Google redirect malware IE and Firefox (scour)

Royboyct · April 24, 2013

Hello - I have been infected with this and have had no luck removing with standard products so I came to the boards seeking assistance. Next post is the dds.scr logs and I also took the initiative to disable the anti-virus stuff and did the Combofix and AdwCleaner apps and have included their logs in the post below based on previous posts on this issue here on these boards. I also hit immediate to Auto follow topics I reply to. Thanks in advance for your assistance.

Royboyct · April 24, 2013

DDS.txt log:DDS (Ver_2012-11-20.01) - NTFS_AMD64

Internet Explorer: 10.0.9200.16537 BrowserJavaVersion: 10.7.2

Run by RVW at 21:54:14 on 2013-04-23

Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.5589.2921 [GMT -4:00]

.

AV: Norton Security Suite *Disabled/Updated* {63DF5164-9100-186D-2187-8DC619EFD8BF}

SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

SP: Norton Security Suite *Disabled/Updated* {D8BEB080-B73A-17E3-1B37-B6B462689202}

FW: Norton Security Suite *Disabled* {5BE4D041-DB6F-1935-0AD8-24F3E73C9FC4}

.

============== Running Processes ===============

.

C:\Windows\system32\lsm.exe

C:\Windows\system32\svchost.exe -k DcomLaunch

C:\Windows\system32\svchost.exe -k RPCSS

C:\Windows\system32\atiesrxx.exe

C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted

C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted

C:\Windows\system32\svchost.exe -k LocalService

C:\Windows\system32\svchost.exe -k netsvcs

C:\Windows\system32\svchost.exe -k NetworkService

C:\Windows\system32\atieclxx.exe

C:\Windows\System32\spoolsv.exe

C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork

C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe

C:\Windows\system32\taskhost.exe

C:\Windows\system32\Dwm.exe

C:\Windows\Explorer.EXE

C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

C:\Program Files (x86)\Microsoft\BingBar\SeaPort.EXE

C:\Program Files\Bonjour\mDNSResponder.exe

C:\ProgramData\EPSON\EPW!3 SSRP\E_S40RPB.EXE

C:\Program Files (x86)\Garmin\Core Update Service\Garmin.Cartography.MapUpdate.CoreService.exe

C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe

C:\Program Files (x86)\Garmin\Express Tray\ExpressTray.exe

C:\Program Files (x86)\Strongvault Online Backup\BackupAgent.exe

C:\Program Files (x86)\PFU\ScanSnap\CardMinder\CardLauncher.exe

C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe

C:\Program Files (x86)\McAfee Security Scan\3.0.318\SSScheduler.exe

C:\Program Files (x86)\CyberLink\PowerDVD10\PDVD10Serv.exe

C:\Program Files (x86)\Gateway\Hotkey Utility\HotkeyUtility.exe

C:\Program Files (x86)\NETGEAR\WNA1000M\WNA1000M.exe

C:\Program Files (x86)\PFU\ScanSnap\Driver\PfuSsMon.exe

C:\Windows\SSDriver\fi5110\SsWiaChecker.exe

C:\Program Files (x86)\Sony\PMB\PMBVolumeWatcher.exe

C:\Program Files (x86)\iTunes\iTunesHelper.exe

C:\Program Files (x86)\Sony\ReaderDesktop\appHelper\ReaderAppHelper.exe

C:\Program Files (x86)\Gateway\Registration\GREGsvc.exe

C:\Program Files\Gateway\Gateway Updater\UpdaterService.exe

C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe

C:\Program Files (x86)\Seagate\Seagate Dashboard\MemeoDashboard.exe

C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe

C:\Windows\system32\taskeng.exe

C:\Program Files (x86)\Memeo\AutoBackup\MemeoBackgroundService.exe

C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe

C:\Program Files (x86)\Memeo\AutoBackup\InstantBackup.exe

C:\Program Files (x86)\CyberLink\MediaEspresso\DeviceDetector\DeviceDetector.exe

C:\Program Files (x86)\Memeo\AutoBackup\MemeoUpdater.exe

C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe

C:\Program Files (x86)\Sony\PMB\PMBDeviceInfoProvider.exe

C:\Program Files (x86)\Seagate\Seagate Dashboard\SeagateDashboardService.exe

C:\Windows\system32\svchost.exe -k imgsvc

C:\Program Files (x86)\NETGEAR\WNA1000M\WlanWpsSvc.exe

C:\Program Files (x86)\Constant Guard Protection Suite\IDVaultSvc.exe

C:\Windows\system32\wbem\wmiprvse.exe

C:\Program Files\iPod\bin\iPodService.exe

C:\Windows\system32\SearchIndexer.exe

C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe

C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted

C:\Program Files (x86)\Norton Security Suite\Engine\20.2.0.19\ccSvcHst.exe

C:\Windows\system32\wbem\wmiprvse.exe

C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation

C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe

C:\Program Files\Windows Media Player\wmpnetwk.exe

C:\Windows\System32\WUDFHost.exe

C:\Program Files (x86)\Seagate\Seagate Dashboard\HipServAgent\HipServAgent.exe

C:\Program Files (x86)\Norton Security Suite\Engine\20.2.0.19\ccSvcHst.exe

C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe

C:\Program Files\Internet Explorer\iexplore.exe

C:\Windows\system32\Macromed\Flash\FlashUtil64_11_5_502_146_ActiveX.exe

C:\Program Files (x86)\Microsoft Office\Office14\OUTLOOK.EXE

C:\Program Files (x86)\Nero\Update\NASvc.exe

C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE

C:\Windows\system32\wuauclt.exe

C:\Windows\System32\svchost.exe -k LocalServicePeerNet

C:\Program Files (x86)\Constant Guard Protection Suite\IDVault.exe

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

C:\ComboFix\CF12423.3XE

C:\Windows\System32\MsSpellCheckingFacility.exe

C:\Program Files (x86)\Microsoft Office\Office14\MSACCESS.EXE

C:\Windows\system32\notepad.exe

C:\Windows\NIRCMD.exe

C:\Windows\system32\SearchProtocolHost.exe

C:\Windows\system32\SearchFilterHost.exe

C:\ComboFix\pev.3XE

C:\Windows\System32\cscript.exe

.

============== Pseudo HJT Report ===============

.

uStart Page = hxxp://www.google.com/ig

mStart Page = hxxp://start.sweetpacks.com/?src=10&st=12&crg=3.5000006.10042&barid={9D7ACCE5-AA9D-11E2-A882-F80F4144A662}

BHO: MSS+ Identifier: {0E8A89AD-95D7-40EB-8D9D-083EF7066A01} - C:\Program Files (x86)\McAfee Security Scan\3.0.318\McAfeeMSS_IE.dll

BHO: Adobe PDF Link Helper: {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

BHO: XFINITY Toolbar: {4b9bcce8-a70b-402a-a7e1-db96831ee26f} - C:\Program Files (x86)\xfin_portal\comcastdx.dll

BHO: Norton Identity Protection: {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files (x86)\Norton Security Suite\Engine\20.2.0.19\coieplg.dll

BHO: Norton Vulnerability Protection: {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files (x86)\Norton Security Suite\Engine\20.2.0.19\ips\ipsbho.dll

BHO: Groove GFS Browser Helper: {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files (x86)\Microsoft Office\Office14\GROOVEEX.DLL

BHO: Java Plug-In SSV Helper: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll

BHO: Windows Live ID Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

BHO: Office Document Cache Handler: {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL

BHO: Constant Guard Protection Suite: {B84CDBE7-1B46-494B-A188-01D4C52DEB61} - C:\ProgramData\White Sky, Inc\ID Vault\IEBHO1.13.410.2\NativeBHO.dll

BHO: Updater For XFIN_PORTAL: {bb46be07-13eb-4c49-b0f0-fc78b9ea4983} - C:\Program Files (x86)\xfin_portal\auxi\comcastAu.dll

BHO: Bing Bar Helper: {d2ce3e00-f94a-4740-988e-03dc2f38c34f} -

BHO: Java Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll

TB: Norton Toolbar: {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton Security Suite\Engine\20.2.0.19\coieplg.dll

TB: Bing Bar: {8dcb7100-df86-4384-8842-8fa844297b3f} -

TB: XFINITY Toolbar: {4b9bcce8-a70b-402a-a7e1-db96831ee26f} - C:\Program Files (x86)\xfin_portal\comcastdx.dll

TB: Norton Toolbar: {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton Security Suite\Engine\20.2.0.19\coieplg.dll

uRun: [GarminExpressTrayApp] "C:\Program Files (x86)\Garmin\Express Tray\ExpressTray.exe"

uRun: [backupAgent] C:\Program Files (x86)\Strongvault Online Backup\BackupAgent.exe

mRun: [Norton Online Backup] C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuClient.exe

mRun: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"

mRun: [startCCC] "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun

mRun: [RemoteControl10] "C:\Program Files (x86)\CyberLink\PowerDVD10\PDVD10Serv.exe"

mRun: [Hotkey Utility] C:\Program Files (x86)\Gateway\Hotkey Utility\HotkeyUtility.exe

mRun: [bCSSync] "C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe" /DelayServices

mRun: [Memeo Instant Backup] C:\Program Files (x86)\Memeo\AutoBackup\MemeoLauncher2.exe --silent --no_ui

mRun: [seagate Dashboard] C:\Program Files (x86)\Seagate\Seagate Dashboard\MemeoLauncher.exe --silent --no_ui

mRun: [scanSnap WIA Service Checker] C:\Windows\SSDriver\fi5110\SsWiaChecker.exe

mRun: [APSDaemon] "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe"

mRun: [PMBVolumeWatcher] C:\Program Files (x86)\Sony\PMB\PMBVolumeWatcher.exe

mRun: [iTunesHelper] "C:\Program Files (x86)\iTunes\iTunesHelper.exe"

mRun: [Reader Application Helper] C:\Program Files (x86)\Sony\ReaderDesktop\appHelper\ReaderAppHelper.exe

mRun: [sMessaging] "C:\Users\RVW\AppData\Local\Strongvault Online Backup\SMessaging.exe"

StartupFolder: C:\Users\RVW\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\FUJITS~1.LNK - C:\Program Files (x86)\Fujitsu\LeaderTech\fujitsuWebview-Release.exe

StartupFolder: C:\Users\RVW\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\STRONG~1.LNK - C:\Users\RVW\AppData\Local\Strongvault\StrongVaultApp.exe

StartupFolder: C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\Startup\CARDMI~1.LNK - C:\Program Files (x86)\PFU\ScanSnap\CardMinder\CardLauncher.exe

StartupFolder: C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\Startup\CONSTA~1.LNK - C:\Program Files (x86)\Constant Guard Protection Suite\IDVault.exe

StartupFolder: C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\Startup\CONVER~1.LNK - C:\Program Files (x86)\PFU\ScanSnap\Organizer\PfuSsOrgOcrChk.exe

StartupFolder: C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\Startup\MCAFEE~1.LNK - C:\Program Files (x86)\McAfee Security Scan\3.0.318\SSScheduler.exe

StartupFolder: C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\Startup\NETGEA~1.LNK - C:\Program Files (x86)\NETGEAR\WNA1000M\WNA1000M.exe

StartupFolder: C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\Startup\SCANSN~1.LNK - C:\Program Files (x86)\PFU\ScanSnap\Driver\PfuSsMon.exe

uPolicies-Explorer: NoDriveTypeAutoRun = dword:145

uPolicies-Explorer: NoDrives = dword:0

mPolicies-Explorer: NoDrives = dword:0

mPolicies-System: ConsentPromptBehaviorAdmin = dword:5

mPolicies-System: ConsentPromptBehaviorUser = dword:3

mPolicies-System: EnableUIADesktopToggle = dword:0

IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll

IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIE.dll

IE: {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - {FFFDC614-B694-4AE6-AB38-5D6374584B52} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIELinkedNotes.dll

IE: {A95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\Program Files (x86)\Evernote\Evernote\EvernoteIE.dll/204

DPF: Garmin Communicator Plug-In - hxxps://static.garmincdn.com/gcp/ie/4.0.4.0/GarminAxControl_32.CAB

TCP: NameServer = 192.168.1.1

TCP: Interfaces\{47B82A67-5F32-4588-A0A0-24E77B60BAF6} : NameServer = 75.75.75.75,75.75.76.76

TCP: Interfaces\{47B82A67-5F32-4588-A0A0-24E77B60BAF6} : DHCPNameServer = 192.168.1.1

TCP: Interfaces\{47B82A67-5F32-4588-A0A0-24E77B60BAF6}\7516C647F6E6 : NameServer = 75.75.75.75,75.75.76.76

TCP: Interfaces\{47B82A67-5F32-4588-A0A0-24E77B60BAF6}\7516C647F6E6 : DHCPNameServer = 192.168.1.1

TCP: Interfaces\{47B82A67-5F32-4588-A0A0-24E77B60BAF6}\876696E696479727F657475627 : DHCPNameServer = 75.75.75.75 75.75.76.76

TCP: Interfaces\{47B82A67-5F32-4588-A0A0-24E77B60BAF6}\E4544574541425F5548545 : DHCPNameServer = 192.168.1.250

Filter: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL

Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll

Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files (x86)\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll

SSODL: WebCheck - <orphaned>

SEH: Groove GFS Stub Execution Hook - {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\Program Files (x86)\Microsoft Office\Office14\GROOVEEX.DLL

x64-BHO: Groove GFS Browser Helper: {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL

x64-BHO: Windows Live ID Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

x64-BHO: Office Document Cache Handler: {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL

x64-Run: [RTHDVCPL] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe -s

x64-IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - C:\Program Files\Microsoft Office\Office14\ONBttnIE.dll

x64-IE: {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - {FFFDC614-B694-4AE6-AB38-5D6374584B52} - C:\Program Files\Microsoft Office\Office14\ONBttnIELinkedNotes.dll

x64-Filter: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL

x64-Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - <orphaned>

x64-Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - <orphaned>

x64-SSODL: WebCheck - <orphaned>

x64-SEH: Groove GFS Stub Execution Hook - {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL

.

================= FIREFOX ===================

.

FF - ProfilePath - C:\Users\RVW\AppData\Roaming\Mozilla\Firefox\Profiles\csa42lfo.default\

FF - prefs.js: browser.search.defaulturl -

FF - prefs.js: browser.search.selectedEngine - Bing

FF - prefs.js: browser.startup.homepage - hxxp://start.sweetpacks.com/?src=10&st=12&crg=3.5000006.10042&barid={9D7ACCE5-AA9D-11E2-A882-F80F4144A662}

FF - prefs.js: keyword.URL - hxxp://search.xfinity.com/?cat=web&con=toolbar&cid=xfstart_tech_search&q=

FF - plugin: C:\PROGRA~2\MICROS~4\Office14\NPAUTHZ.DLL

FF - plugin: C:\PROGRA~2\MICROS~4\Office14\NPSPWRAP.DLL

FF - plugin: C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll

FF - plugin: C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll

FF - plugin: C:\Program Files (x86)\McAfee Security Scan\3.0.318\npMcAfeeMSS.dll

FF - plugin: c:\Program Files (x86)\Microsoft Silverlight\5.1.20125.0\npctrlui.dll

FF - plugin: C:\Program Files (x86)\Sony\ReaderDesktop\npreaderdetectmoz.dll

FF - plugin: C:\Program Files (x86)\WildTangent Games\App\BrowserIntegration\Registered\0\NP_wtapp.dll

FF - plugin: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll

FF - plugin: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_5_502_146.dll

FF - plugin: C:\Windows\SysWOW64\npDeployJava1.dll

FF - plugin: C:\Windows\SysWOW64\npmproxy.dll

FF - ExtSQL: 2013-04-21 10:26; {4b9bcce8-a70b-402a-a7e1-db96831ee26f}; C:\Users\RVW\AppData\Roaming\Mozilla\Firefox\Profiles\csa42lfo.default\extensions\{4b9bcce8-a70b-402a-a7e1-db96831ee26f}

FF - ExtSQL: 2013-04-21 10:26; idvaultaddin@whitesky; C:\Users\RVW\AppData\Roaming\Mozilla\Firefox\Profiles\csa42lfo.default\extensions\idvaultaddin@whitesky

.

============= SERVICES / DRIVERS ===============

.

R0 amd_sata;amd_sata;C:\Windows\System32\drivers\amd_sata.sys [2011-10-26 79488]

R0 amd_xata;amd_xata;C:\Windows\System32\drivers\amd_xata.sys [2011-10-26 40064]

R0 SymDS;Symantec Data Store;C:\Windows\System32\drivers\N360x64\1402000.013\symds64.sys [2013-4-21 493216]

R0 SymEFA;Symantec Extended File Attributes;C:\Windows\System32\drivers\N360x64\1402000.013\symefa64.sys [2013-4-21 1133216]

R1 BHDrvx64;BHDrvx64;C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_20.1.0.24\Definitions\BASHDefs\20130412.001\BHDrvx64.sys [2013-4-13 1390680]

R1 ccSet_N360;Norton Security Suite Settings Manager;C:\Windows\System32\drivers\N360x64\1402000.013\ccsetx64.sys [2013-4-21 168096]

R1 IDSVia64;IDSVia64;C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_20.1.0.24\Definitions\IPSDefs\20130423.001\IDSviA64.sys [2013-4-23 513184]

R1 JSWPSLWF;JumpStart Wireless Filter Driver;C:\Windows\System32\drivers\jswpslwfx.sys [2008-10-1 26624]

R1 SymIRON;Symantec Iron Driver;C:\Windows\System32\drivers\N360x64\1402000.013\ironx64.sys [2013-4-21 224416]

R1 SymNetS;Symantec Network Security WFP Driver;C:\Windows\System32\drivers\N360x64\1402000.013\symnets.sys [2013-4-21 432800]

R2 AMD External Events Utility;AMD External Events Utility;C:\Windows\System32\atiesrxx.exe [2011-10-26 204288]

R2 BBUpdate;BBUpdate;C:\Program Files (x86)\Microsoft\BingBar\SeaPort.EXE [2011-5-12 249648]

R2 Garmin Core Update Service;Garmin Core Update Service;C:\Program Files (x86)\Garmin\Core Update Service\Garmin.Cartography.MapUpdate.CoreService.exe [2013-3-27 185688]

R2 GREGService;GREGService;C:\Program Files (x86)\Gateway\Registration\GREGsvc.exe [2011-5-29 36456]

R2 IDVaultSvc;CGPS Service;C:\Program Files (x86)\Constant Guard Protection Suite\IDVaultSvc.exe [2013-4-11 39976]

R2 Live Updater Service;Live Updater Service;C:\Program Files\Gateway\Gateway Updater\UpdaterService.exe [2011-10-25 255376]

R2 MBAMScheduler;MBAMScheduler;C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [2013-4-21 418376]

R2 MBAMService;MBAMService;C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2013-4-21 701512]

R2 MemeoBackgroundService;MemeoBackgroundService;C:\Program Files (x86)\Memeo\AutoBackup\MemeoBackgroundService.exe [2010-6-21 25824]

R2 N360;Norton Security Suite;C:\Program Files (x86)\Norton Security Suite\Engine\20.2.0.19\ccsvchst.exe [2013-4-21 143928]

R2 NAUpdate;Nero Update;C:\Program Files (x86)\Nero\Update\NASvc.exe [2011-3-29 598312]

R2 NOBU;Norton Online Backup;C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe [2010-6-1 2804568]

R2 PMBDeviceInfoProvider;PMBDeviceInfoProvider;C:\Program Files (x86)\Sony\PMB\PMBDeviceInfoProvider.exe [2011-8-24 430136]

R2 SeagateDashboardService;Seagate Dashboard Service;C:\Program Files (x86)\Seagate\Seagate Dashboard\SeagateDashboardService.exe [2011-11-3 8704]

R2 WlanWpsSvc;WlanWpsSvc;C:\Program Files (x86)\NETGEAR\WNA1000M\WlanWpsSvc.exe [2010-11-16 174560]

R3 amdhub30;AMD USB 3.0 Hub Driver;C:\Windows\System32\drivers\amdhub30.sys [2012-2-24 87168]

R3 amdxhc;AMD USB 3.0 Host Controller Driver;C:\Windows\System32\drivers\amdxhc.sys [2012-2-24 188544]

R3 AtiHDAudioService;AMD Function Driver for HD Audio Service;C:\Windows\System32\drivers\AtihdW76.sys [2011-10-26 231440]

R3 EraserUtilRebootDrv;EraserUtilRebootDrv;C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [2013-4-21 138912]

R3 MBAMProtector;MBAMProtector;C:\Windows\System32\drivers\mbam.sys [2013-4-21 25928]

R3 RTL8167;Realtek 8167 NT Driver;C:\Windows\System32\drivers\Rt64win7.sys [2011-10-25 533096]

R3 RTL8192cu;NETGEAR WNA1000M N150 Wireless USB Micro Adapter;C:\Windows\System32\drivers\WNA1000M.sys [2011-1-31 855144]

S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]

S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-3-18 138576]

S2 SkypeUpdate;Skype Updater;C:\Program Files (x86)\Skype\Updater\Updater.exe [2012-7-13 160944]

S3 BBSvc;Bing Bar Update Service;C:\Program Files (x86)\Microsoft\BingBar\BBSvc.EXE [2011-6-7 191752]

S3 GamesAppService;GamesAppService;C:\Program Files (x86)\WildTangent Games\App\GamesAppService.exe [2010-10-12 206072]

S3 jswpsapi;Jumpstart Wifi Protected Setup;C:\Program Files (x86)\NETGEAR\WNA1000\jswpsapi.exe --> C:\Program Files (x86)\NETGEAR\WNA1000\jswpsapi.exe [?]

S3 mbamchameleon;mbamchameleon;C:\Windows\System32\drivers\mbamchameleon.sys [2013-4-21 36680]

S3 McComponentHostService;McAfee Security Scan Component Host Service;C:\Program Files (x86)\McAfee Security Scan\3.0.318\McCHSvc.exe [2013-2-5 235216]

S3 PCAMp50a64;PCAMp50a64 NDIS Protocol Driver;C:\Windows\System32\drivers\PCAMp50a64.sys [2012-10-6 43328]

S3 PCASp50a64;PCASp50a64 NDIS Protocol Driver;C:\Windows\System32\drivers\PCASp50a64.sys [2012-10-6 41280]

S3 TsUsbFlt;TsUsbFlt;C:\Windows\System32\drivers\TsUsbFlt.sys [2010-11-20 59392]

S3 TsUsbGD;Remote Desktop Generic USB Device;C:\Windows\System32\drivers\TsUsbGD.sys [2010-11-20 31232]

S3 USBAAPL64;Apple Mobile USB Driver;C:\Windows\System32\drivers\usbaapl64.sys [2012-9-28 53760]

S3 WatAdminSvc;Windows Activation Technologies Service;C:\Windows\System32\Wat\WatAdminSvc.exe [2012-10-9 1255736]

S4 wlcrasvc;Windows Live Mesh remote connections service;C:\Program Files\Windows Live\Mesh\wlcrasvc.exe [2010-9-22 57184]

.

=============== Created Last 30 ================

.

2013-04-24 00:42:32 98816 ----a-w- C:\Windows\sed.exe

2013-04-24 00:42:32 256000 ----a-w- C:\Windows\PEV.exe

2013-04-24 00:42:32 208896 ----a-w- C:\Windows\MBR.exe

2013-04-24 00:42:27 -------- d-----w- C:\ComboFix

2013-04-22 03:08:27 36680 ----a-w- C:\Windows\System32\drivers\mbamchameleon.sys

2013-04-22 03:07:44 -------- d-----w- C:\Program Files (x86)\FileASSASSIN

2013-04-21 23:49:35 -------- d-----w- C:\Users\RVW\AppData\Roaming\Malwarebytes

2013-04-21 23:49:26 25928 ----a-w- C:\Windows\System32\drivers\mbam.sys

2013-04-21 23:49:26 -------- d-----w- C:\ProgramData\Malwarebytes

2013-04-21 23:49:26 -------- d-----w- C:\Program Files (x86)\Malwarebytes' Anti-Malware

2013-04-21 22:47:04 493216 ----a-w- C:\Windows\System32\drivers\N360x64\1402000.013\symds64.sys

2013-04-21 22:47:04 432800 ----a-r- C:\Windows\System32\drivers\N360x64\1402000.013\symnets.sys

2013-04-21 22:47:04 37496 ----a-r- C:\Windows\System32\drivers\N360x64\1402000.013\srtspx64.sys

2013-04-21 22:47:04 23448 ----a-r- C:\Windows\System32\drivers\N360x64\1402000.013\symelam.sys

2013-04-21 22:47:04 1133216 ----a-w- C:\Windows\System32\drivers\N360x64\1402000.013\symefa64.sys

2013-04-21 22:47:03 776864 ----a-w- C:\Windows\System32\drivers\N360x64\1402000.013\srtsp64.sys

2013-04-21 22:47:03 224416 ----a-r- C:\Windows\System32\drivers\N360x64\1402000.013\ironx64.sys

2013-04-21 22:47:03 168096 ----a-w- C:\Windows\System32\drivers\N360x64\1402000.013\ccsetx64.sys

2013-04-21 22:47:00 -------- d-----w- C:\Windows\System32\drivers\N360x64\1402000.013

2013-04-21 22:44:59 177312 ----a-w- C:\Windows\System32\drivers\SYMEVENT64x86.SYS

2013-04-21 22:44:59 -------- d-----w- C:\Program Files\Symantec

2013-04-21 22:44:59 -------- d-----w- C:\Program Files\Common Files\Symantec Shared

2013-04-21 22:44:29 -------- d-----w- C:\Windows\System32\drivers\N360x64

2013-04-21 22:44:28 -------- d-----w- C:\Program Files (x86)\Norton Security Suite

2013-04-21 22:44:23 -------- d-----w- C:\Program Files (x86)\NortonInstaller

2013-04-21 21:55:15 -------- d-----w- C:\Users\RVW\AppData\Local\Zemana

2013-04-21 16:08:25 -------- d--h--w- C:\ProgramData\Common Files

2013-04-21 16:08:25 -------- d-----w- C:\Users\RVW\AppData\Local\MFAData

2013-04-21 16:08:25 -------- d-----w- C:\Users\RVW\AppData\Local\Avg2013

2013-04-21 16:08:25 -------- d-----w- C:\ProgramData\MFAData

2013-04-21 16:08:16 -------- d-----w- C:\Users\RVW\AppData\Local\Supreme Savings

2013-04-21 15:15:41 388096 ----a-r- C:\Users\RVW\AppData\Roaming\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe

2013-04-21 15:15:41 -------- d-----w- C:\Program Files (x86)\Trend Micro

2013-04-21 15:14:16 -------- d-----w- C:\Users\RVW\AppData\Roaming\Strongvault

2013-04-21 15:14:05 -------- d-----w- C:\Program Files (x86)\Common Files\MSSoap

2013-04-21 15:14:00 -------- d-sh--w- C:\Windows\SysWow64\AI_RecycleBin

2013-04-21 15:13:58 -------- d-----w- C:\Users\RVW\AppData\Local\Strongvault Online Backup

2013-04-21 15:13:58 -------- d-----w- C:\Users\RVW\AppData\Local\Strongvault

2013-04-21 15:13:58 -------- d-----w- C:\ProgramData\Strongvault Online Backup

2013-04-21 15:13:58 -------- d-----w- C:\Program Files (x86)\Strongvault Online Backup

2013-04-21 15:13:49 -------- d-----w- C:\AI_RecycleBin

2013-04-21 14:43:46 -------- d-----w- C:\Program Files (x86)\Common Files\Symantec Shared

2013-04-21 14:35:31 -------- d-----w- C:\ProgramData\PCSettings

2013-04-21 14:27:11 -------- d-----w- C:\ProgramData\IsolatedStorage

2013-04-21 14:27:10 -------- d-----w- C:\Users\RVW\AppData\Local\White_Sky,_Inc

2013-04-21 14:27:06 -------- d-----w- C:\Users\RVW\AppData\Local\ID Vault

2013-04-21 14:26:45 -------- d-----w- C:\Users\RVW\AppData\Roaming\ID Vault

2013-04-21 14:26:27 -------- d-----w- C:\Users\RVW\AppData\Local\Programs

2013-04-21 14:26:19 -------- d-----w- C:\Program Files (x86)\xfin_portal

2013-04-21 14:26:13 -------- d-----w- C:\Program Files (x86)\Constant Guard Protection Suite

2013-04-21 14:26:00 -------- d-----w- C:\ProgramData\White Sky, Inc

2013-04-19 21:36:47 9317456 ----a-w- C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{3E4A6D1B-AA9F-4613-920C-2D25141AE0C6}\mpengine.dll

2013-04-19 02:06:24 -------- d-----w- C:\Users\RVW\AppData\Local\kinoma

2013-04-19 02:05:38 -------- d-----w- C:\Users\RVW\AppData\Local\Sony Corporation

2013-04-19 02:05:38 -------- d-----w- C:\Program Files (x86)\Common Files\Sony Shared

2013-04-19 01:19:08 -------- d-----w- C:\Users\RVW\AppData\Local\{0430F0BE-859B-41B6-8BB1-DC4563BD3EDE}

2013-04-18 23:21:23 -------- d-----w- C:\ProgramData\Garmin

2013-04-18 23:20:19 -------- d-----w- C:\ProgramData\Package Cache

2013-04-10 04:31:00 44032 ----a-w- C:\Windows\System32\tsgqec.dll

2013-04-10 04:31:00 3717632 ----a-w- C:\Windows\System32\mstscax.dll

2013-04-10 04:31:00 36864 ----a-w- C:\Windows\SysWow64\tsgqec.dll

2013-04-10 04:31:00 3217408 ----a-w- C:\Windows\SysWow64\mstscax.dll

2013-04-10 04:31:00 158720 ----a-w- C:\Windows\System32\aaclient.dll

2013-04-10 04:31:00 131584 ----a-w- C:\Windows\SysWow64\aaclient.dll

2013-04-10 04:30:56 3153408 ----a-w- C:\Windows\System32\win32k.sys

2013-04-10 04:30:55 223752 ----a-w- C:\Windows\System32\drivers\fvevol.sys

2013-04-10 04:30:55 1655656 ----a-w- C:\Windows\System32\drivers\ntfs.sys

2013-04-10 04:30:54 6656 ----a-w- C:\Windows\SysWow64\apisetschema.dll

2013-04-10 04:30:54 5550424 ----a-w- C:\Windows\System32\ntoskrnl.exe

2013-04-10 04:30:54 43520 ----a-w- C:\Windows\System32\csrsrv.dll

2013-04-10 04:30:54 3968856 ----a-w- C:\Windows\SysWow64\ntkrnlpa.exe

2013-04-10 04:30:54 3913560 ----a-w- C:\Windows\SysWow64\ntoskrnl.exe

2013-04-10 04:30:54 112640 ----a-w- C:\Windows\System32\smss.exe

2013-04-03 07:06:33 9728 ---ha-w- C:\Windows\SysWow64\api-ms-win-downlevel-shlwapi-l1-1-0.dll

2013-04-03 02:30:25 19968 ----a-w- C:\Windows\System32\drivers\usb8023.sys

.

==================== Find3M ====================

.

2013-04-03 07:06:33 9728 ---ha-w- C:\Windows\System32\api-ms-win-downlevel-shlwapi-l1-1-0.dll

2013-03-12 05:10:56 282744 ------w- C:\Windows\System32\MpSigStub.exe

2013-02-21 10:30:16 1766912 ----a-w- C:\Windows\SysWow64\wininet.dll

2013-02-21 10:29:39 2877440 ----a-w- C:\Windows\SysWow64\jscript9.dll

2013-02-21 10:29:37 61440 ----a-w- C:\Windows\SysWow64\iesetup.dll

2013-02-21 10:29:37 109056 ----a-w- C:\Windows\SysWow64\iesysprep.dll

2013-02-21 10:15:07 2240512 ----a-w- C:\Windows\System32\wininet.dll

2013-02-21 10:14:09 3958784 ----a-w- C:\Windows\System32\jscript9.dll

2013-02-21 10:14:05 67072 ----a-w- C:\Windows\System32\iesetup.dll

2013-02-21 10:14:05 136704 ----a-w- C:\Windows\System32\iesysprep.dll

2013-02-19 12:01:03 2706432 ----a-w- C:\Windows\SysWow64\mshtml.tlb

2013-02-19 11:42:14 2706432 ----a-w- C:\Windows\System32\mshtml.tlb

2013-02-19 11:10:53 71680 ----a-w- C:\Windows\SysWow64\RegisterIEPKEYs.exe

2013-02-19 10:51:18 89600 ----a-w- C:\Windows\System32\RegisterIEPKEYs.exe

2013-02-12 05:45:24 135168 ----a-w- C:\Windows\apppatch\AppPatch64\AcXtrnal.dll

2013-02-12 05:45:22 350208 ----a-w- C:\Windows\apppatch\AppPatch64\AcLayers.dll

2013-02-12 05:45:22 308736 ----a-w- C:\Windows\apppatch\AppPatch64\AcGenral.dll

2013-02-12 05:45:22 111104 ----a-w- C:\Windows\apppatch\AppPatch64\acspecfc.dll

2013-02-12 04:48:31 474112 ----a-w- C:\Windows\apppatch\AcSpecfc.dll

2013-02-12 04:48:26 2176512 ----a-w- C:\Windows\apppatch\AcGenral.dll

.

============= FINISH: 21:54:30.92 ===============

Royboyct · April 24, 2013

Attach.txt log:.

UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.

IF REQUESTED, ZIP IT UP & ATTACH IT

.

DDS (Ver_2012-11-20.01)

.

Microsoft Windows 7 Home Premium

Boot Device: \Device\HarddiskVolume2

Install Date: 8/12/2012 1:05:31 PM

System Uptime: 4/23/2013 8:14:20 PM (1 hours ago)

.

Motherboard: Gateway | | SX2370

Processor: AMD A6-3620 APU with Radeon HD Graphics | P0 | 2200/100mhz

.

==== Disk Partitions =========================

.

C: is FIXED (NTFS) - 1850 GiB total, 1742.824 GiB free.

D: is CDROM ()

E: is Removable

F: is Removable

G: is FIXED (FAT32) - 931 GiB total, 64.066 GiB free.

H: is CDROM ()

I: is FIXED (NTFS) - 466 GiB total, 157.102 GiB free.

X: is NetworkDisk (NTFS) - 932 GiB total, 822.432 GiB free.

Y: is NetworkDisk (NTFS) - 932 GiB total, 822.432 GiB free.

Z: is NetworkDisk (NTFS) - 932 GiB total, 822.432 GiB free.

.

==== Disabled Device Manager Items =============

.

Class GUID: {8ECC055D-047F-11D1-A537-0000F8753ED1}

Description: AntiLog32

Device ID: ROOT\LEGACY_ANTILOG32\0000

Manufacturer:

Name: AntiLog32

PNP Device ID: ROOT\LEGACY_ANTILOG32\0000

Service: AntiLog32

.

==== System Restore Points ===================

.

RP70: 4/10/2013 12:26:35 AM - Windows Update

RP71: 4/10/2013 3:00:30 AM - Windows Update

RP72: 4/18/2013 7:19:02 PM - Garmin Express

RP73: 4/18/2013 7:19:02 PM - Windows Update

RP74: 4/18/2013 10:05:20 PM - Installed Reader for PC.

RP75: 4/21/2013 11:15:20 AM - Installed HiJackThis

RP76: 4/21/2013 11:54:30 AM - Installed Kaspersky Anti-Virus 2011.

RP77: 4/21/2013 5:55:52 PM - Removed Internet Explorer Toolbar 4.7 by SweetPacks

RP78: 4/23/2013 8:42:45 PM - ComboFix created restore point

.

==== Installed Programs ======================

.

ABBYY FineReader for ScanSnap 4.1

Adobe AIR

Adobe Flash Player 11 ActiveX

Adobe Flash Player 11 Plugin

Adobe Reader X (10.1.0) MUI

Agatha Christie - Death on the Nile

AMD APP SDK Runtime

AMD VISION Engine Control Center

Apple Application Support

Apple Mobile Device Support

Apple Software Update

ATI Catalyst Install Manager

Bejeweled 2 Deluxe

Bing Bar

BitTorrent

Bonjour

Build-a-lot 4 - Power Source

CardMinder

CardMinder V4.1

Catalyst Control Center - Branding

Catalyst Control Center InstallProxy

Catalyst Control Center Localization All

ccc-utility64

CCC Help Chinese Standard

CCC Help Chinese Traditional

CCC Help Czech

CCC Help Danish

CCC Help Dutch

CCC Help English

CCC Help Finnish

CCC Help French

CCC Help German

CCC Help Greek

CCC Help Hungarian

CCC Help Italian

CCC Help Japanese

CCC Help Korean

CCC Help Norwegian

CCC Help Polish

CCC Help Portuguese

CCC Help Russian

CCC Help Spanish

CCC Help Swedish

CCC Help Thai

CCC Help Turkish

Chronicles of Albian

Constant Guard Protection Suite

Cradle of Rome 2

CyberLink MediaEspresso

CyberLink PowerDVD 10

D3DX10

Definition Update for Microsoft Office 2010 (KB982726) 32-Bit Edition

Dora's World Adventure

DVDFab 8.2.1.5 (10/10/2012) Qt

eBay Worldwide

Elevated Installer

EPSON Printer Software

EPSON Scan

Evernote v. 4.5.1

FileASSASSIN

Final Drive: Nitro

Galerie de photos Windows Live

Garmin Communicator Plugin x64

Garmin Express

Garmin Express Tray

Garmin Update Service

Gateway Games

Gateway Recovery Management

Gateway Registration

Gateway ScreenSaver

Gateway Updater

Governor of Poker 2 Premium Edition

HiJackThis

Hotkey Utility

HTML Image Splitter

Identity Card

ImgBurn

Ipswitch WS_FTP LE

iTunes

Java 7 Update 7

Java Auto Updater

Jewel Match 3

Junk Mail filter update

Malwarebytes Anti-Malware version 1.75.0.1300

McAfee Security Scan Plus

Memeo Instant Backup

Mesh Runtime

Microsoft .NET Framework 4 Client Profile

Microsoft Application Error Reporting

Microsoft Office 2010

Microsoft Office 2010 Service Pack 1 (SP1)

Microsoft Office Access MUI (English) 2010

Microsoft Office Access Setup Metadata MUI (English) 2010

Microsoft Office Excel MUI (English) 2010

Microsoft Office Groove MUI (English) 2010

Microsoft Office InfoPath MUI (English) 2010

Microsoft Office Office 64-bit Components 2010

Microsoft Office OneNote MUI (English) 2010

Microsoft Office Outlook MUI (English) 2010

Microsoft Office PowerPoint MUI (English) 2010

Microsoft Office Professional Plus 2010

Microsoft Office Proof (English) 2010

Microsoft Office Proof (French) 2010

Microsoft Office Proof (Spanish) 2010

Microsoft Office Proofing (English) 2010

Microsoft Office Publisher MUI (English) 2010

Microsoft Office Shared 64-bit MUI (English) 2010

Microsoft Office Shared 64-bit Setup Metadata MUI (English) 2010

Microsoft Office Shared MUI (English) 2010

Microsoft Office Shared Setup Metadata MUI (English) 2010

Microsoft Office Word MUI (English) 2010

Microsoft Silverlight

Microsoft SQL Server 2005 Compact Edition [ENU]

Microsoft Visual C++ 2005 Redistributable

Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148

Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161

Microsoft Visual C++ 2010 x64 Redistributable - 10.0.30319

Microsoft Visual C++ 2010 x86 Redistributable - 10.0.30319

Mozilla Firefox 19.0.2 (x86 en-US)

Mozilla Maintenance Service

MSVCRT

MSVCRT_amd64

MSXML 4.0 SP2 (KB954430)

MSXML 4.0 SP2 (KB973688)

MSXML 4.0 SP3 Parser

MSXML 4.0 SP3 Parser (KB2721691)

MSXML 4.0 SP3 Parser (KB2758694)

Mystery of Mortlake Mansion

Nero BackItUp 10

Nero BackItUp 10 Help (CHM)

Nero Control Center 10

Nero ControlCenter 10 Help (CHM)

Nero Core Components 10

Nero DiscSpeed 10

Nero DiscSpeed 10 Help (CHM)

Nero Express 10

Nero Express 10 Help (CHM)

Nero Multimedia Suite 10 Essentials

Nero RescueAgent 10

Nero RescueAgent 10 Help (CHM)

Nero StartSmart 10

Nero StartSmart 10 Help (CHM)

Nero Update

NETGEAR WNA1000M Wireless USB 2.0 Adapter

NOOK for PC

Norton Online Backup

Norton Security Suite

Paint Shop Pro 7 Try And Buy

Penguins!

Plants vs. Zombies - Game of the Year

PM/2 for Windows, Release 3.69.05

PMB

Polar Bowler

Polar Golfer

Reader for PC

Realtek Ethernet Controller Driver

Realtek High Definition Audio Driver

Revo Uninstaller 1.94

ScanSnap

ScanSnap Manager

ScanSnap Organizer

Seagate Dashboard

Security Update for Microsoft .NET Framework 4 Client Profile (KB2604121)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2656351)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2656368v2)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2656405)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2686827)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2729449)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2737019)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2742595)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2789642)

Security Update for Microsoft Excel 2010 (KB2597126) 32-Bit Edition

Security Update for Microsoft Filter Pack 2.0 (KB2553501) 32-Bit Edition

Security Update for Microsoft InfoPath 2010 (KB2687422) 32-Bit Edition

Security Update for Microsoft InfoPath 2010 (KB2760406) 32-Bit Edition

Security Update for Microsoft Office 2010 (KB2553091)

Security Update for Microsoft Office 2010 (KB2553096)

Security Update for Microsoft Office 2010 (KB2553371) 32-Bit Edition

Security Update for Microsoft Office 2010 (KB2553447) 32-Bit Edition

Security Update for Microsoft Office 2010 (KB2589320) 32-Bit Edition

Security Update for Microsoft Office 2010 (KB2598243) 32-Bit Edition

Security Update for Microsoft Office 2010 (KB2687501) 32-Bit Edition

Security Update for Microsoft Office 2010 (KB2687510) 32-Bit Edition

Security Update for Microsoft OneNote 2010 (KB2760600) 32-Bit Edition

Security Update for Microsoft Visio 2010 (KB2760762) 32-Bit Edition

Security Update for Microsoft Visio Viewer 2010 (KB2687505) 32-Bit Edition

Security Update for Microsoft Word 2010 (KB2760410) 32-Bit Edition

Skype™ 5.10

Strongvault Online Backup

Times Reader

Torchlight

Update for Microsoft .NET Framework 4 Client Profile (KB2468871)

Update for Microsoft .NET Framework 4 Client Profile (KB2533523)

Update for Microsoft .NET Framework 4 Client Profile (KB2600217)

Update for Microsoft Office 2010 (KB2553065)

Update for Microsoft Office 2010 (KB2553092)

Update for Microsoft Office 2010 (KB2553181) 32-Bit Edition

Update for Microsoft Office 2010 (KB2553267) 32-Bit Edition

Update for Microsoft Office 2010 (KB2553310) 32-Bit Edition

Update for Microsoft Office 2010 (KB2553378) 32-Bit Edition

Update for Microsoft Office 2010 (KB2566458)

Update for Microsoft Office 2010 (KB2596964) 32-Bit Edition

Update for Microsoft Office 2010 (KB2598242) 32-Bit Edition

Update for Microsoft Office 2010 (KB2687503) 32-Bit Edition

Update for Microsoft Office 2010 (KB2687509) 32-Bit Edition

Update for Microsoft Office 2010 (KB2760631) 32-Bit Edition

Update for Microsoft Office 2010 (KB2767886) 32-Bit Edition

Update for Microsoft OneNote 2010 (KB2553290) 32-Bit Edition

Update for Microsoft Outlook 2010 (KB2597090) 32-Bit Edition

Update for Microsoft Outlook 2010 (KB2687623) 32-Bit Edition

Update for Microsoft Outlook Social Connector 2010 (KB2553406) 32-Bit Edition

Update for Microsoft PowerPoint 2010 (KB2598240) 32-Bit Edition

Update for Microsoft SharePoint Workspace 2010 (KB2589371) 32-Bit Edition

Update Installer for WildTangent Games App

Virtual Villagers 5 - New Believers

Welcome Center

WildTangent Games App (Gateway Games)

Windows Live

Windows Live Communications Platform

Windows Live Essentials

Windows Live ID Sign-in Assistant

Windows Live Installer

Windows Live Language Selector

Windows Live Mail

Windows Live Mesh

Windows Live Messenger

Windows Live MIME IFilter

Windows Live Movie Maker

Windows Live Photo Common

Windows Live Photo Gallery

Windows Live PIMT Platform

Windows Live Remote Client

Windows Live Remote Client Resources

Windows Live Remote Service

Windows Live Remote Service Resources

Windows Live SOXE

Windows Live SOXE Definitions

Windows Live UX Platform

Windows Live UX Platform Language Pack

Windows Live Writer

Windows Live Writer Resources

WinRAR archiver

WNA1000

XFINITY Toolbar

Zuma's Revenge

.

==== Event Viewer Messages From Past Week ========

.

4/23/2013 9:05:38 PM, Error: Service Control Manager [7030] - The PEVSystemStart service is marked as an interactive service. However, the system is configured to not allow interactive services. This service may not function properly.

4/23/2013 8:53:18 PM, Error: Application Popup [1060] - \??\C:\ComboFix\catchme.sys has been blocked from loading due to incompatibility with this system. Please contact your software vendor for a compatible version of the driver.

4/23/2013 8:15:27 PM, Error: Microsoft-Windows-WLAN-AutoConfig [10000] - WLAN Extensibility Module has failed to start. Module Path: C:\Windows\system32\Rtlihvs.dll Error Code: 126

4/23/2013 6:00:57 PM, Error: Microsoft-Windows-HAL [12] - The platform firmware has corrupted memory across the previous system power transition. Please check for updated firmware for your system.

4/21/2013 11:58:51 AM, Error: Service Control Manager [7022] - The Windows Search service hung on starting.

4/21/2013 10:32:17 AM, Error: bowser [8003] - The master browser has received a server announcement from the computer OWNER-PC that believes that it is the master browser for the domain on transport NetBT_Tcpip_{47B82A67-5F32-4588-A0A0-24E77B60BAF6}. The master browser is stopping or an election is being forced.

4/21/2013 10:26:52 AM, Error: Service Control Manager [7030] - The CGPS Service service is marked as an interactive service. However, the system is configured to not allow interactive services. This service may not function properly.

.

==== End Of File ===========================

Royboyct · April 24, 2013

Combofix Log:.