Google search redirecting

snapdragon · August 3, 2012

It's not consistent, but sometimes when I google things and click completely legitement links, I get redirected to random websites. For a while I was redirected to click.get-answers-fast.com, then redirected again, but now I'm redirected to a bunch of different places. For a while last night, I couldn't click any anti-virus type things without being directed. Kaspersky redirected to fake Nortion software.

I scanned with malwarebytes, free AVG, and spybot, and none of them find anything yet I'm still redirected. I don't know what to do now and this is my mom's computer so I really don't want to break it further.

I don't know if I have any script thingies running because I suck at computers and I don't even know what that means. Please fix me.

Attach.txt

DDS.txt

snapdragon · August 3, 2012

Oh, I'll paste the logs.

the DDS one:

.

DDS (Ver_2011-08-26.01) - NTFSAMD64

Internet Explorer: 9.0.8112.16421 BrowserJavaVersion: 1.6.0_31

Run by Monica at 13:09:02 on 2012-08-03

Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.3037.1627 [GMT -4:00]

.

AV: McAfee Anti-Virus and Anti-Spyware *Enabled/Updated* {86355677-4064-3EA7-ABB3-1B136EB04637}

SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

SP: McAfee Anti-Virus and Anti-Spyware *Enabled/Updated* {3D54B793-665E-3129-9103-206115370C8A}

FW: McAfee Firewall *Enabled* {BE0ED752-0A0B-3FFF-80EC-B2269063014C}

.

============== Running Processes ===============

.

C:\PROGRA~2\AVG\AVG2012\avgrsa.exe

C:\Program Files (x86)\AVG\AVG2012\avgcsrva.exe

C:\Windows\system32\wininit.exe

C:\Windows\system32\lsm.exe

C:\Windows\system32\svchost.exe -k DcomLaunch

C:\Windows\system32\svchost.exe -k RPCSS

c:\Program Files\Microsoft Security Client\MsMpEng.exe

C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted

C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted

C:\Windows\system32\svchost.exe -k netsvcs

C:\Program Files (x86)\Common Files\logishrd\LVMVFM\UMVPFSrv.exe

C:\Windows\system32\svchost.exe -k LocalService

C:\Program Files\Dell\DellDock\DockLogin.exe

C:\Windows\system32\svchost.exe -k NetworkService

C:\Windows\System32\spoolsv.exe

C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork

C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

C:\Program Files (x86)\AVG\AVG2012\avgwdsvc.exe

C:\Program Files\Bonjour\mDNSResponder.exe

C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe

C:\Program Files (x86)\Dell\Dell Datasafe Online\NOBuAgent.exe

C:\Program Files (x86)\Dell DataSafe Local Backup\sftservice.EXE

C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe

C:\Program Files (x86)\TeamViewer\Version7\TeamViewer_Service.exe

C:\Program Files (x86)\AVG\AVG2012\avgnsa.exe

C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\11.2.0\ToolbarUpdater.exe

C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE

C:\Program Files (x86)\Constant Guard Protection Suite\IDVaultSvc.exe

C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe

C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe

C:\Program Files (x86)\AVG\AVG2012\avgidsagent.exe

C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE

C:\Windows\system32\WUDFHost.exe

C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted

C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation

C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe

C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe

C:\Program Files\Windows Media Player\wmpnetwk.exe

C:\Windows\system32\SearchIndexer.exe

C:\Windows\system32\taskhost.exe

C:\Windows\system32\Dwm.exe

C:\Windows\Explorer.EXE

C:\Program Files (x86)\Dell DataSafe Local Backup\COMPONENTS\SCHEDULER\STSERVICE.EXE

C:\Program Files (x86)\Dell DataSafe Local Backup\Components\DSUpdate\DSUpd.exe

C:\Program Files (x86)\Dell DataSafe Local Backup\Toaster.exe

C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe

C:\Windows\System32\igfxtray.exe

C:\Windows\System32\hkcmd.exe

C:\Windows\System32\igfxpers.exe

C:\Program Files\Microsoft Security Client\msseces.exe

C:\Program Files (x86)\Constant Guard Protection Suite\IDVault.exe

C:\Program Files\Dell\DellDock\DellDock.exe

C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe

C:\Program Files (x86)\Roxio\Roxio Burn\RoxioBurnLauncher.exe

C:\Program Files (x86)\AVG\AVG2012\avgtray.exe

C:\Program Files (x86)\Logitech\LWS\Webcam Software\LWS.exe

C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe

C:\Program Files (x86)\SFT\GuardedID\GIDD.exe

C:\Program Files (x86)\AVG Secure Search\vprot.exe

C:\Program Files (x86)\iTunes\iTunesHelper.exe

C:\Program Files (x86)\Yuna Software\Messenger Plus!\PlusService.exe

C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe

C:\Program Files (x86)\SFT\GuardedID\x64\GIDD.exe

C:\Program Files\iPod\bin\iPodService.exe

C:\Program Files (x86)\Logitech\LWS\Webcam Software\CameraHelperShell.exe

C:\Program Files (x86)\Common Files\Logishrd\LQCVFX\COCIManager.exe

C:\Users\Monica\AppData\Local\Logitech® Webcam Software\Logishrd\LU2.0\LULnchr.exe

C:\Users\Monica\AppData\Local\Logitech® Webcam Software\Logishrd\LU2.0\LogitechUpdate.exe

C:\Program Files (x86)\Mozilla Firefox\firefox.exe

C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe

C:\Program Files (x86)\Windows Live\Contacts\wlcomm.exe

C:\Windows\system32\SearchProtocolHost.exe

C:\Windows\system32\SearchFilterHost.exe

C:\Windows\system32\DllHost.exe

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\conhost.exe

C:\Windows\SysWOW64\cscript.exe

C:\Windows\system32\wbem\wmiprvse.exe

.

============== Pseudo HJT Report ===============

.

uStart Page = hxxp://xfinity.comcast.net/?cid=cgps05242012

uInternet Settings,ProxyOverride = *.local

mWinlogon: Userinit=userinit.exe,

BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

BHO: AVG Do Not Track: {31332eef-cb9f-458f-afeb-d30e9a66b6ba} - C:\Program Files (x86)\AVG\AVG2012\avgdtiex.dll

BHO: AVG Safe Search: {3ca2f312-6f6e-4b53-a66e-4e65e497c8c0} - C:\Program Files (x86)\AVG\AVG2012\avgssie.dll

BHO: XFINITY Toolbar: {4b9bcce8-a70b-402a-a7e1-db96831ee26f} - C:\Program Files (x86)\xfin_portal\comcastdx.dll

BHO: Java Plug-In SSV Helper: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - C:\Program Files (x86)\Java\jre6\bin\ssv.dll

BHO: Windows Live ID Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

BHO: AVG Security Toolbar: {95b7759c-8c7f-4bf1-b163-73684a933233} - C:\Program Files (x86)\AVG Secure Search\11.1.0.12\AVG Secure Search_toolbar.dll

BHO: Windows Live Messenger Companion Helper: {9fdde16b-836f-4806-ab1f-1455cbeff289} - C:\Program Files (x86)\Windows Live\Companion\companioncore.dll

BHO: Skype add-on for Internet Explorer: {ae805869-2e5c-4ed4-8f7b-f1f7851a4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll

BHO: Office Document Cache Handler: {b4f3a835-0e21-4959-ba22-42b3008e02ff} - C:\PROGRA~2\MICROS~1\Office14\URLREDIR.DLL

BHO: Updater For XFIN_PORTAL: {bb46be07-13eb-4c49-b0f0-fc78b9ea4983} - C:\Program Files (x86)\xfin_portal\auxi\comcastAu.dll

BHO: Java Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll

TB: XFINITY Toolbar: {4b9bcce8-a70b-402a-a7e1-db96831ee26f} - C:\Program Files (x86)\xfin_portal\comcastdx.dll

TB: AVG Security Toolbar: {95b7759c-8c7f-4bf1-b163-73684a933233} - C:\Program Files (x86)\AVG Secure Search\11.1.0.12\AVG Secure Search_toolbar.dll

{e7df6bff-55a5-4eb7-a673-4ed3e9456d39}

uRun: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

uRun: [Google Update] "C:\Users\Monica\AppData\Local\Google\Update\GoogleUpdate.exe" /c

uRun: [msnmsgr] "C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe" /background

mRun: [iAStorIcon] C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe

mRun: [Desktop Disc Tool] "c:\Program Files (x86)\Roxio\Roxio Burn\RoxioBurnLauncher.exe"

mRun: [Dell DataSafe Online] C:\Program Files (x86)\Dell\Dell Datasafe Online\NOBuClient.exe

mRun: [AVG_TRAY] "C:\Program Files (x86)\AVG\AVG2012\avgtray.exe"

mRun: [LWS] C:\Program Files (x86)\Logitech\LWS\Webcam Software\LWS.exe -hide

mRun: [sunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"

mRun: [GIDDesktop] C:\Program Files (x86)\SFT\GuardedID\gidd.exe /s

mRun: [vProt] "C:\Program Files (x86)\AVG Secure Search\vprot.exe"

mRun: [Adobe Reader Speed Launcher] "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe"

mRun: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"

mRun: [APSDaemon] "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe"

mRun: [iTunesHelper] "C:\Program Files (x86)\iTunes\iTunesHelper.exe"

mRun: [PlusService] C:\Program Files (x86)\Yuna Software\Messenger Plus!\PlusService.exe

mRun: [HF_G_Jul] "C:\Program Files (x86)\AVG Secure Search\HF_G_Jul.exe" /DoAction

mRun: [Malwarebytes' Anti-Malware] "C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe" /starttray

mRunOnce: ["C:\Program Files (x86)\Dell DataSafe Local Backup\Components\DSUpdate\DSUpdate.exe"] "C:\Program Files (x86)\Dell DataSafe Local Backup\Components\DSUpdate\DSUpdate.exe"

mRunOnce: [Launcher] C:\Program Files (x86)\Dell DataSafe Local Backup\Components\Scheduler\Launcher.exe

StartupFolder: C:\Users\Monica\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\DELLDO~1.LNK - C:\Program Files (x86)\Dell\DellDock\DellDock.exe

StartupFolder: C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\Startup\CONSTA~1.LNK - C:\Program Files (x86)\Constant Guard Protection Suite\IDVault.exe

uPolicies-explorer: HideSCAHealth = 1 (0x1)

mPolicies-explorer: NoActiveDesktop = 1 (0x1)

mPolicies-system: ConsentPromptBehaviorAdmin = 5 (0x5)

mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3)

mPolicies-system: EnableUIADesktopToggle = 0 (0x0)

IE: E&xport to Microsoft Excel - C:\PROGRA~2\MICROS~1\Office14\EXCEL.EXE/3000

IE: Se&nd to OneNote - C:\PROGRA~2\MICROS~1\Office14\ONBttnIE.dll/105

IE: {0000036B-C524-4050-81A0-243669A86B9F} - {B63DBA5F-523F-4B9C-A43D-65DF1977EAD3} - C:\Program Files (x86)\Windows Live\Companion\companioncore.dll

IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll

IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIE.dll

IE: {68BCFFE1-A2DA-4B40-9068-87ECBFC19D16} - {68BCFFE1-A2DA-4B40-9068-87ECBFC19D16} - C:\Program Files (x86)\AVG\AVG2012\avgdtiex.dll

IE: {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - {FFFDC614-B694-4AE6-AB38-5D6374584B52} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIELinkedNotes.dll

IE: {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll

DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} - hxxp://download.eset.com/special/eos/OnlineScanner.cab

DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab

DPF: {CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab

DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab

TCP: DhcpNameServer = 192.168.1.1 75.75.75.75 75.75.76.76

TCP: Interfaces\{AE71F8CD-3945-4FAE-A66A-0A2C63CBF182} : DhcpNameServer = 192.168.1.1 75.75.75.75 75.75.76.76

Filter: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\MSOXMLMF.DLL

Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files (x86)\AVG\AVG2012\avgpp.dll

Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll

Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL

Handler: viprotocol - {B658800C-F66E-4EF3-AB85-6C0C227862A9} - C:\Program Files (x86)\Common Files\AVG Secure Search\ViProtocolInstaller\11.2.0\ViProtocol.dll

Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files (x86)\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll

mASetup: {9191979D-821C-4EA8-B021-2DA1D859A7C5}-3Reg - C:\Program Files (x86)\SFT\GuardedID\gidi.exe /v

BHO-X64: Adobe PDF Link Helper: {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

BHO-X64: AcroIEHelperStub - No File

BHO-X64: AVG Do Not Track: {31332EEF-CB9F-458F-AFEB-D30E9A66B6BA} - C:\Program Files (x86)\AVG\AVG2012\avgdtiex.dll

BHO-X64: AVG Do Not Track - No File

BHO-X64: AVG Safe Search: {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files (x86)\AVG\AVG2012\avgssie.dll

BHO-X64: WormRadar.com IESiteBlocker.NavFilter - No File

BHO-X64: XFINITY Toolbar: {4b9bcce8-a70b-402a-a7e1-db96831ee26f} - C:\Program Files (x86)\xfin_portal\comcastdx.dll

BHO-X64: XFINITY Toolbar - No File

BHO-X64: Java Plug-In SSV Helper: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre6\bin\ssv.dll

BHO-X64: Windows Live ID Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

BHO-X64: AVG Security Toolbar: {95B7759C-8C7F-4BF1-B163-73684A933233} - C:\Program Files (x86)\AVG Secure Search\11.1.0.12\AVG Secure Search_toolbar.dll

BHO-X64: Windows Live Messenger Companion Helper: {9FDDE16B-836F-4806-AB1F-1455CBEFF289} - C:\Program Files (x86)\Windows Live\Companion\companioncore.dll

BHO-X64: Skype add-on for Internet Explorer: {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll

BHO-X64: SkypeIEPluginBHO - No File

BHO-X64: Office Document Cache Handler: {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~2\MICROS~1\Office14\URLREDIR.DLL

BHO-X64: URLRedirectionBHO - No File

BHO-X64: Updater For XFIN_PORTAL: {bb46be07-13eb-4c49-b0f0-fc78b9ea4983} - C:\Program Files (x86)\xfin_portal\auxi\comcastAu.dll

BHO-X64: Updater For XFIN_PORTAL - No File

BHO-X64: Java Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll

TB-X64: XFINITY Toolbar: {4b9bcce8-a70b-402a-a7e1-db96831ee26f} - C:\Program Files (x86)\xfin_portal\comcastdx.dll

TB-X64: AVG Security Toolbar: {95B7759C-8C7F-4BF1-B163-73684A933233} - C:\Program Files (x86)\AVG Secure Search\11.1.0.12\AVG Secure Search_toolbar.dll

mRun-x64: [iAStorIcon] C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe

mRun-x64: [Desktop Disc Tool] "c:\Program Files (x86)\Roxio\Roxio Burn\RoxioBurnLauncher.exe"

mRun-x64: [Dell DataSafe Online] C:\Program Files (x86)\Dell\Dell Datasafe Online\NOBuClient.exe

mRun-x64: [AVG_TRAY] "C:\Program Files (x86)\AVG\AVG2012\avgtray.exe"

mRun-x64: [LWS] C:\Program Files (x86)\Logitech\LWS\Webcam Software\LWS.exe -hide

mRun-x64: [sunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"

mRun-x64: [GIDDesktop] C:\Program Files (x86)\SFT\GuardedID\gidd.exe /s

mRun-x64: [vProt] "C:\Program Files (x86)\AVG Secure Search\vprot.exe"

mRun-x64: [Adobe Reader Speed Launcher] "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe"

mRun-x64: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"

mRun-x64: [APSDaemon] "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe"

mRun-x64: [iTunesHelper] "C:\Program Files (x86)\iTunes\iTunesHelper.exe"

mRun-x64: [PlusService] C:\Program Files (x86)\Yuna Software\Messenger Plus!\PlusService.exe

mRun-x64: [HF_G_Jul] "C:\Program Files (x86)\AVG Secure Search\HF_G_Jul.exe" /DoAction

mRun-x64: [Malwarebytes' Anti-Malware] "C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe" /starttray

mRunOnce-x64: ["C:\Program Files (x86)\Dell DataSafe Local Backup\Components\DSUpdate\DSUpdate.exe"] "C:\Program Files (x86)\Dell DataSafe Local Backup\Components\DSUpdate\DSUpdate.exe"

mRunOnce-x64: [Launcher] C:\Program Files (x86)\Dell DataSafe Local Backup\Components\Scheduler\Launcher.exe

.

================= FIREFOX ===================

.

FF - ProfilePath - C:\Users\Monica\AppData\Roaming\Mozilla\Firefox\Profiles\w9h1gvrc.default\

FF - prefs.js: browser.search.selectedEngine - Google

FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/

FF - prefs.js: keyword.URL - hxxp://isearch.avg.com/search?cid=%7B91742f01-7779-4a82-b2b5-0d01bde227a1%7D&mid=887fb5bbb47647d18b4069e5293aba43-e7556ebd7c7bcea0ef02e4f021e4cb4f831f4b61&ds=AVG&v=11.1.0.7〈=en&pr=fr&d=2012-06-02%2019%3A35%3A54&sap=ku&q=

FF - prefs.js: network.proxy.type - 0

FF - component: C:\Users\Monica\AppData\Roaming\Mozilla\Firefox\Profiles\w9h1gvrc.default\extensions\{B042753D-F57E-4e8e-A01B-7379A6D4CEFB}\components\IBitCometExtension.dll

FF - plugin: C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL

FF - plugin: C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL

FF - plugin: C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll

FF - plugin: C:\Program Files (x86)\Common Files\AVG Secure Search\SiteSafetyInstaller\11.2.0\npsitesafety.dll

FF - plugin: C:\Program Files (x86)\Java\jre6\bin\plugin2\npdeployJava1.dll

FF - plugin: C:\Program Files (x86)\Java\jre6\bin\plugin2\npjp2.dll

FF - plugin: c:\Program Files (x86)\Microsoft Silverlight\5.1.10411.0\npctrlui.dll

FF - plugin: C:\Program Files (x86)\Mozilla Firefox\plugins\npdeployJava1.dll

FF - plugin: C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll

FF - plugin: C:\Program Files (x86)\WildTangent Games\App\BrowserIntegration\Registered\1\NP_wtapp.dll

FF - plugin: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll

FF - plugin: C:\Users\Monica\AppData\Local\Google\Update\1.3.21.115\npGoogleUpdate3.dll

FF - plugin: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_3_300_270.dll

.

============= SERVICES / DRIVERS ===============

.

R0 AVGIDSHA;AVGIDSHA;C:\Windows\system32\DRIVERS\avgidsha.sys --> C:\Windows\system32\DRIVERS\avgidsha.sys [?]

R0 Avgrkx64;AVG Anti-Rootkit Driver;C:\Windows\system32\DRIVERS\avgrkx64.sys --> C:\Windows\system32\DRIVERS\avgrkx64.sys [?]

R0 MpFilter;Microsoft Malware Protection Driver;C:\Windows\system32\DRIVERS\MpFilter.sys --> C:\Windows\system32\DRIVERS\MpFilter.sys [?]

R0 PxHlpa64;PxHlpa64;C:\Windows\system32\Drivers\PxHlpa64.sys --> C:\Windows\system32\Drivers\PxHlpa64.sys [?]

R1 Avgldx64;AVG AVI Loader Driver;C:\Windows\system32\DRIVERS\avgldx64.sys --> C:\Windows\system32\DRIVERS\avgldx64.sys [?]

R1 Avgmfx64;AVG Mini-Filter Resident Anti-Virus Shield;C:\Windows\system32\DRIVERS\avgmfx64.sys --> C:\Windows\system32\DRIVERS\avgmfx64.sys [?]

R1 Avgtdia;AVG TDI Driver;C:\Windows\system32\DRIVERS\avgtdia.sys --> C:\Windows\system32\DRIVERS\avgtdia.sys [?]

R1 GIDv2;GIDv2;C:\Windows\system32\drivers\GIDv2.sys --> C:\Windows\system32\drivers\GIDv2.sys [?]

R2 AVGIDSAgent;AVGIDSAgent;C:\Program Files (x86)\AVG\AVG2012\avgidsagent.exe [2012-7-4 5160568]

R2 avgwd;AVG WatchDog;C:\Program Files (x86)\AVG\AVG2012\avgwdsvc.exe [2012-2-14 193288]

R2 cvhsvc;Client Virtualization Handler;C:\Program Files (x86)\Common Files\microsoft shared\Virtualization Handler\CVHSVC.EXE [2012-1-4 822624]

R2 DockLoginService;Dock Login Service;C:\Program Files\Dell\DellDock\DockLogin.exe [2009-6-9 155648]

R2 IAStorDataMgrSvc;Intel® Rapid Storage Technology;C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe [2010-12-14 13336]

R2 IDVaultSvc;CGPS Service;C:\Program Files (x86)\Constant Guard Protection Suite\IDVaultSvc.exe [2012-7-18 66160]

R2 MBAMService;MBAMService;C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2011-5-19 655944]

R2 NOBU;Dell DataSafe Online;C:\Program Files (x86)\Dell\Dell Datasafe Online\NOBuAgent.exe [2010-8-25 2823000]

R2 sftlist;Application Virtualization Client;C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe [2011-10-1 508776]

R2 SftService;SoftThinks Agent Service;C:\Program Files (x86)\Dell DataSafe Local Backup\SftService.exe [2010-12-14 705856]

R2 TeamViewer7;TeamViewer 7;C:\Program Files (x86)\TeamViewer\Version7\TeamViewer_Service.exe [2012-8-1 2673064]

R2 UMVPFSrv;UMVPFSrv;C:\Program Files (x86)\Common Files\logishrd\LVMVFM\UMVPFSrv.exe [2011-8-19 450848]

R2 vToolbarUpdater11.2.0;vToolbarUpdater11.2.0;C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\11.2.0\ToolbarUpdater.exe [2012-7-9 935008]

R3 AVGIDSDriver;AVGIDSDriver;C:\Windows\system32\DRIVERS\avgidsdrivera.sys --> C:\Windows\system32\DRIVERS\avgidsdrivera.sys [?]

R3 AVGIDSFilter;AVGIDSFilter;C:\Windows\system32\DRIVERS\avgidsfiltera.sys --> C:\Windows\system32\DRIVERS\avgidsfiltera.sys [?]

R3 IntcHdmiAddService;Intel® High Definition Audio HDMI;C:\Windows\system32\drivers\IntcHdmi.sys --> C:\Windows\system32\drivers\IntcHdmi.sys [?]

R3 MBAMProtector;MBAMProtector;\??\C:\Windows\system32\drivers\mbam.sys --> C:\Windows\system32\drivers\mbam.sys [?]

R3 RTL8167;Realtek 8167 NT Driver;C:\Windows\system32\DRIVERS\Rt64win7.sys --> C:\Windows\system32\DRIVERS\Rt64win7.sys [?]

R3 Sftfs;Sftfs;C:\Windows\system32\DRIVERS\Sftfslh.sys --> C:\Windows\system32\DRIVERS\Sftfslh.sys [?]

R3 Sftplay;Sftplay;C:\Windows\system32\DRIVERS\Sftplaylh.sys --> C:\Windows\system32\DRIVERS\Sftplaylh.sys [?]

R3 Sftredir;Sftredir;C:\Windows\system32\DRIVERS\Sftredirlh.sys --> C:\Windows\system32\DRIVERS\Sftredirlh.sys [?]

R3 Sftvol;Sftvol;C:\Windows\system32\DRIVERS\Sftvollh.sys --> C:\Windows\system32\DRIVERS\Sftvollh.sys [?]

R3 sftvsa;Application Virtualization Service Agent;C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe [2011-10-1 219496]

S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]

S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-3-18 138576]

S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-6-3 250056]

S3 GamesAppService;GamesAppService;C:\Program Files (x86)\WildTangent Games\App\GamesAppService.exe [2010-10-12 206072]

S3 LVRS64;Logitech RightSound Filter Driver;C:\Windows\system32\DRIVERS\lvrs64.sys --> C:\Windows\system32\DRIVERS\lvrs64.sys [?]

S3 LVUVC64;Logitech HD Webcam C270(UVC);C:\Windows\system32\DRIVERS\lvuvc64.sys --> C:\Windows\system32\DRIVERS\lvuvc64.sys [?]

S3 MozillaMaintenance;Mozilla Maintenance Service;C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe [2012-5-9 113120]

S3 NisDrv;Microsoft Network Inspection System;C:\Windows\system32\DRIVERS\NisDrvWFP.sys --> C:\Windows\system32\DRIVERS\NisDrvWFP.sys [?]

S3 NisSrv;Microsoft Network Inspection;C:\Program Files\Microsoft Security Client\NisSrv.exe [2012-3-26 291696]

S3 osppsvc;Office Software Protection Platform;C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-1-9 4925184]

S3 TsUsbFlt;TsUsbFlt;C:\Windows\system32\drivers\tsusbflt.sys --> C:\Windows\system32\drivers\tsusbflt.sys [?]

S3 USBAAPL64;Apple Mobile USB Driver;C:\Windows\system32\Drivers\usbaapl64.sys --> C:\Windows\system32\Drivers\usbaapl64.sys [?]

S3 WatAdminSvc;Windows Activation Technologies Service;C:\Windows\system32\Wat\WatAdminSvc.exe --> C:\Windows\system32\Wat\WatAdminSvc.exe [?]

S3 WDC_SAM;WD SCSI Pass Thru driver;C:\Windows\system32\DRIVERS\wdcsam64.sys --> C:\Windows\system32\DRIVERS\wdcsam64.sys [?]

S3 WsAudio_DeviceS(1);WsAudio_DeviceS(1);C:\Windows\system32\drivers\WsAudio_DeviceS(1).sys --> C:\Windows\system32\drivers\WsAudio_DeviceS(1).sys [?]

S3 WsAudio_DeviceS(2);WsAudio_DeviceS(2);C:\Windows\system32\drivers\WsAudio_DeviceS(2).sys --> C:\Windows\system32\drivers\WsAudio_DeviceS(2).sys [?]

S4 wlcrasvc;Windows Live Mesh remote connections service;C:\Program Files\Windows Live\Mesh\wlcrasvc.exe [2010-9-22 57184]

.

=============== Created Last 30 ================

.

2012-08-03 17:04:47 -------- d-----w- C:\Users\Monica\AppData\Local\{CAC67DC7-3072-48B0-9462-CEF75EBA4D95}

2012-08-03 17:04:37 -------- d-----w- C:\Users\Monica\AppData\Local\{560F9F9F-19DC-4600-9C6E-DC4CA1F8374B}

2012-08-03 09:02:32 69000 ----a-w- C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{085881DC-AAB0-4B58-B71C-91089859C2B2}\offreg.dll

2012-08-03 08:24:43 39184 ----a-w- C:\Windows\System32\Partizan.exe

2012-08-03 08:21:26 -------- d-----w- C:\ProgramData\RegRun

2012-08-03 08:21:16 2 --shatr- C:\Windows\winstart.bat

2012-08-03 08:20:34 -------- d-----w- C:\Program Files (x86)\UnHackMe

2012-08-03 04:39:55 -------- d-----w- C:\Program Files (x86)\Panda Security

2012-08-03 04:21:54 279656 ------w- C:\Windows\System32\MpSigStub.exe

2012-08-03 04:19:19 927800 ----a-w- C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{E02A07BB-0BEC-4002-B26C-077B795E8F55}\gapaengine.dll

2012-08-03 04:19:02 9133488 ----a-w- C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{085881DC-AAB0-4B58-B71C-91089859C2B2}\mpengine.dll

2012-08-03 04:16:48 -------- d-----w- C:\Program Files (x86)\Microsoft Security Client

2012-08-03 04:16:37 -------- d-----w- C:\Program Files\Microsoft Security Client

2012-08-02 23:25:45 -------- d-----w- C:\Users\Monica\AppData\Local\{6FBB9E92-FAA8-46C1-892B-6AF99B741331}

2012-08-02 23:25:34 -------- d-----w- C:\Users\Monica\AppData\Local\{C6A8BDD6-7AB7-4DDF-97E1-DDC2165243B0}

2012-08-02 03:40:36 -------- d-----w- C:\Users\Monica\temp

2012-08-02 03:40:35 -------- d-----w- C:\Users\Monica\AppData\Roaming\TeamViewer

2012-08-02 03:40:01 -------- d-----w- C:\Program Files (x86)\TeamViewer

2012-08-02 01:41:19 -------- d-----w- C:\Users\Monica\AppData\Local\{4ED95E48-5232-4AA6-A957-1E60ACC7066F}

2012-08-02 01:40:59 -------- d-----w- C:\Users\Monica\AppData\Local\{5ECC8145-E5D8-43C0-8234-F8E2F8C74694}

2012-08-01 04:50:54 -------- d-----w- C:\Users\Monica\AppData\Local\Netscape

2012-08-01 01:12:45 -------- d-----w- C:\Users\Monica\AppData\Local\{C43BEE84-7080-4EEF-A402-62507F751BA7}

2012-08-01 01:12:33 -------- d-----w- C:\Users\Monica\AppData\Local\{BA9C98B5-8D05-44DA-A919-4567825DE9EC}

2012-07-31 05:41:46 -------- d-----w- C:\Users\Monica\AppData\Local\{51BB49BE-1369-490D-8147-649D9B3598E0}

2012-07-31 05:41:32 -------- d-----w- C:\Users\Monica\AppData\Local\{89E45E66-CE37-4668-AAF8-4F39F4C3BA29}

2012-07-30 00:54:19 -------- d-----w- C:\Users\Monica\AppData\Local\{D73C693F-EC6B-4812-A3D5-93CD8B1B1324}

2012-07-30 00:54:08 -------- d-----w- C:\Users\Monica\AppData\Local\{3F048F52-A60D-4411-B3E4-1018BC097D3C}

2012-07-29 09:03:17 -------- d-----w- C:\Users\Monica\AppData\Local\{76572BFF-147F-4516-B3E9-07F97DE476CB}

2012-07-29 09:03:03 -------- d-----w- C:\Users\Monica\AppData\Local\{8531CF03-BDC3-4A8E-95AB-CB25CDE03E8D}

2012-07-27 21:15:18 -------- d-----w- C:\Users\Monica\AppData\Local\{EBE91465-8E67-426A-8A15-3F0290023B47}

2012-07-27 21:15:06 -------- d-----w- C:\Users\Monica\AppData\Local\{E97EAF84-FD9E-4D20-8605-0D633B226008}

2012-07-27 01:51:20 -------- d-----w- C:\Users\Monica\AppData\Local\{4D7F29C1-75C7-47E8-9EC0-1E77BA048E4D}

2012-07-27 01:51:07 -------- d-----w- C:\Users\Monica\AppData\Local\{64DEB608-D1D2-4D32-8AB1-08696161A91C}

2012-07-26 02:22:27 -------- d-----w- C:\Users\Monica\AppData\Local\{729652FE-69EB-4245-BBE4-B14D26A8094B}

2012-07-26 02:22:16 -------- d-----w- C:\Users\Monica\AppData\Local\{027C6668-4221-4E82-93F7-ECBEBF372B5D}

2012-07-25 18:04:11 8007680 ----a-w- C:\Program Files (x86)\Mozilla Firefox\Microsoft.mshtml.dll

2012-07-25 08:07:26 -------- d-----w- C:\Users\Monica\AppData\Local\{5DA8DD7A-7C6F-4B10-AF72-66AD85431C13}

2012-07-25 08:07:14 -------- d-----w- C:\Users\Monica\AppData\Local\{34A602C4-97B1-43F5-9E0C-2AC354259D88}

2012-07-24 18:45:34 -------- d-----w- C:\Users\Monica\AppData\Local\{C378CD86-92FB-4752-940C-7BA208A157E9}

2012-07-24 18:45:14 -------- d-----w- C:\Users\Monica\AppData\Local\{37B7F17F-330C-48D4-88E4-FC35E75F7021}

2012-07-23 20:48:05 -------- d-----w- C:\Users\Monica\AppData\Local\{073EC2AA-A822-4567-B82D-4D1C367B329D}

2012-07-23 20:47:53 -------- d-----w- C:\Users\Monica\AppData\Local\{80BAAB91-74FF-41F5-8CF3-C2D9D974353B}

2012-07-23 01:09:37 -------- d-----w- C:\Users\Monica\AppData\Local\{3145F7D7-B5CC-4E43-B8AB-6D24F0E9FC1B}

2012-07-23 01:09:14 -------- d-----w- C:\Users\Monica\AppData\Local\{5EEF6C74-6C71-4FD5-B3C2-7785AE6600EF}

2012-07-22 21:07:45 -------- d-----w- C:\Users\Monica\AppData\Roaming\Macrovision

2012-07-22 04:56:53 -------- d-----w- C:\Users\Monica\AppData\Roaming\Three Rings Design

2012-07-22 04:53:38 -------- d-----w- C:\Users\Monica\AppData\Local\PMB Files

2012-07-22 04:53:36 -------- d-----w- C:\ProgramData\PMB Files

2012-07-22 04:53:26 -------- d-----w- C:\Program Files (x86)\Pando Networks

2012-07-22 03:47:26 -------- d-----w- C:\Users\Monica\AppData\Local\{EBAECF27-AC24-4ADA-9B87-C5E1C2086232}

2012-07-22 03:47:08 -------- d-----w- C:\Users\Monica\AppData\Local\{B4BD07B5-1697-429A-B9A3-30E5B1462CB2}

2012-07-22 03:29:53 -------- d-----w- C:\Users\Monica\AppData\Roaming\Gyazo

2012-07-22 03:28:39 -------- d-----w- C:\Program Files (x86)\Gyazo

2012-07-21 01:03:59 -------- d-----w- C:\Users\Monica\AppData\Local\{621E7F9E-151B-44D3-B47A-46B2C0327873}

2012-07-21 01:03:46 -------- d-----w- C:\Users\Monica\AppData\Local\{E1BD9846-ED98-498F-85E0-7D6EB706ECA5}

2012-07-20 05:52:36 -------- d-----w- C:\Users\Monica\AppData\Local\{36FB2A01-BFBF-4246-B966-B462608097D2}

2012-07-20 05:52:23 -------- d-----w- C:\Users\Monica\AppData\Local\{592B6073-9F51-40C6-BC67-4B4473895EE8}

2012-07-18 20:49:11 -------- d-----w- C:\Users\Monica\AppData\Local\{CF8573D2-B3B1-435D-9F89-B59A22526B7D}

2012-07-18 20:48:50 -------- d-----w- C:\Users\Monica\AppData\Local\{8C0D373B-1FCC-44AE-8AD6-8CA44293CD94}

2012-07-18 01:12:41 -------- d-----w- C:\Users\Monica\AppData\Local\{E6948262-A08C-46AD-9801-84219E6FB55F}

2012-07-18 01:12:23 -------- d-----w- C:\Users\Monica\AppData\Local\{B6A848F6-894E-4E08-83EC-A7CCB0C01867}

2012-07-16 22:48:46 -------- d-----w- C:\Users\Monica\AppData\Local\{AE5A2072-8E71-4647-B85F-4FE6582E7B12}

2012-07-16 22:48:36 -------- d-----w- C:\Users\Monica\AppData\Local\{B113F1E3-4F7B-40D2-9717-86041EE13224}

2012-07-15 20:24:15 -------- d-----w- C:\Users\Monica\AppData\Local\{5C2E9490-DCF3-4DD8-9FC9-98A93824FD95}

2012-07-15 20:23:53 -------- d-----w- C:\Users\Monica\AppData\Local\{90E6FFF1-72BB-47DE-A8E0-D65C22C04652}

2012-07-15 00:16:15 -------- d-----w- C:\Users\Monica\AppData\Local\{FE913DAD-3299-4423-B036-E79ED5BEC094}

2012-07-15 00:15:52 -------- d-----w- C:\Users\Monica\AppData\Local\{4830B89F-A4D2-4F53-B98A-075CC28D5171}

2012-07-13 22:13:14 -------- d-----w- C:\Users\Monica\AppData\Local\{76B70729-3E43-4661-B4D2-BED749B938F9}

2012-07-13 22:12:49 -------- d-----w- C:\Users\Monica\AppData\Local\{A5083E04-B16C-49C7-B8E5-74E14FE93CDD}

2012-07-13 01:19:07 -------- d-----w- C:\Users\Monica\AppData\Local\{DBE0B254-2EF5-42BE-9680-C72AF6CD2331}

2012-07-13 01:18:43 -------- d-----w- C:\Users\Monica\AppData\Local\{F982F901-9E9B-467E-9042-CD300424EC5C}

2012-07-12 06:33:40 3148800 ----a-w- C:\Windows\System32\win32k.sys

2012-07-12 03:30:00 -------- d-----w- C:\Users\Monica\AppData\Local\{96AAFB6D-1175-4610-80F3-5C8DD8C1076A}

2012-07-12 03:29:49 -------- d-----w- C:\Users\Monica\AppData\Local\{8FB1C8D3-4369-4A11-8487-FF254B5F1D0A}

2012-07-11 02:55:14 -------- d-----w- C:\Users\Monica\AppData\Local\{D860A217-5B4A-4900-A887-25C33445C4FC}

2012-07-11 02:55:02 -------- d-----w- C:\Users\Monica\AppData\Local\{BE2B5174-CE7D-4B59-86DC-E8CFD23FFC3F}

2012-07-09 22:02:30 -------- d-----w- C:\Users\Monica\AppData\Local\{6CA69CC7-DFD8-4592-9E95-46AB289CB8FC}

2012-07-09 22:02:05 -------- d-----w- C:\Users\Monica\AppData\Local\{7F031E60-561D-42AB-A4CC-F6C38F036945}

2012-07-09 10:01:30 -------- d-----w- C:\Users\Monica\AppData\Local\{914CCD34-9DC0-4F42-BFA2-02CE83336A8F}

2012-07-09 10:01:07 -------- d-----w- C:\Users\Monica\AppData\Local\{A29B8F43-FC88-499B-95A5-B3F11CA59444}

2012-07-08 21:09:32 -------- d-----w- C:\Users\Monica\AppData\Local\{6C63778A-7689-423B-AE28-56A7352AD73A}

2012-07-08 21:09:10 -------- d-----w- C:\Users\Monica\AppData\Local\{CB5BEA7F-AFD8-4BF2-A6B6-EC4CAE20648F}

2012-07-08 07:59:27 -------- d-----w- C:\Users\Monica\AppData\Local\{D38C8444-F9AB-40E7-AD2D-929AF9A5B176}

2012-07-08 07:59:03 -------- d-----w- C:\Users\Monica\AppData\Local\{CF84E57B-491E-439B-8DE2-0B1C8EF5724F}

2012-07-07 19:58:33 -------- d-----w- C:\Users\Monica\AppData\Local\{EE988628-C1D1-4D6A-BA35-65DDF89D829A}

2012-07-07 19:58:11 -------- d-----w- C:\Users\Monica\AppData\Local\{BF6FF22F-4E36-484E-9FC0-1712DBFDBB17}

2012-07-07 10:58:17 -------- d-----w- C:\Users\Monica\AppData\Local\{82FC8D0A-8AAD-4B1B-9C6D-0C9CCBD7D6B0}

2012-07-07 10:57:52 -------- d-----w- C:\Users\Monica\AppData\Local\{C83DAF1B-D506-4A35-94ED-926154A2A210}

2012-07-06 21:36:10 -------- d-----w- C:\Users\Monica\AppData\Local\{426C53B8-7B32-49A4-A920-F8EC1557BF70}

2012-07-06 21:36:00 -------- d-----w- C:\Users\Monica\AppData\Local\{E29C37D1-DA53-4754-85B9-0DEBA997FCE9}

2012-07-06 17:41:50 29288 ----a-w- C:\Windows\System32\drivers\WsAudio_DeviceS(2).sys

2012-07-06 17:40:54 29288 ----a-w- C:\Windows\System32\drivers\WsAudio_DeviceS(1).sys

2012-07-06 17:40:51 -------- d-----w- C:\Users\Monica\AppData\Local\iSkysoft

2012-07-06 17:40:50 -------- d-----w- C:\Program Files (x86)\Common Files\iSkysoft

2012-07-06 17:40:46 892928 ----a-w- C:\Windows\SysWow64\iconv.dll

2012-07-06 17:40:46 675840 ----a-w- C:\Windows\SysWow64\ac3filter.ax

2012-07-06 17:40:45 -------- d-----w- C:\Program Files (x86)\iSkysoft

2012-07-06 03:11:53 -------- d-----w- C:\Users\Monica\AppData\Local\{FE72AED7-D852-43B5-9B7A-A14D0062ADE5}

2012-07-06 03:11:31 -------- d-----w- C:\Users\Monica\AppData\Local\{B05EBF74-030C-4B94-A6C4-4A976D039B84}

2012-07-05 13:42:40 -------- d-----w- C:\Users\Monica\AppData\Local\{254DCC50-53C9-4AEE-ACA4-2930660234CB}

2012-07-05 13:41:48 -------- d-----w- C:\Users\Monica\AppData\Local\{C8ADD9F4-33B3-46A3-9A7B-01F5F293B4EB}

2012-07-05 04:33:25 -------- d-----w- C:\Users\Monica\AppData\Local\{FB137BD2-7A5E-4FE3-A3A2-739404D0DC0A}

2012-07-05 04:27:32 -------- d-----w- C:\Users\Monica\AppData\Local\{7B854BA6-91F6-44E4-8DE3-2836FCE43124}

2012-07-05 04:18:44 -------- d-----w- C:\Users\Monica\AppData\Local\{30656D2A-6295-4B2A-821B-C146762DBCAC}

2012-07-05 04:13:00 -------- d-----w- C:\Users\Monica\AppData\Local\{AADCEE1F-5175-4345-BEB4-5B6A0215B95A}

.

==================== Find3M ====================

.

2012-08-03 07:54:06 426184 ----a-w- C:\Windows\SysWow64\FlashPlayerApp.exe

2012-08-03 07:54:05 70344 ----a-w- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl

2012-07-03 17:46:44 24904 ----a-w- C:\Windows\System32\drivers\mbam.sys

2012-06-06 06:06:16 2004480 ----a-w- C:\Windows\System32\msxml6.dll

2012-06-06 06:06:16 1881600 ----a-w- C:\Windows\System32\msxml3.dll

2012-06-06 06:02:54 1133568 ----a-w- C:\Windows\System32\cdosys.dll

2012-06-06 05:05:52 1390080 ----a-w- C:\Windows\SysWow64\msxml6.dll

2012-06-06 05:05:52 1236992 ----a-w- C:\Windows\SysWow64\msxml3.dll

2012-06-06 05:03:06 805376 ----a-w- C:\Windows\SysWow64\cdosys.dll

2012-06-02 22:15:31 2622464 ----a-w- C:\Windows\System32\wucltux.dll

2012-06-02 22:15:08 99840 ----a-w- C:\Windows\System32\wudriver.dll

2012-06-02 19:19:42 186752 ----a-w- C:\Windows\System32\wuwebv.dll

2012-06-02 19:15:12 36864 ----a-w- C:\Windows\System32\wuapp.exe

2012-06-02 12:12:17 2311680 ----a-w- C:\Windows\System32\jscript9.dll

2012-06-02 12:05:28 1392128 ----a-w- C:\Windows\System32\wininet.dll

2012-06-02 12:04:50 1494528 ----a-w- C:\Windows\System32\inetcpl.cpl

2012-06-02 12:01:40 173056 ----a-w- C:\Windows\System32\ieUnatt.exe

2012-06-02 11:57:08 2382848 ----a-w- C:\Windows\System32\mshtml.tlb

2012-06-02 08:33:25 1800192 ----a-w- C:\Windows\SysWow64\jscript9.dll

2012-06-02 08:25:08 1129472 ----a-w- C:\Windows\SysWow64\wininet.dll

2012-06-02 08:25:03 1427968 ----a-w- C:\Windows\SysWow64\inetcpl.cpl

2012-06-02 08:20:33 142848 ----a-w- C:\Windows\SysWow64\ieUnatt.exe

2012-06-02 08:16:52 2382848 ----a-w- C:\Windows\SysWow64\mshtml.tlb

2012-06-02 05:50:10 458704 ----a-w- C:\Windows\System32\drivers\cng.sys

2012-06-02 05:48:16 95600 ----a-w- C:\Windows\System32\drivers\ksecdd.sys

2012-06-02 05:48:16 151920 ----a-w- C:\Windows\System32\drivers\ksecpkg.sys

2012-06-02 05:45:31 340992 ----a-w- C:\Windows\System32\schannel.dll

2012-06-02 05:44:21 307200 ----a-w- C:\Windows\System32\ncrypt.dll

2012-06-02 04:40:42 22016 ----a-w- C:\Windows\SysWow64\secur32.dll

2012-06-02 04:40:39 225280 ----a-w- C:\Windows\SysWow64\schannel.dll

2012-06-02 04:39:10 219136 ----a-w- C:\Windows\SysWow64\ncrypt.dll

2012-06-02 04:34:09 96768 ----a-w- C:\Windows\SysWow64\sspicli.dll

.

============= FINISH: 13:10:07.38 ===============

The attach one:

.

UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.

IF REQUESTED, ZIP IT UP & ATTACH IT

.

DDS (Ver_2011-08-26.01)

.

Microsoft Windows 7 Home Premium

Boot Device: \Device\HarddiskVolume2

Install Date: 12/18/2010 6:59:42 PM

System Uptime: 8/3/2012 9:25:20 AM (4 hours ago)

.

Motherboard: Dell Inc. | | 018D1Y

Processor: Pentium® Dual-Core CPU E5700 @ 3.00GHz | CPU 1 | 3003/200mhz

.

==== Disk Partitions =========================

.

C: is FIXED (NTFS) - 583 GiB total, 521.082 GiB free.

D: is CDROM ()

E: is Removable

F: is Removable

G: is Removable

H: is Removable

.

==== Disabled Device Manager Items =============

.

==== System Restore Points ===================

.

RP92: 7/6/2012 1:41:01 PM - Device Driver Package Install: WsAudio_DeviceS(1) Sound, video and game controllers

RP93: 7/6/2012 1:41:51 PM - Device Driver Package Install: WsAudio_DeviceS(2) Sound, video and game controllers

RP95: 7/12/2012 2:27:39 AM - Windows Update

RP96: 7/25/2012 2:13:14 AM - Removed LogMeIn Hamachi

RP97: 8/3/2012 12:21:13 AM - Windows Update

RP98: 8/3/2012 4:23:47 AM - RegRun Virus Scan

RP99: 8/3/2012 4:26:49 AM - RegRun Virus Scan

.

==== Installed Programs ======================

.

µTorrent

4Media iPod to PC Transfer

7-Zip 9.20

Adobe Audition 3.0

Adobe Audition 3.0.1 Patch

Adobe Flash Player 11 ActiveX

Adobe Flash Player 11 Plugin

Adobe Reader 9.5.1

Apple Application Support

Apple Software Update

ASIO4ALL

calibre

CameraHelperMsi

Constant Guard Protection Suite

Consumer In-Home Service Agreement

D3DX10

Definition Update for Microsoft Office 2010 (KB982726) 32-Bit Edition

Dell DataSafe Local Backup

Dell DataSafe Local Backup - Support Software

Dell DataSafe Online

Dell Dock

Dell Getting Started Guide

erLT

Google Chrome

GoToAssist 8.0.0.514

GuardedID

Gyazo 1.0

Intel® Control Center

Intel® Rapid Storage Technology

Internet Explorer

Java Auto Updater

Java 6 Update 31

Junk Mail filter update

Logitech Webcam Software

LWS Facebook

LWS Gallery

LWS Help_main

LWS Launcher

LWS Motion Detection

LWS Pictures And Video

LWS Twitter

LWS Video Mask Maker

LWS Webcam Software

LWS WLM Plugin

LWS YouTube Plugin

Malwarebytes Anti-Malware version 1.62.0.1300

Mesh Runtime

Messenger Companion

Messenger Plus! 5

Microsoft Office 2010 Service Pack 1 (SP1)

Microsoft Office Access MUI (English) 2010

Microsoft Office Access Setup Metadata MUI (English) 2010

Microsoft Office Click-to-Run 2010

Microsoft Office Excel MUI (English) 2010

Microsoft Office Home and Student 2010

Microsoft Office OneNote MUI (English) 2010

Microsoft Office Outlook MUI (English) 2010

Microsoft Office PowerPoint MUI (English) 2010

Microsoft Office Proof (English) 2010

Microsoft Office Proof (French) 2010

Microsoft Office Proof (Spanish) 2010

Microsoft Office Proofing (English) 2010

Microsoft Office Publisher MUI (English) 2010

Microsoft Office Shared MUI (English) 2010

Microsoft Office Shared Setup Metadata MUI (English) 2010

Microsoft Office Single Image 2010

Microsoft Office Word MUI (English) 2010

Microsoft SQL Server 2005 Compact Edition [ENU]

Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053

Microsoft Visual C++ 2005 Redistributable

Microsoft Visual C++ 2005 Redistributable - KB2467175

Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570

Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161

Microsoft Visual C++ 2010 x86 Redistributable - 10.0.30319

Mozilla Firefox 14.0.1 (x86 en-US)

Mozilla Maintenance Service

MSVCRT

MSVCRT_amd64

Pando Media Booster

Project64 1.6

Puzzle Pirates

Realtek High Definition Audio Driver

Roxio Burn

Security Update for CAPICOM (KB931906)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2160841)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2446708)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2478663)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2518870)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2539636)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2572078)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2604121)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2633870)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2656351)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2656368)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2656368v2)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2656405)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2686827)

Security Update for Microsoft Excel 2010 (KB2597166) 32-Bit Edition

Security Update for Microsoft InfoPath 2010 (KB2553322) 32-Bit Edition

Security Update for Microsoft Office 2010 (KB2553091)

Security Update for Microsoft Office 2010 (KB2553096)

Security Update for Microsoft Office 2010 (KB2553371) 32-Bit Edition

Security Update for Microsoft Office 2010 (KB2553447) 32-Bit Edition

Security Update for Microsoft Office 2010 (KB2589320) 32-Bit Edition

Security Update for Microsoft Office 2010 (KB2598039) 32-Bit Edition

Security Update for Microsoft Office 2010 (KB2598243) 32-Bit Edition

Security Update for Microsoft PowerPoint 2010 (KB2553185) 32-Bit Edition

Security Update for Microsoft SharePoint Workspace 2010 (KB2566445)

Security Update for Microsoft Visio Viewer 2010 (KB2597981) 32-Bit Edition

Skype Toolbars

Skype™ 4.2

Spybot - Search & Destroy

TeamViewer 7

Update for Microsoft .NET Framework 4 Client Profile (KB2468871)

Update for Microsoft .NET Framework 4 Client Profile (KB2473228)

Update for Microsoft .NET Framework 4 Client Profile (KB2533523)

Update for Microsoft .NET Framework 4 Client Profile (KB2600217)

Update for Microsoft Office 2010 (KB2494150)

Update for Microsoft Office 2010 (KB2553065)

Update for Microsoft Office 2010 (KB2553181) 32-Bit Edition

Update for Microsoft Office 2010 (KB2553267) 32-Bit Edition

Update for Microsoft Office 2010 (KB2553270) 32-Bit Edition

Update for Microsoft Office 2010 (KB2553310) 32-Bit Edition

Update for Microsoft Office 2010 (KB2566458)

Update for Microsoft Office 2010 (KB2596964) 32-Bit Edition

Update for Microsoft Office 2010 (KB2597091) 32-Bit Edition

Update for Microsoft OneNote 2010 (KB2553290) 32-Bit Edition

Update for Microsoft OneNote 2010 (KB2589345) 32-Bit Edition

Update for Microsoft Outlook 2010 (KB2553248) 32-Bit Edition

Update for Microsoft Outlook Social Connector 2010 (KB2553406) 32-Bit Edition

Update Installer for WildTangent Games App

Visual Studio 2008 x64 Redistributables

VLC media player 1.1.9

WildTangent Games

WildTangent Games App (Dell Games)

Windows Live Communications Platform

Windows Live Essentials

Windows Live Installer

Windows Live Mail

Windows Live Mesh

Windows Live Mesh ActiveX Control for Remote Connections

Windows Live Messenger

Windows Live Messenger Companion Core

Windows Live Movie Maker

Windows Live Photo Common

Windows Live Photo Gallery

Windows Live PIMT Platform

Windows Live SOXE

Windows Live SOXE Definitions

Windows Live UX Platform

Windows Live UX Platform Language Pack

Windows Live Writer

Windows Live Writer Resources

XFINITY Toolbar

Xvid Video Codec

.

==== Event Viewer Messages From Past Week ========

.

8/3/2012 5:03:04 AM, Error: Service Control Manager [7023] - The Computer Browser service terminated with the following error: The specified service does not exist as an installed service.

8/3/2012 4:51:10 AM, Error: Service Control Manager [7001] - The HomeGroup Provider service depends on the Function Discovery Provider Host service which failed to start because of the following error: The dependency service or group failed to start.

8/3/2012 4:41:53 AM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service WSearch with arguments "" in order to run the server: {9E175B6D-F52A-11D8-B9A5-505054503030}

8/3/2012 4:41:53 AM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service WSearch with arguments "" in order to run the server: {7D096C5F-AC08-4F1F-BEB7-5C22C517CE39}

8/3/2012 4:41:42 AM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service EventSystem with arguments "" in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF}

8/3/2012 4:41:31 AM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service ShellHWDetection with arguments "" in order to run the server: {DD522ACC-F821-461A-A407-50B198B896DC}

8/3/2012 4:41:17 AM, Error: Service Control Manager [7001] - The Computer Browser service depends on the Server service which failed to start because of the following error: The dependency service or group failed to start.

8/3/2012 4:41:12 AM, Error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: Avgldx64 Avgmfx64 discache MpFilter spldr Wanarpv6

8/3/2012 4:41:10 AM, Error: Service Control Manager [7001] - The Client Virtualization Handler service depends on the Application Virtualization Client service which failed to start because of the following error: The dependency service or group failed to start.

8/3/2012 11:57:35 AM, Error: Service Control Manager [7023] - The Function Discovery Resource Publication service terminated with the following error: %%-2147024891

8/3/2012 11:57:35 AM, Error: Service Control Manager [7001] - The HomeGroup Provider service depends on the Function Discovery Resource Publication service which failed to start because of the following error: %%-2147024891

8/2/2012 12:44:01 AM, Error: Service Control Manager [7022] - The Windows Update service hung on starting.

8/2/2012 12:41:58 AM, Error: Service Control Manager [7011] - A timeout (30000 milliseconds) was reached while waiting for a transaction response from the ShellHWDetection service.

8/2/2012 11:53:27 PM, Error: VDS Basic Provider [1] - Unexpected failure. Error code: D@01010004

8/2/2012 11:52:57 PM, Error: Service Control Manager [7009] - A timeout was reached (30000 milliseconds) while waiting for the CGPS Service service to connect.

8/2/2012 11:52:57 PM, Error: Service Control Manager [7000] - The CGPS Service service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.

8/2/2012 11:40:56 PM, Error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: Avgldx64 Avgmfx64 discache spldr Wanarpv6

8/1/2012 11:55:38 AM, Error: Service Control Manager [7011] - A timeout (30000 milliseconds) was reached while waiting for a transaction response from the lmhosts service.

8/1/2012 11:31:57 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service wuauserv with arguments "" in order to run the server: {E60687F7-01A1-40AA-86AC-DB1CBF673334}

7/31/2012 2:40:40 PM, Error: Service Control Manager [7011] - A timeout (30000 milliseconds) was reached while waiting for a transaction response from the UMVPFSrv service.

7/31/2012 12:57:11 AM, Error: Service Control Manager [7011] - A timeout (30000 milliseconds) was reached while waiting for a transaction response from the SftService service.

7/27/2012 8:51:14 AM, Error: Service Control Manager [7011] - A timeout (30000 milliseconds) was reached while waiting for a transaction response from the Netman service.

.

==== End Of File ===========================

snapdragon · August 3, 2012

I saw the Piracy thread thing and saw that this computer has uTorrent so I just uninstalled the program. I don't know if there are any other programs of the sort. This is my mom's computer, my brother uses it often, and I've only been using it because I spilled tea on my macbook and it's dead.

MrCharlie · August 3, 2012

Welcome to the forum.

Please remove any usb or external drives from the computer before you run this scan!

Please download and run RogueKiller to your desktop.

For Windows XP, double-click to start.

For Vista or Windows 7, do a right-click on the program, select Run as Administrator to start, & when prompted Allow to run.

Click Scan to scan the system.

When the scan completes > Close out the program > Don't Fix anything!

Don't run any other options, they're not all bad!!!!!!!

Post back the report which should be located on your desktop.

MrC

snapdragon · August 3, 2012

Thanks

RogueKiller Logs:

RogueKiller V7.6.5 [08/03/2012] by Tigzy

mail: tigzyRK<at>gmail<dot>com

Feedback: http://www.geekstogo.com/forum/files/file/413-roguekiller/

Blog: http://tigzyrk.blogspot.com

Operating System: Windows 7 (6.1.7601 Service Pack 1) 64 bits version

Started in : Normal mode

User: Monica [Admin rights]

Mode: Scan -- Date: 08/03/2012 16:05:28

¤¤¤ Bad processes: 2 ¤¤¤

[sUSP PATH] LULnchr.exe -- C:\Users\Monica\AppData\Local\Logitech® Webcam Software\Logishrd\LU2.0\LULnchr.exe -> KILLED [TermProc]

[sUSP PATH] LogitechUpdate.exe -- C:\Users\Monica\AppData\Local\Logitech® Webcam Software\Logishrd\LU2.0\LogitechUpdate.exe -> KILLED [TermProc]

¤¤¤ Registry Entries: 6 ¤¤¤

[sUSP PATH] thpm116774366967757202.job @ : \\.\globalroot\Device\HarddiskVolume3\Users\Monica\AppData\Local\Temp\thpm116774366967757202.tmp -> FOUND

[ZeroAccess] HKCR\[...]\InprocServer32 : (C:\Users\Monica\AppData\Local\{f0967059-127a-bfba-96e9-76cd265efaf7}\n.) -> FOUND

[HJ] HKLM\[...]\NewStartPanel : {59031a47-3f72-44a7-89c5-5595fe6b30ee} (1) -> FOUND

[HJ] HKLM\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> FOUND

[HJ] HKCU\[...]\ClassicStartMenu : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> FOUND

[HJ] HKCU\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> FOUND

¤¤¤ Particular Files / Folders: ¤¤¤

[ZeroAccess][FOLDER] U : c:\windows\installer\{f0967059-127a-bfba-96e9-76cd265efaf7}\U --> FOUND

[ZeroAccess][FILE] @ : c:\users\monica\appdata\local\{f0967059-127a-bfba-96e9-76cd265efaf7}\@ --> FOUND

[ZeroAccess][FOLDER] U : c:\users\monica\appdata\local\{f0967059-127a-bfba-96e9-76cd265efaf7}\U --> FOUND

[ZeroAccess][FOLDER] L : c:\users\monica\appdata\local\{f0967059-127a-bfba-96e9-76cd265efaf7}\L --> FOUND

¤¤¤ Driver: [NOT LOADED] ¤¤¤

¤¤¤ Infection : ZeroAccess ¤¤¤

¤¤¤ HOSTS File: ¤¤¤

¤¤¤ MBR Check: ¤¤¤

+++++ PhysicalDrive0: WDC WD6400AAKS-75A7B2 ATA Device +++++

--- User ---

[MBR] e3bc867e2eb59945a2f95a4b3054ef44

[bSP] 976833c91be82e3a47ff2464d98af4e2 : Windows Vista MBR Code

Partition table:

0 - [XXXXXX] DELL-UTIL (0xde) [VISIBLE] Offset (sectors): 63 | Size: 39 Mo

1 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 81920 | Size: 13118 Mo

2 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 26947584 | Size: 597321 Mo

User = LL1 ... OK!

User = LL2 ... OK!

Finished : << RKreport[1].txt >>

RKreport[1].txt

MrCharlie · August 3, 2012

Here you go......

Your computer is infected with a nasty rootkit. Please read the following information first.

You're infected with Rootkit.ZeroAccess, a BackDoor Trojan.
BACKDOOR WARNING
------------------------------
One or more of the identified infections is known to use a backdoor.
This allows hackers to remotely control your computer, steal critical system information and download and execute files.
I would advice you to disconnect this PC from the Internet immediately. If you do any banking or other financial transactions on the PC or if it should contain any other sensitive information, please get to a known clean computer and change all passwords where applicable, and it would be wise to contact those same financial institutions to apprise them of your situation.
Though the infection has been identified and because of it's backdoor functionality, your PC is very likely compromised and there is no way to be sure your computer can ever again be trusted. Many experts in the security community believe that once infected with this type of trojan, the best course of action would be a reformat and reinstall of the OS. Please read these for more information:
How Do I Handle Possible Identify Theft, Internet Fraud and CC Fraud?
http://www.dslreports.com/faq/10451
When Should I Format, How Should I Reinstall
http://www.dslreports.com/faq/10063
I will try my best to clean this machine but I can't guarantee that it will be 100% secure afterwards.
Let me know what you decide to do. If you decide to go through with the cleanup, please proceed with the following steps.

-----------------------------------------

Please make sure system restore is running and create a new restore point before continuing!

For x32 (x86) bit systems download Farbar Recovery Scan Tool and save it to a flash drive.

For x64 bit systems download Farbar Recovery Scan Tool x64 and save it to a flash drive.

How to tell > 32 or 64 bit

Plug the flashdrive into the infected PC.

Enter System Recovery Options.

To enter System Recovery Options from the Advanced Boot Options:

Restart the computer.
As soon as the BIOS is loaded begin tapping the F8 key until Advanced Boot Options appears.
Use the arrow keys to select the Repair your computer menu item.
Select US as the keyboard language settings, and then click Next.
Select the operating system you want to repair, and then click Next.
Select your user account an click Next.

To enter System Recovery Options by using Windows installation disc:

Insert the installation disc.
Restart your computer.
If prompted, press any key to start Windows from the installation disc. If your computer is not configured to start from a CD or DVD, check your BIOS settings.
Click Repair your computer.
Select US as the keyboard language settings, and then click Next.
Select the operating system you want to repair, and then click Next.
Select your user account and click Next.

On the System Recovery Options menu you will get the following options:

- Startup Repair
  System Restore
  Windows Complete PC Restore
  Windows Memory Diagnostic Tool
  Command Prompt

[*]Select Command Prompt

[*]In the command window type in notepad and press Enter.

[*]The notepad opens. Under File menu select Open.

[*]Select "Computer" and find your flash drive letter and close the notepad.

[*]In the command window type e:\frst.exe (for x64 bit version type e:\frst64) and press Enter

Note: Replace letter e with the drive letter of your flash drive.

[*]The tool will start to run.

[*]When the tool opens click Yes to disclaimer.

[*]Press Scan button.

[*]FRST will let you know when the scan is complete and has written the FRST.txt to file, close out this message, then type the following into the search box:

services.exe

[*]Now press the Search button

[*]When the search is complete, search.txt will also be written to your USB

[*]Type exit and reboot the computer normally

[*]Please copy and paste both logs in your reply.(FRST.txt and Search.txt)

snapdragon · August 3, 2012

My mom is gonna be so mad.

FRST logs:

Scan result of Farbar Recovery Scan Tool Version: 25-07-2012 01

Ran by SYSTEM at 03-08-2012 17:40:49

Running from J:\

Windows 7 Home Premium (X64) OS Language: English(US)

The current controlset is ControlSet001

========================== Registry (Whitelisted) =============

HKLM\...\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe -s [8306208 2009-10-20] (Realtek Semiconductor)

HKLM\...\Run: [igfxTray] C:\Windows\system32\igfxtray.exe [162328 2011-02-11] (Intel Corporation)

HKLM\...\Run: [HotKeysCmds] C:\Windows\system32\hkcmd.exe [386584 2011-02-11] (Intel Corporation)

HKLM\...\Run: [Persistence] C:\Windows\system32\igfxpers.exe [417304 2011-02-11] (Intel Corporation)

HKLM\...\Run: [MSC] "c:\Program Files\Microsoft Security Client\msseces.exe" -hide -runkey [1271168 2012-03-26] (Microsoft Corporation)

HKLM-x32\...\Run: [iAStorIcon] C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe [284696 2010-03-03] (Intel Corporation)

HKLM-x32\...\Run: [Desktop Disc Tool] "c:\Program Files (x86)\Roxio\Roxio Burn\RoxioBurnLauncher.exe" [498160 2009-10-15] ()

HKLM-x32\...\Run: [Dell DataSafe Online] C:\Program Files (x86)\Dell\Dell Datasafe Online\NOBuClient.exe [1117528 2010-08-25] (Dell, Inc.)

HKLM-x32\...\Run: [AVG_TRAY] "C:\Program Files (x86)\AVG\AVG2012\avgtray.exe" [2587008 2012-04-05] (AVG Technologies CZ, s.r.o.)

HKLM-x32\...\Run: [LWS] C:\Program Files (x86)\Logitech\LWS\Webcam Software\LWS.exe -hide [205336 2011-08-12] (Logitech Inc.)

HKLM-x32\...\Run: [sunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe" [254696 2012-01-18] (Sun Microsystems, Inc.)

HKLM-x32\...\Run: [GIDDesktop] C:\Program Files (x86)\SFT\GuardedID\gidd.exe /s [395528 2011-07-05] (StrikeForce Technologies Inc.)

HKLM-x32\...\Run: [vProt] "C:\Program Files (x86)\AVG Secure Search\vprot.exe" [1107552 2012-07-09] ()

HKLM-x32\...\Run: [Adobe Reader Speed Launcher] "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe" [37296 2012-03-27] (Adobe Systems Incorporated)

HKLM-x32\...\Run: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [843712 2012-01-02] (Adobe Systems Incorporated)

HKLM-x32\...\Run: [APSDaemon] "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [59280 2012-05-30] (Apple Inc.)

HKLM-x32\...\Run: [iTunesHelper] "C:\Program Files (x86)\iTunes\iTunesHelper.exe" [421776 2012-06-07] (Apple Inc.)

HKLM-x32\...\Run: [PlusService] C:\Program Files (x86)\Yuna Software\Messenger Plus!\PlusService.exe [801792 2012-02-27] (Yuna Software)

HKLM-x32\...\Run: [HF_G_Jul] "C:\Program Files (x86)\AVG Secure Search\HF_G_Jul.exe" /DoAction [36960 2012-07-18] ()

HKLM-x32\...\Run: [Malwarebytes' Anti-Malware] "C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe" /starttray [462920 2012-07-03] (Malwarebytes Corporation)

HKU\Monica\...\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe [9728 2009-07-13] (Microsoft Corporation)

HKU\Monica\...\Run: [Google Update] "C:\Users\Monica\AppData\Local\Google\Update\GoogleUpdate.exe" /c [136176 2012-02-05] (Google Inc.)

HKU\Monica\...\Run: [msnmsgr] "C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe" /background [4280184 2012-03-08] (Microsoft Corporation)

HKLM-x32\...\RunOnce: ["C:\Program Files (x86)\Dell DataSafe Local Backup\Components\DSUpdate\DSUpdate.exe"] "C:\Program Files (x86)\Dell DataSafe Local Backup\Components\DSUpdate\DSUpdate.exe" [560128 2011-09-18] (Dell)

HKLM-x32\...\RunOnce: [Launcher] C:\Program Files (x86)\Dell DataSafe Local Backup\Components\Scheduler\Launcher.exe [165184 2011-01-13] (Softthinks)

HKLM-x32\...\runonceex: [Flags] 128

HKLM-x32\...\runonceex: [Title] UnHackMe Rootkit Check

Winlogon\Notify\GoToAssist: C:\Program Files (x86)\Citrix\GoToAssist\514\G2AWinLogon_x64.dll [X]

Winlogon\Notify\igfxcui: igfxdev.dll (Intel Corporation)

Tcpip\Parameters: [DhcpNameServer] 192.168.1.1 75.75.75.75 75.75.76.76

Startup: C:\Users\All Users\Start Menu\Programs\Startup\Constant Guard.lnk

ShortcutTarget: Constant Guard.lnk -> C:\Program Files (x86)\Constant Guard Protection Suite\IDVault.exe (White Sky, Inc.)

Startup: C:\Users\Default\Start Menu\Programs\Startup\Dell Dock First Run.lnk

ShortcutTarget: Dell Dock First Run.lnk -> C:\Program Files\Dell\DellDock\DellDock.exe (Stardock Corporation)

Startup: C:\Users\Default User\Start Menu\Programs\Startup\Dell Dock First Run.lnk

ShortcutTarget: Dell Dock First Run.lnk -> C:\Program Files\Dell\DellDock\DellDock.exe (Stardock Corporation)

Startup: C:\Users\Monica\Start Menu\Programs\Startup\Dell Dock.lnk

ShortcutTarget: Dell Dock.lnk -> C:\Program Files\Dell\DellDock\DellDock.exe (Stardock Corporation)

==================== Services (Whitelisted) ======

3 Adobe LM Service; "C:\Program Files (x86)\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe" [72704 2011-04-10] (Adobe Systems)

2 AVGIDSAgent; "C:\Program Files (x86)\AVG\AVG2012\avgidsagent.exe" [5160568 2012-07-04] (AVG Technologies CZ, s.r.o.)

2 avgwd; "C:\Program Files (x86)\AVG\AVG2012\avgwdsvc.exe" [193288 2012-02-14] (AVG Technologies CZ, s.r.o.)

2 IDVaultSvc; "C:\Program Files (x86)\Constant Guard Protection Suite\IDVaultSvc.exe" [66160 2012-07-18] (White Sky, Inc.)

2 MBAMService; "C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe" [655944 2012-07-03] (Malwarebytes Corporation)

2 MsMpSvc; "C:\Program Files\Microsoft Security Client\MsMpEng.exe" [12600 2012-03-26] (Microsoft Corporation)

3 NisSrv; "C:\Program Files\Microsoft Security Client\NisSrv.exe" [291696 2012-03-26] (Microsoft Corporation)

2 vToolbarUpdater11.2.0; C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\11.2.0\ToolbarUpdater.exe [935008 2012-07-09] ()

========================== Drivers (Whitelisted) =============

3 AVGIDSDriver; C:\Windows\System32\DRIVERS\avgidsdrivera.sys [124496 2011-12-23] (AVG Technologies CZ, s.r.o. )

3 AVGIDSFilter; C:\Windows\System32\DRIVERS\avgidsfiltera.sys [29776 2011-12-23] (AVG Technologies CZ, s.r.o. )

0 AVGIDSHA; C:\Windows\System32\Drivers\AVGIDSHA.sys [28480 2012-04-19] (AVG Technologies CZ, s.r.o. )

1 Avgldx64; C:\Windows\System32\Drivers\Avgldx64.sys [289872 2012-02-22] (AVG Technologies CZ, s.r.o.)

1 Avgmfx64; C:\Windows\System32\Drivers\Avgmfx64.sys [47696 2011-12-23] (AVG Technologies CZ, s.r.o.)

0 Avgrkx64; C:\Windows\System32\Drivers\Avgrkx64.sys [36944 2012-01-31] (AVG Technologies CZ, s.r.o.)

1 Avgtdia; C:\Windows\System32\Drivers\Avgtdia.sys [383808 2012-03-19] (AVG Technologies CZ, s.r.o.)

1 GIDv2; C:\Windows\System32\Drivers\GIDv2.sys [29288 2011-07-05] (StrikeForce Technologies, Inc.)

3 hamachi; C:\Windows\System32\Drivers\hamachi.sys [33856 2009-03-18] (LogMeIn, Inc.)

3 MBAMProtector; \??\C:\Windows\system32\drivers\mbam.sys [24904 2012-07-03] (Malwarebytes Corporation)

0 Partizan; C:\Windows\System32\drivers\Partizan.sys [x]

========================== NetSvcs (Whitelisted) ===========

============ One Month Created Files and Folders ==============

2012-08-03 15:26 - 2012-08-03 15:26 - 00037308 ____A C:\Users\Monica\Desktop\FRST.txt

2012-08-03 15:20 - 2012-08-03 15:26 - 00000000 ____D C:\FRST

2012-08-03 15:20 - 2012-08-03 15:20 - 01438391 ____A (Farbar) C:\Users\Monica\Desktop\FRST64.exe

2012-08-03 15:05 - 2012-08-03 15:05 - 00002455 ____A C:\Users\Monica\Desktop\RKreport[1].txt

2012-08-03 15:03 - 2012-08-03 15:05 - 00000000 ____D C:\Users\Monica\Desktop\RK_Quarantine

2012-08-03 15:03 - 2012-08-03 15:03 - 01552896 ____A C:\Users\Monica\Desktop\RogueKiller.exe

2012-08-03 12:14 - 2012-08-03 12:14 - 00036972 ____A C:\Users\Monica\Desktop\DDS.txt

2012-08-03 12:14 - 2012-08-03 12:14 - 00011922 ____A C:\Users\Monica\Desktop\Attach.txt

2012-08-03 12:08 - 2012-08-03 12:08 - 00607260 ____R (Swearware) C:\Users\Monica\Downloads\dds.scr

2012-08-03 12:04 - 2012-08-03 12:04 - 00000000 ____D C:\Users\Monica\Local Settings\Application Data\{CAC67DC7-3072-48B0-9462-CEF75EBA4D95}

2012-08-03 12:04 - 2012-08-03 12:04 - 00000000 ____D C:\Users\Monica\Local Settings\Application Data\{560F9F9F-19DC-4600-9C6E-DC4CA1F8374B}

2012-08-03 12:04 - 2012-08-03 12:04 - 00000000 ____D C:\Users\Monica\Local Settings\{CAC67DC7-3072-48B0-9462-CEF75EBA4D95}

2012-08-03 12:04 - 2012-08-03 12:04 - 00000000 ____D C:\Users\Monica\Local Settings\{560F9F9F-19DC-4600-9C6E-DC4CA1F8374B}

2012-08-03 12:04 - 2012-08-03 12:04 - 00000000 ____D C:\Users\Monica\AppData\Local\{CAC67DC7-3072-48B0-9462-CEF75EBA4D95}

2012-08-03 12:04 - 2012-08-03 12:04 - 00000000 ____D C:\Users\Monica\AppData\Local\{560F9F9F-19DC-4600-9C6E-DC4CA1F8374B}

2012-08-03 04:11 - 2012-08-03 04:11 - 17039840 ____A (Microsoft Corporation) C:\Users\Monica\Downloads\Windows-KB890830-x64-V4.10.exe

2012-08-03 04:01 - 2012-07-03 02:13 - 57442464 ____A (Microsoft Corporation) C:\Windows\SysWOW64\MRT.exe

2012-08-03 03:59 - 2012-08-03 03:59 - 16373192 ____A (Microsoft Corporation) C:\Users\Monica\Downloads\Windows-KB890830-V4.10.exe

2012-08-03 03:50 - 2012-08-03 03:51 - 00002330 ____A C:\Users\Monica\Desktop\Rkill.txt

2012-08-03 03:50 - 2012-08-03 03:50 - 01051552 ____A (Bleeping Computer, LLC) C:\Users\Monica\Downloads\rkill.exe

2012-08-03 03:50 - 2012-08-03 03:50 - 00000000 ____D C:\Users\Monica\Desktop\rkill-backup

2012-08-03 03:24 - 2012-08-03 03:24 - 00039184 ____A (Greatis Software) C:\Windows\System32\Partizan.exe

2012-08-03 03:24 - 2012-08-03 03:24 - 00000063 ____A C:\Windows\SysWOW64\Partizan.RRI

2012-08-03 03:21 - 2012-08-03 03:33 - 00000000 ____D C:\Users\All Users\RegRun

2012-08-03 03:21 - 2012-08-03 03:33 - 00000000 ____D C:\Users\All Users\Application Data\RegRun

2012-08-03 03:21 - 2012-08-03 03:31 - 00000000 ____D C:\Users\Monica\My Documents\RegRun2

2012-08-03 03:21 - 2012-08-03 03:31 - 00000000 ____D C:\Users\Monica\Documents\RegRun2

2012-08-03 03:21 - 2012-08-03 03:21 - 00000002 RASHOT C:\Windows\winstart.bat

2012-08-03 03:21 - 2012-08-03 03:21 - 00000002 RASHOT C:\Windows\SysWOW64\CONFIG.NT

2012-08-03 03:21 - 2012-08-03 03:21 - 00000002 RASHOT C:\Windows\SysWOW64\AUTOEXEC.NT

2012-08-03 03:20 - 2012-08-03 03:34 - 00000000 ____D C:\Program Files (x86)\UnHackMe

2012-08-03 03:19 - 2012-08-03 03:19 - 12101490 ____A C:\Users\Monica\Downloads\unhackme.zip

2012-08-03 00:33 - 2012-08-03 00:33 - 00000000 ____D C:\Users\Monica\Downloads\backups

2012-08-03 00:07 - 2012-08-03 00:07 - 00015488 ____A C:\Users\Monica\Downloads\hijackthis.log

2012-08-03 00:06 - 2012-08-03 00:06 - 00388608 ____A (Trend Micro Inc.) C:\Users\Monica\Downloads\HijackThis.exe

2012-08-02 23:59 - 2012-08-02 23:59 - 02136664 ____A (Kaspersky Lab ZAO) C:\Users\Monica\Downloads\tdsskiller.exe

2012-08-02 23:39 - 2012-08-03 03:33 - 00000000 ____D C:\Program Files (x86)\Panda Security

2012-08-02 23:21 - 2012-01-31 07:44 - 00279656 ____N (Microsoft Corporation) C:\Windows\System32\MpSigStub.exe

2012-08-02 23:18 - 2012-08-02 23:18 - 00001945 ____A C:\Windows\epplauncher.mif

2012-08-02 23:16 - 2012-08-02 23:17 - 00000000 ____D C:\Program Files\Microsoft Security Client

2012-08-02 23:16 - 2012-08-02 23:16 - 00000000 ____D C:\Program Files (x86)\Microsoft Security Client

2012-08-02 23:12 - 2012-08-02 23:12 - 12621696 ____A (Microsoft Corporation) C:\Users\Monica\Downloads\mseinstall.exe

2012-08-02 22:40 - 2012-08-02 22:41 - 00408456 ____A C:\Windows\System32\FNTCACHE.DAT

2012-08-02 18:25 - 2012-08-02 18:25 - 00108840 ____A C:\Users\Monica\Local Settings\GDIPFONTCACHEV1.DAT

2012-08-02 18:25 - 2012-08-02 18:25 - 00108840 ____A C:\Users\Monica\Local Settings\Application Data\GDIPFONTCACHEV1.DAT

2012-08-02 18:25 - 2012-08-02 18:25 - 00108840 ____A C:\Users\Monica\AppData\Local\GDIPFONTCACHEV1.DAT

2012-08-02 18:25 - 2012-08-02 18:25 - 00000000 ____D C:\Users\Monica\Local Settings\Application Data\{C6A8BDD6-7AB7-4DDF-97E1-DDC2165243B0}

2012-08-02 18:25 - 2012-08-02 18:25 - 00000000 ____D C:\Users\Monica\Local Settings\Application Data\{6FBB9E92-FAA8-46C1-892B-6AF99B741331}

2012-08-02 18:25 - 2012-08-02 18:25 - 00000000 ____D C:\Users\Monica\Local Settings\{C6A8BDD6-7AB7-4DDF-97E1-DDC2165243B0}

2012-08-02 18:25 - 2012-08-02 18:25 - 00000000 ____D C:\Users\Monica\Local Settings\{6FBB9E92-FAA8-46C1-892B-6AF99B741331}

2012-08-02 18:25 - 2012-08-02 18:25 - 00000000 ____D C:\Users\Monica\AppData\Local\{C6A8BDD6-7AB7-4DDF-97E1-DDC2165243B0}

2012-08-02 18:25 - 2012-08-02 18:25 - 00000000 ____D C:\Users\Monica\AppData\Local\{6FBB9E92-FAA8-46C1-892B-6AF99B741331}

2012-08-02 02:29 - 2012-08-03 04:02 - 00000336 ____A C:\Windows\setupact.log

2012-08-02 02:29 - 2012-08-02 02:29 - 00000000 ____A C:\Windows\setuperr.log

2012-08-01 22:40 - 2012-08-01 22:40 - 00001128 ____A C:\Users\Public\Desktop\TeamViewer 7.lnk

2012-08-01 22:40 - 2012-08-01 22:40 - 00001128 ____A C:\Users\All Users\Desktop\TeamViewer 7.lnk

2012-08-01 22:40 - 2012-08-01 22:40 - 00000000 ____D C:\Users\Monica\Application Data\TeamViewer

2012-08-01 22:40 - 2012-08-01 22:40 - 00000000 ____D C:\Users\Monica\AppData\Roaming\TeamViewer

2012-08-01 22:40 - 2012-08-01 22:40 - 00000000 ____D C:\Program Files (x86)\TeamViewer

2012-08-01 22:39 - 2012-08-01 22:39 - 03610576 ____A (TeamViewer GmbH) C:\Users\Monica\Downloads\TeamViewer_Setup_en.exe

2012-08-01 20:41 - 2012-08-01 20:41 - 00000000 ____D C:\Users\Monica\Local Settings\Application Data\{4ED95E48-5232-4AA6-A957-1E60ACC7066F}

2012-08-01 20:41 - 2012-08-01 20:41 - 00000000 ____D C:\Users\Monica\Local Settings\{4ED95E48-5232-4AA6-A957-1E60ACC7066F}

2012-08-01 20:41 - 2012-08-01 20:41 - 00000000 ____D C:\Users\Monica\AppData\Local\{4ED95E48-5232-4AA6-A957-1E60ACC7066F}

2012-08-01 20:40 - 2012-08-01 20:41 - 00000000 ____D C:\Users\Monica\Local Settings\Application Data\{5ECC8145-E5D8-43C0-8234-F8E2F8C74694}

2012-08-01 20:40 - 2012-08-01 20:41 - 00000000 ____D C:\Users\Monica\Local Settings\{5ECC8145-E5D8-43C0-8234-F8E2F8C74694}

2012-08-01 20:40 - 2012-08-01 20:41 - 00000000 ____D C:\Users\Monica\AppData\Local\{5ECC8145-E5D8-43C0-8234-F8E2F8C74694}

2012-07-31 23:50 - 2012-08-03 03:40 - 00000000 ____D C:\Users\Monica\Local Settings\Netscape

2012-07-31 23:50 - 2012-08-03 03:40 - 00000000 ____D C:\Users\Monica\Local Settings\Application Data\Netscape

2012-07-31 23:50 - 2012-08-03 03:40 - 00000000 ____D C:\Users\Monica\AppData\Local\Netscape

2012-07-31 20:12 - 2012-07-31 20:12 - 00000000 ____D C:\Users\Monica\Local Settings\Application Data\{C43BEE84-7080-4EEF-A402-62507F751BA7}

2012-07-31 20:12 - 2012-07-31 20:12 - 00000000 ____D C:\Users\Monica\Local Settings\Application Data\{BA9C98B5-8D05-44DA-A919-4567825DE9EC}

2012-07-31 20:12 - 2012-07-31 20:12 - 00000000 ____D C:\Users\Monica\Local Settings\{C43BEE84-7080-4EEF-A402-62507F751BA7}

2012-07-31 20:12 - 2012-07-31 20:12 - 00000000 ____D C:\Users\Monica\Local Settings\{BA9C98B5-8D05-44DA-A919-4567825DE9EC}

2012-07-31 20:12 - 2012-07-31 20:12 - 00000000 ____D C:\Users\Monica\AppData\Local\{C43BEE84-7080-4EEF-A402-62507F751BA7}

2012-07-31 20:12 - 2012-07-31 20:12 - 00000000 ____D C:\Users\Monica\AppData\Local\{BA9C98B5-8D05-44DA-A919-4567825DE9EC}

2012-07-31 00:41 - 2012-07-31 00:41 - 00000000 ____D C:\Users\Monica\Local Settings\Application Data\{89E45E66-CE37-4668-AAF8-4F39F4C3BA29}

2012-07-31 00:41 - 2012-07-31 00:41 - 00000000 ____D C:\Users\Monica\Local Settings\Application Data\{51BB49BE-1369-490D-8147-649D9B3598E0}

2012-07-31 00:41 - 2012-07-31 00:41 - 00000000 ____D C:\Users\Monica\Local Settings\{89E45E66-CE37-4668-AAF8-4F39F4C3BA29}

2012-07-31 00:41 - 2012-07-31 00:41 - 00000000 ____D C:\Users\Monica\Local Settings\{51BB49BE-1369-490D-8147-649D9B3598E0}

2012-07-31 00:41 - 2012-07-31 00:41 - 00000000 ____D C:\Users\Monica\AppData\Local\{89E45E66-CE37-4668-AAF8-4F39F4C3BA29}

2012-07-31 00:41 - 2012-07-31 00:41 - 00000000 ____D C:\Users\Monica\AppData\Local\{51BB49BE-1369-490D-8147-649D9B3598E0}

2012-07-29 19:54 - 2012-07-29 19:54 - 00000000 ____D C:\Users\Monica\Local Settings\Application Data\{D73C693F-EC6B-4812-A3D5-93CD8B1B1324}

2012-07-29 19:54 - 2012-07-29 19:54 - 00000000 ____D C:\Users\Monica\Local Settings\Application Data\{3F048F52-A60D-4411-B3E4-1018BC097D3C}

2012-07-29 19:54 - 2012-07-29 19:54 - 00000000 ____D C:\Users\Monica\Local Settings\{D73C693F-EC6B-4812-A3D5-93CD8B1B1324}

2012-07-29 19:54 - 2012-07-29 19:54 - 00000000 ____D C:\Users\Monica\Local Settings\{3F048F52-A60D-4411-B3E4-1018BC097D3C}

2012-07-29 19:54 - 2012-07-29 19:54 - 00000000 ____D C:\Users\Monica\AppData\Local\{D73C693F-EC6B-4812-A3D5-93CD8B1B1324}

2012-07-29 19:54 - 2012-07-29 19:54 - 00000000 ____D C:\Users\Monica\AppData\Local\{3F048F52-A60D-4411-B3E4-1018BC097D3C}

2012-07-29 04:03 - 2012-07-29 04:03 - 00000000 ____D C:\Users\Monica\Local Settings\Application Data\{8531CF03-BDC3-4A8E-95AB-CB25CDE03E8D}

2012-07-29 04:03 - 2012-07-29 04:03 - 00000000 ____D C:\Users\Monica\Local Settings\Application Data\{76572BFF-147F-4516-B3E9-07F97DE476CB}

2012-07-29 04:03 - 2012-07-29 04:03 - 00000000 ____D C:\Users\Monica\Local Settings\{8531CF03-BDC3-4A8E-95AB-CB25CDE03E8D}

2012-07-29 04:03 - 2012-07-29 04:03 - 00000000 ____D C:\Users\Monica\Local Settings\{76572BFF-147F-4516-B3E9-07F97DE476CB}

2012-07-29 04:03 - 2012-07-29 04:03 - 00000000 ____D C:\Users\Monica\AppData\Local\{8531CF03-BDC3-4A8E-95AB-CB25CDE03E8D}

2012-07-29 04:03 - 2012-07-29 04:03 - 00000000 ____D C:\Users\Monica\AppData\Local\{76572BFF-147F-4516-B3E9-07F97DE476CB}

2012-07-27 16:15 - 2012-07-27 16:15 - 00000000 ____D C:\Users\Monica\Local Settings\Application Data\{EBE91465-8E67-426A-8A15-3F0290023B47}

2012-07-27 16:15 - 2012-07-27 16:15 - 00000000 ____D C:\Users\Monica\Local Settings\Application Data\{E97EAF84-FD9E-4D20-8605-0D633B226008}

2012-07-27 16:15 - 2012-07-27 16:15 - 00000000 ____D C:\Users\Monica\Local Settings\{EBE91465-8E67-426A-8A15-3F0290023B47}

2012-07-27 16:15 - 2012-07-27 16:15 - 00000000 ____D C:\Users\Monica\Local Settings\{E97EAF84-FD9E-4D20-8605-0D633B226008}

2012-07-27 16:15 - 2012-07-27 16:15 - 00000000 ____D C:\Users\Monica\AppData\Local\{EBE91465-8E67-426A-8A15-3F0290023B47}

2012-07-27 16:15 - 2012-07-27 16:15 - 00000000 ____D C:\Users\Monica\AppData\Local\{E97EAF84-FD9E-4D20-8605-0D633B226008}

2012-07-26 20:51 - 2012-07-26 20:51 - 00000000 ____D C:\Users\Monica\Local Settings\Application Data\{64DEB608-D1D2-4D32-8AB1-08696161A91C}

2012-07-26 20:51 - 2012-07-26 20:51 - 00000000 ____D C:\Users\Monica\Local Settings\Application Data\{4D7F29C1-75C7-47E8-9EC0-1E77BA048E4D}

2012-07-26 20:51 - 2012-07-26 20:51 - 00000000 ____D C:\Users\Monica\Local Settings\{64DEB608-D1D2-4D32-8AB1-08696161A91C}

2012-07-26 20:51 - 2012-07-26 20:51 - 00000000 ____D C:\Users\Monica\Local Settings\{4D7F29C1-75C7-47E8-9EC0-1E77BA048E4D}

2012-07-26 20:51 - 2012-07-26 20:51 - 00000000 ____D C:\Users\Monica\AppData\Local\{64DEB608-D1D2-4D32-8AB1-08696161A91C}

2012-07-26 20:51 - 2012-07-26 20:51 - 00000000 ____D C:\Users\Monica\AppData\Local\{4D7F29C1-75C7-47E8-9EC0-1E77BA048E4D}

2012-07-25 21:22 - 2012-07-25 21:22 - 00000000 ____D C:\Users\Monica\Local Settings\Application Data\{729652FE-69EB-4245-BBE4-B14D26A8094B}

2012-07-25 21:22 - 2012-07-25 21:22 - 00000000 ____D C:\Users\Monica\Local Settings\Application Data\{027C6668-4221-4E82-93F7-ECBEBF372B5D}

2012-07-25 21:22 - 2012-07-25 21:22 - 00000000 ____D C:\Users\Monica\Local Settings\{729652FE-69EB-4245-BBE4-B14D26A8094B}

2012-07-25 21:22 - 2012-07-25 21:22 - 00000000 ____D C:\Users\Monica\Local Settings\{027C6668-4221-4E82-93F7-ECBEBF372B5D}

2012-07-25 21:22 - 2012-07-25 21:22 - 00000000 ____D C:\Users\Monica\AppData\Local\{729652FE-69EB-4245-BBE4-B14D26A8094B}

2012-07-25 21:22 - 2012-07-25 21:22 - 00000000 ____D C:\Users\Monica\AppData\Local\{027C6668-4221-4E82-93F7-ECBEBF372B5D}

2012-07-25 03:07 - 2012-07-25 03:07 - 00000000 ____D C:\Users\Monica\Local Settings\Application Data\{5DA8DD7A-7C6F-4B10-AF72-66AD85431C13}

2012-07-25 03:07 - 2012-07-25 03:07 - 00000000 ____D C:\Users\Monica\Local Settings\Application Data\{34A602C4-97B1-43F5-9E0C-2AC354259D88}

2012-07-25 03:07 - 2012-07-25 03:07 - 00000000 ____D C:\Users\Monica\Local Settings\{5DA8DD7A-7C6F-4B10-AF72-66AD85431C13}

2012-07-25 03:07 - 2012-07-25 03:07 - 00000000 ____D C:\Users\Monica\Local Settings\{34A602C4-97B1-43F5-9E0C-2AC354259D88}

2012-07-25 03:07 - 2012-07-25 03:07 - 00000000 ____D C:\Users\Monica\AppData\Local\{5DA8DD7A-7C6F-4B10-AF72-66AD85431C13}

2012-07-25 03:07 - 2012-07-25 03:07 - 00000000 ____D C:\Users\Monica\AppData\Local\{34A602C4-97B1-43F5-9E0C-2AC354259D88}

2012-07-24 13:45 - 2012-07-24 13:45 - 00000000 ____D C:\Users\Monica\Local Settings\Application Data\{C378CD86-92FB-4752-940C-7BA208A157E9}

2012-07-24 13:45 - 2012-07-24 13:45 - 00000000 ____D C:\Users\Monica\Local Settings\Application Data\{37B7F17F-330C-48D4-88E4-FC35E75F7021}

2012-07-24 13:45 - 2012-07-24 13:45 - 00000000 ____D C:\Users\Monica\Local Settings\{C378CD86-92FB-4752-940C-7BA208A157E9}

2012-07-24 13:45 - 2012-07-24 13:45 - 00000000 ____D C:\Users\Monica\Local Settings\{37B7F17F-330C-48D4-88E4-FC35E75F7021}

2012-07-24 13:45 - 2012-07-24 13:45 - 00000000 ____D C:\Users\Monica\AppData\Local\{C378CD86-92FB-4752-940C-7BA208A157E9}

2012-07-24 13:45 - 2012-07-24 13:45 - 00000000 ____D C:\Users\Monica\AppData\Local\{37B7F17F-330C-48D4-88E4-FC35E75F7021}

2012-07-23 15:48 - 2012-07-23 15:48 - 00000000 ____D C:\Users\Monica\Local Settings\Application Data\{073EC2AA-A822-4567-B82D-4D1C367B329D}

2012-07-23 15:48 - 2012-07-23 15:48 - 00000000 ____D C:\Users\Monica\Local Settings\{073EC2AA-A822-4567-B82D-4D1C367B329D}

2012-07-23 15:48 - 2012-07-23 15:48 - 00000000 ____D C:\Users\Monica\AppData\Local\{073EC2AA-A822-4567-B82D-4D1C367B329D}

2012-07-23 15:47 - 2012-07-23 15:48 - 00000000 ____D C:\Users\Monica\Local Settings\Application Data\{80BAAB91-74FF-41F5-8CF3-C2D9D974353B}

2012-07-23 15:47 - 2012-07-23 15:48 - 00000000 ____D C:\Users\Monica\Local Settings\{80BAAB91-74FF-41F5-8CF3-C2D9D974353B}

2012-07-23 15:47 - 2012-07-23 15:48 - 00000000 ____D C:\Users\Monica\AppData\Local\{80BAAB91-74FF-41F5-8CF3-C2D9D974353B}

2012-07-22 20:09 - 2012-07-22 20:09 - 00000000 ____D C:\Users\Monica\Local Settings\Application Data\{5EEF6C74-6C71-4FD5-B3C2-7785AE6600EF}

2012-07-22 20:09 - 2012-07-22 20:09 - 00000000 ____D C:\Users\Monica\Local Settings\Application Data\{3145F7D7-B5CC-4E43-B8AB-6D24F0E9FC1B}

2012-07-22 20:09 - 2012-07-22 20:09 - 00000000 ____D C:\Users\Monica\Local Settings\{5EEF6C74-6C71-4FD5-B3C2-7785AE6600EF}

2012-07-22 20:09 - 2012-07-22 20:09 - 00000000 ____D C:\Users\Monica\Local Settings\{3145F7D7-B5CC-4E43-B8AB-6D24F0E9FC1B}

2012-07-22 20:09 - 2012-07-22 20:09 - 00000000 ____D C:\Users\Monica\AppData\Local\{5EEF6C74-6C71-4FD5-B3C2-7785AE6600EF}

2012-07-22 20:09 - 2012-07-22 20:09 - 00000000 ____D C:\Users\Monica\AppData\Local\{3145F7D7-B5CC-4E43-B8AB-6D24F0E9FC1B}

2012-07-22 16:07 - 2012-07-22 16:07 - 00000000 ____D C:\Users\Monica\Application Data\Macrovision

2012-07-22 16:07 - 2012-07-22 16:07 - 00000000 ____D C:\Users\Monica\AppData\Roaming\Macrovision

2012-07-21 23:59 - 2012-05-22 23:59 - 00000032 ___RA C:\Users\All Users\hash.dat

2012-07-21 23:59 - 2012-05-22 23:59 - 00000032 ___RA C:\Users\All Users\Application Data\hash.dat

2012-07-21 23:56 - 2012-07-21 23:56 - 00000000 ____D C:\Users\Monica\Application Data\Three Rings Design

2012-07-21 23:56 - 2012-07-21 23:56 - 00000000 ____D C:\Users\Monica\AppData\Roaming\Three Rings Design

2012-07-21 23:53 - 2012-07-22 00:24 - 00000000 ____D C:\Users\Monica\Local Settings\PMB Files

2012-07-21 23:53 - 2012-07-22 00:24 - 00000000 ____D C:\Users\Monica\Local Settings\Application Data\PMB Files

2012-07-21 23:53 - 2012-07-22 00:24 - 00000000 ____D C:\Users\Monica\AppData\Local\PMB Files

2012-07-21 23:53 - 2012-07-21 23:53 - 00000000 ____D C:\Users\All Users\PMB Files

2012-07-21 23:53 - 2012-07-21 23:53 - 00000000 ____D C:\Users\All Users\Application Data\PMB Files

2012-07-21 23:53 - 2012-07-21 23:53 - 00000000 ____D C:\Program Files (x86)\Pando Networks

2012-07-21 23:52 - 2012-07-21 23:52 - 02353512 ____A C:\Users\Monica\Downloads\LeagueofLegends.exe

2012-07-21 22:47 - 2012-07-21 22:47 - 00000000 ____D C:\Users\Monica\Local Settings\Application Data\{EBAECF27-AC24-4ADA-9B87-C5E1C2086232}

2012-07-21 22:47 - 2012-07-21 22:47 - 00000000 ____D C:\Users\Monica\Local Settings\Application Data\{B4BD07B5-1697-429A-B9A3-30E5B1462CB2}

2012-07-21 22:47 - 2012-07-21 22:47 - 00000000 ____D C:\Users\Monica\Local Settings\{EBAECF27-AC24-4ADA-9B87-C5E1C2086232}

2012-07-21 22:47 - 2012-07-21 22:47 - 00000000 ____D C:\Users\Monica\Local Settings\{B4BD07B5-1697-429A-B9A3-30E5B1462CB2}

2012-07-21 22:47 - 2012-07-21 22:47 - 00000000 ____D C:\Users\Monica\AppData\Local\{EBAECF27-AC24-4ADA-9B87-C5E1C2086232}

2012-07-21 22:47 - 2012-07-21 22:47 - 00000000 ____D C:\Users\Monica\AppData\Local\{B4BD07B5-1697-429A-B9A3-30E5B1462CB2}

2012-07-21 22:29 - 2012-07-21 22:29 - 00000000 ____D C:\Users\Monica\Application Data\Gyazo

2012-07-21 22:29 - 2012-07-21 22:29 - 00000000 ____D C:\Users\Monica\AppData\Roaming\Gyazo

2012-07-21 22:28 - 2012-07-21 22:28 - 00000948 ____A C:\Users\Public\Desktop\Gyazo.lnk

2012-07-21 22:28 - 2012-07-21 22:28 - 00000948 ____A C:\Users\All Users\Desktop\Gyazo.lnk

2012-07-21 22:28 - 2012-07-21 22:28 - 00000000 ____D C:\Program Files (x86)\Gyazo

2012-07-20 20:03 - 2012-07-20 20:04 - 00000000 ____D C:\Users\Monica\Local Settings\Application Data\{621E7F9E-151B-44D3-B47A-46B2C0327873}

2012-07-20 20:03 - 2012-07-20 20:04 - 00000000 ____D C:\Users\Monica\Local Settings\{621E7F9E-151B-44D3-B47A-46B2C0327873}

2012-07-20 20:03 - 2012-07-20 20:04 - 00000000 ____D C:\Users\Monica\AppData\Local\{621E7F9E-151B-44D3-B47A-46B2C0327873}

2012-07-20 20:03 - 2012-07-20 20:03 - 00000000 ____D C:\Users\Monica\Local Settings\Application Data\{E1BD9846-ED98-498F-85E0-7D6EB706ECA5}

2012-07-20 20:03 - 2012-07-20 20:03 - 00000000 ____D C:\Users\Monica\Local Settings\{E1BD9846-ED98-498F-85E0-7D6EB706ECA5}

2012-07-20 20:03 - 2012-07-20 20:03 - 00000000 ____D C:\Users\Monica\AppData\Local\{E1BD9846-ED98-498F-85E0-7D6EB706ECA5}

2012-07-20 00:52 - 2012-07-20 00:52 - 00000000 ____D C:\Users\Monica\Local Settings\Application Data\{592B6073-9F51-40C6-BC67-4B4473895EE8}

2012-07-20 00:52 - 2012-07-20 00:52 - 00000000 ____D C:\Users\Monica\Local Settings\Application Data\{36FB2A01-BFBF-4246-B966-B462608097D2}

2012-07-20 00:52 - 2012-07-20 00:52 - 00000000 ____D C:\Users\Monica\Local Settings\{592B6073-9F51-40C6-BC67-4B4473895EE8}

2012-07-20 00:52 - 2012-07-20 00:52 - 00000000 ____D C:\Users\Monica\Local Settings\{36FB2A01-BFBF-4246-B966-B462608097D2}

2012-07-20 00:52 - 2012-07-20 00:52 - 00000000 ____D C:\Users\Monica\AppData\Local\{592B6073-9F51-40C6-BC67-4B4473895EE8}

2012-07-20 00:52 - 2012-07-20 00:52 - 00000000 ____D C:\Users\Monica\AppData\Local\{36FB2A01-BFBF-4246-B966-B462608097D2}

2012-07-18 15:49 - 2012-07-18 15:49 - 00000000 ____D C:\Users\Monica\Local Settings\Application Data\{CF8573D2-B3B1-435D-9F89-B59A22526B7D}

2012-07-18 15:49 - 2012-07-18 15:49 - 00000000 ____D C:\Users\Monica\Local Settings\{CF8573D2-B3B1-435D-9F89-B59A22526B7D}

2012-07-18 15:49 - 2012-07-18 15:49 - 00000000 ____D C:\Users\Monica\AppData\Local\{CF8573D2-B3B1-435D-9F89-B59A22526B7D}

2012-07-18 15:48 - 2012-07-18 15:49 - 00000000 ____D C:\Users\Monica\Local Settings\Application Data\{8C0D373B-1FCC-44AE-8AD6-8CA44293CD94}

2012-07-18 15:48 - 2012-07-18 15:49 - 00000000 ____D C:\Users\Monica\Local Settings\{8C0D373B-1FCC-44AE-8AD6-8CA44293CD94}

2012-07-18 15:48 - 2012-07-18 15:49 - 00000000 ____D C:\Users\Monica\AppData\Local\{8C0D373B-1FCC-44AE-8AD6-8CA44293CD94}

2012-07-17 20:12 - 2012-07-17 20:12 - 00000000 ____D C:\Users\Monica\Local Settings\Application Data\{E6948262-A08C-46AD-9801-84219E6FB55F}

2012-07-17 20:12 - 2012-07-17 20:12 - 00000000 ____D C:\Users\Monica\Local Settings\Application Data\{B6A848F6-894E-4E08-83EC-A7CCB0C01867}

2012-07-17 20:12 - 2012-07-17 20:12 - 00000000 ____D C:\Users\Monica\Local Settings\{E6948262-A08C-46AD-9801-84219E6FB55F}

2012-07-17 20:12 - 2012-07-17 20:12 - 00000000 ____D C:\Users\Monica\Local Settings\{B6A848F6-894E-4E08-83EC-A7CCB0C01867}

2012-07-17 20:12 - 2012-07-17 20:12 - 00000000 ____D C:\Users\Monica\AppData\Local\{E6948262-A08C-46AD-9801-84219E6FB55F}

2012-07-17 20:12 - 2012-07-17 20:12 - 00000000 ____D C:\Users\Monica\AppData\Local\{B6A848F6-894E-4E08-83EC-A7CCB0C01867}

2012-07-16 17:48 - 2012-07-16 17:48 - 00000000 ____D C:\Users\Monica\Local Settings\Application Data\{B113F1E3-4F7B-40D2-9717-86041EE13224}

2012-07-16 17:48 - 2012-07-16 17:48 - 00000000 ____D C:\Users\Monica\Local Settings\Application Data\{AE5A2072-8E71-4647-B85F-4FE6582E7B12}

2012-07-16 17:48 - 2012-07-16 17:48 - 00000000 ____D C:\Users\Monica\Local Settings\{B113F1E3-4F7B-40D2-9717-86041EE13224}

2012-07-16 17:48 - 2012-07-16 17:48 - 00000000 ____D C:\Users\Monica\Local Settings\{AE5A2072-8E71-4647-B85F-4FE6582E7B12}

2012-07-16 17:48 - 2012-07-16 17:48 - 00000000 ____D C:\Users\Monica\AppData\Local\{B113F1E3-4F7B-40D2-9717-86041EE13224}

2012-07-16 17:48 - 2012-07-16 17:48 - 00000000 ____D C:\Users\Monica\AppData\Local\{AE5A2072-8E71-4647-B85F-4FE6582E7B12}

2012-07-16 13:55 - 2012-07-16 14:03 - 00000000 ____D C:\Users\Monica\Desktop\Windows XP Professional SP3 x32 June 2012 + SATA Drivers [ThumperDC]

2012-07-15 15:24 - 2012-07-15 15:24 - 00000000 ____D C:\Users\Monica\Local Settings\Application Data\{5C2E9490-DCF3-4DD8-9FC9-98A93824FD95}

2012-07-15 15:24 - 2012-07-15 15:24 - 00000000 ____D C:\Users\Monica\Local Settings\{5C2E9490-DCF3-4DD8-9FC9-98A93824FD95}

2012-07-15 15:24 - 2012-07-15 15:24 - 00000000 ____D C:\Users\Monica\AppData\Local\{5C2E9490-DCF3-4DD8-9FC9-98A93824FD95}

2012-07-15 15:23 - 2012-07-15 15:24 - 00000000 ____D C:\Users\Monica\Local Settings\Application Data\{90E6FFF1-72BB-47DE-A8E0-D65C22C04652}

2012-07-15 15:23 - 2012-07-15 15:24 - 00000000 ____D C:\Users\Monica\Local Settings\{90E6FFF1-72BB-47DE-A8E0-D65C22C04652}

2012-07-15 15:23 - 2012-07-15 15:24 - 00000000 ____D C:\Users\Monica\AppData\Local\{90E6FFF1-72BB-47DE-A8E0-D65C22C04652}

2012-07-14 19:16 - 2012-07-14 19:16 - 00000000 ____D C:\Users\Monica\Local Settings\Application Data\{FE913DAD-3299-4423-B036-E79ED5BEC094}

2012-07-14 19:16 - 2012-07-14 19:16 - 00000000 ____D C:\Users\Monica\Local Settings\{FE913DAD-3299-4423-B036-E79ED5BEC094}

2012-07-14 19:16 - 2012-07-14 19:16 - 00000000 ____D C:\Users\Monica\AppData\Local\{FE913DAD-3299-4423-B036-E79ED5BEC094}

2012-07-14 19:15 - 2012-07-14 19:16 - 00000000 ____D C:\Users\Monica\Local Settings\Application Data\{4830B89F-A4D2-4F53-B98A-075CC28D5171}

2012-07-14 19:15 - 2012-07-14 19:16 - 00000000 ____D C:\Users\Monica\Local Settings\{4830B89F-A4D2-4F53-B98A-075CC28D5171}

2012-07-14 19:15 - 2012-07-14 19:16 - 00000000 ____D C:\Users\Monica\AppData\Local\{4830B89F-A4D2-4F53-B98A-075CC28D5171}

2012-07-13 17:13 - 2012-07-13 17:13 - 00000000 ____D C:\Users\Monica\Local Settings\Application Data\{76B70729-3E43-4661-B4D2-BED749B938F9}

2012-07-13 17:13 - 2012-07-13 17:13 - 00000000 ____D C:\Users\Monica\Local Settings\{76B70729-3E43-4661-B4D2-BED749B938F9}

2012-07-13 17:13 - 2012-07-13 17:13 - 00000000 ____D C:\Users\Monica\AppData\Local\{76B70729-3E43-4661-B4D2-BED749B938F9}

2012-07-13 17:12 - 2012-07-13 17:13 - 00000000 ____D C:\Users\Monica\Local Settings\Application Data\{A5083E04-B16C-49C7-B8E5-74E14FE93CDD}

2012-07-13 17:12 - 2012-07-13 17:13 - 00000000 ____D C:\Users\Monica\Local Settings\{A5083E04-B16C-49C7-B8E5-74E14FE93CDD}

2012-07-13 17:12 - 2012-07-13 17:13 - 00000000 ____D C:\Users\Monica\AppData\Local\{A5083E04-B16C-49C7-B8E5-74E14FE93CDD}

2012-07-12 20:19 - 2012-07-12 20:19 - 00000000 ____D C:\Users\Monica\Local Settings\Application Data\{DBE0B254-2EF5-42BE-9680-C72AF6CD2331}

2012-07-12 20:19 - 2012-07-12 20:19 - 00000000 ____D C:\Users\Monica\Local Settings\{DBE0B254-2EF5-42BE-9680-C72AF6CD2331}

2012-07-12 20:19 - 2012-07-12 20:19 - 00000000 ____D C:\Users\Monica\AppData\Local\{DBE0B254-2EF5-42BE-9680-C72AF6CD2331}

2012-07-12 20:18 - 2012-07-12 20:19 - 00000000 ____D C:\Users\Monica\Local Settings\Application Data\{F982F901-9E9B-467E-9042-CD300424EC5C}

2012-07-12 20:18 - 2012-07-12 20:19 - 00000000 ____D C:\Users\Monica\Local Settings\{F982F901-9E9B-467E-9042-CD300424EC5C}

2012-07-12 20:18 - 2012-07-12 20:19 - 00000000 ____D C:\Users\Monica\AppData\Local\{F982F901-9E9B-467E-9042-CD300424EC5C}

2012-07-12 01:33 - 2012-06-11 22:08 - 03148800 ____A (Microsoft Corporation) C:\Windows\System32\win32k.sys

2012-07-12 01:29 - 2012-06-02 07:49 - 17807360 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.dll

2012-07-12 01:29 - 2012-06-02 07:17 - 10924032 ____A (Microsoft Corporation) C:\Windows\System32\ieframe.dll

2012-07-12 01:29 - 2012-06-02 07:12 - 02311680 ____A (Microsoft Corporation) C:\Windows\System32\jscript9.dll

2012-07-12 01:29 - 2012-06-02 07:05 - 01392128 ____A (Microsoft Corporation) C:\Windows\System32\wininet.dll

2012-07-12 01:29 - 2012-06-02 07:05 - 01346048 ____A (Microsoft Corporation) C:\Windows\System32\urlmon.dll

2012-07-12 01:29 - 2012-06-02 07:04 - 01494528 ____A (Microsoft Corporation) C:\Windows\System32\inetcpl.cpl

2012-07-12 01:29 - 2012-06-02 07:04 - 00237056 ____A (Microsoft Corporation) C:\Windows\System32\url.dll

2012-07-12 01:29 - 2012-06-02 07:03 - 00085504 ____A (Microsoft Corporation) C:\Windows\System32\jsproxy.dll

2012-07-12 01:29 - 2012-06-02 07:01 - 00173056 ____A (Microsoft Corporation) C:\Windows\System32\ieUnatt.exe

2012-07-12 01:29 - 2012-06-02 07:00 - 00818688 ____A (Microsoft Corporation) C:\Windows\System32\jscript.dll

2012-07-12 01:29 - 2012-06-02 06:59 - 02144768 ____A (Microsoft Corporation) C:\Windows\System32\iertutil.dll

2012-07-12 01:29 - 2012-06-02 06:57 - 02382848 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.tlb

2012-07-12 01:29 - 2012-06-02 06:57 - 00096768 ____A (Microsoft Corporation) C:\Windows\System32\mshtmled.dll

2012-07-12 01:29 - 2012-06-02 06:54 - 00248320 ____A (Microsoft Corporation) C:\Windows\System32\ieui.dll

2012-07-12 01:29 - 2012-06-02 04:07 - 12314624 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll

2012-07-12 01:29 - 2012-06-02 03:43 - 09737728 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll

2012-07-12 01:29 - 2012-06-02 03:33 - 01800192 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll

2012-07-12 01:29 - 2012-06-02 03:26 - 01103872 ____A (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll

2012-07-12 01:29 - 2012-06-02 03:25 - 01427968 ____A (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl

2012-07-12 01:29 - 2012-06-02 03:25 - 01129472 ____A (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll

2012-07-12 01:29 - 2012-06-02 03:23 - 00231936 ____A (Microsoft Corporation) C:\Windows\SysWOW64\url.dll

2012-07-12 01:29 - 2012-06-02 03:21 - 00065024 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll

2012-07-12 01:29 - 2012-06-02 03:20 - 00142848 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe

2012-07-12 01:29 - 2012-06-02 03:19 - 01793024 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll

2012-07-12 01:29 - 2012-06-02 03:19 - 00716800 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll

2012-07-12 01:29 - 2012-06-02 03:17 - 00073216 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll

2012-07-12 01:29 - 2012-06-02 03:16 - 02382848 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb

2012-07-12 01:29 - 2012-06-02 03:14 - 00176640 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll

2012-07-11 22:30 - 2012-07-11 22:30 - 00000000 ____D C:\Users\Monica\Local Settings\Application Data\{96AAFB6D-1175-4610-80F3-5C8DD8C1076A}

2012-07-11 22:30 - 2012-07-11 22:30 - 00000000 ____D C:\Users\Monica\Local Settings\{96AAFB6D-1175-4610-80F3-5C8DD8C1076A}

2012-07-11 22:30 - 2012-07-11 22:30 - 00000000 ____D C:\Users\Monica\AppData\Local\{96AAFB6D-1175-4610-80F3-5C8DD8C1076A}

2012-07-11 22:29 - 2012-07-11 22:29 - 00000000 ____D C:\Users\Monica\Local Settings\Application Data\{8FB1C8D3-4369-4A11-8487-FF254B5F1D0A}

2012-07-11 22:29 - 2012-07-11 22:29 - 00000000 ____D C:\Users\Monica\Local Settings\{8FB1C8D3-4369-4A11-8487-FF254B5F1D0A}

2012-07-11 22:29 - 2012-07-11 22:29 - 00000000 ____D C:\Users\Monica\AppData\Local\{8FB1C8D3-4369-4A11-8487-FF254B5F1D0A}

2012-07-11 05:24 - 2012-06-09 00:43 - 14172672 ____A (Microsoft Corporation) C:\Windows\System32\shell32.dll

2012-07-11 05:24 - 2012-06-08 23:41 - 12873728 ____A (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll

2012-07-11 05:24 - 2012-06-06 01:06 - 02004480 ____A (Microsoft Corporation) C:\Windows\System32\msxml6.dll

2012-07-11 05:24 - 2012-06-06 01:06 - 01881600 ____A (Microsoft Corporation) C:\Windows\System32\msxml3.dll

2012-07-11 05:24 - 2012-06-06 01:02 - 01133568 ____A (Microsoft Corporation) C:\Windows\System32\cdosys.dll

2012-07-11 05:24 - 2012-06-06 00:05 - 01390080 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msxml6.dll

2012-07-11 05:24 - 2012-06-06 00:05 - 01236992 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msxml3.dll

2012-07-11 05:24 - 2012-06-06 00:03 - 00805376 ____A (Microsoft Corporation) C:\Windows\SysWOW64\cdosys.dll

2012-07-11 05:24 - 2012-06-02 00:50 - 00458704 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\cng.sys

2012-07-11 05:24 - 2012-06-02 00:48 - 00151920 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\ksecpkg.sys

2012-07-11 05:24 - 2012-06-02 00:48 - 00095600 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\ksecdd.sys

2012-07-11 05:24 - 2012-06-02 00:45 - 00340992 ____A (Microsoft Corporation) C:\Windows\System32\schannel.dll

2012-07-11 05:24 - 2012-06-02 00:44 - 00307200 ____A (Microsoft Corporation) C:\Windows\System32\ncrypt.dll

2012-07-11 05:24 - 2012-06-01 23:40 - 00225280 ____A (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll

2012-07-11 05:24 - 2012-06-01 23:40 - 00022016 ____A (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll

2012-07-11 05:24 - 2012-06-01 23:39 - 00219136 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll

2012-07-11 05:24 - 2012-06-01 23:34 - 00096768 ____A (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll

2012-07-11 05:24 - 2010-06-25 22:55 - 00002048 ____A (Microsoft Corporation) C:\Windows\System32\msxml3r.dll

2012-07-11 05:24 - 2010-06-25 22:24 - 00002048 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msxml3r.dll

2012-07-10 21:55 - 2012-07-10 21:55 - 00000000 ____D C:\Users\Monica\Local Settings\Application Data\{D860A217-5B4A-4900-A887-25C33445C4FC}

2012-07-10 21:55 - 2012-07-10 21:55 - 00000000 ____D C:\Users\Monica\Local Settings\Application Data\{BE2B5174-CE7D-4B59-86DC-E8CFD23FFC3F}

2012-07-10 21:55 - 2012-07-10 21:55 - 00000000 ____D C:\Users\Monica\Local Settings\{D860A217-5B4A-4900-A887-25C33445C4FC}

2012-07-10 21:55 - 2012-07-10 21:55 - 00000000 ____D C:\Users\Monica\Local Settings\{BE2B5174-CE7D-4B59-86DC-E8CFD23FFC3F}

2012-07-10 21:55 - 2012-07-10 21:55 - 00000000 ____D C:\Users\Monica\AppData\Local\{D860A217-5B4A-4900-A887-25C33445C4FC}

2012-07-10 21:55 - 2012-07-10 21:55 - 00000000 ____D C:\Users\Monica\AppData\Local\{BE2B5174-CE7D-4B59-86DC-E8CFD23FFC3F}

2012-07-09 17:02 - 2012-07-09 17:02 - 00000000 ____D C:\Users\Monica\Local Settings\Application Data\{7F031E60-561D-42AB-A4CC-F6C38F036945}

2012-07-09 17:02 - 2012-07-09 17:02 - 00000000 ____D C:\Users\Monica\Local Settings\Application Data\{6CA69CC7-DFD8-4592-9E95-46AB289CB8FC}

2012-07-09 17:02 - 2012-07-09 17:02 - 00000000 ____D C:\Users\Monica\Local Settings\{7F031E60-561D-42AB-A4CC-F6C38F036945}

2012-07-09 17:02 - 2012-07-09 17:02 - 00000000 ____D C:\Users\Monica\Local Settings\{6CA69CC7-DFD8-4592-9E95-46AB289CB8FC}

2012-07-09 17:02 - 2012-07-09 17:02 - 00000000 ____D C:\Users\Monica\AppData\Local\{7F031E60-561D-42AB-A4CC-F6C38F036945}

2012-07-09 17:02 - 2012-07-09 17:02 - 00000000 ____D C:\Users\Monica\AppData\Local\{6CA69CC7-DFD8-4592-9E95-46AB289CB8FC}

2012-07-09 05:01 - 2012-07-09 05:01 - 00000000 ____D C:\Users\Monica\Local Settings\Application Data\{A29B8F43-FC88-499B-95A5-B3F11CA59444}

2012-07-09 05:01 - 2012-07-09 05:01 - 00000000 ____D C:\Users\Monica\Local Settings\Application Data\{914CCD34-9DC0-4F42-BFA2-02CE83336A8F}

2012-07-09 05:01 - 2012-07-09 05:01 - 00000000 ____D C:\Users\Monica\Local Settings\{A29B8F43-FC88-499B-95A5-B3F11CA59444}

2012-07-09 05:01 - 2012-07-09 05:01 - 00000000 ____D C:\Users\Monica\Local Settings\{914CCD34-9DC0-4F42-BFA2-02CE83336A8F}

2012-07-09 05:01 - 2012-07-09 05:01 - 00000000 ____D C:\Users\Monica\AppData\Local\{A29B8F43-FC88-499B-95A5-B3F11CA59444}

2012-07-09 05:01 - 2012-07-09 05:01 - 00000000 ____D C:\Users\Monica\AppData\Local\{914CCD34-9DC0-4F42-BFA2-02CE83336A8F}

2012-07-08 16:09 - 2012-07-08 16:09 - 00000000 ____D C:\Users\Monica\Local Settings\Application Data\{CB5BEA7F-AFD8-4BF2-A6B6-EC4CAE20648F}

2012-07-08 16:09 - 2012-07-08 16:09 - 00000000 ____D C:\Users\Monica\Local Settings\Application Data\{6C63778A-7689-423B-AE28-56A7352AD73A}

2012-07-08 16:09 - 2012-07-08 16:09 - 00000000 ____D C:\Users\Monica\Local Settings\{CB5BEA7F-AFD8-4BF2-A6B6-EC4CAE20648F}

2012-07-08 16:09 - 2012-07-08 16:09 - 00000000 ____D C:\Users\Monica\Local Settings\{6C63778A-7689-423B-AE28-56A7352AD73A}

2012-07-08 16:09 - 2012-07-08 16:09 - 00000000 ____D C:\Users\Monica\AppData\Local\{CB5BEA7F-AFD8-4BF2-A6B6-EC4CAE20648F}

2012-07-08 16:09 - 2012-07-08 16:09 - 00000000 ____D C:\Users\Monica\AppData\Local\{6C63778A-7689-423B-AE28-56A7352AD73A}

2012-07-08 02:59 - 2012-07-08 02:59 - 00000000 ____D C:\Users\Monica\Local Settings\Application Data\{D38C8444-F9AB-40E7-AD2D-929AF9A5B176}

2012-07-08 02:59 - 2012-07-08 02:59 - 00000000 ____D C:\Users\Monica\Local Settings\Application Data\{CF84E57B-491E-439B-8DE2-0B1C8EF5724F}

2012-07-08 02:59 - 2012-07-08 02:59 - 00000000 ____D C:\Users\Monica\Local Settings\{D38C8444-F9AB-40E7-AD2D-929AF9A5B176}

2012-07-08 02:59 - 2012-07-08 02:59 - 00000000 ____D C:\Users\Monica\Local Settings\{CF84E57B-491E-439B-8DE2-0B1C8EF5724F}

2012-07-08 02:59 - 2012-07-08 02:59 - 00000000 ____D C:\Users\Monica\AppData\Local\{D38C8444-F9AB-40E7-AD2D-929AF9A5B176}

2012-07-08 02:59 - 2012-07-08 02:59 - 00000000 ____D C:\Users\Monica\AppData\Local\{CF84E57B-491E-439B-8DE2-0B1C8EF5724F}

2012-07-07 17:23 - 2012-07-07 17:23 - 00003584 ____A C:\Users\Monica\Local Settings\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

2012-07-07 17:23 - 2012-07-07 17:23 - 00003584 ____A C:\Users\Monica\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

2012-07-07 17:23 - 2012-07-07 17:23 - 00003584 ____A C:\Users\Monica\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

2012-07-07 14:58 - 2012-07-07 14:58 - 00000000 ____D C:\Users\Monica\Local Settings\Application Data\{EE988628-C1D1-4D6A-BA35-65DDF89D829A}

2012-07-07 14:58 - 2012-07-07 14:58 - 00000000 ____D C:\Users\Monica\Local Settings\Application Data\{BF6FF22F-4E36-484E-9FC0-1712DBFDBB17}

2012-07-07 14:58 - 2012-07-07 14:58 - 00000000 ____D C:\Users\Monica\Local Settings\{EE988628-C1D1-4D6A-BA35-65DDF89D829A}

2012-07-07 14:58 - 2012-07-07 14:58 - 00000000 ____D C:\Users\Monica\Local Settings\{BF6FF22F-4E36-484E-9FC0-1712DBFDBB17}

2012-07-07 14:58 - 2012-07-07 14:58 - 00000000 ____D C:\Users\Monica\AppData\Local\{EE988628-C1D1-4D6A-BA35-65DDF89D829A}

2012-07-07 14:58 - 2012-07-07 14:58 - 00000000 ____D C:\Users\Monica\AppData\Local\{BF6FF22F-4E36-484E-9FC0-1712DBFDBB17}

2012-07-07 05:58 - 2012-07-07 05:58 - 00000000 ____D C:\Users\Monica\Local Settings\Application Data\{82FC8D0A-8AAD-4B1B-9C6D-0C9CCBD7D6B0}

2012-07-07 05:58 - 2012-07-07 05:58 - 00000000 ____D C:\Users\Monica\Local Settings\{82FC8D0A-8AAD-4B1B-9C6D-0C9CCBD7D6B0}

2012-07-07 05:58 - 2012-07-07 05:58 - 00000000 ____D C:\Users\Monica\AppData\Local\{82FC8D0A-8AAD-4B1B-9C6D-0C9CCBD7D6B0}

2012-07-07 05:57 - 2012-07-07 05:58 - 00000000 ____D C:\Users\Monica\Local Settings\Application Data\{C83DAF1B-D506-4A35-94ED-926154A2A210}

2012-07-07 05:57 - 2012-07-07 05:58 - 00000000 ____D C:\Users\Monica\Local Settings\{C83DAF1B-D506-4A35-94ED-926154A2A210}

2012-07-07 05:57 - 2012-07-07 05:58 - 00000000 ____D C:\Users\Monica\AppData\Local\{C83DAF1B-D506-4A35-94ED-926154A2A210}

2012-07-06 16:36 - 2012-07-06 16:36 - 00000000 ____D C:\Users\Monica\Local Settings\Application Data\{E29C37D1-DA53-4754-85B9-0DEBA997FCE9}

2012-07-06 16:36 - 2012-07-06 16:36 - 00000000 ____D C:\Users\Monica\Local Settings\Application Data\{426C53B8-7B32-49A4-A920-F8EC1557BF70}

2012-07-06 16:36 - 2012-07-06 16:36 - 00000000 ____D C:\Users\Monica\Local Settings\{E29C37D1-DA53-4754-85B9-0DEBA997FCE9}

2012-07-06 16:36 - 2012-07-06 16:36 - 00000000 ____D C:\Users\Monica\Local Settings\{426C53B8-7B32-49A4-A920-F8EC1557BF70}

2012-07-06 16:36 - 2012-07-06 16:36 - 00000000 ____D C:\Users\Monica\AppData\Local\{E29C37D1-DA53-4754-85B9-0DEBA997FCE9}

2012-07-06 16:36 - 2012-07-06 16:36 - 00000000 ____D C:\Users\Monica\AppData\Local\{426C53B8-7B32-49A4-A920-F8EC1557BF70}

2012-07-06 16:06 - 2012-08-03 15:35 - 00837246 ____A C:\Windows\WindowsUpdate.log

2012-07-06 12:58 - 2012-07-06 13:29 - 00018948 ____A C:\Windows\System32\avgrep.txt

2012-07-06 12:53 - 2012-07-06 12:53 - 00000000 ____D C:\Windows\Sun

2012-07-06 12:41 - 2011-12-19 15:41 - 00029288 ____A (Wondershare) C:\Windows\System32\Drivers\WsAudio_DeviceS(2).sys

2012-07-06 12:40 - 2012-07-06 12:53 - 00000000 ____D C:\Program Files (x86)\iSkysoft

2012-07-06 12:40 - 2012-07-06 12:40 - 00000000 ____D C:\Users\Monica\Local Settings\iSkysoft

2012-07-06 12:40 - 2012-07-06 12:40 - 00000000 ____D C:\Users\Monica\Local Settings\Application Data\iSkysoft

2012-07-06 12:40 - 2012-07-06 12:40 - 00000000 ____D C:\Users\Monica\AppData\Local\iSkysoft

2012-07-06 12:40 - 2011-12-19 15:41 - 00029288 ____A (Wondershare) C:\Windows\System32\Drivers\WsAudio_DeviceS(1).sys

2012-07-06 12:40 - 2011-12-09 14:35 - 00892928 ____A (Free Software Foundation) C:\Windows\SysWOW64\iconv.dll

2012-07-06 12:40 - 2011-12-09 14:35 - 00675840 ____A () C:\Windows\SysWOW64\ac3filter.ax

2012-07-06 12:35 - 2012-07-06 12:36 - 03157871 ____A C:\Users\Monica\Downloads\9781401303846_epub.v4.epub

2012-07-05 22:11 - 2012-07-05 22:12 - 00000000 ____D C:\Users\Monica\Local Settings\Application Data\{FE72AED7-D852-43B5-9B7A-A14D0062ADE5}

2012-07-05 22:11 - 2012-07-05 22:12 - 00000000 ____D C:\Users\Monica\Local Settings\{FE72AED7-D852-43B5-9B7A-A14D0062ADE5}

2012-07-05 22:11 - 2012-07-05 22:12 - 00000000 ____D C:\Users\Monica\AppData\Local\{FE72AED7-D852-43B5-9B7A-A14D0062ADE5}

2012-07-05 22:11 - 2012-07-05 22:11 - 00000000 ____D C:\Users\Monica\Local Settings\Application Data\{B05EBF74-030C-4B94-A6C4-4A976D039B84}

2012-07-05 22:11 - 2012-07-05 22:11 - 00000000 ____D C:\Users\Monica\Local Settings\{B05EBF74-030C-4B94-A6C4-4A976D039B84}

2012-07-05 22:11 - 2012-07-05 22:11 - 00000000 ____D C:\Users\Monica\AppData\Local\{B05EBF74-030C-4B94-A6C4-4A976D039B84}

2012-07-05 08:42 - 2012-07-05 08:42 - 00000000 ____D C:\Users\Monica\Local Settings\Application Data\{254DCC50-53C9-4AEE-ACA4-2930660234CB}

2012-07-05 08:42 - 2012-07-05 08:42 - 00000000 ____D C:\Users\Monica\Local Settings\{254DCC50-53C9-4AEE-ACA4-2930660234CB}

2012-07-05 08:42 - 2012-07-05 08:42 - 00000000 ____D C:\Users\Monica\AppData\Local\{254DCC50-53C9-4AEE-ACA4-2930660234CB}

2012-07-05 08:41 - 2012-07-05 08:42 - 00000000 ____D C:\Users\Monica\Local Settings\Application Data\{C8ADD9F4-33B3-46A3-9A7B-01F5F293B4EB}

2012-07-05 08:41 - 2012-07-05 08:42 - 00000000 ____D C:\Users\Monica\Local Settings\{C8ADD9F4-33B3-46A3-9A7B-01F5F293B4EB}

2012-07-05 08:41 - 2012-07-05 08:42 - 00000000 ____D C:\Users\Monica\AppData\Local\{C8ADD9F4-33B3-46A3-9A7B-01F5F293B4EB}

2012-07-04 23:33 - 2012-07-04 23:33 - 00000000 ____D C:\Users\Monica\Local Settings\Application Data\{FB137BD2-7A5E-4FE3-A3A2-739404D0DC0A}

2012-07-04 23:33 - 2012-07-04 23:33 - 00000000 ____D C:\Users\Monica\Local Settings\{FB137BD2-7A5E-4FE3-A3A2-739404D0DC0A}

2012-07-04 23:33 - 2012-07-04 23:33 - 00000000 ____D C:\Users\Monica\AppData\Local\{FB137BD2-7A5E-4FE3-A3A2-739404D0DC0A}

2012-07-04 23:27 - 2012-07-04 23:27 - 00000000 ____D C:\Users\Monica\Local Settings\Application Data\{7B854BA6-91F6-44E4-8DE3-2836FCE43124}

2012-07-04 23:27 - 2012-07-04 23:27 - 00000000 ____D C:\Users\Monica\Local Settings\{7B854BA6-91F6-44E4-8DE3-2836FCE43124}

2012-07-04 23:27 - 2012-07-04 23:27 - 00000000 ____D C:\Users\Monica\AppData\Local\{7B854BA6-91F6-44E4-8DE3-2836FCE43124}

2012-07-04 23:18 - 2012-07-04 23:18 - 00000000 ____D C:\Users\Monica\Local Settings\Application Data\{30656D2A-6295-4B2A-821B-C146762DBCAC}

2012-07-04 23:18 - 2012-07-04 23:18 - 00000000 ____D C:\Users\Monica\Local Settings\{30656D2A-6295-4B2A-821B-C146762DBCAC}

2012-07-04 23:18 - 2012-07-04 23:18 - 00000000 ____D C:\Users\Monica\AppData\Local\{30656D2A-6295-4B2A-821B-C146762DBCAC}

2012-07-04 23:13 - 2012-07-04 23:13 - 00000000 ____D C:\Users\Monica\Local Settings\Application Data\{AADCEE1F-5175-4345-BEB4-5B6A0215B95A}

2012-07-04 23:13 - 2012-07-04 23:13 - 00000000 ____D C:\Users\Monica\Local Settings\{AADCEE1F-5175-4345-BEB4-5B6A0215B95A}

2012-07-04 23:13 - 2012-07-04 23:13 - 00000000 ____D C:\Users\Monica\AppData\Local\{AADCEE1F-5175-4345-BEB4-5B6A0215B95A}

2012-07-04 03:39 - 2012-07-04 03:39 - 00000000 ____D C:\Users\Monica\Local Settings\Application Data\{615419E9-56CF-4240-B5C2-295751B82332}

2012-07-04 03:39 - 2012-07-04 03:39 - 00000000 ____D C:\Users\Monica\Local Settings\Application Data\{35E27137-8666-4E80-9F03-2C7BF909D437}

2012-07-04 03:39 - 2012-07-04 03:39 - 00000000 ____D C:\Users\Monica\Local Settings\{615419E9-56CF-4240-B5C2-295751B82332}

2012-07-04 03:39 - 2012-07-04 03:39 - 00000000 ____D C:\Users\Monica\Local Settings\{35E27137-8666-4E80-9F03-2C7BF909D437}

2012-07-04 03:39 - 2012-07-04 03:39 - 00000000 ____D C:\Users\Monica\AppData\Local\{615419E9-56CF-4240-B5C2-295751B82332}

2012-07-04 03:39 - 2012-07-04 03:39 - 00000000 ____D C:\Users\Monica\AppData\Local\{35E27137-8666-4E80-9F03-2C7BF909D437}

============ 3 Months Modified Files ========================

2012-08-03 15:35 - 2012-07-06 16:06 - 00837246 ____A C:\Windows\WindowsUpdate.log

2012-08-03 15:35 - 2009-07-13 23:45 - 00014240 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

2012-08-03 15:35 - 2009-07-13 23:45 - 00014240 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

2012-08-03 15:26 - 2012-08-03 15:26 - 00037308 ____A C:\Users\Monica\Desktop\FRST.txt

2012-08-03 15:22 - 2009-07-14 00:13 - 00730746 ____A C:\Windows\System32\PerfStringBackup.INI

2012-08-03 15:20 - 2012-08-03 15:20 - 01438391 ____A (Farbar) C:\Users\Monica\Desktop\FRST64.exe

2012-08-03 15:05 - 2012-08-03 15:05 - 00002455 ____A C:\Users\Monica\Desktop\RKreport[1].txt

2012-08-03 15:03 - 2012-08-03 15:03 - 01552896 ____A C:\Users\Monica\Desktop\RogueKiller.exe

2012-08-03 14:53 - 2012-06-03 01:46 - 00000830 ____A C:\Windows\Tasks\Adobe Flash Player Updater.job

2012-08-03 14:40 - 2012-02-05 13:39 - 00000912 ____A C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-4233188794-4044679429-2597067180-1001UA.job

2012-08-03 12:14 - 2012-08-03 12:14 - 00036972 ____A C:\Users\Monica\Desktop\DDS.txt

2012-08-03 12:14 - 2012-08-03 12:14 - 00011922 ____A C:\Users\Monica\Desktop\Attach.txt

2012-08-03 12:08 - 2012-08-03 12:08 - 00607260 ____R (Swearware) C:\Users\Monica\Downloads\dds.scr

2012-08-03 04:11 - 2012-08-03 04:11 - 17039840 ____A (Microsoft Corporation) C:\Users\Monica\Downloads\Windows-KB890830-x64-V4.10.exe

2012-08-03 04:02 - 2012-08-02 02:29 - 00000336 ____A C:\Windows\setupact.log

2012-08-03 04:02 - 2009-07-14 00:08 - 00000006 ___AH C:\Windows\Tasks\SA.DAT

2012-08-03 03:59 - 2012-08-03 03:59 - 16373192 ____A (Microsoft Corporation) C:\Users\Monica\Downloads\Windows-KB890830-V4.10.exe

2012-08-03 03:51 - 2012-08-03 03:50 - 00002330 ____A C:\Users\Monica\Desktop\Rkill.txt

2012-08-03 03:50 - 2012-08-03 03:50 - 01051552 ____A (Bleeping Computer, LLC) C:\Users\Monica\Downloads\rkill.exe

2012-08-03 03:24 - 2012-08-03 03:24 - 00039184 ____A (Greatis Software) C:\Windows\System32\Partizan.exe

2012-08-03 03:24 - 2012-08-03 03:24 - 00000063 ____A C:\Windows\SysWOW64\Partizan.RRI

2012-08-03 03:21 - 2012-08-03 03:21 - 00000002 RASHOT C:\Windows\winstart.bat

2012-08-03 03:21 - 2012-08-03 03:21 - 00000002 RASHOT C:\Windows\SysWOW64\CONFIG.NT

2012-08-03 03:21 - 2012-08-03 03:21 - 00000002 RASHOT C:\Windows\SysWOW64\AUTOEXEC.NT

2012-08-03 03:19 - 2012-08-03 03:19 - 12101490 ____A C:\Users\Monica\Downloads\unhackme.zip

2012-08-03 02:54 - 2012-06-03 01:46 - 00426184 ____A (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe

2012-08-03 02:54 - 2012-06-03 01:46 - 00070344 ____A (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl

2012-08-03 00:07 - 2012-08-03 00:07 - 00015488 ____A C:\Users\Monica\Downloads\hijackthis.log

2012-08-03 00:06 - 2012-08-03 00:06 - 00388608 ____A (Trend Micro Inc.) C:\Users\Monica\Downloads\HijackThis.exe

2012-08-02 23:59 - 2012-08-02 23:59 - 02136664 ____A (Kaspersky Lab ZAO) C:\Users\Monica\Downloads\tdsskiller.exe

2012-08-02 23:18 - 2012-08-02 23:18 - 00001945 ____A C:\Windows\epplauncher.mif

2012-08-02 23:16 - 2010-12-19 07:49 - 00744404 ____A C:\Windows\SysWOW64\PerfStringBackup.INI

2012-08-02 23:12 - 2012-08-02 23:12 - 12621696 ____A (Microsoft Corporation) C:\Users\Monica\Downloads\mseinstall.exe

2012-08-02 22:41 - 2012-08-02 22:40 - 00408456 ____A C:\Windows\System32\FNTCACHE.DAT

2012-08-02 19:40 - 2012-02-05 13:39 - 00000860 ____A C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-4233188794-4044679429-2597067180-1001Core.job

2012-08-02 18:25 - 2012-08-02 18:25 - 00108840 ____A C:\Users\Monica\Local Settings\GDIPFONTCACHEV1.DAT

2012-08-02 18:25 - 2012-08-02 18:25 - 00108840 ____A C:\Users\Monica\Local Settings\Application Data\GDIPFONTCACHEV1.DAT

2012-08-02 18:25 - 2012-08-02 18:25 - 00108840 ____A C:\Users\Monica\AppData\Local\GDIPFONTCACHEV1.DAT

2012-08-02 02:29 - 2012-08-02 02:29 - 00000000 ____A C:\Windows\setuperr.log

2012-08-01 22:40 - 2012-08-01 22:40 - 00001128 ____A C:\Users\Public\Desktop\TeamViewer 7.lnk

2012-08-01 22:40 - 2012-08-01 22:40 - 00001128 ____A C:\Users\All Users\Desktop\TeamViewer 7.lnk

2012-08-01 22:39 - 2012-08-01 22:39 - 03610576 ____A (TeamViewer GmbH) C:\Users\Monica\Downloads\TeamViewer_Setup_en.exe

2012-08-01 21:43 - 2012-02-05 13:39 - 00002463 ____A C:\Users\Monica\Desktop\Google Chrome.lnk

2012-07-24 21:06 - 2012-04-13 13:33 - 00001075 ____A C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

2012-07-24 21:06 - 2012-04-13 13:33 - 00001075 ____A C:\Users\All Users\Desktop\Malwarebytes Anti-Malware.lnk

2012-07-21 23:52 - 2012-07-21 23:52 - 02353512 ____A C:\Users\Monica\Downloads\LeagueofLegends.exe

2012-07-21 22:28 - 2012-07-21 22:28 - 00000948 ____A C:\Users\Public\Desktop\Gyazo.lnk

2012-07-21 22:28 - 2012-07-21 22:28 - 00000948 ____A C:\Users\All Users\Desktop\Gyazo.lnk

2012-07-17 08:47 - 2012-06-02 18:36 - 00000927 ____A C:\Users\Public\Desktop\AVG 2012.lnk

2012-07-17 08:47 - 2012-06-02 18:36 - 00000927 ____A C:\Users\All Users\Desktop\AVG 2012.lnk

2012-07-07 17:23 - 2012-07-07 17:23 - 00003584 ____A C:\Users\Monica\Local Settings\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

2012-07-07 17:23 - 2012-07-07 17:23 - 00003584 ____A C:\Users\Monica\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

2012-07-07 17:23 - 2012-07-07 17:23 - 00003584 ____A C:\Users\Monica\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

2012-07-06 13:29 - 2012-07-06 12:58 - 00018948 ____A C:\Windows\System32\avgrep.txt

2012-07-06 12:36 - 2012-07-06 12:35 - 03157871 ____A C:\Users\Monica\Downloads\9781401303846_epub.v4.epub

2012-07-03 12:46 - 2011-05-19 17:22 - 00024904 ____A (Malwarebytes Corporation) C:\Windows\System32\Drivers\mbam.sys

2012-07-03 02:19 - 2010-12-25 10:39 - 59701280 ____A (Microsoft Corporation) C:\Windows\System32\MRT.exe

2012-07-03 02:13 - 2012-08-03 04:01 - 57442464 ____A (Microsoft Corporation) C:\Windows\SysWOW64\MRT.exe

2012-06-25 16:45 - 2012-06-25 16:45 - 00003304 ____N C:\bootsqm.dat

2012-06-11 22:08 - 2012-07-12 01:33 - 03148800 ____A (Microsoft Corporation) C:\Windows\System32\win32k.sys

2012-06-09 00:43 - 2012-07-11 05:24 - 14172672 ____A (Microsoft Corporation) C:\Windows\System32\shell32.dll

2012-06-08 23:41 - 2012-07-11 05:24 - 12873728 ____A (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll

2012-06-06 01:06 - 2012-07-11 05:24 - 02004480 ____A (Microsoft Corporation) C:\Windows\System32\msxml6.dll

2012-06-06 01:06 - 2012-07-11 05:24 - 01881600 ____A (Microsoft Corporation) C:\Windows\System32\msxml3.dll

2012-06-06 01:02 - 2012-07-11 05:24 - 01133568 ____A (Microsoft Corporation) C:\Windows\System32\cdosys.dll

2012-06-06 00:05 - 2012-07-11 05:24 - 01390080 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msxml6.dll

2012-06-06 00:05 - 2012-07-11 05:24 - 01236992 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msxml3.dll

2012-06-06 00:03 - 2012-07-11 05:24 - 00805376 ____A (Microsoft Corporation) C:\Windows\SysWOW64\cdosys.dll

2012-06-04 00:56 - 2012-06-04 00:56 - 00000272 ____A C:\Users\Monica\Application Data\.backup.dm

2012-06-04 00:56 - 2012-06-04 00:56 - 00000272 ____A C:\Users\Monica\AppData\Roaming\.backup.dm

2012-06-02 17:19 - 2012-06-21 11:01 - 02428952 ____A (Microsoft Corporation) C:\Windows\System32\wuaueng.dll

2012-06-02 17:19 - 2012-06-21 11:01 - 00701976 ____A (Microsoft Corporation) C:\Windows\System32\wuapi.dll

2012-06-02 17:19 - 2012-06-21 11:01 - 00057880 ____A (Microsoft Corporation) C:\Windows\System32\wuauclt.exe

2012-06-02 17:19 - 2012-06-21 11:01 - 00044056 ____A (Microsoft Corporation) C:\Windows\System32\wups2.dll

2012-06-02 17:19 - 2012-06-21 11:01 - 00038424 ____A (Microsoft Corporation) C:\Windows\System32\wups.dll

2012-06-02 17:15 - 2012-06-21 11:01 - 02622464 ____A (Microsoft Corporation) C:\Windows\System32\wucltux.dll

2012-06-02 17:15 - 2012-06-21 11:01 - 00099840 ____A (Microsoft Corporation) C:\Windows\System32\wudriver.dll

2012-06-02 14:19 - 2012-06-21 11:00 - 00186752 ____A (Microsoft Corporation) C:\Windows\System32\wuwebv.dll

2012-06-02 14:15 - 2012-06-21 11:00 - 00036864 ____A (Microsoft Corporation) C:\Windows\System32\wuapp.exe

2012-06-02 07:49 - 2012-07-12 01:29 - 17807360 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.dll

2012-06-02 07:17 - 2012-07-12 01:29 - 10924032 ____A (Microsoft Corporation) C:\Windows\System32\ieframe.dll

2012-06-02 07:12 - 2012-07-12 01:29 - 02311680 ____A (Microsoft Corporation) C:\Windows\System32\jscript9.dll

2012-06-02 07:05 - 2012-07-12 01:29 - 01392128 ____A (Microsoft Corporation) C:\Windows\System32\wininet.dll

2012-06-02 07:05 - 2012-07-12 01:29 - 01346048 ____A (Microsoft Corporation) C:\Windows\System32\urlmon.dll

2012-06-02 07:04 - 2012-07-12 01:29 - 01494528 ____A (Microsoft Corporation) C:\Windows\System32\inetcpl.cpl

2012-06-02 07:04 - 2012-07-12 01:29 - 00237056 ____A (Microsoft Corporation) C:\Windows\System32\url.dll

2012-06-02 07:03 - 2012-07-12 01:29 - 00085504 ____A (Microsoft Corporation) C:\Windows\System32\jsproxy.dll

2012-06-02 07:01 - 2012-07-12 01:29 - 00173056 ____A (Microsoft Corporation) C:\Windows\System32\ieUnatt.exe

2012-06-02 07:00 - 2012-07-12 01:29 - 00818688 ____A (Microsoft Corporation) C:\Windows\System32\jscript.dll

2012-06-02 06:59 - 2012-07-12 01:29 - 02144768 ____A (Microsoft Corporation) C:\Windows\System32\iertutil.dll

2012-06-02 06:57 - 2012-07-12 01:29 - 02382848 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.tlb

2012-06-02 06:57 - 2012-07-12 01:29 - 00096768 ____A (Microsoft Corporation) C:\Windows\System32\mshtmled.dll

2012-06-02 06:54 - 2012-07-12 01:29 - 00248320 ____A (Microsoft Corporation) C:\Windows\System32\ieui.dll

2012-06-02 04:07 - 2012-07-12 01:29 - 12314624 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll

2012-06-02 03:43 - 2012-07-12 01:29 - 09737728 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll

2012-06-02 03:33 - 2012-07-12 01:29 - 01800192 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll

2012-06-02 03:26 - 2012-07-12 01:29 - 01103872 ____A (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll

2012-06-02 03:25 - 2012-07-12 01:29 - 01427968 ____A (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl

2012-06-02 03:25 - 2012-07-12 01:29 - 01129472 ____A (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll

2012-06-02 03:23 - 2012-07-12 01:29 - 00231936 ____A (Microsoft Corporation) C:\Windows\SysWOW64\url.dll

2012-06-02 03:21 - 2012-07-12 01:29 - 00065024 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll

2012-06-02 03:20 - 2012-07-12 01:29 - 00142848 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe

2012-06-02 03:19 - 2012-07-12 01:29 - 01793024 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll

2012-06-02 03:19 - 2012-07-12 01:29 - 00716800 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll

2012-06-02 03:17 - 2012-07-12 01:29 - 00073216 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll

2012-06-02 03:16 - 2012-07-12 01:29 - 02382848 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb

2012-06-02 03:14 - 2012-07-12 01:29 - 00176640 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll

2012-06-02 00:50 - 2012-07-11 05:24 - 00458704 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\cng.sys

2012-06-02 00:48 - 2012-07-11 05:24 - 00151920 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\ksecpkg.sys

2012-06-02 00:48 - 2012-07-11 05:24 - 00095600 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\ksecdd.sys

2012-06-02 00:45 - 2012-07-11 05:24 - 00340992 ____A (Microsoft Corporation) C:\Windows\System32\schannel.dll

2012-06-02 00:44 - 2012-07-11 05:24 - 00307200 ____A (Microsoft Corporation) C:\Windows\System32\ncrypt.dll

2012-06-01 23:40 - 2012-07-11 05:24 - 00225280 ____A (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll

2012-06-01 23:40 - 2012-07-11 05:24 - 00022016 ____A (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll

2012-06-01 23:39 - 2012-07-11 05:24 - 00219136 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll

2012-06-01 23:34 - 2012-07-11 05:24 - 00096768 ____A (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll

2012-05-24 08:28 - 2012-05-24 08:27 - 17479088 ____A (White Sky, Inc.) C:\Users\Monica\Downloads\constantguard.exe

2012-05-22 23:59 - 2012-07-21 23:59 - 00000032 ___RA C:\Users\All Users\hash.dat

2012-05-22 23:59 - 2012-07-21 23:59 - 00000032 ___RA C:\Users\All Users\Application Data\hash.dat

ZeroAccess:

C:\Windows\Installer\{f0967059-127a-bfba-96e9-76cd265efaf7}

C:\Windows\Installer\{f0967059-127a-bfba-96e9-76cd265efaf7}\U

ZeroAccess:

C:\Users\Monica\AppData\Local\{f0967059-127a-bfba-96e9-76cd265efaf7}

C:\Users\Monica\AppData\Local\{f0967059-127a-bfba-96e9-76cd265efaf7}\@

C:\Users\Monica\AppData\Local\{f0967059-127a-bfba-96e9-76cd265efaf7}\L

C:\Users\Monica\AppData\Local\{f0967059-127a-bfba-96e9-76cd265efaf7}\U

C:\Users\Monica\AppData\Local\{f0967059-127a-bfba-96e9-76cd265efaf7}\L\00000004.@

C:\Users\Monica\AppData\Local\{f0967059-127a-bfba-96e9-76cd265efaf7}\L\1afb2d56

========================= Known DLLs (Whitelisted) ============

========================= Bamital & volsnap Check ============

C:\Windows\System32\winlogon.exe => MD5 is legit

C:\Windows\System32\wininit.exe => MD5 is legit

C:\Windows\SysWOW64\wininit.exe => MD5 is legit

C:\Windows\explorer.exe => MD5 is legit

C:\Windows\SysWOW64\explorer.exe => MD5 is legit

C:\Windows\System32\svchost.exe => MD5 is legit

C:\Windows\SysWOW64\svchost.exe => MD5 is legit

C:\Windows\System32\services.exe => MD5 is legit

C:\Windows\System32\User32.dll => MD5 is legit

C:\Windows\SysWOW64\User32.dll => MD5 is legit

C:\Windows\System32\userinit.exe => MD5 is legit

C:\Windows\SysWOW64\userinit.exe => MD5 is legit

C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit

==================== EXE ASSOCIATION =====================

HKLM\...\.exe: exefile => OK

HKLM\...\exefile\DefaultIcon: %1 => OK

HKLM\...\exefile\open\command: "%1" %* => OK

========================= Memory info ======================

Percentage of memory in use: 17%

Total physical RAM: 3036.99 MB

Available physical RAM: 2499.55 MB

Total Pagefile: 3035.14 MB

Available Pagefile: 2492.76 MB

Total Virtual: 8192 MB

Available Virtual: 8191.91 MB

======================= Partitions =========================

1 Drive c: (OS) (Fixed) (Total:583.32 GB) (Free:521 GB) NTFS

5 Drive g: (RECOVERY) (Fixed) (Total:12.81 GB) (Free:6.07 GB) NTFS ==>[system with boot components (obtained from reading drive)]

8 Drive j: () (Removable) (Total:14.9 GB) (Free:14.84 GB) FAT32

9 Drive x: (Boot) (Fixed) (Total:0.03 GB) (Free:0.03 GB) NTFS

Disk ### Status Size Free Dyn Gpt

-------- ------------- ------- ------- --- ---

Disk 0 Online 596 GB 0 B

Disk 1 No Media 0 B 0 B

Disk 2 No Media 0 B 0 B

Disk 3 No Media 0 B 0 B

Disk 4 No Media 0 B 0 B

Disk 5 Online 14 GB 0 B

Partitions of Disk 0:

===============

Partition ### Type Size Offset

------------- ---------------- ------- -------

Partition 1 OEM 39 MB 31 KB

Partition 2 Primary 12 GB 40 MB

Partition 3 Primary 583 GB 12 GB

==================================================================================

Disk: 0

Partition 1

Type : DE

Hidden: Yes

Active: No

Volume ### Ltr Label Fs Type Size Status Info

---------- --- ----------- ----- ---------- ------- --------- --------

* Volume 8 FAT Partition 39 MB Healthy Hidden

==================================================================================

Disk: 0

Partition 2

Type : 07

Hidden: No

Active: Yes

Volume ### Ltr Label Fs Type Size Status Info

---------- --- ----------- ----- ---------- ------- --------- --------

* Volume 1 G RECOVERY NTFS Partition 12 GB Healthy

==================================================================================

Disk: 0

Partition 3

Type : 07

Hidden: No

Active: No

Volume ### Ltr Label Fs Type Size Status Info

---------- --- ----------- ----- ---------- ------- --------- --------

* Volume 2 C OS NTFS Partition 583 GB Healthy

==================================================================================

Partitions of Disk 5:

===============

Partition ### Type Size Offset

------------- ---------------- ------- -------

Partition 1 Primary 14 GB 16 KB

==================================================================================

Disk: 5

Partition 1

Type : 0C

Hidden: No

Active: No

Volume ### Ltr Label Fs Type Size Status Info

---------- --- ----------- ----- ---------- ------- --------- --------

* Volume 7 J FAT32 Removable 14 GB Healthy

==================================================================================

==========================================================

Last Boot: 2010-12-14 05:03

======================= End Of Log ==========================

Search log:

Farbar Recovery Scan Tool Version: 25-07-2012 01

Ran by SYSTEM at 2012-08-03 17:43:38

Running from J:\

================== Search: "services.exe" ===================

C:\Windows\winsxs\amd64_microsoft-windows-s..s-servicecontroller_31bf3856ad364e35_6.1.7600.16385_none_2b54b20ee6fa07b1\services.exe

[2009-07-13 18:19] - [2009-07-13 20:39] - 0328704 ____A (Microsoft Corporation) 24ACB7E5BE595468E3B9AA488B9B4FCB

C:\Windows\system64\services.exe

[2009-07-13 18:19] - [2009-07-13 20:39] - 0328704 ____A (Microsoft Corporation) 24ACB7E5BE595468E3B9AA488B9B4FCB

C:\Windows\System32\services.exe

[2009-07-13 18:19] - [2009-07-13 20:39] - 0328704 ____A (Microsoft Corporation) 24ACB7E5BE595468E3B9AA488B9B4FCB

====== End Of Search ======

MrCharlie · August 3, 2012

Not too bad!

OK, here you go......Please carefully carry out this procedure!!!!!!

Open notepad. Make sure "word wrap" under Format is unchecked! Please copy the contents of the code box below. To do this highlight the contents of the box and right click on it. Paste this into the open notepad. Save it on the flashdrive as fixlist.txt


C:\Windows\Installer\{f0967059-127a-bfba-96e9-76cd265efaf7}
C:\Users\Monica\AppData\Local\{f0967059-127a-bfba-96e9-76cd265efaf7}

NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system

On Vista or Windows 7: Now please enter System Recovery Options.

Run FRST64 or FRST (which ever one you're using) and press the Fix button just once and wait.

The tool will make a log on the flashdrive (Fixlog.txt) please post it to your reply.

MrC

snapdragon · August 3, 2012

Fix result of Farbar Recovery Tool (FRST written by Farbar) Version: 25-07-2012 01

Ran by SYSTEM at 2012-08-03 19:37:44 Run:1

Running from K:\

==============================================

C:\Windows\Installer\{f0967059-127a-bfba-96e9-76cd265efaf7} moved successfully.

C:\Users\Monica\AppData\Local\{f0967059-127a-bfba-96e9-76cd265efaf7} moved successfully.

==== End of Fixlog ====

MrCharlie · August 3, 2012

Well Done, lets run ComboFix to clear up any leftovers.

Please download and run ComboFix.

The most important things to remember when running it is to disable all your malware programs and run Combofix from your desktop.

Please visit this webpage for download links, and instructions for running ComboFix

http://www.bleepingcomputer.com/combofix/how-to-use-combofix

Ensure you have disabled all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

Information on disabling your malware programs can be found Here.

Make sure you run ComboFix from your desktop.

Give it at least 30-45 minutes to finish if needed.

Please include the C:\ComboFix.txt in your next reply for further review.

---------->NOTE<----------

If you get the message Illegal operation attempted on registry key that has been marked for deletion after you run ComboFix....please reboot the computer, this should resolve the problem. You may have to do this several times if needed.

MrC

snapdragon · August 3, 2012

I can't disable Comcast's Constant Guard Protection Suite. I think it's just a password protector. Is that okay to leave running or should I uninstall it?

MrCharlie · August 3, 2012

Go ahead and try it, MrC

snapdragon · August 3, 2012

ComboFix told me McAfee is active/running and tried to disable it but couldn't. I wasn't aware this computer had McAfee and can't find it to turn it off or remove it...

MrCharlie · August 3, 2012

Did you look here:

http://www.bleepingcomputer.com/forums/topic114351.html

MrC

snapdragon · August 3, 2012

Yeah but I have no icon for it, it's not in the programs list, and I searched for it in the start bar thing and nothing comes up except for the dds.txt file.

snapdragon · August 3, 2012

I started ComboFix again and that didn't pop up this time. Wooo. It's running now.

snapdragon · August 3, 2012

ComboFix logs!:

ComboFix 12-07-31.06 - Monica 08/03/2012 20:48:37.1.2 - x64

Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.3037.1676 [GMT -4:00]

Running from: c:\users\Monica\Desktop\ComboFix.exe

AV: AVG Anti-Virus Free Edition 2012 *Disabled/Updated* {5A2746B1-DEE9-F85A-FBCD-ADB11639C5F0}

AV: Microsoft Security Essentials *Disabled/Updated* {9765EA51-0D3C-7DFB-6091-10E4E1F341F6}

SP: AVG Anti-Virus Free Edition 2012 *Disabled/Updated* {E146A755-F8D3-F7D4-C17D-96C36DBE8F4D}

SP: Microsoft Security Essentials *Disabled/Updated* {2C040BB5-2B06-7275-5A21-2B969A740B4B}

SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.

((((((((((((((((((((((((( Files Created from 2012-07-04 to 2012-08-04 )))))))))))))))))))))))))))))))

.

2012-08-03 20:20 . 2012-08-03 20:26 -------- d-----w- C:\FRST

2012-08-03 08:24 . 2012-08-03 08:24 39184 ----a-w- c:\windows\system32\Partizan.exe

2012-08-03 08:21 . 2012-08-03 08:33 -------- d-----w- c:\programdata\RegRun

2012-08-03 08:21 . 2012-08-03 08:21 2 --shatr- c:\windows\winstart.bat

2012-08-03 08:20 . 2012-08-03 08:34 -------- d-----w- c:\program files (x86)\UnHackMe

2012-08-03 04:39 . 2012-08-03 08:33 -------- d-----w- c:\program files (x86)\Panda Security

2012-08-03 04:21 . 2012-01-31 12:44 279656 ------w- c:\windows\system32\MpSigStub.exe

2012-08-03 04:19 . 2012-02-09 18:17 927800 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{E02A07BB-0BEC-4002-B26C-077B795E8F55}\gapaengine.dll

2012-08-03 04:19 . 2012-07-16 06:40 9133488 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{085881DC-AAB0-4B58-B71C-91089859C2B2}\mpengine.dll

2012-08-03 04:16 . 2012-08-03 04:16 -------- d-----w- c:\program files (x86)\Microsoft Security Client

2012-08-03 04:16 . 2012-08-03 04:17 -------- d-----w- c:\program files\Microsoft Security Client

2012-08-02 03:40 . 2012-08-02 03:40 -------- d-----w- c:\users\Monica\temp

2012-08-02 03:40 . 2012-08-02 03:40 -------- d-----w- c:\users\Monica\AppData\Roaming\TeamViewer

2012-08-02 03:40 . 2012-08-02 03:40 -------- d-----w- c:\program files (x86)\TeamViewer

2012-08-01 04:50 . 2012-08-03 08:40 -------- d-----w- c:\users\Monica\AppData\Local\Netscape

2012-07-25 18:04 . 2012-05-18 17:26 8007680 ----a-w- c:\program files (x86)\Mozilla Firefox\Microsoft.mshtml.dll

2012-07-22 21:07 . 2012-07-22 21:07 -------- d-----w- c:\users\Monica\AppData\Roaming\Macrovision

2012-07-22 04:56 . 2012-07-22 04:56 -------- d-----w- c:\users\Monica\AppData\Roaming\Three Rings Design

2012-07-22 04:53 . 2012-07-22 05:24 -------- d-----w- c:\users\Monica\AppData\Local\PMB Files

2012-07-22 04:53 . 2012-07-22 04:53 -------- d-----w- c:\programdata\PMB Files

2012-07-22 04:53 . 2012-07-22 04:53 -------- d-----w- c:\program files (x86)\Pando Networks

2012-07-22 03:29 . 2012-07-22 03:29 -------- d-----w- c:\users\Monica\AppData\Roaming\Gyazo

2012-07-22 03:28 . 2012-07-22 03:28 -------- d-----w- c:\program files (x86)\Gyazo

2012-07-12 06:33 . 2012-06-12 03:08 3148800 ----a-w- c:\windows\system32\win32k.sys

2012-07-06 17:53 . 2012-07-06 17:53 -------- d-----w- c:\windows\Sun

2012-07-06 17:41 . 2011-12-19 20:41 29288 ----a-w- c:\windows\system32\drivers\WsAudio_DeviceS(2).sys

2012-07-06 17:40 . 2011-12-19 20:41 29288 ----a-w- c:\windows\system32\drivers\WsAudio_DeviceS(1).sys

2012-07-06 17:40 . 2012-07-06 17:40 -------- d-----w- c:\users\Monica\AppData\Local\iSkysoft

2012-07-06 17:40 . 2012-07-06 17:40 -------- d-----w- c:\program files (x86)\Common Files\iSkysoft

2012-07-06 17:40 . 2011-12-09 19:35 892928 ----a-w- c:\windows\SysWow64\iconv.dll

2012-07-06 17:40 . 2011-12-09 19:35 675840 ----a-w- c:\windows\SysWow64\ac3filter.ax

2012-07-06 17:40 . 2012-07-06 17:53 -------- d-----w- c:\program files (x86)\iSkysoft

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2012-08-03 07:54 . 2012-06-03 06:46 426184 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe

2012-08-03 07:54 . 2012-06-03 06:46 70344 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl

2012-07-03 17:46 . 2011-05-19 22:22 24904 ----a-w- c:\windows\system32\drivers\mbam.sys

2012-07-03 07:19 . 2010-12-25 15:39 59701280 ----a-w- c:\windows\system32\MRT.exe

2012-06-20 01:28 . 2012-06-20 01:28 19736 ----a-w- c:\programdata\Microsoft\IdentityCRL\production\ppcrlconfig600.dll

2012-06-02 22:19 . 2012-06-21 16:01 38424 ----a-w- c:\windows\system32\wups.dll

2012-06-02 22:19 . 2012-06-21 16:01 2428952 ----a-w- c:\windows\system32\wuaueng.dll

2012-06-02 22:19 . 2012-06-21 16:01 57880 ----a-w- c:\windows\system32\wuauclt.exe

2012-06-02 22:19 . 2012-06-21 16:01 44056 ----a-w- c:\windows\system32\wups2.dll

2012-06-02 22:19 . 2012-06-21 16:01 701976 ----a-w- c:\windows\system32\wuapi.dll

2012-06-02 22:15 . 2012-06-21 16:01 2622464 ----a-w- c:\windows\system32\wucltux.dll

2012-06-02 22:15 . 2012-06-21 16:01 99840 ----a-w- c:\windows\system32\wudriver.dll

2012-06-02 19:19 . 2012-06-21 16:00 186752 ----a-w- c:\windows\system32\wuwebv.dll

2012-06-02 19:15 . 2012-06-21 16:00 36864 ----a-w- c:\windows\system32\wuapp.exe

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

.

[HKEY_LOCAL_MACHINE\Wow6432Node\~\Browser Helper Objects\{95B7759C-8C7F-4BF1-B163-73684A933233}]

2012-07-09 17:32 2074208 ----a-w- c:\program files (x86)\AVG Secure Search\11.1.0.12\AVG Secure Search_toolbar.dll

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar]

"{95B7759C-8C7F-4BF1-B163-73684A933233}"= "c:\program files (x86)\AVG Secure Search\11.1.0.12\AVG Secure Search_toolbar.dll" [2012-07-09 2074208]

.

[HKEY_CLASSES_ROOT\clsid\{95b7759c-8c7f-4bf1-b163-73684a933233}]

[HKEY_CLASSES_ROOT\AVG Secure Search.PugiObj.1]

[HKEY_CLASSES_ROOT\AVG Secure Search.PugiObj]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]

"IAStorIcon"="c:\program files (x86)\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe" [2010-03-04 284696]

"Desktop Disc Tool"="c:\program files (x86)\Roxio\Roxio Burn\RoxioBurnLauncher.exe" [2009-10-15 498160]

"Dell DataSafe Online"="c:\program files (x86)\Dell\Dell Datasafe Online\NOBuClient.exe" [2010-08-26 1117528]

"AVG_TRAY"="c:\program files (x86)\AVG\AVG2012\avgtray.exe" [2012-04-05 2587008]

"LWS"="c:\program files (x86)\Logitech\LWS\Webcam Software\LWS.exe" [2011-08-12 205336]

"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2012-01-18 254696]

"GIDDesktop"="c:\program files (x86)\SFT\GuardedID\gidd.exe" [2011-07-05 395528]

"vProt"="c:\program files (x86)\AVG Secure Search\vprot.exe" [2012-07-09 1107552]

"Adobe Reader Speed Launcher"="c:\program files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2012-03-27 37296]

"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-01-02 843712]

"APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2012-05-31 59280]

"iTunesHelper"="c:\program files (x86)\iTunes\iTunesHelper.exe" [2012-06-07 421776]

"PlusService"="c:\program files (x86)\Yuna Software\Messenger Plus!\PlusService.exe" [2012-02-27 801792]

"HF_G_Jul"="c:\program files (x86)\AVG Secure Search\HF_G_Jul.exe" [2012-07-18 36960]

"Malwarebytes' Anti-Malware"="c:\program files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe" [2012-07-03 462920]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce]

"c:\program files (x86)\Dell DataSafe Local Backup\Components\DSUpdate\DSUpdate.exe"="c:\program files (x86)\Dell DataSafe Local Backup\Components\DSUpdate\DSUpdate.exe" [2011-09-18 560128]

"Launcher"="c:\program files (x86)\Dell DataSafe Local Backup\Components\Scheduler\Launcher.exe" [2011-01-13 165184]

.

c:\users\Monica\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\

Dell Dock.lnk - c:\program files\Dell\DellDock\DellDock.exe [2010-5-28 1324384]

.

c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\

Constant Guard.lnk - c:\program files (x86)\Constant Guard Protection Suite\IDVault.exe [2012-7-18 6536304]

.

c:\users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\

Dell Dock First Run.lnk - c:\program files\Dell\DellDock\DellDock.exe [2010-5-28 1324384]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"ConsentPromptBehaviorAdmin"= 5 (0x5)

"ConsentPromptBehaviorUser"= 3 (0x3)

"EnableUIADesktopToggle"= 0 (0x0)

.

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]

BootExecute REG_MULTI_SZ autocheck autochk *\0c:\progra~2\AVG\AVG2012\avgrsa.exe /sync /restart

.

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]

Security Packages REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp

.

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]

@=""

.

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]

@="Service"

.

R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]

R3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-08-03 250056]

R3 GamesAppService;GamesAppService;c:\program files (x86)\WildTangent Games\App\GamesAppService.exe [2010-10-12 206072]

R3 LVRS64;Logitech RightSound Filter Driver;c:\windows\system32\DRIVERS\lvrs64.sys [2011-08-19 351136]

R3 LVUVC64;Logitech HD Webcam C270(UVC);c:\windows\system32\DRIVERS\lvuvc64.sys [2011-08-19 4869024]

R3 MozillaMaintenance;Mozilla Maintenance Service;c:\program files (x86)\Mozilla Maintenance Service\maintenanceservice.exe [2012-07-19 113120]

R3 NisDrv;Microsoft Network Inspection System;c:\windows\system32\DRIVERS\NisDrvWFP.sys [2012-03-21 98688]

R3 NisSrv;Microsoft Network Inspection;c:\program files\Microsoft Security Client\NisSrv.exe [2012-03-26 291696]

R3 osppsvc;Office Software Protection Platform;c:\program files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-01-10 4925184]

R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-20 59392]

R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys [2012-04-25 52736]

R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [2010-12-20 1255736]

R3 WDC_SAM;WD SCSI Pass Thru driver;c:\windows\system32\DRIVERS\wdcsam64.sys [2008-05-06 14464]

R3 WsAudio_DeviceS(1);WsAudio_DeviceS(1);c:\windows\system32\drivers\WsAudio_DeviceS(1).sys [2011-12-19 29288]

R3 WsAudio_DeviceS(2);WsAudio_DeviceS(2);c:\windows\system32\drivers\WsAudio_DeviceS(2).sys [2011-12-19 29288]

R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe [2010-09-23 57184]

S0 AVGIDSHA;AVGIDSHA;c:\windows\system32\DRIVERS\avgidsha.sys [2012-04-19 28480]

S0 Avgrkx64;AVG Anti-Rootkit Driver;c:\windows\system32\DRIVERS\avgrkx64.sys [2012-01-31 36944]

S0 PxHlpa64;PxHlpa64;c:\windows\System32\Drivers\PxHlpa64.sys [2009-07-09 55280]

S1 Avgldx64;AVG AVI Loader Driver;c:\windows\system32\DRIVERS\avgldx64.sys [2012-02-22 289872]

S1 Avgmfx64;AVG Mini-Filter Resident Anti-Virus Shield;c:\windows\system32\DRIVERS\avgmfx64.sys [2011-12-23 47696]

S1 Avgtdia;AVG TDI Driver;c:\windows\system32\DRIVERS\avgtdia.sys [2012-03-19 383808]

S1 GIDv2;GIDv2; [x]

S2 AVGIDSAgent;AVGIDSAgent;c:\program files (x86)\AVG\AVG2012\avgidsagent.exe [2012-07-04 5160568]

S2 avgwd;AVG WatchDog;c:\program files (x86)\AVG\AVG2012\avgwdsvc.exe [2012-02-14 193288]

S2 cvhsvc;Client Virtualization Handler;c:\program files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE [2012-01-04 822624]

S2 DockLoginService;Dock Login Service;c:\program files\Dell\DellDock\DockLogin.exe [2009-06-09 155648]

S2 IAStorDataMgrSvc;Intel® Rapid Storage Technology;c:\program files (x86)\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe [2010-03-04 13336]

S2 IDVaultSvc;CGPS Service;c:\program files (x86)\Constant Guard Protection Suite\IDVaultSvc.exe [2012-07-18 66160]

S2 MBAMService;MBAMService;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2012-07-03 655944]

S2 NOBU;Dell DataSafe Online;c:\program files (x86)\Dell\Dell Datasafe Online\NOBuAgent.exe SERVICE [x]

S2 sftlist;Application Virtualization Client;c:\program files (x86)\Microsoft Application Virtualization Client\sftlist.exe [2011-10-01 508776]

S2 SftService;SoftThinks Agent Service;c:\program files (x86)\Dell DataSafe Local Backup\sftservice.EXE [2011-01-13 705856]

S2 TeamViewer7;TeamViewer 7;c:\program files (x86)\TeamViewer\Version7\TeamViewer_Service.exe [2012-07-16 2673064]

S2 UMVPFSrv;UMVPFSrv;c:\program files (x86)\Common Files\logishrd\LVMVFM\UMVPFSrv.exe [2011-08-19 450848]

S2 vToolbarUpdater11.2.0;vToolbarUpdater11.2.0;c:\program files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\11.2.0\ToolbarUpdater.exe [2012-07-09 935008]

S3 AVGIDSDriver;AVGIDSDriver;c:\windows\system32\DRIVERS\avgidsdrivera.sys [2011-12-23 124496]

S3 AVGIDSFilter;AVGIDSFilter;c:\windows\system32\DRIVERS\avgidsfiltera.sys [2011-12-23 29776]

S3 IntcHdmiAddService;Intel® High Definition Audio HDMI;c:\windows\system32\drivers\IntcHdmi.sys [2009-05-26 138752]

S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2012-07-03 24904]

S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [2011-06-10 539240]

S3 Sftfs;Sftfs;c:\windows\system32\DRIVERS\Sftfslh.sys [2011-10-01 764264]

S3 Sftplay;Sftplay;c:\windows\system32\DRIVERS\Sftplaylh.sys [2011-10-01 268648]

S3 Sftredir;Sftredir;c:\windows\system32\DRIVERS\Sftredirlh.sys [2011-10-01 25960]

S3 Sftvol;Sftvol;c:\windows\system32\DRIVERS\Sftvollh.sys [2011-10-01 22376]

S3 sftvsa;Application Virtualization Service Agent;c:\program files (x86)\Microsoft Application Virtualization Client\sftvsa.exe [2011-10-01 219496]

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{9191979D-821C-4EA8-B021-2DA1D859A7C5}-3Reg]

2011-07-05 14:26 435976 ----a-w- c:\program files (x86)\SFT\GuardedID\GIDI.exe

.

Contents of the 'Scheduled Tasks' folder

.

2012-08-04 c:\windows\Tasks\Adobe Flash Player Updater.job

- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-06-03 07:54]

.

2012-08-04 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-4233188794-4044679429-2597067180-1001Core.job

- c:\users\Monica\AppData\Local\Google\Update\GoogleUpdate.exe [2012-02-05 18:39]

.

2012-08-04 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-4233188794-4044679429-2597067180-1001UA.job

- c:\users\Monica\AppData\Local\Google\Update\GoogleUpdate.exe [2012-02-05 18:39]

.

--------- X64 Entries -----------

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2009-10-21 8306208]

"IgfxTray"="c:\windows\system32\igfxtray.exe" [2011-02-11 162328]

"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2011-02-11 386584]

"Persistence"="c:\windows\system32\igfxpers.exe" [2011-02-11 417304]

"MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2012-03-26 1271168]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]

"LoadAppInit_DLLs"=0x0

.

------- Supplementary Scan -------

.

uLocal Page = c:\windows\system32\blank.htm

uStart Page = hxxp://xfinity.comcast.net/?cid=cgps05242012

mLocal Page = c:\windows\SysWOW64\blank.htm

uInternet Settings,ProxyOverride = *.local

IE: E&xport to Microsoft Excel - c:\progra~2\MICROS~1\Office14\EXCEL.EXE/3000

IE: Se&nd to OneNote - c:\progra~2\MICROS~1\Office14\ONBttnIE.dll/105

TCP: DhcpNameServer = 192.168.1.1 75.75.75.75 75.75.76.76

Handler: viprotocol - {B658800C-F66E-4EF3-AB85-6C0C227862A9} - c:\program files (x86)\Common Files\AVG Secure Search\ViProtocolInstaller\11.2.0\ViProtocol.dll

FF - ProfilePath - c:\users\Monica\AppData\Roaming\Mozilla\Firefox\Profiles\w9h1gvrc.default\

FF - prefs.js: browser.search.selectedEngine - Google

FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/

FF - prefs.js: keyword.URL - hxxp://isearch.avg.com/search?cid=%7B91742f01-7779-4a82-b2b5-0d01bde227a1%7D&mid=887fb5bbb47647d18b4069e5293aba43-e7556ebd7c7bcea0ef02e4f021e4cb4f831f4b61&ds=AVG&v=11.1.0.7〈=en&pr=fr&d=2012-06-02%2019%3A35%3A54&sap=ku&q=

FF - prefs.js: network.proxy.type - 0

.

- - - - ORPHANS REMOVED - - - -

.

Toolbar-Locked - (no file)

WebBrowser-{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39} - (no file)

.

--------------------- LOCKED REGISTRY KEYS ---------------------

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]

@Denied: (A 2) (Everyone)

@="FlashBroker"

"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_3_300_270_ActiveX.exe,-101"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]

"Enabled"=dword:00000001

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_3_300_270_ActiveX.exe"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]

@Denied: (A 2) (Everyone)

@="Shockwave Flash Object"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_3_300_270.ocx"

"ThreadingModel"="Apartment"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]

@="0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]

@="ShockwaveFlash.ShockwaveFlash.11"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_3_300_270.ocx, 1"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]

@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]

@="1.0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]

@="ShockwaveFlash.ShockwaveFlash"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]

@Denied: (A 2) (Everyone)

@="Macromedia Flash Factory Object"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_3_300_270.ocx"

"ThreadingModel"="Apartment"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]

@="FlashFactory.FlashFactory.1"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_3_300_270.ocx, 1"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]

@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]

@="1.0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]

@="FlashFactory.FlashFactory"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]

@Denied: (A 2) (Everyone)

@="IFlashBroker4"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]

@="{00020424-0000-0000-C000-000000000046}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

"Version"="1.0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Office\Common\Smart Tag\Actions\{B7EFF951-E52F-45CC-9EF7-57124F2177CC}]

@Denied: (A) (Everyone)

"Solution"="{15727DE6-F92D-4E46-ACB4-0E2C58B31A18}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3]

@Denied: (A) (Everyone)

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3\0]

"Key"="ActionsPane3"

"Location"="c:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VSTO\\ActionsPane3.xsd"

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]

@Denied: (Full) (Everyone)

.

------------------------ Other Running Processes ------------------------

.

c:\program files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

c:\program files (x86)\Dell DataSafe Local Backup\COMPONENTS\SCHEDULER\STSERVICE.EXE

c:\program files (x86)\Dell DataSafe Local Backup\Components\DSUpdate\DSUpd.exe

c:\program files (x86)\Dell DataSafe Local Backup\Toaster.exe

.

**************************************************************************

.

Completion time: 2012-08-03 21:14:07 - machine was rebooted

ComboFix-quarantined-files.txt 2012-08-04 01:14

.

Pre-Run: 558,905,921,536 bytes free

Post-Run: 558,762,217,472 bytes free

.

- - End Of File - - E7E55B20D90D167ABB1449AD443E400E

MrCharlie · August 3, 2012

Download TFC to your desktop

Close any open windows.

Double click the TFC icon to run the program

TFC will close all open programs itself in order to run,

Click the Start button to begin the process.

Allow TFC to run uninterrupted.

The program should not take long to finish it's job

Once its finished it should automatically reboot your machine,

if it doesn't, manually reboot to ensure a complete clean

--------------------------------------

Then.....

Please Update and run a Quick Scan with MBAM, post the report.

Make sure that everything is checked, and click Remove Selected.

Please let me know how it is, MrC

snapdragon · August 3, 2012

When I try to download it I get this message:

The connection was reset

The connection to the server was reset while the page was loading.

The site could be temporarily unavailable or too busy. Try again in a few

moments.

If you are unable to load any pages, check your computer's network

connection.

If your computer or network is protected by a firewall or proxy, make sure

that Firefox is permitted to access the Web.

Is that normal? ;P

MrCharlie · August 3, 2012

Try here:

http://forums.whatthetech.com/index.php?autocom=downloads&showfile=9

MrC

snapdragon · August 4, 2012

That linked worked, thanks!! Ran it then ran MBAM.

Scan results said no objects detected.

MrCharlie · August 4, 2012

How is it? Any difference?? MrC

snapdragon · August 4, 2012

I don't seem to be redirecting from google on Firefox now. When I try clicking links from google on IE, a pop up that says "Security Alert

You are about to leave a secure Internet connection. It will be possible for others to view information you send. Do you want to continue?"

Is that normal?

MrCharlie · August 4, 2012

Yes it is, to disable it:

To manually change that setting in IE, go to Tools > Internet Options > Advanced and uncheck the box next to "Warn if changing between secure and non secure mode". Or, the first time the message appears check the box "In the Future, do not show this warning".

MrC

snapdragon · August 4, 2012

No redirecting in IE either!! Am I cured?!

Google search redirecting

Recommended Posts

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Recently Browsing 0 members

Important Information