Jump to content

bobalu4u

Honorary Members
  • Posts

    24
  • Joined

  • Last visited

Reputation

0 Neutral
  1. Hi Kevin, Okay here it is! Hopefully it's gone because I do have my homepages back again. Many thanks. Should I install Google chrome on Firefox? Because it seems that a few of those pup's had something to do with Google ad-ons. C:\AdwCleaner\Quarantine\C\Documents and Settings\bob\Application Data\Mozilla\Firefox\Profiles\h7nl2mbh.default-1384217108078\Extensions\16eede48-12e9-4c79-bd54-c82622138533@630d8a34-73af-4e03-9664-9082492eb220.com\extensionData\plugins\91.js.vir JS/Toolbar.Crossrider.B potentially unwanted application deleted - quarantined C:\Documents and Settings\bob\My Documents\Downloads\ccsetup327.exe Win32/Bundled.Toolbar.Google.D potentially unsafe application deleted - quarantined C:\Documents and Settings\bob\My Documents\Downloads 2\kbsetup Typing.exe a variant of Win32/Toolbar.Conduit.J potentially unwanted application deleted - quarantined C:\Documents and Settings\bob\My Documents\SE TUP EXE\ccsetup313.exe Win32/Bundled.Toolbar.Google.E potentially unsafe application deleted - quarantined C:\Documents and Settings\bob\My Documents\SE TUP EXE\duplicate-file-finder-setup.exe a variant of Win32/Bundled.Toolbar.Ask potentially unsafe application deleted - quarantined C:\Documents and Settings\bob\My Documents\SE TUP EXE\RapidTyping_Setup_3.exe a variant of Win32/Bundled.Toolbar.Ask potentially unsafe application deleted - quarantined C:\Documents and Settings\bob\My Documents\SE TUP EXE\Shockwave_Installer_Slim.exe Win32/Bundled.Toolbar.Google.D potentially unsafe application deleted - quarantined C:\Documents and Settings\bob\My Documents\Security info\Downloads\kbsetup Typing.exe a variant of Win32/Toolbar.Conduit.J potentially unwanted application deleted - quarantined C:\Program Files\COMODO\Firewall\s1.tmp a variant of Win32/AdInstaller potentially unwanted application deleted - quarantined C:\Program Files\Final Draft 7\Patch.exe a variant of Win32/HackTool.Patcher.A potentially unsafe application deleted - quarantined C:\System Volume Information\_restore{129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP2187\A1261678.dll a variant of Win32/SProtector.D potentially unwanted application deleted - quarantined C:\System Volume Information\_restore{129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP2187\A1261695.dll a variant of Win32/SProtector.D potentially unwanted application deleted - quarantined C:\System Volume Information\_restore{129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP2189\A1263015.dll a variant of Win32/SProtector.D potentially unwanted application deleted - quarantined C:\System Volume Information\_restore{129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP2189\A1263026.exe a variant of Win32/AdWare.SpeedingUpMyPC.D application cleaned by deleting - quarantined C:\System Volume Information\_restore{129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP2189\A1263029.exe a variant of Win32/Adware.SpeedingUpMyPC.C application cleaned by deleting - quarantined C:\System Volume Information\_restore{129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP2189\A1263033.exe a variant of Win32/SpeedingUpMyPC application deleted - quarantined C:\System Volume Information\_restore{129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP2189\A1263034.dll probably a variant of Win32/SProtector.E potentially unwanted application deleted - quarantined C:\System Volume Information\_restore{129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP2190\A1263201.dll a variant of Win32/AdWare.MultiPlug.N application cleaned by deleting - quarantined C:\System Volume Information\_restore{129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP2190\A1263203.dll a variant of Win64/Adware.MultiPlug.A application cleaned by deleting - quarantined C:\System Volume Information\_restore{129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP2194\A1266134.exe a variant of MSIL/DomaIQ.A potentially unwanted application deleted - quarantined C:\System Volume Information\_restore{129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP2194\A1266139.dll Win32/InstalleRex.M potentially unwanted application deleted - quarantined C:\System Volume Information\_restore{129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP2194\A1266144.dll Win32/InstalleRex.M potentially unwanted application deleted - quarantined C:\WINDOWS\system32\Adobe\Shockwave 11\gt.exe Win32/Bundled.Toolbar.Google.D potentially unsafe application deleted - quarantined C:\zoek_backup\C_DOCUME~1_ALLUSE~1_APPLIC~1_InstallMate\{37E3D31F-83B3-4341-A1AA-CB91EC00F1E9}\Custom.dll Win32/InstalleRex.M potentially unwanted application deleted - quarantined C:\zoek_backup\C_DOCUME~1_ALLUSE~1_APPLIC~1_InstallMate\{DC3B5126-78C7-4B0B-A9E0-30E507D873D0}\Custom.dll Win32/InstalleRex.M potentially unwanted application deleted - quarantined C:\zoek_backup\C_Program Files_Uninstaller\Uninstall.exe a variant of MSIL/DomaIQ.A potentially unwanted application deleted - quarantined
  2. zoek-results.log Here it is, Kevin... thanks again.
  3. No I did put it in this box..it still says error too short. I'm thinking it could be too long. Can I send it to you anyother way, like as an atachment?
  4. Kevin, It won't send. Keeps saying post is too short. Is there another way I can send this log? Thanx
  5. Kevin, I'm sending you the log for Zoek. I think we got it! No more hijacked browsers. Thank you so much! Let me know if there's anything in the log that shows I need more fixing. One question: when I open Firfox it asks if I want to install Google Chrome for faster browsing...should I? I'm moving away from IE 8 because it's no longer supported by MS. I'm not sure which browser to use as my regular browser..Firefox or Google? Thanks again. FYI I've tried to send the post and the log together and I get an error that my post is too short! Odd because if anything it's too long. I'll send it again.
  6. Kevin, I unzipped all three Zoek instances and F Secure, my AV automatically ran a scan and either removed or quarrantined 2 of them. The only one remaining is the EXE file. I'm new to FSecure so I didn't disable it, but I hadn't run the Zoek yet. Should I extract the 2 other instances and put them on the desktop again. F secure calls it a trojan. Or do I just close down F Secure and only run the Zoek EXE.?ythanks
  7. Hey Kevin, here it is. No items found and I still have key find.com as the hijacker of all my browser homepages. What now? Malwarebytes Anti-Malware 1.75.0.1300 www.malwarebytes.org Database version: v2014.04.15.01 Windows XP Service Pack 3 x86 NTFS Internet Explorer 8.0.6001.18702 bob :: BOBALU [administrator] 4/15/2014 4:42:30 PM mbam-log-2014-04-15 (16-42-30).txt Scan type: Quick scan Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM | P2P Scan options disabled: Objects scanned: 303043 Time elapsed: 9 minute(s), 8 second(s) Memory Processes Detected: 0 (No malicious items detected) Memory Modules Detected: 0 (No malicious items detected) Registry Keys Detected: 0 (No malicious items detected) Registry Values Detected: 0 (No malicious items detected) Registry Data Items Detected: 0 (No malicious items detected) Folders Detected: 0 (No malicious items detected) Files Detected: 0 (No malicious items detected) (end)
  8. Hi Kevin, Okay I hope I got this right. Here are the OTL and MBam logs. All processes killed ========== OTL ========== HKLM\SOFTWARE\Microsoft\Internet Explorer\Main\\Default_Page_URL| /E : value set successfully! HKLM\SOFTWARE\Microsoft\Internet Explorer\Main\\Default_Search_URL| /E : value set successfully! HKLM\SOFTWARE\Microsoft\Internet Explorer\Main\\Search Page| /E : value set successfully! HKLM\SOFTWARE\Microsoft\Internet Explorer\Main\\Start Page| /E : value set successfully! HKCU\SOFTWARE\Microsoft\Internet Explorer\Main\\Default_Page_URL| /E : value set successfully! Use Chrome's Settings page to change the HomePage. Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{CF070CB8-F02F-4af4-A7B7-8D45CAD4BB54}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CF070CB8-F02F-4af4-A7B7-8D45CAD4BB54}\ not found. Registry key HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{CF070CB8-F02F-4af4-A7B7-8D45CAD4BB54}\ deleted successfully. Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\Locked deleted successfully. Registry value HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{0B53EAC3-8D69-4B9E-9B19-A37C9A5676A7} deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0B53EAC3-8D69-4B9E-9B19-A37C9A5676A7}\ not found. Registry value HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{2318C2B1-4965-11D4-9B18-009027A5CD4F} deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2318C2B1-4965-11D4-9B18-009027A5CD4F}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{AD9E6088-E00B-42f9-9F0C-8480525D234E}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{AD9E6088-E00B-42f9-9F0C-8480525D234E}\ not found. C:\WINDOWS\tasks\At3.job moved successfully. C:\WINDOWS\tasks\At2.job moved successfully. Unable to delete ADS C:\WINDOWS\System32\sqlsodbc.chm:SummaryInformation . ========== FILES ========== < ipconfig /flushdns /c > Windows IP Configuration Successfully flushed the DNS Resolver Cache. C:\Documents and Settings\bob\My Documents\SECURITY\cmd.bat deleted successfully. C:\Documents and Settings\bob\My Documents\SECURITY\cmd.txt deleted successfully. ========== COMMANDS ========== [EMPTYTEMP] User: Administrator ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes User: All Users User: bob ->Temp folder emptied: 3314 bytes ->Temporary Internet Files folder emptied: 1229202 bytes ->Java cache emptied: 0 bytes ->FireFox cache emptied: 3992767 bytes ->Google Chrome cache emptied: 7234614 bytes ->Flash cache emptied: 506 bytes User: Default User ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes User: Guest User: HelpAssistant User: LocalService ->Temp folder emptied: 66016 bytes ->Temporary Internet Files folder emptied: 33170 bytes ->Flash cache emptied: 0 bytes User: marie ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes User: NetworkService ->Temp folder emptied: 1274736 bytes ->Temporary Internet Files folder emptied: 33170 bytes User: SUPPORT_388945a0 %systemdrive% .tmp files removed: 0 bytes %systemroot% .tmp files removed: 0 bytes %systemroot%\System32 .tmp files removed: 0 bytes %systemroot%\System32\dllcache .tmp files removed: 0 bytes %systemroot%\System32\drivers .tmp files removed: 0 bytes Windows Temp folder emptied: 5400 bytes %systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 15227 bytes %systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 0 bytes RecycleBin emptied: 0 bytes Total Files Cleaned = 13.00 mb Restore point Set: OTL Restore Point OTL by OldTimer - Version 3.2.69.0 log created on 04142014_175400 Files\Folders moved on Reboot... PendingFileRenameOperations files... Registry entries deleted on Reboot.. ----------------------------------- . Malwarebytes Anti-Malware 1.75.0.1300 www.malwarebytes.org Database version: v2014.04.15.01 Windows XP Service Pack 3 x86 NTFS Internet Explorer 8.0.6001.18702 bob :: BOBALU [administrator] 4/14/2014 6:08:04 PM MBAM-log-2014-04-14 (18-19-05).txt Scan type: Quick scan Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM | P2P Scan options disabled: Objects scanned: 302916 Time elapsed: 9 minute(s), 44 second(s) Memory Processes Detected: 0 (No malicious items detected) Memory Modules Detected: 0 (No malicious items detected) Registry Keys Detected: 2 HKCU\SOFTWARE\Google\Chrome\Extensions\pacgpkgadgmibnhpdidcnfafllnmeomc (PUP.Optional.uTorrentTB.A) -> No action taken. HKLM\SOFTWARE\Google\Chrome\Extensions\pacgpkgadgmibnhpdidcnfafllnmeomc (PUP.Optional.uTorrentTB.A) -> No action taken. Registry Values Detected: 0 (No malicious items detected) Registry Data Items Detected: 3 HKLM\SOFTWARE\Clients\StartMenuInternet\Chrome.EXE\shell\open\command| (PUP.Optional.KeyFind.A) -> Bad: ("C:\Program Files\Google\Chrome\Application\chrome.exe" http://www.key-find.com/?type=sc&ts=1397420042&from=tugs&uid=WDCXWD2500JS-75NCB1_WD-WCANK189356893568) Good: (Chrome.exe) -> No action taken. HKLM\SOFTWARE\Clients\StartMenuInternet\FIREFOX.EXE\shell\open\command| (PUP.Optional.KeyFind.A) -> Bad: ("C:\Program Files\Mozilla Firefox\firefox.exe" http://www.key-find.com/?type=sc&ts=1397420042&from=tugs&uid=WDCXWD2500JS-75NCB1_WD-WCANK189356893568) Good: (firefox.exe) -> No action taken. HKLM\SOFTWARE\Clients\StartMenuInternet\Google Chrome\shell\open\command| (PUP.Optional.KeyFind.A) -> Bad: ("C:\Program Files\Google\Chrome\Application\chrome.exe" http://www.key-find.com/?type=sc&ts=1397420042&from=tugs&uid=WDCXWD2500JS-75NCB1_WD-WCANK189356893568) Good: (Chrome.exe) -> No action taken. Folders Detected: 0 (No malicious items detected) Files Detected: 0 (No malicious items detected) (end)
  9. Hi, Okay I ran the programs as directed. Here are the log files. Hope you can help. # AdwCleaner v3.023 - Report created 13/04/2014 at 17:22:28 # Updated 01/04/2014 by Xplode # Operating System : Microsoft Windows XP Service Pack 3 (32 bits) # Username : bob - BOBALU # Running from : C:\Documents and Settings\bob\Desktop\AdwCleaner.exe # Option : Clean ***** [ Services ] ***** ***** [ Files / Folders ] ***** Folder Deleted : C:\Documents and Settings\All Users\Application Data\SNT Folder Deleted : C:\Documents and Settings\All Users\Application Data\WbSvCouponApp Folder Deleted : C:\Program Files\uniblue Folder Deleted : C:\Documents and Settings\bob\Local Settings\Application Data\eSupport.com Folder Deleted : C:\Documents and Settings\bob\Local Settings\Application Data\torch Folder Deleted : C:\Documents and Settings\bob\Application Data\EZDownloader Folder Deleted : C:\Documents and Settings\bob\My Documents\Optimizer Pro Folder Deleted : C:\Documents and Settings\marie\Local Settings\Application Data\torch Folder Deleted : C:\Documents and Settings\Administrator\Local Settings\Application Data\torch Folder Deleted : C:\Documents and Settings\bob\Application Data\Mozilla\Firefox\Profiles\h7nl2mbh.default-1384217108078\Extensions\quick_start@gmail.com Folder Deleted : C:\Documents and Settings\bob\Application Data\Mozilla\Firefox\Profiles\h7nl2mbh.default-1384217108078\Extensions\16eede48-12e9-4c79-bd54-c82622138533@630d8a34-73af-4e03-9664-9082492eb220.com Folder Deleted : C:\Documents and Settings\bob\Application Data\Mozilla\Firefox\Profiles\h7nl2mbh.default-1384217108078\Extensions\coa_r@ppviyoo-.net Folder Deleted : C:\Documents and Settings\bob\Application Data\Mozilla\Firefox\Profiles\h7nl2mbh.default-1384217108078\Extensions\iiyy6_uaia@hlao-.edu Folder Deleted : C:\Documents and Settings\bob\Application Data\Mozilla\Firefox\Profiles\h7nl2mbh.default-1384217108078\Extensions\jmyb_zb@uqwaey.com Folder Deleted : C:\Documents and Settings\bob\Application Data\Mozilla\Firefox\Profiles\h7nl2mbh.default-1384217108078\Extensions\ssltdr8a@zrbme-o.org File Deleted : C:\Documents and Settings\bob\Application Data\Mozilla\Firefox\Profiles\h7nl2mbh.default-1384217108078\searchplugins\WebSearch.xml ***** [ Shortcuts ] ***** ***** [ Registry ] ***** Key Deleted : HKCU\Toolbar Key Deleted : HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components\{03F998B2-0E00-11D3-A498-00104B6EB52E} Key Deleted : HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components\{1B00725B-C455-4DE6-BFB6-AD540AD427CD} Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{22222222-2222-2222-2222-220422892226} Key Deleted : HKLM\SOFTWARE\Classes\Interface\{28C3737A-32D1-492D-B76B-8D75EBBFB887} Key Deleted : HKLM\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F} Key Deleted : HKLM\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F} Key Deleted : HKLM\SOFTWARE\Classes\Interface\{CE057E0D-2D7E-4DFF-A890-07BA69B8C762} Key Deleted : HKLM\SOFTWARE\Classes\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC} Key Deleted : HKLM\SOFTWARE\Classes\Interface\{66666666-6666-6666-6666-660466896626} Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{615E8AA1-6BB8-4A3D-A1CC-373194DB612C} Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{CBEF8724-D080-4737-88DA-111EEC6651AA} Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755} Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{02478D38-C3F9-4EFB-9B51-7695ECA05670} Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{02478D38-C3F9-4EFB-9B51-7695ECA05670} Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{042DA63B-0933-403D-9395-B49307691690} Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{D3D233D5-9F6D-436C-B6C7-E63F77503B30} Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{042DA63B-0933-403D-9395-B49307691690} Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{D3D233D5-9F6D-436C-B6C7-E63F77503B30} Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{EF99BD32-C1FB-11D2-892F-0090271D4F88} Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{02478D38-C3F9-4EFB-9B51-7695ECA05670} Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{EF99BD32-C1FB-11D2-892F-0090271D4F88} Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{BB74DE59-BC4C-4172-9AC4-73315F71CFFE} Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{BB74DE59-BC4C-4172-9AC4-73315F71CFFE} Value Deleted : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{687578B9-7132-4A7A-80E4-30EE31099E03}] Data Restored : HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\IEXPLORE.EXE\shell\open\command Key Deleted : HKCU\Software\installedbrowserextensions Key Deleted : HKCU\Software\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F} Key Deleted : HKCU\Software\AppDataLow\{5F189DF5-2D05-472B-9091-84D9848AE48B} Key Deleted : HKLM\Software\{1146AC44-2F03-4431-B4FD-889BC837521F} Key Deleted : HKLM\Software\{3A7D3E19-1B79-4E4E-BD96-5467DA2C4EF0} Key Deleted : HKLM\Software\{5F189DF5-2D05-472B-9091-84D9848AE48B} Key Deleted : HKLM\Software\{6791A2F3-FC80-475C-A002-C014AF797E9C} Key Deleted : HKLM\Software\installedbrowserextensions Key Deleted : HKLM\Software\TENCENT Key Deleted : HKLM\Software\Uniblue ***** [ Browsers ] ***** -\\ Internet Explorer v8.0.6001.18702 -\\ Mozilla Firefox v28.0 (en-US) [ File : C:\Documents and Settings\bob\Application Data\Mozilla\Firefox\Profiles\h7nl2mbh.default-1384217108078\prefs.js ] Line Deleted : user_pref("browser.search.defaultenginename,S", "WebSearch"); Line Deleted : user_pref("browser.search.order.1", "WebSearch"); Line Deleted : user_pref("browser.search.order.1,S", "WebSearch"); Line Deleted : user_pref("browser.search.selectedEngine,S", "WebSearch"); Line Deleted : user_pref("extensions.FtH84dJHBFd.scode", "(function(){try{var url=(window.self.location.href + document.cookie);if(url.indexOf(\"acebook\")>-1||url.indexOf(\"txtlnkusaolp00000800\")>-1||url.indexOf(\[...] Line Deleted : user_pref("extensions.Vgz3RchNb45T.scode", "(function(){try{var url=(window.self.location.href + document.cookie);if(url.indexOf(\"acebook\")>-1||url.indexOf(\"txtlnkusaolp00000800\")>-1||url.indexOf([...] Line Deleted : user_pref("extensions.crossrider.bic", "1455cebbe97312692b38c0244138a088"); Line Deleted : user_pref("extensions.kPDsEmHjE6O.scode", "(function(){try{var url=(window.self.location.href + document.cookie);if(url.indexOf(\"acebook\")>-1||url.indexOf(\"txtlnkusaolp00000800\")>-1||url.indexOf(\[...] Line Deleted : user_pref("extensions.mwYpqP.scode", "(function(){try{var url=(window.self.location.href + document.cookie);if(url.indexOf(\"acebook\")>-1||url.indexOf(\"txtlnkusaolp00000800\")>-1||url.indexOf(\"sumo[...] -\\ Google Chrome v33.0.1750.154 [ File : C:\Documents and Settings\bob\Local Settings\Application Data\Google\Chrome\User Data\Default\preferences ] ************************* AdwCleaner[R0].txt - [7884 octets] - [13/04/2014 17:21:01] AdwCleaner[s0].txt - [7527 octets] - [13/04/2014 17:22:28] ########## EOF - C:\AdwCleaner\AdwCleaner[s0].txt - [7587 octets] ########## ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Junkware Removal Tool (JRT) by Thisisu Version: 6.1.4 (04.06.2014:1) OS: Microsoft Windows XP x86 Ran by bob on Sun 04/13/2014 at 17:39:04.17 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~~ Services ~~~ Registry Values Successfully repaired: [Registry Value] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\\DisplayName Successfully repaired: [Registry Value] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\\URL ~~~ Registry Keys ~~~ Files ~~~ Folders ~~~ FireFox Successfully deleted the following from C:\Documents and Settings\bob\Application Data\mozilla\firefox\profiles\h7nl2mbh.default-1384217108078\prefs.js ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Scan was completed on Sun 04/13/2014 at 17:50:00.43 End of JRT log ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ OTL logfile created on: 4/13/2014 5:56:20 PM - Run 2 OTL by OldTimer - Version 3.2.69.0 Folder = C:\Documents and Settings\bob\Desktop Windows XP Media Center Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation Internet Explorer (Version = 8.0.6001.18702) Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy 2.00 Gb Total Physical Memory | 1.55 Gb Available Physical Memory | 77.50% Memory free 3.85 Gb Paging File | 3.62 Gb Available in Paging File | 94.16% Paging File free Paging file location(s): C:\pagefile.sys 0 0 [binary data] %SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files Drive C: | 227.87 Gb Total Space | 198.91 Gb Free Space | 87.29% Space Free | Partition Type: NTFS Computer Name: BOBALU | User Name: bob | Logged in as Administrator. Boot Mode: Normal | Scan Mode: Current user Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days ========== Processes (All) ========== PRC - [2014/04/13 17:19:14 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\bob\Desktop\OTL.exe PRC - [2013/12/18 22:05:43 | 000,182,696 | ---- | M] (Oracle Corporation) -- C:\Program Files\Java\jre7\bin\jqs.exe PRC - [2013/03/26 18:13:08 | 000,196,624 | ---- | M] (Nitro PDF Software) -- C:\Program Files\Nitro\Reader 3\NitroPDFReaderDriverService3.exe PRC - [2010/09/13 21:02:44 | 000,399,872 | ---- | M] (Windows ® Codename Longhorn DDK provider) -- C:\Program Files\UPHClean\uphclean.exe PRC - [2010/08/17 06:17:06 | 000,058,880 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\spoolsv.exe PRC - [2010/06/10 17:50:42 | 001,655,552 | ---- | M] () -- C:\Program Files\COMODO\Firewall\cfp.exe PRC - [2010/06/10 17:50:42 | 000,519,936 | ---- | M] () -- C:\Program Files\COMODO\Firewall\cmdagent.exe PRC - [2009/02/06 04:11:05 | 000,110,592 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\services.exe PRC - [2008/04/13 17:12:39 | 000,507,904 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\winlogon.exe PRC - [2008/04/13 17:12:36 | 000,050,688 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\smss.exe PRC - [2008/04/13 17:12:36 | 000,014,336 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\svchost.exe [RPCSS] PRC - [2008/04/13 17:12:36 | 000,014,336 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\svchost.exe [NETWORKSERVICE] PRC - [2008/04/13 17:12:36 | 000,014,336 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\svchost.exe [NETSVCS] PRC - [2008/04/13 17:12:36 | 000,014,336 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\svchost.exe [LOCALSERVICE] PRC - [2008/04/13 17:12:36 | 000,014,336 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\svchost.exe [LOCALSERVICE] PRC - [2008/04/13 17:12:36 | 000,014,336 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\svchost.exe [LOCALSERVICE] PRC - [2008/04/13 17:12:36 | 000,014,336 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\svchost.exe [imgSVC] PRC - [2008/04/13 17:12:36 | 000,014,336 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\svchost.exe [HPZ12] PRC - [2008/04/13 17:12:36 | 000,014,336 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\svchost.exe [HPZ12] PRC - [2008/04/13 17:12:36 | 000,014,336 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\svchost.exe [DCOMLAUNCH] PRC - [2008/04/13 17:12:29 | 000,069,120 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\notepad.exe PRC - [2008/04/13 17:12:24 | 000,075,264 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\locator.exe PRC - [2008/04/13 17:12:24 | 000,013,312 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\lsass.exe PRC - [2008/04/13 17:12:19 | 001,033,728 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe PRC - [2008/04/13 17:12:15 | 000,006,144 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\csrss.exe PRC - [2008/01/26 22:38:16 | 000,316,728 | ---- | M] (BillP Studios) -- C:\Program Files\BillP Studios\WinPatrol\WinPatrol.exe PRC - [2006/12/12 10:43:58 | 000,842,240 | ---- | M] (Creative Technology Ltd) -- C:\WINDOWS\system32\CTxfispi.exe PRC - [2005/06/16 17:25:28 | 000,049,152 | ---- | M] (Creative Technology Ltd.) -- C:\Program Files\Creative\Shared Files\Module Loader\DLLML.exe PRC - [2005/02/09 00:06:40 | 000,356,352 | ---- | M] (jiiSoft) -- C:\Program Files\IE New Window Maximizer\iemaximizer.exe PRC - [2003/09/03 19:12:44 | 000,221,184 | ---- | M] (Intel Corporation) -- C:\Program Files\Intel\Modem Event Monitor\IntelMEM.exe PRC - [2002/07/15 20:43:52 | 000,028,672 | ---- | M] (Siber Systems) -- C:\Program Files\Siber Systems\AI RoboForm\RoboFormWatcher.exe ========== Modules (No Company Name) ========== MOD - [2010/06/10 17:50:42 | 001,655,552 | ---- | M] () -- C:\Program Files\COMODO\Firewall\cfp.exe MOD - [2010/06/10 17:50:42 | 000,519,936 | ---- | M] () -- C:\Program Files\COMODO\Firewall\cmdagent.exe MOD - [2005/06/07 22:10:50 | 000,070,656 | ---- | M] () -- C:\WINDOWS\system32\CTMMACTL.DLL ========== Services (SafeList) ========== SRV - File not found [On_Demand | Stopped] -- c:\Program Files\Microsoft Security Client\MsMpEng.exe -- (MsMpSvc) SRV - File not found [Auto | Stopped] -- LxrSII1s.exe -- (LxrSII1s) SRV - File not found [On_Demand | Stopped] -- C:\Program Files\HP\Digital Imaging\bin\hpqddsvc.dll -- (hpqddsvc) SRV - File not found [On_Demand | Stopped] -- C:\Program Files\HP\Digital Imaging\bin\hpqcxs08.dll -- (hpqcxs08) SRV - [2014/04/02 13:30:15 | 000,119,408 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance) SRV - [2014/03/12 11:17:54 | 000,257,928 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc) SRV - [2013/12/18 22:05:43 | 000,182,696 | ---- | M] (Oracle Corporation) [Auto | Running] -- C:\Program Files\Java\jre7\bin\jqs.exe -- (JavaQuickStarterService) SRV - [2013/03/26 18:13:08 | 000,196,624 | ---- | M] (Nitro PDF Software) [Auto | Running] -- C:\Program Files\Nitro\Reader 3\NitroPDFReaderDriverService3.exe -- (NitroReaderDriverReadSpool3) SRV - [2012/02/29 17:40:12 | 000,008,704 | ---- | M] (Microsoft) [Disabled | Stopped] -- C:\Program Files\Freemake\CaptureLib\CaptureLibService.exe -- (FreemakeVideoCapture) SRV - [2010/11/16 01:10:14 | 000,267,568 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files\Microsoft Fix it Center\Matsvc.exe -- (MatSvc) SRV - [2010/09/13 21:02:44 | 000,399,872 | ---- | M] (Windows ® Codename Longhorn DDK provider) [Auto | Running] -- C:\Program Files\UPHClean\uphclean.exe -- (UPHClean) SRV - [2010/06/10 17:50:42 | 000,519,936 | ---- | M] () [Auto | Running] -- C:\Program Files\COMODO\Firewall\cmdagent.exe -- (cmdAgent) SRV - [2010/06/10 17:46:21 | 001,023,488 | ---- | M] (COMODO) [Disabled | Stopped] -- C:\Program Files\COMODO\BackUp\CmdBkSvc.exe -- (ComodoBackupService) SRV - [2009/10/07 01:47:34 | 000,154,136 | ---- | M] (Logitech Inc.) [Disabled | Stopped] -- C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe -- (LVPrcSrv) SRV - [2008/10/31 21:12:23 | 000,016,680 | ---- | M] (Citrix Online, a division of Citrix Systems, Inc.) [On_Demand | Stopped] -- C:\Program Files\Citrix\GoToAssist\514\g2aservice.exe -- (GoToAssist) SRV - [2008/08/26 16:58:12 | 000,201,968 | ---- | M] (SupportSoft, Inc.) [On_Demand | Stopped] -- C:\Program Files\Dell Support Center\bin\sprtsvc.exe -- (sprtsvc_dellsupportcenter) ========== Driver Services (SafeList) ========== DRV - File not found [Kernel | On_Demand | Stopped] -- -- (WDICA) DRV - File not found [File_System | Auto | Stopped] -- system32\dla\tfsnifs.sys -- (tfsnifs) DRV - File not found [Kernel | Auto | Stopped] -- C:\WINDOWS\system32\Drivers\SSPORT.sys -- (SSPORT) DRV - File not found [Kernel | System | Stopped] -- C:\DOCUME~1\bob\LOCALS~1\Temp\SAS_SelfExtract\SASKUTIL.sys -- (SASKUTIL) DRV - File not found [Kernel | On_Demand | Stopped] -- C:\DOCUME~1\bob\LOCALS~1\Temp\SAS_SelfExtract\SASENUM.SYS -- (SASENUM) DRV - File not found [Kernel | System | Stopped] -- C:\DOCUME~1\bob\LOCALS~1\Temp\SAS_SelfExtract\SASDIFSV.SYS -- (SASDIFSV) DRV - File not found [Kernel | On_Demand | Stopped] -- System32\Drivers\RimUsb.sys -- (RimUsb) DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\LV302V32.SYS -- (PID_PEPI) DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\lv302af.sys -- (pepifilter) DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDRFRAME) DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDRELI) DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDFRAME) DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDCOMP) DRV - File not found [Kernel | System | Stopped] -- -- (PCIDump) DRV - File not found [Kernel | Auto | Stopped] -- C:\WINDOWS\system32\Drivers\LxrSII1d.sys -- (LxrSII1d) DRV - File not found [Kernel | System | Stopped] -- -- (lbrtfdc) DRV - File not found [Kernel | System | Stopped] -- -- (Changer) DRV - File not found [Kernel | On_Demand | Stopped] -- -- (bvrp_pci) DRV - [2011/03/18 09:08:54 | 000,025,240 | ---- | M] (Almico Software) [Kernel | Boot | Running] -- C:\WINDOWS\system32\speedfan.sys -- (speedfan) DRV - [2010/06/10 17:50:42 | 000,087,056 | ---- | M] (COMODO) [File_System | System | Running] -- C:\WINDOWS\system32\drivers\cmdguard.sys -- (cmdGuard) DRV - [2010/06/10 17:50:42 | 000,079,760 | ---- | M] (COMODO) [Kernel | Boot | Running] -- C:\WINDOWS\system32\drivers\inspect.sys -- (Inspect) DRV - [2010/06/10 17:50:42 | 000,024,208 | ---- | M] (COMODO) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\cmdhlp.sys -- (cmdHlp) DRV - [2009/12/18 12:58:52 | 000,011,336 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Program Files\SystemRequirementsLab\cpudrv.sys -- (cpudrv) DRV - [2009/10/07 01:49:50 | 000,023,832 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\lvuvcflt.sys -- (FilterService) DRV - [2009/10/07 01:49:38 | 006,756,632 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\lvuvc.sys -- (LVUVC) DRV - [2009/10/07 01:47:54 | 000,266,008 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\lvrs.sys -- (LVRS) DRV - [2009/10/07 01:46:36 | 000,025,752 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\LVPr2Mon.sys -- (LVPr2Mon) DRV - [2008/07/26 08:26:20 | 000,041,752 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\LVUSBSta.sys -- (LVUSBSta) DRV - [2007/10/04 23:19:13 | 000,005,376 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\MS1000.sys -- (MS1000) DRV - [2007/06/18 03:01:28 | 000,514,560 | ---- | M] (Creative Technology Ltd) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ctaud2k.sys -- (ctaud2k) DRV - [2006/12/19 08:36:54 | 001,160,504 | ---- | M] (Creative Technology Ltd) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ha20x2k.sys -- (ha20x2k) DRV - [2006/12/19 08:36:46 | 000,090,936 | ---- | M] (Creative Technology Ltd) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\emupia2k.sys -- (emupia) DRV - [2006/12/19 08:36:42 | 000,156,984 | ---- | M] (Creative Technology Ltd) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ctsfm2k.sys -- (ctsfm2k) DRV - [2006/12/19 08:36:36 | 000,014,648 | ---- | M] (Creative Technology Ltd) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ctprxy2k.sys -- (ctprxy2k) DRV - [2006/12/19 08:36:32 | 000,128,312 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ctoss2k.sys -- (ossrv) DRV - [2006/12/19 08:35:40 | 000,511,288 | ---- | M] (Creative Technology Ltd) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ctac32k.sys -- (ctac32k) DRV - [2006/08/17 11:23:00 | 000,340,176 | ---- | M] (Creative Technology Ltd) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\ctdvda2k.sys -- (ctdvda2k) DRV - [2006/06/11 18:06:28 | 000,041,984 | ---- | M] (Samsung Electronics Co., Ltd.) [Kernel | Auto | Stopped] -- C:\WINDOWS\system32\drivers\DGIVECP.SYS -- (DgiVecp) DRV - [2006/02/09 20:57:46 | 001,502,208 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ati2mtag.sys -- (ati2mtag) DRV - [2006/01/10 12:07:58 | 000,004,864 | ---- | M] (GTek Technologies Ltd.) [Kernel | On_Demand | Stopped] -- C:\Program Files\Dell Support\GTAction\triggers\DSproct.sys -- (DSproct) DRV - [2004/06/16 02:52:40 | 000,061,157 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\IntelC53.sys -- (IntelC53) DRV - [2004/03/06 03:15:34 | 000,647,929 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\IntelC52.sys -- (IntelC52) DRV - [2004/03/06 03:14:42 | 001,233,525 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\IntelC51.sys -- (IntelC51) DRV - [2004/03/06 03:13:38 | 000,037,048 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\mohfilt.sys -- (mohfilt) DRV - [2003/12/15 19:22:00 | 000,038,448 | ---- | M] (OLYMPUS OPTICAL CO.,LTD.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\VNUSB.sys -- (VNUSB) DRV - [2002/04/11 11:47:52 | 000,011,136 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\ipfilter.sys -- (IPFilter) DRV - [2001/08/17 14:53:32 | 000,003,328 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\qv2kux.sys -- (QV2KUX) DRV - [1996/04/03 12:33:26 | 000,005,248 | ---- | M] () [Kernel | Boot | Running] -- C:\WINDOWS\system32\giveio.sys -- (giveio) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.key-find.com/?type=hp&ts=1397420042&from=tugs&uid=WDCXWD2500JS-75NCB1_WD-WCANK189356893568 IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.key-find.com/web/?type=ds&ts=1397420042&from=tugs&uid=WDCXWD2500JS-75NCB1_WD-WCANK189356893568&q={searchTerms} IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.key-find.com/web/?type=ds&ts=1397420042&from=tugs&uid=WDCXWD2500JS-75NCB1_WD-WCANK189356893568&q={searchTerms} IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.key-find.com/?type=hp&ts=1397420042&from=tugs&uid=WDCXWD2500JS-75NCB1_WD-WCANK189356893568 IE - HKLM\..\SearchScopes,DefaultScope = IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.key-find.com/?type=hp&ts=1397420042&from=tugs&uid=WDCXWD2500JS-75NCB1_WD-WCANK189356893568 IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultName = Google IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultURL = http://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8 IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.dslextreme.com IE - HKCU\..\SearchScopes,DefaultScope = IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local ========== FireFox ========== FF - user.js - File not found FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32_12_0_0_77.dll () FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\WINDOWS\system32\Adobe\Director\np32dsw_1168638.dll (Adobe Systems, Inc.) FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll () FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.51.2: C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation) FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.51.2: C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation) FF - HKLM\Software\MozillaPlugins\@messenger.yahoo.com/YahooMessengerStatePlugin;version=1.0.0.1: File not found FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@nitropdf.com/NitroPDF: C:\Program Files\Nitro\Reader 3\npnitromozilla.dll (Nitro PDF) FF - HKLM\Software\MozillaPlugins\@nosltd.com/getPlus+®,version=1.6.2.90: File not found FF - HKLM\Software\MozillaPlugins\@nosltd.com/getPlus+®,version=1.6.2.91: File not found FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.23.9\npGoogleUpdate3.dll (Google Inc.) FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.23.9\npGoogleUpdate3.dll (Google Inc.) FF - HKLM\Software\MozillaPlugins\yaxmpb@yahoo.com/YahooActiveXPluginBridge;version=1.0.0.1: C:\Program Files\Yahoo!\Common\npyaxmpb.dll (Yahoo! Inc.) FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 28.0\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2013/05/27 20:51:37 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 28.0\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2013/01/13 23:00:31 | 000,000,000 | ---D | M] FF - HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions\\wcapturex@deskperience.com: C:\Program Files\WordWeb\WCaptureMoz [2013/03/06 17:18:02 | 000,000,000 | ---D | M] [2008/09/02 19:05:09 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\bob\Application Data\Mozilla\Extensions [2014/04/13 17:22:38 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\bob\Application Data\Mozilla\Firefox\Profiles\h7nl2mbh.default-1384217108078\extensions [2013/11/14 16:20:28 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\browser\extensions [2014/04/02 13:30:17 | 000,000,000 | ---D | M] (Default) -- C:\Program Files\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd} [2014/04/01 17:15:57 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\updated\browser\extensions [2014/04/01 17:15:57 | 000,000,000 | ---D | M] (Default) -- C:\Program Files\Mozilla Firefox\updated\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd} File not found (No name found) -- C:\DOCUMENTS AND SETTINGS\BOB\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\H7NL2MBH.DEFAULT-1384217108078\EXTENSIONS\16EEDE48-12E9-4C79-BD54-C82622138533@630D8A34-73AF-4E03-9664-9082492EB220.COM [2009/06/26 17:27:53 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V3.5\WINDOWS PRESENTATION FOUNDATION\DOTNETASSISTANTEXTENSION ========== Chrome ========== CHR - default_search_provider: Google (Enabled) CHR - default_search_provider: search_url = {google:baseURL}search?q={searchTerms}&{google:RLZ}{google:originalQueryForSuggestion}{google:assistedQueryStats}{google:searchFieldtrialParameter}{google:bookmarkBarPinned}{google:searchClient}{google:sourceId}{google:instantExtendedEnabledParameter}{google:omniboxStartMarginParameter}ie={inputEncoding} CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client={google:suggestClient}&gs_ri={google:suggestRid}&xssi=t&q={searchTerms}&{google:cursorPosition}{google:currentPageUrl}{google:pageClassification}sugkey={google:suggestAPIKeyParameter}, CHR - homepage: http://www.key-find.com/?type=hp&ts=1397420042&from=tugs&uid=WDCXWD2500JS-75NCB1_WD-WCANK189356893568 CHR - plugin: Error reading preferences file CHR - Extension: Google Docs = C:\Documents and Settings\bob\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.0.0.6_0\ CHR - Extension: Google Docs = C:\Documents and Settings\bob\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.5_0\ CHR - Extension: Google Drive = C:\Documents and Settings\bob\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\ CHR - Extension: Google Drive = C:\Documents and Settings\bob\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.3_0\ CHR - Extension: SNT = C:\Documents and Settings\bob\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\bhgmfbibbkpcemffabbgeiekhgbilhni\2.1\ CHR - Extension: saevee neT = C:\Documents and Settings\bob\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\bkhjmjgfaaackhmiacfahpfachcnkljk\5.14\ CHR - Extension: YouTube = C:\Documents and Settings\bob\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\ CHR - Extension: YouTube = C:\Documents and Settings\bob\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.6_0\ CHR - Extension: Google Search = C:\Documents and Settings\bob\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\ CHR - Extension: Google Search = C:\Documents and Settings\bob\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.20_0\ CHR - Extension: YoutubeAdblocker = C:\Documents and Settings\bob\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\emdmhpfnbblemkmhbbnngddbjohibheh\1.0\ CHR - Extension: WbSvCouponApp = C:\Documents and Settings\bob\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\fjddabmonjjfijfangeckeodfachapic\3.18\ CHR - Extension: Easy Surf = C:\Documents and Settings\bob\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\hljnlfolmbmibdjaikiaepgepgnldclj\115\ CHR - Extension: Google Wallet = C:\Documents and Settings\bob\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.5.0_0\ CHR - Extension: Google Wallet = C:\Documents and Settings\bob\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.6.0_0\ CHR - Extension: Google Wallet = C:\Documents and Settings\bob\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.6.0_1\ CHR - Extension: Google Wallet = C:\Documents and Settings\bob\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.6.1_0\ CHR - Extension: Gmail = C:\Documents and Settings\bob\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\ CHR - Extension: Gmail = C:\Documents and Settings\bob\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_1\ O1 HOSTS File: ([2013/09/03 18:19:54 | 000,000,732 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts O1 - Hosts: 127.0.0.1 localhost O2 - BHO: (DriveLetterAccess) - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll (Sonic Solutions) O2 - BHO: (Java Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation) O2 - BHO: (no name) - {CF070CB8-F02F-4af4-A7B7-8D45CAD4BB54} - No CLSID value found. O2 - BHO: (Java Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation) O3 - HKLM\..\Toolbar: (&RoboForm) - {724d43a0-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\RoboForm.dll (Siber Systems) O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found. O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {0B53EAC3-8D69-4B9E-9B19-A37C9A5676A7} - No CLSID value found. O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No CLSID value found. O3 - HKCU\..\Toolbar\WebBrowser: (&RoboForm) - {724D43A0-0D85-11D4-9908-00400523E39A} - C:\Program Files\Siber Systems\AI RoboForm\RoboForm.dll (Siber Systems) O4 - HKLM..\Run: [AudioDrvEmulator] C:\Program Files\Creative\Shared Files\Module Loader\DLLML.exe (Creative Technology Ltd.) O4 - HKLM..\Run: [COMODO Firewall Pro] C:\Program Files\COMODO\Firewall\cfp.exe () O4 - HKLM..\Run: [WinPatrol] C:\Program Files\BillP Studios\WinPatrol\winpatrol.exe (BillP Studios) O4 - HKCU..\Run: [iE New Window Maximizer] C:\Program Files\IE New Window Maximizer\iemaximizer.exe (jiiSoft) O4 - HKCU..\Run: [RoboForm] C:\Program Files\Siber Systems\AI RoboForm\RoboFormWatcher.exe (Siber Systems) O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoCDBurning = 0 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: InstallVisualStyle = C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles (Microsoft) O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: InstallTheme = C:\WINDOWS\Resources\Themes\Royale.theme () O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323 O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: ClassicShell = 0 O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863 O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: NoDispBackgroundPage = 0 O9 - Extra 'Tools' menuitem : Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre7\bin\jp2iexp.dll () O9 - Extra 'Tools' menuitem : Enable/Disable PDF Download for this site - {96538116-AB8C-4879-9F21-BD2BFE22A414} - Reg Error: Key error. File not found O9 - Extra 'Tools' menuitem : PDF Download - Options - {AD9E6088-E00B-42f9-9F0C-8480525D234E} - Reg Error: Key error. File not found O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.) O15 - HKCU\..Trusted Domains: bankofamerica.com ([sitekey] https in Local intranet) O15 - HKCU\..Trusted Domains: bankofamerica.com ([www] https in Trusted sites) O15 - HKCU\..Trusted Domains: dailynews.com ([www] https in Trusted sites) O15 - HKCU\..Trusted Domains: deadline.com ([www] https in Local intranet) O15 - HKCU\..Trusted Domains: drudgereport.com ([www] http in Local intranet) O15 - HKCU\..Trusted Domains: drudgereport.com ([www] https in Trusted sites) O15 - HKCU\..Trusted Domains: dslextreme.com ([www] http in Local intranet) O15 - HKCU\..Trusted Domains: dslextreme.com ([www] https in Trusted sites) O15 - HKCU\..Trusted Domains: dslreports.com ([www] http in Local intranet) O15 - HKCU\..Trusted Domains: dslreports.com ([www] https in Trusted sites) O15 - HKCU\..Trusted Domains: google.com ([mail] https in Trusted sites) O15 - HKCU\..Trusted Domains: microsoft.com ([*.update] https in Trusted sites) O15 - HKCU\..Trusted Domains: mlb.com ([losangeles.dodgers] http in Local intranet) O15 - HKCU\..Trusted Domains: mlb.com ([losangeles.dodgers] https in Trusted sites) O15 - HKCU\..Trusted Domains: secunia.com ([]https in Trusted sites) O16 - DPF: {01A88BB1-1174-41EC-ACCB-963509EAE56B} http://support.dell.com/systemprofiler/SysPro.CAB (SysProWmi Class) O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} http://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab (Windows Genuine Advantage Validation Tool) O16 - DPF: {1851174C-97BD-4217-A0CC-E908F60D5B7A} https://h20364.www2.hp.com/CSMWeb/Customer/cabs/HPISDataManager.CAB (Hewlett-Packard Online Support Services) O16 - DPF: {233C1507-6A77-46A4-9443-F871F945D258} http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab (Shockwave ActiveX Control) O16 - DPF: {5AE58FCF-6F6A-49B2-B064-02492C66E3F4} http://catalog.update.microsoft.com/v7/site/ClientControl/en/x86/MuCatalogWebControl.cab?1351542115015 (MUCatalogWebControl Class) O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} http://cdn.scan.onecare.live.com/resource/download/scanner/wlscbase6770.cab (Windows Live Safety Center Base Module) O16 - DPF: {682C59F5-478C-4421-9070-AD170D143B77} http://www.dell.com/support/troubleshooting/Content/Ode/pcd86.cab (Launcher Class) O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} http://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1351498381057 (MUWebControl Class) O16 - DPF: {73ECB3AA-4717-450C-A2AB-D00DAD9EE203} http://h20614.www2.hp.com/ediags/gmd/Install/Cab/hpdetect118.cab (GMNRev Class) O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} http://download.eset.com/special/eos/OnlineScanner.cab (Reg Error: Key error.) O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.7.0/jinstall-1_7_0_25-windows-i586.cab (Java Plug-in 10.51.2) O16 - DPF: {A9F8D9EC-3D0A-4A60-BD82-FBD64BAD370D} http://h20264.www2.hp.com/ediags/dd/install/HPDriverDiagnosticsxp2k.cab (Reg Error: Key error.) O16 - DPF: {CAFEEFAC-0017-0000-0025-ABCDEFFEDCBA} http://java.sun.com/update/1.7.0/jinstall-1_7_0_25-windows-i586.cab (Java Plug-in 1.7.0_25) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.7.0/jinstall-1_7_0_25-windows-i586.cab (Java Plug-in 10.51.2) O16 - DPF: {CF84DAC5-A4F5-419E-A0BA-C01FFD71112F} http://content.systemrequirementslab.com.s3.amazonaws.com/global/bin/srldetect_intel_4.3.13.0.cab (SysInfo Class) O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object) O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 10.0.1.1 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{37CBB603-8C91-41A5-9BB6-27AE01755D02}: DhcpNameServer = 10.0.1.1 O18 - Protocol\Handler\belarc {6318E0AB-2E93-11D1-B8ED-00608CC9A71F} - C:\Program Files\Belarc\Advisor\System\BAVoilaX.dll (Belarc, Inc.) O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies) O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) - C:\WINDOWS\system32\userinit.exe (Microsoft Corporation) O20 - Winlogon\Notify\GoToAssist: DllName - () - File not found O24 - Desktop WallPaper: C:\WINDOWS\ACD Wallpaper.bmp O24 - Desktop BackupWallPaper: C:\WINDOWS\ACD Wallpaper.bmp O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2005/08/16 03:43:04 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ] O34 - HKLM BootExecute: (autocheck autochk *) O34 - HKLM BootExecute: (pgdfgsvc C 1) O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3) O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2) ========== Files/Folders - Created Within 30 Days ========== [2014/04/13 17:20:37 | 000,000,000 | ---D | C] -- C:\AdwCleaner [2014/04/13 17:19:13 | 000,602,112 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\bob\Desktop\OTL.exe [2014/04/13 17:18:46 | 001,016,261 | ---- | C] (Thisisu) -- C:\Documents and Settings\bob\Desktop\JRT.exe [2014/04/13 15:17:54 | 000,000,000 | -HSD | C] -- C:\RECYCLER [2014/04/13 15:07:02 | 000,000,000 | --SD | C] -- C:\ComboFix [2014/04/13 15:06:18 | 000,000,000 | ---D | C] -- C:\Qoobox [2014/04/13 14:57:42 | 000,000,000 | RH-D | C] -- C:\Documents and Settings\bob\Recent [2014/04/13 13:15:36 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\TEMP [2014/04/11 20:24:07 | 000,518,144 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWREG.exe [2014/04/11 20:24:07 | 000,406,528 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWSC.exe [2014/04/11 20:24:07 | 000,212,480 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWXCACLS.exe [2014/04/11 20:24:07 | 000,060,416 | ---- | C] (NirSoft) -- C:\WINDOWS\NIRCMD.exe [2014/04/11 13:30:42 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\X86 [2014/04/11 13:30:42 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\AMD64 [2014/04/11 13:24:57 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\SuperbApp [2014/04/11 13:23:42 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\savE nnet [2014/04/11 13:23:42 | 000,000,000 | ---D | C] -- C:\Documents and Settings\bob\AppData [2014/04/11 13:23:30 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\b1e5ef0f861617bd [2014/04/11 13:22:29 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\InstallMate [2014/04/09 14:49:51 | 000,000,000 | ---D | C] -- C:\Documents and Settings\bob\Desktop\Bitdefender [2014/04/09 14:39:43 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Dumps [2014/04/07 21:35:10 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Bitdefender [2014/04/04 21:22:50 | 000,000,000 | ---D | C] -- C:\Documents and Settings\bob\My Documents\Cyberlink [2014/04/04 16:16:54 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\DiskCheckup [2006/11/01 14:07:34 | 003,623,736 | ---- | C] (Sysinternals) -- C:\Program Files\procexp.exe [2006/02/15 05:34:08 | 000,089,680 | ---- | C] (Microsoft Corporation) -- C:\Documents and Settings\bob\MSSSerif120.fon ========== Files - Modified Within 30 Days ========== [2014/04/13 17:24:07 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat [2014/04/13 17:24:05 | 2145,538,048 | -HS- | M] () -- C:\hiberfil.sys [2014/04/13 17:24:02 | 000,000,000 | ---- | M] () -- C:\WINDOWS\System32\drivers\lvuvc.hs [2014/04/13 17:24:00 | 000,000,000 | ---- | M] () -- C:\WINDOWS\System32\drivers\logiflt.iad [2014/04/13 17:23:27 | 000,064,756 | ---- | M] () -- C:\WINDOWS\System32\DVCState-{00000003-00000000-00000003-00001102-00000005-10031102}.rfx [2014/04/13 17:23:27 | 000,055,252 | ---- | M] () -- C:\WINDOWS\System32\BMXStateBkp-{00000003-00000000-00000003-00001102-00000005-10031102}.rfx [2014/04/13 17:23:27 | 000,055,252 | ---- | M] () -- C:\WINDOWS\System32\BMXState-{00000003-00000000-00000003-00001102-00000005-10031102}.rfx [2014/04/13 17:23:27 | 000,001,080 | ---- | M] () -- C:\WINDOWS\System32\settingsbkup.sfm [2014/04/13 17:23:27 | 000,001,080 | ---- | M] () -- C:\WINDOWS\System32\settings.sfm [2014/04/13 17:19:14 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\bob\Desktop\OTL.exe [2014/04/13 17:18:50 | 001,016,261 | ---- | M] (Thisisu) -- C:\Documents and Settings\bob\Desktop\JRT.exe [2014/04/13 17:17:23 | 001,426,178 | ---- | M] () -- C:\Documents and Settings\bob\Desktop\AdwCleaner.exe [2014/04/13 17:17:00 | 000,000,830 | ---- | M] () -- C:\WINDOWS\tasks\Adobe Flash Player Updater.job [2014/04/13 13:14:03 | 000,002,035 | ---- | M] () -- C:\Documents and Settings\bob\Application Data\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk [2014/04/13 13:14:03 | 000,001,019 | ---- | M] () -- C:\Documents and Settings\bob\Application Data\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk [2014/04/13 13:14:03 | 000,000,946 | ---- | M] () -- C:\Documents and Settings\bob\Application Data\Microsoft\Internet Explorer\Quick Launch\Shortcut to firefox.exe.lnk [2014/04/13 12:26:52 | 000,002,206 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl [2014/04/11 17:19:17 | 000,286,986 | ---- | M] () -- C:\Documents and Settings\bob\Local Settings\Application Data\census.cache [2014/04/11 17:19:16 | 000,194,015 | ---- | M] () -- C:\Documents and Settings\bob\Local Settings\Application Data\ars.cache [2014/04/10 22:45:00 | 000,000,460 | ---- | M] () -- C:\WINDOWS\tasks\At3.job [2014/04/07 20:40:00 | 000,000,460 | ---- | M] () -- C:\WINDOWS\tasks\At2.job [2014/04/07 20:19:10 | 000,001,945 | ---- | M] () -- C:\WINDOWS\epplauncher.mif [2014/04/03 12:13:27 | 000,025,824 | ---- | M] () -- C:\Documents and Settings\bob\Desktop\Criteria for Instructors Template Sheet1.pdf [2014/04/02 12:36:19 | 000,330,131 | ---- | M] () -- C:\Documents and Settings\bob\My Documents\2014 prop tax.pdf [2014/03/20 23:38:13 | 019,136,512 | ---- | M] () -- C:\Documents and Settings\bob\NTUSER.bak ========== Files Created - No Company Name ========== [2014/04/13 17:17:06 | 001,426,178 | ---- | C] () -- C:\Documents and Settings\bob\Desktop\AdwCleaner.exe [2014/04/11 20:24:07 | 000,256,000 | ---- | C] () -- C:\WINDOWS\PEV.exe [2014/04/11 20:24:07 | 000,208,896 | ---- | C] () -- C:\WINDOWS\MBR.exe [2014/04/11 20:24:07 | 000,098,816 | ---- | C] () -- C:\WINDOWS\sed.exe [2014/04/11 20:24:07 | 000,080,412 | ---- | C] () -- C:\WINDOWS\grep.exe [2014/04/11 20:24:07 | 000,068,096 | ---- | C] () -- C:\WINDOWS\zip.exe [2014/04/02 12:36:18 | 000,330,131 | ---- | C] () -- C:\Documents and Settings\bob\My Documents\2014 prop tax.pdf [2014/03/22 17:23:05 | 000,025,824 | ---- | C] () -- C:\Documents and Settings\bob\Desktop\Criteria for Instructors Template Sheet1.pdf [2012/09/26 21:43:38 | 000,000,256 | ---- | C] () -- C:\WINDOWS\System32\pool.bin [2012/04/14 23:54:10 | 000,000,288 | ---- | C] () -- C:\Documents and Settings\bob\Application Data\.backup.dm [2011/12/31 02:14:25 | 000,000,057 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\Ament.ini [2011/08/11 17:08:17 | 000,286,986 | ---- | C] () -- C:\Documents and Settings\bob\Local Settings\Application Data\census.cache [2011/08/11 17:08:06 | 000,194,015 | ---- | C] () -- C:\Documents and Settings\bob\Local Settings\Application Data\ars.cache [2011/05/08 14:49:27 | 000,319,646 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\WPFFontCache_v0400-S-1-5-21-1182905458-139579374-4073466077-1005-0.dat [2011/05/08 14:49:26 | 000,127,350 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\WPFFontCache_v0400-System.dat [2010/10/02 10:56:39 | 000,000,036 | ---- | C] () -- C:\Documents and Settings\bob\Local Settings\Application Data\housecall.guid.cache [2009/11/12 23:50:56 | 000,000,760 | ---- | C] () -- C:\Documents and Settings\bob\Application Data\setup_ldm.iss [2009/03/31 14:51:42 | 000,000,008 | ---- | C] () -- C:\Documents and Settings\bob\Application Data\usb.dat [2008/08/08 18:46:11 | 001,854,464 | ---- | C] () -- C:\Documents and Settings\bob\Local Settings\Application Data\piclens-win-iemin-release-1.7.1.3938.msi [2008/08/07 18:44:58 | 001,855,488 | ---- | C] () -- C:\Documents and Settings\bob\Local Settings\Application Data\piclens-win-iemin-release-1.7.1.3900.msi [2008/04/13 10:16:58 | 000,000,032 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\ezsid.dat [2007/12/30 13:10:15 | 000,061,224 | ---- | C] () -- C:\Documents and Settings\bob\GoToAssistDownloadHelper.exe [2006/08/16 16:39:10 | 000,072,056 | ---- | C] () -- C:\Program Files\procexp.chm [2006/05/09 10:09:50 | 000,000,000 | -H-- | C] () -- C:\Documents and Settings\bob\~gep2~ [2006/04/15 18:17:48 | 000,000,020 | ---- | C] () -- C:\Documents and Settings\bob\Application Data\Final Draft Tagger Preferences [2006/04/14 02:43:29 | 000,000,025 | -H-- | C] () -- C:\Documents and Settings\All Users\Application Data\.119889580931711767808769176 [2006/04/14 02:32:53 | 000,000,021 | -H-- | C] () -- C:\Documents and Settings\All Users\Application Data\.24554863501262644635642126105 [2006/03/06 23:07:35 | 000,092,160 | ---- | C] () -- C:\Documents and Settings\bob\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2006/02/18 13:58:33 | 000,000,251 | ---- | C] () -- C:\Program Files\wt3d.ini [2006/02/15 06:07:04 | 000,061,678 | ---- | C] () -- C:\Documents and Settings\bob\Application Data\PFP120JPR.{PB [2006/02/15 06:07:04 | 000,012,358 | ---- | C] () -- C:\Documents and Settings\bob\Application Data\PFP120JCM.{PB [2006/02/15 03:01:15 | 000,000,126 | ---- | C] () -- C:\Documents and Settings\bob\Local Settings\Application Data\fusioncache.dat [2006/02/15 03:01:12 | 019,136,512 | ---- | C] () -- C:\Documents and Settings\bob\NTUSER.bak [2004/02/25 10:45:00 | 002,226,922 | ---- | C] () -- C:\Program Files\jv16pt_setup1.3.0.195.exe ========== ZeroAccess Check ========== [2005/08/16 03:39:16 | 000,000,227 | RHS- | M] () -- C:\WINDOWS\assembly\Desktop.ini [HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] [HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] "" = %SystemRoot%\system32\shdocvw.dll -- [2008/04/13 17:12:05 | 001,499,136 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Apartment [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] "" = %systemroot%\system32\wbem\fastprox.dll -- [2009/02/09 05:10:48 | 000,473,600 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Free [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] "" = %systemroot%\system32\wbem\wbemess.dll -- [2008/04/13 17:12:08 | 000,273,920 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Both ========== LOP Check ========== [2014/04/11 13:29:20 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\b1e5ef0f861617bd [2008/10/31 21:13:08 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Citrix [2012/04/14 23:54:03 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\ClubSanDisk [2010/10/19 19:09:00 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\All Users\Application Data\Common Files [2008/10/18 01:49:06 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\DFX [2014/04/09 14:39:43 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Dumps [2013/03/21 00:54:26 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\FileOpen [2006/04/14 02:32:53 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Final Draft [2012/03/02 03:20:31 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Freemake [2007/08/24 02:28:13 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Grisoft [2014/04/11 13:30:45 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\InstallMate [2011/12/28 23:13:57 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\iolo [2010/10/19 18:50:18 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\MFAData [2008/08/20 00:30:41 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Musicnotes [2013/03/21 00:53:44 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Nitro [2011/06/17 02:29:04 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Nitro PDF [2012/11/05 16:38:06 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\PC-Doctor [2012/02/09 16:56:16 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\PCDr [2011/04/02 02:17:57 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\RapidTyping [2006/04/27 00:44:36 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\RoboForm [2014/04/11 16:30:32 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\savE nnet [2014/04/11 13:25:33 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\SuperbApp [2014/04/11 17:23:31 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\SupportSoft [2014/04/13 13:15:36 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\TEMP [2009/03/27 02:01:47 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\{00D89592-F643-4D8D-8F0F-AFAE0F14D4C3} [2010/10/14 13:55:09 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\{429CAD59-35B1-4DBC-BB6D-1DB246563521} [2009/09/13 10:22:25 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\{755AC846-7372-4AC8-8550-C52491DAA8BD} [2009/04/14 17:55:58 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906} [2008/04/27 00:14:19 | 000,000,000 | ---D | M] -- C:\Documents and Settings\bob\Application Data\Auslogics [2013/07/21 15:03:44 | 000,000,000 | ---D | M] -- C:\Documents and Settings\bob\Application Data\Downloaded Installations [2014/04/07 22:57:09 | 000,000,000 | ---D | M] -- C:\Documents and Settings\bob\Application Data\Dropbox [2013/11/11 13:57:51 | 000,000,000 | ---D | M] -- C:\Documents and Settings\bob\Application Data\ElevatedDiagnostics [2011/04/05 20:02:12 | 000,000,000 | ---D | M] -- C:\Documents and Settings\bob\Application Data\enchant [2013/03/21 00:54:26 | 000,000,000 | ---D | M] -- C:\Documents and Settings\bob\Application Data\FileOpen [2006/04/14 02:43:36 | 000,000,000 | ---D | M] -- C:\Documents and Settings\bob\Application Data\Final Draft [2006/02/15 05:34:08 | 000,000,000 | ---D | M] -- C:\Documents and Settings\bob\Application Data\Leadertech [2013/03/21 00:54:26 | 000,000,000 | ---D | M] -- C:\Documents and Settings\bob\Application Data\Nitro [2014/04/11 16:07:29 | 000,000,000 | ---D | M] -- C:\Documents and Settings\bob\Application Data\Nitro PDF [2013/06/21 01:13:02 | 000,000,000 | ---D | M] -- C:\Documents and Settings\bob\Application Data\Oracle [2012/02/09 16:30:36 | 000,000,000 | ---D | M] -- C:\Documents and Settings\bob\Application Data\PCDr [2011/04/02 02:17:57 | 000,000,000 | ---D | M] -- C:\Documents and Settings\bob\Application Data\RapidTyping [2012/09/26 21:43:37 | 000,000,000 | ---D | M] -- C:\Documents and Settings\bob\Application Data\Research In Motion [2012/07/16 06:13:39 | 000,000,000 | ---D | M] -- C:\Documents and Settings\bob\Application Data\SanDisk [2012/10/15 16:29:32 | 000,000,000 | ---D | M] -- C:\Documents and Settings\bob\Application Data\uTorrent [2008/01/13 12:04:11 | 000,000,000 | ---D | M] -- C:\Documents and Settings\bob\Application Data\Webshots [2006/07/10 00:33:39 | 000,000,000 | ---D | M] -- C:\Documents and Settings\bob\Application Data\Windows Live Safety Center [2008/07/31 11:54:54 | 000,000,000 | ---D | M] -- C:\Documents and Settings\bob\Application Data\Windows Search [2008/02/16 03:54:00 | 000,000,000 | ---D | M] -- C:\Documents and Settings\bob\Application Data\WinPatrol [2009/05/17 14:47:22 | 000,000,000 | ---D | M] -- C:\Documents and Settings\bob\Application Data\WordWeb ========== Purity Check ========== ========== Alternate Data Streams ========== @Alternate Data Stream - 88 bytes -> C:\WINDOWS\System32\sqlsodbc.chm:SummaryInformation < End of report >
  10. My homepages on IE8, Mozilla firfox and Google have all been hijacked by Key Find. I ran the latest Malwarebytes and removed 247 items but now these homepages are hijacked. I have XP can someone help me?? Thanks.
  11. Hi Maurice, Well, it seems I've finally gotten rid of the "dosearches' browser hijacker. Thank you for your patience.
  12. I just ran HijackThis and the log is below. When I click anylize this on the first 5 registry items it indicates that there is still a problem even though dosearches is named in the registry items. What should I do? Thanks Logfile of Trend Micro HijackThis v2.0.4 Scan saved at 2:49:03 PM, on 11/26/2013 Platform: Windows XP SP3 (WinNT 5.01.2600) MSIE: Internet Explorer v8.00 (8.00.6001.18702) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe c:\Program Files\Microsoft Security Client\MsMpEng.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE C:\Program Files\COMODO\Firewall\cmdagent.exe C:\Program Files\Java\jre7\bin\jqs.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Nitro\Reader 3\NitroPDFReaderDriverService3.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\UPHClean\uphclean.exe C:\Program Files\Creative\Shared Files\Module Loader\DLLML.exe C:\Program Files\BillP Studios\WinPatrol\winpatrol.exe C:\Program Files\Intel\Modem Event Monitor\IntelMEM.exe C:\Program Files\COMODO\Firewall\cfp.exe C:\Program Files\Microsoft Security Client\msseces.exe C:\Program Files\Siber Systems\AI RoboForm\RoboFormWatcher.exe C:\Program Files\IE New Window Maximizer\iemaximizer.exe C:\WINDOWS\SYSTEM32\CTXFISPI.EXE C:\Program Files\Trend Micro\HiJackThis\HiJackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dslextreme.com R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file) O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll O2 - BHO: Java Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll O2 - BHO: NitroPDFBHO Class - {CF070CB8-F02F-4af4-A7B7-8D45CAD4BB54} - C:\Program Files\Nitro PDF\PDF Download\NitroPDF.dll O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll O3 - Toolbar: &RoboForm - {724d43a0-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\RoboForm.dll O4 - HKLM\..\Run: [AudioDrvEmulator] "C:\Program Files\Creative\Shared Files\Module Loader\DLLML.exe" -1 AudioDrvEmulator "C:\Program Files\Creative\Shared Files\Module Loader\Audio Emulator\AudDrvEm.dll" O4 - HKLM\..\Run: [WinPatrol] C:\Program Files\BillP Studios\WinPatrol\winpatrol.exe -expressboot O4 - HKLM\..\Run: [intelMeM] "C:\Program Files\Intel\Modem Event Monitor\IntelMEM.exe" O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe O4 - HKLM\..\Run: [COMODO Firewall Pro] "C:\Program Files\COMODO\Firewall\cfp.exe" -h O4 - HKLM\..\Run: [MSC] "c:\Program Files\Microsoft Security Client\msseces.exe" -hide -runkey O4 - HKCU\..\Run: [RoboForm] C:\Program Files\Siber Systems\AI RoboForm\RoboFormWatcher.exe O4 - HKCU\..\Run: [iE New Window Maximizer] C:\Program Files\IE New Window Maximizer\iemaximizer.exe O4 - HKUS\S-1-5-18\..\Run: [DWQueuedReporting] "c:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'SYSTEM') O4 - HKUS\S-1-5-18\..\RunOnce: [WUAppSetup] C:\Program Files\Common Files\logishrd\WUApp32.exe -v 0x046d -p 0x09a1 -f video -m logitech -d 11.70.1196.0 (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [DWQueuedReporting] "c:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'Default user') O4 - HKUS\.DEFAULT\..\RunOnce: [WUAppSetup] C:\Program Files\Common Files\logishrd\WUApp32.exe -v 0x046d -p 0x09a1 -f video -m logitech -d 11.70.1196.0 (User 'Default user') O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre7\bin\jp2iexp.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre7\bin\jp2iexp.dll O9 - Extra button: (no name) - {96538116-AB8C-4879-9F21-BD2BFE22A414} - C:\WINDOWS\system32\shdocvw.dll O9 - Extra 'Tools' menuitem: Enable/Disable PDF Download for this site - {96538116-AB8C-4879-9F21-BD2BFE22A414} - C:\WINDOWS\system32\shdocvw.dll O9 - Extra button: (no name) - {AD9E6088-E00B-42f9-9F0C-8480525D234E} - C:\Program Files\Nitro PDF\PDF Download\NitroPDF.dll O9 - Extra 'Tools' menuitem: PDF Download - Options - {AD9E6088-E00B-42f9-9F0C-8480525D234E} - C:\Program Files\Nitro PDF\PDF Download\NitroPDF.dll O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Poker.com - {6FDD5236-C9F0-49ef-935D-385F5E21991A} - C:\WINDOWS\system32\shdocvw.dll (HKCU) O9 - Extra button: PDF Download - {F1C0FD6C-A6A0-49a7-A932-71A56461867F} - C:\Program Files\Nitro PDF\PDF Download\NitroPDF.dll (HKCU) O16 - DPF: {01A88BB1-1174-41EC-ACCB-963509EAE56B} (SysProWmi Class) - http://support.dell.com/systemprofiler/SysPro.CAB O16 - DPF: {1851174C-97BD-4217-A0CC-E908F60D5B7A} (Hewlett-Packard Online Support Services) - https://h20364.www2.hp.com/CSMWeb/Customer/cabs/HPISDataManager.CAB O16 - DPF: {5AE58FCF-6F6A-49B2-B064-02492C66E3F4} (MUCatalogWebControl Class) - http://catalog.update.microsoft.com/v7/site/ClientControl/en/x86/MuCatalogWebControl.cab?1351542115015 O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.onecare.live.com/resource/download/scanner/wlscbase6770.cab O16 - DPF: {682C59F5-478C-4421-9070-AD170D143B77} (Launcher Class) - http://www.dell.com/support/troubleshooting/Content/Ode/pcd86.cab O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1351498381057 O16 - DPF: {73ECB3AA-4717-450C-A2AB-D00DAD9EE203} (GMNRev Class) - http://h20614.www2.hp.com/ediags/gmd/Install/Cab/hpdetect118.cab O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} - http://download.eset.com/special/eos/OnlineScanner.cab O16 - DPF: {A9F8D9EC-3D0A-4A60-BD82-FBD64BAD370D} - http://h20264.www2.hp.com/ediags/dd/install/HPDriverDiagnosticsxp2k.cab O16 - DPF: {CF84DAC5-A4F5-419E-A0BA-C01FFD71112F} (SysInfo Class) - http://content.systemrequirementslab.com.s3.amazonaws.com/global/bin/srldetect_intel_4.3.13.0.cab O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O20 - AppInit_DLLs: C:\WINDOWS\system32\guard32.dll O20 - Winlogon Notify: GoToAssist - Invalid registry found O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe O23 - Service: COMODO Firewall Pro Helper Service (cmdAgent) - Unknown owner - C:\Program Files\COMODO\Firewall\cmdagent.exe O23 - Service: GoToAssist - Citrix Online, a division of Citrix Systems, Inc. - C:\Program Files\Citrix\GoToAssist\514\g2aservice.exe O23 - Service: Java Quick Starter (JavaQuickStarterService) - Oracle Corporation - C:\Program Files\Java\jre7\bin\jqs.exe O23 - Service: Lexar Secure II (LxrSII1s) - Unknown owner - LxrSII1s.exe (file missing) O23 - Service: Mozilla Maintenance Service (MozillaMaintenance) - Mozilla Foundation - C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe O23 - Service: Intel NCS NetService (NetSvc) - Intel® Corporation - C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe O23 - Service: NitroPDFReaderDriverCreatorReadSpool3 (NitroReaderDriverReadSpool3) - Nitro PDF Software - C:\Program Files\Nitro\Reader 3\NitroPDFReaderDriverService3.exe O23 - Service: SupportSoft Sprocket Service (DellSupportCenter) (sprtsvc_dellsupportcenter) - SupportSoft, Inc. - C:\Program Files\Dell Support Center\bin\sprtsvc.exe O23 - Service: User Profile Hive Cleanup (UPHClean) - Windows ® Codename Longhorn DDK provider - C:\Program Files\UPHClean\uphclean.exe -- End of file - 9165 bytes
  13. Maurice, Here is the log from OTL. Unfortunately, IE8 and Chrome still have dosearches as my homepage. Should I run hijack This? All processes killed ========== OTL ========== HKLM\SOFTWARE\Microsoft\Internet Explorer\Main\\Default_Search_URL| /E : value set successfully! HKLM\SOFTWARE\Microsoft\Internet Explorer\Main\\Search Page| /E : value set successfully! Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{361ac05d-0e0d-11da-9aa9-806d6172696f}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{361ac05d-0e0d-11da-9aa9-806d6172696f}\ not found. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{361ac05d-0e0d-11da-9aa9-806d6172696f}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{361ac05d-0e0d-11da-9aa9-806d6172696f}\ not found. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{361ac05d-0e0d-11da-9aa9-806d6172696f}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{361ac05d-0e0d-11da-9aa9-806d6172696f}\ not found. File E:\setup.exe not found. ========== COMMANDS ========== [EMPTYTEMP] User: Administrator ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes User: All Users User: bob ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 33170 bytes ->Java cache emptied: 0 bytes ->FireFox cache emptied: 0 bytes ->Google Chrome cache emptied: 0 bytes ->Flash cache emptied: 0 bytes User: Default User ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes User: LocalService ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 33170 bytes ->Flash cache emptied: 0 bytes User: marie ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes User: NetworkService ->Temp folder emptied: 3188 bytes ->Temporary Internet Files folder emptied: 0 bytes %systemdrive% .tmp files removed: 0 bytes %systemroot% .tmp files removed: 0 bytes %systemroot%\System32 .tmp files removed: 0 bytes %systemroot%\System32\dllcache .tmp files removed: 0 bytes %systemroot%\System32\drivers .tmp files removed: 0 bytes Windows Temp folder emptied: 9601 bytes %systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 0 bytes %systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 0 bytes RecycleBin emptied: 103760 bytes Total Files Cleaned = 0.00 mb [EMPTYFLASH] User: Administrator User: All Users User: bob ->Flash cache emptied: 0 bytes User: Default User User: LocalService ->Flash cache emptied: 0 bytes User: marie User: NetworkService Total Flash Files Cleaned = 0.00 mb [EMPTYJAVA] User: Administrator User: All Users User: bob ->Java cache emptied: 0 bytes User: Default User User: LocalService User: marie User: NetworkService Total Java Files Cleaned = 0.00 mb Restore point Set: OTL Restore Point OTL by OldTimer - Version 3.2.69.0 log created on 11262013_135957 Files\Folders moved on Reboot... PendingFileRenameOperations files... Registry entries deleted on Reboot...
  14. Maurice, Disregard the prior post. I've gotten clipboard. Will follow your directions.
  15. Maurice, Well this is interesting. I don't have clipboard anymore on my system. It used to be in accessories, but it's gone. I did a "search" and it doesn't show up. Could that be the reason I can't paste?
Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.