puma17

Sorry for the late response but it seems to have corrected itself and am no longer getting the infection after scanning. Thanks for all the help

I uninstalled using your tool and reinstalled the free version and still get the same issue after scanning Registry Keys Detected: 1 HKLM\SOFTWARE\Wow6432Node\Updater By SweetPacks (PUP.Optional.SweetPacks.A) -> Delete on reboot.

I uninstalled using your tool and reinstalled the free version and still get the same issue after scanning Registry Keys Detected: 1 HKLM\SOFTWARE\Wow6432Node\Updater By SweetPacks (PUP.Optional.SweetPacks.A) -> Delete on reboot.

I scanned my system with MBAM and the following still keeps being found each time after deleting and rebooting Registry Keys Detected: 1 HKLM\SOFTWARE\Wow6432Node\Updater By SweetPacks (PUP.Optional.SweetPacks.A)

Did everything you said and ran ESET - no threats were found. I am scanning with MBAM and will post the files I find

Here is the report SystemLook 30.07.11 by jpshortstuff Log created at 07:07 on 17/10/2013 by peter Administrator - Elevation successful ========== regfind ========== Searching for "SweetPacks " No data found. -= EOF =-

Here is the report from the MBAM and Hijack this. You will note that the MBAM file still shows reference to the sweetpack and if reboot, and scan it, it still shows it again. System seems to still be running fine. MBAM still keeps finding the below Registry Keys Detected: 1 HKLM\SOFTWARE\Wow6432Node\Updater By SweetPacks (PUP.Optional.SweetPacks.A) Protection: Enabled 10/16/2013 6:58:40 PM mbam-log-2013-10-16 (18-58-40).txt Scan type: Quick scan Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM Scan options disabled: P2P Objects scanned: 184368 Time elapsed: 6 minute(s), 16 second(s) Memory Processes Detected: 0 (No malicious items detected) Memory Modules Detected: 0 (No malicious items detected) Registry Keys Detected: 1 HKLM\SOFTWARE\Wow6432Node\Updater By SweetPacks (PUP.Optional.SweetPacks.A) -> Delete on reboot. Registry Values Detected: 0 (No malicious items detected) Registry Data Items Detected: 0 (No malicious items detected) Folders Detected: 0 (No malicious items detected) Files Detected: 0 (No malicious items detected) (end) Hijack This Logfile of Trend Micro HijackThis v2.0.4 Scan saved at 9:28:10 PM, on 10/16/13 Platform: Windows Vista SP2 (WinNT 6.00.1906) MSIE: Internet Explorer v9.00 (9.00.8112.16514) Boot mode: Normal Running processes: C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe C:\Windows\system32\Dwm.exe C:\Windows\Explorer.EXE C:\Windows\RtHDVCpl.exe C:\Program Files\AVG\AVG2013\avgui.exe C:\Program Files\Common Files\Research In Motion\USB Drivers\RIMBBLaunchAgent.exe C:\Program Files\Common Files\Research In Motion\Tunnel Manager\PeerManager.exe C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe C:\Program Files\Time Warner Cable\TWC WiFi\TrayApp.exe C:\Program Files\Adobe\Acrobat 11.0\Acrobat\acrotray.exe C:\Program Files\Windows Media Player\wmpnscfg.exe C:\Windows\system32\taskeng.exe C:\Program Files\Time Warner Cable\TWC WiFi\TWC WiFi.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Windows\system32\SearchFilterHost.exe C:\Users\Peter_2\Downloads\HijackThis.exe C:\Users\Peter_2\Desktop\HijackThis.exe R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaults/sb/msgr8/*http://www.yahoo.com/ext/search/search.html R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.com/customize/ie/defaults/su/msgr8/*http://www.yahoo.com R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll O2 - BHO: Java Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll O2 - BHO: Adobe Acrobat Create PDF Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Common Files\Adobe\Acrobat\WCIEActiveX\AcroIEFavClient.dll O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll O2 - BHO: SmartSelect - {F4971EE7-DAA0-4053-9964-665D8EE6A077} - C:\Program Files\Common Files\Adobe\Acrobat\WCIEActiveX\AcroIEFavClient.dll O3 - Toolbar: Adobe Acrobat Create PDF Toolbar - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Common Files\Adobe\Acrobat\WCIEActiveX\AcroIEFavClient.dll O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe O4 - HKLM\..\Run: [AVG_UI] "C:\Program Files\AVG\AVG2013\avgui.exe" /TRAYONLY O4 - HKLM\..\Run: [RIMBBLaunchAgent.exe] C:\Program Files\Common Files\Research In Motion\USB Drivers\RIMBBLaunchAgent.exe O4 - HKLM\..\Run: [RIM PeerManager] "C:\Program Files\Common Files\Research In Motion\Tunnel Manager\PeerManager.exe" O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" O4 - HKLM\..\Run: [DigiDo] "C:\Program Files\Time Warner Cable\TWC WiFi\TrayApp.exe" startup O4 - HKLM\..\Run: [AdobeAAMUpdater-1.0] "C:\Program Files\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe" O4 - HKLM\..\Run: [Acrobat Assistant 8.0] "C:\Program Files\Adobe\Acrobat 11.0\Acrobat\Acrotray.exe" O4 - HKLM\..\Run: [switchBoard] C:\Program Files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe O4 - HKLM\..\Run: [AdobeCS6ServiceManager] "C:\Program Files\Common Files\Adobe\CS6ServiceManager\CS6ServiceManager.exe" -launchedbylogin O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe" O4 - HKLM\..\RunOnce: [Malwarebytes Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe /install /silent O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll O9 - Extra button: Run WinHTTrack - {36ECAF82-3300-8F84-092E-AFF36D6C7040} - C:\Program Files\WinHTTrack\WinHTTrackIEBar.dll O9 - Extra 'Tools' menuitem: Launch WinHTTrack - {36ECAF82-3300-8F84-092E-AFF36D6C7040} - C:\Program Files\WinHTTrack\WinHTTrackIEBar.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL O10 - Unknown file in Winsock LSP: c:\program files\vmware\vmware player\vsocklib.dll O10 - Unknown file in Winsock LSP: c:\program files\vmware\vmware player\vsocklib.dll O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics O17 - HKLM\System\CCS\Services\Tcpip\..\{79470AA1-A7E0-47DD-A805-B910433C643B}: NameServer = 4.2.2.2,4.2.2.3 O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\Windows\system32\browseui.dll O23 - Service: Adobe Acrobat Update Service (AdobeARMservice) - Adobe Systems Incorporated - C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe O23 - Service: AffinegyService - Affinegy, Inc. - C:\Program Files\Time Warner Cable\TWC WiFi\AffinegyService.exe O23 - Service: AVGIDSAgent - AVG Technologies CZ, s.r.o. - C:\Program Files\AVG\AVG2013\avgidsagent.exe O23 - Service: AVG WatchDog (avgwd) - AVG Technologies CZ, s.r.o. - C:\Program Files\AVG\AVG2013\avgwdsvc.exe O23 - Service: B's Recorder GOLD Library General Service (bgsvcgen) - B.H.A Corporation - C:\Windows\System32\bgsvcgen.exe O23 - Service: BlackBerry Device Manager - Research In Motion Limited - C:\Program Files\Common Files\Research In Motion\USB Drivers\BbDevMgr.exe O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe O23 - Service: BrSplService (Brother XP spl Service) - brother Industries Ltd - C:\Windows\system32\brsvc01a.exe O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe O23 - Service: Google Update Service (gupdatem) (gupdatem) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe O23 - Service: HP Health Check Service - Hewlett-Packard - c:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - c:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - c:\Program Files\Common Files\LightScribe\LSSrvc.exe O23 - Service: LMIGuardianSvc - LogMeIn, Inc. - C:\Program Files\LogMeIn\x86\LMIGuardianSvc.exe O23 - Service: MBAMService - Malwarebytes Corporation - C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe O23 - Service: Mozilla Maintenance Service (MozillaMaintenance) - Mozilla Foundation - C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32\nvvsvc.exe O23 - Service: Realtek92SU - Realtek - C:\Program Files\Airlink101\Airlink101 WLAN Monitor\RtlService.exe O23 - Service: RIM MDNS - Apple Inc. - C:\Program Files\Common Files\Research In Motion\Tunnel Manager\mDNSResponder.exe O23 - Service: BlackBerry Link Communication Manager (RIM Tunnel Service) - Research In Motion Limited - C:\Program Files\Common Files\Research In Motion\Tunnel Manager\tunmgr.exe O23 - Service: Skype Updater (SkypeUpdate) - Skype Technologies - C:\Program Files\Skype\Updater\Updater.exe O23 - Service: STI Simulator - Unknown owner - C:\Windows\System32\PAStiSvc.exe O23 - Service: stllssvr - MicroVision Development, Inc. - c:\Program Files\Common Files\SureThing Shared\stllssvr.exe O23 - Service: Adobe SwitchBoard (SwitchBoard) - Adobe Systems Incorporated - C:\Program Files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe O23 - Service: VMware Agent Service (ufad-ws60) - VMware, Inc. - C:\Program Files\VMware\VMware Player\vmware-ufad.exe O23 - Service: VMware Authorization Service (VMAuthdService) - VMware, Inc. - C:\Program Files\VMware\VMware Player\vmware-authd.exe O23 - Service: VMware DHCP Service (VMnetDHCP) - VMware, Inc. - C:\Windows\system32\vmnetdhcp.exe O23 - Service: VMware NAT Service - VMware, Inc. - C:\Windows\system32\vmnat.exe O23 - Service: vToolbarUpdater17.0.12 - Unknown owner - C:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater\17.0.12\ToolbarUpdater.exe (file missing) O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe -- End of file - 10070 bytes

Here is the result for the custom script run per your request ========== OTL ========== Registry value HKEY_USERS\S-1-5-21-4081648169-590389797-1165956351-1001\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{2318C2B1-4965-11D4-9B18-009027A5CD4F} deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2318C2B1-4965-11D4-9B18-009027A5CD4F}\ not found. Registry value HKEY_USERS\S-1-5-21-4081648169-590389797-1165956351-1001\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{3041D03E-FD4B-44E0-B742-2D9B88305F98} deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3041D03E-FD4B-44E0-B742-2D9B88305F98}\ not found. Registry key HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\MenuExt\Free YouTube Download\ deleted successfully. Registry key HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\MenuExt\Free YouTube to Mp3 Converter\ deleted successfully. Starting removal of ActiveX control {67DABFBF-D0AB-41FA-9C46-CC0F21721616} C:\Windows\Downloaded Program Files\DivXPlugin.inf not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{67DABFBF-D0AB-41FA-9C46-CC0F21721616}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{67DABFBF-D0AB-41FA-9C46-CC0F21721616}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{67DABFBF-D0AB-41FA-9C46-CC0F21721616}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{67DABFBF-D0AB-41FA-9C46-CC0F21721616}\ not found. Starting removal of ActiveX control {E2883E8F-472F-4FB0-9522-AC9BF37916A7} C:\Windows\Downloaded Program Files\gp.inf not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{E2883E8F-472F-4FB0-9522-AC9BF37916A7}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E2883E8F-472F-4FB0-9522-AC9BF37916A7}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{E2883E8F-472F-4FB0-9522-AC9BF37916A7}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E2883E8F-472F-4FB0-9522-AC9BF37916A7}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\linkscanner\ deleted successfully. File Protocol\Handler\linkscanner - No CLSID value found not found. ========== FILES ========== < ipconfig /flushdns /c > Windows IP Configuration Successfully flushed the DNS Resolver Cache. C:\Users\Peter_2\Desktop\cmd.bat deleted successfully. C:\Users\Peter_2\Desktop\cmd.txt deleted successfully. ========== COMMANDS ========== [EMPTYJAVA] User: All Users User: Default User: Default User User: Guest ->Java cache emptied: 0 bytes User: peter ->Java cache emptied: 0 bytes User: Peter_2 ->Java cache emptied: 0 bytes User: Public Total Java Files Cleaned = 0.00 mb [EMPTYFLASH] User: All Users User: Default ->Flash cache emptied: 58264 bytes User: Default User ->Flash cache emptied: 0 bytes User: Guest ->Flash cache emptied: 1288 bytes User: peter ->Flash cache emptied: 11414 bytes User: Peter_2 ->Flash cache emptied: 60575 bytes User: Public Total Flash Files Cleaned = 0.00 mb OTL by OldTimer - Version 3.2.69.0 log created on 10162013_070710

Attached below is the log for OTL.txt OTL logfile created on: 10/15/13 7:12:42 AM - Run 1 OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\Peter_2\Desktop Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation Internet Explorer (Version = 9.0.8112.16421) Locale: 00000409 | Country: United States | Language: ENU | Date Format: MM/dd/yy 2.94 Gb Total Physical Memory | 1.25 Gb Available Physical Memory | 42.50% Memory free 6.09 Gb Paging File | 4.50 Gb Available in Paging File | 73.80% Paging File free Paging file location(s): ?:\pagefile.sys %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files Drive C: | 102.95 Gb Total Space | 16.04 Gb Free Space | 15.58% Space Free | Partition Type: NTFS Drive D: | 8.84 Gb Total Space | 1.23 Gb Free Space | 13.96% Space Free | Partition Type: NTFS Computer Name: PETER-PC | User Name: peter | Logged in as Administrator. Boot Mode: Normal | Scan Mode: All users Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days ========== Processes (SafeList) ========== PRC - C:\Users\Peter_2\Desktop\OTL.exe (OldTimer Tools) PRC - C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation) PRC - C:\Program Files\AVG\AVG2013\avgui.exe (AVG Technologies CZ, s.r.o.) PRC - C:\Program Files\AVG\AVG2013\avgwdsvc.exe (AVG Technologies CZ, s.r.o.) PRC - C:\Program Files\AVG\AVG2013\avgcsrvx.exe (AVG Technologies CZ, s.r.o.) PRC - C:\Program Files\AVG\AVG2013\avgrsx.exe (AVG Technologies CZ, s.r.o.) PRC - C:\Program Files\AVG\AVG2013\avgnsx.exe (AVG Technologies CZ, s.r.o.) PRC - C:\Program Files\AVG\AVG2013\avgidsagent.exe (AVG Technologies CZ, s.r.o.) PRC - C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated) PRC - C:\Program Files\Common Files\Research In Motion\Tunnel Manager\PeerManager.exe (Research In Motion Limited) PRC - C:\Program Files\Common Files\Research In Motion\Tunnel Manager\mDNSResponder.exe (Apple Inc.) PRC - C:\Program Files\Common Files\Research In Motion\Tunnel Manager\tunmgr.exe (Research In Motion Limited) PRC - C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation) PRC - C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation) PRC - C:\Program Files\Time Warner Cable\TWC WiFi\TrayApp.exe (Affinegy, Inc.) PRC - C:\Program Files\Time Warner Cable\TWC WiFi\AffinegyService.exe (Affinegy, Inc.) PRC - C:\Program Files\Time Warner Cable\TWC WiFi\TWC WiFi.exe (Affinegy, Inc.) PRC - C:\Program Files\AVG\AVG2013\avgcfgex.exe (AVG Technologies CZ, s.r.o.) PRC - C:\Program Files\Common Files\Research In Motion\USB Drivers\BbDevMgr.exe (Research In Motion Limited) PRC - C:\Program Files\Common Files\Research In Motion\USB Drivers\RIMBBLaunchAgent.exe (Research In Motion Limited) PRC - C:\Program Files\Adobe\Acrobat 11.0\Acrobat\acrotray.exe (Adobe Systems Inc.) PRC - C:\Program Files\LogMeIn\x86\LMIGuardianSvc.exe (LogMeIn, Inc.) PRC - C:\Program Files\Airlink101\Airlink101 WLAN Monitor\RtWLan.exe (Realtek Semiconductor Corp.) PRC - C:\Windows\explorer.exe (Microsoft Corporation) PRC - C:\Windows\System32\vmnetdhcp.exe (VMware, Inc.) PRC - C:\Windows\System32\vmnat.exe (VMware, Inc.) PRC - C:\Program Files\VMware\VMware Player\vmware-authd.exe (VMware, Inc.) PRC - C:\Program Files\Airlink101\Airlink101 WLAN Monitor\RtlService.exe (Realtek) PRC - C:\Windows\RtHDVCpl.exe (Realtek Semiconductor) PRC - C:\Windows\System32\bgsvcgen.exe (B.H.A Corporation) PRC - C:\Windows\System32\PAStiSvc.exe () ========== Modules (No Company Name) ========== MOD - C:\Program Files\Mozilla Firefox\mozjs.dll () MOD - C:\Program Files\Time Warner Cable\TWC WiFi\AffinegyServicePS.dll () MOD - C:\Program Files\Time Warner Cable\TWC WiFi\gateways\UbeeDVW3201BLOC.dll () MOD - C:\Program Files\Time Warner Cable\TWC WiFi\gateways\ArrisDG860ALOC.dll () MOD - C:\Program Files\Time Warner Cable\TWC WiFi\gateways\ArrisTG862GLOC.dll () MOD - C:\Program Files\Time Warner Cable\TWC WiFi\gateways\ArrisTG852GLOC.dll () MOD - C:\Program Files\Time Warner Cable\TWC WiFi\gateways\NetgearWNR1000v3LOC.dll () MOD - C:\Program Files\Time Warner Cable\TWC WiFi\gateways\MotorolaSBG900LOC.dll () MOD - C:\Program Files\Time Warner Cable\TWC WiFi\DigiDoFlavor.dll () MOD - C:\Program Files\Time Warner Cable\TWC WiFi\imageformats\qjpeg4.dll () MOD - C:\Program Files\Time Warner Cable\TWC WiFi\QtGui4.dll () MOD - C:\Program Files\Time Warner Cable\TWC WiFi\QtXml4.dll () MOD - C:\Program Files\Time Warner Cable\TWC WiFi\QtCore4.dll () MOD - C:\Program Files\Time Warner Cable\TWC WiFi\QtNetwork4.dll () MOD - C:\Program Files\WinRAR\RarExt.dll () ========== Services (SafeList) ========== SRV - (vToolbarUpdater17.0.12) -- C:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater\17.0.12\ToolbarUpdater.exe File not found SRV - (MozillaMaintenance) -- C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe (Mozilla Foundation) SRV - (avgwd) -- C:\Program Files\AVG\AVG2013\avgwdsvc.exe (AVG Technologies CZ, s.r.o.) SRV - (AVGIDSAgent) -- C:\Program Files\AVG\AVG2013\avgidsagent.exe (AVG Technologies CZ, s.r.o.) SRV - (AdobeARMservice) -- C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated) SRV - (RIM MDNS) -- C:\Program Files\Common Files\Research In Motion\Tunnel Manager\mDNSResponder.exe (Apple Inc.) SRV - (RIM Tunnel Service) -- C:\Program Files\Common Files\Research In Motion\Tunnel Manager\tunmgr.exe (Research In Motion Limited) SRV - (MBAMService) -- C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation) SRV - (AffinegyService) -- C:\Program Files\Time Warner Cable\TWC WiFi\AffinegyService.exe (Affinegy, Inc.) SRV - (BlackBerry Device Manager) -- C:\Program Files\Common Files\Research In Motion\USB Drivers\BbDevMgr.exe (Research In Motion Limited) SRV - (SkypeUpdate) -- C:\Program Files\Skype\Updater\Updater.exe (Skype Technologies) SRV - (LMIMaint) -- C:\Program Files\LogMeIn\x86\ramaint.exe (LogMeIn, Inc.) SRV - (LMIGuardianSvc) -- C:\Program Files\LogMeIn\x86\LMIGuardianSvc.exe (LogMeIn, Inc.) SRV - (LogMeIn) -- C:\Program Files\LogMeIn\x86\LogMeIn.exe (LogMeIn, Inc.) SRV - (SwitchBoard) -- C:\Program Files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe (Adobe Systems Incorporated) SRV - (VMnetDHCP) -- C:\Windows\System32\vmnetdhcp.exe (VMware, Inc.) SRV - (VMware NAT Service) -- C:\Windows\System32\vmnat.exe (VMware, Inc.) SRV - (VMAuthdService) -- C:\Program Files\VMware\VMware Player\vmware-authd.exe (VMware, Inc.) SRV - (Realtek92SU) -- C:\Program Files\Airlink101\Airlink101 WLAN Monitor\RtlService.exe (Realtek) SRV - (ufad-ws60) -- C:\Program Files\VMware\VMware Player\vmware-ufad.exe (VMware, Inc.) SRV - (WinDefend) -- C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation) SRV - (bgsvcgen) -- C:\Windows\System32\bgsvcgen.exe (B.H.A Corporation) SRV - (STI Simulator) -- C:\Windows\System32\PAStiSvc.exe () ========== Driver Services (SafeList) ========== DRV - (PcdrNdisuio) -- system32\DRIVERS\pcdrndisuio.sys File not found DRV - (NwlnkFwd) -- system32\DRIVERS\nwlnkfwd.sys File not found DRV - (NwlnkFlt) -- system32\DRIVERS\nwlnkflt.sys File not found DRV - (mbr) -- C:\ComboFix\mbr.sys File not found DRV - (IpInIp) -- system32\DRIVERS\ipinip.sys File not found DRV - (catchme) -- C:\Users\peter\AppData\Local\Temp\catchme.sys File not found DRV - (blbdrive) -- C:\Windows\system32\drivers\blbdrive.sys File not found DRV - (aniozlml) -- File not found DRV - (avgtp) -- C:\Windows\System32\drivers\avgtpx86.sys (AVG Technologies) DRV - (AVGIDSShim) -- C:\Windows\System32\drivers\avgidsshimx.sys (AVG Technologies CZ, s.r.o.) DRV - (Avgrkx86) -- C:\Windows\System32\drivers\avgrkx86.sys (AVG Technologies CZ, s.r.o.) DRV - (Avglogx) -- C:\Windows\System32\drivers\avglogx.sys (AVG Technologies CZ, s.r.o.) DRV - (AVGIDSDriver) -- C:\Windows\System32\drivers\avgidsdriverx.sys (AVG Technologies CZ, s.r.o.) DRV - (AVGIDSHX) -- C:\Windows\System32\drivers\avgidshx.sys (AVG Technologies CZ, s.r.o.) DRV - (Avgldx86) -- C:\Windows\System32\drivers\avgldx86.sys (AVG Technologies CZ, s.r.o.) DRV - (Avgmfx86) -- C:\Windows\System32\drivers\avgmfx86.sys (AVG Technologies CZ, s.r.o.) DRV - (rimvndis) -- C:\Windows\System32\drivers\rimvndis6.sys (Research in Motion Limited) DRV - (MBAMProtector) -- C:\Windows\System32\drivers\mbam.sys (Malwarebytes Corporation) DRV - (Avgtdix) -- C:\Windows\System32\drivers\avgtdix.sys (AVG Technologies CZ, s.r.o.) DRV - (sptd) -- C:\Windows\System32\drivers\sptd.sys () DRV - (LMIRfsClientNP) -- C:\Windows\System32\LMIRfsClientNP.dll (LogMeIn, Inc.) DRV - (LMIRfsDriver) -- C:\Windows\System32\drivers\LMIRfsDriver.sys (LogMeIn, Inc.) DRV - (LMIInfo) -- C:\Program Files\LogMeIn\x86\rainfo.sys (LogMeIn, Inc.) DRV - (RTL8192su) -- C:\Windows\System32\drivers\rtl8192su.sys (Realtek Semiconductor Corporation ) DRV - (vmci) -- C:\Windows\System32\drivers\vmci.sys (VMware, Inc.) DRV - (vmkbd) -- C:\Windows\System32\drivers\VMkbd.sys (VMware, Inc.) DRV - (vmx86) -- C:\Windows\System32\drivers\vmx86.sys (VMware, Inc.) DRV - (hcmon) -- C:\Windows\System32\drivers\hcmon.sys (VMware, Inc.) DRV - (VMnetuserif) -- C:\Windows\System32\drivers\vmnetuserif.sys (VMware, Inc.) DRV - (VMnetBridge) -- C:\Windows\System32\drivers\vmnetbridge.sys (VMware, Inc.) DRV - (VMnetAdapter) -- C:\Windows\System32\drivers\vmnetadapter.sys (VMware, Inc.) DRV - (vstor2-ws60) -- C:\Program Files\VMware\VMware Player\vstor2-ws60.sys (VMware, Inc.) DRV - (NVENETFD) -- C:\Windows\System32\drivers\nvmfdx32.sys (NVIDIA Corporation) DRV - (nvlddmkm) -- C:\Windows\System32\drivers\nvlddmkm.sys (NVIDIA Corporation) DRV - (HSXHWBS2) -- C:\Windows\System32\drivers\HSXHWBS2.sys (Conexant Systems, Inc.) DRV - (HSF_DP) -- C:\Windows\System32\drivers\HSX_DP.sys (Conexant Systems, Inc.) DRV - (nvstor32) -- C:\Windows\System32\drivers\nvstor32.sys (NVIDIA Corporation) DRV - (XAudio) -- C:\Windows\System32\drivers\XAudio.sys (Conexant Systems, Inc.) DRV - (pnarp) -- C:\Windows\System32\drivers\pnarp.sys (Pure Networks, Inc.) DRV - (cdrbsdrv) -- C:\Windows\System32\drivers\cdrbsdrv.sys (B.H.A Corporation) DRV - (PAC7311) -- C:\Windows\System32\drivers\PA707UCM.SYS (PixArt Imaging Inc.) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaults/sb/msgr8/*http://www.yahoo.com/ext/search/search.html IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,CustomSearch = http://us.rd.yahoo.com/customize/ie/defaults/cs/msgr8/*http://www.yahoo.com/ext/search/search.html IE - HKLM\..\SearchScopes,DefaultScope = IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-19\..\SearchScopes,DefaultScope = IE - HKU\S-1-5-20\..\SearchScopes,DefaultScope = IE - HKU\S-1-5-21-4081648169-590389797-1165956351-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com IE - HKU\S-1-5-21-4081648169-590389797-1165956351-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = en-us IE - HKU\S-1-5-21-4081648169-590389797-1165956351-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = C0 67 7B 24 AF 26 CA 01 [binary data] IE - HKU\S-1-5-21-4081648169-590389797-1165956351-1000\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1 IE - HKU\S-1-5-21-4081648169-590389797-1165956351-1000\..\SearchScopes,DefaultScope = IE - HKU\S-1-5-21-4081648169-590389797-1165956351-1000\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC IE - HKU\S-1-5-21-4081648169-590389797-1165956351-1000\..\SearchScopes\{27674CB4-CB56-4DDD-9C69-744878B5B6C1}: "URL" = http://search.yahoo.com/search?p={searchTerms}&ei=utf-8&fr=b1ie7 IE - HKU\S-1-5-21-4081648169-590389797-1165956351-1000\..\SearchScopes\{688B6F2A-6679-4CEB-A689-3D7DC9DD441E}: "URL" = http://www.search.com/search?q={searchTerms}&sourceid=iesp IE - HKU\S-1-5-21-4081648169-590389797-1165956351-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-21-4081648169-590389797-1165956351-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local IE - HKU\S-1-5-21-4081648169-590389797-1165956351-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/ IE - HKU\S-1-5-21-4081648169-590389797-1165956351-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://www.msn.com/defaultc.aspx IE - HKU\S-1-5-21-4081648169-590389797-1165956351-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = en-us IE - HKU\S-1-5-21-4081648169-590389797-1165956351-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 70 44 73 27 05 26 CA 01 [binary data] IE - HKU\S-1-5-21-4081648169-590389797-1165956351-1001\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1 IE - HKU\S-1-5-21-4081648169-590389797-1165956351-1001\..\SearchScopes,DefaultScope = IE - HKU\S-1-5-21-4081648169-590389797-1165956351-1001\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC IE - HKU\S-1-5-21-4081648169-590389797-1165956351-1001\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7&rlz=1I7GPEA_en IE - HKU\S-1-5-21-4081648169-590389797-1165956351-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 ========== FireFox ========== FF - prefs.js..browser.search.defaultenginename: "Bing" FF - prefs.js..browser.search.defaulturl: "" FF - prefs.js..browser.search.selectedEngine: "Bing" FF - prefs.js..extensions.enabledAddons: %7B972ce4c6-7e08-4474-a285-3208198ce6fd%7D:24.0 FF - prefs.js..network.proxy.no_proxies_on: "*.local" FF - prefs.js..network.proxy.type: 0 FF - user.js - File not found FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32_11_8_800_168.dll () FF - HKLM\Software\MozillaPlugins\@bittorrent.com/BitTorrentDNA: C:\Program Files\DNA\plugins\npbtdna.dll (BitTorrent, Inc.) FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google) FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.25.2: C:\Windows\system32\npDeployJava1.dll (Oracle Corporation) FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.25.2: C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation) FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@real.com/RhapsodyPlayerEngine,version=1.0: C:\Program Files\Real\RhapsodyPlayerEngine\nprhapengine.dll (RealNetworks, Inc.) FF - HKLM\Software\MozillaPlugins\@RIM.com/WebSLLauncher,version=1.0: C:\Program Files\Common Files\Research In Motion\BBWebSLLauncher\NPWebSLLauncher.dll () FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.165\npGoogleUpdate3.dll (Google Inc.) FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.165\npGoogleUpdate3.dll (Google Inc.) FF - HKLM\Software\MozillaPlugins\Adobe Acrobat: C:\Program Files\Adobe\Acrobat 11.0\Acrobat\Air\nppdf32.dll (Adobe Systems Inc.) FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF - HKLM\Software\MozillaPlugins\adobe.com/AdobeAAMDetect: C:\Program Files\Common Files\Adobe\OOBE\PDApp\CCM\Utilities\npAdobeAAMDetect32.dll (Adobe Systems) FF - HKCU\Software\MozillaPlugins\@bittorrent.com/BitTorrentDNA: C:\Users\peter\Program Files\DNA\plugins\npbtdna.dll (BitTorrent, Inc.) FF - HKCU\Software\MozillaPlugins\@movenetworks.com/Quantum Media Player: C:\Users\peter\AppData\Roaming\Move Networks\plugins\npqmp071705000014.dll (Move Networks) FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{3112ca9c-de6d-4884-a869-9855de68056c}: C:\Documents and Settings\All Users\Application Data\Google\Toolbar for Firefox\{3112ca9c-de6d-4884-a869-9855de68056c} [2009/07/24 13:25:57 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\web2pdfextension@web2pdf.adobedotcom: C:\Program Files\Adobe\Acrobat 11.0\Acrobat\Browser\WCFirefoxExtn [2013/10/07 18:51:37 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 24.0\extensions\\Components: C:\Program Files\Mozilla Firefox\components FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 24.0\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2013/10/07 18:52:13 | 000,000,000 | ---D | M] FF - HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions\\{d5bc46d8-67c7-11dc-8c1d-0097498c2b7a}: C:\Users\peter\Program Files\DNA [2009/01/04 12:38:01 | 000,000,000 | ---D | M] FF - HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions\\moveplayer@movenetworks.com: C:\Users\peter\AppData\Roaming\Move Networks [2010/01/07 21:20:54 | 000,000,000 | ---D | M] FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 23.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 23.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2013/10/07 18:52:13 | 000,000,000 | ---D | M] [2011/07/22 23:57:38 | 000,000,000 | ---D | M] (No name found) -- C:\Users\peter\AppData\Roaming\mozilla\Extensions [2013/10/14 08:32:49 | 000,000,000 | ---D | M] (No name found) -- C:\Users\peter\AppData\Roaming\mozilla\Firefox\Profiles\ppvs4fa5.default\extensions [2013/10/03 11:07:12 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\browser\extensions [2013/10/03 11:07:22 | 000,000,000 | ---D | M] (Default) -- C:\Program Files\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd} O1 HOSTS File: ([2013/10/14 08:16:51 | 000,000,027 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts O1 - Hosts: 127.0.0.1 localhost O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated) O2 - BHO: (Java Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation) O2 - BHO: (Adobe Acrobat Create PDF Toolbar Helper) - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Common Files\Adobe\Acrobat\WCIEActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated) O2 - BHO: (Java Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation) O2 - BHO: (Adobe Acrobat Create PDF from Selection) - {F4971EE7-DAA0-4053-9964-665D8EE6A077} - C:\Program Files\Common Files\Adobe\Acrobat\WCIEActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated) O3 - HKLM\..\Toolbar: (Adobe Acrobat Create PDF Toolbar) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Common Files\Adobe\Acrobat\WCIEActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated) O3 - HKU\.DEFAULT\..\Toolbar\WebBrowser: (Adobe Acrobat Create PDF Toolbar) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Common Files\Adobe\Acrobat\WCIEActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated) O3 - HKU\S-1-5-18\..\Toolbar\WebBrowser: (Adobe Acrobat Create PDF Toolbar) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Common Files\Adobe\Acrobat\WCIEActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated) O3 - HKU\S-1-5-21-4081648169-590389797-1165956351-1000\..\Toolbar\WebBrowser: (Adobe Acrobat Create PDF Toolbar) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Common Files\Adobe\Acrobat\WCIEActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated) O3 - HKU\S-1-5-21-4081648169-590389797-1165956351-1001\..\Toolbar\WebBrowser: (no name) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No CLSID value found. O3 - HKU\S-1-5-21-4081648169-590389797-1165956351-1001\..\Toolbar\WebBrowser: (no name) - {3041D03E-FD4B-44E0-B742-2D9B88305F98} - No CLSID value found. O3 - HKU\S-1-5-21-4081648169-590389797-1165956351-1001\..\Toolbar\WebBrowser: (Adobe Acrobat Create PDF Toolbar) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Common Files\Adobe\Acrobat\WCIEActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated) O4 - HKLM..\Run: [Acrobat Assistant 8.0] C:\Program Files\Adobe\Acrobat 11.0\Acrobat\Acrotray.exe (Adobe Systems Inc.) O4 - HKLM..\Run: [AdobeAAMUpdater-1.0] C:\Program Files\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe (Adobe Systems Incorporated) O4 - HKLM..\Run: [AdobeCS6ServiceManager] C:\Program Files\Common Files\Adobe\CS6ServiceManager\CS6ServiceManager.exe (Adobe Systems Incorporated) O4 - HKLM..\Run: [AVG_UI] C:\Program Files\AVG\AVG2013\avgui.exe (AVG Technologies CZ, s.r.o.) O4 - HKLM..\Run: [DigiDo] C:\Program Files\Time Warner Cable\TWC WiFi\TrayApp.exe (Affinegy, Inc.) O4 - HKLM..\Run: [RIM PeerManager] C:\Program Files\Common Files\Research In Motion\Tunnel Manager\PeerManager.exe (Research In Motion Limited) O4 - HKLM..\Run: [RIMBBLaunchAgent.exe] C:\Program Files\Common Files\Research In Motion\USB Drivers\RIMBBLaunchAgent.exe (Research In Motion Limited) O4 - HKLM..\Run: [RtHDVCpl] C:\Windows\RtHDVCpl.exe (Realtek Semiconductor) O4 - HKLM..\Run: [switchBoard] C:\Program Files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe (Adobe Systems Incorporated) O4 - HKLM..\RunOnce: [Malwarebytes Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation) O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 255 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0 O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel present O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Control Panel present O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Control Panel present O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Control Panel present O7 - HKU\S-1-5-21-4081648169-590389797-1165956351-1000\Software\Policies\Microsoft\Internet Explorer\Control Panel present O7 - HKU\S-1-5-21-4081648169-590389797-1165956351-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoChangeStartMenu = 0 O7 - HKU\S-1-5-21-4081648169-590389797-1165956351-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0 O7 - HKU\S-1-5-21-4081648169-590389797-1165956351-1001\Software\Policies\Microsoft\Internet Explorer\Control Panel present O8 - Extra context menu item: Free YouTube Download - C:\Users\peter\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubedownload.htm File not found O8 - Extra context menu item: Free YouTube to Mp3 Converter - C:\Users\peter\AppData\Roaming\DVDVideoSoftIEHelpers\youtubetomp3.htm File not found O9 - Extra Button: Run WinHTTrack - {36ECAF82-3300-8F84-092E-AFF36D6C7040} - C:\Program Files\WinHTTrack\WinHTTrackIEBar.dll () O9 - Extra 'Tools' menuitem : Launch WinHTTrack - {36ECAF82-3300-8F84-092E-AFF36D6C7040} - C:\Program Files\WinHTTrack\WinHTTrackIEBar.dll () O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.) O10 - Protocol_Catalog9\Catalog_Entries\000000000011 - C:\Program Files\VMware\VMware Player\vsocklib.dll (VMware, Inc.) O10 - Protocol_Catalog9\Catalog_Entries\000000000012 - C:\Program Files\VMware\VMware Player\vsocklib.dll (VMware, Inc.) O15 - HKU\S-1-5-21-4081648169-590389797-1165956351-1001\..Trusted Ranges: Range1 ([http] in Local intranet) O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} http://download.divx.com/player/DivXBrowserPlugin.cab (Reg Error: Key error.) O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 209.18.47.61 209.18.47.62 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{79470AA1-A7E0-47DD-A805-B910433C643B}: NameServer = 4.2.2.2,4.2.2.3 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{B315F718-9933-4B4E-8600-EBA98A633554}: DhcpNameServer = 209.18.47.61 209.18.47.62 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{F2130641-846C-4CDD-8B61-5888841DD668}: DhcpNameServer = 209.18.47.61 209.18.47.62 O18 - Protocol\Handler\linkscanner - No CLSID value found O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies) O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation) O24 - Desktop WallPaper: C:\Windows\Web\Wallpaper\img17.jpg O24 - Desktop BackupWallPaper: C:\Windows\Web\Wallpaper\img17.jpg O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2007/09/15 04:12:25 | 000,000,074 | ---- | M] () - C:\autoexec.bat -- [ NTFS ] O34 - HKLM BootExecute: (autocheck autochk *) O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37 - HKLM\...com [@ = ComFile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3) O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2) ========== Files/Folders - Created Within 30 Days ========== [2013/10/14 21:57:26 | 000,000,000 | ---D | C] -- C:\Windows\temp [2013/10/14 21:57:25 | 000,000,000 | ---D | C] -- C:\Users\peter\AppData\Local\temp [2013/10/14 21:56:29 | 000,000,000 | -HSD | C] -- C:\$RECYCLE.BIN [2013/10/14 08:02:13 | 000,518,144 | ---- | C] (SteelWerX) -- C:\Windows\SWREG.exe [2013/10/14 08:02:13 | 000,406,528 | ---- | C] (SteelWerX) -- C:\Windows\SWSC.exe [2013/10/14 08:02:13 | 000,060,416 | ---- | C] (NirSoft) -- C:\Windows\NIRCMD.exe [2013/10/14 08:02:04 | 000,000,000 | ---D | C] -- C:\Qoobox [2013/10/14 08:01:36 | 000,000,000 | ---D | C] -- C:\Windows\erdnt [2013/10/12 15:17:48 | 000,000,000 | ---D | C] -- C:\Windows\ERUNT [2013/10/11 21:35:10 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware [2013/10/11 21:35:09 | 000,022,856 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys [2013/10/11 21:35:09 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware [2013/10/09 20:17:13 | 000,000,000 | ---D | C] -- C:\AdwCleaner [2013/10/09 18:17:08 | 000,000,000 | ---D | C] -- C:\ProgramData\HitmanPro [2013/10/09 03:07:41 | 002,382,848 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mshtml.tlb [2013/10/09 03:07:40 | 000,176,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieui.dll [2013/10/09 03:07:40 | 000,142,848 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieUnatt.exe [2013/10/09 03:07:40 | 000,065,024 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\jsproxy.dll [2013/10/09 03:07:39 | 001,800,704 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\jscript9.dll [2013/10/09 03:07:39 | 000,607,744 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msfeeds.dll [2013/10/09 03:07:38 | 000,231,936 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\url.dll [2013/10/09 03:07:37 | 001,427,968 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\inetcpl.cpl [2013/10/09 02:35:39 | 001,172,480 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3d10warp.dll [2013/10/09 02:35:39 | 001,069,056 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\DWrite.dll [2013/10/09 02:35:39 | 001,029,120 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3d10.dll [2013/10/09 02:35:39 | 000,683,008 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d2d1.dll [2013/10/09 02:35:39 | 000,486,400 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3d10level9.dll [2013/10/09 02:35:39 | 000,219,648 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3d10_1core.dll [2013/10/09 02:35:39 | 000,189,952 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3d10core.dll [2013/10/09 02:35:39 | 000,160,768 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3d10_1.dll [2013/10/09 02:35:37 | 000,037,376 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\cdd.dll [2013/10/09 02:35:36 | 000,102,608 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\PresentationCFFRasterizerNative_v0300.dll [2013/10/09 02:35:34 | 002,050,048 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\win32k.sys [2013/10/09 02:35:30 | 000,226,304 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\drivers\usbport.sys [2013/10/09 02:35:30 | 000,006,016 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\drivers\usbd.sys [2013/10/09 02:35:25 | 000,293,376 | ---- | C] (Adobe Systems Incorporated) -- C:\Windows\System32\atmfd.dll [2013/10/09 02:35:25 | 000,034,304 | ---- | C] (Adobe Systems) -- C:\Windows\System32\atmlib.dll [2013/10/07 20:09:08 | 000,000,000 | ---D | C] -- C:\ProgramData\ALM [2013/10/07 20:00:30 | 000,000,000 | ---D | C] -- C:\Users\peter\Adobe Flash Builder 4.6 [2013/10/07 19:51:44 | 000,000,000 | ---D | C] -- C:\adobeTemp [2013/10/07 19:45:34 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Master Collection CS6 [2013/10/07 17:47:46 | 000,000,000 | ---D | C] -- C:\Program Files\Adobe Download Assistant [2013/10/07 16:34:40 | 000,000,000 | ---D | C] -- C:\Users\peter\AppData\Local\Alpemix [2013/10/07 15:56:10 | 000,000,000 | ---D | C] -- C:\Program Files\Webteh [2013/10/03 11:07:12 | 000,000,000 | ---D | C] -- C:\Program Files\Mozilla Firefox [2013/09/29 08:40:46 | 000,082,896 | ---- | C] (Wondershare Software) -- C:\Windows\System32\WSMonEditor.dll [2013/09/29 08:40:15 | 000,000,000 | ---D | C] -- C:\Users\peter\AppData\Local\Wondershare [2013/09/29 08:40:14 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Wondershare [2013/09/29 08:39:32 | 000,000,000 | ---D | C] -- C:\ProgramData\PDFEditor [2013/09/29 08:39:31 | 000,000,000 | ---D | C] -- C:\Users\peter\AppData\Roaming\Wondershare [4 C:\Windows\System32\*.tmp files -> C:\Windows\System32\*.tmp -> ] [1 C:\Users\peter\AppData\Roaming\*.tmp files -> C:\Users\peter\AppData\Roaming\*.tmp -> ] ========== Files - Modified Within 30 Days ========== [2013/10/15 06:56:00 | 000,000,884 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job [2013/10/15 06:00:45 | 000,003,568 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0 [2013/10/15 06:00:45 | 000,003,568 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0 [2013/10/15 05:56:00 | 000,000,880 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job [2013/10/14 10:00:39 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat [2013/10/14 08:16:51 | 000,000,027 | ---- | M] () -- C:\Windows\System32\drivers\etc\hosts [2013/10/11 21:35:10 | 000,000,912 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk [2013/10/09 18:40:27 | 000,607,186 | ---- | M] () -- C:\Windows\System32\perfh009.dat [2013/10/09 18:40:27 | 000,105,412 | ---- | M] () -- C:\Windows\System32\perfc009.dat [2013/10/09 03:40:31 | 003,997,384 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT [2013/10/07 19:42:05 | 000,001,317 | ---- | M] () -- C:\Users\Public\Desktop\Adobe Application Manager.lnk [2013/10/07 18:52:13 | 000,002,019 | ---- | M] () -- C:\Users\Public\Desktop\Adobe FormsCentral.lnk [2013/10/07 18:52:13 | 000,001,905 | ---- | M] () -- C:\Users\Public\Desktop\Adobe Acrobat XI Pro.lnk [2013/10/05 07:59:02 | 000,001,977 | ---- | M] () -- C:\Users\Public\Desktop\Google Chrome.lnk [2013/10/02 03:01:23 | 000,003,726 | ---- | M] () -- C:\Program Files\Mozilla Firefoxavg-secure-search.xml [2013/10/02 03:01:13 | 000,037,664 | ---- | M] (AVG Technologies) -- C:\Windows\System32\drivers\avgtpx86.sys [2013/09/30 22:18:06 | 000,000,330 | ---- | M] () -- C:\Windows\tasks\HPCeeScheduleForPeter_2.job [2013/09/22 05:22:59 | 001,800,704 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\jscript9.dll [2013/09/22 05:14:39 | 001,427,968 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\inetcpl.cpl [2013/09/22 05:12:32 | 000,231,936 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\url.dll [2013/09/22 05:09:55 | 000,065,024 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\jsproxy.dll [2013/09/22 05:08:41 | 000,142,848 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\ieUnatt.exe [2013/09/22 05:05:42 | 000,607,744 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\msfeeds.dll [2013/09/22 05:03:18 | 002,382,848 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\mshtml.tlb [2013/09/22 04:59:06 | 000,176,640 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\ieui.dll [4 C:\Windows\System32\*.tmp files -> C:\Windows\System32\*.tmp -> ] [1 C:\Users\peter\AppData\Roaming\*.tmp files -> C:\Users\peter\AppData\Roaming\*.tmp -> ] ========== Files Created - No Company Name ========== [2013/10/14 08:02:13 | 000,256,000 | ---- | C] () -- C:\Windows\PEV.exe [2013/10/14 08:02:13 | 000,208,896 | ---- | C] () -- C:\Windows\MBR.exe [2013/10/14 08:02:13 | 000,098,816 | ---- | C] () -- C:\Windows\sed.exe [2013/10/14 08:02:13 | 000,080,412 | ---- | C] () -- C:\Windows\grep.exe [2013/10/14 08:02:13 | 000,068,096 | ---- | C] () -- C:\Windows\zip.exe [2013/10/11 21:35:10 | 000,000,912 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk [2013/10/07 19:42:05 | 000,001,329 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Application Manager.lnk [2013/10/07 19:42:05 | 000,001,317 | ---- | C] () -- C:\Users\Public\Desktop\Adobe Application Manager.lnk [2013/10/07 18:52:13 | 000,002,089 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe FormsCentral.lnk [2013/10/07 18:52:13 | 000,002,019 | ---- | C] () -- C:\Users\Public\Desktop\Adobe FormsCentral.lnk [2013/10/07 18:52:13 | 000,001,928 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Acrobat Distiller XI.lnk [2013/10/07 18:52:13 | 000,001,905 | ---- | C] () -- C:\Users\Public\Desktop\Adobe Acrobat XI Pro.lnk [2013/10/07 18:52:13 | 000,001,808 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Acrobat XI Pro.lnk [2013/07/25 07:33:02 | 000,810,599 | ---- | C] () -- C:\Users\peter\AppData\Local\census.cache [2013/07/25 07:32:10 | 000,215,789 | ---- | C] () -- C:\Users\peter\AppData\Local\ars.cache [2013/07/25 07:07:04 | 000,000,036 | ---- | C] () -- C:\Users\peter\AppData\Local\housecall.guid.cache [2013/06/27 01:38:27 | 000,003,726 | ---- | C] () -- C:\Program Files\Mozilla Firefoxavg-secure-search.xml [2013/04/29 17:47:13 | 000,024,206 | ---- | C] () -- C:\Users\peter\AppData\Roaming\UserTile.png [2009/10/27 20:32:55 | 000,000,212 | ---- | C] () -- C:\Users\peter\AppData\Roaming\wklnhst.dat [2009/08/27 21:28:40 | 000,000,116 | ---- | C] () -- C:\Users\peter\Adobe Encore_AME.pref [2009/07/01 21:21:22 | 000,000,000 | ---- | C] () -- C:\Users\peter\AppData\Local\rx_image.Cache [2009/05/03 00:26:28 | 000,087,162 | ---- | C] () -- C:\Users\peter\mixxxtrack.xml [2009/05/03 00:26:28 | 000,000,614 | ---- | C] () -- C:\Users\peter\mixxxbpmschemes.xml [2009/05/03 00:11:01 | 000,001,506 | ---- | C] () -- C:\Users\peter\mixxx.cfg [2008/08/05 18:32:06 | 000,026,112 | ---- | C] () -- C:\Users\peter\01018259.dot [2008/03/26 20:17:39 | 000,000,012 | ---- | C] () -- C:\Users\peter\intlname.ols [2008/02/24 16:35:31 | 000,039,936 | ---- | C] () -- C:\Users\peter\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2008/02/24 14:56:02 | 000,007,268 | ---- | C] () -- C:\Users\peter\AppData\Local\d3d9caps.dat ========== ZeroAccess Check ========== [2006/11/02 07:54:22 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini [HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] [HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] "" = %SystemRoot%\system32\shell32.dll -- [2012/06/08 12:47:00 | 011,586,048 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Apartment [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] "" = %systemroot%\system32\wbem\fastprox.dll -- [2009/04/11 01:28:19 | 000,614,912 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Free [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] "" = %systemroot%\system32\wbem\wbemess.dll -- [2009/04/11 01:28:25 | 000,347,648 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Both ========== Alternate Data Streams ========== @Alternate Data Stream - 99 bytes -> C:\ProgramData\TEMP:BE76DBCF @Alternate Data Stream - 145 bytes -> C:\ProgramData\TEMP:0A8E2C33 @Alternate Data Stream - 132 bytes -> C:\ProgramData\TEMP:EBC2DB92 @Alternate Data Stream - 124 bytes -> C:\ProgramData\TEMP:0B4227B4 @Alternate Data Stream - 110 bytes -> C:\ProgramData\TEMP:DFC5A2B2 @Alternate Data Stream - 104 bytes -> C:\ProgramData\TEMP:7838B9E0 < End of report >

I ran the script. The computer seems to be working fine and is stable but the annoying issue below is still there per below. Also see the report from the script run. So not sure if this is an issue still Registry Keys Detected: 1 HKLM\SOFTWARE\Wow6432Node\Updater By SweetPacks (PUP.Optional.SweetPacks.A) ComboFix 13-10-13.02 - peter 10/14/13 21:43:26.2.1 - x86 Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.1.1033.18.3006.1717 [GMT -5:00] Running from: c:\users\Peter_2\Desktop\ComboFix.exe Command switches used :: c:\users\Peter_2\Desktop\CFScript.txt AV: AVG AntiVirus Free Edition 2013 *Disabled/Updated* {0E9420C4-06B3-7FA0-3AB1-6E49CB52ECD9} SP: AVG AntiVirus Free Edition 2013 *Disabled/Updated* {B5F5C120-2089-702E-0001-553BB0D5A664} SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} * Created a new restore point . . ((((((((((((((((((((((((( Files Created from 2013-09-15 to 2013-10-15 ))))))))))))))))))))))))))))))) . . 2013-10-15 02:54 . 2013-10-15 02:54 -------- d-----w- c:\users\peter\AppData\Local\temp 2013-10-15 02:54 . 2013-10-15 02:54 -------- d-----w- c:\users\Guest\AppData\Local\temp 2013-10-15 02:54 . 2013-10-15 02:54 -------- d-----w- c:\users\Default\AppData\Local\temp 2013-10-12 20:17 . 2013-10-12 20:17 -------- d-----w- c:\windows\ERUNT 2013-10-12 02:35 . 2013-10-12 02:35 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware 2013-10-12 02:35 . 2013-04-04 19:50 22856 ----a-w- c:\windows\system32\drivers\mbam.sys 2013-10-11 06:49 . 2013-09-16 05:50 7328304 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\Windows Defender\Definition Updates\{5CA1C4F7-EB28-4129-8F4C-A0820C22C9C5}\mpengine.dll ERROR(0x00000005) 2013-10-11 00:43 . 2013-10-11 00:50 -------- d-----w- c:\users\Peter_2\AppData\Roaming\ScanSoft 2013-10-10 01:17 . 2013-10-13 16:22 -------- d-----w- C:\AdwCleaner 2013-10-09 07:35 . 2013-08-27 02:47 219648 ----a-w- c:\windows\system32\d3d10_1core.dll 2013-10-08 01:00 . 2013-10-08 01:00 -------- d-----w- c:\users\peter\Adobe Flash Builder 4.6 2013-10-08 00:51 . 2013-10-08 00:51 -------- d-----w- C:\adobeTemp 2013-10-07 22:47 . 2013-10-07 22:47 -------- d-----w- c:\program files\Adobe Download Assistant 2013-10-07 21:34 . 2013-10-07 21:34 -------- d-----w- c:\users\peter\AppData\Local\Alpemix 2013-10-07 21:33 . 2013-10-07 21:33 -------- d-----w- c:\users\Peter_2\AppData\Local\Alpemix 2013-10-07 20:56 . 2013-10-07 20:56 -------- d-----w- c:\program files\Webteh 2013-09-29 13:43 . 2013-09-29 13:43 -------- d-----w- c:\users\Peter_2\AppData\Local\Wondershare 2013-09-29 13:41 . 2013-09-29 13:41 -------- d-----w- c:\users\Peter_2\AppData\Roaming\Wondershare 2013-09-29 13:40 . 2013-09-03 00:09 82896 ----a-w- c:\windows\system32\WSMonEditor.dll 2013-09-29 13:40 . 2013-09-29 13:40 -------- d-----w- c:\users\peter\AppData\Local\Wondershare 2013-09-29 13:40 . 2013-09-29 13:40 -------- d-----w- c:\program files\Common Files\Wondershare 2013-09-29 13:39 . 2013-09-29 13:41 -------- d-----w- c:\users\peter\AppData\Roaming\Wondershare . . . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2013-10-02 08:01 . 2012-12-14 15:15 37664 ----a-w- c:\windows\system32\drivers\avgtpx86.sys 2013-09-16 05:50 . 2008-02-10 23:25 7328304 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\Windows Defender\Definition Updates\Backup\mpengine.dll ERROR(0x00000005) 2013-09-14 13:21 . 2012-10-09 03:49 692616 ----a-w- c:\windows\system32\FlashPlayerApp.exe 2013-09-14 13:21 . 2011-06-18 20:27 71048 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl 2013-09-10 06:34 . 2013-09-10 06:34 22328 ----a-w- c:\windows\system32\drivers\avgidsshimx.sys 2013-09-05 06:43 . 2013-09-05 06:43 39224 ----a-w- c:\windows\system32\drivers\avgrkx86.sys 2013-08-07 09:22 . 2009-10-02 21:47 238872 ------w- c:\windows\system32\MpSigStub.exe 2013-08-02 04:09 . 2013-08-27 21:53 1548288 ----a-w- c:\windows\system32\WMVDECOD.DLL 2013-07-20 06:51 . 2013-07-20 06:51 246072 ----a-w- c:\windows\system32\drivers\avglogx.sys 2013-07-20 06:50 . 2013-07-20 06:50 60216 ----a-w- c:\windows\system32\drivers\avgidshx.sys 2013-07-20 06:50 . 2013-07-20 06:50 208184 ----a-w- c:\windows\system32\drivers\avgidsdriverx.sys 2013-07-20 06:50 . 2013-07-20 06:50 171320 ----a-w- c:\windows\system32\drivers\avgldx86.sys 2013-07-17 19:41 . 2013-08-18 18:20 2048 ----a-w- c:\windows\system32\tzres.dll . . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 . [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-19 202240] . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "RtHDVCpl"="RtHDVCpl.exe" [2008-01-15 4874240] "AVG_UI"="c:\program files\AVG\AVG2013\avgui.exe" [2013-08-15 4411440] "RIMBBLaunchAgent.exe"="c:\program files\Common Files\Research In Motion\USB Drivers\RIMBBLaunchAgent.exe" [2013-01-17 267792] "RIM PeerManager"="c:\program files\Common Files\Research In Motion\Tunnel Manager\PeerManager.exe" [2013-04-26 4265472] "Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2013-04-04 958576] "SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2013-03-12 253816] "DigiDo"="c:\program files\Time Warner Cable\TWC WiFi\TrayApp.exe" [2013-02-27 1158480] "AdobeAAMUpdater-1.0"="c:\program files\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe" [2012-09-20 444904] "Acrobat Assistant 8.0"="c:\program files\Adobe\Acrobat 11.0\Acrobat\Acrotray.exe" [2012-09-24 3477640] "SwitchBoard"="c:\program files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe" [2010-02-19 517096] "AdobeCS6ServiceManager"="c:\program files\Common Files\Adobe\CS6ServiceManager\CS6ServiceManager.exe" [2012-03-09 1073312] . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce] "Malwarebytes Anti-Malware"="c:\program files\Malwarebytes' Anti-Malware\mbamgui.exe" [2013-04-04 532040] . c:\users\Guest\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ OneNote 2007 Screen Clipper and Launcher.lnk - c:\program files\Microsoft Office\Office12\ONENOTEM.EXE /tsr [2009-2-26 97680] . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "EnableUIADesktopToggle"= 0 (0x0) . [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WudfSvc] @="Service" . [HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Auto run of VideoCam Suite 1.0.lnk] path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\Auto run of VideoCam Suite 1.0.lnk backup=c:\windows\pss\Auto run of VideoCam Suite 1.0.lnk.CommonStartup backupExtension=.CommonStartup . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Health Check Scheduler] 2007-05-24 20:13 71176 ----a-w- c:\program files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HPADVISOR] 2009-08-05 17:27 1644088 ----a-w- c:\program files\Hewlett-Packard\HP Advisor\HPAdvisor.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\hpsysdrv] 2007-04-18 15:01 65536 ----a-w- c:\hp\support\hpsysdrv.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task] 2009-01-05 21:18 413696 ----a-w- c:\program files\QuickTime\QTTask.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateReg] 2007-04-07 09:56 54936 ----a-w- c:\windows\System32\jureg.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched] 2013-03-12 12:32 253816 ----a-w- c:\program files\Common Files\Java\Java Update\jusched.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\VMware hqtray] 2009-03-27 03:57 64048 ----a-w- c:\program files\VMware\VMware Player\hqtray.exe . [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-] "AdobeBridge"= . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-] "Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" "Adobe Acrobat Speed Launcher"="c:\program files\Adobe\Acrobat 10.0\Acrobat\Acrobat_sl.exe" "Acrobat Assistant 8.0"="c:\program files\Adobe\Acrobat 10.0\Acrobat\Acrotray.exe" "RIM PeerManager"="c:\program files\Common Files\Research In Motion\Tunnel Manager\PeerManager.exe" "RIMBBLaunchAgent.exe"=c:\program files\Common Files\Research In Motion\USB Drivers\RIMBBLaunchAgent.exe "vProt"="c:\program files\AVG Secure Search\vprot.exe" . [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring] "DisableMonitoring"=dword:00000001 . [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus] "DisableMonitoring"=dword:00000001 . [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall] "DisableMonitoring"=dword:00000001 . [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost] LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache . [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}] 2013-10-05 12:50 1185744 ----a-w- c:\program files\Google\Chrome\Application\30.0.1599.69\Installer\chrmstp.exe . Contents of the 'Scheduled Tasks' folder . 2013-10-14 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job - c:\program files\Google\Update\GoogleUpdate.exe [2010-02-06 05:17] . 2013-10-15 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job - c:\program files\Google\Update\GoogleUpdate.exe [2010-02-06 05:17] . 2013-10-01 c:\windows\Tasks\HPCeeScheduleForPeter_2.job - c:\program files\hewlett-packard\sdp\ceement\HPCEE.exe [2007-09-15 23:55] . . ------- Supplementary Scan ------- . mSearch Bar = hxxp://us.rd.yahoo.com/customize/ie/defaults/sb/msgr8/*http://www.yahoo.com/ext/search/search.html uInternet Settings,ProxyOverride = *.local uSearchURL,(Default) = hxxp://us.rd.yahoo.com/customize/ie/defaults/su/msgr8/*http://www.yahoo.com IE: &??????? ? Microsoft Excel - c:\progra~1\MICROS~3\OFFICE11\EXCEL.EXE/3000 IE: Append Link Target to Existing PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html IE: Append to Existing PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html IE: Convert Link Target to Adobe PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html IE: Convert to Adobe PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECapture.html IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000 IE: Free YouTube Download - c:\users\peter\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubedownload.htm IE: Free YouTube to Mp3 Converter - c:\users\peter\AppData\Roaming\DVDVideoSoftIEHelpers\youtubetomp3.htm LSP: c:\program files\VMware\VMware Player\vsocklib.dll TCP: DhcpNameServer = 209.18.47.61 209.18.47.62 TCP: Interfaces\{79470AA1-A7E0-47DD-A805-B910433C643B}: NameServer = 4.2.2.2,4.2.2.3 FF - ProfilePath - c:\users\peter\AppData\Roaming\Mozilla\Firefox\Profiles\ppvs4fa5.default\ FF - prefs.js: browser.search.defaulturl - FF - prefs.js: browser.search.selectedEngine - Bing FF - prefs.js: network.proxy.type - 0 FF - ExtSQL: 2013-10-07 18:51; web2pdfextension@web2pdf.adobedotcom; c:\program files\Adobe\Acrobat 11.0\Acrobat\Browser\WCFirefoxExtn . . ************************************************************************** . catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2013-10-14 21:54 Windows 6.0.6002 Service Pack 2 NTFS . scanning hidden processes ... . scanning hidden autostart entries ... . scanning hidden files ... . scan completed successfully hidden files: 0 . ************************************************************************** . --------------------- LOCKED REGISTRY KEYS --------------------- . [HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 . [HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 . [HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0003\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 . Completion time: 2013-10-14 21:57:21 ComboFix-quarantined-files.txt 2013-10-15 02:57 ComboFix2.txt 2013-10-14 13:20 . Pre-Run: 17,116,585,984 bytes free Post-Run: 17,099,804,672 bytes free . - - End Of File - - 10598FF95382604BB8A25F74872077DD 8913823FF508CCF109DB74B636C301DA

Here is the information requested Log from Combofix - See below loglet me know of any problems you may have had - had no problems or issues while running the programHow is the computer doing now? - computer seems to be running find. Exact same way as before. I did not have any browser redirects before and I don't have them now. No known issues ComboFix 13-10-13.02 - peter 10/14/13 8:04.1.1 - x86 Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.1.1033.18.3006.1359 [GMT -5:00] Running from: c:\users\Peter_2\Desktop\ComboFix.exe AV: AVG AntiVirus Free Edition 2013 *Disabled/Updated* {0E9420C4-06B3-7FA0-3AB1-6E49CB52ECD9} SP: AVG AntiVirus Free Edition 2013 *Disabled/Updated* {B5F5C120-2089-702E-0001-553BB0D5A664} SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} * Created a new restore point . . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . . C:\install.exe c:\users\peter\AppData\Local\Google\Chrome\User Data\Default\preferences c:\users\Peter_2\AppData\Local\Google\Chrome\User Data\Default\preferences . . ((((((((((((((((((((((((( Files Created from 2013-09-14 to 2013-10-14 ))))))))))))))))))))))))))))))) . . 2013-10-14 13:16 . 2013-10-14 13:17 -------- d-----w- c:\users\peter\AppData\Local\temp 2013-10-14 13:16 . 2013-10-14 13:16 -------- d-----w- c:\users\Guest\AppData\Local\temp 2013-10-14 13:16 . 2013-10-14 13:16 -------- d-----w- c:\users\Default\AppData\Local\temp 2013-10-12 20:17 . 2013-10-12 20:17 -------- d-----w- c:\windows\ERUNT 2013-10-12 02:35 . 2013-10-12 02:35 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware 2013-10-12 02:35 . 2013-04-04 19:50 22856 ----a-w- c:\windows\system32\drivers\mbam.sys 2013-10-11 06:49 . 2013-09-16 05:50 7328304 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\Windows Defender\Definition Updates\{5CA1C4F7-EB28-4129-8F4C-A0820C22C9C5}\mpengine.dll ERROR(0x00000005) 2013-10-11 00:43 . 2013-10-11 00:50 -------- d-----w- c:\users\Peter_2\AppData\Roaming\ScanSoft 2013-10-10 01:17 . 2013-10-13 16:22 -------- d-----w- C:\AdwCleaner 2013-10-09 07:35 . 2013-08-27 02:47 219648 ----a-w- c:\windows\system32\d3d10_1core.dll 2013-10-08 01:00 . 2013-10-08 01:00 -------- d-----w- c:\users\peter\Adobe Flash Builder 4.6 2013-10-08 00:51 . 2013-10-08 00:51 -------- d-----w- C:\adobeTemp 2013-10-07 22:47 . 2013-10-07 22:47 -------- d-----w- c:\program files\Adobe Download Assistant 2013-10-07 21:34 . 2013-10-07 21:34 -------- d-----w- c:\users\peter\AppData\Local\Alpemix 2013-10-07 21:33 . 2013-10-07 21:33 -------- d-----w- c:\users\Peter_2\AppData\Local\Alpemix 2013-10-07 20:56 . 2013-10-07 20:56 -------- d-----w- c:\program files\Webteh 2013-09-29 13:43 . 2013-09-29 13:43 -------- d-----w- c:\users\Peter_2\AppData\Local\Wondershare 2013-09-29 13:41 . 2013-09-29 13:41 -------- d-----w- c:\users\Peter_2\AppData\Roaming\Wondershare 2013-09-29 13:40 . 2013-09-03 00:09 82896 ----a-w- c:\windows\system32\WSMonEditor.dll 2013-09-29 13:40 . 2013-09-29 13:40 -------- d-----w- c:\users\peter\AppData\Local\Wondershare 2013-09-29 13:40 . 2013-09-29 13:40 -------- d-----w- c:\program files\Common Files\Wondershare 2013-09-29 13:39 . 2013-09-29 13:41 -------- d-----w- c:\users\peter\AppData\Roaming\Wondershare . . . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2013-10-02 08:01 . 2012-12-14 15:15 37664 ----a-w- c:\windows\system32\drivers\avgtpx86.sys 2013-09-16 05:50 . 2008-02-10 23:25 7328304 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\Windows Defender\Definition Updates\Backup\mpengine.dll ERROR(0x00000005) 2013-09-14 13:21 . 2012-10-09 03:49 692616 ----a-w- c:\windows\system32\FlashPlayerApp.exe 2013-09-14 13:21 . 2011-06-18 20:27 71048 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl 2013-09-10 06:34 . 2013-09-10 06:34 22328 ----a-w- c:\windows\system32\drivers\avgidsshimx.sys 2013-09-05 06:43 . 2013-09-05 06:43 39224 ----a-w- c:\windows\system32\drivers\avgrkx86.sys 2013-08-07 09:22 . 2009-10-02 21:47 238872 ------w- c:\windows\system32\MpSigStub.exe 2013-08-02 04:09 . 2013-08-27 21:53 1548288 ----a-w- c:\windows\system32\WMVDECOD.DLL 2013-07-20 06:51 . 2013-07-20 06:51 246072 ----a-w- c:\windows\system32\drivers\avglogx.sys 2013-07-20 06:50 . 2013-07-20 06:50 60216 ----a-w- c:\windows\system32\drivers\avgidshx.sys 2013-07-20 06:50 . 2013-07-20 06:50 208184 ----a-w- c:\windows\system32\drivers\avgidsdriverx.sys 2013-07-20 06:50 . 2013-07-20 06:50 171320 ----a-w- c:\windows\system32\drivers\avgldx86.sys 2013-07-17 19:41 . 2013-08-18 18:20 2048 ----a-w- c:\windows\system32\tzres.dll . . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 . [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-19 202240] . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "RtHDVCpl"="RtHDVCpl.exe" [2008-01-15 4874240] "AVG_UI"="c:\program files\AVG\AVG2013\avgui.exe" [2013-08-15 4411440] "RIMBBLaunchAgent.exe"="c:\program files\Common Files\Research In Motion\USB Drivers\RIMBBLaunchAgent.exe" [2013-01-17 267792] "RIM PeerManager"="c:\program files\Common Files\Research In Motion\Tunnel Manager\PeerManager.exe" [2013-04-26 4265472] "Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2013-04-04 958576] "SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2013-03-12 253816] "DigiDo"="c:\program files\Time Warner Cable\TWC WiFi\TrayApp.exe" [2013-02-27 1158480] "AdobeAAMUpdater-1.0"="c:\program files\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe" [2012-09-20 444904] "Acrobat Assistant 8.0"="c:\program files\Adobe\Acrobat 11.0\Acrobat\Acrotray.exe" [2012-09-24 3477640] "SwitchBoard"="c:\program files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe" [2010-02-19 517096] "AdobeCS6ServiceManager"="c:\program files\Common Files\Adobe\CS6ServiceManager\CS6ServiceManager.exe" [2012-03-09 1073312] . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce] "Malwarebytes Anti-Malware"="c:\program files\Malwarebytes' Anti-Malware\mbamgui.exe" [2013-04-04 532040] . c:\users\Guest\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ OneNote 2007 Screen Clipper and Launcher.lnk - c:\program files\Microsoft Office\Office12\ONENOTEM.EXE /tsr [2009-2-26 97680] . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "EnableUIADesktopToggle"= 0 (0x0) . [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WudfSvc] @="Service" . [HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Auto run of VideoCam Suite 1.0.lnk] path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\Auto run of VideoCam Suite 1.0.lnk backup=c:\windows\pss\Auto run of VideoCam Suite 1.0.lnk.CommonStartup backupExtension=.CommonStartup HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Health Check Scheduler] 2007-05-24 20:13 71176 ----a-w- c:\program files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HPADVISOR] 2009-08-05 17:27 1644088 ----a-w- c:\program files\Hewlett-Packard\HP Advisor\HPAdvisor.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\hpsysdrv] 2007-04-18 15:01 65536 ----a-w- c:\hp\support\hpsysdrv.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task] 2009-01-05 21:18 413696 ----a-w- c:\program files\QuickTime\QTTask.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateReg] 2007-04-07 09:56 54936 ----a-w- c:\windows\System32\jureg.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched] 2013-03-12 12:32 253816 ----a-w- c:\program files\Common Files\Java\Java Update\jusched.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\VMware hqtray] 2009-03-27 03:57 64048 ----a-w- c:\program files\VMware\VMware Player\hqtray.exe . [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-] "AdobeBridge"= . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-] "Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" "Adobe Acrobat Speed Launcher"="c:\program files\Adobe\Acrobat 10.0\Acrobat\Acrobat_sl.exe" "Acrobat Assistant 8.0"="c:\program files\Adobe\Acrobat 10.0\Acrobat\Acrotray.exe" "RIM PeerManager"="c:\program files\Common Files\Research In Motion\Tunnel Manager\PeerManager.exe" "RIMBBLaunchAgent.exe"=c:\program files\Common Files\Research In Motion\USB Drivers\RIMBBLaunchAgent.exe "vProt"="c:\program files\AVG Secure Search\vprot.exe" . [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring] "DisableMonitoring"=dword:00000001 . [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus] "DisableMonitoring"=dword:00000001 . [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall] "DisableMonitoring"=dword:00000001 . [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost] LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache . [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}] 2013-10-05 12:50 1185744 ----a-w- c:\program files\Google\Chrome\Application\30.0.1599.69\Installer\chrmstp.exe . Contents of the 'Scheduled Tasks' folder . 2013-10-14 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job - c:\program files\Google\Update\GoogleUpdate.exe [2010-02-06 05:17] . 2013-10-14 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job - c:\program files\Google\Update\GoogleUpdate.exe [2010-02-06 05:17] . 2013-10-01 c:\windows\Tasks\HPCeeScheduleForPeter_2.job - c:\program files\hewlett-packard\sdp\ceement\HPCEE.exe [2007-09-15 23:55] . . ------- Supplementary Scan ------- . mSearch Bar = hxxp://us.rd.yahoo.com/customize/ie/defaults/sb/msgr8/*http://www.yahoo.com/ext/search/search.html uInternet Settings,ProxyOverride = *.local uSearchURL,(Default) = hxxp://us.rd.yahoo.com/customize/ie/defaults/su/msgr8/*http://www.yahoo.com IE: &??????? ? Microsoft Excel - c:\progra~1\MICROS~3\OFFICE11\EXCEL.EXE/3000 IE: Append Link Target to Existing PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html IE: Append to Existing PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html IE: Convert Link Target to Adobe PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html IE: Convert to Adobe PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECapture.html IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000 IE: Free YouTube Download - c:\users\peter\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubedownload.htm IE: Free YouTube to Mp3 Converter - c:\users\peter\AppData\Roaming\DVDVideoSoftIEHelpers\youtubetomp3.htm LSP: c:\program files\VMware\VMware Player\vsocklib.dll TCP: DhcpNameServer = 209.18.47.61 209.18.47.62 TCP: Interfaces\{79470AA1-A7E0-47DD-A805-B910433C643B}: NameServer = 4.2.2.2,4.2.2.3 FF - ProfilePath - c:\users\peter\AppData\Roaming\Mozilla\Firefox\Profiles\ppvs4fa5.default\ FF - prefs.js: browser.search.defaulturl - FF - prefs.js: browser.search.selectedEngine - Bing FF - prefs.js: network.proxy.type - 0 FF - ExtSQL: 2013-10-07 18:51; web2pdfextension@web2pdf.adobedotcom; c:\program files\Adobe\Acrobat 11.0\Acrobat\Browser\WCFirefoxExtn . - - - - ORPHANS REMOVED - - - - . HKCU-Run-AdobeBridge - (no file) SafeBoot-WudfPf SafeBoot-WudfRd MSConfigStartUp-Acrobat Assistant 8 - c:\program files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe MSConfigStartUp-Adobe Reader Speed Launcher - c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe MSConfigStartUp-Adobe_ID0EYTHM - c:\progra~1\COMMON~1\Adobe\ADOBEV~1\Server\bin\VERSIO~2.EXE MSConfigStartUp-pronto - c:\program files\Wimba\Pronto\pronto.exe . . . ************************************************************************** . catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2013-10-14 08:17 Windows 6.0.6002 Service Pack 2 NTFS . scanning hidden processes ... . scanning hidden autostart entries ... . scanning hidden files ... . scan completed successfully hidden files: 0 . ************************************************************************** . --------------------- LOCKED REGISTRY KEYS --------------------- . [HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 . [HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 . [HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0003\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 . Completion time: 2013-10-14 08:20:45 ComboFix-quarantined-files.txt 2013-10-14 13:20 . Pre-Run: 16,900,898,816 bytes free Post-Run: 17,105,309,696 bytes free . - - End Of File - - 8F1AA6427E14F55F8AF15C766B0C64DF 8913823FF508CCF109DB74B636C301DA

This is the only file for JRT I was able to locate [Creation] "10/13/13 11:36:19 AM" [systemRoot] "C:\Windows" [Restore] "MACHINE SECURITY" "security" "C:\Windows\System32\config\security" [Restore] "MACHINE SOFTWARE" "software" "C:\Windows\System32\config\software" [Restore] "MACHINE SYSTEM" "system" "C:\Windows\System32\config\system" [Restore] "USERS .DEFAULT" "default" "C:\Windows\System32\config\default" [Restore] "MACHINE SAM" "sam" "C:\Windows\System32\config\sam" [Restore] "MACHINE COMPONENTS" "COMPON~3" "C:\Windows\System32\config\COMPON~3" [Restore] "MACHINE BCD00000000" "BCD" "C:\Boot\BCD" [Restore] "USERS S-1-5-21-4081648169-590389797-1165956351-1000" "Users\00000001\ntuser.dat" "C:\Users\peter\ntuser.dat" [Restore] "USERS S-1-5-21-4081648169-590389797-1165956351-1000_Classes" "Users\00000002\UsrClass.dat" "C:\Users\peter\AppData\Local\MICROS~1\Windows\UsrClass.dat"

I ran both files but only one gave a report. Please see report from AdwCleaner but was not given one for JRT.txt. JRT did run and automatically restart my computer but no report was given # AdwCleaner v3.007 - Report created 13/10/2013 at 11:11:57 # Updated 09/10/2013 by Xplode # Operating System : Windows Vista Home Premium Service Pack 2 (32 bits) # Username : peter - PETER-PC # Running from : C:\Users\Peter_2\Desktop\AdwCleaner(1).exe # Option : Scan ***** [ Services ] ***** ***** [ Files / Folders ] ***** ***** [ Shortcuts ] ***** ***** [ Registry ] ***** Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2} ***** [ Browsers ] ***** -\\ Internet Explorer v9.0.8112.16514 -\\ Mozilla Firefox v24.0 (en-US) [ File : C:\Users\peter\AppData\Roaming\Mozilla\Firefox\Profiles\ppvs4fa5.default\prefs.js ] [ File : C:\Users\Peter_2\AppData\Roaming\Mozilla\Firefox\Profiles\in24q4d3.default\prefs.js ] -\\ Google Chrome v30.0.1599.69 [ File : C:\Users\peter\AppData\Local\Google\Chrome\User Data\Default\preferences ] [ File : C:\Users\Peter_2\AppData\Local\Google\Chrome\User Data\Default\preferences ] ************************* AdwCleaner[R0].txt - [1097 octets] - [09/10/2013 20:17:43] AdwCleaner[R1].txt - [1218 octets] - [09/10/2013 20:53:39] AdwCleaner[R2].txt - [1338 octets] - [11/10/2013 19:46:29] AdwCleaner[R3].txt - [1250 octets] - [13/10/2013 11:11:57] AdwCleaner[s0].txt - [1159 octets] - [09/10/2013 20:28:10] AdwCleaner[s1].txt - [1279 octets] - [09/10/2013 21:04:07] AdwCleaner[s2].txt - [1399 octets] - [11/10/2013 19:47:35] ########## EOF - \AdwCleaner\AdwCleaner[R3].txt - [1490 octets] ##########

Thanks Gringo. After following your instructions, I have downloaded and run DDS. Please find below the two txt files DDS.txt and Attach.txt DDS (Ver_2012-11-20.01) - NTFS_x86 Internet Explorer: 9.0.8112.16514 BrowserJavaVersion: 10.25.2 Run by peter at 21:56:05 on 2013-10-12 Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.1.1033.18.3006.1407 [GMT -5:00] . AV: AVG AntiVirus Free Edition 2013 *Enabled/Updated* {0E9420C4-06B3-7FA0-3AB1-6E49CB52ECD9} SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} SP: AVG AntiVirus Free Edition 2013 *Enabled/Updated* {B5F5C120-2089-702E-0001-553BB0D5A664} . ============== Running Processes ================ . C:\PROGRA~1\AVG\AVG2013\avgrsx.exe C:\Program Files\AVG\AVG2013\avgcsrvx.exe C:\Windows\system32\wininit.exe C:\Windows\system32\lsm.exe C:\Windows\system32\nvvsvc.exe C:\Windows\system32\SLsvc.exe C:\Windows\system32\rundll32.exe C:\Windows\system32\brss01a.exe C:\Windows\System32\spoolsv.exe C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe C:\Program Files\Time Warner Cable\TWC WiFi\AffinegyService.exe C:\Program Files\AVG\AVG2013\avgidsagent.exe C:\Program Files\AVG\AVG2013\avgwdsvc.exe C:\Windows\System32\bgsvcgen.exe C:\Program Files\Bonjour\mDNSResponder.exe c:\Program Files\Common Files\LightScribe\LSSrvc.exe C:\Program Files\LogMeIn\x86\LMIGuardianSvc.exe C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe C:\Program Files\Airlink101\Airlink101 WLAN Monitor\RtlService.exe C:\Program Files\Common Files\Research In Motion\Tunnel Manager\mDNSResponder.exe C:\Program Files\Airlink101\Airlink101 WLAN Monitor\RtWlan.exe C:\Windows\System32\PAStiSvc.exe C:\Windows\system32\vmnat.exe C:\Windows\system32\SearchIndexer.exe C:\Windows\system32\DRIVERS\xaudio.exe C:\Program Files\Common Files\Research In Motion\Tunnel Manager\tunmgr.exe C:\Program Files\VMware\VMware Player\vmware-authd.exe C:\Windows\System32\WUDFHost.exe C:\Windows\system32\vmnetdhcp.exe C:\Windows\system32\taskeng.exe C:\Program Files\AVG\AVG2013\avgnsx.exe C:\Program Files\Common Files\Research In Motion\USB Drivers\BbDevMgr.exe c:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe C:\Program Files\Windows Media Player\wmpnetwk.exe C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe C:\Windows\system32\Dwm.exe C:\Windows\Explorer.EXE C:\Windows\RtHDVCpl.exe C:\Program Files\AVG\AVG2013\avgui.exe C:\Program Files\Common Files\Research In Motion\USB Drivers\RIMBBLaunchAgent.exe C:\Program Files\Common Files\Research In Motion\Tunnel Manager\PeerManager.exe C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe C:\Windows\system32\taskeng.exe C:\Program Files\Time Warner Cable\TWC WiFi\TrayApp.exe C:\Program Files\Adobe\Acrobat 11.0\Acrobat\acrotray.exe C:\Program Files\Windows Media Player\wmpnscfg.exe C:\Program Files\Time Warner Cable\TWC WiFi\TWC WiFi.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\plugin-container.exe C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_8_800_168.exe C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_8_800_168.exe C:\Windows\system32\jusched.exe C:\Windows\system32\SearchProtocolHost.exe C:\Windows\system32\SearchFilterHost.exe C:\Windows\system32\wbem\wmiprvse.exe C:\Windows\system32\svchost.exe -k DcomLaunch C:\Windows\system32\svchost.exe -k rpcss C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted C:\Windows\system32\svchost.exe -k netsvcs C:\Windows\system32\svchost.exe -k GPSvcGroup C:\Windows\system32\svchost.exe -k LocalService C:\Windows\system32\svchost.exe -k NetworkService C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted C:\Windows\system32\svchost.exe -k imgsvc C:\Windows\System32\svchost.exe -k WerSvcGroup C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation . ============== Pseudo HJT Report =============== . uSearch Bar = hxxp://us.rd.yahoo.com/customize/ie/defaults/sb/msgr8/*http://www.yahoo.com/ext/search/search.html uSearch Page = hxxp://us.rd.yahoo.com/customize/ie/defaults/sp/msgr8/*http://www.yahoo.com mSearch Bar = hxxp://us.rd.yahoo.com/customize/ie/defaults/sb/msgr8/*http://www.yahoo.com/ext/search/search.html mSearch Page = hxxp://us.rd.yahoo.com/customize/ie/defaults/sp/msgr8/*http://www.yahoo.com mDefault_Search_URL = hxxp://us.rd.yahoo.com/customize/ie/defaults/su/msgr8/*http://www.yahoo.com uSearchURL,(Default) = hxxp://us.rd.yahoo.com/customize/ie/defaults/su/msgr8/*http://www.yahoo.com mWinlogon: Userinit = c:\windows\system32\Userinit.exe BHO: Adobe PDF Reader Link Helper: {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelper.dll BHO: Adobe PDF Link Helper: {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll BHO: Groove GFS Browser Helper: {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - c:\program files\microsoft office\office12\GrooveShellExtensions.dll BHO: Java Plug-In SSV Helper: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - c:\program files\java\jre7\bin\ssv.dll BHO: Adobe Acrobat Create PDF Toolbar Helper: {AE7CD045-E861-484f-8273-0445EE161910} - c:\program files\common files\adobe\acrobat\wcieactivex\AcroIEFavClient.dll BHO: Java Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - c:\program files\java\jre7\bin\jp2ssv.dll BHO: Adobe Acrobat Create PDF from Selection: {F4971EE7-DAA0-4053-9964-665D8EE6A077} - c:\program files\common files\adobe\acrobat\wcieactivex\AcroIEFavClient.dll TB: Adobe Acrobat Create PDF Toolbar: {47833539-D0C5-4125-9FA8-0819E2EAAC93} - c:\program files\common files\adobe\acrobat\wcieactivex\AcroIEFavClient.dll TB: Adobe Acrobat Create PDF Toolbar: {47833539-D0C5-4125-9FA8-0819E2EAAC93} - c:\program files\common files\adobe\acrobat\wcieactivex\AcroIEFavClient.dll uRun: [WMPNSCFG] c:\program files\windows media player\WMPNSCFG.exe uRun: [AdobeBridge] <no file> uRunOnce: [Report] \AdwCleaner\AdwCleaner[s2].txt uRunOnce: [JRTcleanup] c:\users\peter\appdata\local\temp\jrt\JRT.bat mRun: [RtHDVCpl] RtHDVCpl.exe mRun: [AVG_UI] "c:\program files\avg\avg2013\avgui.exe" /TRAYONLY mRun: [RIMBBLaunchAgent.exe] c:\program files\common files\research in motion\usb drivers\RIMBBLaunchAgent.exe mRun: [RIM PeerManager] "c:\program files\common files\research in motion\tunnel manager\PeerManager.exe" mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe" mRun: [sunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe" mRun: [DigiDo] "c:\program files\time warner cable\twc wifi\TrayApp.exe" startup mRun: [AdobeAAMUpdater-1.0] "c:\program files\common files\adobe\oobe\pdapp\uwa\UpdaterStartupUtility.exe" mRun: [Acrobat Assistant 8.0] "c:\program files\adobe\acrobat 11.0\acrobat\Acrotray.exe" mRun: [switchBoard] c:\program files\common files\adobe\switchboard\SwitchBoard.exe mRun: [AdobeCS6ServiceManager] "c:\program files\common files\adobe\cs6servicemanager\CS6ServiceManager.exe" -launchedbylogin mRunOnce: [Malwarebytes Anti-Malware] c:\program files\malwarebytes' anti-malware\mbamgui.exe /install /silent mPolicies-Explorer: NoDriveTypeAutoRun = dword:255 mPolicies-Explorer: BindDirectlyToPropertySetStorage = dword:0 mPolicies-System: EnableUIADesktopToggle = dword:0 IE: &??????? ? Microsoft Excel - <no file> IE: Append Link Target to Existing PDF - c:\program files\common files\adobe\acrobat\activex\AcroIEFavClient.dll/AcroIEAppendSelLinks.html IE: Append to Existing PDF - c:\program files\common files\adobe\acrobat\activex\AcroIEFavClient.dll/AcroIEAppend.html IE: Convert Link Target to Adobe PDF - c:\program files\common files\adobe\acrobat\activex\AcroIEFavClient.dll/AcroIECaptureSelLinks.html IE: Convert to Adobe PDF - c:\program files\common files\adobe\acrobat\activex\AcroIEFavClient.dll/AcroIECapture.html IE: E&xport to Microsoft Excel - c:\progra~1\micros~3\office12\EXCEL.EXE/3000 IE: Free YouTube Download - c:\users\peter\appdata\roaming\dvdvideosoftiehelpers\freeyoutubedownload.htm IE: Free YouTube to Mp3 Converter - c:\users\peter\appdata\roaming\dvdvideosoftiehelpers\youtubetomp3.htm IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\program files\microsoft office\office12\ONBttnIE.dll IE: {36ECAF82-3300-8F84-092E-AFF36D6C7040} - {86529161-034E-4F8A-88D2-3C625E612E04} - c:\program files\winhttrack\WinHTTrackIEBar.dll IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} LSP: c:\program files\vmware\vmware player\vsocklib.dll TCP: NameServer = 209.18.47.61 209.18.47.62 TCP: Interfaces\{79470AA1-A7E0-47DD-A805-B910433C643B} : NameServer = 4.2.2.2,4.2.2.3 TCP: Interfaces\{B315F718-9933-4B4E-8600-EBA98A633554} : DHCPNameServer = 209.18.47.61 209.18.47.62 TCP: Interfaces\{F2130641-846C-4CDD-8B61-5888841DD668} : DHCPNameServer = 209.18.47.61 209.18.47.62 Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - c:\program files\microsoft office\office12\GrooveSystemServices.dll Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - <orphaned> Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\program files\common files\skype\Skype4COM.dll SEH: Groove GFS Stub Execution Hook - {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - c:\program files\microsoft office\office12\GrooveShellExtensions.dll LSA: Security Packages = kerberos msv1_0 schannel wdigest tspkg mASetup: {8A69D345-D564-463c-AFF1-A69D9E530F96} - "c:\program files\google\chrome\application\30.0.1599.69\installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --multi-install --chrome . ================= FIREFOX =================== . FF - ProfilePath - c:\users\peter\appdata\roaming\mozilla\firefox\profiles\ppvs4fa5.default\ FF - prefs.js: browser.search.defaulturl - FF - prefs.js: browser.search.selectedEngine - Bing FF - prefs.js: network.proxy.type - 0 FF - plugin: c:\program files\adobe\acrobat 11.0\acrobat\air\nppdf32.dll FF - plugin: c:\program files\adobe\reader 10.0\reader\air\nppdf32.dll FF - plugin: c:\program files\common files\adobe\oobe\pdapp\ccm\utilities\npAdobeAAMDetect32.dll FF - plugin: c:\program files\common files\adobe\oobe\pdapp\ccm\utilities\npAdobeAAMDetect64.dll FF - plugin: c:\program files\common files\avg secure search\sitesafetyinstaller\17.0.12\npsitesafety.dll FF - plugin: c:\program files\common files\research in motion\bbwebsllauncher\NPWebSLLauncher.dll FF - plugin: c:\program files\google\google earth\plugin\npgeplugin.dll FF - plugin: c:\program files\google\update\1.3.21.153\npGoogleUpdate3.dll FF - plugin: c:\program files\java\jre7\bin\plugin2\npjp2.dll FF - plugin: c:\program files\microsoft silverlight\5.1.20913.0\npctrlui.dll FF - plugin: c:\users\peter\appdata\roaming\move networks\plugins\npqmp071503000010.dll FF - plugin: c:\users\peter\appdata\roaming\move networks\plugins\npqmp071705000014.dll FF - plugin: c:\users\peter\program files\dna\plugins\npbtdna.dll FF - plugin: c:\windows\system32\macromed\flash\NPSWF32_11_8_800_168.dll FF - plugin: c:\windows\system32\npDeployJava1.dll FF - plugin: c:\windows\system32\npmproxy.dll FF - plugin: c:\windows\system32\NPSWF32.dll FF - ExtSQL: 2013-10-07 18:51; web2pdfextension@web2pdf.adobedotcom; c:\program files\adobe\acrobat 11.0\acrobat\browser\WCFirefoxExtn . ============= SERVICES / DRIVERS =============== . R0 AVGIDSHX;AVGIDSHX;c:\windows\system32\drivers\avgidshx.sys [2013-7-20 60216] R0 Avglogx;AVG Logging Driver;c:\windows\system32\drivers\avglogx.sys [2013-7-20 246072] R0 Avgmfx86;AVG Mini-Filter Resident Anti-Virus Shield;c:\windows\system32\drivers\avgmfx86.sys [2013-7-1 96568] R0 Avgrkx86;AVG Anti-Rootkit Driver;c:\windows\system32\drivers\avgrkx86.sys [2013-9-5 39224] R1 AVGIDSDriver;AVGIDSDriver;c:\windows\system32\drivers\avgidsdriverx.sys [2013-7-20 208184] R1 AVGIDSShim;AVGIDSShim;c:\windows\system32\drivers\avgidsshimx.sys [2013-9-10 22328] R1 Avgldx86;AVG AVI Loader Driver;c:\windows\system32\drivers\avgldx86.sys [2013-7-20 171320] R1 Avgtdix;AVG TDI Driver;c:\windows\system32\drivers\avgtdix.sys [2013-3-21 182072] R1 avgtp;avgtp;c:\windows\system32\drivers\avgtpx86.sys [2012-12-14 37664] R2 AVGIDSAgent;AVGIDSAgent;c:\program files\avg\avg2013\avgidsagent.exe [2013-7-4 4939312] R2 avgwd;AVG WatchDog;c:\program files\avg\avg2013\avgwdsvc.exe [2013-7-23 283136] R2 FontCache;Windows Font Cache Service;c:\windows\system32\svchost.exe -k LocalServiceAndNoImpersonation [2008-6-24 21504] R2 LMIGuardianSvc;LMIGuardianSvc;c:\program files\logmein\x86\LMIGuardianSvc.exe [2011-3-1 374152] R2 LMIInfo;LogMeIn Kernel Information Provider;c:\program files\logmein\x86\rainfo.sys [2010-9-17 12856] R2 LMIRfsDriver;LogMeIn Remote File System Driver;c:\windows\system32\drivers\LMIRfsDriver.sys [2011-5-11 47640] R2 MBAMService;MBAMService;c:\program files\malwarebytes' anti-malware\mbamservice.exe [2013-10-11 701512] R2 Realtek92SU;Realtek92SU;c:\program files\airlink101\airlink101 wlan monitor\RtlService.exe [2013-8-20 40960] R2 RIM MDNS;RIM MDNS;c:\program files\common files\research in motion\tunnel manager\mDNSResponder.exe [2013-4-26 389632] R2 RIM Tunnel Service;BlackBerry Link Communication Manager;c:\program files\common files\research in motion\tunnel manager\tunmgr.exe [2013-4-26 1235456] R2 vmci;VMware vmci;c:\windows\system32\drivers\vmci.sys [2009-3-26 54960] R3 BlackBerry Device Manager;BlackBerry Device Manager;c:\program files\common files\research in motion\usb drivers\BbDevMgr.exe [2013-2-6 585728] R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2013-10-11 22856] R3 rimvndis;BlackBerry Virtual Private Network;c:\windows\system32\drivers\rimvndis6.sys [2013-4-26 14336] S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384] S2 SkypeUpdate;Skype Updater;c:\program files\skype\updater\Updater.exe [2012-11-9 160944] S2 vToolbarUpdater17.0.12;vToolbarUpdater17.0.12;c:\program files\common files\avg secure search\vtoolbarupdater\17.0.12\toolbarupdater.exe --> c:\program files\common files\avg secure search\vtoolbarupdater\17.0.12\ToolbarUpdater.exe [?] S3 PAC7311;Trust Webcam 14839;c:\windows\system32\drivers\PA707UCM.SYS [2005-10-18 154752] S3 RTL8192su;Airlink101 Wireless N USB Adapter;c:\windows\system32\drivers\rtl8192su.sys [2013-8-20 526848] S3 SwitchBoard;Adobe SwitchBoard;c:\program files\common files\adobe\switchboard\SwitchBoard.exe [2010-2-19 517096] S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\microsoft.net\framework\v4.0.30319\wpf\WPFFontCache_v0400.exe [2013-7-20 754856] . =============== File Associations =============== . ShellExec: dreamweaver.exe: Open="c:\program files\adobe\adobe dreamweaver cs6\dreamweaver.exe", "%1" . =============== Created Last 30 ================ . 2013-10-12 20:17:48 -------- d-----w- c:\windows\ERUNT 2013-10-12 02:35:09 22856 ----a-w- c:\windows\system32\drivers\mbam.sys 2013-10-12 02:35:09 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware 2013-10-11 06:49:38 7328304 ----a-w- c:\programdata\microsoft\windows defender\definition updates\{5ca1c4f7-eb28-4129-8f4c-a0820c22c9c5}\mpengine.dll 2013-10-10 01:17:13 -------- d-----w- C:\AdwCleaner 2013-10-09 23:17:08 -------- d-----w- c:\programdata\HitmanPro 2013-10-09 07:35:39 798208 ----a-w- c:\windows\system32\FntCache.dll 2013-10-08 01:09:08 -------- d-----w- c:\programdata\ALM 2013-10-08 01:00:30 -------- d-----w- c:\users\peter\Adobe Flash Builder 4.6 2013-10-08 00:51:44 -------- d-----w- C:\adobeTemp 2013-10-07 22:47:46 -------- d-----w- c:\program files\Adobe Download Assistant 2013-10-07 21:34:40 -------- d-----w- c:\users\peter\appdata\local\Alpemix 2013-10-07 20:56:10 -------- d-----w- c:\program files\Webteh 2013-09-29 13:40:46 82896 ----a-w- c:\windows\system32\WSMonEditor.dll 2013-09-29 13:40:15 -------- d-----w- c:\users\peter\appdata\local\Wondershare 2013-09-29 13:40:14 -------- d-----w- c:\program files\common files\Wondershare 2013-09-29 13:39:32 -------- d-----w- c:\programdata\PDFEditor 2013-09-29 13:39:31 -------- d-----w- c:\users\peter\appdata\roaming\Wondershare . ==================== Find3M ==================== . 2013-10-02 08:01:13 37664 ----a-w- c:\windows\system32\drivers\avgtpx86.sys 2013-09-22 10:22:59 1800704 ----a-w- c:\windows\system32\jscript9.dll 2013-09-22 10:14:39 1427968 ----a-w- c:\windows\system32\inetcpl.cpl 2013-09-22 10:13:22 1129472 ----a-w- c:\windows\system32\wininet.dll 2013-09-22 10:08:41 142848 ----a-w- c:\windows\system32\ieUnatt.exe 2013-09-22 10:06:58 420864 ----a-w- c:\windows\system32\vbscript.dll 2013-09-22 10:03:18 2382848 ----a-w- c:\windows\system32\mshtml.tlb 2013-09-14 13:21:15 71048 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl 2013-09-14 13:21:15 692616 ----a-w- c:\windows\system32\FlashPlayerApp.exe 2013-09-10 06:34:48 22328 ----a-w- c:\windows\system32\drivers\avgidsshimx.sys 2013-09-05 06:43:42 39224 ----a-w- c:\windows\system32\drivers\avgrkx86.sys 2013-08-29 07:36:04 2050048 ----a-w- c:\windows\system32\win32k.sys 2013-08-27 02:47:50 219648 ----a-w- c:\windows\system32\d3d10_1core.dll 2013-08-27 02:47:50 189952 ----a-w- c:\windows\system32\d3d10core.dll 2013-08-27 02:47:50 160768 ----a-w- c:\windows\system32\d3d10_1.dll 2013-08-27 02:47:50 1029120 ----a-w- c:\windows\system32\d3d10.dll 2013-08-27 01:52:08 1172480 ----a-w- c:\windows\system32\d3d10warp.dll 2013-08-27 01:50:40 486400 ----a-w- c:\windows\system32\d3d10level9.dll 2013-08-27 01:32:20 683008 ----a-w- c:\windows\system32\d2d1.dll 2013-08-27 01:28:36 1069056 ----a-w- c:\windows\system32\DWrite.dll 2013-08-07 09:22:04 238872 ------w- c:\windows\system32\MpSigStub.exe 2013-08-02 04:09:35 1548288 ----a-w- c:\windows\system32\WMVDECOD.DLL 2013-08-01 03:16:32 638400 ----a-w- c:\windows\system32\drivers\dxgkrnl.sys 2013-08-01 02:49:15 37376 ----a-w- c:\windows\system32\cdd.dll 2013-07-20 10:44:53 102608 ----a-w- c:\windows\system32\PresentationCFFRasterizerNative_v0300.dll 2013-07-20 06:51:00 246072 ----a-w- c:\windows\system32\drivers\avglogx.sys 2013-07-20 06:50:56 60216 ----a-w- c:\windows\system32\drivers\avgidshx.sys 2013-07-20 06:50:56 208184 ----a-w- c:\windows\system32\drivers\avgidsdriverx.sys 2013-07-20 06:50:50 171320 ----a-w- c:\windows\system32\drivers\avgldx86.sys 2013-07-17 19:41:34 2048 ----a-w- c:\windows\system32\tzres.dll 2013-07-16 04:35:16 615936 ----a-w- c:\windows\system32\themeui.dll . ============= FINISH: 21:56:54.03 =============== . UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG. IF REQUESTED, ZIP IT UP & ATTACH IT . DDS (Ver_2012-11-20.01) . Microsoft® Windows Vista™ Home Premium Boot Device: \Device\HarddiskVolume1 Install Date: 09/21/07 4:15:19 AM System Uptime: 10/12/13 3:19:35 PM (6 hours ago) . Motherboard: ECS | | Iris Processor: AMD Athlon 64 Processor 4000+ | Socket AM2 | 2600/201mhz . ==== Disk Partitions ========================= . C: is FIXED (NTFS) - 103 GiB total, 15.944 GiB free. D: is FIXED (NTFS) - 9 GiB total, 1.234 GiB free. E: is CDROM () F: is Removable G: is Removable H: is Removable I: is Removable J: is Removable L: is CDROM () . ==== Disabled Device Manager Items ============= . Class GUID: {4d36e972-e325-11ce-bfc1-08002be10318} Description: Airlink101 Wireless N USB Adapter Device ID: USB\VID_0BDA&PID_8171\00E04C000001 Manufacturer: Airlink101 Name: Airlink101 Wireless N USB Adapter PNP Device ID: USB\VID_0BDA&PID_8171\00E04C000001 Service: RTL8192su . Class GUID: {4d36e972-e325-11ce-bfc1-08002be10318} Description: VMware Virtual Ethernet Adapter for VMnet1 Device ID: ROOT\VMWARE\0000 Manufacturer: VMware, Inc. Name: VMware Virtual Ethernet Adapter for VMnet1 PNP Device ID: ROOT\VMWARE\0000 Service: VMnetAdapter . Class GUID: {4d36e972-e325-11ce-bfc1-08002be10318} Description: VMware Virtual Ethernet Adapter for VMnet8 Device ID: ROOT\VMWARE\0001 Manufacturer: VMware, Inc. Name: VMware Virtual Ethernet Adapter for VMnet8 PNP Device ID: ROOT\VMWARE\0001 Service: VMnetAdapter . ==== System Restore Points =================== . No restore point in system. . ==== Installed Programs ====================== . Update for Microsoft Office 2007 (KB2508958) 7-Zip 9.20 ActiveCheck component for HP Active Support Library Adobe Acrobat XI Pro Adobe Acrobat XI Pro Licence XI Pro Adobe AIR Adobe Creative Suite 6 Master Collection Adobe CS6 Master Collection Licence CS 6 Adobe Download Assistant Adobe ExtendScript Toolkit 2 Adobe Flash Player 11 ActiveX Adobe Flash Player 11 Plugin Adobe Help Manager Adobe Media Player Adobe Reader X (10.1.8) Adobe Setup Adobe SVG Viewer 3.0 Adobe Widget Browser Airlink101 WLAN Monitor AVG 2013 BitTorrent bl BlackBerry Device Software Updater BlackBerry Link Bonjour Brother MFL-Pro Suite Business PlanMaker Professional CCleaner Compatibility Pack for the 2007 Office system DIY DataRecovery CHK-Mate DNA Fast Directory Submitter 1.54 FileZilla Client 3.7.0.2 Free 3GP Video Converter version 3.2 Free DVD MP3 Ripper 1.12 Free Studio version 4.8 Free Video to Flash Converter version 4.1 Google Chrome Google Earth H&R Block Deluxe + Efile + State 2010 H&R Block Deluxe + Efile + State 2011 H&R Block Deluxe + Efile 2012 H&R Block Premium + Efile + State 2009 Hardware Diagnostic Tools Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595) Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484) HP Active Support Library HP Active Support Library 32 bit components HP Advisor HP Customer Experience Enhancements HP Customer Feedback HP Easy Setup - Frontend HP On-Screen Cap/Num/Scroll Lock Indicator HP Photosmart Essential 2.01 HP Photosmart Essential2.01 HP Product Detection HP Update HPAsset component for HP Active Support Library Java 7 Update 25 Java Auto Updater Java SE Runtime Environment 6 Update 1 LightScribe 1.8.15.1 LogMeIn Malwarebytes Anti-Malware version 1.75.0.1300 Microsoft .NET Framework 3.5 SP1 Microsoft .NET Framework 4 Client Profile Microsoft Office 2007 Service Pack 3 (SP3) Microsoft Office Access MUI (English) 2007 Microsoft Office Access Setup Metadata MUI (English) 2007 Microsoft Office Enterprise 2007 Microsoft Office Excel MUI (English) 2007 Microsoft Office File Validation Add-In Microsoft Office Groove MUI (English) 2007 Microsoft Office Groove Setup Metadata MUI (English) 2007 Microsoft Office InfoPath MUI (English) 2007 Microsoft Office OneNote MUI (English) 2007 Microsoft Office Outlook MUI (English) 2007 Microsoft Office PowerPoint MUI (English) 2007 Microsoft Office Proof (English) 2007 Microsoft Office Proof (French) 2007 Microsoft Office Proof (Spanish) 2007 Microsoft Office Proofing (English) 2007 Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3) Microsoft Office Publisher MUI (English) 2007 Microsoft Office Shared MUI (English) 2007 Microsoft Office Shared Setup Metadata MUI (English) 2007 Microsoft Office Word MUI (English) 2007 Microsoft Silverlight Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 Microsoft Visual C++ 2005 Redistributable Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148 Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570 Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 Microsoft Visual C++ Run Time Lib Setup Microsoft Works Microsoft_VC80_ATL_x86 Microsoft_VC80_CRT_x86 Microsoft_VC80_MFC_x86 Microsoft_VC80_MFCLOC_x86 Microsoft_VC90_ATL_x86 Microsoft_VC90_CRT_x86 Microsoft_VC90_MFC_x86 Microsoft_VC90_MFCLOC_x86 Move Media Player Mozilla Firefox 24.0 (x86 en-US) Mozilla Maintenance Service MSXML 4.0 SP2 (KB936181) MSXML 4.0 SP2 (KB941833) MSXML 4.0 SP2 (KB954430) MSXML 4.0 SP2 (KB973688) muvee autoProducer 6.0 My HP Games NVIDIA Drivers OGA Notifier 2.0.0048.0 PDF Settings CS6 Pdf995 (installed by TaxCut) PdfEdit995 (installed by TaxCut) ph ProposalWriter PSSWCORE PxMergeModule Python 2.5 QuickTime Realtek High Definition Audio Driver Respondus LockDown Browser Rhapsody Rhapsody Player Engine Roxio Activation Module Roxio Creator Audio Roxio Creator Basic v9 Roxio Creator Copy Roxio Creator Data Roxio Creator EasyArchive Roxio Creator Tools Roxio Express Labeler 3 Security Update for Microsoft .NET Framework 3.5 SP1 (KB2604111) Security Update for Microsoft .NET Framework 3.5 SP1 (KB2736416) Security Update for Microsoft .NET Framework 3.5 SP1 (KB2840629) Security Update for Microsoft .NET Framework 3.5 SP1 (KB2861697) Security Update for Microsoft .NET Framework 4 Client Profile (KB2446708) Security Update for Microsoft .NET Framework 4 Client Profile (KB2478663) Security Update for Microsoft .NET Framework 4 Client Profile (KB2518870) Security Update for Microsoft .NET Framework 4 Client Profile (KB2539636) Security Update for Microsoft .NET Framework 4 Client Profile (KB2572078) Security Update for Microsoft .NET Framework 4 Client Profile (KB2604121) Security Update for Microsoft .NET Framework 4 Client Profile (KB2633870) Security Update for Microsoft .NET Framework 4 Client Profile (KB2656351) Security Update for Microsoft .NET Framework 4 Client Profile (KB2656368) Security Update for Microsoft .NET Framework 4 Client Profile (KB2656368v2) Security Update for Microsoft .NET Framework 4 Client Profile (KB2656405) Security Update for Microsoft .NET Framework 4 Client Profile (KB2686827) Security Update for Microsoft .NET Framework 4 Client Profile (KB2729449) Security Update for Microsoft .NET Framework 4 Client Profile (KB2737019) Security Update for Microsoft .NET Framework 4 Client Profile (KB2742595) Security Update for Microsoft .NET Framework 4 Client Profile (KB2789642) Security Update for Microsoft .NET Framework 4 Client Profile (KB2804576) Security Update for Microsoft .NET Framework 4 Client Profile (KB2832407) Security Update for Microsoft .NET Framework 4 Client Profile (KB2835393) Security Update for Microsoft .NET Framework 4 Client Profile (KB2840628) Security Update for Microsoft .NET Framework 4 Client Profile (KB2840628v2) Security Update for Microsoft .NET Framework 4 Client Profile (KB2858302v2) Security Update for Microsoft .NET Framework 4 Client Profile (KB2861188) Security Update for Microsoft Office 2007 suites (KB2596744) 32-Bit Edition Security Update for Microsoft Office 2007 suites (KB2596754) 32-Bit Edition Security Update for Microsoft Office 2007 suites (KB2596792) 32-Bit Edition Security Update for Microsoft Office 2007 suites (KB2596825) 32-Bit Edition Security Update for Microsoft Office 2007 suites (KB2596871) 32-Bit Edition Security Update for Microsoft Office 2007 suites (KB2597969) 32-Bit Edition Security Update for Microsoft Office 2007 suites (KB2597973) 32-Bit Edition Security Update for Microsoft Office 2007 suites (KB2687309) 32-Bit Edition Security Update for Microsoft Office 2007 suites (KB2687439) 32-Bit Edition Security Update for Microsoft Office 2007 suites (KB2760411) 32-Bit Edition Security Update for Microsoft Office 2007 suites (KB2760585) 32-Bit Edition Security Update for Microsoft Office 2007 suites (KB2760591) 32-Bit Edition Security Update for Microsoft Office 2007 suites (KB2827326) 32-Bit Edition Security Update for Microsoft Office 2007 suites (KB2827329) 32-Bit Edition Security Update for Microsoft Office Excel 2007 (KB2827324) 32-Bit Edition Security Update for Microsoft Office InfoPath 2007 (KB2687440) 32-Bit Edition Security Update for Microsoft Office Outlook 2007 (KB2825999) 32-Bit Edition Security Update for Microsoft Office PowerPoint 2007 (KB2596764) 32-Bit Edition Security Update for Microsoft Office PowerPoint 2007 (KB2596912) 32-Bit Edition Security Update for Microsoft Office Publisher 2007 (KB2597971) 32-Bit Edition Security Update for Microsoft Office Word 2007 (KB2827330) 32-Bit Edition Skype™ 6.0 Soft Data Fax Modem with SmartCP SopCast 2.0.4 TaxCut Premium + Efile 2008 TaxCut Premium 2007 TWC WiFi Update for 2007 Microsoft Office System (KB967642) Update for Microsoft .NET Framework 3.5 SP1 (KB963707) Update for Microsoft .NET Framework 4 Client Profile (KB2468871) Update for Microsoft .NET Framework 4 Client Profile (KB2533523) Update for Microsoft .NET Framework 4 Client Profile (KB2600217) Update for Microsoft .NET Framework 4 Client Profile (KB2836939) Update for Microsoft .NET Framework 4 Client Profile (KB2836939v3) Update for Microsoft Office 2007 Help for Common Features (KB963673) Update for Microsoft Office 2007 suites (KB2596620) 32-Bit Edition Update for Microsoft Office 2007 suites (KB2687493) 32-Bit Edition Update for Microsoft Office 2007 suites (KB2767849) 32-Bit Edition Update for Microsoft Office 2007 suites (KB2767916) 32-Bit Edition Update for Microsoft Office Access 2007 Help (KB963663) Update for Microsoft Office Excel 2007 Help (KB963678) Update for Microsoft Office Infopath 2007 Help (KB963662) Update for Microsoft Office OneNote 2007 Help (KB963670) Update for Microsoft Office Outlook 2007 (KB2687404) 32-Bit Edition Update for Microsoft Office Outlook 2007 Help (KB963677) Update for Microsoft Office Outlook 2007 Junk Email Filter (KB2827325) 32-Bit Edition Update for Microsoft Office Powerpoint 2007 Help (KB963669) Update for Microsoft Office Publisher 2007 Help (KB963667) Update for Microsoft Office Script Editor Help (KB963671) Update for Microsoft Office Word 2007 Help (KB963665) VideoCam Suite VideoCam Suite 1.0 VideoToolkit01 VMware Player WeatherBug Gadget WebFerret Windows Media Player Firefox Plugin WinHTTrack Website Copier 3.43-3 WinRAR archiver WMV Converter 2.5 . ==== Event Viewer Messages From Past Week ======== . 10/12/13 9:56:09 PM, Error: Service Control Manager [7016] - The BrSplService service has reported an invalid current state 0. 10/12/13 3:56:47 PM, Error: BROWSER [8020] - The browser was unable to promote itself to master browser. The computer that currently believes it is the master browser is unknown. 10/12/13 3:26:02 PM, Error: netbt [4321] - The name "WORKGROUP :1d" could not be registered on the interface with IP address 192.168.0.2. The computer with the IP address 192.168.0.8 did not allow the name to be claimed by this computer. 10/12/13 3:21:36 PM, Error: Service Control Manager [7000] - The vToolbarUpdater17.0.12 service failed to start due to the following error: The system cannot find the file specified. 10/12/13 3:20:30 PM, Error: Microsoft-Windows-PrintSpooler [19] - The print spooler failed to share printer PDF995 with shared resource name PDF995. Error 2114. The printer cannot be used by others on the network. 10/12/13 3:20:30 PM, Error: Microsoft-Windows-PrintSpooler [19] - The print spooler failed to share printer Business Plan PDF Driver v251 with shared resource name Business Plan PDF Driver v251. Error 2114. The printer cannot be used by others on the network. 10/12/13 3:20:30 PM, Error: Microsoft-Windows-PrintSpooler [19] - The print spooler failed to share printer Brother PC-FAX v.2 with shared resource name Brother PC-FAX v.2. Error 2114. The printer cannot be used by others on the network. 10/12/13 3:20:30 PM, Error: Microsoft-Windows-PrintSpooler [19] - The print spooler failed to share printer Brother MFC-640CW USB Printer with shared resource name Brother MFC-640CW USB Printer. Error 2114. The printer cannot be used by others on the network. 10/12/13 3:20:26 PM, Error: Microsoft-Windows-HttpEvent [15021] - An error occured while using SSL configuration for socket address 0.0.0.0:4482. The error status code is contained within the returned data. 10/12/13 3:18:57 PM, Error: Service Control Manager [7006] - The ScRegSetValueExW call failed for FailureActions with the following error: Access is denied. 10/12/13 2:48:50 PM, Error: BROWSER [8019] - The browser was unable to promote itself to master browser. The browser will continue to attempt to promote itself to the master browser, but will no longer log any events in the event log in Event Viewer. 10/12/13 11:48:48 AM, Error: bowser [8003] - The master browser has received a server announcement from the computer PLAYBOOK-0249 that believes that it is the master browser for the domain on transport NetBT_Tcpip_{B315F718-9933-4B4E-8600-EBA9. The master browser is stopping or an election is being forced. 10/12/13 11:46:33 AM, Error: netbt [4319] - A duplicate name has been detected on the TCP network. The IP address of the computer that sent the message is in the data. Use nbtstat -n in a command window to see which name is in the Conflict state. 10/11/13 7:44:34 PM, Error: Service Control Manager [7009] - A timeout was reached (30000 milliseconds) while waiting for the Windows Media Player Network Sharing Service service to connect. 10/11/13 7:44:34 PM, Error: Service Control Manager [7000] - The Windows Media Player Network Sharing Service service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion. 10/11/13 7:43:54 PM, Error: Service Control Manager [7011] - A timeout (30000 milliseconds) was reached while waiting for a transaction response from the Realtek92SU service. 10/09/13 3:31:01 AM, Error: Service Control Manager [7009] - A timeout was reached (30000 milliseconds) while waiting for the Windows Search service to connect. 10/09/13 3:31:01 AM, Error: Service Control Manager [7000] - The Windows Search service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion. 10/09/13 3:01:02 AM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1053" attempting to start the service WSearch with arguments "" in order to run the server: {7D096C5F-AC08-4F1F-BEB7-5C22C517CE39} 10/09/13 12:01:50 PM, Error: Server [2505] - The server could not bind to the transport \Device\NetBT_Tcpip_{B315F718-9933-4B4E-8600-EBA98A633554} because another computer on the network has the same name. The server could not start. 10/07/13 9:53:15 PM, Error: Service Control Manager [7011] - A timeout (30000 milliseconds) was reached while waiting for a transaction response from the avgwd service. 10/07/13 9:03:49 AM, Error: Service Control Manager [7043] - The AVGIDSAgent service did not shut down properly after receiving a preshutdown control. 10/07/13 4:34:50 PM, Error: Service Control Manager [7030] - The AlpemixServicex service is marked as an interactive service. However, the system is configured to not allow interactive services. This service may not function properly. 10/07/13 10:24:23 AM, Error: bowser [8003] - The master browser has received a server announcement from the computer BLACKBERRY-CAEE that believes that it is the master browser for the domain on transport NetBT_Tcpip_{B315F718-9933-4B4E-8600-EB. The master browser is stopping or an election is being forced. 10/06/13 10:10:07 PM, Error: netbt [4321] - The name "WORKGROUP :1d" could not be registered on the interface with IP address 192.168.0.2. The computer with the IP address 192.168.0.4 did not allow the name to be claimed by this computer. . ==== End Of File ===========================

Hi, I have this annoying sweet pack issue. I have tried using Adware and it does not catch this and have tried using other scanners as well to no avail. Malwarebytes, finds it but does not delete it. Each time malwarebytes locates it then asks if I want to delete, i say yes, then reboot and scan again, it is still there. This is the results after the deletion request from using malwarebytes. You will see tha even after deletion on reboot, it still is there. Please help Malwarebytes Anti-Malware (PRO) 1.75.0.1300 www.malwarebytes.org Database version: v2013.10.12.01 Windows Vista Service Pack 2 x86 NTFS Internet Explorer 9.0.8112.16421 Peter_2 :: PETER-PC [limited] Protection: Enabled 10/11/2013 9:39:46 PM mbam-log-2013-10-11 (21-39-46).txt Scan type: Full scan (C:\|D:\|E:\|F:\|G:\|H:\|I:\|J:\|L:\|M:\|) Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM Scan options disabled: P2P Objects scanned: 502509 Time elapsed: 2 hour(s), 8 minute(s), 28 second(s) Memory Processes Detected: 0 (No malicious items detected) Memory Modules Detected: 0 (No malicious items detected) Registry Keys Detected: 1 HKLM\SOFTWARE\Wow6432Node\Updater By SweetPacks (PUP.Optional.SweetPacks.A) -> Delete on reboot. Registry Values Detected: 0 (No malicious items detected) Registry Data Items Detected: 0 (No malicious items detected) Folders Detected: 0 (No malicious items detected) Files Detected: 0 (No malicious items detected) (end)