lantern1014

<p> </p> <div># AdwCleaner v2.300 - Logfile created 05/10/2013 at 18:06:23</div> <div># Updated 28/04/2013 by Xplode</div> <div># Operating system : Windows Vista Home Premium Service Pack 2 (32 bits)</div> <div># User : User - USER-PC</div> <div># Boot Mode : Normal</div> <div># Running from : C:\Users\User\Desktop\adwcleaner.exe</div> <div># Option [Delete]</div> <div> </div> <div> </div> <div>***** [services] *****</div> <div> </div> <div>Stopped & Deleted : CltMngSvc</div> <div> </div> <div>***** [Files / Folders] *****</div> <div> </div> <div>Deleted on reboot : C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\cflheckfmhopnialghigdlggahiomebp</div> <div>Folder Deleted : C:\Program Files\Conduit</div> <div>Folder Deleted : C:\Program Files\SearchProtect</div> <div>Folder Deleted : C:\Program Files\SweetIM</div> <div>Folder Deleted : C:\Program Files\TornTV.com</div> <div>Folder Deleted : C:\Program Files\uTorrentControl_v6</div> <div>Folder Deleted : C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\cflheckfmhopnialghigdlggahiomebp</div> <div>Folder Deleted : C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\dlnembnfbcpjnepmfjmngjenhhajpdfd</div> <div>Folder Deleted : C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\jbpkiefagocgkmemidfngdkamloieekf</div> <div>Folder Deleted : C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\ogccgbmabaphcakpiclgcnmcnimhokcj</div> <div> </div> <div>***** [Registry] *****</div> <div> </div> <div>Key Deleted : HKCU\Software\1ClickDownload</div> <div>Key Deleted : HKCU\Software\AppDataLow\Software\Conduit</div> <div>Key Deleted : HKCU\Software\AppDataLow\Software\ConduitSearchScopes</div> <div>Key Deleted : HKCU\Software\AppDataLow\Software\SmartBar</div> <div>Key Deleted : HKCU\Software\AppDataLow\Software\uTorrentControl_v6</div> <div>Key Deleted : HKCU\Software\AppDataLow\Toolbar</div> <div>Key Deleted : HKCU\Software\Conduit</div> <div>Key Deleted : HKCU\Software\Google\Chrome\Extensions\cflheckfmhopnialghigdlggahiomebp</div> <div>Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{EEE6C360-6118-11DC-9C72-001320C79847}</div> <div>Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\1ClickDownload</div> <div>Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\SearchProtect</div> <div>Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\uTorrentControl_v6 Toolbar</div> <div>Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{02478D38-C3F9-4EFB-9B51-7695ECA05670}</div> <div>Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{EF99BD32-C1FB-11D2-892F-0090271D4F88}</div> <div>Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{02478D38-C3F9-4EFB-9B51-7695ECA05670}</div> <div>Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{EF99BD32-C1FB-11D2-892F-0090271D4F88}</div> <div>Key Deleted : HKLM\SOFTWARE\Classes\AppID\{B302A1BD-0157-49FA-90F1-4E94F22C7B4B}</div> <div>Key Deleted : HKLM\SOFTWARE\Classes\AppID\Extension.DLL</div> <div>Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{02478D38-C3F9-4EFB-9B51-7695ECA05670}</div> <div>Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{3C471948-F874-49F5-B338-4F214A2EE0B1}</div> <div>Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{96F454EA-9D38-474F-B504-56193E00C1A5}</div> <div>Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{CD90659F-D5B2-4104-9504-7CA36E6532DF}</div> <div>Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{EF99BD32-C1FB-11D2-892F-0090271D4F88}</div> <div>Key Deleted : HKLM\SOFTWARE\Classes\Interface\{A36867C6-302D-49FC-9D8E-1EB037B5F1AB}</div> <div>Key Deleted : HKLM\SOFTWARE\Classes\Interface\{EEE6C358-6118-11DC-9C72-001320C79847}</div> <div>Key Deleted : HKLM\SOFTWARE\Classes\Interface\{EEE6C359-6118-11DC-9C72-001320C79847}</div> <div>Key Deleted : HKLM\SOFTWARE\Classes\Interface\{EEE6C35A-6118-11DC-9C72-001320C79847}</div> <div>Key Deleted : HKLM\SOFTWARE\Classes\Toolbar.CT3289075</div> <div>Key Deleted : HKLM\Software\Conduit</div> <div>Key Deleted : HKLM\SOFTWARE\Google\Chrome\Extensions\cflheckfmhopnialghigdlggahiomebp</div> <div>Key Deleted : HKLM\SOFTWARE\Google\Chrome\Extensions\jbpkiefagocgkmemidfngdkamloieekf</div> <div>Key Deleted : HKLM\SOFTWARE\Google\Chrome\Extensions\ogccgbmabaphcakpiclgcnmcnimhokcj</div> <div>Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{31D23AE6-997E-4984-93CD-00477ECE1FDA}</div> <div>Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{B8D732BA-194A-4315-B11B-DC3CF6C37667}</div> <div>Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{EEE6C367-6118-11DC-9C72-001320C79847}</div> <div>Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{EEE6C360-6118-11DC-9C72-001320C79847}</div> <div>Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{02478D38-C3F9-4EFB-9B51-7695ECA05670}</div> <div>Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{96F454EA-9D38-474F-B504-56193E00C1A5}</div> <div>Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{02478D38-C3F9-4EFB-9B51-7695ECA05670}</div> <div>Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{CD90659F-D5B2-4104-9504-7CA36E6532DF}</div> <div>Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{EF99BD32-C1FB-11D2-892F-0090271D4F88}</div> <div>Key Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UpgradeCodes\A97CEC23332751B47BA4B95BAA50C9D0</div> <div>Key Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\02F47BF73B948514FAACADD8CBBDF37D</div> <div>Key Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\063A857434EDED11A893800002C0A966</div> <div>Key Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\080D9F5E1E95FEE4794CE438E635239E</div> <div>Key Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\0FF2AEFF45EEA0A48A4B33C1973B6094</div> <div>Key Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\1E264E0A5959A1C46BA9175A878B12EA</div> <div>Key Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\2E6768B6932D112438F047C54D180635</div> <div>Key Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\305B09CE8C53A214DB58887F62F25536</div> <div>Key Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\351716A953E21214898904032EAE2E81</div> <div>Key Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\397C771A7BCAC904697C3EC629ED33ED</div> <div>Key Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\69D6A6B2ED56AF24EA6335EAD6E91CA4</div> <div>Key Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\7FFA128C2B0FF414D805FC5627883401</div> <div>Key Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\86EDC790504E1834DBC20C9A04328FD2</div> <div>Key Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\97C3D0F82E712E241A2F969F45E3351C</div> <div>Key Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\98CC8BF5A4A6E6C4ABF7051DDAB8B058</div> <div>Key Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\9E7F556BF224D804D96A96F0F6344789</div> <div>Key Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\A189D17A469616C4688D23E192996267</div> <div>Key Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\BF4F885EDEE45644EB1E0C99E0162399</div> <div>Key Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\CE21F3FD57B244142880EF15A165A156</div> <div>Key Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\D15DAF33C220F91468A1D7D57C31ACD7</div> <div>Key Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\D3BA76A44C779424889063D5098ED2D6</div> <div>Key Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\D6D0EB9FDBD90C04D92A7E729058F10D</div> <div>Key Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\E4748F9A4181FCE46A23C13B517B9420</div> <div>Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\1ClickDownload</div> <div>Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SearchProtect</div> <div>Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\uTorrentControl_v6 Toolbar</div> <div>Key Deleted : HKLM\Software\SearchProtect</div> <div>Key Deleted : HKLM\Software\uTorrentControl_v6</div> <div>Value Deleted : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{96F454EA-9D38-474F-B504-56193E00C1A5}]</div> <div>Value Deleted : HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks [{96F454EA-9D38-474F-B504-56193E00C1A5}]</div> <div>Value Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Run [searchprotect]</div> <div>Value Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{96F454EA-9D38-474F-B504-56193E00C1A5}]</div> <div>Value Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{EF99BD32-C1FB-11D2-892F-0090271D4F88}]</div> <div>Value Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks [{96F454EA-9D38-474F-B504-56193E00C1A5}]</div> <div>Value Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run [searchProtectAll]</div> <div>Value Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDLLs [C:\Program Files\SweetIM\Toolbars\Internet Explorer\mgHelperApp.exe]</div> <div>Value Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDLLs [C:\Program Files\SweetIM\Toolbars\Internet Explorer\mgToolbarProxy.dll]</div> <div> </div> <div>***** [internet Browsers] *****</div> <div> </div> <div>-\\ Internet Explorer v9.0.8112.16476</div> <div> </div> <div>[OK] Registry is clean.</div> <div> </div> <div>-\\ Google Chrome v26.0.1410.64</div> <div> </div> <div>*************************</div> <div> </div> <div>AdwCleaner[R1].txt - [9836 octets] - [10/05/2013 17:39:42]</div> <div>AdwCleaner[R2].txt - [9896 octets] - [10/05/2013 18:06:06]</div> <div>AdwCleaner[s1].txt - [9695 octets] - [10/05/2013 18:06:23]</div> <div> </div> <div>########## EOF - C:\AdwCleaner[s1].txt - [9755 octets] ##########</div> <div> </div> <div> </div> <div> </div> <div>-----------------------------------------------------------------------------------------------</div> <div> </div> <div> <div> Results of screen317's Security Check version 0.99.63 </div> <div> Windows Vista Service Pack 2 x86 (UAC is disabled!) </div> <div> Internet Explorer 9 </div> <div>``````````````Antivirus/Firewall Check:`````````````` </div> <div> Windows Firewall Enabled! </div> <div>avast! Antivirus </div> <div> Antivirus up to date! </div> <div>`````````Anti-malware/Other Utilities Check:````````` </div> <div> Java 7 Update 17 </div> <div> Java version out of Date! </div> <div> Adobe Reader 10.1.6 Adobe Reader out of Date! </div> <div> Google Chrome 26.0.1410.43 </div> <div> Google Chrome 26.0.1410.64 </div> <div>````````Process Check: objlist.exe by Laurent```````` </div> <div> AVAST Software Avast AvastSvc.exe </div> <div> AVAST Software Avast AvastUI.exe </div> <div>`````````````````System Health check````````````````` </div> <div> Total Fragmentation on Drive C: 1 % </div> <div>````````````````````End of Log`````````````````````` </div> <div> </div> </div> <div> </div>

# AdwCleaner v2.300 - Logfile created 05/10/2013 at 17:39:42 # Updated 28/04/2013 by Xplode # Operating system : Windows Vista Home Premium Service Pack 2 (32 bits) # User : User - USER-PC # Boot Mode : Normal # Running from : C:\Users\User\Desktop\adwcleaner.exe # Option [search] ***** [services] ***** Found : CltMngSvc ***** [Files / Folders] ***** Folder Found : C:\Program Files\Conduit Folder Found : C:\Program Files\SearchProtect Folder Found : C:\Program Files\SweetIM Folder Found : C:\Program Files\TornTV.com Folder Found : C:\Program Files\uTorrentControl_v6 Folder Found : C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\cflheckfmhopnialghigdlggahiomebp Folder Found : C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\cflheckfmhopnialghigdlggahiomebp Folder Found : C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\dlnembnfbcpjnepmfjmngjenhhajpdfd Folder Found : C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\jbpkiefagocgkmemidfngdkamloieekf Folder Found : C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\ogccgbmabaphcakpiclgcnmcnimhokcj ***** [Registry] ***** Key Found : HKCU\Software\1ClickDownload Key Found : HKCU\Software\AppDataLow\Software\Conduit Key Found : HKCU\Software\AppDataLow\Software\ConduitSearchScopes Key Found : HKCU\Software\AppDataLow\Software\SmartBar Key Found : HKCU\Software\AppDataLow\Software\uTorrentControl_v6 Key Found : HKCU\Software\AppDataLow\Toolbar Key Found : HKCU\Software\Conduit Key Found : HKCU\Software\Google\Chrome\Extensions\cflheckfmhopnialghigdlggahiomebp Key Found : HKCU\Software\Google\Chrome\Extensions\cflheckfmhopnialghigdlggahiomebp Key Found : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{EEE6C360-6118-11DC-9C72-001320C79847} Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\1ClickDownload Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\SearchProtect Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\uTorrentControl_v6 Toolbar Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{02478D38-C3F9-4EFB-9B51-7695ECA05670} Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{EF99BD32-C1FB-11D2-892F-0090271D4F88} Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{02478D38-C3F9-4EFB-9B51-7695ECA05670} Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{EF99BD32-C1FB-11D2-892F-0090271D4F88} Key Found : HKLM\SOFTWARE\Classes\AppID\{B302A1BD-0157-49FA-90F1-4E94F22C7B4B} Key Found : HKLM\SOFTWARE\Classes\AppID\Extension.DLL Key Found : HKLM\SOFTWARE\Classes\CLSID\{02478D38-C3F9-4EFB-9B51-7695ECA05670} Key Found : HKLM\SOFTWARE\Classes\CLSID\{3C471948-F874-49F5-B338-4F214A2EE0B1} Key Found : HKLM\SOFTWARE\Classes\CLSID\{96F454EA-9D38-474F-B504-56193E00C1A5} Key Found : HKLM\SOFTWARE\Classes\CLSID\{CD90659F-D5B2-4104-9504-7CA36E6532DF} Key Found : HKLM\SOFTWARE\Classes\CLSID\{EF99BD32-C1FB-11D2-892F-0090271D4F88} Key Found : HKLM\SOFTWARE\Classes\Interface\{A36867C6-302D-49FC-9D8E-1EB037B5F1AB} Key Found : HKLM\SOFTWARE\Classes\Interface\{EEE6C358-6118-11DC-9C72-001320C79847} Key Found : HKLM\SOFTWARE\Classes\Interface\{EEE6C359-6118-11DC-9C72-001320C79847} Key Found : HKLM\SOFTWARE\Classes\Interface\{EEE6C35A-6118-11DC-9C72-001320C79847} Key Found : HKLM\SOFTWARE\Classes\Toolbar.CT3289075 Key Found : HKLM\Software\Conduit Key Found : HKLM\SOFTWARE\Google\Chrome\Extensions\cflheckfmhopnialghigdlggahiomebp Key Found : HKLM\SOFTWARE\Google\Chrome\Extensions\cflheckfmhopnialghigdlggahiomebp Key Found : HKLM\SOFTWARE\Google\Chrome\Extensions\jbpkiefagocgkmemidfngdkamloieekf Key Found : HKLM\SOFTWARE\Google\Chrome\Extensions\ogccgbmabaphcakpiclgcnmcnimhokcj Key Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{31D23AE6-997E-4984-93CD-00477ECE1FDA} Key Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{B8D732BA-194A-4315-B11B-DC3CF6C37667} Key Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{EEE6C367-6118-11DC-9C72-001320C79847} Key Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{EEE6C360-6118-11DC-9C72-001320C79847} Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{02478D38-C3F9-4EFB-9B51-7695ECA05670} Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{96F454EA-9D38-474F-B504-56193E00C1A5} Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{02478D38-C3F9-4EFB-9B51-7695ECA05670} Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{CD90659F-D5B2-4104-9504-7CA36E6532DF} Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{EF99BD32-C1FB-11D2-892F-0090271D4F88} Key Found : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UpgradeCodes\A97CEC23332751B47BA4B95BAA50C9D0 Key Found : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\02F47BF73B948514FAACADD8CBBDF37D Key Found : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\063A857434EDED11A893800002C0A966 Key Found : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\080D9F5E1E95FEE4794CE438E635239E Key Found : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\0FF2AEFF45EEA0A48A4B33C1973B6094 Key Found : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\1E264E0A5959A1C46BA9175A878B12EA Key Found : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\2E6768B6932D112438F047C54D180635 Key Found : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\305B09CE8C53A214DB58887F62F25536 Key Found : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\351716A953E21214898904032EAE2E81 Key Found : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\397C771A7BCAC904697C3EC629ED33ED Key Found : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\69D6A6B2ED56AF24EA6335EAD6E91CA4 Key Found : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\7FFA128C2B0FF414D805FC5627883401 Key Found : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\86EDC790504E1834DBC20C9A04328FD2 Key Found : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\97C3D0F82E712E241A2F969F45E3351C Key Found : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\98CC8BF5A4A6E6C4ABF7051DDAB8B058 Key Found : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\9E7F556BF224D804D96A96F0F6344789 Key Found : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\A189D17A469616C4688D23E192996267 Key Found : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\BF4F885EDEE45644EB1E0C99E0162399 Key Found : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\CE21F3FD57B244142880EF15A165A156 Key Found : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\D15DAF33C220F91468A1D7D57C31ACD7 Key Found : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\D3BA76A44C779424889063D5098ED2D6 Key Found : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\D6D0EB9FDBD90C04D92A7E729058F10D Key Found : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\E4748F9A4181FCE46A23C13B517B9420 Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\1ClickDownload Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SearchProtect Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\uTorrentControl_v6 Toolbar Key Found : HKLM\Software\SearchProtect Key Found : HKLM\Software\uTorrentControl_v6 Key Found : HKU\S-1-5-21-2518506455-3246167175-1989359215-1000\Software\Microsoft\Internet Explorer\SearchScopes\{EEE6C360-6118-11DC-9C72-001320C79847} Value Found : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{96F454EA-9D38-474F-B504-56193E00C1A5}] Value Found : HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks [{96F454EA-9D38-474F-B504-56193E00C1A5}] Value Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Run [searchprotect] Value Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{96F454EA-9D38-474F-B504-56193E00C1A5}] Value Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{EF99BD32-C1FB-11D2-892F-0090271D4F88}] Value Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks [{96F454EA-9D38-474F-B504-56193E00C1A5}] Value Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run [searchProtectAll] Value Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDLLs [C:\Program Files\SweetIM\Toolbars\Internet Explorer\mgHelperApp.exe] Value Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDLLs [C:\Program Files\SweetIM\Toolbars\Internet Explorer\mgToolbarProxy.dll] ***** [internet Browsers] ***** -\\ Internet Explorer v9.0.8112.16476 [OK] Registry is clean. -\\ Google Chrome v26.0.1410.64 ************************* AdwCleaner[R1].txt - [9707 octets] - [10/05/2013 17:39:42] ########## EOF - C:\AdwCleaner[R1].txt - [9767 octets] ########## AdwCleanerR1.txt

ComboFix 13-05-10.03 - User 05/10/2013 15:44:00.1.2 - x86 Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.1.1033.18.3070.1424 [GMT -7:00] Running from: c:\users\User\Desktop\ComboFix.exe AV: avast! Antivirus *Disabled/Updated* {2B2D1395-420B-D5C9-657E-930FE358FC3C} SP: avast! Antivirus *Disabled/Updated* {904CF271-6431-DA47-5FCE-A87D98DFB681} SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} . . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . . c:\program files\Search Toolbar c:\program files\Search Toolbar\icon.ico c:\program files\Search Toolbar\SearchToolbar.dll c:\program files\Search Toolbar\SearchToolbarUninstall.exe c:\program files\Search Toolbar\SearchToolbarUpdater.exe c:\users\Guest\AppData\Roaming\WTouch c:\users\Guest\AppData\Roaming\WTouch\WTouch.xml T:\Autorun.inf T:\Setup.exe . . ((((((((((((((((((((((((( Files Created from 2013-04-10 to 2013-05-10 ))))))))))))))))))))))))))))))) . . 2013-05-10 22:59 . 2013-05-10 22:59 -------- d-----w- c:\users\Default\AppData\Local\temp 2013-05-10 22:59 . 2013-05-10 22:59 -------- d-----w- c:\users\Guest\AppData\Local\temp 2013-05-10 21:06 . 2013-04-10 03:08 6906960 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{1A75321E-07BD-4033-837F-4D6906406E11}\mpengine.dll 2013-05-10 20:56 . 2013-05-10 20:56 40776 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys 2013-05-10 04:24 . 2013-05-10 04:24 -------- d-----w- c:\users\User\AppData\Roaming\Malwarebytes 2013-05-10 04:24 . 2013-05-10 04:24 -------- d-----w- c:\programdata\Malwarebytes 2013-05-10 03:45 . 2013-05-10 03:45 -------- d-----w- c:\program files\Enigma Software Group 2013-05-10 03:44 . 2013-05-10 21:00 -------- d-----w- c:\windows\0AC0F1B261C74B6EACEF58FCC0B94835.TMP 2013-05-10 03:44 . 2013-05-10 03:44 -------- d-----w- c:\program files\Common Files\Wise Installation Wizard 2013-05-09 20:52 . 2013-05-09 20:52 -------- d-----w- C:\FRST 2013-04-24 10:11 . 2013-03-03 19:07 1082232 ----a-w- c:\windows\system32\drivers\ntfs.sys . . . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2013-05-09 21:05 . 2011-03-29 02:36 22240 ----a-w- c:\programdata\Microsoft\IdentityCRL\production\ppcrlconfig600.dll 2013-05-02 09:06 . 2011-06-07 05:38 238872 ------w- c:\windows\system32\MpSigStub.exe 2013-03-12 20:25 . 2013-03-12 20:26 94112 ----a-w- c:\windows\system32\WindowsAccessBridge.dll 2013-03-12 20:25 . 2013-03-12 20:26 861088 ----a-w- c:\windows\system32\npDeployJava1.dll 2013-03-12 20:25 . 2011-08-11 22:15 782240 ----a-w- c:\windows\system32\deployJava1.dll 2013-03-11 13:25 . 2013-04-10 04:01 3603816 ----a-w- c:\windows\system32\ntkrnlpa.exe 2013-03-11 13:25 . 2013-04-10 04:01 3551080 ----a-w- c:\windows\system32\ntoskrnl.exe 2013-03-09 03:45 . 2013-04-10 04:01 49152 ----a-w- c:\windows\system32\csrsrv.dll 2013-03-09 01:28 . 2013-04-10 04:01 64000 ----a-w- c:\windows\system32\smss.exe 2013-03-08 03:53 . 2013-04-10 04:01 376320 ----a-w- c:\windows\system32\winsrv.dll 2013-03-08 03:52 . 2013-04-10 04:01 2067968 ----a-w- c:\windows\system32\mstscax.dll 2013-03-06 22:33 . 2013-03-13 00:30 49248 ----a-w- c:\windows\system32\drivers\aswRvrt.sys 2013-03-06 22:33 . 2013-03-13 00:30 164736 ----a-w- c:\windows\system32\drivers\aswVmm.sys 2013-03-06 22:33 . 2011-07-01 20:40 368176 ----a-w- c:\windows\system32\drivers\aswSP.sys 2013-03-06 22:33 . 2011-07-01 20:40 49760 ----a-w- c:\windows\system32\drivers\aswRdr.sys 2013-03-06 22:33 . 2011-07-01 20:40 765736 ----a-w- c:\windows\system32\drivers\aswSnx.sys 2013-03-06 22:33 . 2011-07-01 20:40 62376 ----a-w- c:\windows\system32\drivers\aswTdi.sys 2013-03-06 22:33 . 2011-07-01 20:40 66336 ----a-w- c:\windows\system32\drivers\aswMonFlt.sys 2013-03-06 22:33 . 2011-07-01 20:40 29816 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys 2013-03-06 22:32 . 2011-07-01 20:39 41664 ----a-w- c:\windows\avastSS.scr 2013-03-06 22:32 . 2011-07-01 20:39 228600 ----a-w- c:\windows\system32\aswBoot.exe 2013-03-05 01:40 . 2013-04-10 04:00 2049024 ----a-w- c:\windows\system32\win32k.sys 2013-02-12 01:57 . 2013-03-14 06:36 15872 ----a-w- c:\windows\system32\drivers\usb8023.sys . . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 . [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks] "{96f454ea-9d38-474f-b504-56193e00c1a5}"= "c:\program files\uTorrentControl_v6\prxtbuTo0.dll" [2013-03-05 231168] . [HKEY_CLASSES_ROOT\clsid\{96f454ea-9d38-474f-b504-56193e00c1a5}] . [HKEY_LOCAL_MACHINE\SOFTWARE\~\Browser Helper Objects\{96f454ea-9d38-474f-b504-56193e00c1a5}] 2013-03-05 13:37 231168 ----a-w- c:\program files\uTorrentControl_v6\prxtbuTo0.dll . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar] "{96f454ea-9d38-474f-b504-56193e00c1a5}"= "c:\program files\uTorrentControl_v6\prxtbuTo0.dll" [2013-03-05 231168] . [HKEY_CLASSES_ROOT\clsid\{96f454ea-9d38-474f-b504-56193e00c1a5}] . [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser] "{96F454EA-9D38-474F-B504-56193E00C1A5}"= "c:\program files\uTorrentControl_v6\prxtbuTo0.dll" [2013-03-05 231168] . [HKEY_CLASSES_ROOT\clsid\{96f454ea-9d38-474f-b504-56193e00c1a5}] . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast] @="{472083B0-C522-11CF-8763-00608CC02F24}" [HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}] 2013-03-06 22:32 121968 ----a-w- c:\program files\AVAST Software\Avast\ashShell.dll . [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "WindowsWelcomeCenter"="oobefldr.dll" [2009-04-11 2153472] "swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2011-06-09 39408] "SearchProtect"="c:\users\User\AppData\Roaming\SearchProtect\bin\cltmng.exe" [2013-03-06 2731296] . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "RtHDVCpl"="RtHDVCpl.exe" [2008-01-09 4669440] "Skytel"="Skytel.exe" [2008-01-09 1826816] "NvSvc"="c:\windows\system32\nvsvc.dll" [2009-05-26 92704] "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2009-05-26 8530464] "NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2009-05-26 88608] "googletalk"="c:\program files\Google\Google Talk\googletalk.exe" [2007-01-01 3739648] "Google Quick Search Box"="c:\program files\Google\Quick Search Box\GoogleQuickSearchBox.exe" [2011-06-09 126976] "Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-12-03 946352] "avast"="c:\program files\AVAST Software\Avast\avastUI.exe" [2013-03-06 4767304] "ISBMgr.exe"="c:\program files\Sony\ISB Utility\ISBMgr.exe" [2007-09-19 311296] "AppMon Utility"="c:\program files\Sony\AppMonUtil\AppMonUtility.exe" [2007-09-20 542560] "LWS"="c:\program files\Logitech\LWS\Webcam Software\LWS.exe" [2010-05-08 165208] "GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2009-02-27 30040] "QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2011-07-06 421888] "CanonMyPrinter"="c:\program files\Canon\MyPrinter\BJMyPrt.exe" [2010-03-25 2516296] "CanonSolutionMenuEx"="c:\program files\Canon\Solution Menu EX\CNSEMAIN.EXE" [2010-04-02 1185112] "APSDaemon"="c:\program files\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2011-11-02 59240] "iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2011-12-08 421736] "SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2012-07-03 252848] "SearchProtectAll"="c:\program files\SearchProtect\bin\cltmng.exe" [2013-03-06 2731296] . c:\users\User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ HMA Pro VPN 2.0.lnk - c:\program files\HMA! Pro VPN\bin\HMA! Pro VPN.exe [2012-12-21 2011872] . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "EnableLUA"= 0 (0x0) "EnableUIADesktopToggle"= 0 (0x0) . [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\VESWinlogon] 2007-08-15 03:05 98304 ----a-w- c:\windows\System32\VESWinlogon.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "aux3"=wdmaud.drv . [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WudfSvc] @="Service" . [HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc\S-1-5-21-2518506455-3246167175-1989359215-1000] "EnableNotificationsRef"=dword:00000001 . [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost] LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache . [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}] 2013-04-11 04:22 1642448 ----a-w- c:\program files\Google\Chrome\Application\26.0.1410.64\Installer\chrmstp.exe . Contents of the 'Scheduled Tasks' folder . 2013-05-10 c:\windows\Tasks\Google Software Updater.job - c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2011-06-09 04:41] . 2013-05-10 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job - c:\program files\Google\Update\GoogleUpdate.exe [2011-06-09 01:46] . 2013-05-10 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job - c:\program files\Google\Update\GoogleUpdate.exe [2011-06-09 01:46] . 2013-05-10 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2518506455-3246167175-1989359215-1000Core.job - c:\users\User\AppData\Local\Google\Update\GoogleUpdate.exe [2011-06-09 01:46] . 2013-05-10 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2518506455-3246167175-1989359215-1000UA.job - c:\users\User\AppData\Local\Google\Update\GoogleUpdate.exe [2011-06-09 01:46] . . ------- Supplementary Scan ------- . uStart Page = hxxp://www.google.com/ mStart Page = hxxp://start.sweetpacks.com/?src=10&st=12&crg=3.5000006.10042&barid={C6B3CC60-8B74-11E2-8821-001A80F6721F} IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000 LSP: c:\program files\HMA! Pro VPN\bin\ForceInterfaceLSP.dll TCP: DhcpNameServer = 192.168.0.1 75.75.75.75 75.75.76.76 TCP: Interfaces\{D1A0B3FF-C733-49B9-8BC2-C1978F806AEB}: NameServer = 208.67.222.222 208.67.220.220 . - - - - ORPHANS REMOVED - - - - . SafeBoot-WudfPf SafeBoot-WudfRd AddRemove-Search Toolbar - c:\program files\Search Toolbar\SearchToolbarUninstall.exe . . . ************************************************************************** . catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2013-05-10 16:00 Windows 6.0.6002 Service Pack 2 NTFS . scanning hidden processes ... . scanning hidden autostart entries ... . scanning hidden files ... . . c:\windows\TEMP\TMP00000095540EA142ACA16E69 524288 bytes . scan completed successfully hidden files: 1 . ************************************************************************** . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SampleCollector] "ImagePath"="\"c:\program files\Sony\VAIO Care\VCPerfService.exe\" \"/service\" \"/sstates\" \"/sampleinterval=5000\" \"/procinterval=5\" \"/dllinterval=120\" \"/counter=\Processor(_Total)\% Processor Time:1/counter=\PhysicalDisk(_Total)\Disk Bytes/sec:1\" \"/counter=\Network Interface(*)\Bytes Total/sec:1\" \"/expandcounter=\Processor Information(*)\Processor Frequency:1\" \"/expandcounter=\Processor(*)\% Idle Time:1\" \"/expandcounter=\Processor(*)\% C1 Time:1\" \"/expandcounter=\Processor(*)\% C2 Time:1\" \"/expandcounter=\Processor(*)\% C3 Time:1\" \"/expandcounter=\Processor(*)\% Processor Time:1\" \"/directory=inteldata\"" . --------------------- LOCKED REGISTRY KEYS --------------------- . [HKEY_USERS\S-1-5-21-2518506455-3246167175-1989359215-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.**ˆ] @Class="Shell" @Allowed: (Read) (RestrictedCode) . [HKEY_USERS\S-1-5-21-2518506455-3246167175-1989359215-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.**ˆ\OpenWithList] @Class="Shell" "a"="vlc.exe" "MRUList"="a" . [HKEY_USERS\S-1-5-21-2518506455-3246167175-1989359215-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs\.**ˆ] "0"=hex:54,3a,5c,41,7a,75,72,65,75,73,20,44,6f,77,6e,6c,6f,61,64,73,5c,5f,63, 6f,6d,70,6c,65,74,65,64,20,66,69,6c,65,73,5c,5f,5f,43,6f,70,79,20,74,6f,20,\ "MRUListEx"=hex:00,00,00,00,ff,ff,ff,ff . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\DbgagD\1*] "value"="?\03\02\06\02' ?" . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 . Completion time: 2013-05-10 16:05:23 ComboFix-quarantined-files.txt 2013-05-10 23:05 . Pre-Run: 325,447,245,824 bytes free Post-Run: 327,216,361,472 bytes free . - - End Of File - - E56D223EC5E3DB6D0AD9A229C94ECDBC 101.txt

Malwarebytes Anti-Rootkit BETA 1.05.0.1001 www.malwarebytes.org Database version: v2013.05.10.09 Windows Vista Service Pack 2 x86 NTFS Internet Explorer 9.0.8112.16421 User :: USER-PC [administrator] 5/10/2013 1:10:53 PM mbar-log-2013-05-10 (13-10-53).txt Scan type: Quick scan Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM | P2P Scan options disabled: Objects scanned: 31031 Time elapsed: 28 minute(s), 51 second(s) Memory Processes Detected: 0 (No malicious items detected) Memory Modules Detected: 0 (No malicious items detected) Registry Keys Detected: 0 (No malicious items detected) Registry Values Detected: 0 (No malicious items detected) Registry Data Items Detected: 0 (No malicious items detected) Folders Detected: 0 (No malicious items detected) Files Detected: 0 (No malicious items detected) (end) -------------------------------------------------------------------------------------------------------- --------------------------------------- Malwarebytes Anti-Rootkit BETA 1.05.0.1001 © Malwarebytes Corporation 2011-2012 OS version: 6.0.6002 Windows Vista Service Pack 2 x86 Account is Administrative Internet Explorer version: 9.0.8112.16421 File system is: NTFS Disk drives: C:\ DRIVE_FIXED CPU speed: 1.995000 GHz Memory total: 3218808832, free: 1139462144 ------------ Kernel report ------------ 05/10/2013 12:33:50 ------------ Loaded modules ----------- \SystemRoot\system32\ntkrnlpa.exe \SystemRoot\system32\hal.dll \SystemRoot\system32\kdcom.dll \SystemRoot\system32\mcupdate_GenuineIntel.dll \SystemRoot\system32\PSHED.dll \SystemRoot\system32\BOOTVID.dll \SystemRoot\system32\CLFS.SYS \SystemRoot\system32\CI.dll \SystemRoot\system32\drivers\Wdf01000.sys \SystemRoot\system32\drivers\WDFLDR.SYS \SystemRoot\system32\drivers\acpi.sys \SystemRoot\system32\drivers\WMILIB.SYS \SystemRoot\system32\drivers\msisadrv.sys \SystemRoot\system32\drivers\pci.sys \SystemRoot\System32\drivers\partmgr.sys \SystemRoot\system32\DRIVERS\compbatt.sys \SystemRoot\system32\DRIVERS\BATTC.SYS \SystemRoot\system32\drivers\volmgr.sys \SystemRoot\System32\drivers\volmgrx.sys \SystemRoot\system32\drivers\intelide.sys \SystemRoot\system32\drivers\PCIIDEX.SYS \SystemRoot\system32\DRIVERS\pcmcia.sys \SystemRoot\System32\drivers\mountmgr.sys \SystemRoot\system32\DRIVERS\iaStor.sys \SystemRoot\system32\drivers\atapi.sys \SystemRoot\system32\drivers\ataport.SYS \SystemRoot\system32\drivers\msahci.sys \SystemRoot\system32\DRIVERS\SI3132.sys \SystemRoot\system32\DRIVERS\SCSIPORT.SYS \SystemRoot\system32\drivers\fltmgr.sys \SystemRoot\system32\drivers\fileinfo.sys \SystemRoot\system32\DRIVERS\SiWinAcc.sys \SystemRoot\System32\Drivers\ksecdd.sys \SystemRoot\system32\drivers\ndis.sys \SystemRoot\system32\drivers\msrpc.sys \SystemRoot\system32\drivers\NETIO.SYS \SystemRoot\System32\drivers\tcpip.sys \SystemRoot\System32\drivers\fwpkclnt.sys \SystemRoot\System32\Drivers\Ntfs.sys \SystemRoot\system32\drivers\volsnap.sys \SystemRoot\System32\Drivers\spldr.sys \SystemRoot\system32\DRIVERS\SiRemFil.sys \SystemRoot\System32\Drivers\mup.sys \SystemRoot\System32\drivers\ecache.sys \SystemRoot\system32\drivers\disk.sys \SystemRoot\system32\drivers\CLASSPNP.SYS \SystemRoot\system32\drivers\crcdisk.sys \SystemRoot\System32\Drivers\aswRvrt.sys \SystemRoot\system32\DRIVERS\tunnel.sys \SystemRoot\system32\DRIVERS\tunmp.sys \SystemRoot\system32\DRIVERS\intelppm.sys \SystemRoot\system32\DRIVERS\CmBatt.sys \SystemRoot\system32\DRIVERS\nvlddmkm.sys \SystemRoot\System32\drivers\dxgkrnl.sys \SystemRoot\System32\drivers\watchdog.sys \SystemRoot\system32\DRIVERS\usbuhci.sys \SystemRoot\system32\DRIVERS\USBPORT.SYS \SystemRoot\system32\DRIVERS\usbehci.sys \SystemRoot\system32\DRIVERS\HDAudBus.sys \SystemRoot\system32\DRIVERS\yk60x86.sys \SystemRoot\system32\DRIVERS\NETw4v32.sys \SystemRoot\system32\DRIVERS\ohci1394.sys \SystemRoot\system32\DRIVERS\1394BUS.SYS \SystemRoot\system32\drivers\ti21sony.sys \SystemRoot\system32\DRIVERS\SFEP.sys \SystemRoot\system32\DRIVERS\i8042prt.sys \SystemRoot\system32\DRIVERS\kbdclass.sys \SystemRoot\system32\DRIVERS\mouclass.sys \SystemRoot\system32\DRIVERS\cdrom.sys \SystemRoot\system32\DRIVERS\GEARAspiWDM.sys \SystemRoot\system32\DRIVERS\wacomvhid.sys \SystemRoot\system32\DRIVERS\HIDCLASS.SYS \SystemRoot\system32\DRIVERS\HIDPARSE.SYS \SystemRoot\system32\DRIVERS\WacomVTHid.sys \SystemRoot\system32\DRIVERS\msiscsi.sys \SystemRoot\system32\DRIVERS\storport.sys \SystemRoot\system32\DRIVERS\TDI.SYS \SystemRoot\system32\DRIVERS\rasl2tp.sys \SystemRoot\system32\DRIVERS\ndistapi.sys \SystemRoot\system32\DRIVERS\ndiswan.sys \SystemRoot\system32\DRIVERS\raspppoe.sys \SystemRoot\system32\DRIVERS\raspptp.sys \SystemRoot\system32\DRIVERS\rassstp.sys \SystemRoot\system32\DRIVERS\tap0901.sys \SystemRoot\system32\DRIVERS\termdd.sys \SystemRoot\system32\DRIVERS\swenum.sys \SystemRoot\system32\DRIVERS\ks.sys \SystemRoot\system32\DRIVERS\mssmbios.sys \SystemRoot\system32\DRIVERS\umbus.sys \SystemRoot\system32\DRIVERS\usbhub.sys \SystemRoot\system32\DRIVERS\mouhid.sys \SystemRoot\system32\DRIVERS\wacommousefilter.sys \SystemRoot\System32\Drivers\NDProxy.SYS \SystemRoot\system32\drivers\stwrt.sys \SystemRoot\system32\drivers\portcls.sys \SystemRoot\system32\drivers\drmk.sys \SystemRoot\system32\DRIVERS\HSXHWAZL.sys \SystemRoot\system32\DRIVERS\HSX_DPV.sys \SystemRoot\system32\DRIVERS\HSX_CNXT.sys \SystemRoot\system32\drivers\modem.sys \SystemRoot\system32\drivers\RTKVHDA.sys \SystemRoot\system32\DRIVERS\usbccgp.sys \SystemRoot\system32\DRIVERS\USBD.SYS \SystemRoot\System32\Drivers\R5U870FLx86.sys \SystemRoot\System32\Drivers\usbvideo.sys \SystemRoot\System32\Drivers\R5U870FUx86.sys \SystemRoot\System32\Drivers\aswSnx.SYS \SystemRoot\System32\Drivers\Fs_Rec.SYS \SystemRoot\System32\Drivers\Null.SYS \SystemRoot\System32\Drivers\Beep.SYS \SystemRoot\System32\drivers\vga.sys \SystemRoot\System32\drivers\VIDEOPRT.SYS \SystemRoot\system32\drivers\usbaudio.sys \SystemRoot\system32\DRIVERS\hidusb.sys \SystemRoot\System32\DRIVERS\RDPCDD.sys \SystemRoot\system32\drivers\rdpencdd.sys \SystemRoot\System32\Drivers\Msfs.SYS \SystemRoot\System32\Drivers\Npfs.SYS \SystemRoot\System32\DRIVERS\rasacd.sys \SystemRoot\system32\DRIVERS\tdx.sys \SystemRoot\System32\Drivers\aswTdi.SYS \SystemRoot\system32\DRIVERS\smb.sys \SystemRoot\system32\drivers\afd.sys \SystemRoot\System32\Drivers\aswRdr.SYS \SystemRoot\System32\DRIVERS\netbt.sys \SystemRoot\system32\drivers\ws2ifsl.sys \SystemRoot\system32\DRIVERS\pacer.sys \SystemRoot\system32\DRIVERS\netbios.sys \SystemRoot\system32\DRIVERS\wanarp.sys \SystemRoot\system32\DRIVERS\rdbss.sys \SystemRoot\system32\drivers\nsiproxy.sys \SystemRoot\System32\Drivers\dfsc.sys \SystemRoot\System32\Drivers\aswSP.SYS \SystemRoot\system32\DRIVERS\udfs.sys \SystemRoot\System32\Drivers\crashdmp.sys \SystemRoot\System32\Drivers\dump_dumpata.sys \SystemRoot\System32\Drivers\dump_msahci.sys \SystemRoot\System32\win32k.sys \SystemRoot\System32\drivers\Dxapi.sys \SystemRoot\system32\DRIVERS\monitor.sys \SystemRoot\System32\TSDDD.dll \SystemRoot\System32\cdd.dll \SystemRoot\system32\drivers\luafv.sys \??\C:\Windows\system32\drivers\aswMonFlt.sys \SystemRoot\System32\Drivers\aswFsBlk.SYS \SystemRoot\system32\drivers\WudfPf.sys \SystemRoot\system32\drivers\spsys.sys \SystemRoot\system32\DRIVERS\lltdio.sys \SystemRoot\system32\DRIVERS\nwifi.sys \SystemRoot\system32\DRIVERS\ndisuio.sys \SystemRoot\system32\DRIVERS\rspndr.sys \SystemRoot\system32\DRIVERS\asyncmac.sys \SystemRoot\system32\drivers\HTTP.sys \SystemRoot\System32\DRIVERS\srvnet.sys \SystemRoot\system32\DRIVERS\bowser.sys \SystemRoot\System32\drivers\mpsdrv.sys \SystemRoot\system32\drivers\mrxdav.sys \SystemRoot\system32\DRIVERS\mrxsmb.sys \SystemRoot\system32\DRIVERS\mrxsmb10.sys \SystemRoot\system32\DRIVERS\mrxsmb20.sys \SystemRoot\System32\DRIVERS\srv2.sys \SystemRoot\System32\DRIVERS\srv.sys \SystemRoot\system32\DRIVERS\mdmxsdk.sys \SystemRoot\system32\drivers\peauth.sys \SystemRoot\System32\Drivers\secdrv.SYS \SystemRoot\System32\drivers\tcpipreg.sys \SystemRoot\system32\DRIVERS\WUDFRd.sys \SystemRoot\system32\DRIVERS\xaudio.sys \SystemRoot\system32\DRIVERS\LVPr2Mon.sys \SystemRoot\System32\Drivers\fastfat.SYS \??\C:\Program Files\Enigma Software Group\SpyHunter\esgiguard.sys \??\C:\Windows\system32\drivers\mbamchameleon.sys \??\C:\Windows\system32\drivers\mbamswissarmy.sys \Windows\System32\ntdll.dll ----------- End ----------- <<<1>>> Upper Device Name: \Device\Harddisk2\DR2 Upper Device Object: 0xffffffff8a1e07c0 Upper Device Driver Name: \Driver\disk\ Lower Device Name: \Device\00000067\ Lower Device Object: 0xffffffff890009a0 Lower Device Driver Name: \Driver\ti21sony\ Driver name found: ti21sony Initialization returned 0x0 Load Function returned 0x0 <<<1>>> Upper Device Name: \Device\Harddisk1\DR1 Upper Device Object: 0xffffffff8a178ac8 Upper Device Driver Name: \Driver\disk\ Lower Device Name: \Device\00000066\ Lower Device Object: 0xffffffff8a1c2298 Lower Device Driver Name: \Driver\ti21sony\ Driver name found: ti21sony <<<1>>> Upper Device Name: \Device\Harddisk0\DR0 Upper Device Object: 0xffffffff86a0eac8 Upper Device Driver Name: \Driver\disk\ Lower Device Name: \Device\Ide\IdeDeviceP2T0L0-4\ Lower Device Object: 0xffffffff853938a0 Lower Device Driver Name: \Driver\atapi\ Driver name found: atapi Initialization returned 0x0 Port sub-driver loaded: \??\C:\Windows\System32\drivers\ataport.sys (0x0) Load Function returned 0x0 Downloaded database version: v2013.05.10.09 Downloaded database version: v2013.05.07.01 Initializing... Done! <<<2>>> Device number: 0, partition: 1 Physical Sector Size: 512 Drive: 0, DevicePointer: 0xffffffff86a0eac8, DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\disk\ --------- Disk Stack ------ DevicePointer: 0xffffffff86a0e660, DeviceName: Unknown, DriverName: \Driver\SiRemFil\ DevicePointer: 0xffffffff86a0e7b0, DeviceName: Unknown, DriverName: \Driver\partmgr\ DevicePointer: 0xffffffff86a0eac8, DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\disk\ DevicePointer: 0xffffffff853938a0, DeviceName: \Device\Ide\IdeDeviceP2T0L0-4\, DriverName: \Driver\atapi\ ------------ End ---------- Alternate DeviceName: Unknown, DriverName: \Driver\partmgr\ Upper DeviceData: 0xffffffff9f16c390, 0xffffffff86a0eac8, 0xffffffffc2436ac8 Lower DeviceData: 0xffffffffab20aa48, 0xffffffff853938a0, 0xffffffff86307238 <<<3>>> Volume: C: File system type: NTFS SectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytes Scanning directory: C:\Windows\system32\drivers... <<<2>>> Device number: 0, partition: 1 <<<3>>> Volume: C: File system type: NTFS SectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytes Done! Drive 0 Scanning MBR on drive 0... Inspecting partition table: MBR Signature: 55AA Disk Signature: 790DA712 Partition information: Partition 0 type is Primary (0x7) Partition is ACTIVE. Partition starts at LBA: 2048 Numsec = 976769024 Partition file system is NTFS Partition is bootable Partition 1 type is Empty (0x0) Partition is NOT ACTIVE. Partition starts at LBA: 0 Numsec = 0 Partition 2 type is Empty (0x0) Partition is NOT ACTIVE. Partition starts at LBA: 0 Numsec = 0 Partition 3 type is Empty (0x0) Partition is NOT ACTIVE. Partition starts at LBA: 0 Numsec = 0 Disk Size: 500107862016 bytes Sector size: 512 bytes Scanning physical sectors of unpartitioned space on drive 0 (1-2047-976753168-976773168)... Physical Sector Size: 0 Drive: 1, DevicePointer: 0xffffffff8a178ac8, DeviceName: \Device\Harddisk1\DR1\, DriverName: \Driver\disk\ --------- Disk Stack ------ DevicePointer: 0xffffffff89000398, DeviceName: Unknown, DriverName: \Driver\SiRemFil\ DevicePointer: 0xffffffff8a1787b0, DeviceName: Unknown, DriverName: \Driver\partmgr\ DevicePointer: 0xffffffff8a178ac8, DeviceName: \Device\Harddisk1\DR1\, DriverName: \Driver\disk\ DevicePointer: 0xffffffff8a1c2298, DeviceName: \Device\00000066\, DriverName: \Driver\ti21sony\ ------------ End ---------- Physical Sector Size: 0 Drive: 2, DevicePointer: 0xffffffff8a1e07c0, DeviceName: \Device\Harddisk2\DR2\, DriverName: \Driver\disk\ --------- Disk Stack ------ DevicePointer: 0xffffffff8a178660, DeviceName: Unknown, DriverName: \Driver\SiRemFil\ DevicePointer: 0xffffffff89e00a30, DeviceName: Unknown, DriverName: \Driver\partmgr\ DevicePointer: 0xffffffff8a1e07c0, DeviceName: \Device\Harddisk2\DR2\, DriverName: \Driver\disk\ DevicePointer: 0xffffffff890009a0, DeviceName: \Device\00000067\, DriverName: \Driver\ti21sony\ ------------ End ---------- Done! Performing system, memory and registry scan... Scan Interrupted Done! Initializing... Done! <<<2>>> Device number: 0, partition: 1 <<<3>>> Volume: C: File system type: NTFS SectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytes Scanning directory: C:\Windows\system32\drivers... <<<2>>> Device number: 0, partition: 1 <<<3>>> Volume: C: File system type: NTFS SectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytes Done! Drive 0 Scanning MBR on drive 0... Inspecting partition table: MBR Signature: 55AA Disk Signature: 790DA712 Partition information: Partition 0 type is Primary (0x7) Partition is ACTIVE. Partition starts at LBA: 2048 Numsec = 976769024 Partition file system is NTFS Partition is bootable Partition 1 type is Empty (0x0) Partition is NOT ACTIVE. Partition starts at LBA: 0 Numsec = 0 Partition 2 type is Empty (0x0) Partition is NOT ACTIVE. Partition starts at LBA: 0 Numsec = 0 Partition 3 type is Empty (0x0) Partition is NOT ACTIVE. Partition starts at LBA: 0 Numsec = 0 Disk Size: 500107862016 bytes Sector size: 512 bytes Scanning physical sectors of unpartitioned space on drive 0 (1-2047-976753168-976773168)... Physical Sector Size: 0 Drive: 1, DevicePointer: 0xffffffff8a178ac8, DeviceName: \Device\Harddisk1\DR1\, DriverName: \Driver\disk\ --------- Disk Stack ------ DevicePointer: 0xffffffff89000398, DeviceName: Unknown, DriverName: \Driver\SiRemFil\ DevicePointer: 0xffffffff8a1787b0, DeviceName: Unknown, DriverName: \Driver\partmgr\ DevicePointer: 0xffffffff8a178ac8, DeviceName: \Device\Harddisk1\DR1\, DriverName: \Driver\disk\ DevicePointer: 0xffffffff8a1c2298, DeviceName: \Device\00000066\, DriverName: \Driver\ti21sony\ ------------ End ---------- Physical Sector Size: 0 Drive: 2, DevicePointer: 0xffffffff8a1e07c0, DeviceName: \Device\Harddisk2\DR2\, DriverName: \Driver\disk\ --------- Disk Stack ------ DevicePointer: 0xffffffff8a178660, DeviceName: Unknown, DriverName: \Driver\SiRemFil\ DevicePointer: 0xffffffff89e00a30, DeviceName: Unknown, DriverName: \Driver\partmgr\ DevicePointer: 0xffffffff8a1e07c0, DeviceName: \Device\Harddisk2\DR2\, DriverName: \Driver\disk\ DevicePointer: 0xffffffff890009a0, DeviceName: \Device\00000067\, DriverName: \Driver\ti21sony\ ------------ End ---------- Physical Sector Size: 512 Drive: 3, DevicePointer: 0xffffffffc255e380, DeviceName: \Device\Harddisk3\DR6\, DriverName: \Driver\disk\ --------- Disk Stack ------ DevicePointer: 0xffffffff85af8810, DeviceName: Unknown, DriverName: \Driver\SiRemFil\ DevicePointer: 0xffffffffa447ab88, DeviceName: Unknown, DriverName: \Driver\partmgr\ DevicePointer: 0xffffffffc255e380, DeviceName: \Device\Harddisk3\DR6\, DriverName: \Driver\disk\ DevicePointer: 0xffffffff86e30af8, DeviceName: \Device\00000091\, DriverName: \Driver\USBSTOR\ ------------ End ---------- Alternate DeviceName: Unknown, DriverName: \Driver\partmgr\ Upper DeviceData: 0x0, 0x0, 0x0 Lower DeviceData: 0x0, 0x0, 0x0 Drive 3 Scanning MBR on drive 3... Inspecting partition table: MBR Signature: 55AA Disk Signature: 7E3D0894 Partition information: Partition 0 type is Primary (0x7) Partition is NOT ACTIVE. Partition starts at LBA: 2048 Numsec = 2930274081 Partition 1 type is Empty (0x0) Partition is NOT ACTIVE. Partition starts at LBA: 0 Numsec = 0 Partition 2 type is Empty (0x0) Partition is NOT ACTIVE. Partition starts at LBA: 0 Numsec = 0 Partition 3 type is Empty (0x0) Partition is NOT ACTIVE. Partition starts at LBA: 0 Numsec = 0 Disk Size: 1500301909504 bytes Sector size: 512 bytes Done! Performing system, memory and registry scan... Done! Scan finished ======================================= mbar-log-2013-05-10 (13-10-53).txt system-log.txt

it booted up in normal mode without the FBI virus screen. is there anything else i should do?

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x86) Version: 08-05-2013 Ran by User at 2013-05-09 20:12:37 Run:1 Running from E:\ Boot Mode: Safe Mode (minimal) ============================================== HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce\\*EvtMgr32 => Value deleted successfully. HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\\Shell => Value was restored successfully. C:\Windows\{233F7E35-3B16-0420-3F38-1E091B49DE02}.exe => Moved successfully. ==== End of Fixlog ==== Fixlog.txt

Sorry about that, here you go.. FRST.txt

<p> </p> <div>Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 08-05-2013</div> <div>Ran by User (administrator) on 09-05-2013 16:58:47</div> <div>Running from E:\</div> <div>Windows Vista Home Premium Service Pack 2 (X86) OS Language: English(US)</div> <div>Internet Explorer Version 9</div> <div>Boot Mode: Safe Mode (minimal)</div> <div>==================== Processes (Whitelisted) ===================</div> <div> </div> <div>(Microsoft Corporation) C:\Windows\SYSTEM32\WISPTIS.EXE</div> <div>(Microsoft Corporation) C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe</div> <div>(Microsoft Corporation) C:\Windows\SYSTEM32\WISPTIS.EXE</div> <div>(Microsoft Corporation) C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe</div> <div>(Microsoft Corporation) C:\Windows\system32\cmd.exe</div> <div>(Farbar) e:\FRST.exe</div> <div> </div> <div>==================== Registry (Whitelisted) ==================</div> <div> </div> <div>HKLM\...\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide [1008184 2008-01-20] (Microsoft Corporation)</div> <div>HKLM\...\Run: [RtHDVCpl] RtHDVCpl.exe [x]</div> <div>HKLM\...\Run: [skytel] Skytel.exe [x]</div> <div>HKLM\...\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart [92704 2009-05-26] (NVIDIA Corporation)</div> <div>HKLM\...\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup [8530464 2009-05-26] (NVIDIA Corporation)</div> <div>HKLM\...\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit [88608 2009-05-26] (NVIDIA Corporation)</div> <div>HKLM\...\Run: [googletalk] C:\Program Files\Google\Google Talk\googletalk.exe /autostart [3739648 2007-01-01] (Google)</div> <div>HKLM\...\Run: [Google Quick Search Box] "C:\Program Files\Google\Quick Search Box\GoogleQuickSearchBox.exe" /autorun [126976 2011-06-08] (Google Inc.)</div> <div>HKLM\...\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [946352 2012-12-03] (Adobe Systems Incorporated)</div> <div>HKLM\...\Run: [avast] "C:\Program Files\AVAST Software\Avast\avastUI.exe" /nogui [4767304 2013-03-06] (AVAST Software)</div> <div>HKLM\...\Run: [iSBMgr.exe] "C:\Program Files\Sony\ISB Utility\ISBMgr.exe" [311296 2007-09-19] (Sony Corporation)</div> <div>HKLM\...\Run: [AppMon Utility] "C:\Program Files\Sony\AppMonUtil\AppMonUtility.exe" @@@Start [542560 2007-09-20] (Sony Corporation)</div> <div>HKLM\...\Run: [LWS] C:\Program Files\Logitech\LWS\Webcam Software\LWS.exe -hide [165208 2010-05-07] (Logitech Inc.)</div> <div>HKLM\...\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" [30040 2009-02-26] (Microsoft Corporation)</div> <div>HKLM\...\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime [421888 2011-07-05] (Apple Inc.)</div> <div>HKLM\...\Run: [CanonMyPrinter] C:\Program Files\Canon\MyPrinter\BJMyPrt.exe /logon [2516296 2010-03-24] (CANON INC.)</div> <div>HKLM\...\Run: [CanonSolutionMenuEx] C:\Program Files\Canon\Solution Menu EX\CNSEMAIN.EXE /logon [1185112 2010-04-02] (CANON INC.)</div> <div>HKLM\...\Run: [APSDaemon] "C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe" [59240 2011-11-02] (Apple Inc.)</div> <div>HKLM\...\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" [421736 2011-12-08] (Apple Inc.)</div> <div>HKLM\...\Run: [sunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe" [252848 2012-07-03] (Sun Microsystems, Inc.)</div> <div>HKLM\...\Run: [searchProtectAll] C:\Program Files\SearchProtect\bin\cltmng.exe [2731296 2013-03-06] (Conduit)</div> <div>HKLM\...\RunOnce: [*EvtMgr32] C:\Windows\{233F7E35-3B16-0420-3F38-1E091B49DE02}.exe [329728 2013-05-09] (PEERNET Inc.)</div> <div>HKLM\...\Winlogon: [shell] C:\Windows\{233F7E35-3B16-0420-3F38-1E091B49DE02}.exe [329728 2013-05-09] (PEERNET Inc.)</div> <div>Winlogon\Notify\VESWinlogon: VESWinlogon.dll (Sony Corporation)</div> <div>HKCU\...\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter [x]</div> <div>HKCU\...\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [39408 2011-06-08] (Google Inc.)</div> <div>HKCU\...\Run: [Google Update] "C:\Users\User\AppData\Local\Google\Update\GoogleUpdate.exe" /c [136176 2011-06-08] (Google Inc.)</div> <div>HKCU\...\Run: [searchProtect] C:\Users\User\AppData\Roaming\SearchProtect\bin\cltmng.exe [2731296 2013-03-06] (Conduit)</div> <div>MountPoints2: {884eb048-a2d3-11e0-8917-001a80f6721f} - G:\setup.exe -a</div> <div>HKU\Guest\...\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime [ 2011-07-05] (Apple Inc.)</div> <div>Startup: C:\Users\User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\HMA Pro VPN 2.0.lnk</div> <div>ShortcutTarget: HMA Pro VPN 2.0.lnk -> C:\Program Files\HMA! Pro VPN\bin\HMA! Pro VPN.exe (Privax)</div> <div> </div> <div>==================== Internet (Whitelisted) ====================</div> <div> </div> <div>HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://start.sweetpacks.com/?src=10&st=12&crg=3.5000006.10042&barid={C6B3CC60-8B74-11E2-8821-001A80F6721F}</div> <div>HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://www.msn.com/</div> <div>HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://start.sweetpacks.com/?src=10&st=12&crg=3.5000006.10042&barid={C6B3CC60-8B74-11E2-8821-001A80F6721F}</div> <div>URLSearchHook: uTorrentControl_v6 Toolbar - {96f454ea-9d38-474f-b504-56193e00c1a5} - C:\Program Files\uTorrentControl_v6\prxtbuTor.dll (Conduit Ltd.)</div> <div>HKLM SearchScopes: DefaultScope {EEE6C360-6118-11DC-9C72-001320C79847} URL = http://start.sweetpacks.com/?src=6&q={searchTerms}&st=12&crg=3.5000006.10042&barid={C6B3CC60-8B74-11E2-8821-001A80F6721F}</div> <div>SearchScopes: HKLM - {EEE6C360-6118-11DC-9C72-001320C79847} URL = http://start.sweetpacks.com/?src=6&q={searchTerms}&st=12&crg=3.5000006.10042&barid={C6B3CC60-8B74-11E2-8821-001A80F6721F}</div> <div>SearchScopes: HKCU - {EEE6C360-6118-11DC-9C72-001320C79847} URL = http://start.sweetpacks.com/?src=6&q={searchTerms}&st=12&crg=3.5000006.10042&barid={C6B3CC60-8B74-11E2-8821-001A80F6721F}</div> <div>BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn0\yt.dll (Yahoo! Inc.)</div> <div>BHO: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)</div> <div>BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)</div> <div>BHO: Java Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)</div> <div>BHO: avast! WebRep - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)</div> <div>BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)</div> <div>BHO: uTorrentControl_v6 Toolbar - {96f454ea-9d38-474f-b504-56193e00c1a5} - C:\Program Files\uTorrentControl_v6\prxtbuTor.dll (Conduit Ltd.)</div> <div>BHO: Search Toolbar - {9D425283-D487-4337-BAB6-AB8354A81457} - C:\Program Files\Search Toolbar\SearchToolbar.dll ()</div> <div>BHO: Windows Live Messenger Companion Helper - {9FDDE16B-836F-4806-AB1F-1455CBEFF289} - C:\Program Files\Windows Live\Companion\companioncore.dll (Microsoft Corporation)</div> <div>BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)</div> <div>BHO: Skype Browser Helper - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)</div> <div>BHO: Updater By SweetPacks - {C4CFC0DE-134F-4466-B2A2-FF7C59A8BFAD} - C:\Program Files\Updater By SweetPacks\Extension32.dll ()</div> <div>BHO: Bing Bar Helper - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - "C:\Program Files\Microsoft\BingBar\BingExt.dll" No File</div> <div>BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)</div> <div>BHO: SweetPacks Browser Helper - {EEE6C35C-6118-11DC-9C72-001320C79847} - C:\Program Files\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll (SweetIM Technologies Ltd.)</div> <div>BHO: SingleInstance Class - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn0\YTSingleInstance.dll (Yahoo! Inc)</div> <div>Toolbar: HKLM - Search Toolbar - {9D425283-D487-4337-BAB6-AB8354A81457} - C:\Program Files\Search Toolbar\SearchToolbar.dll ()</div> <div>Toolbar: HKLM - avast! WebRep - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)</div> <div>Toolbar: HKLM - Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn0\yt.dll (Yahoo! Inc.)</div> <div>Toolbar: HKLM - Bing Bar - {8dcb7100-df86-4384-8842-8fa844297b3f} - "C:\Program Files\Microsoft\BingBar\BingExt.dll" No File</div> <div>Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)</div> <div>Toolbar: HKLM - uTorrentControl_v6 Toolbar - {96f454ea-9d38-474f-b504-56193e00c1a5} - C:\Program Files\uTorrentControl_v6\prxtbuTor.dll (Conduit Ltd.)</div> <div>Toolbar: HKLM - SweetPacks Toolbar for Internet Explorer - {EEE6C35B-6118-11DC-9C72-001320C79847} - C:\Program Files\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll (SweetIM Technologies Ltd.)</div> <div>Toolbar: HKCU -Google Toolbar - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)</div> <div>Toolbar: HKCU -Search Toolbar - {9D425283-D487-4337-BAB6-AB8354A81457} - C:\Program Files\Search Toolbar\SearchToolbar.dll ()</div> <div>PDF: {02CF1781-EA91-4FA5-A200-646E8241987C} http://esupport.sony.com/VaioInfo.CAB</div> <div>PDF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab</div> <div>Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll (Microsoft Corporation)</div> <div>Handler: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\Windows Live\Messenger\msgrapp.dll (Microsoft Corporation)</div> <div>Handler: ms-help - {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll (Microsoft Corporation)</div> <div>Handler: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\Windows Live\Messenger\msgrapp.dll (Microsoft Corporation)</div> <div>Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)</div> <div>Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)</div> <div>Handler: wlmailhtml - {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - C:\Program Files\Windows Live\Mail\mailcomm.dll (Microsoft Corporation)</div> <div>Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll (Microsoft Corporation)</div> <div>Winsock: Catalog5 07 C:\Program Files\Bonjour\mdnsNSP.dll [19968] (Microsoft Corporation)</div> <div>Winsock: Catalog9 01 C:\Program Files\HMA! Pro VPN\bin\ForceInterfaceLSP.dll [19968] (Microsoft Corporation)</div> <div>Winsock: Catalog9 02 C:\Program Files\HMA! Pro VPN\bin\ForceInterfaceLSP.dll [19968] (Microsoft Corporation)</div> <div>Winsock: Catalog9 03 C:\Program Files\HMA! Pro VPN\bin\ForceInterfaceLSP.dll [19968] (Microsoft Corporation)</div> <div>Winsock: Catalog9 04 C:\Program Files\HMA! Pro VPN\bin\ForceInterfaceLSP.dll [19968] (Microsoft Corporation)</div> <div>Winsock: Catalog9 05 C:\Program Files\HMA! Pro VPN\bin\ForceInterfaceLSP.dll [19968] (Microsoft Corporation)</div> <div>Winsock: Catalog9 16 C:\Program Files\HMA! Pro VPN\bin\ForceInterfaceLSP.dll [223232] (Microsoft Corporation)</div> <div>Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt</div> <div>Tcpip\Parameters: [DhcpNameServer] 192.168.0.1 75.75.75.75 75.75.76.76</div> <div>Tcpip\..\Interfaces\{D1A0B3FF-C733-49B9-8BC2-C1978F806AEB}: [NameServer]208.67.222.222 208.67.220.220</div> <div> </div> <div>FireFox:</div> <div>========</div> <div>FF ProfilePath: C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\0</div> <div>FF Plugin: @Apple.com/iTunes,version=1.0 - C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()</div> <div>FF Plugin: @canon.com/EPPEX - C:\Program Files\Canon\Easy-PhotoPrint EX\NPEZFFPI.DLL (CANON INC.)</div> <div>FF Plugin: @Google.com/GoogleEarthPlugin - C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)</div> <div>FF Plugin: @java.com/DTPlugin,version=10.17.2 - C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)</div> <div>FF Plugin: @java.com/JavaPlugin,version=10.17.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)</div> <div>FF Plugin: @messenger.yahoo.com/YahooMessengerStatePlugin;version=1.0.0.6 - C:\Program Files\Yahoo!\Shared\npYState.dll (Yahoo! Inc.)</div> <div>FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.20125.0\npctrl.dll ( Microsoft Corporation)</div> <div>FF Plugin: @microsoft.com/WLPG,version=15.4.3502.0922 - C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)</div> <div>FF Plugin: @microsoft.com/WLPG,version=15.4.3538.0513 - C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)</div> <div>FF Plugin: @microsoft.com/WPF,version=3.5 - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)</div> <div>FF Plugin: @pack.google.com/Google Updater;version=14 - C:\Program Files\Google\Google Updater\2.4.2432.1652\npCIDetect14.dll (Google)</div> <div>FF Plugin: @tools.google.com/Google Update;version=3 - C:\Program Files\Google\Update\1.3.21.145\npGoogleUpdate3.dll (Google Inc.)</div> <div>FF Plugin: @tools.google.com/Google Update;version=9 - C:\Program Files\Google\Update\1.3.21.145\npGoogleUpdate3.dll (Google Inc.)</div> <div>FF Plugin: @wacom.com/wacom-plugin,version=1.1.0.3 - C:\Program Files\TabletPlugins\npwacom.dll (Wacom, Inc.)</div> <div>FF Plugin: Adobe Reader - C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)</div> <div>FF Extension: torntv - C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\0\Extensions\torntv@torntv.com.xpi</div> <div> </div> <div>Chrome: </div> <div>=======</div> <div>CHR RestoreOnStartup: "hxxp://start.sweetpacks.com/?src=10&st=12&crg=3.5000006.10042&barid={C6B3CC60-8B74-11E2-8821-001A80F6721F}"</div> <div>CHR DefaultSearchURL: (Bing) - http://start.sweetpacks.com/?src=6&q={searchTerms}&st=12&crg=3.5000006.10042&barid={C6B3CC60-8B74-11E2-8821-001A80F6721F}</div> <div>CHR DefaultSuggestURL: (Bing) - "suggest_url": ""</div> <div>CHR Plugin: (Shockwave Flash) - C:\Program Files\Google\Chrome\Application\22.0.1229.79\PepperFlash\pepflashplayer.dll No File</div> <div>CHR Plugin: (Chrome Remote Desktop Viewer) - internal-remoting-viewer</div> <div>CHR Plugin: (Native Client) - C:\Program Files\Google\Chrome\Application\26.0.1410.64\ppGoogleNaClPluginChrome.dll ()</div> <div>CHR Plugin: (Chrome PDF Viewer) - C:\Program Files\Google\Chrome\Application\26.0.1410.64\pdf.dll ()</div> <div>CHR Plugin: (Adobe Acrobat) - C:\Program Files\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll (Adobe Systems Inc.)</div> <div>CHR Plugin: (Java Deployment Toolkit 6.0.260.3) - C:\Program Files\Java\jre6\bin\new_plugin\npdeployJava1.dll No File</div> <div>CHR Plugin: (Java Platform SE 6 U26) - C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll No File</div> <div>CHR Plugin: (QuickTime Plug-in 7.7) - C:\Program Files\QuickTime\plugins\npqtplugin.dll (Apple Inc.)</div> <div>CHR Plugin: (QuickTime Plug-in 7.7) - C:\Program Files\QuickTime\plugins\npqtplugin2.dll (Apple Inc.)</div> <div>CHR Plugin: (QuickTime Plug-in 7.7) - C:\Program Files\QuickTime\plugins\npqtplugin3.dll (Apple Inc.)</div> <div>CHR Plugin: (QuickTime Plug-in 7.7) - C:\Program Files\QuickTime\plugins\npqtplugin4.dll (Apple Inc.)</div> <div>CHR Plugin: (QuickTime Plug-in 7.7) - C:\Program Files\QuickTime\plugins\npqtplugin5.dll (Apple Inc.)</div> <div>CHR Plugin: (QuickTime Plug-in 7.7) - C:\Program Files\QuickTime\plugins\npqtplugin6.dll (Apple Inc.)</div> <div>CHR Plugin: (QuickTime Plug-in 7.7) - C:\Program Files\QuickTime\plugins\npqtplugin7.dll (Apple Inc.)</div> <div>CHR Plugin: (Google Talk Plugin) - C:\Users\User\AppData\Roaming\Mozilla\plugins\npgoogletalk.dll (Google)</div> <div>CHR Plugin: (Google Talk Plugin Video Accelerator) - C:\Users\User\AppData\Roaming\Mozilla\plugins\npgtpo3dautoplugin.dll ()</div> <div>CHR Plugin: (CANON iMAGE GATEWAY Album Plugin Utility) - C:\Program Files\Canon\Easy-PhotoPrint EX\NPEZFFPI.DLL (CANON INC.)</div> <div>CHR Plugin: (Google Earth Plugin) - C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)</div> <div>CHR Plugin: (Google Updater) - C:\Program Files\Google\Google Updater\2.4.2432.1652\npCIDetect14.dll (Google)</div> <div>CHR Plugin: (Google Update) - C:\Program Files\Google\Update\1.3.21.123\npGoogleUpdate3.dll No File</div> <div>CHR Plugin: ( Wacom Dynamic Link Library) - C:\Program Files\TabletPlugins\npwacom.dll (Wacom, Inc.)</div> <div>CHR Plugin: (Windows Live\u0099 Photo Gallery) - C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)</div> <div>CHR Plugin: (iTunes Application Detector) - C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()</div> <div>CHR Plugin: (Silverlight Plug-In) - c:\Program Files\Microsoft Silverlight\4.1.10329.0\npctrl.dll No File</div> <div>CHR Plugin: (Windows Presentation Foundation) - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)</div> <div>CHR Extension: (YouTube) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.6_0</div> <div>CHR Extension: (uTorrentControl_v6) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\cflheckfmhopnialghigdlggahiomebp\10.15.0.562_0</div> <div>CHR Extension: (Google Search) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.20_0</div> <div>CHR Extension: (Updater By SweetPacks) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\dlnembnfbcpjnepmfjmngjenhhajpdfd\2.0.0.566_0</div> <div>CHR Extension: (avast! WebRep) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\icmlaeflemplmjndnaapfdbbnpncnbda\8.0.1483_0</div> <div>CHR Extension: (Torntv) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\jbpkiefagocgkmemidfngdkamloieekf\1.1_0</div> <div>CHR Extension: (Skype Click to Call) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl\5.6.0.8442_0</div> <div>CHR Extension: (SweetPacks Chrome Extension) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\ogccgbmabaphcakpiclgcnmcnimhokcj\1.3.0.3_0</div> <div>CHR Extension: (Gmail) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_1</div> <div> </div> <div>========================== Services (Whitelisted) =================</div> <div> </div> <div>S2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [45248 2013-03-06] (AVAST Software)</div> <div>S2 CltMngSvc; C:\Program Files\SearchProtect\bin\CltMngSvc.exe [93984 2013-03-06] (Conduit)</div> <div>S2 IJPLMSVC; C:\Program Files\Canon\IJPLM\IJPLMSVC.EXE [116104 2010-04-05] ()</div> <div>S3 OpenVPNService; C:\Program Files\HMA! Pro VPN\bin\openvpnserv.exe [36352 2012-11-19] ()</div> <div>S2 SampleCollector; C:\Program Files\Sony\VAIO Care\VCPerfService.exe [187792 2010-08-12] (Sony Corporation)</div> <div>S2 Updater By SweetPacks; C:\Program Files\Updater By SweetPacks\ExtensionUpdaterService.exe [188760 2013-02-28] ()</div> <div>S3 VcmIAlzMgr; C:\Program Files\Sony\VCM Intelligent Analyzing Manager\VcmIAlzMgr.exe [480624 2009-09-16] (Sony Corporation)</div> <div>S3 VUAgent; C:\Program Files\Sony\VAIO Update\VUAgent.exe [957056 2012-10-26] (Sony Corporation)</div> <div>S2 WTouchService; C:\Program Files\WTouch\WTouchService.exe [113448 2009-11-23] (Wacom Technology, Corp.)</div> <div>S3 msiserver; %systemroot%\system32\msiexec /V [x]</div> <div> </div> <div>==================== Drivers (Whitelisted) ====================</div> <div> </div> <div>S2 aswFsBlk; C:\Windows\System32\Drivers\aswFsBlk.sys [29816 2013-03-06] (AVAST Software)</div> <div>S2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [66336 2013-03-06] (AVAST Software)</div> <div>S1 aswRdr; C:\Windows\System32\Drivers\aswRdr.sys [49760 2013-03-06] (AVAST Software)</div> <div>R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [49248 2013-03-06] ()</div> <div>S1 aswSnx; C:\Windows\System32\Drivers\aswSnx.sys [765736 2013-03-06] (AVAST Software)</div> <div>S1 aswSP; C:\Windows\System32\Drivers\aswSP.sys [368176 2013-03-06] (AVAST Software)</div> <div>S1 aswTdi; C:\Windows\System32\Drivers\aswTdi.sys [62376 2013-03-06] (AVAST Software)</div> <div>S3 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [164736 2013-03-06] ()</div> <div>S3 CompFilter; C:\Windows\System32\DRIVERS\lvbusflt.sys [20704 2010-05-14] (Logitech Inc.)</div> <div>S3 LVPr2Mon; C:\Windows\System32\DRIVERS\LVPr2Mon.sys [25824 2010-05-07] ()</div> <div>S3 OVT511Plus; C:\Windows\System32\Drivers\omcamvid.sys [167816 2001-09-18] (OmniVision Technologies, Inc.)</div> <div>S3 R5U870FLx86; C:\Windows\System32\Drivers\R5U870FLx86.sys [73472 2008-01-08] (Ricoh)</div> <div>S3 R5U870FUx86; C:\Windows\System32\Drivers\R5U870FUx86.sys [43904 2008-01-08] (Ricoh)</div> <div>R0 SI3132; C:\Windows\System32\DRIVERS\SI3132.sys [80424 2007-10-03] (Silicon Image, Inc)</div> <div>R0 SiFilter; C:\Windows\System32\DRIVERS\SiWinAcc.sys [19240 2007-10-03] (Silicon Image, Inc)</div> <div>R0 SiRemFil; C:\Windows\System32\DRIVERS\SiRemFil.sys [15400 2007-10-03] (Silicon Image, Inc)</div> <div>S3 tap0901; C:\Windows\System32\DRIVERS\tap0901.sys [26112 2012-11-19] (The OpenVPN Project)</div> <div>S3 ti21sony; C:\Windows\System32\drivers\ti21sony.sys [812544 2007-06-05] (Texas Instruments)</div> <div>R3 WacomVTHid; C:\Windows\System32\DRIVERS\WacomVTHid.sys [13480 2009-07-09] (Wacom Technology)</div> <div>S3 IpInIp; system32\DRIVERS\ipinip.sys [x]</div> <div>S3 NwlnkFlt; system32\DRIVERS\nwlnkflt.sys [x]</div> <div>S3 NwlnkFwd; system32\DRIVERS\nwlnkfwd.sys [x]</div> <div>S3 UIUSys; system32\DRIVERS\UIUSYS.SYS [x]</div> <div> </div> <div>==================== NetSvcs (Whitelisted) ===================</div> <div> </div> <div> </div> <div>==================== One Month Created Files and Folders ========</div> <div> </div> <div>2013-05-09 13:52 - 2013-05-09 13:52 - 00000000 ____D C:\FRST</div> <div>2013-05-09 07:37 - 2013-05-09 07:37 - 00035005 ____A C:\Users\User\Downloads\Teachs+-+Timo+Garrett+%26+Brian+Davilla.mp4.torrent</div> <div>2013-05-09 07:37 - 2013-05-09 07:37 - 00030359 ____A C:\Users\User\Downloads\Sweat+-+Ronny+Howard+%26+Billy+Webster.mov.torrent</div> <div>2013-05-09 07:37 - 2013-05-09 07:37 - 00017566 ____A C:\Users\User\Downloads\Spritzz+Winks+take.avi.torrent</div> <div>2013-05-09 07:37 - 2013-05-09 07:37 - 00011426 ____A C:\Users\User\Downloads\%5BBAO+-+Kinky+Angels%5D+Breaking+Trevor%27s+Neck.mp4.torrent</div> <div>2013-05-09 07:36 - 2013-05-09 07:36 - 00096663 ____A C:\Users\User\Downloads\%5Bo%5D+%5BPunk%5D+Nation+3.mp4.torrent</div> <div>2013-05-09 07:36 - 2013-05-09 07:36 - 00018865 ____A C:\Users\User\Downloads\%5BBAO+-+Kinky+Angels%5D+The+Other+Side+of+Gino.mp4.torrent</div> <div>2013-05-09 07:36 - 2013-05-09 07:36 - 00012355 ____A C:\Users\User\Downloads\Corbin+Fisher+-ACM1306-+Ashton%27s+%28Dixon%29+-+Back.mp4.torrent</div> <div>2013-05-09 07:35 - 2013-05-09 07:35 - 00031677 ____A C:\Users\User\Downloads\Czech+Hunter+88.mp4.torrent</div> <div>2013-05-09 07:35 - 2013-05-09 07:35 - 00013405 ____A C:\Users\User\Downloads\%5BBAO+-+Kinky+Angels%5D+Adam+Doesn%27t+Hesitate.mp4.torrent</div> <div>2013-05-09 07:34 - 2013-05-09 07:34 - 00042249 ____A C:\Users\User\Downloads\Sean+Cody+1597+Joel+%26+Troy+BB+540.wmv.torrent</div> <div>2013-05-09 07:34 - 2013-05-09 07:34 - 00021969 ____A C:\Users\User\Downloads\Blue+Pictures+-+Back.wmv.torrent</div> <div>2013-05-09 07:34 - 2013-05-09 07:34 - 00018358 ____A C:\Users\User\Downloads\%5BBAO+-+Kinky+Angels%5D+Turbulence+Ahead.mp4.torrent</div> <div>2013-05-09 07:34 - 2013-05-09 07:34 - 00012178 ____A C:\Users\User\Downloads\%5BBAO+-+Kinky+Angels%5D+Take+Your+Seat.mp4.torrent</div> <div>2013-05-09 07:32 - 2013-05-09 07:32 - 00020513 ____A C:\Users\User\Downloads\%5BChaos%5D+Bryan+and+Kelton-++Bossy.mp4.torrent</div> <div>2013-05-09 07:31 - 2013-05-09 07:31 - 00018920 ____A C:\Users\User\Downloads\%5BTony%5D+Jeremy+Stevens+and+Paul+Stack.mp4.torrent</div> <div>2013-05-09 07:31 - 2013-05-09 07:31 - 00017171 ____A C:\Users\User\Downloads\%5Brobbymendez.com%5D+Jayden+Alexander+%26+Robby+Mendez.torrent</div> <div>2013-05-09 07:31 - 2013-05-09 07:31 - 00014688 ____A C:\Users\User\Downloads\%5BBatino+Bashin.mov.torrent</div> <div>2013-05-09 07:31 - 2013-05-09 07:31 - 00013898 ____A C:\Users\User\Downloads\%5BStudio%5D+Just+For+You+-+Guys+Like+Us+-+Sc+3+-+Angel+Rock+and+Wolfie+Blue.mp4.torrent</div> <div>2013-05-09 07:31 - 2013-05-09 07:31 - 00012110 ____A C:\Users\User\Downloads\%5Brobbymendez.com%5D+Jayden+Alexander+Robby+Mendez.mp4.torrent</div> <div>2013-05-09 07:30 - 2013-05-09 07:30 - 00017842 ____A C:\Users\User\Downloads\%5BKristen+Bjorn%5D+Reality+%23+1+-+Diesel+O%27+Green+and+Julio+Rey.mp4.torrent</div> <div>2013-05-09 07:30 - 2013-05-09 07:30 - 00012619 ____A C:\Users\User\Downloads\%5BEric+Videos%5D+Nathan+loaded+on+a+highway+rest+stop.mp4.torrent</div> <div>2013-05-09 07:29 - 2013-05-09 07:29 - 00030849 ____A C:\Users\User\Downloads\Breakfast+Sex+%28Shane+Frost+Ashton+Webber%29.mp4.torrent</div> <div>2013-05-09 07:26 - 2013-05-09 07:26 - 00034059 ____A C:\Users\User\Downloads\RandyBlue+-+Austin%2C+Chris%2C+and+Jordan.mp4.torrent</div> <div>2013-05-09 07:26 - 2013-05-09 07:26 - 00010777 ____A C:\Users\User\Downloads\%5BBAO+-+Kinky+Angels%5D+Perfect+Match.mp4.torrent</div> <div>2013-05-09 07:25 - 2013-05-09 07:26 - 00012092 ____A C:\Users\User\Downloads\+Shooter.mp4.torrent</div> <div>2013-05-09 07:25 - 2013-05-09 07:25 - 00027209 ____A C:\Users\User\Downloads\Nation+-+Tim+%26+Fin.mp4.torrent</div> <div>2013-05-09 07:24 - 2013-05-09 07:23 - 00329728 ___SH (PEERNET Inc.) C:\Windows\{233F7E35-3B16-0420-3F38-1E091B49DE02}.exe</div> <div>2013-05-09 07:23 - 2013-05-09 07:24 - 00034061 ____A C:\Users\User\Downloads\Club+-+Aaron%2CAdam%2CDerek+%26+Jessy.mp4.torrent</div> <div>2013-05-07 16:51 - 2013-05-07 16:51 - 00017811 ____A C:\Users\User\Downloads\Roadstrip+Ep+1+-+Boys+-+2013+%28H264.AAC+39m%29.mp4.torrent</div> <div>2013-05-07 16:51 - 2013-05-07 16:51 - 00011071 ____A C:\Users\User\Downloads\%5BHelix%5D+-+Hayden+Clark+and+Aiden+Summers.mp4.torrent</div> <div>2013-05-07 16:50 - 2013-05-07 16:50 - 00018458 ____A C:\Users\User\Downloads\Bangover.mp4.torrent</div> <div>2013-05-07 16:50 - 2013-05-07 16:50 - 00012669 ____A C:\Users\User\Downloads\Jake+Bass+%26+Levi+Karter.mp4.torrent</div> <div>2013-05-07 16:49 - 2013-05-07 16:49 - 00019367 ____A C:\Users\User\Downloads\Dylan+Lucas+-+Lance+Alexander+Jimmy+Clay.torrent</div> <div>2013-05-07 16:48 - 2013-05-07 16:49 - 00047139 ____A C:\Users\User\Downloads\%5Bo%5D+%5BDylan+Lucas%5D+Brady+Jensen+Lance+Alexander.mp4.torrent</div> <div> </div> <div> </div> <div>==================== One Month Modified Files and Folders ========</div> <div> </div> <div>2013-05-09 16:57 - 2006-11-02 03:33 - 00703388 ____A C:\Windows\System32\PerfStringBackup.INI</div> <div>2013-05-09 16:42 - 2011-07-26 06:46 - 00000000 ____D C:\Windows\System32\logishrd</div> <div>2013-05-09 16:42 - 2011-06-08 18:47 - 00000878 ____A C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job</div> <div>2013-05-09 16:42 - 2006-11-02 05:47 - 00003760 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0</div> <div>2013-05-09 16:42 - 2006-11-02 05:47 - 00003760 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0</div> <div>2013-05-09 16:41 - 2006-11-02 06:01 - 00000006 ___AH C:\Windows\Tasks\SA.DAT</div> <div>2013-05-09 14:26 - 2009-04-11 05:37 - 01597457 ____A C:\Windows\WindowsUpdate.log</div> <div>2013-05-09 13:52 - 2013-05-09 13:52 - 00000000 ____D C:\FRST</div> <div>2013-05-09 07:42 - 2008-01-20 19:47 - 00139988 ____A C:\Windows\PFRO.log</div> <div>2013-05-09 07:41 - 2012-03-05 19:39 - 00000000 ____D C:\Users\User\AppData\Roaming\Azureus</div> <div>2013-05-09 07:37 - 2013-05-09 07:37 - 00035005 ____A C:\Users\User\Downloads\Teach+-+Timo+Garrett+%26+Brian+Davilla.mp4.torrent</div> <div>2013-05-09 07:37 - 2013-05-09 07:37 - 00030359 ____A C:\Users\User\Downloads\Sweat+-+Ronny+Howard+%26+Billy+Webster.mov.torrent</div> <div>2013-05-09 07:37 - 2013-05-09 07:37 - 00017566 ____A C:\Users\User\Downloads\Spritzz+Winks+take.avi.torrent</div> <div>2013-05-09 07:37 - 2013-05-09 07:37 - 00011426 ____A C:\Users\User\Downloads\%5BBAO+-+Kinky+Angels%5D+Breaking+Trevor%27s+Neck.mp4.torrent</div> <div>2013-05-09 07:36 - 2013-05-09 07:36 - 00096663 ____A C:\Users\User\Downloads\%5Bo%5D+%5BPunk%5D+Nation+3.mp4.torrent</div> <div>2013-05-09 07:36 - 2013-05-09 07:36 - 00018865 ____A C:\Users\User\Downloads\%5BBAO+-+Kinky+Angels%5D+The+Other+Side+of+Gino.mp4.torrent</div> <div>2013-05-09 07:36 - 2013-05-09 07:36 - 00012355 ____A C:\Users\User\Downloads\Corbin+Fisher+-ACM1306-+Ashton%27s+%28Dixon%29+-+Back.mp4.torrent</div> <div>2013-05-09 07:35 - 2013-05-09 07:35 - 00031677 ____A C:\Users\User\Downloads\Czech+Hunter+88.mp4.torrent</div> <div>2013-05-09 07:35 - 2013-05-09 07:35 - 00013405 ____A C:\Users\User\Downloads\%5BBAO+-+Kinky+Angels%5D+Adam+Doesn%27t+Hesitate.mp4.torrent</div> <div>2013-05-09 07:34 - 2013-05-09 07:34 - 00042249 ____A C:\Users\User\Downloads\Sean+Cody+1597+Joel+%26+Troy+BB+540.wmv.torrent</div> <div>2013-05-09 07:34 - 2013-05-09 07:34 - 00021969 ____A C:\Users\User\Downloads\Blue+Pictures+-+Back.wmv.torrent</div> <div>2013-05-09 07:34 - 2013-05-09 07:34 - 00018358 ____A C:\Users\User\Downloads\%5BBAO+-+Kinky+Angels%5D+Turbulence+Ahead.mp4.torrent</div> <div>2013-05-09 07:34 - 2013-05-09 07:34 - 00012178 ____A C:\Users\User\Downloads\%5BBAO+-+Kinky+Angels%5D+Take+Your+Seat.mp4.torrent</div> <div>2013-05-09 07:34 - 2011-06-08 20:42 - 00000904 ____A C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2518506455-3246167175-1989359215-1000UA.job</div> <div>2013-05-09 07:32 - 2013-05-09 07:32 - 00020513 ____A C:\Users\User\Downloads\%5BChaos%5D+Bryan+and+Kelton-++Bossy.mp4.torrent</div> <div>2013-05-09 07:31 - 2013-05-09 07:31 - 00018920 ____A C:\Users\User\Downloads\%5BTony%5D+Jeremy+Stevens+and+Paul+Stack.mp4.torrent</div> <div>2013-05-09 07:31 - 2013-05-09 07:31 - 00017171 ____A C:\Users\User\Downloads\%5Brobbymendez.com%5D+Jayden+Alexander+%26+Robby+Mendez.torrent</div> <div>2013-05-09 07:31 - 2013-05-09 07:31 - 00014688 ____A C:\Users\User\Downloads\%5BBatino+Bashin.mov.torrent</div> <div>2013-05-09 07:31 - 2013-05-09 07:31 - 00013898 ____A C:\Users\User\Downloads\%5BStudio%5D+Just+For+You+-+Guys+Like+Us+-+Sc+3+-+Angel+Rock+and+Wolfie+Blue.mp4.torrent</div> <div>2013-05-09 07:31 - 2013-05-09 07:31 - 00012110 ____A C:\Users\User\Downloads\%5Brobbymendez.com%5D+Jayden+Alexander+Robby+Mendez.mp4.torrent</div> <div>2013-05-09 07:30 - 2013-05-09 07:30 - 00017842 ____A C:\Users\User\Downloads\%5BKristen+Bjorn%5D+Reality+%23+1+-+Diesel+O%27+Green+and+Julio+Rey.mp4.torrent</div> <div>2013-05-09 07:30 - 2013-05-09 07:30 - 00012619 ____A C:\Users\User\Downloads\%5BEric+Videos%5D+Nathan+loaded+on+a+highway+rest+stop.mp4.torrent</div> <div>2013-05-09 07:29 - 2013-05-09 07:29 - 00030849 ____A C:\Users\User\Downloads\Breakfast+Sex+%28Shane+Frost+Ashton+Webber%29.mp4.torrent</div> <div>2013-05-09 07:26 - 2013-05-09 07:26 - 00034059 ____A C:\Users\User\Downloads\RandyBlue+-+Austin%2C+Chris%2C+and+Jordan.mp4.torrent</div> <div>2013-05-09 07:26 - 2013-05-09 07:26 - 00010777 ____A C:\Users\User\Downloads\%5BBAO+-+Kinky+Angels%5D+Perfect+Match.mp4.torrent</div> <div>2013-05-09 07:26 - 2013-05-09 07:25 - 00012092 ____A C:\Users\User\Downloads\+Shooter.mp4.torrent</div> <div>2013-05-09 07:25 - 2013-05-09 07:25 - 00027209 ____A C:\Users\User\Downloads\Nation+-+Tim+%26+Fin.mp4.torrent</div> <div>2013-05-09 07:24 - 2013-05-09 07:23 - 00034061 ____A C:\Users\User\Downloads\Club+-+Aaron%2CAdam%2CDerek+%26+Jessy.mp4.torrent</div> <div>2013-05-09 07:23 - 2013-05-09 07:24 - 00329728 ___SH (PEERNET Inc.) C:\Windows\{233F7E35-3B16-0420-3F38-1E091B49DE02}.exe</div> <div>2013-05-09 06:58 - 2011-06-08 18:47 - 00000882 ____A C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job</div> <div>2013-05-09 03:34 - 2011-06-08 20:42 - 00000852 ____A C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2518506455-3246167175-1989359215-1000Core.job</div> <div>2013-05-08 21:34 - 2011-06-08 18:46 - 00000868 ____A C:\Windows\Tasks\Google Software Updater.job</div> <div>2013-05-07 16:51 - 2013-05-07 16:51 - 00017811 ____A C:\Users\User\Downloads\Roadstrip+Ep+1+-+Boys+-+2013+%28H264.AAC+39m%29.mp4.torrent</div> <div>2013-05-07 16:51 - 2013-05-07 16:51 - 00011071 ____A C:\Users\User\Downloads\%5BHelix%5D+-+Hayden+Clark+and+Aiden+Summers.mp4.torrent</div> <div>2013-05-07 16:50 - 2013-05-07 16:50 - 00018458 ____A C:\Users\User\Downloads\Bangover.mp4.torrent</div> <div>2013-05-07 16:50 - 2013-05-07 16:50 - 00012669 ____A C:\Users\User\Downloads\Jake+Bass+%26+Levi+Karter.mp4.torrent</div> <div>2013-05-07 16:49 - 2013-05-07 16:49 - 00019367 ____A C:\Users\User\Downloads\Dylan+Lucas+-+Lance+Alexander+Jimmy+Clay.torrent</div> <div>2013-05-07 16:49 - 2013-05-07 16:48 - 00047139 ____A C:\Users\User\Downloads\%5Bo%5D+%5BDylan+Lucas%5D+Brady+Jensen+Lance+Alexander.mp4.torrent</div> <div> </div> <div> </div> <div>==================== Bamital & volsnap Check =================</div> <div> </div> <div>C:\Windows\explorer.exe => MD5 is legit</div> <div>C:\Windows\System32\winlogon.exe => MD5 is legit</div> <div>C:\Windows\System32\wininit.exe => MD5 is legit</div> <div>C:\Windows\System32\svchost.exe => MD5 is legit</div> <div>C:\Windows\System32\services.exe => MD5 is legit</div> <div>C:\Windows\System32\User32.dll => MD5 is legit</div> <div>C:\Windows\System32\userinit.exe => MD5 is legit</div> <div>C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit</div> <div> </div> <div> </div> <div>Last Boot: 2013-05-09 14:49</div> <div> </div> <div>==================== End Of Log ============================</div>

Can Not get past FBI warning screen. My laptop apparently has a version of this virus that is not responding to any of the options talked about. My laptop responds the same way in safe mode/ safemode with networking as it does it in normal..the FBI screen appears in all modes except safemode command prompt making any of the options listed above impossible to implement. Can anyone offer any advice????