Jump to content

allsuprussell

Honorary Members
 View Profile  See their activity

  • Posts

    25

  • Joined

  • Last visited

 Content Type 

Posts posted by allsuprussell

    Whitesmoke toolbar? Total novice, love some help.

    in Resolved Malware Removal Logs

    Posted

    Here ya go

    Zoek.exe Version 4.0.0.2 Updated 23-04-2013

    Tool run by Russell Allsup on 01/05/2013 at 10:06:45.01.

    Microsoft Windows 7 Home Premium 6.1.7601 Service Pack 1 x64

    Running in: Normal Mode Internet Access Detected

    ==== Chrome Look ======================

    HKEY_LOCAL_MACHINE\SOFTWARE\Google\Chrome\Extensions

    ndibdjnfmopecpmkdieinmbadjfpblof - C:\ProgramData\AVG Secure Search\ChromeExt\14.2.0.1\avg.crx[]

    Google Docs - Russell Allsup - Default\Extensions\aohghmighlieiainnegkcijnfilokake

    Google Drive - Russell Allsup - Default\Extensions\apdfllckaahabafndbhieahigkjlhalf

    YouTube - Russell Allsup - Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo

    Google Search - Russell Allsup - Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf

    Gmail - Russell Allsup - Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia

    Tapatalk Notifier - Russell Allsup - Default\Extensions\plfhcjljnfjpfcbjpgnflfofmahljkjj

    Whitesmoke toolbar? Total novice, love some help.

    in Resolved Malware Removal Logs

    Posted

    Wow, okay so i did AVAST and nothing seemed to work, but Zoek...well chrome didnt automatically go to the conduit url, it just went to a normal tab like homepage. However, Im also signed out from my google account, so im afraid if i log back on itll send me back to it, wondering if that may be a problem signing back in? In other words, this is the first time something has changed with the homepage and i don't want to screw it up.

    Here is the log from zoek

    Zoek.exe Version 4.0.0.2 Updated 23-04-2013

    Tool run by Russell Allsup on 30/04/2013 at 19:54:53.37.

    InstallShield* 6.1.7601 x64 WMI=failure

    Running in: Normal Mode Internet Access Detected

    ==== Reset Google Chrome ======================

    C:\users\Russell Allsup\AppData\Local\Google\Chrome\User Data\Default\Preferences was reset successfully

    C:\users\Russell Allsup\AppData\Local\Google\Chrome\User Data\Default\Web Data was reset successfully

    Whitesmoke toolbar? Total novice, love some help.

    in Resolved Malware Removal Logs

    Posted

    Okay, here it is ( sorry to say conduit is still the url, dont know why..)

    ComboFix 13-04-29.01 - Russell Allsup 30/04/2013 18:55:01.1.2 - x64

    Running from: c:\users\Russell Allsup\Desktop\ComboFix.exe

    .

    .

    ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

    .

    .

    c:\users\RUSSEL~1\AppData\Local\Temp\_MEI38042\_ctypes.pyd

    c:\users\RUSSEL~1\AppData\Local\Temp\_MEI38042\_elementtree.pyd

    c:\users\RUSSEL~1\AppData\Local\Temp\_MEI38042\_hashlib.pyd

    c:\users\RUSSEL~1\AppData\Local\Temp\_MEI38042\_socket.pyd

    c:\users\RUSSEL~1\AppData\Local\Temp\_MEI38042\_ssl.pyd

    c:\users\RUSSEL~1\AppData\Local\Temp\_MEI38042\pyexpat.pyd

    c:\users\RUSSEL~1\AppData\Local\Temp\_MEI38042\pysqlite2._sqlite.pyd

    c:\users\RUSSEL~1\AppData\Local\Temp\_MEI38042\python27.dll

    c:\users\RUSSEL~1\AppData\Local\Temp\_MEI38042\pythoncom27.dll

    c:\users\RUSSEL~1\AppData\Local\Temp\_MEI38042\PyWinTypes27.dll

    c:\users\RUSSEL~1\AppData\Local\Temp\_MEI38042\select.pyd

    c:\users\RUSSEL~1\AppData\Local\Temp\_MEI38042\unicodedata.pyd

    c:\users\RUSSEL~1\AppData\Local\Temp\_MEI38042\win32api.pyd

    c:\users\RUSSEL~1\AppData\Local\Temp\_MEI38042\win32com.shell.shell.pyd

    c:\users\RUSSEL~1\AppData\Local\Temp\_MEI38042\win32crypt.pyd

    c:\users\RUSSEL~1\AppData\Local\Temp\_MEI38042\win32event.pyd

    c:\users\RUSSEL~1\AppData\Local\Temp\_MEI38042\win32file.pyd

    c:\users\RUSSEL~1\AppData\Local\Temp\_MEI38042\win32inet.pyd

    c:\users\RUSSEL~1\AppData\Local\Temp\_MEI38042\win32pdh.pyd

    c:\users\RUSSEL~1\AppData\Local\Temp\_MEI38042\win32process.pyd

    c:\users\RUSSEL~1\AppData\Local\Temp\_MEI38042\win32profile.pyd

    c:\users\RUSSEL~1\AppData\Local\Temp\_MEI38042\win32security.pyd

    c:\users\RUSSEL~1\AppData\Local\Temp\_MEI38042\win32ts.pyd

    c:\users\RUSSEL~1\AppData\Local\Temp\_MEI38042\windows._cacheinvalidation.pyd

    c:\users\RUSSEL~1\AppData\Local\Temp\_MEI38042\wx._controls_.pyd

    c:\users\RUSSEL~1\AppData\Local\Temp\_MEI38042\wx._core_.pyd

    c:\users\RUSSEL~1\AppData\Local\Temp\_MEI38042\wx._gdi_.pyd

    c:\users\RUSSEL~1\AppData\Local\Temp\_MEI38042\wx._html2.pyd

    c:\users\RUSSEL~1\AppData\Local\Temp\_MEI38042\wx._misc_.pyd

    c:\users\RUSSEL~1\AppData\Local\Temp\_MEI38042\wx._windows_.pyd

    c:\users\RUSSEL~1\AppData\Local\Temp\_MEI38042\wx._wizard.pyd

    c:\users\RUSSEL~1\AppData\Local\Temp\_MEI38042\wxbase294u_net_vc90.dll

    c:\users\RUSSEL~1\AppData\Local\Temp\_MEI38042\wxbase294u_vc90.dll

    c:\users\RUSSEL~1\AppData\Local\Temp\_MEI38042\wxmsw294u_adv_vc90.dll

    c:\users\RUSSEL~1\AppData\Local\Temp\_MEI38042\wxmsw294u_core_vc90.dll

    c:\users\RUSSEL~1\AppData\Local\Temp\_MEI38042\wxmsw294u_html_vc90.dll

    c:\users\RUSSEL~1\AppData\Local\Temp\_MEI38042\wxmsw294u_webview_vc90.dll

    c:\users\Russell Allsup\AppData\Local\assembly\tmp

    c:\users\Russell Allsup\AppData\Local\Temp\_MEI38042\_ctypes.pyd

    c:\users\Russell Allsup\AppData\Local\Temp\_MEI38042\_elementtree.pyd

    c:\users\Russell Allsup\AppData\Local\Temp\_MEI38042\_hashlib.pyd

    c:\users\Russell Allsup\AppData\Local\Temp\_MEI38042\_socket.pyd

    c:\users\Russell Allsup\AppData\Local\Temp\_MEI38042\_ssl.pyd

    c:\users\Russell Allsup\AppData\Local\Temp\_MEI38042\pyexpat.pyd

    c:\users\Russell Allsup\AppData\Local\Temp\_MEI38042\pysqlite2._sqlite.pyd

    c:\users\Russell Allsup\AppData\Local\Temp\_MEI38042\python27.dll

    c:\users\Russell Allsup\AppData\Local\Temp\_MEI38042\pythoncom27.dll

    c:\users\Russell Allsup\AppData\Local\Temp\_MEI38042\PyWinTypes27.dll

    c:\users\Russell Allsup\AppData\Local\Temp\_MEI38042\select.pyd

    c:\users\Russell Allsup\AppData\Local\Temp\_MEI38042\unicodedata.pyd

    c:\users\Russell Allsup\AppData\Local\Temp\_MEI38042\win32api.pyd

    c:\users\Russell Allsup\AppData\Local\Temp\_MEI38042\win32com.shell.shell.pyd

    c:\users\Russell Allsup\AppData\Local\Temp\_MEI38042\win32crypt.pyd

    c:\users\Russell Allsup\AppData\Local\Temp\_MEI38042\win32event.pyd

    c:\users\Russell Allsup\AppData\Local\Temp\_MEI38042\win32file.pyd

    c:\users\Russell Allsup\AppData\Local\Temp\_MEI38042\win32inet.pyd

    c:\users\Russell Allsup\AppData\Local\Temp\_MEI38042\win32pdh.pyd

    c:\users\Russell Allsup\AppData\Local\Temp\_MEI38042\win32process.pyd

    c:\users\Russell Allsup\AppData\Local\Temp\_MEI38042\win32profile.pyd

    c:\users\Russell Allsup\AppData\Local\Temp\_MEI38042\win32security.pyd

    c:\users\Russell Allsup\AppData\Local\Temp\_MEI38042\win32ts.pyd

    c:\users\Russell Allsup\AppData\Local\Temp\_MEI38042\windows._cacheinvalidation.pyd

    c:\users\Russell Allsup\AppData\Local\Temp\_MEI38042\wx._controls_.pyd

    c:\users\Russell Allsup\AppData\Local\Temp\_MEI38042\wx._core_.pyd

    c:\users\Russell Allsup\AppData\Local\Temp\_MEI38042\wx._gdi_.pyd

    c:\users\Russell Allsup\AppData\Local\Temp\_MEI38042\wx._html2.pyd

    c:\users\Russell Allsup\AppData\Local\Temp\_MEI38042\wx._misc_.pyd

    c:\users\Russell Allsup\AppData\Local\Temp\_MEI38042\wx._windows_.pyd

    c:\users\Russell Allsup\AppData\Local\Temp\_MEI38042\wx._wizard.pyd

    c:\users\Russell Allsup\AppData\Local\Temp\_MEI38042\wxbase294u_net_vc90.dll

    c:\users\Russell Allsup\AppData\Local\Temp\_MEI38042\wxbase294u_vc90.dll

    c:\users\Russell Allsup\AppData\Local\Temp\_MEI38042\wxmsw294u_adv_vc90.dll

    c:\users\Russell Allsup\AppData\Local\Temp\_MEI38042\wxmsw294u_core_vc90.dll

    c:\users\Russell Allsup\AppData\Local\Temp\_MEI38042\wxmsw294u_html_vc90.dll

    c:\users\Russell Allsup\AppData\Local\Temp\_MEI38042\wxmsw294u_webview_vc90.dll

    c:\users\Russell Allsup\DLL32.DLL

    c:\windows\SysWow64\lsprst7.dll

    .

    .

    ((((((((((((((((((((((((( Files Created from 2013-04-01 to 2013-05-01 )))))))))))))))))))))))))))))))

    .

    .

    2013-05-01 01:59 . 2013-05-01 01:59 -------- d-----w- c:\users\Default\AppData\Local\temp

    2013-04-30 20:06 . 2013-04-30 20:06 -------- d-----w- C:\_OTL

    2013-04-30 19:12 . 2013-04-10 03:46 9317456 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{F93B3D93-8503-4463-91D5-C20E5A0651DD}\mpengine.dll

    2013-04-30 01:45 . 2013-04-30 01:45 -------- d-----w- c:\windows\ERUNT

    2013-04-30 01:11 . 2013-04-30 01:44 -------- d-----w- C:\JRT

    2013-04-25 04:35 . 2013-04-12 14:45 1656680 ----a-w- c:\windows\system32\drivers\ntfs.sys

    2013-04-16 07:31 . 2013-04-16 07:31 -------- d-----w- c:\program files\Microsoft Mouse and Keyboard Center

    2013-04-09 21:43 . 2013-02-15 06:06 3717632 ----a-w- c:\windows\system32\mstscax.dll

    2013-04-09 21:43 . 2013-02-15 04:37 3217408 ----a-w- c:\windows\SysWow64\mstscax.dll

    2013-04-09 21:43 . 2013-02-15 06:08 44032 ----a-w- c:\windows\system32\tsgqec.dll

    2013-04-09 21:43 . 2013-02-15 06:02 158720 ----a-w- c:\windows\system32\aaclient.dll

    2013-04-09 21:43 . 2013-02-15 04:34 131584 ----a-w- c:\windows\SysWow64\aaclient.dll

    2013-04-09 21:43 . 2013-02-15 03:25 36864 ----a-w- c:\windows\SysWow64\tsgqec.dll

    2013-04-09 21:43 . 2013-03-01 03:36 3153408 ----a-w- c:\windows\system32\win32k.sys

    2013-04-09 21:42 . 2013-01-24 06:01 223752 ----a-w- c:\windows\system32\drivers\fvevol.sys

    2013-04-09 21:42 . 2013-03-19 06:04 5550424 ----a-w- c:\windows\system32\ntoskrnl.exe

    2013-04-09 21:42 . 2013-03-19 05:04 3968856 ----a-w- c:\windows\SysWow64\ntkrnlpa.exe

    2013-04-09 21:42 . 2013-03-19 05:04 3913560 ----a-w- c:\windows\SysWow64\ntoskrnl.exe

    2013-04-09 21:42 . 2013-03-19 05:46 43520 ----a-w- c:\windows\system32\csrsrv.dll

    2013-04-09 21:42 . 2013-03-19 04:47 6656 ----a-w- c:\windows\SysWow64\apisetschema.dll

    2013-04-09 21:42 . 2013-03-19 03:06 112640 ----a-w- c:\windows\system32\smss.exe

    .

    .

    .

    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

    .

    2013-04-10 09:07 . 2012-10-01 07:47 72702784 ----a-w- c:\windows\system32\MRT.exe

    2013-03-13 07:58 . 2012-05-14 09:44 73432 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl

    2013-03-13 07:58 . 2012-05-14 09:44 693976 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe

    2013-03-12 08:10 . 2010-11-21 03:27 282744 ------w- c:\windows\system32\MpSigStub.exe

    2013-02-19 06:53 . 2013-01-25 07:24 39768 ----a-w- c:\windows\system32\drivers\avgtpx64.sys

    2013-02-12 05:45 . 2013-03-14 03:16 135168 ----a-w- c:\windows\apppatch\AppPatch64\AcXtrnal.dll

    2013-02-12 05:45 . 2013-03-14 03:16 350208 ----a-w- c:\windows\apppatch\AppPatch64\AcLayers.dll

    2013-02-12 05:45 . 2013-03-14 03:16 308736 ----a-w- c:\windows\apppatch\AppPatch64\AcGenral.dll

    2013-02-12 05:45 . 2013-03-14 03:16 111104 ----a-w- c:\windows\apppatch\AppPatch64\acspecfc.dll

    2013-02-12 04:48 . 2013-03-14 03:16 474112 ----a-w- c:\windows\apppatch\AcSpecfc.dll

    2013-02-12 04:48 . 2013-03-14 03:16 2176512 ----a-w- c:\windows\apppatch\AcGenral.dll

    2013-02-12 04:12 . 2013-03-14 21:05 19968 ----a-w- c:\windows\system32\drivers\usb8023.sys

    .

    .

    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

    .

    .

    *Note* empty entries & legit default entries are not shown

    REGEDIT4

    .

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

    "GoogleDriveSync"="c:\program files (x86)\Google\Drive\googledrivesync.exe" [2013-03-07 19357112]

    .

    [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]

    "SuiteTray"="c:\program files (x86)\EgisTec MyWinLockerSuite\x86\SuiteTray.exe" [2011-09-20 341360]

    "Norton Online Backup"="c:\program files (x86)\Symantec\Norton Online Backup\NOBuClient.exe" [2010-06-01 1155928]

    "Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-12-03 946352]

    "BackupManagerTray"="c:\program files (x86)\NTI\Acer Backup Manager\BackupManagerTray.exe" [2012-01-05 296984]

    "LManager"="c:\program files (x86)\Launch Manager\LManager.exe" [2012-03-23 1105488]

    "APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2012-08-28 59280]

    "iTunesHelper"="c:\program files (x86)\iTunes\iTunesHelper.exe" [2012-09-10 421776]

    "ConnectionManager"="c:\program files (x86)\Winsim\ConnectionManager\Simply.SystemTrayIcon.exe" [2012-08-14 152424]

    "SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2012-07-03 252848]

    "PWRISOVM.EXE"="c:\program files (x86)\PowerISO\PWRISOVM.EXE" [2012-12-09 336992]

    .

    [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]

    "IsMyWinLockerReboot"="msiexec.exe" [2010-11-21 73216]

    .

    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

    "ConsentPromptBehaviorAdmin"= 5 (0x5)

    "ConsentPromptBehaviorUser"= 3 (0x3)

    "EnableUIADesktopToggle"= 0 (0x0)

    "PromptOnSecureDesktop"= 0 (0x0)

    .

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]

    @=""

    .

    R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]

    R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe [2012-11-09 160944]

    R3 EgisTec Ticket Service;EgisTec Ticket Service;c:\program files (x86)\Common Files\EgisTec\Services\EgisTicketService.exe [2011-06-21 173424]

    R3 ose64;Office 64 Source Engine;c:\program files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2010-01-10 174440]

    R3 Point64;Microsoft Mouse and Keyboard Center Filter Driver;c:\windows\system32\DRIVERS\point64.sys [2013-01-30 50800]

    R3 Sage 50 Transaction Manager 2013 - CDN;Sage 50 Transaction Manager 2013 - CDN;c:\program files (x86)\Winsim\TransactionManager2013 - CDN\Sage_SA.TransactionManager.exe [2012-12-11 35696]

    R3 Sage Simply Accounting Transaction Manager 2012 - CDN;Sage Simply Accounting Transaction Manager 2012 - CDN;c:\program files (x86)\Winsim\TransactionManager2012 - CDN\Sage_SA.TransactionManager.exe [2011-08-02 46408]

    R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-21 59392]

    R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys [2010-11-21 31232]

    R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys [2012-07-09 52736]

    R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [2012-09-21 1255736]

    R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe [2010-09-23 57184]

    S1 avgtp;avgtp;c:\windows\system32\drivers\avgtpx64.sys [2013-02-19 39768]

    S1 mwlPSDFilter;mwlPSDFilter;c:\windows\system32\DRIVERS\mwlPSDFilter.sys [2012-05-14 22648]

    S1 mwlPSDNServ;mwlPSDNServ;c:\windows\system32\DRIVERS\mwlPSDNServ.sys [2012-05-14 20520]

    S1 mwlPSDVDisk;mwlPSDVDisk;c:\windows\system32\DRIVERS\mwlPSDVDisk.sys [2012-05-14 62776]

    S2 DsiWMIService;Dritek WMI Service;c:\program files (x86)\Launch Manager\dsiwmis.exe [2012-03-23 355920]

    S2 ePowerSvc;ePower Service;c:\program files\Acer\Acer ePower Management\ePowerSvc.exe [2012-02-08 871296]

    S2 GREGService;GREGService;c:\program files (x86)\Acer\Registration\GREGsvc.exe [2012-02-29 28264]

    S2 IAStorDataMgrSvc;Intel® Rapid Storage Technology;c:\program files (x86)\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe [2011-11-30 13592]

    S2 Intel® Capability Licensing Service Interface;Intel® Capability Licensing Service Interface;c:\program files\Intel\iCLS Client\HeciServer.exe [2012-02-03 628448]

    S2 Intel® ME Service;Intel® ME Service;c:\program files (x86)\Intel\Intel® Management Engine Components\FWService\IntelMeFWService.exe [2012-02-07 128280]

    S2 jhi_service;Intel® Dynamic Application Loader Host Interface Service;c:\program files (x86)\Intel\Intel® Management Engine Components\DAL\jhi_service.exe [2012-02-07 161560]

    S2 Live Updater Service;Live Updater Service;c:\program files\Acer\Acer Updater\UpdaterService.exe [2012-02-07 255376]

    S2 NOBU;Norton Online Backup;c:\program files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe SERVICE [x]

    S2 NTI IScheduleSvc;NTI IScheduleSvc;c:\program files (x86)\NTI\Acer Backup Manager\IScheduleSvc.exe [2012-01-05 256536]

    S2 Simply Accounting Database Connection Manager;Sage 50 Database Connection Manager;c:\program files (x86)\Winsim\ConnectionManager\SimplyConnectionManager.exe [2012-08-14 22376]

    S2 UNS;Intel® Management and Security Application User Notification Service;c:\program files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe [2012-02-07 363800]

    S2 ZAtheros Wlan Agent;ZAtheros Wlan Agent;c:\program files (x86)\Atheros\Ath_WlanAgent.exe [2012-01-18 72864]

    S3 IntcDAud;Intel® Display Audio;c:\windows\system32\DRIVERS\IntcDAud.sys [2011-12-05 331264]

    S3 RSBASTOR;Realtek PCIE CardReader Driver - BA;c:\windows\system32\DRIVERS\RtsBaStor.sys [2012-02-01 292968]

    S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [2012-03-16 685672]

    S3 SmbDrv;SmbDrv;c:\windows\system32\DRIVERS\Smb_driver.sys [2012-02-14 22800]

    .

    .

    --- Other Services/Drivers In Memory ---

    .

    *NewlyCreated* - WS2IFSL

    .

    [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]

    2013-04-29 22:35 1642448 ----a-w- c:\program files (x86)\Google\Chrome\Application\26.0.1410.64\Installer\chrmstp.exe

    .

    Contents of the 'Scheduled Tasks' folder

    .

    2013-05-01 c:\windows\Tasks\Adobe Flash Player Updater.job

    - c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-05-14 07:58]

    .

    2013-05-01 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job

    - c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-09-20 03:03]

    .

    2013-05-01 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job

    - c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-09-20 03:03]

    .

    2013-05-01 c:\windows\Tasks\ISM-UpdateService-4e00205a-2ab1-4423-8f77-cc25b82cde1d-Logon.job

    - c:\program files (x86)\Intel\Intel® ME FW Recovery Agent\bin\Bootstrap.exe [2011-11-25 20:41]

    .

    2013-04-30 c:\windows\Tasks\ISM-UpdateService-4e00205a-2ab1-4423-8f77-cc25b82cde1d.job

    - c:\program files (x86)\Intel\Intel® ME FW Recovery Agent\bin\Bootstrap.exe [2011-11-25 20:41]

    .

    .

    --------- X64 Entries -----------

    .

    .

    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveBlacklistedOverlay]

    @="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D42}"

    [HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D42}]

    2013-03-07 23:31 776144 ----a-w- c:\program files (x86)\Google\Drive\googledrivesync64.dll

    .

    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSharedOverlay]

    @="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D44}"

    [HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D44}]

    2013-03-07 23:31 776144 ----a-w- c:\program files (x86)\Google\Drive\googledrivesync64.dll

    .

    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSyncedOverlay]

    @="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D40}"

    [HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D40}]

    2013-03-07 23:31 776144 ----a-w- c:\program files (x86)\Google\Drive\googledrivesync64.dll

    .

    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSyncingOverlay]

    @="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D41}"

    [HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D41}]

    2013-03-07 23:31 776144 ----a-w- c:\program files (x86)\Google\Drive\googledrivesync64.dll

    .

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

    "IgfxTray"="c:\windows\system32\igfxtray.exe" [2012-04-22 170264]

    "HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2012-04-22 398616]

    "Persistence"="c:\windows\system32\igfxpers.exe" [2012-04-22 439064]

    "RTHDVCPL"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2012-02-21 12452456]

    "Power Management"="c:\program files\Acer\Acer ePower Management\ePowerTray.exe" [2012-02-08 1829768]

    "BCSSync"="c:\program files\Microsoft Office\Office14\BCSSync.exe" [2010-03-13 112512]

    .

    ------- Supplementary Scan -------

    .

    uStart Page = https://www.google.ca/

    uLocal Page = c:\windows\system32\blank.htm

    mDefault_Page_URL = hxxp://acer.msn.com

    mStart Page = hxxp://www.google.com

    mLocal Page = c:\windows\SysWOW64\blank.htm

    uInternet Settings,ProxyOverride = *.local

    IE: E&xport to Microsoft Excel - c:\progra~2\MICROS~4\Office14\EXCEL.EXE/3000

    IE: Se&nd to OneNote - c:\progra~2\MICROS~4\Office14\ONBttnIE.dll/105

    TCP: DhcpNameServer = 64.59.144.93 64.59.150.139

    FF - ProfilePath - c:\users\Russell Allsup\AppData\Roaming\Mozilla\Firefox\Profiles\d3p9l5pa.default\

    FF - prefs.js: browser.search.selectedEngine - Google

    FF - prefs.js: browser.startup.homepage - hxxps://www.google.ca/

    .

    - - - - ORPHANS REMOVED - - - -

    .

    Toolbar-Locked - (no file)

    Wow6432Node-HKLM-Run-<NO NAME> - (no file)

    Toolbar-Locked - (no file)

    HKLM-Run-SynTPEnh - c:\program files (x86)\Synaptics\SynTP\SynTPEnh.exe

    .

    .

    .

    --------------------- LOCKED REGISTRY KEYS ---------------------

    .

    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]

    @Denied: (A 2) (Everyone)

    @="FlashBroker"

    "LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_6_602_180_ActiveX.exe,-101"

    .

    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]

    "Enabled"=dword:00000001

    .

    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]

    @="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_6_602_180_ActiveX.exe"

    .

    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]

    @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

    .

    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]

    @Denied: (A 2) (Everyone)

    @="IFlashBroker5"

    .

    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]

    @="{00020424-0000-0000-C000-000000000046}"

    .

    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]

    @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

    "Version"="1.0"

    .

    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]

    @Denied: (A 2) (Everyone)

    @="FlashBroker"

    "LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_6_602_180_ActiveX.exe,-101"

    .

    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]

    "Enabled"=dword:00000001

    .

    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]

    @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_6_602_180_ActiveX.exe"

    .

    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]

    @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

    .

    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]

    @Denied: (A 2) (Everyone)

    @="Shockwave Flash Object"

    .

    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]

    @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_6_602_180.ocx"

    "ThreadingModel"="Apartment"

    .

    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]

    @="0"

    .

    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]

    @="ShockwaveFlash.ShockwaveFlash.11"

    .

    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]

    @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_6_602_180.ocx, 1"

    .

    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]

    @="{D27CDB6B-AE6D-11cf-96B8-444553540000}"

    .

    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]

    @="1.0"

    .

    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]

    @="ShockwaveFlash.ShockwaveFlash"

    .

    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]

    @Denied: (A 2) (Everyone)

    @="Macromedia Flash Factory Object"

    .

    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]

    @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_6_602_180.ocx"

    "ThreadingModel"="Apartment"

    .

    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]

    @="FlashFactory.FlashFactory.1"

    .

    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]

    @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_6_602_180.ocx, 1"

    .

    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]

    @="{D27CDB6B-AE6D-11cf-96B8-444553540000}"

    .

    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]

    @="1.0"

    .

    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]

    @="FlashFactory.FlashFactory"

    .

    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]

    @Denied: (A 2) (Everyone)

    @="IFlashBroker5"

    .

    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]

    @="{00020424-0000-0000-C000-000000000046}"

    .

    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]

    @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

    "Version"="1.0"

    .

    [HKEY_LOCAL_MACHINE\SOFTWARE\McAfee]

    "SymbolicLinkValue"=hex(6):5c,00,72,00,65,00,67,00,69,00,73,00,74,00,72,00,79,

    00,5c,00,6d,00,61,00,63,00,68,00,69,00,6e,00,65,00,5c,00,53,00,6f,00,66,00,\

    .

    [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Office\Common\Smart Tag\Actions\{B7EFF951-E52F-45CC-9EF7-57124F2177CC}]

    @Denied: (A) (Everyone)

    "Solution"="{15727DE6-F92D-4E46-ACB4-0E2C58B31A18}"

    .

    [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3]

    @Denied: (A) (Everyone)

    .

    [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3\0]

    "Key"="ActionsPane3"

    "Location"="c:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VSTO\\ActionsPane3.xsd"

    .

    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]

    @Denied: (Full) (Everyone)

    .

    ------------------------ Other Running Processes ------------------------

    .

    c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe

    c:\program files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

    c:\program files (x86)\Launch Manager\LMutilps32.exe

    c:\program files (x86)\CyberLink\MediaEspresso\DeviceDetector\DeviceDetector.exe

    c:\program files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe

    .

    **************************************************************************

    .

    Completion time: 2013-04-30 19:07:36 - machine was rebooted

    ComboFix-quarantined-files.txt 2013-05-01 02:07

    .

    Pre-Run: 405,304,791,040 bytes free

    Post-Run: 404,797,775,872 bytes free

    .

    - - End Of File - - DC8980940DF5EFEE9F6ECEF36BD7F44A

    Whitesmoke toolbar? Total novice, love some help.

    in Resolved Malware Removal Logs

    Posted

    I believe this is the one

    All processes killed

    ========== OTL ==========

    Use Chrome's Settings page to remove the default_search_provider items.

    Use Chrome's Settings page to remove the default_search_provider items.

    ========== COMMANDS ==========

    [EMPTYJAVA]

    User: All Users

    User: Default

    User: Default User

    User: Public

    User: Russell Allsup

    ->Java cache emptied: 713347 bytes

    Total Java Files Cleaned = 1.00 mb

    [EMPTYTEMP]

    User: All Users

    User: Default

    ->Temp folder emptied: 0 bytes

    ->Temporary Internet Files folder emptied: 0 bytes

    ->Flash cache emptied: 56466 bytes

    User: Default User

    ->Temp folder emptied: 0 bytes

    ->Temporary Internet Files folder emptied: 0 bytes

    ->Flash cache emptied: 0 bytes

    User: Public

    User: Russell Allsup

    ->Temp folder emptied: 4725881508 bytes

    ->Temporary Internet Files folder emptied: 47066271 bytes

    ->Java cache emptied: 0 bytes

    ->FireFox cache emptied: 386444678 bytes

    ->Google Chrome cache emptied: 344954729 bytes

    ->Flash cache emptied: 161843 bytes

    %systemdrive% .tmp files removed: 0 bytes

    %systemroot% .tmp files removed: 0 bytes

    %systemroot%\System32 .tmp files removed: 0 bytes

    %systemroot%\System32 (64bit) .tmp files removed: 0 bytes

    %systemroot%\System32\drivers .tmp files removed: 0 bytes

    Windows Temp folder emptied: 532085769 bytes

    %systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 67822 bytes

    RecycleBin emptied: 3103773312 bytes

    Total Files Cleaned = 8,717.00 mb

    [EMPTYFLASH]

    User: All Users

    User: Default

    ->Flash cache emptied: 0 bytes

    Whitesmoke toolbar? Total novice, love some help.

    in Resolved Malware Removal Logs

    Posted

    Okay, it was set too google and everything else seems set to how it should. However, in the "Other search engines" category, I had to delete the "conduit" search engine, and still when opening chrome the homepage is the whitesmoke one. I noticed however that for search engines, googles URL looks strange,

    {google:baseURL}search?q=%s&{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}{google:assistedQueryStats}{google:searchFieldtrialParameter}{google:searchClient}{google:sourceId}{google:instantExtendedEnabledParameter}ie={inputEncoding}

    All of the other engines are the standard http:// whatever, but google's is the above.

    No idea what that means or how to fix it. Also thanks for all your help so far, im trying here.

    Whitesmoke toolbar? Total novice, love some help.

    in Resolved Malware Removal Logs

    Posted

    The OTL

    OTL logfile created on: 29/04/2013 7:55:31 PM - Run 1

    OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\Russell Allsup\Downloads

    64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation

    Internet Explorer (Version = 9.0.8112.16421)

    Locale: 00001009 | Country: Canada | Language: ENC | Date Format: dd/MM/yyyy

    5.84 Gb Total Physical Memory | 3.85 Gb Available Physical Memory | 65.84% Memory free

    11.68 Gb Paging File | 9.49 Gb Available in Paging File | 81.28% Paging File free

    Paging file location(s): ?:\pagefile.sys [binary data]

    %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)

    Drive C: | 449.66 Gb Total Space | 368.25 Gb Free Space | 81.90% Space Free | Partition Type: NTFS

    Computer Name: RussellAllsup | User Name: Russell Allsup | Logged in as Administrator.

    Boot Mode: Normal | Scan Mode: All users | Quick Scan | Include 64bit Scans

    Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

    ========== Processes (SafeList) ==========

    PRC - [2013/04/29 19:54:48 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Russell Allsup\Downloads\OTL.exe

    PRC - [2013/04/09 01:57:09 | 001,312,720 | ---- | M] (Google Inc.) -- C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

    PRC - [2013/03/07 16:31:48 | 019,357,112 | ---- | M] (Google) -- C:\Program Files (x86)\Google\Drive\googledrivesync.exe

    PRC - [2012/12/18 07:28:08 | 000,065,192 | ---- | M] (Adobe Systems Incorporated) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe

    PRC - [2012/12/09 02:51:30 | 000,336,992 | ---- | M] (Power Software Ltd) -- C:\Program Files (x86)\PowerISO\PWRISOVM.EXE

    PRC - [2012/08/14 01:00:00 | 000,152,424 | ---- | M] (Sage) -- C:\Program Files (x86)\winsim\ConnectionManager\Simply.SystemTrayIcon.exe

    PRC - [2012/08/14 01:00:00 | 000,022,376 | ---- | M] (Sage) -- C:\Program Files (x86)\winsim\ConnectionManager\SimplyConnectionManager.exe

    PRC - [2012/03/23 02:33:48 | 000,419,408 | ---- | M] (Dritek System Inc.) -- C:\Program Files (x86)\Launch Manager\LMutilps32.exe

    PRC - [2012/03/23 02:33:46 | 000,355,920 | ---- | M] (Dritek System Inc.) -- C:\Program Files (x86)\Launch Manager\dsiwmis.exe

    PRC - [2012/03/23 02:33:46 | 000,343,632 | ---- | M] (Dritek System Inc.) -- C:\Program Files (x86)\Launch Manager\LMworker.exe

    PRC - [2012/03/23 02:33:44 | 001,105,488 | ---- | M] (Dritek System Inc.) -- C:\Program Files (x86)\Launch Manager\LManager.exe

    PRC - [2012/02/29 06:49:06 | 000,028,264 | ---- | M] (Acer Incorporated) -- C:\Program Files (x86)\Acer\Registration\GREGsvc.exe

    PRC - [2012/02/07 03:03:36 | 000,363,800 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe

    PRC - [2012/02/07 03:03:34 | 000,277,784 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe

    PRC - [2012/02/07 03:03:28 | 000,128,280 | ---- | M] () -- C:\Program Files (x86)\Intel\Intel® Management Engine Components\FWService\IntelMeFWService.exe

    PRC - [2012/02/07 03:03:16 | 000,161,560 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel® Management Engine Components\DAL\Jhi_service.exe

    PRC - [2012/01/18 04:37:32 | 000,072,864 | ---- | M] (Atheros) -- C:\Program Files (x86)\Atheros\Ath_WlanAgent.exe

    PRC - [2012/01/05 14:22:10 | 000,256,536 | ---- | M] (NTI Corporation) -- C:\Program Files (x86)\NTI\Acer Backup Manager\IScheduleSvc.exe

    PRC - [2012/01/05 14:21:44 | 000,296,984 | ---- | M] (NTI Corporation) -- C:\Program Files (x86)\NTI\Acer Backup Manager\BackupManagerTray.exe

    PRC - [2011/12/23 10:24:00 | 000,119,808 | ---- | M] () -- C:\Program Files (x86)\Intel\Intel® ME FW Recovery Agent\bin\updateui.exe

    PRC - [2011/11/29 20:04:56 | 000,013,592 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe

    PRC - [2011/11/25 13:41:36 | 000,645,896 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel® ME FW Recovery Agent\bin\ismagent.exe

    PRC - [2011/05/20 09:44:32 | 000,986,208 | ---- | M] (CyberLink) -- C:\Program Files (x86)\CyberLink\MediaEspresso\DeviceDetector\DeviceDetector.exe

    ========== Modules (No Company Name) ==========

    MOD - [2013/04/29 18:17:08 | 000,128,512 | ---- | M] () -- C:\Users\Russell Allsup\AppData\Local\Temp\_MEI36042\_elementtree.pyd

    MOD - [2013/04/29 18:17:08 | 000,098,816 | ---- | M] () -- C:\Users\Russell Allsup\AppData\Local\Temp\_MEI36042\win32api.pyd

    MOD - [2013/04/29 18:17:08 | 000,044,032 | ---- | M] () -- C:\Users\Russell Allsup\AppData\Local\Temp\_MEI36042\_socket.pyd

    MOD - [2013/04/29 18:17:07 | 001,175,040 | ---- | M] () -- C:\Users\Russell Allsup\AppData\Local\Temp\_MEI36042\wx._core_.pyd

    MOD - [2013/04/29 18:17:07 | 001,153,024 | ---- | M] () -- C:\Users\Russell Allsup\AppData\Local\Temp\_MEI36042\_ssl.pyd

    MOD - [2013/04/29 18:17:07 | 001,022,416 | ---- | M] () -- C:\Users\Russell Allsup\AppData\Local\Temp\_MEI36042\windows._cacheinvalidation.pyd

    MOD - [2013/04/29 18:17:07 | 000,811,008 | ---- | M] () -- C:\Users\Russell Allsup\AppData\Local\Temp\_MEI36042\wx._windows_.pyd

    MOD - [2013/04/29 18:17:07 | 000,805,888 | ---- | M] () -- C:\Users\Russell Allsup\AppData\Local\Temp\_MEI36042\wx._gdi_.pyd

    MOD - [2013/04/29 18:17:07 | 000,735,232 | ---- | M] () -- C:\Users\Russell Allsup\AppData\Local\Temp\_MEI36042\wx._misc_.pyd

    MOD - [2013/04/29 18:17:07 | 000,711,680 | ---- | M] () -- C:\Users\Russell Allsup\AppData\Local\Temp\_MEI36042\_hashlib.pyd

    MOD - [2013/04/29 18:17:07 | 000,557,056 | ---- | M] () -- C:\Users\Russell Allsup\AppData\Local\Temp\_MEI36042\pysqlite2._sqlite.pyd

    MOD - [2013/04/29 18:17:07 | 000,364,544 | ---- | M] () -- C:\Users\Russell Allsup\AppData\Local\Temp\_MEI36042\pythoncom27.dll

    MOD - [2013/04/29 18:17:07 | 000,320,512 | ---- | M] () -- C:\Users\Russell Allsup\AppData\Local\Temp\_MEI36042\win32com.shell.shell.pyd

    MOD - [2013/04/29 18:17:07 | 000,122,368 | ---- | M] () -- C:\Users\Russell Allsup\AppData\Local\Temp\_MEI36042\wx._wizard.pyd

    MOD - [2013/04/29 18:17:07 | 000,119,808 | ---- | M] () -- C:\Users\Russell Allsup\AppData\Local\Temp\_MEI36042\win32file.pyd

    MOD - [2013/04/29 18:17:07 | 000,110,080 | ---- | M] () -- C:\Users\Russell Allsup\AppData\Local\Temp\_MEI36042\PyWinTypes27.dll

    MOD - [2013/04/29 18:17:07 | 000,108,544 | ---- | M] () -- C:\Users\Russell Allsup\AppData\Local\Temp\_MEI36042\win32security.pyd

    MOD - [2013/04/29 18:17:07 | 000,087,040 | ---- | M] () -- C:\Users\Russell Allsup\AppData\Local\Temp\_MEI36042\_ctypes.pyd

    MOD - [2013/04/29 18:17:07 | 000,070,656 | ---- | M] () -- C:\Users\Russell Allsup\AppData\Local\Temp\_MEI36042\wx._html2.pyd

    MOD - [2013/04/29 18:17:07 | 000,035,840 | ---- | M] () -- C:\Users\Russell Allsup\AppData\Local\Temp\_MEI36042\win32process.pyd

    MOD - [2013/04/29 18:17:07 | 000,025,600 | ---- | M] () -- C:\Users\Russell Allsup\AppData\Local\Temp\_MEI36042\win32pdh.pyd

    MOD - [2013/04/29 18:17:07 | 000,022,528 | ---- | M] () -- C:\Users\Russell Allsup\AppData\Local\Temp\_MEI36042\win32ts.pyd

    MOD - [2013/04/29 18:17:07 | 000,017,408 | ---- | M] () -- C:\Users\Russell Allsup\AppData\Local\Temp\_MEI36042\win32profile.pyd

    MOD - [2013/04/29 18:17:07 | 000,011,264 | ---- | M] () -- C:\Users\Russell Allsup\AppData\Local\Temp\_MEI36042\win32crypt.pyd

    MOD - [2013/04/29 18:17:06 | 000,038,912 | ---- | M] () -- C:\Users\Russell Allsup\AppData\Local\Temp\_MEI36042\win32inet.pyd

    MOD - [2013/04/29 18:17:05 | 001,062,400 | ---- | M] () -- C:\Users\Russell Allsup\AppData\Local\Temp\_MEI36042\wx._controls_.pyd

    MOD - [2013/04/29 18:17:05 | 000,686,080 | ---- | M] () -- C:\Users\Russell Allsup\AppData\Local\Temp\_MEI36042\unicodedata.pyd

    MOD - [2013/04/29 18:17:05 | 000,127,488 | ---- | M] () -- C:\Users\Russell Allsup\AppData\Local\Temp\_MEI36042\pyexpat.pyd

    MOD - [2013/04/29 18:17:05 | 000,018,432 | ---- | M] () -- C:\Users\Russell Allsup\AppData\Local\Temp\_MEI36042\win32event.pyd

    MOD - [2013/04/29 18:17:04 | 000,010,240 | ---- | M] () -- C:\Users\Russell Allsup\AppData\Local\Temp\_MEI36042\select.pyd

    MOD - [2013/04/09 01:57:07 | 000,390,096 | ---- | M] () -- C:\Program Files (x86)\Google\Chrome\Application\26.0.1410.64\ppgooglenaclpluginchrome.dll

    MOD - [2013/04/09 01:57:06 | 013,130,704 | ---- | M] () -- C:\Program Files (x86)\Google\Chrome\Application\26.0.1410.64\PepperFlash\pepflashplayer.dll

    MOD - [2013/04/09 01:57:05 | 004,050,896 | ---- | M] () -- C:\Program Files (x86)\Google\Chrome\Application\26.0.1410.64\pdf.dll

    MOD - [2013/04/09 01:56:15 | 000,598,480 | ---- | M] () -- C:\Program Files (x86)\Google\Chrome\Application\26.0.1410.64\libglesv2.dll

    MOD - [2013/04/09 01:56:14 | 000,124,368 | ---- | M] () -- C:\Program Files (x86)\Google\Chrome\Application\26.0.1410.64\libegl.dll

    MOD - [2013/04/09 01:56:13 | 001,606,096 | ---- | M] () -- C:\Program Files (x86)\Google\Chrome\Application\26.0.1410.64\ffmpegsumo.dll

    MOD - [2013/02/13 17:37:37 | 000,221,696 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.ServiceProce#\a392764bc6940a1a59e2bf834d447116\System.ServiceProcess.ni.dll

    MOD - [2013/02/13 17:15:29 | 013,199,360 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Windows.Forms\806c4ba7d696ab586ffd774a31f1a66b\System.Windows.Forms.ni.dll

    MOD - [2013/01/20 11:51:18 | 000,771,584 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Runtime.Remo#\9fe8c27f7d33440089db00fa170f95f9\System.Runtime.Remoting.ni.dll

    MOD - [2013/01/18 09:49:10 | 001,667,584 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Drawing\b83993cc955262507c8ead67567c8060\System.Drawing.ni.dll

    MOD - [2013/01/18 09:47:20 | 009,094,656 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System\df418085cedae9fa2efee87e20a419a4\System.ni.dll

    MOD - [2013/01/18 09:47:13 | 014,413,824 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\60c214b6ad5691e368a16ec65d127c27\mscorlib.ni.dll

    MOD - [2012/08/27 21:33:32 | 000,087,912 | ---- | M] () -- C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll

    MOD - [2012/08/27 21:33:08 | 001,242,512 | ---- | M] () -- C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll

    MOD - [2012/01/05 14:22:36 | 000,465,344 | ---- | M] () -- C:\Program Files (x86)\NTI\Acer Backup Manager\sqlite3.dll

    MOD - [2011/12/23 10:24:00 | 000,119,808 | ---- | M] () -- C:\Program Files (x86)\Intel\Intel® ME FW Recovery Agent\bin\updateui.exe

    MOD - [2011/11/25 13:42:50 | 000,499,976 | ---- | M] () -- C:\Program Files (x86)\Intel\Intel® ME FW Recovery Agent\bin\plugin\PServerPlugin.dll

    MOD - [2011/11/25 13:29:32 | 000,015,872 | ---- | M] () -- C:\Program Files (x86)\Intel\Intel® ME FW Recovery Agent\bin\featureController.dll

    MOD - [2011/11/25 13:28:26 | 000,484,352 | ---- | M] () -- C:\Program Files (x86)\Intel\Intel® ME FW Recovery Agent\bin\DeviceProfile.dll

    MOD - [2011/11/25 13:26:14 | 000,013,824 | ---- | M] () -- C:\Program Files (x86)\Intel\Intel® ME FW Recovery Agent\bin\eventsSender.dll

    MOD - [2011/08/17 16:48:24 | 000,322,048 | ---- | M] () -- C:\Program Files (x86)\Intel\Intel® ME FW Recovery Agent\bin\log4cplus.dll

    MOD - [2011/08/17 16:48:22 | 000,195,584 | ---- | M] () -- C:\Program Files (x86)\Intel\Intel® ME FW Recovery Agent\bin\libgsoap.dll

    MOD - [2011/08/17 16:41:36 | 000,400,384 | ---- | M] () -- C:\Program Files (x86)\Intel\Intel® ME FW Recovery Agent\bin\sqlite3.dll

    MOD - [2011/08/15 20:17:30 | 009,224,704 | ---- | M] () -- C:\Program Files (x86)\Intel\Intel® ME FW Recovery Agent\bin\QtGui4.dll

    MOD - [2011/08/15 20:15:44 | 000,382,464 | ---- | M] () -- C:\Program Files (x86)\Intel\Intel® ME FW Recovery Agent\bin\QtXml4.dll

    MOD - [2011/08/15 20:12:04 | 002,603,520 | ---- | M] () -- C:\Program Files (x86)\Intel\Intel® ME FW Recovery Agent\bin\QtCore4.dll

    MOD - [2011/08/15 20:12:04 | 001,006,592 | ---- | M] () -- C:\Program Files (x86)\Intel\Intel® ME FW Recovery Agent\bin\QtNetwork4.dll

    MOD - [2011/08/15 19:23:00 | 000,062,464 | ---- | M] () -- C:\Program Files (x86)\Intel\Intel® ME FW Recovery Agent\bin\zlib1.dll

    MOD - [2011/07/19 16:05:40 | 014,978,048 | ---- | M] () -- C:\Program Files (x86)\Intel\Intel® ME FW Recovery Agent\bin\QtWebKit4.dll

    MOD - [2011/07/19 16:04:56 | 000,317,952 | ---- | M] () -- C:\Program Files (x86)\Intel\Intel® ME FW Recovery Agent\bin\phonon4.dll

    MOD - [2011/03/17 01:11:16 | 004,297,568 | ---- | M] () -- C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Cultures\OFFICE.ODF

    MOD - [2010/10/20 16:45:26 | 008,801,120 | ---- | M] () -- C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveIntlResource.dll

    ========== Services (SafeList) ==========

    SRV:64bit: - [2012/02/07 17:53:48 | 000,871,296 | ---- | M] (Acer Incorporated) [Auto | Running] -- C:\Program Files\Acer\Acer ePower Management\ePowerSvc.exe -- (ePowerSvc)

    SRV:64bit: - [2012/02/06 17:54:04 | 000,255,376 | ---- | M] (Acer Incorporated) [Auto | Stopped] -- C:\Program Files\Acer\Acer Updater\UpdaterService.exe -- (Live Updater Service)

    SRV:64bit: - [2012/02/02 22:29:52 | 000,628,448 | ---- | M] (Intel® Corporation) [Auto | Running] -- C:\Program Files\Intel\iCLS Client\HeciServer.exe -- (Intel®

    SRV:64bit: - [2010/09/22 18:10:10 | 000,057,184 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Program Files\Windows Live\Mesh\wlcrasvc.exe -- (wlcrasvc)

    SRV:64bit: - [2009/07/13 18:41:27 | 001,011,712 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)

    SRV - [2013/04/11 22:54:39 | 000,115,608 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)

    SRV - [2013/03/13 00:58:22 | 000,253,656 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)

    SRV - [2012/12/18 07:28:08 | 000,065,192 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice)

    SRV - [2012/11/09 12:21:24 | 000,160,944 | R--- | M] (Skype Technologies) [Auto | Stopped] -- C:\Program Files (x86)\Skype\Updater\Updater.exe -- (SkypeUpdate)

    SRV - [2012/08/14 01:00:00 | 000,022,376 | ---- | M] (Sage) [Auto | Running] -- C:\Program Files (x86)\winsim\ConnectionManager\SimplyConnectionManager.exe -- (Simply Accounting Database Connection Manager)

    SRV - [2012/06/04 13:26:14 | 000,655,624 | ---- | M] (Acresso Software Inc.) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe -- (FLEXnet Licensing Service)

    SRV - [2012/04/22 06:25:32 | 000,276,248 | ---- | M] (Intel Corporation) [On_Demand | Stopped] -- C:\Windows\SysWOW64\IntelCpHeciSvc.exe -- (cphs)

    SRV - [2012/03/23 02:33:46 | 000,355,920 | ---- | M] (Dritek System Inc.) [Auto | Running] -- C:\Program Files (x86)\Launch Manager\dsiwmis.exe -- (DsiWMIService)

    SRV - [2012/02/29 06:49:06 | 000,028,264 | ---- | M] (Acer Incorporated) [Auto | Running] -- C:\Program Files (x86)\Acer\Registration\GREGsvc.exe -- (GREGService)

    SRV - [2012/02/07 03:03:36 | 000,363,800 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe -- (UNS)

    SRV - [2012/02/07 03:03:34 | 000,277,784 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe -- (LMS)

    SRV - [2012/02/07 03:03:28 | 000,128,280 | ---- | M] () [Auto | Running] -- C:\Program Files (x86)\Intel\Intel® Management Engine Components\FWService\IntelMeFWService.exe -- (Intel®

    SRV - [2012/02/07 03:03:16 | 000,161,560 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files (x86)\Intel\Intel® Management Engine Components\DAL\Jhi_service.exe -- (jhi_service)

    SRV - [2012/01/18 04:37:32 | 000,072,864 | ---- | M] (Atheros) [Auto | Running] -- C:\Program Files (x86)\Atheros\Ath_WlanAgent.exe -- (ZAtheros Wlan Agent)

    SRV - [2012/01/05 14:22:10 | 000,256,536 | ---- | M] (NTI Corporation) [Auto | Running] -- C:\Program Files (x86)\NTI\Acer Backup Manager\IScheduleSvc.exe -- (NTI IScheduleSvc)

    SRV - [2011/11/29 20:04:56 | 000,013,592 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe -- (IAStorDataMgrSvc)

    SRV - [2011/06/21 12:55:04 | 000,173,424 | ---- | M] (Egis Technology Inc. ) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\EgisTec\Services\EgisTicketService.exe -- (EgisTec Ticket Service)

    SRV - [2010/06/01 15:31:28 | 002,804,568 | ---- | M] (Symantec Corporation) [Auto | Running] -- C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe -- (NOBU)

    SRV - [2010/03/18 13:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)

    SRV - [2009/06/10 14:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)

    ========== Driver Services (SafeList) ==========

    DRV:64bit: - [2013/02/18 23:53:09 | 000,039,768 | ---- | M] (AVG Technologies) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\avgtpx64.sys -- (avgtp)

    DRV:64bit: - [2013/01/29 18:15:04 | 000,050,800 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\point64.sys -- (Point64)

    DRV:64bit: - [2012/12/09 02:51:20 | 000,126,944 | ---- | M] (Power Software Ltd) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\scdemu.sys -- (SCDEmu)

    DRV:64bit: - [2012/08/21 13:01:20 | 000,033,240 | ---- | M] (GEAR Software Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\GEARAspiWDM.sys -- (GEARAspiWDM)

    DRV:64bit: - [2012/07/09 13:42:54 | 000,052,736 | ---- | M] (Apple, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\usbaapl64.sys -- (USBAAPL64)

    DRV:64bit: - [2012/05/14 02:38:23 | 000,062,776 | ---- | M] (Egis Technology Inc.) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\mwlPSDVDisk.sys -- (mwlPSDVDisk)

    DRV:64bit: - [2012/05/14 02:38:23 | 000,022,648 | ---- | M] (Egis Technology Inc.) [File_System | System | Running] -- C:\Windows\SysNative\drivers\mwlPSDFilter.sys -- (mwlPSDFilter)

    DRV:64bit: - [2012/05/14 02:38:23 | 000,020,520 | ---- | M] (Egis Technology Inc.) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\mwlPSDNserv.sys -- (mwlPSDNServ)

    DRV:64bit: - [2012/03/26 04:09:54 | 014,748,416 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\igdkmd64.sys -- (igfx)

    DRV:64bit: - [2012/03/16 06:02:54 | 000,685,672 | ---- | M] (Realtek ) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Rt64win7.sys -- (RTL8167)

    DRV:64bit: - [2012/02/29 23:46:16 | 000,023,408 | ---- | M] (Microsoft Corporation) [Recognizer | Boot | Unknown] -- C:\Windows\SysNative\drivers\fs_rec.sys -- (Fs_Rec)

    DRV:64bit: - [2012/02/13 21:33:08 | 000,412,944 | ---- | M] (Synaptics Incorporated) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\SynTP.sys -- (SynTP)

    DRV:64bit: - [2012/02/13 21:33:02 | 000,022,800 | ---- | M] (Synaptics Incorporated) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Smb_driver.sys -- (SmbDrv)

    DRV:64bit: - [2012/02/06 23:03:06 | 000,018,432 | ---- | M] (NTI Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\NTIDrvr.sys -- (NTIDrvr)

    DRV:64bit: - [2012/02/06 23:03:06 | 000,017,408 | ---- | M] (NTI Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\UBHelper.sys -- (UBHelper)

    DRV:64bit: - [2012/02/01 02:06:18 | 000,292,968 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\RtsBaStor.sys -- (RSBASTOR)

    DRV:64bit: - [2012/01/20 00:31:14 | 002,801,664 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\athrx.sys -- (athr)

    DRV:64bit: - [2011/12/05 13:23:08 | 000,331,264 | ---- | M] (Intel® Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\IntcDAud.sys -- (IntcDAud)

    DRV:64bit: - [2011/11/29 19:40:32 | 000,568,600 | ---- | M] (Intel Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\iaStor.sys -- (iaStor)

    DRV:64bit: - [2011/11/09 10:04:14 | 000,060,184 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\HECIx64.sys -- (MEIx64)

    DRV:64bit: - [2011/07/13 22:35:47 | 000,107,904 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata)

    DRV:64bit: - [2011/07/13 22:35:47 | 000,027,008 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata)

    DRV:64bit: - [2011/01/15 09:21:04 | 000,036,352 | ---- | M] (Elaborate Bytes AG) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\VClone.sys -- (VClone)

    DRV:64bit: - [2010/11/20 20:24:33 | 000,059,392 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbFlt.sys -- (TsUsbFlt)

    DRV:64bit: - [2010/11/20 20:23:47 | 000,078,720 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD)

    DRV:64bit: - [2010/11/20 20:23:47 | 000,031,232 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbGD.sys -- (TsUsbGD)

    DRV:64bit: - [2009/07/13 18:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs)

    DRV:64bit: - [2009/07/13 18:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2)

    DRV:64bit: - [2009/07/13 18:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor)

    DRV:64bit: - [2009/06/10 13:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv)

    DRV:64bit: - [2009/06/10 13:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv)

    DRV:64bit: - [2009/06/10 13:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a)

    DRV:64bit: - [2009/06/10 13:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir)

    DRV - [2009/07/13 18:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount)

    ========== Standard Registry (SafeList) ==========

    ========== Internet Explorer ==========

    IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://acer.msn.com

    IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com

    IE:64bit: - HKLM\..\SearchScopes,DefaultScope =

    IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&form=AARTDF&pc=MAAR&src=IE-SearchBox

    IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://acer.msn.com

    IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm

    IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com

    IE - HKLM\..\SearchScopes,DefaultScope =

    IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&form=AARTDF&pc=MAAR&src=IE-SearchBox

    IE - HKU\.DEFAULT\..\SearchScopes,DefaultScope =

    IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

    IE - HKU\S-1-5-18\..\SearchScopes,DefaultScope =

    IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

    IE - HKU\S-1-5-19\..\SearchScopes,DefaultScope =

    IE - HKU\S-1-5-20\..\SearchScopes,DefaultScope =

    IE - HKU\S-1-5-21-3013127783-3903512391-2632275378-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://acer.msn.com

    IE - HKU\S-1-5-21-3013127783-3903512391-2632275378-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = https://www.google.ca/

    IE - HKU\S-1-5-21-3013127783-3903512391-2632275378-1001\..\SearchScopes,DefaultScope =

    IE - HKU\S-1-5-21-3013127783-3903512391-2632275378-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

    IE - HKU\S-1-5-21-3013127783-3903512391-2632275378-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

    ========== FireFox ==========

    FF - prefs.js..browser.search.selectedEngine: "Google"

    FF - prefs.js..browser.startup.homepage: "https://www.google.ca/"

    FF - prefs.js..extensions.enabledAddons: %7B972ce4c6-7e08-4474-a285-3208198ce6fd%7D:20.0.1

    FF - user.js - File not found

    FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_6_602_180.dll File not found

    FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found

    FF:64bit: - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\5.1.20125.0\npctrl.dll ( Microsoft Corporation)

    FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)

    FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_6_602_180.dll ()

    FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found

    FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()

    FF - HKLM\Software\MozillaPlugins\@intel-webapi.intel.com/Intel WebAPI ipt;version=2.0.59: C:\Program Files (x86)\Intel\Intel® Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation)

    FF - HKLM\Software\MozillaPlugins\@intel-webapi.intel.com/Intel WebAPI updater: C:\Program Files (x86)\Intel\Intel® Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)

    FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.11.2: C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)

    FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.11.2: C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)

    FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found

    FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files (x86)\Microsoft Silverlight\5.1.20125.0\npctrl.dll ( Microsoft Corporation)

    FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~2\MICROS~4\Office14\NPAUTHZ.DLL (Microsoft Corporation)

    FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\PROGRA~2\MICROS~4\Office14\NPSPWRAP.DLL (Microsoft Corporation)

    FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)

    FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3538.0513: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)

    FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.21.135\npGoogleUpdate3.dll (Google Inc.)

    FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.21.135\npGoogleUpdate3.dll (Google Inc.)

    FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

    FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{D19CA586-DD6C-4a0a-96F8-14644F340D60}: C:\Program Files (x86)\Common Files\McAfee\SystemCore

    FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 20.0.1\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2013/04/11 22:54:39 | 000,000,000 | ---D | M]

    FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 20.0.1\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins

    FF - HKEY_LOCAL_MACHINE\software\mozilla\Thunderbird\Extensions\\msktbird@mcafee.com: C:\Program Files\McAfee\MSK

    FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 20.0.1\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2013/04/11 22:54:39 | 000,000,000 | ---D | M]

    FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 20.0.1\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins

    [2013/01/13 20:57:25 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Russell Allsup\AppData\Roaming\Mozilla\Extensions

    [2013/04/29 17:38:05 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Russell Allsup\AppData\Roaming\Mozilla\Firefox\Profiles\d3p9l5pa.default\extensions

    [2013/04/11 22:54:35 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\Mozilla Firefox\extensions

    [2013/04/11 22:54:39 | 000,263,064 | ---- | M] (Mozilla Foundation) -- C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll

    [2013/01/04 20:45:12 | 000,002,465 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml

    [2013/02/19 17:49:52 | 000,002,086 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\twitter.xml

    ========== Chrome ==========

    CHR - default_search_provider: Google (Enabled)

    CHR - default_search_provider: search_url = {google:baseURL}search?q={searchTerms}&{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}{google:assistedQueryStats}{google:searchFieldtrialParameter}{google:searchClient}{google:sourceId}{google:instantExtendedEnabledParameter}ie={inputEncoding}

    CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client=chrome&q={searchTerms}&{google:cursorPosition}sugkey={google:suggestAPIKeyParameter},

    CHR - homepage: http://www.igoogle.ca/

    CHR - plugin: Shockwave Flash (Enabled) = C:\Program Files (x86)\Google\Chrome\Application\26.0.1410.64\PepperFlash\pepflashplayer.dll

    CHR - plugin: Chrome Remote Desktop Viewer (Enabled) = internal-remoting-viewer

    CHR - plugin: Native Client (Enabled) = C:\Program Files (x86)\Google\Chrome\Application\26.0.1410.64\ppGoogleNaClPluginChrome.dll

    CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Program Files (x86)\Google\Chrome\Application\26.0.1410.64\pdf.dll

    CHR - plugin: Adobe Acrobat (Enabled) = C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll

    CHR - plugin: Microsoft Office 2010 (Enabled) = C:\PROGRA~2\MICROS~4\Office14\NPAUTHZ.DLL

    CHR - plugin: Microsoft Office 2010 (Enabled) = C:\PROGRA~2\MICROS~4\Office14\NPSPWRAP.DLL

    CHR - plugin: Google Update (Enabled) = C:\Program Files (x86)\Google\Update\1.3.21.135\npGoogleUpdate3.dll

    CHR - plugin: Intel\u00AE Identity Protection Technology (Enabled) = C:\Program Files (x86)\Intel\Intel® Management Engine Components\IPT\npIntelWebAPIIPT.dll

    CHR - plugin: Intel\u00AE Identity Protection Technology (Enabled) = C:\Program Files (x86)\Intel\Intel® Management Engine Components\IPT\npIntelWebAPIUpdater.dll

    CHR - plugin: Java Platform SE 7 U11 (Enabled) = C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll

    CHR - plugin: Windows Live\u0099 Photo Gallery (Enabled) = C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll

    CHR - plugin: iTunes Application Detector (Enabled) = C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll

    CHR - plugin: Shockwave Flash (Enabled) = C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_6_602_180.dll

    CHR - plugin: Java Deployment Toolkit 7.0.110.21 (Enabled) = C:\Windows\SysWOW64\npDeployJava1.dll

    CHR - plugin: Silverlight Plug-In (Enabled) = c:\Program Files (x86)\Microsoft Silverlight\5.1.20125.0\npctrl.dll

    O1 HOSTS File: ([2009/06/10 14:00:26 | 000,000,824 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts

    O2:64bit: - BHO: (scriptproxy) - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\Common Files\McAfee\SystemCore\ScriptSn.20120920231924.dll File not found

    O2 - BHO: (Java Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)

    O2 - BHO: (scriptproxy) - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files (x86)\Common Files\McAfee\SystemCore\ScriptSn.20120920231924.dll File not found

    O2 - BHO: (Java Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)

    O3:64bit: - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.

    O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.

    O4:64bit: - HKLM..\Run: [HotKeysCmds] C:\Windows\SysNative\hkcmd.exe (Intel Corporation)

    O4:64bit: - HKLM..\Run: [igfxTray] C:\Windows\SysNative\igfxtray.exe (Intel Corporation)

    O4:64bit: - HKLM..\Run: [Persistence] C:\Windows\SysNative\igfxpers.exe (Intel Corporation)

    O4:64bit: - HKLM..\Run: [Power Management] C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe (Acer Incorporated)

    O4:64bit: - HKLM..\Run: [RTHDVCPL] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Realtek Semiconductor)

    O4 - HKLM..\Run: [] File not found

    O4 - HKLM..\Run: [APSDaemon] C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)

    O4 - HKLM..\Run: [backupManagerTray] C:\Program Files (x86)\NTI\Acer Backup Manager\BackupManagerTray.exe (NTI Corporation)

    O4 - HKLM..\Run: [ConnectionManager] C:\Program Files (x86)\winsim\ConnectionManager\Simply.SystemTrayIcon.exe (Sage)

    O4 - HKLM..\Run: [LManager] C:\Program Files (x86)\Launch Manager\LManager.exe (Dritek System Inc.)

    O4 - HKLM..\Run: [Norton Online Backup] C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuClient.exe (Symantec Corporation)

    O4 - HKLM..\Run: [PWRISOVM.EXE] C:\Program Files (x86)\PowerISO\PWRISOVM.EXE (Power Software Ltd)

    O4 - HKLM..\Run: [suiteTray] C:\Program Files (x86)\EgisTec MyWinLockerSuite\x86\SuiteTray.exe (Egis Technology Inc.)

    O4 - HKU\S-1-5-19..\Run: [sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)

    O4 - HKU\S-1-5-20..\Run: [sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)

    O4 - HKU\S-1-5-21-3013127783-3903512391-2632275378-1001..\Run: [GoogleDriveSync] C:\Program Files (x86)\Google\Drive\googledrivesync.exe (Google)

    O4 - HKLM..\RunOnce: [Malwarebytes Anti-Malware] C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)

    O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found

    O4 - HKU\S-1-5-20..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found

    O4 - Startup: C:\Users\Russell Allsup\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2010 Screen Clipper and Launcher.lnk = File not found

    O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1

    O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1

    O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoControlPanel = 0

    O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5

    O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3

    O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0

    O8:64bit: - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~2\MICROS~4\Office14\EXCEL.EXE/3000 File not found

    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~2\MICROS~4\Office14\EXCEL.EXE/3000 File not found

    O9 - Extra Button: @C:\Program Files (x86)\Evernote\Evernote\Resource.dll,-101 - {A95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\Program Files (x86)\Evernote\Evernote\EvernoteIE.dll (Evernote Corp., 333 W Evelyn Ave. Mountain View, CA 94041)

    O9 - Extra 'Tools' menuitem : @C:\Program Files (x86)\Evernote\Evernote\Resource.dll,-101 - {A95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\Program Files (x86)\Evernote\Evernote\EvernoteIE.dll (Evernote Corp., 333 W Evelyn Ave. Mountain View, CA 94041)

    O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000009 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)

    O10 - NameSpace_Catalog5\Catalog_Entries\000000000009 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)

    O1364bit: - gopher Prefix: missing

    O13 - gopher Prefix: missing

    O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 64.59.144.93 64.59.150.139

    O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{8B9FF3CB-5252-4DA4-AD05-E5DD0C4DCD41}: DhcpNameServer = 40.31.1.201 40.31.1.202

    O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{EC1FE264-712B-4417-9DE8-4F8BA78CEFFA}: DhcpNameServer = 64.59.144.93 64.59.150.139

    O18:64bit: - Protocol\Handler\livecall - No CLSID value found

    O18:64bit: - Protocol\Handler\msnim - No CLSID value found

    O18:64bit: - Protocol\Handler\skype4com - No CLSID value found

    O18:64bit: - Protocol\Handler\wlmailhtml - No CLSID value found

    O18:64bit: - Protocol\Handler\wlpg - No CLSID value found

    O18 - Protocol\Handler\ms-help - No CLSID value found

    O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)

    O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)

    O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)

    O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)

    O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\SysWow64\userinit.exe (Microsoft Corporation)

    O20:64bit: - Winlogon\Notify\igfxcui: DllName - (igfxdev.dll) - C:\Windows\SysNative\igfxdev.dll (Intel Corporation)

    O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.

    O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.

    O32 - HKLM CDRom: AutoRun - 1

    O34 - HKLM BootExecute: (autocheck autochk *)

    O35:64bit: - HKLM\..comfile [open] -- "%1" %*

    O35:64bit: - HKLM\..exefile [open] -- "%1" %*

    O35 - HKLM\..comfile [open] -- "%1" %*

    O35 - HKLM\..exefile [open] -- "%1" %*

    O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*

    O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*

    O37 - HKLM\...com [@ = comfile] -- "%1" %*

    O37 - HKLM\...exe [@ = exefile] -- "%1" %*

    O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)

    O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)

    O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)

    ========== Files/Folders - Created Within 30 Days ==========

    [2013/04/29 18:45:32 | 000,000,000 | ---D | C] -- C:\Windows\ERUNT

    [2013/04/29 18:42:10 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware

    [2013/04/29 18:42:08 | 000,025,928 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys

    [2013/04/29 18:42:08 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware

    [2013/04/29 18:11:12 | 000,000,000 | ---D | C] -- C:\JRT

    [2013/04/29 15:58:04 | 000,000,000 | ---D | C] -- C:\Users\Russell Allsup\Desktop\RK_Quarantine

    [2013/04/29 15:35:42 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome

    [2013/04/18 19:47:47 | 000,000,000 | ---D | C] -- C:\Users\Russell Allsup\Desktop\Beatriz Files

    [2013/04/18 19:12:44 | 000,000,000 | ---D | C] -- C:\Users\Russell Allsup\Desktop\Access 2010 (x86 and x64) - DVD (English)

    [2013/04/16 00:32:00 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Mouse and Keyboard Center

    [2013/04/16 00:31:30 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft Mouse and Keyboard Center

    [2013/04/11 22:54:35 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Mozilla Firefox

    [2013/03/31 12:49:29 | 000,000,000 | ---D | C] -- C:\Users\Russell Allsup\Documents\My Weblog Posts

    ========== Files - Modified Within 30 Days ==========

    [2013/04/29 19:58:00 | 000,000,830 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job

    [2013/04/29 19:53:08 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat

    [2013/04/29 19:16:00 | 000,000,914 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job

    [2013/04/29 19:09:00 | 000,000,830 | ---- | M] () -- C:\Windows\tasks\ISM-UpdateService-4e00205a-2ab1-4423-8f77-cc25b82cde1d.job

    [2013/04/29 18:42:10 | 000,001,101 | ---- | M] () -- C:\Users\Russell Allsup\Application Data\Microsoft\Internet Explorer\Quick Launch\Malwarebytes Anti-Malware.lnk

    [2013/04/29 18:42:10 | 000,001,077 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

    [2013/04/29 18:23:12 | 000,016,976 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

    [2013/04/29 18:23:12 | 000,016,976 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

    [2013/04/29 18:16:12 | 000,000,910 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job

    [2013/04/29 18:16:12 | 000,000,828 | ---- | M] () -- C:\Windows\tasks\ISM-UpdateService-4e00205a-2ab1-4423-8f77-cc25b82cde1d-Logon.job

    [2013/04/29 18:15:43 | 408,178,687 | -HS- | M] () -- C:\hiberfil.sys

    [2013/04/29 17:39:40 | 000,002,247 | ---- | M] () -- C:\Users\Russell Allsup\Application Data\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk

    [2013/04/29 15:35:42 | 000,002,223 | ---- | M] () -- C:\Users\Public\Desktop\Google Chrome.lnk

    [2013/04/17 13:16:20 | 000,431,928 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT

    [2013/04/16 13:10:51 | 000,001,270 | ---- | M] () -- C:\Users\Russell Allsup\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2010 Screen Clipper and Launcher.lnk

    [2013/04/16 00:32:00 | 000,000,000 | -H-- | M] () -- C:\Windows\SysNative\drivers\Msft_Kernel_point64_01011.Wdf

    [2013/04/11 14:51:19 | 000,778,834 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI

    [2013/04/11 14:51:19 | 000,664,780 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat

    [2013/04/11 14:51:19 | 000,125,484 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat

    [2013/04/04 14:50:32 | 000,025,928 | ---- | M] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys

    ========== Files Created - No Company Name ==========

    [2013/04/29 18:42:10 | 000,001,101 | ---- | C] () -- C:\Users\Russell Allsup\Application Data\Microsoft\Internet Explorer\Quick Launch\Malwarebytes Anti-Malware.lnk

    [2013/04/29 18:42:10 | 000,001,077 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

    [2013/04/29 15:35:42 | 000,002,247 | ---- | C] () -- C:\Users\Russell Allsup\Application Data\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk

    [2013/04/29 15:35:42 | 000,002,223 | ---- | C] () -- C:\Users\Public\Desktop\Google Chrome.lnk

    [2013/04/16 00:32:00 | 000,000,000 | -H-- | C] () -- C:\Windows\SysNative\drivers\Msft_Kernel_point64_01011.Wdf

    [2013/01/24 14:18:45 | 000,001,025 | ---- | C] () -- C:\Windows\SysWow64\sysprs7.dll

    [2013/01/24 14:18:44 | 000,000,205 | ---- | C] () -- C:\Windows\SysWow64\lsprst7.dll

    [2013/01/24 14:00:04 | 000,000,051 | ---- | C] () -- C:\Users\Russell Allsup\dlmgr_.pro

    [2013/01/16 22:10:07 | 000,002,131 | ---- | C] () -- C:\Windows\ODBC.INI

    [2013/01/16 21:40:53 | 000,000,248 | ---- | C] () -- C:\Windows\ODBCINST.INI

    [2012/09/19 20:14:36 | 000,764,378 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI

    [2012/05/14 03:04:52 | 000,963,912 | ---- | C] () -- C:\Windows\SysWow64\igkrng600.bin

    [2012/05/14 03:04:48 | 000,261,208 | ---- | C] () -- C:\Windows\SysWow64\igfcg600m.bin

    [2012/05/14 03:04:45 | 000,058,880 | ---- | C] () -- C:\Windows\SysWow64\igdde32.dll

    [2012/05/14 03:04:44 | 013,212,672 | ---- | C] () -- C:\Windows\SysWow64\ig4icd32.dll

    [2012/05/14 03:04:44 | 000,145,804 | ---- | C] () -- C:\Windows\SysWow64\igcompkrng600.bin

    [2012/02/02 22:08:26 | 000,001,536 | ---- | C] () -- C:\Windows\SysWow64\IusEventLog.dll

    [2002/06/04 09:59:58 | 000,204,800 | ---- | C] () -- C:\Users\Russell Allsup\Restoration.exe

    [2002/03/31 05:35:56 | 000,006,144 | ---- | C] () -- C:\Users\Russell Allsup\DLL16.DLL

    [2002/03/21 10:20:38 | 000,204,849 | ---- | C] () -- C:\Users\Russell Allsup\DLL32.DLL

    ========== ZeroAccess Check ==========

    [2009/07/13 21:55:00 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini

    [HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64

    [HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

    [HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] /64

    [HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]

    [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64

    "" = C:\Windows\SysNative\shell32.dll -- [2012/06/08 22:43:10 | 014,172,672 | ---- | M] (Microsoft Corporation)

    "ThreadingModel" = Apartment

    [HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

    "" = %SystemRoot%\system32\shell32.dll -- [2012/06/08 21:41:00 | 012,873,728 | ---- | M] (Microsoft Corporation)

    "ThreadingModel" = Apartment

    [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] /64

    "" = C:\Windows\SysNative\wbem\fastprox.dll -- [2009/07/13 18:40:51 | 000,909,312 | ---- | M] (Microsoft Corporation)

    "ThreadingModel" = Free

    [HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]

    "" = %systemroot%\system32\wbem\fastprox.dll -- [2010/11/20 20:24:25 | 000,606,208 | ---- | M] (Microsoft Corporation)

    "ThreadingModel" = Free

    [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] /64

    "" = C:\Windows\SysNative\wbem\wbemess.dll -- [2009/07/13 18:41:56 | 000,505,856 | ---- | M] (Microsoft Corporation)

    "ThreadingModel" = Both

    [HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]

    ========== LOP Check ==========

    [2013/01/25 00:08:27 | 000,000,000 | ---D | M] -- C:\Users\Russell Allsup\AppData\Roaming\Azureus

    [2013/02/01 20:45:13 | 000,000,000 | ---D | M] -- C:\Users\Russell Allsup\AppData\Roaming\e-academy Inc

    [2013/01/25 01:01:22 | 000,000,000 | ---D | M] -- C:\Users\Russell Allsup\AppData\Roaming\PowerISO

    [2012/09/19 19:18:59 | 000,000,000 | ---D | M] -- C:\Users\Russell Allsup\AppData\Roaming\Screensaver

    [2012/10/25 15:47:12 | 000,000,000 | ---D | M] -- C:\Users\Russell Allsup\AppData\Roaming\SoftGrid Client

    [2013/01/24 14:23:43 | 000,000,000 | ---D | M] -- C:\Users\Russell Allsup\AppData\Roaming\SPSSInc

    [2012/09/19 20:15:25 | 000,000,000 | ---D | M] -- C:\Users\Russell Allsup\AppData\Roaming\TP

    [2012/09/19 21:21:57 | 000,000,000 | ---D | M] -- C:\Users\Russell Allsup\AppData\Roaming\WildTangent

    [2012/10/27 12:29:16 | 000,000,000 | ---D | M] -- C:\Users\Russell Allsup\AppData\Roaming\Windows Live Writer

    [2012/09/23 15:04:17 | 000,000,000 | ---D | M] -- C:\Users\Russell Allsup\AppData\Roaming\WindSolutions

    ========== Purity Check ==========

    < End of report >

    The Extras

    OTL Extras logfile created on: 29/04/2013 7:55:31 PM - Run 1

    OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\Russell Allsup\Downloads

    64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation

    Internet Explorer (Version = 9.0.8112.16421)

    Locale: 00001009 | Country: Canada | Language: ENC | Date Format: dd/MM/yyyy

    5.84 Gb Total Physical Memory | 3.85 Gb Available Physical Memory | 65.84% Memory free

    11.68 Gb Paging File | 9.49 Gb Available in Paging File | 81.28% Paging File free

    Paging file location(s): ?:\pagefile.sys [binary data]

    %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)

    Drive C: | 449.66 Gb Total Space | 368.25 Gb Free Space | 81.90% Space Free | Partition Type: NTFS

    Computer Name: RussellAllsup | User Name: Russell Allsup | Logged in as Administrator.

    Boot Mode: Normal | Scan Mode: All users | Quick Scan | Include 64bit Scans

    Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

    ========== Extra Registry (SafeList) ==========

    ========== File Associations ==========

    64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]

    .url[@ = InternetShortcut] -- C:\Windows\SysNative\rundll32.exe (Microsoft Corporation)

    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]

    .cpl [@ = cplfile] -- C:\Windows\SysWow64\control.exe (Microsoft Corporation)

    [HKEY_USERS\S-1-5-21-3013127783-3903512391-2632275378-1001\SOFTWARE\Classes\<extension>]

    .html [@ = ChromeHTML] -- Reg Error: Key error. File not found

    ========== Shell Spawning ==========

    64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]

    batfile [open] -- "%1" %*

    cmdfile [open] -- "%1" %*

    comfile [open] -- "%1" %*

    exefile [open] -- "%1" %*

    helpfile [open] -- Reg Error: Key error.

    inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)

    InternetShortcut [open] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l (Microsoft Corporation)

    InternetShortcut [print] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)

    piffile [open] -- "%1" %*

    regfile [merge] -- Reg Error: Key error.

    scrfile [config] -- "%1"

    scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l

    scrfile [open] -- "%1" /S

    txtfile [edit] -- Reg Error: Key error.

    Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1

    Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)

    Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

    Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

    Folder [explore] -- Reg Error: Value error.

    Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]

    batfile [open] -- "%1" %*

    cmdfile [open] -- "%1" %*

    comfile [open] -- "%1" %*

    cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)

    exefile [open] -- "%1" %*

    helpfile [open] -- Reg Error: Key error.

    inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)

    piffile [open] -- "%1" %*

    regfile [merge] -- Reg Error: Key error.

    scrfile [config] -- "%1"

    scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l

    scrfile [open] -- "%1" /S

    txtfile [edit] -- Reg Error: Key error.

    Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1

    Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)

    Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

    Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

    Folder [explore] -- Reg Error: Value error.

    Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

    ========== Security Center Settings ==========

    64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]

    "cval" = 1

    64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

    64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]

    "VistaSp1" = 28 4D B2 76 41 04 CA 01 [binary data]

    "AntiVirusOverride" = 0

    "AntiSpywareOverride" = 0

    "FirewallOverride" = 0

    64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]

    ========== Firewall Settings ==========

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]

    "EnableFirewall" = 1

    "DisableNotifications" = 0

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]

    "EnableFirewall" = 1

    "DisableNotifications" = 0

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]

    "EnableFirewall" = 1

    "DisableNotifications" = 0

    ========== Authorized Applications List ==========

    ========== Vista Active Open Ports Exception List ==========

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]

    "{044AA66A-C8A5-400B-B3FA-12EFD03D71C3}" = lport=10243 | protocol=6 | dir=in | app=system |

    "{0C4F89F6-C26A-4286-9D1A-7613E0E61A0E}" = lport=1900 | protocol=17 | dir=in | name=windows live communications platform (ssdp) |

    "{134BA209-4DD9-4668-8F39-05DD1442159D}" = rport=138 | protocol=17 | dir=out | app=system |

    "{19BE819B-74F5-4450-AC25-AA461AF7628C}" = lport=138 | protocol=17 | dir=in | app=system |

    "{1BDD489F-65AA-4005-ACF7-F96F47B18B67}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |

    "{2F5321FE-65B4-4206-A190-FED41FE9BADC}" = lport=445 | protocol=6 | dir=in | app=system |

    "{31F856D5-3522-429C-A7F9-593192A471DF}" = lport=6004 | protocol=17 | dir=in | app=c:\program files\microsoft office\office14\outlook.exe |

    "{361EF682-83B1-4544-9723-0DA148968048}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe |

    "{40C0A195-DD15-45E5-96D2-3E488E07E893}" = lport=2869 | protocol=6 | dir=in | name=windows live communications platform (upnp) |

    "{464E6B9F-FD0E-418C-AB73-A0DFF45E5957}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |

    "{4B434228-E518-4749-BACD-43960FD0CB5A}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |

    "{4FD16A37-44CB-49CD-922D-71BCA43C924E}" = lport=2869 | protocol=6 | dir=in | app=system |

    "{552CC157-FCF8-4D37-A6AD-1E7E2CE53768}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe |

    "{5C22BFCA-B5C8-4896-A656-AC69954754F1}" = rport=139 | protocol=6 | dir=out | app=system |

    "{5CE5F8A1-17A1-48D6-8592-5C954581AEA1}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |

    "{70F23507-E377-4FB1-BC64-E2CC2492C947}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 |

    "{75D07652-8F8C-4FB0-A25A-CC27DFCCA2F5}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |

    "{89F81078-CCC7-4773-8967-5B3157249C41}" = rport=10243 | protocol=6 | dir=out | app=system |

    "{96D111C7-6B8E-43AF-BC62-EB04DB2DBFA9}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |

    "{A000E140-3BA7-4724-BBC5-50B8ACA691F1}" = rport=445 | protocol=6 | dir=out | app=system |

    "{C6AC4A29-C80A-413F-A448-0B90C9B89DFE}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe |

    "{C95B94BD-44F4-4A6E-B2A7-636DFB5C3C4D}" = rport=137 | protocol=17 | dir=out | app=system |

    "{EB00F2A3-C7F7-42E8-9B86-A3DDEAD53BBE}" = lport=137 | protocol=17 | dir=in | app=system |

    "{ED8F914D-B168-4E75-AEAB-CA32C7312A55}" = lport=139 | protocol=6 | dir=in | app=system |

    ========== Vista Active Application Exception List ==========

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]

    "{04C1C5FC-E325-40E1-BF05-438481226323}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |

    "{0579EB36-BAB5-45A1-942F-3DBC67AE8E32}" = protocol=17 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |

    "{092217F5-38C2-483A-97B6-BD84730211DE}" = dir=in | app=c:\program files (x86)\windows live\contacts\wlcomm.exe |

    "{0AFA87D3-B957-49A3-A354-0F352A440BDD}" = protocol=17 | dir=in | app=c:\program files (x86)\acer\clear.fi photo\dmcdaemon.exe |

    "{0EA59961-7C1E-433E-B13E-76B658B88A3B}" = protocol=17 | dir=in | app=c:\program files\common files\mcafee\mcsvchost\mcsvhost.exe |

    "{21FCB1D0-9F48-4EC1-AB18-847FC9B3F695}" = protocol=6 | dir=in | app=c:\program files\microsoft office\office14\onenote.exe |

    "{2ADCFEF2-2135-43A1-AF6B-4035F74DF098}" = protocol=6 | dir=in | app=c:\program files (x86)\acer\clear.fi photo\dmcdaemon.exe |

    "{33770F4E-77E8-4D88-B860-87F82F920709}" = protocol=17 | dir=in | app=c:\program files (x86)\bonjour\mdnsresponder.exe |

    "{33A8967F-F27B-42A8-8A9D-C3A1FDE738BA}" = dir=in | app=c:\program files (x86)\windows live\messenger\msnmsgr.exe |

    "{3A2BE8DC-CA60-4A30-813C-D9B59EF12238}" = protocol=6 | dir=out | app=system |

    "{3E692617-1D2E-48ED-8AE6-DA5A87EBA026}" = dir=in | app=c:\program files (x86)\windows live\mesh\moe.exe |

    "{3F923039-8387-41D6-82E8-4FC965EFA640}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |

    "{3FB63C77-678C-4C62-B7D6-A0474968A180}" = protocol=17 | dir=in | app=%programfiles(x86)%\windows media player\wmplayer.exe |

    "{4DEA150E-65DA-48A4-AA5E-80490A58BEC8}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 |

    "{61C24F00-0127-465F-B9C9-26188D37AD1E}" = protocol=6 | dir=in | app=c:\program files (x86)\vuze\azureus.exe |

    "{6A2E71B9-5782-4D75-AE3E-35586DAD722F}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |

    "{6AE51D20-C5BA-4CA3-A79A-D075C5AE8CFE}" = protocol=17 | dir=in | app=c:\program files\microsoft office\office14\onenote.exe |

    "{6C254EB5-B9B5-4FD8-9F5E-F88FF266632A}" = protocol=6 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe |

    "{72309BA0-6F5D-42A1-8569-A11051FCEC56}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 |

    "{7322AB01-F29E-4441-8F58-CABEEF80FA52}" = protocol=6 | dir=in | app=c:\program files (x86)\acer\clear.fi media\windowsupnpmv.exe |

    "{847E0308-8C24-4147-8247-359FA6173191}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |

    "{858D75D8-9C2C-4489-AD51-FA4D6EF20D07}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 |

    "{88CC1FF5-B353-47DF-A9A6-0A5AABE5B776}" = dir=in | app=c:\program files (x86)\acer\clear.fi sdk20\movie\playmovie.exe |

    "{8AEFF780-DF75-4898-9FB5-B3EE9D937706}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |

    "{8BC9AE23-241C-40F8-B030-6DC6591B5163}" = dir=in | app=c:\program files (x86)\common files\apple\apple application support\webkit2webprocess.exe |

    "{9A9EEA63-A3EC-4A03-A9D6-D779001BCE5E}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |

    "{A6054849-3106-486A-8A87-DC3E86E3310F}" = protocol=17 | dir=in | app=c:\program files\microsoft office\office14\groove.exe |

    "{AAB8F019-A424-421D-8E2F-3704EBA8DD6B}" = dir=in | app=c:\program files (x86)\itunes\itunes.exe |

    "{AAF559DB-381A-4722-84AC-869229CEF0F8}" = protocol=17 | dir=in | app=c:\program files (x86)\acer\clear.fi media\windowsupnpmv.exe |

    "{AC6233A8-0064-4960-933A-BB71C83A2EF9}" = protocol=6 | dir=in | app=c:\program files\common files\mcafee\mcsvchost\mcsvhost.exe |

    "{B9B51ABD-AFC2-470C-86DA-2D33E681253F}" = protocol=6 | dir=in | app=c:\program files (x86)\bonjour\mdnsresponder.exe |

    "{BF8DC535-BD30-4AE3-85D3-40E5DE77A9AA}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |

    "{BF9C3F48-A670-4F2E-AB89-D4765C6C4AA3}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |

    "{BFECD996-240E-42A6-934B-05A861F6A63C}" = protocol=6 | dir=in | app=c:\program files\microsoft office\office14\groove.exe |

    "{CA9F2AB8-6D9C-48AD-85A6-08268A972D06}" = protocol=6 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |

    "{D0ED2D80-BB5A-4A0A-A3B9-2CEF05D9E1F2}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe |

    "{D31DAF52-EFEB-495A-84A8-9984345DA532}" = protocol=17 | dir=in | app=c:\program files (x86)\acer\clear.fi photo\windowsupnp.exe |

    "{DAA3AF94-705F-43E4-ACB5-4E576F41FE04}" = protocol=17 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe |

    "{DBFF046C-B2EA-4ABC-BFD7-31F689742688}" = dir=in | app=c:\program files (x86)\acer\clear.fi sdk20\mvp\videoplayer.exe |

    "{DD833968-99EE-4813-96CF-FEAAD1230C83}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |

    "{DF4570C6-8139-410A-B6FF-21FE725D156B}" = protocol=6 | dir=in | app=c:\program files (x86)\acer\clear.fi media\dmcdaemon.exe |

    "{E0E1EC43-875B-4729-B191-67092D2E9128}" = protocol=17 | dir=in | app=c:\program files (x86)\acer\clear.fi media\dmcdaemon.exe |

    "{E1E9630C-5C2D-44C7-9F70-29F0B4D0AEFC}" = protocol=6 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |

    "{E46FA317-59D5-49A3-893E-2A4852648B2B}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 |

    "{E7F86356-9F20-434E-92F1-5FD95A8F69ED}" = dir=in | app=c:\program files (x86)\acer\clear.fi sdk20\mvp\musicplayer.exe |

    "{EBAEABE3-575F-43DF-822F-62A8963CF3AC}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |

    "{F01E9182-C091-40D3-A43C-3C53C1C1EA9C}" = protocol=6 | dir=in | app=c:\program files (x86)\acer\clear.fi photo\windowsupnp.exe |

    "{FF09664D-ECA2-45B2-ADB9-7B18E17F9B82}" = protocol=17 | dir=in | app=c:\program files (x86)\vuze\azureus.exe |

    "TCP Query User{2B879A9F-0683-4A12-8C8E-8EC40FA275C4}C:\program files (x86)\symantec\norton online backup\nobuclient.exe" = protocol=6 | dir=in | app=c:\program files (x86)\symantec\norton online backup\nobuclient.exe |

    "TCP Query User{3ADBE8B7-8CD1-485D-8AF5-DA6BCBEA105D}C:\program files\ibm\spss\statistics\21\jre\bin\javaw.exe" = protocol=6 | dir=in | app=c:\program files\ibm\spss\statistics\21\jre\bin\javaw.exe |

    "TCP Query User{6B12C207-94D3-4868-9F3F-097CCDB146E8}C:\program files\ibm\spss\statistics\21\jre\bin\javaw.exe" = protocol=6 | dir=in | app=c:\program files\ibm\spss\statistics\21\jre\bin\javaw.exe |

    "TCP Query User{D83F732B-3C43-4FCA-A058-EE2E87391F37}C:\program files (x86)\symantec\norton online backup\nobuclient.exe" = protocol=6 | dir=in | app=c:\program files (x86)\symantec\norton online backup\nobuclient.exe |

    "UDP Query User{4F0F2FF0-4A74-4D4D-9E98-A97462753C29}C:\program files (x86)\symantec\norton online backup\nobuclient.exe" = protocol=17 | dir=in | app=c:\program files (x86)\symantec\norton online backup\nobuclient.exe |

    "UDP Query User{58533393-2A37-4F8F-A704-1B5816894706}C:\program files (x86)\symantec\norton online backup\nobuclient.exe" = protocol=17 | dir=in | app=c:\program files (x86)\symantec\norton online backup\nobuclient.exe |

    "UDP Query User{6933AE39-3A43-4B67-810B-50E60D5AF9EF}C:\program files\ibm\spss\statistics\21\jre\bin\javaw.exe" = protocol=17 | dir=in | app=c:\program files\ibm\spss\statistics\21\jre\bin\javaw.exe |

    "UDP Query User{F5BCD475-9CAF-4990-AE5F-6FCD7C1ED5E4}C:\program files\ibm\spss\statistics\21\jre\bin\javaw.exe" = protocol=17 | dir=in | app=c:\program files\ibm\spss\statistics\21\jre\bin\javaw.exe |

    ========== HKEY_LOCAL_MACHINE Uninstall List ==========

    64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]

    "{09536BA1-E498-4CC3-B834-D884A67D7E34}" = Intel® Trusted Connect Service Client

    "{0B78ECB0-1A6B-4E6D-89D7-0E7CE77F0427}" = MyWinLocker

    "{1493B2AE-0261-47D2-B1AA-F4DAD0F6C48B}" = iTunes

    "{180C8888-50F1-426B-A9DC-AB83A1989C65}" = Windows Live Language Selector

    "{1ACC8FFB-9D84-4C05-A4DE-D28A9BC91698}" = Windows Live ID Sign-in Assistant

    "{1D8E6291-B0D5-35EC-8441-6616F567A0F7}" = Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219

    "{1E26B9C2-ED08-4EEA-83C8-A786502B41E5}" = IBM SPSS Statistics 21

    "{1F557316-CFC0-41BD-AFF7-8BC49CE444D7}" = Shredder

    "{24F93B56-61F5-415F-85B9-AA444DA34AFC}" = Microsoft Mouse and Keyboard Center

    "{5E2CD4FB-4538-4831-8176-05D653C3E6D4}" = Windows Live Remote Service Resources

    "{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161

    "{656DEEDE-F6AC-47CA-A568-A1B4E34B5760}" = Windows Live Remote Service Resources

    "{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}" = Bonjour

    "{7446FE8D-C1F9-4D42-AAAE-5DBCE58605A6}" = Apple Mobile Device Support

    "{8220EEFE-38CD-377E-8595-13398D740ACE}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17

    "{847B0532-55E3-4AAF-8D7B-E3A1A7CD17E5}" = Windows Live Remote Client Resources

    "{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight

    "{8E34682C-8118-31F1-BC4C-98CD9675E1C2}" = Microsoft .NET Framework 4 Extended

    "{8EB588BD-D398-40D0-ADF7-BE1CEEF7C116}" = Windows Live Remote Client Resources

    "{90140000-0011-0000-1000-0000000FF1CE}" = Microsoft Office Professional Plus 2010

    "{90140000-0011-0000-1000-0000000FF1CE}_Office14.PROPLUS_{7BC9B5EB-125A-4E9B-97E1-8D85B5E960B8}" = Microsoft Office 2010 Service Pack 1 (SP1)

    "{90140000-0015-0409-1000-0000000FF1CE}" = Microsoft Office Access MUI (English) 2010

    "{90140000-0015-0409-1000-0000000FF1CE}_Office14.PROPLUS_{EC583796-6BBB-47DD-B9CE-B5DA12D71135}" = Microsoft Office 2010 Service Pack 1 (SP1)

    "{90140000-0016-0409-1000-0000000FF1CE}" = Microsoft Office Excel MUI (English) 2010

    "{90140000-0016-0409-1000-0000000FF1CE}_Office14.PROPLUS_{EC583796-6BBB-47DD-B9CE-B5DA12D71135}" = Microsoft Office 2010 Service Pack 1 (SP1)

    "{90140000-0018-0409-1000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (English) 2010

    "{90140000-0018-0409-1000-0000000FF1CE}_Office14.PROPLUS_{EC583796-6BBB-47DD-B9CE-B5DA12D71135}" = Microsoft Office 2010 Service Pack 1 (SP1)

    "{90140000-0019-0409-1000-0000000FF1CE}" = Microsoft Office Publisher MUI (English) 2010

    "{90140000-0019-0409-1000-0000000FF1CE}_Office14.PROPLUS_{EC583796-6BBB-47DD-B9CE-B5DA12D71135}" = Microsoft Office 2010 Service Pack 1 (SP1)

    "{90140000-001A-0409-1000-0000000FF1CE}" = Microsoft Office Outlook MUI (English) 2010

    "{90140000-001A-0409-1000-0000000FF1CE}_Office14.PROPLUS_{EC583796-6BBB-47DD-B9CE-B5DA12D71135}" = Microsoft Office 2010 Service Pack 1 (SP1)

    "{90140000-001B-0409-1000-0000000FF1CE}" = Microsoft Office Word MUI (English) 2010

    "{90140000-001B-0409-1000-0000000FF1CE}_Office14.PROPLUS_{EC583796-6BBB-47DD-B9CE-B5DA12D71135}" = Microsoft Office 2010 Service Pack 1 (SP1)

    "{90140000-001F-0409-1000-0000000FF1CE}" = Microsoft Office Proof (English) 2010

    "{90140000-001F-0409-1000-0000000FF1CE}_Office14.PROPLUS_{0242505C-4E90-407F-9299-B5B275F50D86}" = Microsoft Office 2010 Service Pack 1 (SP1)

    "{90140000-001F-040C-1000-0000000FF1CE}" = Microsoft Office Proof (French) 2010

    "{90140000-001F-040C-1000-0000000FF1CE}_Office14.PROPLUS_{B51389C8-2890-4633-81D8-47D2A7402274}" = Microsoft Office 2010 Service Pack 1 (SP1)

    "{90140000-001F-0C0A-1000-0000000FF1CE}" = Microsoft Office Proof (Spanish) 2010

    "{90140000-001F-0C0A-1000-0000000FF1CE}_Office14.PROPLUS_{1779650B-2E44-4A19-8DF6-3866D645764A}" = Microsoft Office 2010 Service Pack 1 (SP1)

    "{90140000-002C-0409-1000-0000000FF1CE}" = Microsoft Office Proofing (English) 2010

    "{90140000-002C-0409-1000-0000000FF1CE}_Office14.PROPLUS_{270CA0B9-9881-44DB-BC3B-37C7E66A044A}" = Microsoft Office 2010 Service Pack 1 (SP1)

    "{90140000-0043-0000-1000-0000000FF1CE}" = Microsoft Office Office 32-bit Components 2010

    "{90140000-0043-0000-1000-0000000FF1CE}_Office14.PROPLUS_{E8B6D35B-0B6F-4DCE-9493-859BF3809A7F}" = Microsoft Office 2010 Service Pack 1 (SP1)

    "{90140000-0043-0409-1000-0000000FF1CE}" = Microsoft Office Shared 32-bit MUI (English) 2010

    "{90140000-0043-0409-1000-0000000FF1CE}_Office14.PROPLUS_{FCD1C311-8B02-4DBD-BA46-1079C629577E}" = Microsoft Office 2010 Service Pack 1 (SP1)

    "{90140000-0044-0409-1000-0000000FF1CE}" = Microsoft Office InfoPath MUI (English) 2010

    "{90140000-0044-0409-1000-0000000FF1CE}_Office14.PROPLUS_{EC583796-6BBB-47DD-B9CE-B5DA12D71135}" = Microsoft Office 2010 Service Pack 1 (SP1)

    "{90140000-006E-0409-1000-0000000FF1CE}" = Microsoft Office Shared MUI (English) 2010

    "{90140000-006E-0409-1000-0000000FF1CE}_Office14.PROPLUS_{516CA4A9-98E6-4F77-A863-CBD8487368E4}" = Microsoft Office 2010 Service Pack 1 (SP1)

    "{90140000-00A1-0409-1000-0000000FF1CE}" = Microsoft Office OneNote MUI (English) 2010

    "{90140000-00A1-0409-1000-0000000FF1CE}_Office14.PROPLUS_{EC583796-6BBB-47DD-B9CE-B5DA12D71135}" = Microsoft Office 2010 Service Pack 1 (SP1)

    "{90140000-00BA-0409-1000-0000000FF1CE}" = Microsoft Office Groove MUI (English) 2010

    "{90140000-00BA-0409-1000-0000000FF1CE}_Office14.PROPLUS_{EC583796-6BBB-47DD-B9CE-B5DA12D71135}" = Microsoft Office 2010 Service Pack 1 (SP1)

    "{90140000-0115-0409-1000-0000000FF1CE}" = Microsoft Office Shared Setup Metadata MUI (English) 2010

    "{90140000-0115-0409-1000-0000000FF1CE}_Office14.PROPLUS_{516CA4A9-98E6-4F77-A863-CBD8487368E4}" = Microsoft Office 2010 Service Pack 1 (SP1)

    "{90140000-0117-0409-1000-0000000FF1CE}" = Microsoft Office Access Setup Metadata MUI (English) 2010

    "{90140000-0117-0409-1000-0000000FF1CE}_Office14.PROPLUS_{EC583796-6BBB-47DD-B9CE-B5DA12D71135}" = Microsoft Office 2010 Service Pack 1 (SP1)

    "{95120000-00B9-0409-1000-0000000FF1CE}" = Microsoft Application Error Reporting

    "{A508D5A2-3AC1-4594-A718-A663D6D3CF11}" = Windows Live Remote Service Resources

    "{A679FBE4-BA2D-4514-8834-030982C8B31A}" = Windows Live Remote Service Resources

    "{B143BE44-8723-315E-9413-011C55873C0E}" = Microsoft Visual Studio 2010 Tools for Office Runtime (x64)

    "{B750FA38-7AB0-42CB-ACBB-E7DBE9FF603F}" = Windows Live Remote Client Resources

    "{CFF3C688-2198-4BC3-A399-598226949C39}" = Windows Live Remote Client Resources

    "{DA54F80E-261C-41A2-A855-549A144F2F59}" = Windows Live MIME IFilter

    "{DF6D988A-EEA0-4277-AAB8-158E086E439B}" = Windows Live Remote Client

    "{E02A6548-6FDE-40E2-8ED9-119D7D7E641F}" = Windows Live Remote Service

    "{EF79C448-6946-4D71-8134-03407888C054}" = Shared C Run-time for x64

    "{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}" = Microsoft .NET Framework 4 Client Profile

    "Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile

    "Microsoft .NET Framework 4 Extended" = Microsoft .NET Framework 4 Extended

    "Microsoft Mouse and Keyboard Center" = Microsoft Mouse and Keyboard Center

    "Microsoft Visual Studio 2010 Tools for Office Runtime (x64)" = Microsoft Visual Studio 2010 Tools for Office Runtime (x64)

    "Office14.PROPLUS" = Microsoft Office Professional Plus 2010

    "SynTPDeinstKey" = Synaptics Pointing Device Driver

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]

    "{05E379CC-F626-4E7D-8354-463865B303BF}" = Windows Live UX Platform Language Pack

    "{0ABBF310-94E4-4AE8-A6BD-10345A3F6439}" = Google Drive

    "{0B0F231F-CE6A-483D-AA23-77B364F75917}" = Windows Live Installer

    "{0B61BBD5-DA3C-409A-8730-0C3DC3B0F270}" = Backup Manager V3

    "{0D261C88-454B-46FE-B43B-640E621BDA11}" = Windows Live Mail

    "{17DF9714-60C9-43C9-A9C2-32BCAED44CBE}" = MyWinLocker Suite

    "{19BA08F7-C728-469C-8A35-BFBD3633BE08}" = Windows Live Movie Maker

    "{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148

    "{1F6AB0E7-8CDD-4B93-8A23-AA9EB2FEFCE4}" = Junk Mail filter update

    "{200FEC62-3C34-4D60-9CE8-EC372E01C08F}" = Windows Live SOXE Definitions

    "{26A24AE4-039D-4CA4-87B4-2F83217011FF}" = Java 7 Update 11

    "{28006915-2739-4EBE-B5E8-49B25D32EB33}" = Qualcomm Atheros WiFi Driver Installation

    "{2A3FC24C-6EC0-4519-A52B-FDA4EA9B2D24}" = Windows Live Messenger

    "{2CEDEB33-4931-48B1-8010-20618772B58E}" = Sage Simply Accounting 2012

    "{3336F667-9049-4D46-98B6-4C743EEBC5B1}" = Windows Live Photo Gallery

    "{34319F1F-7CF2-4CC9-B357-1AE7D2FF3AC5}" = Windows Live

    "{34F4D9A4-42C2-4348-BEF4-E553C84549E7}" = Windows Live Photo Gallery

    "{39F15B50-A977-4CA6-B1C3-6A8724CDA025}" = MyWinLocker 4

    "{3B9A92DA-6374-4872-B646-253F18624D5F}" = Windows Live Writer

    "{3DB0448D-AD82-4923-B305-D001E521A964}" = Acer ePower Management

    "{3E29EE6C-963A-4aae-86C1-DC237C4A49FC}" = Intel® Rapid Storage Technology

    "{40A66DF6-22D3-44B5-A7D3-83B118A2C0DC}" = Norton Online Backup

    "{43B43577-2514-4CE0-B14A-7E85C17C0453}" = Windows Live Essentials

    "{4664ED39-C80A-48F7-93CD-EBDCAFAB6CC5}" = Windows Live Writer Resources

    "{488F0347-C4A7-4374-91A7-30818BEDA710}" = Galerie de photos Windows Live

    "{48C0DC5E-820A-44F2-890E-29B68EDD3C78}" = Windows Live Writer

    "{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater

    "{52D160F1-0E2C-4AC1-9EF9-8ABE1CAF2F8D}" = Sage 50 Accounting 2013

    "{579684A4-DDD5-4CA3-9EA8-7BE7D9593DB4}" = Windows Live UX Platform Language Pack

    "{5D273F60-0525-48BA-A5FB-D0CAA4A952AE}" = Windows Live Movie Maker

    "{613C0AC5-3A67-4B94-8B13-9176AD83F5BF}" = newsXpresso

    "{62687B11-58B5-4A18-9BC3-9DF4CE03F194}" = Windows Live Writer Resources

    "{63EC2120-1742-4625-AA47-C6A8AEC9C64C}" = Apple Application Support

    "{644063FA-ABA3-42AC-A8AC-3EDC0706018B}" = Windows Live Mesh

    "{65153EA5-8B6E-43B6-857B-C6E4FC25798A}" = Intel® Management Engine Components

    "{682B3E4F-696A-42DE-A41C-4C07EA1678B4}" = Windows Live SOXE

    "{6A85286D-BA0F-4318-8C30-AD74A33AAD36}" = MySQL Connector/ODBC 3.51

    "{6DEC8BD5-7574-47FA-B080-492BBBE2FEA3}" = Windows Live Movie Maker

    "{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable

    "{718B4606-2FEF-411B-B96E-4FC53B91EBC0}" = Secure Download Manager

    "{77477AEA-5757-47D8-8B33-939F43D82218}" = Windows Live UX Platform Language Pack

    "{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}" = Apple Software Update

    "{78DAE910-CA72-450E-AD22-772CB1A00678}" = Windows Live Mesh

    "{7D1C7B9F-2744-4388-B128-5C75B8BCCC84}" = Windows Live Essentials

    "{7F811A54-5A09-4579-90E1-C93498E230D9}" = Acer eRecovery Management

    "{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable

    "{83C292B7-38A5-440B-A731-07070E81A64F}" = Windows Live PIMT Platform

    "{841F1FB4-FDF8-461C-A496-3E1CFD84C0B5}" = Windows Live Mesh

    "{8833FFB6-5B0C-4764-81AA-06DFEED9A476}" = Realtek Ethernet Controller Driver

    "{8C6D6116-B724-4810-8F2D-D047E6B7D68E}" = Mesh Runtime

    "{8D68CE08-9A14-4B7B-9857-3C646A2F34C7}" = Fooz Kids Platform

    "{8DD46C6A-0056-4FEC-B70A-28BB16A1F11F}" = MSVCRT

    "{8FF3891F-01B5-4A71-BFCD-20761890471C}" = Windows Live Messenger

    "{92EA4134-10D1-418A-91E1-5A0453131A38}" = Windows Live Movie Maker

    "{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17

    "{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161

    "{9D56775A-93F3-44A3-8092-840E3826DE30}" = Windows Live Mail

    "{9DA3F03B-2CEE-4344-838E-117861E61FAF}" = Windows Live Mail

    "{9FAE6E8D-E686-49F5-A574-0A58DFD9580C}" = Windows Live Mail

    "{A0382E3C-7384-429A-9BFA-AF5888E5A193}" = Acer Crystal Eye Webcam

    "{A0C91188-C88F-4E86-93E6-CD7C9A266649}" = Windows Live Mesh

    "{A199DB88-E22D-4CE7-90AC-B8BE396D7BF4}" = Windows Live Movie Maker

    "{A3AD65CC-B2CE-49da-AE4E-CC2ECF4EC0F8}" = clear.fi SDK - MVP 2

    "{A41A708E-3BE6-4561-855D-44027C1CF0F8}" = Windows Live Photo Common

    "{A6C48A9F-694A-4234-B3AA-62590B668927}" = Intel® Manageability Engine Firmware Recovery Agent

    "{A726AE06-AAA3-43D1-87E3-70F510314F04}" = Windows Live Writer

    "{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper

    "{A9BDCA6B-3653-467B-AC83-94367DA3BFE3}" = Windows Live Photo Common

    "{AAAFC670-569B-4A2F-82B4-42945E0DE3EF}" = Windows Live Writer

    "{AAF454FC-82CA-4F29-AB31-6A109485E76E}" = Windows Live Writer

    "{AB61A2E9-37D3-485D-9085-19FBDF8CEF4A}" = Windows Live Messenger

    "{AC76BA86-7AD7-FFFF-7B44-AA0000000001}" = Adobe Reader X (10.1.5) MUI

    "{AFF7E080-1974-45BF-9310-10DE1A1F5ED0}" = Adobe AIR

    "{B33B61FE-701F-425F-98AB-2B85725CBF68}" = Windows Live Photo Common

    "{B3BE54A4-8DFE-4593-8E66-56AB7133B812}" = Windows Live Writer

    "{B5AD89F2-03D3-4206-8487-018298007DD0}" = clear.fi Photo

    "{C1594429-8296-4652-BF54-9DBE4932A44C}" = Realtek PCIE Card Reader

    "{C2695E83-CF1D-43D1-84FE-B3BEC561012A}" = Shredder

    "{C66824E4-CBB3-4851-BB3F-E8CFD6350923}" = Windows Live Mail

    "{C893D8C0-1BA0-4517-B11C-E89B65E72F70}" = Windows Live Photo Common

    "{C9E1343D-E21E-4508-A1BE-04A089EC137D}" = Windows Live Messenger

    "{CE95A79E-E4FC-4FFF-8A75-29F04B942FF2}" = Windows Live UX Platform

    "{D0B44725-3666-492D-BEF6-587A14BD9BD9}" = MSVCRT_amd64

    "{D3D5C4E8-040F-4C6F-8105-41D43CF94F44}" = NTI Media Maker 9

    "{D3E5A972-9A15-427D-AE78-8181A5FD943C}" = eBay Worldwide

    "{D436F577-1695-4D2F-8B44-AC76C99E0002}" = Windows Live Photo Common

    "{D45240D3-B6B3-4FF9-B243-54ECE3E10066}" = Windows Live Communications Platform

    "{DAF7BB88-6392-40aa-A714-8392C4BDBD2C}" = clear.fi SDK- Movie 2

    "{DDC8BDEE-DCAC-404D-8257-3E8D4B782467}" = Windows Live Writer Resources

    "{DECDCB7C-58CC-4865-91AF-627F9798FE48}" = Windows Live Mesh

    "{DF71ABBB-B834-41C0-BB58-80B0545D754C}" = Windows Live UX Platform Language Pack

    "{E09C4DB7-630C-4F06-A631-8EA7239923AF}" = D3DX10

    "{E3739848-5329-48E3-8D28-5BBD6E8BE384}" = CyberLink MediaEspresso

    "{E5B21F11-6933-4E0B-A25C-7963E3C07D11}" = Windows Live Messenger

    "{E727A662-AF9F-4DEE-81C5-F4A1686F3DFC}" = Windows Live Writer Resources

    "{E85A4EFC-82F2-4CEE-8A8E-62FDAD353A66}" = Galería fotográfica de Windows Live

    "{E9AF1707-3F3A-49E2-8345-4F2D629D0876}" = clear.fi Media

    "{EA17F4FC-FDBF-4CF8-A529-2D983132D053}" = Skype™ 6.0

    "{EE171732-BEB4-4576-887D-CB62727F01CA}" = Acer Updater

    "{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}" = Microsoft SQL Server 2005 Compact Edition [ENU]

    "{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219

    "{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}" = Intel® Processor Graphics

    "{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver

    "{F77EF646-19EB-11E1-9A9E-984BE15F174E}" = Evernote v. 4.5.2

    "{F7A46527-DF1F-4B0F-9637-98547E189442}" = Windows Live Galeria de Fotos

    "{F8A9085D-4C7A-41a9-8A77-C8998A96C421}" = Intel® Control Center

    "{FCB3772C-B7D0-4933-B1A9-3707EBACC573}" = Intel® OpenCL CPU Runtime

    "{FCDB0EF3-673C-FDCE-6498-750F51391660}" = Fooz Kids

    "{FE044230-9CA5-43F7-9B58-5AC5A28A1F33}" = Windows Live Essentials

    "8461-7759-5462-8226" = Vuze

    "Acer Registration" = Acer Registration

    "Acer Screensaver" = Acer ScreenSaver

    "Acer Welcome Center" = Welcome Center

    "Adobe AIR" = Adobe AIR

    "Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX

    "Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin

    "FoozKids" = Fooz Kids

    "Google Chrome" = Google Chrome

    "Identity Card" = Identity Card

    "InstallShield_{0B61BBD5-DA3C-409A-8730-0C3DC3B0F270}" = Acer Backup Manager

    "InstallShield_{17DF9714-60C9-43C9-A9C2-32BCAED44CBE}" = MyWinLocker Suite

    "InstallShield_{2CEDEB33-4931-48B1-8010-20618772B58E}" = Sage Simply Accounting 2012

    "InstallShield_{52D160F1-0E2C-4AC1-9EF9-8ABE1CAF2F8D}" = Sage 50 Accounting 2013

    "InstallShield_{613C0AC5-3A67-4B94-8B13-9176AD83F5BF}" = newsXpresso

    "InstallShield_{A0382E3C-7384-429A-9BFA-AF5888E5A193}" = Acer Crystal Eye Webcam

    "InstallShield_{D3D5C4E8-040F-4C6F-8105-41D43CF94F44}" = NTI Media Maker 9

    "InstallShield_{E3739848-5329-48E3-8D28-5BBD6E8BE384}" = CyberLink MediaEspresso

    "Kobo" = Kobo

    "LManager" = Launch Manager

    "Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware version 1.75.0.1300

    "Mozilla Firefox 20.0.1 (x86 en-US)" = Mozilla Firefox 20.0.1 (x86 en-US)

    "MozillaMaintenanceService" = Mozilla Maintenance Service

    "PowerISO" = PowerISO

    "WinLiveSuite" = Windows Live Essentials

    ========== Last 20 Event Log Errors ==========

    [ Application Events ]

    Error - 29/04/2013 10:16:27 PM | Computer Name = RussellAllsup | Source = Bonjour Service | ID = 100

    Description = Task Scheduling Error: Continuously busy for more than a second

    Error - 29/04/2013 10:16:27 PM | Computer Name = RussellAllsup | Source = Bonjour Service | ID = 100

    Description = Task Scheduling Error: m->NextScheduledEvent 1202

    Error - 29/04/2013 10:16:27 PM | Computer Name = RussellAllsup | Source = Bonjour Service | ID = 100

    Description = Task Scheduling Error: m->NextScheduledSPRetry 1202

    [ System Events ]

    Error - 29/04/2013 10:11:53 PM | Computer Name = RussellAllsup | Source = DCOM | ID = 10010

    Description =

    < End of report >

    Whitesmoke toolbar? Total novice, love some help.

    in Resolved Malware Removal Logs

    Posted

    still having chrome start with the conduit url thing, but heres the text

    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

    Junkware Removal Tool (JRT) by Thisisu

    Version: 4.9.3 (04.29.2013:2)

    OS: Windows 7 Home Premium x64

    Ran by Russell Allsup on 29/04/2013 at 18:45:34.65

    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

    ~~~ Services

    ~~~ Registry Values

    ~~~ Registry Keys

    Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Classes\installer\upgradecodes\f928123a039649549966d4c29d35b1c9

    Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{332B2345-BF2B-457F-B30C-DB25D549B0BA}

    ~~~ Files

    ~~~ Folders

    Successfully deleted: [Empty Folder] C:\Users\Russell Allsup\appdata\local\{093DE70E-38AE-4E0D-916C-00786A6A4B7F}

    Successfully deleted: [Empty Folder] C:\Users\Russell Allsup\appdata\local\{4BEC1E29-3DEE-4CA8-9C9B-2E631048E53B}

    Successfully deleted: [Empty Folder] C:\Users\Russell Allsup\appdata\local\{4EB46E8F-FEA2-4F97-9022-9190B29586BA}

    Successfully deleted: [Empty Folder] C:\Users\Russell Allsup\appdata\local\{5FDF27F3-1300-4AC9-A33A-03AE13AE397E}

    Successfully deleted: [Empty Folder] C:\Users\Russell Allsup\appdata\local\{768DD7D2-2C74-4888-B0BB-3DD59D086885}

    Successfully deleted: [Empty Folder] C:\Users\Russell Allsup\appdata\local\{80DC2A0E-8EE1-427D-BEEC-253F79824992}

    Successfully deleted: [Empty Folder] C:\Users\Russell Allsup\appdata\local\{89708595-3751-4868-8E1C-8A3D7997D903}

    Successfully deleted: [Empty Folder] C:\Users\Russell Allsup\appdata\local\{96ECA68C-B168-48F3-96BF-25F9EFE9EC74}

    Successfully deleted: [Empty Folder] C:\Users\Russell Allsup\appdata\local\{B877B32E-ABA8-4C1C-8B65-C316A2077F7E}

    ~~~ FireFox

    Emptied folder: C:\Users\Russell Allsup\AppData\Roaming\mozilla\firefox\profiles\d3p9l5pa.default\minidumps [109 files]

    ~~~ Event Viewer Logs were cleared

    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

    Scan was completed on 29/04/2013 at 18:53:16.77

    End of JRT log

    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

    Whitesmoke toolbar? Total novice, love some help.

    in Resolved Malware Removal Logs

    Posted

    Cool, well i started chrome and it didnt send me to that search conduit B.S.

    # AdwCleaner v2.300 - Logfile created 04/29/2013 at 17:37:56

    # Updated 28/04/2013 by Xplode

    # Operating system : Windows 7 Home Premium Service Pack 1 (64 bits)

    # User : Russell Allsup - RussellAllsup

    # Boot Mode : Normal

    # Running from : C:\Users\Russell Allsup\Downloads\adwcleaner.exe

    # Option [Delete]

    ***** [services] *****

    Stopped & Deleted : vToolbarUpdater14.2.0

    ***** [Files / Folders] *****

    File Deleted : C:\Program Files (x86)\Mozilla Firefox\searchplugins\avg-secure-search.xml

    File Deleted : C:\Users\Public\Desktop\eBay.lnk

    File Deleted : C:\Users\Russell Allsup\AppData\Roaming\Mozilla\Firefox\Profiles\d3p9l5pa.default\searchplugins\Askcom.xml

    Folder Deleted : C:\Program Files (x86)\Ask.com

    Folder Deleted : C:\Program Files (x86)\AVG Secure Search

    Folder Deleted : C:\Program Files (x86)\Common Files\AVG Secure Search

    Folder Deleted : C:\ProgramData\Ask

    Folder Deleted : C:\ProgramData\AVG Secure Search

    Folder Deleted : C:\Users\Russell Allsup\AppData\Local\AVG Secure Search

    Folder Deleted : C:\Users\Russell Allsup\AppData\LocalLow\AskToolbar

    Folder Deleted : C:\Users\Russell Allsup\AppData\LocalLow\AVG Secure Search

    Folder Deleted : C:\Users\Russell Allsup\AppData\Roaming\Mozilla\Firefox\Profiles\d3p9l5pa.default\extensions\toolbar@ask.com

    Folder Deleted : C:\Windows\Installer\{86D4B82A-ABED-442A-BE86-96357B70F4FE}

    ***** [Registry] *****

    Key Deleted : HKCU\Software\APN

    Key Deleted : HKCU\Software\AppDataLow\Software\AskToolbar

    Key Deleted : HKCU\Software\Ask.com

    Key Deleted : HKCU\Software\AVG Secure Search

    Key Deleted : HKCU\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A5AA24EA-11B8-4113-95AE-9ED71DEAF12A}

    Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{95B7759C-8C7F-4BF1-B163-73684A933233}

    Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{D4027C7F-154A-4066-A1AD-4243D8127440}

    Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{95B7759C-8C7F-4BF1-B163-73684A933233}

    Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{D4027C7F-154A-4066-A1AD-4243D8127440}

    Key Deleted : HKCU\Software\Softonic

    Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{95B7759C-8C7F-4BF1-B163-73684A933233}

    Key Deleted : HKLM\Software\APN

    Key Deleted : HKLM\Software\AskToolbar

    Key Deleted : HKLM\Software\AVG Secure Search

    Key Deleted : HKLM\Software\AVG Security Toolbar

    Key Deleted : HKLM\SOFTWARE\Classes\AppID\{09C554C3-109B-483C-A06B-F14172F1A947}

    Key Deleted : HKLM\SOFTWARE\Classes\AppID\{1FDFF5A2-7BB1-48E1-8081-7236812B12B2}

    Key Deleted : HKLM\SOFTWARE\Classes\AppID\{4E1E9D45-8BF9-4139-915C-9F83CC3D5921}

    Key Deleted : HKLM\SOFTWARE\Classes\AppID\{960DF771-CFCB-4E53-A5B5-6EF2BBE6E706}

    Key Deleted : HKLM\SOFTWARE\Classes\AppID\{9B0CB95C-933A-4B8C-B6D4-EDCD19A43874}

    Key Deleted : HKLM\SOFTWARE\Classes\AppID\{B12E99ED-69BD-437C-86BE-C862B9E5444D}

    Key Deleted : HKLM\SOFTWARE\Classes\AppID\{BB711CB0-C70B-482E-9852-EC05EBD71DBB}

    Key Deleted : HKLM\SOFTWARE\Classes\AppID\{D7EE8177-D51E-4F89-92B6-83EA2EC40800}

    Key Deleted : HKLM\SOFTWARE\Classes\AppID\{EA28B360-05E0-4F93-8150-02891F1D8D3C}

    Key Deleted : HKLM\SOFTWARE\Classes\AppID\escort.DLL

    Key Deleted : HKLM\SOFTWARE\Classes\AppID\escortApp.DLL

    Key Deleted : HKLM\SOFTWARE\Classes\AppID\escortEng.DLL

    Key Deleted : HKLM\SOFTWARE\Classes\AppID\escorTlbr.DLL

    Key Deleted : HKLM\SOFTWARE\Classes\AppID\esrv.EXE

    Key Deleted : HKLM\SOFTWARE\Classes\AppID\GenericAskToolbar.DLL

    Key Deleted : HKLM\SOFTWARE\Classes\AppID\ScriptHelper.EXE

    Key Deleted : HKLM\SOFTWARE\Classes\AppID\ViProtocol.DLL

    Key Deleted : HKLM\SOFTWARE\Classes\AVG Secure Search.BrowserWndAPI

    Key Deleted : HKLM\SOFTWARE\Classes\AVG Secure Search.BrowserWndAPI.1

    Key Deleted : HKLM\SOFTWARE\Classes\AVG Secure Search.PugiObj

    Key Deleted : HKLM\SOFTWARE\Classes\AVG Secure Search.PugiObj.1

    Key Deleted : HKLM\SOFTWARE\Classes\GenericAskToolbar.ToolbarWnd

    Key Deleted : HKLM\SOFTWARE\Classes\GenericAskToolbar.ToolbarWnd.1

    Key Deleted : HKLM\Software\Classes\Installer\Features\A28B4D68DEBAA244EB686953B7074FEF

    Key Deleted : HKLM\Software\Classes\Installer\Products\A28B4D68DEBAA244EB686953B7074FEF

    Key Deleted : HKLM\SOFTWARE\Classes\PROTOCOLS\Handler\viprotocol

    Key Deleted : HKLM\SOFTWARE\Classes\S

    Key Deleted : HKLM\SOFTWARE\Classes\ScriptHelper.ScriptHelperApi

    Key Deleted : HKLM\SOFTWARE\Classes\ScriptHelper.ScriptHelperApi.1

    Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}

    Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{74FB6AFD-DD77-4CEB-83BD-AB2B63E63C93}

    Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{9C049BA6-EA47-4AC3-AED6-A66D8DC9E1D8}

    Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{C2AC8A0E-E48E-484B-A71C-C7A937FAAB94}

    Key Deleted : HKLM\SOFTWARE\Classes\ViProtocol.ViProtocolOLE

    Key Deleted : HKLM\SOFTWARE\Classes\ViProtocol.ViProtocolOLE.1

    Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\FunmoodsSetup_RASAPI32

    Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\FunmoodsSetup_RASMANCS

    Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{C6FDD0C3-266A-4DC3-B459-28C697C44CDC}

    Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{F25AF245-4A81-40DC-92F9-E9021F207706}

    Key Deleted : HKLM\SOFTWARE\MozillaPlugins\@avg.com/AVG SiteSafety plugin,version=11.0.0.1,application/x-avg-sitesafety-plugin

    Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{00000000-6E41-4FD3-8538-502F5495E5FC}

    Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{4E92DB5F-AAD9-49D3-8EAB-B40CBE5B1FF7}

    Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{95B7759C-8C7F-4BF1-B163-73684A933233}

    Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{B658800C-F66E-4EF3-AB85-6C0C227862A9}

    Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{D4027C7F-154A-4066-A1AD-4243D8127440}

    Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39}

    Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{F25AF245-4A81-40DC-92F9-E9021F207706}

    Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{03E2A1F3-4402-4121-8B35-733216D61217}

    Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{23C70BCA-6E23-4A65-AD2E-1389062074F1}

    Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{23D8EEF7-0E13-4000-B9C4-6603C1E912D1}

    Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{295CACB4-51F5-46FD-914E-C72BAAE1B672}

    Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{2CE5C4B9-6DBE-4528-96FA-C9FF38EF1762}

    Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{34C1FDF7-02C1-4F23-B393-F48B16E071D1}

    Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{4E92DB5F-AAD9-49D3-8EAB-B40CBE5B1FF7}

    Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{54291324-7A3D-4F11-B707-3FB6A2C97BD9}

    Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{59C63F11-D4E5-46E7-9B8A-EE158DCA83A8}

    Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{5DA22CBD-0029-4A09-B757-CF0FAFC488ED}

    Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{6C434537-053E-486D-B62A-160059D9D456}

    Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{77A6E7D4-4A83-4A9B-A2A0-EF3B125DC29D}

    Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{91CF619A-4686-4CA4-9232-3B2E6B63AA92}

    Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{9E3B11F6-4179-4603-A71B-A55F4BCB0BEC}

    Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{AC71B60E-94C9-4EDE-BA46-E146747BB67E}

    Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{C0585B2F-74D7-4734-88DE-6C150C5D4036}

    Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{C401D2CE-DC27-45C7-BC0C-8E6EA7F085D6}

    Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{CA17D76B-F91D-4659-A7FD-A9F7ED375CDD}

    Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{D8242E89-2F81-484A-AE5B-BA8CAD5B7347}

    Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{EF0588D6-1621-4A75-B8BE-F4BC34794136}

    Key Deleted : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A5AA24EA-11B8-4113-95AE-9ED71DEAF12A}

    Key Deleted : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39}

    Key Deleted : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{F25AF245-4A81-40DC-92F9-E9021F207706}

    Key Deleted : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{95B7759C-8C7F-4BF1-B163-73684A933233}

    Key Deleted : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}

    Key Deleted : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{86D4B82A-ABED-442A-BE86-96357B70F4FE}

    Key Deleted : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\AVG Secure Search

    Key Deleted : HKLM\SOFTWARE\Classes\Interface\{03E2A1F3-4402-4121-8B35-733216D61217}

    Key Deleted : HKLM\SOFTWARE\Classes\Interface\{0D80F1C5-D17B-4177-AC68-955F3EF9F191}

    Key Deleted : HKLM\SOFTWARE\Classes\Interface\{23C70BCA-6E23-4A65-AD2E-1389062074F1}

    Key Deleted : HKLM\SOFTWARE\Classes\Interface\{23D8EEF7-0E13-4000-B9C4-6603C1E912D1}

    Key Deleted : HKLM\SOFTWARE\Classes\Interface\{295CACB4-51F5-46FD-914E-C72BAAE1B672}

    Key Deleted : HKLM\SOFTWARE\Classes\Interface\{2CE5C4B9-6DBE-4528-96FA-C9FF38EF1762}

    Key Deleted : HKLM\SOFTWARE\Classes\Interface\{34C1FDF7-02C1-4F23-B393-F48B16E071D1}

    Key Deleted : HKLM\SOFTWARE\Classes\Interface\{4E92DB5F-AAD9-49D3-8EAB-B40CBE5B1FF7}

    Key Deleted : HKLM\SOFTWARE\Classes\Interface\{54291324-7A3D-4F11-B707-3FB6A2C97BD9}

    Key Deleted : HKLM\SOFTWARE\Classes\Interface\{59C63F11-D4E5-46E7-9B8A-EE158DCA83A8}

    Key Deleted : HKLM\SOFTWARE\Classes\Interface\{5DA22CBD-0029-4A09-B757-CF0FAFC488ED}

    Key Deleted : HKLM\SOFTWARE\Classes\Interface\{6C434537-053E-486D-B62A-160059D9D456}

    Key Deleted : HKLM\SOFTWARE\Classes\Interface\{77A6E7D4-4A83-4A9B-A2A0-EF3B125DC29D}

    Key Deleted : HKLM\SOFTWARE\Classes\Interface\{79FB5FC8-44B9-4AF5-BADD-CCE547F953E5}

    Key Deleted : HKLM\SOFTWARE\Classes\Interface\{91CF619A-4686-4CA4-9232-3B2E6B63AA92}

    Key Deleted : HKLM\SOFTWARE\Classes\Interface\{9E3B11F6-4179-4603-A71B-A55F4BCB0BEC}

    Key Deleted : HKLM\SOFTWARE\Classes\Interface\{AC71B60E-94C9-4EDE-BA46-E146747BB67E}

    Key Deleted : HKLM\SOFTWARE\Classes\Interface\{C0585B2F-74D7-4734-88DE-6C150C5D4036}

    Key Deleted : HKLM\SOFTWARE\Classes\Interface\{C401D2CE-DC27-45C7-BC0C-8E6EA7F085D6}

    Key Deleted : HKLM\SOFTWARE\Classes\Interface\{CA17D76B-F91D-4659-A7FD-A9F7ED375CDD}

    Key Deleted : HKLM\SOFTWARE\Classes\Interface\{D8242E89-2F81-484A-AE5B-BA8CAD5B7347}

    Key Deleted : HKLM\SOFTWARE\Classes\Interface\{EF0588D6-1621-4A75-B8BE-F4BC34794136}

    Key Deleted : HKLM\SOFTWARE\Google\Chrome\Extensions\bbjciahceamgodcoidkjpchnokgfpphh

    Key Deleted : HKLM\SOFTWARE\Google\Chrome\Extensions\cjpglkicenollcignonpgiafdgfeehoj

    Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{B7971660-A1CE-4FDD-B9E0-2C37D77AFB0B}

    Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\A28B4D68DEBAA244EB686953B7074FEF

    Value Deleted : HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks [{00000000-6E41-4FD3-8538-502F5495E5FC}]

    Value Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run [ApnUpdater]

    Value Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run [vProt]

    Value Deleted : HKLM\SOFTWARE\Mozilla\Firefox\Extensions [Avg@toolbar]

    Value Deleted : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar [{95B7759C-8C7F-4BF1-B163-73684A933233}]

    Value Deleted : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar [{D4027C7F-154A-4066-A1AD-4243D8127440}]

    ***** [internet Browsers] *****

    -\\ Internet Explorer v9.0.8112.16476

    Replaced : [HKLM\SOFTWARE\Microsoft\Internet Explorer\Main - Start Page] = hxxp://searchfunmoods.com/?f=1&a=download&chnl=download&cd=2XzuyEtN2Y1L1QzuyEyEyC0DyDyB0B0A0D0DzytB0EtDyE0EtN0D0Tzu0CtAtBzytN1L2XzutBtFtBtFtDtFtAyEyE&cr=1632136062 --> hxxp://www.google.com

    -\\ Mozilla Firefox v20.0.1 (en-US)

    File : C:\Users\Russell Allsup\AppData\Roaming\Mozilla\Firefox\Profiles\d3p9l5pa.default\prefs.js

    Deleted : user_pref("browser.search.defaultengine", "Ask.com");

    Deleted : user_pref("browser.search.defaultenginename", "Ask.com");

    Deleted : user_pref("browser.search.order.1", "Ask.com");

    Deleted : user_pref("extensions.asktb.ff-original-keyword-url", "");

    Deleted : user_pref("keyword.URL", "hxxp://websearch.ask.com/redirect?client=ff&src=kw&tb=ORJ&o=&locale=&apn_u[...]

    -\\ Google Chrome v26.0.1410.64

    File : C:\Users\Russell Allsup\AppData\Local\Google\Chrome\User Data\Default\Preferences

    Deleted [l.2647] : urls_to_restore_on_startup = [ "hxxp://search.conduit.com/?ctid=CT3198785&SearchSource=48" ]

    *************************

    AdwCleaner[R1].txt - [12977 octets] - [29/04/2013 17:09:31]

    AdwCleaner[R2].txt - [13038 octets] - [29/04/2013 17:37:42]

    AdwCleaner[s1].txt - [13200 octets] - [29/04/2013 17:37:56]

    ########## EOF - C:\AdwCleaner[s1].txt - [13261 octets] ##########

    Whitesmoke toolbar? Total novice, love some help.

    in Resolved Malware Removal Logs

    Posted

    Okay I looked over it, and its all Greek to me, so as long as it gets rid of the problem Im fine with destroying it as long as its not like..school documents or anything which I liked to save.

    # AdwCleaner v2.300 - Logfile created 04/29/2013 at 17:09:31

    # Updated 28/04/2013 by Xplode

    # Operating system : Windows 7 Home Premium Service Pack 1 (64 bits)

    # User : Russell Allsup - RussellAllsup

    # Boot Mode : Normal

    # Running from : C:\Users\Russell Allsup\Downloads\adwcleaner.exe

    # Option [search]

    ***** [services] *****

    Found : vToolbarUpdater14.2.0

    ***** [Files / Folders] *****

    File Found : C:\Program Files (x86)\Mozilla Firefox\searchplugins\avg-secure-search.xml

    File Found : C:\Users\Public\Desktop\eBay.lnk

    File Found : C:\Users\Russell Allsup\AppData\Roaming\Mozilla\Firefox\Profiles\d3p9l5pa.default\searchplugins\Askcom.xml

    Folder Found : C:\Program Files (x86)\Ask.com

    Folder Found : C:\Program Files (x86)\AVG Secure Search

    Folder Found : C:\Program Files (x86)\Common Files\AVG Secure Search

    Folder Found : C:\ProgramData\Ask

    Folder Found : C:\ProgramData\AVG Secure Search

    Folder Found : C:\Users\Russell Allsup\AppData\Local\AVG Secure Search

    Folder Found : C:\Users\Russell Allsup\AppData\LocalLow\AskToolbar

    Folder Found : C:\Users\Russell Allsup\AppData\LocalLow\AVG Secure Search

    Folder Found : C:\Users\Russell Allsup\AppData\Roaming\Mozilla\Firefox\Profiles\d3p9l5pa.default\extensions\toolbar@ask.com

    Folder Found : C:\Windows\Installer\{86D4B82A-ABED-442A-BE86-96357B70F4FE}

    ***** [Registry] *****

    Key Found : HKCU\Software\APN

    Key Found : HKCU\Software\AppDataLow\Software\AskToolbar

    Key Found : HKCU\Software\Ask.com

    Key Found : HKCU\Software\AVG Secure Search

    Key Found : HKCU\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A5AA24EA-11B8-4113-95AE-9ED71DEAF12A}

    Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{95B7759C-8C7F-4BF1-B163-73684A933233}

    Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{D4027C7F-154A-4066-A1AD-4243D8127440}

    Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{95B7759C-8C7F-4BF1-B163-73684A933233}

    Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{D4027C7F-154A-4066-A1AD-4243D8127440}

    Key Found : HKCU\Software\Softonic

    Key Found : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{95B7759C-8C7F-4BF1-B163-73684A933233}

    Key Found : HKLM\Software\APN

    Key Found : HKLM\Software\AskToolbar

    Key Found : HKLM\Software\AVG Secure Search

    Key Found : HKLM\Software\AVG Security Toolbar

    Key Found : HKLM\SOFTWARE\Classes\AppID\{09C554C3-109B-483C-A06B-F14172F1A947}

    Key Found : HKLM\SOFTWARE\Classes\AppID\{1FDFF5A2-7BB1-48E1-8081-7236812B12B2}

    Key Found : HKLM\SOFTWARE\Classes\AppID\{4E1E9D45-8BF9-4139-915C-9F83CC3D5921}

    Key Found : HKLM\SOFTWARE\Classes\AppID\{960DF771-CFCB-4E53-A5B5-6EF2BBE6E706}

    Key Found : HKLM\SOFTWARE\Classes\AppID\{9B0CB95C-933A-4B8C-B6D4-EDCD19A43874}

    Key Found : HKLM\SOFTWARE\Classes\AppID\{B12E99ED-69BD-437C-86BE-C862B9E5444D}

    Key Found : HKLM\SOFTWARE\Classes\AppID\{BB711CB0-C70B-482E-9852-EC05EBD71DBB}

    Key Found : HKLM\SOFTWARE\Classes\AppID\{D7EE8177-D51E-4F89-92B6-83EA2EC40800}

    Key Found : HKLM\SOFTWARE\Classes\AppID\{EA28B360-05E0-4F93-8150-02891F1D8D3C}

    Key Found : HKLM\SOFTWARE\Classes\AppID\escort.DLL

    Key Found : HKLM\SOFTWARE\Classes\AppID\escortApp.DLL

    Key Found : HKLM\SOFTWARE\Classes\AppID\escortEng.DLL

    Key Found : HKLM\SOFTWARE\Classes\AppID\escorTlbr.DLL

    Key Found : HKLM\SOFTWARE\Classes\AppID\esrv.EXE

    Key Found : HKLM\SOFTWARE\Classes\AppID\GenericAskToolbar.DLL

    Key Found : HKLM\SOFTWARE\Classes\AppID\ScriptHelper.EXE

    Key Found : HKLM\SOFTWARE\Classes\AppID\ViProtocol.DLL

    Key Found : HKLM\SOFTWARE\Classes\AVG Secure Search.BrowserWndAPI

    Key Found : HKLM\SOFTWARE\Classes\AVG Secure Search.BrowserWndAPI.1

    Key Found : HKLM\SOFTWARE\Classes\AVG Secure Search.PugiObj

    Key Found : HKLM\SOFTWARE\Classes\AVG Secure Search.PugiObj.1

    Key Found : HKLM\SOFTWARE\Classes\GenericAskToolbar.ToolbarWnd

    Key Found : HKLM\SOFTWARE\Classes\GenericAskToolbar.ToolbarWnd.1

    Key Found : HKLM\Software\Classes\Installer\Features\A28B4D68DEBAA244EB686953B7074FEF

    Key Found : HKLM\Software\Classes\Installer\Products\A28B4D68DEBAA244EB686953B7074FEF

    Key Found : HKLM\SOFTWARE\Classes\PROTOCOLS\Handler\viprotocol

    Key Found : HKLM\SOFTWARE\Classes\S

    Key Found : HKLM\SOFTWARE\Classes\ScriptHelper.ScriptHelperApi

    Key Found : HKLM\SOFTWARE\Classes\ScriptHelper.ScriptHelperApi.1

    Key Found : HKLM\SOFTWARE\Classes\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}

    Key Found : HKLM\SOFTWARE\Classes\TypeLib\{74FB6AFD-DD77-4CEB-83BD-AB2B63E63C93}

    Key Found : HKLM\SOFTWARE\Classes\TypeLib\{9C049BA6-EA47-4AC3-AED6-A66D8DC9E1D8}

    Key Found : HKLM\SOFTWARE\Classes\TypeLib\{C2AC8A0E-E48E-484B-A71C-C7A937FAAB94}

    Key Found : HKLM\SOFTWARE\Classes\ViProtocol.ViProtocolOLE

    Key Found : HKLM\SOFTWARE\Classes\ViProtocol.ViProtocolOLE.1

    Key Found : HKLM\SOFTWARE\Microsoft\Tracing\FunmoodsSetup_RASAPI32

    Key Found : HKLM\SOFTWARE\Microsoft\Tracing\FunmoodsSetup_RASMANCS

    Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{C6FDD0C3-266A-4DC3-B459-28C697C44CDC}

    Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{F25AF245-4A81-40DC-92F9-E9021F207706}

    Key Found : HKLM\SOFTWARE\MozillaPlugins\@avg.com/AVG SiteSafety plugin,version=11.0.0.1,application/x-avg-sitesafety-plugin

    Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{00000000-6E41-4FD3-8538-502F5495E5FC}

    Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{4E92DB5F-AAD9-49D3-8EAB-B40CBE5B1FF7}

    Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{95B7759C-8C7F-4BF1-B163-73684A933233}

    Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{B658800C-F66E-4EF3-AB85-6C0C227862A9}

    Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{D4027C7F-154A-4066-A1AD-4243D8127440}

    Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39}

    Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{F25AF245-4A81-40DC-92F9-E9021F207706}

    Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{03E2A1F3-4402-4121-8B35-733216D61217}

    Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{23C70BCA-6E23-4A65-AD2E-1389062074F1}

    Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{23D8EEF7-0E13-4000-B9C4-6603C1E912D1}

    Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{295CACB4-51F5-46FD-914E-C72BAAE1B672}

    Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{2CE5C4B9-6DBE-4528-96FA-C9FF38EF1762}

    Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{34C1FDF7-02C1-4F23-B393-F48B16E071D1}

    Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{4E92DB5F-AAD9-49D3-8EAB-B40CBE5B1FF7}

    Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{54291324-7A3D-4F11-B707-3FB6A2C97BD9}

    Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{59C63F11-D4E5-46E7-9B8A-EE158DCA83A8}

    Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{5DA22CBD-0029-4A09-B757-CF0FAFC488ED}

    Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{6C434537-053E-486D-B62A-160059D9D456}

    Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{77A6E7D4-4A83-4A9B-A2A0-EF3B125DC29D}

    Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{91CF619A-4686-4CA4-9232-3B2E6B63AA92}

    Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{9E3B11F6-4179-4603-A71B-A55F4BCB0BEC}

    Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{AC71B60E-94C9-4EDE-BA46-E146747BB67E}

    Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{C0585B2F-74D7-4734-88DE-6C150C5D4036}

    Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{C401D2CE-DC27-45C7-BC0C-8E6EA7F085D6}

    Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{CA17D76B-F91D-4659-A7FD-A9F7ED375CDD}

    Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{D8242E89-2F81-484A-AE5B-BA8CAD5B7347}

    Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{EF0588D6-1621-4A75-B8BE-F4BC34794136}

    Key Found : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A5AA24EA-11B8-4113-95AE-9ED71DEAF12A}

    Key Found : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39}

    Key Found : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{F25AF245-4A81-40DC-92F9-E9021F207706}

    Key Found : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{95B7759C-8C7F-4BF1-B163-73684A933233}

    Key Found : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}

    Key Found : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{86D4B82A-ABED-442A-BE86-96357B70F4FE}

    Key Found : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\AVG Secure Search

    Key Found : HKLM\SOFTWARE\Classes\Interface\{03E2A1F3-4402-4121-8B35-733216D61217}

    Key Found : HKLM\SOFTWARE\Classes\Interface\{0D80F1C5-D17B-4177-AC68-955F3EF9F191}

    Key Found : HKLM\SOFTWARE\Classes\Interface\{23C70BCA-6E23-4A65-AD2E-1389062074F1}

    Key Found : HKLM\SOFTWARE\Classes\Interface\{23D8EEF7-0E13-4000-B9C4-6603C1E912D1}

    Key Found : HKLM\SOFTWARE\Classes\Interface\{295CACB4-51F5-46FD-914E-C72BAAE1B672}

    Key Found : HKLM\SOFTWARE\Classes\Interface\{2CE5C4B9-6DBE-4528-96FA-C9FF38EF1762}

    Key Found : HKLM\SOFTWARE\Classes\Interface\{34C1FDF7-02C1-4F23-B393-F48B16E071D1}

    Key Found : HKLM\SOFTWARE\Classes\Interface\{4E92DB5F-AAD9-49D3-8EAB-B40CBE5B1FF7}

    Key Found : HKLM\SOFTWARE\Classes\Interface\{54291324-7A3D-4F11-B707-3FB6A2C97BD9}

    Key Found : HKLM\SOFTWARE\Classes\Interface\{59C63F11-D4E5-46E7-9B8A-EE158DCA83A8}

    Key Found : HKLM\SOFTWARE\Classes\Interface\{5DA22CBD-0029-4A09-B757-CF0FAFC488ED}

    Key Found : HKLM\SOFTWARE\Classes\Interface\{6C434537-053E-486D-B62A-160059D9D456}

    Key Found : HKLM\SOFTWARE\Classes\Interface\{77A6E7D4-4A83-4A9B-A2A0-EF3B125DC29D}

    Key Found : HKLM\SOFTWARE\Classes\Interface\{79FB5FC8-44B9-4AF5-BADD-CCE547F953E5}

    Key Found : HKLM\SOFTWARE\Classes\Interface\{91CF619A-4686-4CA4-9232-3B2E6B63AA92}

    Key Found : HKLM\SOFTWARE\Classes\Interface\{9E3B11F6-4179-4603-A71B-A55F4BCB0BEC}

    Key Found : HKLM\SOFTWARE\Classes\Interface\{AC71B60E-94C9-4EDE-BA46-E146747BB67E}

    Key Found : HKLM\SOFTWARE\Classes\Interface\{C0585B2F-74D7-4734-88DE-6C150C5D4036}

    Key Found : HKLM\SOFTWARE\Classes\Interface\{C401D2CE-DC27-45C7-BC0C-8E6EA7F085D6}

    Key Found : HKLM\SOFTWARE\Classes\Interface\{CA17D76B-F91D-4659-A7FD-A9F7ED375CDD}

    Key Found : HKLM\SOFTWARE\Classes\Interface\{D8242E89-2F81-484A-AE5B-BA8CAD5B7347}

    Key Found : HKLM\SOFTWARE\Classes\Interface\{EF0588D6-1621-4A75-B8BE-F4BC34794136}

    Key Found : HKLM\SOFTWARE\Google\Chrome\Extensions\bbjciahceamgodcoidkjpchnokgfpphh

    Key Found : HKLM\SOFTWARE\Google\Chrome\Extensions\cjpglkicenollcignonpgiafdgfeehoj

    Key Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{B7971660-A1CE-4FDD-B9E0-2C37D77AFB0B}

    Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\A28B4D68DEBAA244EB686953B7074FEF

    Key Found : HKU\S-1-5-21-3013127783-3903512391-2632275378-1001\Software\Microsoft\Internet Explorer\SearchScopes\{95B7759C-8C7F-4BF1-B163-73684A933233}

    Value Found : HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks [{00000000-6E41-4FD3-8538-502F5495E5FC}]

    Value Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run [ApnUpdater]

    Value Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run [vProt]

    Value Found : HKLM\SOFTWARE\Mozilla\Firefox\Extensions [Avg@toolbar]

    Value Found : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar [{95B7759C-8C7F-4BF1-B163-73684A933233}]

    Value Found : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar [{D4027C7F-154A-4066-A1AD-4243D8127440}]

    ***** [internet Browsers] *****

    -\\ Internet Explorer v9.0.8112.16476

    [HKLM\SOFTWARE\Microsoft\Internet Explorer\Main - Start Page] = hxxp://searchfunmoods.com/?f=1&a=download&chnl=download&cd=2XzuyEtN2Y1L1QzuyEyEyC0DyDyB0B0A0D0DzytB0EtDyE0EtN0D0Tzu0CtAtBzytN1L2XzutBtFtBtFtDtFtAyEyE&cr=1632136062

    -\\ Mozilla Firefox v20.0.1 (en-US)

    File : C:\Users\Russell Allsup\AppData\Roaming\Mozilla\Firefox\Profiles\d3p9l5pa.default\prefs.js

    Found : user_pref("browser.search.defaultengine", "Ask.com");

    Found : user_pref("browser.search.defaultenginename", "Ask.com");

    Found : user_pref("browser.search.order.1", "Ask.com");

    Found : user_pref("extensions.asktb.ff-original-keyword-url", "");

    Found : user_pref("keyword.URL", "hxxp://websearch.ask.com/redirect?client=ff&src=kw&tb=ORJ&o=&locale=&apn_u[...]

    -\\ Google Chrome v26.0.1410.64

    File : C:\Users\Russell Allsup\AppData\Local\Google\Chrome\User Data\Default\Preferences

    Found [l.2634] : urls_to_restore_on_startup = [ "hxxp://search.conduit.com/?ctid=CT3198785&SearchSource=48" ]

    *************************

    AdwCleaner[R1].txt - [12902 octets] - [29/04/2013 17:09:31]

    ########## EOF - C:\AdwCleaner[R1].txt - [12963 octets] ##########

    Whitesmoke toolbar? Total novice, love some help.

    in Resolved Malware Removal Logs

    Posted

    Okay thanks Charlie, also I had previously deleted utorrent (this is a used laptop) but I dont really know what other "bad" programs will affect it, so just let me know, heres the two now

    DDS (Ver_2012-11-20.01) - NTFS_AMD64

    Internet Explorer: 9.0.8112.16476 BrowserJavaVersion: 10.11.2

    Run by Russell Allsup at 16:55:38 on 2013-04-29

    .

    ============== Running Processes ================

    .

    C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe

    C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

    C:\Program Files (x86)\Launch Manager\dsiwmis.exe

    C:\Program Files (x86)\Acer\Registration\GREGsvc.exe

    C:\Program Files (x86)\Launch Manager\LMutilps32.exe

    C:\Program Files (x86)\Intel\Intel® Management Engine Components\FWService\IntelMeFWService.exe

    C:\Program Files (x86)\Intel\Intel® Management Engine Components\DAL\jhi_service.exe

    C:\Program Files\Acer\Acer Updater\UpdaterService.exe

    C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe

    C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe

    C:\Program Files (x86)\NTI\Acer Backup Manager\IScheduleSvc.exe

    C:\Program Files (x86)\Winsim\ConnectionManager\SimplyConnectionManager.exe

    C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe

    C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\14.2.0\ToolbarUpdater.exe

    C:\Program Files (x86)\Atheros\Ath_WlanAgent.exe

    C:\Program Files (x86)\Google\Drive\googledrivesync.exe

    C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe

    C:\Program Files (x86)\NTI\Acer Backup Manager\BackupManagerTray.exe

    C:\Program Files (x86)\Launch Manager\LManager.exe

    C:\Program Files (x86)\iTunes\iTunesHelper.exe

    C:\Program Files (x86)\winsim\ConnectionManager\Simply.SystemTrayIcon.exe

    C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe

    C:\Program Files (x86)\AVG Secure Search\vprot.exe

    C:\Program Files (x86)\PowerISO\PWRISOVM.EXE

    C:\Program Files (x86)\Launch Manager\LMworker.exe

    C:\Program Files (x86)\Google\Drive\googledrivesync.exe

    C:\Program Files (x86)\CyberLink\MediaEspresso\DeviceDetector\DeviceDetector.exe

    C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe

    C:\Program Files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe

    C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe

    C:\Program Files (x86)\Intel\Intel® ME FW Recovery Agent\bin\ismagent.exe

    C:\Program Files (x86)\Intel\Intel® ME FW Recovery Agent\bin\updateui.exe

    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

    .

    ============== Pseudo HJT Report ===============

    .

    uStart Page = hxxps://www.google.ca/

    uDefault_Page_URL = hxxp://acer.msn.com

    mStart Page = hxxp://www.google.com

    mDefault_Page_URL = hxxp://acer.msn.com

    uURLSearchHooks: UrlSearchHook Class: {00000000-6E41-4FD3-8538-502F5495E5FC} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll

    mWinlogon: Userinit = userinit.exe,

    BHO: Adobe PDF Link Helper: {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

    BHO: Groove GFS Browser Helper: {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files (x86)\Microsoft Office\Office14\GROOVEEX.DLL

    BHO: Java Plug-In SSV Helper: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll

    BHO: scriptproxy: {7DB2D5A0-7241-4E79-B68D-6309F01C5231} -

    BHO: Windows Live ID Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

    BHO: AVG Security Toolbar: {95B7759C-8C7F-4BF1-B163-73684A933233} - C:\Program Files (x86)\AVG Secure Search\14.2.0.1\AVG Secure Search_toolbar.dll

    BHO: Office Document Cache Handler: {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL

    BHO: Ask Toolbar: {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll

    BHO: Java Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll

    TB: Ask Toolbar: {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll

    TB: AVG Security Toolbar: {95B7759C-8C7F-4BF1-B163-73684A933233} - C:\Program Files (x86)\AVG Secure Search\14.2.0.1\AVG Secure Search_toolbar.dll

    uRun: [GoogleDriveSync] "C:\Program Files (x86)\Google\Drive\googledrivesync.exe" /autostart

    mRun: [suiteTray] "C:\Program Files (x86)\EgisTec MyWinLockerSuite\x86\SuiteTray.exe"

    mRun: [Norton Online Backup] C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuClient.exe

    mRun: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"

    mRun: [backupManagerTray] "C:\Program Files (x86)\NTI\Acer Backup Manager\BackupManagerTray.exe" -h -k

    mRun: [LManager] C:\Program Files (x86)\Launch Manager\LManager.exe

    mRun: [APSDaemon] "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe"

    mRun: [iTunesHelper] "C:\Program Files (x86)\iTunes\iTunesHelper.exe"

    mRun: [ConnectionManager] C:\Program Files (x86)\Winsim\ConnectionManager\Simply.SystemTrayIcon.exe

    mRun: [sunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"

    mRun: [ApnUpdater] "C:\Program Files (x86)\Ask.com\Updater\Updater.exe"

    mRun: [vProt] "C:\Program Files (x86)\AVG Secure Search\vprot.exe"

    mRun: [PWRISOVM.EXE] C:\Program Files (x86)\PowerISO\PWRISOVM.EXE -startup

    dRunOnce: [isMyWinLockerReboot] msiexec.exe /qn /x{voidguid}

    mPolicies-Explorer: NoActiveDesktop = dword:1

    mPolicies-Explorer: NoActiveDesktopChanges = dword:1

    mPolicies-System: ConsentPromptBehaviorAdmin = dword:5

    mPolicies-System: ConsentPromptBehaviorUser = dword:3

    mPolicies-System: EnableUIADesktopToggle = dword:0

    mPolicies-System: PromptOnSecureDesktop = dword:0

    IE: E&xport to Microsoft Excel - C:\PROGRA~2\MICROS~4\Office14\EXCEL.EXE/3000

    IE: Se&nd to OneNote - C:\PROGRA~2\MICROS~4\Office14\ONBttnIE.dll/105

    IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll

    IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIE.dll

    IE: {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - {FFFDC614-B694-4AE6-AB38-5D6374584B52} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIELinkedNotes.dll

    IE: {A95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\Program Files (x86)\Evernote\Evernote\EvernoteIE.dll/204

    TCP: NameServer = 64.59.144.93 64.59.150.139

    TCP: Interfaces\{8B9FF3CB-5252-4DA4-AD05-E5DD0C4DCD41} : DHCPNameServer = 40.31.1.201 40.31.1.202

    TCP: Interfaces\{EC1FE264-712B-4417-9DE8-4F8BA78CEFFA} : DHCPNameServer = 64.59.144.93 64.59.150.139

    TCP: Interfaces\{EC1FE264-712B-4417-9DE8-4F8BA78CEFFA}\356455E45445D2355434552554 : DHCPNameServer = 206.12.16.14 142.58.103.2

    TCP: Interfaces\{EC1FE264-712B-4417-9DE8-4F8BA78CEFFA}\35E46475D27457563747 : DHCPNameServer = 64.253.129.3 64.253.129.4

    TCP: Interfaces\{EC1FE264-712B-4417-9DE8-4F8BA78CEFFA}\D496B65697 : DHCPNameServer = 192.168.1.254 75.153.176.9

    Filter: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL

    Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll

    Handler: viprotocol - {B658800C-F66E-4EF3-AB85-6C0C227862A9} - C:\Program Files (x86)\Common Files\AVG Secure Search\ViProtocolInstaller\14.2.0\ViProtocol.dll

    Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files (x86)\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll

    SSODL: WebCheck - <orphaned>

    SEH: Groove GFS Stub Execution Hook - {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\Program Files (x86)\Microsoft Office\Office14\GROOVEEX.DLL

    mASetup: {8A69D345-D564-463c-AFF1-A69D9E530F96} - "C:\Program Files (x86)\Google\Chrome\Application\26.0.1410.64\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --multi-install --chrome

    x64-mStart Page = hxxp://searchfunmoods.com/?f=1&a=download&chnl=download&cd=2XzuyEtN2Y1L1QzuyEyEyC0DyDyB0B0A0D0DzytB0EtDyE0EtN0D0Tzu0CtAtBzytN1L2XzutBtFtBtFtDtFtAyEyE&cr=1632136062

    x64-mDefault_Page_URL = hxxp://acer.msn.com

    x64-BHO: Groove GFS Browser Helper: {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL

    x64-BHO: scriptproxy: {7DB2D5A0-7241-4E79-B68D-6309F01C5231} -

    x64-BHO: Windows Live ID Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

    x64-BHO: Office Document Cache Handler: {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL

    x64-Run: [igfxTray] C:\Windows\System32\igfxtray.exe

    x64-Run: [HotKeysCmds] C:\Windows\System32\hkcmd.exe

    x64-Run: [Persistence] C:\Windows\System32\igfxpers.exe

    x64-Run: [RTHDVCPL] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe -s

    x64-Run: [synTPEnh] C:\Program Files (x86)\Synaptics\SynTP\SynTPEnh.exe

    x64-Run: [Power Management] C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe

    x64-Run: [bCSSync] "C:\Program Files\Microsoft Office\Office14\BCSSync.exe" /DelayServices

    x64-IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - C:\Program Files\Microsoft Office\Office14\ONBttnIE.dll

    x64-IE: {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - {FFFDC614-B694-4AE6-AB38-5D6374584B52} - C:\Program Files\Microsoft Office\Office14\ONBttnIELinkedNotes.dll

    x64-Filter: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL

    x64-Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - <orphaned>

    x64-Handler: viprotocol - {B658800C-F66E-4EF3-AB85-6C0C227862A9} - <orphaned>

    x64-Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - <orphaned>

    x64-Notify: igfxcui - igfxdev.dll

    x64-SSODL: WebCheck - <orphaned>

    x64-SEH: Groove GFS Stub Execution Hook - {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL

    .

    ================= FIREFOX ===================

    .

    FF - ProfilePath - C:\Users\Russell Allsup\AppData\Roaming\Mozilla\Firefox\Profiles\d3p9l5pa.default\

    FF - prefs.js: browser.search.selectedEngine - Google

    FF - prefs.js: browser.startup.homepage - hxxps://www.google.ca/

    FF - prefs.js: keyword.URL - hxxp://websearch.ask.com/redirect?client=ff&src=kw&tb=ORJ&o=&locale=&apn_uid=8F75D01F-B9A9-47E9-A490-48384D7F442B&apn_ptnrs=U3&apn_sauid=9D87180F-40F9-4A86-B984-CD09570B008D&apn_dtid=OSJ000YYCA&&q=

    FF - plugin: C:\PROGRA~2\MICROS~4\Office14\NPAUTHZ.DLL

    FF - plugin: C:\PROGRA~2\MICROS~4\Office14\NPSPWRAP.DLL

    FF - plugin: C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll

    FF - plugin: C:\Program Files (x86)\Common Files\AVG Secure Search\SiteSafetyInstaller\14.2.0\npsitesafety.dll

    FF - plugin: C:\Program Files (x86)\Google\Update\1.3.21.135\npGoogleUpdate3.dll

    FF - plugin: C:\Program Files (x86)\Intel\Intel® Management Engine Components\IPT\npIntelWebAPIIPT.dll

    FF - plugin: C:\Program Files (x86)\Intel\Intel® Management Engine Components\IPT\npIntelWebAPIUpdater.dll

    FF - plugin: C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll

    FF - plugin: c:\Program Files (x86)\Microsoft Silverlight\5.1.20125.0\npctrlui.dll

    FF - plugin: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll

    FF - plugin: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_6_602_180.dll

    FF - plugin: C:\Windows\SysWOW64\npDeployJava1.dll

    FF - plugin: C:\Windows\SysWOW64\npmproxy.dll

    .

    ============= SERVICES / DRIVERS ===============

    .

    R? clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86

    R? clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64

    R? EgisTec Ticket Service;EgisTec Ticket Service

    R? ose64;Office 64 Source Engine

    R? Sage 50 Transaction Manager 2013 - CDN;Sage 50 Transaction Manager 2013 - CDN

    R? Sage Simply Accounting Transaction Manager 2012 - CDN;Sage Simply Accounting Transaction Manager 2012 - CDN

    R? SkypeUpdate;Skype Updater

    R? TsUsbFlt;TsUsbFlt

    R? TsUsbGD;Remote Desktop Generic USB Device

    R? USBAAPL64;Apple Mobile USB Driver

    R? WatAdminSvc;Windows Activation Technologies Service

    R? wlcrasvc;Windows Live Mesh remote connections service

    S? avgtp;avgtp

    S? DsiWMIService;Dritek WMI Service

    S? ePowerSvc;ePower Service

    S? GREGService;GREGService

    S? IAStorDataMgrSvc;Intel® Rapid Storage Technology

    S? IntcDAud;Intel® Display Audio

    S? Intel® Capability Licensing Service Interface;Intel® Capability Licensing Service Interface

    S? Intel® ME Service;Intel® ME Service

    S? jhi_service;Intel® Dynamic Application Loader Host Interface Service

    S? Live Updater Service;Live Updater Service

    S? MBAMProtector;MBAMProtector

    S? MBAMScheduler;MBAMScheduler

    S? MBAMService;MBAMService

    S? mwlPSDFilter;mwlPSDFilter

    S? mwlPSDNServ;mwlPSDNServ

    S? mwlPSDVDisk;mwlPSDVDisk

    S? NOBU;Norton Online Backup

    S? NTI IScheduleSvc;NTI IScheduleSvc

    S? RSBASTOR;Realtek PCIE CardReader Driver - BA

    S? RTL8167;Realtek 8167 NT Driver

    S? Simply Accounting Database Connection Manager;Sage 50 Database Connection Manager

    S? SmbDrv;SmbDrv

    S? UNS;Intel® Management and Security Application User Notification Service

    S? vToolbarUpdater14.2.0;vToolbarUpdater14.2.0

    S? ZAtheros Wlan Agent;ZAtheros Wlan Agent

    .

    =============== Created Last 30 ================

    .

    2013-04-27 07:19:49 9317456 ----a-w- C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{2EFD7609-2432-45BC-94C5-E0F0990F632E}\mpengine.dll

    2013-04-25 04:35:43 1656680 ----a-w- C:\Windows\System32\drivers\ntfs.sys

    2013-04-16 07:31:30 -------- d-----w- C:\Program Files\Microsoft Mouse and Keyboard Center

    2013-04-09 21:43:10 3717632 ----a-w- C:\Windows\System32\mstscax.dll

    2013-04-09 21:43:09 3217408 ----a-w- C:\Windows\SysWow64\mstscax.dll

    2013-04-09 21:43:08 44032 ----a-w- C:\Windows\System32\tsgqec.dll

    2013-04-09 21:43:08 36864 ----a-w- C:\Windows\SysWow64\tsgqec.dll

    2013-04-09 21:43:08 158720 ----a-w- C:\Windows\System32\aaclient.dll

    2013-04-09 21:43:08 131584 ----a-w- C:\Windows\SysWow64\aaclient.dll

    2013-04-09 21:43:00 3153408 ----a-w- C:\Windows\System32\win32k.sys

    2013-04-09 21:42:57 223752 ----a-w- C:\Windows\System32\drivers\fvevol.sys

    2013-04-09 21:42:56 5550424 ----a-w- C:\Windows\System32\ntoskrnl.exe

    2013-04-09 21:42:54 3968856 ----a-w- C:\Windows\SysWow64\ntkrnlpa.exe

    2013-04-09 21:42:54 3913560 ----a-w- C:\Windows\SysWow64\ntoskrnl.exe

    2013-04-09 21:42:53 6656 ----a-w- C:\Windows\SysWow64\apisetschema.dll

    2013-04-09 21:42:53 43520 ----a-w- C:\Windows\System32\csrsrv.dll

    2013-04-09 21:42:53 112640 ----a-w- C:\Windows\System32\smss.exe

    2013-04-06 03:16:18 -------- d-----w- C:\Users\Russell Allsup\AppData\Local\{89708595-3751-4868-8E1C-8A3D7997D903}

    2013-04-06 03:14:49 -------- d-----w- C:\Users\Russell Allsup\AppData\Local\{4BEC1E29-3DEE-4CA8-9C9B-2E631048E53B}

    2013-03-31 19:49:42 -------- d-----w- C:\Users\Russell Allsup\AppData\Local\{4EB46E8F-FEA2-4F97-9022-9190B29586BA}

    .

    ==================== Find3M ====================

    .

    2013-04-04 21:50:32 25928 ----a-w- C:\Windows\System32\drivers\mbam.sys

    2013-03-13 07:58:22 73432 ----a-w- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl

    2013-03-13 07:58:22 693976 ----a-w- C:\Windows\SysWow64\FlashPlayerApp.exe

    2013-03-12 08:10:56 282744 ------w- C:\Windows\System32\MpSigStub.exe

    2013-02-22 06:27:49 2312704 ----a-w- C:\Windows\System32\jscript9.dll

    2013-02-22 06:20:51 1392128 ----a-w- C:\Windows\System32\wininet.dll

    2013-02-22 06:19:37 1494528 ----a-w- C:\Windows\System32\inetcpl.cpl

    2013-02-22 06:15:48 173056 ----a-w- C:\Windows\System32\ieUnatt.exe

    2013-02-22 06:15:23 599040 ----a-w- C:\Windows\System32\vbscript.dll

    2013-02-22 06:12:41 2382848 ----a-w- C:\Windows\System32\mshtml.tlb

    2013-02-22 03:46:00 1800704 ----a-w- C:\Windows\SysWow64\jscript9.dll

    2013-02-22 03:38:00 1129472 ----a-w- C:\Windows\SysWow64\wininet.dll

    2013-02-22 03:37:50 1427968 ----a-w- C:\Windows\SysWow64\inetcpl.cpl

    2013-02-22 03:34:17 142848 ----a-w- C:\Windows\SysWow64\ieUnatt.exe

    2013-02-22 03:34:03 420864 ----a-w- C:\Windows\SysWow64\vbscript.dll

    2013-02-22 03:31:46 2382848 ----a-w- C:\Windows\SysWow64\mshtml.tlb

    2013-02-19 06:53:09 39768 ----a-w- C:\Windows\System32\drivers\avgtpx64.sys

    2013-02-12 05:45:24 135168 ----a-w- C:\Windows\apppatch\AppPatch64\AcXtrnal.dll

    2013-02-12 05:45:22 350208 ----a-w- C:\Windows\apppatch\AppPatch64\AcLayers.dll

    2013-02-12 05:45:22 308736 ----a-w- C:\Windows\apppatch\AppPatch64\AcGenral.dll

    2013-02-12 05:45:22 111104 ----a-w- C:\Windows\apppatch\AppPatch64\acspecfc.dll

    2013-02-12 04:48:31 474112 ----a-w- C:\Windows\apppatch\AcSpecfc.dll

    2013-02-12 04:48:26 2176512 ----a-w- C:\Windows\apppatch\AcGenral.dll

    2013-02-12 04:12:05 19968 ----a-w- C:\Windows\System32\drivers\usb8023.sys

    2013-02-02 05:06:07 205 ----a-w- C:\Windows\SysWow64\lsprst7.dll

    2013-01-30 01:15:06 862664 ----a-w- C:\Windows\SysWow64\msvcr110.dll

    2013-01-30 01:15:06 828872 ----a-w- C:\Windows\System32\msvcr110.dll

    2013-01-30 01:15:06 661448 ----a-w- C:\Windows\System32\msvcp110.dll

    2013-01-30 01:15:06 534480 ----a-w- C:\Windows\SysWow64\msvcp110.dll

    2013-01-30 01:15:06 354264 ----a-w- C:\Windows\System32\vccorlib110.dll

    2013-01-30 01:15:06 251864 ----a-w- C:\Windows\SysWow64\vccorlib110.dll

    2013-01-30 01:15:04 50800 ----a-w- C:\Windows\System32\drivers\point64.sys

    2013-01-30 01:15:04 1795952 ----a-w- C:\Windows\System32\WdfCoInstaller01011.dll

    .

    ============= FINISH: 16:56:05.67 ===============

    .

    ==== Installed Programs ======================

    .

    clear.fi SDK- Movie 2

    clear.fi SDK - MVP 2

    Acer Backup Manager

    Acer Crystal Eye Webcam

    Acer ePower Management

    Acer eRecovery Management

    Acer Registration

    Acer ScreenSaver

    Acer Updater

    Adobe AIR

    Adobe Flash Player 11 ActiveX

    Adobe Flash Player 11 Plugin

    Adobe Reader X (10.1.5) MUI

    Apple Application Support

    Apple Mobile Device Support

    Apple Software Update

    Ask Toolbar

    AVG Security Toolbar

    Backup Manager V3

    Bonjour

    clear.fi Media

    clear.fi Photo

    CyberLink MediaEspresso

    D3DX10

    Definition Update for Microsoft Office 2010 (KB982726) 64-Bit Edition

    eBay Worldwide

    Evernote v. 4.5.2

    Fooz Kids

    Fooz Kids Platform

    Galerie de photos Windows Live

    Galería fotográfica de Windows Live

    Google Chrome

    Google Drive

    Google Update Helper

    IBM SPSS Statistics 21

    Identity Card

    Intel® Control Center

    Intel® Manageability Engine Firmware Recovery Agent

    Intel® Management Engine Components

    Intel® OpenCL CPU Runtime

    Intel® Processor Graphics

    Intel® Rapid Storage Technology

    Intel® Trusted Connect Service Client

    iTunes

    Java 7 Update 11

    Java Auto Updater

    Junk Mail filter update

    Kobo

    Launch Manager

    Malwarebytes Anti-Malware version 1.75.0.1300

    Mesh Runtime

    Microsoft .NET Framework 4 Client Profile

    Microsoft .NET Framework 4 Extended

    Microsoft Application Error Reporting

    Microsoft Mouse and Keyboard Center

    Microsoft Office 2010 Service Pack 1 (SP1)

    Microsoft Office Access MUI (English) 2010

    Microsoft Office Access Setup Metadata MUI (English) 2010

    Microsoft Office Excel MUI (English) 2010

    Microsoft Office Groove MUI (English) 2010

    Microsoft Office InfoPath MUI (English) 2010

    Microsoft Office Office 32-bit Components 2010

    Microsoft Office OneNote MUI (English) 2010

    Microsoft Office Outlook MUI (English) 2010

    Microsoft Office PowerPoint MUI (English) 2010

    Microsoft Office Professional Plus 2010

    Microsoft Office Proof (English) 2010

    Microsoft Office Proof (French) 2010

    Microsoft Office Proof (Spanish) 2010

    Microsoft Office Proofing (English) 2010

    Microsoft Office Publisher MUI (English) 2010

    Microsoft Office Shared 32-bit MUI (English) 2010

    Microsoft Office Shared MUI (English) 2010

    Microsoft Office Shared Setup Metadata MUI (English) 2010

    Microsoft Office Word MUI (English) 2010

    Microsoft Silverlight

    Microsoft SQL Server 2005 Compact Edition [ENU]

    Microsoft Visual C++ 2005 Redistributable

    Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17

    Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161

    Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17

    Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148

    Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161

    Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219

    Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219

    Microsoft Visual Studio 2010 Tools for Office Runtime (x64)

    Mozilla Firefox 20.0.1 (x86 en-US)

    Mozilla Maintenance Service

    MSVCRT

    MSVCRT_amd64

    MSXML 4.0 SP2 (KB954430)

    MSXML 4.0 SP2 (KB973688)

    MySQL Connector/ODBC 3.51

    MyWinLocker

    MyWinLocker 4

    MyWinLocker Suite

    newsXpresso

    Norton Online Backup

    NTI Media Maker 9

    PowerISO

    Qualcomm Atheros WiFi Driver Installation

    Realtek Ethernet Controller Driver

    Realtek High Definition Audio Driver

    Realtek PCIE Card Reader

    Sage 50 Accounting 2013

    Sage Simply Accounting 2012

    Secure Download Manager

    Security Update for Microsoft .NET Framework 4 Client Profile (KB2604121)

    Security Update for Microsoft .NET Framework 4 Client Profile (KB2656351)

    Security Update for Microsoft .NET Framework 4 Client Profile (KB2656368v2)

    Security Update for Microsoft .NET Framework 4 Client Profile (KB2656405)

    Security Update for Microsoft .NET Framework 4 Client Profile (KB2686827)

    Security Update for Microsoft .NET Framework 4 Client Profile (KB2729449)

    Security Update for Microsoft .NET Framework 4 Client Profile (KB2736428)

    Security Update for Microsoft .NET Framework 4 Client Profile (KB2737019)

    Security Update for Microsoft .NET Framework 4 Client Profile (KB2742595)

    Security Update for Microsoft .NET Framework 4 Client Profile (KB2789642)

    Security Update for Microsoft .NET Framework 4 Extended (KB2487367)

    Security Update for Microsoft .NET Framework 4 Extended (KB2656351)

    Security Update for Microsoft .NET Framework 4 Extended (KB2736428)

    Security Update for Microsoft .NET Framework 4 Extended (KB2742595)

    Security Update for Microsoft Excel 2010 (KB2597126) 64-Bit Edition

    Security Update for Microsoft Filter Pack 2.0 (KB2553501) 64-Bit Edition

    Security Update for Microsoft InfoPath 2010 (KB2687422) 64-Bit Edition

    Security Update for Microsoft InfoPath 2010 (KB2760406) 64-Bit Edition

    Security Update for Microsoft Office 2010 (KB2553091)

    Security Update for Microsoft Office 2010 (KB2553096)

    Security Update for Microsoft Office 2010 (KB2553371) 64-Bit Edition

    Security Update for Microsoft Office 2010 (KB2553447) 64-Bit Edition

    Security Update for Microsoft Office 2010 (KB2589320) 64-Bit Edition

    Security Update for Microsoft Office 2010 (KB2598243) 64-Bit Edition

    Security Update for Microsoft Office 2010 (KB2687501) 64-Bit Edition

    Security Update for Microsoft Office 2010 (KB2687510) 64-Bit Edition

    Security Update for Microsoft OneNote 2010 (KB2760600) 64-Bit Edition

    Security Update for Microsoft Visio 2010 (KB2760762) 64-Bit Edition

    Security Update for Microsoft Visio Viewer 2010 (KB2687505) 64-Bit Edition

    Security Update for Microsoft Word 2010 (KB2760410) 64-Bit Edition

    Shared C Run-time for x64

    Shredder

    Skype™ 6.0

    Synaptics Pointing Device Driver

    Update for Microsoft .NET Framework 4 Client Profile (KB2468871)

    Update for Microsoft .NET Framework 4 Client Profile (KB2533523)

    Update for Microsoft .NET Framework 4 Client Profile (KB2600217)

    Update for Microsoft .NET Framework 4 Extended (KB2468871)

    Update for Microsoft .NET Framework 4 Extended (KB2533523)

    Update for Microsoft .NET Framework 4 Extended (KB2600217)

    Update for Microsoft Office 2010 (KB2553065)

    Update for Microsoft Office 2010 (KB2553092)

    Update for Microsoft Office 2010 (KB2553181) 64-Bit Edition

    Update for Microsoft Office 2010 (KB2553267) 64-Bit Edition

    Update for Microsoft Office 2010 (KB2553310) 64-Bit Edition

    Update for Microsoft Office 2010 (KB2553378) 64-Bit Edition

    Update for Microsoft Office 2010 (KB2566458)

    Update for Microsoft Office 2010 (KB2598242) 64-Bit Edition

    Update for Microsoft Office 2010 (KB2687509) 64-Bit Edition

    Update for Microsoft Office 2010 (KB2760631) 64-Bit Edition

    Update for Microsoft Office 2010 (KB2767886) 64-Bit Edition

    Update for Microsoft OneNote 2010 (KB2553290) 64-Bit Edition

    Update for Microsoft Outlook 2010 (KB2597090) 64-Bit Edition

    Update for Microsoft Outlook 2010 (KB2687623) 64-Bit Edition

    Update for Microsoft Outlook Social Connector 2010 (KB2553406) 64-Bit Edition

    Update for Microsoft PowerPoint 2010 (KB2598240) 64-Bit Edition

    Update for Microsoft SharePoint Workspace 2010 (KB2589371) 64-Bit Edition

    Vuze

    Welcome Center

    Windows Live

    Windows Live Communications Platform

    Windows Live Essentials

    Windows Live Galeria de Fotos

    Windows Live ID Sign-in Assistant

    Windows Live Installer

    Windows Live Language Selector

    Windows Live Mail

    Windows Live Mesh

    Windows Live Messenger

    Windows Live MIME IFilter

    Windows Live Movie Maker

    Windows Live Photo Common

    Windows Live Photo Gallery

    Windows Live PIMT Platform

    Windows Live Remote Client

    Windows Live Remote Client Resources

    Windows Live Remote Service

    Windows Live Remote Service Resources

    Windows Live SOXE

    Windows Live SOXE Definitions

    Windows Live UX Platform

    Windows Live UX Platform Language Pack

    Windows Live Writer

    Windows Live Writer Resources

    .

    ==== End Of File ===========================

    Whitesmoke toolbar? Total novice, love some help.

    in Resolved Malware Removal Logs

    Posted

    So this may or may not be it, but i just googled how to do a DDS log and it led me to this...let me know if this is right or wrong and ill try and fix it.

    DDS (Ver_2012-11-20.01) - NTFS_AMD64

    Internet Explorer: 9.0.8112.16476 BrowserJavaVersion: 10.11.2

    Run by Russell Allsup at 16:55:38 on 2013-04-29

    .

    ============== Running Processes ================

    .

    C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe

    C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

    C:\Program Files (x86)\Launch Manager\dsiwmis.exe

    C:\Program Files (x86)\Acer\Registration\GREGsvc.exe

    C:\Program Files (x86)\Launch Manager\LMutilps32.exe

    C:\Program Files (x86)\Intel\Intel® Management Engine Components\FWService\IntelMeFWService.exe

    C:\Program Files (x86)\Intel\Intel® Management Engine Components\DAL\jhi_service.exe

    C:\Program Files\Acer\Acer Updater\UpdaterService.exe

    C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe

    C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe

    C:\Program Files (x86)\NTI\Acer Backup Manager\IScheduleSvc.exe

    C:\Program Files (x86)\Winsim\ConnectionManager\SimplyConnectionManager.exe

    C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe

    C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\14.2.0\ToolbarUpdater.exe

    C:\Program Files (x86)\Atheros\Ath_WlanAgent.exe

    C:\Program Files (x86)\Google\Drive\googledrivesync.exe

    C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe

    C:\Program Files (x86)\NTI\Acer Backup Manager\BackupManagerTray.exe

    C:\Program Files (x86)\Launch Manager\LManager.exe

    C:\Program Files (x86)\iTunes\iTunesHelper.exe

    C:\Program Files (x86)\winsim\ConnectionManager\Simply.SystemTrayIcon.exe

    C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe

    C:\Program Files (x86)\AVG Secure Search\vprot.exe

    C:\Program Files (x86)\PowerISO\PWRISOVM.EXE

    C:\Program Files (x86)\Launch Manager\LMworker.exe

    C:\Program Files (x86)\Google\Drive\googledrivesync.exe

    C:\Program Files (x86)\CyberLink\MediaEspresso\DeviceDetector\DeviceDetector.exe

    C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe

    C:\Program Files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe

    C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe

    C:\Program Files (x86)\Intel\Intel® ME FW Recovery Agent\bin\ismagent.exe

    C:\Program Files (x86)\Intel\Intel® ME FW Recovery Agent\bin\updateui.exe

    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

    .

    ============== Pseudo HJT Report ===============

    .

    uStart Page = hxxps://www.google.ca/

    uDefault_Page_URL = hxxp://acer.msn.com

    mStart Page = hxxp://www.google.com

    mDefault_Page_URL = hxxp://acer.msn.com

    uURLSearchHooks: UrlSearchHook Class: {00000000-6E41-4FD3-8538-502F5495E5FC} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll

    mWinlogon: Userinit = userinit.exe,

    BHO: Adobe PDF Link Helper: {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

    BHO: Groove GFS Browser Helper: {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files (x86)\Microsoft Office\Office14\GROOVEEX.DLL

    BHO: Java Plug-In SSV Helper: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll

    BHO: scriptproxy: {7DB2D5A0-7241-4E79-B68D-6309F01C5231} -

    BHO: Windows Live ID Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

    BHO: AVG Security Toolbar: {95B7759C-8C7F-4BF1-B163-73684A933233} - C:\Program Files (x86)\AVG Secure Search\14.2.0.1\AVG Secure Search_toolbar.dll

    BHO: Office Document Cache Handler: {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL

    BHO: Ask Toolbar: {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll

    BHO: Java Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll

    TB: Ask Toolbar: {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll

    TB: AVG Security Toolbar: {95B7759C-8C7F-4BF1-B163-73684A933233} - C:\Program Files (x86)\AVG Secure Search\14.2.0.1\AVG Secure Search_toolbar.dll

    uRun: [GoogleDriveSync] "C:\Program Files (x86)\Google\Drive\googledrivesync.exe" /autostart

    mRun: [suiteTray] "C:\Program Files (x86)\EgisTec MyWinLockerSuite\x86\SuiteTray.exe"

    mRun: [Norton Online Backup] C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuClient.exe

    mRun: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"

    mRun: [backupManagerTray] "C:\Program Files (x86)\NTI\Acer Backup Manager\BackupManagerTray.exe" -h -k

    mRun: [LManager] C:\Program Files (x86)\Launch Manager\LManager.exe

    mRun: [APSDaemon] "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe"

    mRun: [iTunesHelper] "C:\Program Files (x86)\iTunes\iTunesHelper.exe"

    mRun: [ConnectionManager] C:\Program Files (x86)\Winsim\ConnectionManager\Simply.SystemTrayIcon.exe

    mRun: [sunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"

    mRun: [ApnUpdater] "C:\Program Files (x86)\Ask.com\Updater\Updater.exe"

    mRun: [vProt] "C:\Program Files (x86)\AVG Secure Search\vprot.exe"

    mRun: [PWRISOVM.EXE] C:\Program Files (x86)\PowerISO\PWRISOVM.EXE -startup

    dRunOnce: [isMyWinLockerReboot] msiexec.exe /qn /x{voidguid}

    mPolicies-Explorer: NoActiveDesktop = dword:1

    mPolicies-Explorer: NoActiveDesktopChanges = dword:1

    mPolicies-System: ConsentPromptBehaviorAdmin = dword:5

    mPolicies-System: ConsentPromptBehaviorUser = dword:3

    mPolicies-System: EnableUIADesktopToggle = dword:0

    mPolicies-System: PromptOnSecureDesktop = dword:0

    IE: E&xport to Microsoft Excel - C:\PROGRA~2\MICROS~4\Office14\EXCEL.EXE/3000

    IE: Se&nd to OneNote - C:\PROGRA~2\MICROS~4\Office14\ONBttnIE.dll/105

    IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll

    IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIE.dll

    IE: {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - {FFFDC614-B694-4AE6-AB38-5D6374584B52} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIELinkedNotes.dll

    IE: {A95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\Program Files (x86)\Evernote\Evernote\EvernoteIE.dll/204

    TCP: NameServer = 64.59.144.93 64.59.150.139

    TCP: Interfaces\{8B9FF3CB-5252-4DA4-AD05-E5DD0C4DCD41} : DHCPNameServer = 40.31.1.201 40.31.1.202

    TCP: Interfaces\{EC1FE264-712B-4417-9DE8-4F8BA78CEFFA} : DHCPNameServer = 64.59.144.93 64.59.150.139

    TCP: Interfaces\{EC1FE264-712B-4417-9DE8-4F8BA78CEFFA}\356455E45445D2355434552554 : DHCPNameServer = 206.12.16.14 142.58.103.2

    TCP: Interfaces\{EC1FE264-712B-4417-9DE8-4F8BA78CEFFA}\35E46475D27457563747 : DHCPNameServer = 64.253.129.3 64.253.129.4

    TCP: Interfaces\{EC1FE264-712B-4417-9DE8-4F8BA78CEFFA}\D496B65697 : DHCPNameServer = 192.168.1.254 75.153.176.9

    Filter: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL

    Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll

    Handler: viprotocol - {B658800C-F66E-4EF3-AB85-6C0C227862A9} - C:\Program Files (x86)\Common Files\AVG Secure Search\ViProtocolInstaller\14.2.0\ViProtocol.dll

    Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files (x86)\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll

    SSODL: WebCheck - <orphaned>

    SEH: Groove GFS Stub Execution Hook - {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\Program Files (x86)\Microsoft Office\Office14\GROOVEEX.DLL

    mASetup: {8A69D345-D564-463c-AFF1-A69D9E530F96} - "C:\Program Files (x86)\Google\Chrome\Application\26.0.1410.64\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --multi-install --chrome

    x64-mStart Page = hxxp://searchfunmoods.com/?f=1&a=download&chnl=download&cd=2XzuyEtN2Y1L1QzuyEyEyC0DyDyB0B0A0D0DzytB0EtDyE0EtN0D0Tzu0CtAtBzytN1L2XzutBtFtBtFtDtFtAyEyE&cr=1632136062

    x64-mDefault_Page_URL = hxxp://acer.msn.com

    x64-BHO: Groove GFS Browser Helper: {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL

    x64-BHO: scriptproxy: {7DB2D5A0-7241-4E79-B68D-6309F01C5231} -

    x64-BHO: Windows Live ID Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

    x64-BHO: Office Document Cache Handler: {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL

    x64-Run: [igfxTray] C:\Windows\System32\igfxtray.exe

    x64-Run: [HotKeysCmds] C:\Windows\System32\hkcmd.exe

    x64-Run: [Persistence] C:\Windows\System32\igfxpers.exe

    x64-Run: [RTHDVCPL] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe -s

    x64-Run: [synTPEnh] C:\Program Files (x86)\Synaptics\SynTP\SynTPEnh.exe

    x64-Run: [Power Management] C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe

    x64-Run: [bCSSync] "C:\Program Files\Microsoft Office\Office14\BCSSync.exe" /DelayServices

    x64-IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - C:\Program Files\Microsoft Office\Office14\ONBttnIE.dll

    x64-IE: {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - {FFFDC614-B694-4AE6-AB38-5D6374584B52} - C:\Program Files\Microsoft Office\Office14\ONBttnIELinkedNotes.dll

    x64-Filter: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL

    x64-Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - <orphaned>

    x64-Handler: viprotocol - {B658800C-F66E-4EF3-AB85-6C0C227862A9} - <orphaned>

    x64-Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - <orphaned>

    x64-Notify: igfxcui - igfxdev.dll

    x64-SSODL: WebCheck - <orphaned>

    x64-SEH: Groove GFS Stub Execution Hook - {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL

    .

    ================= FIREFOX ===================

    .

    FF - ProfilePath - C:\Users\Russell Allsup\AppData\Roaming\Mozilla\Firefox\Profiles\d3p9l5pa.default\

    FF - prefs.js: browser.search.selectedEngine - Google

    FF - prefs.js: browser.startup.homepage - hxxps://www.google.ca/

    FF - prefs.js: keyword.URL - hxxp://websearch.ask.com/redirect?client=ff&src=kw&tb=ORJ&o=&locale=&apn_uid=8F75D01F-B9A9-47E9-A490-48384D7F442B&apn_ptnrs=U3&apn_sauid=9D87180F-40F9-4A86-B984-CD09570B008D&apn_dtid=OSJ000YYCA&&q=

    FF - plugin: C:\PROGRA~2\MICROS~4\Office14\NPAUTHZ.DLL

    FF - plugin: C:\PROGRA~2\MICROS~4\Office14\NPSPWRAP.DLL

    FF - plugin: C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll

    FF - plugin: C:\Program Files (x86)\Common Files\AVG Secure Search\SiteSafetyInstaller\14.2.0\npsitesafety.dll

    FF - plugin: C:\Program Files (x86)\Google\Update\1.3.21.135\npGoogleUpdate3.dll

    FF - plugin: C:\Program Files (x86)\Intel\Intel® Management Engine Components\IPT\npIntelWebAPIIPT.dll

    FF - plugin: C:\Program Files (x86)\Intel\Intel® Management Engine Components\IPT\npIntelWebAPIUpdater.dll

    FF - plugin: C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll

    FF - plugin: c:\Program Files (x86)\Microsoft Silverlight\5.1.20125.0\npctrlui.dll

    FF - plugin: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll

    FF - plugin: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_6_602_180.dll

    FF - plugin: C:\Windows\SysWOW64\npDeployJava1.dll

    FF - plugin: C:\Windows\SysWOW64\npmproxy.dll

    .

    ============= SERVICES / DRIVERS ===============

    .

    R? clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86

    R? clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64

    R? EgisTec Ticket Service;EgisTec Ticket Service

    R? ose64;Office 64 Source Engine

    R? Sage 50 Transaction Manager 2013 - CDN;Sage 50 Transaction Manager 2013 - CDN

    R? Sage Simply Accounting Transaction Manager 2012 - CDN;Sage Simply Accounting Transaction Manager 2012 - CDN

    R? SkypeUpdate;Skype Updater

    R? TsUsbFlt;TsUsbFlt

    R? TsUsbGD;Remote Desktop Generic USB Device

    R? USBAAPL64;Apple Mobile USB Driver

    R? WatAdminSvc;Windows Activation Technologies Service

    R? wlcrasvc;Windows Live Mesh remote connections service

    S? avgtp;avgtp

    S? DsiWMIService;Dritek WMI Service

    S? ePowerSvc;ePower Service

    S? GREGService;GREGService

    S? IAStorDataMgrSvc;Intel® Rapid Storage Technology

    S? IntcDAud;Intel® Display Audio

    S? Intel® Capability Licensing Service Interface;Intel® Capability Licensing Service Interface

    S? Intel® ME Service;Intel® ME Service

    S? jhi_service;Intel® Dynamic Application Loader Host Interface Service

    S? Live Updater Service;Live Updater Service

    S? MBAMProtector;MBAMProtector

    S? MBAMScheduler;MBAMScheduler

    S? MBAMService;MBAMService

    S? mwlPSDFilter;mwlPSDFilter

    S? mwlPSDNServ;mwlPSDNServ

    S? mwlPSDVDisk;mwlPSDVDisk

    S? NOBU;Norton Online Backup

    S? NTI IScheduleSvc;NTI IScheduleSvc

    S? RSBASTOR;Realtek PCIE CardReader Driver - BA

    S? RTL8167;Realtek 8167 NT Driver

    S? Simply Accounting Database Connection Manager;Sage 50 Database Connection Manager

    S? SmbDrv;SmbDrv

    S? UNS;Intel® Management and Security Application User Notification Service

    S? vToolbarUpdater14.2.0;vToolbarUpdater14.2.0

    S? ZAtheros Wlan Agent;ZAtheros Wlan Agent

    .

    =============== Created Last 30 ================

    .

    2013-04-27 07:19:49 9317456 ----a-w- C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{2EFD7609-2432-45BC-94C5-E0F0990F632E}\mpengine.dll

    2013-04-25 04:35:43 1656680 ----a-w- C:\Windows\System32\drivers\ntfs.sys

    2013-04-16 07:31:30 -------- d-----w- C:\Program Files\Microsoft Mouse and Keyboard Center

    2013-04-09 21:43:10 3717632 ----a-w- C:\Windows\System32\mstscax.dll

    2013-04-09 21:43:09 3217408 ----a-w- C:\Windows\SysWow64\mstscax.dll

    2013-04-09 21:43:08 44032 ----a-w- C:\Windows\System32\tsgqec.dll

    2013-04-09 21:43:08 36864 ----a-w- C:\Windows\SysWow64\tsgqec.dll

    2013-04-09 21:43:08 158720 ----a-w- C:\Windows\System32\aaclient.dll

    2013-04-09 21:43:08 131584 ----a-w- C:\Windows\SysWow64\aaclient.dll

    2013-04-09 21:43:00 3153408 ----a-w- C:\Windows\System32\win32k.sys

    2013-04-09 21:42:57 223752 ----a-w- C:\Windows\System32\drivers\fvevol.sys

    2013-04-09 21:42:56 5550424 ----a-w- C:\Windows\System32\ntoskrnl.exe

    2013-04-09 21:42:54 3968856 ----a-w- C:\Windows\SysWow64\ntkrnlpa.exe

    2013-04-09 21:42:54 3913560 ----a-w- C:\Windows\SysWow64\ntoskrnl.exe

    2013-04-09 21:42:53 6656 ----a-w- C:\Windows\SysWow64\apisetschema.dll

    2013-04-09 21:42:53 43520 ----a-w- C:\Windows\System32\csrsrv.dll

    2013-04-09 21:42:53 112640 ----a-w- C:\Windows\System32\smss.exe

    2013-04-06 03:16:18 -------- d-----w- C:\Users\Russell Allsup\AppData\Local\{89708595-3751-4868-8E1C-8A3D7997D903}

    2013-04-06 03:14:49 -------- d-----w- C:\Users\Russell Allsup\AppData\Local\{4BEC1E29-3DEE-4CA8-9C9B-2E631048E53B}

    2013-03-31 19:49:42 -------- d-----w- C:\Users\Russell Allsup\AppData\Local\{4EB46E8F-FEA2-4F97-9022-9190B29586BA}

    .

    ==================== Find3M ====================

    .

    2013-04-04 21:50:32 25928 ----a-w- C:\Windows\System32\drivers\mbam.sys

    2013-03-13 07:58:22 73432 ----a-w- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl

    2013-03-13 07:58:22 693976 ----a-w- C:\Windows\SysWow64\FlashPlayerApp.exe

    2013-03-12 08:10:56 282744 ------w- C:\Windows\System32\MpSigStub.exe

    2013-02-22 06:27:49 2312704 ----a-w- C:\Windows\System32\jscript9.dll

    2013-02-22 06:20:51 1392128 ----a-w- C:\Windows\System32\wininet.dll

    2013-02-22 06:19:37 1494528 ----a-w- C:\Windows\System32\inetcpl.cpl

    2013-02-22 06:15:48 173056 ----a-w- C:\Windows\System32\ieUnatt.exe

    2013-02-22 06:15:23 599040 ----a-w- C:\Windows\System32\vbscript.dll

    2013-02-22 06:12:41 2382848 ----a-w- C:\Windows\System32\mshtml.tlb

    2013-02-22 03:46:00 1800704 ----a-w- C:\Windows\SysWow64\jscript9.dll

    2013-02-22 03:38:00 1129472 ----a-w- C:\Windows\SysWow64\wininet.dll

    2013-02-22 03:37:50 1427968 ----a-w- C:\Windows\SysWow64\inetcpl.cpl

    2013-02-22 03:34:17 142848 ----a-w- C:\Windows\SysWow64\ieUnatt.exe

    2013-02-22 03:34:03 420864 ----a-w- C:\Windows\SysWow64\vbscript.dll

    2013-02-22 03:31:46 2382848 ----a-w- C:\Windows\SysWow64\mshtml.tlb

    2013-02-19 06:53:09 39768 ----a-w- C:\Windows\System32\drivers\avgtpx64.sys

    2013-02-12 05:45:24 135168 ----a-w- C:\Windows\apppatch\AppPatch64\AcXtrnal.dll

    2013-02-12 05:45:22 350208 ----a-w- C:\Windows\apppatch\AppPatch64\AcLayers.dll

    2013-02-12 05:45:22 308736 ----a-w- C:\Windows\apppatch\AppPatch64\AcGenral.dll

    2013-02-12 05:45:22 111104 ----a-w- C:\Windows\apppatch\AppPatch64\acspecfc.dll

    2013-02-12 04:48:31 474112 ----a-w- C:\Windows\apppatch\AcSpecfc.dll

    2013-02-12 04:48:26 2176512 ----a-w- C:\Windows\apppatch\AcGenral.dll

    2013-02-12 04:12:05 19968 ----a-w- C:\Windows\System32\drivers\usb8023.sys

    2013-02-02 05:06:07 205 ----a-w- C:\Windows\SysWow64\lsprst7.dll

    2013-01-30 01:15:06 862664 ----a-w- C:\Windows\SysWow64\msvcr110.dll

    2013-01-30 01:15:06 828872 ----a-w- C:\Windows\System32\msvcr110.dll

    2013-01-30 01:15:06 661448 ----a-w- C:\Windows\System32\msvcp110.dll

    2013-01-30 01:15:06 534480 ----a-w- C:\Windows\SysWow64\msvcp110.dll

    2013-01-30 01:15:06 354264 ----a-w- C:\Windows\System32\vccorlib110.dll

    2013-01-30 01:15:06 251864 ----a-w- C:\Windows\SysWow64\vccorlib110.dll

    2013-01-30 01:15:04 50800 ----a-w- C:\Windows\System32\drivers\point64.sys

    2013-01-30 01:15:04 1795952 ----a-w- C:\Windows\System32\WdfCoInstaller01011.dll

    .

    ============= FINISH: 16:56:05.67 ===============

    Whitesmoke toolbar? Total novice, love some help.

    in Resolved Malware Removal Logs

    Posted

    Okay, I ran the roguekiller thing earlier in the day and this is what the first one said

    Operating System : Windows 7 (6.1.7601 Service Pack 1) 64 bits version

    Started in : Normal mode

    User : Russell Allsup [Admin rights]

    Mode : Scan -- Date : 04/29/2013 15:59:58

    | ARK || FAK || MBR |

    ¤¤¤ Bad processes : 0 ¤¤¤

    ¤¤¤ Registry Entries : 6 ¤¤¤

    [HJPOL] HKLM\[...]\System : DisableTaskMgr (0) -> FOUND

    [HJPOL] HKLM\[...]\System : DisableRegistryTools (0) -> FOUND

    [HJPOL] HKLM\[...]\Wow6432Node\System : DisableTaskMgr (0) -> FOUND

    [HJPOL] HKLM\[...]\Wow6432Node\System : DisableRegistryTools (0) -> FOUND

    [HJ DESK] HKLM\[...]\NewStartPanel : {59031a47-3f72-44a7-89c5-5595fe6b30ee} (1) -> FOUND

    [HJ DESK] HKLM\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> FOUND

    ¤¤¤ Particular Files / Folders: ¤¤¤

    ¤¤¤ Driver : [NOT LOADED] ¤¤¤

    ¤¤¤ HOSTS File: ¤¤¤

    --> C:\Windows\system32\drivers\etc\hosts

    ¤¤¤ MBR Check: ¤¤¤

    +++++ PhysicalDrive0: WDC WD5000BPVT-22HXZT3 +++++

    --- User ---

    [MBR] 9023b1095986a4e6462840240279b720

    [bSP] 1b90f50e07fe2689fa0e7fcc908759dc : Windows 7/8 MBR Code

    Partition table:

    0 - [XXXXXX] ACER (0x27) [VISIBLE] Offset (sectors): 2048 | Size: 16384 Mo

    1 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 33556480 | Size: 100 Mo

    2 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 33761280 | Size: 460454 Mo

    User = LL1 ... OK!

    User = LL2 ... OK!

    Finished : << RKreport[1]_S_04292013_02d1559.txt >>

    RKreport[1]_S_04292013_02d1559.txt

    Whitesmoke toolbar? Total novice, love some help.

    in Resolved Malware Removal Logs

    Posted

    So, if anyone out there has complete and utter patience for someone who really has no idea on computer lingo or understanding, I think I may have been infected(?) with the whitesmoke toolbar. The reason I say this is that On my old desktop, whenever I ran google chrome, it would always start at a page with the url:

    http://search.conduit.com/?ctid=CT3198785&SearchSource=48

    Now that I have my laptop, and downloaded chrome for the first time, tied it to my emails and such, yet again, on chrome the homepage has the same as above, and it loads really slow. When i pasted this into a google search, it suggested a whitesmoke toolbar hjiack, and im a little worried and would like to know how to get rid of it.

    Again, i have only the most kindergarten level of understanding, but im willing to listen and do exactly what someone says who knows how to handle this, albeit with a few questions mixed in im sure.

    Please help and I'll be absolutely grateful for anyone who helps me on this, i just want to be able to do my basic gmail, chrome, youtube etc,, without all this b.s.

    Thank you.

Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.