Jump to content

floor203

Members
  • Posts

    12
  • Joined

  • Last visited

Everything posted by floor203

  1. Hmm things are okay after. I can now go on the 2 websites i told you i couldnt before. Thank you so much for your help.
  2. And sorry to double post, but another thing i wanted to ask that i had forgotten to. A pop up on the side comes every once in a while that my free trial of mbam has expired. I thought you could get a free version and one that you buy ? And also if its expired does that mean that the virus it deleted and quarantined have been freed thanks,
  3. Hmm, im having a problem Maniac, I ran the scan, it, ran through the day and overnight, so i left it on during the night, and i woke up to come check the results. It said 35 threats were deleted total. But i cant click anything on the program, not the close, or minimize or the lab results.
  4. Ok here's the log. ESETSmartInstaller@High as downloader log: all ok # version=8 # OnlineScannerApp.exe=1.0.0.1 # OnlineScanner.ocx=1.0.0.6844 # api_version=3.0.2 # EOSSerial=e13fb85d30085a468ee289ed53124800 # end=finished # remove_checked=true # archives_checked=true # unwanted_checked=true # unsafe_checked=true # antistealth_checked=true # utc_time=2012-12-11 08:13:34 # local_time=2012-12-11 03:13:34 (-0500, Eastern Standard Time) # country="United States" # lang=1033 # osver=6.1.7601 NT Service Pack 1 # compatibility_mode=774 16777213 100 96 13996738 131005486 0 0 # compatibility_mode=5893 16776573 100 94 0 106757064 0 0 # scanned=199372 # found=14 # cleaned=14 # scan_time=10026 C:\$Recycle.Bin\S-1-5-21-2176901464-859471246-874924473-1000\$RUDOF71.exe probably a variant of Win32/Agent.JDAWYGN trojan (deleted - quarantined) E3582B63FBD3CBBEDD03918D750F546A515A293D C C:\Program Files (x86)\VlcPlus\Extras\setup.exe a variant of Win32/Toolbar.Zugo application (cleaned by deleting - quarantined) B17258805276E8C30B9055B902E3B22018809BAF C C:\Program Files (x86)\Windows Live\Messenger\msimg32.dll Win32/Toolbar.MyWebSearch application (cleaned by deleting - quarantined) D2CBBAED406ACCD4856445BD3A9CC47CA563E49D C C:\Program Files (x86)\Windows Live\Messenger\riched20.dll Win32/Toolbar.MyWebSearch application (cleaned by deleting - quarantined) 2489008EF2E8FB7A3BDF6014D4488D01629C7034 C C:\Users\brandsmart\AppData\Local\Temp\jar_cache2231031388501571993.tmp multiple threats (deleted - quarantined) A85ED42A87DF08D48B9577AB33374B0A82281536 C C:\Users\brandsmart\AppData\Local\Temp\jar_cache8655502250733737224.tmp multiple threats (deleted - quarantined) A85ED42A87DF08D48B9577AB33374B0A82281536 C C:\Users\brandsmart\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\3\3b6b9743-3a5c06ea a variant of Java/TrojanDownloader.Agent.NDJ trojan (deleted - quarantined) 1A328FD8403FBAB4A6750324D540072B456D96FE C C:\Users\brandsmart\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\52\58007f34-2715d149 multiple threats (deleted - quarantined) A283B844CBCEDD90E1FE3F4FF2964729BB98C7E8 C C:\Users\brandsmart\Downloads\iLividSetup.exe Win32/Toolbar.SearchSuite application (cleaned by deleting - quarantined) D9AD9612EBFBCD3D477CDC58F0C12C6200EF7878 C C:\Users\brandsmart\Downloads\SavageGunZInstaller1 (1).exe probably a variant of Win32/Agent.GTDUAL trojan (cleaned by deleting - quarantined) 564167984A4255F350A6A9D2A1DF01BAB2061434 C C:\Users\brandsmart\Downloads\SavageGunZInstaller1 (2).exe probably a variant of Win32/Agent.GTDUAL trojan (cleaned by deleting - quarantined) 564167984A4255F350A6A9D2A1DF01BAB2061434 C C:\Users\brandsmart\Downloads\SavageGunZInstaller1.exe probably a variant of Win32/Agent.GTDUAL trojan (cleaned by deleting - quarantined) 564167984A4255F350A6A9D2A1DF01BAB2061434 C C:\Users\brandsmart\Downloads\testing.rar Win32/PSW.FireThief.PB trojan (deleted - quarantined) 46EFFEC03DDFACBF6B1026F56729F4517606A3B8 C C:\Users\brandsmart\Downloads\XvidSetup.exe multiple threats (cleaned by deleting - quarantined) 2F7BD32E2E95142CA14565940DB812ABC4630A11 C ESETSmartInstaller@High as downloader log: all ok # version=8 # OnlineScannerApp.exe=1.0.0.1 # OnlineScanner.ocx=1.0.0.6844 # api_version=3.0.2 # EOSSerial=e13fb85d30085a468ee289ed53124800 # end=finished # remove_checked=false # archives_checked=false # unwanted_checked=true # unsafe_checked=true # antistealth_checked=true # utc_time=2012-12-13 09:49:16 # local_time=2012-12-13 04:49:16 (-0500, Eastern Standard Time) # country="United States" # lang=1033 # osver=6.1.7601 NT Service Pack 1 # compatibility_mode=774 16777213 100 96 14218480 131227228 0 0 # compatibility_mode=5893 16776573 100 94 0 106978806 0 0 # scanned=204661 # found=0 # cleaned=0 # scan_time=6922
  5. Hey uh Maniac , is there perhaps anyway i can bypass it when Mbab blocks the site, and not have to download Combofix.......because ive had a bad experience with combofix before, and after running it i couldnt get on the internet.......and i got in more trouble then.... Right now with your help, the problems i originaly identified are solved. The youtube SKIPAD and random ads are gone, and the internet is gone back to the original speed it was. The only thing was that the 2 anime sites that i mentioned are being blocked by mbam, but besides those 2 sites , i havent come across any other pages that mbam blocks. Thanks.
  6. And here is the fresh DDS you requested. Before that though , another thing is that i cant go on some sites , malwarebyets is blocking them for example these 2 sites Animebuzz.tv and animedreaming, when i try to go on them MBAM blocks it then a message comes up that saids successbly blocked a potentially malicious website and has its ip, etc. Attach . UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG. IF REQUESTED, ZIP IT UP & ATTACH IT . DDS (Ver_2012-11-20.01) . Microsoft Windows 7 Home Premium Boot Device: \Device\HarddiskVolume1 Install Date: 1/7/2010 5:26:29 PM System Uptime: 12/7/2012 2:34:24 AM (0 hours ago) . Motherboard: TOSHIBA | | Portable PC Processor: AMD Turion II Dual-Core Mobile M520 | Socket S1G3 | 2300/200mhz . ==== Disk Partitions ========================= . C: is FIXED (NTFS) - 288 GiB total, 156.365 GiB free. D: is CDROM () . ==== Disabled Device Manager Items ============= . ==== System Restore Points =================== . RP405: 11/27/2012 12:39:52 PM - Windows Update RP406: 11/29/2012 11:02:19 AM - Windows Update RP407: 12/4/2012 7:44:46 PM - Windows Update RP408: 12/6/2012 1:53:16 AM - Removed ShaunWhiteSnowboarding . ==== Installed Programs ====================== . Update for Microsoft Office 2007 (KB2508958) Adobe AIR Adobe Flash Player 11 ActiveX Adobe Flash Player 11 Plugin Adobe Reader XI Adobe Shockwave Player 11.6 Akamai NetSession Interface Amazon Links Apple Application Support Apple Mobile Device Support Apple Software Update ATI Catalyst Install Manager avast! Free Antivirus Bing Bar Bonjour Canon Easy-PhotoPrint EX Canon Easy-WebPrint EX Canon Inkjet Printer/Scanner/Fax Extended Survey Program Canon MG3100 series MP Drivers Canon MG3100 series On-screen Manual Canon MG3100 series User Registration Canon MP Navigator EX 5.0 Canon My Printer Canon Solution Menu EX Catalyst Control Center - Branding Catalyst Control Center Core Implementation Catalyst Control Center Graphics Full Existing Catalyst Control Center Graphics Full New Catalyst Control Center Graphics Light Catalyst Control Center Graphics Previews Common Catalyst Control Center Graphics Previews Vista Catalyst Control Center InstallProxy Catalyst Control Center Localization All ccc-core-static ccc-utility64 CCC Help Chinese Standard CCC Help Chinese Traditional CCC Help Czech CCC Help Danish CCC Help Dutch CCC Help English CCC Help Finnish CCC Help French CCC Help German CCC Help Greek CCC Help Hungarian CCC Help Italian CCC Help Japanese CCC Help Korean CCC Help Norwegian CCC Help Polish CCC Help Portuguese CCC Help Russian CCC Help Spanish CCC Help Swedish CCC Help Thai CCC Help Turkish Compatibility Pack for the 2007 Office system ConservativeTalkNow D3DX10 Dropbox EvilGunZ C11 FIFA 08 FlashWorks Fraps Google Chrome Google Earth Google Toolbar for Internet Explorer Google Update Helper Grand Fantasia InterActual Player iTunes Java 7 Update 7 Java Auto Updater Java 6 Update 29 JavaFX 2.1.0 Junk Mail filter update Label@Once 1.0 LSI V92 MOH Application Malwarebytes Anti-Malware version 1.65.1.1000 Mavis Beacon Deluxe - 25th Anniv. Ed. Messenger Companion Microsoft .NET Framework 4 Client Profile Microsoft Application Error Reporting Microsoft Office 2007 Service Pack 3 (SP3) Microsoft Office Access MUI (English) 2007 Microsoft Office Access Setup Metadata MUI (English) 2007 Microsoft Office Click-to-Run 2010 Microsoft Office Enterprise 2007 Microsoft Office Excel MUI (English) 2007 Microsoft Office File Validation Add-In Microsoft Office Groove MUI (English) 2007 Microsoft Office Groove Setup Metadata MUI (English) 2007 Microsoft Office Home and Business 2010 - English Microsoft Office Home and Student 2007 Microsoft Office InfoPath MUI (English) 2007 Microsoft Office Office 64-bit Components 2007 Microsoft Office OneNote MUI (English) 2007 Microsoft Office Outlook MUI (English) 2007 Microsoft Office PowerPoint MUI (English) 2007 Microsoft Office PowerPoint Viewer 2007 (English) Microsoft Office Professional Plus 2007 Microsoft Office Proof (English) 2007 Microsoft Office Proof (French) 2007 Microsoft Office Proof (Spanish) 2007 Microsoft Office Proofing (English) 2007 Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3) Microsoft Office Publisher MUI (English) 2007 Microsoft Office Shared 64-bit MUI (English) 2007 Microsoft Office Shared 64-bit Setup Metadata MUI (English) 2007 Microsoft Office Shared MUI (English) 2007 Microsoft Office Shared Setup Metadata MUI (English) 2007 Microsoft Office Suite Activation Assistant Microsoft Office Word MUI (English) 2007 Microsoft Silverlight Microsoft SQL Server 2005 Compact Edition [ENU] Microsoft Visual C++ 2005 ATL Update kb973923 - x64 8.0.50727.4053 Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 Microsoft Visual C++ 2005 Redistributable Microsoft Visual C++ 2005 Redistributable (x64) Microsoft Visual C++ 2005 Redistributable (x64) - KB2467175 Microsoft Visual C++ 2008 Redistributable - KB2467174 - x64 9.0.30729.5570 Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570 Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 Microsoft Works Mozilla Firefox 16.0.2 (x86 en-US) Mozilla Maintenance Service MSVCRT MSVCRT_amd64 NetZero Launcher Pando Media Booster PlayReady PC Runtime amd64 Quickbooks Financial Center RealNetworks - Microsoft Visual C++ 2008 Runtime RealPlayer Realtek Ethernet Controller Driver Realtek High Definition Audio Driver Realtek USB 2.0 Card Reader Realtek WLAN Driver RealUpgrade 1.1 Security Update for CAPICOM (KB931906) Security Update for Microsoft .NET Framework 4 Client Profile (KB2446708) Security Update for Microsoft .NET Framework 4 Client Profile (KB2478663) Security Update for Microsoft .NET Framework 4 Client Profile (KB2518870) Security Update for Microsoft .NET Framework 4 Client Profile (KB2539636) Security Update for Microsoft .NET Framework 4 Client Profile (KB2572078) Security Update for Microsoft .NET Framework 4 Client Profile (KB2604121) Security Update for Microsoft .NET Framework 4 Client Profile (KB2633870) Security Update for Microsoft .NET Framework 4 Client Profile (KB2656351) Security Update for Microsoft .NET Framework 4 Client Profile (KB2656368) Security Update for Microsoft .NET Framework 4 Client Profile (KB2656368v2) Security Update for Microsoft .NET Framework 4 Client Profile (KB2656405) Security Update for Microsoft .NET Framework 4 Client Profile (KB2686827) Security Update for Microsoft .NET Framework 4 Client Profile (KB2729449) Security Update for Microsoft .NET Framework 4 Client Profile (KB2737019) Security Update for Microsoft Office 2007 suites (KB2596615) 32-Bit Edition Security Update for Microsoft Office 2007 suites (KB2596672) 32-Bit Edition Security Update for Microsoft Office 2007 suites (KB2596744) 32-Bit Edition Security Update for Microsoft Office 2007 suites (KB2596754) 32-Bit Edition Security Update for Microsoft Office 2007 suites (KB2596785) 32-Bit Edition Security Update for Microsoft Office 2007 suites (KB2596792) 32-Bit Edition Security Update for Microsoft Office 2007 suites (KB2596856) 32-Bit Edition Security Update for Microsoft Office 2007 suites (KB2596871) 32-Bit Edition Security Update for Microsoft Office 2007 suites (KB2597969) 32-Bit Edition Security Update for Microsoft Office 2007 suites (KB2687311) 32-Bit Edition Security Update for Microsoft Office 2007 suites (KB2687314) 32-Bit Edition Security Update for Microsoft Office 2007 suites (KB2687439) 32-Bit Edition Security Update for Microsoft Office 2007 suites (KB2687441) 32-Bit Edition Security Update for Microsoft Office Excel 2007 (KB2687307) 32-Bit Edition Security Update for Microsoft Office InfoPath 2007 (KB2687440) 32-Bit Edition Security Update for Microsoft Office PowerPoint 2007 (KB2596764) 32-Bit Edition Security Update for Microsoft Office PowerPoint 2007 (KB2596912) 32-Bit Edition Security Update for Microsoft Office Publisher 2007 (KB2596705) 32-Bit Edition Security Update for Microsoft Office Word 2007 (KB2687315) 32-Bit Edition Skype Click to Call Skype Launcher Skype™ 5.10 swMSM SwordSearcher 6.1.1.3 Synaptics Pointing Device Driver TOSHIBA Application Installer TOSHIBA Assist TOSHIBA Bulletin Board TOSHIBA ConfigFree TOSHIBA Disc Creator TOSHIBA DVD PLAYER TOSHIBA eco Utility TOSHIBA Extended Tiles for Windows Mobility Center TOSHIBA Face Recognition TOSHIBA Hardware Setup TOSHIBA HDD/SSD Alert TOSHIBA Internal Modem Region Select Utility TOSHIBA Media Controller Toshiba Online Backup TOSHIBA PC Health Monitor TOSHIBA Quality Application TOSHIBA Recovery Media Creator TOSHIBA ReelTime TOSHIBA Service Station TOSHIBA Software Modem TOSHIBA Speech System Applications TOSHIBA Speech System SR Engine(U.S.) Version1.0 TOSHIBA Speech System TTS Engine(U.S.) Version1.0 TOSHIBA Supervisor Password TOSHIBA Value Added Package TOSHIBA Web Camera Application ToshibaRegistration Unity Web Player Update for 2007 Microsoft Office System (KB967642) Update for Microsoft .NET Framework 4 Client Profile (KB2468871) Update for Microsoft .NET Framework 4 Client Profile (KB2533523) Update for Microsoft .NET Framework 4 Client Profile (KB2600217) Update for Microsoft Office 2007 Help for Common Features (KB963673) Update for Microsoft Office 2007 suites (KB2596660) 32-Bit Edition Update for Microsoft Office 2007 suites (KB2596848) 32-Bit Edition Update for Microsoft Office Access 2007 Help (KB963663) Update for Microsoft Office Excel 2007 Help (KB963678) Update for Microsoft Office Infopath 2007 Help (KB963662) Update for Microsoft Office OneNote 2007 Help (KB963670) Update for Microsoft Office Outlook 2007 (KB2687404) 32-Bit Edition Update for Microsoft Office Outlook 2007 Help (KB963677) Update for Microsoft Office Outlook 2007 Junk Email Filter (KB2760413) 32-Bit Edition Update for Microsoft Office Powerpoint 2007 Help (KB963669) Update for Microsoft Office Publisher 2007 Help (KB963667) Update for Microsoft Office Script Editor Help (KB963671) Update for Microsoft Office Word 2007 Help (KB963665) Visual C++ 8.0 Runtime Setup Package Visual C++ 8.0 Runtime Setup Package (x64) VitalSource Bookshelf Windows Live Communications Platform Windows Live Essentials Windows Live ID Sign-in Assistant Windows Live Installer Windows Live Language Selector Windows Live Mail Windows Live Messenger Windows Live Messenger Companion Core Windows Live MIME IFilter Windows Live Movie Maker Windows Live Photo Common Windows Live Photo Gallery Windows Live PIMT Platform Windows Live SOXE Windows Live SOXE Definitions Windows Live Sync Windows Live UX Platform Windows Live UX Platform Language Pack Windows Live Writer Windows Live Writer Resources Windows Media Player Firefox Plugin WinRAR 4.01 (64-bit) Yahoo! Install Manager . ==== Event Viewer Messages From Past Week ======== . 12/7/2012 2:34:44 AM, Error: atikmdag [52236] - CPLIB :: General - Invalid Parameter 12/7/2012 2:34:44 AM, Error: atikmdag [43029] - Display is not active . ==== End Of File =========================== and here's the DDS DDS (Ver_2012-11-20.01) - NTFS_AMD64 Internet Explorer: 9.0.8112.16455 BrowserJavaVersion: 10.7.2 Run by brandsmart at 2:44:05 on 2012-12-07 Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.3836.1848 [GMT -5:00] . AV: avast! Antivirus *Enabled/Updated* {2B2D1395-420B-D5C9-657E-930FE358FC3C} SP: avast! Antivirus *Enabled/Updated* {904CF271-6431-DA47-5FCE-A87D98DFB681} SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} . ============== Running Processes =============== . C:\windows\system32\lsm.exe C:\windows\system32\svchost.exe -k DcomLaunch C:\windows\system32\svchost.exe -k RPCSS C:\windows\system32\atiesrxx.exe C:\windows\System32\svchost.exe -k LocalServiceNetworkRestricted C:\windows\System32\svchost.exe -k LocalSystemNetworkRestricted C:\windows\system32\svchost.exe -k netsvcs C:\windows\system32\svchost.exe -k LocalService C:\windows\system32\svchost.exe -k NetworkService C:\windows\system32\atieclxx.exe C:\Program Files\AVAST Software\Avast\AvastSvc.exe C:\windows\system32\Dwm.exe C:\windows\Explorer.EXE C:\windows\System32\spoolsv.exe C:\windows\system32\taskhost.exe C:\windows\system32\svchost.exe -k LocalServiceNoNetwork C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe C:\windows\SysWOW64\afasrv64.exe C:\windows\SysWOW64\svchost.exe -k Akamai C:\windows\system32\taskeng.exe C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe C:\Program Files (x86)\Microsoft\BingBar\7.1.391.0\BBSvc.exe C:\Program Files\Bonjour\mDNSResponder.exe C:\Program Files (x86)\Canon\IJPLM\IJPLMSVC.EXE C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe C:\Program Files (x86)\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe C:\windows\system32\svchost.exe -k imgsvc C:\Windows\system32\TODDSrv.exe C:\Program Files\TOSHIBA\Power Saver\TosCoSrv.exe C:\Program Files\TOSHIBA\TECO\TecoService.exe C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE C:\windows\system32\SearchIndexer.exe C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe C:\windows\system32\wbem\wmiprvse.exe C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE C:\windows\system32\svchost.exe -k NetworkServiceNetworkRestricted C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe C:\Program Files\Synaptics\SynTP\SynTPEnh.exe C:\Program Files\ltmoh\ltmoh.exe C:\Program Files\TOSHIBA\Power Saver\TPwrMain.exe C:\Program Files\TOSHIBA\SmoothView\SmoothView.exe C:\Program Files\TOSHIBA\FlashCards\TCrdMain.exe C:\Program Files\TOSHIBA\TECO\Teco.exe C:\Program Files\TOSHIBA\BulletinBoard\TosNcCore.exe C:\Program Files\TOSHIBA\ReelTime\TosReelTimeMonitor.exe C:\Program Files\Canon\MyPrinter\BJMYPRT.EXE C:\Program Files (x86)\USIM Editor\iconcs72400344.exe C:\Program Files (x86)\Pando Networks\Media Booster\PMB.exe C:\Users\brandsmart\AppData\Local\Akamai\netsession_win.exe C:\Users\brandsmart\AppData\Local\Akamai\netsession_win.exe C:\Program Files (x86)\TOSHIBA\TOSHIBA Service Station\ToshibaServiceStation.exe C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe C:\Program Files (x86)\TOSHIBA\TOSHIBA Web Camera Application\TWebCamera.exe C:\Program Files\AVAST Software\Avast\AvastUI.exe C:\Program Files (x86)\Canon\Solution Menu EX\CNSEMAIN.EXE C:\Program Files (x86)\iTunes\iTunesHelper.exe C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe C:\Program Files (x86)\Real\RealPlayer\Update\realsched.exe C:\Users\brandsmart\AppData\Roaming\Dropbox\bin\Dropbox.exe C:\Program Files (x86)\Microsoft Office\Office12\ONENOTEM.EXE C:\Program Files\Synaptics\SynTP\SynTPHelper.exe C:\windows\system32\svchost.exe -k LocalServiceAndNoImpersonation C:\Program Files\iPod\bin\iPodService.exe C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe C:\windows\splwow64.exe C:\Program Files (x86)\Canon\Solution Menu EX\CNSEUPDT.EXE C:\Program Files (x86)\TOSHIBA\TOSHIBA Service Station\TMachInfo.exe C:\Program Files\LSI SoftModem\agr64svc.exe C:\Program Files (x86)\TOSHIBA\ConfigFree\CFIWmxSvcs64.exe C:\Program Files (x86)\TOSHIBA\ConfigFree\CFProcSRVC.exe C:\Program Files (x86)\TOSHIBA\ConfigFree\CFSvcs.exe C:\Program Files\TOSHIBA\rselect\RSelSvc.exe C:\windows\System32\svchost.exe -k secsvcs C:\Program Files\TOSHIBA\TPHM\TPCHSrv.exe C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSmartSrv.exe C:\Program Files\TOSHIBA\TPHM\TPCHWMsg.exe C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSENotify.exe C:\windows\servicing\TrustedInstaller.exe C:\windows\system32\wuauclt.exe C:\Program Files (x86)\Google\Chrome\Application\chrome.exe C:\Program Files (x86)\Google\Chrome\Application\chrome.exe C:\Program Files (x86)\Google\Chrome\Application\chrome.exe C:\Program Files (x86)\Google\Chrome\Application\chrome.exe C:\Program Files (x86)\Google\Chrome\Application\chrome.exe C:\Program Files (x86)\Google\Chrome\Application\chrome.exe C:\Program Files (x86)\Google\Chrome\Application\chrome.exe C:\Program Files (x86)\Mozilla Firefox\firefox.exe C:\Program Files (x86)\Google\Chrome\Application\chrome.exe C:\windows\System32\cscript.exe . ============== Pseudo HJT Report =============== . uStart Page = hxxp://www.google.com/ig/redirectdomain?brand=TSNA&bmod=TSNA uDefault_Page_URL = hxxp://www.google.com/ig/redirectdomain?brand=TSNA&bmod=TSNA mStart Page = hxxp://www.google.com/ig/redirectdomain?brand=TSNA&bmod=TSNA mDefault_Page_URL = hxxp://www.google.com/ig/redirectdomain?brand=TSNA&bmod=TSNA mWinlogon: Userinit = userinit.exe, BHO: {02478D38-C3F9-4efb-9B51-7695ECA05670} - <orphaned> BHO: Adobe PDF Link Helper: {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll BHO: RealPlayer Download and Record Plugin for Internet Explorer: {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll BHO: Canon Easy-WebPrint EX BHO: {3785D0AD-BFFF-47F6-BF5B-A587C162FED9} - C:\Program Files (x86)\Canon\Easy-WebPrint EX\ewpexbho.dll BHO: AVG Safe Search: {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - BHO: Groove GFS Browser Helper: {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll BHO: Java Plug-In SSV Helper: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll BHO: avast! WebRep: {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll BHO: Windows Live ID Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll BHO: Windows Live Messenger Companion Helper: {9FDDE16B-836F-4806-AB1F-1455CBEFF289} - C:\Program Files (x86)\Windows Live\Companion\companioncore.dll BHO: Google Toolbar Helper: {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll BHO: Skype Browser Helper: {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll BHO: Bing Bar Helper: {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files (x86)\Microsoft\BingBar\7.1.391.0\BingExt.dll BHO: Java Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll TB: Google Toolbar: {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll TB: ConservativeTalkNow: {533329C9-CA91-42A2-8792-7F91C7B4172A} - TB: Canon Easy-WebPrint EX: {759D9886-0C6F-4498-BAB6-4A5F47C6C72F} - C:\Program Files (x86)\Canon\Easy-WebPrint EX\ewpexhlp.dll TB: avast! WebRep: {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll TB: Canon Easy-WebPrint EX: {759D9886-0C6F-4498-BAB6-4A5F47C6C72F} - C:\Program Files (x86)\Canon\Easy-WebPrint EX\ewpexhlp.dll TB: Bing Bar: {8dcb7100-df86-4384-8842-8fa844297b3f} - TB: Google Toolbar: {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll EB: Canon Easy-WebPrint EX: {21347690-EC41-4F9A-8887-1F4AEE672439} - C:\Program Files (x86)\Canon\Easy-WebPrint EX\ewpexhlp.dll uRun: [swg] "C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" uRun: [msnmsgr] "C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe" /background uRun: [Pando Media Booster] C:\Program Files (x86)\Pando Networks\Media Booster\PMB.exe uRun: [Akamai NetSession Interface] "C:\Users\brandsmart\AppData\Local\Akamai\netsession_win.exe" uRun: [DW6] "C:\Program Files (x86)\The Weather Channel FW\Desktop\DesktopWeather.exe" mRun: [startCCC] "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun mRun: [ToshibaServiceStation] "C:\Program Files (x86)\TOSHIBA\TOSHIBA Service Station\ToshibaServiceStation.exe" /hide:60 mRun: [TWebCamera] "C:\Program Files (x86)\TOSHIBA\TOSHIBA Web Camera Application\TWebCamera.exe" autorun mRun: [NortonOnlineBackupReminder] "C:\Program Files (x86)\TOSHIBA\Toshiba Online Backup\Activation\TobuActivation.exe" UNATTENDED mRun: [avast] "C:\Program Files\AVAST Software\Avast\avastUI.exe" /nogui mRun: [GrooveMonitor] "C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe" mRun: [CanonSolutionMenuEx] C:\Program Files (x86)\Canon\Solution Menu EX\CNSEMAIN.EXE /logon mRun: [APSDaemon] "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" mRun: [uSBestCR] C:\Program Files (x86)\USIM Editor\iconcs72400344.exe RunFromReg mRun: [iTunesHelper] "C:\Program Files (x86)\iTunes\iTunesHelper.exe" mRun: [sunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe" mRun: [TkBellExe] "c:\program files (x86)\real\realplayer\Update\realsched.exe" -osboot mRun: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" StartupFolder: C:\Users\BRANDS~1\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\Dropbox.lnk - C:\Users\brandsmart\AppData\Roaming\Dropbox\bin\Dropbox.exe StartupFolder: C:\Users\BRANDS~1\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\ONENOT~1.LNK - C:\Program Files (x86)\Microsoft Office\Office12\ONENOTEM.EXE StartupFolder: C:\Users\BRANDS~1\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\ZIPSCR~1.LNK - C:\NavPress\ZIPscrpt.exe uPolicies-Explorer: NoDriveTypeAutoRun = dword:255 mPolicies-Explorer: NoActiveDesktop = dword:1 mPolicies-Explorer: NoActiveDesktopChanges = dword:1 mPolicies-System: ConsentPromptBehaviorAdmin = dword:5 mPolicies-System: ConsentPromptBehaviorUser = dword:3 mPolicies-System: EnableUIADesktopToggle = dword:0 IE: E&xport to Microsoft Excel - C:\PROGRA~2\MIF5BA~1\Office12\EXCEL.EXE/3000 IE: Google Sidewiki... - C:\Program Files (x86)\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_2EC7709873947E87.dll/cmsidewiki.html IE: {0000036B-C524-4050-81A0-243669A86B9F} - {B63DBA5F-523F-4B9C-A43D-65DF1977EAD3} - C:\Program Files (x86)\Windows Live\Companion\companioncore.dll IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - C:\Program Files (x86)\Microsoft Office\Office12\ONBttnIE.dll IE: {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} . INFO: HKCU has more than 50 listed domains. If you wish to scan all of them, select the 'Force scan all domains' option. . DPF: {02BCC737-B171-4746-94C9-0D8A0B2C0089} - hxxp://office.microsoft.com/_layouts/ClientBin/ieawsdc32.cab DPF: {233C1507-6A77-46A4-9443-F871F945D258} - hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} - hxxp://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} - C:\Program Files (x86)\Yahoo!\Common\Yinsthelper.dll DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} - hxxp://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab DPF: {8100D56A-5661-482C-BEE8-AFECE305D968} - hxxp://upload.facebook.com/controls/2009.07.28_v5.5.8.1/FacebookPhotoUploader55.cab DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab DPF: {B3E32D88-8E7F-468F-B0E2-3A300FD4A82C} - hxxp://myitlab.pearsoned.com/Pegasus/Modules/SIMIntegration/Resources/ax/stub.cab DPF: {CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab TCP: NameServer = 192.168.1.1 TCP: Interfaces\{1F34DFC2-A868-47A7-84E0-304628083DBD} : DHCPNameServer = 10.1.10.1 TCP: Interfaces\{5A01509C-8215-43C9-9780-C9A65A540D63} : DHCPNameServer = 192.168.1.1 TCP: Interfaces\{5A01509C-8215-43C9-9780-C9A65A540D63}\16474777966696 : DHCPNameServer = 192.168.6.1 64.134.255.2 64.134.255.10 TCP: Interfaces\{5A01509C-8215-43C9-9780-C9A65A540D63}\2456C6B696E6F574F575962756C6563737F5246443345373 : DHCPNameServer = 192.168.2.1 TCP: Interfaces\{5A01509C-8215-43C9-9780-C9A65A540D63}\2656C6B696E6534376 : DHCPNameServer = 192.168.2.1 192.168.1.254 TCP: Interfaces\{5A01509C-8215-43C9-9780-C9A65A540D63}\96367636 : DHCPNameServer = 192.168.0.1 Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveSystemServices.dll Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files (x86)\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll SSODL: WebCheck - <orphaned> SEH: Groove GFS Stub Execution Hook - {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll x64-BHO: avast! WebRep: {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll x64-BHO: AVG Safe Search: {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - x64-BHO: Windows Live ID Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll x64-BHO: Google Toolbar Helper: {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll x64-TB: avast! WebRep: {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll x64-TB: Google Toolbar: {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll x64-Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe x64-Run: [synTPEnh] C:\Program Files (x86)\Synaptics\SynTP\SynTPEnh.exe x64-Run: [LtMoh] C:\Program Files\ltmoh\Ltmoh.exe x64-Run: [TPwrMain] C:\Program Files (x86)\TOSHIBA\Power Saver\TPwrMain.EXE x64-Run: [smoothView] C:\Program Files (x86)\Toshiba\SmoothView\SmoothView.exe x64-Run: [00TCrdMain] C:\Program Files (x86)\TOSHIBA\FlashCards\TCrdMain.exe x64-Run: [TosWaitSrv] C:\Program Files (x86)\TOSHIBA\TPHM\TosWaitSrv.exe x64-Run: [smartFaceVWatcher] C:\Program Files (x86)\Toshiba\SmartFaceV\SmartFaceVWatcher.exe x64-Run: [Teco] "C:\Program Files (x86)\TOSHIBA\TECO\Teco.exe" /r x64-Run: [TosSENotify] C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosWaitSrv.exe x64-Run: [TosNC] C:\Program Files (x86)\Toshiba\BulletinBoard\TosNcCore.exe x64-Run: [TosReelTimeMonitor] C:\Program Files (x86)\TOSHIBA\ReelTime\TosReelTimeMonitor.exe x64-Run: [CanonMyPrinter] C:\Program Files\Canon\MyPrinter\BJMyPrt.exe /logon x64-Run: [uSBestCR] C:\Program Files (x86)\USIM Editor\iconcs72400344.exe RunFromReg x64-Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - <orphaned> x64-Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - <orphaned> x64-Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - <orphaned> x64-Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - <orphaned> x64-SSODL: WebCheck - <orphaned> . ================= FIREFOX =================== . FF - ProfilePath - C:\Users\brandsmart\AppData\Roaming\Mozilla\Firefox\Profiles\cqfudqqy.default\ FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/ FF - plugin: C:\PROGRA~2\MIF5BA~1\Office14\NPSPWRAP.DLL FF - plugin: C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll FF - plugin: C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll FF - plugin: C:\Program Files (x86)\Canon\Easy-PhotoPrint EX\NPEZFFPI.DLL FF - plugin: C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll FF - plugin: C:\Program Files (x86)\Google\Update\1.3.21.123\npGoogleUpdate3.dll FF - plugin: C:\Program Files (x86)\Java\jre6\bin\new_plugin\npdeployJava1.dll FF - plugin: C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll FF - plugin: c:\Program Files (x86)\Microsoft Silverlight\5.1.10411.0\npctrlui.dll FF - plugin: C:\Program Files (x86)\Mozilla Firefox\plugins\nprpplugin.dll FF - plugin: C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll FF - plugin: c:\program files (x86)\real\realplayer\Netscape6\nprpplugin.dll FF - plugin: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll FF - plugin: C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprpchromebrowserrecordext.dll FF - plugin: C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll FF - plugin: C:\Users\brandsmart\AppData\Local\Microsoft\Internet Explorer\Downloaded Program Files\npsoe.dll FF - plugin: C:\Users\brandsmart\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll FF - plugin: C:\windows\SysWOW64\Adobe\Director\np32dsw.dll FF - plugin: C:\windows\SysWOW64\Macromed\Flash\NPSWF32_11_4_402_287.dll FF - plugin: C:\windows\SysWOW64\npDeployJava1.dll FF - plugin: C:\windows\SysWOW64\npmproxy.dll FF - ExtSQL: 2012-10-12 00:20; {0153E448-190B-4987-BDE1-F256CADA672F}; C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext . ============= SERVICES / DRIVERS =============== . R0 tos_sps64;TOSHIBA tos_sps64 Service;C:\windows\System32\drivers\tos_sps64.sys [2009-12-25 482384] R1 aswSnx;aswSnx;C:\windows\System32\drivers\aswSnx.sys [2011-3-16 819032] R1 aswSP;aswSP;C:\windows\System32\drivers\aswSP.sys [2011-3-16 337240] R2 AfaService;Afa Card Reader Service;C:\windows\System32\afasrv64.exe --> C:\windows\System32\afasrv64.exe [?] R2 Akamai;Akamai NetSession Interface;C:\windows\System32\svchost.exe -k Akamai [2009-7-13 27136] R2 AMD External Events Utility;AMD External Events Utility;C:\windows\System32\atiesrxx.exe [2009-12-25 203264] R2 aswFsBlk;aswFsBlk;C:\windows\System32\drivers\aswFsBlk.sys [2011-3-16 24408] R2 aswMonFlt;aswMonFlt;C:\windows\System32\drivers\aswMonFlt.sys [2011-3-16 69976] R2 avast! Antivirus;avast! Antivirus;C:\Program Files\AVAST Software\Avast\AvastSvc.exe [2012-3-27 44768] R2 BBSvc;BingBar Service;C:\Program Files (x86)\Microsoft\BingBar\7.1.391.0\BBSvc.EXE [2012-6-11 193616] R2 cfWiMAXService;ConfigFree WiMAX Service;C:\Program Files (x86)\TOSHIBA\ConfigFree\CFIWmxSvcs64.exe [2009-8-10 248688] R2 ConfigFree Gadget Service;ConfigFree Gadget Service;C:\Program Files (x86)\TOSHIBA\ConfigFree\CFProcSRVC.exe [2009-7-14 42368] R2 ConfigFree Service;ConfigFree Service;C:\Program Files (x86)\TOSHIBA\ConfigFree\CFSvcs.exe [2009-3-10 46448] R2 cvhsvc;Client Virtualization Handler;C:\Program Files (x86)\Common Files\microsoft shared\Virtualization Handler\CVHSVC.EXE [2012-1-4 822624] R2 MBAMScheduler;MBAMScheduler;C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [2012-12-4 399432] R2 MBAMService;MBAMService;C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2012-12-4 676936] R2 RSELSVC;TOSHIBA Modem region select service;C:\Program Files\TOSHIBA\rselect\RSelSvc.exe [2009-7-7 65904] R2 sftlist;Application Virtualization Client;C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe [2011-10-1 508776] R2 TOSHIBA eco Utility Service;TOSHIBA eco Utility Service;C:\Program Files\TOSHIBA\TECO\TecoService.exe [2009-8-11 252272] R2 TVALZFL;TOSHIBA ACPI-Based Value Added Logical and General Purpose Device Filter Driver;C:\windows\System32\drivers\TVALZFL.sys [2009-6-19 14472] R3 FwLnk;FwLnk Driver;C:\windows\System32\drivers\FwLnk.sys [2009-12-25 9216] R3 MBAMProtector;MBAMProtector;C:\windows\System32\drivers\mbam.sys [2012-12-4 25928] R3 PGEffect;Pangu effect driver;C:\windows\System32\drivers\PGEffect.sys [2009-12-25 35008] R3 RTL8167;Realtek 8167 NT Driver;C:\windows\System32\drivers\Rt64win7.sys [2009-12-25 236544] R3 rtl8192se;Realtek Wireless LAN 802.11n PCI-E NIC NT Driver;C:\windows\System32\drivers\rtl8192se.sys [2009-12-25 943616] R3 Sftfs;Sftfs;C:\windows\System32\drivers\Sftfslh.sys [2011-10-1 764264] R3 Sftplay;Sftplay;C:\windows\System32\drivers\Sftplaylh.sys [2011-10-1 268648] R3 Sftredir;Sftredir;C:\windows\System32\drivers\Sftredirlh.sys [2011-10-1 25960] R3 Sftvol;Sftvol;C:\windows\System32\drivers\Sftvollh.sys [2011-10-1 22376] R3 sftvsa;Application Virtualization Service Agent;C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe [2011-10-1 219496] R3 TMachInfo;TMachInfo;C:\Program Files (x86)\TOSHIBA\TOSHIBA Service Station\TMachInfo.exe [2009-12-25 51512] R3 TOSHIBA HDD SSD Alert Service;TOSHIBA HDD SSD Alert Service;C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSmartSrv.exe [2009-8-3 137560] R3 TPCHSrv;TPCH Service;C:\Program Files\TOSHIBA\TPHM\TPCHSrv.exe [2009-8-4 826224] S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384] S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-3-18 138576] S2 SkypeUpdate;Skype Updater;C:\Program Files (x86)\Skype\Updater\Updater.exe [2012-6-7 160944] S3 BBUpdate;BBUpdate;C:\Program Files (x86)\Microsoft\BingBar\7.1.391.0\SeaPort.EXE [2012-6-11 240208] S3 MHIKEY10;MHIKEY10;C:\windows\System32\drivers\MHIKEY10x64.sys [2010-9-15 60288] S3 npggsvc;nProtect GameGuard Service;C:\windows\System32\GameMon.des -service --> C:\windows\System32\GameMon.des -service [?] S3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;C:\windows\System32\drivers\RtsUStor.sys [2009-12-25 222208] S3 TsUsbFlt;TsUsbFlt;C:\windows\System32\drivers\TsUsbFlt.sys [2011-6-6 59392] S3 USBAAPL64;Apple Mobile USB Driver;C:\windows\System32\drivers\usbaapl64.sys [2012-2-15 52736] S3 WatAdminSvc;Windows Activation Technologies Service;C:\windows\System32\Wat\WatAdminSvc.exe [2010-4-19 1255736] . =============== Created Last 30 ================ . 2012-12-07 07:39:12 76232 ----a-w- C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{A1ED66F4-BF96-4506-A1C7-6BC492823CF2}\offreg.dll 2012-12-07 06:55:01 -------- d-----w- C:\windows\ERUNT 2012-12-07 06:52:37 -------- d-----w- C:\JRT 2012-12-07 02:02:13 -------- d-----w- C:\Users\brandsmart\AppData\Local\{ADF28A49-D2B0-48FA-A38E-A0192BD3A728} 2012-12-06 06:38:35 -------- d-----w- C:\Users\brandsmart\AppData\Local\{EC0E3181-D863-4A1E-8040-66B9EB72B015} 2012-12-05 16:51:14 -------- d-----w- C:\Users\brandsmart\AppData\Local\{12BC2AB9-8618-49C0-B1E8-BE684E25D2D1} 2012-12-05 00:46:10 9125352 ----a-w- C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{A1ED66F4-BF96-4506-A1C7-6BC492823CF2}\mpengine.dll 2012-12-04 05:33:00 -------- d-----w- C:\Users\brandsmart\AppData\Roaming\Malwarebytes 2012-12-04 05:32:43 -------- d-----w- C:\ProgramData\Malwarebytes 2012-12-04 05:32:42 25928 ----a-w- C:\windows\System32\drivers\mbam.sys 2012-12-04 05:32:41 -------- d-----w- C:\Program Files (x86)\Malwarebytes' Anti-Malware 2012-12-04 04:41:44 -------- d-----w- C:\Users\brandsmart\AppData\Local\{F56F9503-27EE-45A3-897D-DA73315C8A82} 2012-12-02 13:47:15 -------- d-----w- C:\Users\brandsmart\AppData\Local\{A39BD791-71EA-4273-8083-1A40372AE528} 2012-11-30 19:26:01 -------- d-----w- C:\Program Files (x86)\BuzzSocialPointsIE_DNS 2012-11-30 18:04:58 -------- d-----w- C:\Users\brandsmart\AppData\Local\{D5ABDFAD-AE51-412B-95EB-55B9A3C0C77C} 2012-11-29 15:58:05 -------- d-----w- C:\Users\brandsmart\AppData\Local\{999BA1CD-AC9B-4DE6-A652-9D8DDFDA645B} 2012-11-29 02:15:35 -------- d-----w- C:\Users\brandsmart\AppData\Local\{06BAE05C-22D9-4442-9233-3E686F2E2FB3} 2012-11-28 05:51:27 -------- d-----w- C:\Users\brandsmart\AppData\Local\{B9A8AC2C-3ACD-45B4-B6AB-976EAB0987D2} 2012-11-27 17:34:48 -------- d-----w- C:\Users\brandsmart\AppData\Local\{7B7BFAA1-E2BB-48AB-BEF7-0E8C22BA294D} 2012-11-25 20:18:17 -------- d-----w- C:\Users\brandsmart\AppData\Local\{5A53FEA5-C0DB-4A8F-B663-C8F6EFBDFF4E} 2012-11-24 15:55:34 -------- d-----w- C:\Users\brandsmart\AppData\Local\{E27A40A5-60E9-4A89-A447-6AAF23A083C7} 2012-11-23 16:13:25 -------- d-----w- C:\Users\brandsmart\AppData\Local\{78D2D085-42E1-435A-BC88-FA4908BE642C} 2012-11-23 04:13:07 -------- d-----w- C:\Users\brandsmart\AppData\Local\{27D297BB-1372-481F-A9CD-B84B350BCD30} 2012-11-19 00:51:29 -------- d-----w- C:\Users\brandsmart\AppData\Local\{9111A644-6A5E-4B79-904B-26F8B6B45081} 2012-11-18 06:08:18 -------- d-----w- C:\Users\brandsmart\AppData\Local\{9A4EFBA4-C520-4B04-BB88-26A46A12D5F0} 2012-11-16 12:15:44 -------- d-----w- C:\Users\brandsmart\AppData\Local\{30C40323-B90D-4A96-BF4F-727C332D9EBC} 2012-11-15 21:16:59 -------- d-----w- C:\Users\brandsmart\AppData\Local\{86B872D7-AF45-4F68-B258-3E89484E0904} 2012-11-15 04:26:21 -------- d-----w- C:\Users\brandsmart\AppData\Local\{61939948-FFB8-4BAD-8F3A-30A2F5D797E6} 2012-11-14 09:12:45 -------- d-----w- C:\Users\brandsmart\AppData\Local\{C2848D79-C3B5-4656-800C-9D516AD8D9CA} 2012-11-14 08:20:36 2560 ----a-w- C:\windows\System32\drivers\en-US\wdf01000.sys.mui 2012-11-14 08:20:34 9728 ----a-w- C:\windows\System32\Wdfres.dll 2012-11-14 08:20:34 785512 ----a-w- C:\windows\System32\drivers\Wdf01000.sys 2012-11-14 08:20:34 54376 ----a-w- C:\windows\System32\drivers\WdfLdr.sys 2012-11-14 08:03:59 87040 ----a-w- C:\windows\System32\drivers\WUDFPf.sys 2012-11-14 08:03:59 198656 ----a-w- C:\windows\System32\drivers\WUDFRd.sys 2012-11-14 08:03:57 84992 ----a-w- C:\windows\System32\WUDFSvc.dll 2012-11-14 08:03:57 194048 ----a-w- C:\windows\System32\WUDFPlatform.dll 2012-11-14 08:03:53 45056 ----a-w- C:\windows\System32\WUDFCoinstaller.dll 2012-11-14 08:03:53 229888 ----a-w- C:\windows\System32\WUDFHost.exe 2012-11-14 08:03:52 744448 ----a-w- C:\windows\System32\WUDFx.dll 2012-11-12 14:26:26 -------- d-----w- C:\Users\brandsmart\AppData\Local\{458F4D10-860B-4AC6-A7D5-032FD88E510A} 2012-11-12 02:26:06 -------- d-----w- C:\Users\brandsmart\AppData\Local\{90DEE558-2DC4-4350-9E04-3B1DEE9D06E4} 2012-11-11 14:25:47 -------- d-----w- C:\Users\brandsmart\AppData\Local\{663BBBD0-8081-4870-A116-BAC5D09DDCAD} 2012-11-10 00:14:42 -------- d-----w- C:\Users\brandsmart\AppData\Local\{570103B8-02B8-4300-9871-E5E5BBDF345E} 2012-11-09 05:25:26 -------- d-----w- C:\Users\brandsmart\AppData\Local\{9BB6FFEE-4EA7-451D-BFC1-E7EC810F0C0E} 2012-11-08 00:28:58 -------- d-----w- C:\Users\brandsmart\AppData\Local\{066F5BD0-DB6E-4189-8F61-09C7DFB23BA1} . ==================== Find3M ==================== . 2012-11-09 06:03:37 73656 ----a-w- C:\windows\SysWow64\FlashPlayerCPLApp.cpl 2012-11-09 06:03:37 697272 ----a-w- C:\windows\SysWow64\FlashPlayerApp.exe 2012-10-18 18:25:58 3149824 ----a-w- C:\windows\System32\win32k.sys 2012-10-16 08:38:37 135168 ----a-w- C:\windows\apppatch\AppPatch64\AcXtrnal.dll 2012-10-16 08:38:34 350208 ----a-w- C:\windows\apppatch\AppPatch64\AcLayers.dll 2012-10-16 07:39:52 561664 ----a-w- C:\windows\apppatch\AcLayers.dll 2012-10-12 04:19:49 499712 ----a-w- C:\windows\SysWow64\msvcp71.dll 2012-10-12 04:19:49 348160 ----a-w- C:\windows\SysWow64\msvcr71.dll 2012-10-09 18:17:13 55296 ----a-w- C:\windows\System32\dhcpcsvc6.dll 2012-10-09 18:17:13 226816 ----a-w- C:\windows\System32\dhcpcore6.dll 2012-10-09 17:40:31 44032 ----a-w- C:\windows\SysWow64\dhcpcsvc6.dll 2012-10-09 17:40:31 193536 ----a-w- C:\windows\SysWow64\dhcpcore6.dll 2012-10-08 11:31:03 2312704 ----a-w- C:\windows\System32\jscript9.dll 2012-10-08 11:23:52 1392128 ----a-w- C:\windows\System32\wininet.dll 2012-10-08 11:22:55 1494528 ----a-w- C:\windows\System32\inetcpl.cpl 2012-10-08 11:18:22 173056 ----a-w- C:\windows\System32\ieUnatt.exe 2012-10-08 11:17:35 599040 ----a-w- C:\windows\System32\vbscript.dll 2012-10-08 11:13:33 2382848 ----a-w- C:\windows\System32\mshtml.tlb 2012-10-08 07:56:24 1800704 ----a-w- C:\windows\SysWow64\jscript9.dll 2012-10-08 07:48:03 1129472 ----a-w- C:\windows\SysWow64\wininet.dll 2012-10-08 07:47:44 1427968 ----a-w- C:\windows\SysWow64\inetcpl.cpl 2012-10-08 07:44:05 142848 ----a-w- C:\windows\SysWow64\ieUnatt.exe 2012-10-08 07:43:21 420864 ----a-w- C:\windows\SysWow64\vbscript.dll 2012-10-08 07:40:56 2382848 ----a-w- C:\windows\SysWow64\mshtml.tlb 2012-10-03 17:56:54 1914248 ----a-w- C:\windows\System32\drivers\tcpip.sys 2012-10-03 17:44:21 70656 ----a-w- C:\windows\System32\nlaapi.dll 2012-10-03 17:44:21 303104 ----a-w- C:\windows\System32\nlasvc.dll 2012-10-03 17:44:17 246272 ----a-w- C:\windows\System32\netcorehc.dll 2012-10-03 17:44:17 18944 ----a-w- C:\windows\System32\netevent.dll 2012-10-03 17:44:16 216576 ----a-w- C:\windows\System32\ncsi.dll 2012-10-03 17:42:16 569344 ----a-w- C:\windows\System32\iphlpsvc.dll 2012-10-03 16:42:24 18944 ----a-w- C:\windows\SysWow64\netevent.dll 2012-10-03 16:42:24 175104 ----a-w- C:\windows\SysWow64\netcorehc.dll 2012-10-03 16:42:23 156672 ----a-w- C:\windows\SysWow64\ncsi.dll 2012-10-03 16:07:26 45568 ----a-w- C:\windows\System32\drivers\tcpipreg.sys 2012-09-26 03:04:54 95208 ----a-w- C:\windows\SysWow64\WindowsAccessBridge-32.dll 2012-09-26 03:04:52 821736 ----a-w- C:\windows\SysWow64\npDeployJava1.dll 2012-09-26 03:04:52 746984 ----a-w- C:\windows\SysWow64\deployJava1.dll 2012-09-25 22:47:43 78336 ----a-w- C:\windows\SysWow64\synceng.dll 2012-09-25 22:46:17 95744 ----a-w- C:\windows\System32\synceng.dll 2012-09-14 19:19:29 2048 ----a-w- C:\windows\System32\tzres.dll 2012-09-14 18:28:53 2048 ----a-w- C:\windows\SysWow64\tzres.dll . ============= FINISH: 2:46:00.43 ===============
  7. Ok, here is the text from the Junkware. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Junkware Removal Tool (JRT) by Thisisu Version: 3.9.5 (12.06.2012:6) OS: Windows 7 Home Premium x64 Ran by brandsmart on Fri 12/07/2012 at 1:55:06.17 Blog: http://thisisudax.blogspot.com ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~~ Services Successfully stopped: [service] MyWebSearchService Successfully deleted: [service] MyWebSearchService ~~~ Registry Values Successfully deleted: [Registry Value] hkey_local_machine\software\microsoft\windows\currentversion\run\\My Web Search Bar Search Scope Monitor Successfully deleted: [Registry Value] hkey_current_user\software\microsoft\windows\currentversion\run\\MyWebSearch Email Plugin Successfully deleted: [Registry Value] hkey_current_user\software\microsoft\internet explorer\toolbar\webbrowser\\{30f9b915-b755-4826-820b-08fba6bd249d} Successfully deleted: [Registry Value] hkey_current_user\software\microsoft\internet explorer\toolbar\webbrowser\\{7aeb3efd-e564-43f1-b658-5058a7c5743b} Successfully deleted: [Registry Value] hkey_current_user\software\microsoft\internet explorer\urlsearchhooks\\{7aeb3efd-e564-43f1-b658-5058a7c5743b} Successfully deleted: [Registry Value] hkey_current_user\software\microsoft\internet explorer\toolbar\webbrowser\\{d4027c7f-154a-4066-a1ad-4243d8127440} ~~~ Registry Keys Successfully deleted: [Registry Key] "hkey_current_user\software\appdatalow\software\fun web products" Successfully deleted: [Registry Key] "hkey_current_user\software\appdatalow\software\funwebproducts" Successfully deleted: [Registry Key] "hkey_current_user\software\appdatalow\software\mywebsearch" Successfully deleted: [Registry Key] "hkey_current_user\software\appdatalow\software\pricegong" Successfully deleted: [Registry Key] "hkey_current_user\software\mywebsearch" Successfully deleted: [Registry Key] "hkey_current_user\software\softonic" Successfully deleted: [Registry Key] "hkey_current_user\software\zugo" Successfully deleted: [Registry Key] "hkey_local_machine\software\classes\conduit.engine" Successfully deleted: [Registry Key] "hkey_local_machine\software\classes\funwebproducts.datacontrol" Successfully deleted: [Registry Key] "hkey_local_machine\software\classes\funwebproducts.datacontrol.1" Successfully deleted: [Registry Key] "hkey_local_machine\software\classes\funwebproducts.historykillerscheduler" Successfully deleted: [Registry Key] "hkey_local_machine\software\classes\funwebproducts.historykillerscheduler.1" Successfully deleted: [Registry Key] "hkey_local_machine\software\classes\funwebproducts.historyswattercontrolbar" Successfully deleted: [Registry Key] "hkey_local_machine\software\classes\funwebproducts.historyswattercontrolbar.1" Successfully deleted: [Registry Key] "hkey_local_machine\software\classes\funwebproducts.htmlmenu" Successfully deleted: [Registry Key] "hkey_local_machine\software\classes\funwebproducts.htmlmenu.1" Successfully deleted: [Registry Key] "hkey_local_machine\software\classes\funwebproducts.htmlmenu.2" Successfully deleted: [Registry Key] "hkey_local_machine\software\classes\funwebproducts.iecookiesmanager" Successfully deleted: [Registry Key] "hkey_local_machine\software\classes\funwebproducts.iecookiesmanager.1" Successfully deleted: [Registry Key] "hkey_local_machine\software\classes\funwebproducts.killerobjmanager" Successfully deleted: [Registry Key] "hkey_local_machine\software\classes\funwebproducts.killerobjmanager.1" Successfully deleted: [Registry Key] "hkey_local_machine\software\classes\funwebproducts.popswatterbarbutton" Successfully deleted: [Registry Key] "hkey_local_machine\software\classes\funwebproducts.popswatterbarbutton.1" Successfully deleted: [Registry Key] "hkey_local_machine\software\classes\funwebproducts.popswattersettingscontrol" Successfully deleted: [Registry Key] "hkey_local_machine\software\classes\funwebproducts.popswattersettingscontrol.1" Successfully deleted: [Registry Key] "hkey_local_machine\software\classes\mywebsearch.chatsessionplugin" Successfully deleted: [Registry Key] "hkey_local_machine\software\classes\mywebsearch.chatsessionplugin.1" Successfully deleted: [Registry Key] "hkey_local_machine\software\classes\mywebsearch.htmlpanel" Successfully deleted: [Registry Key] "hkey_local_machine\software\classes\mywebsearch.htmlpanel.1" Successfully deleted: [Registry Key] "hkey_local_machine\software\classes\mywebsearch.multiplebutton" Successfully deleted: [Registry Key] "hkey_local_machine\software\classes\mywebsearch.multiplebutton.1" Successfully deleted: [Registry Key] "hkey_local_machine\software\classes\mywebsearch.outlookaddin" Successfully deleted: [Registry Key] "hkey_local_machine\software\classes\mywebsearch.outlookaddin.1" Successfully deleted: [Registry Key] "hkey_local_machine\software\classes\mywebsearch.pseudotransparentplugin" Successfully deleted: [Registry Key] "hkey_local_machine\software\classes\mywebsearch.pseudotransparentplugin.1" Successfully deleted: [Registry Key] "hkey_local_machine\software\classes\mywebsearch.thirdpartyinstaller" Successfully deleted: [Registry Key] "hkey_local_machine\software\classes\mywebsearch.thirdpartyinstaller.1" Successfully deleted: [Registry Key] "hkey_local_machine\software\classes\mywebsearch.urlalertbutton" Successfully deleted: [Registry Key] "hkey_local_machine\software\classes\mywebsearch.urlalertbutton.1" Successfully deleted: [Registry Key] "hkey_local_machine\software\classes\mywebsearchtoolbar.settingsplugin" Successfully deleted: [Registry Key] "hkey_local_machine\software\classes\mywebsearchtoolbar.settingsplugin.1" Successfully deleted: [Registry Key] "hkey_local_machine\software\classes\mywebsearchtoolbar.toolbarplugin" Successfully deleted: [Registry Key] "hkey_local_machine\software\classes\mywebsearchtoolbar.toolbarplugin.1" Successfully deleted: [Registry Key] "hkey_local_machine\software\classes\screensavercontrol.screensaverinstaller" Successfully deleted: [Registry Key] "hkey_local_machine\software\classes\screensavercontrol.screensaverinstaller.1" Successfully deleted: [Registry Key] "hkey_local_machine\software\conduit" Successfully deleted: [Registry Key] "hkey_local_machine\software\focusinteractive" Successfully deleted: [Registry Key] "hkey_local_machine\software\fun web products" Successfully deleted: [Registry Key] "hkey_local_machine\software\mywebsearch" Successfully deleted: [Registry Key] hkey_classes_root\clsid\{00a6faf1-072e-44cf-8957-5838f569a31d} Successfully deleted: [Registry Key] hkey_classes_root\clsid\{00a6faf6-072e-44cf-8957-5838f569a31d} Successfully deleted: [Registry Key] hkey_classes_root\clsid\{07b18ea1-a523-4961-b6bb-170de4475cca} Successfully deleted: [Registry Key] hkey_classes_root\clsid\{07b18ea9-a523-4961-b6bb-170de4475cca} Successfully deleted: [Registry Key] hkey_classes_root\clsid\{07b18eab-a523-4961-b6bb-170de4475cca} Successfully deleted: [Registry Key] hkey_classes_root\clsid\{08858af6-42ad-4914-95d2-ac3ab0dc8e28} Successfully deleted: [Registry Key] hkey_classes_root\clsid\{0f8ecf4f-3646-4c3a-8881-8e138ffcaf70} Successfully deleted: [Registry Key] hkey_classes_root\clsid\{147a976f-eee1-4377-8ea7-4716e4cdd239} Successfully deleted: [Registry Key] hkey_classes_root\clsid\{1e0de227-5ce4-4ea3-ab0c-8b03e1aa76bc} Successfully deleted: [Registry Key] hkey_classes_root\clsid\{25560540-9571-4d7b-9389-0f166788785a} Successfully deleted: [Registry Key] hkey_classes_root\clsid\{3dc201fb-e9c9-499c-a11f-23c360d7c3f8} Successfully deleted: [Registry Key] hkey_classes_root\clsid\{3e720452-b472-4954-b7aa-33069eb53906} Successfully deleted: [Registry Key] hkey_classes_root\clsid\{53ced2d0-5e9a-4761-9005-648404e6f7e5} Successfully deleted: [Registry Key] hkey_current_user\software\microsoft\internet explorer\searchscopes\{56256a51-b582-467e-b8d4-7786eda79ae0} Successfully deleted: [Registry Key] hkey_local_machine\software\microsoft\internet explorer\searchscopes\{56256a51-b582-467e-b8d4-7786eda79ae0} Successfully deleted: [Registry Key] hkey_classes_root\clsid\{63d0ed2c-b45b-4458-8b3b-60c69bbbd83c} Successfully deleted: [Registry Key] hkey_classes_root\clsid\{7473d292-b7bb-4f24-ae82-7e2ce94bb6a9} Successfully deleted: [Registry Key] hkey_classes_root\clsid\{7473d294-b7bb-4f24-ae82-7e2ce94bb6a9} Successfully deleted: [Registry Key] hkey_classes_root\clsid\{7473d296-b7bb-4f24-ae82-7e2ce94bb6a9} Successfully deleted: [Registry Key] hkey_classes_root\clsid\{799391d3-eb86-4bac-9bd3-cbfea58a0e15} Successfully deleted: [Registry Key] hkey_classes_root\clsid\{819ffe22-35c7-4925-8cda-4e0e2db94302} Successfully deleted: [Registry Key] hkey_classes_root\clsid\{84da4fdf-a1cf-4195-8688-3e961f505983} Successfully deleted: [Registry Key] hkey_classes_root\clsid\{8e6f1832-9607-4440-8530-13be7c4b1d14} Successfully deleted: [Registry Key] hkey_classes_root\clsid\{938aa51a-996c-4884-98ce-80dd16a5c9da} Successfully deleted: [Registry Key] hkey_classes_root\clsid\{98d9753d-d73b-42d5-8c85-4469cda897ab} Successfully deleted: [Registry Key] hkey_classes_root\clsid\{9afb8248-617f-460d-9366-d71cdeda3179} Successfully deleted: [Registry Key] hkey_classes_root\clsid\{9ff05104-b030-46fc-94b8-81276e4e27df} Successfully deleted: [Registry Key] hkey_classes_root\clsid\{a9571378-68a1-443d-b082-284f960c6d17} Successfully deleted: [Registry Key] hkey_classes_root\clsid\{adb01e81-3c79-4272-a0f1-7b2be7a782dc} Successfully deleted: [Registry Key] hkey_current_user\software\microsoft\internet explorer\searchscopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b} Successfully deleted: [Registry Key] hkey_local_machine\software\microsoft\internet explorer\searchscopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b} Successfully deleted: [Registry Key] hkey_classes_root\clsid\{b813095c-81c0-4e40-aa14-67520372b987} Successfully deleted: [Registry Key] hkey_classes_root\clsid\{c9d7be3e-141a-4c85-8cd6-32461f3df2c7} Successfully deleted: [Registry Key] hkey_classes_root\clsid\{cff4ce82-3aa2-451f-9b77-7165605fb835} Successfully deleted: [Registry Key] hkey_classes_root\clsid\{d858dafc-9573-4811-b323-7011a3aa7e61} Successfully deleted: [Registry Key] hkey_classes_root\clsid\{d9fffb27-d62a-4d64-8cec-1ff006528805} Successfully deleted: [Registry Key] hkey_classes_root\clsid\{e79dfbca-5697-4fbd-94e5-5b2a9c7c1612} ~~~ Files Successfully deleted: [File] "C:\windows\syswow64\f3pssavr.scr" ~~~ Folders Successfully deleted: [Folder] "C:\Users\brandsmart\appdata\local\conduit" Successfully deleted: [Folder] "C:\Users\brandsmart\appdata\locallow\conduit" Successfully deleted: [Folder] "C:\Users\brandsmart\appdata\locallow\funwebproducts" Successfully deleted: [Folder] "C:\Users\brandsmart\appdata\locallow\mywebsearch" Successfully deleted: [Folder] "C:\Users\brandsmart\appdata\locallow\pricegong" Successfully deleted: [Folder] "C:\Program Files (x86)\funwebproducts" Successfully deleted: [Folder] "C:\Program Files (x86)\mywebsearch" Successfully deleted: [Folder] "C:\windows\buzzsocialpointschecker" ~~~ FireFox Successfully deleted: [File] "C:\Program Files (x86)\Mozilla Firefox\searchplugins\bing.xml.old" Successfully deleted: [File] C:\Users\brandsmart\AppData\Roaming\mozilla\firefox\profiles\cqfudqqy.default\searchplugins\bing-zugo.xml Successfully deleted: [File] C:\Users\brandsmart\AppData\Roaming\mozilla\firefox\profiles\cqfudqqy.default\searchplugins\conduit.xml Successfully deleted: [Folder] C:\Users\brandsmart\AppData\Roaming\mozilla\firefox\profiles\cqfudqqy.default\conduitcommon Successfully deleted: [Folder] C:\Users\brandsmart\AppData\Roaming\mozilla\firefox\profiles\cqfudqqy.default\extensions\4nffxtbr@ConservativeTalkNow_4n.com Successfully deleted: [Registry Value] hkey_local_machine\software\mozilla\firefox\extensions\\4nffxtbr@ConservativeTalkNow_4n.com Successfully deleted: [Registry Value] hkey_local_machine\software\mozilla\firefox\extensions\\m3ffxtbr@mywebsearch.com Successfully deleted the following from C:\Users\brandsmart\AppData\Roaming\mozilla\firefox\profiles\cqfudqqy.default\prefs.js user_pref("CT2818425..clientLogIsEnabled", true); user_pref("CT2818425..clientLogServiceUrl", "http://clientlog.users.conduit.com/ClientDiagnostics.asmx/ReportDiagnosticsEvent"); user_pref("CT2818425..uninstallLogServiceUrl", "http://uninstall.users.conduit.com/Uninstall.asmx/RegisterToolbarUninstallation"); user_pref("CT2818425.ALLOW_SHOWING_HIDDEN_TOOLBAR", false); user_pref("CT2818425.AboutPrivacyUrl", "http://www.conduit.com/privacy/Default.aspx"); user_pref("CT2818425.AppTrackingLastCheckTime", "Thu Nov 03 2011 15:18:48 GMT-0400 (Eastern Daylight Time)"); user_pref("CT2818425.CTID", "CT2818425"); user_pref("CT2818425.CurrentServerDate", "10-11-2011"); user_pref("CT2818425.DialogsAlignMode", "LTR"); user_pref("CT2818425.DialogsGetterLastCheckTime", "Thu Nov 10 2011 07:19:47 GMT-0500 (Eastern Standard Time)"); user_pref("CT2818425.DownloadReferralCookieData", ""); user_pref("CT2818425.EMailNotifierPollDate", "Thu Nov 10 2011 08:24:52 GMT-0500 (Eastern Standard Time)"); user_pref("CT2818425.FirstServerDate", "10-9-2011"); user_pref("CT2818425.FirstTime", true); user_pref("CT2818425.FirstTimeFF3", true); user_pref("CT2818425.FixPageNotFoundErrors", true); user_pref("CT2818425.GroupingServerCheckInterval", 1440); user_pref("CT2818425.GroupingServiceUrl", "http://grouping.services.conduit.com/"); user_pref("CT2818425.HasUserGlobalKeys", true); user_pref("CT2818425.HomePageProtectorEnabled", true); user_pref("CT2818425.HomepageBeforeUnload", "http://search.conduit.com/?ctid=CT2818425&SearchSource=13"); user_pref("CT2818425.Initialize", true); user_pref("CT2818425.InitializeCommonPrefs", true); user_pref("CT2818425.InstallationAndCookieDataSentCount", 3); user_pref("CT2818425.InstallationId", "ConduitStubGeneric"); user_pref("CT2818425.InstallationType", "ConduitStubIntegration"); user_pref("CT2818425.InstalledDate", "Sat Sep 10 2011 09:53:30 GMT-0400 (Eastern Daylight Time)"); user_pref("CT2818425.InvalidateCache", false); user_pref("CT2818425.IsAlertDBUpdated", true); user_pref("CT2818425.IsGrouping", false); user_pref("CT2818425.IsInitSetupIni", true); user_pref("CT2818425.IsMulticommunity", false); user_pref("CT2818425.IsOpenThankYouPage", false); user_pref("CT2818425.IsOpenUninstallPage", true); user_pref("CT2818425.IsProtectorsInit", true); user_pref("CT2818425.LanguagePackLastCheckTime", "Thu Nov 10 2011 07:19:47 GMT-0500 (Eastern Standard Time)"); user_pref("CT2818425.LanguagePackReloadIntervalMM", 1440); user_pref("CT2818425.LanguagePackServiceUrl", "http://translation.users.conduit.com/Translation.ashx"); user_pref("CT2818425.LastLogin_3.6.0.10", "Tue Sep 27 2011 20:43:23 GMT-0400 (Eastern Daylight Time)"); user_pref("CT2818425.LastLogin_3.7.0.6", "Thu Nov 10 2011 07:19:47 GMT-0500 (Eastern Standard Time)"); user_pref("CT2818425.LastLogin_3.8.0.8", "Thu Nov 10 2011 08:27:01 GMT-0500 (Eastern Standard Time)"); user_pref("CT2818425.LatestVersion", "3.8.0.8"); user_pref("CT2818425.Locale", "en"); user_pref("CT2818425.MCDetectTooltipHeight", "83"); user_pref("CT2818425.MCDetectTooltipUrl", "http://@EB_INSTALL_LINK@/rank/tooltip/?version=1"); user_pref("CT2818425.MCDetectTooltipWidth", "295"); user_pref("CT2818425.MyStuffEnabledAtInstallation", true); user_pref("CT2818425.OriginalFirstVersion", "3.6.0.10"); user_pref("CT2818425.RadioIsPodcast", false); user_pref("CT2818425.RadioLastCheckTime", "Thu Nov 10 2011 07:19:47 GMT-0500 (Eastern Standard Time)"); user_pref("CT2818425.RadioLastUpdateIPServer", "3"); user_pref("CT2818425.RadioLastUpdateServer", "129330101464100000"); user_pref("CT2818425.RadioMediaID", "21515677"); user_pref("CT2818425.RadioMediaType", "Media Player"); user_pref("CT2818425.RadioMenuSelectedID", "EBRadioMenu_CT281842521515677"); user_pref("CT2818425.RadioShrinkedFromSetup", false); user_pref("CT2818425.RadioStationName", "Virgin%20Radio%20Classic%20Rock"); user_pref("CT2818425.RadioStationURL", "http://www.smgradio.com/core/audio/wmp/live.asx?service=vcbb"); user_pref("CT2818425.SavedHomepage", "http://dm.startnow.com/?src=startpage&provider=bing&provider_name=bing&provider_code=Z055&partner_id=195&product_id=611&affiliate_id=&channel=dm5&toolbar_id=200&t user_pref("CT2818425.SearchEngineBeforeUnload", "vshare.tv Bar Customized Web Search"); user_pref("CT2818425.SearchFromAddressBarIsInit", true); user_pref("CT2818425.SearchFromAddressBarUrl", "http://search.conduit.com/ResultsExt.aspx?ctid=CT2818425&SearchSource=2&q="); user_pref("CT2818425.SearchInNewTabEnabled", true); user_pref("CT2818425.SearchInNewTabIntervalMM", 1440); user_pref("CT2818425.SearchInNewTabLastCheckTime", "Thu Nov 10 2011 07:19:45 GMT-0500 (Eastern Standard Time)"); user_pref("CT2818425.SearchInNewTabServiceUrl", "http://newtab.conduit-hosting.com/newtab/?ctid=EB_TOOLBAR_ID"); user_pref("CT2818425.SearchInNewTabUsageUrl", "http://usage.hosting.toolbar.conduit-services.com/usage.ashx?ctid=EB_TOOLBAR_ID"); user_pref("CT2818425.SearchInNewTabUserEnabled", false); user_pref("CT2818425.SearchProtectorEnabled", true); user_pref("CT2818425.SearchProtectorToolbarDisabled", false); user_pref("CT2818425.ServiceMapLastCheckTime", "Thu Nov 10 2011 07:19:46 GMT-0500 (Eastern Standard Time)"); user_pref("CT2818425.SettingsLastCheckTime", "Thu Nov 10 2011 07:19:45 GMT-0500 (Eastern Standard Time)"); user_pref("CT2818425.SettingsLastUpdate", "1314770452"); user_pref("CT2818425.ThirdPartyComponentsInterval", 504); user_pref("CT2818425.ThirdPartyComponentsLastCheck", "Sat Oct 22 2011 15:31:29 GMT-0400 (Eastern Daylight Time)"); user_pref("CT2818425.ThirdPartyComponentsLastUpdate", "1312887586"); user_pref("CT2818425.ToolbarShrinkedFromSetup", false); user_pref("CT2818425.TrusteLinkUrl", "http://trust.conduit.com/CT2818425"); user_pref("CT2818425.TrustedApiDomains", "conduit.com,conduit-hosting.com,conduit-services.com,client.conduit-storage.com,OurToolbar.com,CommunityToolbars.com,ForumToolbar.com,MyBlogToolbar.com,MyCity user_pref("CT2818425.UserID", "UN59813431504397145"); user_pref("CT2818425.alertChannelId", "1210492"); user_pref("CT2818425.generalConfigFromLogin", "{\"ApiMaxAlerts\":\"12\",\"SocialDomains\":\"social.conduit.com;apps.conduit.com;services.apps.conduit.com\",\"AppsDetectionUrlPattern\":\"http://appdown user_pref("CT2818425.globalFirstTimeInfoLastCheckTime", "Thu Nov 10 2011 07:19:47 GMT-0500 (Eastern Standard Time)"); user_pref("CT2818425.homepageProtectorEnableByLogin", true); user_pref("CT2818425.initDone", true); user_pref("CT2818425.isAppTrackingManagerOn", true); user_pref("CT2818425.isFirstRadioInstallation", false); user_pref("CT2818425.myStuffEnabled", true); user_pref("CT2818425.myStuffPublihserMinWidth", 400); user_pref("CT2818425.myStuffSearchUrl", "http://Apps.conduit.com/search?q=SEARCH_TERM&SearchSourceOrigin=29&ctid=EB_TOOLBAR_ID&octid=EB_ORIGINAL_CTID"); user_pref("CT2818425.myStuffServiceIntervalMM", 1440); user_pref("CT2818425.myStuffServiceUrl", "http://mystuff.conduit-services.com/MyStuffService.ashx?ComponentId=EB_MY_STUFF_INSTANCE_GUID&lut=EB_MY_STUFF_LUT"); user_pref("CT2818425.oldAppsList", "129320401456081839,129320401456081840,111,7071898492715082350,129320423773893997,129320419773581338,129320407169518972,129320408417175918,1000082,129331598259106948 user_pref("CT2818425.revertSettingsEnabled", false); user_pref("CT2818425.searchProtectorDialogDelayInSec", 10); user_pref("CT2818425.searchProtectorEnableByLogin", true); user_pref("CT2818425.testingCtid", ""); user_pref("CT2818425.toolbarAppMetaDataLastCheckTime", "Thu Nov 10 2011 07:19:47 GMT-0500 (Eastern Standard Time)"); user_pref("CT2818425.toolbarContextMenuLastCheckTime", "Sat Nov 05 2011 21:08:33 GMT-0400 (Eastern Daylight Time)"); user_pref("CommunityToolbar.ConduitHomepagesList", "http://search.conduit.com/?ctid=CT2818425&SearchSource=13"); user_pref("CommunityToolbar.ConduitSearchList", "vshare.tv Bar Customized Web Search"); user_pref("CommunityToolbar.ETag.http://alerts.conduit-services.com/root/1210492/1206165/US", "\"0\""); user_pref("CommunityToolbar.ETag.http://appsmetadata.toolbar.conduit-services.com/?ctid=CT2818425", "\"1288682875\""); user_pref("CommunityToolbar.ETag.http://contextmenu.toolbar.conduit-services.com/?name=GottenApps&locale=en", "wVmmvqqOMqrv5xct1cJIHg=="); user_pref("CommunityToolbar.ETag.http://contextmenu.toolbar.conduit-services.com/?name=OtherApps&locale=en", "0uSPYx+Kl2jpu8sJZMeHjw=="); user_pref("CommunityToolbar.ETag.http://contextmenu.toolbar.conduit-services.com/?name=SharedApps&locale=en", "Dclc8oo4TTv7+mAkSlUSWg=="); user_pref("CommunityToolbar.ETag.http://contextmenu.toolbar.conduit-services.com/?name=Toolbar&locale=en", "K4Vqu91uAzWURlxJRdXJOg=="); user_pref("CommunityToolbar.ETag.http://dynamicdialogs.alert.conduit-services.com/alert/dlg.pkg", "\"07879643d3acc1:0\""); user_pref("CommunityToolbar.ETag.http://dynamicdialogs.toolbar.conduit-services.com/DLG.pkg?ver=3.6.0.10", "\"0ee90707f77cc1:0\""); user_pref("CommunityToolbar.ETag.http://dynamicdialogs.toolbar.conduit-services.com/DLG.pkg?ver=3.7.0.6", "\"80ee9485875dcc1:0\""); user_pref("CommunityToolbar.ETag.http://servicemap.conduit-services.com/Toolbar/?ownerId=CT2818425", "\"56fe0d15406c7b69464328b19c048ede\""); user_pref("CommunityToolbar.ETag.http://settings.toolbar.conduit-services.com/?ctid=CT2818425&octid=CT2818425", "\"1314770452\""); user_pref("CommunityToolbar.ETag.http://translation.toolbar.conduit-services.com/?locale=EB_LOCALE", "\"634515953213470000\""); user_pref("CommunityToolbar.ETag.http://translation.toolbar.conduit-services.com/?locale=en", "\"1d81252562c31be757300e4205a85371\""); user_pref("CommunityToolbar.LatestLibsPath", "file:///C:\\Users\\brandsmart\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\cqfudqqy.default\\conduitCommon\\modules\\3.8.0.8"); user_pref("CommunityToolbar.LatestToolbarVersionInstalled", "3.8.0.8"); user_pref("CommunityToolbar.SearchFromAddressBarSavedUrl", "http://dm.startnow.com/s/?src=addrbar&provider=bing&provider_name=bing&provider_code=Z055&partner_id=195&product_id=611&affiliate_id=&channe user_pref("CommunityToolbar.ToolbarsList", "CT2818425"); user_pref("CommunityToolbar.ToolbarsList2", "CT2818425"); user_pref("CommunityToolbar.ToolbarsList4", "CT2818425"); user_pref("CommunityToolbar.facebook.settingsLastCheckTime", "Thu Nov 10 2011 07:19:46 GMT-0500 (Eastern Standard Time)"); user_pref("CommunityToolbar.globalUserId", "9c8acd4b-9e45-4ab7-a20f-87e2034f98ab"); user_pref("CommunityToolbar.isAlertUrlAddedToFeedItemTable", true); user_pref("CommunityToolbar.isClickActionAddedToFeedItemTable", true); user_pref("CommunityToolbar.notifications.alertDialogsGetterLastCheckTime", "Sun Nov 06 2011 18:59:40 GMT-0500 (Eastern Standard Time)"); user_pref("CommunityToolbar.notifications.alertInfoInterval", 1440); user_pref("CommunityToolbar.notifications.alertInfoLastCheckTime", "Thu Nov 10 2011 07:19:55 GMT-0500 (Eastern Standard Time)"); user_pref("CommunityToolbar.notifications.clientsServerUrl", "http://alert.client.conduit.com"); user_pref("CommunityToolbar.notifications.locale", "en"); user_pref("CommunityToolbar.notifications.loginIntervalMin", 1440); user_pref("CommunityToolbar.notifications.loginLastCheckTime", "Thu Nov 10 2011 07:19:46 GMT-0500 (Eastern Standard Time)"); user_pref("CommunityToolbar.notifications.loginLastUpdateTime", "1313487611"); user_pref("CommunityToolbar.notifications.messageShowTimeSec", 20); user_pref("CommunityToolbar.notifications.servicesServerUrl", "http://alert.services.conduit.com"); user_pref("CommunityToolbar.notifications.showTrayIcon", false); user_pref("CommunityToolbar.notifications.userCloseIntervalMin", 300); user_pref("CommunityToolbar.notifications.userId", "7832d736-8348-463c-a888-ba7a54143e70"); user_pref("browser.search.defaultenginename", "Web Search..."); user_pref("browser.search.defaultthis.engineName", "vshare.tv Bar Customized Web Search"); user_pref("browser.search.defaulturl", "http://search.conduit.com/ResultsExt.aspx?ctid=CT2818425&SearchSource=3&q={searchTerms}"); user_pref("browser.search.selectedEngine", "vshare.tv Bar Customized Web Search"); user_pref("extensions.installCache", "[{\"name\":\"winreg-app-global\",\"addons\":{\"m3ffxtbr@mywebsearch.com\":{\"descriptor\":\"C:\\\\Program Files (x86)\\\\MyWebSearch\\\\bar\\\\2.bin\",\"mtime\":1 user_pref("extensions.wrc.SearchRules.ask.com.style", ".WRCN {display:none} #yui-main .tsrc_vnru .title + .WRCN, #yui-main #teoma-results .title + .WRCN {display:inline !important; background: url(\"I user_pref("extensions.wrc.SearchRules.ask.com.url", "^http(s)?\\:\\/\\/(.+\\.)?ask\\.com\\/.*"); user_pref("extensions.wrc.SearchRules.baidu.com.style", ".WRCN {display:none} .result .f .WRCN {display:inline !important; background: url(\"IMAGE\") right no-repeat}"); user_pref("extensions.wrc.SearchRules.baidu.com.url", "^http\\:\\/\\/www\\.baidu\\.com\\/.*"); user_pref("extensions.wrc.SearchRules.excite.com.style", ".WRCN {display:none} .listing .resultsLink + .WRCN {display:inline !important; background: url(\"IMAGE\") right no-repeat}"); user_pref("extensions.wrc.SearchRules.excite.com.url", "^http\\:\\/\\/msxml\\.excite\\.com\\/excite\\/ws\\/.+"); user_pref("extensions.wrc.SearchRules.rambler.ru.style", ".WRCN {display:none} .search-results .title + .WRCN {display:inline !important; background: url(\"IMAGE\") right no-repeat}"); user_pref("keyword.URL", "http://dm.startnow.com/s/?src=addrbar&provider=bing&provider_name=bing&provider_code=Z055&partner_id=195&product_id=611&affiliate_id=&channel=dm5&toolbar_id=200&toolbar_versi user_pref("vshare.install.date", "1304121600000"); user_pref("vshare.install.dumpFileCount", 0); user_pref("vshare.install.dumpFileDisabled", false); user_pref("vshare.install.finished", "1.0.0"); user_pref("vshare.install.guid", "{70e32f29-2499-489a-bfb3-d8d87cab6c83}"); user_pref("vshare.install.isHidden", true); user_pref("vshare.install.istoolbarhp", true); user_pref("vshare.install.istoolbarsearch", true); user_pref("vshare.install.laststatreq", "1308960000000"); user_pref("vshare.install.newtab", true); user_pref("vshare.install.overlayVersion", 1); user_pref("vshare.install.userHPSettings", "http://www.google.com/"); user_pref("vshare.install.userSPSettings", ""); ~~~ Event Viewer Logs were cleared ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Scan was completed on Fri 12/07/2012 at 2:11:43.59 End of JRT log ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ and here is the MBAM Log Malwarebytes Anti-Malware (Trial) 1.65.1.1000 www.malwarebytes.org Database version: v2012.12.07.03 Windows 7 Service Pack 1 x64 NTFS Internet Explorer 9.0.8112.16421 brandsmart :: BRANDSMART-PC [administrator] Protection: Enabled 12/7/2012 2:15:05 AM mbam-log-2012-12-07 (02-15-05).txt Scan type: Quick scan Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM Scan options disabled: P2P Objects scanned: 231269 Time elapsed: 8 minute(s), 53 second(s) Memory Processes Detected: 0 (No malicious items detected) Memory Modules Detected: 0 (No malicious items detected) Registry Keys Detected: 54 HKCR\Interface\{07B18EAA-A523-4961-B6BB-170DE4475CCA} (PUP.MyWebSearch) -> Quarantined and deleted successfully. HKCR\Typelib\{0D26BC71-A633-4E71-AD31-EADC3A1B6A3A} (PUP.MyWebSearch) -> Quarantined and deleted successfully. HKCR\Interface\{E342AF55-B78A-4CD0-A2BB-DA7F52D9D25E} (PUP.MyWebSearch) -> Quarantined and deleted successfully. HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{F138D901-86F0-4383-99B6-9CDD406036DA} (PUP.MyWebSearch) -> Quarantined and deleted successfully. HKCR\Interface\{2E3537FC-CF2F-4F56-AF54-5A6A3DD375CC} (PUP.MyWebSearch) -> Quarantined and deleted successfully. HKCR\Typelib\{3E720450-B472-4954-B7AA-33069EB53906} (PUP.MyWebSearch) -> Quarantined and deleted successfully. HKCR\Interface\{3E720451-B472-4954-B7AA-33069EB53906} (PUP.MyWebSearch) -> Quarantined and deleted successfully. HKCR\Typelib\{29D67D3C-509A-4544-903F-C8C1B8236554} (PUP.MyWebSearch) -> Quarantined and deleted successfully. HKCR\Interface\{7473D291-B7BB-4F24-AE82-7E2CE94BB6A9} (PUP.MyWebSearch) -> Quarantined and deleted successfully. HKCR\Typelib\{8CA01F0E-987C-49C3-B852-2F1AC4A7094C} (PUP.MyWebSearch) -> Quarantined and deleted successfully. HKCR\Interface\{1093995A-BA37-41D2-836E-091067C4AD17} (PUP.MyWebSearch) -> Quarantined and deleted successfully. HKCR\Typelib\{8E6F1830-9607-4440-8530-13BE7C4B1D14} (PUP.MyWebSearch) -> Quarantined and deleted successfully. HKCR\Interface\{63D0ED2B-B45B-4458-8B3B-60C69BBBD83C} (PUP.MyWebSearch) -> Quarantined and deleted successfully. HKCR\Typelib\{C8CECDE3-1AE1-4C4A-AD82-6D5B00212144} (PUP.MyWebSearch) -> Quarantined and deleted successfully. HKCR\Interface\{17DE5E5E-BFE3-4E83-8E1F-8755795359EC} (PUP.MyWebSearch) -> Quarantined and deleted successfully. HKCR\Typelib\{D518921A-4A03-425E-9873-B9A71756821E} (PUP.MyWebSearch) -> Quarantined and deleted successfully. HKCR\Typelib\{07B18EA0-A523-4961-B6BB-170DE4475CCA} (PUP.MyWebSearch) -> Quarantined and deleted successfully. HKCR\Typelib\{E47CAEE0-DEEA-464A-9326-3F2801535A4D} (PUP.MyWebSearch) -> Quarantined and deleted successfully. HKCR\Interface\{3E1656ED-F60E-4597-B6AA-B6A58E171495} (PUP.MyWebSearch) -> Quarantined and deleted successfully. HKCR\Typelib\{E79DFBC0-5697-4FBD-94E5-5B2A9C7C1612} (PUP.MyWebSearch) -> Quarantined and deleted successfully. HKCR\Interface\{72EE7F04-15BD-4845-A005-D6711144D86A} (PUP.MyWebSearch) -> Quarantined and deleted successfully. HKCR\Typelib\{F42228FB-E84E-479E-B922-FBBD096E792C} (PUP.MyWebSearch) -> Quarantined and deleted successfully. HKCR\Interface\{6E74766C-4D93-4CC0-96D1-47B8E07FF9CA} (PUP.MyWebSearch) -> Quarantined and deleted successfully. HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{00A6FAF1-072E-44CF-8957-5838F569A31D} (PUP.MyWebSearch) -> Quarantined and deleted successfully. HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{00A6FAF1-072E-44CF-8957-5838F569A31D} (PUP.MyWebSearch) -> Quarantined and deleted successfully. HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{07B18EA1-A523-4961-B6BB-170DE4475CCA} (PUP.MyWebSearch) -> Quarantined and deleted successfully. HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{07B18EA1-A523-4961-B6BB-170DE4475CCA} (PUP.MyWebSearch) -> Quarantined and deleted successfully. HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{07B18EA9-A523-4961-B6BB-170DE4475CCA} (PUP.MyWebSearch) -> Quarantined and deleted successfully. HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{07B18EA9-A523-4961-B6BB-170DE4475CCA} (PUP.MyWebSearch) -> Quarantined and deleted successfully. HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{00A6FAF6-072E-44CF-8957-5838F569A31D} (PUP.MyWebSearch) -> Quarantined and deleted successfully. HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{07B18EAB-A523-4961-B6BB-170DE4475CCA} (PUP.MyWebSearch) -> Quarantined and deleted successfully. HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{07B18EAB-A523-4961-B6BB-170DE4475CCA} (PUP.MyWebSearch) -> Quarantined and deleted successfully. HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{9FF05104-B030-46FC-94B8-81276E4E27DF} (PUP.MyWebSearch) -> Quarantined and deleted successfully. HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{9FF05104-B030-46FC-94B8-81276E4E27DF} (PUP.MyWebSearch) -> Quarantined and deleted successfully. HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{59C7FC09-1C83-4648-B3E6-003D2BBC7481} (PUP.MyWebSearch) -> Quarantined and deleted successfully. HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{68AF847F-6E91-45dd-9B68-D6A12C30E5D7} (PUP.MyWebSearch) -> Quarantined and deleted successfully. HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{9170B96C-28D4-4626-8358-27E6CAEEF907} (PUP.MyWebSearch) -> Quarantined and deleted successfully. HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{D1A71FA0-FF48-48dd-9B6D-7A13A3E42127} (PUP.MyWebSearch) -> Quarantined and deleted successfully. HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{DDB1968E-EAD6-40fd-8DAE-FF14757F60C7} (PUP.MyWebSearch) -> Quarantined and deleted successfully. HKLM\SOFTWARE\MozillaPlugins\@mywebsearch.com/Plugin (PUP.MyWebSearch) -> Quarantined and deleted successfully. HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{25560540-9571-4D7B-9389-0F166788785A} (PUP.MyWebSearch) -> Quarantined and deleted successfully. HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{3DC201FB-E9C9-499C-A11F-23C360D7C3F8} (PUP.MyWebSearch) -> Quarantined and deleted successfully. HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{3E720452-B472-4954-B7AA-33069EB53906} (PUP.MyWebSearch) -> Quarantined and deleted successfully. HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{63D0ED2C-B45B-4458-8B3B-60C69BBBD83C} (PUP.MyWebSearch) -> Quarantined and deleted successfully. HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{7473D294-B7BB-4f24-AE82-7E2CE94BB6A9} (PUP.MyWebSearch) -> Quarantined and deleted successfully. HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{98D9753D-D73B-42D5-8C85-4469CDA897AB} (PUP.MyWebSearch) -> Quarantined and deleted successfully. HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{E79DFBCA-5697-4fbd-94E5-5B2A9C7C1612} (PUP.MyWebSearch) -> Quarantined and deleted successfully. HKCR\Typelib\{7473D290-B7BB-4F24-AE82-7E2CE94BB6A9} (PUP.MyWebSearch) -> Quarantined and deleted successfully. HKLM\SOFTWARE\Microsoft\Office\Word\Addins\MyWebSearch.OutlookAddin (PUP.MyWebSearch) -> Quarantined and deleted successfully. HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\RunDll32Policy\f3ScrCtr.dll (PUP.MyWebSearch) -> Quarantined and deleted successfully. HKLM\SOFTWARE\Microsoft\Multimedia\WMPlayer\Schemes\f3pss (PUP.MyWebSearch) -> Quarantined and deleted successfully. HKLM\SOFTWARE\Microsoft\Office\Outlook\Addins\MyWebSearch.OutlookAddin (PUP.MyWebSearch) -> Quarantined and deleted successfully. HKCR\Interface\{CF54BE1C-9359-4395-8533-1657CF209CFE} (PUP.MyWebSearch) -> Quarantined and deleted successfully. HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MyWebSearch bar Uninstall (PUP.MyWebSearch) -> Quarantined and deleted successfully. Registry Values Detected: 2 HKLM\SOFTWARE\Microsoft\Windows Media\WMSDK\Sources|f3PopularScreensavers (PUP.MyWebSearch) -> Data: C:\Program Files (x86)\MyWebSearch\bar\2.bin\F3SCRCTR.DLL -> Quarantined and deleted successfully. HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform|FunWebProducts (PUP.MyWebSearch) -> Data: -> Quarantined and deleted successfully. Registry Data Items Detected: 0 (No malicious items detected) Folders Detected: 0 (No malicious items detected) Files Detected: 2 C:\Users\brandsmart\AppData\Local\Temp\.exe (Trojan.Agent) -> Quarantined and deleted successfully. C:\Users\brandsmart\Downloads\Acapella Praise - Hosanna! Music (1993).mp3.exe (Affiliate.Downloader) -> Quarantined and deleted successfully. (end)
  8. Also the Junkware Removal tool came up with a warning on my avast? and the origin "thisissudax" doesnt exist? and there's no digital signature is this safe to use? Sorry for so many questions , but just want to make sure in the removal process i dont screw the computer up more than it was before , cause its my moms laptop....
  9. Thank you for the help once again, 2 things. I uninstalled all the things you asked , the only one that i couldnt was the MyWebSearch when i tried to uninstall it this was the message i got. and 2. Will going on ahead and removing all the infections affect the computer, since some of the files seems to have affected System 32? or is it safe to remove them.
  10. Ok, thank you so much for your response. Here is the requested information The DDS DDS (Ver_2012-11-20.01) - NTFS_AMD64 Internet Explorer: 9.0.8112.16455 BrowserJavaVersion: 10.7.2 Run by brandsmart at 0:21:41 on 2012-12-05 #Option Extended Search is enabled. Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.3836.1099 [GMT -5:00] . AV: avast! Antivirus *Enabled/Updated* {2B2D1395-420B-D5C9-657E-930FE358FC3C} AV: Norton Internet Security *Disabled/Outdated* {88C95A36-8C3B-2F2C-1B8B-30FCCFDC4855} SP: avast! Antivirus *Enabled/Updated* {904CF271-6431-DA47-5FCE-A87D98DFB681} SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} SP: Norton Internet Security *Enabled/Outdated* {33A8BBD2-AA01-20A2-213B-0B8EB45B02E8} FW: Norton Internet Security *Disabled* {B0F2DB13-C654-2E74-30D4-99C9310F0F2E} . ============== Running Processes =============== . C:\windows\system32\lsm.exe C:\windows\system32\svchost.exe -k DcomLaunch C:\windows\system32\svchost.exe -k RPCSS C:\windows\system32\atiesrxx.exe C:\windows\System32\svchost.exe -k LocalServiceNetworkRestricted C:\windows\System32\svchost.exe -k LocalSystemNetworkRestricted C:\windows\system32\svchost.exe -k netsvcs C:\windows\system32\svchost.exe -k LocalService C:\windows\system32\svchost.exe -k NetworkService C:\Program Files\AVAST Software\Avast\AvastSvc.exe C:\windows\system32\atieclxx.exe C:\windows\System32\spoolsv.exe C:\windows\system32\svchost.exe -k LocalServiceNoNetwork C:\windows\SysWOW64\afasrv64.exe C:\windows\SysWOW64\svchost.exe -k Akamai C:\windows\system32\taskhost.exe C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe C:\windows\system32\Dwm.exe C:\windows\Explorer.EXE C:\Program Files\Bonjour\mDNSResponder.exe C:\Program Files (x86)\Canon\IJPLM\IJPLMSVC.EXE C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe C:\Program Files (x86)\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe C:\PROGRA~2\MYWEBS~1\bar\2.bin\mwssvc.exe C:\Program Files (x86)\Norton Internet Security\Engine\17.0.0.136\ccSvcHst.exe C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe C:\Windows\system32\TODDSrv.exe C:\Program Files\TOSHIBA\Power Saver\TosCoSrv.exe C:\Program Files\TOSHIBA\TECO\TecoService.exe C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE C:\Program Files (x86)\Norton Internet Security\Engine\17.0.0.136\ccSvcHst.exe C:\windows\system32\svchost.exe -k NetworkServiceNetworkRestricted C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe C:\Program Files\Synaptics\SynTP\SynTPEnh.exe C:\Program Files\ltmoh\ltmoh.exe C:\Program Files\TOSHIBA\Power Saver\TPwrMain.exe C:\Program Files\TOSHIBA\SmoothView\SmoothView.exe C:\Program Files\TOSHIBA\FlashCards\TCrdMain.exe C:\Program Files\Synaptics\SynTP\SynTPHelper.exe C:\Program Files\TOSHIBA\TECO\Teco.exe C:\Program Files\TOSHIBA\BulletinBoard\TosNcCore.exe C:\Program Files\TOSHIBA\ReelTime\TosReelTimeMonitor.exe C:\Program Files\Canon\MyPrinter\BJMYPRT.EXE C:\Program Files (x86)\USIM Editor\iconcs72400344.exe C:\Users\brandsmart\AppData\Local\Akamai\netsession_win.exe C:\Program Files (x86)\McAfee Security Scan\2.1.121\SSScheduler.exe C:\Users\brandsmart\AppData\Local\Akamai\netsession_win.exe C:\Users\brandsmart\AppData\Roaming\Dropbox\bin\Dropbox.exe C:\Program Files (x86)\Microsoft Office\Office12\ONENOTEM.EXE C:\Program Files (x86)\TOSHIBA\TOSHIBA Service Station\ToshibaServiceStation.exe C:\Program Files (x86)\TOSHIBA\TOSHIBA Web Camera Application\TWebCamera.exe C:\Program Files\AVAST Software\Avast\AvastUI.exe C:\Program Files\LSI SoftModem\agr64svc.exe C:\Program Files (x86)\Canon\Solution Menu EX\CNSEMAIN.EXE C:\Program Files (x86)\iTunes\iTunesHelper.exe C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe C:\Program Files (x86)\Real\RealPlayer\Update\realsched.exe C:\windows\system32\svchost.exe -k imgsvc C:\Program Files (x86)\TOSHIBA\ConfigFree\CFIWmxSvcs64.exe C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe C:\Program Files\iPod\bin\iPodService.exe C:\windows\system32\svchost.exe -k LocalServiceAndNoImpersonation C:\windows\splwow64.exe C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe C:\Program Files (x86)\TOSHIBA\ConfigFree\CFProcSRVC.exe C:\Program Files (x86)\TOSHIBA\ConfigFree\CFSvcs.exe C:\Program Files\TOSHIBA\rselect\RSelSvc.exe C:\Program Files (x86)\Canon\Solution Menu EX\CNSEUPDT.EXE C:\windows\System32\svchost.exe -k secsvcs C:\Program Files (x86)\TOSHIBA\TOSHIBA Service Station\TMachInfo.exe C:\Program Files\TOSHIBA\TPHM\TPCHSrv.exe C:\Program Files\TOSHIBA\TPHM\TPCHWMsg.exe C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSmartSrv.exe C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSENotify.exe C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe C:\Program Files (x86)\Microsoft\BingBar\7.1.391.0\SeaPort.exe C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe C:\windows\system32\SearchIndexer.exe C:\Program Files (x86)\Google\Chrome\Application\chrome.exe C:\Program Files (x86)\Google\Chrome\Application\chrome.exe C:\Program Files (x86)\Google\Chrome\Application\chrome.exe C:\Program Files (x86)\Google\Chrome\Application\chrome.exe C:\Program Files (x86)\Google\Chrome\Application\chrome.exe C:\Program Files (x86)\Google\Chrome\Application\chrome.exe C:\Program Files (x86)\Google\Chrome\Application\chrome.exe C:\Program Files (x86)\Google\Chrome\Application\chrome.exe C:\Program Files (x86)\Google\Chrome\Application\chrome.exe C:\Program Files (x86)\Google\Chrome\Application\chrome.exe C:\Program Files (x86)\Java\jre7\bin\jp2launcher.exe C:\Program Files (x86)\Java\jre7\bin\java.exe C:\windows\system32\taskhost.exe C:\windows\system32\wuauclt.exe C:\Program Files (x86)\Google\Chrome\Application\chrome.exe C:\Program Files (x86)\Google\Chrome\Application\chrome.exe C:\Program Files (x86)\Google\Chrome\Application\chrome.exe C:\windows\system32\wbem\wmiprvse.exe C:\windows\System32\cscript.exe . ============== Pseudo HJT Report =============== . uStart Page = hxxp://www.google.com/ig/redirectdomain?brand=TSNA&bmod=TSNA uDefault_Page_URL = hxxp://www.google.com/ig/redirectdomain?brand=TSNA&bmod=TSNA mStart Page = hxxp://www.google.com/ig/redirectdomain?brand=TSNA&bmod=TSNA mDefault_Page_URL = hxxp://www.google.com/ig/redirectdomain?brand=TSNA&bmod=TSNA uURLSearchHooks: vshare.tv Bar Toolbar: {7aeb3efd-e564-43f1-b658-5058a7c5743b} - C:\Program Files (x86)\vshare.tv_Bar\prxtbvsha.dll mURLSearchHooks: vshare.tv Bar Toolbar: {7aeb3efd-e564-43f1-b658-5058a7c5743b} - C:\Program Files (x86)\vshare.tv_Bar\prxtbvsha.dll mWinlogon: Userinit = userinit.exe BHO: {02478D38-C3F9-4efb-9B51-7695ECA05670} - <orphaned> BHO: Adobe PDF Link Helper: {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll BHO: BuzzSocialPoints_IE: {1A917769-FBA3-4273-AA4C-F852D116854B} - C:\Program Files (x86)\BuzzSocialPoints_IE\ScriptHost.dll BHO: RealPlayer Download and Record Plugin for Internet Explorer: {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll BHO: Conduit Engine : {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Program Files (x86)\ConduitEngine\prxConduitEngin.dll BHO: Canon Easy-WebPrint EX BHO: {3785D0AD-BFFF-47F6-BF5B-A587C162FED9} - C:\Program Files (x86)\Canon\Easy-WebPrint EX\ewpexbho.dll BHO: AVG Safe Search: {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - BHO: Symantec NCO BHO: {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files (x86)\Norton Internet Security\Engine\17.0.0.136\CoIEPlg.dll BHO: Symantec Intrusion Prevention: {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files (x86)\Norton Internet Security\Engine\17.0.0.136\IPSBHO.dll BHO: StartNow Toolbar Helper: {6E13D095-45C3-4271-9475-F3B48227DD9F} - C:\Program Files (x86)\StartNow Toolbar\Toolbar32.dll BHO: Groove GFS Browser Helper: {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll BHO: Java Plug-In SSV Helper: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll BHO: vshare.tv Bar Toolbar: {7aeb3efd-e564-43f1-b658-5058a7c5743b} - C:\Program Files (x86)\vshare.tv_Bar\prxtbvsha.dll BHO: BuzzSocialPoints_DNS_IE: {8BD7501A-5166-4036-BB01-5FC63C68EFEB} - C:\Program Files (x86)\BuzzSocialPoints_DNS_IE\ScriptHost.dll BHO: avast! WebRep: {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll BHO: Windows Live ID Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll BHO: Windows Live Messenger Companion Helper: {9FDDE16B-836F-4806-AB1F-1455CBEFF289} - C:\Program Files (x86)\Windows Live\Companion\companioncore.dll BHO: Google Toolbar Helper: {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll BHO: Skype Browser Helper: {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll BHO: Bing Bar Helper: {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files (x86)\Microsoft\BingBar\7.1.391.0\BingExt.dll BHO: Java Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll TB: Google Toolbar: {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll TB: Norton Toolbar: {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton Internet Security\Engine\17.0.0.136\CoIEPlg.dll TB: vshare.tv Bar Toolbar: {7AEB3EFD-E564-43F1-B658-5058A7C5743B} - C:\Program Files (x86)\vshare.tv_Bar\prxtbvsha.dll TB: ConservativeTalkNow: {533329C9-CA91-42A2-8792-7F91C7B4172A} - TB: Conduit Engine : {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Program Files (x86)\ConduitEngine\prxConduitEngin.dll TB: Canon Easy-WebPrint EX: {759D9886-0C6F-4498-BAB6-4A5F47C6C72F} - C:\Program Files (x86)\Canon\Easy-WebPrint EX\ewpexhlp.dll TB: Norton Toolbar: {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton Internet Security\Engine\17.0.0.136\CoIEPlg.dll TB: avast! WebRep: {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll TB: StartNow Toolbar: {5911488E-9D1E-40ec-8CBB-06B231CC153F} - C:\Program Files (x86)\StartNow Toolbar\Toolbar32.dll TB: vshare.tv Bar Toolbar: {7aeb3efd-e564-43f1-b658-5058a7c5743b} - C:\Program Files (x86)\vshare.tv_Bar\prxtbvsha.dll TB: Conduit Engine : {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Program Files (x86)\ConduitEngine\prxConduitEngin.dll TB: Canon Easy-WebPrint EX: {759D9886-0C6F-4498-BAB6-4A5F47C6C72F} - C:\Program Files (x86)\Canon\Easy-WebPrint EX\ewpexhlp.dll TB: Bing Bar: {8dcb7100-df86-4384-8842-8fa844297b3f} - TB: Google Toolbar: {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll EB: Canon Easy-WebPrint EX: {21347690-EC41-4F9A-8887-1F4AEE672439} - C:\Program Files (x86)\Canon\Easy-WebPrint EX\ewpexhlp.dll uRun: [swg] "C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" uRun: [msnmsgr] "C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe" /background uRun: [MyWebSearch Email Plugin] C:\PROGRA~2\MYWEBS~1\bar\2.bin\mwsoemon.exe uRun: [Pando Media Booster] C:\Program Files (x86)\Pando Networks\Media Booster\PMB.exe uRun: [Akamai NetSession Interface] "C:\Users\brandsmart\AppData\Local\Akamai\netsession_win.exe" uRun: [DW6] "C:\Program Files (x86)\The Weather Channel FW\Desktop\DesktopWeather.exe" uRunOnce: [FlashPlayerUpdate] C:\windows\SysWOW64\Macromed\Flash\FlashUtil32_11_4_402_287_Plugin.exe -update plugin mRun: [startCCC] "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun mRun: [ToshibaServiceStation] "C:\Program Files (x86)\TOSHIBA\TOSHIBA Service Station\ToshibaServiceStation.exe" /hide:60 mRun: [TWebCamera] "C:\Program Files (x86)\TOSHIBA\TOSHIBA Web Camera Application\TWebCamera.exe" autorun mRun: [NortonOnlineBackupReminder] "C:\Program Files (x86)\TOSHIBA\Toshiba Online Backup\Activation\TobuActivation.exe" UNATTENDED mRun: [avast] "C:\Program Files\AVAST Software\Avast\avastUI.exe" /nogui mRun: [GrooveMonitor] "C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe" mRun: [My Web Search Bar Search Scope Monitor] "C:\PROGRA~2\MYWEBS~1\bar\2.bin\m3SrchMn.exe" /m=2 /w /h mRun: [CanonSolutionMenuEx] C:\Program Files (x86)\Canon\Solution Menu EX\CNSEMAIN.EXE /logon mRun: [APSDaemon] "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" mRun: [uSBestCR] C:\Program Files (x86)\USIM Editor\iconcs72400344.exe RunFromReg mRun: [iTunesHelper] "C:\Program Files (x86)\iTunes\iTunesHelper.exe" mRun: [sunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe" mRun: [TkBellExe] "c:\program files (x86)\real\realplayer\Update\realsched.exe" -osboot mRun: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" StartupFolder: C:\Users\BRANDS~1\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\Dropbox.lnk - C:\Users\brandsmart\AppData\Roaming\Dropbox\bin\Dropbox.exe StartupFolder: C:\Users\BRANDS~1\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\ONENOT~1.LNK - C:\Program Files (x86)\Microsoft Office\Office12\ONENOTEM.EXE StartupFolder: C:\Users\BRANDS~1\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\ZIPSCR~1.LNK - C:\NavPress\ZIPscrpt.exe StartupFolder: C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\Startup\MCAFEE~1.LNK - C:\Program Files (x86)\McAfee Security Scan\2.1.121\SSScheduler.exe uPolicies-Explorer: NoDriveTypeAutoRun = dword:255 mPolicies-Explorer: NoActiveDesktop = dword:1 mPolicies-Explorer: NoActiveDesktopChanges = dword:1 mPolicies-System: ConsentPromptBehaviorAdmin = dword:5 mPolicies-System: ConsentPromptBehaviorUser = dword:3 mPolicies-System: EnableUIADesktopToggle = dword:0 IE: E&xport to Microsoft Excel - C:\PROGRA~2\MIF5BA~1\Office12\EXCEL.EXE/3000 IE: Google Sidewiki... - C:\Program Files (x86)\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_2EC7709873947E87.dll/cmsidewiki.html IE: {0000036B-C524-4050-81A0-243669A86B9F} - {B63DBA5F-523F-4B9C-A43D-65DF1977EAD3} - C:\Program Files (x86)\Windows Live\Companion\companioncore.dll IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - C:\Program Files (x86)\Microsoft Office\Office12\ONBttnIE.dll IE: {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} DPF: {02BCC737-B171-4746-94C9-0D8A0B2C0089} - hxxp://office.microsoft.com/_layouts/ClientBin/ieawsdc32.cab DPF: {233C1507-6A77-46A4-9443-F871F945D258} - hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} - hxxp://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} - C:\Program Files (x86)\Yahoo!\Common\Yinsthelper.dll DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} - hxxp://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab DPF: {8100D56A-5661-482C-BEE8-AFECE305D968} - hxxp://upload.facebook.com/controls/2009.07.28_v5.5.8.1/FacebookPhotoUploader55.cab DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab DPF: {B3E32D88-8E7F-468F-B0E2-3A300FD4A82C} - hxxp://myitlab.pearsoned.com/Pegasus/Modules/SIMIntegration/Resources/ax/stub.cab DPF: {CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab TCP: NameServer = 192.168.1.1 TCP: Interfaces\{1F34DFC2-A868-47A7-84E0-304628083DBD} : DHCPNameServer = 10.1.10.1 TCP: Interfaces\{5A01509C-8215-43C9-9780-C9A65A540D63} : DHCPNameServer = 192.168.1.1 TCP: Interfaces\{5A01509C-8215-43C9-9780-C9A65A540D63}\16474777966696 : DHCPNameServer = 192.168.6.1 64.134.255.2 64.134.255.10 TCP: Interfaces\{5A01509C-8215-43C9-9780-C9A65A540D63}\2456C6B696E6F574F575962756C6563737F5246443345373 : DHCPNameServer = 192.168.2.1 TCP: Interfaces\{5A01509C-8215-43C9-9780-C9A65A540D63}\2656C6B696E6534376 : DHCPNameServer = 192.168.2.1 192.168.1.254 TCP: Interfaces\{5A01509C-8215-43C9-9780-C9A65A540D63}\96367636 : DHCPNameServer = 192.168.0.1 Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveSystemServices.dll Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files (x86)\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll SSODL: WebCheck - <orphaned> SEH: Groove GFS Stub Execution Hook - {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll x64-BHO: avast! WebRep: {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll x64-BHO: AVG Safe Search: {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - x64-BHO: Windows Live ID Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll x64-BHO: Google Toolbar Helper: {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll x64-TB: avast! WebRep: {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll x64-TB: Google Toolbar: {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll x64-Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe x64-Run: [synTPEnh] C:\Program Files (x86)\Synaptics\SynTP\SynTPEnh.exe x64-Run: [LtMoh] C:\Program Files\ltmoh\Ltmoh.exe x64-Run: [TPwrMain] C:\Program Files (x86)\TOSHIBA\Power Saver\TPwrMain.EXE x64-Run: [smoothView] C:\Program Files (x86)\Toshiba\SmoothView\SmoothView.exe x64-Run: [00TCrdMain] C:\Program Files (x86)\TOSHIBA\FlashCards\TCrdMain.exe x64-Run: [TosWaitSrv] C:\Program Files (x86)\TOSHIBA\TPHM\TosWaitSrv.exe x64-Run: [smartFaceVWatcher] C:\Program Files (x86)\Toshiba\SmartFaceV\SmartFaceVWatcher.exe x64-Run: [Teco] "C:\Program Files (x86)\TOSHIBA\TECO\Teco.exe" /r x64-Run: [TosSENotify] C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosWaitSrv.exe x64-Run: [TosNC] C:\Program Files (x86)\Toshiba\BulletinBoard\TosNcCore.exe x64-Run: [TosReelTimeMonitor] C:\Program Files (x86)\TOSHIBA\ReelTime\TosReelTimeMonitor.exe x64-Run: [CanonMyPrinter] C:\Program Files\Canon\MyPrinter\BJMyPrt.exe /logon x64-Run: [uSBestCR] C:\Program Files (x86)\USIM Editor\iconcs72400344.exe RunFromReg x64-Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - <orphaned> x64-Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - <orphaned> x64-Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - <orphaned> x64-Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - <orphaned> x64-SSODL: WebCheck - <orphaned> . ================= FIREFOX =================== . FF - ProfilePath - C:\Users\brandsmart\AppData\Roaming\Mozilla\Firefox\Profiles\cqfudqqy.default\ FF - prefs.js: browser.search.defaulturl - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2818425&SearchSource=3&q={searchTerms} FF - prefs.js: browser.search.selectedEngine - vshare.tv Bar Customized Web Search FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/ FF - prefs.js: keyword.URL - hxxp://dm.startnow.com/s/?src=addrbar&provider=bing&provider_name=bing&provider_code=Z055&partner_id=195&product_id=611&affiliate_id=&channel=dm5&toolbar_id=200&toolbar_version=2.1.0&install_country=US&install_date=20110626&user_guid=6BCF5D5343EB4D3AAC4C9DCAC22AF5BC&machine_id=c00e95a962fd802128b611003a2087eb&browser=FF&os=win&os_version=6.1-x64-SP0&q= FF - plugin: C:\PROGRA~2\MIF5BA~1\Office14\NPSPWRAP.DLL FF - plugin: C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll FF - plugin: C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll FF - plugin: C:\Program Files (x86)\Canon\Easy-PhotoPrint EX\NPEZFFPI.DLL FF - plugin: C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll FF - plugin: C:\Program Files (x86)\Google\Update\1.3.21.123\npGoogleUpdate3.dll FF - plugin: C:\Program Files (x86)\Java\jre6\bin\new_plugin\npdeployJava1.dll FF - plugin: C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll FF - plugin: c:\Program Files (x86)\Microsoft Silverlight\5.1.10411.0\npctrlui.dll FF - plugin: C:\Program Files (x86)\Mozilla Firefox\plugins\nprpplugin.dll FF - plugin: C:\Program Files (x86)\Mozilla Firefox\plugins\npvsharetvplg.dll FF - plugin: C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll FF - plugin: c:\program files (x86)\real\realplayer\Netscape6\nprpplugin.dll FF - plugin: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll FF - plugin: C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprpchromebrowserrecordext.dll FF - plugin: C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll FF - plugin: C:\Users\brandsmart\AppData\Local\Microsoft\Internet Explorer\Downloaded Program Files\npsoe.dll FF - plugin: C:\Users\brandsmart\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll FF - plugin: C:\windows\SysWOW64\Adobe\Director\np32dsw.dll FF - plugin: C:\windows\SysWOW64\Macromed\Flash\NPSWF32_11_4_402_287.dll FF - plugin: C:\windows\SysWOW64\npDeployJava1.dll FF - plugin: C:\windows\SysWOW64\npmproxy.dll FF - ExtSQL: 2012-10-12 00:20; {0153E448-190B-4987-BDE1-F256CADA672F}; C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext FF - ExtSQL: 2012-11-02 12:56; buzzsocial@buzzsocialpoints.com; C:\Program Files (x86)\Mozilla Firefox\extensions\buzzsocial@buzzsocialpoints.com.xpi FF - ExtSQL: 2012-11-08 14:07; buzzsocial_lidns@buzzsocialpoints.com; C:\Program Files (x86)\Mozilla Firefox\extensions\buzzsocial_lidns@buzzsocialpoints.com.xpi FF - ExtSQL: !HIDDEN! 2011-10-12 06:54; 4nffxtbr@ConservativeTalkNow_4n.com; C:\Program Files (x86)\ConservativeTalkNow_4n\bar\1.bin . ============= SERVICES / DRIVERS =============== . R0 SymDS;Symantec Data Store;C:\windows\System32\drivers\NISx64\1100000.088\SymDS64.sys [2009-12-25 433200] R0 SymEFA;Symantec Extended File Attributes;C:\windows\System32\drivers\NISx64\1100000.088\SymEFA64.sys [2009-12-25 217136] R0 tos_sps64;TOSHIBA tos_sps64 Service;C:\windows\System32\drivers\tos_sps64.sys [2009-12-25 482384] R1 aswSnx;aswSnx;C:\windows\System32\drivers\aswSnx.sys [2011-3-16 819032] R1 aswSP;aswSP;C:\windows\System32\drivers\aswSP.sys [2011-3-16 337240] R1 BHDrvx64;BHDrvx64;C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.0.0.136\Definitions\BASHDefs\20090829.001\BHDrvx64.sys [2009-12-25 641584] R1 ccHP;Symantec Hash Provider;C:\windows\System32\drivers\NISx64\1100000.088\ccHPx64.sys [2009-12-25 615040] R1 IDSVia64;IDSVia64;C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.0.0.136\Definitions\IPSDefs\20090828.002\IDSVia64.sys [2009-12-25 467504] R1 SymIRON;Symantec Iron Driver;C:\windows\System32\drivers\NISx64\1100000.088\Ironx64.sys [2009-12-25 146992] R1 SYMTDIv;Symantec Vista Network Dispatch Driver;C:\windows\System32\drivers\NISx64\1100000.088\symtdiv.sys [2009-12-25 450608] R2 AfaService;Afa Card Reader Service;C:\windows\System32\afasrv64.exe --> C:\windows\System32\afasrv64.exe [?] R2 Akamai;Akamai NetSession Interface;C:\windows\System32\svchost.exe -k Akamai [2009-7-13 27136] R2 AMD External Events Utility;AMD External Events Utility;C:\windows\System32\atiesrxx.exe [2009-12-25 203264] R2 aswFsBlk;aswFsBlk;C:\windows\System32\drivers\aswFsBlk.sys [2011-3-16 24408] R2 aswMonFlt;aswMonFlt;C:\windows\System32\drivers\aswMonFlt.sys [2011-3-16 69976] R2 avast! Antivirus;avast! Antivirus;C:\Program Files\AVAST Software\Avast\AvastSvc.exe [2012-3-27 44768] R2 cfWiMAXService;ConfigFree WiMAX Service;C:\Program Files (x86)\TOSHIBA\ConfigFree\CFIWmxSvcs64.exe [2009-8-10 248688] R2 ConfigFree Gadget Service;ConfigFree Gadget Service;C:\Program Files (x86)\TOSHIBA\ConfigFree\CFProcSRVC.exe [2009-7-14 42368] R2 ConfigFree Service;ConfigFree Service;C:\Program Files (x86)\TOSHIBA\ConfigFree\CFSvcs.exe [2009-3-10 46448] R2 cvhsvc;Client Virtualization Handler;C:\Program Files (x86)\Common Files\microsoft shared\Virtualization Handler\CVHSVC.EXE [2012-1-4 822624] R2 MBAMScheduler;MBAMScheduler;C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [2012-12-4 399432] R2 MBAMService;MBAMService;C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2012-12-4 676936] R2 MyWebSearchService;My Web Search Service;C:\PROGRA~2\MYWEBS~1\bar\2.bin\mwssvc.exe [2011-5-1 28762] R2 NIS;Norton Internet Security;C:\Program Files (x86)\Norton Internet Security\Engine\17.0.0.136\ccSvcHst.exe [2009-12-25 126392] R2 RSELSVC;TOSHIBA Modem region select service;C:\Program Files\TOSHIBA\rselect\RSelSvc.exe [2009-7-7 65904] R2 sftlist;Application Virtualization Client;C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe [2011-10-1 508776] R2 TOSHIBA eco Utility Service;TOSHIBA eco Utility Service;C:\Program Files\TOSHIBA\TECO\TecoService.exe [2009-8-11 252272] R2 TVALZFL;TOSHIBA ACPI-Based Value Added Logical and General Purpose Device Filter Driver;C:\windows\System32\drivers\TVALZFL.sys [2009-6-19 14472] R3 BBUpdate;BBUpdate;C:\Program Files (x86)\Microsoft\BingBar\7.1.391.0\SeaPort.EXE [2012-6-11 240208] R3 FwLnk;FwLnk Driver;C:\windows\System32\drivers\FwLnk.sys [2009-12-25 9216] R3 MBAMProtector;MBAMProtector;C:\windows\System32\drivers\mbam.sys [2012-12-4 25928] R3 PGEffect;Pangu effect driver;C:\windows\System32\drivers\PGEffect.sys [2009-12-25 35008] R3 RTL8167;Realtek 8167 NT Driver;C:\windows\System32\drivers\Rt64win7.sys [2009-12-25 236544] R3 rtl8192se;Realtek Wireless LAN 802.11n PCI-E NIC NT Driver;C:\windows\System32\drivers\rtl8192se.sys [2009-12-25 943616] R3 Sftfs;Sftfs;C:\windows\System32\drivers\Sftfslh.sys [2011-10-1 764264] R3 Sftplay;Sftplay;C:\windows\System32\drivers\Sftplaylh.sys [2011-10-1 268648] R3 Sftredir;Sftredir;C:\windows\System32\drivers\Sftredirlh.sys [2011-10-1 25960] R3 Sftvol;Sftvol;C:\windows\System32\drivers\Sftvollh.sys [2011-10-1 22376] R3 sftvsa;Application Virtualization Service Agent;C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe [2011-10-1 219496] R3 TMachInfo;TMachInfo;C:\Program Files (x86)\TOSHIBA\TOSHIBA Service Station\TMachInfo.exe [2009-12-25 51512] R3 TOSHIBA HDD SSD Alert Service;TOSHIBA HDD SSD Alert Service;C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSmartSrv.exe [2009-8-3 137560] R3 TPCHSrv;TPCH Service;C:\Program Files\TOSHIBA\TPHM\TPCHSrv.exe [2009-8-4 826224] S2 BBSvc;BingBar Service;C:\Program Files (x86)\Microsoft\BingBar\7.1.391.0\BBSvc.EXE [2012-6-11 193616] S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384] S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-3-18 138576] S2 SkypeUpdate;Skype Updater;C:\Program Files (x86)\Skype\Updater\Updater.exe [2012-6-7 160944] S3 McComponentHostService;McAfee Security Scan Component Host Service;C:\Program Files (x86)\McAfee Security Scan\2.1.121\McCHSvc.exe [2010-9-3 227232] S3 MHIKEY10;MHIKEY10;C:\windows\System32\drivers\MHIKEY10x64.sys [2010-9-15 60288] S3 npggsvc;nProtect GameGuard Service;C:\windows\System32\GameMon.des -service --> C:\windows\System32\GameMon.des -service [?] S3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;C:\windows\System32\drivers\RtsUStor.sys [2009-12-25 222208] S3 TsUsbFlt;TsUsbFlt;C:\windows\System32\drivers\TsUsbFlt.sys [2011-6-6 59392] S3 USBAAPL64;Apple Mobile USB Driver;C:\windows\System32\drivers\usbaapl64.sys [2012-2-15 52736] S3 WatAdminSvc;Windows Activation Technologies Service;C:\windows\System32\Wat\WatAdminSvc.exe [2010-4-19 1255736] . =============== Created Last 60 ================ . 2012-12-05 00:46:10 9125352 ----a-w- C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{A1ED66F4-BF96-4506-A1C7-6BC492823CF2}\mpengine.dll 2012-12-04 05:33:00 -------- d-----w- C:\Users\brandsmart\AppData\Roaming\Malwarebytes 2012-12-04 05:32:43 -------- d-----w- C:\ProgramData\Malwarebytes 2012-12-04 05:32:42 25928 ----a-w- C:\windows\System32\drivers\mbam.sys 2012-12-04 05:32:41 -------- d-----w- C:\Program Files (x86)\Malwarebytes' Anti-Malware 2012-12-04 04:41:44 -------- d-----w- C:\Users\brandsmart\AppData\Local\{F56F9503-27EE-45A3-897D-DA73315C8A82} 2012-12-02 13:47:15 -------- d-----w- C:\Users\brandsmart\AppData\Local\{A39BD791-71EA-4273-8083-1A40372AE528} 2012-11-30 19:26:25 -------- d-----w- C:\Program Files (x86)\BuzzSocialPoints_IE 2012-11-30 19:26:22 -------- d-----w- C:\Program Files (x86)\BuzzSocialPointsIE 2012-11-30 19:26:22 -------- d-----w- C:\Program Files (x86)\BuzzSocialPoints 2012-11-30 19:26:05 -------- d-----w- C:\Program Files (x86)\BuzzSocialPoints_DNS_IE 2012-11-30 19:26:01 -------- d-----w- C:\windows\BuzzSocialPointsChecker 2012-11-30 19:26:01 -------- d-----w- C:\Program Files (x86)\BuzzSocialPointsIE_DNS 2012-11-30 19:26:01 -------- d-----w- C:\Program Files (x86)\BuzzSocialPoints_DNS 2012-11-30 18:04:58 -------- d-----w- C:\Users\brandsmart\AppData\Local\{D5ABDFAD-AE51-412B-95EB-55B9A3C0C77C} 2012-11-29 15:58:05 -------- d-----w- C:\Users\brandsmart\AppData\Local\{999BA1CD-AC9B-4DE6-A652-9D8DDFDA645B} 2012-11-29 02:15:35 -------- d-----w- C:\Users\brandsmart\AppData\Local\{06BAE05C-22D9-4442-9233-3E686F2E2FB3} 2012-11-28 05:51:27 -------- d-----w- C:\Users\brandsmart\AppData\Local\{B9A8AC2C-3ACD-45B4-B6AB-976EAB0987D2} 2012-11-27 17:34:48 -------- d-----w- C:\Users\brandsmart\AppData\Local\{7B7BFAA1-E2BB-48AB-BEF7-0E8C22BA294D} 2012-11-25 20:18:17 -------- d-----w- C:\Users\brandsmart\AppData\Local\{5A53FEA5-C0DB-4A8F-B663-C8F6EFBDFF4E} 2012-11-24 15:55:34 -------- d-----w- C:\Users\brandsmart\AppData\Local\{E27A40A5-60E9-4A89-A447-6AAF23A083C7} 2012-11-23 16:13:25 -------- d-----w- C:\Users\brandsmart\AppData\Local\{78D2D085-42E1-435A-BC88-FA4908BE642C} 2012-11-23 04:13:07 -------- d-----w- C:\Users\brandsmart\AppData\Local\{27D297BB-1372-481F-A9CD-B84B350BCD30} 2012-11-19 00:51:29 -------- d-----w- C:\Users\brandsmart\AppData\Local\{9111A644-6A5E-4B79-904B-26F8B6B45081} 2012-11-18 06:08:18 -------- d-----w- C:\Users\brandsmart\AppData\Local\{9A4EFBA4-C520-4B04-BB88-26A46A12D5F0} 2012-11-16 12:15:44 -------- d-----w- C:\Users\brandsmart\AppData\Local\{30C40323-B90D-4A96-BF4F-727C332D9EBC} 2012-11-15 21:16:59 -------- d-----w- C:\Users\brandsmart\AppData\Local\{86B872D7-AF45-4F68-B258-3E89484E0904} 2012-11-15 04:26:21 -------- d-----w- C:\Users\brandsmart\AppData\Local\{61939948-FFB8-4BAD-8F3A-30A2F5D797E6} 2012-11-14 09:12:45 -------- d-----w- C:\Users\brandsmart\AppData\Local\{C2848D79-C3B5-4656-800C-9D516AD8D9CA} 2012-11-14 08:20:36 2560 ----a-w- C:\windows\System32\drivers\en-US\wdf01000.sys.mui 2012-11-14 08:20:34 9728 ----a-w- C:\windows\System32\Wdfres.dll 2012-11-14 08:20:34 785512 ----a-w- C:\windows\System32\drivers\Wdf01000.sys 2012-11-14 08:20:34 54376 ----a-w- C:\windows\System32\drivers\WdfLdr.sys 2012-11-14 08:03:59 87040 ----a-w- C:\windows\System32\drivers\WUDFPf.sys 2012-11-14 08:03:59 198656 ----a-w- C:\windows\System32\drivers\WUDFRd.sys 2012-11-14 08:03:57 84992 ----a-w- C:\windows\System32\WUDFSvc.dll 2012-11-14 08:03:57 194048 ----a-w- C:\windows\System32\WUDFPlatform.dll 2012-11-14 08:03:53 45056 ----a-w- C:\windows\System32\WUDFCoinstaller.dll 2012-11-14 08:03:53 229888 ----a-w- C:\windows\System32\WUDFHost.exe 2012-11-14 08:03:52 744448 ----a-w- C:\windows\System32\WUDFx.dll 2012-11-12 14:26:26 -------- d-----w- C:\Users\brandsmart\AppData\Local\{458F4D10-860B-4AC6-A7D5-032FD88E510A} 2012-11-12 02:26:06 -------- d-----w- C:\Users\brandsmart\AppData\Local\{90DEE558-2DC4-4350-9E04-3B1DEE9D06E4} 2012-11-11 14:25:47 -------- d-----w- C:\Users\brandsmart\AppData\Local\{663BBBD0-8081-4870-A116-BAC5D09DDCAD} 2012-11-10 00:14:42 -------- d-----w- C:\Users\brandsmart\AppData\Local\{570103B8-02B8-4300-9871-E5E5BBDF345E} 2012-11-09 05:25:26 -------- d-----w- C:\Users\brandsmart\AppData\Local\{9BB6FFEE-4EA7-451D-BFC1-E7EC810F0C0E} 2012-11-08 00:28:58 -------- d-----w- C:\Users\brandsmart\AppData\Local\{066F5BD0-DB6E-4189-8F61-09C7DFB23BA1} 2012-11-06 17:24:06 -------- d-----w- C:\Users\brandsmart\AppData\Local\{C5DD1649-60CE-44DB-A5CB-18FD3F109FF2} 2012-11-05 23:37:14 -------- d-----w- C:\Users\brandsmart\AppData\Local\{DD2CEE9E-154F-4BD0-A2B9-6749EBD69497} 2012-11-04 22:42:55 -------- d-----w- C:\Users\brandsmart\AppData\Local\{B5A7A122-F566-4C66-BAF4-173FD590B0F8} 2012-10-31 23:31:51 -------- d-----w- C:\Users\brandsmart\AppData\Local\{AD8DDC32-BB2C-4A46-A9AF-913F588481D6} 2012-10-30 21:38:27 -------- d-----w- C:\Users\brandsmart\AppData\Local\{AC83CF8F-5729-43CE-B74B-1CEF2F5F9EBA} 2012-10-29 22:38:54 -------- d-----w- C:\Users\brandsmart\AppData\Local\{31847D1E-EE53-4322-80C6-E71C8953BA7D} 2012-10-28 23:56:18 -------- d-----w- C:\Users\brandsmart\AppData\Local\{83F2DBC2-2DEC-4509-BEED-5290634D22BD} 2012-10-27 22:10:56 -------- d-----w- C:\Users\brandsmart\AppData\Local\{1BE4DE40-57DC-400D-BFB4-82981F4BE380} 2012-10-26 22:36:16 -------- d-----w- C:\Users\brandsmart\AppData\Local\{28197E31-F1D7-4213-907C-53A3AC9FDC46} 2012-10-24 23:18:58 -------- d-----w- C:\Users\brandsmart\AppData\Local\{9C648E7F-966F-48BC-99AA-26AEAABA3670} 2012-10-21 23:25:31 -------- d-----w- C:\Users\brandsmart\AppData\Local\{4A14398B-A0DD-4295-A6E5-6A7FF15F8BC2} 2012-10-16 22:49:20 -------- d-----w- C:\Users\brandsmart\AppData\Local\{F171AA84-A90A-4E38-90BF-918B2833809D} 2012-10-16 15:28:53 -------- d-----w- C:\Users\brandsmart\AppData\Local\{6F1CC207-6A20-4510-8E6B-A8DAEF4BE991} 2012-10-16 00:46:34 -------- d-----w- C:\Users\brandsmart\AppData\Local\{4226094B-81C9-477E-BAC0-91ADFE7CE808} 2012-10-14 15:40:34 -------- d-----w- C:\Users\brandsmart\AppData\Local\{6478EA4A-8889-43B3-867D-6865E8318B0E} 2012-10-13 04:50:10 -------- d-----w- C:\Users\brandsmart\AppData\Local\{DE8B874D-D6B0-44A8-BE75-EFA71633D433} 2012-10-12 14:35:31 -------- d-----w- C:\Users\brandsmart\AppData\Local\{3F867ECA-F1C8-466A-BD5C-D583D6987ACC} 2012-10-12 10:26:57 1659760 ----a-w- C:\windows\System32\drivers\ntfs.sys 2012-10-12 10:25:49 5559664 ----a-w- C:\windows\System32\ntoskrnl.exe 2012-10-12 10:25:47 3968880 ----a-w- C:\windows\SysWow64\ntkrnlpa.exe 2012-10-12 10:25:46 3914096 ----a-w- C:\windows\SysWow64\ntoskrnl.exe 2012-10-12 10:23:38 220160 ----a-w- C:\windows\System32\wintrust.dll 2012-10-12 10:23:38 172544 ----a-w- C:\windows\SysWow64\wintrust.dll 2012-10-12 10:20:22 2048 ----a-w- C:\windows\SysWow64\tzres.dll 2012-10-12 10:20:22 2048 ----a-w- C:\windows\System32\tzres.dll 2012-10-12 10:20:11 715776 ----a-w- C:\windows\System32\kerberos.dll 2012-10-12 10:20:11 542208 ----a-w- C:\windows\SysWow64\kerberos.dll 2012-10-12 10:14:21 140288 ----a-w- C:\windows\System32\cryptnet.dll 2012-10-12 10:14:20 103936 ----a-w- C:\windows\SysWow64\cryptnet.dll 2012-10-12 10:14:19 140288 ----a-w- C:\windows\SysWow64\cryptsvc.dll 2012-10-12 10:14:17 184320 ----a-w- C:\windows\System32\cryptsvc.dll 2012-10-12 10:14:16 1464320 ----a-w- C:\windows\System32\crypt32.dll 2012-10-12 10:14:15 1159680 ----a-w- C:\windows\SysWow64\crypt32.dll 2012-10-11 20:55:11 -------- d-----w- C:\Users\brandsmart\AppData\Local\{4BAA7B1F-A8CB-4D37-98E6-F642CA88CE72} 2012-10-11 19:58:00 -------- d-----w- C:\Users\brandsmart\AppData\Local\{ABC6E8FB-3E69-4367-A47A-FA2735D3023D} 2012-10-09 16:50:52 -------- d-----w- C:\Users\brandsmart\AppData\Local\{185D26A4-C5DA-4BA3-BBFA-F27AA9BD412B} 2012-10-08 22:36:15 -------- d-----w- C:\Users\brandsmart\AppData\Local\{5BC06CF3-4700-421F-9B68-A3EC3440A221} 2012-10-08 20:25:31 -------- d-----w- C:\Users\brandsmart\AppData\Local\{8E433AA6-EACF-4D0C-B350-26E2BBECAE19} 2012-10-08 01:01:46 -------- d-----w- C:\Users\brandsmart\AppData\Local\{72B64534-B185-49AB-9D10-A4F5D6182E39} 2012-10-07 16:35:58 -------- d-----w- C:\Users\brandsmart\AppData\Local\{9AE5170A-51DD-46A4-874B-EF5CD2E47F4E} 2012-10-07 05:28:34 -------- d-----w- C:\Users\brandsmart\AppData\Local\{0E8C36B7-406C-4CA8-9DAD-D4D8BA36ECB1} 2012-10-07 04:55:03 -------- d-----w- C:\Users\brandsmart\AppData\Local\{A67141DA-21BD-4A36-AA2A-0A16FD56AC2E} 2012-10-06 06:06:00 -------- d-----w- C:\Users\brandsmart\AppData\Local\{E49B45F0-568F-41C5-B750-D4B19AF15279} 2012-10-06 05:55:52 -------- d-----w- C:\Users\brandsmart\AppData\Local\{729BA7FE-5F5C-423A-93A1-6007C29F8720} . ==================== Find6M ==================== . 2012-11-09 06:03:37 73656 ----a-w- C:\windows\SysWow64\FlashPlayerCPLApp.cpl 2012-11-09 06:03:37 697272 ----a-w- C:\windows\SysWow64\FlashPlayerApp.exe 2012-10-18 18:25:58 3149824 ----a-w- C:\windows\System32\win32k.sys 2012-10-16 08:38:37 135168 ----a-w- C:\windows\apppatch\AppPatch64\AcXtrnal.dll 2012-10-16 08:38:34 350208 ----a-w- C:\windows\apppatch\AppPatch64\AcLayers.dll 2012-10-16 07:39:52 561664 ----a-w- C:\windows\apppatch\AcLayers.dll 2012-10-12 04:19:49 499712 ----a-w- C:\windows\SysWow64\msvcp71.dll 2012-10-12 04:19:49 348160 ----a-w- C:\windows\SysWow64\msvcr71.dll 2012-10-09 18:17:13 55296 ----a-w- C:\windows\System32\dhcpcsvc6.dll 2012-10-09 18:17:13 226816 ----a-w- C:\windows\System32\dhcpcore6.dll 2012-10-09 17:40:31 44032 ----a-w- C:\windows\SysWow64\dhcpcsvc6.dll 2012-10-09 17:40:31 193536 ----a-w- C:\windows\SysWow64\dhcpcore6.dll 2012-10-08 11:31:03 2312704 ----a-w- C:\windows\System32\jscript9.dll 2012-10-08 11:23:52 1392128 ----a-w- C:\windows\System32\wininet.dll 2012-10-08 11:22:55 1494528 ----a-w- C:\windows\System32\inetcpl.cpl 2012-10-08 11:18:22 173056 ----a-w- C:\windows\System32\ieUnatt.exe 2012-10-08 11:17:35 599040 ----a-w- C:\windows\System32\vbscript.dll 2012-10-08 11:13:33 2382848 ----a-w- C:\windows\System32\mshtml.tlb 2012-10-08 07:56:24 1800704 ----a-w- C:\windows\SysWow64\jscript9.dll 2012-10-08 07:48:03 1129472 ----a-w- C:\windows\SysWow64\wininet.dll 2012-10-08 07:47:44 1427968 ----a-w- C:\windows\SysWow64\inetcpl.cpl 2012-10-08 07:44:05 142848 ----a-w- C:\windows\SysWow64\ieUnatt.exe 2012-10-08 07:43:21 420864 ----a-w- C:\windows\SysWow64\vbscript.dll 2012-10-08 07:40:56 2382848 ----a-w- C:\windows\SysWow64\mshtml.tlb 2012-10-03 17:56:54 1914248 ----a-w- C:\windows\System32\drivers\tcpip.sys 2012-10-03 17:44:21 70656 ----a-w- C:\windows\System32\nlaapi.dll 2012-10-03 17:44:21 303104 ----a-w- C:\windows\System32\nlasvc.dll 2012-10-03 17:44:17 246272 ----a-w- C:\windows\System32\netcorehc.dll 2012-10-03 17:44:17 18944 ----a-w- C:\windows\System32\netevent.dll 2012-10-03 17:44:16 216576 ----a-w- C:\windows\System32\ncsi.dll 2012-10-03 17:42:16 569344 ----a-w- C:\windows\System32\iphlpsvc.dll 2012-10-03 16:42:24 18944 ----a-w- C:\windows\SysWow64\netevent.dll 2012-10-03 16:42:24 175104 ----a-w- C:\windows\SysWow64\netcorehc.dll 2012-10-03 16:42:23 156672 ----a-w- C:\windows\SysWow64\ncsi.dll 2012-10-03 16:07:26 45568 ----a-w- C:\windows\System32\drivers\tcpipreg.sys 2012-09-26 03:04:54 95208 ----a-w- C:\windows\SysWow64\WindowsAccessBridge-32.dll 2012-09-26 03:04:52 821736 ----a-w- C:\windows\SysWow64\npDeployJava1.dll 2012-09-26 03:04:52 746984 ----a-w- C:\windows\SysWow64\deployJava1.dll 2012-09-25 22:47:43 78336 ----a-w- C:\windows\SysWow64\synceng.dll 2012-09-25 22:46:17 95744 ----a-w- C:\windows\System32\synceng.dll 2012-08-22 18:12:40 950128 ----a-w- C:\windows\System32\drivers\ndis.sys 2012-08-22 18:12:40 376688 ----a-w- C:\windows\System32\drivers\netio.sys 2012-08-22 18:12:33 288624 ----a-w- C:\windows\System32\drivers\FWPKCLNT.SYS 2012-08-21 21:01:00 245760 ----a-w- C:\windows\System32\OxpsConverter.exe 2012-08-20 18:48:44 362496 ----a-w- C:\windows\System32\wow64win.dll 2012-08-20 18:48:44 243200 ----a-w- C:\windows\System32\wow64.dll 2012-08-20 18:48:44 13312 ----a-w- C:\windows\System32\wow64cpu.dll 2012-08-20 18:48:43 215040 ----a-w- C:\windows\System32\winsrv.dll 2012-08-20 18:48:37 16384 ----a-w- C:\windows\System32\ntvdm64.dll 2012-08-20 18:48:35 424448 ----a-w- C:\windows\System32\KernelBase.dll 2012-08-20 18:46:22 338432 ----a-w- C:\windows\System32\conhost.exe 2012-08-20 17:40:21 14336 ----a-w- C:\windows\SysWow64\ntvdm64.dll 2012-08-20 17:38:44 44032 ----a-w- C:\windows\apppatch\acwow64.dll 2012-08-20 17:38:26 25600 ----a-w- C:\windows\SysWow64\setup16.exe 2012-08-20 17:37:19 5120 ----a-w- C:\windows\SysWow64\wow32.dll 2012-08-20 17:37:18 274944 ----a-w- C:\windows\SysWow64\KernelBase.dll 2012-08-20 15:38:21 7680 ----a-w- C:\windows\SysWow64\instnm.exe 2012-08-20 15:38:20 2048 ----a-w- C:\windows\SysWow64\user.exe 2012-08-20 15:33:28 6144 ---ha-w- C:\windows\SysWow64\api-ms-win-security-base-l1-1-0.dll 2012-08-20 15:33:28 4608 ---ha-w- C:\windows\SysWow64\api-ms-win-core-threadpool-l1-1-0.dll 2012-08-20 15:33:28 3584 ---ha-w- C:\windows\SysWow64\api-ms-win-core-xstate-l1-1-0.dll 2012-08-20 15:33:28 3072 ---ha-w- C:\windows\SysWow64\api-ms-win-core-util-l1-1-0.dll 2012-08-02 17:58:52 574464 ----a-w- C:\windows\System32\d3d10level9.dll 2012-08-02 16:57:20 490496 ----a-w- C:\windows\SysWow64\d3d10level9.dll 2012-07-04 22:13:27 59392 ----a-w- C:\windows\System32\browcli.dll 2012-07-04 22:13:27 136704 ----a-w- C:\windows\System32\browser.dll 2012-07-04 21:14:34 41984 ----a-w- C:\windows\SysWow64\browcli.dll 2012-07-04 20:26:03 41472 ----a-w- C:\windows\System32\drivers\RNDISMP.sys . ============= FINISH: 0:23:26.83 =============== and here is the Attach . UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG. IF REQUESTED, ZIP IT UP & ATTACH IT . DDS (Ver_2012-11-20.01) . Microsoft Windows 7 Home Premium Boot Device: \Device\HarddiskVolume1 Install Date: 1/7/2010 5:26:29 PM System Uptime: 12/4/2012 12:40:19 PM (12 hours ago) . Motherboard: TOSHIBA | | Portable PC Processor: AMD Turion II Dual-Core Mobile M520 | Socket S1G3 | 2300/200mhz . ==== Disk Partitions ========================= . C: is FIXED (NTFS) - 288 GiB total, 146.186 GiB free. D: is CDROM () . ==== Disabled Device Manager Items ============= . ==== System Restore Points =================== . RP404: 11/21/2012 12:03:11 AM - Windows Update RP405: 11/27/2012 12:39:52 PM - Windows Update RP406: 11/29/2012 11:02:19 AM - Windows Update RP407: 12/4/2012 7:44:46 PM - Windows Update . ==== Installed Programs ====================== . Update for Microsoft Office 2007 (KB2508958) Adobe AIR Adobe Flash Player 11 ActiveX Adobe Flash Player 11 Plugin Adobe Reader XI Adobe Shockwave Player 11.6 Akamai NetSession Interface Amazon Links Apple Application Support Apple Mobile Device Support Apple Software Update ATI Catalyst Install Manager avast! Free Antivirus Bing Bar BloodlineGunZ The Beginning V1 Bonjour BuzzSocialPoints version 1.0 BuzzSocialPoints_DNS version 1.0 BuzzSocialPoints_DNS_IE BuzzSocialPoints_IE Canon Easy-PhotoPrint EX Canon Easy-WebPrint EX Canon Inkjet Printer/Scanner/Fax Extended Survey Program Canon MG3100 series MP Drivers Canon MG3100 series On-screen Manual Canon MG3100 series User Registration Canon MP Navigator EX 5.0 Canon My Printer Canon Solution Menu EX Catalyst Control Center - Branding Catalyst Control Center Core Implementation Catalyst Control Center Graphics Full Existing Catalyst Control Center Graphics Full New Catalyst Control Center Graphics Light Catalyst Control Center Graphics Previews Common Catalyst Control Center Graphics Previews Vista Catalyst Control Center InstallProxy Catalyst Control Center Localization All ccc-core-static ccc-utility64 CCC Help Chinese Standard CCC Help Chinese Traditional CCC Help Czech CCC Help Danish CCC Help Dutch CCC Help English CCC Help Finnish CCC Help French CCC Help German CCC Help Greek CCC Help Hungarian CCC Help Italian CCC Help Japanese CCC Help Korean CCC Help Norwegian CCC Help Polish CCC Help Portuguese CCC Help Russian CCC Help Spanish CCC Help Swedish CCC Help Thai CCC Help Turkish Compatibility Pack for the 2007 Office system Conduit Engine ConservativeTalkNow D3DX10 Dropbox EvilGunZ C11 FIFA 08 FlashWorks Fraps Google Chrome Google Earth Google Toolbar for Internet Explorer Google Update Helper Grand Fantasia InterActual Player iTunes Java 7 Update 7 Java Auto Updater Java 6 Update 29 JavaFX 2.1.0 Junk Mail filter update Label@Once 1.0 LSI V92 MOH Application Malwarebytes Anti-Malware version 1.65.1.1000 Mavis Beacon Deluxe - 25th Anniv. Ed. McAfee Security Scan Plus Messenger Companion Microsoft .NET Framework 4 Client Profile Microsoft Application Error Reporting Microsoft Office 2007 Service Pack 3 (SP3) Microsoft Office Access MUI (English) 2007 Microsoft Office Access Setup Metadata MUI (English) 2007 Microsoft Office Click-to-Run 2010 Microsoft Office Enterprise 2007 Microsoft Office Excel MUI (English) 2007 Microsoft Office File Validation Add-In Microsoft Office Groove MUI (English) 2007 Microsoft Office Groove Setup Metadata MUI (English) 2007 Microsoft Office Home and Business 2010 - English Microsoft Office Home and Student 2007 Microsoft Office InfoPath MUI (English) 2007 Microsoft Office Office 64-bit Components 2007 Microsoft Office OneNote MUI (English) 2007 Microsoft Office Outlook MUI (English) 2007 Microsoft Office PowerPoint MUI (English) 2007 Microsoft Office PowerPoint Viewer 2007 (English) Microsoft Office Professional Plus 2007 Microsoft Office Proof (English) 2007 Microsoft Office Proof (French) 2007 Microsoft Office Proof (Spanish) 2007 Microsoft Office Proofing (English) 2007 Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3) Microsoft Office Publisher MUI (English) 2007 Microsoft Office Shared 64-bit MUI (English) 2007 Microsoft Office Shared 64-bit Setup Metadata MUI (English) 2007 Microsoft Office Shared MUI (English) 2007 Microsoft Office Shared Setup Metadata MUI (English) 2007 Microsoft Office Suite Activation Assistant Microsoft Office Word MUI (English) 2007 Microsoft Silverlight Microsoft SQL Server 2005 Compact Edition [ENU] Microsoft Visual C++ 2005 ATL Update kb973923 - x64 8.0.50727.4053 Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 Microsoft Visual C++ 2005 Redistributable Microsoft Visual C++ 2005 Redistributable (x64) Microsoft Visual C++ 2005 Redistributable (x64) - KB2467175 Microsoft Visual C++ 2008 Redistributable - KB2467174 - x64 9.0.30729.5570 Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570 Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 Microsoft Works Mozilla Firefox 16.0.2 (x86 en-US) Mozilla Maintenance Service MSVCRT MSVCRT_amd64 My Web Search NetZero Launcher Norton Internet Security Pando Media Booster PlayReady PC Runtime amd64 Quickbooks Financial Center RealNetworks - Microsoft Visual C++ 2008 Runtime RealPlayer Realtek Ethernet Controller Driver Realtek High Definition Audio Driver Realtek USB 2.0 Card Reader Realtek WLAN Driver RealUpgrade 1.1 SavageGunZ Installer Security Update for CAPICOM (KB931906) Security Update for Microsoft .NET Framework 4 Client Profile (KB2446708) Security Update for Microsoft .NET Framework 4 Client Profile (KB2478663) Security Update for Microsoft .NET Framework 4 Client Profile (KB2518870) Security Update for Microsoft .NET Framework 4 Client Profile (KB2539636) Security Update for Microsoft .NET Framework 4 Client Profile (KB2572078) Security Update for Microsoft .NET Framework 4 Client Profile (KB2604121) Security Update for Microsoft .NET Framework 4 Client Profile (KB2633870) Security Update for Microsoft .NET Framework 4 Client Profile (KB2656351) Security Update for Microsoft .NET Framework 4 Client Profile (KB2656368) Security Update for Microsoft .NET Framework 4 Client Profile (KB2656368v2) Security Update for Microsoft .NET Framework 4 Client Profile (KB2656405) Security Update for Microsoft .NET Framework 4 Client Profile (KB2686827) Security Update for Microsoft .NET Framework 4 Client Profile (KB2729449) Security Update for Microsoft .NET Framework 4 Client Profile (KB2737019) Security Update for Microsoft Office 2007 suites (KB2596615) 32-Bit Edition Security Update for Microsoft Office 2007 suites (KB2596672) 32-Bit Edition Security Update for Microsoft Office 2007 suites (KB2596744) 32-Bit Edition Security Update for Microsoft Office 2007 suites (KB2596754) 32-Bit Edition Security Update for Microsoft Office 2007 suites (KB2596785) 32-Bit Edition Security Update for Microsoft Office 2007 suites (KB2596792) 32-Bit Edition Security Update for Microsoft Office 2007 suites (KB2596856) 32-Bit Edition Security Update for Microsoft Office 2007 suites (KB2596871) 32-Bit Edition Security Update for Microsoft Office 2007 suites (KB2597969) 32-Bit Edition Security Update for Microsoft Office 2007 suites (KB2687311) 32-Bit Edition Security Update for Microsoft Office 2007 suites (KB2687314) 32-Bit Edition Security Update for Microsoft Office 2007 suites (KB2687439) 32-Bit Edition Security Update for Microsoft Office 2007 suites (KB2687441) 32-Bit Edition Security Update for Microsoft Office Excel 2007 (KB2687307) 32-Bit Edition Security Update for Microsoft Office InfoPath 2007 (KB2687440) 32-Bit Edition Security Update for Microsoft Office PowerPoint 2007 (KB2596764) 32-Bit Edition Security Update for Microsoft Office PowerPoint 2007 (KB2596912) 32-Bit Edition Security Update for Microsoft Office Publisher 2007 (KB2596705) 32-Bit Edition Security Update for Microsoft Office Word 2007 (KB2687315) 32-Bit Edition ShaunWhiteSnowboarding Skype Click to Call Skype Launcher Skype™ 5.10 StartNow Toolbar swMSM SwordSearcher 6.1.1.3 Synaptics Pointing Device Driver TOSHIBA Application Installer TOSHIBA Assist TOSHIBA Bulletin Board TOSHIBA ConfigFree TOSHIBA Disc Creator TOSHIBA DVD PLAYER TOSHIBA eco Utility TOSHIBA Extended Tiles for Windows Mobility Center TOSHIBA Face Recognition TOSHIBA Hardware Setup TOSHIBA HDD/SSD Alert TOSHIBA Internal Modem Region Select Utility TOSHIBA Media Controller Toshiba Online Backup TOSHIBA PC Health Monitor TOSHIBA Quality Application TOSHIBA Recovery Media Creator TOSHIBA ReelTime TOSHIBA Service Station TOSHIBA Software Modem TOSHIBA Speech System Applications TOSHIBA Speech System SR Engine(U.S.) Version1.0 TOSHIBA Speech System TTS Engine(U.S.) Version1.0 TOSHIBA Supervisor Password TOSHIBA Value Added Package TOSHIBA Web Camera Application ToshibaRegistration Unity Web Player Update for 2007 Microsoft Office System (KB967642) Update for Microsoft .NET Framework 4 Client Profile (KB2468871) Update for Microsoft .NET Framework 4 Client Profile (KB2533523) Update for Microsoft .NET Framework 4 Client Profile (KB2600217) Update for Microsoft Office 2007 Help for Common Features (KB963673) Update for Microsoft Office 2007 suites (KB2596660) 32-Bit Edition Update for Microsoft Office 2007 suites (KB2596848) 32-Bit Edition Update for Microsoft Office Access 2007 Help (KB963663) Update for Microsoft Office Excel 2007 Help (KB963678) Update for Microsoft Office Infopath 2007 Help (KB963662) Update for Microsoft Office OneNote 2007 Help (KB963670) Update for Microsoft Office Outlook 2007 (KB2687404) 32-Bit Edition Update for Microsoft Office Outlook 2007 Help (KB963677) Update for Microsoft Office Outlook 2007 Junk Email Filter (KB2760413) 32-Bit Edition Update for Microsoft Office Powerpoint 2007 Help (KB963669) Update for Microsoft Office Publisher 2007 Help (KB963667) Update for Microsoft Office Script Editor Help (KB963671) Update for Microsoft Office Word 2007 Help (KB963665) Visual C++ 8.0 Runtime Setup Package Visual C++ 8.0 Runtime Setup Package (x64) VitalSource Bookshelf vshare.tv Bar Toolbar vShare.tv plugin 1.3 Windows Live Communications Platform Windows Live Essentials Windows Live ID Sign-in Assistant Windows Live Installer Windows Live Language Selector Windows Live Mail Windows Live Messenger Windows Live Messenger Companion Core Windows Live MIME IFilter Windows Live Movie Maker Windows Live Photo Common Windows Live Photo Gallery Windows Live PIMT Platform Windows Live SOXE Windows Live SOXE Definitions Windows Live Sync Windows Live UX Platform Windows Live UX Platform Language Pack Windows Live Writer Windows Live Writer Resources Windows Media Player Firefox Plugin WinRAR 4.01 (64-bit) Yahoo! Install Manager . ==== Event Viewer Messages From Past Week ======== . 12/4/2012 9:46:12 AM, Error: atikmdag [52236] - CPLIB :: General - Invalid Parameter 12/4/2012 5:17:24 PM, Error: atikmdag [43029] - Display is not active 12/3/2012 11:38:00 PM, Error: volmgr [46] - Crash dump initialization failed! 12/2/2012 2:31:05 PM, Error: Service Control Manager [7011] - A timeout (30000 milliseconds) was reached while waiting for a transaction response from the AMD External Events Utility service. 11/28/2012 12:19:21 AM, Error: Service Control Manager [7011] - A timeout (30000 milliseconds) was reached while waiting for a transaction response from the ShellHWDetection service. . ==== End Of File ===========================
  11. Sorry for the double post , but one thing i forgot to mention. Also when the QuickScan finished it checked some files to be removed named Trojan.Agent and it looks like its in System 32? I dunno, and i think i read somewhere that things in System 32 shouldnt be touched or the computer wont run correctly? so i havent removed any of the infections after the scan.
  12. Hello there, pardon me if i missed some parts , but i already downloaded Malwarebytes in order to try to remove the infections myself. The problem im having is a few days ago i noticed that when i would play Youtube videos there would be alot of Ads showing up that never did and and orange "Skip Ad" picture would show up over the play button. *This is not my picture, its just to show you what im talking about , this picture is an example from another user* And today i noticed the computer was being a bit slower than normal. I downloaded malwarebytes and ran a quick scan. and it saids there were more than 100 infections.....il have to wait and see if it wont be 300 when i do a full scan. As for the computer its running fairly well, my concern is that is okay to delete all the things that were found. Many of them are in the category of Registry Key and Registry value and i heard messing with the registry can mess the computer up, so i dunno what to do. Is it safe to delete them. Thank you for the reply. Malwarebytes Anti-Malware (Trial) 1.65.1.1000 www.malwarebytes.org Database version: v2012.12.04.02 Windows 7 Service Pack 1 x64 NTFS Internet Explorer 9.0.8112.16421 brandsmart :: BRANDSMART-PC [administrator] Protection: Enabled 12/4/2012 12:34:47 AM mbam-log-2012-12-04 (01-02-18).txt Scan type: Quick scan Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM Scan options disabled: P2P Objects scanned: 231679 Time elapsed: 9 minute(s), 45 second(s) Memory Processes Detected: 0 (No malicious items detected) Memory Modules Detected: 0 (No malicious items detected) Registry Keys Detected: 127 HKLM\SYSTEM\CurrentControlSet\Services\MyWebSearchService (PUP.MyWebSearch) -> No action taken. HKCR\CLSID\{00A6FAF1-072E-44cf-8957-5838F569A31D} (PUP.MyWebSearch) -> No action taken. HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{00A6FAF1-072E-44CF-8957-5838F569A31D} (PUP.MyWebSearch) -> No action taken. HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{00A6FAF1-072E-44CF-8957-5838F569A31D} (PUP.MyWebSearch) -> No action taken. HKCR\CLSID\{00A6FAF6-072E-44cf-8957-5838F569A31D} (PUP.MyWebSearch) -> No action taken. HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{00A6FAF6-072E-44CF-8957-5838F569A31D} (PUP.MyWebSearch) -> No action taken. HKCR\CLSID\{07B18EA1-A523-4961-B6BB-170DE4475CCA} (PUP.MyWebSearch) -> No action taken. HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{07B18EA1-A523-4961-B6BB-170DE4475CCA} (PUP.MyWebSearch) -> No action taken. HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{07B18EA1-A523-4961-B6BB-170DE4475CCA} (PUP.MyWebSearch) -> No action taken. HKCR\CLSID\{07B18EA9-A523-4961-B6BB-170DE4475CCA} (PUP.MyWebSearch) -> No action taken. HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{07B18EA9-A523-4961-B6BB-170DE4475CCA} (PUP.MyWebSearch) -> No action taken. HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{07B18EA9-A523-4961-B6BB-170DE4475CCA} (PUP.MyWebSearch) -> No action taken. HKCR\CLSID\{07B18EAB-A523-4961-B6BB-170DE4475CCA} (PUP.MyWebSearch) -> No action taken. HKCR\TypeLib\{07B18EA0-A523-4961-B6BB-170DE4475CCA} (PUP.MyWebSearch) -> No action taken. HKCR\Interface\{07B18EAA-A523-4961-B6BB-170DE4475CCA} (PUP.MyWebSearch) -> No action taken. HKCR\MyWebSearchToolBar.SettingsPlugin.1 (PUP.MyWebSearch) -> No action taken. HKCR\MyWebSearchToolBar.SettingsPlugin (PUP.MyWebSearch) -> No action taken. HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{07B18EAB-A523-4961-B6BB-170DE4475CCA} (PUP.MyWebSearch) -> No action taken. HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{07B18EAB-A523-4961-B6BB-170DE4475CCA} (PUP.MyWebSearch) -> No action taken. HKCR\CLSID\{0F8ECF4F-3646-4C3A-8881-8E138FFCAF70} (PUP.MyWebSearch) -> No action taken. HKCR\TypeLib\{8CA01F0E-987C-49C3-B852-2F1AC4A7094C} (PUP.MyWebSearch) -> No action taken. HKCR\Interface\{1093995A-BA37-41D2-836E-091067C4AD17} (PUP.MyWebSearch) -> No action taken. HKCR\FunWebProducts.IECookiesManager.1 (PUP.MyWebSearch) -> No action taken. HKCR\FunWebProducts.IECookiesManager (PUP.MyWebSearch) -> No action taken. HKCR\CLSID\{147A976F-EEE1-4377-8EA7-4716E4CDD239} (PUP.MyWebSearch) -> No action taken. HKCR\CLSID\{1E0DE227-5CE4-4ea3-AB0C-8B03E1AA76BC} (PUP.MyWebSearch) -> No action taken. HKCR\CLSID\{25560540-9571-4D7B-9389-0F166788785A} (PUP.MyWebSearch) -> No action taken. HKCR\TypeLib\{C8CECDE3-1AE1-4C4A-AD82-6D5B00212144} (PUP.MyWebSearch) -> No action taken. HKCR\Interface\{17DE5E5E-BFE3-4E83-8E1F-8755795359EC} (PUP.MyWebSearch) -> No action taken. HKCR\FunWebProducts.DataControl.1 (PUP.MyWebSearch) -> No action taken. HKCR\FunWebProducts.DataControl (PUP.MyWebSearch) -> No action taken. HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{25560540-9571-4D7B-9389-0F166788785A} (PUP.MyWebSearch) -> No action taken. HKCR\CLSID\{3DC201FB-E9C9-499C-A11F-23C360D7C3F8} (PUP.MyWebSearch) -> No action taken. HKCR\FunWebProducts.HTMLMenu.2 (PUP.MyWebSearch) -> No action taken. HKCR\FunWebProducts.HTMLMenu (PUP.MyWebSearch) -> No action taken. HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{3DC201FB-E9C9-499C-A11F-23C360D7C3F8} (PUP.MyWebSearch) -> No action taken. HKCR\CLSID\{3E720452-B472-4954-B7AA-33069EB53906} (PUP.MyWebSearch) -> No action taken. HKCR\TypeLib\{3E720450-B472-4954-B7AA-33069EB53906} (PUP.MyWebSearch) -> No action taken. HKCR\Interface\{3E720451-B472-4954-B7AA-33069EB53906} (PUP.MyWebSearch) -> No action taken. HKCR\MyWebSearch.HTMLPanel.1 (PUP.MyWebSearch) -> No action taken. HKCR\MyWebSearch.HTMLPanel (PUP.MyWebSearch) -> No action taken. HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{3E720452-B472-4954-B7AA-33069EB53906} (PUP.MyWebSearch) -> No action taken. HKCR\CLSID\{53CED2D0-5E9A-4761-9005-648404E6F7E5} (PUP.MyWebSearch) -> No action taken. HKCR\MyWebSearchToolBar.ToolbarPlugin.1 (PUP.MyWebSearch) -> No action taken. HKCR\MyWebSearchToolBar.ToolbarPlugin (PUP.MyWebSearch) -> No action taken. HKCR\CLSID\{63D0ED2C-B45B-4458-8B3B-60C69BBBD83C} (PUP.MyWebSearch) -> No action taken. HKCR\TypeLib\{8E6F1830-9607-4440-8530-13BE7C4B1D14} (PUP.MyWebSearch) -> No action taken. HKCR\Interface\{63D0ED2B-B45B-4458-8B3B-60C69BBBD83C} (PUP.MyWebSearch) -> No action taken. HKCR\FunWebProducts.PopSwatterSettingsControl.1 (PUP.MyWebSearch) -> No action taken. HKCR\FunWebProducts.PopSwatterSettingsControl (PUP.MyWebSearch) -> No action taken. HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{63D0ED2C-B45B-4458-8B3B-60C69BBBD83C} (PUP.MyWebSearch) -> No action taken. HKCR\CLSID\{7473D292-B7BB-4f24-AE82-7E2CE94BB6A9} (PUP.MyWebSearch) -> No action taken. HKCR\TypeLib\{7473D290-B7BB-4f24-AE82-7E2CE94BB6A9} (PUP.MyWebSearch) -> No action taken. HKCR\Interface\{7473D291-B7BB-4F24-AE82-7E2CE94BB6A9} (PUP.MyWebSearch) -> No action taken. HKCR\CLSID\{7473D294-B7BB-4f24-AE82-7E2CE94BB6A9} (PUP.MyWebSearch) -> No action taken. HKCR\MyWebSearch.PseudoTransparentPlugin.1 (PUP.MyWebSearch) -> No action taken. HKCR\MyWebSearch.PseudoTransparentPlugin (PUP.MyWebSearch) -> No action taken. HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{7473D294-B7BB-4F24-AE82-7E2CE94BB6A9} (PUP.MyWebSearch) -> No action taken. HKCR\CLSID\{7473D296-B7BB-4f24-AE82-7E2CE94BB6A9} (PUP.MyWebSearch) -> No action taken. HKCR\CLSID\{84DA4FDF-A1CF-4195-8688-3E961F505983} (PUP.MyWebSearch) -> No action taken. HKCR\CLSID\{8E6F1832-9607-4440-8530-13BE7C4B1D14} (PUP.MyWebSearch) -> No action taken. HKCR\FunWebProducts.PopSwatterBarButton.1 (PUP.MyWebSearch) -> No action taken. HKCR\FunWebProducts.PopSwatterBarButton (PUP.MyWebSearch) -> No action taken. HKCR\CLSID\{938AA51A-996C-4884-98CE-80DD16A5C9DA} (PUP.MyWebSearch) -> No action taken. HKCR\CLSID\{98D9753D-D73B-42D5-8C85-4469CDA897AB} (PUP.MyWebSearch) -> No action taken. HKCR\FunWebProducts.HTMLMenu.1 (PUP.MyWebSearch) -> No action taken. HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{98D9753D-D73B-42D5-8C85-4469CDA897AB} (PUP.MyWebSearch) -> No action taken. HKCR\CLSID\{9FF05104-B030-46FC-94B8-81276E4E27DF} (PUP.MyWebSearch) -> No action taken. HKCR\TypeLib\{29D67D3C-509A-4544-903F-C8C1B8236554} (PUP.MyWebSearch) -> No action taken. HKCR\Interface\{2E3537FC-CF2F-4F56-AF54-5A6A3DD375CC} (PUP.MyWebSearch) -> No action taken. HKCR\ScreenSaverControl.ScreenSaverInstaller.1 (PUP.MyWebSearch) -> No action taken. HKCR\ScreenSaverControl.ScreenSaverInstaller (PUP.MyWebSearch) -> No action taken. HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{9FF05104-B030-46FC-94B8-81276E4E27DF} (PUP.MyWebSearch) -> No action taken. HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{9FF05104-B030-46FC-94B8-81276E4E27DF} (PUP.MyWebSearch) -> No action taken. HKCR\CLSID\{A9571378-68A1-443d-B082-284F960C6D17} (PUP.MyWebSearch) -> No action taken. HKCR\CLSID\{ADB01E81-3C79-4272-A0F1-7B2BE7A782DC} (PUP.MyWebSearch) -> No action taken. HKCR\MyWebSearch.OutlookAddin.1 (PUP.MyWebSearch) -> No action taken. HKCR\MyWebSearch.OutlookAddin (PUP.MyWebSearch) -> No action taken. HKCR\CLSID\{B813095C-81C0-4E40-AA14-67520372B987} (PUP.MyWebSearch) -> No action taken. HKCR\FunWebProducts.KillerObjManager.1 (PUP.MyWebSearch) -> No action taken. HKCR\FunWebProducts.KillerObjManager (PUP.MyWebSearch) -> No action taken. HKCR\CLSID\{C9D7BE3E-141A-4C85-8CD6-32461F3DF2C7} (PUP.MyWebSearch) -> No action taken. HKCR\FunWebProducts.HistoryKillerScheduler.1 (PUP.MyWebSearch) -> No action taken. HKCR\FunWebProducts.HistoryKillerScheduler (PUP.MyWebSearch) -> No action taken. HKCR\CLSID\{CFF4CE82-3AA2-451F-9B77-7165605FB835} (PUP.MyWebSearch) -> No action taken. HKCR\FunWebProducts.HistorySwatterControlBar.1 (PUP.MyWebSearch) -> No action taken. HKCR\FunWebProducts.HistorySwatterControlBar (PUP.MyWebSearch) -> No action taken. HKCR\CLSID\{D9FFFB27-D62A-4D64-8CEC-1FF006528805} (PUP.MyWebSearch) -> No action taken. HKCR\TypeLib\{0D26BC71-A633-4E71-AD31-EADC3A1B6A3A} (PUP.MyWebSearch) -> No action taken. HKCR\Interface\{E342AF55-B78A-4CD0-A2BB-DA7F52D9D25E} (PUP.MyWebSearch) -> No action taken. HKCR\CLSID\{E79DFBCA-5697-4fbd-94E5-5B2A9C7C1612} (PUP.MyWebSearch) -> No action taken. HKCR\TypeLib\{E79DFBC0-5697-4FBD-94E5-5B2A9C7C1612} (PUP.MyWebSearch) -> No action taken. HKCR\Interface\{72EE7F04-15BD-4845-A005-D6711144D86A} (PUP.MyWebSearch) -> No action taken. HKCR\MyWebSearch.ChatSessionPlugin.1 (PUP.MyWebSearch) -> No action taken. HKCR\MyWebSearch.ChatSessionPlugin (PUP.MyWebSearch) -> No action taken. HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{E79DFBCA-5697-4FBD-94E5-5B2A9C7C1612} (PUP.MyWebSearch) -> No action taken. HKCR\Typelib\{D518921A-4A03-425E-9873-B9A71756821E} (PUP.MyWebSearch) -> No action taken. HKCR\Interface\{CF54BE1C-9359-4395-8533-1657CF209CFE} (PUP.MyWebSearch) -> No action taken. HKCR\Typelib\{E47CAEE0-DEEA-464A-9326-3F2801535A4D} (PUP.MyWebSearch) -> No action taken. HKCR\Interface\{3E1656ED-F60E-4597-B6AA-B6A58E171495} (PUP.MyWebSearch) -> No action taken. HKCR\Typelib\{F42228FB-E84E-479E-B922-FBBD096E792C} (PUP.MyWebSearch) -> No action taken. HKCR\Interface\{6E74766C-4D93-4CC0-96D1-47B8E07FF9CA} (PUP.MyWebSearch) -> No action taken. HKCU\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{56256A51-B582-467e-B8D4-7786EDA79AE0} (Trojan.Vundo) -> No action taken. HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{56256A51-B582-467e-B8D4-7786EDA79AE0} (Trojan.Vundo) -> No action taken. HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{59C7FC09-1C83-4648-B3E6-003D2BBC7481} (PUP.MyWebSearch) -> No action taken. HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{68AF847F-6E91-45dd-9B68-D6A12C30E5D7} (PUP.MyWebSearch) -> No action taken. HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{9170B96C-28D4-4626-8358-27E6CAEEF907} (PUP.MyWebSearch) -> No action taken. HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{D1A71FA0-FF48-48dd-9B6D-7A13A3E42127} (PUP.MyWebSearch) -> No action taken. HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{DDB1968E-EAD6-40fd-8DAE-FF14757F60C7} (PUP.MyWebSearch) -> No action taken. HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{F138D901-86F0-4383-99B6-9CDD406036DA} (PUP.MyWebSearch) -> No action taken. HKCR\MyWebSearch.MultipleButton (PUP.MyWebSearch) -> No action taken. HKCR\MyWebSearch.MultipleButton.1 (PUP.MyWebSearch) -> No action taken. HKCR\MyWebSearch.ThirdPartyInstaller (PUP.MyWebSearch) -> No action taken. HKCR\MyWebSearch.ThirdPartyInstaller.1 (PUP.MyWebSearch) -> No action taken. HKCR\MyWebSearch.UrlAlertButton (PUP.MyWebSearch) -> No action taken. HKCR\MyWebSearch.UrlAlertButton.1 (PUP.MyWebSearch) -> No action taken. HKCU\SOFTWARE\MyWebSearch (PUP.MyWebSearch) -> No action taken. HKCU\Software\AppDataLow\Software\MyWebSearch (PUP.MyWebsearch) -> No action taken. HKLM\SOFTWARE\FocusInteractive (PUP.MyWebSearch) -> No action taken. HKLM\SOFTWARE\Fun Web Products (PUP.MyWebSearch) -> No action taken. HKLM\SOFTWARE\MyWebSearch (PUP.MyWebSearch) -> No action taken. HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\RunDll32Policy\f3ScrCtr.dll (PUP.MyWebSearch) -> No action taken. HKLM\SOFTWARE\Microsoft\Multimedia\WMPlayer\Schemes\f3pss (PUP.MyWebSearch) -> No action taken. HKLM\SOFTWARE\Microsoft\Office\Outlook\Addins\MyWebSearch.OutlookAddin (PUP.MyWebSearch) -> No action taken. HKLM\SOFTWARE\Microsoft\Office\Word\Addins\MyWebSearch.OutlookAddin (PUP.MyWebSearch) -> No action taken. HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MyWebSearch bar Uninstall (PUP.MyWebSearch) -> No action taken. HKLM\SOFTWARE\MozillaPlugins\@mywebsearch.com/Plugin (PUP.MyWebSearch) -> No action taken. Registry Values Detected: 5 HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run|MyWebSearch Email Plugin (PUP.MyWebSearch) -> Data: C:\PROGRA~2\MYWEBS~1\bar\2.bin\mwsoemon.exe -> No action taken. HKLM\SOFTWARE\Microsoft\Windows Media\WMSDK\Sources|f3PopularScreensavers (PUP.MyWebSearch) -> Data: C:\Program Files (x86)\MyWebSearch\bar\2.bin\F3SCRCTR.DLL -> No action taken. HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform|FunWebProducts (PUP.MyWebSearch) -> Data: -> No action taken. HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run|My Web Search Bar Search Scope Monitor (PUP.MyWebSearch) -> Data: "C:\PROGRA~2\MYWEBS~1\bar\2.bin\m3SrchMn.exe" /m=2 /w /h -> No action taken. HKLM\SOFTWARE\Mozilla\Firefox\Extensions|m3ffxtbr@mywebsearch.com (PUP.MyWebSearch) -> Data: C:\Program Files (x86)\MyWebSearch\bar\2.bin -> No action taken. Registry Data Items Detected: 0 (No malicious items detected) Folders Detected: 17 C:\Program Files (x86)\FunWebProducts (PUP.MyWebSearch) -> No action taken. C:\Program Files (x86)\FunWebProducts\ScreenSaver (PUP.MyWebSearch) -> No action taken. C:\Program Files (x86)\FunWebProducts\ScreenSaver\Images (PUP.MyWebSearch) -> No action taken. C:\Program Files (x86)\MyWebSearch (PUP.MyWebSearch) -> No action taken. C:\Program Files (x86)\MyWebSearch\bar (PUP.MyWebSearch) -> No action taken. C:\Program Files (x86)\MyWebSearch\bar\1.bin (PUP.MyWebSearch) -> No action taken. C:\Program Files (x86)\MyWebSearch\bar\1.bin\chrome (PUP.MyWebSearch) -> No action taken. C:\Program Files (x86)\MyWebSearch\bar\2.bin (PUP.MyWebSearch) -> No action taken. C:\Program Files (x86)\MyWebSearch\bar\2.bin\chrome (PUP.MyWebSearch) -> No action taken. C:\Program Files (x86)\MyWebSearch\bar\Avatar (PUP.MyWebSearch) -> No action taken. C:\Program Files (x86)\MyWebSearch\bar\Game (PUP.MyWebSearch) -> No action taken. C:\Program Files (x86)\MyWebSearch\bar\History (PUP.MyWebSearch) -> No action taken. C:\Program Files (x86)\MyWebSearch\bar\icons (PUP.MyWebSearch) -> No action taken. C:\Program Files (x86)\MyWebSearch\bar\Message (PUP.MyWebSearch) -> No action taken. C:\Program Files (x86)\MyWebSearch\bar\Notifier (PUP.MyWebSearch) -> No action taken. C:\Program Files (x86)\MyWebSearch\bar\Overlay (PUP.MyWebSearch) -> No action taken. C:\Program Files (x86)\MyWebSearch\bar\Settings (PUP.MyWebSearch) -> No action taken. Files Detected: 51 C:\Program Files (x86)\MyWebSearch\bar\2.bin\MWSSVC.EXE (PUP.MyWebSearch) -> No action taken. C:\Program Files (x86)\MyWebSearch\bar\2.bin\F3HISTSW.DLL (PUP.MyWebSearch) -> No action taken. C:\Program Files (x86)\MyWebSearch\bar\2.bin\F3DTACTL.DLL (PUP.MyWebSearch) -> No action taken. C:\Program Files (x86)\MyWebSearch\bar\2.bin\M3HTML.DLL (PUP.MyWebSearch) -> No action taken. C:\Program Files (x86)\MyWebSearch\bar\2.bin\F3CJPEG.DLL (PUP.MyWebSearch) -> No action taken. C:\Program Files (x86)\MyWebSearch\bar\2.bin\F3HTTPCT.DLL (PUP.MyWebSearch) -> No action taken. C:\Program Files (x86)\MyWebSearch\bar\2.bin\M3MSG.DLL (PUP.MyWebSearch) -> No action taken. C:\Windows\System32\f3PSSavr.scr (PUP.FunWebProducts) -> No action taken. C:\Users\brandsmart\Downloads\Acapella Praise - Hosanna! Music (1993).mp3.exe (Affiliate.Downloader) -> No action taken. C:\Windows\System32\f3PSSavr.scr (Trojan.Agent) -> No action taken. C:\Windows\SysWOW64\f3PSSavr.scr (Trojan.Agent) -> No action taken. C:\Users\brandsmart\AppData\Local\Temp\.exe (Trojan.Agent) -> No action taken. C:\Program Files (x86)\MyWebSearch\bar\1.bin\chrome\M3FFXTBR.JAR (PUP.MyWebSearch) -> No action taken. C:\Program Files (x86)\MyWebSearch\bar\2.bin\CHROME.MANIFEST (PUP.MyWebSearch) -> No action taken. C:\Program Files (x86)\MyWebSearch\bar\2.bin\F3BKGERR.JPG (PUP.MyWebSearch) -> No action taken. C:\Program Files (x86)\MyWebSearch\bar\2.bin\F3IMSTUB.DLL (PUP.MyWebSearch) -> No action taken. C:\Program Files (x86)\MyWebSearch\bar\2.bin\F3PSSAVR.SCR (PUP.MyWebSearch) -> No action taken. C:\Program Files (x86)\MyWebSearch\bar\2.bin\F3REGHK.DLL (PUP.MyWebSearch) -> No action taken. C:\Program Files (x86)\MyWebSearch\bar\2.bin\F3RESTUB.DLL (PUP.MyWebSearch) -> No action taken. C:\Program Files (x86)\MyWebSearch\bar\2.bin\F3SPACER.WMV (PUP.MyWebSearch) -> No action taken. C:\Program Files (x86)\MyWebSearch\bar\2.bin\F3WALLPP.DAT (PUP.MyWebSearch) -> No action taken. C:\Program Files (x86)\MyWebSearch\bar\2.bin\F3WPHOOK.DLL (PUP.MyWebSearch) -> No action taken. C:\Program Files (x86)\MyWebSearch\bar\2.bin\FWPBUDDY.PNG (PUP.MyWebSearch) -> No action taken. C:\Program Files (x86)\MyWebSearch\bar\2.bin\INSTALL.RDF (PUP.MyWebSearch) -> No action taken. C:\Program Files (x86)\MyWebSearch\bar\2.bin\M3IMPIPE.EXE (PUP.MyWebSearch) -> No action taken. C:\Program Files (x86)\MyWebSearch\bar\2.bin\M3SKPLAY.EXE (PUP.MyWebSearch) -> No action taken. C:\Program Files (x86)\MyWebSearch\bar\2.bin\chrome\M3FFXTBR.JAR (PUP.MyWebSearch) -> No action taken. C:\Program Files (x86)\MyWebSearch\bar\Avatar\COMMON.F3S (PUP.MyWebSearch) -> No action taken. C:\Program Files (x86)\MyWebSearch\bar\Game\CHECKERS.F3S (PUP.MyWebSearch) -> No action taken. C:\Program Files (x86)\MyWebSearch\bar\Game\CHESS.F3S (PUP.MyWebSearch) -> No action taken. C:\Program Files (x86)\MyWebSearch\bar\Game\REVERSI.F3S (PUP.MyWebSearch) -> No action taken. C:\Program Files (x86)\MyWebSearch\bar\icons\CM.ICO (PUP.MyWebSearch) -> No action taken. C:\Program Files (x86)\MyWebSearch\bar\icons\MFC.ICO (PUP.MyWebSearch) -> No action taken. C:\Program Files (x86)\MyWebSearch\bar\icons\PSS.ICO (PUP.MyWebSearch) -> No action taken. C:\Program Files (x86)\MyWebSearch\bar\icons\SMILEY.ICO (PUP.MyWebSearch) -> No action taken. C:\Program Files (x86)\MyWebSearch\bar\icons\WB.ICO (PUP.MyWebSearch) -> No action taken. C:\Program Files (x86)\MyWebSearch\bar\icons\ZWINKY.ICO (PUP.MyWebSearch) -> No action taken. C:\Program Files (x86)\MyWebSearch\bar\Message\COMMON.F3S (PUP.MyWebSearch) -> No action taken. C:\Program Files (x86)\MyWebSearch\bar\Notifier\COMMON.F3S (PUP.MyWebSearch) -> No action taken. C:\Program Files (x86)\MyWebSearch\bar\Notifier\DOG.F3S (PUP.MyWebSearch) -> No action taken. C:\Program Files (x86)\MyWebSearch\bar\Notifier\FISH.F3S (PUP.MyWebSearch) -> No action taken. C:\Program Files (x86)\MyWebSearch\bar\Notifier\KUNGFU.F3S (PUP.MyWebSearch) -> No action taken. C:\Program Files (x86)\MyWebSearch\bar\Notifier\LIFEGARD.F3S (PUP.MyWebSearch) -> No action taken. C:\Program Files (x86)\MyWebSearch\bar\Notifier\MAID.F3S (PUP.MyWebSearch) -> No action taken. C:\Program Files (x86)\MyWebSearch\bar\Notifier\MAILBOX.F3S (PUP.MyWebSearch) -> No action taken. C:\Program Files (x86)\MyWebSearch\bar\Notifier\OPERA.F3S (PUP.MyWebSearch) -> No action taken. C:\Program Files (x86)\MyWebSearch\bar\Notifier\ROBOT.F3S (PUP.MyWebSearch) -> No action taken. C:\Program Files (x86)\MyWebSearch\bar\Notifier\SEDUCT.F3S (PUP.MyWebSearch) -> No action taken. C:\Program Files (x86)\MyWebSearch\bar\Notifier\SURFER.F3S (PUP.MyWebSearch) -> No action taken. C:\Program Files (x86)\MyWebSearch\bar\Overlay\COMMON.F3S (PUP.MyWebSearch) -> No action taken. C:\Program Files (x86)\MyWebSearch\bar\Settings\s_pid.dat (PUP.MyWebSearch) -> No action taken. (end)
Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.