:COMMANDS [CREATERESTOREPOINT] :OTL PRC - [2014/05/29 06:16:32 | 000,241,344 | ---- | M] () -- C:\Program Files\pcmax\pcmax.exe PRC - [2014/05/22 09:44:36 | 001,082,240 | ---- | M] () -- C:\Program Files (x86)\ConsumerInput\Monitoring\dca-monitoring.exe SRV:64bit: - [2014/05/29 06:16:32 | 000,241,344 | ---- | M] () [Auto | Running] -- C:\Program Files\pcmax\pcmax.exe -- (pcmaxservice) MOD - [2014/05/22 09:44:36 | 001,082,240 | ---- | M] () -- C:\Program Files (x86)\Consumer Input\Monitoring\dca-monitoring.exe MOD - [2014/05/29 22:26:50 | 000,640,000 | ---- | M] () -- C:\Program Files (x86)\Premium Software\systerm32.exe MOD - [2014/03/14 22:25:44 | 000,236,544 | ---- | M] () -- C:\Program Files (x86)\Premium Software\sqlite3.dll [2014/06/23 19:56:00 | 000,000,976 | ---- | M] () -- C:\Windows\tasks\ConsumerInputUpdateTaskMachineUA.job [2014/06/23 19:55:49 | 000,000,972 | ---- | M] () -- C:\Windows\tasks\ConsumerInputUpdateTaskMachineCore.job [1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ] [1 C:\Users\Mom n Dad\AppData\Local\*.tmp files -> C:\Users\Mom n Dad\AppData\Local\*.tmp -> ] IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {87575A10-906E-4892-8D9C-E203F73BF9CE} IE:64bit: - HKLM\..\SearchScopes\{87575A10-906E-4892-8D9C-E203F73BF9CE}: "URL" = http://www.bing.com/...rc=IE-SearchBox IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/...ms}&FORM=IE8SRC IE - HKLM\..\SearchScopes\{35e9438f-19d4-4516-b2ac-59ba9241de4d}: "URL" = http://search.tb.ask...or={searchTerms} IE - HKLM\..\SearchScopes\{87575A10-906E-4892-8D9C-E203F73BF9CE}: "URL" = http://www.bing.com/...rc=IE-SearchBox IE - HKLM\..\SearchScopes\{b0441a0e-a49a-4e16-afc1-74ecced1921f}: "URL" = http://search.mywebs...or={searchTerms} IE - HKU\S-1-5-19\..\SearchScopes,DefaultScope = IE - HKU\S-1-5-20\..\SearchScopes,DefaultScope = IE - HKU\S-1-5-21-1399685641-2452391960-3966799618-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://g.msn.com/USCON/1 IE - HKU\S-1-5-21-1399685641-2452391960-3966799618-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://maxwebsearch....00&i_id== IE - HKU\S-1-5-21-1399685641-2452391960-3966799618-1001\SOFTWARE\Microsoft\Internet Explorer\Main,SearchDefaultBranded = 1 IE - HKU\S-1-5-21-1399685641-2452391960-3966799618-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/ IE - HKU\S-1-5-21-1399685641-2452391960-3966799618-1001\..\URLSearchHook: {26842a09-ffa8-4e2c-ae12-0c80f01c3295} - No CLSID value found IE - HKU\S-1-5-21-1399685641-2452391960-3966799618-1001\..\URLSearchHook: {81017EA9-9AA8-4A6A-9734-7AF40E7D593F} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn3\yt.dll (Yahoo! Inc.) IE - HKU\S-1-5-21-1399685641-2452391960-3966799618-1001\..\SearchScopes,DefaultScope = {DECA3892-BA8F-44b8-A993-A466AD694AE4} IE - HKU\S-1-5-21-1399685641-2452391960-3966799618-1001\..\SearchScopes\{35e9438f-19d4-4516-b2ac-59ba9241de4d}: "URL" = http://maxwebsearch....00&i_id== IE - HKU\S-1-5-21-1399685641-2452391960-3966799618-1001\..\SearchScopes\{3F0F7EC3-B59E-44F5-BB53-67AEC49BD573}: "URL" = http://maxwebsearch....00&i_id== IE - HKU\S-1-5-21-1399685641-2452391960-3966799618-1001\..\SearchScopes\{3F229536-5CF1-48E0-B503-5D687169D5B0}: "URL" = http://maxwebsearch....00&i_id== IE - HKU\S-1-5-21-1399685641-2452391960-3966799618-1001\..\SearchScopes\{5DF1E62F-F24E-4D6F-88DD-FAE08FC0687C}: "URL" = http://maxwebsearch....00&i_id== IE - HKU\S-1-5-21-1399685641-2452391960-3966799618-1001\..\SearchScopes\{67349ABE-6A96-4734-BF91-4BD50B20845E}: "URL" = http://maxwebsearch....00&i_id== IE - HKU\S-1-5-21-1399685641-2452391960-3966799618-1001\..\SearchScopes\{6747FD11-9D8F-42A0-9531-B2F4FD0E812D}: "URL" = http://maxwebsearch....00&i_id== IE - HKU\S-1-5-21-1399685641-2452391960-3966799618-1001\..\SearchScopes\{87575A10-906E-4892-8D9C-E203F73BF9CE}: "URL" = http://maxwebsearch....00&i_id== IE - HKU\S-1-5-21-1399685641-2452391960-3966799618-1001\..\SearchScopes\{b0441a0e-a49a-4e16-afc1-74ecced1921f}: "URL" = http://maxwebsearch....00&i_id== IE - HKU\S-1-5-21-1399685641-2452391960-3966799618-1001\..\SearchScopes\{B141F27F-CB03-4FE7-80B1-92BE7B2367C2}: "URL" = http://maxwebsearch....00&i_id== IE - HKU\S-1-5-21-1399685641-2452391960-3966799618-1001\..\SearchScopes\{B903E7F3-FC8E-4A4F-9C08-1C5B2D05D550}: "URL" = http://maxwebsearch....00&i_id== IE - HKU\S-1-5-21-1399685641-2452391960-3966799618-1001\..\SearchScopes\{D3E502F6-745E-4676-8B3D-9E36AB5C7504}: "URL" = http://maxwebsearch....00&i_id== IE - HKU\S-1-5-21-1399685641-2452391960-3966799618-1001\..\SearchScopes\{DECA3892-BA8F-44b8-A993-A466AD694AE4}: "URL" = http://maxwebsearch....00&i_id== FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_13_0_0_214.dll File not found FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found O2 - BHO: (no name) - {1e91a655-bb4b-4693-a05e-2edebc4c9d89} - No CLSID value found. O2 - BHO: (no name) - {71c1d63a-c944-428a-a5bd-ba513190e5d2} - No CLSID value found. O3:64bit: - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found. O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found. O4:64bit: - HKLM..\Run: [AdobeAAMUpdater-1.0] FILES\ADOBE\OOBE\PDAPP\UWA\UPDATERSTARTUPUTILITY.EXE" File not found O4:64bit: - HKLM..\Run: [HotKeysCmds] DOWS\SYSTEM32\HKCMD.EXE File not found O4:64bit: - HKLM..\Run: [IgfxTray] DOWS\SYSTEM32\IGFXTRAY.EXE File not found O4:64bit: - HKLM..\Run: [Persistence] DOWS\SYSTEM32\IGFXPERS.EXE File not found O4:64bit: - HKLM..\Run: [RTHDVCPL] GUI64.EXE -S File not found O4 - HKLM..\Run: [SaferBrowser] C:\Program Files (x86)\SaferBrowser\SaferBrowser.exe () O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found O4 - HKU\S-1-5-20..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found O4:64bit: - HKLM..\Run: [pcreg] C:\Program Files\pcmax\service.exe () O4 - HKLM..\Run: [Windows FUPM Service Manager] C:\Program Files (x86)\Premium Software\systerm32.exe () O18:64bit: - Protocol\Handler\cozi - No CLSID value found O18:64bit: - Protocol\Handler\livecall - No CLSID value found O18:64bit: - Protocol\Handler\msnim - No CLSID value found O18:64bit: - Protocol\Handler\wlmailhtml - No CLSID value found O18:64bit: - Protocol\Handler\wlpg - No CLSID value found O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. [2014/06/09 19:56:03 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Premium Software [2014/06/09 19:56:03 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Premium Software [2014/06/12 03:54:18 | 000,000,000 | ---D | C] -- C:\Program Files\pcmax :Files C:\Program Files\pcmax C:\Program Files (x86)\Consumer Input :Commands [emptytemp] [resethosts]