Jump to content

justime

Members
 View Profile  See their activity

  • Posts

    18

  • Joined

  • Last visited

 Content Type 

Everything posted by justime

  1. justime
    thank you so much for helping me with my computer
  2. justime
    thank you it is working now 1
  3. justime
    that is all good but i did forget about this ("Combofix acidentally took out your audio service. We´ll fix this. Please post up C:\qoobox\ComboFix-quarantined-files.txt ") and have already uninstalled combofix
  4. justime
    # AdwCleaner v2.306 - Logfile created 07/22/2013 at 09:16:12 # Updated 19/07/2013 by Xplode # Operating system : Windows 7 Home Premium Service Pack 1 (64 bits) # User : Administrator - JUSTINSMITH # Boot Mode : Normal # Running from : C:\Users\Administrator\Desktop\adwcleaner.exe # Option [Delete] ***** [services] ***** ***** [Files / Folders] ***** Deleted on reboot : C:\ProgramData\Browser Manager File Deleted : C:\END File Deleted : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\eBay.lnk File Deleted : C:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\mmj39qj7.default\searchplugins\Search_Results.xml File Deleted : C:\Users\Nyamuoch\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_search.conduit.com_0.localstorage File Deleted : C:\Users\Nyamuoch\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_search.conduit.com_0.localstorage-journal Folder Deleted : C:\Program Files (x86)\Conduit Folder Deleted : C:\ProgramData\Ask Folder Deleted : C:\Users\Administrator\AppData\LocalLow\AskToolbar Folder Deleted : C:\Users\Administrator\AppData\LocalLow\boost_interprocess Folder Deleted : C:\Users\Administrator\AppData\LocalLow\Conduit Folder Deleted : C:\Users\Nyamuoch\AppData\Local\Conduit Folder Deleted : C:\Users\Nyamuoch\AppData\LocalLow\AVG Secure Search Folder Deleted : C:\Users\Nyamuoch\AppData\LocalLow\boost_interprocess Folder Deleted : C:\Users\Nyamuoch\AppData\LocalLow\Conduit Folder Deleted : C:\Users\Nyamuoch\AppData\LocalLow\PriceGong Folder Deleted : C:\Users\Nyamuoch\AppData\LocalLow\Smartbar Folder Deleted : C:\Users\Nyamuoch\AppData\Roaming\iWin ***** [Registry] ***** Key Deleted : HKCU\Software\AppDataLow\Software\Conduit Key Deleted : HKCU\Software\AppDataLow\Software\MyWebSearch Key Deleted : HKCU\Software\AppDataLow\Software\SmartBar Key Deleted : HKCU\Software\Conduit Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{AE07101B-46D4-4A98-AF68-0333EA26E113} Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{F25AF245-4A81-40DC-92F9-E9021F207706} Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\grusskartencenter.com Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\EscDomains\grusskartencenter.com Key Deleted : HKCU\Software\SearchProtect Key Deleted : HKLM\SOFTWARE\Classes\Conduit.Engine Key Deleted : HKLM\SOFTWARE\Classes\CrossriderApp0026278.BHO Key Deleted : HKLM\SOFTWARE\Classes\CrossriderApp0026278.BHO.1 Key Deleted : HKLM\SOFTWARE\Classes\CrossriderApp0026278.Sandbox Key Deleted : HKLM\SOFTWARE\Classes\CrossriderApp0026278.Sandbox.1 Key Deleted : HKLM\SOFTWARE\Classes\Toolbar.CT2612669 Key Deleted : HKLM\SOFTWARE\Classes\Toolbar.CT3284668 Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{13ABD093-D46F-40DF-A608-47E162EC799D} Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{9C049BA6-EA47-4AC3-AED6-A66D8DC9E1D8} Key Deleted : HKLM\Software\Conduit Key Deleted : HKLM\Software\DataMngr Key Deleted : HKLM\Software\InstallIQ Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\RunDll32Policy\f3ScrCtr.dll Key Deleted : HKLM\SOFTWARE\Microsoft\Multimedia\WMPlayer\Schemes\f3pss Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\ConduitInstaller_RASAPI32 Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\ConduitInstaller_RASMANCS Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\QuickShare_RASAPI32 Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\QuickShare_RASMANCS Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\wajam_install_RASAPI32 Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\wajam_install_RASMANCS Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{02478D38-C3F9-4EFB-9B51-7695ECA05670} Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{3B7599DF-3D5D-4EF5-BF51-9C2EDA788E83} Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{7C3B01BC-53A5-48A0-A43B-0C67731134B9} Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{EF99BD32-C1FB-11D2-892F-0090271D4F88} Key Deleted : HKLM\Software\SearchProtect Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{0974BA1E-64EC-11DE-B2A5-E43756D89593} Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{3C471948-F874-49F5-B338-4F214A2EE0B1} Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{94496571-6AC5-4836-82D5-D46260C44B17} Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{BC9FD17D-30F6-4464-9E53-596A90AFF023} Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{DE9028D0-5FFA-4E69-94E3-89EE8741F468} Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39} Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{03E2A1F3-4402-4121-8B35-733216D61217} Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{9E3B11F6-4179-4603-A71B-A55F4BCB0BEC} Key Deleted : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{0ABE0FED-50E7-4E42-A125-57C0A11DBCDE} Key Deleted : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\SearchProtect Key Deleted : HKLM\SOFTWARE\Classes\Interface\{03E2A1F3-4402-4121-8B35-733216D61217} Key Deleted : HKLM\SOFTWARE\Classes\Interface\{819FFE21-35C7-4925-8CDA-4E0E2DB94302} Key Deleted : HKLM\SOFTWARE\Classes\Interface\{8E9CF769-3D3B-40EB-9E2D-76E7A205E4D2} Key Deleted : HKLM\SOFTWARE\Classes\Interface\{9E3B11F6-4179-4603-A71B-A55F4BCB0BEC} Value Deleted : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar [10] ***** [internet Browsers] ***** -\\ Internet Explorer v10.0.9200.16635 [OK] Registry is clean. -\\ Mozilla Firefox v22.0 (en-US) File : C:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\mmj39qj7.default\prefs.js Deleted : user_pref("browser.search.defaultenginename", "Search Results"); Deleted : user_pref("browser.search.order.1", "Search Results"); -\\ Google Chrome v28.0.1500.72 File : C:\Users\Nyamuoch\AppData\Local\Google\Chrome\User Data\Default\Preferences Deleted [l.25] : keyword = "search.snap.do", File : C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Preferences Deleted [l.34] : keyword = "search.conduit.com", ************************* AdwCleaner[s1].txt - [7272 octets] - [22/07/2013 09:16:12] ########## EOF - C:\AdwCleaner[s1].txt - [7332 octets] ########## Results of screen317's Security Check version 0.99.70 Windows 7 Service Pack 1 x64 (UAC is enabled) Internet Explorer 10 ``````````````Antivirus/Firewall Check:`````````````` Windows Firewall Enabled! WMI entry may not exist for antivirus; attempting automatic update. `````````Anti-malware/Other Utilities Check:````````` Malwarebytes Anti-Malware version 1.75.0.1300 Java 7 Update 21 Java version out of Date! Adobe Flash Player 11.7.700.224 Adobe Reader 9 Adobe Reader out of Date! Mozilla Firefox (22.0) Google Chrome 28.0.1500.71 Google Chrome 28.0.1500.72 ````````Process Check: objlist.exe by Laurent```````` `````````````````System Health check````````````````` Total Fragmentation on Drive C: 0% ````````````````````End of Log``````````````````````
  5. justime
    i have two other logs to post but have to shut everything off to do them so in a few minutes i will post them ComboFix.txt
  6. justime
    C:\FRST\Quarantine\SearchProtect\bin\ChromeModule.dll a variant of Win32/Conduit.SearchProtect.C application C:\FRST\Quarantine\SearchProtect\bin\SPHook32.dll probably a variant of Win32/Conduit.SearchProtect.C applicationC:\Program Files (x86)\Mozilla Firefox\browser\nsprotector.js Win32/Conduit.SearchProtect.A applicationC:\Program Files (x86)\Solid Savings\Uninstall.exe multiple threatsC:\ProgramData\Spybot - Search & Destroy\Recovery\OptimumInstaller3.zip Win32/Bagle.gen.zip wormC:\Qoobox\Quarantine\C\Program Files (x86)\SearchProtect\bin\ChromeModule.dll.vir a variant of Win32/Conduit.SearchProtect.C applicationC:\Qoobox\Quarantine\C\Program Files (x86)\SearchProtect\bin\cltmng.exe.vir a variant of Win32/Conduit.SearchProtect.B applicationC:\Qoobox\Quarantine\C\Program Files (x86)\SearchProtect\bin\FirefoxModule.dll.vir a variant of Win32/Conduit.SearchProtect.C applicationC:\Qoobox\Quarantine\C\Program Files (x86)\SearchProtect\bin\InternetExplorerModule.dll.vir a variant of Win32/Conduit.SearchProtect.C applicationC:\Qoobox\Quarantine\C\Program Files (x86)\SearchProtect\bin\SPHook32.dll.vir probably a variant of Win32/Conduit.SearchProtect.C applicationC:\Qoobox\Quarantine\C\Program Files (x86)\SearchProtect\ffprotect\application.js.vir Win32/Conduit.SearchProtect.A applicationC:\Qoobox\Quarantine\C\Program Files (x86)\SearchProtect\ffprotect\nsprotector.js.vir Win32/Conduit.SearchProtect.A applicationC:\Qoobox\Quarantine\C\Users\Administrator\AppData\Roaming\SearchProtect\bin\ChromeModule.dll.vir a variant of Win32/Conduit.SearchProtect.C applicationC:\Qoobox\Quarantine\C\Users\Administrator\AppData\Roaming\SearchProtect\bin\cltmng.exe.vir a variant of Win32/Conduit.SearchProtect.B applicationC:\Qoobox\Quarantine\C\Users\Administrator\AppData\Roaming\SearchProtect\bin\FirefoxModule.dll.vir a variant of Win32/Conduit.SearchProtect.C applicationC:\Qoobox\Quarantine\C\Users\Administrator\AppData\Roaming\SearchProtect\bin\InternetExplorerModule.dll.vir a variant of Win32/Conduit.SearchProtect.C applicationC:\Qoobox\Quarantine\C\Users\Administrator\AppData\Roaming\SearchProtect\bin\SPHook32.dll.vir probably a variant of Win32/Conduit.SearchProtect.C applicationC:\Qoobox\Quarantine\C\Users\Administrator\AppData\Roaming\SearchProtect\ffprotect\application.js.vir Win32/Conduit.SearchProtect.A applicationC:\Qoobox\Quarantine\C\Users\Administrator\AppData\Roaming\SearchProtect\ffprotect\nsprotector.js.vir Win32/Conduit.SearchProtect.A applicationC:\Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\3DZX06W6\SPSetup[1].exe multiple threatsC:\Users\Administrator\Downloads\7zip_freely_d2320532.exe a variant of Win32/InstallIQ.A applicationC:\Users\Administrator\Downloads\BearShareSetup-r0-n-bc.exe Win32/Toolbar.SearchSuite applicationC:\Users\Administrator\Downloads\BearShareSetup-r717-n-bf.exe Win32/Toolbar.SearchSuite applicationC:\Users\Administrator\Downloads\musicoasis.exe a variant of Win32/InstallIQ.A applicationC:\Users\Administrator\Downloads\backups\backup-20130512-121837-370.dll a variant of Win32/Toolbar.CrossRider.A applicationC:\Users\All Users\Spybot - Search & Destroy\Recovery\OptimumInstaller3.zip Win32/Bagle.gen.zip wormC:\Users\Nyamuoch\AppData\Roaming\Apple Computer\MobileSync\Backup\0f64c4ac547dfc239fef1a6d73dcb92a87584ede\5a39be90c1d47a707ca4808a667904cfd3d834ca Win32/Toolbar.Widgi application
  7. justime
    system volume information, recovery, MSOCache, found.000, documents and settings
  8. justime
    yes but i still have other folders that are locked if i could give yo a screenshot you could see what i am looking at
  9. justime
    Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 18-07-2013 Ran by Administrator at 2013-07-21 22:12:21 Run:1 Running from C:\Users\Administrator\Desktop Boot Mode: Normal ============================================== HKU\Nyamuoch\Software\Microsoft\Windows\CurrentVersion\Run\\SearchProtect => Value deleted successfully. HKU\Nyamuoch\Software\Microsoft\Windows\CurrentVersion\Run\\Browser Infrastructure Helper => Value deleted successfully. HKU\Nyamuoch\Software\Microsoft\Windows\CurrentVersion\RunOnce\\SpybotDeletingB9942 => Value deleted successfully. HKU\Nyamuoch\Software\Microsoft\Windows\CurrentVersion\RunOnce\\SpybotDeletingD9035 => Value deleted successfully. HKU\Nyamuoch\Software\Microsoft\Windows\CurrentVersion\RunOnce\\SpybotDeletingB385 => Value deleted successfully. HKU\Nyamuoch\Software\Microsoft\Windows\CurrentVersion\RunOnce\\SpybotDeletingD4923 => Value deleted successfully. HKU\Nyamuoch\Software\Microsoft\Windows\CurrentVersion\RunOnce\\SpybotDeletingB2016 => Value deleted successfully. HKU\Nyamuoch\Software\Microsoft\Windows\CurrentVersion\RunOnce\\SpybotDeletingD6263 => Value deleted successfully. HKU\Nyamuoch\Software\Microsoft\Windows\CurrentVersion\RunOnce\\SpybotDeletingB1652 => Value deleted successfully. HKU\Nyamuoch\Software\Microsoft\Windows\CurrentVersion\RunOnce\\SpybotDeletingD2709 => Value deleted successfully. HKU\Nyamuoch\Software\Microsoft\Windows\CurrentVersion\RunOnce\\SpybotDeletingB1493 => Value deleted successfully. HKU\Nyamuoch\Software\Microsoft\Windows\CurrentVersion\RunOnce\\SpybotDeletingD5378 => Value deleted successfully. HKU\Nyamuoch\Software\Microsoft\Windows\CurrentVersion\RunOnce\\SpybotDeletingB8669 => Value deleted successfully. HKU\Nyamuoch\Software\Microsoft\Windows\CurrentVersion\RunOnce\\SpybotDeletingD7274 => Value deleted successfully. HKU\Nyamuoch\Software\Microsoft\Windows\CurrentVersion\RunOnce\\SpybotDeletingB2841 => Value deleted successfully. HKU\Nyamuoch\Software\Microsoft\Windows\CurrentVersion\RunOnce\\SpybotDeletingD3157 => Value deleted successfully. HKU\Nyamuoch\Software\Microsoft\Windows\CurrentVersion\RunOnce\\SpybotDeletingB1756 => Value deleted successfully. HKU\Nyamuoch\Software\Microsoft\Windows\CurrentVersion\RunOnce\\SpybotDeletingD2867 => Value deleted successfully. HKU\Nyamuoch\Software\Microsoft\Windows\CurrentVersion\RunOnce\\SpybotDeletingB7186 => Value deleted successfully. HKU\Nyamuoch\Software\Microsoft\Windows\CurrentVersion\RunOnce\\SpybotDeletingD3373 => Value deleted successfully. HKU\Nyamuoch\Software\Microsoft\Windows\CurrentVersion\RunOnce\\SpybotDeletingB1289 => Value deleted successfully. HKU\Nyamuoch\Software\Microsoft\Windows\CurrentVersion\RunOnce\\SpybotDeletingD5433 => Value deleted successfully. HKU\Nyamuoch\Software\Microsoft\Windows\CurrentVersion\RunOnce\\SpybotDeletingB1967 => Value deleted successfully. HKU\Nyamuoch\Software\Microsoft\Windows\CurrentVersion\RunOnce\\SpybotDeletingD2396 => Value deleted successfully. HKU\Nyamuoch\Software\Microsoft\Windows\CurrentVersion\RunOnce\\SpybotDeletingB8238 => Value deleted successfully. HKU\Nyamuoch\Software\Microsoft\Windows\CurrentVersion\RunOnce\\SpybotDeletingD9476 => Value deleted successfully. HKU\Nyamuoch\Software\Microsoft\Windows\CurrentVersion\RunOnce\\SpybotDeletingB1143 => Value deleted successfully. HKU\Nyamuoch\Software\Microsoft\Windows\CurrentVersion\RunOnce\\SpybotDeletingD3218 => Value deleted successfully. HKU\Nyamuoch\Software\Microsoft\Windows\CurrentVersion\RunOnce\\SpybotDeletingB2923 => Value deleted successfully. HKU\Nyamuoch\Software\Microsoft\Windows\CurrentVersion\RunOnce\\SpybotDeletingD2411 => Value deleted successfully. HKU\Nyamuoch\Software\Microsoft\Windows\CurrentVersion\RunOnce\\SpybotDeletingB5054 => Value deleted successfully. HKU\Nyamuoch\Software\Microsoft\Windows\CurrentVersion\RunOnce\\SpybotDeletingD9492 => Value deleted successfully. HKU\Nyamuoch\Software\Microsoft\Windows\CurrentVersion\RunOnce\\SpybotDeletingB5856 => Value deleted successfully. HKU\Nyamuoch\Software\Microsoft\Windows\CurrentVersion\RunOnce\\SpybotDeletingD8643 => Value deleted successfully. HKU\Nyamuoch\Software\Microsoft\Windows\CurrentVersion\RunOnce\\SpybotDeletingB189 => Value deleted successfully. HKU\Nyamuoch\Software\Microsoft\Windows\CurrentVersion\RunOnce\\SpybotDeletingD2232 => Value deleted successfully. HKU\Nyamuoch\Software\Microsoft\Windows\CurrentVersion\RunOnce\\SpybotDeletingB9810 => Value deleted successfully. HKU\Nyamuoch\Software\Microsoft\Windows\CurrentVersion\RunOnce\\SpybotDeletingD7203 => Value deleted successfully. HKU\Nyamuoch\Software\Microsoft\Windows\CurrentVersion\RunOnce\\SpybotDeletingB3460 => Value deleted successfully. HKU\Nyamuoch\Software\Microsoft\Windows\CurrentVersion\RunOnce\\SpybotDeletingD9781 => Value deleted successfully. HKU\Nyamuoch\Software\Microsoft\Windows\CurrentVersion\RunOnce\\SpybotDeletingB1259 => Value deleted successfully. HKU\Nyamuoch\Software\Microsoft\Windows\CurrentVersion\RunOnce\\SpybotDeletingD4346 => Value deleted successfully. HKU\Nyamuoch\Software\Microsoft\Windows\CurrentVersion\RunOnce\\SpybotDeletingB9842 => Value deleted successfully. HKU\Nyamuoch\Software\Microsoft\Windows\CurrentVersion\RunOnce\\SpybotDeletingD4782 => Value deleted successfully. HKU\Nyamuoch\Software\Microsoft\Windows\CurrentVersion\RunOnce\\SpybotDeletingB2748 => Value deleted successfully. HKU\Nyamuoch\Software\Microsoft\Windows\CurrentVersion\RunOnce\\SpybotDeletingD5256 => Value deleted successfully. HKU\Nyamuoch\Software\Microsoft\Windows\CurrentVersion\RunOnce\\SpybotDeletingB4961 => Value deleted successfully. HKU\Nyamuoch\Software\Microsoft\Windows\CurrentVersion\RunOnce\\SpybotDeletingD5315 => Value deleted successfully. HKU\Nyamuoch\Software\Microsoft\Windows\CurrentVersion\RunOnce\\SpybotDeletingB3015 => Value deleted successfully. HKU\Nyamuoch\Software\Microsoft\Windows\CurrentVersion\RunOnce\\SpybotDeletingD715 => Value deleted successfully. HKU\Nyamuoch\Software\Microsoft\Windows\CurrentVersion\RunOnce\\SpybotDeletingB3417 => Value deleted successfully. HKU\Nyamuoch\Software\Microsoft\Windows\CurrentVersion\RunOnce\\SpybotDeletingD2847 => Value deleted successfully. HKU\Nyamuoch\Software\Microsoft\Windows\CurrentVersion\RunOnce\\SpybotDeletingB8331 => Value deleted successfully. HKU\Nyamuoch\Software\Microsoft\Windows\CurrentVersion\RunOnce\\SpybotDeletingD9701 => Value deleted successfully. HKU\Nyamuoch\Software\Microsoft\Windows\CurrentVersion\RunOnce\\SpybotDeletingB7873 => Value deleted successfully. HKU\Nyamuoch\Software\Microsoft\Windows\CurrentVersion\RunOnce\\SpybotDeletingD9634 => Value deleted successfully. HKU\Nyamuoch\Software\Microsoft\Windows\CurrentVersion\RunOnce\\SpybotDeletingB2485 => Value deleted successfully. HKU\Nyamuoch\Software\Microsoft\Windows\CurrentVersion\RunOnce\\SpybotDeletingD1385 => Value deleted successfully. HKU\Nyamuoch\Software\Microsoft\Windows\CurrentVersion\RunOnce\\SpybotDeletingB4803 => Value deleted successfully. HKU\Nyamuoch\Software\Microsoft\Windows\CurrentVersion\RunOnce\\SpybotDeletingD1363 => Value deleted successfully. HKU\Nyamuoch\Software\Microsoft\Windows\CurrentVersion\RunOnce\\SpybotDeletingB8985 => Value deleted successfully. HKU\Nyamuoch\Software\Microsoft\Windows\CurrentVersion\RunOnce\\SpybotDeletingD9048 => Value deleted successfully. HKU\Nyamuoch\Software\Microsoft\Windows\CurrentVersion\RunOnce\\SpybotDeletingB2371 => Value deleted successfully. HKU\Nyamuoch\Software\Microsoft\Windows\CurrentVersion\RunOnce\\SpybotDeletingD2533 => Value deleted successfully. HKU\Nyamuoch\Software\Microsoft\Windows\CurrentVersion\RunOnce\\SpybotDeletingB3073 => Value deleted successfully. HKU\Nyamuoch\Software\Microsoft\Windows\CurrentVersion\RunOnce\\SpybotDeletingD7775 => Value deleted successfully. HKU\Nyamuoch\Software\Microsoft\Windows\CurrentVersion\RunOnce\\SpybotDeletingB6311 => Value deleted successfully. HKU\Nyamuoch\Software\Microsoft\Windows\CurrentVersion\RunOnce\\SpybotDeletingD6558 => Value deleted successfully. HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\\DefaultScope => Value was restored successfully. HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0E2443F9-9665-467A-B335-E8D803135D83} => Key deleted successfully. HKCR\CLSID\{0E2443F9-9665-467A-B335-E8D803135D83} => Key not found. HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2002} => Key deleted successfully. HKCR\CLSID\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2002} => Key not found. HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\\\DefaultScope => Value was restored successfully. HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\{0E2443F9-9665-467A-B335-E8D803135D83} => Key deleted successfully. HKCR\Wow6432Node\CLSID\{0E2443F9-9665-467A-B335-E8D803135D83} => Key not found. HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2002} => Key deleted successfully. HKCR\Wow6432Node\CLSID\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2002} => Key not found. HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2A69} => Key deleted successfully. HKCR\Wow6432Node\CLSID\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2A69} => Key not found. HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b} => Key deleted successfully. HKCR\Wow6432Node\CLSID\{afdbddaa-5d3f-42ee-b79c-185a7020515b} => Key not found. HKCU\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\\DefaultScope => Value was restored successfully. HKCU\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0E2443F9-9665-467A-B335-E8D803135D83} => Key deleted successfully. HKCR\CLSID\{0E2443F9-9665-467A-B335-E8D803135D83} => Key not found. HKCU\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2002} => Key deleted successfully. HKCR\CLSID\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2002} => Key not found. C:\Users\Nyamuoch\AppData\Roaming\SearchProtect => Moved successfully. C:\Users\Nyamuoch\AppData\Local\Smartbar => Moved successfully. C:\ProgramData\ntuser.dat => Moved successfully. permissions for "C:\users\administrator\documents\my music" were reset successfully ==== End of Fixlog ====
  10. justime
    i have saved fixlist.txt to my desktop and frst64.exe is also saved to my desktop but i am not sure what you mean by " Save it to the same direction as frst.exe (or frst64.exe) as fixlist.txt " please clarify
  11. justime
    Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 18-07-2013 Ran by Administrator (administrator) on 18-07-2013 22:25:55 Running from C:\Users\Administrator\Desktop Windows 7 Home Premium Service Pack 1 (X64) OS Language: English(US) Internet Explorer Version 10 Boot Mode: Normal ==================== Processes (Whitelisted) ================= (Microsoft Corporation) C:\Windows\system32\WLANExt.exe (Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe (Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe (Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\Shared\HPDrvMntSvc.exe () C:\Program Files (x86)\RealNetworks\RealDownloader\rndlresolversvc.exe () C:\Program Files (x86)\CyberLink\Shared files\RichVideo.exe (Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe (Intel Corporation) C:\Windows\System32\hkcmd.exe (Intel Corporation) C:\Windows\System32\igfxpers.exe (Sun Microsystems, Inc.) C:\Program Files\Java\jre6\bin\jusched.exe (Conexant Systems, Inc.) C:\Program Files\CONEXANT\cAudioFilterAgent\cAudioFilterAgent64.exe ( Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch Buttons\QLBCTRL.exe (Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe (Apple Inc.) C:\Program Files (x86)\iTunes\iTunesHelper.exe (Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\Shared\hpqwmiex.exe (Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe (Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch Buttons\Com4QLBEx.exe () C:\Program Files (x86)\Hewlett-Packard\Shared\hpqToaster.exe (Sun Microsystems, Inc.) C:\Program Files\Java\jre6\bin\jucheck.exe ==================== Registry (Whitelisted) ================== HKLM\...\Run: [synTPEnh] - C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [1808168 2009-06-18] (Synaptics Incorporated) HKLM\...\Run: [sunJavaUpdateSched] - C:\Program Files\Java\jre6\bin\jusched.exe [171520 2009-11-01] (Sun Microsystems, Inc.) HKLM\...\Run: [cAudioFilterAgent] - C:\Program Files\Conexant\cAudioFilterAgent\cAudioFilterAgent64.exe [495104 2009-07-14] (Conexant Systems, Inc.) HKLM-x32\...\Run: [QlbCtrl.exe] - C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start [323640 2010-02-25] ( Hewlett-Packard Development Company, L.P.) HKLM-x32\...\Run: [WirelessAssistant] - C:\Program Files (x86)\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe [500792 2010-03-23] (Hewlett-Packard Company) HKLM-x32\...\Run: [APSDaemon] - "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [59720 2013-04-21] (Apple Inc.) HKLM-x32\...\Run: [Adobe Reader Speed Launcher] - "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe" [35696 2009-02-27] (Adobe Systems Incorporated) HKLM-x32\...\Run: [QuickTime Task] - "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime [421888 2013-05-01] (Apple Inc.) HKLM-x32\...\Run: [iTunesHelper] - "C:\Program Files (x86)\iTunes\iTunesHelper.exe" [152392 2013-05-31] (Apple Inc.) HKLM-x32\...\Run: [AppleSyncNotifier] - C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe [47904 2010-09-21] (Apple Inc.) HKU\Guest\...\RunOnce: [FlashPlayerUpdate] - C:\Windows\SysWow64\Macromed\Flash\FlashUtil10e.exe [x] HKU\music\...\RunOnce: [Application Restart #0] - C:\Program Files (x86)\Internet Explorer\iexplore.exe -restart /WERRESTART [770648 2013-06-11] (Microsoft Corporation) HKU\Nyamuoch\...\Run: [msnmsgr] - "C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe" /background [3883856 2009-07-26] (Microsoft Corporation) HKU\Nyamuoch\...\Run: [smartAudio] - C:\Program Files\CONEXANT\SAII\SAIICpl.exe /c [307768 2010-06-22] () HKU\Nyamuoch\...\Run: [skype] - "C:\Program Files (x86)\Skype\Phone\Skype.exe" /nosplash /minimized [17418928 2012-07-13] (Skype Technologies S.A.) HKU\Nyamuoch\...\Run: [Google Update] - "C:\Users\Nyamuoch\AppData\Local\Google\Update\GoogleUpdate.exe" /c [116648 2012-09-15] (Google Inc.) HKU\Nyamuoch\...\Run: [DW6] - "C:\Program Files (x86)\The Weather Channel FW\Desktop\DesktopWeather.exe" [x] HKU\Nyamuoch\...\Run: [DW7] - "C:\Program Files (x86)\The Weather Channel\The Weather Channel App\TWCApp.exe" [x] HKU\Nyamuoch\...\Run: [searchProtect] - C:\Users\Nyamuoch\AppData\Roaming\SearchProtect\bin\cltmng.exe [x] HKU\Nyamuoch\...\Run: [browser Infrastructure Helper] - C:\Users\Nyamuoch\AppData\Local\Smartbar\Application\QuickShare.exe startup [x] HKU\Nyamuoch\...\Run: [AVG-Secure-Search-Update_JUNE2013_TB] - "C:\Program Files (x86)\AVG Secure Search\AVG-Secure-Search-Update_JUNE2013_TB.exe" /PROMPT /CMPID=JUNE2013_TB [x] HKU\Nyamuoch\...\Run: [AVG-Secure-Search-Update_JUNE2013_HP] - "C:\Program Files (x86)\AVG Secure Search\AVG-Secure-Search-Update_JUNE2013_HP.exe" /PROMPT /CMPID=JUNE2013_HP [x] HKU\Nyamuoch\...\RunOnce: [spybotDeletingB9942] - command.com /c del "C:\Program Files (x86)\FunWebProducts\Installr\1.bin\F3EZSETP.DLL" [x] HKU\Nyamuoch\...\RunOnce: [spybotDeletingD9035] - cmd.exe /c del "C:\Program Files (x86)\FunWebProducts\Installr\1.bin\F3EZSETP.DLL" [x] HKU\Nyamuoch\...\RunOnce: [spybotDeletingB385] - command.com /c del "C:\Program Files (x86)\FunWebProducts\Installr\1.bin\F3PLUGIN.DLL" [x] HKU\Nyamuoch\...\RunOnce: [spybotDeletingD4923] - cmd.exe /c del "C:\Program Files (x86)\FunWebProducts\Installr\1.bin\F3PLUGIN.DLL" [x] HKU\Nyamuoch\...\RunOnce: [spybotDeletingB2016] - command.com /c del "C:\Program Files (x86)\FunWebProducts\Installr\1.bin\NPFUNWEB.DLL" [x] HKU\Nyamuoch\...\RunOnce: [spybotDeletingD6263] - cmd.exe /c del "C:\Program Files (x86)\FunWebProducts\Installr\1.bin\NPFUNWEB.DLL" [x] HKU\Nyamuoch\...\RunOnce: [spybotDeletingB1652] - command.com /c del "C:\Users\Nyamuoch\AppData\Local\Smartbar\Application\1Extension.crx" [x] HKU\Nyamuoch\...\RunOnce: [spybotDeletingD2709] - cmd.exe /c del "C:\Users\Nyamuoch\AppData\Local\Smartbar\Application\1Extension.crx" [x] HKU\Nyamuoch\...\RunOnce: [spybotDeletingB1493] - command.com /c del "C:\Users\Nyamuoch\AppData\Local\Smartbar\Application\BrowserHelper.exe" [x] HKU\Nyamuoch\...\RunOnce: [spybotDeletingD5378] - cmd.exe /c del "C:\Users\Nyamuoch\AppData\Local\Smartbar\Application\BrowserHelper.exe" [x] HKU\Nyamuoch\...\RunOnce: [spybotDeletingB8669] - command.com /c del "C:\Users\Nyamuoch\AppData\Local\Smartbar\Application\ProductsRemovalTool.exe" [x] HKU\Nyamuoch\...\RunOnce: [spybotDeletingD7274] - cmd.exe /c del "C:\Users\Nyamuoch\AppData\Local\Smartbar\Application\ProductsRemovalTool.exe" [x] HKU\Nyamuoch\...\RunOnce: [spybotDeletingB2841] - command.com /c del "C:\Users\Nyamuoch\AppData\Local\Smartbar\Application\RegAsm.exe" [x] HKU\Nyamuoch\...\RunOnce: [spybotDeletingD3157] - cmd.exe /c del "C:\Users\Nyamuoch\AppData\Local\Smartbar\Application\RegAsm.exe" [x] HKU\Nyamuoch\...\RunOnce: [spybotDeletingB1756] - command.com /c del "C:\Users\Nyamuoch\AppData\Local\Smartbar\Application\Smartbar.Personalization.Settings.PersonalizationSettingsManager.dll" [x] HKU\Nyamuoch\...\RunOnce: [spybotDeletingD2867] - cmd.exe /c del "C:\Users\Nyamuoch\AppData\Local\Smartbar\Application\Smartbar.Personalization.Settings.PersonalizationSettingsManager.dll" [x] HKU\Nyamuoch\...\RunOnce: [spybotDeletingB7186] - command.com /c del "C:\Users\Nyamuoch\AppData\Local\Smartbar\Application\Smartbar.Personalization.Settings.UserSettingsManager.dll" [x] HKU\Nyamuoch\...\RunOnce: [spybotDeletingD3373] - cmd.exe /c del "C:\Users\Nyamuoch\AppData\Local\Smartbar\Application\Smartbar.Personalization.Settings.UserSettingsManager.dll" [x] HKU\Nyamuoch\...\RunOnce: [spybotDeletingB1289] - command.com /c del "C:\Users\Nyamuoch\AppData\Local\Smartbar\Application\Smartbar.Resources.AutomaticUpdates.dll" [x] HKU\Nyamuoch\...\RunOnce: [spybotDeletingD5433] - cmd.exe /c del "C:\Users\Nyamuoch\AppData\Local\Smartbar\Application\Smartbar.Resources.AutomaticUpdates.dll" [x] HKU\Nyamuoch\...\RunOnce: [spybotDeletingB1967] - command.com /c del "C:\Users\Nyamuoch\AppData\Local\Smartbar\Application\Smartbar.Resources.BrowserHelperUtils.dll" [x] HKU\Nyamuoch\...\RunOnce: [spybotDeletingD2396] - cmd.exe /c del "C:\Users\Nyamuoch\AppData\Local\Smartbar\Application\Smartbar.Resources.BrowserHelperUtils.dll" [x] HKU\Nyamuoch\...\RunOnce: [spybotDeletingB8238] - command.com /c del "C:\Users\Nyamuoch\AppData\Local\Smartbar\Application\Smartbar.Resources.HistoryAndStatsWrapper.dll" [x] HKU\Nyamuoch\...\RunOnce: [spybotDeletingD9476] - cmd.exe /c del "C:\Users\Nyamuoch\AppData\Local\Smartbar\Application\Smartbar.Resources.HistoryAndStatsWrapper.dll" [x] HKU\Nyamuoch\...\RunOnce: [spybotDeletingB1143] - command.com /c del "C:\Users\Nyamuoch\AppData\Local\Smartbar\Application\Smartbar.Resources.LanguageSettings.dll" [x] HKU\Nyamuoch\...\RunOnce: [spybotDeletingD3218] - cmd.exe /c del "C:\Users\Nyamuoch\AppData\Local\Smartbar\Application\Smartbar.Resources.LanguageSettings.dll" [x] HKU\Nyamuoch\...\RunOnce: [spybotDeletingB2923] - command.com /c del "C:\Users\Nyamuoch\AppData\Local\Smartbar\Application\Smartbar.Resources.ProcessDownMonitor.dll" [x] HKU\Nyamuoch\...\RunOnce: [spybotDeletingD2411] - cmd.exe /c del "C:\Users\Nyamuoch\AppData\Local\Smartbar\Application\Smartbar.Resources.ProcessDownMonitor.dll" [x] HKU\Nyamuoch\...\RunOnce: [spybotDeletingB5054] - command.com /c del "C:\Users\Nyamuoch\AppData\Local\Smartbar\Application\Smartbar.Resources.ProductsRemovalLibary.dll" [x] HKU\Nyamuoch\...\RunOnce: [spybotDeletingD9492] - cmd.exe /c del "C:\Users\Nyamuoch\AppData\Local\Smartbar\Application\Smartbar.Resources.ProductsRemovalLibary.dll" [x] HKU\Nyamuoch\...\RunOnce: [spybotDeletingB5856] - command.com /c del "C:\Users\Nyamuoch\AppData\Local\Smartbar\Application\Smartbar.Resources.ProductUninstaller.dll" [x] HKU\Nyamuoch\...\RunOnce: [spybotDeletingD8643] - cmd.exe /c del "C:\Users\Nyamuoch\AppData\Local\Smartbar\Application\Smartbar.Resources.ProductUninstaller.dll" [x] HKU\Nyamuoch\...\RunOnce: [spybotDeletingB189] - command.com /c del "C:\Users\Nyamuoch\AppData\Local\Smartbar\Application\Smartbar.Resources.SetBrowsersSettings.dll" [x] HKU\Nyamuoch\...\RunOnce: [spybotDeletingD2232] - cmd.exe /c del "C:\Users\Nyamuoch\AppData\Local\Smartbar\Application\Smartbar.Resources.SetBrowsersSettings.dll" [x] HKU\Nyamuoch\...\RunOnce: [spybotDeletingB9810] - command.com /c del "C:\Users\Nyamuoch\AppData\Local\Smartbar\Application\Smartbar.Resources.SetBrowsersSettingsAutoUpdater.dll" [x] HKU\Nyamuoch\...\RunOnce: [spybotDeletingD7203] - cmd.exe /c del "C:\Users\Nyamuoch\AppData\Local\Smartbar\Application\Smartbar.Resources.SetBrowsersSettingsAutoUpdater.dll" [x] HKU\Nyamuoch\...\RunOnce: [spybotDeletingB3460] - command.com /c del "C:\Users\Nyamuoch\AppData\Local\Smartbar\Application\Smartbar.Resources.ShortcutsLibrary.dll" [x] HKU\Nyamuoch\...\RunOnce: [spybotDeletingD9781] - cmd.exe /c del "C:\Users\Nyamuoch\AppData\Local\Smartbar\Application\Smartbar.Resources.ShortcutsLibrary.dll" [x] HKU\Nyamuoch\...\RunOnce: [spybotDeletingB1259] - command.com /c del "C:\Users\Nyamuoch\AppData\Local\Smartbar\Application\Smartbar.Resources.SideBySide.dll" [x] HKU\Nyamuoch\...\RunOnce: [spybotDeletingD4346] - cmd.exe /c del "C:\Users\Nyamuoch\AppData\Local\Smartbar\Application\Smartbar.Resources.SideBySide.dll" [x] HKU\Nyamuoch\...\RunOnce: [spybotDeletingB9842] - command.com /c del "C:\Users\Nyamuoch\AppData\Local\Smartbar\Application\Smartbar.Resources.SocialNetsSharer.dll" [x] HKU\Nyamuoch\...\RunOnce: [spybotDeletingD4782] - cmd.exe /c del "C:\Users\Nyamuoch\AppData\Local\Smartbar\Application\Smartbar.Resources.SocialNetsSharer.dll" [x] HKU\Nyamuoch\...\RunOnce: [spybotDeletingB2748] - command.com /c del "C:\Users\Nyamuoch\AppData\Local\Smartbar\Application\Smartbar.Resources.SocialNetsSharer.XmlSerializers.dll" [x] HKU\Nyamuoch\...\RunOnce: [spybotDeletingD5256] - cmd.exe /c del "C:\Users\Nyamuoch\AppData\Local\Smartbar\Application\Smartbar.Resources.SocialNetsSharer.XmlSerializers.dll" [x] HKU\Nyamuoch\...\RunOnce: [spybotDeletingB4961] - command.com /c del "C:\Users\Nyamuoch\AppData\Local\Smartbar\Application\Smartbar.Resources.Translations.dll" [x] HKU\Nyamuoch\...\RunOnce: [spybotDeletingD5315] - cmd.exe /c del "C:\Users\Nyamuoch\AppData\Local\Smartbar\Application\Smartbar.Resources.Translations.dll" [x] HKU\Nyamuoch\...\RunOnce: [spybotDeletingB3015] - command.com /c del "C:\Users\Nyamuoch\AppData\Local\Smartbar\Application\Smartbar.Resources.UninstallScreen.dll" [x] HKU\Nyamuoch\...\RunOnce: [spybotDeletingD715] - cmd.exe /c del "C:\Users\Nyamuoch\AppData\Local\Smartbar\Application\Smartbar.Resources.UninstallScreen.dll" [x] HKU\Nyamuoch\...\RunOnce: [spybotDeletingB3417] - command.com /c del "C:\Users\Nyamuoch\AppData\Local\Smartbar\Application\Smartbar.Resources.UrlHistorySupplier.dll" [x] HKU\Nyamuoch\...\RunOnce: [spybotDeletingD2847] - cmd.exe /c del "C:\Users\Nyamuoch\AppData\Local\Smartbar\Application\Smartbar.Resources.UrlHistorySupplier.dll" [x] HKU\Nyamuoch\...\RunOnce: [spybotDeletingB8331] - command.com /c del "C:\Users\Nyamuoch\AppData\Local\Smartbar\Application\Smartbar.Resources.Utilities.dll" [x] HKU\Nyamuoch\...\RunOnce: [spybotDeletingD9701] - cmd.exe /c del "C:\Users\Nyamuoch\AppData\Local\Smartbar\Application\Smartbar.Resources.Utilities.dll" [x] HKU\Nyamuoch\...\RunOnce: [spybotDeletingB7873] - command.com /c del "C:\Users\Nyamuoch\AppData\Local\Smartbar\Application\SmartbarInternetExplorerBHO.dll" [x] HKU\Nyamuoch\...\RunOnce: [spybotDeletingD9634] - cmd.exe /c del "C:\Users\Nyamuoch\AppData\Local\Smartbar\Application\SmartbarInternetExplorerBHO.dll" [x] HKU\Nyamuoch\...\RunOnce: [spybotDeletingB2485] - command.com /c del "C:\Users\Nyamuoch\AppData\Local\Smartbar\Application\SmartbarInternetExplorerExtension.dll" [x] HKU\Nyamuoch\...\RunOnce: [spybotDeletingD1385] - cmd.exe /c del "C:\Users\Nyamuoch\AppData\Local\Smartbar\Application\SmartbarInternetExplorerExtension.dll" [x] HKU\Nyamuoch\...\RunOnce: [spybotDeletingB4803] - command.com /c del "C:\Users\Nyamuoch\AppData\Local\Smartbar\Application\SmartbarVersionsHelper.exe" [x] HKU\Nyamuoch\...\RunOnce: [spybotDeletingD1363] - cmd.exe /c del "C:\Users\Nyamuoch\AppData\Local\Smartbar\Application\SmartbarVersionsHelper.exe" [x] HKU\Nyamuoch\...\RunOnce: [spybotDeletingB8985] - command.com /c del "C:\Users\Nyamuoch\AppData\Local\Wajam\Chrome\wajam.crx" [x] HKU\Nyamuoch\...\RunOnce: [spybotDeletingD9048] - cmd.exe /c del "C:\Users\Nyamuoch\AppData\Local\Wajam\Chrome\wajam.crx" [x] HKU\Nyamuoch\...\RunOnce: [spybotDeletingB2371] - command.com /c del "C:\Program Files (x86)\Wajam\Updater\WajamUpdater.exe" [x] HKU\Nyamuoch\...\RunOnce: [spybotDeletingD2533] - cmd.exe /c del "C:\Program Files (x86)\Wajam\Updater\WajamUpdater.exe" [x] HKU\Nyamuoch\...\RunOnce: [spybotDeletingB3073] - command.com /c del "C:\Users\Nyamuoch\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Wajam\uninstall.lnk" [x] HKU\Nyamuoch\...\RunOnce: [spybotDeletingD7775] - cmd.exe /c del "C:\Users\Nyamuoch\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Wajam\uninstall.lnk" [x] HKU\Nyamuoch\...\RunOnce: [spybotDeletingB6311] - command.com /c del "C:\Program Files (x86)\Wajam\IE\favicon.ico" [x] HKU\Nyamuoch\...\RunOnce: [spybotDeletingD6558] - cmd.exe /c del "C:\Program Files (x86)\Wajam\IE\favicon.ico" [x] Startup: C:\Users\Nyamuoch\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\IMVU.lnk ShortcutTarget: IMVU.lnk -> C:\Users\Administrator\AppData\Roaming\IMVUClient\IMVUQualityAgent.exe (No File) Startup: C:\Users\Nyamuoch\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ZooskMessenger.lnk ShortcutTarget: ZooskMessenger.lnk -> C:\Program Files (x86)\ZooskMessenger\ZooskMessenger.exe (No File) BootExecute: autocheck autochk * sdnclean64.exe ==================== Internet (Whitelisted) ==================== ProxyServer: :0 HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch StartMenuInternet: IEXPLORE.EXE - "C:\Program Files (x86)\Internet Explorer\iexplore.exe" SearchScopes: HKLM - DefaultScope {9BB47C17-9C68-4BB3-B188-DD9AF0FD2002} URL = http://dts.search-results.com/sr?src=ieb&gct=ds&appid=717&systemid=2&apn_uid=0243580197474874&apn_dtid=IME002&o=APN10641&apn_ptnrs=AG2&q={searchTerms} SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = SearchScopes: HKLM - {0E2443F9-9665-467A-B335-E8D803135D83} URL = http://www.ask.com/web?q={searchTerms}&l=dis&o=uscql SearchScopes: HKLM - {2CC18F59-43CB-417F-B4B0-9DE87E158C04} URL = http://www.bing.com/search?q={searchTerms}&form=CPNTDF&pc=CPNTDF&src=IE-SearchBox SearchScopes: HKLM - {9BB47C17-9C68-4BB3-B188-DD9AF0FD2002} URL = http://dts.search-results.com/sr?src=ieb&gct=ds&appid=717&systemid=2&apn_uid=0243580197474874&apn_dtid=IME002&o=APN10641&apn_ptnrs=AG2&q={searchTerms} SearchScopes: HKLM-x32 - DefaultScope {9BB47C17-9C68-4BB3-B188-DD9AF0FD2002} URL = http://dts.search-results.com/sr?src=ieb&gct=ds&appid=717&systemid=2&apn_uid=0243580197474874&apn_dtid=IME002&o=APN10641&apn_ptnrs=AG2&q={searchTerms} SearchScopes: HKLM-x32 - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = SearchScopes: HKLM-x32 - {0E2443F9-9665-467A-B335-E8D803135D83} URL = http://www.ask.com/web?q={searchTerms}&l=dis&o=uscql SearchScopes: HKLM-x32 - {2CC18F59-43CB-417F-B4B0-9DE87E158C04} URL = http://www.bing.com/search?q={searchTerms}&form=CPNTDF&pc=CPNTDF&src=IE-SearchBox SearchScopes: HKLM-x32 - {9BB47C17-9C68-4BB3-B188-DD9AF0FD2002} URL = http://dts.search-results.com/sr?src=ieb&gct=ds&appid=717&systemid=2&apn_uid=0243580197474874&apn_dtid=IME002&o=APN10641&apn_ptnrs=AG2&q={searchTerms} SearchScopes: HKLM-x32 - {9BB47C17-9C68-4BB3-B188-DD9AF0FD2A69} URL = http://search.bearshare.com/web?src=ieb&q={searchTerms} SearchScopes: HKLM-x32 - {afdbddaa-5d3f-42ee-b79c-185a7020515b} URL = http://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2612669 SearchScopes: HKCU - DefaultScope {9BB47C17-9C68-4BB3-B188-DD9AF0FD2002} URL = http://dts.search-results.com/sr?src=ieb&gct=ds&appid=717&systemid=2&apn_uid=0243580197474874&apn_dtid=IME002&o=APN10641&apn_ptnrs=AG2&q={searchTerms} SearchScopes: HKCU - {0E2443F9-9665-467A-B335-E8D803135D83} URL = SearchScopes: HKCU - {9BB47C17-9C68-4BB3-B188-DD9AF0FD2002} URL = http://dts.search-results.com/sr?src=ieb&gct=ds&appid=717&systemid=2&apn_uid=0243580197474874&apn_dtid=IME002&o=APN10641&apn_ptnrs=AG2&q={searchTerms} BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.) BHO-x32: HP Print Enhancer - {0347C33E-8762-4905-BF09-768834316C61} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll (Hewlett-Packard Co.) BHO-x32: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated) BHO-x32: RealNetworks Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\IE\rndlbrowserrecordplugin.dll (RealDownloader) BHO-x32: Java Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation) BHO-x32: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation) BHO-x32: Microsoft Live Search Toolbar Helper - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files (x86)\MSN\Toolbar\3.0.0566.0\msneshellx.dll (Microsoft Corp.) BHO-x32: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation) BHO-x32: HP Network Check Helper - {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} - C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPlugin.dll (Hewlett-Packard) BHO-x32: HP Smart BHO Class - {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll (Hewlett-Packard Co.) Toolbar: HKLM-x32 - Microsoft Live Search Toolbar - {1E61ED7C-7CB8-49d6-B9E9-AB4C880C8414} - C:\Program Files (x86)\MSN\Toolbar\3.0.0566.0\msneshellx.dll (Microsoft Corp.) DPF: HKLM-x32 {17492023-C23A-453E-A040-C7C580BBF700} http://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab DPF: HKLM-x32 {24DCAB5D-AB40-440F-9CF8-DF2F406FD3DD} http://www.stcloudstate.edu/XpressConnect/tools/xc_loader_activex.ocx DPF: HKLM-x32 {67DABFBF-D0AB-41FA-9C46-CC0F21721616} http://download.divx.com/player/DivXBrowserPlugin.cab DPF: HKLM-x32 {73ECB3AA-4717-450C-A2AB-D00DAD9EE203} http://h20614.www2.hp.com/ediags/gmd/Install/Cab/hpdetect1262.cab DPF: HKLM-x32 {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab Handler-x32: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~2\WIC4A1~1\MESSEN~1\MSGRAP~1.DLL (Microsoft Corporation) Handler-x32: ms-itss - {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Program Files (x86)\Common Files\Microsoft Shared\Information Retrieval\msitss.dll (Microsoft Corporation) Handler-x32: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~2\WIC4A1~1\MESSEN~1\MSGRAP~1.DLL (Microsoft Corporation) Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies) Tcpip\Parameters: [DhcpNameServer] 192.168.0.1 FireFox: ======== FF ProfilePath: C:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\mmj39qj7.default FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_7_700_224.dll () FF Plugin: @microsoft.com/GENUINE - disabled No File FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation) FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_7_700_224.dll () FF Plugin-x32: @adobe.com/ShockwavePlayer - C:\Windows\SysWOW64\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.) FF Plugin-x32: @Apple.com/iTunes,version=1.0 - C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll () FF Plugin-x32: @Google.com/GoogleEarthPlugin - C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google) FF Plugin-x32: @google.com/npPicasa3,version=3.0.0 - C:\Program Files (x86)\Google\Picasa3\npPicasa3.dll (Google, Inc.) FF Plugin-x32: @java.com/DTPlugin,version=10.21.2 - C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation) FF Plugin-x32: @java.com/JavaPlugin,version=10.21.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation) FF Plugin-x32: @microsoft.com/GENUINE - disabled No File FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation) FF Plugin-x32: @microsoft.com/WLPG,version=14.0.8081.0709 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF Plugin-x32: @real.com/nppl3260;version=16.0.0.282 - c:\program files (x86)\real\realplayer\Netscape6\nppl3260.dll (RealNetworks, Inc.) FF Plugin-x32: @real.com/nprndlchromebrowserrecordext;version=1.3.0 - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlchromebrowserrecordext.dll (RealNetworks, Inc.) FF Plugin-x32: @real.com/nprndlhtml5videoshim;version=1.3.0 - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlhtml5videoshim.dll (RealNetworks, Inc.) FF Plugin-x32: @real.com/nprndlpepperflashvideoshim;version=1.3.0 - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlpepperflashvideoshim.dll (RealNetworks, Inc.) FF Plugin-x32: @real.com/nprpplugin;version=16.0.0.282 - c:\program files (x86)\real\realplayer\Netscape6\nprpplugin.dll (RealPlayer) FF Plugin-x32: @realnetworks.com/npdlplugin;version=1 - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\npdlplugin.dll (RealDownloader) FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.) FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.) FF Plugin-x32: @WildTangent.com/GamesAppPresenceDetector,Version=1.0 - C:\Program Files (x86)\WildTangent Games\App\BrowserIntegration\Registered\1\NP_wtapp.dll () FF SearchPlugin: C:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\mmj39qj7.default\searchplugins\Search_Results.xml FF Extension: Yahoo! Toolbar - C:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\mmj39qj7.default\Extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1} FF Extension: HP Detect - C:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\mmj39qj7.default\Extensions\{ab91efd4-6975-4081-8552-1b3922ed79e2} FF Extension: No Name - C:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\mmj39qj7.default\Extensions\{c0c9a2c7-2e5c-4447-bc53-97718bc91e1b}.xpi FF Extension: Default - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd} FF HKLM-x32\...\Firefox\Extensions: [smartwebprinting@hp.com] C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 FF Extension: HP Smart Web Printing - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 FF HKLM-x32\...\Firefox\Extensions: [{34712C68-7391-4c47-94F3-8F88D49AD632}] C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Firefox\Ext\ FF Extension: RealDownloader - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Firefox\Ext\ FF HKLM-x32\...\Firefox\Extensions: [{ABDE892B-13A8-4d1b-88E6-365A6E755758}] C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Firefox\Ext FF Extension: RealDownloader - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Firefox\Ext Chrome: ======= CHR DefaultSearchURL: (Conduit) - http://search.conduit.com/Results.aspx?q={searchTerms}&SearchSource=49&CUI=UN42569107121326115&ctid=CT3297955&UM=2 CHR DefaultSuggestURL: (Conduit) - http://suggest.search.conduit.com/CSuggestJson.ashx?prefix={searchTerms}&CUI=UN42569107121326115&UM=2 CHR Plugin: (Shockwave Flash) - C:\Program Files (x86)\Google\Chrome\Application\28.0.1500.72\PepperFlash\pepflashplayer.dll () CHR Plugin: (Chrome Remote Desktop Viewer) - internal-remoting-viewer CHR Plugin: (Native Client) - C:\Program Files (x86)\Google\Chrome\Application\28.0.1500.72\ppGoogleNaClPluginChrome.dll () CHR Plugin: (Chrome PDF Viewer) - C:\Program Files (x86)\Google\Chrome\Application\28.0.1500.72\pdf.dll () CHR Plugin: (Adobe Acrobat) - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\nppdf32.dll (Adobe Systems Inc.) CHR Plugin: (QuickTime Plug-in 7.6.9) - C:\Program Files (x86)\QuickTime\plugins\npqtplugin.dll (Apple Inc.) CHR Plugin: (QuickTime Plug-in 7.6.9) - C:\Program Files (x86)\QuickTime\plugins\npqtplugin2.dll (Apple Inc.) CHR Plugin: (QuickTime Plug-in 7.6.9) - C:\Program Files (x86)\QuickTime\plugins\npqtplugin3.dll (Apple Inc.) CHR Plugin: (QuickTime Plug-in 7.6.9) - C:\Program Files (x86)\QuickTime\plugins\npqtplugin4.dll (Apple Inc.) CHR Plugin: (QuickTime Plug-in 7.6.9) - C:\Program Files (x86)\QuickTime\plugins\npqtplugin5.dll (Apple Inc.) CHR Plugin: (QuickTime Plug-in 7.6.9) - C:\Program Files (x86)\QuickTime\plugins\npqtplugin6.dll No File CHR Plugin: (QuickTime Plug-in 7.6.9) - C:\Program Files (x86)\QuickTime\plugins\npqtplugin7.dll No File CHR Plugin: (AVG SiteSafety plugin) - C:\Program Files (x86)\Common Files\AVG Secure Search\SiteSafetyInstaller\14.2.0\\npsitesafety.dll No File CHR Plugin: (Picasa) - C:\Program Files (x86)\Google\Picasa3\npPicasa3.dll (Google, Inc.) CHR Plugin: (Google Update) - C:\Program Files (x86)\Google\Update\1.3.21.135\npGoogleUpdate3.dll No File CHR Plugin: (Java Platform SE 6 U35) - C:\Program Files (x86)\Java\jre6\bin\plugin2\npjp2.dll No File CHR Plugin: (McAfee Security Scanner +) - C:\Program Files (x86)\McAfee Security Scan\3.0.318\npMcAfeeMss.dll No File CHR Plugin: (Windows Live\u00AE Photo Gallery) - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) CHR Plugin: (iTunes Application Detector) - C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll () CHR Plugin: (RealNetworks RealDownloader Chrome Background Extension Plug-In (32-bit) ) - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlchromebrowserrecordext.dll (RealNetworks, Inc.) CHR Plugin: (RealNetworks RealDownloader HTML5VideoShim Plug-In (32-bit) ) - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlhtml5videoshim.dll (RealNetworks, Inc.) CHR Plugin: (RealNetworks RealDownloader PepperFlashVideoShim Plug-In (32-bit) ) - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlpepperflashvideoshim.dll (RealNetworks, Inc.) CHR Plugin: (RealDownloader Plugin) - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\npdlplugin.dll (RealDownloader) CHR Plugin: (Shockwave for Director) - C:\Windows\SysWOW64\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.) CHR Plugin: (Shockwave Flash) - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_6_602_180.dll No File CHR Plugin: (Java Deployment Toolkit 6.0.350.10) - C:\Windows\SysWOW64\npdeployJava1.dll (Oracle Corporation) CHR Plugin: (Silverlight Plug-In) - c:\Program Files (x86)\Microsoft Silverlight\5.1.20125.0\npctrl.dll No File CHR Plugin: (RealPlayer G2 LiveConnect-Enabled Plug-In (32-bit) ) - c:\program files (x86)\real\realplayer\Netscape6\nppl3260.dll (RealNetworks, Inc.) CHR Plugin: (RealPlayer Download Plugin) - c:\program files (x86)\real\realplayer\Netscape6\nprpplugin.dll (RealPlayer) CHR Extension: (Google Docs) - C:\Users\ADMINI~1\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.5_0 CHR Extension: (Google Drive) - C:\Users\ADMINI~1\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.3_0 CHR Extension: (YouTube) - C:\Users\ADMINI~1\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.6_0 CHR Extension: (Google Search) - C:\Users\ADMINI~1\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.20_0 CHR Extension: (Gmail) - C:\Users\ADMINI~1\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0 ==================== Services (Whitelisted) ================= R2 RealNetworks Downloader Resolver Service; C:\Program Files (x86)\RealNetworks\RealDownloader\rndlresolversvc.exe [38608 2012-11-29] () R2 RichVideo; C:\Program Files (x86)\CyberLink\Shared files\RichVideo.exe [247152 2009-07-06] () S2 SBSDWSCService; C:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe [x] ==================== Drivers (Whitelisted) ==================== S3 massfilter_hs; C:\Windows\system32\drivers\massfilter_hs.sys [18456 2011-07-07] (HandSet Incorporated) S3 RimUsb; C:\Windows\System32\Drivers\RimUsb_AMD64.sys [27520 2007-05-14] (Research In Motion Limited) S3 SWDUMon; C:\Windows\System32\DRIVERS\SWDUMon.sys [15712 2013-05-27] () S3 catchme; \??\C:\ComboFix\catchme.sys [x] U4 eabfiltr; S3 RtsUIR; system32\DRIVERS\Rts516xIR.sys [x] S3 USBCCID; system32\DRIVERS\RtsUCcid.sys [x] ==================== NetSvcs (Whitelisted) =================== ==================== One Month Created Files and Folders ======== 2013-07-18 22:25 - 2013-07-18 22:25 - 00000000 ____D C:\FRST 2013-07-18 22:19 - 2013-07-18 22:19 - 01778207 _____ (Farbar) C:\Users\Administrator\Desktop\FRST64.exe 2013-07-18 09:47 - 2013-07-18 10:23 - 00000000 ____D C:\Users\Administrator\Tracing 2013-07-18 02:11 - 2013-07-18 02:11 - 00034125 _____ C:\ComboFix.txt 2013-07-18 01:20 - 2013-07-18 01:20 - 05090256 ____R (Swearware) C:\Users\Administrator\Desktop\ComboFix.exe 2013-07-17 23:19 - 2011-06-25 22:45 - 00256000 _____ C:\Windows\PEV.exe 2013-07-17 23:19 - 2010-11-07 09:20 - 00208896 _____ C:\Windows\MBR.exe 2013-07-17 23:19 - 2009-04-19 20:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe 2013-07-17 23:19 - 2000-08-30 16:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe 2013-07-17 23:19 - 2000-08-30 16:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe 2013-07-17 23:19 - 2000-08-30 16:00 - 00098816 _____ C:\Windows\sed.exe 2013-07-17 23:19 - 2000-08-30 16:00 - 00080412 _____ C:\Windows\grep.exe 2013-07-17 23:19 - 2000-08-30 16:00 - 00068096 _____ C:\Windows\zip.exe 2013-07-17 23:18 - 2013-07-18 02:11 - 00000000 ____D C:\Qoobox 2013-07-17 23:18 - 2013-07-18 02:03 - 00000000 ____D C:\Windows\erdnt 2013-07-17 23:17 - 2013-07-17 23:18 - 05090256 ____R (Swearware) C:\Users\Administrator\Downloads\ComboFix.exe 2013-07-16 11:17 - 2013-07-18 10:59 - 00003362 _____ C:\Windows\System32\Tasks\RealPlayerRealUpgradeScheduledTaskS-1-5-21-820292111-1869468108-3859774255-500 2013-07-16 10:45 - 2013-07-16 10:45 - 00007605 _____ C:\Users\ADMINI~1\AppData\Local\Resmon.ResmonCfg 2013-07-16 00:21 - 2013-07-16 00:21 - 00000000 ____D C:\Users\Administrator\AppData\Roaming\RealNetworks 2013-07-10 22:53 - 2013-06-11 15:43 - 14329856 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll 2013-07-10 22:53 - 2013-06-11 15:43 - 02877440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll 2013-07-10 22:53 - 2013-06-11 15:43 - 01767936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll 2013-07-10 22:53 - 2013-06-11 15:43 - 01141248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll 2013-07-10 22:53 - 2013-06-11 15:43 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll 2013-07-10 22:53 - 2013-06-11 15:43 - 00493056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll 2013-07-10 22:53 - 2013-06-11 15:43 - 00039424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll 2013-07-10 22:53 - 2013-06-11 15:42 - 13760512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll 2013-07-10 22:53 - 2013-06-11 15:42 - 02046976 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll 2013-07-10 22:53 - 2013-06-11 15:42 - 00391168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll 2013-07-10 22:53 - 2013-06-11 15:42 - 00109056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll 2013-07-10 22:53 - 2013-06-11 15:42 - 00061440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll 2013-07-10 22:53 - 2013-06-11 15:42 - 00033280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll 2013-07-10 22:53 - 2013-06-11 15:26 - 02241024 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll 2013-07-10 22:53 - 2013-06-11 15:26 - 01365504 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll 2013-07-10 22:53 - 2013-06-11 15:26 - 00051712 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe 2013-07-10 22:53 - 2013-06-11 15:25 - 19238912 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll 2013-07-10 22:53 - 2013-06-11 15:25 - 15404032 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll 2013-07-10 22:53 - 2013-06-11 15:25 - 03958784 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll 2013-07-10 22:53 - 2013-06-11 15:25 - 02648576 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll 2013-07-10 22:53 - 2013-06-11 15:25 - 00855552 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll 2013-07-10 22:53 - 2013-06-11 15:25 - 00603136 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll 2013-07-10 22:53 - 2013-06-11 15:25 - 00526336 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll 2013-07-10 22:53 - 2013-06-11 15:25 - 00136704 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll 2013-07-10 22:53 - 2013-06-11 15:25 - 00067072 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll 2013-07-10 22:53 - 2013-06-11 15:25 - 00053248 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll 2013-07-10 22:53 - 2013-06-11 15:25 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll 2013-07-10 22:53 - 2013-06-11 14:51 - 00071680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe 2013-07-10 22:53 - 2013-06-11 14:50 - 00089600 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe 2013-07-10 22:53 - 2013-06-06 19:22 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb 2013-07-10 22:53 - 2013-06-06 18:37 - 02706432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb 2013-07-10 18:41 - 2013-06-04 19:34 - 03153920 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys 2013-07-10 18:41 - 2013-06-03 22:00 - 00624128 _____ (Microsoft Corporation) C:\Windows\system32\qedit.dll 2013-07-10 18:41 - 2013-06-03 20:53 - 00509440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\qedit.dll 2013-07-10 18:41 - 2013-05-05 22:03 - 01887744 _____ (Microsoft Corporation) C:\Windows\system32\WMVDECOD.DLL 2013-07-10 18:41 - 2013-05-05 20:56 - 01620480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMVDECOD.DLL 2013-07-10 18:40 - 2013-04-09 15:34 - 01247744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\DWrite.dll 2013-07-10 18:40 - 2013-04-02 14:51 - 01643520 _____ (Microsoft Corporation) C:\Windows\system32\DWrite.dll 2013-07-07 12:42 - 2013-07-07 12:42 - 01899088 _____ (InstallX, LLC) C:\Users\Administrator\Downloads\7zip_freely_d2320532.exe 2013-07-07 10:14 - 2013-07-07 10:15 - 00000000 ____D C:\Users\Administrator\Downloads\5r553 transmission xeploded view 2013-07-07 02:09 - 2013-07-07 02:09 - 03423200 _____ (Conduit) C:\Users\Administrator\Downloads\Produtools_Manuals_2_1_B2.exe 2013-07-07 02:09 - 2013-07-07 02:09 - 00000000 ____D C:\Users\ADMINI~1\AppData\Local\CRE 2013-07-06 23:19 - 2013-07-18 10:59 - 00003244 _____ C:\Windows\System32\Tasks\RealPlayerRealUpgradeLogonTaskS-1-5-21-820292111-1869468108-3859774255-500 2013-07-06 14:33 - 2013-07-06 14:33 - 00000000 ____D C:\ProgramData\Mozilla 2013-07-06 14:33 - 2013-07-06 14:33 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service 2013-07-06 14:28 - 2013-07-06 14:33 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox 2013-07-06 14:18 - 2013-07-06 14:18 - 02013672 _____ (Driver Manager) C:\Users\Administrator\Downloads\DriverManager.exe 2013-07-06 14:16 - 2013-07-06 14:16 - 00000000 ____D C:\Users\ADMINI~1\AppData\Local\DriverTuner 2013-07-06 14:15 - 2013-07-06 14:15 - 02811856 _____ (LionSea SoftWare ) C:\Users\Administrator\Downloads\setup.exe 2013-07-06 13:30 - 2013-07-18 13:34 - 00003014 _____ C:\Windows\System32\Tasks\ReclaimerUpdateXML_Administrator 2013-07-06 13:30 - 2013-07-18 13:34 - 00000398 _____ C:\Windows\Tasks\ReclaimerUpdateXML_Administrator.job 2013-07-06 13:30 - 2013-07-18 10:59 - 00000408 _____ C:\Windows\Tasks\RNUpgradeHelperLogonPrompt_Administrator.job 2013-07-06 13:30 - 2013-07-17 11:34 - 00003018 _____ C:\Windows\System32\Tasks\ReclaimerUpdateFiles_Administrator 2013-07-06 13:30 - 2013-07-17 11:34 - 00000402 _____ C:\Windows\Tasks\ReclaimerUpdateFiles_Administrator.job 2013-07-06 13:30 - 2013-07-06 13:30 - 00003650 _____ C:\Windows\System32\Tasks\RNUpgradeHelperResumePrompt_Administrator 2013-07-06 13:30 - 2013-07-06 13:30 - 00002722 _____ C:\Windows\System32\Tasks\RNUpgradeHelperLogonPrompt_Administrator 2013-07-06 13:09 - 2013-07-06 13:09 - 00000000 ____D C:\Users\ADMINI~1\AppData\Local\Cyberlink 2013-07-06 13:07 - 2013-07-06 13:07 - 00000000 ___HD C:\Users\Administrator\Documents\ShadowEditFiles 2013-07-06 13:07 - 2013-07-06 13:07 - 00000000 ____D C:\Users\Administrator\Documents\CyberLink 2013-07-03 05:52 - 2013-05-09 21:49 - 00030720 _____ (Microsoft Corporation) C:\Windows\system32\cryptdlg.dll 2013-07-03 05:52 - 2013-05-09 19:20 - 00024576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptdlg.dll 2013-07-03 05:52 - 2013-04-25 15:30 - 01505280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d11.dll 2013-07-03 05:52 - 2013-04-16 23:02 - 01230336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WindowsCodecs.dll 2013-07-03 05:52 - 2013-04-16 22:24 - 01424384 _____ (Microsoft Corporation) C:\Windows\system32\WindowsCodecs.dll 2013-07-03 05:52 - 2013-03-31 14:52 - 01887232 _____ (Microsoft Corporation) C:\Windows\system32\d3d11.dll 2013-07-03 05:52 - 2013-03-18 21:53 - 00230400 _____ (Microsoft Corporation) C:\Windows\system32\wwansvc.dll 2013-07-03 05:52 - 2013-03-18 21:53 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\wwanprotdim.dll 2013-06-30 20:18 - 2013-06-30 20:19 - 00000000 ____D C:\Users\Administrator\Documents\VIDEO_TS 2013-06-30 20:18 - 2003-11-06 15:38 - 00000000 ____D C:\Users\Administrator\Documents\AUDIO_TS 2013-06-30 19:58 - 2013-07-06 13:07 - 00000000 ____D C:\Users\Administrator\AppData\Roaming\CyberLink 2013-06-22 20:51 - 2013-06-22 20:51 - 01879632 _____ (InstallX, LLC) C:\Users\Administrator\Downloads\musicoasis.exe 2013-06-20 20:08 - 2013-06-21 06:30 - 00000000 ____D C:\ProgramData\Malwarebytes' Anti-Malware (portable) 2013-06-20 20:06 - 2013-06-20 20:07 - 00000000 ____D C:\Users\Administrator\Desktop\New folder (2) 2013-06-20 20:05 - 2013-06-20 20:05 - 13169742 _____ C:\Users\Administrator\Downloads\mbar-1.06.0.1003.zip 2013-06-19 21:05 - 2013-07-18 02:04 - 00005434 _____ C:\Windows\PFRO.log 2013-06-19 20:48 - 2013-06-19 20:48 - 00377856 _____ C:\Users\Administrator\Downloads\rxmikr9j.exe 2013-06-19 20:36 - 2013-06-19 21:51 - 00000000 ____D C:\Users\Administrator\Desktop\scans 2013-06-19 18:40 - 2013-06-19 18:40 - 00084696 _____ C:\Users\ADMINI~1\AppData\Local\GDIPFONTCACHEV1.DAT 2013-06-19 18:39 - 2013-07-18 10:52 - 00002296 _____ C:\Windows\setupact.log 2013-06-19 18:39 - 2013-06-19 18:39 - 00000000 _____ C:\Windows\setuperr.log 2013-06-19 18:38 - 2013-07-16 00:18 - 00354008 _____ C:\Windows\system32\FNTCACHE.DAT 2013-06-18 18:03 - 2013-06-18 18:03 - 00001895 _____ C:\Users\Public\Desktop\MGTEK dopisp.lnk 2013-06-18 18:03 - 2013-06-18 18:03 - 00000000 ____D C:\Program Files (x86)\MGTEK ==================== One Month Modified Files and Folders ======= 2013-07-18 22:25 - 2013-07-18 22:25 - 00000000 ____D C:\FRST 2013-07-18 22:19 - 2013-07-18 22:19 - 01778207 _____ (Farbar) C:\Users\Administrator\Desktop\FRST64.exe 2013-07-18 22:05 - 2010-05-24 03:59 - 00000902 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job 2013-07-18 21:57 - 2012-09-01 18:34 - 00000830 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job 2013-07-18 21:48 - 2012-10-13 12:37 - 00000920 _____ C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-820292111-1869468108-3859774255-1000UA.job 2013-07-18 13:34 - 2013-07-06 13:30 - 00003014 _____ C:\Windows\System32\Tasks\ReclaimerUpdateXML_Administrator 2013-07-18 13:34 - 2013-07-06 13:30 - 00000398 _____ C:\Windows\Tasks\ReclaimerUpdateXML_Administrator.job 2013-07-18 10:59 - 2013-07-16 11:17 - 00003362 _____ C:\Windows\System32\Tasks\RealPlayerRealUpgradeScheduledTaskS-1-5-21-820292111-1869468108-3859774255-500 2013-07-18 10:59 - 2013-07-06 23:19 - 00003244 _____ C:\Windows\System32\Tasks\RealPlayerRealUpgradeLogonTaskS-1-5-21-820292111-1869468108-3859774255-500 2013-07-18 10:59 - 2013-07-06 13:30 - 00000408 _____ C:\Windows\Tasks\RNUpgradeHelperLogonPrompt_Administrator.job 2013-07-18 10:59 - 2010-05-24 03:59 - 00000898 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job 2013-07-18 10:59 - 2009-07-13 20:45 - 00023248 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 2013-07-18 10:59 - 2009-07-13 20:45 - 00023248 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 2013-07-18 10:52 - 2013-06-19 18:39 - 00002296 _____ C:\Windows\setupact.log 2013-07-18 10:52 - 2009-07-13 21:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT 2013-07-18 10:49 - 2010-01-29 06:29 - 01570057 _____ C:\Windows\WindowsUpdate.log 2013-07-18 10:23 - 2013-07-18 09:47 - 00000000 ____D C:\Users\Administrator\Tracing 2013-07-18 09:49 - 2013-06-12 21:15 - 00000000 ____D C:\Users\Administrator\Desktop\New folder 2013-07-18 09:47 - 2012-08-31 11:18 - 00000000 ____D C:\Users\Administrator 2013-07-18 08:48 - 2012-10-13 12:37 - 00000868 _____ C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-820292111-1869468108-3859774255-1000Core.job 2013-07-18 02:11 - 2013-07-18 02:11 - 00034125 _____ C:\ComboFix.txt 2013-07-18 02:11 - 2013-07-17 23:18 - 00000000 ____D C:\Qoobox 2013-07-18 02:05 - 2009-07-13 18:34 - 00000215 _____ C:\Windows\system.ini 2013-07-18 02:04 - 2013-06-19 21:05 - 00005434 _____ C:\Windows\PFRO.log 2013-07-18 02:04 - 2009-07-13 18:34 - 86245376 _____ C:\Windows\system32\config\software.bak 2013-07-18 02:04 - 2009-07-13 18:34 - 15990784 _____ C:\Windows\system32\config\system.bak 2013-07-18 02:04 - 2009-07-13 18:34 - 04927488 _____ C:\Windows\system32\config\default.bak 2013-07-18 02:04 - 2009-07-13 18:34 - 00094208 _____ C:\Windows\system32\config\sam.bak 2013-07-18 02:04 - 2009-07-13 18:34 - 00028672 _____ C:\Windows\system32\config\security.bak 2013-07-18 02:03 - 2013-07-17 23:18 - 00000000 ____D C:\Windows\erdnt 2013-07-18 01:20 - 2013-07-18 01:20 - 05090256 ____R (Swearware) C:\Users\Administrator\Desktop\ComboFix.exe 2013-07-18 00:21 - 2009-07-13 19:20 - 00000000 __RHD C:\Users\Default 2013-07-17 23:18 - 2013-07-17 23:17 - 05090256 ____R (Swearware) C:\Users\Administrator\Downloads\ComboFix.exe 2013-07-17 15:49 - 2010-03-20 17:01 - 00000052 _____ C:\Windows\SysWOW64\DOErrors.log 2013-07-17 15:48 - 2012-12-05 19:40 - 00000000 _____ C:\Windows\system32\HP_ActiveX_Patch_NOT_DETECTED.txt 2013-07-17 11:34 - 2013-07-06 13:30 - 00003018 _____ C:\Windows\System32\Tasks\ReclaimerUpdateFiles_Administrator 2013-07-17 11:34 - 2013-07-06 13:30 - 00000402 _____ C:\Windows\Tasks\ReclaimerUpdateFiles_Administrator.job 2013-07-16 11:12 - 2013-05-08 04:11 - 00000000 ____D C:\Windows\pss 2013-07-16 10:45 - 2013-07-16 10:45 - 00007605 _____ C:\Users\ADMINI~1\AppData\Local\Resmon.ResmonCfg 2013-07-16 01:00 - 2010-05-24 03:59 - 00003898 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA 2013-07-16 01:00 - 2010-05-24 03:59 - 00003646 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore 2013-07-16 00:21 - 2013-07-16 00:21 - 00000000 ____D C:\Users\Administrator\AppData\Roaming\RealNetworks 2013-07-16 00:21 - 2013-03-29 18:58 - 00000000 ____D C:\Users\Administrator\AppData\Roaming\Real 2013-07-16 00:18 - 2013-06-19 18:38 - 00354008 _____ C:\Windows\system32\FNTCACHE.DAT 2013-07-16 00:18 - 2009-09-06 17:57 - 00000000 ____D C:\Windows\Panther 2013-07-16 00:16 - 2013-03-21 00:01 - 00000000 ____D C:\Program Files\Microsoft Silverlight 2013-07-16 00:16 - 2013-03-21 00:01 - 00000000 ____D C:\Program Files (x86)\Microsoft Silverlight 2013-07-16 00:16 - 2009-07-13 21:32 - 00000000 ____D C:\Program Files\Windows Defender 2013-07-16 00:16 - 2009-07-13 21:32 - 00000000 ____D C:\Program Files (x86)\Windows Defender 2013-07-10 22:55 - 2010-07-15 18:47 - 78185248 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe 2013-07-10 22:47 - 2009-10-31 23:03 - 00000000 ____D C:\ProgramData\Microsoft Help 2013-07-07 17:14 - 2013-04-03 16:11 - 00000364 _____ C:\Windows\Tasks\HPCeeScheduleForAdministrator.job 2013-07-07 12:42 - 2013-07-07 12:42 - 01899088 _____ (InstallX, LLC) C:\Users\Administrator\Downloads\7zip_freely_d2320532.exe 2013-07-07 10:15 - 2013-07-07 10:14 - 00000000 ____D C:\Users\Administrator\Downloads\5r553 transmission xeploded view 2013-07-07 04:10 - 2013-04-03 16:11 - 00003234 _____ C:\Windows\System32\Tasks\HPCeeScheduleForAdministrator 2013-07-07 02:09 - 2013-07-07 02:09 - 03423200 _____ (Conduit) C:\Users\Administrator\Downloads\Produtools_Manuals_2_1_B2.exe 2013-07-07 02:09 - 2013-07-07 02:09 - 00000000 ____D C:\Users\ADMINI~1\AppData\Local\CRE 2013-07-06 14:34 - 2013-05-10 06:01 - 00000000 ____D C:\Users\Administrator\AppData\Roaming\HpUpdate 2013-07-06 14:33 - 2013-07-06 14:33 - 00000000 ____D C:\ProgramData\Mozilla 2013-07-06 14:33 - 2013-07-06 14:33 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service 2013-07-06 14:33 - 2013-07-06 14:28 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox 2013-07-06 14:18 - 2013-07-06 14:18 - 02013672 _____ (Driver Manager) C:\Users\Administrator\Downloads\DriverManager.exe 2013-07-06 14:16 - 2013-07-06 14:16 - 00000000 ____D C:\Users\ADMINI~1\AppData\Local\DriverTuner 2013-07-06 14:15 - 2013-07-06 14:15 - 02811856 _____ (LionSea SoftWare ) C:\Users\Administrator\Downloads\setup.exe 2013-07-06 13:30 - 2013-07-06 13:30 - 00003650 _____ C:\Windows\System32\Tasks\RNUpgradeHelperResumePrompt_Administrator 2013-07-06 13:30 - 2013-07-06 13:30 - 00002722 _____ C:\Windows\System32\Tasks\RNUpgradeHelperLogonPrompt_Administrator 2013-07-06 13:09 - 2013-07-06 13:09 - 00000000 ____D C:\Users\ADMINI~1\AppData\Local\Cyberlink 2013-07-06 13:07 - 2013-07-06 13:07 - 00000000 ___HD C:\Users\Administrator\Documents\ShadowEditFiles 2013-07-06 13:07 - 2013-07-06 13:07 - 00000000 ____D C:\Users\Administrator\Documents\CyberLink 2013-07-06 13:07 - 2013-06-30 19:58 - 00000000 ____D C:\Users\Administrator\AppData\Roaming\CyberLink 2013-07-06 13:04 - 2012-08-31 11:19 - 00000000 ____D C:\Users\ADMINI~1\AppData\Local\Apple Computer 2013-07-05 18:42 - 2009-07-13 19:20 - 00000000 ____D C:\Windows\rescache 2013-06-30 20:19 - 2013-06-30 20:18 - 00000000 ____D C:\Users\Administrator\Documents\VIDEO_TS 2013-06-23 02:43 - 2010-03-11 17:32 - 00000000 ____D C:\Windows\System32\Tasks\Games 2013-06-22 20:51 - 2013-06-22 20:51 - 01879632 _____ (InstallX, LLC) C:\Users\Administrator\Downloads\musicoasis.exe 2013-06-21 06:30 - 2013-06-20 20:08 - 00000000 ____D C:\ProgramData\Malwarebytes' Anti-Malware (portable) 2013-06-20 20:07 - 2013-06-20 20:06 - 00000000 ____D C:\Users\Administrator\Desktop\New folder (2) 2013-06-20 20:05 - 2013-06-20 20:05 - 13169742 _____ C:\Users\Administrator\Downloads\mbar-1.06.0.1003.zip 2013-06-20 19:36 - 2013-05-07 13:22 - 00003606 _____ C:\Windows\wininit.ini 2013-06-19 21:51 - 2013-06-19 20:36 - 00000000 ____D C:\Users\Administrator\Desktop\scans 2013-06-19 20:48 - 2013-06-19 20:48 - 00377856 _____ C:\Users\Administrator\Downloads\rxmikr9j.exe 2013-06-19 20:10 - 2009-07-13 19:20 - 00000000 ____D C:\Windows\system32\NDF 2013-06-19 18:40 - 2013-06-19 18:40 - 00084696 _____ C:\Users\ADMINI~1\AppData\Local\GDIPFONTCACHEV1.DAT 2013-06-19 18:39 - 2013-06-19 18:39 - 00000000 _____ C:\Windows\setuperr.log 2013-06-18 18:03 - 2013-06-18 18:03 - 00001895 _____ C:\Users\Public\Desktop\MGTEK dopisp.lnk 2013-06-18 18:03 - 2013-06-18 18:03 - 00000000 ____D C:\Program Files (x86)\MGTEK Files to move or delete: ==================== C:\ProgramData\ntuser.dat ==================== Bamital & volsnap Check ================= C:\Windows\System32\winlogon.exe => MD5 is legit C:\Windows\System32\wininit.exe => MD5 is legit C:\Windows\SysWOW64\wininit.exe => MD5 is legit C:\Windows\explorer.exe => MD5 is legit C:\Windows\SysWOW64\explorer.exe => MD5 is legit C:\Windows\System32\svchost.exe => MD5 is legit C:\Windows\SysWOW64\svchost.exe => MD5 is legit C:\Windows\System32\services.exe => MD5 is legit C:\Windows\System32\User32.dll => MD5 is legit C:\Windows\SysWOW64\User32.dll => MD5 is legit C:\Windows\System32\userinit.exe => MD5 is legit C:\Windows\SysWOW64\userinit.exe => MD5 is legit C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit LastRegBack: 2013-07-17 00:24 ==================== End Of Log ============================ Additional scan result of Farbar Recovery Scan Tool (x64) Version: 18-07-2013 Ran by Administrator at 2013-07-18 22:27:01 Running from C:\Users\Administrator\Desktop Boot Mode: Normal ========================================================== ==================== Installed Programs ======================= Update for Microsoft Office 2007 (KB2508958) (x32) Acrobat.com (x32 Version: 1.6.65) Adobe AIR (x32 Version: 2.0.3.13070) Adobe Flash Player 11 ActiveX (x32 Version: 11.7.700.224) Adobe Flash Player 11 Plugin (x32 Version: 11.7.700.224) Adobe Reader 9.1 MUI (x32 Version: 9.1.0) Adobe Shockwave Player (x32 Version: 11.0) Anarchy Online (x32 Version: 18.6.1_EP1) Ancient Spiders Solitaire (x32 Version: 2.2.0.95) Any Video Converter 3.5.7 (x32) Apple Application Support (x32 Version: 2.3.4) Apple Mobile Device Support (Version: 6.1.0.13) Apple Software Update (x32 Version: 2.1.3.127) Atheros Driver Installation Program (x32 Version: 9.0) Blasterball 3 (x32 Version: 2.2.0.95) Bonjour (Version: 3.0.0.10) Compatibility Pack for the 2007 Office system (x32 Version: 12.0.6612.1000) Conexant HD Audio (Version: 4.98.60.50) CyberLink DVD Suite (x32 Version: 7.0.2111) CyberLink MediaShow (x32 Version: 4.1.3325) eaner (Version: 4.01) FileZilla Client 3.6.0.2 (x32 Version: 3.6.0.2) Google Chrome (x32 Version: 28.0.1500.72) Google Earth Plug-in (x32 Version: 7.0.3.8542) Google Talk Plugin (x32 Version: 3.18.3.12840) Google Update Helper (x32 Version: 1.3.21.153) HDAUDIO Soft Data Fax Modem with SmartCP (Version: 7.80.4.50) Hewlett-Packard ACLM.NET v1.2.1.1 (x32 Version: 1.00.0000) House of Cards (x32 Version: 2.2.0.95) HP Advisor (x32 Version: 3.3.9512.3162) HP Customer Experience Enhancements (x32 Version: 6.0.1.7) HP Games (x32 Version: 1.0.2.5) HP Product Detection (x32 Version: 11.15.0008) HP Quick Launch Buttons (x32 Version: 6.50.16.1) HP Setup (x32 Version: 1.2.3560.3170) HP Smart Web Printing 4.60 (Version: 4.60) HP Support Assistant (x32 Version: 7.0.39.15) HP Update (x32 Version: 5.005.000.002) HP User Guides 0156 (x32 Version: 1.02.0001) HP Wireless Assistant (x32 Version: 3.50.11.2) iCloud (Version: 2.1.2.8) Intel® Graphics Media Accelerator Driver (Version: 8.15.10.2202) Internet TV for Windows Media Center (x32 Version: 4.2.2.0) iTunes (Version: 11.0.4.4) Java 7 Update 21 (x32 Version: 7.0.210) Java Auto Updater (x32 Version: 2.1.9.5) Java 6 Update 15 (64-bit) (Version: 6.0.150) Java SE Development Kit 6 Update 15 (64-bit) (Version: 1.6.0.150) Junk Mail filter update (x32 Version: 14.0.8089.726) LabelPrint (x32 Version: 2.5.2111) Malwarebytes Anti-Malware version 1.75.0.1300 (x32 Version: 1.75.0.1300) MGTEK dopisp 6.1 (x32 Version: 6.1.3574) Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319) Microsoft .NET Framework 4 Extended (Version: 4.0.30319) Microsoft Application Error Reporting (Version: 12.0.6015.5000) Microsoft Choice Guard (x32 Version: 2.0.48.0) Microsoft Live Search Toolbar (x32 Version: 3.0.566.0) Microsoft Office 2007 Service Pack 3 (SP3) (x32) Microsoft Office Excel MUI (English) 2007 (x32 Version: 12.0.6612.1000) Microsoft Office File Validation Add-In (x32 Version: 14.0.5130.5003) Microsoft Office Home and Student 2007 (x32 Version: 12.0.6612.1000) Microsoft Office Office 64-bit Components 2007 (Version: 12.0.6612.1000) Microsoft Office OneNote MUI (English) 2007 (x32 Version: 12.0.6612.1000) Microsoft Office PowerPoint MUI (English) 2007 (x32 Version: 12.0.6612.1000) Microsoft Office PowerPoint Viewer 2007 (English) (x32 Version: 12.0.6612.1000) Microsoft Office Proof (English) 2007 (x32 Version: 12.0.6612.1000) Microsoft Office Proof (French) 2007 (x32 Version: 12.0.6612.1000) Microsoft Office Proof (Spanish) 2007 (x32 Version: 12.0.6612.1000) Microsoft Office Proofing (English) 2007 (x32 Version: 12.0.4518.1014) Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3) (x32) Microsoft Office Shared 64-bit MUI (English) 2007 (Version: 12.0.6612.1000) Microsoft Office Shared 64-bit Setup Metadata MUI (English) 2007 (Version: 12.0.6612.1000) Microsoft Office Shared MUI (English) 2007 (x32 Version: 12.0.6612.1000) Microsoft Office Shared Setup Metadata MUI (English) 2007 (x32 Version: 12.0.6612.1000) Microsoft Office Suite Activation Assistant (x32 Version: 2.9) Microsoft Office Word MUI (English) 2007 (x32 Version: 12.0.6612.1000) Microsoft Silverlight (Version: 5.1.20513.0) Microsoft SQL Server 2005 Compact Edition [ENU] (x32 Version: 3.1.0000) Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 (x32 Version: 8.0.50727.4053) Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.56336) Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.61001) Microsoft Visual C++ 2005 Redistributable (x64) (Version: 8.0.56336) Microsoft Visual C++ 2005 Redistributable (x64) (Version: 8.0.61000) Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (Version: 9.0.30729) Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (Version: 9.0.30729.4148) Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (Version: 9.0.30729.6161) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (x32 Version: 9.0.30729.4148) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (x32 Version: 9.0.30729.6161) Microsoft Works (x32 Version: 9.7.0621) MobileMe Control Panel (Version: 3.1.4.0) Mozilla Firefox 22.0 (x86 en-US) (x32 Version: 22.0) Mozilla Maintenance Service (x32 Version: 22.0) MSVCRT (x32 Version: 14.0.1468.721) Mystery of Shark Island (x32 Version: 2.2.0.95) NaturalReaderFree (x32 Version: 11.9) PDFCreator (x32 Version: 1.2.0) Picasa 3 (x32 Version: 3.9) Power2Go (x32 Version: 6.0.3311) PowerDirector (x32 Version: 7.0.3311) QLBCASL (x32 Version: 6.40.17.2) QuickShare (x32 Version: 1.6.1.924) QuickTime (x32 Version: 7.74.80.86) RealDownloader (x32 Version: 1.3.0) RealNetworks - Microsoft Visual C++ 2008 Runtime (x32 Version: 9.0) RealNetworks - Microsoft Visual C++ 2010 Runtime (x32 Version: 10.0) RealPlayer (x32 Version: 16.0.0) Realtek 8136 8168 8169 Ethernet Driver (x32 Version: 1.00.0007) Realtek USB 2.0 Card Reader (x32 Version: 6.1.7100.30093) RealUpgrade 1.1 (x32 Version: 1.1.0) Recovery Manager (x32 Version: 5.5.2202) SeaMonkey 2.16 (x86 en-US) (x32 Version: 2.16) Search Protect by conduit (x32 Version: 1.5.0.71) Skype™ 5.10 (x32 Version: 5.10.116) SmartWebPrinting (x32 Version: 140.0.186.000) Synaptics Pointing Device Driver (Version: 13.2.2.0) Update for 2007 Microsoft Office System (KB967642) (x32) Update for Microsoft .NET Framework 4 Client Profile (KB2533523) (x32 Version: 1) Update for Microsoft .NET Framework 4 Client Profile (KB2600217) (x32 Version: 1) Update for Microsoft .NET Framework 4 Extended (KB2533523) (x32 Version: 1) Update for Microsoft .NET Framework 4 Extended (KB2600217) (x32 Version: 1) Update for Microsoft Office 2007 Help for Common Features (KB963673) (x32) Update for Microsoft Office 2007 suites (KB2596620) 32-Bit Edition (x32) Update for Microsoft Office 2007 suites (KB2596660) 32-Bit Edition (x32) Update for Microsoft Office 2007 suites (KB2596848) 32-Bit Edition (x32) Update for Microsoft Office 2007 suites (KB2687493) 32-Bit Edition (x32) Update for Microsoft Office 2007 suites (KB2767916) 32-Bit Edition (x32) Update for Microsoft Office Excel 2007 Help (KB963678) (x32) Update for Microsoft Office Powerpoint 2007 Help (KB963669) (x32) Update for Microsoft Office Script Editor Help (KB963671) (x32) Update for Microsoft Office Word 2007 Help (KB963665) (x32) Update Installer for WildTangent Games App (x32) WildTangent Games App (HP Games) (x32 Version: 4.0.10.16) Windows Live Call (x32 Version: 14.0.8064.0206) Windows Live Communications Platform (x32 Version: 14.0.8064.206) Windows Live Essentials (x32 Version: 14.0.8089.0726) Windows Live Essentials (x32 Version: 14.0.8089.726) Windows Live Mail (x32 Version: 14.0.8089.0726) Windows Live Messenger (x32 Version: 14.0.8089.0726) Windows Live Movie Maker (x32 Version: 14.0.8091.0730) Windows Live Photo Gallery (x32 Version: 14.0.8081.709) Windows Live Sign-in Assistant (x32 Version: 5.000.818.5) Windows Live Sync (x32 Version: 14.0.8089.726) Windows Live Upload Tool (x32 Version: 14.0.8014.1029) Windows Live Writer (x32 Version: 14.0.8089.0726) Windows Media Center Add-in for Flash (x32 Version: 4.1.2.0) ZTE Handset USB Driver ZTE Handset USB Driver (Version: 5.2066.1.9B04) ==================== Restore Points ========================= 03-07-2013 13:53:03 Windows Update 06-07-2013 21:21:59 Windows Update 06-07-2013 22:20:08 Installed Driver Manager. 08-07-2013 03:00:06 Windows Backup 11-07-2013 02:31:43 Windows Update 11-07-2013 06:43:52 Windows Update 16-07-2013 08:29:04 Windows Backup 16-07-2013 08:33:17 Windows Update 18-07-2013 09:22:28 ComboFix created restore point ==================== Hosts content: ========================== 2009-07-13 18:34 - 2013-07-18 02:05 - 00000027 ____A C:\Windows\system32\Drivers\etc\hosts 127.0.0.1 localhost ==================== Scheduled Tasks (whitelisted) ============= Task: {0E53346B-C4DC-4FFD-8E78-36D8CADCAE5E} - System32\Tasks\RealDownloaderDownloaderScheduledTaskS-1-5-21-820292111-1869468108-3859774255-1000 => C:\Program Files (x86)\RealNetworks\RealDownloader\recordingmanager.exe [2012-11-29] (RealNetworks, Inc.) Task: {10477E4A-6EDC-4295-BB03-20E13199B947} - System32\Tasks\Hewlett-Packard\HP Support Assistant\Update Check => C:\ProgramData\Hewlett-Packard\HP Support Framework\Resources\Updater7\HPSFUpdater.exe [2013-04-01] (Hewlett-Packard Company) Task: {1126E0C9-D049-4AD3-A153-29650537DE00} - System32\Tasks\Microsoft\Windows\Media Center\mcupdate_scheduled => C:\Windows\ehome\mcupdate.exe [2010-11-20] (Microsoft Corporation) Task: {12DA1C6A-976D-41E7-9C2B-80FAB836DAD4} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2010-05-24] (Google Inc.) Task: {17041CA6-1F02-4E94-BA70-56B3AE3EDCBD} - System32\Tasks\RealDownloaderRealUpgradeScheduledTaskS-1-5-21-820292111-1869468108-3859774255-1000 => C:\Program Files (x86)\RealNetworks\RealDownloader\realupgrade.exe [2012-11-29] (RealNetworks, Inc.) Task: {1B1A4508-D087-4801-BC95-C1F74E45203A} - System32\Tasks\User_Feed_Synchronization-{3A2EFA84-6D3A-4AC3-BF2F-4B685BF63066} => C:\Windows\system32\msfeedssync.exe [2013-05-08] (Microsoft Corporation) Task: {295899C1-38C5-48C9-80B2-DBB9E35601DF} - System32\Tasks\Hewlett-Packard\HP Support Assistant\PC Health Analysis => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe [2012-09-27] (Hewlett-Packard Company) Task: {49E1BA52-0A77-4DAB-996D-BFA455AA12C1} - System32\Tasks\ReclaimerUpdateXML_Administrator => C:\Users\Administrator\AppData\Roaming\Real\Update\UpgradeHelper\RealPlayer\10.50\agent\rnupgagent.exe [2013-07-06] (RealNetworks, Inc.) Task: {5AF935F5-7602-456A-9C33-AF9E67E864BB} - System32\Tasks\Hewlett-Packard\HP Support Assistant\HPSAObjUtilTask => C:\Program Files (x86)\Hewlett-Packard\HP Health Check\ActiveCheck\product_line\UtilTask.exe [2013-07-09] (Microsoft) Task: {659F612E-0142-4693-BD7A-458C772DCE50} - System32\Tasks\RNUpgradeHelperLogonPrompt_Administrator => C:\Users\Administrator\AppData\Roaming\Real\Update\UpgradeHelper\RealPlayer\10.50\agent\rnupgagent.exe [2013-07-06] (RealNetworks, Inc.) Task: {6A1B9678-7561-42C5-B8BA-4C1B24AD00FC} - System32\Tasks\RealUpgradeScheduledTaskS-1-5-21-820292111-1869468108-3859774255-1000 => C:\Program Files (x86)\Real\RealUpgrade\RealUpgrade.exe [2012-11-30] (RealNetworks, Inc.) Task: {6BED7511-C8E7-4943-A3EB-793DFD9E5E9A} - System32\Tasks\RealUpgradeLogonTaskS-1-5-21-820292111-1869468108-3859774255-1000 => C:\Program Files (x86)\Real\RealUpgrade\RealUpgrade.exe [2012-11-30] (RealNetworks, Inc.) Task: {9DEE9EA3-32E8-448A-820D-28BD6CA5E84F} - System32\Tasks\RNUpgradeHelperResumePrompt_Administrator => C:\Users\Administrator\AppData\Roaming\Real\Update\UpgradeHelper\RealPlayer\10.50\agent\rnupgagent.exe [2013-07-06] (RealNetworks, Inc.) Task: {A4539F8C-3944-494F-853B-B99BDBFA8123} - System32\Tasks\RealDownloaderRealUpgradeLogonTaskS-1-5-21-820292111-1869468108-3859774255-1000 => C:\Program Files (x86)\RealNetworks\RealDownloader\realupgrade.exe [2012-11-29] (RealNetworks, Inc.) Task: {A86F9183-7FD1-4141-84BA-63B3B6EF08CF} - System32\Tasks\RealPlayerRealUpgradeScheduledTaskS-1-5-21-820292111-1869468108-3859774255-500 => C:\Program Files (x86)\Real\RealUpgrade\RealUpgrade.exe [2012-11-30] (RealNetworks, Inc.) Task: {B2569D54-9C27-4D65-8D0B-9F7572BF7DA8} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-820292111-1869468108-3859774255-1000UA => C:\Users\Nyamuoch\AppData\Local\Google\Update\GoogleUpdate.exe [2012-09-15] (Google Inc.) Task: {B3FF3BD5-DFDE-4068-A55B-375AFB01A367} - System32\Tasks\Microsoft\Windows\WindowsBackup\AutomaticBackup => C:\Windows\system32\rundll32.exe [2009-07-13] (Microsoft Corporation) Task: {B610BAC0-2279-4DD7-B3BE-F20723B1182B} - System32\Tasks\ReclaimerUpdateFiles_Administrator => C:\Users\Administrator\AppData\Roaming\Real\Update\UpgradeHelper\RealPlayer\10.50\agent\rnupgagent.exe [2013-07-06] (RealNetworks, Inc.) Task: {BE3229AF-DE00-445A-8ADE-FAA0A00CD8FD} - System32\Tasks\HPCeeScheduleForAdministrator => C:\Program Files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe [2010-09-13] (Hewlett-Packard) Task: {C14C6F69-4F0A-430A-9C34-B4516F2F6253} - System32\Tasks\Microsoft\Windows\WindowsBackup\Windows Backup Monitor => C:\Windows\system32\sdclt.exe [2010-11-20] (Microsoft Corporation) Task: {C61FB612-35C4-4936-A9A4-A542D50E59CD} - System32\Tasks\Hewlett-Packard\HP Support Assistant\HP Support Assistant Quick Start => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe [2012-09-27] (Hewlett-Packard Company) Task: {C8AFA857-DEAD-4B2F-B8D8-5B2B407BED29} - System32\Tasks\RealPlayerRealUpgradeScheduledTaskS-1-5-21-820292111-1869468108-3859774255-1000 => C:\Program Files (x86)\Real\RealUpgrade\RealUpgrade.exe [2012-11-30] (RealNetworks, Inc.) Task: {C9F8FED4-00A9-4F63-94DA-D918BC4522FF} - System32\Tasks\Microsoft\Windows Defender\MP Scheduled Scan => C:\program files\windows defender\MpCmdRun.exe [2009-07-13] (Microsoft Corporation) Task: {CD422D5B-A235-4F85-A833-F5AB0435D8BB} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2013-06-12] (Adobe Systems Incorporated) Task: {DB7268F6-CA5E-464C-8452-31E39338C2A8} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2013-04-23] (Piriform Ltd) Task: {DEBB27FB-062A-4E48-90D8-E9FD878D524A} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.) Task: {DFD7353F-3401-4914-A6F4-98D887805DC9} - System32\Tasks\Games\UpdateCheck_S-1-5-21-820292111-1869468108-3859774255-500 Task: {E74ECED9-17F9-4328-B274-CD17A64A1369} - System32\Tasks\RealPlayerRealUpgradeLogonTaskS-1-5-21-820292111-1869468108-3859774255-1000 => C:\Program Files (x86)\Real\RealUpgrade\RealUpgrade.exe [2012-11-30] (RealNetworks, Inc.) Task: {ED846F19-10BD-42B9-8789-8BA3635C9806} - System32\Tasks\RealPlayerRealUpgradeLogonTaskS-1-5-21-820292111-1869468108-3859774255-500 => C:\Program Files (x86)\Real\RealUpgrade\RealUpgrade.exe [2012-11-30] (RealNetworks, Inc.) Task: {F1C25FA9-BB10-4F74-8A08-F5F63A5BFCF9} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-820292111-1869468108-3859774255-1000Core => C:\Users\Nyamuoch\AppData\Local\Google\Update\GoogleUpdate.exe [2012-09-15] (Google Inc.) Task: {F632924F-4E75-4E7B-8CDB-A381335DA9A4} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2010-05-24] (Google Inc.) Task: {F6B2484E-DA4C-46D5-982E-0B58371EAE93} - System32\Tasks\Hewlett-Packard\HP Support Assistant\WarrantyChecker_DeviceScan => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPWarrantyCheck\HPWarrantyChecker.exe [2013-07-05] (Hewlett-Packard) Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-820292111-1869468108-3859774255-1000Core.job => C:\Users\Nyamuoch\AppData\Local\Google\Update\GoogleUpdate.exe Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-820292111-1869468108-3859774255-1000UA.job => C:\Users\Nyamuoch\AppData\Local\Google\Update\GoogleUpdate.exe Task: C:\Windows\Tasks\HPCeeScheduleForAdministrator.job => C:\Program Files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe Task: C:\Windows\Tasks\ReclaimerUpdateFiles_Administrator.job => C:\Users\Administrator\AppData\Roaming\Real\Update\UpgradeHelper\RealPlayer\10.50\agent\rnupgagent.exe Task: C:\Windows\Tasks\ReclaimerUpdateXML_Administrator.job => C:\Users\Administrator\AppData\Roaming\Real\Update\UpgradeHelper\RealPlayer\10.50\agent\rnupgagent.exe Task: C:\Windows\Tasks\RNUpgradeHelperLogonPrompt_Administrator.job => C:\Users\Administrator\AppData\Roaming\Real\Update\UpgradeHelper\RealPlayer\10.50\agent\rnupgagent.exe ==================== Faulty Device Manager Devices ============= ==================== Event log errors: ========================= Application errors: ================== Error: (07/18/2013 02:51:54 AM) (Source: SideBySide) (User: ) Description: Activation context generation failed for "WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1"1".Error in manifest or policy file "WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1"2" on line WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1"3. Component identity found in manifest does not match the identity of the component requested. Reference is WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1". Definition is WLMFDS,processorArchitecture="x86",type="win32",version="1.0.0.1". Please use sxstrace.exe for detailed diagnosis. Error: (07/17/2013 00:25:43 AM) (Source: SideBySide) (User: ) Description: Activation context generation failed for "WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1"1".Error in manifest or policy file "WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1"2" on line WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1"3. Component identity found in manifest does not match the identity of the component requested. Reference is WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1". Definition is WLMFDS,processorArchitecture="x86",type="win32",version="1.0.0.1". Please use sxstrace.exe for detailed diagnosis. Error: (07/16/2013 11:28:54 PM) (Source: ESENT) (User: ) Description: taskhost (2076) WebCacheLocal: Database recovery/restore failed with unexpected error -1032. Error: (07/16/2013 11:28:53 PM) (Source: ESENT) (User: ) Description: taskhost (2076) WebCacheLocal: An attempt to open the file "C:\Users\Administrator\AppData\Local\Microsoft\Windows\WebCache\V01.log" for read only access failed with system error 32 (0x00000020): "The process cannot access the file because it is being used by another process. ". The open file operation will fail with error -1032 (0xfffffbf8). Error: (07/16/2013 11:28:43 PM) (Source: ESENT) (User: ) Description: taskhost (2076) WebCacheLocal: An attempt to open the file "C:\Users\Administrator\AppData\Local\Microsoft\Windows\WebCache\V01.log" for read / write access failed with system error 32 (0x00000020): "The process cannot access the file because it is being used by another process. ". The open file operation will fail with error -1032 (0xfffffbf8). Error: (07/16/2013 11:16:45 AM) (Source: ESENT) (User: ) Description: taskhost (2236) An attempt to open the file "C:\Users\Administrator\AppData\Local\Microsoft\Windows\WebCache\WebCacheV01.dat" for read only access failed with system error 32 (0x00000020): "The process cannot access the file because it is being used by another process. ". The open file operation will fail with error -1032 (0xfffffbf8). Error: (07/16/2013 06:54:40 AM) (Source: Application Hang) (User: ) Description: The program wmplayer.exe version 12.0.7601.17514 stopped interacting with Windows and was closed. To see if more information about the problem is available, check the problem history in the Action Center control panel. Process ID: f14 Start Time: 01ce82340f5c9c59 Termination Time: 749 Application Path: C:\Program Files (x86)\Windows Media Player\wmplayer.exe Report Id: 9a0b6bd7-ee27-11e2-9c69-00262db82294 Error: (07/16/2013 06:41:25 AM) (Source: Application Hang) (User: ) Description: The program wmplayer.exe version 12.0.7601.17514 stopped interacting with Windows and was closed. To see if more information about the problem is available, check the problem history in the Action Center control panel. Process ID: 8dc Start Time: 01ce81fdbb83a85e Termination Time: 1108 Application Path: C:\Program Files (x86)\Windows Media Player\wmplayer.exe Report Id: af557f1b-ee25-11e2-9c69-00262db82294 Error: (07/16/2013 01:55:24 AM) (Source: Bonjour Service) (User: ) Description: Task Scheduling Error: m->NextScheduledSPRetry 16224 Error: (07/16/2013 01:55:24 AM) (Source: Bonjour Service) (User: ) Description: Task Scheduling Error: m->NextScheduledEvent 16224 System errors: ============= Error: (07/18/2013 10:52:18 AM) (Source: Service Control Manager) (User: ) Description: The SBSD Security Center Service service failed to start due to the following error: %%2 Error: (07/18/2013 10:50:13 AM) (Source: Service Control Manager) (User: ) Description: The SBSD Security Center Service service failed to start due to the following error: %%2 Error: (07/18/2013 10:31:42 AM) (Source: Service Control Manager) (User: ) Description: The SBSD Security Center Service service failed to start due to the following error: %%2 Error: (07/18/2013 10:27:21 AM) (Source: Service Control Manager) (User: ) Description: The SBSD Security Center Service service failed to start due to the following error: %%2 Error: (07/18/2013 10:23:14 AM) (Source: Service Control Manager) (User: ) Description: The SBSD Security Center Service service failed to start due to the following error: %%2 Error: (07/18/2013 02:09:51 AM) (Source: Service Control Manager) (User: ) Description: The Windows Update service hung on starting. Error: (07/18/2013 02:06:51 AM) (Source: Service Control Manager) (User: ) Description: The HP Support Assistant Service service failed to start due to the following error: %%31 Error: (07/18/2013 02:06:29 AM) (Source: Service Control Manager) (User: ) Description: The Windows Presentation Foundation Font Cache 3.0.0.0 service failed to start due to the following error: %%31 Error: (07/18/2013 02:04:47 AM) (Source: Service Control Manager) (User: ) Description: The SBSD Security Center Service service failed to start due to the following error: %%2 Error: (07/18/2013 02:03:48 AM) (Source: Service Control Manager) (User: ) Description: The UPnP Device Host service failed to start due to the following error: %%1069 Microsoft Office Sessions: ========================= CodeIntegrity Errors: =================================== Date: 2013-07-18 02:02:12.198 Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume2\ComboFix\catchme.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source. Date: 2013-07-18 02:02:11.870 Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume2\ComboFix\catchme.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source. Date: 2013-07-18 02:02:11.511 Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume2\ComboFix\catchme.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source. Date: 2013-07-18 02:02:11.184 Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume2\ComboFix\catchme.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source. Date: 2013-07-17 23:31:02.523 Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume2\ComboFix\catchme.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source. Date: 2013-07-17 23:31:02.168 Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume2\ComboFix\catchme.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source. Date: 2013-05-28 00:34:17.168 Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\ELAMBKUP\klelam.sys because the set of per-page image hashes could not be found on the system. Date: 2013-05-28 00:34:17.166 Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\ELAMBKUP\klelam.sys because the set of per-page image hashes could not be found on the system. Date: 2013-05-28 00:34:17.163 Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\ELAMBKUP\klelam.sys because the set of per-page image hashes could not be found on the system. Date: 2013-05-28 00:34:17.152 Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 2013\KLELAMX64\klelam.sys because the set of per-page image hashes could not be found on the system. ==================== Memory info =========================== Percentage of memory in use: 41% Total physical RAM: 1979.2 MB Available physical RAM: 1160.99 MB Total Pagefile: 3958.39 MB Available Pagefile: 2992.94 MB Total Virtual: 8192 MB Available Virtual: 8191.82 MB ==================== Drives ================================ Drive c: () (Fixed) (Total:220.4 GB) (Free:132.97 GB) NTFS (Disk=0 Partition=2) ==>[system with boot components (obtained from reading drive)] Drive d: (RECOVERY) (Fixed) (Total:12.29 GB) (Free:2.03 GB) NTFS (Disk=0 Partition=3) ==>[system with boot components (obtained from reading drive)] ==================== MBR & Partition Table ================== ======================================================== Disk: 0 (Size: 233 GB) (Disk ID: 0393754D) Partition 1: (Active) - (Size=199 MB) - (Type=07 NTFS) Partition 2: (Not Active) - (Size=220 GB) - (Type=07 NTFS) Partition 3: (Not Active) - (Size=12 GB) - (Type=07 NTFS) ==================== End Of Log =====================
  12. justime
    better but i still am having problems with access it will not let me into my music libraries , i go documents-my documents-my music. and it says access denied C:\users\administrator\documents\my music is not accessible
  13. justime
    ComboFix 13-07-18.01 - Administrator 07/18/2013 1:55.3.1 - x64 Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.1979.880 [GMT -8:00] Running from: c:\users\Administrator\Desktop\ComboFix.exe Command switches used :: c:\users\Administrator\Desktop\CFScript.txt SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} . . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . . c:\program files (x86)\SearchProtect c:\program files (x86)\SearchProtect\bin\ChromeModule.dll c:\program files (x86)\SearchProtect\bin\cltmng.exe c:\program files (x86)\SearchProtect\bin\CltMngSvc.exe c:\program files (x86)\SearchProtect\bin\FirefoxModule.dll c:\program files (x86)\SearchProtect\bin\InternetExplorerModule.dll c:\program files (x86)\SearchProtect\bin\msvcp100.dll c:\program files (x86)\SearchProtect\bin\msvcr100.dll c:\program files (x86)\SearchProtect\bin\rep.dat c:\program files (x86)\SearchProtect\bin\SPHook32.dll c:\program files (x86)\SearchProtect\bin\SPRunner.exe c:\program files (x86)\SearchProtect\bin\uninstall.exe c:\program files (x86)\SearchProtect\Dialogs\dialogsApi.js c:\program files (x86)\SearchProtect\Dialogs\lib\jquery.min.js c:\program files (x86)\SearchProtect\Dialogs\lib\json2.js c:\program files (x86)\SearchProtect\Dialogs\spbd\bubble.css c:\program files (x86)\SearchProtect\Dialogs\spbd\bubble.js c:\program files (x86)\SearchProtect\Dialogs\spbd\images\information.png c:\program files (x86)\SearchProtect\Dialogs\spbd\images\x-default-LTR.png c:\program files (x86)\SearchProtect\Dialogs\spbd\images\x-default-RTL.png c:\program files (x86)\SearchProtect\Dialogs\spbd\images\x-mouseover-LTR.png c:\program files (x86)\SearchProtect\Dialogs\spbd\images\x-mouseover-RTL.png c:\program files (x86)\SearchProtect\Dialogs\spbd\main.html c:\program files (x86)\SearchProtect\Dialogs\spsd\images\ok-button.png c:\program files (x86)\SearchProtect\Dialogs\spsd\images\separation-line.png c:\program files (x86)\SearchProtect\Dialogs\spsd\images\warning.png c:\program files (x86)\SearchProtect\Dialogs\spsd\main.html c:\program files (x86)\SearchProtect\Dialogs\spsd\SearchProtector.css c:\program files (x86)\SearchProtect\Dialogs\spsd\settings.js c:\program files (x86)\SearchProtect\ffprotect\abstraction.js c:\program files (x86)\SearchProtect\ffprotect\application.js c:\program files (x86)\SearchProtect\ffprotect\nsprotector.js c:\users\Administrator\AppData\Roaming\SearchProtect c:\users\Administrator\AppData\Roaming\SearchProtect\bin\ChromeModule.dll c:\users\Administrator\AppData\Roaming\SearchProtect\bin\cltmng.exe c:\users\Administrator\AppData\Roaming\SearchProtect\bin\CltMngSvc.exe c:\users\Administrator\AppData\Roaming\SearchProtect\bin\FirefoxModule.dll c:\users\Administrator\AppData\Roaming\SearchProtect\bin\InternetExplorerModule.dll c:\users\Administrator\AppData\Roaming\SearchProtect\bin\msvcp100.dll c:\users\Administrator\AppData\Roaming\SearchProtect\bin\msvcr100.dll c:\users\Administrator\AppData\Roaming\SearchProtect\bin\rep.dat c:\users\Administrator\AppData\Roaming\SearchProtect\bin\SPHook32.dll c:\users\Administrator\AppData\Roaming\SearchProtect\bin\SPRunner.exe c:\users\Administrator\AppData\Roaming\SearchProtect\Dialogs\dialogsApi.js c:\users\Administrator\AppData\Roaming\SearchProtect\Dialogs\lib\jquery.min.js c:\users\Administrator\AppData\Roaming\SearchProtect\Dialogs\lib\json2.js c:\users\Administrator\AppData\Roaming\SearchProtect\Dialogs\spbd\bubble.css c:\users\Administrator\AppData\Roaming\SearchProtect\Dialogs\spbd\bubble.js c:\users\Administrator\AppData\Roaming\SearchProtect\Dialogs\spbd\images\information.png c:\users\Administrator\AppData\Roaming\SearchProtect\Dialogs\spbd\images\x-default-LTR.png c:\users\Administrator\AppData\Roaming\SearchProtect\Dialogs\spbd\images\x-default-RTL.png c:\users\Administrator\AppData\Roaming\SearchProtect\Dialogs\spbd\images\x-mouseover-LTR.png c:\users\Administrator\AppData\Roaming\SearchProtect\Dialogs\spbd\images\x-mouseover-RTL.png c:\users\Administrator\AppData\Roaming\SearchProtect\Dialogs\spbd\main.html c:\users\Administrator\AppData\Roaming\SearchProtect\Dialogs\spsd\images\ok-button.png c:\users\Administrator\AppData\Roaming\SearchProtect\Dialogs\spsd\images\separation-line.png c:\users\Administrator\AppData\Roaming\SearchProtect\Dialogs\spsd\images\warning.png c:\users\Administrator\AppData\Roaming\SearchProtect\Dialogs\spsd\main.html c:\users\Administrator\AppData\Roaming\SearchProtect\Dialogs\spsd\SearchProtector.css c:\users\Administrator\AppData\Roaming\SearchProtect\Dialogs\spsd\settings.js c:\users\Administrator\AppData\Roaming\SearchProtect\ffprotect\abstraction.js c:\users\Administrator\AppData\Roaming\SearchProtect\ffprotect\application.js c:\users\Administrator\AppData\Roaming\SearchProtect\ffprotect\Dialogs\dialogsApi.js c:\users\Administrator\AppData\Roaming\SearchProtect\ffprotect\Dialogs\lib\jquery.min.js c:\users\Administrator\AppData\Roaming\SearchProtect\ffprotect\Dialogs\lib\json2.js c:\users\Administrator\AppData\Roaming\SearchProtect\ffprotect\Dialogs\spbd\bubble.css c:\users\Administrator\AppData\Roaming\SearchProtect\ffprotect\Dialogs\spbd\bubble.js c:\users\Administrator\AppData\Roaming\SearchProtect\ffprotect\Dialogs\spbd\images\information.png c:\users\Administrator\AppData\Roaming\SearchProtect\ffprotect\Dialogs\spbd\images\x-default-LTR.png c:\users\Administrator\AppData\Roaming\SearchProtect\ffprotect\Dialogs\spbd\images\x-default-RTL.png c:\users\Administrator\AppData\Roaming\SearchProtect\ffprotect\Dialogs\spbd\images\x-mouseover-LTR.png c:\users\Administrator\AppData\Roaming\SearchProtect\ffprotect\Dialogs\spbd\images\x-mouseover-RTL.png c:\users\Administrator\AppData\Roaming\SearchProtect\ffprotect\Dialogs\spbd\main.html c:\users\Administrator\AppData\Roaming\SearchProtect\ffprotect\Dialogs\spsd\images\ok-button.png c:\users\Administrator\AppData\Roaming\SearchProtect\ffprotect\Dialogs\spsd\images\separation-line.png c:\users\Administrator\AppData\Roaming\SearchProtect\ffprotect\Dialogs\spsd\images\warning.png c:\users\Administrator\AppData\Roaming\SearchProtect\ffprotect\Dialogs\spsd\main.html c:\users\Administrator\AppData\Roaming\SearchProtect\ffprotect\Dialogs\spsd\SearchProtector.css c:\users\Administrator\AppData\Roaming\SearchProtect\ffprotect\Dialogs\spsd\settings.js c:\users\Administrator\AppData\Roaming\SearchProtect\ffprotect\nsprotector.js c:\users\Administrator\AppData\Roaming\SearchProtect\ffprotect\popupTransparent.xul c:\users\Administrator\AppData\Roaming\SearchProtect\ffprotect\SProtectorRepository\EN c:\users\Administrator\AppData\Roaming\SearchProtect\ffprotect\SProtectorRepository\searchProtectorData . . ((((((((((((((((((((((((((((((((((((((( Drivers/Services ))))))))))))))))))))))))))))))))))))))))))))))))) . . -------\Service_CltMngSvc . . ((((((((((((((((((((((((( Files Created from 2013-06-18 to 2013-07-18 ))))))))))))))))))))))))))))))) . . 2013-07-18 10:03 . 2013-07-18 10:03 -------- d-----w- c:\users\Nyamuoch\AppData\Local\temp 2013-07-18 10:03 . 2013-07-18 10:03 -------- d-----w- c:\users\music\AppData\Local\temp 2013-07-18 10:03 . 2013-07-18 10:03 -------- d-----w- c:\users\Guest\AppData\Local\temp 2013-07-16 08:36 . 2013-07-02 08:34 9460976 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{4C9595A6-CF60-4371-8B54-424D2ACCD112}\mpengine.dll 2013-07-16 08:21 . 2013-07-16 08:21 -------- d-----w- c:\users\Administrator\AppData\Roaming\RealNetworks 2013-07-11 02:41 . 2013-04-10 05:46 1367040 ----a-w- c:\program files\Common Files\Microsoft Shared\ink\journal.dll 2013-07-11 02:40 . 2013-04-02 22:51 1643520 ----a-w- c:\windows\system32\DWrite.dll 2013-07-11 02:40 . 2013-04-09 23:34 1247744 ----a-w- c:\windows\SysWow64\DWrite.dll 2013-07-07 10:09 . 2013-07-07 10:09 -------- d-----w- c:\users\Administrator\AppData\Local\CRE 2013-07-06 22:33 . 2013-07-06 22:33 -------- d-----w- c:\program files (x86)\Mozilla Maintenance Service 2013-07-06 22:16 . 2013-07-06 22:16 -------- d-----w- c:\users\Administrator\AppData\Local\DriverTuner 2013-07-06 21:09 . 2013-07-06 21:09 -------- d-----w- c:\users\Administrator\AppData\Local\Cyberlink 2013-07-03 13:52 . 2013-03-19 05:53 48640 ----a-w- c:\windows\system32\wwanprotdim.dll 2013-07-03 13:52 . 2013-03-19 05:53 230400 ----a-w- c:\windows\system32\wwansvc.dll 2013-07-03 13:52 . 2013-04-17 06:24 1424384 ----a-w- c:\windows\system32\WindowsCodecs.dll 2013-07-03 13:52 . 2013-04-17 07:02 1230336 ----a-w- c:\windows\SysWow64\WindowsCodecs.dll 2013-07-03 13:52 . 2013-05-10 05:49 30720 ----a-w- c:\windows\system32\cryptdlg.dll 2013-07-03 13:52 . 2013-05-10 03:20 24576 ----a-w- c:\windows\SysWow64\cryptdlg.dll 2013-07-03 13:52 . 2013-03-31 22:52 1887232 ----a-w- c:\windows\system32\d3d11.dll 2013-07-03 13:52 . 2013-04-25 23:30 1505280 ----a-w- c:\windows\SysWow64\d3d11.dll 2013-07-01 03:58 . 2013-07-06 21:07 -------- d-----w- c:\users\Administrator\AppData\Roaming\CyberLink 2013-06-21 04:08 . 2013-06-21 14:30 -------- d-----w- c:\programdata\Malwarebytes' Anti-Malware (portable) 2013-06-19 02:03 . 2013-06-19 02:03 -------- d-----w- c:\program files (x86)\MGTEK 2013-06-19 02:03 . 2013-06-19 02:03 -------- d-----w- c:\program files (x86)\Common Files\MGTEK . . . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2013-07-11 06:55 . 2010-07-16 02:47 78185248 ----a-w- c:\windows\system32\MRT.exe 2013-07-07 07:36 . 2010-08-25 06:30 737072 ----a-w- c:\programdata\Microsoft\eHome\Packages\SportsV2\SportsTemplateCore-2\Microsoft.MediaCenter.Sports.UI.dll 2013-07-07 07:25 . 2010-08-25 06:29 2876528 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCEClientUX\UpdateableMarkup-2\markup.dll 2013-07-07 07:25 . 2010-08-25 06:29 42776 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCEClientUX\dSM-2\StartResources.dll 2013-07-07 07:25 . 2010-08-25 06:29 539984 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCESpotlight\MCESpotlight-2\SpotlightResources.dll 2013-07-02 01:37 . 2010-08-19 06:41 737072 ----a-w- c:\programdata\Microsoft\eHome\Packages\SportsV2\SportsTemplateCore\Microsoft.MediaCenter.Sports.UI.dll 2013-07-02 01:32 . 2010-08-19 06:41 2876528 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCEClientUX\UpdateableMarkup\markup.dll 2013-07-02 01:29 . 2010-08-19 06:40 42776 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCEClientUX\dSM\StartResources.dll 2013-07-02 01:29 . 2010-08-19 06:40 539984 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCESpotlight\MCESpotlight\SpotlightResources.dll 2013-06-13 03:57 . 2012-09-02 02:34 71048 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl 2013-06-13 03:57 . 2012-09-02 02:34 692104 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe 2013-05-27 16:29 . 2013-05-12 19:25 15712 ----a-w- c:\windows\system32\drivers\SWDUMon.sys 2013-05-15 03:47 . 2013-05-15 03:47 4167680 ----a-w- c:\program files (x86)\GUT8E94.tmp 2013-05-13 05:51 . 2013-06-12 14:15 184320 ----a-w- c:\windows\system32\cryptsvc.dll 2013-05-13 05:51 . 2013-06-12 14:15 1464320 ----a-w- c:\windows\system32\crypt32.dll 2013-05-13 05:51 . 2013-06-12 14:15 139776 ----a-w- c:\windows\system32\cryptnet.dll 2013-05-13 05:50 . 2013-06-12 14:15 52224 ----a-w- c:\windows\system32\certenc.dll 2013-05-13 04:45 . 2013-06-12 14:15 140288 ----a-w- c:\windows\SysWow64\cryptsvc.dll 2013-05-13 04:45 . 2013-06-12 14:15 1160192 ----a-w- c:\windows\SysWow64\crypt32.dll 2013-05-13 04:45 . 2013-06-12 14:15 103936 ----a-w- c:\windows\SysWow64\cryptnet.dll 2013-05-13 03:43 . 2013-06-12 14:15 1192448 ----a-w- c:\windows\system32\certutil.exe 2013-05-13 03:08 . 2013-06-12 14:15 903168 ----a-w- c:\windows\SysWow64\certutil.exe 2013-05-13 03:08 . 2013-06-12 14:15 43008 ----a-w- c:\windows\SysWow64\certenc.dll 2013-05-08 13:05 . 2013-05-08 13:05 1054720 ----a-w- c:\windows\system32\MsSpellCheckingFacility.exe 2013-05-08 13:05 . 2013-05-08 13:05 73728 ----a-w- c:\windows\SysWow64\SetIEInstalledDate.exe 2013-05-08 13:05 . 2013-05-08 13:05 719360 ----a-w- c:\windows\SysWow64\mshtmlmedia.dll 2013-05-08 13:05 . 2013-05-08 13:05 523264 ----a-w- c:\windows\SysWow64\vbscript.dll 2013-05-08 13:05 . 2013-05-08 13:05 48640 ----a-w- c:\windows\SysWow64\mshtmler.dll 2013-05-08 13:05 . 2013-05-08 13:05 38400 ----a-w- c:\windows\SysWow64\imgutil.dll 2013-05-08 13:05 . 2013-05-08 13:05 226304 ----a-w- c:\windows\system32\elshyph.dll 2013-05-08 13:05 . 2013-05-08 13:05 185344 ----a-w- c:\windows\SysWow64\elshyph.dll 2013-05-08 13:05 . 2013-05-08 13:05 158720 ----a-w- c:\windows\SysWow64\msls31.dll 2013-05-08 13:05 . 2013-05-08 13:05 150528 ----a-w- c:\windows\SysWow64\iexpress.exe 2013-05-08 13:05 . 2013-05-08 13:05 138752 ----a-w- c:\windows\SysWow64\wextract.exe 2013-05-08 13:05 . 2013-05-08 13:05 137216 ----a-w- c:\windows\SysWow64\ieUnatt.exe 2013-05-08 13:05 . 2013-05-08 13:05 12800 ----a-w- c:\windows\SysWow64\mshta.exe 2013-05-08 13:05 . 2013-05-08 13:05 110592 ----a-w- c:\windows\SysWow64\IEAdvpack.dll 2013-05-08 13:05 . 2013-05-08 13:05 905728 ----a-w- c:\windows\system32\mshtmlmedia.dll 2013-05-08 13:05 . 2013-05-08 13:05 81408 ----a-w- c:\windows\system32\icardie.dll 2013-05-08 13:05 . 2013-05-08 13:05 762368 ----a-w- c:\windows\system32\ieapfltr.dll 2013-05-08 13:05 . 2013-05-08 13:05 61952 ----a-w- c:\windows\SysWow64\tdc.ocx 2013-05-08 13:05 . 2013-05-08 13:05 452096 ----a-w- c:\windows\system32\dxtmsft.dll 2013-05-08 13:05 . 2013-05-08 13:05 441856 ----a-w- c:\windows\system32\html.iec 2013-05-08 13:05 . 2013-05-08 13:05 361984 ----a-w- c:\windows\SysWow64\html.iec 2013-05-08 13:05 . 2013-05-08 13:05 281600 ----a-w- c:\windows\system32\dxtrans.dll 2013-05-08 13:05 . 2013-05-08 13:05 270848 ----a-w- c:\windows\system32\iedkcs32.dll 2013-05-08 13:05 . 2013-05-08 13:05 235008 ----a-w- c:\windows\system32\url.dll 2013-05-08 13:05 . 2013-05-08 13:05 23040 ----a-w- c:\windows\SysWow64\licmgr10.dll 2013-05-08 13:05 . 2013-05-08 13:05 216064 ----a-w- c:\windows\system32\msls31.dll 2013-05-08 13:05 . 2013-05-08 13:05 197120 ----a-w- c:\windows\system32\msrating.dll 2013-05-08 13:05 . 2013-05-08 13:05 1441280 ----a-w- c:\windows\SysWow64\inetcpl.cpl 2013-05-08 13:05 . 2013-05-08 13:05 1400416 ----a-w- c:\windows\system32\ieapfltr.dat 2013-05-08 13:05 . 2013-05-08 13:05 1509376 ----a-w- c:\windows\system32\inetcpl.cpl 2013-05-08 13:05 . 2013-05-08 13:05 97280 ----a-w- c:\windows\system32\mshtmled.dll 2013-05-08 13:05 . 2013-05-08 13:05 92160 ----a-w- c:\windows\system32\SetIEInstalledDate.exe 2013-05-08 13:05 . 2013-05-08 13:05 77312 ----a-w- c:\windows\system32\tdc.ocx 2013-05-08 13:05 . 2013-05-08 13:05 62976 ----a-w- c:\windows\system32\pngfilt.dll 2013-05-08 13:05 . 2013-05-08 13:05 599552 ----a-w- c:\windows\system32\vbscript.dll 2013-05-08 13:05 . 2013-05-08 13:05 52224 ----a-w- c:\windows\system32\msfeedsbs.dll 2013-05-08 13:05 . 2013-05-08 13:05 51200 ----a-w- c:\windows\system32\imgutil.dll 2013-05-08 13:05 . 2013-05-08 13:05 48640 ----a-w- c:\windows\system32\mshtmler.dll 2013-05-08 13:05 . 2013-05-08 13:05 27648 ----a-w- c:\windows\system32\licmgr10.dll 2013-05-08 13:05 . 2013-05-08 13:05 247296 ----a-w- c:\windows\system32\webcheck.dll 2013-05-08 13:05 . 2013-05-08 13:05 173568 ----a-w- c:\windows\system32\ieUnatt.exe 2013-05-08 13:05 . 2013-05-08 13:05 167424 ----a-w- c:\windows\system32\iexpress.exe 2013-05-08 13:05 . 2013-05-08 13:05 149504 ----a-w- c:\windows\system32\occache.dll 2013-05-08 13:05 . 2013-05-08 13:05 144896 ----a-w- c:\windows\system32\wextract.exe 2013-05-08 13:05 . 2013-05-08 13:05 13824 ----a-w- c:\windows\system32\mshta.exe 2013-05-08 13:05 . 2013-05-08 13:05 136192 ----a-w- c:\windows\system32\iepeers.dll 2013-05-08 13:05 . 2013-05-08 13:05 135680 ----a-w- c:\windows\system32\IEAdvpack.dll 2013-05-08 13:05 . 2013-05-08 13:05 12800 ----a-w- c:\windows\system32\msfeedssync.exe 2013-05-08 13:05 . 2013-05-08 13:05 102912 ----a-w- c:\windows\system32\inseng.dll 2013-05-08 06:39 . 2013-06-12 14:15 1910632 ----a-w- c:\windows\system32\drivers\tcpip.sys 2013-05-08 06:10 . 2011-06-11 09:58 421200 ----a-w- c:\windows\SysWow64\msvcp100.dll 2013-05-02 10:06 . 2013-05-13 14:47 278800 ------w- c:\windows\system32\MpSigStub.exe 2013-05-01 11:59 . 2013-05-01 11:59 94208 ----a-w- c:\windows\SysWow64\QuickTimeVR.qtx 2013-05-01 11:59 . 2013-05-01 11:59 69632 ----a-w- c:\windows\SysWow64\QuickTime.qts 2013-04-26 05:51 . 2013-06-12 14:15 751104 ----a-w- c:\windows\system32\win32spl.dll 2013-04-26 04:55 . 2013-06-12 14:15 492544 ----a-w- c:\windows\SysWow64\win32spl.dll 2013-04-26 03:57 . 2010-01-29 14:38 29480 ----a-w- c:\windows\SysWow64\msxml3a.dll 2013-04-26 03:54 . 2013-04-26 03:55 95648 ----a-w- c:\windows\SysWow64\WindowsAccessBridge-32.dll 2013-04-26 03:54 . 2012-09-03 21:40 866720 ----a-w- c:\windows\SysWow64\npdeployJava1.dll 2013-04-26 03:54 . 2012-09-03 21:40 788896 ----a-w- c:\windows\SysWow64\deployJava1.dll . . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 . [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "HPADVISOR"="c:\program files (x86)\Hewlett-Packard\HP Advisor\HPAdvisor.exe" [2009-09-29 1685048] . [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] "QlbCtrl.exe"="c:\program files (x86)\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe" [2010-02-25 323640] "WirelessAssistant"="c:\program files (x86)\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe" [2010-03-23 500792] "APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2013-04-22 59720] "iTunesHelper"="c:\program files (x86)\iTunes\iTunesHelper.exe" [2013-05-31 152392] "TkBellExe"="c:\program files (x86)\Real\RealPlayer\update\realsched.exe" [2013-02-13 295072] "QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" [2013-05-01 421888] "AppleSyncNotifier"="c:\program files (x86)\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe" [2010-09-22 47904] "Adobe Reader Speed Launcher"="c:\program files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-28 35696] . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "ConsentPromptBehaviorUser"= 3 (0x3) "EnableUIADesktopToggle"= 0 (0x0) . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows] "LoadAppInit_DLLs"=1 (0x1) . [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager] BootExecute REG_MULTI_SZ autocheck autochk *\0\0sdnclean64.exe . [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys] @="Driver" HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe . R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x] R2 HP Support Assistant Service;HP Support Assistant Service;c:\program files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe;c:\program files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe [x] R2 SBSDWSCService;SBSD Security Center Service;c:\program files (x86)\Spybot - Search & Destroy\SDWinSec.exe;c:\program files (x86)\Spybot - Search & Destroy\SDWinSec.exe [x] R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe;c:\program files (x86)\Skype\Updater\Updater.exe [x] R3 GamesAppService;GamesAppService;c:\program files (x86)\WildTangent Games\App\GamesAppService.exe;c:\program files (x86)\WildTangent Games\App\GamesAppService.exe [x] R3 massfilter_hs;HS HandSet Mass Storage Filter Driver;c:\windows\system32\drivers\massfilter_hs.sys;c:\windows\SYSNATIVE\drivers\massfilter_hs.sys [x] R3 Netaapl;Apple Mobile Device Ethernet Service;c:\windows\system32\DRIVERS\netaapl64.sys;c:\windows\SYSNATIVE\DRIVERS\netaapl64.sys [x] R3 netw5v64;Intel® Wireless WiFi Link 5000 Series Adapter Driver for Windows Vista 64 Bit;c:\windows\system32\DRIVERS\netw5v64.sys;c:\windows\SYSNATIVE\DRIVERS\netw5v64.sys [x] R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys;c:\windows\SYSNATIVE\drivers\rdpvideominiport.sys [x] R3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;c:\windows\System32\Drivers\RtsUStor.sys;c:\windows\SYSNATIVE\Drivers\RtsUStor.sys [x] R3 RtsUIR;Realtek IR Driver;c:\windows\system32\DRIVERS\Rts516xIR.sys;c:\windows\SYSNATIVE\DRIVERS\Rts516xIR.sys [x] R3 SrvHsfHDA;SrvHsfHDA;c:\windows\system32\DRIVERS\VSTAZL6.SYS;c:\windows\SYSNATIVE\DRIVERS\VSTAZL6.SYS [x] R3 SrvHsfV92;SrvHsfV92;c:\windows\system32\DRIVERS\VSTDPV6.SYS;c:\windows\SYSNATIVE\DRIVERS\VSTDPV6.SYS [x] R3 SrvHsfWinac;SrvHsfWinac;c:\windows\system32\DRIVERS\VSTCNXT6.SYS;c:\windows\SYSNATIVE\DRIVERS\VSTCNXT6.SYS [x] R3 SWDUMon;SWDUMon;c:\windows\system32\DRIVERS\SWDUMon.sys;c:\windows\SYSNATIVE\DRIVERS\SWDUMon.sys [x] R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x] R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys;c:\windows\SYSNATIVE\Drivers\usbaapl64.sys [x] R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe;c:\windows\SYSNATIVE\Wat\WatAdminSvc.exe [x] R3 yukonw7;NDIS6.2 Miniport Driver for Marvell Yukon Ethernet Controller;c:\windows\system32\DRIVERS\yk62x64.sys;c:\windows\SYSNATIVE\DRIVERS\yk62x64.sys [x] R4 Com4QLBEx;Com4QLBEx;c:\program files (x86)\Hewlett-Packard\HP Quick Launch Buttons\Com4QLBEx.exe;c:\program files (x86)\Hewlett-Packard\HP Quick Launch Buttons\Com4QLBEx.exe [x] S2 HPDrvMntSvc.exe;HP Quick Synchronization Service;c:\program files (x86)\Hewlett-Packard\Shared\HPDrvMntSvc.exe;c:\program files (x86)\Hewlett-Packard\Shared\HPDrvMntSvc.exe [x] S2 HsfXAudioService;HsfXAudioService;c:\windows\system32\svchost.exe;c:\windows\SYSNATIVE\svchost.exe [x] S2 RealNetworks Downloader Resolver Service;RealNetworks Downloader Resolver Service;c:\program files (x86)\RealNetworks\RealDownloader\rndlresolversvc.exe;c:\program files (x86)\RealNetworks\RealDownloader\rndlresolversvc.exe [x] S3 CAXHWAZL;CAXHWAZL;c:\windows\system32\DRIVERS\CAXHWAZL.sys;c:\windows\SYSNATIVE\DRIVERS\CAXHWAZL.sys [x] S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys;c:\windows\SYSNATIVE\DRIVERS\Rt64win7.sys [x] . . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}] 2013-07-16 09:08 1173456 ----a-w- c:\program files (x86)\Google\Chrome\Application\28.0.1500.72\Installer\chrmstp.exe . Contents of the 'Scheduled Tasks' folder . 2013-07-18 c:\windows\Tasks\Adobe Flash Player Updater.job - c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-09-02 03:57] . 2013-07-18 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job - c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-05-24 11:59] . 2013-07-18 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job - c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-05-24 11:59] . 2013-07-17 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-820292111-1869468108-3859774255-1000Core.job - c:\users\Nyamuoch\AppData\Local\Google\Update\GoogleUpdate.exe [2012-10-13 22:36] . 2013-07-18 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-820292111-1869468108-3859774255-1000UA.job - c:\users\Nyamuoch\AppData\Local\Google\Update\GoogleUpdate.exe [2012-10-13 22:36] . 2013-07-08 c:\windows\Tasks\HPCeeScheduleForAdministrator.job - c:\program files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe [2010-09-14 03:15] . 2013-07-17 c:\windows\Tasks\ReclaimerUpdateFiles_Administrator.job - c:\users\Administrator\AppData\Roaming\Real\Update\UpgradeHelper\RealPlayer\10.50\agent\rnupgagent.exe [2013-07-06 21:23] . 2013-07-17 c:\windows\Tasks\ReclaimerUpdateXML_Administrator.job - c:\users\Administrator\AppData\Roaming\Real\Update\UpgradeHelper\RealPlayer\10.50\agent\rnupgagent.exe [2013-07-06 21:23] . 2013-07-18 c:\windows\Tasks\RNUpgradeHelperLogonPrompt_Administrator.job - c:\users\Administrator\AppData\Roaming\Real\Update\UpgradeHelper\RealPlayer\10.50\agent\rnupgagent.exe [2013-07-06 21:23] . . --------- X64 Entries ----------- . . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "IgfxTray"="c:\windows\system32\igfxtray.exe" [2010-08-26 161304] "HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2010-08-26 386584] "Persistence"="c:\windows\system32\igfxpers.exe" [2010-08-26 415256] "SynTPEnh"="c:\program files (x86)\Synaptics\SynTP\SynTPEnh.exe" [bU] "SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-11-01 171520] "cAudioFilterAgent"="c:\program files\Conexant\cAudioFilterAgent\cAudioFilterAgent64.exe" [2009-07-14 495104] . ------- Supplementary Scan ------- . uLocal Page = c:\windows\system32\blank.htm mLocal Page = c:\windows\SysWOW64\blank.htm IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200 IE: E&xport to Microsoft Excel - c:\progra~2\MICROS~4\Office12\EXCEL.EXE/3000 TCP: DhcpNameServer = 192.168.0.1 FF - ProfilePath - c:\users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\mmj39qj7.default\ FF - ExtSQL: 2013-05-27 19:14; {635abd67-4fe9-1b23-4f01-e679fa7484c1}; c:\users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\mmj39qj7.default\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1} FF - ExtSQL: 2013-05-27 19:44; {c0c9a2c7-2e5c-4447-bc53-97718bc91e1b}; c:\users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\mmj39qj7.default\extensions\{c0c9a2c7-2e5c-4447-bc53-97718bc91e1b}.xpi FF - ExtSQL: 2013-07-06 14:33; {ab91efd4-6975-4081-8552-1b3922ed79e2}; c:\users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\mmj39qj7.default\extensions\{ab91efd4-6975-4081-8552-1b3922ed79e2} . - - - - ORPHANS REMOVED - - - - . Toolbar-10 - (no file) AddRemove-RealPlayer 16.0 - c:\program files (x86)\real\realplayer\Update\r1puninst.exe AddRemove-SearchProtect - c:\program files (x86)\SearchProtect\bin\uninstall.exe AddRemove-{EE202411-2C26-49E8-9784-1BC1DBF7DE96} - c:\program files (x86)\InstallShield Installation Information\{EE202411-2C26-49E8-9784-1BC1DBF7DE96}\setup.exe . . . --------------------- LOCKED REGISTRY KEYS --------------------- . [HKEY_USERS\S-1-5-21-820292111-1869468108-3859774255-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.cda\UserChoice] @Denied: (2) (Administrator) "Progid"="WMP11.AssocFile.CDA" . [HKEY_USERS\S-1-5-21-820292111-1869468108-3859774255-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\UserChoice] @Denied: (2) (Administrator) "Progid"="ChromeHTML" . [HKEY_USERS\S-1-5-21-820292111-1869468108-3859774255-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\UserChoice] @Denied: (2) (Administrator) "Progid"="ChromeHTML" . [HKEY_USERS\S-1-5-21-820292111-1869468108-3859774255-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\UserChoice] @Denied: (2) (Administrator) "Progid"="ChromeHTML" . [HKEY_USERS\S-1-5-21-820292111-1869468108-3859774255-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\UserChoice] @Denied: (2) (Administrator) "Progid"="ChromeHTML" . [HKEY_USERS\S-1-5-21-820292111-1869468108-3859774255-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\UserChoice] @Denied: (2) (Administrator) "Progid"="ChromeHTML" . [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}] @Denied: (A 2) (Everyone) @="FlashBroker" "LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_7_700_224_ActiveX.exe,-101" . [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation] "Enabled"=dword:00000001 . [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32] @="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_7_700_224_ActiveX.exe" . [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" . [HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}] @Denied: (A 2) (Everyone) @="IFlashBroker5" . [HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32] @="{00020424-0000-0000-C000-000000000046}" . [HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" "Version"="1.0" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}] @Denied: (A 2) (Everyone) @="FlashBroker" "LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_7_700_224_ActiveX.exe,-101" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation] "Enabled"=dword:00000001 . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_7_700_224_ActiveX.exe" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}] @Denied: (A 2) (Everyone) @="Shockwave Flash Object" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_7_700_224.ocx" "ThreadingModel"="Apartment" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus] @="0" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID] @="ShockwaveFlash.ShockwaveFlash.11" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_7_700_224.ocx, 1" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib] @="{D27CDB6B-AE6D-11cf-96B8-444553540000}" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version] @="1.0" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID] @="ShockwaveFlash.ShockwaveFlash" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}] @Denied: (A 2) (Everyone) @="Macromedia Flash Factory Object" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_7_700_224.ocx" "ThreadingModel"="Apartment" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID] @="FlashFactory.FlashFactory.1" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_7_700_224.ocx, 1" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib] @="{D27CDB6B-AE6D-11cf-96B8-444553540000}" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version] @="1.0" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID] @="FlashFactory.FlashFactory" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}] @Denied: (A 2) (Everyone) @="IFlashBroker5" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32] @="{00020424-0000-0000-C000-000000000046}" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" "Version"="1.0" . [HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 . [HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security] @Denied: (Full) (Everyone) . ------------------------ Other Running Processes ------------------------ . c:\program files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe c:\program files (x86)\CyberLink\Shared files\RichVideo.exe c:\program files (x86)\Hewlett-Packard\Shared\hpqwmiex.exe . ************************************************************************** . Completion time: 2013-07-18 02:11:42 - machine was rebooted ComboFix-quarantined-files.txt 2013-07-18 10:11 ComboFix2.txt 2013-07-18 09:37 ComboFix3.txt 2013-07-18 08:21 . Pre-Run: 143,333,924,864 bytes free Post-Run: 142,778,712,064 bytes free . - - End Of File - - D5314C82BA1B1D329B6DF921A5459D0D AEE357D355D7F06DFEC420A755C0B947
  14. justime
    Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.1979.937 [GMT -8:00] Running from: c:\users\Administrator\Downloads\ComboFix.exeSP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}..((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))..c:\users\Nyamuoch\Documents\~WRL0585.tmp..((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))..-------\Service_AudioSrv..((((((((((((((((((((((((( Files Created from 2013-06-18 to 2013-07-18 )))))))))))))))))))))))))))))))..2013-07-18 07:31 . 2013-07-18 07:31 -------- d-----w- c:\users\Nyamuoch\AppData\Local\temp2013-07-18 07:31 . 2013-07-18 07:31 -------- d-----w- c:\users\music\AppData\Local\temp2013-07-18 07:31 . 2013-07-18 07:31 -------- d-----w- c:\users\Guest\AppData\Local\temp2013-07-18 07:31 . 2013-07-18 07:31 -------- d-----w- c:\users\Default\AppData\Local\temp2013-07-16 08:36 . 2013-07-02 08:34 9460976 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{4C9595A6-CF60-4371-8B54-424D2ACCD112}\mpengine.dll2013-07-16 08:21 . 2013-07-16 08:21 -------- d-----w- c:\users\Administrator\AppData\Roaming\RealNetworks2013-07-11 02:41 . 2013-04-10 05:46 1367040 ----a-w- c:\program files\Common Files\Microsoft Shared\ink\journal.dll2013-07-11 02:40 . 2013-04-02 22:51 1643520 ----a-w- c:\windows\system32\DWrite.dll2013-07-11 02:40 . 2013-04-09 23:34 1247744 ----a-w- c:\windows\SysWow64\DWrite.dll2013-07-07 10:09 . 2013-07-07 10:10 -------- d-----w- c:\program files (x86)\SearchProtect2013-07-07 10:09 . 2013-07-07 10:12 -------- d-----w- c:\users\Administrator\AppData\Roaming\SearchProtect2013-07-07 10:09 . 2013-07-07 10:09 -------- d-----w- c:\users\Administrator\AppData\Local\CRE2013-07-06 22:33 . 2013-07-06 22:33 -------- d-----w- c:\program files (x86)\Mozilla Maintenance Service2013-07-06 22:16 . 2013-07-06 22:16 -------- d-----w- c:\users\Administrator\AppData\Local\DriverTuner2013-07-06 21:09 . 2013-07-06 21:09 -------- d-----w- c:\users\Administrator\AppData\Local\Cyberlink2013-07-03 13:52 . 2013-03-19 05:53 48640 ----a-w- c:\windows\system32\wwanprotdim.dll2013-07-03 13:52 . 2013-03-19 05:53 230400 ----a-w- c:\windows\system32\wwansvc.dll2013-07-03 13:52 . 2013-04-17 06:24 1424384 ----a-w- c:\windows\system32\WindowsCodecs.dll2013-07-03 13:52 . 2013-04-17 07:02 1230336 ----a-w- c:\windows\SysWow64\WindowsCodecs.dll2013-07-03 13:52 . 2013-05-10 05:49 30720 ----a-w- c:\windows\system32\cryptdlg.dll2013-07-03 13:52 . 2013-05-10 03:20 24576 ----a-w- c:\windows\SysWow64\cryptdlg.dll2013-07-03 13:52 . 2013-03-31 22:52 1887232 ----a-w- c:\windows\system32\d3d11.dll2013-07-03 13:52 . 2013-04-25 23:30 1505280 ----a-w- c:\windows\SysWow64\d3d11.dll2013-07-01 03:58 . 2013-07-06 21:07 -------- d-----w- c:\users\Administrator\AppData\Roaming\CyberLink2013-06-21 04:08 . 2013-06-21 14:30 -------- d-----w- c:\programdata\Malwarebytes' Anti-Malware (portable)2013-06-19 02:03 . 2013-06-19 02:03 -------- d-----w- c:\program files (x86)\MGTEK2013-06-19 02:03 . 2013-06-19 02:03 -------- d-----w- c:\program files (x86)\Common Files\MGTEK...(((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))).2013-07-11 06:55 . 2010-07-16 02:47 78185248 ----a-w- c:\windows\system32\MRT.exe2013-07-07 07:36 . 2010-08-25 06:30 737072 ----a-w- c:\programdata\Microsoft\eHome\Packages\SportsV2\SportsTemplateCore-2\Microsoft.MediaCenter.Sports.UI.dll2013-07-07 07:25 . 2010-08-25 06:29 2876528 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCEClientUX\UpdateableMarkup-2\markup.dll2013-07-07 07:25 . 2010-08-25 06:29 42776 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCEClientUX\dSM-2\StartResources.dll2013-07-07 07:25 . 2010-08-25 06:29 539984 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCESpotlight\MCESpotlight-2\SpotlightResources.dll2013-07-02 01:37 . 2010-08-19 06:41 737072 ----a-w- c:\programdata\Microsoft\eHome\Packages\SportsV2\SportsTemplateCore\Microsoft.MediaCenter.Sports.UI.dll2013-07-02 01:32 . 2010-08-19 06:41 2876528 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCEClientUX\UpdateableMarkup\markup.dll2013-07-02 01:29 . 2010-08-19 06:40 42776 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCEClientUX\dSM\StartResources.dll2013-07-02 01:29 . 2010-08-19 06:40 539984 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCESpotlight\MCESpotlight\SpotlightResources.dll2013-06-13 03:57 . 2012-09-02 02:34 71048 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl2013-06-13 03:57 . 2012-09-02 02:34 692104 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe2013-05-27 16:29 . 2013-05-12 19:25 15712 ----a-w- c:\windows\system32\drivers\SWDUMon.sys2013-05-15 03:47 . 2013-05-15 03:47 4167680 ----a-w- c:\program files (x86)\GUT8E94.tmp2013-05-13 05:51 . 2013-06-12 14:15 184320 ----a-w- c:\windows\system32\cryptsvc.dll2013-05-13 05:51 . 2013-06-12 14:15 1464320 ----a-w- c:\windows\system32\crypt32.dll2013-05-13 05:51 . 2013-06-12 14:15 139776 ----a-w- c:\windows\system32\cryptnet.dll2013-05-13 05:50 . 2013-06-12 14:15 52224 ----a-w- c:\windows\system32\certenc.dll2013-05-13 04:45 . 2013-06-12 14:15 140288 ----a-w- c:\windows\SysWow64\cryptsvc.dll2013-05-13 04:45 . 2013-06-12 14:15 1160192 ----a-w- c:\windows\SysWow64\crypt32.dll2013-05-13 04:45 . 2013-06-12 14:15 103936 ----a-w- c:\windows\SysWow64\cryptnet.dll2013-05-13 03:43 . 2013-06-12 14:15 1192448 ----a-w- c:\windows\system32\certutil.exe2013-05-13 03:08 . 2013-06-12 14:15 903168 ----a-w- c:\windows\SysWow64\certutil.exe2013-05-13 03:08 . 2013-06-12 14:15 43008 ----a-w- c:\windows\SysWow64\certenc.dll2013-05-08 13:05 . 2013-05-08 13:05 1054720 ----a-w- c:\windows\system32\MsSpellCheckingFacility.exe2013-05-08 13:05 . 2013-05-08 13:05 73728 ----a-w- c:\windows\SysWow64\SetIEInstalledDate.exe2013-05-08 13:05 . 2013-05-08 13:05 719360 ----a-w- c:\windows\SysWow64\mshtmlmedia.dll2013-05-08 13:05 . 2013-05-08 13:05 523264 ----a-w- c:\windows\SysWow64\vbscript.dll2013-05-08 13:05 . 2013-05-08 13:05 48640 ----a-w- c:\windows\SysWow64\mshtmler.dll2013-05-08 13:05 . 2013-05-08 13:05 38400 ----a-w- c:\windows\SysWow64\imgutil.dll2013-05-08 13:05 . 2013-05-08 13:05 226304 ----a-w- c:\windows\system32\elshyph.dll2013-05-08 13:05 . 2013-05-08 13:05 185344 ----a-w- c:\windows\SysWow64\elshyph.dll2013-05-08 13:05 . 2013-05-08 13:05 158720 ----a-w- c:\windows\SysWow64\msls31.dll2013-05-08 13:05 . 2013-05-08 13:05 150528 ----a-w- c:\windows\SysWow64\iexpress.exe2013-05-08 13:05 . 2013-05-08 13:05 138752 ----a-w- c:\windows\SysWow64\wextract.exe2013-05-08 13:05 . 2013-05-08 13:05 137216 ----a-w- c:\windows\SysWow64\ieUnatt.exe2013-05-08 13:05 . 2013-05-08 13:05 12800 ----a-w- c:\windows\SysWow64\mshta.exe2013-05-08 13:05 . 2013-05-08 13:05 110592 ----a-w- c:\windows\SysWow64\IEAdvpack.dll2013-05-08 13:05 . 2013-05-08 13:05 905728 ----a-w- c:\windows\system32\mshtmlmedia.dll2013-05-08 13:05 . 2013-05-08 13:05 81408 ----a-w- c:\windows\system32\icardie.dll2013-05-08 13:05 . 2013-05-08 13:05 762368 ----a-w- c:\windows\system32\ieapfltr.dll2013-05-08 13:05 . 2013-05-08 13:05 61952 ----a-w- c:\windows\SysWow64\tdc.ocx2013-05-08 13:05 . 2013-05-08 13:05 452096 ----a-w- c:\windows\system32\dxtmsft.dll2013-05-08 13:05 . 2013-05-08 13:05 441856 ----a-w- c:\windows\system32\html.iec2013-05-08 13:05 . 2013-05-08 13:05 361984 ----a-w- c:\windows\SysWow64\html.iec2013-05-08 13:05 . 2013-05-08 13:05 281600 ----a-w- c:\windows\system32\dxtrans.dll2013-05-08 13:05 . 2013-05-08 13:05 270848 ----a-w- c:\windows\system32\iedkcs32.dll2013-05-08 13:05 . 2013-05-08 13:05 235008 ----a-w- c:\windows\system32\url.dll2013-05-08 13:05 . 2013-05-08 13:05 23040 ----a-w- c:\windows\SysWow64\licmgr10.dll2013-05-08 13:05 . 2013-05-08 13:05 216064 ----a-w- c:\windows\system32\msls31.dll2013-05-08 13:05 . 2013-05-08 13:05 197120 ----a-w- c:\windows\system32\msrating.dll2013-05-08 13:05 . 2013-05-08 13:05 1441280 ----a-w- c:\windows\SysWow64\inetcpl.cpl2013-05-08 13:05 . 2013-05-08 13:05 1400416 ----a-w- c:\windows\system32\ieapfltr.dat2013-05-08 13:05 . 2013-05-08 13:05 1509376 ----a-w- c:\windows\system32\inetcpl.cpl2013-05-08 13:05 . 2013-05-08 13:05 97280 ----a-w- c:\windows\system32\mshtmled.dll2013-05-08 13:05 . 2013-05-08 13:05 92160 ----a-w- c:\windows\system32\SetIEInstalledDate.exe2013-05-08 13:05 . 2013-05-08 13:05 77312 ----a-w- c:\windows\system32\tdc.ocx2013-05-08 13:05 . 2013-05-08 13:05 62976 ----a-w- c:\windows\system32\pngfilt.dll2013-05-08 13:05 . 2013-05-08 13:05 599552 ----a-w- c:\windows\system32\vbscript.dll2013-05-08 13:05 . 2013-05-08 13:05 52224 ----a-w- c:\windows\system32\msfeedsbs.dll2013-05-08 13:05 . 2013-05-08 13:05 51200 ----a-w- c:\windows\system32\imgutil.dll2013-05-08 13:05 . 2013-05-08 13:05 48640 ----a-w- c:\windows\system32\mshtmler.dll2013-05-08 13:05 . 2013-05-08 13:05 27648 ----a-w- c:\windows\system32\licmgr10.dll2013-05-08 13:05 . 2013-05-08 13:05 247296 ----a-w- c:\windows\system32\webcheck.dll2013-05-08 13:05 . 2013-05-08 13:05 173568 ----a-w- c:\windows\system32\ieUnatt.exe2013-05-08 13:05 . 2013-05-08 13:05 167424 ----a-w- c:\windows\system32\iexpress.exe2013-05-08 13:05 . 2013-05-08 13:05 149504 ----a-w- c:\windows\system32\occache.dll2013-05-08 13:05 . 2013-05-08 13:05 144896 ----a-w- c:\windows\system32\wextract.exe2013-05-08 13:05 . 2013-05-08 13:05 13824 ----a-w- c:\windows\system32\mshta.exe2013-05-08 13:05 . 2013-05-08 13:05 136192 ----a-w- c:\windows\system32\iepeers.dll2013-05-08 13:05 . 2013-05-08 13:05 135680 ----a-w- c:\windows\system32\IEAdvpack.dll2013-05-08 13:05 . 2013-05-08 13:05 12800 ----a-w- c:\windows\system32\msfeedssync.exe2013-05-08 13:05 . 2013-05-08 13:05 102912 ----a-w- c:\windows\system32\inseng.dll2013-05-08 06:39 . 2013-06-12 14:15 1910632 ----a-w- c:\windows\system32\drivers\tcpip.sys2013-05-08 06:10 . 2011-06-11 09:58 421200 ----a-w- c:\windows\SysWow64\msvcp100.dll2013-05-02 10:06 . 2013-05-13 14:47 278800 ------w- c:\windows\system32\MpSigStub.exe2013-05-01 11:59 . 2013-05-01 11:59 94208 ----a-w- c:\windows\SysWow64\QuickTimeVR.qtx2013-05-01 11:59 . 2013-05-01 11:59 69632 ----a-w- c:\windows\SysWow64\QuickTime.qts2013-04-26 05:51 . 2013-06-12 14:15 751104 ----a-w- c:\windows\system32\win32spl.dll2013-04-26 04:55 . 2013-06-12 14:15 492544 ----a-w- c:\windows\SysWow64\win32spl.dll2013-04-26 03:57 . 2010-01-29 14:38 29480 ----a-w- c:\windows\SysWow64\msxml3a.dll2013-04-26 03:54 . 2013-04-26 03:55 95648 ----a-w- c:\windows\SysWow64\WindowsAccessBridge-32.dll2013-04-26 03:54 . 2012-09-03 21:40 866720 ----a-w- c:\windows\SysWow64\npdeployJava1.dll2013-04-26 03:54 . 2012-09-03 21:40 788896 ----a-w- c:\windows\SysWow64\deployJava1.dll..((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))..*Note* empty entries & legit default entries are not shown REGEDIT4.[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]"SearchProtect"="c:\users\Administrator\AppData\Roaming\SearchProtect\bin\cltmng.exe" [2013-05-08 2852640]"HPADVISOR"="c:\program files (x86)\Hewlett-Packard\HP Advisor\HPAdvisor.exe" [2009-09-29 1685048].[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]"QlbCtrl.exe"="c:\program files (x86)\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe" [2010-02-25 323640]"WirelessAssistant"="c:\program files (x86)\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe" [2010-03-23 500792]"APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2013-04-22 59720]"iTunesHelper"="c:\program files (x86)\iTunes\iTunesHelper.exe" [2013-05-31 152392]"TkBellExe"="c:\program files (x86)\Real\RealPlayer\update\realsched.exe" [2013-02-13 295072]"SearchProtectAll"="c:\program files (x86)\SearchProtect\bin\cltmng.exe" [2013-05-08 2852640]"QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" [2013-05-01 421888]"AppleSyncNotifier"="c:\program files (x86)\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe" [2010-09-22 47904]"Adobe Reader Speed Launcher"="c:\program files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-28 35696].[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]"ConsentPromptBehaviorUser"= 3 (0x3)"EnableUIADesktopToggle"= 0 (0x0).[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]"LoadAppInit_DLLs"=1 (0x1).[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]BootExecute REG_MULTI_SZ autocheck autochk *\0\0sdnclean64.exe.[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]@="Driver"HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software UpdateHKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe.R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]R2 SBSDWSCService;SBSD Security Center Service;c:\program files (x86)\Spybot - Search & Destroy\SDWinSec.exe;c:\program files (x86)\Spybot - Search & Destroy\SDWinSec.exe [x]R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe;c:\program files (x86)\Skype\Updater\Updater.exe [x]R3 GamesAppService;GamesAppService;c:\program files (x86)\WildTangent Games\App\GamesAppService.exe;c:\program files (x86)\WildTangent Games\App\GamesAppService.exe [x]R3 massfilter_hs;HS HandSet Mass Storage Filter Driver;c:\windows\system32\drivers\massfilter_hs.sys;c:\windows\SYSNATIVE\drivers\massfilter_hs.sys [x]R3 Netaapl;Apple Mobile Device Ethernet Service;c:\windows\system32\DRIVERS\netaapl64.sys;c:\windows\SYSNATIVE\DRIVERS\netaapl64.sys [x]R3 netw5v64;Intel® Wireless WiFi Link 5000 Series Adapter Driver for Windows Vista 64 Bit;c:\windows\system32\DRIVERS\netw5v64.sys;c:\windows\SYSNATIVE\DRIVERS\netw5v64.sys [x]R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys;c:\windows\SYSNATIVE\drivers\rdpvideominiport.sys [x]R3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;c:\windows\System32\Drivers\RtsUStor.sys;c:\windows\SYSNATIVE\Drivers\RtsUStor.sys [x]R3 RtsUIR;Realtek IR Driver;c:\windows\system32\DRIVERS\Rts516xIR.sys;c:\windows\SYSNATIVE\DRIVERS\Rts516xIR.sys [x]R3 SrvHsfHDA;SrvHsfHDA;c:\windows\system32\DRIVERS\VSTAZL6.SYS;c:\windows\SYSNATIVE\DRIVERS\VSTAZL6.SYS [x]R3 SrvHsfV92;SrvHsfV92;c:\windows\system32\DRIVERS\VSTDPV6.SYS;c:\windows\SYSNATIVE\DRIVERS\VSTDPV6.SYS [x]R3 SrvHsfWinac;SrvHsfWinac;c:\windows\system32\DRIVERS\VSTCNXT6.SYS;c:\windows\SYSNATIVE\DRIVERS\VSTCNXT6.SYS [x]R3 SWDUMon;SWDUMon;c:\windows\system32\DRIVERS\SWDUMon.sys;c:\windows\SYSNATIVE\DRIVERS\SWDUMon.sys [x]R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys;c:\windows\SYSNATIVE\Drivers\usbaapl64.sys [x]R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe;c:\windows\SYSNATIVE\Wat\WatAdminSvc.exe [x]R3 yukonw7;NDIS6.2 Miniport Driver for Marvell Yukon Ethernet Controller;c:\windows\system32\DRIVERS\yk62x64.sys;c:\windows\SYSNATIVE\DRIVERS\yk62x64.sys [x]R4 CltMngSvc;Search Protect by Conduit Updater;c:\program files (x86)\SearchProtect\bin\CltMngSvc.exe;c:\program files (x86)\SearchProtect\bin\CltMngSvc.exe [x]R4 Com4QLBEx;Com4QLBEx;c:\program files (x86)\Hewlett-Packard\HP Quick Launch Buttons\Com4QLBEx.exe;c:\program files (x86)\Hewlett-Packard\HP Quick Launch Buttons\Com4QLBEx.exe [x]S2 HP Support Assistant Service;HP Support Assistant Service;c:\program files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe;c:\program files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe [x]S2 HPDrvMntSvc.exe;HP Quick Synchronization Service;c:\program files (x86)\Hewlett-Packard\Shared\HPDrvMntSvc.exe;c:\program files (x86)\Hewlett-Packard\Shared\HPDrvMntSvc.exe [x]S2 HsfXAudioService;HsfXAudioService;c:\windows\system32\svchost.exe;c:\windows\SYSNATIVE\svchost.exe [x]S2 RealNetworks Downloader Resolver Service;RealNetworks Downloader Resolver Service;c:\program files (x86)\RealNetworks\RealDownloader\rndlresolversvc.exe;c:\program files (x86)\RealNetworks\RealDownloader\rndlresolversvc.exe [x]S3 CAXHWAZL;CAXHWAZL;c:\windows\system32\DRIVERS\CAXHWAZL.sys;c:\windows\SYSNATIVE\DRIVERS\CAXHWAZL.sys [x]S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys;c:\windows\SYSNATIVE\DRIVERS\Rt64win7.sys [x]..--- Other Services/Drivers In Memory ---.*NewlyCreated* - WS2IFSL.[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]2013-07-16 09:08 1173456 ----a-w- c:\program files (x86)\Google\Chrome\Application\28.0.1500.72\Installer\chrmstp.exe.Contents of the 'Scheduled Tasks' folder.2013-07-18 c:\windows\Tasks\Adobe Flash Player Updater.job- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-09-02 03:57].2013-07-18 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-05-24 11:59].2013-07-18 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-05-24 11:59].2013-07-17 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-820292111-1869468108-3859774255-1000Core.job- c:\users\Nyamuoch\AppData\Local\Google\Update\GoogleUpdate.exe [2012-10-13 22:36].2013-07-18 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-820292111-1869468108-3859774255-1000UA.job- c:\users\Nyamuoch\AppData\Local\Google\Update\GoogleUpdate.exe [2012-10-13 22:36].2013-07-08 c:\windows\Tasks\HPCeeScheduleForAdministrator.job- c:\program files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe [2010-09-14 03:15].2013-07-17 c:\windows\Tasks\ReclaimerUpdateFiles_Administrator.job- c:\users\Administrator\AppData\Roaming\Real\Update\UpgradeHelper\RealPlayer\10.50\agent\rnupgagent.exe [2013-07-06 21:23].2013-07-17 c:\windows\Tasks\ReclaimerUpdateXML_Administrator.job- c:\users\Administrator\AppData\Roaming\Real\Update\UpgradeHelper\RealPlayer\10.50\agent\rnupgagent.exe [2013-07-06 21:23].2013-07-18 c:\windows\Tasks\RNUpgradeHelperLogonPrompt_Administrator.job- c:\users\Administrator\AppData\Roaming\Real\Update\UpgradeHelper\RealPlayer\10.50\agent\rnupgagent.exe [2013-07-06 21:23]..--------- X64 Entries -----------..[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]"IgfxTray"="c:\windows\system32\igfxtray.exe" [2010-08-26 161304]"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2010-08-26 386584]"Persistence"="c:\windows\system32\igfxpers.exe" [2010-08-26 415256]"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-11-01 171520]"cAudioFilterAgent"="c:\program files\Conexant\cAudioFilterAgent\cAudioFilterAgent64.exe" [2009-07-14 495104].------- Supplementary Scan -------.uLocal Page = c:\windows\system32\blank.htmmLocal Page = c:\windows\SysWOW64\blank.htmIE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200IE: E&xport to Microsoft Excel - c:\progra~2\MICROS~4\Office12\EXCEL.EXE/3000TCP: DhcpNameServer = 192.168.0.1FF - ProfilePath - c:\users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\mmj39qj7.default\FF - prefs.js: browser.search.selectedEngine - Search ResultsFF - ExtSQL: 2013-05-27 19:14; {635abd67-4fe9-1b23-4f01-e679fa7484c1}; c:\users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\mmj39qj7.default\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}FF - ExtSQL: 2013-05-27 19:44; {c0c9a2c7-2e5c-4447-bc53-97718bc91e1b}; c:\users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\mmj39qj7.default\extensions\{c0c9a2c7-2e5c-4447-bc53-97718bc91e1b}.xpiFF - ExtSQL: 2013-07-06 14:33; {ab91efd4-6975-4081-8552-1b3922ed79e2}; c:\users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\mmj39qj7.default\extensions\{ab91efd4-6975-4081-8552-1b3922ed79e2}.- - - - ORPHANS REMOVED - - - -.Toolbar-10 - (no file)Wow6432Node-HKLM-Run-vProt - c:\program files (x86)\AVG Secure Search\vprot.exeWow6432Node-HKLM-Run-OtShot - c:\program files (x86)\OtShot\otshot.exeWow6432Node-HKLM-Run-DivX Download Manager - c:\program files (x86)\DivX\DivX Plus Web Player\DDmService.exeWow6432Node-HKLM-Run-ccApp - c:\program files (x86)\Common Files\Symantec Shared\ccApp.exeWow6432Node-HKLM-Run-BingDesktop - c:\program files (x86)\Microsoft\BingDesktop\BingDesktop.exeWow6432Node-HKLM-Run-ApnUpdater - c:\program files (x86)\Ask.com\Updater\Updater.exeWow6432Node-HKLM-Run-(default) - (no file)c:\users\Guest\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LimeWire On Startup.lnk - c:\program files (x86)\LimeWire\LimeWire.exe -startupc:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk - c:\program files (x86)\McAfee Security Scan\3.0.318\SSScheduler.exeHKLM_Wow6432Node-ActiveSetup-{2D46B6DC-2207-486B-B523-A557E6D54B47} - startToolbar-10 - (no file)HKLM-Run-SynTPEnh - c:\program files (x86)\Synaptics\SynTP\SynTPEnh.exeAddRemove-RealPlayer 16.0 - c:\program files (x86)\real\realplayer\Update\r1puninst.exeAddRemove-{EE202411-2C26-49E8-9784-1BC1DBF7DE96} - c:\program files (x86)\InstallShield Installation Information\{EE202411-2C26-49E8-9784-1BC1DBF7DE96}\setup.exe...--------------------- LOCKED REGISTRY KEYS ---------------------.[HKEY_USERS\S-1-5-21-820292111-1869468108-3859774255-500\Software\Microsoft\Internet Explorer\Approved Extensions]@Denied: (2) (Administrator)"{74322BF9-DF26-493F-B0DA-6D2FC5E6429E}"=hex:51,66,7a,6c,4c,1d,3b,1b,e9,3d,22, 6d,13,85,52,05,ad,d0,32,73,cd,a3,0e,86.[HKEY_USERS\S-1-5-21-820292111-1869468108-3859774255-500\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration]@Denied: (2) (Administrator)"Timestamp"=hex:02,d7,ab,3d,0b,4c,ce,01.[HKEY_USERS\S-1-5-21-820292111-1869468108-3859774255-500\Software\Microsoft\Internet Explorer\User Preferences]@Denied: (2) (Administrator)"88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15, d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,d8,ba,98,43,55,c3,13,47,b0,ee,ce,\"2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=hex:01,00,00,00,d0,8c,9d,df,01,15, d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,d8,ba,98,43,55,c3,13,47,b0,ee,ce,\.[HKEY_USERS\S-1-5-21-820292111-1869468108-3859774255-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.cda\UserChoice]@Denied: (2) (Administrator)"Progid"="WMP11.AssocFile.CDA".[HKEY_USERS\S-1-5-21-820292111-1869468108-3859774255-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\UserChoice]@Denied: (2) (Administrator)"Progid"="ChromeHTML".[HKEY_USERS\S-1-5-21-820292111-1869468108-3859774255-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\UserChoice]@Denied: (2) (Administrator)"Progid"="ChromeHTML".[HKEY_USERS\S-1-5-21-820292111-1869468108-3859774255-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\UserChoice]@Denied: (2) (Administrator)"Progid"="ChromeHTML".[HKEY_USERS\S-1-5-21-820292111-1869468108-3859774255-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\UserChoice]@Denied: (2) (Administrator)"Progid"="ChromeHTML".[HKEY_USERS\S-1-5-21-820292111-1869468108-3859774255-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\UserChoice]@Denied: (2) (Administrator)"Progid"="ChromeHTML".[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]@Denied: (A 2) (Everyone)@="FlashBroker""LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_7_700_224_ActiveX.exe,-101".[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]"Enabled"=dword:00000001.[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_7_700_224_ActiveX.exe".[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}".[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]@Denied: (A 2) (Everyone)@="IFlashBroker5".[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]@="{00020424-0000-0000-C000-000000000046}".[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}""Version"="1.0".[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]@Denied: (A 2) (Everyone)@="FlashBroker""LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_7_700_224_ActiveX.exe,-101".[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]"Enabled"=dword:00000001.[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_7_700_224_ActiveX.exe".[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}".[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]@Denied: (A 2) (Everyone)@="Shockwave Flash Object".[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_7_700_224.ocx""ThreadingModel"="Apartment".[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]@="0".[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]@="ShockwaveFlash.ShockwaveFlash.11".[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_7_700_224.ocx, 1".[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]@="{D27CDB6B-AE6D-11cf-96B8-444553540000}".[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]@="1.0".[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]@="ShockwaveFlash.ShockwaveFlash".[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]@Denied: (A 2) (Everyone)@="Macromedia Flash Factory Object".[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_7_700_224.ocx""ThreadingModel"="Apartment".[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]@="FlashFactory.FlashFactory.1".[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_7_700_224.ocx, 1".[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]@="{D27CDB6B-AE6D-11cf-96B8-444553540000}".[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]@="1.0".[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]@="FlashFactory.FlashFactory".[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]@Denied: (A 2) (Everyone)@="IFlashBroker5".[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]@="{00020424-0000-0000-C000-000000000046}".[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}""Version"="1.0".[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]@Denied: (A) (Users)@Denied: (A) (Everyone)@Allowed: (B 1 2 3 4 5) (S-1-5-20)"BlindDial"=dword:00000000.[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]@Denied: (Full) (Everyone).------------------------ Other Running Processes ------------------------.c:\program files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exec:\program files (x86)\CyberLink\Shared files\RichVideo.exec:\program files (x86)\Hewlett-Packard\Shared\hpqwmiex.exe.**************************************************************************.Completion time: 2013-07-18 00:21:02 - machine was rebootedComboFix-quarantined-files.txt 2013-07-18 08:21.Pre-Run: 139,009,638,400 bytes freePost-Run: 140,129,120,256 bytes free.- - End Of File - - 53D4A969FF56EF508D431D89550B4C21AEE357D355D7F06DFEC420A755C0B947
  15. justime
    i have been trying to fix this myself and it just seems to be getting worse... that being said this is some of the problems i am having . i had a friend use my computer for a time and somehow he installed some thing called bearshare or something like that and it changed all my homepages in all my browsers and now i cannot move music files from windows media to itunes in the directory OR access the directory at all.(i can view it but cannot open many things i used to be able to) i have all these little locks on my file icons and my cpu usage is at 100% a lot of the time.i have my file options set to show all hidden files and folders but i still cannot access the files that i need to . I am the administrator i know that i tried to get it fixed through you a few weeks ago but i am very busy with work ... my schedule has changed and i do not go to work tell noon so i have a little more time now. here is the scans that you asked for before i think i really hope this is right ark.txt Extras.Txt OTL.Txt system-log.txt
  16. justime
    GMER 2.1.19163 - http://www.gmer.net Rootkit scan 2013-06-19 20:59:18 Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-0 Hitachi_HTS725025A9A364 rev.PC2OC70E 232.89GB Running: rxmikr9j.exe; Driver: C:\Users\ADMINI~1\AppData\Local\Temp\pxtcrpow.sys ---- Threads - GMER 2.1 ---- Thread C:\Windows\System32\svchost.exe [948:1152] 000007fefa1459a0 Thread C:\Windows\System32\svchost.exe [948:1204] 000007fefc971a70 Thread C:\Windows\System32\svchost.exe [948:2884] 000007fef93e88f8 Thread C:\Windows\System32\svchost.exe [948:2992] 000007fef8e544e0 Thread C:\Windows\System32\svchost.exe [948:2560] 000007feef4f5fd0 Thread C:\Windows\System32\svchost.exe [948:1996] 000007feef4f63ec Thread C:\Windows\System32\svchost.exe [948:2620] 000007fef2e942c8 Thread C:\Windows\system32\svchost.exe [972:1044] 000007fef8350ea8 Thread C:\Windows\system32\svchost.exe [972:944] 000007fef8349db0 Thread C:\Windows\system32\svchost.exe [972:2056] 000007fef834aa10 Thread C:\Windows\system32\svchost.exe [972:2088] 000007fef8351c94 Thread C:\Windows\system32\svchost.exe [972:3300] 000007fef36ad3c8 Thread C:\Windows\system32\svchost.exe [972:3304] 000007fef36ad3c8 Thread C:\Windows\system32\svchost.exe [972:3308] 000007fef36ad3c8 Thread C:\Windows\system32\svchost.exe [972:3312] 000007fef36ad3c8 Thread C:\Windows\system32\svchost.exe [972:2000] 000007fefb1bc2d4 Thread C:\Windows\system32\svchost.exe [972:2288] 000007fefb1bc2d4 Thread C:\Windows\system32\svchost.exe [972:2872] 000007fefb1bc2d4 Thread C:\Windows\system32\svchost.exe [972:1920] 000007fefb1bc2d4 Thread C:\Windows\system32\svchost.exe [972:3452] 000007fef9325124 Thread C:\Windows\system32\svchost.exe [1004:1260] 000007fef9ca1e00 Thread C:\Windows\system32\svchost.exe [1004:1264] 000007fef9b61a50 Thread C:\Windows\system32\svchost.exe [1004:1560] 000007fefc971a70 Thread C:\Windows\system32\svchost.exe [1004:1968] 000007fefc971a70 Thread C:\Windows\system32\svchost.exe [1004:1048] 000007fef84b506c Thread C:\Windows\system32\svchost.exe [1004:412] 000007fef8871c20 Thread C:\Windows\system32\svchost.exe [1004:1000] 000007fef8871c20 Thread C:\Windows\system32\svchost.exe [1004:3868] 000007fef9325124 Thread C:\Windows\system32\svchost.exe [1004:304] 000007fef2d784d8 Thread C:\Windows\system32\svchost.exe [1004:2320] 000007fef13623a8 Thread C:\Windows\system32\svchost.exe [1004:3488] 000007fef0f50d00 Thread C:\Windows\system32\svchost.exe [1004:724] 000007feed489498 Thread C:\Windows\system32\svchost.exe [1004:4572] 000007fef8171ab0 Thread C:\Windows\system32\svchost.exe [1004:4256] 000007fef8d3b68c Thread C:\Windows\system32\svchost.exe [1004:3988] 000007fef8a917f8 Thread C:\Windows\system32\svchost.exe [1004:300] 000007fef8a917f8 Thread C:\Windows\system32\svchost.exe [1004:4948] 000007fef8a917f8 Thread C:\Windows\system32\svchost.exe [372:1076] 000007fefaaf8274 Thread C:\Windows\system32\svchost.exe [372:2248] 000007fefaaf8274 Thread C:\Windows\system32\svchost.exe [1100:1608] 000007fef94ebd88 Thread C:\Windows\system32\svchost.exe [1100:1748] 000007fef90c5170 Thread C:\Windows\system32\svchost.exe [1100:3212] 000007fef9325124 Thread C:\Windows\system32\svchost.exe [1100:1776] 000007fef0fb83d8 Thread C:\Windows\system32\svchost.exe [1100:660] 000007fef0ef3f1c Thread C:\Windows\system32\svchost.exe [1100:3144] 000007fef7dd22b8 Thread C:\Windows\system32\svchost.exe [1100:2128] 000007fef7dd1a38 Thread C:\Windows\system32\svchost.exe [1100:3520] 000007fef7da5388 Thread C:\Windows\system32\svchost.exe [1100:1584] 000007fef1267738 Thread C:\Windows\system32\svchost.exe [1100:4000] 000007fef27c1f90 Thread C:\Windows\System32\spoolsv.exe [1280:912] 000007feef5910c8 Thread C:\Windows\System32\spoolsv.exe [1280:892] 000007fef4546144 Thread C:\Windows\System32\spoolsv.exe [1280:872] 000007feef4f5fd0 Thread C:\Windows\System32\spoolsv.exe [1280:2468] 000007feef4e3438 Thread C:\Windows\System32\spoolsv.exe [1280:2452] 000007feef4f63ec Thread C:\Windows\System32\spoolsv.exe [1280:2728] 000007feef625e5c Thread C:\Windows\system32\svchost.exe [1316:1512] 000007fef97635c0 Thread C:\Windows\system32\svchost.exe [1316:1492] 000007fef9765600 Thread C:\Windows\system32\svchost.exe [1316:1980] 000007fef7f52940 Thread C:\Windows\system32\svchost.exe [1316:2236] 000007fef7c72888 Thread C:\Windows\system32\svchost.exe [1316:3808] 000007fef7c72a40 Thread C:\Windows\system32\taskhost.exe [2252:2752] 000007fef7bf1f38 Thread C:\Windows\system32\taskhost.exe [2252:2760] 000007fef7c12740 Thread C:\Windows\system32\taskhost.exe [2252:2836] 000007fefac51010 Thread C:\Windows\system32\taskhost.exe [2252:3248] 000007fef90c5170 Thread C:\Windows\system32\svchost.exe [3124:3204] 000007fef33d8470 Thread C:\Windows\system32\svchost.exe [3124:3208] 000007fef33e2418 Thread C:\Windows\system32\svchost.exe [3124:3268] 000007feef4f5fd0 Thread C:\Windows\system32\svchost.exe [3124:3272] 000007feef4f63ec Thread C:\Windows\system32\svchost.exe [3124:928] 000007fef2c84734 Thread C:\Windows\system32\svchost.exe [3124:2628] 000007fef2c84734 ---- Disk sectors - GMER 2.1 ---- Disk \Device\Harddisk0\DR0 unknown MBR code ---- EOF - GMER 2.1 ----
  17. justime
    OK here is the scans . I im having trouble posting more than one at a time. OTL logfile created on: 6/19/2013 7:31:44 PM - Run 1 OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\Administrator\Downloads 64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation Internet Explorer (Version = 9.10.9200.16614) Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy 1.93 Gb Total Physical Memory | 0.84 Gb Available Physical Memory | 43.41% Memory free 3.87 Gb Paging File | 2.35 Gb Available in Paging File | 60.88% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86) Drive C: | 220.40 Gb Total Space | 155.01 Gb Free Space | 70.33% Space Free | Partition Type: NTFS Drive D: | 12.29 Gb Total Space | 2.03 Gb Free Space | 16.49% Space Free | Partition Type: NTFS Computer Name: JUSTINSMITH | User Name: Administrator | Logged in as Administrator. Boot Mode: Normal | Scan Mode: Current user | Include 64bit Scans Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days ========== Processes (SafeList) ========== PRC - [2013/06/19 19:29:08 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Administrator\Downloads\OTL.exe PRC - [2013/05/16 10:59:00 | 003,830,224 | ---- | M] (Safer-Networking Ltd.) -- C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe PRC - [2013/05/16 10:56:34 | 001,033,688 | ---- | M] (Safer-Networking Ltd.) -- C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe PRC - [2013/05/16 10:56:30 | 001,817,560 | ---- | M] (Safer-Networking Ltd.) -- C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe PRC - [2013/05/15 13:21:32 | 000,171,928 | ---- | M] (Safer-Networking Ltd.) -- C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe PRC - [2012/12/06 12:14:42 | 000,056,416 | ---- | M] (Apple Inc.) -- C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\SyncServer.exe PRC - [2012/11/29 18:31:04 | 000,038,608 | ---- | M] () -- C:\Program Files (x86)\RealNetworks\RealDownloader\rndlresolversvc.exe PRC - [2012/08/10 13:48:50 | 000,197,536 | ---- | M] (Hewlett-Packard Company) -- C:\Program Files (x86)\Hewlett-Packard\Shared\HPDrvMntSvc.exe ========== Modules (No Company Name) ========== MOD - [2013/05/16 10:55:28 | 000,161,112 | ---- | M] () -- C:\Program Files (x86)\Spybot - Search & Destroy 2\snlFileFormats150.bpl MOD - [2013/05/16 10:55:26 | 000,113,496 | ---- | M] () -- C:\Program Files (x86)\Spybot - Search & Destroy 2\snlThirdParty150.bpl MOD - [2013/05/16 10:55:24 | 000,416,600 | ---- | M] () -- C:\Program Files (x86)\Spybot - Search & Destroy 2\DEC150.bpl MOD - [2012/08/27 18:33:32 | 000,087,912 | ---- | M] () -- C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll MOD - [2012/08/27 18:33:08 | 001,242,512 | ---- | M] () -- C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll ========== Services (SafeList) ========== SRV:64bit: - [2009/07/13 17:41:27 | 001,011,712 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend) SRV - [2013/06/12 19:57:18 | 000,256,904 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc) SRV - [2012/11/29 18:31:04 | 000,038,608 | ---- | M] () [Auto | Running] -- C:\Program Files (x86)\RealNetworks\RealDownloader\rndlresolversvc.exe -- (RealNetworks Downloader Resolver Service) SRV - [2012/09/27 09:55:16 | 000,086,528 | ---- | M] (Hewlett-Packard Company) [Auto | Running] -- C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSA_Service.exe -- (HP Support Assistant Service) SRV - [2012/08/10 13:48:50 | 000,197,536 | ---- | M] (Hewlett-Packard Company) [Auto | Running] -- C:\Program Files (x86)\Hewlett-Packard\Shared\HPDrvMntSvc.exe -- (HPDrvMntSvc.exe) SRV - [2012/07/13 10:28:36 | 000,160,944 | R--- | M] (Skype Technologies) [Auto | Stopped] -- C:\Program Files (x86)\Skype\Updater\Updater.exe -- (SkypeUpdate) SRV - [2010/10/12 09:59:12 | 000,206,072 | ---- | M] (WildTangent, Inc.) [On_Demand | Stopped] -- C:\Program Files (x86)\WildTangent Games\App\GamesAppService.exe -- (GamesAppService) SRV - [2010/03/18 11:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32) SRV - [2009/06/10 13:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32) SRV - [2009/04/29 11:21:18 | 000,436,736 | ---- | M] (Conexant Systems, Inc.) [Auto | Running] -- C:\Windows\SysWOW64\XAudio64.dll -- (HsfXAudioService) ========== Driver Services (SafeList) ========== DRV:64bit: - [2013/05/27 08:29:00 | 000,015,712 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\SWDUMon.sys -- (SWDUMon) DRV:64bit: - [2012/12/13 13:50:36 | 000,054,784 | ---- | M] (Apple, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\usbaapl64.sys -- (USBAAPL64) DRV:64bit: - [2012/08/23 06:10:20 | 000,019,456 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\rdpvideominiport.sys -- (RdpVideoMiniport) DRV:64bit: - [2012/08/23 06:07:35 | 000,057,856 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbFlt.sys -- (TsUsbFlt) DRV:64bit: - [2012/08/21 10:01:20 | 000,033,240 | ---- | M] (GEAR Software Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\GEARAspiWDM.sys -- (GEARAspiWDM) DRV:64bit: - [2012/03/26 11:50:12 | 000,022,528 | ---- | M] (Apple Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\netaapl64.sys -- (Netaapl) DRV:64bit: - [2012/02/29 22:46:16 | 000,023,408 | ---- | M] (Microsoft Corporation) [Recognizer | Boot | Unknown] -- C:\Windows\SysNative\drivers\fs_rec.sys -- (Fs_Rec) DRV:64bit: - [2011/07/07 16:13:40 | 000,018,456 | ---- | M] (HandSet Incorporated) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\massfilter_hs.sys -- (massfilter_hs) DRV:64bit: - [2011/03/10 22:41:12 | 000,107,904 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata) DRV:64bit: - [2011/03/10 22:41:12 | 000,027,008 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata) DRV:64bit: - [2010/11/20 05:33:35 | 000,078,720 | ---- | M] (Hewlett-Packard Company) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD) DRV:64bit: - [2010/11/20 01:37:42 | 000,109,056 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\sdbus.sys -- (sdbus) DRV:64bit: - [2010/09/26 17:15:22 | 002,374,656 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\athrx.sys -- (athr) DRV:64bit: - [2010/08/25 17:36:04 | 010,611,552 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\igdkmd64.sys -- (igfx) DRV:64bit: - [2010/03/22 13:53:08 | 000,699,960 | ---- | M] (Conexant Systems Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\CHDRT64.sys -- (CnxtHdAudService) DRV:64bit: - [2009/07/13 17:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs) DRV:64bit: - [2009/07/13 17:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2) DRV:64bit: - [2009/07/13 17:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor) DRV:64bit: - [2009/06/18 20:12:32 | 000,272,432 | ---- | M] (Synaptics Incorporated) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\SynTP.sys -- (SynTP) DRV:64bit: - [2009/06/10 13:01:11 | 001,485,312 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\VSTDPV6.SYS -- (SrvHsfV92) DRV:64bit: - [2009/06/10 13:01:11 | 000,740,864 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\VSTCNXT6.SYS -- (SrvHsfWinac) DRV:64bit: - [2009/06/10 13:01:11 | 000,292,864 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\VSTAZL6.SYS -- (SrvHsfHDA) DRV:64bit: - [2009/06/10 12:35:33 | 000,389,120 | ---- | M] (Marvell) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\yk62x64.sys -- (yukonw7) DRV:64bit: - [2009/06/10 12:35:28 | 005,434,368 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\netw5v64.sys -- (netw5v64) DRV:64bit: - [2009/06/10 12:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv) DRV:64bit: - [2009/06/10 12:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv) DRV:64bit: - [2009/06/10 12:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a) DRV:64bit: - [2009/06/10 12:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir) DRV:64bit: - [2009/06/04 16:46:50 | 000,216,064 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\RtsUStor.sys -- (RSUSBSTOR) DRV:64bit: - [2009/05/22 22:52:30 | 000,215,040 | ---- | M] (Realtek ) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Rt64win7.sys -- (RTL8167) DRV:64bit: - [2009/04/29 11:21:08 | 000,010,240 | ---- | M] (Conexant Systems, Inc.) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\XAudio64.sys -- (XAudio) DRV:64bit: - [2009/04/29 07:48:32 | 000,018,432 | ---- | M] (Hewlett-Packard Development Company, L.P.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\HpqKbFiltr.sys -- (HpqKbFiltr) DRV:64bit: - [2009/02/12 22:24:56 | 001,485,824 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\CAX_DPV.sys -- (HSF_DPV) DRV:64bit: - [2009/02/12 22:20:56 | 000,292,864 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\CAXHWAZL.sys -- (CAXHWAZL) DRV:64bit: - [2009/02/12 22:19:34 | 000,740,864 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\CAX_CNXT.sys -- (winachsf) DRV:64bit: - [2007/05/14 14:06:18 | 000,027,520 | ---- | M] (Research In Motion Limited) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\RimUsb_AMD64.sys -- (RimUsb) DRV:64bit: - [2006/06/18 06:27:24 | 000,017,024 | ---- | M] (Conexant) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\mdmxsdk.sys -- (mdmxsdk) DRV - [2009/07/13 17:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {9BB47C17-9C68-4BB3-B188-DD9AF0FD2002} IE:64bit: - HKLM\..\SearchScopes\{0E2443F9-9665-467A-B335-E8D803135D83}: "URL" = http://www.ask.com/web?q={searchTerms}&l=dis&o=uscql IE:64bit: - HKLM\..\SearchScopes\{2CC18F59-43CB-417F-B4B0-9DE87E158C04}: "URL" = http://www.bing.com/search?q={searchTerms}&form=CPNTDF&pc=CPNTDF&src=IE-SearchBox IE:64bit: - HKLM\..\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2002}: "URL" = http://dts.search-results.com/sr?src=ieb&gct=ds&appid=717&systemid=2&apn_uid=0243580197474874&apn_dtid=IME002&o=APN10641&apn_ptnrs=AG2&q={searchTerms} IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm IE - HKLM\..\SearchScopes,DefaultScope = {9BB47C17-9C68-4BB3-B188-DD9AF0FD2002} IE - HKLM\..\SearchScopes\{0E2443F9-9665-467A-B335-E8D803135D83}: "URL" = http://www.ask.com/web?q={searchTerms}&l=dis&o=uscql IE - HKLM\..\SearchScopes\{2CC18F59-43CB-417F-B4B0-9DE87E158C04}: "URL" = http://www.bing.com/search?q={searchTerms}&form=CPNTDF&pc=CPNTDF&src=IE-SearchBox IE - HKLM\..\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2002}: "URL" = http://dts.search-results.com/sr?src=ieb&gct=ds&appid=717&systemid=2&apn_uid=0243580197474874&apn_dtid=IME002&o=APN10641&apn_ptnrs=AG2&q={searchTerms} IE - HKLM\..\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2A69}: "URL" = http://search.bearshare.com/web?src=ieb&q={searchTerms} IE - HKLM\..\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}: "URL" = http://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2612669 IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://g.msn.com/CQNOT/1 IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com/ IE - HKCU\..\SearchScopes,DefaultScope = {9BB47C17-9C68-4BB3-B188-DD9AF0FD2002} IE - HKCU\..\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2002}: "URL" = http://dts.search-results.com/sr?src=ieb&gct=ds&appid=717&systemid=2&apn_uid=0243580197474874&apn_dtid=IME002&o=APN10641&apn_ptnrs=AG2&q={searchTerms} IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 1 IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = localhost:21320 ========== FireFox ========== FF - prefs.js..browser.search.defaultenginename: "Search Results" FF - prefs.js..browser.search.order.1: "Search Results" FF - prefs.js..browser.search.selectedEngine: "Search Results" FF - prefs.js..browser.startup.homepage: "http://search.bearshare.net?appid=717" FF - prefs.js..extensions.enabledAddons: %7B635abd67-4fe9-1b23-4f01-e679fa7484c1%7D:2.6.0.20130418072822 FF - prefs.js..extensions.enabledAddons: %7B972ce4c6-7e08-4474-a285-3208198ce6fd%7D:21.0 FF - prefs.js..keyword.URL: "http://dts.search-results.com/sr?src=ffb&gct=ds&appid=717&systemid=2&apn_dtid=IME002&apn_ptnrs=AG2&apn_uid=0243580197474874&o=APN10641&q=" FF - user.js - File not found FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_7_700_224.dll File not found FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found FF:64bit: - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\5.1.20125.0\npctrl.dll ( Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_7_700_224.dll () FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\Windows\SysWOW64\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.) FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll () FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google) FF - HKLM\Software\MozillaPlugins\@google.com/npPicasa3,version=3.0.0: C:\Program Files (x86)\Google\Picasa3\npPicasa3.dll (Google, Inc.) FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.21.2: C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation) FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.21.2: C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files (x86)\Microsoft Silverlight\5.1.20125.0\npctrl.dll ( Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=14.0.8081.0709: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@real.com/nppl3260;version=16.0.0.282: c:\program files (x86)\real\realplayer\Netscape6\nppl3260.dll (RealNetworks, Inc.) FF - HKLM\Software\MozillaPlugins\@real.com/nprndlchromebrowserrecordext;version=1.3.0: C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlchromebrowserrecordext.dll (RealNetworks, Inc.) FF - HKLM\Software\MozillaPlugins\@real.com/nprndlhtml5videoshim;version=1.3.0: C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlhtml5videoshim.dll (RealNetworks, Inc.) FF - HKLM\Software\MozillaPlugins\@real.com/nprndlpepperflashvideoshim;version=1.3.0: C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlpepperflashvideoshim.dll (RealNetworks, Inc.) FF - HKLM\Software\MozillaPlugins\@real.com/nprpplugin;version=16.0.0.282: c:\program files (x86)\real\realplayer\Netscape6\nprpplugin.dll (RealPlayer) FF - HKLM\Software\MozillaPlugins\@realnetworks.com/npdlplugin;version=1: C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\npdlplugin.dll (RealDownloader) FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.21.145\npGoogleUpdate3.dll (Google Inc.) FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.21.145\npGoogleUpdate3.dll (Google Inc.) FF - HKLM\Software\MozillaPlugins\@WildTangent.com/GamesAppPresenceDetector,Version=1.0: C:\Program Files (x86)\WildTangent Games\App\BrowserIntegration\Registered\1\NP_wtapp.dll () FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\smartwebprinting@hp.com: C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2010/03/22 14:08:35 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{34712C68-7391-4c47-94F3-8F88D49AD632}: C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Firefox\Ext\ [2013/02/12 18:17:13 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{ABDE892B-13A8-4d1b-88E6-365A6E755758}: C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Firefox\Ext [2013/02/12 18:17:13 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 21.0\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 21.0\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins FF - HKEY_LOCAL_MACHINE\software\mozilla\SeaMonkey 2.16\extensions\\Components: C:\Program Files (x86)\SeaMonkey\components [2013/06/14 20:50:44 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\SeaMonkey 2.16\extensions\\Plugins: C:\Program Files (x86)\SeaMonkey\plugins [2013/03/31 07:56:44 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Administrator\AppData\Roaming\mozilla\Extensions [2013/06/13 18:10:22 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Administrator\AppData\Roaming\mozilla\Firefox\Profiles\mmj39qj7.default\extensions [2013/05/27 19:28:41 | 000,000,000 | ---D | M] (Yahoo! Toolbar) -- C:\Users\Administrator\AppData\Roaming\mozilla\Firefox\Profiles\mmj39qj7.default\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1} [2013/03/31 07:56:45 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Administrator\AppData\Roaming\mozilla\SeaMonkey\Profiles\xxyz0yil.default\extensions [2013/05/27 19:44:43 | 000,221,336 | ---- | M] () (No name found) -- C:\Users\Administrator\AppData\Roaming\mozilla\firefox\profiles\mmj39qj7.default\extensions\{c0c9a2c7-2e5c-4447-bc53-97718bc91e1b}.xpi [2013/06/09 11:02:26 | 000,002,646 | ---- | M] () -- C:\Users\Administrator\AppData\Roaming\mozilla\firefox\profiles\mmj39qj7.default\searchplugins\Search_Results.xml [2013/05/27 19:14:32 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\Mozilla Firefox\browser\extensions [2013/05/27 19:14:32 | 000,000,000 | ---D | M] (Default) -- C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd} [2013/05/27 19:14:31 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\Mozilla Firefox\distribution\extensions [2013/05/27 19:14:31 | 000,000,000 | ---D | M] (Yahoo! Toolbar) -- C:\Program Files (x86)\Mozilla Firefox\distribution\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1} ========== Chrome ========== CHR - default_search_provider: Search Results (Enabled) CHR - default_search_provider: search_url = http://dts.search-results.com/sr?src=crb&gct=ds&appid=717&systemid=2&apn_uid=0243580197474874&apn_dtid=IME002&o=APN10641&apn_ptnrs=AG2&q={searchTerms} CHR - default_search_provider: suggest_url = CHR - homepage: http://search.bearshare.net?appid=717 CHR - plugin: Shockwave Flash (Enabled) = C:\Program Files (x86)\Google\Chrome\Application\27.0.1453.116\PepperFlash\pepflashplayer.dll CHR - plugin: Chrome Remote Desktop Viewer (Enabled) = internal-remoting-viewer CHR - plugin: Native Client (Enabled) = C:\Program Files (x86)\Google\Chrome\Application\27.0.1453.116\ppGoogleNaClPluginChrome.dll CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Program Files (x86)\Google\Chrome\Application\27.0.1453.116\pdf.dll CHR - plugin: Adobe Acrobat (Enabled) = C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\nppdf32.dll CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin.dll CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin2.dll CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin3.dll CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin4.dll CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin5.dll CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin6.dll CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin7.dll CHR - plugin: AVG SiteSafety plugin (Enabled) = C:\Program Files (x86)\Common Files\AVG Secure Search\SiteSafetyInstaller\14.2.0\\npsitesafety.dll CHR - plugin: Picasa (Enabled) = C:\Program Files (x86)\Google\Picasa3\npPicasa3.dll CHR - plugin: Google Update (Enabled) = C:\Program Files (x86)\Google\Update\1.3.21.135\npGoogleUpdate3.dll CHR - plugin: Java Platform SE 6 U35 (Enabled) = C:\Program Files (x86)\Java\jre6\bin\plugin2\npjp2.dll CHR - plugin: McAfee Security Scanner + (Enabled) = C:\Program Files (x86)\McAfee Security Scan\3.0.318\npMcAfeeMss.dll CHR - plugin: Windows Live\u00AE Photo Gallery (Enabled) = C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll CHR - plugin: iTunes Application Detector (Enabled) = C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll CHR - plugin: RealNetworks RealDownloader Chrome Background Extension Plug-In (32-bit) (Enabled) = C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlchromebrowserrecordext.dll CHR - plugin: RealNetworks RealDownloader HTML5VideoShim Plug-In (32-bit) (Enabled) = C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlhtml5videoshim.dll CHR - plugin: RealNetworks RealDownloader PepperFlashVideoShim Plug-In (32-bit) (Enabled) = C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlpepperflashvideoshim.dll CHR - plugin: RealDownloader Plugin (Enabled) = C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\npdlplugin.dll CHR - plugin: Shockwave for Director (Enabled) = C:\Windows\SysWOW64\Adobe\Director\np32dsw.dll CHR - plugin: Shockwave Flash (Enabled) = C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_6_602_180.dll CHR - plugin: Java Deployment Toolkit 6.0.350.10 (Enabled) = C:\Windows\SysWOW64\npdeployJava1.dll CHR - plugin: Silverlight Plug-In (Enabled) = c:\Program Files (x86)\Microsoft Silverlight\5.1.20125.0\npctrl.dll CHR - plugin: RealPlayer G2 LiveConnect-Enabled Plug-In (32-bit) (Enabled) = c:\program files (x86)\real\realplayer\Netscape6\nppl3260.dll CHR - plugin: RealPlayer Download Plugin (Enabled) = c:\program files (x86)\real\realplayer\Netscape6\nprpplugin.dll CHR - Extension: Google Docs = C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.5_0\ CHR - Extension: Google Drive = C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.3_0\ CHR - Extension: IMVU Inc = C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\bcfjehbfanfhgoehogmbiebedkidedjb\10.16.4.512_0\ CHR - Extension: YouTube = C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.6_0\ CHR - Extension: Google Search = C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.20_0\ CHR - Extension: RealDownloader = C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\idhngdhcfkoamngbedgpaokgjbnpdiji\1.3.0_0\ CHR - Extension: Gmail = C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\ O1 HOSTS File: ([2013/06/12 21:54:22 | 000,447,966 | R--- | M]) - C:\Windows\SysNative\drivers\etc\hosts O1 - Hosts: 74.208.10.249 gs.apple.com O1 - Hosts: 127.0.0.1 www.007guard.com O1 - Hosts: 127.0.0.1 007guard.com O1 - Hosts: 127.0.0.1 008i.com O1 - Hosts: 127.0.0.1 www.008k.com O1 - Hosts: 127.0.0.1 008k.com O1 - Hosts: 127.0.0.1 www.00hq.com O1 - Hosts: 127.0.0.1 00hq.com O1 - Hosts: 127.0.0.1 010402.com O1 - Hosts: 127.0.0.1 www.032439.com O1 - Hosts: 127.0.0.1 032439.com O1 - Hosts: 127.0.0.1 www.0scan.com O1 - Hosts: 127.0.0.1 0scan.com O1 - Hosts: 127.0.0.1 1000gratisproben.com O1 - Hosts: 127.0.0.1 www.1000gratisproben.com O1 - Hosts: 127.0.0.1 1001namen.com O1 - Hosts: 127.0.0.1 www.1001namen.com O1 - Hosts: 127.0.0.1 100888290cs.com O1 - Hosts: 127.0.0.1 www.100888290cs.com O1 - Hosts: 127.0.0.1 www.100sexlinks.com O1 - Hosts: 127.0.0.1 100sexlinks.com O1 - Hosts: 127.0.0.1 10sek.com O1 - Hosts: 127.0.0.1 www.10sek.com O1 - Hosts: 127.0.0.1 www.1-2005-search.com O1 - Hosts: 127.0.0.1 1-2005-search.com O1 - Hosts: 15377 more lines... O2 - BHO: (RealNetworks Download and Record Plugin for Internet Explorer) - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\IE\rndlbrowserrecordplugin.dll (RealDownloader) O2 - BHO: (Java Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation) O2 - BHO: (Microsoft Live Search Toolbar Helper) - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - c:\Program Files (x86)\MSN\Toolbar\3.0.0566.0\msneshellx.dll (Microsoft Corp.) O2 - BHO: (Java Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation) O2 - BHO: (HP Network Check Helper) - {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} - C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPlugin.dll (Hewlett-Packard) O3:64bit: - HKLM\..\Toolbar: (no name) - 10 - No CLSID value found. O3 - HKLM\..\Toolbar: (Microsoft Live Search Toolbar) - {1E61ED7C-7CB8-49d6-B9E9-AB4C880C8414} - c:\Program Files (x86)\MSN\Toolbar\3.0.0566.0\msneshellx.dll (Microsoft Corp.) O3 - HKLM\..\Toolbar: (no name) - 10 - No CLSID value found. O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {604BC32A-9680-40D1-9AC6-E06B23A1BA4C} - No CLSID value found. O4:64bit: - HKLM..\Run: [HotKeysCmds] C:\Windows\SysNative\hkcmd.exe (Intel Corporation) O4:64bit: - HKLM..\Run: [igfxTray] C:\Windows\SysNative\igfxtray.exe (Intel Corporation) O4:64bit: - HKLM..\Run: [Persistence] C:\Windows\SysNative\igfxpers.exe (Intel Corporation) O4 - HKLM..\Run: [APSDaemon] C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.) O4 - HKLM..\Run: [sDTray] C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe (Safer-Networking Ltd.) O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3 O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O8 - Extra context menu item: Add to Google Photos Screensa&ver - C:\Windows\SysWow64\GPhotos.scr (Google Inc.) O9 - Extra Button: @C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPlugin.dll,-103 - {25510184-5A38-4A99-B273-DCA8EEF6CD08} - C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\NCLauncherFromIE.exe (Hewlett-Packard) O9 - Extra 'Tools' menuitem : @C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPlugin.dll,-102 - {25510184-5A38-4A99-B273-DCA8EEF6CD08} - C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\NCLauncherFromIE.exe (Hewlett-Packard) O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000005 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.) O10 - NameSpace_Catalog5\Catalog_Entries\000000000005 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.) O1364bit: - gopher Prefix: missing O13 - gopher Prefix: missing O16:64bit: - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab (Java Plug-in 1.6.0_15) O16:64bit: - DPF: {CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab (Java Plug-in 1.6.0_15) O16:64bit: - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab (Java Plug-in 1.6.0_15) O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} http://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab (Windows Genuine Advantage Validation Tool) O16 - DPF: {24DCAB5D-AB40-440F-9CF8-DF2F406FD3DD} http://www.stcloudstate.edu/XpressConnect/tools/xc_loader_activex.ocx (xc_loader_activex.cntMain) O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} http://download.divx.com/player/DivXBrowserPlugin.cab (Reg Error: Key error.) O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.0.1 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{BD5FA972-99E2-4848-8BC7-8AA7FE25674F}: DhcpNameServer = 192.168.0.1 O18:64bit: - Protocol\Handler\livecall - No CLSID value found O18:64bit: - Protocol\Handler\ms-help - No CLSID value found O18:64bit: - Protocol\Handler\ms-itss - No CLSID value found O18:64bit: - Protocol\Handler\msnim - No CLSID value found O18:64bit: - Protocol\Handler\skype4com - No CLSID value found O18:64bit: - Protocol\Handler\wlmailhtml - No CLSID value found O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies) O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation) O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation) O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\SysWow64\userinit.exe (Microsoft Corporation) O20:64bit: - Winlogon\Notify\igfxcui: DllName - (igfxdev.dll) - C:\Windows\SysNative\igfxdev.dll (Intel Corporation) O20 - Winlogon\Notify\SDWinLogon: DllName - (SDWinLogon.dll) - File not found O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. O32 - HKLM CDRom: AutoRun - 1 O33 - MountPoints2\{955fff04-bf2f-11e2-b3a6-00262db82294}\Shell - "" = AutoRun O33 - MountPoints2\{955fff04-bf2f-11e2-b3a6-00262db82294}\Shell\AutoRun\command - "" = G:\IronKey.exe O33 - MountPoints2\{d88a02c9-b8b9-11e2-afc2-00262db82294}\Shell - "" = AutoRun O33 - MountPoints2\{d88a02c9-b8b9-11e2-afc2-00262db82294}\Shell\AutoRun\command - "" = E:\Autorun.exe /s O34 - HKLM BootExecute: (autocheck autochk *) O35:64bit: - HKLM\..comfile [open] -- "%1" %* O35:64bit: - HKLM\..exefile [open] -- "%1" %* O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %* O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3) O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2) O38 - SubSystems\\Windows: (ServerDll=sxssrv,4) ========== Files/Folders - Created Within 30 Days ========== [2013/06/18 18:03:16 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\MGTEK [2013/06/18 18:03:16 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\MGTEK [2013/06/14 20:50:30 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\QuickTime [2013/06/14 20:50:24 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\QuickTime [2013/06/14 20:49:10 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iCloud [2013/06/14 20:30:58 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes [2013/06/14 20:29:57 | 000,000,000 | ---D | C] -- C:\Program Files\iTunes [2013/06/14 20:29:57 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\iTunes [2013/06/14 20:29:57 | 000,000,000 | ---D | C] -- C:\Program Files\iPod [2013/06/14 20:29:57 | 000,000,000 | ---D | C] -- C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69 [2013/06/14 20:29:11 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Apple Software Update [2013/06/14 19:52:21 | 000,526,336 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieui.dll [2013/06/14 19:52:21 | 000,391,168 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieui.dll [2013/06/13 18:51:43 | 000,025,928 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys [2013/06/13 18:51:43 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware [2013/06/12 21:58:02 | 000,000,000 | ---D | C] -- C:\Users\Administrator\Documents\ProcAlyzer Dumps [2013/06/12 21:30:26 | 000,017,272 | ---- | C] (Safer Networking Limited) -- C:\Windows\SysNative\sdnclean64.exe [2013/06/12 21:30:22 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Spybot - Search & Destroy 2 [2013/06/12 21:15:00 | 000,000,000 | ---D | C] -- C:\Users\Administrator\Desktop\New folder [2013/06/12 06:21:51 | 000,136,704 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\iesysprep.dll [2013/06/12 06:21:51 | 000,109,056 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\iesysprep.dll [2013/06/12 06:21:51 | 000,089,600 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\RegisterIEPKEYs.exe [2013/06/12 06:21:51 | 000,071,680 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\RegisterIEPKEYs.exe [2013/06/12 06:21:51 | 000,067,072 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\iesetup.dll [2013/06/12 06:21:51 | 000,061,440 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\iesetup.dll [2013/06/12 06:21:51 | 000,051,712 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ie4uinit.exe [2013/06/12 06:21:51 | 000,039,936 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\iernonce.dll [2013/06/12 06:21:51 | 000,033,280 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\iernonce.dll [2013/06/12 06:21:49 | 000,855,552 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\jscript.dll [2013/06/12 06:21:49 | 000,690,688 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\jscript.dll [2013/06/12 06:21:49 | 000,603,136 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\msfeeds.dll [2013/06/12 06:21:48 | 003,958,784 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\jscript9.dll [2013/06/12 06:19:44 | 000,000,000 | ---D | C] -- C:\ProgramData\2C3C1 [2013/06/12 06:15:06 | 000,751,104 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\win32spl.dll [2013/06/12 06:15:06 | 000,492,544 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\win32spl.dll [2013/06/12 06:15:04 | 001,464,320 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\crypt32.dll [2013/06/12 06:15:04 | 001,192,448 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\certutil.exe [2013/06/12 06:15:04 | 000,903,168 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\certutil.exe [2013/06/12 06:15:04 | 000,139,776 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\cryptnet.dll [2013/06/12 06:15:04 | 000,052,224 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\certenc.dll [2013/06/12 06:15:04 | 000,043,008 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\certenc.dll [2013/06/09 13:31:00 | 000,000,000 | ---D | C] -- C:\ProgramData\Browser Manager [2013/06/09 11:04:42 | 000,000,000 | ---D | C] -- C:\Users\Administrator\Documents\My Received Files [2013/06/04 20:39:41 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\naturalsoft [2013/06/04 20:39:37 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\naturalsoft [2013/06/04 20:39:36 | 000,000,000 | ---D | C] -- C:\Users\Administrator\Documents\Naturalsoft [2013/06/04 20:38:01 | 000,000,000 | ---D | C] -- C:\ProgramData\NaturalSoft [2013/05/27 19:18:58 | 000,000,000 | ---D | C] -- C:\Users\Administrator\AppData\Local\Macromedia [2013/05/27 19:14:30 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Mozilla Firefox [2013/05/27 11:55:30 | 000,000,000 | ---D | C] -- C:\ProgramData\Kaspersky Lab [2013/05/27 01:13:18 | 000,000,000 | ---D | C] -- C:\Users\Administrator\AppData\Local\Conexant [2013/05/26 22:23:41 | 000,000,000 | ---D | C] -- C:\Users\Administrator\AppData\Roaming\PC Cleaner [2013/05/26 22:23:37 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\PC Cleaner [2 C:\Program Files (x86)\*.tmp files -> C:\Program Files (x86)\*.tmp -> ] [1 C:\*.tmp files -> C:\*.tmp -> ] ========== Files - Modified Within 30 Days ========== [2013/06/19 19:30:44 | 000,001,113 | ---- | M] () -- C:\Users\Administrator\Desktop\OTL.exe - Shortcut.lnk [2013/06/19 18:58:22 | 000,000,902 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job [2013/06/19 18:57:16 | 000,000,830 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job [2013/06/19 18:48:00 | 000,000,920 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-820292111-1869468108-3859774255-1000UA.job [2013/06/19 18:46:55 | 000,023,248 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 [2013/06/19 18:46:55 | 000,023,248 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 [2013/06/19 18:40:18 | 000,000,898 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job [2013/06/19 18:40:15 | 000,000,350 | ---- | M] () -- C:\Windows\tasks\AVG-Secure-Search-Update_JUNE2013_TB_rmv.job [2013/06/19 18:40:15 | 000,000,350 | ---- | M] () -- C:\Windows\tasks\AVG-Secure-Search-Update_JUNE2013_HP_rmv.job [2013/06/19 18:39:20 | 000,354,008 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT [2013/06/19 18:39:05 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat [2013/06/19 18:38:55 | 1556,500,480 | -HS- | M] () -- C:\hiberfil.sys [2013/06/19 01:49:00 | 000,000,344 | ---- | M] () -- C:\Windows\tasks\HPCeeScheduleForNyamuoch.job [2013/06/18 18:03:16 | 000,001,895 | ---- | M] () -- C:\Users\Public\Desktop\MGTEK dopisp.lnk [2013/06/15 08:48:00 | 000,000,868 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-820292111-1869468108-3859774255-1000Core.job [2013/06/14 20:50:31 | 000,001,805 | ---- | M] () -- C:\Users\Public\Desktop\QuickTime Player.lnk [2013/06/13 18:51:45 | 000,001,069 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk [2013/06/12 21:54:22 | 000,447,966 | R--- | M] () -- C:\Windows\SysNative\drivers\etc\hosts [2013/06/12 21:30:29 | 000,001,339 | ---- | M] () -- C:\Users\Public\Desktop\Spybot-S&D Start Center.lnk [2013/06/12 19:57:17 | 000,692,104 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\FlashPlayerApp.exe [2013/06/12 19:57:17 | 000,071,048 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl [2013/06/09 10:51:30 | 002,014,296 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat [2013/06/09 10:51:30 | 000,594,354 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat [2013/06/09 10:51:30 | 000,006,230 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI [2013/06/08 06:06:58 | 000,526,336 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\ieui.dll [2013/06/08 03:40:02 | 000,391,168 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\ieui.dll [2013/06/06 22:10:09 | 000,000,364 | ---- | M] () -- C:\Windows\tasks\HPCeeScheduleForAdministrator.job [2013/06/04 20:39:42 | 000,002,012 | ---- | M] () -- C:\Users\Public\Desktop\Demo.lnk [2013/06/04 20:39:42 | 000,002,007 | ---- | M] () -- C:\Users\Public\Desktop\Free NaturalReader.lnk [2013/05/27 19:14:34 | 000,001,107 | ---- | M] () -- C:\Users\Public\Desktop\Mozilla Firefox.lnk [2013/05/27 08:29:00 | 000,015,712 | ---- | M] () -- C:\Windows\SysNative\drivers\SWDUMon.sys [2013/05/26 22:23:01 | 000,000,000 | ---- | M] () -- C:\END [2 C:\Program Files (x86)\*.tmp files -> C:\Program Files (x86)\*.tmp -> ] [1 C:\*.tmp files -> C:\*.tmp -> ] ========== Files Created - No Company Name ========== [2013/06/19 19:30:44 | 000,001,113 | ---- | C] () -- C:\Users\Administrator\Desktop\OTL.exe - Shortcut.lnk [2013/06/19 18:38:57 | 000,354,008 | ---- | C] () -- C:\Windows\SysNative\FNTCACHE.DAT [2013/06/18 18:03:16 | 000,001,895 | ---- | C] () -- C:\Users\Public\Desktop\MGTEK dopisp.lnk [2013/06/14 20:50:31 | 000,001,805 | ---- | C] () -- C:\Users\Public\Desktop\QuickTime Player.lnk [2013/06/14 20:29:11 | 000,002,519 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Apple Software Update.lnk [2013/06/13 18:51:45 | 000,001,069 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk [2013/06/12 21:30:29 | 000,001,351 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot-S&D Start Center.lnk [2013/06/12 21:30:29 | 000,001,339 | ---- | C] () -- C:\Users\Public\Desktop\Spybot-S&D Start Center.lnk [2013/06/07 21:52:17 | 000,000,350 | ---- | C] () -- C:\Windows\tasks\AVG-Secure-Search-Update_JUNE2013_HP_rmv.job [2013/06/04 20:39:42 | 000,002,012 | ---- | C] () -- C:\Users\Public\Desktop\Demo.lnk [2013/06/04 20:39:42 | 000,002,007 | ---- | C] () -- C:\Users\Public\Desktop\Free NaturalReader.lnk [2013/06/03 01:56:54 | 000,000,350 | ---- | C] () -- C:\Windows\tasks\AVG-Secure-Search-Update_JUNE2013_TB_rmv.job [2013/05/27 19:14:34 | 000,001,107 | ---- | C] () -- C:\Users\Public\Desktop\Mozilla Firefox.lnk [2013/05/09 10:34:34 | 000,584,584 | ---- | C] () -- C:\Windows\adb.exe [2013/05/07 13:22:25 | 000,003,556 | ---- | C] () -- C:\Windows\wininit.ini [2013/02/14 18:08:59 | 000,006,212 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI ========== ZeroAccess Check ========== [2009/07/13 20:55:00 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini [HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64 [HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] [HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] /64 [HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64 "" = C:\Windows\SysNative\shell32.dll -- [2013/02/26 21:52:56 | 014,172,672 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Apartment [HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] "" = %SystemRoot%\system32\shell32.dll -- [2013/02/26 20:55:05 | 012,872,704 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Apartment [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] /64 "" = C:\Windows\SysNative\wbem\fastprox.dll -- [2009/07/13 17:40:51 | 000,909,312 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Free [HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] "" = %systemroot%\system32\wbem\fastprox.dll -- [2010/11/20 04:19:02 | 000,606,208 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Free [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] /64 "" = C:\Windows\SysNative\wbem\wbemess.dll -- [2009/07/13 17:41:56 | 000,505,856 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Both [HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] < End of report > OTL Extras logfile created on: 6/19/2013 7:31:44 PM - Run 1 OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\Administrator\Downloads 64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation Internet Explorer (Version = 9.10.9200.16614) Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy 1.93 Gb Total Physical Memory | 0.84 Gb Available Physical Memory | 43.41% Memory free 3.87 Gb Paging File | 2.35 Gb Available in Paging File | 60.88% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86) Drive C: | 220.40 Gb Total Space | 155.01 Gb Free Space | 70.33% Space Free | Partition Type: NTFS Drive D: | 12.29 Gb Total Space | 2.03 Gb Free Space | 16.49% Space Free | Partition Type: NTFS Computer Name: JUSTINSMITH | User Name: Administrator | Logged in as Administrator. Boot Mode: Normal | Scan Mode: Current user | Include 64bit Scans Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days ========== Extra Registry (SafeList) ========== ========== File Associations ========== 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>] .html[@ = ChromeHTML] -- C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) .url[@ = InternetShortcut] -- C:\Windows\SysNative\rundll32.exe (Microsoft Corporation) [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>] .cpl [@ = cplfile] -- C:\Windows\SysWow64\control.exe (Microsoft Corporation) .html [@ = ChromeHTML] -- C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) [HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>] .html [@ = ChromeHTML] -- Reg Error: Key error. File not found ========== Shell Spawning ========== 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command] batfile [open] -- "%1" %* cmdfile [open] -- "%1" %* comfile [open] -- "%1" %* exefile [open] -- "%1" %* helpfile [open] -- Reg Error: Key error. htmlfile [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation) htmlfile [opennew] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation) htmlfile [print] -- "%systemroot%\system32\rundll32.exe" "%systemroot%\system32\mshtml.dll",PrintHTML "%1" http [open] -- "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" -- "%1" (Google Inc.) https [open] -- "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" -- "%1" (Google Inc.) inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation) InternetShortcut [open] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l (Microsoft Corporation) InternetShortcut [print] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation) piffile [open] -- "%1" %* regfile [merge] -- Reg Error: Key error. scrfile [config] -- "%1" scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l scrfile [open] -- "%1" /S txtfile [edit] -- Reg Error: Key error. Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1 Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation) Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation) Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation) Folder [explore] -- Reg Error: Value error. Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation) Applications\iexplore.exe [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation) CLSID\{871C5380-42A0-1069-A2EA-08002B30309D} [OpenHomePage] -- "C:\Program Files\Internet Explorer\iexplore.exe" (Microsoft Corporation) [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command] batfile [open] -- "%1" %* cmdfile [open] -- "%1" %* comfile [open] -- "%1" %* cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation) exefile [open] -- "%1" %* helpfile [open] -- Reg Error: Key error. htmlfile [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation) htmlfile [opennew] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation) htmlfile [print] -- "%systemroot%\system32\rundll32.exe" "%systemroot%\system32\mshtml.dll",PrintHTML "%1" http [open] -- "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" -- "%1" (Google Inc.) https [open] -- "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" -- "%1" (Google Inc.) inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation) piffile [open] -- "%1" %* regfile [merge] -- Reg Error: Key error. scrfile [config] -- "%1" scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l scrfile [open] -- "%1" /S txtfile [edit] -- Reg Error: Key error. Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1 Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation) Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation) Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation) Folder [explore] -- Reg Error: Value error. Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation) Applications\iexplore.exe [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation) CLSID\{871C5380-42A0-1069-A2EA-08002B30309D} [OpenHomePage] -- Reg Error: Value error. ========== Security Center Settings ========== 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center] "cval" = 1 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring] 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc] "VistaSp1" = 28 4D B2 76 41 04 CA 01 [binary data] "AntiVirusOverride" = 0 "AntiSpywareOverride" = 0 "FirewallOverride" = 0 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc] ========== Firewall Settings ========== [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile] "DisableNotifications" = 0 "EnableFirewall" = 1 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile] "DisableNotifications" = 0 "EnableFirewall" = 1 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile] "DisableNotifications" = 0 "EnableFirewall" = 1 ========== Authorized Applications List ========== [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] "C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe" = C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe:*:Enabled:Spybot-S&D 2 Tray Icon -- (Safer-Networking Ltd.) "C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe" = C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe:*:Enabled:Spybot-S&D 2 Scanner Service -- (Safer-Networking Ltd.) "C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdate.exe" = C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdate.exe:*:Enabled:Spybot-S&D 2 Updater -- (Safer-Networking Ltd.) "C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe" = C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe:*:Enabled:Spybot-S&D 2 Background update service -- (Safer-Networking Ltd.) "C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe" = C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe:*:Enabled:Spybot-S&D 2 Tray Icon -- (Safer-Networking Ltd.) "C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe" = C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe:*:Enabled:Spybot-S&D 2 Scanner Service -- (Safer-Networking Ltd.) "C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdate.exe" = C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdate.exe:*:Enabled:Spybot-S&D 2 Updater -- (Safer-Networking Ltd.) "C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe" = C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe:*:Enabled:Spybot-S&D 2 Background update service -- (Safer-Networking Ltd.) ========== Vista Active Open Ports Exception List ========== [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules] "{12A3EA37-4A86-4A89-9092-AF7BA6CE4D46}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe | "{293D1DEC-17E8-411D-AC64-4EBBFB626435}" = lport=138 | protocol=17 | dir=in | app=system | "{42917DDC-5749-42A9-BD9F-1853CC45DBA6}" = lport=2869 | protocol=6 | dir=in | app=system | "{520E77E4-1599-48BC-9756-C86EBB2D7EF6}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe | "{55FC4ED6-2A93-44DF-B2B3-9955677D9DDB}" = rport=3702 | protocol=17 | dir=out | svc=fdrespub | app=%systemroot%\system32\svchost.exe | "{59E41F68-286B-4541-9FBC-366D10A42461}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | "{5C3FB88A-5D74-460D-82E0-4DC0F1B1459C}" = lport=139 | protocol=6 | dir=in | app=system | "{75DCC1B2-568E-4E07-B20E-2157A98AA081}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=svchost.exe | "{7A593EF0-EA30-484E-9B99-F1E33CDA2766}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe | "{87FB24CF-F39B-4177-960E-13D181CD44FD}" = lport=808 | protocol=6 | dir=in | svc=nettcpactivator | app=c:\windows\microsoft.net\framework64\v4.0.30319\smsvchost.exe | "{88A4F061-4ED7-4D96-B36F-B6FE184911CD}" = lport=445 | protocol=6 | dir=in | app=system | "{8A63D69E-D156-4B3F-8C3C-5D10EF003B42}" = lport=3702 | protocol=17 | dir=in | svc=fdrespub | app=%systemroot%\system32\svchost.exe | "{911EDEAA-191B-4840-B7F6-DC64DEB86E91}" = rport=445 | protocol=6 | dir=out | app=system | "{9230B78E-0540-4020-B6AB-A65D3E344099}" = rport=139 | protocol=6 | dir=out | app=system | "{C0EDBF02-CC1F-42DE-A89F-6F67F7FA432C}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | "{C1753875-B2DB-4C65-A606-7863DB9698AA}" = rport=3702 | protocol=17 | dir=out | svc=fdphost | app=%systemroot%\system32\svchost.exe | "{C210E84A-B317-4925-B61A-950A49648F7B}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe | "{C69BFD33-7372-481F-A5F1-0E7F618496E1}" = lport=3702 | protocol=17 | dir=in | svc=fdphost | app=%systemroot%\system32\svchost.exe | "{E1CC632C-6312-4E2C-B009-4BB9B7AAA2B3}" = rport=138 | protocol=17 | dir=out | app=system | "{E243443B-3410-4974-AF6F-F1C680577D93}" = rport=137 | protocol=17 | dir=out | app=system | "{E31D040D-ECDD-47E2-A96E-B26D752381D5}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe | "{F84B35D1-6AE4-4A3B-B67A-D788352A88CE}" = lport=137 | protocol=17 | dir=in | app=system | "{F878E0F8-FE15-4CF0-B888-9FF567400320}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 | ========== Vista Active Application Exception List ========== [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules] "{0EF6C8D1-5605-4537-B9B5-67041A7598C6}" = protocol=6 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe | "{1883A16E-9963-48D9-960C-CA136C835F78}" = protocol=17 | dir=in | app=c:\program files (x86)\bonjour\mdnsresponder.exe | "{1F2AE6D0-97AE-4190-9E05-DE4DB4415990}" = protocol=17 | dir=in | app=c:\program files (x86)\microsoft office\office12\onenote.exe | "{2B1CDDBE-A634-457A-8342-73A09870401A}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 | "{3625E558-74BD-49AF-A7A0-C5E909F56CC6}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 | "{3BBF94B4-E40A-4EE6-BAA3-9F48694DFE87}" = dir=in | app=c:\program files (x86)\hp\digital imaging\smart web printing\smartwebprintexe.exe | "{450CD543-6725-4397-8674-AC0EDA3E3C9A}" = protocol=6 | dir=in | app=c:\program files (x86)\limewire\limewire.exe | "{46C7BCB2-F475-41F0-A371-65BD003F604C}" = dir=in | app=c:\program files (x86)\common files\apple\apple application support\webkit2webprocess.exe | "{4830DB97-4C3F-425D-89A8-586FC21C078F}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe | "{4CB55E83-DCBA-49B0-88E9-959E4EFDD6D5}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe | "{501F2436-E299-4D2A-926F-E44B233FBE03}" = dir=in | app=c:\program files (x86)\cyberlink\powerdirector\pdr.exe | "{7C0308DC-6C1F-4F71-B2E7-525C9248E7C4}" = protocol=17 | dir=in | app=c:\program files (x86)\yahoo!\messenger\yahoomessenger.exe | "{7C8E33A1-3980-492D-A5D4-B9B1B592F434}" = dir=in | app=c:\program files (x86)\bearshare applications\bearshare\bearshare.exe | "{8285FE9C-ED98-47E0-A8D5-72D3C129AD1B}" = protocol=6 | dir=in | app=c:\program files (x86)\bearshare applications\bearshare\bearshare.exe | "{87E6EC17-FCF3-4D29-A1B2-DE29210CC88F}" = dir=in | app=c:\program files (x86)\windows live\messenger\wlcsdk.exe | "{8FD46EDC-10AC-4246-A85A-5414F7C5255C}" = dir=in | app=c:\program files (x86)\hewlett-packard\hp support framework\resources\hpwarrantycheck\hpdevicedetection3.exe | "{95D5353C-A456-474B-ADB4-1FFA9EA34CFC}" = dir=in | app=c:\program files (x86)\windows live\sync\windowslivesync.exe | "{A5E3A268-37B6-488A-8C4B-B0183E849733}" = protocol=6 | dir=in | app=c:\program files (x86)\microsoft office\office12\onenote.exe | "{B116DD68-127D-4B7A-A5C0-D62A0313DE4C}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 | "{BD15ECC7-3C91-4245-B115-29466BC1FEEF}" = dir=in | app=c:\program files (x86)\itunes\itunes.exe | "{BE1AC7C5-D36E-4E18-9B2F-9ED999327686}" = protocol=17 | dir=in | app=c:\program files (x86)\limewire\limewire.exe | "{C21CF18E-DE12-4C7F-8D10-0FE305EBE983}" = dir=in | app=c:\program files (x86)\windows live\messenger\msnmsgr.exe | "{CFB78923-88D1-458A-A5EE-40153F689818}" = dir=in | app=c:\program files (x86)\hp\hp software update\hpwucli.exe | "{D962AA01-DC55-4AB8-A3CD-D055F85F456C}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 | "{E549FD87-3F94-453C-B7B0-A27812FBA109}" = protocol=6 | dir=in | app=c:\program files (x86)\yahoo!\messenger\yahoomessenger.exe | "{EBE307A6-9635-498C-9E3D-A3DFD4AB2281}" = protocol=17 | dir=in | app=c:\program files (x86)\bearshare applications\bearshare\bearshare.exe | "{F890CD97-C2B6-4ECF-BC0B-205029AC21DD}" = protocol=17 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe | "{FE031134-56BE-4B1C-BCC5-5631351CE6DF}" = protocol=6 | dir=in | app=c:\program files (x86)\bonjour\mdnsresponder.exe | "TCP Query User{AC98445E-579A-44ED-850B-29A6D133E3D8}C:\users\nyamuoch\appdata\roaming\imvuclient\1vivoxvoice.exe" = protocol=6 | dir=in | app=c:\users\nyamuoch\appdata\roaming\imvuclient\1vivoxvoice.exe | "UDP Query User{DB4CB53E-EDFC-4749-B067-5E40FF15B07D}C:\users\nyamuoch\appdata\roaming\imvuclient\1vivoxvoice.exe" = protocol=17 | dir=in | app=c:\users\nyamuoch\appdata\roaming\imvuclient\1vivoxvoice.exe | ========== HKEY_LOCAL_MACHINE Uninstall List ========== 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall] "{01D42BF0-ED08-463f-8A28-99EB6FEE962B}" = ZTE Handset USB Driver "{071c9b48-7c32-4621-a0ac-3f809523288f}" = Microsoft Visual C++ 2005 Redistributable (x64) "{26A24AE4-039D-4CA4-87B4-2F86416015FF}" = Java 6 Update 15 (64-bit) "{2F72F540-1F60-4266-9506-952B21D6640D}" = Apple Mobile Device Support "{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 "{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 "{64A3A4F4-B792-11D6-A78A-00B0D0160150}" = Java SE Development Kit 6 Update 15 (64-bit) "{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}" = Bonjour "{704C0303-D20C-45AF-BD2B-556EAF31BE09}" = iCloud "{76FF0F03-B707-4332-B5D1-A56C8303514E}" = iTunes "{8220EEFE-38CD-377E-8595-13398D740ACE}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 "{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight "{8E34682C-8118-31F1-BC4C-98CD9675E1C2}" = Microsoft .NET Framework 4 Extended "{90120000-002A-0000-1000-0000000FF1CE}" = Microsoft Office Office 64-bit Components 2007 "{90120000-002A-0409-1000-0000000FF1CE}" = Microsoft Office Shared 64-bit MUI (English) 2007 "{90120000-0116-0409-1000-0000000FF1CE}" = Microsoft Office Shared 64-bit Setup Metadata MUI (English) 2007 "{95120000-00B9-0409-1000-0000000FF1CE}" = Microsoft Application Error Reporting "{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}" = Microsoft Visual C++ 2005 Redistributable (x64) "{D2D77DC2-8299-11D1-8949-444553540000}_is1" = ZTE Handset USB Driver "{EF5948BA-589D-4BE7-B993-C45DC1A77E24}" = MobileMe Control Panel "{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}" = Microsoft .NET Framework 4 Client Profile "CCleaner" = CCleaner "CNXT_AUDIO_HDA" = Conexant HD Audio "CNXT_MODEM_HDA_HSF" = HDAUDIO Soft Data Fax Modem with SmartCP "HDMI" = Intel® Graphics Media Accelerator Driver "HP Smart Web Printing" = HP Smart Web Printing 4.60 "Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile "Microsoft .NET Framework 4 Extended" = Microsoft .NET Framework 4 Extended "SynTPDeinstKey" = Synaptics Pointing Device Driver [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall] "{0001B4FD-9EA3-4D90-A79E-FD14BA3AB01D}" = PDFCreator "{07FA4960-B038-49EB-891B-9F95930AA544}" = HP Customer Experience Enhancements "{15BC8CD0-A65B-47D0-A2DD-90A824590FA8}" = Microsoft Works "{178832DE-9DE0-4C87-9F82-9315A9B03985}" = Windows Live Writer "{17B4760F-334B-475D-829F-1A3E94A6A4E6}" = HP Setup "{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 "{1FBF6C24-C1FD-4101-A42B-0C564F9E8E79}" = CyberLink DVD Suite "{205C6BDD-7B73-42DE-8505-9A093F35A238}" = Windows Live Upload Tool "{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}" = MSVCRT "{24554447-718C-4EE5-A376-0000014A88D8}" = QuickShare "{26A24AE4-039D-4CA4-87B4-2F83217021FF}" = Java 7 Update 21 "{287ECFA4-719A-2143-A09B-D6A12DE54E40}" = Acrobat.com "{28C2DED6-325B-4CC7-983A-1777C8F7FBAB}" = RealUpgrade 1.1 "{2FA94A64-C84E-49d1-97DD-7BF06C7BBFB2}.WildTangent Games App" = Update Installer for WildTangent Games App "{34B32B70-8081-11E2-89AF-B8AC6F98CCE3}" = Google Earth Plug-in "{34D2AB40-150D-475D-AE32-BD23FB5EE355}" = HP Quick Launch Buttons "{3AE003CD-4111-4D8D-B798-FACFDFCF2991}_is1" = Anarchy Online "{3B4E636E-9D65-4D67-BA61-189800823F52}" = Windows Live Communications Platform "{3D5044A5-97B8-45C0-B956-BB2376569188}" = Windows Live Movie Maker "{40BF1E83-20EB-11D8-97C5-0009C5020658}" = Power2Go "{40FB8D7C-6FF8-4AF2-BC8B-0B1DB32AF04B}" = HP Advisor "{44B2A0AB-412E-4F8C-B058-D1E8AECCDFF5}" = Recovery Manager "{45338B07-A236-4270-9A77-EBB4115517B5}" = Windows Live Sign-in Assistant "{47D7C9B8-BD44-4D2E-9040-E946477B2F9A}" = Microsoft Live Search Toolbar "{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater "{4E432692-A736-4F77-AF77-F9078CF88D31}" = HP Wireless Assistant "{5D09C772-ECB3-442B-9CC6-B4341C78FDC2}" = Apple Application Support "{6412CECE-8172-4BE5-935B-6CECACD2CA87}" = Windows Live Mail "{64A7418C-6BD4-48BE-A2E3-CAEC3BCD9E81}" = HP User Guides 0156 "{6F340107-F9AA-47C6-B54C-C3A19F11553F}" = Hewlett-Packard ACLM.NET v1.2.1.1 "{70B446D1-E03B-4ab0-9B3C-0832142C9AA8}.WildTangent Games App-hp" = WildTangent Games App (HP Games) "{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable "{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable "{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 "{7770E71B-2D43-4800-9CB3-5B6CAAEBEBEA}" = RealNetworks - Microsoft Visual C++ 2008 Runtime "{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}" = Apple Software Update "{80E158EA-7181-40FE-A701-301CE6BE64AB}" = CyberLink MediaShow "{81128EE8-8EAD-4DB0-85C6-17C2CE50FF71}" = Windows Live Essentials "{84EBDF39-4B33-49D7-A0BD-EB6E2C4E81C1}" = Windows Live Sync "{8833FFB6-5B0C-4764-81AA-06DFEED9A476}" = Realtek 8136 8168 8169 Ethernet Driver "{8FF6F5CA-4E30-4E3B-B951-204CAAA2716A}" = SmartWebPrinting "{90120000-0016-0409-0000-0000000FF1CE}" = Microsoft Office Excel MUI (English) 2007 "{90120000-0016-0409-0000-0000000FF1CE}_HOMESTUDENTR_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3) "{90120000-0018-0409-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (English) 2007 "{90120000-0018-0409-0000-0000000FF1CE}_HOMESTUDENTR_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3) "{90120000-001B-0409-0000-0000000FF1CE}" = Microsoft Office Word MUI (English) 2007 "{90120000-001B-0409-0000-0000000FF1CE}_HOMESTUDENTR_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3) "{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007 "{90120000-001F-0409-0000-0000000FF1CE}_HOMESTUDENTR_{1FF96026-A04A-4C3E-B50A-BB7022654D0F}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3) "{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007 "{90120000-001F-040C-0000-0000000FF1CE}_HOMESTUDENTR_{71F055E8-E2C6-4214-BB3D-BFE03561B89E}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3) "{90120000-001F-0C0A-0000-0000000FF1CE}" = Microsoft Office Proof (Spanish) 2007 "{90120000-001F-0C0A-0000-0000000FF1CE}_HOMESTUDENTR_{2314F9A1-126F-45CC-8A5E-DFAF866F3FBC}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3) "{90120000-0020-0409-0000-0000000FF1CE}" = Compatibility Pack for the 2007 Office system "{90120000-002A-0000-1000-0000000FF1CE}_HOMESTUDENTR_{664655D8-B9BB-455D-8A58-7EAF7B0B2862}" = Microsoft Office 2007 Service Pack 3 (SP3) "{90120000-002A-0409-1000-0000000FF1CE}_HOMESTUDENTR_{98333358-268C-4164-B6D4-C96DF5153727}" = Microsoft Office 2007 Service Pack 3 (SP3) "{90120000-002C-0409-0000-0000000FF1CE}" = Microsoft Office Proofing (English) 2007 "{90120000-006E-0409-0000-0000000FF1CE}" = Microsoft Office Shared MUI (English) 2007 "{90120000-006E-0409-0000-0000000FF1CE}_HOMESTUDENTR_{98333358-268C-4164-B6D4-C96DF5153727}" = Microsoft Office 2007 Service Pack 3 (SP3) "{90120000-00A1-0409-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (English) 2007 "{90120000-00A1-0409-0000-0000000FF1CE}_HOMESTUDENTR_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3) "{90120000-0115-0409-0000-0000000FF1CE}" = Microsoft Office Shared Setup Metadata MUI (English) 2007 "{90120000-0115-0409-0000-0000000FF1CE}_HOMESTUDENTR_{98333358-268C-4164-B6D4-C96DF5153727}" = Microsoft Office 2007 Service Pack 3 (SP3) "{90120000-0116-0409-1000-0000000FF1CE}_HOMESTUDENTR_{98333358-268C-4164-B6D4-C96DF5153727}" = Microsoft Office 2007 Service Pack 3 (SP3) "{90140000-2005-0000-0000-0000000FF1CE}" = Microsoft Office File Validation Add-In "{91120000-002F-0000-0000-0000000FF1CE}" = Microsoft Office Home and Student 2007 "{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}" = Microsoft Office 2007 Service Pack 3 (SP3) "{95120000-00AF-0409-0000-0000000FF1CE}" = Microsoft Office PowerPoint Viewer 2007 (English) "{96AE7E41-E34E-47D0-AC07-1091A8127911}" = Realtek USB 2.0 Card Reader "{97486FBE-A3FC-4783-8D55-EA37E9D171CC}" = HP Update "{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 "{9D318C86-AF4C-409F-A6AC-7183FF4CF424}" = Internet TV for Windows Media Center "{A85FD55B-891B-4314-97A5-EA96C0BD80B5}" = Windows Live Messenger "{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper "{AAECF7BA-E83B-4A10-87EA-DE0B333F8734}" = RealNetworks - Microsoft Visual C++ 2010 Runtime "{AC76BA86-7AD7-FFFF-7B44-A91000000001}" = Adobe Reader 9.1 MUI "{AD72CFB4-C2BF-424E-9DF0-C7BAD1F30A11}" = Adobe Shockwave Player "{AF7EBCA4-9FAF-4DC8-8D09-67854BB84D34}" = RealDownloader "{B194272D-1F92-46DF-99EB-8D5CE91CB4EC}" = Adobe AIR "{B4092C6D-E886-4CB2-BA68-FE5A99D31DE7}_is1" = Spybot - Search & Destroy "{B67BAFBA-4C9F-48FA-9496-933E3B255044}" = QuickTime "{C25D3574-3136-4B33-9D32-8F0F5E81F349}" = MGTEK dopisp 6.1 "{C3A32068-8AB1-4327-BB16-BED9C6219DC7}" = Atheros Driver Installation Program "{C59C179C-668D-49A9-B6EA-0121CCFC1243}" = LabelPrint "{C5E7BF75-007E-44AD-8962-627ED44CB63B}" = NaturalReaderFree "{CB099890-1D5F-11D5-9EA9-0050BAE317E1}" = PowerDirector "{D6C75F0B-3BC1-4FC9-B8C5-3F7E8ED059CA}" = Windows Live Photo Gallery "{DF802C05-4660-418c-970C-B988ADB1D316}" = Microsoft Live Search Toolbar "{E2D09AC2-4153-4817-AAEB-24F92A8BCE88}" = Windows Media Center Add-in for Flash "{E2DFE069-083E-4631-9B6C-43C48E991DE5}" = Junk Mail filter update "{E50AE784-FABE-46DA-A1F8-7B6B56DCB22E}" = Microsoft Office Suite Activation Assistant "{E7A8BC75-50A9-32F2-8DFB-C499D21881B7}" = Google Talk Plugin "{EE202411-2C26-49E8-9784-1BC1DBF7DE96}" = HP Support Assistant "{EE7257A2-39A2-4D2F-9DAC-F9F25B8AE1D8}" = Skype™ 5.10 "{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}" = Microsoft SQL Server 2005 Compact Edition [ENU] "{F0E12BBA-AD66-4022-A453-A1C8A0C4D570}" = Microsoft Choice Guard "{F1D7AC58-554A-4A58-B784-B61558B1449A}" = QLBCASL "{F6BD194C-4190-4D73-B1B1-C48C99921BFE}" = Windows Live Call "Adobe AIR" = Adobe AIR "Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX "Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin "Any Video Converter_is1" = Any Video Converter 3.5.7 "FileZilla Client" = FileZilla Client 3.6.0.2 "Google Chrome" = Google Chrome "HOMESTUDENTR" = Microsoft Office Home and Student 2007 "InstallShield_{1FBF6C24-C1FD-4101-A42B-0C564F9E8E79}" = CyberLink DVD Suite "InstallShield_{40BF1E83-20EB-11D8-97C5-0009C5020658}" = Power2Go "InstallShield_{80E158EA-7181-40FE-A701-301CE6BE64AB}" = CyberLink MediaShow "InstallShield_{C59C179C-668D-49A9-B6EA-0121CCFC1243}" = LabelPrint "InstallShield_{CB099890-1D5F-11D5-9EA9-0050BAE317E1}" = PowerDirector "Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware version 1.75.0.1300 "Mozilla Firefox 21.0 (x86 en-US)" = Mozilla Firefox 21.0 (x86 en-US) "Picasa 3" = Picasa 3 "RealPlayer 16.0" = RealPlayer "SeaMonkey 2.16 (x86 en-US)" = SeaMonkey 2.16 (x86 en-US) "WildTangent hp Master Uninstall" = HP Games "WinLiveSuite_Wave3" = Windows Live Essentials "WTA-17e90530-dff3-487c-9e22-e4d006cf78ab" = Ancient Spiders Solitaire "WTA-2747c86d-2796-43b0-a393-d34b3befba23" = House of Cards "WTA-3a5b3f05-44ef-4b6d-bab6-f33997d40999" = Mystery of Shark Island "WTA-f51962ed-10ec-4439-b180-ddad7a9c0feb" = Blasterball 3 ========== HKEY_CURRENT_USER Uninstall List ========== [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall] ========== Last 20 Event Log Errors ========== [ Application Events ] Error - 2/12/2013 10:49:44 PM | Computer Name = Nyamuoch-PC | Source = Application Error | ID = 1000 Description = Faulting application name: realplay.exe, version: 16.0.0.282, time stamp: 0x50b942d6 Faulting module name: mpamedia.dll_unloaded, version: 0.0.0.0, time stamp: 0x50b9428f Exception code: 0xc0000005 Fault offset: 0x5c28b170 Faulting process id: 0x1410 Faulting application start time: 0x01ce09946727e134 Faulting application path: c:\program files (x86)\real\realplayer\realplay.exe Faulting module path: mpamedia.dll Report Id: 04f8076d-7588-11e2-9ab7-00262db82294 Error - 2/12/2013 10:50:23 PM | Computer Name = Nyamuoch-PC | Source = Application Error | ID = 1000 Description = Faulting application name: realplay.exe, version: 16.0.0.282, time stamp: 0x50b942d6 Faulting module name: mpamedia.dll_unloaded, version: 0.0.0.0, time stamp: 0x50b9428f Exception code: 0xc0000005 Fault offset: 0x5c23548b Faulting process id: 0x1410 Faulting application start time: 0x01ce09946727e134 Faulting application path: c:\program files (x86)\real\realplayer\realplay.exe Faulting module path: mpamedia.dll Report Id: 1c4e2fc6-7588-11e2-9ab7-00262db82294 Error - 2/12/2013 11:28:30 PM | Computer Name = Nyamuoch-PC | Source = SideBySide | ID = 16842787 Description = Activation context generation failed for "c:\program files (x86)\windows live\photo gallery\MovieMaker.Exe".Error in manifest or policy file "c:\program files (x86)\windows live\photo gallery\WLMFDS.DLL" on line 8. Component identity found in manifest does not match the identity of the component requested. Reference is WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1". Definition is WLMFDS,processorArchitecture="x86",type="win32",version="1.0.0.1". Please use sxstrace.exe for detailed diagnosis. Error - 2/12/2013 11:29:08 PM | Computer Name = Nyamuoch-PC | Source = SideBySide | ID = 16842785 Description = Activation context generation failed for "C:\Windows\Installer\{AF7EBCA4-9FAF-4DC8-8D09-67854BB84D34}\recordingmanager.exe". Dependent Assembly rpshellextension.1.0,language="*",type="win32",version="1.0.0.0" could not be found. Please use sxstrace.exe for detailed diagnosis. Error - 2/13/2013 2:30:00 AM | Computer Name = Nyamuoch-PC | Source = SideBySide | ID = 16842787 Description = Activation context generation failed for "C:\Program Files (x86)\Windows Live\Photo Gallery\MovieMaker.Exe".Error in manifest or policy file "C:\Program Files (x86)\Windows Live\Photo Gallery\WLMFDS.DLL" on line 8. Component identity found in manifest does not match the identity of the component requested. Reference is WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1". Definition is WLMFDS,processorArchitecture="x86",type="win32",version="1.0.0.1". Please use sxstrace.exe for detailed diagnosis. Error - 2/13/2013 2:30:00 AM | Computer Name = Nyamuoch-PC | Source = SideBySide | ID = 16842787 Description = Activation context generation failed for "C:\Program Files (x86)\Windows Live\Photo Gallery\MovieMaker.Exe".Error in manifest or policy file "C:\Program Files (x86)\Windows Live\Photo Gallery\WLMFDS.DLL" on line 8. Component identity found in manifest does not match the identity of the component requested. Reference is WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1". Definition is WLMFDS,processorArchitecture="x86",type="win32",version="1.0.0.1". Please use sxstrace.exe for detailed diagnosis. Error - 2/13/2013 3:24:12 AM | Computer Name = Nyamuoch-PC | Source = SideBySide | ID = 16842787 Description = Activation context generation failed for "c:\program files (x86)\windows live\photo gallery\MovieMaker.Exe".Error in manifest or policy file "c:\program files (x86)\windows live\photo gallery\WLMFDS.DLL" on line 8. Component identity found in manifest does not match the identity of the component requested. Reference is WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1". Definition is WLMFDS,processorArchitecture="x86",type="win32",version="1.0.0.1". Please use sxstrace.exe for detailed diagnosis. Error - 2/13/2013 4:39:40 AM | Computer Name = Nyamuoch-PC | Source = SideBySide | ID = 16842787 Description = Activation context generation failed for "c:\program files (x86)\windows live\photo gallery\MovieMaker.Exe".Error in manifest or policy file "c:\program files (x86)\windows live\photo gallery\WLMFDS.DLL" on line 8. Component identity found in manifest does not match the identity of the component requested. Reference is WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1". Definition is WLMFDS,processorArchitecture="x86",type="win32",version="1.0.0.1". Please use sxstrace.exe for detailed diagnosis. Error - 2/13/2013 4:40:03 AM | Computer Name = Nyamuoch-PC | Source = SideBySide | ID = 16842785 Description = Activation context generation failed for "C:\Windows\Installer\{AF7EBCA4-9FAF-4DC8-8D09-67854BB84D34}\recordingmanager.exe". Dependent Assembly rpshellextension.1.0,language="*",type="win32",version="1.0.0.0" could not be found. Please use sxstrace.exe for detailed diagnosis. Error - 2/13/2013 5:03:06 AM | Computer Name = Nyamuoch-PC | Source = Windows Search Service | ID = 3007 Description = [ Hewlett-Packard Events ] Error - 4/19/2010 12:03:37 PM | Computer Name = Nyamuoch-PC | Source = Hewlett-Packard | ID = 0 Description = en-US Could not find file 'C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Logs\SystemInfoAA.xml'. mscorlib at System.IO.__Error.WinIOError(Int32 errorCode, String maybeFullPath) at System.IO.FileStream.Init(String path, FileMode mode, FileAccess access, Int32 rights, Boolean useRights, FileShare share, Int32 bufferSize, FileOptions options, SECURITY_ATTRIBUTES secAttrs, String msgPath, Boolean bFromProxy) at System.IO.FileStream..ctor(String path, FileMode mode, FileAccess access, FileShare share, Int32 bufferSize, FileOptions options, String msgPath, Boolean bFromProxy) at System.IO.FileStream..ctor(String path, FileMode mode, FileAccess access, FileShare share, Int32 bufferSize, FileOptions options) at System.IO.StreamReader..ctor(String path, Encoding encoding, Boolean detectEncodingFromByteOrderMarks, Int32 bufferSize) at System.IO.StreamReader..ctor(String path, Encoding encoding) at System.IO.File.ReadAllText(String path, Encoding encoding) at n.a(Object A_0, EventArgs A_1) Error - 4/19/2010 12:03:38 PM | Computer Name = Nyamuoch-PC | Source = Hewlett-Packard | ID = 0 Description = en-US Could not find file 'C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Logs\SystemInfoAA.xml'. mscorlib at System.IO.__Error.WinIOError(Int32 errorCode, String maybeFullPath) at System.IO.FileStream.Init(String path, FileMode mode, FileAccess access, Int32 rights, Boolean useRights, FileShare share, Int32 bufferSize, FileOptions options, SECURITY_ATTRIBUTES secAttrs, String msgPath, Boolean bFromProxy) at System.IO.FileStream..ctor(String path, FileMode mode, FileAccess access, FileShare share, Int32 bufferSize, FileOptions options, String msgPath, Boolean bFromProxy) at System.IO.FileStream..ctor(String path, FileMode mode, FileAccess access, FileShare share, Int32 bufferSize, FileOptions options) at System.IO.StreamReader..ctor(String path, Encoding encoding, Boolean detectEncodingFromByteOrderMarks, Int32 bufferSize) at System.IO.StreamReader..ctor(String path, Encoding encoding) at System.IO.File.ReadAllText(String path, Encoding encoding) at n.a(Object A_0, EventArgs A_1) Error - 7/14/2010 8:31:49 PM | Computer Name = Nyamuoch-PC | Source = Hewlett-Packard | ID = 0 Description = en-US Could not find file 'C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Logs\SystemInfoAA.xml'. mscorlib at System.IO.__Error.WinIOError(Int32 errorCode, String maybeFullPath) at System.IO.FileStream.Init(String path, FileMode mode, FileAccess access, Int32 rights, Boolean useRights, FileShare share, Int32 bufferSize, FileOptions options, SECURITY_ATTRIBUTES secAttrs, String msgPath, Boolean bFromProxy) at System.IO.FileStream..ctor(String path, FileMode mode, FileAccess access, FileShare share, Int32 bufferSize, FileOptions options, String msgPath, Boolean bFromProxy) at System.IO.FileStream..ctor(String path, FileMode mode, FileAccess access, FileShare share, Int32 bufferSize, FileOptions options) at System.IO.StreamReader..ctor(String path, Encoding encoding, Boolean detectEncodingFromByteOrderMarks, Int32 bufferSize) at System.IO.StreamReader..ctor(String path, Encoding encoding) at System.IO.File.ReadAllText(String path, Encoding encoding) at n.a() Error - 8/18/2010 8:25:23 PM | Computer Name = Nyamuoch-PC | Source = Hewlett-Packard | ID = 0 Description = en-US Could not find file 'C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Logs\SystemInfoAA.xml'. mscorlib at System.IO.__Error.WinIOError(Int32 errorCode, String maybeFullPath) at System.IO.FileStream.Init(String path, FileMode mode, FileAccess access, Int32 rights, Boolean useRights, FileShare share, Int32 bufferSize, FileOptions options, SECURITY_ATTRIBUTES secAttrs, String msgPath, Boolean bFromProxy) at System.IO.FileStream..ctor(String path, FileMode mode, FileAccess access, FileShare share, Int32 bufferSize, FileOptions options, String msgPath, Boolean bFromProxy) at System.IO.FileStream..ctor(String path, FileMode mode, FileAccess access, FileShare share, Int32 bufferSize, FileOptions options) at System.IO.StreamReader..ctor(String path, Encoding encoding, Boolean detectEncodingFromByteOrderMarks, Int32 bufferSize) at System.IO.StreamReader..ctor(String path, Encoding encoding) at System.IO.File.ReadAllText(String path, Encoding encoding) at n.a() Error - 8/23/2010 7:54:59 PM | Computer Name = Nyamuoch-PC | Source = Hewlett-Packard | ID = 0 Description = en-US Could not find file 'C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Logs\SystemInfoAA.xml'. mscorlib at System.IO.__Error.WinIOError(Int32 errorCode, String maybeFullPath) at System.IO.FileStream.Init(String path, FileMode mode, FileAccess access, Int32 rights, Boolean useRights, FileShare share, Int32 bufferSize, FileOptions options, SECURITY_ATTRIBUTES secAttrs, String msgPath, Boolean bFromProxy) at System.IO.FileStream..ctor(String path, FileMode mode, FileAccess access, FileShare share, Int32 bufferSize, FileOptions options, String msgPath, Boolean bFromProxy) at System.IO.FileStream..ctor(String path, FileMode mode, FileAccess access, FileShare share, Int32 bufferSize, FileOptions options) at System.IO.StreamReader..ctor(String path, Encoding encoding, Boolean detectEncodingFromByteOrderMarks, Int32 bufferSize) at System.IO.StreamReader..ctor(String path, Encoding encoding) at System.IO.File.ReadAllText(String path, Encoding encoding) at n.a() Error - 8/25/2010 7:25:55 PM | Computer Name = Nyamuoch-PC | Source = Hewlett-Packard | ID = 0 Description = en-US Could not find file 'C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Logs\SystemInfoAA.xml'. mscorlib at System.IO.__Error.WinIOError(Int32 errorCode, String maybeFullPath) at System.IO.FileStream.Init(String path, FileMode mode, FileAccess access, Int32 rights, Boolean useRights, FileShare share, Int32 bufferSize, FileOptions options, SECURITY_ATTRIBUTES secAttrs, String msgPath, Boolean bFromProxy) at System.IO.FileStream..ctor(String path, FileMode mode, FileAccess access, FileShare share, Int32 bufferSize, FileOptions options, String msgPath, Boolean bFromProxy) at System.IO.FileStream..ctor(String path, FileMode mode, FileAccess access, FileShare share, Int32 bufferSize, FileOptions options) at System.IO.StreamReader..ctor(String path, Encoding encoding, Boolean detectEncodingFromByteOrderMarks, Int32 bufferSize) at System.IO.StreamReader..ctor(String path, Encoding encoding) at System.IO.File.ReadAllText(String path, Encoding encoding) at n.a() Error - 1/12/2011 8:12:12 PM | Computer Name = Nyamuoch-PC | Source = Hewlett-Packard | ID = 0 Description = AAProcessExited() C:\ProgramData\Hewlett-Packard\HP Support Framework\Telemetry\011112061209.xml File not created by asset agent [ Media Center Events ] Error - 5/17/2013 2:11:06 AM | Computer Name = Nyamuoch-PC | Source = MCUpdate | ID = 0 Description = 10:11:06 PM - Failed to retrieve MCESpotlight (Error: The request failed with HTTP status 403: Forbidden.) Error - 5/17/2013 2:11:06 AM | Computer Name = Nyamuoch-PC | Source = MCUpdate | ID = 0 Description = 10:11:06 PM - Failed to retrieve MCEClientUX (Error: The request failed with HTTP status 403: Forbidden.) Error - 5/17/2013 2:11:07 AM | Computer Name = Nyamuoch-PC | Source = MCUpdate | ID = 0 Description = 10:11:07 PM - Failed to retrieve SportsSchedule (Error: The request failed with HTTP status 403: Forbidden.) Error - 5/17/2013 2:11:07 AM | Computer Name = Nyamuoch-PC | Source = MCUpdate | ID = 0 Description = 10:11:07 PM - Failed to retrieve SportsV2 (Error: The request failed with HTTP status 403: Forbidden.) Error - 5/17/2013 2:11:32 AM | Computer Name = Nyamuoch-PC | Source = MCUpdate | ID = 0 Description = 10:11:07 PM - Failed to retrieve Broadband (Error: The request failed with HTTP status 403: Forbidden.) Error - 5/17/2013 10:25:28 AM | Computer Name = Nyamuoch-PC | Source = MCUpdate | ID = 0 Description = 6:25:28 AM - Failed to retrieve Directory (Error: The request failed with HTTP status 403: Forbidden.) Error - 5/17/2013 10:25:29 AM | Computer Name = Nyamuoch-PC | Source = MCUpdate | ID = 0 Description = 6:25:29 AM - Failed to retrieve NetTV (Error: The request failed with HTTP status 403: Forbidden.) Error - 5/17/2013 10:25:30 AM | Computer Name = Nyamuoch-PC | Source = MCUpdate | ID = 0 Description = 6:25:30 AM - Failed to retrieve MCESpotlight (Error: Invalid security token.) Error - 5/17/2013 10:26:10 AM | Computer Name = Nyamuoch-PC | Source = MCUpdate | ID = 0 Description = 6:26:10 AM - Failed to retrieve SportsSchedule (Error: The request failed with HTTP status 403: Forbidden.) Error - 5/17/2013 10:26:31 AM | Computer Name = Nyamuoch-PC | Source = MCUpdate | ID = 0 Description = 6:26:23 AM - Failed to retrieve Broadband (Error: The request failed with HTTP status 403: Forbidden.) [ System Events ] Error - 6/18/2013 10:49:21 PM | Computer Name = justinsmith | Source = cdrom | ID = 262155 Description = The driver detected a controller error on \Device\CdRom0. Error - 6/18/2013 10:50:12 PM | Computer Name = justinsmith | Source = cdrom | ID = 262155 Description = The driver detected a controller error on \Device\CdRom0. Error - 6/18/2013 10:51:09 PM | Computer Name = justinsmith | Source = cdrom | ID = 262155 Description = The driver detected a controller error on \Device\CdRom0. Error - 6/18/2013 10:52:01 PM | Computer Name = justinsmith | Source = cdrom | ID = 262155 Description = The driver detected a controller error on \Device\CdRom0. Error - 6/18/2013 10:53:01 PM | Computer Name = justinsmith | Source = DCOM | ID = 10010 Description = Error - 6/18/2013 10:56:09 PM | Computer Name = justinsmith | Source = Service Control Manager | ID = 7000 Description = The SBSD Security Center Service service failed to start due to the following error: %%2 Error - 6/18/2013 10:56:10 PM | Computer Name = justinsmith | Source = Service Control Manager | ID = 7026 Description = The following boot-start or system-start driver(s) failed to load: cdrom < End of report >
  18. justime
    hjt log Logfile of Trend Micro HijackThis v2.0.5 Scan saved at 9:16:35 PM, on 6/12/2013 Platform: Windows 7 SP1 (WinNT 6.00.3505) MSIE: Internet Explorer v10.0 (10.00.9200.16611) FIREFOX: 21.0 (en-US) Boot mode: Normal Running processes: C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch Buttons\QLBCTRL.exe C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe C:\Program Files (x86)\iTunes\iTunesHelper.exe C:\Program Files (x86)\Real\RealPlayer\Update\realsched.exe C:\Program Files (x86)\Hewlett-Packard\Shared\hpqToaster.exe C:\Users\Administrator\Downloads\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://g.msn.com/CQNOT/1 R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://search.bearshare.net?appid=717 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/p/?LinkId=255141 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/p/?LinkId=255141 R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = F2 - REG:system.ini: UserInit=userinit.exe, O1 - Hosts: 74.208.10.249 gs.apple.com O2 - BHO: HP Print Enhancer - {0347C33E-8762-4905-BF09-768834316C61} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll O2 - BHO: Search-Results Toolbar - {15a0413e-9f45-4d45-9a75-2c20b15b5b51} - C:\PROGRA~2\SEARCH~2\Datamngr\SRTOOL~1\searchresultsDx.dll O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll O2 - BHO: RealNetworks Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\IE\rndlbrowserrecordplugin.dll O2 - BHO: Java Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O2 - BHO: Microsoft Live Search Toolbar Helper - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - c:\Program Files (x86)\MSN\Toolbar\3.0.0566.0\msneshellx.dll O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll O2 - BHO: HP Network Check Helper - {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} - C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPlugin.dll O2 - BHO: HP Smart BHO Class - {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll O3 - Toolbar: Microsoft Live Search Toolbar - {1E61ED7C-7CB8-49d6-B9E9-AB4C880C8414} - c:\Program Files (x86)\MSN\Toolbar\3.0.0566.0\msneshellx.dll O3 - Toolbar: Search-Results Toolbar - {15a0413e-9f45-4d45-9a75-2c20b15b5b51} - C:\PROGRA~2\SEARCH~2\Datamngr\SRTOOL~1\searchresultsDx.dll O4 - HKLM\..\Run: [QlbCtrl.exe] C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start O4 - HKLM\..\Run: [WirelessAssistant] C:\Program Files (x86)\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe O4 - HKLM\..\Run: [HP Software Update] C:\Program Files (x86)\Hp\HP Software Update\HPWuSchd2.exe O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files (x86)\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files (x86)\Real\RealPlayer\update\realsched.exe" -osboot O4 - HKLM\..\Run: [DATAMNGR] C:\PROGRA~2\SEARCH~2\Datamngr\DATAMN~2.EXE O4 - HKUS\S-1-5-19\..\Run: [sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'LOCAL SERVICE') O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'LOCAL SERVICE') O4 - HKUS\S-1-5-20\..\Run: [sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'NETWORK SERVICE') O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'NETWORK SERVICE') O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\Windows\system32\GPhotos.scr/200 O9 - Extra button: Blog This - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll O9 - Extra 'Tools' menuitem: &Blog This in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll O9 - Extra button: @C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPlugin.dll,-103 - {25510184-5A38-4A99-B273-DCA8EEF6CD08} - C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\NCLauncherFromIE.exe O9 - Extra 'Tools' menuitem: @C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPlugin.dll,-102 - {25510184-5A38-4A99-B273-DCA8EEF6CD08} - C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\NCLauncherFromIE.exe O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~4\Office12\ONBttnIE.dll O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~4\Office12\ONBttnIE.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~2\MICROS~4\Office12\REFIEBAR.DLL O9 - Extra button: Show or hide HP Smart Web Printing - {DDE87865-83C5-48c4-8357-2F5B1AA84522} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics O16 - DPF: {24DCAB5D-AB40-440F-9CF8-DF2F406FD3DD} (xc_loader_activex.cntMain) - http://www.stcloudstate.edu/XpressConnect/tools/xc_loader_activex.ocx O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} - http://download.divx.com/player/DivXBrowserPlugin.cab O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL O20 - AppInit_DLLs: C:\PROGRA~3\Wincert\WIN32C~1.DLL C:\PROGRA~2\SEARCH~2\Datamngr\mgrldr.dll O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing) O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe O23 - Service: Search Protect by Conduit Updater (CltMngSvc) - Conduit - C:\Program Files (x86)\SearchProtect\bin\CltMngSvc.exe O23 - Service: Com4QLBEx - Hewlett-Packard Development Company, L.P. - C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch Buttons\Com4QLBEx.exe O23 - Service: Datamngr Coordinator (DatamngrCoordinator) - Musiclab LLC. - C:\Program Files (x86)\Search Results Toolbar\Datamngr\DatamngrCoordinator.exe O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing) O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing) O23 - Service: GamesAppService - WildTangent, Inc. - C:\Program Files (x86)\WildTangent Games\App\GamesAppService.exe O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe O23 - Service: Google Update Service (gupdatem) (gupdatem) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files (x86)\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: HP Support Assistant Service - Hewlett-Packard Company - C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe O23 - Service: HP Quick Synchronization Service (HPDrvMntSvc.exe) - Hewlett-Packard Company - C:\Program Files (x86)\Hewlett-Packard\Shared\HPDrvMntSvc.exe O23 - Service: HP Software Framework Service (hpqwmiex) - Hewlett-Packard Company - C:\Program Files (x86)\Hewlett-Packard\Shared\hpqwmiex.exe O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing) O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing) O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing) O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing) O23 - Service: RealNetworks Downloader Resolver Service - Unknown owner - C:\Program Files (x86)\RealNetworks\RealDownloader\rndlresolversvc.exe O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files (x86)\CyberLink\Shared files\RichVideo.exe O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing) O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing) O23 - Service: SBSD Security Center Service (SBSDWSCService) - Unknown owner - C:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe (file missing) O23 - Service: Skype Updater (SkypeUpdate) - Skype Technologies - C:\Program Files (x86)\Skype\Updater\Updater.exe O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing) O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing) O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing) O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing) O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing) O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing) O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing) O23 - Service: @%SystemRoot%\system32\Wat\WatUX.exe,-601 (WatAdminSvc) - Unknown owner - C:\Windows\system32\Wat\WatAdminSvc.exe (file missing) O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing) O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing) O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing) -- End of file - 11920 bytes
Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.