Jump to content

Comprev

Honorary Members
 View Profile  See their activity

  • Posts

    943

  • Joined

  • Last visited

 Content Type 

Posts posted by Comprev

    Sweetpacks redirect

    in Resolved Malware Removal Logs

    Posted

    Results of screen317's Security Check version 0.99.63

    Windows 7 Service Pack 1 x64 (UAC is enabled)

    Internet Explorer 9

    ``````````````Antivirus/Firewall Check:``````````````

    Windows Firewall Enabled!

    Microsoft Security Essentials

    (On Access scanning disabled!)

    Error obtaining update status for antivirus!

    `````````Anti-malware/Other Utilities Check:`````````

    Malwarebytes Anti-Malware version 1.75.0.1300

    JavaFX 2.1.1

    Java 7 Update 17

    Java version out of Date!

    Adobe Flash Player 11.6.602.180

    Adobe Reader 10.1.5 Adobe Reader out of Date!

    Mozilla Firefox (20.0.1)

    Google Chrome 26.0.1410.43

    Google Chrome 26.0.1410.64

    ````````Process Check: objlist.exe by Laurent````````

    Microsoft Security Essentials MSMpEng.exe

    Microsoft Security Essentials msseces.exe

    Malwarebytes Anti-Malware mbamservice.exe

    Malwarebytes Anti-Malware mbamgui.exe

    Malwarebytes' Anti-Malware mbamscheduler.exe

    `````````````````System Health check`````````````````

    Total Fragmentation on Drive C: 4%

    ````````````````````End of Log``````````````````````

    Sweetpacks redirect

    in Resolved Malware Removal Logs

    Posted

    Zoek.exe Version 4.0.0.2 Updated 30-04-2013

    Tool run by Brittwins on Thu 05/02/2013 at 21:23:46.56.

    Microsoft Windows 7 Home Premium 6.1.7601 Service Pack 1 x64

    Running in: Normal Mode Internet Access Detected

    ==== FireFox Fix ======================

    Deleted from C:\Users\Brittwins\AppData\Roaming\Mozilla\Firefox\Profiles\hlehrijn.default\prefs.js:

    user_pref("browser.startup.homepage", "http://www.yahoo.com/");

    user_pref("browser.search.defaulturl", "");

    user_pref("browser.newtab.url", "http://start.sweetpacks.com/?src=97&barid={C8130AB8-A6D5-11E2-BF47-F0DEF1C74384}&crg=3.5000006.10042");

    user_pref("browser.search.defaultenginename", "Bing");

    user_pref("browser.search.selectedEngine", "Google");

    user_pref("browser.search.useDBForOrder", true);

    Added to C:\Users\Brittwins\AppData\Roaming\Mozilla\Firefox\Profiles\hlehrijn.default\prefs.js:

    user_pref("browser.startup.homepage", "http://www.google.com");

    user_pref("browser.search.defaulturl", "http://www.google.com/search?btnG=Google+Search&q=");

    user_pref("browser.newtab.url", "http://www.google.com/");

    user_pref("browser.search.defaultengine", "Google");

    user_pref("browser.search.defaultenginename", "Google");

    user_pref("browser.search.selectedEngine", "Google");

    user_pref("browser.search.order.1", "Google");

    user_pref("keyword.URL", "http://www.google.com/search?btnG=Google+Search&q=");

    user_pref("browser.search.suggest.enabled", true);

    user_pref("browser.search.useDBForOrder", true);

    Deleted from C:\Users\Guest\AppData\Roaming\Mozilla\Firefox\Profiles\ogj3p4ef.default\prefs.js:

    Added to C:\Users\Guest\AppData\Roaming\Mozilla\Firefox\Profiles\ogj3p4ef.default\prefs.js:

    user_pref("browser.startup.homepage", "http://www.google.com");

    user_pref("browser.search.defaulturl", "http://www.google.com/search?btnG=Google+Search&q=");

    user_pref("browser.newtab.url", "http://www.google.com/");

    user_pref("browser.search.defaultengine", "Google");

    user_pref("browser.search.defaultenginename", "Google");

    user_pref("browser.search.selectedEngine", "Google");

    user_pref("browser.search.order.1", "Google");

    user_pref("keyword.URL", "http://www.google.com/search?btnG=Google+Search&q=");

    user_pref("browser.search.suggest.enabled", true);

    user_pref("browser.search.useDBForOrder", true);

    ==== Firefox Extensions ======================

    ProfilePath: C:\Users\Brittwins\AppData\Roaming\Mozilla\Firefox\Profiles\hlehrijn.default

    - Flashblock - %ProfilePath%\extensions\{3d7eb24f-2740-49df-8937-200b1cc08f8a}

    - WOT - %ProfilePath%\extensions\{a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7}

    - Adblock Plus - %ProfilePath%\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi

    AppDir: C:\Program Files (x86)\Mozilla Firefox

    - Default - %AppDir%\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}

    ==== Firefox Plugins ======================

    Profilepath: C:\Users\Brittwins\AppData\Roaming\Mozilla\Firefox\Profiles\hlehrijn.default

    47299371607DC2FB234444EEACB1639E - C:\windows\SysWOW64\Macromed\Flash\NPSWF32_11_6_602_180.dll - Shockwave Flash

    D4BD9F86123C87ECA570418B69326F99 - C:\windows\SysWOW64\npDeployJava1.dll - Java Deployment Toolkit 7.0.170.2

    3D3CAF586124C4E8102764C8B3063BB6 - C:\windows\SysWOW64\Adobe\Director\np32dsw.dll - Shockwave for Director / Shockwave for Director

    15E298B5EC5B89C5994A59863969D9FF - C:\windows\SysWOW64\npmproxy.dll - Microsoft® Windows® Operating System

    The redirects have appeared to have stopped :)

    Sweetpacks redirect

    in Resolved Malware Removal Logs

    Posted

    Here's the log again. No matter what I seem to do the page always opens at every new tab. Chrome isn't affected anymore, only Firefox, but the Avast program didn't find any problems with it.

    All processes killed

    ========== OTL ==========

    ========== FILES ==========

    File\Folder C:\PROGRAM FILES\UPDATER BY SWEETPACKS not found.

    ========== COMMANDS ==========

    [EMPTYJAVA]

    User: All Users

    User: Brittwins

    ->Java cache emptied: 0 bytes

    User: Default

    User: Default User

    User: Guest

    User: Public

    Total Java Files Cleaned = 0.00 mb

    [EMPTYTEMP]

    User: All Users

    User: Brittwins

    ->Temp folder emptied: 541917 bytes

    ->Temporary Internet Files folder emptied: 128 bytes

    ->Java cache emptied: 0 bytes

    ->FireFox cache emptied: 8348294 bytes

    ->Google Chrome cache emptied: 1195840 bytes

    ->Flash cache emptied: 0 bytes

    User: Default

    ->Temp folder emptied: 0 bytes

    ->Temporary Internet Files folder emptied: 0 bytes

    User: Default User

    ->Temp folder emptied: 0 bytes

    ->Temporary Internet Files folder emptied: 0 bytes

    User: Guest

    ->Temp folder emptied: 0 bytes

    ->Temporary Internet Files folder emptied: 0 bytes

    ->FireFox cache emptied: 0 bytes

    ->Google Chrome cache emptied: 0 bytes

    ->Flash cache emptied: 0 bytes

    User: Public

    ->Temp folder emptied: 0 bytes

    %systemdrive% .tmp files removed: 0 bytes

    %systemroot% .tmp files removed: 0 bytes

    %systemroot%\System32 .tmp files removed: 0 bytes

    %systemroot%\System32 (64bit) .tmp files removed: 0 bytes

    %systemroot%\System32\drivers .tmp files removed: 0 bytes

    Windows Temp folder emptied: 112419 bytes

    %systemroot%\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 0 bytes

    %systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 128 bytes

    RecycleBin emptied: 0 bytes

    Total Files Cleaned = 10.00 mb

    [EMPTYFLASH]

    User: All Users

    User: Brittwins

    ->Flash cache emptied: 0 bytes

    User: Default

    User: Default User

    User: Guest

    ->Flash cache emptied: 0 bytes

    User: Public

    Total Flash Files Cleaned = 0.00 mb

    OTL by OldTimer - Version 3.2.69.0 log created on 04302013_233325

    Files\Folders moved on Reboot...

    C:\Users\Brittwins\AppData\Local\Temp\FXSAPIDebugLogFile.txt moved successfully.

    C:\Users\Brittwins\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat moved successfully.

    PendingFileRenameOperations files...

    Registry entries deleted on Reboot...

    Sweetpacks redirect

    in Resolved Malware Removal Logs

    Posted

    Still seeing it. Here's the log

    OTL logfile created on: 4/30/2013 9:34:10 PM - Run 2

    OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\Brittwins\Desktop

    64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation

    Internet Explorer (Version = 9.10.9200.16540)

    Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

    3.47 Gb Total Physical Memory | 2.22 Gb Available Physical Memory | 64.01% Memory free

    6.95 Gb Paging File | 5.24 Gb Available in Paging File | 75.49% Paging File free

    Paging file location(s): ?:\pagefile.sys [binary data]

    %SystemDrive% = C: | %SystemRoot% = C:\windows | %ProgramFiles% = C:\Program Files (x86)

    Drive C: | 421.81 Gb Total Space | 380.96 Gb Free Space | 90.32% Space Free | Partition Type: NTFS

    Drive D: | 29.00 Gb Total Space | 26.88 Gb Free Space | 92.71% Space Free | Partition Type: NTFS

    Drive F: | 283.92 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS

    Computer Name: BRITTWINS-PC | User Name: Brittwins | Logged in as Administrator.

    Boot Mode: Normal | Scan Mode: All users | Quick Scan | Include 64bit Scans

    Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

    ========== Processes (SafeList) ==========

    PRC - [2013/04/27 15:43:30 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Brittwins\Desktop\OTL.exe

    PRC - [2013/04/11 17:20:00 | 000,920,472 | ---- | M] (Mozilla Corporation) -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe

    PRC - [2013/04/04 14:50:32 | 000,701,512 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe

    PRC - [2013/04/04 14:50:32 | 000,532,040 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe

    PRC - [2013/04/04 14:50:32 | 000,418,376 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe

    PRC - [2012/12/18 10:28:08 | 000,065,192 | ---- | M] (Adobe Systems Incorporated) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe

    PRC - [2012/03/01 23:05:52 | 000,100,256 | ---- | M] () -- C:\Program Files (x86)\Lenovo\Onekey Theater\OnekeySupport.exe

    PRC - [2012/03/01 23:02:42 | 000,329,056 | ---- | M] (Lenovo) -- C:\Program Files (x86)\Lenovo\VeriFace\PManage.exe

    PRC - [2011/10/01 08:30:22 | 000,219,496 | ---- | M] (Microsoft Corporation) -- C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe

    PRC - [2011/10/01 08:30:18 | 000,508,776 | ---- | M] (Microsoft Corporation) -- C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe

    PRC - [2011/01/28 19:29:36 | 000,136,488 | ---- | M] (CyberLink) -- C:\Program Files (x86)\Lenovo\YouCam\YCMMirage.exe

    ========== Modules (No Company Name) ==========

    MOD - [2013/04/11 17:19:29 | 003,133,336 | ---- | M] () -- C:\Program Files (x86)\Mozilla Firefox\mozjs.dll

    MOD - [2012/03/01 23:05:52 | 000,100,256 | ---- | M] () -- C:\Program Files (x86)\Lenovo\Onekey Theater\OnekeySupport.exe

    MOD - [2012/03/01 23:02:41 | 000,013,664 | ---- | M] () -- C:\Program Files (x86)\Lenovo\VeriFace\ChooseLang.dll

    MOD - [2011/02/16 13:53:14 | 000,133,024 | ---- | M] () -- C:\Program Files (x86)\Lenovo\Onekey Theater\WindowsApiHookDll32.dll

    MOD - [2011/02/16 13:51:10 | 000,161,696 | ---- | M] () -- C:\Program Files (x86)\Lenovo\Onekey Theater\ActiveDetect32.dll

    ========== Services (SafeList) ==========

    SRV:64bit: - [2013/01/27 12:34:32 | 000,379,360 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- c:\Program Files\Microsoft Security Client\NisSrv.exe -- (NisSrv)

    SRV:64bit: - [2013/01/27 12:34:32 | 000,022,056 | ---- | M] (Microsoft Corporation) [Auto | Running] -- c:\Program Files\Microsoft Security Client\MsMpEng.exe -- (MsMpSvc)

    SRV:64bit: - [2011/12/15 05:04:50 | 000,361,984 | ---- | M] (Advanced Micro Devices, Inc.) [Auto | Running] -- C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe -- (AMD FUEL Service)

    SRV:64bit: - [2011/12/14 20:57:22 | 000,204,288 | ---- | M] (AMD) [Auto | Running] -- C:\Windows\SysNative\atiesrxx.exe -- (AMD External Events Utility)

    SRV:64bit: - [2010/09/22 14:10:10 | 000,057,184 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Program Files\Windows Live\Mesh\wlcrasvc.exe -- (wlcrasvc)

    SRV:64bit: - [2009/07/13 21:41:27 | 001,011,712 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)

    SRV - [2013/04/11 17:19:59 | 000,115,608 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)

    SRV - [2013/04/04 14:50:32 | 000,701,512 | ---- | M] (Malwarebytes Corporation) [Auto | Running] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe -- (MBAMService)

    SRV - [2013/04/04 14:50:32 | 000,418,376 | ---- | M] (Malwarebytes Corporation) [Auto | Running] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe -- (MBAMScheduler)

    SRV - [2013/03/12 19:44:19 | 000,253,656 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)

    SRV - [2012/12/18 10:28:08 | 000,065,192 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice)

    SRV - [2011/10/01 08:30:22 | 000,219,496 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe -- (sftvsa)

    SRV - [2011/10/01 08:30:18 | 000,508,776 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe -- (sftlist)

    SRV - [2011/06/17 13:33:04 | 000,237,008 | ---- | M] (McAfee, Inc.) [On_Demand | Stopped] -- C:\Program Files (x86)\McAfee Security Scan\3.0.207\McCHSvc.exe -- (McComponentHostService)

    SRV - [2010/03/18 13:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)

    SRV - [2010/01/30 00:40:16 | 001,043,584 | ---- | M] (Hewlett-Packard Co.) [Auto | Running] -- C:\Program Files (x86)\HP\Digital Imaging\bin\HPSLPSVC64.DLL -- (HPSLPSVC)

    SRV - [2009/06/10 17:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)

    ========== Driver Services (SafeList) ==========

    DRV:64bit: - [2013/04/04 14:50:32 | 000,025,928 | ---- | M] (Malwarebytes Corporation) [File_System | On_Demand | Running] -- C:\Windows\SysNative\drivers\mbam.sys -- (MBAMProtector)

    DRV:64bit: - [2013/01/20 16:59:04 | 000,130,008 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\NisDrvWFP.sys -- (NisDrv)

    DRV:64bit: - [2012/03/01 23:21:48 | 000,039,008 | ---- | M] (Lenovo.) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\LhdX64.sys -- (LHDmgr)

    DRV:64bit: - [2012/03/01 23:21:44 | 000,029,792 | ---- | M] (Lenovo Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\AcpiVpc.sys -- (ACPIVPC)

    DRV:64bit: - [2012/03/01 23:04:25 | 000,057,952 | ---- | M] (Lenovo) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\fbfmon.sys -- (fbfmon)

    DRV:64bit: - [2012/03/01 23:04:25 | 000,013,408 | ---- | M] (Lenovo) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\BPntDrv.sys -- (BPntDrv)

    DRV:64bit: - [2012/03/01 02:46:16 | 000,023,408 | ---- | M] (Microsoft Corporation) [Recognizer | Boot | Unknown] -- C:\windows\SysNative\drivers\fs_rec.sys -- (Fs_Rec)

    DRV:64bit: - [2011/12/14 21:45:44 | 010,208,256 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\atikmdag.sys -- (amdkmdag)

    DRV:64bit: - [2011/12/14 20:13:24 | 000,317,952 | ---- | M] (Advanced Micro Devices, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\atikmpag.sys -- (amdkmdap)

    DRV:64bit: - [2011/10/01 08:30:22 | 000,022,376 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Sftvollh.sys -- (Sftvol)

    DRV:64bit: - [2011/10/01 08:30:18 | 000,268,648 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Sftplaylh.sys -- (Sftplay)

    DRV:64bit: - [2011/10/01 08:30:18 | 000,025,960 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Running] -- C:\Windows\SysNative\drivers\Sftredirlh.sys -- (Sftredir)

    DRV:64bit: - [2011/10/01 08:30:10 | 000,764,264 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Sftfslh.sys -- (Sftfs)

    DRV:64bit: - [2011/08/17 04:44:46 | 000,053,376 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\usbfilter.sys -- (usbfilter)

    DRV:64bit: - [2011/01/28 19:29:58 | 000,031,088 | ---- | M] (CyberLink Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\clwvd.sys -- (clwvd)

    DRV:64bit: - [2010/12/23 12:45:58 | 003,293,272 | ---- | M] (Windows ® Win 7 DDK provider) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\S6000KNT.sys -- (S6000KNT)

    DRV:64bit: - [2010/12/22 08:19:58 | 001,407,024 | ---- | M] (Synaptics Incorporated) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\SynTP.sys -- (SynTP)

    DRV:64bit: - [2010/11/30 02:40:04 | 000,307,304 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\rtsuvstor.sys -- (RSUSBVSTOR)

    DRV:64bit: - [2010/11/24 07:33:26 | 002,673,664 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\athrx.sys -- (athr)

    DRV:64bit: - [2010/11/20 23:24:33 | 000,059,392 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbFlt.sys -- (TsUsbFlt)

    DRV:64bit: - [2010/11/20 23:23:47 | 000,078,720 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD)

    DRV:64bit: - [2010/11/20 23:23:47 | 000,031,232 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbGD.sys -- (TsUsbGD)

    DRV:64bit: - [2010/11/17 08:04:32 | 000,115,216 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\AtihdW76.sys -- (AtiHDAudioService)

    DRV:64bit: - [2010/05/30 23:46:50 | 000,333,928 | ---- | M] (Realtek ) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Rt64win7.sys -- (RTL8167)

    DRV:64bit: - [2010/04/07 01:57:08 | 000,073,784 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata)

    DRV:64bit: - [2010/04/07 01:57:08 | 000,028,728 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata)

    DRV:64bit: - [2010/02/18 05:18:24 | 000,046,136 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\amdiox64.sys -- (amdiox64)

    DRV:64bit: - [2010/02/04 23:20:26 | 000,015,360 | ---- | M] (Windows ® Win 7 DDK provider) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HP8207_8307.sys -- (HP8207_8307)

    DRV:64bit: - [2009/07/21 10:20:06 | 000,121,840 | ---- | M] (CyberLink) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\wsvd.sys -- (wsvd)

    DRV:64bit: - [2009/07/13 21:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs)

    DRV:64bit: - [2009/07/13 21:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2)

    DRV:64bit: - [2009/07/13 21:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor)

    DRV:64bit: - [2009/07/13 20:39:20 | 000,023,040 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\WSDPrint.sys -- (WSDPrintDevice)

    DRV:64bit: - [2009/07/13 20:35:32 | 000,012,288 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\serscan.sys -- (StillCam)

    DRV:64bit: - [2009/06/10 16:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv)

    DRV:64bit: - [2009/06/10 16:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv)

    DRV:64bit: - [2009/06/10 16:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a)

    DRV:64bit: - [2009/06/10 16:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir)

    DRV - [2009/07/13 21:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount)

    ========== Standard Registry (SafeList) ==========

    ========== Internet Explorer ==========

    IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Secondary Start Pages = http://www.lenovo.com/ [binary data]

    IE:64bit: - HKLM\..\SearchScopes,DefaultScope =

    IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&form=LENDF8&pc=MALN&src=IE-SearchBox'>http://www.bing.com/search?q={searchTerms}&form=LENDF8&pc=MALN&src=IE-SearchBox

    IE:64bit: - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7

    IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm

    IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Secondary Start Pages = http://www.lenovo.com/ [binary data]

    IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page =

    IE - HKLM\..\SearchScopes,DefaultScope =

    IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&form=LENDF8&pc=MALN&src=IE-SearchBox'>http://www.bing.com/search?q={searchTerms}&form=LENDF8&pc=MALN&src=IE-SearchBox

    IE - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7

    IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

    IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

    IE - HKU\S-1-5-19\..\SearchScopes,DefaultScope =

    IE - HKU\S-1-5-20\..\SearchScopes,DefaultScope =

    IE - HKU\S-1-5-21-728219785-2893818178-200570721-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.bing.com

    IE - HKU\S-1-5-21-728219785-2893818178-200570721-1001\..\SearchScopes,DefaultScope = {6A1806CD-94D4-4689-BA73-E35EA1EA9990}

    IE - HKU\S-1-5-21-728219785-2893818178-200570721-1001\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&form=LENDF8&pc=MALN&src=IE-SearchBox'>http://www.bing.com/search?q={searchTerms}&form=LENDF8&pc=MALN&src=IE-SearchBox

    IE - HKU\S-1-5-21-728219785-2893818178-200570721-1001\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7LENN_enUS489

    IE - HKU\S-1-5-21-728219785-2893818178-200570721-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

    ========== FireFox ==========

    FF - prefs.js..browser.search.defaultenginename: "Bing"

    FF - prefs.js..browser.search.defaulturl: ""

    FF - prefs.js..browser.search.selectedEngine: "Google"

    FF - prefs.js..browser.search.useDBForOrder: true

    FF - prefs.js..browser.startup.homepage: "http://www.yahoo.com/"

    FF - prefs.js..extensions.enabledAddons: %7Ba0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7%7D:20130402

    FF - prefs.js..extensions.enabledAddons: %7B3d7eb24f-2740-49df-8937-200b1cc08f8a%7D:1.5.17

    FF - prefs.js..extensions.enabledAddons: %7B972ce4c6-7e08-4474-a285-3208198ce6fd%7D:20.0.1

    FF - user.js - File not found

    FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\windows\system32\Macromed\Flash\NPSWF64_11_6_602_180.dll File not found

    FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found

    FF:64bit: - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\5.1.20125.0\npctrl.dll ( Microsoft Corporation)

    FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)

    FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\windows\SysWOW64\Macromed\Flash\NPSWF32_11_6_602_180.dll ()

    FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\windows\SysWOW64\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)

    FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.17.2: C:\windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)

    FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.17.2: C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)

    FF - HKLM\Software\MozillaPlugins\@mcafee.com/SAFFPlugin: C:\Program Files (x86)\McAfee\SiteAdvisor\npmcffplg32.dll File not found

    FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found

    FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files (x86)\Microsoft Silverlight\5.1.20125.0\npctrl.dll ( Microsoft Corporation)

    FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)

    FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)

    FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)

    FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3508.1109: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)

    FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.21.135\npGoogleUpdate3.dll (Google Inc.)

    FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.21.135\npGoogleUpdate3.dll (Google Inc.)

    FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

    64bit-FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{C4CFC0DE-134F-4466-B2A2-FF7C59A8BFAD}: C:\PROGRAM FILES\UPDATER BY SWEETPACKS\FIREFOX

    FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{4ED1F68A-5463-4931-9384-8FFF5ED91D92}: C:\Program Files (x86)\McAfee\SiteAdvisor

    FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\smartwebprinting@hp.com: C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2012/08/23 20:26:47 | 000,000,000 | ---D | M]

    FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 20.0.1\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2013/04/11 17:20:01 | 000,000,000 | ---D | M]

    FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 20.0.1\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins

    FF - HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions\\smartwebprinting@hp.com: C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2012/08/23 20:26:47 | 000,000,000 | ---D | M]

    FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 20.0.1\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2013/04/11 17:20:01 | 000,000,000 | ---D | M]

    FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 20.0.1\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins

    [2012/06/20 22:10:39 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Brittwins\AppData\Roaming\mozilla\Extensions

    [2013/04/24 19:41:15 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Brittwins\AppData\Roaming\mozilla\Firefox\Profiles\hlehrijn.default\extensions

    [2013/04/16 16:32:27 | 000,000,000 | ---D | M] (Flashblock) -- C:\Users\Brittwins\AppData\Roaming\mozilla\Firefox\Profiles\hlehrijn.default\extensions\{3d7eb24f-2740-49df-8937-200b1cc08f8a}

    [2013/04/05 20:08:33 | 000,000,000 | ---D | M] (WOT) -- C:\Users\Brittwins\AppData\Roaming\mozilla\Firefox\Profiles\hlehrijn.default\extensions\{a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7}

    [2013/02/14 16:22:47 | 000,817,280 | ---- | M] () (No name found) -- C:\Users\Brittwins\AppData\Roaming\mozilla\firefox\profiles\hlehrijn.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi

    [2013/04/11 17:19:19 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\Mozilla Firefox\extensions

    [2013/04/11 17:20:00 | 000,263,064 | ---- | M] (Mozilla Foundation) -- C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll

    [2012/09/16 16:53:13 | 000,002,465 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml

    [2013/03/01 09:32:06 | 000,002,086 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\twitter.xml

    ========== Chrome ==========

    CHR - default_search_provider: ()

    CHR - default_search_provider: search_url =

    CHR - default_search_provider: suggest_url =

    CHR - homepage: http://start.sweetpacks.com/?src=10&st=12&crg=3.5000006.10042&barid={C8130AB8-A6D5-11E2-BF47-F0DEF1C74384}

    O1 HOSTS File: ([2013/04/27 12:34:17 | 000,000,027 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts

    O1 - Hosts: 127.0.0.1 localhost

    O2:64bit: - BHO: (SteadyVideoBHO Class) - {6C680BAE-655C-4E3D-8FC4-E6A520C3D928} - C:\Program Files\AMD\SteadyVideo\SteadyVideo.dll (Advanced Micro Devices)

    O2:64bit: - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)

    O2 - BHO: (SteadyVideoBHO Class) - {6C680BAE-655C-4E3D-8FC4-E6A520C3D928} - C:\Program Files (x86)\AMD\SteadyVideo\SteadyVideo.dll (Advanced Micro Devices)

    O2 - BHO: (Java Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)

    O2 - BHO: (Java Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)

    O3:64bit: - HKLM\..\Toolbar: (Google Toolbar) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)

    O3:64bit: - HKU\S-1-5-21-728219785-2893818178-200570721-1001\..\Toolbar\WebBrowser: (Google Toolbar) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)

    O4:64bit: - HKLM..\Run: [Energy Management] C:\Program Files (x86)\Lenovo\Energy Management\Energy Management.exe (Lenovo (Beijing) Limited)

    O4:64bit: - HKLM..\Run: [EnergyUtility] C:\Program Files (x86)\Lenovo\Energy Management\utility.exe (Lenovo(beijing) Limited)

    O4:64bit: - HKLM..\Run: [Lenovo EE Boot Optimizer] C:\Program Files (x86)\Lenovo\Boot Optimizer\PopWnd.exe (Lenovo)

    O4:64bit: - HKLM..\Run: [MSC] c:\Program Files\Microsoft Security Client\msseces.exe (Microsoft Corporation)

    O4:64bit: - HKLM..\Run: [OnekeyStudio] C:\Program Files (x86)\Lenovo\Onekey Theater\OnekeyStudio.exe (Lenovo)

    O4:64bit: - HKLM..\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Realtek Semiconductor)

    O4 - HKLM..\Run: [startCCC] C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.)

    O4 - HKLM..\Run: [updateP2GShortCut] C:\Program Files (x86)\Lenovo\Power2Go\MUITransfer\MUIStartMenu.exe (CyberLink Corp.)

    O4 - HKLM..\Run: [updatePRCShortCut] C:\Program Files\Lenovo\OneKey App\OneKey Recovery\MUITransfer\MUIStartMenu.exe (CyberLink Corp.)

    O4 - HKLM..\Run: [VeriFaceManager] C:\Program Files (x86)\Lenovo\VeriFace\PManage.exe (Lenovo)

    O4 - HKLM..\Run: [YouCam Mirage] C:\Program Files (x86)\Lenovo\YouCam\YCMMirage.exe (CyberLink)

    O4 - HKLM..\Run: [YouCam Tray] C:\Program Files (x86)\Lenovo\YouCam\YouCam.exe (CyberLink Corp.)

    O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present

    O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0

    O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3

    O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel present

    O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Control Panel present

    O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Control Panel present

    O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Control Panel present

    O7 - HKU\S-1-5-21-728219785-2893818178-200570721-1001\Software\Policies\Microsoft\Internet Explorer\Control Panel present

    O7 - HKU\S-1-5-21-728219785-2893818178-200570721-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0

    O13 - gopher Prefix: missing

    O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.254

    O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{7A9BFD46-BEDD-406F-9A4F-7DA918455A2C}: DhcpNameServer = 192.168.1.254

    O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{D6A2F2CA-D77B-48DF-87A6-84EA21D0B45C}: DhcpNameServer = 172.168.123.2

    O18:64bit: - Protocol\Handler\livecall - No CLSID value found

    O18:64bit: - Protocol\Handler\ms-help - No CLSID value found

    O18:64bit: - Protocol\Handler\msnim - No CLSID value found

    O18:64bit: - Protocol\Handler\wlmailhtml - No CLSID value found

    O18:64bit: - Protocol\Handler\wlpg - No CLSID value found

    O18:64bit: - Protocol\Filter\video/mp4 {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files\AMD\SteadyVideo\VideoMIMEFilter.dll (Advanced Micro Devices)

    O18:64bit: - Protocol\Filter\video/x-flv {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files\AMD\SteadyVideo\VideoMIMEFilter.dll (Advanced Micro Devices)

    O18 - Protocol\Filter\video/mp4 {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files (x86)\AMD\SteadyVideo\VideoMIMEFilter.dll (Advanced Micro Devices)

    O18 - Protocol\Filter\video/x-flv {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files (x86)\AMD\SteadyVideo\VideoMIMEFilter.dll (Advanced Micro Devices)

    O20:64bit: - HKLM Winlogon: Shell - (Explorer.exe) - C:\windows\explorer.exe (Microsoft Corporation)

    O20:64bit: - HKLM Winlogon: UserInit - (C:\windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)

    O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\windows\SysWow64\explorer.exe (Microsoft Corporation)

    O20 - HKLM Winlogon: UserInit - (C:\windows\system32\userinit.exe) - C:\Windows\SysWOW64\userinit.exe (Microsoft Corporation)

    O32 - HKLM CDRom: AutoRun - 1

    O32 - AutoRun File - [2001/12/27 02:45:20 | 000,000,154 | R--- | M] () - F:\Autorun.inf -- [ CDFS ]

    O34 - HKLM BootExecute: (autocheck autochk *)

    O35:64bit: - HKLM\..comfile [open] -- "%1" %*

    O35:64bit: - HKLM\..exefile [open] -- "%1" %*

    O35 - HKLM\..comfile [open] -- "%1" %*

    O35 - HKLM\..exefile [open] -- "%1" %*

    O37:64bit: - HKLM\...com [@ = ComFile] -- "%1" %*

    O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*

    O37 - HKLM\...com [@ = ComFile] -- "%1" %*

    O37 - HKLM\...exe [@ = exefile] -- "%1" %*

    O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)

    O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)

    O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)

    ========== Files/Folders - Created Within 30 Days ==========

    [2013/04/30 19:58:24 | 002,828,552 | ---- | C] (AVAST Software) -- C:\Users\Brittwins\Desktop\avast-browser-cleanup.exe

    [2013/04/28 11:10:15 | 000,000,000 | ---D | C] -- C:\_OTL

    [2013/04/27 15:43:28 | 000,602,112 | ---- | C] (OldTimer Tools) -- C:\Users\Brittwins\Desktop\OTL.exe

    [2013/04/27 12:34:31 | 000,000,000 | -HSD | C] -- C:\$RECYCLE.BIN

    [2013/04/24 20:37:19 | 000,518,144 | ---- | C] (SteelWerX) -- C:\windows\SWREG.exe

    [2013/04/24 20:37:19 | 000,406,528 | ---- | C] (SteelWerX) -- C:\windows\SWSC.exe

    [2013/04/24 20:37:19 | 000,060,416 | ---- | C] (NirSoft) -- C:\windows\NIRCMD.exe

    [2013/04/24 20:37:10 | 000,000,000 | ---D | C] -- C:\Qoobox

    [2013/04/24 20:36:50 | 000,000,000 | ---D | C] -- C:\windows\erdnt

    [2013/04/24 20:16:44 | 005,060,715 | R--- | C] (Swearware) -- C:\Users\Brittwins\Desktop\ComboFix.exe

    [2013/04/21 20:06:49 | 000,000,000 | ---D | C] -- C:\Users\Brittwins\Desktop\RK_Quarantine

    [2013/04/11 17:19:18 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Mozilla Firefox

    [2013/04/03 16:54:05 | 000,000,000 | ---D | C] -- C:\Users\Brittwins\Desktop\Body Book

    ========== Files - Modified Within 30 Days ==========

    [2013/04/30 21:27:44 | 000,726,092 | ---- | M] () -- C:\windows\SysNative\fastboot.set

    [2013/04/30 21:27:16 | 000,000,908 | ---- | M] () -- C:\windows\tasks\GoogleUpdateTaskMachineCore.job

    [2013/04/30 21:26:46 | 000,000,912 | ---- | M] () -- C:\windows\tasks\GoogleUpdateTaskMachineUA.job

    [2013/04/30 21:26:44 | 000,067,584 | --S- | M] () -- C:\windows\bootstat.dat

    [2013/04/30 20:46:00 | 000,000,830 | ---- | M] () -- C:\windows\tasks\Adobe Flash Player Updater.job

    [2013/04/30 20:09:28 | 000,021,280 | -H-- | M] () -- C:\windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

    [2013/04/30 20:09:28 | 000,021,280 | -H-- | M] () -- C:\windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

    [2013/04/30 20:06:20 | 000,727,182 | ---- | M] () -- C:\windows\SysNative\PerfStringBackup.INI

    [2013/04/30 20:06:20 | 000,624,622 | ---- | M] () -- C:\windows\SysNative\perfh009.dat

    [2013/04/30 20:06:20 | 000,106,708 | ---- | M] () -- C:\windows\SysNative\perfc009.dat

    [2013/04/30 20:01:00 | 2798,211,072 | -HS- | M] () -- C:\hiberfil.sys

    [2013/04/30 19:58:33 | 002,828,552 | ---- | M] (AVAST Software) -- C:\Users\Brittwins\Desktop\avast-browser-cleanup.exe

    [2013/04/27 15:43:30 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Brittwins\Desktop\OTL.exe

    [2013/04/27 12:34:17 | 000,000,027 | ---- | M] () -- C:\windows\SysNative\drivers\etc\hosts

    [2013/04/27 12:21:54 | 005,060,715 | R--- | M] (Swearware) -- C:\Users\Brittwins\Desktop\ComboFix.exe

    [2013/04/23 19:58:02 | 000,619,461 | ---- | M] () -- C:\Users\Brittwins\Desktop\adwcleaner.exe

    [2013/04/21 20:06:07 | 000,791,040 | ---- | M] () -- C:\Users\Brittwins\Desktop\RogueKillerX64.exe

    [2013/04/21 17:37:16 | 000,001,109 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

    [2013/04/16 16:40:05 | 000,000,051 | ---- | M] () -- C:\Users\Brittwins\AppData\Roaming\mbam.context.scan

    [2013/04/11 22:22:23 | 000,002,183 | ---- | M] () -- C:\Users\Public\Desktop\Google Chrome.lnk

    [2013/04/11 16:51:42 | 000,364,752 | ---- | M] () -- C:\windows\SysNative\FNTCACHE.DAT

    [2013/04/04 14:50:32 | 000,025,928 | ---- | M] (Malwarebytes Corporation) -- C:\windows\SysNative\drivers\mbam.sys

    [2013/04/03 16:35:40 | 000,025,185 | ---- | M] () -- C:\windows\SysWow64\ieuinit.inf

    [2013/04/03 16:35:39 | 000,025,185 | ---- | M] () -- C:\windows\SysNative\ieuinit.inf

    ========== Files Created - No Company Name ==========

    [2013/04/24 20:37:19 | 000,256,000 | ---- | C] () -- C:\windows\PEV.exe

    [2013/04/24 20:37:19 | 000,208,896 | ---- | C] () -- C:\windows\MBR.exe

    [2013/04/24 20:37:19 | 000,098,816 | ---- | C] () -- C:\windows\sed.exe

    [2013/04/24 20:37:19 | 000,080,412 | ---- | C] () -- C:\windows\grep.exe

    [2013/04/24 20:37:19 | 000,068,096 | ---- | C] () -- C:\windows\zip.exe

    [2013/04/23 19:57:47 | 000,619,461 | ---- | C] () -- C:\Users\Brittwins\Desktop\adwcleaner.exe

    [2013/04/21 20:06:05 | 000,791,040 | ---- | C] () -- C:\Users\Brittwins\Desktop\RogueKillerX64.exe

    [2013/04/16 16:39:43 | 000,000,051 | ---- | C] () -- C:\Users\Brittwins\AppData\Roaming\mbam.context.scan

    [2013/04/03 16:35:40 | 000,025,185 | ---- | C] () -- C:\windows\SysWow64\ieuinit.inf

    [2013/04/03 16:35:39 | 000,025,185 | ---- | C] () -- C:\windows\SysNative\ieuinit.inf

    [2012/08/23 20:21:03 | 000,208,423 | ---- | C] () -- C:\windows\hpoins43.dat

    [2012/08/23 20:21:03 | 000,000,601 | ---- | C] () -- C:\windows\hpomdl43.dat

    [2012/07/24 11:21:38 | 000,000,093 | ---- | C] () -- C:\windows\ka.ini

    [2012/06/20 06:59:19 | 000,734,478 | ---- | C] () -- C:\windows\SysWow64\PerfStringBackup.INI

    [2012/03/02 07:56:03 | 000,300,328 | ---- | C] () -- C:\windows\it50.dll

    [2012/03/02 07:56:03 | 000,259,368 | ---- | C] () -- C:\windows\FastBR.dll

    [2012/03/02 07:56:03 | 000,218,408 | ---- | C] () -- C:\windows\Image.dll

    [2012/03/02 07:56:03 | 000,202,024 | ---- | C] () -- C:\windows\HardDisk.dll

    [2012/03/02 07:56:03 | 000,177,448 | ---- | C] () -- C:\windows\disk.dll

    [2012/03/02 07:56:03 | 000,003,443 | ---- | C] () -- C:\windows\UTILITYDRV.SYS

    [2012/03/02 07:55:58 | 000,259,368 | ---- | C] () -- C:\windows\CopyFile.dll

    [2012/03/02 07:55:58 | 000,110,592 | ---- | C] () -- C:\windows\BootseqwWmi.exe

    [2012/03/02 07:55:58 | 000,081,920 | ---- | C] () -- C:\windows\Bootseqw32.exe

    [2012/03/02 07:55:58 | 000,049,152 | ---- | C] () -- C:\windows\CHGBOOTW.EXE

    [2012/03/02 07:55:58 | 000,008,704 | ---- | C] () -- C:\windows\Access32.sys

    [2012/03/01 23:02:47 | 001,500,512 | ---- | C] () -- C:\windows\SysWow64\Apblend.dll

    [2012/03/01 23:02:47 | 000,472,416 | ---- | C] () -- C:\windows\SysWow64\Lenovo.VerifaceStub.dll

    [2012/03/01 23:02:46 | 002,086,240 | ---- | C] () -- C:\windows\SysWow64\LenovoVeriface.Interface.dll

    [2012/03/01 23:02:46 | 001,171,456 | ---- | C] () -- C:\windows\SysWow64\PicNotify.dll

    [2012/03/01 23:02:38 | 001,044,480 | ---- | C] () -- C:\windows\SysWow64\3DImageRenderer.dll

    [2012/03/01 22:46:36 | 000,015,190 | ---- | C] () -- C:\windows\S6000Twn.ini

    [2012/03/01 22:39:50 | 000,000,000 | ---- | C] () -- C:\windows\ativpsrm.bin

    [2011/12/27 04:00:46 | 000,003,929 | ---- | C] () -- C:\windows\SysWow64\atipblag.dat

    [2011/12/15 05:40:16 | 000,056,832 | ---- | C] () -- C:\windows\SysWow64\OpenVideo.dll

    [2011/07/04 01:58:32 | 000,066,856 | ---- | C] () -- C:\windows\SysWow64\SynTPEnhPS.dll

    ========== ZeroAccess Check ==========

    [2009/07/14 00:55:00 | 000,000,227 | RHS- | M] () -- C:\windows\assembly\Desktop.ini

    [HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64

    [HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

    [HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] /64

    [HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]

    [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64

    "" = C:\Windows\SysNative\shell32.dll -- [2012/06/09 01:43:10 | 014,172,672 | ---- | M] (Microsoft Corporation)

    "ThreadingModel" = Apartment

    [HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

    "" = %SystemRoot%\system32\shell32.dll -- [2012/06/09 00:41:00 | 012,873,728 | ---- | M] (Microsoft Corporation)

    "ThreadingModel" = Apartment

    [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] /64

    "" = C:\Windows\SysNative\wbem\fastprox.dll -- [2009/07/13 21:40:51 | 000,909,312 | ---- | M] (Microsoft Corporation)

    "ThreadingModel" = Free

    [HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]

    "" = %systemroot%\system32\wbem\fastprox.dll -- [2010/11/20 23:24:25 | 000,606,208 | ---- | M] (Microsoft Corporation)

    "ThreadingModel" = Free

    [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] /64

    "" = C:\Windows\SysNative\wbem\wbemess.dll -- [2009/07/13 21:41:56 | 000,505,856 | ---- | M] (Microsoft Corporation)

    "ThreadingModel" = Both

    [HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]

    ========== LOP Check ==========

    [2013/04/21 09:26:15 | 000,000,000 | ---D | M] -- C:\Users\Brittwins\AppData\Roaming\.minecraft

    [2012/12/11 18:17:30 | 000,000,000 | ---D | M] -- C:\Users\Brittwins\AppData\Roaming\SoftGrid Client

    [2012/06/20 07:00:39 | 000,000,000 | ---D | M] -- C:\Users\Brittwins\AppData\Roaming\TP

    ========== Purity Check ==========

    < End of report >

    Sweetpacks redirect

    in Resolved Malware Removal Logs

    Posted

    I'm still seeing every time I open a new tab...here's the log:

    All processes killed

    ========== OTL ==========

    HKLM\SOFTWARE\Microsoft\Internet Explorer\Main\\Start Page| /E : value set successfully!

    Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{C4CFC0DE-134F-4466-B2A2-FF7C59A8BFAD}\ deleted successfully.

    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{C4CFC0DE-134F-4466-B2A2-FF7C59A8BFAD}\ deleted successfully.

    Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\Locked deleted successfully.

    Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\ deleted successfully.

    64bit-Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\\WebCheck deleted successfully.

    64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E6FB5E20-DE35-11CF-9C87-00AA005127ED}\ not found.

    Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\\WebCheck deleted successfully.

    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E6FB5E20-DE35-11CF-9C87-00AA005127ED}\ not found.

    Registry value HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{C4CFC0DE-134F-4466-B2A2-FF7C59A8BFAD} deleted successfully.

    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{C4CFC0DE-134F-4466-B2A2-FF7C59A8BFAD}\ not found.

    File C:\Program Files\Updater By SweetPacks\Firefox not found.

    ========== COMMANDS ==========

    [EMPTYJAVA]

    User: All Users

    User: Brittwins

    ->Java cache emptied: 0 bytes

    User: Default

    User: Default User

    User: Guest

    User: Public

    Total Java Files Cleaned = 0.00 mb

    [EMPTYTEMP]

    User: All Users

    User: Brittwins

    ->Temp folder emptied: 306674 bytes

    ->Temporary Internet Files folder emptied: 73800078 bytes

    ->Java cache emptied: 0 bytes

    ->FireFox cache emptied: 81472262 bytes

    ->Google Chrome cache emptied: 360252133 bytes

    ->Flash cache emptied: 211012 bytes

    User: Default

    ->Temp folder emptied: 0 bytes

    ->Temporary Internet Files folder emptied: 0 bytes

    User: Default User

    ->Temp folder emptied: 0 bytes

    ->Temporary Internet Files folder emptied: 0 bytes

    User: Guest

    ->Temp folder emptied: 0 bytes

    ->Temporary Internet Files folder emptied: 67 bytes

    ->FireFox cache emptied: 75782783 bytes

    ->Google Chrome cache emptied: 288379068 bytes

    ->Flash cache emptied: 2864 bytes

    User: Public

    ->Temp folder emptied: 0 bytes

    %systemdrive% .tmp files removed: 0 bytes

    %systemroot% .tmp files removed: 0 bytes

    %systemroot%\System32 .tmp files removed: 0 bytes

    %systemroot%\System32 (64bit) .tmp files removed: 0 bytes

    %systemroot%\System32\drivers .tmp files removed: 0 bytes

    Windows Temp folder emptied: 545272 bytes

    %systemroot%\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 40354 bytes

    %systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 79239 bytes

    RecycleBin emptied: 0 bytes

    Total Files Cleaned = 840.00 mb

    [EMPTYFLASH]

    User: All Users

    User: Brittwins

    ->Flash cache emptied: 0 bytes

    User: Default

    User: Default User

    User: Guest

    ->Flash cache emptied: 0 bytes

    User: Public

    Total Flash Files Cleaned = 0.00 mb

    OTL by OldTimer - Version 3.2.69.0 log created on 04282013_111015

    Files\Folders moved on Reboot...

    C:\Users\Brittwins\AppData\Local\Temp\FXSAPIDebugLogFile.txt moved successfully.

    C:\Users\Brittwins\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat moved successfully.

    PendingFileRenameOperations files...

    Registry entries deleted on Reboot...

    Sweetpacks redirect

    in Resolved Malware Removal Logs

    Posted

    OTL logfile created on: 4/27/2013 3:44:35 PM - Run 1

    OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\Brittwins\Desktop

    64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation

    Internet Explorer (Version = 9.10.9200.16540)

    Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

    3.47 Gb Total Physical Memory | 2.08 Gb Available Physical Memory | 59.81% Memory free

    6.95 Gb Paging File | 5.02 Gb Available in Paging File | 72.22% Paging File free

    Paging file location(s): ?:\pagefile.sys [binary data]

    %SystemDrive% = C: | %SystemRoot% = C:\windows | %ProgramFiles% = C:\Program Files (x86)

    Drive C: | 421.81 Gb Total Space | 380.13 Gb Free Space | 90.12% Space Free | Partition Type: NTFS

    Drive D: | 29.00 Gb Total Space | 26.88 Gb Free Space | 92.71% Space Free | Partition Type: NTFS

    Drive F: | 283.92 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS

    Computer Name: BRITTWINS-PC | User Name: Brittwins | Logged in as Administrator.

    Boot Mode: Normal | Scan Mode: All users | Quick Scan | Include 64bit Scans

    Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

    ========== Processes (SafeList) ==========

    PRC - [2013/04/27 15:43:30 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Brittwins\Desktop\OTL.exe

    PRC - [2013/04/11 17:20:00 | 000,920,472 | ---- | M] (Mozilla Corporation) -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe

    PRC - [2013/04/04 14:50:32 | 000,701,512 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe

    PRC - [2013/04/04 14:50:32 | 000,532,040 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe

    PRC - [2013/04/04 14:50:32 | 000,418,376 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe

    PRC - [2012/12/18 10:28:08 | 000,065,192 | ---- | M] (Adobe Systems Incorporated) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe

    PRC - [2012/03/01 23:05:52 | 000,100,256 | ---- | M] () -- C:\Program Files (x86)\Lenovo\Onekey Theater\OnekeySupport.exe

    PRC - [2012/03/01 23:02:42 | 000,329,056 | ---- | M] (Lenovo) -- C:\Program Files (x86)\Lenovo\VeriFace\PManage.exe

    PRC - [2011/10/01 08:30:22 | 000,219,496 | ---- | M] (Microsoft Corporation) -- C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe

    PRC - [2011/10/01 08:30:18 | 000,508,776 | ---- | M] (Microsoft Corporation) -- C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe

    PRC - [2011/01/28 19:29:36 | 000,136,488 | ---- | M] (CyberLink) -- C:\Program Files (x86)\Lenovo\YouCam\YCMMirage.exe

    ========== Modules (No Company Name) ==========

    MOD - [2013/04/11 17:19:29 | 003,133,336 | ---- | M] () -- C:\Program Files (x86)\Mozilla Firefox\mozjs.dll

    MOD - [2012/03/01 23:05:52 | 000,100,256 | ---- | M] () -- C:\Program Files (x86)\Lenovo\Onekey Theater\OnekeySupport.exe

    MOD - [2012/03/01 23:02:41 | 000,013,664 | ---- | M] () -- C:\Program Files (x86)\Lenovo\VeriFace\ChooseLang.dll

    MOD - [2011/02/16 13:53:14 | 000,133,024 | ---- | M] () -- C:\Program Files (x86)\Lenovo\Onekey Theater\WindowsApiHookDll32.dll

    MOD - [2011/02/16 13:51:10 | 000,161,696 | ---- | M] () -- C:\Program Files (x86)\Lenovo\Onekey Theater\ActiveDetect32.dll

    ========== Services (SafeList) ==========

    SRV:64bit: - [2013/01/27 12:34:32 | 000,379,360 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- c:\Program Files\Microsoft Security Client\NisSrv.exe -- (NisSrv)

    SRV:64bit: - [2013/01/27 12:34:32 | 000,022,056 | ---- | M] (Microsoft Corporation) [Auto | Running] -- c:\Program Files\Microsoft Security Client\MsMpEng.exe -- (MsMpSvc)

    SRV:64bit: - [2011/12/15 05:04:50 | 000,361,984 | ---- | M] (Advanced Micro Devices, Inc.) [Auto | Running] -- C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe -- (AMD FUEL Service)

    SRV:64bit: - [2011/12/14 20:57:22 | 000,204,288 | ---- | M] (AMD) [Auto | Running] -- C:\Windows\SysNative\atiesrxx.exe -- (AMD External Events Utility)

    SRV:64bit: - [2010/09/22 14:10:10 | 000,057,184 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Program Files\Windows Live\Mesh\wlcrasvc.exe -- (wlcrasvc)

    SRV:64bit: - [2009/07/13 21:41:27 | 001,011,712 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)

    SRV - [2013/04/11 17:19:59 | 000,115,608 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)

    SRV - [2013/04/04 14:50:32 | 000,701,512 | ---- | M] (Malwarebytes Corporation) [Auto | Running] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe -- (MBAMService)

    SRV - [2013/04/04 14:50:32 | 000,418,376 | ---- | M] (Malwarebytes Corporation) [Auto | Running] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe -- (MBAMScheduler)

    SRV - [2013/03/12 19:44:19 | 000,253,656 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)

    SRV - [2012/12/18 10:28:08 | 000,065,192 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice)

    SRV - [2011/10/01 08:30:22 | 000,219,496 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe -- (sftvsa)

    SRV - [2011/10/01 08:30:18 | 000,508,776 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe -- (sftlist)

    SRV - [2011/06/17 13:33:04 | 000,237,008 | ---- | M] (McAfee, Inc.) [On_Demand | Stopped] -- C:\Program Files (x86)\McAfee Security Scan\3.0.207\McCHSvc.exe -- (McComponentHostService)

    SRV - [2010/03/18 13:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)

    SRV - [2010/01/30 00:40:16 | 001,043,584 | ---- | M] (Hewlett-Packard Co.) [Auto | Running] -- C:\Program Files (x86)\HP\Digital Imaging\bin\HPSLPSVC64.DLL -- (HPSLPSVC)

    SRV - [2009/06/10 17:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)

    ========== Driver Services (SafeList) ==========

    DRV:64bit: - [2013/04/04 14:50:32 | 000,025,928 | ---- | M] (Malwarebytes Corporation) [File_System | On_Demand | Running] -- C:\Windows\SysNative\drivers\mbam.sys -- (MBAMProtector)

    DRV:64bit: - [2013/01/20 16:59:04 | 000,130,008 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\NisDrvWFP.sys -- (NisDrv)

    DRV:64bit: - [2012/03/01 23:21:48 | 000,039,008 | ---- | M] (Lenovo.) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\LhdX64.sys -- (LHDmgr)

    DRV:64bit: - [2012/03/01 23:21:44 | 000,029,792 | ---- | M] (Lenovo Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\AcpiVpc.sys -- (ACPIVPC)

    DRV:64bit: - [2012/03/01 23:04:25 | 000,057,952 | ---- | M] (Lenovo) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\fbfmon.sys -- (fbfmon)

    DRV:64bit: - [2012/03/01 23:04:25 | 000,013,408 | ---- | M] (Lenovo) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\BPntDrv.sys -- (BPntDrv)

    DRV:64bit: - [2012/03/01 02:46:16 | 000,023,408 | ---- | M] (Microsoft Corporation) [Recognizer | Boot | Unknown] -- C:\windows\SysNative\drivers\fs_rec.sys -- (Fs_Rec)

    DRV:64bit: - [2011/12/14 21:45:44 | 010,208,256 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\atikmdag.sys -- (amdkmdag)

    DRV:64bit: - [2011/12/14 20:13:24 | 000,317,952 | ---- | M] (Advanced Micro Devices, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\atikmpag.sys -- (amdkmdap)

    DRV:64bit: - [2011/10/01 08:30:22 | 000,022,376 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Sftvollh.sys -- (Sftvol)

    DRV:64bit: - [2011/10/01 08:30:18 | 000,268,648 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Sftplaylh.sys -- (Sftplay)

    DRV:64bit: - [2011/10/01 08:30:18 | 000,025,960 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Running] -- C:\Windows\SysNative\drivers\Sftredirlh.sys -- (Sftredir)

    DRV:64bit: - [2011/10/01 08:30:10 | 000,764,264 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Sftfslh.sys -- (Sftfs)

    DRV:64bit: - [2011/08/17 04:44:46 | 000,053,376 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\usbfilter.sys -- (usbfilter)

    DRV:64bit: - [2011/01/28 19:29:58 | 000,031,088 | ---- | M] (CyberLink Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\clwvd.sys -- (clwvd)

    DRV:64bit: - [2010/12/23 12:45:58 | 003,293,272 | ---- | M] (Windows ® Win 7 DDK provider) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\S6000KNT.sys -- (S6000KNT)

    DRV:64bit: - [2010/12/22 08:19:58 | 001,407,024 | ---- | M] (Synaptics Incorporated) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\SynTP.sys -- (SynTP)

    DRV:64bit: - [2010/11/30 02:40:04 | 000,307,304 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\rtsuvstor.sys -- (RSUSBVSTOR)

    DRV:64bit: - [2010/11/24 07:33:26 | 002,673,664 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\athrx.sys -- (athr)

    DRV:64bit: - [2010/11/20 23:24:33 | 000,059,392 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbFlt.sys -- (TsUsbFlt)

    DRV:64bit: - [2010/11/20 23:23:47 | 000,078,720 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD)

    DRV:64bit: - [2010/11/20 23:23:47 | 000,031,232 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbGD.sys -- (TsUsbGD)

    DRV:64bit: - [2010/11/17 08:04:32 | 000,115,216 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\AtihdW76.sys -- (AtiHDAudioService)

    DRV:64bit: - [2010/05/30 23:46:50 | 000,333,928 | ---- | M] (Realtek ) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Rt64win7.sys -- (RTL8167)

    DRV:64bit: - [2010/04/07 01:57:08 | 000,073,784 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata)

    DRV:64bit: - [2010/04/07 01:57:08 | 000,028,728 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata)

    DRV:64bit: - [2010/02/18 05:18:24 | 000,046,136 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\amdiox64.sys -- (amdiox64)

    DRV:64bit: - [2010/02/04 23:20:26 | 000,015,360 | ---- | M] (Windows ® Win 7 DDK provider) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HP8207_8307.sys -- (HP8207_8307)

    DRV:64bit: - [2009/07/21 10:20:06 | 000,121,840 | ---- | M] (CyberLink) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\wsvd.sys -- (wsvd)

    DRV:64bit: - [2009/07/13 21:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs)

    DRV:64bit: - [2009/07/13 21:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2)

    DRV:64bit: - [2009/07/13 21:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor)

    DRV:64bit: - [2009/07/13 20:39:20 | 000,023,040 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\WSDPrint.sys -- (WSDPrintDevice)

    DRV:64bit: - [2009/07/13 20:35:32 | 000,012,288 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\serscan.sys -- (StillCam)

    DRV:64bit: - [2009/06/10 16:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv)

    DRV:64bit: - [2009/06/10 16:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv)

    DRV:64bit: - [2009/06/10 16:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a)

    DRV:64bit: - [2009/06/10 16:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir)

    DRV - [2009/07/13 21:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount)

    ========== Standard Registry (SafeList) ==========

    ========== Internet Explorer ==========

    IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Secondary Start Pages = http://www.lenovo.com/ [binary data]

    IE:64bit: - HKLM\..\SearchScopes,DefaultScope =

    IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&form=LENDF8&pc=MALN&src=IE-SearchBox

    IE:64bit: - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7

    IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm

    IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Secondary Start Pages = http://www.lenovo.com/ [binary data]

    IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://start.sweetpacks.com/?src=10&st=12&crg=3.5000006.10042&barid={C8130AB8-A6D5-11E2-BF47-F0DEF1C74384}

    IE - HKLM\..\SearchScopes,DefaultScope =

    IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&form=LENDF8&pc=MALN&src=IE-SearchBox

    IE - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7

    IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

    IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

    IE - HKU\S-1-5-19\..\SearchScopes,DefaultScope =

    IE - HKU\S-1-5-20\..\SearchScopes,DefaultScope =

    IE - HKU\S-1-5-21-728219785-2893818178-200570721-1001\..\SearchScopes,DefaultScope = {6A1806CD-94D4-4689-BA73-E35EA1EA9990}

    IE - HKU\S-1-5-21-728219785-2893818178-200570721-1001\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&form=LENDF8&pc=MALN&src=IE-SearchBox

    IE - HKU\S-1-5-21-728219785-2893818178-200570721-1001\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7LENN_enUS489

    IE - HKU\S-1-5-21-728219785-2893818178-200570721-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

    ========== FireFox ==========

    FF - prefs.js..browser.search.defaultenginename: "Bing"

    FF - prefs.js..browser.search.defaulturl: ""

    FF - prefs.js..browser.search.selectedEngine: "Google"

    FF - prefs.js..browser.search.useDBForOrder: true

    FF - prefs.js..browser.startup.homepage: "http://www.yahoo.com/"

    FF - prefs.js..extensions.enabledAddons: %7Ba0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7%7D:20130402

    FF - prefs.js..extensions.enabledAddons: %7B3d7eb24f-2740-49df-8937-200b1cc08f8a%7D:1.5.17

    FF - prefs.js..extensions.enabledAddons: %7B972ce4c6-7e08-4474-a285-3208198ce6fd%7D:20.0.1

    FF - user.js - File not found

    FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\windows\system32\Macromed\Flash\NPSWF64_11_6_602_180.dll File not found

    FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found

    FF:64bit: - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\5.1.20125.0\npctrl.dll ( Microsoft Corporation)

    FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)

    FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\windows\SysWOW64\Macromed\Flash\NPSWF32_11_6_602_180.dll ()

    FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\windows\SysWOW64\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)

    FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.17.2: C:\windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)

    FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.17.2: C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)

    FF - HKLM\Software\MozillaPlugins\@mcafee.com/SAFFPlugin: C:\Program Files (x86)\McAfee\SiteAdvisor\npmcffplg32.dll File not found

    FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found

    FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files (x86)\Microsoft Silverlight\5.1.20125.0\npctrl.dll ( Microsoft Corporation)

    FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)

    FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)

    FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)

    FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3508.1109: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)

    FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.21.135\npGoogleUpdate3.dll (Google Inc.)

    FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.21.135\npGoogleUpdate3.dll (Google Inc.)

    FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

    64bit-FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{C4CFC0DE-134F-4466-B2A2-FF7C59A8BFAD}: C:\PROGRAM FILES\UPDATER BY SWEETPACKS\FIREFOX

    FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{4ED1F68A-5463-4931-9384-8FFF5ED91D92}: C:\Program Files (x86)\McAfee\SiteAdvisor

    FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\smartwebprinting@hp.com: C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2012/08/23 20:26:47 | 000,000,000 | ---D | M]

    FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{C4CFC0DE-134F-4466-B2A2-FF7C59A8BFAD}: C:\Program Files\Updater By SweetPacks\Firefox

    FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 20.0.1\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2013/04/11 17:20:01 | 000,000,000 | ---D | M]

    FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 20.0.1\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins

    FF - HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions\\smartwebprinting@hp.com: C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2012/08/23 20:26:47 | 000,000,000 | ---D | M]

    FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 20.0.1\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2013/04/11 17:20:01 | 000,000,000 | ---D | M]

    FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 20.0.1\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins

    [2012/06/20 22:10:39 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Brittwins\AppData\Roaming\mozilla\Extensions

    [2013/04/24 19:41:15 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Brittwins\AppData\Roaming\mozilla\Firefox\Profiles\hlehrijn.default\extensions

    [2013/04/16 16:32:27 | 000,000,000 | ---D | M] (Flashblock) -- C:\Users\Brittwins\AppData\Roaming\mozilla\Firefox\Profiles\hlehrijn.default\extensions\{3d7eb24f-2740-49df-8937-200b1cc08f8a}

    [2013/04/05 20:08:33 | 000,000,000 | ---D | M] (WOT) -- C:\Users\Brittwins\AppData\Roaming\mozilla\Firefox\Profiles\hlehrijn.default\extensions\{a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7}

    [2013/02/14 16:22:47 | 000,817,280 | ---- | M] () (No name found) -- C:\Users\Brittwins\AppData\Roaming\mozilla\firefox\profiles\hlehrijn.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi

    [2013/04/11 17:19:19 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\Mozilla Firefox\extensions

    [2013/04/11 17:20:00 | 000,263,064 | ---- | M] (Mozilla Foundation) -- C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll

    [2012/09/16 16:53:13 | 000,002,465 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml

    [2013/03/01 09:32:06 | 000,002,086 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\twitter.xml

    ========== Chrome ==========

    CHR - default_search_provider: Bing (Enabled)

    CHR - default_search_provider: search_url = http://start.sweetpacks.com/?src=6&q={searchTerms}&st=12&crg=3.5000006.10042&barid={C8130AB8-A6D5-11E2-BF47-F0DEF1C74384}

    CHR - default_search_provider: suggest_url =

    CHR - homepage: http://start.sweetpacks.com/?src=10&st=12&crg=3.5000006.10042&barid={C8130AB8-A6D5-11E2-BF47-F0DEF1C74384}

    CHR - plugin: Remoting Viewer (Enabled) = internal-remoting-viewer

    CHR - plugin: Native Client (Enabled) = C:\Program Files (x86)\Google\Chrome\Application\26.0.1410.64\ppGoogleNaClPluginChrome.dll

    CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Program Files (x86)\Google\Chrome\Application\26.0.1410.64\pdf.dll

    CHR - plugin: Shockwave Flash (Enabled) = C:\Program Files (x86)\Google\Chrome\Application\26.0.1410.64\gcswf32.dll

    CHR - plugin: Microsoft Office 2010 (Enabled) = C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL

    CHR - plugin: Google Update (Enabled) = C:\Program Files (x86)\Google\Update\1.3.21.111\npGoogleUpdate3.dll

    CHR - plugin: Windows Live\u0099 Photo Gallery (Enabled) = C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll

    CHR - plugin: Silverlight Plug-In (Enabled) = c:\Program Files (x86)\Microsoft Silverlight\4.0.50401.0\npctrl.dll

    O1 HOSTS File: ([2013/04/27 12:34:17 | 000,000,027 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts

    O1 - Hosts: 127.0.0.1 localhost

    O2:64bit: - BHO: (SteadyVideoBHO Class) - {6C680BAE-655C-4E3D-8FC4-E6A520C3D928} - C:\Program Files\AMD\SteadyVideo\SteadyVideo.dll (Advanced Micro Devices)

    O2:64bit: - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)

    O2 - BHO: (SteadyVideoBHO Class) - {6C680BAE-655C-4E3D-8FC4-E6A520C3D928} - C:\Program Files (x86)\AMD\SteadyVideo\SteadyVideo.dll (Advanced Micro Devices)

    O2 - BHO: (Java Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)

    O2 - BHO: (Updater By SweetPacks) - {C4CFC0DE-134F-4466-B2A2-FF7C59A8BFAD} - C:\Program Files\Updater By SweetPacks\Extension32.dll File not found

    O2 - BHO: (Java Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)

    O2 - BHO: (SingleInstance Class) - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn\YTSingleInstance.dll (Yahoo! Inc)

    O3:64bit: - HKLM\..\Toolbar: (Google Toolbar) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)

    O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.

    O3:64bit: - HKU\S-1-5-21-728219785-2893818178-200570721-1001\..\Toolbar\WebBrowser: (Google Toolbar) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)

    O4:64bit: - HKLM..\Run: [Energy Management] C:\Program Files (x86)\Lenovo\Energy Management\Energy Management.exe (Lenovo (Beijing) Limited)

    O4:64bit: - HKLM..\Run: [EnergyUtility] C:\Program Files (x86)\Lenovo\Energy Management\utility.exe (Lenovo(beijing) Limited)

    O4:64bit: - HKLM..\Run: [Lenovo EE Boot Optimizer] C:\Program Files (x86)\Lenovo\Boot Optimizer\PopWnd.exe (Lenovo)

    O4:64bit: - HKLM..\Run: [MSC] c:\Program Files\Microsoft Security Client\msseces.exe (Microsoft Corporation)

    O4:64bit: - HKLM..\Run: [OnekeyStudio] C:\Program Files (x86)\Lenovo\Onekey Theater\OnekeyStudio.exe (Lenovo)

    O4:64bit: - HKLM..\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Realtek Semiconductor)

    O4 - HKLM..\Run: [] File not found

    O4 - HKLM..\Run: [startCCC] C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.)

    O4 - HKLM..\Run: [updateP2GShortCut] C:\Program Files (x86)\Lenovo\Power2Go\MUITransfer\MUIStartMenu.exe (CyberLink Corp.)

    O4 - HKLM..\Run: [updatePRCShortCut] C:\Program Files\Lenovo\OneKey App\OneKey Recovery\MUITransfer\MUIStartMenu.exe (CyberLink Corp.)

    O4 - HKLM..\Run: [VeriFaceManager] C:\Program Files (x86)\Lenovo\VeriFace\PManage.exe (Lenovo)

    O4 - HKLM..\Run: [YouCam Mirage] C:\Program Files (x86)\Lenovo\YouCam\YCMMirage.exe (CyberLink)

    O4 - HKLM..\Run: [YouCam Tray] C:\Program Files (x86)\Lenovo\YouCam\YouCam.exe (CyberLink Corp.)

    O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present

    O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0

    O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3

    O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel present

    O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Control Panel present

    O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Control Panel present

    O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Control Panel present

    O7 - HKU\S-1-5-21-728219785-2893818178-200570721-1001\Software\Policies\Microsoft\Internet Explorer\Control Panel present

    O7 - HKU\S-1-5-21-728219785-2893818178-200570721-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0

    O13 - gopher Prefix: missing

    O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.254

    O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{7A9BFD46-BEDD-406F-9A4F-7DA918455A2C}: DhcpNameServer = 192.168.1.254

    O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{D6A2F2CA-D77B-48DF-87A6-84EA21D0B45C}: DhcpNameServer = 172.168.123.2

    O18:64bit: - Protocol\Handler\livecall - No CLSID value found

    O18:64bit: - Protocol\Handler\ms-help - No CLSID value found

    O18:64bit: - Protocol\Handler\msnim - No CLSID value found

    O18:64bit: - Protocol\Handler\wlmailhtml - No CLSID value found

    O18:64bit: - Protocol\Handler\wlpg - No CLSID value found

    O18:64bit: - Protocol\Filter\video/mp4 {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files\AMD\SteadyVideo\VideoMIMEFilter.dll (Advanced Micro Devices)

    O18:64bit: - Protocol\Filter\video/x-flv {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files\AMD\SteadyVideo\VideoMIMEFilter.dll (Advanced Micro Devices)

    O18 - Protocol\Filter\video/mp4 {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files (x86)\AMD\SteadyVideo\VideoMIMEFilter.dll (Advanced Micro Devices)

    O18 - Protocol\Filter\video/x-flv {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files (x86)\AMD\SteadyVideo\VideoMIMEFilter.dll (Advanced Micro Devices)

    O20:64bit: - HKLM Winlogon: Shell - (Explorer.exe) - C:\windows\explorer.exe (Microsoft Corporation)

    O20:64bit: - HKLM Winlogon: UserInit - (C:\windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)

    O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\windows\SysWow64\explorer.exe (Microsoft Corporation)

    O20 - HKLM Winlogon: UserInit - (C:\windows\system32\userinit.exe) - C:\Windows\SysWOW64\userinit.exe (Microsoft Corporation)

    O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.

    O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.

    O32 - HKLM CDRom: AutoRun - 1

    O32 - AutoRun File - [2001/12/27 02:45:20 | 000,000,154 | R--- | M] () - F:\Autorun.inf -- [ CDFS ]

    O34 - HKLM BootExecute: (autocheck autochk *)

    O35:64bit: - HKLM\..comfile [open] -- "%1" %*

    O35:64bit: - HKLM\..exefile [open] -- "%1" %*

    O35 - HKLM\..comfile [open] -- "%1" %*

    O35 - HKLM\..exefile [open] -- "%1" %*

    O37:64bit: - HKLM\...com [@ = ComFile] -- "%1" %*

    O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*

    O37 - HKLM\...com [@ = ComFile] -- "%1" %*

    O37 - HKLM\...exe [@ = exefile] -- "%1" %*

    O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)

    O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)

    O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)

    ========== Files/Folders - Created Within 30 Days ==========

    [2013/04/27 15:43:28 | 000,602,112 | ---- | C] (OldTimer Tools) -- C:\Users\Brittwins\Desktop\OTL.exe

    [2013/04/27 12:34:31 | 000,000,000 | -HSD | C] -- C:\$RECYCLE.BIN

    [2013/04/24 20:37:19 | 000,518,144 | ---- | C] (SteelWerX) -- C:\windows\SWREG.exe

    [2013/04/24 20:37:19 | 000,406,528 | ---- | C] (SteelWerX) -- C:\windows\SWSC.exe

    [2013/04/24 20:37:19 | 000,060,416 | ---- | C] (NirSoft) -- C:\windows\NIRCMD.exe

    [2013/04/24 20:37:10 | 000,000,000 | ---D | C] -- C:\Qoobox

    [2013/04/24 20:36:50 | 000,000,000 | ---D | C] -- C:\windows\erdnt

    [2013/04/24 20:16:44 | 005,060,715 | R--- | C] (Swearware) -- C:\Users\Brittwins\Desktop\ComboFix.exe

    [2013/04/21 20:06:49 | 000,000,000 | ---D | C] -- C:\Users\Brittwins\Desktop\RK_Quarantine

    [2013/04/11 17:19:18 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Mozilla Firefox

    [2013/04/03 16:54:05 | 000,000,000 | ---D | C] -- C:\Users\Brittwins\Desktop\Body Book

    ========== Files - Modified Within 30 Days ==========

    [2013/04/27 15:46:00 | 000,000,830 | ---- | M] () -- C:\windows\tasks\Adobe Flash Player Updater.job

    [2013/04/27 15:43:30 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Brittwins\Desktop\OTL.exe

    [2013/04/27 15:42:59 | 000,000,912 | ---- | M] () -- C:\windows\tasks\GoogleUpdateTaskMachineUA.job

    [2013/04/27 15:42:54 | 000,067,584 | --S- | M] () -- C:\windows\bootstat.dat

    [2013/04/27 12:59:36 | 000,021,280 | -H-- | M] () -- C:\windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

    [2013/04/27 12:59:36 | 000,021,280 | -H-- | M] () -- C:\windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

    [2013/04/27 12:56:35 | 000,727,182 | ---- | M] () -- C:\windows\SysNative\PerfStringBackup.INI

    [2013/04/27 12:56:35 | 000,624,622 | ---- | M] () -- C:\windows\SysNative\perfh009.dat

    [2013/04/27 12:56:35 | 000,106,708 | ---- | M] () -- C:\windows\SysNative\perfc009.dat

    [2013/04/27 12:53:21 | 000,169,712 | ---- | M] () -- C:\windows\SysNative\fastboot.set

    [2013/04/27 12:53:17 | 000,000,908 | ---- | M] () -- C:\windows\tasks\GoogleUpdateTaskMachineCore.job

    [2013/04/27 12:51:15 | 2798,211,072 | -HS- | M] () -- C:\hiberfil.sys

    [2013/04/27 12:34:17 | 000,000,027 | ---- | M] () -- C:\windows\SysNative\drivers\etc\hosts

    [2013/04/27 12:21:54 | 005,060,715 | R--- | M] (Swearware) -- C:\Users\Brittwins\Desktop\ComboFix.exe

    [2013/04/23 19:58:02 | 000,619,461 | ---- | M] () -- C:\Users\Brittwins\Desktop\adwcleaner.exe

    [2013/04/21 20:06:07 | 000,791,040 | ---- | M] () -- C:\Users\Brittwins\Desktop\RogueKillerX64.exe

    [2013/04/21 17:37:16 | 000,001,109 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

    [2013/04/16 16:40:05 | 000,000,051 | ---- | M] () -- C:\Users\Brittwins\AppData\Roaming\mbam.context.scan

    [2013/04/11 22:22:23 | 000,002,183 | ---- | M] () -- C:\Users\Public\Desktop\Google Chrome.lnk

    [2013/04/11 16:51:42 | 000,364,752 | ---- | M] () -- C:\windows\SysNative\FNTCACHE.DAT

    [2013/04/04 14:50:32 | 000,025,928 | ---- | M] (Malwarebytes Corporation) -- C:\windows\SysNative\drivers\mbam.sys

    [2013/04/03 16:35:40 | 000,025,185 | ---- | M] () -- C:\windows\SysWow64\ieuinit.inf

    [2013/04/03 16:35:39 | 000,025,185 | ---- | M] () -- C:\windows\SysNative\ieuinit.inf

    ========== Files Created - No Company Name ==========

    [2013/04/24 20:37:19 | 000,256,000 | ---- | C] () -- C:\windows\PEV.exe

    [2013/04/24 20:37:19 | 000,208,896 | ---- | C] () -- C:\windows\MBR.exe

    [2013/04/24 20:37:19 | 000,098,816 | ---- | C] () -- C:\windows\sed.exe

    [2013/04/24 20:37:19 | 000,080,412 | ---- | C] () -- C:\windows\grep.exe

    [2013/04/24 20:37:19 | 000,068,096 | ---- | C] () -- C:\windows\zip.exe

    [2013/04/23 19:57:47 | 000,619,461 | ---- | C] () -- C:\Users\Brittwins\Desktop\adwcleaner.exe

    [2013/04/21 20:06:05 | 000,791,040 | ---- | C] () -- C:\Users\Brittwins\Desktop\RogueKillerX64.exe

    [2013/04/16 16:39:43 | 000,000,051 | ---- | C] () -- C:\Users\Brittwins\AppData\Roaming\mbam.context.scan

    [2013/04/03 16:35:40 | 000,025,185 | ---- | C] () -- C:\windows\SysWow64\ieuinit.inf

    [2013/04/03 16:35:39 | 000,025,185 | ---- | C] () -- C:\windows\SysNative\ieuinit.inf

    [2012/08/23 20:21:03 | 000,208,423 | ---- | C] () -- C:\windows\hpoins43.dat

    [2012/08/23 20:21:03 | 000,000,601 | ---- | C] () -- C:\windows\hpomdl43.dat

    [2012/07/24 11:21:38 | 000,000,093 | ---- | C] () -- C:\windows\ka.ini

    [2012/06/20 06:59:19 | 000,734,478 | ---- | C] () -- C:\windows\SysWow64\PerfStringBackup.INI

    [2012/03/02 07:56:03 | 000,300,328 | ---- | C] () -- C:\windows\it50.dll

    [2012/03/02 07:56:03 | 000,259,368 | ---- | C] () -- C:\windows\FastBR.dll

    [2012/03/02 07:56:03 | 000,218,408 | ---- | C] () -- C:\windows\Image.dll

    [2012/03/02 07:56:03 | 000,202,024 | ---- | C] () -- C:\windows\HardDisk.dll

    [2012/03/02 07:56:03 | 000,177,448 | ---- | C] () -- C:\windows\disk.dll

    [2012/03/02 07:56:03 | 000,003,443 | ---- | C] () -- C:\windows\UTILITYDRV.SYS

    [2012/03/02 07:55:58 | 000,259,368 | ---- | C] () -- C:\windows\CopyFile.dll

    [2012/03/02 07:55:58 | 000,110,592 | ---- | C] () -- C:\windows\BootseqwWmi.exe

    [2012/03/02 07:55:58 | 000,081,920 | ---- | C] () -- C:\windows\Bootseqw32.exe

    [2012/03/02 07:55:58 | 000,049,152 | ---- | C] () -- C:\windows\CHGBOOTW.EXE

    [2012/03/02 07:55:58 | 000,008,704 | ---- | C] () -- C:\windows\Access32.sys

    [2012/03/01 23:02:47 | 001,500,512 | ---- | C] () -- C:\windows\SysWow64\Apblend.dll

    [2012/03/01 23:02:47 | 000,472,416 | ---- | C] () -- C:\windows\SysWow64\Lenovo.VerifaceStub.dll

    [2012/03/01 23:02:46 | 002,086,240 | ---- | C] () -- C:\windows\SysWow64\LenovoVeriface.Interface.dll

    [2012/03/01 23:02:46 | 001,171,456 | ---- | C] () -- C:\windows\SysWow64\PicNotify.dll

    [2012/03/01 23:02:38 | 001,044,480 | ---- | C] () -- C:\windows\SysWow64\3DImageRenderer.dll

    [2012/03/01 22:46:36 | 000,015,190 | ---- | C] () -- C:\windows\S6000Twn.ini

    [2012/03/01 22:39:50 | 000,000,000 | ---- | C] () -- C:\windows\ativpsrm.bin

    [2011/12/27 04:00:46 | 000,003,929 | ---- | C] () -- C:\windows\SysWow64\atipblag.dat

    [2011/12/15 05:40:16 | 000,056,832 | ---- | C] () -- C:\windows\SysWow64\OpenVideo.dll

    [2011/07/04 01:58:32 | 000,066,856 | ---- | C] () -- C:\windows\SysWow64\SynTPEnhPS.dll

    ========== ZeroAccess Check ==========

    [2009/07/14 00:55:00 | 000,000,227 | RHS- | M] () -- C:\windows\assembly\Desktop.ini

    [HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64

    [HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

    [HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] /64

    [HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]

    [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64

    "" = C:\Windows\SysNative\shell32.dll -- [2012/06/09 01:43:10 | 014,172,672 | ---- | M] (Microsoft Corporation)

    "ThreadingModel" = Apartment

    [HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

    "" = %SystemRoot%\system32\shell32.dll -- [2012/06/09 00:41:00 | 012,873,728 | ---- | M] (Microsoft Corporation)

    "ThreadingModel" = Apartment

    [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] /64

    "" = C:\Windows\SysNative\wbem\fastprox.dll -- [2009/07/13 21:40:51 | 000,909,312 | ---- | M] (Microsoft Corporation)

    "ThreadingModel" = Free

    [HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]

    "" = %systemroot%\system32\wbem\fastprox.dll -- [2010/11/20 23:24:25 | 000,606,208 | ---- | M] (Microsoft Corporation)

    "ThreadingModel" = Free

    [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] /64

    "" = C:\Windows\SysNative\wbem\wbemess.dll -- [2009/07/13 21:41:56 | 000,505,856 | ---- | M] (Microsoft Corporation)

    "ThreadingModel" = Both

    [HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]

    ========== LOP Check ==========

    [2013/04/21 09:26:15 | 000,000,000 | ---D | M] -- C:\Users\Brittwins\AppData\Roaming\.minecraft

    [2012/12/11 18:17:30 | 000,000,000 | ---D | M] -- C:\Users\Brittwins\AppData\Roaming\SoftGrid Client

    [2012/06/20 07:00:39 | 000,000,000 | ---D | M] -- C:\Users\Brittwins\AppData\Roaming\TP

    ========== Purity Check ==========

    < End of report >

    Sweetpacks redirect

    in Resolved Malware Removal Logs

    Posted

    ComboFix 13-04-27.04 - Brittwins 04/27/2013 12:25:08.2.2 - x64

    Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.3558.2129 [GMT -4:00]

    Running from: c:\users\Brittwins\Desktop\ComboFix.exe

    Command switches used :: c:\users\Brittwins\Desktop\CFScript.txt

    AV: Microsoft Security Essentials *Disabled/Updated* {3F839487-C7A2-C958-E30C-E2825BA31FB5}

    SP: Microsoft Security Essentials *Disabled/Updated* {84E27563-E198-C6D6-D9BC-D9F020245508}

    SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

    * Created a new restore point

    .

    FILE ::

    "c:\program files\Updater By SweetPacks\Extension32.dll"

    "c:\program files\Updater By SweetPacks\ExtensionUpdaterService.exe"

    .

    .

    ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

    .

    .

    c:\program files\Updater By SweetPacks

    c:\program files\Updater By SweetPacks\DGChrome.exe

    c:\program files\Updater By SweetPacks\Extension32.dll

    c:\program files\Updater By SweetPacks\Extension64.dll

    c:\program files\Updater By SweetPacks\ExtensionUpdaterService.exe

    c:\program files\Updater By SweetPacks\Firefox\chrome.manifest

    c:\program files\Updater By SweetPacks\Firefox\chrome\content\libraries\DataExchangeScript.js

    c:\program files\Updater By SweetPacks\Firefox\chrome\content\main.js

    c:\program files\Updater By SweetPacks\Firefox\chrome\content\main.xul

    c:\program files\Updater By SweetPacks\Firefox\chrome\content\resources\localscript.js

    c:\program files\Updater By SweetPacks\Firefox\chrome\locale\en-US\overlay.dtd

    c:\program files\Updater By SweetPacks\Firefox\chrome\skin\overlay.css

    c:\program files\Updater By SweetPacks\Firefox\defaults\preferences\defaults.js

    c:\program files\Updater By SweetPacks\Firefox\install.rdf

    c:\program files\Updater By SweetPacks\InstallerHelper.dll

    c:\program files\Updater By SweetPacks\libraries\DataExchangeScript.js

    c:\program files\Updater By SweetPacks\resources\localscript.js

    c:\program files\Updater By SweetPacks\source.crx

    c:\program files\Updater By SweetPacks\unins000.dat

    c:\program files\Updater By SweetPacks\unins000.exe

    .

    .

    ((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

    .

    .

    -------\Service_Updater By SweetPacks

    -------\Service_Updater By SweetPacks

    .

    .

    ((((((((((((((((((((((((( Files Created from 2013-03-27 to 2013-04-27 )))))))))))))))))))))))))))))))

    .

    .

    2013-04-27 16:31 . 2013-04-27 16:31 -------- d-----w- c:\users\Guest\AppData\Local\temp

    2013-04-23 23:59 . 2013-04-23 23:58 905296 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{05849D01-295F-4491-A74F-57608FDD1A82}\gapaengine.dll

    2013-04-23 23:58 . 2013-04-10 03:46 9317456 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{E65CF144-6AAB-4BA1-ABCC-ADAD032E630C}\mpengine.dll

    2013-04-23 23:56 . 2013-04-12 14:45 1656680 ----a-w- c:\windows\system32\drivers\ntfs.sys

    2013-04-21 18:32 . 2013-04-10 03:46 9317456 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll

    2013-04-10 20:59 . 2013-02-15 06:06 3717632 ----a-w- c:\windows\system32\mstscax.dll

    2013-04-03 20:35 . 2013-04-03 20:35 226304 ----a-w- c:\windows\system32\elshyph.dll

    .

    .

    .

    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

    .

    2013-04-04 18:50 . 2012-06-24 09:30 25928 ----a-w- c:\windows\system32\drivers\mbam.sys

    2013-04-02 10:34 . 2010-11-21 03:27 282744 ------w- c:\windows\system32\MpSigStub.exe

    2013-03-12 23:44 . 2012-06-22 02:56 73432 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl

    2013-03-12 23:44 . 2012-06-22 02:56 693976 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe

    2013-03-05 01:18 . 2013-03-05 01:18 95648 ----a-w- c:\windows\SysWow64\WindowsAccessBridge-32.dll

    2013-03-05 01:18 . 2012-06-21 11:20 861088 ----a-w- c:\windows\SysWow64\npDeployJava1.dll

    2013-03-05 01:18 . 2012-06-21 11:20 782240 ----a-w- c:\windows\SysWow64\deployJava1.dll

    2013-02-12 05:45 . 2013-03-13 00:03 135168 ----a-w- c:\windows\apppatch\AppPatch64\AcXtrnal.dll

    2013-02-12 05:45 . 2013-03-13 00:03 308736 ----a-w- c:\windows\apppatch\AppPatch64\AcGenral.dll

    2013-02-12 05:45 . 2013-03-13 00:03 350208 ----a-w- c:\windows\apppatch\AppPatch64\AcLayers.dll

    2013-02-12 05:45 . 2013-03-13 00:03 111104 ----a-w- c:\windows\apppatch\AppPatch64\acspecfc.dll

    2013-02-12 04:48 . 2013-03-13 00:03 474112 ----a-w- c:\windows\apppatch\AcSpecfc.dll

    2013-02-12 04:48 . 2013-03-13 00:03 2176512 ----a-w- c:\windows\apppatch\AcGenral.dll

    2013-02-12 04:12 . 2013-03-21 21:35 19968 ----a-w- c:\windows\system32\drivers\usb8023.sys

    .

    .

    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

    .

    .

    *Note* empty entries & legit default entries are not shown

    REGEDIT4

    .

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

    "swg"="c:\program files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2012-03-02 39408]

    .

    [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]

    "StartCCC"="c:\program files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2011-12-15 343168]

    "YouCam Mirage"="c:\program files (x86)\Lenovo\YouCam\YCMMirage.exe" [2011-01-28 136488]

    "YouCam Tray"="c:\program files (x86)\Lenovo\YouCam\YouCam.exe" [2011-01-28 228448]

    "VeriFaceManager"="c:\program files (x86)\Lenovo\VeriFace\PManage.exe" [2012-03-02 329056]

    "UpdateP2GShortCut"="c:\program files (x86)\Lenovo\Power2Go\MUITransfer\MUIStartMenu.exe" [2010-07-26 222504]

    "UpdatePRCShortCut"="c:\program files\Lenovo\OneKey App\OneKey Recovery\MUITransfer\MUIStartMenu.exe" [2009-05-13 222504]

    "HP Software Update"="c:\program files (x86)\HP\HP Software Update\HPWuSchd2.exe" [2009-11-18 54576]

    "Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-12-03 946352]

    "SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2012-07-03 252848]

    .

    c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\

    HP Digital Imaging Monitor.lnk - c:\program files (x86)\HP\Digital Imaging\bin\hpqtra08.exe [2009-11-18 275072]

    .

    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

    "ConsentPromptBehaviorUser"= 3 (0x3)

    "EnableUIADesktopToggle"= 0 (0x0)

    .

    [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]

    "aux"=wdmaud.drv

    .

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]

    @=""

    .

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]

    @="Service"

    .

    R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]

    R2 McAfee SiteAdvisor Service;McAfee SiteAdvisor Service;c:\progra~2\mcafee\SITEAD~1\mcsacore.exe [x]

    R3 HP8207_8307;HP-HP8207_8307;c:\windows\system32\DRIVERS\HP8207_8307.sys [2010-02-05 15360]

    R3 McComponentHostService;McAfee Security Scan Component Host Service;c:\program files (x86)\McAfee Security Scan\3.0.207\McCHSvc.exe [2011-06-17 237008]

    R3 NisDrv;Microsoft Network Inspection System;c:\windows\system32\DRIVERS\NisDrvWFP.sys [2013-01-20 130008]

    R3 NisSrv;Microsoft Network Inspection;c:\program files\Microsoft Security Client\NisSrv.exe [2013-01-27 379360]

    R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-21 59392]

    R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys [2010-11-21 31232]

    R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [2012-06-21 1255736]

    R3 wsvd;wsvd;c:\windows\system32\DRIVERS\wsvd.sys [2009-07-21 121840]

    R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe [2010-09-22 57184]

    S0 fbfmon;fbfmon;c:\windows\system32\drivers\fbfmon.sys [2012-03-02 57952]

    S0 LHDmgr;LHDmgr;c:\windows\System32\DRIVERS\LhdX64.sys [2012-03-02 39008]

    S1 BPntDrv;BPntDrv;c:\windows\system32\drivers\BPntDrv.sys [2012-03-02 13408]

    S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [2011-12-15 204288]

    S2 AMD FUEL Service;AMD FUEL Service;c:\program files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [2011-12-15 361984]

    S2 cvhsvc;Client Virtualization Handler;c:\program files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE [2012-01-04 822624]

    S2 MBAMScheduler;MBAMScheduler;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [2013-04-04 418376]

    S2 MBAMService;MBAMService;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2013-04-04 701512]

    S2 sftlist;Application Virtualization Client;c:\program files (x86)\Microsoft Application Virtualization Client\sftlist.exe [2011-10-01 508776]

    S3 ACPIVPC;Lenovo Virtual Power Controller Driver;c:\windows\system32\DRIVERS\AcpiVpc.sys [2012-03-02 29792]

    S3 amdiox64;AMD IO Driver;c:\windows\system32\DRIVERS\amdiox64.sys [2010-02-18 46136]

    S3 AtiHDAudioService;ATI Function Driver for HD Audio Service;c:\windows\system32\drivers\AtihdW76.sys [2010-11-17 115216]

    S3 clwvd;CyberLink WebCam Virtual Driver;c:\windows\system32\DRIVERS\clwvd.sys [2011-01-28 31088]

    S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2013-04-04 25928]

    S3 RSUSBVSTOR;RtsUVStor.Sys Realtek USB Card Reader;c:\windows\system32\Drivers\RtsUVStor.sys [2010-11-30 307304]

    S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [2010-05-31 333928]

    S3 S6000KNT;S6000KNT_WebCam Driver;c:\windows\system32\Drivers\S6000KNT.sys [2010-12-23 3293272]

    S3 Sftfs;Sftfs;c:\windows\system32\DRIVERS\Sftfslh.sys [2011-10-01 764264]

    S3 Sftplay;Sftplay;c:\windows\system32\DRIVERS\Sftplaylh.sys [2011-10-01 268648]

    S3 Sftredir;Sftredir;c:\windows\system32\DRIVERS\Sftredirlh.sys [2011-10-01 25960]

    S3 Sftvol;Sftvol;c:\windows\system32\DRIVERS\Sftvollh.sys [2011-10-01 22376]

    S3 sftvsa;Application Virtualization Service Agent;c:\program files (x86)\Microsoft Application Virtualization Client\sftvsa.exe [2011-10-01 219496]

    S3 usbfilter;AMD USB Filter Driver;c:\windows\system32\DRIVERS\usbfilter.sys [2011-08-17 53376]

    .

    .

    --- Other Services/Drivers In Memory ---

    .

    *NewlyCreated* - WS2IFSL

    .

    [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\svchost]

    hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc

    .

    [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]

    2013-04-12 02:22 1642448 ----a-w- c:\program files (x86)\Google\Chrome\Application\26.0.1410.64\Installer\chrmstp.exe

    .

    Contents of the 'Scheduled Tasks' folder

    .

    2013-04-27 c:\windows\Tasks\Adobe Flash Player Updater.job

    - c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-06-22 23:44]

    .

    2013-04-27 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job

    - c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-03-02 03:15]

    .

    2013-04-27 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job

    - c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-03-02 03:15]

    .

    .

    --------- X64 Entries -----------

    .

    .

    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\VeriFace Enc]

    @="{771C7324-DA80-49D3-8017-753B0AF60951}"

    [HKEY_CLASSES_ROOT\CLSID\{771C7324-DA80-49D3-8017-753B0AF60951}]

    2012-03-02 03:02 1508192 ----a-w- c:\windows\System32\IcnOvrly.dll

    .

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

    "RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2011-04-22 11831400]

    "SynTPEnh"="c:\program files (x86)\Synaptics\SynTP\SynTPEnh.exe" [bU]

    "Lenovo EE Boot Optimizer"="c:\program files (x86)\Lenovo\Boot Optimizer\PopWnd.exe" [2012-03-02 206176]

    "OnekeyStudio"="c:\program files (x86)\Lenovo\Onekey Theater\OnekeyStudio.exe" [2012-03-02 789920]

    "Energy Management"="c:\program files (x86)\Lenovo\Energy Management\Energy Management.exe" [2012-03-02 9769888]

    "EnergyUtility"="c:\program files (x86)\Lenovo\Energy Management\Utility.exe" [2012-03-02 5908928]

    "MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2013-01-27 1281512]

    .

    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - LocalService

    FontCache

    .

    ------- Supplementary Scan -------

    .

    uLocal Page = c:\windows\system32\blank.htm

    mStart Page = hxxp://start.sweetpacks.com/?src=10&st=12&crg=3.5000006.10042&barid={C8130AB8-A6D5-11E2-BF47-F0DEF1C74384}

    mLocal Page = c:\windows\SysWOW64\blank.htm

    IE: E&xport to Microsoft Excel - c:\progra~2\MICROS~1\Office14\EXCEL.EXE/3000

    IE: Se&nd to OneNote - c:\progra~2\MICROS~1\Office14\ONBttnIE.dll/105

    TCP: DhcpNameServer = 192.168.1.254

    FF - ProfilePath - c:\users\Brittwins\AppData\Roaming\Mozilla\Firefox\Profiles\hlehrijn.default\

    FF - prefs.js: browser.search.defaulturl -

    FF - prefs.js: browser.search.selectedEngine - Google

    FF - prefs.js: browser.startup.homepage - hxxp://www.yahoo.com/

    FF - ExtSQL: 2013-04-16 16:41; {C4CFC0DE-134F-4466-B2A2-FF7C59A8BFAD}; c:\program files\Updater By SweetPacks\Firefox

    FF - ExtSQL: !HIDDEN! 2012-08-23 20:26; smartwebprinting@hp.com; c:\program files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3

    .

    - - - - ORPHANS REMOVED - - - -

    .

    BHO-{C4CFC0DE-134F-4466-B2A2-FF7C59A8BFAD} - c:\program files\Updater By SweetPacks\Extension32.dll

    Toolbar-Locked - (no file)

    Wow6432Node-HKLM-Run-<NO NAME> - (no file)

    .

    .

    .

    --------------------- LOCKED REGISTRY KEYS ---------------------

    .

    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]

    @Denied: (A 2) (Everyone)

    @="Shockwave Flash Object"

    .

    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]

    @="c:\\windows\\SysWow64\\Macromed\\Flash\\Flash10h.ocx"

    "ThreadingModel"="Apartment"

    .

    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]

    @="0"

    .

    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]

    @="ShockwaveFlash.ShockwaveFlash.10"

    .

    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]

    @="c:\\windows\\SysWow64\\Macromed\\Flash\\Flash10h.ocx, 1"

    .

    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]

    @="{D27CDB6B-AE6D-11cf-96B8-444553540000}"

    .

    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]

    @="1.0"

    .

    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]

    @="ShockwaveFlash.ShockwaveFlash"

    .

    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]

    @Denied: (A 2) (Everyone)

    @="Macromedia Flash Factory Object"

    .

    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]

    @="c:\\windows\\SysWow64\\Macromed\\Flash\\Flash10h.ocx"

    "ThreadingModel"="Apartment"

    .

    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]

    @="FlashFactory.FlashFactory.1"

    .

    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]

    @="c:\\windows\\SysWow64\\Macromed\\Flash\\Flash10h.ocx, 1"

    .

    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]

    @="{D27CDB6B-AE6D-11cf-96B8-444553540000}"

    .

    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]

    @="1.0"

    .

    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]

    @="FlashFactory.FlashFactory"

    .

    [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Office\Common\Smart Tag\Actions\{B7EFF951-E52F-45CC-9EF7-57124F2177CC}]

    @Denied: (A) (Everyone)

    "Solution"="{15727DE6-F92D-4E46-ACB4-0E2C58B31A18}"

    .

    [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3]

    @Denied: (A) (Everyone)

    .

    [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3\0]

    "Key"="ActionsPane3"

    "Location"="c:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VSTO\\ActionsPane3.xsd"

    .

    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]

    @Denied: (Full) (Everyone)

    .

    ------------------------ Other Running Processes ------------------------

    .

    c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe

    c:\program files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe

    .

    **************************************************************************

    .

    Completion time: 2013-04-27 12:38:33 - machine was rebooted

    ComboFix-quarantined-files.txt 2013-04-27 16:38

    ComboFix2.txt 2013-04-25 00:49

    .

    Pre-Run: 408,688,627,712 bytes free

    Post-Run: 408,456,654,848 bytes free

    .

    - - End Of File - - 4A743D541A93F05BD3171205A8AAD41E

    I'm still seeing the redirect, though.

    Sweetpacks redirect

    in Resolved Malware Removal Logs

    Posted

    ComboFix 13-04-24.03 - Brittwins 04/24/2013 20:39:56.1.2 - x64

    Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.3558.2416 [GMT -4:00]

    Running from: c:\users\Brittwins\Desktop\ComboFix.exe

    AV: Microsoft Security Essentials *Disabled/Updated* {3F839487-C7A2-C958-E30C-E2825BA31FB5}

    SP: Microsoft Security Essentials *Disabled/Updated* {84E27563-E198-C6D6-D9BC-D9F020245508}

    SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

    .

    .

    ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

    .

    .

    c:\users\Brittwins\AppData\Local\Microsoft\Windows\Temporary Internet Files\{037D0E15-DAB4-4455-B7B8-C00B7F3EB6B1}.xps

    c:\users\Brittwins\AppData\Local\Microsoft\Windows\Temporary Internet Files\{1C125159-0062-4591-B69B-AA52A3A5727F}.xps

    c:\users\Brittwins\AppData\Local\Microsoft\Windows\Temporary Internet Files\{28B78676-A577-4A40-B534-073E81F349EE}.xps

    c:\users\Brittwins\AppData\Local\Microsoft\Windows\Temporary Internet Files\{549A6E95-EC06-47D5-A7E1-3E97ECC053D3}.xps

    c:\users\Brittwins\AppData\Local\Microsoft\Windows\Temporary Internet Files\{6A53D218-E877-4A78-BC29-0EE39F924221}.xps

    c:\users\Brittwins\AppData\Local\Microsoft\Windows\Temporary Internet Files\{710A8CD2-D2CA-4CD3-8037-9125EC0AC76F}.xps

    c:\users\Brittwins\AppData\Local\Microsoft\Windows\Temporary Internet Files\{867107BC-1CCF-4FB7-962A-4E692613E9D1}.xps

    c:\users\Brittwins\AppData\Local\Microsoft\Windows\Temporary Internet Files\{9B8E8438-3B0F-4D7B-A57B-1531E5005CCB}.xps

    c:\users\Brittwins\AppData\Local\Microsoft\Windows\Temporary Internet Files\{9D2BC5B0-EBE0-4219-9F66-0AC1959E5DE4}.xps

    c:\users\Brittwins\AppData\Local\Microsoft\Windows\Temporary Internet Files\{A0E28E5B-8306-4F36-9E42-E458A2609168}.xps

    c:\users\Brittwins\AppData\Local\Microsoft\Windows\Temporary Internet Files\{EE8504C4-B5D0-4A5C-AA5A-C67958E22D75}.xps

    c:\users\Brittwins\AppData\Local\Microsoft\Windows\Temporary Internet Files\{F7B72E76-A04B-4827-B6F1-F8D82AB08F6E}.xps

    c:\windows\gt.exe

    c:\windows\PolicyDefinitions

    c:\windows\PolicyDefinitions\DeviceRedirection.admx

    c:\windows\PolicyDefinitions\en-US\DeviceRedirection.adml

    c:\windows\PolicyDefinitions\en-US\EnhancedStorage.adml

    c:\windows\PolicyDefinitions\en-US\InetRes.adml

    c:\windows\PolicyDefinitions\en-US\NCSI.adml

    c:\windows\PolicyDefinitions\en-US\RacWmiProv.adml

    c:\windows\PolicyDefinitions\en-US\ReAgent.adml

    c:\windows\PolicyDefinitions\en-US\sdiageng.adml

    c:\windows\PolicyDefinitions\en-US\sdiagschd.adml

    c:\windows\PolicyDefinitions\en-US\Search.adml

    c:\windows\PolicyDefinitions\en-US\ShapeCollector.adml

    c:\windows\PolicyDefinitions\en-US\WindowsMediaDRM.adml

    c:\windows\PolicyDefinitions\en-US\WindowsMediaPlayer.adml

    c:\windows\PolicyDefinitions\EnhancedStorage.admx

    c:\windows\PolicyDefinitions\inetres.admx

    c:\windows\PolicyDefinitions\NCSI.admx

    c:\windows\PolicyDefinitions\RacWmiProv.admx

    c:\windows\PolicyDefinitions\ReAgent.admx

    c:\windows\PolicyDefinitions\sdiageng.admx

    c:\windows\PolicyDefinitions\sdiagschd.admx

    c:\windows\PolicyDefinitions\Search.admx

    c:\windows\PolicyDefinitions\ShapeCollector.admx

    c:\windows\PolicyDefinitions\WindowsMediaDRM.admx

    c:\windows\PolicyDefinitions\WindowsMediaPlayer.admx

    c:\windows\s.bat

    c:\windows\version.txt

    .

    .

    ((((((((((((((((((((((((( Files Created from 2013-03-25 to 2013-04-25 )))))))))))))))))))))))))))))))

    .

    .

    2013-04-25 00:46 . 2013-04-25 00:46 -------- d-----w- c:\users\Guest\AppData\Local\temp

    2013-04-25 00:46 . 2013-04-25 00:46 -------- d-----w- c:\users\Default\AppData\Local\temp

    2013-04-23 23:59 . 2013-04-23 23:58 905296 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{05849D01-295F-4491-A74F-57608FDD1A82}\gapaengine.dll

    2013-04-23 23:58 . 2013-04-10 03:46 9317456 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{E65CF144-6AAB-4BA1-ABCC-ADAD032E630C}\mpengine.dll

    2013-04-23 23:56 . 2013-04-12 14:45 1656680 ----a-w- c:\windows\system32\drivers\ntfs.sys

    2013-04-21 18:32 . 2013-04-10 03:46 9317456 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll

    2013-04-16 20:41 . 2013-04-16 20:41 -------- d-----w- c:\program files\Updater By SweetPacks

    2013-04-10 20:59 . 2013-02-15 06:06 3717632 ----a-w- c:\windows\system32\mstscax.dll

    2013-04-03 20:35 . 2013-04-03 20:35 226304 ----a-w- c:\windows\system32\elshyph.dll

    .

    .

    .

    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

    .

    2013-04-04 18:50 . 2012-06-24 09:30 25928 ----a-w- c:\windows\system32\drivers\mbam.sys

    2013-04-02 10:34 . 2010-11-21 03:27 282744 ------w- c:\windows\system32\MpSigStub.exe

    2013-03-12 23:44 . 2012-06-22 02:56 73432 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl

    2013-03-12 23:44 . 2012-06-22 02:56 693976 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe

    2013-03-05 01:18 . 2013-03-05 01:18 95648 ----a-w- c:\windows\SysWow64\WindowsAccessBridge-32.dll

    2013-03-05 01:18 . 2012-06-21 11:20 861088 ----a-w- c:\windows\SysWow64\npDeployJava1.dll

    2013-03-05 01:18 . 2012-06-21 11:20 782240 ----a-w- c:\windows\SysWow64\deployJava1.dll

    2013-02-12 05:45 . 2013-03-13 00:03 135168 ----a-w- c:\windows\apppatch\AppPatch64\AcXtrnal.dll

    2013-02-12 05:45 . 2013-03-13 00:03 308736 ----a-w- c:\windows\apppatch\AppPatch64\AcGenral.dll

    2013-02-12 05:45 . 2013-03-13 00:03 350208 ----a-w- c:\windows\apppatch\AppPatch64\AcLayers.dll

    2013-02-12 05:45 . 2013-03-13 00:03 111104 ----a-w- c:\windows\apppatch\AppPatch64\acspecfc.dll

    2013-02-12 04:48 . 2013-03-13 00:03 474112 ----a-w- c:\windows\apppatch\AcSpecfc.dll

    2013-02-12 04:48 . 2013-03-13 00:03 2176512 ----a-w- c:\windows\apppatch\AcGenral.dll

    2013-02-12 04:12 . 2013-03-21 21:35 19968 ----a-w- c:\windows\system32\drivers\usb8023.sys

    .

    .

    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

    .

    .

    *Note* empty entries & legit default entries are not shown

    REGEDIT4

    .

    [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\~\Browser Helper Objects\{C4CFC0DE-134F-4466-B2A2-FF7C59A8BFAD}]

    2013-02-28 17:37 170840 ----a-w- c:\program files\Updater By SweetPacks\Extension32.dll

    .

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

    "swg"="c:\program files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2012-03-02 39408]

    .

    [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]

    "StartCCC"="c:\program files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2011-12-15 343168]

    "YouCam Mirage"="c:\program files (x86)\Lenovo\YouCam\YCMMirage.exe" [2011-01-28 136488]

    "YouCam Tray"="c:\program files (x86)\Lenovo\YouCam\YouCam.exe" [2011-01-28 228448]

    "VeriFaceManager"="c:\program files (x86)\Lenovo\VeriFace\PManage.exe" [2012-03-02 329056]

    "UpdateP2GShortCut"="c:\program files (x86)\Lenovo\Power2Go\MUITransfer\MUIStartMenu.exe" [2010-07-26 222504]

    "UpdatePRCShortCut"="c:\program files\Lenovo\OneKey App\OneKey Recovery\MUITransfer\MUIStartMenu.exe" [2009-05-13 222504]

    "HP Software Update"="c:\program files (x86)\HP\HP Software Update\HPWuSchd2.exe" [2009-11-18 54576]

    "Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-12-03 946352]

    "SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2012-07-03 252848]

    .

    c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\

    HP Digital Imaging Monitor.lnk - c:\program files (x86)\HP\Digital Imaging\bin\hpqtra08.exe [2009-11-18 275072]

    .

    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

    "ConsentPromptBehaviorUser"= 3 (0x3)

    "EnableUIADesktopToggle"= 0 (0x0)

    .

    [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]

    "aux"=wdmaud.drv

    .

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]

    @=""

    .

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]

    @="Service"

    .

    R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]

    R2 McAfee SiteAdvisor Service;McAfee SiteAdvisor Service;c:\progra~2\mcafee\SITEAD~1\mcsacore.exe [x]

    R3 HP8207_8307;HP-HP8207_8307;c:\windows\system32\DRIVERS\HP8207_8307.sys [2010-02-05 15360]

    R3 McComponentHostService;McAfee Security Scan Component Host Service;c:\program files (x86)\McAfee Security Scan\3.0.207\McCHSvc.exe [2011-06-17 237008]

    R3 NisDrv;Microsoft Network Inspection System;c:\windows\system32\DRIVERS\NisDrvWFP.sys [2013-01-20 130008]

    R3 NisSrv;Microsoft Network Inspection;c:\program files\Microsoft Security Client\NisSrv.exe [2013-01-27 379360]

    R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-21 59392]

    R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys [2010-11-21 31232]

    R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [2012-06-21 1255736]

    R3 wsvd;wsvd;c:\windows\system32\DRIVERS\wsvd.sys [2009-07-21 121840]

    R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe [2010-09-22 57184]

    S0 fbfmon;fbfmon;c:\windows\system32\drivers\fbfmon.sys [2012-03-02 57952]

    S0 LHDmgr;LHDmgr;c:\windows\System32\DRIVERS\LhdX64.sys [2012-03-02 39008]

    S1 BPntDrv;BPntDrv;c:\windows\system32\drivers\BPntDrv.sys [2012-03-02 13408]

    S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [2011-12-15 204288]

    S2 AMD FUEL Service;AMD FUEL Service;c:\program files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [2011-12-15 361984]

    S2 cvhsvc;Client Virtualization Handler;c:\program files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE [2012-01-04 822624]

    S2 MBAMScheduler;MBAMScheduler;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [2013-04-04 418376]

    S2 MBAMService;MBAMService;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2013-04-04 701512]

    S2 sftlist;Application Virtualization Client;c:\program files (x86)\Microsoft Application Virtualization Client\sftlist.exe [2011-10-01 508776]

    S2 Updater By SweetPacks;Updater By SweetPacks;c:\program files\Updater By SweetPacks\ExtensionUpdaterService.exe [2013-02-28 188760]

    S3 ACPIVPC;Lenovo Virtual Power Controller Driver;c:\windows\system32\DRIVERS\AcpiVpc.sys [2012-03-02 29792]

    S3 amdiox64;AMD IO Driver;c:\windows\system32\DRIVERS\amdiox64.sys [2010-02-18 46136]

    S3 AtiHDAudioService;ATI Function Driver for HD Audio Service;c:\windows\system32\drivers\AtihdW76.sys [2010-11-17 115216]

    S3 clwvd;CyberLink WebCam Virtual Driver;c:\windows\system32\DRIVERS\clwvd.sys [2011-01-28 31088]

    S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2013-04-04 25928]

    S3 RSUSBVSTOR;RtsUVStor.Sys Realtek USB Card Reader;c:\windows\system32\Drivers\RtsUVStor.sys [2010-11-30 307304]

    S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [2010-05-31 333928]

    S3 S6000KNT;S6000KNT_WebCam Driver;c:\windows\system32\Drivers\S6000KNT.sys [2010-12-23 3293272]

    S3 Sftfs;Sftfs;c:\windows\system32\DRIVERS\Sftfslh.sys [2011-10-01 764264]

    S3 Sftplay;Sftplay;c:\windows\system32\DRIVERS\Sftplaylh.sys [2011-10-01 268648]

    S3 Sftredir;Sftredir;c:\windows\system32\DRIVERS\Sftredirlh.sys [2011-10-01 25960]

    S3 Sftvol;Sftvol;c:\windows\system32\DRIVERS\Sftvollh.sys [2011-10-01 22376]

    S3 sftvsa;Application Virtualization Service Agent;c:\program files (x86)\Microsoft Application Virtualization Client\sftvsa.exe [2011-10-01 219496]

    S3 usbfilter;AMD USB Filter Driver;c:\windows\system32\DRIVERS\usbfilter.sys [2011-08-17 53376]

    .

    .

    [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\svchost]

    hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc

    .

    [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]

    2013-04-12 02:22 1642448 ----a-w- c:\program files (x86)\Google\Chrome\Application\26.0.1410.64\Installer\chrmstp.exe

    .

    Contents of the 'Scheduled Tasks' folder

    .

    2013-04-25 c:\windows\Tasks\Adobe Flash Player Updater.job

    - c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-06-22 23:44]

    .

    2013-04-25 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job

    - c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-03-02 03:15]

    .

    2013-04-25 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job

    - c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-03-02 03:15]

    .

    .

    --------- X64 Entries -----------

    .

    .

    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\VeriFace Enc]

    @="{771C7324-DA80-49D3-8017-753B0AF60951}"

    [HKEY_CLASSES_ROOT\CLSID\{771C7324-DA80-49D3-8017-753B0AF60951}]

    2012-03-02 03:02 1508192 ----a-w- c:\windows\System32\IcnOvrly.dll

    .

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

    "RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2011-04-22 11831400]

    "Lenovo EE Boot Optimizer"="c:\program files (x86)\Lenovo\Boot Optimizer\PopWnd.exe" [2012-03-02 206176]

    "OnekeyStudio"="c:\program files (x86)\Lenovo\Onekey Theater\OnekeyStudio.exe" [2012-03-02 789920]

    "Energy Management"="c:\program files (x86)\Lenovo\Energy Management\Energy Management.exe" [2012-03-02 9769888]

    "EnergyUtility"="c:\program files (x86)\Lenovo\Energy Management\Utility.exe" [2012-03-02 5908928]

    "MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2013-01-27 1281512]

    .

    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - LocalService

    FontCache

    .

    ------- Supplementary Scan -------

    .

    uStart Page = hxxp://start.sweetpacks.com/?src=10&st=12&crg=3.5000006.10042&barid={C8130AB8-A6D5-11E2-BF47-F0DEF1C74384}

    uLocal Page = c:\windows\system32\blank.htm

    mStart Page = hxxp://start.sweetpacks.com/?src=10&st=12&crg=3.5000006.10042&barid={C8130AB8-A6D5-11E2-BF47-F0DEF1C74384}

    mLocal Page = c:\windows\SysWOW64\blank.htm

    IE: E&xport to Microsoft Excel - c:\progra~2\MICROS~1\Office14\EXCEL.EXE/3000

    IE: Se&nd to OneNote - c:\progra~2\MICROS~1\Office14\ONBttnIE.dll/105

    TCP: DhcpNameServer = 192.168.1.254

    FF - ProfilePath - c:\users\Brittwins\AppData\Roaming\Mozilla\Firefox\Profiles\hlehrijn.default\

    FF - prefs.js: browser.search.defaulturl -

    FF - prefs.js: browser.search.selectedEngine - Google

    FF - prefs.js: browser.startup.homepage - hxxp://www.yahoo.com/

    FF - prefs.js: keyword.URL - hxxp://start.sweetpacks.com/?src=2&st=12&barid={C8130AB8-A6D5-11E2-BF47-F0DEF1C74384}&q=

    FF - ExtSQL: 2013-04-16 16:41; {C4CFC0DE-134F-4466-B2A2-FF7C59A8BFAD}; c:\program files\Updater By SweetPacks\Firefox

    FF - ExtSQL: !HIDDEN! 2012-08-23 20:26; smartwebprinting@hp.com; c:\program files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3

    .

    - - - - ORPHANS REMOVED - - - -

    .

    URLSearchHooks-{1c68c940-1b2f-46eb-bd8c-2e1612ff6a58} - (no file)

    Toolbar-Locked - (no file)

    Wow6432Node-HKLM-Run-<NO NAME> - (no file)

    HKLM_Wow6432Node-ActiveSetup-{2D46B6DC-2207-486B-B523-A557E6D54B47} - start

    Toolbar-Locked - (no file)

    HKLM-Run-SynTPEnh - c:\program files (x86)\Synaptics\SynTP\SynTPEnh.exe

    .

    .

    .

    --------------------- LOCKED REGISTRY KEYS ---------------------

    .

    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]

    @Denied: (A 2) (Everyone)

    @="Shockwave Flash Object"

    .

    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]

    @="c:\\windows\\SysWow64\\Macromed\\Flash\\Flash10h.ocx"

    "ThreadingModel"="Apartment"

    .

    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]

    @="0"

    .

    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]

    @="ShockwaveFlash.ShockwaveFlash.10"

    .

    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]

    @="c:\\windows\\SysWow64\\Macromed\\Flash\\Flash10h.ocx, 1"

    .

    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]

    @="{D27CDB6B-AE6D-11cf-96B8-444553540000}"

    .

    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]

    @="1.0"

    .

    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]

    @="ShockwaveFlash.ShockwaveFlash"

    .

    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]

    @Denied: (A 2) (Everyone)

    @="Macromedia Flash Factory Object"

    .

    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]

    @="c:\\windows\\SysWow64\\Macromed\\Flash\\Flash10h.ocx"

    "ThreadingModel"="Apartment"

    .

    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]

    @="FlashFactory.FlashFactory.1"

    .

    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]

    @="c:\\windows\\SysWow64\\Macromed\\Flash\\Flash10h.ocx, 1"

    .

    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]

    @="{D27CDB6B-AE6D-11cf-96B8-444553540000}"

    .

    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]

    @="1.0"

    .

    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]

    @="FlashFactory.FlashFactory"

    .

    [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Office\Common\Smart Tag\Actions\{B7EFF951-E52F-45CC-9EF7-57124F2177CC}]

    @Denied: (A) (Everyone)

    "Solution"="{15727DE6-F92D-4E46-ACB4-0E2C58B31A18}"

    .

    [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3]

    @Denied: (A) (Everyone)

    .

    [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3\0]

    "Key"="ActionsPane3"

    "Location"="c:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VSTO\\ActionsPane3.xsd"

    .

    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]

    @Denied: (Full) (Everyone)

    .

    Completion time: 2013-04-24 20:49:52

    ComboFix-quarantined-files.txt 2013-04-25 00:49

    .

    Pre-Run: 406,890,188,800 bytes free

    Post-Run: 407,440,674,816 bytes free

    .

    - - End Of File - - 8B1D50A2E115355120DAFD3C88731F27

    Still seeing the redirect, though. This time only in Firefox.

    Sweetpacks redirect

    in Resolved Malware Removal Logs

    Posted

    # AdwCleaner v2.202 - Logfile created 04/24/2013 at 19:40:50

    # Updated 23/04/2013 by Xplode

    # Operating system : Windows 7 Home Premium Service Pack 1 (64 bits)

    # User : Brittwins - BRITTWINS-PC

    # Boot Mode : Normal

    # Running from : C:\Users\Brittwins\Desktop\adwcleaner.exe

    # Option [Delete]

    ***** [services] *****

    ***** [Files / Folders] *****

    File Deleted : C:\Users\Brittwins\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_apps.conduit.com_0.localstorage

    File Deleted : C:\Users\Brittwins\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_apps.conduit.com_0.localstorage-journal

    File Deleted : C:\Users\Brittwins\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_search.conduit.com_0.localstorage

    File Deleted : C:\Users\Brittwins\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_search.conduit.com_0.localstorage-journal

    File Deleted : C:\Users\Brittwins\AppData\Roaming\Mozilla\Firefox\Profiles\hlehrijn.default\extensions\{EEE6C361-6118-11DC-9C72-001320C79847}.xpi

    File Deleted : C:\Users\Brittwins\AppData\Roaming\Mozilla\Firefox\Profiles\hlehrijn.default\searchplugins\SweetIm.xml

    Folder Deleted : C:\Program Files (x86)\Conduit

    Folder Deleted : C:\Program Files (x86)\SweetIM

    Folder Deleted : C:\ProgramData\Partner

    Folder Deleted : C:\Users\Brittwins\AppData\Local\Conduit

    Folder Deleted : C:\Users\Brittwins\AppData\Local\Google\Chrome\User Data\Default\Extensions\dlnembnfbcpjnepmfjmngjenhhajpdfd

    Folder Deleted : C:\Users\Brittwins\AppData\Local\Google\Chrome\User Data\Default\Extensions\ogccgbmabaphcakpiclgcnmcnimhokcj

    Folder Deleted : C:\Users\Brittwins\AppData\LocalLow\Conduit

    Folder Deleted : C:\Users\Brittwins\AppData\Roaming\Mozilla\Firefox\Profiles\hlehrijn.default\Smartbar

    Folder Deleted : C:\Users\Brittwins\AppData\Roaming\Mozilla\Firefox\Profiles\hlehrijn.default\SweetPacksToolbarData

    ***** [Registry] *****

    Key Deleted : HKCU\Software\AppDataLow\Software\SmartBar

    Key Deleted : HKCU\Software\Conduit

    Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{02478D38-C3F9-4EFB-9B51-7695ECA05670}

    Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{EF99BD32-C1FB-11D2-892F-0090271D4F88}

    Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{02478D38-C3F9-4EFB-9B51-7695ECA05670}

    Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{EEE6C35B-6118-11DC-9C72-001320C79847}

    Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{EF99BD32-C1FB-11D2-892F-0090271D4F88}

    Key Deleted : HKCU\Software\Softonic

    Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{EEE6C360-6118-11DC-9C72-001320C79847}

    Key Deleted : HKLM\SOFTWARE\Classes\AppID\{B302A1BD-0157-49FA-90F1-4E94F22C7B4B}

    Key Deleted : HKLM\SOFTWARE\Classes\AppID\Extension.DLL

    Key Deleted : HKLM\SOFTWARE\Classes\Extension.ExtensionHelperObject

    Key Deleted : HKLM\SOFTWARE\Classes\Extension.ExtensionHelperObject.1

    Key Deleted : HKLM\SOFTWARE\Classes\SWEETIE.IEToolbar

    Key Deleted : HKLM\SOFTWARE\Classes\SWEETIE.IEToolbar.1

    Key Deleted : HKLM\SOFTWARE\Classes\sweetim_urlsearchhook.toolbarurlsearchhook

    Key Deleted : HKLM\SOFTWARE\Classes\sweetim_urlsearchhook.toolbarurlsearchhook.1

    Key Deleted : HKLM\SOFTWARE\Classes\Toolbar.CT3067892

    Key Deleted : HKLM\SOFTWARE\Classes\Toolbar3.sweetie

    Key Deleted : HKLM\SOFTWARE\Classes\Toolbar3.sweetie.1

    Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{1D5A4199-956E-49BC-B89F-6A35C57C0D13}

    Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{EEE6C35E-6118-11DC-9C72-001320C79847}

    Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{EEE6C35F-6118-11DC-9C72-001320C79847}

    Key Deleted : HKLM\Software\Conduit

    Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{02478D38-C3F9-4EFB-9B51-7695ECA05670}

    Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{EF99BD32-C1FB-11D2-892F-0090271D4F88}

    Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{02478D38-C3F9-4EFB-9B51-7695ECA05670}

    Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{3C471948-F874-49F5-B338-4F214A2EE0B1}

    Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{EEE6C35B-6118-11DC-9C72-001320C79847}

    Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{EEE6C35C-6118-11DC-9C72-001320C79847}

    Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{EEE6C35D-6118-11DC-9C72-001320C79847}

    Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{EF99BD32-C1FB-11D2-892F-0090271D4F88}

    Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{A36867C6-302D-49FC-9D8E-1EB037B5F1AB}

    Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{EEE6C358-6118-11DC-9C72-001320C79847}

    Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{EEE6C359-6118-11DC-9C72-001320C79847}

    Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{EEE6C35A-6118-11DC-9C72-001320C79847}

    Key Deleted : HKLM\SOFTWARE\Wow6432Node\Google\Chrome\Extensions\ogccgbmabaphcakpiclgcnmcnimhokcj

    Key Deleted : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{EEE6C367-6118-11DC-9C72-001320C79847}

    Key Deleted : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\{EEE6C360-6118-11DC-9C72-001320C79847}

    Key Deleted : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{02478D38-C3F9-4EFB-9B51-7695ECA05670}

    Key Deleted : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{EEE6C35C-6118-11DC-9C72-001320C79847}

    Key Deleted : HKLM\SOFTWARE\Classes\Interface\{A36867C6-302D-49FC-9D8E-1EB037B5F1AB}

    Key Deleted : HKLM\SOFTWARE\Classes\Interface\{EEE6C358-6118-11DC-9C72-001320C79847}

    Key Deleted : HKLM\SOFTWARE\Classes\Interface\{EEE6C359-6118-11DC-9C72-001320C79847}

    Key Deleted : HKLM\SOFTWARE\Classes\Interface\{EEE6C35A-6118-11DC-9C72-001320C79847}

    Value Deleted : HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks [{EF99BD32-C1FB-11D2-892F-0090271D4F88}]

    Value Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDLLs [C:\Program Files (x86)\SweetIM\Toolbars\Internet Explorer\mgHelperApp.exe]

    Value Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDLLs [C:\Program Files (x86)\SweetIM\Toolbars\Internet Explorer\mgToolbarProxy.dll]

    Value Deleted : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar [{EEE6C35B-6118-11DC-9C72-001320C79847}]

    Value Deleted : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar [{EF99BD32-C1FB-11D2-892F-0090271D4F88}]

    ***** [internet Browsers] *****

    -\\ Internet Explorer v10.0.9200.16537

    [OK] Registry is clean.

    -\\ Mozilla Firefox v20.0.1 (en-US)

    File : C:\Users\Brittwins\AppData\Roaming\Mozilla\Firefox\Profiles\hlehrijn.default\prefs.js

    Deleted : user_pref("CT3067892.3067892a129610743761394763000000paramsGK1", "{\"updateReqTime\":1345673674404,\[...]

    Deleted : user_pref("CT3067892.3067892a129610743761394763000000twitterTemplate_notify_followers", "0x0037,0x00[...]

    Deleted : user_pref("CT3067892.3067892a129610743761394763000000twitterTemplate_notify_followers_count", "31");

    Deleted : user_pref("CT3067892.3067892a129610743761394763000000twitterTemplate_notify_following", "0x0032,0x00[...]

    Deleted : user_pref("CT3067892.3067892a129610743761394763000000twitterTemplate_notify_following_count", "31");

    Deleted : user_pref("CT3067892.3067892a129610743761394763000000twitterTemplate_notify_home", "0x0032,0x0033,0x[...]

    Deleted : user_pref("CT3067892.3067892a129610743761394763000000twitterTemplate_notify_home_count", "15");

    Deleted : user_pref("CT3067892.ENABALE_HISTORY", "{\"dataType\":\"string\",\"data\":\"true\"}");

    Deleted : user_pref("CT3067892.ENABLE_RETURN_WEB_SEARCH_ON_THE_PAGE", "{\"dataType\":\"string\",\"data\":\"tru[...]

    Deleted : user_pref("CT3067892.FirstTime", "true");

    Deleted : user_pref("CT3067892.FirstTimeFF3", "true");

    Deleted : user_pref("CT3067892.SearchFromAddressBarUrl", "hxxp://search.conduit.com/ResultsExt.aspx?SSPV=FFSB1[...]

    Deleted : user_pref("CT3067892.UserID", "UN21886396350621362");

    Deleted : user_pref("CT3067892.addressBarTakeOverEnabledInHidden", "true");

    Deleted : user_pref("CT3067892.autoDisableScopes", -1);

    Deleted : user_pref("CT3067892.browser.search.defaultthis.engineName", true);

    Deleted : user_pref("CT3067892.defaultSearch", "true");

    Deleted : user_pref("CT3067892.embeddedsData", "[{\"appId\":\"10000002\",\"apiPermissions\":{\"crossDomainAjax[...]

    Deleted : user_pref("CT3067892.enableAlerts", "always");

    Deleted : user_pref("CT3067892.enableSearchFromAddressBar", "true");

    Deleted : user_pref("CT3067892.firstTimeDialogOpened", "true");

    Deleted : user_pref("CT3067892.fixPageNotFoundError", "true");

    Deleted : user_pref("CT3067892.fixPageNotFoundErrorInHidden", "true");

    Deleted : user_pref("CT3067892.fixUrls", true);

    Deleted : user_pref("CT3067892.installId", "ct3067892_miniclip.exe");

    Deleted : user_pref("CT3067892.installType", "ConduitNSISIntegration");

    Deleted : user_pref("CT3067892.isEnableAllDialogs", "{\"dataType\":\"string\",\"data\":\"true\"}");

    Deleted : user_pref("CT3067892.isNewTabEnabled", true);

    Deleted : user_pref("CT3067892.isPerformedSmartBarTransition", "true");

    Deleted : user_pref("CT3067892.isToolbarShrinked", "{\"dataType\":\"string\",\"data\":\"false\"}");

    Deleted : user_pref("CT3067892.keyword", true);

    Deleted : user_pref("CT3067892.navigationAliasesJson", "{\"EB_SEARCH_TERM\":\"\",\"EB_MAIN_FRAME_URL\":\"hxxp%[...]

    Deleted : user_pref("CT3067892.openThankYouPage", "false");

    Deleted : user_pref("CT3067892.openUninstallPage", "true");

    Deleted : user_pref("CT3067892.search.searchAppId", "10000002");

    Deleted : user_pref("CT3067892.search.searchCount", "0");

    Deleted : user_pref("CT3067892.searchInNewTabEnabledInHidden", "true");

    Deleted : user_pref("CT3067892.selectToSearchBoxEnabled", "{\"dataType\":\"string\",\"data\":\"true\"}");

    Deleted : user_pref("CT3067892.serviceLayer_service_login_isFirstLoginInvoked", "{\"dataType\":\"boolean\",\"d[...]

    Deleted : user_pref("CT3067892.serviceLayer_service_login_loginCount", "{\"dataType\":\"number\",\"data\":\"4\[...]

    Deleted : user_pref("CT3067892.serviceLayer_service_toolbarGrouping_activeCTID", "{\"dataType\":\"string\",\"d[...]

    Deleted : user_pref("CT3067892.serviceLayer_service_toolbarGrouping_activeDownloadUrl", "{\"dataType\":\"strin[...]

    Deleted : user_pref("CT3067892.serviceLayer_service_toolbarGrouping_activeToolbarName", "{\"dataType\":\"strin[...]

    Deleted : user_pref("CT3067892.serviceLayer_service_toolbarGrouping_invoked", "{\"dataType\":\"string\",\"data[...]

    Deleted : user_pref("CT3067892.serviceLayer_service_usage_toolbarUsageCount", "{\"dataType\":\"number\",\"data[...]

    Deleted : user_pref("CT3067892.serviceLayer_services_appTrackingFirstTime_lastUpdate", "1345163210837");

    Deleted : user_pref("CT3067892.serviceLayer_services_appTracking_lastUpdate", "1345163093988");

    Deleted : user_pref("CT3067892.serviceLayer_services_appsMetadata_lastUpdate", "1345673788601");

    Deleted : user_pref("CT3067892.serviceLayer_services_gottenAppsContextMenu_lastUpdate", "1344541656036");

    Deleted : user_pref("CT3067892.serviceLayer_services_login_10.10.20.14_lastUpdate", "1345673788693");

    Deleted : user_pref("CT3067892.serviceLayer_services_login_10.10.27.6_lastUpdate", "1345674530618");

    Deleted : user_pref("CT3067892.serviceLayer_services_login_10.10.6.6_lastUpdate", "1342360218960");

    Deleted : user_pref("CT3067892.serviceLayer_services_menu_4e9ef8462bd971f8d86771b0b0a0455c_lastUpdate", "13456[...]

    Deleted : user_pref("CT3067892.serviceLayer_services_menu_792d6ada7cb12ebc9c513e6a90d877e5_lastUpdate", "13456[...]

    Deleted : user_pref("CT3067892.serviceLayer_services_menu_bd5dece9153767afb9c43a2020020099_lastUpdate", "13456[...]

    Deleted : user_pref("CT3067892.serviceLayer_services_otherAppsContextMenu_lastUpdate", "1344541656106");

    Deleted : user_pref("CT3067892.serviceLayer_services_searchAPI_lastUpdate", "1345673788851");

    Deleted : user_pref("CT3067892.serviceLayer_services_serviceMap_lastUpdate", "1345673788405");

    Deleted : user_pref("CT3067892.serviceLayer_services_toolbarContextMenu_lastUpdate", "1344541656159");

    Deleted : user_pref("CT3067892.serviceLayer_services_toolbarSettings_lastUpdate", "1345673788505");

    Deleted : user_pref("CT3067892.serviceLayer_services_translation_lastUpdate", "1345673788910");

    Deleted : user_pref("CT3067892.settingsINI", true);

    Deleted : user_pref("CT3067892.shouldFirstTimeDialog", "false");

    Deleted : user_pref("CT3067892.smartbar.CTID", "CT3067892");

    Deleted : user_pref("CT3067892.smartbar.Uninstall", "0");

    Deleted : user_pref("CT3067892.smartbar.homepage", true);

    Deleted : user_pref("CT3067892.smartbar.toolbarName", "Miniclip ");

    Deleted : user_pref("CT3067892.toolbarBornServerTime", "23-6-2012");

    Deleted : user_pref("CT3067892.toolbarCurrentServerTime", "23-8-2012");

    Deleted : user_pref("CT3067892.twitterTemplate_3067892a129610743761394763000000_DailyActivity", "1345673675716[...]

    Deleted : user_pref("CT3067892.twitterTemplate_3067892a129610743761394763000000_LifetimeSent", "TRUE");

    Deleted : user_pref("Smartbar.ConduitHomepagesList", "hxxp://search.conduit.com/?SSPV=FFSB10&ctid=CT3067892&Se[...]

    Deleted : user_pref("Smartbar.ConduitSearchEngineList", "Miniclip Customized Web Search");

    Deleted : user_pref("Smartbar.ConduitSearchUrlList", "hxxp://search.conduit.com/ResultsExt.aspx?SSPV=FFSB10&ct[...]

    Deleted : user_pref("Smartbar.keywordURLSelectedCTID", "CT3067892");

    Deleted : user_pref("sweetim.toolbar.RevertDialog.enable", "false");

    Deleted : user_pref("sweetim.toolbar.SearchBoxLogo", "bing.png");

    Deleted : user_pref("sweetim.toolbar.SearchBoxText", "Search with Bing");

    Deleted : user_pref("sweetim.toolbar.UserSelectedSaveSettings", "true");

    Deleted : user_pref("sweetim.toolbar.Visibility.VisibilityGuardLastUnHide", "1366580846686");

    Deleted : user_pref("sweetim.toolbar.Visibility.enable", "true");

    Deleted : user_pref("sweetim.toolbar.Visibility.intervaldays", "7");

    Deleted : user_pref("sweetim.toolbar.cargo", "3.5000006.10042");

    Deleted : user_pref("sweetim.toolbar.cda.DisableOveride.enable", "false");

    Deleted : user_pref("sweetim.toolbar.cda.HideOveride.enable", "false");

    Deleted : user_pref("sweetim.toolbar.cda.RemoveOveride.enable", "false");

    Deleted : user_pref("sweetim.toolbar.defaultProvider", "bng");

    Deleted : user_pref("sweetim.toolbar.dialogs.0.enable", "true");

    Deleted : user_pref("sweetim.toolbar.dialogs.0.handler", "chrome://sim_toolbar_package/content/optionsdialog-h[...]

    Deleted : user_pref("sweetim.toolbar.dialogs.0.height", "335");

    Deleted : user_pref("sweetim.toolbar.dialogs.0.id", "id_options_dialog");

    Deleted : user_pref("sweetim.toolbar.dialogs.0.title", "$string.config.label;");

    Deleted : user_pref("sweetim.toolbar.dialogs.0.url", "hxxp://www.sweetim.com/simffbar/options_remote_ff.asp?la[...]

    Deleted : user_pref("sweetim.toolbar.dialogs.0.width", "761");

    Deleted : user_pref("sweetim.toolbar.dialogs.1.enable", "true");

    Deleted : user_pref("sweetim.toolbar.dialogs.1.handler", "chrome://sim_toolbar_package/content/exampledialog-h[...]

    Deleted : user_pref("sweetim.toolbar.dialogs.1.height", "300");

    Deleted : user_pref("sweetim.toolbar.dialogs.1.id", "id_example_dialog");

    Deleted : user_pref("sweetim.toolbar.dialogs.1.title", "Example (unit-test) dialog");

    Deleted : user_pref("sweetim.toolbar.dialogs.1.url", "chrome://sim_toolbar_package/content/exampledialog.html"[...]

    Deleted : user_pref("sweetim.toolbar.dialogs.1.width", "500");

    Deleted : user_pref("sweetim.toolbar.dialogs.2.enable", "true");

    Deleted : user_pref("sweetim.toolbar.dialogs.2.handler", "chrome://sim_toolbar_package/content/cdadialog-handl[...]

    Deleted : user_pref("sweetim.toolbar.dialogs.2.height", "150");

    Deleted : user_pref("sweetim.toolbar.dialogs.2.id", "id_dialog_hide_disable_remove");

    Deleted : user_pref("sweetim.toolbar.dialogs.2.title", "Option Dialog");

    Deleted : user_pref("sweetim.toolbar.dialogs.2.url", "hxxp://www.sweetim.com/simffbar/simcdadialog.asp");

    Deleted : user_pref("sweetim.toolbar.dialogs.2.width", "530");

    Deleted : user_pref("sweetim.toolbar.dnscatch.domain-blacklist", ".*.sweetim.com/.*|.*.facebook.com/.*|.*.goog[...]

    Deleted : user_pref("sweetim.toolbar.highlight.colors", "#FFFF00,#00FFE4,#5AFF00,#0087FF,#FFCC00,#FF00F0");

    Deleted : user_pref("sweetim.toolbar.keywordUrlGuard.enable", "false");

    Deleted : user_pref("sweetim.toolbar.logger.ConsoleHandler.MinReportLevel", "7");

    Deleted : user_pref("sweetim.toolbar.logger.FileHandler.FileName", "ff-toolbar.log");

    Deleted : user_pref("sweetim.toolbar.logger.FileHandler.MaxFileSize", "200000");

    Deleted : user_pref("sweetim.toolbar.logger.FileHandler.MinReportLevel", "7");

    Deleted : user_pref("sweetim.toolbar.mode.debug", "false");

    Deleted : user_pref("sweetim.toolbar.newtab.created", "true");

    Deleted : user_pref("sweetim.toolbar.newtab.enable", "true");

    Deleted : user_pref("sweetim.toolbar.newtab.url", "hxxp://start.sweetpacks.com/?src=97&barid=$toolbar_id;&crg=[...]

    Deleted : user_pref("sweetim.toolbar.previous.browser.newtab.url", "about:newtab");

    Deleted : user_pref("sweetim.toolbar.previous.browser.search.defaultenginename", "");

    Deleted : user_pref("sweetim.toolbar.previous.browser.search.selectedEngine", "");

    Deleted : user_pref("sweetim.toolbar.previous.browser.startup.homepage", "www.yahoo.com");

    Deleted : user_pref("sweetim.toolbar.previous.keyword.URL", "");

    Deleted : user_pref("sweetim.toolbar.rc.url", "hxxp://www.sweetim.com/simffbar/rc.html?toolbar_version=$ITEM_V[...]

    Deleted : user_pref("sweetim.toolbar.scripts.0.addcontextdiv", "true");

    Deleted : user_pref("sweetim.toolbar.scripts.0.callback", "simVerification");

    Deleted : user_pref("sweetim.toolbar.scripts.0.domain-blacklist", "");

    Deleted : user_pref("sweetim.toolbar.scripts.0.domain-whitelist", "hxxp://(www.|apps.)?facebook\\.com.*");

    Deleted : user_pref("sweetim.toolbar.scripts.0.elementid", "id_script_sim_fb");

    Deleted : user_pref("sweetim.toolbar.scripts.0.enable", "false");

    Deleted : user_pref("sweetim.toolbar.scripts.0.id", "id_script_fb");

    Deleted : user_pref("sweetim.toolbar.scripts.0.url", "hxxp://sc.sweetim.com/apps/in/fb/infb.js");

    Deleted : user_pref("sweetim.toolbar.scripts.1.addcontextdiv", "true");

    Deleted : user_pref("sweetim.toolbar.scripts.1.callback", "simVerification");

    Deleted : user_pref("sweetim.toolbar.scripts.1.domain-blacklist", "");

    Deleted : user_pref("sweetim.toolbar.scripts.1.domain-whitelist", "hxxps://(www.|apps.)?facebook\\.com.*");

    Deleted : user_pref("sweetim.toolbar.scripts.1.elementid", "id_script_sim_fb");

    Deleted : user_pref("sweetim.toolbar.scripts.1.enable", "false");

    Deleted : user_pref("sweetim.toolbar.scripts.1.id", "id_script_fb_hxxpS");

    Deleted : user_pref("sweetim.toolbar.scripts.1.url", "hxxps://sc.sweetim.com/apps/in/fb/infb.js");

    Deleted : user_pref("sweetim.toolbar.scripts.2.addcontextdiv", "false");

    Deleted : user_pref("sweetim.toolbar.scripts.2.callback", "");

    Deleted : user_pref("sweetim.toolbar.scripts.2.domain-blacklist", ".*.google..*|.*.bing..*|.*.live..*|.*.msn..[...]

    Deleted : user_pref("sweetim.toolbar.scripts.2.domain-whitelist", "");

    Deleted : user_pref("sweetim.toolbar.scripts.2.elementid", "id_predict_include_script");

    Deleted : user_pref("sweetim.toolbar.scripts.2.enable", "false");

    Deleted : user_pref("sweetim.toolbar.scripts.2.id", "id_script_prad");

    Deleted : user_pref("sweetim.toolbar.scripts.2.url", "hxxp://cdn1.certified-apps.com/scripts/shared/enable.js?[...]

    Deleted : user_pref("sweetim.toolbar.search.external", "<?xml version=\"1.0\"?><TOOLBAR><EXTERNAL_SEARCH engin[...]

    Deleted : user_pref("sweetim.toolbar.search.history.capacity", "10");

    Deleted : user_pref("sweetim.toolbar.searchguard.enable", "false");

    Deleted : user_pref("sweetim.toolbar.searchguard.initialized_by_rc", "true");

    Deleted : user_pref("sweetim.toolbar.simapp_id", "{C8130AB8-A6D5-11E2-BF47-F0DEF1C74384}");

    Deleted : user_pref("sweetim.toolbar.urls.afteruninstall", "hxxp://toolbar.sweetpacks.com/uninstallbar.asp?bar[...]

    Deleted : user_pref("sweetim.toolbar.urls.contactus", "hxxp://www.perion.com/contact-us");

    Deleted : user_pref("sweetim.toolbar.urls.homepage", "hxxp://start.sweetpacks.com/?src=10&st=12&crg=3.5000006.[...]

    Deleted : user_pref("sweetim.toolbar.urls.privacy", "hxxp://www.perion.com/privacy-policy");

    Deleted : user_pref("sweetim.toolbar.urls.searchpage", "hxxp://start.sweetpacks.com/?barid=$toolbar_id;");

    Deleted : user_pref("sweetim.toolbar.urls.uninstall", "hxxp://toolbar.sweetpacks.com/uninstall");

    Deleted : user_pref("sweetim.toolbar.version", "1.12.0.0");

    Deleted : user_pref("{C4CFC0DE-134F-4466-B2A2-FF7C59A8BFAD}.ScriptData_WSG_blackList", "form=CONTLB|babsrc=too[...]

    Deleted : user_pref("{C4CFC0DE-134F-4466-B2A2-FF7C59A8BFAD}.ScriptData_WSG_whiteList", "{\"search.babylon.com\[...]

    -\\ Google Chrome v26.0.1410.64

    File : C:\Users\Brittwins\AppData\Local\Google\Chrome\User Data\Default\Preferences

    [OK] File is clean.

    *************************

    AdwCleaner[R1].txt - [21011 octets] - [23/04/2013 19:58:51]

    AdwCleaner[s1].txt - [21256 octets] - [24/04/2013 19:40:50]

    ########## EOF - C:\AdwCleaner[s1].txt - [21317 octets] ##########

    Still going to that page whenever I open a new tab.

    Chrome also blocked an attempt during the deletion process to change it...was that AdwCleaner?

    Thanks for the help.

    Sweetpacks redirect

    in Resolved Malware Removal Logs

    Posted

    It's both Firefox and Chrome that are being redirected. The key/value you gave for RogueKiller was found and successfully deleted.

    # AdwCleaner v2.202 - Logfile created 04/23/2013 at 19:58:51

    # Updated 23/04/2013 by Xplode

    # Operating system : Windows 7 Home Premium Service Pack 1 (64 bits)

    # User : Brittwins - BRITTWINS-PC

    # Boot Mode : Normal

    # Running from : C:\Users\Brittwins\Desktop\adwcleaner.exe

    # Option [search]

    ***** [services] *****

    ***** [Files / Folders] *****

    File Found : C:\Users\Brittwins\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_apps.conduit.com_0.localstorage

    File Found : C:\Users\Brittwins\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_apps.conduit.com_0.localstorage-journal

    File Found : C:\Users\Brittwins\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_search.conduit.com_0.localstorage

    File Found : C:\Users\Brittwins\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_search.conduit.com_0.localstorage-journal

    File Found : C:\Users\Brittwins\AppData\Roaming\Mozilla\Firefox\Profiles\hlehrijn.default\extensions\{EEE6C361-6118-11DC-9C72-001320C79847}.xpi

    File Found : C:\Users\Brittwins\AppData\Roaming\Mozilla\Firefox\Profiles\hlehrijn.default\searchplugins\SweetIm.xml

    Folder Found : C:\Program Files (x86)\Conduit

    Folder Found : C:\Program Files (x86)\SweetIM

    Folder Found : C:\ProgramData\Partner

    Folder Found : C:\Users\Brittwins\AppData\Local\Conduit

    Folder Found : C:\Users\Brittwins\AppData\Local\Google\Chrome\User Data\Default\Extensions\dlnembnfbcpjnepmfjmngjenhhajpdfd

    Folder Found : C:\Users\Brittwins\AppData\Local\Google\Chrome\User Data\Default\Extensions\ogccgbmabaphcakpiclgcnmcnimhokcj

    Folder Found : C:\Users\Brittwins\AppData\LocalLow\Conduit

    Folder Found : C:\Users\Brittwins\AppData\Roaming\Mozilla\Firefox\Profiles\hlehrijn.default\Smartbar

    Folder Found : C:\Users\Brittwins\AppData\Roaming\Mozilla\Firefox\Profiles\hlehrijn.default\SweetPacksToolbarData

    ***** [Registry] *****

    Key Found : HKCU\Software\AppDataLow\Software\SmartBar

    Key Found : HKCU\Software\Conduit

    Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{02478D38-C3F9-4EFB-9B51-7695ECA05670}

    Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{EF99BD32-C1FB-11D2-892F-0090271D4F88}

    Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{02478D38-C3F9-4EFB-9B51-7695ECA05670}

    Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{EEE6C35B-6118-11DC-9C72-001320C79847}

    Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{EF99BD32-C1FB-11D2-892F-0090271D4F88}

    Key Found : HKCU\Software\Softonic

    Key Found : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{EEE6C360-6118-11DC-9C72-001320C79847}

    Key Found : HKLM\SOFTWARE\Classes\AppID\{B302A1BD-0157-49FA-90F1-4E94F22C7B4B}

    Key Found : HKLM\SOFTWARE\Classes\AppID\Extension.DLL

    Key Found : HKLM\SOFTWARE\Classes\Extension.ExtensionHelperObject

    Key Found : HKLM\SOFTWARE\Classes\Extension.ExtensionHelperObject.1

    Key Found : HKLM\SOFTWARE\Classes\SWEETIE.IEToolbar

    Key Found : HKLM\SOFTWARE\Classes\SWEETIE.IEToolbar.1

    Key Found : HKLM\SOFTWARE\Classes\sweetim_urlsearchhook.toolbarurlsearchhook

    Key Found : HKLM\SOFTWARE\Classes\sweetim_urlsearchhook.toolbarurlsearchhook.1

    Key Found : HKLM\SOFTWARE\Classes\Toolbar.CT3067892

    Key Found : HKLM\SOFTWARE\Classes\Toolbar3.sweetie

    Key Found : HKLM\SOFTWARE\Classes\Toolbar3.sweetie.1

    Key Found : HKLM\SOFTWARE\Classes\TypeLib\{1D5A4199-956E-49BC-B89F-6A35C57C0D13}

    Key Found : HKLM\SOFTWARE\Classes\TypeLib\{EEE6C35E-6118-11DC-9C72-001320C79847}

    Key Found : HKLM\SOFTWARE\Classes\TypeLib\{EEE6C35F-6118-11DC-9C72-001320C79847}

    Key Found : HKLM\Software\Conduit

    Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{02478D38-C3F9-4EFB-9B51-7695ECA05670}

    Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{EF99BD32-C1FB-11D2-892F-0090271D4F88}

    Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{02478D38-C3F9-4EFB-9B51-7695ECA05670}

    Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{3C471948-F874-49F5-B338-4F214A2EE0B1}

    Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{EEE6C35B-6118-11DC-9C72-001320C79847}

    Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{EEE6C35C-6118-11DC-9C72-001320C79847}

    Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{EEE6C35D-6118-11DC-9C72-001320C79847}

    Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{EF99BD32-C1FB-11D2-892F-0090271D4F88}

    Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{A36867C6-302D-49FC-9D8E-1EB037B5F1AB}

    Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{EEE6C358-6118-11DC-9C72-001320C79847}

    Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{EEE6C359-6118-11DC-9C72-001320C79847}

    Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{EEE6C35A-6118-11DC-9C72-001320C79847}

    Key Found : HKLM\SOFTWARE\Wow6432Node\Google\Chrome\Extensions\ogccgbmabaphcakpiclgcnmcnimhokcj

    Key Found : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{EEE6C367-6118-11DC-9C72-001320C79847}

    Key Found : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\{EEE6C360-6118-11DC-9C72-001320C79847}

    Key Found : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{02478D38-C3F9-4EFB-9B51-7695ECA05670}

    Key Found : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{EEE6C35C-6118-11DC-9C72-001320C79847}

    Key Found : HKLM\SOFTWARE\Classes\Interface\{A36867C6-302D-49FC-9D8E-1EB037B5F1AB}

    Key Found : HKLM\SOFTWARE\Classes\Interface\{EEE6C358-6118-11DC-9C72-001320C79847}

    Key Found : HKLM\SOFTWARE\Classes\Interface\{EEE6C359-6118-11DC-9C72-001320C79847}

    Key Found : HKLM\SOFTWARE\Classes\Interface\{EEE6C35A-6118-11DC-9C72-001320C79847}

    Key Found : HKU\S-1-5-21-728219785-2893818178-200570721-1001\Software\Microsoft\Internet Explorer\SearchScopes\{EEE6C360-6118-11DC-9C72-001320C79847}

    Value Found : HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks [{EF99BD32-C1FB-11D2-892F-0090271D4F88}]

    Value Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDLLs [C:\Program Files (x86)\SweetIM\Toolbars\Internet Explorer\mgHelperApp.exe]

    Value Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDLLs [C:\Program Files (x86)\SweetIM\Toolbars\Internet Explorer\mgToolbarProxy.dll]

    Value Found : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar [{EEE6C35B-6118-11DC-9C72-001320C79847}]

    Value Found : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar [{EF99BD32-C1FB-11D2-892F-0090271D4F88}]

    ***** [internet Browsers] *****

    -\\ Internet Explorer v10.0.9200.16537

    [OK] Registry is clean.

    -\\ Mozilla Firefox v20.0.1 (en-US)

    File : C:\Users\Brittwins\AppData\Roaming\Mozilla\Firefox\Profiles\hlehrijn.default\prefs.js

    Found : user_pref("CT3067892.3067892a129610743761394763000000paramsGK1", "{\"updateReqTime\":1345673674404,\[...]

    Found : user_pref("CT3067892.3067892a129610743761394763000000twitterTemplate_notify_followers", "0x0037,0x00[...]

    Found : user_pref("CT3067892.3067892a129610743761394763000000twitterTemplate_notify_followers_count", "31");

    Found : user_pref("CT3067892.3067892a129610743761394763000000twitterTemplate_notify_following", "0x0032,0x00[...]

    Found : user_pref("CT3067892.3067892a129610743761394763000000twitterTemplate_notify_following_count", "31");

    Found : user_pref("CT3067892.3067892a129610743761394763000000twitterTemplate_notify_home", "0x0032,0x0033,0x[...]

    Found : user_pref("CT3067892.3067892a129610743761394763000000twitterTemplate_notify_home_count", "15");

    Found : user_pref("CT3067892.ENABALE_HISTORY", "{\"dataType\":\"string\",\"data\":\"true\"}");

    Found : user_pref("CT3067892.ENABLE_RETURN_WEB_SEARCH_ON_THE_PAGE", "{\"dataType\":\"string\",\"data\":\"tru[...]

    Found : user_pref("CT3067892.FirstTime", "true");

    Found : user_pref("CT3067892.FirstTimeFF3", "true");

    Found : user_pref("CT3067892.SearchFromAddressBarUrl", "hxxp://search.conduit.com/ResultsExt.aspx?SSPV=FFSB1[...]

    Found : user_pref("CT3067892.UserID", "UN21886396350621362");

    Found : user_pref("CT3067892.addressBarTakeOverEnabledInHidden", "true");

    Found : user_pref("CT3067892.autoDisableScopes", -1);

    Found : user_pref("CT3067892.browser.search.defaultthis.engineName", true);

    Found : user_pref("CT3067892.defaultSearch", "true");

    Found : user_pref("CT3067892.embeddedsData", "[{\"appId\":\"10000002\",\"apiPermissions\":{\"crossDomainAjax[...]

    Found : user_pref("CT3067892.enableAlerts", "always");

    Found : user_pref("CT3067892.enableSearchFromAddressBar", "true");

    Found : user_pref("CT3067892.firstTimeDialogOpened", "true");

    Found : user_pref("CT3067892.fixPageNotFoundError", "true");

    Found : user_pref("CT3067892.fixPageNotFoundErrorInHidden", "true");

    Found : user_pref("CT3067892.fixUrls", true);

    Found : user_pref("CT3067892.installId", "ct3067892_miniclip.exe");

    Found : user_pref("CT3067892.installType", "ConduitNSISIntegration");

    Found : user_pref("CT3067892.isEnableAllDialogs", "{\"dataType\":\"string\",\"data\":\"true\"}");

    Found : user_pref("CT3067892.isNewTabEnabled", true);

    Found : user_pref("CT3067892.isPerformedSmartBarTransition", "true");

    Found : user_pref("CT3067892.isToolbarShrinked", "{\"dataType\":\"string\",\"data\":\"false\"}");

    Found : user_pref("CT3067892.keyword", true);

    Found : user_pref("CT3067892.navigationAliasesJson", "{\"EB_SEARCH_TERM\":\"\",\"EB_MAIN_FRAME_URL\":\"hxxp%[...]

    Found : user_pref("CT3067892.openThankYouPage", "false");

    Found : user_pref("CT3067892.openUninstallPage", "true");

    Found : user_pref("CT3067892.search.searchAppId", "10000002");

    Found : user_pref("CT3067892.search.searchCount", "0");

    Found : user_pref("CT3067892.searchInNewTabEnabledInHidden", "true");

    Found : user_pref("CT3067892.selectToSearchBoxEnabled", "{\"dataType\":\"string\",\"data\":\"true\"}");

    Found : user_pref("CT3067892.serviceLayer_service_login_isFirstLoginInvoked", "{\"dataType\":\"boolean\",\"d[...]

    Found : user_pref("CT3067892.serviceLayer_service_login_loginCount", "{\"dataType\":\"number\",\"data\":\"4\[...]

    Found : user_pref("CT3067892.serviceLayer_service_toolbarGrouping_activeCTID", "{\"dataType\":\"string\",\"d[...]

    Found : user_pref("CT3067892.serviceLayer_service_toolbarGrouping_activeDownloadUrl", "{\"dataType\":\"strin[...]

    Found : user_pref("CT3067892.serviceLayer_service_toolbarGrouping_activeToolbarName", "{\"dataType\":\"strin[...]

    Found : user_pref("CT3067892.serviceLayer_service_toolbarGrouping_invoked", "{\"dataType\":\"string\",\"data[...]

    Found : user_pref("CT3067892.serviceLayer_service_usage_toolbarUsageCount", "{\"dataType\":\"number\",\"data[...]

    Found : user_pref("CT3067892.serviceLayer_services_appTrackingFirstTime_lastUpdate", "1345163210837");

    Found : user_pref("CT3067892.serviceLayer_services_appTracking_lastUpdate", "1345163093988");

    Found : user_pref("CT3067892.serviceLayer_services_appsMetadata_lastUpdate", "1345673788601");

    Found : user_pref("CT3067892.serviceLayer_services_gottenAppsContextMenu_lastUpdate", "1344541656036");

    Found : user_pref("CT3067892.serviceLayer_services_login_10.10.20.14_lastUpdate", "1345673788693");

    Found : user_pref("CT3067892.serviceLayer_services_login_10.10.27.6_lastUpdate", "1345674530618");

    Found : user_pref("CT3067892.serviceLayer_services_login_10.10.6.6_lastUpdate", "1342360218960");

    Found : user_pref("CT3067892.serviceLayer_services_menu_4e9ef8462bd971f8d86771b0b0a0455c_lastUpdate", "13456[...]

    Found : user_pref("CT3067892.serviceLayer_services_menu_792d6ada7cb12ebc9c513e6a90d877e5_lastUpdate", "13456[...]

    Found : user_pref("CT3067892.serviceLayer_services_menu_bd5dece9153767afb9c43a2020020099_lastUpdate", "13456[...]

    Found : user_pref("CT3067892.serviceLayer_services_otherAppsContextMenu_lastUpdate", "1344541656106");

    Found : user_pref("CT3067892.serviceLayer_services_searchAPI_lastUpdate", "1345673788851");

    Found : user_pref("CT3067892.serviceLayer_services_serviceMap_lastUpdate", "1345673788405");

    Found : user_pref("CT3067892.serviceLayer_services_toolbarContextMenu_lastUpdate", "1344541656159");

    Found : user_pref("CT3067892.serviceLayer_services_toolbarSettings_lastUpdate", "1345673788505");

    Found : user_pref("CT3067892.serviceLayer_services_translation_lastUpdate", "1345673788910");

    Found : user_pref("CT3067892.settingsINI", true);

    Found : user_pref("CT3067892.shouldFirstTimeDialog", "false");

    Found : user_pref("CT3067892.smartbar.CTID", "CT3067892");

    Found : user_pref("CT3067892.smartbar.Uninstall", "0");

    Found : user_pref("CT3067892.smartbar.homepage", true);

    Found : user_pref("CT3067892.smartbar.toolbarName", "Miniclip ");

    Found : user_pref("CT3067892.toolbarBornServerTime", "23-6-2012");

    Found : user_pref("CT3067892.toolbarCurrentServerTime", "23-8-2012");

    Found : user_pref("CT3067892.twitterTemplate_3067892a129610743761394763000000_DailyActivity", "1345673675716[...]

    Found : user_pref("CT3067892.twitterTemplate_3067892a129610743761394763000000_LifetimeSent", "TRUE");

    Found : user_pref("Smartbar.ConduitHomepagesList", "hxxp://search.conduit.com/?SSPV=FFSB10&ctid=CT3067892&Se[...]

    Found : user_pref("Smartbar.ConduitSearchEngineList", "Miniclip Customized Web Search");

    Found : user_pref("Smartbar.ConduitSearchUrlList", "hxxp://search.conduit.com/ResultsExt.aspx?SSPV=FFSB10&ct[...]

    Found : user_pref("Smartbar.keywordURLSelectedCTID", "CT3067892");

    Found : user_pref("sweetim.toolbar.RevertDialog.enable", "false");

    Found : user_pref("sweetim.toolbar.SearchBoxLogo", "bing.png");

    Found : user_pref("sweetim.toolbar.SearchBoxText", "Search with Bing");

    Found : user_pref("sweetim.toolbar.UserSelectedSaveSettings", "true");

    Found : user_pref("sweetim.toolbar.Visibility.VisibilityGuardLastUnHide", "1366580846686");

    Found : user_pref("sweetim.toolbar.Visibility.enable", "true");

    Found : user_pref("sweetim.toolbar.Visibility.intervaldays", "7");

    Found : user_pref("sweetim.toolbar.cargo", "3.5000006.10042");

    Found : user_pref("sweetim.toolbar.cda.DisableOveride.enable", "false");

    Found : user_pref("sweetim.toolbar.cda.HideOveride.enable", "false");

    Found : user_pref("sweetim.toolbar.cda.RemoveOveride.enable", "false");

    Found : user_pref("sweetim.toolbar.defaultProvider", "bng");

    Found : user_pref("sweetim.toolbar.dialogs.0.enable", "true");

    Found : user_pref("sweetim.toolbar.dialogs.0.handler", "chrome://sim_toolbar_package/content/optionsdialog-h[...]

    Found : user_pref("sweetim.toolbar.dialogs.0.height", "335");

    Found : user_pref("sweetim.toolbar.dialogs.0.id", "id_options_dialog");

    Found : user_pref("sweetim.toolbar.dialogs.0.title", "$string.config.label;");

    Found : user_pref("sweetim.toolbar.dialogs.0.url", "hxxp://www.sweetim.com/simffbar/options_remote_ff.asp?la[...]

    Found : user_pref("sweetim.toolbar.dialogs.0.width", "761");

    Found : user_pref("sweetim.toolbar.dialogs.1.enable", "true");

    Found : user_pref("sweetim.toolbar.dialogs.1.handler", "chrome://sim_toolbar_package/content/exampledialog-h[...]

    Found : user_pref("sweetim.toolbar.dialogs.1.height", "300");

    Found : user_pref("sweetim.toolbar.dialogs.1.id", "id_example_dialog");

    Found : user_pref("sweetim.toolbar.dialogs.1.title", "Example (unit-test) dialog");

    Found : user_pref("sweetim.toolbar.dialogs.1.url", "chrome://sim_toolbar_package/content/exampledialog.html"[...]

    Found : user_pref("sweetim.toolbar.dialogs.1.width", "500");

    Found : user_pref("sweetim.toolbar.dialogs.2.enable", "true");

    Found : user_pref("sweetim.toolbar.dialogs.2.handler", "chrome://sim_toolbar_package/content/cdadialog-handl[...]

    Found : user_pref("sweetim.toolbar.dialogs.2.height", "150");

    Found : user_pref("sweetim.toolbar.dialogs.2.id", "id_dialog_hide_disable_remove");

    Found : user_pref("sweetim.toolbar.dialogs.2.title", "Option Dialog");

    Found : user_pref("sweetim.toolbar.dialogs.2.url", "hxxp://www.sweetim.com/simffbar/simcdadialog.asp");

    Found : user_pref("sweetim.toolbar.dialogs.2.width", "530");

    Found : user_pref("sweetim.toolbar.dnscatch.domain-blacklist", ".*.sweetim.com/.*|.*.facebook.com/.*|.*.goog[...]

    Found : user_pref("sweetim.toolbar.highlight.colors", "#FFFF00,#00FFE4,#5AFF00,#0087FF,#FFCC00,#FF00F0");

    Found : user_pref("sweetim.toolbar.keywordUrlGuard.enable", "false");

    Found : user_pref("sweetim.toolbar.logger.ConsoleHandler.MinReportLevel", "7");

    Found : user_pref("sweetim.toolbar.logger.FileHandler.FileName", "ff-toolbar.log");

    Found : user_pref("sweetim.toolbar.logger.FileHandler.MaxFileSize", "200000");

    Found : user_pref("sweetim.toolbar.logger.FileHandler.MinReportLevel", "7");

    Found : user_pref("sweetim.toolbar.mode.debug", "false");

    Found : user_pref("sweetim.toolbar.newtab.created", "true");

    Found : user_pref("sweetim.toolbar.newtab.enable", "true");

    Found : user_pref("sweetim.toolbar.newtab.url", "hxxp://start.sweetpacks.com/?src=97&barid=$toolbar_id;&crg=[...]

    Found : user_pref("sweetim.toolbar.previous.browser.newtab.url", "about:newtab");

    Found : user_pref("sweetim.toolbar.previous.browser.search.defaultenginename", "");

    Found : user_pref("sweetim.toolbar.previous.browser.search.selectedEngine", "");

    Found : user_pref("sweetim.toolbar.previous.browser.startup.homepage", "www.yahoo.com");

    Found : user_pref("sweetim.toolbar.previous.keyword.URL", "");

    Found : user_pref("sweetim.toolbar.rc.url", "hxxp://www.sweetim.com/simffbar/rc.html?toolbar_version=$ITEM_V[...]

    Found : user_pref("sweetim.toolbar.scripts.0.addcontextdiv", "true");

    Found : user_pref("sweetim.toolbar.scripts.0.callback", "simVerification");

    Found : user_pref("sweetim.toolbar.scripts.0.domain-blacklist", "");

    Found : user_pref("sweetim.toolbar.scripts.0.domain-whitelist", "hxxp://(www.|apps.)?facebook\\.com.*");

    Found : user_pref("sweetim.toolbar.scripts.0.elementid", "id_script_sim_fb");

    Found : user_pref("sweetim.toolbar.scripts.0.enable", "false");

    Found : user_pref("sweetim.toolbar.scripts.0.id", "id_script_fb");

    Found : user_pref("sweetim.toolbar.scripts.0.url", "hxxp://sc.sweetim.com/apps/in/fb/infb.js");

    Found : user_pref("sweetim.toolbar.scripts.1.addcontextdiv", "true");

    Found : user_pref("sweetim.toolbar.scripts.1.callback", "simVerification");

    Found : user_pref("sweetim.toolbar.scripts.1.domain-blacklist", "");

    Found : user_pref("sweetim.toolbar.scripts.1.domain-whitelist", "hxxps://(www.|apps.)?facebook\\.com.*");

    Found : user_pref("sweetim.toolbar.scripts.1.elementid", "id_script_sim_fb");

    Found : user_pref("sweetim.toolbar.scripts.1.enable", "false");

    Found : user_pref("sweetim.toolbar.scripts.1.id", "id_script_fb_hxxpS");

    Found : user_pref("sweetim.toolbar.scripts.1.url", "hxxps://sc.sweetim.com/apps/in/fb/infb.js");

    Found : user_pref("sweetim.toolbar.scripts.2.addcontextdiv", "false");

    Found : user_pref("sweetim.toolbar.scripts.2.callback", "");

    Found : user_pref("sweetim.toolbar.scripts.2.domain-blacklist", ".*.google..*|.*.bing..*|.*.live..*|.*.msn..[...]

    Found : user_pref("sweetim.toolbar.scripts.2.domain-whitelist", "");

    Found : user_pref("sweetim.toolbar.scripts.2.elementid", "id_predict_include_script");

    Found : user_pref("sweetim.toolbar.scripts.2.enable", "false");

    Found : user_pref("sweetim.toolbar.scripts.2.id", "id_script_prad");

    Found : user_pref("sweetim.toolbar.scripts.2.url", "hxxp://cdn1.certified-apps.com/scripts/shared/enable.js?[...]

    Found : user_pref("sweetim.toolbar.search.external", "<?xml version=\"1.0\"?><TOOLBAR><EXTERNAL_SEARCH engin[...]

    Found : user_pref("sweetim.toolbar.search.history.capacity", "10");

    Found : user_pref("sweetim.toolbar.searchguard.enable", "false");

    Found : user_pref("sweetim.toolbar.searchguard.initialized_by_rc", "true");

    Found : user_pref("sweetim.toolbar.simapp_id", "{C8130AB8-A6D5-11E2-BF47-F0DEF1C74384}");

    Found : user_pref("sweetim.toolbar.urls.afteruninstall", "hxxp://toolbar.sweetpacks.com/uninstallbar.asp?bar[...]

    Found : user_pref("sweetim.toolbar.urls.contactus", "hxxp://www.perion.com/contact-us");

    Found : user_pref("sweetim.toolbar.urls.homepage", "hxxp://start.sweetpacks.com/?src=10&st=12&crg=3.5000006.[...]

    Found : user_pref("sweetim.toolbar.urls.privacy", "hxxp://www.perion.com/privacy-policy");

    Found : user_pref("sweetim.toolbar.urls.searchpage", "hxxp://start.sweetpacks.com/?barid=$toolbar_id;");

    Found : user_pref("sweetim.toolbar.urls.uninstall", "hxxp://toolbar.sweetpacks.com/uninstall");

    Found : user_pref("sweetim.toolbar.version", "1.12.0.0");

    Found : user_pref("{C4CFC0DE-134F-4466-B2A2-FF7C59A8BFAD}.ScriptData_WSG_blackList", "form=CONTLB|babsrc=too[...]

    Found : user_pref("{C4CFC0DE-134F-4466-B2A2-FF7C59A8BFAD}.ScriptData_WSG_whiteList", "{\"search.babylon.com\[...]

    -\\ Google Chrome v26.0.1410.64

    File : C:\Users\Brittwins\AppData\Local\Google\Chrome\User Data\Default\Preferences

    [OK] File is clean.

    *************************

    AdwCleaner[R1].txt - [20890 octets] - [23/04/2013 19:58:51]

    ########## EOF - C:\AdwCleaner[R1].txt - [20951 octets] ##########

    Sweetpacks redirect

    in Resolved Malware Removal Logs

    Posted

    RogueKiller V8.5.4 _x64_ [Mar 18 2013] by Tigzy

    mail : tigzyRK<at>gmail<dot>com

    Feedback : http://www.geekstogo.com/forum/files/file/413-roguekiller/

    Website : http://tigzy.geekstogo.com/roguekiller.php

    Blog : http://tigzyrk.blogspot.com/

    Operating System : Windows 7 (6.1.7601 Service Pack 1) 64 bits version

    Started in : Normal mode

    User : Brittwins [Admin rights]

    Mode : Scan -- Date : 04/21/2013 20:27:56

    | ARK || FAK || MBR |

    ¤¤¤ Bad processes : 0 ¤¤¤

    ¤¤¤ Registry Entries : 3 ¤¤¤

    [RUN][bLACKLISTDLL] HKLM\[...]\Wow6432Node\Run : S6000Mnt (C:\windows\SysWOW64\Rundll32.exe S6000Rmv.dll,WinMainRmv /StartStillMnt) -> FOUND

    [HJ DESK] HKLM\[...]\NewStartPanel : {59031a47-3f72-44a7-89c5-5595fe6b30ee} (1) -> FOUND

    [HJ DESK] HKLM\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> FOUND

    ¤¤¤ Particular Files / Folders: ¤¤¤

    ¤¤¤ Driver : [NOT LOADED] ¤¤¤

    ¤¤¤ HOSTS File: ¤¤¤

    --> C:\windows\system32\drivers\etc\hosts

    ¤¤¤ MBR Check: ¤¤¤

    +++++ PhysicalDrive0: WDC WD50 00BPVT-24HXZT3 SATA Disk Device +++++

    --- User ---

    [MBR] 47ec9554432ec7881f84d0d707bfd4d4

    [bSP] 8d6e6b6ba97bf1adf05a14cdfa6888b0 : Windows 7/8 MBR Code

    Partition table:

    0 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 2048 | Size: 200 Mo

    1 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 411648 | Size: 431938 Mo

    2 - [XXXXXX] EXTEN-LBA (0x0f) [VISIBLE] Offset (sectors): 885020672 | Size: 29692 Mo

    3 - [XXXXXX] COMPAQ (0x12) [VISIBLE] Offset (sectors): 945829888 | Size: 15109 Mo

    User = LL1 ... OK!

    User = LL2 ... OK!

    Finished : << RKreport[1]_S_04212013_02d2027.txt >>

    RKreport[1]_S_04212013_02d2027.txt

    Sweetpacks redirect

    in Resolved Malware Removal Logs

    Posted

    Welcome to the forum.

    Please remove any usb or external drives from the computer before you run this scan!

    Please download and run RogueKiller 32 bit to your desktop.

    RogueKiller<---use this one for 64 bit systems

    Quit all running programs.

    For Windows XP, double-click to start.

    For Vista or Windows 7-8, do a right-click on the program, select Run as Administrator to start, & when prompted Allow to run.

    Click Scan to scan the system.

    When the scan completes > Close out the program > Don't Fix anything!

    Don't run any other options, they're not all bad!!!!!!!

    Post back the report which should be located on your desktop.

    (please don't put logs in code or quotes)

    P2P Warning:

    MrC

    Note:

    Make sure you're subscribed to this topic:
    Click on the
    Follow This Topic Button
    (at the top right of this page), make sure that the
    Receive notification
    box is checked and that it is set to
    Instantly

    Removing malware can be unpredictable
    ...things can go very wrong!
    Backup
    any files that cannot be replaced. You can copy them to a CD/DVD, external drive or a pen drive

    <+>
    Please don't run any other scans, download, install or uninstall any programs while I'm working with you.

    <+>The removal of malware isn't instantaneous, please be patient.

    <+>
    Please stick with me until I give you the "all clear".

    ------->Your topic will be closed if you haven't replied within 3 days!<--------

    (If I don't respond within 24 hours, please send me a PM)

    Hold on, is there a torrent program running on the computer?

    Sweetpacks redirect

    in Resolved Malware Removal Logs

    Posted

    Hey everyone

    A few days ago my brother noticed that his homepage was Sweetpacks, which is apparently an adware/browser redirect. He changed his homepage and removed the toolbar, but whenever a new tab is opened the page is displayed. MBAM and a MSE quick scan didn't find anything.

    DDS (Ver_2012-11-20.01) - NTFS_AMD64

    Internet Explorer: 10.0.9200.16537 BrowserJavaVersion: 10.17.2

    Run by Brittwins at 18:04:24 on 2013-04-21

    Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.3558.1540 [GMT -4:00]

    .

    AV: Microsoft Security Essentials *Enabled/Updated* {3F839487-C7A2-C958-E30C-E2825BA31FB5}

    SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

    SP: Microsoft Security Essentials *Enabled/Updated* {84E27563-E198-C6D6-D9BC-D9F020245508}

    .

    ============== Running Processes ===============

    .

    C:\windows\system32\lsm.exe

    C:\windows\system32\svchost.exe -k DcomLaunch

    C:\windows\system32\svchost.exe -k RPCSS

    c:\Program Files\Microsoft Security Client\MsMpEng.exe

    C:\windows\system32\atiesrxx.exe

    C:\windows\System32\svchost.exe -k LocalServiceNetworkRestricted

    C:\windows\System32\svchost.exe -k LocalSystemNetworkRestricted

    C:\windows\system32\svchost.exe -k LocalService

    C:\windows\system32\svchost.exe -k netsvcs

    C:\windows\system32\svchost.exe -k NetworkService

    C:\windows\System32\spoolsv.exe

    C:\windows\system32\svchost.exe -k LocalServiceNoNetwork

    C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe

    C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe

    C:\windows\SysWOW64\svchost.exe -k hpdevmgmt

    C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe

    C:\windows\system32\svchost.exe -k imgsvc

    C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe

    C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE

    C:\windows\system32\SearchIndexer.exe

    C:\windows\system32\svchost.exe -k HPService

    c:\Program Files\Microsoft Security Client\NisSrv.exe

    C:\windows\system32\svchost.exe -k NetworkServiceNetworkRestricted

    C:\windows\system32\atieclxx.exe

    C:\windows\system32\taskhost.exe

    C:\windows\system32\Dwm.exe

    C:\windows\Explorer.EXE

    C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe

    C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

    C:\Program Files (x86)\Lenovo\Onekey Theater\OnekeyStudio.exe

    C:\Program Files (x86)\Lenovo\Energy Management\Energy Management.exe

    C:\Program Files (x86)\Lenovo\Energy Management\utility.exe

    C:\Program Files\Microsoft Security Client\msseces.exe

    C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

    C:\Program Files (x86)\Lenovo\YouCam\YCMMirage.exe

    C:\Program Files\Synaptics\SynTP\SynTPHelper.exe

    C:\Program Files (x86)\Lenovo\VeriFace\PManage.exe

    C:\windows\WebCam\S6000\S6000Mnt.exe

    C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe

    C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe

    C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe

    C:\windows\system32\svchost.exe -k LocalServiceAndNoImpersonation

    C:\Program Files (x86)\HP\Digital Imaging\bin\hpqSTE08.exe

    C:\Program Files (x86)\HP\Digital Imaging\bin\hpqbam08.exe

    C:\Program Files (x86)\Lenovo\Onekey Theater\OnekeySupport.exe

    C:\Program Files (x86)\HP\Digital Imaging\bin\hpqgpc01.exe

    C:\windows\System32\svchost.exe -k LocalServicePeerNet

    C:\Program Files\Windows Media Player\wmpnetwk.exe

    C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE

    C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE

    C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe

    C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe

    C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe

    C:\windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe

    C:\windows\SysWOW64\mspaint.exe

    C:\Program Files\Updater By SweetPacks\ExtensionUpdaterService.exe

    C:\windows\system32\wuauclt.exe

    C:\Program Files (x86)\Mozilla Firefox\firefox.exe

    C:\windows\System32\svchost.exe -k HPZ12

    C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe

    C:\windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_6_602_180.exe

    C:\windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_6_602_180.exe

    C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE

    C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe

    C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe

    C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe

    C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbam.exe

    C:\windows\notepad.exe

    C:\windows\system32\taskhost.exe

    C:\windows\system32\SearchProtocolHost.exe

    C:\windows\system32\SearchFilterHost.exe

    C:\windows\system32\wbem\wmiprvse.exe

    C:\windows\System32\cscript.exe

    .

    ============== Pseudo HJT Report ===============

    .

    uStart Page = hxxp://start.sweetpacks.com/?src=10&st=12&crg=3.5000006.10042&barid={C8130AB8-A6D5-11E2-BF47-F0DEF1C74384}

    uDefault_Page_URL = hxxp://www.google.com/ig/redirectdomain?brand=LENN&bmod=LENN

    mStart Page = hxxp://start.sweetpacks.com/?src=10&st=12&crg=3.5000006.10042&barid={C8130AB8-A6D5-11E2-BF47-F0DEF1C74384}

    uURLSearchHooks: {1c68c940-1b2f-46eb-bd8c-2e1612ff6a58} - <orphaned>

    uURLSearchHooks: Yahoo! Toolbar: {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn\yt.dll

    mWinlogon: Userinit = userinit.exe

    BHO: &Yahoo! Toolbar Helper: {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn\yt.dll

    BHO: HP Print Enhancer: {0347C33E-8762-4905-BF09-768834316C61} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll

    BHO: Adobe PDF Link Helper: {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

    BHO: SteadyVideoBHO Class: {6C680BAE-655C-4E3D-8FC4-E6A520C3D928} - C:\Program Files (x86)\AMD\SteadyVideo\SteadyVideo.dll

    BHO: Java Plug-In SSV Helper: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll

    BHO: Windows Live ID Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

    BHO: Google Toolbar Helper: {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll

    BHO: Office Document Cache Handler: {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL

    BHO: Updater By SweetPacks: {C4CFC0DE-134F-4466-B2A2-FF7C59A8BFAD} - C:\Program Files\Updater By SweetPacks\Extension32.dll

    BHO: Java Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll

    BHO: SweetPacks Browser Helper: {EEE6C35C-6118-11DC-9C72-001320C79847} - C:\Program Files (x86)\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll

    BHO: SingleInstance Class: {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn\YTSingleInstance.dll

    BHO: HP Smart BHO Class: {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll

    TB: Google Toolbar: {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll

    TB: Yahoo! Toolbar: {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn\yt.dll

    TB: Google Toolbar: {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll

    TB: SweetPacks Toolbar for Internet Explorer: {EEE6C35B-6118-11DC-9C72-001320C79847} - C:\Program Files (x86)\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll

    EB: HP Smart Web Printing: {555D4D79-4BD2-4094-A395-CFC534424A05} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_bho.dll

    EB: HP Smart Web Printing: {555D4D79-4BD2-4094-A395-CFC534424A05} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_bho.dll

    uRun: [swg] "C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"

    uRunOnce: [FlashPlayerUpdate] C:\windows\SysWOW64\Macromed\Flash\FlashUtil32_11_6_602_180_Plugin.exe -update plugin

    mRun: [startCCC] "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun

    mRun: [s6000Mnt] C:\windows\SysWOW64\Rundll32.exe S6000Rmv.dll,WinMainRmv /StartStillMnt

    mRun: [YouCam Mirage] "C:\Program Files (x86)\Lenovo\YouCam\YCMMirage.exe"

    mRun: [YouCam Tray] "C:\Program Files (x86)\Lenovo\YouCam\YouCam.exe" /s

    mRun: [VeriFaceManager] C:\Program Files (x86)\Lenovo\VeriFace\PManage.exe

    mRun: [updateP2GShortCut] "C:\Program Files (x86)\Lenovo\Power2Go\MUITransfer\MUIStartMenu.exe" "C:\Program Files (x86)\Lenovo\Power2Go" UpdateWithCreateOnce "SOFTWARE\CyberLink\Power2Go\5.0"

    mRun: [updatePRCShortCut] "C:\Program Files\Lenovo\OneKey App\OneKey Recovery\MUITransfer\MUIStartMenu.exe" "C:\Program Files\Lenovo\OneKey App\OneKey Recovery" UpdateWithCreateOnce "Software\Lenovo\OneKey App\OneKey Recovery"

    mRun: [HP Software Update] C:\Program Files (x86)\HP\HP Software Update\HPWuSchd2.exe

    mRun: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"

    mRun: [sunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"

    mRunOnce: [Malwarebytes Anti-Malware] C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe /install /silent

    StartupFolder: C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\Startup\HPDIGI~1.LNK - C:\Program Files (x86)\HP\Digital Imaging\bin\hpqtra08.exe

    mPolicies-Explorer: NoActiveDesktop = dword:1

    mPolicies-Explorer: NoActiveDesktopChanges = dword:1

    mPolicies-System: ConsentPromptBehaviorUser = dword:3

    mPolicies-System: EnableUIADesktopToggle = dword:0

    IE: E&xport to Microsoft Excel - C:\PROGRA~2\MICROS~1\Office14\EXCEL.EXE/3000

    IE: Se&nd to OneNote - C:\PROGRA~2\MICROS~1\Office14\ONBttnIE.dll/105

    IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll

    IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIE.dll

    IE: {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - {FFFDC614-B694-4AE6-AB38-5D6374584B52} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIELinkedNotes.dll

    IE: {DDE87865-83C5-48c4-8357-2F5B1AA84522} - {DDE87865-83C5-48c4-8357-2F5B1AA84522} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll

    TCP: NameServer = 192.168.1.254

    TCP: Interfaces\{7A9BFD46-BEDD-406F-9A4F-7DA918455A2C} : DHCPNameServer = 192.168.1.254

    TCP: Interfaces\{7A9BFD46-BEDD-406F-9A4F-7DA918455A2C}\2475F4365616E62456163686 : DHCPNameServer = 10.0.0.1

    TCP: Interfaces\{7A9BFD46-BEDD-406F-9A4F-7DA918455A2C}\2475F4365616E6245616368684F64756C662355796475637 : DHCPNameServer = 10.0.0.1

    TCP: Interfaces\{7A9BFD46-BEDD-406F-9A4F-7DA918455A2C}\55E69647024383 : DHCPNameServer = 192.168.122.1

    TCP: Interfaces\{D6A2F2CA-D77B-48DF-87A6-84EA21D0B45C} : DHCPNameServer = 172.168.123.2

    Filter: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL

    Filter: video/mp4 - {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files (x86)\AMD\SteadyVideo\VideoMIMEFilter.dll

    Filter: video/x-flv - {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files (x86)\AMD\SteadyVideo\VideoMIMEFilter.dll

    Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files (x86)\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll

    SSODL: WebCheck - <orphaned>

    mASetup: {8A69D345-D564-463c-AFF1-A69D9E530F96} - "C:\Program Files (x86)\Google\Chrome\Application\26.0.1410.64\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --multi-install --chrome

    x64-BHO: SteadyVideoBHO Class: {6C680BAE-655C-4E3D-8FC4-E6A520C3D928} - C:\Program Files\AMD\SteadyVideo\SteadyVideo.dll

    x64-BHO: Windows Live ID Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

    x64-BHO: Google Toolbar Helper: {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll

    x64-BHO: Office Document Cache Handler: {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL

    x64-BHO: Updater By SweetPacks: {C4CFC0DE-134F-4466-B2A2-FF7C59A8BFAD} - C:\Program Files\Updater By SweetPacks\Extension64.dll

    x64-TB: Google Toolbar: {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll

    x64-Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe -s

    x64-Run: [synTPEnh] C:\Program Files (x86)\Synaptics\SynTP\SynTPEnh.exe

    x64-Run: [Lenovo EE Boot Optimizer] C:\Program Files (x86)\Lenovo\Boot Optimizer\PopWnd.exe

    x64-Run: [OnekeyStudio] C:\Program Files (x86)\Lenovo\Onekey Theater\OnekeyStudio.exe

    x64-Run: [Energy Management] C:\Program Files (x86)\Lenovo\Energy Management\Energy Management.exe

    x64-Run: [EnergyUtility] C:\Program Files (x86)\Lenovo\Energy Management\Utility.exe

    x64-Run: [MSC] "c:\Program Files\Microsoft Security Client\msseces.exe" -hide -runkey

    x64-IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - C:\Program Files\Microsoft Office\Office14\ONBttnIE.dll

    x64-IE: {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - {FFFDC614-B694-4AE6-AB38-5D6374584B52} - C:\Program Files\Microsoft Office\Office14\ONBttnIELinkedNotes.dll

    x64-Filter: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL

    x64-Filter: video/mp4 - {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files\AMD\SteadyVideo\VideoMIMEFilter.dll

    x64-Filter: video/x-flv - {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files\AMD\SteadyVideo\VideoMIMEFilter.dll

    x64-Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - <orphaned>

    x64-SSODL: WebCheck - <orphaned>

    .

    ================= FIREFOX ===================

    .

    FF - ProfilePath - C:\Users\Brittwins\AppData\Roaming\Mozilla\Firefox\Profiles\hlehrijn.default\

    FF - prefs.js: browser.search.defaulturl -

    FF - prefs.js: browser.search.selectedEngine - Google

    FF - prefs.js: browser.startup.homepage - hxxp://www.yahoo.com/

    FF - prefs.js: keyword.URL - hxxp://start.sweetpacks.com/?src=2&st=12&barid={C8130AB8-A6D5-11E2-BF47-F0DEF1C74384}&q=

    FF - plugin: C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL

    FF - plugin: C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL

    FF - plugin: C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll

    FF - plugin: C:\Program Files (x86)\Google\Update\1.3.21.135\npGoogleUpdate3.dll

    FF - plugin: C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll

    FF - plugin: c:\Program Files (x86)\Microsoft Silverlight\5.1.20125.0\npctrlui.dll

    FF - plugin: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll

    FF - plugin: C:\windows\SysWOW64\Adobe\Director\np32dsw.dll

    FF - plugin: C:\windows\SysWOW64\Macromed\Flash\NPSWF32_11_6_602_180.dll

    FF - plugin: C:\windows\SysWOW64\npDeployJava1.dll

    FF - plugin: C:\windows\SysWOW64\npmproxy.dll

    FF - ExtSQL: 2013-04-16 16:40; {EEE6C361-6118-11DC-9C72-001320C79847}; C:\Users\Brittwins\AppData\Roaming\Mozilla\Firefox\Profiles\hlehrijn.default\extensions\{EEE6C361-6118-11DC-9C72-001320C79847}.xpi

    FF - ExtSQL: 2013-04-16 16:41; {C4CFC0DE-134F-4466-B2A2-FF7C59A8BFAD}; C:\Program Files\Updater By SweetPacks\Firefox

    FF - ExtSQL: !HIDDEN! 2012-08-23 20:26; smartwebprinting@hp.com; C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3

    .

    ============= SERVICES / DRIVERS ===============

    .

    R0 fbfmon;fbfmon;C:\windows\System32\drivers\fbfmon.sys [2012-3-1 57952]

    R0 LHDmgr;LHDmgr;C:\windows\System32\drivers\LhdX64.sys [2012-3-1 39008]

    R0 MpFilter;Microsoft Malware Protection Driver;C:\windows\System32\drivers\MpFilter.sys [2013-1-20 230320]

    R1 BPntDrv;BPntDrv;C:\windows\System32\drivers\BPntDrv.sys [2012-3-1 13408]

    R2 AMD External Events Utility;AMD External Events Utility;C:\windows\System32\atiesrxx.exe [2011-12-27 204288]

    R2 AMD FUEL Service;AMD FUEL Service;C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [2011-12-15 361984]

    R2 cvhsvc;Client Virtualization Handler;C:\Program Files (x86)\Common Files\microsoft shared\Virtualization Handler\CVHSVC.EXE [2012-1-4 822624]

    R2 MBAMScheduler;MBAMScheduler;C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [2012-9-10 418376]

    R2 MBAMService;MBAMService;C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2012-9-10 701512]

    R2 NisDrv;Microsoft Network Inspection System;C:\windows\System32\drivers\NisDrvWFP.sys [2012-3-20 130008]

    R2 sftlist;Application Virtualization Client;C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe [2011-10-1 508776]

    R2 Updater By SweetPacks;Updater By SweetPacks;C:\Program Files\Updater By SweetPacks\ExtensionUpdaterService.exe [2013-4-16 188760]

    R3 ACPIVPC;Lenovo Virtual Power Controller Driver;C:\windows\System32\drivers\AcpiVpc.sys [2010-10-25 29792]

    R3 amdiox64;AMD IO Driver;C:\windows\System32\drivers\amdiox64.sys [2012-3-1 46136]

    R3 AtiHDAudioService;ATI Function Driver for HD Audio Service;C:\windows\System32\drivers\AtihdW76.sys [2011-12-27 115216]

    R3 clwvd;CyberLink WebCam Virtual Driver;C:\windows\System32\drivers\clwvd.sys [2011-1-28 31088]

    R3 MBAMProtector;MBAMProtector;C:\windows\System32\drivers\mbam.sys [2012-6-24 25928]

    R3 NisSrv;Microsoft Network Inspection;C:\Program Files\Microsoft Security Client\NisSrv.exe [2013-1-27 379360]

    R3 RSUSBVSTOR;RtsUVStor.Sys Realtek USB Card Reader;C:\windows\System32\drivers\rtsuvstor.sys [2012-3-1 307304]

    R3 RTL8167;Realtek 8167 NT Driver;C:\windows\System32\drivers\Rt64win7.sys [2012-3-1 333928]

    R3 S6000KNT;S6000KNT_WebCam Driver;C:\windows\System32\drivers\S6000KNT.sys [2012-3-1 3293272]

    R3 Sftfs;Sftfs;C:\windows\System32\drivers\Sftfslh.sys [2011-10-1 764264]

    R3 Sftplay;Sftplay;C:\windows\System32\drivers\Sftplaylh.sys [2011-10-1 268648]

    R3 Sftredir;Sftredir;C:\windows\System32\drivers\Sftredirlh.sys [2011-10-1 25960]

    R3 Sftvol;Sftvol;C:\windows\System32\drivers\Sftvollh.sys [2011-10-1 22376]

    R3 sftvsa;Application Virtualization Service Agent;C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe [2011-10-1 219496]

    R3 usbfilter;AMD USB Filter Driver;C:\windows\System32\drivers\usbfilter.sys [2012-3-1 53376]

    S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]

    S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-3-18 138576]

    S2 McAfee SiteAdvisor Service;McAfee SiteAdvisor Service;c:\PROGRA~2\mcafee\SITEAD~1\mcsacore.exe --> c:\PROGRA~2\mcafee\SITEAD~1\mcsacore.exe [?]

    S3 HP8207_8307;HP-HP8207_8307;C:\windows\System32\drivers\HP8207_8307.sys [2010-2-4 15360]

    S3 McComponentHostService;McAfee Security Scan Component Host Service;C:\Program Files (x86)\McAfee Security Scan\3.0.207\McCHSvc.exe [2011-6-17 237008]

    S3 TsUsbFlt;TsUsbFlt;C:\windows\System32\drivers\TsUsbFlt.sys [2010-11-20 59392]

    S3 TsUsbGD;Remote Desktop Generic USB Device;C:\windows\System32\drivers\TsUsbGD.sys [2010-11-20 31232]

    S3 WatAdminSvc;Windows Activation Technologies Service;C:\windows\System32\Wat\WatAdminSvc.exe [2012-6-21 1255736]

    S3 wsvd;wsvd;C:\windows\System32\drivers\wsvd.sys [2009-7-21 121840]

    S4 wlcrasvc;Windows Live Mesh remote connections service;C:\Program Files\Windows Live\Mesh\wlcrasvc.exe [2010-9-22 57184]

    .

    =============== Created Last 30 ================

    .

    2013-04-21 21:50:13 76232 ----a-w- C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{E23B0FA9-8524-40FE-997A-19A83EEF3C67}\offreg.dll

    2013-04-21 18:32:18 9317456 ----a-w- C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{E23B0FA9-8524-40FE-997A-19A83EEF3C67}\mpengine.dll

    2013-04-21 13:31:54 9317456 ------w- C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll

    2013-04-16 20:41:26 -------- d-----w- C:\Program Files (x86)\SweetIM

    2013-04-16 20:41:06 -------- d-----w- C:\Program Files\Updater By SweetPacks

    2013-04-11 21:20:01 26520 ----a-w- C:\Program Files (x86)\Mozilla Firefox\plugin-hang-ui.exe

    2013-04-11 20:30:32 2706432 ----a-w- C:\windows\SysWow64\mshtml.tlb

    2013-04-10 20:59:23 3717632 ----a-w- C:\windows\System32\mstscax.dll

    2013-04-03 20:35:43 226304 ----a-w- C:\windows\System32\elshyph.dll

    .

    ==================== Find3M ====================

    .

    2013-04-04 18:50:32 25928 ----a-w- C:\windows\System32\drivers\mbam.sys

    2013-04-02 10:34:28 282744 ------w- C:\windows\System32\MpSigStub.exe

    2013-03-19 06:04:06 5550424 ----a-w- C:\windows\System32\ntoskrnl.exe

    2013-03-19 05:46:56 43520 ----a-w- C:\windows\System32\csrsrv.dll

    2013-03-19 05:04:13 3968856 ----a-w- C:\windows\SysWow64\ntkrnlpa.exe

    2013-03-19 05:04:10 3913560 ----a-w- C:\windows\SysWow64\ntoskrnl.exe

    2013-03-19 04:47:50 6656 ----a-w- C:\windows\SysWow64\apisetschema.dll

    2013-03-19 03:06:33 112640 ----a-w- C:\windows\System32\smss.exe

    2013-03-12 23:44:18 73432 ----a-w- C:\windows\SysWow64\FlashPlayerCPLApp.cpl

    2013-03-12 23:44:18 693976 ----a-w- C:\windows\SysWow64\FlashPlayerApp.exe

    2013-03-05 01:18:44 95648 ----a-w- C:\windows\SysWow64\WindowsAccessBridge-32.dll

    2013-03-05 01:18:41 861088 ----a-w- C:\windows\SysWow64\npDeployJava1.dll

    2013-03-05 01:18:41 782240 ----a-w- C:\windows\SysWow64\deployJava1.dll

    2013-03-02 06:04:53 1655656 ----a-w- C:\windows\System32\drivers\ntfs.sys

    2013-03-01 03:36:04 3153408 ----a-w- C:\windows\System32\win32k.sys

    2013-02-21 10:30:16 1766912 ----a-w- C:\windows\SysWow64\wininet.dll

    2013-02-21 10:29:39 2877440 ----a-w- C:\windows\SysWow64\jscript9.dll

    2013-02-21 10:29:37 61440 ----a-w- C:\windows\SysWow64\iesetup.dll

    2013-02-21 10:29:37 109056 ----a-w- C:\windows\SysWow64\iesysprep.dll

    2013-02-21 10:15:07 2240512 ----a-w- C:\windows\System32\wininet.dll

    2013-02-21 10:14:09 3958784 ----a-w- C:\windows\System32\jscript9.dll

    2013-02-21 10:14:05 67072 ----a-w- C:\windows\System32\iesetup.dll

    2013-02-21 10:14:05 136704 ----a-w- C:\windows\System32\iesysprep.dll

    2013-02-19 11:42:14 2706432 ----a-w- C:\windows\System32\mshtml.tlb

    2013-02-19 11:10:53 71680 ----a-w- C:\windows\SysWow64\RegisterIEPKEYs.exe

    2013-02-19 10:51:18 89600 ----a-w- C:\windows\System32\RegisterIEPKEYs.exe

    2013-02-15 06:08:40 44032 ----a-w- C:\windows\System32\tsgqec.dll

    2013-02-15 06:02:26 158720 ----a-w- C:\windows\System32\aaclient.dll

    2013-02-15 04:37:10 3217408 ----a-w- C:\windows\SysWow64\mstscax.dll

    2013-02-15 04:34:10 131584 ----a-w- C:\windows\SysWow64\aaclient.dll

    2013-02-15 03:25:51 36864 ----a-w- C:\windows\SysWow64\tsgqec.dll

    2013-02-12 05:45:24 135168 ----a-w- C:\windows\apppatch\AppPatch64\AcXtrnal.dll

    2013-02-12 05:45:22 350208 ----a-w- C:\windows\apppatch\AppPatch64\AcLayers.dll

    2013-02-12 05:45:22 308736 ----a-w- C:\windows\apppatch\AppPatch64\AcGenral.dll

    2013-02-12 05:45:22 111104 ----a-w- C:\windows\apppatch\AppPatch64\acspecfc.dll

    2013-02-12 04:48:31 474112 ----a-w- C:\windows\apppatch\AcSpecfc.dll

    2013-02-12 04:48:26 2176512 ----a-w- C:\windows\apppatch\AcGenral.dll

    2013-02-12 04:12:05 19968 ----a-w- C:\windows\System32\drivers\usb8023.sys

    2013-01-24 06:01:01 223752 ----a-w- C:\windows\System32\drivers\fvevol.sys

    .

    ============= FINISH: 18:05:05.11 ===============

    .

    UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.

    IF REQUESTED, ZIP IT UP & ATTACH IT

    .

    DDS (Ver_2012-11-20.01)

    .

    Microsoft Windows 7 Home Premium

    Boot Device: \Device\HarddiskVolume1

    Install Date: 6/20/2012 6:51:41 AM

    System Uptime: 4/19/2013 3:02:29 PM (51 hours ago)

    .

    Motherboard: LENOVO | | Torpedo

    Processor: AMD A4-3300M APU with Radeon HD Graphics | Socket FS1 | 798/100mhz

    .

    ==== Disk Partitions =========================

    .

    C: is FIXED (NTFS) - 422 GiB total, 378.705 GiB free.

    D: is FIXED (NTFS) - 29 GiB total, 26.882 GiB free.

    F: is CDROM (CDFS)

    .

    ==== Disabled Device Manager Items =============

    .

    Class GUID: {4d36e971-e325-11ce-bfc1-08002be10318}

    Description: Photosmart C4700 series

    Device ID: ROOT\MULTIFUNCTION\0000

    Manufacturer: HP

    Name: Photosmart C4700 series

    PNP Device ID: ROOT\MULTIFUNCTION\0000

    Service:

    .

    ==== System Restore Points ===================

    .

    RP98: 3/17/2013 2:14:22 PM - Windows Update

    RP99: 3/21/2013 5:52:59 PM - Windows Update

    RP100: 3/21/2013 10:59:17 PM - Windows Update

    RP101: 3/25/2013 4:35:33 PM - Windows Update

    RP102: 3/29/2013 9:21:51 AM - Windows Update

    RP103: 4/1/2013 4:43:52 PM - Windows Update

    RP105: 4/3/2013 4:33:35 PM - Windows Modules Installer

    RP108: 4/5/2013 8:15:28 PM - Windows Update

    RP109: 4/10/2013 5:02:44 PM - Windows Update

    RP111: 4/11/2013 4:29:00 PM - Windows Modules Installer

    RP112: 4/13/2013 8:36:10 PM - Windows Update

    RP113: 4/17/2013 4:43:22 PM - Windows Update

    RP114: 4/21/2013 9:31:19 AM - Windows Update

    RP115: 4/21/2013 5:42:23 PM - Removed Kodu Game Lab

    .

    ==== Installed Programs ======================

    .

    64 Bit HP CIO Components Installer

    Adobe Flash Player 11 Plugin

    Adobe Reader X (10.1.5)

    Adobe Shockwave Player 11.6

    AMD APP SDK Runtime

    AMD AVIVO64 Codecs

    AMD Catalyst Install Manager

    AMD Fuel

    AMD Media Foundation Decoders

    AMD Steady Video Plug-In

    AMD VISION Engine Control Center

    Atheros Client Installation Program

    BufferChm

    C4700

    Catalyst Control Center - Branding

    Catalyst Control Center Graphics Previews Common

    Catalyst Control Center InstallProxy

    Catalyst Control Center Localization All

    Catalyst Control Center Profiles Mobile

    ccc-utility64

    CCC Help Chinese Standard

    CCC Help Chinese Traditional

    CCC Help Czech

    CCC Help Danish

    CCC Help Dutch

    CCC Help English

    CCC Help Finnish

    CCC Help French

    CCC Help German

    CCC Help Greek

    CCC Help Hungarian

    CCC Help Italian

    CCC Help Japanese

    CCC Help Korean

    CCC Help Norwegian

    CCC Help Polish

    CCC Help Portuguese

    CCC Help Russian

    CCC Help Spanish

    CCC Help Swedish

    CCC Help Thai

    CCC Help Turkish

    Coupon Printer for Windows

    D3DX10

    Definition Update for Microsoft Office 2010 (KB982726) 32-Bit Edition

    Destinations

    DeviceDiscovery

    Energy Management

    Google Chrome

    Google Toolbar for Internet Explorer

    Google Update Helper

    GPBaseService2

    HP Customer Participation Program 14.0

    HP Imaging Device Functions 14.0

    HP Photo Creations

    HP Photosmart C4700 All-in-One Driver Software 14.0 Rel. 6

    HP Smart Web Printing 4.60

    HP Solution Center 14.0

    HP Update

    HPPhotoGadget

    HPProductAssistant

    HPSSupply

    Internet Explorer Toolbar 4.7 by SweetPacks

    Java 7 Update 17

    Java Auto Updater

    JavaFX 2.1.1

    JumpStart Typing

    Junk Mail filter update

    Kodu Game Lab

    Lenovo EasyCamera

    Lenovo EE Boot Optimizer

    Lenovo Games Console

    Lenovo OneKey Recovery

    Lenovo YouCam

    Malwarebytes Anti-Malware version 1.75.0.1300

    MarketResearch

    McAfee Security Scan Plus

    Mesh Runtime

    Microsoft .NET Framework 4 Client Profile

    Microsoft Application Error Reporting

    Microsoft Office 2010 Service Pack 1 (SP1)

    Microsoft Office Access MUI (English) 2010

    Microsoft Office Access Setup Metadata MUI (English) 2010

    Microsoft Office Click-to-Run 2010

    Microsoft Office Excel MUI (English) 2010

    Microsoft Office Home and Student 2010

    Microsoft Office Office 64-bit Components 2010

    Microsoft Office OneNote MUI (English) 2010

    Microsoft Office Outlook MUI (English) 2010

    Microsoft Office PowerPoint MUI (English) 2010

    Microsoft Office Proof (English) 2010

    Microsoft Office Proof (French) 2010

    Microsoft Office Proof (Spanish) 2010

    Microsoft Office Proofing (English) 2010

    Microsoft Office Publisher MUI (English) 2010

    Microsoft Office Shared 64-bit MUI (English) 2010

    Microsoft Office Shared 64-bit Setup Metadata MUI (English) 2010

    Microsoft Office Shared MUI (English) 2010

    Microsoft Office Shared Setup Metadata MUI (English) 2010

    Microsoft Office Single Image 2010

    Microsoft Office Word MUI (English) 2010

    Microsoft Security Client

    Microsoft Security Essentials

    Microsoft Silverlight

    Microsoft SQL Server 2005 Compact Edition [ENU]

    Microsoft Visual C++ 2005 Redistributable

    Microsoft Visual C++ 2010 x64 Redistributable - 10.0.30319

    Microsoft Visual C++ 2010 x86 Redistributable - 10.0.30319

    Microsoft XNA Framework Redistributable 3.1

    Mozilla Firefox 20.0.1 (x86 en-US)

    Mozilla Maintenance Service

    MSVCRT

    MSVCRT_amd64

    MSXML 4.0 SP2 (KB954430)

    MSXML 4.0 SP2 (KB973688)

    Network64

    Onekey Theater

    ooVoo

    Power2Go

    PowerXpressHybrid

    PS_AIO_06_C4700_SW_Min

    QuickTime

    QuickTransfer

    Realtek Ethernet Controller Driver For Windows 7

    Realtek High Definition Audio Driver

    Realtek USB 2.0 Reader Driver

    Scan

    Security Update for Microsoft .NET Framework 4 Client Profile (KB2604121)

    Security Update for Microsoft .NET Framework 4 Client Profile (KB2656351)

    Security Update for Microsoft .NET Framework 4 Client Profile (KB2656368v2)

    Security Update for Microsoft .NET Framework 4 Client Profile (KB2656405)

    Security Update for Microsoft .NET Framework 4 Client Profile (KB2686827)

    Security Update for Microsoft .NET Framework 4 Client Profile (KB2729449)

    Security Update for Microsoft .NET Framework 4 Client Profile (KB2737019)

    Security Update for Microsoft .NET Framework 4 Client Profile (KB2742595)

    Security Update for Microsoft .NET Framework 4 Client Profile (KB2789642)

    Security Update for Microsoft Excel 2010 (KB2597126) 32-Bit Edition

    Security Update for Microsoft Filter Pack 2.0 (KB2553501) 32-Bit Edition

    Security Update for Microsoft InfoPath 2010 (KB2760406) 32-Bit Edition

    Security Update for Microsoft Office 2010 (KB2553091)

    Security Update for Microsoft Office 2010 (KB2553096)

    Security Update for Microsoft Office 2010 (KB2553371) 32-Bit Edition

    Security Update for Microsoft Office 2010 (KB2553447) 32-Bit Edition

    Security Update for Microsoft Office 2010 (KB2589320) 32-Bit Edition

    Security Update for Microsoft Office 2010 (KB2598243) 32-Bit Edition

    Security Update for Microsoft Office 2010 (KB2687501) 32-Bit Edition

    Security Update for Microsoft Office 2010 (KB2687510) 32-Bit Edition

    Security Update for Microsoft OneNote 2010 (KB2760600) 32-Bit Edition

    Security Update for Microsoft Visio Viewer 2010 (KB2687505) 32-Bit Edition

    Security Update for Microsoft Word 2010 (KB2760410) 32-Bit Edition

    Shop for HP Supplies

    SmartWebPrinting

    SolutionCenter

    SRS Control Panel

    Status

    swMSM

    Synaptics Pointing Device Driver

    Toolbox

    TrayApp

    Update for Microsoft .NET Framework 4 Client Profile (KB2468871)

    Update for Microsoft .NET Framework 4 Client Profile (KB2533523)

    Update for Microsoft .NET Framework 4 Client Profile (KB2600217)

    Update for Microsoft Office 2010 (KB2553065)

    Update for Microsoft Office 2010 (KB2553181) 32-Bit Edition

    Update for Microsoft Office 2010 (KB2553267) 32-Bit Edition

    Update for Microsoft Office 2010 (KB2553310) 32-Bit Edition

    Update for Microsoft Office 2010 (KB2553378) 32-Bit Edition

    Update for Microsoft Office 2010 (KB2566458)

    Update for Microsoft Office 2010 (KB2596964) 32-Bit Edition

    Update for Microsoft Office 2010 (KB2598242) 32-Bit Edition

    Update for Microsoft Office 2010 (KB2687503) 32-Bit Edition

    Update for Microsoft Office 2010 (KB2687509) 32-Bit Edition

    Update for Microsoft Office 2010 (KB2760631) 32-Bit Edition

    Update for Microsoft Office 2010 (KB2767886) 32-Bit Edition

    Update for Microsoft OneNote 2010 (KB2553290) 32-Bit Edition

    Update for Microsoft Outlook 2010 (KB2597090) 32-Bit Edition

    Update for Microsoft Outlook 2010 (KB2687623) 32-Bit Edition

    Update for Microsoft Outlook Social Connector 2010 (KB2553406) 32-Bit Edition

    Update for Microsoft PowerPoint 2010 (KB2598240) 32-Bit Edition

    Update for Microsoft SharePoint Workspace 2010 (KB2589371) 32-Bit Edition

    Updater By SweetPacks 2.0.0.566

    UserGuide

    VeriFace

    WebReg

    Windows Driver Package - Lenovo (ACPIVPC) System (12/02/2010 6.1.0.1)

    Windows Live Communications Platform

    Windows Live Essentials

    Windows Live ID Sign-in Assistant

    Windows Live Installer

    Windows Live Language Selector

    Windows Live Mail

    Windows Live Mesh

    Windows Live Mesh ActiveX Control for Remote Connections

    Windows Live Messenger

    Windows Live MIME IFilter

    Windows Live Movie Maker

    Windows Live Photo Common

    Windows Live Photo Gallery

    Windows Live PIMT Platform

    Windows Live Remote Client

    Windows Live Remote Client Resources

    Windows Live Remote Service

    Windows Live Remote Service Resources

    Windows Live SOXE

    Windows Live SOXE Definitions

    Windows Live UX Platform

    Windows Live UX Platform Language Pack

    Windows Live Writer

    Windows Live Writer Resources

    Yahoo! Toolbar

    .

    ==== Event Viewer Messages From Past Week ========

    .

    4/17/2013 2:12:21 AM, Error: Service Control Manager [7034] - The Google Update Service (gupdate) service terminated unexpectedly. It has done this 1 time(s).

    .

    ==== End Of File ===========================

    Thanks

    Airplane Ride

    in Tailwaggers and Jokes

    Posted

    His request approved, the CNN News photographer quickly used a cell phone to call the local airport to charter a flight. He was told a twin-engine plane would be waiting for him at the airport.

    Arriving at the airfield, he spotted a plane warming up outside a hanger. He jumped in with his bag, slammed the door shut, and shouted, 'Let's go'.

    The pilot taxied out, swung the plane into the wind and took off.

    Once in the air, the photographer instructed the pilot, 'Fly over the valley and make low passes so I can take pictures of the fires on the hillsides.'

    'Why?' asked the pilot.

    'Because I'm a photographer for CNN' , he responded, 'and I need to get some close up shots.'

    The pilot was strangely silent for a moment, finally he stammered,

    'So, what you're telling me, is . . . You're NOT my flight instructor?

    The Higgs Boson particle exists!

    in General Chat

    Posted

    Yes they are quite excited but not sure if that information will actually translate into any direct useful information to be applied to current science and medicine fields or not. I suppose in time we'll see.

    I agree. I think that any advancements made through knowledge of Higgs Boson might not influence technology until much later, but in theoretical and experimental physics it is likely to reveal more information that should translate into direct benefits for the general public.

    The Higgs Boson particle exists!

    in General Chat

    Posted

    In a discovery that throws light on the very fabric of space and time, a new subatomic particle has been found that is consistent with the long-sought-after Higgs boson.

    Making one of the most anticipated announcements in modern science tonight, researchers using the world's biggest atom smasher near Geneva announced they had observed the new particle in collisions in the giant instrument.

    "We have reached a milestone in our understanding of nature," Rolf Heuer, director general of CERN" said.

    More studies, however, will be needed to pin down the exact nature of the boson, which is the most massive ever seen, scientist said.

    ...

    Researchers using two huge detectors at the Large Hadron Collider announced the results of their searches at a joint scientific seminar in Geneva and Melbourne, where the International Conference on High Energy Physics is being held.

    The two teams had been blinded to each other's data, to avoid influencing their independent analyses.

    They each found strong evidence for the existence of a particle with a mass of 125-126 gigaelectronvolts – about 130 times the mass of a proton.

    Read more: Confirmed: the Higgs boson does exist

    This is exciting news in the world of physics! We now have a better understanding about the very nature of everything. This is a pretty surprising breakthrough and I predict that we will, at some point, be able to discover or even build a lot with this knowledge in hand.

Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.