please help

justime · July 18, 2013

i have been trying to fix this myself and it just seems to be getting worse... that being said this is some of the problems i am having .

i had a friend use my computer for a time and somehow he installed some thing called bearshare or something like that and it changed all my homepages in all my browsers and now i cannot move music files from windows media to itunes in the directory OR access the directory at all.(i can view it but cannot open many things i used to be able to) i have all these little locks on my file icons and my cpu usage is at 100% a lot of the time.i have my file options set to show all hidden files and folders but i still cannot access the files that i need to . I am the administrator i know that i tried to get it fixed through you a few weeks ago but i am very busy with work ... my schedule has changed and i do not go to work tell noon so i have a little more time now. here is the scans that you asked for before i think i really hope this is right

ark.txt

Extras.Txt

OTL.Txt

system-log.txt

Psychotic · July 18, 2013

Hi there,
my name is Marius and I will be assisting you with your Malware related problems.

Before we move on, please read the following points carefully.

First, read my instructions completely. If there is anything that you do not understand kindly ask before proceeding.
Perform everything in the correct order. Sometimes one step requires the previous one.
If you have any problems while you are follow my instructions, Stop there and tell me the exact nature of your problem.
Do not run any other scans without instruction or Add/ Remove Software unless I tell you to do so. This would change the output of our tools and could be confusing for me.
Post all Logfiles as a reply rather than as an attachment unless I specifically ask you. If you can not post all logfiles in one reply, feel free to use more posts.
If I don't hear from you within 3 days from this initial or any subsequent post, then this thread will be closed.
Stay with me. I will give you some advice about prevention after the cleanup process. Absence of symptoms does not always mean the computer is clean.
My first language is not english. So please do not use slang or idioms. It could be hard for me to read. Thanks for your understanding.

Combofix

Combofix should only be run when adviced by a team member!

Link

Important - Save the file to your desktop!

Deactivate any and all of your antivirus programs /spyware scanners - they can prevent CF from doing its work.
Run Combofix.exe

When finished, Combofix creates a log file named C:\Combofix.txt. Please post its content in your next reply.

Note: When receiving an error message containing ""Illegal operation attempted on a registry key that has been marked for deletion" simply restart your computer to fix this.

justime · July 18, 2013

Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.1979.937 [GMT -8:00]

Running from: c:\users\Administrator\Downloads\ComboFix.exe

SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\users\Nyamuoch\Documents\~WRL0585.tmp

.

((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.

-------\Service_AudioSrv

.

((((((((((((((((((((((((( Files Created from 2013-06-18 to 2013-07-18 )))))))))))))))))))))))))))))))

.

2013-07-18 07:31 . 2013-07-18 07:31 -------- d-----w- c:\users\Nyamuoch\AppData\Local\temp

2013-07-18 07:31 . 2013-07-18 07:31 -------- d-----w- c:\users\music\AppData\Local\temp

2013-07-18 07:31 . 2013-07-18 07:31 -------- d-----w- c:\users\Guest\AppData\Local\temp

2013-07-18 07:31 . 2013-07-18 07:31 -------- d-----w- c:\users\Default\AppData\Local\temp

2013-07-16 08:36 . 2013-07-02 08:34 9460976 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{4C9595A6-CF60-4371-8B54-424D2ACCD112}\mpengine.dll

2013-07-16 08:21 . 2013-07-16 08:21 -------- d-----w- c:\users\Administrator\AppData\Roaming\RealNetworks

2013-07-11 02:41 . 2013-04-10 05:46 1367040 ----a-w- c:\program files\Common Files\Microsoft Shared\ink\journal.dll

2013-07-11 02:40 . 2013-04-02 22:51 1643520 ----a-w- c:\windows\system32\DWrite.dll

2013-07-11 02:40 . 2013-04-09 23:34 1247744 ----a-w- c:\windows\SysWow64\DWrite.dll

2013-07-07 10:09 . 2013-07-07 10:10 -------- d-----w- c:\program files (x86)\SearchProtect

2013-07-07 10:09 . 2013-07-07 10:12 -------- d-----w- c:\users\Administrator\AppData\Roaming\SearchProtect

2013-07-07 10:09 . 2013-07-07 10:09 -------- d-----w- c:\users\Administrator\AppData\Local\CRE

2013-07-06 22:33 . 2013-07-06 22:33 -------- d-----w- c:\program files (x86)\Mozilla Maintenance Service

2013-07-06 22:16 . 2013-07-06 22:16 -------- d-----w- c:\users\Administrator\AppData\Local\DriverTuner

2013-07-06 21:09 . 2013-07-06 21:09 -------- d-----w- c:\users\Administrator\AppData\Local\Cyberlink

2013-07-03 13:52 . 2013-03-19 05:53 48640 ----a-w- c:\windows\system32\wwanprotdim.dll

2013-07-03 13:52 . 2013-03-19 05:53 230400 ----a-w- c:\windows\system32\wwansvc.dll

2013-07-03 13:52 . 2013-04-17 06:24 1424384 ----a-w- c:\windows\system32\WindowsCodecs.dll

2013-07-03 13:52 . 2013-04-17 07:02 1230336 ----a-w- c:\windows\SysWow64\WindowsCodecs.dll

2013-07-03 13:52 . 2013-05-10 05:49 30720 ----a-w- c:\windows\system32\cryptdlg.dll

2013-07-03 13:52 . 2013-05-10 03:20 24576 ----a-w- c:\windows\SysWow64\cryptdlg.dll

2013-07-03 13:52 . 2013-03-31 22:52 1887232 ----a-w- c:\windows\system32\d3d11.dll

2013-07-03 13:52 . 2013-04-25 23:30 1505280 ----a-w- c:\windows\SysWow64\d3d11.dll

2013-07-01 03:58 . 2013-07-06 21:07 -------- d-----w- c:\users\Administrator\AppData\Roaming\CyberLink

2013-06-21 04:08 . 2013-06-21 14:30 -------- d-----w- c:\programdata\Malwarebytes' Anti-Malware (portable)

2013-06-19 02:03 . 2013-06-19 02:03 -------- d-----w- c:\program files (x86)\MGTEK

2013-06-19 02:03 . 2013-06-19 02:03 -------- d-----w- c:\program files (x86)\Common Files\MGTEK

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2013-07-11 06:55 . 2010-07-16 02:47 78185248 ----a-w- c:\windows\system32\MRT.exe

2013-07-07 07:36 . 2010-08-25 06:30 737072 ----a-w- c:\programdata\Microsoft\eHome\Packages\SportsV2\SportsTemplateCore-2\Microsoft.MediaCenter.Sports.UI.dll

2013-07-07 07:25 . 2010-08-25 06:29 2876528 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCEClientUX\UpdateableMarkup-2\markup.dll

2013-07-07 07:25 . 2010-08-25 06:29 42776 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCEClientUX\dSM-2\StartResources.dll

2013-07-07 07:25 . 2010-08-25 06:29 539984 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCESpotlight\MCESpotlight-2\SpotlightResources.dll

2013-07-02 01:37 . 2010-08-19 06:41 737072 ----a-w- c:\programdata\Microsoft\eHome\Packages\SportsV2\SportsTemplateCore\Microsoft.MediaCenter.Sports.UI.dll

2013-07-02 01:32 . 2010-08-19 06:41 2876528 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCEClientUX\UpdateableMarkup\markup.dll

2013-07-02 01:29 . 2010-08-19 06:40 42776 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCEClientUX\dSM\StartResources.dll

2013-07-02 01:29 . 2010-08-19 06:40 539984 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCESpotlight\MCESpotlight\SpotlightResources.dll

2013-06-13 03:57 . 2012-09-02 02:34 71048 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl

2013-06-13 03:57 . 2012-09-02 02:34 692104 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe

2013-05-27 16:29 . 2013-05-12 19:25 15712 ----a-w- c:\windows\system32\drivers\SWDUMon.sys

2013-05-15 03:47 . 2013-05-15 03:47 4167680 ----a-w- c:\program files (x86)\GUT8E94.tmp

2013-05-13 05:51 . 2013-06-12 14:15 184320 ----a-w- c:\windows\system32\cryptsvc.dll

2013-05-13 05:51 . 2013-06-12 14:15 1464320 ----a-w- c:\windows\system32\crypt32.dll

2013-05-13 05:51 . 2013-06-12 14:15 139776 ----a-w- c:\windows\system32\cryptnet.dll

2013-05-13 05:50 . 2013-06-12 14:15 52224 ----a-w- c:\windows\system32\certenc.dll

2013-05-13 04:45 . 2013-06-12 14:15 140288 ----a-w- c:\windows\SysWow64\cryptsvc.dll

2013-05-13 04:45 . 2013-06-12 14:15 1160192 ----a-w- c:\windows\SysWow64\crypt32.dll

2013-05-13 04:45 . 2013-06-12 14:15 103936 ----a-w- c:\windows\SysWow64\cryptnet.dll

2013-05-13 03:43 . 2013-06-12 14:15 1192448 ----a-w- c:\windows\system32\certutil.exe

2013-05-13 03:08 . 2013-06-12 14:15 903168 ----a-w- c:\windows\SysWow64\certutil.exe

2013-05-13 03:08 . 2013-06-12 14:15 43008 ----a-w- c:\windows\SysWow64\certenc.dll

2013-05-08 13:05 . 2013-05-08 13:05 1054720 ----a-w- c:\windows\system32\MsSpellCheckingFacility.exe

2013-05-08 13:05 . 2013-05-08 13:05 73728 ----a-w- c:\windows\SysWow64\SetIEInstalledDate.exe

2013-05-08 13:05 . 2013-05-08 13:05 719360 ----a-w- c:\windows\SysWow64\mshtmlmedia.dll

2013-05-08 13:05 . 2013-05-08 13:05 523264 ----a-w- c:\windows\SysWow64\vbscript.dll

2013-05-08 13:05 . 2013-05-08 13:05 48640 ----a-w- c:\windows\SysWow64\mshtmler.dll

2013-05-08 13:05 . 2013-05-08 13:05 38400 ----a-w- c:\windows\SysWow64\imgutil.dll

2013-05-08 13:05 . 2013-05-08 13:05 226304 ----a-w- c:\windows\system32\elshyph.dll

2013-05-08 13:05 . 2013-05-08 13:05 185344 ----a-w- c:\windows\SysWow64\elshyph.dll

2013-05-08 13:05 . 2013-05-08 13:05 158720 ----a-w- c:\windows\SysWow64\msls31.dll

2013-05-08 13:05 . 2013-05-08 13:05 150528 ----a-w- c:\windows\SysWow64\iexpress.exe

2013-05-08 13:05 . 2013-05-08 13:05 138752 ----a-w- c:\windows\SysWow64\wextract.exe

2013-05-08 13:05 . 2013-05-08 13:05 137216 ----a-w- c:\windows\SysWow64\ieUnatt.exe

2013-05-08 13:05 . 2013-05-08 13:05 12800 ----a-w- c:\windows\SysWow64\mshta.exe

2013-05-08 13:05 . 2013-05-08 13:05 110592 ----a-w- c:\windows\SysWow64\IEAdvpack.dll

2013-05-08 13:05 . 2013-05-08 13:05 905728 ----a-w- c:\windows\system32\mshtmlmedia.dll

2013-05-08 13:05 . 2013-05-08 13:05 81408 ----a-w- c:\windows\system32\icardie.dll

2013-05-08 13:05 . 2013-05-08 13:05 762368 ----a-w- c:\windows\system32\ieapfltr.dll

2013-05-08 13:05 . 2013-05-08 13:05 61952 ----a-w- c:\windows\SysWow64\tdc.ocx

2013-05-08 13:05 . 2013-05-08 13:05 452096 ----a-w- c:\windows\system32\dxtmsft.dll

2013-05-08 13:05 . 2013-05-08 13:05 441856 ----a-w- c:\windows\system32\html.iec

2013-05-08 13:05 . 2013-05-08 13:05 361984 ----a-w- c:\windows\SysWow64\html.iec

2013-05-08 13:05 . 2013-05-08 13:05 281600 ----a-w- c:\windows\system32\dxtrans.dll

2013-05-08 13:05 . 2013-05-08 13:05 270848 ----a-w- c:\windows\system32\iedkcs32.dll

2013-05-08 13:05 . 2013-05-08 13:05 235008 ----a-w- c:\windows\system32\url.dll

2013-05-08 13:05 . 2013-05-08 13:05 23040 ----a-w- c:\windows\SysWow64\licmgr10.dll

2013-05-08 13:05 . 2013-05-08 13:05 216064 ----a-w- c:\windows\system32\msls31.dll

2013-05-08 13:05 . 2013-05-08 13:05 197120 ----a-w- c:\windows\system32\msrating.dll

2013-05-08 13:05 . 2013-05-08 13:05 1441280 ----a-w- c:\windows\SysWow64\inetcpl.cpl

2013-05-08 13:05 . 2013-05-08 13:05 1400416 ----a-w- c:\windows\system32\ieapfltr.dat

2013-05-08 13:05 . 2013-05-08 13:05 1509376 ----a-w- c:\windows\system32\inetcpl.cpl

2013-05-08 13:05 . 2013-05-08 13:05 97280 ----a-w- c:\windows\system32\mshtmled.dll

2013-05-08 13:05 . 2013-05-08 13:05 92160 ----a-w- c:\windows\system32\SetIEInstalledDate.exe

2013-05-08 13:05 . 2013-05-08 13:05 77312 ----a-w- c:\windows\system32\tdc.ocx

2013-05-08 13:05 . 2013-05-08 13:05 62976 ----a-w- c:\windows\system32\pngfilt.dll

2013-05-08 13:05 . 2013-05-08 13:05 599552 ----a-w- c:\windows\system32\vbscript.dll

2013-05-08 13:05 . 2013-05-08 13:05 52224 ----a-w- c:\windows\system32\msfeedsbs.dll

2013-05-08 13:05 . 2013-05-08 13:05 51200 ----a-w- c:\windows\system32\imgutil.dll

2013-05-08 13:05 . 2013-05-08 13:05 48640 ----a-w- c:\windows\system32\mshtmler.dll

2013-05-08 13:05 . 2013-05-08 13:05 27648 ----a-w- c:\windows\system32\licmgr10.dll

2013-05-08 13:05 . 2013-05-08 13:05 247296 ----a-w- c:\windows\system32\webcheck.dll

2013-05-08 13:05 . 2013-05-08 13:05 173568 ----a-w- c:\windows\system32\ieUnatt.exe

2013-05-08 13:05 . 2013-05-08 13:05 167424 ----a-w- c:\windows\system32\iexpress.exe

2013-05-08 13:05 . 2013-05-08 13:05 149504 ----a-w- c:\windows\system32\occache.dll

2013-05-08 13:05 . 2013-05-08 13:05 144896 ----a-w- c:\windows\system32\wextract.exe

2013-05-08 13:05 . 2013-05-08 13:05 13824 ----a-w- c:\windows\system32\mshta.exe

2013-05-08 13:05 . 2013-05-08 13:05 136192 ----a-w- c:\windows\system32\iepeers.dll

2013-05-08 13:05 . 2013-05-08 13:05 135680 ----a-w- c:\windows\system32\IEAdvpack.dll

2013-05-08 13:05 . 2013-05-08 13:05 12800 ----a-w- c:\windows\system32\msfeedssync.exe

2013-05-08 13:05 . 2013-05-08 13:05 102912 ----a-w- c:\windows\system32\inseng.dll

2013-05-08 06:39 . 2013-06-12 14:15 1910632 ----a-w- c:\windows\system32\drivers\tcpip.sys

2013-05-08 06:10 . 2011-06-11 09:58 421200 ----a-w- c:\windows\SysWow64\msvcp100.dll

2013-05-02 10:06 . 2013-05-13 14:47 278800 ------w- c:\windows\system32\MpSigStub.exe

2013-05-01 11:59 . 2013-05-01 11:59 94208 ----a-w- c:\windows\SysWow64\QuickTimeVR.qtx

2013-05-01 11:59 . 2013-05-01 11:59 69632 ----a-w- c:\windows\SysWow64\QuickTime.qts

2013-04-26 05:51 . 2013-06-12 14:15 751104 ----a-w- c:\windows\system32\win32spl.dll

2013-04-26 04:55 . 2013-06-12 14:15 492544 ----a-w- c:\windows\SysWow64\win32spl.dll

2013-04-26 03:57 . 2010-01-29 14:38 29480 ----a-w- c:\windows\SysWow64\msxml3a.dll

2013-04-26 03:54 . 2013-04-26 03:55 95648 ----a-w- c:\windows\SysWow64\WindowsAccessBridge-32.dll

2013-04-26 03:54 . 2012-09-03 21:40 866720 ----a-w- c:\windows\SysWow64\npdeployJava1.dll

2013-04-26 03:54 . 2012-09-03 21:40 788896 ----a-w- c:\windows\SysWow64\deployJava1.dll

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"SearchProtect"="c:\users\Administrator\AppData\Roaming\SearchProtect\bin\cltmng.exe" [2013-05-08 2852640]

"HPADVISOR"="c:\program files (x86)\Hewlett-Packard\HP Advisor\HPAdvisor.exe" [2009-09-29 1685048]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]

"QlbCtrl.exe"="c:\program files (x86)\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe" [2010-02-25 323640]

"WirelessAssistant"="c:\program files (x86)\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe" [2010-03-23 500792]

"APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2013-04-22 59720]

"iTunesHelper"="c:\program files (x86)\iTunes\iTunesHelper.exe" [2013-05-31 152392]

"TkBellExe"="c:\program files (x86)\Real\RealPlayer\update\realsched.exe" [2013-02-13 295072]

"SearchProtectAll"="c:\program files (x86)\SearchProtect\bin\cltmng.exe" [2013-05-08 2852640]

"QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" [2013-05-01 421888]

"AppleSyncNotifier"="c:\program files (x86)\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe" [2010-09-22 47904]

"Adobe Reader Speed Launcher"="c:\program files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-28 35696]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"ConsentPromptBehaviorUser"= 3 (0x3)

"EnableUIADesktopToggle"= 0 (0x0)

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]

"LoadAppInit_DLLs"=1 (0x1)

.

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]

BootExecute REG_MULTI_SZ autocheck autochk *\0\0sdnclean64.exe

.

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]

@="Driver"

HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update

HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe

.

R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]

R2 SBSDWSCService;SBSD Security Center Service;c:\program files (x86)\Spybot - Search & Destroy\SDWinSec.exe;c:\program files (x86)\Spybot - Search & Destroy\SDWinSec.exe [x]

R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe;c:\program files (x86)\Skype\Updater\Updater.exe [x]

R3 GamesAppService;GamesAppService;c:\program files (x86)\WildTangent Games\App\GamesAppService.exe;c:\program files (x86)\WildTangent Games\App\GamesAppService.exe [x]

R3 massfilter_hs;HS HandSet Mass Storage Filter Driver;c:\windows\system32\drivers\massfilter_hs.sys;c:\windows\SYSNATIVE\drivers\massfilter_hs.sys [x]

R3 Netaapl;Apple Mobile Device Ethernet Service;c:\windows\system32\DRIVERS\netaapl64.sys;c:\windows\SYSNATIVE\DRIVERS\netaapl64.sys [x]

R3 netw5v64;Intel® Wireless WiFi Link 5000 Series Adapter Driver for Windows Vista 64 Bit;c:\windows\system32\DRIVERS\netw5v64.sys;c:\windows\SYSNATIVE\DRIVERS\netw5v64.sys [x]

R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys;c:\windows\SYSNATIVE\drivers\rdpvideominiport.sys [x]

R3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;c:\windows\System32\Drivers\RtsUStor.sys;c:\windows\SYSNATIVE\Drivers\RtsUStor.sys [x]

R3 RtsUIR;Realtek IR Driver;c:\windows\system32\DRIVERS\Rts516xIR.sys;c:\windows\SYSNATIVE\DRIVERS\Rts516xIR.sys [x]

R3 SrvHsfHDA;SrvHsfHDA;c:\windows\system32\DRIVERS\VSTAZL6.SYS;c:\windows\SYSNATIVE\DRIVERS\VSTAZL6.SYS [x]

R3 SrvHsfV92;SrvHsfV92;c:\windows\system32\DRIVERS\VSTDPV6.SYS;c:\windows\SYSNATIVE\DRIVERS\VSTDPV6.SYS [x]

R3 SrvHsfWinac;SrvHsfWinac;c:\windows\system32\DRIVERS\VSTCNXT6.SYS;c:\windows\SYSNATIVE\DRIVERS\VSTCNXT6.SYS [x]

R3 SWDUMon;SWDUMon;c:\windows\system32\DRIVERS\SWDUMon.sys;c:\windows\SYSNATIVE\DRIVERS\SWDUMon.sys [x]

R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]

R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys;c:\windows\SYSNATIVE\Drivers\usbaapl64.sys [x]

R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe;c:\windows\SYSNATIVE\Wat\WatAdminSvc.exe [x]

R3 yukonw7;NDIS6.2 Miniport Driver for Marvell Yukon Ethernet Controller;c:\windows\system32\DRIVERS\yk62x64.sys;c:\windows\SYSNATIVE\DRIVERS\yk62x64.sys [x]

R4 CltMngSvc;Search Protect by Conduit Updater;c:\program files (x86)\SearchProtect\bin\CltMngSvc.exe;c:\program files (x86)\SearchProtect\bin\CltMngSvc.exe [x]

R4 Com4QLBEx;Com4QLBEx;c:\program files (x86)\Hewlett-Packard\HP Quick Launch Buttons\Com4QLBEx.exe;c:\program files (x86)\Hewlett-Packard\HP Quick Launch Buttons\Com4QLBEx.exe [x]

S2 HP Support Assistant Service;HP Support Assistant Service;c:\program files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe;c:\program files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe [x]

S2 HPDrvMntSvc.exe;HP Quick Synchronization Service;c:\program files (x86)\Hewlett-Packard\Shared\HPDrvMntSvc.exe;c:\program files (x86)\Hewlett-Packard\Shared\HPDrvMntSvc.exe [x]

S2 HsfXAudioService;HsfXAudioService;c:\windows\system32\svchost.exe;c:\windows\SYSNATIVE\svchost.exe [x]

S2 RealNetworks Downloader Resolver Service;RealNetworks Downloader Resolver Service;c:\program files (x86)\RealNetworks\RealDownloader\rndlresolversvc.exe;c:\program files (x86)\RealNetworks\RealDownloader\rndlresolversvc.exe [x]

S3 CAXHWAZL;CAXHWAZL;c:\windows\system32\DRIVERS\CAXHWAZL.sys;c:\windows\SYSNATIVE\DRIVERS\CAXHWAZL.sys [x]

S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys;c:\windows\SYSNATIVE\DRIVERS\Rt64win7.sys [x]

.

--- Other Services/Drivers In Memory ---

.

*NewlyCreated* - WS2IFSL

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]

2013-07-16 09:08 1173456 ----a-w- c:\program files (x86)\Google\Chrome\Application\28.0.1500.72\Installer\chrmstp.exe

.

Contents of the 'Scheduled Tasks' folder

.

2013-07-18 c:\windows\Tasks\Adobe Flash Player Updater.job

- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-09-02 03:57]

.

2013-07-18 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job

- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-05-24 11:59]

.

2013-07-18 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job

- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-05-24 11:59]

.

2013-07-17 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-820292111-1869468108-3859774255-1000Core.job

- c:\users\Nyamuoch\AppData\Local\Google\Update\GoogleUpdate.exe [2012-10-13 22:36]

.

2013-07-18 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-820292111-1869468108-3859774255-1000UA.job

- c:\users\Nyamuoch\AppData\Local\Google\Update\GoogleUpdate.exe [2012-10-13 22:36]

.

2013-07-08 c:\windows\Tasks\HPCeeScheduleForAdministrator.job

- c:\program files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe [2010-09-14 03:15]

.

2013-07-17 c:\windows\Tasks\ReclaimerUpdateFiles_Administrator.job

- c:\users\Administrator\AppData\Roaming\Real\Update\UpgradeHelper\RealPlayer\10.50\agent\rnupgagent.exe [2013-07-06 21:23]

.

2013-07-17 c:\windows\Tasks\ReclaimerUpdateXML_Administrator.job

- c:\users\Administrator\AppData\Roaming\Real\Update\UpgradeHelper\RealPlayer\10.50\agent\rnupgagent.exe [2013-07-06 21:23]

.

2013-07-18 c:\windows\Tasks\RNUpgradeHelperLogonPrompt_Administrator.job

- c:\users\Administrator\AppData\Roaming\Real\Update\UpgradeHelper\RealPlayer\10.50\agent\rnupgagent.exe [2013-07-06 21:23]

.

--------- X64 Entries -----------

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"IgfxTray"="c:\windows\system32\igfxtray.exe" [2010-08-26 161304]

"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2010-08-26 386584]

"Persistence"="c:\windows\system32\igfxpers.exe" [2010-08-26 415256]

"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-11-01 171520]

"cAudioFilterAgent"="c:\program files\Conexant\cAudioFilterAgent\cAudioFilterAgent64.exe" [2009-07-14 495104]

.

------- Supplementary Scan -------

.

uLocal Page = c:\windows\system32\blank.htm

mLocal Page = c:\windows\SysWOW64\blank.htm

IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200

IE: E&xport to Microsoft Excel - c:\progra~2\MICROS~4\Office12\EXCEL.EXE/3000

TCP: DhcpNameServer = 192.168.0.1

FF - ProfilePath - c:\users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\mmj39qj7.default\

FF - prefs.js: browser.search.selectedEngine - Search Results

FF - ExtSQL: 2013-05-27 19:14; {635abd67-4fe9-1b23-4f01-e679fa7484c1}; c:\users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\mmj39qj7.default\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}

FF - ExtSQL: 2013-05-27 19:44; {c0c9a2c7-2e5c-4447-bc53-97718bc91e1b}; c:\users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\mmj39qj7.default\extensions\{c0c9a2c7-2e5c-4447-bc53-97718bc91e1b}.xpi

FF - ExtSQL: 2013-07-06 14:33; {ab91efd4-6975-4081-8552-1b3922ed79e2}; c:\users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\mmj39qj7.default\extensions\{ab91efd4-6975-4081-8552-1b3922ed79e2}

.

- - - - ORPHANS REMOVED - - - -

.

Toolbar-10 - (no file)

Wow6432Node-HKLM-Run-vProt - c:\program files (x86)\AVG Secure Search\vprot.exe

Wow6432Node-HKLM-Run-OtShot - c:\program files (x86)\OtShot\otshot.exe

Wow6432Node-HKLM-Run-DivX Download Manager - c:\program files (x86)\DivX\DivX Plus Web Player\DDmService.exe

Wow6432Node-HKLM-Run-ccApp - c:\program files (x86)\Common Files\Symantec Shared\ccApp.exe

Wow6432Node-HKLM-Run-BingDesktop - c:\program files (x86)\Microsoft\BingDesktop\BingDesktop.exe

Wow6432Node-HKLM-Run-ApnUpdater - c:\program files (x86)\Ask.com\Updater\Updater.exe

Wow6432Node-HKLM-Run-(default) - (no file)

c:\users\Guest\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LimeWire On Startup.lnk - c:\program files (x86)\LimeWire\LimeWire.exe -startup

c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk - c:\program files (x86)\McAfee Security Scan\3.0.318\SSScheduler.exe

HKLM_Wow6432Node-ActiveSetup-{2D46B6DC-2207-486B-B523-A557E6D54B47} - start

Toolbar-10 - (no file)

HKLM-Run-SynTPEnh - c:\program files (x86)\Synaptics\SynTP\SynTPEnh.exe

AddRemove-RealPlayer 16.0 - c:\program files (x86)\real\realplayer\Update\r1puninst.exe

AddRemove-{EE202411-2C26-49E8-9784-1BC1DBF7DE96} - c:\program files (x86)\InstallShield Installation Information\{EE202411-2C26-49E8-9784-1BC1DBF7DE96}\setup.exe

.

--------------------- LOCKED REGISTRY KEYS ---------------------

.

[HKEY_USERS\S-1-5-21-820292111-1869468108-3859774255-500\Software\Microsoft\Internet Explorer\Approved Extensions]

@Denied: (2) (Administrator)

"{74322BF9-DF26-493F-B0DA-6D2FC5E6429E}"=hex:51,66,7a,6c,4c,1d,3b,1b,e9,3d,22,

6d,13,85,52,05,ad,d0,32,73,cd,a3,0e,86

.

[HKEY_USERS\S-1-5-21-820292111-1869468108-3859774255-500\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration]

@Denied: (2) (Administrator)

"Timestamp"=hex:02,d7,ab,3d,0b,4c,ce,01

.

[HKEY_USERS\S-1-5-21-820292111-1869468108-3859774255-500\Software\Microsoft\Internet Explorer\User Preferences]

@Denied: (2) (Administrator)

"88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15,

d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,d8,ba,98,43,55,c3,13,47,b0,ee,ce,\

"2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=hex:01,00,00,00,d0,8c,9d,df,01,15,

d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,d8,ba,98,43,55,c3,13,47,b0,ee,ce,\

.

[HKEY_USERS\S-1-5-21-820292111-1869468108-3859774255-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.cda\UserChoice]

@Denied: (2) (Administrator)

"Progid"="WMP11.AssocFile.CDA"

.

[HKEY_USERS\S-1-5-21-820292111-1869468108-3859774255-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\UserChoice]

@Denied: (2) (Administrator)

"Progid"="ChromeHTML"

.

[HKEY_USERS\S-1-5-21-820292111-1869468108-3859774255-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\UserChoice]

@Denied: (2) (Administrator)

"Progid"="ChromeHTML"

.

[HKEY_USERS\S-1-5-21-820292111-1869468108-3859774255-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\UserChoice]

@Denied: (2) (Administrator)

"Progid"="ChromeHTML"

.

[HKEY_USERS\S-1-5-21-820292111-1869468108-3859774255-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\UserChoice]

@Denied: (2) (Administrator)

"Progid"="ChromeHTML"

.

[HKEY_USERS\S-1-5-21-820292111-1869468108-3859774255-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\UserChoice]

@Denied: (2) (Administrator)

"Progid"="ChromeHTML"

.

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]

@Denied: (A 2) (Everyone)

@="FlashBroker"

"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_7_700_224_ActiveX.exe,-101"

.

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]

"Enabled"=dword:00000001

.

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]

@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_7_700_224_ActiveX.exe"

.

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

.

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]

@Denied: (A 2) (Everyone)

@="IFlashBroker5"

.

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]

@="{00020424-0000-0000-C000-000000000046}"

.

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

"Version"="1.0"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]

@Denied: (A 2) (Everyone)

@="FlashBroker"

"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_7_700_224_ActiveX.exe,-101"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]

"Enabled"=dword:00000001

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_7_700_224_ActiveX.exe"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]

@Denied: (A 2) (Everyone)

@="Shockwave Flash Object"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_7_700_224.ocx"

"ThreadingModel"="Apartment"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]

@="0"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]

@="ShockwaveFlash.ShockwaveFlash.11"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_7_700_224.ocx, 1"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]

@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]

@="1.0"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]

@="ShockwaveFlash.ShockwaveFlash"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]

@Denied: (A 2) (Everyone)

@="Macromedia Flash Factory Object"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_7_700_224.ocx"

"ThreadingModel"="Apartment"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]

@="FlashFactory.FlashFactory.1"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_7_700_224.ocx, 1"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]

@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]

@="1.0"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]

@="FlashFactory.FlashFactory"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]

@Denied: (A 2) (Everyone)

@="IFlashBroker5"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]

@="{00020424-0000-0000-C000-000000000046}"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

"Version"="1.0"

.

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

.

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]

@Denied: (Full) (Everyone)

.

------------------------ Other Running Processes ------------------------

.

c:\program files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

c:\program files (x86)\CyberLink\Shared files\RichVideo.exe

c:\program files (x86)\Hewlett-Packard\Shared\hpqwmiex.exe

.

**************************************************************************

.

Completion time: 2013-07-18 00:21:02 - machine was rebooted

ComboFix-quarantined-files.txt 2013-07-18 08:21

.

Pre-Run: 139,009,638,400 bytes free

Post-Run: 140,129,120,256 bytes free

.

- - End Of File - - 53D4A969FF56EF508D431D89550B4C21

AEE357D355D7F06DFEC420A755C0B947

Psychotic · July 18, 2013

Combofix scripting

1. Close any open browsers.

2. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

3. Download the attached CFScript.txt and save it to the location where Combofix is.

Refering to the picture above, drag CFScript into ComboFix.exe

When finished, it shall produce a log for you at C:\ComboFix.txt which I will require in your next reply.

CFScript.txt

justime · July 18, 2013

ComboFix 13-07-18.01 - Administrator 07/18/2013 1:55.3.1 - x64

Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.1979.880 [GMT -8:00]

Running from: c:\users\Administrator\Desktop\ComboFix.exe

Command switches used :: c:\users\Administrator\Desktop\CFScript.txt

SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\program files (x86)\SearchProtect

c:\program files (x86)\SearchProtect\bin\ChromeModule.dll

c:\program files (x86)\SearchProtect\bin\cltmng.exe

c:\program files (x86)\SearchProtect\bin\CltMngSvc.exe

c:\program files (x86)\SearchProtect\bin\FirefoxModule.dll

c:\program files (x86)\SearchProtect\bin\InternetExplorerModule.dll

c:\program files (x86)\SearchProtect\bin\msvcp100.dll

c:\program files (x86)\SearchProtect\bin\msvcr100.dll

c:\program files (x86)\SearchProtect\bin\rep.dat

c:\program files (x86)\SearchProtect\bin\SPHook32.dll

c:\program files (x86)\SearchProtect\bin\SPRunner.exe

c:\program files (x86)\SearchProtect\bin\uninstall.exe

c:\program files (x86)\SearchProtect\Dialogs\dialogsApi.js

c:\program files (x86)\SearchProtect\Dialogs\lib\jquery.min.js

c:\program files (x86)\SearchProtect\Dialogs\lib\json2.js

c:\program files (x86)\SearchProtect\Dialogs\spbd\bubble.css

c:\program files (x86)\SearchProtect\Dialogs\spbd\bubble.js

c:\program files (x86)\SearchProtect\Dialogs\spbd\images\information.png

c:\program files (x86)\SearchProtect\Dialogs\spbd\images\x-default-LTR.png

c:\program files (x86)\SearchProtect\Dialogs\spbd\images\x-default-RTL.png

c:\program files (x86)\SearchProtect\Dialogs\spbd\images\x-mouseover-LTR.png

c:\program files (x86)\SearchProtect\Dialogs\spbd\images\x-mouseover-RTL.png

c:\program files (x86)\SearchProtect\Dialogs\spbd\main.html

c:\program files (x86)\SearchProtect\Dialogs\spsd\images\ok-button.png

c:\program files (x86)\SearchProtect\Dialogs\spsd\images\separation-line.png

c:\program files (x86)\SearchProtect\Dialogs\spsd\images\warning.png

c:\program files (x86)\SearchProtect\Dialogs\spsd\main.html

c:\program files (x86)\SearchProtect\Dialogs\spsd\SearchProtector.css

c:\program files (x86)\SearchProtect\Dialogs\spsd\settings.js

c:\program files (x86)\SearchProtect\ffprotect\abstraction.js

c:\program files (x86)\SearchProtect\ffprotect\application.js

c:\program files (x86)\SearchProtect\ffprotect\nsprotector.js

c:\users\Administrator\AppData\Roaming\SearchProtect

c:\users\Administrator\AppData\Roaming\SearchProtect\bin\ChromeModule.dll

c:\users\Administrator\AppData\Roaming\SearchProtect\bin\cltmng.exe

c:\users\Administrator\AppData\Roaming\SearchProtect\bin\CltMngSvc.exe

c:\users\Administrator\AppData\Roaming\SearchProtect\bin\FirefoxModule.dll

c:\users\Administrator\AppData\Roaming\SearchProtect\bin\InternetExplorerModule.dll

c:\users\Administrator\AppData\Roaming\SearchProtect\bin\msvcp100.dll

c:\users\Administrator\AppData\Roaming\SearchProtect\bin\msvcr100.dll

c:\users\Administrator\AppData\Roaming\SearchProtect\bin\rep.dat

c:\users\Administrator\AppData\Roaming\SearchProtect\bin\SPHook32.dll

c:\users\Administrator\AppData\Roaming\SearchProtect\bin\SPRunner.exe

c:\users\Administrator\AppData\Roaming\SearchProtect\Dialogs\dialogsApi.js

c:\users\Administrator\AppData\Roaming\SearchProtect\Dialogs\lib\jquery.min.js

c:\users\Administrator\AppData\Roaming\SearchProtect\Dialogs\lib\json2.js

c:\users\Administrator\AppData\Roaming\SearchProtect\Dialogs\spbd\bubble.css

c:\users\Administrator\AppData\Roaming\SearchProtect\Dialogs\spbd\bubble.js

c:\users\Administrator\AppData\Roaming\SearchProtect\Dialogs\spbd\images\information.png

c:\users\Administrator\AppData\Roaming\SearchProtect\Dialogs\spbd\images\x-default-LTR.png

c:\users\Administrator\AppData\Roaming\SearchProtect\Dialogs\spbd\images\x-default-RTL.png

c:\users\Administrator\AppData\Roaming\SearchProtect\Dialogs\spbd\images\x-mouseover-LTR.png

c:\users\Administrator\AppData\Roaming\SearchProtect\Dialogs\spbd\images\x-mouseover-RTL.png

c:\users\Administrator\AppData\Roaming\SearchProtect\Dialogs\spbd\main.html

c:\users\Administrator\AppData\Roaming\SearchProtect\Dialogs\spsd\images\ok-button.png

c:\users\Administrator\AppData\Roaming\SearchProtect\Dialogs\spsd\images\separation-line.png

c:\users\Administrator\AppData\Roaming\SearchProtect\Dialogs\spsd\images\warning.png

c:\users\Administrator\AppData\Roaming\SearchProtect\Dialogs\spsd\main.html

c:\users\Administrator\AppData\Roaming\SearchProtect\Dialogs\spsd\SearchProtector.css

c:\users\Administrator\AppData\Roaming\SearchProtect\Dialogs\spsd\settings.js

c:\users\Administrator\AppData\Roaming\SearchProtect\ffprotect\abstraction.js

c:\users\Administrator\AppData\Roaming\SearchProtect\ffprotect\application.js

c:\users\Administrator\AppData\Roaming\SearchProtect\ffprotect\Dialogs\dialogsApi.js

c:\users\Administrator\AppData\Roaming\SearchProtect\ffprotect\Dialogs\lib\jquery.min.js

c:\users\Administrator\AppData\Roaming\SearchProtect\ffprotect\Dialogs\lib\json2.js

c:\users\Administrator\AppData\Roaming\SearchProtect\ffprotect\Dialogs\spbd\bubble.css

c:\users\Administrator\AppData\Roaming\SearchProtect\ffprotect\Dialogs\spbd\bubble.js

c:\users\Administrator\AppData\Roaming\SearchProtect\ffprotect\Dialogs\spbd\images\information.png

c:\users\Administrator\AppData\Roaming\SearchProtect\ffprotect\Dialogs\spbd\images\x-default-LTR.png

c:\users\Administrator\AppData\Roaming\SearchProtect\ffprotect\Dialogs\spbd\images\x-default-RTL.png

c:\users\Administrator\AppData\Roaming\SearchProtect\ffprotect\Dialogs\spbd\images\x-mouseover-LTR.png

c:\users\Administrator\AppData\Roaming\SearchProtect\ffprotect\Dialogs\spbd\images\x-mouseover-RTL.png

c:\users\Administrator\AppData\Roaming\SearchProtect\ffprotect\Dialogs\spbd\main.html

c:\users\Administrator\AppData\Roaming\SearchProtect\ffprotect\Dialogs\spsd\images\ok-button.png

c:\users\Administrator\AppData\Roaming\SearchProtect\ffprotect\Dialogs\spsd\images\separation-line.png

c:\users\Administrator\AppData\Roaming\SearchProtect\ffprotect\Dialogs\spsd\images\warning.png

c:\users\Administrator\AppData\Roaming\SearchProtect\ffprotect\Dialogs\spsd\main.html

c:\users\Administrator\AppData\Roaming\SearchProtect\ffprotect\Dialogs\spsd\SearchProtector.css

c:\users\Administrator\AppData\Roaming\SearchProtect\ffprotect\Dialogs\spsd\settings.js

c:\users\Administrator\AppData\Roaming\SearchProtect\ffprotect\nsprotector.js

c:\users\Administrator\AppData\Roaming\SearchProtect\ffprotect\popupTransparent.xul

c:\users\Administrator\AppData\Roaming\SearchProtect\ffprotect\SProtectorRepository\EN

c:\users\Administrator\AppData\Roaming\SearchProtect\ffprotect\SProtectorRepository\searchProtectorData

.

((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.

-------\Service_CltMngSvc

.

((((((((((((((((((((((((( Files Created from 2013-06-18 to 2013-07-18 )))))))))))))))))))))))))))))))

.

2013-07-18 10:03 . 2013-07-18 10:03 -------- d-----w- c:\users\Nyamuoch\AppData\Local\temp

2013-07-18 10:03 . 2013-07-18 10:03 -------- d-----w- c:\users\music\AppData\Local\temp

2013-07-18 10:03 . 2013-07-18 10:03 -------- d-----w- c:\users\Guest\AppData\Local\temp