Jump to content

Can't get Rid of "Dropin Savings"!


Recommended Posts

i am infected with Whitesmoke and have ran Anti-Malwarebytes wtih a full scan to no avail. Below are the text files you requested.

.

DDS (Ver_2011-08-26.01) - NTFSAMD64

Internet Explorer: 9.0.8112.16421

Run by mherwig at 22:53:47 on 2012-09-17

Microsoft Windows 7 Professional 6.1.7601.1.1252.1.1033.18.8149.5211 [GMT -4:00]

.

AV: Symantec Endpoint Protection *Enabled/Updated* {88C95A36-8C3B-2F2C-1B8B-30FCCFDC4855}

SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

SP: Symantec Endpoint Protection *Enabled/Updated* {33A8BBD2-AA01-20A2-213B-0B8EB45B02E8}

FW: Symantec Endpoint Protection *Enabled* {B0F2DB13-C654-2E74-30D4-99C9310F0F2E}

.

============== Running Processes ===============

.

C:\Windows\system32\wininit.exe

C:\Windows\system32\lsm.exe

C:\Windows\system32\svchost.exe -k DcomLaunch

C:\Windows\system32\nvvsvc.exe

C:\Windows\system32\svchost.exe -k RPCSS

C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted

C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted

C:\Windows\system32\svchost.exe -k netsvcs

C:\Program Files\IDT\WDM\STacSV64.exe

C:\Windows\system32\svchost.exe -k LocalService

C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe

C:\Windows\system32\nvvsvc.exe

C:\Program Files\Common Files\SPBA\upeksvr.exe

C:\Windows\system32\WUDFHost.exe

C:\Program Files (x86)\Symantec\Symantec Endpoint Protection\Smc.exe

C:\Windows\system32\svchost.exe -k NetworkService

C:\Program Files\Intel\WiFi\bin\EvtEng.exe

C:\Program Files\Intel\WiFi\bin\ZCfgSvc7.exe

C:\Windows\system32\WLANExt.exe

C:\Windows\system32\wbem\unsecapp.exe

C:\Windows\system32\wbem\wmiprvse.exe

C:\Windows\system32\conhost.exe

C:\Program Files (x86)\Common Files\Symantec Shared\ccSvcHst.exe

C:\Windows\System32\spoolsv.exe

C:\Program Files\Broadcom Corporation\Broadcom USH Host Components\CV\bin\HostControlService.exe

C:\Program Files\Broadcom Corporation\Broadcom USH Host Components\CV\bin\HostStorageService.exe

C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation

C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork

C:\Program Files\Dell\Dell Data Protection\Access\Advanced\Wave\Trusted Drive Manager\TdmService.exe

C:\Program Files\IDT\WDM\AESTSr64.exe

C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

C:\Program Files\Bonjour\mDNSResponder.exe

C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe

c:\Program Files\Dell\Dell System Manager\DCPSysMgrSvc.exe

C:\Windows\system32\IProsetMonitor.exe

C:\Program Files (x86)\Intel\Services\IPT\jhi_service.exe

C:\Windows\system32\lxeacoms.exe

C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe

C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe

C:\Program Files\Common Files\Nitro PDF\Professional\6.0\NitroPDFDriverServicex64.exe

C:\Windows\SysWOW64\NLSSRV32.EXE

C:\Windows\system32\taskhost.exe

C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe

C:\Windows\system32\Dwm.exe

C:\Windows\Explorer.EXE

C:\Program Files (x86)\Symantec\Symantec Endpoint Protection\SmcGui.exe

C:\Windows\system32\DRIVERS\o2flash.exe

c:\Windows\SysWOW64\srvany.exe

c:\Windows\sysWOW64\SDIOAssist.exe

C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe

C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe

C:\Windows\system32\svchost.exe -k imgsvc

C:\Program Files (x86)\Symantec\Symantec Endpoint Protection\Rtvscan.exe

C:\Program Files\Intel\WiMAX\Bin\AppSrv.exe

C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE

C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe

C:\Program Files\Intel\WiMAX\Bin\DMAgent.exe

C:\Windows\system32\svchost.exe -k bthsvcs

C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted

C:\Program Files (x86)\Symantec\Symantec Endpoint Protection\ProtectionUtilSurrogate.exe

C:\Windows\system32\SearchIndexer.exe

C:\Program Files\DellTPad\Apoint.exe

C:\Program Files\IDT\WDM\sttray64.exe

C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe

C:\Program Files\Intel\WiMAX\Bin\WiMAXCU.exe

C:\Program Files (x86)\STMicroelectronics\AccelerometerP11\FF_Protection.exe

C:\dell\DBRM\Reminder\DbrmTrayicon.exe

C:\Program Files (x86)\Lexmark S300-S400 Series\lxeamon.exe

C:\Program Files\DellTPad\ApMsgFwd.exe

C:\Program Files\DellTPad\HidFind.exe

C:\Program Files\DellTPad\Apntex.exe

C:\Windows\system32\conhost.exe

C:\Windows\system32\wbem\unsecapp.exe

C:\Program Files (x86)\Lexmark S300-S400 Series\ezprint.exe

C:\Program Files (x86)\Dell Webcam\Dell Webcam Central\WebcamDell2.exe

C:\Program Files (x86)\CyberLink\PowerDVD9\PDVD9Serv.exe

C:\Program Files (x86)\Roxio\OEM\Roxio Burn\RoxioBurnLauncher.exe

C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe

C:\Program Files (x86)\Common Files\Symantec Shared\ccApp.exe

C:\Program Files (x86)\Citrix\ICA Client\concentr.exe

C:\Program Files (x86)\Common Files\Research In Motion\USB Drivers\RIMBBLaunchAgent.exe

C:\Program Files (x86)\iTunes\iTunesHelper.exe

C:\Program Files (x86)\Citrix\ICA Client\wfcrun32.exe

C:\Program Files\iPod\bin\iPodService.exe

C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe

C:\Program Files\Dell\Dell System Manager\DCPSysMgr.exe

C:\Program Files (x86)\McAfee Security Scan\2.0.181\SSScheduler.exe

C:\Program Files\Microsoft Office\Office14\ONENOTEM.EXE

C:\Program Files\Windows Media Player\wmpnetwk.exe

C:\Windows\SysWOW64\RunDll32.exe

C:\Program Files\WIDCOMM\Bluetooth Software\BtStackServer.exe

C:\Program Files (x86)\Intel\Intel® Management Engine Components\IMSS\PrivacyIconClient.exe

C:\Program Files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe

C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe

C:\Program Files\WIDCOMM\Bluetooth Software\BluetoothHeadsetProxy.exe

C:\Windows\system32\wuauclt.exe

C:\Windows\system32\svchost.exe -k SDRSVC

C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe

C:\Program Files (x86)\Mozilla Firefox\firefox.exe

C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe

C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe

C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_3_300_271.exe

C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_3_300_271.exe

C:\Windows\system32\SearchProtocolHost.exe

C:\Windows\system32\SearchFilterHost.exe

C:\Windows\system32\DllHost.exe

C:\Windows\system32\DllHost.exe

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\conhost.exe

C:\Windows\SysWOW64\cscript.exe

C:\Windows\system32\wbem\wmiprvse.exe

.

============== Pseudo HJT Report ===============

.

uSearch Page = hxxp://www.google.com

uStart Page = hxxp://www.google.com/

uSearch Bar = hxxp://www.google.com/ie

uDefault_Search_URL = hxxp://www.google.com/ie

uInternet Settings,ProxyOverride = *.local

uSearchAssistant = hxxp://www.google.com/ie

uSearchURL,(Default) = hxxp://www.google.com/search?q=%s

uURLSearchHooks: H - No File

mWinlogon: Userinit=userinit.exe,

BHO: Lexmark Toolbar: {1017a80c-6f09-4548-a84d-edd6ac9525f0} - C:\Program Files\Lexmark Toolbar\toolband.dll

BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

BHO: Groove GFS Browser Helper: {72853161-30c5-4d22-b7f9-0bbc1d38a37e} - C:\PROGRA~2\MICROS~4\Office14\GROOVEEX.DLL

BHO: Windows Live ID Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

BHO: Skype Browser Helper: {ae805869-2e5c-4ed4-8f7b-f1f7851a4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll

BHO: Office Document Cache Handler: {b4f3a835-0e21-4959-ba22-42b3008e02ff} - C:\PROGRA~2\MICROS~4\Office14\URLREDIR.DLL

BHO: Lexmark Printable Web: {d2c5e510-be6d-42cc-9f61-e4f939078474} - C:\Program Files\Lexmark Printable Web\bho.dll

BHO: Java Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll

BHO: {F90A5A0D-CD98-49CC-9AA7-9CD11C7478BF} - No File

TB: Lexmark Toolbar: {1017a80c-6f09-4548-a84d-edd6ac9525f0} - C:\Program Files\Lexmark Toolbar\toolband.dll

TB: {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No File

uRun: [FDPRO-516] C:\Program Files (x86)\Fighters\FighterLauncher.exe FDPRO

mRun: [iMSS] "C:\Program Files (x86)\Intel\Intel® Management Engine Components\IMSS\PIconStartup.exe"

mRun: [Dell Webcam Central] "C:\Program Files (x86)\Dell Webcam\Dell Webcam Central\WebcamDell2.exe" /mode2

mRun: [RemoteControl9] "C:\Program Files (x86)\CyberLink\PowerDVD9\PDVD9Serv.exe"

mRun: [PDVD9LanguageShortcut] "C:\Program Files (x86)\CyberLink\PowerDVD9\Language\Language.exe"

mRun: [<NO NAME>]

mRun: [RoxWatchTray] "C:\Program Files (x86)\Common Files\Roxio Shared\OEM\12.0\SharedCOM\RoxWatchTray12OEM.exe"

mRun: [Desktop Disc Tool] "C:\Program Files (x86)\Roxio\OEM\Roxio Burn\RoxioBurnLauncher.exe"

mRun: [sunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"

mRun: [ccApp] "C:\Program Files (x86)\Common Files\Symantec Shared\ccApp.exe"

mRun: [Adobe Reader Speed Launcher] "C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Reader_sl.exe"

mRun: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"

mRun: [ConnectionCenter] "C:\Program Files (x86)\Citrix\ICA Client\concentr.exe" /startup

mRun: [RIMBBLaunchAgent.exe] C:\Program Files (x86)\Common Files\Research In Motion\USB Drivers\RIMBBLaunchAgent.exe

mRun: [APSDaemon] "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe"

mRun: [iTunesHelper] "C:\Program Files (x86)\iTunes\iTunesHelper.exe"

StartupFolder: C:\Users\mherwig\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\ONENOT~1.LNK - C:\Program Files (x86)\Microsoft Office\Office14\ONENOTEM.EXE

StartupFolder: C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\Startup\BLUETO~1.LNK - C:\Program Files (x86)\WIDCOMM\Bluetooth Software\BTTray.exe

StartupFolder: C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\Startup\DELLSY~1.LNK - C:\Program Files (x86)\Dell\Dell System Manager\DCPSysMgr.exe

StartupFolder: C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\Startup\MCAFEE~1.LNK - C:\Program Files (x86)\McAfee Security Scan\2.0.181\SSScheduler.exe

mPolicies-explorer: NoActiveDesktop = 1 (0x1)

mPolicies-explorer: NoActiveDesktopChanges = 1 (0x1)

mPolicies-system: ConsentPromptBehaviorAdmin = 5 (0x5)

mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3)

mPolicies-system: EnableUIADesktopToggle = 0 (0x0)

mPolicies-system: DisableCAD = 1 (0x1)

IE: Add to Google Photos Screensa&ver - C:\Windows\system32\GPhotos.scr/200

IE: E&xport to Microsoft Excel - C:\PROGRA~1\MICROS~1\Office14\EXCEL.EXE/3000

IE: Se&nd to OneNote - C:\PROGRA~1\MICROS~1\Office14\ONBttnIE.dll/105

IE: Send image to &Bluetooth Device... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm

IE: Send page to &Bluetooth Device... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm

IE: {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm

IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll

IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIE.dll

IE: {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - {FFFDC614-B694-4AE6-AB38-5D6374584B52} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIELinkedNotes.dll

IE: {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll

DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab

DPF: {CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab

DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab

TCP: Interfaces\{6F464E28-0E91-4DC7-8D6D-6AE81C10C4B4} : DhcpNameServer = 192.168.254.254

TCP: Interfaces\{6F464E28-0E91-4DC7-8D6D-6AE81C10C4B4}\132353230333D20534F5E4564777F627B6 : DhcpNameServer = 192.168.2.1

TCP: Interfaces\{6F464E28-0E91-4DC7-8D6D-6AE81C10C4B4}\241647475627970514D27513 : DhcpNameServer = 10.49.181.2 10.48.181.2

TCP: Interfaces\{6F464E28-0E91-4DC7-8D6D-6AE81C10C4B4}\241647475627970514D27523 : DhcpNameServer = 10.49.181.2 10.48.181.2

TCP: Interfaces\{6F464E28-0E91-4DC7-8D6D-6AE81C10C4B4}\6716C65647D27657563747 : DhcpNameServer = 192.168.33.1 204.186.110.76 216.144.187.37

TCP: Interfaces\{6F464E28-0E91-4DC7-8D6D-6AE81C10C4B4}\C696E6B6379737 : DhcpNameServer = 216.144.187.199 204.186.0.201 207.44.0.1

Filter: application/x-ica - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll

Filter: ica - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll

Filter: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\MSOXMLMF.DLL

Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll

Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files (x86)\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll

AppInit_DLLs: C:\Windows\SysWOW64\nvinit.dll

SEH: Groove GFS Stub Execution Hook: {b5a7f190-dda6-4420-b3ba-52453494e6cd} - C:\PROGRA~2\MICROS~4\Office14\GROOVEEX.DLL

LSA: Authentication Packages = msv1_0 wvauth

BHO-X64: Lexmark Toolbar: {1017A80C-6F09-4548-A84D-EDD6AC9525F0} - C:\Program Files\Lexmark Toolbar\toolband.dll

BHO-X64: Adobe PDF Link Helper: {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

BHO-X64: AcroIEHelperStub - No File

BHO-X64: Groove GFS Browser Helper: {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~2\MICROS~4\Office14\GROOVEEX.DLL

BHO-X64: Windows Live ID Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

BHO-X64: Skype Browser Helper: {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll

BHO-X64: SkypeIEPluginBHO - No File

BHO-X64: Office Document Cache Handler: {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~2\MICROS~4\Office14\URLREDIR.DLL

BHO-X64: URLRedirectionBHO - No File

BHO-X64: Lexmark Printable Web: {D2C5E510-BE6D-42CC-9F61-E4F939078474} - C:\Program Files\Lexmark Printable Web\bho.dll

BHO-X64: Java Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll

BHO-X64: {F90A5A0D-CD98-49CC-9AA7-9CD11C7478BF} - No File

BHO-X64: BHO_PROJECT - No File

TB-X64: Lexmark Toolbar: {1017A80C-6F09-4548-A84D-EDD6AC9525F0} - C:\Program Files\Lexmark Toolbar\toolband.dll

TB-X64: {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No File

mRun-x64: [iMSS] "C:\Program Files (x86)\Intel\Intel® Management Engine Components\IMSS\PIconStartup.exe"

mRun-x64: [Dell Webcam Central] "C:\Program Files (x86)\Dell Webcam\Dell Webcam Central\WebcamDell2.exe" /mode2

mRun-x64: [RemoteControl9] "C:\Program Files (x86)\CyberLink\PowerDVD9\PDVD9Serv.exe"

mRun-x64: [PDVD9LanguageShortcut] "C:\Program Files (x86)\CyberLink\PowerDVD9\Language\Language.exe"

mRun-x64: [(Default)]

mRun-x64: [RoxWatchTray] "C:\Program Files (x86)\Common Files\Roxio Shared\OEM\12.0\SharedCOM\RoxWatchTray12OEM.exe"

mRun-x64: [Desktop Disc Tool] "C:\Program Files (x86)\Roxio\OEM\Roxio Burn\RoxioBurnLauncher.exe"

mRun-x64: [sunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"

mRun-x64: [ccApp] "C:\Program Files (x86)\Common Files\Symantec Shared\ccApp.exe"

mRun-x64: [Adobe Reader Speed Launcher] "C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Reader_sl.exe"

mRun-x64: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"

mRun-x64: [ConnectionCenter] "C:\Program Files (x86)\Citrix\ICA Client\concentr.exe" /startup

mRun-x64: [RIMBBLaunchAgent.exe] C:\Program Files (x86)\Common Files\Research In Motion\USB Drivers\RIMBBLaunchAgent.exe

mRun-x64: [APSDaemon] "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe"

mRun-x64: [iTunesHelper] "C:\Program Files (x86)\iTunes\iTunesHelper.exe"

IE-X64: {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm

AppInit_DLLs-X64: C:\Windows\SysWOW64\nvinit.dll

SEH-X64: Groove GFS Stub Execution Hook: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\PROGRA~2\MICROS~4\Office14\GROOVEEX.DLL

.

================= FIREFOX ===================

.

FF - ProfilePath - C:\Users\mherwig\AppData\Roaming\Mozilla\Firefox\Profiles\7tz7rliw.default\

FF - prefs.js: browser.search.selectedEngine - WhiteSmoke US New Customized Web Search

FF - prefs.js: browser.startup.homepage - hxxp://search.conduit.com/?ctid=CT3244149&SearchSource=13

FF - prefs.js: keyword.URL - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT3244149&SearchSource=2&q=

FF - plugin: C:\PROGRA~2\MICROS~4\Office14\NPAUTHZ.DLL

FF - plugin: C:\PROGRA~2\MICROS~4\Office14\NPSPWRAP.DLL

FF - plugin: C:\Program Files (x86)\Common Files\Research In Motion\BBWebSLLauncher\NPWebSLLauncher.dll

FF - plugin: C:\Program Files (x86)\Google\Picasa3\npPicasa3.dll

FF - plugin: C:\Program Files (x86)\Java\jre6\bin\new_plugin\npdeployJava1.dll

FF - plugin: c:\Program Files (x86)\Microsoft Silverlight\4.0.50401.0\npctrlui.dll

FF - plugin: C:\Program Files (x86)\Mozilla Firefox\plugins\npicaN.dll

FF - plugin: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll

FF - plugin: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll

FF - plugin: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll

FF - plugin: C:\Users\mherwig\AppData\Roaming\Mozilla\Firefox\Profiles\7tz7rliw.default\extensions\{462be121-2b54-4218-bf00-b9bf8135b23f}\plugins\np-mswmp.dll

FF - plugin: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_3_300_271.dll

.

---- FIREFOX POLICIES ----

user_pref('extensions.autoDisableScopes', 0);user_pref('security.csp.enable', false);user_pref('security.OCSP.enabled', 0);

============= SERVICES / DRIVERS ===============

.

R0 nvpciflt;nvpciflt;C:\Windows\system32\DRIVERS\nvpciflt.sys --> C:\Windows\system32\DRIVERS\nvpciflt.sys [?]

R0 PxHlpa64;PxHlpa64;C:\Windows\system32\Drivers\PxHlpa64.sys --> C:\Windows\system32\Drivers\PxHlpa64.sys [?]

R0 stdcfltn;Disk Class Filter Driver for Accelerometer;C:\Windows\system32\DRIVERS\stdcfltn.sys --> C:\Windows\system32\DRIVERS\stdcfltn.sys [?]

R1 ctxusbm;Citrix USB Monitor Driver;C:\Windows\system32\DRIVERS\ctxusbm.sys --> C:\Windows\system32\DRIVERS\ctxusbm.sys [?]

R1 vwififlt;Virtual WiFi Filter Driver;C:\Windows\system32\DRIVERS\vwififlt.sys --> C:\Windows\system32\DRIVERS\vwififlt.sys [?]

R2 AESTFilters;Andrea ST Filters Service;C:\Program Files\IDT\WDM\AESTSr64.exe [2011-7-19 89600]

R2 Credential Vault Host Control Service;Credential Vault Host Control Service;C:\Program Files\Broadcom Corporation\Broadcom USH Host Components\CV\bin\HostControlService.exe [2010-10-28 1035680]

R2 Credential Vault Host Storage;Credential Vault Host Storage;C:\Program Files\Broadcom Corporation\Broadcom USH Host Components\CV\bin\HostStorageService.exe [2010-10-28 36768]

R2 dcpsysmgrsvc;Dell System Manager Service;C:\Program Files\Dell\Dell System Manager\DCPSysMgrSvc.exe [2011-1-20 517488]

R2 DMAgent;Intel® PROSet/Wireless WiMAX Red Bend Device Management Service;C:\Program Files\Intel\WiMAX\Bin\DMAgent.exe [2010-11-7 499200]

R2 Intel® PROSet Monitoring Service;Intel® PROSet Monitoring Service;C:\Windows\system32\IProsetMonitor.exe --> C:\Windows\system32\IProsetMonitor.exe [?]

R2 jhi_service;Intel® Identity Protection Technology Host Interface Service;C:\Program Files (x86)\Intel\Services\IPT\jhi_service.exe [2011-2-24 212944]

R2 lxea_device;lxea_device;C:\Windows\system32\lxeacoms.exe -service --> C:\Windows\system32\lxeacoms.exe -service [?]

R2 MBAMScheduler;MBAMScheduler;C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [2012-9-16 399432]

R2 MBAMService;MBAMService;C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2012-9-16 676936]

R2 NitroDriverReadSpool;NitroPDFDriverCreatorReadSpool;C:\Program Files\Common Files\Nitro PDF\Professional\6.0\NitroPDFDriverServicex64.exe [2011-1-31 341312]

R2 nlsX86cc;NLS Service;C:\Windows\SysWOW64\NLSSRV32.EXE [2011-1-31 68928]

R2 O2SDIOAssist;O2SDIOAssist;C:\Windows\SysWOW64\srvany.exe [2011-7-18 8192]

R2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [2011-6-5 378472]

R2 Symantec AntiVirus;Symantec Endpoint Protection;C:\Program Files (x86)\Symantec\Symantec Endpoint Protection\Rtvscan.exe [2010-4-23 1831024]

R2 UNS;Intel® Management and Security Application User Notification Service;C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe [2011-7-18 2656280]

R2 WiMAXAppSrv;Intel® PROSet/Wireless WiMAX Service;C:\Program Files\Intel\WiMAX\Bin\AppSrv.exe [2010-11-7 869376]

R2 ZcfgSvc7;Intel® PROSet/Wireless ZeroConfig Service;C:\Program Files\Intel\WiFi\bin\ZCfgSvc7.exe [2010-12-23 992256]

R3 Acceler;Accelerometer Service;C:\Windows\system32\DRIVERS\Accelern.sys --> C:\Windows\system32\DRIVERS\Accelern.sys [?]

R3 bpenum;Intel® Centrino® WiMAX Enumerator;C:\Windows\system32\DRIVERS\bpenum.sys --> C:\Windows\system32\DRIVERS\bpenum.sys [?]

R3 bpmp;Intel® Centrino® WiMAX 6050 Series;C:\Windows\system32\DRIVERS\bpmp.sys --> C:\Windows\system32\DRIVERS\bpmp.sys [?]

R3 bpusb;Intel® Centrino® WiMAX 6050 Series Function Driver;C:\Windows\system32\Drivers\bpusb.sys --> C:\Windows\system32\Drivers\bpusb.sys [?]

R3 BTWAMPFL;BTWAMPFL;C:\Windows\system32\DRIVERS\btwampfl.sys --> C:\Windows\system32\DRIVERS\btwampfl.sys [?]

R3 btwl2cap;Bluetooth L2CAP Service;C:\Windows\system32\DRIVERS\btwl2cap.sys --> C:\Windows\system32\DRIVERS\btwl2cap.sys [?]

R3 CtClsFlt;Creative Camera Class Upper Filter Driver;C:\Windows\system32\DRIVERS\CtClsFlt.sys --> C:\Windows\system32\DRIVERS\CtClsFlt.sys [?]

R3 cvusbdrv;Dell ControlVault;C:\Windows\system32\Drivers\cvusbdrv.sys --> C:\Windows\system32\Drivers\cvusbdrv.sys [?]

R3 e1cexpress;Intel® PRO/1000 PCI Express Network Connection Driver C;C:\Windows\system32\DRIVERS\e1c62x64.sys --> C:\Windows\system32\DRIVERS\e1c62x64.sys [?]

R3 EraserUtilRebootDrv;EraserUtilRebootDrv;C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [2012-8-14 138912]

R3 MBAMProtector;MBAMProtector;\??\C:\Windows\system32\drivers\mbam.sys --> C:\Windows\system32\drivers\mbam.sys [?]

R3 MEIx64;Intel® Management Engine Interface;C:\Windows\system32\DRIVERS\HECIx64.sys --> C:\Windows\system32\DRIVERS\HECIx64.sys [?]

R3 NETwNs64;___ Intel® Wireless WiFi Link 5000 Series Adapter Driver for Windows 7 - 64 Bit;C:\Windows\system32\DRIVERS\NETwNs64.sys --> C:\Windows\system32\DRIVERS\NETwNs64.sys [?]

R3 NVHDA;Service for NVIDIA High Definition Audio Driver;C:\Windows\system32\drivers\nvhda64v.sys --> C:\Windows\system32\drivers\nvhda64v.sys [?]

R3 O2MDRRDR;O2MDRRDR;C:\Windows\system32\DRIVERS\O2MDRw7x64.sys --> C:\Windows\system32\DRIVERS\O2MDRw7x64.sys [?]

R3 O2SDJRDR;O2SDJRDR;C:\Windows\system32\DRIVERS\o2sdjw7x64.sys --> C:\Windows\system32\DRIVERS\o2sdjw7x64.sys [?]

S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]

S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-3-18 138576]

S2 lxeaCATSCustConnectService;lxeaCATSCustConnectService;C:\Windows\System32\spool\DRIVERS\x64\3\lxeaserv.exe [2012-1-22 45736]

S2 nvUpdatusService;NVIDIA Update Service Daemon;C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe [2011-7-19 1997416]

S2 RoxWatch12;Roxio Hard Drive Watcher 12;C:\Program Files (x86)\Common Files\Roxio Shared\OEM\12.0\SharedCOM\RoxWatch12OEM.exe [2010-11-25 219632]

S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-4-3 250056]

S3 dmvsc;dmvsc;C:\Windows\system32\drivers\dmvsc.sys --> C:\Windows\system32\drivers\dmvsc.sys [?]

S3 McComponentHostService;McAfee Security Scan Component Host Service;C:\Program Files (x86)\McAfee Security Scan\2.0.181\McCHSvc.exe [2010-1-15 227232]

S3 Microsoft SharePoint Workspace Audit Service;Microsoft SharePoint Workspace Audit Service;C:\Program Files\Microsoft Office\Office14\GROOVE.EXE [2010-3-25 51456888]

S3 MIPushAlertService;MIPushAlertService;C:\Program Files (x86)\MISys\MISys SBM\MISys SBM 5.0 Server\MISys Push Alert Service\PushAlertService.exe [2011-7-14 30720]

S3 MozillaMaintenance;Mozilla Maintenance Service;C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe [2012-5-4 113120]

S3 netvsc;netvsc;C:\Windows\system32\DRIVERS\netvsc60.sys --> C:\Windows\system32\DRIVERS\netvsc60.sys [?]

S3 O2MDFRDR;O2MDFRDR;C:\Windows\system32\drivers\O2MDFw7x64.sys --> C:\Windows\system32\drivers\O2MDFw7x64.sys [?]

S3 ose64;Office 64 Source Engine;C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2010-1-9 174440]

S3 osppsvc;Office Software Protection Platform;C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-1-9 4925184]

S3 RoxMediaDB12OEM;RoxMediaDB12OEM;C:\Program Files (x86)\Common Files\Roxio Shared\OEM\12.0\SharedCOM\RoxMediaDB12OEM.exe [2010-11-25 1116656]

S3 StorSvc;Storage Service;C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted [2009-7-13 20992]

S3 SynthVid;SynthVid;C:\Windows\system32\DRIVERS\VMBusVideoM.sys --> C:\Windows\system32\DRIVERS\VMBusVideoM.sys [?]

S3 TsUsbFlt;TsUsbFlt;C:\Windows\system32\drivers\tsusbflt.sys --> C:\Windows\system32\drivers\tsusbflt.sys [?]

S3 TsUsbGD;Remote Desktop Generic USB Device;C:\Windows\system32\drivers\TsUsbGD.sys --> C:\Windows\system32\drivers\TsUsbGD.sys [?]

S3 USBAAPL64;Apple Mobile USB Driver;C:\Windows\system32\Drivers\usbaapl64.sys --> C:\Windows\system32\Drivers\usbaapl64.sys [?]

S3 WatAdminSvc;Windows Activation Technologies Service;C:\Windows\system32\Wat\WatAdminSvc.exe --> C:\Windows\system32\Wat\WatAdminSvc.exe [?]

S4 wlcrasvc;Windows Live Mesh remote connections service;C:\Program Files\Windows Live\Mesh\wlcrasvc.exe [2010-9-22 57184]

.

=============== Created Last 30 ================

.

2012-09-17 02:32:48 -------- d-----w- C:\Users\mherwig\.smplayer

2012-09-17 02:23:44 -------- d-----w- C:\Users\mherwig\AppData\Roaming\Malwarebytes

2012-09-17 02:23:37 25928 ----a-w- C:\Windows\System32\drivers\mbam.sys

2012-09-17 02:23:37 -------- d-----w- C:\ProgramData\Malwarebytes

2012-09-17 02:23:37 -------- d-----w- C:\Program Files (x86)\Malwarebytes' Anti-Malware

2012-09-17 02:10:05 -------- d-----w- C:\Users\mherwig\AppData\Roaming\Fighters

2012-09-17 02:10:03 -------- d-----w- C:\ProgramData\Fighters

2012-09-17 02:05:47 -------- d-----w- C:\Program Files (x86)\OApps

2012-09-02 04:34:15 -------- d-----w- C:\Users\mherwig\AppData\Roaming\WindSolutions

2012-09-02 04:34:15 -------- d-----w- C:\ProgramData\WindSolutions

2012-09-02 03:38:18 -------- d-----w- C:\Users\mherwig\AppData\Local\Apple Computer

2012-09-02 03:38:09 34152 ----a-w- C:\Windows\System32\drivers\GEARAspiWDM.sys

2012-09-02 03:38:09 126312 ----a-w- C:\Windows\System32\GEARAspi64.dll

2012-09-02 03:38:09 107368 ----a-w- C:\Windows\SysWow64\GEARAspi.dll

2012-09-02 03:37:44 -------- d-----w- C:\Program Files\iPod

2012-09-02 03:37:42 -------- d-----w- C:\ProgramData\{93E26451-CD9A-43A5-A2FA-C42392EA4001}

2012-09-02 03:37:42 -------- d-----w- C:\Program Files\iTunes

2012-09-02 03:37:42 -------- d-----w- C:\Program Files (x86)\iTunes

2012-09-02 03:37:03 -------- d-----w- C:\Users\mherwig\AppData\Local\Apple

2012-09-02 03:36:26 -------- d-----w- C:\Program Files\Bonjour

2012-09-02 03:36:26 -------- d-----w- C:\Program Files (x86)\Bonjour

2012-08-19 03:14:16 770384 ----a-w- C:\Program Files (x86)\Mozilla Firefox\msvcr100.dll

2012-08-19 03:14:16 421200 ----a-w- C:\Program Files (x86)\Mozilla Firefox\msvcp100.dll

.

==================== Find3M ====================

.

2012-08-19 04:02:08 70344 ----a-w- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl

2012-08-19 04:02:08 426184 ----a-w- C:\Windows\SysWow64\FlashPlayerApp.exe

.

============= FINISH: 22:54:14.34 ===============

.

UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.

IF REQUESTED, ZIP IT UP & ATTACH IT

.

DDS (Ver_2011-08-26.01)

.

Microsoft Windows 7 Professional

Boot Device: \Device\HarddiskVolume2

Install Date: 11/16/2011 1:49:45 PM

System Uptime: 9/17/2012 8:00:50 PM (2 hours ago)

.

Motherboard: Dell Inc. | | 0J4TFW

Processor: Intel® Core i7-2720QM CPU @ 2.20GHz | CPU 1 | 2201/100mhz

.

==== Disk Partitions =========================

.

C: is FIXED (NTFS) - 288 GiB total, 200.069 GiB free.

D: is CDROM ()

.

==== Disabled Device Manager Items =============

.

Class GUID: {4d36e972-e325-11ce-bfc1-08002be10318}

Description: Bluetooth Device (Personal Area Network)

Device ID: BTH\MS_BTHPAN\7&3B379ECB&0&2

Manufacturer: Microsoft

Name: Bluetooth Device (Personal Area Network)

PNP Device ID: BTH\MS_BTHPAN\7&3B379ECB&0&2

Service: BthPan

.

==== System Restore Points ===================

.

RP129: 5/3/2012 11:26:07 AM - Scheduled Checkpoint

RP130: 5/14/2012 8:20:41 PM - Windows Backup

RP131: 5/28/2012 9:00:20 PM - Windows Backup

RP132: 6/20/2012 10:09:25 PM - Windows Update

RP133: 8/14/2012 12:15:42 PM - Installed BlackBerry Desktop Software.

RP134: 9/1/2012 11:37:08 PM - Installed iTunes

RP135: 9/11/2012 10:37:54 PM - Installed Asoftech Photo Recovery

RP136: 9/16/2012 10:12:02 PM - Removed Asoftech Photo Recovery

.

==== Installed Programs ======================

.

ABBYY FineReader 6.0 Sprint

AccelerometerP11

Adobe Flash Player 11 ActiveX

Adobe Flash Player 11 Plugin

Adobe Reader X

Apple Application Support

Apple Software Update

BlackBerry Desktop Software 7.1

Citrix online plug-in - web

Citrix online plug-in (DV)

Citrix online plug-in (HDX)

Citrix online plug-in (USB)

Citrix online plug-in (Web)

connectivity.cis.cpp-4.0-core-32

connectivity.connectionserver.client.http.cpp-4.0-core-32

connectivity.connectionserver.client.httpxir3.cpp-4.0-core-32

connectivity.connectionserver.core.helpers.cpp-4.0-core-32

connectivity.connectionserver.drivers.informix.odbc-4.0-core-32

connectivity.connectionserver.drivers.informix.odbc.config-4.0-core-nu

connectivity.connectionserver.drivers.informix.odbc.config-4.0-en-nu

connectivity.connectionserver.drivers.jdbc.core-4.0-core-nu

connectivity.connectionserver.drivers.jdbc.core.config-4.0-core-nu

connectivity.connectionserver.drivers.jdbc.core.config-4.0-en-nu

connectivity.connectionserver.drivers.mysql.jdbc-4.0-core-nu

connectivity.connectionserver.drivers.mysql.jdbc-4.0-en-nu

connectivity.connectionserver.drivers.mysql.odbc-4.0-core-32

connectivity.connectionserver.drivers.mysql.odbc.config-4.0-core-nu

connectivity.connectionserver.drivers.mysql.odbc.config-4.0-en-nu

connectivity.connectionserver.drivers.neoview.odbc-4.0-core-32

connectivity.connectionserver.drivers.neoview.odbc.config-4.0-core-nu

connectivity.connectionserver.drivers.neoview.odbc.config-4.0-en-nu

connectivity.connectionserver.drivers.netezza.jdbc-4.0-core-nu

connectivity.connectionserver.drivers.netezza.jdbc-4.0-en-nu

connectivity.connectionserver.drivers.netezza.odbc-4.0-core-32

connectivity.connectionserver.drivers.netezza.odbc.config-4.0-core-nu

connectivity.connectionserver.drivers.netezza.odbc.config-4.0-en-nu

connectivity.connectionserver.drivers.odbc.core-4.0-core-32

connectivity.connectionserver.drivers.odbc.core.config-4.0-core-nu

connectivity.connectionserver.drivers.odbc.core.config-4.0-en-nu

connectivity.connectionserver.drivers.progress.jdbc-4.0-core-nu

connectivity.connectionserver.drivers.progress.jdbc-4.0-en-nu

connectivity.connectionserver.drivers.progress.odbc-4.0-core-32

connectivity.connectionserver.drivers.progress.odbc.config-4.0-core-32

connectivity.connectionserver.drivers.progress.odbc.config-4.0-en-32

connectivity.connectionserver.drivers.sybase.ctlib-4.0-core-32

connectivity.connectionserver.drivers.sybase.ctlib.config-4.0-core-nu

connectivity.connectionserver.drivers.sybase.ctlib.config-4.0-en-nu

connectivity.connectionserver.drivers.teradata.jdbc-4.0-core-nu

connectivity.connectionserver.drivers.teradata.jdbc-4.0-en-nu

connectivity.connectionserver.drivers.teradata.odbc-4.0-core-32

connectivity.connectionserver.drivers.teradata.odbc.config-4.0-core-nu

connectivity.connectionserver.drivers.teradata.odbc.config-4.0-en-nu

connectivity.connectionserver.helpers.cpp-4.0-core-32

connectivity.connectionserver.plugin.http.cpp-4.0-core-32

connectivity.connectionserver.server.bridge.cpp-4.0-core-32

connectivity.connectionserver.tools.cscheck-4.0-core-32

connectivity.connectionserver.tools.cscheck-4.0-en-32

connectivity.connectionserver.tools.cscheck.config-4.0-core-nu

connectivity.foundation.cpp-4.0-core-32

CopyTrans Suite Remove Only

Crystal Reports 2011

crystalreports.boe.sdkplugins.java-4.0-core-nu

crystalreports.boe.sdkplugins.java-4.0-en-nu

crystalreports.boe.sdkplugins.java.crlov-4.0-core-nu

crystalreports.boe.sdkplugins.java.managedreports-4.0-core-nu

crystalreports.boe.serviceplugins.pss.java-4.0-core-nu

crystalreports.cpp.businessview.clients.crw-4.0-core-32

crystalreports.cpp.businessview.clients.crw-4.0-en-32

crystalreports.cpp.businessview.sdk-4.0-core-32

crystalreports.cpp.businessview.sdk-4.0-en-32

crystalreports.cpp.charthelp-4.0-en-32

crystalreports.cpp.cractivexviewer-4.0-core-32

crystalreports.cpp.cractivexviewer-4.0-en-32

crystalreports.cpp.cslib-4.0-core-32

crystalreports.cpp.designer-4.0-core-32

crystalreports.cpp.designer-4.0-en-32

crystalreports.cpp.erom-4.0-core-32

crystalreports.cpp.erom-4.0-en-32

crystalreports.cpp.exporting.expmod-4.0-core-32

crystalreports.cpp.exporting.u2dapp-4.0-core-32

crystalreports.cpp.exporting.u2dapp-4.0-en-32

crystalreports.cpp.exporting.u2ddisk-4.0-core-32

crystalreports.cpp.exporting.u2ddisk-4.0-en-32

crystalreports.cpp.exporting.u2dmapi-4.0-core-32

crystalreports.cpp.exporting.u2dmapi-4.0-en-32

crystalreports.cpp.exporting.u2dnotes-4.0-core-32

crystalreports.cpp.exporting.u2dnotes-4.0-en-32

crystalreports.cpp.exporting.u2dpost-4.0-core-32

crystalreports.cpp.exporting.u2dpost-4.0-en-32

crystalreports.cpp.exporting.u2dvim-4.0-core-32

crystalreports.cpp.exporting.u2dvim-4.0-en-32

crystalreports.cpp.exporting.u2fcr-4.0-core-32

crystalreports.cpp.exporting.u2fcr-4.0-en-32

crystalreports.cpp.exporting.u2fhtml-4.0-core-32

crystalreports.cpp.exporting.u2fhtml-4.0-en-32

crystalreports.cpp.exporting.u2fodbc-4.0-core-32

crystalreports.cpp.exporting.u2fodbc-4.0-en-32

crystalreports.cpp.exporting.u2fpdf-4.0-core-32

crystalreports.cpp.exporting.u2fpdf-4.0-en-32

crystalreports.cpp.exporting.u2frdef-4.0-core-32

crystalreports.cpp.exporting.u2frdef-4.0-en-32

crystalreports.cpp.exporting.u2frec-4.0-core-32

crystalreports.cpp.exporting.u2frec-4.0-en-32

crystalreports.cpp.exporting.u2frtf-4.0-core-32

crystalreports.cpp.exporting.u2frtf-4.0-en-32

crystalreports.cpp.exporting.u2fsepv-4.0-core-32

crystalreports.cpp.exporting.u2fsepv-4.0-en-32

crystalreports.cpp.exporting.u2ftext-4.0-core-32

crystalreports.cpp.exporting.u2ftext-4.0-en-32

crystalreports.cpp.exporting.u2fwordw-4.0-core-32

crystalreports.cpp.exporting.u2fwordw-4.0-en-32

crystalreports.cpp.exporting.u2fxls-4.0-core-32

crystalreports.cpp.exporting.u2fxls-4.0-en-32

crystalreports.cpp.exporting.u2fxml-4.0-core-32

crystalreports.cpp.exporting.u2fxml-4.0-en-32

crystalreports.cpp.exporting.u2fxml2-4.0-core-32

crystalreports.cpp.exporting.u2fxml2-4.0-en-32

crystalreports.cpp.filedialog-4.0-core-32

crystalreports.cpp.filedialog-4.0-en-32

crystalreports.cpp.help-4.0-core-32

crystalreports.cpp.help-4.0-en-32

crystalreports.cpp.keycode.defn-4.0-core-nu

crystalreports.cpp.parameterprompt-4.0-core-32

crystalreports.cpp.parameterprompt-4.0-en-32

crystalreports.cpp.printcontrol-4.0-core-32

crystalreports.cpp.printcontrol-4.0-en-32

crystalreports.cpp.ras.bv-4.0-core-32

crystalreports.cpp.ras.bv-4.0-en-32

crystalreports.cpp.registrywrapper-4.0-core-32

crystalreports.cpp.runtimeshare-4.0-core-32

crystalreports.cpp.runtimeshare-4.0-en-32

crystalreports.cpp.saptoolbar-4.0-core-32

crystalreports.cpp.saptoolbar-4.0-en-32

crystalreports.cpp.share-4.0-core-32

crystalreports.cpp.share-4.0-en-32

crystalreports.cpp.share.registry-4.0-core-32

crystalreports.crystalcommon.cpp.crjavaconfig-4.0-core-nu

crystalreports.crystalcommon.cpp.crlang-4.0-core-32

crystalreports.crystalcommon.cpp.crlogger-4.0-core-32

crystalreports.crystalcommon.dotnet-4.0-core-32

crystalreports.dataaccess.driver.access-4.0-core-32

crystalreports.dataaccess.driver.access-4.0-en-32

crystalreports.dataaccess.driver.act-4.0-core-32

crystalreports.dataaccess.driver.act-4.0-en-32

crystalreports.dataaccess.driver.ado-4.0-core-32

crystalreports.dataaccess.driver.ado-4.0-en-32

crystalreports.dataaccess.driver.adodotnetinterop-4.0-core-32

crystalreports.dataaccess.driver.adoplus-4.0-core-32

crystalreports.dataaccess.driver.adoplus-4.0-en-32

crystalreports.dataaccess.driver.btrieve-4.0-core-32

crystalreports.dataaccess.driver.btrieve-4.0-en-32

crystalreports.dataaccess.driver.com-4.0-core-32

crystalreports.dataaccess.driver.com-4.0-en-32

crystalreports.dataaccess.driver.db2-4.0-core-32

crystalreports.dataaccess.driver.db2-4.0-en-32

crystalreports.dataaccess.driver.ebs-4.0-core-32

crystalreports.dataaccess.driver.fielddef-4.0-core-32

crystalreports.dataaccess.driver.fielddef-4.0-en-32

crystalreports.dataaccess.driver.filesystem-4.0-core-32

crystalreports.dataaccess.driver.filesystem-4.0-en-32

crystalreports.dataaccess.driver.informix-4.0-core-32

crystalreports.dataaccess.driver.informix-4.0-en-32

crystalreports.dataaccess.driver.java-4.0-core-nu

crystalreports.dataaccess.driver.javabeans-4.0-core-32

crystalreports.dataaccess.driver.javabeans-4.0-en-32

crystalreports.dataaccess.driver.jdbc-4.0-core-32

crystalreports.dataaccess.driver.jdbc-4.0-en-32

crystalreports.dataaccess.driver.jde-4.0-core-32

crystalreports.dataaccess.driver.odbc-4.0-core-32

crystalreports.dataaccess.driver.odbc-4.0-en-32

crystalreports.dataaccess.driver.olap-4.0-core-32

crystalreports.dataaccess.driver.olap-4.0-en-32

crystalreports.dataaccess.driver.oracle-4.0-core-32

crystalreports.dataaccess.driver.oracle-4.0-en-32

crystalreports.dataaccess.driver.p2bbde-4.0-core-32

crystalreports.dataaccess.driver.p2bbde-4.0-en-32

crystalreports.dataaccess.driver.p2dbase-4.0-core-32

crystalreports.dataaccess.driver.p2dbase-4.0-en-32

crystalreports.dataaccess.driver.p2sevt-4.0-core-32

crystalreports.dataaccess.driver.p2sevt-4.0-en-32

crystalreports.dataaccess.driver.p2sexchange-4.0-core-32

crystalreports.dataaccess.driver.p2sexchange-4.0-en-32

crystalreports.dataaccess.driver.p2slog-4.0-core-32

crystalreports.dataaccess.driver.p2slog-4.0-en-32

crystalreports.dataaccess.driver.p2soutlk-4.0-core-32

crystalreports.dataaccess.driver.p2soutlk-4.0-en-32

crystalreports.dataaccess.driver.psenterprise-4.0-core-32

crystalreports.dataaccess.driver.sap-4.0-core-32

crystalreports.dataaccess.driver.sap-4.0-en-32

crystalreports.dataaccess.driver.sforce-4.0-core-32

crystalreports.dataaccess.driver.sforce-4.0-en-32

crystalreports.dataaccess.driver.siebel-4.0-core-32

crystalreports.dataaccess.driver.sybase-4.0-core-32

crystalreports.dataaccess.driver.sybase-4.0-en-32

crystalreports.dataaccess.driver.universe-4.0-core-32

crystalreports.dataaccess.driver.universe-4.0-en-32

crystalreports.dataaccess.driver.wic-4.0-core-32

crystalreports.dataaccess.driver.wic-4.0-en-32

crystalreports.dataaccess.driver.xml-4.0-core-32

crystalreports.dataaccess.driver.xml-4.0-en-32

crystalreports.dataaccess.querybuilder-4.0-core-32

crystalreports.dataaccess.querybuilder-4.0-en-32

crystalreports.dataaccess.share-4.0-core-32

crystalreports.dataaccess.share-4.0-en-32

crystalreports.dataaccess.share.registry-4.0-core-32

crystalreports.designers.java.launcher-4.0-core-32

crystalreports.partner.shared.cpp-4.0-core-32

crystalreports.partner.shared.cpp-4.0-en-32

crystalreports.partner.shared.cpp.pvlmapping-4.0-core-32

crystalreports.partner.shared.java.jde-4.0-core-nu

crystalreports.partner.shared.java.siebel-4.0-core-nu

crystalreports.rptpubwiz.cpp-4.0-core-32

crystalreports.rptpubwiz.cpp-4.0-en-32

crystalreports.rptpubwiz.cpp.help-4.0-core-32

crystalreports.sdk.java.repository-4.0-core-nu

crystalreports.sdk.java.sdkcommon-4.0-core-nu

crystalreports.webreporting.common-4.0-core-nu

crystalreports.webreporting.common-4.0-en-nu

cvom.java-4.0-core-nu

cvom.java-4.0-en-nu

cvom.java.ui_helpers-4.0-core-nu

CyberLink PowerDVD 9.5

D3DX10

Dell Data Protection | Access

Dell Data Protection | Access | Drivers

Dell Data Protection | Access | Middleware

Dell Webcam Central

DirectX 9 Runtime

fnc61_crviewer.msi

foundation.bcm.cpp-4.0-core-32

foundation.bcm.java-4.0-core-nu

foundation.bcm.java.bundle-4.0-core-nu

foundation.bcm.java.classes-4.0-core-nu

foundation.javalibs-4.0-core-nu

foundation.javalibs.bundle-4.0-core-nu

foundation.javalibs.classes-4.0-core-nu

foundation.locale_fallback.cpp-4.0-core-32

foundation.tracelog.cpp-4.0-core-32

foundation.tracelog.java-4.0-core-nu

foundation.tracelog.java.classes-4.0-core-nu

informationengine.qt.drivers.informix.odbc.config-4.0-core-nu

informationengine.qt.drivers.mysql.jdbc-4.0-core-nu

informationengine.qt.drivers.mysql.odbc.config-4.0-core-nu

informationengine.qt.drivers.neoview.odbc.config-4.0-core-nu

informationengine.qt.drivers.netezza.jdbc-4.0-core-nu

informationengine.qt.drivers.netezza.odbc.config-4.0-core-nu

informationengine.qt.drivers.progress.jdbc-4.0-core-nu

informationengine.qt.drivers.progress.odbc.config-4.0-core-32

informationengine.qt.drivers.sybase.ctlib.config-4.0-core-nu

informationengine.qt.drivers.teradata.jdbc-4.0-core-nu

informationengine.qt.drivers.teradata.odbc.config-4.0-core-nu

Intel® Control Center

Intel® Identity Protection Technology 1.1.2.0

Intel® Management Engine Components

Intel® Processor Graphics

Java Auto Updater

Java 6 Update 29

Junk Mail filter update

Lexmark Printable Web

Lexmark Toolbar

LiveUpdate 3.3 (Symantec Corporation)

Malwarebytes Anti-Malware version 1.65.0.1400

McAfee Security Scan Plus

Mesh Runtime

Microsoft Office Live Meeting 2007

Microsoft Silverlight

Microsoft SQL Server 2005 Compact Edition [ENU]

Microsoft Visual C++ 2005 Redistributable

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17

Microsoft WSE 3.0 Runtime

MISys Manufacturing 5.0

Mozilla Firefox 14.0.1 (x86 en-US)

Mozilla Maintenance Service

MSVCRT

MSVCRT_amd64

MSXML 4.0 SP2 (KB954430)

MSXML 4.0 SP2 (KB973688)

MSXML 4.0 SP2 Parser and SDK

NVIDIA Stereoscopic 3D Driver

O2Micro Flash Memory Card Windows Driver

olap.analysis.implementation.cpp.activex-4.0-core-32

olap.analysis.implementation.cpp.sofa-4.0-core-32

PhotoShowExpress

Picasa 3

platform.client.java.helper.supportability-4.0-core-nu

platform.library.common-4.0-core-32

platform.library.common.authentication.jdedwards-4.0-core-32

platform.library.common.authentication.jdedwards-4.0-en-32

platform.library.common.authentication.jdedwards.java-4.0-core-nu

platform.library.common.authentication.oracle-4.0-core-32

platform.library.common.authentication.peoplesoft-4.0-core-32

platform.library.common.authentication.sap-4.0-core-32

platform.library.common.authentication.siebel-4.0-core-32

platform.library.common.authentication.siebel-4.0-en-32

platform.library.common.authentication.siebel.java-4.0-core-nu

platform.sdk.boe.com-4.0-core-32

platform.sdk.boe.com-4.0-en-32

platform.sdk.boe.com.core-4.0-core-32

platform.sdk.boe.com.instrumentation-4.0-core-nu

platform.sdk.boe.com.slplugins-4.0-core-32

platform.sdk.boe.com.slplugins.pinfiles-4.0-core-nu

platform.sdk.boe.java-4.0-core-nu

platform.sdk.boe.java.bundles-4.0-core-nu

platform.sdk.boe.java.classes-4.0-core-nu

platform.sdk.boe.java.dfo.util-4.0-core-nu

platform.sdk.boe.java.jdedwards-4.0-core-nu

platform.sdk.boe.java.jdedwards.plugins_bundle-4.0-core-nu

platform.sdk.boe.java.oracle-4.0-core-nu

platform.sdk.boe.java.oracle.plugins_bundle-4.0-core-nu

platform.sdk.boe.java.pbds-4.0-core-nu

platform.sdk.boe.java.pbds_full-4.0-core-nu

platform.sdk.boe.java.peoplesoft-4.0-core-nu

platform.sdk.boe.java.peoplesoft.plugins_bundle-4.0-core-nu

platform.sdk.boe.java.sap-4.0-core-nu

platform.sdk.boe.java.sap.plugins_bundle-4.0-core-nu

platform.sdk.boe.java.siebel-4.0-core-nu

platform.sdk.boe.java.siebel.plugins_bundle-4.0-core-nu

platform.services.ras21.clientsdk.java-4.0-core-nu

platform.services.ras21.clientsdk.java.pbd-4.0-core-nu

platform.services.ras21.clientsdk_bundle-4.0-core-nu

platform.services.ras21.clientsdk_shared_bundle-4.0-core-nu

product.crystalreports.arp-4.0-core-32

product.crystalreports.eula-4.0-core-32

product.crystalreports.langpackproperty-4.0-en-nu

product.shared.installiverse.reg-4.0-core-nu

product.shared.langpackreg-4.0-core-nu

repoaccess.async_scheduling-4.0-core-32

repoaccess.async_scheduling-4.0-en-32

repoaccess.bo_storage-4.0-core-32

repoaccess.cdztools-4.0-core-32

repoaccess.cdztools-4.0-en-32

repoaccess.cdztools.java-4.0-core-nu

repoaccess.cdztools.jshell-4.0-core-nu

repoaccess.container-4.0-core-32

repoaccess.container.admintool.java-4.0-core-nu

repoaccess.container.java-4.0-core-nu

repoaccess.repo_proxy.cpp-4.0-core-32

Required Runtimes

Roxio Activation Module

Roxio BackOnTrack

Roxio Burn

Roxio Creator Starter

Roxio Express Labeler 3

SAP Crystal Reports runtime engine for .NET Framework 4 (32-bit)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2446708)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2478663)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2518870)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2539636)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2572078)

Security Update for Microsoft .NET Framework 4 Extended (KB2416472)

Security Update for Microsoft .NET Framework 4 Extended (KB2487367)

setup.engine.sharedregistry-4.0-core-32

shared.library.content-4.0-core-32

shared.library.content-4.0-en-32

shared.library.cxlib.cxlib-4.0-core-32

shared.library.keycode.decoder.cpp-4.0-core-32

shared.library.keycode.defn-4.0-core-32

shared.library.keycode.licmgr-4.0-core-32

shared.library.keycode.licmgr-4.0-en-32

Skype Click to Call

Skype™ 5.5

Sonic CinePlayer Decoder Pack

tools.astools.cpp-4.0-core-32

tools.i18n4j-4.0-core-nu

tools.srvtools-4.0-core-32

tools.wstk-4.0-core-32

tools.wstk.java-4.0-core-nu

tools.wstk.webcontent-4.0-core-nu

tp.apache.axis-1.3-core-nu

tp.apache.axis2-1.3-core-nu

tp.apache.axis2.bundle-1.3-core-nu

tp.apache.axis2.classes-1.3-core-nu

tp.apache.commons.java-3.1-core-nu

tp.apache.commons.java.classes-3.1-core-nu

tp.apache.derby-10.2.2.0-core-nu

tp.apache.derby.classes-10.2.2.0-core-nu

tp.apache.log4j-1.2.6_sap.1-core-nu

tp.apache.log4j.bundle-1.2.6_sap.1-core-nu

tp.apache.log4j.classes-1.2.6_sap.1-core-nu

tp.apache.log4j.nteventlogappender-1.2.6_sap.1-core-32

tp.apache.rampart-1.3-core-nu

tp.apache.rampart.classes-1.3-core-nu

tp.apache.xalan.cpp-1.10.0-core-32

tp.apache.xalan.java-2.5.2-core-nu

tp.apache.xalan.java.classes-2.5.2-core-nu

tp.apache.xbean-2.1.0-core-nu

tp.apache.xerces.cpp-2.1.0-core-32

tp.apache.xerces.cpp-2.7.0-core-32

tp.apache.xerces.java-2.6.2-core-nu

tp.apache.xerces.java.classes-2.6.2-core-nu

tp.azalea-5.5-core-32

tp.azalea.fonts-5.5-core-nu

tp.cup-0.11-core-nu

tp.curl.cpp-7.13.2-core-32

tp.datadirect.cpp-6.0-core-32

tp.eclipse.aspectj-1.6.5-core-nu

tp.eclipse.aspectj.classes-1.6.5-core-nu

tp.gzip-1.2.3-core-32

tp.ibm.icu.cpp-3.0.1-core-32

tp.ibm.icu.cpp-4.2.1-core-32

tp.ibm.icu.java-3.8.1-core-nu

tp.libxml2-2.0-core-32

tp.mapinfo.mapx.cpp-3.5-core-32

tp.microsoft.mssdk-10.0-core-32

tp.microsoft.office.stdole-11.0-core-32

tp.netegrity.siteminder.cpp.smagent-6.0-core-32

tp.netscape.ldap.cpp-6.0.5-core-32

tp.netscape.ldap.cpp.mozjavascript-6.0.5-core-32

tp.ooc.cpp-3.3.2-core-32

tp.ooc.java-4.0.5-core-nu

tp.ooc.java.bundle-4.0.5-core-nu

tp.ooc.java.classes-4.0.5-core-nu

tp.openssl-0.9.8l-core-32

tp.pervasive.db.btrieve-3.0-core-32

tp.pkware.cpp-1.0-core-32

tp.poco-1.3.6-core-32

tp.rosette-4.2.1-core-32

tp.rsa.crypto-6.3-core-32

tp.rsa.crypto.cpp-3.2.1.2-core-32

tp.rsa.crypto.java-4.1-core-nu

tp.rsa.crypto.java.classes-4.1-core-nu

tp.salesforce-9.0-core-nu

tp.sap.introscope-822-core-nu

tp.sap.ljs.passport-0.7.0-core-nu

tp.sap.ljs.passport.classes-0.7.0-core-nu

tp.sap.ncs-720-core-32

tp.sap.nwrfc-711-core-32

tp.sap.rfcsdku-70-core-32

tp.shared.pvlocale.pvlocale-4.0-core-32

tp.sourceforge.libpng.cpp-1.0.30-core-32

tp.sun-1.1-core-nu

tp.sun.classes-1.1-core-nu

tp.sun.jdk-1.6-core-32

tp.sun.jdk.jre-1.6-core-32

tp.threedgraphics.pgsdk.cpp-2.50.16.busobj.1-core-32

tp.threedgraphics.pgsdk.cpp-2.50.16.busobj.1-en-32

tp.threedgraphics.pgsdk.cpp.chartsupport-2.50.16.busobj.1-core-nu

tp.threedgraphics.pgsdk.cpp.runtime-2.50.16.busobj.1-core-32

tp.threedgraphics.pgsdk.cpp.runtime-2.50.16.busobj.1-en-32

tp.utexasaustin.hoard-3.7.1-core-32

tp.xpp3-1.1.3.8-core-nu

tp.xpp3.bundle-1.1.3.8-core-nu

tp.xpp3.classes-1.1.3.8-core-nu

Update for Microsoft .NET Framework 4 Client Profile (KB2468871)

Update for Microsoft .NET Framework 4 Client Profile (KB2473228)

Update for Microsoft .NET Framework 4 Client Profile (KB2533523)

Update for Microsoft .NET Framework 4 Extended (KB2468871)

Update for Microsoft .NET Framework 4 Extended (KB2533523)

Windows Live Communications Platform

Windows Live Essentials

Windows Live Installer

Windows Live Mail

Windows Live Mesh

Windows Live Mesh ActiveX Control for Remote Connections

Windows Live Messenger

Windows Live Movie Maker

Windows Live Photo Common

Windows Live Photo Gallery

Windows Live PIMT Platform

Windows Live SOXE

Windows Live SOXE Definitions

Windows Live UX Platform

Windows Live UX Platform Language Pack

Windows Live Writer

Windows Live Writer Resources

.

==== Event Viewer Messages From Past Week ========

.

9/17/2012 9:21:31 PM, Error: NETLOGON [5719] - This computer was not able to set up a secure session with a domain controller in domain BATTERY due to the following: There are currently no logon servers available to service the logon request. This may lead to authentication problems. Make sure that this computer is connected to the network. If the problem persists, please contact your domain administrator. ADDITIONAL INFO If this computer is a domain controller for the specified domain, it sets up the secure session to the primary domain controller emulator in the specified domain. Otherwise, this computer sets up the secure session to any domain controller in the specified domain.

9/16/2012 10:33:16 PM, Error: Service Control Manager [7009] - A timeout was reached (30000 milliseconds) while waiting for the Roxio Hard Drive Watcher 12 service to connect.

9/16/2012 10:33:14 PM, Error: Service Control Manager [7041] - The nvUpdatusService service was unable to log on as .\UpdatusUser with the currently configured password due to the following error: Logon failure: the user has not been granted the requested logon type at this computer. Service: nvUpdatusService Domain and account: .\UpdatusUser This service account does not have the required user right "Log on as a service." User Action Assign "Log on as a service" to the service account on this computer. You can use Local Security Settings (Secpol.msc) to do this. If this computer is a node in a cluster, check that this user right is assigned to the Cluster service account on all nodes in the cluster. If you have already assigned this user right to the service account, and the user right appears to be removed, check with your domain administrator to find out if a Group Policy object associated with this node might be removing the right.

9/16/2012 10:33:14 PM, Error: Service Control Manager [7000] - The NVIDIA Update Service Daemon service failed to start due to the following error: The service did not start due to a logon failure.

9/16/2012 10:31:24 PM, Error: Microsoft-Windows-GroupPolicy [1129] - The processing of Group Policy failed because of lack of network connectivity to a domain controller. This may be a transient condition. A success message would be generated once the machine gets connected to the domain controller and Group Policy has succesfully processed. If you do not see a success message for several hours, then contact your administrator.

9/16/2012 10:30:40 PM, Error: Service Control Manager [7009] - A timeout was reached (30000 milliseconds) while waiting for the lxeaCATSCustConnectService service to connect.

9/16/2012 10:30:40 PM, Error: Service Control Manager [7000] - The lxeaCATSCustConnectService service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.

9/16/2012 10:30:35 PM, Error: Service Control Manager [7001] - The NTRU TSS v1.2.1.34 TCS service depends on the TPM Base Services service which failed to start because of the following error: The operation completed successfully.

.

==== End Of File ===========================

Thank you for your help!!

Link to post
Share on other sites

Welcome to the forum.

Please remove any usb or external drives from the computer before you run this scan!

Please download and run RogueKiller to your desktop.

Quit all running programs.

For Windows XP, double-click to start.

For Vista or Windows 7, do a right-click on the program, select Run as Administrator to start, & when prompted Allow to run.

Click Scan to scan the system.

When the scan completes > Close out the program > Don't Fix anything!

Don't run any other options, they're not all bad!!!!!!!

Post back the report which should be located on your desktop.

~~~~~~~~~~~~~~~~~~

Next................

Please download AdwCleaner from here and save it on your Desktop.

  1. Right-click on adwcleaner.exe and select Run As Administrator to launch the application.
  2. Now click on the Search tab.
  3. Please post the contents of the log-file created in your next post.

Note: The log can also be located at C:\ >> AdwCleaner[XX].txt >> XX <-- Denotes the number of times the application has been ran, so in this should be something like R1.

MrC

Link to post
Share on other sites

Did as you said...both log files are below...

RogueKiller V8.0.3 [09/13/2012] by Tigzy

mail: tigzyRK<at>gmail<dot>com

Feedback: http://www.geekstogo.com/forum/files/file/413-roguekiller/

Blog: http://tigzyrk.blogspot.com

Operating System: Windows 7 (6.1.7601 Service Pack 1) 64 bits version

Started in : Normal mode

User : mherwig [Admin rights]

Mode : Scan -- Date : 09/17/2012 23:25:47

¤¤¤ Bad processes : 0 ¤¤¤

¤¤¤ Registry Entries : 3 ¤¤¤

[HJ SMENU] HKCU\[...]\Advanced : Start_ShowMyGames (0) -> FOUND

[HJ DESK] HKLM\[...]\NewStartPanel : {59031a47-3f72-44a7-89c5-5595fe6b30ee} (1) -> FOUND

[HJ DESK] HKLM\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> FOUND

¤¤¤ Particular Files / Folders: ¤¤¤

¤¤¤ Driver : [NOT LOADED] ¤¤¤

¤¤¤ Infection : ¤¤¤

¤¤¤ HOSTS File: ¤¤¤

--> C:\Windows\system32\drivers\etc\hosts

¤¤¤ MBR Check: ¤¤¤

+++++ PhysicalDrive0: ST320LT007-9ZV142 +++++

--- User ---

[MBR] a73769ebf2a0be21527d1c8f228bf020

[bSP] 55f31f41154a1605d0faf59ab61a0c88 : Windows Vista MBR Code

Partition table:

0 - [XXXXXX] DELL-UTIL (0xde) [VISIBLE] Offset (sectors): 63 | Size: 39 Mo

1 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 81920 | Size: 10544 Mo

2 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 21676032 | Size: 294660 Mo

User = LL1 ... OK!

User = LL2 ... OK!

Finished : << RKreport[1].txt >>

RKreport[1].txt

# AdwCleaner v2.002 - Logfile created 09/17/2012 at 23:27:28

# Updated 16/09/2012 by Xplode

# Operating system : Windows 7 Professional Service Pack 1 (64 bits)

# User : mherwig - IBPA-1164

# Boot Mode : Normal

# Running from : C:\Users\mherwig\Downloads\adwcleaner.exe

# Option [search]

***** [services] *****

***** [Files / Folders] *****

File Found : C:\Users\mherwig\AppData\Roaming\Mozilla\Firefox\Profiles\7tz7rliw.default\searchplugins\Conduit.xml

Folder Found : C:\Program Files (x86)\OApps

Folder Found : C:\Users\mherwig\AppData\Local\Temp\CT3244149

Folder Found : C:\Users\mherwig\AppData\Roaming\Mozilla\Firefox\Profiles\7tz7rliw.default\CT3244149

Folder Found : C:\Users\mherwig\AppData\Roaming\Mozilla\Firefox\Profiles\7tz7rliw.default\extensions\{462be121-2b54-4218-bf00-b9bf8135b23f}

Folder Found : C:\Users\mherwig\AppData\Roaming\Mozilla\Firefox\Profiles\7tz7rliw.default\Smartbar

Folder Found : C:\Users\mherwig\Documents\ShopToWin

***** [Registry] *****

Key Found : HKCU\Software\AppDataLow\Software\Freecause

Key Found : HKCU\Software\AppDataLow\Software\SmartBar

Key Found : HKLM\SOFTWARE\Classes\FreeCauseURLSearchHook.FCToolbarURLSearchHook

Key Found : HKLM\SOFTWARE\Classes\FreeCauseURLSearchHook.FCToolbarURLSearchHook.1

Key Found : HKLM\SOFTWARE\Classes\Interface\{79FB5FC8-44B9-4AF5-BADD-CCE547F953E5}

***** [internet Browsers] *****

-\\ Internet Explorer v9.0.8112.16421

[OK] Registry is clean.

-\\ Mozilla Firefox v14.0.1 (en-US)

Profile name : default

File : C:\Users\mherwig\AppData\Roaming\Mozilla\Firefox\Profiles\7tz7rliw.default\prefs.js

Found : user_pref("CT3244149.1000082.isPlayDisplay", "true");

Found : user_pref("CT3244149.1000082.state", "{\"state\":\"stopped\",\"text\":\"Californi...\",\"description[...]

Found : user_pref("CT3244149.ENABALE_HISTORY", "{\"dataType\":\"string\",\"data\":\"true\"}");

Found : user_pref("CT3244149.ENABLE_RETURN_WEB_SEARCH_ON_THE_PAGE", "{\"dataType\":\"string\",\"data\":\"tru[...]

Found : user_pref("CT3244149.FirstTime", "true");

Found : user_pref("CT3244149.FirstTimeFF3", "true");

Found : user_pref("CT3244149.SearchFromAddressBarUrl", "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT324[...]

Found : user_pref("CT3244149.UserID", "UN10237691019674189");

Found : user_pref("CT3244149.UserId", "55ce4531-7a4c-f49f-f785-86d091ea7c29");

Found : user_pref("CT3244149.addressBarTakeOverEnabledInHidden", "true");

Found : user_pref("CT3244149.autoDisableScopes", -1);

Found : user_pref("CT3244149.browser.search.defaultthis.engineName", true);

Found : user_pref("CT3244149.cb_experience_000", "3");

Found : user_pref("CT3244149.cb_firstuse0100", "1");

Found : user_pref("CT3244149.cbcountry_001", "US");

Found : user_pref("CT3244149.cbfirsttime", "Sun Sep 16 2012 22:05:35 GMT-0400 (Eastern Daylight Time)");

Found : user_pref("CT3244149.defaultSearch", "true");

Found : user_pref("CT3244149.embeddedsData", "[{\"appId\":\"129895725399351616\",\"apiPermissions\":{\"cross[...]

Found : user_pref("CT3244149.enableAlerts", "always");

Found : user_pref("CT3244149.enableSearchFromAddressBar", "true");

Found : user_pref("CT3244149.firstTimeDialogOpened", "true");

Found : user_pref("CT3244149.fixPageNotFoundError", "true");

Found : user_pref("CT3244149.fixPageNotFoundErrorInHidden", "true");

Found : user_pref("CT3244149.fixUrls", true);

Found : user_pref("CT3244149.hxxp___api16_starwebnet_com.pid2", "4c5873fdeebfb001");

Found : user_pref("CT3244149.hxxp___api20_starwebnet_com.pid2", "4c5873fdeebfb001");

Found : user_pref("CT3244149.hxxp___api26_starwebnet_com.pid2", "4c5873fdeebfb001");

Found : user_pref("CT3244149.hxxp___api29_starwebnet_com.pid2", "4c5873fdeebfb001");

Found : user_pref("CT3244149.hxxp___api30_starwebnet_com.pid2", "4c5873fdeebfb001");

Found : user_pref("CT3244149.hxxp___api32_starwebnet_com.pid2", "4c5873fdeebfb001");

Found : user_pref("CT3244149.hxxp___toolbar_jollywallet_com_tlb_2.APP_WIN_FEATURES", "resizable=yes, scrollb[...]

Found : user_pref("CT3244149.hxxp___toolbar_jollywallet_com_tlb_2.Affiliate_cache", "[\"c822c1b63853ed273b89[...]

Found : user_pref("CT3244149.hxxp___toolbar_jollywallet_com_tlb_2.Affiliate_defaultGui", "{\"gui\":[{\"type\[...]

Found : user_pref("CT3244149.hxxp___toolbar_jollywallet_com_tlb_2.Affiliate_settings", "{\"initUrl\":\"hxxp:[...]

Found : user_pref("CT3244149.hxxp___www_socialgrowthtechnologies_com_couponbuddy_v001.APP_WIN_FEATURES", "op[...]

Found : user_pref("CT3244149.installId", "155");

Found : user_pref("CT3244149.installType", "ConduitNSISIntegration");

Found : user_pref("CT3244149.isEnableAllDialogs", "{\"dataType\":\"string\",\"data\":\"true\"}");

Found : user_pref("CT3244149.isNewTabEnabled", true);

Found : user_pref("CT3244149.isPerformedSmartBarTransition", "true");

Found : user_pref("CT3244149.isToolbarShrinked", "{\"dataType\":\"string\",\"data\":\"false\"}");

Found : user_pref("CT3244149.keyword", true);

Found : user_pref("CT3244149.navigationAliasesJson", "{\"EB_MAIN_FRAME_URL\":\"\",\"EB_MAIN_FRAME_TITLE\":\"[...]

Found : user_pref("CT3244149.openThankYouPage", "false");

Found : user_pref("CT3244149.openUninstallPage", "true");

Found : user_pref("CT3244149.search.searchAppId", "129895725399351616");

Found : user_pref("CT3244149.search.searchCount", "0");

Found : user_pref("CT3244149.searchInNewTabEnabledInHidden", "true");

Found : user_pref("CT3244149.selectToSearchBoxEnabled", "{\"dataType\":\"string\",\"data\":\"true\"}");

Found : user_pref("CT3244149.serviceLayer_service_login_isFirstLoginInvoked", "{\"dataType\":\"boolean\",\"d[...]

Found : user_pref("CT3244149.serviceLayer_service_login_loginCount", "{\"dataType\":\"number\",\"data\":\"4\[...]

Found : user_pref("CT3244149.serviceLayer_service_toolbarGrouping_activeCTID", "{\"dataType\":\"string\",\"d[...]

Found : user_pref("CT3244149.serviceLayer_service_toolbarGrouping_activeDownloadUrl", "{\"dataType\":\"strin[...]

Found : user_pref("CT3244149.serviceLayer_service_toolbarGrouping_activeToolbarName", "{\"dataType\":\"strin[...]

Found : user_pref("CT3244149.serviceLayer_service_toolbarGrouping_invoked", "{\"dataType\":\"string\",\"data[...]

Found : user_pref("CT3244149.serviceLayer_service_usage_toolbarUsageCount", "{\"dataType\":\"number\",\"data[...]

Found : user_pref("CT3244149.serviceLayer_services_appTrackingFirstTime_lastUpdate", "1347847531964");

Found : user_pref("CT3244149.serviceLayer_services_appsMetadata_lastUpdate", "1347847531968");

Found : user_pref("CT3244149.serviceLayer_services_gottenAppsContextMenu_lastUpdate", "1347847532373");

Found : user_pref("CT3244149.serviceLayer_services_login_10.10.27.6_lastUpdate", "1347847535933");

Found : user_pref("CT3244149.serviceLayer_services_optimizer_lastUpdate", "1347847532150");

Found : user_pref("CT3244149.serviceLayer_services_otherAppsContextMenu_lastUpdate", "1347847532404");

Found : user_pref("CT3244149.serviceLayer_services_searchAPI_lastUpdate", "1347847530860");

Found : user_pref("CT3244149.serviceLayer_services_serviceMap_lastUpdate", "1347847530198");

Found : user_pref("CT3244149.serviceLayer_services_toolbarContextMenu_lastUpdate", "1347847532347");

Found : user_pref("CT3244149.serviceLayer_services_toolbarSettings_lastUpdate", "1347854730907");

Found : user_pref("CT3244149.serviceLayer_services_translation_lastUpdate", "1347847535133");

Found : user_pref("CT3244149.settingsINI", true);

Found : user_pref("CT3244149.shouldFirstTimeDialog", "false");

Found : user_pref("CT3244149.smartbar.CTID", "CT3244149");

Found : user_pref("CT3244149.smartbar.Uninstall", "0");

Found : user_pref("CT3244149.smartbar.homepage", true);

Found : user_pref("CT3244149.smartbar.toolbarName", "WhiteSmoke US New ");

Found : user_pref("CT3244149.toolbarBornServerTime", "17-9-2012");

Found : user_pref("CT3244149.toolbarCurrentServerTime", "17-9-2012");

Found : user_pref("CT3244149.url_history0001", "hxxp://forums.malwarebytes.org/index.php?showtopic=69183:::c[...]

Found : user_pref("Smartbar.ConduitHomepagesList", "hxxp://search.conduit.com/?ctid=CT3244149&SearchSource=1[...]

Found : user_pref("Smartbar.ConduitSearchEngineList", "WhiteSmoke US New Customized Web Search");

Found : user_pref("Smartbar.ConduitSearchUrlList", "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT3244149[...]

Found : user_pref("Smartbar.keywordURLSelectedCTID", "CT3244149");

Found : user_pref("browser.search.selectedEngine", "WhiteSmoke US New Customized Web Search");

Found : user_pref("browser.startup.homepage", "hxxp://search.conduit.com/?ctid=CT3244149&SearchSource=13");

Found : user_pref("freecausef6eedaac826d50f43dedd0d2b7570509.AutoSearchEventData", "auto%20search");

Found : user_pref("freecausef6eedaac826d50f43dedd0d2b7570509.ClearCacheDate", 16);

Found : user_pref("freecausef6eedaac826d50f43dedd0d2b7570509.DNSCatch", false);

Found : user_pref("freecausef6eedaac826d50f43dedd0d2b7570509.DisplayEULA", true);

Found : user_pref("freecausef6eedaac826d50f43dedd0d2b7570509.DnsCatchEventData", "dns%20catch");

Found : user_pref("freecausef6eedaac826d50f43dedd0d2b7570509.EBOMode", true);

Found : user_pref("freecausef6eedaac826d50f43dedd0d2b7570509.EnableDCAData_xx", true);

Found : user_pref("freecausef6eedaac826d50f43dedd0d2b7570509.EnableDCA_xx", false);

Found : user_pref("freecausef6eedaac826d50f43dedd0d2b7570509.FirstLaunchShown", true);

Found : user_pref("freecausef6eedaac826d50f43dedd0d2b7570509.InstallDomain", "freecause.com");

Found : user_pref("freecausef6eedaac826d50f43dedd0d2b7570509.InstallType", "standard");

Found : user_pref("freecausef6eedaac826d50f43dedd0d2b7570509.LoadLayoutDate.100569", 16);

Found : user_pref("freecausef6eedaac826d50f43dedd0d2b7570509.NewTabSearchEventData", "tab%20search");

Found : user_pref("freecausef6eedaac826d50f43dedd0d2b7570509.ShowRecommendedOptions", true);

Found : user_pref("freecausef6eedaac826d50f43dedd0d2b7570509.StateReportDate", "1347847710292");

Found : user_pref("freecausef6eedaac826d50f43dedd0d2b7570509.TopRightSearchEventData", "top%20right%20search[...]

Found : user_pref("freecausef6eedaac826d50f43dedd0d2b7570509.beforeInstallSaved", true);

Found : user_pref("freecausef6eedaac826d50f43dedd0d2b7570509.beforeinstall.homepage", "hxxp%3A//search.condu[...]

Found : user_pref("freecausef6eedaac826d50f43dedd0d2b7570509.beforeinstall.search", "WhiteSmoke%20US%20New%2[...]

Found : user_pref("freecausef6eedaac826d50f43dedd0d2b7570509.customNewTab", false);

Found : user_pref("freecausef6eedaac826d50f43dedd0d2b7570509.dcaDefaultMode", false);

Found : user_pref("freecausef6eedaac826d50f43dedd0d2b7570509.dcaShowInstallerPage", false);

Found : user_pref("freecausef6eedaac826d50f43dedd0d2b7570509.dcaShowSurvey", true);

Found : user_pref("freecausef6eedaac826d50f43dedd0d2b7570509.helpUsImprove", true);

Found : user_pref("freecausef6eedaac826d50f43dedd0d2b7570509.hideOthers", false);

Found : user_pref("freecausef6eedaac826d50f43dedd0d2b7570509.partnerauth", false);

Found : user_pref("freecausef6eedaac826d50f43dedd0d2b7570509.processAddrBar", false);

Found : user_pref("freecausef6eedaac826d50f43dedd0d2b7570509.restoreSearch", false);

Found : user_pref("freecausef6eedaac826d50f43dedd0d2b7570509.searchHistory", true);

Found : user_pref("freecausef6eedaac826d50f43dedd0d2b7570509.session", "117C1D6B8DCC970C6170E8F94C6D5625D7A3[...]

Found : user_pref("freecausef6eedaac826d50f43dedd0d2b7570509.showFirstLaunchOptions", false);

Found : user_pref("freecausef6eedaac826d50f43dedd0d2b7570509.tb_lang", "en");

Found : user_pref("freecausef6eedaac826d50f43dedd0d2b7570509.tool_id", "100569");

Found : user_pref("freecausef6eedaac826d50f43dedd0d2b7570509.user_id", "121130272");

Found : user_pref("freecausef6eedaac826d50f43dedd0d2b7570509.user_key", "3ae09a7e075e8efd9c33bbaad0443604ff5[...]

Found : user_pref("freecausef6eedaac826d50f43dedd0d2b7570509.user_layouts", "100569");

Found : user_pref("freecausef6eedaac826d50f43dedd0d2b7570509.user_lnames", "Shop%20to%20Win%2029");

Found : user_pref("freecausef6eedaac826d50f43dedd0d2b7570509.vars.disablecuidinject", "1");

Found : user_pref("freecausef6eedaac826d50f43dedd0d2b7570509.xml_service_url", "6bb94bbf55fe2f255901a560824a[...]

Found : user_pref("freecausef6eedaac826d50f43dedd0d2b7570509.yahooSearch", false);

Found : user_pref("keyword.URL", "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT3244149&SearchSource=2&q=[...]

*************************

AdwCleaner[R1].txt - [12483 octets] - [17/09/2012 23:27:28]

########## EOF - C:\AdwCleaner[R1].txt - [12544 octets] ##########

Link to post
Share on other sites

  1. Please re-run AdwCleaner
  2. Click on Delete button.
  3. Confirm each time with OK.
  4. Your computer will be rebooted automatically. A text file will open after the restart. Please post the content of that logfile in your reply.

Note: You can find the logfile at C:\AdwCleaner[sn].txt as well - n is the order number.

MrC

Link to post
Share on other sites

Reran AdwCleaner...but I only had the opportunity to hit delete once before it rebooted...

# AdwCleaner v2.002 - Logfile created 09/22/2012 at 20:56:11

# Updated 16/09/2012 by Xplode

# Operating system : Windows 7 Professional Service Pack 1 (64 bits)

# User : mherwig - IBPA-1164

# Boot Mode : Normal

# Running from : C:\Users\mherwig\Downloads\adwcleaner.exe

# Option [Delete]

***** [services] *****

***** [Files / Folders] *****

File Deleted : C:\Users\mherwig\AppData\Roaming\Mozilla\Firefox\Profiles\7tz7rliw.default\searchplugins\Conduit.xml

Folder Deleted : C:\Program Files (x86)\OApps

Folder Deleted : C:\Users\mherwig\AppData\Local\Temp\CT3244149

Folder Deleted : C:\Users\mherwig\AppData\Roaming\Mozilla\Firefox\Profiles\7tz7rliw.default\CT3244149

Folder Deleted : C:\Users\mherwig\AppData\Roaming\Mozilla\Firefox\Profiles\7tz7rliw.default\extensions\{462be121-2b54-4218-bf00-b9bf8135b23f}

Folder Deleted : C:\Users\mherwig\AppData\Roaming\Mozilla\Firefox\Profiles\7tz7rliw.default\Smartbar

Folder Deleted : C:\Users\mherwig\Documents\ShopToWin

***** [Registry] *****

Key Deleted : HKCU\Software\AppDataLow\Software\Freecause

Key Deleted : HKCU\Software\AppDataLow\Software\SmartBar

Key Deleted : HKLM\SOFTWARE\Classes\FreeCauseURLSearchHook.FCToolbarURLSearchHook

Key Deleted : HKLM\SOFTWARE\Classes\FreeCauseURLSearchHook.FCToolbarURLSearchHook.1

Key Deleted : HKLM\SOFTWARE\Classes\Interface\{79FB5FC8-44B9-4AF5-BADD-CCE547F953E5}

***** [internet Browsers] *****

-\\ Internet Explorer v9.0.8112.16421

Restored : [HKCU\Software\Wow6432Node\Microsoft\Internet Explorer\SearchScopes - DefaultScope]

Restored : [HKCU\Software\Microsoft\Internet Explorer\SearchScopes - DefaultScope]

Restored : [HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes - DefaultScope]

Restored : [HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes - DefaultScope]

Restored : [HKU\S-1-5-18\Software\Microsoft\Internet Explorer\SearchScopes - DefaultScope]

Restored : [HKU\S-1-5-19\Software\Microsoft\Internet Explorer\SearchScopes - DefaultScope]

Restored : [HKU\S-1-5-20\Software\Microsoft\Internet Explorer\SearchScopes - DefaultScope]

-\\ Mozilla Firefox v14.0.1 (en-US)

Profile name : default

File : C:\Users\mherwig\AppData\Roaming\Mozilla\Firefox\Profiles\7tz7rliw.default\prefs.js

C:\Users\mherwig\AppData\Roaming\Mozilla\Firefox\Profiles\7tz7rliw.default\user.js ... Deleted !

Deleted : user_pref("CT3244149.1000082.isPlayDisplay", "true");

Deleted : user_pref("CT3244149.1000082.state", "{\"state\":\"stopped\",\"text\":\"Californi...\",\"description[...]

Deleted : user_pref("CT3244149.ENABALE_HISTORY", "{\"dataType\":\"string\",\"data\":\"true\"}");

Deleted : user_pref("CT3244149.ENABLE_RETURN_WEB_SEARCH_ON_THE_PAGE", "{\"dataType\":\"string\",\"data\":\"tru[...]

Deleted : user_pref("CT3244149.FirstTime", "true");

Deleted : user_pref("CT3244149.FirstTimeFF3", "true");

Deleted : user_pref("CT3244149.SearchFromAddressBarUrl", "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT324[...]

Deleted : user_pref("CT3244149.UserID", "UN10237691019674189");

Deleted : user_pref("CT3244149.UserId", "55ce4531-7a4c-f49f-f785-86d091ea7c29");

Deleted : user_pref("CT3244149.addressBarTakeOverEnabledInHidden", "true");

Deleted : user_pref("CT3244149.autoDisableScopes", -1);

Deleted : user_pref("CT3244149.browser.search.defaultthis.engineName", true);

Deleted : user_pref("CT3244149.cb_experience_000", "7");

Deleted : user_pref("CT3244149.cb_firstuse0100", "1");

Deleted : user_pref("CT3244149.cbcountry_001", "US");

Deleted : user_pref("CT3244149.cbfirsttime", "Sun Sep 16 2012 22:05:35 GMT-0400 (Eastern Daylight Time)");

Deleted : user_pref("CT3244149.defaultSearch", "true");

Deleted : user_pref("CT3244149.embeddedsData", "[{\"appId\":\"129895725399351616\",\"apiPermissions\":{\"cross[...]

Deleted : user_pref("CT3244149.enableAlerts", "always");

Deleted : user_pref("CT3244149.enableSearchFromAddressBar", "true");

Deleted : user_pref("CT3244149.firstTimeDialogOpened", "true");

Deleted : user_pref("CT3244149.fixPageNotFoundError", "true");

Deleted : user_pref("CT3244149.fixPageNotFoundErrorInHidden", "true");

Deleted : user_pref("CT3244149.fixUrls", true);

Deleted : user_pref("CT3244149.hxxp___api16_starwebnet_com.pid2", "4c5873fdeebfb001");

Deleted : user_pref("CT3244149.hxxp___api18_starwebnet_com.pid2", "4c5873fdeebfb001");

Deleted : user_pref("CT3244149.hxxp___api20_starwebnet_com.pid2", "4c5873fdeebfb001");

Deleted : user_pref("CT3244149.hxxp___api26_starwebnet_com.pid2", "4c5873fdeebfb001");

Deleted : user_pref("CT3244149.hxxp___api29_starwebnet_com.pid2", "4c5873fdeebfb001");

Deleted : user_pref("CT3244149.hxxp___api30_starwebnet_com.pid2", "4c5873fdeebfb001");

Deleted : user_pref("CT3244149.hxxp___api32_starwebnet_com.pid2", "4c5873fdeebfb001");

Deleted : user_pref("CT3244149.hxxp___api6_starwebnet_com.pid2", "4c5873fdeebfb001");

Deleted : user_pref("CT3244149.hxxp___toolbar_jollywallet_com_tlb_2.APP_WIN_FEATURES", "resizable=yes, scrollb[...]

Deleted : user_pref("CT3244149.hxxp___toolbar_jollywallet_com_tlb_2.Affiliate_cache", "[\"c822c1b63853ed273b89[...]

Deleted : user_pref("CT3244149.hxxp___toolbar_jollywallet_com_tlb_2.Affiliate_defaultGui", "{\"gui\":[{\"type\[...]

Deleted : user_pref("CT3244149.hxxp___toolbar_jollywallet_com_tlb_2.Affiliate_settings", "{\"initUrl\":\"hxxp:[...]

Deleted : user_pref("CT3244149.hxxp___www_socialgrowthtechnologies_com_couponbuddy_v001.APP_WIN_FEATURES", "op[...]

Deleted : user_pref("CT3244149.installId", "155");

Deleted : user_pref("CT3244149.installType", "ConduitNSISIntegration");

Deleted : user_pref("CT3244149.isEnableAllDialogs", "{\"dataType\":\"string\",\"data\":\"true\"}");

Deleted : user_pref("CT3244149.isNewTabEnabled", true);

Deleted : user_pref("CT3244149.isPerformedSmartBarTransition", "true");

Deleted : user_pref("CT3244149.isToolbarShrinked", "{\"dataType\":\"string\",\"data\":\"false\"}");

Deleted : user_pref("CT3244149.keyword", true);

Deleted : user_pref("CT3244149.navigationAliasesJson", "{\"EB_MAIN_FRAME_URL\":\"hxxp%3A%2F%2Fwebmail.frontier[...]

Deleted : user_pref("CT3244149.openThankYouPage", "false");

Deleted : user_pref("CT3244149.openUninstallPage", "true");

Deleted : user_pref("CT3244149.search.searchAppId", "129895725399351616");

Deleted : user_pref("CT3244149.search.searchCount", "0");

Deleted : user_pref("CT3244149.searchInNewTabEnabledInHidden", "true");

Deleted : user_pref("CT3244149.selectToSearchBoxEnabled", "{\"dataType\":\"string\",\"data\":\"true\"}");

Deleted : user_pref("CT3244149.serviceLayer_service_login_isFirstLoginInvoked", "{\"dataType\":\"boolean\",\"d[...]

Deleted : user_pref("CT3244149.serviceLayer_service_login_loginCount", "{\"dataType\":\"number\",\"data\":\"4\[...]

Deleted : user_pref("CT3244149.serviceLayer_service_toolbarGrouping_activeCTID", "{\"dataType\":\"string\",\"d[...]

Deleted : user_pref("CT3244149.serviceLayer_service_toolbarGrouping_activeDownloadUrl", "{\"dataType\":\"strin[...]

Deleted : user_pref("CT3244149.serviceLayer_service_toolbarGrouping_activeToolbarName", "{\"dataType\":\"strin[...]

Deleted : user_pref("CT3244149.serviceLayer_service_toolbarGrouping_invoked", "{\"dataType\":\"string\",\"data[...]

Deleted : user_pref("CT3244149.serviceLayer_service_usage_toolbarUsageCount", "{\"dataType\":\"number\",\"data[...]

Deleted : user_pref("CT3244149.serviceLayer_services_appTrackingFirstTime_lastUpdate", "1347847531964");

Deleted : user_pref("CT3244149.serviceLayer_services_appsMetadata_lastUpdate", "1347934195499");

Deleted : user_pref("CT3244149.serviceLayer_services_gottenAppsContextMenu_lastUpdate", "1347847532373");

Deleted : user_pref("CT3244149.serviceLayer_services_login_10.10.27.6_lastUpdate", "1347931454259");

Deleted : user_pref("CT3244149.serviceLayer_services_optimizer_lastUpdate", "1347934196681");

Deleted : user_pref("CT3244149.serviceLayer_services_otherAppsContextMenu_lastUpdate", "1347847532404");

Deleted : user_pref("CT3244149.serviceLayer_services_searchAPI_lastUpdate", "1347934195730");

Deleted : user_pref("CT3244149.serviceLayer_services_serviceMap_lastUpdate", "1347934194701");

Deleted : user_pref("CT3244149.serviceLayer_services_toolbarContextMenu_lastUpdate", "1347847532347");

Deleted : user_pref("CT3244149.serviceLayer_services_toolbarSettings_lastUpdate", "1347934195697");

Deleted : user_pref("CT3244149.serviceLayer_services_translation_lastUpdate", "1347934195364");

Deleted : user_pref("CT3244149.settingsINI", true);

Deleted : user_pref("CT3244149.shouldFirstTimeDialog", "false");

Deleted : user_pref("CT3244149.smartbar.CTID", "CT3244149");

Deleted : user_pref("CT3244149.smartbar.Uninstall", "0");

Deleted : user_pref("CT3244149.smartbar.homepage", true);

Deleted : user_pref("CT3244149.smartbar.toolbarName", "WhiteSmoke US New ");

Deleted : user_pref("CT3244149.toolbarBornServerTime", "17-9-2012");

Deleted : user_pref("CT3244149.toolbarCurrentServerTime", "18-9-2012");

Deleted : user_pref("CT3244149.url_history0001", "hxxp://forums.malwarebytes.org/index.php?showtopic=115982#::[...]

Deleted : user_pref("Smartbar.ConduitHomepagesList", "hxxp://search.conduit.com/?ctid=CT3244149&SearchSource=1[...]

Deleted : user_pref("Smartbar.ConduitSearchEngineList", "WhiteSmoke US New Customized Web Search");

Deleted : user_pref("Smartbar.ConduitSearchUrlList", "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT3244149[...]

Deleted : user_pref("Smartbar.keywordURLSelectedCTID", "CT3244149");

Deleted : user_pref("browser.search.selectedEngine", "WhiteSmoke US New Customized Web Search");

Deleted : user_pref("browser.startup.homepage", "hxxp://search.conduit.com/?ctid=CT3244149&SearchSource=13");

Deleted : user_pref("freecausef6eedaac826d50f43dedd0d2b7570509.AutoSearchEventData", "auto%20search");

Deleted : user_pref("freecausef6eedaac826d50f43dedd0d2b7570509.ClearCacheDate", 16);

Deleted : user_pref("freecausef6eedaac826d50f43dedd0d2b7570509.DNSCatch", false);

Deleted : user_pref("freecausef6eedaac826d50f43dedd0d2b7570509.DisplayEULA", true);

Deleted : user_pref("freecausef6eedaac826d50f43dedd0d2b7570509.DnsCatchEventData", "dns%20catch");

Deleted : user_pref("freecausef6eedaac826d50f43dedd0d2b7570509.EBOMode", true);

Deleted : user_pref("freecausef6eedaac826d50f43dedd0d2b7570509.EnableDCAData_xx", true);

Deleted : user_pref("freecausef6eedaac826d50f43dedd0d2b7570509.EnableDCA_xx", false);

Deleted : user_pref("freecausef6eedaac826d50f43dedd0d2b7570509.FirstLaunchShown", true);

Deleted : user_pref("freecausef6eedaac826d50f43dedd0d2b7570509.InstallDomain", "freecause.com");

Deleted : user_pref("freecausef6eedaac826d50f43dedd0d2b7570509.InstallType", "standard");

Deleted : user_pref("freecausef6eedaac826d50f43dedd0d2b7570509.LoadLayoutDate.100569", 16);

Deleted : user_pref("freecausef6eedaac826d50f43dedd0d2b7570509.NewTabSearchEventData", "tab%20search");

Deleted : user_pref("freecausef6eedaac826d50f43dedd0d2b7570509.ShowRecommendedOptions", true);

Deleted : user_pref("freecausef6eedaac826d50f43dedd0d2b7570509.StateReportDate", "1347847710292");

Deleted : user_pref("freecausef6eedaac826d50f43dedd0d2b7570509.TopRightSearchEventData", "top%20right%20search[...]

Deleted : user_pref("freecausef6eedaac826d50f43dedd0d2b7570509.beforeInstallSaved", true);

Deleted : user_pref("freecausef6eedaac826d50f43dedd0d2b7570509.beforeinstall.homepage", "hxxp%3A//search.condu[...]

Deleted : user_pref("freecausef6eedaac826d50f43dedd0d2b7570509.beforeinstall.search", "WhiteSmoke%20US%20New%2[...]

Deleted : user_pref("freecausef6eedaac826d50f43dedd0d2b7570509.customNewTab", false);

Deleted : user_pref("freecausef6eedaac826d50f43dedd0d2b7570509.dcaDefaultMode", false);

Deleted : user_pref("freecausef6eedaac826d50f43dedd0d2b7570509.dcaShowInstallerPage", false);

Deleted : user_pref("freecausef6eedaac826d50f43dedd0d2b7570509.dcaShowSurvey", true);

Deleted : user_pref("freecausef6eedaac826d50f43dedd0d2b7570509.helpUsImprove", true);

Deleted : user_pref("freecausef6eedaac826d50f43dedd0d2b7570509.hideOthers", false);

Deleted : user_pref("freecausef6eedaac826d50f43dedd0d2b7570509.partnerauth", false);

Deleted : user_pref("freecausef6eedaac826d50f43dedd0d2b7570509.processAddrBar", false);

Deleted : user_pref("freecausef6eedaac826d50f43dedd0d2b7570509.restoreSearch", false);

Deleted : user_pref("freecausef6eedaac826d50f43dedd0d2b7570509.searchHistory", true);

Deleted : user_pref("freecausef6eedaac826d50f43dedd0d2b7570509.session", "117C1D6B8DCC970C6170E8F94C6D5625D7A3[...]

Deleted : user_pref("freecausef6eedaac826d50f43dedd0d2b7570509.showFirstLaunchOptions", false);

Deleted : user_pref("freecausef6eedaac826d50f43dedd0d2b7570509.tb_lang", "en");

Deleted : user_pref("freecausef6eedaac826d50f43dedd0d2b7570509.tool_id", "100569");

Deleted : user_pref("freecausef6eedaac826d50f43dedd0d2b7570509.user_id", "121130272");

Deleted : user_pref("freecausef6eedaac826d50f43dedd0d2b7570509.user_key", "3ae09a7e075e8efd9c33bbaad0443604ff5[...]

Deleted : user_pref("freecausef6eedaac826d50f43dedd0d2b7570509.user_layouts", "100569");

Deleted : user_pref("freecausef6eedaac826d50f43dedd0d2b7570509.user_lnames", "Shop%20to%20Win%2029");

Deleted : user_pref("freecausef6eedaac826d50f43dedd0d2b7570509.vars.disablecuidinject", "1");

Deleted : user_pref("freecausef6eedaac826d50f43dedd0d2b7570509.xml_service_url", "6bb94bbf55fe2f255901a560824a[...]

Deleted : user_pref("freecausef6eedaac826d50f43dedd0d2b7570509.yahooSearch", false);

Deleted : user_pref("keyword.URL", "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT3244149&SearchSource=2&q=[...]

*************************

AdwCleaner[R1].txt - [12612 octets] - [17/09/2012 23:27:28]

AdwCleaner[R2].txt - [12844 octets] - [22/09/2012 20:55:35]

AdwCleaner[s1].txt - [13765 octets] - [22/09/2012 20:56:11]

########## EOF - C:\AdwCleaner[s1].txt - [13826 octets] ##########

Link to post
Share on other sites

Great thumbsup.gif

Lets check your computers security before you go and we have a little cleanup to do also:

Download Security Check by screen317 from HERE or HERE.

  • Save it to your Desktop.
  • Double click SecurityCheck.exe and follow the onscreen instructions inside of the black box.
  • A Notepad document should open automatically called checkup.txt; please post the contents of that document.

MrC

Link to post
Share on other sites

Welcome to the forum, please start at the link below:

http://forums.malwar...?showtopic=9573

Post back the 2 logs here.....DDS.txt and Attach.txt

<====><====><====><====><====><====><====><====>

Next.......

Please remove any usb or external drives from the computer before you run this scan!

Quit all running programs.

Please download and run RogueKiller to your desktop.

For Windows XP, double-click to start.

For Vista or Windows 7, do a right-click on the program, select Run as Administrator to start, & when prompted Allow to run.

Click Scan to scan the system.

When the scan completes > Close out the program > Don't Fix anything!

Don't run any other options, they're not all bad!!!!!!!

Post back the report which should be located on your desktop.

MrC

Link to post
Share on other sites

Here are the DDS files...

.

DDS (Ver_2011-08-26.01) - NTFSAMD64

Internet Explorer: 9.0.8112.16421

Run by mherwig at 21:24:17 on 2012-09-23

Microsoft Windows 7 Professional 6.1.7601.1.1252.1.1033.18.8149.5739 [GMT -4:00]

.

AV: Symantec Endpoint Protection *Enabled/Updated* {88C95A36-8C3B-2F2C-1B8B-30FCCFDC4855}

SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

SP: Symantec Endpoint Protection *Enabled/Updated* {33A8BBD2-AA01-20A2-213B-0B8EB45B02E8}

FW: Symantec Endpoint Protection *Enabled* {B0F2DB13-C654-2E74-30D4-99C9310F0F2E}

.

============== Running Processes ===============

.

C:\Windows\system32\wininit.exe

C:\Windows\system32\lsm.exe

C:\Windows\system32\svchost.exe -k DcomLaunch

C:\Windows\system32\nvvsvc.exe

C:\Windows\system32\svchost.exe -k RPCSS

C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted

C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted

C:\Windows\system32\svchost.exe -k netsvcs

C:\Program Files\IDT\WDM\STacSV64.exe

C:\Windows\system32\svchost.exe -k LocalService

C:\Windows\system32\WUDFHost.exe

C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe

C:\Windows\system32\nvvsvc.exe

C:\Program Files (x86)\Symantec\Symantec Endpoint Protection\Smc.exe

C:\Program Files\Common Files\SPBA\upeksvr.exe

C:\Windows\system32\svchost.exe -k NetworkService

C:\Program Files\Intel\WiFi\bin\EvtEng.exe

C:\Windows\system32\WLANExt.exe

C:\Program Files\Intel\WiFi\bin\ZCfgSvc7.exe

C:\Windows\system32\wbem\unsecapp.exe

C:\Program Files (x86)\Common Files\Symantec Shared\ccSvcHst.exe

C:\Windows\system32\conhost.exe

C:\Windows\system32\wbem\wmiprvse.exe

C:\Windows\System32\spoolsv.exe

C:\Program Files\Broadcom Corporation\Broadcom USH Host Components\CV\bin\HostControlService.exe

C:\Program Files\Broadcom Corporation\Broadcom USH Host Components\CV\bin\HostStorageService.exe

C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation

C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork

C:\Program Files\Dell\Dell Data Protection\Access\Advanced\Wave\Trusted Drive Manager\TdmService.exe

C:\Program Files\IDT\WDM\AESTSr64.exe

C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

C:\Windows\system32\taskhost.exe

C:\Program Files\Bonjour\mDNSResponder.exe

C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe

c:\Program Files\Dell\Dell System Manager\DCPSysMgrSvc.exe

C:\Windows\system32\IProsetMonitor.exe

C:\Program Files (x86)\Intel\Services\IPT\jhi_service.exe

C:\Windows\system32\lxeacoms.exe

C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe

C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe

C:\Program Files\Common Files\Nitro PDF\Professional\6.0\NitroPDFDriverServicex64.exe

C:\Windows\SysWOW64\NLSSRV32.EXE

C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe

C:\Windows\system32\DRIVERS\o2flash.exe

c:\Windows\SysWOW64\srvany.exe

C:\Windows\system32\Dwm.exe

c:\Windows\sysWOW64\SDIOAssist.exe

C:\Windows\Explorer.EXE

C:\Program Files (x86)\Symantec\Symantec Endpoint Protection\SmcGui.exe

C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe

C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe

C:\Windows\system32\svchost.exe -k imgsvc

C:\Program Files (x86)\Symantec\Symantec Endpoint Protection\Rtvscan.exe

C:\Program Files\Intel\WiMAX\Bin\AppSrv.exe

C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE

C:\Program Files (x86)\Symantec\Symantec Endpoint Protection\ProtectionUtilSurrogate.exe

C:\Program Files\Intel\WiMAX\Bin\DMAgent.exe

C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe

C:\Windows\system32\svchost.exe -k bthsvcs

C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted

C:\Windows\system32\SearchIndexer.exe

C:\Program Files\DellTPad\Apoint.exe

C:\Program Files\IDT\WDM\sttray64.exe

C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe

C:\Program Files\Intel\WiMAX\Bin\WiMAXCU.exe

C:\Program Files (x86)\STMicroelectronics\AccelerometerP11\FF_Protection.exe

C:\dell\DBRM\Reminder\DbrmTrayicon.exe

C:\Windows\system32\wbem\unsecapp.exe

C:\Program Files\DellTPad\ApMsgFwd.exe

C:\Program Files\DellTPad\HidFind.exe

C:\Program Files\DellTPad\Apntex.exe

C:\Windows\system32\conhost.exe

C:\Program Files (x86)\Lexmark S300-S400 Series\lxeamon.exe

C:\Program Files (x86)\Lexmark S300-S400 Series\ezprint.exe

C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe

C:\Program Files\Dell\Dell System Manager\DCPSysMgr.exe

C:\Program Files (x86)\Dell Webcam\Dell Webcam Central\WebcamDell2.exe

C:\Program Files (x86)\CyberLink\PowerDVD9\PDVD9Serv.exe

C:\Program Files (x86)\Roxio\OEM\Roxio Burn\RoxioBurnLauncher.exe

C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe

C:\Program Files (x86)\Common Files\Symantec Shared\ccApp.exe

C:\Program Files (x86)\Citrix\ICA Client\concentr.exe

C:\Program Files (x86)\McAfee Security Scan\2.0.181\SSScheduler.exe

C:\Program Files (x86)\Common Files\Research In Motion\USB Drivers\RIMBBLaunchAgent.exe

C:\Program Files (x86)\iTunes\iTunesHelper.exe

C:\Program Files (x86)\Citrix\ICA Client\wfcrun32.exe

C:\Program Files\Microsoft Office\Office14\ONENOTEM.EXE

C:\Program Files\iPod\bin\iPodService.exe

C:\Program Files\Windows Media Player\wmpnetwk.exe

C:\Program Files (x86)\Mozilla Firefox\firefox.exe

C:\Windows\SysWOW64\RunDll32.exe

C:\Program Files\WIDCOMM\Bluetooth Software\BtStackServer.exe

C:\Program Files\WIDCOMM\Bluetooth Software\BluetoothHeadsetProxy.exe

C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe

C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_4_402_278.exe

C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_4_402_278.exe

C:\Program Files (x86)\Intel\Intel® Management Engine Components\IMSS\PrivacyIconClient.exe

C:\Program Files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe

C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe

C:\Windows\system32\sppsvc.exe

C:\Windows\servicing\TrustedInstaller.exe

C:\Windows\system32\wuauclt.exe

C:\Windows\system32\svchost.exe -k SDRSVC

C:\Windows\system32\DllHost.exe

C:\Windows\system32\DllHost.exe

C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\conhost.exe

C:\Windows\SysWOW64\cscript.exe

C:\Windows\system32\wbem\wmiprvse.exe

.

============== Pseudo HJT Report ===============

.

uSearch Page = hxxp://www.google.com

uStart Page = hxxp://www.google.com/

uSearch Bar = hxxp://www.google.com/ie

uDefault_Search_URL = hxxp://www.google.com/ie

uInternet Settings,ProxyOverride = *.local

uSearchAssistant = hxxp://www.google.com/ie

uSearchURL,(Default) = hxxp://www.google.com/search?q=%s

uURLSearchHooks: H - No File

mWinlogon: Userinit=userinit.exe,

BHO: Lexmark Toolbar: {1017a80c-6f09-4548-a84d-edd6ac9525f0} - C:\Program Files\Lexmark Toolbar\toolband.dll

BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

BHO: Groove GFS Browser Helper: {72853161-30c5-4d22-b7f9-0bbc1d38a37e} - C:\PROGRA~2\MICROS~4\Office14\GROOVEEX.DLL

BHO: Windows Live ID Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

BHO: Skype Browser Helper: {ae805869-2e5c-4ed4-8f7b-f1f7851a4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll

BHO: Office Document Cache Handler: {b4f3a835-0e21-4959-ba22-42b3008e02ff} - C:\PROGRA~2\MICROS~4\Office14\URLREDIR.DLL

BHO: Lexmark Printable Web: {d2c5e510-be6d-42cc-9f61-e4f939078474} - C:\Program Files\Lexmark Printable Web\bho.dll

BHO: Java Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll

BHO: {F90A5A0D-CD98-49CC-9AA7-9CD11C7478BF} - No File

TB: Lexmark Toolbar: {1017a80c-6f09-4548-a84d-edd6ac9525f0} - C:\Program Files\Lexmark Toolbar\toolband.dll

TB: {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No File

uRun: [FDPRO-516] C:\Program Files (x86)\Fighters\FighterLauncher.exe FDPRO

mRun: [iMSS] "C:\Program Files (x86)\Intel\Intel® Management Engine Components\IMSS\PIconStartup.exe"

mRun: [Dell Webcam Central] "C:\Program Files (x86)\Dell Webcam\Dell Webcam Central\WebcamDell2.exe" /mode2

mRun: [RemoteControl9] "C:\Program Files (x86)\CyberLink\PowerDVD9\PDVD9Serv.exe"

mRun: [PDVD9LanguageShortcut] "C:\Program Files (x86)\CyberLink\PowerDVD9\Language\Language.exe"

mRun: [<NO NAME>]

mRun: [Desktop Disc Tool] "C:\Program Files (x86)\Roxio\OEM\Roxio Burn\RoxioBurnLauncher.exe"

mRun: [sunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"

mRun: [ccApp] "C:\Program Files (x86)\Common Files\Symantec Shared\ccApp.exe"

mRun: [Adobe Reader Speed Launcher] "C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Reader_sl.exe"

mRun: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"

mRun: [ConnectionCenter] "C:\Program Files (x86)\Citrix\ICA Client\concentr.exe" /startup

mRun: [RIMBBLaunchAgent.exe] C:\Program Files (x86)\Common Files\Research In Motion\USB Drivers\RIMBBLaunchAgent.exe

mRun: [APSDaemon] "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe"

mRun: [iTunesHelper] "C:\Program Files (x86)\iTunes\iTunesHelper.exe"

StartupFolder: C:\Users\mherwig\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\ONENOT~1.LNK - C:\Program Files (x86)\Microsoft Office\Office14\ONENOTEM.EXE

StartupFolder: C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\Startup\BLUETO~1.LNK - C:\Program Files (x86)\WIDCOMM\Bluetooth Software\BTTray.exe

StartupFolder: C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\Startup\DELLSY~1.LNK - C:\Program Files (x86)\Dell\Dell System Manager\DCPSysMgr.exe

StartupFolder: C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\Startup\MCAFEE~1.LNK - C:\Program Files (x86)\McAfee Security Scan\2.0.181\SSScheduler.exe

mPolicies-explorer: NoActiveDesktop = 1 (0x1)

mPolicies-explorer: NoActiveDesktopChanges = 1 (0x1)

mPolicies-system: ConsentPromptBehaviorAdmin = 5 (0x5)

mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3)

mPolicies-system: EnableUIADesktopToggle = 0 (0x0)

mPolicies-system: DisableCAD = 1 (0x1)

IE: Add to Google Photos Screensa&ver - C:\Windows\system32\GPhotos.scr/200

IE: E&xport to Microsoft Excel - C:\PROGRA~1\MICROS~1\Office14\EXCEL.EXE/3000

IE: Se&nd to OneNote - C:\PROGRA~1\MICROS~1\Office14\ONBttnIE.dll/105

IE: Send image to &Bluetooth Device... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm

IE: Send page to &Bluetooth Device... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm

IE: {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm

IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll

IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIE.dll

IE: {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - {FFFDC614-B694-4AE6-AB38-5D6374584B52} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIELinkedNotes.dll

IE: {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll

DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab

DPF: {CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab

DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab

TCP: DhcpNameServer = 192.168.254.254

TCP: Interfaces\{6F464E28-0E91-4DC7-8D6D-6AE81C10C4B4} : DhcpNameServer = 192.168.254.254

TCP: Interfaces\{6F464E28-0E91-4DC7-8D6D-6AE81C10C4B4}\132353230333D20534F5E4564777F627B6 : DhcpNameServer = 192.168.2.1

TCP: Interfaces\{6F464E28-0E91-4DC7-8D6D-6AE81C10C4B4}\241647475627970514D27513 : DhcpNameServer = 10.49.181.2 10.48.181.2

TCP: Interfaces\{6F464E28-0E91-4DC7-8D6D-6AE81C10C4B4}\241647475627970514D27523 : DhcpNameServer = 10.49.181.2 10.48.181.2

TCP: Interfaces\{6F464E28-0E91-4DC7-8D6D-6AE81C10C4B4}\6716C65647D27657563747 : DhcpNameServer = 192.168.33.1 204.186.110.76 216.144.187.37

TCP: Interfaces\{6F464E28-0E91-4DC7-8D6D-6AE81C10C4B4}\C696E6B6379737 : DhcpNameServer = 216.144.187.199 204.186.0.201 207.44.0.1

Filter: application/x-ica - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll

Filter: ica - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll

Filter: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\MSOXMLMF.DLL

Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll

Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files (x86)\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll

AppInit_DLLs: C:\Windows\SysWOW64\nvinit.dll

SEH: Groove GFS Stub Execution Hook: {b5a7f190-dda6-4420-b3ba-52453494e6cd} - C:\PROGRA~2\MICROS~4\Office14\GROOVEEX.DLL

LSA: Authentication Packages = msv1_0 wvauth

BHO-X64: Lexmark Toolbar: {1017A80C-6F09-4548-A84D-EDD6AC9525F0} - C:\Program Files\Lexmark Toolbar\toolband.dll

BHO-X64: Adobe PDF Link Helper: {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

BHO-X64: AcroIEHelperStub - No File

BHO-X64: Groove GFS Browser Helper: {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~2\MICROS~4\Office14\GROOVEEX.DLL

BHO-X64: Windows Live ID Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

BHO-X64: Skype Browser Helper: {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll

BHO-X64: SkypeIEPluginBHO - No File

BHO-X64: Office Document Cache Handler: {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~2\MICROS~4\Office14\URLREDIR.DLL

BHO-X64: URLRedirectionBHO - No File

BHO-X64: Lexmark Printable Web: {D2C5E510-BE6D-42CC-9F61-E4F939078474} - C:\Program Files\Lexmark Printable Web\bho.dll

BHO-X64: Java Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll

BHO-X64: {F90A5A0D-CD98-49CC-9AA7-9CD11C7478BF} - No File

BHO-X64: BHO_PROJECT - No File

TB-X64: Lexmark Toolbar: {1017A80C-6F09-4548-A84D-EDD6AC9525F0} - C:\Program Files\Lexmark Toolbar\toolband.dll

TB-X64: {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No File

mRun-x64: [iMSS] "C:\Program Files (x86)\Intel\Intel® Management Engine Components\IMSS\PIconStartup.exe"

mRun-x64: [Dell Webcam Central] "C:\Program Files (x86)\Dell Webcam\Dell Webcam Central\WebcamDell2.exe" /mode2

mRun-x64: [RemoteControl9] "C:\Program Files (x86)\CyberLink\PowerDVD9\PDVD9Serv.exe"

mRun-x64: [PDVD9LanguageShortcut] "C:\Program Files (x86)\CyberLink\PowerDVD9\Language\Language.exe"

mRun-x64: [(Default)]

mRun-x64: [Desktop Disc Tool] "C:\Program Files (x86)\Roxio\OEM\Roxio Burn\RoxioBurnLauncher.exe"

mRun-x64: [sunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"

mRun-x64: [ccApp] "C:\Program Files (x86)\Common Files\Symantec Shared\ccApp.exe"

mRun-x64: [Adobe Reader Speed Launcher] "C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Reader_sl.exe"

mRun-x64: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"

mRun-x64: [ConnectionCenter] "C:\Program Files (x86)\Citrix\ICA Client\concentr.exe" /startup

mRun-x64: [RIMBBLaunchAgent.exe] C:\Program Files (x86)\Common Files\Research In Motion\USB Drivers\RIMBBLaunchAgent.exe

mRun-x64: [APSDaemon] "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe"

mRun-x64: [iTunesHelper] "C:\Program Files (x86)\iTunes\iTunesHelper.exe"

IE-X64: {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm

AppInit_DLLs-X64: C:\Windows\SysWOW64\nvinit.dll

SEH-X64: Groove GFS Stub Execution Hook: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\PROGRA~2\MICROS~4\Office14\GROOVEEX.DLL

.

================= FIREFOX ===================

.

FF - ProfilePath - C:\Users\mherwig\AppData\Roaming\Mozilla\Firefox\Profiles\7tz7rliw.default\

FF - plugin: C:\PROGRA~2\MICROS~4\Office14\NPAUTHZ.DLL

FF - plugin: C:\PROGRA~2\MICROS~4\Office14\NPSPWRAP.DLL

FF - plugin: C:\Program Files (x86)\Common Files\Research In Motion\BBWebSLLauncher\NPWebSLLauncher.dll

FF - plugin: C:\Program Files (x86)\Google\Picasa3\npPicasa3.dll

FF - plugin: C:\Program Files (x86)\Java\jre6\bin\new_plugin\npdeployJava1.dll

FF - plugin: C:\Program Files (x86)\McAfee\Supportability\MVT\NPMVTPlugin.dll

FF - plugin: c:\Program Files (x86)\Microsoft Silverlight\4.0.50401.0\npctrlui.dll

FF - plugin: C:\Program Files (x86)\Mozilla Firefox\plugins\npicaN.dll

FF - plugin: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll

FF - plugin: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll

FF - plugin: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll

FF - plugin: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_4_402_278.dll

.

============= SERVICES / DRIVERS ===============

.

R0 nvpciflt;nvpciflt;C:\Windows\system32\DRIVERS\nvpciflt.sys --> C:\Windows\system32\DRIVERS\nvpciflt.sys [?]

R0 PxHlpa64;PxHlpa64;C:\Windows\system32\Drivers\PxHlpa64.sys --> C:\Windows\system32\Drivers\PxHlpa64.sys [?]

R0 stdcfltn;Disk Class Filter Driver for Accelerometer;C:\Windows\system32\DRIVERS\stdcfltn.sys --> C:\Windows\system32\DRIVERS\stdcfltn.sys [?]

R1 ctxusbm;Citrix USB Monitor Driver;C:\Windows\system32\DRIVERS\ctxusbm.sys --> C:\Windows\system32\DRIVERS\ctxusbm.sys [?]

R1 vwififlt;Virtual WiFi Filter Driver;C:\Windows\system32\DRIVERS\vwififlt.sys --> C:\Windows\system32\DRIVERS\vwififlt.sys [?]

R2 AESTFilters;Andrea ST Filters Service;C:\Program Files\IDT\WDM\AESTSr64.exe [2011-7-19 89600]

R2 Credential Vault Host Control Service;Credential Vault Host Control Service;C:\Program Files\Broadcom Corporation\Broadcom USH Host Components\CV\bin\HostControlService.exe [2010-10-28 1035680]

R2 Credential Vault Host Storage;Credential Vault Host Storage;C:\Program Files\Broadcom Corporation\Broadcom USH Host Components\CV\bin\HostStorageService.exe [2010-10-28 36768]

R2 dcpsysmgrsvc;Dell System Manager Service;C:\Program Files\Dell\Dell System Manager\DCPSysMgrSvc.exe [2011-1-20 517488]

R2 DMAgent;Intel® PROSet/Wireless WiMAX Red Bend Device Management Service;C:\Program Files\Intel\WiMAX\Bin\DMAgent.exe [2010-11-7 499200]

R2 Intel® PROSet Monitoring Service;Intel® PROSet Monitoring Service;C:\Windows\system32\IProsetMonitor.exe --> C:\Windows\system32\IProsetMonitor.exe [?]

R2 jhi_service;Intel® Identity Protection Technology Host Interface Service;C:\Program Files (x86)\Intel\Services\IPT\jhi_service.exe [2011-2-24 212944]

R2 lxea_device;lxea_device;C:\Windows\system32\lxeacoms.exe -service --> C:\Windows\system32\lxeacoms.exe -service [?]

R2 MBAMScheduler;MBAMScheduler;C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [2012-9-16 399432]

R2 MBAMService;MBAMService;C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2012-9-16 676936]

R2 NitroDriverReadSpool;NitroPDFDriverCreatorReadSpool;C:\Program Files\Common Files\Nitro PDF\Professional\6.0\NitroPDFDriverServicex64.exe [2011-1-31 341312]

R2 nlsX86cc;NLS Service;C:\Windows\SysWOW64\NLSSRV32.EXE [2011-1-31 68928]

R2 O2SDIOAssist;O2SDIOAssist;C:\Windows\SysWOW64\srvany.exe [2011-7-18 8192]

R2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [2011-6-5 378472]

R2 Symantec AntiVirus;Symantec Endpoint Protection;C:\Program Files (x86)\Symantec\Symantec Endpoint Protection\Rtvscan.exe [2010-4-23 1831024]

R2 UNS;Intel® Management and Security Application User Notification Service;C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe [2011-7-18 2656280]

R2 WiMAXAppSrv;Intel® PROSet/Wireless WiMAX Service;C:\Program Files\Intel\WiMAX\Bin\AppSrv.exe [2010-11-7 869376]

R2 ZcfgSvc7;Intel® PROSet/Wireless ZeroConfig Service;C:\Program Files\Intel\WiFi\bin\ZCfgSvc7.exe [2010-12-23 992256]

R3 Acceler;Accelerometer Service;C:\Windows\system32\DRIVERS\Accelern.sys --> C:\Windows\system32\DRIVERS\Accelern.sys [?]

R3 bpenum;Intel® Centrino® WiMAX Enumerator;C:\Windows\system32\DRIVERS\bpenum.sys --> C:\Windows\system32\DRIVERS\bpenum.sys [?]

R3 bpmp;Intel® Centrino® WiMAX 6050 Series;C:\Windows\system32\DRIVERS\bpmp.sys --> C:\Windows\system32\DRIVERS\bpmp.sys [?]

R3 bpusb;Intel® Centrino® WiMAX 6050 Series Function Driver;C:\Windows\system32\Drivers\bpusb.sys --> C:\Windows\system32\Drivers\bpusb.sys [?]

R3 BTWAMPFL;BTWAMPFL;C:\Windows\system32\DRIVERS\btwampfl.sys --> C:\Windows\system32\DRIVERS\btwampfl.sys [?]

R3 btwl2cap;Bluetooth L2CAP Service;C:\Windows\system32\DRIVERS\btwl2cap.sys --> C:\Windows\system32\DRIVERS\btwl2cap.sys [?]

R3 CtClsFlt;Creative Camera Class Upper Filter Driver;C:\Windows\system32\DRIVERS\CtClsFlt.sys --> C:\Windows\system32\DRIVERS\CtClsFlt.sys [?]

R3 cvusbdrv;Dell ControlVault;C:\Windows\system32\Drivers\cvusbdrv.sys --> C:\Windows\system32\Drivers\cvusbdrv.sys [?]

R3 e1cexpress;Intel® PRO/1000 PCI Express Network Connection Driver C;C:\Windows\system32\DRIVERS\e1c62x64.sys --> C:\Windows\system32\DRIVERS\e1c62x64.sys [?]

R3 EraserUtilRebootDrv;EraserUtilRebootDrv;C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [2012-8-14 138912]

R3 MBAMProtector;MBAMProtector;\??\C:\Windows\system32\drivers\mbam.sys --> C:\Windows\system32\drivers\mbam.sys [?]

R3 MEIx64;Intel® Management Engine Interface;C:\Windows\system32\DRIVERS\HECIx64.sys --> C:\Windows\system32\DRIVERS\HECIx64.sys [?]

R3 NETwNs64;___ Intel® Wireless WiFi Link 5000 Series Adapter Driver for Windows 7 - 64 Bit;C:\Windows\system32\DRIVERS\NETwNs64.sys --> C:\Windows\system32\DRIVERS\NETwNs64.sys [?]

R3 NVHDA;Service for NVIDIA High Definition Audio Driver;C:\Windows\system32\drivers\nvhda64v.sys --> C:\Windows\system32\drivers\nvhda64v.sys [?]

R3 O2MDRRDR;O2MDRRDR;C:\Windows\system32\DRIVERS\O2MDRw7x64.sys --> C:\Windows\system32\DRIVERS\O2MDRw7x64.sys [?]

R3 O2SDJRDR;O2SDJRDR;C:\Windows\system32\DRIVERS\o2sdjw7x64.sys --> C:\Windows\system32\DRIVERS\o2sdjw7x64.sys [?]

S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]

S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-3-18 138576]

S2 lxeaCATSCustConnectService;lxeaCATSCustConnectService;C:\Windows\System32\spool\DRIVERS\x64\3\lxeaserv.exe [2012-1-22 45736]

S2 McProxy;McAfee Proxy Service;C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe [2012-9-22 249936]

S2 nvUpdatusService;NVIDIA Update Service Daemon;C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe [2011-7-19 1997416]

S2 RoxWatch12;Roxio Hard Drive Watcher 12;C:\Program Files (x86)\Common Files\Roxio Shared\OEM\12.0\SharedCOM\RoxWatch12OEM.exe [2010-11-25 219632]

S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-4-3 250288]

S3 dmvsc;dmvsc;C:\Windows\system32\drivers\dmvsc.sys --> C:\Windows\system32\drivers\dmvsc.sys [?]

S3 McComponentHostService;McAfee Security Scan Component Host Service;C:\Program Files (x86)\McAfee Security Scan\2.0.181\McCHSvc.exe [2010-1-15 227232]

S3 Microsoft SharePoint Workspace Audit Service;Microsoft SharePoint Workspace Audit Service;C:\Program Files\Microsoft Office\Office14\GROOVE.EXE [2010-3-25 51456888]

S3 MIPushAlertService;MIPushAlertService;C:\Program Files (x86)\MISys\MISys SBM\MISys SBM 5.0 Server\MISys Push Alert Service\PushAlertService.exe [2011-7-14 30720]

S3 MozillaMaintenance;Mozilla Maintenance Service;C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe [2012-5-4 114144]

S3 netvsc;netvsc;C:\Windows\system32\DRIVERS\netvsc60.sys --> C:\Windows\system32\DRIVERS\netvsc60.sys [?]

S3 O2MDFRDR;O2MDFRDR;C:\Windows\system32\drivers\O2MDFw7x64.sys --> C:\Windows\system32\drivers\O2MDFw7x64.sys [?]

S3 ose64;Office 64 Source Engine;C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2010-1-9 174440]

S3 osppsvc;Office Software Protection Platform;C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-1-9 4925184]

S3 RoxMediaDB12OEM;RoxMediaDB12OEM;C:\Program Files (x86)\Common Files\Roxio Shared\OEM\12.0\SharedCOM\RoxMediaDB12OEM.exe [2010-11-25 1116656]

S3 StorSvc;Storage Service;C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted [2009-7-13 20992]

S3 SynthVid;SynthVid;C:\Windows\system32\DRIVERS\VMBusVideoM.sys --> C:\Windows\system32\DRIVERS\VMBusVideoM.sys [?]

S3 TsUsbFlt;TsUsbFlt;C:\Windows\system32\drivers\tsusbflt.sys --> C:\Windows\system32\drivers\tsusbflt.sys [?]

S3 TsUsbGD;Remote Desktop Generic USB Device;C:\Windows\system32\drivers\TsUsbGD.sys --> C:\Windows\system32\drivers\TsUsbGD.sys [?]

S3 USBAAPL64;Apple Mobile USB Driver;C:\Windows\system32\Drivers\usbaapl64.sys --> C:\Windows\system32\Drivers\usbaapl64.sys [?]

S3 WatAdminSvc;Windows Activation Technologies Service;C:\Windows\system32\Wat\WatAdminSvc.exe --> C:\Windows\system32\Wat\WatAdminSvc.exe [?]

S4 wlcrasvc;Windows Live Mesh remote connections service;C:\Program Files\Windows Live\Mesh\wlcrasvc.exe [2010-9-22 57184]

.

=============== Created Last 30 ================

.

2012-09-23 02:34:29 -------- d-----w- C:\Users\mherwig\AppData\Roaming\McAfee

2012-09-23 02:31:11 -------- d-----w- C:\Program Files (x86)\Common Files\McAfee

2012-09-23 02:30:52 -------- d-----w- C:\Program Files\McAfee.com

2012-09-23 02:30:52 -------- d-----w- C:\Program Files\McAfee

2012-09-23 02:30:52 -------- d-----w- C:\Program Files\Common Files\McAfee

2012-09-23 02:30:50 -------- d-----w- C:\Program Files (x86)\McAfee

2012-09-23 01:10:38 73696 ----a-w- C:\Program Files (x86)\Mozilla Firefox\breakpadinjector.dll

2012-09-17 02:32:48 -------- d-----w- C:\Users\mherwig\.smplayer

2012-09-17 02:23:44 -------- d-----w- C:\Users\mherwig\AppData\Roaming\Malwarebytes

2012-09-17 02:23:37 25928 ----a-w- C:\Windows\System32\drivers\mbam.sys

2012-09-17 02:23:37 -------- d-----w- C:\ProgramData\Malwarebytes

2012-09-17 02:23:37 -------- d-----w- C:\Program Files (x86)\Malwarebytes' Anti-Malware

2012-09-17 02:10:05 -------- d-----w- C:\Users\mherwig\AppData\Roaming\Fighters

2012-09-17 02:10:03 -------- d-----w- C:\ProgramData\Fighters

2012-09-02 04:34:15 -------- d-----w- C:\Users\mherwig\AppData\Roaming\WindSolutions

2012-09-02 04:34:15 -------- d-----w- C:\ProgramData\WindSolutions

2012-09-02 03:38:18 -------- d-----w- C:\Users\mherwig\AppData\Local\Apple Computer

2012-09-02 03:38:09 34152 ----a-w- C:\Windows\System32\drivers\GEARAspiWDM.sys

2012-09-02 03:38:09 126312 ----a-w- C:\Windows\System32\GEARAspi64.dll

2012-09-02 03:38:09 107368 ----a-w- C:\Windows\SysWow64\GEARAspi.dll

2012-09-02 03:37:44 -------- d-----w- C:\Program Files\iPod

2012-09-02 03:37:42 -------- d-----w- C:\ProgramData\{93E26451-CD9A-43A5-A2FA-C42392EA4001}

2012-09-02 03:37:42 -------- d-----w- C:\Program Files\iTunes

2012-09-02 03:37:42 -------- d-----w- C:\Program Files (x86)\iTunes

2012-09-02 03:37:03 -------- d-----w- C:\Users\mherwig\AppData\Local\Apple

2012-09-02 03:36:26 -------- d-----w- C:\Program Files\Bonjour

2012-09-02 03:36:26 -------- d-----w- C:\Program Files (x86)\Bonjour

.

==================== Find3M ====================

.

2012-09-23 01:02:24 73136 ----a-w- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl

2012-09-23 01:02:24 696240 ----a-w- C:\Windows\SysWow64\FlashPlayerApp.exe

.

============= FINISH: 21:25:05.89 ===============

.

UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.

IF REQUESTED, ZIP IT UP & ATTACH IT

.

DDS (Ver_2011-08-26.01)

.

Microsoft Windows 7 Professional

Boot Device: \Device\HarddiskVolume2

Install Date: 11/16/2011 1:49:45 PM

System Uptime: 9/23/2012 9:16:10 PM (0 hours ago)

.

Motherboard: Dell Inc. | | 0J4TFW

Processor: Intel® Core i7-2720QM CPU @ 2.20GHz | CPU 1 | 2201/100mhz

.

==== Disk Partitions =========================

.

C: is FIXED (NTFS) - 288 GiB total, 199.031 GiB free.

D: is CDROM ()

.

==== Disabled Device Manager Items =============

.

Class GUID: {4d36e972-e325-11ce-bfc1-08002be10318}

Description: Bluetooth Device (Personal Area Network)

Device ID: BTH\MS_BTHPAN\7&3B379ECB&0&2

Manufacturer: Microsoft

Name: Bluetooth Device (Personal Area Network)

PNP Device ID: BTH\MS_BTHPAN\7&3B379ECB&0&2

Service: BthPan

.

==== System Restore Points ===================

.

RP129: 5/3/2012 11:26:07 AM - Scheduled Checkpoint

RP130: 5/14/2012 8:20:41 PM - Windows Backup

RP131: 5/28/2012 9:00:20 PM - Windows Backup

RP132: 6/20/2012 10:09:25 PM - Windows Update

RP133: 8/14/2012 12:15:42 PM - Installed BlackBerry Desktop Software.

RP134: 9/1/2012 11:37:08 PM - Installed iTunes

RP135: 9/11/2012 10:37:54 PM - Installed Asoftech Photo Recovery

RP136: 9/16/2012 10:12:02 PM - Removed Asoftech Photo Recovery

.

==== Installed Programs ======================

.

ABBYY FineReader 6.0 Sprint

AccelerometerP11

Adobe Flash Player 11 ActiveX

Adobe Flash Player 11 Plugin

Adobe Reader X

Apple Application Support

Apple Software Update

BlackBerry Desktop Software 7.1

Citrix online plug-in - web

Citrix online plug-in (DV)

Citrix online plug-in (HDX)

Citrix online plug-in (USB)

Citrix online plug-in (Web)

connectivity.cis.cpp-4.0-core-32

connectivity.connectionserver.client.http.cpp-4.0-core-32

connectivity.connectionserver.client.httpxir3.cpp-4.0-core-32

connectivity.connectionserver.core.helpers.cpp-4.0-core-32

connectivity.connectionserver.drivers.informix.odbc-4.0-core-32

connectivity.connectionserver.drivers.informix.odbc.config-4.0-core-nu

connectivity.connectionserver.drivers.informix.odbc.config-4.0-en-nu

connectivity.connectionserver.drivers.jdbc.core-4.0-core-nu

connectivity.connectionserver.drivers.jdbc.core.config-4.0-core-nu

connectivity.connectionserver.drivers.jdbc.core.config-4.0-en-nu

connectivity.connectionserver.drivers.mysql.jdbc-4.0-core-nu

connectivity.connectionserver.drivers.mysql.jdbc-4.0-en-nu

connectivity.connectionserver.drivers.mysql.odbc-4.0-core-32

connectivity.connectionserver.drivers.mysql.odbc.config-4.0-core-nu

connectivity.connectionserver.drivers.mysql.odbc.config-4.0-en-nu

connectivity.connectionserver.drivers.neoview.odbc-4.0-core-32

connectivity.connectionserver.drivers.neoview.odbc.config-4.0-core-nu

connectivity.connectionserver.drivers.neoview.odbc.config-4.0-en-nu

connectivity.connectionserver.drivers.netezza.jdbc-4.0-core-nu

connectivity.connectionserver.drivers.netezza.jdbc-4.0-en-nu

connectivity.connectionserver.drivers.netezza.odbc-4.0-core-32

connectivity.connectionserver.drivers.netezza.odbc.config-4.0-core-nu

connectivity.connectionserver.drivers.netezza.odbc.config-4.0-en-nu

connectivity.connectionserver.drivers.odbc.core-4.0-core-32

connectivity.connectionserver.drivers.odbc.core.config-4.0-core-nu

connectivity.connectionserver.drivers.odbc.core.config-4.0-en-nu

connectivity.connectionserver.drivers.progress.jdbc-4.0-core-nu

connectivity.connectionserver.drivers.progress.jdbc-4.0-en-nu

connectivity.connectionserver.drivers.progress.odbc-4.0-core-32

connectivity.connectionserver.drivers.progress.odbc.config-4.0-core-32

connectivity.connectionserver.drivers.progress.odbc.config-4.0-en-32

connectivity.connectionserver.drivers.sybase.ctlib-4.0-core-32

connectivity.connectionserver.drivers.sybase.ctlib.config-4.0-core-nu

connectivity.connectionserver.drivers.sybase.ctlib.config-4.0-en-nu

connectivity.connectionserver.drivers.teradata.jdbc-4.0-core-nu

connectivity.connectionserver.drivers.teradata.jdbc-4.0-en-nu

connectivity.connectionserver.drivers.teradata.odbc-4.0-core-32

connectivity.connectionserver.drivers.teradata.odbc.config-4.0-core-nu

connectivity.connectionserver.drivers.teradata.odbc.config-4.0-en-nu

connectivity.connectionserver.helpers.cpp-4.0-core-32

connectivity.connectionserver.plugin.http.cpp-4.0-core-32

connectivity.connectionserver.server.bridge.cpp-4.0-core-32

connectivity.connectionserver.tools.cscheck-4.0-core-32

connectivity.connectionserver.tools.cscheck-4.0-en-32

connectivity.connectionserver.tools.cscheck.config-4.0-core-nu

connectivity.foundation.cpp-4.0-core-32

CopyTrans Suite Remove Only

Crystal Reports 2011

crystalreports.boe.sdkplugins.java-4.0-core-nu

crystalreports.boe.sdkplugins.java-4.0-en-nu

crystalreports.boe.sdkplugins.java.crlov-4.0-core-nu

crystalreports.boe.sdkplugins.java.managedreports-4.0-core-nu

crystalreports.boe.serviceplugins.pss.java-4.0-core-nu

crystalreports.cpp.businessview.clients.crw-4.0-core-32

crystalreports.cpp.businessview.clients.crw-4.0-en-32

crystalreports.cpp.businessview.sdk-4.0-core-32

crystalreports.cpp.businessview.sdk-4.0-en-32

crystalreports.cpp.charthelp-4.0-en-32

crystalreports.cpp.cractivexviewer-4.0-core-32

crystalreports.cpp.cractivexviewer-4.0-en-32

crystalreports.cpp.cslib-4.0-core-32

crystalreports.cpp.designer-4.0-core-32

crystalreports.cpp.designer-4.0-en-32

crystalreports.cpp.erom-4.0-core-32

crystalreports.cpp.erom-4.0-en-32

crystalreports.cpp.exporting.expmod-4.0-core-32

crystalreports.cpp.exporting.u2dapp-4.0-core-32

crystalreports.cpp.exporting.u2dapp-4.0-en-32

crystalreports.cpp.exporting.u2ddisk-4.0-core-32

crystalreports.cpp.exporting.u2ddisk-4.0-en-32

crystalreports.cpp.exporting.u2dmapi-4.0-core-32

crystalreports.cpp.exporting.u2dmapi-4.0-en-32

crystalreports.cpp.exporting.u2dnotes-4.0-core-32

crystalreports.cpp.exporting.u2dnotes-4.0-en-32

crystalreports.cpp.exporting.u2dpost-4.0-core-32

crystalreports.cpp.exporting.u2dpost-4.0-en-32

crystalreports.cpp.exporting.u2dvim-4.0-core-32

crystalreports.cpp.exporting.u2dvim-4.0-en-32

crystalreports.cpp.exporting.u2fcr-4.0-core-32

crystalreports.cpp.exporting.u2fcr-4.0-en-32

crystalreports.cpp.exporting.u2fhtml-4.0-core-32

crystalreports.cpp.exporting.u2fhtml-4.0-en-32

crystalreports.cpp.exporting.u2fodbc-4.0-core-32

crystalreports.cpp.exporting.u2fodbc-4.0-en-32

crystalreports.cpp.exporting.u2fpdf-4.0-core-32

crystalreports.cpp.exporting.u2fpdf-4.0-en-32

crystalreports.cpp.exporting.u2frdef-4.0-core-32

crystalreports.cpp.exporting.u2frdef-4.0-en-32

crystalreports.cpp.exporting.u2frec-4.0-core-32

crystalreports.cpp.exporting.u2frec-4.0-en-32

crystalreports.cpp.exporting.u2frtf-4.0-core-32

crystalreports.cpp.exporting.u2frtf-4.0-en-32

crystalreports.cpp.exporting.u2fsepv-4.0-core-32

crystalreports.cpp.exporting.u2fsepv-4.0-en-32

crystalreports.cpp.exporting.u2ftext-4.0-core-32

crystalreports.cpp.exporting.u2ftext-4.0-en-32

crystalreports.cpp.exporting.u2fwordw-4.0-core-32

crystalreports.cpp.exporting.u2fwordw-4.0-en-32

crystalreports.cpp.exporting.u2fxls-4.0-core-32

crystalreports.cpp.exporting.u2fxls-4.0-en-32

crystalreports.cpp.exporting.u2fxml-4.0-core-32

crystalreports.cpp.exporting.u2fxml-4.0-en-32

crystalreports.cpp.exporting.u2fxml2-4.0-core-32

crystalreports.cpp.exporting.u2fxml2-4.0-en-32

crystalreports.cpp.filedialog-4.0-core-32

crystalreports.cpp.filedialog-4.0-en-32

crystalreports.cpp.help-4.0-core-32

crystalreports.cpp.help-4.0-en-32

crystalreports.cpp.keycode.defn-4.0-core-nu

crystalreports.cpp.parameterprompt-4.0-core-32

crystalreports.cpp.parameterprompt-4.0-en-32

crystalreports.cpp.printcontrol-4.0-core-32

crystalreports.cpp.printcontrol-4.0-en-32

crystalreports.cpp.ras.bv-4.0-core-32

crystalreports.cpp.ras.bv-4.0-en-32

crystalreports.cpp.registrywrapper-4.0-core-32

crystalreports.cpp.runtimeshare-4.0-core-32

crystalreports.cpp.runtimeshare-4.0-en-32

crystalreports.cpp.saptoolbar-4.0-core-32

crystalreports.cpp.saptoolbar-4.0-en-32

crystalreports.cpp.share-4.0-core-32

crystalreports.cpp.share-4.0-en-32

crystalreports.cpp.share.registry-4.0-core-32

crystalreports.crystalcommon.cpp.crjavaconfig-4.0-core-nu

crystalreports.crystalcommon.cpp.crlang-4.0-core-32

crystalreports.crystalcommon.cpp.crlogger-4.0-core-32

crystalreports.crystalcommon.dotnet-4.0-core-32

crystalreports.dataaccess.driver.access-4.0-core-32

crystalreports.dataaccess.driver.access-4.0-en-32

crystalreports.dataaccess.driver.act-4.0-core-32

crystalreports.dataaccess.driver.act-4.0-en-32

crystalreports.dataaccess.driver.ado-4.0-core-32

crystalreports.dataaccess.driver.ado-4.0-en-32

crystalreports.dataaccess.driver.adodotnetinterop-4.0-core-32

crystalreports.dataaccess.driver.adoplus-4.0-core-32

crystalreports.dataaccess.driver.adoplus-4.0-en-32

crystalreports.dataaccess.driver.btrieve-4.0-core-32

crystalreports.dataaccess.driver.btrieve-4.0-en-32

crystalreports.dataaccess.driver.com-4.0-core-32

crystalreports.dataaccess.driver.com-4.0-en-32

crystalreports.dataaccess.driver.db2-4.0-core-32

crystalreports.dataaccess.driver.db2-4.0-en-32

crystalreports.dataaccess.driver.ebs-4.0-core-32

crystalreports.dataaccess.driver.fielddef-4.0-core-32

crystalreports.dataaccess.driver.fielddef-4.0-en-32

crystalreports.dataaccess.driver.filesystem-4.0-core-32

crystalreports.dataaccess.driver.filesystem-4.0-en-32

crystalreports.dataaccess.driver.informix-4.0-core-32

crystalreports.dataaccess.driver.informix-4.0-en-32

crystalreports.dataaccess.driver.java-4.0-core-nu

crystalreports.dataaccess.driver.javabeans-4.0-core-32

crystalreports.dataaccess.driver.javabeans-4.0-en-32

crystalreports.dataaccess.driver.jdbc-4.0-core-32

crystalreports.dataaccess.driver.jdbc-4.0-en-32

crystalreports.dataaccess.driver.jde-4.0-core-32

crystalreports.dataaccess.driver.odbc-4.0-core-32

crystalreports.dataaccess.driver.odbc-4.0-en-32

crystalreports.dataaccess.driver.olap-4.0-core-32

crystalreports.dataaccess.driver.olap-4.0-en-32

crystalreports.dataaccess.driver.oracle-4.0-core-32

crystalreports.dataaccess.driver.oracle-4.0-en-32

crystalreports.dataaccess.driver.p2bbde-4.0-core-32

crystalreports.dataaccess.driver.p2bbde-4.0-en-32

crystalreports.dataaccess.driver.p2dbase-4.0-core-32

crystalreports.dataaccess.driver.p2dbase-4.0-en-32

crystalreports.dataaccess.driver.p2sevt-4.0-core-32

crystalreports.dataaccess.driver.p2sevt-4.0-en-32

crystalreports.dataaccess.driver.p2sexchange-4.0-core-32

crystalreports.dataaccess.driver.p2sexchange-4.0-en-32

crystalreports.dataaccess.driver.p2slog-4.0-core-32

crystalreports.dataaccess.driver.p2slog-4.0-en-32

crystalreports.dataaccess.driver.p2soutlk-4.0-core-32

crystalreports.dataaccess.driver.p2soutlk-4.0-en-32

crystalreports.dataaccess.driver.psenterprise-4.0-core-32

crystalreports.dataaccess.driver.sap-4.0-core-32

crystalreports.dataaccess.driver.sap-4.0-en-32

crystalreports.dataaccess.driver.sforce-4.0-core-32

crystalreports.dataaccess.driver.sforce-4.0-en-32

crystalreports.dataaccess.driver.siebel-4.0-core-32

crystalreports.dataaccess.driver.sybase-4.0-core-32

crystalreports.dataaccess.driver.sybase-4.0-en-32

crystalreports.dataaccess.driver.universe-4.0-core-32

crystalreports.dataaccess.driver.universe-4.0-en-32

crystalreports.dataaccess.driver.wic-4.0-core-32

crystalreports.dataaccess.driver.wic-4.0-en-32

crystalreports.dataaccess.driver.xml-4.0-core-32

crystalreports.dataaccess.driver.xml-4.0-en-32

crystalreports.dataaccess.querybuilder-4.0-core-32

crystalreports.dataaccess.querybuilder-4.0-en-32

crystalreports.dataaccess.share-4.0-core-32

crystalreports.dataaccess.share-4.0-en-32

crystalreports.dataaccess.share.registry-4.0-core-32

crystalreports.designers.java.launcher-4.0-core-32

crystalreports.partner.shared.cpp-4.0-core-32

crystalreports.partner.shared.cpp-4.0-en-32

crystalreports.partner.shared.cpp.pvlmapping-4.0-core-32

crystalreports.partner.shared.java.jde-4.0-core-nu

crystalreports.partner.shared.java.siebel-4.0-core-nu

crystalreports.rptpubwiz.cpp-4.0-core-32

crystalreports.rptpubwiz.cpp-4.0-en-32

crystalreports.rptpubwiz.cpp.help-4.0-core-32

crystalreports.sdk.java.repository-4.0-core-nu

crystalreports.sdk.java.sdkcommon-4.0-core-nu

crystalreports.webreporting.common-4.0-core-nu

crystalreports.webreporting.common-4.0-en-nu

cvom.java-4.0-core-nu

cvom.java-4.0-en-nu

cvom.java.ui_helpers-4.0-core-nu

CyberLink PowerDVD 9.5

D3DX10

Dell Data Protection | Access

Dell Data Protection | Access | Drivers

Dell Data Protection | Access | Middleware

Dell Webcam Central

DirectX 9 Runtime

fnc61_crviewer.msi

foundation.bcm.cpp-4.0-core-32

foundation.bcm.java-4.0-core-nu

foundation.bcm.java.bundle-4.0-core-nu

foundation.bcm.java.classes-4.0-core-nu

foundation.javalibs-4.0-core-nu

foundation.javalibs.bundle-4.0-core-nu

foundation.javalibs.classes-4.0-core-nu

foundation.locale_fallback.cpp-4.0-core-32

foundation.tracelog.cpp-4.0-core-32

foundation.tracelog.java-4.0-core-nu

foundation.tracelog.java.classes-4.0-core-nu

informationengine.qt.drivers.informix.odbc.config-4.0-core-nu

informationengine.qt.drivers.mysql.jdbc-4.0-core-nu

informationengine.qt.drivers.mysql.odbc.config-4.0-core-nu

informationengine.qt.drivers.neoview.odbc.config-4.0-core-nu

informationengine.qt.drivers.netezza.jdbc-4.0-core-nu

informationengine.qt.drivers.netezza.odbc.config-4.0-core-nu

informationengine.qt.drivers.progress.jdbc-4.0-core-nu

informationengine.qt.drivers.progress.odbc.config-4.0-core-32

informationengine.qt.drivers.sybase.ctlib.config-4.0-core-nu

informationengine.qt.drivers.teradata.jdbc-4.0-core-nu

informationengine.qt.drivers.teradata.odbc.config-4.0-core-nu

Intel® Control Center

Intel® Identity Protection Technology 1.1.2.0

Intel® Management Engine Components

Intel® Processor Graphics

Java Auto Updater

Java 6 Update 29

Junk Mail filter update

Lexmark Printable Web

Lexmark Toolbar

LiveUpdate 3.3 (Symantec Corporation)

Malwarebytes Anti-Malware version 1.65.0.1400

McAfee Security Scan Plus

McAfee Virtual Technician

Mesh Runtime

Microsoft Office Live Meeting 2007

Microsoft Silverlight

Microsoft SQL Server 2005 Compact Edition [ENU]

Microsoft Visual C++ 2005 Redistributable

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17

Microsoft WSE 3.0 Runtime

MISys Manufacturing 5.0

Mozilla Firefox 15.0.1 (x86 en-US)

Mozilla Maintenance Service

MSVCRT

MSVCRT_amd64

MSXML 4.0 SP2 (KB954430)

MSXML 4.0 SP2 (KB973688)

MSXML 4.0 SP2 Parser and SDK

NVIDIA Stereoscopic 3D Driver

O2Micro Flash Memory Card Windows Driver

olap.analysis.implementation.cpp.activex-4.0-core-32

olap.analysis.implementation.cpp.sofa-4.0-core-32

PhotoShowExpress

Picasa 3

platform.client.java.helper.supportability-4.0-core-nu

platform.library.common-4.0-core-32

platform.library.common.authentication.jdedwards-4.0-core-32

platform.library.common.authentication.jdedwards-4.0-en-32

platform.library.common.authentication.jdedwards.java-4.0-core-nu

platform.library.common.authentication.oracle-4.0-core-32

platform.library.common.authentication.peoplesoft-4.0-core-32

platform.library.common.authentication.sap-4.0-core-32

platform.library.common.authentication.siebel-4.0-core-32

platform.library.common.authentication.siebel-4.0-en-32

platform.library.common.authentication.siebel.java-4.0-core-nu

platform.sdk.boe.com-4.0-core-32

platform.sdk.boe.com-4.0-en-32

platform.sdk.boe.com.core-4.0-core-32

platform.sdk.boe.com.instrumentation-4.0-core-nu

platform.sdk.boe.com.slplugins-4.0-core-32

platform.sdk.boe.com.slplugins.pinfiles-4.0-core-nu

platform.sdk.boe.java-4.0-core-nu

platform.sdk.boe.java.bundles-4.0-core-nu

platform.sdk.boe.java.classes-4.0-core-nu

platform.sdk.boe.java.dfo.util-4.0-core-nu

platform.sdk.boe.java.jdedwards-4.0-core-nu

platform.sdk.boe.java.jdedwards.plugins_bundle-4.0-core-nu

platform.sdk.boe.java.oracle-4.0-core-nu

platform.sdk.boe.java.oracle.plugins_bundle-4.0-core-nu

platform.sdk.boe.java.pbds-4.0-core-nu

platform.sdk.boe.java.pbds_full-4.0-core-nu

platform.sdk.boe.java.peoplesoft-4.0-core-nu

platform.sdk.boe.java.peoplesoft.plugins_bundle-4.0-core-nu

platform.sdk.boe.java.sap-4.0-core-nu

platform.sdk.boe.java.sap.plugins_bundle-4.0-core-nu

platform.sdk.boe.java.siebel-4.0-core-nu

platform.sdk.boe.java.siebel.plugins_bundle-4.0-core-nu

platform.services.ras21.clientsdk.java-4.0-core-nu

platform.services.ras21.clientsdk.java.pbd-4.0-core-nu

platform.services.ras21.clientsdk_bundle-4.0-core-nu

platform.services.ras21.clientsdk_shared_bundle-4.0-core-nu

product.crystalreports.arp-4.0-core-32

product.crystalreports.eula-4.0-core-32

product.crystalreports.langpackproperty-4.0-en-nu

product.shared.installiverse.reg-4.0-core-nu

product.shared.langpackreg-4.0-core-nu

repoaccess.async_scheduling-4.0-core-32

repoaccess.async_scheduling-4.0-en-32

repoaccess.bo_storage-4.0-core-32

repoaccess.cdztools-4.0-core-32

repoaccess.cdztools-4.0-en-32

repoaccess.cdztools.java-4.0-core-nu

repoaccess.cdztools.jshell-4.0-core-nu

repoaccess.container-4.0-core-32

repoaccess.container.admintool.java-4.0-core-nu

repoaccess.container.java-4.0-core-nu

repoaccess.repo_proxy.cpp-4.0-core-32

Required Runtimes

Roxio Activation Module

Roxio BackOnTrack

Roxio Burn

Roxio Creator Starter

Roxio Express Labeler 3

SAP Crystal Reports runtime engine for .NET Framework 4 (32-bit)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2446708)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2478663)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2518870)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2539636)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2572078)

Security Update for Microsoft .NET Framework 4 Extended (KB2416472)

Security Update for Microsoft .NET Framework 4 Extended (KB2487367)

setup.engine.sharedregistry-4.0-core-32

shared.library.content-4.0-core-32

shared.library.content-4.0-en-32

shared.library.cxlib.cxlib-4.0-core-32

shared.library.keycode.decoder.cpp-4.0-core-32

shared.library.keycode.defn-4.0-core-32

shared.library.keycode.licmgr-4.0-core-32

shared.library.keycode.licmgr-4.0-en-32

Skype Click to Call

Skype™ 5.5

Sonic CinePlayer Decoder Pack

tools.astools.cpp-4.0-core-32

tools.i18n4j-4.0-core-nu

tools.srvtools-4.0-core-32

tools.wstk-4.0-core-32

tools.wstk.java-4.0-core-nu

tools.wstk.webcontent-4.0-core-nu

tp.apache.axis-1.3-core-nu

tp.apache.axis2-1.3-core-nu

tp.apache.axis2.bundle-1.3-core-nu

tp.apache.axis2.classes-1.3-core-nu

tp.apache.commons.java-3.1-core-nu

tp.apache.commons.java.classes-3.1-core-nu

tp.apache.derby-10.2.2.0-core-nu

tp.apache.derby.classes-10.2.2.0-core-nu

tp.apache.log4j-1.2.6_sap.1-core-nu

tp.apache.log4j.bundle-1.2.6_sap.1-core-nu

tp.apache.log4j.classes-1.2.6_sap.1-core-nu

tp.apache.log4j.nteventlogappender-1.2.6_sap.1-core-32

tp.apache.rampart-1.3-core-nu

tp.apache.rampart.classes-1.3-core-nu

tp.apache.xalan.cpp-1.10.0-core-32

tp.apache.xalan.java-2.5.2-core-nu

tp.apache.xalan.java.classes-2.5.2-core-nu

tp.apache.xbean-2.1.0-core-nu

tp.apache.xerces.cpp-2.1.0-core-32

tp.apache.xerces.cpp-2.7.0-core-32

tp.apache.xerces.java-2.6.2-core-nu

tp.apache.xerces.java.classes-2.6.2-core-nu

tp.azalea-5.5-core-32

tp.azalea.fonts-5.5-core-nu

tp.cup-0.11-core-nu

tp.curl.cpp-7.13.2-core-32

tp.datadirect.cpp-6.0-core-32

tp.eclipse.aspectj-1.6.5-core-nu

tp.eclipse.aspectj.classes-1.6.5-core-nu

tp.gzip-1.2.3-core-32

tp.ibm.icu.cpp-3.0.1-core-32

tp.ibm.icu.cpp-4.2.1-core-32

tp.ibm.icu.java-3.8.1-core-nu

tp.libxml2-2.0-core-32

tp.mapinfo.mapx.cpp-3.5-core-32

tp.microsoft.mssdk-10.0-core-32

tp.microsoft.office.stdole-11.0-core-32

tp.netegrity.siteminder.cpp.smagent-6.0-core-32

tp.netscape.ldap.cpp-6.0.5-core-32

tp.netscape.ldap.cpp.mozjavascript-6.0.5-core-32

tp.ooc.cpp-3.3.2-core-32

tp.ooc.java-4.0.5-core-nu

tp.ooc.java.bundle-4.0.5-core-nu

tp.ooc.java.classes-4.0.5-core-nu

tp.openssl-0.9.8l-core-32

tp.pervasive.db.btrieve-3.0-core-32

tp.pkware.cpp-1.0-core-32

tp.poco-1.3.6-core-32

tp.rosette-4.2.1-core-32

tp.rsa.crypto-6.3-core-32

tp.rsa.crypto.cpp-3.2.1.2-core-32

tp.rsa.crypto.java-4.1-core-nu

tp.rsa.crypto.java.classes-4.1-core-nu

tp.salesforce-9.0-core-nu

tp.sap.introscope-822-core-nu

tp.sap.ljs.passport-0.7.0-core-nu

tp.sap.ljs.passport.classes-0.7.0-core-nu

tp.sap.ncs-720-core-32

tp.sap.nwrfc-711-core-32

tp.sap.rfcsdku-70-core-32

tp.shared.pvlocale.pvlocale-4.0-core-32

tp.sourceforge.libpng.cpp-1.0.30-core-32

tp.sun-1.1-core-nu

tp.sun.classes-1.1-core-nu

tp.sun.jdk-1.6-core-32

tp.sun.jdk.jre-1.6-core-32

tp.threedgraphics.pgsdk.cpp-2.50.16.busobj.1-core-32

tp.threedgraphics.pgsdk.cpp-2.50.16.busobj.1-en-32

tp.threedgraphics.pgsdk.cpp.chartsupport-2.50.16.busobj.1-core-nu

tp.threedgraphics.pgsdk.cpp.runtime-2.50.16.busobj.1-core-32

tp.threedgraphics.pgsdk.cpp.runtime-2.50.16.busobj.1-en-32

tp.utexasaustin.hoard-3.7.1-core-32

tp.xpp3-1.1.3.8-core-nu

tp.xpp3.bundle-1.1.3.8-core-nu

tp.xpp3.classes-1.1.3.8-core-nu

Update for Microsoft .NET Framework 4 Client Profile (KB2468871)

Update for Microsoft .NET Framework 4 Client Profile (KB2473228)

Update for Microsoft .NET Framework 4 Client Profile (KB2533523)

Update for Microsoft .NET Framework 4 Extended (KB2468871)

Update for Microsoft .NET Framework 4 Extended (KB2533523)

Windows Live Communications Platform

Windows Live Essentials

Windows Live Installer

Windows Live Mail

Windows Live Mesh

Windows Live Mesh ActiveX Control for Remote Connections

Windows Live Messenger

Windows Live Movie Maker

Windows Live Photo Common

Windows Live Photo Gallery

Windows Live PIMT Platform

Windows Live SOXE

Windows Live SOXE Definitions

Windows Live UX Platform

Windows Live UX Platform Language Pack

Windows Live Writer

Windows Live Writer Resources

.

==== Event Viewer Messages From Past Week ========

.

9/23/2012 9:20:39 PM, Error: Service Control Manager [7009] - A timeout was reached (30000 milliseconds) while waiting for the Roxio Hard Drive Watcher 12 service to connect.

9/23/2012 9:20:38 PM, Error: Service Control Manager [7041] - The nvUpdatusService service was unable to log on as .\UpdatusUser with the currently configured password due to the following error: Logon failure: the user has not been granted the requested logon type at this computer. Service: nvUpdatusService Domain and account: .\UpdatusUser This service account does not have the required user right "Log on as a service." User Action Assign "Log on as a service" to the service account on this computer. You can use Local Security Settings (Secpol.msc) to do this. If this computer is a node in a cluster, check that this user right is assigned to the Cluster service account on all nodes in the cluster. If you have already assigned this user right to the service account, and the user right appears to be removed, check with your domain administrator to find out if a Group Policy object associated with this node might be removing the right.

9/23/2012 9:20:38 PM, Error: Service Control Manager [7003] - The McAfee Network Agent service depends the following service: mfefire. This service might not be installed.

9/23/2012 9:20:38 PM, Error: Service Control Manager [7000] - The NVIDIA Update Service Daemon service failed to start due to the following error: The service did not start due to a logon failure.

9/23/2012 9:18:36 PM, Error: Microsoft-Windows-GroupPolicy [1129] - The processing of Group Policy failed because of lack of network connectivity to a domain controller. This may be a transient condition. A success message would be generated once the machine gets connected to the domain controller and Group Policy has succesfully processed. If you do not see a success message for several hours, then contact your administrator.

9/23/2012 9:18:18 PM, Error: Service Control Manager [7003] - The McAfee Proxy Service service depends the following service: mfefire. This service might not be installed.

9/23/2012 9:18:13 PM, Error: Service Control Manager [7009] - A timeout was reached (30000 milliseconds) while waiting for the lxeaCATSCustConnectService service to connect.

9/23/2012 9:18:13 PM, Error: Service Control Manager [7000] - The lxeaCATSCustConnectService service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.

9/23/2012 9:18:05 PM, Error: NETLOGON [5719] - This computer was not able to set up a secure session with a domain controller in domain BATTERY due to the following: There are currently no logon servers available to service the logon request. This may lead to authentication problems. Make sure that this computer is connected to the network. If the problem persists, please contact your domain administrator. ADDITIONAL INFO If this computer is a domain controller for the specified domain, it sets up the secure session to the primary domain controller emulator in the specified domain. Otherwise, this computer sets up the secure session to any domain controller in the specified domain.

9/23/2012 9:18:01 PM, Error: Service Control Manager [7001] - The NTRU TSS v1.2.1.34 TCS service depends on the TPM Base Services service which failed to start because of the following error: The operation completed successfully.

9/22/2012 9:59:26 PM, Error: Service Control Manager [7023] - The McAfee Validation Trust Protection Service service terminated with the following error: The system cannot find the file specified.

9/22/2012 8:47:17 PM, Error: Service Control Manager [7011] - A timeout (30000 milliseconds) was reached while waiting for a transaction response from the LanmanServer service.

.

==== End Of File ===========================

And, here is RogueKiller...

RogueKiller V8.0.5 [09/23/2012] by Tigzy

mail: tigzyRK<at>gmail<dot>com

Feedback: http://www.geekstogo.com/forum/files/file/413-roguekiller/

Blog: http://tigzyrk.blogspot.com

Operating System: Windows 7 (6.1.7601 Service Pack 1) 64 bits version

Started in : Normal mode

User : mherwig [Admin rights]

Mode : Scan -- Date : 09/23/2012 21:28:45

¤¤¤ Bad processes : 0 ¤¤¤

¤¤¤ Registry Entries : 3 ¤¤¤

[HJ SMENU] HKCU\[...]\Advanced : Start_ShowMyGames (0) -> FOUND

[HJ DESK] HKLM\[...]\NewStartPanel : {59031a47-3f72-44a7-89c5-5595fe6b30ee} (1) -> FOUND

[HJ DESK] HKLM\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> FOUND

¤¤¤ Particular Files / Folders: ¤¤¤

¤¤¤ Driver : [NOT LOADED] ¤¤¤

¤¤¤ Extern Hives: ¤¤¤

¤¤¤ Infection : ¤¤¤

¤¤¤ HOSTS File: ¤¤¤

--> C:\Windows\system32\drivers\etc\hosts

¤¤¤ MBR Check: ¤¤¤

+++++ PhysicalDrive0: ST320LT007-9ZV142 +++++

--- User ---

[MBR] a73769ebf2a0be21527d1c8f228bf020

[bSP] 55f31f41154a1605d0faf59ab61a0c88 : Windows Vista MBR Code

Partition table:

0 - [XXXXXX] DELL-UTIL (0xde) [VISIBLE] Offset (sectors): 63 | Size: 39 Mo

1 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 81920 | Size: 10544 Mo

2 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 21676032 | Size: 294660 Mo

User = LL1 ... OK!

User = LL2 ... OK!

Finished : << RKreport[2].txt >>

RKreport[1].txt ; RKreport[2].txt

Now what?

Link to post
Share on other sites

What browsers are affected?

Please download AdwCleaner from here and save it on your Desktop.

  1. Right-click on adwcleaner.exe and select Run As Administrator to launch the application.
  2. Now click on the Search tab.
  3. Please post the contents of the log-file created in your next post.

Note: The log can also be located at C:\ >> AdwCleaner[XX].txt >> XX <-- Denotes the number of times the application has been ran, so in this should be something like R1.

MrC

Link to post
Share on other sites

I've only checked in Firefox since I stay far away from Explorer.

Here is the Next log file...

# AdwCleaner v2.002 - Logfile created 09/23/2012 at 21:52:52

# Updated 16/09/2012 by Xplode

# Operating system : Windows 7 Professional Service Pack 1 (64 bits)

# User : mherwig - IBPA-1164

# Boot Mode : Normal

# Running from : C:\Users\mherwig\Downloads\adwcleaner.exe

# Option [search]

***** [services] *****

***** [Files / Folders] *****

***** [Registry] *****

***** [internet Browsers] *****

-\\ Internet Explorer v9.0.8112.16421

[OK] Registry is clean.

-\\ Mozilla Firefox v15.0.1 (en-US)

Profile name : default

File : C:\Users\mherwig\AppData\Roaming\Mozilla\Firefox\Profiles\7tz7rliw.default\prefs.js

[OK] File is clean.

*************************

AdwCleaner[R1].txt - [12612 octets] - [17/09/2012 23:27:28]

AdwCleaner[R2].txt - [12844 octets] - [22/09/2012 20:55:35]

AdwCleaner[s1].txt - [13890 octets] - [22/09/2012 20:56:11]

AdwCleaner[R3].txt - [886 octets] - [23/09/2012 21:52:52]

########## EOF - C:\AdwCleaner[R3].txt - [945 octets] ##########

Link to post
Share on other sites

Did you recently install a new program? If so it probably came with that.

Drop in Savings usually gets installed without your permission with 3rd parry software.

  • It is recommended that You update Your Firefox to latest version.
  • Go under Tools => Add-ons => Extensions or about:addons and disable unwanted addons.
  • If You do not know which addon is responsible, then disable all of them and enable one by one until responsible addon is found.

FF also has a reset button that will restore it all back to defaults:

http://support.mozil...x-most-problems

Let me know, MrC

Link to post
Share on other sites

Due to the lack of feedback this topic is closed to prevent others from posting here. If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread.

Other members who need assistance please start your own topic in a new thread. Thanks!

Link to post
Share on other sites

Guest
This topic is now closed to further replies.
 Share

  • Recently Browsing   0 members

    • No registered users viewing this page.
Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.