Jump to content

iLivid infection


Recommended Posts

My wife was on the net over the weekend and has been complaining of slowness on her system, no popups, but I did notice an installation of ilivid had appeared in her Programs control panel. I scanned with MSE and removed the rogue java entries that popped up.

I then did a system restore to last week. (this probably wasn't the best thing to do thinking about it, but well, can't roll back, the roll back).

I ran MBAM in safe mode and removed some myWebSearch stuff from the PC. Rebooted, ran MBAM again in normal mode with nothing found.

Symptoms: Nothing in the Start Menu > Programs, unable to open certain exe files (iexplore, firefox) and it seems some permission changes on her user directory. There are no issues with opening files in safe mode.

Many thanks in advance for the help!

DDS log:

.

DDS (Ver_2011-08-26.01) - NTFSAMD64

Internet Explorer: 9.0.8112.16421 BrowserJavaVersion: 1.6.0_31

Run by Marci at 18:23:24 on 2012-10-10

Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.3948.2549 [GMT -4:00]

.

AV: Microsoft Security Essentials *Enabled/Updated* {B140BF4E-23BB-4198-90AB-A51A4C60A69C}

SP: Microsoft Security Essentials *Enabled/Updated* {0A215EAA-0581-4E16-AA1B-9E6837E7EC21}

SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.

============== Running Processes ===============

.

C:\Windows\system32\wininit.exe

C:\Windows\system32\lsm.exe

C:\Windows\system32\svchost.exe -k DcomLaunch

C:\Windows\system32\svchost.exe -k RPCSS

c:\Program Files\Microsoft Security Client\MsMpEng.exe

C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted

C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted

C:\Windows\system32\svchost.exe -k netsvcs

C:\Windows\system32\svchost.exe -k LocalService

C:\Windows\system32\svchost.exe -k NetworkService

C:\Windows\System32\spoolsv.exe

C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork

C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

C:\Program Files\Bonjour\mDNSResponder.exe

C:\Program Files\Carbonite\Carbonite Backup\carboniteservice.exe

C:\Program Files\Acer\Acer ePower Management\ePowerSvc.exe

C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation

C:\Program Files\Acer\Acer Updater\UpdaterService.exe

C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE

C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe

C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted

C:\Windows\system32\SearchIndexer.exe

C:\Program Files\Windows Media Player\wmpnetwk.exe

C:\Windows\system32\wbem\wmiprvse.exe

C:\Windows\system32\taskhost.exe

C:\Windows\system32\Dwm.exe

C:\Windows\Explorer.EXE

C:\Windows\system32\igfxtray.exe

C:\Windows\system32\hkcmd.exe

C:\Windows\system32\igfxpers.exe

C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe

C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe

C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe

C:\Windows\system32\igfxsrvc.exe

C:\Program Files\Microsoft Security Client\msseces.exe

C:\Windows\system32\igfxext.exe

C:\Windows\system32\wbem\unsecapp.exe

C:\Program Files\Acer\Acer ePower Management\ePowerEvent.exe

C:\Program Files\Synaptics\SynTP\SynTPHelper.exe

C:\Windows\system32\wuauclt.exe

C:\Windows\system32\vssvc.exe

C:\Windows\System32\svchost.exe -k swprv

C:\Windows\system32\taskhost.exe

C:\Windows\system32\DllHost.exe

C:\Windows\system32\DllHost.exe

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\conhost.exe

C:\Windows\SysWOW64\cscript.exe

C:\Windows\system32\wbem\wmiprvse.exe

.

============== Pseudo HJT Report ===============

.

uStart Page = hxxp://acer.msn.com

uDefault_Page_URL = hxxp://acer.msn.com

mDefault_Page_URL = hxxp://acer.msn.com

mStart Page = hxxp://acer.msn.com

uInternet Settings,ProxyOverride = *.local

uURLSearchHooks: vshare.tv Bar Toolbar: {7aeb3efd-e564-43f1-b658-5058a7c5743b} - C:\Program Files (x86)\vshare.tv_Bar\prxtbvsha.dll

mURLSearchHooks: vshare.tv Bar Toolbar: {7aeb3efd-e564-43f1-b658-5058a7c5743b} - C:\Program Files (x86)\vshare.tv_Bar\prxtbvsha.dll

mWinlogon: Userinit=userinit.exe,

BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

BHO: Expat Shield Class: {3706ee7c-3cad-445d-8a43-03ebc3b75908} - C:\Program Files (x86)\Expat Shield\HssIE\ExpatIE.dll

BHO: Groove GFS Browser Helper: {72853161-30c5-4d22-b7f9-0bbc1d38a37e} - C:\PROGRA~2\MICROS~4\Office14\GROOVEEX.DLL

BHO: Java™ Plug-In SSV Helper: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - C:\Program Files (x86)\Java\jre6\bin\ssv.dll

BHO: vshare.tv Bar Toolbar: {7aeb3efd-e564-43f1-b658-5058a7c5743b} - C:\Program Files (x86)\vshare.tv_Bar\prxtbvsha.dll

BHO: Windows Live ID Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

BHO: Adobe PDF Conversion Toolbar Helper: {ae7cd045-e861-484f-8273-0445ee161910} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll

BHO: Office Document Cache Handler: {b4f3a835-0e21-4959-ba22-42b3008e02ff} - C:\PROGRA~2\MICROS~4\Office14\URLREDIR.DLL

BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll

BHO: SmartSelect Class: {f4971ee7-daa0-4053-9964-665d8ee6a077} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll

TB: Adobe PDF: {47833539-d0c5-4125-9fa8-0819e2eaac93} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll

TB: vshare.tv Bar Toolbar: {7aeb3efd-e564-43f1-b658-5058a7c5743b} - C:\Program Files (x86)\vshare.tv_Bar\prxtbvsha.dll

uRun: [iSUSPM] C:\ProgramData\FLEXnet\Connect\11\ISUSPM.exe -scheduler

mRun: [iAStorIcon] C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe

mRun: [suiteTray] "C:\Program Files (x86)\EgisTec MyWinLockerSuite\x86\SuiteTray.exe"

mRun: [EgisTecPMMUpdate] "C:\Program Files (x86)\EgisTec IPS\PmmUpdate.exe"

mRun: [EgisUpdate] "C:\Program Files (x86)\EgisTec IPS\EgisUpdate.exe" -d

mRun: [Norton Online Backup] C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuClient.exe

mRun: [Adobe Reader Speed Launcher] "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe"

mRun: [backupManagerTray] "C:\Program Files (x86)\NTI\Acer Backup Manager\BackupManagerTray.exe" -h -k

mRun: [LManager] C:\Program Files (x86)\Launch Manager\LManager.exe

mRun: [Dolby Advanced Audio v2] "C:\Dolby PCEE4\pcee4.exe" -autostart

mRun: [ArcadeMovieService] "C:\Program Files (x86)\Acer\clear.fi\Movie\clear.fiMovieService.exe"

mRun: [Carbonite Backup] C:\Program Files (x86)\Carbonite\Carbonite Backup\CarboniteUI.exe

mRun: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"

mRun: [<NO NAME>]

mRun: [Adobe Acrobat Speed Launcher] "C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Acrobat_sl.exe"

mRun: [Acrobat Assistant 8.0] "C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Acrotray.exe"

mRun: [switchBoard] C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe

mRun: [AdobeCS5ServiceManager] "C:\Program Files (x86)\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe" -launchedbylogin

mRun: [APSDaemon] "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe"

mRun: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime

mRun: [iTunesHelper] "C:\Program Files (x86)\iTunes\iTunesHelper.exe"

mRun: [sunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"

dRunOnce: [isMyWinLockerReboot] msiexec.exe /qn /x{voidguid}

StartupFolder: C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\Startup\MCAFEE~1.LNK - C:\Program Files (x86)\McAfee Security Scan\3.0.207\SSScheduler.exe

mPolicies-explorer: NoActiveDesktop = 1 (0x1)

mPolicies-system: ConsentPromptBehaviorAdmin = 5 (0x5)

mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3)

mPolicies-system: EnableUIADesktopToggle = 0 (0x0)

IE: Append Link Target to Existing PDF - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html

IE: Append to Existing PDF - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html

IE: Convert Link Target to Adobe PDF - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html

IE: Convert to Adobe PDF - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECapture.html

IE: E&xport to Microsoft Excel - C:\PROGRA~1\MICROS~3\Office14\EXCEL.EXE/3000

IE: Se&nd to OneNote - C:\PROGRA~1\MICROS~3\Office14\ONBttnIE.dll/105

IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll

IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIE.dll

IE: {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - {FFFDC614-B694-4AE6-AB38-5D6374584B52} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIELinkedNotes.dll

DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab

DPF: {CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab

DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab

TCP: DhcpNameServer = 10.0.0.1

TCP: Interfaces\{43F073EE-7D78-4DC8-BC61-DB9FCB9A4C62} : DhcpNameServer = 10.0.0.1

TCP: Interfaces\{43F073EE-7D78-4DC8-BC61-DB9FCB9A4C62}\E4544574541425 : DhcpNameServer = 10.0.0.1

TCP: Interfaces\{AA180B28-E6AA-4BED-AE1A-9E3A74AEE289} : NameServer = 10.197.48.1

Filter: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\MSOXMLMF.DLL

Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL

Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files (x86)\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll

SEH: Groove GFS Stub Execution Hook: {b5a7f190-dda6-4420-b3ba-52453494e6cd} - C:\PROGRA~2\MICROS~4\Office14\GROOVEEX.DLL

BHO-X64: Adobe PDF Link Helper: {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

BHO-X64: AcroIEHelperStub - No File

BHO-X64: Expat Shield Class: {3706EE7C-3CAD-445D-8A43-03EBC3B75908} - C:\Program Files (x86)\Expat Shield\HssIE\ExpatIE.dll

BHO-X64: Groove GFS Browser Helper: {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~2\MICROS~4\Office14\GROOVEEX.DLL

BHO-X64: Java™ Plug-In SSV Helper: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre6\bin\ssv.dll

BHO-X64: vshare.tv Bar Toolbar: {7aeb3efd-e564-43f1-b658-5058a7c5743b} - C:\Program Files (x86)\vshare.tv_Bar\prxtbvsha.dll

BHO-X64: vshare.tv Bar - No File

BHO-X64: Windows Live ID Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

BHO-X64: Adobe PDF Conversion Toolbar Helper: {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll

BHO-X64: Office Document Cache Handler: {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~2\MICROS~4\Office14\URLREDIR.DLL

BHO-X64: URLRedirectionBHO - No File

BHO-X64: Java™ Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll

BHO-X64: SmartSelect Class: {F4971EE7-DAA0-4053-9964-665D8EE6A077} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll

BHO-X64: SmartSelect - No File

TB-X64: Adobe PDF: {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll

TB-X64: vshare.tv Bar Toolbar: {7aeb3efd-e564-43f1-b658-5058a7c5743b} - C:\Program Files (x86)\vshare.tv_Bar\prxtbvsha.dll

mRun-x64: [iAStorIcon] C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe

mRun-x64: [suiteTray] "C:\Program Files (x86)\EgisTec MyWinLockerSuite\x86\SuiteTray.exe"

mRun-x64: [EgisTecPMMUpdate] "C:\Program Files (x86)\EgisTec IPS\PmmUpdate.exe"

mRun-x64: [EgisUpdate] "C:\Program Files (x86)\EgisTec IPS\EgisUpdate.exe" -d

mRun-x64: [Norton Online Backup] C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuClient.exe

mRun-x64: [Adobe Reader Speed Launcher] "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe"

mRun-x64: [backupManagerTray] "C:\Program Files (x86)\NTI\Acer Backup Manager\BackupManagerTray.exe" -h -k

mRun-x64: [LManager] C:\Program Files (x86)\Launch Manager\LManager.exe

mRun-x64: [Dolby Advanced Audio v2] "C:\Dolby PCEE4\pcee4.exe" -autostart

mRun-x64: [ArcadeMovieService] "C:\Program Files (x86)\Acer\clear.fi\Movie\clear.fiMovieService.exe"

mRun-x64: [Carbonite Backup] C:\Program Files (x86)\Carbonite\Carbonite Backup\CarboniteUI.exe

mRun-x64: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"

mRun-x64: [(Default)]

mRun-x64: [Adobe Acrobat Speed Launcher] "C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Acrobat_sl.exe"

mRun-x64: [Acrobat Assistant 8.0] "C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Acrotray.exe"

mRun-x64: [switchBoard] C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe

mRun-x64: [AdobeCS5ServiceManager] "C:\Program Files (x86)\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe" -launchedbylogin

mRun-x64: [APSDaemon] "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe"

mRun-x64: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime

mRun-x64: [iTunesHelper] "C:\Program Files (x86)\iTunes\iTunesHelper.exe"

mRun-x64: [sunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"

SEH-X64: Groove GFS Stub Execution Hook: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\PROGRA~2\MICROS~4\Office14\GROOVEEX.DLL

.

================= FIREFOX ===================

.

FF - ProfilePath - C:\Users\Marci\AppData\Roaming\Mozilla\Firefox\Profiles\o3zmyekh.default\

FF - prefs.js: browser.startup.homepage - hxxp://www.facebook.com/marci.gower

FF - plugin: C:\PROGRA~2\MICROS~4\Office14\NPAUTHZ.DLL

FF - plugin: C:\PROGRA~2\MICROS~4\Office14\NPSPWRAP.DLL

FF - plugin: C:\Program Files (x86)\Java\jre6\bin\plugin2\npdeployJava1.dll

FF - plugin: C:\Program Files (x86)\Java\jre6\bin\plugin2\npjp2.dll

FF - plugin: c:\Program Files (x86)\Microsoft Silverlight\5.1.10411.0\npctrlui.dll

FF - plugin: C:\Program Files (x86)\Mozilla Firefox\plugins\npdeployJava1.dll

FF - plugin: C:\Program Files (x86)\Mozilla Firefox\plugins\npvsharetvplg.dll

FF - plugin: C:\Program Files (x86)\WildTangent Games\App\BrowserIntegration\Registered\0\NP_wtapp.dll

FF - plugin: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll

FF - plugin: C:\Users\Marci\AppData\Roaming\Mozilla\Firefox\Profiles\o3zmyekh.default\extensions\{7aeb3efd-e564-43f1-b658-5058a7c5743b}\plugins\np-mswmp.dll

FF - plugin: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_4_402_265.dll

.

============= SERVICES / DRIVERS ===============

.

R0 MpFilter;Microsoft Malware Protection Driver;C:\Windows\system32\DRIVERS\MpFilter.sys --> C:\Windows\system32\DRIVERS\MpFilter.sys [?]

R1 mwlPSDFilter;mwlPSDFilter;C:\Windows\system32\DRIVERS\mwlPSDFilter.sys --> C:\Windows\system32\DRIVERS\mwlPSDFilter.sys [?]

R1 mwlPSDNServ;mwlPSDNServ;C:\Windows\system32\DRIVERS\mwlPSDNServ.sys --> C:\Windows\system32\DRIVERS\mwlPSDNServ.sys [?]

R1 mwlPSDVDisk;mwlPSDVDisk;C:\Windows\system32\DRIVERS\mwlPSDVDisk.sys --> C:\Windows\system32\DRIVERS\mwlPSDVDisk.sys [?]

R1 vwififlt;Virtual WiFi Filter Driver;C:\Windows\system32\DRIVERS\vwififlt.sys --> C:\Windows\system32\DRIVERS\vwififlt.sys [?]

R2 ePowerSvc;Acer ePower Service;C:\Program Files\Acer\Acer ePower Management\ePowerSvc.exe [2011-5-15 873064]

R2 Live Updater Service;Live Updater Service;C:\Program Files\Acer\Acer Updater\UpdaterService.exe [2011-4-6 244624]

R3 b57xdbd;Broadcom xD Picture Bus Driver Service;C:\Windows\system32\drivers\b57xdbd.sys --> C:\Windows\system32\drivers\b57xdbd.sys [?]

R3 b57xdmp;Broadcom xD Picture vstorp client drv;C:\Windows\system32\drivers\b57xdmp.sys --> C:\Windows\system32\drivers\b57xdmp.sys [?]

R3 bScsiMSa;bScsiMSa;C:\Windows\system32\drivers\bScsiMSa.sys --> C:\Windows\system32\drivers\bScsiMSa.sys [?]

R3 bScsiSDa;bScsiSDa;C:\Windows\system32\DRIVERS\bScsiSDa.sys --> C:\Windows\system32\DRIVERS\bScsiSDa.sys [?]

R3 IntcDAud;Intel® Display Audio;C:\Windows\system32\DRIVERS\IntcDAud.sys --> C:\Windows\system32\DRIVERS\IntcDAud.sys [?]

R3 k57nd60a;Broadcom NetLink ™ Gigabit Ethernet - NDIS 6.0;C:\Windows\system32\DRIVERS\k57nd60a.sys --> C:\Windows\system32\DRIVERS\k57nd60a.sys [?]

R3 MEIx64;Intel® Management Engine Interface;C:\Windows\system32\DRIVERS\HECIx64.sys --> C:\Windows\system32\DRIVERS\HECIx64.sys [?]

S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]

S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-3-18 138576]

S2 DsiWMIService;Dritek WMI Service;C:\Program Files (x86)\Launch Manager\dsiwmis.exe [2011-4-6 352336]

S2 ExpatShieldService;Expat Shield Service;C:\Program Files (x86)\Expat Shield\bin\openvpnas.exe [2012-1-6 331608]

S2 ExpatSrv;Expat Shield Routing Service;C:\Program Files (x86)\Expat Shield\HssWPR\hsssrv.exe [2012-1-4 363336]

S2 ExpatWd;Expat Shield Monitoring Service;C:\Program Files (x86)\Expat Shield\bin\hsswd.exe -product Expat --> C:\Program Files (x86)\Expat Shield\bin\hsswd.exe -product Expat [?]

S2 GREGService;GREGService;C:\Program Files (x86)\Acer\Registration\GREGsvc.exe [2010-1-8 23584]

S2 IAStorDataMgrSvc;Intel® Rapid Storage Technology;C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe [2011-4-6 13336]

S2 NOBU;Norton Online Backup;C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe [2010-6-1 2804568]

S2 NTI IScheduleSvc;NTI IScheduleSvc;C:\Program Files (x86)\NTI\Acer Backup Manager\IScheduleSvc.exe [2011-2-15 257344]

S2 SkypeUpdate;Skype Updater;C:\Program Files (x86)\Skype\Updater\Updater.exe [2012-7-13 160944]

S2 UNS;Intel® Management and Security Application User Notification Service;C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe [2011-5-15 2656280]

S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-8-12 250808]

S3 EgisTec Ticket Service;EgisTec Ticket Service;C:\Program Files (x86)\Common Files\EgisTec\Services\EgisTicketService.exe [2010-9-27 172912]

S3 ExpatTrayService;Expat Shield Tray Service;C:\Program Files (x86)\Expat Shield\bin\ExpatTrayService.exe [2012-1-6 77520]

S3 GamesAppService;GamesAppService;C:\Program Files (x86)\WildTangent Games\App\GamesAppService.exe [2010-10-12 206072]

S3 McComponentHostService;McAfee Security Scan Component Host Service;C:\Program Files (x86)\McAfee Security Scan\3.0.207\McCHSvc.exe [2011-6-17 237008]

S3 Microsoft SharePoint Workspace Audit Service;Microsoft SharePoint Workspace Audit Service;C:\Program Files\Microsoft Office\Office14\GROOVE.EXE [2011-6-12 51740536]

S3 MozillaMaintenance;Mozilla Maintenance Service;C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe [2012-8-12 114144]

S3 NisDrv;Microsoft Network Inspection System;C:\Windows\system32\DRIVERS\NisDrvWFP.sys --> C:\Windows\system32\DRIVERS\NisDrvWFP.sys [?]

S3 NisSrv;Microsoft Network Inspection;C:\Program Files\Microsoft Security Client\NisSrv.exe [2012-9-12 368896]

S3 ose64;Office 64 Source Engine;C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2010-1-9 174440]

S3 osppsvc;Office Software Protection Platform;C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-1-9 4925184]

S3 SwitchBoard;Adobe SwitchBoard;C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [2010-2-19 517096]

S3 TsUsbFlt;TsUsbFlt;C:\Windows\system32\drivers\tsusbflt.sys --> C:\Windows\system32\drivers\tsusbflt.sys [?]

S3 TsUsbGD;Remote Desktop Generic USB Device;C:\Windows\system32\drivers\TsUsbGD.sys --> C:\Windows\system32\drivers\TsUsbGD.sys [?]

S3 USBAAPL64;Apple Mobile USB Driver;C:\Windows\system32\Drivers\usbaapl64.sys --> C:\Windows\system32\Drivers\usbaapl64.sys [?]

S3 WatAdminSvc;Windows Activation Technologies Service;C:\Windows\system32\Wat\WatAdminSvc.exe --> C:\Windows\system32\Wat\WatAdminSvc.exe [?]

S3 WSDPrintDevice;WSD Print Support via UMB;C:\Windows\system32\DRIVERS\WSDPrint.sys --> C:\Windows\system32\DRIVERS\WSDPrint.sys [?]

S4 wlcrasvc;Windows Live Mesh remote connections service;C:\Program Files\Windows Live\Mesh\wlcrasvc.exe [2010-9-22 57184]

.

=============== Created Last 30 ================

.

2012-10-10 02:01:14 -------- d-----w- C:\Users\Marci\AppData\Roaming\Malwarebytes

2012-10-10 02:01:07 25928 ----a-w- C:\Windows\System32\drivers\mbam.sys

2012-10-10 02:01:07 -------- d-----w- C:\ProgramData\Malwarebytes

2012-10-10 02:01:06 -------- d-----w- C:\Program Files (x86)\Malwarebytes' Anti-Malware

2012-10-10 01:42:13 1659760 ----a-w- C:\Windows\System32\drivers\ntfs.sys

2012-10-10 01:39:47 2048 ----a-w- C:\Windows\SysWow64\tzres.dll

2012-10-10 01:39:47 2048 ----a-w- C:\Windows\System32\tzres.dll

2012-10-10 01:39:29 715776 ----a-w- C:\Windows\System32\kerberos.dll

2012-10-10 01:39:29 542208 ----a-w- C:\Windows\SysWow64\kerberos.dll

2012-10-10 01:39:16 1464320 ----a-w- C:\Windows\System32\crypt32.dll

2012-10-10 01:39:15 184320 ----a-w- C:\Windows\System32\cryptsvc.dll

2012-10-10 01:39:15 140288 ----a-w- C:\Windows\SysWow64\cryptsvc.dll

2012-10-10 01:39:15 140288 ----a-w- C:\Windows\System32\cryptnet.dll

2012-10-10 01:39:15 1159680 ----a-w- C:\Windows\SysWow64\crypt32.dll

2012-10-10 01:39:15 103936 ----a-w- C:\Windows\SysWow64\cryptnet.dll

2012-10-07 14:48:51 -------- d-----w- C:\Users\Marci\AppData\Local\TelevisionFanatic

2012-10-07 14:47:43 -------- d-----w- C:\Users\Marci\AppData\Local\dealcabby

2012-10-07 14:47:40 -------- d-----w- C:\ProgramData\Sendori

2012-10-07 14:47:38 -------- d-----w- C:\Program Files (x86)\PricePeep

2012-10-07 14:47:38 -------- d-----w- C:\Program Files (x86)\FLVPlayer

2012-10-07 14:47:37 -------- d-----w- C:\Program Files (x86)\Sendori

2012-10-07 14:39:02 -------- d-----w- C:\Program Files (x86)\TelevisionFanatic

2012-10-07 14:11:15 -------- d-----w- C:\Users\Marci\AppData\Local\Ilivid Player

2012-10-07 14:10:51 -------- d-----w- C:\Program Files (x86)\iLivid

2012-09-30 04:21:30 972192 ------w- C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{A03729AC-2912-46FF-93F5-F55302D7C2EB}\gapaengine.dll

2012-09-29 02:49:32 245760 ----a-w- C:\Windows\System32\OxpsConverter.exe

2012-09-11 22:09:55 950128 ----a-w- C:\Windows\System32\drivers\ndis.sys

2012-09-11 22:09:54 574464 ----a-w- C:\Windows\System32\d3d10level9.dll

2012-09-11 22:09:54 490496 ----a-w- C:\Windows\SysWow64\d3d10level9.dll

2012-09-11 22:09:54 41472 ----a-w- C:\Windows\System32\drivers\RNDISMP.sys

2012-09-11 22:09:53 376688 ----a-w- C:\Windows\System32\drivers\netio.sys

2012-09-11 22:09:53 288624 ----a-w- C:\Windows\System32\drivers\FWPKCLNT.SYS

2012-09-11 22:09:53 1913200 ----a-w- C:\Windows\System32\drivers\tcpip.sys

.

==================== Find3M ====================

.

2012-10-10 21:07:16 73656 ----a-w- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl

2012-10-10 21:07:16 696760 ----a-w- C:\Windows\SysWow64\FlashPlayerApp.exe

2012-08-31 02:03:48 228768 ----a-w- C:\Windows\System32\drivers\MpFilter.sys

2012-08-31 02:03:48 128456 ----a-w- C:\Windows\System32\drivers\NisDrvWFP.sys

2012-08-30 18:03:45 5559664 ----a-w- C:\Windows\System32\ntoskrnl.exe

2012-08-30 17:12:02 3968880 ----a-w- C:\Windows\SysWow64\ntkrnlpa.exe

2012-08-30 17:12:02 3914096 ----a-w- C:\Windows\SysWow64\ntoskrnl.exe

2012-08-24 18:05:07 220160 ----a-w- C:\Windows\System32\wintrust.dll

2012-08-24 16:57:48 172544 ----a-w- C:\Windows\SysWow64\wintrust.dll

2012-08-24 10:31:32 2312704 ----a-w- C:\Windows\System32\jscript9.dll

2012-08-24 10:21:18 1392128 ----a-w- C:\Windows\System32\wininet.dll

2012-08-24 10:20:11 1494528 ----a-w- C:\Windows\System32\inetcpl.cpl

2012-08-24 10:14:45 173056 ----a-w- C:\Windows\System32\ieUnatt.exe

2012-08-24 10:13:29 599040 ----a-w- C:\Windows\System32\vbscript.dll

2012-08-24 10:09:42 2382848 ----a-w- C:\Windows\System32\mshtml.tlb

2012-08-24 06:59:17 1800704 ----a-w- C:\Windows\SysWow64\jscript9.dll

2012-08-24 06:51:27 1129472 ----a-w- C:\Windows\SysWow64\wininet.dll

2012-08-24 06:51:02 1427968 ----a-w- C:\Windows\SysWow64\inetcpl.cpl

2012-08-24 06:47:26 142848 ----a-w- C:\Windows\SysWow64\ieUnatt.exe

2012-08-24 06:47:12 420864 ----a-w- C:\Windows\SysWow64\vbscript.dll

2012-08-24 06:43:58 2382848 ----a-w- C:\Windows\SysWow64\mshtml.tlb

2012-08-20 18:48:44 362496 ----a-w- C:\Windows\System32\wow64win.dll

2012-08-20 18:48:44 243200 ----a-w- C:\Windows\System32\wow64.dll

2012-08-20 18:48:44 13312 ----a-w- C:\Windows\System32\wow64cpu.dll

2012-08-20 18:48:43 215040 ----a-w- C:\Windows\System32\winsrv.dll

2012-08-20 18:48:37 16384 ----a-w- C:\Windows\System32\ntvdm64.dll

2012-08-20 18:48:35 424448 ----a-w- C:\Windows\System32\KernelBase.dll

2012-08-20 18:46:22 338432 ----a-w- C:\Windows\System32\conhost.exe

2012-08-20 17:40:21 14336 ----a-w- C:\Windows\SysWow64\ntvdm64.dll

2012-08-20 17:38:44 44032 ----a-w- C:\Windows\apppatch\acwow64.dll

2012-08-20 17:38:26 25600 ----a-w- C:\Windows\SysWow64\setup16.exe

2012-08-20 17:37:19 5120 ----a-w- C:\Windows\SysWow64\wow32.dll

2012-08-20 17:37:18 274944 ----a-w- C:\Windows\SysWow64\KernelBase.dll

2012-08-20 15:38:21 7680 ----a-w- C:\Windows\SysWow64\instnm.exe

2012-08-20 15:38:20 2048 ----a-w- C:\Windows\SysWow64\user.exe

2012-08-20 15:33:28 6144 ---ha-w- C:\Windows\SysWow64\api-ms-win-security-base-l1-1-0.dll

2012-08-20 15:33:28 4608 ---ha-w- C:\Windows\SysWow64\api-ms-win-core-threadpool-l1-1-0.dll

2012-08-20 15:33:28 3584 ---ha-w- C:\Windows\SysWow64\api-ms-win-core-xstate-l1-1-0.dll

2012-08-20 15:33:28 3072 ---ha-w- C:\Windows\SysWow64\api-ms-win-core-util-l1-1-0.dll

2012-07-18 18:15:06 3148800 ----a-w- C:\Windows\System32\win32k.sys

.

============= FINISH: 18:23:40.74 ===============

Link to post
Share on other sites

Welcome to the forum.

Can you post the Attach.txt also.

~~~~~~~~~~~~~~~~

Please remove any usb or external drives from the computer before you run this scan!

Please download and run RogueKiller to your desktop.

Quit all running programs.

For Windows XP, double-click to start.

For Vista or Windows 7, do a right-click on the program, select Run as Administrator to start, & when prompted Allow to run.

Click Scan to scan the system.

When the scan completes > Close out the program > Don't Fix anything!

Don't run any other options, they're not all bad!!!!!!!

Post back the report which should be located on your desktop.

MrC

------->Your topic will be closed if you haven't replied within 3 days!<--------

Link to post
Share on other sites

Attach.txt.. erm.. attached!

I'll run rogue killer now. Thanks for the quick reply!

never mind, didn't attach... posted below

.

UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.

IF REQUESTED, ZIP IT UP & ATTACH IT

.

DDS (Ver_2011-08-26.01)

.

Microsoft Windows 7 Home Premium

Boot Device: \Device\HarddiskVolume2

Install Date: 8/1/2011 5:39:40 PM

System Uptime: 10/10/2012 5:27:01 PM (1 hours ago)

.

Motherboard: Acer | | JE50_HR

Processor: Intel® Core i3-2310M CPU @ 2.10GHz | CPU1 | 2100/1333mhz

.

==== Disk Partitions =========================

.

C: is FIXED (NTFS) - 283 GiB total, 218.008 GiB free.

D: is CDROM ()

E: is Removable

F: is Removable

.

==== Disabled Device Manager Items =============

.

Class GUID: {eec5ad98-8080-425f-922a-dabf3de3f69a}

Description: WPD FileSystem Volume Driver

Device ID: WPDBUSENUMROOT\UMB\2&37C186B&0&STORAGE#VOLUME#_??_USBSTOR#DISK&VEN_SANDISK&PROD_CRUZER&REV_1.26#200605727102E240C93D&0#

Manufacturer: Microsoft

Name: WPD FileSystem Volume Driver

PNP Device ID: WPDBUSENUMROOT\UMB\2&37C186B&0&STORAGE#VOLUME#_??_USBSTOR#DISK&VEN_SANDISK&PROD_CRUZER&REV_1.26#200605727102E240C93D&0#

Service: WUDFRd

.

Class GUID: {eec5ad98-8080-425f-922a-dabf3de3f69a}

Description: SD

Device ID: WPDBUSENUMROOT\UMB\2&37C186B&0&STORAGE#VOLUME#_??_SCSI#DISK&VEN_BROADCOM&PROD_SD&REV_0001#5&74D8BEC&0&000000#

Manufacturer: Broadcom

Name: LEXAR MEDIA

PNP Device ID: WPDBUSENUMROOT\UMB\2&37C186B&0&STORAGE#VOLUME#_??_SCSI#DISK&VEN_BROADCOM&PROD_SD&REV_0001#5&74D8BEC&0&000000#

Service: WUDFRd

.

==== System Restore Points ===================

.

RP163: 10/7/2012 1:49:39 AM - Windows Update

RP164: 10/8/2012 9:25:12 PM - Installed Java 6 Update 35

RP165: 10/9/2012 9:19:10 PM - Restore Operation

RP167: 10/9/2012 9:40:46 PM - Windows Update

RP169: 10/10/2012 5:05:47 PM - Windows Update

.

==== Installed Programs ======================

.

µTorrent

Acer Backup Manager

Acer Crystal Eye Webcam

Acer ePower Management

Acer eRecovery Management

Acer Games

Acer Registration

Acer ScreenSaver

Acer Updater

Acrobat.com

Adobe Acrobat X Pro - English, Français, Deutsch

Adobe AIR

Adobe Community Help

Adobe Flash Player 11 ActiveX

Adobe Flash Player 11 Plugin

Adobe Media Player

Adobe Photoshop CS5

Adobe Reader 9.1 MUI

Agatha Christie - 4:50 from Paddington

Apple Application Support

Apple Software Update

Backup Manager V3

BBC iPlayer Desktop

Bejeweled 2 Deluxe

Build-a-lot 2

Carbonite

Chuzzle Deluxe

clear.fi

clear.fi Client

D3DX10

Diner Dash 2 Restaurant Rescue

Dolby Advanced Audio v2

Dora's World Adventure

eBay Worldwide

Expat Shield 2.24

FATE - The Traitor Soul

Final Drive: Nitro

Galerie de photos Windows Live

Identity Card

Intel® Control Center

Intel® Management Engine Components

Intel® Processor Graphics

Intel® Rapid Storage Technology

Java Auto Updater

Java 6 Update 31

Jewel Quest Heritage

Junk Mail filter update

Launch Manager

LinkedIn Outlook Connector

Malwarebytes Anti-Malware version 1.65.0.1400

McAfee Security Scan Plus

MediaEspresso

Mesh Runtime

Microsoft Office 2010

Microsoft Office Live Small Business Image Uploader

Microsoft SQL Server 2005 Compact Edition [ENU]

Microsoft Visual C++ 2005 Redistributable

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161

Microsoft_VC80_ATL_x86

Microsoft_VC80_CRT_x86

Microsoft_VC80_MFC_x86

Microsoft_VC80_MFCLOC_x86

Microsoft_VC90_ATL_x86

Microsoft_VC90_CRT_x86

Microsoft_VC90_MFC_x86

Mozilla Firefox 15.0 (x86 en-US)

Mozilla Firefox 15.0.1 (x86 en-US)

Mozilla Maintenance Service

MSVCRT

MSVCRT_amd64

MSXML 4.0 SP2 (KB954430)

MSXML 4.0 SP2 (KB973688)

Mystery P.I. - Stolen in San Francisco

MyWinLocker 4

MyWinLocker Suite

Namco All-Stars: PAC-MAN

newsXpresso

NOOK for PC

Norton Online Backup

NTI Media Maker 9

PDF Settings CS5

Penguins!

Plants vs. Zombies - Game of the Year

Poker Superstars III

Polar Bowler

Polar Golfer

QuickTime

Realtek High Definition Audio Driver

Security Update for Microsoft .NET Framework 4 Client Profile (KB2478663)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2518870)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2539636)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2572078)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2604121)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2633870)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2656351)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2656368)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2656368v2)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2656405)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2686827)

Shredder

Skype™ 5.10

Times Reader

Torchlight

Update for Microsoft .NET Framework 4 Client Profile (KB2468871)

Update for Microsoft .NET Framework 4 Client Profile (KB2533523)

Update for Microsoft .NET Framework 4 Client Profile (KB2600217)

Update Installer for WildTangent Games App

Virtual Villagers 4 - The Tree of Life

vshare.tv Bar Toolbar

vShare.tv plugin 1.3

Welcome Center

WildTangent Games App (Acer Games)

Windows Live

Windows Live Communications Platform

Windows Live Essentials

Windows Live Installer

Windows Live Mail

Windows Live Mesh

Windows Live Messenger

Windows Live Movie Maker

Windows Live Photo Common

Windows Live Photo Gallery

Windows Live PIMT Platform

Windows Live SOXE

Windows Live SOXE Definitions

Windows Live UX Platform

Windows Live UX Platform Language Pack

Windows Live Writer

Windows Live Writer Resources

Zuma's Revenge

.

==== Event Viewer Messages From Past Week ========

.

10/9/2012 9:55:58 PM, Error: Microsoft Antimalware [3002] - Microsoft Antimalware Real-Time Protection feature has encountered an error and failed. Feature: Network Inspection System Error Code: 0x8007045b Error description: A system shutdown is in progress. Reason: The system is missing updates that are required for running Network Inspection System. Install the required updates and restart the computer.

10/9/2012 9:45:58 PM, Error: Microsoft Antimalware [3002] - Microsoft Antimalware Real-Time Protection feature has encountered an error and failed. Feature: Network Inspection System Error Code: 0x80070714 Error description: The specified image file did not contain a resource section. Reason: The system is missing updates that are required for running Network Inspection System. Install the required updates and restart the computer.

10/9/2012 9:41:50 PM, Error: Microsoft-Windows-WindowsUpdateClient [20] - Installation Failure: Windows failed to install the following update with error 0x80070643: Definition Update for Microsoft Security Essentials - KB2310138 (Definition 1.137.1428.0).

10/9/2012 9:41:25 PM, Error: Microsoft Antimalware [3002] - Microsoft Antimalware Real-Time Protection feature has encountered an error and failed. Feature: Network Inspection System Error Code: 0x80070714 Error description: The specified image file did not contain a resource section. Reason: Antimalware protection has stopped functioning for an unknown reason. In some instances, restarting the service may resolve the problem.

10/9/2012 9:41:24 PM, Error: Microsoft Antimalware [2003] - Microsoft Antimalware has encountered an error trying to update the engine. New Engine Version: Previous Engine Version: 2.1.8600.0 Engine Type: Network Inspection System User: NT AUTHORITY\SYSTEM Error Code: 0x80070714 Error description: The specified image file did not contain a resource section.

10/9/2012 9:41:24 PM, Error: Microsoft Antimalware [2001] - Microsoft Antimalware has encountered an error trying to update signatures. New Signature Version: Previous Signature Version: 15.11.0.0 Update Source: User Update Stage: Install Source Path: Signature Type: Network Inspection System Update Type: Full User: NT AUTHORITY\SYSTEM Current Engine Version: Previous Engine Version: 2.1.8600.0 Error code: 0x80070714 Error description: The specified image file did not contain a resource section.

10/9/2012 9:41:24 PM, Error: Microsoft Antimalware [2001] - Microsoft Antimalware has encountered an error trying to update signatures. New Signature Version: Previous Signature Version: 1.137.1428.0 Update Source: Microsoft Update Server Update Stage: Install Source Path: http://www.microsoft.com Signature Type: AntiVirus Update Type: Full User: NT AUTHORITY\SYSTEM Current Engine Version: Previous Engine Version: 1.1.8800.0 Error code: 0x80070643 Error description: Fatal error during installation.

10/9/2012 9:35:42 PM, Error: Service Control Manager [7031] - The CarboniteService service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service.

10/9/2012 9:24:44 PM, Error: Microsoft Antimalware [3002] - Microsoft Antimalware Real-Time Protection feature has encountered an error and failed. Feature: Network Inspection System Error Code: 0x80070714 Error description: The specified image file did not contain a resource section. Reason: The system is missing updates that are required for running Network Inspection System. Install the required updates and restart the computer.

10/9/2012 9:24:33 PM, Error: Microsoft Antimalware [2004] - Microsoft Antimalware has encountered an error trying to load signatures and will attempt reverting back to a known-good set of signatures. Signatures Attempted: Current Error Code: 0x80070002 Error description: The system cannot find the file specified. Signature version: 1.137.851.0;1.137.851.0 Engine version: 1.1.8800.0

10/9/2012 9:23:28 PM, Error: Microsoft-Windows-Kernel-General [5] - {Registry Hive Recovered} Registry hive (file): '\??\Volume{a89333b3-7ed5-11e0-942b-806e6f6e6963}\System Volume Information\SystemRestore\{41E15251-8C93-4F8D-8158-20B72308443F}' was corrupted and it has been recovered. Some data might have been lost.

10/9/2012 5:01:52 PM, Error: Service Control Manager [7000] - The Sendori service failed to start due to the following error: The system cannot find the file specified.

10/9/2012 10:54:29 PM, Error: Microsoft Antimalware [3002] - Microsoft Antimalware Real-Time Protection feature has encountered an error and failed. Feature: Network Inspection System Error Code: 0x80070714 Error description: The specified image file did not contain a resource section. Reason: The system is missing updates that are required for running Network Inspection System. Install the required updates and restart the computer.

10/9/2012 10:53:00 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1068" attempting to start the service fdPHost with arguments "" in order to run the server: {D3DCB472-7261-43CE-924B-0704BD730D5F}

10/9/2012 10:53:00 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1068" attempting to start the service fdPHost with arguments "" in order to run the server: {145B4335-FE2A-4927-A040-7C35AD3180EF}

10/9/2012 10:52:57 PM, Error: Service Control Manager [7001] - The HomeGroup Provider service depends on the Function Discovery Provider Host service which failed to start because of the following error: The dependency service or group failed to start.

10/9/2012 10:52:49 PM, Error: Service Control Manager [7001] - The Computer Browser service depends on the Server service which failed to start because of the following error: The dependency service or group failed to start.

10/9/2012 10:52:46 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service WSearch with arguments "" in order to run the server: {9E175B6D-F52A-11D8-B9A5-505054503030}

10/9/2012 10:52:46 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service WSearch with arguments "" in order to run the server: {7D096C5F-AC08-4F1F-BEB7-5C22C517CE39}

10/9/2012 10:52:44 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service EventSystem with arguments "" in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF}

10/9/2012 10:52:43 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service CarboniteService with arguments "" in order to run the server: {36471C67-6A93-4434-92CC-4C614CD06666}

10/9/2012 10:52:35 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service ShellHWDetection with arguments "" in order to run the server: {DD522ACC-F821-461A-A407-50B198B896DC}

10/9/2012 10:52:30 PM, Error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: discache MpFilter mwlPSDFilter mwlPSDNServ mwlPSDVDisk spldr Wanarpv6

10/9/2012 10:46:57 PM, Error: Microsoft Antimalware [3002] - Microsoft Antimalware Real-Time Protection feature has encountered an error and failed. Feature: Network Inspection System Error Code: 0x80070714 Error description: The specified image file did not contain a resource section. Reason: The system is missing updates that are required for running Network Inspection System. Install the required updates and restart the computer.

10/8/2012 8:30:06 PM, Error: Service Control Manager [7034] - The Application Sendori service terminated unexpectedly. It has done this 1 time(s).

10/8/2012 5:18:35 PM, Error: Ntfs [55] - The file system structure on the disk is corrupt and unusable. Please run the chkdsk utility on the volume Acer.

10/8/2012 2:07:16 PM, Error: Service Control Manager [7034] - The Sendoriv1 service terminated unexpectedly. It has done this 1 time(s).

10/8/2012 2:06:36 PM, Error: Service Control Manager [7009] - A timeout was reached (30000 milliseconds) while waiting for the Service Sendori service to connect.

10/8/2012 2:06:36 PM, Error: Service Control Manager [7000] - The Service Sendori service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.

10/4/2012 9:12:42 AM, Error: Microsoft-Windows-WER-SystemErrorReporting [1001] - The computer has rebooted from a bugcheck. The bugcheck was: 0x0000009f (0x0000000000000003, 0xfffffa8004029e30, 0xfffff80000b9c3d8, 0xfffffa800909b320). A dump was saved in: C:\Windows\MEMORY.DMP. Report Id: 100412-62681-01.

10/10/2012 5:41:20 PM, Error: Microsoft-Windows-Kernel-General [5] - {Registry Hive Recovered} Registry hive (file): '\??\C:\Windows\System32\SMI\Store\Machine\SCHEMA.DAT' was corrupted and it has been recovered. Some data might have been lost.

10/10/2012 5:29:58 PM, Error: Service Control Manager [7001] - The Intel® Management and Security Application User Notification Service service depends on the Intel® Management and Security Application Local Management Service service which failed to start because of the following error: The system cannot find the file specified.

10/10/2012 5:29:58 PM, Error: Service Control Manager [7000] - The Intel® Management and Security Application Local Management Service service failed to start due to the following error: The system cannot find the file specified.

10/10/2012 5:29:54 PM, Error: Service Control Manager [7000] - The Intel® Rapid Storage Technology service failed to start due to the following error: Access is denied.

10/10/2012 5:27:53 PM, Error: Microsoft Antimalware [3002] - Microsoft Antimalware Real-Time Protection feature has encountered an error and failed. Feature: Network Inspection System Error Code: 0x80070714 Error description: The specified image file did not contain a resource section. Reason: The system is missing updates that are required for running Network Inspection System. Install the required updates and restart the computer.

10/10/2012 5:27:51 PM, Error: Service Control Manager [7000] - The NTI IScheduleSvc service failed to start due to the following error: The system cannot find the file specified.

10/10/2012 5:27:51 PM, Error: Service Control Manager [7000] - The Norton Online Backup service failed to start due to the following error: Access is denied.

10/10/2012 5:27:51 PM, Error: Service Control Manager [7000] - The GREGService service failed to start due to the following error: The system cannot find the file specified.

10/10/2012 5:27:51 PM, Error: Service Control Manager [7000] - The Expat Shield Service service failed to start due to the following error: The system cannot find the file specified.

10/10/2012 5:27:51 PM, Error: Service Control Manager [7000] - The Expat Shield Routing Service service failed to start due to the following error: The system cannot find the file specified.

10/10/2012 5:27:51 PM, Error: Service Control Manager [7000] - The Expat Shield Monitoring Service service failed to start due to the following error: The system cannot find the file specified.

10/10/2012 5:27:51 PM, Error: Service Control Manager [7000] - The Dritek WMI Service service failed to start due to the following error: The system cannot find the file specified.

.

==== End Of File ===========================

Link to post
Share on other sites

RogueKiller Report:

RogueKiller V8.1.1 [10/03/2012] by Tigzy

mail: tigzyRK<at>gmail<dot>com

Feedback: http://www.geekstogo.com/forum/files/file/413-roguekiller/

Website: http://tigzy.geekstogo.com/roguekiller.php

Blog: http://tigzyrk.blogspot.com

Operating System: Windows 7 (6.1.7601 Service Pack 1) 64 bits version

Started in : Normal mode

User : Marci [Admin rights]

Mode : Scan -- Date : 10/10/2012 19:38:15

¤¤¤ Bad processes : 0 ¤¤¤

¤¤¤ Registry Entries : 5 ¤¤¤

[TASK][sUSP PATH] {5F6010C8-60E5-41f3-BF5B-C3AF5DBE12D4} : "C:\ProgramData\Carbonite\Carbonite Backup\CarboniteUpgrade.exe" /silent -> FOUND

[DNS] HKLM\[...]\ControlSet001\Services\Interfaces\{AA180B28-E6AA-4BED-AE1A-9E3A74AEE289} : NameServer (10.197.48.1) -> FOUND

[DNS] HKLM\[...]\ControlSet002\Services\Interfaces\{AA180B28-E6AA-4BED-AE1A-9E3A74AEE289} : NameServer (10.197.48.1) -> FOUND

[HJ DESK] HKLM\[...]\NewStartPanel : {59031a47-3f72-44a7-89c5-5595fe6b30ee} (1) -> FOUND

[HJ DESK] HKLM\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> FOUND

¤¤¤ Particular Files / Folders: ¤¤¤

¤¤¤ Driver : [NOT LOADED] ¤¤¤

¤¤¤ HOSTS File: ¤¤¤

--> C:\Windows\system32\drivers\etc\hosts

¤¤¤ MBR Check: ¤¤¤

+++++ PhysicalDrive0: WDC WD3200BPVT-22ZEST0 +++++

--- User ---

[MBR] 2d9ca7f73f0d18cd6176639eeb124826

[bSP] ff54479be1e29a3382a6e6f5272fdc2f : Windows 7 MBR Code

Partition table:

0 - [XXXXXX] ACER (0x27) [VISIBLE] Offset (sectors): 2048 | Size: 15360 Mo

1 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 31459328 | Size: 100 Mo

2 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 31664128 | Size: 289783 Mo

User = LL1 ... OK!

User = LL2 ... OK!

+++++ PhysicalDrive1: Broadcom SD SCSI Disk Device +++++

--- User ---

[MBR] 5a63b18f8797aa298b3847db3395fcd1

[bSP] df4f83c1f72e36823a12b0dfc7617313 : MBR Code unknown

Partition table:

0 - [XXXXXX] FAT16 (0x06) [VISIBLE] Offset (sectors): 233 | Size: 489 Mo

User = LL1 ... OK!

Error reading LL2 MBR!

Finished : << RKreport[1].txt >>

RKreport[1].txt

Link to post
Share on other sites

Please download AdwCleaner from here and save it on your Desktop.

  1. Right-click on adwcleaner.exe and select Run As Administrator to launch the application.
  2. Now click on the Search tab.
  3. Please post the contents of the log-file created in your next post.

Note: The log can also be located at C:\ >> AdwCleaner[XX].txt >> XX <-- Denotes the number of times the application has been ran, so in this should be something like R1.

MrC

Link to post
Share on other sites

# AdwCleaner v2.004 - Logfile created 10/10/2012 at 19:52:36

# Updated 06/10/2012 by Xplode

# Operating system : Windows 7 Home Premium Service Pack 1 (64 bits)

# User : Marci - MARCI7

# Boot Mode : Normal

# Running from : C:\Users\Marci\Desktop\adwcleaner.exe

# Option [search]

***** [services] *****

***** [Files / Folders] *****

File Found : C:\Program Files (x86)\Mozilla Firefox\Plugins\npvsharetvplg.dll

File Found : C:\Users\Marci\AppData\Roaming\Mozilla\Firefox\Profiles\o3zmyekh.default\extensions\pricepeep@getpricepeep.com.xpi

Folder Found : C:\Program Files (x86)\Conduit

Folder Found : C:\Program Files (x86)\Ilivid

Folder Found : C:\Program Files (x86)\Mozilla Firefox\Extensions\afurladvisor@anchorfree.com

Folder Found : C:\Program Files (x86)\PricePeep

Folder Found : C:\Program Files (x86)\vShare.tv plugin

Folder Found : C:\Program Files (x86)\vshare.tv_Bar

Folder Found : C:\Users\Marci\AppData\Local\Conduit

Folder Found : C:\Users\Marci\AppData\Local\Ilivid Player

Folder Found : C:\Users\Marci\AppData\Local\Software

Folder Found : C:\Users\Marci\AppData\Local\Temp\CT2818425

Folder Found : C:\Users\Marci\AppData\LocalLow\Conduit

Folder Found : C:\Users\Marci\AppData\LocalLow\vshare.tv_Bar

Folder Found : C:\Users\Marci\AppData\Roaming\Mozilla\Firefox\Profiles\o3zmyekh.default\ConduitCommon

Folder Found : C:\Users\Marci\AppData\Roaming\Mozilla\Firefox\Profiles\o3zmyekh.default\CT2818425

Folder Found : C:\Users\Marci\AppData\Roaming\Mozilla\Firefox\Profiles\o3zmyekh.default\extensions\{7aeb3efd-e564-43f1-b658-5058a7c5743b}

***** [Registry] *****

Key Found : HKCU\Software\AppDataLow\Software\Conduit

Key Found : HKCU\Software\AppDataLow\Software\vshare.tv_Bar

Key Found : HKCU\Software\AppDataLow\Toolbar

Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{7AEB3EFD-E564-43F1-B658-5058A7C5743B}

Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{7AEB3EFD-E564-43F1-B658-5058A7C5743B}

Key Found : HKCU\Software\StartSearch

Key Found : HKLM\SOFTWARE\Classes\Toolbar.CT2818425

Key Found : HKLM\SOFTWARE\Classes\TypeLib\{99C22A61-21BA-4F81-85FF-CDC9EB5DB10B}

Key Found : HKLM\Software\Conduit

Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{91E526FE-D9CF-443C-91A4-4A42F6178477}

Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{A1B48071-416D-474E-A13B-BE5456E7FC31}

Key Found : HKLM\Software\vshare.tv_Bar

Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{7AEB3EFD-E564-43F1-B658-5058A7C5743B}

Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{91E526FE-D9CF-443C-91A4-4A42F6178477}

Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{A1B48071-416D-474E-A13B-BE5456E7FC31}

Key Found : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{AF527190-68C9-4D03-AA04-9EB633E1D2C9}

Key Found : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{DE93BFA0-058A-4B8E-A8D9-8918B3817571}

Key Found : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}

Key Found : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{7AEB3EFD-E564-43F1-B658-5058A7C5743B}

Key Found : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\vshare.tv_Bar Toolbar

Key Found : HKLM\SOFTWARE\Classes\Interface\{79FB5FC8-44B9-4AF5-BADD-CCE547F953E5}

Key Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}

Value Found : HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks [{7AEB3EFD-E564-43F1-B658-5058A7C5743B}]

Value Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks [{7AEB3EFD-E564-43F1-B658-5058A7C5743B}]

Value Found : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar [{7AEB3EFD-E564-43F1-B658-5058A7C5743B}]

***** [internet Browsers] *****

-\\ Internet Explorer v9.0.8112.16421

[OK] Registry is clean.

-\\ Mozilla Firefox v15.0 (en-US)

Profile name : default

File : C:\Users\Marci\AppData\Roaming\Mozilla\Firefox\Profiles\o3zmyekh.default\prefs.js

Found : user_pref("CT2818425..clientLogIsEnabled", false);

Found : user_pref("CT2818425..clientLogServiceUrl", "hxxp://clientlog.users.conduit.com/ClientDiagnostics.as[...]

Found : user_pref("CT2818425..uninstallLogServiceUrl", "hxxp://uninstall.users.conduit.com/Uninstall.asmx/Re[...]

Found : user_pref("CT2818425.ALLOW_SHOWING_HIDDEN_TOOLBAR", false);

Found : user_pref("CT2818425.AboutPrivacyUrl", "hxxp://www.conduit.com/privacy/Default.aspx");

Found : user_pref("CT2818425.BrowserCompStateIsOpen_129712757411525741", true);

Found : user_pref("CT2818425.BrowserCompStateIsOpen_129735245815838327", true);

Found : user_pref("CT2818425.BrowserCompStateIsOpen_129893041058613741", true);

Found : user_pref("CT2818425.CT2818425", "CT2818425");

Found : user_pref("CT2818425.CurrentServerDate", "10-10-2012");

Found : user_pref("CT2818425.DSInstall", false);

Found : user_pref("CT2818425.DialogsAlignMode", "LTR");

Found : user_pref("CT2818425.DialogsGetterLastCheckTime", "Tue Oct 09 2012 21:59:26 GMT-0400 (Eastern Daylig[...]

Found : user_pref("CT2818425.DownloadReferralCookieData", "");

Found : user_pref("CT2818425.EMailNotifierPollDate", "Sat Mar 10 2012 12:21:46 GMT-0500 (Eastern Standard Ti[...]

Found : user_pref("CT2818425.FirstServerDate", "10-3-2012");

Found : user_pref("CT2818425.FirstTime", true);

Found : user_pref("CT2818425.FirstTimeFF3", true);

Found : user_pref("CT2818425.FixPageNotFoundErrors", false);

Found : user_pref("CT2818425.GroupingServerCheckInterval", 1440);

Found : user_pref("CT2818425.GroupingServiceUrl", "hxxp://grouping.services.conduit.com/");

Found : user_pref("CT2818425.HPInstall", false);

Found : user_pref("CT2818425.HasUserGlobalKeys", true);

Found : user_pref("CT2818425.HomePageProtectorEnabled", false);

Found : user_pref("CT2818425.HomepageBeforeUnload", "hxxp://www.facebook.com/marci.gower");

Found : user_pref("CT2818425.Initialize", true);

Found : user_pref("CT2818425.InitializeCommonPrefs", true);

Found : user_pref("CT2818425.InstallationAndCookieDataSentCount", 3);

Found : user_pref("CT2818425.InstallationType", "Unknown");

Found : user_pref("CT2818425.InstalledDate", "Sat Mar 10 2012 12:21:47 GMT-0500 (Eastern Standard Time)");

Found : user_pref("CT2818425.InvalidateCache", false);

Found : user_pref("CT2818425.IsGrouping", false);

Found : user_pref("CT2818425.IsInitSetupIni", true);

Found : user_pref("CT2818425.IsMulticommunity", false);

Found : user_pref("CT2818425.IsOpenThankYouPage", true);

Found : user_pref("CT2818425.IsOpenUninstallPage", true);

Found : user_pref("CT2818425.IsProtectorsInit", true);

Found : user_pref("CT2818425.LanguagePackLastCheckTime", "Tue Oct 09 2012 21:59:26 GMT-0400 (Eastern Dayligh[...]

Found : user_pref("CT2818425.LanguagePackReloadIntervalMM", 1440);

Found : user_pref("CT2818425.LanguagePackServiceUrl", "hxxp://translation.users.conduit.com/Translation.ashx[...]

Found : user_pref("CT2818425.LastLogin_3.10.0.1", "Sat Mar 10 2012 12:22:43 GMT-0500 (Eastern Standard Time)[...]

Found : user_pref("CT2818425.LastLogin_3.12.0.7", "Tue May 01 2012 06:39:06 GMT-0400 (Eastern Daylight Time)[...]

Found : user_pref("CT2818425.LastLogin_3.12.2.3", "Thu May 31 2012 13:11:29 GMT-0400 (Eastern Daylight Time)[...]

Found : user_pref("CT2818425.LastLogin_3.13.0.6", "Sun Jul 15 2012 12:22:15 GMT-0400 (Eastern Daylight Time)[...]

Found : user_pref("CT2818425.LastLogin_3.14.1.0", "Sun Aug 26 2012 00:08:16 GMT-0400 (Eastern Daylight Time)[...]

Found : user_pref("CT2818425.LastLogin_3.15.1.0", "Tue Oct 09 2012 21:59:26 GMT-0400 (Eastern Daylight Time)[...]

Found : user_pref("CT2818425.LatestVersion", "3.15.1.0");

Found : user_pref("CT2818425.Locale", "en");

Found : user_pref("CT2818425.MCDetectTooltipHeight", "83");

Found : user_pref("CT2818425.MCDetectTooltipUrl", "hxxp://@EB_INSTALL_LINK@/rank/tooltip/?version=1");

Found : user_pref("CT2818425.MCDetectTooltipWidth", "295");

Found : user_pref("CT2818425.MyStuffEnabledAtInstallation", true);

Found : user_pref("CT2818425.OriginalFirstVersion", "3.10.0.1");

Found : user_pref("CT2818425.RadioIsPodcast", false);

Found : user_pref("CT2818425.RadioLastCheckTime", "Mon Mar 12 2012 15:16:07 GMT-0400 (Eastern Daylight Time)[...]

Found : user_pref("CT2818425.RadioLastUpdateIPServer", "3");

Found : user_pref("CT2818425.RadioLastUpdateServer", "129330101464100000");

Found : user_pref("CT2818425.RadioMediaID", "21515677");

Found : user_pref("CT2818425.RadioMediaType", "Media Player");

Found : user_pref("CT2818425.RadioMenuSelectedID", "EBRadioMenu_CT281842521515677");

Found : user_pref("CT2818425.RadioShrinkedFromSetup", false);

Found : user_pref("CT2818425.RadioStationName", "Virgin%20Radio%20Classic%20Rock");

Found : user_pref("CT2818425.RadioStationURL", "hxxp://www.smgradio.com/core/audio/wmp/live.asx?service=vcbb[...]

Found : user_pref("CT2818425.SearchCaption", "vshare.tv Customized Web Search");

Found : user_pref("CT2818425.SearchEngineBeforeUnload", "chrome://browser-region/locale/region.properties");

Found : user_pref("CT2818425.SearchFromAddressBarIsInit", true);

Found : user_pref("CT2818425.SearchFromAddressBarUrl", "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT281[...]

Found : user_pref("CT2818425.SearchInNewTabEnabled", true);

Found : user_pref("CT2818425.SearchInNewTabIntervalMM", 1440);

Found : user_pref("CT2818425.SearchInNewTabLastCheckTime", "Tue Oct 09 2012 21:59:25 GMT-0400 (Eastern Dayli[...]

Found : user_pref("CT2818425.SearchInNewTabServiceUrl", "hxxp://newtab.conduit-hosting.com/newtab/?ctid=EB_T[...]

Found : user_pref("CT2818425.SearchInNewTabUserEnabled", false);

Found : user_pref("CT2818425.SearchProtectorEnabled", false);

Found : user_pref("CT2818425.SearchProtectorToolbarDisabled", false);

Found : user_pref("CT2818425.SendProtectorDataViaLogin", true);

Found : user_pref("CT2818425.ServiceMapLastCheckTime", "Tue Oct 09 2012 21:59:25 GMT-0400 (Eastern Daylight [...]

Found : user_pref("CT2818425.SettingsLastCheckTime", "Tue Oct 09 2012 21:59:25 GMT-0400 (Eastern Daylight Ti[...]

Found : user_pref("CT2818425.SettingsLastUpdate", "1348502557");

Found : user_pref("CT2818425.TBHomePageUrl", "hxxp://search.conduit.com/?ctid=CT2818425&SearchSource=13");

Found : user_pref("CT2818425.ThirdPartyComponentsInterval", 504);

Found : user_pref("CT2818425.ThirdPartyComponentsLastCheck", "Sat Mar 10 2012 12:21:45 GMT-0500 (Eastern Sta[...]

Found : user_pref("CT2818425.ThirdPartyComponentsLastUpdate", "1312887586");

Found : user_pref("CT2818425.ToolbarShrinkedFromSetup", false);

Found : user_pref("CT2818425.TrusteLinkUrl", "hxxp://trust.conduit.com/CT2818425");

Found : user_pref("CT2818425.TrustedApiDomains", "conduit.com,conduit-hosting.com,conduit-services.com,clien[...]

Found : user_pref("CT2818425.UserID", "UN47956079780564975");

Found : user_pref("CT2818425.alertChannelId", "1210492");

Found : user_pref("CT2818425.autoDisableScopes", -1);

Found : user_pref("CT2818425.backendstorage.cbfirsttime", "536174204D617220313020323031322031323A32323A34362[...]

Found : user_pref("CT2818425.backendstorage.key_user_agree_ia12", "31");

Found : user_pref("CT2818425.backendstorage.shoppingapp.gk.exipres", "546875204D617220313520323031322031323A[...]

Found : user_pref("CT2818425.backendstorage.shoppingapp.gk.geolocation", "756E6974656420737461746573");

Found : user_pref("CT2818425.backendstorage.user_uniqueid", "66323865656365622D633762322D306639302D356637662[...]

Found : user_pref("CT2818425.components.1000234", false);

Found : user_pref("CT2818425.generalConfigFromLogin", "{\"ApiMaxAlerts\":\"12\",\"SocialDomains\":\"social.c[...]

Found : user_pref("CT2818425.globalFirstTimeInfoLastCheckTime", "Tue Mar 13 2012 03:44:07 GMT-0400 (Eastern [...]

Found : user_pref("CT2818425.homepageProtectorEnableByLogin", true);

Found : user_pref("CT2818425.initDone", true);

Found : user_pref("CT2818425.isAppTrackingManagerOn", true);

Found : user_pref("CT2818425.isFirstRadioInstallation", false);

Found : user_pref("CT2818425.myStuffEnabled", true);

Found : user_pref("CT2818425.myStuffPublihserMinWidth", 400);

Found : user_pref("CT2818425.myStuffSearchUrl", "hxxp://Apps.conduit.com/search?q=SEARCH_TERM&SearchSourceOr[...]

Found : user_pref("CT2818425.myStuffServiceIntervalMM", 1440);

Found : user_pref("CT2818425.myStuffServiceUrl", "hxxp://mystuff.conduit-services.com/MyStuffService.ashx?Co[...]

Found : user_pref("CT2818425.navigateToUrlOnSearch", false);

Found : user_pref("CT2818425.revertSettingsEnabled", false);

Found : user_pref("CT2818425.searchProtectorDialogDelayInSec", 10);

Found : user_pref("CT2818425.searchProtectorEnableByLogin", true);

Found : user_pref("CT2818425.testingCtid", "");

Found : user_pref("CT2818425.toolbarAppMetaDataLastCheckTime", "Tue Oct 09 2012 21:59:26 GMT-0400 (Eastern D[...]

Found : user_pref("CT2818425.toolbarContextMenuLastCheckTime", "Sat Mar 10 2012 12:21:47 GMT-0500 (Eastern S[...]

Found : user_pref("CT2818425.usagesFlag", 2);

Found : user_pref("CommunityToolbar.ETag.hxxp://Settings.toolbar.search.conduit.com/root/CT2818425/CT2818425[...]

Found : user_pref("CommunityToolbar.ETag.hxxp://alerts.conduit-services.com/root/1210492/1206165/US", "\"0\"[...]

Found : user_pref("CommunityToolbar.ETag.hxxp://appsmetadata.toolbar.conduit-services.com/?ctid=CT2818425", [...]

Found : user_pref("CommunityToolbar.ETag.hxxp://contextmenu.toolbar.conduit-services.com/?name=GottenApps&lo[...]

Found : user_pref("CommunityToolbar.ETag.hxxp://contextmenu.toolbar.conduit-services.com/?name=GottenApps&lo[...]

Found : user_pref("CommunityToolbar.ETag.hxxp://contextmenu.toolbar.conduit-services.com/?name=OtherApps&loc[...]

Found : user_pref("CommunityToolbar.ETag.hxxp://contextmenu.toolbar.conduit-services.com/?name=OtherApps&loc[...]

Found : user_pref("CommunityToolbar.ETag.hxxp://contextmenu.toolbar.conduit-services.com/?name=SharedApps&lo[...]

Found : user_pref("CommunityToolbar.ETag.hxxp://contextmenu.toolbar.conduit-services.com/?name=SharedApps&lo[...]

Found : user_pref("CommunityToolbar.ETag.hxxp://contextmenu.toolbar.conduit-services.com/?name=Toolbar&local[...]

Found : user_pref("CommunityToolbar.ETag.hxxp://contextmenu.toolbar.conduit-services.com/?name=Toolbar&local[...]

Found : user_pref("CommunityToolbar.ETag.hxxp://dynamicdialogs.alert.conduit-services.com/alert/dlg.pkg", "\[...]

Found : user_pref("CommunityToolbar.ETag.hxxp://dynamicdialogs.toolbar.conduit-services.com/DLG.pkg?ver=3.10[...]

Found : user_pref("CommunityToolbar.ETag.hxxp://dynamicdialogs.toolbar.conduit-services.com/DLG.pkg?ver=3.12[...]

Found : user_pref("CommunityToolbar.ETag.hxxp://dynamicdialogs.toolbar.conduit-services.com/DLG.pkg?ver=3.12[...]

Found : user_pref("CommunityToolbar.ETag.hxxp://dynamicdialogs.toolbar.conduit-services.com/DLG.pkg?ver=3.13[...]

Found : user_pref("CommunityToolbar.ETag.hxxp://dynamicdialogs.toolbar.conduit-services.com/DLG.pkg?ver=3.14[...]

Found : user_pref("CommunityToolbar.ETag.hxxp://dynamicdialogs.toolbar.conduit-services.com/DLG.pkg?ver=3.15[...]

Found : user_pref("CommunityToolbar.ETag.hxxp://servicemap.conduit-services.com/Toolbar/?ownerId=CT2818425",[...]

Found : user_pref("CommunityToolbar.ETag.hxxp://translation.toolbar.conduit-services.com/?locale=en", "\"abd[...]

Found : user_pref("CommunityToolbar.LatestLibsPath", "file:///C:\\Users\\Marci\\AppData\\Roaming\\Mozilla\\F[...]

Found : user_pref("CommunityToolbar.LatestToolbarVersionInstalled", "3.10.0.1");

Found : user_pref("CommunityToolbar.SearchFromAddressBarSavedUrl", "");

Found : user_pref("CommunityToolbar.ToolbarsList", "CT2818425");

Found : user_pref("CommunityToolbar.ToolbarsList2", "CT2818425");

Found : user_pref("CommunityToolbar.ToolbarsList4", "CT2818425");

Found : user_pref("CommunityToolbar.facebook.settingsLastCheckTime", "Sat Mar 10 2012 12:21:46 GMT-0500 (Eas[...]

Found : user_pref("CommunityToolbar.globalUserId", "ce284a29-936e-4e3d-8959-c2454901cb38");

Found : user_pref("CommunityToolbar.isAlertUrlAddedToFeedItemTable", true);

Found : user_pref("CommunityToolbar.isClickActionAddedToFeedItemTable", true);

Found : user_pref("CommunityToolbar.notifications.alertDialogsGetterLastCheckTime", "Sat Mar 10 2012 12:21:4[...]

Found : user_pref("CommunityToolbar.notifications.alertEnabled", false);

Found : user_pref("CommunityToolbar.notifications.alertInfoInterval", 1440);

Found : user_pref("CommunityToolbar.notifications.alertInfoLastCheckTime", "Sat Mar 10 2012 12:21:54 GMT-050[...]

Found : user_pref("CommunityToolbar.notifications.clientsServerUrl", "hxxp://alert.client.conduit.com");

Found : user_pref("CommunityToolbar.notifications.locale", "");

Found : user_pref("CommunityToolbar.notifications.loginIntervalMin", 0);

Found : user_pref("CommunityToolbar.notifications.loginLastCheckTime", "Sun Mar 11 2012 15:15:59 GMT-0400 (E[...]

Found : user_pref("CommunityToolbar.notifications.loginLastUpdateTime", "");

Found : user_pref("CommunityToolbar.notifications.messageShowTimeSec", 20);

Found : user_pref("CommunityToolbar.notifications.servicesServerUrl", "hxxp://alert.services.conduit.com");

Found : user_pref("CommunityToolbar.notifications.showTrayIcon", false);

Found : user_pref("CommunityToolbar.notifications.userCloseIntervalMin", 300);

Found : user_pref("CommunityToolbar.notifications.userId", "a89fae1e-e252-4857-968b-f406d88530b2");

Found : user_pref("CommunityToolbar.originalHomepage", "hxxp://www.facebook.com/marci.gower");

Found : user_pref("CommunityToolbar.originalSearchEngine", "chrome://browser-region/locale/region.properties[...]

Found : user_pref("vshare.install.date", "1329957972");

Found : user_pref("vshare.install.finished", "1.0.0");

Found : user_pref("vshare.install.fresh", "false");

Found : user_pref("vshare.install.guid", "{f691f350-1798-4560-bd1c-acf558070cd1}");

Found : user_pref("vshare.install.newtab", false);

*************************

AdwCleaner[R1].txt - [18127 octets] - [10/10/2012 19:52:36]

########## EOF - C:\AdwCleaner[R1].txt - [18188 octets] ##########

Link to post
Share on other sites

Lots of "junk" found............

  1. Please re-run AdwCleaner
  2. Click on Delete button.
  3. Confirm each time with OK if asked.
  4. Your computer will be rebooted automatically. A text file will open after the restart. Please post the content of that logfile in your reply.

Note: You can find the logfile at C:\AdwCleaner[sn].txt as well - n is the order number.

MrC

Link to post
Share on other sites

She's a fan of junk.. must be why she married me :D

Second logfile:

# AdwCleaner v2.004 - Logfile created 10/10/2012 at 19:59:10

# Updated 06/10/2012 by Xplode

# Operating system : Windows 7 Home Premium Service Pack 1 (64 bits)

# User : Marci - MARCI7

# Boot Mode : Normal

# Running from : C:\Users\Marci\Desktop\adwcleaner.exe

# Option [Delete]

***** [services] *****

***** [Files / Folders] *****

Deleted on reboot : C:\Program Files (x86)\Mozilla Firefox\Extensions\afurladvisor@anchorfree.com

File Deleted : C:\Program Files (x86)\Mozilla Firefox\Plugins\npvsharetvplg.dll

File Deleted : C:\Users\Marci\AppData\Roaming\Mozilla\Firefox\Profiles\o3zmyekh.default\extensions\pricepeep@getpricepeep.com.xpi

Folder Deleted : C:\Program Files (x86)\Conduit

Folder Deleted : C:\Program Files (x86)\Ilivid

Folder Deleted : C:\Program Files (x86)\PricePeep

Folder Deleted : C:\Program Files (x86)\vShare.tv plugin

Folder Deleted : C:\Program Files (x86)\vshare.tv_Bar

Folder Deleted : C:\Users\Marci\AppData\Local\Conduit

Folder Deleted : C:\Users\Marci\AppData\Local\Ilivid Player

Folder Deleted : C:\Users\Marci\AppData\Local\Software

Folder Deleted : C:\Users\Marci\AppData\Local\Temp\CT2818425

Folder Deleted : C:\Users\Marci\AppData\LocalLow\Conduit

Folder Deleted : C:\Users\Marci\AppData\LocalLow\vshare.tv_Bar

Folder Deleted : C:\Users\Marci\AppData\Roaming\Mozilla\Firefox\Profiles\o3zmyekh.default\ConduitCommon

Folder Deleted : C:\Users\Marci\AppData\Roaming\Mozilla\Firefox\Profiles\o3zmyekh.default\CT2818425

Folder Deleted : C:\Users\Marci\AppData\Roaming\Mozilla\Firefox\Profiles\o3zmyekh.default\extensions\{7aeb3efd-e564-43f1-b658-5058a7c5743b}

***** [Registry] *****

Key Deleted : HKCU\Software\AppDataLow\Software\Conduit

Key Deleted : HKCU\Software\AppDataLow\Software\vshare.tv_Bar

Key Deleted : HKCU\Software\AppDataLow\Toolbar

Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{7AEB3EFD-E564-43F1-B658-5058A7C5743B}

Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{7AEB3EFD-E564-43F1-B658-5058A7C5743B}

Key Deleted : HKCU\Software\StartSearch

Key Deleted : HKLM\SOFTWARE\Classes\Toolbar.CT2818425

Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{99C22A61-21BA-4F81-85FF-CDC9EB5DB10B}

Key Deleted : HKLM\Software\Conduit

Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{91E526FE-D9CF-443C-91A4-4A42F6178477}

Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{A1B48071-416D-474E-A13B-BE5456E7FC31}

Key Deleted : HKLM\Software\vshare.tv_Bar

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{7AEB3EFD-E564-43F1-B658-5058A7C5743B}

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{91E526FE-D9CF-443C-91A4-4A42F6178477}

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{A1B48071-416D-474E-A13B-BE5456E7FC31}

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{AF527190-68C9-4D03-AA04-9EB633E1D2C9}

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{DE93BFA0-058A-4B8E-A8D9-8918B3817571}

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{7AEB3EFD-E564-43F1-B658-5058A7C5743B}

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\vshare.tv_Bar Toolbar

Key Deleted : HKLM\SOFTWARE\Classes\Interface\{79FB5FC8-44B9-4AF5-BADD-CCE547F953E5}

Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}

Value Deleted : HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks [{7AEB3EFD-E564-43F1-B658-5058A7C5743B}]

Value Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks [{7AEB3EFD-E564-43F1-B658-5058A7C5743B}]

Value Deleted : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar [{7AEB3EFD-E564-43F1-B658-5058A7C5743B}]

***** [internet Browsers] *****

-\\ Internet Explorer v9.0.8112.16421

[OK] Registry is clean.

-\\ Mozilla Firefox v15.0 (en-US)

Profile name : default

File : C:\Users\Marci\AppData\Roaming\Mozilla\Firefox\Profiles\o3zmyekh.default\prefs.js

Deleted : user_pref("CT2818425..clientLogIsEnabled", false);

Deleted : user_pref("CT2818425..clientLogServiceUrl", "hxxp://clientlog.users.conduit.com/ClientDiagnostics.as[...]

Deleted : user_pref("CT2818425..uninstallLogServiceUrl", "hxxp://uninstall.users.conduit.com/Uninstall.asmx/Re[...]

Deleted : user_pref("CT2818425.ALLOW_SHOWING_HIDDEN_TOOLBAR", false);

Deleted : user_pref("CT2818425.AboutPrivacyUrl", "hxxp://www.conduit.com/privacy/Default.aspx");

Deleted : user_pref("CT2818425.BrowserCompStateIsOpen_129712757411525741", true);

Deleted : user_pref("CT2818425.BrowserCompStateIsOpen_129735245815838327", true);

Deleted : user_pref("CT2818425.BrowserCompStateIsOpen_129893041058613741", true);

Deleted : user_pref("CT2818425.CT2818425", "CT2818425");

Deleted : user_pref("CT2818425.CurrentServerDate", "10-10-2012");

Deleted : user_pref("CT2818425.DSInstall", false);

Deleted : user_pref("CT2818425.DialogsAlignMode", "LTR");

Deleted : user_pref("CT2818425.DialogsGetterLastCheckTime", "Tue Oct 09 2012 21:59:26 GMT-0400 (Eastern Daylig[...]

Deleted : user_pref("CT2818425.DownloadReferralCookieData", "");

Deleted : user_pref("CT2818425.EMailNotifierPollDate", "Sat Mar 10 2012 12:21:46 GMT-0500 (Eastern Standard Ti[...]

Deleted : user_pref("CT2818425.FirstServerDate", "10-3-2012");

Deleted : user_pref("CT2818425.FirstTime", true);

Deleted : user_pref("CT2818425.FirstTimeFF3", true);

Deleted : user_pref("CT2818425.FixPageNotFoundErrors", false);

Deleted : user_pref("CT2818425.GroupingServerCheckInterval", 1440);

Deleted : user_pref("CT2818425.GroupingServiceUrl", "hxxp://grouping.services.conduit.com/");

Deleted : user_pref("CT2818425.HPInstall", false);

Deleted : user_pref("CT2818425.HasUserGlobalKeys", true);

Deleted : user_pref("CT2818425.HomePageProtectorEnabled", false);

Deleted : user_pref("CT2818425.HomepageBeforeUnload", "hxxp://www.facebook.com/marci.gower");

Deleted : user_pref("CT2818425.Initialize", true);

Deleted : user_pref("CT2818425.InitializeCommonPrefs", true);

Deleted : user_pref("CT2818425.InstallationAndCookieDataSentCount", 3);

Deleted : user_pref("CT2818425.InstallationType", "Unknown");

Deleted : user_pref("CT2818425.InstalledDate", "Sat Mar 10 2012 12:21:47 GMT-0500 (Eastern Standard Time)");

Deleted : user_pref("CT2818425.InvalidateCache", false);

Deleted : user_pref("CT2818425.IsGrouping", false);

Deleted : user_pref("CT2818425.IsInitSetupIni", true);

Deleted : user_pref("CT2818425.IsMulticommunity", false);

Deleted : user_pref("CT2818425.IsOpenThankYouPage", true);

Deleted : user_pref("CT2818425.IsOpenUninstallPage", true);

Deleted : user_pref("CT2818425.IsProtectorsInit", true);

Deleted : user_pref("CT2818425.LanguagePackLastCheckTime", "Tue Oct 09 2012 21:59:26 GMT-0400 (Eastern Dayligh[...]

Deleted : user_pref("CT2818425.LanguagePackReloadIntervalMM", 1440);

Deleted : user_pref("CT2818425.LanguagePackServiceUrl", "hxxp://translation.users.conduit.com/Translation.ashx[...]

Deleted : user_pref("CT2818425.LastLogin_3.10.0.1", "Sat Mar 10 2012 12:22:43 GMT-0500 (Eastern Standard Time)[...]

Deleted : user_pref("CT2818425.LastLogin_3.12.0.7", "Tue May 01 2012 06:39:06 GMT-0400 (Eastern Daylight Time)[...]

Deleted : user_pref("CT2818425.LastLogin_3.12.2.3", "Thu May 31 2012 13:11:29 GMT-0400 (Eastern Daylight Time)[...]

Deleted : user_pref("CT2818425.LastLogin_3.13.0.6", "Sun Jul 15 2012 12:22:15 GMT-0400 (Eastern Daylight Time)[...]

Deleted : user_pref("CT2818425.LastLogin_3.14.1.0", "Sun Aug 26 2012 00:08:16 GMT-0400 (Eastern Daylight Time)[...]

Deleted : user_pref("CT2818425.LastLogin_3.15.1.0", "Tue Oct 09 2012 21:59:26 GMT-0400 (Eastern Daylight Time)[...]

Deleted : user_pref("CT2818425.LatestVersion", "3.15.1.0");

Deleted : user_pref("CT2818425.Locale", "en");

Deleted : user_pref("CT2818425.MCDetectTooltipHeight", "83");

Deleted : user_pref("CT2818425.MCDetectTooltipUrl", "hxxp://@EB_INSTALL_LINK@/rank/tooltip/?version=1");

Deleted : user_pref("CT2818425.MCDetectTooltipWidth", "295");

Deleted : user_pref("CT2818425.MyStuffEnabledAtInstallation", true);

Deleted : user_pref("CT2818425.OriginalFirstVersion", "3.10.0.1");

Deleted : user_pref("CT2818425.RadioIsPodcast", false);

Deleted : user_pref("CT2818425.RadioLastCheckTime", "Mon Mar 12 2012 15:16:07 GMT-0400 (Eastern Daylight Time)[...]

Deleted : user_pref("CT2818425.RadioLastUpdateIPServer", "3");

Deleted : user_pref("CT2818425.RadioLastUpdateServer", "129330101464100000");

Deleted : user_pref("CT2818425.RadioMediaID", "21515677");

Deleted : user_pref("CT2818425.RadioMediaType", "Media Player");

Deleted : user_pref("CT2818425.RadioMenuSelectedID", "EBRadioMenu_CT281842521515677");

Deleted : user_pref("CT2818425.RadioShrinkedFromSetup", false);

Deleted : user_pref("CT2818425.RadioStationName", "Virgin%20Radio%20Classic%20Rock");

Deleted : user_pref("CT2818425.RadioStationURL", "hxxp://www.smgradio.com/core/audio/wmp/live.asx?service=vcbb[...]

Deleted : user_pref("CT2818425.SearchCaption", "vshare.tv Customized Web Search");

Deleted : user_pref("CT2818425.SearchEngineBeforeUnload", "chrome://browser-region/locale/region.properties");

Deleted : user_pref("CT2818425.SearchFromAddressBarIsInit", true);

Deleted : user_pref("CT2818425.SearchFromAddressBarUrl", "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT281[...]

Deleted : user_pref("CT2818425.SearchInNewTabEnabled", true);

Deleted : user_pref("CT2818425.SearchInNewTabIntervalMM", 1440);

Deleted : user_pref("CT2818425.SearchInNewTabLastCheckTime", "Tue Oct 09 2012 21:59:25 GMT-0400 (Eastern Dayli[...]

Deleted : user_pref("CT2818425.SearchInNewTabServiceUrl", "hxxp://newtab.conduit-hosting.com/newtab/?ctid=EB_T[...]

Deleted : user_pref("CT2818425.SearchInNewTabUserEnabled", false);

Deleted : user_pref("CT2818425.SearchProtectorEnabled", false);

Deleted : user_pref("CT2818425.SearchProtectorToolbarDisabled", false);

Deleted : user_pref("CT2818425.SendProtectorDataViaLogin", true);

Deleted : user_pref("CT2818425.ServiceMapLastCheckTime", "Tue Oct 09 2012 21:59:25 GMT-0400 (Eastern Daylight [...]

Deleted : user_pref("CT2818425.SettingsLastCheckTime", "Tue Oct 09 2012 21:59:25 GMT-0400 (Eastern Daylight Ti[...]

Deleted : user_pref("CT2818425.SettingsLastUpdate", "1348502557");

Deleted : user_pref("CT2818425.TBHomePageUrl", "hxxp://search.conduit.com/?ctid=CT2818425&SearchSource=13");

Deleted : user_pref("CT2818425.ThirdPartyComponentsInterval", 504);

Deleted : user_pref("CT2818425.ThirdPartyComponentsLastCheck", "Sat Mar 10 2012 12:21:45 GMT-0500 (Eastern Sta[...]

Deleted : user_pref("CT2818425.ThirdPartyComponentsLastUpdate", "1312887586");

Deleted : user_pref("CT2818425.ToolbarShrinkedFromSetup", false);

Deleted : user_pref("CT2818425.TrusteLinkUrl", "hxxp://trust.conduit.com/CT2818425");

Deleted : user_pref("CT2818425.TrustedApiDomains", "conduit.com,conduit-hosting.com,conduit-services.com,clien[...]

Deleted : user_pref("CT2818425.UserID", "UN47956079780564975");

Deleted : user_pref("CT2818425.alertChannelId", "1210492");

Deleted : user_pref("CT2818425.autoDisableScopes", -1);

Deleted : user_pref("CT2818425.backendstorage.cbfirsttime", "536174204D617220313020323031322031323A32323A34362[...]

Deleted : user_pref("CT2818425.backendstorage.key_user_agree_ia12", "31");

Deleted : user_pref("CT2818425.backendstorage.shoppingapp.gk.exipres", "546875204D617220313520323031322031323A[...]

Deleted : user_pref("CT2818425.backendstorage.shoppingapp.gk.geolocation", "756E6974656420737461746573");

Deleted : user_pref("CT2818425.backendstorage.user_uniqueid", "66323865656365622D633762322D306639302D356637662[...]

Deleted : user_pref("CT2818425.components.1000234", false);

Deleted : user_pref("CT2818425.generalConfigFromLogin", "{\"ApiMaxAlerts\":\"12\",\"SocialDomains\":\"social.c[...]

Deleted : user_pref("CT2818425.globalFirstTimeInfoLastCheckTime", "Tue Mar 13 2012 03:44:07 GMT-0400 (Eastern [...]

Deleted : user_pref("CT2818425.homepageProtectorEnableByLogin", true);

Deleted : user_pref("CT2818425.initDone", true);

Deleted : user_pref("CT2818425.isAppTrackingManagerOn", true);

Deleted : user_pref("CT2818425.isFirstRadioInstallation", false);

Deleted : user_pref("CT2818425.myStuffEnabled", true);

Deleted : user_pref("CT2818425.myStuffPublihserMinWidth", 400);

Deleted : user_pref("CT2818425.myStuffSearchUrl", "hxxp://Apps.conduit.com/search?q=SEARCH_TERM&SearchSourceOr[...]

Deleted : user_pref("CT2818425.myStuffServiceIntervalMM", 1440);

Deleted : user_pref("CT2818425.myStuffServiceUrl", "hxxp://mystuff.conduit-services.com/MyStuffService.ashx?Co[...]

Deleted : user_pref("CT2818425.navigateToUrlOnSearch", false);

Deleted : user_pref("CT2818425.revertSettingsEnabled", false);

Deleted : user_pref("CT2818425.searchProtectorDialogDelayInSec", 10);

Deleted : user_pref("CT2818425.searchProtectorEnableByLogin", true);

Deleted : user_pref("CT2818425.testingCtid", "");

Deleted : user_pref("CT2818425.toolbarAppMetaDataLastCheckTime", "Tue Oct 09 2012 21:59:26 GMT-0400 (Eastern D[...]

Deleted : user_pref("CT2818425.toolbarContextMenuLastCheckTime", "Sat Mar 10 2012 12:21:47 GMT-0500 (Eastern S[...]

Deleted : user_pref("CT2818425.usagesFlag", 2);

Deleted : user_pref("CommunityToolbar.ETag.hxxp://Settings.toolbar.search.conduit.com/root/CT2818425/CT2818425[...]

Deleted : user_pref("CommunityToolbar.ETag.hxxp://alerts.conduit-services.com/root/1210492/1206165/US", "\"0\"[...]

Deleted : user_pref("CommunityToolbar.ETag.hxxp://appsmetadata.toolbar.conduit-services.com/?ctid=CT2818425", [...]

Deleted : user_pref("CommunityToolbar.ETag.hxxp://contextmenu.toolbar.conduit-services.com/?name=GottenApps&lo[...]

Deleted : user_pref("CommunityToolbar.ETag.hxxp://contextmenu.toolbar.conduit-services.com/?name=GottenApps&lo[...]

Deleted : user_pref("CommunityToolbar.ETag.hxxp://contextmenu.toolbar.conduit-services.com/?name=OtherApps&loc[...]

Deleted : user_pref("CommunityToolbar.ETag.hxxp://contextmenu.toolbar.conduit-services.com/?name=OtherApps&loc[...]

Deleted : user_pref("CommunityToolbar.ETag.hxxp://contextmenu.toolbar.conduit-services.com/?name=SharedApps&lo[...]

Deleted : user_pref("CommunityToolbar.ETag.hxxp://contextmenu.toolbar.conduit-services.com/?name=SharedApps&lo[...]

Deleted : user_pref("CommunityToolbar.ETag.hxxp://contextmenu.toolbar.conduit-services.com/?name=Toolbar&local[...]

Deleted : user_pref("CommunityToolbar.ETag.hxxp://contextmenu.toolbar.conduit-services.com/?name=Toolbar&local[...]

Deleted : user_pref("CommunityToolbar.ETag.hxxp://dynamicdialogs.alert.conduit-services.com/alert/dlg.pkg", "\[...]

Deleted : user_pref("CommunityToolbar.ETag.hxxp://dynamicdialogs.toolbar.conduit-services.com/DLG.pkg?ver=3.10[...]

Deleted : user_pref("CommunityToolbar.ETag.hxxp://dynamicdialogs.toolbar.conduit-services.com/DLG.pkg?ver=3.12[...]

Deleted : user_pref("CommunityToolbar.ETag.hxxp://dynamicdialogs.toolbar.conduit-services.com/DLG.pkg?ver=3.12[...]

Deleted : user_pref("CommunityToolbar.ETag.hxxp://dynamicdialogs.toolbar.conduit-services.com/DLG.pkg?ver=3.13[...]

Deleted : user_pref("CommunityToolbar.ETag.hxxp://dynamicdialogs.toolbar.conduit-services.com/DLG.pkg?ver=3.14[...]

Deleted : user_pref("CommunityToolbar.ETag.hxxp://dynamicdialogs.toolbar.conduit-services.com/DLG.pkg?ver=3.15[...]

Deleted : user_pref("CommunityToolbar.ETag.hxxp://servicemap.conduit-services.com/Toolbar/?ownerId=CT2818425",[...]

Deleted : user_pref("CommunityToolbar.ETag.hxxp://translation.toolbar.conduit-services.com/?locale=en", "\"abd[...]

Deleted : user_pref("CommunityToolbar.LatestLibsPath", "file:///C:\\Users\\Marci\\AppData\\Roaming\\Mozilla\\F[...]

Deleted : user_pref("CommunityToolbar.LatestToolbarVersionInstalled", "3.10.0.1");

Deleted : user_pref("CommunityToolbar.SearchFromAddressBarSavedUrl", "");

Deleted : user_pref("CommunityToolbar.ToolbarsList", "CT2818425");

Deleted : user_pref("CommunityToolbar.ToolbarsList2", "CT2818425");

Deleted : user_pref("CommunityToolbar.ToolbarsList4", "CT2818425");

Deleted : user_pref("CommunityToolbar.facebook.settingsLastCheckTime", "Sat Mar 10 2012 12:21:46 GMT-0500 (Eas[...]

Deleted : user_pref("CommunityToolbar.globalUserId", "ce284a29-936e-4e3d-8959-c2454901cb38");

Deleted : user_pref("CommunityToolbar.isAlertUrlAddedToFeedItemTable", true);

Deleted : user_pref("CommunityToolbar.isClickActionAddedToFeedItemTable", true);

Deleted : user_pref("CommunityToolbar.notifications.alertDialogsGetterLastCheckTime", "Sat Mar 10 2012 12:21:4[...]

Deleted : user_pref("CommunityToolbar.notifications.alertEnabled", false);

Deleted : user_pref("CommunityToolbar.notifications.alertInfoInterval", 1440);

Deleted : user_pref("CommunityToolbar.notifications.alertInfoLastCheckTime", "Sat Mar 10 2012 12:21:54 GMT-050[...]

Deleted : user_pref("CommunityToolbar.notifications.clientsServerUrl", "hxxp://alert.client.conduit.com");

Deleted : user_pref("CommunityToolbar.notifications.locale", "");

Deleted : user_pref("CommunityToolbar.notifications.loginIntervalMin", 0);

Deleted : user_pref("CommunityToolbar.notifications.loginLastCheckTime", "Sun Mar 11 2012 15:15:59 GMT-0400 (E[...]

Deleted : user_pref("CommunityToolbar.notifications.loginLastUpdateTime", "");

Deleted : user_pref("CommunityToolbar.notifications.messageShowTimeSec", 20);

Deleted : user_pref("CommunityToolbar.notifications.servicesServerUrl", "hxxp://alert.services.conduit.com");

Deleted : user_pref("CommunityToolbar.notifications.showTrayIcon", false);

Deleted : user_pref("CommunityToolbar.notifications.userCloseIntervalMin", 300);

Deleted : user_pref("CommunityToolbar.notifications.userId", "a89fae1e-e252-4857-968b-f406d88530b2");

Deleted : user_pref("CommunityToolbar.originalHomepage", "hxxp://www.facebook.com/marci.gower");

Deleted : user_pref("CommunityToolbar.originalSearchEngine", "chrome://browser-region/locale/region.properties[...]

Deleted : user_pref("vshare.install.date", "1329957972");

Deleted : user_pref("vshare.install.finished", "1.0.0");

Deleted : user_pref("vshare.install.fresh", "false");

Deleted : user_pref("vshare.install.guid", "{f691f350-1798-4560-bd1c-acf558070cd1}");

Deleted : user_pref("vshare.install.newtab", false);

*************************

AdwCleaner[R1].txt - [18254 octets] - [10/10/2012 19:52:36]

AdwCleaner[R2].txt - [18315 octets] - [10/10/2012 19:58:47]

AdwCleaner[s1].txt - [18664 octets] - [10/10/2012 19:59:10]

########## EOF - C:\AdwCleaner[s1].txt - [18725 octets] ##########

Link to post
Share on other sites

Great thumbsup.gif

Lets check your computers security before you go and we have a little cleanup to do also:

Download Security Check by screen317 from HERE or HERE.

  • Save it to your Desktop.
  • Double click SecurityCheck.exe and follow the onscreen instructions inside of the black box.
  • A Notepad document should open automatically called checkup.txt; please post the contents of that document.

MrC

Link to post
Share on other sites

Results of screen317's Security Check version 0.99.51

Windows 7 Service Pack 1 x64 (UAC is enabled)

Internet Explorer 9

``````````````Antivirus/Firewall Check:``````````````

Windows Firewall Enabled!

Microsoft Security Essentials

Antivirus up to date!

`````````Anti-malware/Other Utilities Check:`````````

Malwarebytes Anti-Malware version 1.65.0.1400

Java 6 Update 31

Java version out of Date!

Adobe Flash Player 11.4.402.287

Adobe Reader 9 Adobe Reader out of Date!

Mozilla Firefox (15.0)

````````Process Check: objlist.exe by Laurent````````

Microsoft Security Essentials MSMpEng.exe

Microsoft Security Essentials msseces.exe

`````````````````System Health check`````````````````

Total Fragmentation on Drive C: 0%

````````````````````End of Log``````````````````````

Link to post
Share on other sites

Java™ 6 Update 31 <----uninstall this from add/remove programs

http://www.java.com/...load/manual.jsp <---latest version of Java

http://www.java.com/...d/installed.jsp <---verify your Java

~~~~~~~~~~~~~~~~~~~~~~~~~~

You have out dated programs on the system which are vulnerable to malware.

Please update or uninstall them

Info on doing that can be found in my Preventive Maintenance

~~~~~~~~~~~~~~~~~~~~~

A little clean up to do....

Please Uninstall ComboFix: (if you used it)

Press the Windows logo key + R to bring up the "run box"

Copy and paste next command in the field:

ComboFix /uninstall

Make sure there's a space between Combofix and /

cf2.jpg

Then hit enter.

This will uninstall Combofix, delete its related folders and files, hide file extensions, hide the system/hidden files and clears System Restore cache and create new Restore point

(If that doesn't work.....you can simply rename ComboFix.exe to Uninstall.exe and double click it to complete the uninstall)

---------------------------------

Please download OTL from one of the links below: (you may already have OTL on the system)

http://oldtimer.geekstogo.com/OTL.exe

http://oldtimer.geekstogo.com/OTL.com

http://www.itxassoci...T-Tools/OTL.exe

Save it to your desktop.

Run OTL and hit the CleanUp button. (This will cleanup the tools and logs used including itself)

Any other programs or logs you can manually delete.

IE: RogueKiller.exe, RKreport.txt, RK_Quarantine folder, C:\FRST, etc....

-------------------------------

Any questions...please post back.

If you think I've helped you, please leave a comment > click on my avatar picture > click Profile Feed.

Take a look at My Preventive Maintenance to avoid being infected again.

Good Luck and Thanks for using the forum, MrC

Link to post
Share on other sites

Run unhide again and don't reboot!!

Next................

Please download and run ComboFix.

The most important things to remember when running it is to disable all your malware programs and run Combofix from your desktop.

Please visit this webpage for download links, and instructions for running ComboFix

http://www.bleepingc...to-use-combofix

Ensure you have disabled all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

Information on disabling your malware programs can be found Here.

Make sure you run ComboFix from your desktop.

Give it at least 30-45 minutes to finish if needed.

Please include the C:\ComboFix.txt in your next reply for further review.

---------->NOTE<----------

If you get the message Illegal operation attempted on registry key that has been marked for deletion after you run ComboFix....please reboot the computer, this should resolve the problem. You may have to do this several times if needed.

MrC

Link to post
Share on other sites

Combo Fix log:

ComboFix 12-10-10.02 - Marci 10/10/2012 21:20:31.1.4 - x64

Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.3948.2489 [GMT -4:00]

Running from: c:\users\Marci\Desktop\ComboFix.exe

AV: Microsoft Security Essentials *Disabled/Updated* {B140BF4E-23BB-4198-90AB-A51A4C60A69C}

SP: Microsoft Security Essentials *Disabled/Updated* {0A215EAA-0581-4E16-AA1B-9E6837E7EC21}

SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

.

c:\program files (x86)\TelevisionFanatic

c:\program files (x86)\TelevisionFanatic\bar\gen1\COMMON.T8S

c:\program files (x86)\TelevisionFanatic\bar\IE9Mesg\COMMON.T8S

c:\program files (x86)\TelevisionFanatic\bar\Message\COMMON.T8S

c:\program files (x86)\TelevisionFanatic\bar\Settings\s_pid.dat

c:\users\Marci\AppData\Local\Microsoft\Windows\Temporary Internet Files\{B75867C2-EC0E-4280-BCA4-04F8C382E61A}.xps

c:\users\Marci\AppData\Local\Microsoft\Windows\Temporary Internet Files\{F65E9993-56FB-495E-8B21-153A9F2EC510}.xps

c:\users\Marci\AppData\Roaming\Mozilla\Firefox\Profiles\o3zmyekh.default\extensions\64ffxtbr@TelevisionFanatic.com

c:\users\Marci\AppData\Roaming\Mozilla\Firefox\Profiles\o3zmyekh.default\extensions\64ffxtbr@TelevisionFanatic.com\bootstrap.js

c:\users\Marci\AppData\Roaming\Mozilla\Firefox\Profiles\o3zmyekh.default\extensions\64ffxtbr@TelevisionFanatic.com\chrome.manifest

c:\users\Marci\AppData\Roaming\Mozilla\Firefox\Profiles\o3zmyekh.default\extensions\64ffxtbr@TelevisionFanatic.com\chrome\64ffxtbr.jar

c:\users\Marci\AppData\Roaming\Mozilla\Firefox\Profiles\o3zmyekh.default\extensions\64ffxtbr@TelevisionFanatic.com\install.rdf

c:\users\Marci\AppData\Roaming\Mozilla\Firefox\Profiles\o3zmyekh.default\extensions\64ffxtbr@TelevisionFanatic.com\META-INF\manifest.mf

c:\users\Marci\AppData\Roaming\Mozilla\Firefox\Profiles\o3zmyekh.default\extensions\64ffxtbr@TelevisionFanatic.com\META-INF\zigbert.rsa

c:\users\Marci\AppData\Roaming\Mozilla\Firefox\Profiles\o3zmyekh.default\extensions\64ffxtbr@TelevisionFanatic.com\META-INF\zigbert.sf

c:\windows\SysWow64\DEBUG.log

.

.

((((((((((((((((((((((((( Files Created from 2012-09-11 to 2012-10-11 )))))))))))))))))))))))))))))))

.

.

2012-10-11 01:24 . 2012-10-11 01:24 -------- d-----w- c:\users\Default\AppData\Local\temp

2012-10-10 02:01 . 2012-10-10 02:01 -------- d-----w- c:\users\Marci\AppData\Roaming\Malwarebytes

2012-10-10 02:01 . 2012-10-10 02:01 -------- d-----w- c:\programdata\Malwarebytes

2012-10-10 02:01 . 2012-09-07 21:04 25928 ----a-w- c:\windows\system32\drivers\mbam.sys

2012-10-10 02:01 . 2012-10-10 02:01 -------- d-----w- c:\program files (x86)\Malwarebytes' Anti-Malware

2012-10-10 01:42 . 2012-08-31 18:19 1659760 ----a-w- c:\windows\system32\drivers\ntfs.sys

2012-10-10 01:39 . 2012-09-14 19:19 2048 ----a-w- c:\windows\system32\tzres.dll

2012-10-10 01:39 . 2012-09-14 18:28 2048 ----a-w- c:\windows\SysWow64\tzres.dll

2012-10-10 01:39 . 2012-08-11 00:56 715776 ----a-w- c:\windows\system32\kerberos.dll

2012-10-10 01:39 . 2012-08-10 23:56 542208 ----a-w- c:\windows\SysWow64\kerberos.dll

2012-10-10 01:39 . 2012-06-02 05:41 1464320 ----a-w- c:\windows\system32\crypt32.dll

2012-10-10 01:39 . 2012-06-02 05:41 184320 ----a-w- c:\windows\system32\cryptsvc.dll

2012-10-10 01:39 . 2012-06-02 05:41 140288 ----a-w- c:\windows\system32\cryptnet.dll

2012-10-10 01:39 . 2012-06-02 04:36 140288 ----a-w- c:\windows\SysWow64\cryptsvc.dll

2012-10-10 01:39 . 2012-06-02 04:36 1159680 ----a-w- c:\windows\SysWow64\crypt32.dll

2012-10-10 01:39 . 2012-06-02 04:36 103936 ----a-w- c:\windows\SysWow64\cryptnet.dll

2012-10-07 14:48 . 2012-10-11 00:49 -------- d-----w- c:\users\Marci\AppData\Local\TelevisionFanatic

2012-10-07 14:47 . 2012-10-10 01:23 -------- d-----w- c:\users\Marci\AppData\Local\dealcabby

2012-10-07 14:47 . 2012-10-10 01:23 -------- d-----w- c:\programdata\Sendori

2012-10-07 14:47 . 2012-10-10 01:23 -------- d-----w- c:\program files (x86)\FLVPlayer

2012-10-07 14:47 . 2012-10-10 01:23 -------- d-----w- c:\program files (x86)\Sendori

2012-10-07 14:12 . 2012-10-10 01:22 -------- d-----w- c:\users\Marci\AppData\Roaming\vlc

2012-09-30 04:21 . 2012-09-30 04:21 972192 ------w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{A03729AC-2912-46FF-93F5-F55302D7C2EB}\gapaengine.dll

2012-09-29 02:49 . 2012-08-21 21:01 245760 ----a-w- c:\windows\system32\OxpsConverter.exe

2012-09-12 02:02 . 2012-09-12 02:02 -------- d-----w- c:\program files (x86)\Common Files\Skype

2012-09-11 22:09 . 2012-08-22 18:12 950128 ----a-w- c:\windows\system32\drivers\ndis.sys

2012-09-11 22:09 . 2012-08-02 17:58 574464 ----a-w- c:\windows\system32\d3d10level9.dll

2012-09-11 22:09 . 2012-08-02 16:57 490496 ----a-w- c:\windows\SysWow64\d3d10level9.dll

2012-09-11 22:09 . 2012-07-04 20:26 41472 ----a-w- c:\windows\system32\drivers\RNDISMP.sys

2012-09-11 22:09 . 2012-08-22 18:12 1913200 ----a-w- c:\windows\system32\drivers\tcpip.sys

2012-09-11 22:09 . 2012-08-22 18:12 376688 ----a-w- c:\windows\system32\drivers\netio.sys

2012-09-11 22:09 . 2012-08-22 18:12 288624 ----a-w- c:\windows\system32\drivers\FWPKCLNT.SYS

.

.

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2012-10-10 21:09 . 2012-08-26 05:42 65309168 ----a-w- c:\windows\system32\MRT.exe

2012-10-10 21:07 . 2012-08-12 19:53 696760 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe

2012-10-10 21:07 . 2011-08-05 00:50 73656 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl

2012-08-31 02:03 . 2012-08-31 02:03 228768 ----a-w- c:\windows\system32\drivers\MpFilter.sys

2012-08-31 02:03 . 2011-04-27 19:25 128456 ----a-w- c:\windows\system32\drivers\NisDrvWFP.sys

2012-08-20 17:38 . 2012-10-10 01:40 44032 ----a-w- c:\windows\apppatch\acwow64.dll

2012-07-18 18:15 . 2012-08-15 16:24 3148800 ----a-w- c:\windows\system32\win32k.sys

.

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

.

[HKEY_LOCAL_MACHINE\Wow6432Node\~\Browser Helper Objects\{3706EE7C-3CAD-445D-8A43-03EBC3B75908}]

2012-01-04 23:02 233288 ----a-w- c:\program files (x86)\Expat Shield\HssIE\ExpatIE.dll

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\Carbonite.Green]

@="{95A27763-F62A-4114-9072-E81D87DE3B68}"

[HKEY_CLASSES_ROOT\CLSID\{95A27763-F62A-4114-9072-E81D87DE3B68}]

2011-03-04 00:52 762000 ----a-r- c:\program files (x86)\Carbonite\Carbonite Backup\CarboniteNSE.dll

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\Carbonite.Partial]

@="{E300CD91-100F-4E67-9AF3-1384A6124015}"

[HKEY_CLASSES_ROOT\CLSID\{E300CD91-100F-4E67-9AF3-1384A6124015}]

2011-03-04 00:52 762000 ----a-r- c:\program files (x86)\Carbonite\Carbonite Backup\CarboniteNSE.dll

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\Carbonite.Yellow]

@="{5E529433-B50E-4bef-A63B-16A6B71B071A}"

[HKEY_CLASSES_ROOT\CLSID\{5E529433-B50E-4bef-A63B-16A6B71B071A}]

2011-03-04 00:52 762000 ----a-r- c:\program files (x86)\Carbonite\Carbonite Backup\CarboniteNSE.dll

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]

"IAStorIcon"="c:\program files (x86)\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe" [2010-09-14 283160]

"SuiteTray"="c:\program files (x86)\EgisTec MyWinLockerSuite\x86\SuiteTray.exe" [2010-09-28 340336]

"EgisTecPMMUpdate"="c:\program files (x86)\EgisTec IPS\PmmUpdate.exe" [2010-09-17 407920]

"EgisUpdate"="c:\program files (x86)\EgisTec IPS\EgisUpdate.exe" [2010-09-17 201584]

"Norton Online Backup"="c:\program files (x86)\Symantec\Norton Online Backup\NOBuClient.exe" [2010-06-01 1155928]

"Adobe Reader Speed Launcher"="c:\program files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-28 35696]

"BackupManagerTray"="c:\program files (x86)\NTI\Acer Backup Manager\BackupManagerTray.exe" [2011-02-15 297280]

"LManager"="c:\program files (x86)\Launch Manager\LManager.exe" [2011-03-14 1081424]

"Dolby Advanced Audio v2"="c:\dolby pcee4\pcee4.exe" [2011-02-03 506712]

"ArcadeMovieService"="c:\program files (x86)\Acer\clear.fi\Movie\clear.fiMovieService.exe" [2011-02-18 177448]

"Carbonite Backup"="c:\program files (x86)\Carbonite\Carbonite Backup\CarboniteUI.exe" [2011-03-04 948880]

"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-10-25 932288]

"Adobe Acrobat Speed Launcher"="c:\program files (x86)\Adobe\Acrobat 10.0\Acrobat\Acrobat_sl.exe" [2010-10-25 36760]

"Acrobat Assistant 8.0"="c:\program files (x86)\Adobe\Acrobat 10.0\Acrobat\Acrotray.exe" [2010-10-25 821144]

"SwitchBoard"="c:\program files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe" [2010-02-19 517096]

"AdobeCS5ServiceManager"="c:\program files (x86)\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe" [2010-02-22 406992]

"APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2011-11-02 59240]

"QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" [2011-10-24 421888]

"iTunesHelper"="c:\program files (x86)\iTunes\iTunesHelper.exe" [2012-01-16 421736]

"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2012-01-18 254696]

.

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]

"IsMyWinLockerReboot"="msiexec.exe" [2010-11-21 73216]

.

c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\

McAfee Security Scan Plus.lnk - c:\program files (x86)\McAfee Security Scan\3.0.207\SSScheduler.exe [2011-6-17 272528]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"ConsentPromptBehaviorAdmin"= 5 (0x5)

"ConsentPromptBehaviorUser"= 3 (0x3)

"EnableUIADesktopToggle"= 0 (0x0)

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]

"LoadAppInit_DLLs"=0 (0x0)

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]

"aux"=wdmaud.drv

.

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]

Security Packages REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp

.

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]

@=""

.

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]

@="Service"

.

R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]

R2 DsiWMIService;Dritek WMI Service;c:\program files (x86)\Launch Manager\dsiwmis.exe [2011-03-14 352336]

R2 ExpatShieldService;Expat Shield Service;c:\program files (x86)\Expat Shield\bin\openvpnas.exe [2012-01-06 331608]

R2 ExpatSrv;Expat Shield Routing Service;c:\program files (x86)\Expat Shield\HssWPR\hsssrv.exe [2012-01-04 363336]

R2 ExpatWd;Expat Shield Monitoring Service;c:\program files (x86)\Expat Shield\bin\hsswd.exe [2012-01-04 329544]

R2 GREGService;GREGService;c:\program files (x86)\Acer\Registration\GREGsvc.exe [2010-01-08 23584]

R2 IAStorDataMgrSvc;Intel® Rapid Storage Technology;c:\program files (x86)\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe [2010-09-14 13336]

R2 NOBU;Norton Online Backup;c:\program files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe SERVICE [x]

R2 NTI IScheduleSvc;NTI IScheduleSvc;c:\program files (x86)\NTI\Acer Backup Manager\IScheduleSvc.exe [2011-02-15 257344]

R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe [2012-07-13 160944]

R2 UNS;Intel® Management and Security Application User Notification Service;c:\program files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe [2011-02-01 2656280]

R3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-10-10 250808]

R3 EgisTec Ticket Service;EgisTec Ticket Service;c:\program files (x86)\Common Files\EgisTec\Services\EgisTicketService.exe [2010-09-28 172912]

R3 ExpatTrayService;Expat Shield Tray Service;c:\program files (x86)\Expat Shield\bin\ExpatTrayService.EXE [2012-01-06 77520]

R3 GamesAppService;GamesAppService;c:\program files (x86)\WildTangent Games\App\GamesAppService.exe [2010-10-12 206072]

R3 McComponentHostService;McAfee Security Scan Component Host Service;c:\program files (x86)\McAfee Security Scan\3.0.207\McCHSvc.exe [2011-06-17 237008]

R3 Microsoft SharePoint Workspace Audit Service;Microsoft SharePoint Workspace Audit Service;c:\program files\Microsoft Office\Office14\GROOVE.EXE [2011-06-12 51740536]

R3 MozillaMaintenance;Mozilla Maintenance Service;c:\program files (x86)\Mozilla Maintenance Service\maintenanceservice.exe [2012-09-08 114144]

R3 NisDrv;Microsoft Network Inspection System;c:\windows\system32\DRIVERS\NisDrvWFP.sys [2012-08-31 128456]

R3 NisSrv;Microsoft Network Inspection;c:\program files\Microsoft Security Client\NisSrv.exe [2012-09-13 368896]

R3 ose64;Office 64 Source Engine;c:\program files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2010-01-10 174440]

R3 osppsvc;Office Software Protection Platform;c:\program files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-01-10 4925184]

R3 SwitchBoard;Adobe SwitchBoard;c:\program files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [2010-02-19 517096]

R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-21 59392]

R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys [2010-11-21 31232]

R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys [2011-05-10 51712]

R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [2011-08-04 1255736]

R3 WSDPrintDevice;WSD Print Support via UMB;c:\windows\system32\DRIVERS\WSDPrint.sys [2009-07-14 23040]

R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe [2010-09-23 57184]

S1 mwlPSDFilter;mwlPSDFilter;c:\windows\system32\DRIVERS\mwlPSDFilter.sys [2011-04-06 22912]

S1 mwlPSDNServ;mwlPSDNServ;c:\windows\system32\DRIVERS\mwlPSDNServ.sys [2011-04-06 20328]

S1 mwlPSDVDisk;mwlPSDVDisk;c:\windows\system32\DRIVERS\mwlPSDVDisk.sys [2011-04-06 62584]

S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [2009-07-14 59904]

S2 ePowerSvc;Acer ePower Service;c:\program files\Acer\Acer ePower Management\ePowerSvc.exe [2011-02-23 873064]

S2 Live Updater Service;Live Updater Service;c:\program files\Acer\Acer Updater\UpdaterService.exe [2011-01-31 244624]

S3 b57xdbd;Broadcom xD Picture Bus Driver Service;c:\windows\system32\drivers\b57xdbd.sys [2011-01-21 67624]

S3 b57xdmp;Broadcom xD Picture vstorp client drv;c:\windows\system32\drivers\b57xdmp.sys [2011-01-21 19496]

S3 bScsiMSa;bScsiMSa;c:\windows\system32\drivers\bScsiMSa.sys [2011-01-20 52264]

S3 bScsiSDa;bScsiSDa;c:\windows\system32\DRIVERS\bScsiSDa.sys [2011-01-14 85544]

S3 IntcDAud;Intel® Display Audio;c:\windows\system32\DRIVERS\IntcDAud.sys [2010-10-15 317440]

S3 k57nd60a;Broadcom NetLink Gigabit Ethernet - NDIS 6.0;c:\windows\system32\DRIVERS\k57nd60a.sys [2011-01-17 412712]

S3 MEIx64;Intel® Management Engine Interface;c:\windows\system32\DRIVERS\HECIx64.sys [2010-10-20 56344]

.

.

Contents of the 'Scheduled Tasks' folder

.

2012-10-11 c:\windows\Tasks\Adobe Flash Player Updater.job

- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-08-12 21:07]

.

.

--------- X64 Entries -----------

.

.

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{3706EE7C-3CAD-445D-8A43-03EBC3B75908}]

2012-01-04 23:02 287048 ----a-w- c:\program files (x86)\Expat Shield\HssIE\ExpatIE_64.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\Carbonite.Green]

@="{95A27763-F62A-4114-9072-E81D87DE3B68}"

[HKEY_CLASSES_ROOT\CLSID\{95A27763-F62A-4114-9072-E81D87DE3B68}]

2011-03-04 00:36 1174672 ----a-r- c:\program files\Carbonite\Carbonite Backup\CarboniteNSE.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\Carbonite.Partial]

@="{E300CD91-100F-4E67-9AF3-1384A6124015}"

[HKEY_CLASSES_ROOT\CLSID\{E300CD91-100F-4E67-9AF3-1384A6124015}]

2011-03-04 00:36 1174672 ----a-r- c:\program files\Carbonite\Carbonite Backup\CarboniteNSE.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\Carbonite.Yellow]

@="{5E529433-B50E-4bef-A63B-16A6B71B071A}"

[HKEY_CLASSES_ROOT\CLSID\{5E529433-B50E-4bef-A63B-16A6B71B071A}]

2011-03-04 00:36 1174672 ----a-r- c:\program files\Carbonite\Carbonite Backup\CarboniteNSE.dll

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"IgfxTray"="c:\windows\system32\igfxtray.exe" [2011-03-30 167960]

"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2011-03-30 391704]

"Persistence"="c:\windows\system32\igfxpers.exe" [2011-03-30 418840]

"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2011-03-10 11785832]

"RtHDVBg"="c:\program files\Realtek\Audio\HDA\RAVBg64.exe" [2011-03-09 2189416]

"Power Management"="c:\program files\Acer\Acer ePower Management\ePowerTray.exe" [2011-02-23 1796200]

"BCSSync"="c:\program files\Microsoft Office\Office14\BCSSync.exe" [2010-03-13 112512]

"AdobeAAMUpdater-1.0"="c:\program files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe" [2010-09-16 497648]

"MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2012-09-13 1289704]

.

------- Supplementary Scan -------

.

uLocal Page = c:\windows\system32\blank.htm

uStart Page = hxxp://acer.msn.com

mDefault_Page_URL = hxxp://acer.msn.com

mStart Page = hxxp://acer.msn.com

mLocal Page = c:\windows\SysWOW64\blank.htm

uInternet Settings,ProxyOverride = *.local

IE: Append Link Target to Existing PDF - c:\program files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html

IE: Append to Existing PDF - c:\program files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html

IE: Convert Link Target to Adobe PDF - c:\program files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html

IE: Convert to Adobe PDF - c:\program files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECapture.html

IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~3\Office14\EXCEL.EXE/3000

IE: Se&nd to OneNote - c:\progra~1\MICROS~3\Office14\ONBttnIE.dll/105

TCP: DhcpNameServer = 10.0.0.1

TCP: Interfaces\{AA180B28-E6AA-4BED-AE1A-9E3A74AEE289}: NameServer = 10.197.48.1

FF - ProfilePath - c:\users\Marci\AppData\Roaming\Mozilla\Firefox\Profiles\o3zmyekh.default\

FF - prefs.js: browser.startup.homepage - hxxp://www.facebook.com/marci.gower

.

- - - - ORPHANS REMOVED - - - -

.

Toolbar-Locked - (no file)

Wow6432Node-HKCU-Run-ISUSPM - c:\programdata\FLEXnet\Connect\11\ISUSPM.exe

Wow6432Node-HKLM-Run-<NO NAME> - (no file)

Toolbar-Locked - (no file)

HKLM-Run-SynTPEnh - c:\program files (x86)\Synaptics\SynTP\SynTPEnh.exe

.

.

.

--------------------- LOCKED REGISTRY KEYS ---------------------

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]

@Denied: (A 2) (Everyone)

@="FlashBroker"

"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_4_402_287_ActiveX.exe,-101"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]

"Enabled"=dword:00000001

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]

@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_4_402_287_ActiveX.exe"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]

@Denied: (A 2) (Everyone)

@="IFlashBroker5"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]

@="{00020424-0000-0000-C000-000000000046}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

"Version"="1.0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]

@Denied: (A 2) (Everyone)

@="FlashBroker"

"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_4_402_287_ActiveX.exe,-101"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]

"Enabled"=dword:00000001

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_4_402_287_ActiveX.exe"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]

@Denied: (A 2) (Everyone)

@="Shockwave Flash Object"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_4_402_287.ocx"

"ThreadingModel"="Apartment"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]

@="0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]

@="ShockwaveFlash.ShockwaveFlash.11"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_4_402_287.ocx, 1"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]

@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]

@="1.0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]

@="ShockwaveFlash.ShockwaveFlash"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]

@Denied: (A 2) (Everyone)

@="Macromedia Flash Factory Object"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_4_402_287.ocx"

"ThreadingModel"="Apartment"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]

@="FlashFactory.FlashFactory.1"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_4_402_287.ocx, 1"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]

@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]

@="1.0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]

@="FlashFactory.FlashFactory"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]

@Denied: (A 2) (Everyone)

@="IFlashBroker5"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]

@="{00020424-0000-0000-C000-000000000046}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

"Version"="1.0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\McAfee]

"SymbolicLinkValue"=hex(6):5c,00,72,00,65,00,67,00,69,00,73,00,74,00,72,00,79,

00,5c,00,6d,00,61,00,63,00,68,00,69,00,6e,00,65,00,5c,00,53,00,6f,00,66,00,\

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]

@Denied: (Full) (Everyone)

.

Completion time: 2012-10-10 21:27:48

ComboFix-quarantined-files.txt 2012-10-11 01:27

.

Pre-Run: 231,965,261,824 bytes free

Post-Run: 232,156,762,112 bytes free

.

- - End Of File - - AF2A75B981827CDD1BEEE564CA2E7BD4

Link to post
Share on other sites

Guest
This topic is now closed to further replies.
 Share

  • Recently Browsing   0 members

    • No registered users viewing this page.
Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.