit: - [2010/09/22 18:10:10 | 000,057,184 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Program Files\Windows Live\Mesh\wlcrasvc.exe -- (wlcrasvc)
SRV:64bit: - [2010/06/17 05:23:36 | 000,194,496 | ---- | M] (Advanced Micro Devices) [Auto | Running] -- C:\Program Files\ATI Technologies\ATI.ACE\Reservation Manager\AMD Reservation Manager.exe -- (AMD Reservation Manager)
SRV:64bit: - [2009/07/13 20:41:27 | 001,011,712 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)
SRV - [2012/06/13 17:27:26 | 000,792,512 | ---- | M] (Spigot, Inc.) [Auto | Running] -- C:\Program Files (x86)\Application Updater\ApplicationUpdater.exe -- (Application Updater)
SRV - [2012/06/10 12:13:59 | 000,257,224 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)
SRV - [2011/08/25 18:53:00 | 000,013,672 | ---- | M] (Intuit Inc.) [Auto | Running] -- C:\Program Files (x86)\Common Files\Intuit\Update Service v4\IntuitUpdateService.exe -- (IntuitUpdateServiceV4)
SRV - [2011/07/17 20:53:40 | 000,651,720 | ---- | M] (Macrovision Europe Ltd.) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe -- (FLEXnet Licensing Service)
SRV - [2011/06/10 15:54:55 | 000,641,464 | ---- | M] (Cisco Systems, Inc.) [Auto | Running] -- C:\Program Files (x86)\Cisco\Cisco AnyConnect VPN Client\vpnagent.exe -- (vpnagent)
SRV - [2011/04/01 11:14:30 | 000,183,560 | ---- | M] (Microsoft Corporation.) [On_Demand | Stopped] -- C:\Program Files (x86)\Microsoft\BingBar\BBSvc.EXE -- (BBSvc)
SRV - [2011/03/28 11:21:16 | 000,249,648 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files (x86)\Microsoft\BingBar\SeaPort.EXE -- (SeaPort)
SRV - [2010/10/22 13:08:18 | 001,039,360 | ---- | M] (Hewlett-Packard Co.) [Auto | Running] -- C:\Program Files (x86)\Hp\Digital Imaging\bin\HPSLPSVC64.DLL -- (HPSLPSVC)
SRV - [2010/08/24 18:02:08 | 001,104,656 | ---- | M] (TiVo Inc.) [Disabled | Stopped] -- C:\Program Files (x86)\TiVo\Desktop\TiVoBeacon.exe -- (TivoBeacon2)
SRV - [2010/06/29 22:51:12 | 000,245,232 | ---- | M] (CyberLink) [Auto | Stopped] -- C:\Program Files (x86)\Hewlett-Packard\Media\DVD\Kernel\HDDVD\NavFilter\kmsvc.exe -- (CLKMSVC10_C6F09094)
SRV - [2010/06/12 20:06:08 | 000,400,368 | ---- | M] (CinemaNow, Inc.) [Auto | Running] -- C:\Program Files (x86)\CinemaNow\CinemaNow Media Manager\CinemaNowSvc.exe -- (CinemaNow Service)
SRV - [2010/04/03 18:01:24 | 000,246,520 | ---- | M] (WildTangent, Inc.) [On_Demand | Stopped] -- C:\Program Files (x86)\HP Games\HP Game Console\GameConsoleService.exe -- (GameConsoleService)
SRV - [2010/03/18 13:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)
SRV - [2009/10/14 17:53:20 | 000,635,416 | ---- | M] (PDF Complete Inc) [Auto | Running] -- C:\Program Files (x86)\PDF Complete\pdfsvc.exe -- (pdfcDispatcher)
SRV - [2009/06/10 16:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)


========== Driver Services (SafeList) ==========

DRV:64bit: - [2012/04/26 06:47:20 | 011,172,864 | ---- | M] (Advanced Micro Devices, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\atikmdag.sys -- (amdkmdag)
DRV:64bit: - [2012/04/26 03:32:46 | 000,339,456 | ---- | M] (Advanced Micro Devices, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\atikmpag.sys -- (amdkmdap)
DRV:64bit: - [2012/04/04 15:56:40 | 000,024,904 | ---- | M] (Malwarebytes Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\mbam.sys -- (MBAMProtector)
DRV:64bit: - [2012/03/20 20:44:12 | 000,098,688 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\NisDrvWFP.sys -- (NisDrv)
DRV:64bit: - [2012/03/08 18:40:52 | 000,048,488 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\fssfltr.sys -- (fssfltr)
DRV:64bit: - [2012/03/01 01:46:16 | 000,023,408 | ---- | M] (Microsoft Corporation) [Recognizer | Boot | Unknown] -- C:\Windows\SysNative\drivers\fs_rec.sys -- (Fs_Rec)
DRV:64bit: - [2012/02/15 11:01:50 | 000,052,736 | ---- | M] (Apple, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\usbaapl64.sys -- (USBAAPL64)
DRV:64bit: - [2011/07/12 21:15:44 | 000,115,216 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\AtihdW76.sys -- (AtiHDAudioService)
DRV:64bit: - [2011/06/10 15:42:42 | 000,022,264 | ---- | M] (Cisco Systems, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\vpnva64.sys -- (vpnva)
DRV:64bit: - [2010/12/13 15:37:18 | 000,036,720 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\nx6000.sys -- (MSHUSBVideo)
DRV:64bit: - [2010/11/20 08:33:35 | 000,078,720 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD)
DRV:64bit: - [2010/11/20 06:07:05 | 000,059,392 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbFlt.sys -- (TsUsbFlt)
DRV:64bit: - [2010/04/07 18:12:02 | 000,124,944 | ---- | M] (ATI Technologies, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\AtiHdmi.sys -- (AtiHdmiService)
DRV:64bit: - [2010/03/10 10:33:52 | 000,016,440 | ---- | M] (Advanced Micro Devices Inc.) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\AtiPcie64.sys -- (AtiPcie) AMD PCI Express (3GIO)
DRV:64bit: - [2010/03/04 09:43:00 | 000,346,144 | ---- | M] (Realtek ) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Rt64win7.sys -- (RTL8167)
DRV:64bit: - [2010/03/01 16:59:50 | 000,024,376 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\cqcpu.sys -- (cqcpu)
DRV:64bit: - [2010/03/01 16:59:50 | 000,024,376 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\cpqdfw.sys -- (CpqDfw)
DRV:64bit: - [2010/02/18 09:18:24 | 000,046,136 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\amdiox64.sys -- (amdiox64)
DRV:64bit: - [2010/02/05 23:04:06 | 000,028,728 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata)
DRV:64bit: - [2010/02/05 23:04:04 | 000,070,712 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata)
DRV:64bit: - [2009/12/22 04:26:36 | 000,038,456 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\usbfilter.sys -- (usbfilter)
DRV:64bit: - [2009/12/18 22:33:34 | 000,852,256 | ---- | M] (Ralink Technology, Corp.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\netr28x.sys -- (netr28x)
DRV:64bit: - [2009/07/13 20:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs)
DRV:64bit: - [2009/07/13 20:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2)
DRV:64bit: - [2009/07/13 20:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor)
DRV:64bit: - [2009/07/13 19:39:20 | 000,023,040 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\WSDPrint.sys -- (WSDPrintDevice)
DRV:64bit: - [2009/07/13 19:35:32 | 000,012,288 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\serscan.sys -- (StillCam)
DRV:64bit: - [2009/06/10 15:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv)
DRV:64bit: - [2009/06/10 15:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv)
DRV:64bit: - [2009/06/10 15:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a)
DRV:64bit: - [2009/06/10 15:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir)
DRV:64bit: - [2009/05/18 13:17:08 | 000,034,152 | ---- | M] (GEAR Software Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\GEARAspiWDM.sys -- (GEARAspiWDM)
DRV - [2009/07/13 20:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://g.msn.com/HPDSK/1
IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {6A1806CD-94D4-4689-BA73-E35EA1EA9990}
IE:64bit: - HKLM\..\SearchScopes\{4BE7C5D5-DCF9-4D27-A254-C71512F61062}: "URL" = http://search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=chr-hp-psg&type=HPDTDF
IE:64bit: - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://www.google.com/search?q={sea...putEncoding}&oe={outputEncoding}&sourceid=ie7
IE:64bit: - HKLM\..\SearchScopes\{BEF6D117-EEF5-4221-B745-3BCCFF49643C}: "URL" = http://en.wikipedia.org/wiki/Special:Search?search={searchTerms}
IE:64bit: - HKLM\..\SearchScopes\{D3F2AB17-75DD-4DF5-A14E-699BAEE9DCD8}: "URL" = http://www.ask.com/web?q={searchterms}&l=dis&o=ushpd
IE:64bit: - HKLM\..\SearchScopes\{FA0B86B0-57D9-4CD6-9F71-FB3CA0930617}: "URL" = http://www.bing.com/search?q={searchTerms}&form=HPDTDF&pc=HPDTDF&src=IE-SearchBox
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://g.msn.com/HPDSK/1
IE - HKLM\..\SearchScopes,DefaultScope = {6A1806CD-94D4-4689-BA73-E35EA1EA9990}
IE - HKLM\..\SearchScopes\{4BE7C5D5-DCF9-4D27-A254-C71512F61062}: "URL" = http://search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=chr-hp-psg&type=HPDTDF
IE - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://www.google.com/search?q={sea...putEncoding}&oe={outputEncoding}&sourceid=ie7
IE - HKLM\..\SearchScopes\{BEF6D117-EEF5-4221-B745-3BCCFF49643C}: "URL" = http://en.wikipedia.org/wiki/Special:Search?search={searchTerms}
IE - HKLM\..\SearchScopes\{D3F2AB17-75DD-4DF5-A14E-699BAEE9DCD8}: "URL" = http://www.ask.com/web?q={searchterms}&l=dis&o=ushpd
IE - HKLM\..\SearchScopes\{FA0B86B0-57D9-4CD6-9F71-FB3CA0930617}: "URL" = http://www.bing.com/search?q={searchTerms}&form=HPDTDF&pc=HPDTDF&src=IE-SearchBox


IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local



IE - HKU\S-1-5-21-1561252055-2272658225-3862106704-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://drudgereport.com/
IE - HKU\S-1-5-21-1561252055-2272658225-3862106704-1001\..\SearchScopes,DefaultScope = {FFC252F0-787F-456D-AE27-6F9C7C767F02}
IE - HKU\S-1-5-21-1561252055-2272658225-3862106704-1001\..\SearchScopes\{4BE7C5D5-DCF9-4D27-A254-C71512F61062}: "URL" = http://search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=chr-hp-psg&type=HPDTDF
IE - HKU\S-1-5-21-1561252055-2272658225-3862106704-1001\..\SearchScopes\{8C3501B0-9D48-4F42-855E-6F5E6FA8D61D}: "URL" = http://us.yhs4.search.yahoo.com/yhs...a&hspart=greentree&type=937811&p={searchTerms}
IE - HKU\S-1-5-21-1561252055-2272658225-3862106704-1001\..\SearchScopes\{BEF6D117-EEF5-4221-B745-3BCCFF49643C}: "URL" = http://en.wikipedia.org/wiki/Special:Search?search={searchTerms}
IE - HKU\S-1-5-21-1561252055-2272658225-3862106704-1001\..\SearchScopes\{D3F2AB17-75DD-4DF5-A14E-699BAEE9DCD8}: "URL" = http://www.ask.com/web?q={searchterms}&l=dis&o=ushpd
IE - HKU\S-1-5-21-1561252055-2272658225-3862106704-1001\..\SearchScopes\{E0D4660F-E26D-463F-B6BA-0F06800CEAF2}: "URL" = http://websearch.ask.com/redirect?c...pn_sauid=5B839B4C-AF21-493F-A51F-A68D86014E12&
IE - HKU\S-1-5-21-1561252055-2272658225-3862106704-1001\..\SearchScopes\{FA0B86B0-57D9-4CD6-9F71-FB3CA0930617}: "URL" = http://www.bing.com/search?q={searchTerms}&form=HPDTDF&pc=HPDTDF&src=IE-SearchBox
IE - HKU\S-1-5-21-1561252055-2272658225-3862106704-1001\..\SearchScopes\{FFC252F0-787F-456D-AE27-6F9C7C767F02}: "URL" = http://www.google.com/search?q={sea...x?}&startPage={startPage}&rlz=1I7ADFA_enUS453
IE - HKU\S-1-5-21-1561252055-2272658225-3862106704-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-21-1561252055-2272658225-3862106704-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local


========== FireFox ==========

FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\5.1.10411.0\npctrl.dll ( Microsoft Corporation)
FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~1\MICROS~3\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files (x86)\Microsoft Silverlight\5.1.10411.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3538.0513: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3555.0308: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@rocketlife.com/RocketLife Secure Plug-In Layer;version=1.0.5: C:\ProgramData\Visan\plugins\npRLSecurePluginLayer.dll (RocketLife, LLP)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.21.111\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.21.111\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=2.0.1: C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF - HKLM\Software\MozillaPlugins\Adobe Acrobat: C:\Program Files (x86)\Adobe\Acrobat 9.0\Acrobat\Air\nppdf32.dll (Adobe Systems Inc.)
FF - HKCU\Software\MozillaPlugins\@hulu.com/Hulu Desktop: C:\Users\Allen Home Office\AppData\Local\HuluDesktop\instances\0.9.14.1\nphdplg.dll (Hulu LLC)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Users\Allen Home Office\AppData\Local\Google\Update\1.3.21.111\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Users\Allen Home Office\AppData\Local\Google\Update\1.3.21.111\npGoogleUpdate3.dll (Google Inc.)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\smartwebprinting@hp.com: C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2011/08/05 18:34:31 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions\\smartwebprinting@hp.com: C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2011/08/05 18:34:31 | 000,000,000 | ---D | M]


========== Chrome ==========

CHR - default_search_provider: Google (Enabled)
CHR - default_search_provider: search_url = {google:baseURL}search?{google:RLZ}{google:acceptedSuggestion}{google:eek:riginalQueryForSuggestion}{google:searchFieldtrialParameter}{google:instantFieldTrialGroupParameter}sourceid=chrome&ie={inputEncoding}&q={searchTerms}
CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}{google:instantFieldTrialGroupParameter}client=chrome&hl={language}&q={searchTerms}
CHR - plugin: Shockwave Flash (Enabled) = C:\Users\Allen Home Office\AppData\Local\Google\Chrome\Application\17.0.963.78\gcswf32.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin2.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin3.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin4.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin5.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin6.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin7.dll
CHR - plugin: Java Deployment Toolkit 6.0.260.3 (Enabled) = C:\Program Files (x86)\Java\jre6\bin\new_plugin\npdeployJava1.dll
CHR - plugin: Java(TM) Platform SE 6 U26 (Enabled) = C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll
CHR - plugin: Adobe Acrobat (Disabled) = C:\Program Files (x86)\Adobe\Acrobat 9.0\Acrobat\Browser\nppdf32.dll
CHR - plugin: Silverlight Plug-In (Enabled) = c:\Program Files (x86)\Microsoft Silverlight\4.0.60531.0\npctrl.dll
CHR - plugin: Microsoft Office 2010 (Enabled) = C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL
CHR - plugin: Microsoft Office 2010 (Enabled) = C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL
CHR - plugin: Chrome NaCl (Enabled) = C:\Users\Allen Home Office\AppData\Local\Google\Chrome\Application\17.0.963.78\ppGoogleNaClPluginChrome.dll
CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Users\Allen Home Office\AppData\Local\Google\Chrome\Application\17.0.963.78\pdf.dll
CHR - plugin: Windows Live\u0099 Photo Gallery (Enabled) = C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll
CHR - plugin: iTunes Application Detector (Enabled) = C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll
CHR - plugin: Google Update (Enabled) = C:\Users\Allen Home Office\AppData\Local\Google\Update\1.3.21.67\npGoogleUpdate3.dll
CHR - plugin: Hulu Desktop (Enabled) = C:\Users\Allen Home Office\AppData\Local\HuluDesktop\instances\0.9.14.1\nphdplg.dll
CHR - plugin: Default Plug-in (Enabled) = default_plugin
CHR - Extension: Skype Click to Call = C:\Users\Allen Home Office\AppData\Local\Google\Chrome\User Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl\5.7.0.8773_0\

O1 HOSTS File: ([2012/06/30 11:08:37 | 000,000,027 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2:64bit: - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
O2 - BHO: (Adobe PDF Conversion Toolbar Helper) - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O2 - BHO: (Skype Browser Helper) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O2 - BHO: (Bing Bar Helper) - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.)
O2 - BHO: (SmartSelect Class) - {F4971EE7-DAA0-4053-9964-665D8EE6A077} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O3:64bit: - HKLM\..\Toolbar: (Google Toolbar) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
O3 - HKLM\..\Toolbar: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O3 - HKLM\..\Toolbar: (Bing Bar) - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.)
O3:64bit: - HKU\S-1-5-21-1561252055-2272658225-3862106704-1001\..\Toolbar\WebBrowser: (Google Toolbar) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
O3 - HKU\S-1-5-21-1561252055-2272658225-3862106704-1001\..\Toolbar\WebBrowser: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O4:64bit: - HKLM..\Run: [hpsysdrv] c:\Program Files (x86)\Hewlett-Packard\HP Odometer\hpsysdrv.exe (Hewlett-Packard)
O4:64bit: - HKLM..\Run: [MSC] c:\Program Files\Microsoft Security Client\msseces.exe (Microsoft Corporation)
O4:64bit: - HKLM..\Run: [SmartMenu] C:\Program Files\Hewlett-Packard\HP MediaSmart\SmartMenu.exe ()
O4 - HKLM..\Run: [Acrobat Assistant 8.0] C:\Program Files (x86)\Adobe\Acrobat 9.0\Acrobat\Acrotray.exe (Adobe Systems Inc.)
O4 - HKLM..\Run: [Adobe Acrobat Speed Launcher] C:\Program Files (x86)\Adobe\Acrobat 9.0\Acrobat\Acrobat_sl.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [APSDaemon] C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
O4 - HKLM..\Run: [LifeCam] C:\Program Files (x86)\Microsoft LifeCam\LifeExp.exe (Microsoft Corporation)
O4 - HKLM..\Run: [PDF Complete] C:\Program Files (x86)\PDF Complete\pdfsty.exe (PDF Complete Inc)
O4 - HKLM..\Run: [SearchSettings] C:\Program Files (x86)\Common Files\Spigot\Search Settings\SearchSettings.exe (Spigot, Inc.)
O4 - HKLM..\Run: [StartCCC] C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.)
O4 - HKU\S-1-5-21-1561252055-2272658225-3862106704-1001..\Run: [TivoNotify] C:\Program Files (x86)\TiVo\Desktop\TiVoNotify.exe (TiVo Inc.)
O4 - HKU\S-1-5-21-1561252055-2272658225-3862106704-1001..\Run: [TivoServer] C:\Program Files (x86)\TiVo\Desktop\TiVoServer.exe (TiVo Inc.)
O4 - HKU\S-1-5-21-1561252055-2272658225-3862106704-1001..\Run: [TivoTransfer] C:\Program Files (x86)\TiVo\Desktop\TiVoTransfer.exe (TiVo Inc.)
O4 - HKU\S-1-5-21-1561252055-2272658225-3862106704-1001..\Run: [TranscodingService] C:\Program Files (x86)\TiVo\Desktop\Plus\\TranscodingService.exe ()
O4 - Startup: C:\Users\Allen Home Office\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk = C:\Users\Allen Home Office\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0
O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-1561252055-2272658225-3862106704-1001\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-1561252055-2272658225-3862106704-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-21-1561252055-2272658225-3862106704-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O8:64bit: - Extra context menu item: Append Link Target to Existing PDF - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8:64bit: - Extra context menu item: Append to Existing PDF - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8:64bit: - Extra context menu item: Convert Link Target to Adobe PDF - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8:64bit: - Extra context menu item: Convert to Adobe PDF - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Append Link Target to Existing PDF - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Append to Existing PDF - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Convert Link Target to Adobe PDF - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Convert to Adobe PDF - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O9 - Extra Button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra 'Tools' menuitem : Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000009 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000009 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)
O15 - HKU\S-1-5-21-1561252055-2272658225-3862106704-1001\..Trusted Domains: fordav.com ([favpn] https in Trusted sites)
O15 - HKU\S-1-5-21-1561252055-2272658225-3862106704-1001\..Trusted Domains: intuit.com ([ttlc] https in Trusted sites)
O16 - DPF: {55963676-2F5E-4BAF-AC28-CF26AA587566} https://favpn.fordav.com/CACHE/stc/1/binaries/vpnweb.cab (Cisco AnyConnect VPN Client Web Control)
O16 - DPF: {73ECB3AA-4717-450C-A2AB-D00DAD9EE203} http://h20614.www2.hp.com/ediags/gmd/Install/Cab/hpdetect118.cab (Reg Error: Key error.)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 1.6.0_29)
O16 - DPF: {CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 1.6.0_29)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 1.6.0_29)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 209.18.47.61 209.18.47.62
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{5807F2E7-B16E-40CF-AFA8-2CEBF3EC8D99}: DhcpNameServer = 209.18.47.61 209.18.47.62
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{6A87AD15-AF2B-4214-9A36-6927D90D386E}: DhcpNameServer = 168.95.1.1 168.95.192.1
O18:64bit: - Protocol\Handler\livecall - No CLSID value found
O18:64bit: - Protocol\Handler\ms-help - No CLSID value found
O18:64bit: - Protocol\Handler\msnim - No CLSID value found
O18:64bit: - Protocol\Handler\skype4com - No CLSID value found
O18:64bit: - Protocol\Handler\skype-ie-addon-data - No CLSID value found
O18:64bit: - Protocol\Handler\wlmailhtml - No CLSID value found
O18:64bit: - Protocol\Handler\wlpg - No CLSID value found
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O20:64bit: - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysNative\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysWOW64\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O32 - HKLM CDRom: AutoRun - 1
O34 - HKLM BootExecute: (autocheck autochk *)
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:64bit: - HKLM\...com [@ = ComFile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = ComFile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)


Drivers32:64bit: msacm.l3acm - C:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.l3acm - C:\Windows\SysWOW64\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: vidc.cvid - C:\Windows\SysWow64\iccvid.dll (Radius Inc.)
 
CREATERESTOREPOINT
Restore point Set: OTL Restore Point

========== Files/Folders - Created Within 30 Days ==========

[2012/06/30 15:19:37 | 000,596,992 | ---- | C] (OldTimer Tools) -- C:\Users\Allen Home Office\Desktop\OTL.exe
[2012/06/30 15:19:24 | 000,000,000 | ---D | C] -- C:\Users\Allen Home Office\AppData\Roaming\HPAppData
[2012/06/30 11:09:08 | 000,000,000 | -HSD | C] -- C:\$RECYCLE.BIN
[2012/06/30 10:56:34 | 000,518,144 | ---- | C] (SteelWerX) -- C:\Windows\SWREG.exe
[2012/06/30 10:56:34 | 000,406,528 | ---- | C] (SteelWerX) -- C:\Windows\SWSC.exe
[2012/06/30 10:56:34 | 000,060,416 | ---- | C] (NirSoft) -- C:\Windows\NIRCMD.exe
[2012/06/30 10:56:30 | 000,000,000 | ---D | C] -- C:\Qoobox
[2012/06/30 10:56:13 | 000,000,000 | ---D | C] -- C:\Windows\erdnt
[2012/06/30 10:48:31 | 004,566,027 | R--- | C] (Swearware) -- C:\Users\Allen Home Office\Desktop\ComboFix.exe
[2012/06/30 02:24:48 | 000,000,000 | ---D | C] -- C:\FRST
[2012/06/29 22:56:53 | 000,000,000 | ---D | C] -- C:\Users\Allen Home Office\AppData\Roaming\Malwarebytes
[2012/06/29 22:56:41 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2012/06/29 22:56:33 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2012/06/29 22:56:32 | 000,024,904 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys
[2012/06/29 22:56:31 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware
[2012/06/28 17:22:39 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Microsoft Security Client
[2012/06/28 17:22:37 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft Security Client
[2012/06/28 16:22:04 | 000,000,000 | ---D | C] -- C:\Kaspersky Rescue Disk 10.0
[2012/06/28 16:15:45 | 000,000,000 | ---D | C] -- C:\Windows\Hewlett-Packard
[2012/06/28 16:14:47 | 000,000,000 | ---D | C] -- C:\Users\Allen Home Office\Documents\My Scans
[2012/06/28 16:00:07 | 000,000,000 | ---D | C] -- C:\ProgramData\Visan
[2012/06/28 15:59:07 | 000,000,000 | ---D | C] -- C:\ProgramData\WEBREG
[2012/06/28 15:46:55 | 000,000,000 | ---D | C] -- C:\Users\Allen Home Office\AppData\Local\HP
[2012/06/28 15:38:56 | 000,000,000 | ---D | C] -- C:\ProgramData\HP Product Assistant
[2012/06/23 14:11:40 | 000,000,000 | -HSD | C] -- C:\Windows\SysNative\%APPDATA%
[2012/06/18 13:19:53 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\YouTube Downloader Toolbar
[2012/06/18 13:19:53 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Spigot
[2012/06/18 13:19:53 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Application Updater
[2012/06/06 18:39:06 | 000,000,000 | ---D | C] -- C:\Users\Allen Home Office\AppData\Local\{9BB68229-3ED6-44DE-A38D-5FB7E12C5A0D}
[2012/06/06 18:38:56 | 000,000,000 | ---D | C] -- C:\Users\Allen Home Office\AppData\Local\{E8F6B1D5-740A-4BFF-AAA5-5DB5FDE96FA6}
[2012/06/05 23:15:23 | 000,000,000 | ---D | C] -- C:\ProgramData\YTD YouTube Downloader & Converter
[2012/06/05 23:15:20 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\YTD YouTube Downloader & Converter
[2012/06/05 23:15:18 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\GreenTree Applications
[2012/06/05 20:08:35 | 000,000,000 | ---D | C] -- C:\Users\Allen Home Office\AppData\Local\{7855CDFF-538F-4435-A583-0265BC83E1F7}
[2012/06/05 20:08:24 | 000,000,000 | ---D | C] -- C:\Users\Allen Home Office\AppData\Local\{11C3F5D8-5014-42A8-AB1B-0405304CFCDF}
[2012/06/03 01:20:24 | 000,000,000 | ---D | C] -- C:\Users\Allen Home Office\AppData\Local\{62EBE100-CB78-4100-9163-9FA6929E28B6}
[2012/06/02 17:31:34 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Lame For Audacity
[2012/06/02 17:29:19 | 000,000,000 | ---D | C] -- C:\Users\Allen Home Office\AppData\Roaming\Audacity
[2012/06/02 17:29:06 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Audacity
[2012/06/02 13:19:59 | 000,000,000 | ---D | C] -- C:\Users\Allen Home Office\AppData\Local\{38D6F2FB-CD17-48AF-A57D-68AE41087D19}
[2012/06/02 13:19:49 | 000,000,000 | ---D | C] -- C:\Users\Allen Home Office\AppData\Local\{D84C9BDB-371D-49CE-872A-E056CA6983F7}
[2012/06/02 13:01:35 | 000,000,000 | ---D | C] -- C:\Windows\en
[2012/06/02 12:54:53 | 000,000,000 | ---D | C] -- C:\Users\Allen Home Office\AppData\Local\{BB2145F5-827C-469A-A69F-46282A492BB3}
[2012/06/02 12:54:43 | 000,000,000 | ---D | C] -- C:\Users\Allen Home Office\AppData\Local\{9455B1B1-4E5A-4D57-99E8-8E2F5E7057ED}
[2012/06/02 12:21:47 | 000,000,000 | ---D | C] -- C:\Users\Allen Home Office\AppData\Local\{A486477C-F208-4E41-9DE4-50792E2B9DB9}
[2012/06/02 12:21:37 | 000,000,000 | ---D | C] -- C:\Users\Allen Home Office\AppData\Local\{BD8FD565-2D08-447E-9EC9-632DBD001CF6}
[2012/06/02 08:30:37 | 000,000,000 | ---D | C] -- C:\Users\Allen Home Office\AppData\Local\{4571A3DF-69FC-4DB8-BF33-55C979B70438}

========== Files - Modified Within 30 Days ==========

[2012/06/30 15:22:47 | 000,009,920 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2012/06/30 15:22:47 | 000,009,920 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2012/06/30 15:19:56 | 000,740,078 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
[2012/06/30 15:19:56 | 000,633,336 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
[2012/06/30 15:19:56 | 000,110,354 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
[2012/06/30 15:19:51 | 000,596,992 | ---- | M] (OldTimer Tools) -- C:\Users\Allen Home Office\Desktop\OTL.exe
[2012/06/30 15:15:24 | 000,000,894 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2012/06/30 15:14:54 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2012/06/30 15:14:44 | 2146,918,399 | -HS- | M] () -- C:\hiberfil.sys
[2012/06/30 15:08:35 | 000,000,956 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-1561252055-2272658225-3862106704-1001UA.job
[2012/06/30 15:08:35 | 000,000,898 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2012/06/30 15:08:35 | 000,000,830 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job
[2012/06/30 15:08:35 | 000,000,362 | ---- | M] () -- C:\Windows\tasks\HP Photo Creations Communicator.job
[2012/06/30 11:08:37 | 000,000,027 | ---- | M] () -- C:\Windows\SysNative\drivers\etc\hosts
[2012/06/30 10:48:33 | 004,566,027 | R--- | M] (Swearware) -- C:\Users\Allen Home Office\Desktop\ComboFix.exe
[2012/06/29 22:56:41 | 000,001,115 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2012/06/28 17:22:57 | 000,001,945 | ---- | M] () -- C:\Windows\epplauncher.mif
[2012/06/28 17:22:41 | 000,753,736 | ---- | M] () -- C:\Windows\SysWow64\PerfStringBackup.INI
[2012/06/28 16:26:53 | 000,437,040 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT
[2012/06/28 15:59:03 | 000,212,671 | ---- | M] () -- C:\Windows\hpoins52.dat
[2012/06/28 15:38:52 | 000,001,317 | ---- | M] () -- C:\Users\Public\Desktop\HP Solution Center.lnk
[2012/06/28 11:21:15 | 000,000,904 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-1561252055-2272658225-3862106704-1001Core.job
[2012/06/24 18:17:02 | 000,000,336 | ---- | M] () -- C:\Windows\tasks\HPCeeScheduleForLesley.job
[2012/06/11 20:56:58 | 000,002,472 | ---- | M] () -- C:\Users\Allen Home Office\Desktop\Google Chrome.lnk
[2012/06/05 23:15:19 | 000,001,393 | ---- | M] () -- C:\Users\Public\Desktop\YTD YouTube Downloader & Converter.lnk
[2012/06/02 12:38:30 | 000,001,072 | ---- | M] () -- C:\Users\Allen Home Office\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
[2012/06/02 12:38:12 | 000,001,064 | ---- | M] () -- C:\Users\Allen Home Office\Desktop\Dropbox.lnk

========== Files Created - No Company Name ==========

[2012/06/30 10:56:34 | 000,256,000 | ---- | C] () -- C:\Windows\PEV.exe
[2012/06/30 10:56:34 | 000,208,896 | ---- | C] () -- C:\Windows\MBR.exe
[2012/06/30 10:56:34 | 000,098,816 | ---- | C] () -- C:\Windows\sed.exe
[2012/06/30 10:56:34 | 000,080,412 | ---- | C] () -- C:\Windows\grep.exe
[2012/06/30 10:56:34 | 000,068,096 | ---- | C] () -- C:\Windows\zip.exe
[2012/06/29 22:56:41 | 000,001,115 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2012/06/28 17:22:44 | 000,001,917 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Security Essentials.lnk
[2012/06/28 16:00:08 | 000,000,362 | ---- | C] () -- C:\Windows\tasks\HP Photo Creations Communicator.job
[2012/06/28 15:38:52 | 000,001,317 | ---- | C] () -- C:\Users\Public\Desktop\HP Solution Center.lnk
[2012/06/05 23:15:19 | 000,001,393 | ---- | C] () -- C:\Users\Public\Desktop\YTD YouTube Downloader & Converter.lnk
[2012/06/02 17:29:13 | 000,001,025 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Audacity.lnk
[2012/04/26 03:52:40 | 000,204,952 | ---- | C] () -- C:\Windows\SysWow64\ativvsvl.dat
[2012/04/26 03:52:40 | 000,157,144 | ---- | C] () -- C:\Windows\SysWow64\ativvsva.dat
[2012/01/10 23:02:51 | 000,000,614 | ---- | C] () -- C:\ProgramData\Microsoft.SqlServer.Compact.400.32.bc
[2011/12/27 19:36:11 | 000,484,352 | ---- | C] () -- C:\Windows\SysWow64\lame_enc.dll
[2011/09/12 22:06:18 | 000,003,917 | ---- | C] () -- C:\Windows\SysWow64\atipblag.dat
[2011/08/05 18:49:05 | 000,212,535 | ---- | C] () -- C:\Windows\hpoins52.dat.temp
[2011/08/05 18:49:05 | 000,001,333 | ---- | C] () -- C:\Windows\hpomdl52.dat.temp
[2011/08/05 18:29:13 | 000,212,671 | ---- | C] () -- C:\Windows\hpoins52.dat
[2011/07/24 17:30:29 | 000,196,440 | -H-- | C] () -- C:\Windows\SysWow64\mlfcache.dat
[2011/07/12 23:06:00 | 000,753,736 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI
[2011/06/27 20:22:06 | 000,007,603 | ---- | C] () -- C:\Users\Allen Home Office\AppData\Local\Resmon.ResmonCfg
[2011/03/30 15:28:48 | 000,013,931 | ---- | C] () -- C:\Windows\SysWow64\RaCoInst.dat
[2011/03/30 15:20:09 | 000,000,000 | ---- | C] () -- C:\Windows\ativpsrm.bin

========== LOP Check ==========

[2012/06/03 08:47:27 | 000,000,000 | ---D | M] -- C:\Users\Allen Home Office\AppData\Roaming\Audacity
[2012/06/30 15:15:39 | 000,000,000 | ---D | M] -- C:\Users\Allen Home Office\AppData\Roaming\Dropbox
[2011/12/27 19:36:19 | 000,000,000 | ---D | M] -- C:\Users\Allen Home Office\AppData\Roaming\FreeAudioPack
[2011/07/12 21:43:20 | 000,000,000 | ---D | M] -- C:\Users\Allen Home Office\AppData\Roaming\NewspaperDirect
[2011/07/12 21:27:06 | 000,000,000 | ---D | M] -- C:\Users\Allen Home Office\AppData\Roaming\WildTangent
[2011/07/19 15:43:34 | 000,000,000 | ---D | M] -- C:\Users\Lesley\AppData\Roaming\TeamViewer
[2012/06/29 07:22:49 | 000,032,550 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT

========== Purity Check ==========



========== Custom Scans ==========

< %SYSTEMDRIVE%\*.* >
[2010/11/17 18:32:28 | 000,000,000 | ---- | M] () -- C:\10NAFMRW603.restore
[2009/07/24 14:22:29 | 000,008,192 | RHS- | M] () -- C:\BOOTSECT.BAK
[2012/06/30 11:16:05 | 000,028,970 | ---- | M] () -- C:\ComboFix.txt
[2010/08/21 13:57:43 | 000,000,003 | R--- | M] () -- C:\CPCSUPPDISC
[2010/08/21 13:58:33 | 000,105,036 | R--- | M] () -- C:\DISC1
[2012/06/30 15:14:44 | 2146,918,399 | -HS- | M] () -- C:\hiberfil.sys
[2011/03/30 17:07:09 | 000,000,000 | RHS- | M] () -- C:\OS
[2012/06/30 15:14:49 | 4294,217,727 | -HS- | M] () -- C:\pagefile.sys

< %systemroot%\Fonts\*.com >
[2009/07/14 00:32:31 | 000,026,040 | ---- | M] () -- C:\Windows\Fonts\GlobalMonospace.CompositeFont
[2009/07/14 00:32:31 | 000,026,489 | ---- | M] () -- C:\Windows\Fonts\GlobalSansSerif.CompositeFont
[2009/07/14 00:32:31 | 000,029,779 | ---- | M] () -- C:\Windows\Fonts\GlobalSerif.CompositeFont
[2009/07/14 00:32:31 | 000,043,318 | ---- | M] () -- C:\Windows\Fonts\GlobalUserInterface.CompositeFont

< %systemroot%\Fonts\*.dll >

< %systemroot%\Fonts\*.ini >
[2009/06/10 15:49:50 | 000,000,065 | ---- | M] () -- C:\Windows\Fonts\desktop.ini

< %systemroot%\Fonts\*.ini2 >

< %systemroot%\Fonts\*.exe >

< %systemroot%\system32\spool\prtprocs\w32x86\*.* >

< %systemroot%\REPAIR\*.bak1 >

< %systemroot%\REPAIR\*.ini >

< %systemroot%\system32\*.jpg >

< %systemroot%\*.jpg >

< %systemroot%\*.png >

< %systemroot%\*.scr >
[2012/03/08 18:37:20 | 000,302,448 | ---- | M] (Microsoft Corporation) -- C:\Windows\WLXPGSS.SCR

< %systemroot%\*._sy >

< %APPDATA%\Adobe\Update\*.* >

< %ALLUSERSPROFILE%\Favorites\*.* >

< %APPDATA%\Microsoft\*.* >

< %PROGRAMFILES%\*.* >
[2009/07/13 23:54:24 | 000,000,174 | -HS- | M] () -- C:\Program Files (x86)\desktop.ini

< %APPDATA%\Update\*.* >

< %systemroot%\*. /mp /s >

< %systemroot%\System32\config\*.sav >

< %PROGRAMFILES%\bak. /s >

< %systemroot%\system32\bak. /s >

< %ALLUSERSPROFILE%\Start Menu\*.lnk /x >

< %systemroot%\system32\config\systemprofile\*.dat /x >

< %systemroot%\*.config >

< %systemroot%\system32\*.db >

< %APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x >
[2011/07/12 21:34:28 | 000,000,221 | -HS- | M] () -- C:\Users\Allen Home Office\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini

< %USERPROFILE%\Desktop\*.exe >
[2012/06/30 10:48:33 | 004,566,027 | R--- | M] (Swearware) -- C:\Users\Allen Home Office\Desktop\ComboFix.exe
[2012/06/30 15:19:51 | 000,596,992 | ---- | M] (OldTimer Tools) -- C:\Users\Allen Home Office\Desktop\OTL.exe

< %PROGRAMFILES%\Common Files\*.* >

< %systemroot%\*.src >

< %systemroot%\install\*.* >

< %systemroot%\system32\DLL\*.* >

< %systemroot%\system32\HelpFiles\*.* >

< %systemroot%\tasks\*.* >
[2012/06/30 15:08:35 | 000,000,830 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job
[2012/06/30 15:15:24 | 000,000,894 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2012/06/30 15:08:35 | 000,000,898 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2012/06/28 11:21:15 | 000,000,904 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-1561252055-2272658225-3862106704-1001Core.job
[2012/06/30 15:08:35 | 000,000,956 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-1561252055-2272658225-3862106704-1001UA.job
[2012/06/30 15:08:35 | 000,000,362 | ---- | M] () -- C:\Windows\tasks\HP Photo Creations Communicator.job
[2012/06/24 18:17:02 | 000,000,336 | ---- | M] () -- C:\Windows\tasks\HPCeeScheduleForLesley.job
[2012/06/30 15:14:58 | 000,000,006 | -H-- | M] () -- C:\Windows\tasks\SA.DAT
[2012/06/29 07:22:49 | 000,032,550 | ---- | M] () -- C:\Windows\tasks\SCHEDLGU.TXT

< %systemroot%\system32\rundll\*.* >

< %systemroot%\winn32\*.* >

< %systemroot%\Java\*.* >

< %systemroot%\system32\test\*.* >

< %systemroot%\system32\Rundll32\*.* >

< %systemroot%\AppPatch\Custom\*.* >

< %APPDATA%\Roaming\Microsoft\Windows\Recent\*.lnk /x >

< %PROGRAMFILES%\PC-Doctor\Downloads\*.* >

< %PROGRAMFILES%\Internet Explorer\*.tmp >

< %PROGRAMFILES%\Internet Explorer\*.dat >

< %USERPROFILE%\My Documents\*.exe >

< %USERPROFILE%\*.exe >

< %systemroot%\ADDINS\*.* >
[2009/06/10 16:20:04 | 000,000,802 | ---- | M] () -- C:\Windows\ADDINS\FXSEXT.ecf

< %systemroot%\assembly\*.bak2 >

< %systemroot%\Config\*.* >

< %systemroot%\REPAIR\*.bak2 >

< %systemroot%\SECURITY\Database\*.sdb /x >

< %systemroot%\SYSTEM\*.bak2 >

< %systemroot%\Web\*.bak2 >

< %systemroot%\Driver Cache\*.* >

< %PROGRAMFILES%\Mozilla Firefox\0*.exe >

< %ProgramFiles%\Microsoft Common\*.* >

< %ProgramFiles%\TinyProxy. >

< %USERPROFILE%\Favorites\*.url /x >
[2012/02/17 07:53:59 | 000,000,402 | -HS- | M] () -- C:\Users\Allen Home Office\Favorites\desktop.ini

< %systemroot%\system32\*.bk >

< %systemroot%\*.te >

< %systemroot%\system32\system32\*.* >

< %ALLUSERSPROFILE%\*.dat /x >
[2012/06/28 15:59:04 | 000,005,179 | ---- | M] () -- C:\ProgramData\hpzinstall.log
[2012/01/10 23:24:27 | 000,000,614 | ---- | M] () -- C:\ProgramData\Microsoft.SqlServer.Compact.400.32.bc

< %systemroot%\system32\drivers\*.rmv >

< dir /b "%systemroot%\system32\*.exe" | find /I " " /c >

< dir /b "%systemroot%\*.exe" | find /I " " /c >

< %PROGRAMFILES%\Microsoft\*.* >

< %systemroot%\System32\Wbem\proquota.exe >

< %PROGRAMFILES%\Mozilla Firefox\*.dat >

< %USERPROFILE%\Cookies\*.txt /x >

< %SystemRoot%\system32\fonts\*.* >

< %systemroot%\system32\winlog\*.* >

< %systemroot%\system32\Language\*.* >

< %systemroot%\system32\Settings\*.* >

< %systemroot%\system32\*.quo >

< %SYSTEMROOT%\AppPatch\*.exe >

< %SYSTEMROOT%\inf\*.exe >

< %SYSTEMROOT%\Installer\*.exe >

< %systemroot%\system32\config\*.bak2 >

< %systemroot%\system32\Computers\*.* >

< %SystemRoot%\system32\Sound\*.* >

< %SystemRoot%\system32\SpecialImg\*.* >

< %SystemRoot%\system32\code\*.* >

< %SystemRoot%\system32\draft\*.* >

< %SystemRoot%\system32\MSSSys\*.* >

< %ProgramFiles%\Javascript\*.* >

< %systemroot%\pchealth\helpctr\System\*.exe /s >

< %systemroot%\Web\*.exe >

< %systemroot%\system32\msn\*.* >

< %systemroot%\system32\*.tro >

< %AppData%\Microsoft\Installer\msupdates\*.* >

< %ProgramFiles%\Messenger\*.* >

< %systemroot%\system32\systhem32\*.* >

< %systemroot%\system\*.exe >

< HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >

< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install\LastSuccessTime /rs >

< >
< End of report >
 
Cool :)

Run OTL
  • Under the Custom Scans/Fixes box at the bottom, paste in the following

    Code: 
    :OTL
PRC - [2012/06/13 17:37:04 | 001,088,904 | ---- | M] (Spigot, Inc.) -- C:\Program Files (x86)\Common Files\Spigot\Search Settings\SearchSettings.exe
PRC - [2012/06/13 17:27:26 | 000,792,512 | ---- | M] (Spigot, Inc.) -- C:\Program Files (x86)\Application Updater\ApplicationUpdater.exe
SRV - [2012/06/13 17:27:26 | 000,792,512 | ---- | M] (Spigot, Inc.) [Auto | Running] -- C:\Program Files (x86)\Application Updater\ApplicationUpdater.exe -- (Application Updater)
O4 - HKLM..\Run: [SearchSettings] C:\Program Files (x86)\Common Files\Spigot\Search Settings\SearchSettings.exe (Spigot, Inc.)
O15 - HKU\S-1-5-21-1561252055-2272658225-3862106704-1001\..Trusted Domains: fordav.com ([favpn] https in Trusted sites)
O15 - HKU\S-1-5-21-1561252055-2272658225-3862106704-1001\..Trusted Domains: intuit.com ([ttlc] https in Trusted sites)
O16 - DPF: {73ECB3AA-4717-450C-A2AB-D00DAD9EE203} http://h20614.www2.hp.com/ediags/gmd/Install/Cab/hpdetect118.cab (Reg Error: Key error.)


:Services

:Reg

:Files
C:\Program Files (x86)\Common Files\Spigot
C:\Program Files (x86)\Application Updater\ApplicationUpdater.exe

:Commands
[purity]
[emptytemp]
[emptyjava]
[emptyflash]
[Reboot]
  • Then click the Run Fix button at the top
  • Let the program run unhindered, reboot the PC when it is done
  • You will get a log that shows the results of the fix. Please post it.

=================================================

Last scans...

1. Download Security Check from HERE, and save it to your Desktop.
  • Double-click SecurityCheck.exe
  • Follow the onscreen instructions inside of the black box.
  • A Notepad document should open automatically called checkup.txt; please post the contents of that document.

    NOTE SecurityCheck may produce some false warning(s), so leave the results reading to me.

2. Please download Farbar Service Scanner (FSS) and run it on the computer with the issue.
  • Make sure the following options are checked:
    • Internet Services
    • Windows Firewall
    • System Restore
    • Security Center
    • Windows Update
    • Windows Defender
  • Press "Scan".
  • It will create a log (FSS.txt) in the same directory the tool is run.
  • Please copy and paste the log to your reply.


3. Download Temp File Cleaner (TFC)
  • Double click on TFC.exe to run the program.
  • Click on Start button to begin cleaning process.
  • TFC will close all running programs, and it may ask you to restart computer.


4. Please run a free online scan with the ESET Online Scanner

  • Disable your antivirus program
  • Tick the box next to YES, I accept the Terms of Use
  • Click Start
  • Accept any security warnings from your browser.
  • Check Scan archives
  • Click Start
  • ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
  • When the scan completes, click on List of found threats
  • Click on Export to text file , and save the file to your desktop using a unique name, such as ESETScan. Include the contents of this report in your next reply.
  • NOTE. If Eset won't find any threats, it won't produce any log.
 
OTL log

All processes killed
========== OTL ==========
No active process named SearchSettings.exe was found!
Process ApplicationUpdater.exe killed successfully!
Service Application Updater stopped successfully!
Service Application Updater deleted successfully!
C:\Program Files (x86)\Application Updater\ApplicationUpdater.exe moved successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\SearchSettings deleted successfully.
C:\Program Files (x86)\Common Files\Spigot\Search Settings\SearchSettings.exe moved successfully.
Registry key HKEY_USERS\S-1-5-21-1561252055-2272658225-3862106704-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\fordav.com\favpn\ deleted successfully.
Registry key HKEY_USERS\S-1-5-21-1561252055-2272658225-3862106704-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\intuit.com\ttlc\ deleted successfully.
Starting removal of ActiveX control {73ECB3AA-4717-450C-A2AB-D00DAD9EE203}
C:\Windows\Downloaded Program Files\Setup.inf moved successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{73ECB3AA-4717-450C-A2AB-D00DAD9EE203}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73ECB3AA-4717-450C-A2AB-D00DAD9EE203}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{73ECB3AA-4717-450C-A2AB-D00DAD9EE203}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73ECB3AA-4717-450C-A2AB-D00DAD9EE203}\ not found.
========== SERVICES/DRIVERS ==========
========== REGISTRY ==========
========== FILES ==========
C:\Program Files (x86)\Common Files\Spigot\Search Settings\Res folder moved successfully.
C:\Program Files (x86)\Common Files\Spigot\Search Settings\Lang folder moved successfully.
C:\Program Files (x86)\Common Files\Spigot\Search Settings folder moved successfully.
C:\Program Files (x86)\Common Files\Spigot\GC folder moved successfully.
C:\Program Files (x86)\Common Files\Spigot folder moved successfully.
File\Folder C:\Program Files (x86)\Application Updater\ApplicationUpdater.exe not found.
========== COMMANDS ==========

[EMPTYTEMP]

User: All Users

User: Allen Home Office
->Temp folder emptied: 126890 bytes
->Temporary Internet Files folder emptied: 21652309 bytes
->Java cache emptied: 2991029 bytes
->Google Chrome cache emptied: 19488400 bytes
->Flash cache emptied: 58882 bytes

User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 41620 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: Lesley
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 13846575 bytes
->Java cache emptied: 1838499 bytes
->Flash cache emptied: 58680 bytes

User: Public
->Temp folder emptied: 0 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32 (64bit) .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 21220 bytes
%systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 123648777 bytes
RecycleBin emptied: 205916 bytes

Total Files Cleaned = 175.00 mb


[EMPTYJAVA]

User: All Users

User: Allen Home Office
->Java cache emptied: 0 bytes

User: Default

User: Default User

User: Lesley
->Java cache emptied: 0 bytes

User: Public

Total Java Files Cleaned = 0.00 mb


[EMPTYFLASH]

User: All Users

User: Allen Home Office
->Flash cache emptied: 0 bytes

User: Default
->Flash cache emptied: 0 bytes

User: Default User
->Flash cache emptied: 0 bytes

User: Lesley
->Flash cache emptied: 0 bytes

User: Public

Total Flash Files Cleaned = 0.00 mb


OTL by OldTimer - Version 3.2.53.0 log created on 06302012_161019
Files\Folders moved on Reboot...
C:\Users\Allen Home Office\AppData\Local\Temp\FXSAPIDebugLogFile.txt moved successfully.
PendingFileRenameOperations files...
File C:\Users\Allen Home Office\AppData\Local\Temp\FXSAPIDebugLogFile.txt not found!
Registry entries deleted on Reboot...
 
Secruity Check log

Results of screen317's Security Check version 0.99.24
Windows 7 x64 (UAC is disabled!)
Internet Explorer 9
``````````````````````````````
Antivirus/Firewall Check:
Windows Firewall Enabled!
[size=1]WMI entry may not exist for antivirus; attempting automatic update.[/size]
```````````````````````````````
Anti-malware/Other Utilities Check:
Java(TM) 6 Update 29
````````````````````````````````
Process Check:
objlist.exe by Laurent
Windows Defender MSMpEng.exe
Microsoft Security Essentials msseces.exe
``````````End of Log````````````
 
FSS log

Farbar Service Scanner Version: 25-06-2012 01
Ran by Allen Home Office (administrator) on 30-06-2012 at 16:21:28
Running from "C:\Users\Allen Home Office\Desktop"
Microsoft Windows 7 Home Premium Service Pack 1 (X64)
Boot Mode: Normal
****************************************************************
Internet Services:
============
Connection Status:
==============
Localhost is accessible.
LAN connected.
Google IP is accessible.
Google.com is accessible.
Yahoo IP is accessible.
Yahoo.com is accessible.

Windows Firewall:
=============
Firewall Disabled Policy:
==================

System Restore:
============
System Restore Disabled Policy:
========================

Action Center:
============
Windows Update:
============
Windows Autoupdate Disabled Policy:
============================

Windows Defender:
==============
WinDefend Service is not running. Checking service configuration:
The start type of WinDefend service is set to Demand. The default start type is Auto.
The ImagePath of WinDefend service is OK.
The ServiceDll of WinDefend service is OK.

Windows Defender Disabled Policy:
==========================
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender]
"DisableAntiSpyware"=DWORD:1

File Check:
========
C:\Windows\System32\nsisvc.dll => MD5 is legit
C:\Windows\System32\drivers\nsiproxy.sys => MD5 is legit
C:\Windows\System32\dhcpcore.dll => MD5 is legit
C:\Windows\System32\drivers\afd.sys => MD5 is legit
C:\Windows\System32\drivers\tdx.sys => MD5 is legit
C:\Windows\System32\Drivers\tcpip.sys => MD5 is legit
C:\Windows\System32\dnsrslvr.dll => MD5 is legit
C:\Windows\System32\mpssvc.dll => MD5 is legit
C:\Windows\System32\bfe.dll => MD5 is legit
C:\Windows\System32\drivers\mpsdrv.sys => MD5 is legit
C:\Windows\System32\SDRSVC.dll => MD5 is legit
C:\Windows\System32\vssvc.exe => MD5 is legit
C:\Windows\System32\wscsvc.dll => MD5 is legit
C:\Windows\System32\wbem\WMIsvc.dll => MD5 is legit
C:\Windows\System32\wuaueng.dll => MD5 is legit
C:\Windows\System32\qmgr.dll => MD5 is legit
C:\Windows\System32\es.dll => MD5 is legit
C:\Windows\System32\cryptsvc.dll => MD5 is legit
C:\Program Files\Windows Defender\MpSvc.dll => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit

**** End of log ****
 
ESET log

C:\Program Files (x86)\YouTube Downloader Toolbar\IE\5.9\youtubedownloaderToolbarIE.dll a variant of Win32/Toolbar.Widgi application cleaned by deleting - quarantined
C:\Windows\Installer\118f3cdd.msi a variant of Win32/Toolbar.Widgi application deleted - quarantined
C:\_OTL\MovedFiles\06302012_161019\C_Program Files (x86)\Common Files\Spigot\Search Settings\SearchSettings.exe a variant of Win32/Toolbar.Widgi application cleaned by deleting - quarantined
 
You must log in or register to reply here.

Similar threads

E
I have been taken over by a software called Astanda using XML to Log everything and roaming to an SQL server.
Replies
0
Views
465
eriksnyman1
E
Cal Jeffrey
Hackers used Ars Technica and Vimeo to deliver malware using obfuscated binary instructions...
Replies
0
Views
130
Cal Jeffrey
Cal Jeffrey
H
Freezes after BSOD
Replies
10
Views
1K
bazz2004
B

Latest posts

Back