Jump to content

hmorse

Members
  • Posts

    1
  • Joined

  • Last visited

Reputation

0 Neutral
  1. Hi, I am having a computer problem whereby it appears as though I have a virus that Malwarebytes has not been able to remove or detect. Currently there is a Internet Explorer window opening (a local newspaper) in the top left corner of the desktop and we have been unable to close it or remove the window. Here are the DDS and Attach logs: DDS: . DDS (Ver_2011-08-26.01) - NTFSx86 Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 1.6.0_26 Run by HEM at 12:41:08 on 2012-07-05 Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.3071.2233 [GMT -4:00] . . ============== Running Processes =============== . C:\WINDOWS\system32\svchost.exe -k DcomLaunch svchost.exe C:\WINDOWS\System32\svchost.exe -k netsvcs svchost.exe C:\Program Files\3COM\3Com Wireless 108 Mbps 11g USB Utility \lcs.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Common Files\logishrd\LVMVFM\UMVPFSrv.exe svchost.exe C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe C:\Program Files\Bonjour\mDNSResponder.exe C:\Program Files\Citrix\GoToMyPC\g2svc.exe C:\Program Files\Siber Systems\GoodSync\Gs-Server.exe C:\Program Files\Citrix\GoToMyPC\g2comm.exe C:\Program Files\Citrix\GoToMyPC\g2pre.exe C:\Program Files\Citrix\GoToMyPC\g2tray.exe C:\Program Files\Java\jre6\bin\jqs.exe C:\WINDOWS\system32\NLSSRV32.EXE C:\Program Files\CDBurnerXP\NMSAccessU.exe C:\WINDOWS\system32\nvsvc32.exe C:\Program Files\Common Files\Motive\pcCMService.exe svchost.exe C:\WINDOWS\system32\svchost.exe -k imgsvc C:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater\11.1.0\ToolbarUpdater.exe C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE C:\WINDOWS\system32\SearchIndexer.exe C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe C:\WINDOWS\system32\wscntfy.exe C:\WINDOWS\system32\ctfmon.exe C:\WINDOWS\system32\UMonit.exe C:\Program Files\Microsoft IntelliPoint\ipoint.exe C:\Program Files\Microsoft IntelliType Pro\itype.exe C:\Program Files\Logitech\LWS\Webcam Software\LWS.exe C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe C:\WINDOWS\RTHDCPL.EXE C:\WINDOWS\system32\RunDLL32.exe C:\Program Files\Logitech\LWS\Webcam Software\CameraHelperShell.exe C:\Program Files\Common Files\Logishrd\LQCVFX\COCIManager.exe C:\Program Files\Google\Google Calendar Sync\GoogleCalendarSync.exe C:\WINDOWS\STK02N\STK02NM.exe C:\Documents and Settings\HEM\Application Data\Dropbox\bin\Dropbox.exe C:\WINDOWS\explorer.exe C:\Program Files\Microsoft\BingBar\7.1.362.0\SeaPort.exe C:\Program Files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe C:\Program Files\Microsoft Office\Office14\OUTLOOK.EXE C:\WINDOWS\system32\SearchProtocolHost.exe C:\WINDOWS\system32\SearchProtocolHost.exe . ============== Pseudo HJT Report =============== . uStart Page = hxxp://google.com/ mStart Page = hxxp://start.funmoods.com/?f=1&a=adknlg&chnl=adknlg&cd=2XzuyEtN2Y1L1QzutDtDtBtCzzyDtC0DyBtDyDyD0Ezz0FtAtN0D0Tzu0CtCzzyDtN1L2XzutBtFtCtFtDtFtAtDtC&cr=18690824 uURLSearchHooks: YTNavAssist.YTNavAssistPlugin Class: {81017ea9-9aa8-4a6a-9734-7af40e7d593f} - c:\program files\yahoo!\companion\installs\cpn\YTNavAssist.dll BHO: &Yahoo! Toolbar Helper: {02478d38-c3f9-4efb-9b51-7695eca05670} - c:\program files\yahoo!\companion\installs\cpn\yt.dll BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll BHO: Babylon toolbar helper: {2eecd738-5844-4a99-b4b6-146bf802613b} - c:\program files\babylontoolbar\babylontoolbar\1.5.3.17\bh\BabylonToolbar.dll BHO: RoboForm Toolbar Helper: {724d43a9-0d85-11d4-9908-00400523e39a} - c:\program files\siber systems\ai roboform\roboform.dll BHO: Windows Live ID Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll BHO: AVG Security Toolbar: {95b7759c-8c7f-4bf1-b163-73684a933233} - c:\program files\avg secure search\11.1.0.7\AVG Secure Search_toolbar.dll BHO: Skype Browser Helper: {ae805869-2e5c-4ed4-8f7b-f1f7851a4497} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll BHO: Office Document Cache Handler: {b4f3a835-0e21-4959-ba22-42b3008e02ff} - c:\progra~1\micros~2\office14\URLREDIR.DLL BHO: PC Antivirus Web Protection BHO: {c11cbda9-6702-469e-9ce1-64e3971a6b44} - c:\program files\pc antivirus\pf.dll BHO: Bing Bar Helper: {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - c:\program files\microsoft\bingbar\7.1.362.0\BingExt.dll BHO: Support.com Toolbar: {d4027c7f-154a-4066-a1ad-4243d8127440} - c:\program files\ask.com\GenericAskToolbar.dll BHO: Java Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll TB: &RoboForm Toolbar: {724d43a0-0d85-11d4-9908-00400523e39a} - c:\program files\siber systems\ai roboform\roboform.dll TB: Support.com Toolbar: {d4027c7f-154a-4066-a1ad-4243d8127440} - c:\program files\ask.com\GenericAskToolbar.dll TB: Google Toolbar: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program files\google\google toolbar\GoogleToolbar_32.dll TB: att.net Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - c:\program files\yahoo!\companion\installs\cpn\yt.dll TB: AVG Security Toolbar: {95b7759c-8c7f-4bf1-b163-73684a933233} - c:\program files\avg secure search\11.1.0.7\AVG Secure Search_toolbar.dll TB: Babylon Toolbar: {98889811-442d-49dd-99d7-dc866be87dbc} - c:\program files\babylontoolbar\babylontoolbar\1.5.3.17\BabylonToolbarTlbr.dll TB: Bing Bar: {8dcb7100-df86-4384-8842-8fa844297b3f} - "c:\program files\microsoft\bingbar\7.1.362.0\BingExt.dll" mRun: [JMB36X IDE Setup] c:\windows\raidtool\xInsIDE.exe mRun: [uMonit] c:\windows\system32\UMonit.exe mRun: [DNS7reminder] "c:\program files\nuance\naturallyspeaking11\ereg\ereg.exe" -r "c:\documents and settings\all users\application data\nuance\naturallyspeaking11\Ereg.ini mRun: [intelliPoint] "c:\program files\microsoft intellipoint\ipoint.exe" mRun: [itype] "c:\program files\microsoft intellitype pro\itype.exe" mRun: [LWS] c:\program files\logitech\lws\webcam software\LWS.exe -hide mRun: [HP Software Update] c:\program files\hp\hp software update\HPWuSchd2.exe mRun: [RTHDCPL] RTHDCPL.EXE mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup mRun: [NvMediaCenter] RunDLL32.exe NvMCTray.dll,NvTaskbarInit -login mRun: [nwiz] c:\program files\nvidia corporation\nview\nwiz.exe /installquiet dRun: [RoboForm] "c:\program files\siber systems\ai roboform\RoboTaskBarIcon.exe" dRunOnce: [DeleteEngineAfterUpdate] reg DELETE HKCU\Software\ConduitEngine /f StartupFolder: c:\docume~1\hem\startm~1\programs\startup\dropbox.lnk - c:\documents and settings\hem\application data\dropbox\bin\Dropbox.exe StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\google~1.lnk - c:\program files\google\google calendar sync\GoogleCalendarSync.exe StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\stk02n~1.lnk - c:\windows\stk02n\STK02NM.exe uPolicies-explorer: NoThumbnailCache = 1 (0x1) mPolicies-explorer: NoResolveTrack = 1 (0x1) IE: Customize Menu - file://c:\program files\siber systems\ai roboform\RoboFormComCustomizeIEMenu.html IE: Fill Forms - file://c:\program files\siber systems\ai roboform\RoboFormComFillForms.html IE: Save Forms - file://c:\program files\siber systems\ai roboform\RoboFormComSavePass.html IE: Show RoboForm Toolbar - file://c:\program files\siber systems\ai roboform\RoboFormComShowToolbar.html IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\program files\microsoft office\office14\ONBttnIE.dll IE: {320AF880-6646-11D3-ABEE-C5DBF3571F46} - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - c:\program files\siber systems\ai roboform\roboform.dll IE: {320AF880-6646-11D3-ABEE-C5DBF3571F49} - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - c:\program files\siber systems\ai roboform\roboform.dll IE: {724d43aa-0d85-11d4-9908-00400523e39a} - {724d43aa-0d85-11d4-9908-00400523e39a} - c:\program files\siber systems\ai roboform\roboform.dll IE: {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - {FFFDC614-B694-4AE6-AB38-5D6374584B52} - c:\program files\microsoft office\office14\ONBttnIELinkedNotes.dll IE: {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - c:\progra~1\spybot~1\SDHelper.dll Trusted Zone: cnet.com\download DPF: Garmin Communicator Plug-In - hxxps://static.garmincdn.com/gcp/ie/4.0.1.0/GarminAxControl_32.CAB DPF: Starfield Technologies - hxxp://video.secureserver.net/WSTPlugins/starfield_technologies.CAB DPF: {108D3206-846A-4A93-BACB-F0572D043ED7} - hxxp://99.28.49.193/webrec.cab DPF: {166B1BCA-3F9C-11CF-8075-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab DPF: {1E54D648-B804-468d-BC78-4AFFED8E262F} - hxxp://www.nvidia.com/content/DriverDownload/srl/3.0.0.4/srl_bin/sysreqlab_nvd.cab DPF: {46D8BEE7-0B27-4466-ABA2-A5F1E157971C} - hxxp://65.254.18.46:120/RemoteWeb.cab DPF: {5FFDFC21-AE40-4C7C-955C-415A1ACE01C8} - hxxp://66.192.110.33:100/VideoViewer.ocx DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} - hxxp://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1266006557234 DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} - hxxp://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1341329730109 DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab DPF: {917623D1-D8E5-11D2-BE8B-00104B06BDE3} - hxxp://www.opentopia.com/support/activex/AxisCamControl.cab DPF: {C1FDEE68-98D5-4F42-A4DD-D0BECF5077EB} - hxxp://tools.ebayimg.com/eps/wl/activex/eBay_Enhanced_Picture_Control_v1-0-31-0.cab DPF: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab TCP: DhcpNameServer = 192.168.1.254 TCP: Interfaces\{87E4B200-38DD-479B-BB2C-A0142A73BAD9} : DhcpNameServer = 192.168.1.254 Filter: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - c:\program files\common files\microsoft shared\office14\MSOXMLMF.DLL Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~1\common~1\skype\Skype4COM.dll Handler: viprotocol - {B658800C-F66E-4EF3-AB85-6C0C227862A9} - c:\program files\common files\avg secure search\viprotocolinstaller\11.1.0\ViProtocol.dll Notify: GoToMyPC - c:\program files\citrix\gotomypc\G2WinLogon.dll SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll SEH: Windows Desktop Search Namespace Manager: {56f9679e-7826-4c84-81f3-532071a8bcc5} - c:\program files\windows desktop search\MSNLNamespaceMgr.dll . ================= FIREFOX =================== . FF - ProfilePath - c:\documents and settings\hem\application data\mozilla\firefox\profiles\ajj61eh2.default\ FF - prefs.js: browser.search.defaulturl - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2475029&SearchSource=3&q={searchTerms} FF - prefs.js: browser.search.selectedEngine - AVG Secure Search FF - prefs.js: browser.startup.homepage - hxxp://isearch.avg.com?cid=%7B99945dac-158f-4ccd-b30c-95cca09b959f%7D&mid=036c9dd0f4d147d0bd56d168c3f999a6-5465d9b6fc0bf4d5974f78a9f122f84e472db74f&ds=ts026&v=11.1.0.7〈=en&pr=sa&d=2012-06-30%2012%3A44%3A26&sap=hp FF - prefs.js: keyword.URL - hxxp://isearch.avg.com/search?cid=%7B99945dac-158f-4ccd-b30c-95cca09b959f%7D&mid=036c9dd0f4d147d0bd56d168c3f999a6-5465d9b6fc0bf4d5974f78a9f122f84e472db74f&ds=ts026&v=11.1.0.7〈=en&pr=sa&d=2012-06-30%2012%3A44%3A26&sap=ku&q= . ---- FIREFOX POLICIES ---- FF - user.js: extensions.BabylonToolbar_i.id - c02de8f30000000000000021851d7055 FF - user.js: extensions.BabylonToolbar_i.hardId - c02de8f30000000000000021851d7055 FF - user.js: extensions.BabylonToolbar_i.instlDay - 15525 FF - user.js: extensions.BabylonToolbar_i.vrsn - 1.5.3.17 FF - user.js: extensions.BabylonToolbar_i.vrsni - 1.5.3.17 FF - user.js: extensions.BabylonToolbar_i.vrsnTs - 1.5.3.1710:44:39 FF - user.js: extensions.BabylonToolbar_i.prtnrId - babylon FF - user.js: extensions.BabylonToolbar_i.prdct - BabylonToolbar FF - user.js: extensions.BabylonToolbar_i.aflt - babsst FF - user.js: extensions.BabylonToolbar_i.smplGrp - none FF - user.js: extensions.BabylonToolbar_i.tlbrId - tb9 FF - user.js: extensions.BabylonToolbar_i.newTab - false FF - user.js: extensions.BabylonToolbar_i.babTrack - affID=109935&tt=010712_1 FF - user.js: extensions.BabylonToolbar_i.babExt - FF - user.js: extensions.BabylonToolbar_i.srcExt - ss FF - user.js: extensions.BabylonToolbar_i.instlRef - sst user_pref('extensions.autoDisableScopes', 0);user_pref('security.csp.enable', false);user_pref('security.OCSP.enabled', 0); FF - user.js: extensions.funmoods.hmpg - true FF - user.js: extensions.funmoods.hmpgUrl - hxxp://start.funmoods.com/?f=1&a=adknlg&chnl=adknlg&cd=2XzuyEtN2Y1L1QzutDtDtBtCzzyDtC0DyBtDyDyD0Ezz0FtAtN0D0Tzu0CtCzzyDtN1L2XzutBtFtCtFtDtFtAtDtC&cr=18690824 FF - user.js: extensions.funmoods.dfltSrch - true FF - user.js: extensions.funmoods.srchPrvdr - Search FF - user.js: extensions.funmoods.dnsErr - true FF - user.js: extensions.funmoods_i.newTab - true FF - user.js: extensions.funmoods.newTabUrl - hxxp://start.funmoods.com/?f=2&a=adknlg&chnl=adknlg&cd=2XzuyEtN2Y1L1QzutDtDtBtCzzyDtC0DyBtDyDyD0Ezz0FtAtN0D0Tzu0CtCzzyDtN1L2XzutBtFtCtFtDtFtAtDtC&cr=18690824 FF - user.js: extensions.funmoods.tlbrSrchUrl - hxxp://start.funmoods.com/?f=3&a=adknlg&chnl=adknlg&cd=2XzuyEtN2Y1L1QzutDtDtBtCzzyDtC0DyBtDyDyD0Ezz0FtAtN0D0Tzu0CtCzzyDtN1L2XzutBtFtCtFtDtFtAtDtC&cr=18690824&q= FF - user.js: extensions.funmoods.id - 0021851D7055E8F3 FF - user.js: extensions.funmoods.instlDay - 15525 FF - user.js: extensions.funmoods.vrsn - 1.5.23.22 FF - user.js: extensions.funmoods.vrsni - 1.5.23.22 FF - user.js: extensions.funmoods_i.vrsnTs - 1.5.23.2210:47:37 FF - user.js: extensions.funmoods.prtnrId - funmoods FF - user.js: extensions.funmoods.prdct - funmoods FF - user.js: extensions.funmoods.aflt - adknlg FF - user.js: extensions.funmoods_i.smplGrp - none FF - user.js: extensions.funmoods.tlbrId - base FF - user.js: extensions.funmoods.instlRef - adknlg FF - user.js: extensions.funmoods.dfltLng - FF - user.js: extensions.funmoods.excTlbr - false FF - user.js: extensions.funmoods.autoRvrt - false FF - user.js: extensions.funmoods.envrmnt - production FF - user.js: extensions.funmoods.isdcmntcmplt - true FF - user.js: extensions.funmoods.mntrvrsn - 1.3.0 . ============= SERVICES / DRIVERS =============== . R2 GsServer;GoodSync Server;c:\program files\siber systems\goodsync\Gs-Server.exe [2012-6-25 3361496] R2 nlsX86cc;Nalpeiron Licensing Service;c:\windows\system32\NLSSRV32.EXE [2012-6-3 69640] R2 nvUpdatusService;NVIDIA Update Service Daemon;c:\program files\nvidia corporation\nvidia update core\daemonu.exe [2012-7-3 1262400] R2 pcCMService;pcCMService;c:\program files\common files\motive\pcCMService.exe [2012-6-20 361472] R2 UMVPFSrv;UMVPFSrv;c:\program files\common files\logishrd\lvmvfm\UMVPFSrv.exe [2011-8-19 450848] R2 vToolbarUpdater11.1.0;vToolbarUpdater11.1.0;c:\program files\common files\avg secure search\vtoolbarupdater\11.1.0\ToolbarUpdater.exe [2012-7-1 935480] R3 BBUpdate;BBUpdate;c:\program files\microsoft\bingbar\7.1.362.0\SeaPort.EXE [2012-2-13 240408] R3 osppsvc;Office Software Protection Platform;c:\program files\common files\microsoft shared\officesoftwareprotectionplatform\OSPPSVC.EXE [2010-1-9 4640000] S1 SBRE;SBRE;c:\windows\system32\drivers\sbredrv.sys --> c:\windows\system32\drivers\SBREDrv.sys [?] S2 BBSvc;BingBar Service;c:\program files\microsoft\bingbar\7.1.362.0\BBSvc.EXE [2012-2-13 193816] S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384] S2 gupdate;Google Update Service (gupdate);c:\program files\google\update\GoogleUpdate.exe [2010-2-16 135664] S2 SkypeUpdate;Skype Updater;c:\program files\skype\updater\Updater.exe [2012-6-7 160944] S2 WSWNDA3100;WSWNDA3100;c:\program files\netgear\wnda3100v2\WifiSvc.exe [2012-1-21 272864] S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\system32\macromed\flash\FlashPlayerUpdateService.exe [2012-3-28 250056] S3 Ambfilt;Ambfilt;c:\windows\system32\drivers\Ambfilt.sys [2011-2-9 1691480] S3 AQFileRestore;AQFileRestore;c:\windows\system32\drivers\aqfilerestore.sys --> c:\windows\system32\drivers\AQFileRestore.sys [?] S3 BCMH43XX;Broadcom 802.11 USB Network Adapter Driver;c:\windows\system32\drivers\bcmwlhigh5.sys [2012-1-21 1024768] S3 dc3d;MS Hardware Device Detection Driver (USB);c:\windows\system32\drivers\dc3d.sys [2011-1-30 45288] S3 DCamUSBSTK02N;Standard Camera;c:\windows\system32\drivers\STK02NW2.sys [2010-2-25 101520] S3 DfSdkS;Defragmentation-Service;c:\program files\ashampoo\ashampoo winoptimizer 7\DfSdkS.exe [2011-4-11 406016] S3 DragonSvc;Dragon Service;c:\program files\common files\nuance\dgnsvc.exe [2010-7-23 296808] S3 FIXUSTOR;FIXUSTOR;c:\windows\system32\drivers\fixustor.sys [2011-1-30 12416] S3 gupdatem;Google Update Service (gupdatem);c:\program files\google\update\GoogleUpdate.exe [2010-2-16 135664] S3 Linksys_adapter_H;Linksys Adapter Network Driver;c:\windows\system32\drivers\AE2500xp.sys [2012-3-7 1034240] S3 MatSvc;Microsoft Automated Troubleshooting Service;c:\program files\microsoft fix it center\Matsvc.exe [2011-6-13 267568] S3 PSI;PSI;c:\windows\system32\drivers\psi_mf.sys [2009-6-17 12648] S3 SWDUMon;SWDUMon;c:\windows\system32\drivers\SWDUMon.sys [2011-3-30 12984] S3 WinRM;Windows Remote Management (WS-Management);c:\windows\system32\svchost.exe -k WINRM [2004-8-4 14336] S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\microsoft.net\framework\v4.0.30319\wpf\WPFFontCache_v0400.exe [2010-3-18 753504] S4 Akamai;Akamai NetSession Interface;c:\windows\system32\svchost.exe -k Akamai [2004-8-4 14336] S4 Bulk1528;SPCA1528 Still Camera Service; [x] S4 Ca1528av;SPCA1528 Video Camera Service; [x] . =============== Created Last 30 ================ . 2012-07-05 16:03:49 -------- d-sha-r- C:\cmdcons 2012-07-05 16:01:57 98816 ----a-w- c:\windows\sed.exe 2012-07-05 16:01:57 518144 ----a-w- c:\windows\SWREG.exe 2012-07-05 16:01:57 256000 ----a-w- c:\windows\PEV.exe 2012-07-05 16:01:57 208896 ----a-w- c:\windows\MBR.exe 2012-07-04 20:44:08 -------- d-----w- c:\windows\pss 2012-07-04 20:41:19 -------- d-----w- c:\documents and settings\hem\local settings\application data\LogMeIn Rescue Applet 2012-07-04 17:31:09 -------- d-----w- c:\documents and settings\hem\application data\AVPro 2012-07-04 17:30:59 -------- d-----w- c:\documents and settings\hem\application data\PC Antivirus 2012-07-04 17:30:56 6197048 ----a-w- c:\windows\uninstac.exe 2012-07-04 17:30:53 582992 ----a-w- c:\windows\system32\sbap.dll 2012-07-04 17:30:53 308560 ----a-w- c:\windows\system32\vipre.dll 2012-07-04 17:30:53 160768 ----a-w- c:\windows\system32\unrar.dll 2012-07-04 17:30:53 1332560 ----a-w- c:\windows\system32\sbte.dll 2012-07-04 17:30:52 -------- d-----w- c:\program files\PC Antivirus 2012-07-04 17:30:52 -------- d-----w- c:\documents and settings\all users\application data\AVC1Data 2012-07-04 17:27:50 -------- d-----w- c:\program files\PC Cleaners 2012-07-04 17:20:03 -------- d-----w- c:\documents and settings\hem\application data\PC Cleaners 2012-07-04 17:19:58 4106512 ----a-w- c:\windows\uninst.exe 2012-07-04 17:19:58 -------- d-----w- c:\documents and settings\hem\application data\PCPro 2012-07-04 17:19:56 -------- d-----w- c:\documents and settings\all users\application data\PC1Data 2012-07-04 14:49:07 -------- d-----w- c:\documents and settings\hem\application data\Funmoods 2012-07-04 14:47:24 -------- d-----w- c:\program files\OApps 2012-07-04 14:44:33 -------- d-----w- c:\program files\Playbryte 2012-07-04 14:44:33 -------- d-----w- c:\documents and settings\hem\application data\Go PDF Reader 2012-07-04 14:44:28 -------- d-----w- c:\documents and settings\hem\local settings\application data\Playbryte 2012-07-03 15:46:26 -------- d-----w- c:\windows\system32\winrm 2012-07-03 15:46:22 -------- dc-h--w- c:\windows\$968930Uinstall_KB968930$ 2012-07-03 15:03:28 45056 ----a-w- c:\windows\system32\unredmon.exe 2012-07-03 15:03:28 116224 ----a-w- c:\windows\system32\redmonnt.dll 2012-07-03 15:02:54 -------- d-----w- c:\documents and settings\hem\local settings\application data\Giant Savings 2012-07-03 15:02:53 -------- d-----w- c:\program files\BabylonToolbar 2012-07-03 15:02:52 -------- d-----w- c:\documents and settings\hem\application data\BabylonToolbar 2012-07-03 15:02:50 -------- d-----w- c:\program files\Giant Savings 2012-07-03 15:00:03 -------- d-----w- c:\documents and settings\hem\application data\Babylon 2012-07-03 15:00:03 -------- d-----w- c:\documents and settings\all users\application data\Babylon 2012-07-02 02:35:14 -------- d-----w- c:\documents and settings\hem\local settings\application data\AVG Secure Search 2012-07-01 17:00:46 -------- d-----w- c:\documents and settings\all users\application data\AVG Secure Search 2012-06-30 16:56:20 65640 ----a-w- c:\windows\system32\RtkCoInstIIXP.dll 2012-06-30 16:56:20 25548 ----a-w- c:\windows\system32\drivers\RTAIODAT.DAT 2012-06-30 16:56:20 11368 ----a-w- c:\windows\system32\RtkCoLDRXP.dll 2012-06-30 16:44:26 -------- d-----w- c:\documents and settings\hem\application data\AVG Secure Search 2012-06-30 16:44:23 -------- d-----w- c:\program files\common files\AVG Secure Search 2012-06-30 16:44:21 -------- d-----w- c:\program files\AVG Secure Search 2012-06-30 16:44:17 -------- d--h--w- c:\documents and settings\all users\application data\Common Files 2012-06-21 23:50:00 -------- d-----w- c:\documents and settings\hem\application data\FileOpen 2012-06-21 23:50:00 -------- d-----w- c:\documents and settings\all users\application data\FileOpen 2012-06-21 23:48:46 -------- d-----w- c:\documents and settings\hem\application data\Downloaded Installations 2012-06-20 11:59:48 -------- d-----w- c:\program files\ATT 2012-06-20 11:44:33 -------- d-----w- c:\documents and settings\hem\local settings\application data\ATTYToolbar 2012-06-20 11:44:33 -------- d-----w- c:\documents and settings\all users\application data\ATTYToolbar 2012-06-20 11:44:29 -------- d-----w- c:\program files\Yahoo! 2012-06-19 23:22:02 -------- d-----w- c:\program files\ATT-HSI 2012-06-19 23:21:50 -------- d-----w- c:\program files\common files\Motive 2012-06-13 05:22:39 521728 -c----w- c:\windows\system32\dllcache\jsdbgui.dll 2012-06-06 21:45:45 -------- d-----w- c:\program files\Dropbox . ==================== Find3M ==================== . 2012-07-05 15:20:58 12984 ----a-w- c:\windows\system32\drivers\SWDUMon.sys 2012-07-03 21:14:54 1074636 ----a-w- c:\windows\system32\nvdrsdb1.bin 2012-07-03 21:14:54 1 ----a-w- c:\windows\system32\nvdrssel.bin 2012-07-03 21:00:33 1074636 ----a-w- c:\windows\system32\nvdrsdb0.bin 2012-06-23 16:25:33 70344 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl 2012-06-23 16:25:33 426184 ----a-w- c:\windows\system32\FlashPlayerApp.exe 2012-06-04 21:35:26 222448 ----a-w- c:\windows\system32\muweb.dll 2012-06-04 01:25:46 69640 ----a-w- c:\windows\system32\NLSSRV32.EXE 2012-06-03 19:08:00 499712 ----a-w- c:\windows\system32\msvcp71.dll 2012-06-02 19:19:44 22040 ----a-w- c:\windows\system32\wucltui.dll.mui 2012-06-02 19:19:38 219160 ----a-w- c:\windows\system32\wuaucpl.cpl 2012-06-02 19:19:38 15384 ----a-w- c:\windows\system32\wuaucpl.cpl.mui 2012-06-02 19:19:34 15384 ----a-w- c:\windows\system32\wuapi.dll.mui 2012-06-02 19:19:30 17944 ----a-w- c:\windows\system32\wuaueng.dll.mui 2012-06-02 19:18:58 275696 ----a-w- c:\windows\system32\mucltui.dll 2012-06-02 19:18:58 17136 ----a-w- c:\windows\system32\mucltui.dll.mui 2012-05-31 13:22:09 599040 ----a-w- c:\windows\system32\crypt32.dll 2012-05-16 15:08:26 916992 ----a-w- c:\windows\system32\wininet.dll 2012-05-15 13:20:33 1863168 ----a-w- c:\windows\system32\win32k.sys 2012-05-15 09:40:26 54272 ----a-w- c:\windows\system32\nvwddi.dll 2012-05-15 09:40:02 15504192 ----a-w- c:\windows\system32\nvcpl.dll 2012-05-15 09:40:02 143680 ----a-w- c:\windows\system32\nvcolor.exe 2012-05-15 09:40:01 164160 ----a-w- c:\windows\system32\nvsvc32.exe 2012-05-15 09:40:01 108352 ----a-w- c:\windows\system32\nvmctray.dll 2012-05-11 14:42:33 43520 ------w- c:\windows\system32\licmgr10.dll 2012-05-11 14:42:33 1469440 ------w- c:\windows\system32\inetcpl.cpl 2012-05-11 11:38:02 385024 ----a-w- c:\windows\system32\html.iec 2012-05-04 13:16:13 2148352 ----a-w- c:\windows\system32\ntoskrnl.exe 2012-05-04 12:32:19 2026496 ----a-w- c:\windows\system32\ntkrnlpa.exe 2012-05-02 13:46:36 139656 ----a-w- c:\windows\system32\drivers\rdpwd.sys . ============= FINISH: 12:41:23.15 =============== ATTACH.TXT LOG: . DDS (Ver_2011-08-26.01) - NTFSx86 Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 1.6.0_26 Run by HEM at 12:41:08 on 2012-07-05 Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.3071.2233 [GMT -4:00] . . ============== Running Processes =============== . C:\WINDOWS\system32\svchost.exe -k DcomLaunch svchost.exe C:\WINDOWS\System32\svchost.exe -k netsvcs svchost.exe C:\Program Files\3COM\3Com Wireless 108 Mbps 11g USB Utility \lcs.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Common Files\logishrd\LVMVFM\UMVPFSrv.exe svchost.exe C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe C:\Program Files\Bonjour\mDNSResponder.exe C:\Program Files\Citrix\GoToMyPC\g2svc.exe C:\Program Files\Siber Systems\GoodSync\Gs-Server.exe C:\Program Files\Citrix\GoToMyPC\g2comm.exe C:\Program Files\Citrix\GoToMyPC\g2pre.exe C:\Program Files\Citrix\GoToMyPC\g2tray.exe C:\Program Files\Java\jre6\bin\jqs.exe C:\WINDOWS\system32\NLSSRV32.EXE C:\Program Files\CDBurnerXP\NMSAccessU.exe C:\WINDOWS\system32\nvsvc32.exe C:\Program Files\Common Files\Motive\pcCMService.exe svchost.exe C:\WINDOWS\system32\svchost.exe -k imgsvc C:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater\11.1.0\ToolbarUpdater.exe C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE C:\WINDOWS\system32\SearchIndexer.exe C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe C:\WINDOWS\system32\wscntfy.exe C:\WINDOWS\system32\ctfmon.exe C:\WINDOWS\system32\UMonit.exe C:\Program Files\Microsoft IntelliPoint\ipoint.exe C:\Program Files\Microsoft IntelliType Pro\itype.exe C:\Program Files\Logitech\LWS\Webcam Software\LWS.exe C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe C:\WINDOWS\RTHDCPL.EXE C:\WINDOWS\system32\RunDLL32.exe C:\Program Files\Logitech\LWS\Webcam Software\CameraHelperShell.exe C:\Program Files\Common Files\Logishrd\LQCVFX\COCIManager.exe C:\Program Files\Google\Google Calendar Sync\GoogleCalendarSync.exe C:\WINDOWS\STK02N\STK02NM.exe C:\Documents and Settings\HEM\Application Data\Dropbox\bin\Dropbox.exe C:\WINDOWS\explorer.exe C:\Program Files\Microsoft\BingBar\7.1.362.0\SeaPort.exe C:\Program Files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe C:\Program Files\Microsoft Office\Office14\OUTLOOK.EXE C:\WINDOWS\system32\SearchProtocolHost.exe C:\WINDOWS\system32\SearchProtocolHost.exe . ============== Pseudo HJT Report =============== . uStart Page = hxxp://google.com/ mStart Page = hxxp://start.funmoods.com/?f=1&a=adknlg&chnl=adknlg&cd=2XzuyEtN2Y1L1QzutDtDtBtCzzyDtC0DyBtDyDyD0Ezz0FtAtN0D0Tzu0CtCzzyDtN1L2XzutBtFtCtFtDtFtAtDtC&cr=18690824 uURLSearchHooks: YTNavAssist.YTNavAssistPlugin Class: {81017ea9-9aa8-4a6a-9734-7af40e7d593f} - c:\program files\yahoo!\companion\installs\cpn\YTNavAssist.dll BHO: &Yahoo! Toolbar Helper: {02478d38-c3f9-4efb-9b51-7695eca05670} - c:\program files\yahoo!\companion\installs\cpn\yt.dll BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll BHO: Babylon toolbar helper: {2eecd738-5844-4a99-b4b6-146bf802613b} - c:\program files\babylontoolbar\babylontoolbar\1.5.3.17\bh\BabylonToolbar.dll BHO: RoboForm Toolbar Helper: {724d43a9-0d85-11d4-9908-00400523e39a} - c:\program files\siber systems\ai roboform\roboform.dll BHO: Windows Live ID Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll BHO: AVG Security Toolbar: {95b7759c-8c7f-4bf1-b163-73684a933233} - c:\program files\avg secure search\11.1.0.7\AVG Secure Search_toolbar.dll BHO: Skype Browser Helper: {ae805869-2e5c-4ed4-8f7b-f1f7851a4497} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll BHO: Office Document Cache Handler: {b4f3a835-0e21-4959-ba22-42b3008e02ff} - c:\progra~1\micros~2\office14\URLREDIR.DLL BHO: PC Antivirus Web Protection BHO: {c11cbda9-6702-469e-9ce1-64e3971a6b44} - c:\program files\pc antivirus\pf.dll BHO: Bing Bar Helper: {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - c:\program files\microsoft\bingbar\7.1.362.0\BingExt.dll BHO: Support.com Toolbar: {d4027c7f-154a-4066-a1ad-4243d8127440} - c:\program files\ask.com\GenericAskToolbar.dll BHO: Java Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll TB: &RoboForm Toolbar: {724d43a0-0d85-11d4-9908-00400523e39a} - c:\program files\siber systems\ai roboform\roboform.dll TB: Support.com Toolbar: {d4027c7f-154a-4066-a1ad-4243d8127440} - c:\program files\ask.com\GenericAskToolbar.dll TB: Google Toolbar: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program files\google\google toolbar\GoogleToolbar_32.dll TB: att.net Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - c:\program files\yahoo!\companion\installs\cpn\yt.dll TB: AVG Security Toolbar: {95b7759c-8c7f-4bf1-b163-73684a933233} - c:\program files\avg secure search\11.1.0.7\AVG Secure Search_toolbar.dll TB: Babylon Toolbar: {98889811-442d-49dd-99d7-dc866be87dbc} - c:\program files\babylontoolbar\babylontoolbar\1.5.3.17\BabylonToolbarTlbr.dll TB: Bing Bar: {8dcb7100-df86-4384-8842-8fa844297b3f} - "c:\program files\microsoft\bingbar\7.1.362.0\BingExt.dll" mRun: [JMB36X IDE Setup] c:\windows\raidtool\xInsIDE.exe mRun: [uMonit] c:\windows\system32\UMonit.exe mRun: [DNS7reminder] "c:\program files\nuance\naturallyspeaking11\ereg\ereg.exe" -r "c:\documents and settings\all users\application data\nuance\naturallyspeaking11\Ereg.ini mRun: [intelliPoint] "c:\program files\microsoft intellipoint\ipoint.exe" mRun: [itype] "c:\program files\microsoft intellitype pro\itype.exe" mRun: [LWS] c:\program files\logitech\lws\webcam software\LWS.exe -hide mRun: [HP Software Update] c:\program files\hp\hp software update\HPWuSchd2.exe mRun: [RTHDCPL] RTHDCPL.EXE mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup mRun: [NvMediaCenter] RunDLL32.exe NvMCTray.dll,NvTaskbarInit -login mRun: [nwiz] c:\program files\nvidia corporation\nview\nwiz.exe /installquiet dRun: [RoboForm] "c:\program files\siber systems\ai roboform\RoboTaskBarIcon.exe" dRunOnce: [DeleteEngineAfterUpdate] reg DELETE HKCU\Software\ConduitEngine /f StartupFolder: c:\docume~1\hem\startm~1\programs\startup\dropbox.lnk - c:\documents and settings\hem\application data\dropbox\bin\Dropbox.exe StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\google~1.lnk - c:\program files\google\google calendar sync\GoogleCalendarSync.exe StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\stk02n~1.lnk - c:\windows\stk02n\STK02NM.exe uPolicies-explorer: NoThumbnailCache = 1 (0x1) mPolicies-explorer: NoResolveTrack = 1 (0x1) IE: Customize Menu - file://c:\program files\siber systems\ai roboform\RoboFormComCustomizeIEMenu.html IE: Fill Forms - file://c:\program files\siber systems\ai roboform\RoboFormComFillForms.html IE: Save Forms - file://c:\program files\siber systems\ai roboform\RoboFormComSavePass.html IE: Show RoboForm Toolbar - file://c:\program files\siber systems\ai roboform\RoboFormComShowToolbar.html IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\program files\microsoft office\office14\ONBttnIE.dll IE: {320AF880-6646-11D3-ABEE-C5DBF3571F46} - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - c:\program files\siber systems\ai roboform\roboform.dll IE: {320AF880-6646-11D3-ABEE-C5DBF3571F49} - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - c:\program files\siber systems\ai roboform\roboform.dll IE: {724d43aa-0d85-11d4-9908-00400523e39a} - {724d43aa-0d85-11d4-9908-00400523e39a} - c:\program files\siber systems\ai roboform\roboform.dll IE: {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - {FFFDC614-B694-4AE6-AB38-5D6374584B52} - c:\program files\microsoft office\office14\ONBttnIELinkedNotes.dll IE: {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - c:\progra~1\spybot~1\SDHelper.dll Trusted Zone: cnet.com\download DPF: Garmin Communicator Plug-In - hxxps://static.garmincdn.com/gcp/ie/4.0.1.0/GarminAxControl_32.CAB DPF: Starfield Technologies - hxxp://video.secureserver.net/WSTPlugins/starfield_technologies.CAB DPF: {108D3206-846A-4A93-BACB-F0572D043ED7} - hxxp://99.28.49.193/webrec.cab DPF: {166B1BCA-3F9C-11CF-8075-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab DPF: {1E54D648-B804-468d-BC78-4AFFED8E262F} - hxxp://www.nvidia.com/content/DriverDownload/srl/3.0.0.4/srl_bin/sysreqlab_nvd.cab DPF: {46D8BEE7-0B27-4466-ABA2-A5F1E157971C} - hxxp://65.254.18.46:120/RemoteWeb.cab DPF: {5FFDFC21-AE40-4C7C-955C-415A1ACE01C8} - hxxp://66.192.110.33:100/VideoViewer.ocx DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} - hxxp://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1266006557234 DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} - hxxp://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1341329730109 DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab DPF: {917623D1-D8E5-11D2-BE8B-00104B06BDE3} - hxxp://www.opentopia.com/support/activex/AxisCamControl.cab DPF: {C1FDEE68-98D5-4F42-A4DD-D0BECF5077EB} - hxxp://tools.ebayimg.com/eps/wl/activex/eBay_Enhanced_Picture_Control_v1-0-31-0.cab DPF: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab TCP: DhcpNameServer = 192.168.1.254 TCP: Interfaces\{87E4B200-38DD-479B-BB2C-A0142A73BAD9} : DhcpNameServer = 192.168.1.254 Filter: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - c:\program files\common files\microsoft shared\office14\MSOXMLMF.DLL Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~1\common~1\skype\Skype4COM.dll Handler: viprotocol - {B658800C-F66E-4EF3-AB85-6C0C227862A9} - c:\program files\common files\avg secure search\viprotocolinstaller\11.1.0\ViProtocol.dll Notify: GoToMyPC - c:\program files\citrix\gotomypc\G2WinLogon.dll SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll SEH: Windows Desktop Search Namespace Manager: {56f9679e-7826-4c84-81f3-532071a8bcc5} - c:\program files\windows desktop search\MSNLNamespaceMgr.dll . ================= FIREFOX =================== . FF - ProfilePath - c:\documents and settings\hem\application data\mozilla\firefox\profiles\ajj61eh2.default\ FF - prefs.js: browser.search.defaulturl - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2475029&SearchSource=3&q={searchTerms} FF - prefs.js: browser.search.selectedEngine - AVG Secure Search FF - prefs.js: browser.startup.homepage - hxxp://isearch.avg.com?cid=%7B99945dac-158f-4ccd-b30c-95cca09b959f%7D&mid=036c9dd0f4d147d0bd56d168c3f999a6-5465d9b6fc0bf4d5974f78a9f122f84e472db74f&ds=ts026&v=11.1.0.7〈=en&pr=sa&d=2012-06-30%2012%3A44%3A26&sap=hp FF - prefs.js: keyword.URL - hxxp://isearch.avg.com/search?cid=%7B99945dac-158f-4ccd-b30c-95cca09b959f%7D&mid=036c9dd0f4d147d0bd56d168c3f999a6-5465d9b6fc0bf4d5974f78a9f122f84e472db74f&ds=ts026&v=11.1.0.7〈=en&pr=sa&d=2012-06-30%2012%3A44%3A26&sap=ku&q= . ---- FIREFOX POLICIES ---- FF - user.js: extensions.BabylonToolbar_i.id - c02de8f30000000000000021851d7055 FF - user.js: extensions.BabylonToolbar_i.hardId - c02de8f30000000000000021851d7055 FF - user.js: extensions.BabylonToolbar_i.instlDay - 15525 FF - user.js: extensions.BabylonToolbar_i.vrsn - 1.5.3.17 FF - user.js: extensions.BabylonToolbar_i.vrsni - 1.5.3.17 FF - user.js: extensions.BabylonToolbar_i.vrsnTs - 1.5.3.1710:44:39 FF - user.js: extensions.BabylonToolbar_i.prtnrId - babylon FF - user.js: extensions.BabylonToolbar_i.prdct - BabylonToolbar FF - user.js: extensions.BabylonToolbar_i.aflt - babsst FF - user.js: extensions.BabylonToolbar_i.smplGrp - none FF - user.js: extensions.BabylonToolbar_i.tlbrId - tb9 FF - user.js: extensions.BabylonToolbar_i.newTab - false FF - user.js: extensions.BabylonToolbar_i.babTrack - affID=109935&tt=010712_1 FF - user.js: extensions.BabylonToolbar_i.babExt - FF - user.js: extensions.BabylonToolbar_i.srcExt - ss FF - user.js: extensions.BabylonToolbar_i.instlRef - sst user_pref('extensions.autoDisableScopes', 0);user_pref('security.csp.enable', false);user_pref('security.OCSP.enabled', 0); FF - user.js: extensions.funmoods.hmpg - true FF - user.js: extensions.funmoods.hmpgUrl - hxxp://start.funmoods.com/?f=1&a=adknlg&chnl=adknlg&cd=2XzuyEtN2Y1L1QzutDtDtBtCzzyDtC0DyBtDyDyD0Ezz0FtAtN0D0Tzu0CtCzzyDtN1L2XzutBtFtCtFtDtFtAtDtC&cr=18690824 FF - user.js: extensions.funmoods.dfltSrch - true FF - user.js: extensions.funmoods.srchPrvdr - Search FF - user.js: extensions.funmoods.dnsErr - true FF - user.js: extensions.funmoods_i.newTab - true FF - user.js: extensions.funmoods.newTabUrl - hxxp://start.funmoods.com/?f=2&a=adknlg&chnl=adknlg&cd=2XzuyEtN2Y1L1QzutDtDtBtCzzyDtC0DyBtDyDyD0Ezz0FtAtN0D0Tzu0CtCzzyDtN1L2XzutBtFtCtFtDtFtAtDtC&cr=18690824 FF - user.js: extensions.funmoods.tlbrSrchUrl - hxxp://start.funmoods.com/?f=3&a=adknlg&chnl=adknlg&cd=2XzuyEtN2Y1L1QzutDtDtBtCzzyDtC0DyBtDyDyD0Ezz0FtAtN0D0Tzu0CtCzzyDtN1L2XzutBtFtCtFtDtFtAtDtC&cr=18690824&q= FF - user.js: extensions.funmoods.id - 0021851D7055E8F3 FF - user.js: extensions.funmoods.instlDay - 15525 FF - user.js: extensions.funmoods.vrsn - 1.5.23.22 FF - user.js: extensions.funmoods.vrsni - 1.5.23.22 FF - user.js: extensions.funmoods_i.vrsnTs - 1.5.23.2210:47:37 FF - user.js: extensions.funmoods.prtnrId - funmoods FF - user.js: extensions.funmoods.prdct - funmoods FF - user.js: extensions.funmoods.aflt - adknlg FF - user.js: extensions.funmoods_i.smplGrp - none FF - user.js: extensions.funmoods.tlbrId - base FF - user.js: extensions.funmoods.instlRef - adknlg FF - user.js: extensions.funmoods.dfltLng - FF - user.js: extensions.funmoods.excTlbr - false FF - user.js: extensions.funmoods.autoRvrt - false FF - user.js: extensions.funmoods.envrmnt - production FF - user.js: extensions.funmoods.isdcmntcmplt - true FF - user.js: extensions.funmoods.mntrvrsn - 1.3.0 . ============= SERVICES / DRIVERS =============== . R2 GsServer;GoodSync Server;c:\program files\siber systems\goodsync\Gs-Server.exe [2012-6-25 3361496] R2 nlsX86cc;Nalpeiron Licensing Service;c:\windows\system32\NLSSRV32.EXE [2012-6-3 69640] R2 nvUpdatusService;NVIDIA Update Service Daemon;c:\program files\nvidia corporation\nvidia update core\daemonu.exe [2012-7-3 1262400] R2 pcCMService;pcCMService;c:\program files\common files\motive\pcCMService.exe [2012-6-20 361472] R2 UMVPFSrv;UMVPFSrv;c:\program files\common files\logishrd\lvmvfm\UMVPFSrv.exe [2011-8-19 450848] R2 vToolbarUpdater11.1.0;vToolbarUpdater11.1.0;c:\program files\common files\avg secure search\vtoolbarupdater\11.1.0\ToolbarUpdater.exe [2012-7-1 935480] R3 BBUpdate;BBUpdate;c:\program files\microsoft\bingbar\7.1.362.0\SeaPort.EXE [2012-2-13 240408] R3 osppsvc;Office Software Protection Platform;c:\program files\common files\microsoft shared\officesoftwareprotectionplatform\OSPPSVC.EXE [2010-1-9 4640000] S1 SBRE;SBRE;c:\windows\system32\drivers\sbredrv.sys --> c:\windows\system32\drivers\SBREDrv.sys [?] S2 BBSvc;BingBar Service;c:\program files\microsoft\bingbar\7.1.362.0\BBSvc.EXE [2012-2-13 193816] S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384] S2 gupdate;Google Update Service (gupdate);c:\program files\google\update\GoogleUpdate.exe [2010-2-16 135664] S2 SkypeUpdate;Skype Updater;c:\program files\skype\updater\Updater.exe [2012-6-7 160944] S2 WSWNDA3100;WSWNDA3100;c:\program files\netgear\wnda3100v2\WifiSvc.exe [2012-1-21 272864] S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\system32\macromed\flash\FlashPlayerUpdateService.exe [2012-3-28 250056] S3 Ambfilt;Ambfilt;c:\windows\system32\drivers\Ambfilt.sys [2011-2-9 1691480] S3 AQFileRestore;AQFileRestore;c:\windows\system32\drivers\aqfilerestore.sys --> c:\windows\system32\drivers\AQFileRestore.sys [?] S3 BCMH43XX;Broadcom 802.11 USB Network Adapter Driver;c:\windows\system32\drivers\bcmwlhigh5.sys [2012-1-21 1024768] S3 dc3d;MS Hardware Device Detection Driver (USB);c:\windows\system32\drivers\dc3d.sys [2011-1-30 45288] S3 DCamUSBSTK02N;Standard Camera;c:\windows\system32\drivers\STK02NW2.sys [2010-2-25 101520] S3 DfSdkS;Defragmentation-Service;c:\program files\ashampoo\ashampoo winoptimizer 7\DfSdkS.exe [2011-4-11 406016] S3 DragonSvc;Dragon Service;c:\program files\common files\nuance\dgnsvc.exe [2010-7-23 296808] S3 FIXUSTOR;FIXUSTOR;c:\windows\system32\drivers\fixustor.sys [2011-1-30 12416] S3 gupdatem;Google Update Service (gupdatem);c:\program files\google\update\GoogleUpdate.exe [2010-2-16 135664] S3 Linksys_adapter_H;Linksys Adapter Network Driver;c:\windows\system32\drivers\AE2500xp.sys [2012-3-7 1034240] S3 MatSvc;Microsoft Automated Troubleshooting Service;c:\program files\microsoft fix it center\Matsvc.exe [2011-6-13 267568] S3 PSI;PSI;c:\windows\system32\drivers\psi_mf.sys [2009-6-17 12648] S3 SWDUMon;SWDUMon;c:\windows\system32\drivers\SWDUMon.sys [2011-3-30 12984] S3 WinRM;Windows Remote Management (WS-Management);c:\windows\system32\svchost.exe -k WINRM [2004-8-4 14336] S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\microsoft.net\framework\v4.0.30319\wpf\WPFFontCache_v0400.exe [2010-3-18 753504] S4 Akamai;Akamai NetSession Interface;c:\windows\system32\svchost.exe -k Akamai [2004-8-4 14336] S4 Bulk1528;SPCA1528 Still Camera Service; [x] S4 Ca1528av;SPCA1528 Video Camera Service; [x] . =============== Created Last 30 ================ . 2012-07-05 16:03:49 -------- d-sha-r- C:\cmdcons 2012-07-05 16:01:57 98816 ----a-w- c:\windows\sed.exe 2012-07-05 16:01:57 518144 ----a-w- c:\windows\SWREG.exe 2012-07-05 16:01:57 256000 ----a-w- c:\windows\PEV.exe 2012-07-05 16:01:57 208896 ----a-w- c:\windows\MBR.exe 2012-07-04 20:44:08 -------- d-----w- c:\windows\pss 2012-07-04 20:41:19 -------- d-----w- c:\documents and settings\hem\local settings\application data\LogMeIn Rescue Applet 2012-07-04 17:31:09 -------- d-----w- c:\documents and settings\hem\application data\AVPro 2012-07-04 17:30:59 -------- d-----w- c:\documents and settings\hem\application data\PC Antivirus 2012-07-04 17:30:56 6197048 ----a-w- c:\windows\uninstac.exe 2012-07-04 17:30:53 582992 ----a-w- c:\windows\system32\sbap.dll 2012-07-04 17:30:53 308560 ----a-w- c:\windows\system32\vipre.dll 2012-07-04 17:30:53 160768 ----a-w- c:\windows\system32\unrar.dll 2012-07-04 17:30:53 1332560 ----a-w- c:\windows\system32\sbte.dll 2012-07-04 17:30:52 -------- d-----w- c:\program files\PC Antivirus 2012-07-04 17:30:52 -------- d-----w- c:\documents and settings\all users\application data\AVC1Data 2012-07-04 17:27:50 -------- d-----w- c:\program files\PC Cleaners 2012-07-04 17:20:03 -------- d-----w- c:\documents and settings\hem\application data\PC Cleaners 2012-07-04 17:19:58 4106512 ----a-w- c:\windows\uninst.exe 2012-07-04 17:19:58 -------- d-----w- c:\documents and settings\hem\application data\PCPro 2012-07-04 17:19:56 -------- d-----w- c:\documents and settings\all users\application data\PC1Data 2012-07-04 14:49:07 -------- d-----w- c:\documents and settings\hem\application data\Funmoods 2012-07-04 14:47:24 -------- d-----w- c:\program files\OApps 2012-07-04 14:44:33 -------- d-----w- c:\program files\Playbryte 2012-07-04 14:44:33 -------- d-----w- c:\documents and settings\hem\application data\Go PDF Reader 2012-07-04 14:44:28 -------- d-----w- c:\documents and settings\hem\local settings\application data\Playbryte 2012-07-03 15:46:26 -------- d-----w- c:\windows\system32\winrm 2012-07-03 15:46:22 -------- dc-h--w- c:\windows\$968930Uinstall_KB968930$ 2012-07-03 15:03:28 45056 ----a-w- c:\windows\system32\unredmon.exe 2012-07-03 15:03:28 116224 ----a-w- c:\windows\system32\redmonnt.dll 2012-07-03 15:02:54 -------- d-----w- c:\documents and settings\hem\local settings\application data\Giant Savings 2012-07-03 15:02:53 -------- d-----w- c:\program files\BabylonToolbar 2012-07-03 15:02:52 -------- d-----w- c:\documents and settings\hem\application data\BabylonToolbar 2012-07-03 15:02:50 -------- d-----w- c:\program files\Giant Savings 2012-07-03 15:00:03 -------- d-----w- c:\documents and settings\hem\application data\Babylon 2012-07-03 15:00:03 -------- d-----w- c:\documents and settings\all users\application data\Babylon 2012-07-02 02:35:14 -------- d-----w- c:\documents and settings\hem\local settings\application data\AVG Secure Search 2012-07-01 17:00:46 -------- d-----w- c:\documents and settings\all users\application data\AVG Secure Search 2012-06-30 16:56:20 65640 ----a-w- c:\windows\system32\RtkCoInstIIXP.dll 2012-06-30 16:56:20 25548 ----a-w- c:\windows\system32\drivers\RTAIODAT.DAT 2012-06-30 16:56:20 11368 ----a-w- c:\windows\system32\RtkCoLDRXP.dll 2012-06-30 16:44:26 -------- d-----w- c:\documents and settings\hem\application data\AVG Secure Search 2012-06-30 16:44:23 -------- d-----w- c:\program files\common files\AVG Secure Search 2012-06-30 16:44:21 -------- d-----w- c:\program files\AVG Secure Search 2012-06-30 16:44:17 -------- d--h--w- c:\documents and settings\all users\application data\Common Files 2012-06-21 23:50:00 -------- d-----w- c:\documents and settings\hem\application data\FileOpen 2012-06-21 23:50:00 -------- d-----w- c:\documents and settings\all users\application data\FileOpen 2012-06-21 23:48:46 -------- d-----w- c:\documents and settings\hem\application data\Downloaded Installations 2012-06-20 11:59:48 -------- d-----w- c:\program files\ATT 2012-06-20 11:44:33 -------- d-----w- c:\documents and settings\hem\local settings\application data\ATTYToolbar 2012-06-20 11:44:33 -------- d-----w- c:\documents and settings\all users\application data\ATTYToolbar 2012-06-20 11:44:29 -------- d-----w- c:\program files\Yahoo! 2012-06-19 23:22:02 -------- d-----w- c:\program files\ATT-HSI 2012-06-19 23:21:50 -------- d-----w- c:\program files\common files\Motive 2012-06-13 05:22:39 521728 -c----w- c:\windows\system32\dllcache\jsdbgui.dll 2012-06-06 21:45:45 -------- d-----w- c:\program files\Dropbox . ==================== Find3M ==================== . 2012-07-05 15:20:58 12984 ----a-w- c:\windows\system32\drivers\SWDUMon.sys 2012-07-03 21:14:54 1074636 ----a-w- c:\windows\system32\nvdrsdb1.bin 2012-07-03 21:14:54 1 ----a-w- c:\windows\system32\nvdrssel.bin 2012-07-03 21:00:33 1074636 ----a-w- c:\windows\system32\nvdrsdb0.bin 2012-06-23 16:25:33 70344 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl 2012-06-23 16:25:33 426184 ----a-w- c:\windows\system32\FlashPlayerApp.exe 2012-06-04 21:35:26 222448 ----a-w- c:\windows\system32\muweb.dll 2012-06-04 01:25:46 69640 ----a-w- c:\windows\system32\NLSSRV32.EXE 2012-06-03 19:08:00 499712 ----a-w- c:\windows\system32\msvcp71.dll 2012-06-02 19:19:44 22040 ----a-w- c:\windows\system32\wucltui.dll.mui 2012-06-02 19:19:38 219160 ----a-w- c:\windows\system32\wuaucpl.cpl 2012-06-02 19:19:38 15384 ----a-w- c:\windows\system32\wuaucpl.cpl.mui 2012-06-02 19:19:34 15384 ----a-w- c:\windows\system32\wuapi.dll.mui 2012-06-02 19:19:30 17944 ----a-w- c:\windows\system32\wuaueng.dll.mui 2012-06-02 19:18:58 275696 ----a-w- c:\windows\system32\mucltui.dll 2012-06-02 19:18:58 17136 ----a-w- c:\windows\system32\mucltui.dll.mui 2012-05-31 13:22:09 599040 ----a-w- c:\windows\system32\crypt32.dll 2012-05-16 15:08:26 916992 ----a-w- c:\windows\system32\wininet.dll 2012-05-15 13:20:33 1863168 ----a-w- c:\windows\system32\win32k.sys 2012-05-15 09:40:26 54272 ----a-w- c:\windows\system32\nvwddi.dll 2012-05-15 09:40:02 15504192 ----a-w- c:\windows\system32\nvcpl.dll 2012-05-15 09:40:02 143680 ----a-w- c:\windows\system32\nvcolor.exe 2012-05-15 09:40:01 164160 ----a-w- c:\windows\system32\nvsvc32.exe 2012-05-15 09:40:01 108352 ----a-w- c:\windows\system32\nvmctray.dll 2012-05-11 14:42:33 43520 ------w- c:\windows\system32\licmgr10.dll 2012-05-11 14:42:33 1469440 ------w- c:\windows\system32\inetcpl.cpl 2012-05-11 11:38:02 385024 ----a-w- c:\windows\system32\html.iec 2012-05-04 13:16:13 2148352 ----a-w- c:\windows\system32\ntoskrnl.exe 2012-05-04 12:32:19 2026496 ----a-w- c:\windows\system32\ntkrnlpa.exe 2012-05-02 13:46:36 139656 ----a-w- c:\windows\system32\drivers\rdpwd.sys . ============= FINISH: 12:41:23.15 ===============
Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.