Keep getting MB has Successfully blocked access to a potentially malicious website

gtdriski · May 31, 2013

Hello,

Like others, I keep getting the popup that MalwareBytes has Successfully blocked access to a potentially malicious website. It seems to be the same IP over and over.

Please assist.

I have already run DDS. Here are the DDS logs:

DDS (Ver_2012-11-20.01) - NTFS_x86

Internet Explorer: 7.0.6000.21335 BrowserJavaVersion: 10.21.2

Run by GaryT at 14:37:18 on 2013-05-31

Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.3455.2288 [GMT -4:00]

.

AV: ESET NOD32 Antivirus 6.0 *Enabled/Updated* {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}

.

============== Running Processes ================

.

C:\Program Files\Logitech\SolarApp\L4301_Solar.exe

C:\Program Files\Cisco\Cisco AnyConnect VPN Client\vpnagent.exe

C:\WINDOWS\system32\brss01a.exe

C:\WINDOWS\system32\spoolsv.exe

c:\program files\common files\logishrd\lvmvfm\LVPrcSrv.exe

C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe

C:\Program Files\Java\jre7\bin\jqs.exe

C:\Program Files\Common Files\LightScribe\LSSrvc.exe

C:\Program Files\LogMeIn\x86\RaMaint.exe

C:\Program Files\LogMeIn\x86\LogMeIn.exe

C:\Program Files\LogMeIn\x86\LMIGuardian.exe

C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe

C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE

C:\WINDOWS\Explorer.EXE

C:\Program Files\Raxco\PerfectDisk10\PDAgent.exe

C:\WINDOWS\system32\PSIService.exe

C:\Program Files\Common Files\Intuit\QuickBooks\QBCFMonitorService.exe

C:\Program Files\Common Files\Intuit\DataProtect\QBIDPService.exe

C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe

C:\Documents and Settings\All Users\Application Data\Skype\Toolbars\Skype C2C Service\c2c_service.exe

C:\Program Files\Common Files\Java\Java Update\jusched.exe

C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

C:\Program Files\Skype\Phone\Skype.exe

C:\Program Files\TuneUp Utilities 2013\TuneUpUtilitiesService32.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\UPHClean\uphclean.exe

C:\Documents and Settings\GaryT\Local Settings\Application Data\Google\Update\1.3.21.145\GoogleCrashHandler.exe

C:\Program Files\Common Files\Pure Networks Shared\Platform\nmsrvc.exe

C:\Program Files\Raxco\PerfectDisk10\PDEngine.exe

C:\Program Files\TuneUp Utilities 2013\TuneUpUtilitiesApp32.exe

C:\WINDOWS\System32\alg.exe

C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe

C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe

C:\Documents and Settings\GaryT\Local Settings\Application Data\Intuit\SyncManager\Current\IntuitSyncManager.exe

C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe

C:\Program Files\Raxco\PerfectDisk10\PDAgentS1.exe

C:\Program Files\Raxco\PerfectDisk10\PerfectDisk.exe

C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe

C:\Program Files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe

C:\PROGRA~1\INTUIT\QUICKB~1\QBDBMgr.exe

C:\WINDOWS\system32\wbem\wmiprvse.exe

C:\WINDOWS\system32\svchost.exe -k DcomLaunch

C:\WINDOWS\system32\svchost.exe -k rpcss

C:\WINDOWS\System32\svchost.exe -k netsvcs

C:\WINDOWS\System32\svchost.exe -k NetworkService

C:\WINDOWS\system32\svchost.exe -k LocalService

C:\WINDOWS\system32\svchost.exe -k netsvcs

C:\WINDOWS\System32\svchost.exe -k imgsvc

.

============== Pseudo HJT Report ===============

.

uStart Page = hxxp://cm.my.yahoo.com/?rd=nux

uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8

uSearchAssistant = hxxp://www.google.com/ie

uSearchURL,(Default) = hxxp://www.google.com/keyword/%s

BHO: SnagIt Toolbar Loader: {00C6482D-C502-44C8-8409-FCE54AD9C208} - c:\program files\techsmith\snagit 10\SnagitBHO.dll

BHO: Adobe PDF Link Helper: {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll

BHO: Java™ Plug-In SSV Helper: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - c:\program files\java\jre7\bin\ssv.dll

BHO: del.icio.us Toolbar Helper: {7AA07AE6-01EF-44EC-93CA-9D7CD41CCDB6} - c:\program files\del.icio.us\internet explorer buttons\dlcsIE.dll

BHO: Windows Live Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll

BHO: Google Toolbar Helper: {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\google toolbar\GoogleToolbar_32.dll

BHO: Catcher Class: {ADECBED6-0366-4377-A739-E69DFBA04663} - c:\program files\moyea\flv downloader\MoyeaCth.dll

BHO: Adobe PDF Conversion Toolbar Helper: {AE7CD045-E861-484f-8273-0445EE161910} - c:\program files\common files\adobe\acrobat\activex\AcroIEFavClient.dll

BHO: Skype Browser Helper: {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll

BHO: Google Toolbar Notifier BHO: {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - c:\program files\google\googletoolbarnotifier\5.7.8313.1002\swg.dll

BHO: Java™ Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - c:\program files\java\jre7\bin\jp2ssv.dll

BHO: SmartSelect Class: {F4971EE7-DAA0-4053-9964-665D8EE6A077} - c:\program files\common files\adobe\acrobat\activex\AcroIEFavClient.dll

TB: del.icio.us: {981FE6A8-260C-4930-960F-C3BC82746CB0} - c:\program files\del.icio.us\internet explorer buttons\dlcsIE.dll

TB: Google Toolbar: {2318C2B1-4965-11D4-9B18-009027A5CD4F} - c:\program files\google\google toolbar\GoogleToolbar_32.dll

TB: Adobe PDF: {47833539-D0C5-4125-9FA8-0819E2EAAC93} - c:\program files\common files\adobe\acrobat\activex\AcroIEFavClient.dll

TB: Easy-WebPrint: {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - c:\program files\canon\easy-webprint\Toolband.dll

TB: del.icio.us: {981FE6A8-260C-4930-960F-C3BC82746CB0} - c:\program files\del.icio.us\internet explorer buttons\dlcsIE.dll

TB: Adobe PDF: {47833539-D0C5-4125-9FA8-0819E2EAAC93} - c:\program files\common files\adobe\acrobat\activex\AcroIEFavClient.dll

TB: Snagit: {8FF5E183-ABDE-46EB-B09E-D2AAB95CABE3} - c:\program files\techsmith\snagit 10\SnagitIEAddin.dll

TB: Google Toolbar: {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\google toolbar\GoogleToolbar_32.dll

uRun: [swg] "c:\program files\google\googletoolbarnotifier\GoogleToolbarNotifier.exe"

uRun: [skype] "c:\program files\skype\phone\Skype.exe" /minimized /regrun

uRun: [Google Update] "c:\documents and settings\garyt\local settings\application data\google\update\GoogleUpdate.exe" /c

uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe

mRun: [egui] "c:\program files\eset\eset nod32 antivirus\egui.exe" /hide /waitservice

mRun: [sunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe"

mRun: [intuit SyncManager] c:\program files\common files\intuit\sync\IntuitSyncManager.exe startup

mRun: [amd_dc_opt] c:\program files\amd\dual-core optimizer\amd_dc_opt.exe

uPolicies-Explorer: NoDriveTypeAutoRun = dword:323

uPolicies-Explorer: NoDriveAutoRun = dword:67108863

uPolicies-Explorer: NoDrives = dword:0

mPolicies-Explorer: NoDriveAutoRun = dword:67108863

mPolicies-Explorer: NoDriveTypeAutoRun = dword:323

mPolicies-Explorer: NoDrives = dword:0

mPolicies-Windows\System: Allow-LogonScript-NetbiosDisabled = dword:1

mPolicies-Explorer: NoDriveTypeAutoRun = dword:323

mPolicies-Explorer: NoDriveAutoRun = dword:67108863

IE: Add to Evernote 4.0 - c:\program files\evernote\evernote\EvernoteIE.dll/204

IE: Append Link Target to Existing PDF - c:\program files\common files\adobe\acrobat\activex\AcroIEFavClient.dll/AcroIEAppendSelLinks.html

IE: Append to Existing PDF - c:\program files\common files\adobe\acrobat\activex\AcroIEFavClient.dll/AcroIEAppend.html

IE: Convert Link Target to Adobe PDF - c:\program files\common files\adobe\acrobat\activex\AcroIEFavClient.dll/AcroIECaptureSelLinks.html

IE: Convert selected links to Adobe PDF - c:\program files\adobe\acrobat 8.0\acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html

IE: Convert selected links to existing PDF - c:\program files\adobe\acrobat 8.0\acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html

IE: Convert selection to Adobe PDF - c:\program files\adobe\acrobat 8.0\acrobat\AcroIEFavClient.dll/AcroIECapture.html

IE: Convert selection to existing PDF - c:\program files\adobe\acrobat 8.0\acrobat\AcroIEFavClient.dll/AcroIEAppend.html

IE: Convert to Adobe PDF - c:\program files\common files\adobe\acrobat\activex\AcroIEFavClient.dll/AcroIECapture.html

IE: Easy-WebPrint Add To Print List - c:\program files\canon\easy-webprint\Resource.dll/RC_AddToList.html

IE: Easy-WebPrint High Speed Print - c:\program files\canon\easy-webprint\Resource.dll/RC_HSPrint.html

IE: Easy-WebPrint Preview - c:\program files\canon\easy-webprint\Resource.dll/RC_Preview.html

IE: Easy-WebPrint Print - c:\program files\canon\easy-webprint\Resource.dll/RC_Print.html

IE: {86B4FC19-8FA4-4FD3-B243-9AEDB42FA2D5} - {86B4FC19-8FA4-4FD3-B243-9AEDB42FA2D5} - c:\program files\eltima software\flash decompiler trillix\saveflash\iebt.dll

IE: {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll

IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503}

IE: {A95fe080-8f5d-11d2-a20b-00aa003c157a} - c:\program files\evernote\evernote\EvernoteIE.dll/204

IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe

DPF: NetGUI - hxxp://www.gomeetnow.com/client/window/1,0,1,69/ActiveXInstaller.CAB

DPF: Web-Based Email Tools - hxxp://email.secureserver.net/Download.CAB

DPF: {02FFCFC3-C28F-4ED9-954B-1BAC9FD77E12} - hxxp://webstream.intra.net/media/xflux3.cab

DPF: {0742B9EF-8C83-41CA-BFBA-830A59E23533} - hxxps://support.microsoft.com/Dcode/ActiveX/MSDcode.cab

DPF: {11260943-421B-11D0-8EAC-0000C07D88CF} - hxxp://www.ipix.com/viewers/ipixx.cab

DPF: {166B1BCA-3F9C-11CF-8075-444553540000} - hxxp://fpdownload.macromedia.com/get/shockwave/cabs/director/sw.cab

DPF: {16C698C4-4BE0-4CDF-B777-39276A95F58F} - hxxp://meeting.zoho.com/login/ActivexViewer.jsp

DPF: {2AF5BD25-90C5-4EEC-88C5-B44DC2905D8B} - hxxp://dlmanager.akamaitools.com.edgesuite.net/dlmanager/versions/activex/dlm-activex-2.0.3.8.cab

DPF: {3E68E405-C6DE-49FF-83AE-41EE9F4C36CE} - hxxp://office.microsoft.com/officeupdate/content/opuc3.cab

DPF: {493ACF15-5CD9-4474-82A6-91670C3DD66E} - hxxp://www.linkedin.com/cab/LinkedInContactFinderControl.cab

DPF: {4C39376E-FA9D-4349-BACC-D305C1750EF3} - hxxp://tools.ebayimg.com/eps/wl/activex/eBay_Enhanced_Picture_Control_v1-0-3-36.cab

DPF: {54D53429-945C-4188-B460-C81356541882} - hxxp://photosmart.hpphoto.com/Download/HPeServicesLocalPrint.CAB

DPF: {56426D1F-A2BB-4195-8555-CCE6533F81E8} - hxxp://meeting.zoho.com/login/Agent.jsp

DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} - hxxp://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1122093200750

DPF: {67A5F8DC-1A4B-4D66-9F24-A704AD929EEE} - hxxp://www.nvidia.com/content/DriverDownload/srl/2.0.0.1/sysreqlab2.cab

DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} - hxxp://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1257126710734

DPF: {74DBCB52-F298-4110-951D-AD2FF67BC8AB} - hxxp://www.nvidia.com/content/DriverDownload/nforce/NvidiaSmartScan.cab

DPF: {7B297BFD-85E4-4092-B2AF-16A91B2EA103} - hxxp://www3.ca.com/securityadvisor/virusinfo/webscan.cab

DPF: {7BC974EF-A718-4A17-B77E-4C8DBC327AFA} - hxxps://secure.voloper.net/editor.cab

DPF: {7DD82D6B-3553-470B-8D1E-D5C7086478A7} - hxxps://merchantaccount.quickbooks.com/sync/QBMASSyncCom2_2005.cab

DPF: {84B7AC1D-9AD1-474F-B6B0-FE1641DBFDFA} - hxxp://www.contentpurity.com/xp/ScanFilexp.CAB

DPF: {87651085-BCBF-4281-B8F7-1F6E56E92515} - hxxp://meeting.zoho.com/login/Agent.jsp

DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/ultrashim.cab

DPF: {B7039D87-D648-4431-BA87-C3A04E6111DA} - hxxps://67.43.9.72:4643/vz/ssh/wodTelnetDLX.cab

DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab

DPF: {D5382F3F-32AA-41E1-9FFF-5D1EFAC80D40} - hxxp://contentpurity.com/members/FileClean.CAB

DPF: {D821DC4A-0814-435E-9820-661C543A4679} - hxxp://drmlicense.one.microsoft.com/crlupdate/en/crlocx.ocx

DPF: {E87F6C8E-16C0-11D3-BEF7-009027438003} - hxxp://office.webstream-innovations.com/hyperoffice/personal/documents/XUpload.ocx

DPF: {E8F628B5-259A-4734-97EE-BA914D7BE941} - hxxp://driveragent.com/files/driveragent.cab

DPF: {F21AC8A4-4322-11D6-8EBE-0001023D1A2A} - hxxps://merchantaccount.quickbooks.com/recurchrg/IntuitRecurPayCom.cab

DPF: {F8A9F96F-8375-4596-BD89-EEAE2781D810} - hxxps://merchantaccount.quickbooks.com/sync/QBMASSyncCom1.cab

DPF: {FF1CD9A3-00CD-45C1-8182-4EEC229A182D} - hxxp://www.plaxo.com/activex/plx_upldr-2k-xp.cab

TCP: NameServer = 208.67.222.222 208.67.220.220 38.116.38.49

TCP: Interfaces\{625B8D87-A3B9-4E07-ABB1-3D7E45668443} : DHCPNameServer = 208.67.222.222 208.67.220.220 38.116.38.49

Handler: intu-help-qb1 - {9B0F96C7-2E4B-433e-ABF3-043BA1B54AE3} - c:\program files\intuit\quickbooks 2006\HelpAsyncPluggableProtocol.dll

Handler: intu-help-qb2 - {84D77A00-41B5-4b8b-8ADF-86486D72E749} - c:\program files\intuit\quickbooks 2006\HelpAsyncPluggableProtocol.dll

Handler: intu-help-qb5 - {867FCB77-9823-4cd6-8210-D85F968D466F} - c:\program files\intuit\quickbooks 2006\HelpAsyncPluggableProtocol.dll

Handler: pure-go - {4746C79A-2042-4332-8650-48966E44ABA8} - c:\program files\common files\pure networks shared\platform\puresp4.dll

Handler: qbwc - {FC598A64-626C-4447-85B8-53150405FD57} -

Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll

Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\program files\common files\skype\Skype4COM.dll

Notify: LBTWlgn - c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll

Notify: LMIinit - LMIinit.dll

SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll

.

================= FIREFOX ===================

.

FF - ProfilePath - c:\documents and settings\garyt\application data\mozilla\firefox\profiles\1llhjzre.default\

FF - prefs.js: browser.startup.homepage - web.ebuddy.com|hxxp://www.netvibes.com/

FF - plugin: c:\documents and settings\garyt\application data\mozilla\firefox\profiles\1llhjzre.default\extensions\logmeinclient@logmein.com\plugins\npLMI64.dll

FF - plugin: c:\documents and settings\garyt\application data\mozilla\firefox\profiles\1llhjzre.default\extensions\logmeinclient@logmein.com\plugins\npRACtrl.dll

FF - plugin: c:\documents and settings\garyt\local settings\application data\google\update\1.3.21.145\npGoogleUpdate3.dll

FF - plugin: c:\program files\adobe\acrobat 9.0\acrobat\air\nppdf32.dll

FF - plugin: c:\program files\google\update\1.3.21.145\npGoogleUpdate3.dll

FF - plugin: c:\program files\intra.net 4.x components\packages\{309453f2-8d7a-4f10-bdac-ea09d31f9198}\npsf.dll

FF - plugin: c:\program files\java\jre7\bin\plugin2\npjp2.dll

FF - plugin: c:\program files\microsoft silverlight\5.1.20125.0\npctrlui.dll

FF - plugin: c:\program files\microsoft\office live\npOLW.dll

FF - plugin: c:\program files\sibelius software\scorch\NPSibelius.dll

FF - plugin: c:\windows\system32\ibm\npwdplugin.dll

FF - plugin: c:\windows\system32\macromed\flash\NPSWF32_11_7_700_202.dll

FF - plugin: c:\windows\system32\npdeployJava1.dll

FF - plugin: c:\windows\system32\Npindeo.dll

FF - plugin: c:\windows\system32\npptools.dll

FF - plugin: c:\windows\system32\npwmsdrm.dll

FF - ExtSQL: !HIDDEN! 2011-07-10 18:12; {20a82645-c095-46ed-80e3-08825760534b}; c:\windows\microsoft.net\framework\v3.5\windows presentation foundation\DotNetAssistantExtension

.

---- FIREFOX POLICIES ----

FF - user.js: network.http.max-persistent-connections-per-server - 4

FF - user.js: nglayout.initialpaint.delay - 600

.

============= SERVICES / DRIVERS ===============

.

R1 ehdrv;ehdrv;c:\windows\system32\drivers\ehdrv.sys [2012-3-14 122240]

R1 epfwtdir;epfwtdir;c:\windows\system32\drivers\epfwtdir.sys [2012-3-14 105784]

R2 ekrn;ESET Service;c:\program files\eset\eset nod32 antivirus\ekrn.exe [2013-3-21 1341664]

R2 L4301_Solar;Logitech Solar Keyboard Service;c:\program files\logitech\solarapp\L4301_Solar.exe [2010-10-26 319568]

R2 LBeepKE;Logitech Beep Suppression Driver;c:\windows\system32\drivers\LBeepKE.sys [2011-6-14 12216]

R2 LMIInfo;LogMeIn Kernel Information Provider;c:\program files\logmein\x86\rainfo.sys [2008-7-24 12856]

R2 LMIRfsDriver;LogMeIn Remote File System Driver;c:\windows\system32\drivers\LMIRfsDriver.sys [2009-4-24 47640]

R2 MBAMScheduler;MBAMScheduler;c:\program files\malwarebytes' anti-malware\mbamscheduler.exe [2012-9-12 418376]

R2 MBAMService;MBAMService;c:\program files\malwarebytes' anti-malware\mbamservice.exe [2011-1-5 701512]

R2 npf;NetGroup Packet Filter Driver;c:\windows\system32\drivers\npf.sys [2009-3-15 34064]

R2 ousbehci;OrangeWare USB Enhanced Host Controller Service;c:\windows\system32\drivers\ousbehci.sys [2009-10-12 45824]

R2 QBVSS;QBIDPService;c:\program files\common files\intuit\dataprotect\QBIDPService.exe [2011-8-19 1248256]

R2 Skype C2C Service;Skype C2C Service;c:\documents and settings\all users\application data\skype\toolbars\skype c2c service\c2c_service.exe [2013-1-31 3289208]

R2 TuneUp.UtilitiesSvc;TuneUp Utilities Service;c:\program files\tuneup utilities 2013\TuneUpUtilitiesService32.exe [2013-1-31 1724192]

R2 ubsbm;Unibrain 1394 SBM Driver;c:\windows\system32\drivers\UBSBM.sys [2005-7-27 14080]

R2 ubumapi;Unibrain 1394 FireAPI Driver;c:\windows\system32\drivers\UBUMAPI.sys [2005-7-27 36352]

R2 vpnagent;Cisco AnyConnect VPN Agent;c:\program files\cisco\cisco anyconnect vpn client\vpnagent.exe [2011-9-22 645048]

R3 dfmirage;dfmirage;c:\windows\system32\drivers\dfmirage.sys [2005-11-25 31896]

R3 LEqdUsb;Logitech SetPoint Unifying KMDF USB Filter;c:\windows\system32\drivers\LEqdUsb.sys [2010-8-24 43704]

R3 LHidEqd;Logitech SetPoint Unifying KMDF HID Filter;c:\windows\system32\drivers\LHidEqd.sys [2010-8-24 12216]

R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2011-1-5 22856]

R3 ousb2hub;OrangeWare USB 2.0 Root Hub Support;c:\windows\system32\drivers\ousb2hub.sys [2009-10-12 56960]

R3 TuneUpUtilitiesDrv;TuneUpUtilitiesDrv;c:\program files\tuneup utilities 2013\TuneUpUtilitiesDriver32.sys [2012-9-18 10088]

R3 ubohci;Unibrain 1394 OHCI Driver;c:\windows\system32\drivers\ubohci.sys [2005-7-27 77056]

R3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\microsoft.net\framework\v4.0.30319\wpf\WPFFontCache_v0400.exe [2010-3-18 753504]

S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]

S2 SkypeUpdate;Skype Updater;c:\program files\skype\updater\Updater.exe [2013-2-28 161384]

S3 FileShd;FileShd;c:\windows\system32\drivers\fileshd2.sys [2007-9-10 69888]

S3 libusb0;Jawbone LibUsb-Win32 - Kernel Driver 09/22/2011,1.2.5.0;c:\windows\system32\drivers\libusb0.sys [2011-5-13 42592]

S3 PCAlertDriver;PCAlertDriver;c:\program files\msi\core center\NTGLM7X.SYS [2005-10-2 22432]

S3 Revoflt;Revoflt;c:\windows\system32\drivers\revoflt.sys [2010-7-11 27064]

S4 LMIRfsClientNP;LMIRfsClientNP; [x]

.

=============== Created Last 30 ================

.

2013-05-19 04:44:59 548864 ----a-w- c:\program files\mozilla firefox\plugins\webex\924\mmssl32.dll

2013-05-18 04:18:01 1409 ----a-w- c:\windows\QTFont.for

2013-05-13 05:25:42 -------- d-----w- c:\documents and settings\garyt\local settings\application data\Sun

2013-05-13 03:36:19 144896 ----a-w- c:\windows\system32\javacpl.cpl

2013-05-13 03:36:01 94112 ----a-w- c:\windows\system32\WindowsAccessBridge.dll

.

==================== Find3M ====================

.

2013-05-27 22:02:09 71048 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl

2013-05-27 22:02:09 692104 ----a-w- c:\windows\system32\FlashPlayerApp.exe

2013-05-13 03:35:42 866720 ----a-w- c:\windows\system32\npdeployJava1.dll

2013-05-13 03:35:41 788896 ----a-w- c:\windows\system32\deployJava1.dll

2013-04-30 10:18:51 1072544 ----a-w- c:\windows\system32\nvdrsdb0.bin

2013-04-30 10:18:51 1 ----a-w- c:\windows\system32\nvdrssel.bin

2013-04-30 10:18:46 1072544 ----a-w- c:\windows\system32\nvdrsdb1.bin

2013-04-16 21:59:48 841216 ----a-w- c:\windows\system32\wininet.dll

2013-04-16 21:59:48 1830912 ----a-w- c:\windows\system32\inetcpl.cpl

2013-04-16 21:59:47 78336 ----a-w- c:\windows\system32\ieencode.dll

2013-04-16 21:59:47 17408 ----a-w- c:\windows\system32\corpol.dll

2013-04-12 23:28:54 389120 ----a-w- c:\windows\system32\html.iec

2013-04-10 01:31:19 1876352 ----a-w- c:\windows\system32\win32k.sys

2013-04-04 18:50:32 22856 ----a-w- c:\windows\system32\drivers\mbam.sys

2013-03-08 08:36:22 293376 ----a-w- c:\windows\system32\winsrv.dll

2013-03-07 01:32:25 2149888 ----a-w- c:\windows\system32\ntoskrnl.exe

2013-03-07 00:50:30 2028544 ----a-w- c:\windows\system32\ntkrnlpa.exe

2009-10-31 20:13:58 44 ---h--w- c:\program files\dd2c2250.tmp

2003-08-27 18:19:18 36963 ----a-w- c:\program files\common files\SM1updtr.dll

.

============= FINISH: 14:38:50.61 ===============

.

UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.

IF REQUESTED, ZIP IT UP & ATTACH IT

.

DDS (Ver_2012-11-20.01)

.

Microsoft Windows XP Professional

Boot Device: \Device\HarddiskVolume1

Install Date: 7/17/2005 9:23:02 PM

System Uptime: 5/28/2013 3:12:39 AM (83 hours ago)

.

Motherboard: MICRO-STAR INTERNATIONAL CO., LTD | | MS-7125

Processor: AMD Athlon™ 64 X2 Dual Core Processor 4200+ | Socket 939 | 2210/201mhz

.

==== Disk Partitions =========================

.

A: is Removable

C: is FIXED (NTFS) - 186 GiB total, 46.736 GiB free.

D: is CDROM ()

.

==== Disabled Device Manager Items =============

.

Class GUID: {4D36E972-E325-11CE-BFC1-08002BE10318}

Description: Cisco AnyConnect VPN Virtual Miniport Adapter for Windows

Device ID: ROOT\NET\0000

Manufacturer: Cisco Systems

Name: Cisco AnyConnect VPN Virtual Miniport Adapter for Windows

PNP Device ID: ROOT\NET\0000

Service: vpnva

.

==== System Restore Points ===================

.

No restore point in system.

.

==== Installed Programs ======================

.

3114 SATARAID5

500e

ABBYY FineReader 5.0 Sprint

Adobe Acrobat 9 Standard - English, Français, Deutsch

Adobe Acrobat 9.5.4 - CPSID_83708

Adobe AIR

Adobe ConnectNow

Adobe ConnectNow Add-in

Adobe Flash Player 11 ActiveX

Adobe Flash Player 11 Plugin

Adobe Shockwave Player 11

Advanced Find and Replace v5.1

AMD CPUInfo

AMD Power Monitor

AMD Processor Driver

Apple Software Update

Brother BRAdmin Professional 2.51

Brother HL-5170DN

Camera Support Core Library

Camera Window DS

Camera Window DVC

Camera Window MC

Camtasia Studio 7

Canon Camera Support Core Library

Canon Camera Window DS for ZoomBrowser EX

Canon Camera Window DVC for ZoomBrowser EX

Canon Camera Window for ZoomBrowser EX

Canon i950

Canon MovieEdit Task for ZoomBrowser EX

Canon PhotoRecord

Canon RAW Image Task for ZoomBrowser EX

Canon RemoteCapture Task for ZoomBrowser EX

Canon Utilities Easy-PhotoPrint

Canon ZoomBrowser EX

CCleaner

Cisco AnyConnect VPN Client

Cisco Network Magic

Cisco Unified Presenter Add-in 6x5

ClickTracks Hosted Viewer

Cole2k Media - Codec Pack (Advanced) 7.1.0

Compatibility Pack for the 2007 Office system

Constant Contact QuickImport - Outlook

Corel Photo Album 6

Critical Security Update

Critical Update for Windows Media Player 11 (KB959772)

CSS eXplorer

Cypress USB Mass Storage Driver Installation

del.icio.us Buttons for Internet Explorer

DeVilbiss Remote Control

DH Driver Cleaner.NET

Directory Submitter 1.0.29

DivX

DivX Player

Domain Samurai

DriverMax 5

Dropbox

Dual-Core Optimizer

EPSON Copy Utility 3

EPSON Perf 2480 - 2580 Guide

EPSON Scan

EPSON Smart Panel

eReg

erLT

ESET NOD32 Antivirus

EVEREST Ultimate Edition v5.02

Evernote v. 4.5.10

Family Tree Maker 2011

Flash Decompiler Trillix

Free Easy Burner V 3.8

Google AdWords Editor

Google Chrome

Google Toolbar for Internet Explorer

Google Update Helper

GoToMeeting 5.4.0.1082

GSiteCrawler

GTK+ 2.10.6-1 runtime environment

HighMAT Extension to Microsoft Windows XP CD Writing Wizard

Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)

Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)

Hotfix for Windows Internet Explorer 7 (KB947864)

Hotfix for Windows Media Format 11 SDK (KB929399)

Hotfix for Windows Media Player 11 (KB939683)

Hotfix for Windows XP (KB2158563)

Hotfix for Windows XP (KB2443685)

Hotfix for Windows XP (KB2570791)

Hotfix for Windows XP (KB2633952)

Hotfix for Windows XP (KB2756822)

Hotfix for Windows XP (KB2779562)

Hotfix for Windows XP (KB952287)

Hotfix for Windows XP (KB961118)

Hotfix for Windows XP (KB970653-v3)

Hotfix for Windows XP (KB976098-v2)

Hotfix for Windows XP (KB979306)

Hotfix for Windows XP (KB981793)

HP eServices Local Prints and Save

HP Scrawlr

InfraRecorder

Internet Explorer Q903235

Intra.Net 4.x Components

IrfanView (remove only)

iTunes

Java 7 Update 21

Java Auto Updater

Jawbone Updater

join.me

Keyword Cloud Generator 1.0.21

LightScribe 1.4.136.1

Likno Web Button Maker

Logitech Audio Echo Cancellation Component

Logitech QuickCam

Logitech SetPoint 6.50

Logitech Solar App 1.0

Logitech Video Enumerator

Logitech® Camera Driver

LogMeIn

LtMoh_MARS

Macromedia Dreamweaver 8

Macromedia Extension Manager

Macromedia Flash 8

Macromedia Flash 8 Video Encoder

Malwarebytes Anti-Malware version 1.75.0.1300

Market Samurai

MediaInfo 0.7.5.3

MediaLife

Memory Zipper Plus 7.11

Microsoft .NET Framework 1.1

Microsoft .NET Framework 1.1 Security Update (KB2698023)

Microsoft .NET Framework 1.1 Security Update (KB2742597)

Microsoft .NET Framework 2.0 Service Pack 2

Microsoft .NET Framework 3.0 Service Pack 2

Microsoft .NET Framework 3.5 SP1

Microsoft .NET Framework 4 Client Profile

Microsoft .NET Framework 4 Extended

Microsoft Compression Client Pack 1.0 for Windows XP

Microsoft Internationalized Domain Names Mitigation APIs

Microsoft Kernel-Mode Driver Framework Feature Pack 1.9

Microsoft National Language Support Downlevel APIs

Microsoft Office 2003 Primary Interop Assemblies

Microsoft Office File Validation Add-In

Microsoft Office Live Add-in 1.5

Microsoft Office Professional Edition 2003

Microsoft Office Project Standard 2003

Microsoft Primary Interoperability Assemblies 2005

Microsoft Silverlight

Microsoft SQL Server Compact 3.5 SP2 ENU

Microsoft User-Mode Driver Framework Feature Pack 1.0

Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053

Microsoft Visual C++ 2005 Redistributable

Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148

Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161

Microsoft Visual Studio 2005 Tools for Office Runtime

Microsoft WSE 3.0 Runtime

Mirage Driver 1.1

Mix-FX

MovieEdit Task

Moyea Flash Video MX Pro Version: 5.0.16.932

Moyea Flash Video MX Pro Version: 6.0.2.1174

Moyea FLV Downloader version 1.15.0.15

Moyea FLV Player version 1.5.2.7

Moyea FLV to Video Converter Pro 3 Version: 3.0.6.0

Mozilla Firefox 21.0 (x86 en-US)

Mozilla Maintenance Service

MSI DigiCell

MSXML 4.0 SP2 (KB925672)

MSXML 4.0 SP2 (KB927978)

MSXML 4.0 SP2 (KB936181)

MSXML 4.0 SP2 (KB954430)

MSXML 4.0 SP2 (KB973688)

MSXML 4.0 SP2 Parser and SDK

MSXML 6 Service Pack 2 (KB954459)

MVision

MyPublisher BookMaker

Netsparker [Community Edition] - Web Application Security Scanner

Network Magic

Nmap 4.85BETA5

Notepad++

NVIDIA Drivers

OGA Notifier 2.0.0048.0

Paint.NET v3.5.10

Paros 3.2.13

Passpack DESKTOP

PerfectDisk 10 Professional

PhotoImpression 5

PingPlotter Standard 3.30.0s

PlexTools Professional V2.28

Pure Networks Platform

QuickBooks

QuickBooks Pro 2012

Quicken 2006

Quicken WillMaker Plus 2006

QuickTime

RAW Image Task

RawShooter essentials 2005

Realtek AC'97 Audio

Recuva (remove only)

RemoteCapture Task 1.1

Report Viewer 2.3

Revo Uninstaller Pro 3.0.5

Roxio Content 9

Roxio Drag-to-Disc

Roxio Easy Media Creator 9 Suite

Roxio Media Experience

Roxio Update Manager

Savings Bond Wizard

ScanToWeb

SeaTools for Windows

Security Update for CAPICOM (KB931906)

Security Update for Microsoft .NET Framework 3.5 SP1 (KB2604111)

Security Update for Microsoft .NET Framework 3.5 SP1 (KB2657424)

Security Update for Microsoft .NET Framework 3.5 SP1 (KB2736416)

Security Update for Microsoft Windows (KB2564958)

Security Update for Windows Internet Explorer 7 (KB2183461)

Security Update for Windows Internet Explorer 7 (KB2360131)

Security Update for Windows Internet Explorer 7 (KB2416400)

Security Update for Windows Internet Explorer 7 (KB2482017)

Security Update for Windows Internet Explorer 7 (KB2497640)

Security Update for Windows Internet Explorer 7 (KB2530548)

Security Update for Windows Internet Explorer 7 (KB2544521)

Security Update for Windows Internet Explorer 7 (KB2559049)

Security Update for Windows Internet Explorer 7 (KB2586448)

Security Update for Windows Internet Explorer 7 (KB2618444)

Security Update for Windows Internet Explorer 7 (KB2647516)

Security Update for Windows Internet Explorer 7 (KB2675157)

Security Update for Windows Internet Explorer 7 (KB2699988)

Security Update for Windows Internet Explorer 7 (KB2722913)

Security Update for Windows Internet Explorer 7 (KB2744842)

Security Update for Windows Internet Explorer 7 (KB2761465)

Security Update for Windows Internet Explorer 7 (KB2792100)

Security Update for Windows Internet Explorer 7 (KB2797052)

Security Update for Windows Internet Explorer 7 (KB2799329)

Security Update for Windows Internet Explorer 7 (KB2809289)

Security Update for Windows Internet Explorer 7 (KB2817183)

Security Update for Windows Internet Explorer 7 (KB2829530)

Security Update for Windows Media Encoder (KB2447961)

Security Update for Windows Media Player (KB2378111)

Security Update for Windows Media Player (KB911564)

Security Update for Windows Media Player (KB952069)

Security Update for Windows Media Player (KB954155)

Security Update for Windows Media Player (KB968816)

Security Update for Windows Media Player (KB973540)

Security Update for Windows Media Player (KB975558)

Security Update for Windows Media Player (KB978695)

Security Update for Windows Media Player 10 (KB911565)

Security Update for Windows Media Player 10 (KB917734)

Security Update for Windows Media Player 11 (KB936782)

Security Update for Windows Media Player 11 (KB954154)

Security Update for Windows XP (KB2079403)

Security Update for Windows XP (KB2115168)

Security Update for Windows XP (KB2121546)

Security Update for Windows XP (KB2160329)

Security Update for Windows XP (KB2229593)

Security Update for Windows XP (KB2259922)

Security Update for Windows XP (KB2279986)

Security Update for Windows XP (KB2286198)

Security Update for Windows XP (KB2296011)

Security Update for Windows XP (KB2296199)

Security Update for Windows XP (KB2347290)

Security Update for Windows XP (KB2360937)

Security Update for Windows XP (KB2387149)

Security Update for Windows XP (KB2393802)

Security Update for Windows XP (KB2412687)

Security Update for Windows XP (KB2419632)

Security Update for Windows XP (KB2423089)

Security Update for Windows XP (KB2436673)

Security Update for Windows XP (KB2440591)

Security Update for Windows XP (KB2443105)

Security Update for Windows XP (KB2476490)

Security Update for Windows XP (KB2476687)

Security Update for Windows XP (KB2478960)

Security Update for Windows XP (KB2478971)

Security Update for Windows XP (KB2479628)

Security Update for Windows XP (KB2479943)

Security Update for Windows XP (KB2481109)

Security Update for Windows XP (KB2483185)

Security Update for Windows XP (KB2485376)

Security Update for Windows XP (KB2485663)

Security Update for Windows XP (KB2491683)

Security Update for Windows XP (KB2503658)

Security Update for Windows XP (KB2503665)

Security Update for Windows XP (KB2506212)

Security Update for Windows XP (KB2506223)

Security Update for Windows XP (KB2507618)

Security Update for Windows XP (KB2507938)

Security Update for Windows XP (KB2508272)

Security Update for Windows XP (KB2508429)

Security Update for Windows XP (KB2509553)

Security Update for Windows XP (KB2510581)

Security Update for Windows XP (KB2511455)

Security Update for Windows XP (KB2524375)

Security Update for Windows XP (KB2535512)

Security Update for Windows XP (KB2536276-v2)

Security Update for Windows XP (KB2536276)

Security Update for Windows XP (KB2544893-v2)

Security Update for Windows XP (KB2544893)

Security Update for Windows XP (KB2555917)

Security Update for Windows XP (KB2562937)

Security Update for Windows XP (KB2566454)

Security Update for Windows XP (KB2567053)

Security Update for Windows XP (KB2567680)

Security Update for Windows XP (KB2570222)

Security Update for Windows XP (KB2570947)

Security Update for Windows XP (KB2584146)

Security Update for Windows XP (KB2585542)

Security Update for Windows XP (KB2592799)

Security Update for Windows XP (KB2598479)

Security Update for Windows XP (KB2603381)

Security Update for Windows XP (KB2618451)

Security Update for Windows XP (KB2619339)

Security Update for Windows XP (KB2620712)

Security Update for Windows XP (KB2621440)

Security Update for Windows XP (KB2624667)

Security Update for Windows XP (KB2631813)

Security Update for Windows XP (KB2633171)

Security Update for Windows XP (KB2639417)

Security Update for Windows XP (KB2641653)

Security Update for Windows XP (KB2646524)

Security Update for Windows XP (KB2647518)

Security Update for Windows XP (KB2653956)

Security Update for Windows XP (KB2655992)

Security Update for Windows XP (KB2659262)

Security Update for Windows XP (KB2676562)

Security Update for Windows XP (KB2685939)

Security Update for Windows XP (KB2686509)

Security Update for Windows XP (KB2691442)

Security Update for Windows XP (KB2695962)

Security Update for Windows XP (KB2698365)

Security Update for Windows XP (KB2705219)

Security Update for Windows XP (KB2707511)

Security Update for Windows XP (KB2709162)

Security Update for Windows XP (KB2712808)

Security Update for Windows XP (KB2718523)

Security Update for Windows XP (KB2719985)

Security Update for Windows XP (KB2723135)

Security Update for Windows XP (KB2724197)

Security Update for Windows XP (KB2727528)

Security Update for Windows XP (KB2731847)

Security Update for Windows XP (KB2753842-v2)

Security Update for Windows XP (KB2753842)

Security Update for Windows XP (KB2757638)

Security Update for Windows XP (KB2758857)

Security Update for Windows XP (KB2761226)

Security Update for Windows XP (KB2770660)

Security Update for Windows XP (KB2778344)

Security Update for Windows XP (KB2779030)

Security Update for Windows XP (KB2780091)

Security Update for Windows XP (KB2799494)

Security Update for Windows XP (KB2802968)

Security Update for Windows XP (KB2807986)

Security Update for Windows XP (KB2808735)

Security Update for Windows XP (KB2813170)

Security Update for Windows XP (KB2813345)

Security Update for Windows XP (KB2820197)

Security Update for Windows XP (KB2820917)

Security Update for Windows XP (KB2829361)

Security Update for Windows XP (KB979687)

Security Update for Windows XP (KB980436)

Security Update for Windows XP (KB981322)

Security Update for Windows XP (KB981852)

Security Update for Windows XP (KB981957)

Security Update for Windows XP (KB981997)

Security Update for Windows XP (KB982132)

Security Update for Windows XP (KB982214)

Security Update for Windows XP (KB982665)

Security Update for Windows XP (KB982802)

Sibelius Scorch (Firefox, Opera, Netscape, Chrome only)

Skype Click to Call

Skype™ 6.3

SmartFTP Client

SmartFTP Client 3.0 Setup Files (remove only)

SmartFTP Client 4.0 Setup Files (remove only)

SmartLink Desktop

Snagit 10.0.1

SnagIt Studio

SOS Online Backup

Speccy

StuffIt Expander 2009

Sumopaint Pro

SupportSoft Assisted Service

System Requirements Lab

TeamViewer 6

Time Zone Data Update Tool for Microsoft Office Outlook

TuneUp Utilities 2013

TuneUp Utilities Language Pack (en-US)

ubCore

UEStudio '10.30

UltraCompare v7.20

UltraSentry

Update for Microsoft .NET Framework 3.5 SP1 (KB963707)

Update for Windows Internet Explorer 7 (KB976749)

Update for Windows Internet Explorer 7 (KB980182)

Update for Windows XP (KB2141007)

Update for Windows XP (KB2345886)

Update for Windows XP (KB2467659)

Update for Windows XP (KB2541763)

Update for Windows XP (KB2616676-v2)

Update for Windows XP (KB2641690)

Update for Windows XP (KB2661254-v2)

Update for Windows XP (KB2718704)

Update for Windows XP (KB2736233)

Update for Windows XP (KB2749655)

Update for Windows XP (KB951072-v2)

Update for Windows XP (KB951978)

Update for Windows XP (KB955759)

Update for Windows XP (KB955839)

Update for Windows XP (KB967715)

Update for Windows XP (KB968389)

Update for Windows XP (KB971029)

Update for Windows XP (KB971737)

Update for Windows XP (KB973687)

Update for Windows XP (KB973815)

USB Storage Adapter FX (SM1)

User Profile Hive Cleanup Service

Visual Studio 2005 Tools for Office Second Edition Runtime

Web CEO 9.1

WebEx

WebFldrs XP

Windows Genuine Advantage v1.3.0254.0

Windows Imaging Component

Windows Installer Clean Up

Windows Live Sign-in Assistant

Windows Media Encoder 9 Series

Windows Media Format 11 runtime

Windows Media Player 11

Windows Resource Kit Tools - SubInAcl.exe

Windows XP Service Pack 3

WinMerge 2.12.4

winpcap-nmap 4.02

WinZip 15.0

WSI Power Search

XML Paper Specification Shared Components Pack 1.0

XSitePro2

XviD MPEG-4 Codec

Yugma

.

==== Event Viewer Messages From Past Week ========

.

5/31/2013 2:37:22 PM, error: Service Control Manager [7016] - The BrSplService service has reported an invalid current state 0.

5/28/2013 3:14:30 AM, error: System Error [1003] - Error code 1000008e, parameter1 c0000005, parameter2 b66ac3a6, parameter3 a55f0960, parameter4 00000000.

5/27/2013 5:56:57 PM, error: Service Control Manager [7002] - The BrPar service depends on the Parallel arbitrator group and no member of this group started.

5/27/2013 5:56:57 PM, error: Service Control Manager [7000] - The Parallel port driver service failed to start due to the following error: The service cannot be started, either because it is disabled or because it has no enabled devices associated with it.

5/27/2013 5:56:16 PM, error: NETLOGON [3095] - This computer is configured as a member of a workgroup, not as a member of a domain. The Netlogon service does not need to run in this configuration.

.

==== End Of File ===========================

Thanks, Gary

MrCharlie · May 31, 2013

Welcome to the forum.

Please remove any usb or external drives from the computer before you run this scan!

Please download and run RogueKiller 32 Bit to your desktop.

RogueKiller 64 Bit <---use this one for 64 bit systems

Quit all running programs.

For Windows XP, double-click to start.

For Vista or Windows 7-8, do a right-click on the program, select Run as Administrator to start, & when prompted Allow to run.

Click Scan to scan the system.

When the scan completes > Close out the program > Don't Fix anything!

Don't run any other options, they're not all bad!!!!!!!

Post back the report which should be located on your desktop.

(please don't put logs in code or quotes)

P2P Warning:

If you're using Peer 2 Peer software such as uTorrent, BitTorrent or similar you must either fully uninstall it or completely disable it from running while being assisted here.
Failure to remove or disable such software will result in your topic being closed and no further assistance being provided.

MrC

Note:

Please read all of my instructions completely including these.

Make sure you're subscribed to this topic:

Click on the

Follow This Topic Button

(at the top right of this page), make sure that the

Receive notification

box is checked and that it is set to

Instantly

Removing malware can be unpredictable

...things can go very wrong!

Backup

any files that cannot be replaced. You can copy them to a CD/DVD, external drive or a pen drive

<+>Please don't run any other scans, download, install or uninstall any programs while I'm working with you.

<+>The removal of malware isn't instantaneous, please be patient.

<+>Please stick with me until I give you the "all clear" and

Please don't waste my time by leaving before that

.

------->Your topic will be closed if you haven't replied within 3 days!<--------

(If I don't respond within 24 hours, please send me a PM)

gtdriski · June 2, 2013

MrCharlie,

Thanks for helping.

Here is the RogueKiller Report:

RogueKiller V8.5.4 [Mar 18 2013] by Tigzy

mail : tigzyRK<at>gmail<dot>com

Feedback : http://www.geekstogo.com/forum/files/file/413-roguekiller/

Website : http://tigzy.geekstogo.com/roguekiller.php

Blog : http://tigzyrk.blogspot.com/

Operating System : Windows XP (5.1.2600 Service Pack 3) 32 bits version

Started in : Normal mode

User : GaryT [Admin rights]

Mode : Scan -- Date : 06/02/2013 01:42:05

| ARK || FAK || MBR |

¤¤¤ Bad processes : 0 ¤¤¤

¤¤¤ Registry Entries : 3 ¤¤¤

[HJPOL] HKCU\[...]\System : disableregistrytools (0) -> FOUND

[HJPOL] HKLM\[...]\System : DisableRegistryTools (0) -> FOUND

[HJ] HKLM\[...]\SystemRestore : DisableSR (1) -> FOUND

¤¤¤ Particular Files / Folders: ¤¤¤

¤¤¤ Driver : [LOADED] ¤¤¤

¤¤¤ HOSTS File: ¤¤¤

--> C:\WINDOWS\system32\drivers\etc\hosts

127.0.0.1 localhost

¤¤¤ MBR Check: ¤¤¤

+++++ PhysicalDrive0: NVIDIA MIRROR 186.31G +++++

--- User ---

[MBR] c742ddd5f6a0c3b55445f63cd19fee64

[bSP] 1a31c6e198c07ae4fde6f1b9e53b97ae : Windows XP MBR Code

Partition table:

0 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 63 | Size: 190771 Mo

Error reading LL1 MBR!

Error reading LL2 MBR!

Finished : << RKreport[1]_S_06022013_02d0142.txt >>

RKreport[1]_S_06022013_02d0142.txt

Thanks, Gary

MrCharlie · June 2, 2013

Not much showing, please enable system restore before running MBAR:

Download Malwarebytes Anti-Rootkit from HERE

Unzip the contents to a folder in a convenient location.
Open the folder where the contents were unzipped and run mbar.exe
Follow the instructions in the wizard to update and allow the program to scan your computer for threats.
Click on the Cleanup button to remove any threats and reboot if prompted to do so.
Wait while the system shuts down and the cleanup process is performed.
Perform another scan with Malwarebytes Anti-Rootkit to verify that no threats remain. If they do, then click Cleanup once more and repeat the process.
When done, please post the two logs produced they will be in the MBAR folder..... mbar-log.txt and system-log.txt

To attach a log if needed:

Bottom right corner of this page.

New window that comes up.

~~~~~~~~~~~~~~~~~~~~~~~

Note:

If no additional threats were found, verify that your system is now running normally, making sure that the following items are functional:

Internet access

Windows Update

Windows Firewall

If there are additional problems with your system, such as any of those listed above or other system issues, then run the fixdamage tool included with Malwarebytes Anti-Rootkit and reboot. It's located in the Plugins folder which is in the MBAR folder.

Just run fixdamage.exe.

Verify that your system is now functioning normally.

MrC

gtdriski · June 3, 2013

MrCharllie,

Thanks. I ran MBAR and it found nothing. Here are the logs:

Malwarebytes Anti-Rootkit BETA 1.06.0.1003

www.malwarebytes.org

Database version: v2013.06.03.01

Windows XP Service Pack 3 x86 NTFS

Internet Explorer 7.0.5730.11

GaryT :: GTD-DESKTOP [administrator]

6/2/2013 10:37:18 PM

mbar-log-2013-06-02 (22-37-18).txt

Scan type: Quick scan

Scan options disabled: Deep Anti-Rootkit Scan | PUP

Objects scanned: 232353

Time elapsed: 13 minute(s), 39 second(s)

Memory Processes Detected: 0

(No malicious items detected)

Memory Modules Detected: 0

(No malicious items detected)

Registry Keys Detected: 0

(No malicious items detected)

Registry Values Detected: 0

(No malicious items detected)

Registry Data Items Detected: 0

(No malicious items detected)

Folders Detected: 0

(No malicious items detected)

Files Detected: 0

(No malicious items detected)

Physical Sectors Detected: 0

(No malicious items detected)

(end)

---------------------------------------

Malwarebytes Anti-Rootkit BETA 1.06.0.1003

OS version: 5.1.2600 Windows XP Service Pack 3 x86

Account is Administrative

Internet Explorer version: 7.0.5730.11

File system is: NTFS

Disk drives: C:\ DRIVE_FIXED

CPU speed: 2.210000 GHz

Memory total: 3623317504, free: 2791817216

Downloaded database version: v2013.06.03.01

Downloaded database version: v2013.05.22.01

Initializing...

------------ Kernel report ------------

06/02/2013 22:37:08

------------ Loaded modules -----------

\WINDOWS\system32\ntkrnlpa.exe

\WINDOWS\system32\hal.dll

\WINDOWS\system32\KDCOM.DLL

\WINDOWS\system32\BOOTVID.dll

ACPI.sys

\WINDOWS\System32\DRIVERS\WMILIB.SYS

pci.sys

isapnp.sys

ohci1394.sys

\WINDOWS\System32\DRIVERS\1394BUS.SYS

MountMgr.sys

ftdisk.sys

dmload.sys

dmio.sys

nvraid.sys

\WINDOWS\system32\drivers\CLASSPNP.SYS

PartMgr.sys

VolSnap.sys

nvatabus.sys

Si3114r5.sys

\WINDOWS\System32\DRIVERS\SCSIPORT.SYS

nvata.sys

disk.sys

fltmgr.sys

drvmcdb.sys

SiWinAcc.sys

PxHelp20.sys

KSecDD.sys

Ntfs.sys

NDIS.sys

SiRemFil.sys

Mup.sys

\SystemRoot\System32\DRIVERS\AmdK8.sys

\SystemRoot\System32\DRIVERS\usbohci.sys

\SystemRoot\System32\DRIVERS\USBPORT.SYS

\SystemRoot\System32\Drivers\ousbehci.sys

\SystemRoot\system32\drivers\ALCXWDM.SYS

\SystemRoot\system32\drivers\portcls.sys

\SystemRoot\system32\drivers\drmk.sys

\SystemRoot\system32\drivers\ks.sys

\SystemRoot\System32\DRIVERS\imapi.sys

\SystemRoot\System32\Drivers\DLACDBHM.SYS

\SystemRoot\System32\DRIVERS\cdrom.sys

\SystemRoot\System32\DRIVERS\redbook.sys

\SystemRoot\System32\Drivers\GEARAspiWDM.sys

\SystemRoot\system32\DRIVERS\ubohci.sys

\SystemRoot\system32\DRIVERS\UB1394.SYS

\SystemRoot\System32\DRIVERS\nvnetbus.sys

\SystemRoot\System32\DRIVERS\NVNRM.SYS

\SystemRoot\System32\DRIVERS\yk51x86.sys

\SystemRoot\System32\DRIVERS\nv4_mini.sys

\SystemRoot\System32\DRIVERS\VIDEOPRT.SYS

\SystemRoot\System32\DRIVERS\fdc.sys

\SystemRoot\system32\DRIVERS\dfmirage.sys

\SystemRoot\system32\DRIVERS\lmimirr.sys

\SystemRoot\System32\DRIVERS\audstub.sys

\SystemRoot\System32\DRIVERS\rasl2tp.sys

\SystemRoot\System32\DRIVERS\ndistapi.sys

\SystemRoot\System32\DRIVERS\ndiswan.sys

\SystemRoot\System32\DRIVERS\raspppoe.sys

\SystemRoot\System32\DRIVERS\raspptp.sys

\SystemRoot\System32\DRIVERS\TDI.SYS

\SystemRoot\System32\DRIVERS\psched.sys

\SystemRoot\System32\DRIVERS\msgpc.sys

\SystemRoot\System32\DRIVERS\ptilink.sys

\SystemRoot\System32\DRIVERS\raspti.sys

\SystemRoot\System32\DRIVERS\rdpdr.sys

\SystemRoot\System32\DRIVERS\termdd.sys

\SystemRoot\System32\DRIVERS\kbdclass.sys

\SystemRoot\System32\DRIVERS\mouclass.sys

\SystemRoot\System32\DRIVERS\swenum.sys

\SystemRoot\System32\DRIVERS\update.sys

\SystemRoot\System32\DRIVERS\mssmbios.sys

\SystemRoot\system32\DRIVERS\AmdLLD.sys

\SystemRoot\System32\DRIVERS\flpydisk.sys

\SystemRoot\System32\Drivers\NDProxy.SYS

\SystemRoot\System32\DRIVERS\usbhub.sys

\SystemRoot\System32\DRIVERS\USBD.SYS

\SystemRoot\system32\DRIVERS\ousb2hub.sys

\SystemRoot\System32\DRIVERS\NVENETFD.sys

\SystemRoot\system32\DRIVERS\eamon.sys

\SystemRoot\System32\Drivers\Fs_Rec.SYS

\SystemRoot\System32\Drivers\Null.SYS

\SystemRoot\System32\Drivers\Beep.SYS

\SystemRoot\System32\Drivers\DLARTL_M.SYS

\SystemRoot\system32\DRIVERS\ehdrv.sys

\SystemRoot\system32\DRIVERS\HIDPARSE.SYS

\SystemRoot\System32\drivers\vga.sys

\SystemRoot\System32\Drivers\mnmdd.SYS

\SystemRoot\System32\DRIVERS\RDPCDD.sys

\SystemRoot\System32\Drivers\Msfs.SYS

\SystemRoot\System32\Drivers\Npfs.SYS

\SystemRoot\System32\DRIVERS\rasacd.sys

\SystemRoot\system32\DRIVERS\ipsec.sys

\SystemRoot\System32\DRIVERS\tcpip.sys

\SystemRoot\System32\DRIVERS\netbt.sys

\SystemRoot\System32\DRIVERS\ipnat.sys

\SystemRoot\system32\DRIVERS\epfwtdir.sys

\SystemRoot\System32\drivers\ws2ifsl.sys

\SystemRoot\System32\DRIVERS\wanarp.sys

\SystemRoot\System32\drivers\afd.sys

\SystemRoot\System32\DRIVERS\netbios.sys

\SystemRoot\System32\DRIVERS\rdbss.sys

\SystemRoot\System32\DRIVERS\mrxsmb.sys

\SystemRoot\System32\Drivers\Fips.SYS

\SystemRoot\System32\Drivers\Cinemsup.SYS

\SystemRoot\System32\Drivers\Cdfs.SYS

\SystemRoot\system32\DRIVERS\usbccgp.sys

\SystemRoot\system32\DRIVERS\usbprint.sys

\SystemRoot\system32\DRIVERS\hidusb.sys

\SystemRoot\system32\DRIVERS\HIDCLASS.SYS

\SystemRoot\System32\Drivers\LEqdUsb.Sys

\SystemRoot\System32\Drivers\WDFLDR.SYS

\SystemRoot\System32\Drivers\wdf01000.sys

\SystemRoot\system32\DRIVERS\kbdhid.sys

\SystemRoot\System32\DRIVERS\mouhid.sys

\SystemRoot\System32\Drivers\LHidEqd.Sys

\SystemRoot\system32\DRIVERS\lvuvcflt.sys

\SystemRoot\system32\DRIVERS\LHidFilt.Sys

\SystemRoot\system32\DRIVERS\LMouFilt.Sys

\SystemRoot\system32\DRIVERS\LVMVDrv.sys

\SystemRoot\system32\drivers\LVUSBSta.sys

\SystemRoot\system32\DRIVERS\lvuvc.sys

\SystemRoot\system32\DRIVERS\lvpopflt.sys

\SystemRoot\system32\drivers\usbaudio.sys

\SystemRoot\system32\DRIVERS\LVcKap.sys

\SystemRoot\system32\DRIVERS\usbscan.sys

\SystemRoot\System32\Drivers\dump_nvraid.sys

\SystemRoot\System32\Drivers\dump_CLASSPNP.SYS

\SystemRoot\System32\win32k.sys

\SystemRoot\System32\drivers\Dxapi.sys

\SystemRoot\System32\watchdog.sys

\SystemRoot\System32\drivers\dxg.sys

\SystemRoot\System32\drivers\dxgthk.sys

\SystemRoot\System32\nv4_disp.dll

\SystemRoot\System32\ATMFD.DLL

\SystemRoot\System32\Drivers\DRVNDDM.SYS

\SystemRoot\System32\DLA\DLADResM.SYS

\SystemRoot\System32\DLA\DLAIFS_M.SYS

\SystemRoot\System32\DLA\DLAOPIOM.SYS

\SystemRoot\System32\DLA\DLAPoolM.SYS

\SystemRoot\System32\Drivers\DefragFS.SYS

\SystemRoot\System32\DLA\DLABMFSM.SYS

\SystemRoot\System32\DLA\DLABOIOM.SYS

\SystemRoot\System32\DLA\DLAUDFAM.SYS

\SystemRoot\System32\DLA\DLAUDF_M.SYS

\SystemRoot\System32\DRIVERS\ndisuio.sys

\SystemRoot\system32\DRIVERS\pnarp.sys

\SystemRoot\system32\DRIVERS\purendis.sys

\SystemRoot\System32\Drivers\LBeepKE.sys

\SystemRoot\system32\DRIVERS\srv.sys

\??\C:\Program Files\LogMeIn\x86\RaInfo.sys

\??\C:\WINDOWS\system32\drivers\LMIRfsDriver.sys

\SystemRoot\system32\drivers\npf.sys

\SystemRoot\system32\DRIVERS\ubsbm.sys

\SystemRoot\system32\DRIVERS\ubumapi.sys

\??\C:\WINDOWS\system32\Drivers\uphcleanhlp.sys

\SystemRoot\system32\drivers\sysaudio.sys

\SystemRoot\system32\drivers\wdmaud.sys

\SystemRoot\system32\DRIVERS\LVPr2Mon.sys

\SystemRoot\System32\Drivers\HTTP.sys

\??\C:\Program Files\TuneUp Utilities 2013\TuneUpUtilitiesDriver32.sys

\SystemRoot\System32\Drivers\TDTCP.SYS

\SystemRoot\System32\Drivers\RDPWD.SYS

\SystemRoot\System32\Drivers\Fastfat.SYS

\SystemRoot\System32\DRIVERS\ipfltdrv.sys

\SystemRoot\System32\DRIVERS\sr.sys

\SystemRoot\system32\DRIVERS\asyncmac.sys

\SystemRoot\system32\drivers\kmixer.sys

\??\C:\WINDOWS\system32\drivers\mbamchameleon.sys

\??\C:\WINDOWS\system32\drivers\mbamswissarmy.sys

\WINDOWS\system32\ntdll.dll

----------- End -----------

Done!

<<<1>>>

Upper Device Name: \Device\Harddisk0\DR0

Upper Device Object: 0xffffffff8b0af728

Upper Device Driver Name: \Driver\Disk\

Lower Device Name: \Device\00000080\

Lower Device Object: 0xffffffff8b08f1c8

Lower Device Driver Name: \Driver\nvraid\

<<<2>>>

Device number: 0, partition: 1

Physical Sector Size: 512

Drive: 0, DevicePointer: 0xffffffff8b0af728, DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\Disk\

--------- Disk Stack ------

DevicePointer: 0xffffffff8b054cc8, DeviceName: Unknown, DriverName: \Driver\SiRemFil\

DevicePointer: 0xffffffff8b054e08, DeviceName: Unknown, DriverName: \Driver\PartMgr\

DevicePointer: 0xffffffff8b0af728, DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\Disk\

DevicePointer: 0xffffffff8b08f1c8, DeviceName: \Device\00000080\, DriverName: \Driver\nvraid\

------------ End ----------

Alternate DeviceName: Unknown, DriverName: \Driver\PartMgr\

Upper DeviceData: 0x0, 0x0, 0x0

Lower DeviceData: 0x0, 0x0, 0x0

<<<3>>>

Volume: C:

File system type: NTFS

SectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytes

<<<2>>>

Device number: 0, partition: 1

<<<3>>>

Volume: C:

File system type: NTFS

SectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytes

Scanning drivers directory: C:\WINDOWS\system32\drivers...

<<<2>>>

Device number: 0, partition: 1

<<<3>>>

Volume: C:

File system type: NTFS

SectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytes

The directory C:\WINDOWS\system32\drivers seems inaccessible or encrypted.

Drivers scan is aborted.

Done!

Drive 0

Scanning MBR on drive 0...

Inspecting partition table:

MBR Signature: 55AA

Disk Signature: FFFFFFFF

Partition information:

Partition 0 type is Primary (0x7)

Partition is ACTIVE.

Partition starts at LBA: 63 Numsec = 390700737

Partition file system is NTFS

Partition is bootable

Partition 1 type is Empty (0x0)

Partition is NOT ACTIVE.

Partition starts at LBA: 0 Numsec = 0

Partition 2 type is Empty (0x0)

Partition is NOT ACTIVE.

Partition starts at LBA: 0 Numsec = 0

Partition 3 type is Empty (0x0)

Partition is NOT ACTIVE.

Partition starts at LBA: 0 Numsec = 0

Disk Size: 200049623040 bytes

Sector size: 512 bytes

Scanning physical sectors of unpartitioned space on drive 0 (1-62-390701920-390721920)...

Done!

Scan finished

=======================================

Removal queue found; removal started

Removing c:\documents and settings\all users\application data\malwarebytes' anti-malware (portable)\mbr_0_i.mbam...

Removing c:\documents and settings\all users\application data\malwarebytes' anti-malware (portable)\bootstrap_0_0_63_i.mbam...

Removing c:\documents and settings\all users\application data\malwarebytes' anti-malware (portable)\mbr_0_r.mbam...

Removal finished

However, while I am in my browser, MB keeps blocking an attempted outgoing connection to the same IP (46.229.165.2).

Thanks, Gary

MrCharlie · June 3, 2013

Here's that ip address:

The most important things to remember when running it is to disable all your malware programs and run Combofix from your desktop.

Please visit this webpage for download links, and instructions for running ComboFix

http://www.bleepingc...to-use-combofix

Ensure you have disabled all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

Information on disabling your malware programs can be found Here.

Make sure you run ComboFix from your desktop.

Give it at least 30-45 minutes to finish if needed.

Please include the C:\ComboFix.txt in your next reply for further review.

---------->NOTE<----------

If you get the message Illegal operation attempted on registry key that has been marked for deletion after you run ComboFix....please reboot the computer, this should resolve the problem. You may have to do this several times if needed.

MrC

gtdriski · June 8, 2013

MrCharlie,

Sorry for the delay. Here is the ComboFix report:

ComboFix 13-06-07.03 - GaryT 06/07/2013 18:30:54.4.2 - x86

Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.3455.2658 [GMT -4:00]

Running from: c:\documents and settings\GaryT\Desktop\ComboFix.exe

AV: ESET NOD32 Antivirus 6.0 *Disabled/Updated* {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\windows\EventSystem.log

.

((((((((((((((((((((((((( Files Created from 2013-05-07 to 2013-06-07 )))))))))))))))))))))))))))))))

.

2013-06-03 02:37 . 2013-06-03 02:51 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes' Anti-Malware (portable)

2013-06-03 02:36 . 2013-06-03 02:36 35144 ----a-w- c:\windows\system32\drivers\mbamchameleon.sys

2013-05-13 05:25 . 2013-05-13 05:25 -------- d-----w- c:\documents and settings\GaryT\Local Settings\Application Data\Sun

2013-05-13 03:36 . 2013-05-13 03:36 -------- d-----w- c:\program files\Common Files\Java

2013-05-13 03:36 . 2013-05-13 03:35 144896 ----a-w- c:\windows\system32\javacpl.cpl

2013-05-13 03:36 . 2013-05-13 03:35 94112 ----a-w- c:\windows\system32\WindowsAccessBridge.dll

2013-05-13 03:35 . 2013-05-13 03:35 -------- d-----w- c:\program files\Java

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2013-05-27 22:02 . 2012-04-04 22:07 692104 ----a-w- c:\windows\system32\FlashPlayerApp.exe

2013-05-27 22:02 . 2011-05-25 00:30 71048 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl

2013-05-13 03:35 . 2012-08-16 01:34 866720 ----a-w- c:\windows\system32\npdeployJava1.dll

2013-05-13 03:35 . 2010-05-14 05:08 788896 ----a-w- c:\windows\system32\deployJava1.dll

2013-04-16 21:59 . 2005-04-27 14:54 841216 ----a-w- c:\windows\system32\wininet.dll

2013-04-16 21:59 . 2003-03-31 12:00 1830912 ----a-w- c:\windows\system32\inetcpl.cpl

2013-04-16 21:59 . 2004-08-04 07:56 78336 ----a-w- c:\windows\system32\ieencode.dll

2013-04-16 21:59 . 2003-03-31 12:00 17408 ----a-w- c:\windows\system32\corpol.dll

2013-04-12 23:28 . 2004-08-04 05:59 389120 ----a-w- c:\windows\system32\html.iec

2013-04-10 01:31 . 2009-05-11 00:18 1876352 ----a-w- c:\windows\system32\win32k.sys

2013-04-04 18:50 . 2011-01-05 17:12 22856 ----a-w- c:\windows\system32\drivers\mbam.sys

2009-10-31 20:13 . 2009-11-02 08:13 44 ---h--w- c:\program files\dd2c2250.tmp

2003-08-27 18:19 . 2005-08-07 18:05 36963 ----a-w- c:\program files\Common Files\SM1updtr.dll

2012-02-23 21:09 . 2013-05-19 04:44 113976 ----a-w- c:\program files\mozilla firefox\plugins\atgpcdec.dll

2012-02-23 21:09 . 2013-05-19 04:44 449848 ----a-w- c:\program files\mozilla firefox\plugins\atgpcext.dll

2011-03-03 18:52 . 2013-05-19 04:44 46392 ----a-w- c:\program files\mozilla firefox\plugins\atmccli.dll

2011-03-03 18:52 . 2013-05-19 04:44 99208 ----a-w- c:\program files\mozilla firefox\plugins\ieatgpc.dll

2010-03-31 15:09 . 2013-05-19 04:44 10437264 ----a-w- c:\program files\mozilla firefox\plugins\PDFNetC.dll

2010-04-08 16:35 . 2013-05-19 04:44 9822960 ----a-r- c:\program files\mozilla firefox\plugins\ScorchAxPlugin.dll

2010-04-08 17:36 . 2013-05-19 04:44 107760 ----a-w- c:\program files\mozilla firefox\plugins\ScorchPDFWrapper.dll

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\BackupIconOverlayId]

@="{2EE61E5C-8F94-4AAB-8A80-D2A8CD1FEDAD}"

[HKEY_CLASSES_ROOT\CLSID\{2EE61E5C-8F94-4AAB-8A80-D2A8CD1FEDAD}]

2009-04-21 09:17 233472 ------w- c:\program files\SOS Online Backup\CtxMenu_1_0_0_10.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]

@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"

[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]

2011-10-31 21:02 94208 ----a-w- c:\documents and settings\GaryT\Application Data\Dropbox\bin\DropboxExt.14.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]

@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"

[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]

2011-10-31 21:02 94208 ----a-w- c:\documents and settings\GaryT\Application Data\Dropbox\bin\DropboxExt.14.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]

@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"

[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]

2011-10-31 21:02 94208 ----a-w- c:\documents and settings\GaryT\Application Data\Dropbox\bin\DropboxExt.14.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt4]

@="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}"

[HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}]

2011-10-31 21:02 94208 ----a-w- c:\documents and settings\GaryT\Application Data\Dropbox\bin\DropboxExt.14.dll

.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-03-31 68856]

"Skype"="c:\program files\Skype\Phone\Skype.exe" [2013-02-28 18642024]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"egui"="c:\program files\ESET\ESET NOD32 Antivirus\egui.exe" [2013-03-21 5078504]

"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2013-03-12 253816]

"Intuit SyncManager"="c:\program files\Common Files\Intuit\Sync\IntuitSyncManager.exe" [2013-03-01 2778424]

"amd_dc_opt"="c:\program files\AMD\Dual-Core Optimizer\amd_dc_opt.exe" [2008-07-22 77824]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]

"UIHost"="c:\windows\system32\logonui.exe"

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LBTWlgn]

2010-10-28 10:13 64592 ----a-w- c:\program files\Common Files\Logishrd\Bluetooth\LBTWLgn.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LMIinit]

2010-06-10 00:08 87424 ----a-w- c:\windows\system32\LMIinit.dll

.

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]

BootExecute REG_MULTI_SZ PDBoot.exe\0autocheck autochk *\0sasnative32

.

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]

@="Driver"

.

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Intuit Data Protect.lnk]

path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Intuit Data Protect.lnk

backup=c:\windows\pss\Intuit Data Protect.lnkCommon Startup

.

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^QuickBooks Update Agent.lnk]

path=c:\documents and settings\All Users\Start Menu\Programs\Startup\QuickBooks Update Agent.lnk

backup=c:\windows\pss\QuickBooks Update Agent.lnkCommon Startup

.

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^QuickBooks_Standard_21.lnk]

path=c:\documents and settings\All Users\Start Menu\Programs\Startup\QuickBooks_Standard_21.lnk

backup=c:\windows\pss\QuickBooks_Standard_21.lnkCommon Startup

.

[HKLM\~\startupfolder\C:^Documents and Settings^GaryT^Start Menu^Programs^Startup^Dropbox.lnk]

path=c:\documents and settings\GaryT\Start Menu\Programs\Startup\Dropbox.lnk

backup=c:\windows\pss\Dropbox.lnkStartup

.

[HKLM\~\startupfolder\C:^Documents and Settings^GaryT^Start Menu^Programs^Startup^EvernoteClipper.lnk]

path=c:\documents and settings\GaryT\Start Menu\Programs\Startup\EvernoteClipper.lnk

backup=c:\windows\pss\EvernoteClipper.lnkStartup

.

[HKLM\~\startupfolder\C:^Documents and Settings^GaryT^Start Menu^Programs^Startup^Jawbone Updater.lnk]

path=c:\documents and settings\GaryT\Start Menu\Programs\Startup\Jawbone Updater.lnk

backup=c:\windows\pss\Jawbone Updater.lnkStartup

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EvtMgr6]

2012-10-06 08:16 1843512 ----a-w- c:\program files\Logitech\SetPointP\SetPoint.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSPM Startup]

2005-08-11 20:30 249856 ----a-w- c:\program files\Common Files\InstallShield\UpdateService\ISUSPM.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSScheduler]

2008-10-24 14:14 79136 ----a-w- c:\program files\Common Files\InstallShield\UpdateService\issch.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogitechCommunicationsManager]

2007-02-08 05:12 488984 ----a-w- c:\program files\Common Files\Logishrd\LComMgr\Communications_Helper.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogitechQuickCamRibbon]

2007-02-08 05:13 774168 ----a-w- c:\program files\Logitech\QuickCam10\QuickCam10.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogMeIn GUI]

2008-07-24 22:46 63048 ----a-w- c:\program files\LogMeIn\x86\LogMeInSystray.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LTMSG]

2003-07-14 14:52 40960 ----a-w- c:\windows\ltmsg.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nmapp]

2009-07-08 06:53 472112 ----a-w- c:\program files\Pure Networks\Network Magic\nmapp.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nmctxth]

2009-07-07 18:48 647216 ----a-w- c:\program files\Common Files\Pure Networks Shared\Platform\nmctxth.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMan]

2007-04-16 19:28 577536 ----a-w- c:\windows\soundman.exe

.

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]

"ctfmon.exe"=c:\windows\system32\ctfmon.exe

"MemoryZipperPlus"="c:\program files\Memzip\memzip.exe"

"DriverMax"="c:\program files\Innovative Solutions\DriverMax\devices.exe" -agent

"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]

"LiveMonitor"=c:\program files\MSI\Live Update 3\LMonitor.exe

"Corel Photo Downloader"="c:\program files\Common Files\Corel\Corel PhotoDownloader\Corel Photo Downloader.exe" -startup

"QuickTime Task"="c:\program files\QuickTime\qttask.exe" -atboottime

"bwprnmon.exe"=c:\bitware\NT\bwprnmon.exe

"RoxioDragToDisc"="c:\program files\Roxio\Drag-to-Disc\DrgToDsc.exe"

"SoundMan"=SOUNDMAN.EXE

"RoxWatchTray"="c:\program files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe"

"DMXLauncher"="c:\program files\Roxio\Media Experience\DMXLauncher.exe"

"NVRaidService"="c:\windows\System32\nvraidservice.exe"

"LogitechCommunicationsManager"="c:\program files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe"

"SM1BG"="c:\windows\SM1BG.EXE"

"KernelFaultCheck"=%systemroot%\system32\dumprep 0 -k

"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe"

"Adobe Acrobat Speed Launcher"="c:\program files\Adobe\Acrobat 9.0\Acrobat\Acrobat_sl.exe"

"Acrobat Assistant 8.0"="c:\program files\Adobe\Acrobat 9.0\Acrobat\Acrotray.exe"

"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"

.

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

"c:\\WINDOWS\\system32\\fxsclnt.exe"=

"c:\\Program Files\\Savings Bond Wizard\\SBWizard.exe"=

"c:\\WINDOWS\\system32\\mmc.exe"=

"c:\\Program Files\\iTunes\\iTunes.exe"=

"c:\\Program Files\\Macromedia\\Dreamweaver 8\\Dreamweaver.exe"=

"c:\\WINDOWS\\system32\\dpvsetup.exe"=

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

"c:\\Program Files\\Web CEO\\BIN\\webceo.exe"=

"c:\\Program Files\\Web CEO\\BIN\\wsceokrnl.dll"=

"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=

"c:\\Program Files\\Paros\\IEEmbed.exe"=

"c:\\Program Files\\TeamViewer\\Version6\\TeamViewer.exe"=

"c:\\Program Files\\TeamViewer\\Version6\\TeamViewer_Service.exe"=

"c:\\Documents and Settings\\GaryT\\Application Data\\Dropbox\\bin\\Dropbox.exe"=

"c:\\Program Files\\SmartFTP Client\\SmartFTP.exe"=

"c:\\Program Files\\Mozilla Firefox\\plugin-container.exe"=

"c:\\Program Files\\Intuit\\QuickBooks 2006\\QBDBMgrN.exe"=

"c:\\Program Files\\Jawbone\\JawboneUpdater.exe"=

"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

"c:\program files\Common Files\Pure Networks Shared\Platform\nmsrvc.exe"= c:\program files\Common Files\Pure Networks Shared\Platform\nmsrvc.exe:LocalSubNet,0.0.0.0/255.255.255.255:Enabled:Pure Networks Platform Service

.

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]

"3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009

"67:UDP"= 67:UDP:DHCP Discovery Service

.

R1 ehdrv;ehdrv;c:\windows\system32\drivers\ehdrv.sys [3/14/2012 9:40 AM 122240]

R1 epfwtdir;epfwtdir;c:\windows\system32\drivers\epfwtdir.sys [3/14/2012 9:40 AM 105784]

R2 ekrn;ESET Service;c:\program files\ESET\ESET NOD32 Antivirus\ekrn.exe [3/21/2013 3:19 PM 1341664]

R2 L4301_Solar;Logitech Solar Keyboard Service;c:\program files\Logitech\SolarApp\L4301_Solar.exe [10/26/2010 5:25 PM 319568]

R2 LBeepKE;Logitech Beep Suppression Driver;c:\windows\system32\drivers\LBeepKE.sys [6/14/2011 11:55 PM 12216]

R2 LMIInfo;LogMeIn Kernel Information Provider;c:\program files\LogMeIn\x86\rainfo.sys [7/24/2008 6:46 PM 12856]

R2 MBAMScheduler;MBAMScheduler;c:\program files\Malwarebytes' Anti-Malware\mbamscheduler.exe [9/12/2012 7:13 PM 418376]

R2 npf;NetGroup Packet Filter Driver;c:\windows\system32\drivers\npf.sys [3/15/2009 4:13 PM 34064]

R2 ousbehci;OrangeWare USB Enhanced Host Controller Service;c:\windows\system32\drivers\ousbehci.sys [10/12/2009 2:46 AM 45824]

R2 QBVSS;QBIDPService;c:\program files\Common Files\Intuit\DataProtect\QBIDPService.exe [8/19/2011 9:31 PM 1248256]

R2 TuneUp.UtilitiesSvc;TuneUp Utilities Service;c:\program files\TuneUp Utilities 2013\TuneUpUtilitiesService32.exe [1/31/2013 5:35 AM 1724192]

R2 ubsbm;Unibrain 1394 SBM Driver;c:\windows\system32\drivers\UBSBM.sys [7/27/2005 5:25 PM 14080]

R2 ubumapi;Unibrain 1394 FireAPI Driver;c:\windows\system32\drivers\UBUMAPI.sys [7/27/2005 5:25 PM 36352]

R2 vpnagent;Cisco AnyConnect VPN Agent;c:\program files\Cisco\Cisco AnyConnect VPN Client\vpnagent.exe [9/22/2011 2:43 PM 645048]

R3 dfmirage;dfmirage;c:\windows\system32\drivers\dfmirage.sys [11/25/2005 5:43 PM 31896]

R3 LEqdUsb;Logitech SetPoint Unifying KMDF USB Filter;c:\windows\system32\drivers\LEqdUsb.sys [8/24/2010 1:30 PM 43704]

R3 LHidEqd;Logitech SetPoint Unifying KMDF HID Filter;c:\windows\system32\drivers\LHidEqd.sys [8/24/2010 1:30 PM 12216]

R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [1/5/2011 1:12 PM 22856]

R3 ousb2hub;OrangeWare USB 2.0 Root Hub Support;c:\windows\system32\drivers\ousb2hub.sys [10/12/2009 2:46 AM 56960]

R3 TuneUpUtilitiesDrv;TuneUpUtilitiesDrv;c:\program files\TuneUp Utilities 2013\TuneUpUtilitiesDriver32.sys [9/18/2012 4:02 PM 10088]

R3 ubohci;Unibrain 1394 OHCI Driver;c:\windows\system32\drivers\ubohci.sys [7/27/2005 5:25 PM 77056]

S2 MBAMService;MBAMService;c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe [1/5/2011 1:12 PM 701512]

S2 Skype C2C Service;Skype C2C Service;c:\documents and settings\All Users\Application Data\Skype\Toolbars\Skype C2C Service\c2c_service.exe [1/31/2013 10:38 AM 3289208]

S2 SkypeUpdate;Skype Updater;c:\program files\Skype\Updater\Updater.exe [2/28/2013 6:45 PM 161384]

S3 FileShd;FileShd;c:\windows\system32\drivers\fileshd2.sys [9/10/2007 4:13 PM 69888]

S3 libusb0;Jawbone LibUsb-Win32 - Kernel Driver 09/22/2011,1.2.5.0;c:\windows\system32\drivers\libusb0.sys [5/13/2011 12:17 AM 42592]

S3 mbamchameleon;mbamchameleon;c:\windows\system32\drivers\mbamchameleon.sys [6/2/2013 10:36 PM 35144]

S3 PCAlertDriver;PCAlertDriver;c:\program files\MSI\Core Center\NTGLM7X.SYS [10/2/2005 1:15 AM 22432]

S3 Revoflt;Revoflt;c:\windows\system32\drivers\revoflt.sys [7/11/2010 1:36 AM 27064]

.

--- Other Services/Drivers In Memory ---

.

*Deregistered* - uphcleanhlp

.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs

UxTuneUp

.

Contents of the 'Scheduled Tasks' folder

.

2013-06-03 c:\windows\Tasks\AppleSoftwareUpdate.job

- c:\program files\Apple Software Update\SoftwareUpdate.exe [2007-08-29 19:57]

.

2013-06-07 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job

- c:\program files\Google\Update\GoogleUpdate.exe [2010-02-03 01:24]

.

2013-06-07 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job

- c:\program files\Google\Update\GoogleUpdate.exe [2010-02-03 01:24]

.

2013-06-07 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-796845957-1647877149-725345543-1003Core.job

- c:\documents and settings\GaryT\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2011-08-18 23:00]

.

2013-06-07 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-796845957-1647877149-725345543-1003UA.job

- c:\documents and settings\GaryT\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2011-08-18 23:00]

.

2013-06-07 c:\windows\Tasks\SOS Online Backup - Driskill.job

- c:\program files\sos online backup\sosuploadagent.exe [2009-04-28 06:38]

.

2013-06-07 c:\windows\Tasks\User_Feed_Synchronization-{6B4B2B2E-0337-436A-93B3-0954C8510B04}.job

- c:\windows\system32\msfeedssync.exe [2006-10-17 16:58]

.

------- Supplementary Scan -------

.

uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8

uStart Page = hxxp://cm.my.yahoo.com/?rd=nux

uSearchAssistant = hxxp://www.google.com/ie

uSearchURL,(Default) = hxxp://www.google.com/keyword/%s

IE: Add to Evernote 4.0 - c:\program files\Evernote\Evernote\EvernoteIE.dll/204

IE: Append Link Target to Existing PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html

IE: Append to Existing PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html

IE: Convert Link Target to Adobe PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html

IE: Convert selected links to Adobe PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html

IE: Convert selected links to existing PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html

IE: Convert selection to Adobe PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html

IE: Convert selection to existing PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html

IE: Convert to Adobe PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECapture.html

IE: Easy-WebPrint Add To Print List - c:\program files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html

IE: Easy-WebPrint High Speed Print - c:\program files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html

IE: Easy-WebPrint Preview - c:\program files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html

IE: Easy-WebPrint Print - c:\program files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html

Trusted Zone: microsoft.com\drmlicense.one

TCP: DhcpNameServer = 208.67.222.222 208.67.220.220 38.116.38.49