Need help with mix.dj browser hijack

ghostofunder · May 25, 2013

My IE browser has been hijacked and my Chrome browser opens with a second tab for mix.dj searching. I've run Malwarebytes Anti-Virus and nothing is picked up. Any assistance would be greatly appreciated.

I ran DDS and these are the logs:

DDS (Ver_2012-11-20.01) - NTFS_AMD64

Internet Explorer: 10.0.9200.16576

Run by Donna at 16:45:01 on 2013-05-25

Microsoft Windows 7 Professional 6.1.7601.1.1252.1.1033.18.3969.1438 [GMT -5:00]

.

AV: AVG AntiVirus Free Edition 2013 *Enabled/Updated* {0E9420C4-06B3-7FA0-3AB1-6E49CB52ECD9}

SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

SP: AVG AntiVirus Free Edition 2013 *Enabled/Updated* {B5F5C120-2089-702E-0001-553BB0D5A664}

FW: ZoneAlarm Free Firewall Firewall *Enabled* {E6380B7E-D4B2-19F1-083E-56486607704B}

.

============== Running Processes ===============

.

C:\Windows\system32\lsm.exe

C:\Windows\system32\svchost.exe -k DcomLaunch

C:\Windows\system32\svchost.exe -k RPCSS

C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted

C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted

C:\Windows\system32\svchost.exe -k LocalService

C:\Windows\system32\svchost.exe -k netsvcs

C:\Program Files\IDT\WDM\STacSV64.exe

C:\Windows\system32\svchost.exe -k NetworkService

C:\Program Files (x86)\CheckPoint\ZoneAlarm\vsmon.exe

C:\Windows\system32\WLANExt.exe

C:\Program Files\Common Files\SPBA\upeksvr.exe

C:\Program Files\Dell\DW WLAN Card\WLTRYSVC.EXE

C:\Program Files\Dell\DW WLAN Card\bcmwltry.exe

C:\Program Files\CheckPoint\ZAForceField\IswSvc.exe

C:\Windows\System32\spoolsv.exe

C:\Program Files\Dell\Dell Data Protection\Access\Advanced\Wave\Trusted Drive Manager\TdmService.exe

C:\Windows\System32\svchost.exe -k LocalServiceAndNoImpersonation

C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork

C:\Windows\system32\taskhost.exe

C:\Program Files\CheckPoint\ZAForceField\ForceField.exe

C:\Windows\system32\Dwm.exe

C:\Program Files (x86)\AVG\AVG2013\avgwdsvc.exe

C:\Program Files\Broadcom\MgmtAgent\BrcmMgmtAgent.exe

C:\Program Files\Dell\Dell Data Protection\Access\Advanced\Wave\EMBASSY Client Core\EmbassyServer.exe

C:\Program Files\Intel\iCLS Client\HeciServer.exe

C:\Program Files (x86)\Intel\Intel® Management Engine Components\DAL\jhi_service.exe

C:\Windows\system32\o2flash.exe

C:\Program Files\Dell\Dell Data Protection\Access\Advanced\hapi64\pbadrvsvc.exe

C:\Program Files\Dell\Dell Data Protection\Access\Advanced\Wave\Authentication Manager\WaveAMService.exe

C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE

C:\Program Files\Dell\Feature Enhancement Pack\DFEPService.exe

C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe

C:\Windows\system32\wbem\wmiprvse.exe

C:\Program Files\DellTPad\Apoint.exe

C:\Program Files\IDT\WDM\sttray64.exe

C:\Program Files\Dell\DW WLAN Card\WLTRAY.EXE

C:\Program Files\Dell\Dell Data Protection\Access\Advanced\Wave\Trusted Drive Manager\TdmNotify.exe

C:\Program Files\Dell\Feature Enhancement Pack\DFEPApplication.exe

C:\Windows\System32\igfxtray.exe

C:\Windows\System32\hkcmd.exe

C:\Windows\System32\igfxpers.exe

C:\Program Files (x86)\Intel\Intel® USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe

C:\Program Files (x86)\AVG\AVG2013\avgui.exe

C:\Program Files\Dell\Feature Enhancement Pack\SmartSettings.exe

C:\Windows\system32\SearchIndexer.exe

C:\Program Files (x86)\Intel\Intel® Integrated Clock Controller Service\ICCProxy.exe

C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted

C:\Program Files (x86)\CheckPoint\ZoneAlarm\zatray.exe

C:\Program Files\DellTPad\ApMsgFwd.exe

C:\Program Files\DellTPad\HidFind.exe

C:\Program Files\DellTPad\Apntex.exe

C:\Windows\system32\wbem\unsecapp.exe

C:\Windows\System32\svchost.exe -k LocalServicePeerNet

C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe

C:\Program Files (x86)\Dell Digital Delivery\DeliveryService.exe

C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe

C:\Program Files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe

C:\Program Files (x86)\Intel\Intel® Management Engine Components\IMSS\PrivacyIconClient.exe

C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe

C:\Program Files (x86)\AVG\AVG2013\avgcfgex.exe

C:\Windows\explorer.exe

C:\Program Files (x86)\AVG\AVG2013\avgidsagent.exe

C:\Program Files (x86)\AVG\AVG2013\avgemca.exe

C:\Program Files (x86)\AVG\AVG2013\avgnsa.exe

C:\Program Files (x86)\AVG\AVG2013\avgrsa.exe

C:\Program Files (x86)\AVG\AVG2013\avgcsrva.exe

C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

C:\Program Files (x86)\Mozilla Thunderbird\thunderbird.exe

C:\Program Files (x86)\KeePass Password Safe 2\KeePass.exe

C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

C:\Windows\system32\taskhost.exe

C:\Program Files\Windows Media Player\wmpnetwk.exe

C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

C:\Windows\system32\taskeng.exe

C:\Windows\system32\SearchProtocolHost.exe

C:\Windows\system32\SearchFilterHost.exe

C:\Windows\system32\wbem\wmiprvse.exe

C:\Windows\System32\cscript.exe

.

============== Pseudo HJT Report ===============

.

uStart Page = hxxp://search.conduit.com?SearchSource=10&CUI=&UM=2&ctid=CT3287822

uDefault_Page_URL = hxxp://dell13-comm.msn.com

mWinlogon: Userinit = userinit.exe

BHO: Zonealarm Helper Object: {2A841F7A-A014-4DA5-B6D9-8B913DFB7A8C} - C:\Program Files (x86)\Check Point Software Technologies LTD\zonealarm\1.8.11.11\bh\zonealarm.dll

BHO: ZoneAlarm Security Engine Registrar: {8A4A36C2-0535-4D2C-BD3D-496CB7EED6E3} - C:\Program Files\CheckPoint\ZAForceField\WOW64\TrustChecker\bin\TrustCheckerIEPlugin.dll

BHO: Windows Live ID Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

TB: ZoneAlarm Security Engine: {EE2AC4E5-B0B0-4EC6-88A9-BCA1A32AB107} - C:\Program Files\CheckPoint\ZAForceField\WOW64\TrustChecker\bin\TrustCheckerIEPlugin.dll

TB: ZoneAlarm Security Toolbar: {438FAE3E-BDEF-44D3-AB8B-0C7C8350DF59} - C:\Program Files (x86)\Check Point Software Technologies LTD\zonealarm\1.8.11.11\zonealarmTlbr.dll

TB: ZoneAlarm Security Engine: {EE2AC4E5-B0B0-4EC6-88A9-BCA1A32AB107} - C:\Program Files\CheckPoint\ZAForceField\WOW64\TrustChecker\bin\TrustCheckerIEPlugin.dll

mRun: [iMSS] "C:\Program Files (x86)\Intel\Intel® Management Engine Components\IMSS\PIconStartup.exe"

mRun: [uSB3MON] "C:\Program Files (x86)\Intel\Intel® USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe"

mRun: [iAStorIcon] C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorIconLaunch.exe "C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe" 60

mRun: [AVG_UI] "C:\Program Files (x86)\AVG\AVG2013\avgui.exe" /TRAYONLY

mRun: [ZoneAlarm] "C:\Program Files (x86)\CheckPoint\ZoneAlarm\zatray.exe"

mRun: [KeePass 2 PreLoad] "C:\Program Files (x86)\KeePass Password Safe 2\KeePass.exe" --preload

StartupFolder: C:\Users\Donna\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\Dropbox.lnk - C:\Users\Donna\AppData\Roaming\Dropbox\bin\Dropbox.exe

StartupFolder: C:\Users\Donna\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\SMARTS~1.LNK - C:\Program Files\Dell\Feature Enhancement Pack\SmartSettings.exe

uPolicies-Explorer: NoDriveTypeAutoRun = dword:145

mPolicies-Explorer: NoActiveDesktop = dword:1

mPolicies-Explorer: NoActiveDesktopChanges = dword:1

mPolicies-System: ConsentPromptBehaviorAdmin = dword:5

mPolicies-System: ConsentPromptBehaviorUser = dword:3

mPolicies-System: EnableUIADesktopToggle = dword:0

mPolicies-System: DisableCAD = dword:1

IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll

TCP: NameServer = 68.105.28.11 68.105.29.11 68.105.28.12

TCP: Interfaces\{036277A3-0881-4D18-9488-50C91EA115EE} : DHCPNameServer = 68.105.28.11 68.105.29.11 68.105.28.12

Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files (x86)\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll

SSODL: WebCheck - <orphaned>

LSA: Authentication Packages = msv1_0 wvauth

mASetup: {8A69D345-D564-463c-AFF1-A69D9E530F96} - "C:\Program Files (x86)\Google\Chrome\Application\27.0.1453.94\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --multi-install --chrome

x64-BHO: ZoneAlarm Security Engine Registrar: {8A4A36C2-0535-4D2C-BD3D-496CB7EED6E3} - C:\Program Files\CheckPoint\ZAForceField\TrustChecker\bin\TrustCheckerIEPlugin.dll

x64-BHO: Windows Live ID Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

x64-TB: ZoneAlarm Security Engine: {EE2AC4E5-B0B0-4EC6-88A9-BCA1A32AB107} - C:\Program Files\CheckPoint\ZAForceField\TrustChecker\bin\TrustCheckerIEPlugin.dll

x64-Run: [Apoint] C:\Program Files\DellTPad\Apoint.exe

x64-Run: [sysTrayApp] C:\Program Files\IDT\WDM\sttray64.exe

x64-Run: [broadcom Wireless Manager UI] C:\Program Files\Dell\DW WLAN Card\WLTRAY.exe

x64-Run: [TdmNotify] C:\Program Files\Dell\Dell Data Protection\Access\Advanced\Wave\Trusted Drive Manager\TdmNotify.exe

x64-Run: [DFEPApplication] C:\Program Files\Dell\Feature Enhancement Pack\DFEPApplication.exe

x64-Run: [igfxTray] C:\Windows\System32\igfxtray.exe

x64-Run: [HotKeysCmds] C:\Windows\System32\hkcmd.exe

x64-Run: [Persistence] C:\Windows\System32\igfxpers.exe

x64-Run: [iSW] "C:\Program Files\CheckPoint\ZAForceField\ForceField.exe" /icon="hidden"

x64-Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - <orphaned>

x64-Notify: igfxcui - igfxdev.dll

x64-Notify: spba - C:\Program Files\Common Files\SPBA\homefus2.dll

x64-SSODL: WebCheck - <orphaned>

.

============= SERVICES / DRIVERS ===============

.

R0 AVGIDSHA;AVGIDSHA;C:\Windows\System32\drivers\avgidsha.sys [2013-2-8 71480]

R0 Avgloga;AVG Logging Driver;C:\Windows\System32\drivers\avgloga.sys [2013-2-8 311096]

R0 Avgmfx64;AVG Mini-Filter Resident Anti-Virus Shield;C:\Windows\System32\drivers\avgmfx64.sys [2013-2-8 116536]

R0 Avgrkx64;AVG Anti-Rootkit Driver;C:\Windows\System32\drivers\avgrkx64.sys [2013-2-8 45880]

R0 iusb3hcs;Intel® USB 3.0 Host Controller Switch Driver;C:\Windows\System32\drivers\iusb3hcs.sys [2013-5-5 20024]

R0 stdcfltn;Disk Class Filter Driver for Accelerometer;C:\Windows\System32\drivers\stdcfltn.sys [2013-5-6 22128]

R1 AVGIDSDriver;AVGIDSDriver;C:\Windows\System32\drivers\avgidsdrivera.sys [2013-3-29 246072]

R1 Avgldx64;AVG AVI Loader Driver;C:\Windows\System32\drivers\avgldx64.sys [2013-2-8 206136]

R1 Avgtdia;AVG TDI Driver;C:\Windows\System32\drivers\avgtdia.sys [2013-3-21 240952]

R2 AVGIDSAgent;AVGIDSAgent;C:\Program Files (x86)\AVG\AVG2013\avgidsagent.exe [2013-5-14 4937264]

R2 avgwd;AVG WatchDog;C:\Program Files (x86)\AVG\AVG2013\avgwdsvc.exe [2013-4-18 283136]

R2 BrcmMgmtAgent;Broadcom Management Agent;C:\Program Files\Broadcom\MgmtAgent\BrcmMgmtAgent.exe [2011-11-30 163840]

R2 DellDigitalDelivery;Dell Digital Delivery Service;C:\Program Files (x86)\Dell Digital Delivery\DeliveryService.exe [2013-3-13 187912]

R2 DFEPService;Dell Feature Enhancement Pack Service;C:\Program Files\Dell\Feature Enhancement Pack\DFEPService.exe [2012-8-15 2280504]

R2 EmbassyService;EmbassyService;C:\Program Files\Dell\Dell Data Protection\Access\Advanced\Wave\EMBASSY Client Core\EmbassyServer.exe [2012-11-20 225720]

R2 IAStorDataMgrSvc;Intel® Rapid Storage Technology;C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe [2013-5-5 13632]

R2 Intel® Capability Licensing Service Interface;Intel® Capability Licensing Service Interface;C:\Program Files\Intel\iCLS Client\HeciServer.exe [2012-7-27 636952]

R2 ISWKL;ZoneAlarm LTD Toolbar ISWKL;C:\Program Files\CheckPoint\ZAForceField\ISWKL.sys [2012-11-22 33712]

R2 IswSvc;ZoneAlarm LTD Toolbar IswSvc;C:\Program Files\CheckPoint\ZAForceField\ISWSVC.exe [2012-11-22 828072]

R2 jhi_service;Intel® Dynamic Application Loader Host Interface Service;C:\Program Files (x86)\Intel\Intel® Management Engine Components\DAL\Jhi_service.exe [2013-5-5 166432]

R2 PbaDrvSvc_x64;Dell PBA x64 Service;C:\Program Files\Dell\Dell Data Protection\Access\Advanced\hapi64\pbadrvsvc.exe [2012-11-23 20480]

R2 UNS;Intel® Management and Security Application User Notification Service;C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe [2013-5-5 365600]

R2 Wave Authentication Manager Service;Wave Authentication Manager Service;C:\Program Files\Dell\Dell Data Protection\Access\Advanced\Wave\Authentication Manager\WaveAMService.exe [2012-11-19 1758720]

R3 dcdbas;System Management Driver;C:\Windows\System32\drivers\dcdbas64.sys [2012-9-23 39016]

R3 ICCS;Intel® Integrated Clock Controller Service - Intel® ICCS;C:\Program Files (x86)\Intel\Intel® Integrated Clock Controller Service\ICCProxy.exe [2013-5-23 169752]

R3 IntcDAud;Intel® Display Audio;C:\Windows\System32\drivers\IntcDAud.sys [2013-5-23 342528]

R3 iusb3hub;Intel® USB 3.0 Hub Driver;C:\Windows\System32\drivers\iusb3hub.sys [2013-5-5 358456]

R3 iusb3xhc;Intel® USB 3.0 eXtensible Host Controller Driver;C:\Windows\System32\drivers\iusb3xhc.sys [2013-5-5 791608]

R3 O2SDJRDR;O2SDJRDR;C:\Windows\System32\drivers\o2sdjw7x64.sys [2013-5-6 84712]

R3 ST_ACCEL;STMicroelectronics Accelerometer Service;C:\Windows\System32\drivers\ST_ACCEL.sys [2013-5-6 68208]

S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]

S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-3-18 138576]

S2 WvPCR;WvPCR;C:\Program Files\Dell\Dell Data Protection\Access\Advanced\Wave\Common\WvPCR.exe [2012-11-8 254384]

S3 dmvsc;dmvsc;C:\Windows\System32\drivers\dmvsc.sys [2010-11-21 71168]

S3 fssfltr;fssfltr;C:\Windows\System32\drivers\fssfltr.sys [2013-5-5 57856]

S3 fsssvc;Windows Live Family Safety Service;C:\Program Files (x86)\Windows Live\Family Safety\fsssvc.exe [2012-9-12 1512448]

S3 netvsc;netvsc;C:\Windows\System32\drivers\netvsc60.sys [2010-11-21 168448]

S3 O2MDFRDR;O2MDFRDR;C:\Windows\System32\drivers\o2mdfw7x64.sys [2013-5-6 72808]

S3 O2MDRRDR;O2MDRRDR;C:\Windows\System32\drivers\O2MDRw7x64.sys [2013-5-6 74984]

S3 StorSvc;Storage Service;C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted [2009-7-13 27136]

S3 SynthVid;SynthVid;C:\Windows\System32\drivers\VMBusVideoM.sys [2010-11-21 22528]

S3 TsUsbFlt;TsUsbFlt;C:\Windows\System32\drivers\TsUsbFlt.sys [2010-11-20 59392]

S3 TsUsbGD;Remote Desktop Generic USB Device;C:\Windows\System32\drivers\TsUsbGD.sys [2010-11-20 31232]

S3 WatAdminSvc;Windows Activation Technologies Service;C:\Windows\System32\Wat\WatAdminSvc.exe [2013-5-25 1255736]

.

=============== Created Last 30 ================

.

2013-05-25 14:44:35 -------- d-----w- C:\ProgramData\Malwarebytes' Anti-Malware (portable)

2013-05-25 14:06:57 -------- d-----w- C:\Program Files (x86)\InCode Solutions

2013-05-25 10:11:27 -------- d-----w- C:\Program Files (x86)\MSXML 4.0

2013-05-25 08:58:30 -------- d-----w- C:\Windows\SysWow64\Wat

2013-05-25 08:58:30 -------- d-----w- C:\Windows\System32\Wat

2013-05-25 08:23:01 9728 ---ha-w- C:\Windows\SysWow64\api-ms-win-downlevel-shlwapi-l1-1-0.dll

2013-05-25 08:22:59 363008 ----a-w- C:\Windows\System32\dxgi.dll

2013-05-25 04:26:58 -------- d-----w- C:\Users\Donna\AppData\Roaming\Malwarebytes

2013-05-25 04:26:47 25928 ----a-w- C:\Windows\System32\drivers\mbam.sys

2013-05-25 04:26:47 -------- d-----w- C:\ProgramData\Malwarebytes

2013-05-25 04:26:47 -------- d-----w- C:\Program Files (x86)\Malwarebytes' Anti-Malware

2013-05-25 00:31:11 -------- d-----w- C:\Users\Donna\AppData\Local\Microsoft Games

2013-05-25 00:28:33 -------- d-----w- C:\Program Files\Microsoft Games

2013-05-24 18:57:21 -------- d-----w- C:\Windows\System32\appmgmt

2013-05-24 18:42:21 -------- d-----w- C:\Program Files (x86)\Conduit

2013-05-24 18:42:00 -------- d-----w- C:\Users\Donna\AppData\Local\Conduit

2013-05-24 18:40:47 -------- d-----w- C:\Users\Donna\AppData\Local\CRE

2013-05-24 10:55:57 -------- dc----w- C:\Users\Donna\AppData\Local\MigWiz

2013-05-24 02:58:49 -------- d-----w- C:\Program Files (x86)\KeePass Password Safe 2

2013-05-24 02:46:24 -------- d-----w- C:\Users\Donna\AppData\Local\DoNotTrackPlus

2013-05-24 02:36:09 -------- d-----r- C:\Users\Donna\Dropbox

2013-05-24 02:29:29 -------- d-----w- C:\Users\Donna\AppData\Roaming\Dropbox

2013-05-24 02:02:55 -------- d-----w- C:\Users\Donna\AppData\Roaming\KeePass

2013-05-24 02:01:22 -------- d-----w- C:\Users\Donna\AppData\Local\Programs

2013-05-24 01:04:15 -------- d-----w- C:\Users\Donna\AppData\Local\Thunderbird

2013-05-24 01:04:11 -------- d-----w- C:\Program Files (x86)\Mozilla Maintenance Service

2013-05-24 00:39:00 -------- d-----w- C:\Users\Donna\AppData\Roaming\CheckPoint

2013-05-24 00:38:56 -------- d-----w- C:\Program Files\CheckPoint

2013-05-24 00:38:03 -------- d-----w- C:\Program Files (x86)\Check Point Software Technologies LTD

2013-05-24 00:38:01 -------- d-----w- C:\Users\Donna\AppData\Roaming\Check Point Software Technologies LTD

2013-05-24 00:37:58 -------- d-----w- C:\Program Files (x86)\CheckPoint

2013-05-24 00:36:57 -------- d-----w- C:\ProgramData\CheckPoint

2013-05-24 00:05:57 -------- d-----w- C:\Users\Donna\AppData\Roaming\AVG2013

2013-05-24 00:05:36 -------- d-----w- C:\Users\Donna\AppData\Roaming\TuneUp Software

2013-05-24 00:05:25 -------- d--h--w- C:\$AVG

2013-05-24 00:05:25 -------- d-----w- C:\ProgramData\AVG2013

2013-05-24 00:05:03 -------- d-----w- C:\Program Files (x86)\AVG

2013-05-24 00:02:14 -------- d--h--w- C:\ProgramData\Common Files

2013-05-24 00:02:14 -------- d-----w- C:\Users\Donna\AppData\Local\MFAData

2013-05-24 00:02:14 -------- d-----w- C:\Users\Donna\AppData\Local\Avg2013

2013-05-24 00:02:14 -------- d-----w- C:\ProgramData\MFAData

2013-05-23 23:51:29 -------- d-----w- C:\Program Files (x86)\VS Revo Group

2013-05-23 23:51:27 -------- d-----w- C:\Program Files (x86)\SweetIM

2013-05-23 23:48:42 -------- d-----w- C:\Program Files (x86)\Dell Digital Delivery

2013-05-23 23:41:45 -------- d-----w- C:\Users\Donna\AppData\Local\Google

2013-05-23 23:41:33 -------- d-----w- C:\Users\Donna\AppData\Local\Apps

2013-05-23 23:41:32 -------- d-----w- C:\Users\Donna\AppData\Local\Deployment

2013-05-23 23:31:24 23552 ----a-w- C:\Windows\System32\drivers\tdtcp.sys

2013-05-23 23:28:23 -------- d-----w- C:\Users\Donna\AppData\Roaming\Intel Corporation

2013-05-23 23:28:19 0 ----a-w- C:\Windows\invcol.tmp

2013-05-23 23:27:09 -------- d-----r- C:\Users\Donna\Virtual Machines

2013-05-23 23:27:03 -------- d-----w- C:\Users\Donna\AppData\Local\Dell

2013-05-23 23:26:49 -------- d-----w- C:\Users\Donna\AppData\Local\VirtualStore

2013-05-23 23:26:35 2622464 ----a-w- C:\Windows\System32\wucltux.dll

2013-05-23 23:26:26 99840 ----a-w- C:\Windows\System32\wudriver.dll

2013-05-23 23:26:15 36864 ----a-w- C:\Windows\System32\wuapp.exe

2013-05-23 23:26:15 186752 ----a-w- C:\Windows\System32\wuwebv.dll

2013-05-06 05:51:40 6102016 ----a-w- C:\Windows\System32\stlang64.dll

2013-05-06 05:51:40 1821184 ----a-w- C:\Windows\System32\IDTNC64.cpl

2013-05-06 05:51:37 -------- d-----w- C:\Program Files\IDT

2013-05-06 05:51:19 -------- d-----w- C:\Intel

2013-05-06 05:51:09 22128 ----a-w- C:\Windows\System32\drivers\stdcfltn.sys

2013-05-06 05:50:44 -------- d-----w- C:\Windows\devcon

2013-05-06 05:46:09 -------- d-----w- C:\Program Files\STMicroelectronics

2013-05-06 05:45:27 -------- d-----w- C:\Program Files\DellTPad

2013-05-06 05:43:15 360832 ----a-w- C:\Windows\System32\drivers\vpcvmm.sys

2013-05-06 05:42:52 503808 ----a-w- C:\Windows\System32\srcore.dll

2013-05-06 05:34:13 90112 ----a-w- C:\Windows\System32\igfxCoIn_v2712.dll

2013-05-06 05:33:46 440592 ----a-w- C:\Windows\System32\drivers\b57nd60a.sys

2013-05-06 05:32:47 95544 ----a-w- C:\Windows\System32\bcmwlcoi.dll

2013-05-06 05:32:47 4746304 ----a-w- C:\Windows\System32\drivers\BCMWL664.SYS

2013-05-06 05:32:47 3952640 ----a-w- C:\Windows\System32\bcmihvsrv64.dll

2013-05-06 05:32:47 3617792 ----a-w- C:\Windows\System32\bcmihvui64.dll

2013-05-06 05:32:45 68208 ----a-w- C:\Windows\System32\drivers\ST_ACCEL.sys

2013-05-06 05:32:45 65136 ----a-w- C:\Windows\System32\stdcfltnco02.dll

2013-05-06 05:32:45 1721576 ----a-w- C:\Windows\System32\WdfCoInstaller01009.dll

2013-05-06 05:28:35 -------- d-----w- C:\Windows\System32\oem

2013-05-06 05:28:33 -------- d-----w- C:\Drivers

2013-05-06 04:36:22 -------- d-----w- C:\Program Files (x86)\Common Files\Intel Corporation

2013-05-06 04:30:55 -------- d-----w- C:\ProgramData\Trend Micro

2013-05-06 04:29:20 -------- d-----w- C:\Windows\{69093D49-3DD1-4FB5-A378-0D4DB4CF86EA}

2013-05-06 04:29:12 -------- d-----w- C:\Windows\en

2013-05-06 04:29:04 -------- d-----w- C:\Program Files (x86)\Microsoft SQL Server Compact Edition

2013-05-06 04:28:32 57856 ----a-w- C:\Windows\System32\drivers\fssfltr.sys

2013-05-06 04:28:19 -------- d-----w- C:\Windows\PCHEALTH

2013-05-06 04:27:36 77656 ----a-w- C:\Windows\System32\XAPOFX1_5.dll

2013-05-06 04:27:36 74072 ----a-w- C:\Windows\SysWow64\XAPOFX1_5.dll

2013-05-06 04:27:36 527192 ----a-w- C:\Windows\SysWow64\XAudio2_7.dll

2013-05-06 04:27:36 518488 ----a-w- C:\Windows\System32\XAudio2_7.dll

2013-05-06 04:27:36 276832 ----a-w- C:\Windows\System32\d3dx11_43.dll

2013-05-06 04:27:36 2526056 ----a-w- C:\Windows\System32\D3DCompiler_43.dll

2013-05-06 04:27:36 248672 ----a-w- C:\Windows\SysWow64\d3dx11_43.dll

2013-05-06 04:27:36 2106216 ----a-w- C:\Windows\SysWow64\D3DCompiler_43.dll

2013-05-06 04:27:19 523088 ----a-w- C:\Windows\System32\d3dx10_42.dll

2013-05-06 04:27:19 453456 ----a-w- C:\Windows\SysWow64\d3dx10_42.dll

2013-05-06 04:27:02 4398360 ----a-w- C:\Windows\System32\d3dx9_32.dll

2013-05-06 04:27:02 3426072 ----a-w- C:\Windows\SysWow64\d3dx9_32.dll

2013-05-06 04:26:01 89944 -c--a-w- C:\Program Files (x86)\Common Files\Windows Live\.cache\d0785c5a1ce4a1104\DSETUP.dll

2013-05-06 04:26:01 537432 -c--a-w- C:\Program Files (x86)\Common Files\Windows Live\.cache\d0785c5a1ce4a1104\DXSETUP.exe

2013-05-06 04:26:01 1801048 -c--a-w- C:\Program Files (x86)\Common Files\Windows Live\.cache\d0785c5a1ce4a1104\dsetup32.dll

2013-05-06 04:26:00 94040 -c--a-w- C:\Program Files (x86)\Common Files\Windows Live\.cache\cfbeb1041ce4a1101\DSETUP.dll

2013-05-06 04:26:00 89944 -c--a-w- C:\Program Files (x86)\Common Files\Windows Live\.cache\d00d3e6d1ce4a1102\DSETUP.dll

2013-05-06 04:26:00 537432 -c--a-w- C:\Program Files (x86)\Common Files\Windows Live\.cache\d00d3e6d1ce4a1102\DXSETUP.exe

2013-05-06 04:26:00 525656 -c--a-w- C:\Program Files (x86)\Common Files\Windows Live\.cache\cfbeb1041ce4a1101\DXSETUP.exe

2013-05-06 04:26:00 1801048 -c--a-w- C:\Program Files (x86)\Common Files\Windows Live\.cache\d00d3e6d1ce4a1102\dsetup32.dll

2013-05-06 04:26:00 1691480 -c--a-w- C:\Program Files (x86)\Common Files\Windows Live\.cache\cfbeb1041ce4a1101\dsetup32.dll

2013-05-06 04:25:59 -------- d-----w- C:\Program Files (x86)\Common Files\Windows Live

2013-05-06 04:25:29 -------- d-----w- C:\Windows\{7197954C-D1BE-4A17-8E69-52FDC4010A30}

2013-05-06 04:20:31 93288 ----a-w- C:\Windows\dcmdev64.exe

2013-05-06 04:20:31 382056 ----a-w- C:\Windows\hapint.exe

2013-05-06 04:20:31 335464 ----a-w- C:\Windows\dchcfg64.exe

2013-05-06 04:20:29 459880 ----a-w- C:\Windows\System32\dchbas64.dll

2013-05-06 04:20:29 322664 ----a-w- C:\Windows\System32\dchapi64.dll

2013-05-06 04:20:26 -------- d-----w- C:\Program Files (x86)\Dell

2013-05-06 04:20:08 -------- d-----w- C:\apps

2013-05-06 04:20:06 -------- d-----w- C:\ProgramData\Security Innovation

2013-05-06 04:20:06 -------- d-----w- C:\Program Files (x86)\Security Innovation

2013-05-06 04:19:44 -------- d-----w- C:\Program Files\Fingerprint Sensor

2013-05-06 04:19:19 -------- d-----w- C:\Program Files\Common Files\SPBA

2013-05-06 04:19:19 -------- d-----w- C:\Program Files (x86)\Common Files\SPBA

2013-05-06 04:18:52 -------- d-----w- C:\Program Files (x86)\Gemalto

2013-05-06 04:18:42 -------- d-----w- C:\Program Files (x86)\O2Micro OZ776 SCR Driver

2013-05-06 04:18:23 -------- d-----w- C:\Windows\Downloaded Installations

2013-05-06 04:18:17 40960 ----a-w- C:\Windows\SysWow64\ct32O2.dll

2013-05-06 04:18:17 40960 ----a-w- C:\Windows\System32\ct32O2.dll

2013-05-06 04:18:08 -------- d-----w- C:\ProgramData\Wave Systems Corp

2013-05-06 04:15:46 121344 ----a-w- C:\Windows\System32\basp.dll

2013-05-06 04:15:45 -------- d-----w- C:\Program Files\Broadcom

2013-05-06 04:15:32 -------- d-----w- C:\Windows\Dell

2013-05-06 04:14:44 41984 ----a-w- C:\Windows\System32\drivers\USB3Ver.dll

2013-05-06 04:14:43 791608 ----a-w- C:\Windows\System32\drivers\iusb3xhc.sys

2013-05-06 04:14:43 358456 ----a-w- C:\Windows\System32\drivers\iusb3hub.sys

2013-05-06 04:14:43 20024 ----a-w- C:\Windows\System32\drivers\iusb3hcs.sys

2013-05-06 04:14:37 8192 ----a-w- C:\Windows\System32\drivers\IntelMEFWVer.dll

2013-05-06 04:13:39 -------- d-----w- C:\Program Files (x86)\Common Files\postureAgent

2013-05-06 04:13:34 -------- d-----w- C:\Program Files (x86)\Cisco

2013-05-06 04:12:56 1131520 ----a-w- C:\Windows\System32\BCMLogon.dll

2013-05-06 04:12:53 8225280 ----a-w- C:\Windows\System32\BCMWLCPL.CPL

2013-05-06 04:12:53 73728 ----a-w- C:\Windows\System32\wltrynt.dll

2013-05-06 04:12:53 6656 ----a-w- C:\Windows\System32\bcmwlrc.dll

2013-05-06 04:12:53 4993024 ----a-w- C:\Windows\System32\bcmttls.dll

2013-05-06 04:12:53 4961800 ----a-w- C:\Windows\SysWow64\vcredist_x64.exe

2013-05-06 04:12:53 446 ----a-w- C:\Windows\SysWow64\vcredist_x64.bat

2013-05-06 04:12:53 445 ----a-w- C:\Windows\System32\vcredist_x64.bat

2013-05-06 04:12:53 35344 ----a-w- C:\Windows\System32\drivers\npf.sys

2013-05-06 04:12:53 3161088 ----a-w- C:\Windows\System32\vcredist_x64.exe

2013-05-06 04:12:53 22592 ----a-w- C:\Windows\System32\drivers\bcm42rly.sys

2013-05-06 04:12:52 -------- d-----w- C:\Program Files\Dell

2013-05-06 04:11:34 -------- d-----w- C:\Program Files (x86)\ST Microelectronics

2013-05-06 04:11:33 -------- d-----w- C:\Program Files\Windows XP Mode

2013-05-06 03:56:52 71024 ----a-w- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl

2013-05-06 03:56:52 691568 ----a-w- C:\Windows\SysWow64\FlashPlayerApp.exe

2013-05-06 03:56:43 -------- d-----w- C:\Program Files\Dell Inc

.

==================== Find3M ====================

.

2013-05-25 08:23:01 9728 ---ha-w- C:\Windows\System32\api-ms-win-downlevel-shlwapi-l1-1-0.dll

2013-05-25 08:22:59 2565120 ----a-w- C:\Windows\System32\d3d10warp.dll

2013-05-06 05:43:09 936448 ----a-w- C:\Windows\System32\vmsal.exe

2013-05-06 05:42:52 478208 ----a-w- C:\Windows\System32\dpnet.dll

2013-04-12 14:45:08 1656680 ----a-w- C:\Windows\System32\drivers\ntfs.sys

2013-04-10 06:01:54 265064 ----a-w- C:\Windows\System32\drivers\dxgmms1.sys

2013-04-10 06:01:53 983400 ----a-w- C:\Windows\System32\drivers\dxgkrnl.sys

2013-04-10 03:30:50 3153920 ----a-w- C:\Windows\System32\win32k.sys

2013-03-29 07:53:48 246072 ----a-w- C:\Windows\System32\drivers\avgidsdrivera.sys

2013-03-21 08:08:24 240952 ----a-w- C:\Windows\System32\drivers\avgtdia.sys

2013-03-19 06:04:06 5550424 ----a-w- C:\Windows\System32\ntoskrnl.exe

2013-03-19 05:46:56 43520 ----a-w- C:\Windows\System32\csrsrv.dll

2013-03-19 05:04:13 3968856 ----a-w- C:\Windows\SysWow64\ntkrnlpa.exe

2013-03-19 05:04:10 3913560 ----a-w- C:\Windows\SysWow64\ntoskrnl.exe

2013-03-19 04:47:50 6656 ----a-w- C:\Windows\SysWow64\apisetschema.dll

2013-03-19 03:06:33 112640 ----a-w- C:\Windows\System32\smss.exe

2013-03-14 04:14:20 279024 ----a-w- C:\Windows\SysWow64\IntelCpHeciSvc.exe

2013-03-14 04:14:18 515568 ----a-w- C:\Windows\System32\igfxsrvc.exe

2013-03-14 04:14:18 442352 ----a-w- C:\Windows\System32\igfxpers.exe

2013-03-14 04:14:18 254960 ----a-w- C:\Windows\System32\igfxext.exe

2013-03-14 04:14:18 172016 ----a-w- C:\Windows\System32\igfxtray.exe

2013-03-14 04:14:16 5905904 ----a-w- C:\Windows\System32\GfxUI.exe

2013-03-14 04:14:16 399856 ----a-w- C:\Windows\System32\hkcmd.exe

2013-03-14 04:14:16 185840 ----a-w- C:\Windows\System32\difx64.exe

2013-02-27 17:58:36 342528 ----a-w- C:\Windows\System32\drivers\IntcDAud.sys

2013-02-27 17:58:36 16896 ----a-w- C:\Windows\System32\IntcDAuC.dll

2013-02-27 17:58:16 116224 ----a-w- C:\Windows\System32\igfxCoIn_v3040.dll

2013-02-27 06:02:44 111448 ----a-w- C:\Windows\System32\consent.exe

2013-02-27 05:48:00 1930752 ----a-w- C:\Windows\System32\authui.dll

2013-02-27 05:47:10 70144 ----a-w- C:\Windows\System32\appinfo.dll

2013-02-27 04:49:24 1796096 ----a-w- C:\Windows\SysWow64\authui.dll

.

============= FINISH: 16:45:30.73 ===============

.

UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.

IF REQUESTED, ZIP IT UP & ATTACH IT

.

DDS (Ver_2012-11-20.01)

.

Microsoft Windows 7 Professional

Boot Device: \Device\HarddiskVolume2

Install Date: 5/23/2013 6:25:47 PM

System Uptime: 5/25/2013 7:18:40 AM (9 hours ago)

.

Motherboard: Dell Inc. | | 0MYF02

Processor: Intel® Core i3-3120M CPU @ 2.50GHz | SOCKET 0 | 1200/100mhz

.

==== Disk Partitions =========================

.

C: is FIXED (NTFS) - 297 GiB total, 259.805 GiB free.

D: is CDROM ()

.

==== Disabled Device Manager Items =============

.

==== System Restore Points ===================

.

RP12: 5/23/2013 6:25:55 PM - Windows Update

RP13: 5/23/2013 6:29:55 PM - Dell Updates

RP14: 5/23/2013 6:31:25 PM - Windows Update

RP15: 5/23/2013 7:04:45 PM - Installed AVG 2013

RP16: 5/23/2013 7:05:09 PM - Installed AVG 2013

RP17: 5/24/2013 1:43:57 PM - Revo Uninstaller's restore point - Free Spider Solitaire v4.0

RP18: 5/24/2013 1:57:01 PM - Removed Internet Explorer Toolbar 4.8 by SweetPacks

RP19: 5/24/2013 7:28:20 PM - Windows Modules Installer

RP20: 5/25/2013 3:00:28 AM - Windows Update

RP21: 5/25/2013 5:09:56 AM - Windows Update

.

==== Installed Programs ======================

.

7-Zip 9.21

Adobe Flash Player 11 ActiveX

AuthenTec WinBio FingerPrint Software 64-bit

AVG 2013

Broadcom NetXtreme-I Netlink Driver and Management Installer

Cisco EAP-FAST Module

Cisco LEAP Module

Cisco PEAP Module

Custom

D3DX10

Dell Client System Update

Dell Data Protection | Access

Dell Digital Delivery

Dell Edoc Viewer

Dell Feature Enhancement Pack

Dell Touchpad

DellAccess

Dropbox

DW WLAN Card Utility

EMBASSY Client Core

ERAS Connector

Gemalto

GemPcCCID

Google Chrome

Google Update Helper

Intel® Control Center

Intel® Management Engine Components

Intel® Processor Graphics

Intel® Rapid Storage Technology

Intel® SDK for OpenCL - CPU Only Runtime Package

Intel® USB 3.0 eXtensible Host Controller Driver

Intel® Trusted Connect Service Client

Junk Mail filter update

KeePass Password Safe 2.22

Malwarebytes Anti-Malware version 1.75.0.1300

Microsoft .NET Framework 4 Client Profile

Microsoft .NET Framework 4 Extended

Microsoft Application Error Reporting

Microsoft SQL Server 2005 Compact Edition [ENU]

Microsoft Visual C++ 2005 Redistributable

Microsoft Visual C++ 2005 Redistributable (x64)

Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17

Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219

Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219

Movie Maker

Mozilla Maintenance Service

Mozilla Thunderbird 17.0.6 (x86 en-US)

MSVCRT

MSVCRT_amd64

MSVCRT110

MSVCRT110_amd64

MSXML 4.0 SP2 (KB954430)

MSXML 4.0 SP2 (KB973688)

O2Micro OZ776 SCR Driver

PBA Driver

Photo Common

Photo Gallery

Preboot Manager

Private Information Manager

RemoveIT Pro v4 - SE

Revo Uninstaller 1.94

Security Update for Microsoft .NET Framework 4 Client Profile (KB2518870)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2539636)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2572078)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2604121)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2656351)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2729449)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2736428)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2737019)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2742595)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2789642)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2804576)

Security Update for Microsoft .NET Framework 4 Extended (KB2487367)

Security Update for Microsoft .NET Framework 4 Extended (KB2656351)

Security Update for Microsoft .NET Framework 4 Extended (KB2736428)

Security Update for Microsoft .NET Framework 4 Extended (KB2742595)

SI TSS

SPBA (WBF) 5.9

ST Microelectronics 3 Axis Digital Accelerometer Solution

toolkit32for64bit

Trusted Drive Manager

Update for Microsoft .NET Framework 4 Client Profile (KB2468871)

Update for Microsoft .NET Framework 4 Client Profile (KB2533523)

Update for Microsoft .NET Framework 4 Extended (KB2468871)

Update for Microsoft .NET Framework 4 Extended (KB2533523)

Visual Studio 2010 x64 Redistributables

Wave Crypto Runtime 2.0.9.0 x64

Wave Crypto Runtime 2.0.9.0 x86

Wave Infrastructure Installer

Wave Support Software Installer

Windows Live Communications Platform

Windows Live Essentials

Windows Live Family Safety

Windows Live ID Sign-in Assistant

Windows Live Installer

Windows Live Mail

Windows Live MIME IFilter

Windows Live Photo Common

Windows Live PIMT Platform

Windows Live SOXE

Windows Live SOXE Definitions

Windows Live UX Platform

Windows Live UX Platform Language Pack

Windows Live Writer

Windows Live Writer Resources

ZoneAlarm Firewall

ZoneAlarm Free Firewall

ZoneAlarm LTD Toolbar

ZoneAlarm Security

ZoneAlarm Security Toolbar

.

==== Event Viewer Messages From Past Week ========

.

5/25/2013 9:47:03 AM, Error: iaStor [9] - The device, \Device\Ide\iaStor0, did not respond within the timeout period.

5/25/2013 5:13:02 AM, Error: Service Control Manager [7001] - The WvPCR service depends on the TPM Base Services service which failed to start because of the following error: The operation completed successfully.

5/25/2013 5:13:02 AM, Error: Service Control Manager [7001] - The SI TSS v1.2.1.41 TCS service depends on the TPM Base Services service which failed to start because of the following error: The operation completed successfully.

5/25/2013 5:11:58 AM, Error: Service Control Manager [7006] - The ScRegSetValueExW call failed for FailureActions with the following error: Access is denied.

5/25/2013 4:05:03 AM, Error: Microsoft-Windows-WindowsUpdateClient [20] - Installation Failure: Windows failed to install the following update with error 0x80242016: Security Update for Internet Explorer 9 for Windows 7 for x64-based Systems (KB2847204).

5/25/2013 4:05:03 AM, Error: Microsoft-Windows-WindowsUpdateClient [20] - Installation Failure: Windows failed to install the following update with error 0x80242016: Cumulative Security Update for Internet Explorer 9 for Windows 7 for x64-based Systems (KB2829530).

5/25/2013 4:02:04 AM, Error: Service Control Manager [7023] -

5/25/2013 3:30:58 AM, Error: Microsoft-Windows-WindowsUpdateClient [20] - Installation Failure: Windows failed to install the following update with error 0x80070643: Update for Microsoft XML Core Services 4.0 Service Pack 2 for x64-based Systems (KB973688).

5/25/2013 3:28:06 AM, Error: Microsoft-Windows-WindowsUpdateClient [20] - Installation Failure: Windows failed to install the following update with error 0x80070643: Security Update for Microsoft XML Core Services 4.0 Service Pack 2 for x64-based Systems (KB954430).

5/24/2013 5:40:21 AM, Error: Service Control Manager [7011] - A timeout (30000 milliseconds) was reached while waiting for a transaction response from the DFEPService service.

5/24/2013 5:38:43 AM, Error: Microsoft-Windows-WER-SystemErrorReporting [1001] - The computer has rebooted from a bugcheck. The bugcheck was: 0x000000d1 (0x0000000000000010, 0x0000000000000002, 0x0000000000000000, 0xfffff88002e753d8). A dump was saved in: C:\Windows\MEMORY.DMP. Report Id: 052413-44522-01.

5/23/2013 7:39:13 PM, Error: Service Control Manager [7030] - The TrueVector Internet Monitor service is marked as an interactive service. However, the system is configured to not allow interactive services. This service may not function properly.

5/23/2013 6:51:49 PM, Error: Service Control Manager [7030] - The DefaultTabSearch service is marked as an interactive service. However, the system is configured to not allow interactive services. This service may not function properly.

5/23/2013 6:48:40 PM, Error: Service Control Manager [7034] - The Dell Digital Delivery Service service terminated unexpectedly. It has done this 2 time(s).

5/23/2013 6:38:23 PM, Error: Service Control Manager [7034] - The Dell Digital Delivery Service service terminated unexpectedly. It has done this 1 time(s).

.

==== End Of File ===========================

gringo_pr · May 25, 2013

Hello ghostofunder

I would like to welcome you to the Malware Removal section of the forum.

Around here they call me Gringo and I will be glad to help you with your malware problems.

Very Important --> Please read this post completely, I have spent my time to put together somethings for you to keep in mind while I am helping you to make things go easier, faster and smoother for both of us!

Please do not run any tools unless instructed to do so.
- We ask you to run different tools in a specific order to ensure the malware is completely removed from your machine, and running any additional tools may detect false positives, interfere with our tools, or cause unforeseen damage or system instability.
[*]Please do not attach logs or use code boxes, just copy and paste the text.
- Due to the high volume of logs we receive it helps to receive everything in the same format, and code boxes make the logs very difficult to read. Also, attachments require us to download and open the reports when it is easier to just read the reports in your post.
[*]Please read every post completely before doing anything.
- Pay special attention to the NOTE: lines, these entries identify an individual issue or important step in the cleanup process.
[*]Please provide feedback about your experience as we go.
- A short statement describing how the computer is working helps us understand where to go next, for example: I am still getting redirected, the computer is running normally, etc. Please do not describe the computer as "the same", this requires the extra step of looking back at your previous post.

NOTE: At the top of your post, click on the "Follow This Topic" Button, make sure that the "Receive notification" box is checked and that it is set to "Instantly" - This will send you an e-mail as soon as I reply to your topic, allowing us to resolve the issue faster.

NOTE: Backup any files that cannot be replaced. Removing malware can be unpredictable and this step can save a lot of heartaches if things don't go as planed. You can put them on a CD/DVD, external drive or a pen drive, anywhere except on the computer.

NOTE: It is good practice to copy and paste the instructions into notepad and print them in case it is necessary for you to go offline during the cleanup process. To open notepad, navigate to Start Menu > All Programs > Accessories > Notepad. Please remember to copy the entire post so you do not miss any instructions.

These are the programs I would like you to run next, if you have any problems with one of these just skip it and move on to the next one.

-AdwCleaner-

Please download AdwCleaner by Xplode onto your desktop.

Close all open programs and internet browsers.
Double click on AdwCleaner.exe to run the tool.
Click on Delete.
Confirm each time with Ok.
Your computer will be rebooted automatically. A text file will open after the restart.
Please post the content of that logfile with your next answer.
You can find the logfile at C:\AdwCleaner[s1].txt as well.

-Junkware-Removal-Tool-

Please download Junkware Removal Tool to your desktop.

Shut down your protection software now to avoid potential conflicts.
Run the tool by double-clicking it. If you are using Windows Vista, 7, or 8; instead of double-clicking, right-mouse click JRT.exe and select "Run as Administrator".
The tool will open and start scanning your system.
Please be patient as this can take a while to complete depending on your system's specifications.
On completion, a log (JRT.txt) is saved to your desktop and will automatically open.
Post the contents of JRT.txt into your next message.

When they are complete let me have the two reports and let me know how things are running.

Gringo

ghostofunder · May 26, 2013

Thanks the reply Gringo. Here are the two files:

# AdwCleaner v2.301 - Logfile created 05/25/2013 at 20:01:07

# Updated 16/05/2013 by Xplode

# Operating system : Windows 7 Professional Service Pack 1 (64 bits)

# User : Donna - DONNA-NEW

# Boot Mode : Normal

# Running from : C:\Users\Donna\Desktop\AdwCleaner.exe

# Option [search]

***** [services] *****

***** [Files / Folders] *****

Folder Found : C:\Users\Donna\AppData\Roaming\CheckPoint\ZoneAlarm LTD Toolbar

***** [Registry] *****

Key Found : HKLM\SOFTWARE\Classes\AppID\{09C554C3-109B-483C-A06B-F14172F1A947}

Key Found : HKLM\SOFTWARE\Classes\AppID\{4E1E9D45-8BF9-4139-915C-9F83CC3D5921}

Key Found : HKLM\SOFTWARE\Classes\AppID\{B12E99ED-69BD-437C-86BE-C862B9E5444D}

Key Found : HKLM\SOFTWARE\Classes\AppID\{D7EE8177-D51E-4F89-92B6-83EA2EC40800}

Key Found : HKLM\SOFTWARE\Classes\TypeLib\{212C2C4F-C845-4FBC-9561-C833A13D8DCE}

Key Found : HKLM\SOFTWARE\Classes\TypeLib\{3C5D1D57-16C8-473C-A552-37B8D88596FE}

Key Found : HKLM\SOFTWARE\Classes\TypeLib\{4A115D8A-6A7B-4C72-92B1-2E2D01F36979}

Key Found : HKLM\SOFTWARE\Classes\TypeLib\{4E1E9D45-8BF9-4139-915C-9F83CC3D5921}

Key Found : HKLM\SOFTWARE\Classes\TypeLib\{99DF8440-814E-497F-BDDD-FB93E9E9DF96}

Key Found : HKLM\SOFTWARE\Classes\TypeLib\{D7EE8177-D51E-4F89-92B6-83EA2EC40800}

Key Found : HKLM\SOFTWARE\MozillaPlugins\@checkpoint.com/FFApi

Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{19D2F415-D58B-46BC-9390-C03DCBC21EB2}

Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{3C471948-F874-49F5-B338-4F214A2EE0B1}

Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{6E45F3E8-2683-4824-A6BE-08108022FB36}

Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{9F0F16DD-4E76-4049-A9B1-7A91E48F0323}

Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{F4288797-CB12-49CE-9DF8-7CDFA1143BEA}

Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{FFB96CC1-7EB3-449D-B827-DB661701C6BB}

Key Found : HKLM\SOFTWARE\Wow6432Node\Google\Chrome\Extensions\ogccgbmabaphcakpiclgcnmcnimhokcj

Key Found : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{83CAD530-387D-40FD-82EA-B9E863D92A9B}

Key Found : HKLM\SOFTWARE\Classes\Interface\{FFB96CC1-7EB3-449D-B827-DB661701C6BB}

Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ZoneAlarm LTD Toolbar

Value Found : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{EEE6C35B-6118-11DC-9C72-001320C79847}]

***** [internet Browsers] *****

-\\ Internet Explorer v10.0.9200.16576

[OK] Registry is clean.

-\\ Google Chrome v27.0.1453.94

File : C:\Users\Donna\AppData\Local\Google\Chrome\User Data\Default\Preferences

Found [l.3262] : urls_to_restore_on_startup = [ "hxxps://fclaweb.fcla.edu/", "hxxp://search.conduit.com/?ctid=CT3287822&SearchSource=48&CUI=UN32803421331684431&UM=2" ]

*************************

AdwCleaner[R1].txt - [2845 octets] - [25/05/2013 20:01:07]

########## EOF - C:\AdwCleaner[R1].txt - [2905 octets] ##########

Junkware Removal Tool (JRT) by Thisisu

Version: 4.9.4 (05.06.2013:1)

OS: Windows 7 Professional x64

Ran by Donna on Sat 05/25/2013 at 19:48:52.97

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

~~~ Services

~~~ Registry Values

Successfully repaired: [Registry Value] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\\Start Page

Successfully repaired: [Registry Value] HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\Main\\Start Page

Successfully repaired: [Registry Value] HKEY_USERS\S-1-5-18\Software\Microsoft\Internet Explorer\Main\\Start Page

Successfully repaired: [Registry Value] HKEY_USERS\S-1-5-19\Software\Microsoft\Internet Explorer\Main\\Start Page

Successfully repaired: [Registry Value] HKEY_USERS\S-1-5-20\Software\Microsoft\Internet Explorer\Main\\Start Page

Successfully repaired: [Registry Value] HKEY_USERS\S-1-5-21-3759848468-541695144-1953164835-1000\Software\Microsoft\Internet Explorer\Main\\Start Page

~~~ Registry Keys

Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\escort.escortiepane

Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\escort.escortiepane.1

Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\conduit

Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\conduit

Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\sweetim

Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\sweetim

Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\AppDataLow\Software\conduitsearchscopes

Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\AppDataLow\Software\smartbar

Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Classes\appid\escort.dll

Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Classes\appid\escortapp.dll

Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Classes\appid\escorteng.dll

Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Classes\appid\escortlbr.dll

Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Classes\appid\esrv.exe

Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Classes\scripthost.tool

Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Classes\scripthost.tool.1

Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\classes\Toolbar.CT3287822

Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{B5F55283-0BE1-4A44-9C68-AFEF9B24C8DD}

Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{D1E467CD-9079-4406-BDB5-9B3C71F22A6A}

Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{EEE6C360-6118-11DC-9C72-001320C79847}

Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\SearchScopes\{EEE6C360-6118-11DC-9C72-001320C79847}

~~~ Files

Successfully deleted: [File] "C:\end"

~~~ Folders

Successfully deleted: [Folder] "C:\Users\Donna\appdata\local\conduit"

Successfully deleted: [Folder] "C:\Users\Donna\appdata\locallow\conduit"

Successfully deleted: [Folder] "C:\Program Files (x86)\conduit"

Successfully deleted: [Folder] "C:\Program Files (x86)\sweetim"

~~~ Event Viewer Logs were cleared

ghostofunder · May 26, 2013

Seems to be gone from IE but still shows up when I open Chrome.

gringo_pr · May 26, 2013

Hello ghostofunder

I Would like you to do the following.

Please print out or make a copy in notepad of any instructions given, as sometimes it is necessary to go offline and you will lose access to them.

Run Combofix:

You may be asked to install or update the Recovery Console (Win XP Only) if this happens please allow it to do so (you will need to be connected to the internet for this)

Before you run Combofix I will need you to turn off any security software you have running, If you do not know how to do this you can find out >here< or >here<

Combofix may need to reboot your computer more than once to do its job this is normal.

You can download Combofix from one of these links. I want you to save it to the desktop and run it from there.

Link 1
Link 2
Link 3

1. Close any open browsers or any other programs that are open.

2. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

Double click on combofix.exe & follow the prompts.

When finished, it will produce a report for you.

Note 1: Do not mouseclick combofix's window while it's running. That may cause it to stall

Note 2: If you receive an error "Illegal operation attempted on a registry key that has been marked for deletion." Please restart the computer

"information and logs"

In your next post I need the following
Log from Combofix
let me know of any problems you may have had
How is the computer doing now?

Gringo

ghostofunder · May 26, 2013

I ran Combofix but am now having severe problems. I was unable to save the log file on the infected laptop. When I tried to open the instructions I saved in notepad, when I try to launch Chrome and when I tried to open the Snipping too I get the the error "Illegal operation attempted on a registry key that it marked for deletion". Obviously I'm posting this from a different machine.

ghostofunder · May 26, 2013

Uh Oh! When I was unable to save the log file on the infected laptop I tried saving it to my Dropbox. I opened Dropbox on the laptop I'm currently using and mix.dj is now on this machine too.

gringo_pr · May 26, 2013

Please read my instruction paying attention to note2 - restart the computer and send me the report - we will clean up this other computer when we are done with this one

ghostofunder · May 26, 2013

In other words, go through the same process, right? Stating with running AdwCleaner?

gringo_pr · May 26, 2013

No read post 5 in those instruction show how to run combofix and I give a special note to pay attention that if you get the error that you had gotten that the only thing that needs to be done is restart the computer

that is what I want you to do now - restart the computer and send me the report - all future reference please read all the instructions

gringo

ghostofunder · May 26, 2013

Ignore previous post. I reread you message incorrectly. The max.dj search table is still present. Here is the log:

ComboFix 13-05-25.02 - Donna 05/26/2013 8:00.1.4 - x64

Microsoft Windows 7 Professional 6.1.7601.1.1252.1.1033.18.3969.2604 [GMT -4:00]

Running from: c:\users\Donna\Desktop\ComboFix.exe

AV: AVG AntiVirus Free Edition 2013 *Disabled/Updated* {0E9420C4-06B3-7FA0-3AB1-6E49CB52ECD9}

FW: ZoneAlarm Free Firewall Firewall *Disabled* {E6380B7E-D4B2-19F1-083E-56486607704B}

SP: AVG AntiVirus Free Edition 2013 *Disabled/Updated* {B5F5C120-2089-702E-0001-553BB0D5A664}

SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\windows\security\Database\tmp.edb

.

((((((((((((((((((((((((( Files Created from 2013-04-26 to 2013-05-26 )))))))))))))))))))))))))))))))

.

2013-05-26 12:07 . 2013-05-26 12:07 -------- d-----w- c:\users\Default\AppData\Local\temp

2013-05-26 02:13 . 2013-05-26 02:13 -------- d-----w- c:\program files (x86)\Common Files\Java

2013-05-26 02:13 . 2013-05-26 02:13 95648 ----a-w- c:\windows\SysWow64\WindowsAccessBridge-32.dll

2013-05-26 02:13 . 2013-05-26 02:13 -------- d-----w- c:\program files (x86)\Java

2013-05-26 01:57 . 2013-05-26 01:58 -------- d-----w- c:\programdata\Cisco

2013-05-26 01:50 . 2013-05-26 02:13 788896 ----a-w- c:\windows\SysWow64\deployJava1.dll

2013-05-26 01:50 . 2013-05-26 02:13 866720 ----a-w- c:\windows\SysWow64\npDeployJava1.dll

2013-05-26 01:50 . 2013-05-26 01:50 -------- d-----w- c:\programdata\McAfee

2013-05-26 00:48 . 2013-05-26 00:48 -------- d-----w- c:\windows\ERUNT

2013-05-26 00:48 . 2013-05-26 00:48 -------- d-----w- C:\JRT

2013-05-25 14:44 . 2013-05-25 14:56 -------- d-----w- c:\programdata\Malwarebytes' Anti-Malware (portable)

2013-05-25 14:06 . 2013-05-25 14:06 -------- d-----w- c:\program files (x86)\InCode Solutions

2013-05-25 13:49 . 2013-05-25 13:49 -------- d-----w- c:\program files (x86)\7-Zip

2013-05-25 10:11 . 2013-05-25 10:11 -------- d-----w- c:\program files (x86)\MSXML 4.0

2013-05-25 10:10 . 2013-05-03 21:15 75016696 ----a-w- c:\windows\system32\MRT.exe

2013-05-25 08:58 . 2013-05-25 08:58 -------- d-----w- c:\windows\SysWow64\Wat

2013-05-25 08:58 . 2013-05-25 08:58 -------- d-----w- c:\windows\system32\Wat

2013-05-25 08:23 . 2013-05-25 08:23 9728 ---ha-w- c:\windows\SysWow64\api-ms-win-downlevel-shlwapi-l1-1-0.dll

2013-05-25 08:22 . 2013-05-25 08:22 363008 ----a-w- c:\windows\system32\dxgi.dll

2013-05-25 04:26 . 2013-05-25 04:26 -------- d-----w- c:\program files (x86)\Malwarebytes' Anti-Malware

2013-05-25 04:26 . 2013-05-25 04:26 -------- d-----w- c:\programdata\Malwarebytes

2013-05-25 04:26 . 2013-04-04 19:50 25928 ----a-w- c:\windows\system32\drivers\mbam.sys

2013-05-25 00:28 . 2013-05-25 00:28 -------- d-----w- c:\program files\Microsoft Games

2013-05-24 18:57 . 2013-05-24 18:57 -------- d-----w- c:\windows\system32\appmgmt

2013-05-24 02:58 . 2013-05-24 02:58 -------- d-----w- c:\program files (x86)\KeePass Password Safe 2

2013-05-24 01:04 . 2013-05-24 01:04 -------- d-----w- c:\program files (x86)\Mozilla Maintenance Service

2013-05-24 01:04 . 2013-05-24 01:04 -------- d-----w- c:\program files (x86)\Mozilla Thunderbird

2013-05-24 00:38 . 2013-05-24 00:38 -------- d-----w- c:\program files\CheckPoint

2013-05-24 00:38 . 2013-05-24 00:38 -------- d-----w- c:\program files (x86)\Check Point Software Technologies LTD

2013-05-24 00:37 . 2013-05-24 00:38 -------- d-----w- c:\program files (x86)\CheckPoint

2013-05-24 00:36 . 2013-05-24 00:36 -------- d-----w- c:\programdata\CheckPoint

2013-05-24 00:05 . 2013-05-24 00:05 -------- d-----w- c:\programdata\AVG2013

2013-05-24 00:05 . 2013-05-24 00:05 -------- d-----w- C:\$AVG

2013-05-24 00:05 . 2013-05-24 00:05 -------- d-----w- c:\program files (x86)\AVG

2013-05-24 00:02 . 2013-05-25 22:47 -------- d-----w- c:\programdata\MFAData

2013-05-24 00:02 . 2013-05-24 00:02 -------- d--h--w- c:\programdata\Common Files

2013-05-23 23:51 . 2013-05-23 23:51 -------- d-----w- c:\program files (x86)\VS Revo Group

2013-05-23 23:48 . 2013-05-23 23:48 -------- d-----w- c:\program files (x86)\Dell Digital Delivery

2013-05-23 23:41 . 2013-05-23 23:42 -------- d-----w- c:\program files (x86)\Google

2013-05-23 23:31 . 2012-02-17 04:57 23552 ----a-w- c:\windows\system32\drivers\tdtcp.sys

2013-05-23 23:28 . 2013-05-23 23:28 0 ----a-w- c:\windows\invcol.tmp

2013-05-23 23:26 . 2012-06-02 22:19 2428952 ----a-w- c:\windows\system32\wuaueng.dll

2013-05-23 23:26 . 2012-06-02 22:19 57880 ----a-w- c:\windows\system32\wuauclt.exe

2013-05-23 23:26 . 2012-06-02 22:19 44056 ----a-w- c:\windows\system32\wups2.dll

2013-05-23 23:26 . 2012-06-02 22:15 2622464 ----a-w- c:\windows\system32\wucltux.dll

2013-05-23 23:26 . 2012-06-02 22:19 38424 ----a-w- c:\windows\system32\wups.dll

2013-05-23 23:26 . 2012-06-02 22:19 701976 ----a-w- c:\windows\system32\wuapi.dll

2013-05-23 23:26 . 2012-06-02 22:15 99840 ----a-w- c:\windows\system32\wudriver.dll

2013-05-23 23:26 . 2012-06-02 20:19 186752 ----a-w- c:\windows\system32\wuwebv.dll

2013-05-23 23:26 . 2012-06-02 20:15 36864 ----a-w- c:\windows\system32\wuapp.exe

2013-05-23 23:25 . 2013-05-24 02:36 -------- d-----w- c:\users\Donna

2013-05-06 05:51 . 2012-09-20 16:56 6102016 ----a-w- c:\windows\system32\stlang64.dll

2013-05-06 05:51 . 2012-09-20 16:56 1821184 ----a-w- c:\windows\system32\IDTNC64.cpl

2013-05-06 05:51 . 2013-05-06 05:51 -------- d-----w- c:\program files\IDT

2013-05-06 05:51 . 2013-05-23 23:32 -------- d-----w- c:\program files (x86)\Intel

2013-05-06 05:51 . 2013-05-23 23:30 -------- d-----w- C:\Intel

2013-05-06 05:51 . 2013-05-06 05:51 -------- d-----w- c:\program files\DIFX

2013-05-06 05:51 . 2013-05-06 04:28 -------- dc----w- c:\windows\system32\DRVSTORE

2013-05-06 05:51 . 2011-07-16 04:31 22128 ----a-w- c:\windows\system32\drivers\stdcfltn.sys

2013-05-06 05:50 . 2013-05-06 05:50 -------- d-----w- c:\windows\devcon

2013-05-06 05:46 . 2013-05-06 05:46 -------- d-----w- c:\program files\STMicroelectronics

2013-05-06 05:43 . 2013-05-06 05:43 360832 ----a-w- c:\windows\system32\drivers\vpcvmm.sys

2013-05-06 05:42 . 2013-05-06 05:42 503808 ----a-w- c:\windows\system32\srcore.dll

2013-05-06 05:34 . 2013-02-22 19:48 9007616 ----a-w- c:\windows\system32\igfxress.dll

2013-05-06 05:33 . 2012-05-15 23:31 440592 ----a-w- c:\windows\system32\drivers\b57nd60a.sys

2013-05-06 05:32 . 2011-10-27 07:44 4746304 ----a-w- c:\windows\system32\drivers\BCMWL664.SYS

2013-05-06 05:32 . 2011-10-27 07:44 95544 ----a-w- c:\windows\system32\bcmwlcoi.dll

2013-05-06 05:32 . 2011-10-27 07:38 3952640 ----a-w- c:\windows\system32\bcmihvsrv64.dll

2013-05-06 05:32 . 2011-10-27 07:38 3617792 ----a-w- c:\windows\system32\bcmihvui64.dll

2013-05-06 05:32 . 2012-05-21 06:54 68208 ----a-w- c:\windows\system32\drivers\ST_ACCEL.sys

2013-05-06 05:32 . 2012-05-21 06:54 65136 ----a-w- c:\windows\system32\stdcfltnco02.dll

2013-05-06 05:32 . 2012-05-21 06:54 1721576 ----a-w- c:\windows\system32\WdfCoInstaller01009.dll

2013-05-06 05:28 . 2013-05-23 23:35 -------- d-----w- c:\windows\system32\oem

2013-05-06 05:28 . 2013-05-06 05:34 -------- d-----w- C:\Drivers

2013-05-06 04:36 . 2013-05-06 04:36 -------- d-----w- c:\program files (x86)\Common Files\Intel Corporation

2013-05-06 04:30 . 2013-05-24 00:46 -------- d-----w- c:\programdata\Trend Micro

2013-05-06 04:29 . 2013-05-06 04:29 -------- d-----w- c:\windows\{69093D49-3DD1-4FB5-A378-0D4DB4CF86EA}

2013-05-06 04:29 . 2013-05-06 04:29 -------- d-----w- c:\windows\en

2013-05-06 04:29 . 2013-05-06 04:29 -------- d-----w- c:\program files (x86)\Microsoft SQL Server Compact Edition

2013-05-06 04:28 . 2012-09-12 20:20 57856 ----a-w- c:\windows\system32\drivers\fssfltr.sys

2013-05-06 04:28 . 2013-05-06 04:28 -------- d-----w- c:\program files\Windows Live

2013-05-06 04:28 . 2013-05-06 04:28 -------- d-----w- c:\windows\PCHEALTH

2013-05-06 04:28 . 2013-05-06 04:28 -------- d-----w- c:\program files (x86)\Windows Live

2013-05-06 04:27 . 2010-06-02 09:55 77656 ----a-w- c:\windows\system32\XAPOFX1_5.dll

2013-05-06 04:27 . 2010-06-02 09:55 74072 ----a-w- c:\windows\SysWow64\XAPOFX1_5.dll

2013-05-06 04:27 . 2010-06-02 09:55 527192 ----a-w- c:\windows\SysWow64\XAudio2_7.dll

2013-05-06 04:27 . 2010-06-02 09:55 518488 ----a-w- c:\windows\system32\XAudio2_7.dll

2013-05-06 04:27 . 2010-05-26 16:41 276832 ----a-w- c:\windows\system32\d3dx11_43.dll

2013-05-06 04:27 . 2010-05-26 16:41 2526056 ----a-w- c:\windows\system32\D3DCompiler_43.dll

2013-05-06 04:27 . 2010-05-26 16:41 248672 ----a-w- c:\windows\SysWow64\d3dx11_43.dll

2013-05-06 04:27 . 2010-05-26 16:41 2106216 ----a-w- c:\windows\SysWow64\D3DCompiler_43.dll

2013-05-06 04:27 . 2009-09-04 22:29 453456 ----a-w- c:\windows\SysWow64\d3dx10_42.dll

2013-05-06 04:27 . 2009-09-04 22:29 523088 ----a-w- c:\windows\system32\d3dx10_42.dll

2013-05-06 04:27 . 2006-11-29 18:06 4398360 ----a-w- c:\windows\system32\d3dx9_32.dll

2013-05-06 04:27 . 2006-11-29 18:06 3426072 ----a-w- c:\windows\SysWow64\d3dx9_32.dll

2013-05-06 04:25 . 2013-05-06 04:25 -------- d-----w- c:\program files (x86)\Common Files\Windows Live

2013-05-06 04:25 . 2013-05-23 23:30 -------- d-----w- c:\programdata\Dell

2013-05-06 04:25 . 2013-05-06 04:25 -------- d-----w- c:\windows\{7197954C-D1BE-4A17-8E69-52FDC4010A30}

2013-05-06 04:20 . 2012-09-23 08:19 93288 ----a-w- c:\windows\dcmdev64.exe

2013-05-06 04:20 . 2012-09-23 08:19 382056 ----a-w- c:\windows\hapint.exe

2013-05-06 04:20 . 2012-09-23 08:19 335464 ----a-w- c:\windows\dchcfg64.exe

2013-05-06 04:20 . 2012-09-23 08:19 459880 ----a-w- c:\windows\system32\dchbas64.dll

2013-05-06 04:20 . 2012-09-23 08:19 322664 ----a-w- c:\windows\system32\dchapi64.dll

2013-05-06 04:20 . 2013-05-06 04:29 -------- d-----w- c:\program files (x86)\Dell

2013-05-06 04:20 . 2013-05-06 04:20 -------- d-----w- C:\apps

2013-05-06 04:20 . 2013-05-06 04:20 -------- d-----w- c:\programdata\Security Innovation

2013-05-06 04:20 . 2013-05-06 04:20 -------- d-----w- c:\program files (x86)\Security Innovation

2013-05-06 04:19 . 2013-05-06 04:19 -------- d-----w- c:\program files\Fingerprint Sensor

2013-05-06 04:19 . 2013-05-06 04:32 -------- d-----w- c:\program files\Common Files\SPBA

2013-05-06 04:19 . 2013-05-06 04:19 -------- d-----w- c:\program files (x86)\Common Files\SPBA

2013-05-06 04:18 . 2013-05-06 04:18 -------- d-----w- c:\program files (x86)\Gemalto

2013-05-06 04:18 . 2013-05-06 04:18 -------- d-----w- c:\program files (x86)\O2Micro OZ776 SCR Driver

2013-05-06 04:18 . 2013-05-06 04:18 -------- d-----w- c:\windows\Downloaded Installations

2013-05-06 04:18 . 2013-05-06 04:18 40960 ----a-w- c:\windows\SysWow64\ct32O2.dll

2013-05-06 04:18 . 2013-05-06 04:18 40960 ----a-w- c:\windows\system32\ct32O2.dll

2013-05-06 04:18 . 2013-05-06 04:34 -------- d-----w- c:\programdata\Wave Systems Corp

2013-05-06 04:15 . 2011-12-19 14:46 121344 ----a-w- c:\windows\system32\basp.dll

2013-05-06 04:15 . 2013-05-06 04:15 -------- d-----w- c:\program files\Broadcom

2013-05-06 04:15 . 2013-05-06 04:15 -------- d-----w- c:\windows\Dell

2013-05-06 04:14 . 2012-10-16 13:52 41984 ----a-w- c:\windows\system32\drivers\USB3Ver.dll

2013-05-06 04:14 . 2012-10-16 13:53 791608 ----a-w- c:\windows\system32\drivers\iusb3xhc.sys

2013-05-06 04:14 . 2012-10-16 13:53 358456 ----a-w- c:\windows\system32\drivers\iusb3hub.sys

2013-05-06 04:14 . 2012-10-16 13:53 20024 ----a-w- c:\windows\system32\drivers\iusb3hcs.sys

2013-05-06 04:14 . 2012-10-19 21:42 8192 ----a-w- c:\windows\system32\drivers\IntelMEFWVer.dll

2013-05-06 04:14 . 2013-05-23 23:32 -------- d-----w- c:\programdata\Intel

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2013-05-23 23:26 . 2012-07-17 19:37 22240 ----a-w- c:\programdata\Microsoft\IdentityCRL\production\ppcrlconfig600.dll

2013-05-06 05:42 . 2013-05-06 05:42 44032 ----a-w- c:\windows\apppatch\acwow64.dll

2013-05-06 05:42 . 2013-05-06 05:42 561664 ----a-w- c:\windows\apppatch\AcLayers.dll

2013-05-06 05:42 . 2013-05-06 05:42 350208 ----a-w- c:\windows\apppatch\AppPatch64\AcLayers.dll

2013-05-06 05:42 . 2013-05-06 05:42 135168 ----a-w- c:\windows\apppatch\AppPatch64\AcXtrnal.dll

2013-03-29 07:53 . 2013-03-29 07:53 246072 ----a-w- c:\windows\system32\drivers\avgidsdrivera.sys

2013-03-21 08:08 . 2013-03-21 08:08 240952 ----a-w- c:\windows\system32\drivers\avgtdia.sys

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]

@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"

[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]

2013-05-17 14:45 130736 ----a-w- c:\users\Donna\AppData\Roaming\Dropbox\bin\DropboxExt.19.dll

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]

@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"

[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]

2013-05-17 14:45 130736 ----a-w- c:\users\Donna\AppData\Roaming\Dropbox\bin\DropboxExt.19.dll

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]

@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"

[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]

2013-05-17 14:45 130736 ----a-w- c:\users\Donna\AppData\Roaming\Dropbox\bin\DropboxExt.19.dll

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]

"IMSS"="c:\program files (x86)\Intel\Intel® Management Engine Components\IMSS\PIconStartup.exe" [2012-10-23 134176]

"USB3MON"="c:\program files (x86)\Intel\Intel® USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe" [2012-10-16 291648]

"IAStorIcon"="c:\program files (x86)\Intel\Intel® Rapid Storage Technology\IAStorIconLaunch.exe" [2012-06-07 56128]

"AVG_UI"="c:\program files (x86)\AVG\AVG2013\avgui.exe" [2013-04-29 4408368]

"ZoneAlarm"="c:\program files (x86)\CheckPoint\ZoneAlarm\zatray.exe" [2013-03-27 73832]

"KeePass 2 PreLoad"="c:\program files (x86)\KeePass Password Safe 2\KeePass.exe" [2013-04-05 1960448]

"Cisco AnyConnect Secure Mobility Agent for Windows"="c:\program files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnui.exe" [2012-12-10 527864]

"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2013-03-12 253816]

.

c:\users\Donna\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\

Dropbox.lnk - c:\users\Donna\AppData\Roaming\Dropbox\bin\Dropbox.exe [2013-5-17 28711576]

Smart Settings.lnk - c:\program files\Dell\Feature Enhancement Pack\SmartSettings.exe [2012-8-15 507448]

.

c:\users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\

Smart Settings.lnk - c:\program files\Dell\Feature Enhancement Pack\SmartSettings.exe [2012-8-15 507448]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"ConsentPromptBehaviorAdmin"= 5 (0x5)

"ConsentPromptBehaviorUser"= 3 (0x3)

"EnableUIADesktopToggle"= 0 (0x0)

"HideFastUserSwitching"= 1 (0x1)

.

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]

@="Driver"

.

R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]

R2 WvPCR;WvPCR;c:\program files\Dell\Dell Data Protection\Access\Advanced\Wave\Common\WvPCR.exe [2012-11-08 254384]

R3 acsock;acsock;c:\windows\system32\DRIVERS\acsock64.sys [2012-12-10 112080]

R3 dmvsc;dmvsc;c:\windows\system32\drivers\dmvsc.sys [2010-11-21 71168]

R3 ICCS;Intel® Integrated Clock Controller Service - Intel® ICCS;c:\program files (x86)\Intel\Intel® Integrated Clock Controller Service\ICCProxy.exe [2012-04-24 169752]

R3 netvsc;netvsc;c:\windows\system32\DRIVERS\netvsc60.sys [2010-11-21 168448]

R3 O2MDFRDR;O2MDFRDR;c:\windows\system32\drivers\O2MDFw7x64.sys [2011-01-03 72808]

R3 O2MDRRDR;O2MDRRDR;c:\windows\system32\drivers\O2MDRw7x64.sys [2011-01-03 74984]

R3 SynthVid;SynthVid;c:\windows\system32\DRIVERS\VMBusVideoM.sys [2010-11-21 22528]

R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-21 59392]

R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys [2010-11-21 31232]

R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [2013-05-25 1255736]

S0 AVGIDSHA;AVGIDSHA;c:\windows\system32\DRIVERS\avgidsha.sys [2013-02-08 71480]

S0 Avgloga;AVG Logging Driver;c:\windows\system32\DRIVERS\avgloga.sys [2013-02-08 311096]

S0 Avgmfx64;AVG Mini-Filter Resident Anti-Virus Shield;c:\windows\system32\DRIVERS\avgmfx64.sys [2013-02-08 116536]

S0 Avgrkx64;AVG Anti-Rootkit Driver;c:\windows\system32\DRIVERS\avgrkx64.sys [2013-02-08 45880]

S0 iusb3hcs;Intel® USB 3.0 Host Controller Switch Driver;c:\windows\system32\DRIVERS\iusb3hcs.sys [2012-10-16 20024]

S0 stdcfltn;Disk Class Filter Driver for Accelerometer;c:\windows\system32\DRIVERS\stdcfltn.sys [2011-07-16 22128]

S1 AVGIDSDriver;AVGIDSDriver;c:\windows\system32\DRIVERS\avgidsdrivera.sys [2013-03-29 246072]

S1 Avgldx64;AVG AVI Loader Driver;c:\windows\system32\DRIVERS\avgldx64.sys [2013-02-08 206136]

S1 Avgtdia;AVG TDI Driver;c:\windows\system32\DRIVERS\avgtdia.sys [2013-03-21 240952]

S2 AVGIDSAgent;AVGIDSAgent;c:\program files (x86)\AVG\AVG2013\avgidsagent.exe [2013-05-14 4937264]

S2 avgwd;AVG WatchDog;c:\program files (x86)\AVG\AVG2013\avgwdsvc.exe [2013-04-18 283136]

S2 BrcmMgmtAgent;Broadcom Management Agent;c:\program files\Broadcom\MgmtAgent\BrcmMgmtAgent.exe [2011-12-01 163840]

S2 DellDigitalDelivery;Dell Digital Delivery Service;c:\program files (x86)\Dell Digital Delivery\DeliveryService.exe [2013-03-13 187912]

S2 DFEPService;Dell Feature Enhancement Pack Service;c:\program files\Dell\Feature Enhancement Pack\DFEPService.exe [2012-08-15 2280504]

S2 EmbassyService;EmbassyService;c:\program files\Dell\Dell Data Protection\Access\Advanced\Wave\EMBASSY Client Core\EmbassyServer.exe [2012-11-20 225720]

S2 IAStorDataMgrSvc;Intel® Rapid Storage Technology;c:\program files (x86)\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe [2012-05-30 13632]

S2 Intel® Capability Licensing Service Interface;Intel® Capability Licensing Service Interface;c:\program files\Intel\iCLS Client\HeciServer.exe [2012-07-27 636952]

S2 ISWKL;ZoneAlarm LTD Toolbar ISWKL;c:\program files\CheckPoint\ZAForceField\ISWKL.sys [2012-11-22 33712]

S2 IswSvc;ZoneAlarm LTD Toolbar IswSvc;c:\program files\CheckPoint\ZAForceField\IswSvc.exe [2012-11-22 828072]

S2 jhi_service;Intel® Dynamic Application Loader Host Interface Service;c:\program files (x86)\Intel\Intel® Management Engine Components\DAL\jhi_service.exe [2012-10-23 166432]

S2 PbaDrvSvc_x64;Dell PBA x64 Service;c:\program files\Dell\Dell Data Protection\Access\Advanced\hapi64\pbadrvsvc.exe [2012-11-23 20480]

S2 UNS;Intel® Management and Security Application User Notification Service;c:\program files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe [2012-10-23 365600]

S2 vpnagent;Cisco AnyConnect Secure Mobility Agent;c:\program files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnagent.exe [2012-12-10 479224]

S2 Wave Authentication Manager Service;Wave Authentication Manager Service;c:\program files\Dell\Dell Data Protection\Access\Advanced\Wave\Authentication Manager\WaveAMService.exe [2012-11-19 1758720]

S3 dcdbas;System Management Driver;c:\windows\system32\DRIVERS\dcdbas64.sys [2012-09-23 39016]

S3 IntcDAud;Intel® Display Audio;c:\windows\system32\DRIVERS\IntcDAud.sys [2013-02-27 342528]

S3 iusb3hub;Intel® USB 3.0 Hub Driver;c:\windows\system32\DRIVERS\iusb3hub.sys [2012-10-16 358456]

S3 iusb3xhc;Intel® USB 3.0 eXtensible Host Controller Driver;c:\windows\system32\DRIVERS\iusb3xhc.sys [2012-10-16 791608]

S3 O2SDJRDR;O2SDJRDR;c:\windows\system32\DRIVERS\o2sdjw7x64.sys [2011-11-14 84712]

S3 ST_ACCEL;STMicroelectronics Accelerometer Service;c:\windows\system32\DRIVERS\ST_ACCEL.sys [2012-05-21 68208]

.

--- Other Services/Drivers In Memory ---

.

*NewlyCreated* - WS2IFSL

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]

2013-05-23 23:42 1165776 ----a-w- c:\program files (x86)\Google\Chrome\Application\27.0.1453.94\Installer\chrmstp.exe

.

Contents of the 'Scheduled Tasks' folder

.

2013-05-26 c:\windows\Tasks\Adobe Flash Player Updater.job

- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2013-05-06 03:56]

.

2013-05-26 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job

- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2013-05-23 23:41]

.

2013-05-26 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job

- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2013-05-23 23:41]

.

--------- X64 Entries -----------

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]

@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"

[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]

2013-05-17 14:45 164016 ----a-w- c:\users\Donna\AppData\Roaming\Dropbox\bin\DropboxExt64.19.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]

@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"

[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]

2013-05-17 14:45 164016 ----a-w- c:\users\Donna\AppData\Roaming\Dropbox\bin\DropboxExt64.19.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]

@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"

[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]

2013-05-17 14:45 164016 ----a-w- c:\users\Donna\AppData\Roaming\Dropbox\bin\DropboxExt64.19.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt4]

@="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}"

[HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}]

2013-05-17 14:45 164016 ----a-w- c:\users\Donna\AppData\Roaming\Dropbox\bin\DropboxExt64.19.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\EnabledUnlockedFDEIconOverlay]

@="{30D3C2AF-9709-4D05-9CF4-13335F3C1E4A}"

[HKEY_CLASSES_ROOT\CLSID\{30D3C2AF-9709-4D05-9CF4-13335F3C1E4A}]

2012-11-09 04:39 135584 ----a-w- c:\program files\Dell\Dell Data Protection\Access\Advanced\Wave\Trusted Drive Manager\TdmIconOverlay.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\UninitializedFdeIconOverlay]

@="{CF08DA3E-C97D-4891-A66B-E39B28DD270F}"

[HKEY_CLASSES_ROOT\CLSID\{CF08DA3E-C97D-4891-A66B-E39B28DD270F}]

2012-11-09 04:39 135584 ----a-w- c:\program files\Dell\Dell Data Protection\Access\Advanced\Wave\Trusted Drive Manager\TdmIconOverlay.dll

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Apoint"="c:\program files\DellTPad\Apoint.exe" [2012-12-21 684016]

"SysTrayApp"="c:\program files\IDT\WDM\sttray64.exe" [2012-09-20 1664000]

"Broadcom Wireless Manager UI"="c:\program files\Dell\DW WLAN Card\WLTRAY.exe" [2012-01-18 7469568]

"TdmNotify"="c:\program files\Dell\Dell Data Protection\Access\Advanced\Wave\Trusted Drive Manager\TdmNotify.exe" [2012-11-09 370584]

"DFEPApplication"="c:\program files\Dell\Feature Enhancement Pack\DFEPApplication.exe" [2012-08-15 7077432]

"IgfxTray"="c:\windows\system32\igfxtray.exe" [2013-03-14 172016]

"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2013-03-14 399856]

"Persistence"="c:\windows\system32\igfxpers.exe" [2013-03-14 442352]

"ISW"="c:\program files\CheckPoint\ZAForceField\ForceField.exe" [2012-11-22 1127592]

.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - LocalService

FontCache

.

------- Supplementary Scan -------

.

uLocal Page = c:\windows\system32\blank.htm

uStart Page = hxxp://www.google.com

mLocal Page = c:\windows\SysWOW64\blank.htm

TCP: DhcpNameServer = 68.105.28.11 68.105.29.11 68.105.28.12

.

- - - - ORPHANS REMOVED - - - -

.

Toolbar-Locked - (no file)

HKLM_Wow6432Node-ActiveSetup-{2D46B6DC-2207-486B-B523-A557E6D54B47} - start

Toolbar-Locked - (no file)

.

--------------------- LOCKED REGISTRY KEYS ---------------------

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]

@Denied: (A 2) (Everyone)

@="FlashBroker"

"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_6_602_168_ActiveX.exe,-101"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]

"Enabled"=dword:00000001

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]

@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_6_602_168_ActiveX.exe"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]

@Denied: (A 2) (Everyone)

@="IFlashBroker5"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]

@="{00020424-0000-0000-C000-000000000046}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

"Version"="1.0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]

@Denied: (A 2) (Everyone)

@="FlashBroker"

"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_6_602_168_ActiveX.exe,-101"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]

"Enabled"=dword:00000001

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_6_602_168_ActiveX.exe"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]

@Denied: (A 2) (Everyone)

@="Shockwave Flash Object"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_6_602_168.ocx"

"ThreadingModel"="Apartment"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]

@="0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]

@="ShockwaveFlash.ShockwaveFlash.11"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_6_602_168.ocx, 1"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]

@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]

@="1.0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]

@="ShockwaveFlash.ShockwaveFlash"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]

@Denied: (A 2) (Everyone)

@="Macromedia Flash Factory Object"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_6_602_168.ocx"

"ThreadingModel"="Apartment"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]

@="FlashFactory.FlashFactory.1"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_6_602_168.ocx, 1"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]

@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]

@="1.0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]

@="FlashFactory.FlashFactory"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]

@Denied: (A 2) (Everyone)

@="IFlashBroker5"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]

@="{00020424-0000-0000-C000-000000000046}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

"Version"="1.0"

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]

@Denied: (Full) (Everyone)

.

------------------------ Other Running Processes ------------------------

.

c:\windows\system32\o2flash.exe

c:\program files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe

.

**************************************************************************

.

Completion time: 2013-05-26 08:14:45 - machine was rebooted

ComboFix-quarantined-files.txt 2013-05-26 12:14

.

Pre-Run: 276,590,518,272 bytes free

Post-Run: 276,370,096,128 bytes free

.

- - End Of File - - B2AE24D79DC77995A0CFDD29C6C390F6

gringo_pr · May 26, 2013

Hello ghostofunder

Lets get a deeper look into the system and lets see if something shows up.

Download and run OTL

Download OTL by Old Timer and save it to your Desktop.

Double click on OTL.exe to run it.
Under Output, ensure that Minimal Output is selected.
Under Extra Registry section, select Use SafeList.
Click the Scan All Users checkbox.
Click on Run Scan at the top left hand corner.
When done, two Notepad files will open.
- OTL.txt <-- Will be opened and the that I need posted back here
- Extra.txt <-- Will be minimized - save this one on your desktop in case I ask for it later
[*]Please post the contents of OTL.txt in your next reply.

Gringo

ghostofunder · May 26, 2013

Having to divide into multiple posts. Part 1

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)

Drive C: | 297.32 Gb Total Space | 257.47 Gb Free Space | 86.60% Space Free | Partition Type: NTFS

Computer Name: DONNA-NEW | User Name: Donna | Logged in as Administrator.

Boot Mode: Normal | Scan Mode: All users | Include 64bit Scans

Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - File not found

PRC - C:\Users\Donna\Desktop\OTL.exe (OldTimer Tools)

PRC - C:\Users\Donna\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)

PRC - C:\Program Files (x86)\AVG\AVG2013\avgidsagent.exe (AVG Technologies CZ, s.r.o.)

PRC - C:\Program Files (x86)\AVG\AVG2013\avgui.exe (AVG Technologies CZ, s.r.o.)

PRC - C:\Program Files (x86)\AVG\AVG2013\avgwdsvc.exe (AVG Technologies CZ, s.r.o.)

PRC - C:\Program Files (x86)\CheckPoint\ZoneAlarm\vsmon.exe (Check Point Software Technologies LTD)

PRC - C:\Program Files (x86)\CheckPoint\ZoneAlarm\zatray.exe (Check Point Software Technologies LTD)

PRC - C:\Program Files (x86)\Dell Digital Delivery\DeliveryService.exe (Dell Products, LP.)

PRC - C:\Program Files (x86)\AVG\AVG2013\avgcfgex.exe (AVG Technologies CZ, s.r.o.)

PRC - C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnui.exe (Cisco Systems, Inc.)

PRC - C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnagent.exe (Cisco Systems, Inc.)

PRC - C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe (Intel Corporation)

PRC - C:\Program Files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe (Intel Corporation)

PRC - C:\Program Files (x86)\Intel\Intel® Management Engine Components\DAL\Jhi_service.exe (Intel Corporation)

PRC - C:\Program Files (x86)\Intel\Intel® USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe (Intel Corporation)

PRC - C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe (Intel Corporation)

PRC - C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe (Intel Corporation)

PRC - C:\Program Files (x86)\Intel\Intel® Integrated Clock Controller Service\ICCProxy.exe (Intel Corporation)

========== Modules (No Company Name) ==========

MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\IAStorUtil\c484ce0997e68573a00dc6cddf16e2ac\IAStorUtil.ni.dll ()

MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\IAStorCommon\a9f8b35698a9a28f22861f7b814b79bc\IAStorCommon.ni.dll ()

MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Web\5ecf01964c70e453d71e5d7653912ff9\System.Web.ni.dll ()

MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Runtime.Remo#\90b89f6e8032310e9ac72a309fd49e83\System.Runtime.Remoting.ni.dll ()

MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\30e3a21202000677d0a9270572251477\System.Windows.Forms.ni.dll ()

MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\eead6629e384a5b69f9ae35284b7eeed\System.Drawing.ni.dll ()

MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\WindowsBase\716959df79685a1eae0fc14275a32b0f\WindowsBase.ni.dll ()

MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Xml\f687c43e9fdec031988b33ae722c4613\System.Xml.ni.dll ()

MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Configuration\764f15e86c82662e977bd418bd6318c1\System.Configuration.ni.dll ()

MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System\369f8bdca364e2b4936d18dea582912c\System.ni.dll ()

MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\7150b9136fad5b79e88f6c7f9d3d2c39\mscorlib.ni.dll ()

MOD - C:\Users\Donna\AppData\Roaming\Dropbox\bin\libcef.dll ()

MOD - C:\Users\Donna\AppData\Roaming\Dropbox\bin\wxmsw28uh_vc.dll ()

========== Services (SafeList) ==========

SRV:64bit: - (PbaDrvSvc_x64) -- C:\Program Files\Dell\Dell Data Protection\Access\Advanced\hapi64\pbadrvsvc.exe ()

SRV:64bit: - (IswSvc) -- C:\Program Files\CheckPoint\ZAForceField\ISWSVC.exe (Check Point Software Technologies)

SRV:64bit: - (EmbassyService) -- C:\Program Files\Dell\Dell Data Protection\Access\Advanced\Wave\EMBASSY Client Core\EmbassyServer.exe ()

SRV:64bit: - (Wave Authentication Manager Service) -- C:\Program Files\Dell\Dell Data Protection\Access\Advanced\Wave\Authentication Manager\WaveAMService.exe (Wave Systems Corp.)

SRV:64bit: - (TdmService) -- C:\Program Files\Dell\Dell Data Protection\Access\Advanced\Wave\Trusted Drive Manager\TdmService.exe (Wave Systems Corp.)

SRV:64bit: - (WvPCR) -- C:\Program Files\Dell\Dell Data Protection\Access\Advanced\Wave\Common\WvPCR.exe (Wave Systems Corp.)

SRV:64bit: - (STacSV) -- C:\Program Files\IDT\WDM\stacsv64.exe (IDT, Inc.)

SRV:64bit: - (SecureStorageService) -- C:\Program Files\Dell\Dell Data Protection\Access\Advanced\Wave\Secure Storage Manager\SecureStorageService.exe (Wave Systems Corp.)

SRV:64bit: - (DFEPService) -- C:\Program Files\Dell\Feature Enhancement Pack\DFEPService.exe (Dell Inc.)

SRV:64bit: - (Intel® -- C:\Program Files\Intel\iCLS Client\HeciServer.exe (Intel® Corporation)

SRV:64bit: - (wltrysvc) -- C:\Program Files\Dell\DW WLAN Card\WLTRYSVC.EXE (Dell Inc.)

SRV:64bit: - (BrcmMgmtAgent) -- C:\Program Files\Broadcom\MgmtAgent\BrcmMgmtAgent.exe (Broadcom Corporation)

SRV:64bit: - (O2FLASH) -- C:\Windows\SysNative\o2flash.exe (O2Micro International)

SRV:64bit: - (WinDefend) -- C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)

SRV:64bit: - (AppMgmt) -- C:\Windows\SysNative\appmgmts.dll (Microsoft Corporation)

SRV - (AVGIDSAgent) -- C:\Program Files (x86)\AVG\AVG2013\avgidsagent.exe (AVG Technologies CZ, s.r.o.)

SRV - (MozillaMaintenance) -- C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe (Mozilla Foundation)

SRV - (AdobeFlashPlayerUpdateSvc) -- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe (Adobe Systems Incorporated)

SRV - (avgwd) -- C:\Program Files (x86)\AVG\AVG2013\avgwdsvc.exe (AVG Technologies CZ, s.r.o.)

SRV - (vsmon) -- C:\Program Files (x86)\CheckPoint\ZoneAlarm\vsmon.exe (Check Point Software Technologies LTD)

SRV - (cphs) -- C:\Windows\SysWOW64\IntelCpHeciSvc.exe (Intel Corporation)

SRV - (DellDigitalDelivery) -- C:\Program Files (x86)\Dell Digital Delivery\DeliveryService.exe (Dell Products, LP.)

SRV - (vpnagent) -- C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnagent.exe (Cisco Systems, Inc.)

SRV - (UNS) -- C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe (Intel Corporation)

SRV - (LMS) -- C:\Program Files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe (Intel Corporation)

SRV - (jhi_service) -- C:\Program Files (x86)\Intel\Intel® Management Engine Components\DAL\Jhi_service.exe (Intel Corporation)

SRV - (IAStorDataMgrSvc) -- C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe (Intel Corporation)

SRV - (tcsd_win32.exe) -- C:\Program Files (x86)\Security Innovation\SI TSS\bin\tcsd_win32.exe ()

SRV - (ICCS) -- C:\Program Files (x86)\Intel\Intel® Integrated Clock Controller Service\ICCProxy.exe (Intel Corporation)

SRV - (clr_optimization_v4.0.30319_32) -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (Microsoft Corporation)

SRV - (clr_optimization_v2.0.50727_32) -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (Microsoft Corporation)

========== Driver Services (SafeList) ==========

DRV:64bit: - (vpcvmm) -- C:\Windows\SysNative\drivers\vpcvmm.sys (Microsoft Corporation)

DRV:64bit: - (vpcnfltr) -- C:\Windows\SysNative\drivers\vpcnfltr.sys (Microsoft Corporation)

DRV:64bit: - (vpcbus) -- C:\Windows\SysNative\drivers\vpchbus.sys (Microsoft Corporation)

DRV:64bit: - (vpcusb) -- C:\Windows\SysNative\drivers\vpcusb.sys (Microsoft Corporation)

DRV:64bit: - (Fs_Rec) -- C:\Windows\SysNative\drivers\fs_rec.sys (Microsoft Corporation)

DRV:64bit: - (amdsata) -- C:\Windows\SysNative\drivers\amdsata.sys (Advanced Micro Devices)

DRV:64bit: - (amdxata) -- C:\Windows\SysNative\drivers\amdxata.sys (Advanced Micro Devices)

DRV:64bit: - (AVGIDSDriver) -- C:\Windows\SysNative\drivers\avgidsdrivera.sys (AVG Technologies CZ, s.r.o.)

DRV:64bit: - (Avgtdia) -- C:\Windows\SysNative\drivers\avgtdia.sys (AVG Technologies CZ, s.r.o.)

DRV:64bit: - (IntcDAud) -- C:\Windows\SysNative\drivers\IntcDAud.sys (Intel® Corporation)

DRV:64bit: - (igfx) -- C:\Windows\SysNative\drivers\igdkmd64.sys (Intel Corporation)

DRV:64bit: - (Avgmfx64) -- C:\Windows\SysNative\drivers\avgmfx64.sys (AVG Technologies CZ, s.r.o.)

DRV:64bit: - (Avgloga) -- C:\Windows\SysNative\drivers\avgloga.sys (AVG Technologies CZ, s.r.o.)

DRV:64bit: - (AVGIDSHA) -- C:\Windows\SysNative\drivers\avgidsha.sys (AVG Technologies CZ, s.r.o.)

DRV:64bit: - (Avgldx64) -- C:\Windows\SysNative\drivers\avgldx64.sys (AVG Technologies CZ, s.r.o.)

DRV:64bit: - (Avgrkx64) -- C:\Windows\SysNative\drivers\avgrkx64.sys (AVG Technologies CZ, s.r.o.)

DRV:64bit: - (ApfiltrService) -- C:\Windows\SysNative\drivers\Apfiltr.sys (Alps Electric Co., Ltd.)

DRV:64bit: - (Vsdatant) -- C:\Windows\SysNative\drivers\vsdatant.sys (Check Point Software Technologies LTD)

DRV:64bit: - (vpnva) -- C:\Windows\SysNative\drivers\vpnva64.sys (Cisco Systems, Inc.)

DRV:64bit: - (acsock) -- C:\Windows\SysNative\drivers\acsock64.sys (Cisco Systems, Inc.)

DRV:64bit: - (ISWKL) -- C:\Program Files\CheckPoint\ZAForceField\ISWKL.sys (Check Point Software Technologies)

DRV:64bit: - (iusb3xhc) -- C:\Windows\SysNative\drivers\iusb3xhc.sys (Intel Corporation)

DRV:64bit: - (iusb3hub) -- C:\Windows\SysNative\drivers\iusb3hub.sys (Intel Corporation)

DRV:64bit: - (iusb3hcs) -- C:\Windows\SysNative\drivers\iusb3hcs.sys (Intel Corporation)

DRV:64bit: - (dcdbas) -- C:\Windows\SysNative\drivers\dcdbas64.sys (Dell Inc.)

DRV:64bit: - (STHDA) -- C:\Windows\SysNative\drivers\stwrt64.sys (IDT, Inc.)

DRV:64bit: - (fssfltr) -- C:\Windows\SysNative\drivers\fssfltr.sys (Microsoft Corporation)

DRV:64bit: - (MEIx64) -- C:\Windows\SysNative\drivers\HECIx64.sys (Intel Corporation)

DRV:64bit: - (iaStor) -- C:\Windows\SysNative\drivers\iaStor.sys (Intel Corporation)

DRV:64bit: - (ST_ACCEL) -- C:\Windows\SysNative\drivers\ST_ACCEL.sys (STMicroelectronics)

DRV:64bit: - (b57nd60a) -- C:\Windows\SysNative\drivers\b57nd60a.sys (Broadcom Corporation)

DRV:64bit: - (BCM42RLY) -- C:\Windows\SysNative\drivers\bcm42rly.sys (Broadcom Corporation)

DRV:64bit: - (Blfp) -- C:\Windows\SysNative\drivers\basp.sys (Broadcom Corporation)

DRV:64bit: - (O2SDJRDR) -- C:\Windows\SysNative\drivers\o2sdjw7x64.sys (O2Micro )

DRV:64bit: - (BCM43XX) -- C:\Windows\SysNative\drivers\BCMWL664.SYS (Broadcom Corporation)

DRV:64bit: - (stdcfltn) -- C:\Windows\SysNative\drivers\stdcfltn.sys (ST Microelectronics)

DRV:64bit: - (O2MDRRDR) -- C:\Windows\SysNative\drivers\O2MDRw7x64.sys (O2Micro )

DRV:64bit: - (O2MDFRDR) -- C:\Windows\SysNative\drivers\o2mdfw7x64.sys (O2Micro )

DRV:64bit: - (TsUsbFlt) -- C:\Windows\SysNative\drivers\TsUsbFlt.sys (Microsoft Corporation)

DRV:64bit: - (netvsc) -- C:\Windows\SysNative\drivers\netvsc60.sys (Microsoft Corporation)

DRV:64bit: - (dmvsc) -- C:\Windows\SysNative\drivers\dmvsc.sys (Microsoft Corporation)

DRV:64bit: - (SynthVid) -- C:\Windows\SysNative\drivers\VMBusVideoM.sys (Microsoft Corporation)

DRV:64bit: - (HpSAMD) -- C:\Windows\SysNative\drivers\HpSAMD.sys (Hewlett-Packard Company)

DRV:64bit: - (TsUsbGD) -- C:\Windows\SysNative\drivers\TsUsbGD.sys (Microsoft Corporation)

DRV:64bit: - (amdsbs) -- C:\Windows\SysNative\drivers\amdsbs.sys (AMD Technologies Inc.)

DRV:64bit: - (LSI_SAS2) -- C:\Windows\SysNative\drivers\lsi_sas2.sys (LSI Corporation)

DRV:64bit: - (stexstor) -- C:\Windows\SysNative\drivers\stexstor.sys (Promise Technology)

DRV:64bit: - (ebdrv) -- C:\Windows\SysNative\drivers\evbda.sys (Broadcom Corporation)

DRV:64bit: - (b06bdrv) -- C:\Windows\SysNative\drivers\bxvbda.sys (Broadcom Corporation)

DRV:64bit: - (hcw85cir) -- C:\Windows\SysNative\drivers\hcw85cir.sys (Hauppauge Computer Works, Inc.)

DRV - (WIMMount) -- C:\Windows\SysWOW64\drivers\wimmount.sys (Microsoft Corporation)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {891954C5-D884-4A78-B046-2D224A4E82CE}

IE:64bit: - HKLM\..\SearchScopes\{891954C5-D884-4A78-B046-2D224A4E82CE}: "URL" = http://www.bing.com/search?q={searchTerms}&form=IE9TR&src=IE9TR&pc=MDDRJS

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm

IE - HKLM\..\SearchScopes,DefaultScope = {D1E467CD-9079-4406-BDB5-9B3C71F22A6A}

IE - HKLM\..\SearchScopes\{891954C5-D884-4A78-B046-2D224A4E82CE}: "URL" = http://www.bing.com/search?q={searchTerms}&form=IE9TR&src=IE9TR&pc=MDDRJS

IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-19\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com

IE - HKU\S-1-5-20\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com

IE - HKU\S-1-5-21-3759848468-541695144-1953164835-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com

IE - HKU\S-1-5-21-3759848468-541695144-1953164835-1000\..\SearchScopes,DefaultScope = {891954C5-D884-4A78-B046-2D224A4E82CE}

IE - HKU\S-1-5-21-3759848468-541695144-1953164835-1000\..\SearchScopes\{CB2E8768-4963-4720-A3B8-C82C43492B0F}: "URL" = http://search.zonealarm.com/search?src=sp&tbid=base2013&Lan=en&q={searchTerms}&gu=445eeb5a2661447ba6aac6123e12b7ae&tu=10G90008D2B0008&sku=&tstsId=&ver=&&r=583

IE - HKU\S-1-5-21-3759848468-541695144-1953164835-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found

FF - HKLM\Software\MozillaPlugins\@checkpoint.com/FFApi: C:\Program Files\CheckPoint\ZAForceField\WOW64\TrustChecker\bin\npFFApi.dll ()

FF - HKLM\Software\MozillaPlugins\@intel-webapi.intel.com/Intel WebAPI ipt;version=2.1.42: C:\Program Files (x86)\Intel\Intel® Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation)

FF - HKLM\Software\MozillaPlugins\@intel-webapi.intel.com/Intel WebAPI updater: C:\Program Files (x86)\Intel\Intel® Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)

FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.21.2: C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)

FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.21.2: C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)

FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found

FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=16.4.3505.0912: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.21.145\npGoogleUpdate3.dll (Google Inc.)

FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.21.145\npGoogleUpdate3.dll (Google Inc.)

64bit-FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{C4CFC0DE-134F-4466-B2A2-FF7C59A8BFAD}: C:\PROGRAM FILES\UPDATER BY SWEETPACKS\FIREFOX

64bit-FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{FFB96CC1-7EB3-449D-B827-DB661701C6BB}: C:\PROGRAM FILES\CHECKPOINT\ZAFORCEFIELD\TRUSTCHECKER [2013/05/23 20:38:58 | 000,000,000 | ---D | M]

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\extensions\\{C4CFC0DE-134F-4466-B2A2-FF7C59A8BFAD}: C:\Program Files\Updater By SweetPacks\Firefox

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\extensions\\{FFB96CC1-7EB3-449D-B827-DB661701C6BB}: C:\Program Files\CheckPoint\ZAForceField\WOW64\TrustChecker [2013/05/23 20:38:59 | 000,000,000 | ---D | M]

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 17.0.6\extensions\\Components: C:\Program Files (x86)\Mozilla Thunderbird\components [2013/05/23 21:04:08 | 000,000,000 | ---D | M]

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 17.0.6\extensions\\Plugins: C:\Program Files (x86)\Mozilla Thunderbird\plugins

[2013/05/23 21:04:16 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Donna\AppData\Roaming\Mozilla\Extensions

[2013/05/23 20:38:02 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\Mozilla Firefox\extensions

========== Chrome ==========

CHR - default_search_provider: Google (Enabled)

CHR - default_search_provider: search_url = {google:baseURL}search?q={searchTerms}&{google:RLZ}{google:originalQueryForSuggestion}{google:assistedQueryStats}{google:searchFieldtrialParameter}{google:searchClient}{google:sourceId}{google:instantExtendedEnabledParameter}ie={inputEncoding}

CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client=chrome&q={searchTerms}&{google:cursorPosition}sugkey={google:suggestAPIKeyParameter},

CHR - homepage: http://fclaweb.fcla.edu/

CHR - plugin: Shockwave Flash (Enabled) = C:\Program Files (x86)\Google\Chrome\Application\27.0.1453.94\PepperFlash\pepflashplayer.dll

CHR - plugin: Chrome Remote Desktop Viewer (Enabled) = internal-remoting-viewer

CHR - plugin: Native Client (Enabled) = C:\Program Files (x86)\Google\Chrome\Application\27.0.1453.94\ppGoogleNaClPluginChrome.dll

CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Program Files (x86)\Google\Chrome\Application\27.0.1453.94\pdf.dll

CHR - plugin: Google Update (Enabled) = C:\Program Files (x86)\Google\Update\1.3.21.145\npGoogleUpdate3.dll

CHR - plugin: Intelu00AE Identity Protection Technology (Enabled) = C:\Program Files (x86)\Intel\Intel® Management Engine Components\IPT\npIntelWebAPIIPT.dll

CHR - plugin: Intelu00AE Identity Protection Technology (Enabled) = C:\Program Files (x86)\Intel\Intel® Management Engine Components\IPT\npIntelWebAPIUpdater.dll

CHR - plugin: Photo Gallery (Enabled) = C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll

CHR - Extension: Awesome Screenshot: Capture & Annotate = C:\Users\Donna\AppData\Local\Google\Chrome\User Data\Default\Extensions\alelhddbbhepgpmgidjdcjakblofbmce\3.4.4_0\

CHR - Extension: Google Docs = C:\Users\Donna\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.5_0\

CHR - Extension: Google Drive = C:\Users\Donna\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.3_0\

CHR - Extension: YouTube = C:\Users\Donna\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.6_0\

CHR - Extension: Google Search = C:\Users\Donna\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.20_0\

CHR - Extension: Last.fm Scrobbler = C:\Users\Donna\AppData\Local\Google\Chrome\User Data\Default\Extensions\hhinaapppaileiechjoiifaancjggfjm\1.16_1\

CHR - Extension: Picasa Extension (by Google) = C:\Users\Donna\AppData\Local\Google\Chrome\User Data\Default\Extensions\lhhlohbbihddnfcehbijmlnpkafmmkfp\0.1_0\

CHR - Extension: Google Dictionary (by Google) = C:\Users\Donna\AppData\Local\Google\Chrome\User Data\Default\Extensions\mgijmajocgfcbeboacabfgobmjgjcoja\3.0.17_1\

CHR - Extension: Gmail = C:\Users\Donna\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\