[Nstory]

This computer belongs to a relative, so I am unsure of when these problems occurred. I'm here often though, and have noticed major problems with this computer for months. The Icons on the desktop have disappeared, the layout of Windows looks outdated, quite a few pop-ups, and an issue with Google redirecting. I've used Mbam, and Super Anti-Spyware, and there were many things detected from the scan. However, the problems are still the same, even after removing them. There was an Extras.Txt that popped up with the OTL scan, I won't post it, unless you need to view it. Thank you in advance!

OTL.Txt
OTL logfile created on: 7/27/2011 8:46:02 AM - Run 1
OTL by OldTimer - Version 3.2.26.1 Folder = C:\Users\robert\Desktop
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.19088)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

2.00 Gb Total Physical Memory | 1.21 Gb Available Physical Memory | 60.38% Memory free
4.24 Gb Paging File | 2.96 Gb Available in Paging File | 69.74% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 138.95 Gb Total Space | 56.33 Gb Free Space | 40.54% Space Free | Partition Type: NTFS
Drive D: | 10.00 Gb Total Space | 5.61 Gb Free Space | 56.08% Space Free | Partition Type: NTFS

Computer Name: ROBERT-PC | User Name: robert | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2011/07/27 08:45:09 | 000,579,584 | ---- | M] (OldTimer Tools) -- C:\Users\robert\Desktop\OTL.exe
PRC - [2011/07/10 10:07:38 | 000,042,504 | ---- | M] (COMPANYVERS_NAME) -- C:\Program Files\Zwinky_42\bar\1.bin\42barsvc.exe
PRC - [2011/07/10 10:07:38 | 000,030,096 | ---- | M] (VER_COMPANY_NAME) -- C:\Program Files\Zwinky_42\bar\1.bin\42brmon.exe
PRC - [2011/07/10 10:07:38 | 000,022,048 | ---- | M] (MindSpark) -- C:\Program Files\Zwinky_42\bar\1.bin\42medint.exe
PRC - [2011/06/19 14:27:27 | 000,924,632 | ---- | M] (Mozilla Corporation) -- C:\Program Files\Mozilla Firefox\firefox.exe
PRC - [2011/06/19 12:31:27 | 000,761,344 | ---- | M] (CrypKey Inc.) -- C:\ProgramData\gcdef32.exe
PRC - [2011/06/19 12:31:27 | 000,761,344 | ---- | M] (CrypKey Inc.) -- C:\Windows\System32\dplayx32.exe
PRC - [2011/06/06 12:55:28 | 000,064,952 | ---- | M] (Adobe Systems Incorporated) -- C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe
PRC - [2011/05/27 21:32:15 | 000,013,312 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\msfeedssync.exe
PRC - [2011/05/10 16:03:16 | 001,205,760 | ---- | M] (W3i, LLC) -- C:\Program Files\W3i\InstallIQUpdater\InstallIQUpdater.exe
PRC - [2011/04/22 05:21:10 | 000,247,728 | ---- | M] (TomTom) -- C:\Program Files\TomTom HOME 2\TomTomHOMERunner.exe
PRC - [2011/04/22 05:21:10 | 000,092,592 | ---- | M] (TomTom) -- C:\Program Files\TomTom HOME 2\TomTomHOMEService.exe
PRC - [2011/03/23 16:40:00 | 000,028,672 | ---- | M] (Guffins) -- C:\Program Files\Guffins\bar\2.bin\u4medint.exe
PRC - [2011/03/23 16:39:59 | 000,036,864 | ---- | M] (Guffins) -- C:\Program Files\Guffins\bar\2.bin\u4barsvc.exe
PRC - [2011/03/23 16:39:59 | 000,027,648 | ---- | M] (Guffins) -- C:\Program Files\Guffins\bar\2.bin\u4brmon.exe
PRC - [2011/01/17 18:37:40 | 011,322,880 | ---- | M] (OpenOffice.org) -- C:\Program Files\OpenOffice.org 3\program\soffice.exe
PRC - [2011/01/17 18:37:40 | 011,314,688 | ---- | M] (OpenOffice.org) -- C:\Program Files\OpenOffice.org 3\program\soffice.bin
PRC - [2010/10/27 20:17:52 | 000,207,424 | ---- | M] (ArcSoft Inc.) -- C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe
PRC - [2010/10/19 05:53:48 | 000,983,480 | ---- | M] (MusicLab, LLC) -- C:\Program Files\BearShare Applications\MediaBar\Datamngr\datamngrUI.exe
PRC - [2010/08/25 11:27:44 | 000,309,824 | ---- | M] (ArcSoft Inc.) -- C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ArcCon.ac
PRC - [2010/07/19 10:50:45 | 002,403,568 | ---- | M] (SUPERAntiSpyware.com) -- C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
PRC - [2010/05/14 11:44:46 | 000,501,480 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\Common Files\Java\Java Update\jucheck.exe
PRC - [2010/04/07 12:55:58 | 001,553,344 | ---- | M] (Weskysoft Inc.) -- C:\Program Files\Active PC Optimizer\ActivePCOptimizerService.exe
PRC - [2010/03/18 11:19:26 | 000,113,152 | ---- | M] (ArcSoft Inc.) -- C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe
PRC - [2010/01/15 05:49:20 | 000,255,536 | ---- | M] (McAfee, Inc.) -- C:\Program Files\McAfee Security Scan\2.0.181\SSScheduler.exe
PRC - [2009/04/10 23:27:36 | 002,926,592 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe
PRC - [2009/02/06 13:44:40 | 003,572,984 | ---- | M] (Veoh Networks) -- C:\Program Files\Veoh Networks\VeohWebPlayer\veohwebplayer.exe
PRC - [2008/11/09 13:48:14 | 000,602,392 | ---- | M] (Yahoo! Inc.) -- C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe
PRC - [2008/04/28 14:56:28 | 000,161,048 | ---- | M] (Stardock Corporation) -- C:\Program Files\Dell\DellDock\DockLogin.exe
PRC - [2008/03/11 10:44:38 | 000,202,544 | ---- | M] (SupportSoft, Inc.) -- C:\Program Files\Dell Support Center\bin\sprtsvc.exe
PRC - [2008/03/11 10:44:36 | 000,202,544 | ---- | M] (SupportSoft, Inc.) -- C:\Program Files\Dell Support Center\bin\sprtcmd.exe
PRC - [2008/01/24 23:38:12 | 002,458,128 | ---- | M] (McAfee, Inc.) -- c:\Program Files\Common Files\McAfee\MNA\McNASvc.exe
PRC - [2008/01/20 19:23:32 | 001,008,184 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Windows Defender\MSASCui.exe
PRC - [2007/11/01 17:12:38 | 000,582,992 | ---- | M] (McAfee, Inc.) -- c:\Program Files\McAfee.com\Agent\mcagent.exe
PRC - [2003/08/29 19:05:35 | 000,360,448 | ---- | M] () -- C:\Program Files\SpywareGuard\sgmain.exe
PRC - [2003/08/29 11:14:56 | 000,233,472 | ---- | M] () -- C:\Program Files\SpywareGuard\sgbhp.exe


========== Modules (SafeList) ==========

MOD - [2011/07/27 08:45:09 | 000,579,584 | ---- | M] (OldTimer Tools) -- C:\Users\robert\Desktop\OTL.exe
MOD - [2010/08/31 08:43:52 | 001,686,016 | ---- | M] (Microsoft Corporation) -- C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6002.18305_none_5cb72f2a088b0ed3\comctl32.dll


========== Win32 Services (SafeList) ==========

SRV - File not found [Auto | Stopped] -- -- (RoxLiveShare9)
SRV - File not found [Auto | Stopped] -- -- (0286771307566251mcinstcleanup) McAfee Application Installer Cleanup (0286771307566251)
SRV - [2011/07/10 10:07:38 | 000,042,504 | ---- | M] (COMPANYVERS_NAME) [Auto | Running] -- C:\Program Files\Zwinky_42\bar\1.bin\42barsvc.exe -- (Zwinky_42Service)
SRV - [2011/06/19 12:31:27 | 000,761,344 | ---- | M] (CrypKey Inc.) [Auto | Running] -- C:\Windows\System32\dplayx32.exe -- (WPFFontCache_v040032)
SRV - [2011/06/06 12:55:28 | 000,064,952 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice)
SRV - [2011/04/22 05:21:10 | 000,092,592 | ---- | M] (TomTom) [Auto | Running] -- C:\Program Files\TomTom HOME 2\TomTomHOMEService.exe -- (TomTomHOMEService)
SRV - [2011/03/23 16:39:59 | 000,036,864 | ---- | M] (Guffins) [Auto | Running] -- C:\Program Files\Guffins\bar\2.bin\u4barsvc.exe -- (GuffinsService)
SRV - [2010/04/21 10:46:17 | 000,373,760 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Windows\System32\inetsrv\iisw3adm.dll -- (WAS)
SRV - [2010/04/21 10:46:17 | 000,373,760 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\System32\inetsrv\iisw3adm.dll -- (W3SVC)
SRV - [2010/04/07 12:55:58 | 001,553,344 | ---- | M] (Weskysoft Inc.) [Auto | Running] -- C:\Program Files\Active PC Optimizer\ActivePCOptimizerService.exe -- (RegMumService)
SRV - [2010/03/18 11:19:26 | 000,113,152 | ---- | M] (ArcSoft Inc.) [Auto | Running] -- C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe -- (ACDaemon)
SRV - [2010/01/15 05:49:20 | 000,227,232 | ---- | M] (McAfee, Inc.) [On_Demand | Stopped] -- C:\Program Files\McAfee Security Scan\2.0.181\McCHSvc.exe -- (McComponentHostService)
SRV - [2009/12/08 15:41:42 | 000,120,232 | ---- | M] (stumbleupon.com) [On_Demand | Stopped] -- C:\Program Files\StumbleUpon\StumbleUponUpdateService.exe -- (StumbleUponUpdateService)
SRV - [2009/04/10 23:28:17 | 000,052,224 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\System32\inetsrv\apphostsvc.dll -- (AppHostSvc)
SRV - [2008/11/09 13:48:14 | 000,602,392 | ---- | M] (Yahoo! Inc.) [Auto | Running] -- C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe -- (YahooAUService)
SRV - [2008/08/28 08:25:40 | 000,016,680 | ---- | M] (Citrix Online, a division of Citrix Systems, Inc.) [On_Demand | Stopped] -- C:\Program Files\Citrix\GoToAssist\514\g2aservice.exe -- (GoToAssist)
SRV - [2008/04/28 14:56:28 | 000,161,048 | ---- | M] (Stardock Corporation) [Auto | Running] -- C:\Program Files\Dell\DellDock\DockLogin.exe -- (DockLoginService)
SRV - [2008/03/11 10:44:38 | 000,202,544 | ---- | M] (SupportSoft, Inc.) [Auto | Running] -- C:\Program Files\Dell Support Center\bin\sprtsvc.exe -- (sprtsvc_dellsupportcenter) SupportSoft Sprocket Service (dellsupportcenter)
SRV - [2008/01/24 23:38:12 | 002,458,128 | ---- | M] (McAfee, Inc.) [Auto | Running] -- c:\Program Files\Common Files\McAfee\MNA\McNASvc.exe -- (McNASvc)
SRV - [2008/01/20 19:23:32 | 000,272,952 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)
SRV - [2008/01/09 14:50:22 | 000,767,976 | ---- | M] (McAfee, Inc.) [Auto | Stopped] -- C:\Program Files\McAfee\MSC\mcmscsvc.exe -- (mcmscsvc)
SRV - [2007/12/11 10:33:42 | 000,358,224 | ---- | M] (McAfee, Inc.) [Auto | Stopped] -- c:\Program Files\Common Files\McAfee\McProxy\McProxy.exe -- (McProxy)
SRV - [2007/12/05 08:04:10 | 000,695,624 | ---- | M] (McAfee, Inc.) [On_Demand | Stopped] -- C:\Program Files\McAfee\VirusScan\mcsysmon.exe -- (McSysmon)
SRV - [2007/07/24 10:02:14 | 000,144,704 | ---- | M] (McAfee, Inc.) [Unknown | Stopped] -- C:\Program Files\McAfee\VirusScan\Mcshield.exe -- (McShield)
SRV - [2006/11/02 05:36:18 | 000,029,696 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\System32\iprip.dll -- (iprip)


========== Driver Services (SafeList) ==========

DRV - [2010/06/24 15:53:04 | 000,021,504 | ---- | M] (http://libusb-win32.sourceforge.net) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\libusb0.sys -- (libusb0)
DRV - [2010/05/10 11:41:30 | 000,067,656 | ---- | M] (SUPERAdBlocker.com and SUPERAntiSpyware.com) [Kernel | System | Running] -- C:\Program Files\SUPERAntiSpyware\SASKUTIL.SYS -- (SASKUTIL)
DRV - [2010/03/10 21:02:38 | 000,056,352 | ---- | M] (Exent Technologies Ltd.) [Kernel | Auto | Running] -- C:\Program Files\Free Ride Games\X4HSEx.sys -- (X4HSEx)
DRV - [2010/02/17 11:25:48 | 000,012,872 | ---- | M] (SUPERAdBlocker.com and SUPERAntiSpyware.com) [Kernel | System | Running] -- C:\Program Files\SUPERAntiSpyware\sasdifsv.sys -- (SASDIFSV)
DRV - [2008/08/21 04:54:10 | 003,928,576 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\atikmdag.sys -- (R300)
DRV - [2008/08/21 04:54:10 | 003,928,576 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\atikmdag.sys -- (atikmdag)
DRV - [2007/12/02 10:51:42 | 000,040,488 | ---- | M] (McAfee, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\mfesmfk.sys -- (mfesmfk)
DRV - [2007/11/22 04:44:08 | 000,201,320 | ---- | M] (McAfee, Inc.) [Kernel | System | Running] -- C:\Windows\System32\drivers\mfehidk.sys -- (mfehidk)
DRV - [2007/11/22 04:44:08 | 000,079,304 | ---- | M] (McAfee, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\mfeavfk.sys -- (mfeavfk)
DRV - [2007/11/22 04:44:08 | 000,035,240 | ---- | M] (McAfee, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\mfebopk.sys -- (mfebopk)
DRV - [2007/11/22 04:44:04 | 000,033,832 | ---- | M] (McAfee, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\mferkdk.sys -- (mferkdk)
DRV - [2007/07/13 04:21:12 | 000,125,728 | ---- | M] () [Kernel | System | Stopped] -- C:\Windows\System32\drivers\Mpfp.sys -- (MPFP)
DRV - [2007/04/29 01:42:24 | 000,228,224 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\e1e6032.sys -- (e1express) Intel®
DRV - [2006/10/18 11:08:18 | 000,258,048 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\HSXHWBS2.sys -- (HSXHWBS2)
DRV - [2006/08/04 17:39:10 | 000,008,192 | ---- | M] (Conexant Systems, Inc.) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\XAudio.sys -- (XAudio)
DRV - [2004/09/29 13:36:29 | 000,015,360 | ---- | M] (Motorola Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\NetMotCM.sys -- (ndiscm)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\..\URLSearchHook: {72b90932-6338-4345-9fc4-4f94984ed241} - C:\Program Files\Morphster\tbMorp.dll (Conduit Ltd.)
IE - HKLM\..\URLSearchHook: {9565115d-c7d6-46d3-bd63-b67b481a4368} - C:\Program Files\PageRage\tbPage.dll (Conduit Ltd.)

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = Preserve
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page =
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://home.mywebsea...83-DAAB9C8425C9
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Restore = http://search.condui...&ctid=CT2746180
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,XMLHTTP_UUID_Default = F6 AB 30 01 24 7A 45 40 81 9D 2A 46 D3 76 F7 CE [binary data]
IE - HKCU\..\URLSearchHook: {4e320bc8-c23b-4de3-9c38-ba0ae622579f} - Reg Error: Key error. File not found
IE - HKCU\..\URLSearchHook: {81017EA9-9AA8-4A6A-9734-7AF40E7D593F} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\YTNavAssist.dll (Yahoo! Inc.)
IE - HKCU\..\URLSearchHook: {c3d3840c-12ea-4461-a61d-190555fecc82} - C:\Program Files\Guffins\bar\2.bin\u4SrcAs.dll (Guffins)
IE - HKCU\..\URLSearchHook: {E38FA08E-F56A-4169-ABF5-5C71E3C153A1} - C:\Program Files\Freeze.com\NetAssistant\NetAssistant.dll (W3i, LLC)
IE - HKCU\..\URLSearchHook: {f92a9fe4-2850-4198-b9d5-279880e49b16} - Reg Error: Key error. File not found
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 1
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = <local>

========== FireFox ==========

FF - prefs.js..browser.search.defaultenginename: "BearShare Web Search"
FF - prefs.js..browser.search.defaulturl: "http://www.google.co...-8&oe=UTF-8&q="
FF - prefs.js..browser.search.order.1: "BearShare Web Search"
FF - prefs.js..browser.search.selectedEngine: "BearShare Web Search"
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "http://home.mywebsea...3-CBB72A4D6FC1"
FF - prefs.js..extensions.enabledItems: {1FD91A9C-410C-4090-BBCC-55D3450EF433}:2.0
FF - prefs.js..extensions.enabledItems: {DB390D2E-0FB4-413F-B039-AE342D1D40BA}:1.0
FF - prefs.js..extensions.enabledItems: [email protected]:1.2
FF - prefs.js..extensions.enabledItems: {E84D42CA-64EB-11DE-A65F-8C3656D89593}:3.1
FF - prefs.js..extensions.enabledItems: {B728AB94-9BC7-49b7-B76A-422BB31B2FD0}:2.0.0.8
FF - prefs.js..extensions.enabledItems: [email protected]:1.2
FF - prefs.js..extensions.enabledItems: [email protected]:1.4
FF - prefs.js..extensions.enabledItems: [email protected]:7
FF - prefs.js..extensions.enabledItems: {E4E6BF2A-1667-11DF-A01F-1F9655D89593}:4.0
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}:6.0.22
FF - prefs.js..keyword.URL: "http://search.bearsh...&systemid=2&q="

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\Windows\system32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@exent.com/npExentCtl,version=7.0.0.0: C:\Program Files\Free Ride Games\npExentCtl.dll (Exent Technologies Ltd.)
FF - HKLM\Software\MozillaPlugins\@Guffins.com/Plugin: C:\Program Files\Guffins\bar\2.bin\NPu4Stub.dll (Guffins)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\4.0.60531.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@movenetworks.com/Quantum Media Player: C:\Users\robert\AppData\Roaming\Move Networks\plugins\npqmp071701000002.dll (Move Networks)
FF - HKLM\Software\MozillaPlugins\@mywebsearch.com/Plugin: C:\Program Files\MyWebSearch\bar\1.bin\NPMyWebS.dll File not found
FF - HKLM\Software\MozillaPlugins\@veoh.com/VeohTVPlugin: C:\Program Files\Veoh Networks\VeohWebPlayer\NPVeohTVPlugin.dll (Veoh Networks )
FF - HKLM\Software\MozillaPlugins\@veoh.com/VeohWebPlayer: C:\Program Files\Veoh Networks\VeohWebPlayer\npWebPlayerVideoPluginATL.dll (Veoh)
FF - HKLM\Software\MozillaPlugins\@Zwinky_42.com/Plugin: C:\Program Files\Zwinky_42\bar\1.bin\NP42Stub.dll (MindSpark)
FF - HKLM\Software\MozillaPlugins\@zylom.com/ZylomGamesPlayer: C:\Users\robert\AppData\Roaming\Zylom\ZylomGamesPlayer\npzylomgamesplayer.dll (Zylom)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKCU\Software\MozillaPlugins\@movenetworks.com/Quantum Media Player: C:\Users\robert\AppData\Roaming\Move Networks\plugins\npqmp071701000002.dll (Move Networks)
FF - HKCU\Software\MozillaPlugins\@unity3d.com/UnityPlayer,version=1.0: C:\Users\robert\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{B728AB94-9BC7-49b7-B76A-422BB31B2FD0}: C:\Program Files\ArcSoft\Media Converter for Philips\Internet Video Downloader\Plugin_FireFox [2010/09/05 19:46:15 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\[email protected]: C:\Program Files\Guffins\bar\2.bin [2011/03/23 16:40:04 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\42ffxtbr@Zwinky_42.com: C:\Program Files\Zwinky_42\bar\1.bin [2011/07/10 10:07:46 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 4.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2011/06/19 14:27:32 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 4.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2011/07/16 19:06:48 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions\\[email protected]: C:\Program Files\Veoh Networks\VeohWebPlayer\FFVideoFinder [2009/02/20 12:39:36 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions\\[email protected]: C:\Users\robert\AppData\Roaming\Move Networks [2011/06/08 10:55:34 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions\\[email protected]: C:\Program Files\FriendsChecker\DynConFf\ [2011/06/08 10:55:20 | 000,000,000 | ---D | M]

[2011/03/21 18:21:41 | 000,000,000 | -H-D | M] (No name found) -- C:\Users\robert\AppData\Roaming\mozilla\Extensions
[2010/10/02 11:17:11 | 000,000,000 | -H-D | M] (No name found) -- C:\Users\robert\AppData\Roaming\mozilla\Extensions\[email protected]
[2011/03/21 18:21:41 | 000,000,000 | -H-D | M] (No name found) -- C:\Users\robert\AppData\Roaming\mozilla\Extensions\[email protected]
[2011/07/23 13:21:20 | 000,000,000 | ---D | M] (No name found) -- C:\Users\robert\AppData\Roaming\mozilla\Firefox\Profiles\95z9sp1d.default\extensions
[2011/06/09 12:32:27 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Users\robert\AppData\Roaming\mozilla\Firefox\Profiles\95z9sp1d.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2011/07/27 08:21:20 | 000,000,000 | ---D | M] (XUL Cache) -- C:\Users\robert\AppData\Roaming\mozilla\Firefox\Profiles\95z9sp1d.default\extensions\{84dfe0dd-b582-4795-9334-45d5e4cbc4b6}
[2011/06/08 10:55:34 | 000,000,000 | ---D | M] (Simppull Toolbar) -- C:\Users\robert\AppData\Roaming\mozilla\Firefox\Profiles\95z9sp1d.default\extensions\{E4E6BF2A-1667-11DF-A01F-1F9655D89593}
[2011/06/08 10:55:34 | 000,000,000 | ---D | M] (MediaBar) -- C:\Users\robert\AppData\Roaming\mozilla\Firefox\Profiles\95z9sp1d.default\extensions\{E84D42CA-64EB-11DE-A65F-8C3656D89593}
[2010/12/18 20:19:35 | 000,000,000 | -H-D | M] (No name found) -- C:\Users\robert\AppData\Roaming\mozilla\Firefox\Profiles\95z9sp1d.default\extensions\{E84D42CA-64EB-11DE-A65F-8C3656D89593}chrome
[2011/06/29 08:59:30 | 000,000,000 | ---D | M] (XUL Cache) -- C:\Users\robert\AppData\Roaming\mozilla\Firefox\Profiles\95z9sp1d.default\extensions\{ed722164-ba13-4b88-9fa7-34638b4e87fa}
[2011/06/08 10:55:34 | 000,000,000 | ---D | M] (Search Toolbar) -- C:\Users\robert\AppData\Roaming\mozilla\Firefox\Profiles\95z9sp1d.default\extensions\[email protected]
[2010/09/14 05:41:12 | 000,002,506 | -H-- | M] () -- C:\Users\robert\AppData\Roaming\Mozilla\Firefox\Profiles\95z9sp1d.default\searchplugins\BearShareWebSearch.xml
[2010/10/03 08:36:09 | 000,001,919 | -H-- | M] () -- C:\Users\robert\AppData\Roaming\Mozilla\Firefox\Profiles\95z9sp1d.default\searchplugins\bing-zugo.xml
[2011/02/27 11:00:51 | 000,009,980 | -H-- | M] () -- C:\Users\robert\AppData\Roaming\Mozilla\Firefox\Profiles\95z9sp1d.default\searchplugins\Guffins.xml
[2011/05/28 17:27:58 | 000,009,932 | -H-- | M] () -- C:\Users\robert\AppData\Roaming\Mozilla\Firefox\Profiles\95z9sp1d.default\searchplugins\mywebsearch.xml
[2010/11/26 19:57:26 | 000,000,743 | -H-- | M] () -- C:\Users\robert\AppData\Roaming\Mozilla\Firefox\Profiles\95z9sp1d.default\searchplugins\search-defender.xml
[2011/07/10 17:40:53 | 000,009,946 | ---- | M] () -- C:\Users\robert\AppData\Roaming\Mozilla\Firefox\Profiles\95z9sp1d.default\searchplugins\Zwinky_42.xml
[2011/06/08 11:20:31 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions
[2011/06/08 11:20:32 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}
[2009/01/14 00:11:35 | 000,000,000 | ---D | M] (Seekeen) -- C:\Program Files\Mozilla Firefox\extensions\{DB390D2E-0FB4-413F-B039-AE342D1D40BA}
[2008/11/19 22:51:33 | 000,000,000 | ---D | M] (Real Networks Settings) -- C:\Program Files\Mozilla Firefox\extensions\[email protected]
File not found (No name found) --
[2011/03/23 16:40:04 | 000,000,000 | ---D | M] (Guffins) -- C:\PROGRAM FILES\GUFFINS\BAR\2.BIN
[2011/07/10 10:07:46 | 000,000,000 | ---D | M] (Zwinky) -- C:\PROGRAM FILES\ZWINKY_42\BAR\1.BIN
[2011/06/08 10:55:34 | 000,000,000 | ---D | M] (Move Media Player) -- C:\USERS\ROBERT\APPDATA\ROAMING\MOVE NETWORKS
[2011/06/19 14:27:27 | 000,142,296 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll
[2011/06/08 11:20:06 | 000,472,808 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\mozilla firefox\plugins\npdeployJava1.dll
[2010/09/14 05:41:12 | 000,002,506 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\BearShareWebSearch.xml
[2011/06/19 14:27:29 | 000,002,252 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml

O1 HOSTS File: ([2011/06/29 08:24:07 | 000,000,098 | ---- | M]) - C:\Windows\System32\drivers\etc\Hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: ::1 localhost
O2 - BHO: (no name) - {0130ABF6-7A24-4045-819D-2A46D376F7Ce} - C:\Windows\System32\ati2edxx32.dll ()
O2 - BHO: (&Yahoo! Toolbar Helper) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll (Yahoo! Inc.)
O2 - BHO: (MediaBar) - {0974BA1E-64EC-11DE-B2A5-E43756D89593} - C:\Program Files\BearShare Applications\MediaBar\ToolBar\BearshareMediabarDx.dll ()
O2 - BHO: (IEPlugin Class) - {11222041-111B-46E3-BD29-EFB2449479B1} - C:\Program Files\ArcSoft\Media Converter for Philips\Internet Video Downloader\ArcURLRecord.dll (ArcSoft, Inc.)
O2 - BHO: (StumbleUpon Launcher) - {145B29F4-A56B-4b90-BBAC-45784EBEBBB7} - C:\Program Files\StumbleUpon\StumbleUponIEBar.dll (stumbleupon.com)
O2 - BHO: (Toolbar BHO) - {24a07957-9b8c-4821-a614-e127ac763d9c} - C:\Program Files\Zwinky_42\bar\1.bin\42bar.dll (MindSpark)
O2 - BHO: (Conduit Engine) - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Program Files\ConduitEngine\ConduitEngine.dll (Conduit Ltd.)
O2 - BHO: (Search Assistant BHO) - {3849dae8-4add-4c86-9e37-3ed93676ebc5} - C:\Program Files\Zwinky_42\bar\1.bin\42SrcAs.dll (COMPANYVERS_NAME)
O2 - BHO: (SpywareGuardDLBLOCK.CBrowserHelper) - {4A368E80-174F-4872-96B5-0B27DDD11DB2} - C:\Program Files\SpywareGuard\dlprotect.dll ()
O2 - BHO: (4029b9e1) - {4E306816-857E-F71D-7218-53CDD39447F9} - C:\ProgramData\ati2edxx32.dll ()
O2 - BHO: (Simppull Toolbar) - {627af46b-2076-42ae-a2fd-8428734d3e74} - C:\Program Files\simppulltoolbar\simppulldx.dll ()
O2 - BHO: (Morphster Toolbar) - {72b90932-6338-4345-9fc4-4f94984ed241} - C:\Program Files\Morphster\tbMorp.dll (Conduit Ltd.)
O2 - BHO: (UrlHelper Class) - {74322BF9-DF26-493f-B0DA-6D2FC5E6429E} - C:\Program Files\BearShare Applications\MediaBar\Datamngr\IEBHO.dll (MusicLab, LLC)
O2 - BHO: (Window Shopper) - {74F475FA-6C75-43BD-AAB9-ECDA6184F600} - File not found
O2 - BHO: (scriptproxy) - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\McAfee\VirusScan\scriptsn.dll (McAfee, Inc.)
O2 - BHO: (Shop to Win 14) - {8C423C72-F06E-43B3-A3E8-A435FFF9E9E0} - C:\Program Files\Shop to Win 14\Shop to Win 14.dll (Shop To Win, LLC)
O2 - BHO: (PageRage Toolbar) - {9565115d-c7d6-46d3-bd63-b67b481a4368} - C:\Program Files\PageRage\tbPage.dll (Conduit Ltd.)
O2 - BHO: (Toolbar BHO) - {a916eefe-6a17-4d7d-a131-2738b260bb55} - C:\Program Files\Guffins\bar\2.bin\u4bar.dll (Guffins)
O2 - BHO: (Updater For Simppull Toolbar) - {C4B8BAB4-1667-11DF-A242-BA9455D89593} - C:\Program Files\simppulltoolbar\auxi\simppulltoolbAu.dll (Visicom Media)
O2 - BHO: (CBrowserHelperObject Object) - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:\Program Files\Dell\BAE\BAE.dll (Dell Inc.)
O2 - BHO: (Search Assistant BHO) - {d6a34acb-76fa-4a14-88ea-5d54797a2028} - C:\Program Files\Guffins\bar\2.bin\u4SrcAs.dll (Guffins)
O2 - BHO: (NetAssistant) - {E38FA08E-F56A-4169-ABF5-5C71E3C153A1} - C:\Program Files\Freeze.com\NetAssistant\NetAssistant.dll (W3i, LLC)
O2 - BHO: (no name) - {E4E6BF2A-1667-11DF-A01F-1F9655D89593} - No CLSID value found.
O2 - BHO: (SingleInstance Class) - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\YTSingleInstance.dll (Yahoo! Inc)
O2 - BHO: (FriendsChecker) - {FED6A736-129B-49C7-857E-25FC91E87DB3} - C:\Program Files\FriendsChecker\DynConIe\DynConIE.dll (FriendsChecker)
O3 - HKLM\..\Toolbar: (MediaBar) - {0974BA1E-64EC-11DE-B2A5-E43756D89593} - C:\Program Files\BearShare Applications\MediaBar\ToolBar\BearshareMediabarDx.dll ()
O3 - HKLM\..\Toolbar: (no name) - {0C8413C1-FAD1-446C-8584-BE50576F863E} - No CLSID value found.
O3 - HKLM\..\Toolbar: (Veoh Web Player Video Finder) - {0FBB9689-D3D7-4f7a-A2E2-585B10099BFC} - C:\Program Files\Veoh Networks\VeohWebPlayer\VeohIEToolbar.dll (Veoh Networks Inc)
O3 - HKLM\..\Toolbar: (Zwinky Toolbar) - {1df01b27-e0d6-40d5-a8ce-0d926d6f39f3} - C:\Program Files\Zwinky_42\bar\1.bin\42bar.dll (MindSpark)
O3 - HKLM\..\Toolbar: (Conduit Engine) - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Program Files\ConduitEngine\ConduitEngine.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (StumbleUpon Toolbar) - {5093EB4C-3E93-40AB-9266-B607BA87BDC8} - C:\Program Files\StumbleUpon\StumbleUponIEBar.dll (stumbleupon.com)
O3 - HKLM\..\Toolbar: (Veoh Video Compass) - {52836EB0-631A-47B1-94A6-61F9D9112DAE} - C:\Program Files\Veoh Networks\Veoh Video Compass\SearchRecsPlugin.dll (Veoh Networks)
O3 - HKLM\..\Toolbar: (Simppull Toolbar) - {627af46b-2076-42ae-a2fd-8428734d3e74} - C:\Program Files\simppulltoolbar\simppulldx.dll ()
O3 - HKLM\..\Toolbar: (Morphster Toolbar) - {72b90932-6338-4345-9fc4-4f94984ed241} - C:\Program Files\Morphster\tbMorp.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (PageRage Toolbar) - {9565115d-c7d6-46d3-bd63-b67b481a4368} - C:\Program Files\PageRage\tbPage.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (Guffins) - {de2fdf7c-2637-4ba3-b427-3fce2d331db5} - C:\Program Files\Guffins\bar\2.bin\u4bar.dll (Guffins)
O3 - HKLM\..\Toolbar: (Yahoo! Toolbar) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll (Yahoo! Inc.)
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {0C8413C1-FAD1-446C-8584-BE50576F863E} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (Zwinky Toolbar) - {1DF01B27-E0D6-40D5-A8CE-0D926D6F39F3} - C:\Program Files\Zwinky_42\bar\1.bin\42bar.dll (MindSpark)
O3 - HKCU\..\Toolbar\WebBrowser: (Conduit Engine) - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Program Files\ConduitEngine\ConduitEngine.dll (Conduit Ltd.)
O3 - HKCU\..\Toolbar\WebBrowser: (Morphster Toolbar) - {72B90932-6338-4345-9FC4-4F94984ED241} - C:\Program Files\Morphster\tbMorp.dll (Conduit Ltd.)
O3 - HKCU\..\Toolbar\WebBrowser: (PageRage Toolbar) - {9565115D-C7D6-46D3-BD63-B67B481A4368} - C:\Program Files\PageRage\tbPage.dll (Conduit Ltd.)
O3 - HKCU\..\Toolbar\WebBrowser: (Guffins) - {DE2FDF7C-2637-4BA3-B427-3FCE2D331DB5} - C:\Program Files\Guffins\bar\2.bin\u4bar.dll (Guffins)
O4 - HKLM..\Run: [ArcSoft Connection Service] C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe (ArcSoft Inc.)
O4 - HKLM..\Run: [CyberDefender Registry Cleaner] File not found
O4 - HKLM..\Run: [DATAMNGR] C:\Program Files\BearShare Applications\MediaBar\Datamngr\datamngrUI.exe (MusicLab, LLC)
O4 - HKLM..\Run: [DellSupportCenter] C:\Program Files\Dell Support Center\bin\sprtcmd.exe (SupportSoft, Inc.)
O4 - HKLM..\Run: [dscactivate] C:\Program Files\Dell Support Center\gs_agent\custom\dsca.exe ( )
O4 - HKLM..\Run: [ECenter] C:\DELL\E-Center\EULALauncher.exe ( )
O4 - HKLM..\Run: [Guffins Browser Plugin Loader] C:\Program Files\Guffins\bar\2.bin\u4brmon.exe (Guffins)
O4 - HKLM..\Run: [Malwarebytes Anti-Malware (reboot)] C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe (Malwarebytes Corporation)
O4 - HKLM..\Run: [Malwarebytes' Anti-Malware (reboot)] C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe (Malwarebytes Corporation)
O4 - HKLM..\Run: [StartCCC] C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe ()
O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)
O4 - HKLM..\Run: [Zwinky_42 Browser Plugin Loader] C:\Program Files\Zwinky_42\bar\1.bin\42brmon.exe (VER_COMPANY_NAME)
O4 - HKCU..\Run: [811264436] C:\Users\robert\AppData\Local\Temp\tmph1189877229015082782.tmp (Crane Dusky Rafts Bozo)
O4 - HKCU..\Run: [ares] File not found
O4 - HKCU..\Run: [DellSupportCenter] C:\Program Files\Dell Support Center\bin\sprtcmd.exe (SupportSoft, Inc.)
O4 - HKCU..\Run: [DW6] File not found
O4 - HKCU..\Run: [Exetender] C:\Program Files\Free Ride Games\GPlayer.exe (Exent Technologies Ltd.)
O4 - HKCU..\Run: [InstallIQUpdater] C:\Program Files\W3i\InstallIQUpdater\InstallIQUpdater.exe (W3i, LLC)
O4 - HKCU..\Run: [Malware Protection] File not found
O4 - HKCU..\Run: [msav] File not found
O4 - HKCU..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe (SUPERAntiSpyware.com)
O4 - HKCU..\Run: [Svc2dll] File not found
O4 - HKCU..\Run: [TomTomHOME.exe] C:\Program Files\TomTom HOME 2\TomTomHOMERunner.exe (TomTom)
O4 - HKCU..\Run: [VeohPlugin] C:\Program Files\Veoh Networks\VeohWebPlayer\veohwebplayer.exe (Veoh Networks)
O4 - Startup: C:\Users\robert\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.3.lnk = C:\Program Files\OpenOffice.org 3\program\quickstart.exe ()
O4 - Startup: C:\Users\robert\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SpywareGuard.lnk = C:\Program Files\SpywareGuard\sgmain.exe ()
O9 - Extra Button: Window Shopper - {A69A551A-1AAE-4B67-8C2E-52F8B8A19504} - File not found
O10 - NameSpace_Catalog5\Catalog_Entries\000000000005 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O13 - gopher Prefix: missing
O15 - HKCU\..Trusted Domains: real.com ([rhap-app-4-0] https in Trusted sites)
O15 - HKCU\..Trusted Domains: real.com ([rhapreg] https in Trusted sites)
O16 - DPF: {149E45D8-163E-4189-86FC-45022AB2B6C9} file:///C:/Program%20Files/Mysteryville/Images/stg_drm.ocx (SpinTop DRM Control)
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} http://download.macr...director/sw.cab (Shockwave ActiveX Control)
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} C:\Program Files\Yahoo!\Common\Yinsthelper.dll (Installation Support)
O16 - DPF: {6A060448-60F9-11D5-A6CD-0002B31F7455} (ExentInf Class)
O16 - DPF: {73ECB3AA-4717-450C-A2AB-D00DAD9EE203} http://h20270.www2.h...ctDetection.cab (GMNRev Class)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.ma...t/ultrashim.cab (Reg Error: Key error.)
O16 - DPF: {924B4927-D3BA-41EA-9F7E-8A89194AB3AC} http://panda-plugin..../p3dactivex.cab (P3DActiveX Control)
O16 - DPF: {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_05)
O16 - DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {CB97291A-6603-466A-AA11-80C2EB74CB10} https://install.cox....InstallAx10.ocx (CoxSelfInstallAx10 Control)
O16 - DPF: {CC450D71-CC90-424C-8638-1F2DBAC87A54} file:///C:/Program%20Files/Mysteryville/Images/armhelper.ocx (ArmHelper Control)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.ad...Plus/1.6/gp.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 68.105.28.11 68.105.29.11 68.105.28.12
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O20 - AppInit_DLLs: (C:\PROGRA~1\BEARSH~1\MediaBar\Datamngr\datamngr.dll C:\PROGRA~1\BEARSH~1\MediaBar\Datamngr\IEBHO.dll) - C:\Program Files\BearShare Applications\MediaBar\Datamngr\datamngr.dll (MusicLab, LLC)
O20 - AppInit_DLLs: (C:\ProgramData\ati2edxx32.dll) - C:\ProgramData\ati2edxx32.dll ()
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKCU Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\GoToAssist: DllName - C:\Program Files\Citrix\GoToAssist\514\G2AWinLogon.dll - C:\Program Files\Citrix\GoToAssist\514\g2awinlogon.dll (Citrix Online, a division of Citrix Systems, Inc.)
O24 - Desktop WallPaper: C:\Windows\Web\Wallpaper\img32.jpg
O24 - Desktop BackupWallPaper: C:\Windows\Web\Wallpaper\img32.jpg
O28 - HKLM ShellExecuteHooks: {81559C35-8464-49F7-BB0E-07A383BEF910} - C:\Program Files\SpywareGuard\spywareguard.dll ()
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006/09/18 14:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O33 - MountPoints2\{843a975c-2313-11e0-9d2e-001a66ab16c1}\Shell - "" = AutoRun
O33 - MountPoints2\{843a975c-2313-11e0-9d2e-001a66ab16c1}\Shell\AutoRun\command - "" = J:\PhotoRun.exe
O33 - MountPoints2\{f971412a-a55b-11df-963a-001a66ab16c1}\Shell\AutoRun\command - "" = J:\Setup_FlipShare.exe
O33 - MountPoints2\{f971412a-a55b-11df-963a-001a66ab16c1}\Shell\Setup FlipShare\command - "" = J:\Setup_FlipShare.exe
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O35 - HKCU\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2011/07/27 08:45:07 | 000,579,584 | ---- | C] (OldTimer Tools) -- C:\Users\robert\Desktop\OTL.exe
[2011/07/16 19:06:26 | 000,000,000 | -HSD | C] -- C:\Config.Msi
[2011/07/10 10:07:38 | 000,000,000 | ---D | C] -- C:\Program Files\Zwinky_42
[2011/07/09 23:55:40 | 000,000,000 | ---D | C] -- C:\Program Files\Zwinky_42EI
[1 C:\Users\robert\Desktop\*.tmp files -> C:\Users\robert\Desktop\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2011/07/27 08:45:09 | 000,579,584 | ---- | M] (OldTimer Tools) -- C:\Users\robert\Desktop\OTL.exe
[2011/07/27 08:44:59 | 000,000,424 | -H-- | M] () -- C:\Windows\tasks\User_Feed_Synchronization-{959423BF-60E2-4333-92F1-3CBDC81F09DA}.job
[2011/07/27 08:32:14 | 000,003,616 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2011/07/27 08:32:14 | 000,003,616 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2011/07/27 08:26:45 | 000,000,142 | ---- | M] () -- C:\ProgramData\60daeeb3
[2011/07/27 07:55:03 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2011/07/27 05:29:01 | 000,000,418 | ---- | M] () -- C:\Windows\tasks\ParetoLogic Update Version2.job
[2011/07/26 23:54:40 | 000,634,834 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2011/07/26 23:54:40 | 000,112,596 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2011/07/26 23:49:21 | 000,000,416 | ---- | M] () -- C:\Windows\tasks\PCConfidential.job
[2011/07/26 23:48:05 | 000,065,536 | ---- | M] () -- C:\Windows\System32\Ikeext.etl
[2011/07/26 23:47:07 | 2143,514,624 | -HS- | M] () -- C:\hiberfil.sys
[2011/07/26 18:00:00 | 000,000,446 | ---- | M] () -- C:\Windows\tasks\ParetoLogic Registration3.job
[2011/07/26 18:00:00 | 000,000,444 | ---- | M] () -- C:\Windows\tasks\ParetoLogic Registration.job
[2011/07/25 01:24:15 | 000,000,382 | ---- | M] () -- C:\Windows\tasks\DriverCure.job
[2011/07/23 13:21:16 | 000,356,864 | ---- | M] () -- C:\Windows\System32\ati2edxx32.dll
[2011/07/18 20:47:04 | 000,000,945 | ---- | M] () -- C:\Users\robert\Application Data\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk
[2011/07/16 19:25:20 | 000,000,940 | ---- | M] () -- C:\Users\robert\Application Data\Microsoft\Internet Explorer\Quick Launch\Windows Media Player.lnk
[2011/07/16 19:25:19 | 000,000,818 | ---- | M] () -- C:\Users\robert\Application Data\Microsoft\Internet Explorer\Quick Launch\QuickTime Player.lnk
[2011/07/16 19:25:19 | 000,000,794 | ---- | M] () -- C:\Users\Public\Desktop\QuickTime Player.lnk
[2011/07/16 19:25:19 | 000,000,754 | ---- | M] () -- C:\Users\robert\Application Data\Microsoft\Internet Explorer\Quick Launch\iTunes.lnk
[2011/07/16 19:25:19 | 000,000,730 | ---- | M] () -- C:\Users\Public\Desktop\iTunes.lnk
[2011/07/16 19:06:48 | 000,001,894 | ---- | M] () -- C:\Users\Public\Desktop\Adobe Reader X.lnk
[2011/07/16 18:27:23 | 000,008,428 | ---- | M] () -- C:\Users\robert\Desktop\New OpenDocument Drawing.odg
[2011/07/15 03:22:37 | 000,172,032 | ---- | M] () -- C:\ProgramData\ati2edxx32.dll
[2011/07/15 03:22:37 | 000,000,095 | ---- | M] () -- C:\Windows\System32\1257569987
[2011/07/15 03:22:04 | 000,298,248 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT
[2011/07/15 03:03:52 | 000,000,197 | ---- | M] () -- C:\Windows\System32\MRT.INI
[2011/07/15 01:00:00 | 000,000,356 | ---- | M] () -- C:\Windows\tasks\McDefragTask.job
[2011/07/14 21:39:01 | 000,000,798 | ---- | M] () -- C:\Users\Public\Desktop\Kobo.lnk
[2011/07/11 21:05:34 | 000,025,143 | ---- | M] () -- C:\Users\robert\AppData\Roaming\762E.185
[2011/07/10 10:07:23 | 000,210,976 | ---- | M] () -- C:\Users\robert\Desktop\Zwinky.exe
[2011/07/09 23:08:41 | 000,700,144 | ---- | M] () -- C:\Users\robert\Desktop\Second_Life_Setup.exe
[2011/07/09 10:36:00 | 000,000,848 | ---- | M] () -- C:\Users\Public\Desktop\Mozilla Firefox.lnk
[2011/07/08 10:25:48 | 000,001,356 | ---- | M] () -- C:\Users\robert\AppData\Local\d3d9caps.dat
[2011/07/01 01:53:45 | 000,010,576 | -HS- | M] () -- C:\Users\robert\AppData\Local\caxgied5y78r866jn7by1
[2011/07/01 01:53:45 | 000,010,576 | -HS- | M] () -- C:\ProgramData\caxgied5y78r866jn7by1
[2011/07/01 01:00:00 | 000,000,348 | ---- | M] () -- C:\Windows\tasks\McQcTask.job
[2011/06/29 18:07:12 | 000,001,804 | ---- | M] () -- C:\Users\robert\Application Data\Microsoft\Internet Explorer\Quick Launch\iTunes (7).lnk
[2011/06/29 18:06:27 | 000,001,804 | ---- | M] () -- C:\Users\robert\Application Data\Microsoft\Internet Explorer\Quick Launch\iTunes (6).lnk
[2011/06/29 18:06:21 | 000,001,804 | ---- | M] () -- C:\Users\robert\Application Data\Microsoft\Internet Explorer\Quick Launch\iTunes (5).lnk
[2011/06/29 18:06:12 | 000,001,804 | ---- | M] () -- C:\Users\robert\Application Data\Microsoft\Internet Explorer\Quick Launch\iTunes (4).lnk
[2011/06/29 08:24:07 | 000,000,098 | ---- | M] () -- C:\Windows\System32\drivers\etc\Hosts
[2011/06/29 08:13:21 | 000,522,752 | ---- | M] (OldTimer Tools) -- C:\Users\robert\Desktop\OTM.exe
[2011/06/28 04:14:49 | 000,001,750 | ---- | M] () -- C:\Users\robert\Application Data\Microsoft\Internet Explorer\Quick Launch\Mozilla Firefox (3).lnk
[2011/06/27 20:36:48 | 000,001,750 | ---- | M] () -- C:\Users\robert\Application Data\Microsoft\Internet Explorer\Quick Launch\Mozilla Firefox (2).lnk
[1 C:\Users\robert\Desktop\*.tmp files -> C:\Users\robert\Desktop\*.tmp -> ]

========== Files Created - No Company Name ==========

[2011/07/23 13:21:16 | 000,356,864 | ---- | C] () -- C:\Windows\System32\ati2edxx32.dll
[2011/07/18 20:47:04 | 000,000,951 | ---- | C] () -- C:\Users\robert\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
[2011/07/18 20:47:04 | 000,000,945 | ---- | C] () -- C:\Users\robert\Application Data\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk
[2011/07/16 19:25:20 | 000,001,738 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Media Center.lnk
[2011/07/16 19:25:20 | 000,000,946 | ---- | C] () -- C:\Users\robert\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows Media Player.lnk
[2011/07/16 19:25:20 | 000,000,940 | ---- | C] () -- C:\Users\robert\Application Data\Microsoft\Internet Explorer\Quick Launch\Windows Media Player.lnk
[2011/07/16 19:25:19 | 000,000,818 | ---- | C] () -- C:\Users\robert\Application Data\Microsoft\Internet Explorer\Quick Launch\QuickTime Player.lnk
[2011/07/16 19:25:19 | 000,000,794 | ---- | C] () -- C:\Users\Public\Desktop\QuickTime Player.lnk
[2011/07/16 19:25:19 | 000,000,754 | ---- | C] () -- C:\Users\robert\Application Data\Microsoft\Internet Explorer\Quick Launch\iTunes.lnk
[2011/07/16 19:25:19 | 000,000,730 | ---- | C] () -- C:\Users\Public\Desktop\iTunes.lnk
[2011/07/16 19:25:17 | 000,000,917 | ---- | C] () -- C:\Users\robert\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows Mail.lnk
[2011/07/16 19:06:48 | 000,001,894 | ---- | C] () -- C:\Users\Public\Desktop\Adobe Reader X.lnk
[2011/07/16 19:06:48 | 000,001,804 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader X.lnk
[2011/07/16 18:27:23 | 000,008,428 | ---- | C] () -- C:\Users\robert\Desktop\New OpenDocument Drawing.odg
[2011/07/15 03:22:37 | 000,172,032 | ---- | C] () -- C:\ProgramData\ati2edxx32.dll
[2011/07/15 03:03:52 | 000,000,197 | ---- | C] () -- C:\Windows\System32\MRT.INI
[2011/07/09 23:55:34 | 000,210,976 | ---- | C] () -- C:\Users\robert\Desktop\Zwinky.exe
[2011/07/09 23:07:07 | 000,700,144 | ---- | C] () -- C:\Users\robert\Desktop\Second_Life_Setup.exe
[2011/07/09 10:36:00 | 000,000,848 | ---- | C] () -- C:\Users\Public\Desktop\Mozilla Firefox.lnk
[2011/07/06 00:16:08 | 000,000,798 | ---- | C] () -- C:\Users\Public\Desktop\Kobo.lnk
[2011/07/02 12:22:31 | 000,025,143 | ---- | C] () -- C:\Users\robert\AppData\Roaming\762E.185
[2011/06/29 18:07:12 | 000,001,804 | ---- | C] () -- C:\Users\robert\Application Data\Microsoft\Internet Explorer\Quick Launch\iTunes (7).lnk
[2011/06/29 18:06:27 | 000,001,804 | ---- | C] () -- C:\Users\robert\Application Data\Microsoft\Internet Explorer\Quick Launch\iTunes (6).lnk
[2011/06/29 18:06:21 | 000,001,804 | ---- | C] () -- C:\Users\robert\Application Data\Microsoft\Internet Explorer\Quick Launch\iTunes (5).lnk
[2011/06/29 18:06:12 | 000,001,804 | ---- | C] () -- C:\Users\robert\Application Data\Microsoft\Internet Explorer\Quick Launch\iTunes (4).lnk
[2011/06/29 12:30:45 | 000,010,576 | -HS- | C] () -- C:\Users\robert\AppData\Local\caxgied5y78r866jn7by1
[2011/06/29 12:30:45 | 000,010,576 | -HS- | C] () -- C:\ProgramData\caxgied5y78r866jn7by1
[2011/06/28 04:14:49 | 000,001,750 | ---- | C] () -- C:\Users\robert\Application Data\Microsoft\Internet Explorer\Quick Launch\Mozilla Firefox (3).lnk
[2011/06/27 20:36:48 | 000,001,750 | ---- | C] () -- C:\Users\robert\Application Data\Microsoft\Internet Explorer\Quick Launch\Mozilla Firefox (2).lnk
[2011/05/19 17:42:28 | 000,000,064 | ---- | C] () -- C:\Windows\GPlrLanc.dat
[2011/04/17 14:14:38 | 000,000,157 | -H-- | C] () -- C:\Users\robert\AppData\Local\svc2dll.dat
[2011/04/17 14:14:35 | 000,118,272 | ---- | C] () -- C:\Users\robert\AppData\Local\svc2dll.exe.old
[2011/04/02 08:29:54 | 000,010,282 | -HS- | C] () -- C:\Users\robert\AppData\Local\jcl665ep0rnlp562hps
[2010/09/06 10:47:16 | 000,870,128 | -H-- | C] () -- C:\Users\robert\AppData\Roaming\mcs.rma
[2010/09/06 10:47:16 | 000,000,004 | -H-- | C] () -- C:\Users\robert\AppData\Roaming\E67770
[2010/07/24 22:48:07 | 000,767,952 | ---- | C] () -- C:\Windows\BDTSupport.dll.old
[2009/09/23 15:55:01 | 000,107,612 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchema.bin
[2009/09/23 15:55:00 | 000,117,248 | ---- | C] () -- C:\Windows\System32\EhStorAuthn.dll
[2009/03/23 17:54:37 | 000,001,356 | ---- | C] () -- C:\Users\robert\AppData\Local\d3d9caps.dat
[2008/11/23 22:21:36 | 000,003,526 | -H-- | C] () -- C:\Users\robert\AppData\Roaming\wklnhst.dat
[2008/11/19 22:51:53 | 000,000,000 | ---- | C] () -- C:\Windows\nsreg.dat
[2008/10/27 11:18:47 | 000,141,162 | ---- | C] () -- C:\Windows\hpoins14.dat
[2008/10/14 22:56:14 | 000,157,696 | ---- | C] () -- C:\Windows\hpoins28.dat.temp
[2008/10/14 22:56:14 | 000,000,932 | ---- | C] () -- C:\Windows\hpomdl28.dat.temp
[2008/09/20 01:04:10 | 000,018,904 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchemaTrivial.bin
[2008/09/18 05:34:50 | 000,008,248 | ---- | C] () -- C:\Users\robert\AppData\Local\en.ini
[2008/09/18 04:38:52 | 000,086,016 | ---- | C] () -- C:\Users\robert\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2008/08/28 10:51:31 | 003,107,788 | ---- | C] () -- C:\Windows\System32\atiumdva.dat
[2008/08/28 10:51:31 | 000,159,744 | ---- | C] () -- C:\Windows\System32\atitmmxx.dll
[2008/08/28 10:51:29 | 000,876,544 | ---- | C] () -- C:\Windows\System32\TEACico2.dll
[2008/08/28 08:19:24 | 000,125,728 | ---- | C] () -- C:\Windows\System32\drivers\Mpfp.sys
[2008/08/28 02:57:49 | 000,000,000 | ---- | C] () -- C:\Windows\ativpsrm.bin
[2008/07/17 12:23:36 | 000,174,818 | ---- | C] () -- C:\Windows\System32\atiicdxx.dat
[2008/03/06 00:38:44 | 000,090,112 | ---- | C] () -- C:\Windows\System32\atibrtmon.exe
[2007/09/19 18:14:41 | 000,002,000 | ---- | C] () -- C:\Windows\hpomdl14.dat
[2007/08/21 21:51:16 | 000,081,920 | ---- | C] () -- C:\Windows\System32\ATIODE.exe
[2007/08/21 19:36:12 | 000,040,960 | ---- | C] () -- C:\Windows\System32\ATIODCLI.exe
[2006/11/02 05:57:28 | 000,067,584 | --S- | C] () -- C:\Windows\bootstat.dat
[2006/11/02 05:47:37 | 000,298,248 | ---- | C] () -- C:\Windows\System32\FNTCACHE.DAT
[2006/11/02 05:35:32 | 000,005,632 | ---- | C] () -- C:\Windows\System32\sysprepMCE.dll
[2006/11/02 03:33:01 | 000,634,834 | ---- | C] () -- C:\Windows\System32\perfh009.dat
[2006/11/02 03:33:01 | 000,287,440 | ---- | C] () -- C:\Windows\System32\perfi009.dat
[2006/11/02 03:33:01 | 000,112,596 | ---- | C] () -- C:\Windows\System32\perfc009.dat
[2006/11/02 03:33:01 | 000,030,674 | ---- | C] () -- C:\Windows\System32\perfd009.dat
[2006/11/02 03:23:21 | 000,215,943 | ---- | C] () -- C:\Windows\System32\dssec.dat
[2006/11/02 01:58:30 | 000,043,131 | ---- | C] () -- C:\Windows\mib.bin
[2006/11/02 01:19:00 | 000,000,741 | ---- | C] () -- C:\Windows\System32\NOISE.DAT
[2006/11/02 00:40:29 | 000,013,750 | ---- | C] () -- C:\Windows\System32\pacerprf.ini
[2006/11/02 00:25:31 | 000,673,088 | ---- | C] () -- C:\Windows\System32\mlang.dat

========== LOP Check ==========

[2010/12/16 09:26:17 | 000,000,000 | -H-D | M] -- C:\Users\robert\AppData\Roaming\Bitrix Security
[2009/07/13 12:49:12 | 000,000,000 | -H-D | M] -- C:\Users\robert\AppData\Roaming\DriverCure
[2011/06/07 17:18:52 | 000,000,000 | -H-D | M] -- C:\Users\robert\AppData\Roaming\Fighters
[2011/07/26 23:38:38 | 000,000,000 | ---D | M] -- C:\Users\robert\AppData\Roaming\FrostWire
[2008/12/23 13:34:25 | 000,000,000 | -H-D | M] -- C:\Users\robert\AppData\Roaming\iShell
[2009/04/15 01:32:09 | 000,000,000 | ---D | M] -- C:\Users\robert\AppData\Roaming\iWin
[2010/11/26 18:31:22 | 000,000,000 | ---D | M] -- C:\Users\robert\AppData\Roaming\LimeWire
[2009/05/30 12:12:00 | 000,000,000 | -H-D | M] -- C:\Users\robert\AppData\Roaming\McGraw-HillLicensing
[2010/12/16 17:25:17 | 000,000,000 | -H-D | M] -- C:\Users\robert\AppData\Roaming\MusicNet
[2010/12/18 13:57:23 | 000,000,000 | ---D | M] -- C:\Users\robert\AppData\Roaming\OpenCandy
[2011/06/08 11:35:24 | 000,000,000 | ---D | M] -- C:\Users\robert\AppData\Roaming\OpenOffice.org
[2011/06/08 10:55:34 | 000,000,000 | ---D | M] -- C:\Users\robert\AppData\Roaming\SpinTop
[2008/11/23 22:21:38 | 000,000,000 | -H-D | M] -- C:\Users\robert\AppData\Roaming\Template
[2010/10/02 11:17:02 | 000,000,000 | ---D | M] -- C:\Users\robert\AppData\Roaming\TomTom
[2011/03/21 18:29:59 | 000,000,000 | ---D | M] -- C:\Users\robert\AppData\Roaming\Vivox
[2009/01/08 16:54:15 | 000,000,000 | -H-D | M] -- C:\Users\robert\AppData\Roaming\WeatherBug
[2009/02/15 15:45:41 | 000,000,000 | ---D | M] -- C:\Users\robert\AppData\Roaming\Zylom
[2011/07/25 01:24:15 | 000,000,382 | ---- | M] () -- C:\Windows\Tasks\DriverCure.job
[2011/07/15 01:00:00 | 000,000,356 | ---- | M] () -- C:\Windows\Tasks\McDefragTask.job
[2011/07/01 01:00:00 | 000,000,348 | ---- | M] () -- C:\Windows\Tasks\McQcTask.job
[2011/07/26 18:00:00 | 000,000,444 | ---- | M] () -- C:\Windows\Tasks\ParetoLogic Registration.job
[2011/07/26 18:00:00 | 000,000,446 | ---- | M] () -- C:\Windows\Tasks\ParetoLogic Registration3.job
[2011/07/27 05:29:01 | 000,000,418 | ---- | M] () -- C:\Windows\Tasks\ParetoLogic Update Version2.job
[2011/07/26 23:49:21 | 000,000,416 | ---- | M] () -- C:\Windows\Tasks\PCConfidential.job
[2011/07/26 23:40:06 | 000,032,554 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT
[2011/07/27 08:44:59 | 000,000,424 | -H-- | M] () -- C:\Windows\Tasks\User_Feed_Synchronization-{959423BF-60E2-4333-92F1-3CBDC81F09DA}.job

========== Purity Check ==========



========== Alternate Data Streams ==========

@Alternate Data Stream - 95 bytes -> C:\ProgramData\TEMP:5C321E34
@Alternate Data Stream - 820 bytes -> C:\Users\robert\Documents\Welcome to Windows Mail.eml:OECustomProperty
@Alternate Data Stream - 143 bytes -> C:\ProgramData\TEMP:DB2BB17F
@Alternate Data Stream - 122 bytes -> C:\ProgramData\TEMP:A8ADE5D8
@Alternate Data Stream - 121 bytes -> C:\ProgramData\TEMP:DFC5A2B2
@Alternate Data Stream - 114 bytes -> C:\ProgramData\TEMP:1502A995
@Alternate Data Stream - 113 bytes -> C:\ProgramData\TEMP:C2B2C9C1
@Alternate Data Stream - 105 bytes -> C:\ProgramData\TEMP:430C6D84

< End of report >

[Advertisements]

Hello and welcome to the forums!

My secret agent name on the forums is SweetTech (you can call me ST for short), it's a pleasure to meet you.

I would be glad to take a look at your log and help you with solving any malware problems.

If you have since resolved the issues you were originally experiencing, or have received help elsewhere, please inform me so that this topic can be closed.

If you have not, please adhere to the guidelines below and then follow instructions as outlined further below:

• Logs from malware removal programs (OTL is one of them) can take some time to analyze. I need you to be patient while I analyze any logs you post. Please remember, I am a volunteer, and I do have a life outside of these forums.
  
• Please make sure to carefully read any instruction that I give you. Attention to detail is important! Since I cannot see or directly interact with your computer I am dependent on you to "be my eyes" and provide as much information as you can regarding the current state of your computer.
  
• If you're not sure, or if something unexpected happens, do NOT continue! Stop and ask!
  
• If I instruct you to download a specific tool in which you already have, please delete the copy that you have and re-download the tool. The reason I ask you to do this is because these tools are updated fairly regularly.
  
• Do not do things I do not ask for, such as running a spyware scan on your computer. The one thing that you should always do, is to make sure sure that your anti-virus definitions are up-to-date!
  
• Please do not use the Attachment feature for any log file. Do a Copy/Paste of the entire contents of the log file and submit it inside your post.
  
• I am going to stick with you until ALL malware is gone from your system. I would appreciate it if you would do the same. From this point, we're in this together
  Because of this, you must reply within three days failure to reply will result in the topic being closed!
  
• Lastly, I am no magician. I will try very hard to fix your issues, but no promises can be made. Also be aware that some infections are so severe that you might need to resort to reformatting and reinstalling your operating system.
  Don't worry, this only happens in severe cases, but it sadly does happen. Be prepared to back up your data. Have means of backing up your data available.

____________________________________________________

Please post the Extras.txt log for me to review.

GooredFix
Please download GooredFix from one of the locations below and save it to your Desktop
Download Mirror #1

• Ensure all Firefox windows are closed.
• To run the tool, double-click it (XP), or right-click and select Run As Administrator (Vista).
• When prompted to run the scan, click Yes.
• GooredFix will check for infections, and then a log will appear. Please post the contents of that log in your next reply (it can also be found on your desktop, called GooredFix.txt).

NEXT:



OTL Fix

We need to run an OTL Fix

• Please reopen on your desktop.
• Copy and Paste the following code into the textbox.
  

  :Services
  :Processes
  KILLALLPROCESSES
  :OTL
  PRC - [2011/07/10 10:07:38 | 000,042,504 | ---- | M] (COMPANYVERS_NAME) -- C:\Program Files\Zwinky_42\bar\1.bin\42barsvc.exe
  PRC - [2011/07/10 10:07:38 | 000,030,096 | ---- | M] (VER_COMPANY_NAME) -- C:\Program Files\Zwinky_42\bar\1.bin\42brmon.exe
  PRC - [2011/07/10 10:07:38 | 000,022,048 | ---- | M] (MindSpark) -- C:\Program Files\Zwinky_42\bar\1.bin\42medint.exe
  PRC - [2011/06/19 12:31:27 | 000,761,344 | ---- | M] (CrypKey Inc.) -- C:\ProgramData\gcdef32.exe
  PRC - [2011/06/19 12:31:27 | 000,761,344 | ---- | M] (CrypKey Inc.) -- C:\Windows\System32\dplayx32.exe
  PRC - [2011/03/23 16:40:00 | 000,028,672 | ---- | M] (Guffins) -- C:\Program Files\Guffins\bar\2.bin\u4medint.exe
  PRC - [2011/03/23 16:39:59 | 000,036,864 | ---- | M] (Guffins) -- C:\Program Files\Guffins\bar\2.bin\u4barsvc.exe
  PRC - [2011/03/23 16:39:59 | 000,027,648 | ---- | M] (Guffins) -- C:\Program Files\Guffins\bar\2.bin\u4brmon.exe
  SRV - File not found [Auto | Stopped] -- -- (RoxLiveShare9)
  SRV - File not found [Auto | Stopped] -- -- (0286771307566251mcinstcleanup) McAfee Application Installer Cleanup (0286771307566251)
  SRV - [2011/07/10 10:07:38 | 000,042,504 | ---- | M] (COMPANYVERS_NAME) [Auto | Running] -- C:\Program Files\Zwinky_42\bar\1.bin\42barsvc.exe -- (Zwinky_42Service)
  SRV - [2011/06/19 12:31:27 | 000,761,344 | ---- | M] (CrypKey Inc.) [Auto | Running] -- C:\Windows\System32\dplayx32.exe -- (WPFFontCache_v040032)
  SRV - [2011/03/23 16:39:59 | 000,036,864 | ---- | M] (Guffins) [Auto | Running] -- C:\Program Files\Guffins\bar\2.bin\u4barsvc.exe -- (GuffinsService)
  IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://home.mywebsea...83-DAAB9C8425C9
  IE - HKCU\..\URLSearchHook: {4e320bc8-c23b-4de3-9c38-ba0ae622579f} - Reg Error: Key error. File not found
  IE - HKCU\..\URLSearchHook: {c3d3840c-12ea-4461-a61d-190555fecc82} - C:\Program Files\Guffins\bar\2.bin\u4SrcAs.dll (Guffins)
  IE - HKCU\..\URLSearchHook: {f92a9fe4-2850-4198-b9d5-279880e49b16} - Reg Error: Key error. File not found
  IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 1
  FF - prefs.js..extensions.enabledItems: [email protected]:1.2
  FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}:6.0.22
  FF - HKLM\Software\MozillaPlugins\@Guffins.com/Plugin: C:\Program Files\Guffins\bar\2.bin\NPu4Stub.dll (Guffins)
  FF - HKLM\Software\MozillaPlugins\@Zwinky_42.com/Plugin: C:\Program Files\Zwinky_42\bar\1.bin\NP42Stub.dll (MindSpark)
  [2011/07/27 08:21:20 | 000,000,000 | ---D | M] (XUL Cache) -- C:\Users\robert\AppData\Roaming\mozilla\Firefox\Profiles\95z9sp1d.default\extensions\{84dfe0dd-b582-4795-9334-45d5e4cbc4b6}
  [2011/06/29 08:59:30 | 000,000,000 | ---D | M] (XUL Cache) -- C:\Users\robert\AppData\Roaming\mozilla\Firefox\Profiles\95z9sp1d.default\extensions\{ed722164-ba13-4b88-9fa7-34638b4e87fa}
  [2011/02/27 11:00:51 | 000,009,980 | -H-- | M] () -- C:\Users\robert\AppData\Roaming\Mozilla\Firefox\Profiles\95z9sp1d.default\searchplugins\Guffins.xml
  [2010/11/26 19:57:26 | 000,000,743 | -H-- | M] () -- C:\Users\robert\AppData\Roaming\Mozilla\Firefox\Profiles\95z9sp1d.default\searchplugins\search-defender.xml
  [2011/07/10 17:40:53 | 000,009,946 | ---- | M] () -- C:\Users\robert\AppData\Roaming\Mozilla\Firefox\Profiles\95z9sp1d.default\searchplugins\Zwinky_42.xml
  [2011/03/23 16:40:04 | 000,000,000 | ---D | M] (Guffins) -- C:\PROGRAM FILES\GUFFINS\BAR\2.BIN
  [2011/07/10 10:07:46 | 000,000,000 | ---D | M] (Zwinky) -- C:\PROGRAM FILES\ZWINKY_42\BAR\1.BIN
  O2 - BHO: (no name) - {0130ABF6-7A24-4045-819D-2A46D376F7Ce} - C:\Windows\System32\ati2edxx32.dll ()
  O2 - BHO: (Toolbar BHO) - {24a07957-9b8c-4821-a614-e127ac763d9c} - C:\Program Files\Zwinky_42\bar\1.bin\42bar.dll (MindSpark)
  O2 - BHO: (Search Assistant BHO) - {3849dae8-4add-4c86-9e37-3ed93676ebc5} - C:\Program Files\Zwinky_42\bar\1.bin\42SrcAs.dll (COMPANYVERS_NAME)
  O2 - BHO: (4029b9e1) - {4E306816-857E-F71D-7218-53CDD39447F9} - C:\ProgramData\ati2edxx32.dll ()
  O2 - BHO: (Window Shopper) - {74F475FA-6C75-43BD-AAB9-ECDA6184F600} - File not found
  O2 - BHO: (no name) - {E4E6BF2A-1667-11DF-A01F-1F9655D89593} - No CLSID value found.
  O3 - HKLM\..\Toolbar: (no name) - {0C8413C1-FAD1-446C-8584-BE50576F863E} - No CLSID value found.
  O3 - HKLM\..\Toolbar: (Zwinky Toolbar) - {1df01b27-e0d6-40d5-a8ce-0d926d6f39f3} - C:\Program Files\Zwinky_42\bar\1.bin\42bar.dll (MindSpark)
  O3 - HKLM\..\Toolbar: (Guffins) - {de2fdf7c-2637-4ba3-b427-3fce2d331db5} - C:\Program Files\Guffins\bar\2.bin\u4bar.dll (Guffins)
  O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {0C8413C1-FAD1-446C-8584-BE50576F863E} - No CLSID value found.
  O3 - HKCU\..\Toolbar\WebBrowser: (Zwinky Toolbar) - {1DF01B27-E0D6-40D5-A8CE-0D926D6F39F3} - C:\Program Files\Zwinky_42\bar\1.bin\42bar.dll (MindSpark)
  O3 - HKCU\..\Toolbar\WebBrowser: (Guffins) - {DE2FDF7C-2637-4BA3-B427-3FCE2D331DB5} - C:\Program Files\Guffins\bar\2.bin\u4bar.dll (Guffins)
  O4 - HKLM..\Run: [CyberDefender Registry Cleaner] File not found
  O4 - HKLM..\Run: [Guffins Browser Plugin Loader] C:\Program Files\Guffins\bar\2.bin\u4brmon.exe (Guffins)
  O4 - HKLM..\Run: [Zwinky_42 Browser Plugin Loader] C:\Program Files\Zwinky_42\bar\1.bin\42brmon.exe (VER_COMPANY_NAME)
  O4 - HKCU..\Run: [811264436] C:\Users\robert\AppData\Local\Temp\tmph1189877229015082782.tmp (Crane Dusky Rafts Bozo)
  O4 - HKCU..\Run: [ares] File not found
  O4 - HKCU..\Run: [DW6] File not found
  O4 - HKCU..\Run: [Malware Protection] File not found
  O4 - HKCU..\Run: [msav] File not found
  O4 - HKCU..\Run: [Svc2dll] File not found
  O9 - Extra Button: Window Shopper - {A69A551A-1AAE-4B67-8C2E-52F8B8A19504} - File not found
  O15 - HKCU\..Trusted Domains: real.com ([rhap-app-4-0] https in Trusted sites)
  O15 - HKCU\..Trusted Domains: real.com ([rhapreg] https in Trusted sites)
  O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_22)
  O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.ma...t/ultrashim.cab (Reg Error: Key error.)
  O16 - DPF: {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_05)
  O16 - DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_22)
  O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_22)
  O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.ad...Plus/1.6/gp.cab (Reg Error: Key error.)
  O20 - AppInit_DLLs: (C:\ProgramData\ati2edxx32.dll) - C:\ProgramData\ati2edxx32.dll ()
  O33 - MountPoints2\{843a975c-2313-11e0-9d2e-001a66ab16c1}\Shell - "" = AutoRun
  O33 - MountPoints2\{843a975c-2313-11e0-9d2e-001a66ab16c1}\Shell\AutoRun\command - "" = J:\PhotoRun.exe
  O33 - MountPoints2\{f971412a-a55b-11df-963a-001a66ab16c1}\Shell\AutoRun\command - "" = J:\Setup_FlipShare.exe
  O33 - MountPoints2\{f971412a-a55b-11df-963a-001a66ab16c1}\Shell\Setup FlipShare\command - "" = J:\Setup_FlipShare.exe
  [2011/07/10 10:07:38 | 000,000,000 | ---D | C] -- C:\Program Files\Zwinky_42
  [2011/07/09 23:55:40 | 000,000,000 | ---D | C] -- C:\Program Files\Zwinky_42EI
  [1 C:\Users\robert\Desktop\*.tmp files -> C:\Users\robert\Desktop\*.tmp -> ]
  [2011/07/27 08:26:45 | 000,000,142 | ---- | M] () -- C:\ProgramData\60daeeb3
  [2011/07/23 13:21:16 | 000,356,864 | ---- | M] () -- C:\Windows\System32\ati2edxx32.dll
  [2011/07/15 03:22:37 | 000,172,032 | ---- | M] () -- C:\ProgramData\ati2edxx32.dll
  [2011/07/15 03:22:37 | 000,000,095 | ---- | M] () -- C:\Windows\System32\1257569987
  [2011/07/11 21:05:34 | 000,025,143 | ---- | M] () -- C:\Users\robert\AppData\Roaming\762E.185
  [2011/07/10 10:07:23 | 000,210,976 | ---- | M] () -- C:\Users\robert\Desktop\Zwinky.exe
  [2011/07/01 01:53:45 | 000,010,576 | -HS- | M] () -- C:\Users\robert\AppData\Local\caxgied5y78r866jn7by1
  [2011/07/01 01:53:45 | 000,010,576 | -HS- | M] () -- C:\ProgramData\caxgied5y78r866jn7by1
  [2011/07/23 13:21:16 | 000,356,864 | ---- | C] () -- C:\Windows\System32\ati2edxx32.dll
  [2011/07/15 03:22:37 | 000,172,032 | ---- | C] () -- C:\ProgramData\ati2edxx32.dll
  [2011/07/09 23:55:34 | 000,210,976 | ---- | C] () -- C:\Users\robert\Desktop\Zwinky.exe
  [2011/07/02 12:22:31 | 000,025,143 | ---- | C] () -- C:\Users\robert\AppData\Roaming\762E.185
  [2011/06/29 12:30:45 | 000,010,576 | -HS- | C] () -- C:\Users\robert\AppData\Local\caxgied5y78r866jn7by1
  [2011/06/29 12:30:45 | 000,010,576 | -HS- | C] () -- C:\ProgramData\caxgied5y78r866jn7by1
  [2011/04/17 14:14:38 | 000,000,157 | -H-- | C] () -- C:\Users\robert\AppData\Local\svc2dll.dat
  [2011/04/17 14:14:35 | 000,118,272 | ---- | C] () -- C:\Users\robert\AppData\Local\svc2dll.exe.old
  [2011/04/02 08:29:54 | 000,010,282 | -HS- | C] () -- C:\Users\robert\AppData\Local\jcl665ep0rnlp562hps
  [2010/09/06 10:47:16 | 000,870,128 | -H-- | C] () -- C:\Users\robert\AppData\Roaming\mcs.rma
  [2010/09/06 10:47:16 | 000,000,004 | -H-- | C] () -- C:\Users\robert\AppData\Roaming\E67770
  @Alternate Data Stream - 95 bytes -> C:\ProgramData\TEMP:5C321E34
  @Alternate Data Stream - 820 bytes -> C:\Users\robert\Documents\Welcome to Windows Mail.eml:OECustomProperty
  @Alternate Data Stream - 143 bytes -> C:\ProgramData\TEMP:DB2BB17F
  @Alternate Data Stream - 122 bytes -> C:\ProgramData\TEMP:A8ADE5D8
  @Alternate Data Stream - 121 bytes -> C:\ProgramData\TEMP:DFC5A2B2
  @Alternate Data Stream - 114 bytes -> C:\ProgramData\TEMP:1502A995
  @Alternate Data Stream - 113 bytes -> C:\ProgramData\TEMP:C2B2C9C1
  @Alternate Data Stream - 105 bytes -> C:\ProgramData\TEMP:430C6D84
  
  :Reg
  :Files
  c:\program files\Guffins
  echo,Y|cacls "%WinDir%\system32\drivers\etc\hosts" /G everyone:f /c
  ipconfig /flushdns /c
  :Commands
  [purity]
  [resethosts]
  [CreateRestorePoint]
  [emptytemp]
  [EMPTYFLASH]
  

• Push
• OTL may ask to reboot the machine. Please do so if asked.
• Click the OK button.
• A report will open. Copy and Paste that report in your next reply.
• If the machine reboots, the log will be located at C:\_OTL\MovedFiles\mmddyyyy_hhmmss.log, where mmddyyyy_hhmmss is the date of the tool run.

NEXT:



Scanning with GMER

Before scanning, make sure all other running programs are closed and no other actions like a scheduled antivirus scan will occur while the scan is being performed. Do not use your computer for anything else during the scan.

Download GMER Rootkit Scanner from here or here.

• Extract the contents of the zipped file to desktop.
• Double click GMER.exe. If asked to allow gmer.sys driver to load, please consent .
• If it gives you a warning about rootkit activity and asks if you want to run scan...click on NO.
  
  
  Click the image to enlarge it
  
• In the right panel, you will see several boxes that have been checked. Uncheck the following ...
  • IAT/EAT
  • Drives/Partition other than Systemdrive (typically C:\)
  • Show All (don't miss this one)
• Then click the Scan button & wait for it to finish.
• Once done click on the [Save..] button, and in the File name area, type in "Gmer.txt" or it will save as a .log file which cannot be uploaded to your post.
  
• Save it where you can easily find it, such as your desktop, and attach it in your reply.

Notes:
**Caution**
Rootkit scans often produce false positives. Do NOT take any action on any "<--- ROOKIT" entries

-- If you encounter any problems, try running GMER in safe mode.
-- If GMER crashes or keeps resulting in a BSODs, uncheck Devices on the right side before scanning.



NEXT:



What issues are you currently experiencing with your computer

[SweetTech]

Hello and welcome to the forums!

My secret agent name on the forums is SweetTech (you can call me ST for short), it's a pleasure to meet you.

I would be glad to take a look at your log and help you with solving any malware problems.

If you have since resolved the issues you were originally experiencing, or have received help elsewhere, please inform me so that this topic can be closed.

If you have not, please adhere to the guidelines below and then follow instructions as outlined further below:

• Logs from malware removal programs (OTL is one of them) can take some time to analyze. I need you to be patient while I analyze any logs you post. Please remember, I am a volunteer, and I do have a life outside of these forums.
  
• Please make sure to carefully read any instruction that I give you. Attention to detail is important! Since I cannot see or directly interact with your computer I am dependent on you to "be my eyes" and provide as much information as you can regarding the current state of your computer.
  
• If you're not sure, or if something unexpected happens, do NOT continue! Stop and ask!
  
• If I instruct you to download a specific tool in which you already have, please delete the copy that you have and re-download the tool. The reason I ask you to do this is because these tools are updated fairly regularly.
  
• Do not do things I do not ask for, such as running a spyware scan on your computer. The one thing that you should always do, is to make sure sure that your anti-virus definitions are up-to-date!
  
• Please do not use the Attachment feature for any log file. Do a Copy/Paste of the entire contents of the log file and submit it inside your post.
  
• I am going to stick with you until ALL malware is gone from your system. I would appreciate it if you would do the same. From this point, we're in this together
  Because of this, you must reply within three days failure to reply will result in the topic being closed!
  
• Lastly, I am no magician. I will try very hard to fix your issues, but no promises can be made. Also be aware that some infections are so severe that you might need to resort to reformatting and reinstalling your operating system.
  Don't worry, this only happens in severe cases, but it sadly does happen. Be prepared to back up your data. Have means of backing up your data available.

____________________________________________________

Please post the Extras.txt log for me to review.

GooredFix
Please download GooredFix from one of the locations below and save it to your Desktop
Download Mirror #1

• Ensure all Firefox windows are closed.
• To run the tool, double-click it (XP), or right-click and select Run As Administrator (Vista).
• When prompted to run the scan, click Yes.
• GooredFix will check for infections, and then a log will appear. Please post the contents of that log in your next reply (it can also be found on your desktop, called GooredFix.txt).

NEXT:



OTL Fix

We need to run an OTL Fix

• Please reopen on your desktop.
• Copy and Paste the following code into the textbox.
  

  :Services
  :Processes
  KILLALLPROCESSES
  :OTL
  PRC - [2011/07/10 10:07:38 | 000,042,504 | ---- | M] (COMPANYVERS_NAME) -- C:\Program Files\Zwinky_42\bar\1.bin\42barsvc.exe
  PRC - [2011/07/10 10:07:38 | 000,030,096 | ---- | M] (VER_COMPANY_NAME) -- C:\Program Files\Zwinky_42\bar\1.bin\42brmon.exe
  PRC - [2011/07/10 10:07:38 | 000,022,048 | ---- | M] (MindSpark) -- C:\Program Files\Zwinky_42\bar\1.bin\42medint.exe
  PRC - [2011/06/19 12:31:27 | 000,761,344 | ---- | M] (CrypKey Inc.) -- C:\ProgramData\gcdef32.exe
  PRC - [2011/06/19 12:31:27 | 000,761,344 | ---- | M] (CrypKey Inc.) -- C:\Windows\System32\dplayx32.exe
  PRC - [2011/03/23 16:40:00 | 000,028,672 | ---- | M] (Guffins) -- C:\Program Files\Guffins\bar\2.bin\u4medint.exe
  PRC - [2011/03/23 16:39:59 | 000,036,864 | ---- | M] (Guffins) -- C:\Program Files\Guffins\bar\2.bin\u4barsvc.exe
  PRC - [2011/03/23 16:39:59 | 000,027,648 | ---- | M] (Guffins) -- C:\Program Files\Guffins\bar\2.bin\u4brmon.exe
  SRV - File not found [Auto | Stopped] -- -- (RoxLiveShare9)
  SRV - File not found [Auto | Stopped] -- -- (0286771307566251mcinstcleanup) McAfee Application Installer Cleanup (0286771307566251)
  SRV - [2011/07/10 10:07:38 | 000,042,504 | ---- | M] (COMPANYVERS_NAME) [Auto | Running] -- C:\Program Files\Zwinky_42\bar\1.bin\42barsvc.exe -- (Zwinky_42Service)
  SRV - [2011/06/19 12:31:27 | 000,761,344 | ---- | M] (CrypKey Inc.) [Auto | Running] -- C:\Windows\System32\dplayx32.exe -- (WPFFontCache_v040032)
  SRV - [2011/03/23 16:39:59 | 000,036,864 | ---- | M] (Guffins) [Auto | Running] -- C:\Program Files\Guffins\bar\2.bin\u4barsvc.exe -- (GuffinsService)
  IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://home.mywebsea...83-DAAB9C8425C9
  IE - HKCU\..\URLSearchHook: {4e320bc8-c23b-4de3-9c38-ba0ae622579f} - Reg Error: Key error. File not found
  IE - HKCU\..\URLSearchHook: {c3d3840c-12ea-4461-a61d-190555fecc82} - C:\Program Files\Guffins\bar\2.bin\u4SrcAs.dll (Guffins)
  IE - HKCU\..\URLSearchHook: {f92a9fe4-2850-4198-b9d5-279880e49b16} - Reg Error: Key error. File not found
  IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 1
  FF - prefs.js..extensions.enabledItems: [email protected]:1.2
  FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}:6.0.22
  FF - HKLM\Software\MozillaPlugins\@Guffins.com/Plugin: C:\Program Files\Guffins\bar\2.bin\NPu4Stub.dll (Guffins)
  FF - HKLM\Software\MozillaPlugins\@Zwinky_42.com/Plugin: C:\Program Files\Zwinky_42\bar\1.bin\NP42Stub.dll (MindSpark)
  [2011/07/27 08:21:20 | 000,000,000 | ---D | M] (XUL Cache) -- C:\Users\robert\AppData\Roaming\mozilla\Firefox\Profiles\95z9sp1d.default\extensions\{84dfe0dd-b582-4795-9334-45d5e4cbc4b6}
  [2011/06/29 08:59:30 | 000,000,000 | ---D | M] (XUL Cache) -- C:\Users\robert\AppData\Roaming\mozilla\Firefox\Profiles\95z9sp1d.default\extensions\{ed722164-ba13-4b88-9fa7-34638b4e87fa}
  [2011/02/27 11:00:51 | 000,009,980 | -H-- | M] () -- C:\Users\robert\AppData\Roaming\Mozilla\Firefox\Profiles\95z9sp1d.default\searchplugins\Guffins.xml
  [2010/11/26 19:57:26 | 000,000,743 | -H-- | M] () -- C:\Users\robert\AppData\Roaming\Mozilla\Firefox\Profiles\95z9sp1d.default\searchplugins\search-defender.xml
  [2011/07/10 17:40:53 | 000,009,946 | ---- | M] () -- C:\Users\robert\AppData\Roaming\Mozilla\Firefox\Profiles\95z9sp1d.default\searchplugins\Zwinky_42.xml
  [2011/03/23 16:40:04 | 000,000,000 | ---D | M] (Guffins) -- C:\PROGRAM FILES\GUFFINS\BAR\2.BIN
  [2011/07/10 10:07:46 | 000,000,000 | ---D | M] (Zwinky) -- C:\PROGRAM FILES\ZWINKY_42\BAR\1.BIN
  O2 - BHO: (no name) - {0130ABF6-7A24-4045-819D-2A46D376F7Ce} - C:\Windows\System32\ati2edxx32.dll ()
  O2 - BHO: (Toolbar BHO) - {24a07957-9b8c-4821-a614-e127ac763d9c} - C:\Program Files\Zwinky_42\bar\1.bin\42bar.dll (MindSpark)
  O2 - BHO: (Search Assistant BHO) - {3849dae8-4add-4c86-9e37-3ed93676ebc5} - C:\Program Files\Zwinky_42\bar\1.bin\42SrcAs.dll (COMPANYVERS_NAME)
  O2 - BHO: (4029b9e1) - {4E306816-857E-F71D-7218-53CDD39447F9} - C:\ProgramData\ati2edxx32.dll ()
  O2 - BHO: (Window Shopper) - {74F475FA-6C75-43BD-AAB9-ECDA6184F600} - File not found
  O2 - BHO: (no name) - {E4E6BF2A-1667-11DF-A01F-1F9655D89593} - No CLSID value found.
  O3 - HKLM\..\Toolbar: (no name) - {0C8413C1-FAD1-446C-8584-BE50576F863E} - No CLSID value found.
  O3 - HKLM\..\Toolbar: (Zwinky Toolbar) - {1df01b27-e0d6-40d5-a8ce-0d926d6f39f3} - C:\Program Files\Zwinky_42\bar\1.bin\42bar.dll (MindSpark)
  O3 - HKLM\..\Toolbar: (Guffins) - {de2fdf7c-2637-4ba3-b427-3fce2d331db5} - C:\Program Files\Guffins\bar\2.bin\u4bar.dll (Guffins)
  O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {0C8413C1-FAD1-446C-8584-BE50576F863E} - No CLSID value found.
  O3 - HKCU\..\Toolbar\WebBrowser: (Zwinky Toolbar) - {1DF01B27-E0D6-40D5-A8CE-0D926D6F39F3} - C:\Program Files\Zwinky_42\bar\1.bin\42bar.dll (MindSpark)
  O3 - HKCU\..\Toolbar\WebBrowser: (Guffins) - {DE2FDF7C-2637-4BA3-B427-3FCE2D331DB5} - C:\Program Files\Guffins\bar\2.bin\u4bar.dll (Guffins)
  O4 - HKLM..\Run: [CyberDefender Registry Cleaner] File not found
  O4 - HKLM..\Run: [Guffins Browser Plugin Loader] C:\Program Files\Guffins\bar\2.bin\u4brmon.exe (Guffins)
  O4 - HKLM..\Run: [Zwinky_42 Browser Plugin Loader] C:\Program Files\Zwinky_42\bar\1.bin\42brmon.exe (VER_COMPANY_NAME)
  O4 - HKCU..\Run: [811264436] C:\Users\robert\AppData\Local\Temp\tmph1189877229015082782.tmp (Crane Dusky Rafts Bozo)
  O4 - HKCU..\Run: [ares] File not found
  O4 - HKCU..\Run: [DW6] File not found
  O4 - HKCU..\Run: [Malware Protection] File not found
  O4 - HKCU..\Run: [msav] File not found
  O4 - HKCU..\Run: [Svc2dll] File not found
  O9 - Extra Button: Window Shopper - {A69A551A-1AAE-4B67-8C2E-52F8B8A19504} - File not found
  O15 - HKCU\..Trusted Domains: real.com ([rhap-app-4-0] https in Trusted sites)
  O15 - HKCU\..Trusted Domains: real.com ([rhapreg] https in Trusted sites)
  O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_22)
  O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.ma...t/ultrashim.cab (Reg Error: Key error.)
  O16 - DPF: {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_05)
  O16 - DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_22)
  O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_22)
  O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.ad...Plus/1.6/gp.cab (Reg Error: Key error.)
  O20 - AppInit_DLLs: (C:\ProgramData\ati2edxx32.dll) - C:\ProgramData\ati2edxx32.dll ()
  O33 - MountPoints2\{843a975c-2313-11e0-9d2e-001a66ab16c1}\Shell - "" = AutoRun
  O33 - MountPoints2\{843a975c-2313-11e0-9d2e-001a66ab16c1}\Shell\AutoRun\command - "" = J:\PhotoRun.exe
  O33 - MountPoints2\{f971412a-a55b-11df-963a-001a66ab16c1}\Shell\AutoRun\command - "" = J:\Setup_FlipShare.exe
  O33 - MountPoints2\{f971412a-a55b-11df-963a-001a66ab16c1}\Shell\Setup FlipShare\command - "" = J:\Setup_FlipShare.exe
  [2011/07/10 10:07:38 | 000,000,000 | ---D | C] -- C:\Program Files\Zwinky_42
  [2011/07/09 23:55:40 | 000,000,000 | ---D | C] -- C:\Program Files\Zwinky_42EI
  [1 C:\Users\robert\Desktop\*.tmp files -> C:\Users\robert\Desktop\*.tmp -> ]
  [2011/07/27 08:26:45 | 000,000,142 | ---- | M] () -- C:\ProgramData\60daeeb3
  [2011/07/23 13:21:16 | 000,356,864 | ---- | M] () -- C:\Windows\System32\ati2edxx32.dll
  [2011/07/15 03:22:37 | 000,172,032 | ---- | M] () -- C:\ProgramData\ati2edxx32.dll
  [2011/07/15 03:22:37 | 000,000,095 | ---- | M] () -- C:\Windows\System32\1257569987
  [2011/07/11 21:05:34 | 000,025,143 | ---- | M] () -- C:\Users\robert\AppData\Roaming\762E.185
  [2011/07/10 10:07:23 | 000,210,976 | ---- | M] () -- C:\Users\robert\Desktop\Zwinky.exe
  [2011/07/01 01:53:45 | 000,010,576 | -HS- | M] () -- C:\Users\robert\AppData\Local\caxgied5y78r866jn7by1
  [2011/07/01 01:53:45 | 000,010,576 | -HS- | M] () -- C:\ProgramData\caxgied5y78r866jn7by1
  [2011/07/23 13:21:16 | 000,356,864 | ---- | C] () -- C:\Windows\System32\ati2edxx32.dll
  [2011/07/15 03:22:37 | 000,172,032 | ---- | C] () -- C:\ProgramData\ati2edxx32.dll
  [2011/07/09 23:55:34 | 000,210,976 | ---- | C] () -- C:\Users\robert\Desktop\Zwinky.exe
  [2011/07/02 12:22:31 | 000,025,143 | ---- | C] () -- C:\Users\robert\AppData\Roaming\762E.185
  [2011/06/29 12:30:45 | 000,010,576 | -HS- | C] () -- C:\Users\robert\AppData\Local\caxgied5y78r866jn7by1
  [2011/06/29 12:30:45 | 000,010,576 | -HS- | C] () -- C:\ProgramData\caxgied5y78r866jn7by1
  [2011/04/17 14:14:38 | 000,000,157 | -H-- | C] () -- C:\Users\robert\AppData\Local\svc2dll.dat
  [2011/04/17 14:14:35 | 000,118,272 | ---- | C] () -- C:\Users\robert\AppData\Local\svc2dll.exe.old
  [2011/04/02 08:29:54 | 000,010,282 | -HS- | C] () -- C:\Users\robert\AppData\Local\jcl665ep0rnlp562hps
  [2010/09/06 10:47:16 | 000,870,128 | -H-- | C] () -- C:\Users\robert\AppData\Roaming\mcs.rma
  [2010/09/06 10:47:16 | 000,000,004 | -H-- | C] () -- C:\Users\robert\AppData\Roaming\E67770
  @Alternate Data Stream - 95 bytes -> C:\ProgramData\TEMP:5C321E34
  @Alternate Data Stream - 820 bytes -> C:\Users\robert\Documents\Welcome to Windows Mail.eml:OECustomProperty
  @Alternate Data Stream - 143 bytes -> C:\ProgramData\TEMP:DB2BB17F
  @Alternate Data Stream - 122 bytes -> C:\ProgramData\TEMP:A8ADE5D8
  @Alternate Data Stream - 121 bytes -> C:\ProgramData\TEMP:DFC5A2B2
  @Alternate Data Stream - 114 bytes -> C:\ProgramData\TEMP:1502A995
  @Alternate Data Stream - 113 bytes -> C:\ProgramData\TEMP:C2B2C9C1
  @Alternate Data Stream - 105 bytes -> C:\ProgramData\TEMP:430C6D84
  
  :Reg
  :Files
  c:\program files\Guffins
  echo,Y|cacls "%WinDir%\system32\drivers\etc\hosts" /G everyone:f /c
  ipconfig /flushdns /c
  :Commands
  [purity]
  [resethosts]
  [CreateRestorePoint]
  [emptytemp]
  [EMPTYFLASH]
  

• Push
• OTL may ask to reboot the machine. Please do so if asked.
• Click the OK button.
• A report will open. Copy and Paste that report in your next reply.
• If the machine reboots, the log will be located at C:\_OTL\MovedFiles\mmddyyyy_hhmmss.log, where mmddyyyy_hhmmss is the date of the tool run.

NEXT:



Scanning with GMER

Before scanning, make sure all other running programs are closed and no other actions like a scheduled antivirus scan will occur while the scan is being performed. Do not use your computer for anything else during the scan.

Download GMER Rootkit Scanner from here or here.

• Extract the contents of the zipped file to desktop.
• Double click GMER.exe. If asked to allow gmer.sys driver to load, please consent .
• If it gives you a warning about rootkit activity and asks if you want to run scan...click on NO.
  
  
  Click the image to enlarge it
  
• In the right panel, you will see several boxes that have been checked. Uncheck the following ...
  • IAT/EAT
  • Drives/Partition other than Systemdrive (typically C:\)
  • Show All (don't miss this one)
• Then click the Scan button & wait for it to finish.
• Once done click on the [Save..] button, and in the File name area, type in "Gmer.txt" or it will save as a .log file which cannot be uploaded to your post.
  
• Save it where you can easily find it, such as your desktop, and attach it in your reply.

Notes:
**Caution**
Rootkit scans often produce false positives. Do NOT take any action on any "<--- ROOKIT" entries

-- If you encounter any problems, try running GMER in safe mode.
-- If GMER crashes or keeps resulting in a BSODs, uncheck Devices on the right side before scanning.



NEXT:



What issues are you currently experiencing with your computer

[Nstory]

Hello ST, thank you for assisting me. I tried downloading GooredFix, but it didn't work. All the icons on the desktop were gone to begin with, but I also can't get it to save on the desktop either. I will be purchasing a flash drive and using that to download, will that be ok?

[SweetTech]

Hi!

Actually hold up!

We will want to run a special tool first to unhide your icons.

Lets see if you're able to download and run UnHide.exe by Grinler.

It will unhide folders/files that were set to be hidden by the infection you had.



NEXT:



Please post back letting me know if you were able to run UnHide.

[Nstory]

Hello again ST, sorry for the late response...

I was able to download and run the Unhide tool, but the icons did not appear. I'm able to find the items on the desktop going through My Computer. Also, during the middle of the OTL scan, an error message popped up that said it had encountered a problem and needed to shut down. Should I try again?

Extras.Txt
OTL Extras logfile created on: 7/27/2011 8:46:02 AM - Run 1
OTL by OldTimer - Version 3.2.26.1 Folder = C:\Users\robert\Desktop
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.19088)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

2.00 Gb Total Physical Memory | 1.21 Gb Available Physical Memory | 60.38% Memory free
4.24 Gb Paging File | 2.96 Gb Available in Paging File | 69.74% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 138.95 Gb Total Space | 56.33 Gb Free Space | 40.54% Space Free | Partition Type: NTFS
Drive D: | 10.00 Gb Total Space | 5.61 Gb Free Space | 56.08% Space Free | Partition Type: NTFS

Computer Name: ROBERT-PC | User Name: robert | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========


========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\System32\control.exe (Microsoft Corporation)
.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)
.html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)

[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = ChromeHTML] -- Reg Error: Key error. File not found

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
htmlfile [edit] -- Reg Error: Key error.
http [open] -- "C:\Program Files\Mozilla Firefox\firefox.exe" -requestPending -osint -url "%1" (Mozilla Corporation)
https [open] -- "C:\Program Files\Mozilla Firefox\firefox.exe" -requestPending -osint -url "%1" (Mozilla Corporation)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusOverride" = 1
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
"VistaSp1" = Reg Error: Unknown registry data type -- File not found
"VistaSp2" = Reg Error: Unknown registry data type -- File not found

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\S-1-5-21-695326800-797908242-393843667-1000]
"EnableNotificationsRef" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0

========== Authorized Applications List ==========


========== Vista Active Open Ports Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{2DA02863-563F-4E0E-B4D2-571E5B2BBE70}" = lport=3702 | protocol=17 | dir=in | svc=fdrespub | app=%systemroot%\system32\svchost.exe |
"{31E39E14-92B4-445F-9E77-2D4E1E1CB05C}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{4D473B4B-5637-49DB-8021-DB0A9D4E9CF1}" = rport=3702 | protocol=17 | dir=out | svc=fdrespub | app=%systemroot%\system32\svchost.exe |
"{9DBCEFFC-E0F7-4183-A4BD-55E2CA9A638D}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{CCA852BC-F882-483B-A07D-5852B128B0BD}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{E68641FA-1CF8-4482-81DC-4692C12FE91D}" = rport=3702 | protocol=17 | dir=out | svc=fdphost | app=%systemroot%\system32\svchost.exe |
"{EA088081-13AD-4090-BA18-33829D3051B6}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{FDA4D954-5FEA-4F0B-AC45-2DF047090D79}" = lport=3702 | protocol=17 | dir=in | svc=fdphost | app=%systemroot%\system32\svchost.exe |

========== Vista Active Application Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{0BCE6CF7-31BA-4C19-8CDD-63F169CFFAA2}" = dir=in | app=c:\program files\common files\mcafee\mna\mcnasvc.exe |
"{19936838-D427-40BD-B0E5-D982CD943610}" = protocol=17 | dir=in | app=c:\program files\veoh networks\veohwebplayer\veohwebplayer.exe |
"{1F5DC97B-BB2D-40AA-BD4A-6A5282C77325}" = protocol=17 | dir=in | app=c:\program files\itunes\itunes.exe |
"{28504E43-D04A-4D73-AB29-AF9D08A3AD6E}" = protocol=6 | dir=in | app=c:\program files\veoh networks\veohwebplayer\veohwebplayer.exe |
"{3D56A90D-B68A-4F74-8815-5E97E02CD416}" = protocol=17 | dir=in | app=c:\program files\bearshare applications\bearshare\bearshare.exe |
"{4FA3E202-CB1A-4260-9388-28594F78A911}" = protocol=6 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{655E8E22-BE21-4B02-8906-060921C07F14}" = protocol=17 | dir=in | app=c:\program files\frostwire\frostwire.exe |
"{694D3B63-C79A-40FD-84C9-6E944D532874}" = protocol=17 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{6A61BD85-87C9-485D-8322-66298C3B628C}" = protocol=6 | dir=in | app=c:\program files\bearshare applications\bearshare\bearshare.exe |
"{74B64D9B-D0D2-4B98-8CC8-EDB233A845F4}" = protocol=17 | dir=in | app=c:\program files\itunes\itunes.exe |
"{7D13FF79-0351-4A18-B7F5-C336C9538488}" = dir=in | app=c:\windows\system32\dplayx32.exe |
"{845BC6F1-4248-4D32-BABC-292870B4E13C}" = dir=in | app=c:\windows\system32\dplayx32.exe |
"{9A49B860-04B2-43E7-A89C-63C7134549F6}" = protocol=6 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{9C772D1A-FD5F-4547-91C8-9089DE804011}" = protocol=6 | dir=in | app=c:\program files\frostwire\frostwire.exe |
"{A873FB20-160F-4B7B-BFFE-3D4184130A03}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe |
"{B4D9A51F-77F2-46A1-B33B-92FE50C4A121}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{B77A421C-C3EF-4F9B-BC06-C519DC3D5335}" = protocol=6 | dir=in | app=c:\program files\itunes\itunes.exe |
"{C8C0D1F2-4A12-42E0-9E98-F9DC02ED6986}" = protocol=17 | dir=in | app=c:\program files\limewire\limewire.exe |
"{CA90A67D-67AE-47F3-9251-C29CFC83D182}" = protocol=17 | dir=in | app=c:\program files\bearshare applications\bearshare\bearshare.exe |
"{CF7295D1-05EC-4438-BFE6-7513F6CD6153}" = protocol=17 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{D1E1BB4A-28A2-4081-AE7C-BC1B6F13422E}" = dir=in | app=c:\windows\system32\dplayx32.exe |
"{DE9D0133-B678-473A-AF64-58B2F5A0072A}" = protocol=6 | dir=in | app=c:\program files\limewire\limewire.exe |
"{E01176D2-C0FB-479D-90F9-AA6738AAD230}" = protocol=6 | dir=in | app=c:\program files\bearshare applications\bearshare\bearshare.exe |
"{F221949A-4A7F-4B63-AFB2-00D5782C1520}" = protocol=6 | dir=in | app=c:\program files\itunes\itunes.exe |
"TCP Query User{0953E54D-49F8-493A-8CCD-21725831F135}C:\program files\bearshare applications\bearshare\bearshare.exe" = protocol=6 | dir=in | app=c:\program files\bearshare applications\bearshare\bearshare.exe |
"TCP Query User{280ED61D-AAD4-4FB9-8D9B-2CBC44365C42}C:\program files\limewire\limewire.exe" = protocol=6 | dir=in | app=c:\program files\limewire\limewire.exe |
"TCP Query User{45C1125B-94F9-4DF2-85D6-BFF7F7A75BBF}C:\users\robert\appdata\local\temp\17396.exe" = protocol=6 | dir=in | app=c:\users\robert\appdata\local\temp\17396.exe |
"TCP Query User{6F3C4051-A185-4EEA-BE81-55A2DB1CA804}C:\program files\ares\ares.exe" = protocol=6 | dir=in | app=c:\program files\ares\ares.exe |
"TCP Query User{8B203962-133A-425E-9039-1A9AA4D5452A}C:\users\robert\appdata\roaming\imvuclient\1vivoxvoice.exe" = protocol=6 | dir=in | app=c:\users\robert\appdata\roaming\imvuclient\1vivoxvoice.exe |
"TCP Query User{D93FB9E0-9223-427F-9BBF-814B6FC28F8A}C:\users\robert\appdata\local\svc2dll.exe" = protocol=6 | dir=in | app=c:\users\robert\appdata\local\svc2dll.exe |
"UDP Query User{1112E526-5D08-4A68-9A79-0E1467030098}C:\program files\ares\ares.exe" = protocol=17 | dir=in | app=c:\program files\ares\ares.exe |
"UDP Query User{16C3E7D2-32BE-4880-941F-D8A6731BD284}C:\program files\bearshare applications\bearshare\bearshare.exe" = protocol=17 | dir=in | app=c:\program files\bearshare applications\bearshare\bearshare.exe |
"UDP Query User{2AE817C2-0F40-4528-AB0C-017062E4BC64}C:\users\robert\appdata\roaming\imvuclient\1vivoxvoice.exe" = protocol=17 | dir=in | app=c:\users\robert\appdata\roaming\imvuclient\1vivoxvoice.exe |
"UDP Query User{3AF1FB5A-1C1D-4DA1-BC09-95E8E96D5595}C:\users\robert\appdata\local\svc2dll.exe" = protocol=17 | dir=in | app=c:\users\robert\appdata\local\svc2dll.exe |
"UDP Query User{3BA527B2-6E82-4B66-B91F-F518357817AA}C:\users\robert\appdata\local\temp\17396.exe" = protocol=17 | dir=in | app=c:\users\robert\appdata\local\temp\17396.exe |
"UDP Query User{F98D02FF-44F3-49C3-AB84-288B81E96180}C:\program files\limewire\limewire.exe" = protocol=17 | dir=in | app=c:\program files\limewire\limewire.exe |

========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
"{00CD9341-46BF-C386-1D4C-4D980B615549}" = Catalyst Control Center Localization Chinese Standard
"{055EE59D-217B-43A7-ABFF-507B966405D8}" = ATI Catalyst Control Center
"{08E81ABD-79F7-49C2-881F-FD6CB0975693}" = Roxio Creator Data
"{09760D42-E223-42AD-8C3E-55B47D0DDAC3}" = Roxio Creator DE
"{0F7C2E47-089E-4d23-B9F7-39BE00100776}" = Toolbox
"{0F81061C-661C-D357-F79C-31B1D78609F9}" = Catalyst Control Center Localization Spanish
"{11B83AD3-7A46-4C2E-A568-9505981D4C6F}" = HP Update
"{15BC8CD0-A65B-47D0-A2DD-90A824590FA8}" = Microsoft Works
"{170715E4-3235-8999-C05D-54156AC3F163}" = CCC Help German
"{174C89F3-EBA7-17AB-2FCA-82AE6AF7C8C5}" = CCC Help Japanese
"{18669FF9-C8FE-407a-9F70-E674896B1DB4}" = GPBaseService
"{1D9C9979-7B3D-0EBA-06B5-1A648DE8ECFC}" = Skins
"{1E0D8F69-A6AB-4934-9B2D-159D9F97BA4A}" = ParetoLogic DriverCure
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{1F54DAFA-9261-4A62-B59D-6C9F26B48FE4}" = Roxio Creator Tools
"{250AD9EB-E6A4-FEE1-AAAF-66EB69E96060}" = CCC Help Polish
"{26A24AE4-039D-4CA4-87B4-2F83216022FF}" = Java™ 6 Update 22
"{28BE306E-5DA6-4F9C-BDB0-DBA3C8C6FFFD}" = QuickTime
"{2B64ACEB-703E-6D90-5CBE-140B9A66C85B}" = Catalyst Control Center Localization Portuguese
"{2B7BDADB-EC8C-4C54-B5DD-CE45A016D3A7}" = Free Ride Games Player
"{2BA09774-34F7-4A06-8C7E-B69E44CB9EB0}" = DriverBoost
"{2CADE3B6-6B69-2050-7B7C-2E6BB1183458}" = Catalyst Control Center Localization Thai
"{30465B6C-B53F-49A1-9EBA-A3F187AD502E}" = Roxio Update Manager
"{30C042F8-B207-313E-F932-3599ADF24651}" = CCC Help Korean
"{3248F0A8-6813-11D6-A77B-00B0D0160050}" = Java™ 6 Update 5
"{34BFB099-07B2-4E95-A673-7362D60866A2}" = PSSWCORE
"{36FDBE6E-6684-462b-AE98-9A39A1B200CC}" = HPProductAssistant
"{3AE375B7-4C1A-8954-D87B-126990CA06ED}" = Catalyst Control Center Localization Turkish
"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
"{3E171899-0175-47CC-84C4-562ACDD4C021}" = OpenOffice.org 3.3
"{3F92ABBB-6BBF-11D5-B229-002078017FBF}" = NetWaiting
"{42DB15D5-DAAD-A187-252F-80B669BFC970}" = CCC Help Turkish
"{43B0D334-9A1B-4257-9E51-D3813BD8B9D0}" = GoGear ARIA Device Manager
"{44F70E24-C55E-4C6E-29F1-573C03BDFB9D}" = CCC Help Chinese Traditional
"{4517895C-2CCB-9CA7-D24A-E74559551426}" = Catalyst Control Center Localization Chinese Traditional
"{49041980-E77D-DCAD-8365-F22688D3A8AE}" = Catalyst Control Center Localization Hungarian
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{5109C064-813E-4e87-B0DE-C8AF7B5BC02B}" = SmartWebPrintingOC
"{52A69E11-7CEB-4a7d-9607-68BA4F39A89B}" = DeviceDiscovery
"{5335DADB-34BA-4AE8-A519-648D78498846}" = Skype™ 5.3
"{553255F3-78FD-40F1-A6F8-6882140265FE}" = Apple Application Support
"{569F35EF-9A3E-7EA6-3817-01F7A142E608}" = CCC Help Thai
"{57E08EAC-F4FA-E453-6516-CA4D8AF4BD6D}" = CCC Help English
"{5ACE69F0-A3E8-44eb-88C1-0A841E700180}" = TrayApp
"{5D9748ED-2EC3-E694-68E7-14AE077AA686}" = Catalyst Control Center Core Implementation
"{5E06C076-E4E7-4239-A886-B3D8AC84C166}" = HP Print Diagnostic Utility
"{5ECB3A3C-980B-4D12-9724-25DCB07A1F47}" = iTunes
"{62230596-37E5-4618-A329-0D21F529A86F}" = Browser Address Error Redirector
"{6675CA7F-E51B-4F6A-99D4-F8F0124C6EAA}" = Roxio Express Labeler 3
"{687FEF8A-8597-40b4-832C-297EA3F35817}" = BufferChm
"{6956856F-B6B3-4BE0-BA0B-8F495BE32033}" = Apple Software Update
"{6B7B6D4D-8F9B-4CB3-8CA4-BCA9CC4C1A22}" = EDocs
"{6DE18AB5-540B-4981-87D5-6CF7E923D983}_is1" = CyberDefender Registry Cleaner
"{6EFDBA50-4ABE-4194-86F7-F3BD0A011F5B}_is1" = Shop To Win
"{6FC963A4-D7C2-743E-4634-0BE6893D2D30}" = ccc-utility
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{73A4F29F-31AC-4EBD-AA1B-0CC5F18C8F83}" = Roxio Creator Audio
"{7484FF63-DFD5-4703-5D5A-7B197CBC6AF7}" = CCC Help Hungarian
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{777CA40C-0206-4EF6-A0FC-618BF06BF8D0}" = Intel® PRO Network Connections 12.1.11.0
"{79D4609A-AE25-B8CA-9FD2-9DC5A919414E}" = ccc-core-static
"{7DB9F1E5-9ACB-410D-A7DC-7A3D023CE045}" = Dell Getting Started Guide
"{7F19855D-DB03-2435-858D-8CD809994A3F}" = Catalyst Control Center Localization Korean
"{86CE85E6-DBAC-3FFD-B977-E4B79F83C909}" = Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570
"{8958DFF1-3103-8A70-9108-40D7D359D8C6}" = Catalyst Control Center Graphics Full New
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8A253629-0511-4854-8B4E-46E57E66005C}" = Bonjour
"{8A85DEAD-7C1F-4368-881C-72AC74CB2E91}" = UnloadSupport
"{8E3A5EA8-DE6D-9333-0DB4-55FB9B6EED46}" = CCC Help Chinese Standard
"{8F3C31C5-9C3A-4AA8-8EFA-71290A7AD533}" = TomTom HOME Visual Studio Merge Modules
"{90120000-0020-0409-0000-0000000FF1CE}" = Compatibility Pack for the 2007 Office system
"{90CA0C98-4E23-8B12-29EC-FCEB49983E7E}" = Catalyst Control Center Localization Japanese
"{95120000-00AF-0409-0000-0000000FF1CE}" = Microsoft Office PowerPoint Viewer 2007 (English)
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9A57F3E7-F32D-FD92-124C-B9C9D7231C20}" = Catalyst Control Center Graphics Light
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{9DE1BE03-AFE2-4CDB-BFEB-D06D736CD01A}" = Apple Mobile Device Support
"{A0B9F8DF-C949-45ed-9808-7DC5C0C19C81}" = Status
"{A11409F1-CD33-4076-85CB-4EE4A8439BFE}" = Scan
"{A5AB9D5E-52E2-440e-A3ED-9512E253C81A}" = SolutionCenter
"{A6B90148-02C5-4fd3-8D7A-EF2386835CB9}" = F4100_Help
"{A6C265BE-E2C1-483e-843D-6B4C1E912AE0}" = F4100
"{A75BC59B-10BF-6B87-DCC7-3501F158ACC6}" = Times Reader
"{A9FE59F0-5BFA-4FDF-84C6-F45457715379}" = InstallIQ Updater
"{AC76BA86-7AD7-1033-7B44-AA1000000001}" = Adobe Reader X (10.1.0)
"{AC76BA86-7AD7-5464-3428-800000000003}" = Spelling Dictionaries Support For Adobe Reader 8
"{AF7FC1CA-79DF-43c3-90A3-33EFEB9294CE}" = AIO_Scan
"{AFF7E080-1974-45BF-9310-10DE1A1F5ED0}" = Adobe AIR
"{B4509BCE-7BAD-4a8c-B1AE-4D0CE7467C42}" = F4100_doccd
"{B4F35A00-24FD-4fb3-BF5E-413D5423434D}" = DJ_AIO_Software_min
"{B6A26DE5-F2B5-4D58-9570-4FC760E00FCD}" = Roxio Creator Copy
"{B8DBED1E-8BC3-4d08-B94A-F9D7D88E9BBF}" = HPSSupply
"{B935C985-A17F-484B-8470-09E4FC27DC26}" = Dell-eBay
"{BAD0FA60-09CF-4411-AE6A-C2844C8812FA}" = HP Photosmart Essential 2.5
"{BB22EB20-70C4-32D9-CAE5-816E24F458CA}" = Catalyst Control Center Graphics Full Existing
"{C39A4E1F-9AF1-4FE1-A80E-A5B867FABB42}" = Dell Best of Web
"{C3A0F1A3-7AD3-F7E3-D81A-0A5EC68F0397}" = Catalyst Control Center Localization Polish
"{C54CF9B1-B0A9-4FB6-9E9E-0F151754D823}_is1" = Active PC Optimizer 1.0
"{C792A75A-2A1F-4991-9B85-291745478A79}" = NetAssistant
"{CA50045C-5119-48e7-9BA7-6B317379857A}" = DJ_AIO_Software
"{CAE7D1D9-3794-4169-B4DD-964ADBC534EE}" = HP Product Detection
"{CCB9B81A-167F-4832-B305-D2A0430840B3}" = WebReg
"{CD65BFB7-291F-9D67-760B-4FD16337FCB9}" = CCC Help Italian
"{CDDCBBF1-2703-46BC-938B-BCC81A1EEAAA}" = SUPERAntiSpyware
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{D2E0F0CC-6BE0-490b-B08B-9267083E34C9}" = MarketResearch
"{D99A8E3A-AE5A-4692-8B19-6F16D454E240}" = Destination Component
"{DB98F489-0D1B-0244-2B95-24F4C9D6A5BD}" = CCC Help Spanish
"{DC0D3295-0697-808C-4F1F-44E58330C3E8}" = Catalyst Control Center Localization German
"{E08DC77E-D09A-4e36-8067-D6DBBCC5F8DC}" = VideoToolkit01
"{E3BFEE55-39E2-4BE0-B966-89FE583822C1}" = Dell Support Center
"{E548726E-F4E8-459f-BAB8-45551BC071E9}" = DJ_AIO_ProductContext
"{E623BB3F-F7ED-4148-BEB5-A0D1DB28B4DE}" = Media Converter for Philips
"{E646DCF0-5A68-11D5-B229-002078017FBF}" = Digital Line Detect
"{E79066AE-9AF1-9C3C-6F3A-95BC4A3C3E33}" = Catalyst Control Center Graphics Previews Common
"{E87B8271-8225-31ED-95BE-0C7DB1813F7C}" = CCC Help French
"{E87FE5BA-2E1B-A6F2-F40E-9D6865ADF886}" = Catalyst Control Center Localization French
"{ED439A64-F018-4DD4-8BA5-328D85AB09AB}" = Roxio Creator DE
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F18E39EE-5306-6765-9EE3-CD3ECFE9678F}" = Catalyst Control Center Graphics Previews Vista
"{F1E63043-54FC-429B-AB2C-31AF9FBA4BC7}" = 32 Bit HP CIO Components Installer
"{F318B83E-27E2-2EFF-12EE-667C02A062D9}" = CCC Help Portuguese
"{F42CD69D-E393-47c8-B2CD-B139C4ADA9A8}" = Copy
"{F63A3748-B93D-4360-9AD4-B064481A5C7B}" = Modem Diagnostic Tool
"{F6CB42B9-F033-4152-8813-FF11DA8E6A78}" = Dell Dock
"{FA8A44D7-3E8A-4034-9C4F-088FA6B72BC4}" = HP Deskjet All-In-One Software 9.0
"{FB665796-AB4E-4519-AA8E-83144A2BAEEA}" = BOX CLEANER
"{FCDBE9CF-CFB4-2260-8F84-09B6F7FD9A87}" = Catalyst Control Center Localization Italian
"{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Adobe Shockwave Player" = Adobe Shockwave Player
"BearShare MediaBar" = MediaBar
"CNXT_MODEM_PCI_VEN_14F1&DEV_2F20&SUBSYS_200F14F1" = Conexant D850 PCI V.92 Modem
"com.nyt.timesreader.78C54164786ADE80CB31E1C5D95607D0938C987A.1" = Times Reader
"conduitEngine" = Conduit Engine
"Digital DJ Pro" = Digital DJ Pro 1.7.0
"dynconff" = FriendsChecker
"FrostWire" = FrostWire 4.21.3
"GoToAssist" = GoToAssist 8.0.0.514
"Guffinsbar Uninstall" = Guffins
"HP Imaging Device Functions" = HP Imaging Device Functions 10.0
"HP Photosmart Essential" = HP Photosmart Essential 2.5
"HP Smart Web Printing" = HP Smart Web Printing
"HP Solution Center & Imaging Support Tools" = HP Solution Center 10.0
"HPExtendedCapabilities" = HP Customer Participation Program 10.0
"Kobo" = Kobo
"Luxor" = Luxor (remove only)
"Luxor 2" = Luxor 2 (remove only)
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
"McAfee Security Scan" = McAfee Security Scan Plus
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Morphster Toolbar" = Morphster Toolbar
"Mozilla Firefox 4.0.1 (x86 en-US)" = Mozilla Firefox 4.0.1 (x86 en-US)
"MSC" = McAfee SecurityCenter
"Norton PC Checkup" = Norton PC Checkup
"PageRage Toolbar" = PageRage Toolbar
"PROSetDX" = Intel® PRO Network Connections 12.1.11.0
"RealArcade" = RealArcade
"Rhapsody" = Rhapsody
"Sewer Run_is1" = Sewer Run
"Shop for HP Supplies" = Shop for HP Supplies
"simppulltoolbar" = Simppull Toolbar (Remove Toolbar Only)
"SpywareBlaster_is1" = SpywareBlaster 4.4
"SpywareGuard_is1" = SpywareGuard v2.2
"StumbleUponIEToolbar" = StumbleUpon IE Toolbar
"TomTom HOME" = TomTom HOME 2.8.2.2264
"TuneUpMedia" = TuneUp Companion 1.9.0
"Veoh Video Compass" = Veoh Video Compass
"Veoh Web Player Beta" = Veoh Web Player Beta
"Yahoo! Companion" = Yahoo! Toolbar
"Yahoo! Software Update" = Yahoo! Software Update
"YInstHelper" = Yahoo! Install Manager
"Zwinky_42bar Uninstall" = Zwinky Toolbar

========== HKEY_CURRENT_USER Uninstall List ==========

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"f031ef6ac137efc5" = Dell Driver Download Manager
"Move Media Player" = Move Media Player
"NetAssistant" = Freeze.com NetAssistant
"UnityWebPlayer" = Unity Web Player

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 12/12/2010 5:01:43 AM | Computer Name = robert-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledSPRetry 6443

Error - 12/12/2010 5:01:44 AM | Computer Name = robert-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: Continuously busy for more than a second

Error - 12/12/2010 5:01:44 AM | Computer Name = robert-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledEvent 7457

Error - 12/12/2010 5:01:44 AM | Computer Name = robert-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledSPRetry 7457

Error - 12/12/2010 5:01:45 AM | Computer Name = robert-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: Continuously busy for more than a second

Error - 12/12/2010 5:01:45 AM | Computer Name = robert-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledEvent 8455

Error - 12/12/2010 5:01:45 AM | Computer Name = robert-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledSPRetry 8455

Error - 12/12/2010 5:01:46 AM | Computer Name = robert-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: Continuously busy for more than a second

Error - 12/12/2010 5:01:46 AM | Computer Name = robert-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledEvent 9469

Error - 12/12/2010 5:01:46 AM | Computer Name = robert-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledSPRetry 9469

[ Media Center Events ]
Error - 12/24/2008 4:32:58 PM | Computer Name = robert-PC | Source = MCUpdate | ID = 0
Description = DownloadPackgeTask.SubTasksComplete: failed downloading package SportsSchedule.

Error - 5/20/2009 4:04:47 AM | Computer Name = robert-PC | Source = MCUpdate | ID = 0
Description = DownloadPackgeTask.SubTasksComplete: failed downloading package SportsSchedule.

Error - 6/10/2009 3:59:19 AM | Computer Name = robert-PC | Source = MCUpdate | ID = 0
Description = DownloadPackgeTask.SubTasksComplete: failed downloading package SportsSchedule.

[ System Events ]
Error - 7/27/2011 2:49:34 AM | Computer Name = robert-PC | Source = Service Control Manager | ID = 7022
Description =

Error - 7/27/2011 2:49:34 AM | Computer Name = robert-PC | Source = Service Control Manager | ID = 7031
Description =

Error - 7/27/2011 2:49:34 AM | Computer Name = robert-PC | Source = Service Control Manager | ID = 7026
Description =

Error - 7/27/2011 2:50:34 AM | Computer Name = robert-PC | Source = Service Control Manager | ID = 7031
Description =

Error - 7/27/2011 2:51:43 AM | Computer Name = robert-PC | Source = Service Control Manager | ID = 7034
Description =

Error - 7/27/2011 2:52:15 AM | Computer Name = robert-PC | Source = Service Control Manager | ID = 7031
Description =

Error - 7/27/2011 2:53:48 AM | Computer Name = robert-PC | Source = Service Control Manager | ID = 7031
Description =

Error - 7/27/2011 2:54:09 AM | Computer Name = robert-PC | Source = DCOM | ID = 10010
Description =

Error - 7/27/2011 2:55:11 AM | Computer Name = robert-PC | Source = Service Control Manager | ID = 7034
Description =

Error - 7/27/2011 7:54:01 AM | Computer Name = robert-PC | Source = IPRIP | ID = 29053
Description = IPRIP could not join the multicast group 224.0.0.9 on the local interface
with IP address 68.7.30.131. The data is the error code.


< End of report >


GooredFix.txt
GooredFix by jpshortstuff (16.07.11.1)
Log created at 08:23 on 03/08/2011 (robert)
Firefox version 4.0.1 (en-US)

========== GooredScan ==========

Deleting "C:\Users\robert\Application Data\Mozilla\Firefox\Profiles\95z9sp1d.default\extensions\{84dfe0dd-b582-4795-9334-45d5e4cbc4b6}" -> Success!
Deleting "C:\Users\robert\Application Data\Mozilla\Firefox\Profiles\95z9sp1d.default\extensions\{ed722164-ba13-4b88-9fa7-34638b4e87fa}" -> Success!
(none)

========== GooredLog ==========

C:\Program Files\Mozilla Firefox\extensions\
{972ce4c6-7e08-4474-a285-3208198ce6fd} [05:51 20/11/2008]
{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} [18:20 08/06/2011]
{DB390D2E-0FB4-413F-B039-AE342D1D40BA} [07:11 14/01/2009]

C:\Users\robert\Application Data\Mozilla\Firefox\Profiles\95z9sp1d.default\extensions\
{20a82645-c095-46ed-80e3-08825760534b} [19:32 09/06/2011]
{E4E6BF2A-1667-11DF-A01F-1F9655D89593} [01:50 28/05/2011]
{E84D42CA-64EB-11DE-A65F-8C3656D89593} [00:23 17/12/2010]

C:\Users\robert\AppData\Local\
(none)

[HKEY_LOCAL_MACHINE\Software\Mozilla\Firefox\Extensions]
"{20a82645-c095-46ed-80e3-08825760534b}"="c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\" [10:13 21/08/2009]
"{B728AB94-9BC7-49b7-B76A-422BB31B2FD0}"="C:\Program Files\ArcSoft\Media Converter for Philips\Internet Video Downloader\Plugin_FireFox" [02:46 06/09/2010]
"[email protected]"="C:\Program Files\Guffins\bar\2.bin" [23:39 23/03/2011]
"42ffxtbr@Zwinky_42.com"="C:\Program Files\Zwinky_42\bar\1.bin" [17:07 10/07/2011]

---------- Old Logs ----------
GooredFix[15.38.10_29-06-2011].txt
GooredFix[16.57.31_08-06-2011].txt

-=E.O.F=-

Attached Files

•  Gmer.txt   693bytes   111 downloads

[SweetTech]

Hi!

No worries!

We will try running a different tool.

Running ComboFix
Download Combofix from either of the links below, and save it to your desktop.

Link 1
Link 2

**Note: It is important that it is saved directly to your desktop**

--------------------------------------------------------------------
IMPORTANT - Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link here

Note: If AVG or CA Internet Security Suite is installed, you must remove these programs before using Combofix. If for some reason these applications will not uninstall, try uninstalling with AppRemover by Opswat.
--------------------------------------------------------------------

Double click on ComboFix.exe & follow the prompts.

• When finished, it will produce a report for you.
• Please post the C:\ComboFix.txt for further review.

[Nstory]

ComboFix 11-08-07.03 - robert 08/08/2011 9:29.1.2 - x86
Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.1.1033.18.2045.1094 [GMT -7:00]
Running from: c:\users\robert\Desktop\ComboFix.exe
AV: McAfee VirusScan *Disabled/Outdated* {2A28CCAF-2E53-0F80-A82C-9572D1C24D8C}
FW: McAfee Personal Firewall *Disabled* {12134D8A-643C-0ED8-8373-3C472F110AF7}
SP: McAfee VirusScan *Disabled/Updated* {91492D4B-0869-000E-929C-AE00AA450731}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
C:\data
c:\data\default\us_sres.data
C:\install.exe
c:\program files\GuffinsEI
c:\program files\Mozilla Firefox\components\npclntax.xpt
c:\program files\Search Toolbar
c:\program files\Search Toolbar\icon.ico
c:\program files\Search Toolbar\SearchToolbar.dll
c:\program files\Search Toolbar\SearchToolbarUninstall.exe
c:\program files\Search Toolbar\SearchToolbarUpdater.exe
c:\users\robert\0.20209555164929804.exe
c:\users\robert\0.6117575988424623.exe
c:\users\robert\AppData\Roaming\Bitrix Security
c:\users\robert\AppData\Roaming\Bitrix Security\dqshh
c:\users\robert\AppData\Roaming\Bitrix Security\jje.txt
c:\users\robert\AppData\Roaming\Bitrix Security\ljgh.txt
c:\users\robert\AppData\Roaming\Bitrix Security\lop.txt
c:\users\robert\AppData\Roaming\Bitrix Security\mxd1.txt
c:\users\robert\AppData\Roaming\Bitrix Security\qnf.txt
c:\users\robert\AppData\Roaming\Bitrix Security\rcpqvbs5_shrd
c:\users\robert\Desktop\Malware Protection.lnk
c:\users\robert\Favorites\InstallAVg_77043301.exe
c:\users\robert\Taskmgr.exe
c:\users\robert\wevtapi.dll
c:\windows\Downloaded Program Files\f3initialsetup1.0.1.1.inf
c:\windows\system32\AutoRun.inf
.
.
((((((((((((((((((((((((( Files Created from 2011-07-08 to 2011-08-08 )))))))))))))))))))))))))))))))
.
.
2011-08-08 16:36 . 2011-08-08 16:36 -------- d-----w- c:\users\Default\AppData\Local\temp
2011-08-05 08:38 . 2011-07-13 03:39 6881616 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\Windows Defender\Definition Updates\{4393DAB8-42EE-4CCB-852E-AB5825FFA269}\mpengine.dll ERROR(0x00000005)
2011-08-03 15:32 . 2011-08-03 15:32 -------- d-----w- C:\_OTL
2011-07-14 10:16 . 2011-06-02 13:34 2043392 ----a-w- c:\windows\system32\win32k.sys
2011-07-14 10:16 . 2011-04-20 15:55 375808 ----a-w- c:\windows\system32\winsrv.dll
2011-07-14 10:16 . 2011-04-20 15:50 49152 ----a-w- c:\windows\system32\csrsrv.dll
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-07-13 03:39 . 2008-10-14 17:14 6881616 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\Windows Defender\Definition Updates\Backup\mpengine.dll ERROR(0x00000005)
2011-06-08 18:20 . 2011-06-08 18:20 472808 ----a-w- c:\windows\system32\deployJava1.dll
2011-05-28 06:08 . 2011-06-16 03:13 916480 ----a-w- c:\windows\system32\wininet.dll
2011-05-28 06:04 . 2011-06-16 03:13 43520 ----a-w- c:\windows\system32\licmgr10.dll
2011-05-28 06:04 . 2011-06-16 03:13 1469440 ----a-w- c:\windows\system32\inetcpl.cpl
2011-05-28 06:04 . 2011-06-16 03:13 71680 ----a-w- c:\windows\system32\iesetup.dll
2011-05-28 06:04 . 2011-06-16 03:13 109056 ----a-w- c:\windows\system32\iesysprep.dll
2011-05-28 05:10 . 2011-06-16 03:13 385024 ----a-w- c:\windows\system32\html.iec
2011-05-28 04:33 . 2011-06-16 03:13 133632 ----a-w- c:\windows\system32\ieUnatt.exe
2011-05-28 04:31 . 2011-06-16 03:13 1638912 ----a-w- c:\windows\system32\mshtml.tlb
2011-05-25 02:14 . 2009-10-05 19:15 222080 ------w- c:\windows\system32\MpSigStub.exe
2011-06-19 21:27 . 2011-06-19 21:27 142296 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{E38FA08E-F56A-4169-ABF5-5C71E3C153A1}"= "c:\program files\Freeze.com\NetAssistant\NetAssistant.dll" [2011-04-04 355448]
"{81017EA9-9AA8-4A6A-9734-7AF40E7D593F}"= "c:\program files\Yahoo!\Companion\Installs\cpn0\YTNavAssist.dll" [2011-03-16 214840]
.
[HKEY_CLASSES_ROOT\clsid\{e38fa08e-f56a-4169-abf5-5c71e3c153a1}]
[HKEY_CLASSES_ROOT\NetAssistant.NetAssistantBHO.1]
[HKEY_CLASSES_ROOT\TypeLib\{1E8FC16F-4C51-49C4-BC9B-4FC24BDDCEE7}]
[HKEY_CLASSES_ROOT\NetAssistant.NetAssistantBHO]
.
[HKEY_CLASSES_ROOT\clsid\{81017ea9-9aa8-4a6a-9734-7af40e7d593f}]
[HKEY_CLASSES_ROOT\YTNavAssist.YTNavAssistPlugin.1]
[HKEY_CLASSES_ROOT\TypeLib\{A31F34A1-EBD2-45A2-BF6D-231C1B987CC8}]
[HKEY_CLASSES_ROOT\YTNavAssist.YTNavAssistPlugin]
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{0974BA1E-64EC-11DE-B2A5-E43756D89593}]
2009-12-20 09:51 87480 ----a-w- c:\progra~1\BEARSH~1\MediaBar\ToolBar\BearshareMediabarDx.dll
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{30F9B915-B755-4826-820B-08FBA6BD249D}]
2010-09-12 22:02 3863136 ----a-w- c:\program files\ConduitEngine\ConduitEngine.dll
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{627af46b-2076-42ae-a2fd-8428734d3e74}]
2010-02-10 16:36 86016 ----a-w- c:\program files\simppulltoolbar\simppulldx.dll
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{72b90932-6338-4345-9fc4-4f94984ed241}]
2010-09-12 22:02 3863136 ----a-w- c:\program files\Morphster\tbMorp.dll
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{74322BF9-DF26-493f-B0DA-6D2FC5E6429E}]
2010-10-19 12:53 585136 ----a-w- c:\progra~1\BEARSH~1\MediaBar\Datamngr\IEBHO.dll
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{8C423C72-F06E-43B3-A3E8-A435FFF9E9E0}]
2010-12-29 18:20 14432 ----a-w- c:\program files\Shop to Win 14\Shop to Win 14.dll
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{9565115d-c7d6-46d3-bd63-b67b481a4368}]
2010-04-27 17:08 2393184 ----a-w- c:\program files\PageRage\tbPage.dll
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{C4B8BAB4-1667-11DF-A242-BA9455D89593}]
2009-10-20 15:50 258008 ----a-w- c:\program files\simppulltoolbar\auxi\simppulltoolbAu.dll
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{E38FA08E-F56A-4169-ABF5-5C71E3C153A1}]
2011-04-04 17:23 355448 ----a-w- c:\program files\Freeze.com\NetAssistant\NetAssistant.dll
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{FED6A736-129B-49C7-857E-25FC91E87DB3}]
2011-04-22 02:19 206400 ----a-w- c:\program files\FriendsChecker\DynConIe\DynConIE.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{9565115d-c7d6-46d3-bd63-b67b481a4368}"= "c:\program files\PageRage\tbPage.dll" [2010-04-27 2393184]
"{72b90932-6338-4345-9fc4-4f94984ed241}"= "c:\program files\Morphster\tbMorp.dll" [2010-09-12 3863136]
"{30F9B915-B755-4826-820B-08FBA6BD249D}"= "c:\program files\ConduitEngine\ConduitEngine.dll" [2010-09-12 3863136]
"{0974BA1E-64EC-11DE-B2A5-E43756D89593}"= "c:\progra~1\BEARSH~1\MediaBar\ToolBar\BearshareMediabarDx.dll" [2009-12-20 87480]
"{627af46b-2076-42ae-a2fd-8428734d3e74}"= "c:\program files\simppulltoolbar\simppulldx.dll" [2010-02-10 86016]
.
[HKEY_CLASSES_ROOT\clsid\{9565115d-c7d6-46d3-bd63-b67b481a4368}]
.
[HKEY_CLASSES_ROOT\clsid\{72b90932-6338-4345-9fc4-4f94984ed241}]
.
[HKEY_CLASSES_ROOT\clsid\{30f9b915-b755-4826-820b-08fba6bd249d}]
.
[HKEY_CLASSES_ROOT\clsid\{0974ba1e-64ec-11de-b2a5-e43756d89593}]
.
[HKEY_CLASSES_ROOT\clsid\{627af46b-2076-42ae-a2fd-8428734d3e74}]
.
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{9565115D-C7D6-46D3-BD63-B67B481A4368}"= "c:\program files\PageRage\tbPage.dll" [2010-04-27 2393184]
"{72B90932-6338-4345-9FC4-4F94984ED241}"= "c:\program files\Morphster\tbMorp.dll" [2010-09-12 3863136]
"{30F9B915-B755-4826-820B-08FBA6BD249D}"= "c:\program files\ConduitEngine\ConduitEngine.dll" [2010-09-12 3863136]
.
[HKEY_CLASSES_ROOT\clsid\{9565115d-c7d6-46d3-bd63-b67b481a4368}]
.
[HKEY_CLASSES_ROOT\clsid\{72b90932-6338-4345-9fc4-4f94984ed241}]
.
[HKEY_CLASSES_ROOT\clsid\{30f9b915-b755-4826-820b-08fba6bd249d}]
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"DellSupportCenter"="c:\program files\Dell Support Center\bin\sprtcmd.exe" [2008-03-11 202544]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-21 125952]
"VeohPlugin"="c:\program files\Veoh Networks\VeohWebPlayer\veohwebplayer.exe" [2009-02-06 3572984]
"TomTomHOME.exe"="c:\program files\TomTom HOME 2\TomTomHOMERunner.exe" [2011-04-22 247728]
"Exetender"="c:\program files\Free Ride Games\GPlayer.exe" [2011-04-06 4833712]
"InstallIQUpdater"="c:\program files\W3i\InstallIQUpdater\InstallIQUpdater.exe" [2011-05-10 1205760]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ECenter"="c:\dell\E-Center\EULALauncher.exe" [2008-02-29 17920]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2006-11-10 90112]
"dscactivate"="c:\program files\Dell Support Center\gs_agent\custom\dsca.exe" [2008-03-11 16384]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2007-10-15 49152]
"hpqSRMon"="c:\program files\HP\Digital Imaging\bin\hpqSRMon.exe" [2007-08-22 80896]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2010-03-18 421888]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2010-04-28 142120]
"Malwarebytes Anti-Malware (reboot)"="c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2010-12-21 963976]
"DellSupportCenter"="c:\program files\Dell Support Center\bin\sprtcmd.exe" [2008-03-11 202544]
"ArcSoft Connection Service"="c:\program files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe" [2010-10-28 207424]
"Malwarebytes' Anti-Malware (reboot)"="c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2010-12-21 963976]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-05-14 248552]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2011-06-06 937920]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"Exetender"="c:\program files\Free Ride Games\GPlayer.exe" [2011-04-06 4833712]
.
c:\users\robert\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
OpenOffice.org 3.3.lnk - c:\program files\OpenOffice.org 3\program\quickstart.exe [2010-12-13 1198592]
SpywareGuard.lnk - c:\program files\SpywareGuard\sgmain.exe [2003-8-29 360448]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Digital Line Detect.lnk - c:\program files\Digital Line Detect\DLG.exe [2008-8-28 50688]
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2007-10-14 214360]
McAfee Security Scan Plus.lnk - c:\program files\McAfee Security Scan\2.0.181\SSScheduler.exe [2010-1-15 255536]
Philips GoGear ARIA Device Manager.lnk - c:\philips\GoGear ARIA Device Manager\GoGear_Aria_DeviceManager.exe [2010-9-5 1693032]
.
c:\users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Dell Dock First Run.lnk - c:\program files\Dell\DellDock\DellDock.exe [2008-5-13 1058088]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\GoToAssist]
2008-08-28 15:25 10536 ----a-w- c:\program files\Citrix\GoToAssist\514\g2awinlogon.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=c:\progra~1\BEARSH~1\MediaBar\Datamngr\datamngr.dll c:\progra~1\BEARSH~1\MediaBar\Datamngr\IEBHO.dll
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcmscsvc]
@=""
.
[HKLM\~\startupfolder\C:^Users^robert^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^LimeWire On Startup.lnk]
path=c:\users\robert\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LimeWire On Startup.lnk
backup=c:\windows\pss\LimeWire On Startup.lnk.Startup
backupExtension=.Startup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CyberDefender Registry Cleaner]
2009-05-14 22:04 196608 ----a-w- c:\program files\CyberDefender\Registry Cleaner\startcdrc.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DellSupportCenter]
2008-03-11 17:44 202544 ----a-w- c:\program files\Dell Support Center\bin\sprtcmd.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\mcagent_exe]
2007-11-02 00:12 582992 ----a-w- c:\program files\McAfee.com\Agent\mcagent.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc]
"AntiVirusOverride"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc\S-1-5-21-695326800-797908242-393843667-1000]
"EnableNotificationsRef"=dword:00000001
.
R2 0286771307566251mcinstcleanup;McAfee Application Installer Cleanup (0286771307566251);c:\users\robert\AppData\Local\Temp\028677~1.EXE [x]
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R3 libusb0;libusb-win32 - Kernel Driver, Version 1.2.4.0;c:\windows\system32\drivers\libusb0.sys [2010-06-24 21504]
R3 McComponentHostService;McAfee Security Scan Component Host Service;c:\program files\McAfee Security Scan\2.0.181\McCHSvc.exe [2010-01-15 227232]
R3 StumbleUponUpdateService;StumbleUponUpdateService;c:\program files\StumbleUpon\StumbleUponUpdateService.exe [2009-12-08 120232]
R3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [2010-03-18 753504]
S1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\SASDIFSV.SYS [2010-02-17 12872]
S1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [2010-05-10 67656]
S2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files\Common Files\Adobe\ARM\1.0\armsvc.exe [2011-06-06 64952]
S2 DockLoginService;Dock Login Service;c:\program files\Dell\DellDock\DockLogin.exe [2008-04-28 161048]
S2 iprip;RIP Listener;c:\windows\System32\svchost.exe [2008-01-21 21504]
S2 RegMumService;ActivePCOptimizer Service;c:\program files\Active PC Optimizer\ActivePCOptimizerService.exe [2010-04-07 1553344]
S2 TomTomHOMEService;TomTomHOMEService;c:\program files\TomTom HOME 2\TomTomHOMEService.exe [2011-04-22 92592]
S2 X4HSEx;X4HSEx;c:\program files\Free Ride Games\X4HSEx.Sys [2010-03-11 56352]
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
rsmsvcs REG_MULTI_SZ ntmssvc
ipripsvc REG_MULTI_SZ iprip
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache
.
Contents of the 'Scheduled Tasks' folder
.
2011-08-07 c:\windows\Tasks\DriverCure.job
- c:\program files\ParetoLogic\DriverCure\DriverCure.exe [2010-06-28 20:57]
.
2011-07-15 c:\windows\Tasks\McDefragTask.job
- c:\progra~1\mcafee\mqc\QcConsol.exe [2008-08-28 18:32]
.
2011-08-01 c:\windows\Tasks\McQcTask.job
- c:\progra~1\mcafee\mqc\QcConsol.exe [2008-08-28 18:32]
.
2011-08-08 c:\windows\Tasks\ParetoLogic Registration.job
- c:\program files\Common Files\ParetoLogic\UUS2\UUS.dll [2009-01-13 14:59]
.
2011-08-08 c:\windows\Tasks\ParetoLogic Registration3.job
- c:\program files\Common Files\ParetoLogic\UUS3\UUS3.dll [2010-04-06 21:30]
.
2011-08-03 c:\windows\Tasks\ParetoLogic Update Version2.job
- c:\program files\Common Files\ParetoLogic\UUS2\Pareto_Update.exe [2009-01-13 14:59]
.
2011-08-08 c:\windows\Tasks\User_Feed_Synchronization-{959423BF-60E2-4333-92F1-3CBDC81F09DA}.job
- c:\windows\system32\msfeedssync.exe [2011-06-16 04:32]
.
.
------- Supplementary Scan -------
.
uStart Page =
uInternet Settings,ProxyOverride = <local>
IE: Google Sidewiki... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_950DF09FAB501E03.dll/cmsidewiki.html
TCP: DhcpNameServer = 68.105.28.11 68.105.29.11 68.105.28.12
FF - ProfilePath - c:\users\robert\AppData\Roaming\Mozilla\Firefox\Profiles\95z9sp1d.default\
FF - prefs.js: browser.search.defaulturl - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=
FF - prefs.js: browser.search.selectedEngine - BearShare Web Search
FF - prefs.js: browser.startup.homepage - hxxp://home.mywebsearch.com/index.jhtml?n=77C09F4F&ptnrS=ZJxdm975YYus&ptb=7B077769-099E-421A-89F3-CBB72A4D6FC1
FF - prefs.js: keyword.URL - hxxp://search.bearshare.com/web?src=ffb&systemid=2&q=
.
- - - - ORPHANS REMOVED - - - -
.
BHO-{a916eefe-6a17-4d7d-a131-2738b260bb55} - c:\progra~1\Guffins\bar\2.bin\u4bar.dll
BHO-{d6a34acb-76fa-4a14-88ea-5d54797a2028} - c:\program files\Guffins\bar\2.bin\u4SrcAs.dll
WebBrowser-{D0523BB4-21E7-11DD-9AB7-415B56D89593} - (no file)
WebBrowser-{F92A9FE4-2850-4198-B9D5-279880E49B16} - (no file)
MSConfigStartUp-Weather - c:\program files\AWS\WeatherBug\Weather.exe
MSConfigStartUp-WeatherDPA - c:\program files\Zango\bin\10.3.75.0\Weather.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-08-08 09:36
Windows 6.0.6002 Service Pack 2 NTFS
.
scanning hidden processes ...
.
scanning hidden autostart entries ...
.
scanning hidden files ...
.
.
c:\windows\TEMP\TMP00000085E1F8D6AD85F16941 524288 bytes
.
scan completed successfully
hidden files: 1
.
**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="YMP.Media"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="YMP.Media"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="YMP.Media"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="YMP.Media"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.flac\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="YMP.Media"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="YMP.Media"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="YMP.Media"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.midi\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="YMP.Media"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="YMP.Media"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ogg\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="YMP.Media"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pcm\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="YMP.Media"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pls\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="YMP.Media"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="YMP.Media"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.spx\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="YMP.Media"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wav\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="YMP.Media"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="YMP.Media"
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
Completion time: 2011-08-08 09:42:04
ComboFix-quarantined-files.txt 2011-08-08 16:42
.
Pre-Run: 59,301,793,792 bytes free
Post-Run: 59,298,193,408 bytes free
.
- - End Of File - - AD70A78277E0BA56442CB1434DFFA93B

[SweetTech]

Hi!

Please let me know how things are running after doing these scans:

ComboFix Script

• Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before following the steps below.
• They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".

Copy/paste the text inside the Codebox below into notepad:

Here's how to do that:
Click Start > Run type Notepad click OK.
This will open an empty notepad file:

Copy all the text inside of the code box - Press Ctrl+C (or right click on the highlighted section and choose 'copy')

KillAll::
File::
c:\windows\TEMP\TMP00000085E1F8D6AD85F16941

Now paste the copied text into the open notepad - press CTRL+V (or right click and choose 'paste')

Save this file to your desktop, Save this as "CFScript"

Here's how to do that:

1.Click File;
2.Click Save As... Change the directory to your desktop;
3.Change the Save as type to "All Files";
4.Type in the file name: CFScript
5.Click Save ...

• Referring to the screenshot above, drag CFScript.txt into ComboFix.exe.
• ComboFix will now run a scan on your system. If ComboFix prompts you to update to the newest version, please allow it to do so. It may reboot your system when it finishes. This is normal.
• When finished, it shall produce a log for you.
• Copy and paste the contents of the log in your next reply.

CAUTION: Do not mouse-click ComboFix's window while it is running. That may cause it to stall.



NEXT:



Malwarebytes' Anti-Malware

I see that you have Malwarebytes' Anti-Malware installed on your computer could you please do a scan using these settings:

• Open Malwarebytes' Anti-Malware
• Select the Update tab
• Click Check for Updates
• After the update have been completed, Select the Scanner tab.
• Select Perform quick scan, then click on Scan
• Leave the default options as it is and click on Start Scan
• When done, you will be prompted. Click OK, then click on Show Results
• Checked (ticked) all items and click on Remove Selected
• After it has removed the items, Notepad will open. Please post this log in your next reply. You can also find the log in the Logs tab. The bottom most log is the latest

Extra Note: If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts, click OK to either and let MBAM proceed with the disinfection process, if asked to restart the computer, please do so immediately.



NEXT:



ESET Online Scanner
I'd like us to scan your machine with ESET Online Scan

Note: It is recommended to disable on-board anti-virus program and anti-spyware programs while performing scans so there are no conflicts and it will speed up scan time.
Please don't go surfing while your resident protection is disabled!
Once the scan is finished remember to re-enable your anti-virus along with your anti-spyware programs.

• Hold down Control and click on the following link to open ESET OnlineScan in a new window.
  ESET OnlineScan
• Click the button.
• For alternate browsers only: (Microsoft Internet Explorer users can skip these steps)
  • Click on to download the ESET Smart Installer. Save it to your desktop.
  • Double click on the icon on your desktop.
• Check
• Click the button.
• Accept any security warnings from your browser.
• Check
• Make sure that the option "Remove found threats" is Unchecked
• When the Computer scan settings display shows, click the Advanced option, the place a check next to the following (if it is not already checked):
  
  • Enable Anti-Stealth technology
• Push the Start button.
• ESET will then download updates for itself, install itself, and begin
  scanning your computer. Please be patient as this can take some time.
• When the scan completes, push
• Push , and save the file to your desktop using a unique name, such as
  ESETScan. Include the contents of this report in your next reply.
• Push the button.
• Push

NEXT:



Security Check
Download Security Check by screen317 from here or here.

• Save it to your Desktop.
• Double click SecurityCheck.exe and follow the onscreen instructions inside of the black box.
• A Notepad document should open automatically called checkup.txt; please post the contents of that document.

[Nstory]

Hello ST,

I ran into a lil problem after dragging the CFScript into ComboFix. The computer restarted, and a log popped up, but I was unable to get back onto the internet, I couldn't run any programs or open any files. I forgot to write down the error message, but it said something about registry files being deleted. I went into safemode and did system restore to the latest date, so I could get back on here. I am sure I screwed up and set you back by doing a system restore, but the errors were preventing me from doing anything.

here is the log from the comboFix,

ComboFix 11-08-10.01 - robert 08/10/2011 8:23.2.2 - x86
Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.1.1033.18.2045.1258 [GMT -7:00]
Running from: c:\users\robert\Desktop\ComboFix.exe
Command switches used :: c:\users\robert\Desktop\CFScript.txt
AV: McAfee VirusScan *Disabled/Outdated* {2A28CCAF-2E53-0F80-A82C-9572D1C24D8C}
FW: McAfee Personal Firewall *Disabled* {12134D8A-643C-0ED8-8373-3C472F110AF7}
SP: McAfee VirusScan *Disabled/Updated* {91492D4B-0869-000E-929C-AE00AA450731}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
FILE ::
"c:\windows\TEMP\TMP00000085E1F8D6AD85F16941"
.
.
((((((((((((((((((((((((( Files Created from 2011-07-10 to 2011-08-10 )))))))))))))))))))))))))))))))
.
.
2011-08-10 15:29 . 2011-08-10 15:33 -------- d-----w- c:\users\robert\AppData\Local\temp
2011-08-03 15:32 . 2011-08-03 15:32 -------- d-----w- C:\_OTL
2011-07-14 10:16 . 2011-06-02 13:34 2043392 ----a-w- c:\windows\system32\win32k.sys
2011-07-14 10:16 . 2011-04-20 15:55 375808 ----a-w- c:\windows\system32\winsrv.dll
2011-07-14 10:16 . 2011-04-20 15:50 49152 ----a-w- c:\windows\system32\csrsrv.dll
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-07-13 03:39 . 2011-08-09 08:40 6881616 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\Windows Defender\Definition Updates\{D345D6AE-C71C-4B9F-A4EF-E951F890EFE7}\mpengine.dll ERROR(0x00000005)
2011-07-13 03:39 . 2008-10-14 17:14 6881616 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\Windows Defender\Definition Updates\Backup\mpengine.dll ERROR(0x00000005)
2011-06-08 18:20 . 2011-06-08 18:20 472808 ----a-w- c:\windows\system32\deployJava1.dll
2011-05-28 06:08 . 2011-06-16 03:13 916480 ----a-w- c:\windows\system32\wininet.dll
2011-05-28 06:04 . 2011-06-16 03:13 43520 ----a-w- c:\windows\system32\licmgr10.dll
2011-05-28 06:04 . 2011-06-16 03:13 1469440 ----a-w- c:\windows\system32\inetcpl.cpl
2011-05-28 06:04 . 2011-06-16 03:13 71680 ----a-w- c:\windows\system32\iesetup.dll
2011-05-28 06:04 . 2011-06-16 03:13 109056 ----a-w- c:\windows\system32\iesysprep.dll
2011-05-28 05:10 . 2011-06-16 03:13 385024 ----a-w- c:\windows\system32\html.iec
2011-05-28 04:33 . 2011-06-16 03:13 133632 ----a-w- c:\windows\system32\ieUnatt.exe
2011-05-28 04:31 . 2011-06-16 03:13 1638912 ----a-w- c:\windows\system32\mshtml.tlb
2011-05-25 02:14 . 2009-10-05 19:15 222080 ------w- c:\windows\system32\MpSigStub.exe
2011-06-19 21:27 . 2011-06-19 21:27 142296 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{E38FA08E-F56A-4169-ABF5-5C71E3C153A1}"= "c:\program files\Freeze.com\NetAssistant\NetAssistant.dll" [2011-04-04 355448]
"{81017EA9-9AA8-4A6A-9734-7AF40E7D593F}"= "c:\program files\Yahoo!\Companion\Installs\cpn0\YTNavAssist.dll" [2011-03-16 214840]
.
[HKEY_CLASSES_ROOT\clsid\{e38fa08e-f56a-4169-abf5-5c71e3c153a1}]
[HKEY_CLASSES_ROOT\NetAssistant.NetAssistantBHO.1]
[HKEY_CLASSES_ROOT\TypeLib\{1E8FC16F-4C51-49C4-BC9B-4FC24BDDCEE7}]
[HKEY_CLASSES_ROOT\NetAssistant.NetAssistantBHO]
.
[HKEY_CLASSES_ROOT\clsid\{81017ea9-9aa8-4a6a-9734-7af40e7d593f}]
[HKEY_CLASSES_ROOT\YTNavAssist.YTNavAssistPlugin.1]
[HKEY_CLASSES_ROOT\TypeLib\{A31F34A1-EBD2-45A2-BF6D-231C1B987CC8}]
[HKEY_CLASSES_ROOT\YTNavAssist.YTNavAssistPlugin]
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{0974BA1E-64EC-11DE-B2A5-E43756D89593}]
2009-12-20 09:51 87480 ----a-w- c:\progra~1\BEARSH~1\MediaBar\ToolBar\BearshareMediabarDx.dll
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{30F9B915-B755-4826-820B-08FBA6BD249D}]
2010-09-12 22:02 3863136 ----a-w- c:\program files\ConduitEngine\ConduitEngine.dll
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{627af46b-2076-42ae-a2fd-8428734d3e74}]
2010-02-10 16:36 86016 ----a-w- c:\program files\simppulltoolbar\simppulldx.dll
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{72b90932-6338-4345-9fc4-4f94984ed241}]
2010-09-12 22:02 3863136 ----a-w- c:\program files\Morphster\tbMorp.dll
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{74322BF9-DF26-493f-B0DA-6D2FC5E6429E}]
2010-10-19 12:53 585136 ----a-w- c:\progra~1\BEARSH~1\MediaBar\Datamngr\IEBHO.dll
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{8C423C72-F06E-43B3-A3E8-A435FFF9E9E0}]
2010-12-29 18:20 14432 ----a-w- c:\program files\Shop to Win 14\Shop to Win 14.dll
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{9565115d-c7d6-46d3-bd63-b67b481a4368}]
2010-04-27 17:08 2393184 ----a-w- c:\program files\PageRage\tbPage.dll
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{C4B8BAB4-1667-11DF-A242-BA9455D89593}]
2009-10-20 15:50 258008 ----a-w- c:\program files\simppulltoolbar\auxi\simppulltoolbAu.dll
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{E38FA08E-F56A-4169-ABF5-5C71E3C153A1}]
2011-04-04 17:23 355448 ----a-w- c:\program files\Freeze.com\NetAssistant\NetAssistant.dll
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{FED6A736-129B-49C7-857E-25FC91E87DB3}]
2011-04-22 02:19 206400 ----a-w- c:\program files\FriendsChecker\DynConIe\DynConIE.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{9565115d-c7d6-46d3-bd63-b67b481a4368}"= "c:\program files\PageRage\tbPage.dll" [2010-04-27 2393184]
"{72b90932-6338-4345-9fc4-4f94984ed241}"= "c:\program files\Morphster\tbMorp.dll" [2010-09-12 3863136]
"{30F9B915-B755-4826-820B-08FBA6BD249D}"= "c:\program files\ConduitEngine\ConduitEngine.dll" [2010-09-12 3863136]
"{0974BA1E-64EC-11DE-B2A5-E43756D89593}"= "c:\progra~1\BEARSH~1\MediaBar\ToolBar\BearshareMediabarDx.dll" [2009-12-20 87480]
"{627af46b-2076-42ae-a2fd-8428734d3e74}"= "c:\program files\simppulltoolbar\simppulldx.dll" [2010-02-10 86016]
.
[HKEY_CLASSES_ROOT\clsid\{9565115d-c7d6-46d3-bd63-b67b481a4368}]
.
[HKEY_CLASSES_ROOT\clsid\{72b90932-6338-4345-9fc4-4f94984ed241}]
.
[HKEY_CLASSES_ROOT\clsid\{30f9b915-b755-4826-820b-08fba6bd249d}]
.
[HKEY_CLASSES_ROOT\clsid\{0974ba1e-64ec-11de-b2a5-e43756d89593}]
.
[HKEY_CLASSES_ROOT\clsid\{627af46b-2076-42ae-a2fd-8428734d3e74}]
.
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{9565115D-C7D6-46D3-BD63-B67B481A4368}"= "c:\program files\PageRage\tbPage.dll" [2010-04-27 2393184]
"{72B90932-6338-4345-9FC4-4F94984ED241}"= "c:\program files\Morphster\tbMorp.dll" [2010-09-12 3863136]
"{30F9B915-B755-4826-820B-08FBA6BD249D}"= "c:\program files\ConduitEngine\ConduitEngine.dll" [2010-09-12 3863136]
.
[HKEY_CLASSES_ROOT\clsid\{9565115d-c7d6-46d3-bd63-b67b481a4368}]
.
[HKEY_CLASSES_ROOT\clsid\{72b90932-6338-4345-9fc4-4f94984ed241}]
.
[HKEY_CLASSES_ROOT\clsid\{30f9b915-b755-4826-820b-08fba6bd249d}]
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"DellSupportCenter"="c:\program files\Dell Support Center\bin\sprtcmd.exe" [2008-03-11 202544]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-21 125952]
"VeohPlugin"="c:\program files\Veoh Networks\VeohWebPlayer\veohwebplayer.exe" [2009-02-06 3572984]
"TomTomHOME.exe"="c:\program files\TomTom HOME 2\TomTomHOMERunner.exe" [2011-04-22 247728]
"Exetender"="c:\program files\Free Ride Games\GPlayer.exe" [2011-04-06 4833712]
"InstallIQUpdater"="c:\program files\W3i\InstallIQUpdater\InstallIQUpdater.exe" [2011-05-10 1205760]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ECenter"="c:\dell\E-Center\EULALauncher.exe" [2008-02-29 17920]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2006-11-10 90112]
"dscactivate"="c:\program files\Dell Support Center\gs_agent\custom\dsca.exe" [2008-03-11 16384]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2007-10-15 49152]
"hpqSRMon"="c:\program files\HP\Digital Imaging\bin\hpqSRMon.exe" [2007-08-22 80896]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2010-03-18 421888]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2010-04-28 142120]
"Malwarebytes Anti-Malware (reboot)"="c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2010-12-21 963976]
"DellSupportCenter"="c:\program files\Dell Support Center\bin\sprtcmd.exe" [2008-03-11 202544]
"ArcSoft Connection Service"="c:\program files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe" [2010-10-28 207424]
"Malwarebytes' Anti-Malware (reboot)"="c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2010-12-21 963976]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-05-14 248552]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2011-06-06 937920]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"Exetender"="c:\program files\Free Ride Games\GPlayer.exe" [2011-04-06 4833712]
.
c:\users\robert\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
OpenOffice.org 3.3.lnk - c:\program files\OpenOffice.org 3\program\quickstart.exe [2010-12-13 1198592]
SpywareGuard.lnk - c:\program files\SpywareGuard\sgmain.exe [2003-8-29 360448]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Digital Line Detect.lnk - c:\program files\Digital Line Detect\DLG.exe [2008-8-28 50688]
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2007-10-14 214360]
McAfee Security Scan Plus.lnk - c:\program files\McAfee Security Scan\2.0.181\SSScheduler.exe [2010-1-15 255536]
Philips GoGear ARIA Device Manager.lnk - c:\philips\GoGear ARIA Device Manager\GoGear_Aria_DeviceManager.exe [2010-9-5 1693032]
.
c:\users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Dell Dock First Run.lnk - c:\program files\Dell\DellDock\DellDock.exe [2008-5-13 1058088]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\GoToAssist]
2008-08-28 15:25 10536 ----a-w- c:\program files\Citrix\GoToAssist\514\g2awinlogon.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=c:\progra~1\BEARSH~1\MediaBar\Datamngr\datamngr.dll c:\progra~1\BEARSH~1\MediaBar\Datamngr\IEBHO.dll
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcmscsvc]
@=""
.
[HKLM\~\startupfolder\C:^Users^robert^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^LimeWire On Startup.lnk]
path=c:\users\robert\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LimeWire On Startup.lnk
backup=c:\windows\pss\LimeWire On Startup.lnk.Startup
backupExtension=.Startup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CyberDefender Registry Cleaner]
2009-05-14 22:04 196608 ----a-w- c:\program files\CyberDefender\Registry Cleaner\startcdrc.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DellSupportCenter]
2008-03-11 17:44 202544 ----a-w- c:\program files\Dell Support Center\bin\sprtcmd.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\mcagent_exe]
2007-11-02 00:12 582992 ----a-w- c:\program files\McAfee.com\Agent\mcagent.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc]
"AntiVirusOverride"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc\S-1-5-21-695326800-797908242-393843667-1000]
"EnableNotificationsRef"=dword:00000001
.
R2 0286771307566251mcinstcleanup;McAfee Application Installer Cleanup (0286771307566251);c:\users\robert\AppData\Local\Temp\028677~1.EXE [x]
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R3 libusb0;libusb-win32 - Kernel Driver, Version 1.2.4.0;c:\windows\system32\drivers\libusb0.sys [2010-06-24 21504]
R3 McComponentHostService;McAfee Security Scan Component Host Service;c:\program files\McAfee Security Scan\2.0.181\McCHSvc.exe [2010-01-15 227232]
R3 StumbleUponUpdateService;StumbleUponUpdateService;c:\program files\StumbleUpon\StumbleUponUpdateService.exe [2009-12-08 120232]
R3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [2010-03-18 753504]
S1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\SASDIFSV.SYS [2010-02-17 12872]
S1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [2010-05-10 67656]
S2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files\Common Files\Adobe\ARM\1.0\armsvc.exe [2011-06-06 64952]
S2 DockLoginService;Dock Login Service;c:\program files\Dell\DellDock\DockLogin.exe [2008-04-28 161048]
S2 iprip;RIP Listener;c:\windows\System32\svchost.exe [2008-01-21 21504]
S2 RegMumService;ActivePCOptimizer Service;c:\program files\Active PC Optimizer\ActivePCOptimizerService.exe [2010-04-07 1553344]
S2 TomTomHOMEService;TomTomHOMEService;c:\program files\TomTom HOME 2\TomTomHOMEService.exe [2011-04-22 92592]
S2 X4HSEx;X4HSEx;c:\program files\Free Ride Games\X4HSEx.Sys [2010-03-11 56352]
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
rsmsvcs REG_MULTI_SZ ntmssvc
ipripsvc REG_MULTI_SZ iprip
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache
.
Contents of the 'Scheduled Tasks' folder
.
2011-08-07 c:\windows\Tasks\DriverCure.job
- c:\program files\ParetoLogic\DriverCure\DriverCure.exe [2010-06-28 20:57]
.
2011-07-15 c:\windows\Tasks\McDefragTask.job
- c:\progra~1\mcafee\mqc\QcConsol.exe [2008-08-28 18:32]
.
2011-08-01 c:\windows\Tasks\McQcTask.job
- c:\progra~1\mcafee\mqc\QcConsol.exe [2008-08-28 18:32]
.
2011-08-10 c:\windows\Tasks\ParetoLogic Registration.job
- c:\program files\Common Files\ParetoLogic\UUS2\UUS.dll [2009-01-13 14:59]
.
2011-08-10 c:\windows\Tasks\ParetoLogic Registration3.job
- c:\program files\Common Files\ParetoLogic\UUS3\UUS3.dll [2010-04-06 21:30]
.
2011-08-10 c:\windows\Tasks\ParetoLogic Update Version2.job
- c:\program files\Common Files\ParetoLogic\UUS2\Pareto_Update.exe [2009-01-13 14:59]
.
2011-08-10 c:\windows\Tasks\User_Feed_Synchronization-{959423BF-60E2-4333-92F1-3CBDC81F09DA}.job
- c:\windows\system32\msfeedssync.exe [2011-06-16 04:32]
.
.
------- Supplementary Scan -------
.
uStart Page =
uInternet Settings,ProxyOverride = <local>
IE: Google Sidewiki... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_950DF09FAB501E03.dll/cmsidewiki.html
TCP: DhcpNameServer = 68.105.28.11 68.105.29.11 68.105.28.12
FF - ProfilePath - c:\users\robert\AppData\Roaming\Mozilla\Firefox\Profiles\95z9sp1d.default\
FF - prefs.js: browser.search.defaulturl - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=
FF - prefs.js: browser.search.selectedEngine - BearShare Web Search
FF - prefs.js: browser.startup.homepage - hxxp://home.mywebsearch.com/index.jhtml?n=77C09F4F&ptnrS=ZJxdm975YYus&ptb=7B077769-099E-421A-89F3-CBB72A4D6FC1
FF - prefs.js: keyword.URL - hxxp://search.bearshare.com/web?src=ffb&systemid=2&q=
.
.
**************************************************************************
scanning hidden processes ...
.
scanning hidden autostart entries ...
.
scanning hidden files ...
.
scan completed successfully
hidden files:
.
**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="YMP.Media"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="YMP.Media"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="YMP.Media"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="YMP.Media"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.flac\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="YMP.Media"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="YMP.Media"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="YMP.Media"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.midi\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="YMP.Media"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="YMP.Media"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ogg\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="YMP.Media"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pcm\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="YMP.Media"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pls\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="YMP.Media"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="YMP.Media"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.spx\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="YMP.Media"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wav\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="YMP.Media"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="YMP.Media"
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
------------------------ Other Running Processes ------------------------
.
c:\windows\system32\Ati2evxx.exe
c:\windows\system32\Ati2evxx.exe
c:\program files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe
c:\program files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\windows\system32\CISVC.EXE
c:\windows\System32\tcpsvcs.exe
c:\windows\System32\snmp.exe
c:\program files\Dell Support Center\bin\sprtsvc.exe
c:\windows\system32\DRIVERS\xaudio.exe
c:\program files\Yahoo!\SoftwareUpdate\YahooAUService.exe
c:\windows\system32\WUDFHost.exe
c:\program files\BearShare Applications\MediaBar\Datamngr\datamngrUI.exe
c:\windows\servicing\TrustedInstaller.exe
c:\program files\ATI Technologies\ATI.ACE\Core-Static\MOM.EXE
c:\program files\OpenOffice.org 3\program\soffice.exe
c:\program files\Common Files\ArcSoft\Connection Service\Bin\ArcCon.ac
c:\windows\ehome\ehmsas.exe
c:\program files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
c:\program files\OpenOffice.org 3\program\soffice.bin
c:\program files\HP\Digital Imaging\bin\hpqSTE08.exe
c:\program files\HP\Digital Imaging\bin\hpqbam08.exe
c:\program files\HP\Digital Imaging\bin\hpqgpc01.exe
c:\program files\iPod\bin\iPodService.exe
c:\progra~1\COMMON~1\mcafee\mna\mcnasvc.exe
c:\progra~1\mcafee.com\agent\mcagent.exe
c:\windows\system32\wermgr.exe
.
**************************************************************************
.
Completion time: 2011-08-10 08:43:39 - machine was rebooted
ComboFix-quarantined-files.txt 2011-08-10 15:42
ComboFix2.txt 2011-08-08 16:42
.
Pre-Run: 58,400,378,880 bytes free
Post-Run: 58,411,134,976 bytes free
.
- - End Of File - - 3AA72E877C2E520D8C5EC25BAE89D130

[SweetTech]

Hi!

Okay.

Please proceed with the rest of the instructions in my previous post (MBAM, ESET, and SecurityCheck scan).

[Nstory]

malwarbytes:

Malwarebytes' Anti-Malware 1.50.1.1100
www.malwarebytes.org

Database version: 6492

Windows 6.0.6002 Service Pack 2
Internet Explorer 8.0.6001.19120

8/12/2011 7:52:34 AM
mbam-log-2011-08-12 (07-52-34).txt

Scan type: Quick scan
Objects scanned: 157642
Time elapsed: 5 minute(s), 11 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 9

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
c:\Users\robert\downloads\Guffins.exe (PUP.FunWebProducts) -> Not selected for removal.
c:\Windows\System32\config\systemprofile\AppData\Roaming\020000005ee9e7711270c.manifest (Malware.Trace) -> Quarantined and deleted successfully.
c:\Windows\System32\config\systemprofile\AppData\Roaming\020000005ee9e7711270o.manifest (Malware.Trace) -> Quarantined and deleted successfully.
c:\Windows\System32\config\systemprofile\AppData\Roaming\020000005ee9e7711270p.manifest (Malware.Trace) -> Quarantined and deleted successfully.
c:\Windows\System32\config\systemprofile\AppData\Roaming\020000005ee9e7711270s.manifest (Malware.Trace) -> Quarantined and deleted successfully.
c:\Windows\System32\020000005ee9e7711270c.manifest (Malware.Trace) -> Quarantined and deleted successfully.
c:\Windows\System32\020000005ee9e7711270o.manifest (Malware.Trace) -> Quarantined and deleted successfully.
c:\Windows\System32\020000005ee9e7711270p.manifest (Malware.Trace) -> Quarantined and deleted successfully.
c:\Windows\System32\020000005ee9e7711270s.manifest (Malware.Trace) -> Quarantined and deleted successfully.

Malwarebytes:

Malwarebytes' Anti-Malware 1.50.1.1100
www.malwarebytes.org

Database version: 6492

Windows 6.0.6002 Service Pack 2
Internet Explorer 8.0.6001.19120

8/12/2011 7:56:33 AM
mbam-log-2011-08-12 (07-56-33).txt

Scan type: Quick scan
Objects scanned: 157669
Time elapsed: 3 minute(s), 26 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 1

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
c:\Users\robert\downloads\Guffins.exe (PUP.FunWebProducts) -> Quarantined and deleted successfully.

ESETScan:
C:\Program Files\Active PC Optimizer\ActivePCOptimizer.exe a variant of Win32/Adware.RegistryMum application
C:\ProgramData\gcdef32.exe a variant of Win32/Kryptik.QHP trojan
C:\ProgramData\Fighters\SLOW-PCfighter\InstallCache\{C3F5F5A2-6DC3-43D1-9811-B9713A0C67E6}\SLOW-PCfighter.msi a variant of Win32/SlowPCfighter application
C:\Qoobox\Quarantine\C\Program Files\Search Toolbar\SearchToolbar.dll.vir Win32/Toolbar.Zugo application
C:\Qoobox\Quarantine\C\Users\robert\0.20209555164929804.exe.vir a variant of Win32/Kryptik.QHP trojan
C:\Qoobox\Quarantine\C\Users\robert\0.6117575988424623.exe.vir a variant of Win32/Kryptik.QHP trojan
C:\Qoobox\Quarantine\C\Users\robert\wevtapi.dll.vir a variant of Win32/Olmarik.AWJ trojan
C:\Qoobox\Quarantine\C\Users\robert\Favorites\InstallAVg_77043301.exe.vir a variant of Win32/Kryptik.AFN trojan
C:\Users\All Users\gcdef32.exe a variant of Win32/Kryptik.QHP trojan
C:\Users\All Users\Fighters\SLOW-PCfighter\InstallCache\{C3F5F5A2-6DC3-43D1-9811-B9713A0C67E6}\SLOW-PCfighter.msi a variant of Win32/SlowPCfighter application
C:\Users\robert\AppData\Local\Google\Chrome\User Data\Default\Default\pfgolekbbbmhhbbhhbfogjahhmgmlpia\contentscript.js Win32/TrojanDownloader.Tracur.F trojan
C:\Users\robert\AppData\Local\Temp\C504.tmp Win32/Olmarik.AWO trojan
C:\Users\robert\AppData\Local\Temp\C8CB.tmp Win32/Olmarik.AWO trojan
C:\Users\robert\AppData\Local\Temp(28)\A902.tmp a variant of Win32/Kryptik.RLK trojan
C:\Users\robert\AppData\Local\Temp(28)\thpm4913857023281553869.tmp a variant of Win32/Kryptik.RLK trojan
C:\Users\robert\AppData\LocalLow\Guffins\bar\setups\GuffinsAuto.exe probably a variant of Win32/Toolbar.MyWebSearch.L application
C:\Users\robert\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\55\6e9395f7-7da530fd a variant of Win32/Kryptik.PUI trojan
C:\Users\robert\AppData\LocalLow\Zwinky_42EI\Installr\Cache\07BE66B6.exe a variant of Win32/Toolbar.MyWebSearch.O application
C:\Users\robert\AppData\Roaming\Mozilla\Firefox\Profiles\95z9sp1d.default\gsl.dll Win32/Adware.GreenAV application
C:\Users\robert\Contacts\setup.exe Win32/TrojanDownloader.FakeAlert.ALS trojan
C:\Users\robert\Desktop\GooredFix Backups\C\Users\robert\Application Data\Mozilla\Firefox\Profiles\95z9sp1d.default\extensions\{84dfe0dd-b582-4795-9334-45d5e4cbc4b6}\chrome.manifest Win32/TrojanDownloader.Tracur.F trojan
C:\Users\robert\Desktop\GooredFix Backups\C\Users\robert\Application Data\Mozilla\Firefox\Profiles\95z9sp1d.default\extensions\{84dfe0dd-b582-4795-9334-45d5e4cbc4b6}\chrome\xulcache.jar JS/Agent.NDJ trojan
C:\Users\robert\Desktop\GooredFix Backups\C\Users\robert\Application Data\Mozilla\Firefox\Profiles\95z9sp1d.default\extensions\{ed722164-ba13-4b88-9fa7-34638b4e87fa}\chrome.manifest Win32/TrojanDownloader.Tracur.F trojan
C:\Users\robert\Desktop\GooredFix Backups\C\Users\robert\Application Data\Mozilla\Firefox\Profiles\95z9sp1d.default\extensions\{ed722164-ba13-4b88-9fa7-34638b4e87fa}\chrome\xulcache.jar JS/Agent.NDB trojan
C:\Users\robert\Desktop\GooredFix Backups\C\Users\robert\Application Data\Mozilla\Firefox\Profiles\95z9sp1d.default\extensions\{ed722164-ba13-4b88-9fa7-34638b4e87fa}\{ed722164-ba13-4b88-9fa7-34638b4e87fa}\chrome.manifest Win32/TrojanDownloader.Tracur.F trojan
C:\Users\robert\Desktop\GooredFix Backups\C\Users\robert\Application Data\Mozilla\Firefox\Profiles\95z9sp1d.default\extensions\{ed722164-ba13-4b88-9fa7-34638b4e87fa}\{ed722164-ba13-4b88-9fa7-34638b4e87fa}\chrome\xulcache.jar JS/Agent.NDB trojan
C:\Users\robert\Documents\jared lee hooray for hollywood live.snd a variant of WMA/TrojanDownloader.GetCodec.gen trojan
C:\Users\robert\Documents\FrostWire\Saved\hooray for hollywood jared lee.mp3 a variant of WMA/TrojanDownloader.GetCodec.gen trojan
C:\Users\robert\Documents\New Folder\i toons\SetupPlaySushi.exe a variant of Win32/Adware.Gamevance.AK application
C:\Users\robert\Downloads\PlayItAll-Setup-win32_2.exe Win32/Toolbar.Zugo application
C:\Users\robert\Downloads\SetupGamevance.exe a variant of Win32/Adware.Gamevance.AB application
C:\Users\robert\Downloads\unconfirmed 25246.crdownload Win32/Adware.Gamevance.AK application
C:\Users\robert\Downloads\unconfirmed 71581.crdownload Win32/Adware.Gamevance.AK application
C:\_OTL\MovedFiles\08032011_083212\C_Program Files\Guffins\bar\2.bin\u4datact.dll a variant of Win32/Toolbar.MyWebSearch.A application
C:\_OTL\MovedFiles\08032011_083212\C_Program Files\Guffins\bar\2.bin\u4html.dll probably a variant of Win32/Toolbar.MyWebSearch.F application
C:\_OTL\MovedFiles\08032011_083212\C_Program Files\Guffins\bar\2.bin\u4htmlmu.dll probably a variant of Win32/Toolbar.MyWebSearch.B application
C:\_OTL\MovedFiles\08032011_083212\C_Program Files\Guffins\bar\2.bin\u4Plugin.dll a variant of Win32/Toolbar.MyWebSearch application
C:\_OTL\MovedFiles\08032011_083212\C_Program Files\Guffins\bar\2.bin\u4skin.dll a variant of Win32/Toolbar.MyWebSearch.P application
C:\_OTL\MovedFiles\08032011_083212\C_Program Files\Zwinky_42\bar\1.bin\42datact.dll a variant of Win32/Toolbar.MyWebSearch.A application
C:\_OTL\MovedFiles\08032011_083212\C_Program Files\Zwinky_42\bar\1.bin\42highin.exe Win32/Toolbar.MyWebSearch application
C:\_OTL\MovedFiles\08032011_083212\C_Program Files\Zwinky_42\bar\1.bin\42html.dll probably a variant of Win32/Toolbar.MyWebSearch.F application
C:\_OTL\MovedFiles\08032011_083212\C_Program Files\Zwinky_42\bar\1.bin\42htmlmu.dll probably a variant of Win32/Toolbar.MyWebSearch.B application
C:\_OTL\MovedFiles\08032011_083212\C_Program Files\Zwinky_42\bar\1.bin\42ieovr.dll probably a variant of Win32/Toolbar.MyWebSearch.P application
C:\_OTL\MovedFiles\08032011_083212\C_Program Files\Zwinky_42\bar\1.bin\42medint.exe Win32/Toolbar.MyWebSearch application
C:\_OTL\MovedFiles\08032011_083212\C_Program Files\Zwinky_42\bar\1.bin\42Plugin.dll a variant of Win32/Toolbar.MyWebSearch application
C:\_OTL\MovedFiles\08032011_083212\C_Program Files\Zwinky_42\bar\1.bin\42skin.dll a variant of Win32/Toolbar.MyWebSearch.P application
C:\_OTL\MovedFiles\08032011_083212\C_ProgramData\ati2edxx32.dll Win32/TrojanDownloader.Agent.PDY trojan
C:\_OTL\MovedFiles\08032011_083212\C_Users\robert\AppData\Local\svc2dll.exe.old probably a variant of Win32/Agent.DLNPJFK trojan
C:\_OTL\MovedFiles\08032011_083212\C_Users\robert\AppData\Local\Temp\tmph1189877229015082782.tmp a variant of Win32/Kryptik.QWM trojan
C:\_OTL\MovedFiles\08032011_083212\C_Windows\System32\ati2edxx32.dll a variant of Win32/Kryptik.QSR trojan
C:\_OTL\MovedFiles\08032011_083212\C_Windows\System32\dplayx32.exe a variant of Win32/Kryptik.QHP trojan

CheckUp:

Results of screen317's Security Check version 0.99.18
Windows Vista Service Pack 2 (UAC is enabled)
Internet Explorer 8
``````````````````````````````
Antivirus/Firewall Check:
Windows Firewall Enabled!
ESET Online Scanner v3
McAfee Security Scan Plus
McAfee SecurityCenter
WMI entry may not exist for antivirus; attempting automatic update.
```````````````````````````````
Anti-malware/Other Utilities Check:
Malwarebytes' Anti-Malware
TuneUp Companion 1.9.0
BOX CLEANER
Java™ 6 Update 22
Java™ 6 Update 5
Out of date Java installed!
Flash Player Out of Date!
Adobe Flash Player 10.1.102.64
Mozilla Firefox (x86 en-US..)
````````````````````````````````
Process Check:
objlist.exe by Laurent
system32 OnlineScannerApp.exe -?-
``````````End of Log````````````

[SweetTech]

Hi!

I'm going to ask that you run a new scan with MBAM. The latest version of MBAM is 1.51.1.1800 and the latest database version as of this posting is: 7449

Malwarebytes' Anti-Malware

I see that you have Malwarebytes' Anti-Malware installed on your computer could you please do a scan using these settings:

• Open Malwarebytes' Anti-Malware
• Select the Update tab
• Click Check for Updates
• After the update have been completed, Select the Scanner tab.
• Select Perform quick scan, then click on Scan
• Leave the default options as it is and click on Start Scan
• When done, you will be prompted. Click OK, then click on Show Results
• Checked (ticked) all items and click on Remove Selected
• After it has removed the items, Notepad will open. Please post this log in your next reply. You can also find the log in the Logs tab. The bottom most log is the latest

Extra Note: If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts, click OK to either and let MBAM proceed with the disinfection process, if asked to restart the computer, please do so immediately.



NEXT:



These threat(s) below are currently in Quarantine/System Restore and shall be removed when we clean up our tools later on.

C:\_OTL\MovedFiles\08032011_083212\C_Program Files\Guffins\bar\2.bin\u4datact.dll a variant of Win32/Toolbar.MyWebSearch.A application
C:\_OTL\MovedFiles\08032011_083212\C_Program Files\Guffins\bar\2.bin\u4html.dll probably a variant of Win32/Toolbar.MyWebSearch.F application
C:\_OTL\MovedFiles\08032011_083212\C_Program Files\Guffins\bar\2.bin\u4htmlmu.dll probably a variant of Win32/Toolbar.MyWebSearch.B application
C:\_OTL\MovedFiles\08032011_083212\C_Program Files\Guffins\bar\2.bin\u4Plugin.dll a variant of Win32/Toolbar.MyWebSearch application
C:\_OTL\MovedFiles\08032011_083212\C_Program Files\Guffins\bar\2.bin\u4skin.dll a variant of Win32/Toolbar.MyWebSearch.P application
C:\_OTL\MovedFiles\08032011_083212\C_Program Files\Zwinky_42\bar\1.bin\42datact.dll a variant of Win32/Toolbar.MyWebSearch.A application
C:\_OTL\MovedFiles\08032011_083212\C_Program Files\Zwinky_42\bar\1.bin\42highin.exe Win32/Toolbar.MyWebSearch application
C:\_OTL\MovedFiles\08032011_083212\C_Program Files\Zwinky_42\bar\1.bin\42html.dll probably a variant of Win32/Toolbar.MyWebSearch.F application
C:\_OTL\MovedFiles\08032011_083212\C_Program Files\Zwinky_42\bar\1.bin\42htmlmu.dll probably a variant of Win32/Toolbar.MyWebSearch.B application
C:\_OTL\MovedFiles\08032011_083212\C_Program Files\Zwinky_42\bar\1.bin\42ieovr.dll probably a variant of Win32/Toolbar.MyWebSearch.P application
C:\_OTL\MovedFiles\08032011_083212\C_Program Files\Zwinky_42\bar\1.bin\42medint.exe Win32/Toolbar.MyWebSearch application
C:\_OTL\MovedFiles\08032011_083212\C_Program Files\Zwinky_42\bar\1.bin\42Plugin.dll a variant of Win32/Toolbar.MyWebSearch application
C:\_OTL\MovedFiles\08032011_083212\C_Program Files\Zwinky_42\bar\1.bin\42skin.dll a variant of Win32/Toolbar.MyWebSearch.P application
C:\_OTL\MovedFiles\08032011_083212\C_ProgramData\ati2edxx32.dll Win32/TrojanDownloader.Agent.PDY trojan
C:\_OTL\MovedFiles\08032011_083212\C_Users\robert\AppData\Local\svc2dll.exe.old probably a variant of Win32/Agent.DLNPJFK trojan
C:\_OTL\MovedFiles\08032011_083212\C_Users\robert\AppData\Local\Temp\tmph1189877229015082782.tmp a variant of Win32/Kryptik.QWM trojan
C:\_OTL\MovedFiles\08032011_083212\C_Windows\System32\ati2edxx32.dll a variant of Win32/Kryptik.QSR trojan
C:\_OTL\MovedFiles\08032011_083212\C_Windows\System32\dplayx32.exe a variant of Win32/Kryptik.QHP trojan
C:\Users\robert\Desktop\GooredFix Backups\C\Users\robert\Application Data\Mozilla\Firefox\Profiles\95z9sp1d.default\extensions\{84dfe0dd-b582-4795-9334-45d5e4cbc4b6}\chrome.manifest Win32/TrojanDownloader.Tracur.F trojan
C:\Users\robert\Desktop\GooredFix Backups\C\Users\robert\Application Data\Mozilla\Firefox\Profiles\95z9sp1d.default\extensions\{84dfe0dd-b582-4795-9334-45d5e4cbc4b6}\chrome\xulcache.jar JS/Agent.NDJ trojan
C:\Users\robert\Desktop\GooredFix Backups\C\Users\robert\Application Data\Mozilla\Firefox\Profiles\95z9sp1d.default\extensions\{ed722164-ba13-4b88-9fa7-34638b4e87fa}\chrome.manifest Win32/TrojanDownloader.Tracur.F trojan
C:\Users\robert\Desktop\GooredFix Backups\C\Users\robert\Application Data\Mozilla\Firefox\Profiles\95z9sp1d.default\extensions\{ed722164-ba13-4b88-9fa7-34638b4e87fa}\chrome\xulcache.jar JS/Agent.NDB trojan
C:\Users\robert\Desktop\GooredFix Backups\C\Users\robert\Application Data\Mozilla\Firefox\Profiles\95z9sp1d.default\extensions\{ed722164-ba13-4b88-9fa7-34638b4e87fa}\{ed722164-ba13-4b88-9fa7-34638b4e87fa}\chrome.manifest Win32/TrojanDownloader.Tracur.F trojan
C:\Users\robert\Desktop\GooredFix Backups\C\Users\robert\Application Data\Mozilla\Firefox\Profiles\95z9sp1d.default\extensions\{ed722164-ba13-4b88-9fa7-34638b4e87fa}\{ed722164-ba13-4b88-9fa7-34638b4e87fa}\chrome\xulcache.jar JS/Agent.NDB trojan
C:\Qoobox\Quarantine\C\Program Files\Search Toolbar\SearchToolbar.dll.vir Win32/Toolbar.Zugo application
C:\Qoobox\Quarantine\C\Users\robert\0.20209555164929804.exe.vir a variant of Win32/Kryptik.QHP trojan
C:\Qoobox\Quarantine\C\Users\robert\0.6117575988424623.exe.vir a variant of Win32/Kryptik.QHP trojan
C:\Qoobox\Quarantine\C\Users\robert\wevtapi.dll.vir a variant of Win32/Olmarik.AWJ trojan
C:\Qoobox\Quarantine\C\Users\robert\Favorites\InstallAVg_77043301.exe.vir a variant of Win32/Kryptik.AFN trojan

These threat(s) below will be removed very shortly:

C:\Users\robert\Documents\jared lee hooray for hollywood live.snd a variant of WMA/TrojanDownloader.GetCodec.gen trojan
C:\Users\robert\Documents\FrostWire\Saved\hooray for hollywood jared lee.mp3 a variant of WMA/TrojanDownloader.GetCodec.gen trojan
C:\Users\robert\Documents\New Folder\i toons\SetupPlaySushi.exe a variant of Win32/Adware.Gamevance.AK application
C:\Users\robert\Downloads\PlayItAll-Setup-win32_2.exe Win32/Toolbar.Zugo application
C:\Users\robert\Downloads\SetupGamevance.exe a variant of Win32/Adware.Gamevance.AB application
C:\Users\robert\Downloads\unconfirmed 25246.crdownload Win32/Adware.Gamevance.AK application
C:\Users\robert\Downloads\unconfirmed 71581.crdownload Win32/Adware.Gamevance.AK application
C:\Users\All Users\gcdef32.exe a variant of Win32/Kryptik.QHP trojan
C:\Users\All Users\Fighters\SLOW-PCfighter\InstallCache\{C3F5F5A2-6DC3-43D1-9811-B9713A0C67E6}\SLOW-PCfighter.msi a variant of Win32/SlowPCfighter application
C:\Users\robert\AppData\Local\Google\Chrome\User Data\Default\Default\pfgolekbbbmhhbbhhbfogjahhmgmlpia\contentscript.js Win32/TrojanDownloader.Tracur.F trojan
C:\Users\robert\AppData\Local\Temp\C504.tmp Win32/Olmarik.AWO trojan
C:\Users\robert\AppData\Local\Temp\C8CB.tmp Win32/Olmarik.AWO trojan
C:\Users\robert\AppData\Local\Temp(28)\A902.tmp a variant of Win32/Kryptik.RLK trojan
C:\Users\robert\AppData\Local\Temp(28)\thpm4913857023281553869.tmp a variant of Win32/Kryptik.RLK trojan
C:\Users\robert\AppData\LocalLow\Guffins\bar\setups\GuffinsAuto.exe probably a variant of Win32/Toolbar.MyWebSearch.L application
C:\Users\robert\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\55\6e9395f7-7da530fd a variant of Win32/Kryptik.PUI trojan
C:\Users\robert\AppData\LocalLow\Zwinky_42EI\Installr\Cache\07BE66B6.exe a variant of Win32/Toolbar.MyWebSearch.O application
C:\Users\robert\AppData\Roaming\Mozilla\Firefox\Profiles\95z9sp1d.default\gsl.dll Win32/Adware.GreenAV application
C:\Users\robert\Contacts\setup.exe Win32/TrojanDownloader.FakeAlert.ALS trojan
C:\Program Files\Active PC Optimizer\ActivePCOptimizer.exe a variant of Win32/Adware.RegistryMum application
C:\ProgramData\gcdef32.exe a variant of Win32/Kryptik.QHP trojan
C:\ProgramData\Fighters\SLOW-PCfighter\InstallCache\{C3F5F5A2-6DC3-43D1-9811-B9713A0C67E6}\SLOW-PCfighter.msi a variant of Win32/SlowPCfighter application

____________________________________________________

From the looks of your SecurityCheck log, I can see that we have some outdated programs that need to be updated.

Lets address those programs that need updating now!

Your SecurityCheck log indicates that your version of Flash Player is outdated. This is a vulnerability that needs to be addressed. Please remove the outdated version of Flash Player and then install the latest version.

Java Outdated

Important Note: Your version of Java is out of date. Older versions have vulnerabilities that malicious sites can use to exploit and infect your system.

• Microsoft: ‘Unprecedented Wave of Java Exploitation’
• Drive-by Trojan preying on out-of-date Java installations
• Ghosts of Java Haunt Users

Please follow these steps to remove older version Java components and update:

• Download the latest version of Java Runtime Environment (JRE) Version 7 and save it to your desktop.
• Look for "Java Platform, Standard Edition".
• Click the "Download JRE" button to the right.
• Read the License Agreement, and then check the box that says: "Accept License Agreement".
• From the list, select your OS and Platform:
  
  • 32-bit Select: Windows x86 Offline.
  • 64-bit Select: Windows x64.
• If a download for an Offline Installation is available, it is recommended to choose that and save the file to your desktop.
• Close any programs you may have running - especially your web browser.

Go to > Control Panel, double-click on Add/Remove Programs or Programs and Features in Vista/Windows 7 and remove all older versions of Java.

• Check (highlight) any item with Java Runtime Environment (JRE or J2SE) in the name.
• Click the Remove or Change/Remove button and follow the onscreen instructions for the Java uninstaller.
• Repeat as many times as necessary to remove each Java versions.
• Reboot your computer once all Java components are removed.
• Then from your desktop double-click on jre-7-windows-i586.exe to install the newest version.
• If using Windows 7 or Vista and the installer refuses to launch due to insufficient user permissions, then Run As Administrator.
• When the Java Setup - Welcome window opens, click the Install > button.
• If offered to install a Toolbar, just uncheck the box before continuing unless you want it.
• The McAfee Security Scan Plus tool is installed by default unless you uncheck the McAfee installation box when updating Java.

Note: The Java Quick Starter (JQS.exe) adds a service to improve the initial startup time of Java applets and applications but it's not necessary.
To disable the JQS service if you don't want to use it:

• Go to Start > Control Panel > Java > Advanced > Miscellaneous and uncheck the box for Java Quick Starter.
• Click Ok and reboot your computer.

NEXT



OTL Fix

We need to run an OTL Fix

• Please reopen on your desktop.
• Copy and Paste the following code into the textbox.
  

  :Services
  :OTL
  
  :Reg
  
  :Files
  C:\Users\All Users\gcdef32.exe
  C:\Users\All Users\Fighters\SLOW-PCfighter\InstallCache\{C3F5F5A2-6DC3-43D1-9811-B9713A0C67E6}\SLOW-PCfighter.msi
  C:\Users\robert\AppData\Local\Google\Chrome\User Data\Default\Default\pfgolekbbbmhhbbhhbfogjahhmgmlpia\
  C:\Users\robert\AppData\Local\Temp\C504.tmp
  C:\Users\robert\AppData\Local\Temp\C8CB.tmp
  C:\Users\robert\AppData\Local\Temp(28)\A902.tmp
  C:\Users\robert\AppData\Local\Temp(28)\
  C:\Users\robert\AppData\Local\Temp(28)\thpm4913857023281553869.tmp
  C:\Users\robert\AppData\LocalLow\Guffins\bar\setups\GuffinsAuto.exe
  C:\Users\robert\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\55\6e9395f7-7da530fd
  C:\Users\robert\AppData\LocalLow\Zwinky_42EI\Installr\Cache\07BE66B6.exe
  C:\Users\robert\AppData\Roaming\Mozilla\Firefox\Profiles\95z9sp1d.default\gsl.dll
  C:\Users\robert\Contacts\setup.exe
  C:\Users\robert\Documents\jared lee hooray for hollywood live.snd
  C:\Users\robert\Documents\FrostWire\Saved\hooray for hollywood jared lee.mp3
  C:\Users\robert\Documents\New Folder\i toons\SetupPlaySushi.exe
  C:\Users\robert\Downloads\PlayItAll-Setup-win32_2.exe
  C:\Users\robert\Downloads\SetupGamevance.exe
  C:\Users\robert\Downloads\unconfirmed 25246.crdownload
  C:\Users\robert\Downloads\unconfirmed 71581.crdownload
  C:\Program Files\Active PC Optimizer\ActivePCOptimizer.exe
  C:\ProgramData\gcdef32.exe
  C:\ProgramData\Fighters\SLOW-PCfighter\InstallCache\{C3F5F5A2-6DC3-43D1-9811-B9713A0C67E6}\SLOW-PCfighter.msi
  ipconfig /flushdns /c
  :Commands
  [purity]
  [resethosts]
  [CreateRestorePoint]
  [emptytemp]
  [EMPTYFLASH]
  

• Push
• OTL may ask to reboot the machine. Please do so if asked.
• Click the OK button.
• A report will open. Copy and Paste that report in your next reply.
• If the machine reboots, the log will be located at C:\_OTL\MovedFiles\mmddyyyy_hhmmss.log, where mmddyyyy_hhmmss is the date of the tool run.

NEXT:



Re-Running OTL

We need to create a New FULL OTL Report

• Please download OTL from here if you have not done so already:
  
  • Main Mirror
  • Mirror
• Save it to your desktop.
• Double click on the icon on your desktop.
• Click the "Scan All Users" checkbox.
• Change the "Extra Registry" option to "SafeList"
• Push the button.
• Two reports will open, copy and paste them in a reply here:
  
  • OTL.txt <-- Will be opened
  • Extras.txt <-- Will be minimized

NEXT:



What outstanding issues (if any) are you still experiencing with your computer?

[Nstory]

Hello ST,
there is quite a few things missing from the 'start' menu, all the program files are gone, and windows still looks outdated. Also, I was here to do the tasks on the 27th, but wasn't able to finish everything, so the mbam log is from that date...

Malwarebytes' Anti-Malware 1.51.1.1800
www.malwarebytes.org

Database version: 7589

Windows 6.0.6002 Service Pack 2
Internet Explorer 8.0.6001.19120

8/27/2011 6:01:27 PM
mbam-log-2011-08-27 (18-01-27).txt

Scan type: Quick scan
Objects scanned: 171707
Time elapsed: 3 minute(s), 18 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 1
Registry Values Infected: 7
Registry Data Items Infected: 4
Folders Infected: 0
Files Infected: 70

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_CURRENT_USER\SOFTWARE\exqonczctruceg (Malware.Trace) -> Quarantined and deleted successfully.

Registry Values Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Ilozul (IPH.Trojan.Hiloti.7B) -> Value: Ilozul -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\conhost (Trojan.Agent) -> Value: conhost -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Security Protection (Spyware.Passwords.XGen) -> Value: Security Protection -> Quarantined and deleted successfully.
HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Usisacanuver (Trojan.Hiloti) -> Value: Usisacanuver -> Quarantined and deleted successfully.
HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\UYVCmBdwfK (Trojan.FakeAlert) -> Value: UYVCmBdwfK -> Quarantined and deleted successfully.
HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\mD01602LoIkK01602 (Trojan.FakeAlert) -> Value: mD01602LoIkK01602 -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN\compmgm (Trojan.Agent) -> Value: compmgm -> Quarantined and deleted successfully.

Registry Data Items Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\FIREFOX.EXE\shell\open\command\(default) (Hijack.StartMenuInternet) -> Bad: ("C:\Windows\system32\config\systemprofile\AppData\Local\brf.exe" -a "C:\Program Files\Mozilla Firefox\firefox.exe") Good: (firefox.exe) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\FIREFOX.EXE\shell\safemode\command\(default) (Hijack.StartMenuInternet) -> Bad: ("C:\Windows\system32\config\systemprofile\AppData\Local\brf.exe" -a "C:\Program Files\Mozilla Firefox\firefox.exe" -safe-mode) Good: (firefox.exe -safe-mode) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\IEXPLORE.EXE\shell\open\command\(default) (Hijack.StartMenuInternet) -> Bad: ("C:\Windows\system32\config\systemprofile\AppData\Local\brf.exe" -a "C:\Program Files\Internet Explorer\iexplore.exe") Good: (iexplore.exe) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr (PUM.Hijack.TaskManager) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

Folders Infected:
(No malicious items detected)

Files Infected:
c:\Windows\System32\config\systemprofile\AppData\Local\oqopeqepijo.dll (IPH.Trojan.Hiloti.7B) -> Quarantined and deleted successfully.
c:\Windows\System32\config\systemprofile\AppData\Roaming\microsoft\conhost.exe (Trojan.Agent) -> Quarantined and deleted successfully.
c:\programdata\defender.exe (Spyware.Passwords.XGen) -> Quarantined and deleted successfully.
c:\Windows\System32\config\systemprofile\AppData\Local\minensm.dll (Trojan.Hiloti) -> Quarantined and deleted successfully.
c:\programdata\uyvcmbdwfk.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
c:\programdata\md01602loikk01602\md01602loikk01602.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
c:\programdata\12B6.tmp (Spyware.Passwords.XGen) -> Quarantined and deleted successfully.
c:\programdata\223F.tmp (Spyware.Passwords.XGen) -> Quarantined and deleted successfully.
c:\programdata\227D.tmp (Spyware.Passwords.XGen) -> Quarantined and deleted successfully.
c:\programdata\25A8.tmp (Spyware.Passwords.XGen) -> Quarantined and deleted successfully.
c:\programdata\4B33.tmp (Spyware.Passwords.XGen) -> Quarantined and deleted successfully.
c:\programdata\8352.tmp (Spyware.Passwords.XGen) -> Quarantined and deleted successfully.
c:\programdata\p1kalmig2kb7fz.exe (Rogue.FakeHDD) -> Quarantined and deleted successfully.
c:\programdata\E39A.tmp (Spyware.Passwords.XGen) -> Quarantined and deleted successfully.
c:\programdata\gcdef32.exe (Trojan.Tracur) -> Quarantined and deleted successfully.
c:\Windows\System32\config\systemprofile\AppData\Roaming\dwm.exe (Trojan.Agent) -> Quarantined and deleted successfully.
c:\Windows\temp\0.0319854940890556.exe (Trojan.Hiloti) -> Quarantined and deleted successfully.
c:\Windows\temp\0.06092616245536264.exe (Trojan.Hiloti) -> Quarantined and deleted successfully.
c:\Windows\temp\0.09910381875861107.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
c:\Windows\temp\0.1466922644871117.exe (Trojan.Hiloti) -> Quarantined and deleted successfully.
c:\Windows\temp\0.20896954127007117.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
c:\Windows\temp\0.2126185066102696.exe (Trojan.Hiloti) -> Quarantined and deleted successfully.
c:\Windows\temp\0.2194242830113493.exe (Trojan.Hiloti) -> Quarantined and deleted successfully.
c:\Windows\temp\0.2523594537871795.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
c:\Windows\temp\0.3005737371557411.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
c:\Windows\temp\0.32036766833753993.exe (Spyware.Passwords.XGen) -> Quarantined and deleted successfully.
c:\Windows\temp\0.3552576835064556.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
c:\Windows\temp\0.39211310616914263.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
c:\Windows\temp\0.3953362807668781.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
c:\Windows\temp\0.40127530151173585.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
c:\Windows\temp\0.4375651234245157.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
c:\Windows\temp\0.4917038883876028.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
c:\Windows\temp\0.6012705448052178.exe (Trojan.Hiloti) -> Quarantined and deleted successfully.
c:\Windows\temp\0.6027112441742067.exe (Trojan.Hiloti) -> Quarantined and deleted successfully.
c:\Windows\temp\0.6582735699132214.exe (Trojan.Hiloti) -> Quarantined and deleted successfully.
c:\Windows\temp\0.6758794793060697.exe (Trojan.Hiloti) -> Quarantined and deleted successfully.
c:\Windows\temp\0.7835561879406773.exe (Trojan.Hiloti) -> Quarantined and deleted successfully.
c:\Windows\temp\0.817377430952529.exe (Trojan.Hiloti) -> Quarantined and deleted successfully.
c:\Windows\temp\0.8373662701068801.exe (Trojan.Hiloti) -> Quarantined and deleted successfully.
c:\Windows\temp\0.8565862179857867.exe (Trojan.Hiloti) -> Quarantined and deleted successfully.
c:\Windows\temp\0.8865418134536122.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
c:\Windows\temp\0.9696990763485082.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
c:\Windows\temp\srv1398.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
c:\Windows\temp\srv1664.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
c:\Windows\temp\srvC78.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
c:\Windows\temp\sxocnemawr.exe (Trojan.Hiloti) -> Quarantined and deleted successfully.
c:\Windows\temp\thpm3822226237040614465.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
c:\Windows\temp\C995.tmp (Spyware.Passwords.XGen) -> Quarantined and deleted successfully.
c:\Windows\temp\CF67.tmp (Spyware.Passwords.XGen) -> Quarantined and deleted successfully.
c:\Windows\temp\csrss.exe (Trojan.Agent) -> Quarantined and deleted successfully.
c:\Windows\temp\D1E0.tmp (Spyware.Passwords.XGen) -> Quarantined and deleted successfully.
c:\Windows\temp\E82C.tmp (Spyware.Passwords.XGen) -> Quarantined and deleted successfully.
c:\Windows\temp\EF5D.tmp (Spyware.Passwords.XGen) -> Quarantined and deleted successfully.
c:\Windows\temp\F382.tmp (Spyware.Passwords.XGen) -> Quarantined and deleted successfully.
c:\Windows\temp\F871.tmp (Spyware.Passwords.XGen) -> Quarantined and deleted successfully.
c:\Windows\temp\FA29.tmp (Spyware.Passwords.XGen) -> Quarantined and deleted successfully.
c:\Windows\temp\jar_cache8173986841229030768.tmp (Trojan.FakeAlert) -> Quarantined and deleted successfully.
c:\Windows\temp\jar_cache227502048822369890.tmp (Trojan.FakeAlert) -> Quarantined and deleted successfully.
c:\Windows\temp\21F2.tmp (Spyware.Passwords.XGen) -> Quarantined and deleted successfully.
c:\Windows\temp\68FF.tmp (Spyware.Passwords.XGen) -> Quarantined and deleted successfully.
c:\Windows\temp\7F12.tmp (Rootkit.TDSS) -> Quarantined and deleted successfully.
c:\Windows\temp\82CA.tmp (Rootkit.TDSS) -> Quarantined and deleted successfully.
c:\Windows\temp\A72.tmp (Rootkit.TDSS) -> Quarantined and deleted successfully.
c:\Windows\temp\B3F3.tmp (Spyware.Passwords.XGen) -> Quarantined and deleted successfully.
c:\Windows\System32\config\systemprofile\local settings\application data\minensm.dll (Trojan.Hiloti) -> Quarantined and deleted successfully.
c:\Windows\scvhost.exe (Trojan.Agent) -> Quarantined and deleted successfully.
c:\Windows\System32\config\systemprofile\application data\dwm.exe (Trojan.Agent) -> Quarantined and deleted successfully.
c:\Windows\System32\config\systemprofile\AppData\Roaming\Adobe\shed\thr1.chm (Malware.Trace) -> Quarantined and deleted successfully.
c:\Windows\System32\config\systemprofile\AppData\Roaming\Adobe\plugs\mmc18793393.txt (Trojan.Agent.Gen) -> Quarantined and deleted successfully.
c:\Windows\System32\config\systemprofile\AppData\Roaming\Adobe\plugs\mmc94.exe (Trojan.Agent.Gen) -> Quarantined and deleted successfully.

OTL
All processes killed
========== SERVICES/DRIVERS ==========
========== OTL ==========
========== REGISTRY ==========
========== FILES ==========
File\Folder C:\Users\All Users\gcdef32.exe not found.
C:\Users\All Users\Fighters\SLOW-PCfighter\InstallCache\{C3F5F5A2-6DC3-43D1-9811-B9713A0C67E6}\SLOW-PCfighter.msi moved successfully.
C:\Users\robert\AppData\Local\Google\Chrome\User Data\Default\Default\pfgolekbbbmhhbbhhbfogjahhmgmlpia folder moved successfully.
C:\Users\robert\AppData\Local\Temp\C504.tmp moved successfully.
C:\Users\robert\AppData\Local\Temp\C8CB.tmp moved successfully.
C:\Users\robert\AppData\Local\Temp(28)\A902.tmp moved successfully.
C:\Users\robert\AppData\Local\Temp(28)\WPDNSE folder moved successfully.
C:\Users\robert\AppData\Local\Temp(28)\svflp.tmp folder moved successfully.
C:\Users\robert\AppData\Local\Temp(28)\Low\FCSB000063443\cache-robert folder moved successfully.
C:\Users\robert\AppData\Local\Temp(28)\Low\FCSB000063443\cache folder moved successfully.
C:\Users\robert\AppData\Local\Temp(28)\Low\FCSB000063443 folder moved successfully.
C:\Users\robert\AppData\Local\Temp(28)\Low folder moved successfully.
C:\Users\robert\AppData\Local\Temp(28)\hsperfdata_robert folder moved successfully.
C:\Users\robert\AppData\Local\Temp(28) folder moved successfully.
File\Folder C:\Users\robert\AppData\Local\Temp(28)\thpm4913857023281553869.tmp not found.
C:\Users\robert\AppData\LocalLow\Guffins\bar\setups\GuffinsAuto.exe moved successfully.
C:\Users\robert\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\55\6e9395f7-7da530fd moved successfully.
C:\Users\robert\AppData\LocalLow\Zwinky_42EI\Installr\Cache\07BE66B6.exe moved successfully.
C:\Users\robert\AppData\Roaming\Mozilla\Firefox\Profiles\95z9sp1d.default\gsl.dll moved successfully.
C:\Users\robert\Contacts\setup.exe moved successfully.
C:\Users\robert\Documents\jared lee hooray for hollywood live.snd moved successfully.
C:\Users\robert\Documents\FrostWire\Saved\hooray for hollywood jared lee.mp3 moved successfully.
C:\Users\robert\Documents\New Folder\i toons\SetupPlaySushi.exe moved successfully.
C:\Users\robert\Downloads\PlayItAll-Setup-win32_2.exe moved successfully.
C:\Users\robert\Downloads\SetupGamevance.exe moved successfully.
C:\Users\robert\Downloads\unconfirmed 25246.crdownload moved successfully.
C:\Users\robert\Downloads\unconfirmed 71581.crdownload moved successfully.
C:\Program Files\Active PC Optimizer\ActivePCOptimizer.exe moved successfully.
File\Folder C:\ProgramData\gcdef32.exe not found.
File\Folder C:\ProgramData\Fighters\SLOW-PCfighter\InstallCache\{C3F5F5A2-6DC3-43D1-9811-B9713A0C67E6}\SLOW-PCfighter.msi not found.
< ipconfig /flushdns /c >
Windows IP Configuration
Successfully flushed the DNS Resolver Cache.
J:\cmd.bat deleted successfully.
J:\cmd.txt deleted successfully.
========== COMMANDS ==========
C:\Windows\System32\drivers\etc\Hosts moved successfully.
HOSTS file reset successfully


[EMPTYTEMP]

User: All Users

User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: Public
->Temp folder emptied: 0 bytes

User: robert
->Temp folder emptied: 93563590 bytes
->Temporary Internet Files folder emptied: 10172280 bytes
->Java cache emptied: 36799 bytes
->FireFox cache emptied: 617432958 bytes
->Google Chrome cache emptied: 0 bytes
->Flash cache emptied: 23491 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 761682 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 57097504 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 0 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 743.00 mb


[EMPTYFLASH]

User: All Users

User: Default
->Flash cache emptied: 0 bytes

User: Default User
->Flash cache emptied: 0 bytes

User: Public

User: robert
->Flash cache emptied: 0 bytes

Total Flash Files Cleaned = 0.00 mb


OTL by OldTimer - Version 3.2.26.7 log created on 08312011_091021

Files\Folders moved on Reboot...

Registry entries deleted on Reboot...

OTL:

OTL logfile created on: 8/31/2011 9:20:26 AM - Run 2
OTL by OldTimer - Version 3.2.26.7 Folder = J:\
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.19120)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

2.00 Gb Total Physical Memory | 1.14 Gb Available Physical Memory | 56.89% Memory free
4.24 Gb Paging File | 3.29 Gb Available in Paging File | 77.57% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 138.95 Gb Total Space | 73.44 Gb Free Space | 52.85% Space Free | Partition Type: NTFS
Drive D: | 10.00 Gb Total Space | 3.29 Gb Free Space | 32.85% Space Free | Partition Type: NTFS
Drive J: | 1.86 Gb Total Space | 1.44 Gb Free Space | 77.42% Space Free | Partition Type: FAT

Computer Name: ROBERT-PC | User Name: robert | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2011/08/31 09:08:56 | 000,580,608 | ---- | M] (OldTimer Tools) -- J:\OTL.exe
PRC - [2011/06/19 14:27:27 | 000,924,632 | -H-- | M] (Mozilla Corporation) -- C:\Program Files\Mozilla Firefox\firefox.exe
PRC - [2011/06/06 12:55:28 | 000,064,952 | -H-- | M] (Adobe Systems Incorporated) -- C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe
PRC - [2011/04/22 05:21:10 | 000,247,728 | -H-- | M] (TomTom) -- C:\Program Files\TomTom HOME 2\TomTomHOMERunner.exe
PRC - [2011/04/22 05:21:10 | 000,092,592 | -H-- | M] (TomTom) -- C:\Program Files\TomTom HOME 2\TomTomHOMEService.exe
PRC - [2010/10/27 20:17:52 | 000,207,424 | -H-- | M] (ArcSoft Inc.) -- C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe
PRC - [2010/10/19 05:53:48 | 000,983,480 | -H-- | M] (MusicLab, LLC) -- C:\Program Files\BearShare Applications\MediaBar\Datamngr\datamngrUI.exe
PRC - [2010/08/25 11:27:44 | 000,309,824 | -H-- | M] (ArcSoft Inc.) -- C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ArcCon.ac
PRC - [2010/04/07 12:55:58 | 001,553,344 | -H-- | M] (Weskysoft Inc.) -- C:\Program Files\Active PC Optimizer\ActivePCOptimizerService.exe
PRC - [2010/03/18 11:19:26 | 000,113,152 | -H-- | M] (ArcSoft Inc.) -- C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe
PRC - [2009/04/10 23:27:36 | 002,926,592 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe
PRC - [2009/02/06 13:44:40 | 003,572,984 | -H-- | M] (Veoh Networks) -- C:\Program Files\Veoh Networks\VeohWebPlayer\veohwebplayer.exe
PRC - [2008/11/09 13:48:14 | 000,602,392 | -H-- | M] (Yahoo! Inc.) -- C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe
PRC - [2008/04/28 14:56:28 | 000,161,048 | -H-- | M] (Stardock Corporation) -- C:\Program Files\Dell\DellDock\DockLogin.exe
PRC - [2008/03/11 10:44:38 | 000,202,544 | -H-- | M] (SupportSoft, Inc.) -- C:\Program Files\Dell Support Center\bin\sprtsvc.exe
PRC - [2008/03/11 10:44:36 | 000,202,544 | -H-- | M] (SupportSoft, Inc.) -- C:\Program Files\Dell Support Center\bin\sprtcmd.exe
PRC - [2008/01/24 23:38:12 | 002,458,128 | -H-- | M] (McAfee, Inc.) -- c:\Program Files\Common Files\McAfee\MNA\McNASvc.exe
PRC - [2007/11/01 17:12:38 | 000,582,992 | -H-- | M] (McAfee, Inc.) -- c:\Program Files\McAfee.com\Agent\mcagent.exe
PRC - [2003/08/29 19:05:35 | 000,360,448 | ---- | M] () -- C:\Program Files\SpywareGuard\sgmain.exe
PRC - [2003/08/29 11:14:56 | 000,233,472 | ---- | M] () -- C:\Program Files\SpywareGuard\sgbhp.exe


========== Modules (No Company Name) ==========

MOD - [2011/08/19 13:19:43 | 005,450,752 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Xml\4c3cda96b8f12220da20f2f8d1b9439c\System.Xml.ni.dll
MOD - [2011/08/19 13:17:52 | 007,950,848 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System\b9ea0d414c4861120bfb7365d8ec0939\System.ni.dll
MOD - [2011/08/19 13:17:45 | 011,490,816 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\f6deb187f24bb3185841092b89fbfdbb\mscorlib.ni.dll
MOD - [2011/06/19 14:27:28 | 001,874,904 | -H-- | M] () -- C:\Program Files\Mozilla Firefox\mozjs.dll
MOD - [2009/11/03 16:51:42 | 000,067,872 | -H-- | M] () -- C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll
MOD - [2009/02/06 13:34:24 | 006,661,120 | -H-- | M] () -- C:\Program Files\Veoh Networks\VeohWebPlayer\QtGui4.dll
MOD - [2009/02/06 13:34:24 | 001,916,928 | -H-- | M] () -- C:\Program Files\Veoh Networks\VeohWebPlayer\QtCore4.dll
MOD - [2009/02/06 13:34:24 | 000,770,560 | -H-- | M] () -- C:\Program Files\Veoh Networks\VeohWebPlayer\QtNetwork4.dll
MOD - [2008/08/21 02:13:06 | 000,159,744 | -H-- | M] () -- C:\Windows\System32\atitmmxx.dll
MOD - [2003/08/29 19:05:35 | 000,360,448 | ---- | M] () -- C:\Program Files\SpywareGuard\sgmain.exe
MOD - [2003/08/29 11:14:56 | 000,233,472 | ---- | M] () -- C:\Program Files\SpywareGuard\sgbhp.exe


========== Win32 Services (SafeList) ==========

SRV - File not found [Auto | Stopped] -- -- (0286771307566251mcinstcleanup) McAfee Application Installer Cleanup (0286771307566251)
SRV - [2011/06/06 12:55:28 | 000,064,952 | -H-- | M] (Adobe Systems Incorporated) [Auto | Running] -- C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice)
SRV - [2011/04/22 05:21:10 | 000,092,592 | -H-- | M] (TomTom) [Auto | Running] -- C:\Program Files\TomTom HOME 2\TomTomHOMEService.exe -- (TomTomHOMEService)
SRV - [2010/04/21 10:46:17 | 000,373,760 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Windows\System32\inetsrv\iisw3adm.dll -- (WAS)
SRV - [2010/04/21 10:46:17 | 000,373,760 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\System32\inetsrv\iisw3adm.dll -- (W3SVC)
SRV - [2010/04/07 12:55:58 | 001,553,344 | -H-- | M] (Weskysoft Inc.) [Auto | Running] -- C:\Program Files\Active PC Optimizer\ActivePCOptimizerService.exe -- (RegMumService)
SRV - [2010/03/18 11:19:26 | 000,113,152 | -H-- | M] (ArcSoft Inc.) [Auto | Running] -- C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe -- (ACDaemon)
SRV - [2010/01/15 05:49:20 | 000,227,232 | -H-- | M] (McAfee, Inc.) [On_Demand | Stopped] -- C:\Program Files\McAfee Security Scan\2.0.181\McCHSvc.exe -- (McComponentHostService)
SRV - [2009/12/08 15:41:42 | 000,120,232 | -H-- | M] (stumbleupon.com) [On_Demand | Stopped] -- C:\Program Files\StumbleUpon\StumbleUponUpdateService.exe -- (StumbleUponUpdateService)
SRV - [2009/04/10 23:28:17 | 000,052,224 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\System32\inetsrv\apphostsvc.dll -- (AppHostSvc)
SRV - [2008/11/09 13:48:14 | 000,602,392 | -H-- | M] (Yahoo! Inc.) [Auto | Running] -- C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe -- (YahooAUService)
SRV - [2008/08/28 08:25:40 | 000,016,680 | -H-- | M] (Citrix Online, a division of Citrix Systems, Inc.) [On_Demand | Stopped] -- C:\Program Files\Citrix\GoToAssist\514\g2aservice.exe -- (GoToAssist)
SRV - [2008/04/28 14:56:28 | 000,161,048 | -H-- | M] (Stardock Corporation) [Auto | Running] -- C:\Program Files\Dell\DellDock\DockLogin.exe -- (DockLoginService)
SRV - [2008/03/11 10:44:38 | 000,202,544 | -H-- | M] (SupportSoft, Inc.) [Auto | Running] -- C:\Program Files\Dell Support Center\bin\sprtsvc.exe -- (sprtsvc_dellsupportcenter) SupportSoft Sprocket Service (dellsupportcenter)
SRV - [2008/01/24 23:38:12 | 002,458,128 | -H-- | M] (McAfee, Inc.) [Auto | Running] -- c:\Program Files\Common Files\McAfee\MNA\McNASvc.exe -- (McNASvc)
SRV - [2008/01/09 14:50:22 | 000,767,976 | -H-- | M] (McAfee, Inc.) [Auto | Stopped] -- C:\Program Files\McAfee\MSC\mcmscsvc.exe -- (mcmscsvc)
SRV - [2007/12/11 10:33:42 | 000,358,224 | -H-- | M] (McAfee, Inc.) [Auto | Stopped] -- c:\Program Files\Common Files\McAfee\McProxy\McProxy.exe -- (McProxy)
SRV - [2007/12/05 08:04:10 | 000,695,624 | -H-- | M] (McAfee, Inc.) [On_Demand | Stopped] -- C:\Program Files\McAfee\VirusScan\mcsysmon.exe -- (McSysmon)
SRV - [2007/07/24 10:02:14 | 000,144,704 | -H-- | M] (McAfee, Inc.) [Unknown | Stopped] -- C:\Program Files\McAfee\VirusScan\Mcshield.exe -- (McShield)
SRV - [2006/11/02 05:36:18 | 000,029,696 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\System32\iprip.dll -- (iprip)


========== Driver Services (SafeList) ==========

DRV - [2010/06/24 15:53:04 | 000,021,504 | -H-- | M] (http://libusb-win32.sourceforge.net) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\libusb0.sys -- (libusb0)
DRV - [2010/05/10 11:41:30 | 000,067,656 | -H-- | M] (SUPERAdBlocker.com and SUPERAntiSpyware.com) [Kernel | System | Running] -- C:\Program Files\SUPERAntiSpyware\SASKUTIL.SYS -- (SASKUTIL)
DRV - [2010/03/10 21:02:38 | 000,056,352 | -H-- | M] (Exent Technologies Ltd.) [Kernel | Auto | Running] -- C:\Program Files\Free Ride Games\X4HSEx.sys -- (X4HSEx)
DRV - [2010/02/17 11:25:48 | 000,012,872 | -H-- | M] (SUPERAdBlocker.com and SUPERAntiSpyware.com) [Kernel | System | Running] -- C:\Program Files\SUPERAntiSpyware\sasdifsv.sys -- (SASDIFSV)
DRV - [2008/08/21 04:54:10 | 003,928,576 | -H-- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\atikmdag.sys -- (R300)
DRV - [2008/08/21 04:54:10 | 003,928,576 | -H-- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\atikmdag.sys -- (atikmdag)
DRV - [2008/01/20 19:23:26 | 000,045,624 | -H-- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\tpm.sys -- (TPM)
DRV - [2007/12/02 10:51:42 | 000,040,488 | -H-- | M] (McAfee, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\mfesmfk.sys -- (mfesmfk)
DRV - [2007/11/22 04:44:08 | 000,201,320 | -H-- | M] (McAfee, Inc.) [Kernel | System | Running] -- C:\Windows\System32\drivers\mfehidk.sys -- (mfehidk)
DRV - [2007/11/22 04:44:08 | 000,079,304 | -H-- | M] (McAfee, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\mfeavfk.sys -- (mfeavfk)
DRV - [2007/11/22 04:44:08 | 000,035,240 | -H-- | M] (McAfee, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\mfebopk.sys -- (mfebopk)
DRV - [2007/11/22 04:44:04 | 000,033,832 | -H-- | M] (McAfee, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\mferkdk.sys -- (mferkdk)
DRV - [2007/07/13 04:21:12 | 000,125,728 | -H-- | M] () [Kernel | System | Stopped] -- C:\Windows\System32\drivers\Mpfp.sys -- (MPFP)
DRV - [2007/04/29 01:42:24 | 000,228,224 | -H-- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\e1e6032.sys -- (e1express) Intel®
DRV - [2006/10/18 11:08:18 | 000,258,048 | -H-- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\HSXHWBS2.sys -- (HSXHWBS2)
DRV - [2006/08/04 17:39:10 | 000,008,192 | -H-- | M] (Conexant Systems, Inc.) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\XAudio.sys -- (XAudio)
DRV - [2004/09/29 13:36:29 | 000,015,360 | -H-- | M] (Motorola Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\NetMotCM.sys -- (ndiscm)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\..\URLSearchHook: {72b90932-6338-4345-9fc4-4f94984ed241} - C:\Program Files\Morphster\tbMorp.dll (Conduit Ltd.)
IE - HKLM\..\URLSearchHook: {9565115d-c7d6-46d3-bd63-b67b481a4368} - C:\Program Files\PageRage\tbPage.dll (Conduit Ltd.)


IE - HKU\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.google.co...=us&ibd=6080828
IE - HKU\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co...=us&ibd=6080828
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 1
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = <local>
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = http=127.0.0.1:55778

IE - HKU\S-1-5-18\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.google.co...=us&ibd=6080828
IE - HKU\S-1-5-18\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co...=us&ibd=6080828
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 1
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = <local>
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = http=127.0.0.1:55778

IE - HKU\S-1-5-19\SOFTWARE\Microsoft\Internet Explorer\Main,XMLHTTP_UUID_Default = F6 AB 30 01 24 7A 45 40 81 9D 2A 46 D3 76 F7 CE [binary data]

IE - HKU\S-1-5-20\SOFTWARE\Microsoft\Internet Explorer\Main,XMLHTTP_UUID_Default = F6 AB 30 01 24 7A 45 40 81 9D 2A 46 D3 76 F7 CE [binary data]

IE - HKU\S-1-5-21-695326800-797908242-393843667-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = Preserve
IE - HKU\S-1-5-21-695326800-797908242-393843667-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page =
IE - HKU\S-1-5-21-695326800-797908242-393843667-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Secondary Start Pages = [Binary data over 100 bytes]
IE - HKU\S-1-5-21-695326800-797908242-393843667-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://www.msn.com/?ocid=iehp
IE - HKU\S-1-5-21-695326800-797908242-393843667-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = en-us
IE - HKU\S-1-5-21-695326800-797908242-393843667-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 00 21 76 9A C1 66 CC 01 [binary data]
IE - HKU\S-1-5-21-695326800-797908242-393843667-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Restore = http://search.condui...&ctid=CT2746180
IE - HKU\S-1-5-21-695326800-797908242-393843667-1000\SOFTWARE\Microsoft\Internet Explorer\Main,XMLHTTP_UUID_Default = F6 AB 30 01 24 7A 45 40 81 9D 2A 46 D3 76 F7 CE [binary data]
IE - HKU\S-1-5-21-695326800-797908242-393843667-1000\..\URLSearchHook: {81017EA9-9AA8-4A6A-9734-7AF40E7D593F} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\YTNavAssist.dll (Yahoo! Inc.)
IE - HKU\S-1-5-21-695326800-797908242-393843667-1000\..\URLSearchHook: {E38FA08E-F56A-4169-ABF5-5C71E3C153A1} - C:\Program Files\Freeze.com\NetAssistant\NetAssistant.dll (W3i, LLC)
IE - HKU\S-1-5-21-695326800-797908242-393843667-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 1
IE - HKU\S-1-5-21-695326800-797908242-393843667-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = <local>

========== FireFox ==========

FF - prefs.js..browser.search.defaultenginename: "BearShare Web Search"
FF - prefs.js..browser.search.defaulturl: "http://www.google.co...-8&oe=UTF-8&q="
FF - prefs.js..browser.search.order.1: "BearShare Web Search"
FF - prefs.js..browser.search.selectedEngine: "Yahoo"
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "http://home.mywebsea...3-CBB72A4D6FC1"
FF - prefs.js..keyword.URL: "http://search.bearsh...&systemid=2&q="


FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\Windows\system32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@exent.com/npExentCtl,version=7.0.0.0: C:\Program Files\Free Ride Games\npExentCtl.dll (Exent Technologies Ltd.)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre7\bin\new_plugin\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\4.0.60531.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@movenetworks.com/Quantum Media Player: C:\Users\robert\AppData\Roaming\Move Networks\plugins\npqmp071701000002.dll (Move Networks)
FF - HKLM\Software\MozillaPlugins\@veoh.com/VeohTVPlugin: C:\Program Files\Veoh Networks\VeohWebPlayer\NPVeohTVPlugin.dll (Veoh Networks )
FF - HKLM\Software\MozillaPlugins\@veoh.com/VeohWebPlayer: C:\Program Files\Veoh Networks\VeohWebPlayer\npWebPlayerVideoPluginATL.dll (Veoh)
FF - HKLM\Software\MozillaPlugins\@zylom.com/ZylomGamesPlayer: C:\Users\robert\AppData\Roaming\Zylom\ZylomGamesPlayer\npzylomgamesplayer.dll (Zylom)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKCU\Software\MozillaPlugins\@movenetworks.com/Quantum Media Player: C:\Users\robert\AppData\Roaming\Move Networks\plugins\npqmp071701000002.dll (Move Networks)
FF - HKCU\Software\MozillaPlugins\@unity3d.com/UnityPlayer,version=1.0: C:\Users\robert\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{B728AB94-9BC7-49b7-B76A-422BB31B2FD0}: C:\Program Files\ArcSoft\Media Converter for Philips\Internet Video Downloader\Plugin_FireFox [2010/09/05 19:46:15 | 000,000,000 | -H-D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\[email protected]: C:\Program Files\Guffins\bar\2.bin
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\42ffxtbr@Zwinky_42.com: C:\Program Files\Zwinky_42\bar\1.bin
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{C801F642-9A87-4FB4-90B5-E3487E706AB9}: C:\Windows\system32\config\systemprofile\AppData\Local\{C801F642-9A87-4FB4-90B5-E3487E706AB9} [2011/08/17 22:32:34 | 000,000,000 | -H-D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 4.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2011/08/08 09:35:44 | 000,000,000 | -H-D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 4.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2011/08/31 08:59:25 | 000,000,000 | -H-D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions\\[email protected]: C:\Program Files\Veoh Networks\VeohWebPlayer\FFVideoFinder [2009/02/20 12:39:36 | 000,000,000 | -H-D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions\\[email protected]: C:\Users\robert\AppData\Roaming\Move Networks [2011/06/08 10:55:34 | 000,000,000 | -H-D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions\\[email protected]: C:\Program Files\FriendsChecker\DynConFf\ [2011/06/08 10:55:20 | 000,000,000 | -H-D | M]

[2011/03/21 18:21:41 | 000,000,000 | -H-D | M] (No name found) -- C:\Users\robert\AppData\Roaming\mozilla\Extensions
[2010/10/02 11:17:11 | 000,000,000 | -H-D | M] (No name found) -- C:\Users\robert\AppData\Roaming\mozilla\Extensions\[email protected]
[2011/03/21 18:21:41 | 000,000,000 | -H-D | M] (No name found) -- C:\Users\robert\AppData\Roaming\mozilla\Extensions\[email protected]
[2011/08/29 21:39:10 | 000,000,000 | -H-D | M] (No name found) -- C:\Users\robert\AppData\Roaming\mozilla\Firefox\Profiles\95z9sp1d.default\extensions
[2011/06/09 12:32:27 | 000,000,000 | -H-D | M] (Microsoft .NET Framework Assistant) -- C:\Users\robert\AppData\Roaming\mozilla\Firefox\Profiles\95z9sp1d.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2011/08/29 21:39:11 | 000,000,000 | ---D | M] (Yahoo! Toolbar) -- C:\Users\robert\AppData\Roaming\mozilla\Firefox\Profiles\95z9sp1d.default\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}
[2011/06/08 10:55:34 | 000,000,000 | -H-D | M] (Simppull Toolbar) -- C:\Users\robert\AppData\Roaming\mozilla\Firefox\Profiles\95z9sp1d.default\extensions\{E4E6BF2A-1667-11DF-A01F-1F9655D89593}
[2011/06/08 10:55:34 | 000,000,000 | -H-D | M] (MediaBar) -- C:\Users\robert\AppData\Roaming\mozilla\Firefox\Profiles\95z9sp1d.default\extensions\{E84D42CA-64EB-11DE-A65F-8C3656D89593}
[2010/12/18 20:19:35 | 000,000,000 | -H-D | M] (No name found) -- C:\Users\robert\AppData\Roaming\mozilla\Firefox\Profiles\95z9sp1d.default\extensions\{E84D42CA-64EB-11DE-A65F-8C3656D89593}chrome
[2011/06/08 10:55:34 | 000,000,000 | -H-D | M] (Search Toolbar) -- C:\Users\robert\AppData\Roaming\mozilla\Firefox\Profiles\95z9sp1d.default\extensions\[email protected]
[2010/09/14 05:41:12 | 000,002,506 | -H-- | M] () -- C:\Users\robert\AppData\Roaming\Mozilla\Firefox\Profiles\95z9sp1d.default\searchplugins\BearShareWebSearch.xml
[2010/10/03 08:36:09 | 000,001,919 | -H-- | M] () -- C:\Users\robert\AppData\Roaming\Mozilla\Firefox\Profiles\95z9sp1d.default\searchplugins\bing-zugo.xml
[2011/05/28 17:27:58 | 000,009,932 | -H-- | M] () -- C:\Users\robert\AppData\Roaming\Mozilla\Firefox\Profiles\95z9sp1d.default\searchplugins\mywebsearch.xml
[2011/08/31 09:03:55 | 000,000,000 | -H-D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions
[2011/06/08 11:20:32 | 000,000,000 | -H-D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}
[2011/08/31 09:03:55 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0017-0000-0000-ABCDEFFEDCBA}
[2009/01/14 00:11:35 | 000,000,000 | -H-D | M] (Seekeen) -- C:\Program Files\Mozilla Firefox\extensions\{DB390D2E-0FB4-413F-B039-AE342D1D40BA}
[2008/11/19 22:51:33 | 000,000,000 | -H-D | M] (Real Networks Settings) -- C:\Program Files\Mozilla Firefox\extensions\[email protected]
[2011/06/08 10:55:34 | 000,000,000 | -H-D | M] (Move Media Player) -- C:\USERS\ROBERT\APPDATA\ROAMING\MOVE NETWORKS
[2011/06/19 14:27:27 | 000,142,296 | -H-- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll
[2011/08/31 09:03:47 | 000,611,224 | ---- | M] (Oracle Corporation) -- C:\Program Files\mozilla firefox\plugins\npdeployJava1.dll
[2010/09/14 05:41:12 | 000,002,506 | -H-- | M] () -- C:\Program Files\mozilla firefox\searchplugins\BearShareWebSearch.xml
[2011/06/19 14:27:29 | 000,002,252 | -H-- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml

O1 HOSTS File: ([2011/08/31 09:10:52 | 000,000,098 | ---- | M]) - C:\Windows\System32\drivers\etc\Hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: ::1 localhost
O2 - BHO: (&Yahoo! Toolbar Helper) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll (Yahoo! Inc.)
O2 - BHO: (MediaBar) - {0974BA1E-64EC-11DE-B2A5-E43756D89593} - C:\Program Files\BearShare Applications\MediaBar\ToolBar\BearshareMediabarDx.dll ()
O2 - BHO: (IEPlugin Class) - {11222041-111B-46E3-BD29-EFB2449479B1} - C:\Program Files\ArcSoft\Media Converter for Philips\Internet Video Downloader\ArcURLRecord.dll (ArcSoft, Inc.)
O2 - BHO: (StumbleUpon Launcher) - {145B29F4-A56B-4b90-BBAC-45784EBEBBB7} - C:\Program Files\StumbleUpon\StumbleUponIEBar.dll (stumbleupon.com)
O2 - BHO: (Conduit Engine) - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Program Files\ConduitEngine\ConduitEngine.dll (Conduit Ltd.)
O2 - BHO: (SpywareGuardDLBLOCK.CBrowserHelper) - {4A368E80-174F-4872-96B5-0B27DDD11DB2} - C:\Program Files\SpywareGuard\dlprotect.dll ()
O2 - BHO: (Simppull Toolbar) - {627af46b-2076-42ae-a2fd-8428734d3e74} - C:\Program Files\simppulltoolbar\simppulldx.dll ()
O2 - BHO: (Morphster Toolbar) - {72b90932-6338-4345-9fc4-4f94984ed241} - C:\Program Files\Morphster\tbMorp.dll (Conduit Ltd.)
O2 - BHO: (UrlHelper Class) - {74322BF9-DF26-493f-B0DA-6D2FC5E6429E} - C:\Program Files\BearShare Applications\MediaBar\Datamngr\IEBHO.dll (MusicLab, LLC)
O2 - BHO: (scriptproxy) - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\McAfee\VirusScan\scriptsn.dll (McAfee, Inc.)
O2 - BHO: (Shop to Win 14) - {8C423C72-F06E-43B3-A3E8-A435FFF9E9E0} - C:\Program Files\Shop to Win 14\Shop to Win 14.dll (Shop To Win, LLC)
O2 - BHO: (PageRage Toolbar) - {9565115d-c7d6-46d3-bd63-b67b481a4368} - C:\Program Files\PageRage\tbPage.dll (Conduit Ltd.)
O2 - BHO: (Updater For Simppull Toolbar) - {C4B8BAB4-1667-11DF-A242-BA9455D89593} - C:\Program Files\simppulltoolbar\auxi\simppulltoolbAu.dll (Visicom Media)
O2 - BHO: (CBrowserHelperObject Object) - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:\Program Files\Dell\BAE\BAE.dll (Dell Inc.)
O2 - BHO: (Java™ Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O2 - BHO: (NetAssistant) - {E38FA08E-F56A-4169-ABF5-5C71E3C153A1} - C:\Program Files\Freeze.com\NetAssistant\NetAssistant.dll (W3i, LLC)
O2 - BHO: (SingleInstance Class) - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\YTSingleInstance.dll (Yahoo! Inc)
O2 - BHO: (FriendsChecker) - {FED6A736-129B-49C7-857E-25FC91E87DB3} - C:\Program Files\FriendsChecker\DynConIe\DynConIE.dll (FriendsChecker)
O3 - HKLM\..\Toolbar: (MediaBar) - {0974BA1E-64EC-11DE-B2A5-E43756D89593} - C:\Program Files\BearShare Applications\MediaBar\ToolBar\BearshareMediabarDx.dll ()
O3 - HKLM\..\Toolbar: (Veoh Web Player Video Finder) - {0FBB9689-D3D7-4f7a-A2E2-585B10099BFC} - C:\Program Files\Veoh Networks\VeohWebPlayer\VeohIEToolbar.dll (Veoh Networks Inc)
O3 - HKLM\..\Toolbar: (Conduit Engine) - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Program Files\ConduitEngine\ConduitEngine.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (StumbleUpon Toolbar) - {5093EB4C-3E93-40AB-9266-B607BA87BDC8} - C:\Program Files\StumbleUpon\StumbleUponIEBar.dll (stumbleupon.com)
O3 - HKLM\..\Toolbar: (Veoh Video Compass) - {52836EB0-631A-47B1-94A6-61F9D9112DAE} - C:\Program Files\Veoh Networks\Veoh Video Compass\SearchRecsPlugin.dll (Veoh Networks)
O3 - HKLM\..\Toolbar: (Simppull Toolbar) - {627af46b-2076-42ae-a2fd-8428734d3e74} - C:\Program Files\simppulltoolbar\simppulldx.dll ()
O3 - HKLM\..\Toolbar: (Morphster Toolbar) - {72b90932-6338-4345-9fc4-4f94984ed241} - C:\Program Files\Morphster\tbMorp.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (PageRage Toolbar) - {9565115d-c7d6-46d3-bd63-b67b481a4368} - C:\Program Files\PageRage\tbPage.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (Yahoo! Toolbar) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll (Yahoo! Inc.)
O3 - HKU\S-1-5-21-695326800-797908242-393843667-1000\..\Toolbar\WebBrowser: (Conduit Engine) - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Program Files\ConduitEngine\ConduitEngine.dll (Conduit Ltd.)
O3 - HKU\S-1-5-21-695326800-797908242-393843667-1000\..\Toolbar\WebBrowser: (Morphster Toolbar) - {72B90932-6338-4345-9FC4-4F94984ED241} - C:\Program Files\Morphster\tbMorp.dll (Conduit Ltd.)
O3 - HKU\S-1-5-21-695326800-797908242-393843667-1000\..\Toolbar\WebBrowser: (PageRage Toolbar) - {9565115D-C7D6-46D3-BD63-B67B481A4368} - C:\Program Files\PageRage\tbPage.dll (Conduit Ltd.)
O4 - HKLM..\Run: [ArcSoft Connection Service] C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe (ArcSoft Inc.)
O4 - HKLM..\Run: [DATAMNGR] C:\Program Files\BearShare Applications\MediaBar\Datamngr\datamngrUI.exe (MusicLab, LLC)
O4 - HKLM..\Run: [DellSupportCenter] C:\Program Files\Dell Support Center\bin\sprtcmd.exe (SupportSoft, Inc.)
O4 - HKLM..\Run: [dscactivate] C:\Program Files\Dell Support Center\gs_agent\custom\dsca.exe ( )
O4 - HKLM..\Run: [ECenter] C:\DELL\E-Center\EULALauncher.exe ( )
O4 - HKLM..\Run: [Malwarebytes Anti-Malware (reboot)] C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe (Malwarebytes Corporation)
O4 - HKLM..\Run: [Malwarebytes' Anti-Malware (reboot)] J:\Malwarebytes' Anti-Malware\mbam.exe (Malwarebytes Corporation)
O4 - HKLM..\Run: [StartCCC] C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe ()
O4 - HKU\.DEFAULT..\Run: [Exetender] C:\Program Files\Free Ride Games\GPlayer.exe (Exent Technologies Ltd.)
O4 - HKU\S-1-5-18..\Run: [Exetender] C:\Program Files\Free Ride Games\GPlayer.exe (Exent Technologies Ltd.)
O4 - HKU\S-1-5-21-695326800-797908242-393843667-1000..\Run: [DellSupportCenter] C:\Program Files\Dell Support Center\bin\sprtcmd.exe (SupportSoft, Inc.)
O4 - HKU\S-1-5-21-695326800-797908242-393843667-1000..\Run: [Exetender] C:\Program Files\Free Ride Games\GPlayer.exe (Exent Technologies Ltd.)
O4 - HKU\S-1-5-21-695326800-797908242-393843667-1000..\Run: [TomTomHOME.exe] C:\Program Files\TomTom HOME 2\TomTomHOMERunner.exe (TomTom)
O4 - HKU\S-1-5-21-695326800-797908242-393843667-1000..\Run: [VeohPlugin] C:\Program Files\Veoh Networks\VeohWebPlayer\veohwebplayer.exe (Veoh Networks)
O4 - Startup: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dell Dock First Run.lnk = C:\Program Files\Dell\DellDock\DellDock.exe (Stardock Corporation)
O4 - Startup: C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dell Dock First Run.lnk = C:\Program Files\Dell\DellDock\DellDock.exe (Stardock Corporation)
O4 - Startup: C:\Users\robert\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.3.lnk = C:\Program Files\OpenOffice.org 3\program\quickstart.exe ()
O4 - Startup: C:\Users\robert\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SpywareGuard.lnk = C:\Program Files\SpywareGuard\sgmain.exe ()
F3 - HKU\.DEFAULT WinNT: Load - (C:\Windows\TEMP\csrss.exe) - File not found
F3 - HKU\S-1-5-18 WinNT: Load - (C:\Windows\TEMP\csrss.exe) - File not found
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HideSCAHealth = 1
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableTaskMgr = 1
O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HideSCAHealth = 1
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableTaskMgr = 1
O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-695326800-797908242-393843667-1000\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-695326800-797908242-393843667-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O10 - NameSpace_Catalog5\Catalog_Entries\000000000005 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O16 - DPF: {149E45D8-163E-4189-86FC-45022AB2B6C9} file:///C:/Program%20Files/Mysteryville/Images/stg_drm.ocx (SpinTop DRM Control)
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} http://download.macr...director/sw.cab (Shockwave ActiveX Control)
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} C:\Program Files\Yahoo!\Common\Yinsthelper.dll (Installation Support)
O16 - DPF: {6A060448-60F9-11D5-A6CD-0002B31F7455} (ExentInf Class)
O16 - DPF: {73ECB3AA-4717-450C-A2AB-D00DAD9EE203} http://h20270.www2.h...ctDetection.cab (GMNRev Class)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/...indows-i586.cab (Java Plug-in 10.0.0)
O16 - DPF: {924B4927-D3BA-41EA-9F7E-8A89194AB3AC} http://panda-plugin..../p3dactivex.cab (P3DActiveX Control)
O16 - DPF: {CAFEEFAC-0017-0000-0000-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.7.0)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.7.0)
O16 - DPF: {CB97291A-6603-466A-AA11-80C2EB74CB10} https://install.cox....InstallAx10.ocx (CoxSelfInstallAx10 Control)
O16 - DPF: {CC450D71-CC90-424C-8638-1F2DBAC87A54} file:///C:/Program%20Files/Mysteryville/Images/armhelper.ocx (ArmHelper Control)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 68.105.28.11 68.105.29.11 68.105.28.12
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O20 - AppInit_DLLs: (c:\PROGRA~1\BEARSH~1\MediaBar\Datamngr\datamngr.dll) - c:\Program Files\BearShare Applications\MediaBar\Datamngr\datamngr.dll (MusicLab, LLC)
O20 - AppInit_DLLs: (c:\PROGRA~1\BEARSH~1\MediaBar\Datamngr\IEBHO.dll) - c:\Program Files\BearShare Applications\MediaBar\Datamngr\IEBHO.dll (MusicLab, LLC)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)
O20 - HKU\.DEFAULT Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKU\.DEFAULT Winlogon: Shell - (C:\Windows\system32\config\systemprofile\AppData\Roaming\dwm.exe) - File not found
O20 - HKU\S-1-5-18 Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKU\S-1-5-18 Winlogon: Shell - (C:\Windows\system32\config\systemprofile\AppData\Roaming\dwm.exe) - File not found
O20 - Winlogon\Notify\GoToAssist: DllName - C:\Program Files\Citrix\GoToAssist\514\G2AWinLogon.dll - C:\Program Files\Citrix\GoToAssist\514\g2awinlogon.dll (Citrix Online, a division of Citrix Systems, Inc.)
O24 - Desktop WallPaper: C:\Users\robert\AppData\Roaming\Mozilla\Firefox\Desktop Background.bmp
O24 - Desktop BackupWallPaper: C:\Users\robert\AppData\Roaming\Mozilla\Firefox\Desktop Background.bmp
O28 - HKLM ShellExecuteHooks: {81559C35-8464-49F7-BB0E-07A383BEF910} - C:\Program Files\SpywareGuard\spywareguard.dll ()
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006/09/18 14:43:36 | 000,000,024 | -H-- | M] () - C:\autoexec.bat -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O35 - HKU\S-1-5-21-695326800-797908242-393843667-1000..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = ComFile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKU\.DEFAULT\...exe [@ = exefile] -- "%1" %*
O37 - HKU\S-1-5-18\...exe [@ = exefile] -- "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2011/08/31 09:03:54 | 000,214,408 | ---- | C] (Oracle Corporation) -- C:\Windows\System32\javaws.exe
[2011/08/31 09:03:54 | 000,173,960 | ---- | C] (Oracle Corporation) -- C:\Windows\System32\javaw.exe
[2011/08/31 09:03:54 | 000,173,960 | ---- | C] (Oracle Corporation) -- C:\Windows\System32\java.exe
[2011/08/27 17:57:15 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2011/08/27 17:49:51 | 000,022,712 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys
[2011/08/27 17:48:46 | 009,466,208 | ---- | C] (Malwarebytes Corporation ) -- C:\Users\robert\Desktop\mbam-setup-1.51.1.1800.exe
[2011/08/21 21:13:50 | 000,000,000 | ---D | C] -- C:\ProgramData\mD01602LoIkK01602
[2011/08/21 15:13:29 | 000,000,000 | R--D | C] -- C:\Users\robert\Desktop\New Briefcase
[2011/08/12 08:10:55 | 000,000,000 | -H-D | C] -- C:\Program Files\ESET
[2011/08/12 08:09:21 | 002,322,184 | -H-- | C] (ESET) -- C:\Users\robert\Desktop\esetsmartinstaller_enu.exe
[2011/08/11 09:38:21 | 000,375,808 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\winsrv.dll
[2011/08/11 09:38:12 | 000,025,600 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\jsproxy.dll
[2011/08/11 09:38:11 | 000,174,080 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ie4uinit.exe
[2011/08/11 09:38:10 | 001,638,912 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mshtml.tlb
[2011/08/11 09:38:10 | 001,469,440 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\inetcpl.cpl
[2011/08/11 09:38:10 | 000,611,840 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mstime.dll
[2011/08/11 09:38:10 | 000,602,112 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msfeeds.dll
[2011/08/11 09:38:10 | 000,387,584 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iedkcs32.dll
[2011/08/11 09:38:10 | 000,385,024 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\html.iec
[2011/08/11 09:38:10 | 000,184,320 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iepeers.dll
[2011/08/11 09:38:10 | 000,164,352 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieui.dll
[2011/08/11 09:38:10 | 000,133,632 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieUnatt.exe
[2011/08/11 09:38:10 | 000,109,056 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iesysprep.dll
[2011/08/11 09:38:10 | 000,105,984 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\url.dll
[2011/08/11 09:38:10 | 000,071,680 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iesetup.dll
[2011/08/11 09:38:10 | 000,055,808 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iernonce.dll
[2011/08/11 09:38:10 | 000,055,296 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msfeedsbs.dll
[2011/08/11 09:38:10 | 000,043,520 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\licmgr10.dll
[2011/08/11 09:38:10 | 000,013,312 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msfeedssync.exe
[2011/08/11 09:36:56 | 003,602,832 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ntkrnlpa.exe
[2011/08/11 09:36:56 | 003,550,096 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ntoskrnl.exe
[2011/08/10 08:43:41 | 000,000,000 | -H-D | C] -- C:\Windows\temp
[2011/08/08 09:42:09 | 000,000,000 | -HSD | C] -- C:\$RECYCLE.BIN
[2011/08/08 09:25:30 | 000,518,144 | -H-- | C] (SteelWerX) -- C:\Windows\SWREG.exe
[2011/08/08 09:25:30 | 000,406,528 | -H-- | C] (SteelWerX) -- C:\Windows\SWSC.exe
[2011/08/08 09:25:30 | 000,060,416 | -H-- | C] (NirSoft) -- C:\Windows\NIRCMD.exe
[2011/08/08 09:25:21 | 000,000,000 | -H-D | C] -- C:\Windows\ERDNT
[2011/08/08 09:25:03 | 000,000,000 | -H-D | C] -- C:\Qoobox
[2011/08/08 09:21:53 | 004,165,965 | RH-- | C] (Swearware) -- C:\Users\robert\Desktop\ComboFix.exe
[2011/08/03 08:39:44 | 000,000,000 | -H-D | C] -- C:\Users\robert\Desktop\gmer
[2011/08/03 08:32:12 | 000,000,000 | -H-D | C] -- C:\_OTL
[2011/08/03 08:21:00 | 000,071,398 | -H-- | C] (jpshortstuff) -- C:\Users\robert\Desktop\GooredFix.exe
[3 C:\ProgramData\*.tmp files -> C:\ProgramData\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2011/08/31 09:23:26 | 000,000,394 | -H-- | M] () -- C:\Windows\tasks\User_Feed_Synchronization-{ABF471DD-CDA0-4E09-B753-A25B3EBAFF16}.job
[2011/08/31 09:14:22 | 000,003,616 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2011/08/31 09:14:22 | 000,003,616 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2011/08/31 09:14:01 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2011/08/31 09:13:58 | 2145,570,816 | -HS- | M] () -- C:\hiberfil.sys
[2011/08/31 09:10:52 | 000,000,098 | ---- | M] () -- C:\Windows\System32\drivers\etc\Hosts
[2011/08/31 09:03:47 | 000,544,656 | ---- | M] (Oracle Corporation) -- C:\Windows\System32\deployJava1.dll
[2011/08/31 09:03:47 | 000,214,408 | ---- | M] (Oracle Corporation) -- C:\Windows\System32\javaws.exe
[2011/08/31 09:03:47 | 000,173,960 | ---- | M] (Oracle Corporation) -- C:\Windows\System32\javaw.exe
[2011/08/31 09:03:47 | 000,173,960 | ---- | M] (Oracle Corporation) -- C:\Windows\System32\java.exe
[2011/08/31 05:29:01 | 000,000,418 | -H-- | M] () -- C:\Windows\tasks\ParetoLogic Update Version2.job
[2011/08/30 19:14:07 | 000,219,136 | -H-- | M] () -- C:\Users\robert\Documents\jordan.wps
[2011/08/30 18:00:00 | 000,000,446 | -H-- | M] () -- C:\Windows\tasks\ParetoLogic Registration3.job
[2011/08/30 18:00:00 | 000,000,444 | -H-- | M] () -- C:\Windows\tasks\ParetoLogic Registration.job
[2011/08/29 21:26:17 | 000,000,382 | -H-- | M] () -- C:\Windows\tasks\DriverCure.job
[2011/08/29 21:22:53 | 000,000,798 | ---- | M] () -- C:\Users\robert\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SpywareGuard.lnk
[2011/08/29 21:22:53 | 000,000,794 | ---- | M] () -- C:\Users\robert\Desktop\SpywareGuard LiveUpdate.lnk
[2011/08/29 21:22:53 | 000,000,794 | ---- | M] () -- C:\Users\robert\Desktop\SpywareGuard LiveUpdate - Copy.lnk
[2011/08/29 21:22:53 | 000,000,762 | ---- | M] () -- C:\Users\robert\Desktop\SpywareGuard.lnk
[2011/08/29 21:21:16 | 000,000,482 | ---- | M] () -- C:\Users\robert\Desktop\spywareguardsetup.exe - Shortcut.lnk
[2011/08/29 00:28:23 | 000,001,356 | ---- | M] () -- C:\Users\robert\AppData\Local\d3d9caps.dat
[2011/08/27 17:48:49 | 009,466,208 | ---- | M] (Malwarebytes Corporation ) -- C:\Users\robert\Desktop\mbam-setup-1.51.1.1800.exe
[2011/08/27 17:25:52 | 000,298,248 | -H-- | M] () -- C:\Windows\System32\FNTCACHE.DAT
[2011/08/23 16:24:08 | 000,000,591 | ---- | M] () -- C:\Users\Public\Desktop\Security Protection.lnk
[2011/08/23 15:38:08 | 000,052,736 | -H-- | M] () -- C:\Windows\System32\choidRes.dll
[2011/08/21 15:15:55 | 000,000,199 | ---- | M] () -- C:\Users\robert\Desktop\Security Protection - Payment Page.url
[2011/08/21 15:02:05 | 000,000,196 | ---- | M] () -- C:\Users\robert\Desktop\Security Protection.url
[2011/08/21 13:14:09 | 115,259,740 | ---- | M] () -- C:\Windows\MEMORY.DMP
[2011/08/19 13:04:41 | 000,196,608 | -H-- | M] () -- C:\Windows\System32\Ikeext.etl
[2011/08/19 12:50:01 | 000,000,240 | -H-- | M] () -- C:\ProgramData\~P1kAlMiG2Kb7Fz
[2011/08/19 12:50:01 | 000,000,176 | -H-- | M] () -- C:\ProgramData\~P1kAlMiG2Kb7Fzr
[2011/08/19 12:49:56 | 000,000,328 | -H-- | M] () -- C:\ProgramData\P1kAlMiG2Kb7Fz
[2011/08/19 11:33:28 | 000,010,888 | -HS- | M] () -- C:\ProgramData\j01208s40jwf310
[2011/08/18 20:26:41 | 000,002,255 | -H-- | M] () -- C:\Users\robert\Application Data\Microsoft\Internet Explorer\Quick Launch\iTunes (2).lnk
[2011/08/17 11:24:30 | 000,000,304 | -H-- | M] () -- C:\Windows\tasks\3140662784.job
[2011/08/13 21:52:46 | 000,634,834 | -H-- | M] () -- C:\Windows\System32\perfh009.dat
[2011/08/13 21:52:46 | 000,112,596 | -H-- | M] () -- C:\Windows\System32\perfc009.dat
[2011/08/12 16:59:21 | 000,000,304 | -H-- | M] () -- C:\Windows\tasks\3197502716.job
[2011/08/12 16:28:11 | 000,879,225 | -H-- | M] () -- C:\Users\robert\Desktop\SecurityCheck.exe
[2011/08/12 08:09:22 | 002,322,184 | -H-- | M] (ESET) -- C:\Users\robert\Desktop\esetsmartinstaller_enu.exe
[2011/08/11 01:24:24 | 000,019,275 | -H-- | M] () -- C:\Users\robert\AppData\Roaming\762E.185
[2011/08/08 09:22:03 | 004,165,965 | RH-- | M] (Swearware) -- C:\Users\robert\Desktop\ComboFix.exe
[2011/08/03 08:39:11 | 000,294,216 | -H-- | M] () -- C:\Users\robert\Desktop\gmer.zip
[2011/08/03 08:36:35 | 000,024,374 | -H-- | M] () -- C:\Users\robert\Documents\Welcome to Windows Mail.eml
[2011/08/03 08:21:01 | 000,071,398 | -H-- | M] (jpshortstuff) -- C:\Users\robert\Desktop\GooredFix.exe
[2011/08/03 08:05:25 | 000,000,707 | -H-- | M] () -- C:\Users\robert\Desktop\Windows Media Center Shortcuts.lnk
[2011/08/03 08:02:38 | 000,684,297 | -H-- | M] () -- C:\Users\robert\Desktop\unhide.exe
[3 C:\ProgramData\*.tmp files -> C:\ProgramData\*.tmp -> ]

========== Files Created - No Company Name ==========

[2011/08/29 21:24:30 | 000,000,794 | ---- | C] () -- C:\Users\robert\Desktop\SpywareGuard LiveUpdate - Copy.lnk
[2011/08/29 21:21:16 | 000,000,482 | ---- | C] () -- C:\Users\robert\Desktop\spywareguardsetup.exe - Shortcut.lnk
[2011/08/27 17:25:12 | 2145,570,816 | -HS- | C] () -- C:\hiberfil.sys
[2011/08/23 15:38:08 | 000,052,736 | -H-- | C] () -- C:\Windows\System32\choidRes.dll
[2011/08/21 16:59:32 | 001,305,136 | -H-- | C] () -- C:\Users\robert\Desktop\tdsskiller - Copy.zip
[2011/08/21 15:15:55 | 000,000,199 | ---- | C] () -- C:\Users\robert\Desktop\Security Protection - Payment Page.url
[2011/08/21 15:02:05 | 000,000,196 | ---- | C] () -- C:\Users\robert\Desktop\Security Protection.url
[2011/08/21 14:16:47 | 000,000,591 | ---- | C] () -- C:\Users\Public\Desktop\Security Protection.lnk
[2011/08/21 14:13:58 | 000,000,394 | -H-- | C] () -- C:\Windows\tasks\User_Feed_Synchronization-{ABF471DD-CDA0-4E09-B753-A25B3EBAFF16}.job
[2011/08/19 12:50:01 | 000,000,240 | -H-- | C] () -- C:\ProgramData\~P1kAlMiG2Kb7Fz
[2011/08/19 12:50:01 | 000,000,176 | -H-- | C] () -- C:\ProgramData\~P1kAlMiG2Kb7Fzr
[2011/08/19 12:49:56 | 000,000,328 | -H-- | C] () -- C:\ProgramData\P1kAlMiG2Kb7Fz
[2011/08/17 11:24:30 | 000,000,304 | -H-- | C] () -- C:\Windows\tasks\3140662784.job
[2011/08/14 01:07:02 | 000,010,888 | -HS- | C] () -- C:\ProgramData\j01208s40jwf310
[2011/08/12 20:54:35 | 115,259,740 | ---- | C] () -- C:\Windows\MEMORY.DMP
[2011/08/12 16:59:21 | 000,000,304 | -H-- | C] () -- C:\Windows\tasks\3197502716.job
[2011/08/12 16:28:09 | 000,879,225 | -H-- | C] () -- C:\Users\robert\Desktop\SecurityCheck.exe
[2011/08/10 14:33:26 | 000,019,275 | -H-- | C] () -- C:\Users\robert\AppData\Roaming\762E.185
[2011/08/08 09:25:30 | 000,256,000 | -H-- | C] () -- C:\Windows\PEV.exe
[2011/08/08 09:25:30 | 000,208,896 | -H-- | C] () -- C:\Windows\MBR.exe
[2011/08/08 09:25:30 | 000,098,816 | -H-- | C] () -- C:\Windows\sed.exe
[2011/08/08 09:25:30 | 000,080,412 | -H-- | C] () -- C:\Windows\grep.exe
[2011/08/08 09:25:30 | 000,068,096 | -H-- | C] () -- C:\Windows\zip.exe
[2011/08/03 08:39:06 | 000,294,216 | -H-- | C] () -- C:\Users\robert\Desktop\gmer.zip
[2011/08/03 08:02:36 | 000,684,297 | -H-- | C] () -- C:\Users\robert\Desktop\unhide.exe
[2011/07/15 03:03:52 | 000,000,197 | -H-- | C] () -- C:\Windows\System32\MRT.INI
[2011/05/19 17:42:28 | 000,000,064 | -H-- | C] () -- C:\Windows\GPlrLanc.dat
[2010/07/24 22:48:07 | 000,767,952 | -H-- | C] () -- C:\Windows\BDTSupport.dll.old
[2009/09/23 15:55:01 | 000,107,612 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchema.bin
[2009/09/23 15:55:00 | 000,117,248 | ---- | C] () -- C:\Windows\System32\EhStorAuthn.dll
[2009/03/23 17:54:37 | 000,001,356 | ---- | C] () -- C:\Users\robert\AppData\Local\d3d9caps.dat
[2008/11/23 22:21:36 | 000,003,526 | -H-- | C] () -- C:\Users\robert\AppData\Roaming\wklnhst.dat
[2008/11/19 22:51:53 | 000,000,000 | -H-- | C] () -- C:\Windows\nsreg.dat
[2008/10/27 11:18:47 | 000,141,162 | -H-- | C] () -- C:\Windows\hpoins14.dat
[2008/10/14 22:56:14 | 000,157,696 | -H-- | C] () -- C:\Windows\hpoins28.dat.temp
[2008/10/14 22:56:14 | 000,000,932 | -H-- | C] () -- C:\Windows\hpomdl28.dat.temp
[2008/09/20 01:04:10 | 000,018,904 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchemaTrivial.bin
[2008/09/18 05:34:50 | 000,008,248 | -H-- | C] () -- C:\Users\robert\AppData\Local\en.ini
[2008/09/18 04:38:52 | 000,086,016 | -H-- | C] () -- C:\Users\robert\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2008/08/28 10:51:31 | 003,107,788 | -H-- | C] () -- C:\Windows\System32\atiumdva.dat
[2008/08/28 10:51:31 | 000,159,744 | -H-- | C] () -- C:\Windows\System32\atitmmxx.dll
[2008/08/28 10:51:29 | 000,876,544 | -H-- | C] () -- C:\Windows\System32\TEACico2.dll
[2008/08/28 08:19:24 | 000,125,728 | -H-- | C] () -- C:\Windows\System32\drivers\Mpfp.sys
[2008/08/28 02:57:49 | 000,000,000 | -H-- | C] () -- C:\Windows\ativpsrm.bin
[2008/07/17 12:23:36 | 000,174,818 | -H-- | C] () -- C:\Windows\System32\atiicdxx.dat
[2008/03/06 00:38:44 | 000,090,112 | -H-- | C] () -- C:\Windows\System32\atibrtmon.exe
[2007/09/19 18:14:41 | 000,002,000 | -H-- | C] () -- C:\Windows\hpomdl14.dat
[2007/08/21 21:51:16 | 000,081,920 | -H-- | C] () -- C:\Windows\System32\ATIODE.exe
[2007/08/21 19:36:12 | 000,040,960 | -H-- | C] () -- C:\Windows\System32\ATIODCLI.exe
[2006/11/02 05:57:28 | 000,067,584 | --S- | C] () -- C:\Windows\bootstat.dat
[2006/11/02 05:47:37 | 000,298,248 | -H-- | C] () -- C:\Windows\System32\FNTCACHE.DAT
[2006/11/02 05:35:32 | 000,005,632 | ---- | C] () -- C:\Windows\System32\sysprepMCE.dll
[2006/11/02 03:33:01 | 000,634,834 | -H-- | C] () -- C:\Windows\System32\perfh009.dat
[2006/11/02 03:33:01 | 000,287,440 | -H-- | C] () -- C:\Windows\System32\perfi009.dat
[2006/11/02 03:33:01 | 000,112,596 | -H-- | C] () -- C:\Windows\System32\perfc009.dat
[2006/11/02 03:33:01 | 000,030,674 | -H-- | C] () -- C:\Windows\System32\perfd009.dat
[2006/11/02 03:23:21 | 000,215,943 | -H-- | C] () -- C:\Windows\System32\dssec.dat
[2006/11/02 01:58:30 | 000,043,131 | ---- | C] () -- C:\Windows\mib.bin
[2006/11/02 01:19:00 | 000,000,741 | -H-- | C] () -- C:\Windows\System32\NOISE.DAT
[2006/11/02 00:40:29 | 000,013,750 | -H-- | C] () -- C:\Windows\System32\pacerprf.ini
[2006/11/02 00:25:31 | 000,673,088 | -H-- | C] () -- C:\Windows\System32\mlang.dat

========== Alternate Data Streams ==========

@Alternate Data Stream - 95 bytes -> C:\ProgramData\TEMP:5C321E34
@Alternate Data Stream - 820 bytes -> C:\Users\robert\Documents\Welcome to Windows Mail.eml:OECustomProperty

< End of report >

Extras.Txt
OTL Extras logfile created on: 8/31/2011 9:20:26 AM - Run 2
OTL by OldTimer - Version 3.2.26.7 Folder = J:\
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.19120)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

2.00 Gb Total Physical Memory | 1.14 Gb Available Physical Memory | 56.89% Memory free
4.24 Gb Paging File | 3.29 Gb Available in Paging File | 77.57% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 138.95 Gb Total Space | 73.44 Gb Free Space | 52.85% Space Free | Partition Type: NTFS
Drive D: | 10.00 Gb Total Space | 3.29 Gb Free Space | 32.85% Space Free | Partition Type: NTFS
Drive J: | 1.86 Gb Total Space | 1.44 Gb Free Space | 77.42% Space Free | Partition Type: FAT

Computer Name: ROBERT-PC | User Name: robert | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========


========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)
.html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)

[HKEY_USERS\.DEFAULT\SOFTWARE\Classes\<extension>]

[HKEY_USERS\S-1-5-18\SOFTWARE\Classes\<extension>]

[HKEY_USERS\S-1-5-21-695326800-797908242-393843667-1000\SOFTWARE\Classes\<extension>]
.html [@ = ChromeHTML] -- Reg Error: Key error. File not found

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
htmlfile [edit] -- Reg Error: Key error.
https [open] -- "C:\Program Files\Mozilla Firefox\firefox.exe" -requestPending -osint -url "%1" (Mozilla Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
"FirewallDisableNotify" = 0
"AntiVirusDisableNotify" = 0
"UpdatesDisableNotify" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
"VistaSp1" = Reg Error: Unknown registry data type -- File not found
"VistaSp2" = Reg Error: Unknown registry data type -- File not found

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\S-1-5-21-695326800-797908242-393843667-1000]
"EnableNotificationsRef" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]

========== System Restore Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
"DoNotAllowExceptions" = 1

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]


========== Vista Active Open Ports Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{2DA02863-563F-4E0E-B4D2-571E5B2BBE70}" = lport=3702 | protocol=17 | dir=in | svc=fdrespub | app=%systemroot%\system32\svchost.exe |
"{31E39E14-92B4-445F-9E77-2D4E1E1CB05C}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{4D473B4B-5637-49DB-8021-DB0A9D4E9CF1}" = rport=3702 | protocol=17 | dir=out | svc=fdrespub | app=%systemroot%\system32\svchost.exe |
"{9DBCEFFC-E0F7-4183-A4BD-55E2CA9A638D}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{CCA852BC-F882-483B-A07D-5852B128B0BD}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{E68641FA-1CF8-4482-81DC-4692C12FE91D}" = rport=3702 | protocol=17 | dir=out | svc=fdphost | app=%systemroot%\system32\svchost.exe |
"{EA088081-13AD-4090-BA18-33829D3051B6}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{FDA4D954-5FEA-4F0B-AC45-2DF047090D79}" = lport=3702 | protocol=17 | dir=in | svc=fdphost | app=%systemroot%\system32\svchost.exe |

========== Vista Active Application Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{0BCE6CF7-31BA-4C19-8CDD-63F169CFFAA2}" = dir=in | app=c:\program files\common files\mcafee\mna\mcnasvc.exe |
"{19936838-D427-40BD-B0E5-D982CD943610}" = protocol=17 | dir=in | app=c:\program files\veoh networks\veohwebplayer\veohwebplayer.exe |
"{1F5DC97B-BB2D-40AA-BD4A-6A5282C77325}" = protocol=17 | dir=in | app=c:\program files\itunes\itunes.exe |
"{28504E43-D04A-4D73-AB29-AF9D08A3AD6E}" = protocol=6 | dir=in | app=c:\program files\veoh networks\veohwebplayer\veohwebplayer.exe |
"{3D56A90D-B68A-4F74-8815-5E97E02CD416}" = protocol=17 | dir=in | app=c:\program files\bearshare applications\bearshare\bearshare.exe |
"{4FA3E202-CB1A-4260-9388-28594F78A911}" = protocol=6 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{655E8E22-BE21-4B02-8906-060921C07F14}" = protocol=17 | dir=in | app=c:\program files\frostwire\frostwire.exe |
"{694D3B63-C79A-40FD-84C9-6E944D532874}" = protocol=17 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{6A61BD85-87C9-485D-8322-66298C3B628C}" = protocol=6 | dir=in | app=c:\program files\bearshare applications\bearshare\bearshare.exe |
"{74B64D9B-D0D2-4B98-8CC8-EDB233A845F4}" = protocol=17 | dir=in | app=c:\program files\itunes\itunes.exe |
"{7D13FF79-0351-4A18-B7F5-C336C9538488}" = dir=in | app=c:\windows\system32\dplayx32.exe |
"{845BC6F1-4248-4D32-BABC-292870B4E13C}" = dir=in | app=c:\windows\system32\dplayx32.exe |
"{9A49B860-04B2-43E7-A89C-63C7134549F6}" = protocol=6 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{9C772D1A-FD5F-4547-91C8-9089DE804011}" = protocol=6 | dir=in | app=c:\program files\frostwire\frostwire.exe |
"{A873FB20-160F-4B7B-BFFE-3D4184130A03}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe |
"{B4D9A51F-77F2-46A1-B33B-92FE50C4A121}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{B77A421C-C3EF-4F9B-BC06-C519DC3D5335}" = protocol=6 | dir=in | app=c:\program files\itunes\itunes.exe |
"{C8C0D1F2-4A12-42E0-9E98-F9DC02ED6986}" = protocol=17 | dir=in | app=c:\program files\limewire\limewire.exe |
"{CA90A67D-67AE-47F3-9251-C29CFC83D182}" = protocol=17 | dir=in | app=c:\program files\bearshare applications\bearshare\bearshare.exe |
"{CF7295D1-05EC-4438-BFE6-7513F6CD6153}" = protocol=17 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{D1E1BB4A-28A2-4081-AE7C-BC1B6F13422E}" = dir=in | app=c:\windows\system32\dplayx32.exe |
"{DE9D0133-B678-473A-AF64-58B2F5A0072A}" = protocol=6 | dir=in | app=c:\program files\limewire\limewire.exe |
"{E01176D2-C0FB-479D-90F9-AA6738AAD230}" = protocol=6 | dir=in | app=c:\program files\bearshare applications\bearshare\bearshare.exe |
"{F221949A-4A7F-4B63-AFB2-00D5782C1520}" = protocol=6 | dir=in | app=c:\program files\itunes\itunes.exe |
"TCP Query User{0953E54D-49F8-493A-8CCD-21725831F135}C:\program files\bearshare applications\bearshare\bearshare.exe" = protocol=6 | dir=in | app=c:\program files\bearshare applications\bearshare\bearshare.exe |
"TCP Query User{280ED61D-AAD4-4FB9-8D9B-2CBC44365C42}C:\program files\limewire\limewire.exe" = protocol=6 | dir=in | app=c:\program files\limewire\limewire.exe |
"TCP Query User{45C1125B-94F9-4DF2-85D6-BFF7F7A75BBF}C:\users\robert\appdata\local\temp\17396.exe" = protocol=6 | dir=in | app=c:\users\robert\appdata\local\temp\17396.exe |
"TCP Query User{6F3C4051-A185-4EEA-BE81-55A2DB1CA804}C:\program files\ares\ares.exe" = protocol=6 | dir=in | app=c:\program files\ares\ares.exe |
"TCP Query User{8B203962-133A-425E-9039-1A9AA4D5452A}C:\users\robert\appdata\roaming\imvuclient\1vivoxvoice.exe" = protocol=6 | dir=in | app=c:\users\robert\appdata\roaming\imvuclient\1vivoxvoice.exe |
"TCP Query User{D93FB9E0-9223-427F-9BBF-814B6FC28F8A}C:\users\robert\appdata\local\svc2dll.exe" = protocol=6 | dir=in | app=c:\users\robert\appdata\local\svc2dll.exe |
"UDP Query User{1112E526-5D08-4A68-9A79-0E1467030098}C:\program files\ares\ares.exe" = protocol=17 | dir=in | app=c:\program files\ares\ares.exe |
"UDP Query User{16C3E7D2-32BE-4880-941F-D8A6731BD284}C:\program files\bearshare applications\bearshare\bearshare.exe" = protocol=17 | dir=in | app=c:\program files\bearshare applications\bearshare\bearshare.exe |
"UDP Query User{2AE817C2-0F40-4528-AB0C-017062E4BC64}C:\users\robert\appdata\roaming\imvuclient\1vivoxvoice.exe" = protocol=17 | dir=in | app=c:\users\robert\appdata\roaming\imvuclient\1vivoxvoice.exe |
"UDP Query User{3AF1FB5A-1C1D-4DA1-BC09-95E8E96D5595}C:\users\robert\appdata\local\svc2dll.exe" = protocol=17 | dir=in | app=c:\users\robert\appdata\local\svc2dll.exe |
"UDP Query User{3BA527B2-6E82-4B66-B91F-F518357817AA}C:\users\robert\appdata\local\temp\17396.exe" = protocol=17 | dir=in | app=c:\users\robert\appdata\local\temp\17396.exe |
"UDP Query User{F98D02FF-44F3-49C3-AB84-288B81E96180}C:\program files\limewire\limewire.exe" = protocol=17 | dir=in | app=c:\program files\limewire\limewire.exe |

========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
"{00CD9341-46BF-C386-1D4C-4D980B615549}" = Catalyst Control Center Localization Chinese Standard
"{055EE59D-217B-43A7-ABFF-507B966405D8}" = ATI Catalyst Control Center
"{08E81ABD-79F7-49C2-881F-FD6CB0975693}" = Roxio Creator Data
"{09760D42-E223-42AD-8C3E-55B47D0DDAC3}" = Roxio Creator DE
"{0F7C2E47-089E-4d23-B9F7-39BE00100776}" = Toolbox
"{0F81061C-661C-D357-F79C-31B1D78609F9}" = Catalyst Control Center Localization Spanish
"{11B83AD3-7A46-4C2E-A568-9505981D4C6F}" = HP Update
"{15BC8CD0-A65B-47D0-A2DD-90A824590FA8}" = Microsoft Works
"{170715E4-3235-8999-C05D-54156AC3F163}" = CCC Help German
"{174C89F3-EBA7-17AB-2FCA-82AE6AF7C8C5}" = CCC Help Japanese
"{18669FF9-C8FE-407a-9F70-E674896B1DB4}" = GPBaseService
"{1D9C9979-7B3D-0EBA-06B5-1A648DE8ECFC}" = Skins
"{1E0D8F69-A6AB-4934-9B2D-159D9F97BA4A}" = ParetoLogic DriverCure
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{1F54DAFA-9261-4A62-B59D-6C9F26B48FE4}" = Roxio Creator Tools
"{250AD9EB-E6A4-FEE1-AAAF-66EB69E96060}" = CCC Help Polish
"{26A24AE4-039D-4CA4-87B4-2F83217000FF}" = Java™ 7
"{28BE306E-5DA6-4F9C-BDB0-DBA3C8C6FFFD}" = QuickTime
"{2B64ACEB-703E-6D90-5CBE-140B9A66C85B}" = Catalyst Control Center Localization Portuguese
"{2B7BDADB-EC8C-4C54-B5DD-CE45A016D3A7}" = Free Ride Games Player
"{2BA09774-34F7-4A06-8C7E-B69E44CB9EB0}" = DriverBoost
"{2CADE3B6-6B69-2050-7B7C-2E6BB1183458}" = Catalyst Control Center Localization Thai
"{30465B6C-B53F-49A1-9EBA-A3F187AD502E}" = Roxio Update Manager
"{30C042F8-B207-313E-F932-3599ADF24651}" = CCC Help Korean
"{34BFB099-07B2-4E95-A673-7362D60866A2}" = PSSWCORE
"{36FDBE6E-6684-462b-AE98-9A39A1B200CC}" = HPProductAssistant
"{3AE375B7-4C1A-8954-D87B-126990CA06ED}" = Catalyst Control Center Localization Turkish
"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
"{3E171899-0175-47CC-84C4-562ACDD4C021}" = OpenOffice.org 3.3
"{3F92ABBB-6BBF-11D5-B229-002078017FBF}" = NetWaiting
"{42DB15D5-DAAD-A187-252F-80B669BFC970}" = CCC Help Turkish
"{43B0D334-9A1B-4257-9E51-D3813BD8B9D0}" = GoGear ARIA Device Manager
"{44F70E24-C55E-4C6E-29F1-573C03BDFB9D}" = CCC Help Chinese Traditional
"{4517895C-2CCB-9CA7-D24A-E74559551426}" = Catalyst Control Center Localization Chinese Traditional
"{49041980-E77D-DCAD-8365-F22688D3A8AE}" = Catalyst Control Center Localization Hungarian
"{5109C064-813E-4e87-B0DE-C8AF7B5BC02B}" = SmartWebPrintingOC
"{52A69E11-7CEB-4a7d-9607-68BA4F39A89B}" = DeviceDiscovery
"{5335DADB-34BA-4AE8-A519-648D78498846}" = Skype™ 5.3
"{553255F3-78FD-40F1-A6F8-6882140265FE}" = Apple Application Support
"{569F35EF-9A3E-7EA6-3817-01F7A142E608}" = CCC Help Thai
"{57E08EAC-F4FA-E453-6516-CA4D8AF4BD6D}" = CCC Help English
"{5ACE69F0-A3E8-44eb-88C1-0A841E700180}" = TrayApp
"{5D9748ED-2EC3-E694-68E7-14AE077AA686}" = Catalyst Control Center Core Implementation
"{5E06C076-E4E7-4239-A886-B3D8AC84C166}" = HP Print Diagnostic Utility
"{5ECB3A3C-980B-4D12-9724-25DCB07A1F47}" = iTunes
"{62230596-37E5-4618-A329-0D21F529A86F}" = Browser Address Error Redirector
"{6675CA7F-E51B-4F6A-99D4-F8F0124C6EAA}" = Roxio Express Labeler 3
"{687FEF8A-8597-40b4-832C-297EA3F35817}" = BufferChm
"{6956856F-B6B3-4BE0-BA0B-8F495BE32033}" = Apple Software Update
"{6B7B6D4D-8F9B-4CB3-8CA4-BCA9CC4C1A22}" = EDocs
"{6EFDBA50-4ABE-4194-86F7-F3BD0A011F5B}_is1" = Shop To Win
"{6FC963A4-D7C2-743E-4634-0BE6893D2D30}" = ccc-utility
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{73A4F29F-31AC-4EBD-AA1B-0CC5F18C8F83}" = Roxio Creator Audio
"{7484FF63-DFD5-4703-5D5A-7B197CBC6AF7}" = CCC Help Hungarian
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{777CA40C-0206-4EF6-A0FC-618BF06BF8D0}" = Intel® PRO Network Connections 12.1.11.0
"{79D4609A-AE25-B8CA-9FD2-9DC5A919414E}" = ccc-core-static
"{7DB9F1E5-9ACB-410D-A7DC-7A3D023CE045}" = Dell Getting Started Guide
"{7F19855D-DB03-2435-858D-8CD809994A3F}" = Catalyst Control Center Localization Korean
"{86CE85E6-DBAC-3FFD-B977-E4B79F83C909}" = Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570
"{8958DFF1-3103-8A70-9108-40D7D359D8C6}" = Catalyst Control Center Graphics Full New
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8A253629-0511-4854-8B4E-46E57E66005C}" = Bonjour
"{8A85DEAD-7C1F-4368-881C-72AC74CB2E91}" = UnloadSupport
"{8E3A5EA8-DE6D-9333-0DB4-55FB9B6EED46}" = CCC Help Chinese Standard
"{8F3C31C5-9C3A-4AA8-8EFA-71290A7AD533}" = TomTom HOME Visual Studio Merge Modules
"{90120000-0020-0409-0000-0000000FF1CE}" = Compatibility Pack for the 2007 Office system
"{90CA0C98-4E23-8B12-29EC-FCEB49983E7E}" = Catalyst Control Center Localization Japanese
"{95120000-00AF-0409-0000-0000000FF1CE}" = Microsoft Office PowerPoint Viewer 2007 (English)
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9A57F3E7-F32D-FD92-124C-B9C9D7231C20}" = Catalyst Control Center Graphics Light
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{9DE1BE03-AFE2-4CDB-BFEB-D06D736CD01A}" = Apple Mobile Device Support
"{A0B9F8DF-C949-45ed-9808-7DC5C0C19C81}" = Status
"{A11409F1-CD33-4076-85CB-4EE4A8439BFE}" = Scan
"{A5AB9D5E-52E2-440e-A3ED-9512E253C81A}" = SolutionCenter
"{A6B90148-02C5-4fd3-8D7A-EF2386835CB9}" = F4100_Help
"{A6C265BE-E2C1-483e-843D-6B4C1E912AE0}" = F4100
"{A75BC59B-10BF-6B87-DCC7-3501F158ACC6}" = Times Reader
"{A9FE59F0-5BFA-4FDF-84C6-F45457715379}" = InstallIQ Updater
"{AC76BA86-7AD7-1033-7B44-AA1000000001}" = Adobe Reader X (10.1.0)
"{AC76BA86-7AD7-5464-3428-800000000003}" = Spelling Dictionaries Support For Adobe Reader 8
"{AF7FC1CA-79DF-43c3-90A3-33EFEB9294CE}" = AIO_Scan
"{AFF7E080-1974-45BF-9310-10DE1A1F5ED0}" = Adobe AIR
"{B4509BCE-7BAD-4a8c-B1AE-4D0CE7467C42}" = F4100_doccd
"{B4F35A00-24FD-4fb3-BF5E-413D5423434D}" = DJ_AIO_Software_min
"{B6A26DE5-F2B5-4D58-9570-4FC760E00FCD}" = Roxio Creator Copy
"{B8DBED1E-8BC3-4d08-B94A-F9D7D88E9BBF}" = HPSSupply
"{B935C985-A17F-484B-8470-09E4FC27DC26}" = Dell-eBay
"{BAD0FA60-09CF-4411-AE6A-C2844C8812FA}" = HP Photosmart Essential 2.5
"{BB22EB20-70C4-32D9-CAE5-816E24F458CA}" = Catalyst Control Center Graphics Full Existing
"{C39A4E1F-9AF1-4FE1-A80E-A5B867FABB42}" = Dell Best of Web
"{C3A0F1A3-7AD3-F7E3-D81A-0A5EC68F0397}" = Catalyst Control Center Localization Polish
"{C54CF9B1-B0A9-4FB6-9E9E-0F151754D823}_is1" = Active PC Optimizer 1.0
"{C792A75A-2A1F-4991-9B85-291745478A79}" = NetAssistant
"{CA50045C-5119-48e7-9BA7-6B317379857A}" = DJ_AIO_Software
"{CAE7D1D9-3794-4169-B4DD-964ADBC534EE}" = HP Product Detection
"{CCB9B81A-167F-4832-B305-D2A0430840B3}" = WebReg
"{CD65BFB7-291F-9D67-760B-4FD16337FCB9}" = CCC Help Italian
"{CDDCBBF1-2703-46BC-938B-BCC81A1EEAAA}" = SUPERAntiSpyware
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{D2E0F0CC-6BE0-490b-B08B-9267083E34C9}" = MarketResearch
"{D99A8E3A-AE5A-4692-8B19-6F16D454E240}" = Destination Component
"{DB98F489-0D1B-0244-2B95-24F4C9D6A5BD}" = CCC Help Spanish
"{DC0D3295-0697-808C-4F1F-44E58330C3E8}" = Catalyst Control Center Localization German
"{E08DC77E-D09A-4e36-8067-D6DBBCC5F8DC}" = VideoToolkit01
"{E3BFEE55-39E2-4BE0-B966-89FE583822C1}" = Dell Support Center
"{E548726E-F4E8-459f-BAB8-45551BC071E9}" = DJ_AIO_ProductContext
"{E623BB3F-F7ED-4148-BEB5-A0D1DB28B4DE}" = Media Converter for Philips
"{E646DCF0-5A68-11D5-B229-002078017FBF}" = Digital Line Detect
"{E79066AE-9AF1-9C3C-6F3A-95BC4A3C3E33}" = Catalyst Control Center Graphics Previews Common
"{E87B8271-8225-31ED-95BE-0C7DB1813F7C}" = CCC Help French
"{E87FE5BA-2E1B-A6F2-F40E-9D6865ADF886}" = Catalyst Control Center Localization French
"{ED439A64-F018-4DD4-8BA5-328D85AB09AB}" = Roxio Creator DE
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F18E39EE-5306-6765-9EE3-CD3ECFE9678F}" = Catalyst Control Center Graphics Previews Vista
"{F1E63043-54FC-429B-AB2C-31AF9FBA4BC7}" = 32 Bit HP CIO Components Installer
"{F318B83E-27E2-2EFF-12EE-667C02A062D9}" = CCC Help Portuguese
"{F42CD69D-E393-47c8-B2CD-B139C4ADA9A8}" = Copy
"{F63A3748-B93D-4360-9AD4-B064481A5C7B}" = Modem Diagnostic Tool
"{F6CB42B9-F033-4152-8813-FF11DA8E6A78}" = Dell Dock
"{FA8A44D7-3E8A-4034-9C4F-088FA6B72BC4}" = HP Deskjet All-In-One Software 9.0
"{FB665796-AB4E-4519-AA8E-83144A2BAEEA}" = BOX CLEANER
"{FCDBE9CF-CFB4-2260-8F84-09B6F7FD9A87}" = Catalyst Control Center Localization Italian
"{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Adobe Shockwave Player" = Adobe Shockwave Player
"BearShare MediaBar" = MediaBar
"CNXT_MODEM_PCI_VEN_14F1&DEV_2F20&SUBSYS_200F14F1" = Conexant D850 PCI V.92 Modem
"com.nyt.timesreader.78C54164786ADE80CB31E1C5D95607D0938C987A.1" = Times Reader
"conduitEngine" = Conduit Engine
"Digital DJ Pro" = Digital DJ Pro 1.7.0
"dynconff" = FriendsChecker
"ESET Online Scanner" = ESET Online Scanner v3
"FrostWire" = FrostWire 4.21.3
"GoToAssist" = GoToAssist 8.0.0.514
"Guffinsbar Uninstall" = Guffins
"HP Imaging Device Functions" = HP Imaging Device Functions 10.0
"HP Photosmart Essential" = HP Photosmart Essential 2.5
"HP Smart Web Printing" = HP Smart Web Printing
"HP Solution Center & Imaging Support Tools" = HP Solution Center 10.0
"HPExtendedCapabilities" = HP Customer Participation Program 10.0
"Kobo" = Kobo
"Luxor" = Luxor (remove only)
"Luxor 2" = Luxor 2 (remove only)
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware version 1.51.1.1800
"McAfee Security Scan" = McAfee Security Scan Plus
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Morphster Toolbar" = Morphster Toolbar
"Mozilla Firefox 4.0.1 (x86 en-US)" = Mozilla Firefox 4.0.1 (x86 en-US)
"MSC" = McAfee SecurityCenter
"Norton PC Checkup" = Norton PC Checkup
"PageRage Toolbar" = PageRage Toolbar
"PROSetDX" = Intel® PRO Network Connections 12.1.11.0
"RealArcade" = RealArcade
"Rhapsody" = Rhapsody
"Sewer Run_is1" = Sewer Run
"Shop for HP Supplies" = Shop for HP Supplies
"simppulltoolbar" = Simppull Toolbar (Remove Toolbar Only)
"SpywareBlaster_is1" = SpywareBlaster 4.4
"SpywareGuard_is1" = SpywareGuard v2.2
"StumbleUponIEToolbar" = StumbleUpon IE Toolbar
"TomTom HOME" = TomTom HOME 2.8.2.2264
"TuneUpMedia" = TuneUp Companion 1.9.0
"Veoh Video Compass" = Veoh Video Compass
"Veoh Web Player Beta" = Veoh Web Player Beta
"Yahoo! Companion" = Yahoo! Toolbar
"Yahoo! Software Update" = Yahoo! Software Update
"YInstHelper" = Yahoo! Install Manager
"YTdetect" = Yahoo! Detect
"Zwinky_42bar Uninstall" = Zwinky Toolbar

========== HKEY_USERS Uninstall List ==========

[HKEY_USERS\S-1-5-21-695326800-797908242-393843667-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"f031ef6ac137efc5" = Dell Driver Download Manager
"Move Media Player" = Move Media Player
"NetAssistant" = Freeze.com NetAssistant
"UnityWebPlayer" = Unity Web Player

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 12/7/2010 3:42:17 PM | Computer Name = robert-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledSPRetry 6755

Error - 12/7/2010 3:42:18 PM | Computer Name = robert-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: Continuously busy for more than a second

Error - 12/7/2010 3:42:18 PM | Computer Name = robert-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledEvent 7769

Error - 12/7/2010 3:42:18 PM | Computer Name = robert-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledSPRetry 7769

Error - 12/7/2010 3:42:19 PM | Computer Name = robert-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: Continuously busy for more than a second

Error - 12/7/2010 3:42:19 PM | Computer Name = robert-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledEvent 8783

Error - 12/7/2010 3:42:19 PM | Computer Name = robert-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledSPRetry 8783

Error - 12/7/2010 3:42:20 PM | Computer Name = robert-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: Continuously busy for more than a second

Error - 12/7/2010 3:42:20 PM | Computer Name = robert-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledEvent 9797

Error - 12/7/2010 3:42:20 PM | Computer Name = robert-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledSPRetry 9797

[ Media Center Events ]
Error - 12/24/2008 4:32:58 PM | Computer Name = robert-PC | Source = MCUpdate | ID = 0
Description = DownloadPackgeTask.SubTasksComplete: failed downloading package SportsSchedule.

Error - 5/20/2009 4:04:47 AM | Computer Name = robert-PC | Source = MCUpdate | ID = 0
Description = DownloadPackgeTask.SubTasksComplete: failed downloading package SportsSchedule.

Error - 6/10/2009 3:59:19 AM | Computer Name = robert-PC | Source = MCUpdate | ID = 0
Description = DownloadPackgeTask.SubTasksComplete: failed downloading package SportsSchedule.

[ System Events ]
Error - 8/31/2011 12:15:45 PM | Computer Name = robert-PC | Source = Service Control Manager | ID = 7000
Description =

Error - 8/31/2011 12:15:45 PM | Computer Name = robert-PC | Source = Service Control Manager | ID = 7000
Description =

Error - 8/31/2011 12:16:00 PM | Computer Name = robert-PC | Source = Service Control Manager | ID = 7022
Description =

Error - 8/31/2011 12:16:00 PM | Computer Name = robert-PC | Source = Service Control Manager | ID = 7031
Description =

Error - 8/31/2011 12:16:00 PM | Computer Name = robert-PC | Source = Service Control Manager | ID = 7026
Description =

Error - 8/31/2011 12:17:01 PM | Computer Name = robert-PC | Source = Service Control Manager | ID = 7031
Description =

Error - 8/31/2011 12:18:01 PM | Computer Name = robert-PC | Source = Service Control Manager | ID = 7034
Description =

Error - 8/31/2011 12:18:07 PM | Computer Name = robert-PC | Source = Service Control Manager | ID = 7031
Description =

Error - 8/31/2011 12:19:16 PM | Computer Name = robert-PC | Source = Service Control Manager | ID = 7031
Description =

Error - 8/31/2011 12:20:21 PM | Computer Name = robert-PC | Source = Service Control Manager | ID = 7034
Description =


< End of report >

[SweetTech]

Hi!

there is quite a few things missing from the 'start' menu, all the program files are gone, and windows still looks outdated. Also, I was here to do the tasks on the 27th, but wasn't able to finish everything, so the mbam log is from that date...

Please see this:

Please download UnHide.exe by Grinler.

It will unhide folders/files that were set to be hidden by the infection you had.



NEXT:



This is a manual fix for Vista/Windows 7 users:

1. Copy the entire content of this folder:
C:\Users\user_name\AppData\Local\Temp\smtmp\1
and paste it to this folder:
C:\Program Data\Start Menu

2. Copy the entire content of this folder:
C:\Users\user_name\AppData\Local\Temp\smtmp\2
and paste it to this folder:
C:\Users\user_name\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch

3. Copy the entire content of this folder:
C:\Users\user_name\AppData\Local\Temp\smtmp\3
and paste it to this folder:
C:\Users\user-name\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar

4. Copy the entire content of this folder:
C:\Users\user_name\AppData\Local\Temp\smtmp\4
and paste it to this folder:
C:\Program Data\Desktop

-- Note: The "Start Menu", "Quick Launch" and "Desktop" folders are system folders. In order to see them, you need to Reconfigure Windows to show hidden files, folders. In Windows Explorer go to Tools > Folder Options and click on the View tab. Under Advanced settings > Files and Folders > Hidden Files and Folders, uncheck "Hide Protected operating system Files (recommended)" and hit Apply > OK. In order to access the "Start Menu" folder, you may need to "take ownership" of that folder as shown here.

If the above does not work, then you can restore the defaults for the Start Menu and Administrative Tools as follows:

• Windows 7: Restore Default Shortcuts in Start Menu All Programs
• Vista: Restore Default Shortcuts in Start Menu Programs
• Restore the Administrative Tools folder with vista_ultimate_admintools.zip

For any other missing program shortcuts you will probably need to reinstall the application or manually create new shortcuts.




NEXT:



Malwarebytes' Anti-Malware

I see that you have Malwarebytes' Anti-Malware installed on your computer could you please do a scan using these settings:

• Open Malwarebytes' Anti-Malware
• Select the Update tab
• Click Check for Updates
• After the update have been completed, Select the Scanner tab.
• Select Perform quick scan, then click on Scan
• Leave the default options as it is and click on Start Scan
• When done, you will be prompted. Click OK, then click on Show Results
• Checked (ticked) all items and click on Remove Selected
• After it has removed the items, Notepad will open. Please post this log in your next reply. You can also find the log in the Logs tab. The bottom most log is the latest

Extra Note: If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts, click OK to either and let MBAM proceed with the disinfection process, if asked to restart the computer, please do so immediately.

[SweetTech]

Due to lack of feedback, this topic has been closed.

If you need this topic reopened, please contact a staff member. This applies only to the original topic starter. Everyone else please begin a New Topic.