I cant update Mbam, I think i have a virus

MrsM1 · July 21, 2010

well I tried to post in bleeping computer but i couldnt get this topic box, so i'm relieved that i'm able to do so here. well first i notice a couple days ago that my searches on google werent going where i wanted them to go, they were being sent to other websites, so i researched and found out it might be malware.

I did a few things, i ran mbam in safe mode ( after turning off cd emulation with defogger, backing up my stuff) whenever i tried to update i'd get the 12007 0 winhttpsendrequest indicating i was unable to recieve the update.

mbam did find cookies and such but if i go into internet explorer the problem is still there,

i tried to run gmer and it only allow 3 boxes to be scanned on the menu... so i know something is up with that.

further to my suspicions, i looked up this error code on your forums, i found the exact issue I tried to click on it and bang, its said mozilla firefox is offline try again. which it wasnt because i clicked on another topic in the same forum and it worked.

ok i havent run hijack this yet but here are my dds logs

DDS (Ver_10-03-17.01) - NTFSX64

Run by MOjet1 at 18:28:56.13 on Sun 07/18/2010

Internet Explorer: 8.0.7600.16385 BrowserJavaVersion: 1.6.0_21

Microsoft Windows 7 Home Premium 6.1.7600.0.1252.1.1033.18.3836.942 [GMT -4:00]

SP: SUPERAntiSpyware *disabled* (Updated) {222A897C-5018-402e-943F-7E7AC8560DA7}

============== Running Processes ===============

C:\windows\system32\wininit.exe

C:\windows\system32\lsm.exe

C:\windows\system32\svchost.exe -k DcomLaunch

C:\windows\system32\svchost.exe -k RPCSS

C:\windows\system32\atiesrxx.exe

C:\windows\System32\svchost.exe -k LocalServiceNetworkRestricted

C:\windows\System32\svchost.exe -k LocalSystemNetworkRestricted

C:\windows\system32\svchost.exe -k netsvcs

C:\windows\system32\svchost.exe -k LocalService

C:\windows\system32\atieclxx.exe

C:\windows\system32\svchost.exe -k NetworkService

C:\windows\System32\spoolsv.exe

C:\windows\system32\svchost.exe -k LocalServiceNoNetwork

C:\Program Files\SUPERAntiSpyware\SASCORE64.EXE

C:\Program Files (x86)\Norton Security Suite\Engine\4.2.0.12\ccSvcHst.exe

C:\Program Files (x86)\Comcast\Desktop Doctor\bin\sprtsvc.exe

C:\windows\system32\svchost.exe -k imgsvc

C:\Windows\system32\TODDSrv.exe

C:\Program Files\TOSHIBA\Power Saver\TosCoSrv.exe

C:\Program Files\TOSHIBA\TECO\TecoService.exe

C:\windows\system32\SearchIndexer.exe

C:\Program Files (x86)\Yahoo!\SoftwareUpdate\YahooAUService.exe

C:\windows\system32\taskhost.exe

C:\windows\system32\Dwm.exe

C:\windows\Explorer.EXE

C:\Program Files (x86)\Norton Security Suite\Engine\4.2.0.12\ccSvcHst.exe

C:\windows\system32\wbem\wmiprvse.exe

C:\windows\system32\svchost.exe -k NetworkServiceNetworkRestricted

C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe

C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

C:\Program Files\TOSHIBA\Power Saver\TPwrMain.exe

C:\Program Files\TOSHIBA\SmoothView\SmoothView.exe

C:\Program Files\TOSHIBA\FlashCards\TCrdMain.exe

C:\Program Files\TOSHIBA\TECO\Teco.exe

C:\Program Files\TOSHIBA\BulletinBoard\TosNcCore.exe

C:\Program Files\TOSHIBA\ReelTime\TosReelTimeMonitor.exe

C:\Program Files (x86)\Vidalia Bundle\Vidalia\vidalia.exe

C:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe

C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe

C:\Program Files (x86)\TOSHIBA\TOSHIBA Service Station\ToshibaServiceStation.exe

C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe

C:\windows\system32\taskeng.exe

C:\Program Files (x86)\TOSHIBA\ConfigFree\NDSTray.exe

C:\windows\system32\svchost.exe -k LocalServiceAndNoImpersonation

C:\windows\System32\svchost.exe -k LocalServicePeerNet

C:\Program Files\Windows Media Player\wmpnetwk.exe

C:\Program Files (x86)\Vidalia Bundle\Tor\tor.exe

C:\windows\system32\conhost.exe

C:\Program Files (x86)\TOSHIBA\ConfigFree\CFIWmxSvcs64.exe

C:\Program Files (x86)\TOSHIBA\ConfigFree\CFProcSRVC.exe

C:\Program Files (x86)\TOSHIBA\ConfigFree\CFSvcs.exe

C:\Program Files\TOSHIBA\TPHM\TPCHSrv.exe

C:\Program Files\TOSHIBA\TPHM\TPCHWMsg.exe

C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSmartSrv.exe

C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSENotify.exe

C:\Program Files (x86)\TOSHIBA\TOSHIBA Service Station\TMachInfo.exe

C:\Program Files (x86)\TOSHIBA\ConfigFree\CFSwMgr.exe

C:\Program Files\Synaptics\SynTP\SynTPHelper.exe

C:\Program Files (x86)\Uniblue\DriverScanner\driverscanner.exe

C:\Program Files (x86)\Mozilla Firefox\firefox.exe

C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe

C:\windows\system32\SearchProtocolHost.exe

C:\windows\system32\SearchFilterHost.exe

C:\windows\system32\DllHost.exe

C:\Users\MOjet1\Downloads\dds.scr

C:\windows\system32\conhost.exe

============== Pseudo HJT Report ===============

uDefault_Page_URL = hxxp://www.google.com/ig?brand=TSNA&bmod=TSNA

mDefault_Page_URL = hxxp://www.google.com/ig/redirectdomain?brand=TSNA&bmod=TSNA

mStart Page = hxxp://www.google.com/ig/redirectdomain?brand=TSNA&bmod=TSNA

mLocal Page = c:\windows\syswow64\blank.htm

uInternet Settings,ProxyServer = 127.0.0.1:8118

BHO: {02478D38-C3F9-4efb-9B51-7695ECA05670} - No File

BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files (x86)\common files\adobe\acrobat\activex\AcroIEHelperShim.dll

BHO: {5C255C8A-E604-49b4-9D64-90988571CECB} - No File

BHO: Symantec NCO BHO: {602adb0e-4aff-4217-8aa1-95dac4dfa408} - c:\program files (x86)\norton security suite\engine\4.2.0.12\coIEPlg.dll

BHO: Symantec Intrusion Prevention: {6d53ec84-6aae-4787-aeee-f4628f01010c} - c:\program files (x86)\norton security suite\engine\4.2.0.12\IPSBHO.DLL

BHO: Windows Live Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files (x86)\common files\microsoft shared\windows live\WindowsLiveLogin.dll

BHO: Java Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files (x86)\java\jre6\bin\jp2ssv.dll

BHO: TBSB05974 Class: {fcbccb87-9224-4b8d-b117-f56d924beb18} - c:\program files (x86)\search toolbar\tbcore3.dll

TB: Norton Toolbar: {7febefe3-6b19-4349-98d2-ffb09d4b49ca} - c:\program files (x86)\norton security suite\engine\4.2.0.12\coIEPlg.dll

TB: Search Toolbar: {0c8413c1-fad1-446c-8584-be50576f863e} - c:\program files (x86)\search toolbar\tbcore3.dll

uRun: [Vidalia] "c:\program files (x86)\vidalia bundle\vidalia\vidalia.exe"

uRun: [sUPERAntiSpyware] c:\program files\superantispyware\SUPERAntiSpyware.exe

uRunOnce: [uniblueDriverScanner] c:\program files (x86)\uniblue\driverscanner\Launcher.exe delay

mRun: [ToshibaServiceStation] "c:\program files (x86)\toshiba\toshiba service station\ToshibaServiceStation.exe" /hide:60

mRun: [<NO NAME>]

mRun: [DivXUpdate] "c:\program files (x86)\divx\divx update\DivXUpdate.exe" /CHECKNOW

mRun: [sunJavaUpdateSched] "c:\program files (x86)\common files\java\java update\jusched.exe"

mPolicies-explorer: NoActiveDesktop = 1 (0x1)

mPolicies-explorer: ForceActiveDesktopOn = 0 (0x0)

mPolicies-system: ConsentPromptBehaviorAdmin = 5 (0x5)

mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3)

mPolicies-system: EnableUIADesktopToggle = 0 (0x0)

IE: E&xport to Microsoft Excel - c:\progra~2\mif5ba~1\office12\EXCEL.EXE/3000

IE: Google Sidewiki... - c:\program files (x86)\google\google toolbar\component\GoogleToolbarDynamic_mui_en_89D8574934B26AC4.dll/cmsidewiki.html

IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - c:\program files (x86)\windows live\writer\WriterBrowserExtension.dll

IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\progra~2\mif5ba~1\office12\ONBttnIE.dll

IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~2\mif5ba~1\office12\REFIEBAR.DLL

DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab

DPF: {C345E174-3E87-4F41-A01C-B066A90A49B4} - hxxp://trial.trymicrosoftoffice.com/trialoaa/buymsoffice_assets/framework/microsoft/wrc32.ocx

DPF: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab

DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab

DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab

Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~2\common~1\skype\SKYPE4~1.DLL

TB-X64: {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - No File

TB-X64: {0C8413C1-FAD1-446C-8584-BE50576F863E} - No File

mRun-x64: [(Default)]

mRun-x64: [RtHDVCpl] c:\program files\realtek\audio\hda\RAVCpl64.exe

mRun-x64: [synTPEnh] %ProgramFiles%\Synaptics\SynTP\SynTPEnh.exe

mRun-x64: [TPwrMain] %ProgramFiles%\TOSHIBA\Power Saver\TPwrMain.EXE

mRun-x64: [HSON] %ProgramFiles%\TOSHIBA\TBS\HSON.exe

mRun-x64: [smoothView] %ProgramFiles%\Toshiba\SmoothView\SmoothView.exe

mRun-x64: [00TCrdMain] %ProgramFiles%\TOSHIBA\FlashCards\TCrdMain.exe

mRun-x64: [TosWaitSrv] %ProgramFiles%\TOSHIBA\TPHM\TosWaitSrv.exe

mRun-x64: [smartFaceVWatcher] %ProgramFiles%\Toshiba\SmartFaceV\SmartFaceVWatcher.exe

mRun-x64: [Teco] "%ProgramFiles%\TOSHIBA\TECO\Teco.exe" /r

mRun-x64: [TosSENotify] c:\program files\toshiba\toshiba hdd ssd alert\TosWaitSrv.exe

mRun-x64: [TosNC] %ProgramFiles%\Toshiba\BulletinBoard\TosNcCore.exe

mRun-x64: [TosReelTimeMonitor] %ProgramFiles%\TOSHIBA\ReelTime\TosReelTimeMonitor.exe

Hosts: 127.0.0.1 www.spywareinfo.com

================= FIREFOX ===================

FF - ProfilePath - c:\users\mojet1\appdata\roaming\mozilla\firefox\profiles\4t6796v2.default\

FF - prefs.js: browser.search.defaulturl - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2399412&SearchSource=3&q={searchTerms}

FF - prefs.js: browser.startup.homepage - hxxp://www.google.co.uk/

FF - prefs.js: keyword.URL - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2399412&q=

FF - component: c:\programdata\norton\{0c55c096-0f1d-4f28-aaa2-85ef591126e7}\n360_4.0.0.127\coffplgn\components\coFFPlgn.dll

FF - component: c:\programdata\norton\{0c55c096-0f1d-4f28-aaa2-85ef591126e7}\n360_4.0.0.127\ipsffplgn\components\IPSFFPl.dll

FF - component: c:\users\mojet1\appdata\roaming\mozilla\firefox\profiles\4t6796v2.default\extensions\{3ee8d0be-f450-4ef2-97b9-ac2222d14db3}\components\FFExternalAlert.dll

FF - component: c:\users\mojet1\appdata\roaming\mozilla\firefox\profiles\4t6796v2.default\extensions\{3ee8d0be-f450-4ef2-97b9-ac2222d14db3}\components\RadioWMPCore.dll

FF - plugin: c:\program files (x86)\google\update\1.2.183.23\npGoogleOneClick8.dll

FF - plugin: c:\program files (x86)\google\update\1.2.183.29\npGoogleOneClick8.dll

FF - plugin: c:\program files (x86)\java\jre6\bin\new_plugin\npdeployJava1.dll

FF - plugin: c:\program files (x86)\windows live\photo gallery\NPWLPG.dll

FF - plugin: c:\users\mojet1\appdata\local\google\update\1.2.183.29\npGoogleOneClick8.dll

FF - plugin: c:\windows\syswow64\macromed\flash\NPSWF32.dll

FF - HiddenExtension: Java Console: No Registry Reference - c:\program files (x86)\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}

---- FIREFOX POLICIES ----

FF - user.js: google.toolbar.linkdoctor.enabled - false

FF - user.js: yahoo.ytff.general.dontshowhpoffer - truec:\program files (x86)\mozilla firefox\greprefs\all.js - pref("ui.use_native_colors", true);

c:\program files (x86)\mozilla firefox\greprefs\all.js - pref("ui.use_native_popup_windows", false);

c:\program files (x86)\mozilla firefox\greprefs\all.js - pref("browser.enable_click_image_resizing", true);

c:\program files (x86)\mozilla firefox\greprefs\all.js - pref("accessibility.browsewithcaret_shortcut.enabled", true);

c:\program files (x86)\mozilla firefox\greprefs\all.js - pref("javascript.options.mem.high_water_mark", 32);

c:\program files (x86)\mozilla firefox\greprefs\all.js - pref("javascript.options.mem.gc_frequency", 1600);

c:\program files (x86)\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.lu", true);

c:\program files (x86)\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.nu", true);

c:\program files (x86)\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.nz", true);

c:\program files (x86)\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgberp4a5d4ar", true);

c:\program files (x86)\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--p1ai", true);

c:\program files (x86)\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbayh7gpa", true);

c:\program files (x86)\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.tel", true);

c:\program files (x86)\mozilla firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);

c:\program files (x86)\mozilla firefox\greprefs\all.js - pref("network.proxy.type", 5);

c:\program files (x86)\mozilla firefox\greprefs\all.js - pref("dom.ipc.plugins.timeoutSecs", 45);

c:\program files (x86)\mozilla firefox\greprefs\all.js - pref("svg.smil.enabled", false);

c:\program files (x86)\mozilla firefox\greprefs\all.js - pref("ui.trackpoint_hack.enabled", -1);

c:\program files (x86)\mozilla firefox\greprefs\all.js - pref("browser.formfill.debug", false);

c:\program files (x86)\mozilla firefox\greprefs\all.js - pref("browser.formfill.agedWeight", 2);

c:\program files (x86)\mozilla firefox\greprefs\all.js - pref("browser.formfill.bucketSize", 1);

c:\program files (x86)\mozilla firefox\greprefs\all.js - pref("browser.formfill.maxTimeGroupings", 25);

c:\program files (x86)\mozilla firefox\greprefs\all.js - pref("browser.formfill.timeGroupingSize", 604800);

c:\program files (x86)\mozilla firefox\greprefs\all.js - pref("browser.formfill.boundaryWeight", 25);

c:\program files (x86)\mozilla firefox\greprefs\all.js - pref("browser.formfill.prefixWeight", 5);

c:\program files (x86)\mozilla firefox\greprefs\all.js - pref("accelerometer.enabled", true);

c:\program files (x86)\mozilla firefox\greprefs\all.js - pref("html5.enable", false);

c:\program files (x86)\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pr

ef", true);

c:\program files (x86)\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");

c:\program files (x86)\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);

c:\program files (x86)\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);

c:\program files (x86)\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl3.rsa_seed_sha", true);

c:\program files (x86)\mozilla firefox\defaults\pref\firefox-branding.js - pref("app.update.download.backgroundInterval", 600);

c:\program files (x86)\mozilla firefox\defaults\pref\firefox-branding.js - pref("app.update.url.manual", "http://www.firefox.com");

c:\program files (x86)\mozilla firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-ja", "mozff");

c:\program files (x86)\mozilla firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");

c:\program files (x86)\mozilla firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");

c:\program files (x86)\mozilla firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "addons.mozilla.org");

c:\program files (x86)\mozilla firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add.36", "getpersonas.com");

c:\program files (x86)\mozilla firefox\defaults\pref\firefox.js - pref("lightweightThemes.update.enabled", true);

c:\program files (x86)\mozilla firefox\defaults\pref\firefox.js - pref("browser.allTabs.previews", false);

c:\program files (x86)\mozilla firefox\defaults\pref\firefox.js - pref("plugins.hide_infobar_for_outdated_plugin", false);

c:\program files (x86)\mozilla firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);

c:\program files (x86)\mozilla firefox\defaults\pref\firefox.js - pref("toolbar.customization.usesheet", false);

c:\program files (x86)\mozilla firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.nptest.dll", true);

c:\program files (x86)\mozilla firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npswf32.dll", true);

c:\program files (x86)\mozilla firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npctrl.dll", true);

c:\program files (x86)\mozilla firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npqtplugin.dll", true);

c:\program files (x86)\mozilla firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled", false);

c:\program files (x86)\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.enable", false);

c:\program files (x86)\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.max", 20);

c:\program files (x86)\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.cachetime", 20);

============= SERVICES / DRIVERS ===============

R0 PxHlpa64;PxHlpa64;c:\windows\system32\drivers\PxHlpa64.sys [2010-3-14 55280]

R0 SymDS;Symantec Data Store;c:\windows\system32\drivers\n360x64\0402000.00c\symds64.sys [2010-6-1 433200]

R0 SymEFA;Symantec Extended File Attributes;c:\windows\system32\drivers\n360x64\0402000.00c\symefa64.sys [2010-6-1 221232]

R0 tos_sps64;TOSHIBA tos_sps64 Service;c:\windows\system32\drivers\tos_sps64.sys [2010-3-14 482384]

R1 BHDrvx64;BHDrvx64;c:\programdata\norton\{0c55c096-0f1d-4f28-aaa2-85ef591126e7}\n360_4.0.0.127\definitions\bashdefs\20100709.001\BHDrvx64.sys [2010-7-12 942640]

R1 ccHP;Symantec Hash Provider;c:\windows\system32\drivers\n360x64\0402000.00c\cchpx64.sys [2010-6-1 615040]

R1 IDSVia64;IDSVia64;c:\programdata\norton\{0c55c096-0f1d-4f28-aaa2-85ef591126e7}\n360_4.0.0.127\definitions\ipsdefs\20100716.001\IDSviA64.sys [2010-7-16 463408]

R1 SASDIFSV;SASDIFSV;c:\program files\superantispyware\sasdifsv64.sys [2010-2-17 14920]

R1 SASKUTIL;SASKUTIL;c:\program files\superantispyware\saskutil64.sys [2010-2-17 12360]

R1 SymIRON;Symantec Iron Driver;c:\windows\system32\drivers\n360x64\0402000.00c\ironx64.sys [2010-6-1 150064]

R1 SYMTDIv;Symantec Vista Network Dispatch Driver;c:\windows\system32\drivers\n360x64\0402000.00c\symtdiv.sys [2010-6-1 451120]

R1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\drivers\vwififlt.sys [2009-7-13 59904]

R2 !SASCORE;SAS Core Service;c:\program files\superantispyware\SASCore64.exe [2010-6-29 128752]

R2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [2010-3-14 203264]

R2 cfWiMAXService;ConfigFree WiMAX Service;c:\program files (x86)\toshiba\configfree\CFIWmxSvcs64.exe [2009-8-10 248688]

R2 ConfigFree Gadget Service;ConfigFree Gadget Service;c:\program files (x86)\toshiba\configfree\CFProcSRVC.exe [2009-7-14 42368]

R2 ConfigFree Service;ConfigFree Service;c:\program files (x86)\toshiba\configfree\CFSvcs.exe [2009-3-10 46448]

R2 N360;Norton Security Suite;c:\program files (x86)\norton security suite\engine\4.2.0.12\ccsvchst.exe [2010-6-1 126392]

R2 TOSHIBA eco Utility Service;TOSHIBA eco Utility Service;c:\program files\toshiba\teco\TecoService.exe [2009-8-11 252272]

R2 TVALZFL;TOSHIBA ACPI-Based Value Added Logical and General Purpose Device Filter Driver;c:\windows\system32\drivers\TVALZFL.sys [2009-6-19 14472]

R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files (x86)\common files\symantec shared\eengine\EraserUtilRebootDrv.sys [2010-6-3 132656]

R3 FwLnk;FwLnk Driver;c:\windows\system32\drivers\FwLnk.sys [2010-3-14 9216]

R3 PGEffect;Pangu effect driver;c:\windows\system32\drivers\PGEffect.sys [2010-3-14 35008]

R3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\drivers\Rt64win7.sys [2009-11-5 291328]

R3 rtl8192se;Realtek Wireless LAN 802.11n PCI-E NIC NT Driver;c:\windows\system32\drivers\rtl8192se.sys [2010-4-26 1103904]

R3 TMachInfo;TMachInfo;c:\program files (x86)\toshiba\toshiba service station\TMachInfo.exe [2010-3-14 51512]

R3 TOSHIBA HDD SSD Alert Service;TOSHIBA HDD SSD Alert Service;c:\program files\toshiba\toshiba hdd ssd alert\TosSmartSrv.exe [2009-9-17 137560]

R3 TPCHSrv;TPCH Service;c:\program files\toshiba\tphm\TPCHSrv.exe [2009-8-4 826224]

S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]

S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\microsoft.net\framework64\v4.0.30319\mscorsvw.exe [2010-3-18 138576]

S2 gupdate;Google Update Service (gupdate);c:\program files (x86)\google\update\GoogleUpdate.exe [2010-4-10 135664]

S3 pbfilter;pbfilter;c:\program files\peerblock\pbfilter.sys [2010-4-9 19544]

S3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;c:\windows\system32\drivers\RtsUStor.sys [2010-3-14 222208]

S3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\wat\WatAdminSvc.exe [2010-4-16 1255736]

=============== Created Last 30 ================

2010-07-18 22:12:38 0 ----a-w- c:\users\mojet1\defogger_reenable

2010-07-18 22:00:16 423656 ----a-w- c:\windows\syswow64\deployJava1.dll

2010-07-18 22:00:16 153376 ----a-w- c:\windows\syswow64\javaws.exe

2010-07-18 22:00:16 145184 ----a-w- c:\windows\syswow64\javaw.exe

2010-07-18 22:00:16 145184 ----a-w- c:\windows\syswow64\java.exe

2010-07-18 21:56:57 0 d-----w- c:\programdata\Uniblue

2010-07-18 21:56:35 0 d-----w- c:\users\mojet1\appdata\roaming\Uniblue

2010-07-18 21:56:17 0 d-----w- c:\program files (x86)\Uniblue

2010-07-18 11:53:45 0 d-----w- c:\users\mojet1\appdata\roaming\Malwarebytes

2010-07-18 11:53:20 0 d-----w- c:\programdata\Malwarebytes

2010-07-18 11:53:18 24664 ----a-w- c:\windows\system32\drivers\mbam.sys

2010-07-18 08:21:02 0 d-----w- c:\users\mojet1\appdata\roaming\SUPERAntiSpyware.com

2010-07-18 08:21:02 0 d-----w- c:\programdata\SUPERAntiSpyware.com

2010-07-18 08:20:51 0 d-----w- c:\programdata\!SASCORE

2010-07-18 08:20:47 0 d-----w- c:\program files\SUPERAntiSpyware

2010-07-18 06:48:45 0 d-----w- c:\users\mojet1\DoctorWeb

2010-07-17 19:58:25 0 d-----w- c:\windows\pss

2010-07-17 16:24:27 0 d-----w- c:\programdata\Spybot - Search & Destroy

2010-07-17 16:24:27 0 d-----w- c:\program files (x86)\Spybot - Search & Destroy

2010-07-17 15:53:03 0 d-----w- c:\programdata\FrontLine Registry Cleaner

2010-07-17 15:52:54 0 d-----w- c:\program files (x86)\Frontline Registry Cleaner

2010-07-15 17:10:24 0 d-----w- c:\program files (x86)\CCleaner

2010-07-14 19:25:31 144384 ----a-w- c:\windows\system32\cdd.dll

2010-06-28 09:58:57 23 ----a-w- c:\program files (x86)\hfkud16.sys

2010-06-28 09:58:22 0 d-----w- c:\program files (x86)\TVPlayerUniversal

2010-06-27 17:02:38 0 d-----w- c:\programdata\McAfee

2010-06-23 07:01:34 99176 ----a-w- c:\windows\syswow64\PresentationHostProxy.dll

2010-06-23 07:01:33 49472 ----a-w- c:\windows\syswow64\netfxperf.dll

2010-06-23 07:01:33 48960 ----a-w- c:\windows\system32\netfxperf.dll

2010-06-23 07:01:33 444752 ----a-w- c:\windows\system32\mscoree.dll

2010-06-23 07:01:33 320352 ----a-w- c:\windows\system32\PresentationHost.exe

2010-06-23 07:01:33 297808 ----a-w- c:\windows\syswow64\mscoree.dll

2010-06-23 07:01:33 295264 ----a-w- c:\windows\syswow64\PresentationHost.exe

2010-06-23 07:01:33 1942856 ----a-w- c:\windows\system32\dfshim.dll

2010-06-23 07:01:33 1130824 ----a-w- c:\windows\syswow64\dfshim.dll

2010-06-23 07:01:33 109912 ----a-w- c:\windows\system32\PresentationHostProxy.dll

2010-06-22 19:24:07 1736608 ----a-w- c:\windows\system32\ntdll.dll

2010-06-22 19:24:07 1289528 ----a-w- c:\windows\syswow64\ntdll.dll

2010-06-22 19:23:33 961024 ----a-w- c:\windows\system32\CPFilters.dll

2010-06-22 19:23:30 641536 ----a-w- c:\windows\syswow64\CPFilters.dll

2010-06-22 19:23:29 552960 ----a-w- c:\windows\system32\msdri.dll

2010-06-22 19:23:29 258560 ----a-w- c:\windows\system32\mpg2splt.ax

2010-06-22 19:23:29 199680 ----a-w- c:\windows\syswow64\mpg2splt.ax

2010-06-22 19:23:28 288256 ----a-w- c:\windows\system32\MSNP.ax

2010-06-22 19:23:28 204288 ----a-w- c:\windows\syswow64\MSNP.ax

2010-06-19 07:09:59 0 d-----w- c:\programdata\Adobe Systems

2010-06-19 06:51:33 0 d-----w- c:\program files (x86)\common files\Adobe Systems Shared

2010-06-19 06:13:44 0 d-----w- c:\users\mojet1\wedding

==================== Find3M ====================

2010-05-27 07:24:13 34304 ----a-w- c:\windows\syswow64\atmlib.dll

2010-05-27 06:34:09 46080 ----a-w- c:\windows\system32\atmlib.dll

2010-05-27 04:11:32 366080 ----a-w- c:\windows\system32\atmfd.dll

2010-05-27 03:49:37 293888 ----a-w- c:\windows\syswow64\atmfd.dll

2010-05-21 05:52:30 1192960 ----a-w- c:\windows\system32\wininet.dll

2010-05-21 05:18:06 977920 ----a-w- c:\windows\syswow64\wininet.dll

2010-05-21 05:14:50 48128 ----a-w- c:\windows\syswow64\jsproxy.dll

2010-05-06 12:42:05 1225216 ----a-w- c:\windows\syswow64\urlmon.dll

2010-05-06 12:41:55 606208 ----a-w- c:\windows\syswow64\mstime.dll

2010-05-06 12:41:53 64512 ----a-w- c:\windows\syswow64\msfeedsbs.dll

2010-05-06 12:41:53 5970944 ----a-w- c:\windows\syswow64\mshtml.dll

2010-05-06 12:41:49 381440 ----a-w- c:\windows\syswow64\iedkcs32.dll

2010-05-06 12:41:49 10984448 ----a-w- c:\windows\syswow64\ieframe.dll

2010-05-01 15:07:05 3122176 ----a-w- c:\windows\system32\win32k.sys

2010-04-23 07:13:36 2048 ----a-w- c:\windows\syswow64\tzres.dll

2010-04-23 07:11:58 2048 ----a-w- c:\windows\system32\tzres.dll

2009-07-14 05:37:38 31548 ----a-w- c:\windows\inf\perflib\0409\perfd.dat

2009-07-14 05:37:38 31548 ----a-w- c:\windows\inf\perflib\0409\perfc.dat

2009-07-14 05:37:38 291294 ----a-w- c:\windows\inf\perflib\0409\perfi.dat

2009-07-14 05:37:38 291294 ----a-w- c:\windows\inf\perflib\0409\perfh.dat

2009-07-14 04:54:24 174 --sha-w- c:\program files\desktop.ini

2009-07-14 04:54:24 174 --sha-w- c:\program files (x86)\desktop.ini

2009-07-14 01:00:34 291294 ----a-w- c:\windows\inf\perflib\0000\perfi.dat

2009-07-14 01:00:34 291294 ----a-w- c:\windows\inf\perflib\0000\perfh.dat

2009-07-14 01:00:32 31548 ----a-w- c:\windows\inf\perflib\0000\perfd.dat

2009-07-14 01:00:32 31548 ----a-w- c:\windows\inf\perflib\0000\perfc.dat

2009-06-10 20:44:08 9633792 --sha-r- c:\windows\fonts\StaticCache.dat

2010-04-11 04:58:55 245760 --sha-w- c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\windows\ietldcache\index.dat

2010-04-09 23:56:06 13 --sh--r- c:\windows\system32\drivers\fbd.sys

2009-07-14 01:39:53 398848 --sha-w- c:\windows\winsxs\amd64_microsoft-windows-mail-app_31bf3856ad364e35_6.1.7600.16385_none_4d4d1f2f696639a2\WinMail.exe

2009-07-14 01:14:45 396800 --sha-w- c:\windows\winsxs\x86_microsoft-windows-mail-app_31bf3856ad364e35_6.1.7600.16385_none_f12e83abb108c86c\WinMail.exe

============= FINISH: 18:30:21.49 ===============

and my mbam logs

Malwarebytes' Anti-Malware 1.46

DB: 4052

IE: Internet Explorer 8.0.7600.16385

OS: Windows 6.1.7600

EX: C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbam

DB: C:\ProgramData\Malwarebytes\Malwarebytes' Anti-Malware\rules.ref

U: MOjet1

W: C:\windows

S: C:\windows\system32

RD: C:

PF: C:\Program Files

PF: C:\Program Files (x86)

CF: C:\Program Files (x86)\Common Files

CF: C:\Program Files\Common Files

DAS: C:\Users

D: C:\Users\Default\Desktop

D: C:\Users\MOjet1\Desktop

D: C:\Users\Public\Desktop

D: C:\Windows\ServiceProfiles\LocalService\Desktop

D: C:\Windows\ServiceProfiles\NetworkService\Desktop

SM: C:\ProgramData\Microsoft\Windows\Start Menu

SM: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu

SM: C:\Users\MOjet1\AppData\Roaming\Microsoft\Windows\Start Menu

SM: C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu

SM: C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Start Menu

UR: C:\Users\Default

UR: C:\Users\MOjet1

UR: C:\Users\Public

UR: C:\Windows\ServiceProfiles\LocalService

UR: C:\Windows\ServiceProfiles\NetworkService

UR: C:\windows\system32\config\systemprofile

F: C:\Users\Default\Favorites

F: C:\Users\MOjet1\Favorites

F: C:\Users\Public\Favorites

F: C:\Windows\ServiceProfiles\LocalService\Favorites

F: C:\Windows\ServiceProfiles\NetworkService\Favorites

AD: C:\ProgramData

AD: C:\Users\MOjet1\AppData\Roaming

AD: C:\Users\Default\AppData\Roaming

AD: C:\Windows\ServiceProfiles\LocalService\AppData\Roaming

AD: C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming

AD: C:\windows\system32\config\systemprofile\AppData\Roaming

QL: C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch

QL: C:\Users\MOjet1\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch

QL: C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch

QL: C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch

TF: C:\Users\Default\AppData\Local\Temp

TF: C:\Users\MOjet1\AppData\Local\Temp

TF: C:\Windows\ServiceProfiles\LocalService\AppData\Local\Temp

TF: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp

TF: C:\windows\Temp

i know there is alot i have forgotten, so please let me know what i need to do next, i really appreciate all that you can do for me. thank you.

P: C:\ProgramData\Microsoft\Windows\Start Menu\Programs

P: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs

P: C:\Users\MOjet1\AppData\Roaming\Microsoft\Windows\Start Menu\Programs

P: C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs

P: C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs

S: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup

S: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup

S: C:\Users\MOjet1\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup

D: C:\Users\Default\Documents

D: C:\Users\MOjet1\Documents

D: C:\Users\Public\Documents

D: C:\Windows\ServiceProfiles\LocalService\Documents

D: C:\Windows\ServiceProfiles\NetworkService\Documents

dds_2.txt

screen317 · August 5, 2010

Hello and welcome to Malwarebytes.

My apologies for the extended delay; do you still need help?

MrsM1 · August 5, 2010

Hello and welcome to Malwarebytes.
My apologies for the extended delay; do you still need help?

no problem at all , i really do need help. currently i have posted in two forums yours and bleeping computer and i was just waiting for a reply. as for mbam not updating i had to change the name of the file to confuse whatever it is on my computer to update and now it updates. but i dont think it finds whats hiding on my computer. when i search on Google it doesnt redirect it, because of the add on that i put on mozilla, but yahoo searches still get redirected and the odd google search still gets redirected to some crap listing site. so here is what i have done thus far, ran gmer.. only three of the boxes under toolkit show up with an error mssg that says, cant uses window, system32, config/system file in use, then it scans with another popup of same mssg with same results, apparently my comp is clean. I changed my router password from its default one last saturday and now it works quickly, where as before it was slowing down. i have run mbam several times it always finds a tracking cookie or two or thirty, i have and do run regularly superantispyware at first it found some stuff, but it was mostly only cookies, one trojan.. i have run rootkit, it finds nothing, i have done this in safe mode and normal mode. But i know something is there, can you help. here are ( attached) my dds logs, my otl logs, mymbr logs and my mbam logs

Done!

i havent run hijack this, as yet simply because not sure what to do with it all, nor have i touched combofix.. let me know what would be the best solution. all the above test were run with my machine defogged..

thanks for your help..

DDS_1.txt

Attach_aug_2010.txt

MBRCheck_08.04.10_02.43.47.txt

OTL.Txt

mbam_log_2010_07_18__07_59_07_.txt

avgrep.txt

screen317 · August 5, 2010

Hi,

In the future please post all logs directly into your reply instead of attaching them.

With that said, please update MBAM, run a Quick Scan, and post its log.

Next, please run a free online scan with the ESET Online Scanner

Note: You will need to use Internet Explorer for this scan.

Tick the box next to YES, I accept the Terms of Use.
Click Start
When asked, allow the ActiveX control to install
Click Start
Make sure that the options Remove found threats and the option Scan unwanted applications is checked
Click Scan
Wait for the scan to finish
Use Notepad to open the logfile located at C:\Program Files\EsetOnlineScanner\log.txt
Copy and paste that log as a reply to this topic

-screen317

MrsM1 · August 6, 2010

Hi,
In the future please post all logs directly into your reply instead of attaching them.
With that said, please update MBAM, run a Quick Scan, and post its log.
Next, please run a free online scan with the ESET Online Scanner
Note: You will need to use Internet Explorer for this scan.
Tick the box next to YES, I accept the Terms of Use.
Click Start
When asked, allow the ActiveX control to install
Click Start
Make sure that the options Remove found threats and the option Scan unwanted applications is checked
Click Scan
Wait for the scan to finish
Use Notepad to open the logfile located at C:\Program Files\EsetOnlineScanner\log.txt
Copy and paste that log as a reply to this topic
-screen317

hi ok i will do that, I tried to post the logs instead of attaching them but it said it was too big. ok will get back to you soon.

I have run eset online scanner several times, it finds nothing> but i will do so again and post the logs here.

Thanks

MrsM1 · August 6, 2010

hi ok i will do that, I tried to post the logs instead of attaching them but it said it was too big. ok will get back to you soon.
I have run eset online scanner several times, it finds nothing> but i will do so again and post the logs here.
Thanks

my mbam log:

Malwarebytes' Anti-Malware 1.46

www.malwarebytes.org

Database version: 4375

Windows 6.1.7600

Internet Explorer 8.0.7600.16385

8/6/2010 12:59:08

mbam-log-2010-08-06 (12-59-08).txt

Scan type: Quick scan

Objects scanned: 132063

Time elapsed: 6 minute(s), 57 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 0

Registry Values Infected: 0

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 0

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

(No malicious items detected)

Registry Values Infected:

(No malicious items detected)

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

(No malicious items detected)

Files Infected:

(No malicious items detected)

my eset scanner log:

C:\Program Files (x86)\Mozilla Firefox\SmitfraudFix\Process.exe Win32/PrcView application cleaned by deleting - quarantined

C:\Program Files (x86)\Mozilla Firefox\SmitfraudFix\restart.exe Win32/Shutdown.NAA application cleaned by deleting - quarantined

C:\Users\MOjet1\Downloads\SmitfraudFix.exe multiple threats deleted - quarantined

C:\Users\MOjet1\Downloads\SmitfraudFix\Process.exe Win32/PrcView application cleaned by deleting - quarantined

C:\Users\MOjet1\Downloads\SmitfraudFix\restart.exe Win32/Shutdown.NAA application cleaned by deleting - quarantined

C:\Windows\System32\Process.exe Win32/PrcView application cleaned by deleting - quarantined

it found threats and fixed em, but yahoo searches are still being redirected, now some pages arent opening at all even if i copy and paste the url.

screen317 · August 6, 2010

Hi,

Do you use a router?

MrsM1 · August 6, 2010

Hi,
Do you use a router?

yes

screen317 · August 7, 2010

It is likely that you router is infected.

Please restore it to factory default settings (by accessing 192.168.0.1 or 192.168.1.1 or whatever your manufacturer specifies).

Next, change the default password!

Next, on your computer, navigate to Start --> Run, and enter cmd.exe; press Enter.

In the black box that appears, enter ipconfig /flushdns

Press Enter.

Close cmd.exe, restart your computer, and let me know if the issue persists.

-screen317

MrsM1 · August 7, 2010

It is likely that you router is infected.
Please restore it to factory default settings (by accessing 192.168.0.1 or 192.168.1.1 or whatever your manufacturer specifies).
Next, change the default password!
Next, on your computer, navigate to Start --> Run, and enter cmd.exe; press Enter.
In the black box that appears, enter ipconfig /flushdns
Press Enter.
Close cmd.exe, restart your computer, and let me know if the issue persists.
-screen317

yes it does, i did all these steps two weeks ago, i did them again this morning, yahoo searches are still being hijacked and certain google searches are too. it helped initially when i first did it a few weeks ago, but i am still having reports from mbam that a malicious site is trying to access my comp, also certain webpages get blocked.

screen317 · August 8, 2010

Hi,

Where are Yahoo searches getting hijacked to?

Download OTL.exe by OldTimer to your Desktop.

Close all windows and double click OTL.exe.
Click Run Scan and let the program run uninterrupted.
It will produce two logs for you, one will pop up - OTL.txt, the other will be saved on your Desktop - Extras.txt. Post both logs in this thread.
You may need to use two posts to get it all.

MrsM1 · August 8, 2010

Hi,
Where are Yahoo searches getting hijacked to?
Download OTL.exe by OldTimer to your Desktop.
Close all windows and double click OTL.exe.
Click Run Scan and let the program run uninterrupted.
It will produce two logs for you, one will pop up - OTL.txt, the other will be saved on your Desktop - Extras.txt. Post both logs in this thread.
You may need to use two posts to get it all.

they are redirected to crappy shopping list sites...ok heres one "http://www.freshdeals.com/deals.php?uvx=iOogDni088shv1nPQ-3e_Pw--f4X7x5PzFPUSxhmQT7KYzGkBecg3wQPsPH7dFv-NWYOSEZExN5W_At1cf5WMsxZAT46sLT628DcDwQPGXDkfJBDqYbRx5mcSEu_NjoddBnbWliQPM4YBA-pG4r9EQsD3AA27D0zhDTc12McIudUWHLut9yK2pBEPU4hhNnR8weLmaglIwYLKoztYGvsLty5S2mGoLV

PO1JJxJPhLH1oPD7ffoqmwQ**" and another "bridge1.admarketplace.net." i have had shopica,, shoppingmarkets. etc.

otl text>

OTL logfile created on: 8/8/2010 13:16:10 - Run 2

OTL by OldTimer - Version 3.2.9.1 Folder = C:\Users\MOjet1\Downloads

64bit- Home Premium Edition (Version = 6.1.7600) - Type = NTWorkstation

Internet Explorer (Version = 8.0.7600.16385)

Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

4.00 Gb Total Physical Memory | 1.00 Gb Available Physical Memory | 19.00% Memory free

7.00 Gb Paging File | 3.00 Gb Available in Paging File | 42.00% Paging File free

Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\windows | %ProgramFiles% = C:\Program Files (x86)

Drive C: | 287.61 Gb Total Space | 179.05 Gb Free Space | 62.26% Space Free | Partition Type: NTFS

Drive D: | 4.38 Gb Total Space | 0.08 Gb Free Space | 1.85% Space Free | Partition Type: UDF

E: Drive not present or media not loaded

F: Drive not present or media not loaded

G: Drive not present or media not loaded

H: Drive not present or media not loaded

I: Drive not present or media not loaded

Computer Name: MOJET1-PC

Current User Name: MOjet1

Logged in as Administrator.

Current Boot Mode: Normal

Scan Mode: Current user

Include 64bit Scans

Company Name Whitelist: Off

Skip Microsoft Files: Off

File Age = 30 Days

Output = Standard

========== Processes (SafeList) ==========

PRC - [2010/08/04 02:49:44 | 000,574,976 | ---- | M] (OldTimer Tools) -- C:\Users\MOjet1\Downloads\OTL.exe

PRC - [2010/07/24 13:28:22 | 000,014,808 | ---- | M] (Mozilla Corporation) -- C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe

PRC - [2010/07/24 13:28:21 | 000,910,296 | ---- | M] (Mozilla Corporation) -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe

PRC - [2010/07/23 05:26:07 | 002,403,568 | ---- | M] (SUPERAntiSpyware.com) -- C:\Program Files (x86)\SUPERAntiSpyware\SUPERANTISPYWARE.EXE

PRC - [2010/07/20 22:05:07 | 000,921,952 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files (x86)\AVG\AVG9\avgemc.exe

PRC - [2010/07/20 21:49:30 | 000,723,296 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files (x86)\AVG\AVG9\avgcsrvx.exe

PRC - [2010/07/20 21:49:15 | 002,065,760 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files (x86)\AVG\AVG9\avgtray.exe

PRC - [2010/07/20 21:48:44 | 000,308,136 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files (x86)\AVG\AVG9\avgwdsvc.exe

PRC - [2010/04/29 15:39:34 | 000,304,464 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe

PRC - [2010/04/29 15:39:32 | 000,437,584 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe

PRC - [2010/03/16 20:58:44 | 002,162,688 | ---- | M] () -- C:\Program Files (x86)\Vidalia Bundle\Tor\tor.exe

PRC - [2010/02/27 23:45:02 | 005,344,807 | ---- | M] () -- C:\Program Files (x86)\Vidalia Bundle\Vidalia\vidalia.exe

PRC - [2009/07/28 23:26:42 | 000,062,848 | ---- | M] (TOSHIBA CORPORATION) -- C:\Program Files (x86)\TOSHIBA\ConfigFree\CFSwMgr.exe

PRC - [2009/07/14 22:10:30 | 000,042,368 | ---- | M] (TOSHIBA CORPORATION) -- C:\Program Files (x86)\TOSHIBA\ConfigFree\CFProcSRVC.exe

PRC - [2009/07/13 18:24:00 | 000,304,496 | ---- | M] (TOSHIBA CORPORATION) -- C:\Program Files (x86)\TOSHIBA\ConfigFree\NDSTray.exe

PRC - [2009/03/10 21:51:20 | 000,046,448 | ---- | M] (TOSHIBA CORPORATION) -- C:\Program Files (x86)\TOSHIBA\ConfigFree\CFSvcs.exe

PRC - [2008/11/09 16:48:14 | 000,602,392 | ---- | M] (Yahoo! Inc.) -- C:\Program Files (x86)\Yahoo!\SoftwareUpdate\YahooAUService.exe

PRC - [2008/04/24 13:26:18 | 000,202,560 | ---- | M] (SupportSoft, Inc.) -- C:\Program Files (x86)\Comcast\Desktop Doctor\bin\sprtsvc.exe

PRC - [2007/04/27 19:30:54 | 000,380,928 | ---- | M] (QSX Software Group) -- C:\Program Files (x86)\Ovulation Calendar\OvuCal.exe

========== Modules (SafeList) ==========

MOD - [2010/08/04 02:49:44 | 000,574,976 | ---- | M] (OldTimer Tools) -- C:\Users\MOjet1\Downloads\OTL.exe

MOD - [2009/07/13 21:14:10 | 000,095,232 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWOW64\msscript.ocx

MOD - [2009/07/13 21:03:50 | 001,680,896 | ---- | M] (Microsoft Corporation) -- C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7600.16385_none_421189da2b7fabfc\comctl32.dll

========== Win32 Services (SafeList) ==========

SRV:64bit: - File not found [Auto | Stopped] -- C:\Program Files\SUPERAntiSpyware\SASCORE64.EXE -- (!SASCORE)

SRV:64bit: - [2009/09/17 15:41:36 | 000,137,560 | ---- | M] (TOSHIBA Corporation) [On_Demand | Running] -- C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSmartSrv.exe -- (TOSHIBA HDD SSD Alert Service)

SRV:64bit: - [2009/08/21 12:31:06 | 000,488,800 | ---- | M] (TOSHIBA Corporation) [Auto | Running] -- C:\Program Files\TOSHIBA\Power Saver\TosCoSrv.exe -- (TosCoSrv)

SRV:64bit: - [2009/08/11 19:10:48 | 000,252,272 | ---- | M] (TOSHIBA Corporation) [Auto | Running] -- C:\Program Files\TOSHIBA\TECO\TecoService.exe -- (TOSHIBA eco Utility Service)

SRV:64bit: - [2009/08/04 14:15:06 | 000,826,224 | ---- | M] (TOSHIBA Corporation) [On_Demand | Running] -- C:\Program Files\TOSHIBA\TPHM\TPCHSrv.exe -- (TPCHSrv)

SRV:64bit: - [2009/07/30 02:54:22 | 000,203,264 | ---- | M] (AMD) [Auto | Running] -- C:\Windows\SysNative\atiesrxx.exe -- (AMD External Events Utility)

SRV:64bit: - [2009/07/28 19:48:06 | 000,140,632 | ---- | M] (TOSHIBA Corporation) [Auto | Running] -- C:\Windows\SysNative\TODDSrv.exe -- (TODDSrv)

SRV:64bit: - [2009/07/13 21:41:27 | 001,011,712 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)

SRV - [2010/07/20 22:05:07 | 000,921,952 | ---- | M] (AVG Technologies CZ, s.r.o.) [Auto | Running] -- C:\Program Files (x86)\AVG\AVG9\avgemc.exe -- (avg9emc)

SRV - [2010/07/20 21:48:44 | 000,308,136 | ---- | M] (AVG Technologies CZ, s.r.o.) [On_Demand | Running] -- C:\Program Files (x86)\AVG\AVG9\avgwdsvc.exe -- (avg9wd)

SRV - [2010/04/29 15:39:34 | 000,304,464 | ---- | M] (Malwarebytes Corporation) [Auto | Running] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe -- (MBAMService)

SRV - [2010/04/19 10:25:38 | 000,430,152 | ---- | M] () [On_Demand | Stopped] -- C:\Program Files (x86)\AVG\AVG9\Toolbar\ToolbarBroker.exe -- (AVG Security Toolbar Service)

SRV - [2010/03/18 14:27:14 | 000,138,576 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_64)

SRV - [2010/03/18 13:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)

SRV - [2009/08/17 13:48:42 | 000,051,512 | ---- | M] (TOSHIBA Corporation) [On_Demand | Running] -- C:\Program Files (x86)\TOSHIBA\TOSHIBA Service Station\TMachInfo.exe -- (TMachInfo)

SRV - [2009/08/10 22:55:58 | 000,248,688 | ---- | M] (TOSHIBA CORPORATION) [Auto | Running] -- C:\Program Files (x86)\TOSHIBA\ConfigFree\CFIWmxSvcs64.exe -- (cfWiMAXService)

SRV - [2009/07/14 22:10:30 | 000,042,368 | ---- | M] (TOSHIBA CORPORATION) [Auto | Running] -- C:\Program Files (x86)\TOSHIBA\ConfigFree\CFProcSRVC.exe -- (ConfigFree Gadget Service)

SRV - [2009/03/10 21:51:20 | 000,046,448 | ---- | M] (TOSHIBA CORPORATION) [Auto | Running] -- C:\Program Files (x86)\TOSHIBA\ConfigFree\CFSvcs.exe -- (ConfigFree Service)

SRV - [2008/11/09 16:48:14 | 000,602,392 | ---- | M] (Yahoo! Inc.) [Auto | Running] -- C:\Program Files (x86)\Yahoo!\SoftwareUpdate\YahooAUService.exe -- (YahooAUService)

SRV - [2008/04/24 13:26:18 | 000,202,560 | ---- | M] (SupportSoft, Inc.) [Auto | Running] -- C:\Program Files (x86)\Comcast\Desktop Doctor\bin\sprtsvc.exe -- (sprtsvc_ddoctorv2) SupportSoft Sprocket Service (ddoctorv2)

========== Driver Services (SafeList) ==========

DRV:64bit: - File not found [Kernel | On_Demand | Stopped] -- C:\windows\SysNative\DRIVERS\RtsUCcid.sys -- (USBCCID)

DRV:64bit: - File not found [Kernel | On_Demand | Stopped] -- C:\windows\SysNative\DRIVERS\Rts516xIR.sys -- (RtsUIR)

DRV:64bit: - [2010/07/20 21:50:49 | 000,317,520 | ---- | M] (AVG Technologies CZ, s.r.o.) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\avgtdia.sys -- (AvgTdiA)

DRV:64bit: - [2010/07/20 21:50:40 | 000,269,904 | ---- | M] (AVG Technologies CZ, s.r.o.) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\avgldx64.sys -- (AvgLdx64)

DRV:64bit: - [2010/07/20 21:50:36 | 000,035,536 | ---- | M] (AVG Technologies CZ, s.r.o.) [File_System | System | Running] -- C:\Windows\SysNative\drivers\avgmfx64.sys -- (AvgMfx64)

DRV:64bit: - [2010/04/29 15:39:28 | 000,024,664 | ---- | M] (Malwarebytes Corporation) [File_System | On_Demand | Running] -- C:\Windows\SysNative\drivers\mbam.sys -- (MBAMProtector)

DRV:64bit: - [2010/04/26 17:23:08 | 001,103,904 | ---- | M] (Realtek Semiconductor Corporation ) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\rtl8192se.sys -- (rtl8192se)

DRV:64bit: - [2009/11/05 14:15:40 | 000,291,328 | ---- | M] (Realtek ) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Rt64win7.sys -- (RTL8167)

DRV:64bit: - [2009/09/28 02:02:38 | 000,019,544 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Program Files\PeerBlock\pbfilter.sys -- (pbfilter)

DRV:64bit: - [2009/08/05 22:04:06 | 000,222,208 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\RtsUStor.sys -- (RSUSBSTOR)

DRV:64bit: - [2009/07/31 00:22:04 | 000,027,784 | ---- | M] (TOSHIBA Corporation.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\tdcmdpst.sys -- (tdcmdpst)

DRV:64bit: - [2009/07/30 15:07:12 | 006,037,504 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\atikmdag.sys -- (atikmdag)

DRV:64bit: - [2009/07/24 18:57:08 | 000,482,384 | ---- | M] (TOSHIBA Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\tos_sps64.sys -- (tos_sps64)

DRV:64bit: - [2009/07/20 20:48:32 | 000,274,480 | ---- | M] (Synaptics Incorporated) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\SynTP.sys -- (SynTP)

DRV:64bit: - [2009/07/14 18:31:18 | 000,026,840 | ---- | M] (TOSHIBA Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\TVALZ_O.SYS -- (TVALZ)

DRV:64bit: - [2009/07/13 21:52:21 | 000,106,576 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata)

DRV:64bit: - [2009/07/13 21:52:21 | 000,028,752 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata)

DRV:64bit: - [2009/07/13 21:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs)

DRV:64bit: - [2009/07/13 21:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2)

DRV:64bit: - [2009/07/13 21:47:48 | 000,077,888 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD)

DRV:64bit: - [2009/07/13 21:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor)

DRV:64bit: - [2009/07/09 06:00:00 | 000,055,280 | ---- | M] (Sonic Solutions) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\PxHlpa64.sys -- (PxHlpa64)

DRV:64bit: - [2009/07/07 11:51:42 | 000,009,216 | ---- | M] (TOSHIBA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\FwLnk.sys -- (FwLnk)

DRV:64bit: - [2009/06/22 20:06:38 | 000,035,008 | ---- | M] (TOSHIBA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\PGEffect.sys -- (PGEffect)

DRV:64bit: - [2009/06/19 22:15:22 | 000,014,472 | ---- | M] (TOSHIBA Corporation) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\TVALZFL.sys -- (TVALZFL)

DRV:64bit: - [2009/06/19 22:09:57 | 001,394,688 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\athrx.sys -- (athr)

DRV:64bit: - [2009/06/10 17:01:06 | 001,146,880 | ---- | M] (LSI Corp) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\agrsm64.sys -- (AgereSoftModem)

DRV:64bit: - [2009/06/10 16:38:56 | 000,000,308 | ---- | M] () [File_System | On_Demand | Running] -- C:\Windows\SysNative\wbem\ntfs.mof -- (Ntfs)

DRV:64bit: - [2009/06/10 16:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv)

DRV:64bit: - [2009/06/10 16:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv)

DRV:64bit: - [2009/06/10 16:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a)

DRV:64bit: - [2009/06/10 16:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir)

DRV:64bit: - [2009/05/05 03:30:28 | 000,016,440 | ---- | M] (Advanced Micro Devices Inc.) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\AtiPcie.sys -- (AtiPcie) AMD PCI Express (3GIO)

DRV - [2010/08/04 02:30:31 | 000,034,560 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\windows\SysWow64\drivers\Normandy.sys -- (Normandy)

DRV - [2010/07/23 05:26:07 | 000,012,872 | ---- | M] (SUPERAdBlocker.com and SUPERAntiSpyware.com) [Kernel | System | Stopped] -- C:\Program Files (x86)\SUPERAntiSpyware\SASDIFSV.SYS -- (SASDIFSV)

DRV - [2010/07/23 05:26:06 | 000,067,656 | ---- | M] (SUPERAdBlocker.com and SUPERAntiSpyware.com) [Kernel | System | Stopped] -- C:\Program Files (x86)\SUPERAntiSpyware\SASKUTIL.SYS -- (SASKUTIL)

DRV - [2010/07/23 05:26:06 | 000,012,872 | ---- | M] ( SUPERAdBlocker.com and SUPERAntiSpyware.com) [Kernel | On_Demand | Stopped] -- C:\Program Files (x86)\SUPERAntiSpyware\SASENUM.SYS -- (SASENUM)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.google.com/ig/redirectdomain?br...A&bmod=TSNA

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com/ig/redirectdomain?br...A&bmod=TSNA

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.google.com/ig?brand=TSNA&bmod=TSNA

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = www.google.com

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchDefaultBranded = 1

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/?r0=1279861101

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://www.msn.com/

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = en-us

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 83 6C 6F 74 B6 26 CB 01 [binary data]

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Restore = http://www.google.com/ig?brand=TSNA&bmod=TSNA

IE - HKCU\..\URLSearchHook: {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Program Files (x86)\AVG\AVG9\Toolbar\IEToolbar.dll ()

IE - HKCU\..\URLSearchHook: {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn\yt.dll (Yahoo! Inc.)

IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = 127.0.0.1:8118

IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "AutoConfigURL" = file://C:/Users/MOjet1/AppData/Local/Google/Chrome/User%20Data/Default/Extensions/caehdcpeofiiigpdhbabniblemipncjj/SwitchyAuto.pac?1281170372375

========== FireFox ==========

FF - prefs.js..browser.search.defaultenginename: "Yahoo! Search"

FF - prefs.js..browser.search.defaultthis.engineName: "Free TV Bar c3 Customized Web Search"

FF - prefs.js..browser.search.defaulturl: "http://search.conduit.com/ResultsExt.aspx?ctid=CT2399412&SearchSource=3&q={searchTerms}"

FF - prefs.js..browser.search.param.yahoo-fr: "chrf-ytbm"

FF - prefs.js..browser.search.param.yahoo-fr-cjkt: "chrf-ytbm"

FF - prefs.js..browser.search.param.yahoo-type: "${8}"

FF - prefs.js..browser.search.selectedEngine: "Google"

FF - prefs.js..browser.startup.homepage: "http://www.yahoo.com/"

FF - prefs.js..extensions.enabledItems: foxyproxy@eric.h.jung:2.21.3

FF - prefs.js..extensions.enabledItems: firefox@ghostery.com:2.2.1

FF - prefs.js..extensions.enabledItems: tabberwocky@studio17.wordpress.com:1.1

FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}:6.0.21

FF - prefs.js..extensions.enabledItems: optimizegoogle@optimizegoogle.com:0.78.1

FF - prefs.js..extensions.enabledItems: {3EC9C995-8072-4fc0-953E-4F30620D17F3}:2.0.0.4

FF - prefs.js..extensions.enabledItems: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:1.2.1

FF - prefs.js..extensions.enabledItems: craigslistpeek@tech4computer:0.042

FF - prefs.js..extensions.enabledItems: {46551EC9-40F0-4e47-8E18-8E5CF550CFB8}:1.0.9

FF - prefs.js..extensions.enabledItems: {3f963a5b-e555-4543-90e2-c3908898db71}:9.0.0.845

FF - prefs.js..extensions.enabledItems: https-everywhere@eff.org:0.2.2.development.3

FF - prefs.js..keyword.URL: "http://us.yhs.search.yahoo.com/avg/search?fr=yhs-avg&type=yahoo_avg_hs2-tb-web_us&p="

FF - HKLM\software\mozilla\Firefox\Extensions\\{3f963a5b-e555-4543-90e2-c3908898db71}: C:\Program Files (x86)\AVG\AVG9\Firefox [2010/07/20 22:05:41 | 000,000,000 | ---D | M]

FF - HKLM\software\mozilla\Firefox\Extensions\\avg@igeared: C:\Program Files (x86)\AVG\AVG9\Toolbar\Firefox\avg@igeared [2010/07/20 21:50:30 | 000,000,000 | ---D | M]

FF - HKLM\software\mozilla\Mozilla Firefox 3.6.8\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2010/07/24 13:28:23 | 000,000,000 | ---D | M]

FF - HKLM\software\mozilla\Mozilla Firefox 3.6.8\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2010/07/31 17:30:57 | 000,000,000 | ---D | M]

[2010/04/10 04:04:18 | 000,000,000 | ---D | M] -- C:\Users\MOjet1\AppData\Roaming\mozilla\Extensions

[2010/08/08 03:57:04 | 000,000,000 | ---D | M] -- C:\Users\MOjet1\AppData\Roaming\mozilla\Firefox\Profiles\4t6796v2.default\extensions

[2010/07/19 00:28:45 | 000,000,000 | ---D | M] (WeatherBug) -- C:\Users\MOjet1\AppData\Roaming\mozilla\Firefox\Profiles\4t6796v2.default\extensions\{3EC9C995-8072-4fc0-953E-4F30620D17F3}

[2010/07/19 00:47:31 | 000,000,000 | ---D | M] (Stylish) -- C:\Users\MOjet1\AppData\Roaming\mozilla\Firefox\Profiles\4t6796v2.default\extensions\{46551EC9-40F0-4e47-8E18-8E5CF550CFB8}

[2010/07/29 03:54:52 | 000,000,000 | ---D | M] (NoScript) -- C:\Users\MOjet1\AppData\Roaming\mozilla\Firefox\Profiles\4t6796v2.default\extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}

[2010/07/19 00:43:48 | 000,000,000 | ---D | M] (Adblock Plus) -- C:\Users\MOjet1\AppData\Roaming\mozilla\Firefox\Profiles\4t6796v2.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}

[2010/07/31 16:15:47 | 000,000,000 | ---D | M] -- C:\Users\MOjet1\AppData\Roaming\mozilla\Firefox\Profiles\4t6796v2.default\extensions\craigslistpeek@tech4computer

[2010/07/22 11:54:13 | 000,000,000 | ---D | M] -- C:\Users\MOjet1\AppData\Roaming\mozilla\Firefox\Profiles\4t6796v2.default\extensions\firefox@ghostery.com

[2010/07/12 00:01:09 | 000,000,000 | ---D | M] -- C:\Users\MOjet1\AppData\Roaming\mozilla\Firefox\Profiles\4t6796v2.default\extensions\foxyproxy@eric.h.jung

[2010/07/26 01:56:16 | 000,000,000 | ---D | M] -- C:\Users\MOjet1\AppData\Roaming\mozilla\Firefox\Profiles\4t6796v2.default\extensions\https-everywhere@eff.org

[2010/07/18 19:21:56 | 000,000,000 | ---D | M] -- C:\Users\MOjet1\AppData\Roaming\mozilla\Firefox\Profiles\4t6796v2.default\extensions\optimizegoogle@optimizegoogle.com

[2010/07/17 17:39:05 | 000,000,000 | ---D | M] -- C:\Users\MOjet1\AppData\Roaming\mozilla\Firefox\Profiles\4t6796v2.default\extensions\tabberwocky@studio17.wordpress.com

[2010/06/08 11:30:18 | 000,000,931 | ---- | M] () -- C:\Users\MOjet1\AppData\Roaming\Mozilla\FireFox\Profiles\4t6796v2.default\searchplugins\conduit.xml

[2010/07/31 16:19:34 | 000,000,000 | ---D | M] -- C:\Program Files (x86)\Mozilla Firefox\extensions

[2010/07/18 18:00:20 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}

[2010/04/18 23:33:37 | 000,000,000 | ---D | M] -- C:\Program Files (x86)\Mozilla Firefox\extensions\staff@hide-my-ip.com

[2010/07/18 17:59:50 | 000,423,656 | ---- | M] (Oracle) -- C:\Program Files (x86)\Mozilla Firefox\plugins\npdeployJava1.dll

O1 HOSTS File: ([2010/07/17 15:50:52 | 000,412,182 | R--- | M]) - C:\Windows\SysNative\drivers\etc\hosts

O1 - Hosts: 127.0.0.1 www.007guard.com

O1 - Hosts: 127.0.0.1 007guard.com

O1 - Hosts: 127.0.0.1 008i.com

O1 - Hosts: 127.0.0.1 www.008k.com

O1 - Hosts: 127.0.0.1 008k.com

O1 - Hosts: 127.0.0.1 www.00hq.com

O1 - Hosts: 127.0.0.1 00hq.com

O1 - Hosts: 127.0.0.1 010402.com

O1 - Hosts: 127.0.0.1 www.032439.com

O1 - Hosts: 127.0.0.1 032439.com

O1 - Hosts: 127.0.0.1 www.0scan.com

O1 - Hosts: 127.0.0.1 0scan.com

O1 - Hosts: 127.0.0.1 1000gratisproben.com

O1 - Hosts: 127.0.0.1 www.1000gratisproben.com

O1 - Hosts: 127.0.0.1 1001namen.com

O1 - Hosts: 127.0.0.1 www.1001namen.com

O1 - Hosts: 127.0.0.1 100888290cs.com

O1 - Hosts: 127.0.0.1 www.100888290cs.com

O1 - Hosts: 127.0.0.1 www.100sexlinks.com

O1 - Hosts: 127.0.0.1 100sexlinks.com

O1 - Hosts: 127.0.0.1 10sek.com

O1 - Hosts: 127.0.0.1 www.10sek.com

O1 - Hosts: 127.0.0.1 www.1-2005-search.com

O1 - Hosts: 127.0.0.1 1-2005-search.com

O1 - Hosts: 127.0.0.1 123fporn.info

O1 - Hosts: 14241 more lines...

O2:64bit: - BHO: (AVG Safe Search) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files (x86)\AVG\AVG9\avgssiea.dll (AVG Technologies CZ, s.r.o.)

O2 - BHO: (&Yahoo! Toolbar Helper) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn\yt.dll (Yahoo! Inc.)

O2 - BHO: (AVG Safe Search) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files (x86)\AVG\AVG9\avgssie.dll (AVG Technologies CZ, s.r.o.)

O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.

O2 - BHO: (AVG Security Toolbar BHO) - {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Program Files (x86)\AVG\AVG9\Toolbar\IEToolbar.dll ()

O2 - BHO: (no name) - {FCBCCB87-9224-4B8D-B117-F56D924BEB18} - No CLSID value found.

O2 - BHO: (SingleInstance Class) - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn\YTSingleInstance.dll (Yahoo! Inc)

O3:64bit: - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.

O3 - HKLM\..\Toolbar: (no name) - {0C8413C1-FAD1-446C-8584-BE50576F863E} - No CLSID value found.

O3 - HKLM\..\Toolbar: (AVG Security Toolbar) - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - C:\Program Files (x86)\AVG\AVG9\Toolbar\IEToolbar.dll ()

O3 - HKLM\..\Toolbar: (Yahoo! Toolbar) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn\yt.dll (Yahoo! Inc.)

O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.

O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {0C8413C1-FAD1-446C-8584-BE50576F863E} - No CLSID value found.

O3 - HKCU\..\Toolbar\WebBrowser: (AVG Security Toolbar) - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - C:\Program Files (x86)\AVG\AVG9\Toolbar\IEToolbar.dll ()

O4:64bit: - HKLM..\Run: [] File not found

O4:64bit: - HKLM..\Run: [00TCrdMain] C:\Program Files\TOSHIBA\FlashCards\TCrdMain.exe (TOSHIBA Corporation)

O4:64bit: - HKLM..\Run: [HSON] C:\Program Files\TOSHIBA\TBS\HSON.exe (TOSHIBA Corporation)

O4:64bit: - HKLM..\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Realtek Semiconductor)

O4:64bit: - HKLM..\Run: [smartFaceVWatcher] C:\Program Files\TOSHIBA\SmartFaceV\SmartFaceVWatcher.exe (TOSHIBA Corporation)

O4:64bit: - HKLM..\Run: [smoothView] C:\Program Files\TOSHIBA\SmoothView\SmoothView.exe (TOSHIBA Corporation)

O4:64bit: - HKLM..\Run: [Teco] C:\Program Files\TOSHIBA\TECO\Teco.exe (TOSHIBA Corporation)

O4:64bit: - HKLM..\Run: [TosNC] C:\Program Files\TOSHIBA\BulletinBoard\TosNcCore.exe (TOSHIBA Corporation)

O4:64bit: - HKLM..\Run: [TosReelTimeMonitor] C:\Program Files\TOSHIBA\ReelTime\TosReelTimeMonitor.exe (TOSHIBA Corporation)

O4:64bit: - HKLM..\Run: [TosSENotify] C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosWaitSrv.exe (TOSHIBA Corporation)

O4:64bit: - HKLM..\Run: [TosWaitSrv] C:\Program Files\TOSHIBA\TPHM\TosWaitSrv.exe (TOSHIBA Corporation)

O4:64bit: - HKLM..\Run: [TPwrMain] C:\Program Files\TOSHIBA\Power Saver\TPwrMain.exe (TOSHIBA Corporation)

O4 - HKLM..\Run: [] File not found

O4 - HKLM..\Run: [AVG9_TRAY] C:\Program Files (x86)\AVG\AVG9\avgtray.exe (AVG Technologies CZ, s.r.o.)

O4 - HKLM..\Run: [Malwarebytes' Anti-Malware] C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)

O4 - HKLM..\Run: [ToshibaServiceStation] C:\Program Files (x86)\TOSHIBA\TOSHIBA Service Station\ToshibaServiceStation.exe (TOSHIBA Corporation)

O4 - HKCU..\Run: [sUPERAntiSpyware] C:\Program Files (x86)\SUPERAntiSpyware\SUPERANTISPYWARE.EXE (SUPERAntiSpyware.com)

O4 - HKCU..\Run: [Vidalia] C:\Program Files (x86)\Vidalia Bundle\Vidalia\vidalia.exe ()

O4 - Startup: C:\Users\MOjet1\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Ovulation Calendar.lnk = C:\Program Files (x86)\Ovulation Calendar\OvuCal.exe (QSX Software Group)

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoControlPanel = 0

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3

O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present

O9 - Extra Button: Blog This - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll (Microsoft Corporation)

O9 - Extra 'Tools' menuitem : &Blog This in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll (Microsoft Corporation)

O9 - Extra Button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files (x86)\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)

O9 - Extra 'Tools' menuitem : S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files (x86)\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)

O13 - gopher Prefix: missing

O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab (Java Plug-in 1.6.0_21)

O16 - DPF: {C345E174-3E87-4F41-A01C-B066A90A49B4} http://trial.trymicrosoftoffice.com/trialo...osoft/wrc32.ocx (WRC Class)

O16 - DPF: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab (Java Plug-in 1.6.0_21)

O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab (Java Plug-in 1.6.0_21)

O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload2.macromedia.com/get/shoc...ash/swflash.cab (Shockwave Flash Object)

O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1

O18:64bit: - Protocol\Handler\avgsecuritytoolbar {F2DDE6B2-9684-4A55-86D4-E255E237B77C} - Reg Error: Key error. File not found

O18:64bit: - Protocol\Handler\linkscanner {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files (x86)\AVG\AVG9\avgppa.dll (AVG Technologies CZ, s.r.o.)

O18:64bit: - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - Reg Error: Key error. File not found

O18:64bit: - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - Reg Error: Key error. File not found

O18:64bit: - Protocol\Handler\ms-itss {0A9007C0-4076-11D3-8789-0000F8105754} - Reg Error: Key error. File not found

O18:64bit: - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - Reg Error: Key error. File not found

O18:64bit: - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - Reg Error: Key error. File not found

O18:64bit: - Protocol\Handler\wlmailhtml {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - Reg Error: Key error. File not found

O18 - Protocol\Handler\avgsecuritytoolbar {F2DDE6B2-9684-4A55-86D4-E255E237B77C} - C:\Program Files (x86)\AVG\AVG9\Toolbar\IEToolbar.dll ()

O18 - Protocol\Handler\linkscanner {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files (x86)\AVG\AVG9\avgpp.dll (AVG Technologies CZ, s.r.o.)

O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)

O20:64bit: - AppInit_DLLs: (avgrssta.dll) - C:\windows\SysNative\avgrssta.dll (AVG Technologies CZ, s.r.o.)

O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\windows\explorer.exe (Microsoft Corporation)

O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\windows\SysNative\SystemPropertiesPerformance.exe (Microsoft Corporation)

O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) - File not found

O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\windows\SysWow64\explorer.exe (Microsoft Corporation)

O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\windows\SysWow64\SystemPropertiesPerformance.exe (Microsoft Corporation)

O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found

O20 - Winlogon\Notify\!SASWinLogon: DllName - C:\Program Files (x86)\SUPERAntiSpyware\SASWINLO.DLL - C:\Program Files (x86)\SUPERAntiSpyware\SASWINLO.DLL (SUPERAntiSpyware.com)

O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found.

O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found.

O28 - HKLM ShellExecuteHooks: {5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} - C:\Program Files (x86)\SUPERAntiSpyware\SASSEH.DLL (SuperAdBlocker.com)

O32 - HKLM CDRom: AutoRun - 1

O32 - AutoRun File - [2010/05/14 21:13:32 | 000,000,000 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]

O32 - AutoRun File - [2010/08/07 23:57:52 | 000,000,000 | RH-- | M] () - D:\autorun.wbcat -- [ UDF ]

O32 - AutoRun File - [2010/08/07 23:57:52 | 000,000,129 | ---- | M] () - D:\autorun.inf -- [ UDF ]

O34 - HKLM BootExecute: (autocheck autochk *) - File not found

O35:64bit: - HKLM\..comfile [open] -- "%1" %*

O35:64bit: - HKLM\..exefile [open] -- "%1" %*

O35 - HKLM\..comfile [open] -- "%1" %*

O35 - HKLM\..exefile [open] -- "%1" %*

O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*

O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*

O37 - HKLM\...com [@ = comfile] -- "%1" %*

O37 - HKLM\...exe [@ = exefile] -- "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2010/08/07 12:38:12 | 000,000,000 | ---D | C] -- C:\VundoFix Backups

[2010/08/07 06:40:36 | 000,000,000 | ---D | C] -- C:\Users\MOjet1\AppData\Roaming\BBCiPlayerDesktop.61DB7A798358575D6A969CCD73DDBBD723A6DA9D.1

[2010/08/07 06:40:19 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\BBC iPlayer Desktop

[2010/08/07 06:40:07 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Adobe AIR

[2010/08/07 05:51:32 | 000,000,000 | ---D | C] -- C:\Users\MOjet1\AppData\Roaming\StreamTorrent

[2010/08/07 05:51:28 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\StreamTorrent 1.0

[2010/08/07 02:44:22 | 000,000,000 | ---D | C] -- C:\ProgramData\Yahoo! Companion

[2010/08/07 02:36:24 | 000,000,000 | ---D | C] -- C:\Users\MOjet1\Desktop\logs

[2010/08/04 12:34:10 | 000,000,000 | -H-D | C] -- C:\$AVG

[2010/08/01 02:14:10 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Ovulation Calendar

[2010/07/31 17:20:04 | 000,000,000 | ---D | C] -- C:\windows\Sun

[2010/07/31 16:19:34 | 000,000,000 | ---D | C] -- C:\ProgramData\NOS

[2010/07/29 03:58:00 | 000,289,144 | ---- | C] (S!Ri) -- C:\windows\SysWow64\VCCLSID.exe

[2010/07/29 03:58:00 | 000,288,417 | ---- | C] (S!Ri) -- C:\windows\SysWow64\SrchSTS.exe

[2010/07/29 03:58:00 | 000,135,168 | ---- | C] (SteelWerX) -- C:\windows\SysWow64\swreg.exe

[2010/07/29 03:58:00 | 000,087,552 | ---- | C] (S!Ri.URZ) -- C:\windows\SysWow64\VACFix.exe

[2010/07/29 03:58:00 | 000,082,944 | ---- | C] (S!Ri.URZ) -- C:\windows\SysWow64\IEDFix.exe

[2010/07/29 03:58:00 | 000,082,944 | ---- | C] (S!Ri.URZ) -- C:\windows\SysWow64\IEDFix.C.exe

[2010/07/29 03:58:00 | 000,082,432 | ---- | C] (S!Ri.URZ) -- C:\windows\SysWow64\404Fix.exe

[2010/07/29 03:58:00 | 000,080,384 | ---- | C] (S!Ri.URZ) -- C:\windows\SysWow64\o4Patch.exe

[2010/07/29 03:58:00 | 000,079,360 | ---- | C] (SteelWerX) -- C:\windows\SysWow64\swxcacls.exe

[2010/07/29 03:58:00 | 000,078,336 | ---- | C] (S!Ri.URZ) -- C:\windows\SysWow64\Agent.OMZ.Fix.exe

[2010/07/26 15:19:28 | 000,000,000 | ---D | C] -- C:\Users\MOjet1\Documents\job stuff

[2010/07/26 02:45:02 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Marvell

[2010/07/25 23:34:09 | 000,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\windows\SysWow64\drivers\mbamswissarmy.sys

[2010/07/23 05:11:46 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\SUPERAntiSpyware

[2010/07/23 05:11:45 | 000,000,000 | ---D | C] -- C:\Users\MOjet1\AppData\Roaming\SUPERAntiSpyware.com

[2010/07/23 01:14:58 | 000,000,000 | ---D | C] -- C:\Users\MOjet1\Desktop\Downloads

[2010/07/23 01:14:53 | 000,000,000 | ---D | C] -- C:\Users\MOjet1\AppData\Roaming\GetRightToGo

[2010/07/23 00:52:02 | 000,000,000 | ---D | C] -- C:\ProgramData\TEMP

[2010/07/23 00:38:47 | 001,071,088 | ---- | C] (Microsoft Corporation) -- C:\windows\SysWow64\MSCOMCTL.OCX

[2010/07/23 00:38:45 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\SpywareBlaster

[2010/07/23 00:29:31 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\SpywareGuard

[2010/07/23 00:21:33 | 001,137,360 | ---- | C] (F-Secure Corporation) -- C:\Users\MOjet1\Desktop\fsbl.exe

[2010/07/22 23:34:57 | 000,000,000 | ---D | C] -- C:\Users\MOjet1\AppData\Local\ElevatedDiagnostics

[2010/07/21 20:50:51 | 000,000,000 | -HSD | C] -- C:\windows\SysWow64\%APPDATA%

[2010/07/21 00:14:09 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware

[2010/07/20 22:08:17 | 000,000,000 | ---D | C] -- C:\Users\MOjet1\AppData\Local\AVG Security Toolbar

[2010/07/20 22:07:55 | 000,000,000 | ---D | C] -- C:\bfu

[2010/07/20 21:50:51 | 000,013,048 | ---- | C] (AVG Technologies CZ, s.r.o.) -- C:\windows\SysNative\avgrssta.dll

[2010/07/20 21:50:48 | 000,317,520 | ---- | C] (AVG Technologies CZ, s.r.o.) -- C:\windows\SysNative\drivers\avgtdia.sys

[2010/07/20 21:50:40 | 000,269,904 | ---- | C] (AVG Technologies CZ, s.r.o.) -- C:\windows\SysNative\drivers\avgldx64.sys

[2010/07/20 21:50:35 | 000,035,536 | ---- | C] (AVG Technologies CZ, s.r.o.) -- C:\windows\SysNative\drivers\avgmfx64.sys

[2010/07/20 21:50:35 | 000,000,000 | ---D | C] -- C:\windows\SysNative\drivers\Avg

[2010/07/20 21:50:30 | 000,000,000 | ---D | C] -- C:\ProgramData\AVG Security Toolbar

[2010/07/20 21:46:54 | 000,000,000 | ---D | C] -- C:\ProgramData\avg9

[2010/07/20 21:45:08 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\AVG

[2010/07/20 21:36:55 | 000,000,000 | ---D | C] -- C:\Users\MOjet1\AppData\Roaming\Grisoft

[2010/07/20 21:36:40 | 000,000,000 | ---D | C] -- C:\ProgramData\Grisoft

[2010/07/20 00:58:11 | 000,000,000 | ---D | C] -- C:\Users\MOjet1\AppData\Local\Adobe

[2010/07/18 18:00:37 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Java

[2010/07/18 18:00:16 | 000,423,656 | ---- | C] (Oracle) -- C:\windows\SysWow64\deployJava1.dll

[2010/07/18 18:00:16 | 000,153,376 | ---- | C] (Oracle) -- C:\windows\SysWow64\javaws.exe

[2010/07/18 18:00:16 | 000,145,184 | ---- | C] (Oracle) -- C:\windows\SysWow64\javaw.exe

[2010/07/18 18:00:16 | 000,145,184 | ---- | C] (Oracle) -- C:\windows\SysWow64\java.exe

[2010/07/18 17:59:40 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Java

[2010/07/18 17:56:57 | 000,000,000 | ---D | C] -- C:\ProgramData\Uniblue

[2010/07/18 17:56:35 | 000,000,000 | ---D | C] -- C:\Users\MOjet1\AppData\Roaming\Uniblue

[2010/07/18 07:53:45 | 000,000,000 | ---D | C] -- C:\Users\MOjet1\AppData\Roaming\Malwarebytes

[2010/07/18 07:53:20 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes

[2010/07/18 07:53:18 | 000,024,664 | ---- | C] (Malwarebytes Corporation) -- C:\windows\SysNative\drivers\mbam.sys

[2010/07/18 04:21:02 | 000,000,000 | ---D | C] -- C:\ProgramData\SUPERAntiSpyware.com

[2010/07/18 04:20:51 | 000,000,000 | ---D | C] -- C:\ProgramData\!SASCORE

[2010/07/18 02:48:45 | 000,000,000 | ---D | C] -- C:\Users\MOjet1\DoctorWeb

[2010/07/18 01:41:01 | 000,000,000 | ---D | C] -- C:\Users\MOjet1\Desktop\wedding

[2010/07/18 01:39:51 | 000,000,000 | ---D | C] -- C:\Users\MOjet1\Desktop\pics

[2010/07/18 01:37:31 | 000,000,000 | ---D | C] -- C:\Users\MOjet1\Desktop\wils all

[2010/07/17 16:34:04 | 000,000,000 | ---D | C] -- C:\Users\MOjet1\Desktop\bookmarks

[2010/07/17 15:58:25 | 000,000,000 | ---D | C] -- C:\windows\pss

[2010/07/17 12:24:27 | 000,000,000 | ---D | C] -- C:\ProgramData\Spybot - Search & Destroy

[2010/07/17 12:24:27 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Spybot - Search & Destroy

[2010/07/17 11:53:03 | 000,000,000 | ---D | C] -- C:\ProgramData\FrontLine Registry Cleaner

[2010/07/17 11:52:54 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Frontline Registry Cleaner

[2010/07/17 11:50:29 | 000,000,000 | ---D | C] -- C:\32788R22FWJFW

[2010/07/15 13:10:24 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\CCleaner

[2010/07/14 15:25:31 | 000,144,384 | ---- | C] (Microsoft Corporation) -- C:\windows\SysNative\cdd.dll

========== Files - Modified Within 30 Days ==========

[2010/08/08 13:19:06 | 006,553,600 | -HS- | M] () -- C:\Users\MOjet1\ntuser.dat

[2010/08/08 13:19:04 | 000,000,898 | ---- | M] () -- C:\windows\tasks\GoogleUpdateTaskMachineUA.job

[2010/08/08 13:14:00 | 000,000,912 | ---- | M] () -- C:\windows\tasks\GoogleUpdateTaskUserS-1-5-21-2027184126-505508850-3967297620-1000UA.job

[2010/08/08 13:10:56 | 000,000,435 | ---- | M] () -- C:\windows\SysNative\drivers\etc\hosts.ics

[2010/08/08 13:10:41 | 000,067,584 | --S- | M] () -- C:\windows\bootstat.dat

[2010/08/08 09:40:21 | 063,051,185 | ---- | M] () -- C:\windows\SysNative\drivers\Avg\incavi.avm

[2010/08/08 04:14:03 | 000,000,860 | ---- | M] () -- C:\windows\tasks\GoogleUpdateTaskUserS-1-5-21-2027184126-505508850-3967297620-1000Core.job

[2010/08/08 03:00:02 | 000,000,462 | ---- | M] () -- C:\windows\tasks\FrontLine Registry Cleaner Scheduled Scan - MOjet1.job

[2010/08/08 01:19:01 | 000,000,894 | ---- | M] () -- C:\windows\tasks\GoogleUpdateTaskMachineCore.job

[2010/08/07 14:07:32 | 000,015,792 | -H-- | M] () -- C:\windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

[2010/08/07 14:07:32 | 000,015,792 | -H-- | M] () -- C:\windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

[2010/08/07 14:00:03 | 000,001,028 | ---- | M] () -- C:\Users\MOjet1\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Ovulation Calendar.lnk

[2010/08/07 13:59:34 | 000,524,288 | -HS- | M] () -- C:\Users\MOjet1\ntuser.dat{75053067-a24d-11df-b556-00266c4bf1e6}.TMContainer00000000000000000002.regtrans-ms

[2010/08/07 13:59:34 | 000,524,288 | -HS- | M] () -- C:\Users\MOjet1\ntuser.dat{75053067-a24d-11df-b556-00266c4bf1e6}.TMContainer00000000000000000001.regtrans-ms

[2010/08/07 13:59:34 | 000,065,536 | -HS- | M] () -- C:\Users\MOjet1\ntuser.dat{75053067-a24d-11df-b556-00266c4bf1e6}.TM.blf

[2010/08/07 13:59:29 | 000,000,006 | -H-- | M] () -- C:\windows\tasks\SA.DAT

[2010/08/07 13:59:11 | 3016,884,224 | -HS- | M] () -- C:\hiberfil.sys

[2010/08/07 13:47:55 | 002,770,586 | -H-- | M] () -- C:\Users\MOjet1\AppData\Local\IconCache.db

[2010/08/07 11:58:10 | 000,000,000 | ---- | M] () -- C:\Users\MOjet1\defogger_reenable

[2010/08/07 05:51:31 | 000,001,128 | ---- | M] () -- C:\Users\MOjet1\Desktop\StreamTorrent 1.0.lnk

[2010/08/07 04:10:17 | 000,002,330 | ---- | M] () -- C:\Users\MOjet1\Desktop\Google Chrome.lnk

[2010/08/07 03:52:05 | 000,730,320 | ---- | M] () -- C:\windows\SysNative\PerfStringBackup.INI

[2010/08/07 03:52:05 | 000,627,082 | ---- | M] () -- C:\windows\SysNative\perfh009.dat

[2010/08/07 03:52:05 | 000,107,366 | ---- | M] () -- C:\windows\SysNative\perfc009.dat

[2010/08/07 03:05:03 | 000,132,306 | ---- | M] () -- C:\Users\MOjet1\Documents\cc_20100807_030455.reg

[2010/08/07 02:43:44 | 000,001,018 | ---- | M] () -- C:\Users\MOjet1\Desktop\CCleaner.lnk

[2010/08/04 02:30:31 | 000,034,560 | ---- | M] () -- C:\windows\SysWow64\drivers\Normandy.sys

[2010/08/03 11:35:01 | 000,078,336 | ---- | M] () -- C:\Users\MOjet1\Desktop\ableton comments to set up patch.doc

[2010/08/01 21:08:20 | 019,461,015 | ---- | M] () -- C:\Users\MOjet1\Documents\vlc-1.1.2-win32.exe

[2010/08/01 02:14:13 | 000,000,992 | ---- | M] () -- C:\Users\MOjet1\Desktop\Ovulation Calendar.lnk

[2010/07/29 09:38:10 | 000,002,104 | ---- | M] () -- C:\windows\SysWow64\tmp.reg

[2010/07/29 09:38:10 | 000,000,691 | ---- | M] () -- C:\Users\MOjet1\AppData\Roaming\GetValue.vbs

[2010/07/29 09:38:10 | 000,000,035 | ---- | M] () -- C:\Users\MOjet1\AppData\Roaming\SetValue.bat

[2010/07/27 04:53:59 | 000,239,601 | ---- | M] () -- C:\Users\MOjet1\Desktop\property claim forms.pdf

[2010/07/26 03:21:28 | 000,000,940 | ---- | M] () -- C:\windows\SysNative\temp0201

[2010/07/26 03:21:28 | 000,000,004 | ---- | M] () -- C:\windows\SysNative\WowErr.dat

[2010/07/26 03:21:28 | 000,000,000 | ---- | M] () -- C:\windows\SysNative\katch00

[2010/07/26 03:21:16 | 000,000,000 | ---- | M] () -- C:\windows\SysNative\Zlob01

[2010/07/26 03:21:16 | 000,000,000 | ---- | M] () -- C:\windows\SysNative\WareOut01

[2010/07/26 03:21:16 | 000,000,000 | ---- | M] () -- C:\windows\SysNative\WareOut00

[2010/07/26 03:21:16 | 000,000,000 | ---- | M] () -- C:\windows\SysNative\temp06

[2010/07/26 03:21:16 | 000,000,000 | ---- | M] () -- C:\windows\SysNative\temp04

[2010/07/26 03:21:16 | 000,000,000 | ---- | M] () -- C:\windows\SysNative\temp03

[2010/07/26 03:21:16 | 000,000,000 | ---- | M] () -- C:\windows\SysNative\temp02

[2010/07/26 03:21:16 | 000,000,000 | ---- | M] () -- C:\windows\SysNative\svctdss

[2010/07/26 03:21:16 | 000,000,000 | ---- | M] () -- C:\windows\SysNative\katchNT-OS

[2010/07/26 03:21:14 | 000,000,006 | ---- | M] () -- C:\windows\SysNative\BootDrivers

[2010/07/26 03:21:14 | 000,000,000 | ---- | M] () -- C:\windows\SysNative\Unhandled.dat

[2010/07/26 03:21:14 | 000,000,000 | ---- | M] () -- C:\windows\SysNative\temp0103

[2010/07/26 03:21:14 | 000,000,000 | ---- | M] () -- C:\windows\SysNative\temp0101

[2010/07/26 03:21:14 | 000,000,000 | ---- | M] () -- C:\windows\SysNative\temp0100

[2010/07/26 03:21:14 | 000,000,000 | ---- | M] () -- C:\windows\SysNative\temp000B

[2010/07/26 03:21:14 | 000,000,000 | ---- | M] () -- C:\windows\SysNative\temp000A

[2010/07/26 03:21:14 | 000,000,000 | ---- | M] () -- C:\windows\SysNative\temp0004.bat

[2010/07/26 03:21:14 | 000,000,000 | ---- | M] () -- C:\windows\SysNative\temp0003

[2010/07/26 03:21:14 | 000,000,000 | ---- | M] () -- C:\windows\SysNative\temp0002

[2010/07/26 03:21:14 | 000,000,000 | ---- | M] () -- C:\windows\SysNative\temp0001

[2010/07/26 03:21:14 | 000,000,000 | ---- | M] () -- C:\windows\SysNative\temp0000

[2010/07/26 03:21:14 | 000,000,000 | ---- | M] () -- C:\windows\SysNative\System.dump02

[2010/07/26 03:21:14 | 000,000,000 | ---- | M] () -- C:\windows\SysNative\System.dump01

[2010/07/26 03:21:14 | 000,000,000 | ---- | M] () -- C:\windows\SysNative\System.dump00

[2010/07/26 03:21:14 | 000,000,000 | ---- | M] () -- C:\windows\SysNative\SvcFull

[2010/07/26 03:21:14 | 000,000,000 | ---- | M] () -- C:\windows\SysNative\SvcDumpFull02

[2010/07/26 03:21:14 | 000,000,000 | ---- | M] () -- C:\windows\SysNative\SvcDumpFull01

[2010/07/26 03:21:14 | 000,000,000 | ---- | M] () -- C:\windows\SysNative\SvcDumpFull00

[2010/07/26 03:21:14 | 000,000,000 | ---- | M] () -- C:\windows\SysNative\SvcDumpFull

[2010/07/26 03:21:14 | 000,000,000 | ---- | M] () -- C:\windows\SysNative\SvcDumpB

[2010/07/26 03:21:14 | 000,000,000 | ---- | M] () -- C:\windows\SysNative\SvcDump00

[2010/07/26 03:21:14 | 000,000,000 | ---- | M] () -- C:\windows\SysNative\SvcDump

[2010/07/26 03:21:14 | 000,000,000 | ---- | M] () -- C:\windows\SysNative\SvcDiff

[2010/07/26 03:21:14 | 000,000,000 | ---- | M] () -- C:\windows\SysNative\SvcCovered

[2010/07/26 03:21:14 | 000,000,000 | ---- | M] () -- C:\windows\SysNative\suspectSvc.dat

[2010/07/26 03:21:14 | 000,000,000 | ---- | M] () -- C:\windows\SysNative\ServiceFiles00

[2010/07/26 03:21:14 | 000,000,000 | ---- | M] () -- C:\windows\SysNative\ServiceFiles.dat

[2010/07/26 03:21:14 | 000,000,000 | ---- | M] () -- C:\windows\SysNative\RustB00

[2010/07/26 03:21:14 | 000,000,000 | ---- | M] () -- C:\windows\SysNative\LockedServiceFiles00

[2010/07/26 03:21:14 | 000,000,000 | ---- | M] () -- C:\windows\SysNative\LegacyNoSvc

[2010/07/26 03:21:14 | 000,000,000 | ---- | M] () -- C:\windows\SysNative\LegacyFull

[2010/07/26 03:21:14 | 000,000,000 | ---- | M] () -- C:\windows\SysNative\HandleList

[2010/07/26 03:21:14 | 000,000,000 | ---- | M] () -- C:\windows\SysNative\Handle00

[2010/07/26 03:21:14 | 000,000,000 | ---- | M] () -- C:\windows\SysNative\del03.bat

[2010/07/26 03:21:14 | 000,000,000 | ---- | M] () -- C:\windows\SysNative\d-del_A.dat

[2010/07/26 03:21:14 | 000,000,000 | ---- | M] () -- C:\windows\SysNative\CCS.bat

[2010/07/26 03:21:14 | 000,000,000 | ---- | M] () -- C:\windows\SysNative\BootSvcs

[2010/07/25 23:34:11 | 000,001,020 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk

[2010/07/23 05:20:17 | 000,002,020 | ---- | M] () -- C:\Users\Public\Desktop\SUPERAntiSpyware Professional.lnk

[2010/07/23 03:51:47 | 000,021,770 | ---- | M] () -- C:\Users\MOjet1\Documents\cc_20100723_035127.reg

[2010/07/23 00:21:34 | 001,137,360 | ---- | M] (F-Secure Corporation) -- C:\Users\MOjet1\Desktop\fsbl.exe

[2010/07/21 00:13:42 | 000,001,131 | ---- | M] () -- C:\Users\MOjet1\Desktop\mbam-setup-1.46 - Shortcut.lnk

[2010/07/20 23:39:08 | 000,000,036 | ---- | M] () -- C:\Users\MOjet1\AppData\Local\housecall.guid.cache

[2010/07/20 21:50:56 | 000,001,865 | ---- | M] () -- C:\Users\Public\Desktop\AVG Free 9.0.lnk

[2010/07/20 21:50:53 | 000,013,048 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\windows\SysNative\avgrssta.dll

[2010/07/20 21:50:49 | 000,317,520 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\windows\SysNative\drivers\avgtdia.sys

[2010/07/20 21:50:40 | 000,269,904 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\windows\SysNative\drivers\avgldx64.sys

[2010/07/20 21:50:36 | 000,035,536 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\windows\SysNative\drivers\avgmfx64.sys

[2010/07/20 21:50:35 | 000,113,461 | ---- | M] () -- C:\windows\SysNative\drivers\Avg\iavichjw.avm

[2010/07/20 01:29:44 | 000,046,661 | ---- | M] () -- C:\Users\MOjet1\Documents\application cms.pdf

[2010/07/18 18:38:23 | 000,001,407 | ---- | M] () -- C:\Users\MOjet1\Desktop\wuaclt.exe.lnk

[2010/07/18 18:38:11 | 000,001,506 | ---- | M] () -- C:\Users\MOjet1\Desktop\ATF-Cleaner - Shortcut.lnk

[2010/07/18 17:59:43 | 000,153,376 | ---- | M] (Oracle) -- C:\windows\SysWow64\javaws.exe

[2010/07/18 17:59:43 | 000,145,184 | ---- | M] (Oracle) -- C:\windows\SysWow64\javaw.exe

[2010/07/18 17:59:43 | 000,145,184 | ---- | M] (Oracle) -- C:\windows\SysWow64\java.exe

[2010/07/18 17:59:42 | 000,423,656 | ---- | M] (Oracle) -- C:\windows\SysWow64\deployJava1.dll

[2010/07/17 15:59:52 | 000,009,020 | ---- | M] () -- C:\Users\MOjet1\Documents\cc_20100717_155942.reg

[2010/07/17 15:50:52 | 000,412,182 | R--- | M] () -- C:\windows\SysNative\drivers\etc\hosts

[2010/07/17 15:46:40 | 000,412,182 | R--- | M] () -- C:\windows\SysNative\drivers\etc\hosts.20100717-155052.backup

[2010/07/15 13:30:20 | 000,041,048 | ---- | M] () -- C:\Users\MOjet1\Documents\cc_20100715_133007.reg

========== Files Created - No Company Name ==========

[2010/08/07 13:59:34 | 000,524,288 | -HS- | C] () -- C:\Users\MOjet1\ntuser.dat{75053067-a24d-11df-b556-00266c4bf1e6}.TMContainer00000000000000000002.regtrans-ms

[2010/08/07 13:59:34 | 000,524,288 | -HS- | C] () -- C:\Users\MOjet1\ntuser.dat{75053067-a24d-11df-b556-00266c4bf1e6}.TMContainer00000000000000000001.regtrans-ms

[2010/08/07 13:59:34 | 000,065,536 | -HS- | C] () -- C:\Users\MOjet1\ntuser.dat{75053067-a24d-11df-b556-00266c4bf1e6}.TM.blf

[2010/08/07 11:58:10 | 000,000,000 | ---- | C] () -- C:\Users\MOjet1\defogger_reenable

[2010/08/07 05:51:31 | 000,001,128 | ---- | C] () -- C:\Users\MOjet1\Desktop\StreamTorrent 1.0.lnk

[2010/08/07 04:10:17 | 000,002,330 | ---- | C] () -- C:\Users\MOjet1\Desktop\Google Chrome.lnk

[2010/08/07 04:09:30 | 000,000,912 | ---- | C] () -- C:\windows\tasks\GoogleUpdateTaskUserS-1-5-21-2027184126-505508850-3967297620-1000UA.job

[2010/08/07 04:09:28 | 000,000,860 | ---- | C] () -- C:\windows\tasks\GoogleUpdateTaskUserS-1-5-21-2027184126-505508850-3967297620-1000Core.job

[2010/08/07 03:04:59 | 000,132,306 | ---- | C] () -- C:\Users\MOjet1\Documents\cc_20100807_030455.reg

[2010/08/04 02:21:09 | 000,034,560 | ---- | C] () -- C:\windows\SysWow64\drivers\Normandy.sys

[2010/08/03 11:35:01 | 000,078,336 | ---- | C] () -- C:\Users\MOjet1\Desktop\ableton comments to set up patch.doc

[2010/08/01 21:07:40 | 019,461,015 | ---- | C] () -- C:\Users\MOjet1\Documents\vlc-1.1.2-win32.exe

[2010/08/01 02:14:37 | 000,001,028 | ---- | C] () -- C:\Users\MOjet1\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Ovulation Calendar.lnk

[2010/08/01 02:14:13 | 000,000,992 | ---- | C] () -- C:\Users\MOjet1\Desktop\Ovulation Calendar.lnk

[2010/07/29 03:58:46 | 000,002,104 | ---- | C] () -- C:\windows\SysWow64\tmp.reg

[2010/07/29 03:58:46 | 000,000,691 | ---- | C] () -- C:\Users\MOjet1\AppData\Roaming\GetValue.vbs

[2010/07/29 03:58:46 | 000,000,035 | ---- | C] () -- C:\Users\MOjet1\AppData\Roaming\SetValue.bat

[2010/07/29 03:58:00 | 000,075,776 | ---- | C] () -- C:\windows\SysWow64\WS2Fix.exe

[2010/07/29 03:58:00 | 000,051,200 | ---- | C] () -- C:\windows\SysWow64\dumphive.exe

[2010/07/29 03:58:00 | 000,040,960 | ---- | C] () -- C:\windows\SysWow64\swsc.exe

[2010/07/27 04:53:59 | 000,239,601 | ---- | C] () -- C:\Users\MOjet1\Desktop\property claim forms.pdf

[2010/07/26 03:21:28 | 000,000,940 | ---- | C] () -- C:\windows\SysNative\temp0201

[2010/07/26 03:21:28 | 000,000,000 | ---- | C] () -- C:\windows\SysNative\katch00

[2010/07/26 03:21:16 | 000,000,000 | ---- | C] () -- C:\windows\SysNative\Zlob01

[2010/07/26 03:21:16 | 000,000,000 | ---- | C] () -- C:\windows\SysNative\WareOut01

[2010/07/26 03:21:16 | 000,000,000 | ---- | C] () -- C:\windows\SysNative\WareOut00

[2010/07/26 03:21:16 | 000,000,000 | ---- | C] () -- C:\windows\SysNative\temp06

[2010/07/26 03:21:16 | 000,000,000 | ---- | C] () -- C:\windows\SysNative\temp04

[2010/07/26 03:21:16 | 000,000,000 | ---- | C] () -- C:\windows\SysNative\temp03

[2010/07/26 03:21:16 | 000,000,000 | ---- | C] () -- C:\windows\SysNative\temp02

[2010/07/26 03:21:16 | 000,000,000 | ---- | C] () -- C:\windows\SysNative\svctdss

[2010/07/26 03:21:16 | 000,000,000 | ---- | C] () -- C:\windows\SysNative\katchNT-OS

[2010/07/26 03:21:14 | 000,000,006 | ---- | C] () -- C:\windows\SysNative\BootDrivers

[2010/07/26 03:21:14 | 000,000,000 | ---- | C] () -- C:\windows\SysNative\Unhandled.dat

[2010/07/26 03:21:14 | 000,000,000 | ---- | C] () -- C:\windows\SysNative\temp0103

[2010/07/26 03:21:14 | 000,000,000 | ---- | C] () -- C:\windows\SysNative\temp0101

[2010/07/26 03:21:14 | 000,000,000 | ---- | C] () -- C:\windows\SysNative\temp0100

[2010/07/26 03:21:14 | 000,000,000 | ---- | C] () -- C:\windows\SysNative\temp000B

[2010/07/26 03:21:14 | 000,000,000 | ---- | C] () -- C:\windows\SysNative\temp000A

[2010/07/26 03:21:14 | 000,000,000 | ---- | C] () -- C:\windows\SysNative\temp0004.bat

[2010/07/26 03:21:14 | 000,000,000 | ---- | C] () -- C:\windows\SysNative\temp0003

[2010/07/26 03:21:14 | 000,000,000 | ---- | C] () -- C:\windows\SysNative\temp0002

[2010/07/26 03:21:14 | 000,000,000 | ---- | C] () -- C:\windows\SysNative\temp0001

[2010/07/26 03:21:14 | 000,000,000 | ---- | C] () -- C:\windows\SysNative\temp0000

[2010/07/26 03:21:14 | 000,000,000 | ---- | C] () -- C:\windows\SysNative\System.dump02

[2010/07/26 03:21:14 | 000,000,000 | ---- | C] () -- C:\windows\SysNative\System.dump01

[2010/07/26 03:21:14 | 000,000,000 | ---- | C] () -- C:\windows\SysNative\System.dump00

[2010/07/26 03:21:14 | 000,000,000 | ---- | C] () -- C:\windows\SysNative\SvcFull

[2010/07/26 03:21:14 | 000,000,000 | ---- | C] () -- C:\windows\SysNative\SvcDumpFull02

[2010/07/26 03:21:14 | 000,000,000 | ---- | C] () -- C:\windows\SysNative\SvcDumpFull01

[2010/07/26 03:21:14 | 000,000,000 | ---- | C] () -- C:\windows\SysNative\SvcDumpFull00

[2010/07/26 03:21:14 | 000,000,000 | ---- | C] () -- C:\windows\SysNative\SvcDumpFull

[2010/07/26 03:21:14 | 000,000,000 | ---- | C] () -- C:\windows\SysNative\SvcDumpB

[2010/07/26 03:21:14 | 000,000,000 | ---- | C] () -- C:\windows\SysNative\SvcDump00

[2010/07/26 03:21:14 | 000,000,000 | ---- | C] () -- C:\windows\SysNative\SvcDump

[2010/07/26 03:21:14 | 000,000,000 | ---- | C] () -- C:\windows\SysNative\SvcDiff

[2010/07/26 03:21:14 | 000,000,000 | ---- | C] () -- C:\windows\SysNative\SvcCovered

[2010/07/26 03:21:14 | 000,000,000 | ---- | C] () -- C:\windows\SysNative\suspectSvc.dat

[2010/07/26 03:21:14 | 000,000,000 | ---- | C] () -- C:\windows\SysNative\ServiceFiles00

[2010/07/26 03:21:14 | 000,000,000 | ---- | C] () -- C:\windows\SysNative\ServiceFiles.dat

[2010/07/26 03:21:14 | 000,000,000 | ---- | C] () -- C:\windows\SysNative\RustB00

[2010/07/26 03:21:14 | 000,000,000 | ---- | C] () -- C:\windows\SysNative\LockedServiceFiles00

[2010/07/26 03:21:14 | 000,000,000 | ---- | C] () -- C:\windows\SysNative\LegacyNoSvc

[2010/07/26 03:21:14 | 000,000,000 | ---- | C] () -- C:\windows\SysNative\LegacyFull

[2010/07/26 03:21:14 | 000,000,000 | ---- | C] () -- C:\windows\SysNative\HandleList

[2010/07/26 03:21:14 | 000,000,000 | ---- | C] () -- C:\windows\SysNative\Handle00

[2010/07/26 03:21:14 | 000,000,000 | ---- | C] () -- C:\windows\SysNative\del03.bat

[2010/07/26 03:21:14 | 000,000,000 | ---- | C] () -- C:\windows\SysNative\d-del_A.dat

[2010/07/26 03:21:14 | 000,000,000 | ---- | C] () -- C:\windows\SysNative\CCS.bat

[2010/07/26 03:21:14 | 000,000,000 | ---- | C] () -- C:\windows\SysNative\BootSvcs

[2010/07/26 03:21:13 | 000,000,004 | ---- | C] () -- C:\windows\SysNative\WowErr.dat

[2010/07/25 23:34:11 | 000,001,020 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk

[2010/07/23 05:11:52 | 000,002,020 | ---- | C] () -- C:\Users\Public\Desktop\SUPERAntiSpyware Professional.lnk

[2010/07/23 03:51:33 | 000,021,770 | ---- | C] () -- C:\Users\MOjet1\Documents\cc_20100723_035127.reg

[2010/07/20 23:39:08 | 000,000,036 | ---- | C] () -- C:\Users\MOjet1\AppData\Local\housecall.guid.cache

[2010/07/20 21:50:55 | 000,001,865 | ---- | C] () -- C:\Users\Public\Desktop\AVG Free 9.0.lnk

[2010/07/20 21:50:35 | 063,051,185 | ---- | C] () -- C:\windows\SysNative\drivers\Avg\incavi.avm

[2010/07/20 21:50:35 | 000,113,461 | ---- | C] () -- C:\windows\SysNative\drivers\Avg\iavichjw.avm

[2010/07/20 01:29:44 | 000,046,661 | ---- | C] () -- C:\Users\MOjet1\Documents\application cms.pdf

[2010/07/18 18:38:23 | 000,001,407 | ---- | C] () -- C:\Users\MOjet1\Desktop\wuaclt.exe.lnk

[2010/07/18 18:38:11 | 000,001,506 | ---- | C] () -- C:\Users\MOjet1\Desktop\ATF-Cleaner - Shortcut.lnk

[2010/07/18 18:36:49 | 000,001,131 | ---- | C] () -- C:\Users\MOjet1\Desktop\mbam-setup-1.46 - Shortcut.lnk

[2010/07/17 15:59:46 | 000,009,020 | ---- | C] () -- C:\Users\MOjet1\Documents\cc_20100717_155942.reg

[2010/07/17 11:53:05 | 000,000,462 | ---- | C] () -- C:\windows\tasks\FrontLine Registry Cleaner Scheduled Scan - MOjet1.job

[2010/07/15 13:30:12 | 000,041,048 | ---- | C] () -- C:\Users\MOjet1\Documents\cc_20100715_133007.reg

[2010/07/15 13:10:30 | 000,001,018 | ---- | C] () -- C:\Users\MOjet1\Desktop\CCleaner.lnk

[2010/04/21 16:59:34 | 000,731,106 | ---- | C] () -- C:\windows\SysWow64\PerfStringBackup.INI

[2010/03/14 23:16:29 | 000,000,000 | ---- | C] () -- C:\windows\NDSTray.INI

[2009/07/13 19:42:10 | 000,064,000 | ---- | C] () -- C:\windows\SysWow64\BWContextHandler.dll

[2009/07/13 17:03:59 | 000,364,544 | ---- | C] () -- C:\windows\SysWow64\msjetoledb40.dll

[1999/03/21 16:45:30 | 000,000,136 | ---- | C] () -- C:\windows\SysWow64\mstraps.dll

[1998/03/21 17:02:45 | 000,000,136 | ---- | C] () -- C:\windows\SysWow64\msrfst.dll

========== Alternate Data Streams ==========

@Alternate Data Stream - 118 bytes -> C:\ProgramData\TEMP:5C321E34

< End of report >

MrsM1 · August 8, 2010

and heres the OTL extras.txt

OTL Extras logfile created on: 8/5/2010 07:13:05 - Run 1

OTL by OldTimer - Version 3.2.9.1 Folder = C:\Users\MOjet1\Downloads

64bit- Home Premium Edition (Version = 6.1.7600) - Type = NTWorkstation

Internet Explorer (Version = 8.0.7600.16385)

Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

4.00 Gb Total Physical Memory | 1.00 Gb Available Physical Memory | 25.00% Memory free

7.00 Gb Paging File | 3.00 Gb Available in Paging File | 43.00% Paging File free

Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\windows | %ProgramFiles% = C:\Program Files (x86)

Drive C: | 287.61 Gb Total Space | 184.01 Gb Free Space | 63.98% Space Free | Partition Type: NTFS

D: Drive not present or media not loaded

E: Drive not present or media not loaded

F: Drive not present or media not loaded

G: Drive not present or media not loaded

H: Drive not present or media not loaded

I: Drive not present or media not loaded

Computer Name: MOJET1-PC

Current User Name: MOjet1

Logged in as Administrator.

Current Boot Mode: Normal

Scan Mode: Current user

Include 64bit Scans

Company Name Whitelist: Off

Skip Microsoft Files: Off

File Age = 30 Days

Output = Standard

========== Extra Registry (SafeList) ==========

========== File Associations ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]

.html[@ = FirefoxHTML] -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation)

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]

.cpl [@ = cplfile] -- C:\windows\SysWow64\control.exe (Microsoft Corporation)

.html [@ = FirefoxHTML] -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation)

[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]

.html [@ = ChromeHTML] -- Reg Error: Key error. File not found

========== Shell Spawning ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]

batfile [open] -- "%1" %* File not found

cmdfile [open] -- "%1" %* File not found

comfile [open] -- "%1" %* File not found

exefile [open] -- "%1" %* File not found

helpfile [open] -- Reg Error: Key error.

htmlfile [edit] -- "C:\Program Files (x86)\Microsoft Office\Office12\msohtmed.exe" %1 (Microsoft Corporation)

htmlfile [print] -- "C:\Program Files (x86)\Microsoft Office\Office12\msohtmed.exe" /p %1 (Microsoft Corporation)

http [open] -- Reg Error: Key error.

https [open] -- Reg Error: Key error.

inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)

InternetShortcut [print] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)

piffile [open] -- "%1" %* File not found

regfile [merge] -- Reg Error: Key error.

scrfile [config] -- "%1" File not found

scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)

scrfile [open] -- "%1" /S File not found

txtfile [edit] -- Reg Error: Key error.

Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1 File not found

Directory [AddToPlaylistVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()

Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)

Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

Directory [OneNote.Open] -- C:\PROGRA~2\MIF5BA~1\Office12\ONENOTE.EXE "%L" (Microsoft Corporation)

Directory [PlayWithVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()

Directory [Winamp.Bookmark] -- "C:\Program Files (x86)\Winamp\winamp.exe" /BOOKMARK "%1" (Nullsoft)

Directory [Winamp.Enqueue] -- "C:\Program Files (x86)\Winamp\winamp.exe" /ADD "%1" (Nullsoft)

Directory [Winamp.Play] -- "C:\Program Files (x86)\Winamp\winamp.exe" "%1" (Nullsoft)

Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

Folder [explore] -- Reg Error: Value error.

Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]

batfile [open] -- "%1" %*

cmdfile [open] -- "%1" %*

comfile [open] -- "%1" %*

cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)

exefile [open] -- "%1" %*

helpfile [open] -- Reg Error: Key error.

htmlfile [edit] -- "C:\Program Files (x86)\Microsoft Office\Office12\msohtmed.exe" %1 (Microsoft Corporation)

htmlfile [print] -- "C:\Program Files (x86)\Microsoft Office\Office12\msohtmed.exe" /p %1 (Microsoft Corporation)

http [open] -- Reg Error: Key error.

https [open] -- Reg Error: Key error.

inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)

InternetShortcut [print] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)

piffile [open] -- "%1" %*

regfile [merge] -- Reg Error: Key error.

scrfile [config] -- "%1"

scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)

scrfile [open] -- "%1" /S

txtfile [edit] -- Reg Error: Key error.

Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1