Power1tobee

Here is the log: Results of screen317's Security Check version 0.99.54 Windows Vista Service Pack 2 x64 (UAC is enabled) Internet Explorer 9 ``````````````Antivirus/Firewall Check:`````````````` Windows Firewall Enabled! WMI entry may not exist for antivirus; attempting automatic update. `````````Anti-malware/Other Utilities Check:````````` Malwarebytes Anti-Malware version 1.65.1.1000 Java 6 Update 37 Java version out of Date! Adobe Flash Player 11.5.502.110 Adobe Reader 9 Adobe Reader out of Date! Mozilla Firefox (16.0.2) ````````Process Check: objlist.exe by Laurent```````` Windows Defender MSASCui.exe Malwarebytes Anti-Malware mbamservice.exe Malwarebytes Anti-Malware mbamgui.exe Malwarebytes' Anti-Malware mbamscheduler.exe Windows Defender MSASCui.exe `````````````````System Health check````````````````` Total Fragmentation on Drive C: 0 % ````````````````````End of Log``````````````````````

New Report: # AdwCleaner v2.007 - Logfile created 11/12/2012 at 14:22:12 # Updated 06/11/2012 by Xplode # Operating system : Windows Vista Home Premium Service Pack 2 (64 bits) # User : John Schultz - JOHNSCHULTZ-PC # Boot Mode : Normal # Running from : C:\Users\John Schultz\Desktop\adwcleaner.exe # Option [Delete] ***** [services] ***** ***** [Files / Folders] ***** Deleted on reboot : C:\Program Files (x86)\AVG Secure Search Deleted on reboot : C:\Program Files (x86)\Common Files\AVG Secure Search Deleted on reboot : C:\ProgramData\AVG Secure Search Deleted on reboot : C:\ProgramData\blekko toolbars Deleted on reboot : C:\Users\John Schultz\AppData\Local\AVG Secure Search Deleted on reboot : C:\Users\John Schultz\AppData\Local\Google\Chrome\User Data\Default\databases\chrome-extension_mpfapcdfbbledbojijcbcclmlieaoogk_0 Deleted on reboot : C:\Users\John Schultz\AppData\LocalLow\AVG Secure Search Deleted on reboot : C:\Users\John Schultz\AppData\Roaming\Mozilla\Firefox\Profiles\9vdxx2kv.default\extensions\crossriderapp2258@crossrider.com Deleted on reboot : C:\Users\John Schultz\AppData\Roaming\Mozilla\Firefox\Profiles\9vdxx2kv.default\FCTB Deleted on reboot : C:\Users\JOHNSC~1\AppData\Local\Temp\avg@toolbar File Deleted : C:\Program Files (x86)\Mozilla Firefox\searchplugins\avg-secure-search.xml ***** [Registry] ***** Key Deleted : HKCU\Software\AppDataLow\Software\Crossrider Key Deleted : HKCU\Software\AppDataLow\Software\I Want This Key Deleted : HKCU\Software\AVG Secure Search Key Deleted : HKCU\Software\Conduit Key Deleted : HKCU\Software\Cr_Installer Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\AVG Secure Search Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\I Want This Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{95B7759C-8C7F-4BF1-B163-73684A933233} Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{95B7759C-8C7F-4BF1-B163-73684A933233} Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{F25AF245-4A81-40DC-92F9-E9021F207706} Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{3BD44F0E-0596-4008-AEE0-45D47E3A8F0E} Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{95B7759C-8C7F-4BF1-B163-73684A933233} Key Deleted : HKLM\Software\AVG Secure Search Key Deleted : HKLM\SOFTWARE\Classes\AppID\{1FDFF5A2-7BB1-48E1-8081-7236812B12B2} Key Deleted : HKLM\SOFTWARE\Classes\AppID\{BB711CB0-C70B-482E-9852-EC05EBD71DBB} Key Deleted : HKLM\SOFTWARE\Classes\AppID\ScriptHelper.EXE Key Deleted : HKLM\SOFTWARE\Classes\AppID\ViProtocol.DLL Key Deleted : HKLM\SOFTWARE\Classes\AVG Secure Search.BrowserWndAPI Key Deleted : HKLM\SOFTWARE\Classes\AVG Secure Search.BrowserWndAPI.1 Key Deleted : HKLM\SOFTWARE\Classes\AVG Secure Search.PugiObj Key Deleted : HKLM\SOFTWARE\Classes\AVG Secure Search.PugiObj.1 Key Deleted : HKLM\SOFTWARE\Classes\PROTOCOLS\Handler\viprotocol Key Deleted : HKLM\SOFTWARE\Classes\S Key Deleted : HKLM\SOFTWARE\Classes\ScriptHelper.ScriptHelperApi Key Deleted : HKLM\SOFTWARE\Classes\ScriptHelper.ScriptHelperApi.1 Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{74FB6AFD-DD77-4CEB-83BD-AB2B63E63C93} Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{9C049BA6-EA47-4AC3-AED6-A66D8DC9E1D8} Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{C2AC8A0E-E48E-484B-A71C-C7A937FAAB94} Key Deleted : HKLM\SOFTWARE\Classes\ViProtocol.ViProtocolOLE Key Deleted : HKLM\SOFTWARE\Classes\ViProtocol.ViProtocolOLE.1 Key Deleted : HKLM\Software\Conduit Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{C6FDD0C3-266A-4DC3-B459-28C697C44CDC} Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{F25AF245-4A81-40DC-92F9-E9021F207706} Key Deleted : HKLM\SOFTWARE\MozillaPlugins\@avg.com/AVG SiteSafety plugin,version=11.0.0.1,application/x-avg-sitesafety-plugin Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{4E92DB5F-AAD9-49D3-8EAB-B40CBE5B1FF7} Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{95B7759C-8C7F-4BF1-B163-73684A933233} Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{B658800C-F66E-4EF3-AB85-6C0C227862A9} Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39} Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{F25AF245-4A81-40DC-92F9-E9021F207706} Key Deleted : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39} Key Deleted : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{F25AF245-4A81-40DC-92F9-E9021F207706} Key Deleted : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{95B7759C-8C7F-4BF1-B163-73684A933233} Key Deleted : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\AVG Secure Search Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{F25AF245-4A81-40DC-92F9-E9021F207706} Key Deleted : HKLM\SOFTWARE\Classes\Interface\{03E2A1F3-4402-4121-8B35-733216D61217} Key Deleted : HKLM\SOFTWARE\Classes\Interface\{4E92DB5F-AAD9-49D3-8EAB-B40CBE5B1FF7} Key Deleted : HKLM\SOFTWARE\Classes\Interface\{9E3B11F6-4179-4603-A71B-A55F4BCB0BEC} Key Deleted : HKLM\SOFTWARE\Classes\Interface\{C401D2CE-DC27-45C7-BC0C-8E6EA7F085D6} Value Deleted : HKCU\Software\Microsoft\Internet Explorer\New Windows\Allow [*.crossrider.com] Value Deleted : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39}] Value Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\New Windows\Allow [*.crossrider.com] Value Deleted : HKLM\SOFTWARE\Mozilla\Firefox\Extensions [Avg@toolbar] Value Deleted : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar [{95B7759C-8C7F-4BF1-B163-73684A933233}] ***** [internet Browsers] ***** -\\ Internet Explorer v9.0.8112.16421 Replaced : [HKCU\Software\Microsoft\Internet Explorer\Main - Start Page] = hxxps://isearch.avg.com/?cid={A2C6BF1A-EA02-4D41-A198-4B926F88585B}&mid=cbb57769766e416890bc23c7fea7ca6f-459f19ff00d8727367d7de2ea512bd5c953ae3e0〈=en&ds=hk014&pr=sa&d=2012-07-29 16:22:40&v=12.1.0.21&sap=hp --> hxxp://www.google.com -\\ Mozilla Firefox v16.0.2 (en-US) Profile name : default File : C:\Users\John Schultz\AppData\Roaming\Mozilla\Firefox\Profiles\9vdxx2kv.default\prefs.js C:\Users\John Schultz\AppData\Roaming\Mozilla\Firefox\Profiles\9vdxx2kv.default\user.js ... Deleted ! Deleted : user_pref("browser.search.defaultenginename", "AVG Secure Search"); Deleted : user_pref("browser.search.order.1", "Blekko"); Deleted : user_pref("browser.search.selectedEngine", "AVG Secure Search"); Deleted : user_pref("extensions.crossriderapp2258.2258.InstallationThankYouPage", true); Deleted : user_pref("extensions.crossriderapp2258.2258.InstallationTime", 1336955183); Deleted : user_pref("extensions.crossriderapp2258.2258.InstallationUserSettings.searchUserConifrmation", false[...] Deleted : user_pref("extensions.crossriderapp2258.2258.InstallationUserSettings.setHomepage", false); Deleted : user_pref("extensions.crossriderapp2258.2258.InstallationUserSettings.setNewTab", false); Deleted : user_pref("extensions.crossriderapp2258.2258.InstallationUserSettings.setSearch", false); Deleted : user_pref("extensions.crossriderapp2258.2258.active", true); Deleted : user_pref("extensions.crossriderapp2258.2258.addressbar", ""); Deleted : user_pref("extensions.crossriderapp2258.2258.affid", "0"); Deleted : user_pref("extensions.crossriderapp2258.2258.backgroundjs", "\n\n\"undefined\"!=typeof _GPL_BG_NEW&&[...] Deleted : user_pref("extensions.crossriderapp2258.2258.backgroundver", 16); Deleted : user_pref("extensions.crossriderapp2258.2258.can_run_bg_code", true); Deleted : user_pref("extensions.crossriderapp2258.2258.certdomaininstaller", ""); Deleted : user_pref("extensions.crossriderapp2258.2258.changeprevious", false); Deleted : user_pref("extensions.crossriderapp2258.2258.cookie.InstallationTime.expiration", "Fri Feb 01 2030 0[...] Deleted : user_pref("extensions.crossriderapp2258.2258.cookie.InstallationTime.value", "1336955183"); Deleted : user_pref("extensions.crossriderapp2258.2258.cookie.InstallerParams.expiration", "Fri Feb 01 2030 00[...] Deleted : user_pref("extensions.crossriderapp2258.2258.cookie._GPL_aoi.expiration", "Fri Feb 01 2030 00:00:00 [...] Deleted : user_pref("extensions.crossriderapp2258.2258.cookie._GPL_aoi.value", "1336955183"); Deleted : user_pref("extensions.crossriderapp2258.2258.cookie._GPL_blocklist.expiration", "Mon Nov 12 2012 14:[...] Deleted : user_pref("extensions.crossriderapp2258.2258.cookie._GPL_blocklist.value", "%22nonexistantdomain.com[...] Deleted : user_pref("extensions.crossriderapp2258.2258.cookie._GPL_country_code.expiration", "Tue Nov 13 2012 [...] Deleted : user_pref("extensions.crossriderapp2258.2258.cookie._GPL_country_code.value", "%22US%22"); Deleted : user_pref("extensions.crossriderapp2258.2258.cookie._GPL_crr.expiration", "Fri Feb 01 2030 00:00:00 [...] Deleted : user_pref("extensions.crossriderapp2258.2258.cookie._GPL_crr.value", "1352747723"); Deleted : user_pref("extensions.crossriderapp2258.2258.cookie._GPL_hotfix20111102645.expiration", "Fri Feb 01 [...] Deleted : user_pref("extensions.crossriderapp2258.2258.cookie._GPL_hotfix20111102645.value", "%221%22"); Deleted : user_pref("extensions.crossriderapp2258.2258.cookie._GPL_installer_params.expiration", "Fri Feb 01 2[...] Deleted : user_pref("extensions.crossriderapp2258.2258.cookie._GPL_installer_params.value", "%7B%22source_id%2[...] Deleted : user_pref("extensions.crossriderapp2258.2258.cookie._GPL_parent_zoneid.expiration", "Fri Feb 01 2030[...] Deleted : user_pref("extensions.crossriderapp2258.2258.cookie._GPL_parent_zoneid.value", "%2214019%22"); Deleted : user_pref("extensions.crossriderapp2258.2258.cookie._GPL_pc_20120828.expiration", "Fri Feb 01 2030 0[...] Deleted : user_pref("extensions.crossriderapp2258.2258.cookie._GPL_pc_20120828.value", "1346204276819"); Deleted : user_pref("extensions.crossriderapp2258.2258.cookie._GPL_product_id.expiration", "Fri Feb 01 2030 00[...] Deleted : user_pref("extensions.crossriderapp2258.2258.cookie._GPL_product_id.value", "%2221%22"); Deleted : user_pref("extensions.crossriderapp2258.2258.cookie._GPL_zoneid.expiration", "Fri Feb 01 2030 00:00:[...] Deleted : user_pref("extensions.crossriderapp2258.2258.cookie._GPL_zoneid.value", "%2236240%22"); Deleted : user_pref("extensions.crossriderapp2258.2258.cookie.dbtest.expiration", "Fri Feb 01 2030 00:00:00 GM[...] Deleted : user_pref("extensions.crossriderapp2258.2258.cookie.dbtest.value", "1346007302432"); Deleted : user_pref("extensions.crossriderapp2258.2258.description", "I Want This!"); Deleted : user_pref("extensions.crossriderapp2258.2258.domain", ""); Deleted : user_pref("extensions.crossriderapp2258.2258.emailsig", ""); Deleted : user_pref("extensions.crossriderapp2258.2258.enablesearch", false); Deleted : user_pref("extensions.crossriderapp2258.2258.exposesites", ""); Deleted : user_pref("extensions.crossriderapp2258.2258.fbremoteurl", ""); Deleted : user_pref("extensions.crossriderapp2258.2258.group", 0); Deleted : user_pref("extensions.crossriderapp2258.2258.homepage", ""); Deleted : user_pref("extensions.crossriderapp2258.2258.iframe", false); Deleted : user_pref("extensions.crossriderapp2258.2258.internaldb.Resources_appVer.expiration", "Fri Feb 01 20[...] Deleted : user_pref("extensions.crossriderapp2258.2258.internaldb.Resources_appVer.value", "91"); Deleted : user_pref("extensions.crossriderapp2258.2258.internaldb.Resources_lastVersion.expiration", "Fri Feb [...] Deleted : user_pref("extensions.crossriderapp2258.2258.internaldb.Resources_lastVersion.value", "0"); Deleted : user_pref("extensions.crossriderapp2258.2258.internaldb.Resources_meta.expiration", "Fri Feb 01 2030[...] Deleted : user_pref("extensions.crossriderapp2258.2258.internaldb.Resources_meta.value", "%7B%7D"); Deleted : user_pref("extensions.crossriderapp2258.2258.internaldb.Resources_nextCheck.expiration", "Mon Nov 12[...] Deleted : user_pref("extensions.crossriderapp2258.2258.internaldb.Resources_nextCheck.value", "true"); Deleted : user_pref("extensions.crossriderapp2258.2258.internaldb.Resources_queue.expiration", "Fri Feb 01 203[...] Deleted : user_pref("extensions.crossriderapp2258.2258.internaldb.Resources_queue.value", "%7B%7D"); Deleted : user_pref("extensions.crossriderapp2258.2258.js", "\n\nif(\"undefined\"!=typeof _GPL_PLUGIN){var _GP[...] Deleted : user_pref("extensions.crossriderapp2258.2258.manifesturl", ""); Deleted : user_pref("extensions.crossriderapp2258.2258.name", "I Want This"); Deleted : user_pref("extensions.crossriderapp2258.2258.newtab", ""); Deleted : user_pref("extensions.crossriderapp2258.2258.opensearch", ""); Deleted : user_pref("extensions.crossriderapp2258.2258.plugins.plugin_1000014.code", "Array.prototype.indexOf|[...] Deleted : user_pref("extensions.crossriderapp2258.2258.plugins.plugin_1000014.name", "GPL Plugin (Loader)"); Deleted : user_pref("extensions.crossriderapp2258.2258.plugins.plugin_1000014.ver", 7); Deleted : user_pref("extensions.crossriderapp2258.2258.plugins.plugin_1000015.code", "var _GPL_BG={vars:{},rul[...] Deleted : user_pref("extensions.crossriderapp2258.2258.plugins.plugin_1000015.name", "GPL Background (BG)"); Deleted : user_pref("extensions.crossriderapp2258.2258.plugins.plugin_1000015.ver", 4); Deleted : user_pref("extensions.crossriderapp2258.2258.plugins.plugin_13.code", "(function(a){a.selectedText=f[...] Deleted : user_pref("extensions.crossriderapp2258.2258.plugins.plugin_13.name", "CrossriderAppUtils"); Deleted : user_pref("extensions.crossriderapp2258.2258.plugins.plugin_13.ver", 2); Deleted : user_pref("extensions.crossriderapp2258.2258.plugins.plugin_14.code", "if(typeof(appAPI)===\"undefin[...] Deleted : user_pref("extensions.crossriderapp2258.2258.plugins.plugin_14.name", "CrossriderUtils"); Deleted : user_pref("extensions.crossriderapp2258.2258.plugins.plugin_14.ver", 2); Deleted : user_pref("extensions.crossriderapp2258.2258.plugins.plugin_15.code", "(function(e){function u(c,b){[...] Deleted : user_pref("extensions.crossriderapp2258.2258.plugins.plugin_15.name", "FacebookFFIE"); Deleted : user_pref("extensions.crossriderapp2258.2258.plugins.plugin_15.ver", 1); Deleted : user_pref("extensions.crossriderapp2258.2258.plugins.plugin_16.code", "(function(b,a){function h(){v[...] Deleted : user_pref("extensions.crossriderapp2258.2258.plugins.plugin_16.name", "FFAppAPIWrapper"); Deleted : user_pref("extensions.crossriderapp2258.2258.plugins.plugin_16.ver", 3); Deleted : user_pref("extensions.crossriderapp2258.2258.plugins.plugin_17.code", "if(typeof window!==\"undefine[...] Deleted : user_pref("extensions.crossriderapp2258.2258.plugins.plugin_17.name", "jQuery"); Deleted : user_pref("extensions.crossriderapp2258.2258.plugins.plugin_17.ver", 3); Deleted : user_pref("extensions.crossriderapp2258.2258.plugins.plugin_47.code", "(function(){appAPI.ready=func[...] Deleted : user_pref("extensions.crossriderapp2258.2258.plugins.plugin_47.name", "resources_background"); Deleted : user_pref("extensions.crossriderapp2258.2258.plugins.plugin_47.ver", 1); Deleted : user_pref("extensions.crossriderapp2258.2258.plugins_lists.plugins_0", "17,14,16,47,1000015"); Deleted : user_pref("extensions.crossriderapp2258.2258.plugins_lists.plugins_1", "17,14,13,16,15,1000014"); Deleted : user_pref("extensions.crossriderapp2258.2258.pluginsurl", "hxxp://app-static.crossrider.com/plugin/a[...] Deleted : user_pref("extensions.crossriderapp2258.2258.pluginsversion", 16); Deleted : user_pref("extensions.crossriderapp2258.2258.premium", true); Deleted : user_pref("extensions.crossriderapp2258.2258.publisher", "215 Apps"); Deleted : user_pref("extensions.crossriderapp2258.2258.searchstatus", 0); Deleted : user_pref("extensions.crossriderapp2258.2258.setnewtab", false); Deleted : user_pref("extensions.crossriderapp2258.2258.settingsurl", ""); Deleted : user_pref("extensions.crossriderapp2258.2258.thankyou", "hxxp://iw.antthis.com/thankyou.html"); Deleted : user_pref("extensions.crossriderapp2258.2258.updateinterval", 360); Deleted : user_pref("extensions.crossriderapp2258.2258.ver", 91); Deleted : user_pref("extensions.crossriderapp2258.73407340.InstallationTime", 1336955216); Deleted : user_pref("extensions.crossriderapp2258.73407340.backgroundjs", "\n\n\"undefined\"!=typeof _GPL_BG_N[...] Deleted : user_pref("extensions.crossriderapp2258.73407340.backgroundver", 15); Deleted : user_pref("extensions.crossriderapp2258.73407340.cookie.InstallationTime.expiration", "Fri Feb 01 20[...] Deleted : user_pref("extensions.crossriderapp2258.73407340.cookie.InstallationTime.value", "1336955216"); Deleted : user_pref("extensions.crossriderapp2258.73407340.js", "\n\nif(\"undefined\"!=typeof _GPL_PLUGIN){var[...] Deleted : user_pref("extensions.crossriderapp2258.73407340.plugins.plugin_1000014.code", "Array.prototype.inde[...] Deleted : user_pref("extensions.crossriderapp2258.73407340.plugins.plugin_1000014.name", "GPL Plugin (Loader)"[...] Deleted : user_pref("extensions.crossriderapp2258.73407340.plugins.plugin_1000014.ver", 7); Deleted : user_pref("extensions.crossriderapp2258.73407340.plugins.plugin_1000015.code", "var _GPL_BG={vars:{}[...] Deleted : user_pref("extensions.crossriderapp2258.73407340.plugins.plugin_1000015.name", "GPL Background (BG)"[...] Deleted : user_pref("extensions.crossriderapp2258.73407340.plugins.plugin_1000015.ver", 3); Deleted : user_pref("extensions.crossriderapp2258.73407340.plugins.plugin_13.code", "(function(a){a.selectedTe[...] Deleted : user_pref("extensions.crossriderapp2258.73407340.plugins.plugin_13.name", "CrossriderAppUtils"); Deleted : user_pref("extensions.crossriderapp2258.73407340.plugins.plugin_13.ver", 2); Deleted : user_pref("extensions.crossriderapp2258.73407340.plugins.plugin_14.code", "if(typeof(appAPI)===\"und[...] Deleted : user_pref("extensions.crossriderapp2258.73407340.plugins.plugin_14.name", "CrossriderUtils"); Deleted : user_pref("extensions.crossriderapp2258.73407340.plugins.plugin_14.ver", 2); Deleted : user_pref("extensions.crossriderapp2258.73407340.plugins.plugin_15.code", "(function(f){var u={};var[...] Deleted : user_pref("extensions.crossriderapp2258.73407340.plugins.plugin_15.name", "FacebookFFIE"); Deleted : user_pref("extensions.crossriderapp2258.73407340.plugins.plugin_15.ver", 1); Deleted : user_pref("extensions.crossriderapp2258.73407340.plugins.plugin_16.code", "(function(f,b){if(typeof([...] Deleted : user_pref("extensions.crossriderapp2258.73407340.plugins.plugin_16.name", "FFAppAPIWrapper"); Deleted : user_pref("extensions.crossriderapp2258.73407340.plugins.plugin_16.ver", 3); Deleted : user_pref("extensions.crossriderapp2258.73407340.plugins.plugin_17.code", "if(typeof window!==\"unde[...] Deleted : user_pref("extensions.crossriderapp2258.73407340.plugins.plugin_17.name", "jQuery"); Deleted : user_pref("extensions.crossriderapp2258.73407340.plugins.plugin_17.ver", 3); Deleted : user_pref("extensions.crossriderapp2258.73407340.plugins.plugin_47.code", "(function(){appAPI.ready=[...] Deleted : user_pref("extensions.crossriderapp2258.73407340.plugins.plugin_47.name", "resources_background"); Deleted : user_pref("extensions.crossriderapp2258.73407340.plugins.plugin_47.ver", 1); Deleted : user_pref("extensions.crossriderapp2258.73407340.plugins_lists.plugins_0", "17,14,16,47,1000015"); Deleted : user_pref("extensions.crossriderapp2258.73407340.plugins_lists.plugins_1", "17,14,13,16,15,1000014")[...] Deleted : user_pref("extensions.crossriderapp2258.73407340.pluginsversion", 15); Deleted : user_pref("extensions.crossriderapp2258.73407340.ver", 90); Deleted : user_pref("extensions.crossriderapp2258.adsOldValue", -1); Deleted : user_pref("extensions.crossriderapp2258.apps", "2258"); Deleted : user_pref("extensions.crossriderapp2258.bic", "13748bda268ac6b1a8020dccef660219"); Deleted : user_pref("extensions.crossriderapp2258.cid", 2258); Deleted : user_pref("extensions.crossriderapp2258.firstrun", false); Deleted : user_pref("extensions.crossriderapp2258.hadappinstalled", true); Deleted : user_pref("extensions.crossriderapp2258.installationdate", 1336955216); Deleted : user_pref("extensions.crossriderapp2258.lastcheck", 22545463); Deleted : user_pref("extensions.crossriderapp2258.lastcheckitem", 22545796); Deleted : user_pref("extensions.crossriderapp2258.misc.lastBgWorkerTimer", "1340768854793"); Deleted : user_pref("extensions.crossriderapp2258.misc.lastDomWorkerTimer", "1340768854784"); Deleted : user_pref("extensions.crossriderapp2258.modetype", "production"); Deleted : user_pref("extensions.enabledAddons", "{003e1c8f-ebd6-f074-7551-4b31c0f547ec}:1.300.430,{92044B07-01[...] Deleted : user_pref("freecause003e1c8febd6f07475514b31c0f547ec.AutoSearchEventData", "auto%20search"); Deleted : user_pref("freecause003e1c8febd6f07475514b31c0f547ec.ClearCacheDate", 12); Deleted : user_pref("freecause003e1c8febd6f07475514b31c0f547ec.DNSCatch", true); Deleted : user_pref("freecause003e1c8febd6f07475514b31c0f547ec.DisplayEULA", true); Deleted : user_pref("freecause003e1c8febd6f07475514b31c0f547ec.DnsCatchEventData", "dns%20catch"); Deleted : user_pref("freecause003e1c8febd6f07475514b31c0f547ec.EBOMode", true); Deleted : user_pref("freecause003e1c8febd6f07475514b31c0f547ec.FirstLaunchShown", true); Deleted : user_pref("freecause003e1c8febd6f07475514b31c0f547ec.InstallDomain", "freecause.com"); Deleted : user_pref("freecause003e1c8febd6f07475514b31c0f547ec.InstallType", "standard"); Deleted : user_pref("freecause003e1c8febd6f07475514b31c0f547ec.LoadLayoutDate.100770", 12); Deleted : user_pref("freecause003e1c8febd6f07475514b31c0f547ec.NewTabSearchEventData", "tab%20search"); Deleted : user_pref("freecause003e1c8febd6f07475514b31c0f547ec.ShowRecommendedOptions", true); Deleted : user_pref("freecause003e1c8febd6f07475514b31c0f547ec.StateReportDate", "1352684628633"); Deleted : user_pref("freecause003e1c8febd6f07475514b31c0f547ec.TopRightSearchEventData", "top%20right%20search[...] Deleted : user_pref("freecause003e1c8febd6f07475514b31c0f547ec.beforeInstallSaved", true); Deleted : user_pref("freecause003e1c8febd6f07475514b31c0f547ec.beforeinstall.homepage", "hxxp%3A//www.yahoo.co[...] Deleted : user_pref("freecause003e1c8febd6f07475514b31c0f547ec.beforeinstall.search", "Blekko"); Deleted : user_pref("freecause003e1c8febd6f07475514b31c0f547ec.customNewTab", true); Deleted : user_pref("freecause003e1c8febd6f07475514b31c0f547ec.helpUsImprove", true); Deleted : user_pref("freecause003e1c8febd6f07475514b31c0f547ec.hideOthers", true); Deleted : user_pref("freecause003e1c8febd6f07475514b31c0f547ec.partnerauth", false); Deleted : user_pref("freecause003e1c8febd6f07475514b31c0f547ec.processAddrBar", true); Deleted : user_pref("freecause003e1c8febd6f07475514b31c0f547ec.restoreSearch", false); Deleted : user_pref("freecause003e1c8febd6f07475514b31c0f547ec.runcmd.", "bb_acct_status_1352747172"); Deleted : user_pref("freecause003e1c8febd6f07475514b31c0f547ec.searchHistory", true); Deleted : user_pref("freecause003e1c8febd6f07475514b31c0f547ec.session", "DF7926955FE486B24D144F72842373B5D331[...] Deleted : user_pref("freecause003e1c8febd6f07475514b31c0f547ec.showFirstLaunchOptions", false); Deleted : user_pref("freecause003e1c8febd6f07475514b31c0f547ec.tb_lang", "en"); Deleted : user_pref("freecause003e1c8febd6f07475514b31c0f547ec.tool_id", "100770"); Deleted : user_pref("freecause003e1c8febd6f07475514b31c0f547ec.user_id", "111598052"); Deleted : user_pref("freecause003e1c8febd6f07475514b31c0f547ec.user_key", "53c5828dc535eb14c1acb246d3f21dbcb46[...] Deleted : user_pref("freecause003e1c8febd6f07475514b31c0f547ec.user_layouts", "100770"); Deleted : user_pref("freecause003e1c8febd6f07475514b31c0f547ec.user_lnames", "fcreward.100770.b"); Deleted : user_pref("freecause003e1c8febd6f07475514b31c0f547ec.xml_service_url", "6bb94bbf55fe2f255901a560824a[...] Deleted : user_pref("freecause003e1c8febd6f07475514b31c0f547ec.yahooSearch", true); Deleted : user_pref("keyword.URL", "hxxp://blekko.com/ws/?source={SourceID}&tbp=url&toolbarid=blekkotb_soc&u=U[...] -\\ Google Chrome v [unable to get version] File : C:\Users\John Schultz\AppData\Local\Google\Chrome\User Data\Default\Preferences Deleted [l.9] : homepage = "hxxps://isearch.avg.com/?cid={A2C6BF1A-EA02-4D41-A198-4B926F88585B}&mid=cbb57769766e416890bc23c7fea7ca6f-459f19ff00d8727367d7de2ea512bd5c953ae3e0〈=en&ds=hk014&pr=sa&d=2012-07-29 16:22:40&v=12.1.0.21&sap=hp", Deleted [l.13] : urls_to_restore_on_startup = [ "hxxps://isearch.avg.com/?cid={A2C6BF1A-EA02-4D41-A198-4B926F88585B}&mid=cbb57769766e416890bc23c7fea7ca6f-459f19ff00d8727367d7de2ea512bd5c953ae3e0〈=en&ds=hk014&pr=sa&d=2012-07-29 16:22:40&v=12.1.0.21&sap=hp" ] Deleted [l.566] : homepage = "hxxps://isearch.avg.com/?cid={A2C6BF1A-EA02-4D41-A198-4B926F88585B}&mid=cbb57769766e416890bc23c7fea7ca6f-459f19ff00d8727367d7de2ea512bd5c953ae3e0〈=en&ds=hk014&pr=sa&d=2012-07-29 16:22:40&v=12.1.0.21&sap=hp", Deleted [l.829] : urls_to_restore_on_startup = [ "hxxps://isearch.avg.com/?cid={A2C6BF1A-EA02-4D41-A198-4B926F88585B}&mid=cbb57769766e416890bc23c7fea7ca6f-459f19ff00d8727367d7de2ea512bd5c953ae3e0〈=en&ds=hk014&pr=sa&d=2012-07-29 16:22:40&v=12.1.0.21&sap=hp" ] ************************* AdwCleaner[R1].txt - [25798 octets] - [12/11/2012 14:09:40] AdwCleaner[R2].txt - [25859 octets] - [12/11/2012 14:16:44] AdwCleaner[R3].txt - [25920 octets] - [12/11/2012 14:21:53] AdwCleaner[s1].txt - [25852 octets] - [12/11/2012 14:22:12] ########## EOF - C:\AdwCleaner[s1].txt - [25913 octets] ##########

Here is the AdwCleaner log file: # AdwCleaner v2.007 - Logfile created 11/12/2012 at 14:16:44 # Updated 06/11/2012 by Xplode # Operating system : Windows Vista Home Premium Service Pack 2 (64 bits) # User : John Schultz - JOHNSCHULTZ-PC # Boot Mode : Normal # Running from : C:\Users\John Schultz\Desktop\adwcleaner.exe # Option [search] ***** [services] ***** ***** [Files / Folders] ***** File Found : C:\Program Files (x86)\Mozilla Firefox\searchplugins\avg-secure-search.xml Folder Found : C:\Program Files (x86)\AVG Secure Search Folder Found : C:\Program Files (x86)\Common Files\AVG Secure Search Folder Found : C:\ProgramData\AVG Secure Search Folder Found : C:\ProgramData\blekko toolbars Folder Found : C:\Users\John Schultz\AppData\Local\AVG Secure Search Folder Found : C:\Users\John Schultz\AppData\Local\Google\Chrome\User Data\Default\databases\chrome-extension_mpfapcdfbbledbojijcbcclmlieaoogk_0 Folder Found : C:\Users\John Schultz\AppData\LocalLow\AVG Secure Search Folder Found : C:\Users\John Schultz\AppData\Roaming\Mozilla\Firefox\Profiles\9vdxx2kv.default\extensions\crossriderapp2258@crossrider.com Folder Found : C:\Users\John Schultz\AppData\Roaming\Mozilla\Firefox\Profiles\9vdxx2kv.default\FCTB Folder Found : C:\Users\JOHNSC~1\AppData\Local\Temp\avg@toolbar ***** [Registry] ***** Key Found : HKCU\Software\AppDataLow\Software\Crossrider Key Found : HKCU\Software\AppDataLow\Software\I Want This Key Found : HKCU\Software\AVG Secure Search Key Found : HKCU\Software\Conduit Key Found : HKCU\Software\Cr_Installer Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\AVG Secure Search Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\I Want This Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{95B7759C-8C7F-4BF1-B163-73684A933233} Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{95B7759C-8C7F-4BF1-B163-73684A933233} Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{F25AF245-4A81-40DC-92F9-E9021F207706} Key Found : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{3BD44F0E-0596-4008-AEE0-45D47E3A8F0E} Key Found : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{95B7759C-8C7F-4BF1-B163-73684A933233} Key Found : HKLM\Software\AVG Secure Search Key Found : HKLM\SOFTWARE\Classes\AppID\{1FDFF5A2-7BB1-48E1-8081-7236812B12B2} Key Found : HKLM\SOFTWARE\Classes\AppID\{BB711CB0-C70B-482E-9852-EC05EBD71DBB} Key Found : HKLM\SOFTWARE\Classes\AppID\ScriptHelper.EXE Key Found : HKLM\SOFTWARE\Classes\AppID\ViProtocol.DLL Key Found : HKLM\SOFTWARE\Classes\AVG Secure Search.BrowserWndAPI Key Found : HKLM\SOFTWARE\Classes\AVG Secure Search.BrowserWndAPI.1 Key Found : HKLM\SOFTWARE\Classes\AVG Secure Search.PugiObj Key Found : HKLM\SOFTWARE\Classes\AVG Secure Search.PugiObj.1 Key Found : HKLM\SOFTWARE\Classes\PROTOCOLS\Handler\viprotocol Key Found : HKLM\SOFTWARE\Classes\S Key Found : HKLM\SOFTWARE\Classes\ScriptHelper.ScriptHelperApi Key Found : HKLM\SOFTWARE\Classes\ScriptHelper.ScriptHelperApi.1 Key Found : HKLM\SOFTWARE\Classes\TypeLib\{74FB6AFD-DD77-4CEB-83BD-AB2B63E63C93} Key Found : HKLM\SOFTWARE\Classes\TypeLib\{9C049BA6-EA47-4AC3-AED6-A66D8DC9E1D8} Key Found : HKLM\SOFTWARE\Classes\TypeLib\{C2AC8A0E-E48E-484B-A71C-C7A937FAAB94} Key Found : HKLM\SOFTWARE\Classes\ViProtocol.ViProtocolOLE Key Found : HKLM\SOFTWARE\Classes\ViProtocol.ViProtocolOLE.1 Key Found : HKLM\Software\Conduit Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{C6FDD0C3-266A-4DC3-B459-28C697C44CDC} Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{F25AF245-4A81-40DC-92F9-E9021F207706} Key Found : HKLM\SOFTWARE\MozillaPlugins\@avg.com/AVG SiteSafety plugin,version=11.0.0.1,application/x-avg-sitesafety-plugin Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{4E92DB5F-AAD9-49D3-8EAB-B40CBE5B1FF7} Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{95B7759C-8C7F-4BF1-B163-73684A933233} Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{B658800C-F66E-4EF3-AB85-6C0C227862A9} Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39} Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{F25AF245-4A81-40DC-92F9-E9021F207706} Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{03E2A1F3-4402-4121-8B35-733216D61217} Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{4E92DB5F-AAD9-49D3-8EAB-B40CBE5B1FF7} Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{9E3B11F6-4179-4603-A71B-A55F4BCB0BEC} Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{C401D2CE-DC27-45C7-BC0C-8E6EA7F085D6} Key Found : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39} Key Found : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{F25AF245-4A81-40DC-92F9-E9021F207706} Key Found : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{95B7759C-8C7F-4BF1-B163-73684A933233} Key Found : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\AVG Secure Search Key Found : HKLM\SOFTWARE\Classes\CLSID\{F25AF245-4A81-40DC-92F9-E9021F207706} Key Found : HKLM\SOFTWARE\Classes\Interface\{03E2A1F3-4402-4121-8B35-733216D61217} Key Found : HKLM\SOFTWARE\Classes\Interface\{4E92DB5F-AAD9-49D3-8EAB-B40CBE5B1FF7} Key Found : HKLM\SOFTWARE\Classes\Interface\{9E3B11F6-4179-4603-A71B-A55F4BCB0BEC} Key Found : HKLM\SOFTWARE\Classes\Interface\{C401D2CE-DC27-45C7-BC0C-8E6EA7F085D6} Key Found : HKU\S-1-5-21-2005839633-3723987899-1263698059-1000\Software\Microsoft\Internet Explorer\SearchScopes\{3BD44F0E-0596-4008-AEE0-45D47E3A8F0E} Key Found : HKU\S-1-5-21-2005839633-3723987899-1263698059-1000\Software\Microsoft\Internet Explorer\SearchScopes\{95B7759C-8C7F-4BF1-B163-73684A933233} Value Found : HKCU\Software\Microsoft\Internet Explorer\New Windows\Allow [*.crossrider.com] Value Found : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39}] Value Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\New Windows\Allow [*.crossrider.com] Value Found : HKLM\SOFTWARE\Mozilla\Firefox\Extensions [Avg@toolbar] Value Found : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar [{95B7759C-8C7F-4BF1-B163-73684A933233}] ***** [internet Browsers] ***** -\\ Internet Explorer v9.0.8112.16421 [HKCU\Software\Microsoft\Internet Explorer\Main - Start Page] = hxxps://isearch.avg.com/?cid={A2C6BF1A-EA02-4D41-A198-4B926F88585B}&mid=cbb57769766e416890bc23c7fea7ca6f-459f19ff00d8727367d7de2ea512bd5c953ae3e0〈=en&ds=hk014&pr=sa&d=2012-07-29 16:22:40&v=12.1.0.21&sap=hp -\\ Mozilla Firefox v16.0.2 (en-US) Profile name : default File : C:\Users\John Schultz\AppData\Roaming\Mozilla\Firefox\Profiles\9vdxx2kv.default\prefs.js Found : user_pref("browser.search.defaultenginename", "AVG Secure Search"); Found : user_pref("browser.search.order.1", "Blekko"); Found : user_pref("browser.search.selectedEngine", "AVG Secure Search"); Found : user_pref("extensions.crossriderapp2258.2258.InstallationThankYouPage", true); Found : user_pref("extensions.crossriderapp2258.2258.InstallationTime", 1336955183); Found : user_pref("extensions.crossriderapp2258.2258.InstallationUserSettings.searchUserConifrmation", false[...] Found : user_pref("extensions.crossriderapp2258.2258.InstallationUserSettings.setHomepage", false); Found : user_pref("extensions.crossriderapp2258.2258.InstallationUserSettings.setNewTab", false); Found : user_pref("extensions.crossriderapp2258.2258.InstallationUserSettings.setSearch", false); Found : user_pref("extensions.crossriderapp2258.2258.active", true); Found : user_pref("extensions.crossriderapp2258.2258.addressbar", ""); Found : user_pref("extensions.crossriderapp2258.2258.affid", "0"); Found : user_pref("extensions.crossriderapp2258.2258.backgroundjs", "\n\n\"undefined\"!=typeof _GPL_BG_NEW&&[...] Found : user_pref("extensions.crossriderapp2258.2258.backgroundver", 16); Found : user_pref("extensions.crossriderapp2258.2258.can_run_bg_code", true); Found : user_pref("extensions.crossriderapp2258.2258.certdomaininstaller", ""); Found : user_pref("extensions.crossriderapp2258.2258.changeprevious", false); Found : user_pref("extensions.crossriderapp2258.2258.cookie.InstallationTime.expiration", "Fri Feb 01 2030 0[...] Found : user_pref("extensions.crossriderapp2258.2258.cookie.InstallationTime.value", "1336955183"); Found : user_pref("extensions.crossriderapp2258.2258.cookie.InstallerParams.expiration", "Fri Feb 01 2030 00[...] Found : user_pref("extensions.crossriderapp2258.2258.cookie._GPL_aoi.expiration", "Fri Feb 01 2030 00:00:00 [...] Found : user_pref("extensions.crossriderapp2258.2258.cookie._GPL_aoi.value", "1336955183"); Found : user_pref("extensions.crossriderapp2258.2258.cookie._GPL_blocklist.expiration", "Mon Nov 12 2012 14:[...] Found : user_pref("extensions.crossriderapp2258.2258.cookie._GPL_blocklist.value", "%22nonexistantdomain.com[...] Found : user_pref("extensions.crossriderapp2258.2258.cookie._GPL_country_code.expiration", "Tue Nov 13 2012 [...] Found : user_pref("extensions.crossriderapp2258.2258.cookie._GPL_country_code.value", "%22US%22"); Found : user_pref("extensions.crossriderapp2258.2258.cookie._GPL_crr.expiration", "Fri Feb 01 2030 00:00:00 [...] Found : user_pref("extensions.crossriderapp2258.2258.cookie._GPL_crr.value", "1352747723"); Found : user_pref("extensions.crossriderapp2258.2258.cookie._GPL_hotfix20111102645.expiration", "Fri Feb 01 [...] Found : user_pref("extensions.crossriderapp2258.2258.cookie._GPL_hotfix20111102645.value", "%221%22"); Found : user_pref("extensions.crossriderapp2258.2258.cookie._GPL_installer_params.expiration", "Fri Feb 01 2[...] Found : user_pref("extensions.crossriderapp2258.2258.cookie._GPL_installer_params.value", "%7B%22source_id%2[...] Found : user_pref("extensions.crossriderapp2258.2258.cookie._GPL_parent_zoneid.expiration", "Fri Feb 01 2030[...] Found : user_pref("extensions.crossriderapp2258.2258.cookie._GPL_parent_zoneid.value", "%2214019%22"); Found : user_pref("extensions.crossriderapp2258.2258.cookie._GPL_pc_20120828.expiration", "Fri Feb 01 2030 0[...] Found : user_pref("extensions.crossriderapp2258.2258.cookie._GPL_pc_20120828.value", "1346204276819"); Found : user_pref("extensions.crossriderapp2258.2258.cookie._GPL_product_id.expiration", "Fri Feb 01 2030 00[...] Found : user_pref("extensions.crossriderapp2258.2258.cookie._GPL_product_id.value", "%2221%22"); Found : user_pref("extensions.crossriderapp2258.2258.cookie._GPL_zoneid.expiration", "Fri Feb 01 2030 00:00:[...] Found : user_pref("extensions.crossriderapp2258.2258.cookie._GPL_zoneid.value", "%2236240%22"); Found : user_pref("extensions.crossriderapp2258.2258.cookie.dbtest.expiration", "Fri Feb 01 2030 00:00:00 GM[...] Found : user_pref("extensions.crossriderapp2258.2258.cookie.dbtest.value", "1346007302432"); Found : user_pref("extensions.crossriderapp2258.2258.description", "I Want This!"); Found : user_pref("extensions.crossriderapp2258.2258.domain", ""); Found : user_pref("extensions.crossriderapp2258.2258.emailsig", ""); Found : user_pref("extensions.crossriderapp2258.2258.enablesearch", false); Found : user_pref("extensions.crossriderapp2258.2258.exposesites", ""); Found : user_pref("extensions.crossriderapp2258.2258.fbremoteurl", ""); Found : user_pref("extensions.crossriderapp2258.2258.group", 0); Found : user_pref("extensions.crossriderapp2258.2258.homepage", ""); Found : user_pref("extensions.crossriderapp2258.2258.iframe", false); Found : user_pref("extensions.crossriderapp2258.2258.internaldb.Resources_appVer.expiration", "Fri Feb 01 20[...] Found : user_pref("extensions.crossriderapp2258.2258.internaldb.Resources_appVer.value", "91"); Found : user_pref("extensions.crossriderapp2258.2258.internaldb.Resources_lastVersion.expiration", "Fri Feb [...] Found : user_pref("extensions.crossriderapp2258.2258.internaldb.Resources_lastVersion.value", "0"); Found : user_pref("extensions.crossriderapp2258.2258.internaldb.Resources_meta.expiration", "Fri Feb 01 2030[...] Found : user_pref("extensions.crossriderapp2258.2258.internaldb.Resources_meta.value", "%7B%7D"); Found : user_pref("extensions.crossriderapp2258.2258.internaldb.Resources_nextCheck.expiration", "Mon Nov 12[...] Found : user_pref("extensions.crossriderapp2258.2258.internaldb.Resources_nextCheck.value", "true"); Found : user_pref("extensions.crossriderapp2258.2258.internaldb.Resources_queue.expiration", "Fri Feb 01 203[...] Found : user_pref("extensions.crossriderapp2258.2258.internaldb.Resources_queue.value", "%7B%7D"); Found : user_pref("extensions.crossriderapp2258.2258.js", "\n\nif(\"undefined\"!=typeof _GPL_PLUGIN){var _GP[...] Found : user_pref("extensions.crossriderapp2258.2258.manifesturl", ""); Found : user_pref("extensions.crossriderapp2258.2258.name", "I Want This"); Found : user_pref("extensions.crossriderapp2258.2258.newtab", ""); Found : user_pref("extensions.crossriderapp2258.2258.opensearch", ""); Found : user_pref("extensions.crossriderapp2258.2258.plugins.plugin_1000014.code", "Array.prototype.indexOf|[...] Found : user_pref("extensions.crossriderapp2258.2258.plugins.plugin_1000014.name", "GPL Plugin (Loader)"); Found : user_pref("extensions.crossriderapp2258.2258.plugins.plugin_1000014.ver", 7); Found : user_pref("extensions.crossriderapp2258.2258.plugins.plugin_1000015.code", "var _GPL_BG={vars:{},rul[...] Found : user_pref("extensions.crossriderapp2258.2258.plugins.plugin_1000015.name", "GPL Background (BG)"); Found : user_pref("extensions.crossriderapp2258.2258.plugins.plugin_1000015.ver", 4); Found : user_pref("extensions.crossriderapp2258.2258.plugins.plugin_13.code", "(function(a){a.selectedText=f[...] Found : user_pref("extensions.crossriderapp2258.2258.plugins.plugin_13.name", "CrossriderAppUtils"); Found : user_pref("extensions.crossriderapp2258.2258.plugins.plugin_13.ver", 2); Found : user_pref("extensions.crossriderapp2258.2258.plugins.plugin_14.code", "if(typeof(appAPI)===\"undefin[...] Found : user_pref("extensions.crossriderapp2258.2258.plugins.plugin_14.name", "CrossriderUtils"); Found : user_pref("extensions.crossriderapp2258.2258.plugins.plugin_14.ver", 2); Found : user_pref("extensions.crossriderapp2258.2258.plugins.plugin_15.code", "(function(e){function u(c,b){[...] Found : user_pref("extensions.crossriderapp2258.2258.plugins.plugin_15.name", "FacebookFFIE"); Found : user_pref("extensions.crossriderapp2258.2258.plugins.plugin_15.ver", 1); Found : user_pref("extensions.crossriderapp2258.2258.plugins.plugin_16.code", "(function(b,a){function h(){v[...] Found : user_pref("extensions.crossriderapp2258.2258.plugins.plugin_16.name", "FFAppAPIWrapper"); Found : user_pref("extensions.crossriderapp2258.2258.plugins.plugin_16.ver", 3); Found : user_pref("extensions.crossriderapp2258.2258.plugins.plugin_17.code", "if(typeof window!==\"undefine[...] Found : user_pref("extensions.crossriderapp2258.2258.plugins.plugin_17.name", "jQuery"); Found : user_pref("extensions.crossriderapp2258.2258.plugins.plugin_17.ver", 3); Found : user_pref("extensions.crossriderapp2258.2258.plugins.plugin_47.code", "(function(){appAPI.ready=func[...] Found : user_pref("extensions.crossriderapp2258.2258.plugins.plugin_47.name", "resources_background"); Found : user_pref("extensions.crossriderapp2258.2258.plugins.plugin_47.ver", 1); Found : user_pref("extensions.crossriderapp2258.2258.plugins_lists.plugins_0", "17,14,16,47,1000015"); Found : user_pref("extensions.crossriderapp2258.2258.plugins_lists.plugins_1", "17,14,13,16,15,1000014"); Found : user_pref("extensions.crossriderapp2258.2258.pluginsurl", "hxxp://app-static.crossrider.com/plugin/a[...] Found : user_pref("extensions.crossriderapp2258.2258.pluginsversion", 16); Found : user_pref("extensions.crossriderapp2258.2258.premium", true); Found : user_pref("extensions.crossriderapp2258.2258.publisher", "215 Apps"); Found : user_pref("extensions.crossriderapp2258.2258.searchstatus", 0); Found : user_pref("extensions.crossriderapp2258.2258.setnewtab", false); Found : user_pref("extensions.crossriderapp2258.2258.settingsurl", ""); Found : user_pref("extensions.crossriderapp2258.2258.thankyou", "hxxp://iw.antthis.com/thankyou.html"); Found : user_pref("extensions.crossriderapp2258.2258.updateinterval", 360); Found : user_pref("extensions.crossriderapp2258.2258.ver", 91); Found : user_pref("extensions.crossriderapp2258.73407340.InstallationTime", 1336955216); Found : user_pref("extensions.crossriderapp2258.73407340.backgroundjs", "\n\n\"undefined\"!=typeof _GPL_BG_N[...] Found : user_pref("extensions.crossriderapp2258.73407340.backgroundver", 15); Found : user_pref("extensions.crossriderapp2258.73407340.cookie.InstallationTime.expiration", "Fri Feb 01 20[...] Found : user_pref("extensions.crossriderapp2258.73407340.cookie.InstallationTime.value", "1336955216"); Found : user_pref("extensions.crossriderapp2258.73407340.js", "\n\nif(\"undefined\"!=typeof _GPL_PLUGIN){var[...] Found : user_pref("extensions.crossriderapp2258.73407340.plugins.plugin_1000014.code", "Array.prototype.inde[...] Found : user_pref("extensions.crossriderapp2258.73407340.plugins.plugin_1000014.name", "GPL Plugin (Loader)"[...] Found : user_pref("extensions.crossriderapp2258.73407340.plugins.plugin_1000014.ver", 7); Found : user_pref("extensions.crossriderapp2258.73407340.plugins.plugin_1000015.code", "var _GPL_BG={vars:{}[...] Found : user_pref("extensions.crossriderapp2258.73407340.plugins.plugin_1000015.name", "GPL Background (BG)"[...] Found : user_pref("extensions.crossriderapp2258.73407340.plugins.plugin_1000015.ver", 3); Found : user_pref("extensions.crossriderapp2258.73407340.plugins.plugin_13.code", "(function(a){a.selectedTe[...] Found : user_pref("extensions.crossriderapp2258.73407340.plugins.plugin_13.name", "CrossriderAppUtils"); Found : user_pref("extensions.crossriderapp2258.73407340.plugins.plugin_13.ver", 2); Found : user_pref("extensions.crossriderapp2258.73407340.plugins.plugin_14.code", "if(typeof(appAPI)===\"und[...] Found : user_pref("extensions.crossriderapp2258.73407340.plugins.plugin_14.name", "CrossriderUtils"); Found : user_pref("extensions.crossriderapp2258.73407340.plugins.plugin_14.ver", 2); Found : user_pref("extensions.crossriderapp2258.73407340.plugins.plugin_15.code", "(function(f){var u={};var[...] Found : user_pref("extensions.crossriderapp2258.73407340.plugins.plugin_15.name", "FacebookFFIE"); Found : user_pref("extensions.crossriderapp2258.73407340.plugins.plugin_15.ver", 1); Found : user_pref("extensions.crossriderapp2258.73407340.plugins.plugin_16.code", "(function(f,b){if(typeof([...] Found : user_pref("extensions.crossriderapp2258.73407340.plugins.plugin_16.name", "FFAppAPIWrapper"); Found : user_pref("extensions.crossriderapp2258.73407340.plugins.plugin_16.ver", 3); Found : user_pref("extensions.crossriderapp2258.73407340.plugins.plugin_17.code", "if(typeof window!==\"unde[...] Found : user_pref("extensions.crossriderapp2258.73407340.plugins.plugin_17.name", "jQuery"); Found : user_pref("extensions.crossriderapp2258.73407340.plugins.plugin_17.ver", 3); Found : user_pref("extensions.crossriderapp2258.73407340.plugins.plugin_47.code", "(function(){appAPI.ready=[...] Found : user_pref("extensions.crossriderapp2258.73407340.plugins.plugin_47.name", "resources_background"); Found : user_pref("extensions.crossriderapp2258.73407340.plugins.plugin_47.ver", 1); Found : user_pref("extensions.crossriderapp2258.73407340.plugins_lists.plugins_0", "17,14,16,47,1000015"); Found : user_pref("extensions.crossriderapp2258.73407340.plugins_lists.plugins_1", "17,14,13,16,15,1000014")[...] Found : user_pref("extensions.crossriderapp2258.73407340.pluginsversion", 15); Found : user_pref("extensions.crossriderapp2258.73407340.ver", 90); Found : user_pref("extensions.crossriderapp2258.adsOldValue", -1); Found : user_pref("extensions.crossriderapp2258.apps", "2258"); Found : user_pref("extensions.crossriderapp2258.bic", "13748bda268ac6b1a8020dccef660219"); Found : user_pref("extensions.crossriderapp2258.cid", 2258); Found : user_pref("extensions.crossriderapp2258.firstrun", false); Found : user_pref("extensions.crossriderapp2258.hadappinstalled", true); Found : user_pref("extensions.crossriderapp2258.installationdate", 1336955216); Found : user_pref("extensions.crossriderapp2258.lastcheck", 22545463); Found : user_pref("extensions.crossriderapp2258.lastcheckitem", 22545796); Found : user_pref("extensions.crossriderapp2258.misc.lastBgWorkerTimer", "1340768854793"); Found : user_pref("extensions.crossriderapp2258.misc.lastDomWorkerTimer", "1340768854784"); Found : user_pref("extensions.crossriderapp2258.modetype", "production"); Found : user_pref("extensions.enabledAddons", "{003e1c8f-ebd6-f074-7551-4b31c0f547ec}:1.300.430,{92044B07-01[...] Found : user_pref("freecause003e1c8febd6f07475514b31c0f547ec.AutoSearchEventData", "auto%20search"); Found : user_pref("freecause003e1c8febd6f07475514b31c0f547ec.ClearCacheDate", 12); Found : user_pref("freecause003e1c8febd6f07475514b31c0f547ec.DNSCatch", true); Found : user_pref("freecause003e1c8febd6f07475514b31c0f547ec.DisplayEULA", true); Found : user_pref("freecause003e1c8febd6f07475514b31c0f547ec.DnsCatchEventData", "dns%20catch"); Found : user_pref("freecause003e1c8febd6f07475514b31c0f547ec.EBOMode", true); Found : user_pref("freecause003e1c8febd6f07475514b31c0f547ec.FirstLaunchShown", true); Found : user_pref("freecause003e1c8febd6f07475514b31c0f547ec.InstallDomain", "freecause.com"); Found : user_pref("freecause003e1c8febd6f07475514b31c0f547ec.InstallType", "standard"); Found : user_pref("freecause003e1c8febd6f07475514b31c0f547ec.LoadLayoutDate.100770", 12); Found : user_pref("freecause003e1c8febd6f07475514b31c0f547ec.NewTabSearchEventData", "tab%20search"); Found : user_pref("freecause003e1c8febd6f07475514b31c0f547ec.ShowRecommendedOptions", true); Found : user_pref("freecause003e1c8febd6f07475514b31c0f547ec.StateReportDate", "1352684628633"); Found : user_pref("freecause003e1c8febd6f07475514b31c0f547ec.TopRightSearchEventData", "top%20right%20search[...] Found : user_pref("freecause003e1c8febd6f07475514b31c0f547ec.beforeInstallSaved", true); Found : user_pref("freecause003e1c8febd6f07475514b31c0f547ec.beforeinstall.homepage", "hxxp%3A//www.yahoo.co[...] Found : user_pref("freecause003e1c8febd6f07475514b31c0f547ec.beforeinstall.search", "Blekko"); Found : user_pref("freecause003e1c8febd6f07475514b31c0f547ec.customNewTab", true); Found : user_pref("freecause003e1c8febd6f07475514b31c0f547ec.helpUsImprove", true); Found : user_pref("freecause003e1c8febd6f07475514b31c0f547ec.hideOthers", true); Found : user_pref("freecause003e1c8febd6f07475514b31c0f547ec.partnerauth", false); Found : user_pref("freecause003e1c8febd6f07475514b31c0f547ec.processAddrBar", true); Found : user_pref("freecause003e1c8febd6f07475514b31c0f547ec.restoreSearch", false); Found : user_pref("freecause003e1c8febd6f07475514b31c0f547ec.runcmd.", "bb_acct_status_1352747172"); Found : user_pref("freecause003e1c8febd6f07475514b31c0f547ec.searchHistory", true); Found : user_pref("freecause003e1c8febd6f07475514b31c0f547ec.session", "DF7926955FE486B24D144F72842373B5D331[...] Found : user_pref("freecause003e1c8febd6f07475514b31c0f547ec.showFirstLaunchOptions", false); Found : user_pref("freecause003e1c8febd6f07475514b31c0f547ec.tb_lang", "en"); Found : user_pref("freecause003e1c8febd6f07475514b31c0f547ec.tool_id", "100770"); Found : user_pref("freecause003e1c8febd6f07475514b31c0f547ec.user_id", "111598052"); Found : user_pref("freecause003e1c8febd6f07475514b31c0f547ec.user_key", "53c5828dc535eb14c1acb246d3f21dbcb46[...] Found : user_pref("freecause003e1c8febd6f07475514b31c0f547ec.user_layouts", "100770"); Found : user_pref("freecause003e1c8febd6f07475514b31c0f547ec.user_lnames", "fcreward.100770.b"); Found : user_pref("freecause003e1c8febd6f07475514b31c0f547ec.xml_service_url", "6bb94bbf55fe2f255901a560824a[...] Found : user_pref("freecause003e1c8febd6f07475514b31c0f547ec.yahooSearch", true); Found : user_pref("keyword.URL", "hxxp://blekko.com/ws/?source={SourceID}&tbp=url&toolbarid=blekkotb_soc&u=U[...] -\\ Google Chrome v [unable to get version] File : C:\Users\John Schultz\AppData\Local\Google\Chrome\User Data\Default\Preferences Found [l.9] : homepage = "hxxps://isearch.avg.com/?cid={A2C6BF1A-EA02-4D41-A198-4B926F88585B}&mid=cbb57769766e416890bc23c7fea7ca6f-459f19ff00d8727367d7de2ea512bd5c953ae3e0〈=en&ds=hk014&pr=sa&d=2012-07-29 16:22:40&v=12.1.0.21&sap=hp", Found [l.13] : urls_to_restore_on_startup = [ "hxxps://isearch.avg.com/?cid={A2C6BF1A-EA02-4D41-A198-4B926F88585B}&mid=cbb57769766e416890bc23c7fea7ca6f-459f19ff00d8727367d7de2ea512bd5c953ae3e0〈=en&ds=hk014&pr=sa&d=2012-07-29 16:22:40&v=12.1.0.21&sap=hp" ] Found [l.566] : homepage = "hxxps://isearch.avg.com/?cid={A2C6BF1A-EA02-4D41-A198-4B926F88585B}&mid=cbb57769766e416890bc23c7fea7ca6f-459f19ff00d8727367d7de2ea512bd5c953ae3e0〈=en&ds=hk014&pr=sa&d=2012-07-29 16:22:40&v=12.1.0.21&sap=hp", Found [l.829] : urls_to_restore_on_startup = [ "hxxps://isearch.avg.com/?cid={A2C6BF1A-EA02-4D41-A198-4B926F88585B}&mid=cbb57769766e416890bc23c7fea7ca6f-459f19ff00d8727367d7de2ea512bd5c953ae3e0〈=en&ds=hk014&pr=sa&d=2012-07-29 16:22:40&v=12.1.0.21&sap=hp" ] ************************* AdwCleaner[R1].txt - [25798 octets] - [12/11/2012 14:09:40] AdwCleaner[R2].txt - [25742 octets] - [12/11/2012 14:16:44] ########## EOF - C:\AdwCleaner[R2].txt - [25803 octets] ##########

Ok all done as requested, it appears that there was more than I had expected, the svchost is now gone on startup, anything else you want to do? First Log from MBAR: Malwarebytes Anti-Rootkit 1.1.0.1009 www.malwarebytes.org Database version: v2012.11.12.04 Windows Vista Service Pack 2 x64 NTFS Internet Explorer 9.0.8112.16421 John Schultz :: JOHN-PC [administrator] 11/12/2012 10:43:41 AM mbar-log-2012-11-12 (10-43-41).txt Scan type: Quick scan Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken Scan options disabled: PUP | PUM | P2P Objects scanned: 27107 Time elapsed: 21 minute(s), 41 second(s) Memory Processes Detected: 1 C:\Windows\svchost.exe (Trojan.Agent) -> 7036 -> Delete on reboot. [cbd024914f0e71c515956c1005fd9f61] Memory Modules Detected: 0 (No malicious items detected) Registry Keys Detected: 0 (No malicious items detected) Registry Values Detected: 0 (No malicious items detected) Registry Data Items Detected: 0 (No malicious items detected) Folders Detected: 0 (No malicious items detected) Files Detected: 9 C:\ProgramData\Malwarebytes\Malwarebytes' Anti-Malware\Bootstrap_0_0_29_infected.mbam (Rootkit.Pihar.c.MBR) -> Delete on reboot. [5ba961d04ba8753d2e3203c50ebafdfc] C:\ProgramData\Malwarebytes\Malwarebytes' Anti-Malware\MBR_0_infected.mbam (Rootkit.Pihar.c.MBR) -> Delete on reboot. [cdfc5d12e6f2d4e1921044ebfbc03da9] C:\ProgramData\Malwarebytes\Malwarebytes' Anti-Malware\Sector_0_1465148923_user.mbam (Forged physical sector) -> Delete on reboot. [8240dd042845ebed5e91aabb51877474] C:\Users\John Schultz\AppData\Local\Temp\1\LibRock-1.0.zip (Trojan.BHO) -> Delete on reboot. [18837d38ef6e93a3f6314c664db66898] C:\Users\John Schultz\Local Settings\Temp\1\LibRock-1.0.zip (Trojan.BHO) -> Delete on reboot. [0f8c189d352810261017684a9b6837c9] C:\Users\John Schultz\Local Settings\Application Data\Temp\1\LibRock-1.0.zip (Trojan.BHO) -> Delete on reboot. [5546625346175ed866c1a60ccf34be42] C:\Windows\svchost.exe (Trojan.Agent) -> Delete on reboot. [cbd024914f0e71c515956c1005fd9f61] C:\Users\John Schultz\Local Settings\Application Data\chromeupdate.crx (Trojan.Agent) -> Delete on reboot. [ddbe32831647c670135601a19a6948b8] C:\Users\John Schultz\AppData\Local\chromeupdate.crx (Trojan.Agent) -> Delete on reboot. [b4e7694c3627e15529410a98c93a3dc3] (end) **** SECOND MBAR Log **** Malwarebytes Anti-Rootkit 1.1.0.1009 www.malwarebytes.org Database version: v2012.11.12.04 Windows Vista Service Pack 2 x64 NTFS Internet Explorer 9.0.8112.16421 John Schultz :: JOHN-PC [administrator] 11/12/2012 11:20:57 AM mbar-log-2012-11-12 (11-20-57).txt Scan type: Quick scan Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken Scan options disabled: PUP | PUM | P2P Objects scanned: 26719 Time elapsed: 27 minute(s), 38 second(s) Memory Processes Detected: 0 (No malicious items detected) Memory Modules Detected: 0 (No malicious items detected) Registry Keys Detected: 0 (No malicious items detected) Registry Values Detected: 0 (No malicious items detected) Registry Data Items Detected: 0 (No malicious items detected) Folders Detected: 0 (No malicious items detected) Files Detected: 0 (No malicious items detected) (end)

RogueKiller V8.2.3 [11/07/2012] by Tigzy mail: tigzyRK<at>gmail<dot>com Feedback: http://www.geekstogo.com/forum/files/file/413-roguekiller/ Website: http://tigzy.geekstogo.com/roguekiller.php Blog: http://tigzyrk.blogspot.com Operating System: Windows Vista (6.0.6002 Service Pack 2) 64 bits version Started in : Normal mode User : John Schultz [Admin rights] Mode : Scan -- Date : 11/12/2012 09:16:13 ¤¤¤ Bad processes : 0 ¤¤¤ ¤¤¤ Registry Entries : 8 ¤¤¤ [RUN][sUSP PATH] HKCU\[...]\Run : wmrar ( "C:\Users\John Schultz\AppData\Roaming\wmrar.dll",ProgramText) -> FOUND [RUN][sUSP PATH] HKUS\S-1-5-21-2005839633-3723987899-1263698059-1000[...]\Run : wmrar ( "C:\Users\John Schultz\AppData\Roaming\wmrar.dll",ProgramText) -> FOUND [RUN][sUSP PATH] HKLM\[...]\Wow6432Node\Run : Anti-phishing Domain Advisor ("C:\ProgramData\Anti-phishing Domain Advisor\visicom_antiphishing.exe") -> FOUND [HJ SMENU] HKCU\[...]\Advanced : Start_ShowPrinters (0) -> FOUND [HJ DESK] HKCU\[...]\ClassicStartMenu : {645FF040-5081-101B-9F08-00AA002F954E} (1) -> FOUND [HJ DESK] HKCU\[...]\NewStartPanel : {645FF040-5081-101B-9F08-00AA002F954E} (1) -> FOUND [HJ DESK] HKLM\[...]\NewStartPanel : {59031a47-3f72-44a7-89c5-5595fe6b30ee} (1) -> FOUND [HJ DESK] HKLM\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> FOUND ¤¤¤ Particular Files / Folders: ¤¤¤ ¤¤¤ Driver : [NOT LOADED] ¤¤¤ ¤¤¤ Extern Hives: ¤¤¤ -> D:\windows\system32\config\SOFTWARE -> D:\Users\Default\NTUSER.DAT ¤¤¤ HOSTS File: ¤¤¤ --> C:\Windows\system32\drivers\etc\hosts 127.0.0.1 localhost ::1 localhost 172.31.254.2 mykillernic ¤¤¤ MBR Check: ¤¤¤ +++++ PhysicalDrive0: ST3750630AS +++++ --- User --- [MBR] cdfc5d12e6f2d4e1921044ebfbc03da9 [bSP] 69a577cfd462274758ec500c84e5c42e : Windows Vista MBR Code Partition table: 0 - [XXXXXX] DELL-UTIL (0xde) [VISIBLE] Offset (sectors): 63 | Size: 78 Mo 1 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 161792 | Size: 2048 Mo 2 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 4356096 | Size: 713276 Mo User != LL1 ... KO! --- LL1 --- [MBR] b66828344da21450bf50857281b4b6f7 [bSP] 69a577cfd462274758ec500c84e5c42e : Windows Vista MBR Code Partition table: 1 - [XXXXXX] DELL-UTIL (0xde) [VISIBLE] Offset (sectors): 63 | Size: 78 Mo 2 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 161792 | Size: 2048 Mo 3 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 4356096 | Size: 713276 Mo User != LL2 ... KO! --- LL2 --- [MBR] b66828344da21450bf50857281b4b6f7 [bSP] 69a577cfd462274758ec500c84e5c42e : Windows Vista MBR Code Partition table: 1 - [XXXXXX] DELL-UTIL (0xde) [VISIBLE] Offset (sectors): 63 | Size: 78 Mo 2 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 161792 | Size: 2048 Mo 3 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 4356096 | Size: 713276 Mo Finished : << RKreport[1]_S_11122012_02d0916.txt >> RKreport[1]_S_11122012_02d0916.txt

attach: UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG. IF REQUESTED, ZIP IT UP & ATTACH IT . DDS (Ver_2012-11-07.01) . Microsoft® Windows Vista™ Home Premium Boot Device: \Device\HarddiskVolume3 Install Date: 2/20/2009 5:18:57 AM System Uptime: 11/12/2012 8:40:40 AM (0 hours ago) . Motherboard: DELL Inc. | | 0P270J Processor: Intel® Core i7 CPU 940 @ 2.93GHz | CPU 1 | 2800/133mhz . ==== Disk Partitions ========================= . C: is FIXED (NTFS) - 697 GiB total, 452.891 GiB free. D: is FIXED (NTFS) - 2 GiB total, 1.008 GiB free. E: is CDROM () F: is CDROM () . ==== Disabled Device Manager Items ============= . Class GUID: {4d36e972-e325-11ce-bfc1-08002be10318} Description: Microsoft ISATAP Adapter Device ID: ROOT\*ISATAP\0003 Manufacturer: Microsoft Name: isatap.home PNP Device ID: ROOT\*ISATAP\0003 Service: tunnel . ==== System Restore Points =================== . No restore point in system. . ==== Installed Programs ====================== . Update for Microsoft Office 2007 (KB2508958) AAC Decoder Acrobat.com Adobe AIR Adobe Flash Player 11 ActiveX Adobe Flash Player 11 Plugin Adobe Reader 9 AlienFX for XPS Anti-phishing Domain Advisor Apple Application Support Apple Software Update AutoUpdate AVG Security Toolbar Blekko search bar Broadcom Management Programs Browser Address Error Redirector ClearView Creative MediaSource 5 Curse Client Dell DataSafe Online Dell Dock Dell Getting Started Guide Dell Video Chat (remove only) DivX Codec DivX Converter DivX Player DivX Plus DirectShow Filters DivX Version Checker DivX Web Player Dolby Digital Live Pack Dragon NaturallySpeaking 11 EPSON Artisan 720 Series Printer Uninstall Epson Event Manager EPSON Scan EpsonNet Print EpsonNet Setup 3.3 Google Chrome Google Earth Google Talk Plugin Google Toolbar for Internet Explorer Google Update Helper Google Updater H.264 Decoder Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595) Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484) InstallMgr Intel® Matrix Storage Manager Java Auto Updater Java 6 Update 37 Killer Driver Logitech G35 Malwarebytes Anti-Malware version 1.65.1.1000 McAfee Security Scan Plus Microsoft .NET Framework 3.5 SP1 Microsoft .NET Framework 4 Client Profile Microsoft Default Manager Microsoft Office 2007 Service Pack 3 (SP3) Microsoft Office Access MUI (English) 2007 Microsoft Office Access Setup Metadata MUI (English) 2007 Microsoft Office Excel MUI (English) 2007 Microsoft Office File Validation Add-In Microsoft Office InfoPath MUI (English) 2007 Microsoft Office Office 64-bit Components 2007 Microsoft Office Outlook MUI (English) 2007 Microsoft Office PowerPoint MUI (English) 2007 Microsoft Office Professional Plus 2007 Microsoft Office Proof (English) 2007 Microsoft Office Proof (French) 2007 Microsoft Office Proof (Spanish) 2007 Microsoft Office Proofing (English) 2007 Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3) Microsoft Office Publisher MUI (English) 2007 Microsoft Office Shared 64-bit MUI (English) 2007 Microsoft Office Shared 64-bit Setup Metadata MUI (English) 2007 Microsoft Office Shared MUI (English) 2007 Microsoft Office Shared Setup Metadata MUI (English) 2007 Microsoft Office Word MUI (English) 2007 Microsoft Search Enhancement Pack Microsoft Silverlight Microsoft Visual C++ 2008 ATL Update kb973924 - x64 9.0.30729.4148 Microsoft Visual C++ 2008 Redistributable - x64 9.0.21022 Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 MINITAB Release 14 MKV Splitter Mozilla Firefox 16.0.2 (x86 en-US) Mozilla Maintenance Service MSN Toolbar MSXML 4.0 SP2 (KB927978) MSXML 4.0 SP2 (KB954430) MSXML 4.0 SP2 (KB973688) Mumble 1.2.3 Nostromo Nostromo Array Programming Software NVIDIA 3D Vision Controller Driver 296.10 NVIDIA 3D Vision Driver 296.10 NVIDIA Control Panel 296.10 NVIDIA Graphics Driver 296.10 NVIDIA Install Application NVIDIA PhysX NVIDIA PhysX System Software 9.12.0213 NVIDIA Stereoscopic 3D Driver NVIDIA Update Components OpenAL Pavtube Video DVD Converter Ultimate Ver 4.0.9.3687 PowerDVD QualXServ Service Agreement QuickTime RegiStax 6 RegiStax 6.1.0.8 update Roxio Creator Audio Roxio Creator Copy Roxio Creator Data Roxio Creator DE Roxio Creator Tools Roxio Express Labeler 3 Roxio Update Manager Security Update for Microsoft .NET Framework 3.5 SP1 (KB2604111) Security Update for Microsoft .NET Framework 3.5 SP1 (KB2657424) Security Update for Microsoft .NET Framework 4 Client Profile (KB2160841) Security Update for Microsoft .NET Framework 4 Client Profile (KB2446708) Security Update for Microsoft .NET Framework 4 Client Profile (KB2478663) Security Update for Microsoft .NET Framework 4 Client Profile (KB2518870) Security Update for Microsoft .NET Framework 4 Client Profile (KB2539636) Security Update for Microsoft .NET Framework 4 Client Profile (KB2572078) Security Update for Microsoft .NET Framework 4 Client Profile (KB2604121) Security Update for Microsoft .NET Framework 4 Client Profile (KB2633870) Security Update for Microsoft .NET Framework 4 Client Profile (KB2656351) Security Update for Microsoft .NET Framework 4 Client Profile (KB2656368) Security Update for Microsoft .NET Framework 4 Client Profile (KB2656368v2) Security Update for Microsoft .NET Framework 4 Client Profile (KB2656405) Security Update for Microsoft .NET Framework 4 Client Profile (KB2686827) Security Update for Microsoft Office 2007 suites (KB2596615) 32-Bit Edition Security Update for Microsoft Office 2007 suites (KB2596672) 32-Bit Edition Security Update for Microsoft Office 2007 suites (KB2596744) 32-Bit Edition Security Update for Microsoft Office 2007 suites (KB2596754) 32-Bit Edition Security Update for Microsoft Office 2007 suites (KB2596785) 32-Bit Edition Security Update for Microsoft Office 2007 suites (KB2596792) 32-Bit Edition Security Update for Microsoft Office 2007 suites (KB2596856) 32-Bit Edition Security Update for Microsoft Office 2007 suites (KB2596871) 32-Bit Edition Security Update for Microsoft Office 2007 suites (KB2597162) 32-Bit Edition Security Update for Microsoft Office 2007 suites (KB2597969) 32-Bit Edition Security Update for Microsoft Office 2007 suites (KB2687314) 32-Bit Edition Security Update for Microsoft Office 2007 suites (KB2687439) 32-Bit Edition Security Update for Microsoft Office 2007 suites (KB2687441) 32-Bit Edition Security Update for Microsoft Office Excel 2007 (KB2597161) 32-Bit Edition Security Update for Microsoft Office InfoPath 2007 (KB2687440) 32-Bit Edition Security Update for Microsoft Office PowerPoint 2007 (KB2596764) 32-Bit Edition Security Update for Microsoft Office PowerPoint 2007 (KB2596912) 32-Bit Edition Security Update for Microsoft Office Publisher 2007 (KB2596705) 32-Bit Edition Security Update for Microsoft Office Word 2007 (KB2687315) 32-Bit Edition Sound Blaster X-Fi Update for 2007 Microsoft Office System (KB967642) Update for Microsoft .NET Framework 3.5 SP1 (KB963707) Update for Microsoft .NET Framework 4 Client Profile (KB2468871) Update for Microsoft .NET Framework 4 Client Profile (KB2533523) Update for Microsoft .NET Framework 4 Client Profile (KB2600217) Update for Microsoft Office 2007 Help for Common Features (KB963673) Update for Microsoft Office Access 2007 Help (KB963663) Update for Microsoft Office Excel 2007 Help (KB963678) Update for Microsoft Office Infopath 2007 Help (KB963662) Update for Microsoft Office Outlook 2007 (KB2596598) 32-Bit Edition Update for Microsoft Office Outlook 2007 Help (KB963677) Update for Microsoft Office Outlook 2007 Junk Email Filter (KB2687407) 32-Bit Edition Update for Microsoft Office Powerpoint 2007 Help (KB963669) Update for Microsoft Office Publisher 2007 Help (KB963667) Update for Microsoft Office Script Editor Help (KB963671) Update for Microsoft Office Word 2007 Help (KB963665) VC80CRTRedist - 8.0.50727.762 Ventrilo Client for Windows x64 Visual C++ 9.0 Runtime for Dragon NaturallySpeaking 64bit (x64) Windows Movie Maker 2.6 WinZip 16.5 World of Warcraft XPS Thermal Monitor Xvid 1.1.3 final uninstall . ==== Event Viewer Messages From Past Week ======== . 11/8/2012 9:28:06 PM, Error: Service Control Manager [7009] - A timeout was reached (30000 milliseconds) while waiting for the vToolbarUpdater13.2.0 service to connect. 11/8/2012 9:28:06 PM, Error: Service Control Manager [7000] - The vToolbarUpdater13.2.0 service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion. 11/8/2012 9:15:51 PM, Error: Service Control Manager [7000] - The MBAMScheduler service failed to start due to the following error: The system cannot find the path specified. 11/8/2012 9:10:13 PM, Error: Service Control Manager [7009] - A timeout was reached (30000 milliseconds) while waiting for the MBAMScheduler service to connect. 11/8/2012 9:10:13 PM, Error: Service Control Manager [7000] - The MBAMScheduler service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion. 11/8/2012 9:07:09 PM, Error: Service Control Manager [7034] - The McAfee Security Scan Component Host Service service terminated unexpectedly. It has done this 1 time(s). 11/11/2012 9:46:59 AM, Error: Microsoft-Windows-Dhcp-Client [1002] - The IP address lease 192.168.1.4 for the Network Card with network address 0019030217E5 has been denied by the DHCP server 0.0.0.0 (The DHCP Server sent a DHCPNACK message). 11/10/2012 9:47:35 AM, Error: Service Control Manager [7009] - A timeout was reached (30000 milliseconds) while waiting for the Intel® Matrix Storage Event Monitor service to connect. 11/10/2012 9:47:35 AM, Error: Service Control Manager [7000] - The Intel® Matrix Storage Event Monitor service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion. . ==== End Of File ===========================

A few days ago malwarebytes stared blocking this file, trojan.agent svchost.exe. After mutiple tries I have been unable to remove the file, can you please help. Thanks in advance. Here are the dds. and attach files: dds. DDS (Ver_2012-11-07.01) - NTFS_AMD64 Internet Explorer: 9.0.8112.16450 BrowserJavaVersion: 1.6.0_37 Run by John Schultz at 8:50:41 on 2012-11-12 Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.1.1033.18.6134.3647 [GMT -5:00] . SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} . ============== Running Processes =============== . C:\Windows\system32\lsm.exe C:\Windows\system32\svchost.exe -k DcomLaunch C:\Windows\system32\nvvsvc.exe C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe C:\Windows\system32\svchost.exe -k rpcss C:\Windows\System32\svchost.exe -k secsvcs C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted C:\Windows\system32\svchost.exe -k netsvcs C:\Program Files (x86)\Creative\Shared Files\CTAudSvc.exe C:\Windows\system32\svchost.exe -k GPSvcGroup C:\Windows\system32\SLsvc.exe C:\Windows\system32\svchost.exe -k LocalService C:\Program Files\Dell\DellDock\DockLogin.exe C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe C:\Windows\system32\nvvsvc.exe C:\Windows\system32\svchost.exe -k NetworkService C:\Windows\System32\spoolsv.exe C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork C:\Program Files (x86)\Common Files\Nuance\dgnsvc.exe C:\Program Files\Bigfoot Networks\Killer Driver\PortManager.exe C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted C:\Program Files (x86)\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe C:\Windows\system32\svchost.exe -k imgsvc C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\13.2.0\ToolbarUpdater.exe C:\Windows\System32\svchost.exe -k WerSvcGroup C:\Windows\system32\SearchIndexer.exe C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAANTMon.exe C:\Windows\system32\taskeng.exe C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe C:\Windows\system32\Dwm.exe C:\Windows\Explorer.EXE C:\Program Files\Windows Defender\MSASCui.exe C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAAnotif.exe C:\Program Files\Alienware\AlienFX\AlienwareAlienFXController.exe C:\Program Files\Windows Sidebar\sidebar.exe C:\Program Files\Dell\XPS Thermal Monitor\ThermalApp.exe C:\Windows\ehome\ehtray.exe C:\ProgramData\FLEXnet\Connect\11\ISUSPM.exe C:\Program Files\Bigfoot Networks\Killer Driver\KillerTray.exe C:\Program Files (x86)\Belkin\Nostromo\nost_LM.exe C:\Program Files (x86)\McAfee Security Scan\3.0.207\SSScheduler.exe C:\Program Files\Dell\DellDock\DellDock.exe C:\Windows\ehome\ehmsas.exe C:\Program Files (x86)\Creative\Sound Blaster X-Fi\Volume Panel\VolPanlu.exe C:\Windows\SysWOW64\Ctxfihlp.exe C:\Program Files (x86)\Logitech\G35\G35.exe C:\Program Files (x86)\Epson Software\Event Manager\EEventManager.exe C:\Users\John Schultz\AppData\Local\Apps\2.0\W2319RD7.RYN\903L7J7N.KPM\curs..tion_9e9e83ddf3ed3ead_0005.0001_161f1f0e4761792c\CurseClient.exe C:\ProgramData\Anti-phishing Domain Advisor\visicom_antiphishing.exe C:\Program Files (x86)\AVG Secure Search\vprot.exe C:\Program Files\NVIDIA Corporation\Display\nvtray.exe C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe C:\Program Files (x86)\Belkin\Nostromo\LoadoutManagerHelper.exe C:\Program Files\Windows Sidebar\sidebar.exe C:\Windows\SysWOW64\CTXFISPI.EXE C:\Windows\system32\wbem\wmiprvse.exe C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation C:\Windows\system32\taskeng.exe C:\Program Files\Windows Media Player\wmpnscfg.exe C:\Program Files\Windows Media Player\wmpnetwk.exe C:\Windows\system32\wbem\unsecapp.exe C:\Windows\system32\wbem\wmiprvse.exe C:\Program Files\Alienware\AlienFX\AlienFXHook32Mngr.exe C:\Program Files\Alienware\AlienFX\AlienFXHook64Mngr.exe C:\Windows\system32\SearchProtocolHost.exe C:\Windows\servicing\TrustedInstaller.exe C:\Program Files (x86)\Mozilla Firefox\firefox.exe C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_5_502_110.exe C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_5_502_110.exe C:\Windows\system32\SearchFilterHost.exe C:\Windows\System32\cscript.exe . ============== Pseudo HJT Report =============== . uStart Page = hxxps://isearch.avg.com/?cid={A2C6BF1A-EA02-4D41-A198-4B926F88585B}&mid=cbb57769766e416890bc23c7fea7ca6f-459f19ff00d8727367d7de2ea512bd5c953ae3e0〈=en&ds=hk014&pr=sa&d=2012-07-29 16:22:40&v=12.1.0.21&sap=hp uWindow Title = Internet Explorer provided by Dell uDefault_Page_URL = hxxp://www.google.com/ig/dell?hl=en&client=dell-usuk&channel=us&ibd=4090220 mDefault_Page_URL = hxxp://www.google.com/ig/dell?hl=en&client=dell-usuk&channel=us&ibd=4090220 mWinlogon: Userinit = userinit.exe, BHO: Adobe PDF Link Helper: {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - c:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll BHO: McAfee Phishing Filter: {27B4851A-3207-45A2-B947-BE8AFE6163AB} - BHO: Search Helper: {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files (x86)\Microsoft\Search Enhancement Pack\Search Helper\SearchHelper.dll BHO: Java Plug-In SSV Helper: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre6\bin\ssv.dll BHO: AVG Security Toolbar: {95B7759C-8C7F-4BF1-B163-73684A933233} - C:\Program Files (x86)\AVG Secure Search\13.2.0.5\AVG Secure Search_toolbar.dll BHO: Google Toolbar Helper: {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll BHO: CBrowserHelperObject Object: {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:\Program Files (x86)\Dell\BAE\BAE.dll BHO: MSN Toolbar Helper: {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files (x86)\MSN\Toolbar\3.0.1125.0\msneshellx.dll BHO: Java Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll TB: Google Toolbar: {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll TB: <No Name>: {E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39} - LocalServer32 - <no file> TB: MSN Toolbar: {1E61ED7C-7CB8-49d6-B9E9-AB4C880C8414} - C:\Program Files (x86)\MSN\Toolbar\3.0.1125.0\msneshellx.dll TB: AVG Security Toolbar: {95B7759C-8C7F-4BF1-B163-73684A933233} - C:\Program Files (x86)\AVG Secure Search\13.2.0.5\AVG Secure Search_toolbar.dll TB: Google Toolbar: {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll uRun: [sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun uRun: [XPS Thermal Monitor] C:\Program Files\Dell\XPS Thermal Monitor\ThermalApp.exe uRun: [ehTray.exe] C:\Windows\ehome\ehTray.exe uRun: [WMPNSCFG] C:\Program Files (x86)\Windows Media Player\WMPNSCFG.exe uRun: [Google Update] "C:\Users\John Schultz\AppData\Local\Google\Update\GoogleUpdate.exe" /c uRun: [swg] "C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" uRun: [wmrar] "C:\Users\John Schultz\AppData\Roaming\wmrar.dll",ProgramText uRun: [iSUSPM] C:\ProgramData\FLEXnet\Connect\11\ISUSPM.exe -scheduler mRun: [VolPanel] "C:\Program Files (x86)\Creative\Sound Blaster X-Fi\Volume Panel\VolPanlu.exe" /r mRun: [updReg] C:\Windows\UpdReg.EXE mRun: [Microsoft Default Manager] "C:\Program Files (x86)\Microsoft\Search Enhancement Pack\Default Manager\DefMgr.exe" -resume mRun: [CTxfiHlp] CTXFIHLP.EXE mRun: [Logitech G35] C:\Program Files (x86)\Logitech\G35\G35.exe mRun: [EEventManager] "C:\Program Files (x86)\Epson Software\Event Manager\EEventManager.exe" mRun: [Anti-phishing Domain Advisor] "C:\ProgramData\Anti-phishing Domain Advisor\visicom_antiphishing.exe" mRun: [APSDaemon] "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" mRun: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime mRun: [vProt] "C:\Program Files (x86)\AVG Secure Search\vprot.exe" mRun: [ROC_ROC_JULY_P1] "C:\Program Files (x86)\AVG Secure Search\ROC_ROC_JULY_P1.exe" / /PROMPT /CMPID=ROC_JULY_P1 mRun: [sunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe" mRun: [DNS7reminder] "C:\Program Files (x86)\Nuance\NaturallySpeaking11\Ereg\Ereg.exe" -r "C:\ProgramData\Nuance\NaturallySpeaking11\Ereg.ini StartupFolder: C:\Users\John Schultz\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\CurseClientStartup.ccip StartupFolder: C:\Users\JOHNSC~1\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\DELLDO~1.LNK - C:\Program Files\Dell\DellDock\DellDock.exe StartupFolder: C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\Startup\KILLER~1.LNK - C:\Program Files\Bigfoot Networks\Killer Driver\KillerTray.exe StartupFolder: C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\Startup\LOADOU~1.LNK - C:\Program Files (x86)\Belkin\Nostromo\nost_LM.exe StartupFolder: C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\Startup\MCAFEE~1.LNK - C:\Program Files (x86)\McAfee Security Scan\3.0.207\SSScheduler.exe mPolicies-Explorer: NoActiveDesktop = dword:1 mPolicies-Explorer: NoActiveDesktopChanges = dword:1 mPolicies-Explorer: BindDirectlyToPropertySetStorage = dword:0 mPolicies-System: EnableUIADesktopToggle = dword:0 IE: E&xport to Microsoft Excel - C:\PROGRA~2\MICROS~2\Office12\EXCEL.EXE/3000 IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} LSP: %SYSTEMROOT%\system32\BfLLR.dll DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_37-windows-i586.cab DPF: {CAFEEFAC-0016-0000-0037-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_37-windows-i586.cab DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_37-windows-i586.cab TCP: NameServer = 192.168.1.1 TCP: Interfaces\{2258201E-49A6-4265-884D-269F0CFF4D31} : DHCPNameServer = 192.168.2.1 TCP: Interfaces\{4DE68E87-BC1B-467D-8480-4CD5249721D9} : DHCPNameServer = 192.168.1.1 Handler: viprotocol - {B658800C-F66E-4EF3-AB85-6C0C227862A9} - C:\Program Files (x86)\Common Files\AVG Secure Search\ViProtocolInstaller\13.2.0\ViProtocol.dll LSA: Security Packages = kerberos msv1_0 schannel wdigest tspkg x64-mDefault_Page_URL = hxxp://www.google.com/ig/dell?hl=en&client=dell-usuk&channel=us&ibd=4090220 x64-BHO: McAfee Phishing Filter: {27B4851A-3207-45A2-B947-BE8AFE6163AB} - x64-BHO: Google Toolbar Helper: {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll x64-TB: Google Toolbar: {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll x64-Run: [Windows Defender] C:\Program Files (x86)\Windows Defender\MSASCui.exe -hide x64-Run: [iAAnotif] "C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\iaanotif.exe" x64-Run: [AlienFX Controller] "C:\Program Files\Alienware\AlienFX\AlienwareAlienFXController.exe" x64-mPolicies-Explorer: NoActiveDesktop = dword:1 x64-mPolicies-Explorer: NoActiveDesktopChanges = dword:1 x64-mPolicies-Explorer: BindDirectlyToPropertySetStorage = dword:0 x64-mPolicies-System: EnableUIADesktopToggle = dword:0 x64-Handler: viprotocol - {B658800C-F66E-4EF3-AB85-6C0C227862A9} - <orphaned> Hosts: 172.31.254.2 mykillernic . ================= FIREFOX =================== . FF - ProfilePath - C:\Users\John Schultz\AppData\Roaming\Mozilla\Firefox\Profiles\9vdxx2kv.default\ FF - prefs.js: browser.search.defaulturl - hxxp://search.yahoo.com/search?ei=UTF-8&fr=ytff-&p= FF - prefs.js: browser.search.selectedEngine - AVG Secure Search FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/ FF - prefs.js: keyword.URL - hxxp://blekko.com/ws/?source={SourceID}&tbp=url&toolbarid=blekkotb_soc&u=USERGUID&q= FF - plugin: C:\Program Files (x86)\Common Files\AVG Secure Search\SiteSafetyInstaller\13.2.0\npsitesafety.dll FF - plugin: C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll FF - plugin: C:\Program Files (x86)\Google\Google Updater\2.4.1691.8062\npCIDetect13.dll FF - plugin: C:\Program Files (x86)\Google\Update\1.2.183.23\npGoogleOneClick8.dll FF - plugin: C:\Program Files (x86)\Google\Update\1.3.21.111\npGoogleUpdate3.dll FF - plugin: C:\Program Files (x86)\Google\Update\1.3.21.115\npGoogleUpdate3.dll FF - plugin: C:\Program Files (x86)\Google\Update\1.3.21.123\npGoogleUpdate3.dll FF - plugin: C:\Program Files (x86)\Google\Update\1.3.21.53\npGoogleUpdate3.dll FF - plugin: C:\Program Files (x86)\Google\Update\1.3.21.57\npGoogleUpdate3.dll FF - plugin: C:\Program Files (x86)\Google\Update\1.3.21.65\npGoogleUpdate3.dll FF - plugin: C:\Program Files (x86)\Google\Update\1.3.21.79\npGoogleUpdate3.dll FF - plugin: C:\Program Files (x86)\Google\Update\1.3.21.99\npGoogleUpdate3.dll FF - plugin: C:\Program Files (x86)\Java\jre6\bin\new_plugin\npdeployJava1.dll FF - plugin: C:\Program Files (x86)\Java\jre6\bin\plugin2\npdeployJava1.dll FF - plugin: C:\Program Files (x86)\Java\jre6\bin\plugin2\npjp2.dll FF - plugin: c:\Program Files (x86)\Microsoft Silverlight\4.1.10329.0\npctrlui.dll FF - plugin: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll FF - plugin: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll FF - plugin: C:\Users\John Schultz\AppData\Local\Google\Update\1.3.21.123\npGoogleUpdate3.dll FF - plugin: C:\Users\John Schultz\AppData\Roaming\Mozilla\plugins\npgoogletalk.dll FF - plugin: C:\Users\John Schultz\AppData\Roaming\Mozilla\plugins\npgtpo3dautoplugin.dll FF - plugin: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_5_502_110.dll FF - plugin: C:\Windows\SysWOW64\npdeployJava1.dll FF - plugin: C:\Windows\SysWOW64\npmproxy.dll FF - ExtSQL: 2012-09-12 19:40; {CAFEEFAC-0016-0000-0035-ABCDEFFEDCBA}; C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0035-ABCDEFFEDCBA} FF - ExtSQL: 2012-10-21 11:56; {CAFEEFAC-0016-0000-0037-ABCDEFFEDCBA}; C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0037-ABCDEFFEDCBA} FF - ExtSQL: !HIDDEN! 2009-09-05 16:36; {20a82645-c095-46ed-80e3-08825760534b}; c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension . ---- FIREFOX POLICIES ---- FF - user.js: yahoo.homepage.dontask - true ============= SERVICES / DRIVERS =============== . R0 PxHlpa64;PxHlpa64;C:\Windows\System32\drivers\PxHlpa64.sys [2009-2-20 53488] R1 avgtp;avgtp;C:\Windows\System32\drivers\avgtpx64.sys [2012-7-29 30568] R2 DockLoginService;Dock Login Service;C:\Program Files\Dell\DellDock\DockLogin.exe [2008-9-23 155648] R2 DragonSvc;Dragon Service;C:\Program Files (x86)\Common Files\Nuance\dgnsvc.exe [2010-7-23 296808] R2 FontCache;Windows Font Cache Service;C:\Windows\System32\svchost.exe -k LocalServiceAndNoImpersonation [2008-1-20 27648] R2 Killer Port Manager;Killer Port Manager;C:\Program Files\Bigfoot Networks\Killer Driver\PortManager.exe [2009-2-20 316928] R2 MBAMScheduler;MBAMScheduler;C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [2012-11-8 399432] R2 MBAMService;MBAMService;C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2012-11-8 676936] R2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [2012-2-29 382272] R2 vToolbarUpdater13.2.0;vToolbarUpdater13.2.0;C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\13.2.0\ToolbarUpdater.exe [2012-11-8 711112] R3 CT20XUT.SYS;CT20XUT.SYS;C:\Windows\System32\drivers\CT20XUT.sys [2009-2-20 230424] R3 CTEXFIFX.SYS;CTEXFIFX.SYS;C:\Windows\System32\drivers\CTEXFIFX.sys [2009-2-20 1445912] R3 CTHWIUT.SYS;CTHWIUT.SYS;C:\Windows\System32\drivers\CTHWIUT.sys [2009-2-20 95256] R3 ha20x22k;Creative 20X2 HAL Driver;C:\Windows\System32\drivers\ha20x22k.sys [2009-2-20 1610776] R3 k57nd60a;Broadcom NetLink Gigabit Ethernet - NDIS 6.0;C:\Windows\System32\drivers\k57nd60a.sys [2009-2-20 252928] R3 LADF_DHP2;G35 DHP2 Filter Driver;C:\Windows\System32\drivers\ladfDHP2amd64.sys [2010-9-29 62168] R3 LADF_SBVM;G35 SBVM Filter Driver;C:\Windows\System32\drivers\ladfSBVMamd64.sys [2010-9-29 377176] R3 MBAMProtector;MBAMProtector;C:\Windows\System32\drivers\mbam.sys [2012-11-8 25928] R3 Nv834x64;Killer NIC Gaming Adapter Service;C:\Windows\System32\drivers\Nv834x64.sys [2009-2-20 121888] R3 NvEdge64;Killer NIC NDIS-Edge Service;C:\Windows\System32\drivers\NvEdge64.sys [2009-2-20 26656] S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384] S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-3-18 138576] S2 gupdate1ca250736aa44f5;Google Update Service (gupdate1ca250736aa44f5);C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2009-8-24 133104] S3 bcgame;Nostromo HID Device Minidriver;C:\Windows\System32\drivers\bcgame.sys [2009-3-1 35328] S3 Creative ALchemy AL1 Licensing Service;Creative ALchemy AL1 Licensing Service;C:\Program Files (x86)\Common Files\Creative Labs Shared\Service\AL1Licensing.exe [2009-2-20 79360] S3 Creative Audio Engine Licensing Service;Creative Audio Engine Licensing Service;C:\Program Files (x86)\Common Files\Creative Labs Shared\Service\CTAELicensing.exe [2009-2-20 79360] S3 CT20XUT;CT20XUT;C:\Windows\System32\drivers\CT20XUT.sys [2009-2-20 230424] S3 CTEXFIFX;CTEXFIFX;C:\Windows\System32\drivers\CTEXFIFX.sys [2009-2-20 1445912] S3 CTHWIUT;CTHWIUT;C:\Windows\System32\drivers\CTHWIUT.sys [2009-2-20 95256] S3 McComponentHostService;McAfee Security Scan Component Host Service;C:\Program Files (x86)\McAfee Security Scan\3.0.207\McCHSvc.exe [2011-6-17 237008] S3 PerfHost;Performance Counter DLL Host;C:\Windows\SysWOW64\perfhost.exe [2008-1-20 19968] S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\WPF\WPFFontCache_v0400.exe [2010-3-18 1020768] S4 clr_optimization_v2.0.50727_64;Microsoft .NET Framework NGEN v2.0.50727_X64;C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe [2009-9-18 89920] . =============== File Associations =============== . FileExt: .js: JSFile=C:\Windows\SysWOW64\WScript.exe "%1" %* FileExt: .jse: JSEFile=C:\Windows\SysWOW64\WScript.exe "%1" %* . =============== Created Last 30 ================ . . ==================== Find3M ==================== . 2012-11-10 14:50:29 73656 ----a-w- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl 2012-11-10 14:50:29 697272 ----a-w- C:\Windows\SysWow64\FlashPlayerApp.exe 2012-11-08 23:56:34 30568 ----a-w- C:\Windows\System32\drivers\avgtpx64.sys 2012-10-10 18:54:59 65309168 ----a-w- C:\Windows\System32\mrt.exe 2012-10-10 02:34:03 10220472 ----a-w- C:\Windows\SysWow64\FlashPlayerInstaller.exe 2012-10-02 23:59:52 462848 ----a-w- C:\Users\John Schultz\AppData\Roaming\wmrar.dll 2012-09-30 00:54:26 25928 ----a-w- C:\Windows\System32\drivers\mbam.sys 2012-09-24 19:32:24 477168 ----a-w- C:\Windows\SysWow64\npdeployJava1.dll 2012-09-24 19:32:20 473072 ----a-w- C:\Windows\SysWow64\deployJava1.dll 2012-09-24 19:23:41 157680 ----a-w- C:\Windows\SysWow64\javaws.exe 2012-09-24 19:23:37 149488 ----a-w- C:\Windows\SysWow64\javaw.exe 2012-09-24 19:23:26 149488 ----a-w- C:\Windows\SysWow64\java.exe 2012-09-13 13:45:46 2048 ----a-w- C:\Windows\System32\tzres.dll 2012-09-13 13:28:08 2048 ----a-w- C:\Windows\SysWow64\tzres.dll 2012-08-29 11:40:01 4699520 ----a-w- C:\Windows\System32\ntoskrnl.exe 2012-08-24 16:07:02 218624 ----a-w- C:\Windows\System32\wintrust.dll 2012-08-24 15:53:29 172544 ----a-w- C:\Windows\SysWow64\wintrust.dll 2012-08-24 11:15:45 17810944 ----a-w- C:\Windows\System32\mshtml.dll 2012-08-24 10:39:42 10925568 ----a-w- C:\Windows\System32\ieframe.dll 2012-08-24 10:31:32 2312704 ----a-w- C:\Windows\System32\jscript9.dll 2012-08-24 10:22:46 1346048 ----a-w- C:\Windows\System32\urlmon.dll 2012-08-24 10:21:18 1392128 ----a-w- C:\Windows\System32\wininet.dll 2012-08-24 10:20:11 1494528 ----a-w- C:\Windows\System32\inetcpl.cpl 2012-08-24 10:18:46 237056 ----a-w- C:\Windows\System32\url.dll 2012-08-24 10:17:03 85504 ----a-w- C:\Windows\System32\jsproxy.dll 2012-08-24 10:14:45 173056 ----a-w- C:\Windows\System32\ieUnatt.exe 2012-08-24 10:14:34 816640 ----a-w- C:\Windows\System32\jscript.dll 2012-08-24 10:13:29 599040 ----a-w- C:\Windows\System32\vbscript.dll 2012-08-24 10:12:04 2144768 ----a-w- C:\Windows\System32\iertutil.dll 2012-08-24 10:11:57 729088 ----a-w- C:\Windows\System32\msfeeds.dll 2012-08-24 10:10:14 96768 ----a-w- C:\Windows\System32\mshtmled.dll 2012-08-24 10:09:42 2382848 ----a-w- C:\Windows\System32\mshtml.tlb 2012-08-24 10:04:06 248320 ----a-w- C:\Windows\System32\ieui.dll 2012-08-24 07:27:00 12319744 ----a-w- C:\Windows\SysWow64\mshtml.dll 2012-08-24 07:03:49 9738240 ----a-w- C:\Windows\SysWow64\ieframe.dll 2012-08-24 06:59:17 1800704 ----a-w- C:\Windows\SysWow64\jscript9.dll 2012-08-24 06:51:50 1103872 ----a-w- C:\Windows\SysWow64\urlmon.dll 2012-08-24 06:51:27 1129472 ----a-w- C:\Windows\SysWow64\wininet.dll 2012-08-24 06:51:02 1427968 ----a-w- C:\Windows\SysWow64\inetcpl.cpl 2012-08-24 06:49:57 231936 ----a-w- C:\Windows\SysWow64\url.dll 2012-08-24 06:48:38 65024 ----a-w- C:\Windows\SysWow64\jsproxy.dll 2012-08-24 06:47:36 717824 ----a-w- C:\Windows\SysWow64\jscript.dll 2012-08-24 06:47:26 142848 ----a-w- C:\Windows\SysWow64\ieUnatt.exe 2012-08-24 06:47:12 420864 ----a-w- C:\Windows\SysWow64\vbscript.dll 2012-08-24 06:45:46 607744 ----a-w- C:\Windows\SysWow64\msfeeds.dll 2012-08-24 06:44:35 1793024 ----a-w- C:\Windows\SysWow64\iertutil.dll 2012-08-24 06:44:10 73216 ----a-w- C:\Windows\SysWow64\mshtmled.dll 2012-08-24 06:43:58 2382848 ----a-w- C:\Windows\SysWow64\mshtml.tlb 2012-08-24 06:40:11 176640 ----a-w- C:\Windows\SysWow64\ieui.dll . ============= FINISH: 8:51:47.43 ===============