terra24

Hi CatByte All tools deleted, everything working fine now. I think the help you offer on this forum is fantastic and I am very grateful for your help. Thank You

Hi CatByte I tried all browsers , all seem to be babylon free. I changed everything back to the settings where it would show up ie home page set to a page rather than a bookmark etc thats where the new page would be hijacked and all is working properly. I have opened and closed the browsers a few times and tested again. No problems found. I would say that the problem has been fixed. Thank you. I will be making a donation. Do I need to uninstall the tools etc.. any special removal instructions.

Hi CatByte I ran the OTL as described, log is below. All browsers now seem free of Babylon search. (thankyou) All processes killed ========== OTL ========== HKEY_USERS\S-1-5-21-3393893806-3609269745-4236858211-1004\Software\Microsoft\Internet Explorer\SearchScopes\\DefaultScope| /E : value set successfully! HKEY_USERS\S-1-5-21-3393893806-3609269745-4236858211-1004\Software\Microsoft\Internet Explorer\SearchScopes\\DefaultScope| /E : value set successfully! Registry key HKEY_USERS\S-1-5-21-3393893806-3609269745-4236858211-1004\Software\Microsoft\Internet Explorer\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}\ not found. Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\Locked deleted successfully. Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\\AppInit_Dlls:c:\PROGRA~3\BROWSE~1\25911~1.18\{C16C1~1\mngr.dll deleted successfully. File move failed. c:\ProgramData\Browser Manager\2.5.911.18\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\mngr.dll scheduled to be moved on reboot. Folder move failed. C:\ProgramData\Browser Manager\2.5.911.18\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\traking_settings scheduled to be moved on reboot. Folder move failed. C:\ProgramData\Browser Manager\2.5.911.18\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\FirefoxExtension\content scheduled to be moved on reboot. Folder move failed. C:\ProgramData\Browser Manager\2.5.911.18\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\FirefoxExtension\components scheduled to be moved on reboot. Folder move failed. C:\ProgramData\Browser Manager\2.5.911.18\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\FirefoxExtension scheduled to be moved on reboot. Folder move failed. C:\ProgramData\Browser Manager\2.5.911.18\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8} scheduled to be moved on reboot. Folder move failed. C:\ProgramData\Browser Manager\2.5.911.18 scheduled to be moved on reboot. Folder move failed. C:\ProgramData\Browser Manager scheduled to be moved on reboot. ========== FILES ========== < ipconfig /flushdns /c > Windows IP Configuration Successfully flushed the DNS Resolver Cache. C:\Users\Terra-x\Desktop\cmd.bat deleted successfully. C:\Users\Terra-x\Desktop\cmd.txt deleted successfully. ========== COMMANDS ========== C:\Windows\System32\drivers\etc\Hosts moved successfully. HOSTS file reset successfully [EMPTYTEMP] User: All Users User: Default ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes User: Default User ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes User: Jeremy ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 314162258 bytes ->Java cache emptied: 0 bytes ->FireFox cache emptied: 85022900 bytes ->Google Chrome cache emptied: 432230100 bytes ->Flash cache emptied: 5881 bytes User: Public ->Temp folder emptied: 0 bytes User: Terra-x ->Temp folder emptied: 67545 bytes ->Temporary Internet Files folder emptied: 21287849 bytes ->Java cache emptied: 0 bytes ->FireFox cache emptied: 9949860 bytes ->Google Chrome cache emptied: 7690576 bytes ->Flash cache emptied: 2675 bytes %systemdrive% .tmp files removed: 0 bytes %systemroot% .tmp files removed: 0 bytes %systemroot%\System32 .tmp files removed: 0 bytes %systemroot%\System32 (64bit) .tmp files removed: 0 bytes %systemroot%\System32\drivers .tmp files removed: 0 bytes Windows Temp folder emptied: 0 bytes %systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 36074817 bytes RecycleBin emptied: 0 bytes Total Files Cleaned = 865.00 mb OTL by OldTimer - Version 3.2.69.0 log created on 12022012_104948 Files\Folders moved on Reboot... c:\ProgramData\Browser Manager\2.5.911.18\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\mngr.dll moved successfully. C:\ProgramData\Browser Manager\2.5.911.18\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\traking_settings folder moved successfully. C:\ProgramData\Browser Manager\2.5.911.18\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\FirefoxExtension\content folder moved successfully. C:\ProgramData\Browser Manager\2.5.911.18\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\FirefoxExtension\components folder moved successfully. C:\ProgramData\Browser Manager\2.5.911.18\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\FirefoxExtension folder moved successfully. C:\ProgramData\Browser Manager\2.5.911.18\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8} folder moved successfully. C:\ProgramData\Browser Manager\2.5.911.18 folder moved successfully. C:\ProgramData\Browser Manager folder moved successfully. C:\Users\Terra-x\AppData\Local\Temp\FXSAPIDebugLogFile.txt moved successfully. PendingFileRenameOperations files... Registry entries deleted on Reboot...

Hi CatByte OTL logs attached Extras.Txt OTL.Txt

Hi CatByte I ran the combofix as described the log is below. The Babylon appears to be fixed in firefox and chrome but is still present in the address bar of IE 9. ComboFix 12-12-01.02 - Terra-x 02/12/2012 8:06.2.8 - x64 Microsoft Windows 7 Home Premium 6.1.7601.1.1252.61.1033.18.8169.5443 [GMT 11:00] Running from: c:\users\Terra-x\Desktop\ComboFix.exe Command switches used :: c:\users\Terra-x\Desktop\CFScript.txt AV: Norton Internet Security *Disabled/Updated* {63DF5164-9100-186D-2187-8DC619EFD8BF} FW: Norton Internet Security *Enabled* {5BE4D041-DB6F-1935-0AD8-24F3E73C9FC4} SP: Norton Internet Security *Disabled/Updated* {D8BEB080-B73A-17E3-1B37-B6B462689202} SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} . FILE :: "d:\from old laptop hd\INTERNET MARKETING ALL\INT MARKETING 2 July 11\BLOG BACKUPS\CLONE\blog_backup.zip" "d:\from old laptop hd\INTERNET MARKETING ALL\INT MARKETING 2 July 11\BLOG BACKUPS\Muscle Gain\blog_backup.zip" "d:\from old laptop hd\INTERNET MARKETING ALL\INT MARKETING 2 July 11\BLOG BACKUPS\Real Reviews\blog_backup.zip" "d:\from old laptop hd\INTERNET MARKETING ALL\INT MARKETING 2 July 11\BLOG BACKUPS\Vitmineral\blog_backup.zip" "d:\from old laptop hd\INTERNET MARKETING ALL\INT MARKETING 2 July 11\FLEX SQUEEZE\flexsqueeze140.zip" "d:\from usb stick\FLEX SQUEEZE\flexsqueeze140.zip" . . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . . d:\from old laptop hd\INTERNET MARKETING ALL\INT MARKETING 2 July 11\BLOG BACKUPS\CLONE\blog_backup.zip d:\from old laptop hd\INTERNET MARKETING ALL\INT MARKETING 2 July 11\BLOG BACKUPS\Muscle Gain\blog_backup.zip d:\from old laptop hd\INTERNET MARKETING ALL\INT MARKETING 2 July 11\BLOG BACKUPS\Real Reviews\blog_backup.zip d:\from old laptop hd\INTERNET MARKETING ALL\INT MARKETING 2 July 11\BLOG BACKUPS\Vitmineral\blog_backup.zip d:\from old laptop hd\INTERNET MARKETING ALL\INT MARKETING 2 July 11\FLEX SQUEEZE\flexsqueeze140.zip d:\from usb stick\FLEX SQUEEZE\flexsqueeze140.zip . . ((((((((((((((((((((((((( Files Created from 2012-11-01 to 2012-12-01 ))))))))))))))))))))))))))))))) . . 2012-12-01 21:11 . 2012-12-01 21:11 -------- d-----w- c:\users\Jeremy\AppData\Local\temp 2012-12-01 21:11 . 2012-12-01 21:11 -------- d-----w- c:\users\Default\AppData\Local\temp 2012-12-01 06:25 . 2012-12-01 06:25 -------- d-----w- c:\programdata\34BE82C4-E596-4e99-A191-52C6199EBF69 2012-12-01 03:34 . 2012-12-01 03:34 -------- d-----w- c:\program files (x86)\ESET 2012-12-01 02:50 . 2012-12-01 02:50 76232 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{2D5C5C9E-8C1B-4731-9516-098C382AE0B6}\offreg.dll 2012-12-01 01:18 . 2012-12-01 01:18 -------- d-----w- c:\windows\ERUNT 2012-12-01 01:18 . 2012-12-01 01:18 -------- d-----w- C:\JRT 2012-11-30 20:42 . 2012-11-30 20:42 -------- d-----r- c:\program files (x86)\Skype 2012-11-30 20:42 . 2012-11-30 20:42 -------- d-----w- c:\program files (x86)\Common Files\Skype 2012-11-30 20:42 . 2012-11-30 20:43 -------- d-----w- c:\programdata\Skype 2012-11-30 20:41 . 2012-11-08 17:24 9125352 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{2D5C5C9E-8C1B-4731-9516-098C382AE0B6}\mpengine.dll 2012-11-25 00:39 . 2012-11-25 00:39 -------- d-----w- c:\programdata\Malwarebytes 2012-11-25 00:39 . 2012-11-25 00:39 -------- d-----w- c:\program files (x86)\Malwarebytes' Anti-Malware 2012-11-25 00:39 . 2012-09-29 08:54 25928 ----a-w- c:\windows\system32\drivers\mbam.sys 2012-11-24 06:10 . 2012-11-24 06:10 -------- d-----w- c:\program files (x86)\Common Files\Symantec Shared 2012-11-24 06:05 . 2012-11-24 06:05 174200 ----a-w- c:\windows\system32\drivers\SYMEVENT64x86.SYS 2012-11-24 06:05 . 2012-11-24 06:05 -------- d-----w- c:\program files\Symantec 2012-11-24 06:05 . 2012-11-24 06:05 -------- d-----w- c:\program files\Common Files\Symantec Shared 2012-11-24 06:04 . 2012-11-24 06:04 -------- d-----w- c:\windows\system32\drivers\NISx64 2012-11-24 06:04 . 2012-11-24 06:04 -------- d-----w- c:\program files (x86)\Norton Internet Security 2012-11-24 06:04 . 2012-11-24 06:04 -------- d-----w- c:\programdata\Norton 2012-11-24 06:03 . 2012-11-24 06:03 -------- d-----w- c:\program files (x86)\NortonInstaller 2012-11-24 04:26 . 2012-11-24 04:26 -------- d-----w- c:\program files (x86)\Mozilla Maintenance Service 2012-11-23 23:30 . 2012-11-23 23:30 -------- d-----w- c:\programdata\Browser Manager 2012-11-23 23:02 . 2012-11-23 23:01 1174993 ----a-w- c:\windows\unins001.exe 2012-11-23 23:02 . 2012-03-26 23:58 25600 ----a-w- c:\windows\system32\drivers\WIMBLEMS.sys 2012-11-23 22:57 . 2012-11-23 23:02 -------- d-----w- c:\program files (x86)\Corsair 2012-11-23 22:57 . 2012-11-23 22:56 1174993 ----a-w- c:\windows\unins000.exe 2012-11-23 22:57 . 2012-03-26 23:58 25600 ----a-w- c:\windows\system32\drivers\CORSGKB.sys 2012-11-23 22:33 . 2006-08-20 19:06 27648 ----a-w- c:\windows\system32\Spool\prtprocs\x64\SSGR1pc.dll 2012-11-23 22:33 . 2006-11-21 00:40 89600 ----a-w- c:\windows\system32\SSGR1ci.dll 2012-11-23 22:33 . 2006-11-19 21:22 151552 ----a-w- c:\windows\system32\SSGR1ci.exe 2012-11-23 22:33 . 2009-03-02 03:12 11576 ------w- c:\windows\system32\drivers\SSPORT.SYS 2012-11-23 22:33 . 2009-03-02 03:12 53816 ------w- c:\windows\system32\drivers\DGIVECP.SYS 2012-11-23 22:33 . 2012-11-23 22:33 -------- d-----w- c:\program files (x86)\SAMSUNG 2012-11-20 11:48 . 2012-11-20 11:49 -------- d-----w- c:\users\Terra-x 2012-11-20 11:32 . 2012-08-23 14:13 243200 ----a-w- c:\windows\system32\rdpudd.dll 2012-11-20 11:32 . 2012-08-23 13:20 54272 ----a-w- c:\windows\system32\MsRdpWebAccess.dll 2012-11-20 11:32 . 2012-08-23 11:20 62976 ----a-w- c:\windows\system32\TSWbPrxy.exe 2012-11-20 11:32 . 2012-08-23 11:14 384000 ----a-w- c:\windows\system32\wksprt.exe 2012-11-20 11:32 . 2012-08-23 10:51 228864 ----a-w- c:\windows\system32\rdpendp_winip.dll 2012-11-20 11:32 . 2012-08-23 10:39 1048064 ----a-w- c:\windows\SysWow64\mstsc.exe 2012-11-20 11:32 . 2012-08-23 10:22 1123840 ----a-w- c:\windows\system32\mstsc.exe 2012-11-20 11:32 . 2012-08-23 09:51 3174912 ----a-w- c:\windows\system32\rdpcorets.dll 2012-11-20 11:32 . 2012-08-23 08:19 4916224 ----a-w- c:\windows\SysWow64\mstscax.dll 2012-11-20 11:32 . 2012-08-23 08:13 5773824 ----a-w- c:\windows\system32\mstscax.dll 2012-11-20 11:24 . 2012-08-24 18:09 458712 ----a-w- c:\windows\system32\drivers\cng.sys 2012-11-20 11:24 . 2012-08-24 18:05 340992 ----a-w- c:\windows\system32\schannel.dll 2012-11-20 11:24 . 2012-08-24 16:57 247808 ----a-w- c:\windows\SysWow64\schannel.dll 2012-11-20 11:24 . 2012-08-24 18:13 154480 ----a-w- c:\windows\system32\drivers\ksecpkg.sys 2012-11-20 11:24 . 2012-08-24 18:04 307200 ----a-w- c:\windows\system32\ncrypt.dll 2012-11-20 11:24 . 2012-08-24 18:03 1448448 ----a-w- c:\windows\system32\lsasrv.dll 2012-11-20 11:24 . 2012-08-24 16:57 220160 ----a-w- c:\windows\SysWow64\ncrypt.dll 2012-11-20 11:24 . 2012-08-24 16:57 22016 ----a-w- c:\windows\SysWow64\secur32.dll 2012-11-20 11:24 . 2012-08-24 16:53 96768 ----a-w- c:\windows\SysWow64\sspicli.dll 2012-11-20 11:24 . 2012-05-04 11:00 366592 ----a-w- c:\windows\system32\qdvd.dll 2012-11-20 11:24 . 2012-05-04 09:59 514560 ----a-w- c:\windows\SysWow64\qdvd.dll 2012-11-19 19:03 . 2012-11-19 19:03 -------- d-----w- c:\users\Jeremy\AppData\Local\Macromedia 2012-11-19 11:34 . 2012-11-19 11:35 -------- d-----w- c:\users\Jeremy\AppData\Roaming\FileZilla 2012-11-19 07:56 . 2012-11-19 07:56 -------- d-----w- c:\program files (x86)\FileZilla FTP Client 2012-11-19 07:32 . 2012-11-19 07:32 -------- d-----w- c:\program files\Microsoft Silverlight 2012-11-19 07:32 . 2012-11-19 07:32 -------- d-----w- c:\program files (x86)\Microsoft Silverlight 2012-11-19 07:15 . 2012-11-19 07:15 -------- d-----w- c:\program files (x86)\Common Files\Java 2012-11-19 07:15 . 2012-11-19 07:15 821736 ----a-w- c:\windows\SysWow64\npDeployJava1.dll 2012-11-19 07:15 . 2012-11-19 07:15 746984 ----a-w- c:\windows\SysWow64\deployJava1.dll 2012-11-19 07:15 . 2012-11-19 07:15 95208 ----a-w- c:\windows\SysWow64\WindowsAccessBridge-32.dll 2012-11-19 07:15 . 2012-11-19 07:15 -------- d-----w- c:\program files (x86)\Java 2012-11-19 06:46 . 2012-08-21 02:01 33240 ----a-w- c:\windows\system32\drivers\GEARAspiWDM.sys 2012-11-19 06:45 . 2012-11-19 06:45 -------- d-----w- c:\program files\iPod 2012-11-19 06:45 . 2012-11-19 06:46 -------- d-----w- c:\program files\iTunes 2012-11-19 06:45 . 2012-11-19 06:46 -------- d-----w- c:\program files (x86)\iTunes 2012-11-18 12:21 . 2012-10-09 18:17 226816 ----a-w- c:\windows\system32\dhcpcore6.dll 2012-11-18 12:21 . 2012-10-09 17:40 193536 ----a-w- c:\windows\SysWow64\dhcpcore6.dll 2012-11-18 12:21 . 2012-10-09 18:17 55296 ----a-w- c:\windows\system32\dhcpcsvc6.dll 2012-11-18 12:21 . 2012-10-09 17:40 44032 ----a-w- c:\windows\SysWow64\dhcpcsvc6.dll 2012-11-18 11:33 . 2012-11-20 01:18 -------- d-----w- c:\program files (x86)\Microsoft Works 2012-11-18 11:32 . 2012-11-18 11:32 -------- d-----w- c:\windows\PCHEALTH 2012-11-18 11:26 . 2012-11-18 11:26 -------- d-----w- c:\program files\Microsoft Office 2012-11-18 11:24 . 2012-11-18 11:24 -------- d-----r- C:\MSOCache 2012-11-18 11:08 . 2012-11-18 11:08 159744 ----a-w- c:\program files (x86)\Internet Explorer\Plugins\npqtplugin7.dll 2012-11-18 11:08 . 2012-11-18 11:08 159744 ----a-w- c:\program files (x86)\Internet Explorer\Plugins\npqtplugin6.dll 2012-11-18 11:08 . 2012-11-18 11:08 159744 ----a-w- c:\program files (x86)\Internet Explorer\Plugins\npqtplugin5.dll 2012-11-18 11:08 . 2012-11-18 11:08 159744 ----a-w- c:\program files (x86)\Internet Explorer\Plugins\npqtplugin4.dll 2012-11-18 11:08 . 2012-11-18 11:08 159744 ----a-w- c:\program files (x86)\Internet Explorer\Plugins\npqtplugin3.dll 2012-11-18 11:08 . 2012-11-18 11:08 159744 ----a-w- c:\program files (x86)\Internet Explorer\Plugins\npqtplugin2.dll 2012-11-18 11:08 . 2012-11-18 11:08 159744 ----a-w- c:\program files (x86)\Internet Explorer\Plugins\npqtplugin.dll 2012-11-18 11:08 . 2012-11-18 11:08 -------- d-----w- c:\program files (x86)\QuickTime 2012-11-18 10:04 . 2012-11-18 10:04 -------- d-----w- c:\users\Jeremy\AppData\Local\Mozilla 2012-11-18 09:04 . 2012-11-18 09:04 -------- d-----w- c:\windows\system32\SPReview 2012-11-18 09:02 . 2012-11-18 09:02 -------- d-----w- c:\windows\system32\EventProviders 2012-11-18 09:00 . 2012-10-29 10:04 66395536 ----a-w- c:\windows\system32\MRT.exe 2012-11-18 08:57 . 2012-11-18 09:47 -------- d-----w- c:\program files\CPUID 2012-11-18 08:46 . 2012-11-18 08:46 -------- d--h--w- c:\programdata\.syncID 2012-11-18 08:45 . 2012-11-29 11:09 -------- d--h--w- c:\programdata\.Syncables 2012-11-18 08:16 . 2012-05-31 01:25 279656 ------w- c:\windows\system32\MpSigStub.exe 2012-11-18 07:41 . 2012-11-18 07:41 -------- d-----w- C:\WINSSLog 2012-11-17 23:07 . 2012-07-26 04:55 785512 ----a-w- c:\windows\system32\drivers\Wdf01000.sys 2012-11-17 23:07 . 2012-07-26 04:55 54376 ----a-w- c:\windows\system32\drivers\WdfLdr.sys 2012-11-17 23:07 . 2012-07-26 04:47 2560 ----a-w- c:\windows\system32\drivers\en-US\wdf01000.sys.mui 2012-11-17 23:07 . 2012-07-26 02:36 9728 ----a-w- c:\windows\system32\Wdfres.dll 2012-11-17 23:01 . 2012-07-26 02:26 87040 ----a-w- c:\windows\system32\drivers\WUDFPf.sys 2012-11-17 23:01 . 2012-07-26 02:26 198656 ----a-w- c:\windows\system32\drivers\WUDFRd.sys 2012-11-17 23:01 . 2012-07-26 03:08 84992 ----a-w- c:\windows\system32\WUDFSvc.dll 2012-11-17 23:01 . 2012-07-26 03:08 194048 ----a-w- c:\windows\system32\WUDFPlatform.dll 2012-11-17 23:01 . 2012-07-26 03:08 45056 ----a-w- c:\windows\system32\WUDFCoinstaller.dll 2012-11-17 23:01 . 2012-07-26 03:08 229888 ----a-w- c:\windows\system32\WUDFHost.exe 2012-11-17 23:01 . 2012-07-26 03:08 744448 ----a-w- c:\windows\system32\WUDFx.dll 2012-11-17 04:56 . 2012-10-18 18:25 3149824 ----a-w- c:\windows\system32\win32k.sys 2012-11-17 04:55 . 2012-09-25 22:47 78336 ----a-w- c:\windows\SysWow64\synceng.dll 2012-11-17 04:55 . 2012-09-25 22:46 95744 ----a-w- c:\windows\system32\synceng.dll . . . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2012-12-01 01:43 . 2012-04-18 13:15 45056 ----a-w- c:\windows\system32\acovcnt.exe 2012-11-19 07:22 . 2012-09-07 02:28 697272 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe 2012-11-19 07:22 . 2012-09-07 02:28 73656 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl 2012-11-18 09:17 . 2009-07-14 02:36 175616 ----a-w- c:\windows\system32\msclmd.dll 2012-11-18 09:17 . 2009-07-14 02:36 152576 ----a-w- c:\windows\SysWow64\msclmd.dll 2012-10-24 16:12 . 2012-10-24 16:12 94208 ----a-w- c:\windows\SysWow64\QuickTimeVR.qtx 2012-10-24 16:12 . 2012-10-24 16:12 69632 ----a-w- c:\windows\SysWow64\QuickTime.qts 2012-10-16 08:38 . 2012-11-28 02:53 135168 ----a-w- c:\windows\apppatch\AppPatch64\AcXtrnal.dll 2012-10-16 08:38 . 2012-11-28 02:53 350208 ----a-w- c:\windows\apppatch\AppPatch64\AcLayers.dll 2012-10-16 07:39 . 2012-11-28 02:53 561664 ----a-w- c:\windows\apppatch\AcLayers.dll 2012-09-14 19:19 . 2012-10-09 06:12 2048 ----a-w- c:\windows\system32\tzres.dll 2012-09-14 18:28 . 2012-10-09 06:12 2048 ----a-w- c:\windows\SysWow64\tzres.dll . . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 . [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2010-11-20 1475584] "ISUSPM"="c:\programdata\FLEXnet\Connect\11\ISUSPM.exe" [2009-05-06 222496] "iCloudServices"="c:\program files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe" [2012-08-29 59280] "ApplePhotoStreams"="c:\program files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe" [2012-09-10 59280] "Syncables"="c:\program files (x86)\syncables\syncables desktop\Syncables.exe" [2010-07-19 370480] "Skype"="c:\program files (x86)\Skype\Phone\Skype.exe" [2012-11-09 17877168] . [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] "UpdateLBPShortCut"="c:\program files (x86)\CyberLink\LabelPrint\MUITransfer\MUIStartMenu.exe" [2009-05-20 222504] "CLMLServer"="c:\program files (x86)\CyberLink\Power2Go\CLMLSvc.exe" [2009-11-02 103720] "UpdateP2GoShortCut"="c:\program files (x86)\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe" [2009-05-20 222504] "Nuance PDF Reader-reminder"="c:\program files (x86)\Nuance\PDF Reader\Ereg\Ereg.exe" [2008-11-03 328992] "FLxHCIm"="c:\program files\Fresco Logic Inc\Fresco Logic USB3.0 Host Controller\host\FLxHCIm.exe" [2011-01-21 40448] "ATKOSD2"="c:\program files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe" [2010-08-17 5732992] "ATKMEDIA"="c:\program files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe" [2010-10-07 170624] "HControlUser"="c:\program files (x86)\ASUS\ATK Package\ATK Hotkey\HControlUser.exe" [2009-06-19 105016] "Wireless Console 3"="c:\program files (x86)\ASUS\Wireless Console 3\wcourier.exe" [2010-09-23 1601536] "ASUS Screen Saver Protector"="c:\windows\AsScrPro.exe" [2012-04-18 3058304] "THX TruStudio NB Settings"="c:\program files (x86)\Creative\THX TruStudio\THXNBSet\THXAudNB.exe" [2011-01-28 907776] "UpdReg"="c:\windows\UpdReg.EXE" [2000-05-11 90112] "CPMonitor"="c:\program files (x86)\Roxio\CinePlayer\5.0\CPMonitor.exe" [2010-10-15 84464] "VAWinAgent"="c:\expressgateutil\VAWinAgent.exe" [2010-08-13 21504] "APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2012-10-11 59280] "QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" [2012-10-24 421888] "iTunesHelper"="c:\program files (x86)\iTunes\iTunesHelper.exe" [2012-09-09 421776] "SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2012-07-02 252848] "Corsair laver"="c:\program files (x86)\Corsair\K90 Keyboard\K90Hid.exe" [2012-05-21 1780736] "Corsair M60 Mouse"="c:\program files (x86)\Corsair\M60 Mouse\M60Hid.exe" [2012-05-21 1766400] . c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\ AsusVibeLauncher.lnk - c:\program files (x86)\ASUS\AsusVibe\AsusVibeLauncher.exe [2011-2-4 548528] Bluetooth.lnk - c:\program files\WIDCOMM\Bluetooth Software\BTTray.exe [2010-3-12 1083680] . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "ConsentPromptBehaviorAdmin"= 5 (0x5) "ConsentPromptBehaviorUser"= 3 (0x3) "EnableUIADesktopToggle"= 0 (0x0) . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows] "LoadAppInit_DLLs"=1 (0x1) "AppInit_DLLs"=c:\progra~3\BROWSE~1\25911~1.18\{C16C1~1\mngr.dll . R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576] R2 Skype C2C Service;Skype C2C Service;c:\programdata\Skype\Toolbars\Skype C2C Service\c2c_service.exe [2012-11-21 3290304] R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe [2012-11-09 160944] R2 VideAceWindowsService;VideAceWindowsService;c:\expressgateutil\VAWinService.exe [2010-08-21 77312] R3 btwl2cap;Bluetooth L2CAP Service;c:\windows\system32\DRIVERS\btwl2cap.sys [2009-04-07 35104] R3 Creative ALchemy AL6 Licensing Service;Creative ALchemy AL6 Licensing Service;c:\program files (x86)\Common Files\Creative Labs Shared\Service\AL6Licensing.exe [2012-04-18 79360] R3 Creative Audio Engine Licensing Service;Creative Audio Engine Licensing Service;c:\program files (x86)\Common Files\Creative Labs Shared\Service\CTAELicensing.exe [2012-04-18 79360] R3 DIRECTIO;DIRECTIO;E:\DirectIo.sys [x] R3 L1C;NDIS Miniport Driver for Atheros AR8131/AR8132 PCI-E Ethernet Controller (NDIS 6.20);c:\windows\system32\DRIVERS\L1C62x64.sys [2009-06-10 57344] R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys [2012-08-23 19456] R3 RSUSBVSTOR;RtsUVStor.Sys Realtek USB Card Reader;c:\windows\system32\Drivers\RtsUVStor.sys [2010-08-03 290920] R3 SiSGbeLH;SiS191/SiS190 Ethernet Device NDIS 6.0 Driver;c:\windows\system32\DRIVERS\SiSG664.sys [2009-06-10 56832] R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2012-08-23 57856] R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys [2012-07-09 52736] R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [2012-08-17 1255736] R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe [2010-09-23 57184] S0 PxHlpa64;PxHlpa64;c:\windows\System32\Drivers\PxHlpa64.sys [2010-03-19 55856] S0 SymDS;Symantec Data Store;c:\windows\system32\drivers\NISx64\1300000.080\SYMDS64.SYS [2011-05-16 451192] S0 SymEFA;Symantec Extended File Attributes;c:\windows\system32\drivers\NISx64\1300000.080\SYMEFA64.SYS [2011-05-16 1083512] S1 ATKWMIACPIIO;ATKWMIACPI Driver;c:\program files (x86)\ASUS\ATK Package\ATK WMIACPI\atkwmiacpi64.sys [2010-07-26 17024] S1 BHDrvx64;BHDrvx64;c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_19.0.0.128\Definitions\BASHDefs\20121106.001\BHDrvx64.sys [2012-11-06 1384608] S1 ccSet_NIS;Norton Internet Security Settings Manager;c:\windows\system32\drivers\NISx64\1300000.080\ccSetx64.sys [2011-05-23 165512] S1 IDSVia64;IDSVia64;c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_19.0.0.128\Definitions\IPSDefs\20121130.001\IDSvia64.sys [2012-11-23 513184] S1 SymIRON;Symantec Iron Driver;c:\windows\system32\drivers\NISx64\1300000.080\Ironx64.SYS [2011-05-16 189560] S1 SymNetS;Symantec Network Security WFP Driver;c:\windows\system32\drivers\NISx64\1300000.080\SYMNETS.SYS [2011-05-09 396408] S2 ASMMAP64;ASMMAP64;c:\program files (x86)\ASUS\ATK Package\ATKGFNEX\ASMMAP64.sys [2009-07-03 15416] S2 MBAMScheduler;MBAMScheduler;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [2012-09-29 399432] S2 MBAMService;MBAMService;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2012-09-29 676936] S2 NIS;Norton Internet Security;c:\program files (x86)\Norton Internet Security\Engine\19.0.0.128\ccSvcHst.exe [2011-05-24 138760] S2 SSPORT;SSPORT;c:\windows\system32\Drivers\SSPORT.sys [2009-03-02 11576] S2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [2011-01-28 378984] S2 TurboB;Turbo Boost UI Monitor driver;c:\windows\system32\DRIVERS\TurboB.sys [2010-04-16 13832] S2 TurboBoost;Intel® Turbo Boost Technology Monitor;c:\program files\Intel\TurboBoost\TurboBoost.exe [2010-04-16 134928] S2 UNS;Intel® Management and Security Application User Notification Service;c:\program files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe [2010-10-06 2655768] S3 btusbflt;Bluetooth USB Filter;c:\windows\system32\drivers\btusbflt.sys [2009-12-14 53800] S3 CORSGKB;Corsair Gaming Keyboard;c:\windows\system32\drivers\CORSGKB.sys [2012-03-26 25600] S3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [2012-11-25 138912] S3 FLxHCIc;Fresco Logic xHCI (USB3) Device Driver;c:\windows\system32\DRIVERS\FLxHCIc.sys [2011-01-21 161280] S3 FLxHCIh;Fresco Logic xHCI (USB3) Hub Device Driver;c:\windows\system32\DRIVERS\FLxHCIh.sys [2011-01-21 50176] S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2012-09-29 25928] S3 MBfilt;MBfilt;c:\windows\system32\drivers\MBfilt64.sys [2009-11-17 32344] S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [2010-12-28 412776] S3 WIMBLEMS;Corsair M60 Gaming Mouse;c:\windows\system32\drivers\WIMBLEMS.sys [2012-03-26 25600] . . Contents of the 'Scheduled Tasks' folder . 2012-12-01 c:\windows\Tasks\Adobe Flash Player Updater.job - c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-09-07 07:22] . 2012-12-01 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job - c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-11-23 11:15] . 2012-12-01 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job - c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-11-23 11:15] . . --------- X64 Entries ----------- . . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\AsusWSShellExt_B] @="{6D4133E5-0742-4ADC-8A8C-9303440F7190}" [HKEY_CLASSES_ROOT\CLSID\{6D4133E5-0742-4ADC-8A8C-9303440F7190}] 2009-11-26 05:49 70656 ----a-w- c:\program files (x86)\ASUS\ASUS WebStorage\SERVICE\AsusWSShellExt64.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\AsusWSShellExt_O] @="{64174815-8D98-4CE6-8646-4C039977D808}" [HKEY_CLASSES_ROOT\CLSID\{64174815-8D98-4CE6-8646-4C039977D808}] 2009-11-26 05:49 70656 ----a-w- c:\program files (x86)\ASUS\ASUS WebStorage\SERVICE\AsusWSShellExt64.dll . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ASUS WebStorage"="c:\program files (x86)\ASUS\ASUS WebStorage\SERVICE\AsusWSService.exe" [2010-03-16 1754448] "RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2010-07-22 11075176] "SynTPEnh"="c:\program files (x86)\Synaptics\SynTP\SynTPEnh.exe" [bU] "IntelTBRunOnce"="wscript.exe" [2009-07-14 168960] "SynAsusAcpi"="c:\program files (x86)\Synaptics\SynTP\SynAsusAcpi.exe" [bU] "THXCfg64"="c:\windows\system32\THXCfg64.dll" [2009-10-15 17920] "Setwallpaper"="c:\programdata\SetWallpaper.cmd" [bU] . ------- Supplementary Scan ------- . uLocal Page = c:\windows\system32\blank.htm uStart Page = hxxp://www.google.com.au/ mStart Page = hxxp://asus.msn.com mLocal Page = c:\windows\SysWOW64\blank.htm TCP: DhcpNameServer = 10.0.0.138 FF - ProfilePath - c:\users\Terra-x\AppData\Roaming\Mozilla\Firefox\Profiles\itzt61yr.default\ FF - prefs.js: browser.startup.homepage - hxxp://www.google.com.au/ FF - ExtSQL: 2012-11-24 17:05; {2D3F3651-74B9-4795-BDEC-6DA2F431CB62}; c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_19.0.0.128\coFFPlgn FF - ExtSQL: 2012-11-27 21:11; support@lastpass.com; c:\users\Terra-x\AppData\Roaming\Mozilla\Firefox\Profiles\itzt61yr.default\extensions\support@lastpass.com FF - ExtSQL: 2012-12-01 07:43; {82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}; c:\program files (x86)\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A} FF - ExtSQL: 2012-12-01 11:53; {BBDA0591-3099-440a-AA10-41764D9DB4DB}; c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_19.0.0.128\IPSFFPlgn . - - - - ORPHANS REMOVED - - - - . Toolbar-Locked - (no file) ShellIconOverlayIdentifiers-{FB314ED9-A251-47B7-93E1-CDD82E34AF8B} - (no file) ShellIconOverlayIdentifiers-{FB314EDA-A251-47B7-93E1-CDD82E34AF8B} - (no file) ShellIconOverlayIdentifiers-{FB314EDB-A251-47B7-93E1-CDD82E34AF8B} - (no file) ShellIconOverlayIdentifiers-{FB314EDC-A251-47B7-93E1-CDD82E34AF8B} - (no file) . . . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\NIS] "ImagePath"="\"c:\program files (x86)\Norton Internet Security\Engine\19.0.0.128\ccSvcHst.exe\" /s \"NIS\" /m \"c:\program files (x86)\Norton Internet Security\Engine\19.0.0.128\diMaster.dll\" /prefetch:1" . --------------------- LOCKED REGISTRY KEYS --------------------- . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}] @Denied: (A 2) (Everyone) @="FlashBroker" "LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_4_402_287_ActiveX.exe,-101" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation] "Enabled"=dword:00000001 . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32] @="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_4_402_287_ActiveX.exe" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}] @Denied: (A 2) (Everyone) @="IFlashBroker5" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32] @="{00020424-0000-0000-C000-000000000046}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" "Version"="1.0" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}] @Denied: (A 2) (Everyone) @="FlashBroker" "LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_4_402_287_ActiveX.exe,-101" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation] "Enabled"=dword:00000001 . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_4_402_287_ActiveX.exe" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}] @Denied: (A 2) (Everyone) @="Shockwave Flash Object" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_4_402_287.ocx" "ThreadingModel"="Apartment" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus] @="0" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID] @="ShockwaveFlash.ShockwaveFlash.11" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_4_402_287.ocx, 1" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib] @="{D27CDB6B-AE6D-11cf-96B8-444553540000}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version] @="1.0" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID] @="ShockwaveFlash.ShockwaveFlash" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}] @Denied: (A 2) (Everyone) @="Macromedia Flash Factory Object" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_4_402_287.ocx" "ThreadingModel"="Apartment" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID] @="FlashFactory.FlashFactory.1" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_4_402_287.ocx, 1" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib] @="{D27CDB6B-AE6D-11cf-96B8-444553540000}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version] @="1.0" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID] @="FlashFactory.FlashFactory" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}] @Denied: (A 2) (Everyone) @="IFlashBroker5" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32] @="{00020424-0000-0000-C000-000000000046}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" "Version"="1.0" . [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Office\Common\Smart Tag\Actions\{B7EFF951-E52F-45CC-9EF7-57124F2177CC}] @Denied: (A) (Everyone) . [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3] @Denied: (A) (Everyone) . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security] @Denied: (Full) (Everyone) . Completion time: 2012-12-02 08:15:44 ComboFix-quarantined-files.txt 2012-12-01 21:15 ComboFix2.txt 2012-12-01 02:59 . Pre-Run: 209,456,168,960 bytes free Post-Run: 207,496,204,288 bytes free . - - End Of File - - F820C63A7DC3F7DCC4E562234C308671

Hi CatByte I ran malware bytes no threats found, so I couldn't select and click remove selected. log pasted below: Malwarebytes Anti-Malware (Trial) 1.65.1.1000 www.malwarebytes.org Database version: v2012.12.01.03 Windows 7 Service Pack 1 x64 NTFS Internet Explorer 9.0.8112.16421 Terra-x :: ASUS-LAPTOP [administrator] Protection: Enabled 1/12/2012 2:24:42 PM mbam-log-2012-12-01 (14-24-42).txt Scan type: Quick scan Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM Scan options disabled: P2P Objects scanned: 234295 Time elapsed: 1 minute(s), 34 second(s) Memory Processes Detected: 0 (No malicious items detected) Memory Modules Detected: 0 (No malicious items detected) Registry Keys Detected: 0 (No malicious items detected) Registry Values Detected: 0 (No malicious items detected) Registry Data Items Detected: 0 (No malicious items detected) Folders Detected: 0 (No malicious items detected) Files Detected: 0 (No malicious items detected) (end) And Eset scan attached. ESETSCAN.txt

Hi CatByte Ok ran those three tools Logs attached ComboFix.txt AdwCleanerS1.txt JRT.txt

Hi CatByte Thanks for the quick reply. Logs are attached. aswMBR.txt attach.txt dds.txt MBR.zip

Hello I need to remove a Babylon infection, pretty sure I got it from a Cnet installer and I exited as soon as I saw the word toolbar, I definately didn't authorize anything to install. I can keep it at bay in browser search and homepage but its still there when I use the actual address bar. Its driving me mad, and I want to add this PC to my network but I am woried it might transfer to the other computers. (this computer has never been on the network before). I ran malwarebytes full scan and it came out with no threats found. I was also running MS security essentials when it got in, I since changed that to Norton internet security. Can anyone help please. Cheers Keith