Titchski
-
Posts
19 -
Joined
-
Last visited
Content Type
Events
Profiles
Forums
Posts posted by Titchski
-
-
It's an Acer - it doesn't happen if I boot into safe mode, just "normal" Windows. I'll try reating a new user and seeing if it happens to that account.
-
Had a look through it, don't think it applies as after running unhide, I can see all items and work normally. I'm really hoping the next step isn't a rebuild...
-
As soon as I reboot, all the start menu icons/folders disappear again.
-
Seems to be ok again - will know for sure after a reboot
-
Combo Fix log:
ComboFix 12-10-10.02 - Marci 10/10/2012 21:20:31.1.4 - x64
Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.3948.2489 [GMT -4:00]
Running from: c:\users\Marci\Desktop\ComboFix.exe
AV: Microsoft Security Essentials *Disabled/Updated* {B140BF4E-23BB-4198-90AB-A51A4C60A69C}
SP: Microsoft Security Essentials *Disabled/Updated* {0A215EAA-0581-4E16-AA1B-9E6837E7EC21}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\program files (x86)\TelevisionFanatic
c:\program files (x86)\TelevisionFanatic\bar\gen1\COMMON.T8S
c:\program files (x86)\TelevisionFanatic\bar\IE9Mesg\COMMON.T8S
c:\program files (x86)\TelevisionFanatic\bar\Message\COMMON.T8S
c:\program files (x86)\TelevisionFanatic\bar\Settings\s_pid.dat
c:\users\Marci\AppData\Local\Microsoft\Windows\Temporary Internet Files\{B75867C2-EC0E-4280-BCA4-04F8C382E61A}.xps
c:\users\Marci\AppData\Local\Microsoft\Windows\Temporary Internet Files\{F65E9993-56FB-495E-8B21-153A9F2EC510}.xps
c:\users\Marci\AppData\Roaming\Mozilla\Firefox\Profiles\o3zmyekh.default\extensions\64ffxtbr@TelevisionFanatic.com
c:\users\Marci\AppData\Roaming\Mozilla\Firefox\Profiles\o3zmyekh.default\extensions\64ffxtbr@TelevisionFanatic.com\bootstrap.js
c:\users\Marci\AppData\Roaming\Mozilla\Firefox\Profiles\o3zmyekh.default\extensions\64ffxtbr@TelevisionFanatic.com\chrome.manifest
c:\users\Marci\AppData\Roaming\Mozilla\Firefox\Profiles\o3zmyekh.default\extensions\64ffxtbr@TelevisionFanatic.com\chrome\64ffxtbr.jar
c:\users\Marci\AppData\Roaming\Mozilla\Firefox\Profiles\o3zmyekh.default\extensions\64ffxtbr@TelevisionFanatic.com\install.rdf
c:\users\Marci\AppData\Roaming\Mozilla\Firefox\Profiles\o3zmyekh.default\extensions\64ffxtbr@TelevisionFanatic.com\META-INF\manifest.mf
c:\users\Marci\AppData\Roaming\Mozilla\Firefox\Profiles\o3zmyekh.default\extensions\64ffxtbr@TelevisionFanatic.com\META-INF\zigbert.rsa
c:\users\Marci\AppData\Roaming\Mozilla\Firefox\Profiles\o3zmyekh.default\extensions\64ffxtbr@TelevisionFanatic.com\META-INF\zigbert.sf
c:\windows\SysWow64\DEBUG.log
.
.
((((((((((((((((((((((((( Files Created from 2012-09-11 to 2012-10-11 )))))))))))))))))))))))))))))))
.
.
2012-10-11 01:24 . 2012-10-11 01:24 -------- d-----w- c:\users\Default\AppData\Local\temp
2012-10-10 02:01 . 2012-10-10 02:01 -------- d-----w- c:\users\Marci\AppData\Roaming\Malwarebytes
2012-10-10 02:01 . 2012-10-10 02:01 -------- d-----w- c:\programdata\Malwarebytes
2012-10-10 02:01 . 2012-09-07 21:04 25928 ----a-w- c:\windows\system32\drivers\mbam.sys
2012-10-10 02:01 . 2012-10-10 02:01 -------- d-----w- c:\program files (x86)\Malwarebytes' Anti-Malware
2012-10-10 01:42 . 2012-08-31 18:19 1659760 ----a-w- c:\windows\system32\drivers\ntfs.sys
2012-10-10 01:39 . 2012-09-14 19:19 2048 ----a-w- c:\windows\system32\tzres.dll
2012-10-10 01:39 . 2012-09-14 18:28 2048 ----a-w- c:\windows\SysWow64\tzres.dll
2012-10-10 01:39 . 2012-08-11 00:56 715776 ----a-w- c:\windows\system32\kerberos.dll
2012-10-10 01:39 . 2012-08-10 23:56 542208 ----a-w- c:\windows\SysWow64\kerberos.dll
2012-10-10 01:39 . 2012-06-02 05:41 1464320 ----a-w- c:\windows\system32\crypt32.dll
2012-10-10 01:39 . 2012-06-02 05:41 184320 ----a-w- c:\windows\system32\cryptsvc.dll
2012-10-10 01:39 . 2012-06-02 05:41 140288 ----a-w- c:\windows\system32\cryptnet.dll
2012-10-10 01:39 . 2012-06-02 04:36 140288 ----a-w- c:\windows\SysWow64\cryptsvc.dll
2012-10-10 01:39 . 2012-06-02 04:36 1159680 ----a-w- c:\windows\SysWow64\crypt32.dll
2012-10-10 01:39 . 2012-06-02 04:36 103936 ----a-w- c:\windows\SysWow64\cryptnet.dll
2012-10-07 14:48 . 2012-10-11 00:49 -------- d-----w- c:\users\Marci\AppData\Local\TelevisionFanatic
2012-10-07 14:47 . 2012-10-10 01:23 -------- d-----w- c:\users\Marci\AppData\Local\dealcabby
2012-10-07 14:47 . 2012-10-10 01:23 -------- d-----w- c:\programdata\Sendori
2012-10-07 14:47 . 2012-10-10 01:23 -------- d-----w- c:\program files (x86)\FLVPlayer
2012-10-07 14:47 . 2012-10-10 01:23 -------- d-----w- c:\program files (x86)\Sendori
2012-10-07 14:12 . 2012-10-10 01:22 -------- d-----w- c:\users\Marci\AppData\Roaming\vlc
2012-09-30 04:21 . 2012-09-30 04:21 972192 ------w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{A03729AC-2912-46FF-93F5-F55302D7C2EB}\gapaengine.dll
2012-09-29 02:49 . 2012-08-21 21:01 245760 ----a-w- c:\windows\system32\OxpsConverter.exe
2012-09-12 02:02 . 2012-09-12 02:02 -------- d-----w- c:\program files (x86)\Common Files\Skype
2012-09-11 22:09 . 2012-08-22 18:12 950128 ----a-w- c:\windows\system32\drivers\ndis.sys
2012-09-11 22:09 . 2012-08-02 17:58 574464 ----a-w- c:\windows\system32\d3d10level9.dll
2012-09-11 22:09 . 2012-08-02 16:57 490496 ----a-w- c:\windows\SysWow64\d3d10level9.dll
2012-09-11 22:09 . 2012-07-04 20:26 41472 ----a-w- c:\windows\system32\drivers\RNDISMP.sys
2012-09-11 22:09 . 2012-08-22 18:12 1913200 ----a-w- c:\windows\system32\drivers\tcpip.sys
2012-09-11 22:09 . 2012-08-22 18:12 376688 ----a-w- c:\windows\system32\drivers\netio.sys
2012-09-11 22:09 . 2012-08-22 18:12 288624 ----a-w- c:\windows\system32\drivers\FWPKCLNT.SYS
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-10-10 21:09 . 2012-08-26 05:42 65309168 ----a-w- c:\windows\system32\MRT.exe
2012-10-10 21:07 . 2012-08-12 19:53 696760 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe
2012-10-10 21:07 . 2011-08-05 00:50 73656 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2012-08-31 02:03 . 2012-08-31 02:03 228768 ----a-w- c:\windows\system32\drivers\MpFilter.sys
2012-08-31 02:03 . 2011-04-27 19:25 128456 ----a-w- c:\windows\system32\drivers\NisDrvWFP.sys
2012-08-20 17:38 . 2012-10-10 01:40 44032 ----a-w- c:\windows\apppatch\acwow64.dll
2012-07-18 18:15 . 2012-08-15 16:24 3148800 ----a-w- c:\windows\system32\win32k.sys
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\Wow6432Node\~\Browser Helper Objects\{3706EE7C-3CAD-445D-8A43-03EBC3B75908}]
2012-01-04 23:02 233288 ----a-w- c:\program files (x86)\Expat Shield\HssIE\ExpatIE.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\Carbonite.Green]
@="{95A27763-F62A-4114-9072-E81D87DE3B68}"
[HKEY_CLASSES_ROOT\CLSID\{95A27763-F62A-4114-9072-E81D87DE3B68}]
2011-03-04 00:52 762000 ----a-r- c:\program files (x86)\Carbonite\Carbonite Backup\CarboniteNSE.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\Carbonite.Partial]
@="{E300CD91-100F-4E67-9AF3-1384A6124015}"
[HKEY_CLASSES_ROOT\CLSID\{E300CD91-100F-4E67-9AF3-1384A6124015}]
2011-03-04 00:52 762000 ----a-r- c:\program files (x86)\Carbonite\Carbonite Backup\CarboniteNSE.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\Carbonite.Yellow]
@="{5E529433-B50E-4bef-A63B-16A6B71B071A}"
[HKEY_CLASSES_ROOT\CLSID\{5E529433-B50E-4bef-A63B-16A6B71B071A}]
2011-03-04 00:52 762000 ----a-r- c:\program files (x86)\Carbonite\Carbonite Backup\CarboniteNSE.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"IAStorIcon"="c:\program files (x86)\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe" [2010-09-14 283160]
"SuiteTray"="c:\program files (x86)\EgisTec MyWinLockerSuite\x86\SuiteTray.exe" [2010-09-28 340336]
"EgisTecPMMUpdate"="c:\program files (x86)\EgisTec IPS\PmmUpdate.exe" [2010-09-17 407920]
"EgisUpdate"="c:\program files (x86)\EgisTec IPS\EgisUpdate.exe" [2010-09-17 201584]
"Norton Online Backup"="c:\program files (x86)\Symantec\Norton Online Backup\NOBuClient.exe" [2010-06-01 1155928]
"Adobe Reader Speed Launcher"="c:\program files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-28 35696]
"BackupManagerTray"="c:\program files (x86)\NTI\Acer Backup Manager\BackupManagerTray.exe" [2011-02-15 297280]
"LManager"="c:\program files (x86)\Launch Manager\LManager.exe" [2011-03-14 1081424]
"Dolby Advanced Audio v2"="c:\dolby pcee4\pcee4.exe" [2011-02-03 506712]
"ArcadeMovieService"="c:\program files (x86)\Acer\clear.fi\Movie\clear.fiMovieService.exe" [2011-02-18 177448]
"Carbonite Backup"="c:\program files (x86)\Carbonite\Carbonite Backup\CarboniteUI.exe" [2011-03-04 948880]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-10-25 932288]
"Adobe Acrobat Speed Launcher"="c:\program files (x86)\Adobe\Acrobat 10.0\Acrobat\Acrobat_sl.exe" [2010-10-25 36760]
"Acrobat Assistant 8.0"="c:\program files (x86)\Adobe\Acrobat 10.0\Acrobat\Acrotray.exe" [2010-10-25 821144]
"SwitchBoard"="c:\program files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe" [2010-02-19 517096]
"AdobeCS5ServiceManager"="c:\program files (x86)\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe" [2010-02-22 406992]
"APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2011-11-02 59240]
"QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" [2011-10-24 421888]
"iTunesHelper"="c:\program files (x86)\iTunes\iTunesHelper.exe" [2012-01-16 421736]
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2012-01-18 254696]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"IsMyWinLockerReboot"="msiexec.exe" [2010-11-21 73216]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
McAfee Security Scan Plus.lnk - c:\program files (x86)\McAfee Security Scan\3.0.207\SSScheduler.exe [2011-6-17 272528]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]
"LoadAppInit_DLLs"=0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Security Packages REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]
@=""
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@="Service"
.
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R2 DsiWMIService;Dritek WMI Service;c:\program files (x86)\Launch Manager\dsiwmis.exe [2011-03-14 352336]
R2 ExpatShieldService;Expat Shield Service;c:\program files (x86)\Expat Shield\bin\openvpnas.exe [2012-01-06 331608]
R2 ExpatSrv;Expat Shield Routing Service;c:\program files (x86)\Expat Shield\HssWPR\hsssrv.exe [2012-01-04 363336]
R2 ExpatWd;Expat Shield Monitoring Service;c:\program files (x86)\Expat Shield\bin\hsswd.exe [2012-01-04 329544]
R2 GREGService;GREGService;c:\program files (x86)\Acer\Registration\GREGsvc.exe [2010-01-08 23584]
R2 IAStorDataMgrSvc;Intel® Rapid Storage Technology;c:\program files (x86)\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe [2010-09-14 13336]
R2 NOBU;Norton Online Backup;c:\program files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe SERVICE [x]
R2 NTI IScheduleSvc;NTI IScheduleSvc;c:\program files (x86)\NTI\Acer Backup Manager\IScheduleSvc.exe [2011-02-15 257344]
R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe [2012-07-13 160944]
R2 UNS;Intel® Management and Security Application User Notification Service;c:\program files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe [2011-02-01 2656280]
R3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-10-10 250808]
R3 EgisTec Ticket Service;EgisTec Ticket Service;c:\program files (x86)\Common Files\EgisTec\Services\EgisTicketService.exe [2010-09-28 172912]
R3 ExpatTrayService;Expat Shield Tray Service;c:\program files (x86)\Expat Shield\bin\ExpatTrayService.EXE [2012-01-06 77520]
R3 GamesAppService;GamesAppService;c:\program files (x86)\WildTangent Games\App\GamesAppService.exe [2010-10-12 206072]
R3 McComponentHostService;McAfee Security Scan Component Host Service;c:\program files (x86)\McAfee Security Scan\3.0.207\McCHSvc.exe [2011-06-17 237008]
R3 Microsoft SharePoint Workspace Audit Service;Microsoft SharePoint Workspace Audit Service;c:\program files\Microsoft Office\Office14\GROOVE.EXE [2011-06-12 51740536]
R3 MozillaMaintenance;Mozilla Maintenance Service;c:\program files (x86)\Mozilla Maintenance Service\maintenanceservice.exe [2012-09-08 114144]
R3 NisDrv;Microsoft Network Inspection System;c:\windows\system32\DRIVERS\NisDrvWFP.sys [2012-08-31 128456]
R3 NisSrv;Microsoft Network Inspection;c:\program files\Microsoft Security Client\NisSrv.exe [2012-09-13 368896]
R3 ose64;Office 64 Source Engine;c:\program files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2010-01-10 174440]
R3 osppsvc;Office Software Protection Platform;c:\program files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-01-10 4925184]
R3 SwitchBoard;Adobe SwitchBoard;c:\program files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [2010-02-19 517096]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-21 59392]
R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys [2010-11-21 31232]
R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys [2011-05-10 51712]
R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [2011-08-04 1255736]
R3 WSDPrintDevice;WSD Print Support via UMB;c:\windows\system32\DRIVERS\WSDPrint.sys [2009-07-14 23040]
R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe [2010-09-23 57184]
S1 mwlPSDFilter;mwlPSDFilter;c:\windows\system32\DRIVERS\mwlPSDFilter.sys [2011-04-06 22912]
S1 mwlPSDNServ;mwlPSDNServ;c:\windows\system32\DRIVERS\mwlPSDNServ.sys [2011-04-06 20328]
S1 mwlPSDVDisk;mwlPSDVDisk;c:\windows\system32\DRIVERS\mwlPSDVDisk.sys [2011-04-06 62584]
S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [2009-07-14 59904]
S2 ePowerSvc;Acer ePower Service;c:\program files\Acer\Acer ePower Management\ePowerSvc.exe [2011-02-23 873064]
S2 Live Updater Service;Live Updater Service;c:\program files\Acer\Acer Updater\UpdaterService.exe [2011-01-31 244624]
S3 b57xdbd;Broadcom xD Picture Bus Driver Service;c:\windows\system32\drivers\b57xdbd.sys [2011-01-21 67624]
S3 b57xdmp;Broadcom xD Picture vstorp client drv;c:\windows\system32\drivers\b57xdmp.sys [2011-01-21 19496]
S3 bScsiMSa;bScsiMSa;c:\windows\system32\drivers\bScsiMSa.sys [2011-01-20 52264]
S3 bScsiSDa;bScsiSDa;c:\windows\system32\DRIVERS\bScsiSDa.sys [2011-01-14 85544]
S3 IntcDAud;Intel® Display Audio;c:\windows\system32\DRIVERS\IntcDAud.sys [2010-10-15 317440]
S3 k57nd60a;Broadcom NetLink Gigabit Ethernet - NDIS 6.0;c:\windows\system32\DRIVERS\k57nd60a.sys [2011-01-17 412712]
S3 MEIx64;Intel® Management Engine Interface;c:\windows\system32\DRIVERS\HECIx64.sys [2010-10-20 56344]
.
.
Contents of the 'Scheduled Tasks' folder
.
2012-10-11 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-08-12 21:07]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{3706EE7C-3CAD-445D-8A43-03EBC3B75908}]
2012-01-04 23:02 287048 ----a-w- c:\program files (x86)\Expat Shield\HssIE\ExpatIE_64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\Carbonite.Green]
@="{95A27763-F62A-4114-9072-E81D87DE3B68}"
[HKEY_CLASSES_ROOT\CLSID\{95A27763-F62A-4114-9072-E81D87DE3B68}]
2011-03-04 00:36 1174672 ----a-r- c:\program files\Carbonite\Carbonite Backup\CarboniteNSE.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\Carbonite.Partial]
@="{E300CD91-100F-4E67-9AF3-1384A6124015}"
[HKEY_CLASSES_ROOT\CLSID\{E300CD91-100F-4E67-9AF3-1384A6124015}]
2011-03-04 00:36 1174672 ----a-r- c:\program files\Carbonite\Carbonite Backup\CarboniteNSE.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\Carbonite.Yellow]
@="{5E529433-B50E-4bef-A63B-16A6B71B071A}"
[HKEY_CLASSES_ROOT\CLSID\{5E529433-B50E-4bef-A63B-16A6B71B071A}]
2011-03-04 00:36 1174672 ----a-r- c:\program files\Carbonite\Carbonite Backup\CarboniteNSE.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2011-03-30 167960]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2011-03-30 391704]
"Persistence"="c:\windows\system32\igfxpers.exe" [2011-03-30 418840]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2011-03-10 11785832]
"RtHDVBg"="c:\program files\Realtek\Audio\HDA\RAVBg64.exe" [2011-03-09 2189416]
"Power Management"="c:\program files\Acer\Acer ePower Management\ePowerTray.exe" [2011-02-23 1796200]
"BCSSync"="c:\program files\Microsoft Office\Office14\BCSSync.exe" [2010-03-13 112512]
"AdobeAAMUpdater-1.0"="c:\program files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe" [2010-09-16 497648]
"MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2012-09-13 1289704]
.
------- Supplementary Scan -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = hxxp://acer.msn.com
mDefault_Page_URL = hxxp://acer.msn.com
mStart Page = hxxp://acer.msn.com
mLocal Page = c:\windows\SysWOW64\blank.htm
uInternet Settings,ProxyOverride = *.local
IE: Append Link Target to Existing PDF - c:\program files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: Append to Existing PDF - c:\program files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert Link Target to Adobe PDF - c:\program files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
IE: Convert to Adobe PDF - c:\program files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECapture.html
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~3\Office14\EXCEL.EXE/3000
IE: Se&nd to OneNote - c:\progra~1\MICROS~3\Office14\ONBttnIE.dll/105
TCP: DhcpNameServer = 10.0.0.1
TCP: Interfaces\{AA180B28-E6AA-4BED-AE1A-9E3A74AEE289}: NameServer = 10.197.48.1
FF - ProfilePath - c:\users\Marci\AppData\Roaming\Mozilla\Firefox\Profiles\o3zmyekh.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.facebook.com/marci.gower
.
- - - - ORPHANS REMOVED - - - -
.
Toolbar-Locked - (no file)
Wow6432Node-HKCU-Run-ISUSPM - c:\programdata\FLEXnet\Connect\11\ISUSPM.exe
Wow6432Node-HKLM-Run-<NO NAME> - (no file)
Toolbar-Locked - (no file)
HKLM-Run-SynTPEnh - c:\program files (x86)\Synaptics\SynTP\SynTPEnh.exe
.
.
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_4_402_287_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_4_402_287_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_4_402_287_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_4_402_287_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_4_402_287.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.11"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_4_402_287.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_4_402_287.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_4_402_287.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\McAfee]
"SymbolicLinkValue"=hex(6):5c,00,72,00,65,00,67,00,69,00,73,00,74,00,72,00,79,
00,5c,00,6d,00,61,00,63,00,68,00,69,00,6e,00,65,00,5c,00,53,00,6f,00,66,00,\
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Completion time: 2012-10-10 21:27:48
ComboFix-quarantined-files.txt 2012-10-11 01:27
.
Pre-Run: 231,965,261,824 bytes free
Post-Run: 232,156,762,112 bytes free
.
- - End Of File - - AF2A75B981827CDD1BEEE564CA2E7BD4
-
Running combofix now, cheers
-
Spoke too soon - rebooted and the start programs have gone again :| I'm guessing it didn't get totally removed
-
I'll get right on updating Java and Reader
-
Results of screen317's Security Check version 0.99.51
Windows 7 Service Pack 1 x64 (UAC is enabled)
Internet Explorer 9
``````````````Antivirus/Firewall Check:``````````````
Windows Firewall Enabled!
Microsoft Security Essentials
Antivirus up to date!
`````````Anti-malware/Other Utilities Check:`````````
Malwarebytes Anti-Malware version 1.65.0.1400
Java 6 Update 31
Java version out of Date!
Adobe Flash Player 11.4.402.287
Adobe Reader 9 Adobe Reader out of Date!
Mozilla Firefox (15.0)
````````Process Check: objlist.exe by Laurent````````
Microsoft Security Essentials MSMpEng.exe
Microsoft Security Essentials msseces.exe
`````````````````System Health check`````````````````
Total Fragmentation on Drive C: 0%
````````````````````End of Log``````````````````````
-
unhide worked - all seems to be well now - many, many thanks for the help!
-
ilivid seems to have gone - running unhide now. Thanks for the help so far!
-
Still the same unfortunately - no access to certain exes and no start menu > programs links
-
She's a fan of junk.. must be why she married me
Second logfile:
# AdwCleaner v2.004 - Logfile created 10/10/2012 at 19:59:10
# Updated 06/10/2012 by Xplode
# Operating system : Windows 7 Home Premium Service Pack 1 (64 bits)
# User : Marci - MARCI7
# Boot Mode : Normal
# Running from : C:\Users\Marci\Desktop\adwcleaner.exe
# Option [Delete]
***** [services] *****
***** [Files / Folders] *****
Deleted on reboot : C:\Program Files (x86)\Mozilla Firefox\Extensions\afurladvisor@anchorfree.com
File Deleted : C:\Program Files (x86)\Mozilla Firefox\Plugins\npvsharetvplg.dll
File Deleted : C:\Users\Marci\AppData\Roaming\Mozilla\Firefox\Profiles\o3zmyekh.default\extensions\pricepeep@getpricepeep.com.xpi
Folder Deleted : C:\Program Files (x86)\Conduit
Folder Deleted : C:\Program Files (x86)\Ilivid
Folder Deleted : C:\Program Files (x86)\PricePeep
Folder Deleted : C:\Program Files (x86)\vShare.tv plugin
Folder Deleted : C:\Program Files (x86)\vshare.tv_Bar
Folder Deleted : C:\Users\Marci\AppData\Local\Conduit
Folder Deleted : C:\Users\Marci\AppData\Local\Ilivid Player
Folder Deleted : C:\Users\Marci\AppData\Local\Software
Folder Deleted : C:\Users\Marci\AppData\Local\Temp\CT2818425
Folder Deleted : C:\Users\Marci\AppData\LocalLow\Conduit
Folder Deleted : C:\Users\Marci\AppData\LocalLow\vshare.tv_Bar
Folder Deleted : C:\Users\Marci\AppData\Roaming\Mozilla\Firefox\Profiles\o3zmyekh.default\ConduitCommon
Folder Deleted : C:\Users\Marci\AppData\Roaming\Mozilla\Firefox\Profiles\o3zmyekh.default\CT2818425
Folder Deleted : C:\Users\Marci\AppData\Roaming\Mozilla\Firefox\Profiles\o3zmyekh.default\extensions\{7aeb3efd-e564-43f1-b658-5058a7c5743b}
***** [Registry] *****
Key Deleted : HKCU\Software\AppDataLow\Software\Conduit
Key Deleted : HKCU\Software\AppDataLow\Software\vshare.tv_Bar
Key Deleted : HKCU\Software\AppDataLow\Toolbar
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{7AEB3EFD-E564-43F1-B658-5058A7C5743B}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{7AEB3EFD-E564-43F1-B658-5058A7C5743B}
Key Deleted : HKCU\Software\StartSearch
Key Deleted : HKLM\SOFTWARE\Classes\Toolbar.CT2818425
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{99C22A61-21BA-4F81-85FF-CDC9EB5DB10B}
Key Deleted : HKLM\Software\Conduit
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{91E526FE-D9CF-443C-91A4-4A42F6178477}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{A1B48071-416D-474E-A13B-BE5456E7FC31}
Key Deleted : HKLM\Software\vshare.tv_Bar
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{7AEB3EFD-E564-43F1-B658-5058A7C5743B}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{91E526FE-D9CF-443C-91A4-4A42F6178477}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{A1B48071-416D-474E-A13B-BE5456E7FC31}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{AF527190-68C9-4D03-AA04-9EB633E1D2C9}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{DE93BFA0-058A-4B8E-A8D9-8918B3817571}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{7AEB3EFD-E564-43F1-B658-5058A7C5743B}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\vshare.tv_Bar Toolbar
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{79FB5FC8-44B9-4AF5-BADD-CCE547F953E5}
Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}
Value Deleted : HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks [{7AEB3EFD-E564-43F1-B658-5058A7C5743B}]
Value Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks [{7AEB3EFD-E564-43F1-B658-5058A7C5743B}]
Value Deleted : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar [{7AEB3EFD-E564-43F1-B658-5058A7C5743B}]
***** [internet Browsers] *****
-\\ Internet Explorer v9.0.8112.16421
[OK] Registry is clean.
-\\ Mozilla Firefox v15.0 (en-US)
Profile name : default
File : C:\Users\Marci\AppData\Roaming\Mozilla\Firefox\Profiles\o3zmyekh.default\prefs.js
Deleted : user_pref("CT2818425..clientLogIsEnabled", false);
Deleted : user_pref("CT2818425..clientLogServiceUrl", "hxxp://clientlog.users.conduit.com/ClientDiagnostics.as[...]
Deleted : user_pref("CT2818425..uninstallLogServiceUrl", "hxxp://uninstall.users.conduit.com/Uninstall.asmx/Re[...]
Deleted : user_pref("CT2818425.ALLOW_SHOWING_HIDDEN_TOOLBAR", false);
Deleted : user_pref("CT2818425.AboutPrivacyUrl", "hxxp://www.conduit.com/privacy/Default.aspx");
Deleted : user_pref("CT2818425.BrowserCompStateIsOpen_129712757411525741", true);
Deleted : user_pref("CT2818425.BrowserCompStateIsOpen_129735245815838327", true);
Deleted : user_pref("CT2818425.BrowserCompStateIsOpen_129893041058613741", true);
Deleted : user_pref("CT2818425.CT2818425", "CT2818425");
Deleted : user_pref("CT2818425.CurrentServerDate", "10-10-2012");
Deleted : user_pref("CT2818425.DSInstall", false);
Deleted : user_pref("CT2818425.DialogsAlignMode", "LTR");
Deleted : user_pref("CT2818425.DialogsGetterLastCheckTime", "Tue Oct 09 2012 21:59:26 GMT-0400 (Eastern Daylig[...]
Deleted : user_pref("CT2818425.DownloadReferralCookieData", "");
Deleted : user_pref("CT2818425.EMailNotifierPollDate", "Sat Mar 10 2012 12:21:46 GMT-0500 (Eastern Standard Ti[...]
Deleted : user_pref("CT2818425.FirstServerDate", "10-3-2012");
Deleted : user_pref("CT2818425.FirstTime", true);
Deleted : user_pref("CT2818425.FirstTimeFF3", true);
Deleted : user_pref("CT2818425.FixPageNotFoundErrors", false);
Deleted : user_pref("CT2818425.GroupingServerCheckInterval", 1440);
Deleted : user_pref("CT2818425.GroupingServiceUrl", "hxxp://grouping.services.conduit.com/");
Deleted : user_pref("CT2818425.HPInstall", false);
Deleted : user_pref("CT2818425.HasUserGlobalKeys", true);
Deleted : user_pref("CT2818425.HomePageProtectorEnabled", false);
Deleted : user_pref("CT2818425.HomepageBeforeUnload", "hxxp://www.facebook.com/marci.gower");
Deleted : user_pref("CT2818425.Initialize", true);
Deleted : user_pref("CT2818425.InitializeCommonPrefs", true);
Deleted : user_pref("CT2818425.InstallationAndCookieDataSentCount", 3);
Deleted : user_pref("CT2818425.InstallationType", "Unknown");
Deleted : user_pref("CT2818425.InstalledDate", "Sat Mar 10 2012 12:21:47 GMT-0500 (Eastern Standard Time)");
Deleted : user_pref("CT2818425.InvalidateCache", false);
Deleted : user_pref("CT2818425.IsGrouping", false);
Deleted : user_pref("CT2818425.IsInitSetupIni", true);
Deleted : user_pref("CT2818425.IsMulticommunity", false);
Deleted : user_pref("CT2818425.IsOpenThankYouPage", true);
Deleted : user_pref("CT2818425.IsOpenUninstallPage", true);
Deleted : user_pref("CT2818425.IsProtectorsInit", true);
Deleted : user_pref("CT2818425.LanguagePackLastCheckTime", "Tue Oct 09 2012 21:59:26 GMT-0400 (Eastern Dayligh[...]
Deleted : user_pref("CT2818425.LanguagePackReloadIntervalMM", 1440);
Deleted : user_pref("CT2818425.LanguagePackServiceUrl", "hxxp://translation.users.conduit.com/Translation.ashx[...]
Deleted : user_pref("CT2818425.LastLogin_3.10.0.1", "Sat Mar 10 2012 12:22:43 GMT-0500 (Eastern Standard Time)[...]
Deleted : user_pref("CT2818425.LastLogin_3.12.0.7", "Tue May 01 2012 06:39:06 GMT-0400 (Eastern Daylight Time)[...]
Deleted : user_pref("CT2818425.LastLogin_3.12.2.3", "Thu May 31 2012 13:11:29 GMT-0400 (Eastern Daylight Time)[...]
Deleted : user_pref("CT2818425.LastLogin_3.13.0.6", "Sun Jul 15 2012 12:22:15 GMT-0400 (Eastern Daylight Time)[...]
Deleted : user_pref("CT2818425.LastLogin_3.14.1.0", "Sun Aug 26 2012 00:08:16 GMT-0400 (Eastern Daylight Time)[...]
Deleted : user_pref("CT2818425.LastLogin_3.15.1.0", "Tue Oct 09 2012 21:59:26 GMT-0400 (Eastern Daylight Time)[...]
Deleted : user_pref("CT2818425.LatestVersion", "3.15.1.0");
Deleted : user_pref("CT2818425.Locale", "en");
Deleted : user_pref("CT2818425.MCDetectTooltipHeight", "83");
Deleted : user_pref("CT2818425.MCDetectTooltipUrl", "hxxp://@EB_INSTALL_LINK@/rank/tooltip/?version=1");
Deleted : user_pref("CT2818425.MCDetectTooltipWidth", "295");
Deleted : user_pref("CT2818425.MyStuffEnabledAtInstallation", true);
Deleted : user_pref("CT2818425.OriginalFirstVersion", "3.10.0.1");
Deleted : user_pref("CT2818425.RadioIsPodcast", false);
Deleted : user_pref("CT2818425.RadioLastCheckTime", "Mon Mar 12 2012 15:16:07 GMT-0400 (Eastern Daylight Time)[...]
Deleted : user_pref("CT2818425.RadioLastUpdateIPServer", "3");
Deleted : user_pref("CT2818425.RadioLastUpdateServer", "129330101464100000");
Deleted : user_pref("CT2818425.RadioMediaID", "21515677");
Deleted : user_pref("CT2818425.RadioMediaType", "Media Player");
Deleted : user_pref("CT2818425.RadioMenuSelectedID", "EBRadioMenu_CT281842521515677");
Deleted : user_pref("CT2818425.RadioShrinkedFromSetup", false);
Deleted : user_pref("CT2818425.RadioStationName", "Virgin%20Radio%20Classic%20Rock");
Deleted : user_pref("CT2818425.RadioStationURL", "hxxp://www.smgradio.com/core/audio/wmp/live.asx?service=vcbb[...]
Deleted : user_pref("CT2818425.SearchCaption", "vshare.tv Customized Web Search");
Deleted : user_pref("CT2818425.SearchEngineBeforeUnload", "chrome://browser-region/locale/region.properties");
Deleted : user_pref("CT2818425.SearchFromAddressBarIsInit", true);
Deleted : user_pref("CT2818425.SearchFromAddressBarUrl", "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT281[...]
Deleted : user_pref("CT2818425.SearchInNewTabEnabled", true);
Deleted : user_pref("CT2818425.SearchInNewTabIntervalMM", 1440);
Deleted : user_pref("CT2818425.SearchInNewTabLastCheckTime", "Tue Oct 09 2012 21:59:25 GMT-0400 (Eastern Dayli[...]
Deleted : user_pref("CT2818425.SearchInNewTabServiceUrl", "hxxp://newtab.conduit-hosting.com/newtab/?ctid=EB_T[...]
Deleted : user_pref("CT2818425.SearchInNewTabUserEnabled", false);
Deleted : user_pref("CT2818425.SearchProtectorEnabled", false);
Deleted : user_pref("CT2818425.SearchProtectorToolbarDisabled", false);
Deleted : user_pref("CT2818425.SendProtectorDataViaLogin", true);
Deleted : user_pref("CT2818425.ServiceMapLastCheckTime", "Tue Oct 09 2012 21:59:25 GMT-0400 (Eastern Daylight [...]
Deleted : user_pref("CT2818425.SettingsLastCheckTime", "Tue Oct 09 2012 21:59:25 GMT-0400 (Eastern Daylight Ti[...]
Deleted : user_pref("CT2818425.SettingsLastUpdate", "1348502557");
Deleted : user_pref("CT2818425.TBHomePageUrl", "hxxp://search.conduit.com/?ctid=CT2818425&SearchSource=13");
Deleted : user_pref("CT2818425.ThirdPartyComponentsInterval", 504);
Deleted : user_pref("CT2818425.ThirdPartyComponentsLastCheck", "Sat Mar 10 2012 12:21:45 GMT-0500 (Eastern Sta[...]
Deleted : user_pref("CT2818425.ThirdPartyComponentsLastUpdate", "1312887586");
Deleted : user_pref("CT2818425.ToolbarShrinkedFromSetup", false);
Deleted : user_pref("CT2818425.TrusteLinkUrl", "hxxp://trust.conduit.com/CT2818425");
Deleted : user_pref("CT2818425.TrustedApiDomains", "conduit.com,conduit-hosting.com,conduit-services.com,clien[...]
Deleted : user_pref("CT2818425.UserID", "UN47956079780564975");
Deleted : user_pref("CT2818425.alertChannelId", "1210492");
Deleted : user_pref("CT2818425.autoDisableScopes", -1);
Deleted : user_pref("CT2818425.backendstorage.cbfirsttime", "536174204D617220313020323031322031323A32323A34362[...]
Deleted : user_pref("CT2818425.backendstorage.key_user_agree_ia12", "31");
Deleted : user_pref("CT2818425.backendstorage.shoppingapp.gk.exipres", "546875204D617220313520323031322031323A[...]
Deleted : user_pref("CT2818425.backendstorage.shoppingapp.gk.geolocation", "756E6974656420737461746573");
Deleted : user_pref("CT2818425.backendstorage.user_uniqueid", "66323865656365622D633762322D306639302D356637662[...]
Deleted : user_pref("CT2818425.components.1000234", false);
Deleted : user_pref("CT2818425.generalConfigFromLogin", "{\"ApiMaxAlerts\":\"12\",\"SocialDomains\":\"social.c[...]
Deleted : user_pref("CT2818425.globalFirstTimeInfoLastCheckTime", "Tue Mar 13 2012 03:44:07 GMT-0400 (Eastern [...]
Deleted : user_pref("CT2818425.homepageProtectorEnableByLogin", true);
Deleted : user_pref("CT2818425.initDone", true);
Deleted : user_pref("CT2818425.isAppTrackingManagerOn", true);
Deleted : user_pref("CT2818425.isFirstRadioInstallation", false);
Deleted : user_pref("CT2818425.myStuffEnabled", true);
Deleted : user_pref("CT2818425.myStuffPublihserMinWidth", 400);
Deleted : user_pref("CT2818425.myStuffSearchUrl", "hxxp://Apps.conduit.com/search?q=SEARCH_TERM&SearchSourceOr[...]
Deleted : user_pref("CT2818425.myStuffServiceIntervalMM", 1440);
Deleted : user_pref("CT2818425.myStuffServiceUrl", "hxxp://mystuff.conduit-services.com/MyStuffService.ashx?Co[...]
Deleted : user_pref("CT2818425.navigateToUrlOnSearch", false);
Deleted : user_pref("CT2818425.revertSettingsEnabled", false);
Deleted : user_pref("CT2818425.searchProtectorDialogDelayInSec", 10);
Deleted : user_pref("CT2818425.searchProtectorEnableByLogin", true);
Deleted : user_pref("CT2818425.testingCtid", "");
Deleted : user_pref("CT2818425.toolbarAppMetaDataLastCheckTime", "Tue Oct 09 2012 21:59:26 GMT-0400 (Eastern D[...]
Deleted : user_pref("CT2818425.toolbarContextMenuLastCheckTime", "Sat Mar 10 2012 12:21:47 GMT-0500 (Eastern S[...]
Deleted : user_pref("CT2818425.usagesFlag", 2);
Deleted : user_pref("CommunityToolbar.ETag.hxxp://Settings.toolbar.search.conduit.com/root/CT2818425/CT2818425[...]
Deleted : user_pref("CommunityToolbar.ETag.hxxp://alerts.conduit-services.com/root/1210492/1206165/US", "\"0\"[...]
Deleted : user_pref("CommunityToolbar.ETag.hxxp://appsmetadata.toolbar.conduit-services.com/?ctid=CT2818425", [...]
Deleted : user_pref("CommunityToolbar.ETag.hxxp://contextmenu.toolbar.conduit-services.com/?name=GottenApps&lo[...]
Deleted : user_pref("CommunityToolbar.ETag.hxxp://contextmenu.toolbar.conduit-services.com/?name=GottenApps&lo[...]
Deleted : user_pref("CommunityToolbar.ETag.hxxp://contextmenu.toolbar.conduit-services.com/?name=OtherApps&loc[...]
Deleted : user_pref("CommunityToolbar.ETag.hxxp://contextmenu.toolbar.conduit-services.com/?name=OtherApps&loc[...]
Deleted : user_pref("CommunityToolbar.ETag.hxxp://contextmenu.toolbar.conduit-services.com/?name=SharedApps&lo[...]
Deleted : user_pref("CommunityToolbar.ETag.hxxp://contextmenu.toolbar.conduit-services.com/?name=SharedApps&lo[...]
Deleted : user_pref("CommunityToolbar.ETag.hxxp://contextmenu.toolbar.conduit-services.com/?name=Toolbar&local[...]
Deleted : user_pref("CommunityToolbar.ETag.hxxp://contextmenu.toolbar.conduit-services.com/?name=Toolbar&local[...]
Deleted : user_pref("CommunityToolbar.ETag.hxxp://dynamicdialogs.alert.conduit-services.com/alert/dlg.pkg", "\[...]
Deleted : user_pref("CommunityToolbar.ETag.hxxp://dynamicdialogs.toolbar.conduit-services.com/DLG.pkg?ver=3.10[...]
Deleted : user_pref("CommunityToolbar.ETag.hxxp://dynamicdialogs.toolbar.conduit-services.com/DLG.pkg?ver=3.12[...]
Deleted : user_pref("CommunityToolbar.ETag.hxxp://dynamicdialogs.toolbar.conduit-services.com/DLG.pkg?ver=3.12[...]
Deleted : user_pref("CommunityToolbar.ETag.hxxp://dynamicdialogs.toolbar.conduit-services.com/DLG.pkg?ver=3.13[...]
Deleted : user_pref("CommunityToolbar.ETag.hxxp://dynamicdialogs.toolbar.conduit-services.com/DLG.pkg?ver=3.14[...]
Deleted : user_pref("CommunityToolbar.ETag.hxxp://dynamicdialogs.toolbar.conduit-services.com/DLG.pkg?ver=3.15[...]
Deleted : user_pref("CommunityToolbar.ETag.hxxp://servicemap.conduit-services.com/Toolbar/?ownerId=CT2818425",[...]
Deleted : user_pref("CommunityToolbar.ETag.hxxp://translation.toolbar.conduit-services.com/?locale=en", "\"abd[...]
Deleted : user_pref("CommunityToolbar.LatestLibsPath", "file:///C:\\Users\\Marci\\AppData\\Roaming\\Mozilla\\F[...]
Deleted : user_pref("CommunityToolbar.LatestToolbarVersionInstalled", "3.10.0.1");
Deleted : user_pref("CommunityToolbar.SearchFromAddressBarSavedUrl", "");
Deleted : user_pref("CommunityToolbar.ToolbarsList", "CT2818425");
Deleted : user_pref("CommunityToolbar.ToolbarsList2", "CT2818425");
Deleted : user_pref("CommunityToolbar.ToolbarsList4", "CT2818425");
Deleted : user_pref("CommunityToolbar.facebook.settingsLastCheckTime", "Sat Mar 10 2012 12:21:46 GMT-0500 (Eas[...]
Deleted : user_pref("CommunityToolbar.globalUserId", "ce284a29-936e-4e3d-8959-c2454901cb38");
Deleted : user_pref("CommunityToolbar.isAlertUrlAddedToFeedItemTable", true);
Deleted : user_pref("CommunityToolbar.isClickActionAddedToFeedItemTable", true);
Deleted : user_pref("CommunityToolbar.notifications.alertDialogsGetterLastCheckTime", "Sat Mar 10 2012 12:21:4[...]
Deleted : user_pref("CommunityToolbar.notifications.alertEnabled", false);
Deleted : user_pref("CommunityToolbar.notifications.alertInfoInterval", 1440);
Deleted : user_pref("CommunityToolbar.notifications.alertInfoLastCheckTime", "Sat Mar 10 2012 12:21:54 GMT-050[...]
Deleted : user_pref("CommunityToolbar.notifications.clientsServerUrl", "hxxp://alert.client.conduit.com");
Deleted : user_pref("CommunityToolbar.notifications.locale", "");
Deleted : user_pref("CommunityToolbar.notifications.loginIntervalMin", 0);
Deleted : user_pref("CommunityToolbar.notifications.loginLastCheckTime", "Sun Mar 11 2012 15:15:59 GMT-0400 (E[...]
Deleted : user_pref("CommunityToolbar.notifications.loginLastUpdateTime", "");
Deleted : user_pref("CommunityToolbar.notifications.messageShowTimeSec", 20);
Deleted : user_pref("CommunityToolbar.notifications.servicesServerUrl", "hxxp://alert.services.conduit.com");
Deleted : user_pref("CommunityToolbar.notifications.showTrayIcon", false);
Deleted : user_pref("CommunityToolbar.notifications.userCloseIntervalMin", 300);
Deleted : user_pref("CommunityToolbar.notifications.userId", "a89fae1e-e252-4857-968b-f406d88530b2");
Deleted : user_pref("CommunityToolbar.originalHomepage", "hxxp://www.facebook.com/marci.gower");
Deleted : user_pref("CommunityToolbar.originalSearchEngine", "chrome://browser-region/locale/region.properties[...]
Deleted : user_pref("vshare.install.date", "1329957972");
Deleted : user_pref("vshare.install.finished", "1.0.0");
Deleted : user_pref("vshare.install.fresh", "false");
Deleted : user_pref("vshare.install.guid", "{f691f350-1798-4560-bd1c-acf558070cd1}");
Deleted : user_pref("vshare.install.newtab", false);
*************************
AdwCleaner[R1].txt - [18254 octets] - [10/10/2012 19:52:36]
AdwCleaner[R2].txt - [18315 octets] - [10/10/2012 19:58:47]
AdwCleaner[s1].txt - [18664 octets] - [10/10/2012 19:59:10]
########## EOF - C:\AdwCleaner[s1].txt - [18725 octets] ##########
-
# AdwCleaner v2.004 - Logfile created 10/10/2012 at 19:52:36
# Updated 06/10/2012 by Xplode
# Operating system : Windows 7 Home Premium Service Pack 1 (64 bits)
# User : Marci - MARCI7
# Boot Mode : Normal
# Running from : C:\Users\Marci\Desktop\adwcleaner.exe
# Option [search]
***** [services] *****
***** [Files / Folders] *****
File Found : C:\Program Files (x86)\Mozilla Firefox\Plugins\npvsharetvplg.dll
File Found : C:\Users\Marci\AppData\Roaming\Mozilla\Firefox\Profiles\o3zmyekh.default\extensions\pricepeep@getpricepeep.com.xpi
Folder Found : C:\Program Files (x86)\Conduit
Folder Found : C:\Program Files (x86)\Ilivid
Folder Found : C:\Program Files (x86)\Mozilla Firefox\Extensions\afurladvisor@anchorfree.com
Folder Found : C:\Program Files (x86)\PricePeep
Folder Found : C:\Program Files (x86)\vShare.tv plugin
Folder Found : C:\Program Files (x86)\vshare.tv_Bar
Folder Found : C:\Users\Marci\AppData\Local\Conduit
Folder Found : C:\Users\Marci\AppData\Local\Ilivid Player
Folder Found : C:\Users\Marci\AppData\Local\Software
Folder Found : C:\Users\Marci\AppData\Local\Temp\CT2818425
Folder Found : C:\Users\Marci\AppData\LocalLow\Conduit
Folder Found : C:\Users\Marci\AppData\LocalLow\vshare.tv_Bar
Folder Found : C:\Users\Marci\AppData\Roaming\Mozilla\Firefox\Profiles\o3zmyekh.default\ConduitCommon
Folder Found : C:\Users\Marci\AppData\Roaming\Mozilla\Firefox\Profiles\o3zmyekh.default\CT2818425
Folder Found : C:\Users\Marci\AppData\Roaming\Mozilla\Firefox\Profiles\o3zmyekh.default\extensions\{7aeb3efd-e564-43f1-b658-5058a7c5743b}
***** [Registry] *****
Key Found : HKCU\Software\AppDataLow\Software\Conduit
Key Found : HKCU\Software\AppDataLow\Software\vshare.tv_Bar
Key Found : HKCU\Software\AppDataLow\Toolbar
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{7AEB3EFD-E564-43F1-B658-5058A7C5743B}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{7AEB3EFD-E564-43F1-B658-5058A7C5743B}
Key Found : HKCU\Software\StartSearch
Key Found : HKLM\SOFTWARE\Classes\Toolbar.CT2818425
Key Found : HKLM\SOFTWARE\Classes\TypeLib\{99C22A61-21BA-4F81-85FF-CDC9EB5DB10B}
Key Found : HKLM\Software\Conduit
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{91E526FE-D9CF-443C-91A4-4A42F6178477}
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{A1B48071-416D-474E-A13B-BE5456E7FC31}
Key Found : HKLM\Software\vshare.tv_Bar
Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{7AEB3EFD-E564-43F1-B658-5058A7C5743B}
Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{91E526FE-D9CF-443C-91A4-4A42F6178477}
Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{A1B48071-416D-474E-A13B-BE5456E7FC31}
Key Found : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{AF527190-68C9-4D03-AA04-9EB633E1D2C9}
Key Found : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{DE93BFA0-058A-4B8E-A8D9-8918B3817571}
Key Found : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}
Key Found : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{7AEB3EFD-E564-43F1-B658-5058A7C5743B}
Key Found : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\vshare.tv_Bar Toolbar
Key Found : HKLM\SOFTWARE\Classes\Interface\{79FB5FC8-44B9-4AF5-BADD-CCE547F953E5}
Key Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}
Value Found : HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks [{7AEB3EFD-E564-43F1-B658-5058A7C5743B}]
Value Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks [{7AEB3EFD-E564-43F1-B658-5058A7C5743B}]
Value Found : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar [{7AEB3EFD-E564-43F1-B658-5058A7C5743B}]
***** [internet Browsers] *****
-\\ Internet Explorer v9.0.8112.16421
[OK] Registry is clean.
-\\ Mozilla Firefox v15.0 (en-US)
Profile name : default
File : C:\Users\Marci\AppData\Roaming\Mozilla\Firefox\Profiles\o3zmyekh.default\prefs.js
Found : user_pref("CT2818425..clientLogIsEnabled", false);
Found : user_pref("CT2818425..clientLogServiceUrl", "hxxp://clientlog.users.conduit.com/ClientDiagnostics.as[...]
Found : user_pref("CT2818425..uninstallLogServiceUrl", "hxxp://uninstall.users.conduit.com/Uninstall.asmx/Re[...]
Found : user_pref("CT2818425.ALLOW_SHOWING_HIDDEN_TOOLBAR", false);
Found : user_pref("CT2818425.AboutPrivacyUrl", "hxxp://www.conduit.com/privacy/Default.aspx");
Found : user_pref("CT2818425.BrowserCompStateIsOpen_129712757411525741", true);
Found : user_pref("CT2818425.BrowserCompStateIsOpen_129735245815838327", true);
Found : user_pref("CT2818425.BrowserCompStateIsOpen_129893041058613741", true);
Found : user_pref("CT2818425.CT2818425", "CT2818425");
Found : user_pref("CT2818425.CurrentServerDate", "10-10-2012");
Found : user_pref("CT2818425.DSInstall", false);
Found : user_pref("CT2818425.DialogsAlignMode", "LTR");
Found : user_pref("CT2818425.DialogsGetterLastCheckTime", "Tue Oct 09 2012 21:59:26 GMT-0400 (Eastern Daylig[...]
Found : user_pref("CT2818425.DownloadReferralCookieData", "");
Found : user_pref("CT2818425.EMailNotifierPollDate", "Sat Mar 10 2012 12:21:46 GMT-0500 (Eastern Standard Ti[...]
Found : user_pref("CT2818425.FirstServerDate", "10-3-2012");
Found : user_pref("CT2818425.FirstTime", true);
Found : user_pref("CT2818425.FirstTimeFF3", true);
Found : user_pref("CT2818425.FixPageNotFoundErrors", false);
Found : user_pref("CT2818425.GroupingServerCheckInterval", 1440);
Found : user_pref("CT2818425.GroupingServiceUrl", "hxxp://grouping.services.conduit.com/");
Found : user_pref("CT2818425.HPInstall", false);
Found : user_pref("CT2818425.HasUserGlobalKeys", true);
Found : user_pref("CT2818425.HomePageProtectorEnabled", false);
Found : user_pref("CT2818425.HomepageBeforeUnload", "hxxp://www.facebook.com/marci.gower");
Found : user_pref("CT2818425.Initialize", true);
Found : user_pref("CT2818425.InitializeCommonPrefs", true);
Found : user_pref("CT2818425.InstallationAndCookieDataSentCount", 3);
Found : user_pref("CT2818425.InstallationType", "Unknown");
Found : user_pref("CT2818425.InstalledDate", "Sat Mar 10 2012 12:21:47 GMT-0500 (Eastern Standard Time)");
Found : user_pref("CT2818425.InvalidateCache", false);
Found : user_pref("CT2818425.IsGrouping", false);
Found : user_pref("CT2818425.IsInitSetupIni", true);
Found : user_pref("CT2818425.IsMulticommunity", false);
Found : user_pref("CT2818425.IsOpenThankYouPage", true);
Found : user_pref("CT2818425.IsOpenUninstallPage", true);
Found : user_pref("CT2818425.IsProtectorsInit", true);
Found : user_pref("CT2818425.LanguagePackLastCheckTime", "Tue Oct 09 2012 21:59:26 GMT-0400 (Eastern Dayligh[...]
Found : user_pref("CT2818425.LanguagePackReloadIntervalMM", 1440);
Found : user_pref("CT2818425.LanguagePackServiceUrl", "hxxp://translation.users.conduit.com/Translation.ashx[...]
Found : user_pref("CT2818425.LastLogin_3.10.0.1", "Sat Mar 10 2012 12:22:43 GMT-0500 (Eastern Standard Time)[...]
Found : user_pref("CT2818425.LastLogin_3.12.0.7", "Tue May 01 2012 06:39:06 GMT-0400 (Eastern Daylight Time)[...]
Found : user_pref("CT2818425.LastLogin_3.12.2.3", "Thu May 31 2012 13:11:29 GMT-0400 (Eastern Daylight Time)[...]
Found : user_pref("CT2818425.LastLogin_3.13.0.6", "Sun Jul 15 2012 12:22:15 GMT-0400 (Eastern Daylight Time)[...]
Found : user_pref("CT2818425.LastLogin_3.14.1.0", "Sun Aug 26 2012 00:08:16 GMT-0400 (Eastern Daylight Time)[...]
Found : user_pref("CT2818425.LastLogin_3.15.1.0", "Tue Oct 09 2012 21:59:26 GMT-0400 (Eastern Daylight Time)[...]
Found : user_pref("CT2818425.LatestVersion", "3.15.1.0");
Found : user_pref("CT2818425.Locale", "en");
Found : user_pref("CT2818425.MCDetectTooltipHeight", "83");
Found : user_pref("CT2818425.MCDetectTooltipUrl", "hxxp://@EB_INSTALL_LINK@/rank/tooltip/?version=1");
Found : user_pref("CT2818425.MCDetectTooltipWidth", "295");
Found : user_pref("CT2818425.MyStuffEnabledAtInstallation", true);
Found : user_pref("CT2818425.OriginalFirstVersion", "3.10.0.1");
Found : user_pref("CT2818425.RadioIsPodcast", false);
Found : user_pref("CT2818425.RadioLastCheckTime", "Mon Mar 12 2012 15:16:07 GMT-0400 (Eastern Daylight Time)[...]
Found : user_pref("CT2818425.RadioLastUpdateIPServer", "3");
Found : user_pref("CT2818425.RadioLastUpdateServer", "129330101464100000");
Found : user_pref("CT2818425.RadioMediaID", "21515677");
Found : user_pref("CT2818425.RadioMediaType", "Media Player");
Found : user_pref("CT2818425.RadioMenuSelectedID", "EBRadioMenu_CT281842521515677");
Found : user_pref("CT2818425.RadioShrinkedFromSetup", false);
Found : user_pref("CT2818425.RadioStationName", "Virgin%20Radio%20Classic%20Rock");
Found : user_pref("CT2818425.RadioStationURL", "hxxp://www.smgradio.com/core/audio/wmp/live.asx?service=vcbb[...]
Found : user_pref("CT2818425.SearchCaption", "vshare.tv Customized Web Search");
Found : user_pref("CT2818425.SearchEngineBeforeUnload", "chrome://browser-region/locale/region.properties");
Found : user_pref("CT2818425.SearchFromAddressBarIsInit", true);
Found : user_pref("CT2818425.SearchFromAddressBarUrl", "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT281[...]
Found : user_pref("CT2818425.SearchInNewTabEnabled", true);
Found : user_pref("CT2818425.SearchInNewTabIntervalMM", 1440);
Found : user_pref("CT2818425.SearchInNewTabLastCheckTime", "Tue Oct 09 2012 21:59:25 GMT-0400 (Eastern Dayli[...]
Found : user_pref("CT2818425.SearchInNewTabServiceUrl", "hxxp://newtab.conduit-hosting.com/newtab/?ctid=EB_T[...]
Found : user_pref("CT2818425.SearchInNewTabUserEnabled", false);
Found : user_pref("CT2818425.SearchProtectorEnabled", false);
Found : user_pref("CT2818425.SearchProtectorToolbarDisabled", false);
Found : user_pref("CT2818425.SendProtectorDataViaLogin", true);
Found : user_pref("CT2818425.ServiceMapLastCheckTime", "Tue Oct 09 2012 21:59:25 GMT-0400 (Eastern Daylight [...]
Found : user_pref("CT2818425.SettingsLastCheckTime", "Tue Oct 09 2012 21:59:25 GMT-0400 (Eastern Daylight Ti[...]
Found : user_pref("CT2818425.SettingsLastUpdate", "1348502557");
Found : user_pref("CT2818425.TBHomePageUrl", "hxxp://search.conduit.com/?ctid=CT2818425&SearchSource=13");
Found : user_pref("CT2818425.ThirdPartyComponentsInterval", 504);
Found : user_pref("CT2818425.ThirdPartyComponentsLastCheck", "Sat Mar 10 2012 12:21:45 GMT-0500 (Eastern Sta[...]
Found : user_pref("CT2818425.ThirdPartyComponentsLastUpdate", "1312887586");
Found : user_pref("CT2818425.ToolbarShrinkedFromSetup", false);
Found : user_pref("CT2818425.TrusteLinkUrl", "hxxp://trust.conduit.com/CT2818425");
Found : user_pref("CT2818425.TrustedApiDomains", "conduit.com,conduit-hosting.com,conduit-services.com,clien[...]
Found : user_pref("CT2818425.UserID", "UN47956079780564975");
Found : user_pref("CT2818425.alertChannelId", "1210492");
Found : user_pref("CT2818425.autoDisableScopes", -1);
Found : user_pref("CT2818425.backendstorage.cbfirsttime", "536174204D617220313020323031322031323A32323A34362[...]
Found : user_pref("CT2818425.backendstorage.key_user_agree_ia12", "31");
Found : user_pref("CT2818425.backendstorage.shoppingapp.gk.exipres", "546875204D617220313520323031322031323A[...]
Found : user_pref("CT2818425.backendstorage.shoppingapp.gk.geolocation", "756E6974656420737461746573");
Found : user_pref("CT2818425.backendstorage.user_uniqueid", "66323865656365622D633762322D306639302D356637662[...]
Found : user_pref("CT2818425.components.1000234", false);
Found : user_pref("CT2818425.generalConfigFromLogin", "{\"ApiMaxAlerts\":\"12\",\"SocialDomains\":\"social.c[...]
Found : user_pref("CT2818425.globalFirstTimeInfoLastCheckTime", "Tue Mar 13 2012 03:44:07 GMT-0400 (Eastern [...]
Found : user_pref("CT2818425.homepageProtectorEnableByLogin", true);
Found : user_pref("CT2818425.initDone", true);
Found : user_pref("CT2818425.isAppTrackingManagerOn", true);
Found : user_pref("CT2818425.isFirstRadioInstallation", false);
Found : user_pref("CT2818425.myStuffEnabled", true);
Found : user_pref("CT2818425.myStuffPublihserMinWidth", 400);
Found : user_pref("CT2818425.myStuffSearchUrl", "hxxp://Apps.conduit.com/search?q=SEARCH_TERM&SearchSourceOr[...]
Found : user_pref("CT2818425.myStuffServiceIntervalMM", 1440);
Found : user_pref("CT2818425.myStuffServiceUrl", "hxxp://mystuff.conduit-services.com/MyStuffService.ashx?Co[...]
Found : user_pref("CT2818425.navigateToUrlOnSearch", false);
Found : user_pref("CT2818425.revertSettingsEnabled", false);
Found : user_pref("CT2818425.searchProtectorDialogDelayInSec", 10);
Found : user_pref("CT2818425.searchProtectorEnableByLogin", true);
Found : user_pref("CT2818425.testingCtid", "");
Found : user_pref("CT2818425.toolbarAppMetaDataLastCheckTime", "Tue Oct 09 2012 21:59:26 GMT-0400 (Eastern D[...]
Found : user_pref("CT2818425.toolbarContextMenuLastCheckTime", "Sat Mar 10 2012 12:21:47 GMT-0500 (Eastern S[...]
Found : user_pref("CT2818425.usagesFlag", 2);
Found : user_pref("CommunityToolbar.ETag.hxxp://Settings.toolbar.search.conduit.com/root/CT2818425/CT2818425[...]
Found : user_pref("CommunityToolbar.ETag.hxxp://alerts.conduit-services.com/root/1210492/1206165/US", "\"0\"[...]
Found : user_pref("CommunityToolbar.ETag.hxxp://appsmetadata.toolbar.conduit-services.com/?ctid=CT2818425", [...]
Found : user_pref("CommunityToolbar.ETag.hxxp://contextmenu.toolbar.conduit-services.com/?name=GottenApps&lo[...]
Found : user_pref("CommunityToolbar.ETag.hxxp://contextmenu.toolbar.conduit-services.com/?name=GottenApps&lo[...]
Found : user_pref("CommunityToolbar.ETag.hxxp://contextmenu.toolbar.conduit-services.com/?name=OtherApps&loc[...]
Found : user_pref("CommunityToolbar.ETag.hxxp://contextmenu.toolbar.conduit-services.com/?name=OtherApps&loc[...]
Found : user_pref("CommunityToolbar.ETag.hxxp://contextmenu.toolbar.conduit-services.com/?name=SharedApps&lo[...]
Found : user_pref("CommunityToolbar.ETag.hxxp://contextmenu.toolbar.conduit-services.com/?name=SharedApps&lo[...]
Found : user_pref("CommunityToolbar.ETag.hxxp://contextmenu.toolbar.conduit-services.com/?name=Toolbar&local[...]
Found : user_pref("CommunityToolbar.ETag.hxxp://contextmenu.toolbar.conduit-services.com/?name=Toolbar&local[...]
Found : user_pref("CommunityToolbar.ETag.hxxp://dynamicdialogs.alert.conduit-services.com/alert/dlg.pkg", "\[...]
Found : user_pref("CommunityToolbar.ETag.hxxp://dynamicdialogs.toolbar.conduit-services.com/DLG.pkg?ver=3.10[...]
Found : user_pref("CommunityToolbar.ETag.hxxp://dynamicdialogs.toolbar.conduit-services.com/DLG.pkg?ver=3.12[...]
Found : user_pref("CommunityToolbar.ETag.hxxp://dynamicdialogs.toolbar.conduit-services.com/DLG.pkg?ver=3.12[...]
Found : user_pref("CommunityToolbar.ETag.hxxp://dynamicdialogs.toolbar.conduit-services.com/DLG.pkg?ver=3.13[...]
Found : user_pref("CommunityToolbar.ETag.hxxp://dynamicdialogs.toolbar.conduit-services.com/DLG.pkg?ver=3.14[...]
Found : user_pref("CommunityToolbar.ETag.hxxp://dynamicdialogs.toolbar.conduit-services.com/DLG.pkg?ver=3.15[...]
Found : user_pref("CommunityToolbar.ETag.hxxp://servicemap.conduit-services.com/Toolbar/?ownerId=CT2818425",[...]
Found : user_pref("CommunityToolbar.ETag.hxxp://translation.toolbar.conduit-services.com/?locale=en", "\"abd[...]
Found : user_pref("CommunityToolbar.LatestLibsPath", "file:///C:\\Users\\Marci\\AppData\\Roaming\\Mozilla\\F[...]
Found : user_pref("CommunityToolbar.LatestToolbarVersionInstalled", "3.10.0.1");
Found : user_pref("CommunityToolbar.SearchFromAddressBarSavedUrl", "");
Found : user_pref("CommunityToolbar.ToolbarsList", "CT2818425");
Found : user_pref("CommunityToolbar.ToolbarsList2", "CT2818425");
Found : user_pref("CommunityToolbar.ToolbarsList4", "CT2818425");
Found : user_pref("CommunityToolbar.facebook.settingsLastCheckTime", "Sat Mar 10 2012 12:21:46 GMT-0500 (Eas[...]
Found : user_pref("CommunityToolbar.globalUserId", "ce284a29-936e-4e3d-8959-c2454901cb38");
Found : user_pref("CommunityToolbar.isAlertUrlAddedToFeedItemTable", true);
Found : user_pref("CommunityToolbar.isClickActionAddedToFeedItemTable", true);
Found : user_pref("CommunityToolbar.notifications.alertDialogsGetterLastCheckTime", "Sat Mar 10 2012 12:21:4[...]
Found : user_pref("CommunityToolbar.notifications.alertEnabled", false);
Found : user_pref("CommunityToolbar.notifications.alertInfoInterval", 1440);
Found : user_pref("CommunityToolbar.notifications.alertInfoLastCheckTime", "Sat Mar 10 2012 12:21:54 GMT-050[...]
Found : user_pref("CommunityToolbar.notifications.clientsServerUrl", "hxxp://alert.client.conduit.com");
Found : user_pref("CommunityToolbar.notifications.locale", "");
Found : user_pref("CommunityToolbar.notifications.loginIntervalMin", 0);
Found : user_pref("CommunityToolbar.notifications.loginLastCheckTime", "Sun Mar 11 2012 15:15:59 GMT-0400 (E[...]
Found : user_pref("CommunityToolbar.notifications.loginLastUpdateTime", "");
Found : user_pref("CommunityToolbar.notifications.messageShowTimeSec", 20);
Found : user_pref("CommunityToolbar.notifications.servicesServerUrl", "hxxp://alert.services.conduit.com");
Found : user_pref("CommunityToolbar.notifications.showTrayIcon", false);
Found : user_pref("CommunityToolbar.notifications.userCloseIntervalMin", 300);
Found : user_pref("CommunityToolbar.notifications.userId", "a89fae1e-e252-4857-968b-f406d88530b2");
Found : user_pref("CommunityToolbar.originalHomepage", "hxxp://www.facebook.com/marci.gower");
Found : user_pref("CommunityToolbar.originalSearchEngine", "chrome://browser-region/locale/region.properties[...]
Found : user_pref("vshare.install.date", "1329957972");
Found : user_pref("vshare.install.finished", "1.0.0");
Found : user_pref("vshare.install.fresh", "false");
Found : user_pref("vshare.install.guid", "{f691f350-1798-4560-bd1c-acf558070cd1}");
Found : user_pref("vshare.install.newtab", false);
*************************
AdwCleaner[R1].txt - [18127 octets] - [10/10/2012 19:52:36]
########## EOF - C:\AdwCleaner[R1].txt - [18188 octets] ##########
-
RogueKiller Report:
RogueKiller V8.1.1 [10/03/2012] by Tigzy
mail: tigzyRK<at>gmail<dot>com
Feedback: http://www.geekstogo.com/forum/files/file/413-roguekiller/
Website: http://tigzy.geekstogo.com/roguekiller.php
Blog: http://tigzyrk.blogspot.com
Operating System: Windows 7 (6.1.7601 Service Pack 1) 64 bits version
Started in : Normal mode
User : Marci [Admin rights]
Mode : Scan -- Date : 10/10/2012 19:38:15
¤¤¤ Bad processes : 0 ¤¤¤
¤¤¤ Registry Entries : 5 ¤¤¤
[TASK][sUSP PATH] {5F6010C8-60E5-41f3-BF5B-C3AF5DBE12D4} : "C:\ProgramData\Carbonite\Carbonite Backup\CarboniteUpgrade.exe" /silent -> FOUND
[DNS] HKLM\[...]\ControlSet001\Services\Interfaces\{AA180B28-E6AA-4BED-AE1A-9E3A74AEE289} : NameServer (10.197.48.1) -> FOUND
[DNS] HKLM\[...]\ControlSet002\Services\Interfaces\{AA180B28-E6AA-4BED-AE1A-9E3A74AEE289} : NameServer (10.197.48.1) -> FOUND
[HJ DESK] HKLM\[...]\NewStartPanel : {59031a47-3f72-44a7-89c5-5595fe6b30ee} (1) -> FOUND
[HJ DESK] HKLM\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> FOUND
¤¤¤ Particular Files / Folders: ¤¤¤
¤¤¤ Driver : [NOT LOADED] ¤¤¤
¤¤¤ HOSTS File: ¤¤¤
--> C:\Windows\system32\drivers\etc\hosts
¤¤¤ MBR Check: ¤¤¤
+++++ PhysicalDrive0: WDC WD3200BPVT-22ZEST0 +++++
--- User ---
[MBR] 2d9ca7f73f0d18cd6176639eeb124826
[bSP] ff54479be1e29a3382a6e6f5272fdc2f : Windows 7 MBR Code
Partition table:
0 - [XXXXXX] ACER (0x27) [VISIBLE] Offset (sectors): 2048 | Size: 15360 Mo
1 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 31459328 | Size: 100 Mo
2 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 31664128 | Size: 289783 Mo
User = LL1 ... OK!
User = LL2 ... OK!
+++++ PhysicalDrive1: Broadcom SD SCSI Disk Device +++++
--- User ---
[MBR] 5a63b18f8797aa298b3847db3395fcd1
[bSP] df4f83c1f72e36823a12b0dfc7617313 : MBR Code unknown
Partition table:
0 - [XXXXXX] FAT16 (0x06) [VISIBLE] Offset (sectors): 233 | Size: 489 Mo
User = LL1 ... OK!
Error reading LL2 MBR!
Finished : << RKreport[1].txt >>
RKreport[1].txt
-
Attach.txt.. erm.. attached!
I'll run rogue killer now. Thanks for the quick reply!
never mind, didn't attach... posted below
.
UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT
.
DDS (Ver_2011-08-26.01)
.
Microsoft Windows 7 Home Premium
Boot Device: \Device\HarddiskVolume2
Install Date: 8/1/2011 5:39:40 PM
System Uptime: 10/10/2012 5:27:01 PM (1 hours ago)
.
Motherboard: Acer | | JE50_HR
Processor: Intel® Core i3-2310M CPU @ 2.10GHz | CPU1 | 2100/1333mhz
.
==== Disk Partitions =========================
.
C: is FIXED (NTFS) - 283 GiB total, 218.008 GiB free.
D: is CDROM ()
E: is Removable
F: is Removable
.
==== Disabled Device Manager Items =============
.
Class GUID: {eec5ad98-8080-425f-922a-dabf3de3f69a}
Description: WPD FileSystem Volume Driver
Device ID: WPDBUSENUMROOT\UMB\2&37C186B&0&STORAGE#VOLUME#_??_USBSTOR#DISK&VEN_SANDISK&PROD_CRUZER&REV_1.26#200605727102E240C93D&0#
Manufacturer: Microsoft
Name: WPD FileSystem Volume Driver
PNP Device ID: WPDBUSENUMROOT\UMB\2&37C186B&0&STORAGE#VOLUME#_??_USBSTOR#DISK&VEN_SANDISK&PROD_CRUZER&REV_1.26#200605727102E240C93D&0#
Service: WUDFRd
.
Class GUID: {eec5ad98-8080-425f-922a-dabf3de3f69a}
Description: SD
Device ID: WPDBUSENUMROOT\UMB\2&37C186B&0&STORAGE#VOLUME#_??_SCSI#DISK&VEN_BROADCOM&PROD_SD&REV_0001#5&74D8BEC&0&000000#
Manufacturer: Broadcom
Name: LEXAR MEDIA
PNP Device ID: WPDBUSENUMROOT\UMB\2&37C186B&0&STORAGE#VOLUME#_??_SCSI#DISK&VEN_BROADCOM&PROD_SD&REV_0001#5&74D8BEC&0&000000#
Service: WUDFRd
.
==== System Restore Points ===================
.
RP163: 10/7/2012 1:49:39 AM - Windows Update
RP164: 10/8/2012 9:25:12 PM - Installed Java 6 Update 35
RP165: 10/9/2012 9:19:10 PM - Restore Operation
RP167: 10/9/2012 9:40:46 PM - Windows Update
RP169: 10/10/2012 5:05:47 PM - Windows Update
.
==== Installed Programs ======================
.
µTorrent
Acer Backup Manager
Acer Crystal Eye Webcam
Acer ePower Management
Acer eRecovery Management
Acer Games
Acer Registration
Acer ScreenSaver
Acer Updater
Acrobat.com
Adobe Acrobat X Pro - English, Français, Deutsch
Adobe AIR
Adobe Community Help
Adobe Flash Player 11 ActiveX
Adobe Flash Player 11 Plugin
Adobe Media Player
Adobe Photoshop CS5
Adobe Reader 9.1 MUI
Agatha Christie - 4:50 from Paddington
Apple Application Support
Apple Software Update
Backup Manager V3
BBC iPlayer Desktop
Bejeweled 2 Deluxe
Build-a-lot 2
Carbonite
Chuzzle Deluxe
clear.fi
clear.fi Client
D3DX10
Diner Dash 2 Restaurant Rescue
Dolby Advanced Audio v2
Dora's World Adventure
eBay Worldwide
Expat Shield 2.24
FATE - The Traitor Soul
Final Drive: Nitro
Galerie de photos Windows Live
Identity Card
Intel® Control Center
Intel® Management Engine Components
Intel® Processor Graphics
Intel® Rapid Storage Technology
Java Auto Updater
Java 6 Update 31
Jewel Quest Heritage
Junk Mail filter update
Launch Manager
LinkedIn Outlook Connector
Malwarebytes Anti-Malware version 1.65.0.1400
McAfee Security Scan Plus
MediaEspresso
Mesh Runtime
Microsoft Office 2010
Microsoft Office Live Small Business Image Uploader
Microsoft SQL Server 2005 Compact Edition [ENU]
Microsoft Visual C++ 2005 Redistributable
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
Microsoft_VC80_ATL_x86
Microsoft_VC80_CRT_x86
Microsoft_VC80_MFC_x86
Microsoft_VC80_MFCLOC_x86
Microsoft_VC90_ATL_x86
Microsoft_VC90_CRT_x86
Microsoft_VC90_MFC_x86
Mozilla Firefox 15.0 (x86 en-US)
Mozilla Firefox 15.0.1 (x86 en-US)
Mozilla Maintenance Service
MSVCRT
MSVCRT_amd64
MSXML 4.0 SP2 (KB954430)
MSXML 4.0 SP2 (KB973688)
Mystery P.I. - Stolen in San Francisco
MyWinLocker 4
MyWinLocker Suite
Namco All-Stars: PAC-MAN
newsXpresso
NOOK for PC
Norton Online Backup
NTI Media Maker 9
PDF Settings CS5
Penguins!
Plants vs. Zombies - Game of the Year
Poker Superstars III
Polar Bowler
Polar Golfer
QuickTime
Realtek High Definition Audio Driver
Security Update for Microsoft .NET Framework 4 Client Profile (KB2478663)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2518870)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2539636)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2572078)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2604121)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2633870)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2656351)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2656368)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2656368v2)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2656405)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2686827)
Shredder
Skype™ 5.10
Times Reader
Torchlight
Update for Microsoft .NET Framework 4 Client Profile (KB2468871)
Update for Microsoft .NET Framework 4 Client Profile (KB2533523)
Update for Microsoft .NET Framework 4 Client Profile (KB2600217)
Update Installer for WildTangent Games App
Virtual Villagers 4 - The Tree of Life
vshare.tv Bar Toolbar
vShare.tv plugin 1.3
Welcome Center
WildTangent Games App (Acer Games)
Windows Live
Windows Live Communications Platform
Windows Live Essentials
Windows Live Installer
Windows Live Mail
Windows Live Mesh
Windows Live Messenger
Windows Live Movie Maker
Windows Live Photo Common
Windows Live Photo Gallery
Windows Live PIMT Platform
Windows Live SOXE
Windows Live SOXE Definitions
Windows Live UX Platform
Windows Live UX Platform Language Pack
Windows Live Writer
Windows Live Writer Resources
Zuma's Revenge
.
==== Event Viewer Messages From Past Week ========
.
10/9/2012 9:55:58 PM, Error: Microsoft Antimalware [3002] - Microsoft Antimalware Real-Time Protection feature has encountered an error and failed. Feature: Network Inspection System Error Code: 0x8007045b Error description: A system shutdown is in progress. Reason: The system is missing updates that are required for running Network Inspection System. Install the required updates and restart the computer.
10/9/2012 9:45:58 PM, Error: Microsoft Antimalware [3002] - Microsoft Antimalware Real-Time Protection feature has encountered an error and failed. Feature: Network Inspection System Error Code: 0x80070714 Error description: The specified image file did not contain a resource section. Reason: The system is missing updates that are required for running Network Inspection System. Install the required updates and restart the computer.
10/9/2012 9:41:50 PM, Error: Microsoft-Windows-WindowsUpdateClient [20] - Installation Failure: Windows failed to install the following update with error 0x80070643: Definition Update for Microsoft Security Essentials - KB2310138 (Definition 1.137.1428.0).
10/9/2012 9:41:25 PM, Error: Microsoft Antimalware [3002] - Microsoft Antimalware Real-Time Protection feature has encountered an error and failed. Feature: Network Inspection System Error Code: 0x80070714 Error description: The specified image file did not contain a resource section. Reason: Antimalware protection has stopped functioning for an unknown reason. In some instances, restarting the service may resolve the problem.
10/9/2012 9:41:24 PM, Error: Microsoft Antimalware [2003] - Microsoft Antimalware has encountered an error trying to update the engine. New Engine Version: Previous Engine Version: 2.1.8600.0 Engine Type: Network Inspection System User: NT AUTHORITY\SYSTEM Error Code: 0x80070714 Error description: The specified image file did not contain a resource section.
10/9/2012 9:41:24 PM, Error: Microsoft Antimalware [2001] - Microsoft Antimalware has encountered an error trying to update signatures. New Signature Version: Previous Signature Version: 15.11.0.0 Update Source: User Update Stage: Install Source Path: Signature Type: Network Inspection System Update Type: Full User: NT AUTHORITY\SYSTEM Current Engine Version: Previous Engine Version: 2.1.8600.0 Error code: 0x80070714 Error description: The specified image file did not contain a resource section.
10/9/2012 9:41:24 PM, Error: Microsoft Antimalware [2001] - Microsoft Antimalware has encountered an error trying to update signatures. New Signature Version: Previous Signature Version: 1.137.1428.0 Update Source: Microsoft Update Server Update Stage: Install Source Path: http://www.microsoft.com Signature Type: AntiVirus Update Type: Full User: NT AUTHORITY\SYSTEM Current Engine Version: Previous Engine Version: 1.1.8800.0 Error code: 0x80070643 Error description: Fatal error during installation.
10/9/2012 9:35:42 PM, Error: Service Control Manager [7031] - The CarboniteService service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service.
10/9/2012 9:24:44 PM, Error: Microsoft Antimalware [3002] - Microsoft Antimalware Real-Time Protection feature has encountered an error and failed. Feature: Network Inspection System Error Code: 0x80070714 Error description: The specified image file did not contain a resource section. Reason: The system is missing updates that are required for running Network Inspection System. Install the required updates and restart the computer.
10/9/2012 9:24:33 PM, Error: Microsoft Antimalware [2004] - Microsoft Antimalware has encountered an error trying to load signatures and will attempt reverting back to a known-good set of signatures. Signatures Attempted: Current Error Code: 0x80070002 Error description: The system cannot find the file specified. Signature version: 1.137.851.0;1.137.851.0 Engine version: 1.1.8800.0
10/9/2012 9:23:28 PM, Error: Microsoft-Windows-Kernel-General [5] - {Registry Hive Recovered} Registry hive (file): '\??\Volume{a89333b3-7ed5-11e0-942b-806e6f6e6963}\System Volume Information\SystemRestore\{41E15251-8C93-4F8D-8158-20B72308443F}' was corrupted and it has been recovered. Some data might have been lost.
10/9/2012 5:01:52 PM, Error: Service Control Manager [7000] - The Sendori service failed to start due to the following error: The system cannot find the file specified.
10/9/2012 10:54:29 PM, Error: Microsoft Antimalware [3002] - Microsoft Antimalware Real-Time Protection feature has encountered an error and failed. Feature: Network Inspection System Error Code: 0x80070714 Error description: The specified image file did not contain a resource section. Reason: The system is missing updates that are required for running Network Inspection System. Install the required updates and restart the computer.
10/9/2012 10:53:00 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1068" attempting to start the service fdPHost with arguments "" in order to run the server: {D3DCB472-7261-43CE-924B-0704BD730D5F}
10/9/2012 10:53:00 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1068" attempting to start the service fdPHost with arguments "" in order to run the server: {145B4335-FE2A-4927-A040-7C35AD3180EF}
10/9/2012 10:52:57 PM, Error: Service Control Manager [7001] - The HomeGroup Provider service depends on the Function Discovery Provider Host service which failed to start because of the following error: The dependency service or group failed to start.
10/9/2012 10:52:49 PM, Error: Service Control Manager [7001] - The Computer Browser service depends on the Server service which failed to start because of the following error: The dependency service or group failed to start.
10/9/2012 10:52:46 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service WSearch with arguments "" in order to run the server: {9E175B6D-F52A-11D8-B9A5-505054503030}
10/9/2012 10:52:46 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service WSearch with arguments "" in order to run the server: {7D096C5F-AC08-4F1F-BEB7-5C22C517CE39}
10/9/2012 10:52:44 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service EventSystem with arguments "" in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF}
10/9/2012 10:52:43 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service CarboniteService with arguments "" in order to run the server: {36471C67-6A93-4434-92CC-4C614CD06666}
10/9/2012 10:52:35 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service ShellHWDetection with arguments "" in order to run the server: {DD522ACC-F821-461A-A407-50B198B896DC}
10/9/2012 10:52:30 PM, Error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: discache MpFilter mwlPSDFilter mwlPSDNServ mwlPSDVDisk spldr Wanarpv6
10/9/2012 10:46:57 PM, Error: Microsoft Antimalware [3002] - Microsoft Antimalware Real-Time Protection feature has encountered an error and failed. Feature: Network Inspection System Error Code: 0x80070714 Error description: The specified image file did not contain a resource section. Reason: The system is missing updates that are required for running Network Inspection System. Install the required updates and restart the computer.
10/8/2012 8:30:06 PM, Error: Service Control Manager [7034] - The Application Sendori service terminated unexpectedly. It has done this 1 time(s).
10/8/2012 5:18:35 PM, Error: Ntfs [55] - The file system structure on the disk is corrupt and unusable. Please run the chkdsk utility on the volume Acer.
10/8/2012 2:07:16 PM, Error: Service Control Manager [7034] - The Sendoriv1 service terminated unexpectedly. It has done this 1 time(s).
10/8/2012 2:06:36 PM, Error: Service Control Manager [7009] - A timeout was reached (30000 milliseconds) while waiting for the Service Sendori service to connect.
10/8/2012 2:06:36 PM, Error: Service Control Manager [7000] - The Service Sendori service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
10/4/2012 9:12:42 AM, Error: Microsoft-Windows-WER-SystemErrorReporting [1001] - The computer has rebooted from a bugcheck. The bugcheck was: 0x0000009f (0x0000000000000003, 0xfffffa8004029e30, 0xfffff80000b9c3d8, 0xfffffa800909b320). A dump was saved in: C:\Windows\MEMORY.DMP. Report Id: 100412-62681-01.
10/10/2012 5:41:20 PM, Error: Microsoft-Windows-Kernel-General [5] - {Registry Hive Recovered} Registry hive (file): '\??\C:\Windows\System32\SMI\Store\Machine\SCHEMA.DAT' was corrupted and it has been recovered. Some data might have been lost.
10/10/2012 5:29:58 PM, Error: Service Control Manager [7001] - The Intel® Management and Security Application User Notification Service service depends on the Intel® Management and Security Application Local Management Service service which failed to start because of the following error: The system cannot find the file specified.
10/10/2012 5:29:58 PM, Error: Service Control Manager [7000] - The Intel® Management and Security Application Local Management Service service failed to start due to the following error: The system cannot find the file specified.
10/10/2012 5:29:54 PM, Error: Service Control Manager [7000] - The Intel® Rapid Storage Technology service failed to start due to the following error: Access is denied.
10/10/2012 5:27:53 PM, Error: Microsoft Antimalware [3002] - Microsoft Antimalware Real-Time Protection feature has encountered an error and failed. Feature: Network Inspection System Error Code: 0x80070714 Error description: The specified image file did not contain a resource section. Reason: The system is missing updates that are required for running Network Inspection System. Install the required updates and restart the computer.
10/10/2012 5:27:51 PM, Error: Service Control Manager [7000] - The NTI IScheduleSvc service failed to start due to the following error: The system cannot find the file specified.
10/10/2012 5:27:51 PM, Error: Service Control Manager [7000] - The Norton Online Backup service failed to start due to the following error: Access is denied.
10/10/2012 5:27:51 PM, Error: Service Control Manager [7000] - The GREGService service failed to start due to the following error: The system cannot find the file specified.
10/10/2012 5:27:51 PM, Error: Service Control Manager [7000] - The Expat Shield Service service failed to start due to the following error: The system cannot find the file specified.
10/10/2012 5:27:51 PM, Error: Service Control Manager [7000] - The Expat Shield Routing Service service failed to start due to the following error: The system cannot find the file specified.
10/10/2012 5:27:51 PM, Error: Service Control Manager [7000] - The Expat Shield Monitoring Service service failed to start due to the following error: The system cannot find the file specified.
10/10/2012 5:27:51 PM, Error: Service Control Manager [7000] - The Dritek WMI Service service failed to start due to the following error: The system cannot find the file specified.
.
==== End Of File ===========================
-
Attach.txt.. erm.. attached!
I'll run rogue killer now. Thanks for the quick reply!
-
My wife was on the net over the weekend and has been complaining of slowness on her system, no popups, but I did notice an installation of ilivid had appeared in her Programs control panel. I scanned with MSE and removed the rogue java entries that popped up.
I then did a system restore to last week. (this probably wasn't the best thing to do thinking about it, but well, can't roll back, the roll back).
I ran MBAM in safe mode and removed some myWebSearch stuff from the PC. Rebooted, ran MBAM again in normal mode with nothing found.
Symptoms: Nothing in the Start Menu > Programs, unable to open certain exe files (iexplore, firefox) and it seems some permission changes on her user directory. There are no issues with opening files in safe mode.
Many thanks in advance for the help!
DDS log:
.
DDS (Ver_2011-08-26.01) - NTFSAMD64
Internet Explorer: 9.0.8112.16421 BrowserJavaVersion: 1.6.0_31
Run by Marci at 18:23:24 on 2012-10-10
Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.3948.2549 [GMT -4:00]
.
AV: Microsoft Security Essentials *Enabled/Updated* {B140BF4E-23BB-4198-90AB-A51A4C60A69C}
SP: Microsoft Security Essentials *Enabled/Updated* {0A215EAA-0581-4E16-AA1B-9E6837E7EC21}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
============== Running Processes ===============
.
C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\svchost.exe -k RPCSS
c:\Program Files\Microsoft Security Client\MsMpEng.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Carbonite\Carbonite Backup\carboniteservice.exe
C:\Program Files\Acer\Acer ePower Management\ePowerSvc.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
C:\Program Files\Acer\Acer Updater\UpdaterService.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\Windows\system32\SearchIndexer.exe
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\taskhost.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\igfxtray.exe
C:\Windows\system32\hkcmd.exe
C:\Windows\system32\igfxpers.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe
C:\Windows\system32\igfxsrvc.exe
C:\Program Files\Microsoft Security Client\msseces.exe
C:\Windows\system32\igfxext.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Program Files\Acer\Acer ePower Management\ePowerEvent.exe
C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
C:\Windows\system32\wuauclt.exe
C:\Windows\system32\vssvc.exe
C:\Windows\System32\svchost.exe -k swprv
C:\Windows\system32\taskhost.exe
C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\conhost.exe
C:\Windows\SysWOW64\cscript.exe
C:\Windows\system32\wbem\wmiprvse.exe
.
============== Pseudo HJT Report ===============
.
uStart Page = hxxp://acer.msn.com
uDefault_Page_URL = hxxp://acer.msn.com
mDefault_Page_URL = hxxp://acer.msn.com
mStart Page = hxxp://acer.msn.com
uInternet Settings,ProxyOverride = *.local
uURLSearchHooks: vshare.tv Bar Toolbar: {7aeb3efd-e564-43f1-b658-5058a7c5743b} - C:\Program Files (x86)\vshare.tv_Bar\prxtbvsha.dll
mURLSearchHooks: vshare.tv Bar Toolbar: {7aeb3efd-e564-43f1-b658-5058a7c5743b} - C:\Program Files (x86)\vshare.tv_Bar\prxtbvsha.dll
mWinlogon: Userinit=userinit.exe,
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
BHO: Expat Shield Class: {3706ee7c-3cad-445d-8a43-03ebc3b75908} - C:\Program Files (x86)\Expat Shield\HssIE\ExpatIE.dll
BHO: Groove GFS Browser Helper: {72853161-30c5-4d22-b7f9-0bbc1d38a37e} - C:\PROGRA~2\MICROS~4\Office14\GROOVEEX.DLL
BHO: Java™ Plug-In SSV Helper: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - C:\Program Files (x86)\Java\jre6\bin\ssv.dll
BHO: vshare.tv Bar Toolbar: {7aeb3efd-e564-43f1-b658-5058a7c5743b} - C:\Program Files (x86)\vshare.tv_Bar\prxtbvsha.dll
BHO: Windows Live ID Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
BHO: Adobe PDF Conversion Toolbar Helper: {ae7cd045-e861-484f-8273-0445ee161910} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
BHO: Office Document Cache Handler: {b4f3a835-0e21-4959-ba22-42b3008e02ff} - C:\PROGRA~2\MICROS~4\Office14\URLREDIR.DLL
BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll
BHO: SmartSelect Class: {f4971ee7-daa0-4053-9964-665d8ee6a077} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
TB: Adobe PDF: {47833539-d0c5-4125-9fa8-0819e2eaac93} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
TB: vshare.tv Bar Toolbar: {7aeb3efd-e564-43f1-b658-5058a7c5743b} - C:\Program Files (x86)\vshare.tv_Bar\prxtbvsha.dll
uRun: [iSUSPM] C:\ProgramData\FLEXnet\Connect\11\ISUSPM.exe -scheduler
mRun: [iAStorIcon] C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe
mRun: [suiteTray] "C:\Program Files (x86)\EgisTec MyWinLockerSuite\x86\SuiteTray.exe"
mRun: [EgisTecPMMUpdate] "C:\Program Files (x86)\EgisTec IPS\PmmUpdate.exe"
mRun: [EgisUpdate] "C:\Program Files (x86)\EgisTec IPS\EgisUpdate.exe" -d
mRun: [Norton Online Backup] C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuClient.exe
mRun: [Adobe Reader Speed Launcher] "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe"
mRun: [backupManagerTray] "C:\Program Files (x86)\NTI\Acer Backup Manager\BackupManagerTray.exe" -h -k
mRun: [LManager] C:\Program Files (x86)\Launch Manager\LManager.exe
mRun: [Dolby Advanced Audio v2] "C:\Dolby PCEE4\pcee4.exe" -autostart
mRun: [ArcadeMovieService] "C:\Program Files (x86)\Acer\clear.fi\Movie\clear.fiMovieService.exe"
mRun: [Carbonite Backup] C:\Program Files (x86)\Carbonite\Carbonite Backup\CarboniteUI.exe
mRun: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
mRun: [<NO NAME>]
mRun: [Adobe Acrobat Speed Launcher] "C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Acrobat_sl.exe"
mRun: [Acrobat Assistant 8.0] "C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Acrotray.exe"
mRun: [switchBoard] C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe
mRun: [AdobeCS5ServiceManager] "C:\Program Files (x86)\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe" -launchedbylogin
mRun: [APSDaemon] "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe"
mRun: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime
mRun: [iTunesHelper] "C:\Program Files (x86)\iTunes\iTunesHelper.exe"
mRun: [sunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
dRunOnce: [isMyWinLockerReboot] msiexec.exe /qn /x{voidguid}
StartupFolder: C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\Startup\MCAFEE~1.LNK - C:\Program Files (x86)\McAfee Security Scan\3.0.207\SSScheduler.exe
mPolicies-explorer: NoActiveDesktop = 1 (0x1)
mPolicies-system: ConsentPromptBehaviorAdmin = 5 (0x5)
mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3)
mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
IE: Append Link Target to Existing PDF - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: Append to Existing PDF - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert Link Target to Adobe PDF - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
IE: Convert to Adobe PDF - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECapture.html
IE: E&xport to Microsoft Excel - C:\PROGRA~1\MICROS~3\Office14\EXCEL.EXE/3000
IE: Se&nd to OneNote - C:\PROGRA~1\MICROS~3\Office14\ONBttnIE.dll/105
IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIE.dll
IE: {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - {FFFDC614-B694-4AE6-AB38-5D6374584B52} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIELinkedNotes.dll
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab
TCP: DhcpNameServer = 10.0.0.1
TCP: Interfaces\{43F073EE-7D78-4DC8-BC61-DB9FCB9A4C62} : DhcpNameServer = 10.0.0.1
TCP: Interfaces\{43F073EE-7D78-4DC8-BC61-DB9FCB9A4C62}\E4544574541425 : DhcpNameServer = 10.0.0.1
TCP: Interfaces\{AA180B28-E6AA-4BED-AE1A-9E3A74AEE289} : NameServer = 10.197.48.1
Filter: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\MSOXMLMF.DLL
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL
Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files (x86)\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll
SEH: Groove GFS Stub Execution Hook: {b5a7f190-dda6-4420-b3ba-52453494e6cd} - C:\PROGRA~2\MICROS~4\Office14\GROOVEEX.DLL
BHO-X64: Adobe PDF Link Helper: {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
BHO-X64: AcroIEHelperStub - No File
BHO-X64: Expat Shield Class: {3706EE7C-3CAD-445D-8A43-03EBC3B75908} - C:\Program Files (x86)\Expat Shield\HssIE\ExpatIE.dll
BHO-X64: Groove GFS Browser Helper: {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~2\MICROS~4\Office14\GROOVEEX.DLL
BHO-X64: Java™ Plug-In SSV Helper: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre6\bin\ssv.dll
BHO-X64: vshare.tv Bar Toolbar: {7aeb3efd-e564-43f1-b658-5058a7c5743b} - C:\Program Files (x86)\vshare.tv_Bar\prxtbvsha.dll
BHO-X64: vshare.tv Bar - No File
BHO-X64: Windows Live ID Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
BHO-X64: Adobe PDF Conversion Toolbar Helper: {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
BHO-X64: Office Document Cache Handler: {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~2\MICROS~4\Office14\URLREDIR.DLL
BHO-X64: URLRedirectionBHO - No File
BHO-X64: Java™ Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll
BHO-X64: SmartSelect Class: {F4971EE7-DAA0-4053-9964-665D8EE6A077} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
BHO-X64: SmartSelect - No File
TB-X64: Adobe PDF: {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
TB-X64: vshare.tv Bar Toolbar: {7aeb3efd-e564-43f1-b658-5058a7c5743b} - C:\Program Files (x86)\vshare.tv_Bar\prxtbvsha.dll
mRun-x64: [iAStorIcon] C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe
mRun-x64: [suiteTray] "C:\Program Files (x86)\EgisTec MyWinLockerSuite\x86\SuiteTray.exe"
mRun-x64: [EgisTecPMMUpdate] "C:\Program Files (x86)\EgisTec IPS\PmmUpdate.exe"
mRun-x64: [EgisUpdate] "C:\Program Files (x86)\EgisTec IPS\EgisUpdate.exe" -d
mRun-x64: [Norton Online Backup] C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuClient.exe
mRun-x64: [Adobe Reader Speed Launcher] "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe"
mRun-x64: [backupManagerTray] "C:\Program Files (x86)\NTI\Acer Backup Manager\BackupManagerTray.exe" -h -k
mRun-x64: [LManager] C:\Program Files (x86)\Launch Manager\LManager.exe
mRun-x64: [Dolby Advanced Audio v2] "C:\Dolby PCEE4\pcee4.exe" -autostart
mRun-x64: [ArcadeMovieService] "C:\Program Files (x86)\Acer\clear.fi\Movie\clear.fiMovieService.exe"
mRun-x64: [Carbonite Backup] C:\Program Files (x86)\Carbonite\Carbonite Backup\CarboniteUI.exe
mRun-x64: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
mRun-x64: [(Default)]
mRun-x64: [Adobe Acrobat Speed Launcher] "C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Acrobat_sl.exe"
mRun-x64: [Acrobat Assistant 8.0] "C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Acrotray.exe"
mRun-x64: [switchBoard] C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe
mRun-x64: [AdobeCS5ServiceManager] "C:\Program Files (x86)\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe" -launchedbylogin
mRun-x64: [APSDaemon] "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe"
mRun-x64: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime
mRun-x64: [iTunesHelper] "C:\Program Files (x86)\iTunes\iTunesHelper.exe"
mRun-x64: [sunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
SEH-X64: Groove GFS Stub Execution Hook: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\PROGRA~2\MICROS~4\Office14\GROOVEEX.DLL
.
================= FIREFOX ===================
.
FF - ProfilePath - C:\Users\Marci\AppData\Roaming\Mozilla\Firefox\Profiles\o3zmyekh.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.facebook.com/marci.gower
FF - plugin: C:\PROGRA~2\MICROS~4\Office14\NPAUTHZ.DLL
FF - plugin: C:\PROGRA~2\MICROS~4\Office14\NPSPWRAP.DLL
FF - plugin: C:\Program Files (x86)\Java\jre6\bin\plugin2\npdeployJava1.dll
FF - plugin: C:\Program Files (x86)\Java\jre6\bin\plugin2\npjp2.dll
FF - plugin: c:\Program Files (x86)\Microsoft Silverlight\5.1.10411.0\npctrlui.dll
FF - plugin: C:\Program Files (x86)\Mozilla Firefox\plugins\npdeployJava1.dll
FF - plugin: C:\Program Files (x86)\Mozilla Firefox\plugins\npvsharetvplg.dll
FF - plugin: C:\Program Files (x86)\WildTangent Games\App\BrowserIntegration\Registered\0\NP_wtapp.dll
FF - plugin: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll
FF - plugin: C:\Users\Marci\AppData\Roaming\Mozilla\Firefox\Profiles\o3zmyekh.default\extensions\{7aeb3efd-e564-43f1-b658-5058a7c5743b}\plugins\np-mswmp.dll
FF - plugin: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_4_402_265.dll
.
============= SERVICES / DRIVERS ===============
.
R0 MpFilter;Microsoft Malware Protection Driver;C:\Windows\system32\DRIVERS\MpFilter.sys --> C:\Windows\system32\DRIVERS\MpFilter.sys [?]
R1 mwlPSDFilter;mwlPSDFilter;C:\Windows\system32\DRIVERS\mwlPSDFilter.sys --> C:\Windows\system32\DRIVERS\mwlPSDFilter.sys [?]
R1 mwlPSDNServ;mwlPSDNServ;C:\Windows\system32\DRIVERS\mwlPSDNServ.sys --> C:\Windows\system32\DRIVERS\mwlPSDNServ.sys [?]
R1 mwlPSDVDisk;mwlPSDVDisk;C:\Windows\system32\DRIVERS\mwlPSDVDisk.sys --> C:\Windows\system32\DRIVERS\mwlPSDVDisk.sys [?]
R1 vwififlt;Virtual WiFi Filter Driver;C:\Windows\system32\DRIVERS\vwififlt.sys --> C:\Windows\system32\DRIVERS\vwififlt.sys [?]
R2 ePowerSvc;Acer ePower Service;C:\Program Files\Acer\Acer ePower Management\ePowerSvc.exe [2011-5-15 873064]
R2 Live Updater Service;Live Updater Service;C:\Program Files\Acer\Acer Updater\UpdaterService.exe [2011-4-6 244624]
R3 b57xdbd;Broadcom xD Picture Bus Driver Service;C:\Windows\system32\drivers\b57xdbd.sys --> C:\Windows\system32\drivers\b57xdbd.sys [?]
R3 b57xdmp;Broadcom xD Picture vstorp client drv;C:\Windows\system32\drivers\b57xdmp.sys --> C:\Windows\system32\drivers\b57xdmp.sys [?]
R3 bScsiMSa;bScsiMSa;C:\Windows\system32\drivers\bScsiMSa.sys --> C:\Windows\system32\drivers\bScsiMSa.sys [?]
R3 bScsiSDa;bScsiSDa;C:\Windows\system32\DRIVERS\bScsiSDa.sys --> C:\Windows\system32\DRIVERS\bScsiSDa.sys [?]
R3 IntcDAud;Intel® Display Audio;C:\Windows\system32\DRIVERS\IntcDAud.sys --> C:\Windows\system32\DRIVERS\IntcDAud.sys [?]
R3 k57nd60a;Broadcom NetLink ™ Gigabit Ethernet - NDIS 6.0;C:\Windows\system32\DRIVERS\k57nd60a.sys --> C:\Windows\system32\DRIVERS\k57nd60a.sys [?]
R3 MEIx64;Intel® Management Engine Interface;C:\Windows\system32\DRIVERS\HECIx64.sys --> C:\Windows\system32\DRIVERS\HECIx64.sys [?]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]
S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-3-18 138576]
S2 DsiWMIService;Dritek WMI Service;C:\Program Files (x86)\Launch Manager\dsiwmis.exe [2011-4-6 352336]
S2 ExpatShieldService;Expat Shield Service;C:\Program Files (x86)\Expat Shield\bin\openvpnas.exe [2012-1-6 331608]
S2 ExpatSrv;Expat Shield Routing Service;C:\Program Files (x86)\Expat Shield\HssWPR\hsssrv.exe [2012-1-4 363336]
S2 ExpatWd;Expat Shield Monitoring Service;C:\Program Files (x86)\Expat Shield\bin\hsswd.exe -product Expat --> C:\Program Files (x86)\Expat Shield\bin\hsswd.exe -product Expat [?]
S2 GREGService;GREGService;C:\Program Files (x86)\Acer\Registration\GREGsvc.exe [2010-1-8 23584]
S2 IAStorDataMgrSvc;Intel® Rapid Storage Technology;C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe [2011-4-6 13336]
S2 NOBU;Norton Online Backup;C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe [2010-6-1 2804568]
S2 NTI IScheduleSvc;NTI IScheduleSvc;C:\Program Files (x86)\NTI\Acer Backup Manager\IScheduleSvc.exe [2011-2-15 257344]
S2 SkypeUpdate;Skype Updater;C:\Program Files (x86)\Skype\Updater\Updater.exe [2012-7-13 160944]
S2 UNS;Intel® Management and Security Application User Notification Service;C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe [2011-5-15 2656280]
S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-8-12 250808]
S3 EgisTec Ticket Service;EgisTec Ticket Service;C:\Program Files (x86)\Common Files\EgisTec\Services\EgisTicketService.exe [2010-9-27 172912]
S3 ExpatTrayService;Expat Shield Tray Service;C:\Program Files (x86)\Expat Shield\bin\ExpatTrayService.exe [2012-1-6 77520]
S3 GamesAppService;GamesAppService;C:\Program Files (x86)\WildTangent Games\App\GamesAppService.exe [2010-10-12 206072]
S3 McComponentHostService;McAfee Security Scan Component Host Service;C:\Program Files (x86)\McAfee Security Scan\3.0.207\McCHSvc.exe [2011-6-17 237008]
S3 Microsoft SharePoint Workspace Audit Service;Microsoft SharePoint Workspace Audit Service;C:\Program Files\Microsoft Office\Office14\GROOVE.EXE [2011-6-12 51740536]
S3 MozillaMaintenance;Mozilla Maintenance Service;C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe [2012-8-12 114144]
S3 NisDrv;Microsoft Network Inspection System;C:\Windows\system32\DRIVERS\NisDrvWFP.sys --> C:\Windows\system32\DRIVERS\NisDrvWFP.sys [?]
S3 NisSrv;Microsoft Network Inspection;C:\Program Files\Microsoft Security Client\NisSrv.exe [2012-9-12 368896]
S3 ose64;Office 64 Source Engine;C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2010-1-9 174440]
S3 osppsvc;Office Software Protection Platform;C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-1-9 4925184]
S3 SwitchBoard;Adobe SwitchBoard;C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [2010-2-19 517096]
S3 TsUsbFlt;TsUsbFlt;C:\Windows\system32\drivers\tsusbflt.sys --> C:\Windows\system32\drivers\tsusbflt.sys [?]
S3 TsUsbGD;Remote Desktop Generic USB Device;C:\Windows\system32\drivers\TsUsbGD.sys --> C:\Windows\system32\drivers\TsUsbGD.sys [?]
S3 USBAAPL64;Apple Mobile USB Driver;C:\Windows\system32\Drivers\usbaapl64.sys --> C:\Windows\system32\Drivers\usbaapl64.sys [?]
S3 WatAdminSvc;Windows Activation Technologies Service;C:\Windows\system32\Wat\WatAdminSvc.exe --> C:\Windows\system32\Wat\WatAdminSvc.exe [?]
S3 WSDPrintDevice;WSD Print Support via UMB;C:\Windows\system32\DRIVERS\WSDPrint.sys --> C:\Windows\system32\DRIVERS\WSDPrint.sys [?]
S4 wlcrasvc;Windows Live Mesh remote connections service;C:\Program Files\Windows Live\Mesh\wlcrasvc.exe [2010-9-22 57184]
.
=============== Created Last 30 ================
.
2012-10-10 02:01:14 -------- d-----w- C:\Users\Marci\AppData\Roaming\Malwarebytes
2012-10-10 02:01:07 25928 ----a-w- C:\Windows\System32\drivers\mbam.sys
2012-10-10 02:01:07 -------- d-----w- C:\ProgramData\Malwarebytes
2012-10-10 02:01:06 -------- d-----w- C:\Program Files (x86)\Malwarebytes' Anti-Malware
2012-10-10 01:42:13 1659760 ----a-w- C:\Windows\System32\drivers\ntfs.sys
2012-10-10 01:39:47 2048 ----a-w- C:\Windows\SysWow64\tzres.dll
2012-10-10 01:39:47 2048 ----a-w- C:\Windows\System32\tzres.dll
2012-10-10 01:39:29 715776 ----a-w- C:\Windows\System32\kerberos.dll
2012-10-10 01:39:29 542208 ----a-w- C:\Windows\SysWow64\kerberos.dll
2012-10-10 01:39:16 1464320 ----a-w- C:\Windows\System32\crypt32.dll
2012-10-10 01:39:15 184320 ----a-w- C:\Windows\System32\cryptsvc.dll
2012-10-10 01:39:15 140288 ----a-w- C:\Windows\SysWow64\cryptsvc.dll
2012-10-10 01:39:15 140288 ----a-w- C:\Windows\System32\cryptnet.dll
2012-10-10 01:39:15 1159680 ----a-w- C:\Windows\SysWow64\crypt32.dll
2012-10-10 01:39:15 103936 ----a-w- C:\Windows\SysWow64\cryptnet.dll
2012-10-07 14:48:51 -------- d-----w- C:\Users\Marci\AppData\Local\TelevisionFanatic
2012-10-07 14:47:43 -------- d-----w- C:\Users\Marci\AppData\Local\dealcabby
2012-10-07 14:47:40 -------- d-----w- C:\ProgramData\Sendori
2012-10-07 14:47:38 -------- d-----w- C:\Program Files (x86)\PricePeep
2012-10-07 14:47:38 -------- d-----w- C:\Program Files (x86)\FLVPlayer
2012-10-07 14:47:37 -------- d-----w- C:\Program Files (x86)\Sendori
2012-10-07 14:39:02 -------- d-----w- C:\Program Files (x86)\TelevisionFanatic
2012-10-07 14:11:15 -------- d-----w- C:\Users\Marci\AppData\Local\Ilivid Player
2012-10-07 14:10:51 -------- d-----w- C:\Program Files (x86)\iLivid
2012-09-30 04:21:30 972192 ------w- C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{A03729AC-2912-46FF-93F5-F55302D7C2EB}\gapaengine.dll
2012-09-29 02:49:32 245760 ----a-w- C:\Windows\System32\OxpsConverter.exe
2012-09-11 22:09:55 950128 ----a-w- C:\Windows\System32\drivers\ndis.sys
2012-09-11 22:09:54 574464 ----a-w- C:\Windows\System32\d3d10level9.dll
2012-09-11 22:09:54 490496 ----a-w- C:\Windows\SysWow64\d3d10level9.dll
2012-09-11 22:09:54 41472 ----a-w- C:\Windows\System32\drivers\RNDISMP.sys
2012-09-11 22:09:53 376688 ----a-w- C:\Windows\System32\drivers\netio.sys
2012-09-11 22:09:53 288624 ----a-w- C:\Windows\System32\drivers\FWPKCLNT.SYS
2012-09-11 22:09:53 1913200 ----a-w- C:\Windows\System32\drivers\tcpip.sys
.
==================== Find3M ====================
.
2012-10-10 21:07:16 73656 ----a-w- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl
2012-10-10 21:07:16 696760 ----a-w- C:\Windows\SysWow64\FlashPlayerApp.exe
2012-08-31 02:03:48 228768 ----a-w- C:\Windows\System32\drivers\MpFilter.sys
2012-08-31 02:03:48 128456 ----a-w- C:\Windows\System32\drivers\NisDrvWFP.sys
2012-08-30 18:03:45 5559664 ----a-w- C:\Windows\System32\ntoskrnl.exe
2012-08-30 17:12:02 3968880 ----a-w- C:\Windows\SysWow64\ntkrnlpa.exe
2012-08-30 17:12:02 3914096 ----a-w- C:\Windows\SysWow64\ntoskrnl.exe
2012-08-24 18:05:07 220160 ----a-w- C:\Windows\System32\wintrust.dll
2012-08-24 16:57:48 172544 ----a-w- C:\Windows\SysWow64\wintrust.dll
2012-08-24 10:31:32 2312704 ----a-w- C:\Windows\System32\jscript9.dll
2012-08-24 10:21:18 1392128 ----a-w- C:\Windows\System32\wininet.dll
2012-08-24 10:20:11 1494528 ----a-w- C:\Windows\System32\inetcpl.cpl
2012-08-24 10:14:45 173056 ----a-w- C:\Windows\System32\ieUnatt.exe
2012-08-24 10:13:29 599040 ----a-w- C:\Windows\System32\vbscript.dll
2012-08-24 10:09:42 2382848 ----a-w- C:\Windows\System32\mshtml.tlb
2012-08-24 06:59:17 1800704 ----a-w- C:\Windows\SysWow64\jscript9.dll
2012-08-24 06:51:27 1129472 ----a-w- C:\Windows\SysWow64\wininet.dll
2012-08-24 06:51:02 1427968 ----a-w- C:\Windows\SysWow64\inetcpl.cpl
2012-08-24 06:47:26 142848 ----a-w- C:\Windows\SysWow64\ieUnatt.exe
2012-08-24 06:47:12 420864 ----a-w- C:\Windows\SysWow64\vbscript.dll
2012-08-24 06:43:58 2382848 ----a-w- C:\Windows\SysWow64\mshtml.tlb
2012-08-20 18:48:44 362496 ----a-w- C:\Windows\System32\wow64win.dll
2012-08-20 18:48:44 243200 ----a-w- C:\Windows\System32\wow64.dll
2012-08-20 18:48:44 13312 ----a-w- C:\Windows\System32\wow64cpu.dll
2012-08-20 18:48:43 215040 ----a-w- C:\Windows\System32\winsrv.dll
2012-08-20 18:48:37 16384 ----a-w- C:\Windows\System32\ntvdm64.dll
2012-08-20 18:48:35 424448 ----a-w- C:\Windows\System32\KernelBase.dll
2012-08-20 18:46:22 338432 ----a-w- C:\Windows\System32\conhost.exe
2012-08-20 17:40:21 14336 ----a-w- C:\Windows\SysWow64\ntvdm64.dll
2012-08-20 17:38:44 44032 ----a-w- C:\Windows\apppatch\acwow64.dll
2012-08-20 17:38:26 25600 ----a-w- C:\Windows\SysWow64\setup16.exe
2012-08-20 17:37:19 5120 ----a-w- C:\Windows\SysWow64\wow32.dll
2012-08-20 17:37:18 274944 ----a-w- C:\Windows\SysWow64\KernelBase.dll
2012-08-20 15:38:21 7680 ----a-w- C:\Windows\SysWow64\instnm.exe
2012-08-20 15:38:20 2048 ----a-w- C:\Windows\SysWow64\user.exe
2012-08-20 15:33:28 6144 ---ha-w- C:\Windows\SysWow64\api-ms-win-security-base-l1-1-0.dll
2012-08-20 15:33:28 4608 ---ha-w- C:\Windows\SysWow64\api-ms-win-core-threadpool-l1-1-0.dll
2012-08-20 15:33:28 3584 ---ha-w- C:\Windows\SysWow64\api-ms-win-core-xstate-l1-1-0.dll
2012-08-20 15:33:28 3072 ---ha-w- C:\Windows\SysWow64\api-ms-win-core-util-l1-1-0.dll
2012-07-18 18:15:06 3148800 ----a-w- C:\Windows\System32\win32k.sys
.
============= FINISH: 18:23:40.74 ===============
iLivid infection
in Resolved Malware Removal Logs
Posted
Added a new user - same thing happens, I think I'll go ahead and do a full rebuild - she uses Carbonite to back her stuff up so her docs should be safe enough