My Windows Defender and Windows Firewall won't turn on?

Sammerz93 · September 5, 2012

I was told to post these logs in order for someone to help me.

.

DDS (Ver_2011-08-26.01) - NTFSAMD64

Internet Explorer: 9.0.8112.16421

Run by Sammerz93 at 1:21:12 on 2012-09-05

Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.4044.2309 [GMT -5:00]

.

AV: Norton Internet Security *Disabled/Outdated* {63DF5164-9100-186D-2187-8DC619EFD8BF}

SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

SP: Norton Internet Security *Disabled/Outdated* {D8BEB080-B73A-17E3-1B37-B6B462689202}

FW: Norton Internet Security *Disabled* {5BE4D041-DB6F-1935-0AD8-24F3E73C9FC4}

.

============== Running Processes ===============

.

C:\windows\system32\wininit.exe

C:\windows\system32\lsm.exe

C:\windows\system32\svchost.exe -k DcomLaunch

C:\windows\system32\svchost.exe -k RPCSS

C:\windows\System32\svchost.exe -k LocalServiceNetworkRestricted

C:\windows\System32\svchost.exe -k LocalSystemNetworkRestricted

C:\windows\system32\svchost.exe -k netsvcs

C:\windows\system32\svchost.exe -k LocalService

C:\windows\system32\svchost.exe -k NetworkService

C:\windows\System32\spoolsv.exe

C:\windows\System32\svchost.exe -k LocalServiceNoNetwork

c:\PROGRA~2\mcafee\SITEAD~1\mcsacore.exe

C:\Program Files (x86)\Norton PC Checkup\Engine\2.0.13.11\ccSvcHst.exe

C:\windows\system32\rundll32.exe

C:\windows\SysWOW64\rundll32.exe

C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe

C:\windows\system32\svchost.exe -k imgsvc

C:\windows\system32\TODDSrv.exe

C:\Program Files\TOSHIBA\Power Saver\TosCoSrv.exe

C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE

C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe

C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe

C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE

C:\windows\system32\taskhost.exe

C:\Program Files (x86)\Norton PC Checkup\Engine\2.0.13.11\ccSvcHst.exe

C:\windows\system32\Dwm.exe

C:\windows\Explorer.EXE

C:\Windows\System32\igfxtray.exe

C:\Windows\System32\hkcmd.exe

C:\Windows\System32\igfxpers.exe

C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

C:\Program Files\TOSHIBA\Power Saver\TPwrMain.exe

C:\Program Files\TOSHIBA\FlashCards\TCrdMain.exe

C:\Program Files\TOSHIBA\BulletinBoard\TosNcCore.exe

C:\Program Files\TOSHIBA\ReelTime\TosReelTimeMonitor.exe

C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

C:\Program Files (x86)\McAfee Security Scan\3.0.207\SSScheduler.exe

C:\Program Files (x86)\TOSHIBA\TOSHIBA Service Station\ToshibaServiceStation.exe

C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe

C:\Program Files\Synaptics\SynTP\SynTPHelper.exe

C:\Program Files (x86)\PC Cleaners\PCCleaners.exe

C:\windows\system32\svchost.exe -k LocalServiceAndNoImpersonation

C:\windows\system32\SearchIndexer.exe

C:\Program Files (x86)\TOSHIBA\TOSHIBA Service Station\TMachInfo.exe

C:\Program Files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe

C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe

C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe

C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSmartSrv.exe

C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSENotify.exe

C:\Windows\System32\StikyNot.exe

C:\Program Files (x86)\Mozilla Firefox\firefox.exe

C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe

C:\windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_4_402_265.exe

C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe

C:\windows\System32\svchost.exe -k WerSvcGroup

c:\PROGRA~2\mcafee\SITEAD~1\saui.exe

C:\Program Files (x86)\McAfee Security Scan\3.0.207\McUicnt.exe

C:\Program Files (x86)\McAfee Security Scan\3.0.207\McCHSvc.exe

C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbam.exe

C:\windows\system32\SearchProtocolHost.exe

C:\windows\system32\SearchFilterHost.exe

C:\windows\system32\DllHost.exe

C:\windows\SysWOW64\cmd.exe

C:\windows\system32\conhost.exe

C:\windows\SysWOW64\cscript.exe

C:\windows\system32\wbem\wmiprvse.exe

.

============== Pseudo HJT Report ===============

.

uStart Page = hxxp://www.facebook.com/

uDefault_Page_URL = hxxp://start.toshiba.com

mStart Page = hxxp://start.funmoods.com/?f=1&a=nv1&chnl=nv1&cd=2XzutAtN2Y1L1QzutDtDtByCyC0C0E0AzztA0B0A0AtBzy0CtN0D0TzutBtDtCtBtDyCtBzy&cr=809745180

uInternet Settings,ProxyOverride = <local>

uURLSearchHooks: H - No File

mWinlogon: Userinit=userinit.exe,

BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

BHO: AOL Toolbar Loader: {3ef64538-8b54-4573-b48f-4d34b0238ab2} - C:\Program Files (x86)\AOL Toolbar\aoltb.dll

BHO: Windows Live ID Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

BHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll

BHO: Skype Browser Helper: {ae805869-2e5c-4ed4-8f7b-f1f7851a4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll

BHO: McAfee SiteAdvisor BHO: {b164e929-a1b6-4a06-b104-2cd0e90a88ff} - c:\PROGRA~2\mcafee\SITEAD~1\mcieplg.dll

BHO: Price Check by AOL: {d25b97e9-62b2-40ce-becf-e43a7b879072} - C:\Program Files (x86)\Price Check by AOL\aolpricecheck.dll

BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll

BHO: TOSHIBA Media Controller Plug-in: {f3c88694-effa-4d78-b409-54b7b2535b14} - C:\Program Files (x86)\TOSHIBA\TOSHIBA Media Controller Plug-in\TOSHIBAMediaControllerIE.dll

BHO: Yontoo: {fd72061e-9fde-484d-a58a-0bab4151cad8} - C:\Program Files (x86)\Yontoo\YontooIEClient.dll

TB: McAfee SiteAdvisor Toolbar: {0ebbbe48-bad4-4b4c-8e5a-516abecae064} - c:\PROGRA~2\mcafee\SITEAD~1\mcieplg.dll

TB: AOL Toolbar: {ba00b7b1-0351-477a-b948-23e3ee5a73d4} - C:\Program Files (x86)\AOL Toolbar\aoltb.dll

TB: Google Toolbar: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll

TB: {687578B9-7132-4A7A-80E4-30EE31099E03} - No File

TB: {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - No File

uRun: [swg] "C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"

uRun: [skype] "C:\Program Files (x86)\Skype\Phone\Skype.exe" /minimized /regrun

uRun: [EA Core] "C:\Program Files (x86)\Electronic Arts\EADM\Core.exe" -silent

uRun: [Facebook Update] "C:\Users\Sammerz93\AppData\Local\Facebook\Update\FacebookUpdate.exe" /c /nocrashserver

uRun: [RESTART_STICKY_NOTES] C:\Windows\System32\StikyNot.exe

mRun: [ToshibaServiceStation] "C:\Program Files (x86)\TOSHIBA\TOSHIBA Service Station\ToshibaServiceStation.exe" /hide:60

mRun: [NortonOnlineBackupReminder] "C:\Program Files (x86)\Toshiba\Toshiba Online Backup\Activation\TOBuActivation.exe" UNATTENDED

mRun: [ToshibaAppPlace] "C:\Program Files (x86)\Toshiba\Toshiba App Place\ToshibaAppPlace.exe"

mRun: [APSDaemon] "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe"

mRun: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime

mRun: [Malwarebytes' Anti-Malware] "C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe" /starttray

mRun: [PC Cleaners] "C:\Program Files (x86)\PC Cleaners\PCCleaners.exe" /minimize

StartupFolder: C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\Startup\MCAFEE~1.LNK - C:\Program Files (x86)\McAfee Security Scan\3.0.207\SSScheduler.exe

mPolicies-explorer: NoActiveDesktop = 1 (0x1)

mPolicies-explorer: NoActiveDesktopChanges = 1 (0x1)

mPolicies-system: ConsentPromptBehaviorAdmin = 5 (0x5)

mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3)

mPolicies-system: EnableUIADesktopToggle = 0 (0x0)

IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll

IE: {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll

LSP: mswsock.dll

DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_25-windows-i586.cab

DPF: {CAFEEFAC-0016-0000-0025-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_25-windows-i586.cab

DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_25-windows-i586.cab

TCP: DhcpNameServer = 66.253.230.60 66.253.230.210 68.234.128.70

TCP: Interfaces\{67B01EF4-8284-4691-A4A1-F13EEBF059C8} : DhcpNameServer = 192.168.33.1 75.75.75.75 75.75.76.76

TCP: Interfaces\{67B01EF4-8284-4691-A4A1-F13EEBF059C8}\2656C6B696E6E2362633E2765756374737 : DhcpNameServer = 192.168.169.1

TCP: Interfaces\{E52C985C-1EE6-42CE-921C-B87F114D0CF5} : DhcpNameServer = 66.253.230.60 66.253.230.210 68.234.128.70

Handler: dssrequest - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\PROGRA~2\McAfee\SITEAD~1\McIEPlg.dll

Handler: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\PROGRA~2\McAfee\SITEAD~1\McIEPlg.dll

Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll

Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL

Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files (x86)\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll

BHO-X64: Adobe PDF Link Helper: {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

BHO-X64: AcroIEHelperStub - No File

BHO-X64: AOL Toolbar Loader: {3ef64538-8b54-4573-b48f-4d34b0238ab2} - C:\Program Files (x86)\AOL Toolbar\aoltb.dll

BHO-X64: AOL Toolbar Loader - No File

BHO-X64: Windows Live ID Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

BHO-X64: Google Toolbar Helper: {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll

BHO-X64: Skype Browser Helper: {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll

BHO-X64: SkypeIEPluginBHO - No File

BHO-X64: McAfee SiteAdvisor BHO: {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - c:\PROGRA~2\mcafee\SITEAD~1\mcieplg.dll

BHO-X64: Price Check by AOL: {D25B97E9-62B2-40CE-BECF-E43A7B879072} - C:\Program Files (x86)\Price Check by AOL\aolpricecheck.dll

BHO-X64: Price Check by AOL - No File

BHO-X64: Java™ Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll

BHO-X64: TOSHIBA Media Controller Plug-in: {F3C88694-EFFA-4d78-B409-54B7B2535B14} - C:\Program Files (x86)\TOSHIBA\TOSHIBA Media Controller Plug-in\TOSHIBAMediaControllerIE.dll

BHO-X64: Yontoo: {FD72061E-9FDE-484D-A58A-0BAB4151CAD8} - C:\Program Files (x86)\Yontoo\YontooIEClient.dll

BHO-X64: Yontoo Layers - No File

TB-X64: McAfee SiteAdvisor Toolbar: {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\PROGRA~2\mcafee\SITEAD~1\mcieplg.dll

TB-X64: AOL Toolbar: {ba00b7b1-0351-477a-b948-23e3ee5a73d4} - C:\Program Files (x86)\AOL Toolbar\aoltb.dll

TB-X64: Google Toolbar: {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll

TB-X64: {687578B9-7132-4A7A-80E4-30EE31099E03} - No File

TB-X64: {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - No File

mRun-x64: [ToshibaServiceStation] "C:\Program Files (x86)\TOSHIBA\TOSHIBA Service Station\ToshibaServiceStation.exe" /hide:60

mRun-x64: [NortonOnlineBackupReminder] "C:\Program Files (x86)\Toshiba\Toshiba Online Backup\Activation\TOBuActivation.exe" UNATTENDED

mRun-x64: [ToshibaAppPlace] "C:\Program Files (x86)\Toshiba\Toshiba App Place\ToshibaAppPlace.exe"

mRun-x64: [APSDaemon] "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe"

mRun-x64: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime

mRun-x64: [Malwarebytes' Anti-Malware] "C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe" /starttray

mRun-x64: [PC Cleaners] "C:\Program Files (x86)\PC Cleaners\PCCleaners.exe" /minimize

.

================= FIREFOX ===================

.

FF - ProfilePath - C:\Users\Sammerz93\AppData\Roaming\Mozilla\Firefox\Profiles\bz1g7xf7.default\

FF - prefs.js: browser.search.selectedEngine - Google

FF - prefs.js: browser.startup.homepage - hxxp://www.facebook.com/

FF - prefs.js: keyword.URL - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT3072253&SearchSource=2&q=

FF - prefs.js: network.proxy.type - 0

FF - plugin: C:\PROGRA~2\MICROS~3\Office14\NPSPWRAP.DLL

FF - plugin: C:\Program Files (x86)\Google\Update\1.3.21.115\npGoogleUpdate3.dll

FF - plugin: C:\Program Files (x86)\Java\jre6\bin\new_plugin\npdeployJava1.dll

FF - plugin: C:\Program Files (x86)\McAfee\SiteAdvisor\NPMcFFPlg32.dll

FF - plugin: c:\Program Files (x86)\Microsoft Silverlight\4.1.10329.0\npctrlui.dll

FF - plugin: C:\Program Files (x86)\Mozilla Firefox\plugins\npdnu.dll

FF - plugin: C:\Program Files (x86)\Mozilla Firefox\plugins\npdnupdater2.dll

FF - plugin: C:\Program Files (x86)\WildTangent Games\App\BrowserIntegration\Registered\0\NP_wtapp.dll

FF - plugin: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll

FF - plugin: C:\Users\Sammerz93\AppData\Local\Facebook\Video\Skype\npFacebookVideoCalling.dll

FF - plugin: C:\Users\Sammerz93\AppData\Roaming\Mozilla\Firefox\Profiles\bz1g7xf7.default\extensions\{687578b9-7132-4a7a-80e4-30ee31099e03}\plugins\np-mswmp.dll

FF - plugin: C:\windows\SysWOW64\Macromed\Flash\NPSWF32_11_4_402_265.dll

.

---- FIREFOX POLICIES ----

FF - user.js: extensions.funmoods.hmpg - true

FF - user.js: extensions.funmoods.hmpgUrl - hxxp://start.funmoods.com/?f=1&a=nv1&chnl=nv1&cd=2XzutAtN2Y1L1QzutDtDtByCyC0C0E0AzztA0B0A0AtBzy0CtN0D0TzutBtDtCtBtDyCtBzy&cr=809745180

FF - user.js: extensions.funmoods.dfltSrch - true

FF - user.js: extensions.funmoods.srchPrvdr - Search

FF - user.js: extensions.funmoods.dnsErr - true

FF - user.js: extensions.funmoods_i.newTab - true

FF - user.js: extensions.funmoods.newTabUrl - hxxp://start.funmoods.com/?f=2&a=nv1&chnl=nv1&cd=2XzutAtN2Y1L1QzutDtDtByCyC0C0E0AzztA0B0A0AtBzy0CtN0D0TzutBtDtCtBtDyCtBzy&cr=809745180

FF - user.js: extensions.funmoods.tlbrSrchUrl -

FF - user.js: extensions.funmoods.id - c881a29c00000000000000266cea83ba

FF - user.js: extensions.funmoods.instlDay - 15520

FF - user.js: extensions.funmoods.vrsn - 1.5.23.22

FF - user.js: extensions.funmoods.vrsni - 1.5.23.22

FF - user.js: extensions.funmoods_i.vrsnTs - 1.5.23.2221:45:6

FF - user.js: extensions.funmoods.prtnrId - funmoods

FF - user.js: extensions.funmoods.prdct - funmoods

FF - user.js: extensions.funmoods.aflt - nv1

FF - user.js: extensions.funmoods_i.smplGrp - none

FF - user.js: extensions.funmoods.tlbrId - base

FF - user.js: extensions.funmoods.instlRef - nv1

FF - user.js: extensions.funmoods.dfltLng -

FF - user.js: extensions.funmoods.excTlbr - false

FF - user.js: extensions.funmoods.autoRvrt - false

FF - user.js: extensions.funmoods.envrmnt - production

FF - user.js: extensions.funmoods.isdcmntcmplt - true

FF - user.js: extensions.funmoods.mntrvrsn - 1.3.0

FF - user.js: extentions.y2layers.installId - b8442a97-1e2d-4f1a-a4d1-886a76047e29

FF - user.js: extentions.y2layers.defaultEnableAppsList - twittube,ezLooker,pagerage,buzzdock,toprelatedtopics

.

FF - user.js: extensions.autoDisableScopes - 14

FF - user.js: network.protocol-handler.warn-external.dnupdate - false

FF - user.js: browser.sessionstore.resume_from_crash - false

.

============= SERVICES / DRIVERS ===============

.

R0 tos_sps64;TOSHIBA tos_sps64 Service;C:\windows\system32\DRIVERS\tos_sps64.sys --> C:\windows\system32\DRIVERS\tos_sps64.sys [?]

R1 vwififlt;Virtual WiFi Filter Driver;C:\windows\system32\DRIVERS\vwififlt.sys --> C:\windows\system32\DRIVERS\vwififlt.sys [?]

R2 cvhsvc;Client Virtualization Handler;C:\Program Files (x86)\Common Files\microsoft shared\Virtualization Handler\CVHSVC.EXE [2012-1-4 822624]

R2 MBAMService;MBAMService;C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2012-8-31 655944]

R2 McAfee SiteAdvisor Service;McAfee SiteAdvisor Service;C:\PROGRA~2\mcafee\SITEAD~1\mcsacore.exe [2012-6-12 103440]

R2 PCCUJobMgr;Common Client Job Manager Service;C:\Program Files (x86)\Norton PC Checkup\Engine\2.0.13.11\ccSvcHst.exe [2011-12-14 126392]

R2 sftlist;Application Virtualization Client;C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe [2011-10-1 508776]

R2 UNS;Intel® Management and Security Application User Notification Service;C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe [2011-12-14 2656280]

R3 FwLnk;FwLnk Driver;C:\windows\system32\DRIVERS\FwLnk.sys --> C:\windows\system32\DRIVERS\FwLnk.sys [?]

R3 L1C;NDIS Miniport Driver for Atheros AR813x/AR815x PCI-E Ethernet Controller;C:\windows\system32\DRIVERS\L1C62x64.sys --> C:\windows\system32\DRIVERS\L1C62x64.sys [?]

R3 MBAMProtector;MBAMProtector;\??\C:\windows\system32\drivers\mbam.sys --> C:\windows\system32\drivers\mbam.sys [?]

R3 McComponentHostService;McAfee Security Scan Component Host Service;C:\Program Files (x86)\McAfee Security Scan\3.0.207\McCHSvc.exe [2011-6-17 237008]

R3 MEIx64;Intel® Management Engine Interface;C:\windows\system32\DRIVERS\HECIx64.sys --> C:\windows\system32\DRIVERS\HECIx64.sys [?]

R3 PGEffect;Pangu effect driver;C:\windows\system32\DRIVERS\pgeffect.sys --> C:\windows\system32\DRIVERS\pgeffect.sys [?]

R3 RTL8192Ce;Realtek Wireless LAN 802.11n PCI-E NIC Driver;C:\windows\system32\DRIVERS\rtl8192Ce.sys --> C:\windows\system32\DRIVERS\rtl8192Ce.sys [?]

R3 Sftfs;Sftfs;C:\windows\system32\DRIVERS\Sftfslh.sys --> C:\windows\system32\DRIVERS\Sftfslh.sys [?]

R3 Sftplay;Sftplay;C:\windows\system32\DRIVERS\Sftplaylh.sys --> C:\windows\system32\DRIVERS\Sftplaylh.sys [?]

R3 Sftredir;Sftredir;C:\windows\system32\DRIVERS\Sftredirlh.sys --> C:\windows\system32\DRIVERS\Sftredirlh.sys [?]

R3 Sftvol;Sftvol;C:\windows\system32\DRIVERS\Sftvollh.sys --> C:\windows\system32\DRIVERS\Sftvollh.sys [?]

R3 sftvsa;Application Virtualization Service Agent;C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe [2011-10-1 219496]

R3 TMachInfo;TMachInfo;C:\Program Files (x86)\TOSHIBA\TOSHIBA Service Station\TMachInfo.exe [2011-12-14 57216]

R3 TOSHIBA HDD SSD Alert Service;TOSHIBA HDD SSD Alert Service;C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSmartSrv.exe [2011-6-9 138152]

R3 vwifimp;Microsoft Virtual WiFi Miniport Service;C:\windows\system32\DRIVERS\vwifimp.sys --> C:\windows\system32\DRIVERS\vwifimp.sys [?]

S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]

S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-3-18 138576]

S2 gupdate;Google Update Service (gupdate);C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2011-12-14 136176]

S2 SkypeUpdate;Skype Updater;C:\Program Files (x86)\Skype\Updater\Updater.exe [2012-7-3 160944]

S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-4-20 250568]

S3 EraserUtilDrv11210;EraserUtilDrv11210;C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilDrv11210.sys [2012-8-15 138912]

S3 EraserUtilDrv11220;EraserUtilDrv11220;C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilDrv11220.sys [2012-8-29 138912]

S3 EraserUtilRebootDrv;EraserUtilRebootDrv;C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [2012-2-15 138360]

S3 GamesAppService;GamesAppService;C:\Program Files (x86)\WildTangent Games\App\GamesAppService.exe [2010-10-12 206072]

S3 gupdatem;Google Update Service (gupdatem);C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2011-12-14 136176]

S3 MozillaMaintenance;Mozilla Maintenance Service;C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe [2012-5-15 113120]

S3 osppsvc;Office Software Protection Platform;C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-1-9 4925184]

S3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;C:\windows\system32\Drivers\RtsUStor.sys --> C:\windows\system32\Drivers\RtsUStor.sys [?]

S3 TsUsbFlt;TsUsbFlt;C:\windows\system32\drivers\tsusbflt.sys --> C:\windows\system32\drivers\tsusbflt.sys [?]

S3 TsUsbGD;Remote Desktop Generic USB Device;C:\windows\system32\drivers\TsUsbGD.sys --> C:\windows\system32\drivers\TsUsbGD.sys [?]

S3 WatAdminSvc;Windows Activation Technologies Service;C:\windows\system32\Wat\WatAdminSvc.exe --> C:\windows\system32\Wat\WatAdminSvc.exe [?]

S4 wlcrasvc;Windows Live Mesh remote connections service;C:\Program Files\Windows Live\Mesh\wlcrasvc.exe [2010-9-22 57184]

.

=============== Created Last 30 ================

.

2012-09-04 21:15:36 -------- d-----w- C:\Users\Sammerz93\AppData\Local\Microsoft Games

2012-08-31 19:35:50 -------- d-----w- C:\Users\Sammerz93\AppData\Roaming\PCPro

2012-08-31 19:35:50 -------- d-----w- C:\Users\Sammerz93\AppData\Roaming\PC Cleaners

2012-08-31 19:35:49 4269368 ----a-w- C:\windows\uninst.exe

2012-08-31 19:35:49 -------- d-----w- C:\ProgramData\PC1Data

2012-08-31 19:35:49 -------- d-----w- C:\Program Files (x86)\PC Cleaners

2012-08-31 15:13:16 -------- d-----w- C:\Users\Sammerz93\AppData\Roaming\Malwarebytes

2012-08-31 15:13:03 24904 ----a-w- C:\windows\System32\drivers\mbam.sys

2012-08-31 15:13:03 -------- d-----w- C:\ProgramData\Malwarebytes

2012-08-31 15:13:03 -------- d-----w- C:\Program Files (x86)\Malwarebytes' Anti-Malware

2012-08-30 20:27:27 -------- d-----w- C:\Users\Sammerz93\AppData\Local\ElevatedDiagnostics

2012-08-30 04:29:57 -------- d-----w- C:\Users\Sammerz93\AppData\Local\Chromium

2012-08-26 19:43:20 -------- d-----w- C:\Users\Sammerz93\AppData\Local\NPE

2012-08-26 19:19:56 27256 ----a-w- C:\windows\System32\drivers\FixZeroAccess.sys

2012-08-21 04:15:57 -------- d-----w- C:\Users\Sammerz93\AppData\Roaming\Stellarium

2012-08-21 04:15:35 -------- d-----w- C:\Program Files (x86)\Stellarium

2012-08-15 19:18:23 -------- d-----w- C:\Program Files\STOPzilla!

2012-08-10 01:04:27 -------- d-----w- C:\Users\Sammerz93\AppData\Local\Price Check by AOL

2012-08-10 01:04:23 -------- d-----w- C:\Users\Sammerz93\AppData\Local\AOL Toolbar

2012-08-09 09:50:55 -------- d-sh--w- C:\windows\SysWow64\%APPDATA%

2012-08-09 05:40:54 -------- d-----w- C:\Users\Sammerz93\.swt

2012-08-09 05:38:48 -------- d-----w- C:\Program Files (x86)\Vuze

2012-08-09 05:36:18 -------- d-----w- C:\ProgramData\Price Check by AOL

2012-08-09 05:36:18 -------- d-----w- C:\Program Files (x86)\Price Check by AOL

2012-08-09 05:36:05 -------- d-----w- C:\ProgramData\AOL Toolbar

2012-08-09 05:36:05 -------- d-----w- C:\Program Files (x86)\AOL Toolbar

2012-08-09 05:35:54 -------- d-----w- C:\Program Files (x86)\Common Files\Software Update Utility

2012-08-09 05:35:23 -------- d-----w- C:\Program Files (x86)\BTJunkie Downloader

2012-08-07 18:03:24 9133488 ----a-w- C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{ADD98A8B-EA42-4692-85A8-1011C7B6343A}\mpengine.dll

.

==================== Find3M ====================

.

2012-08-23 20:08:05 73416 ----a-w- C:\windows\SysWow64\FlashPlayerCPLApp.cpl

2012-08-23 20:08:05 696520 ----a-w- C:\windows\SysWow64\FlashPlayerApp.exe

2012-06-12 03:08:36 3148800 ----a-w- C:\windows\System32\win32k.sys

.

============= FINISH: 1:23:28.60 ===============

Attach.zip

Maniac · September 5, 2012

Hello Sammerz93 and :welcome: ! My name is Maniac and I will be glad to help you solve your malware problem.

Please note:

If you are a paying customer, you have the privilege to contact the help desk at Consumer Support. If you choose this option to get help, please let me know.
I recommend you to keep the instructions I will be giving you so that they are available to you at any time. You can save them in a text file or print them.
Make sure you read all of the instructions and fixes thoroughly before continuing with them.
Follow my instructions strictly and don’t hesitate to stop and ask me if you have any questions.
Post your log files, don't attach them. Every log file should be copy/pasted in your next reply.

Step 1

Launch Malwarebytes' Anti-Malware
Go to Update tab and select Check for Updates. If an update is found, it will download and install the latest version.
Go to Scanner tab and select Perform Quick Scan, then click Scan.
The scan may take some time to finish,so please be patient.
When the scan is complete, click OK, then Show Results to view the results.
Make sure that everything is checked, and click Remove Selected.
When disinfection is completed, a log will open in Notepad and you may be prompted to Restart. (See Extra Note)
The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
Copy&Paste the entire report in your next reply.

Extra Note: If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts, click OK to either and let MBAM proceed with the disinfection process, if asked to restart the computer,please do so immediately.

Step 2

Download aswMBR.exe to your desktop.

Double click the aswMBR.exe to run it

Click the "Scan" button to start scan

On completion of the scan click save log, save it to your desktop and post in your next reply

Step 3

Please download AdwCleaner from here and save it on your Desktop.

Right-click on adwcleaner.exe and select Run As Administrator to launch the application.
Now click on the Search tab.
Please post the contents of the log-file created in your next post.

Note: The log can also be located at C:\ >> AdwCleaner[XX].txt >> XX <-- Denotes the number of times the application has been ran, so in this should be something like R1.

Step 4

Please download Farbar Service Scanner and run it on the computer with the issue.

Make sure the following options are checked:
- Internet Services
- Windows Firewall
- System Restore
- Security Center
- Windows Update
[*]Press "Scan".
[*]It will create a log (FSS.txt) in the same directory the tool is run.
[*]Please copy and paste the log to your reply.

In your next reply, post the following log files:

Malwarebytes' Anti-Malware log
aswMBR log
AdwCleaner
Farbar Service Scanner log
a new fresh DDS log

Sammerz93 · September 7, 2012

Thank you for taking the time to help me! Here is everything you've asked for (:

Run date: 2012-09-07 14:26:38

-----------------------------

14:26:38.233 OS Version: Windows x64 6.1.7601 Service Pack 1

14:26:38.234 Number of processors: 2 586 0x2A07

14:26:38.235 ComputerName: SAMMERZ93-PC UserName: Sammerz93

14:26:40.067 Initialize success

14:27:51.103 AVAST engine defs: 12090701

14:28:07.552 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1

14:28:07.554 Disk 0 Vendor: TOSHIBA_ GT00 Size: 305245MB BusType: 3

14:28:07.562 Disk 0 MBR read successfully

14:28:07.564 Disk 0 MBR scan

14:28:07.568 Disk 0 Windows VISTA default MBR code

14:28:07.576 Disk 0 Partition 1 80 (A) 27 Hidden NTFS WinRE NTFS 1500 MB offset 2048

14:28:07.592 Disk 0 Partition 2 00 07 HPFS/NTFS NTFS 289747 MB offset 3074048

14:28:07.625 Disk 0 Partition 3 00 17 Hidd HPFS/NTFS NTFS 13997 MB offset 596475904

14:28:07.761 Disk 0 scanning C:\windows\system32\drivers

14:28:22.949 Service scanning

14:29:17.458 Modules scanning

14:29:17.464 Disk 0 trace - called modules:

14:29:17.495 ntoskrnl.exe CLASSPNP.SYS disk.sys iaStor.sys

14:29:17.850 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0xfffffa80067b1060]

14:29:17.854 3 CLASSPNP.SYS[fffff8800176343f] -> nt!IofCallDriver -> \Device\Ide\IAAStorageDevice-1[0xfffffa8004dc6050]

14:29:22.749 AVAST engine scan C:\windows

14:29:25.204 AVAST engine scan C:\windows\system32

14:31:14.404 File: C:\windows\system32\services.exe **INFECTED** Win32:Sirefef-ZT [Trj]

14:31:47.596 File: C:\windows\assembly\GAC_32\Desktop.ini **INFECTED** Win32:Sirefef-PL [Rtk]

14:31:49.802 File: C:\windows\assembly\GAC_64\Desktop.ini **INFECTED** Win32:Sirefef-PL [Rtk]

14:33:36.919 AVAST engine scan C:\windows\system32\drivers

14:33:45.907 AVAST engine scan C:\Users\Sammerz93

14:39:46.600 AVAST engine scan C:\ProgramData

14:40:55.019 Scan finished successfully

14:41:40.992 Disk 0 MBR has been saved successfully to "C:\Users\Sammerz93\Desktop\MBR.dat"

14:41:40.997 The log file has been saved successfully to "C:\Users\Sammerz93\Desktop\aswMBR.txt"

# AdwCleaner v2.000 - Logfile created 09/07/2012 at 14:42:25

# Updated 30/08/2012 by Xplode

# Operating system : Windows 7 Home Premium Service Pack 1 (64 bits)

# User : Sammerz93 - SAMMERZ93-PC

# Boot Mode : Normal

# Running from : C:\Users\Sammerz93\Downloads\adwcleaner.exe

# Option [search]

***** [services] *****

***** [Files / Folders] *****

File Found : C:\Program Files (x86)\Mozilla Firefox\plugins\npdnu.dll

File Found : C:\Program Files (x86)\Mozilla Firefox\plugins\npdnu.xpt

File Found : C:\Program Files (x86)\Mozilla Firefox\plugins\npdnupdater2.dll

File Found : C:\Program Files (x86)\Mozilla Firefox\plugins\npdnupdater2.xpt

File Found : C:\Users\Sammerz93\AppData\Local\funmoods-speeddial.crx

Folder Found : C:\Program Files (x86)\Common Files\Software Update Utility

Folder Found : C:\Program Files (x86)\Conduit

Folder Found : C:\Program Files (x86)\Yontoo

Folder Found : C:\ProgramData\Tarma Installer

Folder Found : C:\Users\SAMMER~1\AppData\Local\Temp\boost_interprocess

Folder Found : C:\Users\SAMMER~1\AppData\Local\Temp\CT2504091

Folder Found : C:\Users\SAMMER~1\AppData\Local\Temp\CT3072253

Folder Found : C:\Users\Sammerz93\AppData\Local\Conduit

Folder Found : C:\Users\Sammerz93\AppData\LocalLow\Conduit

Folder Found : C:\Users\Sammerz93\AppData\Roaming\Mozilla\Firefox\Profiles\bz1g7xf7.default\ConduitCommon

Folder Found : C:\Users\Sammerz93\AppData\Roaming\Mozilla\Firefox\Profiles\bz1g7xf7.default\CT2504091

Folder Found : C:\Users\Sammerz93\AppData\Roaming\Mozilla\Firefox\Profiles\bz1g7xf7.default\CT3072253

Folder Found : C:\Users\Sammerz93\AppData\Roaming\Mozilla\Firefox\Profiles\bz1g7xf7.default\extensions\{687578b9-7132-4a7a-80e4-30ee31099e03}

Folder Found : C:\Users\Sammerz93\AppData\Roaming\Mozilla\Firefox\Profiles\bz1g7xf7.default\extensions\{ba14329e-9550-4989-b3f2-9732e92d17cc}

Folder Found : C:\Users\Sammerz93\AppData\Roaming\Mozilla\Firefox\Profiles\bz1g7xf7.default\extensions\plugin@yontoo.com

Folder Found : C:\Users\Sammerz93\AppData\Roaming\Mozilla\Firefox\Profiles\bz1g7xf7.default\Smartbar

***** [Registry] *****

Key Found : HKCU\Software\AppDataLow\Software\Conduit

Key Found : HKCU\Software\AppDataLow\Software\SmartBar

Key Found : HKCU\Software\Conduit

Key Found : HKCU\Software\Google\Chrome\Extensions\cjpglkicenollcignonpgiafdgfeehoj

Key Found : HKCU\Software\Google\Chrome\Extensions\fdloijijlkoblmigdofommgnheckmaki

Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{FD72061E-9FDE-484D-A58A-0BAB4151CAD8}

Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{DF7770F7-832F-4BDF-B144-100EDDD0C3AE}

Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{FD72061E-9FDE-484D-A58A-0BAB4151CAD8}

Key Found : HKCU\Software\Softonic

Key Found : HKCU\Software\SweetIm

Key Found : HKLM\SOFTWARE\Classes\AppID\{09C554C3-109B-483C-A06B-F14172F1A947}

Key Found : HKLM\SOFTWARE\Classes\AppID\{4E1E9D45-8BF9-4139-915C-9F83CC3D5921}

Key Found : HKLM\SOFTWARE\Classes\AppID\{608D3067-77E8-463D-9084-908966806826}

Key Found : HKLM\SOFTWARE\Classes\AppID\{6C259840-5BA8-46E6-8ED1-EF3BA47D8BA1}

Key Found : HKLM\SOFTWARE\Classes\AppID\{B12E99ED-69BD-437C-86BE-C862B9E5444D}

Key Found : HKLM\SOFTWARE\Classes\AppID\{B27D9527-3762-4D71-963D-FB7A94FDD678}

Key Found : HKLM\SOFTWARE\Classes\AppID\{BDB69379-802F-4EAF-B541-F8DE92DD98DB}

Key Found : HKLM\SOFTWARE\Classes\AppID\{CFDAFE39-20CE-451D-BD45-A37452F39CF0}

Key Found : HKLM\SOFTWARE\Classes\AppID\{D7EE8177-D51E-4F89-92B6-83EA2EC40800}

Key Found : HKLM\SOFTWARE\Classes\AppID\{EA28B360-05E0-4F93-8150-02891F1D8D3C}

Key Found : HKLM\SOFTWARE\Classes\AppID\dnu.EXE

Key Found : HKLM\SOFTWARE\Classes\AppID\escort.DLL

Key Found : HKLM\SOFTWARE\Classes\AppID\escortApp.DLL

Key Found : HKLM\SOFTWARE\Classes\AppID\escortEng.DLL

Key Found : HKLM\SOFTWARE\Classes\AppID\escorTlbr.DLL

Key Found : HKLM\SOFTWARE\Classes\AppID\YontooIEClient.DLL

Key Found : HKLM\SOFTWARE\Classes\dnUpdate

Key Found : HKLM\SOFTWARE\Classes\dnUpdater.DownloadUIBrowser

Key Found : HKLM\SOFTWARE\Classes\dnUpdater.DownloadUIBrowser.1

Key Found : HKLM\SOFTWARE\Classes\dnUpdater.DownloadUpdController

Key Found : HKLM\SOFTWARE\Classes\dnUpdater.DownloadUpdController.1

Key Found : HKLM\SOFTWARE\Classes\Toolbar.CT2504091

Key Found : HKLM\SOFTWARE\Classes\Toolbar.CT3072253

Key Found : HKLM\SOFTWARE\Classes\TypeLib\{92380354-381A-471F-BE2E-DD9ACD9777EA}

Key Found : HKLM\SOFTWARE\Classes\TypeLib\{D372567D-67C1-4B29-B3F0-159B52B3E967}

Key Found : HKLM\SOFTWARE\Classes\YontooIEClient.Api

Key Found : HKLM\SOFTWARE\Classes\YontooIEClient.Api.1

Key Found : HKLM\SOFTWARE\Classes\YontooIEClient.Layers

Key Found : HKLM\SOFTWARE\Classes\YontooIEClient.Layers.1

Key Found : HKLM\Software\Conduit

Key Found : HKLM\Software\Iminent

Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{7B089B94-D1DC-4C6B-87E1-8156E22C1D96}

Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{DF7770F7-832F-4BDF-B144-100EDDD0C3AE}

Key Found : HKLM\Software\SweetIm

Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{10DE7085-6A1E-4D41-A7BF-9AF93E351401}

Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{7B089B94-D1DC-4C6B-87E1-8156E22C1D96}

Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{7E84186E-B5DE-4226-8A66-6E49C6B511B4}

Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{80922EE0-8A76-46AE-95D5-BD3C3FE0708D}

Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{99066096-8989-4612-841F-621A01D54AD7}

Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{DF7770F7-832F-4BDF-B144-100EDDD0C3AE}

Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{E15A9BFD-D16D-496D-8222-44CADF316E70}

Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{FD72061E-9FDE-484D-A58A-0BAB4151CAD8}

Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{FE9271F2-6EFD-44B0-A826-84C829536E93}

Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{10DE7085-6A1E-4D41-A7BF-9AF93E351401}

Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{1AD27395-1659-4DFF-A319-2CFA243861A5}

Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{23C70BCA-6E23-4A65-AD2E-1389062074F1}

Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{23D8EEF7-0E13-4000-B9C4-6603C1E912D1}

Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{295CACB4-51F5-46FD-914E-C72BAAE1B672}

Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{2CE5C4B9-6DBE-4528-96FA-C9FF38EF1762}

Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{34C1FDF7-02C1-4F23-B393-F48B16E071D1}

Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{54291324-7A3D-4F11-B707-3FB6A2C97BD9}

Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{59C63F11-D4E5-46E7-9B8A-EE158DCA83A8}

Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{5DA22CBD-0029-4A09-B757-CF0FAFC488ED}

Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{660E6F4F-840D-436D-B668-433D9591BAC5}

Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{77A6E7D4-4A83-4A9B-A2A0-EF3B125DC29D}

Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{C0585B2F-74D7-4734-88DE-6C150C5D4036}

Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{D8242E89-2F81-484A-AE5B-BA8CAD5B7347}

Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{E7435878-65B9-44D1-A443-81754E5DFC90}

Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{EF0588D6-1621-4A75-B8BE-F4BC34794136}

Key Found : HKLM\SOFTWARE\Wow6432Node\Google\Chrome\Extensions\cjpglkicenollcignonpgiafdgfeehoj

Key Found : HKLM\SOFTWARE\Wow6432Node\Google\Chrome\Extensions\niapdbllcanepiiimjjndipklodoedlc

Key Found : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{FD72061E-9FDE-484D-A58A-0BAB4151CAD8}

Key Found : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{889DF117-14D1-44EE-9F31-C5FB5D47F68B}

Key Found : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\facemoods

Key Found : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\SoftwareUpdUtility

Key Found : HKLM\SOFTWARE\Classes\Interface\{0D80F1C5-D17B-4177-AC68-955F3EF9F191}

Key Found : HKLM\SOFTWARE\Classes\Interface\{10DE7085-6A1E-4D41-A7BF-9AF93E351401}

Key Found : HKLM\SOFTWARE\Classes\Interface\{1AD27395-1659-4DFF-A319-2CFA243861A5}

Key Found : HKLM\SOFTWARE\Classes\Interface\{23C70BCA-6E23-4A65-AD2E-1389062074F1}

Key Found : HKLM\SOFTWARE\Classes\Interface\{23D8EEF7-0E13-4000-B9C4-6603C1E912D1}

Key Found : HKLM\SOFTWARE\Classes\Interface\{295CACB4-51F5-46FD-914E-C72BAAE1B672}

Key Found : HKLM\SOFTWARE\Classes\Interface\{2CE5C4B9-6DBE-4528-96FA-C9FF38EF1762}

Key Found : HKLM\SOFTWARE\Classes\Interface\{34C1FDF7-02C1-4F23-B393-F48B16E071D1}

Key Found : HKLM\SOFTWARE\Classes\Interface\{54291324-7A3D-4F11-B707-3FB6A2C97BD9}

Key Found : HKLM\SOFTWARE\Classes\Interface\{59C63F11-D4E5-46E7-9B8A-EE158DCA83A8}

Key Found : HKLM\SOFTWARE\Classes\Interface\{5DA22CBD-0029-4A09-B757-CF0FAFC488ED}

Key Found : HKLM\SOFTWARE\Classes\Interface\{660E6F4F-840D-436D-B668-433D9591BAC5}

Key Found : HKLM\SOFTWARE\Classes\Interface\{77A6E7D4-4A83-4A9B-A2A0-EF3B125DC29D}

Key Found : HKLM\SOFTWARE\Classes\Interface\{C0585B2F-74D7-4734-88DE-6C150C5D4036}

Key Found : HKLM\SOFTWARE\Classes\Interface\{D8242E89-2F81-484A-AE5B-BA8CAD5B7347}

Key Found : HKLM\SOFTWARE\Classes\Interface\{E7435878-65B9-44D1-A443-81754E5DFC90}

Key Found : HKLM\SOFTWARE\Classes\Interface\{EF0588D6-1621-4A75-B8BE-F4BC34794136}

Key Found : HKLM\SOFTWARE\Google\Chrome\Extensions\cjpglkicenollcignonpgiafdgfeehoj

Key Found : HKLM\SOFTWARE\Google\Chrome\Extensions\fdloijijlkoblmigdofommgnheckmaki

Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{889DF117-14D1-44EE-9F31-C5FB5D47F68B}

Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\facemoods

Key Found : HKLM\SOFTWARE\Software

Key Found : HKLM\SOFTWARE\Tarma Installer

***** [internet Browsers] *****

-\\ Internet Explorer v9.0.8112.16421

[HKLM\SOFTWARE\Microsoft\Internet Explorer\Main - Start Page] = hxxp://start.funmoods.com/?f=1&a=nv1&chnl=nv1&cd=2XzutAtN2Y1L1QzutDtDtByCyC0C0E0AzztA0B0A0AtBzy0CtN0D0TzutBtDtCtBtDyCtBzy&cr=809745180

-\\ Mozilla Firefox v13.0.1 (en-US)

Profile name : default

File : C:\Users\Sammerz93\AppData\Roaming\Mozilla\Firefox\Profiles\bz1g7xf7.default\prefs.js

Found : user_pref("CT2504091.ENABALE_HISTORY", "{\"dataType\":\"string\",\"data\":\"true\"}");

Found : user_pref("CT2504091.ENABLE_RETURN_WEB_SEARCH_ON_THE_PAGE", "{\"dataType\":\"string\",\"data\":\"tru[...]

Found : user_pref("CT2504091.FirstTime", "true");

Found : user_pref("CT2504091.FirstTimeFF3", "true");

Found : user_pref("CT2504091.UserID", "UN69545093034620614");

Found : user_pref("CT2504091.addressBarTakeOverEnabledInHidden", "true");

Found : user_pref("CT2504091.autoDisableScopes", 14);

Found : user_pref("CT2504091.cbcountry_001", "US");

Found : user_pref("CT2504091.cbfirsttime", "Thu Aug 09 2012 00:39:06 GMT-0500 (Central Daylight Time)");

Found : user_pref("CT2504091.defaultSearch", "false");

Found : user_pref("CT2504091.embeddedsData", "[{\"appId\":\"129079840422026594\",\"apiPermissions\":{\"cross[...]

Found : user_pref("CT2504091.enableAlerts", "false");

Found : user_pref("CT2504091.enableSearchFromAddressBar", "true");

Found : user_pref("CT2504091.firstTimeDialogOpened", "true");

Found : user_pref("CT2504091.fixPageNotFoundError", "true");

Found : user_pref("CT2504091.fixPageNotFoundErrorInHidden", "true");

Found : user_pref("CT2504091.fixUrls", true);

Found : user_pref("CT2504091.installId", "ConduitNSISIntegration");

Found : user_pref("CT2504091.installType", "ConduitNSISIntegration");

Found : user_pref("CT2504091.isEnableAllDialogs", "{\"dataType\":\"string\",\"data\":\"true\"}");

Found : user_pref("CT2504091.isNewTabEnabled", true);

Found : user_pref("CT2504091.isPerformedSmartBarTransition", "true");

Found : user_pref("CT2504091.isToolbarShrinked", "{\"dataType\":\"string\",\"data\":\"false\"}");

Found : user_pref("CT2504091.navigationAliasesJson", "{\"EB_SEARCH_TERM\":\"\",\"EB_MAIN_FRAME_URL\":\"about[...]

Found : user_pref("CT2504091.openThankYouPage", "false");

Found : user_pref("CT2504091.openUninstallPage", "false");

Found : user_pref("CT2504091.search.searchAppId", "129079840422026594");

Found : user_pref("CT2504091.search.searchCount", "0");

Found : user_pref("CT2504091.searchInNewTabEnabledInHidden", "true");

Found : user_pref("CT2504091.searchProtector.notifyChanges", "{\"dataType\":\"string\",\"data\":\"true\"}");

Found : user_pref("CT2504091.selectToSearchBoxEnabled", "{\"dataType\":\"string\",\"data\":\"true\"}");

Found : user_pref("CT2504091.serviceLayer_service_login_isFirstLoginInvoked", "{\"dataType\":\"boolean\",\"d[...]

Found : user_pref("CT2504091.serviceLayer_service_login_loginCount", "{\"dataType\":\"number\",\"data\":\"2\[...]

Found : user_pref("CT2504091.serviceLayer_service_toolbarGrouping_activeCTID", "{\"dataType\":\"string\",\"d[...]

Found : user_pref("CT2504091.serviceLayer_service_toolbarGrouping_activeDownloadUrl", "{\"dataType\":\"strin[...]

Found : user_pref("CT2504091.serviceLayer_service_toolbarGrouping_activeToolbarName", "{\"dataType\":\"strin[...]

Found : user_pref("CT2504091.serviceLayer_service_toolbarGrouping_invoked", "{\"dataType\":\"string\",\"data[...]

Found : user_pref("CT2504091.serviceLayer_service_usage_toolbarUsageCount", "{\"dataType\":\"number\",\"data[...]

Found : user_pref("CT2504091.serviceLayer_services_appTrackingFirstTime_lastUpdate", "1344490743499");

Found : user_pref("CT2504091.serviceLayer_services_appTracking_lastUpdate", "1344490745667");

Found : user_pref("CT2504091.serviceLayer_services_appsMetadata_lastUpdate", "1344490743299");

Found : user_pref("CT2504091.serviceLayer_services_gottenAppsContextMenu_lastUpdate", "1344490745377");

Found : user_pref("CT2504091.serviceLayer_services_login_10.10.20.14_lastUpdate", "1344490744426");

Found : user_pref("CT2504091.serviceLayer_services_optimizer_lastUpdate", "1344490744120");

Found : user_pref("CT2504091.serviceLayer_services_otherAppsContextMenu_lastUpdate", "1344490746879");

Found : user_pref("CT2504091.serviceLayer_services_searchAPI_lastUpdate", "1344490743139");

Found : user_pref("CT2504091.serviceLayer_services_serviceMap_lastUpdate", "1344490742822");

Found : user_pref("CT2504091.serviceLayer_services_toolbarContextMenu_lastUpdate", "1344490744325");

Found : user_pref("CT2504091.serviceLayer_services_toolbarSettings_lastUpdate", "1344490742966");

Found : user_pref("CT2504091.serviceLayer_services_translation_lastUpdate", "1344490743307");

Found : user_pref("CT2504091.settingsINI", true);

Found : user_pref("CT2504091.shouldFirstTimeDialog", "false");

Found : user_pref("CT2504091.smartbar.CTID", "CT2504091");

Found : user_pref("CT2504091.smartbar.Uninstall", "0");

Found : user_pref("CT2504091.smartbar.toolbarName", "Vuze Remote ");

Found : user_pref("CT2504091.startPage", "false");

Found : user_pref("CT2504091.toolbarBornServerTime", "9-8-2012");

Found : user_pref("CT2504091.toolbarCurrentServerTime", "9-8-2012");

Found : user_pref("CT2504091.toolbarDisabled", "true");

Found : user_pref("CT3072253..clientLogIsEnabled", false);

Found : user_pref("CT3072253..clientLogServiceUrl", "hxxp://clientlog.users.conduit.com/ClientDiagnostics.as[...]

Found : user_pref("CT3072253..uninstallLogServiceUrl", "hxxp://uninstall.users.conduit.com/Uninstall.asmx/Re[...]

Found : user_pref("CT3072253.ALLOW_SHOWING_HIDDEN_TOOLBAR", false);

Found : user_pref("CT3072253.AboutPrivacyUrl", "hxxp://www.conduit.com/privacy/Default.aspx");

Found : user_pref("CT3072253.BrowserCompStateIsOpen_129573915102477663", true);

Found : user_pref("CT3072253.BrowserCompStateIsOpen_129749445881800338", true);

Found : user_pref("CT3072253.BrowserCompStateIsOpen_129805375651312503", true);

Found : user_pref("CT3072253.CTID", "CT3072253");

Found : user_pref("CT3072253.CurrentServerDate", "7-9-2012");

Found : user_pref("CT3072253.DSInstall", false);

Found : user_pref("CT3072253.DialogsAlignMode", "LTR");

Found : user_pref("CT3072253.DialogsGetterLastCheckTime", "Tue Sep 04 2012 18:18:19 GMT-0500 (Central Daylig[...]

Found : user_pref("CT3072253.DownloadReferralCookieData", "");

Found : user_pref("CT3072253.FirstServerDate", "26-6-2012");

Found : user_pref("CT3072253.FirstTime", true);

Found : user_pref("CT3072253.FirstTimeFF3", true);

Found : user_pref("CT3072253.FirstTimeHiddenVer", true);

Found : user_pref("CT3072253.FixPageNotFoundErrors", true);

Found : user_pref("CT3072253.GroupingServerCheckInterval", 1440);

Found : user_pref("CT3072253.GroupingServiceUrl", "hxxp://grouping.services.conduit.com/");

Found : user_pref("CT3072253.HPInstall", false);

Found : user_pref("CT3072253.HasUserGlobalKeys", true);

Found : user_pref("CT3072253.HomePageProtectorEnabled", false);

Found : user_pref("CT3072253.HomepageBeforeUnload", "hxxp://start.funmoods.com/?f=1&a=nv1&chnl=nv1&cd=2XzutA[...]

Found : user_pref("CT3072253.Initialize", true);

Found : user_pref("CT3072253.InitializeCommonPrefs", true);

Found : user_pref("CT3072253.InstallationAndCookieDataSentCount", 3);

Found : user_pref("CT3072253.InstallationId", "fft4E66.tmp.exe");

Found : user_pref("CT3072253.InstallationType", "XPE");

Found : user_pref("CT3072253.InstalledDate", "Mon Jun 25 2012 20:07:13 GMT-0500 (Central Daylight Time)");

Found : user_pref("CT3072253.IsAlertDBUpdated", true);

Found : user_pref("CT3072253.IsGrouping", false);

Found : user_pref("CT3072253.IsInitSetupIni", true);

Found : user_pref("CT3072253.IsMulticommunity", false);

Found : user_pref("CT3072253.IsOpenThankYouPage", true);

Found : user_pref("CT3072253.IsOpenUninstallPage", false);

Found : user_pref("CT3072253.LanguagePackLastCheckTime", "Thu Sep 06 2012 23:31:44 GMT-0500 (Central Dayligh[...]

Found : user_pref("CT3072253.LanguagePackReloadIntervalMM", 1440);

Found : user_pref("CT3072253.LanguagePackServiceUrl", "hxxp://translation.users.conduit.com/Translation.ashx[...]

Found : user_pref("CT3072253.LastLogin_3.13.0.6", "Tue Jul 17 2012 21:36:13 GMT-0500 (Central Daylight Time)[...]

Found : user_pref("CT3072253.LastLogin_3.14.1.0", "Wed Sep 05 2012 00:26:35 GMT-0500 (Central Daylight Time)[...]

Found : user_pref("CT3072253.LastLogin_3.15.1.0", "Fri Sep 07 2012 14:13:02 GMT-0500 (Central Daylight Time)[...]

Found : user_pref("CT3072253.LatestVersion", "3.14.1.0");

Found : user_pref("CT3072253.Locale", "en");

Found : user_pref("CT3072253.MCDetectTooltipHeight", "83");

Found : user_pref("CT3072253.MCDetectTooltipUrl", "hxxp://@EB_INSTALL_LINK@/rank/tooltip/?version=1");

Found : user_pref("CT3072253.MCDetectTooltipWidth", "295");

Found : user_pref("CT3072253.MyStuffEnabledAtInstallation", true);

Found : user_pref("CT3072253.OriginalFirstVersion", "3.13.0.6");

Found : user_pref("CT3072253.SHRINK_TOOLBAR", 1);

Found : user_pref("CT3072253.SearchCaption", "uTorrentControl2 Customized Web Search");

Found : user_pref("CT3072253.SearchEngineBeforeUnload", "Search");

Found : user_pref("CT3072253.SearchFromAddressBarIsInit", true);

Found : user_pref("CT3072253.SearchFromAddressBarUrl", "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT307[...]

Found : user_pref("CT3072253.SearchInNewTabEnabled", true);

Found : user_pref("CT3072253.SearchInNewTabIntervalMM", 1440);

Found : user_pref("CT3072253.SearchInNewTabLastCheckTime", "Thu Sep 06 2012 23:31:44 GMT-0500 (Central Dayli[...]

Found : user_pref("CT3072253.SearchInNewTabServiceUrl", "hxxp://newtab.conduit-hosting.com/newtab/?ctid=EB_T[...]

Found : user_pref("CT3072253.SearchInNewTabUserEnabled", false);

Found : user_pref("CT3072253.SearchProtectorEnabled", false);

Found : user_pref("CT3072253.SearchProtectorToolbarDisabled", false);

Found : user_pref("CT3072253.SendProtectorDataViaLogin", true);

Found : user_pref("CT3072253.ServiceMapLastCheckTime", "Thu Sep 06 2012 23:31:44 GMT-0500 (Central Daylight [...]

Found : user_pref("CT3072253.SettingsLastCheckTime", "Fri Sep 07 2012 14:12:56 GMT-0500 (Central Daylight Ti[...]

Found : user_pref("CT3072253.SettingsLastUpdate", "1346938891");

Found : user_pref("CT3072253.TBHomePageUrl", "hxxp://search.conduit.com/?ctid=CT3072253&SearchSource=13");

Found : user_pref("CT3072253.ThirdPartyComponentsInterval", 504);

Found : user_pref("CT3072253.ThirdPartyComponentsLastCheck", "Wed Aug 29 2012 21:25:58 GMT-0500 (Central Day[...]

Found : user_pref("CT3072253.ThirdPartyComponentsLastUpdate", "1331805997");

Found : user_pref("CT3072253.ToolbarShrinkedFromSetup", false);

Found : user_pref("CT3072253.TrusteLinkUrl", "hxxp://trust.conduit.com/CT3072253");

Found : user_pref("CT3072253.TrustedApiDomains", "conduit.com,conduit-hosting.com,conduit-services.com,clien[...]

Found : user_pref("CT3072253.UserID", "UN71119223081873524");

Found : user_pref("CT3072253.ValidationData_Search", 2);

Found : user_pref("CT3072253.ValidationData_Toolbar", 2);

Found : user_pref("CT3072253.alertChannelId", "1463702");

Found : user_pref("CT3072253.autoDisableScopes", -1);

Found : user_pref("CT3072253.backendstorage.cb_experience_000", "3237");

Found : user_pref("CT3072253.backendstorage.cb_firstuse0100", "31");

Found : user_pref("CT3072253.backendstorage.cb_user_id_000", "43423232313731323735393132395F46697265666F78")[...]

Found : user_pref("CT3072253.backendstorage.cbcountry_001", "5553");

Found : user_pref("CT3072253.backendstorage.cbfirsttime", "4D6F6E204A756E20323520323031322032303A30373A31372[...]

Found : user_pref("CT3072253.backendstorage.url_history0001", "687474703A2F2F7777772E66616365626F6F6B2E636F6[...]

Found : user_pref("CT3072253.generalConfigFromLogin", "{\"ApiMaxAlerts\":\"12\",\"SocialDomains\":\"social.c[...]

Found : user_pref("CT3072253.globalFirstTimeInfoLastCheckTime", "Tue Aug 28 2012 14:26:30 GMT-0500 (Central [...]

Found : user_pref("CT3072253.homepageProtectorEnableByLogin", true);

Found : user_pref("CT3072253.initDone", true);

Found : user_pref("CT3072253.isAppTrackingManagerOn", true);

Found : user_pref("CT3072253.myStuffEnabled", true);

Found : user_pref("CT3072253.myStuffPublihserMinWidth", 400);

Found : user_pref("CT3072253.myStuffSearchUrl", "hxxp://Apps.conduit.com/search?q=SEARCH_TERM&SearchSourceOr[...]

Found : user_pref("CT3072253.myStuffServiceIntervalMM", 1440);

Found : user_pref("CT3072253.myStuffServiceUrl", "hxxp://mystuff.conduit-services.com/MyStuffService.ashx?Co[...]

Found : user_pref("CT3072253.navigateToUrlOnSearch", false);

Found : user_pref("CT3072253.oldAppsList", "129295695672325902,129571859753931591,111,129593762370823811,129[...]

Found : user_pref("CT3072253.revertSettingsEnabled", false);

Found : user_pref("CT3072253.searchProtectorDialogDelayInSec", 10);

Found : user_pref("CT3072253.searchProtectorEnableByLogin", true);

Found : user_pref("CT3072253.testingCtid", "");

Found : user_pref("CT3072253.toolbarAppMetaDataLastCheckTime", "Thu Sep 06 2012 23:31:44 GMT-0500 (Central D[...]

Found : user_pref("CT3072253.toolbarContextMenuLastCheckTime", "Wed Sep 05 2012 22:39:13 GMT-0500 (Central D[...]

Found : user_pref("CT3072253.usagesFlag", 2);

Found : user_pref("CommunityToolbar.ETag.hxxp://Settings.toolbar.search.conduit.com/root/CT3072253/CT3072253[...]

Found : user_pref("CommunityToolbar.ETag.hxxp://appsmetadata.toolbar.conduit-services.com/?ctid=CT3072253", [...]

Found : user_pref("CommunityToolbar.ETag.hxxp://contextmenu.toolbar.conduit-services.com/?name=GottenApps&lo[...]

Found : user_pref("CommunityToolbar.ETag.hxxp://contextmenu.toolbar.conduit-services.com/?name=OtherApps&loc[...]

Found : user_pref("CommunityToolbar.ETag.hxxp://contextmenu.toolbar.conduit-services.com/?name=SharedApps&lo[...]

Found : user_pref("CommunityToolbar.ETag.hxxp://contextmenu.toolbar.conduit-services.com/?name=Toolbar&local[...]

Found : user_pref("CommunityToolbar.ETag.hxxp://dynamicdialogs.alert.conduit-services.com/alert/dlg.pkg", "\[...]

Found : user_pref("CommunityToolbar.ETag.hxxp://dynamicdialogs.toolbar.conduit-services.com/DLG.pkg?ver=3.13[...]

Found : user_pref("CommunityToolbar.ETag.hxxp://dynamicdialogs.toolbar.conduit-services.com/DLG.pkg?ver=3.14[...]

Found : user_pref("CommunityToolbar.ETag.hxxp://servicemap.conduit-services.com/Toolbar/?ownerId=CT3072253",[...]

Found : user_pref("CommunityToolbar.ETag.hxxp://translation.toolbar.conduit-services.com/?locale=en", "\"9df[...]

Found : user_pref("CommunityToolbar.LatestLibsPath", "file:///C:\\Users\\Sammerz93\\AppData\\Roaming\\Mozill[...]

Found : user_pref("CommunityToolbar.LatestToolbarVersionInstalled", "3.15.1.0");

Found : user_pref("CommunityToolbar.SearchFromAddressBarSavedUrl", "hxxp://search.yahoo.com/search?fr=mcafee[...]

Found : user_pref("CommunityToolbar.ToolbarsList", "CT3072253");

Found : user_pref("CommunityToolbar.ToolbarsList2", "CT3072253");

Found : user_pref("CommunityToolbar.ToolbarsList4", "CT3072253");

Found : user_pref("CommunityToolbar.globalUserId", "33581b52-83e6-4d62-98de-6e1a78cc3eb9");

Found : user_pref("CommunityToolbar.isAlertUrlAddedToFeedItemTable", true);

Found : user_pref("CommunityToolbar.isClickActionAddedToFeedItemTable", true);

Found : user_pref("CommunityToolbar.keywordURLSelectedCTID", "CT3072253");

Found : user_pref("CommunityToolbar.notifications.alertDialogsGetterLastCheckTime", "Wed Sep 05 2012 22:39:1[...]

Found : user_pref("CommunityToolbar.notifications.alertEnabled", false);

Found : user_pref("CommunityToolbar.notifications.clientsServerUrl", "hxxp://alert.client.conduit.com");

Found : user_pref("CommunityToolbar.notifications.locale", "en");

Found : user_pref("CommunityToolbar.notifications.loginIntervalMin", 1440);

Found : user_pref("CommunityToolbar.notifications.loginLastCheckTime", "Thu Sep 06 2012 23:31:45 GMT-0500 (C[...]

Found : user_pref("CommunityToolbar.notifications.loginLastUpdateTime", "1313487611");

Found : user_pref("CommunityToolbar.notifications.messageShowTimeSec", 20);

Found : user_pref("CommunityToolbar.notifications.servicesServerUrl", "hxxp://alert.services.conduit.com");

Found : user_pref("CommunityToolbar.notifications.showTrayIcon", false);

Found : user_pref("CommunityToolbar.notifications.userCloseIntervalMin", 300);

Found : user_pref("CommunityToolbar.notifications.userId", "c1e8859f-bf6b-415a-bd0f-42de0de97113");

Found : user_pref("CommunityToolbar.originalHomepage", "hxxp://www.facebook.com/");

Found : user_pref("CommunityToolbar.originalSearchEngine", "Secure Search");

Found : user_pref("aol_toolbar.buttons.layout", "aol_mail_5496;facebook_40839;mapquest_40872;twitter_40883;w[...]

Found : user_pref("aol_toolbar.default.homepage.check", false);

Found : user_pref("aol_toolbar.default.search.check", false);

Found : user_pref("aol_toolbar.firsttime.showwindow", false);

Found : user_pref("aol_toolbar.guid", "{D14CCA73-0583-14DF-925A-B22E5E5415D7}");

Found : user_pref("aol_toolbar.install.distroid", "aol");

Found : user_pref("aol_toolbar.install.lastTbVersion", "5.74.1.8384");

Found : user_pref("aol_toolbar.install.lid", "hyplognew00000010");

Found : user_pref("aol_toolbar.install.mtmhp", "hyplogusaolp00000019");

Found : user_pref("aol_toolbar.install.ncid", "");

Found : user_pref("aol_toolbar.metrics.activestampdate", "9");

Found : user_pref("aol_toolbar.metrics.activestampmonth", "7");

Found : user_pref("aol_toolbar.metrics.activestampyear", "2012");

Found : user_pref("aol_toolbar.metrics.originalDate", "9");

Found : user_pref("aol_toolbar.metrics.originalHours", "5");

Found : user_pref("aol_toolbar.metrics.originalMinutes", "38");

Found : user_pref("aol_toolbar.metrics.originalMonth", "8");

Found : user_pref("aol_toolbar.metrics.originalSeconds", "50");

Found : user_pref("aol_toolbar.metrics.originalYear", "2012");

Found : user_pref("aol_toolbar.relatednews.enabled", false);

Found : user_pref("aol_toolbar.remote.publish.xml", "1344490730351");

Found : user_pref("aol_toolbar.rtw.active", false);

Found : user_pref("aol_toolbar.search.button", true);

Found : user_pref("aol_toolbar.search.cid", "09-08-2012");

Found : user_pref("aol_toolbar.search.instd", "20120809053553262");

Found : user_pref("aol_toolbar.search.oid", "09-08-2012");

Found : user_pref("aol_toolbar.search.placement", "right");

Found : user_pref("aol_toolbar.search.populateoncomplete", false);

Found : user_pref("aol_toolbar.search.savehistory", false);

Found : user_pref("aol_toolbar.search.searchtype", "web");

Found : user_pref("aol_toolbar.search.source", "tb50-ff-amonetizetest1");

Found : user_pref("aol_toolbar.skin.custom", false);

Found : user_pref("aol_toolbar.surf.date", "5");

Found : user_pref("aol_toolbar.surf.lastDate", "9");

Found : user_pref("aol_toolbar.surf.lastMonth", "7");

Found : user_pref("aol_toolbar.surf.lastYear", "2012");

Found : user_pref("aol_toolbar.surf.month", "5");

Found : user_pref("aol_toolbar.surf.prevMonth", "0");

Found : user_pref("aol_toolbar.surf.total", "5");

Found : user_pref("aol_toolbar.surf.week", "5");

Found : user_pref("aol_toolbar.surf.year", "5");

Found : user_pref("aol_toolbar.ticker.active", false);

Found : user_pref("aol_toolbar.upgrade.showwindow", false);

Found : user_pref("aol_toolbar.weather.degc", "24");

Found : user_pref("aol_toolbar.weather.degf", "76");

Found : user_pref("aol_toolbar.weather.image", "chrome://aoltoolbar/skin/weather/29_n.png");

Found : user_pref("aol_toolbar.weather.metric", true);

Found : user_pref("aol_toolbar.weather.tooltip", "New York , NY : Partly Cloudy");

Found : user_pref("aol_toolbar.weather.update", "1344490730485");

Found : user_pref("aol_toolbar.weather.zipcode", "10065");

Found : user_pref("extensions.funmoods.aflt", "nv1");

Found : user_pref("extensions.funmoods.autoRvrt", false);

Found : user_pref("extensions.funmoods.cntry", "US");

Found : user_pref("extensions.funmoods.dfltLng", "");

Found : user_pref("extensions.funmoods.dfltSrch", true);

Found : user_pref("extensions.funmoods.dnsErr", true);

Found : user_pref("extensions.funmoods.envrmnt", "production");

Found : user_pref("extensions.funmoods.excTlbr", false);

Found : user_pref("extensions.funmoods.hdrMd5", "14AF370693B1D9267471EB44E3E9420B");

Found : user_pref("extensions.funmoods.hmpg", true);

Found : user_pref("extensions.funmoods.hmpgUrl", "hxxp://start.funmoods.com/?f=1&a=nv1&chnl=nv1&cd=2XzutAtN2[...]

Found : user_pref("extensions.funmoods.id", "c881a29c00000000000000266cea83ba");

Found : user_pref("extensions.funmoods.instlDay", "15520");

Found : user_pref("extensions.funmoods.instlRef", "nv1");

Found : user_pref("extensions.funmoods.isdcmntcmplt", true);

Found : user_pref("extensions.funmoods.lastVrsnTs", "1.5.23.2221:45:6");

Found : user_pref("extensions.funmoods.mntrvrsn", "1.3.0");

Found : user_pref("extensions.funmoods.newTab", true);

Found : user_pref("extensions.funmoods.newTabUrl", "hxxp://start.funmoods.com/?f=2&a=nv1&chnl=nv1&cd=2XzutAt[...]

Found : user_pref("extensions.funmoods.prdct", "funmoods");

Found : user_pref("extensions.funmoods.prtnrId", "funmoods");

Found : user_pref("extensions.funmoods.sg", "none");

Found : user_pref("extensions.funmoods.smplGrp", "none");

Found : user_pref("extensions.funmoods.srchPrvdr", "Search");

Found : user_pref("extensions.funmoods.tlbrId", "base");

Found : user_pref("extensions.funmoods.tlbrSrchUrl", "");

Found : user_pref("extensions.funmoods.vrsn", "1.5.23.22");

Found : user_pref("extensions.funmoods.vrsnTs", "1.5.23.2221:45:6");

Found : user_pref("extensions.funmoods.vrsni", "1.5.23.22");

Found : user_pref("extensions.funmoods_i.newTab", true);

Found : user_pref("extensions.funmoods_i.smplGrp", "none");

Found : user_pref("extensions.funmoods_i.vrsnTs", "1.5.23.2221:45:6");

Found : user_pref("keyword.URL", "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT3072253&SearchSource=2&q=[...]

-\\ Google Chrome v [unable to get version]

File : C:\Users\Sammerz93\AppData\Local\Google\Chrome\User Data\Default\Preferences

Found [l.3] : homepage = "hxxp://start.funmoods.com/?f=1&a=nv1&chnl=nv1&cd=2XzutAtN2Y1L1QzutDtDtByCyC0C0E0AzztA0B0A0AtBzy0CtN0D0TzutBtDtCtBtDyCtBzy&cr=809745180",

Found [l.22] : search_url = "hxxp://start.funmoods.com/results.php?f=4&q={searchTerms}&a=nv1&chnl=nv1&cd=2XzutAtN2Y1L1QzutDtDtByCyC0C0E0AzztA0B0A0AtBzy0CtN0D0TzutBtDtCtBtDyCtBzy&cr=809745180",

*************************

AdwCleaner[R1].txt - [32549 octets] - [07/09/2012 14:42:25]

########## EOF - C:\AdwCleaner[R1].txt - [32610 octets] ##########

Malwarebytes Anti-Malware (Trial) 1.62.0.1300

www.malwarebytes.org

Database version: v2012.09.07.11

Windows 7 Service Pack 1 x64 NTFS

Internet Explorer 9.0.8112.16421

Sammerz93 :: SAMMERZ93-PC [administrator]

Protection: Enabled

9/7/2012 2:16:46 PM

mbam-log-2012-09-07 (14-16-46).txt

Scan type: Quick scan

Scan options disabled: P2P

Objects scanned: 194935

Time elapsed: 2 minute(s), 2 second(s)

Memory Processes Detected: 0

(No malicious items detected)

Memory Modules Detected: 0

(No malicious items detected)

Registry Keys Detected: 0

(No malicious items detected)

Registry Values Detected: 0

(No malicious items detected)

Registry Data Items Detected: 0

(No malicious items detected)

Folders Detected: 0

(No malicious items detected)

Files Detected: 2

C:\Windows\Installer\{56e02f73-c73e-341c-1909-583710acfd43}\U\00000008.@ (Trojan.Dropper.BCMiner) -> Quarantined and deleted successfully.

C:\Windows\Installer\{56e02f73-c73e-341c-1909-583710acfd43}\U\80000000.@ (Rootkit.0Access.64) -> Quarantined and deleted successfully.

(end)

2012/09/07 00:24:41 -0500 SAMMERZ93-PC Sammerz93 DETECTION C:\Windows\Installer\{56e02f73-c73e-341c-1909-583710acfd43}\U\000000cb.@ Rootkit.0Access DENY

2012/09/07 00:45:33 -0500 SAMMERZ93-PC Sammerz93 MESSAGE Starting protection

2012/09/07 00:45:35 -0500 SAMMERZ93-PC Sammerz93 MESSAGE Protection started successfully

2012/09/07 00:45:38 -0500 SAMMERZ93-PC Sammerz93 MESSAGE Starting IP protection

2012/09/07 00:45:38 -0500 SAMMERZ93-PC Sammerz93 ERROR IP protection failed: FwpmEngineOpen0 failed with error code 1753

2012/09/07 01:21:54 -0500 SAMMERZ93-PC Sammerz93 DETECTION C:\Windows\Installer\{56e02f73-c73e-341c-1909-583710acfd43}\U\000000cb.@ Rootkit.0Access QUARANTINE

2012/09/07 01:26:04 -0500 SAMMERZ93-PC Sammerz93 DETECTION C:\Windows\Installer\{56e02f73-c73e-341c-1909-583710acfd43}\U\000000cb.@ Rootkit.0Access DENY

2012/09/07 14:11:56 -0500 SAMMERZ93-PC Sammerz93 MESSAGE Starting protection

2012/09/07 14:11:59 -0500 SAMMERZ93-PC Sammerz93 MESSAGE Protection started successfully

2012/09/07 14:12:02 -0500 SAMMERZ93-PC Sammerz93 MESSAGE Starting IP protection

2012/09/07 14:12:02 -0500 SAMMERZ93-PC Sammerz93 ERROR IP protection failed: FwpmEngineOpen0 failed with error code 1753

2012/09/07 14:13:16 -0500 SAMMERZ93-PC Sammerz93 MESSAGE Executing scheduled update: Daily

2012/09/07 14:14:06 -0500 SAMMERZ93-PC Sammerz93 DETECTION C:\Windows\Installer\{56e02f73-c73e-341c-1909-583710acfd43}\U\000000cb.@ Rootkit.0Access QUARANTINE

2012/09/07 14:14:15 -0500 SAMMERZ93-PC Sammerz93 MESSAGE Starting database refresh

2012/09/07 14:14:17 -0500 SAMMERZ93-PC Sammerz93 MESSAGE Scheduled update executed successfully: database updated from version v2012.08.31.09 to version v2012.09.07.11

2012/09/07 14:14:17 -0500 SAMMERZ93-PC Sammerz93 MESSAGE Database refreshed successfully

2012/09/07 14:18:54 -0500 SAMMERZ93-PC Sammerz93 DETECTION C:\Windows\Installer\{56e02f73-c73e-341c-1909-583710acfd43}\U\000000cb.@ Rootkit.0Access QUARANTINE

2012/09/07 14:24:10 -0500 SAMMERZ93-PC Sammerz93 MESSAGE Starting protection

2012/09/07 14:24:12 -0500 SAMMERZ93-PC Sammerz93 MESSAGE Protection started successfully

2012/09/07 14:24:15 -0500 SAMMERZ93-PC Sammerz93 MESSAGE Starting IP protection

2012/09/07 14:24:15 -0500 SAMMERZ93-PC Sammerz93 ERROR IP protection failed: FwpmEngineOpen0 failed with error code 1753

Farbar Service Scanner Version: 06-08-2012

Ran by Sammerz93 (administrator) on 07-09-2012 at 14:45:43

Running from "C:\Users\Sammerz93\Downloads"

Microsoft Windows 7 Home Premium Service Pack 1 (X64)

Boot Mode: Normal

****************************************************************

Internet Services:

============

Connection Status:

==============

Localhost is accessible.

LAN connected.

Google IP is accessible.

Google.com is accessible.

Yahoo IP is accessible.

Yahoo.com is accessible.

Windows Firewall:

=============

mpsdrv Service is not running. Checking service configuration:

The start type of mpsdrv service is OK.

The ImagePath of mpsdrv service is OK.

MpsSvc Service is not running. Checking service configuration:

Checking Start type: ATTENTION!=====> Unable to retrieve start type of MpsSvc. The value does not exist.

Checking ImagePath: ATTENTION!=====> Unable to retrieve ImagePath of MpsSvc. The value does not exist.

Unable to retrieve ServiceDll of MpsSvc. The value does not exist.

bfe Service is not running. Checking service configuration:

Checking Start type: ATTENTION!=====> Unable to open bfe registry key. The service key does not exist.

Checking ImagePath: ATTENTION!=====> Unable to open bfe registry key. The service key does not exist.

Checking ServiceDll: ATTENTION!=====> Unable to open bfe registry key. The service key does not exist.

Firewall Disabled Policy:

==================

System Restore:

============

System Restore Disabled Policy:

========================

Action Center:

============

wscsvc Service is not running. Checking service configuration:

Checking Start type: ATTENTION!=====> Unable to open wscsvc registry key. The service key does not exist.

Checking ImagePath: ATTENTION!=====> Unable to open wscsvc registry key. The service key does not exist.

Checking ServiceDll: ATTENTION!=====> Unable to open wscsvc registry key. The service key does not exist.

Windows Update:

============

wuauserv Service is not running. Checking service configuration:

Checking Start type: ATTENTION!=====> Unable to open wuauserv registry key. The service key does not exist.

Checking ImagePath: ATTENTION!=====> Unable to open wuauserv registry key. The service key does not exist.

Checking ServiceDll: ATTENTION!=====> Unable to open wuauserv registry key. The service key does not exist.

BITS Service is not running. Checking service configuration:

Checking Start type: ATTENTION!=====> Unable to open BITS registry key. The service key does not exist.

Checking ImagePath: ATTENTION!=====> Unable to open BITS registry key. The service key does not exist.

Checking ServiceDll: ATTENTION!=====> Unable to open BITS registry key. The service key does not exist.

Windows Autoupdate Disabled Policy:

============================

Windows Defender:

==============

WinDefend Service is not running. Checking service configuration:

Checking Start type: ATTENTION!=====> Unable to open WinDefend registry key. The service key does not exist.

Checking ImagePath: ATTENTION!=====> Unable to open WinDefend registry key. The service key does not exist.

Checking ServiceDll: ATTENTION!=====> Unable to open WinDefend registry key. The service key does not exist.

Other Services:

==============

Checking Start type of SharedAccess: ATTENTION!=====> Unable to retrieve start type of SharedAccess. The value does not exist.

Checking ImagePath of SharedAccess: ATTENTION!=====> Unable to retrieve ImagePath of SharedAccess. The value does not exist.

Checking ServiceDll of SharedAccess: ATTENTION!=====> Unable to open SharedAccess registry key. The service key does not exist.

File Check:

========

C:\Windows\System32\nsisvc.dll => MD5 is legit

C:\Windows\System32\drivers\nsiproxy.sys => MD5 is legit

C:\Windows\System32\dhcpcore.dll => MD5 is legit

C:\Windows\System32\drivers\afd.sys => MD5 is legit

C:\Windows\System32\drivers\tdx.sys => MD5 is legit

C:\Windows\System32\Drivers\tcpip.sys => MD5 is legit

C:\Windows\System32\dnsrslvr.dll => MD5 is legit

C:\Windows\System32\mpssvc.dll => MD5 is legit

C:\Windows\System32\bfe.dll => MD5 is legit

C:\Windows\System32\drivers\mpsdrv.sys => MD5 is legit

C:\Windows\System32\SDRSVC.dll => MD5 is legit

C:\Windows\System32\vssvc.exe => MD5 is legit

C:\Windows\System32\wscsvc.dll => MD5 is legit

C:\Windows\System32\wbem\WMIsvc.dll => MD5 is legit

C:\Windows\System32\wuaueng.dll => MD5 is legit

C:\Windows\System32\qmgr.dll => MD5 is legit

C:\Windows\System32\es.dll => MD5 is legit

C:\Windows\System32\cryptsvc.dll => MD5 is legit

C:\Program Files\Windows Defender\MpSvc.dll => MD5 is legit

C:\Windows\System32\svchost.exe => MD5 is legit

C:\Windows\System32\rpcss.dll => MD5 is legit

**** End of log ****

.

DDS (Ver_2011-08-26.01) - NTFSAMD64

Internet Explorer: 9.0.8112.16421

Run by Sammerz93 at 14:47:21 on 2012-09-07

Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.4044.1628 [GMT -5:00]

.

AV: Norton Internet Security *Disabled/Outdated* {63DF5164-9100-186D-2187-8DC619EFD8BF}

SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

SP: Norton Internet Security *Disabled/Outdated* {D8BEB080-B73A-17E3-1B37-B6B462689202}

FW: Norton Internet Security *Disabled* {5BE4D041-DB6F-1935-0AD8-24F3E73C9FC4}

.

============== Running Processes ===============

.

C:\windows\system32\wininit.exe

C:\windows\system32\lsm.exe

C:\windows\system32\svchost.exe -k DcomLaunch

C:\windows\system32\svchost.exe -k RPCSS

C:\windows\System32\svchost.exe -k LocalServiceNetworkRestricted

C:\windows\System32\svchost.exe -k LocalSystemNetworkRestricted

C:\windows\system32\svchost.exe -k netsvcs

C:\windows\system32\svchost.exe -k LocalService

C:\windows\system32\svchost.exe -k NetworkService

C:\windows\System32\spoolsv.exe

C:\windows\System32\svchost.exe -k LocalServiceNoNetwork

c:\PROGRA~2\mcafee\SITEAD~1\mcsacore.exe

C:\windows\system32\rundll32.exe

C:\Program Files (x86)\Norton PC Checkup\Engine\2.0.13.11\ccSvcHst.exe

C:\windows\SysWOW64\rundll32.exe

C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe

C:\windows\system32\svchost.exe -k imgsvc

C:\windows\system32\TODDSrv.exe

C:\Program Files\TOSHIBA\Power Saver\TosCoSrv.exe

C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE

C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe

C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe

C:\windows\system32\taskhost.exe

C:\Program Files (x86)\Norton PC Checkup\Engine\2.0.13.11\ccSvcHst.exe

C:\windows\system32\Dwm.exe

C:\windows\Explorer.EXE

C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE

C:\Windows\System32\igfxtray.exe

C:\Windows\System32\hkcmd.exe

C:\Windows\System32\igfxpers.exe

C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

C:\Program Files\TOSHIBA\Power Saver\TPwrMain.exe

C:\Program Files\TOSHIBA\FlashCards\TCrdMain.exe

C:\Program Files\TOSHIBA\BulletinBoard\TosNcCore.exe

C:\Program Files\TOSHIBA\ReelTime\TosReelTimeMonitor.exe

C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

C:\Windows\System32\StikyNot.exe

C:\Program Files (x86)\McAfee Security Scan\3.0.207\SSScheduler.exe

C:\Program Files (x86)\TOSHIBA\TOSHIBA Service Station\ToshibaServiceStation.exe

C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe

C:\Program Files\Synaptics\SynTP\SynTPHelper.exe

C:\windows\system32\SearchIndexer.exe

C:\windows\system32\svchost.exe -k LocalServiceAndNoImpersonation

C:\Program Files (x86)\Mozilla Firefox\firefox.exe

C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe

C:\Program Files (x86)\TOSHIBA\TOSHIBA Service Station\TMachInfo.exe

C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe

C:\windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_4_402_265.exe

C:\Program Files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe

C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe

C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe

C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSmartSrv.exe

C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSENotify.exe

C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbam.exe

C:\windows\SysWOW64\NOTEPAD.EXE

c:\PROGRA~2\mcafee\SITEAD~1\saui.exe

C:\windows\SysWOW64\NOTEPAD.EXE

C:\Program Files (x86)\VideoLAN\VLC\vlc.exe

C:\windows\system32\NOTEPAD.EXE

C:\windows\system32\wbem\wmiprvse.exe

C:\windows\system32\svchost.exe -k SDRSVC

C:\windows\system32\vssvc.exe

"C:\windows\SysWOW64\svchost.exe" -k LocalServiceDns

C:\windows\system32\DllHost.exe

C:\windows\SysWOW64\cmd.exe

C:\windows\system32\conhost.exe

C:\windows\SysWOW64\cscript.exe

.

============== Pseudo HJT Report ===============

.

uStart Page = hxxp://www.facebook.com/

uDefault_Page_URL = hxxp://start.toshiba.com

mStart Page = hxxp://start.funmoods.com/?f=1&a=nv1&chnl=nv1&cd=2XzutAtN2Y1L1QzutDtDtByCyC0C0E0AzztA0B0A0AtBzy0CtN0D0TzutBtDtCtBtDyCtBzy&cr=809745180

uInternet Settings,ProxyOverride = <local>

uURLSearchHooks: H - No File

mWinlogon: Userinit=userinit.exe,

BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

BHO: AOL Toolbar Loader: {3ef64538-8b54-4573-b48f-4d34b0238ab2} - C:\Program Files (x86)\AOL Toolbar\aoltb.dll

BHO: Windows Live ID Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

BHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll

BHO: Skype Browser Helper: {ae805869-2e5c-4ed4-8f7b-f1f7851a4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll

BHO: McAfee SiteAdvisor BHO: {b164e929-a1b6-4a06-b104-2cd0e90a88ff} - c:\PROGRA~2\mcafee\SITEAD~1\mcieplg.dll

BHO: Price Check by AOL: {d25b97e9-62b2-40ce-becf-e43a7b879072} - C:\Program Files (x86)\Price Check by AOL\aolpricecheck.dll

BHO: Java Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll