I am Infected with malware and need help

Mr. Bojangles · February 25, 2013

Re-starting a new thread. here are the scan results.

#JRT

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Junkware Removal Tool (JRT) by Thisisu

Version: 4.6.5 (02.18.2013:1)

OS: Microsoft Windows XP x86

Ran by Mr. Bojangles on Sun 02/24/2013 at 22:14:19.36

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

~~~ Services

~~~ Registry Values

Successfully deleted: [Registry Value] hkey_current_user\software\microsoft\internet explorer\toolbar\webbrowser\\{1392b8d2-5c05-419f-a8f6-b9f15a596612}

Successfully deleted: [Registry Value] hkey_current_user\software\microsoft\internet explorer\urlsearchhooks\\{1392b8d2-5c05-419f-a8f6-b9f15a596612}

Successfully deleted: [Registry Value] hkey_local_machine\software\microsoft\internet explorer\toolbar\\{6c97a91e-4524-4019-86af-2aa2d567bf5c}

Successfully repaired: [Registry Value] hkey_current_user\software\microsoft\internet explorer\searchscopes\\DefaultScope

Successfully repaired: [Registry Value] hkey_local_machine\software\microsoft\internet explorer\searchscopes\\DefaultScope

Successfully repaired: [Registry Value] hkey_users\.default\software\microsoft\internet explorer\searchscopes\\DefaultScope

Successfully repaired: [Registry Value] hkey_users\s-1-5-18\software\microsoft\internet explorer\searchscopes\\DefaultScope

Successfully repaired: [Registry Value] hkey_users\s-1-5-19\software\microsoft\internet explorer\searchscopes\\DefaultScope

Successfully repaired: [Registry Value] hkey_users\s-1-5-20\software\microsoft\internet explorer\searchscopes\\DefaultScope

Successfully repaired: [Registry Value] hkey_users\S-1-5-21-2838019926-1718427338-2428480347-1008\software\microsoft\internet explorer\searchscopes\\DefaultScope

Successfully repaired: [Registry Value] hkey_current_user\software\microsoft\internet explorer\searchscopes\{0633ee93-d776-472f-a0ff-e1416b8b2e3a}\\DisplayName

Successfully repaired: [Registry Value] hkey_current_user\software\microsoft\internet explorer\searchscopes\{0633ee93-d776-472f-a0ff-e1416b8b2e3a}\\URL

Successfully repaired: [Registry Value] hkey_local_machine\software\microsoft\internet explorer\searchscopes\{0633ee93-d776-472f-a0ff-e1416b8b2e3a}\\DisplayName

Successfully repaired: [Registry Value] hkey_local_machine\software\microsoft\internet explorer\searchscopes\{0633ee93-d776-472f-a0ff-e1416b8b2e3a}\\URL

~~~ Registry Keys

Successfully deleted: [Registry Key] hkey_current_user\software\1clickdownload

Successfully deleted: [Registry Key] hkey_local_machine\software\conduit

Successfully deleted: [Registry Key] hkey_local_machine\software\iminent

Successfully deleted: [Registry Key] hkey_current_user\software\pricegong

Successfully deleted: [Registry Key] hkey_current_user\software\softonic

Successfully deleted: [Registry Key] hkey_current_user\software\sweetim

Successfully deleted: [Registry Key] hkey_local_machine\software\sweetim

Successfully deleted: [Registry Key] hkey_local_machine\software\classes\conduit.engine

Successfully deleted: [Registry Key-Heur] HKEY_LOCAL_MACHINE\software\classes\Toolbar.CT1060933

Successfully deleted: [Registry Key-Heur] HKEY_LOCAL_MACHINE\software\classes\Toolbar.CT2548838

Successfully deleted: [Registry Key-Heur] HKEY_LOCAL_MACHINE\software\classes\Toolbar.CT2704262

Successfully deleted: [Registry Key] hkey_classes_root\clsid\{1392b8d2-5c05-419f-a8f6-b9f15a596612}

Successfully deleted: [Registry Key] hkey_classes_root\clsid\{3c471948-f874-49f5-b338-4f214a2ee0b1}

Successfully deleted: [Registry Key] hkey_classes_root\clsid\{6c97a91e-4524-4019-86af-2aa2d567bf5c}

Successfully deleted: [Registry Key] hkey_local_machine\software\microsoft\windows\currentversion\explorer\browser helper objects\{6c97a91e-4524-4019-86af-2aa2d567bf5c}

Successfully deleted: [Registry Key] hkey_current_user\software\microsoft\internet explorer\searchscopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}

~~~ Files

Successfully deleted: [File] "C:\WINDOWS\system32\conduitengine.tmp"

~~~ Folders

Successfully deleted: [Folder] "C:\Documents and Settings\Mr. Bojangles\Application Data\adawaretb"

Successfully deleted: [Folder] "C:\Documents and Settings\Mr. Bojangles\Application Data\pricegong"

Successfully deleted: [Folder] "C:\Documents and Settings\Mr. Bojangles\Local Settings\Application Data\adawarebp"

Successfully deleted: [Folder] "C:\Documents and Settings\Mr. Bojangles\Local Settings\Application Data\conduit"

Successfully deleted: [Folder] "C:\Program Files\adawaretb"

Successfully deleted: [Folder] "C:\Program Files\conduit"

Successfully deleted: [Folder] "C:\Program Files\free youtube downloader"

Successfully deleted: [Folder] "C:\WINDOWS\freecorder"

Successfully deleted: [Folder] "C:\WINDOWS\installer\{86d4b82a-abed-442a-be86-96357b70f4fe}"

~~~ FireFox

Successfully deleted: [File] C:\Documents and Settings\Mr. Bojangles\Application Data\mozilla\firefox\profiles\64w0fp13.default\user.js

Successfully deleted: [Folder] C:\Documents and Settings\Mr. Bojangles\Application Data\mozilla\firefox\profiles\64w0fp13.default\conduitcommon

Successfully deleted: [Folder] C:\Documents and Settings\Mr. Bojangles\Application Data\mozilla\firefox\profiles\64w0fp13.default\extensions\jid1-yZwVFzbsyfMrqQ@jetpack

Successfully deleted: [Folder] C:\Documents and Settings\Mr. Bojangles\Application Data\mozilla\firefox\profiles\64w0fp13.default\extensions\{1392b8d2-5c05-419f-a8f6-b9f15a596612}

Successfully deleted: [Folder] C:\Documents and Settings\Mr. Bojangles\Application Data\mozilla\firefox\profiles\64w0fp13.default\extensions\{87934c42-161d-45bc-8cef-ef18abe2a30c}

Successfully deleted the following from C:\Documents and Settings\Mr. Bojangles\Application Data\mozilla\firefox\profiles\64w0fp13.default\prefs.js

user_pref("CT1060933..clientLogIsEnabled", false);

user_pref("CT1060933..clientLogServiceUrl", "hxxp://clientlog.users.conduit.com/ClientDiagnostics.asmx/ReportDiagnosticsEvent");

user_pref("CT1060933..uninstallLogServiceUrl", "hxxp://uninstall.users.conduit.com/Uninstall.asmx/RegisterToolbarUninstallation");

user_pref("CT1060933.ALLOW_SHOWING_HIDDEN_TOOLBAR", false);

user_pref("CT1060933.AboutPrivacyUrl", "hxxp://www.conduit.com/privacy/Default.aspx");

user_pref("CT1060933.BrowserCompStateIsOpen_129681785283868963", true);

user_pref("CT1060933.BrowserCompStateIsOpen_129686665230467549", true);

user_pref("CT1060933.BrowserCompStateIsOpen_130040833450137909", true);

user_pref("CT1060933.CTID", "CT1060933");

user_pref("CT1060933.CurrentServerDate", "24-2-2013");

user_pref("CT1060933.DSInstall", false);

user_pref("CT1060933.DialogsAlignMode", "LTR");

user_pref("CT1060933.DialogsGetterLastCheckTime", "Sun Feb 24 2013 06:57:59 GMT+1000");

user_pref("CT1060933.DownloadReferralCookieData", "");

user_pref("CT1060933.FirstServerDate", "16-2-2012");

user_pref("CT1060933.FirstTime", true);

user_pref("CT1060933.FirstTimeFF3", true);

user_pref("CT1060933.FixPageNotFoundErrors", true);

user_pref("CT1060933.GroupingServerCheckInterval", 1440);

user_pref("CT1060933.GroupingServiceUrl", "hxxp://grouping.services.conduit.com/");

user_pref("CT1060933.HPInstall", false);

user_pref("CT1060933.HasUserGlobalKeys", true);

user_pref("CT1060933.Initialize", true);

user_pref("CT1060933.InitializeCommonPrefs", true);

user_pref("CT1060933.InstallationAndCookieDataSentCount", 3);

user_pref("CT1060933.InstallationId", "ConduitNSISIntegration");

user_pref("CT1060933.InstallationType", "ConduitXPEIntegration");

user_pref("CT1060933.InstalledDate", "Thu Feb 16 2012 15:31:54 GMT+1000");

user_pref("CT1060933.InvalidateCache", false);

user_pref("CT1060933.IsGrouping", false);

user_pref("CT1060933.IsInitSetupIni", true);

user_pref("CT1060933.IsMulticommunity", false);

user_pref("CT1060933.IsOpenThankYouPage", false);

user_pref("CT1060933.IsOpenUninstallPage", true);

user_pref("CT1060933.LanguagePackLastCheckTime", "Sun Feb 24 2013 10:37:57 GMT+1000");

user_pref("CT1060933.LanguagePackReloadIntervalMM", 1440);

user_pref("CT1060933.LanguagePackServiceUrl", "hxxp://translation.users.conduit.com/Translation.ashx");

user_pref("CT1060933.LastLogin_3.10.0.1", "Thu Feb 16 2012 15:31:56 GMT+1000");

user_pref("CT1060933.LastLogin_3.12.2.3", "Mon May 28 2012 08:37:18 GMT+1000");

user_pref("CT1060933.LastLogin_3.13.0.6", "Mon Jul 16 2012 02:25:24 GMT+1000");

user_pref("CT1060933.LastLogin_3.14.1.0", "Tue Aug 21 2012 22:42:45 GMT+1000");

user_pref("CT1060933.LastLogin_3.15.1.0", "Wed Nov 07 2012 10:33:29 GMT+1000");

user_pref("CT1060933.LastLogin_3.16.0.100", "Wed Feb 13 2013 06:17:51 GMT+1000");

user_pref("CT1060933.LastLogin_3.16.0.3", "Sat Jan 05 2013 04:34:35 GMT+1000");

user_pref("CT1060933.LastLogin_3.18.0.7", "Sun Feb 24 2013 18:38:12 GMT+1000");

user_pref("CT1060933.LatestVersion", "3.18.0.7");

user_pref("CT1060933.Locale", "en-us");

user_pref("CT1060933.MCDetectTooltipHeight", "83");

user_pref("CT1060933.MCDetectTooltipUrl", "hxxp://@EB_INSTALL_LINK@/rank/tooltip/?version=1");

user_pref("CT1060933.MCDetectTooltipWidth", "295");

user_pref("CT1060933.MyStuffEnabledAtInstallation", true);

user_pref("CT1060933.OriginalFirstVersion", "3.10.0.1");

user_pref("CT1060933.RadioIsPodcast", false);

user_pref("CT1060933.RadioLastCheckTime", "Thu Feb 16 2012 15:31:57 GMT+1000");

user_pref("CT1060933.RadioLastUpdateIPServer", "0");

user_pref("CT1060933.RadioLastUpdateServer", "129326918102570000");

user_pref("CT1060933.RadioMediaID", "21504191");

user_pref("CT1060933.RadioMediaType", "Media Player");

user_pref("CT1060933.RadioMenuSelectedID", "EBRadioMenu_CT106093321504191");

user_pref("CT1060933.RadioShrinkedFromSetup", false);

user_pref("CT1060933.RadioStationName", "KFOG");

user_pref("CT1060933.RadioStationURL", "hxxp://live.cumulusstreaming.com/KFOG-FM");

user_pref("CT1060933.SearchCaption", "Freecorder Customized Web Search");

user_pref("CT1060933.SearchFromAddressBarIsInit", true);

user_pref("CT1060933.SearchFromAddressBarUrl", "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT1060933&SearchSource=2&q=");

user_pref("CT1060933.SearchInNewTabEnabled", true);

user_pref("CT1060933.SearchInNewTabIntervalMM", 1440);

user_pref("CT1060933.SearchInNewTabLastCheckTime", "Sun Feb 24 2013 10:37:57 GMT+1000");

user_pref("CT1060933.SearchInNewTabServiceUrl", "hxxp://newtab.conduit-hosting.com/newtab/?ctid=EB_TOOLBAR_ID&UM=UM_ID");

user_pref("CT1060933.SearchInNewTabUserEnabled", false);

user_pref("CT1060933.SendProtectorDataViaLogin", true);

user_pref("CT1060933.ServiceMapLastCheckTime", "Sun Feb 24 2013 10:37:57 GMT+1000");

user_pref("CT1060933.SettingsLastCheckTime", "Sun Feb 24 2013 21:38:31 GMT+1000");

user_pref("CT1060933.SettingsLastUpdate", "1361679090");

user_pref("CT1060933.TBHomePageUrl", "hxxp://search.conduit.com/?ctid=CT1060933&SearchSource=13");

user_pref("CT1060933.ThirdPartyComponentsInterval", 504);

user_pref("CT1060933.ThirdPartyComponentsLastCheck", "Thu Feb 16 2012 15:31:53 GMT+1000");

user_pref("CT1060933.ThirdPartyComponentsLastUpdate", "1312887586");

user_pref("CT1060933.ToolbarShrinkedFromSetup", false);

user_pref("CT1060933.TrusteLinkUrl", "hxxp://trust.conduit.com/CT1060933");

user_pref("CT1060933.TrustedApiDomains", "conduit.com,conduit-hosting.com,conduit-services.com,client.conduit-storage.com,OurToolbar.com,CommunityToolbars.com,ForumToolbar.com

user_pref("CT1060933.UserID", "UN14161264893491318");

user_pref("CT1060933.ValidationData_Toolbar", 1);

user_pref("CT1060933.alertChannelId", "15651");

user_pref("CT1060933.autoDisableScopes", -1);

user_pref("CT1060933.backendstorage.autocompletepro_enable", "31");

user_pref("CT1060933.backendstorage.autocompletepro_enable_auto", "31");

user_pref("CT1060933.backendstorage.cbfirsttime", "5468752046656220313620323031322031353A33343A303820474D542B31303030");

user_pref("CT1060933.backendstorage.shoppingapp.gk.exipres", "5475652046656220323120323031322031353A33343A303720474D542B31303030");

user_pref("CT1060933.backendstorage.shoppingapp.gk.geolocation", "6175737472616C6961");

user_pref("CT1060933.components.129032145384800518", false);

user_pref("CT1060933.components.129272674122038321", false);

user_pref("CT1060933.generalConfigFromLogin", "{\"ApiMaxAlerts\":\"12\",\"SocialDomains\":\"social.conduit.com;apps.conduit.com;services.apps.conduit.com\",\"AppsDetectionUrlP

user_pref("CT1060933.globalFirstTimeInfoLastCheckTime", "Thu Feb 16 2012 15:31:55 GMT+1000");

user_pref("CT1060933.homepageProtectorEnableByLogin", true);

user_pref("CT1060933.initDone", true);

user_pref("CT1060933.isAppTrackingManagerOn", true);

user_pref("CT1060933.isFirstRadioInstallation", false);

user_pref("CT1060933.myStuffEnabled", true);

user_pref("CT1060933.myStuffPublihserMinWidth", 400);

user_pref("CT1060933.myStuffSearchUrl", "hxxp://Apps.conduit.com/search?q=SEARCH_TERM&SearchSourceOrigin=29&ctid=EB_TOOLBAR_ID&octid=EB_ORIGINAL_CTID");

user_pref("CT1060933.myStuffServiceIntervalMM", 1440);

user_pref("CT1060933.myStuffServiceUrl", "hxxp://mystuff.conduit-services.com/MyStuffService.ashx?ComponentId=EB_MY_STUFF_INSTANCE_GUID&lut=EB_MY_STUFF_LUT");

user_pref("CT1060933.navigateToUrlOnSearch", false);

user_pref("CT1060933.revertSettingsEnabled", true);

user_pref("CT1060933.searchProtectorDialogDelayInSec", 10);

user_pref("CT1060933.searchProtectorEnableByLogin", true);

user_pref("CT1060933.testingCtid", "");

user_pref("CT1060933.toolbarAppMetaDataLastCheckTime", "Sun Feb 24 2013 10:37:57 GMT+1000");

user_pref("CT1060933.toolbarContextMenuLastCheckTime", "Thu Feb 16 2012 15:31:56 GMT+1000");

user_pref("CT1060933.usagesFlag", 2);

user_pref("CT2704262..clientLogIsEnabled", false);

user_pref("CT2704262..clientLogServiceUrl", "hxxp://clientlog.users.conduit.com/ClientDiagnostics.asmx/ReportDiagnosticsEvent");

user_pref("CT2704262..uninstallLogServiceUrl", "hxxp://uninstall.users.conduit.com/Uninstall.asmx/RegisterToolbarUninstallation");

user_pref("CT2704262.ALLOW_SHOWING_HIDDEN_TOOLBAR", false);

user_pref("CT2704262.AboutPrivacyUrl", "hxxp://www.conduit.com/privacy/Default.aspx");

user_pref("CT2704262.BrowserCompStateIsOpen_129674822392465408", true);

user_pref("CT2704262.BrowserCompStateIsOpen_129738587603157113", true);

user_pref("CT2704262.BrowserCompStateIsOpen_129738587703159675", true);

user_pref("CT2704262.CTID", "CT2704262");

user_pref("CT2704262.CurrentServerDate", "18-6-2012");

user_pref("CT2704262.DSInstall", false);

user_pref("CT2704262.DialogsAlignMode", "LTR");

user_pref("CT2704262.DialogsGetterLastCheckTime", "Tue Jun 19 2012 16:14:25 GMT+1000");

user_pref("CT2704262.DownloadReferralCookieData", "");

user_pref("CT2704262.FeedLastCount129531287796537552", 295);

user_pref("CT2704262.FeedPollDate129531287797162554", "Wed Apr 11 2012 06:58:54 GMT+1000");

user_pref("CT2704262.FeedPollDate129531287797162555", "Wed Apr 11 2012 06:58:54 GMT+1000");

user_pref("CT2704262.FeedPollDate129531287797162556", "Wed Apr 11 2012 06:58:54 GMT+1000");

user_pref("CT2704262.FeedPollDate129531287797162557", "Wed Apr 11 2012 06:58:54 GMT+1000");

user_pref("CT2704262.FeedPollDate129531287797162558", "Wed Apr 11 2012 06:58:54 GMT+1000");

user_pref("CT2704262.FeedPollDate129531287797162559", "Wed Apr 11 2012 06:58:54 GMT+1000");

user_pref("CT2704262.FeedPollDate129531287797162560", "Wed Apr 11 2012 06:58:54 GMT+1000");

user_pref("CT2704262.FeedPollDate129531287797162561", "Wed Apr 11 2012 06:58:54 GMT+1000");

user_pref("CT2704262.FeedTTL129531287797162554", 40);

user_pref("CT2704262.FeedTTL129531287797162555", 40);

user_pref("CT2704262.FeedTTL129531287797162556", 40);

user_pref("CT2704262.FeedTTL129531287797162557", 40);

user_pref("CT2704262.FeedTTL129531287797162558", 40);

user_pref("CT2704262.FeedTTL129531287797162559", 40);

user_pref("CT2704262.FeedTTL129531287797162560", 40);

user_pref("CT2704262.FeedTTL129531287797162561", 40);

user_pref("CT2704262.FirstServerDate", "10-4-2012");

user_pref("CT2704262.FirstTime", true);

user_pref("CT2704262.FirstTimeFF3", true);

user_pref("CT2704262.FixPageNotFoundErrors", true);

user_pref("CT2704262.GroupingServerCheckInterval", 1440);

user_pref("CT2704262.GroupingServiceUrl", "hxxp://grouping.services.conduit.com/");

user_pref("CT2704262.HPInstall", false);

user_pref("CT2704262.HasUserGlobalKeys", true);

user_pref("CT2704262.HomePageProtectorEnabled", false);

user_pref("CT2704262.HomepageBeforeUnload", "www.google.com");

user_pref("CT2704262.Initialize", true);

user_pref("CT2704262.InitializeCommonPrefs", true);

user_pref("CT2704262.InstallationAndCookieDataSentCount", 3);

user_pref("CT2704262.InstallationId", "ConduitNSISIntegration");

user_pref("CT2704262.InstallationType", "ConduitXPEIntegration");

user_pref("CT2704262.InstalledDate", "Tue Apr 10 2012 22:51:15 GMT+1000");

user_pref("CT2704262.InvalidateCache", false);

user_pref("CT2704262.IsAlertDBUpdated", true);

user_pref("CT2704262.IsGrouping", false);

user_pref("CT2704262.IsInitSetupIni", true);

user_pref("CT2704262.IsMulticommunity", false);

user_pref("CT2704262.IsOpenThankYouPage", false);

user_pref("CT2704262.IsOpenUninstallPage", true);

user_pref("CT2704262.LanguagePackLastCheckTime", "Tue Jun 19 2012 16:14:31 GMT+1000");

user_pref("CT2704262.LanguagePackReloadIntervalMM", 1440);

user_pref("CT2704262.LanguagePackServiceUrl", "hxxp://translation.users.conduit.com/Translation.ashx");

user_pref("CT2704262.LastLogin_3.10.0.455", "Wed Apr 11 2012 06:58:54 GMT+1000");

user_pref("CT2704262.LastLogin_3.13.0.6", "Tue Jun 19 2012 21:14:50 GMT+1000");

user_pref("CT2704262.LatestVersion", "3.13.0.6");

user_pref("CT2704262.Locale", "en");

user_pref("CT2704262.MCDetectTooltipHeight", "83");

user_pref("CT2704262.MCDetectTooltipUrl", "hxxp://@EB_INSTALL_LINK@/rank/tooltip/?version=1");

user_pref("CT2704262.MCDetectTooltipWidth", "295");

user_pref("CT2704262.MyStuffEnabledAtInstallation", true);

user_pref("CT2704262.OriginalFirstVersion", "3.10.0.455");

user_pref("CT2704262.RadioIsPodcast", false);

user_pref("CT2704262.RadioLastCheckTime", "Tue Apr 10 2012 22:51:16 GMT+1000");

user_pref("CT2704262.RadioLastUpdateIPServer", "3");

user_pref("CT2704262.RadioLastUpdateServer", "129242955136270000");

user_pref("CT2704262.RadioMediaID", "21037024");

user_pref("CT2704262.RadioMediaType", "Media Player");

user_pref("CT2704262.RadioMenuSelectedID", "EBRadioMenu_CT270426221037024");

user_pref("CT2704262.RadioShrinkedFromSetup", false);

user_pref("CT2704262.RadioStationName", "California%20Rock");

user_pref("CT2704262.RadioStationURL", "hxxp://feedlive.net/california.asx");

user_pref("CT2704262.SearchCaption", "FreeSoundRecorder Customized Web Search");

user_pref("CT2704262.SearchEngineBeforeUnload", "chrome://browser-region/locale/region.properties");

user_pref("CT2704262.SearchFromAddressBarIsInit", true);

user_pref("CT2704262.SearchFromAddressBarUrl", "hxxp://search.conduit.com/ResultsExt.aspx?SSPV=FFOB6&ctid=CT2704262&SearchSource=2&q=");

user_pref("CT2704262.SearchInNewTabEnabled", true);

user_pref("CT2704262.SearchInNewTabIntervalMM", 1440);

user_pref("CT2704262.SearchInNewTabLastCheckTime", "Tue Jun 19 2012 16:14:23 GMT+1000");

user_pref("CT2704262.SearchInNewTabServiceUrl", "hxxp://newtab.conduit-hosting.com/newtab/?ctid=EB_TOOLBAR_ID");

user_pref("CT2704262.SearchProtectorEnabled", false);

user_pref("CT2704262.SearchProtectorToolbarDisabled", false);

user_pref("CT2704262.SendProtectorDataViaLogin", true);

user_pref("CT2704262.ServiceMapLastCheckTime", "Tue Jun 19 2012 16:14:26 GMT+1000");

user_pref("CT2704262.SettingsLastCheckTime", "Mon Jun 18 2012 20:00:12 GMT+1000");

user_pref("CT2704262.SettingsLastUpdate", "1339926569");

user_pref("CT2704262.TBHomePageUrl", "hxxp://search.conduit.com/?SSPV=FFOB6&ctid=CT2704262&SearchSource=13");

user_pref("CT2704262.ThirdPartyComponentsInterval", 504);

user_pref("CT2704262.ThirdPartyComponentsLastCheck", "Tue Apr 10 2012 22:51:13 GMT+1000");

user_pref("CT2704262.ThirdPartyComponentsLastUpdate", "1312887586");

user_pref("CT2704262.ToolbarShrinkedFromSetup", false);

user_pref("CT2704262.TrusteLinkUrl", "hxxp://trust.conduit.com/CT2704262");

user_pref("CT2704262.TrustedApiDomains", "conduit.com,conduit-hosting.com,conduit-services.com,client.conduit-storage.com,OurToolbar.com,CommunityToolbars.com,ForumToolbar.com

user_pref("CT2704262.UserID", "UN00167515888583602");

user_pref("CT2704262.ValidationData_Toolbar", 2);

user_pref("CT2704262.alertChannelId", "1096603");

user_pref("CT2704262.autoDisableScopes", -1);

user_pref("CT2704262.backendstorage.2704262a129531303481232105000000paramsgk0", "7B2275706461746552657154696D65223A313333343039313533343937362C227570646174655265737054696D6522

user_pref("CT2704262.backendstorage.autocompletepro_enable", "31");

user_pref("CT2704262.backendstorage.autocompletepro_enable_auto", "31");

user_pref("CT2704262.backendstorage.cbcountry_000", "4155");

user_pref("CT2704262.backendstorage.cbfirsttime", "5475652041707220313020323031322032323A35323A303220474D542B31303030");

user_pref("CT2704262.backendstorage.rss_pub_config", "7B2273657474696E6773223A7B2269636F6E223A22687474703A2F2F73746F726167652E636F6E647569742E636F6D2F36322F3237302F43543237303

user_pref("CT2704262.backendstorage.rssapp2704262a129531303481232105000000cat0", "2535422537422532327479706525323225334125323272737325323225324325323276657273696F6E25323225334

user_pref("CT2704262.backendstorage.rssapp2704262a129531303481232105000000cat1", "2535422537422532327479706525323225334125323272737325323225324325323276657273696F6E25323225334

user_pref("CT2704262.backendstorage.rssapp2704262a129531303481232105000000cat2", "2535422537422532327479706525323225334125323272737325323225324325323276657273696F6E25323225334

user_pref("CT2704262.backendstorage.rssapp2704262a129531303481232105000000cat3", "2535426E756C6C2532432537422532327479706525323225334125323272737325323225324325323276657273696

user_pref("CT2704262.backendstorage.rssapp2704262a129531303481232105000000embeddedversion", "322E352E30");

user_pref("CT2704262.backendstorage.rssapp2704262a129531303481232105000000feedsobj", "2537422532326368616E6E656C7325323225334125374225323269642532322533412532326368616E6E656C7

user_pref("CT2704262.backendstorage.rssapp2704262a129531303481232105000000lastreporttime", "3133333430393135363530313520");

user_pref("CT2704262.backendstorage.rssapp2704262a129531303481232105000000newfeeds", "6E65774665656473");

user_pref("CT2704262.backendstorage.rssapp2704262a129531303481232105000000readitemsarr", "253742253232687474702533412532462532467468656361756375732E626C6F67732E6E7974696D65732

user_pref("CT2704262.backendstorage.shoppingapp.gk.exipres", "53756E2041707220313520323031322032323A35313A353220474D542B31303030");

user_pref("CT2704262.backendstorage.shoppingapp.gk.geolocation", "6175737472616C6961");

user_pref("CT2704262.backendstorage.url_history0001", "68747470733A2F2F7777772E66616365626F6F6B2E636F6D2F426F74746C6F2E62696C6C233A3A3A636C69636B68616E646C65723A3A3A3133333430

user_pref("CT2704262.generalConfigFromLogin", "{\"ApiMaxAlerts\":\"12\",\"SocialDomains\":\"social.conduit.com;apps.conduit.com;services.apps.conduit.com\",\"AppsDetectionUrlP

user_pref("CT2704262.globalFirstTimeInfoLastCheckTime", "Tue Apr 10 2012 22:51:16 GMT+1000");

user_pref("CT2704262.homepageProtectorEnableByLogin", true);

user_pref("CT2704262.initDone", true);

user_pref("CT2704262.isAppTrackingManagerOn", true);

user_pref("CT2704262.isFirstRadioInstallation", false);

user_pref("CT2704262.myStuffEnabled", true);

user_pref("CT2704262.myStuffPublihserMinWidth", 400);

user_pref("CT2704262.myStuffSearchUrl", "hxxp://Apps.conduit.com/search?q=SEARCH_TERM&SearchSourceOrigin=29&ctid=EB_TOOLBAR_ID&octid=EB_ORIGINAL_CTID");

user_pref("CT2704262.myStuffServiceIntervalMM", 1440);

user_pref("CT2704262.myStuffServiceUrl", "hxxp://mystuff.conduit-services.com/MyStuffService.ashx?ComponentId=EB_MY_STUFF_INSTANCE_GUID&lut=EB_MY_STUFF_LUT");

user_pref("CT2704262.navigateToUrlOnSearch", false);

user_pref("CT2704262.revertSettingsEnabled", true);

user_pref("CT2704262.searchProtectorDialogDelayInSec", 10);

user_pref("CT2704262.searchProtectorEnableByLogin", true);

user_pref("CT2704262.testingCtid", "");

user_pref("CT2704262.toolbarAppMetaDataLastCheckTime", "Tue Jun 19 2012 16:14:24 GMT+1000");

user_pref("CT2704262.toolbarContextMenuLastCheckTime", "Tue Apr 10 2012 22:51:28 GMT+1000");

user_pref("CT2704262.usagesFlag", 2);

user_pref("CommunityToolbar.ETag.hxxp://Settings.toolbar.search.conduit.com/root/CT1060933/CT1060933", "\"2f7efd0688764704a81c286a7b29c59a3\"");

user_pref("CommunityToolbar.ETag.hxxp://Settings.toolbar.search.conduit.com/root/CT2704262/CT2704262", "\"1dfbd99afb69e73cd3b40315b7aa37411\"");

user_pref("CommunityToolbar.ETag.hxxp://alerts.conduit-services.com/root/1096603/1092307/AU", "\"0\"");

user_pref("CommunityToolbar.ETag.hxxp://alerts.conduit-services.com/root/15651/15317/AU", "\"0\"");

user_pref("CommunityToolbar.ETag.hxxp://appsmetadata.toolbar.conduit-services.com/?ctid=CT1060933", "\"1359609745\"");

user_pref("CommunityToolbar.ETag.hxxp://appsmetadata.toolbar.conduit-services.com/?ctid=CT2704262", "\"1329385171\"");

user_pref("CommunityToolbar.ETag.hxxp://contextmenu.toolbar.conduit-services.com/?name=GottenApps&locale=en", "m4Df43NZ+9lr21ZNdyYrjA==");

user_pref("CommunityToolbar.ETag.hxxp://contextmenu.toolbar.conduit-services.com/?name=GottenApps&locale=en-us", "wVmmvqqOMqrv5xct1cJIHg==");

user_pref("CommunityToolbar.ETag.hxxp://contextmenu.toolbar.conduit-services.com/?name=OtherApps&locale=en", "V3ke+ogt4ejn0sB1xPR3nw==");

user_pref("CommunityToolbar.ETag.hxxp://contextmenu.toolbar.conduit-services.com/?name=OtherApps&locale=en-us", "0uSPYx+Kl2jpu8sJZMeHjw==");

user_pref("CommunityToolbar.ETag.hxxp://contextmenu.toolbar.conduit-services.com/?name=SharedApps&locale=en", "ktZKgREPsk5m13TY9rsX+A==");

user_pref("CommunityToolbar.ETag.hxxp://contextmenu.toolbar.conduit-services.com/?name=SharedApps&locale=en-us", "Dclc8oo4TTv7+mAkSlUSWg==");

user_pref("CommunityToolbar.ETag.hxxp://contextmenu.toolbar.conduit-services.com/?name=Toolbar&locale=en", "9zRvKErdMb8hJOq85ft5Vg==");

user_pref("CommunityToolbar.ETag.hxxp://contextmenu.toolbar.conduit-services.com/?name=Toolbar&locale=en-us", "K4Vqu91uAzWURlxJRdXJOg==");

user_pref("CommunityToolbar.ETag.hxxp://dynamicdialogs.alert.conduit-services.com/alert/dlg.pkg", "\"80133a6b165cd1:0\"");

user_pref("CommunityToolbar.ETag.hxxp://dynamicdialogs.toolbar.conduit-services.com/DLG.pkg?ver=3.10.0.1", "\"801a319dd78ccc1:0\"");

user_pref("CommunityToolbar.ETag.hxxp://dynamicdialogs.toolbar.conduit-services.com/DLG.pkg?ver=3.10.0.455", "\"4ead38b3e6bcd1:1308\"");

user_pref("CommunityToolbar.ETag.hxxp://dynamicdialogs.toolbar.conduit-services.com/DLG.pkg?ver=3.12.2.3", "\"4ead38b3e6bcd1:0\"");

user_pref("CommunityToolbar.ETag.hxxp://dynamicdialogs.toolbar.conduit-services.com/DLG.pkg?ver=3.13.0.6", "\"0d648794549cd1:0\"");

user_pref("CommunityToolbar.ETag.hxxp://dynamicdialogs.toolbar.conduit-services.com/DLG.pkg?ver=3.14.1.0", "\"0e0a4327275cd1:0\"");

user_pref("CommunityToolbar.ETag.hxxp://dynamicdialogs.toolbar.conduit-services.com/DLG.pkg?ver=3.15.1.0", "\"0343677cfb1cd1:0\"");

user_pref("CommunityToolbar.ETag.hxxp://dynamicdialogs.toolbar.conduit-services.com/DLG.pkg?ver=3.16.0.100", "\"0343677cfb1cd1:0\"");

user_pref("CommunityToolbar.ETag.hxxp://dynamicdialogs.toolbar.conduit-services.com/DLG.pkg?ver=3.16.0.3", "\"0343677cfb1cd1:15a7\"");

user_pref("CommunityToolbar.ETag.hxxp://dynamicdialogs.toolbar.conduit-services.com/DLG.pkg?ver=3.18.0.7", "\"0343677cfb1cd1:160f\"");

user_pref("CommunityToolbar.ETag.hxxp://servicemap.conduit-services.com/Toolbar/?ownerId=CT1060933", "\"ccd90dbc0806c30e56e17c4594b38942\"");

user_pref("CommunityToolbar.ETag.hxxp://servicemap.conduit-services.com/Toolbar/?ownerId=CT2704262", "\"d76323372b05c3748a3d6b1c93a98292\"");

user_pref("CommunityToolbar.ETag.hxxp://storage.conduit.com/BankImages/RadioSkins/Cornflower/equalizer_dead.gif", "\"0678fe477ac91:0\"");

user_pref("CommunityToolbar.ETag.hxxp://storage.conduit.com/BankImages/RadioSkins/Cornflower/minimize.gif", "\"046c7ab477ac91:0\"");

user_pref("CommunityToolbar.ETag.hxxp://storage.conduit.com/BankImages/RadioSkins/Cornflower/play.gif", "\"0484de117c4c91:0\"");

user_pref("CommunityToolbar.ETag.hxxp://storage.conduit.com/BankImages/RadioSkins/Cornflower/stop.gif", "\"0e7a152347ac91:0\"");

user_pref("CommunityToolbar.ETag.hxxp://storage.conduit.com/BankImages/RadioSkins/Cornflower/vol.gif", "\"087c778347ac91:0\"");

user_pref("CommunityToolbar.ETag.hxxp://translation.toolbar.conduit-services.com/?locale=EB_LOCALE", "\"4c814df8d80717195db596ee4f301597\"");

user_pref("CommunityToolbar.ETag.hxxp://translation.toolbar.conduit-services.com/?locale=en", "\"21ba1682b5b6825cbfd420592a540476\"");

user_pref("CommunityToolbar.ETag.hxxp://translation.toolbar.conduit-services.com/?locale=en-us", "\"2236cdfe2705dc5895ad2e365bf489a6\"");

user_pref("CommunityToolbar.ETag.hxxp://twitter.com/users/show/1344951.xml", "\"06340703cadb8c5f19897c486ec4a84c\"");

user_pref("CommunityToolbar.ETag.hxxp://twitter.com/users/show/14293310.xml", "\"49d913f02077d057531654787492c8e5\"");

user_pref("CommunityToolbar.ETag.hxxp://twitter.com/users/show/16887175.xml", "\"efed6cdc2ab07bcc980eab4744f3a941\"");

user_pref("CommunityToolbar.ETag.hxxp://twitter.com/users/show/17151925.xml", "\"7ee4299f7f60fc9b1c62d6ea04af8ebe\"");

user_pref("CommunityToolbar.ETag.hxxp://twitter.com/users/show/20536157.xml", "\"de5f4a5df80a59e331fbb031b7c301c7\"");

user_pref("CommunityToolbar.ETag.hxxp://twitter.com/users/show/30261067.xml", "\"1c9e81987908fe10595529d5b338f62b\"");

user_pref("CommunityToolbar.ETag.hxxp://twitter.com/users/show/428333.xml", "\"4690df8f5613ad9f6cfc1561f1d12d4b\"");

user_pref("CommunityToolbar.ETag.hxxp://twitter.com/users/show/816653.xml", "\"3ffd558e3194a7faa249c6316a858bad\"");

user_pref("CommunityToolbar.LatestLibsPath", "file:///C:\\Documents and Settings\\Mr. Bojangles\\Application Data\\Mozilla\\Firefox\\Profiles\\64w0fp13.default\\conduitCommon\

user_pref("CommunityToolbar.LatestToolbarVersionInstalled", "3.10.0.455");

user_pref("CommunityToolbar.SearchFromAddressBarSavedUrl", "hxxp://search.mywebsearch.com/mywebsearch/GGmain.jhtml?id=ZUfox000&ptb=AL3MCd9NKxyFF0mu4ItXjw&psa=&ind=2010040916&p

user_pref("CommunityToolbar.ToolbarsList", "CT1060933,CT2704262");

user_pref("CommunityToolbar.ToolbarsList2", "CT1060933,CT2704262");

user_pref("CommunityToolbar.ToolbarsList4", "CT1060933,CT2704262");

user_pref("CommunityToolbar.globalUserId", "caad3710-a6c3-4e74-8a2c-c3b9647f7a8e");

user_pref("CommunityToolbar.isAlertUrlAddedToFeedItemTable", true);

user_pref("CommunityToolbar.isClickActionAddedToFeedItemTable", true);

user_pref("CommunityToolbar.keywordURLSelectedCTID", "CT2704262");

user_pref("CommunityToolbar.notifications.alertDialogsGetterLastCheckTime", "Tue Apr 10 2012 22:51:16 GMT+1000");

user_pref("CommunityToolbar.notifications.alertInfoInterval", 1440);

user_pref("CommunityToolbar.notifications.alertInfoLastCheckTime", "Tue Apr 10 2012 23:51:39 GMT+1000");

user_pref("CommunityToolbar.notifications.clientsServerUrl", "hxxp://alert.client.conduit.com");

user_pref("CommunityToolbar.notifications.locale", "en");

user_pref("CommunityToolbar.notifications.loginIntervalMin", 1440);

user_pref("CommunityToolbar.notifications.loginLastCheckTime", "Tue Apr 10 2012 22:51:14 GMT+1000");

user_pref("CommunityToolbar.notifications.loginLastUpdateTime", "1313487611");

user_pref("CommunityToolbar.notifications.messageShowTimeSec", 20);

user_pref("CommunityToolbar.notifications.servicesServerUrl", "hxxp://alert.services.conduit.com");

user_pref("CommunityToolbar.notifications.showTrayIcon", false);

user_pref("CommunityToolbar.notifications.userCloseIntervalMin", 300);

user_pref("CommunityToolbar.notifications.userId", "defff216-ca26-4934-af37-01bd17c5df8f");

user_pref("CommunityToolbar.originalHomepage", "www.google.com");

user_pref("CommunityToolbar.originalSearchEngine", "chrome://browser-region/locale/region.properties");

user_pref("CommunityToolbar.twitter.user_1344951.LastCheckTime", "Wed Apr 11 2012 06:58:56 GMT+1000");

user_pref("CommunityToolbar.twitter.user_14293310.LastCheckTime", "Wed Apr 11 2012 06:58:56 GMT+1000");

user_pref("CommunityToolbar.twitter.user_16887175.LastCheckTime", "Wed Apr 11 2012 06:58:56 GMT+1000");

user_pref("CommunityToolbar.twitter.user_17151925.LastCheckTime", "Wed Apr 11 2012 06:58:56 GMT+1000");

user_pref("CommunityToolbar.twitter.user_20536157.LastCheckTime", "Wed Apr 11 2012 06:58:56 GMT+1000");

user_pref("CommunityToolbar.twitter.user_30261067.LastCheckTime", "Wed Apr 11 2012 06:58:56 GMT+1000");

user_pref("CommunityToolbar.twitter.user_428333.LastCheckTime", "Wed Apr 11 2012 06:58:56 GMT+1000");

user_pref("CommunityToolbar.twitter.user_816653.LastCheckTime", "Wed Apr 11 2012 06:58:56 GMT+1000");

user_pref("extensions.enabledItems", "jqs@sun.com:1.0,toolbar@ask.com:3.5.2.106,{972ce4c6-7e08-4474-a285-3208198ce6fd}:3.6.17");

user_pref("extensions.mywebsearch.openSearchURL", "hxxp://search.mywebsearch.com/mywebsearch/opensearch.jhtml?id=ZUfox000&ptb=AL3MCd9NKxyFF0mu4ItXjw&ind=2010040916&osp=mws&ptn

user_pref("extensions.mywebsearch.prevKwdEnabled", true);

user_pref("extensions.mywebsearch.prevKwdURL", "chrome://browser-region/locale/region.properties");

user_pref("keyword.URL", "hxxp://search.mywebsearch.com/mywebsearch/GGmain.jhtml?id=ZUfox000&ptb=AL3MCd9NKxyFF0mu4ItXjw&psa=&ind=2010040916&ptnrS=ZUfox000&si=&st=kwd&n=77ceca5

Emptied folder: C:\Documents and Settings\Mr. Bojangles\Application Data\mozilla\firefox\profiles\64w0fp13.default\minidumps [4 files]

~~~ Chrome

Successfully deleted: [Folder] C:\Documents and Settings\Mr. Bojangles\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\pmlghpafmmnmmkjdhacccolfgnkiboco

Successfully deleted: [Registry Key] hkey_local_machine\software\google\chrome\extensions\pmlghpafmmnmmkjdhacccolfgnkiboco

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Scan was completed on Sun 02/24/2013 at 22:25:50.91

End of JRT log

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

#MBAM

Malwarebytes' Anti-Malware 1.41

Database version: 2866

Windows 5.1.2600 Service Pack 3

9/28/2009 6:02:51 PM

mbam-log-2009-09-28 (18-02-51).txt

Scan type: Full Scan (C:\|)

Objects scanned: 67967

Time elapsed: 21 minute(s), 35 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 0

Registry Values Infected: 0

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 0

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

(No malicious items detected)

Registry Values Infected:

(No malicious items detected)

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

(No malicious items detected)

Files Infected:

(No malicious items detected)

#DDS

DDS (Ver_2012-11-20.01) - NTFS_x86

Internet Explorer: 7.0.6000.16762

Run by Mr. Bojangles at 15:45:19 on 2013-02-25

.

============== Running Processes ================

.

C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe

C:\Program Files\Symantec Client Security\Symantec Client Firewall\ISSVC.exe

C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe

C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\system32\IPSSVC.EXE

C:\Program Files\Microsoft Small Business\Business Contact Manager\BcmSqlStartupSvc.exe

C:\Program Files\Symantec Client Security\Symantec AntiVirus\DefWatch.exe

C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe

C:\Program Files\D-Link\DWA-525 revA\ANIWConnService.exe

C:\Program Files\Java\jre6\bin\jqs.exe

C:\WINDOWS\system32\netdde.exe

C:\Program Files\Google\Update\1.3.21.135\GoogleCrashHandler.exe

C:\Program Files\Common Files\Native Instruments\Hardware\NIHardwareService.exe

C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe

c:\Program Files\Microsoft SQL Server\90\Shared\sqlbrowser.exe

c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe

c:\program files\lenovo\system update\suservice.exe

C:\Program Files\Symantec Client Security\Symantec AntiVirus\Rtvscan.exe

C:\Program Files\Symantec Client Security\Symantec Client Firewall\SymSPort.exe

C:\Program Files\Common Files\Lenovo\tvt_reg_monitor_svc.exe

C:\Program Files\Lenovo\Rescue and Recovery\rrservice.exe

C:\Program Files\Common Files\Lenovo\Scheduler\tvtsched.exe

C:\Program Files\Lenovo\Rescue and Recovery\ADM\IUService.exe

c:\Program Files\Zune\WMZuneComm.exe

c:\Program Files\Zune\ZuneBusEnum.exe

C:\Program Files\Common Files\Lenovo\Logger\logmon.exe

c:\Program Files\Zune\ZuneNss.exe

c:\Program Files\Zune\ZuneWlanCfgSvc.exe

C:\Program Files\Windows Media Player\wmpnetwk.exe

C:\Program Files\Lenovo\Client Security Solution\cssauth.exe

C:\Program Files\Diskeeper Corporation\Diskeeper\DkIcon.exe

C:\Program Files\Lenovo\Client Security Solution\tvtpwm_tray.exe

C:\Program Files\Common Files\Lenovo\Scheduler\scheduler_proxy.exe

C:\Program Files\D-Link\DWA-525 revA\AirNCFG.exe

C:\Program Files\D-Link\DWA-525 revA\WZCSLDR2.exe

C:\WINDOWS\system32\M-AudioTaskBarIcon.exe

C:\WINDOWS\system32\ICO.EXE

C:\WINDOWS\system32\FSRremoS.EXE

C:\WINDOWS\system32\ctfmon.exe

C:\WINDOWS\system32\Pelmiced.exe

C:\Program Files\McAfee Security Scan\3.0.318\SSScheduler.exe

C:\WINDOWS\system32\taskkill.exe

C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

C:\Program Files\Common Files\Adobe\OOBE\PDApp\UWA\AAM Updates Notifier.exe

C:\Program Files\uTorrent\uTorrent.exe

C:\WINDOWS\explorer.exe

C:\Program Files\Mozilla Firefox\firefox.exe

C:\Program Files\Mozilla Firefox\plugin-container.exe

C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe

C:\WINDOWS\System32\svchost.exe -k netsvcs

C:\WINDOWS\system32\svchost.exe -k WudfServiceGroup

C:\WINDOWS\system32\svchost.exe -k NetworkService

C:\WINDOWS\system32\svchost.exe -k LocalService

C:\WINDOWS\System32\svchost.exe -k HTTPFilter

C:\WINDOWS\system32\svchost.exe -k imgsvc

.

============== Pseudo HJT Report ===============

.

uStart Page = hxxp://www.google.com/

uInternet Connection Wizard,ShellNext = iexplore

uURLSearchHooks: TVersitybar Toolbar: {66bd2442-241b-44cd-8c7a-b51037053cdb} -

BHO: MSS+ Identifier: {0E8A89AD-95D7-40EB-8D9D-083EF7066A01} - c:\program files\mcafee security scan\3.0.318\McAfeeMSS_IE.dll

BHO: Adobe PDF Link Helper: {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll

BHO: {5C255C8A-E604-49b4-9D64-90988571CECB} - <orphaned>

BHO: DriveLetterAccess: {5CA3D70E-1895-11CF-8E15-001234567890} - c:\windows\system32\dla\DLASHX_W.DLL

BHO: Search Helper: {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - c:\program files\microsoft\search enhancement pack\search helper\SearchHelper.dll

BHO: Java Plug-In SSV Helper: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - c:\program files\java\jre6\bin\ssv.dll

BHO: Java Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - c:\program files\java\jre6\bin\jp2ssv.dll

BHO: CPwmIEBrowserHelper Object: {F040E541-A427-4CF7-85D8-75E3E0F476C5} - c:\program files\lenovo\client security solution\tvtpwm_ie_com.dll

uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe

uRun: [Facebook Update] "c:\documents and settings\mr. bojangles\local settings\application data\facebook\update\FacebookUpdate.exe" /c /nocrashserver

mRun: [igfxTray] c:\windows\system32\igfxtray.exe

mRun: [TVT Scheduler Proxy] c:\program files\common files\lenovo\scheduler\scheduler_proxy.exe

mRun: [Zune Launcher] "c:\program files\zune\ZuneLauncher.exe"

mRun: [D-Link D-Link DWA-525] c:\program files\d-link\dwa-525 reva\AirNCFG.exe

mRun: [WZCSLDR2] c:\program files\d-link\dwa-525 reva\WZCSLDR2.exe

mRun: [M-Audio Taskbar Icon] c:\windows\system32\M-AudioTaskBarIcon.exe

mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe"

mRun: [Mouse Suite 98 Daemon] ICO.EXE

mRun: [Ad-Aware Browsing Protection] "c:\documents and settings\all users\application data\ad-aware browsing protection\adawarebp.exe"

mRun: [APSDaemon] "c:\program files\common files\apple\apple application support\APSDaemon.exe"

mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"

mRunOnce: [myfavoritegadgets] <no file>

StartupFolder: c:\docume~1\mr6e0d~1.boj\startm~1\programs\startup\dropbox.lnk - c:\documents and settings\mr. bojangles\application data\dropbox\bin\Dropbox.exe

StartupFolder: c:\documents and settings\mr. bojangles\start menu\programs\startup\startup concealer outlook.vbs

StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\mcafee~1.lnk - c:\program files\mcafee security scan\3.0.318\SSScheduler.exe

uPolicies-Explorer: NoDriveTypeAutoRun = dword:145

mPolicies-Windows\System: Allow-LogonScript-NetbiosDisabled = dword:1

mPolicies-Explorer: NoDriveTypeAutoRun = dword:145

IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200

IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office12\EXCEL.EXE/3000

IE: Set As Messenger Live Display Picture - c:\program files\msnshell\bin\SetMSNDP.htm

IE: {0045D4BC-5189-4b67-969C-83BB1906C421} - {0FE81B52-73FA-425F-8F06-3F32451AC73F} - c:\program files\lenovo\client security solution\tvtpwm_ie_com.dll

IE: {3AD14F0C-ED16-4e43-B6D8-661B03F6A1EF} - c:\program files\pokerstars\PokerStarsUpdate.exe

IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503}

IE: {DA320635-F48C-4613-8325-D75A933C549E} - c:\program files\lenovo\system update\sulauncher.exe

IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe

IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe

.

INFO: HKCU has more than 50 listed domains.

If you wish to scan all of them, select the 'Force scan all domains' option.

.

INFO: HKLM has more than 50 listed domains.

If you wish to scan all of them, select the 'Force scan all domains' option.

.

DPF: {CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_06-windows-i586.cab

DPF: {CAFEEFAC-0016-0000-0006-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_06-windows-i586.cab

DPF: {CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_11-windows-i586.cab

DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_11-windows-i586.cab

DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab

TCP: NameServer = 192.168.1.1

TCP: Interfaces\{1C678FE9-385F-4BBE-849C-DA5C69BC931D} : DHCPNameServer = 192.168.1.1

Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\program files\common files\skype\Skype4COM.dll

Notify: AwayNotify - c:\program files\lenovo\awaytask\AwayNotify.dll

Notify: igfxcui - igfxdev.dll

Notify: NavLogon - c:\windows\system32\NavLogon.dll

SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll

mASetup: {8A69D345-D564-463c-AFF1-A69D9E530F96} - "c:\program files\google\chrome\application\25.0.1364.97\installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --multi-install --chrome

Hosts: 127.0.0.1 www.spywareinfo.com

.

============= SERVICES / DRIVERS ===============

.

=============== Created Last 30 ================

.

2013-02-24 12:43:51 40776 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys

2013-02-24 12:14:12 -------- d-----w- c:\windows\ERUNT

2013-02-24 12:13:57 -------- d-----w- C:\JRT

2013-02-08 07:10:46 16365936 ----a-w- c:\windows\system32\FlashPlayerInstaller.exe

2013-01-29 12:04:02 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware

.

==================== Find3M ====================

.

2013-02-24 12:21:09 71024 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl

2013-02-24 12:21:09 691568 ----a-w- c:\windows\system32\FlashPlayerApp.exe

2013-02-23 14:00:03 5427 ----a-w- c:\windows\system32\EGATHDRV.SYS

2012-12-14 06:49:28 21104 ----a-w- c:\windows\system32\drivers\mbam.sys

.

============= FINISH: 15:51:19.08 ===============

gringo_pr · March 2, 2013

Hello Mr. Bojangles

Welcome to The Forums!!

Around here they call me Gringo and I'll be glad to help you with your malware problems.

Very Important --> Please read this post completely, I have spent my time to put together somethings for you to keep in mind while I am helping you to make things go easier, faster and smoother for both of us!

Please do not run any tools unless instructed to do so.
- We ask you to run different tools in a specific order to ensure the malware is completely removed from your machine, and running any additional tools may detect false positives, interfere with our tools, or cause unforeseen damage or system instability.
[*]Please do not attach logs or use code boxes, just copy and paste the text.
- Due to the high volume of logs we receive it helps to receive everything in the same format, and code boxes make the logs very difficult to read. Also, attachments require us to download and open the reports when it is easier to just read the reports in your post.
[*]Please read every post completely before doing anything.
- Pay special attention to the NOTE: lines, these entries identify an individual issue or important step in the cleanup process.
[*]Please provide feedback about your experience as we go.
- A short statement describing how the computer is working helps us understand where to go next, for example: I am still getting redirected, the computer is running normally, etc. Please do not describe the computer as "the same", this requires the extra step of looking back at your previous post.

NOTE: At the top of your post, click on the "Follow This Topic" Button, make sure that the "Receive notification" box is checked and that it is set to "Instantly" - This will send you an e-mail as soon as I reply to your topic, allowing us to resolve the issue faster.

NOTE: Backup any files that cannot be replaced. Removing malware can be unpredictable and this step can save a lot of heartaches if things don't go as planed. You can put them on a CD/DVD, external drive or a pen drive, anywhere except on the computer.

NOTE: It is good practice to copy and paste the instructions into notepad and print them in case it is necessary for you to go offline during the cleanup process. To open notepad, navigate to Start Menu > All Programs > Accessories > Notepad. Please remember to copy the entire post so you do not miss any instructions.

These are the programs I would like you to run next, if you have any problems with these just skip it and run the next one.

-Security Check-

Download Security Check by screen317 from

here.

Save it to your Desktop.
Double click SecurityCheck.exe and follow the onscreen instructions inside of the black box.
A Notepad document should open automatically called checkup.txt; please post the contents of that document.

-AdwCleaner-

Please download

AdwCleaner by Xplode onto your desktop.

Close all open programs and internet browsers.
Double click on AdwCleaner.exe to run the tool.
Click on Delete.
Confirm each time with Ok.
Your computer will be rebooted automatically. A text file will open after the restart.
Please post the content of that logfile with your next answer.
You can find the logfile at C:\AdwCleaner[s1].txt as well.

--RogueKiller--

Download & SAVE to your Desktop RogueKiller or from here
- Quit all programs that you may have started.
- Please disconnect any USB or external drives from the computer before you run this scan!
- For Vista or Windows 7, right-click and select "Run as Administrator to start"
- For Windows XP, double-click to start.
- Wait until Prescan has finished ...
- Then Click on "Scan" button
- Wait until the Status box shows "Scan Finished"
- click on "delete"
- Wait until the Status box shows "Deleting Finished"
- Click on "Report" and copy/paste the content of the Notepad into your next reply.
- The log should be found in RKreport[1].txt on your Desktop
- Exit/Close RogueKiller+

Gringo

gringo_pr · March 5, 2013

Hello

48 Hour bump

It has been more than 48 hours since my last post.

do you still need help with this?
do you need more time?
are you having problems following my instructions?
if after 48hrs you have not replied to this thread then it will have to be closed!

Gringo

Mr. Bojangles · March 8, 2013

Here are the results from the scans

Results of screen317's Security Check version 0.99.60

Windows XP Service Pack 3 x86

Internet Explorer 7 Out of date!

``````````````Antivirus/Firewall Check:``````````````

Windows Security Center service is not running! This report may not be accurate!

Please wait while WMIC is being installed.

WMI entry may not exist for antivirus; attempting automatic update.

`````````Anti-malware/Other Utilities Check:`````````

Ad-Aware

MVPS Hosts File

Spybot - Search & Destroy

Malwarebytes Anti-Malware version 1.70.0.1100

Java 6 Update 11

Java 6 Update 6

Java version out of Date!

Adobe Flash Player 11.6.602.171

Adobe Reader 10.1.6 Adobe Reader out of Date!

Mozilla Firefox (19.0.2)

Google Chrome 25.0.1364.152

Google Chrome 25.0.1364.97

````````Process Check: objlist.exe by Laurent````````

Ad-Aware AAWService.exe is disabled!

Ad-Aware AAWTray.exe is disabled!

`````````````````System Health check`````````````````

Total Fragmentation on Drive C:: 18% Defragment your hard drive soon! (Do NOT defrag if SSD!)

````````````````````End of Log``````````````````````

RogueKiller V8.5.2 [Feb 23 2013] by Tigzy

mail : tigzyRK<at>gmail<dot>com

Feedback : http://www.geekstogo.com/forum/files/file/413-roguekiller/

Website : http://tigzy.geekstogo.com/roguekiller.php

Blog : http://tigzyrk.blogspot.com/

Operating System : Windows XP (5.1.2600 Service Pack 3) 32 bits version

Started in : Normal mode

User : Mr. Bojangles [Admin rights]

Mode : Scan -- Date : 03/09/2013 02:39:19

| ARK || FAK || MBR |

¤¤¤ Bad processes : 0 ¤¤¤

¤¤¤ Registry Entries : 3 ¤¤¤

[HJPOL] HKCU\[...]\System : DisableTaskMgr (0) -> FOUND

[HJPOL] HKCU\[...]\System : DisableRegistryTools (0) -> FOUND

[HJ DESK] HKLM\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> FOUND

¤¤¤ Particular Files / Folders: ¤¤¤

¤¤¤ Driver : [LOADED] ¤¤¤

SSDT[31] : NtConnectPort @ 0x805A45B4 -> HOOKED (Unknown @ 0x8A445E28)

¤¤¤ HOSTS File: ¤¤¤

--> C:\WINDOWS\system32\drivers\etc\hosts

127.0.0.1 localhost

127.0.0.1 www.007guard.com

127.0.0.1 007guard.com

127.0.0.1 008i.com

127.0.0.1 www.008k.com

127.0.0.1 008k.com

127.0.0.1 www.00hq.com

127.0.0.1 00hq.com

127.0.0.1 010402.com

127.0.0.1 www.032439.com

127.0.0.1 032439.com

127.0.0.1 www.0scan.com

127.0.0.1 0scan.com

127.0.0.1 1000gratisproben.com

127.0.0.1 www.1000gratisproben.com

127.0.0.1 1001namen.com

127.0.0.1 www.1001namen.com

127.0.0.1 100888290cs.com

127.0.0.1 www.100888290cs.com

127.0.0.1 www.100sexlinks.com

[...]

¤¤¤ MBR Check: ¤¤¤

+++++ PhysicalDrive0: +++++

--- User ---

[MBR] 5e6f13bc4d3da5934cfc9f3304d98a65

[bSP] e5b474159f46c3737748d986e9839ab8 : MBR Code unknown

Partition table:

0 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 63 | Size: 146334 Mo

1 - [XXXXXX] COMPAQ (0x12) [VISIBLE] Offset (sectors): 299692575 | Size: 6291 Mo

User = LL1 ... OK!

User = LL2 ... OK!

Finished : << RKreport[1]_S_03092013_02d0239.txt >>

RKreport[1]_S_03092013_02d0239.txt

# AdwCleaner v2.114 - Logfile created 03/09/2013 at 02:28:39

# Updated 05/03/2013 by Xplode

# Operating system : Microsoft Windows XP Service Pack 3 (32 bits)

# User : Mr. Bojangles - MRBOJANGLES

# Boot Mode : Normal

# Running from : C:\Documents and Settings\Mr. Bojangles\My Documents\Downloads\adwcleaner.exe

# Option [Delete]

***** [services] *****

***** [Files / Folders] *****

Folder Deleted : C:\Documents and Settings\All Users\Application Data\AVG Security Toolbar

Folder Deleted : C:\Documents and Settings\All Users\Start Menu\Programs\Freecorder

Folder Deleted : C:\Documents and Settings\Mr. Bojangles\Application Data\Mozilla\Firefox\Profiles\64w0fp13.default\adawaretb

Folder Deleted : C:\Documents and Settings\Mr. Bojangles\Application Data\Mozilla\Firefox\Profiles\64w0fp13.default\jetpack

Folder Deleted : C:\Documents and Settings\Mr. Bojangles\Local Settings\Application Data\APN

Folder Deleted : C:\Documents and Settings\Mr. Bojangles\Start Menu\Programs\Freecorder

Folder Deleted : C:\Documents and Settings\NetworkService\Local Settings\Application Data\Freecorder

Folder Deleted : C:\Documents and Settings\NetworkService\Local Settings\Application Data\TVersitybar

Folder Deleted : C:\Program Files\1ClickDownload

***** [Registry] *****

Key Deleted : HKCU\Software\Ask&Record

Key Deleted : HKCU\Software\ConduitSearchScopes

Key Deleted : HKCU\Software\Freecorder

Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\{79A765E1-C399-405B-85AF-466F52E918B0}

Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{1392B8D2-5C05-419F-A8F6-B9F15A596612}

Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{66BD2442-241B-44CD-8C7A-B51037053CDB}

Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{6C97A91E-4524-4019-86AF-2AA2D567BF5C}

Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{9E92257F-3F0A-451D-B231-6E2DB60CDC71}

Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{D4027C7F-154A-4066-A1AD-4243D8127440}

Key Deleted : HKCU\Software\TVersitybar

Key Deleted : HKLM\SOFTWARE\Classes\AppID\{5B1881D1-D9C7-46DF-B041-1E593282C7D0}

Key Deleted : HKLM\SOFTWARE\Classes\AppID\{608D3067-77E8-463D-9084-908966806826}

Key Deleted : HKLM\SOFTWARE\Classes\AppID\{BDB69379-802F-4EAF-B541-F8DE92DD98DB}

Key Deleted : HKLM\SOFTWARE\Classes\AppID\{EA28B360-05E0-4F93-8150-02891F1D8D3C}

Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{66BD2442-241B-44CD-8C7A-B51037053CDB}

Key Deleted : HKLM\Software\Freecorder

Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{156267B6-9225-4A9D-9473-2C89D1AE31B9}

Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{C07E1777-905F-4B13-82E4-2B689C3A641F}

Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{C7E903FB-D2FD-4042-85E5-EFFC4F056FEA}

Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{CBE965BB-07A3-4927-A0D8-9C32BC3EB4B9}

Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Management\ARPCache\1ClickDownload

Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Management\ARPCache\conduitEngine

Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Management\ARPCache\TVersitybar Toolbar

Key Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\063A857434EDED11A893800002C0A966

Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{889DF117-14D1-44EE-9F31-C5FB5D47F68B}

Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\1ClickDownload

Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\TVersitybar Toolbar

Key Deleted : HKLM\Software\TVersitybar

Value Deleted : HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks [{66BD2442-241B-44CD-8C7A-B51037053CDB}]

***** [internet Browsers] *****

-\\ Internet Explorer v7.0.6000.16762

[OK] Registry is clean.

-\\ Mozilla Firefox v19.0.2 (en-US)

File : C:\Documents and Settings\Mr. Bojangles\Application Data\Mozilla\Firefox\Profiles\64w0fp13.default\prefs.js

[OK] File is clean.

-\\ Google Chrome v25.0.1364.152

File : C:\Documents and Settings\Mr. Bojangles\Local Settings\Application Data\Google\Chrome\User Data\Default\Preferences

[OK] File is clean.

*************************

AdwCleaner[s1].txt - [4475 octets] - [09/03/2013 02:28:39]

########## EOF - C:\AdwCleaner[s1].txt - [4535 octets] ##########

gringo_pr · March 8, 2013

Hello Mr. Bojangles

I Would like you to do the following.

Please print out or make a copy in notepad of any instructions given, as sometimes it is necessary to go offline and you will lose access to them.

Run Combofix:

You may be asked to install or update the Recovery Console (Win XP Only) if this happens please allow it to do so (you will need to be connected to the internet for this)

Before you run Combofix I will need you to turn off any security software you have running, If you do not know how to do this you can find out >here< or >here<

Combofix may need to reboot your computer more than once to do its job this is normal.

You can download Combofix from one of these links. I want you to save it to the desktop and run it from there.

Link 1
Link 2
Link 3

1. Close any open browsers or any other programs that are open.

2. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

Double click on combofix.exe & follow the prompts.

When finished, it will produce a report for you.

Note 1: Do not mouseclick combofix's window while it's running. That may cause it to stall

Note 2: If you receive an error "Illegal operation attempted on a registry key that has been marked for deletion." Please restart the computer

"information and logs"

In your next post I need the following
Log from Combofix
let me know of any problems you may have had
How is the computer doing now?

Gringo

Mr. Bojangles · March 8, 2013

Thanks Gringo,

I had no problems executing your instructions. combofix ran without a hitch here is the log file:

ComboFix 13-03-07.03 - Mr. Bojangles 03/09/2013 3:39.1.2 - x86

Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2038.1411 [GMT 10:00]

Running from: c:\documents and settings\Mr. Bojangles\My Documents\Downloads\ComboFix.exe

* Created a new restore point

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\documents and settings\All Users\Application Data\TEMP

c:\windows\system32\SET20.tmp

c:\windows\system32\SET6F.tmp

c:\windows\system32\SET74.tmp

c:\windows\system32\SET7B.tmp

c:\windows\system32\SETBF.tmp

c:\windows\system32\SETC2.tmp

c:\windows\system32\SETCB.tmp

c:\windows\system32\SETCF.tmp

c:\windows\system32\SETD0.tmp

c:\windows\system32\SETD1.tmp

c:\windows\system32\SETD4.tmp

c:\windows\system32\URTTemp

c:\windows\system32\URTTemp\fusion.dll

c:\windows\system32\URTTemp\mscoree.dll

c:\windows\system32\URTTemp\mscoree.dll.local

c:\windows\system32\URTTemp\mscorsn.dll

c:\windows\system32\URTTemp\mscorwks.dll

c:\windows\system32\URTTemp\msvcr71.dll

c:\windows\system32\URTTemp\regtlib.exe

.

((((((((((((((((((((((((( Files Created from 2013-02-08 to 2013-03-08 )))))))))))))))))))))))))))))))

.

2013-02-25 13:58 . 2013-02-25 14:06 -------- d-----w- c:\documents and settings\Mr. Bojangles\Local Settings\Application Data\adawarebp

2013-02-24 12:14 . 2013-02-24 12:14 -------- d-----w- c:\windows\ERUNT

2013-02-24 12:13 . 2013-02-24 12:13 -------- d-----w- C:\JRT

2013-02-15 22:31 . 2013-02-15 22:31 186432 ----a-w- c:\program files\Internet Explorer\PLUGINS\nppdf32.dll

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2013-03-02 14:00 . 2009-01-08 04:47 5427 ----a-w- c:\windows\system32\EGATHDRV.SYS

2013-02-27 12:13 . 2012-04-22 06:25 691568 ----a-w- c:\windows\system32\FlashPlayerApp.exe

2013-02-27 12:13 . 2011-05-29 09:02 71024 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl

2012-12-14 06:49 . 2009-09-23 08:38 21104 ----a-w- c:\windows\system32\drivers\mbam.sys

2009-09-25 16:41 . 2013-03-08 05:46 1044480 ----a-w- c:\program files\mozilla firefox\plugins\libdivx.dll

2009-09-25 16:41 . 2013-03-08 05:46 200704 ----a-w- c:\program files\mozilla firefox\plugins\ssldivx.dll

2013-03-08 05:46 . 2013-03-08 05:46 263064 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll

.

------- Sigcheck -------

Note: Unsigned files aren't necessarily malware.

.

[-] 2010-05-04 . F247F7AC6713066D4C71721BDC73FC2E . 3600384 . . [7.00.6000.17063] . . c:\windows\SoftwareDistribution\Download\da350b0b03b15d30eb758fde8c0df67a\sp3gdr\mshtml.dll

[-] 2010-05-04 . C466BDCDFAE6F6EFD618F34BA90B1923 . 3603456 . . [7.00.6000.21264] . . c:\windows\SoftwareDistribution\Download\da350b0b03b15d30eb758fde8c0df67a\sp3qfe\mshtml.dll

[-] 2010-03-11 . 94359CD5BB6AC1CC08088F4A4091FF1E . 3599872 . . [7.00.6000.17023] . . c:\windows\SoftwareDistribution\Download\fd907694b9730bf0b6b92a6dbc2f96ef\sp3gdr\mshtml.dll

[-] 2010-03-11 . 9289EBB759293A1381AB0C326A115AEC . 3602944 . . [7.00.6000.21228] . . c:\windows\SoftwareDistribution\Download\fd907694b9730bf0b6b92a6dbc2f96ef\sp3qfe\mshtml.dll

[7] 2010-01-05 . 1673677DBD70142DB1294F1B6FC3323E . 3602944 . . [7.00.6000.21183] . . c:\windows\$hf_mig$\KB978207-IE7\SP3QFE\mshtml.dll

[7] 2009-07-19 . F25D866DD486AD30E05E5596CB363C3E . 5938176 . . [8.00.6001.22902] . . c:\windows\$hf_mig$\KB972260-IE8\SP3QFE\mshtml.dll

[7] 2009-05-13 . EEAADAA744B20E68CF5EB4FBB4F8AFA9 . 5936128 . . [8.00.6001.18783] . . c:\windows\ie8updates\KB972260-IE8\mshtml.dll

[7] 2009-05-13 . EEAADAA744B20E68CF5EB4FBB4F8AFA9 . 5936128 . . [8.00.6001.18783] . . c:\windows\SoftwareDistribution\Download\97fe76a20161cb86e78057600e7c82a0\SP3GDR\mshtml.dll

[7] 2009-05-13 . 1290E417BF806185CC7B2845E78A104E . 5936128 . . [8.00.6001.22873] . . c:\windows\$hf_mig$\KB969897-IE8\SP3QFE\mshtml.dll

[7] 2009-05-13 . 1290E417BF806185CC7B2845E78A104E . 5936128 . . [8.00.6001.22873] . . c:\windows\SoftwareDistribution\Download\97fe76a20161cb86e78057600e7c82a0\SP3QFE\mshtml.dll

[7] 2009-04-29 . 2B4315EC9E3124408A2A5074C4B97700 . 3596288 . . [7.00.6000.16850] . . c:\windows\ie8\mshtml.dll

[7] 2009-04-29 . C6FD770D518FB024245A0EE217D72BC1 . 3598336 . . [7.00.6000.21045] . . c:\windows\$hf_mig$\KB969897-IE7\SP3QFE\mshtml.dll

[7] 2009-03-07 . D469A0EBA2EF5C6BEE8065B7E3196E5E . 5937152 . . [8.00.6001.18702] . . c:\windows\ie8updates\KB969897-IE8\mshtml.dll

[7] 2009-02-21 . 1BB754AB47B327DE8DBF2FA18C36357C . 3596800 . . [7.00.6000.21015] . . c:\windows\$hf_mig$\KB963027-IE7\SP3QFE\mshtml.dll

[7] 2009-02-20 . C7C3E41CC2F6EB4A629FE2184136C098 . 3595264 . . [7.00.6000.16825] . . c:\windows\ie7updates\KB969897-IE7\mshtml.dll

[7] 2009-01-16 . CC9D001B7370B292C35B366CA05B12B4 . 3596288 . . [7.00.6000.20996] . . c:\windows\$hf_mig$\KB961260-IE7\SP2QFE\mshtml.dll

[7] 2009-01-16 . 3B413267DA8AE71C20E5EF3E54F74728 . 3594752 . . [7.00.6000.16809] . . c:\windows\ie7updates\KB963027-IE7\mshtml.dll

[-] 2008-12-13 . 513D14B789343F7C4150C0568E252D0B . 3866112 . . [7.00.6000.16788] . . c:\windows\ie7updates\KB961260-IE7\mshtml.dll

[-] 2008-12-13 . 513D14B789343F7C4150C0568E252D0B . 3866112 . . [7.00.6000.16788] . . c:\windows\ie7updates\KB978207-IE7\mshtml.dll

[-] 2008-12-13 . 513D14B789343F7C4150C0568E252D0B . 3866112 . . [7.00.6000.16788] . . c:\windows\ServicePackFiles\i386\mshtml.dll

[-] 2008-12-13 . 513D14B789343F7C4150C0568E252D0B . 3866112 . . [7.00.6000.16788] . . c:\windows\system32\mshtml.dll

[-] 2008-12-13 . 513D14B789343F7C4150C0568E252D0B . 3866112 . . [7.00.6000.16788] . . c:\windows\system32\dllcache\mshtml.dll

[7] 2008-12-13 . C79FAD61CD4A26ED5AA8C16D991C6FBD . 3594752 . . [7.00.6000.20973] . . c:\windows\$hf_mig$\KB960714-IE7\SP2QFE\mshtml.dll

[7] 2008-10-16 . B74F31A4BD83797D7A083F922169287D . 3595264 . . [7.00.6000.20935] . . c:\windows\$hf_mig$\KB958215-IE7\SP2QFE\mshtml.dll

[7] 2008-04-14 . A706E122B398FE1AB85CB9B75D044223 . 3066880 . . [6.00.2900.5512] . . c:\windows\SoftwareDistribution\Download\79123dd72d0f61d4ed8c7a816ed338d7\mshtml.dll

[7] 2006-11-08 . CBF04597F9CF7739E572276A2698FDD3 . 3577856 . . [7.00.5730.11] . . c:\windows\ie7updates\KB960714-IE7\mshtml.dll

[-] 2006-02-01 . 51C91AC189321A320FC4BC90B56255A3 . 3073024 . . [6.00.2900.2838] . . c:\windows\ie7\mshtml.dll

.

[-] 2010-05-04 . 83306356DE710DA87ED91A6AF6233214 . 832512 . . [7.00.6000.17055] . . c:\windows\SoftwareDistribution\Download\da350b0b03b15d30eb758fde8c0df67a\sp3gdr\wininet.dll

[-] 2010-05-04 . 506B3DCB9C26070072E3047C6910F844 . 841216 . . [7.00.6000.21256] . . c:\windows\SoftwareDistribution\Download\da350b0b03b15d30eb758fde8c0df67a\sp3qfe\wininet.dll

[-] 2010-03-11 . B6AB2EB1DA4BB29079B84AC842520670 . 832512 . . [7.00.6000.17023] . . c:\windows\SoftwareDistribution\Download\fd907694b9730bf0b6b92a6dbc2f96ef\sp3gdr\wininet.dll

[-] 2010-03-11 . 7F6A9D2F3CAA7780AAFD478BF3411462 . 841216 . . [7.00.6000.21228] . . c:\windows\SoftwareDistribution\Download\fd907694b9730bf0b6b92a6dbc2f96ef\sp3qfe\wininet.dll

[7] 2010-01-05 . E7B99465DE2EDCF29784B7600BF6FAE8 . 841216 . . [7.00.6000.21183] . . c:\windows\$hf_mig$\KB978207-IE7\SP3QFE\wininet.dll

[7] 2009-07-03 . 38114DAB42FB2EB84D1726C42B8D80C5 . 915456 . . [8.00.6001.22896] . . c:\windows\$hf_mig$\KB972260-IE8\SP3QFE\wininet.dll

[7] 2009-05-13 . 366C72AF6970DB7BB39AB0142BF09DB5 . 915456 . . [8.00.6001.18783] . . c:\windows\ie8updates\KB972260-IE8\wininet.dll

[7] 2009-05-13 . 366C72AF6970DB7BB39AB0142BF09DB5 . 915456 . . [8.00.6001.18783] . . c:\windows\SoftwareDistribution\Download\97fe76a20161cb86e78057600e7c82a0\SP3GDR\wininet.dll

[7] 2009-05-13 . C0EB6850C8A02A154281749DC61FAF22 . 915456 . . [8.00.6001.22873] . . c:\windows\$hf_mig$\KB969897-IE8\SP3QFE\wininet.dll

[7] 2009-05-13 . C0EB6850C8A02A154281749DC61FAF22 . 915456 . . [8.00.6001.22873] . . c:\windows\SoftwareDistribution\Download\97fe76a20161cb86e78057600e7c82a0\SP3QFE\wininet.dll

[7] 2009-04-29 . 8E2D471157B0DF329D8D0EA5D83B0DDB . 827392 . . [7.00.6000.16850] . . c:\windows\ie8\wininet.dll

[7] 2009-04-29 . 62CCA075F44015147B8971DAFFBCFF76 . 828928 . . [7.00.6000.21045] . . c:\windows\$hf_mig$\KB969897-IE7\SP3QFE\wininet.dll

[7] 2009-03-07 . 6CE32F7778061CCC5814D5E0F282D369 . 914944 . . [8.00.6001.18702] . . c:\windows\ie8updates\KB969897-IE8\wininet.dll

[7] 2009-03-03 . 28775945CCD53DEE280EF58DEA1A94C4 . 826368 . . [7.00.6000.16827] . . c:\windows\ie7updates\KB969897-IE7\wininet.dll

[7] 2009-03-03 . C8667854873938CA13C986F16B0CD183 . 828416 . . [7.00.6000.21020] . . c:\windows\$hf_mig$\KB963027-IE7\SP3QFE\wininet.dll

[7] 2008-12-20 . 044E0A4E9FE97C0FB9AFE9C89E2A82E6 . 827904 . . [7.00.6000.20978] . . c:\windows\$hf_mig$\KB961260-IE7\SP2QFE\wininet.dll

[7] 2008-12-20 . A82935D32D0672E8FF4E91AE398E901C . 826368 . . [7.00.6000.16791] . . c:\windows\ie7updates\KB963027-IE7\wininet.dll

[-] 2008-10-16 . 5044269D9DC59326D8EE54C28ACD7003 . 817152 . . [7.00.6000.16762] . . c:\windows\ie7updates\KB961260-IE7\wininet.dll

[-] 2008-10-16 . 5044269D9DC59326D8EE54C28ACD7003 . 817152 . . [7.00.6000.16762] . . c:\windows\ie7updates\KB978207-IE7\wininet.dll

[-] 2008-10-16 . 5044269D9DC59326D8EE54C28ACD7003 . 817152 . . [7.00.6000.16762] . . c:\windows\ServicePackFiles\i386\wininet.dll

[-] 2008-10-16 . 5044269D9DC59326D8EE54C28ACD7003 . 817152 . . [7.00.6000.16762] . . c:\windows\system32\wininet.dll

[-] 2008-10-16 . 5044269D9DC59326D8EE54C28ACD7003 . 817152 . . [7.00.6000.16762] . . c:\windows\system32\dllcache\wininet.dll

[7] 2008-10-16 . 0D5B75171FF51775B630A431B6C667E8 . 827904 . . [7.00.6000.20935] . . c:\windows\$hf_mig$\KB958215-IE7\SP2QFE\wininet.dll

[7] 2008-04-14 . 7A4F775ABB2F1C97DEF3E73AFA2FAEDD . 666112 . . [6.00.2900.5512] . . c:\windows\SoftwareDistribution\Download\79123dd72d0f61d4ed8c7a816ed338d7\wininet.dll

[7] 2006-11-08 . 92995334F993E6E49C25C6D02EC04401 . 818688 . . [7.00.5730.11] . . c:\windows\ie7updates\KB958215-IE7\wininet.dll

[-] 2006-01-09 . DDE9597A3311748C1519444E2BC147BD . 662016 . . [6.00.2900.2823] . . c:\windows\ie7\wininet.dll

[-] 2005-10-21 . E7B27B6B6E06CE34EA019FD8B858C613 . 658432 . . [6.00.2900.2781] . . c:\windows\$NtUninstallKB905915$\wininet.dll

[-] 2005-10-21 . AF785C4947676A7FC1673FDC5C8D0B5B . 661504 . . [6.00.2900.2781] . . c:\windows\$hf_mig$\KB905915\SP2QFE\wininet.dll

.

[-] 2008-04-14 . 561A50497324F378E30F55D09B4E1258 . 975872 . . [6.00.2900.5512] . . c:\windows\explorer.exe

[-] 2008-04-14 . 561A50497324F378E30F55D09B4E1258 . 975872 . . [6.00.2900.5512] . . c:\windows\ServicePackFiles\i386\explorer.exe

[7] 2008-04-14 . 12896823FB95BFB3DC9B46BCAEDC9923 . 1033728 . . [6.00.2900.5512] . . c:\windows\SoftwareDistribution\Download\79123dd72d0f61d4ed8c7a816ed338d7\explorer.exe

[-] 2007-06-13 . 7712DF0CDDE3A5AC89843E61CD5B3658 . 1033216 . . [6.00.2900.3156] . . c:\windows\$hf_mig$\KB938828\SP2QFE\explorer.exe

[-] 2007-06-13 . 7712DF0CDDE3A5AC89843E61CD5B3658 . 1033216 . . [6.00.2900.3156] . . c:\windows\SoftwareDistribution\Download\44d74c37f0595a363bcec5e9229d8564\sp2qfe\explorer.exe

[-] 2007-06-13 . 97BD6515465659FF8F3B7BE375B2EA87 . 1033216 . . [6.00.2900.3156] . . c:\windows\$NtServicePackUninstall$\explorer.exe

[-] 2007-06-13 . 97BD6515465659FF8F3B7BE375B2EA87 . 1033216 . . [6.00.2900.3156] . . c:\windows\SoftwareDistribution\Download\44d74c37f0595a363bcec5e9229d8564\sp2gdr\explorer.exe

[-] 2004-08-04 . A5C1F2CF7C31874E66478910B43D6513 . 974336 . . [6.00.2900.2180] . . c:\windows\$NtUninstallKB938828$\explorer.exe

.

[-] 2008-04-14 . 0B720CAE71F51A2B93811816F187BC0A . 224256 . . [5.1.2600.5512] . . c:\windows\regedit.exe

[-] 2008-04-14 . 0B720CAE71F51A2B93811816F187BC0A . 224256 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\regedit.exe

[7] 2008-04-14 . 058710B720282CA82B909912D3EF28DB . 146432 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\79123dd72d0f61d4ed8c7a816ed338d7\regedit.exe

[-] 2004-08-04 . 61F45E8000C6C5913D3D1DA451337364 . 224256 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\regedit.exe

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]

@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"

[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]

2012-11-13 23:32 129272 ----a-w- c:\documents and settings\Mr. Bojangles\Application Data\Dropbox\bin\DropboxExt.17.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]

@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"

[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]

2012-11-13 23:32 129272 ----a-w- c:\documents and settings\Mr. Bojangles\Application Data\Dropbox\bin\DropboxExt.17.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]

@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"

[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]

2012-11-13 23:32 129272 ----a-w- c:\documents and settings\Mr. Bojangles\Application Data\Dropbox\bin\DropboxExt.17.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt4]

@="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}"

[HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}]

2012-11-13 23:32 129272 ----a-w- c:\documents and settings\Mr. Bojangles\Application Data\Dropbox\bin\DropboxExt.17.dll

.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Facebook Update"="c:\documents and settings\Mr. Bojangles\Local Settings\Application Data\Facebook\Update\FacebookUpdate.exe" [2012-08-21 138096]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"IgfxTray"="c:\windows\system32\igfxtray.exe" [2007-01-13 131072]

"TVT Scheduler Proxy"="c:\program files\Common Files\Lenovo\Scheduler\scheduler_proxy.exe" [2006-07-15 503808]

"Zune Launcher"="c:\program files\Zune\ZuneLauncher.exe" [2010-11-11 159472]

"D-Link D-Link DWA-525"="c:\program files\D-Link\DWA-525 revA\AirNCFG.exe" [2010-04-22 1015808]

"WZCSLDR2"="c:\program files\D-Link\DWA-525 revA\WZCSLDR2.exe" [2010-04-22 122880]

"M-Audio Taskbar Icon"="c:\windows\system32\M-AudioTaskBarIcon.exe" [2010-12-07 644104]

"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-12-03 946352]

"Mouse Suite 98 Daemon"="ICO.EXE" [2005-04-13 49152]

"Ad-Aware Browsing Protection"="c:\documents and settings\All Users\Application Data\Ad-Aware Browsing Protection\adawarebp.exe" [2012-05-09 201112]

"APSDaemon"="c:\program files\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2012-08-27 59280]

"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2012-09-09 421776]

.

c:\documents and settings\Mr. Bojangles\Start Menu\Programs\Startup\

Dropbox.lnk - c:\documents and settings\Mr. Bojangles\Application Data\Dropbox\bin\Dropbox.exe [2013-1-21 28539272]

startup concealer outlook.vbs [2011-12-12 209]

.

c:\documents and settings\All Users\Start Menu\Programs\Startup\

McAfee Security Scan Plus.lnk - c:\program files\McAfee Security Scan\3.0.318\SSScheduler.exe [2013-2-6 272248]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\AwayNotify]

2006-06-18 17:06 49152 ------w- c:\program files\Lenovo\AwayTask\AwayNotify.dll

.

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]

@="Service"

.

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]

@="Driver"

.

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Google Calendar Sync.lnk]

path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Google Calendar Sync.lnk

backup=c:\windows\pss\Google Calendar Sync.lnkCommon Startup

.

[HKLM\~\startupfolder\C:^Documents and Settings^Mr. Bojangles^Start Menu^Programs^Startup^Y'z Shadow.lnk]

path=c:\documents and settings\Mr. Bojangles\Start Menu\Programs\Startup\Y'z Shadow.lnk

backup=c:\windows\pss\Y'z Shadow.lnkStartup

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]

2012-12-03 07:35 946352 ----a-w- c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AdobeAAMUpdater-1.0]

2011-03-15 07:42 499608 ------w- c:\program files\Common Files\Adobe\OOBE\PDApp\UWA\updaterstartuputility.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AMSG]

2005-11-14 06:23 487424 -c----w- c:\program files\ThinkVantage\AMSG\Amsg.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\APSDaemon]

2012-08-27 11:32 59280 ----a-w- c:\program files\Common Files\Apple\Apple Application Support\APSDaemon.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AwaySch]

2006-06-18 17:06 69632 -c----w- c:\program files\Lenovo\AwayTask\AwaySch.EXE

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ccApp]

2005-06-02 17:21 48752 -c----w- c:\program files\Common Files\Symantec Shared\ccApp.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\cssauth]

2006-07-15 02:13 2341632 ------w- c:\program files\Lenovo\Client Security Solution\cssauth.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DiskeeperSystray]

2006-05-19 00:24 196696 ------w- c:\program files\Diskeeper Corporation\Diskeeper\DkIcon.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DLA]

2006-02-02 13:20 122940 -c----w- c:\windows\system32\DLA\DLACTRLW.EXE

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\High Definition Audio Property Page Shortcut]

2005-01-08 01:07 61952 -c----w- c:\windows\system32\HdAShCut.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HotKeysCmds]

2007-01-13 01:47 163840 -c----w- c:\windows\system32\hkcmd.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSPM Startup]

2004-07-28 00:50 221184 -c----w- c:\progra~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSScheduler]

2004-07-28 00:50 81920 -c----w- c:\program files\Common Files\InstallShield\UpdateService\issch.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]

2012-09-09 13:30 421776 ----a-w- c:\program files\iTunes\iTunesHelper.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LPManager]

2006-07-04 16:11 110592 -c----w- c:\progra~1\THINKV~1\PrdCtr\LPMGR.EXE

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\M-Audio Taskbar Icon]

2010-12-07 09:39 644104 ----a-w- c:\windows\system32\M-AudioTaskBarIcon.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Mouse Suite 98 Daemon]

2005-04-13 22:34 49152 -c----w- c:\windows\system32\ico.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr]

2010-04-16 12:12 3872080 -c--a-w- c:\program files\Windows Live\Messenger\msnmsgr.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PDService.exe]

2006-03-14 00:38 41472 -c----r- c:\program files\Lenovo\SafeGuard PrivateDisk\pdservice.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Persistence]

2007-01-13 01:46 135168 -c----w- c:\windows\system32\igfxpers.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]

2011-07-05 08:36 421888 -c--a-w- c:\program files\QuickTime\QTTask.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]

2008-03-25 12:28 144784 -c----w- c:\program files\Java\jre1.6.0_06\bin\jusched.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\vptray]

2005-08-19 01:22 85696 -c----w- c:\progra~1\SYMANT~1\SYMANT~2\VPTray.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent]

2011-12-09 17:22 74752 ----a-w- c:\program files\Winamp\winampa.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]

"D_Link_DWA-525"=2 (0x2)

.

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]

"DisableMonitoring"=dword:00000001

.

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]

"DisableMonitoring"=dword:00000001

.

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]

"EnableFirewall"= 0 (0x0)

.

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=

"c:\\Program Files\\MSNShell\\Bin\\engie.exe"=

"c:\\Program Files\\uTorrent\\uTorrent.exe"=

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=

"c:\\Program Files\\Java\\jre6\\bin\\java.exe"=

"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=

"c:\\Program Files\\Common Files\\Apple\\Apple Application Support\\WebKit2WebProcess.exe"=

"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

"c:\\Program Files\\iTunes\\iTunes.exe"=

.

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]

"3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009

.

R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [7/6/2010 9:26 PM 64288]

R2 ANPD;ANPD Service;c:\windows\system32\ANPD.SYS [12/29/2011 6:38 PM 29411]

R2 D_Link_DWA-525_WPS;D_Link_DWA-525_WPS Service;c:\program files\D-Link\DWA-525 revA\ANIWConnService.exe [12/29/2011 6:37 PM 40960]

R2 NIHardwareService;NIHardwareService;c:\program files\Common Files\Native Instruments\Hardware\NIHardwareService.exe [4/8/2011 1:33 AM 3857408]

R2 PrivateDisk;PrivateDisk;c:\program files\Lenovo\SafeGuard PrivateDisk\privatediskm.sys [3/14/2006 10:05 AM 58368]

R2 smi2;smi2;c:\program files\SMI2\smi2.sys [7/15/2006 9:55 AM 3968]

R3 MAUSBFASTTRACKPRO;Service for M-Audio FastTrack Pro;c:\windows\system32\drivers\MAudioFastTrackPro.sys [12/7/2010 3:39 PM 158600]

S3 D_Link_DWA-525;D_Link_DWA-525 Service;c:\program files\D-Link\DWA-525 revA\ANIWZCSdS.exe [12/29/2011 6:37 PM 126976]

S3 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [6/22/2010 3:44 AM 1737728]

S3 MBAMSwissArmy;MBAMSwissArmy;\??\c:\windows\system32\drivers\mbamswissarmy.sys --> c:\windows\system32\drivers\mbamswissarmy.sys [?]

S3 McComponentHostService;McAfee Security Scan Component Host Service;c:\program files\McAfee Security Scan\3.0.318\McCHSvc.exe [2/6/2013 1:48 AM 235216]

S3 Netaapl;Apple Mobile Device Ethernet Service;c:\windows\system32\drivers\netaapl.sys [12/10/2011 4:55 AM 18432]

S3 RT80x86;D-Link 802.11n Wireless Driver;c:\windows\system32\drivers\Drt2860.sys [12/29/2011 6:35 PM 1329632]

S3 SavRoam;SAVRoam;c:\program files\Symantec Client Security\Symantec AntiVirus\SavRoam.exe [8/19/2005 11:22 AM 124608]

S3 WDC_SAM;WD SCSI Pass Thru driver;c:\windows\system32\drivers\wdcsam.sys [5/6/2008 4:06 PM 11520]

.

--- Other Services/Drivers In Memory ---

.

*NewlyCreated* - TRUESIGHT

*Deregistered* - TrueSight

.

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]

2013-03-05 13:04 1630672 ----a-w- c:\program files\Google\Chrome\Application\25.0.1364.152\Installer\chrmstp.exe

.

Contents of the 'Scheduled Tasks' folder

.

2013-03-05 c:\windows\Tasks\Ad-Aware Update (Weekly).job

- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2010-06-21 07:40]

.

2013-03-08 c:\windows\Tasks\Adobe Flash Player Updater.job

- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-22 12:13]

.

2013-03-08 c:\windows\Tasks\AdobeAAMUpdater-1.0-MRBOJANGLES-Mr. Bojangles.job

- c:\program files\Common Files\Adobe\OOBE\PDApp\UWA\updaterstartuputility.exe [2012-02-12 07:42]

.

2013-03-04 c:\windows\Tasks\AppleSoftwareUpdate.job

- c:\program files\Apple Software Update\SoftwareUpdate.exe [2011-06-01 07:57]

.

2013-03-07 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-2838019926-1718427338-2428480347-1008Core.job

- c:\documents and settings\Mr. Bojangles\Local Settings\Application Data\Facebook\Update\FacebookUpdate.exe [2012-08-21 11:02]

.

2013-03-08 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-2838019926-1718427338-2428480347-1008UA.job

- c:\documents and settings\Mr. Bojangles\Local Settings\Application Data\Facebook\Update\FacebookUpdate.exe [2012-08-21 11:02]

.

2013-03-08 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job

- c:\program files\Google\Update\GoogleUpdate.exe [2009-10-05 14:43]

.

2013-03-08 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job

- c:\program files\Google\Update\GoogleUpdate.exe [2009-10-05 14:43]

.

2009-01-08 c:\windows\Tasks\Symantec NetDetect.job

- c:\program files\Symantec\LiveUpdate\NDETECT.EXE [2009-01-08 01:32]

.

2013-03-08 c:\windows\Tasks\User_Feed_Synchronization-{B0CC9A6F-834D-47FF-9C2A-B9379DCECD3B}.job

- c:\windows\system32\msfeedssync.exe [2006-10-17 19:58]

.

------- Supplementary Scan -------

.

uStart Page = hxxp://www.google.com/

uInternet Connection Wizard,ShellNext = iexplore

uInternet Settings,ProxyOverride = *.local

IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200

IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000

IE: Set As Messenger Live Display Picture - c:\program files\MSNShell\Bin\SetMSNDP.htm

TCP: DhcpNameServer = 192.168.1.1

.

- - - - ORPHANS REMOVED - - - -

.

MSConfigStartUp-Freecorder FLV Service - c:\program files\Freecorder\FLVSrvc.exe

MSConfigStartUp-Steam - c:\program files\Steam\Steam.exe

MSConfigStartUp-{36766253-3625-2B37-8020-3C1C75B36046} - c:\documents and settings\Mr. Bojangles\Application Data\Gouww\iwzi.exe

AddRemove-Ad-Aware - c:\documents and settings\All Users\Application Data\{90FF8911-FC06-4E49-8959-C3CF1CA226BB}\Ad-AwareInstall.exe

AddRemove-adawaretb - c:\program files\adawaretb\uninstall.exe

AddRemove-CodeMallet - c:\program files\CodeMallet\uninstall.exe

AddRemove-eSupport UndeletePlus_is1 - e:\esupport undeleteplus\unins000.exe

AddRemove-Native Instruments Controller Editor - c:\documents and settings\All Users\Application Data\{DCC412E7-393B-4016-91FB-9307F059AFB6}\Controller Editor Setup PC.exe

AddRemove-Native Instruments Guitar Rig 4 - c:\documents and settings\All Users\Application Data\{D69A48BF-7653-4AA8-94BC-5847522A4573}\Guitar Rig 4 Setup PC.exe

AddRemove-Native Instruments Guitar Rig 5 - c:\documents and settings\All Users\Application Data\{9327ACE9-CC82-4A33-9B33-291ACA1E267B}\Guitar Rig 5 Setup PC.exe

AddRemove-Native Instruments GuitarRig Mobile IO Driver - c:\documents and settings\All Users\Application Data\{4F32CAF7-963B-404D-BF13-C48BA3F5F6A7}\GuitarRig Mobile IO Driver Setup.exe

AddRemove-Native Instruments Rig Kontrol 3 Driver - c:\documents and settings\All Users\Application Data\{EC98E512-708C-4C3B-9F07-B58768C1DD8A}\Rig Kontrol 3 Driver Setup.exe

AddRemove-Native Instruments Service Center - c:\documents and settings\All Users\Application Data\{D7CFB71A-972A-44FF-AE44-8780EB53ABB2}\Service Center Setup.exe

AddRemove-Native Instruments Session IO Driver - c:\documents and settings\All Users\Application Data\{AC46DC4F-66BD-4733-A8B4-0B69418C12D0}\Session IO Driver Setup.exe

AddRemove-Spark - c:\program files\Spark\uninstall.exe

AddRemove-Steam App 240 - c:\program files\Steam\steam.exe

AddRemove-TeamViewer 6 - c:\program files\TeamViewer\Version6\uninstall.exe

AddRemove-TVersity Codec Pack - c:\program files\TVersity Codec Pack\uninst.exe

AddRemove-{01D57CF6-B5BC-4D03-AFF5-7960CFBD05A9} - c:\documents and settings\All Users\Application Data\{9327ACE9-CC82-4A33-9B33-291ACA1E267B}\Guitar Rig 5 Setup PC.exe

AddRemove-{0886900B-B2F3-452C-B580-60F1253F7F80} - c:\documents and settings\All Users\Application Data\{DCC412E7-393B-4016-91FB-9307F059AFB6}\Controller Editor Setup PC.exe

AddRemove-{0B8565BA-BAD5-4732-B122-5FD78EFC50A9} - c:\documents and settings\All Users\Application Data\{D7CFB71A-972A-44FF-AE44-8780EB53ABB2}\Service Center Setup.exe

AddRemove-{2930FB47-6452-4476-BF16-D77F748646DB} - c:\documents and settings\All Users\Application Data\{4F32CAF7-963B-404D-BF13-C48BA3F5F6A7}\GuitarRig Mobile IO Driver Setup.exe

AddRemove-{7930FB47-6452-4476-BF16-D77F748646DB} - c:\documents and settings\All Users\Application Data\{AC46DC4F-66BD-4733-A8B4-0B69418C12D0}\Session IO Driver Setup.exe

AddRemove-{A7E19604-93AF-4611-8C9F-CE509C2B286F}_is1 - c:\program files\Free YouTube Downloader\unins000.exe

AddRemove-{B962AD08-335F-46f7-A182-257D37672E5C} - c:\documents and settings\All Users\Application Data\{EC98E512-708C-4C3B-9F07-B58768C1DD8A}\Rig Kontrol 3 Driver Setup.exe

AddRemove-{C7FAFC98-5ECC-40FC-B440-A5D5FE3A6A6E} - c:\documents and settings\All Users\Application Data\{D69A48BF-7653-4AA8-94BC-5847522A4573}\Guitar Rig 4 Setup PC.exe

AddRemove-{DED53B0B-B67C-4244-AE6A-D6FD3C28D1EF} - c:\documents and settings\All Users\Application Data\{90FF8911-FC06-4E49-8959-C3CF1CA226BB}\Ad-AwareInstall.exe

.

**************************************************************************

.

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2013-03-09 03:47

Windows 5.1.2600 Service Pack 3 NTFS

.

scanning hidden processes ...

.

scanning hidden autostart entries ...

.

scanning hidden files ...

.

scan completed successfully

hidden files: 0

.

**************************************************************************

.

--------------------- LOCKED REGISTRY KEYS ---------------------

.

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]

@Denied: (A 2) (Everyone)

@="FlashBroker"

"LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil32_11_6_602_171_ActiveX.exe,-101"

.

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]

"Enabled"=dword:00000001

.

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]

@="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil32_11_6_602_171_ActiveX.exe"

.

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

.

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]

@Denied: (A 2) (Everyone)

@="IFlashBroker5"

.

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]

@="{00020424-0000-0000-C000-000000000046}"

.

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

"Version"="1.0"

.

[HKEY_LOCAL_MACHINE\software\Classes\VideoLAN.VLCPlugin.*1*]

@="?????????????????? v1"

.

[HKEY_LOCAL_MACHINE\software\Classes\VideoLAN.VLCPlugin.*1*\CLSID]

@="{E23FE9C6-778E-49D4-B537-38FCDE4887D8}"

.

[HKEY_LOCAL_MACHINE\software\Classes\VideoLAN.VLCPlugin.*2*]

@="?????????????????? v2"

.

[HKEY_LOCAL_MACHINE\software\Classes\VideoLAN.VLCPlugin.*2*\CLSID]

@="{9BE31822-FDAD-461B-AD51-BE1D1C159921}"

.

[HKEY_LOCAL_MACHINE\System\ControlSet001\Control\DeviceClasses\{4d1e55b2-f16f-11cf-88cb-001111000030}\##?#HID#Vid_046d&Pid_0a0c&MI_03#7&1fc07de5&0&0000#{4d1e55b2-f1*f-11cf-*8cb-001*1100003*}]

"ClassGUID"="{4D36E97D-E325-11CE-BFC1-08002BE10318}"

.

[HKEY_LOCAL_MACHINE\System\ControlSet001\Control\DeviceClasses\{4d1e55b2-f16f-11cf-88cb-001111000030}\##?#HID#Vid_046d&Pid_0a0c&MI_03#7&1fc07de5&0&0000#{4d1e55b2-f1*f-11cf-*8cb-001*1100003*}\#]

@="Microsoft\00??ms_mmvid\00\0c???\0e\08\00?\00\03\00\01\00???????\00???\0a\12\00?\00\01\00\01\00?????\00\00\00??7-1-2001\00\00??Video Codecs"

.

--------------------- DLLs Loaded Under Running Processes ---------------------

.

- - - - - - - > 'winlogon.exe'(1000)

c:\windows\system32\tvt_gina.dll

c:\program files\Lenovo\Client Security Solution\css_gina_plugin.dll

c:\program files\Lenovo\Client Security Solution\css_wait_bar.dll

c:\program files\Lenovo\Client Security Solution\cssuserdatadispatcher.dll

c:\program files\Lenovo\Client Security Solution\csswait.dll

c:\program files\Common Files\Lenovo\tvt_banner.dll

c:\program files\Lenovo\Client Security Solution\cssdlgpwentry.dll

c:\program files\Lenovo\Client Security Solution\dlganswerprompt.dll

c:\program files\Lenovo\Client Security Solution\tvttsp.dll

c:\program files\Lenovo\Client Security Solution\tcsrpc.dll

c:\program files\Common Files\Lenovo\tvt_res.dll

c:\program files\Lenovo\AwayTask\AwayNotify.dll

.

Completion time: 2013-03-09 03:51:02

ComboFix-quarantined-files.txt 2013-03-08 17:50

ComboFix2.txt 2009-09-27 19:15

.

Pre-Run: 13,662,547,968 bytes free

Post-Run: 14,941,941,760 bytes free

.

WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe

[boot loader]

timeout=2

default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS

[operating systems]

c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons

UnsupportedDebug="do not select this" /debug

multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect

.

- - End Of File - - 5661F7837A8D37A02950D3364C844F25

Mr. Bojangles · March 8, 2013

Unfortunately, i am still getting the malware ads on all my web pages

gringo_pr · March 8, 2013

Hello Mr. Bojangles

I would like you to try and run these next.

TDSSKiller

Please download the latest version of TDSSKiller from here and save it to your Desktop.

Doubleclick on TDSSKiller.exe to run the application, then click on Change parameters.
Put a checkmark beside loaded modules.
A reboot will be needed to apply the changes. Do it.
TDSSKiller will launch automatically after the reboot. Also your computer may seem very slow and unusable. This is normal. Give it enough time to load your background programs.
Then click on Change parameters in TDSSKiller.
Check all boxes then click OK.
Click the Start Scan button.
The scan should take no longer than 2 minutes.
If a suspicious object is detected, the default action will be Skip, click on Continue.
If malicious objects are found, they will show in the Scan results
Ensure Cure (default) is selected, then click Continue > Reboot now to finish the cleaning process.
Note: If Cure is not available, please choose Skip instead, do not choose Delete unless instructed.
A report will be created in your root directory, (usually C:\ folder) in the form of "TDSSKiller.[Version]_[Date]_[Time]_log.txt". Please copy and paste the contents of that file here.
Note** this report can be very long - so if the website gives you an error saying it is to long you may attache it
If the forum still complains about it being to long send me everything that is at the end of the report after where it says
==================
Scan finished
==================

and I will see if I want to see the whole report

Malwarebytes Anti-Rootkit

1.Download Malwarebytes Anti-Rootkit

2.Unzip the contents to a folder in a convenient location.

3.Open the folder where the contents were unzipped and run mbar.exe

4.Follow the instructions in the wizard to update and allow the program to scan your computer for threats.

5.Click on the Cleanup button to remove any threats and reboot if prompted to do so.

6.Wait while the system shuts down and the cleanup process is performed.

7.Perform another scan with Malwarebytes Anti-Rootkit to verify that no threats remain. If they do, then click Cleanup once more and repeat the process.

8.If no additional threats were found, verify that your system is now running normally, making sure that the following items are functional:

•Internet access
•Windows Update
•Windows Firewall

9.If there are additional problems with your system, such as any of those listed above or other system issues, then run the 'fixdamage' tool included with Malwarebytes Anti-Rootkit and reboot.

10.Verify that your system is now functioning normally.

If you have any problems running either one come back and let me know

please reply with the reports from TDSSKiller and MBAR

Gringo

Mr. Bojangles · March 8, 2013

05:19:30.0734 3796 ============================================================

05:19:30.0734 3796 Scan finished

05:19:30.0734 3796 ============================================================

05:19:30.0843 3384 Detected object count: 36

05:19:30.0843 3384 Actual detected object count: 36

05:21:21.0921 3384 ANPD ( UnsignedFile.Multi.Generic ) - skipped by user

05:21:21.0921 3384 ANPD ( UnsignedFile.Multi.Generic ) - User select action: Skip

05:21:21.0921 3384 BVRPMPR5 ( UnsignedFile.Multi.Generic ) - skipped by user

05:21:21.0921 3384 BVRPMPR5 ( UnsignedFile.Multi.Generic ) - User select action: Skip

05:21:21.0921 3384 Diskeeper ( UnsignedFile.Multi.Generic ) - skipped by user

05:21:21.0921 3384 Diskeeper ( UnsignedFile.Multi.Generic ) - User select action: Skip

05:21:21.0921 3384 DLABOIOM ( UnsignedFile.Multi.Generic ) - skipped by user

05:21:21.0921 3384 DLABOIOM ( UnsignedFile.Multi.Generic ) - User select action: Skip

05:21:21.0937 3384 DLACDBHM ( UnsignedFile.Multi.Generic ) - skipped by user

05:21:21.0937 3384 DLACDBHM ( UnsignedFile.Multi.Generic ) - User select action: Skip

05:21:21.0937 3384 DLADResN ( UnsignedFile.Multi.Generic ) - skipped by user

05:21:21.0937 3384 DLADResN ( UnsignedFile.Multi.Generic ) - User select action: Skip

05:21:21.0937 3384 DLAIFS_M ( UnsignedFile.Multi.Generic ) - skipped by user

05:21:21.0937 3384 DLAIFS_M ( UnsignedFile.Multi.Generic ) - User select action: Skip

05:21:21.0953 3384 DLAOPIOM ( UnsignedFile.Multi.Generic ) - skipped by user

05:21:21.0953 3384 DLAOPIOM ( UnsignedFile.Multi.Generic ) - User select action: Skip

05:21:21.0968 3384 DLAPoolM ( UnsignedFile.Multi.Generic ) - skipped by user

05:21:21.0968 3384 DLAPoolM ( UnsignedFile.Multi.Generic ) - User select action: Skip

05:21:21.0968 3384 DLARTL_N ( UnsignedFile.Multi.Generic ) - skipped by user

05:21:21.0968 3384 DLARTL_N ( UnsignedFile.Multi.Generic ) - User select action: Skip

05:21:21.0984 3384 DLAUDFAM ( UnsignedFile.Multi.Generic ) - skipped by user

05:21:21.0984 3384 DLAUDFAM ( UnsignedFile.Multi.Generic ) - User select action: Skip

05:21:21.0984 3384 DLAUDF_M ( UnsignedFile.Multi.Generic ) - skipped by user

05:21:21.0984 3384 DLAUDF_M ( UnsignedFile.Multi.Generic ) - User select action: Skip

05:21:21.0984 3384 DRVMCDB ( UnsignedFile.Multi.Generic ) - skipped by user

05:21:21.0984 3384 DRVMCDB ( UnsignedFile.Multi.Generic ) - User select action: Skip

05:21:22.0000 3384 DRVNDDM ( UnsignedFile.Multi.Generic ) - skipped by user

05:21:22.0000 3384 DRVNDDM ( UnsignedFile.Multi.Generic ) - User select action: Skip

05:21:22.0000 3384 D_Link_DWA-525 ( UnsignedFile.Multi.Generic ) - skipped by user

05:21:22.0000 3384 D_Link_DWA-525 ( UnsignedFile.Multi.Generic ) - User select action: Skip

05:21:22.0000 3384 D_Link_DWA-525_WPS ( UnsignedFile.Multi.Generic ) - skipped by user

05:21:22.0000 3384 D_Link_DWA-525_WPS ( UnsignedFile.Multi.Generic ) - User select action: Skip

05:21:22.0000 3384 EGATHDRV ( UnsignedFile.Multi.Generic ) - skipped by user

05:21:22.0000 3384 EGATHDRV ( UnsignedFile.Multi.Generic ) - User select action: Skip

05:21:22.0000 3384 ialm ( UnsignedFile.Multi.Generic ) - skipped by user

05:21:22.0000 3384 ialm ( UnsignedFile.Multi.Generic ) - User select action: Skip

05:21:22.0015 3384 IDriverT ( UnsignedFile.Multi.Generic ) - skipped by user

05:21:22.0015 3384 IDriverT ( UnsignedFile.Multi.Generic ) - User select action: Skip

05:21:22.0015 3384 IPSSVC ( UnsignedFile.Multi.Generic ) - skipped by user

05:21:22.0015 3384 IPSSVC ( UnsignedFile.Multi.Generic ) - User select action: Skip

05:21:22.0015 3384 Iviaspi ( UnsignedFile.Multi.Generic ) - skipped by user

05:21:22.0015 3384 Iviaspi ( UnsignedFile.Multi.Generic ) - User select action: Skip

05:21:22.0031 3384 Lavasoft Ad-Aware Service ( UnsignedFile.Multi.Generic ) - skipped by user

05:21:22.0031 3384 Lavasoft Ad-Aware Service ( UnsignedFile.Multi.Generic ) - User select action: Skip

05:21:22.0031 3384 NIHardwareService ( UnsignedFile.Multi.Generic ) - skipped by user

05:21:22.0031 3384 NIHardwareService ( UnsignedFile.Multi.Generic ) - User select action: Skip

05:21:22.0031 3384 pmem ( UnsignedFile.Multi.Generic ) - skipped by user

05:21:22.0031 3384 pmem ( UnsignedFile.Multi.Generic ) - User select action: Skip

05:21:22.0031 3384 PrivateDisk ( UnsignedFile.Multi.Generic ) - skipped by user

05:21:22.0031 3384 PrivateDisk ( UnsignedFile.Multi.Generic ) - User select action: Skip

05:21:22.0046 3384 PROCDD ( UnsignedFile.Multi.Generic ) - skipped by user

05:21:22.0046 3384 PROCDD ( UnsignedFile.Multi.Generic ) - User select action: Skip

05:21:22.0046 3384 psadd ( UnsignedFile.Multi.Generic ) - skipped by user

05:21:22.0046 3384 psadd ( UnsignedFile.Multi.Generic ) - User select action: Skip

05:21:22.0046 3384 PsaSrv ( UnsignedFile.Multi.Generic ) - skipped by user

05:21:22.0046 3384 PsaSrv ( UnsignedFile.Multi.Generic ) - User select action: Skip

05:21:22.0046 3384 smi2 ( UnsignedFile.Multi.Generic ) - skipped by user

05:21:22.0046 3384 smi2 ( UnsignedFile.Multi.Generic ) - User select action: Skip

05:21:22.0062 3384 SUService ( UnsignedFile.Multi.Generic ) - skipped by user

05:21:22.0062 3384 SUService ( UnsignedFile.Multi.Generic ) - User select action: Skip

05:21:22.0062 3384 TPkd ( UnsignedFile.Multi.Generic ) - skipped by user

05:21:22.0062 3384 TPkd ( UnsignedFile.Multi.Generic ) - User select action: Skip

05:21:22.0062 3384 TVT Backup Service ( UnsignedFile.Multi.Generic ) - skipped by user

05:21:22.0062 3384 TVT Backup Service ( UnsignedFile.Multi.Generic ) - User select action: Skip

05:21:22.0062 3384 TVT Scheduler ( UnsignedFile.Multi.Generic ) - skipped by user

05:21:22.0062 3384 TVT Scheduler ( UnsignedFile.Multi.Generic ) - User select action: Skip

05:21:22.0062 3384 tvtfilter ( UnsignedFile.Multi.Generic ) - skipped by user

05:21:22.0078 3384 tvtfilter ( UnsignedFile.Multi.Generic ) - User select action: Skip

05:21:22.0078 3384 tvtnetwk ( UnsignedFile.Multi.Generic ) - skipped by user

05:21:22.0078 3384 tvtnetwk ( UnsignedFile.Multi.Generic ) - User select action: Skip

05:21:22.0078 3384 \Device\Harddisk0\DR0 ( TDSS File System ) - skipped by user

05:21:22.0078 3384 \Device\Harddisk0\DR0 ( TDSS File System ) - User select action: Skip

Mr. Bojangles · March 8, 2013

running antirootkit now. will post report when done. in teh mean time, do you want the rest of the report from TDSSKILLER?

Mr. Bojangles · March 8, 2013

scan complete. no malware was found by MBAR

gringo_pr · March 8, 2013

Hello

I want you to rerun Tdsskiller and when it gets to this part

\Device\Harddisk0\DR0 ( TDSS File System ) - skipped by user

\Device\Harddisk0\DR0 ( TDSS File System ) - User select action: Skip

I want you to select delete this time instead of Skip

gringo

Mr. Bojangles · March 8, 2013

ok that's done,

here's the log. malware still present. will restart pc.

06:28:02.0421 3568 ============================================================

06:28:02.0421 3568 Scan finished

06:28:02.0421 3568 ============================================================

06:28:02.0546 0260 Detected object count: 36

06:28:02.0546 0260 Actual detected object count: 36

06:31:07.0125 0260 ANPD ( UnsignedFile.Multi.Generic ) - skipped by user

06:31:07.0125 0260 ANPD ( UnsignedFile.Multi.Generic ) - User select action: Skip

06:31:07.0125 0260 BVRPMPR5 ( UnsignedFile.Multi.Generic ) - skipped by user

06:31:07.0125 0260 BVRPMPR5 ( UnsignedFile.Multi.Generic ) - User select action: Skip

06:31:07.0125 0260 Diskeeper ( UnsignedFile.Multi.Generic ) - skipped by user

06:31:07.0125 0260 Diskeeper ( UnsignedFile.Multi.Generic ) - User select action: Skip

06:31:07.0125 0260 DLABOIOM ( UnsignedFile.Multi.Generic ) - skipped by user

06:31:07.0125 0260 DLABOIOM ( UnsignedFile.Multi.Generic ) - User select action: Skip

06:31:07.0125 0260 DLACDBHM ( UnsignedFile.Multi.Generic ) - skipped by user

06:31:07.0125 0260 DLACDBHM ( UnsignedFile.Multi.Generic ) - User select action: Skip

06:31:07.0140 0260 DLADResN ( UnsignedFile.Multi.Generic ) - skipped by user

06:31:07.0140 0260 DLADResN ( UnsignedFile.Multi.Generic ) - User select action: Skip

06:31:07.0140 0260 DLAIFS_M ( UnsignedFile.Multi.Generic ) - skipped by user

06:31:07.0140 0260 DLAIFS_M ( UnsignedFile.Multi.Generic ) - User select action: Skip

06:31:07.0140 0260 DLAOPIOM ( UnsignedFile.Multi.Generic ) - skipped by user

06:31:07.0140 0260 DLAOPIOM ( UnsignedFile.Multi.Generic ) - User select action: Skip

06:31:07.0140 0260 DLAPoolM ( UnsignedFile.Multi.Generic ) - skipped by user

06:31:07.0140 0260 DLAPoolM ( UnsignedFile.Multi.Generic ) - User select action: Skip

06:31:07.0156 0260 DLARTL_N ( UnsignedFile.Multi.Generic ) - skipped by user

06:31:07.0156 0260 DLARTL_N ( UnsignedFile.Multi.Generic ) - User select action: Skip

06:31:07.0156 0260 DLAUDFAM ( UnsignedFile.Multi.Generic ) - skipped by user

06:31:07.0156 0260 DLAUDFAM ( UnsignedFile.Multi.Generic ) - User select action: Skip

06:31:07.0156 0260 DLAUDF_M ( UnsignedFile.Multi.Generic ) - skipped by user

06:31:07.0156 0260 DLAUDF_M ( UnsignedFile.Multi.Generic ) - User select action: Skip

06:31:07.0156 0260 DRVMCDB ( UnsignedFile.Multi.Generic ) - skipped by user

06:31:07.0156 0260 DRVMCDB ( UnsignedFile.Multi.Generic ) - User select action: Skip

06:31:07.0171 0260 DRVNDDM ( UnsignedFile.Multi.Generic ) - skipped by user

06:31:07.0171 0260 DRVNDDM ( UnsignedFile.Multi.Generic ) - User select action: Skip

06:31:07.0171 0260 D_Link_DWA-525 ( UnsignedFile.Multi.Generic ) - skipped by user

06:31:07.0171 0260 D_Link_DWA-525 ( UnsignedFile.Multi.Generic ) - User select action: Skip

06:31:07.0171 0260 D_Link_DWA-525_WPS ( UnsignedFile.Multi.Generic ) - skipped by user

06:31:07.0171 0260 D_Link_DWA-525_WPS ( UnsignedFile.Multi.Generic ) - User select action: Skip

06:31:07.0171 0260 EGATHDRV ( UnsignedFile.Multi.Generic ) - skipped by user

06:31:07.0171 0260 EGATHDRV ( UnsignedFile.Multi.Generic ) - User select action: Skip

06:31:07.0187 0260 ialm ( UnsignedFile.Multi.Generic ) - skipped by user

06:31:07.0187 0260 ialm ( UnsignedFile.Multi.Generic ) - User select action: Skip

06:31:07.0187 0260 IDriverT ( UnsignedFile.Multi.Generic ) - skipped by user

06:31:07.0187 0260 IDriverT ( UnsignedFile.Multi.Generic ) - User select action: Skip

06:31:07.0187 0260 IPSSVC ( UnsignedFile.Multi.Generic ) - skipped by user

06:31:07.0187 0260 IPSSVC ( UnsignedFile.Multi.Generic ) - User select action: Skip

06:31:07.0203 0260 Iviaspi ( UnsignedFile.Multi.Generic ) - skipped by user

06:31:07.0203 0260 Iviaspi ( UnsignedFile.Multi.Generic ) - User select action: Skip

06:31:07.0203 0260 Lavasoft Ad-Aware Service ( UnsignedFile.Multi.Generic ) - skipped by user

06:31:07.0203 0260 Lavasoft Ad-Aware Service ( UnsignedFile.Multi.Generic ) - User select action: Skip

06:31:07.0218 0260 NIHardwareService ( UnsignedFile.Multi.Generic ) - skipped by user

06:31:07.0218 0260 NIHardwareService ( UnsignedFile.Multi.Generic ) - User select action: Skip

06:31:07.0218 0260 pmem ( UnsignedFile.Multi.Generic ) - skipped by user

06:31:07.0218 0260 pmem ( UnsignedFile.Multi.Generic ) - User select action: Skip

06:31:07.0218 0260 PrivateDisk ( UnsignedFile.Multi.Generic ) - skipped by user

06:31:07.0218 0260 PrivateDisk ( UnsignedFile.Multi.Generic ) - User select action: Skip

06:31:07.0234 0260 PROCDD ( UnsignedFile.Multi.Generic ) - skipped by user

06:31:07.0234 0260 PROCDD ( UnsignedFile.Multi.Generic ) - User select action: Skip

06:31:07.0234 0260 psadd ( UnsignedFile.Multi.Generic ) - skipped by user

06:31:07.0234 0260 psadd ( UnsignedFile.Multi.Generic ) - User select action: Skip

06:31:07.0234 0260 PsaSrv ( UnsignedFile.Multi.Generic ) - skipped by user

06:31:07.0234 0260 PsaSrv ( UnsignedFile.Multi.Generic ) - User select action: Skip

06:31:07.0234 0260 smi2 ( UnsignedFile.Multi.Generic ) - skipped by user

06:31:07.0234 0260 smi2 ( UnsignedFile.Multi.Generic ) - User select action: Skip

06:31:07.0250 0260 SUService ( UnsignedFile.Multi.Generic ) - skipped by user

06:31:07.0250 0260 SUService ( UnsignedFile.Multi.Generic ) - User select action: Skip

06:31:07.0250 0260 TPkd ( UnsignedFile.Multi.Generic ) - skipped by user

06:31:07.0250 0260 TPkd ( UnsignedFile.Multi.Generic ) - User select action: Skip

06:31:07.0250 0260 TVT Backup Service ( UnsignedFile.Multi.Generic ) - skipped by user

06:31:07.0250 0260 TVT Backup Service ( UnsignedFile.Multi.Generic ) - User select action: Skip

06:31:07.0250 0260 TVT Scheduler ( UnsignedFile.Multi.Generic ) - skipped by user

06:31:07.0250 0260 TVT Scheduler ( UnsignedFile.Multi.Generic ) - User select action: Skip

06:31:07.0250 0260 tvtfilter ( UnsignedFile.Multi.Generic ) - skipped by user

06:31:07.0250 0260 tvtfilter ( UnsignedFile.Multi.Generic ) - User select action: Skip

06:31:07.0265 0260 tvtnetwk ( UnsignedFile.Multi.Generic ) - skipped by user

06:31:07.0265 0260 tvtnetwk ( UnsignedFile.Multi.Generic ) - User select action: Skip

06:31:07.0343 0260 \Device\Harddisk0\DR0\TDLFS\z00clicker.dll - copied to quarantine

06:31:07.0343 0260 \Device\Harddisk0\DR0\TDLFS\config.ini - copied to quarantine

06:31:07.0343 0260 \Device\Harddisk0\DR0\TDLFS - deleted

06:31:07.0343 0260 \Device\Harddisk0\DR0 ( TDSS File System ) - User select action: Delete

gringo_pr · March 8, 2013

Hello Mr. Bojangles

At this time I would like you to run this script for me and it is a good time to check out the computer to see if there is anything else that needs to be addressed.

:Run CFScript:

Please start by opening Notepad and copy/paste the text in the box into the window:

 ClearJavaCache::

Save it to your desktop as CFScript.txt

Referring to the picture above, drag CFScript.txt into ComboFix.exe

This will let ComboFix run again.

Restart if you have to.

Save the produced logfile to your desktop.

Note: Do not mouseclick combofix's window whilst it's running. That may cause it to stall

Note 2: If you receive an error "Illegal operation attempted on a registry key that has been marked for deletion." Please restart the computer

"information and logs"

In your next post I need the following

report from Combofix
let me know of any problems you may have had
How is the computer doing now after running the script?

Gringo

Mr. Bojangles · March 8, 2013

No running issues. still have ads.

ComboFix 13-03-07.03 - Mr. Bojangles 03/09/2013 7:21.2.2 - x86

Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2038.1293 [GMT 10:00]

Running from: c:\documents and settings\Mr. Bojangles\My Documents\Downloads\ComboFix.exe

Command switches used :: c:\documents and settings\Mr. Bojangles\Desktop\CFScript.txt.txt

AV: AVG Anti-Virus *Enabled/Updated* {17DDD097-36FF-435F-9E1B-52D74245D6BF}

AV: Lavasoft Ad-Watch Live! Anti-Virus *Disabled/Updated* {A1C4F2E0-7FDE-4917-AFAE-013EFC3EDE33}

AV: Symantec AntiVirus Corporate Edition *Disabled/Outdated* {FB06448E-52B8-493A-90F3-E43226D3305C}

FW: Symantec Client Firewall *Disabled* {5CB76A43-5FAD-476B-B9FF-26FA61F13187}

.

((((((((((((((((((((((((( Files Created from 2013-02-08 to 2013-03-08 )))))))))))))))))))))))))))))))

.

2013-03-08 20:31 . 2013-03-08 20:31 -------- d-----w- C:\TDSSKiller_Quarantine