Jump to content

mskade

Members
  • Posts

    15
  • Joined

  • Last visited

Posts posted by mskade

  1. Hello!

    Yesterday, I tried downloading the files for the online scanner (which you said will take a long time to do) but somehow, files won't download.

    While doing this, I was transferring some songs to iPad and iTunes froze because a file was corrupted or something (I'm not sure). Anyway, the whole laptop froze and I unplugged the iPad from the laptop yet the laptop still froze. So I just turned it off by pressing the power key for a long time... Now, when I open the laptop, scan disk always appear and there were lines saying, "Remove bad sector" number blah blah blah... I want to disappear this step from booting the computer. What should I do?

    Anyway, I am still downloading the files now for the online scanner. It is already at 15%.

    Thanks for being patient.

    Kade

  2. Logfile of Trend Micro HijackThis v2.0.4

    Scan saved at 10:23:05 PM, on 1/8/2013

    Platform: Windows 7 (WinNT 6.00.3504)

    MSIE: Internet Explorer v8.00 (8.00.7600.16385)

    Boot mode: Normal

    Running processes:

    C:\Windows\system32\taskhost.exe

    C:\Windows\system32\Dwm.exe

    C:\Windows\Explorer.EXE

    C:\Program Files\Avira\AntiVir Desktop\avgnt.exe

    C:\Program Files\Common Files\Real\Update_OB\realsched.exe

    C:\Program Files\Quick net\ModemListener.exe

    C:\Program Files\Samsung\Kies\KiesTrayAgent.exe

    C:\Program Files\iTunes\iTunesHelper.exe

    C:\Program Files\Common Files\Java\Java Update\jusched.exe

    C:\Program Files\Windows Sidebar\sidebar.exe

    C:\Windows\System32\StikyNot.exe

    C:\Program Files\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe

    C:\Program Files\Common Files\Apple\Internet Services\ubd.exe

    C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE

    C:\Program Files\Common Files\Apple\Apple Application Support\distnoted.exe

    C:\Windows\system32\conhost.exe

    C:\Windows\system32\taskeng.exe

    C:\Program Files\Mozilla Firefox\firefox.exe

    C:\Windows\notepad.exe

    C:\Program Files\Mozilla Firefox\plugin-container.exe

    C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_4_402_287.exe

    C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_4_402_287.exe

    C:\Windows\system32\SearchFilterHost.exe

    C:\Users\star\Desktop\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =

    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local

    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =

    O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll

    O2 - BHO: Java Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll

    O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll

    O2 - BHO: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll

    O3 - Toolbar: &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll

    O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min

    O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot

    O4 - HKLM\..\Run: [ModemListener] C:\Program Files\Quick net\ModemListener.exe start

    O4 - HKLM\..\Run: [KiesTrayAgent] C:\Program Files\Samsung\Kies\KiesTrayAgent.exe

    O4 - HKLM\..\Run: [APSDaemon] "C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe"

    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\Magic Video Converter\codec\quicktime\QTTask.exe" -atboottime

    O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"

    O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"

    O4 - HKCU\..\Run: [Facebook Update] "C:\Users\star\AppData\Local\Facebook\Update\FacebookUpdate.exe" /c /nocrashserver

    O4 - HKCU\..\Run: [sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun

    O4 - HKCU\..\Run: [RESTART_STICKY_NOTES] C:\Windows\System32\StikyNot.exe

    O4 - HKCU\..\Run: [KiesPDLR] C:\Program Files\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe

    O4 - HKCU\..\Run: [MobileDocuments] C:\Program Files\Common Files\Apple\Internet Services\ubd.exe

    O4 - Startup: OneNote 2007 Screen Clipper and Launcher.lnk = C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE

    O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\Windows\system32\GPhotos.scr/200

    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - (no file)

    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - (no file)

    O9 - Extra button: Blog This - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll

    O9 - Extra 'Tools' menuitem: &Blog This in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll

    O15 - Trusted Zone: *.clonewarsadventures.com

    O15 - Trusted Zone: *.freerealms.com

    O15 - Trusted Zone: *.soe.com

    O15 - Trusted Zone: *.sony.com

    O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~3\Office12\GRA32A~1.DLL

    O23 - Service: Avira AntiVir Scheduler (AntiVirSchedulerService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\sched.exe

    O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\avguard.exe

    O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

    O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe

    O23 - Service: DeviceManager - Unknown owner - C:\Program Files\Common Files\DeviceHelper\DeviceManager.exe

    O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe

    O23 - Service: Google Update Service (gupdatem) (gupdatem) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe

    O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe

    O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe

    O23 - Service: MBAMScheduler - Malwarebytes Corporation - C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe

    O23 - Service: MBAMService - Malwarebytes Corporation - C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe

    O23 - Service: Mozilla Maintenance Service (MozillaMaintenance) - Mozilla Foundation - C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe

    O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe

    --

    End of file - 6428 bytes

    Sorry, replying took so long. ESET took a long time and it said at the end that there is an error. I am doing it again as of this moment,

  3. I wasn't able to click on Show Results and do the next step. But here is the log generated from the quick scan using MBAM:

    Malwarebytes Anti-Malware (Trial) 1.70.0.1100

    www.malwarebytes.org

    Database version: v2013.01.08.07

    Windows 7 x86 NTFS

    Internet Explorer 8.0.7600.16385

    star :: STAR-PC [administrator]

    Protection: Disabled

    1/8/2013 10:06:54 PM

    mbam-log-2013-01-08 (22-06-54).txt

    Scan type: Quick scan

    Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM

    Scan options disabled: P2P

    Objects scanned: 207636

    Time elapsed: 5 minute(s), 28 second(s)

    Memory Processes Detected: 0

    (No malicious items detected)

    Memory Modules Detected: 0

    (No malicious items detected)

    Registry Keys Detected: 0

    (No malicious items detected)

    Registry Values Detected: 0

    (No malicious items detected)

    Registry Data Items Detected: 0

    (No malicious items detected)

    Folders Detected: 0

    (No malicious items detected)

    Files Detected: 0

    (No malicious items detected)

    (end)

    Logfile of Trend Micro HijackThis v2.0.4

    Scan saved at 10:23:05 PM, on 1/8/2013

    Platform: Windows 7 (WinNT 6.00.3504)

    MSIE: Internet Explorer v8.00 (8.00.7600.16385)

    Boot mode: Normal

    Running processes:

    C:\Windows\system32\taskhost.exe

    C:\Windows\system32\Dwm.exe

    C:\Windows\Explorer.EXE

    C:\Program Files\Avira\AntiVir Desktop\avgnt.exe

    C:\Program Files\Common Files\Real\Update_OB\realsched.exe

    C:\Program Files\Quick net\ModemListener.exe

    C:\Program Files\Samsung\Kies\KiesTrayAgent.exe

    C:\Program Files\iTunes\iTunesHelper.exe

    C:\Program Files\Common Files\Java\Java Update\jusched.exe

    C:\Program Files\Windows Sidebar\sidebar.exe

    C:\Windows\System32\StikyNot.exe

    C:\Program Files\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe

    C:\Program Files\Common Files\Apple\Internet Services\ubd.exe

    C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE

    C:\Program Files\Common Files\Apple\Apple Application Support\distnoted.exe

    C:\Windows\system32\conhost.exe

    C:\Windows\system32\taskeng.exe

    C:\Program Files\Mozilla Firefox\firefox.exe

    C:\Windows\notepad.exe

    C:\Program Files\Mozilla Firefox\plugin-container.exe

    C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_4_402_287.exe

    C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_4_402_287.exe

    C:\Windows\system32\SearchFilterHost.exe

    C:\Users\star\Desktop\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =

    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local

    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =

    O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll

    O2 - BHO: Java Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll

    O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll

    O2 - BHO: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll

    O3 - Toolbar: &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll

    O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min

    O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot

    O4 - HKLM\..\Run: [ModemListener] C:\Program Files\Quick net\ModemListener.exe start

    O4 - HKLM\..\Run: [KiesTrayAgent] C:\Program Files\Samsung\Kies\KiesTrayAgent.exe

    O4 - HKLM\..\Run: [APSDaemon] "C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe"

    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\Magic Video Converter\codec\quicktime\QTTask.exe" -atboottime

    O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"

    O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"

    O4 - HKCU\..\Run: [Facebook Update] "C:\Users\star\AppData\Local\Facebook\Update\FacebookUpdate.exe" /c /nocrashserver

    O4 - HKCU\..\Run: [sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun

    O4 - HKCU\..\Run: [RESTART_STICKY_NOTES] C:\Windows\System32\StikyNot.exe

    O4 - HKCU\..\Run: [KiesPDLR] C:\Program Files\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe

    O4 - HKCU\..\Run: [MobileDocuments] C:\Program Files\Common Files\Apple\Internet Services\ubd.exe

    O4 - Startup: OneNote 2007 Screen Clipper and Launcher.lnk = C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE

    O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\Windows\system32\GPhotos.scr/200

    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - (no file)

    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - (no file)

    O9 - Extra button: Blog This - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll

    O9 - Extra 'Tools' menuitem: &Blog This in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll

    O15 - Trusted Zone: *.clonewarsadventures.com

    O15 - Trusted Zone: *.freerealms.com

    O15 - Trusted Zone: *.soe.com

    O15 - Trusted Zone: *.sony.com

    O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~3\Office12\GRA32A~1.DLL

    O23 - Service: Avira AntiVir Scheduler (AntiVirSchedulerService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\sched.exe

    O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\avguard.exe

    O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

    O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe

    O23 - Service: DeviceManager - Unknown owner - C:\Program Files\Common Files\DeviceHelper\DeviceManager.exe

    O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe

    O23 - Service: Google Update Service (gupdatem) (gupdatem) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe

    O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe

    O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe

    O23 - Service: MBAMScheduler - Malwarebytes Corporation - C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe

    O23 - Service: MBAMService - Malwarebytes Corporation - C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe

    O23 - Service: Mozilla Maintenance Service (MozillaMaintenance) - Mozilla Foundation - C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe

    O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe

    --

    End of file - 6428 bytes

    The computer is doing fine however, some folders showed up in Drive D which weren't there before. The folder names are:

    - System Volume Information (when I double click on this, a prompt showed saying "Access Denied")

    - $RECYCLE.BIN

    What should I do next?

  4. Hello,

    Here's the report:

    ComboFix 13-01-05.01 - star 01/07/2013 9:20.2.2 - x86

    Microsoft Windows 7 Ultimate 6.1.7600.0.1252.1.1033.18.3005.2274 [GMT 8:00]

    Running from: c:\users\star\Desktop\ComboFix.exe

    Command switches used :: c:\users\star\Desktop\CFScript.txt

    AV: AntiVir Desktop *Enabled/Outdated* {090F9C29-64CE-6C6F-379C-5901B49A85B7}

    SP: AntiVir Desktop *Enabled/Outdated* {B26E7DCD-42F4-63E1-0D2C-6273CF1DCF0A}

    SP: Windows Defender *Enabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

    * Created a new restore point

    .

    .

    ((((((((((((((((((((((((( Files Created from 2012-12-07 to 2013-01-07 )))))))))))))))))))))))))))))))

    .

    .

    2013-01-07 01:25 . 2013-01-07 01:25 -------- d-----w- c:\users\Default\AppData\Local\temp

    2013-01-06 22:46 . 2013-01-06 22:46 -------- d-----w- C:\_OTL

    2013-01-06 00:24 . 2013-01-07 01:25 -------- d-----w- c:\users\star\AppData\Local\temp

    2013-01-04 03:08 . 2013-01-04 03:08 -------- d-----w- c:\users\star\AppData\Roaming\Malwarebytes

    2013-01-04 03:08 . 2013-01-04 03:08 -------- d-----w- c:\programdata\Malwarebytes

    2013-01-04 03:08 . 2013-01-04 03:08 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware

    2013-01-04 03:08 . 2012-12-14 08:49 21104 ----a-w- c:\windows\system32\drivers\mbam.sys

    2013-01-04 03:08 . 2013-01-04 03:08 -------- d-----w- c:\users\star\AppData\Local\Programs

    .

    .

    .

    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

    .

    2012-10-23 04:39 . 2012-10-23 04:39 696760 ----a-w- c:\windows\system32\FlashPlayerApp.exe

    2012-10-23 04:39 . 2011-05-19 12:31 73656 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl

    2012-10-20 18:03 . 2012-10-20 18:03 93672 ----a-w- c:\windows\system32\WindowsAccessBridge.dll

    2012-10-20 18:03 . 2012-06-28 14:50 821736 ----a-w- c:\windows\system32\npDeployJava1.dll

    2012-10-20 18:03 . 2011-06-16 00:48 746984 ----a-w- c:\windows\system32\deployJava1.dll

    2012-12-06 06:25 . 2012-12-06 06:25 262112 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll

    .

    .

    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

    .

    .

    *Note* empty entries & legit default entries are not shown

    REGEDIT4

    .

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

    "Facebook Update"="c:\users\star\AppData\Local\Facebook\Update\FacebookUpdate.exe" [2012-07-12 138096]

    "Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-07-14 1173504]

    "RESTART_STICKY_NOTES"="c:\windows\System32\StikyNot.exe" [2009-07-14 354304]

    "KiesPDLR"="c:\program files\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe" [2012-06-08 21432]

    "MobileDocuments"="c:\program files\Common Files\Apple\Internet Services\ubd.exe" [2012-02-23 59240]

    .

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

    "avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2010-11-11 281768]

    "TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2010-09-13 198160]

    "ModemListener"="c:\program files\Quick net\ModemListener.exe" [2010-02-22 98304]

    "KiesTrayAgent"="c:\program files\Samsung\Kies\KiesTrayAgent.exe" [2012-06-08 3521464]

    "APSDaemon"="c:\program files\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2012-05-30 59280]

    "QuickTime Task"="c:\program files\Magic Video Converter\codec\quicktime\QTTask.exe" [2012-04-18 421888]

    "iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2012-06-07 421776]

    "SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2012-07-03 252848]

    .

    c:\users\star\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\

    OneNote 2007 Screen Clipper and Launcher.lnk - c:\program files\Microsoft Office\Office12\ONENOTEM.EXE [2006-10-27 98632]

    .

    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

    "ConsentPromptBehaviorAdmin"= 5 (0x5)

    "ConsentPromptBehaviorUser"= 3 (0x3)

    "EnableUIADesktopToggle"= 0 (0x0)

    .

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]

    "aux"=wdmaud.drv

    .

    [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]

    BootExecute REG_MULTI_SZ dfboottime \??\c:\windows\System32\dfboottime.cfg\0autocheck autochk *

    .

    R2 DeviceManager;DeviceManager;c:\program files\Common Files\DeviceHelper\DeviceManager.exe [x]

    R2 MBAMService;MBAMService;c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe [x]

    R3 1394hub;1394 Enabled Hub;c:\windows\System32\svchost.exe [x]

    R3 dg_ssudbus;SAMSUNG Mobile USB Composite Device Driver (DEVGURU Ver.);c:\windows\system32\DRIVERS\ssudbus.sys [x]

    R3 qcusbser;Mobile Connector USB Device for Legacy Serial Communication;c:\windows\system32\DRIVERS\qcusbser.sys [x]

    R3 ssudmdm;SAMSUNG Mobile USB Modem Drivers (DEVGURU Ver.);c:\windows\system32\DRIVERS\ssudmdm.sys [x]

    S2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\Avira\AntiVir Desktop\sched.exe [x]

    S2 MBAMScheduler;MBAMScheduler;c:\program files\Malwarebytes' Anti-Malware\mbamscheduler.exe [x]

    S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [x]

    S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt86win7.sys [x]

    .

    .

    Contents of the 'Scheduled Tasks' folder

    .

    2013-01-06 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-3176759216-2314316463-3149395627-1000Core.job

    - c:\users\star\AppData\Local\Facebook\Update\FacebookUpdate.exe [2011-10-23 09:04]

    .

    2013-01-07 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-3176759216-2314316463-3149395627-1000UA.job

    - c:\users\star\AppData\Local\Facebook\Update\FacebookUpdate.exe [2011-10-23 09:04]

    .

    2013-01-06 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job

    - c:\program files\Google\Update\GoogleUpdate.exe [2011-04-12 03:40]

    .

    2013-01-07 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job

    - c:\program files\Google\Update\GoogleUpdate.exe [2011-04-12 03:40]

    .

    .

    ------- Supplementary Scan -------

    .

    uStart Page =

    mStart Page = hxxp://www.google.com

    uInternet Settings,ProxyOverride = *.local

    IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200

    Trusted Zone: clonewarsadventures.com

    Trusted Zone: freerealms.com

    Trusted Zone: soe.com

    Trusted Zone: sony.com

    TCP: DhcpNameServer = 192.168.1.1

    FF - ProfilePath - c:\users\star\AppData\Roaming\Mozilla\Firefox\Profiles\f0frb1mp.default\

    FF - prefs.js: browser.search.defaulturl -

    .

    .

    --------------------- LOCKED REGISTRY KEYS ---------------------

    .

    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]

    @Denied: (A) (Users)

    @Denied: (A) (Everyone)

    @Allowed: (B 1 2 3 4 5) (S-1-5-20)

    "BlindDial"=dword:00000000

    "MSCurrentCountry"=dword:000000b5

    .

    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]

    @Denied: (A) (Users)

    @Denied: (A) (Everyone)

    @Allowed: (B 1 2 3 4 5) (S-1-5-20)

    "BlindDial"=dword:00000000

    .

    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0003\AllUserSettings]

    @Denied: (A) (Users)

    @Denied: (A) (Everyone)

    @Allowed: (B 1 2 3 4 5) (S-1-5-20)

    "BlindDial"=dword:00000000

    .

    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0004\AllUserSettings]

    @Denied: (A) (Users)

    @Denied: (A) (Everyone)

    @Allowed: (B 1 2 3 4 5) (S-1-5-20)

    "BlindDial"=dword:00000000

    .

    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0006\AllUserSettings]

    @Denied: (A) (Users)

    @Denied: (A) (Everyone)

    @Allowed: (B 1 2 3 4 5) (S-1-5-20)

    "BlindDial"=dword:00000000

    .

    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0007\AllUserSettings]

    @Denied: (A) (Users)

    @Denied: (A) (Everyone)

    @Allowed: (B 1 2 3 4 5) (S-1-5-20)

    "BlindDial"=dword:00000000

    .

    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]

    @Denied: (Full) (Everyone)

    .

    Completion time: 2013-01-07 09:26:41

    ComboFix-quarantined-files.txt 2013-01-07 01:26

    ComboFix2.txt 2013-01-06 00:28

    .

    Pre-Run: 31,557,767,168 bytes free

    Post-Run: 31,370,403,840 bytes free

    .

    - - End Of File - - D977E5ABE7CF7169A1A583B124129D55

    The laptop is doing great now. If it is not so much of a trouble, can you give me a summary of what happened? I'd like to know how I suddenly got the startsear.info. And please advise on what to do with the programs I'd downloaded for this problem. Can I delete them now or not?

    Thank you for helping, kind sir.

    Kade

  5. Alright. Here it is:

    OTL logfile created on: 1/6/2013 7:21:25 PM - Run 1

    OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\star\Desktop

    Ultimate Edition (Version = 6.1.7600) - Type = NTWorkstation

    Internet Explorer (Version = 8.0.7600.16385)

    Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

    2.93 Gb Total Physical Memory | 1.88 Gb Available Physical Memory | 63.90% Memory free

    6.93 Gb Paging File | 5.66 Gb Available in Paging File | 81.66% Paging File free

    Paging file location(s): c:\pagefile.sys 4096 4096 [binary data]

    %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files

    Drive C: | 73.14 Gb Total Space | 27.85 Gb Free Space | 38.07% Space Free | Partition Type: NTFS

    Drive D: | 159.64 Gb Total Space | 35.22 Gb Free Space | 22.06% Space Free | Partition Type: NTFS

    Computer Name: STAR-PC | User Name: star | Logged in as Administrator.

    Boot Mode: Normal | Scan Mode: All users

    Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

    ========== Processes (SafeList) ==========

    PRC - C:\Users\star\Desktop\OTL.exe (OldTimer Tools)

    PRC - C:\Program Files\Google\Update\1.3.21.124\GoogleCrashHandler.exe (Google Inc.)

    PRC - C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe (Malwarebytes Corporation)

    PRC - C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)

    PRC - C:\Windows\System32\Macromed\Flash\FlashPlayerPlugin_11_4_402_287.exe (Adobe Systems, Inc.)

    PRC - C:\Program Files\Samsung\Kies\KiesTrayAgent.exe (Samsung Electronics Co., Ltd.)

    PRC - C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)

    PRC - C:\Program Files\uTorrent\uTorrent.exe (BitTorrent, Inc.)

    PRC - C:\Program Files\Avira\AntiVir Desktop\avguard.exe (Avira GmbH)

    PRC - C:\Program Files\Avira\AntiVir Desktop\sched.exe (Avira GmbH)

    PRC - C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)

    PRC - C:\Program Files\Common Files\Real\Update_OB\realsched.exe (RealNetworks, Inc.)

    PRC - C:\Program Files\Quick net\ModemListener.exe ()

    PRC - C:\Program Files\Avira\AntiVir Desktop\avshadow.exe (Avira GmbH)

    PRC - C:\Program Files\Common Files\DeviceHelper\DeviceManager.exe ()

    PRC - C:\Windows\System32\taskhost.exe (Microsoft Corporation)

    PRC - C:\Windows\explorer.exe (Microsoft Corporation)

    PRC - C:\Windows\System32\conhost.exe (Microsoft Corporation)

    ========== Modules (No Company Name) ==========

    MOD - C:\Program Files\Mozilla Firefox\mozjs.dll ()

    MOD - C:\Windows\System32\Macromed\Flash\NPSWF32_11_4_402_287.dll ()

    MOD - C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll ()

    MOD - C:\Program Files\Common Files\Apple\Apple Application Support\libxml2.dll ()

    MOD - C:\Program Files\Quick net\ModemListener.exe ()

    MOD - C:\Program Files\WinRAR\RarExt.dll ()

    ========== Services (SafeList) ==========

    SRV - (MBAMService) -- C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation)

    SRV - (MBAMScheduler) -- C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe (Malwarebytes Corporation)

    SRV - (MozillaMaintenance) -- C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe (Mozilla Foundation)

    SRV - (AntiVirService) -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe (Avira GmbH)

    SRV - (AntiVirSchedulerService) -- C:\Program Files\Avira\AntiVir Desktop\sched.exe (Avira GmbH)

    SRV - (DeviceManager) -- C:\Program Files\Common Files\DeviceHelper\DeviceManager.exe ()

    SRV - (SensrSvc) -- C:\Windows\System32\sensrsvc.dll (Microsoft Corporation)

    SRV - (PeerDistSvc) -- C:\Windows\System32\PeerDistSvc.dll (Microsoft Corporation)

    SRV - (WinDefend) -- C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)

    ========== Driver Services (SafeList) ==========

    DRV - (catchme) -- C:\Users\star\AppData\Local\Temp\catchme.sys File not found

    DRV - (MBAMProtector) -- C:\Windows\System32\drivers\mbam.sys (Malwarebytes Corporation)

    DRV - (ssudmdm) -- C:\Windows\System32\drivers\ssudmdm.sys (DEVGURU Co., LTD.(www.devguru.co.kr))

    DRV - (dg_ssudbus) -- C:\Windows\System32\drivers\ssudbus.sys (DEVGURU Co., LTD.(www.devguru.co.kr))

    DRV - (avipbb) -- C:\Windows\System32\drivers\avipbb.sys (Avira GmbH)

    DRV - (avgntflt) -- C:\Windows\System32\drivers\avgntflt.sys (Avira GmbH)

    DRV - (qcusbser) -- C:\Windows\System32\drivers\qcusbser.sys (TCT International Mobile Ltd)

    DRV - (vmbus) -- C:\Windows\System32\drivers\vmbus.sys (Microsoft Corporation)

    DRV - (storflt) -- C:\Windows\System32\drivers\vmstorfl.sys (Microsoft Corporation)

    DRV - (storvsc) -- C:\Windows\System32\drivers\storvsc.sys (Microsoft Corporation)

    DRV - (vwifimp) -- C:\Windows\System32\drivers\vwifimp.sys (Microsoft Corporation)

    DRV - (WinUsb) -- C:\Windows\System32\drivers\winusb.sys (Microsoft Corporation)

    DRV - (s3cap) -- C:\Windows\System32\drivers\vms3cap.sys (Microsoft Corporation)

    DRV - (VMBusHID) -- C:\Windows\System32\drivers\VMBusHID.sys (Microsoft Corporation)

    DRV - (smserial) -- C:\Windows\System32\drivers\smserial.sys (Motorola Inc.)

    DRV - (athr) -- C:\Windows\System32\drivers\athr.sys (Atheros Communications, Inc.)

    DRV - (ssmdrv) -- C:\Windows\System32\drivers\ssmdrv.sys (Avira GmbH)

    ========== Standard Registry (SafeList) ==========

    ========== Internet Explorer ==========

    IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com

    IE - HKLM\..\SearchScopes,DefaultScope =

    IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC

    IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

    IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

    IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

    IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

    IE - HKU\S-1-5-19\..\SearchScopes,DefaultScope =

    IE - HKU\S-1-5-20\..\SearchScopes,DefaultScope =

    IE - HKU\S-1-5-21-3176759216-2314316463-3149395627-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://startsear.info

    IE - HKU\S-1-5-21-3176759216-2314316463-3149395627-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = en-us

    IE - HKU\S-1-5-21-3176759216-2314316463-3149395627-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 83 CE CA E0 1D 16 CC 01 [binary data]

    IE - HKU\S-1-5-21-3176759216-2314316463-3149395627-1000\..\SearchScopes,DefaultScope =

    IE - HKU\S-1-5-21-3176759216-2314316463-3149395627-1000\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC

    IE - HKU\S-1-5-21-3176759216-2314316463-3149395627-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

    IE - HKU\S-1-5-21-3176759216-2314316463-3149395627-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

    ========== FireFox ==========

    FF - prefs.js..browser.search.defaultthis.engineName: " "

    FF - prefs.js..browser.search.defaulturl: ""

    FF - prefs.js..browser.startup.homepage: "http://startsear.info"

    FF - prefs.js..extensions.enabledAddons: %7B972ce4c6-7e08-4474-a285-3208198ce6fd%7D:17.0.1

    FF - user.js - File not found

    FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32_11_4_402_287.dll ()

    FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\Windows\system32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)

    FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found

    FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()

    FF - HKLM\Software\MozillaPlugins\@foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/pdf: C:\Program Files\Foxit Software\Foxit Reader\plugins\npFoxitReaderPlugin.dll (Foxit Corporation)

    FF - HKLM\Software\MozillaPlugins\@google.com/npPicasa3,version=3.0.0: C:\Program Files\Google\Picasa3\npPicasa3.dll (Google, Inc.)

    FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.9.2: C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)

    FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.9.2: C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)

    FF - HKLM\Software\MozillaPlugins\@messenger.yahoo.com/YahooMessengerStatePlugin;version=1.0.0.6: C:\Program Files\Yahoo!\Shared\npYState.dll (Yahoo! Inc.)

    FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files\Microsoft Silverlight\4.0.50826.0\npctrl.dll ( Microsoft Corporation)

    FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeLive,version=1.3: C:\Program Files\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)

    FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=14.0.8117.0416: C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)

    FF - HKLM\Software\MozillaPlugins\@real.com/nppl3260;version=6.0.12.449: C:\Program Files\Real\RealPlayer\Netscape6\nppl3260.dll (RealNetworks, Inc.)

    FF - HKLM\Software\MozillaPlugins\@real.com/nprjplug;version=1.0.3.448: C:\Program Files\Real\RealPlayer\Netscape6\nprjplug.dll (RealNetworks, Inc.)

    FF - HKLM\Software\MozillaPlugins\@real.com/nprpjplug;version=6.0.12.448: C:\Program Files\Real\RealPlayer\Netscape6\nprpjplug.dll (RealNetworks, Inc.)

    FF - HKLM\Software\MozillaPlugins\@real.com/nsJSRealPlayerPlugin;version=: File not found

    FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.124\npGoogleUpdate3.dll (Google Inc.)

    FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.124\npGoogleUpdate3.dll (Google Inc.)

    FF - HKCU\Software\MozillaPlugins\@Skype Limited.com/Facebook Video Calling Plugin: C:\Users\star\AppData\Local\Facebook\Video\Skype\npFacebookVideoCalling.dll (Skype Limited)

    FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 17.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012/12/06 14:25:47 | 000,000,000 | ---D | M]

    FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 17.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2012/12/06 14:25:43 | 000,000,000 | ---D | M]

    FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 17.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012/12/06 14:25:47 | 000,000,000 | ---D | M]

    FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 17.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2012/12/06 14:25:43 | 000,000,000 | ---D | M]

    [2011/05/19 20:26:52 | 000,000,000 | ---D | M] (No name found) -- C:\Users\star\AppData\Roaming\mozilla\Extensions

    [2013/01/05 14:30:51 | 000,000,000 | ---D | M] (No name found) -- C:\Users\star\AppData\Roaming\mozilla\Firefox\Profiles\f0frb1mp.default\extensions

    [2012/12/06 14:25:42 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions

    [2012/12/06 14:25:47 | 000,262,112 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll

    [2012/09/01 12:13:43 | 000,002,465 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml

    [2012/10/12 19:40:44 | 000,002,058 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\twitter.xml

    ========== Chrome ==========

    CHR - homepage:

    CHR - default_search_provider: Google (Enabled)

    CHR - default_search_provider: search_url = {google:baseURL}search?q={searchTerms}&{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}{google:assistedQueryStats}{google:searchFieldtrialParameter}sourceid=chrome&ie={inputEncoding}

    CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client=chrome&hl={language}&q={searchTerms}&sugkey={google:suggestAPIKeyParameter}

    CHR - homepage:

    CHR - plugin: Shockwave Flash (Enabled) = C:\Program Files\Google\Chrome\Application\23.0.1271.97\PepperFlash\pepflashplayer.dll

    CHR - plugin: Shockwave Flash (Enabled) = C:\Program Files\Google\Chrome\Application\23.0.1271.97\gcswf32.dll

    CHR - plugin: Remoting Viewer (Enabled) = internal-remoting-viewer

    CHR - plugin: Native Client (Enabled) = C:\Program Files\Google\Chrome\Application\23.0.1271.97\ppGoogleNaClPluginChrome.dll

    CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Program Files\Google\Chrome\Application\23.0.1271.97\pdf.dll

    CHR - plugin: Microsoft\u00AE DRM (Enabled) = C:\Program Files\Windows Media Player\npdrmv2.dll

    CHR - plugin: Microsoft\u00AE DRM (Enabled) = C:\Program Files\Windows Media Player\npwmsdrm.dll

    CHR - plugin: Windows Media Player Plug-in Dynamic Link Library (Enabled) = C:\Program Files\Windows Media Player\npdsplay.dll

    CHR - plugin: Google Update (Enabled) = C:\Program Files\Google\Update\1.3.21.99\npGoogleUpdate3.dll

    O1 HOSTS File: ([2013/01/06 08:25:59 | 000,000,027 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts

    O1 - Hosts: 127.0.0.1 localhost

    O2 - BHO: (RealPlayer Download and Record Plugin for Internet Explorer) - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll (RealPlayer)

    O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.

    O2 - BHO: (Java Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)

    O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.7.8313.1002\swg.dll (Google Inc.)

    O2 - BHO: (Java Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)

    O4 - HKLM..\Run: [APSDaemon] C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)

    O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)

    O4 - HKLM..\Run: [KiesTrayAgent] C:\Program Files\Samsung\Kies\KiesTrayAgent.exe (Samsung Electronics Co., Ltd.)

    O4 - HKLM..\Run: [ModemListener] C:\Program Files\Quick net\ModemListener.exe ()

    O4 - HKLM..\Run: [TkBellExe] C:\Program Files\Common Files\Real\Update_OB\realsched.exe (RealNetworks, Inc.)

    O4 - HKU\S-1-5-21-3176759216-2314316463-3149395627-1000..\Run: [Facebook Update] C:\Users\star\AppData\Local\Facebook\Update\FacebookUpdate.exe (Facebook Inc.)

    O4 - HKU\S-1-5-21-3176759216-2314316463-3149395627-1000..\Run: [KiesPDLR] C:\Program Files\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe ()

    O4 - HKU\S-1-5-21-3176759216-2314316463-3149395627-1000..\Run: [MobileDocuments] C:\Program Files\Common Files\Apple\Internet Services\ubd.exe (Apple Inc.)

    O4 - HKU\S-1-5-21-3176759216-2314316463-3149395627-1000..\Run: [RESTART_STICKY_NOTES] C:\Windows\System32\StikyNot.exe (Microsoft Corporation)

    O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present

    O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0

    O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5

    O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3

    O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel present

    O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Control Panel present

    O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Control Panel present

    O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Control Panel present

    O7 - HKU\S-1-5-21-3176759216-2314316463-3149395627-1000\Software\Policies\Microsoft\Internet Explorer\Control Panel present

    O7 - HKU\S-1-5-21-3176759216-2314316463-3149395627-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0

    O8 - Extra context menu item: Add to Google Photos Screensa&ver - C:\Windows\System32\GPhotos.scr (Google Inc.)

    O10 - NameSpace_Catalog5\Catalog_Entries\000000000008 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)

    O15 - HKU\S-1-5-21-3176759216-2314316463-3149395627-1000\..Trusted Domains: clonewarsadventures.com ([]* in Trusted sites)

    O15 - HKU\S-1-5-21-3176759216-2314316463-3149395627-1000\..Trusted Domains: freerealms.com ([]* in Trusted sites)

    O15 - HKU\S-1-5-21-3176759216-2314316463-3149395627-1000\..Trusted Domains: soe.com ([]* in Trusted sites)

    O15 - HKU\S-1-5-21-3176759216-2314316463-3149395627-1000\..Trusted Domains: sony.com ([]* in Trusted sites)

    O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Reg Error: Value error.)

    O16 - DPF: {CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 1.6.0_29)

    O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 10.9.2)

    O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1

    O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{2BD03252-1F19-4FE2-A68F-1B001A3C1FC1}: DhcpNameServer = 192.168.1.1

    O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)

    O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)

    O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation)

    O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.

    O32 - HKLM CDRom: AutoRun - 1

    O32 - AutoRun File - [2009/06/11 05:42:20 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]

    O34 - HKLM BootExecute: (dfboottime \??\C:\Windows\System32\dfboottime.cfg)

    O34 - HKLM BootExecute: (autocheck autochk *)

    O35 - HKLM\..comfile [open] -- "%1" %*

    O35 - HKLM\..exefile [open] -- "%1" %*

    O37 - HKLM\...com [@ = ComFile] -- "%1" %*

    O37 - HKLM\...exe [@ = exefile] -- "%1" %*

    O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)

    O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)

    O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)

    ========== Files/Folders - Created Within 30 Days ==========

    [2013/01/06 19:18:29 | 000,602,112 | ---- | C] (OldTimer Tools) -- C:\Users\star\Desktop\OTL.exe

    [2013/01/06 08:26:05 | 000,000,000 | ---D | C] -- C:\$RECYCLE.BIN

    [2013/01/06 08:24:30 | 000,000,000 | ---D | C] -- C:\Windows\temp

    [2013/01/06 08:24:30 | 000,000,000 | ---D | C] -- C:\Users\star\AppData\Local\temp

    [2013/01/06 08:17:18 | 000,518,144 | ---- | C] (SteelWerX) -- C:\Windows\SWREG.exe

    [2013/01/06 08:17:18 | 000,406,528 | ---- | C] (SteelWerX) -- C:\Windows\SWSC.exe

    [2013/01/06 08:17:18 | 000,060,416 | ---- | C] (NirSoft) -- C:\Windows\NIRCMD.exe

    [2013/01/06 08:17:11 | 000,000,000 | ---D | C] -- C:\Qoobox

    [2013/01/06 08:16:48 | 000,000,000 | ---D | C] -- C:\Windows\erdnt

    [2013/01/06 08:14:16 | 005,019,547 | R--- | C] (Swearware) -- C:\Users\star\Desktop\ComboFix.exe

    [2013/01/05 14:47:24 | 000,000,000 | ---D | C] -- C:\Users\star\Desktop\RK_Quarantine

    [2013/01/05 07:49:44 | 000,688,992 | R--- | C] (Swearware) -- C:\Users\star\Desktop\dds.scr

    [2013/01/04 11:31:57 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome

    [2013/01/04 11:08:41 | 000,000,000 | ---D | C] -- C:\Users\star\AppData\Roaming\Malwarebytes

    [2013/01/04 11:08:34 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware

    [2013/01/04 11:08:33 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes

    [2013/01/04 11:08:31 | 000,021,104 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys

    [2013/01/04 11:08:31 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware

    [2013/01/04 11:08:05 | 000,000,000 | ---D | C] -- C:\Users\star\AppData\Local\Programs

    [2013/01/04 11:02:55 | 010,156,344 | ---- | C] (Malwarebytes Corporation ) -- C:\Users\star\Desktop\mbam-setup-1.70.0.1100.exe

    [2013/01/04 09:23:45 | 004,732,416 | ---- | C] (AVAST Software) -- C:\Users\star\Desktop\aswMBR.exe

    ========== Files - Modified Within 30 Days ==========

    [2013/01/06 19:19:13 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\star\Desktop\OTL.exe

    [2013/01/06 18:30:00 | 000,001,056 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job

    [2013/01/06 17:10:02 | 000,000,924 | ---- | M] () -- C:\Windows\tasks\FacebookUpdateTaskUserS-1-5-21-3176759216-2314316463-3149395627-1000UA.job

    [2013/01/06 17:10:00 | 000,000,902 | ---- | M] () -- C:\Windows\tasks\FacebookUpdateTaskUserS-1-5-21-3176759216-2314316463-3149395627-1000Core.job

    [2013/01/06 11:30:00 | 000,001,052 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job

    [2013/01/06 08:38:56 | 000,615,360 | ---- | M] () -- C:\Windows\System32\perfh009.dat

    [2013/01/06 08:38:56 | 000,103,702 | ---- | M] () -- C:\Windows\System32\perfc009.dat

    [2013/01/06 08:36:57 | 000,014,192 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

    [2013/01/06 08:36:57 | 000,014,192 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

    [2013/01/06 08:31:49 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat

    [2013/01/06 08:25:59 | 000,000,027 | ---- | M] () -- C:\Windows\System32\drivers\etc\hosts

    [2013/01/06 08:15:19 | 005,019,547 | R--- | M] (Swearware) -- C:\Users\star\Desktop\ComboFix.exe

    [2013/01/05 22:54:04 | 000,002,239 | ---- | M] () -- C:\Users\star\Desktop\Google Chrome.lnk

    [2013/01/05 20:18:18 | 000,034,816 | ---- | M] () -- C:\Users\star\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

    [2013/01/05 14:43:11 | 000,761,856 | ---- | M] () -- C:\Users\star\Desktop\RogueKiller.exe

    [2013/01/05 14:30:05 | 000,551,997 | ---- | M] () -- C:\Users\star\Desktop\adwcleaner.exe

    [2013/01/05 14:22:11 | 000,856,731 | ---- | M] () -- C:\Users\star\Desktop\SecurityCheck.exe

    [2013/01/05 07:49:52 | 000,688,992 | R--- | M] (Swearware) -- C:\Users\star\Desktop\dds.scr

    [2013/01/04 11:08:34 | 000,001,071 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

    [2013/01/04 11:07:43 | 010,156,344 | ---- | M] (Malwarebytes Corporation ) -- C:\Users\star\Desktop\mbam-setup-1.70.0.1100.exe

    [2013/01/04 11:00:23 | 000,000,512 | ---- | M] () -- C:\Users\star\Desktop\MBR.dat

    [2013/01/04 09:24:48 | 004,732,416 | ---- | M] (AVAST Software) -- C:\Users\star\Desktop\aswMBR.exe

    [2012/12/14 16:49:28 | 000,021,104 | ---- | M] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys

    ========== Files Created - No Company Name ==========

    [2013/01/06 08:17:18 | 000,256,000 | ---- | C] () -- C:\Windows\PEV.exe

    [2013/01/06 08:17:18 | 000,208,896 | ---- | C] () -- C:\Windows\MBR.exe

    [2013/01/06 08:17:18 | 000,098,816 | ---- | C] () -- C:\Windows\sed.exe

    [2013/01/06 08:17:18 | 000,080,412 | ---- | C] () -- C:\Windows\grep.exe

    [2013/01/06 08:17:18 | 000,068,096 | ---- | C] () -- C:\Windows\zip.exe

    [2013/01/05 22:54:04 | 000,002,239 | ---- | C] () -- C:\Users\star\Desktop\Google Chrome.lnk

    [2013/01/05 14:42:44 | 000,761,856 | ---- | C] () -- C:\Users\star\Desktop\RogueKiller.exe

    [2013/01/05 14:29:58 | 000,551,997 | ---- | C] () -- C:\Users\star\Desktop\adwcleaner.exe

    [2013/01/05 14:20:13 | 000,856,731 | ---- | C] () -- C:\Users\star\Desktop\SecurityCheck.exe

    [2013/01/04 11:08:34 | 000,001,071 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

    [2013/01/04 11:00:23 | 000,000,512 | ---- | C] () -- C:\Users\star\Desktop\MBR.dat

    [2012/04/10 20:18:36 | 004,035,108 | ---- | C] () -- C:\Users\star\We are Young.mp3

    [2012/04/10 20:16:23 | 003,360,944 | ---- | C] () -- C:\Users\star\Jet Lag.mp3

    [2012/04/10 20:15:26 | 002,905,792 | ---- | C] () -- C:\Users\star\One Direction - One Thing (Acoustic).mp3

    [2012/04/10 20:13:02 | 006,474,037 | ---- | C] () -- C:\Users\star\What Makes You Beautiful.mp3

    [2012/04/10 20:06:59 | 003,453,755 | ---- | C] () -- C:\Users\star\One Direction - One Thing.mp3

    [2012/04/03 15:10:19 | 000,000,043 | ---- | C] () -- C:\Users\star\jagex_cl_runescape_LIVE.dat

    [2012/04/03 15:10:19 | 000,000,024 | ---- | C] () -- C:\Users\star\random.dat

    [2011/11/20 19:35:26 | 000,006,144 | -H-- | C] () -- C:\Users\star\photothumb.db

    [2011/09/23 23:22:00 | 000,248,486 | ---- | C] () -- C:\Users\star\Image(100).jpg

    [2011/09/16 11:54:48 | 000,030,568 | ---- | C] () -- C:\Windows\MusiccityDownload.exe

    [2011/09/16 11:54:44 | 000,974,848 | ---- | C] () -- C:\Windows\System32\cis-2.4.dll

    [2011/09/16 11:54:44 | 000,081,920 | ---- | C] () -- C:\Windows\System32\issacapi_bs-2.3.dll

    [2011/09/16 11:54:44 | 000,065,536 | ---- | C] () -- C:\Windows\System32\issacapi_pe-2.3.dll

    [2011/09/16 11:54:44 | 000,057,344 | ---- | C] () -- C:\Windows\System32\issacapi_se-2.3.dll

    [2011/07/11 16:12:49 | 000,000,069 | ---- | C] () -- C:\Windows\NeroDigital.ini

    [2011/06/09 13:48:24 | 000,070,656 | ---- | C] () -- C:\Windows\System32\dfboottime.exe

    [2011/03/12 09:49:19 | 000,034,816 | ---- | C] () -- C:\Users\star\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

    [2010/07/03 22:49:45 | 000,001,024 | ---- | C] () -- C:\Users\star\.rnd

    ========== ZeroAccess Check ==========

    [2009/07/14 12:42:31 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini

    [HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

    [HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]

    [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

    "" = %SystemRoot%\system32\shell32.dll -- [2009/07/14 09:16:14 | 012,866,560 | ---- | M] (Microsoft Corporation)

    "ThreadingModel" = Apartment

    [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]

    "" = %systemroot%\system32\wbem\fastprox.dll -- [2009/07/14 09:15:20 | 000,605,696 | ---- | M] (Microsoft Corporation)

    "ThreadingModel" = Free

    [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]

    "" = %systemroot%\system32\wbem\wbemess.dll -- [2009/07/14 09:16:17 | 000,342,528 | ---- | M] (Microsoft Corporation)

    "ThreadingModel" = Both

    < End of report >

  6. Hello,

    ComboFix 13-01-05.01 - star 01/06/2013 8:19.1.2 - x86

    Microsoft Windows 7 Ultimate 6.1.7600.0.1252.1.1033.18.3005.1923 [GMT 8:00]

    Running from: c:\users\star\Desktop\ComboFix.exe

    AV: AntiVir Desktop *Disabled/Outdated* {090F9C29-64CE-6C6F-379C-5901B49A85B7}

    SP: AntiVir Desktop *Disabled/Outdated* {B26E7DCD-42F4-63E1-0D2C-6273CF1DCF0A}

    SP: Windows Defender *Enabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

    .

    .

    ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

    .

    .

    c:\users\star\AppData\Local\Temp\26b4a1dd-e07b-48af-be4e-9642b273284b\CliSecureRT.dll

    c:\users\star\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\star.exe

    c:\users\star\AppData\Roaming\STAR-PC.exe

    c:\windows\system32\muzapp.exe

    c:\windows\system32\System32\MASetupCleaner.exe

    c:\windows\system32\System32\muzapp.exe

    .

    .

    ((((((((((((((((((((((((( Files Created from 2012-12-06 to 2013-01-06 )))))))))))))))))))))))))))))))

    .

    .

    2013-01-04 03:08 . 2013-01-04 03:08 -------- d-----w- c:\users\star\AppData\Roaming\Malwarebytes

    2013-01-04 03:08 . 2013-01-04 03:08 -------- d-----w- c:\programdata\Malwarebytes

    2013-01-04 03:08 . 2013-01-04 03:08 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware

    2013-01-04 03:08 . 2012-12-14 08:49 21104 ----a-w- c:\windows\system32\drivers\mbam.sys

    2013-01-04 03:08 . 2013-01-04 03:08 -------- d-----w- c:\users\star\AppData\Local\Programs

    .

    .

    .

    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

    .

    2012-10-23 04:39 . 2012-10-23 04:39 696760 ----a-w- c:\windows\system32\FlashPlayerApp.exe

    2012-10-23 04:39 . 2011-05-19 12:31 73656 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl

    2012-10-20 18:03 . 2012-10-20 18:03 93672 ----a-w- c:\windows\system32\WindowsAccessBridge.dll

    2012-10-20 18:03 . 2012-06-28 14:50 821736 ----a-w- c:\windows\system32\npDeployJava1.dll

    2012-10-20 18:03 . 2011-06-16 00:48 746984 ----a-w- c:\windows\system32\deployJava1.dll

    2012-12-06 06:25 . 2012-12-06 06:25 262112 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll

    .

    .

    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

    .

    .

    *Note* empty entries & legit default entries are not shown

    REGEDIT4

    .

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

    "Facebook Update"="c:\users\star\AppData\Local\Facebook\Update\FacebookUpdate.exe" [2012-07-12 138096]

    "Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-07-14 1173504]

    "RESTART_STICKY_NOTES"="c:\windows\System32\StikyNot.exe" [2009-07-14 354304]

    "KiesPDLR"="c:\program files\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe" [2012-06-08 21432]

    "MobileDocuments"="c:\program files\Common Files\Apple\Internet Services\ubd.exe" [2012-02-23 59240]

    .

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

    "avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2010-11-11 281768]

    "TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2010-09-13 198160]

    "ModemListener"="c:\program files\Quick net\ModemListener.exe" [2010-02-22 98304]

    "KiesTrayAgent"="c:\program files\Samsung\Kies\KiesTrayAgent.exe" [2012-06-08 3521464]

    "APSDaemon"="c:\program files\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2012-05-30 59280]

    "QuickTime Task"="c:\program files\Magic Video Converter\codec\quicktime\QTTask.exe" [2012-04-18 421888]

    "iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2012-06-07 421776]

    "SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2012-07-03 252848]

    .

    c:\users\star\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\

    OneNote 2007 Screen Clipper and Launcher.lnk - c:\program files\Microsoft Office\Office12\ONENOTEM.EXE [2006-10-27 98632]

    .

    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

    "ConsentPromptBehaviorAdmin"= 5 (0x5)

    "ConsentPromptBehaviorUser"= 3 (0x3)

    "EnableUIADesktopToggle"= 0 (0x0)

    .

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]

    "aux"=wdmaud.drv

    .

    [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]

    BootExecute REG_MULTI_SZ dfboottime \??\c:\windows\System32\dfboottime.cfg\0autocheck autochk *

    .

    R2 MBAMService;MBAMService;c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe [x]

    R3 1394hub;1394 Enabled Hub;c:\windows\System32\svchost.exe [x]

    R3 dg_ssudbus;SAMSUNG Mobile USB Composite Device Driver (DEVGURU Ver.);c:\windows\system32\DRIVERS\ssudbus.sys [x]

    R3 qcusbser;Mobile Connector USB Device for Legacy Serial Communication;c:\windows\system32\DRIVERS\qcusbser.sys [x]

    R3 ssudmdm;SAMSUNG Mobile USB Modem Drivers (DEVGURU Ver.);c:\windows\system32\DRIVERS\ssudmdm.sys [x]

    S2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\Avira\AntiVir Desktop\sched.exe [x]

    S2 DeviceManager;DeviceManager;c:\program files\Common Files\DeviceHelper\DeviceManager.exe [x]

    S2 MBAMScheduler;MBAMScheduler;c:\program files\Malwarebytes' Anti-Malware\mbamscheduler.exe [x]

    S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [x]

    S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt86win7.sys [x]

    .

    .

    --- Other Services/Drivers In Memory ---

    .

    *NewlyCreated* - WS2IFSL

    .

    Contents of the 'Scheduled Tasks' folder

    .

    2013-01-05 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-3176759216-2314316463-3149395627-1000Core.job

    - c:\users\star\AppData\Local\Facebook\Update\FacebookUpdate.exe [2011-10-23 09:04]

    .

    2013-01-06 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-3176759216-2314316463-3149395627-1000UA.job

    - c:\users\star\AppData\Local\Facebook\Update\FacebookUpdate.exe [2011-10-23 09:04]

    .

    2013-01-06 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job

    - c:\program files\Google\Update\GoogleUpdate.exe [2011-04-12 03:40]

    .

    2013-01-05 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job

    - c:\program files\Google\Update\GoogleUpdate.exe [2011-04-12 03:40]

    .

    .

    ------- Supplementary Scan -------

    .

    uStart Page = hxxp://startsear.info

    mStart Page = hxxp://www.google.com

    uInternet Settings,ProxyOverride = *.local

    IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200

    Trusted Zone: clonewarsadventures.com

    Trusted Zone: freerealms.com

    Trusted Zone: soe.com

    Trusted Zone: sony.com

    TCP: DhcpNameServer = 192.168.1.1

    FF - ProfilePath - c:\users\star\AppData\Roaming\Mozilla\Firefox\Profiles\f0frb1mp.default\

    FF - prefs.js: browser.search.defaulturl -

    FF - prefs.js: browser.startup.homepage - hxxp://startsear.info

    .

    - - - - ORPHANS REMOVED - - - -

    .

    HKCU-Run-StartUp This - c:\program files\Laplink\PCmover\LaunchSt.exe

    HKCU-Run-STAR-PC - c:\users\star\AppData\Roaming\STAR-PC.exe

    HKLM-Run-KiesHelper - c:\program files\Samsung\Kies\KiesHelper.exe

    AddRemove-01_Simmental - c:\program files\Samsung\USB Drivers\01_Simmental\Uninstall.exe

    AddRemove-02_Siberian - c:\program files\Samsung\USB Drivers\02_Siberian\Uninstall.exe

    AddRemove-03_Swallowtail - c:\program files\Samsung\USB Drivers\03_Swallowtail\Uninstall.exe

    AddRemove-04_semseyite - c:\program files\Samsung\USB Drivers\04_semseyite\Uninstall.exe

    AddRemove-05_Sloan - c:\program files\Samsung\USB Drivers\05_Sloan\Uninstall.exe

    AddRemove-06_Spencer - c:\program files\Samsung\USB Drivers\06_Spencer\Uninstall.exe

    AddRemove-07_Schorl - c:\program files\Samsung\USB Drivers\07_Schorl\Uninstall.exe

    AddRemove-08_EMPChipset - c:\program files\Samsung\USB Drivers\08_EMPChipset\Uninstall.exe

    AddRemove-09_Hsp - c:\program files\Samsung\USB Drivers\09_Hsp\Uninstall.exe

    AddRemove-11_HSP_Plus_Default - c:\program files\Samsung\USB Drivers\11_HSP_Plus_Default\Uninstall.exe

    AddRemove-16_Shrewsbury - c:\program files\Samsung\USB Drivers\16_Shrewsbury\Uninstall.exe

    AddRemove-17_EMP_Chipset2 - c:\program files\Samsung\USB Drivers\17_EMP_Chipset2\Uninstall.exe

    AddRemove-18_Zinia_Serial_Driver - c:\program files\Samsung\USB Drivers\18_Zinia_Serial_Driver\Uninstall.exe

    AddRemove-19_VIA_driver - c:\program files\Samsung\USB Drivers\19_VIA_driver\Uninstall.exe

    AddRemove-20_NXP_Driver - c:\program files\Samsung\USB Drivers\20_NXP_Driver\Uninstall.exe

    AddRemove-21_Searsburg - c:\program files\Samsung\USB Drivers\21_Searsburg\Uninstall.exe

    AddRemove-22_WiBro_WiMAX - c:\program files\Samsung\USB Drivers\22_WiBro_WiMAX\Uninstall.exe

    AddRemove-24_flashusbdriver - c:\program files\Samsung\USB Drivers\24_flashusbdriver\Uninstall.exe

    AddRemove-25_escape - c:\program files\Samsung\USB Drivers\25_escape\Uninstall.exe

    .

    .

    .

    --------------------- LOCKED REGISTRY KEYS ---------------------

    .

    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]

    @Denied: (A) (Users)

    @Denied: (A) (Everyone)

    @Allowed: (B 1 2 3 4 5) (S-1-5-20)

    "BlindDial"=dword:00000000

    "MSCurrentCountry"=dword:000000b5

    .

    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]

    @Denied: (A) (Users)

    @Denied: (A) (Everyone)

    @Allowed: (B 1 2 3 4 5) (S-1-5-20)

    "BlindDial"=dword:00000000

    .

    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0003\AllUserSettings]

    @Denied: (A) (Users)

    @Denied: (A) (Everyone)

    @Allowed: (B 1 2 3 4 5) (S-1-5-20)

    "BlindDial"=dword:00000000

    .

    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0004\AllUserSettings]

    @Denied: (A) (Users)

    @Denied: (A) (Everyone)

    @Allowed: (B 1 2 3 4 5) (S-1-5-20)

    "BlindDial"=dword:00000000

    .

    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0006\AllUserSettings]

    @Denied: (A) (Users)

    @Denied: (A) (Everyone)

    @Allowed: (B 1 2 3 4 5) (S-1-5-20)

    "BlindDial"=dword:00000000

    .

    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0007\AllUserSettings]

    @Denied: (A) (Users)

    @Denied: (A) (Everyone)

    @Allowed: (B 1 2 3 4 5) (S-1-5-20)

    "BlindDial"=dword:00000000

    .

    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]

    @Denied: (Full) (Everyone)

    .

    ------------------------ Other Running Processes ------------------------

    .

    c:\program files\Avira\AntiVir Desktop\avguard.exe

    c:\program files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

    c:\program files\Bonjour\mDNSResponder.exe

    c:\program files\Avira\AntiVir Desktop\avshadow.exe

    c:\windows\system32\conhost.exe

    c:\program files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe

    c:\windows\system32\sppsvc.exe

    c:\windows\system32\taskhost.exe

    c:\program files\Google\Update\1.3.21.124\GoogleCrashHandler.exe

    c:\windows\system32\conhost.exe

    .

    **************************************************************************

    .

    Completion time: 2013-01-06 08:28:51 - machine was rebooted

    ComboFix-quarantined-files.txt 2013-01-06 00:28

    .

    Pre-Run: 31,845,851,136 bytes free

    Post-Run: 31,998,869,504 bytes free

    .

    - - End Of File - - E2711DC0D65BFDE32E603B358932B95A

    The startsear.info is still here. I believe I followed all of your instructions properly, and the combo.exe ran fine. Another problem I noticed when I copied your instructions on Word is the top margin of the blank page is missing. I don't know if this is connected with startsear.info or not, I just thought I'd let you know.

    Kade

  7. Hello Gringo,

    Here are the texts:

    Results of screen317's Security Check version 0.99.56

    Windows 7 x86

    Out of date service pack!!

    Internet Explorer 8 Out of date!

    ``````````````Antivirus/Firewall Check:``````````````

    Windows Firewall Enabled!

    AntiVir Desktop

    Antivirus out of date!

    `````````Anti-malware/Other Utilities Check:`````````

    Malwarebytes Anti-Malware version 1.70.0.1100

    CCleaner

    JavaFX 2.1.1

    Java 6 Update 29

    Java 7 Update 9

    Adobe Flash Player 10 Flash Player out of Date!

    Adobe Flash Player 11.4.402.287

    Mozilla Firefox (17.0.1)

    Google Chrome 23.0.1271.97

    ````````Process Check: objlist.exe by Laurent````````

    Malwarebytes Anti-Malware mbamservice.exe

    Malwarebytes Anti-Malware mbamgui.exe

    Avira Antivir avgnt.exe

    Avira Antivir avguard.exe

    Malwarebytes' Anti-Malware mbamscheduler.exe

    `````````````````System Health check`````````````````

    Total Fragmentation on Drive C: 0%

    ````````````````````End of Log``````````````````````

    # AdwCleaner v2.104 - Logfile created 01/05/2013 at 14:30:46

    # Updated 29/12/2012 by Xplode

    # Operating system : Windows 7 Ultimate (32 bits)

    # User : star - STAR-PC

    # Boot Mode : Normal

    # Running from : C:\Users\star\Desktop\adwcleaner.exe

    # Option [Delete]

    ***** [services] *****

    ***** [Files / Folders] *****

    File Deleted : C:\Program Files\Mozilla Firefox\searchplugins\babylon.xml

    File Deleted : C:\Users\star\AppData\Roaming\Mozilla\Firefox\Profiles\f0frb1mp.default\extensions\{EEE6C361-6118-11DC-9C72-001320C79847}.xpi

    File Deleted : C:\Users\star\AppData\Roaming\Mozilla\Firefox\Profiles\f0frb1mp.default\searchplugins\Conduit.xml

    File Deleted : C:\Users\star\AppData\Roaming\Mozilla\Firefox\Profiles\f0frb1mp.default\searchplugins\SweetIm.xml

    File Deleted : C:\Users\star\Desktop\sweetpcfix.url

    Folder Deleted : C:\Program Files\Ask.com

    Folder Deleted : C:\Program Files\BabylonToolbar

    Folder Deleted : C:\Program Files\Conduit

    Folder Deleted : C:\Program Files\ConduitEngine

    Folder Deleted : C:\Program Files\SweetIM

    Folder Deleted : C:\Program Files\uTorrentBar

    Folder Deleted : C:\ProgramData\Babylon

    Folder Deleted : C:\ProgramData\BabylonUpdater

    Folder Deleted : C:\ProgramData\InstallMate

    Folder Deleted : C:\ProgramData\Premium

    Folder Deleted : C:\ProgramData\SweetIM

    Folder Deleted : C:\Users\star\AppData\Local\Babylon

    Folder Deleted : C:\Users\star\AppData\Local\Google\Chrome\User Data\Default\Extensions\jcdgjdiieiljkfkdcloehkohchhpekkn

    Folder Deleted : C:\Users\star\AppData\LocalLow\AskToolbar

    Folder Deleted : C:\Users\star\AppData\LocalLow\BabylonToolbar

    Folder Deleted : C:\Users\star\AppData\LocalLow\Conduit

    Folder Deleted : C:\Users\star\AppData\LocalLow\ConduitEngine

    Folder Deleted : C:\Users\star\AppData\LocalLow\uTorrentBar

    Folder Deleted : C:\Users\star\AppData\Roaming\Babylon

    Folder Deleted : C:\Users\star\AppData\Roaming\Mozilla\Firefox\Profiles\f0frb1mp.default\Conduit

    Folder Deleted : C:\Users\star\AppData\Roaming\Mozilla\Firefox\Profiles\f0frb1mp.default\ConduitEngine

    Folder Deleted : C:\Users\star\AppData\Roaming\Mozilla\Firefox\Profiles\f0frb1mp.default\CT2786678

    Folder Deleted : C:\Users\star\AppData\Roaming\Mozilla\Firefox\Profiles\f0frb1mp.default\extensions\{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}

    Folder Deleted : C:\Users\star\AppData\Roaming\Mozilla\Firefox\Profiles\f0frb1mp.default\extensions\engine@conduit.com

    Folder Deleted : C:\Users\star\AppData\Roaming\Mozilla\Firefox\Profiles\f0frb1mp.default\extensions\ffxtlbr@babylon.com

    Folder Deleted : C:\Windows\Installer\{0965F857-DAAD-4F93-8054-0E2EC3C8C5B0}

    Folder Deleted : C:\Windows\Installer\{86D4B82A-ABED-442A-BE86-96357B70F4FE}

    Folder Deleted : C:\Windows\Installer\{FB697452-8CA4-46B4-98B1-165C922A2EF3}

    ***** [Registry] *****

    Key Deleted : HKCU\Software\APN

    Key Deleted : HKCU\Software\AppDataLow\AskToolbarInfo

    Key Deleted : HKCU\Software\AppDataLow\Software\AskToolbar

    Key Deleted : HKCU\Software\AppDataLow\Software\Conduit

    Key Deleted : HKCU\Software\AppDataLow\Software\conduitEngine

    Key Deleted : HKCU\Software\AppDataLow\Software\uTorrentBar

    Key Deleted : HKCU\Software\AppDataLow\Toolbar

    Key Deleted : HKCU\Software\Ask.com

    Key Deleted : HKCU\Software\BabylonToolbar

    Key Deleted : HKCU\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A5AA24EA-11B8-4113-95AE-9ED71DEAF12A}

    Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{0ECDF796-C2DC-4D79-A620-CCE0C0A66CC9}

    Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{EEE6C360-6118-11DC-9C72-001320C79847}

    Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{2EECD738-5844-4A99-B4B6-146BF802613B}

    Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{30F9B915-B755-4826-820B-08FBA6BD249D}

    Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{98889811-442D-49DD-99D7-DC866BE87DBC}

    Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{BF7380FA-E3B4-4DB2-AF3E-9D8783A45BFC}

    Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{D4027C7F-154A-4066-A1AD-4243D8127440}

    Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{2EECD738-5844-4A99-B4B6-146BF802613B}

    Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{30F9B915-B755-4826-820B-08FBA6BD249D}

    Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{98889811-442D-49DD-99D7-DC866BE87DBC}

    Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{BF7380FA-E3B4-4DB2-AF3E-9D8783A45BFC}

    Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{D4027C7F-154A-4066-A1AD-4243D8127440}

    Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\{79A765E1-C399-405B-85AF-466F52E918B0}

    Key Deleted : HKCU\Software\SweetIM

    Key Deleted : HKLM\Software\APN

    Key Deleted : HKLM\Software\AskToolbar

    Key Deleted : HKLM\Software\Babylon

    Key Deleted : HKLM\Software\BabylonToolbar

    Key Deleted : HKLM\SOFTWARE\Classes\AppID\{09C554C3-109B-483C-A06B-F14172F1A947}

    Key Deleted : HKLM\SOFTWARE\Classes\AppID\{35C1605E-438B-4D64-AAB1-8885F097A9B1}

    Key Deleted : HKLM\SOFTWARE\Classes\AppID\{4E1E9D45-8BF9-4139-915C-9F83CC3D5921}

    Key Deleted : HKLM\SOFTWARE\Classes\AppID\{9B0CB95C-933A-4B8C-B6D4-EDCD19A43874}

    Key Deleted : HKLM\SOFTWARE\Classes\AppID\{B12E99ED-69BD-437C-86BE-C862B9E5444D}

    Key Deleted : HKLM\SOFTWARE\Classes\AppID\{BDB69379-802F-4EAF-B541-F8DE92DD98DB}

    Key Deleted : HKLM\SOFTWARE\Classes\AppID\{D7EE8177-D51E-4F89-92B6-83EA2EC40800}

    Key Deleted : HKLM\SOFTWARE\Classes\AppID\escort.DLL

    Key Deleted : HKLM\SOFTWARE\Classes\AppID\escortApp.DLL

    Key Deleted : HKLM\SOFTWARE\Classes\AppID\escortEng.DLL

    Key Deleted : HKLM\SOFTWARE\Classes\AppID\escorTlbr.DLL

    Key Deleted : HKLM\SOFTWARE\Classes\AppID\esrv.EXE

    Key Deleted : HKLM\SOFTWARE\Classes\AppID\GenericAskToolbar.DLL

    Key Deleted : HKLM\SOFTWARE\Classes\b

    Key Deleted : HKLM\SOFTWARE\Classes\Babylon.dskBnd

    Key Deleted : HKLM\SOFTWARE\Classes\Babylon.dskBnd.1

    Key Deleted : HKLM\SOFTWARE\Classes\bbylnApp.appCore

    Key Deleted : HKLM\SOFTWARE\Classes\bbylnApp.appCore.1

    Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{00000000-6E41-4FD3-8538-502F5495E5FC}

    Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{291BCCC1-6890-484A-89D3-318C928DAC1B}

    Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{2EECD738-5844-4A99-B4B6-146BF802613B}

    Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{30F9B915-B755-4826-820B-08FBA6BD249D}

    Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{3C471948-F874-49F5-B338-4F214A2EE0B1}

    Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8EEE}

    Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{826D7151-8D99-434B-8540-082B8C2AE556}

    Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{82AC53B4-164C-4B07-A016-437A8388B81A}

    Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{97F2FF5B-260C-4CCF-834A-2DDA4E29E39E}

    Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{98889811-442D-49DD-99D7-DC866BE87DBC}

    Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{A4A0CB15-8465-4F58-A7E5-73084EA2A064}

    Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{B8276A94-891D-453C-9FF3-715C042A2575}

    Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{BF7380FA-E3B4-4DB2-AF3E-9D8783A45BFC}

    Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{D4027C7F-154A-4066-A1AD-4243D8127440}

    Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{E46C8196-B634-44A1-AF6E-957C64278AB1}

    Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{EEE6C35B-6118-11DC-9C72-001320C79847}

    Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{EEE6C35C-6118-11DC-9C72-001320C79847}

    Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{EEE6C35D-6118-11DC-9C72-001320C79847}

    Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{FC40F021-8CF8-4115-B7EA-A349C925FA27}

    Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{FFB9ADCB-8C79-4C29-81D3-74D46A93D370}

    Key Deleted : HKLM\SOFTWARE\Classes\Conduit.Engine

    Key Deleted : HKLM\SOFTWARE\Classes\escort.escortIEPane

    Key Deleted : HKLM\SOFTWARE\Classes\escort.escortIEPane.1

    Key Deleted : HKLM\SOFTWARE\Classes\escort.escrtBtn.1

    Key Deleted : HKLM\SOFTWARE\Classes\esrv.BabylonESrvc

    Key Deleted : HKLM\SOFTWARE\Classes\esrv.BabylonESrvc.1

    Key Deleted : HKLM\SOFTWARE\Classes\GenericAskToolbar.ToolbarWnd

    Key Deleted : HKLM\SOFTWARE\Classes\GenericAskToolbar.ToolbarWnd.1

    Key Deleted : HKLM\SOFTWARE\Classes\Installer\Features\A28B4D68DEBAA244EB686953B7074FEF

    Key Deleted : HKLM\SOFTWARE\Classes\Installer\Products\A28B4D68DEBAA244EB686953B7074FEF

    Key Deleted : HKLM\SOFTWARE\Classes\Installer\UpgradeCodes\F928123A039649549966D4C29D35B1C9

    Key Deleted : HKLM\SOFTWARE\Classes\Interface\{44C3C1DB-2127-433C-98EC-4C9412B5FC3A}

    Key Deleted : HKLM\SOFTWARE\Classes\Interface\{4D5132DD-BB2B-4249-B5E0-D145A8C982E1}

    Key Deleted : HKLM\SOFTWARE\Classes\Interface\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8EEE}

    Key Deleted : HKLM\SOFTWARE\Classes\Interface\{6C434537-053E-486D-B62A-160059D9D456}

    Key Deleted : HKLM\SOFTWARE\Classes\Interface\{706D4A4B-184A-4434-B331-296B07493D2D}

    Key Deleted : HKLM\SOFTWARE\Classes\Interface\{8BE10F21-185F-4CA0-B789-9921674C3993}

    Key Deleted : HKLM\SOFTWARE\Classes\Interface\{91CF619A-4686-4CA4-9232-3B2E6B63AA92}

    Key Deleted : HKLM\SOFTWARE\Classes\Interface\{94C0B25D-3359-4B10-B227-F96A77DB773F}

    Key Deleted : HKLM\SOFTWARE\Classes\Interface\{A439801C-961D-452C-AB42-7848E9CBD289}

    Key Deleted : HKLM\SOFTWARE\Classes\Interface\{AC71B60E-94C9-4EDE-BA46-E146747BB67E}

    Key Deleted : HKLM\SOFTWARE\Classes\Interface\{B0B75FBA-7288-4FD3-A9EB-7EE27FA65599}

    Key Deleted : HKLM\SOFTWARE\Classes\Interface\{B173667F-8395-4317-8DD6-45AD1FE00047}

    Key Deleted : HKLM\SOFTWARE\Classes\Interface\{B32672B3-F656-46E0-B584-FE61C0BB6037}

    Key Deleted : HKLM\SOFTWARE\Classes\Interface\{BFE569F7-646C-4512-969B-9BE3E580D393}

    Key Deleted : HKLM\SOFTWARE\Classes\Interface\{C2434722-5C85-4CA0-BA69-1B67E7AB3D68}

    Key Deleted : HKLM\SOFTWARE\Classes\Interface\{C2996524-2187-441F-A398-CD6CB6B3D020}

    Key Deleted : HKLM\SOFTWARE\Classes\Interface\{E047E227-5342-4D94-80F7-CFB154BF55BD}

    Key Deleted : HKLM\SOFTWARE\Classes\Interface\{E3F79BE9-24D4-4F4D-8C13-DF2C9899F82E}

    Key Deleted : HKLM\SOFTWARE\Classes\Interface\{E77EEF95-3E83-4BB8-9C0D-4A5163774997}

    Key Deleted : HKLM\SOFTWARE\Classes\Interface\{EEE6C358-6118-11DC-9C72-001320C79847}

    Key Deleted : HKLM\SOFTWARE\Classes\Interface\{EEE6C359-6118-11DC-9C72-001320C79847}

    Key Deleted : HKLM\SOFTWARE\Classes\Interface\{EEE6C35A-6118-11DC-9C72-001320C79847}

    Key Deleted : HKLM\SOFTWARE\Classes\Interface\{F4EBB1E2-21F3-4786-8CF4-16EC5925867F}

    Key Deleted : HKLM\SOFTWARE\Classes\MediaPlayer.GraphicsUtils

    Key Deleted : HKLM\SOFTWARE\Classes\MediaPlayer.GraphicsUtils.1

    Key Deleted : HKLM\SOFTWARE\Classes\MgMediaPlayer.GifAnimator

    Key Deleted : HKLM\SOFTWARE\Classes\MgMediaPlayer.GifAnimator.1

    Key Deleted : HKLM\SOFTWARE\Classes\Prod.cap

    Key Deleted : HKLM\SOFTWARE\Classes\sim-packages

    Key Deleted : HKLM\SOFTWARE\Classes\SWEETIE.IEToolbar

    Key Deleted : HKLM\SOFTWARE\Classes\SWEETIE.IEToolbar.1

    Key Deleted : HKLM\SOFTWARE\Classes\sweetim_urlsearchhook.toolbarurlsearchhook

    Key Deleted : HKLM\SOFTWARE\Classes\sweetim_urlsearchhook.toolbarurlsearchhook.1

    Key Deleted : HKLM\SOFTWARE\Classes\Toolbar.CT2786678

    Key Deleted : HKLM\SOFTWARE\Classes\Toolbar3.sweetie

    Key Deleted : HKLM\SOFTWARE\Classes\Toolbar3.sweetie.1

    Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{11549FE4-7C5A-4C17-9FC3-56FC5162A994}

    Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}

    Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{35C1605E-438B-4D64-AAB1-8885F097A9B1}

    Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{4D3B167E-5FD8-4276-8FD7-9DF19C1E4D19}

    Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{4E1E9D45-8BF9-4139-915C-9F83CC3D5921}

    Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{6E8BF012-2C85-4834-B10A-1B31AF173D70}

    Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{D7EE8177-D51E-4F89-92B6-83EA2EC40800}

    Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{EEE6C35E-6118-11DC-9C72-001320C79847}

    Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{EEE6C35F-6118-11DC-9C72-001320C79847}

    Key Deleted : HKLM\Software\Conduit

    Key Deleted : HKLM\Software\conduitEngine

    Key Deleted : HKLM\SOFTWARE\Google\Chrome\Extensions\jcdgjdiieiljkfkdcloehkohchhpekkn

    Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{8375D9C8-634F-4ECB-8CF5-C7416BA5D542}

    Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{932DF8ED-E612-4046-A903-74E272B3E87C}

    Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A5AA24EA-11B8-4113-95AE-9ED71DEAF12A}

    Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{DE7B4C9B-C4D7-423A-ADB7-8EBFF832035B}

    Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{EEE6C367-6118-11DC-9C72-001320C79847}

    Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{EEE6C360-6118-11DC-9C72-001320C79847}

    Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\MyBabylontb_RASAPI32

    Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\MyBabylontb_RASMANCS

    Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\SweetIM.exe

    Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{2EECD738-5844-4A99-B4B6-146BF802613B}

    Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{30F9B915-B755-4826-820B-08FBA6BD249D}

    Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{BF7380FA-E3B4-4DB2-AF3E-9D8783A45BFC}

    Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}

    Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{EEE6C35C-6118-11DC-9C72-001320C79847}

    Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{FC40F021-8CF8-4115-B7EA-A349C925FA27}

    Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\261F213D1F55267499B1F87D0CC3BCF7

    Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\741B4ADF27276464790022C965AB6DA8

    Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\7DE196B10195F5647A2B21B761F3DE01

    Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\9D4F5849367142E4685ED8C25E44C5ED

    Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\A5875B04372C19545BEB90D4D606C472

    Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\A876D9E80B896EC44A8620248CC79296

    Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\B66FFAB725B92594C986DE826A867888

    Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\A28B4D68DEBAA244EB686953B7074FEF

    Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{0965F857-DAAD-4F93-8054-0E2EC3C8C5B0}

    Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{4183178B-4D4E-48A7-9257-454BA90A760E}

    Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{86D4B82A-ABED-442A-BE86-96357B70F4FE}

    Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{FB697452-8CA4-46B4-98B1-165C922A2EF3}

    Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\BabylonToolbar

    Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\conduitEngine

    Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\uTorrentBar Toolbar

    Key Deleted : HKLM\Software\SweetIM

    Key Deleted : HKLM\Software\uTorrentBar

    Value Deleted : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{BF7380FA-E3B4-4DB2-AF3E-9D8783A45BFC}]

    Value Deleted : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{D4027C7F-154A-4066-A1AD-4243D8127440}]

    Value Deleted : HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks [{BF7380FA-E3B4-4DB2-AF3E-9D8783A45BFC}]

    Value Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{30F9B915-B755-4826-820B-08FBA6BD249D}]

    Value Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{98889811-442D-49DD-99D7-DC866BE87DBC}]

    Value Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{BF7380FA-E3B4-4DB2-AF3E-9D8783A45BFC}]

    Value Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{D4027C7F-154A-4066-A1AD-4243D8127440}]

    Value Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{EEE6C35B-6118-11DC-9C72-001320C79847}]

    Value Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks [{BF7380FA-E3B4-4DB2-AF3E-9D8783A45BFC}]

    Value Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run [ApnUpdater]

    Value Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run [sweetIM]

    Value Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run [sweetpacks Communicator]

    Value Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDLLs [C:\Program Files\SweetIM\Toolbars\Internet Explorer\mgHelperApp.exe]

    Value Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDLLs [C:\Program Files\SweetIM\Toolbars\Internet Explorer\mgToolbarProxy.dll]

    ***** [internet Browsers] *****

    -\\ Internet Explorer v8.0.7600.16385

    Replaced : [HKCU\Software\Microsoft\Internet Explorer\Main - Start Page] = hxxp://startsear.info --> hxxp://www.google.com

    Replaced : [HKLM\SOFTWARE\Microsoft\Internet Explorer\Main - Start Page] = hxxp://home.sweetim.com/?barid={ADEB4A87-AEC2-11E1-AF94-000DF07571EC} --> hxxp://www.google.com

    -\\ Mozilla Firefox v17.0.1 (en-US)

    File : C:\Users\star\AppData\Roaming\Mozilla\Firefox\Profiles\f0frb1mp.default\prefs.js

    Deleted : user_pref("CT2786678..clientLogIsEnabled", true);

    Deleted : user_pref("CT2786678..clientLogServiceUrl", "hxxp://clientlog.users.conduit.com/ClientDiagnostics.as[...]

    Deleted : user_pref("CT2786678..uninstallLogServiceUrl", "hxxp://uninstall.users.conduit.com/Uninstall.asmx/Re[...]

    Deleted : user_pref("CT2786678.AboutPrivacyUrl", "hxxp://www.conduit.com/privacy/Default.aspx");

    Deleted : user_pref("CT2786678.CTID", "CT2786678");

    Deleted : user_pref("CT2786678.CurrentServerDate", "2-6-2011");

    Deleted : user_pref("CT2786678.DialogsAlignMode", "LTR");

    Deleted : user_pref("CT2786678.DialogsGetterLastCheckTime", "Thu Jun 02 2011 05:29:27 GMT+0800 (China Standard[...]

    Deleted : user_pref("CT2786678.DownloadReferralCookieData", "");

    Deleted : user_pref("CT2786678.EMailNotifierPollDate", "Thu Jun 02 2011 08:09:28 GMT+0800 (China Standard Time[...]

    Deleted : user_pref("CT2786678.FeedLastCount5690698542593514850", 216);

    Deleted : user_pref("CT2786678.FeedPollDate2429156812186649977", "Thu Jun 02 2011 07:29:21 GMT+0800 (China Sta[...]

    Deleted : user_pref("CT2786678.FeedPollDate2429156813040823546", "Thu Jun 02 2011 07:29:22 GMT+0800 (China Sta[...]

    Deleted : user_pref("CT2786678.FeedPollDate2429156813130095866", "Thu Jun 02 2011 07:29:21 GMT+0800 (China Sta[...]

    Deleted : user_pref("CT2786678.FeedPollDate2429156813224203613", "Thu Jun 02 2011 07:29:21 GMT+0800 (China Sta[...]

    Deleted : user_pref("CT2786678.FeedPollDate2429156813230837251", "Thu Jun 02 2011 07:29:21 GMT+0800 (China Sta[...]

    Deleted : user_pref("CT2786678.FeedPollDate2429156813454291735", "Thu Jun 02 2011 07:29:22 GMT+0800 (China Sta[...]

    Deleted : user_pref("CT2786678.FeedPollDate2429156813729834876", "Thu Jun 02 2011 07:29:21 GMT+0800 (China Sta[...]

    Deleted : user_pref("CT2786678.FeedPollDate2429156813860870021", "Thu Jun 02 2011 07:29:21 GMT+0800 (China Sta[...]

    Deleted : user_pref("CT2786678.FeedPollDate2429156814264681793", "Thu Jun 02 2011 07:29:22 GMT+0800 (China Sta[...]

    Deleted : user_pref("CT2786678.FeedPollDate2429156814863075366", "Thu Jun 02 2011 07:29:21 GMT+0800 (China Sta[...]

    Deleted : user_pref("CT2786678.FeedPollDate2429156815257761081", "Thu Jun 02 2011 07:29:21 GMT+0800 (China Sta[...]

    Deleted : user_pref("CT2786678.FeedTTL2429156813040823546", 15);

    Deleted : user_pref("CT2786678.FeedTTL2429156813130095866", 10);

    Deleted : user_pref("CT2786678.FeedTTL2429156813454291735", 5);

    Deleted : user_pref("CT2786678.FeedTTL2429156814264681793", 5);

    Deleted : user_pref("CT2786678.FirstServerDate", "2-6-2011");

    Deleted : user_pref("CT2786678.FirstTime", true);

    Deleted : user_pref("CT2786678.FirstTimeFF3", true);

    Deleted : user_pref("CT2786678.FixPageNotFoundErrors", true);

    Deleted : user_pref("CT2786678.GroupingServerCheckInterval", 1440);

    Deleted : user_pref("CT2786678.GroupingServiceUrl", "hxxp://grouping.services.conduit.com/");

    Deleted : user_pref("CT2786678.HasUserGlobalKeys", true);

    Deleted : user_pref("CT2786678.Initialize", true);

    Deleted : user_pref("CT2786678.InitializeCommonPrefs", true);

    Deleted : user_pref("CT2786678.InstallationAndCookieDataSentCount", 1);

    Deleted : user_pref("CT2786678.InstallationType", "UnknownIntegration");

    Deleted : user_pref("CT2786678.InstalledDate", "Thu Jun 02 2011 05:29:28 GMT+0800 (China Standard Time)");

    Deleted : user_pref("CT2786678.IsGrouping", false);

    Deleted : user_pref("CT2786678.IsMulticommunity", false);

    Deleted : user_pref("CT2786678.IsOpenThankYouPage", true);

    Deleted : user_pref("CT2786678.IsOpenUninstallPage", true);

    Deleted : user_pref("CT2786678.LanguagePackLastCheckTime", "Thu Jun 02 2011 05:29:27 GMT+0800 (China Standard [...]

    Deleted : user_pref("CT2786678.LanguagePackReloadIntervalMM", 1440);

    Deleted : user_pref("CT2786678.LanguagePackServiceUrl", "hxxp://translation.users.conduit.com/Translation.ashx[...]

    Deleted : user_pref("CT2786678.LastLogin_3.3.3.2", "Thu Jun 02 2011 05:29:20 GMT+0800 (China Standard Time)");

    Deleted : user_pref("CT2786678.LatestVersion", "3.3.3.2");

    Deleted : user_pref("CT2786678.Locale", "en");

    Deleted : user_pref("CT2786678.MCDetectTooltipHeight", "83");

    Deleted : user_pref("CT2786678.MCDetectTooltipUrl", "hxxp://@EB_INSTALL_LINK@/rank/tooltip/?version=1");

    Deleted : user_pref("CT2786678.MCDetectTooltipWidth", "295");

    Deleted : user_pref("CT2786678.SearchFromAddressBarIsInit", true);

    Deleted : user_pref("CT2786678.SearchFromAddressBarUrl", "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT278[...]

    Deleted : user_pref("CT2786678.SearchInNewTabEnabled", true);

    Deleted : user_pref("CT2786678.SearchInNewTabIntervalMM", 1440);

    Deleted : user_pref("CT2786678.SearchInNewTabLastCheckTime", "Thu Jun 02 2011 05:29:21 GMT+0800 (China Standar[...]

    Deleted : user_pref("CT2786678.SearchInNewTabServiceUrl", "hxxp://newtab.conduit-hosting.com/newtab/?ctid=EB_T[...]

    Deleted : user_pref("CT2786678.SearchInNewTabUsageUrl", "hxxp://Usage.Hosting.conduit-services.com/UsageServic[...]

    Deleted : user_pref("CT2786678.ServiceMapLastCheckTime", "Thu Jun 02 2011 05:29:19 GMT+0800 (China Standard Ti[...]

    Deleted : user_pref("CT2786678.SettingsLastCheckTime", "Thu Jun 02 2011 05:29:19 GMT+0800 (China Standard Time[...]

    Deleted : user_pref("CT2786678.SettingsLastUpdate", "1306872762");

    Deleted : user_pref("CT2786678.ThirdPartyComponentsInterval", 504);

    Deleted : user_pref("CT2786678.ThirdPartyComponentsLastCheck", "Thu Jun 02 2011 05:29:19 GMT+0800 (China Stand[...]

    Deleted : user_pref("CT2786678.ThirdPartyComponentsLastUpdate", "1246786978");

    Deleted : user_pref("CT2786678.TrusteLinkUrl", "hxxp://trust.conduit.com/CT2786678");

    Deleted : user_pref("CT2786678.UserID", "UN18337639877813683");

    Deleted : user_pref("CT2786678.WeatherNetwork", "");

    Deleted : user_pref("CT2786678.WeatherPollDate", "Thu Jun 02 2011 07:59:30 GMT+0800 (China Standard Time)");

    Deleted : user_pref("CT2786678.WeatherUnit", "C");

    Deleted : user_pref("CT2786678.alertChannelId", "1178763");

    Deleted : user_pref("CT2786678.generalConfigFromLogin", "{\"SocialDomains\":\"social.conduit.com;apps.conduit.[...]

    Deleted : user_pref("CT2786678.globalFirstTimeInfoLastCheckTime", "Thu Jun 02 2011 05:29:21 GMT+0800 (China St[...]

    Deleted : user_pref("CT2786678.isAppTrackingManagerOn", true);

    Deleted : user_pref("CT2786678.myStuffEnabled", true);

    Deleted : user_pref("CT2786678.myStuffPublihserMinWidth", 400);

    Deleted : user_pref("CT2786678.myStuffSearchUrl", "hxxp://Apps.conduit.com/search?q=SEARCH_TERM&SearchSourceOr[...]

    Deleted : user_pref("CT2786678.myStuffServiceIntervalMM", 1440);

    Deleted : user_pref("CT2786678.myStuffServiceUrl", "hxxp://mystuff.conduit-services.com/MyStuffService.ashx?Co[...]

    Deleted : user_pref("CT2786678.testingCtid", "");

    Deleted : user_pref("CT2786678.toolbarAppMetaDataLastCheckTime", "Thu Jun 02 2011 05:29:21 GMT+0800 (China Sta[...]

    Deleted : user_pref("CT2786678.toolbarContextMenuLastCheckTime", "Thu Jun 02 2011 05:29:30 GMT+0800 (China Sta[...]

    Deleted : user_pref("CommunityToolbar.ETag.hxxp://alerts.conduit-services.com/root/1178763/1174448/PH", "\"0\"[...]

    Deleted : user_pref("CommunityToolbar.ETag.hxxp://alerts.conduit-services.com/root/909619/905414/PH", "\"0\"")[...]

    Deleted : user_pref("CommunityToolbar.ETag.hxxp://appsmetadata.toolbar.conduit-services.com/?ctid=CT2786678", [...]

    Deleted : user_pref("CommunityToolbar.ETag.hxxp://contextmenu.toolbar.conduit-services.com/?name=GottenApps&lo[...]

    Deleted : user_pref("CommunityToolbar.ETag.hxxp://contextmenu.toolbar.conduit-services.com/?name=OtherApps&loc[...]

    Deleted : user_pref("CommunityToolbar.ETag.hxxp://contextmenu.toolbar.conduit-services.com/?name=SharedApps&lo[...]

    Deleted : user_pref("CommunityToolbar.ETag.hxxp://contextmenu.toolbar.conduit-services.com/?name=Toolbar&local[...]

    Deleted : user_pref("CommunityToolbar.ETag.hxxp://dynamicdialogs.alert.conduit-services.com/alert/dlg.pkg", "\[...]

    Deleted : user_pref("CommunityToolbar.ETag.hxxp://dynamicdialogs.engine.conduit-services.com/DLG.pkg?ver=3.3.3[...]

    Deleted : user_pref("CommunityToolbar.ETag.hxxp://dynamicdialogs.toolbar.conduit-services.com/DLG.pkg?ver=3.3.[...]

    Deleted : user_pref("CommunityToolbar.ETag.hxxp://servicemap.conduit-services.com/Toolbar/?ownerId=CT2786678",[...]

    Deleted : user_pref("CommunityToolbar.ETag.hxxp://settings.engine.conduit-services.com/?browser=FF&lut=0", "63[...]

    Deleted : user_pref("CommunityToolbar.ETag.hxxp://settings.engine.conduit-services.com/?browser=FF&lut=3/13/20[...]

    Deleted : user_pref("CommunityToolbar.ETag.hxxp://settings.toolbar.search.conduit.com/root/CT2786678/CT2786678[...]

    Deleted : user_pref("CommunityToolbar.ETag.hxxp://translation.toolbar.conduit-services.com/?locale=en", "\"634[...]

    Deleted : user_pref("CommunityToolbar.EngineOwner", "CT2786678");

    Deleted : user_pref("CommunityToolbar.EngineOwnerGuid", "{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}");

    Deleted : user_pref("CommunityToolbar.EngineOwnerToolbarId", "utorrentbar");

    Deleted : user_pref("CommunityToolbar.IsEngineShown", true);

    Deleted : user_pref("CommunityToolbar.IsMyStuffImportedToEngine", true);

    Deleted : user_pref("CommunityToolbar.OriginalEngineOwner", "CT2786678");

    Deleted : user_pref("CommunityToolbar.OriginalEngineOwnerGuid", "{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}");

    Deleted : user_pref("CommunityToolbar.OriginalEngineOwnerToolbarId", "utorrentbar");

    Deleted : user_pref("CommunityToolbar.SearchFromAddressBarSavedUrl", "");

    Deleted : user_pref("CommunityToolbar.ToolbarsList", "ConduitEngine,CT2786678");

    Deleted : user_pref("CommunityToolbar.ToolbarsList2", "CT2786678");

    Deleted : user_pref("CommunityToolbar.alert.alertDialogsGetterLastCheckTime", "Fri Jun 24 2011 13:07:08 GMT+08[...]

    Deleted : user_pref("CommunityToolbar.alert.alertInfoInterval", 1440);

    Deleted : user_pref("CommunityToolbar.alert.alertInfoLastCheckTime", "Sun Aug 14 2011 07:11:10 GMT+0800 (China[...]

    Deleted : user_pref("CommunityToolbar.alert.clientsServerUrl", "hxxp://alert.client.conduit.com");

    Deleted : user_pref("CommunityToolbar.alert.locale", "en");

    Deleted : user_pref("CommunityToolbar.alert.loginIntervalMin", 1440);

    Deleted : user_pref("CommunityToolbar.alert.loginLastCheckTime", "Mon Aug 15 2011 07:11:02 GMT+0800 (China Sta[...]

    Deleted : user_pref("CommunityToolbar.alert.loginLastUpdateTime", "1305622559");

    Deleted : user_pref("CommunityToolbar.alert.messageShowTimeSec", 20);

    Deleted : user_pref("CommunityToolbar.alert.servicesServerUrl", "hxxp://alert.services.conduit.com");

    Deleted : user_pref("CommunityToolbar.alert.showTrayIcon", false);

    Deleted : user_pref("CommunityToolbar.alert.userCloseIntervalMin", 300);

    Deleted : user_pref("CommunityToolbar.alert.userId", "5e7d735a-7d6f-4f01-b3e8-28dd5605d343");

    Deleted : user_pref("CommunityToolbar.facebook.settingsLastCheckTime", "Thu Jun 02 2011 05:29:23 GMT+0800 (Chi[...]

    Deleted : user_pref("CommunityToolbar.globalUserId", "35731459-76ca-44e3-94fa-baaf5ff44071");

    Deleted : user_pref("CommunityToolbar.isAlertUrlAddedToFeedItemTable", true);

    Deleted : user_pref("CommunityToolbar.isClickActionAddedToFeedItemTable", true);

    Deleted : user_pref("CommunityToolbar.keywordURLSelectedCTID", "CT2786678");

    Deleted : user_pref("ConduitEngine.AppTrackingLastCheckTime", "Sun Aug 14 2011 17:13:19 GMT+0800 (China Standa[...]

    Deleted : user_pref("ConduitEngine.DialogsGetterLastCheckTime", "Sun Aug 14 2011 21:28:32 GMT+0800 (China Stan[...]

    Deleted : user_pref("ConduitEngine.FirstServerDate", "06/02/2011 00");

    Deleted : user_pref("ConduitEngine.FirstTime", true);

    Deleted : user_pref("ConduitEngine.FirstTimeFF3", true);

    Deleted : user_pref("ConduitEngine.HasUserGlobalKeys", true);

    Deleted : user_pref("ConduitEngine.Initialize", true);

    Deleted : user_pref("ConduitEngine.InitializeCommonPrefs", true);

    Deleted : user_pref("ConduitEngine.InstallationType", "UnknownIntegration");

    Deleted : user_pref("ConduitEngine.InstalledDate", "Thu Jun 02 2011 05:29:29 GMT+0800 (China Standard Time)");

    Deleted : user_pref("ConduitEngine.IsMulticommunity", false);

    Deleted : user_pref("ConduitEngine.IsOpenThankYouPage", false);

    Deleted : user_pref("ConduitEngine.IsOpenUninstallPage", true);

    Deleted : user_pref("ConduitEngine.LanguagePackLastCheckTime", "Mon Aug 15 2011 07:11:04 GMT+0800 (China Stand[...]

    Deleted : user_pref("ConduitEngine.LastLogin_3.3.3.2", "Mon Aug 15 2011 21:44:21 GMT+0800 (China Standard Time[...]

    Deleted : user_pref("ConduitEngine.PublisherContainerWidth", 0);

    Deleted : user_pref("ConduitEngine.SearchFromAddressBarIsInit", true);

    Deleted : user_pref("ConduitEngine.SettingsLastCheckTime", "Mon Aug 15 2011 21:44:21 GMT+0800 (China Standard [...]

    Deleted : user_pref("ConduitEngine.UserID", "UN59940693559452031");

    Deleted : user_pref("ConduitEngine.engineLocale", "en-US");

    Deleted : user_pref("ConduitEngine.enngineContextMenuLastCheckTime", "Mon Aug 15 2011 07:11:04 GMT+0800 (China[...]

    Deleted : user_pref("ConduitEngine.globalFirstTimeInfoLastCheckTime", "Mon Aug 15 2011 22:44:21 GMT+0800 (Chin[...]

    Deleted : user_pref("ConduitEngine.initDone", true);

    Deleted : user_pref("ConduitEngine.isAppTrackingManagerOn", true);

    Deleted : user_pref("ConduitEngine.usagesFlag", 2);

    Deleted : user_pref("browser.search.defaultenginename", "SweetIM Search");

    Deleted : user_pref("browser.search.selectedEngine", "SweetIM Search");

    Deleted : user_pref("browser.startup.homepage", "hxxp://startsear.info");

    Deleted : user_pref("extensions.BabylonToolbar.aflt", "babsst");

    Deleted : user_pref("extensions.BabylonToolbar.babTrack", "affID=101434");

    Deleted : user_pref("extensions.BabylonToolbar.bbDpng", 22);

    Deleted : user_pref("extensions.BabylonToolbar.dfltLng", "en");

    Deleted : user_pref("extensions.BabylonToolbar.dfltSrch", true);

    Deleted : user_pref("extensions.BabylonToolbar.hmpg", true);

    Deleted : user_pref("extensions.BabylonToolbar.id", "460d0462000000000000000df07571ec");

    Deleted : user_pref("extensions.BabylonToolbar.instlDay", "15260");

    Deleted : user_pref("extensions.BabylonToolbar.instlRef", "sst");

    Deleted : user_pref("extensions.BabylonToolbar.keyWordUrl", "hxxp://search.babylon.com/?babsrc=SP_ss&q={search[...]

    Deleted : user_pref("extensions.BabylonToolbar.lastDP", 22);

    Deleted : user_pref("extensions.BabylonToolbar.lastVrsnTs", "1.4.35.1022:53:36");

    Deleted : user_pref("extensions.BabylonToolbar.mntrFFxVrsn", "7.0");

    Deleted : user_pref("extensions.BabylonToolbar.newTab", true);

    Deleted : user_pref("extensions.BabylonToolbar.newTabUrl", "hxxp://search.babylon.com/?babsrc=NT_bb");

    Deleted : user_pref("extensions.BabylonToolbar.prdct", "BabylonToolbar");

    Deleted : user_pref("extensions.BabylonToolbar.propectorlck", 60526692);

    Deleted : user_pref("extensions.BabylonToolbar.prtkDS", 1);

    Deleted : user_pref("extensions.BabylonToolbar.prtkHmpg", 1);

    Deleted : user_pref("extensions.BabylonToolbar.prtnrId", "babylon");

    Deleted : user_pref("extensions.BabylonToolbar.ptch_0717", true);

    Deleted : user_pref("extensions.BabylonToolbar.smplGrp", "none");

    Deleted : user_pref("extensions.BabylonToolbar.srcExt", "ss");

    Deleted : user_pref("extensions.BabylonToolbar.srchPrvdr", "Search the web (Babylon)");

    Deleted : user_pref("extensions.BabylonToolbar.tlbrId", "base");

    Deleted : user_pref("extensions.BabylonToolbar.vrsn", "1.4.35.10");

    Deleted : user_pref("extensions.BabylonToolbar.vrsnTs", "1.4.35.1022:53:36");

    Deleted : user_pref("keyword.URL", "hxxp://search.babylon.com/?babsrc=SP_ss&q={searchTerms}&mntrId=460d0462000[...]

    Deleted : user_pref("sweetim.toolbar.previous.browser.search.defaultenginename", "");

    Deleted : user_pref("sweetim.toolbar.previous.browser.search.defaulturl", "hxxp://search.conduit.com/ResultsEx[...]

    Deleted : user_pref("sweetim.toolbar.previous.browser.search.selectedEngine", "Search the web (Babylon)");

    Deleted : user_pref("sweetim.toolbar.previous.browser.startup.homepage", "hxxp://search.babylon.com/?babsrc=HP[...]

    Deleted : user_pref("sweetim.toolbar.urls.homepage", "hxxp://home.sweetim.com/?barid={ADEB4A87-AEC2-11E1-AF94-[...]

    -\\ Google Chrome v23.0.1271.97

    File : C:\Users\star\AppData\Local\Google\Chrome\User Data\Default\Preferences

    Deleted [l.12] : urls_to_restore_on_startup = [ "hxxp://startsear.info/" ]

    Deleted [l.202] : urls_to_restore_on_startup = [ "hxxp://startsear.info/" ]

    *************************

    AdwCleaner[s1].txt - [34289 octets] - [05/01/2013 14:30:46]

    ########## EOF - C:\AdwCleaner[s1].txt - [34350 octets] ##########

    RogueKiller V8.4.2 [Dec 31 2012] by Tigzy

    mail : tigzyRK<at>gmail<dot>com

    Feedback : http://www.geekstogo.com/forum/files/file/413-roguekiller/

    Website : http://tigzy.geekstogo.com/roguekiller.php

    Blog : http://tigzyrk.blogspot.com/

    Operating System : Windows 7 (6.1.7600 ) 32 bits version

    Started in : Normal mode

    User : star [Admin rights]

    Mode : Scan -- Date : 01/05/2013 14:48:38

    ¤¤¤ Bad processes : 0 ¤¤¤

    ¤¤¤ Registry Entries : 6 ¤¤¤

    [RUN][sUSP PATH] HKCU\[...]\Run : STAR-PC (C:\Users\star\AppData\Roaming\STAR-PC.exe) -> FOUND

    [RUN][sUSP PATH] HKUS\S-1-5-21-3176759216-2314316463-3149395627-1000[...]\Run : STAR-PC (C:\Users\star\AppData\Roaming\STAR-PC.exe) -> FOUND

    [HJ DESK] HKCU\[...]\ClassicStartMenu : {59031A47-3F72-44A7-89C5-5595FE6B30EE} (1) -> FOUND

    [HJ DESK] HKCU\[...]\NewStartPanel : {59031a47-3f72-44a7-89c5-5595fe6b30ee} (1) -> FOUND

    [HJ DESK] HKLM\[...]\NewStartPanel : {59031a47-3f72-44a7-89c5-5595fe6b30ee} (1) -> FOUND

    [HJ DESK] HKLM\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> FOUND

    ¤¤¤ Particular Files / Folders: ¤¤¤

    ¤¤¤ Driver : [LOADED] ¤¤¤

    SSDT[84] : NtCreateSection @ 0x82E7ECE3 -> HOOKED (Unknown @ 0x9053F0D6)

    SSDT[316] : NtSetContextThread @ 0x82F29D13 -> HOOKED (Unknown @ 0x9053F0DB)

    SSDT[370] : NtTerminateProcess @ 0x82EAFB3D -> HOOKED (Unknown @ 0x9053F077)

    S_SSDT[585] : NtUserSetWindowsHookEx -> HOOKED (Unknown @ 0x9053F0E0)

    S_SSDT[588] : NtUserSetWinEventHook -> HOOKED (Unknown @ 0x9053F0E5)

    ¤¤¤ HOSTS File: ¤¤¤

    --> C:\Windows\system32\drivers\etc\hosts

    ¤¤¤ MBR Check: ¤¤¤

    +++++ PhysicalDrive0: FUJITSU MJA2250BH G2 ATA Device +++++

    --- User ---

    [MBR] f17513e52d0bc3963e10da7022bc36c5

    [bSP] 2840f74b9343177b4bc5d8e4e0bb269d : Windows 7/8 MBR Code

    Partition table:

    0 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 2048 | Size: 100 Mo

    1 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 206848 | Size: 74899 Mo

    2 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 153600000 | Size: 163474 Mo

    User = LL1 ... OK!

    User = LL2 ... OK!

    Finished : << RKreport[1]_S_01052013_02d1448.txt >>

    RKreport[1]_S_01052013_02d1448.txt

  8. Hello there! I don't know how startsear.info got through my laptop and since then it has been driving me nuts so I decided to seek your help. I've installed the free trial version of Malwarebytes Anti-Malware (thanks!) and performed a quick scan, yet the problem wasn't fixed. Here are my DDS.txt and Attach.txt logs.

    DDS (Ver_2012-11-20.01) - NTFS_x86

    Internet Explorer: 8.0.7600.16385 BrowserJavaVersion: 10.9.2

    Run by star at 7:51:03 on 2013-01-05

    Microsoft Windows 7 Ultimate 6.1.7600.0.1252.1.1033.18.3005.1810 [GMT 8:00]

    .

    AV: AntiVir Desktop *Enabled/Outdated* {090F9C29-64CE-6C6F-379C-5901B49A85B7}

    SP: Windows Defender *Enabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

    SP: AntiVir Desktop *Enabled/Outdated* {B26E7DCD-42F4-63E1-0D2C-6273CF1DCF0A}

    .

    ============== Running Processes ================

    .

    C:\Windows\system32\wininit.exe

    C:\Windows\system32\lsm.exe

    C:\Windows\System32\spoolsv.exe

    C:\Program Files\Avira\AntiVir Desktop\sched.exe

    C:\Windows\system32\taskhost.exe

    C:\Windows\system32\Dwm.exe

    C:\Windows\Explorer.EXE

    C:\Program Files\Avira\AntiVir Desktop\avguard.exe

    C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

    C:\Program Files\Bonjour\mDNSResponder.exe

    C:\Program Files\Common Files\DeviceHelper\DeviceManager.exe

    C:\Program Files\Avira\AntiVir Desktop\avshadow.exe

    C:\Windows\system32\conhost.exe

    C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe

    C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe

    C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe

    C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe

    C:\Windows\System32\rundll32.exe

    C:\Program Files\Avira\AntiVir Desktop\avgnt.exe

    C:\Program Files\Common Files\Real\Update_OB\realsched.exe

    C:\Program Files\Quick net\ModemListener.exe

    C:\Program Files\Ask.com\Updater\Updater.exe

    C:\Program Files\Samsung\Kies\KiesTrayAgent.exe

    C:\Program Files\SweetIM\Messenger\SweetIM.exe

    C:\Program Files\SweetIM\Communicator\SweetPacksUpdateManager.exe

    C:\Program Files\iTunes\iTunesHelper.exe

    C:\Program Files\Common Files\Java\Java Update\jusched.exe

    C:\Program Files\Windows Sidebar\sidebar.exe

    C:\Windows\System32\StikyNot.exe

    C:\Program Files\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe

    C:\Program Files\iPod\bin\iPodService.exe

    C:\Program Files\Common Files\Apple\Internet Services\ubd.exe

    C:\Windows\system32\SearchIndexer.exe

    C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE

    C:\Program Files\Common Files\Apple\Apple Application Support\distnoted.exe

    C:\Windows\system32\conhost.exe

    C:\Program Files\uTorrent\uTorrent.exe

    C:\Program Files\Mozilla Firefox\firefox.exe

    C:\Windows\system32\taskeng.exe

    C:\Windows\notepad.exe

    C:\Windows\system32\DllHost.exe

    C:\Windows\system32\conhost.exe

    C:\Windows\system32\wbem\wmiprvse.exe

    C:\Windows\system32\svchost.exe -k DcomLaunch

    C:\Windows\system32\svchost.exe -k RPCSS

    C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted

    C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted

    C:\Windows\system32\svchost.exe -k netsvcs

    C:\Windows\system32\svchost.exe -k LocalService

    C:\Windows\system32\svchost.exe -k NetworkService

    C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork

    C:\Windows\system32\svchost.exe -k imgsvc

    C:\Windows\system32\svchost.exe -k bthsvcs

    C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation

    C:\Windows\System32\svchost.exe -k secsvcs

    .

    ============== Pseudo HJT Report ===============

    .

    uStart Page = hxxp://startsear.info

    mStart Page = hxxp://home.sweetim.com/?barid={ADEB4A87-AEC2-11E1-AF94-000DF07571EC}

    uURLSearchHooks: uTorrentBar Toolbar: {bf7380fa-e3b4-4db2-af3e-9d8783a45bfc} - c:\program files\utorrentbar\tbuTor.dll

    mURLSearchHooks: uTorrentBar Toolbar: {bf7380fa-e3b4-4db2-af3e-9d8783a45bfc} - c:\program files\utorrentbar\tbuTor.dll

    BHO: Babylon toolbar helper: {2EECD738-5844-4a99-B4B6-146BF802613B} - c:\program files\babylontoolbar\babylontoolbar\1.4.35.10\bh\BabylonToolbar.dll

    BHO: RealPlayer Download and Record Plugin for Internet Explorer: {3049C3E9-B461-4BC5-8870-4C09146192CA} - c:\program files\real\realplayer\rpbrowserrecordplugin.dll

    BHO: Conduit Engine: {30F9B915-B755-4826-820B-08FBA6BD249D} - c:\program files\conduitengine\ConduitEngine.dll

    BHO: {5C255C8A-E604-49b4-9D64-90988571CECB} - <orphaned>

    BHO: Java™ Plug-In SSV Helper: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - c:\program files\java\jre7\bin\ssv.dll

    BHO: Google Toolbar Helper: {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\google toolbar\GoogleToolbar_32.dll

    BHO: Google Toolbar Notifier BHO: {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - c:\program files\google\googletoolbarnotifier\5.7.8313.1002\swg.dll

    BHO: uTorrentBar Toolbar: {bf7380fa-e3b4-4db2-af3e-9d8783a45bfc} - c:\program files\utorrentbar\tbuTor.dll

    BHO: Ask Toolbar: {D4027C7F-154A-4066-A1AD-4243D8127440} - c:\program files\ask.com\GenericAskToolbar.dll

    BHO: Java™ Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - c:\program files\java\jre7\bin\jp2ssv.dll

    BHO: Windows Live Toolbar Helper: {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - c:\program files\windows live\toolbar\wltcore.dll

    BHO: SweetPacks Browser Helper: {EEE6C35C-6118-11DC-9C72-001320C79847} - c:\program files\sweetim\toolbars\internet explorer\mgToolbarIE.dll

    TB: Google Toolbar: {2318C2B1-4965-11D4-9B18-009027A5CD4F} - c:\program files\google\google toolbar\GoogleToolbar_32.dll

    TB: Ask Toolbar: {D4027C7F-154A-4066-A1AD-4243D8127440} - c:\program files\ask.com\GenericAskToolbar.dll

    TB: uTorrentBar Toolbar: {BF7380FA-E3B4-4DB2-AF3E-9D8783A45BFC} - c:\program files\utorrentbar\tbuTor.dll

    TB: &Windows Live Toolbar: {21FA44EF-376D-4D53-9B0F-8A89D3229068} - c:\program files\windows live\toolbar\wltcore.dll

    TB: Ask Toolbar: {D4027C7F-154A-4066-A1AD-4243D8127440} - c:\program files\ask.com\GenericAskToolbar.dll

    TB: &Windows Live Toolbar: {21FA44EF-376D-4D53-9B0F-8A89D3229068} - c:\program files\windows live\toolbar\wltcore.dll

    TB: uTorrentBar Toolbar: {bf7380fa-e3b4-4db2-af3e-9d8783a45bfc} - c:\program files\utorrentbar\tbuTor.dll

    TB: Conduit Engine: {30F9B915-B755-4826-820B-08FBA6BD249D} - c:\program files\conduitengine\ConduitEngine.dll

    TB: Babylon Toolbar: {98889811-442D-49dd-99D7-DC866BE87DBC} - c:\program files\babylontoolbar\babylontoolbar\1.4.35.10\BabylonToolbarTlbr.dll

    TB: SweetPacks Toolbar for Internet Explorer: {EEE6C35B-6118-11DC-9C72-001320C79847} - c:\program files\sweetim\toolbars\internet explorer\mgToolbarIE.dll

    TB: Google Toolbar: {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\google toolbar\GoogleToolbar_32.dll

    uRun: [startUp This] "c:\program files\laplink\pcmover\LaunchSt.exe"

    uRun: [Google Update] "c:\users\star\appdata\local\google\update\GoogleUpdate.exe" /c

    uRun: [Facebook Update] "c:\users\star\appdata\local\facebook\update\FacebookUpdate.exe" /c /nocrashserver

    uRun: [sidebar] c:\program files\windows sidebar\sidebar.exe /autoRun

    uRun: [RESTART_STICKY_NOTES] c:\windows\system32\StikyNot.exe

    uRun: [KiesPDLR] c:\program files\samsung\kies\external\firmwareupdate\KiesPDLR.exe

    uRun: [MobileDocuments] c:\program files\common files\apple\internet services\ubd.exe

    uRun: [sTAR-PC] c:\users\star\appdata\roaming\STAR-PC.exe

    mRun: [avgnt] "c:\program files\avira\antivir desktop\avgnt.exe" /min

    mRun: [TkBellExe] "c:\program files\common files\real\update_ob\realsched.exe" -osboot

    mRun: [ModemListener] c:\program files\quick net\ModemListener.exe start

    mRun: [ApnUpdater] "c:\program files\ask.com\updater\Updater.exe"

    mRun: [KiesHelper] c:\program files\samsung\kies\KiesHelper.exe /s

    mRun: [KiesTrayAgent] c:\program files\samsung\kies\KiesTrayAgent.exe

    mRun: [APSDaemon] "c:\program files\common files\apple\apple application support\APSDaemon.exe"

    mRun: [sweetIM] c:\program files\sweetim\messenger\SweetIM.exe

    mRun: [sweetpacks Communicator] c:\program files\sweetim\communicator\SweetPacksUpdateManager.exe

    mRun: [QuickTime Task] "c:\program files\magic video converter\codec\quicktime\QTTask.exe" -atboottime

    mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"

    mRun: [sunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe"

    StartupFolder: c:\users\star\appdata\roaming\micros~1\windows\startm~1\programs\startup\onenot~1.lnk - c:\program files\microsoft office\office12\ONENOTEM.EXE

    StartupFolder: c:\users\star\appdata\roaming\microsoft\windows\start menu\programs\startup\star.exe

    mPolicies-System: ConsentPromptBehaviorAdmin = dword:5

    mPolicies-System: ConsentPromptBehaviorUser = dword:3

    mPolicies-System: EnableUIADesktopToggle = dword:0

    IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200

    IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - c:\program files\windows live\writer\WriterBrowserExtension.dll

    Trusted Zone: clonewarsadventures.com

    Trusted Zone: freerealms.com

    Trusted Zone: soe.com

    Trusted Zone: sony.com

    DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab

    DPF: {CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab

    DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab

    TCP: NameServer = 192.168.1.1

    TCP: Interfaces\{2BD03252-1F19-4FE2-A68F-1B001A3C1FC1} : DHCPNameServer = 192.168.1.1

    TCP: Interfaces\{2BD03252-1F19-4FE2-A68F-1B001A3C1FC1}\35072796E67677F6F646 : DHCPNameServer = 192.168.1.1

    TCP: Interfaces\{2BD03252-1F19-4FE2-A68F-1B001A3C1FC1}\D4F6F6E6C656166602455616023586F60702D202D4167696E686167716 : DHCPNameServer = 192.168.2.1

    TCP: Interfaces\{2BD03252-1F19-4FE2-A68F-1B001A3C1FC1}\E454457454142575E42523030303 : DHCPNameServer = 192.168.1.1

    Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - c:\program files\microsoft office\office12\GrooveSystemServices.dll

    SSODL: WebCheck - <orphaned>

    SEH: Groove GFS Stub Execution Hook - {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - c:\program files\microsoft office\office12\GrooveShellExtensions.dll

    .

    ================= FIREFOX ===================

    .

    FF - ProfilePath - c:\users\star\appdata\roaming\mozilla\firefox\profiles\f0frb1mp.default\

    FF - prefs.js: browser.search.defaulturl -

    FF - prefs.js: browser.search.selectedEngine - SweetIM Search

    FF - prefs.js: browser.startup.homepage - hxxp://startsear.info

    FF - prefs.js: keyword.URL - hxxp://search.babylon.com/?babsrc=SP_ss&q={searchTerms}&mntrId=460d0462000000000000000df07571ec&tlver=1.4.35.10&affID=101434

    FF - plugin: c:\program files\foxit software\foxit reader\plugins\npFoxitReaderPlugin.dll

    FF - plugin: c:\program files\google\picasa3\npPicasa3.dll

    FF - plugin: c:\program files\google\update\1.3.21.124\npGoogleUpdate3.dll

    FF - plugin: c:\program files\java\jre7\bin\plugin2\npjp2.dll

    FF - plugin: c:\program files\microsoft silverlight\4.0.50826.0\npctrlui.dll

    FF - plugin: c:\program files\microsoft\office live\npOLW.dll

    FF - plugin: c:\program files\windows live\photo gallery\NPWLPG.dll

    FF - plugin: c:\users\star\appdata\local\facebook\video\skype\npFacebookVideoCalling.dll

    FF - plugin: c:\users\star\appdata\local\google\update\1.3.21.123\npGoogleUpdate3.dll

    FF - plugin: c:\windows\system32\macromed\flash\NPSWF32_11_4_402_287.dll

    FF - plugin: c:\windows\system32\npDeployJava1.dll

    FF - plugin: c:\windows\system32\npmproxy.dll

    .

    ============= SERVICES / DRIVERS ===============

    .

    R2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\avira\antivir desktop\sched.exe [2010-9-14 136360]

    R2 AntiVirService;Avira AntiVir Guard;c:\program files\avira\antivir desktop\avguard.exe [2010-9-14 269480]

    R2 avgntflt;avgntflt;c:\windows\system32\drivers\avgntflt.sys [2010-9-14 66616]

    R2 DeviceManager;DeviceManager;c:\program files\common files\devicehelper\devicemanager.exe -start --> c:\program files\common files\devicehelper\DeviceManager.exe -start [?]

    R2 MBAMScheduler;MBAMScheduler;c:\program files\malwarebytes' anti-malware\mbamscheduler.exe [2013-1-4 398184]

    R2 MBAMService;MBAMService;c:\program files\malwarebytes' anti-malware\mbamservice.exe [2013-1-4 682344]

    R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2013-1-4 21104]

    R3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\drivers\Rt86win7.sys [2009-6-11 139776]

    S3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0;c:\windows\system32\drivers\b57nd60x.sys [2009-7-14 229888]

    S3 dg_ssudbus;SAMSUNG Mobile USB Composite Device Driver (DEVGURU Ver.);c:\windows\system32\drivers\ssudbus.sys [2012-7-4 80824]

    S3 fssfltr;fssfltr;c:\windows\system32\drivers\fssfltr.sys [2011-6-10 54632]

    S3 fsssvc;Windows Live Family Safety Service;c:\program files\windows live\family safety\fsssvc.exe [2010-4-28 704872]

    S3 qcusbser;Mobile Connector USB Device for Legacy Serial Communication;c:\windows\system32\drivers\qcusbser.sys [2010-9-14 103552]

    S3 ssudmdm;SAMSUNG Mobile USB Modem Drivers (DEVGURU Ver.);c:\windows\system32\drivers\ssudmdm.sys [2012-7-4 181432]

    .

    =============== Created Last 30 ================

    .

    2013-01-04 03:08:41 -------- d-----w- c:\users\star\appdata\roaming\Malwarebytes

    2013-01-04 03:08:33 -------- d-----w- c:\programdata\Malwarebytes

    2013-01-04 03:08:31 21104 ----a-w- c:\windows\system32\drivers\mbam.sys

    2013-01-04 03:08:31 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware

    2013-01-04 03:08:05 -------- d-----w- c:\users\star\appdata\local\Programs

    2012-12-22 10:01:50 898491 --s-a-w- c:\users\star\appdata\roaming\microsoft\windows\start menu\programs\startup\star.exe

    2012-12-22 10:01:47 898491 --sha-w- c:\users\star\appdata\roaming\STAR-PC.exe

    .

    ==================== Find3M ====================

    .

    2012-10-23 04:39:03 696760 ----a-w- c:\windows\system32\FlashPlayerApp.exe

    2012-10-23 04:39:02 73656 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl

    2012-10-20 18:03:28 93672 ----a-w- c:\windows\system32\WindowsAccessBridge.dll

    2012-10-20 18:03:22 821736 ----a-w- c:\windows\system32\npDeployJava1.dll

    2012-10-20 18:03:21 746984 ----a-w- c:\windows\system32\deployJava1.dll

    .

    ============= FINISH: 7:51:38.40 ===============

    .

    UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.

    IF REQUESTED, ZIP IT UP & ATTACH IT

    .

    DDS (Ver_2012-11-20.01)

    .

    Microsoft Windows 7 Ultimate

    Boot Device: \Device\HarddiskVolume1

    Install Date: 9/13/2010 11:07:36 PM

    System Uptime: 1/5/2013 7:05:23 AM (0 hours ago)

    .

    Motherboard: FUJITSU SIEMENS | | D48

    Processor: Pentium® Dual-Core CPU T4400 @ 2.20GHz | U2E1 | 2200/200mhz

    .

    ==== Disk Partitions =========================

    .

    C: is FIXED (NTFS) - 73 GiB total, 25.081 GiB free.

    D: is FIXED (NTFS) - 160 GiB total, 35.082 GiB free.

    E: is CDROM ()

    H: is FIXED (NTFS) - 466 GiB total, 97.238 GiB free.

    .

    ==== Disabled Device Manager Items =============

    .

    Class GUID:

    Description: Bluetooth Peripheral Device

    Device ID: BTHENUM\{00005601-0000-1000-8000-0002EE000001}_LOCALMFG&000A\7&21BC93D7&0&001F5CD6CB3C_C00000000

    Manufacturer:

    Name: Bluetooth Peripheral Device

    PNP Device ID: BTHENUM\{00005601-0000-1000-8000-0002EE000001}_LOCALMFG&000A\7&21BC93D7&0&001F5CD6CB3C_C00000000

    Service:

    .

    Class GUID:

    Description: Bluetooth Peripheral Device

    Device ID: BTHENUM\{0000111B-0000-1000-8000-00805F9B34FB}_LOCALMFG&000A\7&21BC93D7&0&1C4BD603C5C1_C00000000

    Manufacturer:

    Name: Bluetooth Peripheral Device

    PNP Device ID: BTHENUM\{0000111B-0000-1000-8000-00805F9B34FB}_LOCALMFG&000A\7&21BC93D7&0&1C4BD603C5C1_C00000000

    Service:

    .

    Class GUID:

    Description: Base System Device

    Device ID: PCI\VEN_197B&DEV_2382&SUBSYS_113F1734&REV_00\4&2D86E7A2&0&01E4

    Manufacturer:

    Name: Base System Device

    PNP Device ID: PCI\VEN_197B&DEV_2382&SUBSYS_113F1734&REV_00\4&2D86E7A2&0&01E4

    Service:

    .

    Class GUID:

    Description: Base System Device

    Device ID: PCI\VEN_197B&DEV_2383&SUBSYS_113F1734&REV_00\4&2D86E7A2&0&03E4

    Manufacturer:

    Name: Base System Device

    PNP Device ID: PCI\VEN_197B&DEV_2383&SUBSYS_113F1734&REV_00\4&2D86E7A2&0&03E4

    Service:

    .

    Class GUID:

    Description: Bluetooth Peripheral Device

    Device ID: BTHENUM\{00001304-0000-1000-8000-00805F9B34FB}_LOCALMFG&000A\7&21BC93D7&0&1C4BD603C5C1_C00000000

    Manufacturer:

    Name: Bluetooth Peripheral Device

    PNP Device ID: BTHENUM\{00001304-0000-1000-8000-00805F9B34FB}_LOCALMFG&000A\7&21BC93D7&0&1C4BD603C5C1_C00000000

    Service:

    .

    Class GUID:

    Description: Bluetooth Peripheral Device

    Device ID: BTHENUM\{0000110E-0000-1000-8000-00805F9B34FB}_LOCALMFG&000A\7&21BC93D7&0&1C4BD603C5C1_C00000000

    Manufacturer:

    Name: Bluetooth Peripheral Device

    PNP Device ID: BTHENUM\{0000110E-0000-1000-8000-00805F9B34FB}_LOCALMFG&000A\7&21BC93D7&0&1C4BD603C5C1_C00000000

    Service:

    .

    Class GUID:

    Description: Bluetooth Peripheral Device

    Device ID: BTHENUM\{00001108-0000-1000-8000-00805F9B34FB}_LOCALMFG&000A\7&21BC93D7&0&1C4BD603C5C1_C00000000

    Manufacturer:

    Name: Bluetooth Peripheral Device

    PNP Device ID: BTHENUM\{00001108-0000-1000-8000-00805F9B34FB}_LOCALMFG&000A\7&21BC93D7&0&1C4BD603C5C1_C00000000

    Service:

    .

    Class GUID:

    Description: Base System Device

    Device ID: PCI\VEN_197B&DEV_2384&SUBSYS_113F1734&REV_00\4&2D86E7A2&0&04E4

    Manufacturer:

    Name: Base System Device

    PNP Device ID: PCI\VEN_197B&DEV_2384&SUBSYS_113F1734&REV_00\4&2D86E7A2&0&04E4

    Service:

    .

    Class GUID:

    Description: Bluetooth Peripheral Device

    Device ID: BTHENUM\{00005005-0000-1000-8000-0002EE000001}_LOCALMFG&000A\7&21BC93D7&0&001F5CD6CB3C_C00000000

    Manufacturer:

    Name: Bluetooth Peripheral Device

    PNP Device ID: BTHENUM\{00005005-0000-1000-8000-0002EE000001}_LOCALMFG&000A\7&21BC93D7&0&001F5CD6CB3C_C00000000

    Service:

    .

    Class GUID:

    Description: Bluetooth Peripheral Device

    Device ID: BTHENUM\{0000111B-0000-1000-8000-00805F9B34FB}_LOCALMFG&000A\7&21BC93D7&0&001F5CD6CB3C_C00000000

    Manufacturer:

    Name: Bluetooth Peripheral Device

    PNP Device ID: BTHENUM\{0000111B-0000-1000-8000-00805F9B34FB}_LOCALMFG&000A\7&21BC93D7&0&001F5CD6CB3C_C00000000

    Service:

    .

    Class GUID:

    Description: Bluetooth Peripheral Device

    Device ID: BTHENUM\{0000110B-0000-1000-8000-00805F9B34FB}_LOCALMFG&000A\7&21BC93D7&0&1C4BD603C5C1_C00000000

    Manufacturer:

    Name: Bluetooth Peripheral Device

    PNP Device ID: BTHENUM\{0000110B-0000-1000-8000-00805F9B34FB}_LOCALMFG&000A\7&21BC93D7&0&1C4BD603C5C1_C00000000

    Service:

    .

    Class GUID:

    Description: Bluetooth Peripheral Device

    Device ID: BTHENUM\{00000002-0000-1000-8000-0002EE000002}_LOCALMFG&000A\7&21BC93D7&0&1C4BD603C5C1_C00000000

    Manufacturer:

    Name: Bluetooth Peripheral Device

    PNP Device ID: BTHENUM\{00000002-0000-1000-8000-0002EE000002}_LOCALMFG&000A\7&21BC93D7&0&1C4BD603C5C1_C00000000

    Service:

    .

    Class GUID:

    Description: WD SES Device USB Device

    Device ID: USBSTOR\OTHER&VEN_WD&PROD_SES_DEVICE&REV_1003\575845314531314E5A523133&1

    Manufacturer:

    Name: WD SES Device USB Device

    PNP Device ID: USBSTOR\OTHER&VEN_WD&PROD_SES_DEVICE&REV_1003\575845314531314E5A523133&1

    Service:

    .

    Class GUID:

    Description: Bluetooth Peripheral Device

    Device ID: BTHENUM\{0000110E-0000-1000-8000-00805F9B34FB}_LOCALMFG&000A\7&21BC93D7&0&001F5CD6CB3C_C00000000

    Manufacturer:

    Name: Bluetooth Peripheral Device

    PNP Device ID: BTHENUM\{0000110E-0000-1000-8000-00805F9B34FB}_LOCALMFG&000A\7&21BC93D7&0&001F5CD6CB3C_C00000000

    Service:

    .

    Class GUID:

    Description: Bluetooth Peripheral Device

    Device ID: BTHENUM\{00000004-0000-1000-8000-0002EE000002}_LOCALMFG&000A\7&21BC93D7&0&001F5CD6CB3C_C00000000

    Manufacturer:

    Name: Bluetooth Peripheral Device

    PNP Device ID: BTHENUM\{00000004-0000-1000-8000-0002EE000002}_LOCALMFG&000A\7&21BC93D7&0&001F5CD6CB3C_C00000000

    Service:

    .

    Class GUID: {4d36e972-e325-11ce-bfc1-08002be10318}

    Description: Microsoft Virtual WiFi Miniport Adapter

    Device ID: {5D624F94-8850-40C3-A3FA-A4FD2080BAF3}\VWIFIMP\5&FDBA470&0&01

    Manufacturer: Microsoft

    Name: Microsoft Virtual WiFi Miniport Adapter

    PNP Device ID: {5D624F94-8850-40C3-A3FA-A4FD2080BAF3}\VWIFIMP\5&FDBA470&0&01

    Service: vwifimp

    .

    Class GUID:

    Description: Bluetooth Peripheral Device

    Device ID: BTHENUM\{00000002-0000-1000-8000-0002EE000002}_LOCALMFG&000A\7&21BC93D7&0&001F5CD6CB3C_C00000000

    Manufacturer:

    Name: Bluetooth Peripheral Device

    PNP Device ID: BTHENUM\{00000002-0000-1000-8000-0002EE000002}_LOCALMFG&000A\7&21BC93D7&0&001F5CD6CB3C_C00000000

    Service:

    .

    ==== System Restore Points ===================

    .

    RP90: 1/2/2013 6:39:29 PM - Scheduled Checkpoint

    .

    ==== Installed Programs ======================

    .

    µTorrent

    Adobe AIR

    Adobe Flash Player 10 ActiveX

    Adobe Flash Player 11 Plugin

    Adobe Shockwave Player 11.5

    Apple Application Support

    Apple Mobile Device Support

    Apple Software Update

    Avira AntiVir Personal - Free Antivirus

    Babylon toolbar on IE

    Bonjour

    CCleaner

    Conduit Engine

    CyberLink YouCam

    DC Universe Online Live

    Defraggler

    Diner Dash - Flo on the Go

    Facebook Video Calling 1.2.0.287

    Feeding Frenzy

    ffdshow [rev 2975] [2009-05-28]

    Foxit PDF Creator Toolbar

    Foxit PDF Creator Toolbar Updater

    Foxit Reader

    Google Chrome

    Google Toolbar for Internet Explorer

    Google Update Helper

    HangARoo v2.052

    iCloud

    iTunes

    Java 7 Update 9

    Java Auto Updater

    Java™ 6 Update 29

    JavaFX 2.1.1

    Junk Mail filter update

    K-Lite Codec Pack 5.6.1 (Full)

    Magic Video Converter 12.0.10.2132

    Malwarebytes Anti-Malware version 1.70.0.1100

    Microsoft Application Error Reporting

    Microsoft Choice Guard

    Microsoft Office Access MUI (English) 2007

    Microsoft Office Access Setup Metadata MUI (English) 2007

    Microsoft Office Enterprise 2007

    Microsoft Office Excel MUI (English) 2007

    Microsoft Office Groove MUI (English) 2007

    Microsoft Office Groove Setup Metadata MUI (English) 2007

    Microsoft Office InfoPath MUI (English) 2007

    Microsoft Office Live Add-in 1.3

    Microsoft Office OneNote MUI (English) 2007

    Microsoft Office Outlook Connector

    Microsoft Office Outlook MUI (English) 2007

    Microsoft Office PowerPoint MUI (English) 2007

    Microsoft Office Proof (English) 2007

    Microsoft Office Proof (French) 2007

    Microsoft Office Proof (Spanish) 2007

    Microsoft Office Proofing (English) 2007

    Microsoft Office Publisher MUI (English) 2007

    Microsoft Office Shared MUI (English) 2007

    Microsoft Office Shared Setup Metadata MUI (English) 2007

    Microsoft Office Word MUI (English) 2007

    Microsoft Save as PDF or XPS Add-in for 2007 Microsoft Office programs

    Microsoft Search Enhancement Pack

    Microsoft Silverlight

    Microsoft SQL Server 2005 Compact Edition [ENU]

    Microsoft Sync Framework Runtime Native v1.0 (x86)

    Microsoft Sync Framework Services Native v1.0 (x86)

    Microsoft Visual C++ 2005 Redistributable

    Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17

    Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148

    Microsoft XML Parser

    Mozilla Firefox 17.0.1 (x86 en-US)

    Mozilla Maintenance Service

    MSVCRT

    MyFreeCodec

    Nero 8

    neroxml

    PhotoScape

    Picasa 3

    Quick net

    QuickTime

    QuickTime Alternative 2.8.0

    Real Alternative 1.9.0

    RealPlayer

    Samsung Kies

    SAMSUNG USB Driver for Mobile Phones

    Sandlot Games Client Services

    Skype™ 4.2

    SweetIM for Messenger 3.6

    SweetPacks Toolbar for Internet Explorer 4.6

    Update Manager for SweetPacks 1.0

    uTorrentBar Toolbar

    VCRedistSetup

    VLC media player 1.0.5

    Windows Live Call

    Windows Live Communications Platform

    Windows Live Essentials

    Windows Live Family Safety

    Windows Live Mail

    Windows Live Messenger

    Windows Live Movie Maker

    Windows Live Photo Gallery

    Windows Live Sign-in Assistant

    Windows Live Sync

    Windows Live Toolbar

    Windows Live Upload Tool

    Windows Live Writer

    Windows Media Player Firefox Plugin

    WinRAR archiver

    Yahoo! Messenger

    Yahoo! Toolbar

    .

    ==== Event Viewer Messages From Past Week ========

    .

    1/5/2013 7:05:38 AM, Error: volmgr [46] - Crash dump initialization failed!

    1/2/2013 6:31:43 PM, Error: atapi [11] - The driver detected a controller error on \Device\Ide\IdePort0.

    .

    ==== End Of File ===========================

    I look forward to your help. Thanks!

Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.