TechSpot

Slow performance, firefox not loading, McAfee scan errors

By eraserofficial
Sep 1, 2011
  1. Malwarebytes' Anti-Malware 1.51.1.1800
    www.malwarebytes.org

    Database version: 7624

    Windows 6.0.6002 Service Pack 2
    Internet Explorer 8.0.6001.19088

    01/09/2011 02:50:38
    mbam-log-2011-09-01 (02-50-38).txt

    Scan type: Quick scan
    Objects scanned: 173071
    Time elapsed: 6 minute(s), 28 second(s)

    Memory Processes Infected: 0
    Memory Modules Infected: 0
    Registry Keys Infected: 23
    Registry Values Infected: 4
    Registry Data Items Infected: 0
    Folders Infected: 1
    Files Infected: 4

    Memory Processes Infected:
    (No malicious items detected)

    Memory Modules Infected:
    (No malicious items detected)

    Registry Keys Infected:
    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{00A6FAF1-072E-44CF-8957-5838F569A31D} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{00A6FAF1-072E-44CF-8957-5838F569A31D} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{07B18EA1-A523-4961-B6BB-170DE4475CCA} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{07B18EA9-A523-4961-B6BB-170DE4475CCA} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{07B18EA9-A523-4961-B6BB-170DE4475CCA} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{07B18EAB-A523-4961-B6BB-170DE4475CCA} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{59C7FC09-1C83-4648-B3E6-003D2BBC7481} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{68AF847F-6E91-45dd-9B68-D6A12C30E5D7} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{9170B96C-28D4-4626-8358-27E6CAEEF907} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{D1A71FA0-FF48-48dd-9B6D-7A13A3E42127} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{DDB1968E-EAD6-40fd-8DAE-FF14757F60C7} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{F138D901-86F0-4383-99B6-9CDD406036DA} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{25560540-9571-4D7B-9389-0F166788785A} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{3DC201FB-E9C9-499C-A11F-23C360D7C3F8} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{63D0ED2C-B45B-4458-8B3B-60C69BBBD83C} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{98D9753D-D73B-42D5-8C85-4469CDA897AB} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{9FF05104-B030-46FC-94B8-81276E4E27DF} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\MyWebSearch.MultipleButton (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\MyWebSearch.MultipleButton.1 (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\MyWebSearch.UrlAlertButton (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\MyWebSearch.UrlAlertButton.1 (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\RunDll32Policy\f3ScrCtr.dll (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\Schemes\f3pss (Adware.MyWebSearch) -> Quarantined and deleted successfully.

    Registry Values Infected:
    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\{330C5F8C-32B5-380B-32C2-4DC6E6E4F756} (Trojan.Agent) -> Value: {330C5F8C-32B5-380B-32C2-4DC6E6E4F756} -> Delete on reboot.
    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Chacuvurovilox (Trojan.Agent.U) -> Value: Chacuvurovilox -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Wsomawogepukogib (Trojan.Agent.U) -> Value: Wsomawogepukogib -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\4E4H6UZX7HUBYWUXUICZYQUPFFAZ (Trojan.SpyEyes) -> Value: 4E4H6UZX7HUBYWUXUICZYQUPFFAZ -> Quarantined and deleted successfully.

    Registry Data Items Infected:
    (No malicious items detected)

    Folders Infected:
    c:\hdwe2y7.bin (Trojan.SpyEyes) -> Quarantined and deleted successfully.

    Files Infected:
    c:\Users\Alex\AppData\Roaming\Kygyok\erap.exe (Trojan.Agent) -> Quarantined and deleted successfully.
    c:\Users\Alex\downloads\myfuncardssetup2.3.69.8.sa.hp.zufox000.exe (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    c:\Users\Alex\AppData\Local\Temp\0.6062097928956678.exe (Exploit.Drop.2) -> Quarantined and deleted successfully.
    c:\hdwe2y7.bin\92a529d1cbd401f (Trojan.SpyEyes) -> Quarantined and deleted successfully.



    -----------------------------------------------



    .
    DDS (Ver_2011-08-26.01) - NTFSx86
    Internet Explorer: 8.0.6001.19120 BrowserJavaVersion: 1.6.0_23
    Run by Alex at 15:34:38 on 2011-09-01
    Microsoft® Windows Vista™ Home Basic 6.0.6002.2.1252.44.1033.18.984.110 [GMT 1:00]
    .
    AV: McAfee Anti-Virus and Anti-Spyware *Disabled/Updated* {86355677-4064-3EA7-ABB3-1B136EB04637}
    SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
    SP: McAfee Anti-Virus and Anti-Spyware *Disabled/Updated* {3D54B793-665E-3129-9103-206115370C8A}
    FW: McAfee Firewall *Enabled* {BE0ED752-0A0B-3FFF-80EC-B2269063014C}
    .
    ============== Running Processes ===============
    .
    C:\Windows\system32\wininit.exe
    C:\Windows\system32\lsm.exe
    C:\Windows\system32\svchost.exe -k DcomLaunch
    C:\Windows\system32\svchost.exe -k rpcss
    C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
    C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
    C:\Windows\system32\svchost.exe -k netsvcs
    C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_f6ef8056\STacSV.exe
    C:\Windows\system32\svchost.exe -k GPSvcGroup
    C:\Windows\system32\SLsvc.exe
    C:\Windows\servicing\TrustedInstaller.exe
    C:\Windows\system32\svchost.exe -k LocalService
    C:\Program Files\Dell\DellDock\DockLogin.exe
    C:\Windows\system32\svchost.exe -k NetworkService
    C:\Windows\System32\WLTRYSVC.EXE
    C:\Windows\System32\bcmwltry.exe
    C:\Windows\System32\spoolsv.exe
    C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
    C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_f6ef8056\aestsrv.exe
    C:\Windows\System32\svchost.exe -k Akamai
    C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
    C:\Program Files\Bonjour\mDNSResponder.exe
    C:\Windows\system32\svchost.exe -k hpdevmgmt
    C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMon.exe
    C:\Program Files\McAfee Security Scan\2.0.181\McCHSvc.exe
    C:\Program Files\Common Files\McAfee\SystemCore\mfevtps.exe
    C:\Windows\System32\svchost.exe -k HPZ12
    C:\Windows\System32\svchost.exe -k HPZ12
    C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
    C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
    C:\Windows\system32\svchost.exe -k imgsvc
    C:\Windows\System32\svchost.exe -k WerSvcGroup
    C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
    C:\Windows\system32\SearchIndexer.exe
    C:\Windows\system32\RUNDLL32.EXE
    C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
    C:\Program Files\Common Files\McAfee\SystemCore\mcshield.exe
    C:\Program Files\Common Files\McAfee\SystemCore\mfefire.exe
    C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe
    C:\Program Files\Common Files\Mcafee\McSvcHost\McSvHost.exe
    C:\Windows\system32\taskeng.exe
    C:\Windows\system32\Dwm.exe
    C:\Windows\Explorer.EXE
    C:\Program Files\DellTPad\Apoint.exe
    C:\Windows\System32\hkcmd.exe
    C:\Windows\System32\igfxpers.exe
    C:\Windows\System32\WLTRAY.EXE
    C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
    C:\Windows\autoclk.exe
    C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
    C:\Program Files\IDT\WDM\sttray.exe
    C:\Program Files\McAfee.com\Agent\mcagent.exe
    C:\Program Files\Common Files\Java\Java Update\jusched.exe
    C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
    C:\Program Files\iTunes\iTunesHelper.exe
    C:\Program Files\Common Files\Research In Motion\USB Drivers\RIMBBLaunchAgent.exe
    C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe
    C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe
    C:\Program Files\Skype\Phone\Skype.exe
    C:\Users\Alex\AppData\Local\Flock\Update\FlockUpdate.exe
    C:\Program Files\SAGEM\TalkTalk Broadband\dslmon.exe
    C:\Program Files\McAfee Security Scan\2.0.181\SSScheduler.exe
    C:\Windows\system32\taskeng.exe
    C:\Windows\system32\igfxsrvc.exe
    C:\Users\Alex\AppData\Local\Flock\Application\flock.exe
    C:\Windows\system32\wbem\unsecapp.exe
    C:\Windows\system32\wbem\wmiprvse.exe
    C:\Users\Alex\AppData\Local\Flock\Application\flock.exe
    C:\Users\Alex\AppData\Local\Flock\Application\flock.exe
    C:\Users\Alex\AppData\Local\Flock\Application\flock.exe
    C:\Users\Alex\AppData\Local\Flock\Application\flock.exe
    C:\Users\Alex\AppData\Local\Flock\Application\flock.exe
    C:\Program Files\DellTPad\ApMsgFwd.exe
    C:\Program Files\DellTPad\HidFind.exe
    C:\Windows\system32\wbem\wmiprvse.exe
    C:\Program Files\DellTPad\Apntex.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
    C:\Program Files\iPod\bin\iPodService.exe
    C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
    C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
    C:\Program Files\Dell Support Center\bin\sprtsvc.exe
    C:\Windows\system32\wuauclt.exe
    C:\Windows\system32\NOTEPAD.EXE
    .
    ============== Pseudo HJT Report ===============
    .
    uStart Page = hxxp://home.mywebsearch.com/index.jhtml?n=77C09F4F&ptnrS=ZUfox000&ptb=VVB4gV9IfCsZjSCwQAw_JQ
    uInternet Settings,ProxyOverride = *.local
    BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
    BHO: McAfee Phishing Filter: {27b4851a-3207-45a2-b947-be8afe6163ab} - c:\progra~1\mcafee\msk\mskapbho.dll
    BHO: Search Helper: {6ebf7485-159f-4bff-a14f-b9e3aac4465b} - c:\program files\microsoft\search enhancement pack\search helper\SEPsearchhelperie.dll
    BHO: Groove GFS Browser Helper: {72853161-30c5-4d22-b7f9-0bbc1d38a37e} - c:\program files\microsoft office\office12\GrooveShellExtensions.dll
    BHO: scriptproxy: {7db2d5a0-7241-4e79-b68d-6309f01c5231} - c:\program files\common files\mcafee\systemcore\ScriptSn.20110519173633.dll
    BHO: Windows Live ID Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
    BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
    BHO: HP Smart BHO Class: {ffffffff-cf4e-4f2b-bdc2-0e72e116a856} - c:\program files\hp\digital imaging\smart web printing\hpswp_BHO.dll
    TB: {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No File
    uRun: [ISUSPM] "c:\program files\common files\installshield\updateservice\ISUSPM.exe" -scheduler
    uRun: [Skype] "c:\program files\skype\phone\Skype.exe" /nosplash /minimized
    uRun: [Flock Update] "c:\users\alex\appdata\local\flock\update\FlockUpdate.exe" /c
    uRun: [{330C5F8C-32B5-380B-32C2-4DC6E6E4F756}] c:\users\alex\appdata\roaming\kygyok\erap.exe
    mRun: [Apoint] c:\program files\delltpad\Apoint.exe
    mRun: [IgfxTray] c:\windows\system32\igfxtray.exe
    mRun: [HotKeysCmds] c:\windows\system32\hkcmd.exe
    mRun: [Persistence] c:\windows\system32\igfxpers.exe
    mRun: [Broadcom Wireless Manager UI] c:\windows\system32\WLTRAY.exe
    mRun: [IAAnotif] c:\program files\intel\intel matrix storage manager\iaanotif.exe
    mRun: [Microsoft Default Manager] "c:\program files\microsoft\search enhancement pack\default manager\DefMgr.exe" -resume
    mRun: [autoclk] autoclk.exe
    mRun: [GrooveMonitor] "c:\program files\microsoft office\office12\GrooveMonitor.exe"
    mRun: [SysTrayApp] %ProgramFiles%\IDT\WDM\sttray.exe
    mRun: [mcui_exe] "c:\program files\mcafee.com\agent\mcagent.exe" /runkey
    mRun: [AdobeAAMUpdater-1.0] "c:\program files\common files\adobe\oobe\pdapp\uwa\UpdaterStartupUtility.exe"
    mRun: [SunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe"
    mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 10.0\reader\Reader_sl.exe"
    mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe"
    mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime
    mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"
    mRun: [RIMBBLaunchAgent.exe] c:\program files\common files\research in motion\usb drivers\RIMBBLaunchAgent.exe
    mRun: [Malwarebytes' Anti-Malware] "c:\program files\malwarebytes' anti-malware\mbamgui.exe" /starttray
    mRun: [Malwarebytes' Anti-Malware (reboot)] "c:\program files\malwarebytes' anti-malware\mbam.exe" /runcleanupscript
    StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\dslmon.lnk - c:\program files\sagem\talktalk broadband\dslmon.exe
    StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\mcafee~1.lnk - c:\program files\mcafee security scan\2.0.181\SSScheduler.exe
    mPolicies-explorer: BindDirectlyToPropertySetStorage = 0 (0x0)
    mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
    IE: E&xport to Microsoft Excel - c:\progra~1\micros~3\office12\EXCEL.EXE/3000
    IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - c:\program files\windows live\writer\WriterBrowserExtension.dll
    IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\progra~1\micros~3\office12\ONBttnIE.dll
    IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~3\office12\REFIEBAR.DLL
    IE: {DDE87865-83C5-48c4-8357-2F5B1AA84522} - {DDE87865-83C5-48c4-8357-2F5B1AA84522} - c:\program files\hp\digital imaging\smart web printing\hpswp_BHO.dll
    DPF: {8100D56A-5661-482C-BEE8-AFECE305D968} - hxxp://upload.facebook.com/controls/2009.07.28_v5.5.8.1/FacebookPhotoUploader55.cab
    DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_23-windows-i586.cab
    DPF: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_23-windows-i586.cab
    DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_23-windows-i586.cab
    DPF: {DAF7E6E6-D53A-439A-B28D-12271406B8A9} - hxxp://mobileapps.blackberry.com/devicesoftware/AxLoader.cab
    TCP: DhcpNameServer = 172.16.42.1
    TCP: Interfaces\{6909E238-E6C0-4FB1-96F9-449E4B3FDBD6} : DhcpNameServer = 172.16.42.1
    TCP: Interfaces\{BF130E6E-9114-4454-867F-A3E2F3868995} : DhcpNameServer = 194.81.151.70 194.81.151.71
    Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - c:\program files\microsoft office\office12\GrooveSystemServices.dll
    Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~1\common~1\skype\SKYPE4~1.DLL
    Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - c:\program files\windows live\photo gallery\AlbumDownloadProtocolHandler.dll
    Notify: GoToAssist - c:\program files\citrix\gotoassist\514\G2AWinLogon.dll
    Notify: igfxcui - igfxdev.dll
    SEH: Groove GFS Stub Execution Hook: {b5a7f190-dda6-4420-b3ba-52453494e6cd} - c:\program files\microsoft office\office12\GrooveShellExtensions.dll
    .
    ================= FIREFOX ===================
    .
    FF - ProfilePath - c:\users\alex\appdata\roaming\mozilla\firefox\profiles\46moaji9.default\
    FF - prefs.js: browser.search.selectedEngine - Search the Web
    FF - prefs.js: browser.startup.homepage - hxxp://www.igoogle.com/
    FF - prefs.js: network.proxy.type - 2
    FF - plugin: c:\program files\common files\research in motion\bbwebsllauncher\NPWebSLLauncher.dll
    FF - plugin: c:\program files\java\jre6\bin\new_plugin\npdeployJava1.dll
    FF - plugin: c:\program files\microsoft silverlight\4.0.60531.0\npctrlui.dll
    FF - plugin: c:\program files\mozilla firefox\plugins\npdeployJava1.dll
    FF - plugin: c:\program files\windows live\photo gallery\NPWLPG.dll
    FF - plugin: c:\users\alex\appdata\local\flock\update\1.2.213.0\npFlockOneClick8.dll
    .
    ---- FIREFOX POLICIES ----
    FF - user.js: network.cookie.cookieBehavior - 0
    FF - user.js: privacy.clearOnShutdown.cookies - false
    FF - user.js: security.warn_viewing_mixed - false
    FF - user.js: security.warn_viewing_mixed.show_once - false
    FF - user.js: security.warn_submit_insecure - false
    FF - user.js: security.warn_submit_insecure.show_once - false
    .
    ============= SERVICES / DRIVERS ===============
    .
    R0 mfehidk;McAfee Inc. mfehidk;c:\windows\system32\drivers\mfehidk.sys [2010-8-14 459728]
    R1 mfenlfk;McAfee NDIS Light Filter;c:\windows\system32\drivers\mfenlfk.sys [2010-8-14 64584]
    R2 AESTFilters;Andrea ST Filters Service;c:\windows\system32\driverstore\filerepository\stwrt.inf_f6ef8056\AEstSrv.exe [2009-9-12 81920]
    R2 Akamai;Akamai NetSession Interface;c:\windows\system32\svchost.exe -k Akamai [2008-1-21 21504]
    R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]
    R2 DockLoginService;Dock Login Service;c:\program files\dell\delldock\DockLogin.exe [2008-12-18 155648]
    R2 FontCache;Windows Font Cache Service;c:\windows\system32\svchost.exe -k LocalServiceAndNoImpersonation [2008-1-21 21504]
    R2 MBAMService;MBAMService;c:\program files\malwarebytes' anti-malware\mbamservice.exe [2011-9-1 366640]
    R2 McComponentHostService;McAfee Security Scan Component Host Service;c:\program files\mcafee security scan\2.0.181\McCHSvc.exe [2010-1-15 227232]
    R2 McMPFSvc;McAfee Personal Firewall Service;c:\program files\common files\mcafee\mcsvchost\McSvHost.exe [2010-8-14 271480]
    R2 McNaiAnn;McAfee VirusScan Announcer;c:\program files\common files\mcafee\mcsvchost\McSvHost.exe [2010-8-14 271480]
    R2 McProxy;McAfee Proxy Service;c:\program files\common files\mcafee\mcsvchost\McSvHost.exe [2010-8-14 271480]
    R2 McShield;McShield;c:\program files\common files\mcafee\systemcore\mcshield.exe [2010-8-14 171168]
    R2 mfefire;McAfee Firewall Core Service;c:\program files\common files\mcafee\systemcore\mfefire.exe [2010-8-14 188136]
    R2 mfevtp;McAfee Validation Trust Protection Service;c:\program files\common files\mcafee\systemcore\mfevtps.exe [2010-8-14 148520]
    R2 SBSDWSCService;SBSD Security Center Service;c:\program files\spybot - search & destroy\SDWinSec.exe [2009-10-17 1153368]
    R2 yksvc;Marvell Yukon Service;RUNDLL32.EXE ykx32coinst,serviceStartProc --> RUNDLL32.EXE ykx32coinst,serviceStartProc [?]
    R3 cfwids;McAfee Inc. cfwids;c:\windows\system32\drivers\cfwids.sys [2010-8-14 56064]
    R3 CtClsFlt;Creative Camera Class Upper Filter Driver;c:\windows\system32\drivers\CtClsFlt.sys [2009-9-12 144128]
    R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2011-9-1 22712]
    R3 mfeavfk;McAfee Inc. mfeavfk;c:\windows\system32\drivers\mfeavfk.sys [2010-8-14 153280]
    R3 mfebopk;McAfee Inc. mfebopk;c:\windows\system32\drivers\mfebopk.sys [2010-8-14 52320]
    R3 mfefirek;McAfee Inc. mfefirek;c:\windows\system32\drivers\mfefirek.sys [2010-8-14 314088]
    R3 OA009Ufd;Creative Camera OA009 Upper Filter Driver;c:\windows\system32\drivers\OA009Ufd.sys [2009-3-6 133632]
    R3 OA009Vid;Creative Camera OA009 Function Driver;c:\windows\system32\drivers\OA009Vid.sys [2009-3-19 271552]
    S3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\system32\drivers\mbamswissarmy.sys [2011-9-1 41272]
    S3 mferkdet;McAfee Inc. mferkdet;c:\windows\system32\drivers\mferkdet.sys [2010-8-14 84488]
    S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\microsoft.net\framework\v4.0.30319\wpf\WPFFontCache_v0400.exe [2010-3-18 753504]
    .
    =============== Created Last 30 ================
    .
    2011-09-01 01:42:01 -------- d-----w- c:\users\alex\appdata\roaming\Malwarebytes
    2011-09-01 01:41:45 41272 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
    2011-09-01 01:41:44 -------- d-----w- c:\programdata\Malwarebytes
    2011-09-01 01:41:40 22712 ----a-w- c:\windows\system32\drivers\mbam.sys
    2011-09-01 01:41:40 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
    2011-09-01 01:35:56 2409784 ----a-w- c:\program files\windows mail\OESpamFilter.dat
    2011-09-01 01:34:40 2048 ----a-w- c:\windows\system32\tzres.dll
    2011-09-01 01:31:44 3602832 ----a-w- c:\windows\system32\ntkrnlpa.exe
    2011-09-01 01:31:44 3550096 ----a-w- c:\windows\system32\ntoskrnl.exe
    2011-09-01 01:31:16 905104 ----a-w- c:\windows\system32\drivers\tcpip.sys
    2011-08-26 13:28:18 -------- d-----w- c:\users\alex\appdata\roaming\Dehiac
    2011-08-02 17:36:51 53248 ----a-r- c:\users\alex\appdata\roaming\microsoft\installer\{12baa98c-f8dd-4bc9-bbe6-1c8463114197}\ARPPRODUCTICON.exe
    .
    ==================== Find3M ====================
    .
    2011-07-23 11:04:29 916480 ----a-w- c:\windows\system32\wininet.dll
    2011-07-23 11:00:05 43520 ----a-w- c:\windows\system32\licmgr10.dll
    2011-07-23 10:59:52 1469440 ----a-w- c:\windows\system32\inetcpl.cpl
    2011-07-23 10:59:34 71680 ----a-w- c:\windows\system32\iesetup.dll
    2011-07-23 10:59:34 109056 ----a-w- c:\windows\system32\iesysprep.dll
    2011-07-23 10:03:47 385024 ----a-w- c:\windows\system32\html.iec
    2011-07-23 09:27:04 133632 ----a-w- c:\windows\system32\ieUnatt.exe
    2011-07-23 09:25:38 1638912 ----a-w- c:\windows\system32\mshtml.tlb
    2011-07-06 15:31:47 214016 ----a-w- c:\windows\system32\drivers\mrxsmb10.sys
    2011-06-24 11:34:21 404640 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
    2011-06-17 16:03:18 375808 ----a-w- c:\windows\system32\winsrv.dll
    .
    ============= FINISH: 15:37:27.91 ===============


    ---------------------------------------


    .
    UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
    IF REQUESTED, ZIP IT UP & ATTACH IT
    .
    DDS (Ver_2011-08-26.01)
    .
    Microsoft® Windows Vista™ Home Basic
    Boot Device: \Device\HarddiskVolume3
    Install Date: 12/09/2009 04:30:12
    System Uptime: 01/09/2011 15:20:58 (0 hours ago)
    .
    Motherboard: Dell Inc. | | 0G848F
    Processor: Intel(R) Celeron(R) CPU 900 @ 2.20GHz | Microprocessor | 2194/200mhz
    .
    ==== Disk Partitions =========================
    .
    C: is FIXED (NTFS) - 134 GiB total, 66.219 GiB free.
    D: is FIXED (NTFS) - 15 GiB total, 7.603 GiB free.
    E: is CDROM ()
    .
    ==== Disabled Device Manager Items =============
    .
    Class GUID: {4d36e972-e325-11ce-bfc1-08002be10318}
    Description: Microsoft 6to4 Adapter
    Device ID: ROOT\*6TO4MP\0002
    Manufacturer: Microsoft
    Name: 6TO4 Adapter
    PNP Device ID: ROOT\*6TO4MP\0002
    Service: tunnel
    .
    ==== System Restore Points ===================
    .
    .
    ==== Installed Programs ======================
    .
    Update for Microsoft Office 2007 (KB2508958)
    32 Bit HP CIO Components Installer
    Acrobat.com
    Adobe AIR
    Adobe Community Help
    Adobe Flash Player 10 ActiveX
    Adobe Flash Player 10 Plugin
    Adobe Media Player
    Adobe Reader X (10.0.1)
    Adobe Shockwave Player 11.5
    Advanced Audio FX Engine
    Akamai NetSession Interface
    Apple Application Support
    Apple Mobile Device Support
    Apple Software Update
    BlackBerry Desktop Software 6.0.1
    BlackBerry Device Software Updater
    Bonjour
    BufferChm
    C4400
    C4400_Help
    Cards_Calendar_OrderGift_DoMorePlugout
    CCleaner (remove only)
    Cisco EAP-FAST Module
    Cisco LEAP Module
    Cisco PEAP Module
    Compatibility Pack for the 2007 Office system
    Copy
    CopyTrans Suite Remove Only
    D3DX10
    Dell-eBay
    Dell DataSafe Online
    Dell Dock
    Dell Edoc Viewer
    Dell Getting Started Guide
    Dell Support Center (Support Software)
    Dell Touchpad
    Dell Video Chat
    Dell Webcam Central
    Dell Wireless WLAN Card Utility
    Destination Component
    DeviceDiscovery
    DeviceManagementQFolder
    DocProc
    DocProcQFolder
    eSupportQFolder
    Flock (3.5.3.4641)
    GoToAssist 8.0.0.514
    GPBaseService
    Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)
    Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)
    HP Imaging Device Functions 10.0
    HP Photosmart C4400 All-In-One Driver Software 10.0 Rel .3
    HP Photosmart Essential 2.5
    HP Smart Web Printing
    HP Solution Center 10.0
    HP Update
    HPPhotoSmartPhotobookWebPack1
    HPProductAssistant
    inSSIDer 2.0
    Integrated Webcam Driver (1.02.01.0320)
    Intel(R) TV Wizard
    Intel® Matrix Storage Manager
    iTunes
    Java Auto Updater
    Java(TM) 6 Update 23
    Junk Mail filter update
    Malwarebytes' Anti-Malware version 1.51.1.1800
    McAfee Security Scan Plus
    McAfee SecurityCenter
    Microsoft .NET Framework 3.5 SP1
    Microsoft .NET Framework 4 Client Profile
    Microsoft Application Error Reporting
    Microsoft Default Manager
    Microsoft Office 2007 Service Pack 2 (SP2)
    Microsoft Office Access MUI (English) 2007
    Microsoft Office Access Setup Metadata MUI (English) 2007
    Microsoft Office Enterprise 2007
    Microsoft Office Excel MUI (English) 2007
    Microsoft Office Groove MUI (English) 2007
    Microsoft Office Groove Setup Metadata MUI (English) 2007
    Microsoft Office Home and Student 2007
    Microsoft Office InfoPath MUI (English) 2007
    Microsoft Office OneNote MUI (English) 2007
    Microsoft Office Outlook MUI (English) 2007
    Microsoft Office PowerPoint MUI (English) 2007
    Microsoft Office PowerPoint Viewer 2007 (English)
    Microsoft Office Proof (English) 2007
    Microsoft Office Proof (French) 2007
    Microsoft Office Proof (Spanish) 2007
    Microsoft Office Proofing (English) 2007
    Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
    Microsoft Office Publisher MUI (English) 2007
    Microsoft Office Shared MUI (English) 2007
    Microsoft Office Shared Setup Metadata MUI (English) 2007
    Microsoft Office Suite Activation Assistant
    Microsoft Office Word MUI (English) 2007
    Microsoft Search Enhancement Pack
    Microsoft Silverlight
    Microsoft SQL Server 2005 Compact Edition [ENU]
    Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
    Microsoft Visual C++ 2005 Redistributable
    Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
    Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570
    Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022
    Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
    Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
    Microsoft Works
    Microsoft_VC80_ATL_x86
    Microsoft_VC80_CRT_x86
    Microsoft_VC80_MFC_x86
    Microsoft_VC80_MFCLOC_x86
    Microsoft_VC90_ATL_x86
    Microsoft_VC90_CRT_x86
    Microsoft_VC90_MFC_x86
    Mozilla Firefox 5.0 (x86 en-GB)
    MSVCRT
    MSXML 4.0 SP2 (KB954430)
    MSXML 4.0 SP2 (KB973688)
    OCR Software by I.R.I.S. 10.0
    OGA Notifier 2.0.0048.0
    PanoStandAlone
    Poladroid
    PowerDVD DX
    PS_AIO_03_C4400_ProductContext
    PS_AIO_03_C4400_Software
    PS_AIO_03_C4400_Software_Min
    PSSWCORE
    QuickSet
    QuickTime
    Scan
    Security Update for 2007 Microsoft Office System (KB2288621)
    Security Update for 2007 Microsoft Office System (KB2288931)
    Security Update for 2007 Microsoft Office System (KB2345043)
    Security Update for 2007 Microsoft Office System (KB2509488)
    Security Update for 2007 Microsoft Office System (KB969559)
    Security Update for 2007 Microsoft Office System (KB976321)
    Security Update for Microsoft .NET Framework 3.5 SP1 (KB2416473)
    Security Update for Microsoft .NET Framework 4 Client Profile (KB2446708)
    Security Update for Microsoft .NET Framework 4 Client Profile (KB2478663)
    Security Update for Microsoft .NET Framework 4 Client Profile (KB2518870)
    Security Update for Microsoft Office 2007 System (KB2541012)
    Security Update for Microsoft Office Access 2007 (KB979440)
    Security Update for Microsoft Office Excel 2007 (KB2541007)
    Security Update for Microsoft Office Groove 2007 (KB2494047)
    Security Update for Microsoft Office InfoPath 2007 (KB2510061)
    Security Update for Microsoft Office InfoPath 2007 (KB979441)
    Security Update for Microsoft Office PowerPoint 2007 (KB2535818)
    Security Update for Microsoft Office PowerPoint Viewer 2007 (KB2464623)
    Security Update for Microsoft Office Publisher 2007 (KB2284697)
    Security Update for Microsoft Office system 2007 (972581)
    Security Update for Microsoft Office system 2007 (KB974234)
    Security Update for Microsoft Office Visio Viewer 2007 (KB973709)
    Security Update for Microsoft Office Word 2007 (KB2344993)
    Segoe UI
    Skype™ 5.2
    SmartWebPrintingOC
    SolutionCenter
    Spelling Dictionaries Support For Adobe Reader 9
    Spybot - Search & Destroy
    Status
    TalkTalk Broadband
    Toolbox
    TrayApp
    UnloadSupport
    Update for 2007 Microsoft Office System (KB967642)
    Update for Microsoft .NET Framework 3.5 SP1 (KB963707)
    Update for Microsoft Office 2007 Help for Common Features (KB963673)
    Update for Microsoft Office 2007 System (KB2539530)
    Update for Microsoft Office Access 2007 Help (KB963663)
    Update for Microsoft Office Excel 2007 Help (KB963678)
    Update for Microsoft Office Infopath 2007 Help (KB963662)
    Update for Microsoft Office OneNote 2007 (KB980729)
    Update for Microsoft Office OneNote 2007 Help (KB963670)
    Update for Microsoft Office Outlook 2007 (KB2509470)
    Update for Microsoft Office Outlook 2007 Help (KB963677)
    Update for Microsoft Office Powerpoint 2007 Help (KB963669)
    Update for Microsoft Office Publisher 2007 Help (KB963667)
    Update for Microsoft Office Script Editor Help (KB963671)
    Update for Microsoft Office Word 2007 Help (KB963665)
    Update for Outlook 2007 Junk Email Filter (KB2586924)
    VC80CRTRedist - 8.0.50727.762
    VideoToolkit01
    WebReg
    Windows 7 Upgrade Advisor
    Windows Live Communications Platform
    Windows Live Essentials
    Windows Live ID Sign-in Assistant
    Windows Live Installer
    Windows Live Mail
    Windows Live Messenger
    Windows Live MIME IFilter
    Windows Live Movie Maker
    Windows Live Photo Common
    Windows Live Photo Gallery
    Windows Live PIMT Platform
    Windows Live SOXE
    Windows Live SOXE Definitions
    Windows Live Sync
    Windows Live UX Platform
    Windows Live UX Platform Language Pack
    Windows Live Writer
    Windows Live Writer Resources
    Windows Media Player Firefox Plugin
    WinRAR archiver
    .
    ==== Event Viewer Messages From Past Week ========
    .
    31/08/2011 14:26:35, Error: Service Control Manager [7031] - The McShield service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 5000 milliseconds: Restart the service.
    30/08/2011 21:17:18, Error: Service Control Manager [7001] - The Network List Service service depends on the Network Location Awareness service which failed to start because of the following error: The dependency service or group failed to start.
    30/08/2011 20:56:00, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service McNaiAnn with arguments "" in order to run the server: {DC7EF8E1-824F-4110-AB43-1604DA9B4F40}
    30/08/2011 20:52:55, Error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: AFD DfsC mfehidk mfenlfk mfewfpk NetBIOS netbt nsiproxy PSched RasAcd rdbss Smb spldr Tcpip tdx Wanarpv6
    30/08/2011 20:52:55, Error: Service Control Manager [7001] - The Workstation service depends on the Network Store Interface Service service which failed to start because of the following error: The dependency service or group failed to start.
    30/08/2011 20:52:55, Error: Service Control Manager [7001] - The WebDav Client Redirector Driver service depends on the Redirected Buffering Sub Sysytem service which failed to start because of the following error: A device attached to the system is not functioning.
    30/08/2011 20:52:55, Error: Service Control Manager [7001] - The WebClient service depends on the WebDav Client Redirector Driver service which failed to start because of the following error: The dependency service or group failed to start.
    30/08/2011 20:52:55, Error: Service Control Manager [7001] - The TCP/IP Registry Compatibility service depends on the TCP/IP Protocol Driver service which failed to start because of the following error: A device attached to the system is not functioning.
    30/08/2011 20:52:55, Error: Service Control Manager [7001] - The TCP/IP NetBIOS Helper service depends on the Ancilliary Function Driver for Winsock service which failed to start because of the following error: A device attached to the system is not functioning.
    30/08/2011 20:52:55, Error: Service Control Manager [7001] - The SMB MiniRedirector Wrapper and Engine service depends on the Redirected Buffering Sub Sysytem service which failed to start because of the following error: A device attached to the system is not functioning.
    30/08/2011 20:52:55, Error: Service Control Manager [7001] - The SMB 2.0 MiniRedirector service depends on the SMB MiniRedirector Wrapper and Engine service which failed to start because of the following error: The dependency service or group failed to start.
    30/08/2011 20:52:55, Error: Service Control Manager [7001] - The SMB 1.x MiniRedirector service depends on the SMB MiniRedirector Wrapper and Engine service which failed to start because of the following error: The dependency service or group failed to start.
    30/08/2011 20:52:55, Error: Service Control Manager [7001] - The Network Store Interface Service service depends on the NSI proxy service service which failed to start because of the following error: A device attached to the system is not functioning.
    30/08/2011 20:52:55, Error: Service Control Manager [7001] - The Network Location Awareness service depends on the TCP/IP Protocol Driver service which failed to start because of the following error: A device attached to the system is not functioning.
    30/08/2011 20:52:55, Error: Service Control Manager [7001] - The McShield service depends on the McAfee Validation Trust Protection Service service which failed to start because of the following error: The dependency service or group failed to start.
    30/08/2011 20:52:55, Error: Service Control Manager [7001] - The McAfee Validation Trust Protection Service service depends on the McAfee Inc. mfehidk service which failed to start because of the following error: A device attached to the system is not functioning.
    30/08/2011 20:52:55, Error: Service Control Manager [7001] - The McAfee Proxy Service service depends on the McAfee Firewall Core Service service which failed to start because of the following error: The dependency service or group failed to start.
    30/08/2011 20:52:55, Error: Service Control Manager [7001] - The McAfee Personal Firewall Service service depends on the McAfee Firewall Core Service service which failed to start because of the following error: The dependency service or group failed to start.
    30/08/2011 20:52:55, Error: Service Control Manager [7001] - The McAfee Firewall Core Service service depends on the McAfee Validation Trust Protection Service service which failed to start because of the following error: The dependency service or group failed to start.
    30/08/2011 20:52:55, Error: Service Control Manager [7001] - The McAfee Anti-Spam Service service depends on the McAfee Firewall Core Service service which failed to start because of the following error: The dependency service or group failed to start.
    30/08/2011 20:52:55, Error: Service Control Manager [7001] - The IP Helper service depends on the Network Store Interface Service service which failed to start because of the following error: The dependency service or group failed to start.
    30/08/2011 20:52:55, Error: Service Control Manager [7001] - The DNS Client service depends on the NetIO Legacy TDI Support Driver service which failed to start because of the following error: A device attached to the system is not functioning.
    30/08/2011 20:52:55, Error: Service Control Manager [7001] - The DHCP Client service depends on the Ancilliary Function Driver for Winsock service which failed to start because of the following error: A device attached to the system is not functioning.
    30/08/2011 20:52:55, Error: Service Control Manager [7001] - The Computer Browser service depends on the Server service which failed to start because of the following error: The dependency service or group failed to start.
    30/08/2011 20:52:55, Error: Service Control Manager [7001] - The Bonjour Service service depends on the TCP/IP Protocol Driver service which failed to start because of the following error: A device attached to the system is not functioning.
    30/08/2011 20:52:55, Error: Service Control Manager [7001] - The Apple Mobile Device service depends on the TCP/IP Protocol Driver service which failed to start because of the following error: A device attached to the system is not functioning.
    30/08/2011 20:52:54, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service WSearch with arguments "" in order to run the server: {9E175B6D-F52A-11D8-B9A5-505054503030}
    30/08/2011 20:52:18, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1068" attempting to start the service netprofm with arguments "" in order to run the server: {A47979D2-C419-11D9-A5B4-001185AD2B89}
    30/08/2011 20:52:18, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1068" attempting to start the service netman with arguments "" in order to run the server: {BA126AD1-2166-11D1-B1D0-00805FC1270E}
    30/08/2011 20:52:17, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service EventSystem with arguments "" in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF}
    30/08/2011 20:52:10, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service ShellHWDetection with arguments "" in order to run the server: {DD522ACC-F821-461A-A407-50B198B896DC}
    30/08/2011 20:51:44, Error: EventLog [6008] - The previous system shutdown at 18:28:38 on 30/08/2011 was unexpected.
    29/08/2011 17:23:55, Error: EventLog [6008] - The previous system shutdown at 17:21:28 on 29/08/2011 was unexpected.
    29/08/2011 11:04:14, Error: Service Control Manager [7011] - A timeout (30000 milliseconds) was reached while waiting for a transaction response from the PlugPlay service.
    28/08/2011 12:38:50, Error: Service Control Manager [7011] - A timeout (30000 milliseconds) was reached while waiting for a transaction response from the Netman service.
    27/08/2011 17:42:37, Error: EventLog [6008] - The previous system shutdown at 14:15:03 on 27/08/2011 was unexpected.
    27/08/2011 13:14:15, Error: EventLog [6008] - The previous system shutdown at 08:53:06 on 27/08/2011 was unexpected.
    01/09/2011 15:24:33, Error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: mfewfpk
    01/09/2011 15:24:33, Error: Service Control Manager [7022] - The HP CUE DeviceDiscovery Service service hung on starting.
    01/09/2011 15:23:06, Error: Service Control Manager [7000] - The USB ADSL WAN Adapter service failed to start due to the following error: The service cannot be started, either because it is disabled or because it has no enabled devices associated with it.
    01/09/2011 15:23:06, Error: Service Control Manager [7000] - The Intel(R) PRO/1000 PCI Express Network Connection Driver service failed to start due to the following error: The service cannot be started, either because it is disabled or because it has no enabled devices associated with it.
    01/09/2011 15:23:06, Error: Service Control Manager [7000] - The Intel(R) PRO/1000 NDIS 6 Adapter Driver service failed to start due to the following error: The service cannot be started, either because it is disabled or because it has no enabled devices associated with it.
    01/09/2011 15:23:06, Error: Service Control Manager [7000] - The General Purpose USB Driver (adildr.sys) service failed to start due to the following error: The service cannot be started, either because it is disabled or because it has no enabled devices associated with it.
    01/09/2011 15:21:44, Error: EventLog [6008] - The previous system shutdown at 15:19:08 on 01/09/2011 was unexpected.
    01/09/2011 15:21:07, Error: Microsoft-Windows-Kernel-Processor-Power [2] - Performance power management features on processor 0 are disabled due to a firmware problem. Check with the computer manufacturer for updated firmware.
    01/09/2011 15:11:08, Error: Service Control Manager [7011] - A timeout (30000 milliseconds) was reached while waiting for a transaction response from the stisvc service.
    01/09/2011 12:17:36, Error: Service Control Manager [7009] - A timeout was reached (30000 milliseconds) while waiting for the Windows Search service to connect.
    01/09/2011 12:17:36, Error: Service Control Manager [7000] - The Windows Search service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
    01/09/2011 12:17:36, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1053" attempting to start the service WSearch with arguments "" in order to run the server: {7D096C5F-AC08-4F1F-BEB7-5C22C517CE39}
    01/09/2011 12:02:50, Error: Microsoft-Windows-Dhcp-Client [1001] - Your computer was not assigned an address from the network (by the DHCP Server) for the Network Card with network address 00265E7CF8D9. The following error occurred: The semaphore timeout period has expired.. Your computer will continue to try and obtain an address on its own from the network address (DHCP) server.
    01/09/2011 12:01:30, Error: EventLog [6008] - The previous system shutdown at 03:21:40 on 01/09/2011 was unexpected.
    01/09/2011 02:58:08, Error: EventLog [6008] - The previous system shutdown at 02:56:43 on 01/09/2011 was unexpected.
    01/09/2011 02:52:42, Error: Service Control Manager [7034] - The Marvell Yukon Service service terminated unexpectedly. It has done this 1 time(s).
    .
    ==== End Of File ===========================

    ----------------------------------


    GMER 1.0.15.15641 - http://www.gmer.net
    Rootkit quick scan 2011-09-01 03:20:55
    Windows 6.0.6002 Service Pack 2 Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1 WDC_WD16 rev.11.0
    Running: todi573f.exe; Driver: C:\Users\Alex\AppData\Local\Temp\uxldapow.sys


    ---- System - GMER 1.0.15 ----

    Code \SystemRoot\system32\drivers\mfehidk.sys (McAfee Link Driver/McAfee, Inc.) ZwMapViewOfSection [0x8615BD48]
    Code \SystemRoot\system32\drivers\mfehidk.sys (McAfee Link Driver/McAfee, Inc.) ZwTerminateProcess [0x8615BD72]
    Code \SystemRoot\system32\drivers\mfehidk.sys (McAfee Link Driver/McAfee, Inc.) ZwUnmapViewOfSection [0x8615BD5E]
    Code \SystemRoot\system32\drivers\mfehidk.sys (McAfee Link Driver/McAfee, Inc.) ZwYieldExecution [0x8615BD34]
    Code \SystemRoot\system32\drivers\mfehidk.sys (McAfee Link Driver/McAfee, Inc.) NtMapViewOfSection

    ---- Devices - GMER 1.0.15 ----

    AttachedDevice \FileSystem\fastfat \Fat fltmgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)
    AttachedDevice \FileSystem\fastfat \Fat mfehidk.sys (McAfee Link Driver/McAfee, Inc.)

    ---- EOF - GMER 1.0.15 ----
     
  2. Bobbye

    Bobbye Helper on the Fringe Posts: 16,335   +36

    Welcome to TechSpot! I'll be glad to help with the malware.

    My Guidelines: please read and follow:
    • Be patient. Malware cleaning takes time and I am also working with other members while I am helping you.
    • Read my instructions carefully. If you don't understand or have a problem, ask me.
    • If you have questions, or if a program doesn't work, stop and tell me about it. Don't try to get around it yourself.
    • Follow the order of the tasks I give you. Order is crucial in cleaning process.
    • File sharing programs should be uninstalled or disabled during the cleaning process..
    • Observe these:
      [o] Don't use any other cleaning programs or scans while I'm helping you.
      [o] Don't use a Registry cleaner or make any changes in the Registry.
      [o] Don't download and install new programs- except those I give you.
    • Please let me know if there is any change in the system.

    If I don't get a reply from you in 5 days, the thread will be closed. If your problem persist, you can send a PM to reopen it.
    =====================================
    You are very short on information:
    1. What is slow?
    2. What happens when you lunch Firefox?
    3. Are you aware that your are running Flock?
    Flock was a web browser that specialized in providing social networking and Web 2.0 facilities built into its user interface. Originally Flock was available as a free download but as of April 2011, support for it stopped and users were referred to Chrome or Firefox.
    Download Flock [DISCONTINUED] 3.5.3.4641 / 2.6.1
    You have many processes for Flock running including this updater> but it has nowhere to go except to the website that tells you there is no longer any support for Flock..
    uRun: [Flock Update] "c:\users\alex\appdata\local\flock\update\FlockUpdate.exe" /c
    ====================================
    I would think you need to uninstall the now defunct Flock, then make Firefox the default browser.
    ====================================
    You may also have a mass mailing Worm:
    uRun: [{330C5F8C-32B5-380B-32C2-4DC6E6E4F756}] c:\users\alex\appdata\roaming\kygyok\erap.exe
    • Hold down Control and click on the following link to open ESET OnlineScan in a new window.
      ESETOnlineScan
    • For alternate browsers only: (Microsoft Internet Explorer users can skip these steps)
      [o] Click on Posted Image to download the ESET Smart Installer. Save it to your desktop.
      [o] Double click on the [​IMG]on your desktop.
    • Check 'Yes I accept terms of use.'
    • Click Start button
    • Accept any security warnings from your browser.
      [​IMG]
    • Uncheck 'Remove found threats'
    • Check 'Scan archives/
    • Leave remaining settings as is.
    • Press the Start button.
    • ESET will then download updates for itself, install itself, and begin scanning your computer. Please wait for the scan to finish.
    • When the scan completes, press List of found threats
    • Push Export of text file and save the file to your desktop using a unique name, such as ESETScan. Paste this log in your next reply.
    • Push the Back button
    • Push Finish

    NOTE: If no malware is found then no log will be produced. Let me know if this is the case.
    ======================================
    We do need to remove entries for MyWeSearch, so please run the following:
    Please note: If you have previously run Combofix and it's still on the system, please uninstall it. Then download the current version and do the scan: Uninstall directions, if needed
    • Click START> then RUN
    • Now type Combofix /Uninstall in the runbox and click OK. Note the space between the X and the U, it needs to be there.
    --------------------------------------
    Download Combofix from HERE or HERE and save to the desktop
    • Double click combofix.exe & follow the prompts.
    • ComboFix will check to see if the Microsoft Windows Recovery Console is installed. It is recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode if needed.
      **Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.
    • Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.
    • Once installed, you should see a blue screen prompt that says:
      The Recovery Console was successfully installed.
    • .Click on Yes, to continue scanning for malware
    • .If Combofix asks you to update the program, allow
    • .Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
    • .Close any open browsers.
    • .Double click combofix.exe[​IMG] & follow the prompts to run.
    • When the scan completes , a report will be generated-it will open a text window. Please paste the C:\ComboFix.txt in next reply..
    Re-enable your Antivirus software.

    Note 1:Do not mouse-click Combofix's window while it is running. That may cause it to stall.
    Note 2: ComboFix may reset a number of Internet Explorer's settings, including making I-E the default browser.
    Note 3: Combofix prevents autorun of ALL CD, floppy and USB devices to assist with malware removal & increase security. If this is an issue or makes it difficult for you -- please tell your helper.
    Note 4: CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.
    Note 5: If you receive an error "Illegal operation attempted on a registry key that has been marked for deletion", restart computer to fix the issue.
    ===============================================
    Please update Java to v6u27: Java Updates Uninstall v623 and any other outdated r versions in Add/Remove Programs as they are vulnerabilities for the system.

    Note: Uncheck 'Install Yahoo Toolbar' on the download screen before you do the update.
     
  3. eraserofficial

    eraserofficial TS Rookie Topic Starter

    I've now uninstalled flock and set firefox as my default browser.
    The problem with firefox was that it does not open or respond at all when I click to open it, and still doesn't.

    Here are my logs, thanks for your help:



    -------------

    C:\Program Files\Windows Live\Messenger\msimg32.dll Win32/Toolbar.MyWebSearch application
    C:\Program Files\Windows Live\Messenger\riched20.dll Win32/Toolbar.MyWebSearch application
    C:\ProgramData\Spybot - Search & Destroy\Recovery\FunWebProducts138.zip Win32/Bagle.gen.zip worm
    C:\ProgramData\Spybot - Search & Destroy\Recovery\FunWebProducts139.zip Win32/Bagle.gen.zip worm
    C:\ProgramData\Spybot - Search & Destroy\Recovery\MyWayMyWebSearch1.zip Win32/Bagle.gen.zip worm
    C:\ProgramData\Spybot - Search & Destroy\Recovery\MyWayMyWebSearch131.zip Win32/Bagle.gen.zip worm
    C:\ProgramData\Spybot - Search & Destroy\Recovery\MyWayMyWebSearch133.zip Win32/Bagle.gen.zip worm
    C:\ProgramData\Spybot - Search & Destroy\Recovery\MyWayMyWebSearch134.zip Win32/Bagle.gen.zip worm
    C:\ProgramData\Spybot - Search & Destroy\Recovery\MyWayMyWebSearch138.zip Win32/Bagle.gen.zip worm
    C:\ProgramData\Spybot - Search & Destroy\Recovery\MyWayMyWebSearch139.zip Win32/Bagle.gen.zip worm
    C:\ProgramData\Spybot - Search & Destroy\Recovery\MyWayMyWebSearch141.zip Win32/Bagle.gen.zip worm
    C:\ProgramData\Spybot - Search & Destroy\Recovery\MyWayMyWebSearch144.zip Win32/Bagle.gen.zip worm
    C:\ProgramData\Spybot - Search & Destroy\Recovery\MyWayMyWebSearch156.zip Win32/Bagle.gen.zip worm
    C:\ProgramData\Spybot - Search & Destroy\Recovery\MyWayMyWebSearch190.zip Win32/Bagle.gen.zip worm
    C:\ProgramData\Spybot - Search & Destroy\Recovery\MyWayMyWebSearch193.zip Win32/Bagle.gen.zip worm
    C:\ProgramData\Spybot - Search & Destroy\Recovery\MyWayMyWebSearch284.zip Win32/Bagle.gen.zip worm
    C:\ProgramData\Spybot - Search & Destroy\Recovery\MyWayMyWebSearch5.zip Win32/Bagle.gen.zip worm
    C:\ProgramData\Spybot - Search & Destroy\Recovery\MyWayMyWebSearch8.zip Win32/Bagle.gen.zip worm
    C:\Users\Alex\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\20\36c09694-2b637c2f multiple threats
    C:\Users\All Users\Spybot - Search & Destroy\Recovery\FunWebProducts138.zip Win32/Bagle.gen.zip worm
    C:\Users\All Users\Spybot - Search & Destroy\Recovery\FunWebProducts139.zip Win32/Bagle.gen.zip worm
    C:\Users\All Users\Spybot - Search & Destroy\Recovery\MyWayMyWebSearch1.zip Win32/Bagle.gen.zip worm
    C:\Users\All Users\Spybot - Search & Destroy\Recovery\MyWayMyWebSearch131.zip Win32/Bagle.gen.zip worm
    C:\Users\All Users\Spybot - Search & Destroy\Recovery\MyWayMyWebSearch133.zip Win32/Bagle.gen.zip worm
    C:\Users\All Users\Spybot - Search & Destroy\Recovery\MyWayMyWebSearch134.zip Win32/Bagle.gen.zip worm
    C:\Users\All Users\Spybot - Search & Destroy\Recovery\MyWayMyWebSearch138.zip Win32/Bagle.gen.zip worm
    C:\Users\All Users\Spybot - Search & Destroy\Recovery\MyWayMyWebSearch139.zip Win32/Bagle.gen.zip worm
    C:\Users\All Users\Spybot - Search & Destroy\Recovery\MyWayMyWebSearch141.zip Win32/Bagle.gen.zip worm
    C:\Users\All Users\Spybot - Search & Destroy\Recovery\MyWayMyWebSearch144.zip Win32/Bagle.gen.zip worm
    C:\Users\All Users\Spybot - Search & Destroy\Recovery\MyWayMyWebSearch156.zip Win32/Bagle.gen.zip worm
    C:\Users\All Users\Spybot - Search & Destroy\Recovery\MyWayMyWebSearch190.zip Win32/Bagle.gen.zip worm
    C:\Users\All Users\Spybot - Search & Destroy\Recovery\MyWayMyWebSearch193.zip Win32/Bagle.gen.zip worm
    C:\Users\All Users\Spybot - Search & Destroy\Recovery\MyWayMyWebSearch284.zip Win32/Bagle.gen.zip worm
    C:\Users\All Users\Spybot - Search & Destroy\Recovery\MyWayMyWebSearch5.zip Win32/Bagle.gen.zip worm
    C:\Users\All Users\Spybot - Search & Destroy\Recovery\MyWayMyWebSearch8.zip Win32/Bagle.gen.zip worm


    -----------------------


    ComboFix 11-09-03.01 - Alex 03/09/2011 20:21:19.3.1 - x86
    Microsoft® Windows Vista™ Home Basic 6.0.6002.2.1252.44.1033.18.984.175 [GMT 1:00]
    Running from: c:\users\Alex\Desktop\ComboFix.exe
    AV: McAfee Anti-Virus and Anti-Spyware *Disabled/Updated* {86355677-4064-3EA7-ABB3-1B136EB04637}
    FW: McAfee Firewall *Enabled* {BE0ED752-0A0B-3FFF-80EC-B2269063014C}
    SP: McAfee Anti-Virus and Anti-Spyware *Disabled/Updated* {3D54B793-665E-3129-9103-206115370C8A}
    SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
    .
    .
    ((((((((((((((((((((((((( Files Created from 2011-08-03 to 2011-09-03 )))))))))))))))))))))))))))))))
    .
    .
    2011-09-03 19:35 . 2011-09-03 19:35 -------- d-----w- c:\users\Default\AppData\Local\temp
    2011-09-01 19:27 . 2011-09-01 19:27 -------- d-----w- c:\program files\Common Files\Java
    2011-09-01 17:46 . 2011-09-01 17:46 -------- d-----w- c:\program files\ESET
    2011-09-01 01:42 . 2011-09-01 01:42 -------- d-----w- c:\users\Alex\AppData\Roaming\Malwarebytes
    2011-09-01 01:41 . 2011-07-06 18:52 41272 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
    2011-09-01 01:41 . 2011-09-01 01:41 -------- d-----w- c:\programdata\Malwarebytes
    2011-09-01 01:41 . 2011-09-01 01:41 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
    2011-09-01 01:41 . 2011-07-06 18:52 22712 ----a-w- c:\windows\system32\drivers\mbam.sys
    2011-09-01 01:35 . 2011-06-06 10:59 2409784 ----a-w- c:\program files\Windows Mail\OESpamFilter.dat
    2011-09-01 01:34 . 2011-07-11 13:25 2048 ----a-w- c:\windows\system32\tzres.dll
    2011-09-01 01:31 . 2011-06-20 08:54 3602832 ----a-w- c:\windows\system32\ntkrnlpa.exe
    2011-09-01 01:31 . 2011-06-20 08:54 3550096 ----a-w- c:\windows\system32\ntoskrnl.exe
    2011-09-01 01:31 . 2011-06-17 20:13 905104 ----a-w- c:\windows\system32\drivers\tcpip.sys
    2011-08-26 13:28 . 2011-08-28 15:51 -------- d-----w- c:\users\Alex\AppData\Roaming\Dehiac
    .
    .
    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2011-08-02 17:36 . 2011-08-02 17:36 53248 ----a-r- c:\users\Alex\AppData\Roaming\Microsoft\Installer\{12BAA98C-F8DD-4BC9-BBE6-1C8463114197}\ARPPRODUCTICON.exe
    2011-07-19 04:05 . 2010-12-01 00:58 472808 ----a-w- c:\windows\system32\deployJava1.dll
    2011-06-29 20:26 . 2011-06-18 12:31 0 ----a-w- c:\users\Alex\AppData\Local\Nxetuwus.bin
    2011-06-24 11:34 . 2011-06-02 09:16 404640 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
    2011-06-26 02:48 . 2011-05-07 19:13 142296 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll
    2011-04-14 13:01 . 2010-08-14 18:37 24376 ----a-w- c:\program files\mozilla firefox\components\Scriptff.dll
    .
    .
    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4
    .
    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "ISUSPM"="c:\program files\Common Files\InstallShield\UpdateService\ISUSPM.exe" [2007-08-30 205480]
    "Skype"="c:\program files\Skype\Phone\Skype.exe" [2011-02-04 15052168]
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "Apoint"="c:\program files\DellTPad\Apoint.exe" [2009-03-31 217088]
    "IgfxTray"="c:\windows\system32\igfxtray.exe" [2009-03-31 141848]
    "HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2009-03-31 173592]
    "Persistence"="c:\windows\system32\igfxpers.exe" [2009-03-31 150552]
    "Broadcom Wireless Manager UI"="c:\windows\system32\WLTRAY.exe" [2008-12-21 3810304]
    "IAAnotif"="c:\program files\Intel\Intel Matrix Storage Manager\iaanotif.exe" [2008-06-15 178712]
    "Microsoft Default Manager"="c:\program files\Microsoft\Search Enhancement Pack\Default Manager\DefMgr.exe" [2009-04-24 250192]
    "autoclk"="autoclk.exe" [2003-01-30 143360]
    "GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2008-10-25 31072]
    "SysTrayApp"="c:\program files\IDT\WDM\sttray.exe" [2009-03-31 483428]
    "mcui_exe"="c:\program files\McAfee.com\Agent\mcagent.exe" [2011-06-28 1195408]
    "AdobeAAMUpdater-1.0"="c:\program files\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe" [2010-03-06 500208]
    "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 10.0\Reader\Reader_sl.exe" [2011-01-30 35736]
    "Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-11-10 932288]
    "QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2010-11-29 421888]
    "iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2010-12-13 421160]
    "RIMBBLaunchAgent.exe"="c:\program files\Common Files\Research In Motion\USB Drivers\RIMBBLaunchAgent.exe" [2011-02-18 79192]
    "Malwarebytes' Anti-Malware"="c:\program files\Malwarebytes' Anti-Malware\mbamgui.exe" [2011-07-06 449584]
    "Malwarebytes' Anti-Malware (reboot)"="c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2011-07-06 1047656]
    "SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2011-06-09 254696]
    "dellsupportcenter"="c:\program files\Dell Support Center\bin\sprtcmd.exe" [2009-06-03 206064]
    .
    c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
    DSLMON.lnk - c:\program files\SAGEM\TalkTalk Broadband\dslmon.exe [2009-9-17 962661]
    McAfee Security Scan Plus.lnk - c:\program files\McAfee Security Scan\2.0.181\SSScheduler.exe [2010-1-15 255536]
    .
    c:\users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
    Dell Dock First Run.lnk - c:\program files\Dell\DellDock\DellDock.exe [2009-5-28 1320288]
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
    "EnableUIADesktopToggle"= 0 (0x0)
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\GoToAssist]
    2009-09-12 08:57 10536 ----a-w- c:\program files\Citrix\GoToAssist\514\g2awinlogon.dll
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcmscsvc]
    @=""
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]
    @=""
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
    @="Driver"
    .
    [HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^HP Digital Imaging Monitor.lnk]
    path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk
    backup=c:\windows\pss\HP Digital Imaging Monitor.lnk.CommonStartup
    backupExtension=.CommonStartup
    .
    [HKLM\~\startupfolder\C:^Users^Alex^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^Dell Dock.lnk]
    path=c:\users\Alex\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dell Dock.lnk
    backup=c:\windows\pss\Dell Dock.lnk.Startup
    backupExtension=.Startup
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Dell DataSafe Online]
    2009-07-07 15:23 1779952 ----a-w- c:\program files\Dell DataSafe Online\DataSafeOnline.exe
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Dell Webcam Central]
    2009-01-09 18:49 405639 ------w- c:\program files\Dell Webcam\Dell Webcam Central\WebcamDell2.exe
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\dellsupportcenter]
    2009-06-03 19:46 206064 ----a-w- c:\program files\Dell Support Center\bin\sprtcmd.exe
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]
    2007-10-14 20:17 49152 ----a-w- c:\program files\HP\HP Software Update\hpwuSchd2.exe
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\hpqSRMon]
    2007-08-22 15:31 80896 ----a-w- c:\program files\HP\Digital Imaging\bin\HpqSRmon.exe
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
    2010-12-13 17:16 421160 ----a-w- c:\program files\iTunes\iTunesHelper.exe
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\msnmsgr]
    2010-11-10 01:54 4240760 ----a-w- c:\program files\Windows Live\Messenger\msnmsgr.exe
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PDVDDXSrv]
    2009-02-05 02:26 128232 ------w- c:\program files\CyberLink\PowerDVD DX\PDVDDXSrv.exe
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickSet]
    2009-03-26 23:26 1735760 ----a-w- c:\program files\Dell\QuickSet\quickset.exe
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
    2010-11-29 17:38 421888 ----a-w- c:\program files\QuickTime\QTTask.exe
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Windows Defender]
    2008-01-21 02:33 1008184 ----a-w- c:\program files\Windows Defender\MSASCui.exe
    .
    R1 mfewfpk;McAfee Inc. mfewfpk;c:\windows\system32\drivers\mfewfpk.sys [x]
    R1 MpKslf19fe48b;MpKslf19fe48b;c:\windows\system32\MpEngineStore\MpKslf19fe48b.sys [x]
    R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
    R3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\system32\drivers\mbamswissarmy.sys [2011-07-06 41272]
    R3 mferkdet;McAfee Inc. mferkdet;c:\windows\system32\drivers\mferkdet.sys [2011-04-14 84488]
    R3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [2010-03-18 753504]
    S1 mfenlfk;McAfee NDIS Light Filter;c:\windows\system32\DRIVERS\mfenlfk.sys [2011-04-14 64584]
    S2 AESTFilters;Andrea ST Filters Service;c:\windows\System32\DriverStore\FileRepository\stwrt.inf_f6ef8056\aestsrv.exe [2009-03-31 81920]
    S2 Akamai;Akamai NetSession Interface;c:\windows\System32\svchost.exe [2008-01-21 21504]
    S2 DockLoginService;Dock Login Service;c:\program files\Dell\DellDock\DockLogin.exe [2008-12-18 155648]
    S2 MBAMService;MBAMService;c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe [2011-07-06 366640]
    S2 McComponentHostService;McAfee Security Scan Component Host Service;c:\program files\McAfee Security Scan\2.0.181\McCHSvc.exe [2010-01-15 227232]
    S2 McMPFSvc;McAfee Personal Firewall Service;c:\program files\Common Files\Mcafee\McSvcHost\McSvHost.exe [2010-03-10 271480]
    S2 McNaiAnn;McAfee VirusScan Announcer;c:\program files\Common Files\McAfee\McSvcHost\McSvHost.exe [2010-03-10 271480]
    S2 mfefire;McAfee Firewall Core Service;c:\program files\Common Files\McAfee\SystemCore\\mfefire.exe [2011-04-14 188136]
    S2 mfevtp;McAfee Validation Trust Protection Service;c:\program files\Common Files\McAfee\SystemCore\mfevtps.exe [2011-03-13 148520]
    S2 SBSDWSCService;SBSD Security Center Service;c:\program files\Spybot - Search & Destroy\SDWinSec.exe [2009-01-26 1153368]
    S2 yksvc;Marvell Yukon Service;RUNDLL32.EXE ykx32coinst,serviceStartProc [x]
    S3 cfwids;McAfee Inc. cfwids;c:\windows\system32\drivers\cfwids.sys [2011-04-14 56064]
    S3 CtClsFlt;Creative Camera Class Upper Filter Driver;c:\windows\system32\DRIVERS\CtClsFlt.sys [2008-12-31 144128]
    S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2011-07-06 22712]
    S3 mfefirek;McAfee Inc. mfefirek;c:\windows\system32\drivers\mfefirek.sys [2011-04-14 314088]
    S3 OA009Ufd;Creative Camera OA009 Upper Filter Driver;c:\windows\system32\DRIVERS\OA009Ufd.sys [2009-03-06 133632]
    S3 OA009Vid;Creative Camera OA009 Function Driver;c:\windows\system32\DRIVERS\OA009Vid.sys [2009-03-19 271552]
    .
    .
    --- Other Services/Drivers In Memory ---
    .
    *Deregistered* - mfeavfk01
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
    LocalServiceNoNetwork REG_MULTI_SZ PLA DPS BFE mpssvc
    HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
    hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
    LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache
    Akamai REG_MULTI_SZ Akamai
    .
    .
    ------- Supplementary Scan -------
    .
    uStart Page = hxxp://home.mywebsearch.com/index.jhtml?n=77C09F4F&ptnrS=ZUfox000&ptb=VVB4gV9IfCsZjSCwQAw_JQ
    uInternet Settings,ProxyOverride = *.local
    IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000
    TCP: DhcpNameServer = 172.16.42.1
    DPF: {DAF7E6E6-D53A-439A-B28D-12271406B8A9} - hxxp://mobileapps.blackberry.com/devicesoftware/AxLoader.cab
    FF - ProfilePath - c:\users\Alex\AppData\Roaming\Mozilla\Firefox\Profiles\46moaji9.default\
    FF - prefs.js: browser.search.selectedEngine - Search the Web
    FF - prefs.js: browser.startup.homepage - hxxp://www.igoogle.com/
    FF - prefs.js: network.proxy.type - 2
    FF - user.js: network.cookie.cookieBehavior - 0
    FF - user.js: privacy.clearOnShutdown.cookies - false
    FF - user.js: security.warn_viewing_mixed - false
    FF - user.js: security.warn_viewing_mixed.show_once - false
    FF - user.js: security.warn_submit_insecure - false
    FF - user.js: security.warn_submit_insecure.show_once - false
    .
    .
    **************************************************************************
    .
    catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2011-09-03 20:35
    Windows 6.0.6002 Service Pack 2 NTFS
    .
    scanning hidden processes ...
    .
    scanning hidden autostart entries ...
    .
    scanning hidden files ...
    .
    scan completed successfully
    hidden files: 0
    .
    **************************************************************************
    .
    --------------------- LOCKED REGISTRY KEYS ---------------------
    .
    [HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
    @Denied: (A) (Users)
    @Denied: (A) (Everyone)
    @Allowed: (B 1 2 3 4 5) (S-1-5-20)
    "BlindDial"=dword:00000000
    .
    Completion time: 2011-09-03 20:50:10
    ComboFix-quarantined-files.txt 2011-09-03 19:49
    .
    Pre-Run: 71,814,770,688 bytes free
    Post-Run: 71,856,812,032 bytes free
    .
    - - End Of File - - 9EE82C827DE17A9BE89D802989B09F4A
     
  4. Bobbye

    Bobbye Helper on the Fringe Posts: 16,335   +36

    Please be sure that all logs have a header which identifies the source.
    For Eset entries:
    Please download OTMovit by Old Timer and save to your desktop.
    • Double-click OTMoveIt3.exe to run it. (Vista users, please right click on OTMoveit3.exe and select "Run as an Administrator")
    • Copy the file paths below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose Copy):
      Code:
      :
      :Files  
      C:\Program Files\Windows Live\Messenger\msimg32.dll 
      C:\Program Files\Windows Live\Messenger\riched20.dll 
      C:\Program Files\Windows Live\Messenger\msimg32.dll 
      C:\Program Files\Windows Live\Messenger\riched20.dll 
      C:\ProgramData\Spybot - Search & Destroy\Recovery\FunWebProducts*.zip 
      C:\ProgramData\Spybot - Search & Destroy\Recovery\MyWayMyWebSearch*.zip 
      C:\Users\Alex\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\20\36c09694-2b637c2f
      :Commands
      [purity]
      [emptytemp]
      [start explorer]
      [Reboot]
    • Return to OTMoveIt3, right click in the "Paste Instructions for Items to be Moved" window and choose Paste.
    • Click the red Moveit! button.
    • A log of files and folders moved will be created in the c:\_OTMoveIt\MovedFiles folder in the form of Date and Time (mmddyyyy_hhmmss.log). Please open this log in Notepad and post its contents in your next reply.
    • Close OTMoveIt3
    If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes.
    ======================================
    Stay away from FunWebproducts, My WebSearch and other similar site for Smilies< wallpaper, screen savers, 3D cursors and the like. They aren't free- you pay for them with adware and spyware on the system.
    -------------------------
    At some point or over a span, Spobot Search and Destroy found almost 300 entries for the Win32/Bagel Worm> It put the .zip file extension on the entry> It appears that the entries were in a Recovery file:
    C:\ProgramData\Spybot - Search & Destroy\Recovery\MyWayMyWebSearch131.zip Win32/Bagle.gen.zip worm
    I think the * Wild Card will remove all the entries> there is a long list! It's good to run Spybot S&D, but you should empty the quarantine folder occasionally.
    =======================================
    Malware is in the Java cache- it must be emptied:
    To clear the Java Plug-in cache:

    • [1]. Click Start > Control Panel.
      [2]. Double-click the Java icon in the control panel. [​IMG] The Java Control Panel appears.
      [​IMG]
      [3].Click Settings under Temporary Internet Files.The Temporary Files Settings dialog box appears.
      [​IMG]
      [4] Click Delete Files.The Delete Temporary Files dialog box appears.
      [​IMG]
      [5]. Click OK on Delete Temporary Files window.
      Note: This deletes all the Downloaded Applications and Applets from the cache.
      [6]. Click Apply> OK on Temporary Files Settings window.
    Images courtesy java.com
    ==========================================
    Can you identify either of the following?
    ========================================
    About Firefox: it's not set up correctly:
    FF - prefs.js: browser.search.selectedEngine - Search the Web<<<<Search Engine
    FF - prefs.js: browser.startup.homepage - hxxp://www.igoogle.com/<<<Did you set up the home page
    I'd like to change these entries and have them go to the default. You can change again later
    =======================================
    Please run this Custom CFScript:

    • [1]. Close any open browsers.
      [2]. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
      [3]. Open notepad> click on Format> Uncheck 'Word Wrap'> and copy/paste the text in the code below into it:Be sure to scroll down to include ALL lines.
    Code:
    File::
    DDS::
    uStart Page = hxxp://home.mywebsearch.com/index.jhtml?n=77C09F4F&ptnrS=ZUfox000&ptb=VVB4gV9IfCsZjSCwQAw_JQ
    Extra::
    Firefox::
    Firefox-: - Profile - c:\users\Alex\AppData\Roaming\Mozilla\Firefox\Profiles\46moaji9.default\
    Firefox-: prefs.js - Search.DefaultURL
    Firefox-: prefs.js - Startup.Homepage
    Folder::
    c:\users\Default\AppData\Local\temp
    Registry::
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "autoclk"=-
    
    
    Save this as CFScript.txt, in the same location as ComboFix.exe
    [​IMG]

    Referring to the picture above, drag CFScript into ComboFix.exe

    When finished, it will produce a log for you at C:\ComboFix.txt . Please paste in your next reply.
    ====================
     
  5. eraserofficial

    eraserofficial TS Rookie Topic Starter

    (1 OF 2 REPLIES)

    OT Move it log:

    All processes killed
    Error: Unable to interpret <:> in the current context!
    ========== FILES ==========
    DllUnregisterServer procedure not found in C:\Program Files\Windows Live\Messenger\msimg32.dll
    C:\Program Files\Windows Live\Messenger\msimg32.dll moved successfully.
    DllUnregisterServer procedure not found in C:\Program Files\Windows Live\Messenger\riched20.dll
    C:\Program Files\Windows Live\Messenger\riched20.dll moved successfully.
    File/Folder C:\Program Files\Windows Live\Messenger\msimg32.dll not found.
    File/Folder C:\Program Files\Windows Live\Messenger\riched20.dll not found.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\FunWebProducts.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\FunWebProducts1.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\FunWebProducts10.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\FunWebProducts100.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\FunWebProducts101.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\FunWebProducts102.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\FunWebProducts103.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\FunWebProducts104.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\FunWebProducts105.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\FunWebProducts106.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\FunWebProducts107.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\FunWebProducts108.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\FunWebProducts109.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\FunWebProducts11.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\FunWebProducts110.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\FunWebProducts111.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\FunWebProducts112.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\FunWebProducts113.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\FunWebProducts114.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\FunWebProducts115.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\FunWebProducts116.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\FunWebProducts117.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\FunWebProducts118.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\FunWebProducts119.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\FunWebProducts12.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\FunWebProducts120.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\FunWebProducts121.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\FunWebProducts122.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\FunWebProducts123.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\FunWebProducts124.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\FunWebProducts125.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\FunWebProducts126.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\FunWebProducts127.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\FunWebProducts128.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\FunWebProducts129.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\FunWebProducts13.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\FunWebProducts130.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\FunWebProducts131.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\FunWebProducts132.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\FunWebProducts133.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\FunWebProducts134.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\FunWebProducts135.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\FunWebProducts136.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\FunWebProducts137.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\FunWebProducts138.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\FunWebProducts139.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\FunWebProducts14.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\FunWebProducts140.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\FunWebProducts141.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\FunWebProducts142.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\FunWebProducts143.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\FunWebProducts144.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\FunWebProducts145.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\FunWebProducts146.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\FunWebProducts147.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\FunWebProducts148.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\FunWebProducts149.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\FunWebProducts15.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\FunWebProducts150.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\FunWebProducts151.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\FunWebProducts152.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\FunWebProducts153.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\FunWebProducts154.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\FunWebProducts155.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\FunWebProducts156.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\FunWebProducts157.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\FunWebProducts158.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\FunWebProducts159.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\FunWebProducts16.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\FunWebProducts160.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\FunWebProducts161.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\FunWebProducts162.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\FunWebProducts163.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\FunWebProducts164.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\FunWebProducts165.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\FunWebProducts17.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\FunWebProducts18.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\FunWebProducts19.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\FunWebProducts2.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\FunWebProducts20.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\FunWebProducts21.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\FunWebProducts22.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\FunWebProducts23.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\FunWebProducts24.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\FunWebProducts25.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\FunWebProducts26.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\FunWebProducts27.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\FunWebProducts28.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\FunWebProducts29.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\FunWebProducts3.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\FunWebProducts30.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\FunWebProducts31.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\FunWebProducts32.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\FunWebProducts33.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\FunWebProducts34.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\FunWebProducts35.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\FunWebProducts36.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\FunWebProducts37.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\FunWebProducts38.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\FunWebProducts39.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\FunWebProducts4.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\FunWebProducts40.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\FunWebProducts41.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\FunWebProducts42.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\FunWebProducts43.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\FunWebProducts44.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\FunWebProducts45.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\FunWebProducts46.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\FunWebProducts47.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\FunWebProducts48.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\FunWebProducts49.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\FunWebProducts5.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\FunWebProducts50.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\FunWebProducts51.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\FunWebProducts52.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\FunWebProducts53.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\FunWebProducts54.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\FunWebProducts55.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\FunWebProducts56.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\FunWebProducts57.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\FunWebProducts58.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\FunWebProducts59.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\FunWebProducts6.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\FunWebProducts60.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\FunWebProducts61.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\FunWebProducts62.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\FunWebProducts63.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\FunWebProducts64.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\FunWebProducts65.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\FunWebProducts66.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\FunWebProducts67.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\FunWebProducts68.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\FunWebProducts69.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\FunWebProducts7.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\FunWebProducts70.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\FunWebProducts71.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\FunWebProducts72.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\FunWebProducts73.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\FunWebProducts74.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\FunWebProducts75.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\FunWebProducts76.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\FunWebProducts77.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\FunWebProducts78.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\FunWebProducts79.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\FunWebProducts8.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\FunWebProducts80.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\FunWebProducts81.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\FunWebProducts82.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\FunWebProducts83.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\FunWebProducts84.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\FunWebProducts85.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\FunWebProducts86.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\FunWebProducts87.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\FunWebProducts88.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\FunWebProducts89.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\FunWebProducts9.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\FunWebProducts90.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\FunWebProducts91.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\FunWebProducts92.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\FunWebProducts93.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\FunWebProducts94.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\FunWebProducts95.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\FunWebProducts96.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\FunWebProducts97.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\FunWebProducts98.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\FunWebProducts99.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\MyWayMyWebSearch.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\MyWayMyWebSearch1.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\MyWayMyWebSearch10.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\MyWayMyWebSearch100.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\MyWayMyWebSearch101.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\MyWayMyWebSearch102.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\MyWayMyWebSearch103.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\MyWayMyWebSearch104.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\MyWayMyWebSearch105.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\MyWayMyWebSearch106.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\MyWayMyWebSearch107.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\MyWayMyWebSearch108.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\MyWayMyWebSearch109.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\MyWayMyWebSearch11.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\MyWayMyWebSearch110.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\MyWayMyWebSearch111.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\MyWayMyWebSearch112.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\MyWayMyWebSearch113.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\MyWayMyWebSearch114.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\MyWayMyWebSearch115.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\MyWayMyWebSearch116.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\MyWayMyWebSearch117.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\MyWayMyWebSearch118.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\MyWayMyWebSearch119.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\MyWayMyWebSearch12.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\MyWayMyWebSearch120.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\MyWayMyWebSearch121.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\MyWayMyWebSearch122.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\MyWayMyWebSearch123.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\MyWayMyWebSearch124.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\MyWayMyWebSearch125.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\MyWayMyWebSearch126.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\MyWayMyWebSearch127.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\MyWayMyWebSearch128.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\MyWayMyWebSearch129.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\MyWayMyWebSearch13.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\MyWayMyWebSearch130.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\MyWayMyWebSearch131.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\MyWayMyWebSearch132.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\MyWayMyWebSearch133.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\MyWayMyWebSearch134.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\MyWayMyWebSearch135.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\MyWayMyWebSearch136.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\MyWayMyWebSearch137.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\MyWayMyWebSearch138.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\MyWayMyWebSearch139.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\MyWayMyWebSearch14.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\MyWayMyWebSearch140.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\MyWayMyWebSearch141.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\MyWayMyWebSearch142.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\MyWayMyWebSearch143.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\MyWayMyWebSearch144.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\MyWayMyWebSearch145.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\MyWayMyWebSearch146.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\MyWayMyWebSearch147.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\MyWayMyWebSearch148.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\MyWayMyWebSearch149.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\MyWayMyWebSearch15.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\MyWayMyWebSearch150.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\MyWayMyWebSearch151.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\MyWayMyWebSearch152.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\MyWayMyWebSearch153.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\MyWayMyWebSearch154.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\MyWayMyWebSearch155.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\MyWayMyWebSearch156.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\MyWayMyWebSearch157.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\MyWayMyWebSearch158.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\MyWayMyWebSearch159.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\MyWayMyWebSearch16.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\MyWayMyWebSearch160.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\MyWayMyWebSearch161.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\MyWayMyWebSearch162.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\MyWayMyWebSearch163.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\MyWayMyWebSearch164.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\MyWayMyWebSearch165.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\MyWayMyWebSearch166.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\MyWayMyWebSearch167.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\MyWayMyWebSearch168.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\MyWayMyWebSearch169.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\MyWayMyWebSearch17.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\MyWayMyWebSearch170.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\MyWayMyWebSearch171.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\MyWayMyWebSearch172.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\MyWayMyWebSearch173.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\MyWayMyWebSearch174.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\MyWayMyWebSearch175.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\MyWayMyWebSearch176.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\MyWayMyWebSearch177.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\MyWayMyWebSearch178.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\MyWayMyWebSearch179.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\MyWayMyWebSearch18.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\MyWayMyWebSearch180.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\MyWayMyWebSearch181.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\MyWayMyWebSearch182.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\MyWayMyWebSearch183.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\MyWayMyWebSearch184.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\MyWayMyWebSearch185.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\MyWayMyWebSearch186.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\MyWayMyWebSearch187.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\MyWayMyWebSearch188.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\MyWayMyWebSearch189.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\MyWayMyWebSearch19.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\MyWayMyWebSearch190.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\MyWayMyWebSearch191.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\MyWayMyWebSearch192.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\MyWayMyWebSearch193.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\MyWayMyWebSearch194.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\MyWayMyWebSearch195.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\MyWayMyWebSearch196.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\MyWayMyWebSearch197.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\MyWayMyWebSearch198.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\MyWayMyWebSearch199.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\MyWayMyWebSearch2.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\MyWayMyWebSearch20.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\MyWayMyWebSearch200.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\MyWayMyWebSearch201.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\MyWayMyWebSearch202.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\MyWayMyWebSearch203.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\MyWayMyWebSearch204.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\MyWayMyWebSearch205.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\MyWayMyWebSearch206.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\MyWayMyWebSearch207.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\MyWayMyWebSearch208.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\MyWayMyWebSearch209.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\MyWayMyWebSearch21.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\MyWayMyWebSearch210.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\MyWayMyWebSearch211.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\MyWayMyWebSearch212.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\MyWayMyWebSearch213.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\MyWayMyWebSearch214.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\MyWayMyWebSearch215.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\MyWayMyWebSearch216.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\MyWayMyWebSearch217.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\MyWayMyWebSearch218.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\MyWayMyWebSearch219.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\MyWayMyWebSearch22.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\MyWayMyWebSearch220.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\MyWayMyWebSearch221.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\MyWayMyWebSearch222.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\MyWayMyWebSearch223.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\MyWayMyWebSearch224.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\MyWayMyWebSearch225.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\MyWayMyWebSearch226.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\MyWayMyWebSearch227.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\MyWayMyWebSearch228.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\MyWayMyWebSearch229.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\MyWayMyWebSearch23.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\MyWayMyWebSearch230.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\MyWayMyWebSearch231.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\MyWayMyWebSearch232.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\MyWayMyWebSearch233.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\MyWayMyWebSearch234.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\MyWayMyWebSearch235.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\MyWayMyWebSearch236.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\MyWayMyWebSearch237.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\MyWayMyWebSearch238.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\MyWayMyWebSearch239.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\MyWayMyWebSearch24.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\MyWayMyWebSearch240.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\MyWayMyWebSearch241.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\MyWayMyWebSearch242.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\MyWayMyWebSearch243.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\MyWayMyWebSearch244.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\MyWayMyWebSearch245.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\MyWayMyWebSearch246.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\MyWayMyWebSearch247.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\MyWayMyWebSearch248.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\MyWayMyWebSearch249.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\MyWayMyWebSearch25.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\MyWayMyWebSearch250.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\MyWayMyWebSearch251.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\MyWayMyWebSearch252.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\MyWayMyWebSearch253.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\MyWayMyWebSearch254.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\MyWayMyWebSearch255.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\MyWayMyWebSearch256.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\MyWayMyWebSearch257.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\MyWayMyWebSearch258.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\MyWayMyWebSearch259.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\MyWayMyWebSearch26.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\MyWayMyWebSearch260.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\MyWayMyWebSearch261.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\MyWayMyWebSearch262.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\MyWayMyWebSearch263.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\MyWayMyWebSearch264.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\MyWayMyWebSearch265.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\MyWayMyWebSearch266.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\MyWayMyWebSearch267.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\MyWayMyWebSearch268.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\MyWayMyWebSearch269.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\MyWayMyWebSearch27.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\MyWayMyWebSearch270.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\MyWayMyWebSearch271.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\MyWayMyWebSearch272.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\MyWayMyWebSearch273.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\MyWayMyWebSearch274.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\MyWayMyWebSearch275.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\MyWayMyWebSearch276.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\MyWayMyWebSearch277.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\MyWayMyWebSearch278.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\MyWayMyWebSearch279.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\MyWayMyWebSearch28.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\MyWayMyWebSearch280.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\MyWayMyWebSearch281.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\MyWayMyWebSearch282.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\MyWayMyWebSearch283.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\MyWayMyWebSearch284.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\MyWayMyWebSearch285.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\MyWayMyWebSearch286.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\MyWayMyWebSearch287.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\MyWayMyWebSearch288.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\MyWayMyWebSearch289.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\MyWayMyWebSearch29.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\MyWayMyWebSearch290.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\MyWayMyWebSearch291.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\MyWayMyWebSearch292.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\MyWayMyWebSearch293.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\MyWayMyWebSearch294.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\MyWayMyWebSearch295.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\MyWayMyWebSearch296.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\MyWayMyWebSearch297.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\MyWayMyWebSearch298.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\MyWayMyWebSearch299.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\MyWayMyWebSearch3.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\MyWayMyWebSearch30.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\MyWayMyWebSearch300.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\MyWayMyWebSearch301.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\MyWayMyWebSearch31.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\MyWayMyWebSearch32.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\MyWayMyWebSearch33.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\MyWayMyWebSearch34.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\MyWayMyWebSearch35.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\MyWayMyWebSearch36.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\MyWayMyWebSearch37.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\MyWayMyWebSearch38.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\MyWayMyWebSearch39.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\MyWayMyWebSearch4.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\MyWayMyWebSearch40.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\MyWayMyWebSearch41.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\MyWayMyWebSearch42.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\MyWayMyWebSearch43.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\MyWayMyWebSearch44.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\MyWayMyWebSearch45.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\MyWayMyWebSearch46.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\MyWayMyWebSearch47.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\MyWayMyWebSearch48.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\MyWayMyWebSearch49.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\MyWayMyWebSearch5.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\MyWayMyWebSearch50.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\MyWayMyWebSearch51.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\MyWayMyWebSearch52.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\MyWayMyWebSearch53.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\MyWayMyWebSearch54.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\MyWayMyWebSearch55.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\MyWayMyWebSearch56.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\MyWayMyWebSearch57.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\MyWayMyWebSearch58.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\MyWayMyWebSearch59.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\MyWayMyWebSearch6.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\MyWayMyWebSearch60.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\MyWayMyWebSearch61.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\MyWayMyWebSearch62.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\MyWayMyWebSearch63.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\MyWayMyWebSearch64.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\MyWayMyWebSearch65.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\MyWayMyWebSearch66.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\MyWayMyWebSearch67.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\MyWayMyWebSearch68.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\MyWayMyWebSearch69.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\MyWayMyWebSearch7.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\MyWayMyWebSearch70.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\MyWayMyWebSearch71.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\MyWayMyWebSearch72.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\MyWayMyWebSearch73.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\MyWayMyWebSearch74.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\MyWayMyWebSearch75.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\MyWayMyWebSearch76.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\MyWayMyWebSearch77.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\MyWayMyWebSearch78.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\MyWayMyWebSearch79.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\MyWayMyWebSearch8.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\MyWayMyWebSearch80.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\MyWayMyWebSearch81.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\MyWayMyWebSearch82.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\MyWayMyWebSearch83.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\MyWayMyWebSearch84.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\MyWayMyWebSearch85.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\MyWayMyWebSearch86.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\MyWayMyWebSearch87.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\MyWayMyWebSearch88.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\MyWayMyWebSearch89.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\MyWayMyWebSearch9.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\MyWayMyWebSearch90.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\MyWayMyWebSearch91.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\MyWayMyWebSearch92.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\MyWayMyWebSearch93.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\MyWayMyWebSearch94.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\MyWayMyWebSearch95.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\MyWayMyWebSearch96.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\MyWayMyWebSearch97.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\MyWayMyWebSearch98.zip moved successfully.
    C:\ProgramData\Spybot - Search & Destroy\Recovery\MyWayMyWebSearch99.zip moved successfully.
    C:\Users\Alex\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\20\36c09694-2b637c2f moved successfully.
    ========== COMMANDS ==========

    [EMPTYTEMP]

    User: Alex
    ->Temp folder emptied: 210298 bytes
    ->Temporary Internet Files folder emptied: 24604612 bytes
    ->Java cache emptied: 80062688 bytes
    ->FireFox cache emptied: 61132963 bytes
    ->Flash cache emptied: 9221 bytes

    User: All Users

    User: Default
    ->Temp folder emptied: 0 bytes
    ->Temporary Internet Files folder emptied: 67 bytes
    ->Flash cache emptied: 41620 bytes

    User: Default User
    ->Temp folder emptied: 0 bytes
    ->Temporary Internet Files folder emptied: 0 bytes
    ->Flash cache emptied: 0 bytes

    User: Public
    ->Temp folder emptied: 0 bytes

    %systemdrive% .tmp files removed: 0 bytes
    %systemroot% .tmp files removed: 0 bytes
    %systemroot%\System32 .tmp files removed: 0 bytes
    %systemroot%\System32\drivers .tmp files removed: 0 bytes
    Windows Temp folder emptied: 822104 bytes
    %systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 0 bytes
    %systemroot%\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 499111 bytes
    %systemroot%\system32\config\systemprofile\AppData\LocalLow\Sun\Java\Deployment folder emptied: 741 bytes
    RecycleBin emptied: 0 bytes

    Total Files Cleaned = 160.00 mb


    OTM by OldTimer - Version 3.1.18.0 log created on 09082011_195400
    All processes killed

    OTM by OldTimer - Version 3.1.18.0 log created on 09082011_195356

    Files moved on Reboot...
    File C:\Users\Alex\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low(64)\Content.IE5\LAGOG4RQ\pkvfG-sPemN1PWMSBbR2DFgR1j1aNGV0_DGbxsRQRhwEdQlhV_Eb9_Q3NUthNEFqgRnY9_lr7IgkqImOQgNYtMysKFhF2qL9y9tHRul_eu_p9nFYtlOG6ThKi2Xy7IkTFeNRCEU5NLHy2-UMmVUY8lnoZy4[1].gif not found!
    File C:\Users\Alex\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low(64)\Content.IE5\JOE4XXC7\KcSER8xfLTWekf87maIOi9L2FHAq3vt7HZmn_DDFoJA1_qXxAZz2mBmTNT8nQdcbdnw6ZpXLA9bITAGZTD_kHtbwJFzTm_JvyDLuxEFDAsOMicxls2ZTCbspPKmdZvRbmqTpr1O5ZsKHw709vjgPbqWwK6V[1].gif not found!
    File C:\Users\Alex\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low(64)\Content.IE5\D9B15DZO\bxsRQRhwEdQlhV_Eb9_Q3NUthNEFqgRnY9_lr7IgkqImOQgNYtMysKFhF2qL9y9tHRul_eu_p9nFYtlOG6ThKi2Xy7IkTFeNRCEU5NLHy2-UMmVUY8lnoZy4&callback=google.LU[1].loadFeaturemap_68_0 not found!
    File C:\Users\Alex\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low(64)\Content.IE5\D9B15DZO\xsRQRhwEdQlhV_Eb9_Q3NUthNEFqgRnY9_lr7IgkqImOQgNYtMysKFhF2qL9y9tHRul_eu_p9nFYtlOG6ThKi2Xy7IkTFeNRCEU5NLHy2-UMmVUY8lnoZy4&callback=google.LU[1].loadFeaturemap_622_0 not found!

    Registry entries deleted on Reboot...
     
  6. eraserofficial

    eraserofficial TS Rookie Topic Starter

    (REPLY 2 OF 2)

    ******************************
    Tried to locate the following:
    2011-08-28 15:51 -------- d-----w- c:\users\Alex\AppData\Roaming\Dehiac
    2011-06-18 12:31 0 ----a-w- c:\users\Alex\AppData\Local\Nxetuwus.bin

    -Dehiac folder is empty
    -Nxetuwus does not exist

    ******************************

    Yes, I have set iGoogle as my homepage.
    How do I change the firefox settings so that it works again? (still not opening)

    *****************************

    Combofix log:


    ComboFix 11-09-08.03 - Alex 08/09/2011 20:27:21.4.1 - x86
    Microsoft® Windows Vista™ Home Basic 6.0.6002.2.1252.44.1033.18.984.259 [GMT 1:00]
    Running from: c:\users\Alex\Desktop\ComboFix.exe
    Command switches used :: c:\users\Alex\Desktop\CFScript.txt
    AV: McAfee Anti-Virus and Anti-Spyware *Enabled/Updated* {86355677-4064-3EA7-ABB3-1B136EB04637}
    FW: McAfee Firewall *Enabled* {BE0ED752-0A0B-3FFF-80EC-B2269063014C}
    SP: McAfee Anti-Virus and Anti-Spyware *Enabled/Updated* {3D54B793-665E-3129-9103-206115370C8A}
    SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
    * Resident AV is active
    .
    .
    .
    ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    c:\users\Alex\AppData\Local\abvvpaqg.log
    c:\users\Alex\AppData\Local\fjnmttam.log
    c:\users\Alex\AppData\Local\iflecign.log
    c:\users\Alex\AppData\Local\lapmnsuw.log
    c:\users\Alex\AppData\Local\nvjjarya.log
    c:\users\Alex\AppData\Local\ssbwlnck.log
    c:\users\Alex\AppData\Local\ykritdjj.log
    c:\users\Default\AppData\Local\temp
    .
    .
    ((((((((((((((((((((((((( Files Created from 2011-08-08 to 2011-09-08 )))))))))))))))))))))))))))))))
    .
    .
    2011-09-08 18:53 . 2011-09-08 18:53 -------- d-----w- C:\_OTM
    2011-09-08 13:22 . 2011-04-14 13:01 165032 ----a-w- c:\windows\system32\drivers\mfewfpk.sys
    2011-09-01 19:27 . 2011-09-01 19:27 -------- d-----w- c:\program files\Common Files\Java
    2011-09-01 17:46 . 2011-09-01 17:46 -------- d-----w- c:\program files\ESET
    2011-09-01 01:42 . 2011-09-01 01:42 -------- d-----w- c:\users\Alex\AppData\Roaming\Malwarebytes
    2011-09-01 01:41 . 2011-07-06 18:52 41272 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
    2011-09-01 01:41 . 2011-09-01 01:41 -------- d-----w- c:\programdata\Malwarebytes
    2011-09-01 01:41 . 2011-09-01 01:41 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
    2011-09-01 01:41 . 2011-07-06 18:52 22712 ----a-w- c:\windows\system32\drivers\mbam.sys
    2011-09-01 01:35 . 2011-06-06 10:59 2409784 ----a-w- c:\program files\Windows Mail\OESpamFilter.dat
    2011-09-01 01:34 . 2011-07-11 13:25 2048 ----a-w- c:\windows\system32\tzres.dll
    2011-09-01 01:31 . 2011-06-20 08:54 3602832 ----a-w- c:\windows\system32\ntkrnlpa.exe
    2011-09-01 01:31 . 2011-06-20 08:54 3550096 ----a-w- c:\windows\system32\ntoskrnl.exe
    2011-09-01 01:31 . 2011-06-17 20:13 905104 ----a-w- c:\windows\system32\drivers\tcpip.sys
    2011-08-26 13:28 . 2011-08-28 15:51 -------- d-----w- c:\users\Alex\AppData\Roaming\Dehiac
    .
    .
    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2011-08-02 17:36 . 2011-08-02 17:36 53248 ----a-r- c:\users\Alex\AppData\Roaming\Microsoft\Installer\{12BAA98C-F8DD-4BC9-BBE6-1C8463114197}\ARPPRODUCTICON.exe
    2011-07-19 04:05 . 2010-12-01 00:58 472808 ----a-w- c:\windows\system32\deployJava1.dll
    2011-06-29 20:26 . 2011-06-18 12:31 0 ----a-w- c:\users\Alex\AppData\Local\Nxetuwus.bin
    2011-06-24 11:34 . 2011-06-02 09:16 404640 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
    2011-06-26 02:48 . 2011-05-07 19:13 142296 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll
    2011-04-14 13:01 . 2010-08-14 18:37 24376 ----a-w- c:\program files\mozilla firefox\components\Scriptff.dll
    .
    .
    ((((((((((((((((((((((((((((( SnapShot@2011-09-03_19.35.47 )))))))))))))))))))))))))))))))))))))))))
    .
    + 2008-01-21 01:58 . 2011-09-08 19:05 74026 c:\windows\System32\WDI\ShutdownPerformanceDiagnostics_SystemData.bin
    + 2006-11-02 13:02 . 2011-09-08 19:05 75056 c:\windows\System32\WDI\BootPerformanceDiagnostics_SystemData.bin
    + 2009-09-17 11:48 . 2011-09-08 19:05 18272 c:\windows\System32\WDI\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-480720374-233918930-1306778960-1000_UserData.bin
    + 2009-09-12 03:30 . 2011-09-08 19:09 32768 c:\windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
    - 2009-09-12 03:30 . 2011-09-03 18:19 32768 c:\windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
    - 2009-09-12 03:30 . 2011-09-03 18:19 32768 c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
    + 2011-09-08 19:04 . 2011-09-08 19:09 32768 c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
    - 2009-09-12 03:30 . 2011-09-03 18:19 16384 c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
    + 2009-09-12 03:30 . 2011-09-08 19:09 16384 c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
    + 2009-11-29 12:47 . 2011-09-08 03:44 16384 c:\windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
    - 2009-11-29 12:47 . 2011-08-23 12:33 16384 c:\windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
    + 2009-11-29 12:47 . 2011-09-08 03:44 16384 c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
    - 2009-11-29 12:47 . 2011-08-23 12:33 16384 c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
    + 2009-09-20 18:58 . 2011-09-07 18:03 4418 c:\windows\System32\WDI\ERCQueuedResolutions.dat
    - 2009-09-20 18:58 . 2011-08-29 16:09 4418 c:\windows\System32\WDI\ERCQueuedResolutions.dat
    - 2011-09-03 18:13 . 2011-09-03 18:13 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
    + 2011-09-08 19:01 . 2011-09-08 19:01 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
    - 2011-09-03 18:13 . 2011-09-03 18:13 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
    + 2011-09-08 19:01 . 2011-09-08 19:01 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
    + 2009-09-12 08:39 . 2011-09-08 13:00 901270 c:\windows\winsxs\ManifestCache\6.0.6002.18005_001c11ba_blobs.bin
    + 2009-09-17 15:59 . 2011-09-08 12:55 311386 c:\windows\System32\WDI\SuspendPerformanceDiagnostics_SystemData_S3.bin
    + 2006-11-02 10:33 . 2011-09-08 12:57 609196 c:\windows\System32\perfh009.dat
    + 2006-11-02 10:33 . 2011-09-08 12:57 108672 c:\windows\System32\perfc009.dat
    - 2010-10-23 19:29 . 2011-09-03 17:21 460448 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-System.dat
    + 2010-10-23 19:29 . 2011-09-08 19:00 460448 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-System.dat
    - 2010-10-23 19:29 . 2011-08-31 13:56 918240 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-S-1-5-21-480720374-233918930-1306778960-1000-8192.dat
    + 2010-10-23 19:29 . 2011-09-03 19:55 918240 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-S-1-5-21-480720374-233918930-1306778960-1000-8192.dat
    - 2006-11-02 10:22 . 2011-09-01 15:02 6291456 c:\windows\System32\SMI\Store\Machine\schema.dat
    + 2006-11-02 10:22 . 2011-09-08 19:00 6291456 c:\windows\System32\SMI\Store\Machine\schema.dat
    .
    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4
    .
    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "ISUSPM"="c:\program files\Common Files\InstallShield\UpdateService\ISUSPM.exe" [2007-08-30 205480]
    "Skype"="c:\program files\Skype\Phone\Skype.exe" [2011-02-04 15052168]
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "Apoint"="c:\program files\DellTPad\Apoint.exe" [2009-03-31 217088]
    "IgfxTray"="c:\windows\system32\igfxtray.exe" [2009-03-31 141848]
    "HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2009-03-31 173592]
    "Persistence"="c:\windows\system32\igfxpers.exe" [2009-03-31 150552]
    "Broadcom Wireless Manager UI"="c:\windows\system32\WLTRAY.exe" [2008-12-21 3810304]
    "IAAnotif"="c:\program files\Intel\Intel Matrix Storage Manager\iaanotif.exe" [2008-06-15 178712]
    "Microsoft Default Manager"="c:\program files\Microsoft\Search Enhancement Pack\Default Manager\DefMgr.exe" [2009-04-24 250192]
    "GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2008-10-25 31072]
    "SysTrayApp"="c:\program files\IDT\WDM\sttray.exe" [2009-03-31 483428]
    "mcui_exe"="c:\program files\McAfee.com\Agent\mcagent.exe" [2011-06-28 1195408]
    "AdobeAAMUpdater-1.0"="c:\program files\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe" [2010-03-06 500208]
    "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 10.0\Reader\Reader_sl.exe" [2011-01-30 35736]
    "Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-11-10 932288]
    "QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2010-11-29 421888]
    "iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2010-12-13 421160]
    "RIMBBLaunchAgent.exe"="c:\program files\Common Files\Research In Motion\USB Drivers\RIMBBLaunchAgent.exe" [2011-02-18 79192]
    "Malwarebytes' Anti-Malware"="c:\program files\Malwarebytes' Anti-Malware\mbamgui.exe" [2011-07-06 449584]
    "Malwarebytes' Anti-Malware (reboot)"="c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2011-07-06 1047656]
    "SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2011-06-09 254696]
    "dellsupportcenter"="c:\program files\Dell Support Center\bin\sprtcmd.exe" [2009-06-03 206064]
    .
    c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
    DSLMON.lnk - c:\program files\SAGEM\TalkTalk Broadband\dslmon.exe [2009-9-17 962661]
    McAfee Security Scan Plus.lnk - c:\program files\McAfee Security Scan\2.0.181\SSScheduler.exe [2010-1-15 255536]
    .
    c:\users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
    Dell Dock First Run.lnk - c:\program files\Dell\DellDock\DellDock.exe [2009-5-28 1320288]
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
    "EnableUIADesktopToggle"= 0 (0x0)
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\GoToAssist]
    2009-09-12 08:57 10536 ----a-w- c:\program files\Citrix\GoToAssist\514\g2awinlogon.dll
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcmscsvc]
    @=""
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]
    @=""
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
    @="Driver"
    .
    [HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^HP Digital Imaging Monitor.lnk]
    path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk
    backup=c:\windows\pss\HP Digital Imaging Monitor.lnk.CommonStartup
    backupExtension=.CommonStartup
    .
    [HKLM\~\startupfolder\C:^Users^Alex^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^Dell Dock.lnk]
    path=c:\users\Alex\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dell Dock.lnk
    backup=c:\windows\pss\Dell Dock.lnk.Startup
    backupExtension=.Startup
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Dell DataSafe Online]
    2009-07-07 15:23 1779952 ----a-w- c:\program files\Dell DataSafe Online\DataSafeOnline.exe
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Dell Webcam Central]
    2009-01-09 18:49 405639 ------w- c:\program files\Dell Webcam\Dell Webcam Central\WebcamDell2.exe
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\dellsupportcenter]
    2009-06-03 19:46 206064 ----a-w- c:\program files\Dell Support Center\bin\sprtcmd.exe
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]
    2007-10-14 20:17 49152 ----a-w- c:\program files\HP\HP Software Update\hpwuSchd2.exe
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\hpqSRMon]
    2007-08-22 15:31 80896 ----a-w- c:\program files\HP\Digital Imaging\bin\HpqSRmon.exe
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
    2010-12-13 17:16 421160 ----a-w- c:\program files\iTunes\iTunesHelper.exe
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\msnmsgr]
    2010-11-10 01:54 4240760 ----a-w- c:\program files\Windows Live\Messenger\msnmsgr.exe
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PDVDDXSrv]
    2009-02-05 02:26 128232 ------w- c:\program files\CyberLink\PowerDVD DX\PDVDDXSrv.exe
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickSet]
    2009-03-26 23:26 1735760 ----a-w- c:\program files\Dell\QuickSet\quickset.exe
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
    2010-11-29 17:38 421888 ----a-w- c:\program files\QuickTime\QTTask.exe
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Windows Defender]
    2008-01-21 02:33 1008184 ----a-w- c:\program files\Windows Defender\MSASCui.exe
    .
    R1 MpKslf19fe48b;MpKslf19fe48b;c:\windows\system32\MpEngineStore\MpKslf19fe48b.sys [x]
    R2 0120161315488294mcinstcleanup;McAfee Application Installer Cleanup (0120161315488294);c:\windows\TEMP\012016~1.EXE [x]
    R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
    R2 yksvc;Marvell Yukon Service;RUNDLL32.EXE ykx32coinst,serviceStartProc [x]
    R3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\system32\drivers\mbamswissarmy.sys [2011-07-06 41272]
    R3 mferkdet;McAfee Inc. mferkdet;c:\windows\system32\drivers\mferkdet.sys [2011-04-14 84488]
    R3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [2010-03-18 753504]
    S1 mfenlfk;McAfee NDIS Light Filter;c:\windows\system32\DRIVERS\mfenlfk.sys [2011-04-14 64584]
    S1 mfewfpk;McAfee Inc. mfewfpk;c:\windows\system32\drivers\mfewfpk.sys [2011-04-14 165032]
    S2 AESTFilters;Andrea ST Filters Service;c:\windows\System32\DriverStore\FileRepository\stwrt.inf_f6ef8056\aestsrv.exe [2009-03-31 81920]
    S2 Akamai;Akamai NetSession Interface;c:\windows\System32\svchost.exe [2008-01-21 21504]
    S2 DockLoginService;Dock Login Service;c:\program files\Dell\DellDock\DockLogin.exe [2008-12-18 155648]
    S2 MBAMService;MBAMService;c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe [2011-07-06 366640]
    S2 McComponentHostService;McAfee Security Scan Component Host Service;c:\program files\McAfee Security Scan\2.0.181\McCHSvc.exe [2010-01-15 227232]
    S2 McMPFSvc;McAfee Personal Firewall Service;c:\program files\Common Files\Mcafee\McSvcHost\McSvHost.exe [2010-03-10 271480]
    S2 McNaiAnn;McAfee VirusScan Announcer;c:\program files\Common Files\McAfee\McSvcHost\McSvHost.exe [2010-03-10 271480]
    S2 mfefire;McAfee Firewall Core Service;c:\program files\Common Files\McAfee\SystemCore\\mfefire.exe [2011-04-14 188136]
    S2 mfevtp;McAfee Validation Trust Protection Service;c:\program files\Common Files\McAfee\SystemCore\mfevtps.exe [2011-03-13 148520]
    S2 SBSDWSCService;SBSD Security Center Service;c:\program files\Spybot - Search & Destroy\SDWinSec.exe [2009-01-26 1153368]
    S3 cfwids;McAfee Inc. cfwids;c:\windows\system32\drivers\cfwids.sys [2011-04-14 56064]
    S3 CtClsFlt;Creative Camera Class Upper Filter Driver;c:\windows\system32\DRIVERS\CtClsFlt.sys [2008-12-31 144128]
    S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2011-07-06 22712]
    S3 mfefirek;McAfee Inc. mfefirek;c:\windows\system32\drivers\mfefirek.sys [2011-04-14 314088]
    S3 OA009Ufd;Creative Camera OA009 Upper Filter Driver;c:\windows\system32\DRIVERS\OA009Ufd.sys [2009-03-06 133632]
    S3 OA009Vid;Creative Camera OA009 Function Driver;c:\windows\system32\DRIVERS\OA009Vid.sys [2009-03-19 271552]
    .
    .
    --- Other Services/Drivers In Memory ---
    .
    *Deregistered* - mfeavfk01
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
    LocalServiceNoNetwork REG_MULTI_SZ PLA DPS BFE mpssvc
    HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
    hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
    LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache
    Akamai REG_MULTI_SZ Akamai
    .
    .
    ------- Supplementary Scan -------
    .
    uInternet Settings,ProxyOverride = *.local
    IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000
    TCP: DhcpNameServer = 172.16.42.1
    DPF: {DAF7E6E6-D53A-439A-B28D-12271406B8A9} - hxxp://mobileapps.blackberry.com/devicesoftware/AxLoader.cab
    FF - ProfilePath - c:\users\Alex\AppData\Roaming\Mozilla\Firefox\Profiles\46moaji9.default\
    FF - prefs.js: browser.search.selectedEngine - Search the Web
    FF - prefs.js: browser.startup.homepage - hxxp://www.igoogle.com/
    FF - prefs.js: network.proxy.type - 2
    FF - user.js: network.cookie.cookieBehavior - 0
    FF - user.js: privacy.clearOnShutdown.cookies - false
    FF - user.js: security.warn_viewing_mixed - false
    FF - user.js: security.warn_viewing_mixed.show_once - false
    FF - user.js: security.warn_submit_insecure - false
    FF - user.js: security.warn_submit_insecure.show_once - false
    .
    .
    **************************************************************************
    .
    catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2011-09-08 20:44
    Windows 6.0.6002 Service Pack 2 NTFS
    .
    scanning hidden processes ...
    .
    scanning hidden autostart entries ...
    .
    scanning hidden files ...
    .
    scan completed successfully
    hidden files: 0
    .
    **************************************************************************
    .
    --------------------- LOCKED REGISTRY KEYS ---------------------
    .
    [HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
    @Denied: (A) (Users)
    @Denied: (A) (Everyone)
    @Allowed: (B 1 2 3 4 5) (S-1-5-20)
    "BlindDial"=dword:00000000
    .
    Completion time: 2011-09-08 21:04:46
    ComboFix-quarantined-files.txt 2011-09-08 20:04
    ComboFix2.txt 2011-09-03 19:50
    .
    Pre-Run: 73,802,080,256 bytes free
    Post-Run: 73,764,765,696 bytes free
    .
    - - End Of File - - 4B8F4D3099760A2DDC6B5CB8586F21E1
     
  7. Bobbye

    Bobbye Helper on the Fringe Posts: 16,335   +36

    Security is suppose to be disabled when running Combofix. All of your security was still running when you ran the script. Please be advised that this can affect the scam.

    I'd like you to run HijckThis so I can help point out all the unnecessary startups you have:

    Download HijackThis and save to your desktop.
    • Extract it to a directory on your hard drive called c:\HijackThis.
    • Then navigate to that directory and double-click on the hijackthis.exe file.
    • When started click on the Scan button and then the Save Log button to create a log of your information.
    • The log file and then the log will open in notepad. Be sure to click on Format> Uncheck Word Wrap when you open Notepad
    • Click on "Edit > Select All" then click on "Edit > Copy" to copy the entire contents of the log.
    • Come back here to this thread and paste (Ctrl+V) the log in your next reply.

    NOTE: Do NOT have HijackThis fix anything yet! Most of what it finds will be harmless or even required.
    ============================================
    You did not tell me what the problem was with McAfee< but here are related errors from the Event Viewer:
    Do you see where the errors say The dependency service or group failed to start"? Here's what you need to do:

    Boot into Safe Mode
    • Restart your computer and start pressing the F8 key on your keyboard.
    • Select the Safe Mode option when the Windows Advanced Options menu appears, and then press ENTER.

    Click on Start> Run> type in services.msc> Enter>>>>
    This will open the Service Module in the Administrative Tools> You will be looking for the McAfee Services> I've put them in bold red text, but note that the Service name may be shortened. some Services require other Service to be running in order to run. This is called the Dependency. So whenever you want to change or 'fix' a Service< after you double click on the Service name to open it, you will also need to check the Dependency tab and mke sure that any of the dependencies fo that ervice are set to either Automatic or Manaul Startup Type:

    Examples:
    The McShield service 'depends on' the McAfee Validation Trust Protection Service to run in order for it to run.
    The McAfee Proxy 'depend on ' the McAfee Firewall Core Service to run in order for it to run.
    The McAfee Firewall Core Service
    The McAfee Validation Trust Protection Service 'depends on' epends on the McAfee Inc. mfehidk service which failed to start because of the following error: A device attached to the system is not functioning.

    You can check the Services and their Dependencie for settingSs> If you cannot resolve the issue, please refer to these references from the McAfee Community:
    https://community.mcafee.com/message/115279
    https://community.mcafee.com/thread/23982


    As for the Firefox problem:
    Have you set it as the default browser? You previously had Chrome running> if you cannot resolve the startup, you may have to uninstall, then reinstall.
     
  8. eraserofficial

    eraserofficial TS Rookie Topic Starter

    I wasn't able to disable any of McAfee security when I was doing my scans, even though I turned them off it wouldn't process.

    Here's my Hijackthis log:

    Logfile of Trend Micro HijackThis v2.0.4
    Scan saved at 20:02:27, on 15/09/2011
    Platform: Windows Vista SP2 (WinNT 6.00.1906)
    MSIE: Internet Explorer v8.00 (8.00.6001.19120)
    Boot mode: Normal

    Running processes:
    C:\Windows\system32\Dwm.exe
    C:\Windows\Explorer.EXE
    C:\Windows\system32\taskeng.exe
    C:\Windows\system32\igfxsrvc.exe
    C:\Program Files\DellTPad\Apoint.exe
    C:\Windows\System32\hkcmd.exe
    C:\Windows\System32\igfxpers.exe
    C:\Windows\System32\WLTRAY.EXE
    C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
    C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
    C:\Program Files\IDT\WDM\sttray.exe
    C:\Program Files\McAfee.com\Agent\mcagent.exe
    C:\Windows\system32\wbem\unsecapp.exe
    C:\Program Files\iTunes\iTunesHelper.exe
    C:\Program Files\Common Files\Research In Motion\USB Drivers\RIMBBLaunchAgent.exe
    C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe
    C:\Program Files\Common Files\Java\Java Update\jusched.exe
    C:\Program Files\Dell Support Center\bin\sprtcmd.exe
    C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe
    C:\Program Files\Skype\Phone\Skype.exe
    C:\Program Files\SAGEM\TalkTalk Broadband\dslmon.exe
    C:\Program Files\McAfee Security Scan\2.0.181\SSScheduler.exe
    C:\Program Files\DellTPad\HidFind.exe
    C:\Program Files\DellTPad\Apntex.exe
    C:\Windows\system32\wuauclt.exe
    C:\Windows\System32\mobsync.exe
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\Program Files\Mozilla Firefox\plugin-container.exe
    C:\Users\Alex\AppData\Local\Temp\Rar$EX06.012\HijackThis.exe

    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
    O9 - Extra button: @C:\Program Files\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1004 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
    O9 - Extra 'Tools' menuitem: @C:\Program Files\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1003 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
    O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
    O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
    O9 - Extra button: HP Smart Select - {DDE87865-83C5-48c4-8357-2F5B1AA84522} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll
    O16 - DPF: {8100D56A-5661-482C-BEE8-AFECE305D968} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/2009.07.28_v5.5.8.1/FacebookPhotoUploader55.cab
    O16 - DPF: {DAF7E6E6-D53A-439A-B28D-12271406B8A9} (RIM AxLoader) - http://mobileapps.blackberry.com/devicesoftware/AxLoader.cab
    O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll
    O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
    O18 - Protocol: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll
    O20 - Winlogon Notify: GoToAssist - C:\Program Files\Citrix\GoToAssist\514\G2AWinLogon.dll
    O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\Windows\system32\browseui.dll
    O23 - Service: McAfee Application Installer Cleanup (0120161315488294) (0120161315488294mcinstcleanup) - Unknown owner - C:\Windows\TEMP\012016~1.EXE (file missing)
    O23 - Service: Andrea ST Filters Service (AESTFilters) - Andrea Electronics Corporation - C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_f6ef8056\aestsrv.exe
    O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
    O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
    O23 - Service: Dock Login Service (DockLoginService) - Stardock Corporation - C:\Program Files\Dell\DellDock\DockLogin.exe
    O23 - Service: FLEXnet Licensing Service - Acresso Software Inc. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
    O23 - Service: GoToAssist - Citrix Online, a division of Citrix Systems, Inc. - C:\Program Files\Citrix\GoToAssist\514\g2aservice.exe
    O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMon.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
    O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: MBAMService - Malwarebytes Corporation - C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
    O23 - Service: McAfee Security Scan Component Host Service (McComponentHostService) - McAfee, Inc. - C:\Program Files\McAfee Security Scan\2.0.181\McCHSvc.exe
    O23 - Service: McAfee Personal Firewall Service (McMPFSvc) - McAfee, Inc. - C:\Program Files\Common Files\Mcafee\McSvcHost\McSvHost.exe
    O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe
    O23 - Service: McAfee VirusScan Announcer (McNaiAnn) - McAfee, Inc. - C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe
    O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe
    O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\Program Files\McAfee\VirusScan\mcods.exe
    O23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe
    O23 - Service: McShield - McAfee, Inc. - C:\Program Files\Common Files\McAfee\SystemCore\\mcshield.exe
    O23 - Service: McAfee Firewall Core Service (mfefire) - McAfee, Inc. - C:\Program Files\Common Files\McAfee\SystemCore\\mfefire.exe
    O23 - Service: McAfee Validation Trust Protection Service (mfevtp) - McAfee, Inc. - C:\Program Files\Common Files\McAfee\SystemCore\mfevtps.exe
    O23 - Service: McAfee Anti-Spam Service (MSK80Service) - McAfee, Inc. - C:\Program Files\Common Files\Mcafee\McSvcHost\McSvHost.exe
    O23 - Service: LiveShare P2P Server 9 (RoxLiveShare9) - Unknown owner - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxLiveShare9.exe (file missing)
    O23 - Service: SBSD Security Center Service (SBSDWSCService) - Safer Networking Ltd. - C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe
    O23 - Service: SupportSoft Sprocket Service (DellSupportCenter) (sprtsvc_DellSupportCenter) - SupportSoft, Inc. - C:\Program Files\Dell Support Center\bin\sprtsvc.exe
    O23 - Service: Audio Service (STacSV) - IDT, Inc. - C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_f6ef8056\STacSV.exe
    O23 - Service: Dell Wireless WLAN Tray Service (wltrysvc) - Unknown owner - C:\Windows\System32\WLTRYSVC.EXE
    O23 - Service: Marvell Yukon Service (yksvc) - Unknown owner - RUNDLL32.EXE (file missing)

    --
    End of file - 7272 bytes

    Thought I'd post log before I restart laptop and have to locate it. Will try and sort out McAfee issues now.

    (by the way, thanks for the ongoing help!)
     
  9. eraserofficial

    eraserofficial TS Rookie Topic Starter

    Tried to sort out the McAfee problems in safe mode, I managed to get there and all of the things you put in bold text were present but I'm a bit stumped at what I'm supposed to do when I get there? Sorry if I'm being completely dense but could you provide a step by step mode of how to approach these problems? Don't worry about patronising me I truly am useless at anything technical (hence why I'm here I suppose!)

    Thanks.
     
  10. Bobbye

    Bobbye Helper on the Fringe Posts: 16,335   +36

    You show the following installed:
    McAfee Security Scan Plus
    McAfee SecurityCenter


    All of these McAfee Services are showing in the HJT log, but I have no way of telling what their Startup type is. So boot into Safe Mode, access the Services and make sure it is set as instructed:
    Note: Some of the following may be 'version-dependent'- that is, the first list of the 023 Services I see in your HJT log and other McAfee processes which may or may not be on your system.So I am leaving 2 lists below: the Services I

    ------------------------------
    I found another list in the McAfee forums also for Service settings.

    After you boot into Safe Mode and call up services.msc[/b[ look for each of the following and double click to open each: Set the Startup Type as indicated by changing the display in the dialog box:

    It's possible that some of the above may be version-dependent, so don't be alarmed if you do not see them all.

    Reboot when finished. Open the McAfee Program and make sure these are checked or running:
     
Topic Status:
Not open for further replies.

Similar Topics

Add New Comment

You need to be a member to leave a comment. Join thousands of tech enthusiasts and participate.
TechSpot Account You may also...