Titchski

Added a new user - same thing happens, I think I'll go ahead and do a full rebuild - she uses Carbonite to back her stuff up so her docs should be safe enough

It's an Acer - it doesn't happen if I boot into safe mode, just "normal" Windows. I'll try reating a new user and seeing if it happens to that account.

Had a look through it, don't think it applies as after running unhide, I can see all items and work normally. I'm really hoping the next step isn't a rebuild...

As soon as I reboot, all the start menu icons/folders disappear again.

Seems to be ok again - will know for sure after a reboot

Combo Fix log: ComboFix 12-10-10.02 - Marci 10/10/2012 21:20:31.1.4 - x64 Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.3948.2489 [GMT -4:00] Running from: c:\users\Marci\Desktop\ComboFix.exe AV: Microsoft Security Essentials *Disabled/Updated* {B140BF4E-23BB-4198-90AB-A51A4C60A69C} SP: Microsoft Security Essentials *Disabled/Updated* {0A215EAA-0581-4E16-AA1B-9E6837E7EC21} SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} . . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . . c:\program files (x86)\TelevisionFanatic c:\program files (x86)\TelevisionFanatic\bar\gen1\COMMON.T8S c:\program files (x86)\TelevisionFanatic\bar\IE9Mesg\COMMON.T8S c:\program files (x86)\TelevisionFanatic\bar\Message\COMMON.T8S c:\program files (x86)\TelevisionFanatic\bar\Settings\s_pid.dat c:\users\Marci\AppData\Local\Microsoft\Windows\Temporary Internet Files\{B75867C2-EC0E-4280-BCA4-04F8C382E61A}.xps c:\users\Marci\AppData\Local\Microsoft\Windows\Temporary Internet Files\{F65E9993-56FB-495E-8B21-153A9F2EC510}.xps c:\users\Marci\AppData\Roaming\Mozilla\Firefox\Profiles\o3zmyekh.default\extensions\64ffxtbr@TelevisionFanatic.com c:\users\Marci\AppData\Roaming\Mozilla\Firefox\Profiles\o3zmyekh.default\extensions\64ffxtbr@TelevisionFanatic.com\bootstrap.js c:\users\Marci\AppData\Roaming\Mozilla\Firefox\Profiles\o3zmyekh.default\extensions\64ffxtbr@TelevisionFanatic.com\chrome.manifest c:\users\Marci\AppData\Roaming\Mozilla\Firefox\Profiles\o3zmyekh.default\extensions\64ffxtbr@TelevisionFanatic.com\chrome\64ffxtbr.jar c:\users\Marci\AppData\Roaming\Mozilla\Firefox\Profiles\o3zmyekh.default\extensions\64ffxtbr@TelevisionFanatic.com\install.rdf c:\users\Marci\AppData\Roaming\Mozilla\Firefox\Profiles\o3zmyekh.default\extensions\64ffxtbr@TelevisionFanatic.com\META-INF\manifest.mf c:\users\Marci\AppData\Roaming\Mozilla\Firefox\Profiles\o3zmyekh.default\extensions\64ffxtbr@TelevisionFanatic.com\META-INF\zigbert.rsa c:\users\Marci\AppData\Roaming\Mozilla\Firefox\Profiles\o3zmyekh.default\extensions\64ffxtbr@TelevisionFanatic.com\META-INF\zigbert.sf c:\windows\SysWow64\DEBUG.log . . ((((((((((((((((((((((((( Files Created from 2012-09-11 to 2012-10-11 ))))))))))))))))))))))))))))))) . . 2012-10-11 01:24 . 2012-10-11 01:24 -------- d-----w- c:\users\Default\AppData\Local\temp 2012-10-10 02:01 . 2012-10-10 02:01 -------- d-----w- c:\users\Marci\AppData\Roaming\Malwarebytes 2012-10-10 02:01 . 2012-10-10 02:01 -------- d-----w- c:\programdata\Malwarebytes 2012-10-10 02:01 . 2012-09-07 21:04 25928 ----a-w- c:\windows\system32\drivers\mbam.sys 2012-10-10 02:01 . 2012-10-10 02:01 -------- d-----w- c:\program files (x86)\Malwarebytes' Anti-Malware 2012-10-10 01:42 . 2012-08-31 18:19 1659760 ----a-w- c:\windows\system32\drivers\ntfs.sys 2012-10-10 01:39 . 2012-09-14 19:19 2048 ----a-w- c:\windows\system32\tzres.dll 2012-10-10 01:39 . 2012-09-14 18:28 2048 ----a-w- c:\windows\SysWow64\tzres.dll 2012-10-10 01:39 . 2012-08-11 00:56 715776 ----a-w- c:\windows\system32\kerberos.dll 2012-10-10 01:39 . 2012-08-10 23:56 542208 ----a-w- c:\windows\SysWow64\kerberos.dll 2012-10-10 01:39 . 2012-06-02 05:41 1464320 ----a-w- c:\windows\system32\crypt32.dll 2012-10-10 01:39 . 2012-06-02 05:41 184320 ----a-w- c:\windows\system32\cryptsvc.dll 2012-10-10 01:39 . 2012-06-02 05:41 140288 ----a-w- c:\windows\system32\cryptnet.dll 2012-10-10 01:39 . 2012-06-02 04:36 140288 ----a-w- c:\windows\SysWow64\cryptsvc.dll 2012-10-10 01:39 . 2012-06-02 04:36 1159680 ----a-w- c:\windows\SysWow64\crypt32.dll 2012-10-10 01:39 . 2012-06-02 04:36 103936 ----a-w- c:\windows\SysWow64\cryptnet.dll 2012-10-07 14:48 . 2012-10-11 00:49 -------- d-----w- c:\users\Marci\AppData\Local\TelevisionFanatic 2012-10-07 14:47 . 2012-10-10 01:23 -------- d-----w- c:\users\Marci\AppData\Local\dealcabby 2012-10-07 14:47 . 2012-10-10 01:23 -------- d-----w- c:\programdata\Sendori 2012-10-07 14:47 . 2012-10-10 01:23 -------- d-----w- c:\program files (x86)\FLVPlayer 2012-10-07 14:47 . 2012-10-10 01:23 -------- d-----w- c:\program files (x86)\Sendori 2012-10-07 14:12 . 2012-10-10 01:22 -------- d-----w- c:\users\Marci\AppData\Roaming\vlc 2012-09-30 04:21 . 2012-09-30 04:21 972192 ------w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{A03729AC-2912-46FF-93F5-F55302D7C2EB}\gapaengine.dll 2012-09-29 02:49 . 2012-08-21 21:01 245760 ----a-w- c:\windows\system32\OxpsConverter.exe 2012-09-12 02:02 . 2012-09-12 02:02 -------- d-----w- c:\program files (x86)\Common Files\Skype 2012-09-11 22:09 . 2012-08-22 18:12 950128 ----a-w- c:\windows\system32\drivers\ndis.sys 2012-09-11 22:09 . 2012-08-02 17:58 574464 ----a-w- c:\windows\system32\d3d10level9.dll 2012-09-11 22:09 . 2012-08-02 16:57 490496 ----a-w- c:\windows\SysWow64\d3d10level9.dll 2012-09-11 22:09 . 2012-07-04 20:26 41472 ----a-w- c:\windows\system32\drivers\RNDISMP.sys 2012-09-11 22:09 . 2012-08-22 18:12 1913200 ----a-w- c:\windows\system32\drivers\tcpip.sys 2012-09-11 22:09 . 2012-08-22 18:12 376688 ----a-w- c:\windows\system32\drivers\netio.sys 2012-09-11 22:09 . 2012-08-22 18:12 288624 ----a-w- c:\windows\system32\drivers\FWPKCLNT.SYS . . . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2012-10-10 21:09 . 2012-08-26 05:42 65309168 ----a-w- c:\windows\system32\MRT.exe 2012-10-10 21:07 . 2012-08-12 19:53 696760 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe 2012-10-10 21:07 . 2011-08-05 00:50 73656 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl 2012-08-31 02:03 . 2012-08-31 02:03 228768 ----a-w- c:\windows\system32\drivers\MpFilter.sys 2012-08-31 02:03 . 2011-04-27 19:25 128456 ----a-w- c:\windows\system32\drivers\NisDrvWFP.sys 2012-08-20 17:38 . 2012-10-10 01:40 44032 ----a-w- c:\windows\apppatch\acwow64.dll 2012-07-18 18:15 . 2012-08-15 16:24 3148800 ----a-w- c:\windows\system32\win32k.sys . . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 . [HKEY_LOCAL_MACHINE\Wow6432Node\~\Browser Helper Objects\{3706EE7C-3CAD-445D-8A43-03EBC3B75908}] 2012-01-04 23:02 233288 ----a-w- c:\program files (x86)\Expat Shield\HssIE\ExpatIE.dll . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\Carbonite.Green] @="{95A27763-F62A-4114-9072-E81D87DE3B68}" [HKEY_CLASSES_ROOT\CLSID\{95A27763-F62A-4114-9072-E81D87DE3B68}] 2011-03-04 00:52 762000 ----a-r- c:\program files (x86)\Carbonite\Carbonite Backup\CarboniteNSE.dll . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\Carbonite.Partial] @="{E300CD91-100F-4E67-9AF3-1384A6124015}" [HKEY_CLASSES_ROOT\CLSID\{E300CD91-100F-4E67-9AF3-1384A6124015}] 2011-03-04 00:52 762000 ----a-r- c:\program files (x86)\Carbonite\Carbonite Backup\CarboniteNSE.dll . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\Carbonite.Yellow] @="{5E529433-B50E-4bef-A63B-16A6B71B071A}" [HKEY_CLASSES_ROOT\CLSID\{5E529433-B50E-4bef-A63B-16A6B71B071A}] 2011-03-04 00:52 762000 ----a-r- c:\program files (x86)\Carbonite\Carbonite Backup\CarboniteNSE.dll . [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] "IAStorIcon"="c:\program files (x86)\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe" [2010-09-14 283160] "SuiteTray"="c:\program files (x86)\EgisTec MyWinLockerSuite\x86\SuiteTray.exe" [2010-09-28 340336] "EgisTecPMMUpdate"="c:\program files (x86)\EgisTec IPS\PmmUpdate.exe" [2010-09-17 407920] "EgisUpdate"="c:\program files (x86)\EgisTec IPS\EgisUpdate.exe" [2010-09-17 201584] "Norton Online Backup"="c:\program files (x86)\Symantec\Norton Online Backup\NOBuClient.exe" [2010-06-01 1155928] "Adobe Reader Speed Launcher"="c:\program files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-28 35696] "BackupManagerTray"="c:\program files (x86)\NTI\Acer Backup Manager\BackupManagerTray.exe" [2011-02-15 297280] "LManager"="c:\program files (x86)\Launch Manager\LManager.exe" [2011-03-14 1081424] "Dolby Advanced Audio v2"="c:\dolby pcee4\pcee4.exe" [2011-02-03 506712] "ArcadeMovieService"="c:\program files (x86)\Acer\clear.fi\Movie\clear.fiMovieService.exe" [2011-02-18 177448] "Carbonite Backup"="c:\program files (x86)\Carbonite\Carbonite Backup\CarboniteUI.exe" [2011-03-04 948880] "Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-10-25 932288] "Adobe Acrobat Speed Launcher"="c:\program files (x86)\Adobe\Acrobat 10.0\Acrobat\Acrobat_sl.exe" [2010-10-25 36760] "Acrobat Assistant 8.0"="c:\program files (x86)\Adobe\Acrobat 10.0\Acrobat\Acrotray.exe" [2010-10-25 821144] "SwitchBoard"="c:\program files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe" [2010-02-19 517096] "AdobeCS5ServiceManager"="c:\program files (x86)\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe" [2010-02-22 406992] "APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2011-11-02 59240] "QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" [2011-10-24 421888] "iTunesHelper"="c:\program files (x86)\iTunes\iTunesHelper.exe" [2012-01-16 421736] "SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2012-01-18 254696] . [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce] "IsMyWinLockerReboot"="msiexec.exe" [2010-11-21 73216] . c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\ McAfee Security Scan Plus.lnk - c:\program files (x86)\McAfee Security Scan\3.0.207\SSScheduler.exe [2011-6-17 272528] . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "ConsentPromptBehaviorAdmin"= 5 (0x5) "ConsentPromptBehaviorUser"= 3 (0x3) "EnableUIADesktopToggle"= 0 (0x0) . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows] "LoadAppInit_DLLs"=0 (0x0) . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32] "aux"=wdmaud.drv . [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa] Security Packages REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp . [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS] @="" . [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc] @="Service" . R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576] R2 DsiWMIService;Dritek WMI Service;c:\program files (x86)\Launch Manager\dsiwmis.exe [2011-03-14 352336] R2 ExpatShieldService;Expat Shield Service;c:\program files (x86)\Expat Shield\bin\openvpnas.exe [2012-01-06 331608] R2 ExpatSrv;Expat Shield Routing Service;c:\program files (x86)\Expat Shield\HssWPR\hsssrv.exe [2012-01-04 363336] R2 ExpatWd;Expat Shield Monitoring Service;c:\program files (x86)\Expat Shield\bin\hsswd.exe [2012-01-04 329544] R2 GREGService;GREGService;c:\program files (x86)\Acer\Registration\GREGsvc.exe [2010-01-08 23584] R2 IAStorDataMgrSvc;Intel® Rapid Storage Technology;c:\program files (x86)\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe [2010-09-14 13336] R2 NOBU;Norton Online Backup;c:\program files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe SERVICE [x] R2 NTI IScheduleSvc;NTI IScheduleSvc;c:\program files (x86)\NTI\Acer Backup Manager\IScheduleSvc.exe [2011-02-15 257344] R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe [2012-07-13 160944] R2 UNS;Intel® Management and Security Application User Notification Service;c:\program files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe [2011-02-01 2656280] R3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-10-10 250808] R3 EgisTec Ticket Service;EgisTec Ticket Service;c:\program files (x86)\Common Files\EgisTec\Services\EgisTicketService.exe [2010-09-28 172912] R3 ExpatTrayService;Expat Shield Tray Service;c:\program files (x86)\Expat Shield\bin\ExpatTrayService.EXE [2012-01-06 77520] R3 GamesAppService;GamesAppService;c:\program files (x86)\WildTangent Games\App\GamesAppService.exe [2010-10-12 206072] R3 McComponentHostService;McAfee Security Scan Component Host Service;c:\program files (x86)\McAfee Security Scan\3.0.207\McCHSvc.exe [2011-06-17 237008] R3 Microsoft SharePoint Workspace Audit Service;Microsoft SharePoint Workspace Audit Service;c:\program files\Microsoft Office\Office14\GROOVE.EXE [2011-06-12 51740536] R3 MozillaMaintenance;Mozilla Maintenance Service;c:\program files (x86)\Mozilla Maintenance Service\maintenanceservice.exe [2012-09-08 114144] R3 NisDrv;Microsoft Network Inspection System;c:\windows\system32\DRIVERS\NisDrvWFP.sys [2012-08-31 128456] R3 NisSrv;Microsoft Network Inspection;c:\program files\Microsoft Security Client\NisSrv.exe [2012-09-13 368896] R3 ose64;Office 64 Source Engine;c:\program files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2010-01-10 174440] R3 osppsvc;Office Software Protection Platform;c:\program files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-01-10 4925184] R3 SwitchBoard;Adobe SwitchBoard;c:\program files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [2010-02-19 517096] R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-21 59392] R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys [2010-11-21 31232] R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys [2011-05-10 51712] R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [2011-08-04 1255736] R3 WSDPrintDevice;WSD Print Support via UMB;c:\windows\system32\DRIVERS\WSDPrint.sys [2009-07-14 23040] R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe [2010-09-23 57184] S1 mwlPSDFilter;mwlPSDFilter;c:\windows\system32\DRIVERS\mwlPSDFilter.sys [2011-04-06 22912] S1 mwlPSDNServ;mwlPSDNServ;c:\windows\system32\DRIVERS\mwlPSDNServ.sys [2011-04-06 20328] S1 mwlPSDVDisk;mwlPSDVDisk;c:\windows\system32\DRIVERS\mwlPSDVDisk.sys [2011-04-06 62584] S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [2009-07-14 59904] S2 ePowerSvc;Acer ePower Service;c:\program files\Acer\Acer ePower Management\ePowerSvc.exe [2011-02-23 873064] S2 Live Updater Service;Live Updater Service;c:\program files\Acer\Acer Updater\UpdaterService.exe [2011-01-31 244624] S3 b57xdbd;Broadcom xD Picture Bus Driver Service;c:\windows\system32\drivers\b57xdbd.sys [2011-01-21 67624] S3 b57xdmp;Broadcom xD Picture vstorp client drv;c:\windows\system32\drivers\b57xdmp.sys [2011-01-21 19496] S3 bScsiMSa;bScsiMSa;c:\windows\system32\drivers\bScsiMSa.sys [2011-01-20 52264] S3 bScsiSDa;bScsiSDa;c:\windows\system32\DRIVERS\bScsiSDa.sys [2011-01-14 85544] S3 IntcDAud;Intel® Display Audio;c:\windows\system32\DRIVERS\IntcDAud.sys [2010-10-15 317440] S3 k57nd60a;Broadcom NetLink Gigabit Ethernet - NDIS 6.0;c:\windows\system32\DRIVERS\k57nd60a.sys [2011-01-17 412712] S3 MEIx64;Intel® Management Engine Interface;c:\windows\system32\DRIVERS\HECIx64.sys [2010-10-20 56344] . . Contents of the 'Scheduled Tasks' folder . 2012-10-11 c:\windows\Tasks\Adobe Flash Player Updater.job - c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-08-12 21:07] . . --------- X64 Entries ----------- . . [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{3706EE7C-3CAD-445D-8A43-03EBC3B75908}] 2012-01-04 23:02 287048 ----a-w- c:\program files (x86)\Expat Shield\HssIE\ExpatIE_64.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\Carbonite.Green] @="{95A27763-F62A-4114-9072-E81D87DE3B68}" [HKEY_CLASSES_ROOT\CLSID\{95A27763-F62A-4114-9072-E81D87DE3B68}] 2011-03-04 00:36 1174672 ----a-r- c:\program files\Carbonite\Carbonite Backup\CarboniteNSE.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\Carbonite.Partial] @="{E300CD91-100F-4E67-9AF3-1384A6124015}" [HKEY_CLASSES_ROOT\CLSID\{E300CD91-100F-4E67-9AF3-1384A6124015}] 2011-03-04 00:36 1174672 ----a-r- c:\program files\Carbonite\Carbonite Backup\CarboniteNSE.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\Carbonite.Yellow] @="{5E529433-B50E-4bef-A63B-16A6B71B071A}" [HKEY_CLASSES_ROOT\CLSID\{5E529433-B50E-4bef-A63B-16A6B71B071A}] 2011-03-04 00:36 1174672 ----a-r- c:\program files\Carbonite\Carbonite Backup\CarboniteNSE.dll . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "IgfxTray"="c:\windows\system32\igfxtray.exe" [2011-03-30 167960] "HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2011-03-30 391704] "Persistence"="c:\windows\system32\igfxpers.exe" [2011-03-30 418840] "RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2011-03-10 11785832] "RtHDVBg"="c:\program files\Realtek\Audio\HDA\RAVBg64.exe" [2011-03-09 2189416] "Power Management"="c:\program files\Acer\Acer ePower Management\ePowerTray.exe" [2011-02-23 1796200] "BCSSync"="c:\program files\Microsoft Office\Office14\BCSSync.exe" [2010-03-13 112512] "AdobeAAMUpdater-1.0"="c:\program files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe" [2010-09-16 497648] "MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2012-09-13 1289704] . ------- Supplementary Scan ------- . uLocal Page = c:\windows\system32\blank.htm uStart Page = hxxp://acer.msn.com mDefault_Page_URL = hxxp://acer.msn.com mStart Page = hxxp://acer.msn.com mLocal Page = c:\windows\SysWOW64\blank.htm uInternet Settings,ProxyOverride = *.local IE: Append Link Target to Existing PDF - c:\program files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html IE: Append to Existing PDF - c:\program files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html IE: Convert Link Target to Adobe PDF - c:\program files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html IE: Convert to Adobe PDF - c:\program files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECapture.html IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~3\Office14\EXCEL.EXE/3000 IE: Se&nd to OneNote - c:\progra~1\MICROS~3\Office14\ONBttnIE.dll/105 TCP: DhcpNameServer = 10.0.0.1 TCP: Interfaces\{AA180B28-E6AA-4BED-AE1A-9E3A74AEE289}: NameServer = 10.197.48.1 FF - ProfilePath - c:\users\Marci\AppData\Roaming\Mozilla\Firefox\Profiles\o3zmyekh.default\ FF - prefs.js: browser.startup.homepage - hxxp://www.facebook.com/marci.gower . - - - - ORPHANS REMOVED - - - - . Toolbar-Locked - (no file) Wow6432Node-HKCU-Run-ISUSPM - c:\programdata\FLEXnet\Connect\11\ISUSPM.exe Wow6432Node-HKLM-Run-<NO NAME> - (no file) Toolbar-Locked - (no file) HKLM-Run-SynTPEnh - c:\program files (x86)\Synaptics\SynTP\SynTPEnh.exe . . . --------------------- LOCKED REGISTRY KEYS --------------------- . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}] @Denied: (A 2) (Everyone) @="FlashBroker" "LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_4_402_287_ActiveX.exe,-101" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation] "Enabled"=dword:00000001 . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32] @="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_4_402_287_ActiveX.exe" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}] @Denied: (A 2) (Everyone) @="IFlashBroker5" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32] @="{00020424-0000-0000-C000-000000000046}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" "Version"="1.0" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}] @Denied: (A 2) (Everyone) @="FlashBroker" "LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_4_402_287_ActiveX.exe,-101" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation] "Enabled"=dword:00000001 . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_4_402_287_ActiveX.exe" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}] @Denied: (A 2) (Everyone) @="Shockwave Flash Object" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_4_402_287.ocx" "ThreadingModel"="Apartment" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus] @="0" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID] @="ShockwaveFlash.ShockwaveFlash.11" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_4_402_287.ocx, 1" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib] @="{D27CDB6B-AE6D-11cf-96B8-444553540000}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version] @="1.0" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID] @="ShockwaveFlash.ShockwaveFlash" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}] @Denied: (A 2) (Everyone) @="Macromedia Flash Factory Object" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_4_402_287.ocx" "ThreadingModel"="Apartment" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID] @="FlashFactory.FlashFactory.1" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_4_402_287.ocx, 1" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib] @="{D27CDB6B-AE6D-11cf-96B8-444553540000}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version] @="1.0" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID] @="FlashFactory.FlashFactory" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}] @Denied: (A 2) (Everyone) @="IFlashBroker5" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32] @="{00020424-0000-0000-C000-000000000046}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" "Version"="1.0" . [HKEY_LOCAL_MACHINE\SOFTWARE\McAfee] "SymbolicLinkValue"=hex(6):5c,00,72,00,65,00,67,00,69,00,73,00,74,00,72,00,79, 00,5c,00,6d,00,61,00,63,00,68,00,69,00,6e,00,65,00,5c,00,53,00,6f,00,66,00,\ . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security] @Denied: (Full) (Everyone) . Completion time: 2012-10-10 21:27:48 ComboFix-quarantined-files.txt 2012-10-11 01:27 . Pre-Run: 231,965,261,824 bytes free Post-Run: 232,156,762,112 bytes free . - - End Of File - - AF2A75B981827CDD1BEEE564CA2E7BD4

Running combofix now, cheers

Spoke too soon - rebooted and the start programs have gone again :| I'm guessing it didn't get totally removed

I'll get right on updating Java and Reader

Results of screen317's Security Check version 0.99.51 Windows 7 Service Pack 1 x64 (UAC is enabled) Internet Explorer 9 ``````````````Antivirus/Firewall Check:`````````````` Windows Firewall Enabled! Microsoft Security Essentials Antivirus up to date! `````````Anti-malware/Other Utilities Check:````````` Malwarebytes Anti-Malware version 1.65.0.1400 Java 6 Update 31 Java version out of Date! Adobe Flash Player 11.4.402.287 Adobe Reader 9 Adobe Reader out of Date! Mozilla Firefox (15.0) ````````Process Check: objlist.exe by Laurent```````` Microsoft Security Essentials MSMpEng.exe Microsoft Security Essentials msseces.exe `````````````````System Health check````````````````` Total Fragmentation on Drive C: 0% ````````````````````End of Log``````````````````````

unhide worked - all seems to be well now - many, many thanks for the help!

ilivid seems to have gone - running unhide now. Thanks for the help so far!

Still the same unfortunately - no access to certain exes and no start menu > programs links

She's a fan of junk.. must be why she married me Second logfile: # AdwCleaner v2.004 - Logfile created 10/10/2012 at 19:59:10 # Updated 06/10/2012 by Xplode # Operating system : Windows 7 Home Premium Service Pack 1 (64 bits) # User : Marci - MARCI7 # Boot Mode : Normal # Running from : C:\Users\Marci\Desktop\adwcleaner.exe # Option [Delete] ***** [services] ***** ***** [Files / Folders] ***** Deleted on reboot : C:\Program Files (x86)\Mozilla Firefox\Extensions\afurladvisor@anchorfree.com File Deleted : C:\Program Files (x86)\Mozilla Firefox\Plugins\npvsharetvplg.dll File Deleted : C:\Users\Marci\AppData\Roaming\Mozilla\Firefox\Profiles\o3zmyekh.default\extensions\pricepeep@getpricepeep.com.xpi Folder Deleted : C:\Program Files (x86)\Conduit Folder Deleted : C:\Program Files (x86)\Ilivid Folder Deleted : C:\Program Files (x86)\PricePeep Folder Deleted : C:\Program Files (x86)\vShare.tv plugin Folder Deleted : C:\Program Files (x86)\vshare.tv_Bar Folder Deleted : C:\Users\Marci\AppData\Local\Conduit Folder Deleted : C:\Users\Marci\AppData\Local\Ilivid Player Folder Deleted : C:\Users\Marci\AppData\Local\Software Folder Deleted : C:\Users\Marci\AppData\Local\Temp\CT2818425 Folder Deleted : C:\Users\Marci\AppData\LocalLow\Conduit Folder Deleted : C:\Users\Marci\AppData\LocalLow\vshare.tv_Bar Folder Deleted : C:\Users\Marci\AppData\Roaming\Mozilla\Firefox\Profiles\o3zmyekh.default\ConduitCommon Folder Deleted : C:\Users\Marci\AppData\Roaming\Mozilla\Firefox\Profiles\o3zmyekh.default\CT2818425 Folder Deleted : C:\Users\Marci\AppData\Roaming\Mozilla\Firefox\Profiles\o3zmyekh.default\extensions\{7aeb3efd-e564-43f1-b658-5058a7c5743b} ***** [Registry] ***** Key Deleted : HKCU\Software\AppDataLow\Software\Conduit Key Deleted : HKCU\Software\AppDataLow\Software\vshare.tv_Bar Key Deleted : HKCU\Software\AppDataLow\Toolbar Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{7AEB3EFD-E564-43F1-B658-5058A7C5743B} Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{7AEB3EFD-E564-43F1-B658-5058A7C5743B} Key Deleted : HKCU\Software\StartSearch Key Deleted : HKLM\SOFTWARE\Classes\Toolbar.CT2818425 Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{99C22A61-21BA-4F81-85FF-CDC9EB5DB10B} Key Deleted : HKLM\Software\Conduit Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{91E526FE-D9CF-443C-91A4-4A42F6178477} Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{A1B48071-416D-474E-A13B-BE5456E7FC31} Key Deleted : HKLM\Software\vshare.tv_Bar Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{7AEB3EFD-E564-43F1-B658-5058A7C5743B} Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{91E526FE-D9CF-443C-91A4-4A42F6178477} Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{A1B48071-416D-474E-A13B-BE5456E7FC31} Key Deleted : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{AF527190-68C9-4D03-AA04-9EB633E1D2C9} Key Deleted : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{DE93BFA0-058A-4B8E-A8D9-8918B3817571} Key Deleted : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} Key Deleted : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{7AEB3EFD-E564-43F1-B658-5058A7C5743B} Key Deleted : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\vshare.tv_Bar Toolbar Key Deleted : HKLM\SOFTWARE\Classes\Interface\{79FB5FC8-44B9-4AF5-BADD-CCE547F953E5} Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} Value Deleted : HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks [{7AEB3EFD-E564-43F1-B658-5058A7C5743B}] Value Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks [{7AEB3EFD-E564-43F1-B658-5058A7C5743B}] Value Deleted : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar [{7AEB3EFD-E564-43F1-B658-5058A7C5743B}] ***** [internet Browsers] ***** -\\ Internet Explorer v9.0.8112.16421 [OK] Registry is clean. -\\ Mozilla Firefox v15.0 (en-US) Profile name : default File : C:\Users\Marci\AppData\Roaming\Mozilla\Firefox\Profiles\o3zmyekh.default\prefs.js Deleted : user_pref("CT2818425..clientLogIsEnabled", false); Deleted : user_pref("CT2818425..clientLogServiceUrl", "hxxp://clientlog.users.conduit.com/ClientDiagnostics.as[...] Deleted : user_pref("CT2818425..uninstallLogServiceUrl", "hxxp://uninstall.users.conduit.com/Uninstall.asmx/Re[...] Deleted : user_pref("CT2818425.ALLOW_SHOWING_HIDDEN_TOOLBAR", false); Deleted : user_pref("CT2818425.AboutPrivacyUrl", "hxxp://www.conduit.com/privacy/Default.aspx"); Deleted : user_pref("CT2818425.BrowserCompStateIsOpen_129712757411525741", true); Deleted : user_pref("CT2818425.BrowserCompStateIsOpen_129735245815838327", true); Deleted : user_pref("CT2818425.BrowserCompStateIsOpen_129893041058613741", true); Deleted : user_pref("CT2818425.CT2818425", "CT2818425"); Deleted : user_pref("CT2818425.CurrentServerDate", "10-10-2012"); Deleted : user_pref("CT2818425.DSInstall", false); Deleted : user_pref("CT2818425.DialogsAlignMode", "LTR"); Deleted : user_pref("CT2818425.DialogsGetterLastCheckTime", "Tue Oct 09 2012 21:59:26 GMT-0400 (Eastern Daylig[...] Deleted : user_pref("CT2818425.DownloadReferralCookieData", ""); Deleted : user_pref("CT2818425.EMailNotifierPollDate", "Sat Mar 10 2012 12:21:46 GMT-0500 (Eastern Standard Ti[...] Deleted : user_pref("CT2818425.FirstServerDate", "10-3-2012"); Deleted : user_pref("CT2818425.FirstTime", true); Deleted : user_pref("CT2818425.FirstTimeFF3", true); Deleted : user_pref("CT2818425.FixPageNotFoundErrors", false); Deleted : user_pref("CT2818425.GroupingServerCheckInterval", 1440); Deleted : user_pref("CT2818425.GroupingServiceUrl", "hxxp://grouping.services.conduit.com/"); Deleted : user_pref("CT2818425.HPInstall", false); Deleted : user_pref("CT2818425.HasUserGlobalKeys", true); Deleted : user_pref("CT2818425.HomePageProtectorEnabled", false); Deleted : user_pref("CT2818425.HomepageBeforeUnload", "hxxp://www.facebook.com/marci.gower"); Deleted : user_pref("CT2818425.Initialize", true); Deleted : user_pref("CT2818425.InitializeCommonPrefs", true); Deleted : user_pref("CT2818425.InstallationAndCookieDataSentCount", 3); Deleted : user_pref("CT2818425.InstallationType", "Unknown"); Deleted : user_pref("CT2818425.InstalledDate", "Sat Mar 10 2012 12:21:47 GMT-0500 (Eastern Standard Time)"); Deleted : user_pref("CT2818425.InvalidateCache", false); Deleted : user_pref("CT2818425.IsGrouping", false); Deleted : user_pref("CT2818425.IsInitSetupIni", true); Deleted : user_pref("CT2818425.IsMulticommunity", false); Deleted : user_pref("CT2818425.IsOpenThankYouPage", true); Deleted : user_pref("CT2818425.IsOpenUninstallPage", true); Deleted : user_pref("CT2818425.IsProtectorsInit", true); Deleted : user_pref("CT2818425.LanguagePackLastCheckTime", "Tue Oct 09 2012 21:59:26 GMT-0400 (Eastern Dayligh[...] Deleted : user_pref("CT2818425.LanguagePackReloadIntervalMM", 1440); Deleted : user_pref("CT2818425.LanguagePackServiceUrl", "hxxp://translation.users.conduit.com/Translation.ashx[...] Deleted : user_pref("CT2818425.LastLogin_3.10.0.1", "Sat Mar 10 2012 12:22:43 GMT-0500 (Eastern Standard Time)[...] Deleted : user_pref("CT2818425.LastLogin_3.12.0.7", "Tue May 01 2012 06:39:06 GMT-0400 (Eastern Daylight Time)[...] Deleted : user_pref("CT2818425.LastLogin_3.12.2.3", "Thu May 31 2012 13:11:29 GMT-0400 (Eastern Daylight Time)[...] Deleted : user_pref("CT2818425.LastLogin_3.13.0.6", "Sun Jul 15 2012 12:22:15 GMT-0400 (Eastern Daylight Time)[...] Deleted : user_pref("CT2818425.LastLogin_3.14.1.0", "Sun Aug 26 2012 00:08:16 GMT-0400 (Eastern Daylight Time)[...] Deleted : user_pref("CT2818425.LastLogin_3.15.1.0", "Tue Oct 09 2012 21:59:26 GMT-0400 (Eastern Daylight Time)[...] Deleted : user_pref("CT2818425.LatestVersion", "3.15.1.0"); Deleted : user_pref("CT2818425.Locale", "en"); Deleted : user_pref("CT2818425.MCDetectTooltipHeight", "83"); Deleted : user_pref("CT2818425.MCDetectTooltipUrl", "hxxp://@EB_INSTALL_LINK@/rank/tooltip/?version=1"); Deleted : user_pref("CT2818425.MCDetectTooltipWidth", "295"); Deleted : user_pref("CT2818425.MyStuffEnabledAtInstallation", true); Deleted : user_pref("CT2818425.OriginalFirstVersion", "3.10.0.1"); Deleted : user_pref("CT2818425.RadioIsPodcast", false); Deleted : user_pref("CT2818425.RadioLastCheckTime", "Mon Mar 12 2012 15:16:07 GMT-0400 (Eastern Daylight Time)[...] Deleted : user_pref("CT2818425.RadioLastUpdateIPServer", "3"); Deleted : user_pref("CT2818425.RadioLastUpdateServer", "129330101464100000"); Deleted : user_pref("CT2818425.RadioMediaID", "21515677"); Deleted : user_pref("CT2818425.RadioMediaType", "Media Player"); Deleted : user_pref("CT2818425.RadioMenuSelectedID", "EBRadioMenu_CT281842521515677"); Deleted : user_pref("CT2818425.RadioShrinkedFromSetup", false); Deleted : user_pref("CT2818425.RadioStationName", "Virgin%20Radio%20Classic%20Rock"); Deleted : user_pref("CT2818425.RadioStationURL", "hxxp://www.smgradio.com/core/audio/wmp/live.asx?service=vcbb[...] Deleted : user_pref("CT2818425.SearchCaption", "vshare.tv Customized Web Search"); Deleted : user_pref("CT2818425.SearchEngineBeforeUnload", "chrome://browser-region/locale/region.properties"); Deleted : user_pref("CT2818425.SearchFromAddressBarIsInit", true); Deleted : user_pref("CT2818425.SearchFromAddressBarUrl", "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT281[...] Deleted : user_pref("CT2818425.SearchInNewTabEnabled", true); Deleted : user_pref("CT2818425.SearchInNewTabIntervalMM", 1440); Deleted : user_pref("CT2818425.SearchInNewTabLastCheckTime", "Tue Oct 09 2012 21:59:25 GMT-0400 (Eastern Dayli[...] Deleted : user_pref("CT2818425.SearchInNewTabServiceUrl", "hxxp://newtab.conduit-hosting.com/newtab/?ctid=EB_T[...] Deleted : user_pref("CT2818425.SearchInNewTabUserEnabled", false); Deleted : user_pref("CT2818425.SearchProtectorEnabled", false); Deleted : user_pref("CT2818425.SearchProtectorToolbarDisabled", false); Deleted : user_pref("CT2818425.SendProtectorDataViaLogin", true); Deleted : user_pref("CT2818425.ServiceMapLastCheckTime", "Tue Oct 09 2012 21:59:25 GMT-0400 (Eastern Daylight [...] Deleted : user_pref("CT2818425.SettingsLastCheckTime", "Tue Oct 09 2012 21:59:25 GMT-0400 (Eastern Daylight Ti[...] Deleted : user_pref("CT2818425.SettingsLastUpdate", "1348502557"); Deleted : user_pref("CT2818425.TBHomePageUrl", "hxxp://search.conduit.com/?ctid=CT2818425&SearchSource=13"); Deleted : user_pref("CT2818425.ThirdPartyComponentsInterval", 504); Deleted : user_pref("CT2818425.ThirdPartyComponentsLastCheck", "Sat Mar 10 2012 12:21:45 GMT-0500 (Eastern Sta[...] Deleted : user_pref("CT2818425.ThirdPartyComponentsLastUpdate", "1312887586"); Deleted : user_pref("CT2818425.ToolbarShrinkedFromSetup", false); Deleted : user_pref("CT2818425.TrusteLinkUrl", "hxxp://trust.conduit.com/CT2818425"); Deleted : user_pref("CT2818425.TrustedApiDomains", "conduit.com,conduit-hosting.com,conduit-services.com,clien[...] Deleted : user_pref("CT2818425.UserID", "UN47956079780564975"); Deleted : user_pref("CT2818425.alertChannelId", "1210492"); Deleted : user_pref("CT2818425.autoDisableScopes", -1); Deleted : user_pref("CT2818425.backendstorage.cbfirsttime", "536174204D617220313020323031322031323A32323A34362[...] Deleted : user_pref("CT2818425.backendstorage.key_user_agree_ia12", "31"); Deleted : user_pref("CT2818425.backendstorage.shoppingapp.gk.exipres", "546875204D617220313520323031322031323A[...] Deleted : user_pref("CT2818425.backendstorage.shoppingapp.gk.geolocation", "756E6974656420737461746573"); Deleted : user_pref("CT2818425.backendstorage.user_uniqueid", "66323865656365622D633762322D306639302D356637662[...] Deleted : user_pref("CT2818425.components.1000234", false); Deleted : user_pref("CT2818425.generalConfigFromLogin", "{\"ApiMaxAlerts\":\"12\",\"SocialDomains\":\"social.c[...] Deleted : user_pref("CT2818425.globalFirstTimeInfoLastCheckTime", "Tue Mar 13 2012 03:44:07 GMT-0400 (Eastern [...] Deleted : user_pref("CT2818425.homepageProtectorEnableByLogin", true); Deleted : user_pref("CT2818425.initDone", true); Deleted : user_pref("CT2818425.isAppTrackingManagerOn", true); Deleted : user_pref("CT2818425.isFirstRadioInstallation", false); Deleted : user_pref("CT2818425.myStuffEnabled", true); Deleted : user_pref("CT2818425.myStuffPublihserMinWidth", 400); Deleted : user_pref("CT2818425.myStuffSearchUrl", "hxxp://Apps.conduit.com/search?q=SEARCH_TERM&SearchSourceOr[...] Deleted : user_pref("CT2818425.myStuffServiceIntervalMM", 1440); Deleted : user_pref("CT2818425.myStuffServiceUrl", "hxxp://mystuff.conduit-services.com/MyStuffService.ashx?Co[...] Deleted : user_pref("CT2818425.navigateToUrlOnSearch", false); Deleted : user_pref("CT2818425.revertSettingsEnabled", false); Deleted : user_pref("CT2818425.searchProtectorDialogDelayInSec", 10); Deleted : user_pref("CT2818425.searchProtectorEnableByLogin", true); Deleted : user_pref("CT2818425.testingCtid", ""); Deleted : user_pref("CT2818425.toolbarAppMetaDataLastCheckTime", "Tue Oct 09 2012 21:59:26 GMT-0400 (Eastern D[...] Deleted : user_pref("CT2818425.toolbarContextMenuLastCheckTime", "Sat Mar 10 2012 12:21:47 GMT-0500 (Eastern S[...] Deleted : user_pref("CT2818425.usagesFlag", 2); Deleted : user_pref("CommunityToolbar.ETag.hxxp://Settings.toolbar.search.conduit.com/root/CT2818425/CT2818425[...] Deleted : user_pref("CommunityToolbar.ETag.hxxp://alerts.conduit-services.com/root/1210492/1206165/US", "\"0\"[...] Deleted : user_pref("CommunityToolbar.ETag.hxxp://appsmetadata.toolbar.conduit-services.com/?ctid=CT2818425", [...] Deleted : user_pref("CommunityToolbar.ETag.hxxp://contextmenu.toolbar.conduit-services.com/?name=GottenApps&lo[...] Deleted : user_pref("CommunityToolbar.ETag.hxxp://contextmenu.toolbar.conduit-services.com/?name=GottenApps&lo[...] Deleted : user_pref("CommunityToolbar.ETag.hxxp://contextmenu.toolbar.conduit-services.com/?name=OtherApps&loc[...] Deleted : user_pref("CommunityToolbar.ETag.hxxp://contextmenu.toolbar.conduit-services.com/?name=OtherApps&loc[...] Deleted : user_pref("CommunityToolbar.ETag.hxxp://contextmenu.toolbar.conduit-services.com/?name=SharedApps&lo[...] Deleted : user_pref("CommunityToolbar.ETag.hxxp://contextmenu.toolbar.conduit-services.com/?name=SharedApps&lo[...] Deleted : user_pref("CommunityToolbar.ETag.hxxp://contextmenu.toolbar.conduit-services.com/?name=Toolbar&local[...] Deleted : user_pref("CommunityToolbar.ETag.hxxp://contextmenu.toolbar.conduit-services.com/?name=Toolbar&local[...] Deleted : user_pref("CommunityToolbar.ETag.hxxp://dynamicdialogs.alert.conduit-services.com/alert/dlg.pkg", "\[...] Deleted : user_pref("CommunityToolbar.ETag.hxxp://dynamicdialogs.toolbar.conduit-services.com/DLG.pkg?ver=3.10[...] Deleted : user_pref("CommunityToolbar.ETag.hxxp://dynamicdialogs.toolbar.conduit-services.com/DLG.pkg?ver=3.12[...] Deleted : user_pref("CommunityToolbar.ETag.hxxp://dynamicdialogs.toolbar.conduit-services.com/DLG.pkg?ver=3.12[...] Deleted : user_pref("CommunityToolbar.ETag.hxxp://dynamicdialogs.toolbar.conduit-services.com/DLG.pkg?ver=3.13[...] Deleted : user_pref("CommunityToolbar.ETag.hxxp://dynamicdialogs.toolbar.conduit-services.com/DLG.pkg?ver=3.14[...] Deleted : user_pref("CommunityToolbar.ETag.hxxp://dynamicdialogs.toolbar.conduit-services.com/DLG.pkg?ver=3.15[...] Deleted : user_pref("CommunityToolbar.ETag.hxxp://servicemap.conduit-services.com/Toolbar/?ownerId=CT2818425",[...] Deleted : user_pref("CommunityToolbar.ETag.hxxp://translation.toolbar.conduit-services.com/?locale=en", "\"abd[...] Deleted : user_pref("CommunityToolbar.LatestLibsPath", "file:///C:\\Users\\Marci\\AppData\\Roaming\\Mozilla\\F[...] Deleted : user_pref("CommunityToolbar.LatestToolbarVersionInstalled", "3.10.0.1"); Deleted : user_pref("CommunityToolbar.SearchFromAddressBarSavedUrl", ""); Deleted : user_pref("CommunityToolbar.ToolbarsList", "CT2818425"); Deleted : user_pref("CommunityToolbar.ToolbarsList2", "CT2818425"); Deleted : user_pref("CommunityToolbar.ToolbarsList4", "CT2818425"); Deleted : user_pref("CommunityToolbar.facebook.settingsLastCheckTime", "Sat Mar 10 2012 12:21:46 GMT-0500 (Eas[...] Deleted : user_pref("CommunityToolbar.globalUserId", "ce284a29-936e-4e3d-8959-c2454901cb38"); Deleted : user_pref("CommunityToolbar.isAlertUrlAddedToFeedItemTable", true); Deleted : user_pref("CommunityToolbar.isClickActionAddedToFeedItemTable", true); Deleted : user_pref("CommunityToolbar.notifications.alertDialogsGetterLastCheckTime", "Sat Mar 10 2012 12:21:4[...] Deleted : user_pref("CommunityToolbar.notifications.alertEnabled", false); Deleted : user_pref("CommunityToolbar.notifications.alertInfoInterval", 1440); Deleted : user_pref("CommunityToolbar.notifications.alertInfoLastCheckTime", "Sat Mar 10 2012 12:21:54 GMT-050[...] Deleted : user_pref("CommunityToolbar.notifications.clientsServerUrl", "hxxp://alert.client.conduit.com"); Deleted : user_pref("CommunityToolbar.notifications.locale", ""); Deleted : user_pref("CommunityToolbar.notifications.loginIntervalMin", 0); Deleted : user_pref("CommunityToolbar.notifications.loginLastCheckTime", "Sun Mar 11 2012 15:15:59 GMT-0400 (E[...] Deleted : user_pref("CommunityToolbar.notifications.loginLastUpdateTime", ""); Deleted : user_pref("CommunityToolbar.notifications.messageShowTimeSec", 20); Deleted : user_pref("CommunityToolbar.notifications.servicesServerUrl", "hxxp://alert.services.conduit.com"); Deleted : user_pref("CommunityToolbar.notifications.showTrayIcon", false); Deleted : user_pref("CommunityToolbar.notifications.userCloseIntervalMin", 300); Deleted : user_pref("CommunityToolbar.notifications.userId", "a89fae1e-e252-4857-968b-f406d88530b2"); Deleted : user_pref("CommunityToolbar.originalHomepage", "hxxp://www.facebook.com/marci.gower"); Deleted : user_pref("CommunityToolbar.originalSearchEngine", "chrome://browser-region/locale/region.properties[...] Deleted : user_pref("vshare.install.date", "1329957972"); Deleted : user_pref("vshare.install.finished", "1.0.0"); Deleted : user_pref("vshare.install.fresh", "false"); Deleted : user_pref("vshare.install.guid", "{f691f350-1798-4560-bd1c-acf558070cd1}"); Deleted : user_pref("vshare.install.newtab", false); ************************* AdwCleaner[R1].txt - [18254 octets] - [10/10/2012 19:52:36] AdwCleaner[R2].txt - [18315 octets] - [10/10/2012 19:58:47] AdwCleaner[s1].txt - [18664 octets] - [10/10/2012 19:59:10] ########## EOF - C:\AdwCleaner[s1].txt - [18725 octets] ##########

# AdwCleaner v2.004 - Logfile created 10/10/2012 at 19:52:36 # Updated 06/10/2012 by Xplode # Operating system : Windows 7 Home Premium Service Pack 1 (64 bits) # User : Marci - MARCI7 # Boot Mode : Normal # Running from : C:\Users\Marci\Desktop\adwcleaner.exe # Option [search] ***** [services] ***** ***** [Files / Folders] ***** File Found : C:\Program Files (x86)\Mozilla Firefox\Plugins\npvsharetvplg.dll File Found : C:\Users\Marci\AppData\Roaming\Mozilla\Firefox\Profiles\o3zmyekh.default\extensions\pricepeep@getpricepeep.com.xpi Folder Found : C:\Program Files (x86)\Conduit Folder Found : C:\Program Files (x86)\Ilivid Folder Found : C:\Program Files (x86)\Mozilla Firefox\Extensions\afurladvisor@anchorfree.com Folder Found : C:\Program Files (x86)\PricePeep Folder Found : C:\Program Files (x86)\vShare.tv plugin Folder Found : C:\Program Files (x86)\vshare.tv_Bar Folder Found : C:\Users\Marci\AppData\Local\Conduit Folder Found : C:\Users\Marci\AppData\Local\Ilivid Player Folder Found : C:\Users\Marci\AppData\Local\Software Folder Found : C:\Users\Marci\AppData\Local\Temp\CT2818425 Folder Found : C:\Users\Marci\AppData\LocalLow\Conduit Folder Found : C:\Users\Marci\AppData\LocalLow\vshare.tv_Bar Folder Found : C:\Users\Marci\AppData\Roaming\Mozilla\Firefox\Profiles\o3zmyekh.default\ConduitCommon Folder Found : C:\Users\Marci\AppData\Roaming\Mozilla\Firefox\Profiles\o3zmyekh.default\CT2818425 Folder Found : C:\Users\Marci\AppData\Roaming\Mozilla\Firefox\Profiles\o3zmyekh.default\extensions\{7aeb3efd-e564-43f1-b658-5058a7c5743b} ***** [Registry] ***** Key Found : HKCU\Software\AppDataLow\Software\Conduit Key Found : HKCU\Software\AppDataLow\Software\vshare.tv_Bar Key Found : HKCU\Software\AppDataLow\Toolbar Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{7AEB3EFD-E564-43F1-B658-5058A7C5743B} Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{7AEB3EFD-E564-43F1-B658-5058A7C5743B} Key Found : HKCU\Software\StartSearch Key Found : HKLM\SOFTWARE\Classes\Toolbar.CT2818425 Key Found : HKLM\SOFTWARE\Classes\TypeLib\{99C22A61-21BA-4F81-85FF-CDC9EB5DB10B} Key Found : HKLM\Software\Conduit Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{91E526FE-D9CF-443C-91A4-4A42F6178477} Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{A1B48071-416D-474E-A13B-BE5456E7FC31} Key Found : HKLM\Software\vshare.tv_Bar Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{7AEB3EFD-E564-43F1-B658-5058A7C5743B} Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{91E526FE-D9CF-443C-91A4-4A42F6178477} Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{A1B48071-416D-474E-A13B-BE5456E7FC31} Key Found : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{AF527190-68C9-4D03-AA04-9EB633E1D2C9} Key Found : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{DE93BFA0-058A-4B8E-A8D9-8918B3817571} Key Found : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} Key Found : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{7AEB3EFD-E564-43F1-B658-5058A7C5743B} Key Found : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\vshare.tv_Bar Toolbar Key Found : HKLM\SOFTWARE\Classes\Interface\{79FB5FC8-44B9-4AF5-BADD-CCE547F953E5} Key Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} Value Found : HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks [{7AEB3EFD-E564-43F1-B658-5058A7C5743B}] Value Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks [{7AEB3EFD-E564-43F1-B658-5058A7C5743B}] Value Found : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar [{7AEB3EFD-E564-43F1-B658-5058A7C5743B}] ***** [internet Browsers] ***** -\\ Internet Explorer v9.0.8112.16421 [OK] Registry is clean. -\\ Mozilla Firefox v15.0 (en-US) Profile name : default File : C:\Users\Marci\AppData\Roaming\Mozilla\Firefox\Profiles\o3zmyekh.default\prefs.js Found : user_pref("CT2818425..clientLogIsEnabled", false); Found : user_pref("CT2818425..clientLogServiceUrl", "hxxp://clientlog.users.conduit.com/ClientDiagnostics.as[...] Found : user_pref("CT2818425..uninstallLogServiceUrl", "hxxp://uninstall.users.conduit.com/Uninstall.asmx/Re[...] Found : user_pref("CT2818425.ALLOW_SHOWING_HIDDEN_TOOLBAR", false); Found : user_pref("CT2818425.AboutPrivacyUrl", "hxxp://www.conduit.com/privacy/Default.aspx"); Found : user_pref("CT2818425.BrowserCompStateIsOpen_129712757411525741", true); Found : user_pref("CT2818425.BrowserCompStateIsOpen_129735245815838327", true); Found : user_pref("CT2818425.BrowserCompStateIsOpen_129893041058613741", true); Found : user_pref("CT2818425.CT2818425", "CT2818425"); Found : user_pref("CT2818425.CurrentServerDate", "10-10-2012"); Found : user_pref("CT2818425.DSInstall", false); Found : user_pref("CT2818425.DialogsAlignMode", "LTR"); Found : user_pref("CT2818425.DialogsGetterLastCheckTime", "Tue Oct 09 2012 21:59:26 GMT-0400 (Eastern Daylig[...] Found : user_pref("CT2818425.DownloadReferralCookieData", ""); Found : user_pref("CT2818425.EMailNotifierPollDate", "Sat Mar 10 2012 12:21:46 GMT-0500 (Eastern Standard Ti[...] Found : user_pref("CT2818425.FirstServerDate", "10-3-2012"); Found : user_pref("CT2818425.FirstTime", true); Found : user_pref("CT2818425.FirstTimeFF3", true); Found : user_pref("CT2818425.FixPageNotFoundErrors", false); Found : user_pref("CT2818425.GroupingServerCheckInterval", 1440); Found : user_pref("CT2818425.GroupingServiceUrl", "hxxp://grouping.services.conduit.com/"); Found : user_pref("CT2818425.HPInstall", false); Found : user_pref("CT2818425.HasUserGlobalKeys", true); Found : user_pref("CT2818425.HomePageProtectorEnabled", false); Found : user_pref("CT2818425.HomepageBeforeUnload", "hxxp://www.facebook.com/marci.gower"); Found : user_pref("CT2818425.Initialize", true); Found : user_pref("CT2818425.InitializeCommonPrefs", true); Found : user_pref("CT2818425.InstallationAndCookieDataSentCount", 3); Found : user_pref("CT2818425.InstallationType", "Unknown"); Found : user_pref("CT2818425.InstalledDate", "Sat Mar 10 2012 12:21:47 GMT-0500 (Eastern Standard Time)"); Found : user_pref("CT2818425.InvalidateCache", false); Found : user_pref("CT2818425.IsGrouping", false); Found : user_pref("CT2818425.IsInitSetupIni", true); Found : user_pref("CT2818425.IsMulticommunity", false); Found : user_pref("CT2818425.IsOpenThankYouPage", true); Found : user_pref("CT2818425.IsOpenUninstallPage", true); Found : user_pref("CT2818425.IsProtectorsInit", true); Found : user_pref("CT2818425.LanguagePackLastCheckTime", "Tue Oct 09 2012 21:59:26 GMT-0400 (Eastern Dayligh[...] Found : user_pref("CT2818425.LanguagePackReloadIntervalMM", 1440); Found : user_pref("CT2818425.LanguagePackServiceUrl", "hxxp://translation.users.conduit.com/Translation.ashx[...] Found : user_pref("CT2818425.LastLogin_3.10.0.1", "Sat Mar 10 2012 12:22:43 GMT-0500 (Eastern Standard Time)[...] Found : user_pref("CT2818425.LastLogin_3.12.0.7", "Tue May 01 2012 06:39:06 GMT-0400 (Eastern Daylight Time)[...] Found : user_pref("CT2818425.LastLogin_3.12.2.3", "Thu May 31 2012 13:11:29 GMT-0400 (Eastern Daylight Time)[...] Found : user_pref("CT2818425.LastLogin_3.13.0.6", "Sun Jul 15 2012 12:22:15 GMT-0400 (Eastern Daylight Time)[...] Found : user_pref("CT2818425.LastLogin_3.14.1.0", "Sun Aug 26 2012 00:08:16 GMT-0400 (Eastern Daylight Time)[...] Found : user_pref("CT2818425.LastLogin_3.15.1.0", "Tue Oct 09 2012 21:59:26 GMT-0400 (Eastern Daylight Time)[...] Found : user_pref("CT2818425.LatestVersion", "3.15.1.0"); Found : user_pref("CT2818425.Locale", "en"); Found : user_pref("CT2818425.MCDetectTooltipHeight", "83"); Found : user_pref("CT2818425.MCDetectTooltipUrl", "hxxp://@EB_INSTALL_LINK@/rank/tooltip/?version=1"); Found : user_pref("CT2818425.MCDetectTooltipWidth", "295"); Found : user_pref("CT2818425.MyStuffEnabledAtInstallation", true); Found : user_pref("CT2818425.OriginalFirstVersion", "3.10.0.1"); Found : user_pref("CT2818425.RadioIsPodcast", false); Found : user_pref("CT2818425.RadioLastCheckTime", "Mon Mar 12 2012 15:16:07 GMT-0400 (Eastern Daylight Time)[...] Found : user_pref("CT2818425.RadioLastUpdateIPServer", "3"); Found : user_pref("CT2818425.RadioLastUpdateServer", "129330101464100000"); Found : user_pref("CT2818425.RadioMediaID", "21515677"); Found : user_pref("CT2818425.RadioMediaType", "Media Player"); Found : user_pref("CT2818425.RadioMenuSelectedID", "EBRadioMenu_CT281842521515677"); Found : user_pref("CT2818425.RadioShrinkedFromSetup", false); Found : user_pref("CT2818425.RadioStationName", "Virgin%20Radio%20Classic%20Rock"); Found : user_pref("CT2818425.RadioStationURL", "hxxp://www.smgradio.com/core/audio/wmp/live.asx?service=vcbb[...] Found : user_pref("CT2818425.SearchCaption", "vshare.tv Customized Web Search"); Found : user_pref("CT2818425.SearchEngineBeforeUnload", "chrome://browser-region/locale/region.properties"); Found : user_pref("CT2818425.SearchFromAddressBarIsInit", true); Found : user_pref("CT2818425.SearchFromAddressBarUrl", "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT281[...] Found : user_pref("CT2818425.SearchInNewTabEnabled", true); Found : user_pref("CT2818425.SearchInNewTabIntervalMM", 1440); Found : user_pref("CT2818425.SearchInNewTabLastCheckTime", "Tue Oct 09 2012 21:59:25 GMT-0400 (Eastern Dayli[...] Found : user_pref("CT2818425.SearchInNewTabServiceUrl", "hxxp://newtab.conduit-hosting.com/newtab/?ctid=EB_T[...] Found : user_pref("CT2818425.SearchInNewTabUserEnabled", false); Found : user_pref("CT2818425.SearchProtectorEnabled", false); Found : user_pref("CT2818425.SearchProtectorToolbarDisabled", false); Found : user_pref("CT2818425.SendProtectorDataViaLogin", true); Found : user_pref("CT2818425.ServiceMapLastCheckTime", "Tue Oct 09 2012 21:59:25 GMT-0400 (Eastern Daylight [...] Found : user_pref("CT2818425.SettingsLastCheckTime", "Tue Oct 09 2012 21:59:25 GMT-0400 (Eastern Daylight Ti[...] Found : user_pref("CT2818425.SettingsLastUpdate", "1348502557"); Found : user_pref("CT2818425.TBHomePageUrl", "hxxp://search.conduit.com/?ctid=CT2818425&SearchSource=13"); Found : user_pref("CT2818425.ThirdPartyComponentsInterval", 504); Found : user_pref("CT2818425.ThirdPartyComponentsLastCheck", "Sat Mar 10 2012 12:21:45 GMT-0500 (Eastern Sta[...] Found : user_pref("CT2818425.ThirdPartyComponentsLastUpdate", "1312887586"); Found : user_pref("CT2818425.ToolbarShrinkedFromSetup", false); Found : user_pref("CT2818425.TrusteLinkUrl", "hxxp://trust.conduit.com/CT2818425"); Found : user_pref("CT2818425.TrustedApiDomains", "conduit.com,conduit-hosting.com,conduit-services.com,clien[...] Found : user_pref("CT2818425.UserID", "UN47956079780564975"); Found : user_pref("CT2818425.alertChannelId", "1210492"); Found : user_pref("CT2818425.autoDisableScopes", -1); Found : user_pref("CT2818425.backendstorage.cbfirsttime", "536174204D617220313020323031322031323A32323A34362[...] Found : user_pref("CT2818425.backendstorage.key_user_agree_ia12", "31"); Found : user_pref("CT2818425.backendstorage.shoppingapp.gk.exipres", "546875204D617220313520323031322031323A[...] Found : user_pref("CT2818425.backendstorage.shoppingapp.gk.geolocation", "756E6974656420737461746573"); Found : user_pref("CT2818425.backendstorage.user_uniqueid", "66323865656365622D633762322D306639302D356637662[...] Found : user_pref("CT2818425.components.1000234", false); Found : user_pref("CT2818425.generalConfigFromLogin", "{\"ApiMaxAlerts\":\"12\",\"SocialDomains\":\"social.c[...] Found : user_pref("CT2818425.globalFirstTimeInfoLastCheckTime", "Tue Mar 13 2012 03:44:07 GMT-0400 (Eastern [...] Found : user_pref("CT2818425.homepageProtectorEnableByLogin", true); Found : user_pref("CT2818425.initDone", true); Found : user_pref("CT2818425.isAppTrackingManagerOn", true); Found : user_pref("CT2818425.isFirstRadioInstallation", false); Found : user_pref("CT2818425.myStuffEnabled", true); Found : user_pref("CT2818425.myStuffPublihserMinWidth", 400); Found : user_pref("CT2818425.myStuffSearchUrl", "hxxp://Apps.conduit.com/search?q=SEARCH_TERM&SearchSourceOr[...] Found : user_pref("CT2818425.myStuffServiceIntervalMM", 1440); Found : user_pref("CT2818425.myStuffServiceUrl", "hxxp://mystuff.conduit-services.com/MyStuffService.ashx?Co[...] Found : user_pref("CT2818425.navigateToUrlOnSearch", false); Found : user_pref("CT2818425.revertSettingsEnabled", false); Found : user_pref("CT2818425.searchProtectorDialogDelayInSec", 10); Found : user_pref("CT2818425.searchProtectorEnableByLogin", true); Found : user_pref("CT2818425.testingCtid", ""); Found : user_pref("CT2818425.toolbarAppMetaDataLastCheckTime", "Tue Oct 09 2012 21:59:26 GMT-0400 (Eastern D[...] Found : user_pref("CT2818425.toolbarContextMenuLastCheckTime", "Sat Mar 10 2012 12:21:47 GMT-0500 (Eastern S[...] Found : user_pref("CT2818425.usagesFlag", 2); Found : user_pref("CommunityToolbar.ETag.hxxp://Settings.toolbar.search.conduit.com/root/CT2818425/CT2818425[...] Found : user_pref("CommunityToolbar.ETag.hxxp://alerts.conduit-services.com/root/1210492/1206165/US", "\"0\"[...] Found : user_pref("CommunityToolbar.ETag.hxxp://appsmetadata.toolbar.conduit-services.com/?ctid=CT2818425", [...] Found : user_pref("CommunityToolbar.ETag.hxxp://contextmenu.toolbar.conduit-services.com/?name=GottenApps&lo[...] Found : user_pref("CommunityToolbar.ETag.hxxp://contextmenu.toolbar.conduit-services.com/?name=GottenApps&lo[...] Found : user_pref("CommunityToolbar.ETag.hxxp://contextmenu.toolbar.conduit-services.com/?name=OtherApps&loc[...] Found : user_pref("CommunityToolbar.ETag.hxxp://contextmenu.toolbar.conduit-services.com/?name=OtherApps&loc[...] Found : user_pref("CommunityToolbar.ETag.hxxp://contextmenu.toolbar.conduit-services.com/?name=SharedApps&lo[...] Found : user_pref("CommunityToolbar.ETag.hxxp://contextmenu.toolbar.conduit-services.com/?name=SharedApps&lo[...] Found : user_pref("CommunityToolbar.ETag.hxxp://contextmenu.toolbar.conduit-services.com/?name=Toolbar&local[...] Found : user_pref("CommunityToolbar.ETag.hxxp://contextmenu.toolbar.conduit-services.com/?name=Toolbar&local[...] Found : user_pref("CommunityToolbar.ETag.hxxp://dynamicdialogs.alert.conduit-services.com/alert/dlg.pkg", "\[...] Found : user_pref("CommunityToolbar.ETag.hxxp://dynamicdialogs.toolbar.conduit-services.com/DLG.pkg?ver=3.10[...] Found : user_pref("CommunityToolbar.ETag.hxxp://dynamicdialogs.toolbar.conduit-services.com/DLG.pkg?ver=3.12[...] Found : user_pref("CommunityToolbar.ETag.hxxp://dynamicdialogs.toolbar.conduit-services.com/DLG.pkg?ver=3.12[...] Found : user_pref("CommunityToolbar.ETag.hxxp://dynamicdialogs.toolbar.conduit-services.com/DLG.pkg?ver=3.13[...] Found : user_pref("CommunityToolbar.ETag.hxxp://dynamicdialogs.toolbar.conduit-services.com/DLG.pkg?ver=3.14[...] Found : user_pref("CommunityToolbar.ETag.hxxp://dynamicdialogs.toolbar.conduit-services.com/DLG.pkg?ver=3.15[...] Found : user_pref("CommunityToolbar.ETag.hxxp://servicemap.conduit-services.com/Toolbar/?ownerId=CT2818425",[...] Found : user_pref("CommunityToolbar.ETag.hxxp://translation.toolbar.conduit-services.com/?locale=en", "\"abd[...] Found : user_pref("CommunityToolbar.LatestLibsPath", "file:///C:\\Users\\Marci\\AppData\\Roaming\\Mozilla\\F[...] Found : user_pref("CommunityToolbar.LatestToolbarVersionInstalled", "3.10.0.1"); Found : user_pref("CommunityToolbar.SearchFromAddressBarSavedUrl", ""); Found : user_pref("CommunityToolbar.ToolbarsList", "CT2818425"); Found : user_pref("CommunityToolbar.ToolbarsList2", "CT2818425"); Found : user_pref("CommunityToolbar.ToolbarsList4", "CT2818425"); Found : user_pref("CommunityToolbar.facebook.settingsLastCheckTime", "Sat Mar 10 2012 12:21:46 GMT-0500 (Eas[...] Found : user_pref("CommunityToolbar.globalUserId", "ce284a29-936e-4e3d-8959-c2454901cb38"); Found : user_pref("CommunityToolbar.isAlertUrlAddedToFeedItemTable", true); Found : user_pref("CommunityToolbar.isClickActionAddedToFeedItemTable", true); Found : user_pref("CommunityToolbar.notifications.alertDialogsGetterLastCheckTime", "Sat Mar 10 2012 12:21:4[...] Found : user_pref("CommunityToolbar.notifications.alertEnabled", false); Found : user_pref("CommunityToolbar.notifications.alertInfoInterval", 1440); Found : user_pref("CommunityToolbar.notifications.alertInfoLastCheckTime", "Sat Mar 10 2012 12:21:54 GMT-050[...] Found : user_pref("CommunityToolbar.notifications.clientsServerUrl", "hxxp://alert.client.conduit.com"); Found : user_pref("CommunityToolbar.notifications.locale", ""); Found : user_pref("CommunityToolbar.notifications.loginIntervalMin", 0); Found : user_pref("CommunityToolbar.notifications.loginLastCheckTime", "Sun Mar 11 2012 15:15:59 GMT-0400 (E[...] Found : user_pref("CommunityToolbar.notifications.loginLastUpdateTime", ""); Found : user_pref("CommunityToolbar.notifications.messageShowTimeSec", 20); Found : user_pref("CommunityToolbar.notifications.servicesServerUrl", "hxxp://alert.services.conduit.com"); Found : user_pref("CommunityToolbar.notifications.showTrayIcon", false); Found : user_pref("CommunityToolbar.notifications.userCloseIntervalMin", 300); Found : user_pref("CommunityToolbar.notifications.userId", "a89fae1e-e252-4857-968b-f406d88530b2"); Found : user_pref("CommunityToolbar.originalHomepage", "hxxp://www.facebook.com/marci.gower"); Found : user_pref("CommunityToolbar.originalSearchEngine", "chrome://browser-region/locale/region.properties[...] Found : user_pref("vshare.install.date", "1329957972"); Found : user_pref("vshare.install.finished", "1.0.0"); Found : user_pref("vshare.install.fresh", "false"); Found : user_pref("vshare.install.guid", "{f691f350-1798-4560-bd1c-acf558070cd1}"); Found : user_pref("vshare.install.newtab", false); ************************* AdwCleaner[R1].txt - [18127 octets] - [10/10/2012 19:52:36] ########## EOF - C:\AdwCleaner[R1].txt - [18188 octets] ##########

RogueKiller Report: RogueKiller V8.1.1 [10/03/2012] by Tigzy mail: tigzyRK<at>gmail<dot>com Feedback: http://www.geekstogo.com/forum/files/file/413-roguekiller/ Website: http://tigzy.geekstogo.com/roguekiller.php Blog: http://tigzyrk.blogspot.com Operating System: Windows 7 (6.1.7601 Service Pack 1) 64 bits version Started in : Normal mode User : Marci [Admin rights] Mode : Scan -- Date : 10/10/2012 19:38:15 ¤¤¤ Bad processes : 0 ¤¤¤ ¤¤¤ Registry Entries : 5 ¤¤¤ [TASK][sUSP PATH] {5F6010C8-60E5-41f3-BF5B-C3AF5DBE12D4} : "C:\ProgramData\Carbonite\Carbonite Backup\CarboniteUpgrade.exe" /silent -> FOUND [DNS] HKLM\[...]\ControlSet001\Services\Interfaces\{AA180B28-E6AA-4BED-AE1A-9E3A74AEE289} : NameServer (10.197.48.1) -> FOUND [DNS] HKLM\[...]\ControlSet002\Services\Interfaces\{AA180B28-E6AA-4BED-AE1A-9E3A74AEE289} : NameServer (10.197.48.1) -> FOUND [HJ DESK] HKLM\[...]\NewStartPanel : {59031a47-3f72-44a7-89c5-5595fe6b30ee} (1) -> FOUND [HJ DESK] HKLM\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> FOUND ¤¤¤ Particular Files / Folders: ¤¤¤ ¤¤¤ Driver : [NOT LOADED] ¤¤¤ ¤¤¤ HOSTS File: ¤¤¤ --> C:\Windows\system32\drivers\etc\hosts ¤¤¤ MBR Check: ¤¤¤ +++++ PhysicalDrive0: WDC WD3200BPVT-22ZEST0 +++++ --- User --- [MBR] 2d9ca7f73f0d18cd6176639eeb124826 [bSP] ff54479be1e29a3382a6e6f5272fdc2f : Windows 7 MBR Code Partition table: 0 - [XXXXXX] ACER (0x27) [VISIBLE] Offset (sectors): 2048 | Size: 15360 Mo 1 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 31459328 | Size: 100 Mo 2 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 31664128 | Size: 289783 Mo User = LL1 ... OK! User = LL2 ... OK! +++++ PhysicalDrive1: Broadcom SD SCSI Disk Device +++++ --- User --- [MBR] 5a63b18f8797aa298b3847db3395fcd1 [bSP] df4f83c1f72e36823a12b0dfc7617313 : MBR Code unknown Partition table: 0 - [XXXXXX] FAT16 (0x06) [VISIBLE] Offset (sectors): 233 | Size: 489 Mo User = LL1 ... OK! Error reading LL2 MBR! Finished : << RKreport[1].txt >> RKreport[1].txt

never mind, didn't attach... posted below . UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG. IF REQUESTED, ZIP IT UP & ATTACH IT . DDS (Ver_2011-08-26.01) . Microsoft Windows 7 Home Premium Boot Device: \Device\HarddiskVolume2 Install Date: 8/1/2011 5:39:40 PM System Uptime: 10/10/2012 5:27:01 PM (1 hours ago) . Motherboard: Acer | | JE50_HR Processor: Intel® Core i3-2310M CPU @ 2.10GHz | CPU1 | 2100/1333mhz . ==== Disk Partitions ========================= . C: is FIXED (NTFS) - 283 GiB total, 218.008 GiB free. D: is CDROM () E: is Removable F: is Removable . ==== Disabled Device Manager Items ============= . Class GUID: {eec5ad98-8080-425f-922a-dabf3de3f69a} Description: WPD FileSystem Volume Driver Device ID: WPDBUSENUMROOT\UMB\2&37C186B&0&STORAGE#VOLUME#_??_USBSTOR#DISK&VEN_SANDISK&PROD_CRUZER&REV_1.26#200605727102E240C93D&0# Manufacturer: Microsoft Name: WPD FileSystem Volume Driver PNP Device ID: WPDBUSENUMROOT\UMB\2&37C186B&0&STORAGE#VOLUME#_??_USBSTOR#DISK&VEN_SANDISK&PROD_CRUZER&REV_1.26#200605727102E240C93D&0# Service: WUDFRd . Class GUID: {eec5ad98-8080-425f-922a-dabf3de3f69a} Description: SD Device ID: WPDBUSENUMROOT\UMB\2&37C186B&0&STORAGE#VOLUME#_??_SCSI#DISK&VEN_BROADCOM&PROD_SD&REV_0001#5&74D8BEC&0&000000# Manufacturer: Broadcom Name: LEXAR MEDIA PNP Device ID: WPDBUSENUMROOT\UMB\2&37C186B&0&STORAGE#VOLUME#_??_SCSI#DISK&VEN_BROADCOM&PROD_SD&REV_0001#5&74D8BEC&0&000000# Service: WUDFRd . ==== System Restore Points =================== . RP163: 10/7/2012 1:49:39 AM - Windows Update RP164: 10/8/2012 9:25:12 PM - Installed Java 6 Update 35 RP165: 10/9/2012 9:19:10 PM - Restore Operation RP167: 10/9/2012 9:40:46 PM - Windows Update RP169: 10/10/2012 5:05:47 PM - Windows Update . ==== Installed Programs ====================== . µTorrent Acer Backup Manager Acer Crystal Eye Webcam Acer ePower Management Acer eRecovery Management Acer Games Acer Registration Acer ScreenSaver Acer Updater Acrobat.com Adobe Acrobat X Pro - English, Français, Deutsch Adobe AIR Adobe Community Help Adobe Flash Player 11 ActiveX Adobe Flash Player 11 Plugin Adobe Media Player Adobe Photoshop CS5 Adobe Reader 9.1 MUI Agatha Christie - 4:50 from Paddington Apple Application Support Apple Software Update Backup Manager V3 BBC iPlayer Desktop Bejeweled 2 Deluxe Build-a-lot 2 Carbonite Chuzzle Deluxe clear.fi clear.fi Client D3DX10 Diner Dash 2 Restaurant Rescue Dolby Advanced Audio v2 Dora's World Adventure eBay Worldwide Expat Shield 2.24 FATE - The Traitor Soul Final Drive: Nitro Galerie de photos Windows Live Identity Card Intel® Control Center Intel® Management Engine Components Intel® Processor Graphics Intel® Rapid Storage Technology Java Auto Updater Java 6 Update 31 Jewel Quest Heritage Junk Mail filter update Launch Manager LinkedIn Outlook Connector Malwarebytes Anti-Malware version 1.65.0.1400 McAfee Security Scan Plus MediaEspresso Mesh Runtime Microsoft Office 2010 Microsoft Office Live Small Business Image Uploader Microsoft SQL Server 2005 Compact Edition [ENU] Microsoft Visual C++ 2005 Redistributable Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 Microsoft_VC80_ATL_x86 Microsoft_VC80_CRT_x86 Microsoft_VC80_MFC_x86 Microsoft_VC80_MFCLOC_x86 Microsoft_VC90_ATL_x86 Microsoft_VC90_CRT_x86 Microsoft_VC90_MFC_x86 Mozilla Firefox 15.0 (x86 en-US) Mozilla Firefox 15.0.1 (x86 en-US) Mozilla Maintenance Service MSVCRT MSVCRT_amd64 MSXML 4.0 SP2 (KB954430) MSXML 4.0 SP2 (KB973688) Mystery P.I. - Stolen in San Francisco MyWinLocker 4 MyWinLocker Suite Namco All-Stars: PAC-MAN newsXpresso NOOK for PC Norton Online Backup NTI Media Maker 9 PDF Settings CS5 Penguins! Plants vs. Zombies - Game of the Year Poker Superstars III Polar Bowler Polar Golfer QuickTime Realtek High Definition Audio Driver Security Update for Microsoft .NET Framework 4 Client Profile (KB2478663) Security Update for Microsoft .NET Framework 4 Client Profile (KB2518870) Security Update for Microsoft .NET Framework 4 Client Profile (KB2539636) Security Update for Microsoft .NET Framework 4 Client Profile (KB2572078) Security Update for Microsoft .NET Framework 4 Client Profile (KB2604121) Security Update for Microsoft .NET Framework 4 Client Profile (KB2633870) Security Update for Microsoft .NET Framework 4 Client Profile (KB2656351) Security Update for Microsoft .NET Framework 4 Client Profile (KB2656368) Security Update for Microsoft .NET Framework 4 Client Profile (KB2656368v2) Security Update for Microsoft .NET Framework 4 Client Profile (KB2656405) Security Update for Microsoft .NET Framework 4 Client Profile (KB2686827) Shredder Skype™ 5.10 Times Reader Torchlight Update for Microsoft .NET Framework 4 Client Profile (KB2468871) Update for Microsoft .NET Framework 4 Client Profile (KB2533523) Update for Microsoft .NET Framework 4 Client Profile (KB2600217) Update Installer for WildTangent Games App Virtual Villagers 4 - The Tree of Life vshare.tv Bar Toolbar vShare.tv plugin 1.3 Welcome Center WildTangent Games App (Acer Games) Windows Live Windows Live Communications Platform Windows Live Essentials Windows Live Installer Windows Live Mail Windows Live Mesh Windows Live Messenger Windows Live Movie Maker Windows Live Photo Common Windows Live Photo Gallery Windows Live PIMT Platform Windows Live SOXE Windows Live SOXE Definitions Windows Live UX Platform Windows Live UX Platform Language Pack Windows Live Writer Windows Live Writer Resources Zuma's Revenge . ==== Event Viewer Messages From Past Week ======== . 10/9/2012 9:55:58 PM, Error: Microsoft Antimalware [3002] - Microsoft Antimalware Real-Time Protection feature has encountered an error and failed. Feature: Network Inspection System Error Code: 0x8007045b Error description: A system shutdown is in progress. Reason: The system is missing updates that are required for running Network Inspection System. Install the required updates and restart the computer. 10/9/2012 9:45:58 PM, Error: Microsoft Antimalware [3002] - Microsoft Antimalware Real-Time Protection feature has encountered an error and failed. Feature: Network Inspection System Error Code: 0x80070714 Error description: The specified image file did not contain a resource section. Reason: The system is missing updates that are required for running Network Inspection System. Install the required updates and restart the computer. 10/9/2012 9:41:50 PM, Error: Microsoft-Windows-WindowsUpdateClient [20] - Installation Failure: Windows failed to install the following update with error 0x80070643: Definition Update for Microsoft Security Essentials - KB2310138 (Definition 1.137.1428.0). 10/9/2012 9:41:25 PM, Error: Microsoft Antimalware [3002] - Microsoft Antimalware Real-Time Protection feature has encountered an error and failed. Feature: Network Inspection System Error Code: 0x80070714 Error description: The specified image file did not contain a resource section. Reason: Antimalware protection has stopped functioning for an unknown reason. In some instances, restarting the service may resolve the problem. 10/9/2012 9:41:24 PM, Error: Microsoft Antimalware [2003] - Microsoft Antimalware has encountered an error trying to update the engine. New Engine Version: Previous Engine Version: 2.1.8600.0 Engine Type: Network Inspection System User: NT AUTHORITY\SYSTEM Error Code: 0x80070714 Error description: The specified image file did not contain a resource section. 10/9/2012 9:41:24 PM, Error: Microsoft Antimalware [2001] - Microsoft Antimalware has encountered an error trying to update signatures. New Signature Version: Previous Signature Version: 15.11.0.0 Update Source: User Update Stage: Install Source Path: Signature Type: Network Inspection System Update Type: Full User: NT AUTHORITY\SYSTEM Current Engine Version: Previous Engine Version: 2.1.8600.0 Error code: 0x80070714 Error description: The specified image file did not contain a resource section. 10/9/2012 9:41:24 PM, Error: Microsoft Antimalware [2001] - Microsoft Antimalware has encountered an error trying to update signatures. New Signature Version: Previous Signature Version: 1.137.1428.0 Update Source: Microsoft Update Server Update Stage: Install Source Path: http://www.microsoft.com Signature Type: AntiVirus Update Type: Full User: NT AUTHORITY\SYSTEM Current Engine Version: Previous Engine Version: 1.1.8800.0 Error code: 0x80070643 Error description: Fatal error during installation. 10/9/2012 9:35:42 PM, Error: Service Control Manager [7031] - The CarboniteService service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service. 10/9/2012 9:24:44 PM, Error: Microsoft Antimalware [3002] - Microsoft Antimalware Real-Time Protection feature has encountered an error and failed. Feature: Network Inspection System Error Code: 0x80070714 Error description: The specified image file did not contain a resource section. Reason: The system is missing updates that are required for running Network Inspection System. Install the required updates and restart the computer. 10/9/2012 9:24:33 PM, Error: Microsoft Antimalware [2004] - Microsoft Antimalware has encountered an error trying to load signatures and will attempt reverting back to a known-good set of signatures. Signatures Attempted: Current Error Code: 0x80070002 Error description: The system cannot find the file specified. Signature version: 1.137.851.0;1.137.851.0 Engine version: 1.1.8800.0 10/9/2012 9:23:28 PM, Error: Microsoft-Windows-Kernel-General [5] - {Registry Hive Recovered} Registry hive (file): '\??\Volume{a89333b3-7ed5-11e0-942b-806e6f6e6963}\System Volume Information\SystemRestore\{41E15251-8C93-4F8D-8158-20B72308443F}' was corrupted and it has been recovered. Some data might have been lost. 10/9/2012 5:01:52 PM, Error: Service Control Manager [7000] - The Sendori service failed to start due to the following error: The system cannot find the file specified. 10/9/2012 10:54:29 PM, Error: Microsoft Antimalware [3002] - Microsoft Antimalware Real-Time Protection feature has encountered an error and failed. Feature: Network Inspection System Error Code: 0x80070714 Error description: The specified image file did not contain a resource section. Reason: The system is missing updates that are required for running Network Inspection System. Install the required updates and restart the computer. 10/9/2012 10:53:00 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1068" attempting to start the service fdPHost with arguments "" in order to run the server: {D3DCB472-7261-43CE-924B-0704BD730D5F} 10/9/2012 10:53:00 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1068" attempting to start the service fdPHost with arguments "" in order to run the server: {145B4335-FE2A-4927-A040-7C35AD3180EF} 10/9/2012 10:52:57 PM, Error: Service Control Manager [7001] - The HomeGroup Provider service depends on the Function Discovery Provider Host service which failed to start because of the following error: The dependency service or group failed to start. 10/9/2012 10:52:49 PM, Error: Service Control Manager [7001] - The Computer Browser service depends on the Server service which failed to start because of the following error: The dependency service or group failed to start. 10/9/2012 10:52:46 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service WSearch with arguments "" in order to run the server: {9E175B6D-F52A-11D8-B9A5-505054503030} 10/9/2012 10:52:46 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service WSearch with arguments "" in order to run the server: {7D096C5F-AC08-4F1F-BEB7-5C22C517CE39} 10/9/2012 10:52:44 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service EventSystem with arguments "" in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF} 10/9/2012 10:52:43 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service CarboniteService with arguments "" in order to run the server: {36471C67-6A93-4434-92CC-4C614CD06666} 10/9/2012 10:52:35 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service ShellHWDetection with arguments "" in order to run the server: {DD522ACC-F821-461A-A407-50B198B896DC} 10/9/2012 10:52:30 PM, Error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: discache MpFilter mwlPSDFilter mwlPSDNServ mwlPSDVDisk spldr Wanarpv6 10/9/2012 10:46:57 PM, Error: Microsoft Antimalware [3002] - Microsoft Antimalware Real-Time Protection feature has encountered an error and failed. Feature: Network Inspection System Error Code: 0x80070714 Error description: The specified image file did not contain a resource section. Reason: The system is missing updates that are required for running Network Inspection System. Install the required updates and restart the computer. 10/8/2012 8:30:06 PM, Error: Service Control Manager [7034] - The Application Sendori service terminated unexpectedly. It has done this 1 time(s). 10/8/2012 5:18:35 PM, Error: Ntfs [55] - The file system structure on the disk is corrupt and unusable. Please run the chkdsk utility on the volume Acer. 10/8/2012 2:07:16 PM, Error: Service Control Manager [7034] - The Sendoriv1 service terminated unexpectedly. It has done this 1 time(s). 10/8/2012 2:06:36 PM, Error: Service Control Manager [7009] - A timeout was reached (30000 milliseconds) while waiting for the Service Sendori service to connect. 10/8/2012 2:06:36 PM, Error: Service Control Manager [7000] - The Service Sendori service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion. 10/4/2012 9:12:42 AM, Error: Microsoft-Windows-WER-SystemErrorReporting [1001] - The computer has rebooted from a bugcheck. The bugcheck was: 0x0000009f (0x0000000000000003, 0xfffffa8004029e30, 0xfffff80000b9c3d8, 0xfffffa800909b320). A dump was saved in: C:\Windows\MEMORY.DMP. Report Id: 100412-62681-01. 10/10/2012 5:41:20 PM, Error: Microsoft-Windows-Kernel-General [5] - {Registry Hive Recovered} Registry hive (file): '\??\C:\Windows\System32\SMI\Store\Machine\SCHEMA.DAT' was corrupted and it has been recovered. Some data might have been lost. 10/10/2012 5:29:58 PM, Error: Service Control Manager [7001] - The Intel® Management and Security Application User Notification Service service depends on the Intel® Management and Security Application Local Management Service service which failed to start because of the following error: The system cannot find the file specified. 10/10/2012 5:29:58 PM, Error: Service Control Manager [7000] - The Intel® Management and Security Application Local Management Service service failed to start due to the following error: The system cannot find the file specified. 10/10/2012 5:29:54 PM, Error: Service Control Manager [7000] - The Intel® Rapid Storage Technology service failed to start due to the following error: Access is denied. 10/10/2012 5:27:53 PM, Error: Microsoft Antimalware [3002] - Microsoft Antimalware Real-Time Protection feature has encountered an error and failed. Feature: Network Inspection System Error Code: 0x80070714 Error description: The specified image file did not contain a resource section. Reason: The system is missing updates that are required for running Network Inspection System. Install the required updates and restart the computer. 10/10/2012 5:27:51 PM, Error: Service Control Manager [7000] - The NTI IScheduleSvc service failed to start due to the following error: The system cannot find the file specified. 10/10/2012 5:27:51 PM, Error: Service Control Manager [7000] - The Norton Online Backup service failed to start due to the following error: Access is denied. 10/10/2012 5:27:51 PM, Error: Service Control Manager [7000] - The GREGService service failed to start due to the following error: The system cannot find the file specified. 10/10/2012 5:27:51 PM, Error: Service Control Manager [7000] - The Expat Shield Service service failed to start due to the following error: The system cannot find the file specified. 10/10/2012 5:27:51 PM, Error: Service Control Manager [7000] - The Expat Shield Routing Service service failed to start due to the following error: The system cannot find the file specified. 10/10/2012 5:27:51 PM, Error: Service Control Manager [7000] - The Expat Shield Monitoring Service service failed to start due to the following error: The system cannot find the file specified. 10/10/2012 5:27:51 PM, Error: Service Control Manager [7000] - The Dritek WMI Service service failed to start due to the following error: The system cannot find the file specified. . ==== End Of File ===========================

Attach.txt.. erm.. attached! I'll run rogue killer now. Thanks for the quick reply!

My wife was on the net over the weekend and has been complaining of slowness on her system, no popups, but I did notice an installation of ilivid had appeared in her Programs control panel. I scanned with MSE and removed the rogue java entries that popped up. I then did a system restore to last week. (this probably wasn't the best thing to do thinking about it, but well, can't roll back, the roll back). I ran MBAM in safe mode and removed some myWebSearch stuff from the PC. Rebooted, ran MBAM again in normal mode with nothing found. Symptoms: Nothing in the Start Menu > Programs, unable to open certain exe files (iexplore, firefox) and it seems some permission changes on her user directory. There are no issues with opening files in safe mode. Many thanks in advance for the help! DDS log: . DDS (Ver_2011-08-26.01) - NTFSAMD64 Internet Explorer: 9.0.8112.16421 BrowserJavaVersion: 1.6.0_31 Run by Marci at 18:23:24 on 2012-10-10 Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.3948.2549 [GMT -4:00] . AV: Microsoft Security Essentials *Enabled/Updated* {B140BF4E-23BB-4198-90AB-A51A4C60A69C} SP: Microsoft Security Essentials *Enabled/Updated* {0A215EAA-0581-4E16-AA1B-9E6837E7EC21} SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} . ============== Running Processes =============== . C:\Windows\system32\wininit.exe C:\Windows\system32\lsm.exe C:\Windows\system32\svchost.exe -k DcomLaunch C:\Windows\system32\svchost.exe -k RPCSS c:\Program Files\Microsoft Security Client\MsMpEng.exe C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted C:\Windows\system32\svchost.exe -k netsvcs C:\Windows\system32\svchost.exe -k LocalService C:\Windows\system32\svchost.exe -k NetworkService C:\Windows\System32\spoolsv.exe C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe C:\Program Files\Bonjour\mDNSResponder.exe C:\Program Files\Carbonite\Carbonite Backup\carboniteservice.exe C:\Program Files\Acer\Acer ePower Management\ePowerSvc.exe C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation C:\Program Files\Acer\Acer Updater\UpdaterService.exe C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted C:\Windows\system32\SearchIndexer.exe C:\Program Files\Windows Media Player\wmpnetwk.exe C:\Windows\system32\wbem\wmiprvse.exe C:\Windows\system32\taskhost.exe C:\Windows\system32\Dwm.exe C:\Windows\Explorer.EXE C:\Windows\system32\igfxtray.exe C:\Windows\system32\hkcmd.exe C:\Windows\system32\igfxpers.exe C:\Program Files\Synaptics\SynTP\SynTPEnh.exe C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe C:\Windows\system32\igfxsrvc.exe C:\Program Files\Microsoft Security Client\msseces.exe C:\Windows\system32\igfxext.exe C:\Windows\system32\wbem\unsecapp.exe C:\Program Files\Acer\Acer ePower Management\ePowerEvent.exe C:\Program Files\Synaptics\SynTP\SynTPHelper.exe C:\Windows\system32\wuauclt.exe C:\Windows\system32\vssvc.exe C:\Windows\System32\svchost.exe -k swprv C:\Windows\system32\taskhost.exe C:\Windows\system32\DllHost.exe C:\Windows\system32\DllHost.exe C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\conhost.exe C:\Windows\SysWOW64\cscript.exe C:\Windows\system32\wbem\wmiprvse.exe . ============== Pseudo HJT Report =============== . uStart Page = hxxp://acer.msn.com uDefault_Page_URL = hxxp://acer.msn.com mDefault_Page_URL = hxxp://acer.msn.com mStart Page = hxxp://acer.msn.com uInternet Settings,ProxyOverride = *.local uURLSearchHooks: vshare.tv Bar Toolbar: {7aeb3efd-e564-43f1-b658-5058a7c5743b} - C:\Program Files (x86)\vshare.tv_Bar\prxtbvsha.dll mURLSearchHooks: vshare.tv Bar Toolbar: {7aeb3efd-e564-43f1-b658-5058a7c5743b} - C:\Program Files (x86)\vshare.tv_Bar\prxtbvsha.dll mWinlogon: Userinit=userinit.exe, BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll BHO: Expat Shield Class: {3706ee7c-3cad-445d-8a43-03ebc3b75908} - C:\Program Files (x86)\Expat Shield\HssIE\ExpatIE.dll BHO: Groove GFS Browser Helper: {72853161-30c5-4d22-b7f9-0bbc1d38a37e} - C:\PROGRA~2\MICROS~4\Office14\GROOVEEX.DLL BHO: Java™ Plug-In SSV Helper: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - C:\Program Files (x86)\Java\jre6\bin\ssv.dll BHO: vshare.tv Bar Toolbar: {7aeb3efd-e564-43f1-b658-5058a7c5743b} - C:\Program Files (x86)\vshare.tv_Bar\prxtbvsha.dll BHO: Windows Live ID Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll BHO: Adobe PDF Conversion Toolbar Helper: {ae7cd045-e861-484f-8273-0445ee161910} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll BHO: Office Document Cache Handler: {b4f3a835-0e21-4959-ba22-42b3008e02ff} - C:\PROGRA~2\MICROS~4\Office14\URLREDIR.DLL BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll BHO: SmartSelect Class: {f4971ee7-daa0-4053-9964-665d8ee6a077} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll TB: Adobe PDF: {47833539-d0c5-4125-9fa8-0819e2eaac93} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll TB: vshare.tv Bar Toolbar: {7aeb3efd-e564-43f1-b658-5058a7c5743b} - C:\Program Files (x86)\vshare.tv_Bar\prxtbvsha.dll uRun: [iSUSPM] C:\ProgramData\FLEXnet\Connect\11\ISUSPM.exe -scheduler mRun: [iAStorIcon] C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe mRun: [suiteTray] "C:\Program Files (x86)\EgisTec MyWinLockerSuite\x86\SuiteTray.exe" mRun: [EgisTecPMMUpdate] "C:\Program Files (x86)\EgisTec IPS\PmmUpdate.exe" mRun: [EgisUpdate] "C:\Program Files (x86)\EgisTec IPS\EgisUpdate.exe" -d mRun: [Norton Online Backup] C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuClient.exe mRun: [Adobe Reader Speed Launcher] "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe" mRun: [backupManagerTray] "C:\Program Files (x86)\NTI\Acer Backup Manager\BackupManagerTray.exe" -h -k mRun: [LManager] C:\Program Files (x86)\Launch Manager\LManager.exe mRun: [Dolby Advanced Audio v2] "C:\Dolby PCEE4\pcee4.exe" -autostart mRun: [ArcadeMovieService] "C:\Program Files (x86)\Acer\clear.fi\Movie\clear.fiMovieService.exe" mRun: [Carbonite Backup] C:\Program Files (x86)\Carbonite\Carbonite Backup\CarboniteUI.exe mRun: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" mRun: [<NO NAME>] mRun: [Adobe Acrobat Speed Launcher] "C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Acrobat_sl.exe" mRun: [Acrobat Assistant 8.0] "C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Acrotray.exe" mRun: [switchBoard] C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe mRun: [AdobeCS5ServiceManager] "C:\Program Files (x86)\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe" -launchedbylogin mRun: [APSDaemon] "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" mRun: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime mRun: [iTunesHelper] "C:\Program Files (x86)\iTunes\iTunesHelper.exe" mRun: [sunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe" dRunOnce: [isMyWinLockerReboot] msiexec.exe /qn /x{voidguid} StartupFolder: C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\Startup\MCAFEE~1.LNK - C:\Program Files (x86)\McAfee Security Scan\3.0.207\SSScheduler.exe mPolicies-explorer: NoActiveDesktop = 1 (0x1) mPolicies-system: ConsentPromptBehaviorAdmin = 5 (0x5) mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3) mPolicies-system: EnableUIADesktopToggle = 0 (0x0) IE: Append Link Target to Existing PDF - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html IE: Append to Existing PDF - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html IE: Convert Link Target to Adobe PDF - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html IE: Convert to Adobe PDF - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECapture.html IE: E&xport to Microsoft Excel - C:\PROGRA~1\MICROS~3\Office14\EXCEL.EXE/3000 IE: Se&nd to OneNote - C:\PROGRA~1\MICROS~3\Office14\ONBttnIE.dll/105 IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIE.dll IE: {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - {FFFDC614-B694-4AE6-AB38-5D6374584B52} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIELinkedNotes.dll DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab DPF: {CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab TCP: DhcpNameServer = 10.0.0.1 TCP: Interfaces\{43F073EE-7D78-4DC8-BC61-DB9FCB9A4C62} : DhcpNameServer = 10.0.0.1 TCP: Interfaces\{43F073EE-7D78-4DC8-BC61-DB9FCB9A4C62}\E4544574541425 : DhcpNameServer = 10.0.0.1 TCP: Interfaces\{AA180B28-E6AA-4BED-AE1A-9E3A74AEE289} : NameServer = 10.197.48.1 Filter: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\MSOXMLMF.DLL Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files (x86)\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll SEH: Groove GFS Stub Execution Hook: {b5a7f190-dda6-4420-b3ba-52453494e6cd} - C:\PROGRA~2\MICROS~4\Office14\GROOVEEX.DLL BHO-X64: Adobe PDF Link Helper: {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll BHO-X64: AcroIEHelperStub - No File BHO-X64: Expat Shield Class: {3706EE7C-3CAD-445D-8A43-03EBC3B75908} - C:\Program Files (x86)\Expat Shield\HssIE\ExpatIE.dll BHO-X64: Groove GFS Browser Helper: {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~2\MICROS~4\Office14\GROOVEEX.DLL BHO-X64: Java™ Plug-In SSV Helper: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre6\bin\ssv.dll BHO-X64: vshare.tv Bar Toolbar: {7aeb3efd-e564-43f1-b658-5058a7c5743b} - C:\Program Files (x86)\vshare.tv_Bar\prxtbvsha.dll BHO-X64: vshare.tv Bar - No File BHO-X64: Windows Live ID Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll BHO-X64: Adobe PDF Conversion Toolbar Helper: {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll BHO-X64: Office Document Cache Handler: {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~2\MICROS~4\Office14\URLREDIR.DLL BHO-X64: URLRedirectionBHO - No File BHO-X64: Java™ Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll BHO-X64: SmartSelect Class: {F4971EE7-DAA0-4053-9964-665D8EE6A077} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll BHO-X64: SmartSelect - No File TB-X64: Adobe PDF: {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll TB-X64: vshare.tv Bar Toolbar: {7aeb3efd-e564-43f1-b658-5058a7c5743b} - C:\Program Files (x86)\vshare.tv_Bar\prxtbvsha.dll mRun-x64: [iAStorIcon] C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe mRun-x64: [suiteTray] "C:\Program Files (x86)\EgisTec MyWinLockerSuite\x86\SuiteTray.exe" mRun-x64: [EgisTecPMMUpdate] "C:\Program Files (x86)\EgisTec IPS\PmmUpdate.exe" mRun-x64: [EgisUpdate] "C:\Program Files (x86)\EgisTec IPS\EgisUpdate.exe" -d mRun-x64: [Norton Online Backup] C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuClient.exe mRun-x64: [Adobe Reader Speed Launcher] "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe" mRun-x64: [backupManagerTray] "C:\Program Files (x86)\NTI\Acer Backup Manager\BackupManagerTray.exe" -h -k mRun-x64: [LManager] C:\Program Files (x86)\Launch Manager\LManager.exe mRun-x64: [Dolby Advanced Audio v2] "C:\Dolby PCEE4\pcee4.exe" -autostart mRun-x64: [ArcadeMovieService] "C:\Program Files (x86)\Acer\clear.fi\Movie\clear.fiMovieService.exe" mRun-x64: [Carbonite Backup] C:\Program Files (x86)\Carbonite\Carbonite Backup\CarboniteUI.exe mRun-x64: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" mRun-x64: [(Default)] mRun-x64: [Adobe Acrobat Speed Launcher] "C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Acrobat_sl.exe" mRun-x64: [Acrobat Assistant 8.0] "C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Acrotray.exe" mRun-x64: [switchBoard] C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe mRun-x64: [AdobeCS5ServiceManager] "C:\Program Files (x86)\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe" -launchedbylogin mRun-x64: [APSDaemon] "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" mRun-x64: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime mRun-x64: [iTunesHelper] "C:\Program Files (x86)\iTunes\iTunesHelper.exe" mRun-x64: [sunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe" SEH-X64: Groove GFS Stub Execution Hook: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\PROGRA~2\MICROS~4\Office14\GROOVEEX.DLL . ================= FIREFOX =================== . FF - ProfilePath - C:\Users\Marci\AppData\Roaming\Mozilla\Firefox\Profiles\o3zmyekh.default\ FF - prefs.js: browser.startup.homepage - hxxp://www.facebook.com/marci.gower FF - plugin: C:\PROGRA~2\MICROS~4\Office14\NPAUTHZ.DLL FF - plugin: C:\PROGRA~2\MICROS~4\Office14\NPSPWRAP.DLL FF - plugin: C:\Program Files (x86)\Java\jre6\bin\plugin2\npdeployJava1.dll FF - plugin: C:\Program Files (x86)\Java\jre6\bin\plugin2\npjp2.dll FF - plugin: c:\Program Files (x86)\Microsoft Silverlight\5.1.10411.0\npctrlui.dll FF - plugin: C:\Program Files (x86)\Mozilla Firefox\plugins\npdeployJava1.dll FF - plugin: C:\Program Files (x86)\Mozilla Firefox\plugins\npvsharetvplg.dll FF - plugin: C:\Program Files (x86)\WildTangent Games\App\BrowserIntegration\Registered\0\NP_wtapp.dll FF - plugin: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll FF - plugin: C:\Users\Marci\AppData\Roaming\Mozilla\Firefox\Profiles\o3zmyekh.default\extensions\{7aeb3efd-e564-43f1-b658-5058a7c5743b}\plugins\np-mswmp.dll FF - plugin: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_4_402_265.dll . ============= SERVICES / DRIVERS =============== . R0 MpFilter;Microsoft Malware Protection Driver;C:\Windows\system32\DRIVERS\MpFilter.sys --> C:\Windows\system32\DRIVERS\MpFilter.sys [?] R1 mwlPSDFilter;mwlPSDFilter;C:\Windows\system32\DRIVERS\mwlPSDFilter.sys --> C:\Windows\system32\DRIVERS\mwlPSDFilter.sys [?] R1 mwlPSDNServ;mwlPSDNServ;C:\Windows\system32\DRIVERS\mwlPSDNServ.sys --> C:\Windows\system32\DRIVERS\mwlPSDNServ.sys [?] R1 mwlPSDVDisk;mwlPSDVDisk;C:\Windows\system32\DRIVERS\mwlPSDVDisk.sys --> C:\Windows\system32\DRIVERS\mwlPSDVDisk.sys [?] R1 vwififlt;Virtual WiFi Filter Driver;C:\Windows\system32\DRIVERS\vwififlt.sys --> C:\Windows\system32\DRIVERS\vwififlt.sys [?] R2 ePowerSvc;Acer ePower Service;C:\Program Files\Acer\Acer ePower Management\ePowerSvc.exe [2011-5-15 873064] R2 Live Updater Service;Live Updater Service;C:\Program Files\Acer\Acer Updater\UpdaterService.exe [2011-4-6 244624] R3 b57xdbd;Broadcom xD Picture Bus Driver Service;C:\Windows\system32\drivers\b57xdbd.sys --> C:\Windows\system32\drivers\b57xdbd.sys [?] R3 b57xdmp;Broadcom xD Picture vstorp client drv;C:\Windows\system32\drivers\b57xdmp.sys --> C:\Windows\system32\drivers\b57xdmp.sys [?] R3 bScsiMSa;bScsiMSa;C:\Windows\system32\drivers\bScsiMSa.sys --> C:\Windows\system32\drivers\bScsiMSa.sys [?] R3 bScsiSDa;bScsiSDa;C:\Windows\system32\DRIVERS\bScsiSDa.sys --> C:\Windows\system32\DRIVERS\bScsiSDa.sys [?] R3 IntcDAud;Intel® Display Audio;C:\Windows\system32\DRIVERS\IntcDAud.sys --> C:\Windows\system32\DRIVERS\IntcDAud.sys [?] R3 k57nd60a;Broadcom NetLink ™ Gigabit Ethernet - NDIS 6.0;C:\Windows\system32\DRIVERS\k57nd60a.sys --> C:\Windows\system32\DRIVERS\k57nd60a.sys [?] R3 MEIx64;Intel® Management Engine Interface;C:\Windows\system32\DRIVERS\HECIx64.sys --> C:\Windows\system32\DRIVERS\HECIx64.sys [?] S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384] S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-3-18 138576] S2 DsiWMIService;Dritek WMI Service;C:\Program Files (x86)\Launch Manager\dsiwmis.exe [2011-4-6 352336] S2 ExpatShieldService;Expat Shield Service;C:\Program Files (x86)\Expat Shield\bin\openvpnas.exe [2012-1-6 331608] S2 ExpatSrv;Expat Shield Routing Service;C:\Program Files (x86)\Expat Shield\HssWPR\hsssrv.exe [2012-1-4 363336] S2 ExpatWd;Expat Shield Monitoring Service;C:\Program Files (x86)\Expat Shield\bin\hsswd.exe -product Expat --> C:\Program Files (x86)\Expat Shield\bin\hsswd.exe -product Expat [?] S2 GREGService;GREGService;C:\Program Files (x86)\Acer\Registration\GREGsvc.exe [2010-1-8 23584] S2 IAStorDataMgrSvc;Intel® Rapid Storage Technology;C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe [2011-4-6 13336] S2 NOBU;Norton Online Backup;C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe [2010-6-1 2804568] S2 NTI IScheduleSvc;NTI IScheduleSvc;C:\Program Files (x86)\NTI\Acer Backup Manager\IScheduleSvc.exe [2011-2-15 257344] S2 SkypeUpdate;Skype Updater;C:\Program Files (x86)\Skype\Updater\Updater.exe [2012-7-13 160944] S2 UNS;Intel® Management and Security Application User Notification Service;C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe [2011-5-15 2656280] S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-8-12 250808] S3 EgisTec Ticket Service;EgisTec Ticket Service;C:\Program Files (x86)\Common Files\EgisTec\Services\EgisTicketService.exe [2010-9-27 172912] S3 ExpatTrayService;Expat Shield Tray Service;C:\Program Files (x86)\Expat Shield\bin\ExpatTrayService.exe [2012-1-6 77520] S3 GamesAppService;GamesAppService;C:\Program Files (x86)\WildTangent Games\App\GamesAppService.exe [2010-10-12 206072] S3 McComponentHostService;McAfee Security Scan Component Host Service;C:\Program Files (x86)\McAfee Security Scan\3.0.207\McCHSvc.exe [2011-6-17 237008] S3 Microsoft SharePoint Workspace Audit Service;Microsoft SharePoint Workspace Audit Service;C:\Program Files\Microsoft Office\Office14\GROOVE.EXE [2011-6-12 51740536] S3 MozillaMaintenance;Mozilla Maintenance Service;C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe [2012-8-12 114144] S3 NisDrv;Microsoft Network Inspection System;C:\Windows\system32\DRIVERS\NisDrvWFP.sys --> C:\Windows\system32\DRIVERS\NisDrvWFP.sys [?] S3 NisSrv;Microsoft Network Inspection;C:\Program Files\Microsoft Security Client\NisSrv.exe [2012-9-12 368896] S3 ose64;Office 64 Source Engine;C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2010-1-9 174440] S3 osppsvc;Office Software Protection Platform;C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-1-9 4925184] S3 SwitchBoard;Adobe SwitchBoard;C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [2010-2-19 517096] S3 TsUsbFlt;TsUsbFlt;C:\Windows\system32\drivers\tsusbflt.sys --> C:\Windows\system32\drivers\tsusbflt.sys [?] S3 TsUsbGD;Remote Desktop Generic USB Device;C:\Windows\system32\drivers\TsUsbGD.sys --> C:\Windows\system32\drivers\TsUsbGD.sys [?] S3 USBAAPL64;Apple Mobile USB Driver;C:\Windows\system32\Drivers\usbaapl64.sys --> C:\Windows\system32\Drivers\usbaapl64.sys [?] S3 WatAdminSvc;Windows Activation Technologies Service;C:\Windows\system32\Wat\WatAdminSvc.exe --> C:\Windows\system32\Wat\WatAdminSvc.exe [?] S3 WSDPrintDevice;WSD Print Support via UMB;C:\Windows\system32\DRIVERS\WSDPrint.sys --> C:\Windows\system32\DRIVERS\WSDPrint.sys [?] S4 wlcrasvc;Windows Live Mesh remote connections service;C:\Program Files\Windows Live\Mesh\wlcrasvc.exe [2010-9-22 57184] . =============== Created Last 30 ================ . 2012-10-10 02:01:14 -------- d-----w- C:\Users\Marci\AppData\Roaming\Malwarebytes 2012-10-10 02:01:07 25928 ----a-w- C:\Windows\System32\drivers\mbam.sys 2012-10-10 02:01:07 -------- d-----w- C:\ProgramData\Malwarebytes 2012-10-10 02:01:06 -------- d-----w- C:\Program Files (x86)\Malwarebytes' Anti-Malware 2012-10-10 01:42:13 1659760 ----a-w- C:\Windows\System32\drivers\ntfs.sys 2012-10-10 01:39:47 2048 ----a-w- C:\Windows\SysWow64\tzres.dll 2012-10-10 01:39:47 2048 ----a-w- C:\Windows\System32\tzres.dll 2012-10-10 01:39:29 715776 ----a-w- C:\Windows\System32\kerberos.dll 2012-10-10 01:39:29 542208 ----a-w- C:\Windows\SysWow64\kerberos.dll 2012-10-10 01:39:16 1464320 ----a-w- C:\Windows\System32\crypt32.dll 2012-10-10 01:39:15 184320 ----a-w- C:\Windows\System32\cryptsvc.dll 2012-10-10 01:39:15 140288 ----a-w- C:\Windows\SysWow64\cryptsvc.dll 2012-10-10 01:39:15 140288 ----a-w- C:\Windows\System32\cryptnet.dll 2012-10-10 01:39:15 1159680 ----a-w- C:\Windows\SysWow64\crypt32.dll 2012-10-10 01:39:15 103936 ----a-w- C:\Windows\SysWow64\cryptnet.dll 2012-10-07 14:48:51 -------- d-----w- C:\Users\Marci\AppData\Local\TelevisionFanatic 2012-10-07 14:47:43 -------- d-----w- C:\Users\Marci\AppData\Local\dealcabby 2012-10-07 14:47:40 -------- d-----w- C:\ProgramData\Sendori 2012-10-07 14:47:38 -------- d-----w- C:\Program Files (x86)\PricePeep 2012-10-07 14:47:38 -------- d-----w- C:\Program Files (x86)\FLVPlayer 2012-10-07 14:47:37 -------- d-----w- C:\Program Files (x86)\Sendori 2012-10-07 14:39:02 -------- d-----w- C:\Program Files (x86)\TelevisionFanatic 2012-10-07 14:11:15 -------- d-----w- C:\Users\Marci\AppData\Local\Ilivid Player 2012-10-07 14:10:51 -------- d-----w- C:\Program Files (x86)\iLivid 2012-09-30 04:21:30 972192 ------w- C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{A03729AC-2912-46FF-93F5-F55302D7C2EB}\gapaengine.dll 2012-09-29 02:49:32 245760 ----a-w- C:\Windows\System32\OxpsConverter.exe 2012-09-11 22:09:55 950128 ----a-w- C:\Windows\System32\drivers\ndis.sys 2012-09-11 22:09:54 574464 ----a-w- C:\Windows\System32\d3d10level9.dll 2012-09-11 22:09:54 490496 ----a-w- C:\Windows\SysWow64\d3d10level9.dll 2012-09-11 22:09:54 41472 ----a-w- C:\Windows\System32\drivers\RNDISMP.sys 2012-09-11 22:09:53 376688 ----a-w- C:\Windows\System32\drivers\netio.sys 2012-09-11 22:09:53 288624 ----a-w- C:\Windows\System32\drivers\FWPKCLNT.SYS 2012-09-11 22:09:53 1913200 ----a-w- C:\Windows\System32\drivers\tcpip.sys . ==================== Find3M ==================== . 2012-10-10 21:07:16 73656 ----a-w- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl 2012-10-10 21:07:16 696760 ----a-w- C:\Windows\SysWow64\FlashPlayerApp.exe 2012-08-31 02:03:48 228768 ----a-w- C:\Windows\System32\drivers\MpFilter.sys 2012-08-31 02:03:48 128456 ----a-w- C:\Windows\System32\drivers\NisDrvWFP.sys 2012-08-30 18:03:45 5559664 ----a-w- C:\Windows\System32\ntoskrnl.exe 2012-08-30 17:12:02 3968880 ----a-w- C:\Windows\SysWow64\ntkrnlpa.exe 2012-08-30 17:12:02 3914096 ----a-w- C:\Windows\SysWow64\ntoskrnl.exe 2012-08-24 18:05:07 220160 ----a-w- C:\Windows\System32\wintrust.dll 2012-08-24 16:57:48 172544 ----a-w- C:\Windows\SysWow64\wintrust.dll 2012-08-24 10:31:32 2312704 ----a-w- C:\Windows\System32\jscript9.dll 2012-08-24 10:21:18 1392128 ----a-w- C:\Windows\System32\wininet.dll 2012-08-24 10:20:11 1494528 ----a-w- C:\Windows\System32\inetcpl.cpl 2012-08-24 10:14:45 173056 ----a-w- C:\Windows\System32\ieUnatt.exe 2012-08-24 10:13:29 599040 ----a-w- C:\Windows\System32\vbscript.dll 2012-08-24 10:09:42 2382848 ----a-w- C:\Windows\System32\mshtml.tlb 2012-08-24 06:59:17 1800704 ----a-w- C:\Windows\SysWow64\jscript9.dll 2012-08-24 06:51:27 1129472 ----a-w- C:\Windows\SysWow64\wininet.dll 2012-08-24 06:51:02 1427968 ----a-w- C:\Windows\SysWow64\inetcpl.cpl 2012-08-24 06:47:26 142848 ----a-w- C:\Windows\SysWow64\ieUnatt.exe 2012-08-24 06:47:12 420864 ----a-w- C:\Windows\SysWow64\vbscript.dll 2012-08-24 06:43:58 2382848 ----a-w- C:\Windows\SysWow64\mshtml.tlb 2012-08-20 18:48:44 362496 ----a-w- C:\Windows\System32\wow64win.dll 2012-08-20 18:48:44 243200 ----a-w- C:\Windows\System32\wow64.dll 2012-08-20 18:48:44 13312 ----a-w- C:\Windows\System32\wow64cpu.dll 2012-08-20 18:48:43 215040 ----a-w- C:\Windows\System32\winsrv.dll 2012-08-20 18:48:37 16384 ----a-w- C:\Windows\System32\ntvdm64.dll 2012-08-20 18:48:35 424448 ----a-w- C:\Windows\System32\KernelBase.dll 2012-08-20 18:46:22 338432 ----a-w- C:\Windows\System32\conhost.exe 2012-08-20 17:40:21 14336 ----a-w- C:\Windows\SysWow64\ntvdm64.dll 2012-08-20 17:38:44 44032 ----a-w- C:\Windows\apppatch\acwow64.dll 2012-08-20 17:38:26 25600 ----a-w- C:\Windows\SysWow64\setup16.exe 2012-08-20 17:37:19 5120 ----a-w- C:\Windows\SysWow64\wow32.dll 2012-08-20 17:37:18 274944 ----a-w- C:\Windows\SysWow64\KernelBase.dll 2012-08-20 15:38:21 7680 ----a-w- C:\Windows\SysWow64\instnm.exe 2012-08-20 15:38:20 2048 ----a-w- C:\Windows\SysWow64\user.exe 2012-08-20 15:33:28 6144 ---ha-w- C:\Windows\SysWow64\api-ms-win-security-base-l1-1-0.dll 2012-08-20 15:33:28 4608 ---ha-w- C:\Windows\SysWow64\api-ms-win-core-threadpool-l1-1-0.dll 2012-08-20 15:33:28 3584 ---ha-w- C:\Windows\SysWow64\api-ms-win-core-xstate-l1-1-0.dll 2012-08-20 15:33:28 3072 ---ha-w- C:\Windows\SysWow64\api-ms-win-core-util-l1-1-0.dll 2012-07-18 18:15:06 3148800 ----a-w- C:\Windows\System32\win32k.sys . ============= FINISH: 18:23:40.74 ===============