janedoe1776

no unfortunately it did not help.

ok.. running it now

Well Mr Gringo, I think I am going to go ahead and reformat then attempt to re-install the OS. I still can't run any programs without going into safe mode even with everything we have done to this thing. If the reformat and re-install doesnt work I guess I am SOL on the laptop. I really do appreciate the help you have given me.

and here is the highjackthis log: Logfile of Trend Micro HijackThis v2.0.4 Scan saved at 12:55:34 PM, on 10/26/2013 Platform: Windows Vista SP2 (WinNT 6.00.1906) MSIE: Internet Explorer v9.00 (9.00.8112.16514) Boot mode: Safe mode with network support Running processes: C:\Windows\Explorer.EXE C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\RealNetworks\RealDownloader\recordingmanager.exe C:\Users\Karli\Downloads\HijackThis.exe R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = O2 - BHO: RealNetworks Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\IE\rndlbrowserrecordplugin.dll O2 - BHO: Java Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll O2 - BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O2 - BHO: Windows Live Messenger Companion Helper - {9FDDE16B-836F-4806-AB1F-1455CBEFF289} - C:\Program Files\Windows Live\Companion\companioncore.dll O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll O4 - HKLM\..\Run: [ZoneAlarm] "C:\Program Files\CheckPoint\ZoneAlarm\zatray.exe" O4 - HKLM\..\Run: [TvOutSwitch] C:\Program Files\Fujitsu\DispSwitch\DispSwitchLauncher.exe O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe O4 - HKLM\..\Run: [LoadFujitsuQuickTouch] C:\Program Files\Fujitsu\Application Panel\QuickTouch.exe O4 - HKLM\..\Run: [LoadFUJ02E3] C:\Program Files\Fujitsu\FUJ02E3\FUJ02E3.exe O4 - HKLM\..\Run: [LoadBtnHnd] C:\Program Files\Fujitsu\BtnHnd\BtnHnd.exe O4 - HKLM\..\Run: [LanguageShortcut] "C:\Program Files\CyberLink\PowerDVD\Language\Language.exe" O4 - HKLM\..\Run: [indicatorUtility] C:\Program Files\Fujitsu\Fujitsu Hotkey Utility\IndicatorUty.exe O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe O4 - HKLM\..\Run: [FJUPDNV_Chitose] C:\Program Files\Fujitsu\fjdvrupd\updatenv.exe O4 - HKLM\..\Run: [331BigDog] C:\Windows\VM331_STI.EXE O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Real\RealPlayer\update\realsched.exe" -osboot O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe" O4 - HKLM\..\Run: [AvastUI.exe] "C:\Program Files\AVAST Software\Avast\AvastUI.exe" /nogui O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe O4 - HKUS\S-1-5-18\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe (User 'Default user') O4 - .DEFAULT User Startup: CCC.lnk = ? (User 'Default user') O4 - Startup: CCC.lnk = ? O4 - Startup: Dropbox.lnk = C:\Users\Karli\AppData\Roaming\Dropbox\bin\Dropbox.exe O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe O9 - Extra button: @C:\Program Files\Windows Live\Companion\companionlang.dll,-600 - {0000036B-C524-4050-81A0-243669A86B9F} - C:\Program Files\Windows Live\Companion\companioncore.dll O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL O9 - Extra button: Add to EverNote - {A5ABA0BB-F195-40d8-A5E9-0801153E6597} - C:\Program Files\EverNote\EverNote\enbar.dll O9 - Extra 'Tools' menuitem: Add to EverNote - {A5ABA0BB-F195-40d8-A5E9-0801153E6597} - C:\Program Files\EverNote\EverNote\enbar.dll O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics O16 - DPF: {48DD0448-9209-4F81-9F6D-D83562940134} (MySpace Uploader Control) - http://lads.myspace.com/upload/MySpaceUploader1006.cab O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\Windows\system32\browseui.dll O23 - Service: SAS Core Service (!SASCORE) - SUPERAntiSpyware.com - C:\Program Files\SUPERAntiSpyware\SASCORE.EXE O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe O23 - Service: Agere Modem Call Progress Audio (AgereModemAudio) - Agere Systems - C:\Windows\system32\agrsmsvc.exe O23 - Service: Ati External Event Utility - ATI Technologies Inc. - C:\Windows\system32\Ati2evxx.exe O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: Mozilla Maintenance Service (MozillaMaintenance) - Mozilla Foundation - C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe O23 - Service: O2Flash Memory Service (O2Flash) - O2Micro International - C:\Windows\system32\o2flash.exe O23 - Service: RealNetworks Downloader Resolver Service - Unknown owner - C:\Program Files\RealNetworks\RealDownloader\rndlresolversvc.exe O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe O23 - Service: UpdateNaviInstallService - FUJITSU LIMITED - C:\Program Files\Fujitsu\fjdvrupd\updnvsrv.exe O23 - Service: TrueVector Internet Monitor (vsmon) - Check Point Software Technologies LTD - C:\Program Files\CheckPoint\ZoneAlarm\vsmon.exe O23 - Service: Yahoo! Updater (YahooAUService) - Yahoo! Inc. - C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe O23 - Service: ZoneAlarm Privacy Service (ZAPrivacyService) - Check Point Software Technologies, Ltd. - C:\Program Files\CheckPoint\ZoneAlarm\ZAPrivacyService.exe -- End of file - 6373 bytes

Here is the latest Mbam log. It still freezes when trying to remove the threats that are still showing. I will run the Hijackthis program now. Malwarebytes Anti-Malware 1.75.0.1300 www.malwarebytes.org Database version: v2013.10.26.06 Windows Vista Service Pack 2 x86 NTFS (Safe Mode/Networking) Internet Explorer 9.0.8112.16421 Karli :: KARLI-PC [administrator] 10/26/2013 12:30:38 PM MBAM-log-2013-10-26 (12-38-59).txt Scan type: Quick scan Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM Scan options disabled: P2P Objects scanned: 209745 Time elapsed: 7 minute(s), 59 second(s) Memory Processes Detected: 0 (No malicious items detected) Memory Modules Detected: 0 (No malicious items detected) Registry Keys Detected: 0 (No malicious items detected) Registry Values Detected: 0 (No malicious items detected) Registry Data Items Detected: 0 (No malicious items detected) Folders Detected: 4 C:\Users\Karli\AppData\Roaming\Mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384}\{0113D088-8ED1-468C-B225-585A9C53B5E3} (PUP.Optional.TopArcadeHits.A) -> No action taken. C:\Users\Karli\AppData\Roaming\Mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384}\{0113D088-8ED1-468C-B225-585A9C53B5E3}\chrome (PUP.Optional.TopArcadeHits.A) -> No action taken. C:\Users\Karli\AppData\Roaming\Mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384}\{0113D088-8ED1-468C-B225-585A9C53B5E3}\chrome\content (PUP.Optional.TopArcadeHits.A) -> No action taken. C:\Users\Karli\AppData\Roaming\Mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384}\{0113D088-8ED1-468C-B225-585A9C53B5E3}\skin (PUP.Optional.TopArcadeHits.A) -> No action taken. Files Detected: 0 (No malicious items detected) (end)

Hello Gringo, I was having trouble getting the Windows repair program on to the infected computer. I have managed to get it on that computer and run the program. It is better than it was, but still some fairly serious issues with some programs opening and others causing the computer to totally freeze up to the point where a hard shutdown is all that can be done to remedy the freeze. I feel as though I need to go back to instruction post prior to when the Windows Repair was needed and go through those instructions to make certain I was able to do all those things. I will post the mbam and hijack logs if I can get them to open and run. Thank you for your patience with this.

the mouse pointer turns into a spinning circle like it's trying to do something, but then nothing.

ok Mr. Gringo, I did all that you asked. Now I can't get that computer online and/or open any programs on it. I dug my desktop out so I could get back to you on what was going on with it. At this point is the laptop even redeemable? or am I going to need to reformat and reinstall the OS?

Why am I removing Weatherbug?

Evening Mr. Gringo, Here is the ComboFix log. I did get the "Illegal operation attempted on a registry key that has been marked for deletion." error and restarted. Then I was unable to get online or even open a browser. I ran rkill again, then ran the "fixdamage" part of MBAR to get it back up and running again. My Avast program is not working properly at this point, so I figure I will probably have to uninstall it and do a clean install. There are also 3 icons that appeared on my desktop that I have no idea where they came from. 2 of them are named "desktop.ini" and the other is "~$Checkbook.xlsx" and all 3 of them look almost like they are greyed out. (yes very weird I know). ComboFix 13-10-16.02 - Karli 10/17/2013 20:29:16.4.2 - x86 Running from: c:\users\Karli\Desktop\ComboFix.exe Command switches used :: c:\users\Karli\Desktop\CFScript.txt . . ((((((((((((((((((((((((( Files Created from 2013-09-18 to 2013-10-18 ))))))))))))))))))))))))))))))) . . 2013-10-18 01:39 . 2013-10-18 01:39 -------- d-----w- c:\windows\system32\config\systemprofile\AppData\Local\temp 2013-10-18 01:39 . 2013-10-18 01:39 -------- d-----w- c:\users\Default\AppData\Local\temp 2013-10-17 23:01 . 2013-10-17 23:01 -------- d-----w- c:\users\Karli\AppData\Roaming\AVAST Software 2013-10-17 01:29 . 2013-10-17 01:29 -------- d-----w- c:\users\Karli\AppData\Roaming\CleanMyPC Software 2013-10-16 02:24 . 2013-10-16 02:25 75992 ----a-w- c:\windows\system32\drivers\mbamchameleon.sys 2013-10-15 07:30 . 2013-09-16 05:50 7328304 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{AA957FF3-5D86-469E-BC1A-EFF0705EB987}\mpengine.dll 2013-10-14 04:25 . 2013-10-14 04:30 -------- d-----w- c:\programdata\Spybot - Search & Destroy 2013-10-13 17:06 . 2013-10-17 03:50 -------- d-----w- C:\AdwCleaner 2013-10-13 13:00 . 2013-10-18 00:21 -------- d-----w- c:\programdata\Malwarebytes' Anti-Malware (portable) 2013-10-13 12:29 . 2013-10-13 12:29 -------- d-----w- c:\users\Karli\AppData\Local\ElevatedDiagnostics 2013-10-13 02:38 . 2013-10-13 02:38 -------- d-----w- C:\FRST 2013-10-09 08:25 . 2013-08-27 01:28 1069056 ----a-w- c:\windows\system32\DWrite.dll 2013-10-09 08:25 . 2013-08-27 01:50 486400 ----a-w- c:\windows\system32\d3d10level9.dll 2013-10-09 08:25 . 2013-08-27 01:28 798208 ----a-w- c:\windows\system32\FntCache.dll 2013-10-09 08:25 . 2013-08-27 02:47 219648 ----a-w- c:\windows\system32\d3d10_1core.dll 2013-10-09 08:25 . 2013-08-27 02:47 189952 ----a-w- c:\windows\system32\d3d10core.dll 2013-10-09 08:25 . 2013-08-27 02:47 160768 ----a-w- c:\windows\system32\d3d10_1.dll 2013-10-09 08:25 . 2013-08-27 02:47 1029120 ----a-w- c:\windows\system32\d3d10.dll 2013-10-09 08:25 . 2013-08-27 01:52 1172480 ----a-w- c:\windows\system32\d3d10warp.dll 2013-10-09 08:25 . 2013-08-27 01:32 683008 ----a-w- c:\windows\system32\d2d1.dll 2013-10-05 14:18 . 2013-10-17 22:07 247192 ----a-w- c:\windows\system32\drivers\aswNdis2.sys 2013-10-05 14:18 . 2013-10-14 17:41 104752 ----a-w- c:\windows\system32\drivers\aswFW.sys 2013-10-05 14:18 . 2013-10-17 22:08 26136 ----a-w- c:\windows\system32\drivers\aswKbd.sys 2013-10-05 14:18 . 2013-07-17 09:17 12112 ----a-w- c:\windows\system32\drivers\aswNdis.sys 2013-09-27 01:57 . 2013-09-27 01:57 -------- d-----w- c:\program files\Common Files\Java 2013-09-27 01:57 . 2013-09-27 01:57 -------- d-----w- c:\programdata\Oracle 2013-09-27 01:54 . 2013-09-27 01:54 94632 ----a-w- c:\windows\system32\WindowsAccessBridge.dll 2013-09-27 01:54 . 2013-09-27 01:54 -------- d-----w- c:\program files\Java . . . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2013-10-17 22:08 . 2013-03-26 22:51 178304 ----a-w- c:\windows\system32\drivers\aswVmm.sys 2013-10-17 22:08 . 2013-03-26 22:51 49944 ----a-w- c:\windows\system32\drivers\aswRvrt.sys 2013-10-17 22:08 . 2011-10-29 20:53 35656 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys 2013-10-17 22:08 . 2011-10-29 20:53 403440 ----a-w- c:\windows\system32\drivers\aswSP.sys 2013-10-17 22:08 . 2011-10-29 20:53 54832 ----a-w- c:\windows\system32\drivers\aswRdr.sys 2013-10-17 22:08 . 2011-10-29 20:53 57672 ----a-w- c:\windows\system32\drivers\aswTdi.sys 2013-10-17 22:08 . 2011-10-29 20:53 774392 ----a-w- c:\windows\system32\drivers\aswSnx.sys 2013-10-17 22:08 . 2011-10-29 20:53 70384 ----a-w- c:\windows\system32\drivers\aswMonFlt.sys 2013-10-17 22:08 . 2011-10-29 20:53 43152 ----a-w- c:\windows\avastSS.scr 2013-10-17 22:08 . 2011-10-29 20:53 269216 ----a-w- c:\windows\system32\aswBoot.exe 2013-10-10 09:45 . 2013-02-03 13:27 692616 ----a-w- c:\windows\system32\FlashPlayerApp.exe 2013-10-10 09:45 . 2013-02-03 13:27 71048 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl 2013-09-27 01:54 . 2012-09-20 22:10 868264 ----a-w- c:\windows\system32\npdeployJava1.dll 2013-09-27 01:54 . 2011-06-15 12:27 790440 ----a-w- c:\windows\system32\deployJava1.dll 2013-09-11 09:42 . 2003-03-18 11:14 499712 ----a-w- c:\windows\system32\msvcp71.dll 2013-09-11 09:42 . 2003-02-20 19:42 348160 ----a-w- c:\windows\system32\msvcr71.dll 2013-08-07 09:22 . 2009-12-29 20:05 238872 ------w- c:\windows\system32\MpSigStub.exe 2013-08-02 04:09 . 2013-08-28 03:55 1548288 ----a-w- c:\windows\system32\WMVDECOD.DLL . . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast] @="{472083B0-C522-11CF-8763-00608CC02F24}" [HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}] 2013-10-17 22:08 321752 ----a-w- c:\program files\AVAST Software\Avast\ashShell.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1] @="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}] 2013-05-25 00:36 130736 ----a-w- c:\users\Karli\AppData\Roaming\Dropbox\bin\DropboxExt.19.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2] @="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}] 2013-05-25 00:36 130736 ----a-w- c:\users\Karli\AppData\Roaming\Dropbox\bin\DropboxExt.19.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3] @="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}] 2013-05-25 00:36 130736 ----a-w- c:\users\Karli\AppData\Roaming\Dropbox\bin\DropboxExt.19.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt4] @="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}] 2013-05-25 00:36 130736 ----a-w- c:\users\Karli\AppData\Roaming\Dropbox\bin\DropboxExt.19.dll . [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Weather"="c:\program files\AWS\WeatherBug\Weather.exe" [2010-10-29 1652736] "ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-19 125952] . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ZoneAlarm"="c:\program files\CheckPoint\ZoneAlarm\zatray.exe" [2013-06-20 73832] "TvOutSwitch"="c:\program files\Fujitsu\DispSwitch\DispSwitchLauncher.exe" [2007-10-01 106496] "RtHDVCpl"="RtHDVCpl.exe" [2007-09-19 4702208] "LoadFujitsuQuickTouch"="c:\program files\Fujitsu\Application Panel\QuickTouch.exe" [2006-11-26 260912] "LoadFUJ02E3"="c:\program files\Fujitsu\FUJ02E3\FUJ02E3.exe" [2007-06-13 84784] "LoadBtnHnd"="c:\program files\Fujitsu\BtnHnd\BtnHnd.exe" [2006-11-13 68400] "LanguageShortcut"="c:\program files\CyberLink\PowerDVD\Language\Language.exe" [2007-01-09 52256] "IndicatorUtility"="c:\program files\Fujitsu\Fujitsu Hotkey Utility\IndicatorUty.exe" [2007-02-10 97072] "HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2006-12-11 49152] "FJUPDNV_Chitose"="c:\program files\Fujitsu\fjdvrupd\updatenv.exe" [2007-02-05 167936] "331BigDog"="c:\windows\VM331_STI.EXE" [2007-07-02 192512] "Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2013-04-04 958576] "TkBellExe"="c:\program files\real\realplayer\Update\realsched.exe" [2013-09-11 295512] "SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2013-07-02 254336] "AvastUI.exe"="c:\program files\AVAST Software\Avast\AvastUI.exe" [2013-10-17 3568312] . [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "Picasa Media Detector"="c:\program files\Picasa2\PicasaMediaDetector.exe" [2008-02-26 443968] . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "ConsentPromptBehaviorAdmin"= 5 (0x5) "ConsentPromptBehaviorUser"= 3 (0x3) "EnableUIADesktopToggle"= 0 (0x0) . [hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks] "{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2013-05-07 115440] . [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon] 2013-05-07 22:36 552176 ----a-w- c:\program files\SUPERAntiSpyware\SASWINLO.DLL . [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "aux"=wdmaud.drv . [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager] BootExecute REG_MULTI_SZ autocheck autochk *\0sdnclean.exe . [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\!SASCORE] @="" . [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\01897211.sys] @="Driver" . [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\17882742.sys] @="Driver" . [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\63933402.sys] @="Driver" . [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mbamchameleon] @="Driver" . [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WudfPf] @="Driver" . [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WudfRd] @="Driver" . [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WudfSvc] @="Service" . [HKLM\~\startupfolder\C:^Users^Karli^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^OneNote 2007 Screen Clipper and Launcher.lnk] path=c:\users\Karli\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2007 Screen Clipper and Launcher.lnk backup=c:\windows\pss\OneNote 2007 Screen Clipper and Launcher.lnkStartup . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM] 2013-04-04 21:06 958576 ----a-w- c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Registry Cleaner Scheduler] 2013-03-03 02:20 1403680 ----a-w- c:\program files\CleanMyPC\Registry Cleaner\RCHelper.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl] 2007-03-15 05:01 71216 ------w- c:\program files\CyberLink\PowerDVD\PDVDServ.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SUPERAntiSpyware] 2013-05-15 01:08 4760816 ----a-w- c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe . [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring] "DisableMonitoring"=dword:00000001 . [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus] "DisableMonitoring"=dword:00000001 . [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall] "DisableMonitoring"=dword:00000001 . [HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc] "AntiSpywareOverride"=dword:00000001 . R3 ADVNTDRV;ADVNTDRV;c:\windows\System32\drivers\ADVNTDRV.SYS [1999-11-18 3872] S2 !SASCORE;SAS Core Service;c:\program files\SUPERAntiSpyware\SASCORE.EXE [2013-05-23 119056] . . [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost] LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12 hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc . Contents of the 'Scheduled Tasks' folder . 2013-10-17 c:\windows\Tasks\Adobe Flash Player Updater.job - c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2013-02-03 09:45] . 2013-10-14 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-1554741564-3749478033-3638076803-1000Core.job - c:\users\Karli\AppData\Local\Facebook\Update\FacebookUpdate.exe [2012-02-23 06:20] . 2013-10-17 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-1554741564-3749478033-3638076803-1000UA.job - c:\users\Karli\AppData\Local\Facebook\Update\FacebookUpdate.exe [2012-02-23 06:20] . 2012-01-01 c:\windows\Tasks\RealUpgradeScheduledTaskS-1-5-21-1554741564-3749478033-3638076803-1000.job - c:\program files\Real\RealUpgrade\realupgrade.exe [2013-08-14 22:13] . . ------- Supplementary Scan ------- . uInternet Settings,ProxyOverride = 192.168.*.* TCP: DhcpNameServer = 209.18.47.61 209.18.47.62 FF - ProfilePath - c:\users\Karli\AppData\Roaming\Mozilla\Firefox\Profiles\2fsnzhkb.default-1372970557911\ FF - prefs.js: keyword.URL - FF - ExtSQL: 2013-09-11 04:46; {DF153AFF-6948-45d7-AC98-4FC4AF8A08E2}; c:\programdata\RealNetworks\RealDownloader\BrowserPlugins\Firefox\Ext . . ************************************************************************** . catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2013-10-17 20:39 Windows 6.0.6002 Service Pack 2 NTFS . scanning hidden processes ... . scanning hidden autostart entries ... . scanning hidden files ... . scan completed successfully hidden files: 0 . ************************************************************************** . --------------------- LOCKED REGISTRY KEYS --------------------- . [HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{25537BA6-77A8-11D2-9B6C-0000F8080861}] @DACL=(02 0000) @="Folder Redirection" "ProcessGroupPolicyEx"="ProcessGroupPolicyEx" "DllName"=expand:"fdeploy.dll" "NoMachinePolicy"=dword:00000001 "NoSlowLink"=dword:00000001 "PerUserLocalSettings"=dword:00000001 "NoGPOListChanges"=dword:00000000 "NoBackgroundPolicy"=dword:00000000 "GenerateGroupPolicy"="GenerateGroupPolicy" "EventSources"=multi:"(Folder Redirection,Application)\00\00" "DisplayName"=expand:"@fdeploy.dll,-261" . [HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{3610eda5-77ef-11d2-8dc5-00c04fa31a66}] @DACL=(02 0000) @="Microsoft Disk Quota" "DisplayName"=expand:"@%SystemRoot%\\System32\\dskquota.dll,-100" "NoMachinePolicy"=dword:00000000 "NoUserPolicy"=dword:00000001 "NoSlowLink"=dword:00000001 "NoBackgroundPolicy"=dword:00000001 "NoGPOListChanges"=dword:00000001 "PerUserLocalSettings"=dword:00000000 "RequiresSuccessfulRegistry"=dword:00000001 "EnableAsynchronousProcessing"=dword:00000000 "DllName"=expand:"%SystemRoot%\\System32\\dskquota.dll" "ProcessGroupPolicy"="ProcessGroupPolicy" . [HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{426031c0-0b47-4852-b0ca-ac3d37bfcb39}] @DACL=(02 0000) @="QoS Packet Scheduler" "DisplayName"=expand:"@gptext.dll,-201" "ProcessGroupPolicy"="ProcessPSCHEDPolicy" "DllName"=expand:"gptext.dll" "NoUserPolicy"=dword:00000001 "NoGPOListChanges"=dword:00000001 . [HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{7933F41E-56F8-41d6-A31C-4148A711EE93}] @DACL=(02 0000) @="Windows Search Group Policy Extension" "DllName"=expand:"%SystemRoot%\\System32\\srchadmin.dll" "EnableAsynchronousProcessing"=dword:00000001 "NoBackgroundPolicy"=dword:00000000 "NoGPOListChanges"=dword:00000001 "NoMachinePolicy"=dword:00000000 "NoSlowLink"=dword:00000000 "NoUserPolicy"=dword:00000000 "PerUserLocalSettings"=dword:00000000 "ProcessGroupPolicy"="ProcessGroupPolicy" "RequiresSuccessfulRegistry"=dword:00000001 . [HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{e437bc1c-aa7d-11d2-a382-00c04f991e27}] @DACL=(02 0000) @="IP Security" "ProcessGroupPolicyEx"="ProcessIPSECPolicyEx" "GenerateGroupPolicy"="GenerateIPSECPolicy" "DllName"=expand:"%SystemRoot%\\System32\\polstore.dll" "NoUserPolicy"=dword:00000001 "NoGPOListChanges"=dword:00000000 "DisplayName"=expand:"@c:\\Windows\\system32\\polstore.dll,-5012" . [HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{FB2CA36D-0B40-4307-821B-A13B252DE56C}] @DACL=(02 0000) @="Enterprise QoS" "DisplayName"=expand:"@gptext.dll,-203" "ProcessGroupPolicy"="ProcessEQoSPolicy" "DllName"=expand:"gptext.dll" "RequiresSuccessfulRegistry"=dword:00000001 . [HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 "MSCurrentCountry"=dword:000000b5 . [HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 . --------------------- DLLs Loaded Under Running Processes --------------------- . - - - - - - - > 'Explorer.exe'(8088) c:\users\Karli\AppData\Roaming\Dropbox\bin\DropboxExt.19.dll . Completion time: 2013-10-17 20:43:36 ComboFix-quarantined-files.txt 2013-10-18 01:43 ComboFix2.txt 2013-10-17 02:51 . Pre-Run: 111,032,983,552 bytes free Post-Run: 110,981,976,064 bytes free . - - End Of File - - C57899F8DDDE97040B6E3078B4F7599F 5C616939100B85E558DA92B899A0FC36

ok Gringo, After looking around trying to figure out what needed to be done with this, I ran rkill. That made it possible to run Combofix. So here is that log. ComboFix 13-10-16.02 - Karli 10/16/2013 21:35:00.2.2 - x86 Running from: c:\users\Karli\Desktop\ComboFix.exe . . ((((((((((((((((((((((((( Files Created from 2013-09-17 to 2013-10-17 ))))))))))))))))))))))))))))))) . . 2013-10-17 02:47 . 2013-10-17 02:47 -------- d-----w- c:\users\Default\AppData\Local\temp 2013-10-17 01:29 . 2013-10-17 01:29 -------- d-----w- c:\users\Karli\AppData\Roaming\CleanMyPC Software 2013-10-16 02:40 . 2013-10-17 00:34 40776 ----a-w- c:\windows\system32\drivers\MBAMSwissArmy.sys 2013-10-16 02:24 . 2013-10-16 02:25 75992 ----a-w- c:\windows\system32\drivers\mbamchameleon.sys 2013-10-15 07:30 . 2013-09-16 05:50 7328304 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{AA957FF3-5D86-469E-BC1A-EFF0705EB987}\mpengine.dll 2013-10-14 04:25 . 2013-10-14 04:30 -------- d-----w- c:\programdata\Spybot - Search & Destroy 2013-10-13 17:06 . 2013-10-13 20:35 -------- d-----w- C:\AdwCleaner 2013-10-13 13:00 . 2013-10-13 13:00 -------- d-----w- c:\programdata\Malwarebytes' Anti-Malware (portable) 2013-10-13 12:29 . 2013-10-13 12:29 -------- d-----w- c:\users\Karli\AppData\Local\ElevatedDiagnostics 2013-10-13 02:38 . 2013-10-13 02:38 -------- d-----w- C:\FRST 2013-10-09 08:25 . 2013-08-27 01:28 1069056 ----a-w- c:\windows\system32\DWrite.dll 2013-10-09 08:25 . 2013-08-27 01:50 486400 ----a-w- c:\windows\system32\d3d10level9.dll 2013-10-09 08:25 . 2013-08-27 01:28 798208 ----a-w- c:\windows\system32\FntCache.dll 2013-10-09 08:25 . 2013-08-27 02:47 219648 ----a-w- c:\windows\system32\d3d10_1core.dll 2013-10-09 08:25 . 2013-08-27 02:47 189952 ----a-w- c:\windows\system32\d3d10core.dll 2013-10-09 08:25 . 2013-08-27 02:47 160768 ----a-w- c:\windows\system32\d3d10_1.dll 2013-10-09 08:25 . 2013-08-27 02:47 1029120 ----a-w- c:\windows\system32\d3d10.dll 2013-10-09 08:25 . 2013-08-27 01:52 1172480 ----a-w- c:\windows\system32\d3d10warp.dll 2013-10-09 08:25 . 2013-08-27 01:32 683008 ----a-w- c:\windows\system32\d2d1.dll 2013-10-05 14:18 . 2013-08-30 07:48 204784 ----a-w- c:\windows\system32\drivers\aswNdis2.sys 2013-10-05 14:18 . 2013-08-30 07:48 104752 ----a-w- c:\windows\system32\drivers\aswFW.sys 2013-10-05 14:18 . 2013-08-30 07:48 21576 ----a-w- c:\windows\system32\drivers\aswKbd.sys 2013-10-05 14:18 . 2013-07-17 09:17 12112 ----a-w- c:\windows\system32\drivers\aswNdis.sys 2013-09-27 01:57 . 2013-09-27 01:57 -------- d-----w- c:\program files\Common Files\Java 2013-09-27 01:57 . 2013-09-27 01:57 -------- d-----w- c:\programdata\Oracle 2013-09-27 01:54 . 2013-09-27 01:54 94632 ----a-w- c:\windows\system32\WindowsAccessBridge.dll 2013-09-27 01:54 . 2013-09-27 01:54 -------- d-----w- c:\program files\Java . . . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2013-10-10 09:45 . 2013-02-03 13:27 692616 ----a-w- c:\windows\system32\FlashPlayerApp.exe 2013-10-10 09:45 . 2013-02-03 13:27 71048 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl 2013-09-27 01:54 . 2012-09-20 22:10 868264 ----a-w- c:\windows\system32\npdeployJava1.dll 2013-09-27 01:54 . 2011-06-15 12:27 790440 ----a-w- c:\windows\system32\deployJava1.dll 2013-09-11 09:42 . 2003-03-18 11:14 499712 ----a-w- c:\windows\system32\msvcp71.dll 2013-09-11 09:42 . 2003-02-20 19:42 348160 ----a-w- c:\windows\system32\msvcr71.dll 2013-08-30 07:48 . 2013-03-26 22:51 177864 ----a-w- c:\windows\system32\drivers\aswVmm.sys 2013-08-30 07:48 . 2011-10-29 20:53 369584 ----a-w- c:\windows\system32\drivers\aswSP.sys 2013-08-30 07:48 . 2011-10-29 20:53 56080 ----a-w- c:\windows\system32\drivers\aswTdi.sys 2013-08-30 07:48 . 2013-03-26 22:51 49376 ----a-w- c:\windows\system32\drivers\aswRvrt.sys 2013-08-30 07:48 . 2011-10-29 20:53 49760 ----a-w- c:\windows\system32\drivers\aswRdr.sys 2013-08-30 07:48 . 2011-10-29 20:53 770344 ----a-w- c:\windows\system32\drivers\aswSnx.sys 2013-08-30 07:48 . 2011-10-29 20:53 29816 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys 2013-08-30 07:48 . 2011-10-29 20:53 66336 ----a-w- c:\windows\system32\drivers\aswMonFlt.sys 2013-08-30 07:47 . 2011-10-29 20:53 41664 ----a-w- c:\windows\avastSS.scr 2013-08-30 07:47 . 2011-10-29 20:53 229648 ----a-w- c:\windows\system32\aswBoot.exe 2013-08-07 09:22 . 2009-12-29 20:05 238872 ------w- c:\windows\system32\MpSigStub.exe 2013-08-02 04:09 . 2013-08-28 03:55 1548288 ----a-w- c:\windows\system32\WMVDECOD.DLL . . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast] @="{472083B0-C522-11CF-8763-00608CC02F24}" [HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}] 2013-08-30 07:47 121968 ----a-w- c:\program files\AVAST Software\Avast\ashShell.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1] @="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}] 2013-05-25 00:36 130736 ----a-w- c:\users\Karli\AppData\Roaming\Dropbox\bin\DropboxExt.19.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2] @="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}] 2013-05-25 00:36 130736 ----a-w- c:\users\Karli\AppData\Roaming\Dropbox\bin\DropboxExt.19.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3] @="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}] 2013-05-25 00:36 130736 ----a-w- c:\users\Karli\AppData\Roaming\Dropbox\bin\DropboxExt.19.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt4] @="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}] 2013-05-25 00:36 130736 ----a-w- c:\users\Karli\AppData\Roaming\Dropbox\bin\DropboxExt.19.dll . [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Weather"="c:\program files\AWS\WeatherBug\Weather.exe" [2010-10-29 1652736] "ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-19 125952] . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "avast"="c:\program files\AVAST Software\Avast\avastUI.exe" [2013-08-30 4858968] "ZoneAlarm"="c:\program files\CheckPoint\ZoneAlarm\zatray.exe" [2013-06-20 73832] "TvOutSwitch"="c:\program files\Fujitsu\DispSwitch\DispSwitchLauncher.exe" [2007-10-01 106496] "RtHDVCpl"="RtHDVCpl.exe" [2007-09-19 4702208] "LoadFujitsuQuickTouch"="c:\program files\Fujitsu\Application Panel\QuickTouch.exe" [2006-11-26 260912] "LoadFUJ02E3"="c:\program files\Fujitsu\FUJ02E3\FUJ02E3.exe" [2007-06-13 84784] "LoadBtnHnd"="c:\program files\Fujitsu\BtnHnd\BtnHnd.exe" [2006-11-13 68400] "LanguageShortcut"="c:\program files\CyberLink\PowerDVD\Language\Language.exe" [2007-01-09 52256] "IndicatorUtility"="c:\program files\Fujitsu\Fujitsu Hotkey Utility\IndicatorUty.exe" [2007-02-10 97072] "HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2006-12-11 49152] "FJUPDNV_Chitose"="c:\program files\Fujitsu\fjdvrupd\updatenv.exe" [2007-02-05 167936] "331BigDog"="c:\windows\VM331_STI.EXE" [2007-07-02 192512] "Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2013-04-04 958576] "TkBellExe"="c:\program files\real\realplayer\Update\realsched.exe" [2013-09-11 295512] "SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2013-07-02 254336] . [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "Picasa Media Detector"="c:\program files\Picasa2\PicasaMediaDetector.exe" [2008-02-26 443968] . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "ConsentPromptBehaviorAdmin"= 5 (0x5) "ConsentPromptBehaviorUser"= 3 (0x3) "EnableUIADesktopToggle"= 0 (0x0) . [hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks] "{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2013-05-07 115440] . [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon] 2013-05-07 22:36 552176 ----a-w- c:\program files\SUPERAntiSpyware\SASWINLO.DLL . [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "aux"=wdmaud.drv . [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager] BootExecute REG_MULTI_SZ autocheck autochk *\0\0sdnclean.exe . [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\!SASCORE] @="" . [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\01897211.sys] @="Driver" . [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\17882742.sys] @="Driver" . [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\63933402.sys] @="Driver" . [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mbamchameleon] @="Driver" . [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MBAMSwissArmy] @="Driver" . [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WudfPf] @="Driver" . [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WudfRd] @="Driver" . [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WudfSvc] @="Service" . [HKLM\~\startupfolder\C:^Users^Karli^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^OneNote 2007 Screen Clipper and Launcher.lnk] path=c:\users\Karli\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2007 Screen Clipper and Launcher.lnk backup=c:\windows\pss\OneNote 2007 Screen Clipper and Launcher.lnkStartup . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM] 2013-04-04 21:06 958576 ----a-w- c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Registry Cleaner Scheduler] 2013-03-03 02:20 1403680 ----a-w- c:\program files\CleanMyPC\Registry Cleaner\RCHelper.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl] 2007-03-15 05:01 71216 ------w- c:\program files\CyberLink\PowerDVD\PDVDServ.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SUPERAntiSpyware] 2013-05-15 01:08 4760816 ----a-w- c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe . [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring] "DisableMonitoring"=dword:00000001 . [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus] "DisableMonitoring"=dword:00000001 . [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall] "DisableMonitoring"=dword:00000001 . [HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc] "AntiSpywareOverride"=dword:00000001 . R3 ADVNTDRV;ADVNTDRV;c:\windows\System32\drivers\ADVNTDRV.SYS [1999-11-18 3872] S2 !SASCORE;SAS Core Service;c:\program files\SUPERAntiSpyware\SASCORE.EXE [2013-05-23 119056] . . [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost] LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12 hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc . Contents of the 'Scheduled Tasks' folder . 2013-10-17 c:\windows\Tasks\Adobe Flash Player Updater.job - c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2013-02-03 09:45] . 2013-10-14 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-1554741564-3749478033-3638076803-1000Core.job - c:\users\Karli\AppData\Local\Facebook\Update\FacebookUpdate.exe [2012-02-23 06:20] . 2013-10-16 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-1554741564-3749478033-3638076803-1000UA.job - c:\users\Karli\AppData\Local\Facebook\Update\FacebookUpdate.exe [2012-02-23 06:20] . 2012-01-01 c:\windows\Tasks\RealUpgradeScheduledTaskS-1-5-21-1554741564-3749478033-3638076803-1000.job - c:\program files\Real\RealUpgrade\realupgrade.exe [2013-08-14 22:13] . . ------- Supplementary Scan ------- . uInternet Settings,ProxyOverride = 192.168.*.* TCP: DhcpNameServer = 209.18.47.61 209.18.47.62 FF - ProfilePath - c:\users\Karli\AppData\Roaming\Mozilla\Firefox\Profiles\2fsnzhkb.default-1372970557911\ FF - prefs.js: keyword.URL - FF - ExtSQL: 2013-09-11 04:46; {DF153AFF-6948-45d7-AC98-4FC4AF8A08E2}; c:\programdata\RealNetworks\RealDownloader\BrowserPlugins\Firefox\Ext . - - - - ORPHANS REMOVED - - - - . MSConfigStartUp-Google Desktop Search - c:\program files\Google\Google Desktop Search\GoogleDesktop.exe HKLM_ActiveSetup-ccc-core-static - msiexec AddRemove-{D6B25B8D-0566-42B1-A23D-7576138435D6} - c:\progra~2\TARMAI~1\{D6B25~1\Setup.exe . . . ************************************************************************** . catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2013-10-16 21:47 Windows 6.0.6002 Service Pack 2 NTFS . scanning hidden processes ... . scanning hidden autostart entries ... . scanning hidden files ... . scan completed successfully hidden files: 0 . ************************************************************************** . --------------------- LOCKED REGISTRY KEYS --------------------- . [HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{25537BA6-77A8-11D2-9B6C-0000F8080861}] @DACL=(02 0000) @="Folder Redirection" "ProcessGroupPolicyEx"="ProcessGroupPolicyEx" "DllName"=expand:"fdeploy.dll" "NoMachinePolicy"=dword:00000001 "NoSlowLink"=dword:00000001 "PerUserLocalSettings"=dword:00000001 "NoGPOListChanges"=dword:00000000 "NoBackgroundPolicy"=dword:00000000 "GenerateGroupPolicy"="GenerateGroupPolicy" "EventSources"=multi:"(Folder Redirection,Application)\00\00" "DisplayName"=expand:"@fdeploy.dll,-261" . [HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{3610eda5-77ef-11d2-8dc5-00c04fa31a66}] @DACL=(02 0000) @="Microsoft Disk Quota" "DisplayName"=expand:"@%SystemRoot%\\System32\\dskquota.dll,-100" "NoMachinePolicy"=dword:00000000 "NoUserPolicy"=dword:00000001 "NoSlowLink"=dword:00000001 "NoBackgroundPolicy"=dword:00000001 "NoGPOListChanges"=dword:00000001 "PerUserLocalSettings"=dword:00000000 "RequiresSuccessfulRegistry"=dword:00000001 "EnableAsynchronousProcessing"=dword:00000000 "DllName"=expand:"%SystemRoot%\\System32\\dskquota.dll" "ProcessGroupPolicy"="ProcessGroupPolicy" . [HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{426031c0-0b47-4852-b0ca-ac3d37bfcb39}] @DACL=(02 0000) @="QoS Packet Scheduler" "DisplayName"=expand:"@gptext.dll,-201" "ProcessGroupPolicy"="ProcessPSCHEDPolicy" "DllName"=expand:"gptext.dll" "NoUserPolicy"=dword:00000001 "NoGPOListChanges"=dword:00000001 . [HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{7933F41E-56F8-41d6-A31C-4148A711EE93}] @DACL=(02 0000) @="Windows Search Group Policy Extension" "DllName"=expand:"%SystemRoot%\\System32\\srchadmin.dll" "EnableAsynchronousProcessing"=dword:00000001 "NoBackgroundPolicy"=dword:00000000 "NoGPOListChanges"=dword:00000001 "NoMachinePolicy"=dword:00000000 "NoSlowLink"=dword:00000000 "NoUserPolicy"=dword:00000000 "PerUserLocalSettings"=dword:00000000 "ProcessGroupPolicy"="ProcessGroupPolicy" "RequiresSuccessfulRegistry"=dword:00000001 . [HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{e437bc1c-aa7d-11d2-a382-00c04f991e27}] @DACL=(02 0000) @="IP Security" "ProcessGroupPolicyEx"="ProcessIPSECPolicyEx" "GenerateGroupPolicy"="GenerateIPSECPolicy" "DllName"=expand:"%SystemRoot%\\System32\\polstore.dll" "NoUserPolicy"=dword:00000001 "NoGPOListChanges"=dword:00000000 "DisplayName"=expand:"@c:\\Windows\\system32\\polstore.dll,-5012" . [HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{FB2CA36D-0B40-4307-821B-A13B252DE56C}] @DACL=(02 0000) @="Enterprise QoS" "DisplayName"=expand:"@gptext.dll,-203" "ProcessGroupPolicy"="ProcessEQoSPolicy" "DllName"=expand:"gptext.dll" "RequiresSuccessfulRegistry"=dword:00000001 . [HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 "MSCurrentCountry"=dword:000000b5 . [HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 . --------------------- DLLs Loaded Under Running Processes --------------------- . - - - - - - - > 'Explorer.exe'(7340) c:\users\Karli\AppData\Roaming\Dropbox\bin\DropboxExt.19.dll . Completion time: 2013-10-16 21:51:41 ComboFix-quarantined-files.txt 2013-10-17 02:51 . Pre-Run: 112,661,000,192 bytes free Post-Run: 112,485,310,464 bytes free . - - End Of File - - 310A2F79F83A01AB60A92BC5C6C11525 5C616939100B85E558DA92B899A0FC36

Well Gringo, I tried and what happened this time was that the scan was running along and then I got a pop up that said something about some issue and another panel came up that said "Windows is seeking a solution online" when that stopped searching it said it couldn't find a solution so it was closing Farbar. So I am wondering it OLT is a program log with which you may be familiar? A friend suggested I try that and I was able to generate a log with it. I am copying and pasting the log here in the event it will help the cause. I did not run fix nor did I click the cleanup button in this program because you asked in your first post that no programs be run without being told to. I am just getting desperate for this ordeal to be over is all and this is just a log after all. OTL Extras logfile created on: 10/16/2013 5:24:42 PM - Run 1 OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\Karli\Downloads Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation Internet Explorer (Version = 9.0.8112.16421) Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy 1.93 Gb Total Physical Memory | 1.45 Gb Available Physical Memory | 75.11% Memory free 4.10 Gb Paging File | 3.80 Gb Available in Paging File | 92.53% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files Drive C: | 183.80 Gb Total Space | 107.39 Gb Free Space | 58.43% Space Free | Partition Type: NTFS Drive D: | 1.01 Gb Total Space | 0.89 Gb Free Space | 88.06% Space Free | Partition Type: NTFS Computer Name: KARLI-PC | User Name: Karli | Logged in as Administrator. Boot Mode: SafeMode with Networking | Scan Mode: Current user Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days ========== Extra Registry (SafeList) ========== ========== File Associations ========== [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>] .cpl [@ = cplfile] -- C:\Windows\System32\control.exe (Microsoft Corporation) .hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation) .html [@ = ChromeHTML] -- Reg Error: Key error. File not found [HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>] .html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation) ========== Shell Spawning ========== [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command] batfile [open] -- "%1" %* cmdfile [open] -- "%1" %* comfile [open] -- "%1" %* cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation) exefile [open] -- "%1" %* helpfile [open] -- Reg Error: Key error. hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation) http [open] -- Reg Error: Value error. https [open] -- Reg Error: Value error. inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation) piffile [open] -- "%1" %* regfile [merge] -- Reg Error: Key error. scrfile [config] -- "%1" scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l scrfile [open] -- "%1" /S txtfile [edit] -- Reg Error: Key error. Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1 Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation) Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation) Folder [open] -- %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation) Folder [explore] -- %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation) Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation) ========== Security Center Settings ========== [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center] "cval" = 0 "UacDisableNotify" = 1 "InternetSettingsDisableNotify" = 1 "AutoUpdateDisableNotify" = 1 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring] "DisableMonitoring" = 1 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus] "DisableMonitoring" = 1 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall] "DisableMonitoring" = 1 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc] "AntiVirusOverride" = 0 "AntiSpywareOverride" = 1 "FirewallOverride" = 0 "VistaSp1" = Reg Error: Unknown registry data type -- File not found "VistaSp2" = Reg Error: Unknown registry data type -- File not found ========== Firewall Settings ========== [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile] "EnableFirewall" = 0 "DisableNotifications" = 0 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile] "EnableFirewall" = 0 "DisableNotifications" = 0 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile] "EnableFirewall" = 0 "DisableNotifications" = 0 "DoNotAllowExceptions" = 0 ========== Authorized Applications List ========== [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] ========== Vista Active Open Ports Exception List ========== [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules] "{0333300B-345F-4EE5-8656-541865001273}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe | "{05C84E66-02DE-431B-9287-5A262B8506C9}" = lport=138 | protocol=17 | dir=in | app=system | "{0617D83B-B3A7-489A-9FCC-4844B14877D8}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | "{086FC063-0F20-450F-9BD1-515B48A0C495}" = lport=3702 | protocol=17 | dir=in | svc=fdphost | app=%systemroot%\system32\svchost.exe | "{094E3635-F6CF-4994-91EF-4BEDDF92E412}" = rport=3702 | protocol=17 | dir=out | svc=fdrespub | app=%systemroot%\system32\svchost.exe | "{10F57E7C-CE83-4AAC-9890-C3D3355F4354}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe | "{14F3C2B4-D398-4C79-84E3-656040567359}" = rport=137 | protocol=17 | dir=out | app=system | "{166ABA51-8C49-4B68-8A13-1533246CBA7D}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 | "{1EE10F69-CA26-4948-BD80-531DBC272973}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | "{27E31C2C-F8CD-4F06-BDC9-42EB8F7D3F6E}" = rport=10243 | protocol=6 | dir=out | app=system | "{2B28A7CC-AEF1-4647-BDBB-83854DEECB5E}" = rport=138 | protocol=17 | dir=out | app=system | "{2DC61C3A-EFBC-4F37-AA26-B1A54D4C2C30}" = lport=2869 | protocol=6 | dir=in | name=windows live communications platform (upnp) | "{2F207C39-9FB9-4C4F-897D-7FA2B25DCD33}" = rport=3702 | protocol=17 | dir=out | svc=fdphost | app=%systemroot%\system32\svchost.exe | "{373860E9-C0E8-4C7A-BD12-2DDE9932383A}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe | "{42ED3DA9-258E-48F7-9837-8C73B92C60D0}" = lport=445 | protocol=6 | dir=in | app=system | "{493D14D3-667A-43E1-9D88-541BE0A7B585}" = lport=10243 | protocol=6 | dir=in | app=system | "{4CBE5B32-79D0-4950-A083-D167FCFDE003}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe | "{4EF2DF90-D9D2-4A48-9731-42D9A4DCDC50}" = rport=445 | protocol=6 | dir=out | app=system | "{57B06CD3-A975-4F75-A993-E09ED09028D6}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe | "{6261B315-3303-414F-8CB1-C52D0D194294}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe | "{699D75F2-993A-4B93-A15A-D671D31722E0}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | "{73472542-B843-4705-9A7A-A8B00061F6B6}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | "{783F750F-BDAD-4EC0-B816-75925D261D81}" = rport=139 | protocol=6 | dir=out | app=system | "{7F8CA566-65EF-4BAE-A617-497D97B7A65A}" = lport=3702 | protocol=17 | dir=in | svc=fdrespub | app=%systemroot%\system32\svchost.exe | "{80C07241-BE43-46C8-90F6-B1C4CE976039}" = lport=6004 | protocol=17 | dir=in | app=c:\program files\microsoft office\office12\outlook.exe | "{80CD9F8E-CD35-49D7-A9AA-223CBFBD4455}" = lport=3702 | protocol=17 | dir=in | svc=fdphost | app=%systemroot%\system32\svchost.exe | "{8A0C835F-1CAB-4BE6-80F4-2E1A0FAB8AAD}" = lport=137 | protocol=17 | dir=in | app=system | "{8EBF9818-3336-4B6C-94EF-D7FDCF12553E}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | "{8F125284-834E-4382-A2E1-7216E77BA6B5}" = rport=3702 | protocol=17 | dir=out | svc=fdrespub | app=%systemroot%\system32\svchost.exe | "{AD367401-F650-40CF-8AB8-35F431B0D266}" = rport=3702 | protocol=17 | dir=out | svc=fdphost | app=%systemroot%\system32\svchost.exe | "{BEFD5D00-A8CC-4EFB-9409-F870DD1DDCB7}" = lport=2869 | protocol=6 | dir=in | app=system | "{BF5E5F63-E7C4-4F54-8460-50DBBB12B73D}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe | "{C03FBF70-4A71-4331-9807-11C953D168EE}" = lport=3702 | protocol=17 | dir=in | svc=fdrespub | app=%systemroot%\system32\svchost.exe | "{C62E848D-407E-4ECA-9DAF-46F36E1CC164}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | "{CAB028B3-19AD-462C-B987-2EE2CBCB2267}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe | "{DCD6D9A0-178F-4E24-BD92-960C54F6E46C}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe | "{E803E419-8396-498B-AFE9-30849A8D64B9}" = lport=139 | protocol=6 | dir=in | app=system | "{FD4E0329-2C27-4EB7-AEF8-C574AD59CE4D}" = lport=1900 | protocol=17 | dir=in | name=windows live communications platform (ssdp) | ========== Vista Active Application Exception List ========== [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules] "{036292F7-600A-4320-82F3-497170890D38}" = protocol=6 | dir=in | app=c:\users\karli\appdata\local\temp\7zs88a5.tmp\symnrt.exe | "{04B68E66-BA7D-41B0-A5E4-29A825D749C5}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe | "{09256D71-6F8E-4457-A6CF-66464141EA1F}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe | "{12DCF758-2F60-4A8C-9E29-AFD2B2816CF2}" = protocol=17 | dir=in | app=c:\users\karli\appdata\local\temp\7zsc28f.tmp\symnrt.exe | "{148EDCCC-CF59-4EE3-AA5C-FB291528D531}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 | "{19A3CB4C-E34D-4E16-AB9D-6DA5B94D591A}" = protocol=6 | dir=in | app=c:\program files\skype\plugin manager\skypepm.exe | "{2150DD97-9211-47FA-9BA4-573811B30B18}" = protocol=17 | dir=in | app=c:\program files\imesh applications\imesh\imesh.exe | "{22F13890-1FA2-4D9A-870A-78F8241851F9}" = protocol=6 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe | "{26315707-5834-4277-92B0-4366A54F0AA9}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | "{299FFFD4-C295-4A7D-8101-45F7BF218E75}" = protocol=6 | dir=in | app=c:\program files\skype\plugin manager\skypepm.exe | "{3D7E3B37-CB25-4BDA-9A01-44076A52CB3F}" = dir=in | app=c:\program files\windows live\contacts\wlcomm.exe | "{45041E39-4647-4757-8772-1FF5AB5B189D}" = protocol=6 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe | "{49DBFC8E-0208-40FF-8329-5C2A29E47BEE}" = dir=in | app=c:\program files\skype\phone\skype.exe | "{4A7C91AC-9DBD-4080-915F-32928CBCA8F8}" = protocol=17 | dir=in | app=c:\users\karli\appdata\local\temp\7zs88a5.tmp\symnrt.exe | "{51072E88-83BF-401C-B296-664FE390A821}" = protocol=6 | dir=in | app=c:\program files\imesh applications\imesh\imesh.exe | "{529AB43C-D5D3-4FBC-9B5A-D32C431768D7}" = protocol=6 | dir=in | app=c:\program files\imesh applications\imesh\imesh.exe | "{552A404B-F9F8-47AD-BA10-E3387B74A140}" = dir=in | app=c:\program files\windows live\messenger\msnmsgr.exe | "{569AB3E8-B2D9-4ED5-99E2-CE7260D698DB}" = protocol=17 | dir=in | app=c:\program files\yahoo!\messenger\yahoomessenger.exe | "{5812A0DB-1481-472F-B62E-DD7A818C8A9B}" = protocol=17 | dir=in | app=c:\program files\skype\plugin manager\skypepm.exe | "{5A5E08AD-C604-481A-B397-29111B22177A}" = protocol=17 | dir=in | app=c:\program files\frostwire\frostwire.exe | "{5A751732-7587-497F-A63F-001426441640}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | "{5B4E7A51-1556-418D-B7AB-C6EFFCCAA739}" = dir=in | app=c:\program files\skype\phone\skype.exe | "{6ACEFF02-75A9-4CD8-8797-31FE03666AD0}" = dir=in | app=c:\program files\skype\phone\skype.exe | "{6C4E20BA-F0DE-4B12-BA73-4CA610D67161}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe | "{6D416017-69D3-4131-9AEB-53977BAC2A76}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe | "{6D71989B-6498-45E2-8E6D-F8250472BBF8}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 | "{6E4DD161-27C8-4B64-91A3-CCB21091AA0C}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | "{733A6A2C-0F3C-4438-AD3F-EDEE7B43C596}" = dir=in | app=c:\program files\skype\phone\skype.exe | "{8165A808-DCFF-4A9E-BD99-5B2FA623E49D}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 | "{820FD1DB-B7A4-45BC-BA7F-860BD84CE62B}" = dir=in | app=c:\users\karli\appdata\local\facebook\video\skype\facebookvideocalling.exe | "{89CAE88B-3FC0-4B20-96B4-6C8047E03983}" = protocol=6 | dir=in | app=c:\program files\yahoo!\messenger\yahoomessenger.exe | "{8B21D88A-0353-4977-8BCB-6A93100BDBC1}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe | "{94D7CDFB-7EDD-4181-AE44-6FC5091F498F}" = protocol=17 | dir=in | app=c:\users\karli\appdata\roaming\dropbox\bin\dropbox.exe | "{96A4598D-19BB-4583-BD43-72099917A5EA}" = protocol=6 | dir=in | app=c:\users\karli\appdata\roaming\dropbox\bin\dropbox.exe | "{9EF27F31-8CE0-4AAF-83E6-2C9A9C335745}" = protocol=6 | dir=in | app=c:\users\karli\appdata\local\temp\7zsc28f.tmp\symnrt.exe | "{A8B30F33-8E05-4E4E-B344-D5F115D66DA2}" = protocol=6 | dir=in | app=c:\program files\frostwire\frostwire.exe | "{AAB651C1-9BAB-4837-9BFB-9F7A665CD77B}" = protocol=17 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe | "{AFE320AC-537E-4C8B-945A-FF2B12FE49E0}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe | "{B09BE375-5149-4EE6-A4D1-AF617DB89934}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe | "{B959F579-B8E2-4CC9-8355-FABE350A5C1B}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 | "{BFFC0763-C8EA-4AC7-AE82-020D99311CB9}" = dir=in | app=c:\program files\skype\phone\skype.exe | "{C08311A7-42AB-422C-916B-6B3636A3DB79}" = protocol=17 | dir=in | app=c:\windows\system32\zonelabs\vsmon.exe | "{C1418C3C-249F-4249-AFD9-61594EEF9CEB}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | "{CAE82A2E-8944-4497-A8DC-780E6F17872A}" = protocol=17 | dir=in | app=c:\program files\frostwire\frostwire.exe | "{E95FFBDF-AFCF-41A0-A00B-E1FC50F5F9A8}" = protocol=17 | dir=in | app=c:\program files\skype\plugin manager\skypepm.exe | "{ED74BE6A-8E19-46DB-BD43-32165F99BF7F}" = protocol=6 | dir=out | app=system | "{EDF68B4B-BC26-4441-8810-DFA655B1B33A}" = protocol=17 | dir=in | app=c:\program files\imesh applications\imesh\imesh.exe | "{F118328B-1E04-4E82-BF8B-1553F58ACD2A}" = protocol=6 | dir=in | app=c:\program files\frostwire\frostwire.exe | "{F47718E9-2BB7-407B-B080-45C2670B930C}" = protocol=6 | dir=in | app=c:\windows\system32\zonelabs\vsmon.exe | "{F4F4D12D-9FDC-4F3E-9ECE-6E152C3E327E}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe | "TCP Query User{140F15D7-B2A5-4A75-A64F-0F770E894C13}C:\program files\participatory culture foundation\miro\miro_downloader.exe" = protocol=6 | dir=in | app=c:\program files\participatory culture foundation\miro\miro_downloader.exe | "TCP Query User{75964E12-9136-421F-B570-22C823E2009F}C:\program files\digital asphyxia\y!tunnelpro 2.5\ytpro.exe" = protocol=6 | dir=in | app=c:\program files\digital asphyxia\y!tunnelpro 2.5\ytpro.exe | "TCP Query User{982DC103-C14C-4593-AA41-B3CCDA36C923}C:\program files\yahoo!\messenger\yahoomessenger.exe" = protocol=6 | dir=in | app=c:\program files\yahoo!\messenger\yahoomessenger.exe | "TCP Query User{99C5FB50-607C-4033-8D97-2EB56908B397}C:\users\karli\appdata\roaming\dropbox\bin\dropbox.exe" = protocol=6 | dir=in | app=c:\users\karli\appdata\roaming\dropbox\bin\dropbox.exe | "TCP Query User{ACE2DA7E-0352-4F1A-928A-FD1467DE4D4B}C:\program files\paltalk messenger\paltalk.exe" = protocol=6 | dir=in | app=c:\program files\paltalk messenger\paltalk.exe | "TCP Query User{B55684EB-DE7E-4754-9451-8DBD1FDC0128}C:\program files\participatory culture foundation\miro\miro_downloader.exe" = protocol=6 | dir=in | app=c:\program files\participatory culture foundation\miro\miro_downloader.exe | "UDP Query User{39DD17BB-773E-4FBC-A51F-009ED60FAE06}C:\program files\participatory culture foundation\miro\miro_downloader.exe" = protocol=17 | dir=in | app=c:\program files\participatory culture foundation\miro\miro_downloader.exe | "UDP Query User{59AFB86E-7562-459B-A215-0A96725FB0D1}C:\program files\paltalk messenger\paltalk.exe" = protocol=17 | dir=in | app=c:\program files\paltalk messenger\paltalk.exe | "UDP Query User{6207958E-7463-4505-9A78-1E65356433F9}C:\program files\digital asphyxia\y!tunnelpro 2.5\ytpro.exe" = protocol=17 | dir=in | app=c:\program files\digital asphyxia\y!tunnelpro 2.5\ytpro.exe | "UDP Query User{707B3C07-8967-4FD1-8E8E-06F2F5313C0E}C:\users\karli\appdata\roaming\dropbox\bin\dropbox.exe" = protocol=17 | dir=in | app=c:\users\karli\appdata\roaming\dropbox\bin\dropbox.exe | "UDP Query User{9495A4B1-8589-4AC9-B101-B495285C73C7}C:\program files\participatory culture foundation\miro\miro_downloader.exe" = protocol=17 | dir=in | app=c:\program files\participatory culture foundation\miro\miro_downloader.exe | "UDP Query User{CDCD4B70-95A9-4D86-9672-AA6C589AB49E}C:\program files\yahoo!\messenger\yahoomessenger.exe" = protocol=17 | dir=in | app=c:\program files\yahoo!\messenger\yahoomessenger.exe | ========== HKEY_LOCAL_MACHINE Uninstall List ========== [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall] "{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148 "{00C297B1-02F3-4BEE-8B57-7BCA695A41DA}" = EverNote 2 "{02E89EFC-7B07-4D5A-AA03-9EC0902914EE}" = VC 9.0 Runtime "{0363BA15-B041-099C-7C9A-870EDD1A00B2}" = Catalyst Control Center Localization French "{07159635-9DFE-4105-BFC0-2817DB540C68}" = Roxio Activation Module "{0A0CADCF-78DA-33C4-A350-CD51849B9702}" = Microsoft .NET Framework 4 Extended "{0AE2D65E-001C-45CF-A6E5-665B3F5109F4}" = ArcSoft WebCam Companion 2 "{0B0F231F-CE6A-483D-AA23-77B364F75917}" = Windows Live Installer "{0D2E9DCB-9938-475E-B4DD-8851738852FF}" = AIO_Scan "{10188938-5CD3-1892-54FB-615D8E04CE19}" = CCC Help Turkish "{13E373BA-EE82-ECA9-3762-148677923E15}" = CCC Help Polish "{15BC8CD0-A65B-47D0-A2DD-90A824590FA8}" = Microsoft Works "{1746EA69-DCB6-4408-B5A5-E75F55439CDF}" = Scan "{179C56A4-F57F-4561-8BBF-F911D26EB435}" = WebReg "{191C41F6-4BA8-4D3D-BBC5-AAC8F3077E3F}" = Fujitsu MobilityCenter Extension Utility "{196467F1-C11F-4F76-858B-5812ADC83B94}" = MSXML 4.0 SP3 Parser "{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 "{200FEC62-3C34-4D60-9CE8-EC372E01C08F}" = Windows Live SOXE Definitions "{204C2E58-99C9-F88A-23A8-53B26519CD71}" = CCC Help Thai "{20DA65DE-4441-1D76-524F-BC805574F867}" = Catalyst Control Center Localization Spanish "{23BA3D03-C404-50C7-CB3D-3777B1A3AAC0}" = CCC Help German "{26A24AE4-039D-4CA4-87B4-2F83217040FF}" = Java 7 Update 40 "{27EFE61D-8A19-D287-3573-A871EADC4D2B}" = Catalyst Control Center Localization Finnish "{28C2DED6-325B-4CC7-983A-1777C8F7FBAB}" = RealUpgrade 1.1 "{297DCADA-86A1-4A42-8A13-66B7D7A09FD2}" = WeatherBug "{2A3FC24C-6EC0-4519-A52B-FDA4EA9B2D24}" = Windows Live Messenger "{2C00FDE4-B395-2C43-47CD-4F34BFC7FF58}" = Catalyst Control Center Localization Chinese Traditional "{2F9A6B72-2ECC-B2D8-9B8A-70D634FEF0A5}" = CCC Help Italian "{335C7901-BA1A-6E78-C38E-6FACC8E03FDF}" = ccc-utility "{36FDBE6E-6684-462B-AE98-9A39A1B200CC}" = HP Product Assistant "{3AA7AA2E-6D84-EE7D-6B20-2834F275D118}" = Catalyst Control Center Localization Greek "{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile "{3DB264F1-5300-BE54-F655-474538E5B7AE}" = Catalyst Control Center Graphics Full Existing "{3E9E68FB-49FA-410A-8787-424F2A506E0F}" = Business Plan Pro 15th Anniversary Edition "{4160DC5B-4C56-D0C3-C5FD-F5BDAD3C882B}" = ATI Catalyst Install Manager "{43C67425-D321-60A2-7DDD-5AD7D9DA34AF}" = Catalyst Control Center Localization Turkish "{47BC37A3-35C8-484A-8CBD-851914EB095E}" = Fujitsu Driver Update "{49F2B650-2D7B-4F59-B33D-346F63776BD3}" = DocProc "{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater "{4DB6E497-187A-4095-157B-77242FD24844}" = Catalyst Control Center Localization Polish "{4EEACDD5-E652-A888-E7AE-D345C93108D6}" = Catalyst Control Center Localization Italian "{50816F92-1652-4A7C-B9BC-48F682742C4B}" = Messenger Companion "{509AB552-924D-8CDA-CE9F-6E3549817B09}" = CCC Help Korean "{52E225FC-FCB4-41F7-837B-6E37FB05BD7B}" = Adobe AIR "{535C3494-F852-062B-0380-B118A20D42E9}" = Catalyst Control Center Localization Danish "{574157B0-9D84-49d9-B08B-5296638BF5EE}" = 4300_Help "{579684A4-DDD5-4CA3-9EA8-7BE7D9593DB4}" = Windows Live UX Platform Language Pack "{5A46CDF0-B0F4-4FDF-972A-A6AA3FEB8859}" = CCC Help Norwegian "{5BBE51E2-0809-8E7D-763F-D878FEBEC7B1}" = CCC Help Dutch "{5DD4FCBD-A3C1-4155-9E17-4161C70AAABA}" = Segoe UI "{612C34C7-5E90-47D8-9B5C-0F717DD82726}" = swMSM "{61AA490B-5BA7-48F8-CE04-F16A3A81FC84}" = CCC Help Japanese "{6226477E-444F-4DFE-BA19-9F4F7D4565BC}" = LifeBook Application Panel "{624E54D0-E4F4-434F-9EF6-D4D066EE4348}" = Facebook Video Calling 1.1.1.1 "{641CD90D-17FF-3711-4846-9F02E0EBB115}" = Catalyst Control Center Localization Chinese Standard "{65DA2EC9-0642-47E9-AAE2-B5267AA14D75}" = Activation Assistant for the 2007 Microsoft Office suites "{66E6CE0C-5A1E-430C-B40A-0C90FF1804A8}" = eSupportQFolder "{67D3F1A0-A1F2-49b7-B9EE-011277B170CD}" = HPProductAssistant "{6811CAA0-BF12-11D4-9EA1-0050BAE317E1}" = PowerDVD "{682B3E4F-696A-42DE-A41C-4C07EA1678B4}" = Windows Live SOXE "{68A3D383-6E0A-A84D-0A76-9091175417CE}" = CCC Help Swedish "{6F5E2F4A-377D-4700-B0E3-8F7F7507EA15}" = CustomerResearchQFolder "{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable "{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 "{7770E71B-2D43-4800-9CB3-5B6CAAEBEBEA}" = RealNetworks - Microsoft Visual C++ 2008 Runtime "{78A96B4C-A643-4D0F-98C2-A8E16A6669F9}" = Windows Live Messenger Companion Core "{7A7DC702-DEDE-42A8-8722-B3BA724D546F}" = Fax "{7CAC6A44-C3DE-4153-ACA6-7524602C789E}" = Facebook Video Calling 1.2.0.159 "{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable "{83C292B7-38A5-440B-A731-07070E81A64F}" = Windows Live PIMT Platform "{83C5CF93-B393-6945-0B74-A2EDC64F6CAD}" = Catalyst Control Center Graphics Light "{8445F041-CA54-279A-7D15-F6F406AF402D}" = CCC Help French "{8679FBA3-4098-1A88-E662-9D449F665A9D}" = Catalyst Control Center Localization Thai "{868A72A9-B90D-5E29-3D91-0D5339AD7597}" = Catalyst Control Center Localization Korean "{86CE85E6-DBAC-3FFD-B977-E4B79F83C909}" = Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570 "{87E2B986-07E8-477a-93DC-AF0B6758B192}" = DocProcQFolder "{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight "{8A226FD4-37CE-4B74-93FB-658D943BA544}" = Catalyst Control Center Graphics Previews Vista "{8AC823B4-918E-E9DA-014A-D035CF3D1360}" = Catalyst Control Center Core Implementation "{8DD46C6A-0056-4FEC-B70A-28BB16A1F11F}" = MSVCRT "{8E30D11F-4F74-3EE1-AE2F-830C3CAEA972}" = Catalyst Control Center Localization Swedish "{90120000-0011-0000-0000-0000000FF1CE}" = Microsoft Office Professional Plus 2007 "{90120000-0011-0000-0000-0000000FF1CE}_PROPLUS_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}" = Microsoft Office 2007 Service Pack 3 (SP3) "{90120000-0015-0409-0000-0000000FF1CE}" = Microsoft Office Access MUI (English) 2007 "{90120000-0015-0409-0000-0000000FF1CE}_PROPLUS_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3) "{90120000-0016-0409-0000-0000000FF1CE}" = Microsoft Office Excel MUI (English) 2007 "{90120000-0016-0409-0000-0000000FF1CE}_HOMESTUDENTR_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3) "{90120000-0016-0409-0000-0000000FF1CE}_PROPLUS_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3) "{90120000-0018-0409-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (English) 2007 "{90120000-0018-0409-0000-0000000FF1CE}_HOMESTUDENTR_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3) "{90120000-0018-0409-0000-0000000FF1CE}_PROPLUS_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3) "{90120000-0019-0409-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (English) 2007 "{90120000-0019-0409-0000-0000000FF1CE}_PROPLUS_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3) "{90120000-001A-0409-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (English) 2007 "{90120000-001A-0409-0000-0000000FF1CE}_PROPLUS_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3) "{90120000-001B-0409-0000-0000000FF1CE}" = Microsoft Office Word MUI (English) 2007 "{90120000-001B-0409-0000-0000000FF1CE}_HOMESTUDENTR_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3) "{90120000-001B-0409-0000-0000000FF1CE}_PROPLUS_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3) "{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007 "{90120000-001F-0409-0000-0000000FF1CE}_HOMESTUDENTR_{1FF96026-A04A-4C3E-B50A-BB7022654D0F}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3) "{90120000-001F-0409-0000-0000000FF1CE}_PROPLUS_{1FF96026-A04A-4C3E-B50A-BB7022654D0F}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3) "{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007 "{90120000-001F-040C-0000-0000000FF1CE}_HOMESTUDENTR_{71F055E8-E2C6-4214-BB3D-BFE03561B89E}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3) "{90120000-001F-040C-0000-0000000FF1CE}_PROPLUS_{71F055E8-E2C6-4214-BB3D-BFE03561B89E}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3) "{90120000-001F-0C0A-0000-0000000FF1CE}" = Microsoft Office Proof (Spanish) 2007 "{90120000-001F-0C0A-0000-0000000FF1CE}_HOMESTUDENTR_{2314F9A1-126F-45CC-8A5E-DFAF866F3FBC}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3) "{90120000-001F-0C0A-0000-0000000FF1CE}_PROPLUS_{2314F9A1-126F-45CC-8A5E-DFAF866F3FBC}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3) "{90120000-0020-0409-0000-0000000FF1CE}" = Compatibility Pack for the 2007 Office system "{90120000-002C-0409-0000-0000000FF1CE}" = Microsoft Office Proofing (English) 2007 "{90120000-0044-0409-0000-0000000FF1CE}" = Microsoft Office InfoPath MUI (English) 2007 "{90120000-0044-0409-0000-0000000FF1CE}_PROPLUS_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3) "{90120000-006E-0409-0000-0000000FF1CE}" = Microsoft Office Shared MUI (English) 2007 "{90120000-006E-0409-0000-0000000FF1CE}_HOMESTUDENTR_{98333358-268C-4164-B6D4-C96DF5153727}" = Microsoft Office 2007 Service Pack 3 (SP3) "{90120000-006E-0409-0000-0000000FF1CE}_PROPLUS_{98333358-268C-4164-B6D4-C96DF5153727}" = Microsoft Office 2007 Service Pack 3 (SP3) "{90120000-00A1-0409-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (English) 2007 "{90120000-00A1-0409-0000-0000000FF1CE}_HOMESTUDENTR_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3) "{90120000-0115-0409-0000-0000000FF1CE}" = Microsoft Office Shared Setup Metadata MUI (English) 2007 "{90120000-0115-0409-0000-0000000FF1CE}_HOMESTUDENTR_{98333358-268C-4164-B6D4-C96DF5153727}" = Microsoft Office 2007 Service Pack 3 (SP3) "{90120000-0115-0409-0000-0000000FF1CE}_PROPLUS_{98333358-268C-4164-B6D4-C96DF5153727}" = Microsoft Office 2007 Service Pack 3 (SP3) "{90120000-0117-0409-0000-0000000FF1CE}" = Microsoft Office Access Setup Metadata MUI (English) 2007 "{90120000-0117-0409-0000-0000000FF1CE}_PROPLUS_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3) "{90140000-2005-0000-0000-0000000FF1CE}" = Microsoft Office File Validation Add-In "{91120000-002F-0000-0000-0000000FF1CE}" = Microsoft Office Home and Student 2007 "{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}" = Microsoft Office 2007 Service Pack 3 (SP3) "{915C56D7-1EFD-4BF3-9FBE-2B0D39F36525}" = calibre "{91EA42B7-06FD-2834-858B-B219A6A8CE6C}" = Catalyst Control Center Localization Russian "{933B4015-4618-4716-A828-5289FC03165F}" = VC80CRTRedist - 8.0.50727.6195 "{94CAC2F1-C856-47F4-AF24-65A1E75AEDB9}" = MotoHelper MergeModules "{95120000-00AF-0409-0000-0000000FF1CE}" = Microsoft Office PowerPoint Viewer 2007 (English) "{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting "{95140000-007F-0409-0000-0000000FF1CE}" = Microsoft Office Outlook Connector "{95D08F4E-DFC2-4ce3-ACB7-8C8E206217E9}" = MarketResearch "{97486FBE-A3FC-4783-8D55-EA37E9D171CC}" = HP Update "{978C25EE-5777-46e4-8988-732C297CBDBD}" = Status "{98CCC577-9ED6-E291-F512-800C6BC9B485}" = CCC Help Chinese Standard "{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 "{9B1FD9CE-0776-4f0b-A6F5-C6AB7B650CDF}" = Destinations "{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 "{9F56D0C8-731E-93F2-584A-34C6A486D876}" = Catalyst Control Center Localization Norwegian "{9F72EF8B-AEC9-4CA5-B483-143980AFD6FD}" = ALPS Touch Pad Driver "{9FB9E409-423F-8B24-BF0D-1172F67EFA2F}" = ccc-core-static "{9FEAE825-0C49-8268-6B15-7453BE451243}" = CCC Help English "{a0fe116e-9a8a-466f-aee0-625cb7c207e3}" = Microsoft Visual C++ 2005 Redistributable - KB2467175 "{A2B79FA6-AD59-4D84-AE55-89C58D1F48B9}" = Branding "{A36CD345-625C-4d6c-B3E2-76E1248CB451}" = SolutionCenter "{A3B7C670-4A1E-4EE2-950E-C875BC1965D0}" = Copy "{A5B96AC4-1E88-9219-6AD7-D7EF74F73839}" = Catalyst Control Center Localization Japanese "{A80FA752-C491-4ED9-ABF0-4278563160B2}" = 32 Bit HP CIO Components Installer "{A9BDCA6B-3653-467B-AC83-94367DA3BFE3}" = Windows Live Photo Common "{AAECF7BA-E83B-4A10-87EA-DE0B333F8734}" = RealNetworks - Microsoft Visual C++ 2010 Runtime "{AB5D51AE-EBC3-438D-872C-705C7C2084B0}" = DeviceManagementQFolder "{AC76BA86-7AD7-1033-7B44-AA1000000001}" = Adobe Reader X (10.1.8) "{ACF4BF67-2A6F-ADCA-5B96-79686DD9A1CC}" = Catalyst Control Center Localization German "{ADE16A9D-FBDC-4ecc-B6BD-9C31E51D0332}" = VC0331 USB2.0 Digital Camera "{B0B2407C-AA1A-4812-85DA-E833D5BC3E97}" = 4300 "{B2544A03-10D0-4E5E-BA69-0362FFC20D18}" = OGA Notifier 2.0.0048.0 "{B7FB0C86-41A4-4402-9A33-912C462042A0}" = Roxio Easy Media Creator Home "{B8375BAD-9A94-C89F-44E2-B9189391294A}" = Catalyst Control Center Localization Hungarian "{B92C5909-1D37-4C51-8397-A28BB28E5DC3}" = Facebook Video Calling 1.2.0.287 "{BA0CC975-682B-4678-A35C-05E607F36387}" = Fujitsu Hotkey Utility "{BC153E04-35D7-F24A-5E86-B1209EA5D898}" = Catalyst Control Center Localization Dutch "{BE77A81F-B315-4666-9BF3-AE70C0ADB057}" = BufferChm "{BEE332DD-5CAD-5356-0C68-EFA083DB7A50}" = CCC Help Greek "{C1D8CEBB-BFEE-4E82-92E0-7579211F3ADF}" = Fujitsu Display Manager "{C47B36EC-0639-4462-A9CE-7809CF2F6100}" = ZoneAlarm Security "{C6150D8A-86ED-41D3-87BB-F3BB51B0B77F}" = Windows Live ID Sign-in Assistant "{C667F699-861A-4AB5-AC2C-A8276DCCFDA9}" = O2Micro Flash Memory Card Windows Driver "{C716522C-3731-4667-8579-40B098294500}" = Toolbox "{C8E8D2E3-EF6A-4B1D-A09E-7B27EBE2F3CE}" = RealDownloader "{C916D86C-AB76-49c7-B0E4-A946E0FD9BC2}" = HP Photosmart, Officejet, PSC and Deskjet All-In-One Driver Software 8.0.B "{CA7FD33E-C25D-2739-A08C-D984117158B3}" = CCC Help Hungarian "{CBAD355D-3FFD-215F-0383-5791ACFDC2C2}" = CCC Help Danish "{CDDCBBF1-2703-46BC-938B-BCC81A1EEAAA}" = SUPERAntiSpyware "{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1 "{CE95A79E-E4FC-4FFF-8A75-29F04B942FF2}" = Windows Live UX Platform "{D436F577-1695-4D2F-8B44-AC76C99E0002}" = Windows Live Photo Common "{D45240D3-B6B3-4FF9-B243-54ECE3E10066}" = Windows Live Communications Platform "{D4FB136D-2802-4578-A023-E7243BD0D7D5}" = ZoneAlarm Firewall "{D6B25B8D-0566-42B1-A23D-7576138435D6}" = Y!TunnelPro 2.6 "{D732E36A-B0C2-4DFF-8C60-4AC06233B2BC}" = Motorola Mobile Drivers Installation 6.0.0 "{D802C6C2-E757-3DDE-F1BB-EDEE6857257F}" = CCC Help Finnish "{DDE262BD-7C23-0F41-BABC-F8F2137FF9E0}" = Catalyst Control Center Graphics Full New "{E06F04B9-45E6-4AC0-8083-85F7515F40F7}" = UnloadSupport "{E09575B2-498D-4C8B-A9D2-623F78574F29}" = AIO_CDB_Software "{E09C4DB7-630C-4F06-A631-8EA7239923AF}" = D3DX10 "{E0B09C9A-1408-43BD-5987-1FBD1A92D751}" = Catalyst Control Center Localization Portuguese "{E3724B2E-84FC-D816-6189-9C5ED026C803}" = CCC Help Spanish "{E4FEA654-A06E-356F-0188-79B9AD58F43B}" = CCC Help Russian "{E5B21F11-6933-4E0B-A25C-7963E3C07D11}" = Windows Live Messenger "{E7112940-5F8E-4918-B9FE-251F2F8DC81F}" = AIO_CDB_ProductContext "{E7299127-E1B4-3416-51D6-8D606C817C2B}" = CCC Help Portuguese "{E8A5B78F-4456-4511-AB3D-E7BFFB974A7A}" = Fujitsu System Extension Utility "{E94C7572-FD59-3829-453C-7AA01BBF6A2B}" = CCC Help Czech "{EADFC162-CC19-C5D8-3269-59B9EC9C270B}" = CCC Help Chinese Traditional "{EB21A812-671B-4D08-B974-2A347F0D8F70}" = HP Photosmart Essential "{EB75DE50-5754-4F6F-875D-126EDF8E4CB3}" = HPSSupply "{EBA1F484-F4AE-B16A-940C-545FFB2D0E19}" = Skins "{EBEAF45A-58C3-44c8-8714-87909EBD6BC2}" = 4300Trb "{F00103AD-4552-1329-38F5-E0138426B303}" = Catalyst Control Center Localization Czech "{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver "{FE044230-9CA5-43F7-9B58-5AC5A28A1F33}" = Windows Live Essentials "{FF075778-6E50-47ed-991D-3B07FD4E3250}" = TrayApp "7-Zip" = 7-Zip 9.20 "Activation Assistant for the 2007 Microsoft Office suites" = Activation Assistant for the 2007 Microsoft Office suites "Adobe AIR" = Adobe AIR "Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin "Adobe Shockwave Player" = Adobe Shockwave Player 11.6 "Agere Systems Soft Modem" = Agere Systems HDA Modem "ATI Uninstaller" = ATI Uninstaller "avast" = avast! Internet Security "BFG-Brain Games - Mahjongg" = Brain Games: Mahjongg "BFGC" = Big Fish Games: Game Manager "BFG-Mahjong Escape Ancient China" = Mahjong Escape Ancient China "CleanMyPC - Registry Cleaner_is1" = CleanMyPC - Registry Cleaner "Fujitsu A Series Retail Demo" = Fujitsu A Series Retail Demo "HOMESTUDENTR" = Microsoft Office Home and Student 2007 "HP Imaging Device Functions" = HP Imaging Device Functions 8.0 "HP Solution Center & Imaging Support Tools" = HP Solution Center 8.0 "HPExtendedCapabilities" = HP Customer Participation Program 8.0 "HPOCR" = HP OCR Software 8.0 "InstallShield_{191C41F6-4BA8-4D3D-BBC5-AAC8F3077E3F}" = Fujitsu MobilityCenter Extension Utility "InstallShield_{6226477E-444F-4DFE-BA19-9F4F7D4565BC}" = LifeBook Application Panel "InstallShield_{BA0CC975-682B-4678-A35C-05E607F36387}" = Fujitsu Hotkey Utility "InstallShield_{C1D8CEBB-BFEE-4E82-92E0-7579211F3ADF}" = Fujitsu Display Manager "InstallShield_{C667F699-861A-4AB5-AC2C-A8276DCCFDA9}" = O2Micro Flash Memory Card Windows Driver "InstallShield_{E8A5B78F-4456-4511-AB3D-E7BFFB974A7A}" = Fujitsu System Extension Utility "Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware version 1.75.0.1300 "Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1 "Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile "Microsoft .NET Framework 4 Extended" = Microsoft .NET Framework 4 Extended "Mozilla Firefox 24.0 (x86 en-US)" = Mozilla Firefox 24.0 (x86 en-US) "MozillaMaintenanceService" = Mozilla Maintenance Service "Picasa2" = Picasa 2 "PROPLUS" = Microsoft Office Professional Plus 2007 "RealPlayer 16.0" = RealPlayer "WinLiveSuite" = Windows Live Essentials "Yahoo! Messenger" = Yahoo! Messenger "Yahoo! Software Update" = Yahoo! Software Update "ZoneAlarm Free Firewall" = ZoneAlarm Free Firewall ========== HKEY_CURRENT_USER Uninstall List ========== [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall] "Dropbox" = Dropbox ========== Last 20 Event Log Errors ========== [ Application Events ] Error - 10/16/2013 5:46:05 PM | Computer Name = Karli-PC | Source = EventSystem | ID = 4609 Description = Error - 10/16/2013 5:46:22 PM | Computer Name = Karli-PC | Source = SideBySide | ID = 16842785 Description = Activation context generation failed for "C:\Windows\Installer\{C8E8D2E3-EF6A-4B1D-A09E-7B27EBE2F3CE}\recordingmanager.exe". Dependent Assembly rpshellextension.1.0,language="*",type="win32",version="1.0.0.0" could not be found. Please use sxstrace.exe for detailed diagnosis. Error - 10/16/2013 5:46:22 PM | Computer Name = Karli-PC | Source = SideBySide | ID = 16842785 Description = Activation context generation failed for "C:\Windows\Installer\{C8E8D2E3-EF6A-4B1D-A09E-7B27EBE2F3CE}\recordingmanager.exe". Dependent Assembly rpshellextension.1.0,language="*",type="win32",version="1.0.0.0" could not be found. Please use sxstrace.exe for detailed diagnosis. Error - 10/16/2013 5:51:25 PM | Computer Name = Karli-PC | Source = Application Error | ID = 1000 Description = Faulting application FRST.exe, version 3.3.8.1, time stamp 0x4f25baec, faulting module ntdll.dll, version 6.0.6002.18881, time stamp 0x51da3e27, exception code 0xc0000005, fault offset 0x0006657b, process id 0x124, application start time 0x01cecab9a796428a. Error - 10/16/2013 5:56:00 PM | Computer Name = Karli-PC | Source = Microsoft-Windows-CAPI2 | ID = 131584 Description = Error - 10/16/2013 5:58:10 PM | Computer Name = Karli-PC | Source = SideBySide | ID = 16842785 Description = Activation context generation failed for "C:\Windows\Installer\{C8E8D2E3-EF6A-4B1D-A09E-7B27EBE2F3CE}\recordingmanager.exe". Dependent Assembly rpshellextension.1.0,language="*",type="win32",version="1.0.0.0" could not be found. Please use sxstrace.exe for detailed diagnosis. Error - 10/16/2013 5:58:11 PM | Computer Name = Karli-PC | Source = SideBySide | ID = 16842785 Description = Activation context generation failed for "C:\Windows\Installer\{C8E8D2E3-EF6A-4B1D-A09E-7B27EBE2F3CE}\recordingmanager.exe". Dependent Assembly rpshellextension.1.0,language="*",type="win32",version="1.0.0.0" could not be found. Please use sxstrace.exe for detailed diagnosis. Error - 10/16/2013 6:22:38 PM | Computer Name = Karli-PC | Source = EventSystem | ID = 4609 Description = Error - 10/16/2013 6:22:54 PM | Computer Name = Karli-PC | Source = SideBySide | ID = 16842785 Description = Activation context generation failed for "C:\Windows\Installer\{C8E8D2E3-EF6A-4B1D-A09E-7B27EBE2F3CE}\recordingmanager.exe". Dependent Assembly rpshellextension.1.0,language="*",type="win32",version="1.0.0.0" could not be found. Please use sxstrace.exe for detailed diagnosis. Error - 10/16/2013 6:22:54 PM | Computer Name = Karli-PC | Source = SideBySide | ID = 16842785 Description = Activation context generation failed for "C:\Windows\Installer\{C8E8D2E3-EF6A-4B1D-A09E-7B27EBE2F3CE}\recordingmanager.exe". Dependent Assembly rpshellextension.1.0,language="*",type="win32",version="1.0.0.0" could not be found. Please use sxstrace.exe for detailed diagnosis. [ System Events ] Error - 10/16/2013 5:46:11 PM | Computer Name = Karli-PC | Source = DCOM | ID = 10005 Description = Error - 10/16/2013 5:46:55 PM | Computer Name = Karli-PC | Source = Service Control Manager | ID = 7001 Description = Error - 10/16/2013 5:46:55 PM | Computer Name = Karli-PC | Source = Service Control Manager | ID = 7026 Description = Error - 10/16/2013 6:19:42 PM | Computer Name = Karli-PC | Source = DCOM | ID = 10010 Description = Error - 10/16/2013 6:22:27 PM | Computer Name = Karli-PC | Source = DCOM | ID = 10005 Description = Error - 10/16/2013 6:22:38 PM | Computer Name = Karli-PC | Source = DCOM | ID = 10005 Description = Error - 10/16/2013 6:22:41 PM | Computer Name = Karli-PC | Source = DCOM | ID = 10005 Description = Error - 10/16/2013 6:22:44 PM | Computer Name = Karli-PC | Source = DCOM | ID = 10005 Description = Error - 10/16/2013 6:23:28 PM | Computer Name = Karli-PC | Source = Service Control Manager | ID = 7001 Description = Error - 10/16/2013 6:23:28 PM | Computer Name = Karli-PC | Source = Service Control Manager | ID = 7026 Description = < End of report >

When I paste that into the run box that comes up, I get an error that says Windows can't find ComboFix even though it's sitting right there on the desktop.

Ok here is the report from RK RogueKiller V8.7.2 [Oct 3 2013] by Tigzy mail : tigzyRK<at>gmail<dot>com Feedback : http://www.adlice.com/forum/ Website : http://www.adlice.com/softwares/roguekiller/ Blog : http://tigzyrk.blogspot.com/ Operating System : Windows Vista (6.0.6002 Service Pack 2) 32 bits version Started in : Normal mode User : Karli [Admin rights] Mode : Remove -- Date : 10/14/2013 20:58:52 | ARK || FAK || MBR | ¤¤¤ Bad processes : 1 ¤¤¤ [sUSP PATH] {5E1BB28C-EC29-4111-BF07-8930F62850E9}.exe -- C:\Users\Karli\AppData\Local\Temp\{5E1BB28C-EC29-4111-BF07-8930F62850E9}.exe [7] -> KILLED [TermThr] ¤¤¤ Registry Entries : 2 ¤¤¤ [HJ POL][PUM] HKCU\[...]\System : DisableTaskMgr (0) -> DELETED [HJ POL][PUM] HKCU\[...]\System : DisableRegistryTools (0) -> DELETED ¤¤¤ Scheduled tasks : 0 ¤¤¤ ¤¤¤ Startup Entries : 0 ¤¤¤ ¤¤¤ Web browsers : 0 ¤¤¤ ¤¤¤ Particular Files / Folders: ¤¤¤ ¤¤¤ Driver : [LOADED] ¤¤¤ [inline] EAT @explorer.exe (FwDoNothingOnObject) : FirewallAPI.dll -> HOOKED (Unknown @ 0x36AE6566) [inline] EAT @explorer.exe (FwEnableMemTracing) : FirewallAPI.dll -> HOOKED (Unknown @ 0x36AE6566) [inline] EAT @explorer.exe (FwSetMemLeakPolicy) : FirewallAPI.dll -> HOOKED (Unknown @ 0x36AE6566) ¤¤¤ External Hives: ¤¤¤ ¤¤¤ Infection : ¤¤¤ ¤¤¤ HOSTS File: ¤¤¤ --> %SystemRoot%\System32\drivers\etc\hosts 127.0.0.1 localhost 127.0.0.1 www.007guard.com 127.0.0.1 007guard.com 127.0.0.1 008i.com 127.0.0.1 www.008k.com 127.0.0.1 008k.com 127.0.0.1 www.00hq.com 127.0.0.1 00hq.com 127.0.0.1 010402.com 127.0.0.1 www.032439.com 127.0.0.1 032439.com 127.0.0.1 www.0scan.com 127.0.0.1 0scan.com 127.0.0.1 1000gratisproben.com 127.0.0.1 www.1000gratisproben.com 127.0.0.1 1001namen.com 127.0.0.1 www.1001namen.com 127.0.0.1 100888290cs.com 127.0.0.1 www.100888290cs.com 127.0.0.1 www.100sexlinks.com [...] ¤¤¤ MBR Check: ¤¤¤ +++++ PhysicalDrive0: (\\.\PHYSICALDRIVE0 @ IDE) (Standard disk drives) - FUJITSU MHY2200BH ATA Device +++++ --- User --- [MBR] e4365f7a488759d7e933a0de4af663ef [bSP] dd994dfa1597ebea0f49d35f7e74cbe7 : Windows Vista MBR Code Partition table: 0 - [XXXXXX] ACER (0x27) [VISIBLE] Offset (sectors): 2048 | Size: 1536 Mo 1 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 3147776 | Size: 188208 Mo 2 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 388597760 | Size: 1036 Mo User = LL1 ... OK! User = LL2 ... OK! Finished : << RKreport[0]_D_10142013_205852.txt >> RKreport[0]_S_10142013_205621.txt

Ok, here is the log from the TdssKiller and I am off to the the RogueKiller now. Oh and you were right about the board ot accepting the long log too. so let me know if you need the rest of it. Thanks for your help with this Gringo. I feel like maybe we can make some progress now 20:35:35.0602 0x1738 ============================================================ 20:35:35.0602 0x1738 Scan finished 20:35:35.0602 0x1738 ============================================================ 20:35:35.0618 0x1730 Detected object count: 8 20:35:35.0618 0x1730 Actual detected object count: 8 20:37:52.0400 0x1730 ADVNTDRV ( UnsignedFile.Multi.Generic ) - skipped by user 20:37:52.0400 0x1730 ADVNTDRV ( UnsignedFile.Multi.Generic ) - User select action: Skip 20:37:52.0416 0x1730 FBIOSDRV ( UnsignedFile.Multi.Generic ) - skipped by user 20:37:52.0416 0x1730 FBIOSDRV ( UnsignedFile.Multi.Generic ) - User select action: Skip 20:37:52.0416 0x1730 hpqcxs08 ( UnsignedFile.Multi.Generic ) - skipped by user 20:37:52.0416 0x1730 hpqcxs08 ( UnsignedFile.Multi.Generic ) - User select action: Skip 20:37:52.0416 0x1730 hpqddsvc ( UnsignedFile.Multi.Generic ) - skipped by user 20:37:52.0416 0x1730 hpqddsvc ( UnsignedFile.Multi.Generic ) - User select action: Skip 20:37:52.0416 0x1730 Net Driver HPZ12 ( UnsignedFile.Multi.Generic ) - skipped by user 20:37:52.0416 0x1730 Net Driver HPZ12 ( UnsignedFile.Multi.Generic ) - User select action: Skip 20:37:52.0416 0x1730 O2Flash ( UnsignedFile.Multi.Generic ) - skipped by user 20:37:52.0416 0x1730 O2Flash ( UnsignedFile.Multi.Generic ) - User select action: Skip 20:37:52.0416 0x1730 Pml Driver HPZ12 ( UnsignedFile.Multi.Generic ) - skipped by user 20:37:52.0416 0x1730 Pml Driver HPZ12 ( UnsignedFile.Multi.Generic ) - User select action: Skip 20:37:52.0432 0x1730 UpdateNaviInstallService ( UnsignedFile.Multi.Generic ) - skipped by user 20:37:52.0432 0x1730 UpdateNaviInstallService ( UnsignedFile.Multi.Generic ) - User select action: Skip