Jump to content

UUU.UUU and XXX.XXX

Legendkilla023
 Share

Recommended Posts

Legendkilla023

Legendkilla023

Posted
Posted

I'm having trouble removing these two foul viruses... It seems i've been hit pretttyyyyy hard and trying to clear everything up...

here is the report

Malwarebytes Anti-Malware (Trial) 1.62.0.1300

www.malwarebytes.org

Database version: v2012.07.24.12

Windows 7 Service Pack 1 x64 NTFS

Internet Explorer 8.0.7601.17514

Home :: LEGENDKILLA023 [administrator]

Protection: Enabled

7/24/2012 10:27:46 PM

mbam-log-2012-07-24 (22-27-46).txt

Scan type: Quick scan

Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM

Scan options disabled: P2P

Objects scanned: 245621

Time elapsed: 16 minute(s), 23 second(s)

Memory Processes Detected: 11

C:\Users\Home\AppData\Roaming\Microsoft\Windows\Templates\MFC110D.exe (Trojan.FakeMS) -> 3128 -> Delete on reboot.

C:\Users\Home\AppData\Local\Temp\iprtrmgr.exe (Backdoor.Bot) -> 3636 -> Delete on reboot.

C:\Users\Home\Documents\DCSCMIN\IMDCSC.exe (Backdoor.Agent.DCRSAGen) -> 3372 -> Delete on reboot.

C:\Users\Home\AppData\Roaming\svchost.exe (Trojan.Agent) -> 4064 -> Delete on reboot.

C:\Users\Home\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\25011.exe (Trojan.MSIL.Gen) -> 4184 -> Delete on reboot.

C:\Users\Home\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\52801.exe (Trojan.MSIL.Gen) -> 4200 -> Delete on reboot.

C:\Users\Home\AppData\Roaming\taskmgr.exe (Trojan.Agent) -> 5580 -> Delete on reboot.

C:\Users\Home\AppData\Roaming\csrss.exe (Trojan.Agent) -> 5064 -> Delete on reboot.

C:\Users\Home\AppData\Roaming\svhost.exe (Trojan.Agent) -> 4344 -> Delete on reboot.

C:\Users\Home\AppData\Roaming\FacebookVideoCall.exe (Trojan.Agent.Gen) -> 4112 -> Delete on reboot.

C:\Users\Home\AppData\Roaming\Microsoft\sysBackup.exe (Trojan.Agent) -> 1600 -> Delete on reboot.

Memory Modules Detected: 0

(No malicious items detected)

Registry Keys Detected: 35

HKCR\CLSID\{147A976F-EEE1-4377-8EA7-4716E4CDD239} (PUP.MyWebSearch) -> No action taken.

HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{00A6FAF1-072E-44CF-8957-5838F569A31D} (PUP.MyWebSearch) -> No action taken.

HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{00A6FAF1-072E-44CF-8957-5838F569A31D} (PUP.MyWebSearch) -> No action taken.

HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{07B18EA1-A523-4961-B6BB-170DE4475CCA} (PUP.MyWebSearch) -> No action taken.

HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{07B18EA1-A523-4961-B6BB-170DE4475CCA} (PUP.MyWebSearch) -> No action taken.

HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{07B18EA9-A523-4961-B6BB-170DE4475CCA} (PUP.MyWebSearch) -> No action taken.

HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{07B18EA9-A523-4961-B6BB-170DE4475CCA} (PUP.MyWebSearch) -> No action taken.

HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{07B18EAB-A523-4961-B6BB-170DE4475CCA} (PUP.MyWebSearch) -> No action taken.

HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{00A6FAF6-072E-44CF-8957-5838F569A31D} (PUP.MyWebSearch) -> No action taken.

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{1D4DB7D2-6EC9-47a3-BD87-1E41684E07BB} (PUP.MyWebSearch) -> No action taken.

HKLM\SOFTWARE\Google\Chrome\Extensions\mpfapcdfbbledbojijcbcclmlieaoogk (PUP.GamesPlayLab) -> No action taken.

HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\RunDll32Policy\f3ScrCtr.dll (PUP.MyWebSearch) -> No action taken.

HKLM\SOFTWARE\Microsoft\Multimedia\WMPlayer\Schemes\f3pss (PUP.MyWebSearch) -> No action taken.

HKLM\SOFTWARE\Wow6432Node\Google\Chrome\Extensions\mpfapcdfbbledbojijcbcclmlieaoogk (PUP.GamesPlayLab) -> No action taken.

HKCU\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{56256A51-B582-467e-B8D4-7786EDA79AE0} (Trojan.Vundo) -> Quarantined and deleted successfully.

HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{56256A51-B582-467e-B8D4-7786EDA79AE0} (Trojan.Vundo) -> Quarantined and deleted successfully.

HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{100EB1FD-D03E-47FD-81F3-EE91287F9465} (Adware.ShopperReports) -> Quarantined and deleted successfully.

HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{A7CDDCDC-BEEB-4685-A062-978F5E07CEEE} (Adware.ShopperReports) -> Quarantined and deleted successfully.

HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{11111111-1111-1111-1111-110011221158} (Adware.GamePlayLab) -> Quarantined and deleted successfully.

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{11111111-1111-1111-1111-110011221158} (Adware.GamePlayLab) -> Quarantined and deleted successfully.

HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A078F691-9C07-4AF2-BF43-35E79EECF8B7} (Adware.Softomate) -> Quarantined and deleted successfully.

HKCR\CLSID\{48CBEAF2-A5D5-FDD6-A491-AD4DF9E0CB5B} (Trojan.Agent.Gen) -> Quarantined and deleted successfully.

HKCU\SOFTWARE\Microsoft\Active Setup\Installed Components\{48CBEAF2-A5D5-FDD6-A491-AD4DF9E0CB5B} (Trojan.Agent.Gen) -> Quarantined and deleted successfully.

HKCU\SOFTWARE\CE8SIIFGSU (Trojan.FakeAlert) -> Quarantined and deleted successfully.

HKCU\SOFTWARE\Cerberus (Backdoor.Trace) -> Quarantined and deleted successfully.

HKCU\SOFTWARE\NtWqIVLZEWZU (Trojan.FakeAlert) -> Quarantined and deleted successfully.

HKCU\SOFTWARE\XML (Trojan.FakeAlert) -> Quarantined and deleted successfully.

HKCU\Software\DC3_FEXEC (Malware.Trace) -> Quarantined and deleted successfully.

HKCU\Software\Cr_Installer\2258 (Adware.GamePlayLab) -> Quarantined and deleted successfully.

HKCU\SOFTWARE\CYBER (Backdoor.Trace) -> Quarantined and deleted successfully.

HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\ (Hijack.Zones) -> Quarantined and deleted successfully.

HKCU\Software\VB and VBA Program Settings\SrvID (Malware.Trace) -> Quarantined and deleted successfully.

HKLM\SOFTWARE\QuestBrowse (Adware.QuestBrowse) -> Quarantined and deleted successfully.

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\QuestBrowse (Adware.QuestBrowse) -> Quarantined and deleted successfully.

HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\I WANT THIS (Adware.GamePlayLab) -> Quarantined and deleted successfully.

Registry Values Detected: 23

HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run|Microsoft® Windows® Operating System (Trojan.FakeMS) -> Data: C:\Users\Home\AppData\Roaming\Microsoft\Windows\Templates\MFC110D.exe -> Quarantined and deleted successfully.

HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run|DarkComet RAT (Backdoor.Agent.DCRSAGen) -> Data: C:\Users\Home\Documents\DCSCMIN\IMDCSC.exe -> Quarantined and deleted successfully.

HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run|Nhdkdx (Trojan.VBKrypt) -> Data: C:\Users\Home\AppData\Roaming\Nhdkdx.exe -> Quarantined and deleted successfully.

HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run|muteysexymylul (Trojan.Agent) -> Data: "C:\Users\Home\AppData\Roaming\svchost.exe" -> Quarantined and deleted successfully.

HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run|mutemelol (Trojan.Agent) -> Data: "C:\Users\Home\AppData\Roaming\svchost.exe" -> Quarantined and deleted successfully.

HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run|Windows Defender (Trojan.Agent.Gen) -> Data: C:\Users\Home\AppData\Roaming\WinDefender.exe -> Quarantined and deleted successfully.

HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run|Win Update (Backdoor.Agent) -> Data: C:\Users\Home\AppData\Roaming\Win Update.exe -> Quarantined and deleted successfully.

HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run|csrss.exe (Trojan.Agent) -> Data: "C:\Users\Home\AppData\Roaming\csrss.exe" -> Quarantined and deleted successfully.

HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run|afrriiii (Trojan.Agent) -> Data: "C:\Users\Home\AppData\Roaming\csrss.exe" -> Quarantined and deleted successfully.

HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run|svhost.exe (Trojan.Agent) -> Data: "C:\Users\Home\AppData\Roaming\svhost.exe" -> Quarantined and deleted successfully.

HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run|egregregerfwde (Trojan.Agent) -> Data: "C:\Users\Home\AppData\Roaming\svhost.exe" -> Quarantined and deleted successfully.

HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run|MicroUpdate (Backdoor.Agent.DC) -> Data: C:\Users\Home\Documents\MSDCSC\msdcsc.exe -> Quarantined and deleted successfully.

HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run|KuzeKey (Trojan.Agent.Gen) -> Data: C:\Users\Home\AppData\Roaming\FacebookVideoCall.exe -> Quarantined and deleted successfully.

HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run|crss (Trojan.Agent) -> Data: C:\Users\Home\AppData\Roaming\Microsoft\sysBackup.exe -> Quarantined and deleted successfully.

HKCU\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows|Load (Trojan.Ransom) -> Data: C:\Users\Home\LOCALS~1\Temp\mszwcu.cmd -> Delete on reboot.

HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run|HKCU (Backdoor.HMCPol.Gen) -> Data: C:\Users\Home\AppData\Local\Temp\12er4.exe -> Quarantined and deleted successfully.

HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run|NetWeaveClient (Trojan.Agent) -> Data: C:\Users\Home\AppData\Roaming\NetWeave\Client\Client.exe -> Quarantined and deleted successfully.

HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run|Microsoft Windows (Backdoor.IRCBot) -> Data: C:\Users\Home\AppData\Roaming\services.exe -> Quarantined and deleted successfully.

HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run|svchost.exe (Backdoor.Bot) -> Data: C:\Windows\system32\DCSCMIN\EQfqgASpvJAe\IMDCSC.exe -> Quarantined and deleted successfully.

HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run|adobeupdate (Trojan.Agent) -> Data: "C:\Users\Home\AppData\Roaming\bt99.lnk" -> Quarantined and deleted successfully.

HKCU\Software\Cyber|FirstExecution (Backdoor.Trace) -> Data: 02/09/2011 -- 17:26 -> Quarantined and deleted successfully.

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\I Want This|Publisher (Adware.GamePlayLab) -> Data: 215 Apps -> Quarantined and deleted successfully.

HKLM\SOFTWARE\Mozilla\Firefox\extensions|ClickPotatoLite@ClickPotatoLite.com (Adware.ClickPotato) -> Data: C:\Program Files (x86)\ClickPotatoLite\bin\10.0.659.0\firefox\extensions -> Quarantined and deleted successfully.

Registry Data Items Detected: 2

HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer|NoRun (PUM.Hijack.Run) -> Bad: (1) Good: (0) -> Quarantined and repaired successfully.

HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System|DisableRegistryTools (PUM.Hijack.Regedit) -> Bad: (1) Good: (0) -> Quarantined and repaired successfully.

Folders Detected: 18

C:\Users\Sadeeeee !\AppData\Roaming\Mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384}\textlinks@playsushi.com (PUP.PlaySushi) -> No action taken.

C:\Users\Sadeeeee !\AppData\Roaming\Mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384}\textlinks@playsushi.com\chrome (PUP.PlaySushi) -> No action taken.

C:\Users\Sadeeeee !\AppData\Roaming\Mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384}\textlinks@playsushi.com\components (PUP.PlaySushi) -> No action taken.

C:\Users\Home\AppData\Roaming\dclogs (Stolen.Data) -> Quarantined and deleted successfully.

C:\Users\Sadeeeee !\AppData\Roaming\ClickPotatoLite (Adware.ClickPotato) -> Quarantined and deleted successfully.

C:\Users\Sadeeeee !\AppData\Roaming\ShopperReports3 (Adware.ShopperReports) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\WinDefender (Rogue.WinDefender) -> Quarantined and deleted successfully.

C:\cleansweep.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\ProgramData\QuestBrowse (Adware.QuestBrowse) -> Quarantined and deleted successfully.

C:\Program Files (x86)\QuestBrowse (Adware.QuestBrowse) -> Quarantined and deleted successfully.

C:\Program Files (x86)\Mozilla Firefox\extensions\{D9ADB0A8-7BFB-498D-9880-EE78A81CCFA0} (Adware.QuestBrowse) -> Quarantined and deleted successfully.

C:\Program Files (x86)\Mozilla Firefox\extensions\{D9ADB0A8-7BFB-498D-9880-EE78A81CCFA0}\chrome (Adware.QuestBrowse) -> Quarantined and deleted successfully.

C:\Program Files (x86)\Mozilla Firefox\extensions\{D9ADB0A8-7BFB-498D-9880-EE78A81CCFA0}\defaults (Adware.QuestBrowse) -> Quarantined and deleted successfully.

C:\Program Files (x86)\Mozilla Firefox\extensions\{D9ADB0A8-7BFB-498D-9880-EE78A81CCFA0}\defaults\preferences (Adware.QuestBrowse) -> Quarantined and deleted successfully.

C:\Users\Home\Local Settings\Application Data\I Want This (Adware.GamePlayLab) -> Quarantined and deleted successfully.

C:\Users\Home\Local Settings\Application Data\I Want This\Chrome (Adware.GamePlayLab) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Local\I Want This (Adware.GamePlayLab) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Local\I Want This\Chrome (Adware.GamePlayLab) -> Quarantined and deleted successfully.

Files Detected: 423

C:\Users\Home\Downloads\mplayer_Setup (1).exe (PUP.Bundle.Installer.OI) -> No action taken.

C:\Users\Home\Downloads\mplayer_Setup (2).exe (PUP.Bundle.Installer.OI) -> No action taken.

C:\Users\Home\Downloads\mplayer_Setup.exe (PUP.Bundle.Installer.OI) -> No action taken.

C:\Users\Home\Downloads\setup (1).exe (PUP.BundleInstaller.VG) -> No action taken.

C:\Users\Home\Downloads\setup.exe (PUP.BundleInstaller.VG) -> No action taken.

C:\Users\Sadeeeee !\Downloads\IWON.exe (PUP.FunWebProducts) -> No action taken.

C:\Users\Sadeeeee !\AppData\Roaming\Mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384}\textlinks@playsushi.com\chrome.manifest (PUP.PlaySushi) -> No action taken.

C:\Users\Sadeeeee !\AppData\Roaming\Mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384}\textlinks@playsushi.com\install.rdf (PUP.PlaySushi) -> No action taken.

C:\Users\Sadeeeee !\AppData\Roaming\Mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384}\textlinks@playsushi.com\chrome\pstextlinks.jar (PUP.PlaySushi) -> No action taken.

C:\Users\Sadeeeee !\AppData\Roaming\Mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384}\textlinks@playsushi.com\components\PlaySushiFF.dll (PUP.PlaySushi) -> No action taken.

C:\Users\Sadeeeee !\AppData\Roaming\Mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384}\textlinks@playsushi.com\components\PlaySushiFF.xpt (PUP.PlaySushi) -> No action taken.

C:\Users\Home\AppData\Roaming\Microsoft\Windows\Templates\MFC110D.exe (Trojan.FakeMS) -> Delete on reboot.

C:\Users\Home\AppData\Local\Temp\iprtrmgr.exe (Backdoor.Bot) -> Delete on reboot.

C:\Users\Home\Documents\DCSCMIN\IMDCSC.exe (Backdoor.Agent.DCRSAGen) -> Delete on reboot.

C:\Users\Home\AppData\Roaming\Nhdkdx.exe (Trojan.VBKrypt) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\10112271635757.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\120793246416827.exe (Backdoor.Bot) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\13082989427741.exe (Backdoor.Agent.DCRSAGen) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\13114147555544.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\168833147932684.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\194266257141.exe (Backdoor.Bot) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\2091231963694.exe (Backdoor.Agent.DCRSAGen) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\21517556423184.exe (Backdoor.Agent.DCRSAGen) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\29272129262679.exe (Backdoor.Bot) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\29474205315800.exe (Backdoor.Agent.DCRSAGen) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\300052567128200.exe (Backdoor.Agent.DCRSAGen) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\595017776820.exe (Backdoor.Agent.DCRSAGen) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\winappp.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Local\Temp\C1B8.tmp (Trojan.VBKrypt) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Local\Temp\CBE6.tmp (Trojan.VBKrypt) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Local\Temp\Tmp5975.exe (Heuristics.Shuriken) -> Quarantined and deleted successfully.

C:\Users\Home\Templates\MFC110D.exe (Trojan.Agent) -> Delete on reboot.

C:\Users\Home\AppData\Roaming\115explorer.exe (Backdoor.Messa) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\138explorer.exe (Backdoor.Messa) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\151explorer.exe (Backdoor.Messa) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\260explorer.exe (Backdoor.Messa) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\497explorer.exe (Backdoor.Messa) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\679explorer.exe (Backdoor.Messa) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\735explorer.exe (Backdoor.Messa) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\972explorer.exe (Backdoor.Messa) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\svchost.exe (Trojan.Agent) -> Delete on reboot.

C:\Users\Home\AppData\Roaming\system.exe (Trojan.Agent.Gen) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\WinDefender.exe (Trojan.Agent.Gen) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\25011.exe (Trojan.MSIL.Gen) -> Delete on reboot.

C:\Users\Home\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\52801.exe (Trojan.MSIL.Gen) -> Delete on reboot.

C:\Users\Home\AppData\Roaming\iexplore.exe (Trojan.Agent.Gen) -> Quarantined and deleted successfully.

C:\Users\Home\Templates\explorer.exe (Backdoor.MSIL) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\taskmgr.exe (Trojan.Agent) -> Delete on reboot.

C:\Users\Home\AppData\Roaming\10352312217620.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\109132238218383.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\119562436032587.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\1273369314495.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\13878253463853.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\1397568731297.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\146012208922991.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\147432328232215.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\148451792231600.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\14890188513395.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\15517103243954.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\16177458212185.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\169010518661.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\1707567313797.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\17536418022822.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\18007116816451.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\19902325566199.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\207577454389.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\211221164721788.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\218951137230348.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\22045254405175.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\22503726121984.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\233181058723866.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\241052016131076.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\24167115441074.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\263722575828034.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\26543726023044.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\270361153030810.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\273863023528840.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\27776372679.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\28319251323684.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\306693048523875.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\313911303027773.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\32118335314430.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\36073232220109.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\369119538991.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\405316727673.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\49171276315460.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\53571443317470.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\64282807129225.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\6513979715889.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\7242190798084.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\73001725528518.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\81323007117331.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\8690269736344.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\8722402929085.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\89903234111087.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\98123231820313.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\992521325162.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\16074.exe (Rogue.Agent.Gen) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\23711.exe (Rogue.Agent.Gen) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\26123.exe (Rogue.Agent.Gen) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\28740.exe (Rogue.Agent.Gen) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\31225.exe (Rogue.Agent.Gen) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\35688.exe (Rogue.Agent.Gen) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\41032.exe (Rogue.Agent.Gen) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\46958.exe (Rogue.Agent.Gen) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\48057.exe (Rogue.Agent.Gen) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\50715.exe (Rogue.Agent.Gen) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\54513.exe (Rogue.Agent.Gen) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\55425.exe (Rogue.Agent.Gen) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\57253.exe (Rogue.Agent.Gen) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\64497.exe (Rogue.Agent.Gen) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\71035.exe (Rogue.Agent.Gen) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\73371.exe (Rogue.Agent.Gen) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\78911.exe (Rogue.Agent.Gen) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\90554.exe (Rogue.Agent.Gen) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\92052.exe (Rogue.Agent.Gen) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\92600.exe (Rogue.Agent.Gen) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\97092.exe (Rogue.Agent.Gen) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\Win Update.exe (Backdoor.Agent) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\cglogs.dat (Malware.Trace) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\csrss.exe (Trojan.Agent) -> Delete on reboot.

C:\Users\Home\AppData\Roaming\data.dat (Stolen.Data) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\logs.dat (Bifrose.Trace) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\svhost.exe (Trojan.Agent) -> Delete on reboot.

C:\Users\Home\AppData\Local\Temp\UuU.uUu (Malware.Trace) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Local\Temp\XxX.xXx (Malware.Trace) -> Quarantined and deleted successfully.

C:\Windows\Tasks\{BBAEAEAF-1275-40e2-BD6C-BC8F88BD114A}.job (Trojan.Downloader) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\bot.exe (Backdoor.Agent.Gen) -> Quarantined and deleted successfully.

C:\Users\Home\Templates\cdkeys.txt (Stolen.Data) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\install\iexplorer.exe (Backdoor.SpyNet) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\firefox.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\byte.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\Crypted.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\cg.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Home\Documents\MSDCSC\msdcsc.exe (Backdoor.Agent.DC) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\FacebookVideoCall.exe (Trojan.Agent.Gen) -> Delete on reboot.

C:\Users\Home\My Documents\MSDCSC\msdcsc.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\dclogs\2012-06-25-2.dc (Stolen.Data) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\dclogs\2012-06-26-3.dc (Stolen.Data) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\dclogs\2012-07-01-1.dc (Stolen.Data) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\dclogs\2012-07-03-3.dc (Stolen.Data) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\dclogs\2012-07-04-4.dc (Stolen.Data) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\dclogs\2012-07-08-1.dc (Stolen.Data) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\dclogs\2012-07-09-2.dc (Stolen.Data) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\dclogs\2012-07-10-3.dc (Stolen.Data) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\dclogs\2012-07-11-4.dc (Stolen.Data) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\dclogs\2012-07-12-5.dc (Stolen.Data) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\dclogs\2012-07-20-6.dc (Stolen.Data) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\dclogs\2012-07-21-7.dc (Stolen.Data) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\dclogs\2012-07-22-1.dc (Stolen.Data) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\dclogs\2012-07-23-2.dc (Stolen.Data) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\dclogs\2012-07-24-3.dc (Stolen.Data) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\Microsoft\sysBackup.exe (Trojan.Agent) -> Delete on reboot.

C:\Users\Home\AppData\Roaming\100839.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\101997.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\105799.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\107482.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\111804.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\112214.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\118752.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\128043.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\128805.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\131214.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\131951.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\134363.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\158075.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\160519.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\162566.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\164394.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\172737.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\188011.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\194033.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\195743.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\197913.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\198643.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\204451.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\212166.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\212576.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\213310.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\216497.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\219906.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\225164.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\225529.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\227575.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\237629.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\240191.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\241750.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\245265.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\245569.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\248411.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\253390.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\254584.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\254826.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\265121.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\265126.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\265562.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\268877.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\272516.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\277057.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\280736.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\281347.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\282729.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\284005.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\284246.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\288126.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\290359.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\292130.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\296834.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\297204.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\299032.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\300961.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\306641.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\307617.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\308306.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\308962.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\310398.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\315012.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\319229.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\319717.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\322038.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\325890.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\337407.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\356852.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\357750.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\360121.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\361630.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\365729.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\374975.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\376360.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\379416.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\380022.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\386929.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\390676.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\392733.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\397589.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\401929.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\402175.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\404340.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\404833.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\407609.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\409730.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\411937.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\418857.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\419619.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\429302.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\433155.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\436930.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\437646.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\441384.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\444713.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\447447.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\448670.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\452062.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\452673.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\459794.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\461016.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\462480.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\467443.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\472382.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\474761.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\477479.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\480260.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\486069.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\486430.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\491166.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\493336.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\493706.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\495876.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\496975.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\503877.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\508245.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\512462.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\512708.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\514049.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\517564.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\518836.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\521920.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\523614.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\528347.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\528486.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\533740.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\536690.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\538860.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\539471.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\541422.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\542493.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\546373.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\550007.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\555569.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\561984.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\562841.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\563571.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\567086.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\569010.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\569593.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\575429.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\576865.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\577258.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\582861.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\587771.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\593130.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\601822.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\602614.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\605452.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\608360.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\610042.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\610777.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\613922.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\615263.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\619754.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\624464.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\632342.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\633536.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\639463.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\639951.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\648782.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\655786.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\658129.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\659241.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\662834.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\663075.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\665031.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\667366.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\670470.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\675545.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\682694.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\684645.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\685247.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\686692.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\692377.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\692988.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\693476.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\694329.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\706675.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\712069.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\712114.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\712155.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\713131.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\714649.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\733630.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\738384.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\739242.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\747335.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\753781.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\757145.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\759097.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\759831.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\760458.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\762242.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\764946.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\766004.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\768416.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\768662.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\771808.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\777370.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\778222.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\779445.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\793227.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\793715.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\796496.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\800617.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\802081.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\802815.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\804313.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\805322.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\807278.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\812594.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\813570.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\816370.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\821818.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\824571.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\828816.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\830284.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\831318.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\831625.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\832696.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\839234.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\846948.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\853532.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\862116.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\863703.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\865873.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\870545.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\878096.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\887197.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\888799.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\889950.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\893000.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\893428.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\895663.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\896516.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\896639.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\896697.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\898932.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\909592.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\913041.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\913225.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\917105.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\917688.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\918546.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\918787.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\923980.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\925936.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\927980.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\932474.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\940998.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\948234.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\950619.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\954012.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\954504.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\957162.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\970844.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\981201.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\986460.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\993973.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\999659.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Roaming\bt99.lnk (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Program Files (x86)\Mozilla Firefox\extensions\{D9ADB0A8-7BFB-498D-9880-EE78A81CCFA0}\chrome.manifest (Adware.QuestBrowse) -> Quarantined and deleted successfully.

C:\Program Files (x86)\Mozilla Firefox\extensions\{D9ADB0A8-7BFB-498D-9880-EE78A81CCFA0}\install.rdf (Adware.QuestBrowse) -> Quarantined and deleted successfully.

C:\Program Files (x86)\Mozilla Firefox\extensions\{D9ADB0A8-7BFB-498D-9880-EE78A81CCFA0}\chrome\questbrowse.jar (Adware.QuestBrowse) -> Quarantined and deleted successfully.

C:\Program Files (x86)\Mozilla Firefox\extensions\{D9ADB0A8-7BFB-498D-9880-EE78A81CCFA0}\defaults\preferences\prefs.js (Adware.QuestBrowse) -> Quarantined and deleted successfully.

C:\Users\Home\Local Settings\Application Data\I Want This\Chrome\I Want This.crx (Adware.GamePlayLab) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Local\I Want This\Chrome\I Want This.crx (Adware.GamePlayLab) -> Quarantined and deleted successfully.

(end)

Link to post
Share on other sites
MrCharlie

MrCharlie

Posted
Posted

Welcome to the forum,

Please Update and run a Quick Scan with MBAM, post the report.

Make sure that everything is checked, and click Remove Selected.

--------------------------------

Next......

Please start at the link below:

http://forums.malwar...?showtopic=9573

Post back the 2 logs.....DDS.txt and Attach.txt

<====><====><====><====><====><====><====><====>

Next.......

Please remove any usb or external drives from the computer before you run this scan!

Please download and run RogueKiller to your desktop.

For Windows XP, double-click to start.

For Vista or Windows 7, do a right-click on the program, select Run as Administrator to start, & when prompted Allow to run.

Click Scan to scan the system.

When the scan completes > Close out the program > Don't Fix anything!

Don't run any other options, they're not all bad!!!!!!!

Post back the report which should be located on your desktop.

MrC

Link to post
Share on other sites
Legendkilla023

Legendkilla023

Posted
  • Author
Posted

The MBAM Report

Malwarebytes Anti-Malware (Trial) 1.62.0.1300

www.malwarebytes.org

Database version: v2012.07.25.05

Windows 7 Service Pack 1 x64 NTFS

Internet Explorer 8.0.7601.17514

Home :: LEGENDKILLA023 [administrator]

Protection: Enabled

7/25/2012 12:04:23 PM

mbam-log-2012-07-25 (12-04-23).txt

Scan type: Quick scan

Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM

Scan options disabled: P2P

Objects scanned: 244641

Time elapsed: 8 minute(s), 59 second(s)

Memory Processes Detected: 0

(No malicious items detected)

Memory Modules Detected: 0

(No malicious items detected)

Registry Keys Detected: 0

(No malicious items detected)

Registry Values Detected: 1

HKCU\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows|Load (Trojan.Ransom) -> Data: C:\Users\Home\LOCALS~1\Temp\mszwcu.cmd -> Delete on reboot.

Registry Data Items Detected: 0

(No malicious items detected)

Folders Detected: 0

(No malicious items detected)

Files Detected: 3

C:\Users\Home\AppData\Roaming\cglogs.dat (Malware.Trace) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Local\Temp\UuU.uUu (Malware.Trace) -> Quarantined and deleted successfully.

C:\Users\Home\AppData\Local\Temp\XxX.xXx (Malware.Trace) -> Quarantined and deleted successfully.

(end)

Link to post
Share on other sites
Legendkilla023

Legendkilla023

Posted
  • Author
Posted

Posted DDS.txt and Attached Attach.txt

DDS (Ver_2011-08-26.01) - NTFSAMD64

Internet Explorer: 8.0.7601.17514 BrowserJavaVersion: 10.5.1

Run by Home at 12:23:33 on 2012-07-25

Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.3839.1856 [GMT -4:00]

.

AV: Symantec Endpoint Protection *Disabled/Updated* {88C95A36-8C3B-2F2C-1B8B-30FCCFDC4855}

AV: Microsoft Security Essentials *Enabled/Updated* {9765EA51-0D3C-7DFB-6091-10E4E1F341F6}

SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

SP: Microsoft Security Essentials *Enabled/Updated* {2C040BB5-2B06-7275-5A21-2B969A740B4B}

SP: Symantec Endpoint Protection *Disabled/Updated* {33A8BBD2-AA01-20A2-213B-0B8EB45B02E8}

FW: Symantec Endpoint Protection *Enabled* {B0F2DB13-C654-2E74-30D4-99C9310F0F2E}

.

============== Running Processes ===============

.

C:\Windows\system32\wininit.exe

C:\Windows\system32\lsm.exe

C:\Windows\system32\svchost.exe -k DcomLaunch

C:\Windows\system32\svchost.exe -k RPCSS

c:\Program Files\Microsoft Security Client\MsMpEng.exe

C:\Windows\system32\atiesrxx.exe

C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted

C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted

C:\Windows\system32\svchost.exe -k netsvcs

C:\Windows\system32\svchost.exe -k LocalService

C:\Program Files (x86)\Symantec\Symantec Endpoint Protection\Smc.exe

C:\Windows\system32\atieclxx.exe

C:\Windows\SYSTEM32\WISPTIS.EXE

C:\Windows\system32\svchost.exe -k NetworkService

C:\Program Files (x86)\Common Files\Symantec Shared\ccSvcHst.exe

C:\Windows\System32\spoolsv.exe

C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork

C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe

C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe

C:\Windows\system32\AEADISRV.EXE

C:\Windows\SysWOW64\svchost.exe -k Akamai

C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

C:\Program Files (x86)\Application Updater\ApplicationUpdater.exe

C:\Program Files (x86)\Microsoft\BingBar\BBSvc.EXE

C:\Program Files (x86)\Microsoft\BingBar\SeaPort.EXE

C:\Program Files\Bonjour\mDNSResponder.exe

C:\Program Files (x86)\Hewlett-Packard\TouchSmart\Calendar\Service\GCalService.exe

C:\Program Files (x86)\Deal Cricket\dealcricketupgrade.exe

C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation

C:\Program Files (x86)\Hewlett-Packard\Shared\HPDrvMntSvc.exe

c:\PROGRA~2\mcafee\SITEAD~1\McSACore.exe

C:\Windows\System32\svchost.exe -k HPZ12

C:\Windows\system32\rundll32.exe

C:\Windows\system32\rundll32.exe

C:\Windows\SysWOW64\rundll32.exe

C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe

C:\Windows\system32\svchost.exe -k imgsvc

C:\Program Files (x86)\Symantec\Symantec Endpoint Protection\Rtvscan.exe

C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE

C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe

C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe

C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE

C:\Windows\system32\SearchIndexer.exe

C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted

C:\Windows\system32\WUDFHost.exe

C:\Windows\system32\taskhost.exe

C:\Windows\system32\Dwm.exe

C:\Windows\Explorer.EXE

C:\Program Files (x86)\Symantec\Symantec Endpoint Protection\SmcGui.exe

C:\Program Files (x86)\Symantec\Symantec Endpoint Protection\DoScan.exe

C:\Program Files (x86)\Symantec\Symantec Endpoint Protection\ProtectionUtilSurrogate.exe

C:\Program Files (x86)\Symantec\Symantec Endpoint Protection\SavUI.exe

C:\Windows\SYSTEM32\WISPTIS.EXE

C:\Windows\system32\taskeng.exe

C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe

C:\Program Files (x86)\Analog Devices\SoundMAX\SoundMAX.exe

C:\Program Files (x86)\Common Files\Microsoft Shared\Ink\TabTip32.exe

C:\Windows\system32\taskeng.exe

C:\Program Files (x86)\Hewlett-Packard\TouchSmart\Calendar\Service\HPTouchSmartSyncCalReminderApp.exe

C:\Program Files\Microsoft Security Client\msseces.exe

C:\Program Files (x86)\CrossriderWebApps\Crossrider.exe

C:\Program Files (x86)\Internet Explorer\IELowutil.exe

C:\Program Files (x86)\ooVoo\ooVoo.exe

C:\Program Files (x86)\Common Files\Apple\Internet Services\ubd.exe

C:\Users\Home\fdfix.exe

C:\Program Files (x86)\McAfee Security Scan\2.1.121\SSScheduler.exe

C:\Program Files (x86)\Hewlett-Packard\HP Odometer\hpsysdrv.exe

C:\Windows\System32\svchost.exe -k LocalServicePeerNet

C:\Program Files (x86)\Hewlett-Packard\HP Desktop Keyboard\HPKEYBOARDx.EXE

C:\Program Files\Windows Media Player\wmpnetwk.exe

C:\Program Files (x86)\Hewlett-Packard\HP Remote Solution\HP_Remote_Solution.exe

C:\Windows\system32\taskeng.exe

C:\Program Files (x86)\Analog Devices\Core\smax4pnp.exe

c:\Program Files (x86)\Hewlett-Packard\TouchSmart\Media\Kernel\CLML\CLMLSvc.exe

C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

C:\Program Files (x86)\Hewlett-Packard\Buttons & OSDs control application gen3\FastUserSwitching.exe

C:\Program Files (x86)\hp\HP Software Update\hpwuschd2.exe

C:\Program Files (x86)\Hewlett-Packard\Buttons & OSDs control application gen3\JAN2OSD.exe

C:\Program Files (x86)\Hewlett-Packard\HP Desktop Keyboard\Keystatus.exe

C:\Windows\System32\svchost.exe -k WerSvcGroup

C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe

C:\Program Files (x86)\Common Files\Nikon\Monitor\NkMonitor.exe

C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ArcCon.ac

C:\Program Files (x86)\Common Files\Apple\Apple Application Support\distnoted.exe

C:\Windows\system32\conhost.exe

C:\Program Files (x86)\PowerISO\PWRISOVM.EXE

C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe

C:\Program Files (x86)\Ask.com\Updater\Updater.exe

C:\Program Files (x86)\iTunes\iTunesHelper.exe

C:\Program Files (x86)\Common Files\Symantec Shared\ccApp.exe

C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe

C:\Program Files (x86)\Common Files\Spigot\Search Settings\SearchSettings.exe

C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe

C:\Program Files\iPod\bin\iPodService.exe

C:\Windows\system32\wbem\wmiprvse.exe

c:\Program Files\Microsoft Security Client\MpCmdRun.exe

C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe

C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbam.exe

C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe

C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPSFMessenger\HPSFMsgr.exe

C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe

C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe

C:\Windows\system32\sppsvc.exe

C:\Program Files\Common Files\Microsoft Shared\Ink\InputPersonalization.exe

C:\Windows\system32\msiexec.exe

C:\Windows\system32\wbem\wmiprvse.exe

C:\Windows\system32\SearchProtocolHost.exe

C:\Windows\system32\SearchFilterHost.exe

C:\Windows\system32\DllHost.exe

C:\Windows\system32\DllHost.exe

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\conhost.exe

C:\Windows\SysWOW64\cscript.exe

.

============== Pseudo HJT Report ===============

.

uSearch Page =

uSearch Bar = hxxp://toolbar.inbox.com/search/dispatcher.aspx?tp=aus&qkw=%s&tbid=%tb_id&%language

mStart Page = hxxp://home.sweetim.com

uInternet Settings,ProxyOverride = *.local;127.0.0.1:9421;<local>

uURLSearchHooks: H - No File

uURLSearchHooks: YouTube Downloader Toolbar: {f3fee66e-e034-436a-86e4-9690573bee8a} - C:\Program Files (x86)\YouTube Downloader Toolbar\IE\6.1\youtubedownloaderToolbarIE.dll

uURLSearchHooks: H - No File

uURLSearchHooks: McAfee SiteAdvisor Toolbar: {0ebbbe48-bad4-4b4c-8e5a-516abecae064} - c:\PROGRA~2\mcafee\SITEAD~1\mcieplg.dll

uURLSearchHooks: H - No File

uURLSearchHooks: FCToolbarURLSearchHook Class: {f78bf7a8-cf12-4de7-a6da-c463d1b539a7} - C:\Program Files (x86)\Dogpile Bundle Toolbar\Helper.dll

uWindows: Load=C:\Users\Home\LOCALS~1\Temp\mszwcu.cmd

BHO: TinyBHO Class: {00e71626-0bef-11dc-8314-0800200c9a66} - C:\Program Files (x86)\Deal Cricket\TinyBHO.dll

BHO: 2YourFace Addon: {1185823f-f22f-4027-80e5-4f68acd5de5e} - C:\Program Files (x86)\2YourFace\bho.dll

BHO: PriceGongBHO Class: {1631550f-191d-4826-b069-d9439253d926} - C:\Program Files (x86)\PriceGong\2.1.0\PriceGongIE.dll

BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

BHO: ooVoo Toolbar: {574be437-25ae-4010-a53e-8c63b6ae02ff} - C:\Program Files (x86)\oovootoolbar\vmntemplateX.dll

BHO: ooVoo Toolbar: {59c6f12b-f004-43e5-9997-08f2123119b6} - C:\Program Files (x86)\oovootoolbar\oovootoolbarX.dll

BHO: AppGraffiti: {6f6a5334-78e9-4d9b-8182-8b41ea8c39ef} - C:\PROGRA~2\APPGRA~1\APPGRA~1.DLL

BHO: Groove GFS Browser Helper: {72853161-30c5-4d22-b7f9-0bbc1d38a37e} - C:\PROGRA~2\MICROS~4\Office14\GROOVEEX.DLL

BHO: Java Plug-In SSV Helper: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - C:\Program Files (x86)\Oracle\JavaFX 2.1 Runtime\bin\ssv.dll

BHO: Windows Live ID Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

BHO: {9D425283-D487-4337-BAB6-AB8354A81457} - No File

BHO: Windows Live Messenger Companion Helper: {9fdde16b-836f-4806-ab1f-1455cbeff289} - C:\Program Files (x86)\Windows Live\Companion\companioncore.dll

BHO: CrossRider: {a876e312-7d08-401a-b7a6-fafc5dc2f292} - C:\Program Files (x86)\CrossriderWebApps\Crossrider.dll

BHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll

BHO: Skype Browser Helper: {ae805869-2e5c-4ed4-8f7b-f1f7851a4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll

BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - C:\Program Files (x86)\Google\GoogleToolbarNotifier\5.7.7227.1100\swg.dll

BHO: McAfee SiteAdvisor BHO: {b164e929-a1b6-4a06-b104-2cd0e90a88ff} - c:\PROGRA~2\mcafee\SITEAD~1\mcieplg.dll

BHO: Office Document Cache Handler: {b4f3a835-0e21-4959-ba22-42b3008e02ff} - C:\PROGRA~2\MICROS~4\Office14\URLREDIR.DLL

BHO: Dogpile Bundle Toolbar BHO: {bfe4b5cb-63f7-4a51-9266-6167655d5b4f} - C:\Program Files (x86)\Dogpile Bundle Toolbar\Toolbar.dll

BHO: Bing Bar Helper: {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - "C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll"

BHO: Ask Toolbar: {d4027c7f-154a-4066-a1ad-4243d8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll

BHO: Java Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - C:\Program Files (x86)\Oracle\JavaFX 2.1 Runtime\bin\jp2ssv.dll

BHO: YouTube Downloader Toolbar: {f3fee66e-e034-436a-86e4-9690573bee8a} - C:\Program Files (x86)\YouTube Downloader Toolbar\IE\6.1\youtubedownloaderToolbarIE.dll

BHO: {FCBCCB87-9224-4B8D-B117-F56D924BEB18} - No File

TB: ooVoo Toolbar: {59c6f12b-f004-43e5-9997-08f2123119b6} - C:\Program Files (x86)\oovootoolbar\oovootoolbarX.dll

TB: Ask Toolbar: {d4027c7f-154a-4066-a1ad-4243d8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll

TB: {9D425283-D487-4337-BAB6-AB8354A81457} - No File

TB: McAfee SiteAdvisor Toolbar: {0ebbbe48-bad4-4b4c-8e5a-516abecae064} - c:\PROGRA~2\mcafee\SITEAD~1\mcieplg.dll

TB: ooVoo Toolbar: {574be437-25ae-4010-a53e-8c63b6ae02ff} - C:\Program Files (x86)\oovootoolbar\vmntemplateX.dll

TB: Hyperionics DB Toolbar: {338b4dfe-2e2c-4338-9e41-e176d497299e} - C:\Program Files (x86)\Hyperionics DB Toolbar\tbcore3.dll

TB: Dogpile Bundle Toolbar: {c80bdeb2-8735-44c6-bd55-a1ccd555667a} - C:\Program Files (x86)\Dogpile Bundle Toolbar\Toolbar.dll

TB: Google Toolbar: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll

TB: Bing Bar: {8dcb7100-df86-4384-8842-8fa844297b3f} - "C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll"

TB: YouTube Downloader Toolbar: {f3fee66e-e034-436a-86e4-9690573bee8a} - C:\Program Files (x86)\YouTube Downloader Toolbar\IE\6.1\youtubedownloaderToolbarIE.dll

TB: {604BC32A-9680-40D1-9AC6-E06B23A1BA4C} - No File

TB: {88C7F2AA-F93F-432C-8F0E-B7D85967A527} - No File

TB: {51A86BB3-6602-4C85-92A5-130EE4864F13} - No File

TB: {EEE6C35B-6118-11DC-9C72-001320C79847} - No File

TB: {4B3803EA-5230-4DC3-A7FC-33638F3D3542} - No File

TB: {D7E97865-918F-41E4-9CD0-25AB1C574CE8} - No File

uRun: [CrossRiderPlugin] C:\Program Files (x86)\CrossriderWebApps\Crossrider.exe

uRun: [swg] "C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"

uRun: [Google Update] "C:\Users\Home\AppData\Local\Google\Update\GoogleUpdate.exe" /c

uRun: [ooVoo.exe] C:\Program Files (x86)\ooVoo\ooVoo.exe /minimized

uRun: [msnmsgm]

uRun: [Akamai NetSession Interface] "C:\Users\Home\AppData\Local\Akamai\netsession_win.exe"

uRun: [dsgh] C:\Users\Home\AppData\Roaming\System\dsgh.exe

uRun: [MobileDocuments] C:\Program Files (x86)\Common Files\Apple\Internet Services\ubd.exe

uRun: [startup] C:\Users\Home\AppData\Roaming\Sky Teel.exe

uRun: [<NO NAME>]

uRun: [MainConcept (Nikon)] C:\Users\Home\AppData\Roaming\0B5B8E.exe

uRun: [HLTCDMS83A] C:\Users\Home\AppData\Roaming\0B5B8E.exe

uRun: [Java] C:\Users\Home\AppData\Roaming\Kiiity.exe

uRun: [adobeupdater] "C:\Users\Home\AppData\Roaming\killer.exe"

uRun: [idjutwimjxkmtmhkkth] C:\Users\Home\AppData\Roaming\idjutwimjxkmtmhkkth.exe

uRun: [Licenses] C:\Users\Home\AppData\Roaming\6B70F7.exe

uRun: [iWin] C:\Users\Home\AppData\Roaming\441D8D.exe

uRun: [Q0QzQTJGQzIzMjE3NzNCQU] C:\Users\Home\fdfix.exe

mRun: [hpsysdrv] c:\program files (x86)\hewlett-packard\HP odometer\hpsysdrv.exe

mRun: [HP KEYBOARDx] "C:\Program Files (x86)\Hewlett-Packard\HP Desktop Keyboard\HPKEYBOARDx.EXE"

mRun: [HP Remote Solution] %ProgramFiles%\Hewlett-Packard\HP Remote Solution\HP_Remote_Solution.exe

mRun: [soundMAXPnP] C:\Program Files (x86)\Analog Devices\Core\smax4pnp.exe

mRun: [buttons & OSDs control application gen3] c:\Program Files (x86)\Hewlett-Packard\Buttons & OSDs control application gen3\FastUserSwitching.exe

mRun: [HP Software Update] c:\Program Files (x86)\HP\HP Software Update\HPWuSchd2.exe

mRun: [NortonOnlineBackupReminder] "C:\Program Files (x86)\Symantec\Norton Online Backup\Activation\NobuActivation.exe" UNATTENDED

mRun: [ArcSoft Connection Service] C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe

mRun: [Nikon Transfer Monitor] C:\Program Files (x86)\Common Files\Nikon\Monitor\NkMonitor.exe

mRun: [startCCC] "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun

mRun: [AppleSyncNotifier] C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe

mRun: [PWRISOVM.EXE] C:\Program Files (x86)\PowerISO\PWRISOVM.EXE

mRun: [bCSSync] "C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe" /DelayServices

mRun: [switchBoard] C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe

mRun: [AdobeCS5ServiceManager] "C:\Program Files (x86)\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe" -launchedbylogin

mRun: [DivXUpdate] "C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe" /CHECKNOW

mRun: [ApnUpdater] "C:\Program Files (x86)\Ask.com\Updater\Updater.exe"

mRun: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"

mRun: [APSDaemon] "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe"

mRun: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime

mRun: [iTunesHelper] "C:\Program Files (x86)\iTunes\iTunesHelper.exe"

mRun: [ccApp] "C:\Program Files (x86)\Common Files\Symantec Shared\ccApp.exe"

mRun: [amd_dc_opt] C:\Program Files (x86)\AMD\Dual-Core Optimizer\amd_dc_opt.exe

mRun: [sunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"

mRun: [<NO NAME>]

mRun: [searchSettings] "C:\Program Files (x86)\Common Files\Spigot\Search Settings\SearchSettings.exe"

mRun: [Malwarebytes' Anti-Malware] "C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe" /starttray

StartupFolder: C:\Users\Home\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\tmp56CF.tmp.exe

StartupFolder: C:\Users\Home\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\tmp575B.tmp.exe

StartupFolder: C:\Users\Home\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\tmp57B8.tmp.exe

StartupFolder: C:\Users\Home\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\tmpD743.tmp.exe

StartupFolder: C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\Startup\MCAFEE~1.LNK - C:\Program Files (x86)\McAfee Security Scan\2.1.121\SSScheduler.exe

uPolicies-explorer: NoRun = 0

mPolicies-explorer: NoActiveDesktop = 1 (0x1)

mPolicies-explorer: NoActiveDesktopChanges = 1 (0x1)

mPolicies-system: ConsentPromptBehaviorAdmin = 5 (0x5)

mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3)

mPolicies-system: EnableUIADesktopToggle = 0 (0x0)

IE: E&xport to Microsoft Excel - C:\PROGRA~2\MICROS~4\Office14\EXCEL.EXE/3000

IE: Google Sidewiki... - C:\Program Files (x86)\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_7461B1589E8B4FB7.dll/cmsidewiki.html

IE: Se&nd to OneNote - C:\PROGRA~2\MICROS~4\Office14\ONBttnIE.dll/105

IE: Translate this web page with Babylon - C:\Program Files (x86)\Babylon\Babylon-Pro\Utils\BabylonIEPI.dll/ActionTU.htm

IE: Translate with Babylon - C:\Program Files (x86)\Babylon\Babylon-Pro\Utils\BabylonIEPI.dll/Action.htm

IE: {0000036B-C524-4050-81A0-243669A86B9F} - {B63DBA5F-523F-4B9C-A43D-65DF1977EAD3} - C:\Program Files (x86)\Windows Live\Companion\companioncore.dll

IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll

IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIE.dll

IE: {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - {FFFDC614-B694-4AE6-AB38-5D6374584B52} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIELinkedNotes.dll

IE: {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll

Trusted Zone: clonewarsadventures.com

Trusted Zone: freerealms.com

Trusted Zone: soe.com

Trusted Zone: sony.com

DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab

DPF: {CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab

DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab

TCP: DhcpNameServer = 192.168.1.254

TCP: Interfaces\{54F843ED-BB66-4D40-89CB-BA04DF7BB600} : DhcpNameServer = 192.168.1.254

Filter: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\MSOXMLMF.DLL

Handler: dssrequest - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\PROGRA~2\McAfee\SITEAD~1\McIEPlg.dll

Handler: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\PROGRA~2\McAfee\SITEAD~1\McIEPlg.dll

Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll

Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files (x86)\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll

SEH: Groove GFS Stub Execution Hook: {b5a7f190-dda6-4420-b3ba-52453494e6cd} - C:\PROGRA~2\MICROS~4\Office14\GROOVEEX.DLL

BHO-X64: TinyBHO Class: {00e71626-0bef-11dc-8314-0800200c9a66} - C:\Program Files (x86)\Deal Cricket\TinyBHO.dll

BHO-X64: 2YourFace Addon: {1185823F-F22F-4027-80E5-4F68ACD5DE5E} - C:\Program Files (x86)\2YourFace\bho.dll

BHO-X64: C:\\Program Files (x86)\\2YourFace\\bho.dll - No File

BHO-X64: PriceGongBHO Class: {1631550F-191D-4826-B069-D9439253D926} - C:\Program Files (x86)\PriceGong\2.1.0\PriceGongIE.dll

BHO-X64: PriceGong - No File

BHO-X64: Adobe PDF Link Helper: {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

BHO-X64: AcroIEHelperStub - No File

BHO-X64: ooVoo Toolbar: {574be437-25ae-4010-a53e-8c63b6ae02ff} - C:\Program Files (x86)\oovootoolbar\vmntemplateX.dll

BHO-X64: ooVoo Toolbar - No File

BHO-X64: ooVoo Toolbar: {59c6f12b-f004-43e5-9997-08f2123119b6} - C:\Program Files (x86)\oovootoolbar\oovootoolbarX.dll

BHO-X64: ooVoo Toolbar - No File

BHO-X64: AppGraffiti: {6F6A5334-78E9-4D9B-8182-8B41EA8C39EF} - C:\PROGRA~2\APPGRA~1\APPGRA~1.DLL

BHO-X64: Groove GFS Browser Helper: {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~2\MICROS~4\Office14\GROOVEEX.DLL

BHO-X64: Java Plug-In SSV Helper: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Oracle\JavaFX 2.1 Runtime\bin\ssv.dll

BHO-X64: Windows Live ID Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

BHO-X64: {9D425283-D487-4337-BAB6-AB8354A81457} - No File

BHO-X64: Windows Live Messenger Companion Helper: {9FDDE16B-836F-4806-AB1F-1455CBEFF289} - C:\Program Files (x86)\Windows Live\Companion\companioncore.dll

BHO-X64: CrossRider: {A876E312-7D08-401a-B7A6-FAFC5DC2F292} - C:\Program Files (x86)\CrossriderWebApps\Crossrider.dll

BHO-X64: CrossRider - No File

BHO-X64: Google Toolbar Helper: {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll

BHO-X64: Skype Browser Helper: {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll

BHO-X64: SkypeIEPluginBHO - No File

BHO-X64: Google Toolbar Notifier BHO: {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files (x86)\Google\GoogleToolbarNotifier\5.7.7227.1100\swg.dll

BHO-X64: McAfee SiteAdvisor BHO: {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - c:\PROGRA~2\mcafee\SITEAD~1\mcieplg.dll

BHO-X64: Office Document Cache Handler: {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~2\MICROS~4\Office14\URLREDIR.DLL

BHO-X64: URLRedirectionBHO - No File

BHO-X64: Dogpile Bundle Toolbar BHO: {BFE4B5CB-63F7-4A51-9266-6167655D5B4F} - C:\Program Files (x86)\Dogpile Bundle Toolbar\Toolbar.dll

BHO-X64: FCTBPos00Pos - No File

BHO-X64: Bing Bar Helper: {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - "C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll"

BHO-X64: Ask Toolbar: {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll

BHO-X64: Ask Toolbar BHO - No File

BHO-X64: Java Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Oracle\JavaFX 2.1 Runtime\bin\jp2ssv.dll

BHO-X64: YouTube Downloader Toolbar: {F3FEE66E-E034-436a-86E4-9690573BEE8A} - C:\Program Files (x86)\YouTube Downloader Toolbar\IE\6.1\youtubedownloaderToolbarIE.dll

BHO-X64: {FCBCCB87-9224-4B8D-B117-F56D924BEB18} - No File

BHO-X64: SMTTB2009 - No File

TB-X64: ooVoo Toolbar: {59c6f12b-f004-43e5-9997-08f2123119b6} - C:\Program Files (x86)\oovootoolbar\oovootoolbarX.dll

TB-X64: Ask Toolbar: {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll

TB-X64: {9D425283-D487-4337-BAB6-AB8354A81457} - No File

TB-X64: McAfee SiteAdvisor Toolbar: {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\PROGRA~2\mcafee\SITEAD~1\mcieplg.dll

TB-X64: ooVoo Toolbar: {574be437-25ae-4010-a53e-8c63b6ae02ff} - C:\Program Files (x86)\oovootoolbar\vmntemplateX.dll

TB-X64: Hyperionics DB Toolbar: {338B4DFE-2E2C-4338-9E41-E176D497299E} - C:\Program Files (x86)\Hyperionics DB Toolbar\tbcore3.dll

TB-X64: Dogpile Bundle Toolbar: {C80BDEB2-8735-44C6-BD55-A1CCD555667A} - C:\Program Files (x86)\Dogpile Bundle Toolbar\Toolbar.dll

TB-X64: Google Toolbar: {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll

TB-X64: Bing Bar: {8dcb7100-df86-4384-8842-8fa844297b3f} - "C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll"

TB-X64: YouTube Downloader Toolbar: {F3FEE66E-E034-436a-86E4-9690573BEE8A} - C:\Program Files (x86)\YouTube Downloader Toolbar\IE\6.1\youtubedownloaderToolbarIE.dll

TB-X64: {604BC32A-9680-40D1-9AC6-E06B23A1BA4C} - No File

TB-X64: {88C7F2AA-F93F-432C-8F0E-B7D85967A527} - No File

TB-X64: {51A86BB3-6602-4C85-92A5-130EE4864F13} - No File

TB-X64: {EEE6C35B-6118-11DC-9C72-001320C79847} - No File

TB-X64: {4B3803EA-5230-4DC3-A7FC-33638F3D3542} - No File

TB-X64: {D7E97865-918F-41E4-9CD0-25AB1C574CE8} - No File

mRun-x64: [hpsysdrv] c:\program files (x86)\hewlett-packard\HP odometer\hpsysdrv.exe

mRun-x64: [HP KEYBOARDx] "C:\Program Files (x86)\Hewlett-Packard\HP Desktop Keyboard\HPKEYBOARDx.EXE"

mRun-x64: [HP Remote Solution] %ProgramFiles%\Hewlett-Packard\HP Remote Solution\HP_Remote_Solution.exe

mRun-x64: [soundMAXPnP] C:\Program Files (x86)\Analog Devices\Core\smax4pnp.exe

mRun-x64: [buttons & OSDs control application gen3] c:\Program Files (x86)\Hewlett-Packard\Buttons & OSDs control application gen3\FastUserSwitching.exe

mRun-x64: [HP Software Update] c:\Program Files (x86)\HP\HP Software Update\HPWuSchd2.exe

mRun-x64: [NortonOnlineBackupReminder] "C:\Program Files (x86)\Symantec\Norton Online Backup\Activation\NobuActivation.exe" UNATTENDED

mRun-x64: [ArcSoft Connection Service] C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe

mRun-x64: [Nikon Transfer Monitor] C:\Program Files (x86)\Common Files\Nikon\Monitor\NkMonitor.exe

mRun-x64: [startCCC] "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun

mRun-x64: [AppleSyncNotifier] C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe

mRun-x64: [PWRISOVM.EXE] C:\Program Files (x86)\PowerISO\PWRISOVM.EXE

mRun-x64: [bCSSync] "C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe" /DelayServices

mRun-x64: [switchBoard] C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe

mRun-x64: [AdobeCS5ServiceManager] "C:\Program Files (x86)\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe" -launchedbylogin

mRun-x64: [DivXUpdate] "C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe" /CHECKNOW

mRun-x64: [ApnUpdater] "C:\Program Files (x86)\Ask.com\Updater\Updater.exe"

mRun-x64: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"

mRun-x64: [APSDaemon] "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe"

mRun-x64: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime

mRun-x64: [iTunesHelper] "C:\Program Files (x86)\iTunes\iTunesHelper.exe"

mRun-x64: [ccApp] "C:\Program Files (x86)\Common Files\Symantec Shared\ccApp.exe"

mRun-x64: [amd_dc_opt] C:\Program Files (x86)\AMD\Dual-Core Optimizer\amd_dc_opt.exe

mRun-x64: [sunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"

mRun-x64: [(Default)]

mRun-x64: [searchSettings] "C:\Program Files (x86)\Common Files\Spigot\Search Settings\SearchSettings.exe"

mRun-x64: [Malwarebytes' Anti-Malware] "C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe" /starttray

SEH-X64: Groove GFS Stub Execution Hook: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\PROGRA~2\MICROS~4\Office14\GROOVEEX.DLL

.

================= FIREFOX ===================

.

FF - ProfilePath - C:\Users\Home\AppData\Roaming\Mozilla\Firefox\Profiles\5ecd5axt.default\

FF - prefs.js: browser.search.defaulturl - hxxp://search.sweetim.com/search.asp?src=2&q=

FF - prefs.js: browser.search.selectedEngine - Yahoo

FF - prefs.js: browser.startup.homepage - bing.com

FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?fr=greentree_ff1&ei=utf-8&ilc=12&type=937811&p=

FF - plugin: C:\PROGRA~2\MICROS~4\Office14\NPAUTHZ.DLL

FF - plugin: C:\PROGRA~2\MICROS~4\Office14\NPSPWRAP.DLL

FF - plugin: C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll

FF - plugin: C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll

FF - plugin: C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll

FF - plugin: C:\Program Files (x86)\Google\Update\1.3.21.111\npGoogleUpdate3.dll

FF - plugin: C:\Program Files (x86)\Google\Update\1.3.21.115\npGoogleUpdate3.dll

FF - plugin: C:\Program Files (x86)\Google\Update\1.3.21.53\npGoogleUpdate3.dll

FF - plugin: C:\Program Files (x86)\Google\Update\1.3.21.65\npGoogleUpdate3.dll

FF - plugin: C:\Program Files (x86)\Google\Update\1.3.21.69\npGoogleUpdate3.dll

FF - plugin: C:\Program Files (x86)\Google\Update\1.3.21.79\npGoogleUpdate3.dll

FF - plugin: C:\Program Files (x86)\Google\Update\1.3.21.99\npGoogleUpdate3.dll

FF - plugin: C:\Program Files (x86)\Java\jre6\bin\new_plugin\npdeployJava1.dll

FF - plugin: C:\Program Files (x86)\Java\jre6\bin\plugin2\npdeployJava1.dll

FF - plugin: C:\Program Files (x86)\McAfee\SiteAdvisor\NPMcFFPlg32.dll

FF - plugin: c:\Program Files (x86)\Microsoft Silverlight\4.1.10329.0\npctrlui.dll

FF - plugin: C:\Program Files (x86)\Oracle\JavaFX 2.1 Runtime\bin\plugin2\npjp2.dll

FF - plugin: C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll

FF - plugin: c:\Program Files (x86)\Virtual Earth 3D\npVE3D.dll

FF - plugin: C:\Program Files (x86)\WildTangent Games\App\BrowserIntegration\Registered\16\NP_wtapp.dll

FF - plugin: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll

FF - plugin: C:\Users\Default\AppData\Local\HuluDesktop\instances\0.9.9.1\nphdplg.dll

FF - plugin: C:\Users\Home\AppData\Local\Google\Chrome\User Data\Default\Extensions\dkfjadjghjpjodfhffafagnkbgbpiphf\1.0.3.152_0\npsoe.dll

FF - plugin: C:\Users\Home\AppData\Local\Google\Update\1.3.21.115\npGoogleUpdate3.dll

FF - plugin: C:\Users\Home\AppData\Local\Roblox\Versions\version-e029025a3614426d\NPRobloxProxy.dll

FF - plugin: C:\Users\Home\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll

FF - plugin: C:\Users\Home\AppData\Roaming\Electronic Arts\Game Face\npGameFacePlugin.dll

FF - plugin: C:\Users\Home\AppData\Roaming\Mozilla\plugins\npgoogletalk.dll

FF - plugin: C:\Users\Home\AppData\Roaming\Mozilla\plugins\npgtpo3dautoplugin.dll

FF - plugin: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_3_300_265.dll

FF - plugin: C:\Windows\SysWOW64\npDeployJava1.dll

FF - plugin: C:\Windows\SysWOW64\npmproxy.dll

.

---- FIREFOX POLICIES ----

FF - user.js: network.cookie.cookieBehavior - 0

FF - user.js: privacy.clearOnShutdown.cookies - false

FF - user.js: security.warn_viewing_mixed - false

FF - user.js: security.warn_viewing_mixed.show_once - false

FF - user.js: security.warn_submit_insecure - false

FF - user.js: security.warn_submit_insecure.show_once - false

.

.

.

============= SERVICES / DRIVERS ===============

.

R0 MpFilter;Microsoft Malware Protection Driver;C:\Windows\system32\DRIVERS\MpFilter.sys --> C:\Windows\system32\DRIVERS\MpFilter.sys [?]

R1 vwififlt;Virtual WiFi Filter Driver;C:\Windows\system32\DRIVERS\vwififlt.sys --> C:\Windows\system32\DRIVERS\vwififlt.sys [?]

R2 AdobeARMservice;Adobe Acrobat Update Service;C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2011-6-6 63928]

R2 Akamai;Akamai NetSession Interface;C:\Windows\System32\svchost.exe -k Akamai [2009-7-13 20992]

R2 AMD External Events Utility;AMD External Events Utility;C:\Windows\system32\atiesrxx.exe --> C:\Windows\system32\atiesrxx.exe [?]

R2 Application Updater;Application Updater;C:\Program Files (x86)\Application Updater\ApplicationUpdater.exe [2012-7-19 792512]

R2 BBSvc;Bing Bar Update Service;C:\Program Files (x86)\Microsoft\BingBar\BBSvc.EXE [2011-10-21 196176]

R2 BBUpdate;BBUpdate;C:\Program Files (x86)\Microsoft\BingBar\SeaPort.EXE [2011-10-13 249648]

R2 CalendarSynchService;CalendarSynchService;C:\Program Files (x86)\Hewlett-Packard\TouchSmart\Calendar\Service\GCalService.exe [2009-9-10 22072]

R2 cvhsvc;Client Virtualization Handler;C:\Program Files (x86)\Common Files\microsoft shared\Virtualization Handler\CVHSVC.EXE [2012-1-4 822624]

R2 DealCricket Upgrade;Deal Cricket Upgrade;C:\Program Files (x86)\Deal Cricket\dealcricketupgrade.exe [2010-10-15 17920]

R2 HP Support Assistant Service;HP Support Assistant Service;C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSA_Service.exe [2011-9-9 86072]

R2 HPDrvMntSvc.exe;HP Quick Synchronization Service;C:\Program Files (x86)\Hewlett-Packard\Shared\HPDrvMntSvc.exe [2011-3-28 94264]

R2 MBAMService;MBAMService;C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2012-7-24 655944]

R2 McAfee SiteAdvisor Service;McAfee SiteAdvisor Service;C:\PROGRA~2\mcafee\SITEAD~1\McSACore.exe [2012-7-16 103472]

R2 sftlist;Application Virtualization Client;C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe [2011-10-1 508776]

R2 Symantec AntiVirus;Symantec Endpoint Protection;C:\Program Files (x86)\Symantec\Symantec Endpoint Protection\Rtvscan.exe [2009-11-10 1775344]

R3 ACPIService;Buttons and OSDs ACPI driver gen2;C:\Windows\system32\DRIVERS\OSDACPI.SYS --> C:\Windows\system32\DRIVERS\OSDACPI.SYS [?]

R3 amdkmdag;amdkmdag;C:\Windows\system32\DRIVERS\atipmdag.sys --> C:\Windows\system32\DRIVERS\atipmdag.sys [?]

R3 amdkmdap;amdkmdap;C:\Windows\system32\DRIVERS\atikmpag.sys --> C:\Windows\system32\DRIVERS\atikmpag.sys [?]

R3 EraserUtilRebootDrv;EraserUtilRebootDrv;C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [2012-7-14 138912]

R3 hidkmdf;Microsoft HID Class Shim for KMDF;C:\Windows\system32\DRIVERS\hidkmdf.sys --> C:\Windows\system32\DRIVERS\hidkmdf.sys [?]

R3 MBAMProtector;MBAMProtector;\??\C:\Windows\system32\drivers\mbam.sys --> C:\Windows\system32\drivers\mbam.sys [?]

R3 netr28x;Ralink 802.11n Extensible Wireless Driver;C:\Windows\system32\DRIVERS\netr28x.sys --> C:\Windows\system32\DRIVERS\netr28x.sys [?]

R3 NW1950;NextWindow 1950 Touch Screen;C:\Windows\system32\DRIVERS\NW1950.sys --> C:\Windows\system32\DRIVERS\NW1950.sys [?]

R3 RTL8167;Realtek 8167 NT Driver;C:\Windows\system32\DRIVERS\Rt64win7.sys --> C:\Windows\system32\DRIVERS\Rt64win7.sys [?]

R3 Sftfs;Sftfs;C:\Windows\system32\DRIVERS\Sftfslh.sys --> C:\Windows\system32\DRIVERS\Sftfslh.sys [?]

R3 Sftplay;Sftplay;C:\Windows\system32\DRIVERS\Sftplaylh.sys --> C:\Windows\system32\DRIVERS\Sftplaylh.sys [?]

R3 Sftredir;Sftredir;C:\Windows\system32\DRIVERS\Sftredirlh.sys --> C:\Windows\system32\DRIVERS\Sftredirlh.sys [?]

R3 Sftvol;Sftvol;C:\Windows\system32\DRIVERS\Sftvollh.sys --> C:\Windows\system32\DRIVERS\Sftvollh.sys [?]

R3 sftvsa;Application Virtualization Service Agent;C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe [2011-10-1 219496]

R3 usbfilter;AMD USB Filter Driver;C:\Windows\system32\DRIVERS\usbfilter.sys --> C:\Windows\system32\DRIVERS\usbfilter.sys [?]

S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]

S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-3-18 138576]

S2 gupdate;Google Update Service (gupdate);C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2010-7-13 135664]

S2 McMPFSvc;McAfee Personal Firewall Service;"C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe" /McCoreSvc --> C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe [?]

S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-7-13 250056]

S3 fssfltr;fssfltr;C:\Windows\system32\DRIVERS\fssfltr.sys --> C:\Windows\system32\DRIVERS\fssfltr.sys [?]

S3 fsssvc;Windows Live Family Safety Service;C:\Program Files (x86)\Windows Live\Family Safety\fsssvc.exe [2010-9-23 1493352]

S3 GamesAppService;GamesAppService;C:\Program Files (x86)\WildTangent Games\App\GamesAppService.exe [2010-10-12 206072]

S3 gupdatem;Google Update Service (gupdatem);C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2010-7-13 135664]

S3 McComponentHostService;McAfee Security Scan Component Host Service;C:\Program Files (x86)\McAfee Security Scan\2.1.121\McCHSvc.exe [2010-9-3 227232]

S3 Microsoft SharePoint Workspace Audit Service;Microsoft SharePoint Workspace Audit Service;C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE [2010-1-21 30963576]

S3 MozillaMaintenance;Mozilla Maintenance Service;C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe [2012-5-7 113120]

S3 netr28ux;Linksys USB Wireless LAN Card Driver for Vista;C:\Windows\system32\DRIVERS\netr28ux.sys --> C:\Windows\system32\DRIVERS\netr28ux.sys [?]

S3 NisDrv;Microsoft Network Inspection System;C:\Windows\system32\DRIVERS\NisDrvWFP.sys --> C:\Windows\system32\DRIVERS\NisDrvWFP.sys [?]

S3 NisSrv;Microsoft Network Inspection;C:\Program Files\Microsoft Security Client\NisSrv.exe [2012-3-26 291696]

S3 osppsvc;Office Software Protection Platform;C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-1-9 4925184]

S3 SwitchBoard;Adobe SwitchBoard;C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [2010-2-19 517096]

S3 TsUsbFlt;TsUsbFlt;C:\Windows\system32\drivers\tsusbflt.sys --> C:\Windows\system32\drivers\tsusbflt.sys [?]

S3 USBAAPL64;Apple Mobile USB Driver;C:\Windows\system32\Drivers\usbaapl64.sys --> C:\Windows\system32\Drivers\usbaapl64.sys [?]

S3 WatAdminSvc;Windows Activation Technologies Service;C:\Windows\system32\Wat\WatAdminSvc.exe --> C:\Windows\system32\Wat\WatAdminSvc.exe [?]

S4 wlcrasvc;Windows Live Mesh remote connections service;C:\Program Files\Windows Live\Mesh\wlcrasvc.exe [2010-9-22 57184]

.

=============== Created Last 30 ================

.

2012-07-25 16:20:34 7168 ----a-w- C:\Users\Home\AppData\Roaming\870947.exe_rpopv

2012-07-25 16:20:34 7168 ----a-w- C:\Users\Home\AppData\Roaming\815863.exe_ohjfx

2012-07-25 16:20:34 7168 ----a-w- C:\Users\Home\AppData\Roaming\515731.exe_fhzxk

2012-07-25 16:20:32 3584 ----a-w- C:\Users\Home\AppData\Roaming\taskmgr.exe_calgf

2012-07-25 06:23:17 69000 ----a-w- C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{F61F14C5-22D3-45E3-AA35-24F7C41B35E4}\offreg.dll

2012-07-25 06:09:03 927800 ----a-w- C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{30B4B512-7344-4682-A943-B2479050CAC3}\gapaengine.dll

2012-07-25 06:06:33 9133488 ----a-w- C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{F61F14C5-22D3-45E3-AA35-24F7C41B35E4}\mpengine.dll

2012-07-25 05:58:45 -------- d-----w- C:\Program Files (x86)\Microsoft Security Client

2012-07-25 05:57:05 -------- d-----w- C:\Program Files\Microsoft Security Client

2012-07-25 05:30:29 9133488 ----a-w- C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{B72DCDF5-3547-4E75-907B-2118B74F71B4}\mpengine.dll

2012-07-25 05:19:50 98816 ----a-w- C:\Windows\sed.exe

2012-07-25 05:19:50 518144 ----a-w- C:\Windows\SWREG.exe

2012-07-25 05:19:50 256000 ----a-w- C:\Windows\PEV.exe

2012-07-25 05:19:50 208896 ----a-w- C:\Windows\MBR.exe

2012-07-25 05:19:46 -------- d-s---w- C:\ComboFix

2012-07-25 02:22:50 -------- d-----w- C:\Users\Home\AppData\Roaming\Malwarebytes

2012-07-25 02:22:26 -------- d-----w- C:\ProgramData\Malwarebytes

2012-07-25 02:22:25 24904 ----a-w- C:\Windows\System32\drivers\mbam.sys

2012-07-25 02:22:24 -------- d-----w- C:\Program Files (x86)\Malwarebytes' Anti-Malware

2012-07-25 01:39:20 395264 --sha-r- C:\Users\Home\fdfix.exe

2012-07-24 03:47:23 1586628 ----a-w- C:\Users\Home\AppData\Roaming\oomnq

2012-07-23 15:19:18 -------- d-----w- C:\Users\Home\AppData\Local\{F0140707-4C9E-45BA-811C-96AD9C348EB1}

2012-07-23 00:27:25 -------- d-----w- C:\Program Files (x86)\Application Updater

2012-07-23 00:27:24 -------- d-----w- C:\Program Files (x86)\YouTube Downloader Toolbar

2012-07-23 00:27:24 -------- d-----w- C:\Program Files (x86)\Common Files\Spigot

2012-07-22 20:36:24 576 --sha-w- C:\Users\Home\AppData\Roaming\bat99.bat

2012-07-16 15:25:12 -------- d-----w- C:\Users\Home\AppData\Local\{B2A19FB0-4689-41E0-BD53-DD04B2CE03BB}

2012-07-13 22:46:50 -------- d-----w- C:\Users\Home\AppData\Local\Macromedia

2012-07-13 18:27:26 9226440 ----a-w- C:\Windows\SysWow64\FlashPlayerInstaller.exe

2012-07-13 17:31:23 426184 ----a-w- C:\Windows\SysWow64\FlashPlayerApp.exe

2012-07-12 07:06:43 3148800 ----a-w- C:\Windows\System32\win32k.sys

2012-07-07 04:54:32 -------- d-----w- C:\ProgramData\Steam

2012-07-07 04:54:09 -------- d-----w- C:\ProgramData\PopCap Games

2012-07-04 18:56:41 1064960 ----a-w- C:\Users\Home\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\tmp57B8.tmp.exe

2012-07-04 18:56:41 1064960 ----a-w- C:\Users\Home\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\tmp575B.tmp.exe

2012-07-04 18:56:39 1064960 ----a-w- C:\Users\Home\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\tmp56CF.tmp.exe

2012-07-04 18:53:57 1064960 ----a-w- C:\Users\Home\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\tmpD743.tmp.exe

2012-07-04 17:24:36 -------- d-----w- C:\ProgramData\McAfee Security Scan

2012-07-04 17:24:26 -------- d-----w- C:\Program Files (x86)\McAfee Security Scan

2012-07-04 17:23:48 -------- d-----w- C:\Program Files (x86)\Oracle

2012-07-04 17:23:23 772504 ----a-w- C:\Windows\SysWow64\npDeployJava1.dll

2012-07-03 20:52:36 -------- d-----w- C:\Users\Home\AppData\Local\{2A99E8C8-25A0-4D13-B41D-840454E5D9CB}

2012-07-03 20:51:48 -------- d-----w- C:\Users\Home\AppData\Local\{7DFAADAC-11E8-4320-B9B1-5D2BF240AC8B}

2012-07-03 20:51:25 -------- d-----w- C:\Users\Home\AppData\Local\{5F213E78-7BF6-41C1-AB18-062C856D45A8}

2012-07-03 20:51:04 -------- d-----w- C:\Users\Home\AppData\Local\{BFDB7A8D-D0D3-4AA3-ABA0-4400A10564A0}

2012-07-03 20:50:23 -------- d-----w- C:\Users\Home\AppData\Local\{4855FEA5-70B2-4D24-AD67-5E297B1B0019}

2012-07-03 20:48:12 -------- d-----w- C:\Users\Home\AppData\Local\{5065BE39-29C9-4CE0-B7E1-5542BC43D3AC}

2012-07-03 20:47:36 -------- d-----w- C:\Users\Home\AppData\Local\{DD1AAC30-7BE3-48F8-83E1-781BECE91A0A}

2012-07-03 20:47:04 -------- d-----w- C:\Users\Home\AppData\Local\{CB4007F5-CB85-40A6-A4D5-918DB9492D21}

2012-07-03 03:22:00 -------- d-----w- C:\Users\Home\AppData\Local\Downloaded Installations

2012-07-03 03:21:52 239960 ----a-w- C:\Windows\SysWow64\xactengine3_7.dll

2012-07-03 03:21:52 176984 ----a-w- C:\Windows\System32\xactengine3_7.dll

2012-07-03 03:21:50 1907552 ----a-w- C:\Windows\System32\d3dcsx_43.dll

2012-07-03 03:21:50 1868128 ----a-w- C:\Windows\SysWow64\d3dcsx_43.dll

2012-07-03 03:21:47 78680 ----a-w- C:\Windows\System32\XAPOFX1_4.dll

2012-07-03 03:21:47 74072 ----a-w- C:\Windows\SysWow64\XAPOFX1_4.dll

2012-07-03 03:21:47 530776 ----a-w- C:\Windows\System32\XAudio2_6.dll

2012-07-03 03:21:47 528216 ----a-w- C:\Windows\SysWow64\XAudio2_6.dll

2012-07-03 03:21:47 238936 ----a-w- C:\Windows\SysWow64\xactengine3_6.dll

2012-07-03 03:21:47 176984 ----a-w- C:\Windows\System32\xactengine3_6.dll

2012-07-02 16:39:13 -------- d-----w- C:\Users\Home\AppData\Roaming\.techniclauncher

2012-07-01 21:41:52 -------- d-----w- C:\Users\Home\AppData\Local\.inapptracking

2012-07-01 07:17:22 -------- d-----w- C:\Users\Home\AppData\Roaming\Warner Bros. Interactive Entertainment

2012-07-01 05:46:12 77656 ----a-w- C:\Windows\System32\XAPOFX1_5.dll

2012-07-01 05:46:12 74072 ----a-w- C:\Windows\SysWow64\XAPOFX1_5.dll

2012-07-01 05:46:12 527192 ----a-w- C:\Windows\SysWow64\XAudio2_7.dll

2012-07-01 05:46:12 518488 ----a-w- C:\Windows\System32\XAudio2_7.dll

2012-07-01 05:46:10 276832 ----a-w- C:\Windows\System32\d3dx11_43.dll

2012-07-01 05:46:10 2526056 ----a-w- C:\Windows\System32\D3DCompiler_43.dll

2012-07-01 05:46:10 248672 ----a-w- C:\Windows\SysWow64\d3dx11_43.dll

2012-07-01 05:46:09 511328 ----a-w- C:\Windows\System32\d3dx10_43.dll

2012-07-01 05:46:09 470880 ----a-w- C:\Windows\SysWow64\d3dx10_43.dll

2012-07-01 05:46:08 2401112 ----a-w- C:\Windows\System32\D3DX9_43.dll

2012-07-01 05:46:07 24920 ----a-w- C:\Windows\System32\X3DAudio1_7.dll

2012-07-01 05:46:07 22360 ----a-w- C:\Windows\SysWow64\X3DAudio1_7.dll

2012-06-30 18:21:22 466456 ----a-w- C:\Windows\System32\wrap_oal.dll

2012-06-30 18:21:21 122904 ----a-w- C:\Windows\System32\OpenAL32.dll

2012-06-30 18:21:21 -------- d-----w- C:\Program Files (x86)\OpenAL

2012-06-30 18:21:20 444952 ----a-w- C:\Windows\SysWow64\wrap_oal.dll

2012-06-30 18:21:20 109080 ----a-w- C:\Windows\SysWow64\OpenAL32.dll

2012-06-30 16:03:36 2106216 ----a-w- C:\Windows\SysWow64\D3DCompiler_43.dll

2012-06-30 16:03:36 1998168 ----a-w- C:\Windows\SysWow64\D3DX9_43.dll

2012-06-28 19:47:53 -------- d-----w- C:\Users\Home\AppData\Roaming\RotMG.Production

2012-06-27 13:26:46 770384 ----a-w- C:\Program Files (x86)\Mozilla Firefox\msvcr100.dll

2012-06-27 13:26:46 421200 ----a-w- C:\Program Files (x86)\Mozilla Firefox\msvcp100.dll

.

==================== Find3M ====================

.

2012-07-13 18:27:33 70344 ----a-w- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl

2012-06-06 06:06:16 2004480 ----a-w- C:\Windows\System32\msxml6.dll

2012-06-06 06:06:16 1881600 ----a-w- C:\Windows\System32\msxml3.dll

2012-06-06 06:02:54 1133568 ----a-w- C:\Windows\System32\cdosys.dll

2012-06-06 05:05:52 1390080 ----a-w- C:\Windows\SysWow64\msxml6.dll

2012-06-06 05:05:52 1236992 ----a-w- C:\Windows\SysWow64\msxml3.dll

2012-06-06 05:03:06 805376 ----a-w- C:\Windows\SysWow64\cdosys.dll

2012-06-02 22:15:31 2622464 ----a-w- C:\Windows\System32\wucltux.dll

2012-06-02 22:15:08 99840 ----a-w- C:\Windows\System32\wudriver.dll

2012-06-02 19:19:42 186752 ----a-w- C:\Windows\System32\wuwebv.dll

2012-06-02 19:15:12 36864 ----a-w- C:\Windows\System32\wuapp.exe

2012-06-02 05:50:10 458704 ----a-w- C:\Windows\System32\drivers\cng.sys

2012-06-02 05:48:16 95600 ----a-w- C:\Windows\System32\drivers\ksecdd.sys

2012-06-02 05:48:16 151920 ----a-w- C:\Windows\System32\drivers\ksecpkg.sys

2012-06-02 05:45:31 340992 ----a-w- C:\Windows\System32\schannel.dll

2012-06-02 05:44:21 307200 ----a-w- C:\Windows\System32\ncrypt.dll

2012-06-02 04:40:42 22016 ----a-w- C:\Windows\SysWow64\secur32.dll

2012-06-02 04:40:39 225280 ----a-w- C:\Windows\SysWow64\schannel.dll

2012-06-02 04:39:10 219136 ----a-w- C:\Windows\SysWow64\ncrypt.dll

2012-06-02 04:34:09 96768 ----a-w- C:\Windows\SysWow64\sspicli.dll

2012-05-31 16:25:12 279656 ------w- C:\Windows\System32\MpSigStub.exe

2012-05-15 04:01:31 1188864 ----a-w- C:\Windows\System32\wininet.dll

2012-05-15 03:03:54 981504 ----a-w- C:\Windows\SysWow64\wininet.dll

2012-05-14 22:33:28 172592 ----a-w- C:\Windows\System32\drivers\SYMEVENT64x86.SYS

2012-05-04 23:29:16 687504 ----a-w- C:\Windows\SysWow64\deployJava1.dll

2012-05-04 11:06:22 5559664 ----a-w- C:\Windows\System32\ntoskrnl.exe

2012-05-04 10:03:53 3968368 ----a-w- C:\Windows\SysWow64\ntkrnlpa.exe

2012-05-04 10:03:50 3913072 ----a-w- C:\Windows\SysWow64\ntoskrnl.exe

2012-05-01 05:40:20 209920 ----a-w- C:\Windows\System32\profsvc.dll

2012-04-28 03:55:21 210944 ----a-w- C:\Windows\System32\drivers\rdpwd.sys

.

============= FINISH: 12:26:40.51 ===============

Link to post
Share on other sites
Legendkilla023

Legendkilla023

Posted
  • Author
Posted

Posted DDS

.

UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.

IF REQUESTED, ZIP IT UP & ATTACH IT

.

DDS (Ver_2011-08-26.01)

.

Microsoft Windows 7 Home Premium

Boot Device: \Device\HarddiskVolume1

Install Date: 7/6/2010 6:55:29 PM

System Uptime: 7/25/2012 12:16:09 PM (0 hours ago)

.

Motherboard: PEGATRON CORPORATION | | JESSE

Processor: AMD Athlon II X2 235e Processor | CPU 1 | 2700/200mhz

.

==== Disk Partitions =========================

.

C: is FIXED (NTFS) - 686 GiB total, 540.701 GiB free.

D: is FIXED (NTFS) - 12 GiB total, 1.741 GiB free.

E: is CDROM ()

F: is Removable

G: is CDROM ()

.

==== Disabled Device Manager Items =============

.

==== System Restore Points ===================

.

RP446: 7/16/2012 3:03:39 PM - Windows Defender Checkpoint

RP447: 7/17/2012 9:04:11 PM - Windows Update

RP449: 7/17/2012 9:46:10 PM - Windows Defender Checkpoint

RP451: 7/21/2012 11:25:54 AM - Windows Defender Checkpoint

RP453: 7/22/2012 11:29:28 PM - Windows Defender Checkpoint

RP455: 7/24/2012 1:11:46 AM - Windows Defender Checkpoint

RP456: 7/24/2012 11:03:52 AM - Windows Update

.

==== Installed Programs ======================

.

7-Zip 4.20

aaa

Adobe AIR

Adobe Community Help

Adobe Flash Player 11 ActiveX

Adobe Flash Player 11 Plugin

Adobe Media Player

Adobe Photoshop CS5

Adobe Reader X (10.1.3)

Adobe Shockwave Player 11.6

Akamai NetSession Interface

Akamai NetSession Interface Service

AMD USB Filter Driver

AppGraffiti

Apple Application Support

Apple Software Update

ArcSoft Panorama Maker 5

Ask Toolbar

Audacity 2.0

Bing Bar

Bus Driver

Buttons & OSDs control application gen3

Call of Duty: Modern Warfare 2 - Multiplayer

Capture NX 2

Catalyst Control Center - Branding

Catalyst Control Center Core Implementation

Catalyst Control Center Graphics Full Existing

Catalyst Control Center Graphics Full New

Catalyst Control Center Graphics Light

Catalyst Control Center Graphics Previews Vista

Catalyst Control Center InstallProxy

Catalyst Control Center Localization All

ccc-core-static

CCC Help Chinese Standard

CCC Help Chinese Traditional

CCC Help Czech

CCC Help Danish

CCC Help Dutch

CCC Help English

CCC Help Finnish

CCC Help French

CCC Help German

CCC Help Greek

CCC Help Hungarian

CCC Help Italian

CCC Help Japanese

CCC Help Korean

CCC Help Norwegian

CCC Help Polish

CCC Help Portuguese

CCC Help Russian

CCC Help Spanish

CCC Help Swedish

CCC Help Thai

CCC Help Turkish

Compatibility Pack for the 2007 Office system

Crazy Chicken Kart 2

Crazy Chicken Pinball

Crazy Chicken Skybotz

Crazy Chicken Soccer

Crossrider Web Apps

CyberLink DVD Suite Deluxe

D3DX10

Deal Cricket

Definition Update for Microsoft Office 2010 (KB982726) 32-Bit Edition

DirectX for Managed Code Update (Summer 2004)

DivX Setup

Dogpile Bundle Toolbar

Dual-Core Optimizer

DVD Menu Pack for HP TouchSmart Video

EA SPORTS Gameface Browser Plugin 1.3.1.0

FATE: The Cursed King

File Uploader

Final Media Player 2011

FLV Player

Free Realms

Google Chrome

Google SketchUp 8

Google Talk Plugin

Google Toolbar for Internet Explorer

Google Update Helper

Hewlett-Packard ACLM.NET v1.1.2.0

Higher Score on the SAT/PSAT

HP Advisor

HP Customer Experience Enhancements

HP Desktop Keyboard

HP Games

HP MediaSmart DVD

HP MediaSmart/TouchSmart Netflix

HP Odometer

HP Product Detection

HP Remote Solution

HP Setup

HP Support Assistant

HP Support Information

HP TouchSmart

HP TouchSmart Browser

HP TouchSmart Calendar

HP TouchSmart Canvas

HP TouchSmart Clock

HP TouchSmart Music/Photo/Video

HP TouchSmart Notes

HP TouchSmart RecipeBox

HP TouchSmart RSS

HP TouchSmart Tutorials

HP TouchSmart Twitter

HP TouchSmart Weather

HP TouchSmart Webcam

HP Update

Hulu Desktop

HyperCam 2

Hyperionics DB Toolbar

Java Auto Updater

Java 6 Update 31

Java 7 Update 5

JavaFX 2.1.1

Junk Mail filter update

LabelPrint

LEGO® Batman™ DEMO

LiveUpdate 3.3 (Symantec Corporation)

Malwarebytes Anti-Malware version 1.62.0.1300

McAfee Security Scan Plus

McAfee SiteAdvisor

Mesh Runtime

Messenger Companion

Microsoft Live Search Toolbar

Microsoft Office Access MUI (English) 2010

Microsoft Office Access Setup Metadata MUI (English) 2010

Microsoft Office Click-to-Run 2010

Microsoft Office Excel MUI (English) 2010

Microsoft Office Groove MUI (English) 2010

Microsoft Office Home and Business 2010 - English

Microsoft Office InfoPath MUI (English) 2010

Microsoft Office OneNote MUI (English) 2010

Microsoft Office Outlook Connector

Microsoft Office Outlook MUI (English) 2010

Microsoft Office PowerPoint MUI (English) 2010

Microsoft Office PowerPoint Viewer 2007 (English)

Microsoft Office Professional Plus 2010

Microsoft Office Proof (English) 2010

Microsoft Office Proof (French) 2010

Microsoft Office Proof (Spanish) 2010

Microsoft Office Proofing (English) 2010

Microsoft Office Publisher MUI (English) 2010

Microsoft Office Shared MUI (English) 2010

Microsoft Office Shared Setup Metadata MUI (English) 2010

Microsoft Office Word MUI (English) 2010

Microsoft Outlook Social Connector Provider for Windows Live Messenger 32-bit

Microsoft Silverlight

Microsoft SQL Server 2005 Compact Edition [ENU]

Microsoft Touch Pack for Windows 7

Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053

Microsoft Visual C++ 2005 Redistributable

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161

Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219

Microsoft Works

Microsoft XNA Framework Redistributable 3.0

Microsoft_VC80_ATL_x86

Microsoft_VC80_CRT_x86

Microsoft_VC80_MFC_x86

Microsoft_VC80_MFCLOC_x86

Microsoft_VC90_ATL_x86

Microsoft_VC90_CRT_x86

Microsoft_VC90_MFC_x86

Movie Theme Pack for HP TouchSmart Video

Mozilla Firefox 13.0.1 (x86 en-US)

Mozilla Maintenance Service

MSVCRT

MSVCRT_amd64

MSXML 4.0 SP2 (KB954430)

MSXML 4.0 SP2 (KB973688)

Nikon Message Center

Nikon Transfer

Norton Online Backup

Norton Security Scan

ooVoo

ooVoo Toolbar

OpenAL

Pando Media Booster

PDF Settings CS5

Pearl Harbor: Fire on the Water

Penguins Arena

Picture Control Utility

Power2Go

PowerDirector

PowerISO

PriceGong 2.1.0

QuickTime

Recovery Manager

Roblox for Home

Safari

Security Update for Microsoft .NET Framework 4 Client Profile (KB2160841)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2446708)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2478663)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2518870)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2539636)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2572078)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2604121)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2633870)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2656351)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2656368)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2656368v2)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2656405)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2686827)

Skype Click to Call

Skype™ 5.5

SoundMAX

SpongeBob Typing

SpongeBob: Clash of Triton

Steam

SwiftKit

swMSM

Team Fortress 2

The Weather Channel Desktop 6

Turtle Odyssey

Unity Web Player

Update for Microsoft .NET Framework 4 Client Profile (KB2468871)

Update for Microsoft .NET Framework 4 Client Profile (KB2533523)

Update for Microsoft .NET Framework 4 Client Profile (KB2600217)

Update for Microsoft Office 2010 (KB2494150)

Update for Microsoft Office 2010 (KB2553092)

Update Installer for WildTangent Games App

VC80CRTRedist - 8.0.50727.4053

ViewNX

WildTangent Games

WildTangent Games App

WildTangent Games App (HP Games)

Windows Live Communications Platform

Windows Live Essentials

Windows Live Installer

Windows Live Mail

Windows Live Mesh

Windows Live Mesh ActiveX Control for Remote Connections

Windows Live Messenger

Windows Live Messenger Companion Core

Windows Live Movie Maker

Windows Live Photo Common

Windows Live Photo Gallery

Windows Live PIMT Platform

Windows Live SOXE

Windows Live SOXE Definitions

Windows Live Sync

Windows Live UX Platform

Windows Live UX Platform Language Pack

Windows Live Writer

Windows Live Writer Resources

WinRAR archiver

YouTube Downloader Toolbar v6.1

YTD YouTube Downloader & Converter 3.6

.

==== Event Viewer Messages From Past Week ========

.

7/25/2012 2:12:35 AM, Error: Microsoft Antimalware [2001] - Microsoft Antimalware has encountered an error trying to update signatures. New Signature Version: Previous Signature Version: 1.131.599.0 Update Source: Microsoft Update Server Update Stage: Install Source Path: http://www.microsoft.com Signature Type: AntiVirus Update Type: Full User: NT AUTHORITY\SYSTEM Current Engine Version: Previous Engine Version: 1.1.8601.0 Error code: 0x80240017 Error description: An unexpected problem occurred while checking for updates. For information on installing or troubleshooting updates, see Help and Support.

7/25/2012 2:00:32 AM, Error: Service Control Manager [7009] - A timeout was reached (30000 milliseconds) while waiting for the Microsoft Antimalware Service service to connect.

7/25/2012 2:00:32 AM, Error: Service Control Manager [7000] - The Microsoft Antimalware Service service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.

7/25/2012 12:20:37 PM, Error: Service Control Manager [7023] - The Peer Name Resolution Protocol service terminated with the following error: %%-2140993535

7/25/2012 12:20:37 PM, Error: Service Control Manager [7001] - The Peer Networking Grouping service depends on the Peer Name Resolution Protocol service which failed to start because of the following error: %%-2140993535

7/25/2012 12:20:37 PM, Error: Microsoft-Windows-PNRPSvc [102] - The Peer Name Resolution Protocol cloud did not start because the creation of the default identity failed with error code: 0x80630801.

7/25/2012 12:18:07 PM, Error: Service Control Manager [7003] - The McAfee Personal Firewall Service service depends the following service: MfeFire. This service might not be installed.

7/25/2012 1:38:04 AM, Error: Service Control Manager [7011] - A timeout (30000 milliseconds) was reached while waiting for a transaction response from the ShellHWDetection service.

7/25/2012 1:32:01 AM, Error: Service Control Manager [7034] - The MBAMService service terminated unexpectedly. It has done this 1 time(s).

7/25/2012 1:19:06 AM, Error: Service Control Manager [7031] - The Akamai NetSession Interface service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 1000 milliseconds: Restart the service.

7/25/2012 1:05:49 AM, Error: Service Control Manager [7022] - The Windows Update service hung on starting.

7/24/2012 10:58:37 AM, Error: Service Control Manager [7022] - The SSDP Discovery service hung on starting.

7/24/2012 10:58:37 AM, Error: Service Control Manager [7001] - The UPnP Device Host service depends on the SSDP Discovery service which failed to start because of the following error: After starting, the service hung in a start-pending state.

7/24/2012 10:58:37 AM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1068" attempting to start the service upnphost with arguments "" in order to run the server: {204810B9-73B2-11D4-BF42-00B0D0118B56}

7/24/2012 10:57:07 AM, Error: Microsoft-Windows-WMPNSS-Service [14332] - Service 'WMPNetworkSvc' did not start correctly because CoCreateInstance(CLSID_UPnPDeviceFinder) encountered error '0x80004005'. Verify that the UPnPHost service is running and that the UPnPHost component of Windows is installed properly.

7/22/2012 1:49:39 PM, Error: Microsoft-Windows-WMPNSS-Service [14365] - Proximity detection failed due to unknown error '0x80004004'. The best proximity time detected was -1 milliseconds.

.

==== End Of File ===========================

Link to post
Share on other sites
Legendkilla023

Legendkilla023

Posted
  • Author
Posted

Rouge report

RogueKiller V7.6.4 [07/17/2012] by Tigzy

mail: tigzyRK<at>gmail<dot>com

Feedback: http://www.geekstogo.com/forum/files/file/413-roguekiller/

Blog: http://tigzyrk.blogspot.com

Operating System: Windows 7 (6.1.7601 Service Pack 1) 64 bits version

Started in : Normal mode

User: Home [Admin rights]

Mode: Scan -- Date: 07/25/2012 12:38:18

¤¤¤ Bad processes: 1 ¤¤¤

[sUSP PATH] fdfix.exe -- C:\Users\Home\fdfix.exe -> KILLED [TermProc]

¤¤¤ Registry Entries: 24 ¤¤¤

[sUSP PATH] HKCU\[...]\Run : dsgh (C:\Users\Home\AppData\Roaming\System\dsgh.exe) -> FOUND

[sUSP PATH] HKCU\[...]\Run : startup (C:\Users\Home\AppData\Roaming\Sky Teel.exe) -> FOUND

[sUSP PATH] HKCU\[...]\Run : MainConcept (Nikon) (C:\Users\Home\AppData\Roaming\0B5B8E.exe) -> FOUND

[sUSP PATH] HKCU\[...]\Run : HLTCDMS83A (C:\Users\Home\AppData\Roaming\0B5B8E.exe) -> FOUND

[sUSP PATH] HKCU\[...]\Run : Java (C:\Users\Home\AppData\Roaming\Kiiity.exe) -> FOUND

[sUSP PATH] HKCU\[...]\Run : adobeupdater ("C:\Users\Home\AppData\Roaming\killer.exe") -> FOUND

[sUSP PATH] HKCU\[...]\Run : idjutwimjxkmtmhkkth (C:\Users\Home\AppData\Roaming\idjutwimjxkmtmhkkth.exe) -> FOUND

[sUSP PATH] HKCU\[...]\Run : Licenses (C:\Users\Home\AppData\Roaming\6B70F7.exe) -> FOUND

[sUSP PATH] HKCU\[...]\Run : iWin (C:\Users\Home\AppData\Roaming\441D8D.exe) -> FOUND

[sUSP PATH] HKCU\[...]\Run : Q0QzQTJGQzIzMjE3NzNCQU (C:\Users\Home\fdfix.exe) -> FOUND

[sUSP PATH] HKUS\S-1-5-21-4173507603-124383979-1935116261-1005[...]\Run : dsgh (C:\Users\Home\AppData\Roaming\System\dsgh.exe) -> FOUND

[sUSP PATH] HKUS\S-1-5-21-4173507603-124383979-1935116261-1005[...]\Run : startup (C:\Users\Home\AppData\Roaming\Sky Teel.exe) -> FOUND

[sUSP PATH] HKUS\S-1-5-21-4173507603-124383979-1935116261-1005[...]\Run : MainConcept (Nikon) (C:\Users\Home\AppData\Roaming\0B5B8E.exe) -> FOUND

[sUSP PATH] HKUS\S-1-5-21-4173507603-124383979-1935116261-1005[...]\Run : HLTCDMS83A (C:\Users\Home\AppData\Roaming\0B5B8E.exe) -> FOUND

[sUSP PATH] HKUS\S-1-5-21-4173507603-124383979-1935116261-1005[...]\Run : Java (C:\Users\Home\AppData\Roaming\Kiiity.exe) -> FOUND

[sUSP PATH] HKUS\S-1-5-21-4173507603-124383979-1935116261-1005[...]\Run : adobeupdater ("C:\Users\Home\AppData\Roaming\killer.exe") -> FOUND

[sUSP PATH] HKUS\S-1-5-21-4173507603-124383979-1935116261-1005[...]\Run : idjutwimjxkmtmhkkth (C:\Users\Home\AppData\Roaming\idjutwimjxkmtmhkkth.exe) -> FOUND

[sUSP PATH] HKUS\S-1-5-21-4173507603-124383979-1935116261-1005[...]\Run : Licenses (C:\Users\Home\AppData\Roaming\6B70F7.exe) -> FOUND

[sUSP PATH] HKUS\S-1-5-21-4173507603-124383979-1935116261-1005[...]\Run : iWin (C:\Users\Home\AppData\Roaming\441D8D.exe) -> FOUND

[sUSP PATH] HKUS\S-1-5-21-4173507603-124383979-1935116261-1005[...]\Run : Q0QzQTJGQzIzMjE3NzNCQU (C:\Users\Home\fdfix.exe) -> FOUND

[sUSP PATH] HKCU\[...]\Windows : Load (C:\Users\Home\LOCALS~1\Temp\mszwcu.cmd) -> FOUND

[sUSP PATH] HKUS\S-1-5-21-4173507603-124383979-1935116261-1005[...]\Windows : Load (C:\Users\Home\LOCALS~1\Temp\mszwcu.cmd) -> FOUND

[HJ] HKLM\[...]\NewStartPanel : {59031a47-3f72-44a7-89c5-5595fe6b30ee} (1) -> FOUND

[HJ] HKLM\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> FOUND

¤¤¤ Particular Files / Folders: ¤¤¤

¤¤¤ Driver: [NOT LOADED] ¤¤¤

¤¤¤ Infection : Root.MBR ¤¤¤

¤¤¤ HOSTS File: ¤¤¤

127.0.0.1 support.steampowered.com

.1 onlinescan.avast.com

¤¤¤ MBR Check: ¤¤¤

+++++ PhysicalDrive0: ST375052 8AS SATA Disk Device +++++

--- User ---

[MBR] 7bd7245e50b27303f7ad22c7e22d3022

[bSP] a09b8385b2e94462f712b0b42343477a : Windows Vista/7 MBR Code

Partition table:

0 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 2048 | Size: 100 Mo

1 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 206848 | Size: 702624 Mo

3 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 1439180800 | Size: 12678 Mo

User = LL1 ... OK!

User != LL2 ... KO!

--- LL2 ---

[MBR] 88e42e907aec80f2e3f36dffeac43632

[bSP] 096ca65415799301792a33c93b5e78da : Windows XP MBR Code

Partition table:

+++++ PhysicalDrive1: Multiple Card Reader USB Device +++++

Error reading User MBR!

User = LL1 ... OK!

Error reading LL2 MBR!

Finished : << RKreport[1].txt >>

RKreport[1].txt

Link to post
Share on other sites
MrCharlie

MrCharlie

Posted
Posted

OK, run RogueKiller again and click Scan

When the scan completes > click on the Bad processes tab

¤¤¤ Bad processes: 1 ¤¤¤

[sUSP PATH] fdfix.exe -- C:\Users\Home\fdfix.exe -> KILLED [TermProc]

Put a check next to all of these and uncheck the rest:

Now click Delete on the right hand column under Options

Repeat the process for these

Click on the Registry > tab put a check next to these and uncheck the rest:

¤¤¤ Registry Entries: 24 ¤¤¤

[sUSP PATH] HKCU\[...]\Run : dsgh (C:\Users\Home\AppData\Roaming\System\dsgh.exe) -> FOUND

[sUSP PATH] HKCU\[...]\Run : startup (C:\Users\Home\AppData\Roaming\Sky Teel.exe) -> FOUND

[sUSP PATH] HKCU\[...]\Run : MainConcept (Nikon) (C:\Users\Home\AppData\Roaming\0B5B8E.exe) -> FOUND

[sUSP PATH] HKCU\[...]\Run : HLTCDMS83A (C:\Users\Home\AppData\Roaming\0B5B8E.exe) -> FOUND

[sUSP PATH] HKCU\[...]\Run : Java (C:\Users\Home\AppData\Roaming\Kiiity.exe) -> FOUND

[sUSP PATH] HKCU\[...]\Run : adobeupdater ("C:\Users\Home\AppData\Roaming\killer.exe") -> FOUND

[sUSP PATH] HKCU\[...]\Run : idjutwimjxkmtmhkkth (C:\Users\Home\AppData\Roaming\idjutwimjxkmtmhkkth.exe) -> FOUND

[sUSP PATH] HKCU\[...]\Run : Licenses (C:\Users\Home\AppData\Roaming\6B70F7.exe) -> FOUND

[sUSP PATH] HKCU\[...]\Run : iWin (C:\Users\Home\AppData\Roaming\441D8D.exe) -> FOUND

[sUSP PATH] HKCU\[...]\Run : Q0QzQTJGQzIzMjE3NzNCQU (C:\Users\Home\fdfix.exe) -> FOUND

[sUSP PATH] HKUS\S-1-5-21-4173507603-124383979-1935116261-1005[...]\Run : dsgh (C:\Users\Home\AppData\Roaming\System\dsgh.exe) -> FOUND

[sUSP PATH] HKUS\S-1-5-21-4173507603-124383979-1935116261-1005[...]\Run : MainConcept (Nikon) (C:\Users\Home\AppData\Roaming\0B5B8E.exe) -> FOUND

[sUSP PATH] HKUS\S-1-5-21-4173507603-124383979-1935116261-1005[...]\Run : HLTCDMS83A (C:\Users\Home\AppData\Roaming\0B5B8E.exe) -> FOUND

[sUSP PATH] HKUS\S-1-5-21-4173507603-124383979-1935116261-1005[...]\Run : Java (C:\Users\Home\AppData\Roaming\Kiiity.exe) -> FOUND

[sUSP PATH] HKUS\S-1-5-21-4173507603-124383979-1935116261-1005[...]\Run : adobeupdater ("C:\Users\Home\AppData\Roaming\killer.exe") -> FOUND

[sUSP PATH] HKUS\S-1-5-21-4173507603-124383979-1935116261-1005[...]\Run : idjutwimjxkmtmhkkth (C:\Users\Home\AppData\Roaming\idjutwimjxkmtmhkkth.exe) -> FOUND

[sUSP PATH] HKUS\S-1-5-21-4173507603-124383979-1935116261-1005[...]\Run : Licenses (C:\Users\Home\AppData\Roaming\6B70F7.exe) -> FOUND

[sUSP PATH] HKUS\S-1-5-21-4173507603-124383979-1935116261-1005[...]\Run : iWin (C:\Users\Home\AppData\Roaming\441D8D.exe) -> FOUND

[sUSP PATH] HKUS\S-1-5-21-4173507603-124383979-1935116261-1005[...]\Run : Q0QzQTJGQzIzMjE3NzNCQU (C:\Users\Home\fdfix.exe) -> FOUND

[sUSP PATH] HKCU\[...]\Windows : Load (C:\Users\Home\LOCALS~1\Temp\mszwcu.cmd) -> FOUND

[sUSP PATH] HKUS\S-1-5-21-4173507603-124383979-1935116261-1005[...]\Windows : Load (C:\Users\Home\LOCALS~1\Temp\mszwcu.cmd) -> FOUND

Now click Delete on the right hand column under Options

----------------------------------------

Then.........

Please make sure system restore is running and create a new restore point before continuing.

XP <===> Vista & W7

XP users > please back up the registry using ERUNT.

-----------------------------------------

Please download and run TDSSKiller to your desktop as outlined below:

Doubleclick on TDSSKiller.exe to run the application, then click on Change parameters.

For Windows XP, double-click to start.

For Vista or Windows 7, do a right-click on the program, select Run as Administrator to start, & when prompted Allow to run.

tdss_1.jpg

-------------------------

Check the boxes beside Verify Driver Digital Signature and Detect TDLFS file system, then click OK.

tdss_2.jpg

------------------------

Click the Start Scan button.

tdss_3.jpg

-----------------------

If a suspicious object is detected, the default action will be Skip, click on Continue

If you get the warning about a file UnsignedFile.Multi.Generic or LockedFile.Multi.Generic please choose

Skip and click on Continue

tdss_4.jpg

----------------------

If malicious objects are found, they will show in the Scan results and offer three (3) options.

Ensure Cure is selected, then click Continue => Reboot now to finish the cleaning process.

Note: If Cure is not available, please choose Skip instead, do not choose Delete unless instructed.

tdss_5.jpg

--------------------

A report will be created in your root directory, (usually C:\ folder) in the form of "TDSSKiller.[Version]_[Date]_[Time]_log.txt". Please copy and paste its contents on your next reply.

Sometimes these logs can be very large, in that case please attach it or zip it up and attach it.

-------------------

Here's a summary of what to do if you would like to print it out:

If a suspicious object is detected, the default action will be Skip, click on Continue

If you get the warning about a file UnsignedFile.Multi.Generic or LockedFile.Multi.Generic please choose

Skip and click on Continue

If malicious objects are found, they will show in the Scan results and offer three (3) options.

Ensure Cure is selected, then click Continue => Reboot now to finish the cleaning process.

Note: If Cure is not available, please choose Skip instead, do not choose Delete unless instructed.

MrC

Link to post
Share on other sites
MrCharlie

MrCharlie

Posted
Posted

Those files are OK, I was actually expecting it to find some malware > next....

Please download and run ComboFix.

The most important things to remember when running it is to disable all your malware programs and run Combofix from your desktop.

Please visit this webpage for download links, and instructions for running ComboFix

http://www.bleepingc...to-use-combofix

Ensure you have disabled all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

Information on disabling your malware programs can be found Here.

Make sure you run ComboFix from your desktop.

Give it at least 30-45 minutes to finish if needed.

Please include the C:\ComboFix.txt in your next reply for further review.

---------->NOTE<----------

If you get the message Illegal operation attempted on registry key that has been marked for deletion after you run ComboFix....please reboot the computer, this should resolve the problem. You may have to do this several times if needed.

MrC

Link to post
Share on other sites
Legendkilla023

Legendkilla023

Posted
  • Author
Posted

<p> </p>

<div>ComboFix 12-07-26.03 - Home 07/25/2012  14:33:19.1.2 - x64</div>

<div>Microsoft Windows 7 Home Premium   6.1.7601.1.1252.1.1033.18.3839.1556 [GMT -4:00]</div>

<div>Running from: c:\users\Home\Downloads\ComboFix.exe</div>

<div>AV: Microsoft Security Essentials *Disabled/Updated* {9765EA51-0D3C-7DFB-6091-10E4E1F341F6}</div>

<div>AV: Symantec Endpoint Protection *Disabled/Updated* {88C95A36-8C3B-2F2C-1B8B-30FCCFDC4855}</div>

<div>FW: Symantec Endpoint Protection *Disabled* {B0F2DB13-C654-2E74-30D4-99C9310F0F2E}</div>

<div>SP: Microsoft Security Essentials *Disabled/Updated* {2C040BB5-2B06-7275-5A21-2B969A740B4B}</div>

<div>SP: Symantec Endpoint Protection *Disabled/Updated* {33A8BBD2-AA01-20A2-213B-0B8EB45B02E8}</div>

<div>SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}</div>

<div>.</div>

<div>.</div>

<div>(((((((((((((((((((((((((((((((((((((((   Other Deletions   )))))))))))))))))))))))))))))))))))))))))))))))))</div>

<div>.</div>

<div>.</div>

<div>c:\program files (x86)\Blinkx</div>

<div>c:\program files (x86)\Blinkx\blinkx.ico</div>

<div>c:\program files (x86)\Blinkx\blinkxss.exe</div>

<div>c:\program files (x86)\Blinkx\blinkxstop.exe</div>

<div>c:\program files (x86)\Blinkx\lang.dll</div>

<div>c:\program files (x86)\Blinkx\templates\beat.ico</div>

<div>c:\program files (x86)\Blinkx\templates\index.html</div>

<div>c:\program files (x86)\Blinkx\templates\noflash.html</div>

<div>c:\program files (x86)\Blinkx\templates\offline.html</div>

<div>c:\program files (x86)\Blinkx\templates\offline.swf</div>

<div>c:\program files (x86)\Blinkx\templates\uninstall.exe</div>

<div>c:\program files (x86)\Hyperionics DB Toolbar\tbCOre3.dll</div>

<div>c:\program files (x86)\I Want This</div>

<div>c:\program files (x86)\I Want This\I Want This.ico</div>

<div>c:\users\Home\AppData\Local\Minibar</div>

<div>c:\users\Home\AppData\Local\Minibar\chrome\background.html</div>

<div>c:\users\Home\AppData\Local\Minibar\chrome\cached_http_request.js</div>

<div>c:\users\Home\AppData\Local\Minibar\chrome\extension_info.json</div>

<div>c:\users\Home\AppData\Local\Minibar\chrome\icons\icon128.png</div>

<div>c:\users\Home\AppData\Local\Minibar\chrome\icons\icon19.png</div>

<div>c:\users\Home\AppData\Local\Minibar\chrome\icons\icon32.png</div>

<div>c:\users\Home\AppData\Local\Minibar\chrome\icons\icon48.png</div>

<div>c:\users\Home\AppData\Local\Minibar\chrome\includes\content.js</div>

<div>c:\users\Home\AppData\Local\Minibar\chrome\includes\content_kango.js</div>

<div>c:\users\Home\AppData\Local\Minibar\chrome\includes\content_messaging.js</div>

<div>c:\users\Home\AppData\Local\Minibar\chrome\includes\content_userscript.js</div>

<div>c:\users\Home\AppData\Local\Minibar\chrome\kango-ui\button.js</div>

<div>c:\users\Home\AppData\Local\Minibar\chrome\kango-ui\ui.js</div>

<div>c:\users\Home\AppData\Local\Minibar\chrome\kango\browser.js</div>

<div>c:\users\Home\AppData\Local\Minibar\chrome\kango\console.js</div>

<div>c:\users\Home\AppData\Local\Minibar\chrome\kango\event_listener.js</div>

<div>c:\users\Home\AppData\Local\Minibar\chrome\kango\initialize.js</div>

<div>c:\users\Home\AppData\Local\Minibar\chrome\kango\io.js</div>

<div>c:\users\Home\AppData\Local\Minibar\chrome\kango\jsonstorage.js</div>

<div>c:\users\Home\AppData\Local\Minibar\chrome\kango\kango.js</div>

<div>c:\users\Home\AppData\Local\Minibar\chrome\kango\lang.js</div>

<div>c:\users\Home\AppData\Local\Minibar\chrome\kango\messaging.js</div>

<div>c:\users\Home\AppData\Local\Minibar\chrome\kango\userscript_engine.js</div>

<div>c:\users\Home\AppData\Local\Minibar\chrome\kango\xhr.js</div>

<div>c:\users\Home\AppData\Local\Minibar\chrome\main.js</div>

<div>c:\users\Home\AppData\Local\Minibar\chrome\manifest.json</div>

<div>c:\users\Home\AppData\Local\Minibar\chrome\minibar\actions.js</div>

<div>c:\users\Home\AppData\Local\Minibar\chrome\minibar\cachedxhr.js</div>

<div>c:\users\Home\AppData\Local\Minibar\chrome\minibar\config.js</div>

<div>c:\users\Home\AppData\Local\Minibar\chrome\minibar\macros.js</div>

<div>c:\users\Home\AppData\Local\Minibar\chrome\minibar\minibar.js</div>

<div>c:\users\Home\AppData\Local\Minibar\chrome\popup.html</div>

<div>c:\users\Home\AppData\Local\Minibar\chrome\popup.js</div>

<div>c:\users\Home\AppData\Local\Minibar\chrome\tab.html</div>

<div>c:\users\Home\AppData\Local\Minibar\chrome\tab.js</div>

<div>c:\users\Home\AppData\Local\Minibar\chrome_installer.js</div>

<div>c:\users\Home\AppData\Local\Minibar\common.js</div>

<div>c:\users\Home\AppData\Local\Minibar\install.json</div>

<div>c:\users\Home\AppData\Local\Minibar\minibar.crx</div>

<div>c:\users\Home\AppData\Local\Minibar\sqlite3.exe</div>

<div>c:\users\Home\AppData\Local\Minibar\Uninstall.exe</div>

<div>c:\users\Home\AppData\Local\tempdata.dat</div>

<div>c:\users\Home\AppData\Roaming\515731.exe_fhzxk</div>

<div>c:\users\Home\AppData\Roaming\815863.exe_ohjfx</div>

<div>c:\users\Home\AppData\Roaming\870947.exe_rpopv</div>

<div>c:\users\Home\AppData\Roaming\Atyhy</div>

<div>c:\users\Home\AppData\Roaming\Atyhy\sapoy.akd</div>

<div>c:\users\Home\AppData\Roaming\bat99.bat</div>

<div>c:\users\Home\AppData\Roaming\cglogs.dat</div>

<div>c:\users\Home\AppData\Roaming\chrtmp</div>

<div>c:\users\Home\AppData\Roaming\Directory</div>

<div>c:\users\Home\AppData\Roaming\Enebu</div>

<div>c:\users\Home\AppData\Roaming\Enebu\keavz.qop</div>

<div>c:\users\Home\AppData\Roaming\Ezda</div>

<div>c:\users\Home\AppData\Roaming\Ezda\imxic.fea</div>

<div>c:\users\Home\AppData\Roaming\Home3SQLite3.dll</div>

<div>c:\users\Home\AppData\Roaming\Homelog.dat</div>

<div>c:\users\Home\AppData\Roaming\Local</div>

<div>c:\users\Home\AppData\Roaming\Microsoft\MSConfig.exe</div>

<div>c:\users\Home\AppData\Roaming\Microsoft\UK749IA3GJ.exe</div>

<div>c:\users\Home\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\tmp56CF.tmp.exe</div>

<div>c:\users\Home\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\tmp575B.tmp.exe</div>

<div>c:\users\Home\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\tmp57B8.tmp.exe</div>

<div>c:\users\Home\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\tmpD743.tmp.exe</div>

<div>c:\users\Home\AppData\Roaming\Mozilla\Firefox\Profiles\5ecd5axt.default\extensions\crossriderapp2258@crossrider.com</div>

<div>c:\users\Home\AppData\Roaming\Mozilla\Firefox\Profiles\5ecd5axt.default\extensions\crossriderapp2258@crossrider.com\chrome.manifest</div>

<div>c:\users\Home\AppData\Roaming\Mozilla\Firefox\Profiles\5ecd5axt.default\extensions\crossriderapp2258@crossrider.com\chrome\content\background.html</div>

<div>c:\users\Home\AppData\Roaming\Mozilla\Firefox\Profiles\5ecd5axt.default\extensions\crossriderapp2258@crossrider.com\chrome\content\browser.xul</div>

<div>c:\users\Home\AppData\Roaming\Mozilla\Firefox\Profiles\5ecd5axt.default\extensions\crossriderapp2258@crossrider.com\chrome\content\crossrider.js</div>

<div>c:\users\Home\AppData\Roaming\Mozilla\Firefox\Profiles\5ecd5axt.default\extensions\crossriderapp2258@crossrider.com\chrome\content\crossriderapi.js</div>

<div>c:\users\Home\AppData\Roaming\Mozilla\Firefox\Profiles\5ecd5axt.default\extensions\crossriderapp2258@crossrider.com\chrome\content\dialog.js</div>

<div>c:\users\Home\AppData\Roaming\Mozilla\Firefox\Profiles\5ecd5axt.default\extensions\crossriderapp2258@crossrider.com\chrome\content\options.js</div>

<div>c:\users\Home\AppData\Roaming\Mozilla\Firefox\Profiles\5ecd5axt.default\extensions\crossriderapp2258@crossrider.com\chrome\content\options.xul</div>

<div>c:\users\Home\AppData\Roaming\Mozilla\Firefox\Profiles\5ecd5axt.default\extensions\crossriderapp2258@crossrider.com\chrome\content\search_dialog.xul</div>

<div>c:\users\Home\AppData\Roaming\Mozilla\Firefox\Profiles\5ecd5axt.default\extensions\crossriderapp2258@crossrider.com\chrome\content\update.html</div>

<div>c:\users\Home\AppData\Roaming\Mozilla\Firefox\Profiles\5ecd5axt.default\extensions\crossriderapp2258@crossrider.com\defaults\preferences\prefs.js</div>

<div>c:\users\Home\AppData\Roaming\Mozilla\Firefox\Profiles\5ecd5axt.default\extensions\crossriderapp2258@crossrider.com\install.rdf</div>

<div>c:\users\Home\AppData\Roaming\Mozilla\Firefox\Profiles\5ecd5axt.default\extensions\crossriderapp2258@crossrider.com\locale\en-US\translations.dtd</div>

<div>c:\users\Home\AppData\Roaming\Mozilla\Firefox\Profiles\5ecd5axt.default\extensions\crossriderapp2258@crossrider.com\skin\button1.png</div>

<div>c:\users\Home\AppData\Roaming\Mozilla\Firefox\Profiles\5ecd5axt.default\extensions\crossriderapp2258@crossrider.com\skin\button2.png</div>

<div>c:\users\Home\AppData\Roaming\Mozilla\Firefox\Profiles\5ecd5axt.default\extensions\crossriderapp2258@crossrider.com\skin\button3.png</div>

<div>c:\users\Home\AppData\Roaming\Mozilla\Firefox\Profiles\5ecd5axt.default\extensions\crossriderapp2258@crossrider.com\skin\button4.png</div>

<div>c:\users\Home\AppData\Roaming\Mozilla\Firefox\Profiles\5ecd5axt.default\extensions\crossriderapp2258@crossrider.com\skin\button5.png</div>

<div>c:\users\Home\AppData\Roaming\Mozilla\Firefox\Profiles\5ecd5axt.default\extensions\crossriderapp2258@crossrider.com\skin\crossrider_statusbar.png</div>

<div>c:\users\Home\AppData\Roaming\Mozilla\Firefox\Profiles\5ecd5axt.default\extensions\crossriderapp2258@crossrider.com\skin\icon128.png</div>

<div>c:\users\Home\AppData\Roaming\Mozilla\Firefox\Profiles\5ecd5axt.default\extensions\crossriderapp2258@crossrider.com\skin\icon16.png</div>

<div>c:\users\Home\AppData\Roaming\Mozilla\Firefox\Profiles\5ecd5axt.default\extensions\crossriderapp2258@crossrider.com\skin\icon24.png</div>

<div>c:\users\Home\AppData\Roaming\Mozilla\Firefox\Profiles\5ecd5axt.default\extensions\crossriderapp2258@crossrider.com\skin\icon48.png</div>

<div>c:\users\Home\AppData\Roaming\Mozilla\Firefox\Profiles\5ecd5axt.default\extensions\crossriderapp2258@crossrider.com\skin\panelarrow-up.png</div>

<div>c:\users\Home\AppData\Roaming\Mozilla\Firefox\Profiles\5ecd5axt.default\extensions\crossriderapp2258@crossrider.com\skin\popup.html</div>

<div>c:\users\Home\AppData\Roaming\Mozilla\Firefox\Profiles\5ecd5axt.default\extensions\crossriderapp2258@crossrider.com\skin\popup_binding.xml</div>

<div>c:\users\Home\AppData\Roaming\Mozilla\Firefox\Profiles\5ecd5axt.default\extensions\crossriderapp2258@crossrider.com\skin\skin.css</div>

<div>c:\users\Home\AppData\Roaming\Mozilla\Firefox\Profiles\5ecd5axt.default\extensions\crossriderapp2258@crossrider.com\skin\update.css</div>

<div>c:\users\Home\AppData\Roaming\Mozilla\Firefox\Profiles\5ecd5axt.default\searchplugins\bing-zugo.xml</div>

<div>c:\users\Home\AppData\Roaming\MSWINSCK.OCX</div>

<div>c:\users\Home\AppData\Roaming\oomnq</div>

<div>c:\users\Home\AppData\Roaming\Runescape</div>

<div>c:\users\Home\AppData\Roaming\SQLite3.dll</div>

<div>c:\users\Home\AppData\Roaming\System\Client.exe</div>

<div>c:\users\Home\AppData\Roaming\taskmgr.exe_calgf</div>

<div>c:\users\Home\AppData\Roaming\Vori</div>

<div>c:\users\Home\AppData\Roaming\Vori\ivbe.idy</div>

<div>c:\users\Home\AppData\Roaming\Windir</div>

<div>c:\users\Home\AppData\Roaming\WinDir\Svchost22.exe</div>

<div>c:\users\Home\AppData\Roaming\WinDir\update.exe</div>

<div>c:\users\Home\AppData\Roaming\WindowsDef</div>

<div>c:\users\Home\AppData\Roaming\WindowsDefender</div>

<div>c:\users\Home\AppData\Roaming\Windowsupdate</div>

<div>c:\users\Home\AppData\Roaming\Wyir</div>

<div>c:\users\Home\AppData\Roaming\Wyir\zeez.ofg</div>

<div>c:\users\Home\Documents\DCSCMIN</div>

<div>c:\users\Home\fdfix.exe</div>

<div>c:\users\legendkilla\AppData\Local\Microsoft\Windows\Temporary Internet Files\cookies.sqlite</div>

<div>c:\windows\SysWow64\pt</div>

<div>c:\windows\SysWow64\pt\Lagoon.resources.dll</div>

<div>C:\Windupdt</div>

<div>.</div>

<div>.</div>

<div>(((((((((((((((((((((((((((((((((((((((   Drivers/Services   )))))))))))))))))))))))))))))))))))))))))))))))))</div>

<div>.</div>

<div>.</div>

<div>-------\Service_ACPIService</div>

<div>.</div>

<div>.</div>

<div>(((((((((((((((((((((((((   Files Created from 2012-06-25 to 2012-07-25  )))))))))))))))))))))))))))))))</div>

<div>.</div>

<div>.</div>

<div>2012-07-25 18:54 . 2012-07-25 18:54<span class="Apple-tab-span" style="white-space:pre"> </span>--------<span class="Apple-tab-span" style="white-space:pre"> </span>d-----w-<span class="Apple-tab-span" style="white-space:pre"> </span>c:\users\Sadeeeee !\AppData\Local\temp</div>

<div>2012-07-25 18:54 . 2012-07-25 18:54<span class="Apple-tab-span" style="white-space:pre"> </span>--------<span class="Apple-tab-span" style="white-space:pre"> </span>d-----w-<span class="Apple-tab-span" style="white-space:pre"> </span>c:\users\Default\AppData\Local\temp</div>

<div>2012-07-25 18:54 . 2012-07-25 18:54<span class="Apple-tab-span" style="white-space:pre"> </span>--------<span class="Apple-tab-span" style="white-space:pre"> </span>d-----w-<span class="Apple-tab-span" style="white-space:pre"> </span>c:\users\legendkilla\AppData\Local\temp</div>

<div>2012-07-25 06:09 . 2012-02-09 18:17<span class="Apple-tab-span" style="white-space:pre"> </span>927800<span class="Apple-tab-span" style="white-space:pre"> </span>----a-w-<span class="Apple-tab-span" style="white-space:pre"> </span>c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{30B4B512-7344-4682-A943-B2479050CAC3}\gapaengine.dll</div>

<div>2012-07-25 06:06 . 2012-07-16 06:40<span class="Apple-tab-span" style="white-space:pre"> </span>9133488<span class="Apple-tab-span" style="white-space:pre"> </span>----a-w-<span class="Apple-tab-span" style="white-space:pre"> </span>c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{F61F14C5-22D3-45E3-AA35-24F7C41B35E4}\mpengine.dll</div>

<div>2012-07-25 05:58 . 2012-07-25 05:58<span class="Apple-tab-span" style="white-space:pre"> </span>--------<span class="Apple-tab-span" style="white-space:pre"> </span>d-----w-<span class="Apple-tab-span" style="white-space:pre"> </span>c:\program files (x86)\Microsoft Security Client</div>

<div>2012-07-25 05:57 . 2012-07-25 06:01<span class="Apple-tab-span" style="white-space:pre"> </span>--------<span class="Apple-tab-span" style="white-space:pre"> </span>d-----w-<span class="Apple-tab-span" style="white-space:pre"> </span>c:\program files\Microsoft Security Client</div>

<div>2012-07-25 05:30 . 2012-06-29 10:04<span class="Apple-tab-span" style="white-space:pre"> </span>9133488<span class="Apple-tab-span" style="white-space:pre"> </span>----a-w-<span class="Apple-tab-span" style="white-space:pre"> </span>c:\programdata\Microsoft\Windows Defender\Definition Updates\{B72DCDF5-3547-4E75-907B-2118B74F71B4}\mpengine.dll</div>

<div>2012-07-25 02:22 . 2012-07-25 02:22<span class="Apple-tab-span" style="white-space:pre"> </span>--------<span class="Apple-tab-span" style="white-space:pre"> </span>d-----w-<span class="Apple-tab-span" style="white-space:pre"> </span>c:\users\Home\AppData\Roaming\Malwarebytes</div>

<div>2012-07-25 02:22 . 2012-07-25 02:22<span class="Apple-tab-span" style="white-space:pre"> </span>--------<span class="Apple-tab-span" style="white-space:pre"> </span>d-----w-<span class="Apple-tab-span" style="white-space:pre"> </span>c:\programdata\Malwarebytes</div>

<div>2012-07-25 02:22 . 2012-07-03 17:46<span class="Apple-tab-span" style="white-space:pre"> </span>24904<span class="Apple-tab-span" style="white-space:pre"> </span>----a-w-<span class="Apple-tab-span" style="white-space:pre"> </span>c:\windows\system32\drivers\mbam.sys</div>

<div>2012-07-25 02:22 . 2012-07-25 02:22<span class="Apple-tab-span" style="white-space:pre"> </span>--------<span class="Apple-tab-span" style="white-space:pre"> </span>d-----w-<span class="Apple-tab-span" style="white-space:pre"> </span>c:\program files (x86)\Malwarebytes' Anti-Malware</div>

<div>2012-07-13 22:46 . 2012-07-13 22:46<span class="Apple-tab-span" style="white-space:pre"> </span>--------<span class="Apple-tab-span" style="white-space:pre"> </span>d-----w-<span class="Apple-tab-span" style="white-space:pre"> </span>c:\users\Home\AppData\Local\Macromedia</div>

<div>2012-07-13 18:27 . 2012-07-13 18:27<span class="Apple-tab-span" style="white-space:pre"> </span>9226440<span class="Apple-tab-span" style="white-space:pre"> </span>----a-w-<span class="Apple-tab-span" style="white-space:pre"> </span>c:\windows\SysWow64\FlashPlayerInstaller.exe</div>

<div>2012-07-13 17:31 . 2012-07-13 18:27<span class="Apple-tab-span" style="white-space:pre"> </span>426184<span class="Apple-tab-span" style="white-space:pre"> </span>----a-w-<span class="Apple-tab-span" style="white-space:pre"> </span>c:\windows\SysWow64\FlashPlayerApp.exe</div>

<div>2012-07-13 17:31 . 2012-07-13 17:31<span class="Apple-tab-span" style="white-space:pre"> </span>--------<span class="Apple-tab-span" style="white-space:pre"> </span>d-----w-<span class="Apple-tab-span" style="white-space:pre"> </span>c:\windows\system32\Macromed</div>

<div>2012-07-12 07:06 . 2012-06-12 03:08<span class="Apple-tab-span" style="white-space:pre"> </span>3148800<span class="Apple-tab-span" style="white-space:pre"> </span>----a-w-<span class="Apple-tab-span" style="white-space:pre"> </span>c:\windows\system32\win32k.sys</div>

<div>2012-07-07 04:54 . 2012-07-07 04:54<span class="Apple-tab-span" style="white-space:pre"> </span>--------<span class="Apple-tab-span" style="white-space:pre"> </span>d-----w-<span class="Apple-tab-span" style="white-space:pre"> </span>c:\programdata\Steam</div>

<div>2012-07-07 04:54 . 2012-07-07 04:55<span class="Apple-tab-span" style="white-space:pre"> </span>--------<span class="Apple-tab-span" style="white-space:pre"> </span>d-----w-<span class="Apple-tab-span" style="white-space:pre"> </span>c:\programdata\PopCap Games</div>

<div>2012-07-04 17:24 . 2012-07-04 17:24<span class="Apple-tab-span" style="white-space:pre"> </span>--------<span class="Apple-tab-span" style="white-space:pre"> </span>d-----w-<span class="Apple-tab-span" style="white-space:pre"> </span>c:\programdata\McAfee Security Scan</div>

<div>2012-07-04 17:24 . 2012-07-05 19:14<span class="Apple-tab-span" style="white-space:pre"> </span>--------<span class="Apple-tab-span" style="white-space:pre"> </span>d-----w-<span class="Apple-tab-span" style="white-space:pre"> </span>c:\program files (x86)\McAfee Security Scan</div>

<div>2012-07-04 17:24 . 2012-07-04 17:24<span class="Apple-tab-span" style="white-space:pre"> </span>--------<span class="Apple-tab-span" style="white-space:pre"> </span>d-----w-<span class="Apple-tab-span" style="white-space:pre"> </span>c:\program files (x86)\Common Files\Java</div>

<div>2012-07-04 17:23 . 2012-07-04 17:23<span class="Apple-tab-span" style="white-space:pre"> </span>--------<span class="Apple-tab-span" style="white-space:pre"> </span>d-----w-<span class="Apple-tab-span" style="white-space:pre"> </span>c:\program files (x86)\Oracle</div>

<div>2012-07-04 17:23 . 2012-05-04 23:29<span class="Apple-tab-span" style="white-space:pre"> </span>772504<span class="Apple-tab-span" style="white-space:pre"> </span>----a-w-<span class="Apple-tab-span" style="white-space:pre"> </span>c:\windows\SysWow64\npDeployJava1.dll</div>

<div>2012-07-03 03:22 . 2012-07-03 03:22<span class="Apple-tab-span" style="white-space:pre"> </span>--------<span class="Apple-tab-span" style="white-space:pre"> </span>d-----w-<span class="Apple-tab-span" style="white-space:pre"> </span>c:\users\Home\AppData\Local\Downloaded Installations</div>

<div>2012-07-03 03:21 . 2010-06-02 08:55<span class="Apple-tab-span" style="white-space:pre"> </span>239960<span class="Apple-tab-span" style="white-space:pre"> </span>----a-w-<span class="Apple-tab-span" style="white-space:pre"> </span>c:\windows\SysWow64\xactengine3_7.dll</div>

<div>2012-07-03 03:21 . 2010-06-02 08:55<span class="Apple-tab-span" style="white-space:pre"> </span>176984<span class="Apple-tab-span" style="white-space:pre"> </span>----a-w-<span class="Apple-tab-span" style="white-space:pre"> </span>c:\windows\system32\xactengine3_7.dll</div>

<div>2012-07-03 03:21 . 2010-05-26 15:41<span class="Apple-tab-span" style="white-space:pre"> </span>1907552<span class="Apple-tab-span" style="white-space:pre"> </span>----a-w-<span class="Apple-tab-span" style="white-space:pre"> </span>c:\windows\system32\d3dcsx_43.dll</div>

<div>2012-07-03 03:21 . 2010-05-26 15:41<span class="Apple-tab-span" style="white-space:pre"> </span>1868128<span class="Apple-tab-span" style="white-space:pre"> </span>----a-w-<span class="Apple-tab-span" style="white-space:pre"> </span>c:\windows\SysWow64\d3dcsx_43.dll</div>

<div>2012-07-03 03:21 . 2010-02-04 14:01<span class="Apple-tab-span" style="white-space:pre"> </span>78680<span class="Apple-tab-span" style="white-space:pre"> </span>----a-w-<span class="Apple-tab-span" style="white-space:pre"> </span>c:\windows\system32\XAPOFX1_4.dll</div>

<div>2012-07-03 03:21 . 2010-02-04 14:01<span class="Apple-tab-span" style="white-space:pre"> </span>74072<span class="Apple-tab-span" style="white-space:pre"> </span>----a-w-<span class="Apple-tab-span" style="white-space:pre"> </span>c:\windows\SysWow64\XAPOFX1_4.dll</div>

<div>2012-07-03 03:21 . 2010-02-04 14:01<span class="Apple-tab-span" style="white-space:pre"> </span>530776<span class="Apple-tab-span" style="white-space:pre"> </span>----a-w-<span class="Apple-tab-span" style="white-space:pre"> </span>c:\windows\system32\XAudio2_6.dll</div>

<div>2012-07-03 03:21 . 2010-02-04 14:01<span class="Apple-tab-span" style="white-space:pre"> </span>528216<span class="Apple-tab-span" style="white-space:pre"> </span>----a-w-<span class="Apple-tab-span" style="white-space:pre"> </span>c:\windows\SysWow64\XAudio2_6.dll</div>

<div>2012-07-03 03:21 . 2010-02-04 14:01<span class="Apple-tab-span" style="white-space:pre"> </span>238936<span class="Apple-tab-span" style="white-space:pre"> </span>----a-w-<span class="Apple-tab-span" style="white-space:pre"> </span>c:\windows\SysWow64\xactengine3_6.dll</div>

<div>2012-07-03 03:21 . 2010-02-04 14:01<span class="Apple-tab-span" style="white-space:pre"> </span>176984<span class="Apple-tab-span" style="white-space:pre"> </span>----a-w-<span class="Apple-tab-span" style="white-space:pre"> </span>c:\windows\system32\xactengine3_6.dll</div>

<div>2012-07-02 16:39 . 2012-07-02 16:39<span class="Apple-tab-span" style="white-space:pre"> </span>--------<span class="Apple-tab-span" style="white-space:pre"> </span>d-----w-<span class="Apple-tab-span" style="white-space:pre"> </span>c:\users\Home\AppData\Roaming\.techniclauncher</div>

<div>2012-07-01 21:41 . 2012-07-01 21:41<span class="Apple-tab-span" style="white-space:pre"> </span>--------<span class="Apple-tab-span" style="white-space:pre"> </span>d-----w-<span class="Apple-tab-span" style="white-space:pre"> </span>c:\users\Home\AppData\Local\.inapptracking</div>

<div>2012-07-01 07:17 . 2012-07-01 07:17<span class="Apple-tab-span" style="white-space:pre"> </span>--------<span class="Apple-tab-span" style="white-space:pre"> </span>d-----w-<span class="Apple-tab-span" style="white-space:pre"> </span>c:\users\Home\AppData\Roaming\Warner Bros. Interactive Entertainment</div>

<div>2012-07-01 05:46 . 2010-06-02 08:55<span class="Apple-tab-span" style="white-space:pre"> </span>77656<span class="Apple-tab-span" style="white-space:pre"> </span>----a-w-<span class="Apple-tab-span" style="white-space:pre"> </span>c:\windows\system32\XAPOFX1_5.dll</div>

<div>2012-07-01 05:46 . 2010-06-02 08:55<span class="Apple-tab-span" style="white-space:pre"> </span>74072<span class="Apple-tab-span" style="white-space:pre"> </span>----a-w-<span class="Apple-tab-span" style="white-space:pre"> </span>c:\windows\SysWow64\XAPOFX1_5.dll</div>

<div>2012-07-01 05:46 . 2010-06-02 08:55<span class="Apple-tab-span" style="white-space:pre"> </span>527192<span class="Apple-tab-span" style="white-space:pre"> </span>----a-w-<span class="Apple-tab-span" style="white-space:pre"> </span>c:\windows\SysWow64\XAudio2_7.dll</div>

<div>2012-07-01 05:46 . 2010-06-02 08:55<span class="Apple-tab-span" style="white-space:pre"> </span>518488<span class="Apple-tab-span" style="white-space:pre"> </span>----a-w-<span class="Apple-tab-span" style="white-space:pre"> </span>c:\windows\system32\XAudio2_7.dll</div>

<div>2012-07-01 05:46 . 2010-05-26 15:41<span class="Apple-tab-span" style="white-space:pre"> </span>276832<span class="Apple-tab-span" style="white-space:pre"> </span>----a-w-<span class="Apple-tab-span" style="white-space:pre"> </span>c:\windows\system32\d3dx11_43.dll</div>

<div>2012-07-01 05:46 . 2010-05-26 15:41<span class="Apple-tab-span" style="white-space:pre"> </span>2526056<span class="Apple-tab-span" style="white-space:pre"> </span>----a-w-<span class="Apple-tab-span" style="white-space:pre"> </span>c:\windows\system32\D3DCompiler_43.dll</div>

<div>2012-07-01 05:46 . 2010-05-26 15:41<span class="Apple-tab-span" style="white-space:pre"> </span>248672<span class="Apple-tab-span" style="white-space:pre"> </span>----a-w-<span class="Apple-tab-span" style="white-space:pre"> </span>c:\windows\SysWow64\d3dx11_43.dll</div>

<div>2012-07-01 05:46 . 2010-05-26 15:41<span class="Apple-tab-span" style="white-space:pre"> </span>511328<span class="Apple-tab-span" style="white-space:pre"> </span>----a-w-<span class="Apple-tab-span" style="white-space:pre"> </span>c:\windows\system32\d3dx10_43.dll</div>

<div>2012-07-01 05:46 . 2010-05-26 15:41<span class="Apple-tab-span" style="white-space:pre"> </span>470880<span class="Apple-tab-span" style="white-space:pre"> </span>----a-w-<span class="Apple-tab-span" style="white-space:pre"> </span>c:\windows\SysWow64\d3dx10_43.dll</div>

<div>2012-07-01 05:46 . 2010-05-26 15:41<span class="Apple-tab-span" style="white-space:pre"> </span>2401112<span class="Apple-tab-span" style="white-space:pre"> </span>----a-w-<span class="Apple-tab-span" style="white-space:pre"> </span>c:\windows\system32\D3DX9_43.dll</div>

<div>2012-07-01 05:46 . 2010-02-04 14:01<span class="Apple-tab-span" style="white-space:pre"> </span>24920<span class="Apple-tab-span" style="white-space:pre"> </span>----a-w-<span class="Apple-tab-span" style="white-space:pre"> </span>c:\windows\system32\X3DAudio1_7.dll</div>

<div>2012-07-01 05:46 . 2010-02-04 14:01<span class="Apple-tab-span" style="white-space:pre"> </span>22360<span class="Apple-tab-span" style="white-space:pre"> </span>----a-w-<span class="Apple-tab-span" style="white-space:pre"> </span>c:\windows\SysWow64\X3DAudio1_7.dll</div>

<div>2012-06-30 18:21 . 2012-06-30 18:21<span class="Apple-tab-span" style="white-space:pre"> </span>466456<span class="Apple-tab-span" style="white-space:pre"> </span>----a-w-<span class="Apple-tab-span" style="white-space:pre"> </span>c:\windows\system32\wrap_oal.dll</div>

<div>2012-06-30 18:21 . 2012-06-30 18:21<span class="Apple-tab-span" style="white-space:pre"> </span>122904<span class="Apple-tab-span" style="white-space:pre"> </span>----a-w-<span class="Apple-tab-span" style="white-space:pre"> </span>c:\windows\system32\OpenAL32.dll</div>

<div>2012-06-30 18:21 . 2012-06-30 18:21<span class="Apple-tab-span" style="white-space:pre"> </span>--------<span class="Apple-tab-span" style="white-space:pre"> </span>d-----w-<span class="Apple-tab-span" style="white-space:pre"> </span>c:\program files (x86)\OpenAL</div>

<div>2012-06-30 18:21 . 2012-06-30 18:21<span class="Apple-tab-span" style="white-space:pre"> </span>444952<span class="Apple-tab-span" style="white-space:pre"> </span>----a-w-<span class="Apple-tab-span" style="white-space:pre"> </span>c:\windows\SysWow64\wrap_oal.dll</div>

<div>2012-06-30 18:21 . 2012-06-30 18:21<span class="Apple-tab-span" style="white-space:pre"> </span>109080<span class="Apple-tab-span" style="white-space:pre"> </span>----a-w-<span class="Apple-tab-span" style="white-space:pre"> </span>c:\windows\SysWow64\OpenAL32.dll</div>

<div>2012-06-30 16:03 . 2010-05-26 15:41<span class="Apple-tab-span" style="white-space:pre"> </span>2106216<span class="Apple-tab-span" style="white-space:pre"> </span>----a-w-<span class="Apple-tab-span" style="white-space:pre"> </span>c:\windows\SysWow64\D3DCompiler_43.dll</div>

<div>2012-06-30 16:03 . 2010-05-26 15:41<span class="Apple-tab-span" style="white-space:pre"> </span>1998168<span class="Apple-tab-span" style="white-space:pre"> </span>----a-w-<span class="Apple-tab-span" style="white-space:pre"> </span>c:\windows\SysWow64\D3DX9_43.dll</div>

<div>2012-06-29 22:03 . 2012-06-29 22:03<span class="Apple-tab-span" style="white-space:pre"> </span>--------<span class="Apple-tab-span" style="white-space:pre"> </span>d-----w-<span class="Apple-tab-span" style="white-space:pre"> </span>c:\users\legendkilla\AppData\Local\Symantec</div>

<div>2012-06-28 19:47 . 2012-06-28 19:47<span class="Apple-tab-span" style="white-space:pre"> </span>--------<span class="Apple-tab-span" style="white-space:pre"> </span>d-----w-<span class="Apple-tab-span" style="white-space:pre"> </span>c:\users\Home\AppData\Roaming\RotMG.Production</div>

<div>2012-06-27 13:26 . 2012-06-27 13:26<span class="Apple-tab-span" style="white-space:pre"> </span>770384<span class="Apple-tab-span" style="white-space:pre"> </span>----a-w-<span class="Apple-tab-span" style="white-space:pre"> </span>c:\program files (x86)\Mozilla Firefox\msvcr100.dll</div>

<div>2012-06-27 13:26 . 2012-06-27 13:26<span class="Apple-tab-span" style="white-space:pre"> </span>421200<span class="Apple-tab-span" style="white-space:pre"> </span>----a-w-<span class="Apple-tab-span" style="white-space:pre"> </span>c:\program files (x86)\Mozilla Firefox\msvcp100.dll</div>

<div>.</div>

<div>.</div>

<div>.</div>

<div>((((((((((((((((((((((((((((((((((((((((   Find3M Report   ))))))))))))))))))))))))))))))))))))))))))))))))))))</div>

<div>.</div>

<div>2012-07-13 18:27 . 2011-06-06 20:47<span class="Apple-tab-span" style="white-space:pre"> </span>70344<span class="Apple-tab-span" style="white-space:pre"> </span>----a-w-<span class="Apple-tab-span" style="white-space:pre"> </span>c:\windows\SysWow64\FlashPlayerCPLApp.cpl</div>

<div>2012-07-12 07:01 . 2010-07-28 22:26<span class="Apple-tab-span" style="white-space:pre"> </span>59701280<span class="Apple-tab-span" style="white-space:pre"> </span>----a-w-<span class="Apple-tab-span" style="white-space:pre"> </span>c:\windows\system32\MRT.exe</div>

<div>2012-06-02 22:19 . 2012-06-23 09:19<span class="Apple-tab-span" style="white-space:pre"> </span>38424<span class="Apple-tab-span" style="white-space:pre"> </span>----a-w-<span class="Apple-tab-span" style="white-space:pre"> </span>c:\windows\system32\wups.dll</div>

<div>2012-06-02 22:19 . 2012-06-23 09:26<span class="Apple-tab-span" style="white-space:pre"> </span>2428952<span class="Apple-tab-span" style="white-space:pre"> </span>----a-w-<span class="Apple-tab-span" style="white-space:pre"> </span>c:\windows\system32\wuaueng.dll</div>

<div>2012-06-02 22:19 . 2012-06-23 09:26<span class="Apple-tab-span" style="white-space:pre"> </span>57880<span class="Apple-tab-span" style="white-space:pre"> </span>----a-w-<span class="Apple-tab-span" style="white-space:pre"> </span>c:\windows\system32\wuauclt.exe</div>

<div>2012-06-02 22:19 . 2012-06-23 09:26<span class="Apple-tab-span" style="white-space:pre"> </span>44056<span class="Apple-tab-span" style="white-space:pre"> </span>----a-w-<span class="Apple-tab-span" style="white-space:pre"> </span>c:\windows\system32\wups2.dll</div>

<div>2012-06-02 22:19 . 2012-06-23 09:19<span class="Apple-tab-span" style="white-space:pre"> </span>701976<span class="Apple-tab-span" style="white-space:pre"> </span>----a-w-<span class="Apple-tab-span" style="white-space:pre"> </span>c:\windows\system32\wuapi.dll</div>

<div>2012-06-02 22:15 . 2012-06-23 09:26<span class="Apple-tab-span" style="white-space:pre"> </span>2622464<span class="Apple-tab-span" style="white-space:pre"> </span>----a-w-<span class="Apple-tab-span" style="white-space:pre"> </span>c:\windows\system32\wucltux.dll</div>

<div>2012-06-02 22:15 . 2012-06-23 09:19<span class="Apple-tab-span" style="white-space:pre"> </span>99840<span class="Apple-tab-span" style="white-space:pre"> </span>----a-w-<span class="Apple-tab-span" style="white-space:pre"> </span>c:\windows\system32\wudriver.dll</div>

<div>2012-06-02 19:19 . 2012-06-23 09:16<span class="Apple-tab-span" style="white-space:pre"> </span>186752<span class="Apple-tab-span" style="white-space:pre"> </span>----a-w-<span class="Apple-tab-span" style="white-space:pre"> </span>c:\windows\system32\wuwebv.dll</div>

<div>2012-06-02 19:15 . 2012-06-23 09:16<span class="Apple-tab-span" style="white-space:pre"> </span>36864<span class="Apple-tab-span" style="white-space:pre"> </span>----a-w-<span class="Apple-tab-span" style="white-space:pre"> </span>c:\windows\system32\wuapp.exe</div>

<div>2012-05-31 16:25 . 2010-07-07 02:24<span class="Apple-tab-span" style="white-space:pre"> </span>279656<span class="Apple-tab-span" style="white-space:pre"> </span>------w-<span class="Apple-tab-span" style="white-space:pre"> </span>c:\windows\system32\MpSigStub.exe</div>

<div>2012-05-30 02:20 . 2012-05-30 02:20<span class="Apple-tab-span" style="white-space:pre"> </span>163048<span class="Apple-tab-span" style="white-space:pre"> </span>----a-w-<span class="Apple-tab-span" style="white-space:pre"> </span>c:\programdata\Microsoft\Windows\Sqm\Manifest\Sqm10141.bin</div>

<div>2012-05-15 04:01 . 2012-06-13 08:05<span class="Apple-tab-span" style="white-space:pre"> </span>1188864<span class="Apple-tab-span" style="white-space:pre"> </span>----a-w-<span class="Apple-tab-span" style="white-space:pre"> </span>c:\windows\system32\wininet.dll</div>

<div>2012-05-15 03:59 . 2012-06-13 08:05<span class="Apple-tab-span" style="white-space:pre"> </span>64512<span class="Apple-tab-span" style="white-space:pre"> </span>----a-w-<span class="Apple-tab-span" style="white-space:pre"> </span>c:\windows\system32\jsproxy.dll</div>

<div>2012-05-15 03:03 . 2012-06-13 08:05<span class="Apple-tab-span" style="white-space:pre"> </span>981504<span class="Apple-tab-span" style="white-space:pre"> </span>----a-w-<span class="Apple-tab-span" style="white-space:pre"> </span>c:\windows\SysWow64\wininet.dll</div>

<div>2012-05-14 22:33 . 2012-05-14 22:33<span class="Apple-tab-span" style="white-space:pre"> </span>172592<span class="Apple-tab-span" style="white-space:pre"> </span>----a-w-<span class="Apple-tab-span" style="white-space:pre"> </span>c:\windows\system32\drivers\SYMEVENT64x86.SYS</div>

<div>2012-05-04 23:29 . 2010-09-14 22:37<span class="Apple-tab-span" style="white-space:pre"> </span>687504<span class="Apple-tab-span" style="white-space:pre"> </span>----a-w-<span class="Apple-tab-span" style="white-space:pre"> </span>c:\windows\SysWow64\deployJava1.dll</div>

<div>2012-05-04 11:06 . 2012-06-13 08:05<span class="Apple-tab-span" style="white-space:pre"> </span>5559664<span class="Apple-tab-span" style="white-space:pre"> </span>----a-w-<span class="Apple-tab-span" style="white-space:pre"> </span>c:\windows\system32\ntoskrnl.exe</div>

<div>2012-05-04 10:03 . 2012-06-13 08:05<span class="Apple-tab-span" style="white-space:pre"> </span>3968368<span class="Apple-tab-span" style="white-space:pre"> </span>----a-w-<span class="Apple-tab-span" style="white-space:pre"> </span>c:\windows\SysWow64\ntkrnlpa.exe</div>

<div>2012-05-04 10:03 . 2012-06-13 08:05<span class="Apple-tab-span" style="white-space:pre"> </span>3913072<span class="Apple-tab-span" style="white-space:pre"> </span>----a-w-<span class="Apple-tab-span" style="white-space:pre"> </span>c:\windows\SysWow64\ntoskrnl.exe</div>

<div>2012-05-01 05:40 . 2012-06-13 08:05<span class="Apple-tab-span" style="white-space:pre"> </span>209920<span class="Apple-tab-span" style="white-space:pre"> </span>----a-w-<span class="Apple-tab-span" style="white-space:pre"> </span>c:\windows\system32\profsvc.dll</div>

<div>2012-04-28 03:55 . 2012-06-13 08:05<span class="Apple-tab-span" style="white-space:pre"> </span>210944<span class="Apple-tab-span" style="white-space:pre"> </span>----a-w-<span class="Apple-tab-span" style="white-space:pre"> </span>c:\windows\system32\drivers\rdpwd.sys</div>

<div>.</div>

<div>.</div>

<div>(((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))))</div>

<div>.</div>

<div>.</div>

<div>*Note* empty entries & legit default entries are not shown </div>

<div>REGEDIT4</div>

<div>.</div>

<div>[HKEY_LOCAL_MACHINE\Wow6432Node\~\Browser Helper Objects\{6F6A5334-78E9-4D9B-8182-8B41EA8C39EF}]</div>

<div>.</div>

<div>[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]</div>

<div>"CrossRiderPlugin"="c:\program files (x86)\CrossriderWebApps\Crossrider.exe" [2011-05-15 478720]</div>

<div>"swg"="c:\program files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2010-07-14 39408]</div>

<div>"MobileDocuments"="c:\program files (x86)\Common Files\Apple\Internet Services\ubd.exe" [2012-02-23 59240]</div>

<div>.</div>

<div>[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]</div>

<div>"hpsysdrv"="c:\program files (x86)\hewlett-packard\HP odometer\hpsysdrv.exe" [2008-11-20 62768]</div>

<div>"HP KEYBOARDx"="c:\program files (x86)\Hewlett-Packard\HP Desktop Keyboard\HPKEYBOARDx.EXE" [2009-10-19 715776]</div>

<div>"HP Remote Solution"="c:\program files (x86)\Hewlett-Packard\HP Remote Solution\HP_Remote_Solution.exe" [2009-08-25 656896]</div>

<div>"SoundMAXPnP"="c:\program files (x86)\Analog Devices\Core\smax4pnp.exe" [2009-06-22 1314816]</div>

<div>"Buttons & OSDs control application gen3"="c:\program files (x86)\Hewlett-Packard\Buttons & OSDs control application gen3\FastUserSwitching.exe" [2009-11-17 212992]</div>

<div>"HP Software Update"="c:\program files (x86)\HP\HP Software Update\HPWuSchd2.exe" [2008-12-08 54576]</div>

<div>"NortonOnlineBackupReminder"="c:\program files (x86)\Symantec\Norton Online Backup\Activation\NobuActivation.exe" [2009-06-29 600936]</div>

<div>"ArcSoft Connection Service"="c:\program files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe" [2010-10-28 207424]</div>

<div>"Nikon Transfer Monitor"="c:\program files (x86)\Common Files\Nikon\Monitor\NkMonitor.exe" [2009-09-15 479232]</div>

<div>"StartCCC"="c:\program files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2010-02-03 98304]</div>

<div>"AppleSyncNotifier"="c:\program files (x86)\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe" [2011-09-27 59240]</div>

<div>"PWRISOVM.EXE"="c:\program files (x86)\PowerISO\PWRISOVM.EXE" [2010-04-12 180224]</div>

<div>"BCSSync"="c:\program files (x86)\Microsoft Office\Office14\BCSSync.exe" [2010-01-21 91520]</div>

<div>"SwitchBoard"="c:\program files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe" [2010-02-19 517096]</div>

<div>"AdobeCS5ServiceManager"="c:\program files (x86)\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe" [2010-07-23 402432]</div>

<div>"DivXUpdate"="c:\program files (x86)\DivX\DivX Update\DivXUpdate.exe" [2011-03-21 1230704]</div>

<div>"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2011-06-06 843712]</div>

<div>"APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2012-02-21 59240]</div>

<div>"QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" [2011-10-24 421888]</div>

<div>"iTunesHelper"="c:\program files (x86)\iTunes\iTunesHelper.exe" [2012-03-06 421736]</div>

<div>"ccApp"="c:\program files (x86)\Common Files\Symantec Shared\ccApp.exe" [2009-07-09 115560]</div>

<div>"amd_dc_opt"="c:\program files (x86)\AMD\Dual-Core Optimizer\amd_dc_opt.exe" [2008-07-22 77824]</div>

<div>"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2012-01-17 252296]</div>

<div>"Malwarebytes' Anti-Malware"="c:\program files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe" [2012-07-03 462920]</div>

<div>.</div>

<div>c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\</div>

<div>McAfee Security Scan Plus.lnk - c:\program files (x86)\McAfee Security Scan\2.1.121\SSScheduler.exe [2010-9-3 255536]</div>

<div>.</div>

<div>[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]</div>

<div>"ConsentPromptBehaviorAdmin"= 5 (0x5)</div>

<div>"ConsentPromptBehaviorUser"= 3 (0x3)</div>

<div>"EnableUIADesktopToggle"= 0 (0x0)</div>

<div>.</div>

<div>[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]</div>

<div>"aux"=wdmaud.drv</div>

<div>.</div>

<div>[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]</div>

<div>Security Packages<span class="Apple-tab-span" style="white-space:pre"> </span>REG_MULTI_SZ   <span class="Apple-tab-span" style="white-space:pre"> </span>kerberos msv1_0 schannel wdigest tspkg pku2u livessp</div>

<div>.</div>

<div>[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\ccEvtMgr]</div>

<div>@="Service"</div>

<div>.</div>

<div>[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\ccSetMgr]</div>

<div>@="Service"</div>

<div>.</div>

<div>[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]</div>

<div>@=""</div>

<div>.</div>

<div>[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]</div>

<div>@="Service"</div>

<div>.</div>

<div>[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Symantec Antivirus]</div>

<div>@="Service"</div>

<div>.</div>

<div>[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]</div>

<div>"DisableMonitoring"=dword:00000001</div>

<div>.</div>

<div>R2 BBSvc;Bing Bar Update Service;c:\program files (x86)\Microsoft\BingBar\BBSvc.EXE [2011-10-21 196176]</div>

<div>R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]</div>

<div>R2 gupdate;Google Update Service (gupdate);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-07-14 135664]</div>

<div>R2 HP Support Assistant Service;HP Support Assistant Service;c:\program files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe [2011-09-09 86072]</div>

<div>R2 McMPFSvc;McAfee Personal Firewall Service;c:\program files\Common Files\McAfee\McSvcHost\McSvHost.exe [x]</div>

<div>R3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-07-13 250056]</div>

<div>R3 GamesAppService;GamesAppService;c:\program files (x86)\WildTangent Games\App\GamesAppService.exe [2010-10-12 206072]</div>

<div>R3 gupdatem;Google Update Service (gupdatem);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-07-14 135664]</div>

<div>R3 McComponentHostService;McAfee Security Scan Component Host Service;c:\program files (x86)\McAfee Security Scan\2.1.121\McCHSvc.exe [2010-09-03 227232]</div>

<div>R3 Microsoft SharePoint Workspace Audit Service;Microsoft SharePoint Workspace Audit Service;c:\program files (x86)\Microsoft Office\Office14\GROOVE.EXE [2010-01-21 30963576]</div>

<div>R3 MozillaMaintenance;Mozilla Maintenance Service;c:\program files (x86)\Mozilla Maintenance Service\maintenanceservice.exe [2012-06-27 113120]</div>

<div>R3 netr28ux;Linksys USB Wireless LAN Card Driver for Vista;c:\windows\system32\DRIVERS\netr28ux.sys [2009-08-05 987648]</div>

<div>R3 NisDrv;Microsoft Network Inspection System;c:\windows\system32\DRIVERS\NisDrvWFP.sys [2012-03-21 98688]</div>

<div>R3 NisSrv;Microsoft Network Inspection;c:\program files\Microsoft Security Client\NisSrv.exe [2012-03-26 291696]</div>

<div>R3 osppsvc;Office Software Protection Platform;c:\program files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-01-10 4925184]</div>

<div>R3 SwitchBoard;Adobe SwitchBoard;c:\program files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [2010-02-19 517096]</div>

<div>R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-20 59392]</div>

<div>R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys [2012-02-15 52736]</div>

<div>R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [2010-07-07 1255736]</div>

<div>R3 X6va009;X6va009;c:\windows\SysWOW64\Drivers\X6va009 [x]</div>

<div>R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe [2010-09-22 57184]</div>

<div>S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [2009-07-14 59904]</div>

<div>S2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2011-06-06 63928]</div>

<div>S2 Akamai;Akamai NetSession Interface;c:\windows\System32\svchost.exe [2009-07-14 27136]</div>

<div>S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [2010-02-03 202752]</div>

<div>S2 BBUpdate;BBUpdate;c:\program files (x86)\Microsoft\BingBar\SeaPort.EXE [2011-10-13 249648]</div>

<div>S2 CalendarSynchService;CalendarSynchService;c:\program files (x86)\Hewlett-Packard\TouchSmart\Calendar\Service\GCalService.exe [2009-09-11 22072]</div>

<div>S2 cvhsvc;Client Virtualization Handler;c:\program files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE [2012-01-04 822624]</div>

<div>S2 DealCricket Upgrade;Deal Cricket Upgrade;c:\program files (x86)\Deal Cricket\dealcricketupgrade.exe [2010-10-15 17920]</div>

<div>S2 HPDrvMntSvc.exe;HP Quick Synchronization Service;c:\program files (x86)\Hewlett-Packard\Shared\HPDrvMntSvc.exe [2011-03-28 94264]</div>

<div>S2 MBAMService;MBAMService;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2012-07-03 655944]</div>

<div>S2 McAfee SiteAdvisor Service;McAfee SiteAdvisor Service;c:\progra~2\mcafee\SITEAD~1\McSACore.exe [2012-06-15 103472]</div>

<div>S2 sftlist;Application Virtualization Client;c:\program files (x86)\Microsoft Application Virtualization Client\sftlist.exe [2011-10-01 508776]</div>

<div>S3 amdkmdag;amdkmdag;c:\windows\system32\DRIVERS\atipmdag.sys [2010-02-03 6366720]</div>

<div>S3 amdkmdap;amdkmdap;c:\windows\system32\DRIVERS\atikmpag.sys [2010-02-03 186880]</div>

<div>S3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [2012-05-31 138912]</div>

<div>S3 hidkmdf;Microsoft HID Class Shim for KMDF;c:\windows\system32\DRIVERS\hidkmdf.sys [2009-09-17 14328]</div>

<div>S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2012-07-03 24904]</div>

<div>S3 netr28x;Ralink 802.11n Extensible Wireless Driver;c:\windows\system32\DRIVERS\netr28x.sys [2009-10-12 763904]</div>

<div>S3 NW1950;NextWindow 1950 Touch Screen;c:\windows\system32\DRIVERS\NW1950.sys [2009-09-17 25080]</div>

<div>S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [2009-08-21 239616]</div>

<div>S3 Sftfs;Sftfs;c:\windows\system32\DRIVERS\Sftfslh.sys [2011-10-01 764264]</div>

<div>S3 Sftplay;Sftplay;c:\windows\system32\DRIVERS\Sftplaylh.sys [2011-10-01 268648]</div>

<div>S3 Sftredir;Sftredir;c:\windows\system32\DRIVERS\Sftredirlh.sys [2011-10-01 25960]</div>

<div>S3 Sftvol;Sftvol;c:\windows\system32\DRIVERS\Sftvollh.sys [2011-10-01 22376]</div>

<div>S3 sftvsa;Application Virtualization Service Agent;c:\program files (x86)\Microsoft Application Virtualization Client\sftvsa.exe [2011-10-01 219496]</div>

<div>S3 usbfilter;AMD USB Filter Driver;c:\windows\system32\DRIVERS\usbfilter.sys [2009-04-03 34872]</div>

<div>.</div>

<div>.</div>

<div>[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\svchost]</div>

<div>Akamai<span class="Apple-tab-span" style="white-space:pre"> </span>REG_MULTI_SZ   <span class="Apple-tab-span" style="white-space:pre"> </span>Akamai</div>

<div>.</div>

<div>Contents of the 'Scheduled Tasks' folder</div>

<div>.</div>

<div>2012-07-25 c:\windows\Tasks\Adobe Flash Player Updater.job</div>

<div>- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-07-13 18:27]</div>

<div>.</div>

<div>2012-07-25 c:\windows\Tasks\Final Media Player Update Checker.job</div>

<div>- c:\program files (x86)\FinalMediaPlayer\FMPCheckForUpdates.exe [2011-02-23 21:50]</div>

<div>.</div>

<div>2012-07-25 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job</div>

<div>- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-07-14 01:53]</div>

<div>.</div>

<div>2012-07-25 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job</div>

<div>- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-07-14 01:53]</div>

<div>.</div>

<div>2012-07-25 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-4173507603-124383979-1935116261-1005Core.job</div>

<div>- c:\users\Home\AppData\Local\Google\Update\GoogleUpdate.exe [2011-09-07 08:30]</div>

<div>.</div>

<div>2012-07-25 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-4173507603-124383979-1935116261-1005UA.job</div>

<div>- c:\users\Home\AppData\Local\Google\Update\GoogleUpdate.exe [2011-09-07 08:30]</div>

<div>.</div>

<div>2012-07-14 c:\windows\Tasks\HPCeeScheduleForHome.job</div>

<div>- c:\program files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe [2010-09-14 03:15]</div>

<div>.</div>

<div>2012-07-23 c:\windows\Tasks\Norton Security Scan for legendkilla.job</div>

<div>- c:\program files (x86)\Norton Security Scan\Engine\2.7.3.34\Nss.exe [2010-10-28 10:32]</div>

<div>.</div>

<div>2012-06-30 c:\windows\Tasks\PCDRScheduledMaintenance.job</div>

<div>- c:\program files\PC-Doctor for Windows\pcdrcui.exe [2009-09-18 07:11]</div>

<div>.</div>

<div>.</div>

<div>--------- X64 Entries -----------</div>

<div>.</div>

<div>.</div>

<div>[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]</div>

<div>"SoundMAX"="c:\program files (x86)\Analog Devices\SoundMAX\soundmax.exe" [2009-06-22 3866624]</div>

<div>"PC-Doctor for Windows localizer"="c:\program files\PC-Doctor for Windows\localizer.exe" [2009-09-17 95728]</div>

<div>"AdobeAAMUpdater-1.0"="c:\program files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe" [2010-03-06 500208]</div>

<div>"MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2012-03-26 1271168]</div>

<div>"combofix"="c:\combofix\CF4417.3XE" [2010-11-20 345088]</div>

<div>.</div>

<div>[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]</div>

<div>"LoadAppInit_DLLs"=0x0</div>

<div>.</div>

<div>------- Supplementary Scan -------</div>

<div>.</div>

<div>uLocal Page = c:\windows\system32\blank.htm</div>

<div>mStart Page = hxxp://home.sweetim.com</div>

<div>mLocal Page = c:\windows\SysWOW64\blank.htm</div>

<div>uInternet Settings,ProxyOverride = *.local;127.0.0.1:9421;<local></div>

<div>IE: E&xport to Microsoft Excel - c:\progra~2\MICROS~4\Office14\EXCEL.EXE/3000</div>

<div>IE: Google Sidewiki... - c:\program files (x86)\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_7461B1589E8B4FB7.dll/cmsidewiki.html</div>

<div>IE: Se&nd to OneNote - c:\progra~2\MICROS~4\Office14\ONBttnIE.dll/105</div>

<div>IE: Translate this web page with Babylon - c:\program files (x86)\Babylon\Babylon-Pro\Utils\BabylonIEPI.dll/ActionTU.htm</div>

<div>IE: Translate with Babylon - c:\program files (x86)\Babylon\Babylon-Pro\Utils\BabylonIEPI.dll/Action.htm</div>

<div>Trusted Zone: clonewarsadventures.com</div>

<div>Trusted Zone: freerealms.com</div>

<div>Trusted Zone: soe.com</div>

<div>Trusted Zone: sony.com</div>

<div>TCP: DhcpNameServer = 192.168.1.254</div>

<div>FF - ProfilePath - c:\users\Home\AppData\Roaming\Mozilla\Firefox\Profiles\5ecd5axt.default\</div>

<div>FF - prefs.js: browser.search.defaulturl - hxxp://search.sweetim.com/search.asp?src=2&q=</div>

<div>FF - prefs.js: browser.search.selectedEngine - Yahoo</div>

<div>FF - prefs.js: browser.startup.homepage - bing.com</div>

<div>FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?fr=greentree_ff1&ei=utf-8&ilc=12&type=937811&p=</div>

<div>FF - user.js: network.cookie.cookieBehavior - 0</div>

<div>FF - user.js: privacy.clearOnShutdown.cookies - false</div>

<div>FF - user.js: security.warn_viewing_mixed - false</div>

<div>FF - user.js: security.warn_viewing_mixed.show_once - false</div>

<div>FF - user.js: security.warn_submit_insecure - false</div>

<div>FF - user.js: security.warn_submit_insecure.show_once - false</div>

<div>.</div>

<div>- - - - ORPHANS REMOVED - - - -</div>

<div>.</div>

<div>BHO-{59c6f12b-f004-43e5-9997-08f2123119b6} - c:\program files (x86)\oovootoolbar\oovootoolbarX.dll</div>

<div>Toolbar-{59c6f12b-f004-43e5-9997-08f2123119b6} - c:\program files (x86)\oovootoolbar\oovootoolbarX.dll</div>

<div>Wow6432Node-HKCU-Run-msnmsgm - (no file)</div>

<div>Wow6432Node-HKCU-Run-Akamai NetSession Interface - c:\users\Home\AppData\Local\Akamai\netsession_win.exe</div>

<div>SafeBoot-Symantec Antvirus</div>

<div>WebBrowser-{88C7F2AA-F93F-432C-8F0E-B7D85967A527} - (no file)</div>

<div>WebBrowser-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file)</div>

<div>WebBrowser-{51A86BB3-6602-4C85-92A5-130EE4864F13} - (no file)</div>

<div>WebBrowser-{EEE6C35B-6118-11DC-9C72-001320C79847} - (no file)</div>

<div>AddRemove-Adobe Shockwave Player - c:\windows\system32\Adobe\Shockwave 11\uninstaller.exe</div>

<div>AddRemove-{6F44AF95-3CDE-4513-AD3F-6D45F17BF324} - c:\program files (x86)\InstallShield Installation Information\{6F44AF95-3CDE-4513-AD3F-6D45F17BF324}\setup.exe</div>

<div>.</div>

<div>.</div>

<div>.</div>

<div>[HKEY_LOCAL_MACHINE\system\ControlSet001\services\Akamai]</div>

<div>"ServiceDll"="c:\program files (x86)\common files\akamai/netsession_win_4f7fccd.dll"</div>

<div>.</div>

<div>[HKEY_LOCAL_MACHINE\system\ControlSet001\services\X6va009]</div>

<div>"ImagePath"="\??\c:\windows\SysWOW64\Drivers\X6va009"</div>

<div>.</div>

<div>--------------------- LOCKED REGISTRY KEYS ---------------------</div>

<div>.</div>

<div>[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]</div>

<div>@Denied: (A 2) (Everyone)</div>

<div>@="FlashBroker"</div>

<div>"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_3_300_265_ActiveX.exe,-101"</div>

<div>.</div>

<div>[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]</div>

<div>"Enabled"=dword:00000001</div>

<div>.</div>

<div>[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]</div>

<div>@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_3_300_265_ActiveX.exe"</div>

<div>.</div>

<div>[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]</div>

<div>@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"</div>

<div>.</div>

<div>[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]</div>

<div>@Denied: (A 2) (Everyone)</div>

<div>@="Shockwave Flash Object"</div>

<div>.</div>

<div>[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]</div>

<div>@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_3_300_265.ocx"</div>

<div>"ThreadingModel"="Apartment"</div>

<div>.</div>

<div>[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]</div>

<div>@="0"</div>

<div>.</div>

<div>[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]</div>

<div>@="ShockwaveFlash.ShockwaveFlash.11"</div>

<div>.</div>

<div>[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]</div>

<div>@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_3_300_265.ocx, 1"</div>

<div>.</div>

<div>[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]</div>

<div>@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"</div>

<div>.</div>

<div>[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]</div>

<div>@="1.0"</div>

<div>.</div>

<div>[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]</div>

<div>@="ShockwaveFlash.ShockwaveFlash"</div>

<div>.</div>

<div>[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]</div>

<div>@Denied: (A 2) (Everyone)</div>

<div>@="Macromedia Flash Factory Object"</div>

<div>.</div>

<div>[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]</div>

<div>@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_3_300_265.ocx"</div>

<div>"ThreadingModel"="Apartment"</div>

<div>.</div>

<div>[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]</div>

<div>@="FlashFactory.FlashFactory.1"</div>

<div>.</div>

<div>[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]</div>

<div>@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_3_300_265.ocx, 1"</div>

<div>.</div>

<div>[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]</div>

<div>@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"</div>

<div>.</div>

<div>[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]</div>

<div>@="1.0"</div>

<div>.</div>

<div>[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]</div>

<div>@="FlashFactory.FlashFactory"</div>

<div>.</div>

<div>[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]</div>

<div>@Denied: (A 2) (Everyone)</div>

<div>@="IFlashBroker4"</div>

<div>.</div>

<div>[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]</div>

<div>@="{00020424-0000-0000-C000-000000000046}"</div>

<div>.</div>

<div>[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]</div>

<div>@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"</div>

<div>"Version"="1.0"</div>

<div>.</div>

<div>[HKEY_LOCAL_MACHINE\software\McAfee]</div>

<div>"SymbolicLinkValue"=hex(6):5c,00,72,00,65,00,67,00,69,00,73,00,74,00,72,00,79,</div>

<div>   00,5c,00,6d,00,61,00,63,00,68,00,69,00,6e,00,65,00,5c,00,53,00,6f,00,66,00,\</div>

<div>.</div>

<div>[HKEY_LOCAL_MACHINE\software\Wow6432Node\Microsoft\Office\Common\Smart Tag\Actions\{B7EFF951-E52F-45CC-9EF7-57124F2177CC}]</div>

<div>@Denied: (A) (Everyone)</div>

<div>"Solution"="{15727DE6-F92D-4E46-ACB4-0E2C58B31A18}"</div>

<div>.</div>

<div>[HKEY_LOCAL_MACHINE\software\Wow6432Node\Microsoft\Schema Library\ActionsPane3]</div>

<div>@Denied: (A) (Everyone)</div>

<div>.</div>

<div>[HKEY_LOCAL_MACHINE\software\Wow6432Node\Microsoft\Schema Library\ActionsPane3\0]</div>

<div>"Key"="ActionsPane3"</div>

<div>"Location"="c:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VSTO\\ActionsPane3.xsd"</div>

<div>.</div>

<div>[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]</div>

<div>@Denied: (Full) (Everyone)</div>

<div>.</div>

<div>------------------------ Other Running Processes ------------------------</div>

<div>.</div>

<div>c:\program files (x86)\Common Files\Symantec Shared\ccSvcHst.exe</div>

<div>c:\program files (x86)\Common Files\Microsoft Shared\Ink\TabTip32.exe</div>

<div>c:\program files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe</div>

<div>c:\program files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe</div>

<div>c:\program files (x86)\Hewlett-Packard\TouchSmart\Calendar\Service\HPTouchSmartSyncCalReminderApp.exe</div>

<div>c:\windows\SysWOW64\rundll32.exe</div>

<div>c:\program files (x86)\Symantec\Symantec Endpoint Protection\Rtvscan.exe</div>

<div>c:\program files (x86)\Symantec\Symantec Endpoint Protection\ProtectionUtilSurrogate.exe</div>

<div>c:\program files (x86)\Hewlett-Packard\TouchSmart\Media\Kernel\CLML\CLMLSvc.exe</div>

<div>.</div>

<div>**************************************************************************</div>

<div>.</div>

<div>Completion time: 2012-07-25  15:26:38 - machine was rebooted</div>

<div>ComboFix-quarantined-files.txt  2012-07-25 19:26</div>

<div>.</div>

<div>Pre-Run: 581,743,005,696 bytes free</div>

<div>Post-Run: 582,707,781,632 bytes free</div>

<div>.</div>

<div>- - End Of File - - 1A04E66092CF9B84984F46400112EC9C</div>

<div> </div>

Link to post
Share on other sites
Legendkilla023

Legendkilla023

Posted
  • Author
Posted

ComboFix 12-07-26.03 - Home 07/25/2012 14:33:19.1.2 - x64

Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.3839.1556 [GMT -4:00]

Running from: c:\users\Home\Downloads\ComboFix.exe

AV: Microsoft Security Essentials *Disabled/Updated* {9765EA51-0D3C-7DFB-6091-10E4E1F341F6}

AV: Symantec Endpoint Protection *Disabled/Updated* {88C95A36-8C3B-2F2C-1B8B-30FCCFDC4855}

FW: Symantec Endpoint Protection *Disabled* {B0F2DB13-C654-2E74-30D4-99C9310F0F2E}

SP: Microsoft Security Essentials *Disabled/Updated* {2C040BB5-2B06-7275-5A21-2B969A740B4B}

SP: Symantec Endpoint Protection *Disabled/Updated* {33A8BBD2-AA01-20A2-213B-0B8EB45B02E8}

SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

.

c:\program files (x86)\Blinkx

c:\program files (x86)\Blinkx\blinkx.ico

c:\program files (x86)\Blinkx\blinkxss.exe

c:\program files (x86)\Blinkx\blinkxstop.exe

c:\program files (x86)\Blinkx\lang.dll

c:\program files (x86)\Blinkx\templates\beat.ico

c:\program files (x86)\Blinkx\templates\index.html

c:\program files (x86)\Blinkx\templates\noflash.html

c:\program files (x86)\Blinkx\templates\offline.html

c:\program files (x86)\Blinkx\templates\offline.swf

c:\program files (x86)\Blinkx\templates\uninstall.exe

c:\program files (x86)\Hyperionics DB Toolbar\tbCOre3.dll

c:\program files (x86)\I Want This

c:\program files (x86)\I Want This\I Want This.ico

c:\users\Home\AppData\Local\Minibar

c:\users\Home\AppData\Local\Minibar\chrome\background.html

c:\users\Home\AppData\Local\Minibar\chrome\cached_http_request.js

c:\users\Home\AppData\Local\Minibar\chrome\extension_info.json

c:\users\Home\AppData\Local\Minibar\chrome\icons\icon128.png

c:\users\Home\AppData\Local\Minibar\chrome\icons\icon19.png

c:\users\Home\AppData\Local\Minibar\chrome\icons\icon32.png

c:\users\Home\AppData\Local\Minibar\chrome\icons\icon48.png

c:\users\Home\AppData\Local\Minibar\chrome\includes\content.js

c:\users\Home\AppData\Local\Minibar\chrome\includes\content_kango.js

c:\users\Home\AppData\Local\Minibar\chrome\includes\content_messaging.js

c:\users\Home\AppData\Local\Minibar\chrome\includes\content_userscript.js

c:\users\Home\AppData\Local\Minibar\chrome\kango-ui\button.js

c:\users\Home\AppData\Local\Minibar\chrome\kango-ui\ui.js

c:\users\Home\AppData\Local\Minibar\chrome\kango\browser.js

c:\users\Home\AppData\Local\Minibar\chrome\kango\console.js

c:\users\Home\AppData\Local\Minibar\chrome\kango\event_listener.js

c:\users\Home\AppData\Local\Minibar\chrome\kango\initialize.js

c:\users\Home\AppData\Local\Minibar\chrome\kango\io.js

c:\users\Home\AppData\Local\Minibar\chrome\kango\jsonstorage.js

c:\users\Home\AppData\Local\Minibar\chrome\kango\kango.js

c:\users\Home\AppData\Local\Minibar\chrome\kango\lang.js

c:\users\Home\AppData\Local\Minibar\chrome\kango\messaging.js

c:\users\Home\AppData\Local\Minibar\chrome\kango\userscript_engine.js

c:\users\Home\AppData\Local\Minibar\chrome\kango\xhr.js

c:\users\Home\AppData\Local\Minibar\chrome\main.js

c:\users\Home\AppData\Local\Minibar\chrome\manifest.json

c:\users\Home\AppData\Local\Minibar\chrome\minibar\actions.js

c:\users\Home\AppData\Local\Minibar\chrome\minibar\cachedxhr.js

c:\users\Home\AppData\Local\Minibar\chrome\minibar\config.js

c:\users\Home\AppData\Local\Minibar\chrome\minibar\macros.js

c:\users\Home\AppData\Local\Minibar\chrome\minibar\minibar.js

c:\users\Home\AppData\Local\Minibar\chrome\popup.html

c:\users\Home\AppData\Local\Minibar\chrome\popup.js

c:\users\Home\AppData\Local\Minibar\chrome\tab.html

c:\users\Home\AppData\Local\Minibar\chrome\tab.js

c:\users\Home\AppData\Local\Minibar\chrome_installer.js

c:\users\Home\AppData\Local\Minibar\common.js

c:\users\Home\AppData\Local\Minibar\install.json

c:\users\Home\AppData\Local\Minibar\minibar.crx

c:\users\Home\AppData\Local\Minibar\sqlite3.exe

c:\users\Home\AppData\Local\Minibar\Uninstall.exe

c:\users\Home\AppData\Local\tempdata.dat

c:\users\Home\AppData\Roaming\515731.exe_fhzxk

c:\users\Home\AppData\Roaming\815863.exe_ohjfx

c:\users\Home\AppData\Roaming\870947.exe_rpopv

c:\users\Home\AppData\Roaming\Atyhy

c:\users\Home\AppData\Roaming\Atyhy\sapoy.akd

c:\users\Home\AppData\Roaming\bat99.bat

c:\users\Home\AppData\Roaming\cglogs.dat

c:\users\Home\AppData\Roaming\chrtmp

c:\users\Home\AppData\Roaming\Directory

c:\users\Home\AppData\Roaming\Enebu

c:\users\Home\AppData\Roaming\Enebu\keavz.qop

c:\users\Home\AppData\Roaming\Ezda

c:\users\Home\AppData\Roaming\Ezda\imxic.fea

c:\users\Home\AppData\Roaming\Home3SQLite3.dll

c:\users\Home\AppData\Roaming\Homelog.dat

c:\users\Home\AppData\Roaming\Local

c:\users\Home\AppData\Roaming\Microsoft\MSConfig.exe

c:\users\Home\AppData\Roaming\Microsoft\UK749IA3GJ.exe

c:\users\Home\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\tmp56CF.tmp.exe

c:\users\Home\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\tmp575B.tmp.exe

c:\users\Home\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\tmp57B8.tmp.exe

c:\users\Home\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\tmpD743.tmp.exe

c:\users\Home\AppData\Roaming\Mozilla\Firefox\Profiles\5ecd5axt.default\extensions\crossriderapp2258@crossrider.com

c:\users\Home\AppData\Roaming\Mozilla\Firefox\Profiles\5ecd5axt.default\extensions\crossriderapp2258@crossrider.com\chrome.manifest

c:\users\Home\AppData\Roaming\Mozilla\Firefox\Profiles\5ecd5axt.default\extensions\crossriderapp2258@crossrider.com\chrome\content\background.html

c:\users\Home\AppData\Roaming\Mozilla\Firefox\Profiles\5ecd5axt.default\extensions\crossriderapp2258@crossrider.com\chrome\content\browser.xul

c:\users\Home\AppData\Roaming\Mozilla\Firefox\Profiles\5ecd5axt.default\extensions\crossriderapp2258@crossrider.com\chrome\content\crossrider.js

c:\users\Home\AppData\Roaming\Mozilla\Firefox\Profiles\5ecd5axt.default\extensions\crossriderapp2258@crossrider.com\chrome\content\crossriderapi.js

c:\users\Home\AppData\Roaming\Mozilla\Firefox\Profiles\5ecd5axt.default\extensions\crossriderapp2258@crossrider.com\chrome\content\dialog.js

c:\users\Home\AppData\Roaming\Mozilla\Firefox\Profiles\5ecd5axt.default\extensions\crossriderapp2258@crossrider.com\chrome\content\options.js

c:\users\Home\AppData\Roaming\Mozilla\Firefox\Profiles\5ecd5axt.default\extensions\crossriderapp2258@crossrider.com\chrome\content\options.xul

c:\users\Home\AppData\Roaming\Mozilla\Firefox\Profiles\5ecd5axt.default\extensions\crossriderapp2258@crossrider.com\chrome\content\search_dialog.xul

c:\users\Home\AppData\Roaming\Mozilla\Firefox\Profiles\5ecd5axt.default\extensions\crossriderapp2258@crossrider.com\chrome\content\update.html

c:\users\Home\AppData\Roaming\Mozilla\Firefox\Profiles\5ecd5axt.default\extensions\crossriderapp2258@crossrider.com\defaults\preferences\prefs.js

c:\users\Home\AppData\Roaming\Mozilla\Firefox\Profiles\5ecd5axt.default\extensions\crossriderapp2258@crossrider.com\install.rdf

c:\users\Home\AppData\Roaming\Mozilla\Firefox\Profiles\5ecd5axt.default\extensions\crossriderapp2258@crossrider.com\locale\en-US\translations.dtd

c:\users\Home\AppData\Roaming\Mozilla\Firefox\Profiles\5ecd5axt.default\extensions\crossriderapp2258@crossrider.com\skin\button1.png

c:\users\Home\AppData\Roaming\Mozilla\Firefox\Profiles\5ecd5axt.default\extensions\crossriderapp2258@crossrider.com\skin\button2.png

c:\users\Home\AppData\Roaming\Mozilla\Firefox\Profiles\5ecd5axt.default\extensions\crossriderapp2258@crossrider.com\skin\button3.png

c:\users\Home\AppData\Roaming\Mozilla\Firefox\Profiles\5ecd5axt.default\extensions\crossriderapp2258@crossrider.com\skin\button4.png

c:\users\Home\AppData\Roaming\Mozilla\Firefox\Profiles\5ecd5axt.default\extensions\crossriderapp2258@crossrider.com\skin\button5.png

c:\users\Home\AppData\Roaming\Mozilla\Firefox\Profiles\5ecd5axt.default\extensions\crossriderapp2258@crossrider.com\skin\crossrider_statusbar.png

c:\users\Home\AppData\Roaming\Mozilla\Firefox\Profiles\5ecd5axt.default\extensions\crossriderapp2258@crossrider.com\skin\icon128.png

c:\users\Home\AppData\Roaming\Mozilla\Firefox\Profiles\5ecd5axt.default\extensions\crossriderapp2258@crossrider.com\skin\icon16.png

c:\users\Home\AppData\Roaming\Mozilla\Firefox\Profiles\5ecd5axt.default\extensions\crossriderapp2258@crossrider.com\skin\icon24.png

c:\users\Home\AppData\Roaming\Mozilla\Firefox\Profiles\5ecd5axt.default\extensions\crossriderapp2258@crossrider.com\skin\icon48.png

c:\users\Home\AppData\Roaming\Mozilla\Firefox\Profiles\5ecd5axt.default\extensions\crossriderapp2258@crossrider.com\skin\panelarrow-up.png

c:\users\Home\AppData\Roaming\Mozilla\Firefox\Profiles\5ecd5axt.default\extensions\crossriderapp2258@crossrider.com\skin\popup.html

c:\users\Home\AppData\Roaming\Mozilla\Firefox\Profiles\5ecd5axt.default\extensions\crossriderapp2258@crossrider.com\skin\popup_binding.xml

c:\users\Home\AppData\Roaming\Mozilla\Firefox\Profiles\5ecd5axt.default\extensions\crossriderapp2258@crossrider.com\skin\skin.css

c:\users\Home\AppData\Roaming\Mozilla\Firefox\Profiles\5ecd5axt.default\extensions\crossriderapp2258@crossrider.com\skin\update.css

c:\users\Home\AppData\Roaming\Mozilla\Firefox\Profiles\5ecd5axt.default\searchplugins\bing-zugo.xml

c:\users\Home\AppData\Roaming\MSWINSCK.OCX

c:\users\Home\AppData\Roaming\oomnq

c:\users\Home\AppData\Roaming\Runescape

c:\users\Home\AppData\Roaming\SQLite3.dll

c:\users\Home\AppData\Roaming\System\Client.exe

c:\users\Home\AppData\Roaming\taskmgr.exe_calgf

c:\users\Home\AppData\Roaming\Vori

c:\users\Home\AppData\Roaming\Vori\ivbe.idy

c:\users\Home\AppData\Roaming\Windir

c:\users\Home\AppData\Roaming\WinDir\Svchost22.exe

c:\users\Home\AppData\Roaming\WinDir\update.exe

c:\users\Home\AppData\Roaming\WindowsDef

c:\users\Home\AppData\Roaming\WindowsDefender

c:\users\Home\AppData\Roaming\Windowsupdate

c:\users\Home\AppData\Roaming\Wyir

c:\users\Home\AppData\Roaming\Wyir\zeez.ofg

c:\users\Home\Documents\DCSCMIN

c:\users\Home\fdfix.exe

c:\users\legendkilla\AppData\Local\Microsoft\Windows\Temporary Internet Files\cookies.sqlite

c:\windows\SysWow64\pt

c:\windows\SysWow64\pt\Lagoon.resources.dll

C:\Windupdt

.

.

((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.

.

-------\Service_ACPIService

.

.

((((((((((((((((((((((((( Files Created from 2012-06-25 to 2012-07-25 )))))))))))))))))))))))))))))))

.

.

2012-07-25 18:54 . 2012-07-25 18:54 -------- d-----w- c:\users\Sadeeeee !\AppData\Local\temp

2012-07-25 18:54 . 2012-07-25 18:54 -------- d-----w- c:\users\Default\AppData\Local\temp

2012-07-25 18:54 . 2012-07-25 18:54 -------- d-----w- c:\users\legendkilla\AppData\Local\temp

2012-07-25 06:09 . 2012-02-09 18:17 927800 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{30B4B512-7344-4682-A943-B2479050CAC3}\gapaengine.dll

2012-07-25 06:06 . 2012-07-16 06:40 9133488 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{F61F14C5-22D3-45E3-AA35-24F7C41B35E4}\mpengine.dll

2012-07-25 05:58 . 2012-07-25 05:58 -------- d-----w- c:\program files (x86)\Microsoft Security Client

2012-07-25 05:57 . 2012-07-25 06:01 -------- d-----w- c:\program files\Microsoft Security Client

2012-07-25 05:30 . 2012-06-29 10:04 9133488 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{B72DCDF5-3547-4E75-907B-2118B74F71B4}\mpengine.dll

2012-07-25 02:22 . 2012-07-25 02:22 -------- d-----w- c:\users\Home\AppData\Roaming\Malwarebytes

2012-07-25 02:22 . 2012-07-25 02:22 -------- d-----w- c:\programdata\Malwarebytes

2012-07-25 02:22 . 2012-07-03 17:46 24904 ----a-w- c:\windows\system32\drivers\mbam.sys

2012-07-25 02:22 . 2012-07-25 02:22 -------- d-----w- c:\program files (x86)\Malwarebytes' Anti-Malware

2012-07-13 22:46 . 2012-07-13 22:46 -------- d-----w- c:\users\Home\AppData\Local\Macromedia

2012-07-13 18:27 . 2012-07-13 18:27 9226440 ----a-w- c:\windows\SysWow64\FlashPlayerInstaller.exe

2012-07-13 17:31 . 2012-07-13 18:27 426184 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe

2012-07-13 17:31 . 2012-07-13 17:31 -------- d-----w- c:\windows\system32\Macromed

2012-07-12 07:06 . 2012-06-12 03:08 3148800 ----a-w- c:\windows\system32\win32k.sys

2012-07-07 04:54 . 2012-07-07 04:54 -------- d-----w- c:\programdata\Steam

2012-07-07 04:54 . 2012-07-07 04:55 -------- d-----w- c:\programdata\PopCap Games

2012-07-04 17:24 . 2012-07-04 17:24 -------- d-----w- c:\programdata\McAfee Security Scan

2012-07-04 17:24 . 2012-07-05 19:14 -------- d-----w- c:\program files (x86)\McAfee Security Scan

2012-07-04 17:24 . 2012-07-04 17:24 -------- d-----w- c:\program files (x86)\Common Files\Java

2012-07-04 17:23 . 2012-07-04 17:23 -------- d-----w- c:\program files (x86)\Oracle

2012-07-04 17:23 . 2012-05-04 23:29 772504 ----a-w- c:\windows\SysWow64\npDeployJava1.dll

2012-07-03 03:22 . 2012-07-03 03:22 -------- d-----w- c:\users\Home\AppData\Local\Downloaded Installations

2012-07-03 03:21 . 2010-06-02 08:55 239960 ----a-w- c:\windows\SysWow64\xactengine3_7.dll

2012-07-03 03:21 . 2010-06-02 08:55 176984 ----a-w- c:\windows\system32\xactengine3_7.dll

2012-07-03 03:21 . 2010-05-26 15:41 1907552 ----a-w- c:\windows\system32\d3dcsx_43.dll

2012-07-03 03:21 . 2010-05-26 15:41 1868128 ----a-w- c:\windows\SysWow64\d3dcsx_43.dll

2012-07-03 03:21 . 2010-02-04 14:01 78680 ----a-w- c:\windows\system32\XAPOFX1_4.dll

2012-07-03 03:21 . 2010-02-04 14:01 74072 ----a-w- c:\windows\SysWow64\XAPOFX1_4.dll

2012-07-03 03:21 . 2010-02-04 14:01 530776 ----a-w- c:\windows\system32\XAudio2_6.dll

2012-07-03 03:21 . 2010-02-04 14:01 528216 ----a-w- c:\windows\SysWow64\XAudio2_6.dll

2012-07-03 03:21 . 2010-02-04 14:01 238936 ----a-w- c:\windows\SysWow64\xactengine3_6.dll

2012-07-03 03:21 . 2010-02-04 14:01 176984 ----a-w- c:\windows\system32\xactengine3_6.dll

2012-07-02 16:39 . 2012-07-02 16:39 -------- d-----w- c:\users\Home\AppData\Roaming\.techniclauncher

2012-07-01 21:41 . 2012-07-01 21:41 -------- d-----w- c:\users\Home\AppData\Local\.inapptracking

2012-07-01 07:17 . 2012-07-01 07:17 -------- d-----w- c:\users\Home\AppData\Roaming\Warner Bros. Interactive Entertainment

2012-07-01 05:46 . 2010-06-02 08:55 77656 ----a-w- c:\windows\system32\XAPOFX1_5.dll

2012-07-01 05:46 . 2010-06-02 08:55 74072 ----a-w- c:\windows\SysWow64\XAPOFX1_5.dll

2012-07-01 05:46 . 2010-06-02 08:55 527192 ----a-w- c:\windows\SysWow64\XAudio2_7.dll

2012-07-01 05:46 . 2010-06-02 08:55 518488 ----a-w- c:\windows\system32\XAudio2_7.dll

2012-07-01 05:46 . 2010-05-26 15:41 276832 ----a-w- c:\windows\system32\d3dx11_43.dll

2012-07-01 05:46 . 2010-05-26 15:41 2526056 ----a-w- c:\windows\system32\D3DCompiler_43.dll

2012-07-01 05:46 . 2010-05-26 15:41 248672 ----a-w- c:\windows\SysWow64\d3dx11_43.dll

2012-07-01 05:46 . 2010-05-26 15:41 511328 ----a-w- c:\windows\system32\d3dx10_43.dll

2012-07-01 05:46 . 2010-05-26 15:41 470880 ----a-w- c:\windows\SysWow64\d3dx10_43.dll

2012-07-01 05:46 . 2010-05-26 15:41 2401112 ----a-w- c:\windows\system32\D3DX9_43.dll

2012-07-01 05:46 . 2010-02-04 14:01 24920 ----a-w- c:\windows\system32\X3DAudio1_7.dll

2012-07-01 05:46 . 2010-02-04 14:01 22360 ----a-w- c:\windows\SysWow64\X3DAudio1_7.dll

2012-06-30 18:21 . 2012-06-30 18:21 466456 ----a-w- c:\windows\system32\wrap_oal.dll

2012-06-30 18:21 . 2012-06-30 18:21 122904 ----a-w- c:\windows\system32\OpenAL32.dll

2012-06-30 18:21 . 2012-06-30 18:21 -------- d-----w- c:\program files (x86)\OpenAL

2012-06-30 18:21 . 2012-06-30 18:21 444952 ----a-w- c:\windows\SysWow64\wrap_oal.dll

2012-06-30 18:21 . 2012-06-30 18:21 109080 ----a-w- c:\windows\SysWow64\OpenAL32.dll

2012-06-30 16:03 . 2010-05-26 15:41 2106216 ----a-w- c:\windows\SysWow64\D3DCompiler_43.dll

2012-06-30 16:03 . 2010-05-26 15:41 1998168 ----a-w- c:\windows\SysWow64\D3DX9_43.dll

2012-06-29 22:03 . 2012-06-29 22:03 -------- d-----w- c:\users\legendkilla\AppData\Local\Symantec

2012-06-28 19:47 . 2012-06-28 19:47 -------- d-----w- c:\users\Home\AppData\Roaming\RotMG.Production

2012-06-27 13:26 . 2012-06-27 13:26 770384 ----a-w- c:\program files (x86)\Mozilla Firefox\msvcr100.dll

2012-06-27 13:26 . 2012-06-27 13:26 421200 ----a-w- c:\program files (x86)\Mozilla Firefox\msvcp100.dll

.

.

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2012-07-13 18:27 . 2011-06-06 20:47 70344 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl

2012-07-12 07:01 . 2010-07-28 22:26 59701280 ----a-w- c:\windows\system32\MRT.exe

2012-06-02 22:19 . 2012-06-23 09:19 38424 ----a-w- c:\windows\system32\wups.dll

2012-06-02 22:19 . 2012-06-23 09:26 2428952 ----a-w- c:\windows\system32\wuaueng.dll

2012-06-02 22:19 . 2012-06-23 09:26 57880 ----a-w- c:\windows\system32\wuauclt.exe

2012-06-02 22:19 . 2012-06-23 09:26 44056 ----a-w- c:\windows\system32\wups2.dll

2012-06-02 22:19 . 2012-06-23 09:19 701976 ----a-w- c:\windows\system32\wuapi.dll

2012-06-02 22:15 . 2012-06-23 09:26 2622464 ----a-w- c:\windows\system32\wucltux.dll

2012-06-02 22:15 . 2012-06-23 09:19 99840 ----a-w- c:\windows\system32\wudriver.dll

2012-06-02 19:19 . 2012-06-23 09:16 186752 ----a-w- c:\windows\system32\wuwebv.dll

2012-06-02 19:15 . 2012-06-23 09:16 36864 ----a-w- c:\windows\system32\wuapp.exe

2012-05-31 16:25 . 2010-07-07 02:24 279656 ------w- c:\windows\system32\MpSigStub.exe

2012-05-30 02:20 . 2012-05-30 02:20 163048 ----a-w- c:\programdata\Microsoft\Windows\Sqm\Manifest\Sqm10141.bin

2012-05-15 04:01 . 2012-06-13 08:05 1188864 ----a-w- c:\windows\system32\wininet.dll

2012-05-15 03:59 . 2012-06-13 08:05 64512 ----a-w- c:\windows\system32\jsproxy.dll

2012-05-15 03:03 . 2012-06-13 08:05 981504 ----a-w- c:\windows\SysWow64\wininet.dll

2012-05-14 22:33 . 2012-05-14 22:33 172592 ----a-w- c:\windows\system32\drivers\SYMEVENT64x86.SYS

2012-05-04 23:29 . 2010-09-14 22:37 687504 ----a-w- c:\windows\SysWow64\deployJava1.dll

2012-05-04 11:06 . 2012-06-13 08:05 5559664 ----a-w- c:\windows\system32\ntoskrnl.exe

2012-05-04 10:03 . 2012-06-13 08:05 3968368 ----a-w- c:\windows\SysWow64\ntkrnlpa.exe

2012-05-04 10:03 . 2012-06-13 08:05 3913072 ----a-w- c:\windows\SysWow64\ntoskrnl.exe

2012-05-01 05:40 . 2012-06-13 08:05 209920 ----a-w- c:\windows\system32\profsvc.dll

2012-04-28 03:55 . 2012-06-13 08:05 210944 ----a-w- c:\windows\system32\drivers\rdpwd.sys

.

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

.

[HKEY_LOCAL_MACHINE\Wow6432Node\~\Browser Helper Objects\{6F6A5334-78E9-4D9B-8182-8B41EA8C39EF}]

.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"CrossRiderPlugin"="c:\program files (x86)\CrossriderWebApps\Crossrider.exe" [2011-05-15 478720]

"swg"="c:\program files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2010-07-14 39408]

"MobileDocuments"="c:\program files (x86)\Common Files\Apple\Internet Services\ubd.exe" [2012-02-23 59240]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]

"hpsysdrv"="c:\program files (x86)\hewlett-packard\HP odometer\hpsysdrv.exe" [2008-11-20 62768]

"HP KEYBOARDx"="c:\program files (x86)\Hewlett-Packard\HP Desktop Keyboard\HPKEYBOARDx.EXE" [2009-10-19 715776]

"HP Remote Solution"="c:\program files (x86)\Hewlett-Packard\HP Remote Solution\HP_Remote_Solution.exe" [2009-08-25 656896]

"SoundMAXPnP"="c:\program files (x86)\Analog Devices\Core\smax4pnp.exe" [2009-06-22 1314816]

"Buttons & OSDs control application gen3"="c:\program files (x86)\Hewlett-Packard\Buttons & OSDs control application gen3\FastUserSwitching.exe" [2009-11-17 212992]

"HP Software Update"="c:\program files (x86)\HP\HP Software Update\HPWuSchd2.exe" [2008-12-08 54576]

"NortonOnlineBackupReminder"="c:\program files (x86)\Symantec\Norton Online Backup\Activation\NobuActivation.exe" [2009-06-29 600936]

"ArcSoft Connection Service"="c:\program files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe" [2010-10-28 207424]

"Nikon Transfer Monitor"="c:\program files (x86)\Common Files\Nikon\Monitor\NkMonitor.exe" [2009-09-15 479232]

"StartCCC"="c:\program files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2010-02-03 98304]

"AppleSyncNotifier"="c:\program files (x86)\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe" [2011-09-27 59240]

"PWRISOVM.EXE"="c:\program files (x86)\PowerISO\PWRISOVM.EXE" [2010-04-12 180224]

"BCSSync"="c:\program files (x86)\Microsoft Office\Office14\BCSSync.exe" [2010-01-21 91520]

"SwitchBoard"="c:\program files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe" [2010-02-19 517096]

"AdobeCS5ServiceManager"="c:\program files (x86)\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe" [2010-07-23 402432]

"DivXUpdate"="c:\program files (x86)\DivX\DivX Update\DivXUpdate.exe" [2011-03-21 1230704]

"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2011-06-06 843712]

"APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2012-02-21 59240]

"QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" [2011-10-24 421888]

"iTunesHelper"="c:\program files (x86)\iTunes\iTunesHelper.exe" [2012-03-06 421736]

"ccApp"="c:\program files (x86)\Common Files\Symantec Shared\ccApp.exe" [2009-07-09 115560]

"amd_dc_opt"="c:\program files (x86)\AMD\Dual-Core Optimizer\amd_dc_opt.exe" [2008-07-22 77824]

"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2012-01-17 252296]

"Malwarebytes' Anti-Malware"="c:\program files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe" [2012-07-03 462920]

.

c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\

McAfee Security Scan Plus.lnk - c:\program files (x86)\McAfee Security Scan\2.1.121\SSScheduler.exe [2010-9-3 255536]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"ConsentPromptBehaviorAdmin"= 5 (0x5)

"ConsentPromptBehaviorUser"= 3 (0x3)

"EnableUIADesktopToggle"= 0 (0x0)

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]

"aux"=wdmaud.drv

.

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]

Security Packages REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp

.

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\ccEvtMgr]

@="Service"

.

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\ccSetMgr]

@="Service"

.

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]

@=""

.

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]

@="Service"

.

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Symantec Antivirus]

@="Service"

.

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]

"DisableMonitoring"=dword:00000001

.

R2 BBSvc;Bing Bar Update Service;c:\program files (x86)\Microsoft\BingBar\BBSvc.EXE [2011-10-21 196176]

R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]

R2 gupdate;Google Update Service (gupdate);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-07-14 135664]

R2 HP Support Assistant Service;HP Support Assistant Service;c:\program files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe [2011-09-09 86072]

R2 McMPFSvc;McAfee Personal Firewall Service;c:\program files\Common Files\McAfee\McSvcHost\McSvHost.exe [x]

R3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-07-13 250056]

R3 GamesAppService;GamesAppService;c:\program files (x86)\WildTangent Games\App\GamesAppService.exe [2010-10-12 206072]

R3 gupdatem;Google Update Service (gupdatem);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-07-14 135664]

R3 McComponentHostService;McAfee Security Scan Component Host Service;c:\program files (x86)\McAfee Security Scan\2.1.121\McCHSvc.exe [2010-09-03 227232]

R3 Microsoft SharePoint Workspace Audit Service;Microsoft SharePoint Workspace Audit Service;c:\program files (x86)\Microsoft Office\Office14\GROOVE.EXE [2010-01-21 30963576]

R3 MozillaMaintenance;Mozilla Maintenance Service;c:\program files (x86)\Mozilla Maintenance Service\maintenanceservice.exe [2012-06-27 113120]

R3 netr28ux;Linksys USB Wireless LAN Card Driver for Vista;c:\windows\system32\DRIVERS\netr28ux.sys [2009-08-05 987648]

R3 NisDrv;Microsoft Network Inspection System;c:\windows\system32\DRIVERS\NisDrvWFP.sys [2012-03-21 98688]

R3 NisSrv;Microsoft Network Inspection;c:\program files\Microsoft Security Client\NisSrv.exe [2012-03-26 291696]

R3 osppsvc;Office Software Protection Platform;c:\program files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-01-10 4925184]

R3 SwitchBoard;Adobe SwitchBoard;c:\program files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [2010-02-19 517096]

R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-20 59392]

R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys [2012-02-15 52736]

R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [2010-07-07 1255736]

R3 X6va009;X6va009;c:\windows\SysWOW64\Drivers\X6va009 [x]

R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe [2010-09-22 57184]

S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [2009-07-14 59904]

S2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2011-06-06 63928]

S2 Akamai;Akamai NetSession Interface;c:\windows\System32\svchost.exe [2009-07-14 27136]

S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [2010-02-03 202752]

S2 BBUpdate;BBUpdate;c:\program files (x86)\Microsoft\BingBar\SeaPort.EXE [2011-10-13 249648]

S2 CalendarSynchService;CalendarSynchService;c:\program files (x86)\Hewlett-Packard\TouchSmart\Calendar\Service\GCalService.exe [2009-09-11 22072]

S2 cvhsvc;Client Virtualization Handler;c:\program files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE [2012-01-04 822624]

S2 DealCricket Upgrade;Deal Cricket Upgrade;c:\program files (x86)\Deal Cricket\dealcricketupgrade.exe [2010-10-15 17920]

S2 HPDrvMntSvc.exe;HP Quick Synchronization Service;c:\program files (x86)\Hewlett-Packard\Shared\HPDrvMntSvc.exe [2011-03-28 94264]

S2 MBAMService;MBAMService;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2012-07-03 655944]

S2 McAfee SiteAdvisor Service;McAfee SiteAdvisor Service;c:\progra~2\mcafee\SITEAD~1\McSACore.exe [2012-06-15 103472]

S2 sftlist;Application Virtualization Client;c:\program files (x86)\Microsoft Application Virtualization Client\sftlist.exe [2011-10-01 508776]

S3 amdkmdag;amdkmdag;c:\windows\system32\DRIVERS\atipmdag.sys [2010-02-03 6366720]

S3 amdkmdap;amdkmdap;c:\windows\system32\DRIVERS\atikmpag.sys [2010-02-03 186880]

S3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [2012-05-31 138912]

S3 hidkmdf;Microsoft HID Class Shim for KMDF;c:\windows\system32\DRIVERS\hidkmdf.sys [2009-09-17 14328]

S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2012-07-03 24904]

S3 netr28x;Ralink 802.11n Extensible Wireless Driver;c:\windows\system32\DRIVERS\netr28x.sys [2009-10-12 763904]

S3 NW1950;NextWindow 1950 Touch Screen;c:\windows\system32\DRIVERS\NW1950.sys [2009-09-17 25080]

S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [2009-08-21 239616]

S3 Sftfs;Sftfs;c:\windows\system32\DRIVERS\Sftfslh.sys [2011-10-01 764264]

S3 Sftplay;Sftplay;c:\windows\system32\DRIVERS\Sftplaylh.sys [2011-10-01 268648]

S3 Sftredir;Sftredir;c:\windows\system32\DRIVERS\Sftredirlh.sys [2011-10-01 25960]

S3 Sftvol;Sftvol;c:\windows\system32\DRIVERS\Sftvollh.sys [2011-10-01 22376]

S3 sftvsa;Application Virtualization Service Agent;c:\program files (x86)\Microsoft Application Virtualization Client\sftvsa.exe [2011-10-01 219496]

S3 usbfilter;AMD USB Filter Driver;c:\windows\system32\DRIVERS\usbfilter.sys [2009-04-03 34872]

.

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\svchost]

Akamai REG_MULTI_SZ Akamai

.

Contents of the 'Scheduled Tasks' folder

.

2012-07-25 c:\windows\Tasks\Adobe Flash Player Updater.job

- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-07-13 18:27]

.

2012-07-25 c:\windows\Tasks\Final Media Player Update Checker.job

- c:\program files (x86)\FinalMediaPlayer\FMPCheckForUpdates.exe [2011-02-23 21:50]

.

2012-07-25 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job

- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-07-14 01:53]

.

2012-07-25 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job

- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-07-14 01:53]

.

2012-07-25 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-4173507603-124383979-1935116261-1005Core.job

- c:\users\Home\AppData\Local\Google\Update\GoogleUpdate.exe [2011-09-07 08:30]

.

2012-07-25 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-4173507603-124383979-1935116261-1005UA.job

- c:\users\Home\AppData\Local\Google\Update\GoogleUpdate.exe [2011-09-07 08:30]

.

2012-07-14 c:\windows\Tasks\HPCeeScheduleForHome.job

- c:\program files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe [2010-09-14 03:15]

.

2012-07-23 c:\windows\Tasks\Norton Security Scan for legendkilla.job

- c:\program files (x86)\Norton Security Scan\Engine\2.7.3.34\Nss.exe [2010-10-28 10:32]

.

2012-06-30 c:\windows\Tasks\PCDRScheduledMaintenance.job

- c:\program files\PC-Doctor for Windows\pcdrcui.exe [2009-09-18 07:11]

.

.

--------- X64 Entries -----------

.

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"SoundMAX"="c:\program files (x86)\Analog Devices\SoundMAX\soundmax.exe" [2009-06-22 3866624]

"PC-Doctor for Windows localizer"="c:\program files\PC-Doctor for Windows\localizer.exe" [2009-09-17 95728]

"AdobeAAMUpdater-1.0"="c:\program files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe" [2010-03-06 500208]

"MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2012-03-26 1271168]

"combofix"="c:\combofix\CF4417.3XE" [2010-11-20 345088]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]

"LoadAppInit_DLLs"=0x0

.

------- Supplementary Scan -------

.

uLocal Page = c:\windows\system32\blank.htm

mStart Page = hxxp://home.sweetim.com

mLocal Page = c:\windows\SysWOW64\blank.htm

uInternet Settings,ProxyOverride = *.local;127.0.0.1:9421;<local>

IE: E&xport to Microsoft Excel - c:\progra~2\MICROS~4\Office14\EXCEL.EXE/3000

IE: Google Sidewiki... - c:\program files (x86)\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_7461B1589E8B4FB7.dll/cmsidewiki.html

IE: Se&nd to OneNote - c:\progra~2\MICROS~4\Office14\ONBttnIE.dll/105

IE: Translate this web page with Babylon - c:\program files (x86)\Babylon\Babylon-Pro\Utils\BabylonIEPI.dll/ActionTU.htm

IE: Translate with Babylon - c:\program files (x86)\Babylon\Babylon-Pro\Utils\BabylonIEPI.dll/Action.htm

Trusted Zone: clonewarsadventures.com

Trusted Zone: freerealms.com

Trusted Zone: soe.com

Trusted Zone: sony.com

TCP: DhcpNameServer = 192.168.1.254

FF - ProfilePath - c:\users\Home\AppData\Roaming\Mozilla\Firefox\Profiles\5ecd5axt.default\

FF - prefs.js: browser.search.defaulturl - hxxp://search.sweetim.com/search.asp?src=2&q=

FF - prefs.js: browser.search.selectedEngine - Yahoo

FF - prefs.js: browser.startup.homepage - bing.com

FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?fr=greentree_ff1&ei=utf-8&ilc=12&type=937811&p=

FF - user.js: network.cookie.cookieBehavior - 0

FF - user.js: privacy.clearOnShutdown.cookies - false

FF - user.js: security.warn_viewing_mixed - false

FF - user.js: security.warn_viewing_mixed.show_once - false

FF - user.js: security.warn_submit_insecure - false

FF - user.js: security.warn_submit_insecure.show_once - false

.

- - - - ORPHANS REMOVED - - - -

.

BHO-{59c6f12b-f004-43e5-9997-08f2123119b6} - c:\program files (x86)\oovootoolbar\oovootoolbarX.dll

Toolbar-{59c6f12b-f004-43e5-9997-08f2123119b6} - c:\program files (x86)\oovootoolbar\oovootoolbarX.dll

Wow6432Node-HKCU-Run-msnmsgm - (no file)

Wow6432Node-HKCU-Run-Akamai NetSession Interface - c:\users\Home\AppData\Local\Akamai\netsession_win.exe

SafeBoot-Symantec Antvirus

WebBrowser-{88C7F2AA-F93F-432C-8F0E-B7D85967A527} - (no file)

WebBrowser-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file)

WebBrowser-{51A86BB3-6602-4C85-92A5-130EE4864F13} - (no file)

WebBrowser-{EEE6C35B-6118-11DC-9C72-001320C79847} - (no file)

AddRemove-Adobe Shockwave Player - c:\windows\system32\Adobe\Shockwave 11\uninstaller.exe

AddRemove-{6F44AF95-3CDE-4513-AD3F-6D45F17BF324} - c:\program files (x86)\InstallShield Installation Information\{6F44AF95-3CDE-4513-AD3F-6D45F17BF324}\setup.exe

.

.

.

[HKEY_LOCAL_MACHINE\system\ControlSet001\services\Akamai]

"ServiceDll"="c:\program files (x86)\common files\akamai/netsession_win_4f7fccd.dll"

.

[HKEY_LOCAL_MACHINE\system\ControlSet001\services\X6va009]

"ImagePath"="\??\c:\windows\SysWOW64\Drivers\X6va009"

.

--------------------- LOCKED REGISTRY KEYS ---------------------

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]

@Denied: (A 2) (Everyone)

@="FlashBroker"

"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_3_300_265_ActiveX.exe,-101"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]

"Enabled"=dword:00000001

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_3_300_265_ActiveX.exe"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]

@Denied: (A 2) (Everyone)

@="Shockwave Flash Object"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_3_300_265.ocx"

"ThreadingModel"="Apartment"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]

@="0"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]

@="ShockwaveFlash.ShockwaveFlash.11"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_3_300_265.ocx, 1"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]

@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]

@="1.0"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]

@="ShockwaveFlash.ShockwaveFlash"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]

@Denied: (A 2) (Everyone)

@="Macromedia Flash Factory Object"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_3_300_265.ocx"

"ThreadingModel"="Apartment"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]

@="FlashFactory.FlashFactory.1"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_3_300_265.ocx, 1"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]

@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]

@="1.0"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]

@="FlashFactory.FlashFactory"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]

@Denied: (A 2) (Everyone)

@="IFlashBroker4"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]

@="{00020424-0000-0000-C000-000000000046}"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

"Version"="1.0"

.

[HKEY_LOCAL_MACHINE\software\McAfee]

"SymbolicLinkValue"=hex(6):5c,00,72,00,65,00,67,00,69,00,73,00,74,00,72,00,79,

00,5c,00,6d,00,61,00,63,00,68,00,69,00,6e,00,65,00,5c,00,53,00,6f,00,66,00,\

.

[HKEY_LOCAL_MACHINE\software\Wow6432Node\Microsoft\Office\Common\Smart Tag\Actions\{B7EFF951-E52F-45CC-9EF7-57124F2177CC}]

@Denied: (A) (Everyone)

"Solution"="{15727DE6-F92D-4E46-ACB4-0E2C58B31A18}"

.

[HKEY_LOCAL_MACHINE\software\Wow6432Node\Microsoft\Schema Library\ActionsPane3]

@Denied: (A) (Everyone)

.

[HKEY_LOCAL_MACHINE\software\Wow6432Node\Microsoft\Schema Library\ActionsPane3\0]

"Key"="ActionsPane3"

"Location"="c:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VSTO\\ActionsPane3.xsd"

.

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]

@Denied: (Full) (Everyone)

.

------------------------ Other Running Processes ------------------------

.

c:\program files (x86)\Common Files\Symantec Shared\ccSvcHst.exe

c:\program files (x86)\Common Files\Microsoft Shared\Ink\TabTip32.exe

c:\program files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe

c:\program files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

c:\program files (x86)\Hewlett-Packard\TouchSmart\Calendar\Service\HPTouchSmartSyncCalReminderApp.exe

c:\windows\SysWOW64\rundll32.exe

c:\program files (x86)\Symantec\Symantec Endpoint Protection\Rtvscan.exe

c:\program files (x86)\Symantec\Symantec Endpoint Protection\ProtectionUtilSurrogate.exe

c:\program files (x86)\Hewlett-Packard\TouchSmart\Media\Kernel\CLML\CLMLSvc.exe

.

**************************************************************************

.

Completion time: 2012-07-25 15:26:38 - machine was rebooted

ComboFix-quarantined-files.txt 2012-07-25 19:26

.

Pre-Run: 581,743,005,696 bytes free

Post-Run: 582,707,781,632 bytes free

.

- - End Of File - - 1A04E66092CF9B84984F46400112EC9C

Link to post
Share on other sites
MrCharlie

MrCharlie

Posted
Posted

I'm looking at what anti-virus you have, your only supposed to have one > you have two??

AV: Microsoft Security Essentials *Disabled/Updated* {9765EA51-0D3C-7DFB-6091-10E4E1F341F6}

AV: Symantec Endpoint Protection *Disabled/Updated* {88C95A36-8C3B-2F2C-1B8B-30FCCFDC4855}

One Firewall:

FW: Symantec Endpoint Protection *Disabled* {B0F2DB13-C654-2E74-30D4-99C9310F0F2E}

SP: Microsoft Security Essentials *Disabled/Updated* {2C040BB5-2B06-7275-5A21-2B969A740B4B}

SP: Symantec Endpoint Protection *Disabled/Updated* {33A8BBD2-AA01-20A2-213B-0B8EB45B02E8}

--------------------------------------

Please Update and run a Quick Scan with MBAM, post the report.

Make sure that everything is checked, and click Remove Selected.

Please let me know how computer is running now, MrC

Link to post
Share on other sites
Legendkilla023

Legendkilla023

Posted
  • Author
Posted

Malwarebytes Anti-Malware (Trial) 1.62.0.1300

www.malwarebytes.org

Database version: v2012.07.27.08

Windows 7 Service Pack 1 x64 NTFS

Internet Explorer 8.0.7601.17514

Home :: LEGENDKILLA023 [administrator]

Protection: Enabled

7/27/2012 11:31:24 AM

mbam-log-2012-07-27 (11-31-24).txt

Scan type: Quick scan

Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM

Scan options disabled: P2P

Objects scanned: 242566

Time elapsed: 38 minute(s), 37 second(s)

Memory Processes Detected: 0

(No malicious items detected)

Memory Modules Detected: 0

(No malicious items detected)

Registry Keys Detected: 0

(No malicious items detected)

Registry Values Detected: 0

(No malicious items detected)

Registry Data Items Detected: 0

(No malicious items detected)

Folders Detected: 0

(No malicious items detected)

Files Detected: 0

(No malicious items detected)

(end)

Link to post
Share on other sites
Guest
This topic is now closed to further replies.
 Share
Go to topic listing

  • Recently Browsing   0 members

    • No registered users viewing this page.
Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.