MoneyPak ransomware -- need help with removal -- thank you

Jetter · April 25, 2013

Hello.

I am having a problem with a Dell Inspiron One all-in-one desktop pc. It belongs to a friend of mine and she needs to get it fixed as she is taking online schooling and has material for her classes stored on it.

I have it with me now and I have told her that I will ask for help from a good malware removal specialist.

There are 2 user accounts on the pc -- one is hers with administrator privilages and the other does not have admin privys. The admin account is the one infected with MoneyPak. I can log into the other account all right.

I found the rkill/Malwarebytes fix online but cannot boot the pc into safe mode, safe mode with networking, or safe mode with command prompt without the "FBI" warning popping up, freezing the computer, and asking for ransom.

Naturally, I also cannot install any programs from the limited-privileged user account; not even dds.

We would be very grateful if someone here can help us resolve this issue and restore the pc back to normal.

Thank you.

MrCharlie · April 25, 2013

is is how we deal with that infection:

Please download Farbar Recovery Scan Tool and save it to a flash drive.
Note: You need to run the version compatible with your system. If you are not sure which version applies to your system download both of them and try to run them. Only one of them will run on your system, that will be the right version.
Plug the flash drive into the infected PC.
If you are using Windows 8 consult How to use the Windows 8 System Recovery Environment Command Prompt to enter System Recovery Command prompt.
If you are using Vista or Windows 7 enter System Recovery Options.
To enter System Recovery Options from the Advanced Boot Options:
- Restart the computer.
- As soon as the BIOS is loaded begin tapping the F8 key until Advanced Boot Options appears.
- Use the arrow keys to select the Repair your computer menu item.
- Select US as the keyboard language settings, and then click Next.
- Select the operating system you want to repair, and then click Next.
- Select your user account an click Next.

Note: In case you can not enter System Recovery Options by using F8 method, you can use Windows installation disc, or make a repair disc. Any Windows installation disc or a repair disc made on another computer can be used.

To make a repair disk on Windows 7 consult: http://www.sevenforu...isc-create.html

To enter System Recovery Options by using Windows installation disc:

Insert the installation disc.
Restart your computer.
If prompted, press any key to start Windows from the installation disc. If your computer is not configured to start from a CD or DVD, check your BIOS settings.
Click Repair your computer.
Select US as the keyboard language settings, and then click Next.
Select the operating system you want to repair, and then click Next.
Select your user account and click Next.

On the System Recovery Options menu you will get the following options:
- - Startup Repair
    System Restore
    Windows Complete PC Restore
    Windows Memory Diagnostic Tool
    Command Prompt
    Select Command Prompt
    Once in the Command Prompt:
  [*]In the command window type in notepad and press Enter.
  [*]The notepad opens. Under File menu select Open.
  [*]Select "Computer" and find your flash drive letter and close the notepad.
  [*]In the command window type e:\frst (for x64 bit version type e:\frst64) and press Enter
  Note: Replace letter e with the drive letter of your flash drive.
  [*]The tool will start to run.
  [*]When the tool opens click Yes to disclaimer.
  [*]Press Scan button.
  [*]It will make a log (FRST.txt) on the flash drive. Please copy and paste it to your reply.
MrC

Jetter · April 25, 2013

Thank you so much for the fast response MrCharlie. Here is the log:

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 25-04-2013

Ran by SYSTEM on 25-04-2013 19:48:05

Running from F:\

Windows 7 Home Premium (X64) OS Language: English(US)

Internet Explorer Version 9

Boot Mode: Recovery

The current controlset is ControlSet001

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [igfxTray] "C:\Windows\system32\igfxtray.exe" [161304 2010-08-25] (Intel Corporation)

HKLM\...\Run: [HotKeysCmds] "C:\Windows\system32\hkcmd.exe" [386584 2010-08-25] (Intel Corporation)

HKLM\...\Run: [Persistence] "C:\Windows\system32\igfxpers.exe" [415256 2010-08-25] (Intel Corporation)

HKLM\...\Run: [Trend Micro Titanium] "C:\Program Files\Trend Micro\Titanium\UIFramework\uiWinMgr.exe" -set Silent "1" SplashURL "" [1111568 2011-10-08] (Trend Micro Inc.)

HKLM\...\Run: [Trend Micro Client Framework] "C:\Program Files\Trend Micro\UniClient\UiFrmWrk\UIWatchDog.exe" [197152 2011-02-10] (Trend Micro Inc.)

HKLM-x32\...\RunOnce: [sTToasterLauncher] C:\program files (x86)\Dell DataSafe Local Backup\toasterLauncher.exe [120048 2009-09-17] ()

Winlogon\Notify\GoToAssist: C:\Program Files (x86)\Citrix\GoToAssist\514\G2AWinLogon_x64.dll [X]

HKLM-x32\...\Run: [iYogiToolbar] C:\Program Files (x86)\iYogi SupportDock\iYogiSupportDock.exe [x]

HKLM-x32\...\Run: [dellsupportcenter] "C:\Program Files (x86)\Dell Support Center\bin\sprtcmd.exe" /P dellsupportcenter [x]

HKLM-x32\...\Run: [brMfcWnd] "C:\Program Files (x86)\Brother\Brmfcmon\BrMfcWnd.exe" /AUTORUN [1159168 2009-05-26] (Brother Industries, Ltd.)

HKLM-x32\...\Run: [ControlCenter3] "C:\Program Files (x86)\Brother\ControlCenter3\brctrcen.exe" /autorun [114688 2008-12-24] (Brother Industries, Ltd.)

HKLM-x32\...\Run: [sweetIM] "C:\Program Files (x86)\SweetIM\Messenger\SweetIM.exe" [x]

HKLM-x32\...\Run: [DATAMNGR] C:\PROGRA~2\IMESHA~1\MediaBar\Datamngr\DATAMN~1.EXE [x]

HKLM-x32\...\Run: [APSDaemon] "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [59720 2013-01-28] (Apple Inc.)

HKLM-x32\...\Run: [instaLAN] "C:\Program Files (x86)\Belkin\Router Setup and Monitor\BelkinRouterMonitor.exe" startup [2015136 2011-05-27] (Affinegy, Inc.)

HKLM-x32\...\Run: [sunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe" [254696 2011-06-09] (Sun Microsystems, Inc.)

HKLM-x32\...\Run: [Adobe Reader Speed Launcher] "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe" [38872 2012-07-31] (Adobe Systems Incorporated)

HKLM-x32\...\Run: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [946352 2012-12-03] (Adobe Systems Incorporated)

HKLM-x32\...\Run: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime [421888 2012-10-25] (Apple Inc.)

HKLM-x32\...\Run: [iTunesHelper] "C:\Program Files (x86)\iTunes\iTunesHelper.exe" [152392 2013-02-20] (Apple Inc.)

HKU\dorothy\...\Run: [startup Manager] "C:\Program Files (x86)\iYogi SupportDock\Optimize\startupmanager.exe" [x]

HKU\dorothy\...\Run: [msnmsgr] ~"C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe" /background [4280184 2012-03-08] (Microsoft Corporation)

HKU\dorothy\...\Run: [TrendSecure Remote File Lock] "C:\Program Files\Trend Micro\TrendSecure\RemoteFileLock\FLMain.exe" /lock [x]

HKU\dorothy\...\Run: [swg] "C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [39408 2011-01-04] (Google Inc.)

HKU\dorothy\...\Run: [searchEngineProtection] "C:\Program Files (x86)\Gamesbar\SearchEngineProtection.exe" [546192 2010-10-17] (Oberon Media )

HKU\dorothy\...\Run: [Google Update] "C:\Users\dorothy\AppData\Local\Google\Update\GoogleUpdate.exe" /c [136176 2011-06-04] (Google Inc.)

HKU\dorothy\...\Run: [Messenger (Yahoo!)] ~"C:\PROGRA~2\Yahoo!\Messenger\YahooMessenger.exe" -quiet [6276408 2011-08-22] (Yahoo! Inc.)

HKU\dorothy\...\Run: [MotoCast] "C:\Program Files (x86)\Motorola Mobility\MotoCast\MotoLauncher.lnk" [2053 2012-08-01] ()

HKU\dorothy\...\Run: [spybot-S&D Cleaning] "E:\SpybotPortable\App\Spybot\SDCleaner.exe" /autoclean [x]

HKU\dorothy\...\Policies\system: [LogonHoursAction] 2

HKU\dorothy\...\Policies\system: [DontDisplayLogonHoursWarnings] 1

HKU\dorothy\...\Winlogon: [shell] C:\Users\dorothy\AppData\Roaming\i.ini,explorer.exe

HKU\Jake\...\Run: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime [421888 2012-10-25] (Apple Inc.)

HKU\Jake\...\Run: [Google Update] "C:\Users\Jake\AppData\Local\Google\Update\GoogleUpdate.exe" /c [116648 2012-09-21] (Google Inc.)

HKU\Jake\...\Policies\system: [LogonHoursAction] 2

HKU\Jake\...\Policies\system: [DontDisplayLogonHoursWarnings] 1

AppInit_DLLs: C:\PROGRA~2\IMESHA~1\MediaBar\Datamngr\x64\datamngr.dll C:\PROGRA~2\IMESHA~1\MediaBar\Datamngr\x64\IEBHO.dll [1792904 2011-08-09] (iMesh, Inc)

Startup: C:ProgramData\Start Menu\Programs\Startup\Rand McNally Dock.lnk

ShortcutTarget: Rand McNally Dock.lnk -> C:\Program Files (x86)\Rand McNally\RNDDock\StartupLauncher.bat ()

Startup: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dell Dock First Run.lnk

ShortcutTarget: Dell Dock First Run.lnk -> C:\Program Files\Dell\DellDock\DellDock.exe (Stardock Corporation)

Startup: C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dell Dock First Run.lnk

ShortcutTarget: Dell Dock First Run.lnk -> C:\Program Files\Dell\DellDock\DellDock.exe (Stardock Corporation)

Startup: C:\Users\dorothy\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dell Dock.lnk

ShortcutTarget: Dell Dock.lnk -> C:\Program Files (x86)\Dell\DellDock\DellDock.exe (No File)

Startup: C:\Users\dorothy\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MP3 Rocket (Minimized).lnk

ShortcutTarget: MP3 Rocket (Minimized).lnk -> C:\Program Files (x86)\MP3 Rocket\MP3Rocket.exe ()

Startup: C:\Users\dorothy\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2007 Screen Clipper and Launcher.lnk

ShortcutTarget: OneNote 2007 Screen Clipper and Launcher.lnk -> C:\Program Files (x86)\Microsoft Office\Office12\ONENOTEM.EXE (Microsoft Corporation)

Startup: C:\Users\Jake\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dell Dock.lnk

ShortcutTarget: Dell Dock.lnk -> C:\Program Files\Dell\DellDock\DellDock.exe (Stardock Corporation)

==================== Services (Whitelisted) =================

S2 AffinegyService; C:\Program Files (x86)\Belkin\Router Setup and Monitor\BelkinService.exe [562592 2011-05-27] (Affinegy, Inc.)

S2 Motorola Device Manager; C:\Program Files (x86)\Motorola Mobility\Motorola Device Manager\MotoHelperService.exe [116632 2012-07-17] ()

S2 Amsp; "C:\Program Files\Trend Micro\AMSP\coreServiceShell.exe" coreFrameworkHost.exe -m=rb -dt=60000 [x]

S3 rpcapd; "%ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini" [x]

==================== Drivers (Whitelisted) ====================

S3 BrSerIf; C:\Windows\System32\DRIVERS\BrSerIf.sys [97280 2006-09-02] (Brother Industries Ltd.)

S3 MODEMCSA; C:\Windows\System32\drivers\MODEMCSA.sys [24064 2009-07-13] (Microsoft Corporation)

S3 NPF; C:\Windows\SysWow64\drivers\npf.sys [30336 2003-04-04] (Politecnico di Torino)

S3 RTL8192cu; C:\Windows\System32\DRIVERS\RTL8192cu.sys [762472 2011-05-03] (Realtek Semiconductor Corporation )

S2 tmactmon; C:\Windows\System32\DRIVERS\tmactmon.sys [90704 2011-03-16] (Trend Micro Inc.)

S2 tmcomm; C:\Windows\System32\DRIVERS\tmcomm.sys [144464 2011-03-16] (Trend Micro Inc.)

S2 tmevtmgr; C:\Windows\System32\DRIVERS\tmevtmgr.sys [67664 2011-03-16] (Trend Micro Inc.)

S1 tmtdi; C:\Windows\System32\DRIVERS\tmtdi.sys [105552 2011-03-16] (Trend Micro Inc.)

S3 VIACRX64; C:\Windows\System32\DRIVERS\viacr64.sys [100864 2009-07-14] (VIA Technologies, Inc. )

S2 TMAgent;

==================== NetSvcs (Whitelisted) ===================

==================== One Month Created Files and Folders ========

2013-04-25 19:47 - 2013-04-25 19:47 - 00000000 ____D C:\FRST

2013-04-25 16:54 - 2013-04-25 16:54 - 00688992 ____A (Swearware) C:\Users\Jake\Downloads\dds.scr

2013-04-25 16:54 - 2013-04-25 16:54 - 00688992 ____A (Swearware) C:\Users\Jake\Desktop\dds.scr

2013-04-25 01:33 - 2013-04-25 01:33 - 00000000 ____D C:\Users\Jake\Application Data\WinRAR

2013-04-25 01:33 - 2013-04-25 01:33 - 00000000 ____D C:\Users\Jake\AppData\Roaming\WinRAR

2013-04-25 01:02 - 2013-04-25 01:02 - 00001241 ____A C:\Users\Jake\Desktop\RKreport[1]_S_04252013_02d0202.txt

2013-04-25 00:59 - 2013-04-25 01:02 - 00000000 ____D C:\Users\Jake\Desktop\RK_Quarantine

2013-04-25 00:59 - 2013-04-25 00:59 - 00816128 ____A C:\Users\Jake\Downloads\RogueKiller.exe

2013-04-25 00:56 - 2013-04-25 00:56 - 02237968 ____A (Kaspersky Lab ZAO) C:\Users\Jake\Downloads\tdsskiller.exe

2013-04-25 00:56 - 2013-04-25 00:56 - 02237968 ____A (Kaspersky Lab ZAO) C:\Users\Jake\Desktop\tdsskiller.exe

2013-04-25 00:19 - 2013-04-25 16:22 - 00000314 ____A C:\Windows\setupact.log

2013-04-25 00:11 - 2013-04-25 00:15 - 00069819 ____A C:\Windows\wininit.ini

2013-04-24 23:32 - 2013-04-25 00:52 - 00000000 ____D C:ProgramData\Spybot - Search & Destroy

2013-04-24 23:32 - 2013-04-25 00:52 - 00000000 ____D C:ProgramData\Application Data\Spybot - Search & Destroy

2013-04-24 23:32 - 2013-04-24 23:32 - 00000000 ____D C:\Users\dorothy\My Documents\ProcAlyzer Dumps

2013-04-24 23:32 - 2013-04-24 23:32 - 00000000 ____D C:\Users\dorothy\Documents\ProcAlyzer Dumps

2013-04-24 23:26 - 2013-04-24 23:26 - 41763592 ____A (PortableApps.com) C:\Users\Jake\Downloads\SpybotPortable_2.0.12.paf.exe

2013-04-24 23:16 - 2013-04-24 23:16 - 00000000 ___AH C:\Users\Jake\My Documents\Default.rdp

2013-04-24 23:16 - 2013-04-24 23:16 - 00000000 ___AH C:\Users\Jake\Documents\Default.rdp

2013-04-24 22:27 - 2013-04-24 22:27 - 00000000 ____D C:\Users\dorothy\Local Settings\Application Data\{C13A4478-C08F-49FD-B131-A609AE9689C6}

2013-04-24 22:27 - 2013-04-24 22:27 - 00000000 ____D C:\Users\dorothy\Local Settings\{C13A4478-C08F-49FD-B131-A609AE9689C6}

2013-04-24 22:27 - 2013-04-24 22:27 - 00000000 ____D C:\Users\dorothy\AppData\Local\{C13A4478-C08F-49FD-B131-A609AE9689C6}

2013-04-24 21:29 - 2013-04-24 21:29 - 10285040 ____A (Malwarebytes Corporation ) C:\Users\Jake\Downloads\mbam-setup-1.75.0.1300 (3).exe

2013-04-24 21:26 - 2013-04-24 21:26 - 10285040 ____A (Malwarebytes Corporation ) C:\Users\Jake\Downloads\mbam-setup-1.75.0.1300 (2).exe

2013-04-24 21:26 - 2013-04-24 21:26 - 10285040 ____A (Malwarebytes Corporation ) C:\Users\Jake\Downloads\mbam-setup-1.75.0.1300 (1).exe

2013-04-24 20:12 - 2013-04-24 20:12 - 10285040 ____A (Malwarebytes Corporation ) C:\Users\Jake\Downloads\mbam-setup-1.75.0.1300.exe

2013-04-24 19:53 - 2013-04-25 01:41 - 00004906 ____A C:\Users\Jake\Desktop\Rkill.txt

2013-04-24 19:50 - 2013-04-24 19:53 - 262063408 ____A (Emsisoft GmbH ) C:\Users\Jake\Downloads\EmsisoftAntiMalwareSetup.exe

2013-04-24 19:35 - 2013-04-24 19:25 - 01752992 ____A (Bleeping Computer, LLC) C:\Users\Jake\Desktop\iExplore.exe

2013-04-24 19:25 - 2013-04-24 19:25 - 01752992 ____A (Bleeping Computer, LLC) C:\Users\Jake\Downloads\iExplore.exe

2013-04-24 19:19 - 2013-04-24 19:19 - 00000000 ____D C:\Users\Jake\Local Settings\Macromedia

2013-04-24 19:19 - 2013-04-24 19:19 - 00000000 ____D C:\Users\Jake\Local Settings\Application Data\Macromedia

2013-04-24 19:19 - 2013-04-24 19:19 - 00000000 ____D C:\Users\Jake\AppData\Local\Macromedia

2013-04-24 07:53 - 2013-04-24 07:53 - 00000000 ____D C:ProgramData\kna

2013-04-24 07:53 - 2013-04-24 07:53 - 00000000 ____D C:ProgramData\Application Data\kna

2013-04-24 07:52 - 2013-04-24 07:52 - 00155128 ____A (Hilgraeve, Inc.) C:\Users\dorothy\Desktop\kdgc.tmp

2013-04-24 06:59 - 2013-04-12 09:45 - 01656680 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\ntfs.sys

2013-04-24 06:53 - 2013-04-24 06:54 - 00000000 ____D C:\Users\dorothy\Local Settings\Application Data\{2C6AF02F-77FC-4404-822E-231F28338BE0}

2013-04-24 06:53 - 2013-04-24 06:54 - 00000000 ____D C:\Users\dorothy\Local Settings\{2C6AF02F-77FC-4404-822E-231F28338BE0}

2013-04-24 06:53 - 2013-04-24 06:54 - 00000000 ____D C:\Users\dorothy\AppData\Local\{2C6AF02F-77FC-4404-822E-231F28338BE0}

2013-04-23 07:20 - 2013-04-23 07:20 - 00000000 ____D C:\Users\dorothy\Local Settings\Application Data\{5AB73255-B961-4779-B2C8-7BDFEFFB4007}

2013-04-23 07:20 - 2013-04-23 07:20 - 00000000 ____D C:\Users\dorothy\Local Settings\{5AB73255-B961-4779-B2C8-7BDFEFFB4007}

2013-04-23 07:20 - 2013-04-23 07:20 - 00000000 ____D C:\Users\dorothy\AppData\Local\{5AB73255-B961-4779-B2C8-7BDFEFFB4007}

2013-04-22 06:20 - 2013-04-22 06:21 - 00000000 ____D C:\Users\dorothy\Local Settings\Application Data\{F13CEC5E-3677-4432-94B1-648448AF7A12}

2013-04-22 06:20 - 2013-04-22 06:21 - 00000000 ____D C:\Users\dorothy\Local Settings\{F13CEC5E-3677-4432-94B1-648448AF7A12}

2013-04-22 06:20 - 2013-04-22 06:21 - 00000000 ____D C:\Users\dorothy\AppData\Local\{F13CEC5E-3677-4432-94B1-648448AF7A12}

2013-04-21 10:29 - 2013-04-21 10:29 - 00000000 ____D C:\Users\dorothy\Local Settings\Application Data\{A474F5D0-7E69-4A31-ADB5-205A0178BCC2}

2013-04-21 10:29 - 2013-04-21 10:29 - 00000000 ____D C:\Users\dorothy\Local Settings\{A474F5D0-7E69-4A31-ADB5-205A0178BCC2}

2013-04-21 10:29 - 2013-04-21 10:29 - 00000000 ____D C:\Users\dorothy\AppData\Local\{A474F5D0-7E69-4A31-ADB5-205A0178BCC2}

2013-04-20 10:22 - 2013-04-20 10:23 - 00000000 ____D C:\Users\dorothy\Local Settings\Application Data\{55AC810B-8C7E-44D5-B91A-66B14037EB29}

2013-04-20 10:22 - 2013-04-20 10:23 - 00000000 ____D C:\Users\dorothy\Local Settings\{55AC810B-8C7E-44D5-B91A-66B14037EB29}

2013-04-20 10:22 - 2013-04-20 10:23 - 00000000 ____D C:\Users\dorothy\AppData\Local\{55AC810B-8C7E-44D5-B91A-66B14037EB29}

2013-04-19 18:12 - 2013-04-19 18:13 - 00000000 ____D C:\Users\dorothy\Local Settings\Application Data\{93EC1639-CE5F-44EB-AEA1-C89BB619DE41}

2013-04-19 18:12 - 2013-04-19 18:13 - 00000000 ____D C:\Users\dorothy\Local Settings\{93EC1639-CE5F-44EB-AEA1-C89BB619DE41}

2013-04-19 18:12 - 2013-04-19 18:13 - 00000000 ____D C:\Users\dorothy\AppData\Local\{93EC1639-CE5F-44EB-AEA1-C89BB619DE41}

2013-04-18 08:14 - 2013-04-18 08:14 - 00000000 ____D C:\Users\dorothy\Local Settings\Application Data\{598660BE-F1F0-421C-B430-4EAFF60C21F1}

2013-04-18 08:14 - 2013-04-18 08:14 - 00000000 ____D C:\Users\dorothy\Local Settings\{598660BE-F1F0-421C-B430-4EAFF60C21F1}

2013-04-18 08:14 - 2013-04-18 08:14 - 00000000 ____D C:\Users\dorothy\AppData\Local\{598660BE-F1F0-421C-B430-4EAFF60C21F1}

2013-04-16 11:00 - 2013-04-16 11:00 - 00000000 ____D C:\Users\dorothy\Local Settings\Application Data\{1F395D9C-85A8-40CD-8213-88236583075E}

2013-04-16 11:00 - 2013-04-16 11:00 - 00000000 ____D C:\Users\dorothy\Local Settings\{1F395D9C-85A8-40CD-8213-88236583075E}

2013-04-16 11:00 - 2013-04-16 11:00 - 00000000 ____D C:\Users\dorothy\AppData\Local\{1F395D9C-85A8-40CD-8213-88236583075E}

2013-04-15 11:22 - 2013-04-15 11:23 - 00000000 ____D C:\Users\dorothy\Local Settings\Application Data\{C471B403-F116-4F0D-AE7A-6200FA25C1F9}

2013-04-15 11:22 - 2013-04-15 11:23 - 00000000 ____D C:\Users\dorothy\Local Settings\{C471B403-F116-4F0D-AE7A-6200FA25C1F9}

2013-04-15 11:22 - 2013-04-15 11:23 - 00000000 ____D C:\Users\dorothy\AppData\Local\{C471B403-F116-4F0D-AE7A-6200FA25C1F9}

2013-04-14 12:59 - 2013-04-14 12:59 - 00000000 ____D C:\Users\dorothy\Local Settings\Application Data\{A8234650-5219-42EC-8408-D74632532C74}

2013-04-14 12:59 - 2013-04-14 12:59 - 00000000 ____D C:\Users\dorothy\Local Settings\{A8234650-5219-42EC-8408-D74632532C74}

2013-04-14 12:59 - 2013-04-14 12:59 - 00000000 ____D C:\Users\dorothy\AppData\Local\{A8234650-5219-42EC-8408-D74632532C74}

2013-04-14 12:50 - 2013-02-22 01:27 - 02312704 ____A (Microsoft Corporation) C:\Windows\System32\jscript9.dll

2013-04-14 12:50 - 2013-02-22 01:21 - 01346560 ____A (Microsoft Corporation) C:\Windows\System32\urlmon.dll

2013-04-14 12:50 - 2013-02-22 01:20 - 01392128 ____A (Microsoft Corporation) C:\Windows\System32\wininet.dll

2013-04-14 12:50 - 2013-02-22 01:19 - 01494528 ____A (Microsoft Corporation) C:\Windows\System32\inetcpl.cpl

2013-04-14 12:50 - 2013-02-22 01:18 - 00237056 ____A (Microsoft Corporation) C:\Windows\System32\url.dll

2013-04-14 12:50 - 2013-02-22 01:17 - 00085504 ____A (Microsoft Corporation) C:\Windows\System32\jsproxy.dll

2013-04-14 12:50 - 2013-02-22 01:15 - 00173056 ____A (Microsoft Corporation) C:\Windows\System32\ieUnatt.exe

2013-04-14 12:50 - 2013-02-22 01:14 - 00729088 ____A (Microsoft Corporation) C:\Windows\System32\msfeeds.dll

2013-04-14 12:50 - 2013-02-22 01:13 - 00096768 ____A (Microsoft Corporation) C:\Windows\System32\mshtmled.dll

2013-04-14 12:50 - 2013-02-22 01:12 - 02382848 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.tlb

2013-04-14 12:50 - 2013-02-22 01:09 - 00248320 ____A (Microsoft Corporation) C:\Windows\System32\ieui.dll

2013-04-14 12:50 - 2013-02-21 22:38 - 01129472 ____A (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll

2013-04-14 12:50 - 2013-02-21 22:38 - 01104384 ____A (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll

2013-04-14 12:50 - 2013-02-21 22:37 - 01427968 ____A (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl

2013-04-14 12:50 - 2013-02-21 22:36 - 00231936 ____A (Microsoft Corporation) C:\Windows\SysWOW64\url.dll

2013-04-14 12:50 - 2013-02-21 22:34 - 00420864 ____A (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll

2013-04-14 12:50 - 2013-02-21 22:34 - 00142848 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe

2013-04-14 12:50 - 2013-02-21 22:33 - 00607744 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll

2013-04-14 12:50 - 2013-02-21 22:31 - 02382848 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb

2013-04-14 12:50 - 2013-02-21 22:31 - 00073216 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll

2013-04-14 12:50 - 2013-02-21 22:28 - 00176640 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll

2013-04-14 12:49 - 2013-02-22 01:57 - 17817088 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.dll

2013-04-14 12:49 - 2013-02-22 01:29 - 10925568 ____A (Microsoft Corporation) C:\Windows\System32\ieframe.dll

2013-04-14 12:49 - 2013-02-22 01:15 - 00816640 ____A (Microsoft Corporation) C:\Windows\System32\jscript.dll

2013-04-14 12:49 - 2013-02-22 01:15 - 00599040 ____A (Microsoft Corporation) C:\Windows\System32\vbscript.dll

2013-04-14 12:49 - 2013-02-22 01:13 - 02147840 ____A (Microsoft Corporation) C:\Windows\System32\iertutil.dll

2013-04-14 12:49 - 2013-02-21 23:05 - 12324352 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll

2013-04-14 12:49 - 2013-02-21 22:47 - 09738752 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll

2013-04-14 12:49 - 2013-02-21 22:46 - 01800704 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll

2013-04-14 12:49 - 2013-02-21 22:35 - 00065024 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll

2013-04-14 12:49 - 2013-02-21 22:34 - 00717824 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll

2013-04-14 12:49 - 2013-02-21 22:32 - 01796096 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll

2013-04-14 11:44 - 2013-02-15 01:08 - 00044032 ____A (Microsoft Corporation) C:\Windows\System32\tsgqec.dll

2013-04-14 11:44 - 2013-02-15 01:06 - 03717632 ____A (Microsoft Corporation) C:\Windows\System32\mstscax.dll

2013-04-14 11:44 - 2013-02-15 01:02 - 00158720 ____A (Microsoft Corporation) C:\Windows\System32\aaclient.dll

2013-04-14 11:44 - 2013-02-14 23:37 - 03217408 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mstscax.dll

2013-04-14 11:44 - 2013-02-14 23:34 - 00131584 ____A (Microsoft Corporation) C:\Windows\SysWOW64\aaclient.dll

2013-04-14 11:44 - 2013-02-14 22:25 - 00036864 ____A (Microsoft Corporation) C:\Windows\SysWOW64\tsgqec.dll

2013-04-14 11:37 - 2013-03-19 01:04 - 05550424 ____A (Microsoft Corporation) C:\Windows\System32\ntoskrnl.exe

2013-04-14 11:37 - 2013-03-19 00:46 - 00043520 ____A (Microsoft Corporation) C:\Windows\System32\csrsrv.dll

2013-04-14 11:37 - 2013-03-19 00:04 - 03968856 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe

2013-04-14 11:37 - 2013-03-19 00:04 - 03913560 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe

2013-04-14 11:37 - 2013-03-18 23:47 - 00006656 ____A (Microsoft Corporation) C:\Windows\SysWOW64\apisetschema.dll

2013-04-14 11:37 - 2013-03-18 22:06 - 00112640 ____A (Microsoft Corporation) C:\Windows\System32\smss.exe

2013-04-14 11:37 - 2013-01-24 01:01 - 00223752 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\fvevol.sys

2013-04-14 11:36 - 2013-02-28 22:36 - 03153408 ____A (Microsoft Corporation) C:\Windows\System32\win32k.sys

2013-04-13 13:55 - 2013-04-13 13:55 - 00000000 ____D C:\Users\dorothy\Local Settings\Application Data\{AD74180D-57B2-46AA-9A7D-176A2689F3AD}

2013-04-13 13:55 - 2013-04-13 13:55 - 00000000 ____D C:\Users\dorothy\Local Settings\{AD74180D-57B2-46AA-9A7D-176A2689F3AD}

2013-04-13 13:55 - 2013-04-13 13:55 - 00000000 ____D C:\Users\dorothy\AppData\Local\{AD74180D-57B2-46AA-9A7D-176A2689F3AD}

2013-04-12 11:06 - 2013-04-12 11:06 - 00000315 ____A C:\Users\dorothy\Desktop\(36 unread) - cantstndya - Yahoo! Mail.url

2013-04-12 09:34 - 2013-04-12 09:34 - 00000000 ____D C:\Users\dorothy\Local Settings\Application Data\{E5322D6A-28D1-4490-98FB-74B5F37F2104}

2013-04-12 09:34 - 2013-04-12 09:34 - 00000000 ____D C:\Users\dorothy\Local Settings\{E5322D6A-28D1-4490-98FB-74B5F37F2104}

2013-04-12 09:34 - 2013-04-12 09:34 - 00000000 ____D C:\Users\dorothy\AppData\Local\{E5322D6A-28D1-4490-98FB-74B5F37F2104}

2013-04-11 07:05 - 2013-04-11 07:05 - 00000000 ____D C:\Users\dorothy\Local Settings\Application Data\{CE279CD9-03CF-4C64-8BF5-DD2B607A4DA9}

2013-04-11 07:05 - 2013-04-11 07:05 - 00000000 ____D C:\Users\dorothy\Local Settings\{CE279CD9-03CF-4C64-8BF5-DD2B607A4DA9}

2013-04-11 07:05 - 2013-04-11 07:05 - 00000000 ____D C:\Users\dorothy\AppData\Local\{CE279CD9-03CF-4C64-8BF5-DD2B607A4DA9}

2013-04-10 12:46 - 2013-04-10 12:47 - 00000000 ____D C:\Users\dorothy\Local Settings\Application Data\{9247D8A0-AC60-4395-8E5F-4C99C3AAA43D}

2013-04-10 12:46 - 2013-04-10 12:47 - 00000000 ____D C:\Users\dorothy\Local Settings\{9247D8A0-AC60-4395-8E5F-4C99C3AAA43D}

2013-04-10 12:46 - 2013-04-10 12:47 - 00000000 ____D C:\Users\dorothy\AppData\Local\{9247D8A0-AC60-4395-8E5F-4C99C3AAA43D}

2013-04-10 11:16 - 2013-04-10 11:16 - 00000000 ____D C:\Users\dorothy\Local Settings\Application Data\{9F003C53-A511-46B1-BC65-5EED7918158D}

2013-04-10 11:16 - 2013-04-10 11:16 - 00000000 ____D C:\Users\dorothy\Local Settings\{9F003C53-A511-46B1-BC65-5EED7918158D}

2013-04-10 11:16 - 2013-04-10 11:16 - 00000000 ____D C:\Users\dorothy\AppData\Local\{9F003C53-A511-46B1-BC65-5EED7918158D}

2013-04-09 09:53 - 2013-04-09 09:54 - 00000000 ____D C:\Users\dorothy\Local Settings\Application Data\{41543EAE-9D5D-4A8E-BA33-AB1BECF51138}

2013-04-09 09:53 - 2013-04-09 09:54 - 00000000 ____D C:\Users\dorothy\Local Settings\{41543EAE-9D5D-4A8E-BA33-AB1BECF51138}

2013-04-09 09:53 - 2013-04-09 09:54 - 00000000 ____D C:\Users\dorothy\AppData\Local\{41543EAE-9D5D-4A8E-BA33-AB1BECF51138}

2013-04-07 12:31 - 2013-04-07 12:31 - 00000000 ____D C:\Users\dorothy\Local Settings\Application Data\{818B8F48-33BE-4EEE-B294-9481577BA975}

2013-04-07 12:31 - 2013-04-07 12:31 - 00000000 ____D C:\Users\dorothy\Local Settings\{818B8F48-33BE-4EEE-B294-9481577BA975}

2013-04-07 12:31 - 2013-04-07 12:31 - 00000000 ____D C:\Users\dorothy\AppData\Local\{818B8F48-33BE-4EEE-B294-9481577BA975}

2013-04-05 21:30 - 2013-04-13 13:57 - 00000000 ____D C:\Modio

2013-04-05 21:28 - 2013-04-05 21:29 - 02316630 ____A (GameTuts ) C:\Users\dorothy\Downloads\Modio-setup-5.04.exe

2013-04-05 09:53 - 2013-04-05 09:54 - 00000000 ____D C:\Users\dorothy\Local Settings\Application Data\{7DB1B86B-AFA7-4A22-9612-36263C188C54}

2013-04-05 09:53 - 2013-04-05 09:54 - 00000000 ____D C:\Users\dorothy\Local Settings\{7DB1B86B-AFA7-4A22-9612-36263C188C54}

2013-04-05 09:53 - 2013-04-05 09:54 - 00000000 ____D C:\Users\dorothy\AppData\Local\{7DB1B86B-AFA7-4A22-9612-36263C188C54}

2013-04-03 15:04 - 2013-04-03 15:05 - 00000000 ____D C:\Users\dorothy\Local Settings\Application Data\{C8ACBC33-38CF-4487-B80C-B8393940B3AB}

2013-04-03 15:04 - 2013-04-03 15:05 - 00000000 ____D C:\Users\dorothy\Local Settings\{C8ACBC33-38CF-4487-B80C-B8393940B3AB}

2013-04-03 15:04 - 2013-04-03 15:05 - 00000000 ____D C:\Users\dorothy\AppData\Local\{C8ACBC33-38CF-4487-B80C-B8393940B3AB}

2013-03-31 11:19 - 2013-03-31 11:19 - 00001096 ____A C:\tmsgr_s0.bmp

2013-03-31 11:19 - 2013-03-31 11:19 - 00001028 ____A C:\tmsgr_s1.bmp

2013-03-31 11:19 - 2013-03-31 11:19 - 00001028 ____A C:\msgr_on.bmp

2013-03-31 11:19 - 2013-03-31 11:19 - 00000352 ____A C:\addmy.bmp

2013-03-31 11:19 - 2013-03-31 11:19 - 00000000 ____D C:\w

2013-03-31 11:19 - 2013-03-31 11:19 - 00000000 ____D C:\visi

2013-03-31 11:19 - 2013-03-31 11:19 - 00000000 ____D C:\skins

2013-03-31 11:19 - 2013-03-31 11:19 - 00000000 ____D C:\Cache

2013-03-31 09:32 - 2013-03-31 09:33 - 00000000 ____D C:\Users\dorothy\Local Settings\Application Data\{EF78DD53-46EB-4AB7-97A4-3C05118F32ED}

2013-03-31 09:32 - 2013-03-31 09:33 - 00000000 ____D C:\Users\dorothy\Local Settings\{EF78DD53-46EB-4AB7-97A4-3C05118F32ED}

2013-03-31 09:32 - 2013-03-31 09:33 - 00000000 ____D C:\Users\dorothy\AppData\Local\{EF78DD53-46EB-4AB7-97A4-3C05118F32ED}

2013-03-29 19:35 - 2013-02-11 23:12 - 00019968 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\usb8023.sys

2013-03-29 09:07 - 2013-03-29 09:11 - 00000000 ____D C:\Users\dorothy\Local Settings\Application Data\{7628F35F-9B07-4336-BDB5-F8D47C913D41}

2013-03-29 09:07 - 2013-03-29 09:11 - 00000000 ____D C:\Users\dorothy\Local Settings\{7628F35F-9B07-4336-BDB5-F8D47C913D41}

2013-03-29 09:07 - 2013-03-29 09:11 - 00000000 ____D C:\Users\dorothy\AppData\Local\{7628F35F-9B07-4336-BDB5-F8D47C913D41}

==================== One Month Modified Files and Folders =======

2013-04-25 19:47 - 2013-04-25 19:47 - 00000000 ____D C:\FRST

2013-04-25 17:41 - 2012-08-01 10:26 - 00000000 ____D C:\Users\dorothy\Application Data\MotoCast

2013-04-25 17:41 - 2012-08-01 10:26 - 00000000 ____D C:\Users\dorothy\AppData\Roaming\MotoCast

2013-04-25 17:41 - 2009-07-14 00:10 - 01780960 ____A C:\Windows\WindowsUpdate.log

2013-04-25 17:29 - 2012-09-05 10:14 - 00000830 ____A C:\Windows\Tasks\Adobe Flash Player Updater.job

2013-04-25 17:17 - 2011-01-04 15:31 - 00000900 ____A C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job

2013-04-25 16:56 - 2012-09-21 23:46 - 00000904 ____A C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2754924291-2942948176-839923927-1005UA.job

2013-04-25 16:54 - 2013-04-25 16:54 - 00688992 ____A (Swearware) C:\Users\Jake\Downloads\dds.scr

2013-04-25 16:54 - 2013-04-25 16:54 - 00688992 ____A (Swearware) C:\Users\Jake\Desktop\dds.scr

2013-04-25 16:53 - 2011-06-27 14:19 - 00000916 ____A C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2754924291-2942948176-839923927-1000UA.job

2013-04-25 16:53 - 2011-06-27 14:19 - 00000864 ____A C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2754924291-2942948176-839923927-1000Core.job

2013-04-25 16:29 - 2009-07-13 23:45 - 00014240 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

2013-04-25 16:29 - 2009-07-13 23:45 - 00014240 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

2013-04-25 16:23 - 2011-01-04 15:31 - 00000896 ____A C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job

2013-04-25 16:22 - 2013-04-25 00:19 - 00000314 ____A C:\Windows\setupact.log

2013-04-25 16:22 - 2010-12-06 22:22 - 00000000 ____D C:\Users\dorothy\Incomplete

2013-04-25 04:29 - 2012-08-01 10:30 - 00000000 ____D C:\Users\dorothy\.gstreamer-0.10

2013-04-25 04:28 - 2009-12-21 16:09 - 00000072 ____A C:\Windows\SysWOW64\ToasterLauncherLog.log

2013-04-25 04:28 - 2009-12-21 15:46 - 00000000 ____D C:\Program Files (x86)\Dell DataSafe Local Backup

2013-04-25 04:27 - 2009-07-14 00:08 - 00000006 ___AH C:\Windows\Tasks\SA.DAT

2013-04-25 01:54 - 2012-09-21 23:35 - 00000000 ____D C:\Users\Jake\Local Settings\Google

2013-04-25 01:54 - 2012-09-21 23:35 - 00000000 ____D C:\Users\Jake\Local Settings\Application Data\Google

2013-04-25 01:54 - 2012-09-21 23:35 - 00000000 ____D C:\Users\Jake\AppData\Local\Google

2013-04-25 01:41 - 2013-04-24 19:53 - 00004906 ____A C:\Users\Jake\Desktop\Rkill.txt

2013-04-25 01:33 - 2013-04-25 01:33 - 00000000 ____D C:\Users\Jake\Application Data\WinRAR

2013-04-25 01:33 - 2013-04-25 01:33 - 00000000 ____D C:\Users\Jake\AppData\Roaming\WinRAR

2013-04-25 01:02 - 2013-04-25 01:02 - 00001241 ____A C:\Users\Jake\Desktop\RKreport[1]_S_04252013_02d0202.txt

2013-04-25 01:02 - 2013-04-25 00:59 - 00000000 ____D C:\Users\Jake\Desktop\RK_Quarantine

2013-04-25 00:59 - 2013-04-25 00:59 - 00816128 ____A C:\Users\Jake\Downloads\RogueKiller.exe

2013-04-25 00:56 - 2013-04-25 00:56 - 02237968 ____A (Kaspersky Lab ZAO) C:\Users\Jake\Downloads\tdsskiller.exe

2013-04-25 00:56 - 2013-04-25 00:56 - 02237968 ____A (Kaspersky Lab ZAO) C:\Users\Jake\Desktop\tdsskiller.exe

2013-04-25 00:52 - 2013-04-24 23:32 - 00000000 ____D C:ProgramData\Spybot - Search & Destroy

2013-04-25 00:52 - 2013-04-24 23:32 - 00000000 ____D C:ProgramData\Application Data\Spybot - Search & Destroy

2013-04-25 00:29 - 2012-10-14 20:55 - 00223386 ____A C:\Windows\PFRO.log

2013-04-25 00:15 - 2013-04-25 00:11 - 00069819 ____A C:\Windows\wininit.ini

2013-04-25 00:11 - 2011-01-16 16:42 - 00000000 ____D C:\Program Files (x86)\SweetIM

2013-04-24 23:32 - 2013-04-24 23:32 - 00000000 ____D C:\Users\dorothy\My Documents\ProcAlyzer Dumps

2013-04-24 23:32 - 2013-04-24 23:32 - 00000000 ____D C:\Users\dorothy\Documents\ProcAlyzer Dumps

2013-04-24 23:28 - 2009-07-14 00:13 - 00742028 ____A C:\Windows\System32\PerfStringBackup.INI

2013-04-24 23:26 - 2013-04-24 23:26 - 41763592 ____A (PortableApps.com) C:\Users\Jake\Downloads\SpybotPortable_2.0.12.paf.exe

2013-04-24 23:16 - 2013-04-24 23:16 - 00000000 ___AH C:\Users\Jake\My Documents\Default.rdp

2013-04-24 23:16 - 2013-04-24 23:16 - 00000000 ___AH C:\Users\Jake\Documents\Default.rdp

2013-04-24 22:56 - 2012-09-21 23:51 - 00002365 ____A C:\Users\Jake\Desktop\Google Chrome.lnk

2013-04-24 22:56 - 2012-09-21 23:46 - 00000852 ____A C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2754924291-2942948176-839923927-1005Core.job

2013-04-24 22:36 - 2011-03-16 10:14 - 00000000 ____D C:ProgramData\Trend Micro

2013-04-24 22:36 - 2011-03-16 10:14 - 00000000 ____D C:ProgramData\Application Data\Trend Micro

2013-04-24 22:27 - 2013-04-24 22:27 - 00000000 ____D C:\Users\dorothy\Local Settings\Application Data\{C13A4478-C08F-49FD-B131-A609AE9689C6}

2013-04-24 22:27 - 2013-04-24 22:27 - 00000000 ____D C:\Users\dorothy\Local Settings\{C13A4478-C08F-49FD-B131-A609AE9689C6}

2013-04-24 22:27 - 2013-04-24 22:27 - 00000000 ____D C:\Users\dorothy\AppData\Local\{C13A4478-C08F-49FD-B131-A609AE9689C6}

2013-04-24 22:27 - 2010-03-06 13:15 - 00000000 ____D C:\Users\dorothy\Tracing

2013-04-24 21:39 - 2012-09-21 23:34 - 00079608 ____A C:\Users\Jake\Local Settings\GDIPFONTCACHEV1.DAT

2013-04-24 21:39 - 2012-09-21 23:34 - 00079608 ____A C:\Users\Jake\Local Settings\Application Data\GDIPFONTCACHEV1.DAT

2013-04-24 21:39 - 2012-09-21 23:34 - 00079608 ____A C:\Users\Jake\AppData\Local\GDIPFONTCACHEV1.DAT

2013-04-24 21:29 - 2013-04-24 21:29 - 10285040 ____A (Malwarebytes Corporation ) C:\Users\Jake\Downloads\mbam-setup-1.75.0.1300 (3).exe

2013-04-24 21:26 - 2013-04-24 21:26 - 10285040 ____A (Malwarebytes Corporation ) C:\Users\Jake\Downloads\mbam-setup-1.75.0.1300 (2).exe

2013-04-24 21:26 - 2013-04-24 21:26 - 10285040 ____A (Malwarebytes Corporation ) C:\Users\Jake\Downloads\mbam-setup-1.75.0.1300 (1).exe

2013-04-24 20:12 - 2013-04-24 20:12 - 10285040 ____A (Malwarebytes Corporation ) C:\Users\Jake\Downloads\mbam-setup-1.75.0.1300.exe

2013-04-24 19:53 - 2013-04-24 19:50 - 262063408 ____A (Emsisoft GmbH ) C:\Users\Jake\Downloads\EmsisoftAntiMalwareSetup.exe

2013-04-24 19:25 - 2013-04-24 19:35 - 01752992 ____A (Bleeping Computer, LLC) C:\Users\Jake\Desktop\iExplore.exe

2013-04-24 19:25 - 2013-04-24 19:25 - 01752992 ____A (Bleeping Computer, LLC) C:\Users\Jake\Downloads\iExplore.exe

2013-04-24 19:19 - 2013-04-24 19:19 - 00000000 ____D C:\Users\Jake\Local Settings\Macromedia

2013-04-24 19:19 - 2013-04-24 19:19 - 00000000 ____D C:\Users\Jake\Local Settings\Application Data\Macromedia

2013-04-24 19:19 - 2013-04-24 19:19 - 00000000 ____D C:\Users\Jake\AppData\Local\Macromedia

2013-04-24 07:53 - 2013-04-24 07:53 - 00000000 ____D C:ProgramData\kna

2013-04-24 07:53 - 2013-04-24 07:53 - 00000000 ____D C:ProgramData\Application Data\kna

2013-04-24 07:52 - 2013-04-24 07:52 - 00155128 ____A (Hilgraeve, Inc.) C:\Users\dorothy\Desktop\kdgc.tmp

2013-04-24 07:52 - 2010-03-05 15:08 - 00000000 ____D C:\users\dorothy

2013-04-24 06:54 - 2013-04-24 06:53 - 00000000 ____D C:\Users\dorothy\Local Settings\Application Data\{2C6AF02F-77FC-4404-822E-231F28338BE0}

2013-04-24 06:54 - 2013-04-24 06:53 - 00000000 ____D C:\Users\dorothy\Local Settings\{2C6AF02F-77FC-4404-822E-231F28338BE0}

2013-04-24 06:54 - 2013-04-24 06:53 - 00000000 ____D C:\Users\dorothy\AppData\Local\{2C6AF02F-77FC-4404-822E-231F28338BE0}

2013-04-23 07:20 - 2013-04-23 07:20 - 00000000 ____D C:\Users\dorothy\Local Settings\Application Data\{5AB73255-B961-4779-B2C8-7BDFEFFB4007}

2013-04-23 07:20 - 2013-04-23 07:20 - 00000000 ____D C:\Users\dorothy\Local Settings\{5AB73255-B961-4779-B2C8-7BDFEFFB4007}

2013-04-23 07:20 - 2013-04-23 07:20 - 00000000 ____D C:\Users\dorothy\AppData\Local\{5AB73255-B961-4779-B2C8-7BDFEFFB4007}

2013-04-22 06:21 - 2013-04-22 06:20 - 00000000 ____D C:\Users\dorothy\Local Settings\Application Data\{F13CEC5E-3677-4432-94B1-648448AF7A12}

2013-04-22 06:21 - 2013-04-22 06:20 - 00000000 ____D C:\Users\dorothy\Local Settings\{F13CEC5E-3677-4432-94B1-648448AF7A12}

2013-04-22 06:21 - 2013-04-22 06:20 - 00000000 ____D C:\Users\dorothy\AppData\Local\{F13CEC5E-3677-4432-94B1-648448AF7A12}

2013-04-21 10:29 - 2013-04-21 10:29 - 00000000 ____D C:\Users\dorothy\Local Settings\Application Data\{A474F5D0-7E69-4A31-ADB5-205A0178BCC2}

2013-04-21 10:29 - 2013-04-21 10:29 - 00000000 ____D C:\Users\dorothy\Local Settings\{A474F5D0-7E69-4A31-ADB5-205A0178BCC2}

2013-04-21 10:29 - 2013-04-21 10:29 - 00000000 ____D C:\Users\dorothy\AppData\Local\{A474F5D0-7E69-4A31-ADB5-205A0178BCC2}

2013-04-20 10:23 - 2013-04-20 10:22 - 00000000 ____D C:\Users\dorothy\Local Settings\Application Data\{55AC810B-8C7E-44D5-B91A-66B14037EB29}

2013-04-20 10:23 - 2013-04-20 10:22 - 00000000 ____D C:\Users\dorothy\Local Settings\{55AC810B-8C7E-44D5-B91A-66B14037EB29}

2013-04-20 10:23 - 2013-04-20 10:22 - 00000000 ____D C:\Users\dorothy\AppData\Local\{55AC810B-8C7E-44D5-B91A-66B14037EB29}

2013-04-19 18:13 - 2013-04-19 18:12 - 00000000 ____D C:\Users\dorothy\Local Settings\Application Data\{93EC1639-CE5F-44EB-AEA1-C89BB619DE41}

2013-04-19 18:13 - 2013-04-19 18:12 - 00000000 ____D C:\Users\dorothy\Local Settings\{93EC1639-CE5F-44EB-AEA1-C89BB619DE41}

2013-04-19 18:13 - 2013-04-19 18:12 - 00000000 ____D C:\Users\dorothy\AppData\Local\{93EC1639-CE5F-44EB-AEA1-C89BB619DE41}

2013-04-18 08:14 - 2013-04-18 08:14 - 00000000 ____D C:\Users\dorothy\Local Settings\Application Data\{598660BE-F1F0-421C-B430-4EAFF60C21F1}

2013-04-18 08:14 - 2013-04-18 08:14 - 00000000 ____D C:\Users\dorothy\Local Settings\{598660BE-F1F0-421C-B430-4EAFF60C21F1}

2013-04-18 08:14 - 2013-04-18 08:14 - 00000000 ____D C:\Users\dorothy\AppData\Local\{598660BE-F1F0-421C-B430-4EAFF60C21F1}

2013-04-18 08:14 - 2010-12-06 22:21 - 00000000 ____D C:\Users\dorothy\Application Data\MP3Rocket

2013-04-18 08:14 - 2010-12-06 22:21 - 00000000 ____D C:\Users\dorothy\AppData\Roaming\MP3Rocket

2013-04-16 13:16 - 2009-07-14 00:08 - 00032652 ____A C:\Windows\Tasks\SCHEDLGU.TXT

2013-04-16 11:00 - 2013-04-16 11:00 - 00000000 ____D C:\Users\dorothy\Local Settings\Application Data\{1F395D9C-85A8-40CD-8213-88236583075E}

2013-04-16 11:00 - 2013-04-16 11:00 - 00000000 ____D C:\Users\dorothy\Local Settings\{1F395D9C-85A8-40CD-8213-88236583075E}

2013-04-16 11:00 - 2013-04-16 11:00 - 00000000 ____D C:\Users\dorothy\AppData\Local\{1F395D9C-85A8-40CD-8213-88236583075E}

2013-04-15 11:23 - 2013-04-15 11:22 - 00000000 ____D C:\Users\dorothy\Local Settings\Application Data\{C471B403-F116-4F0D-AE7A-6200FA25C1F9}

2013-04-15 11:23 - 2013-04-15 11:22 - 00000000 ____D C:\Users\dorothy\Local Settings\{C471B403-F116-4F0D-AE7A-6200FA25C1F9}

2013-04-15 11:23 - 2013-04-15 11:22 - 00000000 ____D C:\Users\dorothy\AppData\Local\{C471B403-F116-4F0D-AE7A-6200FA25C1F9}

2013-04-14 12:59 - 2013-04-14 12:59 - 00000000 ____D C:\Users\dorothy\Local Settings\Application Data\{A8234650-5219-42EC-8408-D74632532C74}

2013-04-14 12:59 - 2013-04-14 12:59 - 00000000 ____D C:\Users\dorothy\Local Settings\{A8234650-5219-42EC-8408-D74632532C74}

2013-04-14 12:59 - 2013-04-14 12:59 - 00000000 ____D C:\Users\dorothy\AppData\Local\{A8234650-5219-42EC-8408-D74632532C74}

2013-04-14 12:58 - 2009-07-13 23:45 - 00343552 ____A C:\Windows\System32\FNTCACHE.DAT

2013-04-14 12:50 - 2010-03-12 12:05 - 72702784 ____A (Microsoft Corporation) C:\Windows\System32\MRT.exe

2013-04-13 13:57 - 2013-04-05 21:30 - 00000000 ____D C:\Modio

2013-04-13 13:55 - 2013-04-13 13:55 - 00000000 ____D C:\Users\dorothy\Local Settings\Application Data\{AD74180D-57B2-46AA-9A7D-176A2689F3AD}

2013-04-13 13:55 - 2013-04-13 13:55 - 00000000 ____D C:\Users\dorothy\Local Settings\{AD74180D-57B2-46AA-9A7D-176A2689F3AD}

2013-04-13 13:55 - 2013-04-13 13:55 - 00000000 ____D C:\Users\dorothy\AppData\Local\{AD74180D-57B2-46AA-9A7D-176A2689F3AD}

2013-04-12 11:06 - 2013-04-12 11:06 - 00000315 ____A C:\Users\dorothy\Desktop\(36 unread) - cantstndya - Yahoo! Mail.url

2013-04-12 09:45 - 2013-04-24 06:59 - 01656680 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\ntfs.sys

2013-04-12 09:34 - 2013-04-12 09:34 - 00000000 ____D C:\Users\dorothy\Local Settings\Application Data\{E5322D6A-28D1-4490-98FB-74B5F37F2104}

2013-04-12 09:34 - 2013-04-12 09:34 - 00000000 ____D C:\Users\dorothy\Local Settings\{E5322D6A-28D1-4490-98FB-74B5F37F2104}

2013-04-12 09:34 - 2013-04-12 09:34 - 00000000 ____D C:\Users\dorothy\AppData\Local\{E5322D6A-28D1-4490-98FB-74B5F37F2104}

2013-04-11 13:13 - 2011-06-27 14:20 - 00002380 ____A C:\Users\dorothy\Desktop\Google Chrome.lnk

2013-04-11 07:05 - 2013-04-11 07:05 - 00000000 ____D C:\Users\dorothy\Local Settings\Application Data\{CE279CD9-03CF-4C64-8BF5-DD2B607A4DA9}

2013-04-11 07:05 - 2013-04-11 07:05 - 00000000 ____D C:\Users\dorothy\Local Settings\{CE279CD9-03CF-4C64-8BF5-DD2B607A4DA9}

2013-04-11 07:05 - 2013-04-11 07:05 - 00000000 ____D C:\Users\dorothy\AppData\Local\{CE279CD9-03CF-4C64-8BF5-DD2B607A4DA9}

2013-04-10 12:47 - 2013-04-10 12:46 - 00000000 ____D C:\Users\dorothy\Local Settings\Application Data\{9247D8A0-AC60-4395-8E5F-4C99C3AAA43D}

2013-04-10 12:47 - 2013-04-10 12:46 - 00000000 ____D C:\Users\dorothy\Local Settings\{9247D8A0-AC60-4395-8E5F-4C99C3AAA43D}

2013-04-10 12:47 - 2013-04-10 12:46 - 00000000 ____D C:\Users\dorothy\AppData\Local\{9247D8A0-AC60-4395-8E5F-4C99C3AAA43D}

2013-04-10 11:16 - 2013-04-10 11:16 - 00000000 ____D C:\Users\dorothy\Local Settings\Application Data\{9F003C53-A511-46B1-BC65-5EED7918158D}

2013-04-10 11:16 - 2013-04-10 11:16 - 00000000 ____D C:\Users\dorothy\Local Settings\{9F003C53-A511-46B1-BC65-5EED7918158D}

2013-04-10 11:16 - 2013-04-10 11:16 - 00000000 ____D C:\Users\dorothy\AppData\Local\{9F003C53-A511-46B1-BC65-5EED7918158D}

2013-04-09 09:54 - 2013-04-09 09:53 - 00000000 ____D C:\Users\dorothy\Local Settings\Application Data\{41543EAE-9D5D-4A8E-BA33-AB1BECF51138}

2013-04-09 09:54 - 2013-04-09 09:53 - 00000000 ____D C:\Users\dorothy\Local Settings\{41543EAE-9D5D-4A8E-BA33-AB1BECF51138}

2013-04-09 09:54 - 2013-04-09 09:53 - 00000000 ____D C:\Users\dorothy\AppData\Local\{41543EAE-9D5D-4A8E-BA33-AB1BECF51138}

2013-04-07 12:31 - 2013-04-07 12:31 - 00000000 ____D C:\Users\dorothy\Local Settings\Application Data\{818B8F48-33BE-4EEE-B294-9481577BA975}

2013-04-07 12:31 - 2013-04-07 12:31 - 00000000 ____D C:\Users\dorothy\Local Settings\{818B8F48-33BE-4EEE-B294-9481577BA975}

2013-04-07 12:31 - 2013-04-07 12:31 - 00000000 ____D C:\Users\dorothy\AppData\Local\{818B8F48-33BE-4EEE-B294-9481577BA975}

2013-04-05 21:30 - 2013-03-09 14:38 - 00000564 ____A C:ProgramData\Desktop\Modio.lnk

2013-04-05 21:30 - 2013-03-09 14:38 - 00000564 ____A C:\Users\Public\Desktop\Modio.lnk

2013-04-05 21:29 - 2013-04-05 21:28 - 02316630 ____A (GameTuts ) C:\Users\dorothy\Downloads\Modio-setup-5.04.exe

2013-04-05 21:23 - 2010-03-17 04:46 - 00000000 ____D C:ProgramData\Yahoo! Companion

2013-04-05 21:23 - 2010-03-17 04:46 - 00000000 ____D C:ProgramData\Application Data\Yahoo! Companion

2013-04-05 09:54 - 2013-04-05 09:53 - 00000000 ____D C:\Users\dorothy\Local Settings\Application Data\{7DB1B86B-AFA7-4A22-9612-36263C188C54}

2013-04-05 09:54 - 2013-04-05 09:53 - 00000000 ____D C:\Users\dorothy\Local Settings\{7DB1B86B-AFA7-4A22-9612-36263C188C54}

2013-04-05 09:54 - 2013-04-05 09:53 - 00000000 ____D C:\Users\dorothy\AppData\Local\{7DB1B86B-AFA7-4A22-9612-36263C188C54}

2013-04-03 15:05 - 2013-04-03 15:04 - 00000000 ____D C:\Users\dorothy\Local Settings\Application Data\{C8ACBC33-38CF-4487-B80C-B8393940B3AB}

2013-04-03 15:05 - 2013-04-03 15:04 - 00000000 ____D C:\Users\dorothy\Local Settings\{C8ACBC33-38CF-4487-B80C-B8393940B3AB}

2013-04-03 15:05 - 2013-04-03 15:04 - 00000000 ____D C:\Users\dorothy\AppData\Local\{C8ACBC33-38CF-4487-B80C-B8393940B3AB}

2013-03-31 11:19 - 2013-03-31 11:19 - 00001096 ____A C:\tmsgr_s0.bmp

2013-03-31 11:19 - 2013-03-31 11:19 - 00001028 ____A C:\tmsgr_s1.bmp

2013-03-31 11:19 - 2013-03-31 11:19 - 00001028 ____A C:\msgr_on.bmp

2013-03-31 11:19 - 2013-03-31 11:19 - 00000352 ____A C:\addmy.bmp

2013-03-31 11:19 - 2013-03-31 11:19 - 00000000 ____D C:\w

2013-03-31 11:19 - 2013-03-31 11:19 - 00000000 ____D C:\visi

2013-03-31 11:19 - 2013-03-31 11:19 - 00000000 ____D C:\skins

2013-03-31 11:19 - 2013-03-31 11:19 - 00000000 ____D C:\Cache

2013-03-31 11:19 - 2011-12-22 13:15 - 00000000 ____D C:\e

2013-03-31 09:33 - 2013-03-31 09:32 - 00000000 ____D C:\Users\dorothy\Local Settings\Application Data\{EF78DD53-46EB-4AB7-97A4-3C05118F32ED}

2013-03-31 09:33 - 2013-03-31 09:32 - 00000000 ____D C:\Users\dorothy\Local Settings\{EF78DD53-46EB-4AB7-97A4-3C05118F32ED}

2013-03-31 09:33 - 2013-03-31 09:32 - 00000000 ____D C:\Users\dorothy\AppData\Local\{EF78DD53-46EB-4AB7-97A4-3C05118F32ED}

2013-03-29 15:22 - 2012-09-21 23:34 - 00000000 ____D C:\users\Jake

2013-03-29 15:22 - 2009-07-13 22:20 - 00000000 ____D C:\Windows\registration

2013-03-29 09:11 - 2013-03-29 09:07 - 00000000 ____D C:\Users\dorothy\Local Settings\Application Data\{7628F35F-9B07-4336-BDB5-F8D47C913D41}

2013-03-29 09:11 - 2013-03-29 09:07 - 00000000 ____D C:\Users\dorothy\Local Settings\{7628F35F-9B07-4336-BDB5-F8D47C913D41}

2013-03-29 09:11 - 2013-03-29 09:07 - 00000000 ____D C:\Users\dorothy\AppData\Local\{7628F35F-9B07-4336-BDB5-F8D47C913D41}

==================== Known DLLs (Whitelisted) ================

==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit

C:\Windows\System32\wininit.exe => MD5 is legit

C:\Windows\SysWOW64\wininit.exe => MD5 is legit

C:\Windows\explorer.exe => MD5 is legit

C:\Windows\SysWOW64\explorer.exe => MD5 is legit

C:\Windows\System32\svchost.exe => MD5 is legit

C:\Windows\SysWOW64\svchost.exe => MD5 is legit

C:\Windows\System32\services.exe => MD5 is legit

C:\Windows\System32\User32.dll => MD5 is legit

C:\Windows\SysWOW64\User32.dll => MD5 is legit

C:\Windows\System32\userinit.exe => MD5 is legit

C:\Windows\SysWOW64\userinit.exe => MD5 is legit

C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit

==================== EXE ASSOCIATION =====================

HKLM\...\.exe: exefile => OK

HKLM\...\exefile\DefaultIcon: %1 => OK

HKLM\...\exefile\open\command: "%1" %* => OK

==================== Restore Points =========================

Restore point made on: 2013-02-21 11:38:44

Restore point made on: 2013-03-03 13:05:49

Restore point made on: 2013-03-14 02:01:26

Restore point made on: 2013-03-29 09:48:17

Restore point made on: 2013-03-29 20:55:49

Restore point made on: 2013-04-09 14:53:44

Restore point made on: 2013-04-14 12:49:27

Restore point made on: 2013-04-21 19:13:05

Restore point made on: 2013-04-25 02:00:41

==================== Memory info ===========================

Percentage of memory in use: 14%

Total physical RAM: 4060.8 MB

Available physical RAM: 3456.81 MB

Total Pagefile: 4058.95 MB

Available Pagefile: 3449.86 MB

Total Virtual: 8192 MB

Available Virtual: 8191.88 MB

==================== Drives ================================

Drive c: (OS) (Fixed) (Total:581.48 GB) (Free:508.18 GB) NTFS (Disk=0 Partition=3)

Drive e: (RECOVERY) (Fixed) (Total:14.65 GB) (Free:9.7 GB) NTFS (Disk=0 Partition=2) ==>[system with boot components (obtained from reading drive)]

Drive f: (CENTON USB) (Removable) (Total:29.28 GB) (Free:10.77 GB) FAT32 (Disk=1 Partition=1)

Drive x: (Boot) (Fixed) (Total:0.03 GB) (Free:0.03 GB) NTFS

Disk ### Status Size Free Dyn Gpt

-------- ------------- ------- ------- --- ---

Disk 0 Online 596 GB 0 B

Disk 1 Online 29 GB 0 B

Partitions of Disk 0:

===============

Disk ID: 34DB9D92

Partition ### Type Size Offset

------------- ---------------- ------- -------

Partition 1 OEM 39 MB 31 KB

Partition 2 Primary 14 GB 40 MB

Partition 3 Primary 581 GB 14 GB

==================================================================================

Disk: 0

Partition 1

Type : DE

Hidden: Yes

Active: No

Volume ### Ltr Label Fs Type Size Status Info

---------- --- ----------- ----- ---------- ------- --------- --------

* Volume 4 FAT Partition 39 MB Healthy Hidden

=========================================================

Disk: 0

Partition 2

Type : 07

Hidden: No

Active: Yes

Volume ### Ltr Label Fs Type Size Status Info

---------- --- ----------- ----- ---------- ------- --------- --------

* Volume 1 E RECOVERY NTFS Partition 14 GB Healthy

=========================================================

Disk: 0

Partition 3

Type : 07

Hidden: No

Active: No

Volume ### Ltr Label Fs Type Size Status Info

---------- --- ----------- ----- ---------- ------- --------- --------

* Volume 2 C OS NTFS Partition 581 GB Healthy

=========================================================

Partitions of Disk 1:

===============

Disk ID: D6C29F39

Partition ### Type Size Offset

------------- ---------------- ------- -------

Partition 1 Primary 29 GB 1356 KB

==================================================================================

Disk: 1

Partition 1

Type : 0B

Hidden: No

Active: No

Volume ### Ltr Label Fs Type Size Status Info

---------- --- ----------- ----- ---------- ------- --------- --------

* Volume 3 F CENTON USB FAT32 Removable 29 GB Healthy

=========================================================

============================== MBR & Partition Table ==================

====================================================================

Disk: 0 (MBR Code: Windows Vista) (Size: 596 GB) (Disk ID: 34DB9D92)

Partition 1: (Not Active) - (Size=39 MB) - (Type=DE)

Partition 2: (Active) - (Size=15 GB) - (Type=07) (NTFS)

Partition 3: (Not Active) - (Size=581 GB) - (Type=07) (NTFS)

====================================================================

Disk: 1 (Size: 29 GB) (Disk ID: D6C29F39)

Partition 1: (Not Active) - (Size=29 GB) - (Type=0B)

Last Boot: 2013-04-25 02:46

==================== End Of Log ============================

MrCharlie · April 25, 2013

OK, here you go......This should get you going:

Please download the attached fixlist.txt and copy it to your flashdrive.

NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system

On Vista or Windows 7: Now please enter System Recovery Options. (as you did before)

Run FRST64 or FRST (which ever one you're using) and press the Fix button just once and wait.

The tool will make a log on the flashdrive (Fixlog.txt) please post it to your reply.

See if the computer boots normally now.

MrC

Jetter · April 25, 2013

Thanks again. Yes, the pc boots normally now.

Here is the log:

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 25-04-2013

Ran by SYSTEM at 2013-04-25 21:36:31 Run:1

Running from F:\

Boot Mode: Recovery

==============================================

HKEY_USERS\dorothy\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\\Shell value deleted successfully.

C:\Users\dorothy\Desktop\kdgc.tmp moved successfully.

C:\Users\dorothy\AppData\Roaming\i.ini moved successfully.

==== End of Fixlog ====

MrCharlie · April 25, 2013

OK...Good, we have to run some more scans to make sure you're clean:

Please download and run RogueKiller 32 Bit to your desktop.

RogueKiller 64 Bit <---use this one for 64 bit systems

Quit all running programs.

For Windows XP, double-click to start.

For Vista or Windows 7-8, do a right-click on the program, select Run as Administrator to start, & when prompted Allow to run.

Click Scan to scan the system.

When the scan completes > Close out the program > Don't Fix anything!

Don't run any other options, they're not all bad!!!!!!!

Post back the report which should be located on your desktop.

(please don't put logs in code or quotes)

P2P Warning:

If you're using Peer 2 Peer software such as uTorrent, BitTorrent or similar you must either fully uninstall it or completely disable it from running while being assisted here.
Failure to remove or disable such software will result in your topic being closed and no further assistance being provided.

MrC

Note:

Make sure you're subscribed to this topic:

Click on the

Follow This Topic Button

(at the top right of this page), make sure that the

Receive notification

box is checked and that it is set to

Instantly

Removing malware can be unpredictable

...things can go very wrong!

Backup

any files that cannot be replaced. You can copy them to a CD/DVD, external drive or a pen drive

<+>

Please don't run any other scans, download, install or uninstall any programs while I'm working with you.

<+>The removal of malware isn't instantaneous, please be patient.

<+>

Please stick with me until I give you the "all clear".

------->Your topic will be closed if you haven't replied within 3 days!<--------

(If I don't respond within 24 hours, please send me a PM)

Jetter · April 26, 2013

I have subscribed to instant notifications on thread as you suggested. There appears to be a lot of crapola on this pc. Maybe some P2Ps, I dunno, but I closed off what I was sure was not needed.

RogueKiller log follows:

RogueKiller V8.5.4 _x64_ [Mar 18 2013] by Tigzy

mail : tigzyRK<at>gmail<dot>com

Feedback : http://www.geekstogo.com/forum/files/file/413-roguekiller/

Website : http://tigzy.geekstogo.com/roguekiller.php

Blog : http://tigzyrk.blogspot.com/

Operating System : Windows 7 (6.1.7601 Service Pack 1) 64 bits version

Started in : Normal mode

User : dorothy [Admin rights]

Mode : Scan -- Date : 04/25/2013 21:58:10

| ARK || FAK || MBR |

¤¤¤ Bad processes : 0 ¤¤¤

¤¤¤ Registry Entries : 10 ¤¤¤

[TASK][ROGUE ST] 0 : c:\program files (x86)\internet explorer\iexplore.exe -> FOUND

[TASK][ROGUE ST] 4958 : wscript.exe C:\Users\dorothy\AppData\Local\Temp\launchie.vbs //B -> FOUND

[HJ] HKLM\[...]\System : ConsentPromptBehaviorAdmin (0) -> FOUND

[HJ] HKLM\[...]\Wow6432Node\System : ConsentPromptBehaviorAdmin (0) -> FOUND

[HJ] HKLM\[...]\System : EnableLUA (0) -> FOUND

[HJ] HKLM\[...]\Wow6432Node\System : EnableLUA (0) -> FOUND

[HJ DESK] HKCU\[...]\ClassicStartMenu : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> FOUND

[HJ DESK] HKCU\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> FOUND

[HJ DESK] HKLM\[...]\NewStartPanel : {59031a47-3f72-44a7-89c5-5595fe6b30ee} (1) -> FOUND

[HJ DESK] HKLM\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> FOUND

¤¤¤ Particular Files / Folders: ¤¤¤

¤¤¤ Driver : [NOT LOADED] ¤¤¤

¤¤¤ HOSTS File: ¤¤¤

--> C:\Windows\system32\drivers\etc\hosts

¤¤¤ MBR Check: ¤¤¤

+++++ PhysicalDrive0: WDC WD6400AAKS-75A7B2 ATA Device +++++

--- User ---

[MBR] 8ea298e442e89aa54f250fa9c5563a7b

[bSP] 722da657bcf1fbe43b78d2ead99142f4 : Windows Vista MBR Code

Partition table:

0 - [XXXXXX] DELL-UTIL (0xde) [VISIBLE] Offset (sectors): 63 | Size: 39 Mo

1 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 81920 | Size: 15000 Mo

2 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 30801920 | Size: 595439 Mo

User = LL1 ... OK!

User = LL2 ... OK!

Finished : << RKreport[1]_S_04252013_02d2158.txt >>

RKreport[1]_S_04252013_02d2158.txt

MrCharlie · April 26, 2013

Yes it needs some care!

Run RogueKiller again and click Scan

When the scan completes > click on the Registry tab

Put a check next to all of these and uncheck the rest: (if found)

[TASK][ROGUE ST] 0 : c:\program files (x86)\internet explorer\iexplore.exe -> FOUND
[TASK][ROGUE ST] 4958 : wscript.exe C:\Users\dorothy\AppData\Local\Temp\launchie.vbs //B -> FOUND

Now click Delete on the right hand column under Options

-------------

The most important things to remember when running it is to disable all your malware programs and run Combofix from your desktop.

Please visit this webpage for download links, and instructions for running ComboFix

http://www.bleepingc...to-use-combofix

Ensure you have disabled all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

Information on disabling your malware programs can be found Here.

Make sure you run ComboFix from your desktop.

Give it at least 30-45 minutes to finish if needed.

Please include the C:\ComboFix.txt in your next reply for further review.

---------->NOTE<----------

If you get the message Illegal operation attempted on registry key that has been marked for deletion after you run ComboFix....please reboot the computer, this should resolve the problem. You may have to do this several times if needed.

MrC

Jetter · April 26, 2013

OK, the 2 registry keys were deleted by RogueKiller.

Here is the log from ComboFix:

ComboFix 13-04-25.01 - dorothy 04/25/2013 22:33:55.1.2 - x64

Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.4061.2602 [GMT -4:00]

Running from: c:\users\dorothy\Desktop\ComboFix.exe

AV: Trend Micro Titanium Maximum Security *Disabled/Outdated* {68F968AC-2AA0-091D-848C-803E83E35902}

SP: Trend Micro Titanium Maximum Security *Disabled/Outdated* {D3988948-0C9A-0693-BE3C-BB4CF86413BF}

SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

C:\Install.exe

c:\users\dorothy\AppData\Local\{7DB1B86B-AFA7-4A22-9612-36263C188C54}

c:\users\dorothy\AppData\Local\Temp\1.tmp\F_IN_BOX.dll

c:\users\dorothy\AppData\Roaming\dorothylog.dat

c:\users\dorothy\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe

c:\users\dorothy\Favorites\ccsetup302.exe

c:\windows\SysWow64\WinDir

c:\windows\wininit.ini

c:\windows\XSxS

.

((((((((((((((((((((((((( Files Created from 2013-03-26 to 2013-04-26 )))))))))))))))))))))))))))))))

.

2013-04-26 02:13 . 2013-04-26 02:13 -------- d-----w- c:\program files (x86)\Mozilla Maintenance Service

2013-04-26 02:13 . 2013-04-26 02:13 626688 ----a-w- c:\program files (x86)\Mozilla Firefox\msvcr80.dll

2013-04-26 02:13 . 2013-04-26 02:13 588728 ----a-w- c:\program files (x86)\Mozilla Firefox\gkmedias.dll

2013-04-26 02:13 . 2013-04-26 02:13 548864 ----a-w- c:\program files (x86)\Mozilla Firefox\msvcp80.dll

2013-04-26 02:13 . 2013-04-26 02:13 479232 ----a-w- c:\program files (x86)\Mozilla Firefox\msvcm80.dll

2013-04-26 02:13 . 2013-04-26 02:13 43960 ----a-w- c:\program files (x86)\Mozilla Firefox\mozglue.dll

2013-04-26 02:13 . 2013-04-26 02:13 157352 ----a-w- c:\program files (x86)\Mozilla Firefox\maintenanceservice_installer.exe

2013-04-26 02:13 . 2013-04-26 02:13 129976 ----a-w- c:\program files (x86)\Mozilla Firefox\maintenanceservice.exe

2013-04-26 02:12 . 2013-04-26 02:12 -------- d-----w- c:\users\dorothy\AppData\Local\Macromedia

2013-04-26 00:47 . 2013-04-26 00:47 -------- d-----w- C:\FRST

2013-04-25 06:04 . 2013-04-25 06:04 -------- d-----w- c:\users\Jake\AppData\Local\Diagnostics

2013-04-25 04:32 . 2013-04-25 05:52 -------- d-----w- c:\programdata\Spybot - Search & Destroy

2013-04-25 00:19 . 2013-04-25 00:19 -------- d-----w- c:\users\Jake\AppData\Local\Macromedia

2013-04-24 12:53 . 2013-04-24 12:53 -------- d-----w- c:\programdata\kna

2013-04-24 11:59 . 2013-04-12 14:45 1656680 ----a-w- c:\windows\system32\drivers\ntfs.sys

2013-04-14 17:49 . 2013-02-22 06:21 499200 ----a-w- c:\program files\Internet Explorer\jsdbgui.dll

2013-04-14 16:44 . 2013-02-15 06:06 3717632 ----a-w- c:\windows\system32\mstscax.dll

2013-04-14 16:44 . 2013-02-15 04:37 3217408 ----a-w- c:\windows\SysWow64\mstscax.dll

2013-04-14 16:44 . 2013-02-15 06:08 44032 ----a-w- c:\windows\system32\tsgqec.dll

2013-04-14 16:44 . 2013-02-15 06:02 158720 ----a-w- c:\windows\system32\aaclient.dll

2013-04-14 16:44 . 2013-02-15 04:34 131584 ----a-w- c:\windows\SysWow64\aaclient.dll

2013-04-14 16:44 . 2013-02-15 03:25 36864 ----a-w- c:\windows\SysWow64\tsgqec.dll

2013-04-14 16:37 . 2013-01-24 06:01 223752 ----a-w- c:\windows\system32\drivers\fvevol.sys

2013-04-14 16:37 . 2013-03-19 06:04 5550424 ----a-w- c:\windows\system32\ntoskrnl.exe

2013-04-14 16:37 . 2013-03-19 05:04 3968856 ----a-w- c:\windows\SysWow64\ntkrnlpa.exe

2013-04-14 16:37 . 2013-03-19 05:04 3913560 ----a-w- c:\windows\SysWow64\ntoskrnl.exe

2013-04-14 16:37 . 2013-03-19 05:46 43520 ----a-w- c:\windows\system32\csrsrv.dll

2013-04-14 16:37 . 2013-03-19 04:47 6656 ----a-w- c:\windows\SysWow64\apisetschema.dll

2013-04-14 16:37 . 2013-03-19 03:06 112640 ----a-w- c:\windows\system32\smss.exe

2013-04-14 16:36 . 2013-03-01 03:36 3153408 ----a-w- c:\windows\system32\win32k.sys

2013-04-06 02:30 . 2013-04-13 18:57 -------- d-----w- C:\Modio

2013-03-31 16:19 . 2013-03-31 16:19 -------- d-----w- C:\Cache

2013-03-31 16:19 . 2013-03-31 16:19 -------- d-----w- C:\visi

2013-03-31 16:19 . 2013-03-31 16:19 -------- d-----w- C:\w

2013-03-31 16:19 . 2013-03-31 16:19 -------- d-----w- C:\skins

2013-03-30 00:35 . 2013-02-12 04:12 19968 ----a-w- c:\windows\system32\drivers\usb8023.sys

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2013-04-14 17:50 . 2010-03-12 17:05 72702784 ----a-w- c:\windows\system32\MRT.exe

2013-03-13 21:40 . 2012-09-05 15:14 693976 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe

2013-03-13 21:40 . 2011-05-15 04:27 73432 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl

2013-02-12 05:45 . 2013-03-13 21:44 135168 ----a-w- c:\windows\apppatch\AppPatch64\AcXtrnal.dll

2013-02-12 05:45 . 2013-03-13 21:44 308736 ----a-w- c:\windows\apppatch\AppPatch64\AcGenral.dll

2013-02-12 05:45 . 2013-03-13 21:44 350208 ----a-w- c:\windows\apppatch\AppPatch64\AcLayers.dll

2013-02-12 05:45 . 2013-03-13 21:44 111104 ----a-w- c:\windows\apppatch\AppPatch64\acspecfc.dll

2013-02-12 04:48 . 2013-03-13 21:44 474112 ----a-w- c:\windows\apppatch\AcSpecfc.dll

2013-02-12 04:48 . 2013-03-13 21:44 2176512 ----a-w- c:\windows\apppatch\AcGenral.dll

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

.

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]

"{81017EA9-9AA8-4A6A-9734-7AF40E7D593F}"= "c:\program files (x86)\Yahoo!\Companion\Installs\cpn7\yt.dll" [2013-04-01 1500440]

.

[HKEY_CLASSES_ROOT\clsid\{81017ea9-9aa8-4a6a-9734-7af40e7d593f}]

[HKEY_CLASSES_ROOT\yt.YTNavAssistPlugin.1]

[HKEY_CLASSES_ROOT\TypeLib\{003028C2-EA1C-4676-A316-B5CB50917002}]

[HKEY_CLASSES_ROOT\yt.YTNavAssistPlugin]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\~\Browser Helper Objects\{1631550F-191D-4826-B069-D9439253D926}]

2010-03-28 19:53 353656 ----a-w- c:\program files (x86)\PriceGong\2.1.0\PriceGongIE.dll

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\~\Browser Helper Objects\{28387537-e3f9-4ed7-860c-11e69af4a8a0}]

2011-05-30 13:35 89008 ----a-w- c:\progra~2\IMESHA~1\MediaBar\Datamngr\ToolBar\imeshdtxmltbpi.dll

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\~\Browser Helper Objects\{44ed99e2-16a6-4b89-80d6-5b21cf42e78b}]

2012-10-25 23:19 378568 ----a-w- c:\program files (x86)\UnfriendApp\IE\common.dll

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\~\Browser Helper Objects\{474597C5-AB09-49d6-A4D5-2E8D7341384E}]

2011-08-09 12:35 1235336 ----a-w- c:\progra~2\IMESHA~1\MediaBar\Datamngr\IEBHO.dll

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\~\Browser Helper Objects\{627af46b-2076-42ae-a2fd-8428734d3e74}]

2010-02-10 16:36 86016 ----a-w- c:\program files (x86)\simppulltoolbar\simppulldx.dll

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\~\Browser Helper Objects\{C4B8BAB4-1667-11DF-A242-BA9455D89593}]

2009-10-20 15:50 258008 ----a-w- c:\program files (x86)\simppulltoolbar\auxi\simppulltoolbAu.dll

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\~\Browser Helper Objects\{CB0D163C-E9F4-4236-9496-0597E24B23A5}]

2010-10-17 09:57 779664 ----a-w- c:\program files (x86)\GamesBar\2.0.1.73\oberontb.dll

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar]

"{627af46b-2076-42ae-a2fd-8428734d3e74}"= "c:\program files (x86)\simppulltoolbar\simppulldx.dll" [2010-02-10 86016]

"{28387537-e3f9-4ed7-860c-11e69af4a8a0}"= "c:\progra~2\IMESHA~1\MediaBar\Datamngr\ToolBar\imeshdtxmltbpi.dll" [2011-05-30 89008]

.

[HKEY_CLASSES_ROOT\clsid\{627af46b-2076-42ae-a2fd-8428734d3e74}]

.

[HKEY_CLASSES_ROOT\clsid\{28387537-e3f9-4ed7-860c-11e69af4a8a0}]

.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"swg"="c:\program files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2011-01-04 39408]

"SearchEngineProtection"="c:\program files (x86)\Gamesbar\SearchEngineProtection.exe" [2010-10-17 546192]

"MotoCast"="c:\program files (x86)\Motorola Mobility\MotoCast\MotoLauncher.lnk" [2012-08-01 2053]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]

"BrMfcWnd"="c:\program files (x86)\Brother\Brmfcmon\BrMfcWnd.exe" [2009-05-26 1159168]

"ControlCenter3"="c:\program files (x86)\Brother\ControlCenter3\brctrcen.exe" [2008-12-24 114688]

"APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2013-01-28 59720]

"InstaLAN"="c:\program files (x86)\Belkin\Router Setup and Monitor\BelkinRouterMonitor.exe" [2011-05-27 2015136]

"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2011-06-09 254696]

"Adobe Reader Speed Launcher"="c:\program files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2012-07-31 38872]

"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-12-03 946352]

"QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" [2012-10-25 421888]

"iTunesHelper"="c:\program files (x86)\iTunes\iTunesHelper.exe" [2013-02-20 152392]

.

c:\users\Jake\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\

Dell Dock.lnk - c:\program files\Dell\DellDock\DellDock.exe [2009-9-21 1316192]

.

c:\users\dorothy\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\

Dell Dock.lnk - c:\program files (x86)\Dell\DellDock\DellDock.exe [N/A]

MP3 Rocket (Minimized).lnk - c:\program files (x86)\MP3 Rocket\MP3Rocket.exe [2011-5-3 175104]

OneNote 2007 Screen Clipper and Launcher.lnk - c:\program files (x86)\Microsoft Office\Office12\ONENOTEM.EXE [2009-2-26 97680]

.

c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\

Rand McNally Dock.lnk - c:\program files (x86)\Rand McNally\RNDDock\StartupLauncher.bat [2012-12-19 25]

.

c:\users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\

Dell Dock First Run.lnk - c:\program files\Dell\DellDock\DellDock.exe [2009-9-21 1316192]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"ConsentPromptBehaviorAdmin"= 0 (0x0)

"ConsentPromptBehaviorUser"= 3 (0x3)

"EnableLUA"= 0 (0x0)

"EnableUIADesktopToggle"= 0 (0x0)

"PromptOnSecureDesktop"= 0 (0x0)

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]

"LoadAppInit_DLLs"=1 (0x1)

"AppInit_DLLs"=c:\progra~2\IMESHA~1\MediaBar\Datamngr\IEBHO.dll

.

R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]

R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe [2012-07-13 160944]

R3 BTCFilterService;USB Networking Driver Filter Service;c:\windows\system32\DRIVERS\motfilt.sys [2009-01-29 6144]

R3 CtClsFlt;Creative Camera Class Upper Filter Driver;c:\windows\system32\DRIVERS\CtClsFlt.sys [2009-06-15 172704]

R3 motandroidusb;Mot ADB Interface Driver;c:\windows\system32\Drivers\motoandroid.sys [2009-07-10 31744]

R3 motccgp;Motorola USB Composite Device Driver;c:\windows\system32\DRIVERS\motccgp.sys [2012-06-11 22016]

R3 motccgpfl;MotCcgpFlService;c:\windows\system32\DRIVERS\motccgpfl.sys [2012-01-25 9728]

R3 Motousbnet;Motorola USB Networking Driver Service;c:\windows\system32\DRIVERS\Motousbnet.sys [2012-06-08 27136]

R3 motusbdevice;Motorola USB Dev Driver;c:\windows\system32\DRIVERS\motusbdevice.sys [2011-11-08 11776]

R3 NPF;NetGroup Packet Filter Driver;c:\windows\system32\drivers\npf.sys [2010-06-25 35344]

R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-20 59392]

R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys [2012-09-28 53760]

R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [2010-03-12 1255736]

S0 PxHlpa64;PxHlpa64;c:\windows\System32\Drivers\PxHlpa64.sys [2009-07-09 55280]

S2 Amsp;Trend Micro Solution Platform;c:\program files\Trend Micro\AMSP\coreServiceShell.exe coreFrameworkHost.exe [x]

S2 DeviceMonitorService;DeviceMonitorService;c:\program files (x86)\Motorola Media Link\Lite\NServiceEntry.exe [2012-06-05 87400]

S2 DockLoginService;Dock Login Service;c:\program files\Dell\DellDock\DockLogin.exe [2009-06-09 155648]

S2 Motorola Device Manager;Motorola Device Manager Service;c:\program files (x86)\Motorola Mobility\Motorola Device Manager\MotoHelperService.exe [2012-07-17 116632]

S2 PST Service;PST Service;c:\program files (x86)\Motorola\MotForwardDaemon\ForwardDaemon.exe [2011-09-02 65657]

S2 SftService;SoftThinks Agent Service;c:\program files (x86)\Dell DataSafe Local Backup\sftservice.EXE [2009-09-17 656624]

S2 tmevtmgr;tmevtmgr;c:\windows\system32\DRIVERS\tmevtmgr.sys [2011-03-16 67664]

S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [2009-05-22 215040]

S3 RTL8192cu;Surf Wireless Micro USB Adapter;c:\windows\system32\DRIVERS\RTL8192cu.sys [2011-05-03 762472]

S3 VIACRX64;VIACRX64;c:\windows\system32\DRIVERS\viacr64.sys [2009-07-14 100864]

.

--- Other Services/Drivers In Memory ---

.

*NewlyCreated* - WS2IFSL

.

Contents of the 'Scheduled Tasks' folder

.

2013-04-26 c:\windows\Tasks\Adobe Flash Player Updater.job

- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-09-05 21:40]

.

2013-04-26 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job

- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-01-04 20:31]

.

2013-04-26 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job

- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-01-04 20:31]

.

2013-04-25 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2754924291-2942948176-839923927-1000Core.job

- c:\users\dorothy\AppData\Local\Google\Update\GoogleUpdate.exe [2011-06-27 10:02]

.

2013-04-26 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2754924291-2942948176-839923927-1000UA.job

- c:\users\dorothy\AppData\Local\Google\Update\GoogleUpdate.exe [2011-06-27 10:02]

.

2013-04-25 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2754924291-2942948176-839923927-1005Core.job

- c:\users\Jake\AppData\Local\Google\Update\GoogleUpdate.exe [2012-09-22 04:46]

.

2013-04-26 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2754924291-2942948176-839923927-1005UA.job

- c:\users\Jake\AppData\Local\Google\Update\GoogleUpdate.exe [2012-09-22 04:46]

.

--------- X64 Entries -----------

.

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{474597C5-AB09-49d6-A4D5-2E8D7341384E}]

2011-08-09 12:35 1792904 ----a-w- c:\progra~2\IMESHA~1\MediaBar\Datamngr\x64\IEBHO.dll

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"IgfxTray"="c:\windows\system32\igfxtray.exe" [2010-08-26 161304]

"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2010-08-26 386584]

"Persistence"="c:\windows\system32\igfxpers.exe" [2010-08-26 415256]

"Trend Micro Titanium"="c:\program files\Trend Micro\Titanium\UIFramework\uiWinMgr.exe" [2011-10-08 1111568]

"Trend Micro Client Framework"="c:\program files\Trend Micro\UniClient\UiFrmWrk\UIWatchDog.exe" [2011-02-10 197152]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]

"AppInit_DLLs"=c:\progra~2\IMESHA~1\MediaBar\Datamngr\x64\datamngr.dll c:\progra~2\IMESHA~1\MediaBar\Datamngr\x64\IEBHO.dll

.

------- Supplementary Scan -------

.

uLocal Page = c:\windows\system32\blank.htm

uStart Page = hxxp://www.google.com/

mStart Page = hxxp://home.sweetim.com/?crg=3.1010000&st=18&barid={4FA76F59-FCF2-435E-B10B-ACCB56199629}

mLocal Page = c:\windows\SysWOW64\blank.htm

uInternet Settings,ProxyOverride = *.local;192.168.*.*

IE: Crawler Search - tbr:iemenu

IE: E&xport to Microsoft Excel - c:\progra~2\MICROS~2\Office12\EXCEL.EXE/3000

IE: {{1A93C934-025B-4c3a-B38E-9654A7003239} - {6F282B65-56BF-4BD1-A8B2-A4449A05863D} - c:\program files (x86)\GamesBar\2.0.1.73\oberontb.dll

TCP: DhcpNameServer = 192.168.1.1

Handler: tbr - {4D25FB7A-8902-4291-960E-9ADA051CFBBF} - c:\progra~2\Crawler\Toolbar\ctbr.dll

DPF: {7DD62E58-5FA8-11D2-AFB7-00104B64F127} - hxxp://www.swiftview.com/product/public/svinstall_green.exe

FF - ProfilePath - c:\users\dorothy\AppData\Roaming\Mozilla\Firefox\Profiles\l2np5euz.default\

FF - prefs.js: browser.search.defaulturl -

FF - prefs.js: browser.search.selectedEngine - SweetIM Search

FF - prefs.js: browser.startup.homepage - hxxp://home.sweetim.com/?crg=3.1010000&st=18&barid={4FA76F59-FCF2-435E-B10B-ACCB56199629}

FF - prefs.js: keyword.URL - hxxp://search.sweetim.com/search.asp?src=2&barid={4FA76F59-FCF2-435E-B10B-ACCB56199629}&q=

FF - prefs.js: network.proxy.type - 0

FF - user.js: yahoo.ytff.general.dontshowhpoffer - true

.

- - - - ORPHANS REMOVED - - - -

.

BHO-{E4E6BF2A-1667-11DF-A01F-1F9655D89593} - (no file)

Toolbar-Locked - (no file)

Toolbar-10 - (no file)

Wow6432Node-HKCU-Run-Startup Manager - c:\program files (x86)\iYogi SupportDock\Optimize\startupmanager.exe

Wow6432Node-HKCU-Run-TrendSecure Remote File Lock - c:\program files\Trend Micro\TrendSecure\RemoteFileLock\FLMain.exe

Wow6432Node-HKCU-Run-Messenger (Yahoo!) - ~c:\progra~2\Yahoo!\Messenger\YahooMessenger.exe

Wow6432Node-HKCU-Run-Spybot-S&D Cleaning - e:\spybotportable\App\Spybot\SDCleaner.exe

Wow6432Node-HKLM-Run-iYogiToolbar - c:\program files (x86)\iYogi SupportDock\iYogiSupportDock.exe

Wow6432Node-HKLM-Run-dellsupportcenter - c:\program files (x86)\Dell Support Center\bin\sprtcmd.exe

Wow6432Node-HKLM-Run-SweetIM - c:\program files (x86)\SweetIM\Messenger\SweetIM.exe

Wow6432Node-HKLM-Run-DATAMNGR - c:\progra~2\IMESHA~1\MediaBar\Datamngr\DATAMN~1.EXE

SafeBoot-mcmscsvc

SafeBoot-MCODS

Toolbar-Locked - (no file)

Toolbar-10 - (no file)

AddRemove-Adobe Shockwave Player - c:\windows\system32\Adobe\Shockwave 11\uninstaller.exe

AddRemove-{612AD33D-9824-4E87-8396-92374E91C4BB}_is1 - c:\program files (x86)\Inbox Toolbar\unins000.exe

.

--------------------- LOCKED REGISTRY KEYS ---------------------

.

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]

@Denied: (A 2) (Everyone)

@="FlashBroker"

"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_6_602_180_ActiveX.exe,-101"

.

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]

"Enabled"=dword:00000001

.

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]

@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_6_602_180_ActiveX.exe"

.

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

.

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]

@Denied: (A 2) (Everyone)

@="IFlashBroker5"

.

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]

@="{00020424-0000-0000-C000-000000000046}"

.

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

"Version"="1.0"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]

@Denied: (A 2) (Everyone)

@="FlashBroker"

"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_6_602_180_ActiveX.exe,-101"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]

"Enabled"=dword:00000001

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_6_602_180_ActiveX.exe"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]

@Denied: (A 2) (Everyone)

@="Shockwave Flash Object"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_6_602_180.ocx"

"ThreadingModel"="Apartment"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]

@="0"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]

@="ShockwaveFlash.ShockwaveFlash.11"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_6_602_180.ocx, 1"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]

@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]

@="1.0"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]

@="ShockwaveFlash.ShockwaveFlash"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]

@Denied: (A 2) (Everyone)

@="Macromedia Flash Factory Object"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_6_602_180.ocx"

"ThreadingModel"="Apartment"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]

@="FlashFactory.FlashFactory.1"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_6_602_180.ocx, 1"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]

@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]

@="1.0"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]

@="FlashFactory.FlashFactory"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]

@Denied: (A 2) (Everyone)

@="IFlashBroker5"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]

@="{00020424-0000-0000-C000-000000000046}"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

"Version"="1.0"

.

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

"MSCurrentCountry"=dword:000000b5

.

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]

@Denied: (Full) (Everyone)

.

------------------------ Other Running Processes ------------------------

.

c:\program files (x86)\Belkin\Router Setup and Monitor\BelkinService.exe

c:\program files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

c:\program files (x86)\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe

c:\program files (x86)\Yahoo!\SoftwareUpdate\YahooAUService.exe

c:\program files (x86)\Motorola Mobility\Motorola Device Manager\MotoHelperAgent.exe

c:\program files (x86)\Motorola Mobility\MotoCast\MotoCast.exe

c:\program files (x86)\Brother\ControlCenter3\brccMCtl.exe

c:\program files (x86)\Brother\Brmfcmon\BrMfcmon.exe

c:\program files (x86)\Java\jre6\bin\javaw.exe

c:\program files (x86)\Rand McNally\RNDDock\RNDDock.exe

c:\program files (x86)\Belkin\Router Setup and Monitor\BelkinSetup.exe

c:\program files (x86)\Motorola Mobility\MotoCast\bin\MotoCast-thumbnailer.exe

.

**************************************************************************

.

Completion time: 2013-04-25 22:50:28 - machine was rebooted

ComboFix-quarantined-files.txt 2013-04-26 02:50

.

Pre-Run: 546,484,666,368 bytes free

Post-Run: 547,753,070,592 bytes free

.

- - End Of File - - 29488D1F1D51BB980BBCDDDD32711C02

MrCharlie · April 26, 2013

Can you take a look in these two folders and let me know what's in them and do you recognize them:

2013-04-24 07:53 - 2013-04-24 07:53 - 00000000 ____D C:ProgramData\kna

2013-04-24 07:53 - 2013-04-24 07:53 - 00000000 ____D C:ProgramData\Application Data\kna

You may have to enable hidden files to see them:

http://www.howtogeek...-windows-vista/

Also the same for this file:

2013-04-24 07:52 - 2013-04-24 07:52 - 00155128 ____A (Hilgraeve, Inc.) C:\Users\dorothy\Desktop\kdgc.tmp

If you don't recognize it...please upload it to VirusTotal for a free scan and let me know the results: (just copy back the url)

http://www.virustotal.com/

--------------------------------

AdwCleaner is a reliable removal tool for Adware, Foistware, toolbars and potentially unwanted programs.
AdwCleaner is a tool that deletes :
· Adwares (software ads)
· PUP/LPI (Potentially Undesirable Program)
· Toolbars
· Hijacker (Hijack of the browser's homepage)
It works with a Search and Deletion methode. It can be easily uninstalled using the "Uninstall" mode.

Right-click on adwcleaner.exe and select Run As Administrator (for XP just double click) to launch the application.
Now click on the Search tab.
Please post the contents of the log-file created in your next post.

Note: The log can also be located at C:\ >> AdwCleaner[XX].txt >> XX <-- Denotes the number of times the application has been ran, so in this should be something like R1.

Note:

Please look over what was found......especially any folders, we're going to permanently delete it all in the next step....if there's something you may want to keep...please let me know and I'll explain to why it shouldn't be on your system.

If you see AVG Secure Search being targeted for deletion, Here's Why and Here. You can always Reinstall it.

Please note that Antivir Webguard uses ASK Toolbar as part of its web security. If you remove ASK by using Adwcleaner, Antivir Webguard will no longer work properly. Therefore, if you use this program please use the instructions below to access the options screen where you should enable /DisableAskDetections before using AdwCleaner.
You can click on the question mark (?) in the upper left corner of the program and then click on Options. You will then be presented with a dialog where you can disable various detections. These options are described below:
/DisableAskDetection - This option disables Ask Toolbar detection.

MrC

Jetter · April 26, 2013

Good morning MrC.

I will do as you say, however, I'm on my way to work now. I should be back home and able to begin with it by 5pm Eastern.

Thank you again for your assistance.

Jetter

MrCharlie · April 26, 2013

OK...no rush, MrC

Jetter · April 26, 2013

OK. I've checked the folders/files

2013-04-24 07:53 - 2013-04-24 07:53 - 00000000 ____D C:ProgramData\kna -- is an empty folder
2013-04-24 07:53 - 2013-04-24 07:53 - 00000000 ____D C:ProgramData\Application Data\kna -- Access Denied to "Application Data"
2013-04-24 07:52 - 2013-04-24 07:52 - 00155128 ____A (Hilgraeve, Inc.) C:\Users\dorothy\Desktop\kdgc.tmp -- This file doesn't seem to exist. (Have everything unhidden)

Here is the log from AdwCleaner:

# AdwCleaner v2.202 - Logfile created 04/26/2013 at 17:34:07

# Updated 23/04/2013 by Xplode

# Operating system : Windows 7 Home Premium Service Pack 1 (64 bits)

# User : dorothy - DOROTHY-PC

# Boot Mode : Normal

# Running from : C:\Users\dorothy\Desktop\adwcleaner.exe

# Option [search]

***** [services] *****

***** [Files / Folders] *****

File Found : C:\END

File Found : C:\Program Files (x86)\Mozilla Firefox\searchplugins\SearchResults.xml

File Found : C:\Users\dorothy\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_home.sweetim.com_0.localstorage

File Found : C:\Users\dorothy\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_home.sweetim.com_0.localstorage-journal

File Found : C:\Users\dorothy\AppData\Roaming\Mozilla\Firefox\Profiles\l2np5euz.default\searchplugins\SearchResults.xml

Folder Found : C:\Program Files (x86)\Crawler

Folder Found : C:\Program Files (x86)\GamesBar

Folder Found : C:\Program Files (x86)\iMesh Applications\Mediabar

Folder Found : C:\Program Files (x86)\Inbox Toolbar

Folder Found : C:\Program Files (x86)\PriceGong

Folder Found : C:\Program Files (x86)\SweetIM

Folder Found : C:\ProgramData\Ask

Folder Found : C:\ProgramData\boost_interprocess

Folder Found : C:\ProgramData\GamesBar

Folder Found : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Crawler Toolbar

Folder Found : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\GamesBar

Folder Found : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Inbox Toolbar

Folder Found : C:\ProgramData\Tarma Installer

Folder Found : C:\Users\dorothy\AppData\Local\Google\Chrome\User Data\Default\Extensions\afbcibndhffhhbokgpbpecjmejjcgcej

Folder Found : C:\Users\dorothy\AppData\Local\PackageAware

Folder Found : C:\Users\dorothy\AppData\LocalLow\Conduit

Folder Found : C:\Users\dorothy\AppData\LocalLow\imeshbandmltbpi

Folder Found : C:\Users\dorothy\AppData\LocalLow\Inbox Toolbar

Folder Found : C:\Users\dorothy\AppData\LocalLow\mediabarim

Folder Found : C:\Users\dorothy\AppData\LocalLow\PriceGong

Folder Found : C:\Users\dorothy\AppData\LocalLow\SweetIM

Folder Found : C:\Users\dorothy\AppData\Roaming\Mozilla\Firefox\Profiles\l2np5euz.default\extensions\{28387537-e3f9-4ed7-860c-11e69af4a8a0}

Folder Found : C:\Users\dorothy\AppData\Roaming\Mozilla\Firefox\Profiles\l2np5euz.default\mediabarim

Folder Found : C:\Users\dorothy\AppData\Roaming\RebateInformer

Folder Found : C:\Users\Jake\AppData\LocalLow\imeshbandmltbpi

Folder Found : C:\Users\Jake\AppData\LocalLow\Inbox Toolbar

Folder Found : C:\Users\Jake\AppData\LocalLow\mediabarim

Folder Found : C:\Users\Jake\AppData\LocalLow\PriceGong

Folder Found : C:\Users\Jake\AppData\LocalLow\SweetIM

***** [Registry] *****

Data Found : [x64] HKLM\..\Windows [AppInit_DLLs] = C:\PROGRA~2\IMESHA~1\MediaBar\Datamngr\x64\datamngr.dll

Data Found : [x64] HKLM\..\Windows [AppInit_DLLs] = C:\PROGRA~2\IMESHA~1\MediaBar\Datamngr\x64\IEBHO.dll

Key Found : HKCU\Software\AppDataLow\Software\Conduit

Key Found : HKCU\Software\AppDataLow\Software\PriceGong

Key Found : HKCU\Software\AppDataLow\Software\SmartBar

Key Found : HKCU\Software\Conduit

Key Found : HKCU\Software\CToolbar

Key Found : HKCU\Software\Google\Chrome\Extensions\afbcibndhffhhbokgpbpecjmejjcgcej

Key Found : HKCU\Software\Inbox Toolbar

Key Found : HKCU\Software\Microsoft\Internet Explorer\MenuExt\Crawler Search

Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{02478D38-C3F9-4EFB-9B51-7695ECA05670}

Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{1631550F-191D-4826-B069-D9439253D926}

Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{1CB20BF0-BBAE-40A7-93F4-6435FF3D0411}

Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{28387537-E3F9-4ED7-860C-11E69AF4A8A0}

Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{474597C5-AB09-49D6-A4D5-2E8D7341384E}

Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{4B3803EA-5230-4DC3-A7FC-33638F3D3542}

Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{D3D233D5-9F6D-436C-B6C7-E63F77503B30}

Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{D7E97865-918F-41E4-9CD0-25AB1C574CE8}

Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{EF99BD32-C1FB-11D2-892F-0090271D4F88}

Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{02478D38-C3F9-4EFB-9B51-7695ECA05670}

Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{042DA63B-0933-403D-9395-B49307691690}

Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{1631550F-191D-4826-B069-D9439253D926}

Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{1CB20BF0-BBAE-40A7-93F4-6435FF3D0411}

Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{28387537-E3F9-4ED7-860C-11E69AF4A8A0}

Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{474597C5-AB09-49D6-A4D5-2E8D7341384E}

Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{4B3803EA-5230-4DC3-A7FC-33638F3D3542}

Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{8736C681-37A0-40C6-A0F0-4C083409151C}

Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{D3D233D5-9F6D-436C-B6C7-E63F77503B30}

Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{D7E97865-918F-41E4-9CD0-25AB1C574CE8}

Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{DF7770F7-832F-4BDF-B144-100EDDD0C3AE}

Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{EF99BD32-C1FB-11D2-892F-0090271D4F88}

Key Found : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{171DEBEB-C3D4-40B7-AC73-056A5EBA4A7E}

Key Found : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{1CB20BF0-BBAE-40A7-93F4-6435FF3D0411}

Key Found : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD21}

Key Found : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{C04B7D22-5AEC-4561-8F49-27F6269208F6}

Key Found : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{EEE6C360-6118-11DC-9C72-001320C79847}

Key Found : HKLM\SOFTWARE\Classes\AppID\{835315FC-1BF6-4CA9-80CD-F6C158D40692}

Key Found : HKLM\SOFTWARE\Classes\AppID\{CFDAFE39-20CE-451D-BD45-A37452F39CF0}

Key Found : HKLM\SOFTWARE\Classes\AppID\PriceGongIE.DLL

Key Found : HKLM\SOFTWARE\Classes\AppID\YontooIEClient.DLL

Key Found : HKLM\SOFTWARE\Classes\ctbcommon.Buttons

Key Found : HKLM\SOFTWARE\Classes\ctbr.R404Pro

Key Found : HKLM\SOFTWARE\Classes\CToolbar.TB4Client

Key Found : HKLM\SOFTWARE\Classes\CToolbar.TB4Script

Key Found : HKLM\SOFTWARE\Classes\CToolbar.TB4Server

Key Found : HKLM\SOFTWARE\Classes\PROTOCOLS\Handler\inbox

Key Found : HKLM\SOFTWARE\Classes\PROTOCOLS\Handler\tbr

Key Found : HKLM\SOFTWARE\Classes\TypeLib\{4D3B167E-5FD8-4276-8FD7-9DF19C1E4D19}

Key Found : HKLM\SOFTWARE\Classes\TypeLib\{506F578A-91E1-46CE-830F-E2F4268E9966}

Key Found : HKLM\SOFTWARE\Classes\TypeLib\{615E8AA1-6BB8-4A3D-A1CC-373194DB612C}

Key Found : HKLM\SOFTWARE\Classes\TypeLib\{CBEF8724-D080-4737-88DA-111EEC6651AA}

Key Found : HKLM\SOFTWARE\Classes\TypeLib\{E79BB61D-7F1A-41DF-8AD0-402795E3B566}

Key Found : HKLM\SOFTWARE\Classes\TypeLib\{EEE6C35E-6118-11DC-9C72-001320C79847}

Key Found : HKLM\SOFTWARE\Classes\TypeLib\{EEE6C35F-6118-11DC-9C72-001320C79847}

Key Found : HKLM\Software\CToolbar

Key Found : HKLM\Software\DataMngr

Key Found : HKLM\Software\Freeze.com

Key Found : HKLM\Software\GamesBarSetup

Key Found : HKLM\Software\Inbox Toolbar

Key Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions\{1A93C934-025B-4C3A-B38E-9654A7003239}

Key Found : HKLM\SOFTWARE\Microsoft\Tracing\ConduitInstaller_RASAPI32

Key Found : HKLM\SOFTWARE\Microsoft\Tracing\ConduitInstaller_RASMANCS

Key Found : HKLM\SOFTWARE\Microsoft\Tracing\CToolbar_RASMANCS

Key Found : HKLM\SOFTWARE\Microsoft\Tracing\SweetIM_RASAPI32

Key Found : HKLM\SOFTWARE\Microsoft\Tracing\SweetIM_RASMANCS

Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\SweetIM.exe

Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{02478D38-C3F9-4EFB-9B51-7695ECA05670}

Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{DF7770F7-832F-4BDF-B144-100EDDD0C3AE}

Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{EF99BD32-C1FB-11D2-892F-0090271D4F88}

Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\Crawler

Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{02478D38-C3F9-4EFB-9B51-7695ECA05670}

Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{042DA63B-0933-403D-9395-B49307691690}

Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{1631550F-191D-4826-B069-D9439253D926}

Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{183643C8-EE67-4574-9A38-927852E34163}

Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{1CB20BF0-BBAE-40A7-93F4-6435FF3D0411}

Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{1DDA201E-5B42-4352-933E-21A92B297E3B}

Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{28387537-E3F9-4ED7-860C-11E69AF4A8A0}

Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{37540F19-DD4C-478B-B2DF-C19281BCAF27}

Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{474597C5-AB09-49D6-A4D5-2E8D7341384E}

Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{4B3803EA-5230-4DC3-A7FC-33638F3D3542}

Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{4D25FB7A-8902-4291-960E-9ADA051CFBBF}

Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{54ECA872-DB2A-4C6B-BBB2-F3777C6786CC}

Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{612AD33D-9824-4E87-8396-92374E91C4BB}

Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{6F282B65-56BF-4BD1-A8B2-A4449A05863D}

Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{80922EE0-8A76-46AE-95D5-BD3C3FE0708D}

Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{8736C681-37A0-40C6-A0F0-4C083409151C}

Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{950F80EF-32C2-47DD-9C35-9576E21EE66E}

Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{D2A2595C-4FE4-4315-AA9B-19DBD6271B71}

Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{D3D233D5-9F6D-436C-B6C7-E63F77503B30}

Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{D7E97865-918F-41E4-9CD0-25AB1C574CE8}

Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{EF99BD32-C1FB-11D2-892F-0090271D4F88}

Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{FE9271F2-6EFD-44B0-A826-84C829536E93}

Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{01C78433-6FDF-4E5A-A82D-B535C32E03DF}

Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{28C3737A-32D1-492D-B76B-8D75EBBFB887}

Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{41349826-5C7F-4BF0-8279-5DAF1DE6E9AE}

Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{604EA016-1EDE-41E6-A23E-76CF8F2A4808}

Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{A439801C-961D-452C-AB42-7848E9CBD289}

Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{B3BA5582-79A9-464D-A7FA-711C5888C6E9}

Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{CE057E0D-2D7E-4DFF-A890-07BA69B8C762}

Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{E9BBD270-4B87-4EE2-912F-6635674986C0}

Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{EEE6C358-6118-11DC-9C72-001320C79847}

Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{EEE6C359-6118-11DC-9C72-001320C79847}

Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{EEE6C35A-6118-11DC-9C72-001320C79847}

Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{F4EBB1E2-21F3-4786-8CF4-16EC5925867F}

Key Found : HKLM\SOFTWARE\Wow6432Node\Google\Chrome\Extensions\afbcibndhffhhbokgpbpecjmejjcgcej

Key Found : HKLM\SOFTWARE\Wow6432Node\Google\Chrome\Extensions\niapdbllcanepiiimjjndipklodoedlc

Key Found : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{28387537-E3F9-4ED7-860C-11E69AF4A8A0}

Key Found : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{612AD33D-9824-4E87-8396-92374E91C4BB}

Key Found : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{7459F1D0-9FB6-4D71-AA7B-9DECB34EB704}

Key Found : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{EEE6C367-6118-11DC-9C72-001320C79847}

Key Found : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{FBF1B8D2-9A06-4174-A8B5-E38606DDB92B}

Key Found : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD21}

Key Found : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\{EEE6C360-6118-11DC-9C72-001320C79847}

Key Found : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{02478D38-C3F9-4EFB-9B51-7695ECA05670}

Key Found : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1631550F-191D-4826-B069-D9439253D926}

Key Found : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1CB20BF0-BBAE-40A7-93F4-6435FF3D0411}

Key Found : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{28387537-E3F9-4ED7-860C-11E69AF4A8A0}

Key Found : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{474597C5-AB09-49D6-A4D5-2E8D7341384E}

Key Found : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D3D233D5-9F6D-436C-B6C7-E63F77503B30}

Key Found : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{612AD33D-9824-4E87-8396-92374E91C4BB}_is1

Key Found : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{BF67F764-95B6-4360-BB57-B2E5AA6C814B}

Key Found : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\CToolbar_UNINSTALL

Key Found : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\iMesh 1 MediaBar

Key Found : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\PriceGong

Key Found : HKLM\SOFTWARE\Classes\CLSID\{474597C5-AB09-49D6-A4D5-2E8D7341384E}

Key Found : HKLM\SOFTWARE\Classes\CLSID\{950F80EF-32C2-47DD-9C35-9576E21EE66E}

Key Found : HKLM\SOFTWARE\Classes\Interface\{01C78433-6FDF-4E5A-A82D-B535C32E03DF}

Key Found : HKLM\SOFTWARE\Classes\Interface\{28C3737A-32D1-492D-B76B-8D75EBBFB887}

Key Found : HKLM\SOFTWARE\Classes\Interface\{41349826-5C7F-4BF0-8279-5DAF1DE6E9AE}

Key Found : HKLM\SOFTWARE\Classes\Interface\{604EA016-1EDE-41E6-A23E-76CF8F2A4808}

Key Found : HKLM\SOFTWARE\Classes\Interface\{B3BA5582-79A9-464D-A7FA-711C5888C6E9}

Key Found : HKLM\SOFTWARE\Classes\Interface\{CE057E0D-2D7E-4DFF-A890-07BA69B8C762}

Key Found : HKLM\SOFTWARE\Classes\Interface\{E9BBD270-4B87-4EE2-912F-6635674986C0}

Key Found : HKLM\SOFTWARE\Classes\Interface\{EEE6C358-6118-11DC-9C72-001320C79847}

Key Found : HKLM\SOFTWARE\Classes\Interface\{EEE6C359-6118-11DC-9C72-001320C79847}

Key Found : HKLM\SOFTWARE\Classes\Interface\{EEE6C35A-6118-11DC-9C72-001320C79847}

Key Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD21}

Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{474597C5-AB09-49D6-A4D5-2E8D7341384E}

Key Found : HKU\S-1-5-21-2754924291-2942948176-839923927-1000\Software\Microsoft\Internet Explorer\SearchScopes\{171DEBEB-C3D4-40B7-AC73-056A5EBA4A7E}

Key Found : HKU\S-1-5-21-2754924291-2942948176-839923927-1000\Software\Microsoft\Internet Explorer\SearchScopes\{1CB20BF0-BBAE-40A7-93F4-6435FF3D0411}

Key Found : HKU\S-1-5-21-2754924291-2942948176-839923927-1000\Software\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD21}

Key Found : HKU\S-1-5-21-2754924291-2942948176-839923927-1000\Software\Microsoft\Internet Explorer\SearchScopes\{C04B7D22-5AEC-4561-8F49-27F6269208F6}

Key Found : HKU\S-1-5-21-2754924291-2942948176-839923927-1000\Software\Microsoft\Internet Explorer\SearchScopes\{EEE6C360-6118-11DC-9C72-001320C79847}

Value Found : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{4B3803EA-5230-4DC3-A7FC-33638F3D3542}]

Value Found : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{D7E97865-918F-41E4-9CD0-25AB1C574CE8}]

Value Found : HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks [{1CB20BF0-BBAE-40A7-93F4-6435FF3D0411}]

Value Found : HKCU\Software\Mozilla\Firefox\Extensions [{8a9386b4-e958-4c4c-adf4-8f26db3e4829}]

Value Found : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar [{28387537-E3F9-4ED7-860C-11E69AF4A8A0}]

Value Found : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar [{4B3803EA-5230-4DC3-A7FC-33638F3D3542}]

Value Found : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar [{D7E97865-918F-41E4-9CD0-25AB1C574CE8}]

Value Found : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar [{EF99BD32-C1FB-11D2-892F-0090271D4F88}]

Value Found : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar [10]

***** [internet Browsers] *****

-\\ Internet Explorer v9.0.8112.16476

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Main - Start Page] = hxxp://home.sweetim.com/?crg=3.1010000&st=18&barid={4FA76F59-FCF2-435E-B10B-ACCB56199629}

-\\ Mozilla Firefox v20.0.1 (en-US)

File : C:\Users\dorothy\AppData\Roaming\Mozilla\Firefox\Profiles\l2np5euz.default\prefs.js

Found : user_pref("browser.search.defaultenginename", "SweetIM Search");

Found : user_pref("browser.search.order.1", "Web Search");

Found : user_pref("browser.search.selectedEngine", "SweetIM Search");

Found : user_pref("browser.startup.homepage", "hxxp://home.sweetim.com/?crg=3.1010000&st=18&barid={4FA76F59-[...]

Found : user_pref("keyword.URL", "hxxp://search.sweetim.com/search.asp?src=2&barid={4FA76F59-FCF2-435E-B10B-[...]

Found : user_pref("sweetim.toolbar.previous.browser.search.defaultenginename", "Yahoo");

Found : user_pref("sweetim.toolbar.previous.browser.search.defaulturl", "hxxp://search.yahoo.com/search?fr=m[...]

Found : user_pref("sweetim.toolbar.previous.browser.search.selectedEngine", "Yahoo");

Found : user_pref("sweetim.toolbar.previous.browser.startup.homepage", "hxxp://www.yahoo.com/?ilc=8");

Found : user_pref("sweetim.toolbar.previous.keyword.URL", "hxxp://search.yahoo.com/search?fr=mkg030&p=");

Found : user_pref("sweetim.toolbar.urls.homepage", "hxxp://home.sweetim.com/?crg=3.1010000&st=18&barid={4FA7[...]

File : C:\Users\Jake\AppData\Roaming\Mozilla\Firefox\Profiles\pugqa6br.default\prefs.js

[OK] File is clean.

-\\ Google Chrome v26.0.1410.64

File : C:\Users\dorothy\AppData\Local\Google\Chrome\User Data\Default\Preferences

Found [l.1745] : homepage = "hxxp://home.sweetim.com/?crg=3.1010000&st=18&barid={4FA76F59-FCF2-435E-B10B-ACCB56199629}",

Found [l.2120] : urls_to_restore_on_startup = [ "hxxp://home.sweetim.com/?crg=3.1010000&st=18&barid={4FA76F59-FCF2-435E-B10B-ACCB56199629}", "hxxp://search.imesh.com/" ]

File : C:\Users\Jake\AppData\Local\Google\Chrome\User Data\Default\Preferences

[OK] File is clean.

*************************

AdwCleaner[R1].txt - [19493 octets] - [26/04/2013 17:34:07]

########## EOF - C:\AdwCleaner[R1].txt - [19554 octets] ##########

MrCharlie · April 26, 2013

OK...delete these two folders if you can: (they're malware related)

C:ProgramData\kna

C:ProgramData\Application Data\kna

C:\Users\dorothy\Desktop\kdgc.tmp moved successfully.

OK....We deleted this file with FRST, not sure why it showed up in the log.

If it's not there...good!

--------------------------------------------

Lots of adware found....lets clear it out.....

Please re-run AdwCleaner
Click on Delete button.
Confirm each time with OK if asked.
Your computer will be rebooted automatically. A text file will open after the restart. Please post the content of that logfile in your reply.

Note: You can find the logfile at C:\AdwCleaner[sn].txt as well - n is the order number.

Then......

Lets check your computers security before you go and we have a little cleanup to do also:

Download Security Check by screen317 from HERE or HERE.

Save it to your Desktop.
Double click SecurityCheck.exe and follow the onscreen instructions inside of the black box.
A Notepad document should open automatically called checkup.txt.
Please Post the contents of that document.
Do Not Attach It!!!

MrC

Jetter · April 26, 2013

AdwCleaner:

# AdwCleaner v2.202 - Logfile created 04/26/2013 at 18:49:13

# Updated 23/04/2013 by Xplode

# Operating system : Windows 7 Home Premium Service Pack 1 (64 bits)

# User : dorothy - DOROTHY-PC

# Boot Mode : Normal

# Running from : C:\Users\dorothy\Desktop\adwcleaner.exe

# Option [Delete]

***** [services] *****

***** [Files / Folders] *****

File Deleted : C:\END

File Deleted : C:\Program Files (x86)\Mozilla Firefox\searchplugins\SearchResults.xml

File Deleted : C:\Users\dorothy\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_home.sweetim.com_0.localstorage

File Deleted : C:\Users\dorothy\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_home.sweetim.com_0.localstorage-journal

File Deleted : C:\Users\dorothy\AppData\Roaming\Mozilla\Firefox\Profiles\l2np5euz.default\searchplugins\SearchResults.xml

Folder Deleted : C:\Program Files (x86)\Crawler

Folder Deleted : C:\Program Files (x86)\GamesBar

Folder Deleted : C:\Program Files (x86)\iMesh Applications\Mediabar

Folder Deleted : C:\Program Files (x86)\Inbox Toolbar

Folder Deleted : C:\Program Files (x86)\PriceGong

Folder Deleted : C:\Program Files (x86)\SweetIM

Folder Deleted : C:\ProgramData\Ask

Folder Deleted : C:\ProgramData\boost_interprocess

Folder Deleted : C:\ProgramData\GamesBar

Folder Deleted : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Crawler Toolbar

Folder Deleted : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\GamesBar

Folder Deleted : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Inbox Toolbar

Folder Deleted : C:\ProgramData\Tarma Installer

Folder Deleted : C:\Users\dorothy\AppData\Local\Google\Chrome\User Data\Default\Extensions\afbcibndhffhhbokgpbpecjmejjcgcej

Folder Deleted : C:\Users\dorothy\AppData\Local\PackageAware

Folder Deleted : C:\Users\dorothy\AppData\LocalLow\Conduit

Folder Deleted : C:\Users\dorothy\AppData\LocalLow\imeshbandmltbpi

Folder Deleted : C:\Users\dorothy\AppData\LocalLow\Inbox Toolbar

Folder Deleted : C:\Users\dorothy\AppData\LocalLow\mediabarim

Folder Deleted : C:\Users\dorothy\AppData\LocalLow\PriceGong

Folder Deleted : C:\Users\dorothy\AppData\LocalLow\SweetIM

Folder Deleted : C:\Users\dorothy\AppData\Roaming\Mozilla\Firefox\Profiles\l2np5euz.default\extensions\{28387537-e3f9-4ed7-860c-11e69af4a8a0}

Folder Deleted : C:\Users\dorothy\AppData\Roaming\Mozilla\Firefox\Profiles\l2np5euz.default\mediabarim

Folder Deleted : C:\Users\dorothy\AppData\Roaming\RebateInformer

Folder Deleted : C:\Users\Jake\AppData\LocalLow\imeshbandmltbpi

Folder Deleted : C:\Users\Jake\AppData\LocalLow\Inbox Toolbar

Folder Deleted : C:\Users\Jake\AppData\LocalLow\mediabarim

Folder Deleted : C:\Users\Jake\AppData\LocalLow\PriceGong

Folder Deleted : C:\Users\Jake\AppData\LocalLow\SweetIM

***** [Registry] *****

Data Deleted : [x64] HKLM\..\Windows [AppInit_DLLs] = C:\PROGRA~2\IMESHA~1\MediaBar\Datamngr\x64\datamngr.dll

Data Deleted : [x64] HKLM\..\Windows [AppInit_DLLs] = C:\PROGRA~2\IMESHA~1\MediaBar\Datamngr\x64\IEBHO.dll

Key Deleted : HKCU\Software\AppDataLow\Software\Conduit

Key Deleted : HKCU\Software\AppDataLow\Software\PriceGong

Key Deleted : HKCU\Software\AppDataLow\Software\SmartBar

Key Deleted : HKCU\Software\Conduit

Key Deleted : HKCU\Software\CToolbar

Key Deleted : HKCU\Software\Google\Chrome\Extensions\afbcibndhffhhbokgpbpecjmejjcgcej

Key Deleted : HKCU\Software\Inbox Toolbar

Key Deleted : HKCU\Software\Microsoft\Internet Explorer\MenuExt\Crawler Search

Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{02478D38-C3F9-4EFB-9B51-7695ECA05670}

Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{1631550F-191D-4826-B069-D9439253D926}

Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{1CB20BF0-BBAE-40A7-93F4-6435FF3D0411}

Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{28387537-E3F9-4ED7-860C-11E69AF4A8A0}

Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{474597C5-AB09-49D6-A4D5-2E8D7341384E}

Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{4B3803EA-5230-4DC3-A7FC-33638F3D3542}

Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{D3D233D5-9F6D-436C-B6C7-E63F77503B30}

Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{D7E97865-918F-41E4-9CD0-25AB1C574CE8}

Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{EF99BD32-C1FB-11D2-892F-0090271D4F88}

Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{02478D38-C3F9-4EFB-9B51-7695ECA05670}

Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{042DA63B-0933-403D-9395-B49307691690}

Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{1631550F-191D-4826-B069-D9439253D926}

Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{1CB20BF0-BBAE-40A7-93F4-6435FF3D0411}

Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{28387537-E3F9-4ED7-860C-11E69AF4A8A0}

Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{474597C5-AB09-49D6-A4D5-2E8D7341384E}

Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{4B3803EA-5230-4DC3-A7FC-33638F3D3542}

Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{8736C681-37A0-40C6-A0F0-4C083409151C}

Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{D3D233D5-9F6D-436C-B6C7-E63F77503B30}

Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{D7E97865-918F-41E4-9CD0-25AB1C574CE8}

Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{DF7770F7-832F-4BDF-B144-100EDDD0C3AE}

Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{EF99BD32-C1FB-11D2-892F-0090271D4F88}

Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{171DEBEB-C3D4-40B7-AC73-056A5EBA4A7E}

Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{1CB20BF0-BBAE-40A7-93F4-6435FF3D0411}

Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD21}

Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{C04B7D22-5AEC-4561-8F49-27F6269208F6}

Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{EEE6C360-6118-11DC-9C72-001320C79847}

Key Deleted : HKLM\SOFTWARE\Classes\AppID\{835315FC-1BF6-4CA9-80CD-F6C158D40692}

Key Deleted : HKLM\SOFTWARE\Classes\AppID\{CFDAFE39-20CE-451D-BD45-A37452F39CF0}

Key Deleted : HKLM\SOFTWARE\Classes\AppID\PriceGongIE.DLL

Key Deleted : HKLM\SOFTWARE\Classes\AppID\YontooIEClient.DLL

Key Deleted : HKLM\SOFTWARE\Classes\ctbcommon.Buttons

Key Deleted : HKLM\SOFTWARE\Classes\ctbr.R404Pro

Key Deleted : HKLM\SOFTWARE\Classes\CToolbar.TB4Client

Key Deleted : HKLM\SOFTWARE\Classes\CToolbar.TB4Script

Key Deleted : HKLM\SOFTWARE\Classes\CToolbar.TB4Server

Key Deleted : HKLM\SOFTWARE\Classes\PROTOCOLS\Handler\inbox

Key Deleted : HKLM\SOFTWARE\Classes\PROTOCOLS\Handler\tbr

Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{4D3B167E-5FD8-4276-8FD7-9DF19C1E4D19}

Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{506F578A-91E1-46CE-830F-E2F4268E9966}

Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{615E8AA1-6BB8-4A3D-A1CC-373194DB612C}

Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{CBEF8724-D080-4737-88DA-111EEC6651AA}

Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{E79BB61D-7F1A-41DF-8AD0-402795E3B566}

Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{EEE6C35E-6118-11DC-9C72-001320C79847}

Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{EEE6C35F-6118-11DC-9C72-001320C79847}

Key Deleted : HKLM\Software\CToolbar

Key Deleted : HKLM\Software\DataMngr

Key Deleted : HKLM\Software\Freeze.com

Key Deleted : HKLM\Software\GamesBarSetup

Key Deleted : HKLM\Software\Inbox Toolbar

Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions\{1A93C934-025B-4C3A-B38E-9654A7003239}

Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\ConduitInstaller_RASAPI32

Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\ConduitInstaller_RASMANCS

Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\CToolbar_RASMANCS

Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\SweetIM_RASAPI32

Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\SweetIM_RASMANCS

Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\SweetIM.exe

Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{02478D38-C3F9-4EFB-9B51-7695ECA05670}

Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{DF7770F7-832F-4BDF-B144-100EDDD0C3AE}

Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{EF99BD32-C1FB-11D2-892F-0090271D4F88}

Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\Crawler

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{02478D38-C3F9-4EFB-9B51-7695ECA05670}

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{042DA63B-0933-403D-9395-B49307691690}

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{1631550F-191D-4826-B069-D9439253D926}

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{183643C8-EE67-4574-9A38-927852E34163}

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{1CB20BF0-BBAE-40A7-93F4-6435FF3D0411}

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{1DDA201E-5B42-4352-933E-21A92B297E3B}

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{28387537-E3F9-4ED7-860C-11E69AF4A8A0}

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{37540F19-DD4C-478B-B2DF-C19281BCAF27}

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{474597C5-AB09-49D6-A4D5-2E8D7341384E}

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{4B3803EA-5230-4DC3-A7FC-33638F3D3542}

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{4D25FB7A-8902-4291-960E-9ADA051CFBBF}

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{54ECA872-DB2A-4C6B-BBB2-F3777C6786CC}

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{612AD33D-9824-4E87-8396-92374E91C4BB}

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{6F282B65-56BF-4BD1-A8B2-A4449A05863D}

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{80922EE0-8A76-46AE-95D5-BD3C3FE0708D}

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{8736C681-37A0-40C6-A0F0-4C083409151C}

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{950F80EF-32C2-47DD-9C35-9576E21EE66E}

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{D2A2595C-4FE4-4315-AA9B-19DBD6271B71}

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{D3D233D5-9F6D-436C-B6C7-E63F77503B30}

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{D7E97865-918F-41E4-9CD0-25AB1C574CE8}

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{EF99BD32-C1FB-11D2-892F-0090271D4F88}

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{FE9271F2-6EFD-44B0-A826-84C829536E93}

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{01C78433-6FDF-4E5A-A82D-B535C32E03DF}

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{28C3737A-32D1-492D-B76B-8D75EBBFB887}

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{41349826-5C7F-4BF0-8279-5DAF1DE6E9AE}

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{604EA016-1EDE-41E6-A23E-76CF8F2A4808}

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{A439801C-961D-452C-AB42-7848E9CBD289}

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{B3BA5582-79A9-464D-A7FA-711C5888C6E9}

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{CE057E0D-2D7E-4DFF-A890-07BA69B8C762}

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{E9BBD270-4B87-4EE2-912F-6635674986C0}

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{EEE6C358-6118-11DC-9C72-001320C79847}

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{EEE6C359-6118-11DC-9C72-001320C79847}

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{EEE6C35A-6118-11DC-9C72-001320C79847}

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{F4EBB1E2-21F3-4786-8CF4-16EC5925867F}

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Google\Chrome\Extensions\afbcibndhffhhbokgpbpecjmejjcgcej

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Google\Chrome\Extensions\niapdbllcanepiiimjjndipklodoedlc

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{28387537-E3F9-4ED7-860C-11E69AF4A8A0}

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{612AD33D-9824-4E87-8396-92374E91C4BB}

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{7459F1D0-9FB6-4D71-AA7B-9DECB34EB704}

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{EEE6C367-6118-11DC-9C72-001320C79847}

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{FBF1B8D2-9A06-4174-A8B5-E38606DDB92B}

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD21}

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\{EEE6C360-6118-11DC-9C72-001320C79847}

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{02478D38-C3F9-4EFB-9B51-7695ECA05670}

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1631550F-191D-4826-B069-D9439253D926}

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1CB20BF0-BBAE-40A7-93F4-6435FF3D0411}

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{28387537-E3F9-4ED7-860C-11E69AF4A8A0}

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{474597C5-AB09-49D6-A4D5-2E8D7341384E}

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D3D233D5-9F6D-436C-B6C7-E63F77503B30}

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{612AD33D-9824-4E87-8396-92374E91C4BB}_is1

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{BF67F764-95B6-4360-BB57-B2E5AA6C814B}

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\CToolbar_UNINSTALL

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\iMesh 1 MediaBar

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\PriceGong

Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{474597C5-AB09-49D6-A4D5-2E8D7341384E}

Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{950F80EF-32C2-47DD-9C35-9576E21EE66E}

Key Deleted : HKLM\SOFTWARE\Classes\Interface\{01C78433-6FDF-4E5A-A82D-B535C32E03DF}

Key Deleted : HKLM\SOFTWARE\Classes\Interface\{28C3737A-32D1-492D-B76B-8D75EBBFB887}

Key Deleted : HKLM\SOFTWARE\Classes\Interface\{41349826-5C7F-4BF0-8279-5DAF1DE6E9AE}

Key Deleted : HKLM\SOFTWARE\Classes\Interface\{604EA016-1EDE-41E6-A23E-76CF8F2A4808}

Key Deleted : HKLM\SOFTWARE\Classes\Interface\{B3BA5582-79A9-464D-A7FA-711C5888C6E9}

Key Deleted : HKLM\SOFTWARE\Classes\Interface\{CE057E0D-2D7E-4DFF-A890-07BA69B8C762}

Key Deleted : HKLM\SOFTWARE\Classes\Interface\{E9BBD270-4B87-4EE2-912F-6635674986C0}

Key Deleted : HKLM\SOFTWARE\Classes\Interface\{EEE6C358-6118-11DC-9C72-001320C79847}

Key Deleted : HKLM\SOFTWARE\Classes\Interface\{EEE6C359-6118-11DC-9C72-001320C79847}

Key Deleted : HKLM\SOFTWARE\Classes\Interface\{EEE6C35A-6118-11DC-9C72-001320C79847}

Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD21}

Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{474597C5-AB09-49D6-A4D5-2E8D7341384E}

Value Deleted : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{4B3803EA-5230-4DC3-A7FC-33638F3D3542}]

Value Deleted : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{D7E97865-918F-41E4-9CD0-25AB1C574CE8}]

Value Deleted : HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks [{1CB20BF0-BBAE-40A7-93F4-6435FF3D0411}]

Value Deleted : HKCU\Software\Mozilla\Firefox\Extensions [{8a9386b4-e958-4c4c-adf4-8f26db3e4829}]

Value Deleted : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar [{28387537-E3F9-4ED7-860C-11E69AF4A8A0}]

Value Deleted : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar [{4B3803EA-5230-4DC3-A7FC-33638F3D3542}]

Value Deleted : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar [{D7E97865-918F-41E4-9CD0-25AB1C574CE8}]

Value Deleted : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar [{EF99BD32-C1FB-11D2-892F-0090271D4F88}]

Value Deleted : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar [10]

***** [internet Browsers] *****

-\\ Internet Explorer v9.0.8112.16476

Replaced : [HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Main - Start Page] = hxxp://home.sweetim.com/?crg=3.1010000&st=18&barid={4FA76F59-FCF2-435E-B10B-ACCB56199629} --> hxxp://www.google.com

-\\ Mozilla Firefox v20.0.1 (en-US)

File : C:\Users\dorothy\AppData\Roaming\Mozilla\Firefox\Profiles\l2np5euz.default\prefs.js

C:\Users\dorothy\AppData\Roaming\Mozilla\Firefox\Profiles\l2np5euz.default\user.js ... Deleted !

Deleted : user_pref("browser.search.defaultenginename", "SweetIM Search");

Deleted : user_pref("browser.search.order.1", "Web Search");

Deleted : user_pref("browser.search.selectedEngine", "SweetIM Search");

Deleted : user_pref("browser.startup.homepage", "hxxp://home.sweetim.com/?crg=3.1010000&st=18&barid={4FA76F59-[...]

Deleted : user_pref("keyword.URL", "hxxp://search.sweetim.com/search.asp?src=2&barid={4FA76F59-FCF2-435E-B10B-[...]

Deleted : user_pref("sweetim.toolbar.previous.browser.search.defaultenginename", "Yahoo");

Deleted : user_pref("sweetim.toolbar.previous.browser.search.defaulturl", "hxxp://search.yahoo.com/search?fr=m[...]

Deleted : user_pref("sweetim.toolbar.previous.browser.search.selectedEngine", "Yahoo");

Deleted : user_pref("sweetim.toolbar.previous.browser.startup.homepage", "hxxp://www.yahoo.com/?ilc=8");

Deleted : user_pref("sweetim.toolbar.previous.keyword.URL", "hxxp://search.yahoo.com/search?fr=mkg030&p=");

Deleted : user_pref("sweetim.toolbar.urls.homepage", "hxxp://home.sweetim.com/?crg=3.1010000&st=18&barid={4FA7[...]

File : C:\Users\Jake\AppData\Roaming\Mozilla\Firefox\Profiles\pugqa6br.default\prefs.js

[OK] File is clean.

-\\ Google Chrome v26.0.1410.64

File : C:\Users\dorothy\AppData\Local\Google\Chrome\User Data\Default\Preferences

Deleted [l.1745] : homepage = "hxxp://home.sweetim.com/?crg=3.1010000&st=18&barid={4FA76F59-FCF2-435E-B10B-ACCB5619[...]

Deleted [l.2120] : urls_to_restore_on_startup = [ "hxxp://home.sweetim.com/?crg=3.1010000&st=18&barid={4FA76F59-[...]

File : C:\Users\Jake\AppData\Local\Google\Chrome\User Data\Default\Preferences

[OK] File is clean.

*************************

AdwCleaner[R1].txt - [19586 octets] - [26/04/2013 17:34:07]

AdwCleaner[R2].txt - [19647 octets] - [26/04/2013 18:48:51]

AdwCleaner[s1].txt - [19263 octets] - [26/04/2013 18:49:13]

########## EOF - C:\AdwCleaner[s1].txt - [19324 octets] ##########

Security Check:

Results of screen317's Security Check version 0.99.63

Windows 7 Service Pack 1 x64 (UAC is disabled!)

Internet Explorer 9

``````````````Antivirus/Firewall Check:``````````````

Windows Security Center service is not running! This report may not be accurate!

Windows Firewall Enabled!

Trend Micro Titanium Maximum Security

Antivirus out of date! (On Access scanning disabled!)

`````````Anti-malware/Other Utilities Check:`````````

Java 7 Update 21

Adobe Flash Player 11.7.700.169

Adobe Reader 9 Adobe Reader out of Date!

Mozilla Firefox (20.0.1)

Google Chrome 26.0.1410.43

Google Chrome 26.0.1410.64

````````Process Check: objlist.exe by Laurent````````

Trend Micro AMSP coreServiceShell.exe

Trend Micro UniClient UiFrmWrk uiWatchDog.exe

Trend Micro AMSP coreFrameworkHost.exe

Trend Micro UniClient UiFrmWrk uiSeAgnt.exe

`````````````````System Health check`````````````````

Total Fragmentation on Drive C: 1%

````````````````````End of Log``````````````````````

MrCharlie · April 26, 2013

Out dated programs on the system are vulnerable to malware.

Please update or uninstall them:

Trend Micro Titanium Maximum Security

Antivirus out of date! (On Access scanning disabled!) <-------update and enable this

Adobe Reader 9 Adobe Reader out of Date! <---please check for an update if available or uninstall and download and install Foxit Reader which is less vulnerable to malware and much better than Adobe. Don't install any toolbars that may come with it (ASK Toolbar).

Google Chrome 26.0.1410.43 <---OLD

Google Chrome 26.0.1410.64 <---OK

You have old versions of Google Chrome on the system.

Please download and run OldChromeRemover.

@Windows Vista/Windows 7-8 users must use “Run As Administrator.”

-------------------------------------------

A little clean up to do....

Please Uninstall ComboFix: (if you used it)

Press the Windows logo key + R to bring up the "run box"

Copy and paste next command in the field:

ComboFix /uninstall

Make sure there's a space between Combofix and /

Then hit enter.

This will uninstall Combofix, delete its related folders and files, hide file extensions, hide the system/hidden files and clears System Restore cache and create new Restore point

(If that doesn't work.....you can simply rename ComboFix.exe to Uninstall.exe and double click it to complete the uninstall)

---------------------------------

If you used DeFogger to disable your CD Emulation drivers, please re-enable them.

-------------------------------

Please download OTL from one of the links below: (you may already have OTL on the system)

http://oldtimer.geekstogo.com/OTL.exe

http://oldtimer.geekstogo.com/OTL.com

http://www.itxassoci...T-Tools/OTL.exe

Save it to your desktop.

Run OTL and hit the CleanUp button. (This will cleanup the tools and logs used including itself)

Any other programs or logs you can manually delete.

IE: RogueKiller.exe, RKreport.txt, RK_Quarantine folder, C:\FRST, MBAR, etc....AdwCleaner > just run the program and click uninstall.

-------------------------------

Any questions...please post back.

If you think I've helped you, please leave a comment > click on my avatar picture > click Profile Feed.

Take a look at My Preventive Maintenance to avoid being infected again.

Good Luck and Thanks for using the forum, MrC

Jetter · April 27, 2013

OK. All cleaned up. PC is running nicely.

Have AV, Firewall, etc running now as well.

Will advice users of precautions as you suggest.

Thank you so much for the help, MrC.

MrCharlie · April 27, 2013

OK...Take Care MrC

Maurice Naggar · April 27, 2013

Glad we could help.

If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread.

Other members who need assistance please start your own topic in a new thread. Thanks!

MoneyPak ransomware -- need help with removal -- thank you

Recommended Posts

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Recently Browsing 0 members

Important Information