[dcurtis113]

I cannot remove a browser hijacker I got infected with when I downloaded a video file converter from an untrusted source. I have tried ForeFront, Avast, AVG, and even Norton 360. There are also ads which appear on the lower right and left corners of the screen which show porn images, even on sites that are safe and trustworthy. I know the ads are not coming from those safe sites.

Please help me remove this!

-Don

OTL logfile created on: 11/8/2012 12:28:45 AM - Run 1
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\Don\Downloads
64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

5.87 Gb Total Physical Memory | 3.81 Gb Available Physical Memory | 65.03% Memory free
14.66 Gb Paging File | 11.37 Gb Available in Paging File | 77.53% Paging File free
Paging file location(s): c:\pagefile.sys 9010 9010 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 919.41 Gb Total Space | 611.47 Gb Free Space | 66.51% Space Free | Partition Type: NTFS
Drive F: | 3.61 Gb Total Space | 2.99 Gb Free Space | 82.97% Space Free | Partition Type: FAT32

Computer Name: GATEWAY-KITCHEN | User Name: Don | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan | Include 64bit Scans
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2012/11/08 00:28:26 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Don\Downloads\OTL.exe
PRC - [2012/11/07 23:46:18 | 001,807,800 | ---- | M] (Adobe Systems, Inc.) -- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_5_502_110.exe
PRC - [2012/10/24 12:50:37 | 000,917,984 | ---- | M] (Mozilla Corporation) -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe
PRC - [2012/10/18 17:33:50 | 026,643,352 | ---- | M] (Dropbox, Inc.) -- C:\Users\Don\AppData\Roaming\Dropbox\bin\Dropbox.exe
PRC - [2012/10/10 21:29:13 | 000,143,928 | R--- | M] (Symantec Corporation) -- C:\Program Files (x86)\Norton 360\Engine\20.2.0.19\ccsvchst.exe
PRC - [2012/10/09 08:13:43 | 000,692,152 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\SysWOW64\Macromed\Flash\FlashUtil32_11_4_402_287_ActiveX.exe
PRC - [2012/10/05 10:08:42 | 000,109,064 | ---- | M] (Wajam) -- C:\Program Files (x86)\Wajam\Updater\WajamUpdater.exe
PRC - [2012/04/18 17:09:12 | 000,083,032 | ---- | M] (Intuit Inc.) -- C:\Program Files (x86)\Quicken\qw.exe
PRC - [2012/02/23 11:30:40 | 000,059,240 | ---- | M] (Apple Inc.) -- C:\Program Files (x86)\Common Files\Apple\Internet Services\ubd.exe
PRC - [2010/11/05 22:54:22 | 000,013,336 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe
PRC - [2010/11/05 22:54:20 | 000,283,160 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe
PRC - [2010/10/14 03:11:39 | 000,487,424 | ---- | M] (Gadwin Systems, Inc) -- C:\Program Files (x86)\Gadwin Systems\PrintScreen\PrintScreen.exe
PRC - [2010/07/27 04:47:12 | 000,207,872 | ---- | M] (Alcatel-Lucent) -- C:\Program Files (x86)\Common Files\Motive\McciContextHookShim.exe
PRC - [2010/02/01 23:10:14 | 007,418,368 | ---- | M] (OpenOffice.org) -- C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin
PRC - [2010/02/01 23:10:10 | 007,424,000 | ---- | M] (OpenOffice.org) -- C:\Program Files (x86)\OpenOffice.org 3\program\soffice.exe
PRC - [2009/09/30 22:34:22 | 002,314,240 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe
PRC - [2009/09/30 22:33:08 | 000,262,144 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe
PRC - [2009/09/29 08:17:50 | 000,013,088 | ---- | M] (Intuit Inc.) -- C:\Program Files (x86)\Common Files\Intuit\Update Service\IntuitUpdateService.exe
PRC - [2009/08/28 04:38:58 | 001,150,496 | ---- | M] (Acer Incorporated) -- C:\Program Files (x86)\Gateway\Registration\GregHSRW.exe
PRC - [2009/08/03 11:05:48 | 000,498,160 | ---- | M] () -- C:\Program Files (x86)\Roxio\Roxio Burn\RoxioBurnLauncher.exe
PRC - [2009/07/20 16:07:10 | 000,124,416 | ---- | M] (IOI) -- C:\Program Files (x86)\Gateway Photo Frame\ButtonMonitor.exe
PRC - [2009/07/03 21:47:12 | 000,240,160 | ---- | M] (Acer) -- C:\Program Files\Gateway\Gateway Updater\UpdaterService.exe
PRC - [2008/11/09 15:48:14 | 000,602,392 | ---- | M] (Yahoo! Inc.) -- C:\Program Files (x86)\Yahoo!\SoftwareUpdate\YahooAUService.exe


========== Modules (No Company Name) ==========

MOD - [2012/11/07 23:46:17 | 014,586,808 | ---- | M] () -- C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_5_502_110.dll
MOD - [2012/10/24 12:50:39 | 002,295,264 | ---- | M] () -- C:\Program Files (x86)\Mozilla Firefox\mozjs.dll
MOD - [2012/06/14 02:44:13 | 000,475,648 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\IAStorUtil\1cb5f5d54ef9b24b90a51b006181fe71\IAStorUtil.ni.dll
MOD - [2012/06/14 02:40:21 | 011,833,344 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Web\a501b7960f6c6e2e39162b83f3303aaa\System.Web.ni.dll
MOD - [2012/06/14 02:39:59 | 012,436,480 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\7b7fbe651c6e72f12099a298654c9594\System.Windows.Forms.ni.dll
MOD - [2012/06/14 02:39:53 | 001,591,808 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\6bb439b3f87736d3248ae27d43e2c0d6\System.Drawing.ni.dll
MOD - [2012/05/30 09:51:08 | 000,699,280 | R--- | M] () -- C:\Program Files (x86)\Norton 360\Engine\20.2.0.19\wincfi39.dll
MOD - [2012/05/11 02:33:49 | 000,014,336 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\IAStorCommon\367af7fc22650701edfa7e8ecadcb273\IAStorCommon.ni.dll
MOD - [2012/05/11 02:30:17 | 000,771,584 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Runtime.Remo#\03dee80574f4ec770b6f77ca030ded6c\System.Runtime.Remoting.ni.dll
MOD - [2012/05/11 02:29:41 | 003,347,968 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\WindowsBase\46fce56db7685a586d3eeb7c373e3c1c\WindowsBase.ni.dll
MOD - [2012/05/11 02:29:36 | 005,452,800 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Xml\ba3d70b651454c7d49b407b93663bfed\System.Xml.ni.dll
MOD - [2012/05/11 02:29:33 | 007,967,232 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System\ce9ff6baf9053ed2ed673d948179195c\System.ni.dll
MOD - [2012/05/11 02:29:33 | 000,971,264 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Configuration\cfa9c506bfb9254c89dace7b83bc9f9d\System.Configuration.ni.dll
MOD - [2012/05/11 02:29:22 | 011,492,864 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\acfc1391e45fedd2a359778ea57d914c\mscorlib.ni.dll
MOD - [2011/09/27 07:23:00 | 000,087,912 | ---- | M] () -- C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll
MOD - [2011/09/27 07:22:40 | 001,242,472 | ---- | M] () -- C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll
MOD - [2010/03/14 23:12:15 | 000,970,752 | ---- | M] () -- C:\Program Files (x86)\OpenOffice.org 3\program\libxml2.dll
MOD - [2009/08/03 11:05:48 | 000,498,160 | ---- | M] () -- C:\Program Files (x86)\Roxio\Roxio Burn\RoxioBurnLauncher.exe
MOD - [2009/06/12 18:37:38 | 000,032,768 | ---- | M] () -- C:\Program Files (x86)\Gateway Photo Frame\IOIUSBLib.dll
MOD - [2009/06/12 18:37:36 | 000,025,088 | ---- | M] () -- C:\Program Files (x86)\Gateway Photo Frame\IOIHIDLib.dll


========== Services (SafeList) ==========

SRV:64bit: - [2010/09/22 17:10:10 | 000,057,184 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Program Files\Windows Live\Mesh\wlcrasvc.exe -- (wlcrasvc)
SRV:64bit: - [2009/07/03 21:47:12 | 000,240,160 | ---- | M] (Acer) [Auto | Running] -- C:\Program Files\Gateway\Gateway Updater\UpdaterService.exe -- (Updater Service)
SRV:64bit: - [2008/07/29 12:20:28 | 004,737,024 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Program Files\Microsoft Visual Studio 9.0\Common7\IDE\Remote Debugger\x64\msvsmon.exe -- (msvsmon90)
SRV:64bit: - [2007/04/05 22:42:14 | 000,077,216 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Microsoft Forefront\Client Security\Client\SSA\FcsSas.exe -- (FcsSas)
SRV - [2012/11/07 23:46:18 | 000,250,808 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)
SRV - [2012/10/31 20:03:37 | 000,115,168 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)
SRV - [2012/10/10 21:29:13 | 000,143,928 | R--- | M] (Symantec Corporation) [Auto | Running] -- C:\Program Files (x86)\Norton 360\Engine\20.2.0.19\ccSvcHst.exe -- (N360)
SRV - [2012/10/05 10:08:42 | 000,109,064 | ---- | M] (Wajam) [Auto | Running] -- C:\Program Files (x86)\Wajam\Updater\WajamUpdater.exe -- (WajamUpdater)
SRV - [2012/07/13 12:28:36 | 000,160,944 | R--- | M] (Skype Technologies) [Auto | Stopped] -- C:\Program Files (x86)\Skype\Updater\Updater.exe -- (SkypeUpdate)
SRV - [2010/11/20 07:19:20 | 000,397,824 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Windows\SysWOW64\inetsrv\iisw3adm.dll -- (WAS)
SRV - [2010/11/20 07:19:20 | 000,397,824 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysWOW64\inetsrv\iisw3adm.dll -- (W3SVC)
SRV - [2010/11/20 07:18:03 | 000,061,440 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysWOW64\inetsrv\apphostsvc.dll -- (AppHostSvc)
SRV - [2010/11/05 22:54:22 | 000,013,336 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe -- (IAStorDataMgrSvc)
SRV - [2010/03/18 12:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)
SRV - [2009/09/30 22:34:22 | 002,314,240 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe -- (UNS)
SRV - [2009/09/30 22:33:08 | 000,262,144 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe -- (LMS)
SRV - [2009/09/29 08:17:50 | 000,013,088 | ---- | M] (Intuit Inc.) [Auto | Running] -- C:\Program Files (x86)\Common Files\Intuit\Update Service\IntuitUpdateService.exe -- (IntuitUpdateService)
SRV - [2009/08/28 04:38:58 | 001,150,496 | ---- | M] (Acer Incorporated) [Auto | Running] -- C:\Program Files (x86)\Gateway\Registration\GregHSRW.exe -- (Greg_Service)
SRV - [2009/06/10 16:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)
SRV - [2008/11/09 15:48:14 | 000,602,392 | ---- | M] (Yahoo! Inc.) [Auto | Running] -- C:\Program Files (x86)\Yahoo!\SoftwareUpdate\YahooAUService.exe -- (YahooAUService)


========== Driver Services (SafeList) ==========

DRV:64bit: - [2012/11/03 13:51:25 | 000,177,312 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\SYMEVENT64x86.SYS -- (SymEvent)
DRV:64bit: - [2012/10/08 20:00:02 | 000,776,864 | ---- | M] (Symantec Corporation) [File_System | On_Demand | Running] -- C:\Windows\SysNative\drivers\N360x64\1402000.013\srtsp64.sys -- (SRTSP)
DRV:64bit: - [2012/10/03 20:40:35 | 001,133,216 | ---- | M] (Symantec Corporation) [File_System | Boot | Running] -- C:\Windows\SysNative\drivers\N360x64\1402000.013\symefa64.sys -- (SymEFA)
DRV:64bit: - [2012/10/03 20:40:20 | 000,493,216 | ---- | M] (Symantec Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\N360x64\1402000.013\symds64.sys -- (SymDS)
DRV:64bit: - [2012/10/03 20:19:14 | 000,168,096 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\N360x64\1402000.013\ccsetx64.sys -- (ccSet_N360)
DRV:64bit: - [2012/09/06 21:05:14 | 000,432,800 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\N360x64\1402000.013\symnets.sys -- (SymNetS)
DRV:64bit: - [2012/09/06 20:48:08 | 000,224,416 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\N360x64\1402000.013\ironx64.sys -- (SymIRON)
DRV:64bit: - [2012/05/25 00:36:55 | 000,037,496 | R--- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\N360x64\1402000.013\srtspx64.sys -- (SRTSPX)
DRV:64bit: - [2012/03/08 17:40:52 | 000,048,488 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\fssfltr.sys -- (fssfltr)
DRV:64bit: - [2012/03/01 01:46:16 | 000,023,408 | ---- | M] (Microsoft Corporation) [Recognizer | Boot | Unknown] -- C:\Windows\SysNative\drivers\fs_rec.sys -- (Fs_Rec)
DRV:64bit: - [2012/02/15 10:01:50 | 000,052,736 | ---- | M] (Apple, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\usbaapl64.sys -- (USBAAPL64)
DRV:64bit: - [2011/03/11 01:41:12 | 000,107,904 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata)
DRV:64bit: - [2011/03/11 01:41:12 | 000,027,008 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata)
DRV:64bit: - [2010/11/20 08:33:35 | 000,078,720 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD)
DRV:64bit: - [2010/11/20 06:07:05 | 000,059,392 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbFlt.sys -- (TsUsbFlt)
DRV:64bit: - [2010/11/05 22:45:48 | 000,438,808 | ---- | M] (Intel Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\iaStor.sys -- (iaStor)
DRV:64bit: - [2010/08/25 19:36:04 | 010,611,552 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\igdkmd64.sys -- (igfx)
DRV:64bit: - [2010/07/27 04:47:46 | 000,040,960 | ---- | M] (Printing Communications Assoc., Inc. (PCAUSA)) [Kernel | On_Demand | Running] -- C:\Program Files\Common Files\Motive\MRESP50a64.sys -- (MRESP50a64)
DRV:64bit: - [2010/07/27 04:47:36 | 000,043,008 | ---- | M] (Printing Communications Assoc., Inc. (PCAUSA)) [Kernel | On_Demand | Stopped] -- C:\Program Files\Common Files\Motive\MREMP50a64.sys -- (MREMP50a64)
DRV:64bit: - [2009/09/25 18:42:58 | 000,233,984 | ---- | M] (Intel® Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\IntcDAud.sys -- (IntcDAud)
DRV:64bit: - [2009/09/23 04:11:04 | 000,283,824 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\e1k62x64.sys -- (e1kexpress)
DRV:64bit: - [2009/09/16 23:54:54 | 000,056,344 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\HECIx64.sys -- (HECIx64)
DRV:64bit: - [2009/07/24 08:55:10 | 000,011,264 | ---- | M] (Primax Ltd) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\NMgamingms.sys -- (NMgamingmsFltr)
DRV:64bit: - [2009/07/18 00:18:48 | 000,109,480 | ---- | M] (JMicron Technology Corp.) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\jraid.sys -- (JRAID)
DRV:64bit: - [2009/07/13 20:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs)
DRV:64bit: - [2009/07/13 20:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2)
DRV:64bit: - [2009/07/13 20:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor)
DRV:64bit: - [2009/07/13 19:06:43 | 000,060,288 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\61883.sys -- (61883)
DRV:64bit: - [2009/07/13 19:06:43 | 000,048,768 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\avc.sys -- (Avc)
DRV:64bit: - [2009/07/13 19:06:42 | 000,061,440 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\msdv.sys -- (MSDV)
DRV:64bit: - [2009/07/09 06:00:00 | 000,055,280 | ---- | M] (Sonic Solutions) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\PxHlpa64.sys -- (PxHlpa64)
DRV:64bit: - [2009/06/10 15:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv)
DRV:64bit: - [2009/06/10 15:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv)
DRV:64bit: - [2009/06/10 15:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a)
DRV:64bit: - [2009/06/10 15:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir)
DRV:64bit: - [2009/05/18 12:17:08 | 000,034,152 | ---- | M] (GEAR Software Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\GEARAspiWDM.sys -- (GEARAspiWDM)
DRV - [2012/11/03 13:54:33 | 002,084,000 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_20.1.0.24\Definitions\VirusDefs\20121107.018\ex64.sys -- (NAVEX15)
DRV - [2012/11/03 13:54:33 | 000,126,112 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_20.1.0.24\Definitions\VirusDefs\20121107.018\eng64.sys -- (NAVENG)
DRV - [2012/11/02 14:26:10 | 000,513,184 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_20.1.0.24\Definitions\IPSDefs\20121106.002\IDSviA64.sys -- (IDSVia64)
DRV - [2012/10/05 13:23:26 | 001,385,632 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_20.1.0.24\Definitions\BASHDefs\20121030.002\BHDrvx64.sys -- (BHDrvx64)
DRV - [2012/08/18 04:00:00 | 000,484,512 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys -- (eeCtrl)
DRV - [2012/08/18 04:00:00 | 000,138,912 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys -- (EraserUtilRebootDrv)
DRV - [2010/07/27 04:47:30 | 000,020,096 | ---- | M] (Printing Communications Assoc., Inc. (PCAUSA)) [Kernel | On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Motive\MRESP50.sys -- (MRESP50)
DRV - [2010/07/27 04:47:10 | 000,021,248 | ---- | M] (Printing Communications Assoc., Inc. (PCAUSA)) [Kernel | On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Motive\MREMP50.sys -- (MREMP50)
DRV - [2009/07/13 20:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://homepage.gate...25v155k49k1r25p
IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://homepage.gate...25v155k49k1r25p
IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {9BB47C17-9C68-4BB3-B188-DD9AF0FD2406}
IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/...ms}&FORM=IE8SRC
IE:64bit: - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://www.google.co...g}&sourceid=ie7
IE:64bit: - HKLM\..\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD21}: "URL" = http://dts.search-re...q={searchTerms}
IE:64bit: - HKLM\..\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2406}: "URL" = http://dts.search-re...q={searchTerms}
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://homepage.gate...25v155k49k1r25p
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://homepage.gate...25v155k49k1r25p
IE - HKLM\..\SearchScopes,DefaultScope = {9BB47C17-9C68-4BB3-B188-DD9AF0FD2406}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/...ms}&FORM=IE8SRC
IE - HKLM\..\SearchScopes\{67A2568C-7A0A-4EED-AECC-B5405DE63B64}: "URL" = http://www.google.co...ng}&rlz=1I7ACGW
IE - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://www.google.co...g}&sourceid=ie7
IE - HKLM\..\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD21}: "URL" = http://dts.search-re...q={searchTerms}
IE - HKLM\..\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2406}: "URL" = http://dts.search-re...q={searchTerms}

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.msn.com/?...OIE9MSE&PC=UP09
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com/
IE - HKCU\..\SearchScopes,DefaultScope = {9BB47C17-9C68-4BB3-B188-DD9AF0FD2406}
IE - HKCU\..\SearchScopes\{12183F9D-4845-46CC-90E7-E0D7664975AE}: "URL" = http://search.yahoo....49,17118,0,18,0
IE - HKCU\..\SearchScopes\{32BA2DAB-502A-430A-ACA2-127726A49D00}: "URL" = http://search.avg.co...}&ychte=us&nt=1
IE - HKCU\..\SearchScopes\{67A2568C-7A0A-4EED-AECC-B5405DE63B64}: "URL" = http://www.bing.com/...rc=IE-SearchBox
IE - HKCU\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://www.google.co...&rlz=1I7ADFA_en
IE - HKCU\..\SearchScopes\{99905FB6-2FC9-447A-BF9D-7896ABCF31C1}: "URL" = http://www.google.co...&rlz=1I7ADFA_en
IE - HKCU\..\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD21}: "URL" = http://dts.search-re...q={searchTerms}
IE - HKCU\..\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2406}: "URL" = http://dts.search-re...q={searchTerms}
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = <local>;*.local

========== FireFox ==========

FF - prefs.js..browser.search.defaultenginename: "Search Results"
FF - prefs.js..browser.search.order.1: "Search Results"
FF - prefs.js..browser.search.selectedEngine: "Google"
FF - prefs.js..browser.startup.homepage: "http://www.google.com/"
FF - prefs.js..extensions.enabledAddons: {BBDA0591-3099-440a-AA10-41764D9DB4DB}:11.1.1.5 - 2
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}:6.0.21
FF - prefs.js..extensions.enabledItems: {DDC359D1-844A-42a7-9AA1-88A850A938A8}:2.0.12
FF - prefs.js..extensions.enabledItems: {c45c406e-ab73-11d8-be73-000a95be3b12}:1.1.9
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}:6.0.23
FF - prefs.js..extensions.enabledItems: {1E73965B-8B48-48be-9C8D-68B920ABC1C4}:12.0.0.1912
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0030-ABCDEFFEDCBA}:6.0.30
FF - prefs.js..extensions.enabledItems: [email protected]:5.0.93.0
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0025-ABCDEFFEDCBA}:6.0.25
FF - prefs.js..keyword.URL: "http://dts.search-re...&o=APN10645&q="


FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_5_502_110.dll File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@bestbuy.com/npBestBuyPcAppDetector,version=1.0: C:\ProgramData\Best Buy pc app\npBestBuyPcAppDetector.dll (Best Buy)
FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\5.1.10411.0\npctrl.dll ( Microsoft Corporation)
FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/wpi,version=1.0: C:\Program Files\Microsoft\Web Platform Installer\\npwpidetector.dll ()
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_5_502_110.dll ()
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@bestbuy.com/npBestBuyPcAppDetector,version=1.0: C:\ProgramData\Best Buy pc app\npBestBuyPcAppDetector.dll (Best Buy)
FF - HKLM\Software\MozillaPlugins\@ei.CouponAlert_2p.com/Plugin: C:\Program Files (x86)\CouponAlert_2pEI\Installr\1.bin\NP2pEISB.dll File not found
FF - HKLM\Software\MozillaPlugins\@ei.RecipeHub_2j.com/Plugin: C:\Program Files (x86)\RecipeHub_2jEI\Installr\1.bin\NP2jEISB.dll File not found
FF - HKLM\Software\MozillaPlugins\@ei.TotalRecipeSearch_14.com/Plugin: C:\Program Files (x86)\TotalRecipeSearch_14EI\Installr\1.bin\NP14EISB.dll File not found
FF - HKLM\Software\MozillaPlugins\@google.com/npPicasa3,version=3.0.0: C:\Program Files (x86)\Google\Picasa3\npPicasa3.dll (Google, Inc.)
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.9.2: C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.9.2: C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files (x86)\Microsoft Silverlight\5.1.10411.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3508.1109: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3538.0513: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3555.0308: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/wpi,version=1.1: C:\Program Files\Microsoft\Web Platform Installer\\npwpidetector.dll ()
FF - HKLM\Software\MozillaPlugins\@Motive.com/NpMotive,version=1.0: C:\Program Files (x86)\Common Files\Motive\npMotive.dll (Alcatel-Lucent)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.21.123\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.21.123\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKCU\Software\MozillaPlugins\@Skype Limited.com/Facebook Video Calling Plugin: C:\Users\Don\AppData\Local\Facebook\Video\Skype\npFacebookVideoCalling.dll (Skype Limited)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{BBDA0591-3099-440a-AA10-41764D9DB4DB}: C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_20.1.0.24\IPSFFPlgn\ [2012/11/03 13:51:54 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{2D3F3651-74B9-4795-BDEC-6DA2F431CB62}: C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_20.1.0.24\coFFPlgn\ [2012/11/05 21:56:23 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\[email protected]: C:\Program Files (x86)\Mozilla FireFox\extensions\[email protected] [2012/11/04 10:09:51 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 16.0.2\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012/11/05 20:43:26 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 16.0.2\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2012/10/19 11:42:01 | 000,000,000 | ---D | M]

[2012/11/03 22:05:23 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Don\AppData\Roaming\Mozilla\Extensions
[2012/11/05 21:23:19 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Don\AppData\Roaming\Mozilla\Firefox\Profiles\6lrk0spm.default\extensions
[2012/08/11 23:21:12 | 000,002,323 | ---- | M] () -- C:\Users\Don\AppData\Roaming\Mozilla\Firefox\Profiles\6lrk0spm.default\searchplugins\askcom.xml
[2012/10/28 07:12:27 | 000,002,687 | ---- | M] () -- C:\Users\Don\AppData\Roaming\Mozilla\Firefox\Profiles\6lrk0spm.default\searchplugins\Search_Results.xml
[2012/11/05 20:52:29 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\Mozilla Firefox\extensions
[2012/11/04 10:09:51 | 000,000,000 | ---D | M] (InfoAtoms) -- C:\Program Files (x86)\Mozilla Firefox\extensions\[email protected]
[2012/11/03 13:51:54 | 000,000,000 | ---D | M] (Norton Vulnerability Protection) -- C:\PROGRAMDATA\NORTON\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_20.1.0.24\IPSFFPLGN
[2012/10/24 12:50:58 | 000,261,600 | ---- | M] (Mozilla Foundation) -- C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll
[2012/10/24 12:50:17 | 000,002,465 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml
[2012/10/28 07:12:27 | 000,002,687 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\Search_Results.xml
[2012/10/24 12:50:17 | 000,002,058 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\twitter.xml

========== Chrome ==========

CHR - homepage: http://www.searchnu.com/406
CHR - default_search_provider: ()
CHR - default_search_provider: search_url =
CHR - default_search_provider: suggest_url =
CHR - homepage: http://www.searchnu.com/406
CHR - Extension: No name found = C:\Users\Don\AppData\Local\Google\Chrome\User Data\Default\Extensions\aciahcmjmecflokailenpkdchphgkefd\2.7.9_0\
CHR - Extension: No name found = C:\Users\Don\AppData\Local\Google\Chrome\User Data\Default\Extensions\icmlaeflemplmjndnaapfdbbnpncnbda\7.0.1456_0\
CHR - Extension: No name found = C:\Users\Don\AppData\Local\Google\Chrome\User Data\Default\Extensions\mcbkbpnkkkipelfledbfocopglifcfmi\2.2_0\

O1 HOSTS File: ([2012/08/10 20:46:40 | 000,001,392 | RHS- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: ::1 localhost
O1 - Hosts: 78.46.61.26 www.google-analytics.com.
O1 - Hosts: 78.46.61.26 ad-emea.doubleclick.net.
O1 - Hosts: 78.46.61.26 www.statcounter.com.
O1 - Hosts: 108.163.215.51 www.google-analytics.com.
O1 - Hosts: 108.163.215.51 ad-emea.doubleclick.net.
O1 - Hosts: 108.163.215.51 www.statcounter.com.
O2 - BHO: (InfoAtoms) - {103089DA-0F31-4A8B-843F-7D24A7FE8345} - C:\Program Files (x86)\InfoAtoms\IE32\InfoAtomsClientIE.dll (InfoAtoms Inc.)
O2 - BHO: (Norton Identity Protection) - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files (x86)\Norton 360\Engine\20.2.0.19\coieplg.dll (Symantec Corporation)
O2 - BHO: (Norton Vulnerability Protection) - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files (x86)\Norton 360\Engine\20.2.0.19\ips\ipsbho.dll (Symantec Corporation)
O2 - BHO: (Java™ Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
O2 - BHO: (Wajam) - {A7A6995D-6EE1-4FD1-A258-49395D5BF99C} - C:\Program Files (x86)\Wajam\IE\priam_bho.dll (Wajam)
O2 - BHO: (Java™ Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O2 - BHO: (PricePeep) - {FD6D90C0-E6EE-4BC6-B9F7-9ED319698007} - C:\Program Files (x86)\PricePeep\pricepeep.dll (PricePeep)
O3:64bit: - HKLM\..\Toolbar: (no name) - 10 - No CLSID value found.
O3:64bit: - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3 - HKLM\..\Toolbar: (Norton Toolbar) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton 360\Engine\20.2.0.19\coieplg.dll (Symantec Corporation)
O3 - HKLM\..\Toolbar: (no name) - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - No CLSID value found.
O3 - HKLM\..\Toolbar: (no name) - 10 - No CLSID value found.
O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - No CLSID value found.
O4:64bit: - HKLM..\Run: [ATT-SST_McciTrayApp] C:\Program Files\ATT-SST\McciTrayApp.exe (Alcatel-Lucent)
O4:64bit: - HKLM..\Run: [HotKeysCmds] C:\Windows\SysNative\hkcmd.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [IgfxTray] C:\Windows\SysNative\igfxtray.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [Persistence] C:\Windows\SysNative\igfxpers.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Realtek Semiconductor)
O4 - HKLM..\Run: [APSDaemon] C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
O4 - HKLM..\Run: [Desktop Disc Tool] C:\Program Files (x86)\Roxio\Roxio Burn\RoxioBurnLauncher.exe ()
O4 - HKLM..\Run: [Gateway Photo Frame] C:\Program Files (x86)\Gateway Photo Frame\ButtonMonitor.exe (IOI)
O4 - HKLM..\Run: [IAStorIcon] C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe (Intel Corporation)
O4 - HKLM..\Run: [JMB36X IDE Setup] C:\Windows\RaidTool\xInsIDE.exe ()
O4 - HKCU..\Run: [Facebook Update] C:\Users\Don\AppData\Local\Facebook\Update\FacebookUpdate.exe (Facebook Inc.)
O4 - HKCU..\Run: [Gadwin PrintScreen] C:\Program Files (x86)\Gadwin Systems\PrintScreen\PrintScreen.exe (Gadwin Systems, Inc)
O4 - HKCU..\Run: [MobileDocuments] C:\Program Files (x86)\Common Files\Apple\Internet Services\ubd.exe (Apple Inc.)
O4 - Startup: C:\Users\Don\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk = C:\Users\Don\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
O4 - Startup: C:\Users\Don\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.2.lnk = C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe ()
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: LogonHoursAction = 2
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DontDisplayLogonHoursWarnings = 1
O8:64bit: - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\Windows\system32\GPhotos.scr/200 File not found
O8 - Extra context menu item: Add to Google Photos Screensa&ver - C:\Windows\SysWow64\GPhotos.scr (Google Inc.)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000009 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000009 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)
O1364bit: - gopher Prefix: missing
O13 - gopher Prefix: missing
O15 - HKCU\..Trusted Domains: $talisma_url$ ([]https in Trusted sites)
O15 - HKCU\..Trusted Domains: intuit.com ([ttlc] https in Trusted sites)
O15 - HKCU\..Trusted Domains: utoledo.edu ([myvpn] https in Trusted sites)
O16:64bit: - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://javadl-esd.su...indows-i586.cab (Reg Error: Key error.)
O16 - DPF: {55963676-2F5E-4BAF-AC28-CF26AA587566} https://myvpn.utoled...ries/vpnweb.cab (Cisco AnyConnect VPN Client Web Control)
O16 - DPF: {8100D56A-5661-482C-BEE8-AFECE305D968} http://upload.facebo...oUploader55.cab (Facebook Photo Uploader 5 Control)
O16 - DPF: {BEA7310D-06C4-4339-A784-DC3804819809} http://mywayphotos.r...veX_Control.cab (Photo Upload Plugin Class)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.ad...Plus/1.6/gp.cab (Reg Error: Key error.)
O16 - DPF: {F0006AA7-D371-4315-888F-D143BD1DFA09} http://cms.utoledo.e...b/PopupMenu.dll (Merant Collage PopupMenu Control)
O16 - DPF: Garmin Communicator Plug-In https://static.garmi...inAxControl.CAB (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 72.240.13.7 72.240.13.5
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{9B33559C-0F3D-4964-9E41-FEA57309131C}: DhcpNameServer = 72.240.13.7 72.240.13.5
O18:64bit: - Protocol\Handler\livecall - No CLSID value found
O18:64bit: - Protocol\Handler\msdaipp - No CLSID value found
O18:64bit: - Protocol\Handler\msdaipp\0x00000001 - No CLSID value found
O18:64bit: - Protocol\Handler\msdaipp\oledb - No CLSID value found
O18:64bit: - Protocol\Handler\ms-help - No CLSID value found
O18:64bit: - Protocol\Handler\ms-itss - No CLSID value found
O18:64bit: - Protocol\Handler\msnim - No CLSID value found
O18:64bit: - Protocol\Handler\mso-offdap11 - No CLSID value found
O18:64bit: - Protocol\Handler\skype4com - No CLSID value found
O18:64bit: - Protocol\Handler\wlmailhtml - No CLSID value found
O18:64bit: - Protocol\Handler\wlpg - No CLSID value found
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysWOW64\userinit.exe (Microsoft Corporation)
O20:64bit: - Winlogon\Notify\igfxcui: DllName - (igfxdev.dll) - C:\Windows\SysNative\igfxdev.dll (Intel Corporation)
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O32 - HKLM CDRom: AutoRun - 1
O34 - HKLM BootExecute: (autocheck autochk *)
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)

========== Files/Folders - Created Within 30 Days ==========

[2012/11/06 07:45:01 | 000,000,000 | ---D | C] -- C:\Users\Don\AppData\Local\{645359A3-3E98-41FF-BAAE-D8AE408113C5}
[2012/11/05 21:19:52 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Java
[2012/11/05 18:18:03 | 000,000,000 | ---D | C] -- C:\Users\Don\AppData\Local\{C2591D4A-637E-4BE8-849E-4E7A80BF97B8}
[2012/11/04 10:10:21 | 000,000,000 | ---D | C] -- C:\ProgramData\Real
[2012/11/04 10:10:18 | 000,000,000 | ---D | C] -- C:\Users\Don\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\blinkx beat
[2012/11/04 10:10:18 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Blinkx
[2012/11/04 10:10:06 | 000,000,000 | ---D | C] -- C:\Users\Don\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Wajam
[2012/11/04 10:10:03 | 000,000,000 | ---D | C] -- C:\Users\Don\AppData\Local\Wajam
[2012/11/04 10:10:02 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Wajam
[2012/11/04 10:09:53 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\PricePeep
[2012/11/04 10:09:41 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\InfoAtoms
[2012/11/04 07:40:17 | 000,000,000 | ---D | C] -- C:\Users\Don\AppData\Local\{5D9E46C7-69BD-4A76-B5DB-F7F1B5CA4549}
[2012/11/03 19:39:51 | 000,000,000 | ---D | C] -- C:\Users\Don\AppData\Local\{9ADF526F-23FC-4839-ADBC-21624D093ECF}
[2012/11/03 16:56:02 | 001,133,216 | ---- | C] (Symantec Corporation) -- C:\Windows\SysNative\drivers\N360x64\1402000.013\symefa64.sys
[2012/11/03 16:56:02 | 000,776,864 | ---- | C] (Symantec Corporation) -- C:\Windows\SysNative\drivers\N360x64\1402000.013\srtsp64.sys
[2012/11/03 16:56:02 | 000,493,216 | ---- | C] (Symantec Corporation) -- C:\Windows\SysNative\drivers\N360x64\1402000.013\symds64.sys
[2012/11/03 16:56:02 | 000,432,800 | ---- | C] (Symantec Corporation) -- C:\Windows\SysNative\drivers\N360x64\1402000.013\symnets.sys
[2012/11/03 16:56:02 | 000,224,416 | ---- | C] (Symantec Corporation) -- C:\Windows\SysNative\drivers\N360x64\1402000.013\ironx64.sys
[2012/11/03 16:56:02 | 000,168,096 | ---- | C] (Symantec Corporation) -- C:\Windows\SysNative\drivers\N360x64\1402000.013\ccsetx64.sys
[2012/11/03 16:56:02 | 000,037,496 | R--- | C] (Symantec Corporation) -- C:\Windows\SysNative\drivers\N360x64\1402000.013\srtspx64.sys
[2012/11/03 16:56:02 | 000,023,448 | R--- | C] (Symantec Corporation) -- C:\Windows\SysNative\drivers\N360x64\1402000.013\symelam.sys
[2012/11/03 16:54:59 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\drivers\N360x64\1402000.013
[2012/11/03 14:01:42 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Symantec Shared
[2012/11/03 13:51:28 | 000,177,312 | ---- | C] (Symantec Corporation) -- C:\Windows\SysNative\drivers\SYMEVENT64x86.SYS
[2012/11/03 13:51:24 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Symantec Shared
[2012/11/03 13:51:24 | 000,000,000 | ---D | C] -- C:\Program Files\Symantec
[2012/11/03 13:50:33 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\drivers\N360x64
[2012/11/03 13:50:31 | 000,000,000 | R--D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Norton 360
[2012/11/03 13:50:31 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Norton 360
[2012/11/03 13:50:13 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\NortonInstaller
[2012/11/03 07:39:27 | 000,000,000 | ---D | C] -- C:\Users\Don\AppData\Local\{28667192-D27C-4262-B860-781D5F5C6272}
[2012/11/01 20:26:33 | 000,000,000 | ---D | C] -- C:\Users\Don\AppData\Local\{E4D52803-0C42-4D19-9077-DBF5AE023AD0}
[2012/11/01 06:18:58 | 000,000,000 | ---D | C] -- C:\Users\Don\AppData\Local\{C832AF8E-8D41-44E2-BE7A-730EB1ECABA2}
[2012/10/31 18:18:34 | 000,000,000 | ---D | C] -- C:\Users\Don\AppData\Local\{057CC137-5AA2-454F-986E-0FBCA73CA2FB}
[2012/10/29 05:59:34 | 000,000,000 | ---D | C] -- C:\Users\Don\AppData\Local\{632AFADD-B58A-4566-A237-F6187C4EB629}
[2012/10/28 17:26:05 | 000,000,000 | R--D | C] -- C:\Users\Don\Dropbox
[2012/10/28 16:48:36 | 000,000,000 | ---D | C] -- C:\Users\Don\AppData\Local\{24B60F8E-DCE2-4CC3-A9C7-42D8BA4CA3B8}
[2012/10/27 21:58:41 | 000,000,000 | ---D | C] -- C:\Users\Don\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox
[2012/10/27 21:57:41 | 000,000,000 | ---D | C] -- C:\Users\Don\AppData\Roaming\Dropbox
[2012/10/24 04:12:23 | 000,000,000 | ---D | C] -- C:\Users\Don\AppData\Local\{F83318D8-FA48-416A-A6E3-200D7BCCEC4B}
[2012/10/19 11:41:39 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Mozilla Firefox
[2012/10/18 18:30:50 | 000,000,000 | ---D | C] -- C:\Users\Don\AppData\Local\{56C2019B-0890-4A4D-BBA4-21A07B700DB2}
[2012/10/16 18:29:50 | 000,000,000 | ---D | C] -- C:\Users\Don\AppData\Local\{885F6081-48C0-4248-B752-FAD84C4BD3D0}
[2012/10/15 18:29:38 | 000,000,000 | ---D | C] -- C:\Users\Don\AppData\Local\{B576AC9D-0002-43BB-A12C-76008E0F70A3}
[2012/10/15 18:23:57 | 000,000,000 | ---D | C] -- C:\Users\Don\AppData\Local\{CC2E532F-57A2-46F8-ABA0-850DE384CDAF}
[2012/10/15 18:03:17 | 000,000,000 | ---D | C] -- C:\Users\Don\AppData\Local\{816D545A-E804-4B52-A39B-F04EF8EFDC9D}
[2012/10/15 06:03:05 | 000,000,000 | ---D | C] -- C:\Users\Don\AppData\Local\{45BD9130-4EC6-4CB5-B99A-2EABF35B78DE}
[2012/10/14 13:33:53 | 000,000,000 | ---D | C] -- C:\Users\Don\AppData\Local\{CB677BA9-D13D-4375-B527-A2F3237ECB22}
[2012/10/11 05:17:54 | 000,000,000 | ---D | C] -- C:\Users\Don\AppData\Local\{C2B2CA9F-0FF9-4DD1-A6D4-9C623E82F182}
[2012/10/10 12:31:45 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Citrix
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2012/11/08 00:19:00 | 000,000,898 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2012/11/08 00:13:00 | 000,000,830 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job
[2012/11/07 23:53:00 | 000,000,920 | ---- | M] () -- C:\Windows\tasks\FacebookUpdateTaskUserS-1-5-21-3658333919-145166663-2624550834-1001UA.job
[2012/11/07 23:41:52 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2012/11/07 17:53:01 | 000,000,898 | ---- | M] () -- C:\Windows\tasks\FacebookUpdateTaskUserS-1-5-21-3658333919-145166663-2624550834-1001Core.job
[2012/11/07 17:03:39 | 000,000,894 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2012/11/07 06:37:17 | 004,780,032 | ---- | M] () -- C:\Users\Don\Desktop\withnellquicken2005Cpy2.QDF
[2012/11/05 22:02:01 | 000,009,920 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2012/11/05 22:02:01 | 000,009,920 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2012/11/05 21:53:52 | 000,000,460 | ---- | M] () -- C:\Windows\tasks\SDMsgUpdate (TE).job
[2012/11/05 21:53:26 | 429,203,455 | -HS- | M] () -- C:\hiberfil.sys
[2012/11/05 21:27:48 | 000,854,392 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
[2012/11/05 21:27:48 | 000,717,534 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
[2012/11/05 21:27:48 | 000,138,304 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
[2012/11/05 20:43:28 | 000,001,154 | ---- | M] () -- C:\Users\Public\Desktop\Mozilla Firefox.lnk
[2012/11/05 06:07:52 | 004,598,113 | ---- | M] () -- C:\Users\Don\Desktop\Moms Quicken.QDF
[2012/11/04 22:36:16 | 000,000,632 | RHS- | M] () -- C:\Users\Don\ntuser.pol
[2012/11/04 19:01:19 | 000,016,200 | ---- | M] (McAfee, Inc.) -- C:\Windows\stinger.sys
[2012/11/04 10:10:18 | 000,001,562 | ---- | M] () -- C:\Users\Don\Desktop\blinkx beat.lnk
[2012/11/03 21:57:58 | 002,062,013 | ---- | M] () -- C:\Windows\SysNative\drivers\N360x64\1402000.013\Cat.DB
[2012/11/03 21:57:02 | 000,010,074 | ---- | M] () -- C:\Windows\SysNative\drivers\N360x64\1402000.013\VT20121008.022
[2012/11/03 13:51:25 | 000,177,312 | ---- | M] (Symantec Corporation) -- C:\Windows\SysNative\drivers\SYMEVENT64x86.SYS
[2012/11/03 13:51:25 | 000,007,466 | ---- | M] () -- C:\Windows\SysNative\drivers\SYMEVENT64x86.CAT
[2012/11/03 13:51:25 | 000,000,855 | ---- | M] () -- C:\Windows\SysNative\drivers\SYMEVENT64x86.INF
[2012/11/02 05:46:02 | 000,010,870 | ---- | M] () -- C:\Users\Don\AppData\Roaming\wklnhst.dat
[2012/11/01 21:50:22 | 000,012,288 | ---- | M] () -- C:\Users\Don\Desktop\Outline of Kim.wps
[2012/11/01 06:21:09 | 000,010,240 | ---- | M] () -- C:\Users\Don\Desktop\Girl Scouts.wps
[2012/10/31 05:17:08 | 000,012,800 | ---- | M] () -- C:\Users\Don\Desktop\St. Pius Endowment.xlr
[2012/10/28 18:38:40 | 000,008,380 | ---- | M] () -- C:\Users\Don\Desktop\Finance tracker by Kim.csv
[2012/10/28 18:33:08 | 000,008,264 | ---- | M] () -- C:\Users\Don\Desktop\Finance tracker.csv
[2012/10/28 17:26:05 | 000,001,052 | ---- | M] () -- C:\Users\Don\Desktop\Dropbox.lnk
[2012/10/27 21:58:49 | 000,001,062 | ---- | M] () -- C:\Users\Don\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
[2012/10/27 11:29:36 | 000,009,728 | ---- | M] () -- C:\Users\Don\Documents\daniel contract broken 10-27-12.wps
[2012/10/25 18:58:14 | 000,013,749 | ---- | M] () -- C:\Users\Don\Desktop\MLA format of Mr.Kim.odt
[2012/10/24 23:38:52 | 007,467,359 | ---- | M] () -- C:\Users\Don\AppData\Local\census.cache
[2012/10/24 23:33:24 | 000,131,889 | ---- | M] () -- C:\Users\Don\AppData\Local\ars.cache
[2012/10/22 22:22:50 | 000,000,036 | ---- | M] () -- C:\Users\Don\AppData\Local\housecall.guid.cache
[2012/10/19 07:10:00 | 000,000,172 | ---- | M] () -- C:\Windows\SysNative\drivers\N360x64\1402000.013\isolate.ini
[2012/10/14 23:01:13 | 000,019,002 | ---- | M] () -- C:\Users\Don\Desktop\Les Miserable.odt
[2012/10/14 22:58:41 | 000,000,321 | ---- | M] () -- C:\Users\Don\Desktop\Already tagged.URL
[2012/10/10 21:25:22 | 000,007,605 | ---- | M] () -- C:\Windows\SysNative\drivers\N360x64\1402000.013\srtspx64.cat
[2012/10/10 21:25:22 | 000,007,601 | ---- | M] () -- C:\Windows\SysNative\drivers\N360x64\1402000.013\srtsp64.cat
[2012/10/10 21:25:22 | 000,001,418 | ---- | M] () -- C:\Windows\SysNative\drivers\N360x64\1402000.013\srtspx64.inf
[2012/10/10 12:31:20 | 000,060,304 | ---- | M] () -- C:\Users\Don\g2mdlhlpx.exe
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]

========== Files Created - No Company Name ==========

[2012/11/04 10:10:18 | 000,001,562 | ---- | C] () -- C:\Users\Don\Desktop\blinkx beat.lnk
[2012/11/03 21:57:02 | 002,062,013 | ---- | C] () -- C:\Windows\SysNative\drivers\N360x64\1402000.013\Cat.DB
[2012/11/03 21:57:02 | 000,010,074 | ---- | C] () -- C:\Windows\SysNative\drivers\N360x64\1402000.013\VT20121008.022
[2012/11/03 16:56:02 | 000,009,670 | R--- | C] () -- C:\Windows\SysNative\drivers\N360x64\1402000.013\symelam64.cat
[2012/11/03 16:56:02 | 000,007,611 | ---- | C] () -- C:\Windows\SysNative\drivers\N360x64\1402000.013\ccsetx64.cat
[2012/11/03 16:56:02 | 000,007,605 | ---- | C] () -- C:\Windows\SysNative\drivers\N360x64\1402000.013\srtspx64.cat
[2012/11/03 16:56:02 | 000,007,603 | ---- | C] () -- C:\Windows\SysNative\drivers\N360x64\1402000.013\symefa64.cat
[2012/11/03 16:56:02 | 000,007,601 | ---- | C] () -- C:\Windows\SysNative\drivers\N360x64\1402000.013\symnet64.cat
[2012/11/03 16:56:02 | 000,007,601 | ---- | C] () -- C:\Windows\SysNative\drivers\N360x64\1402000.013\srtsp64.cat
[2012/11/03 16:56:02 | 000,007,597 | ---- | C] () -- C:\Windows\SysNative\drivers\N360x64\1402000.013\symds64.cat
[2012/11/03 16:56:02 | 000,007,593 | ---- | C] () -- C:\Windows\SysNative\drivers\N360x64\1402000.013\iron.cat
[2012/11/03 16:56:02 | 000,003,433 | ---- | C] () -- C:\Windows\SysNative\drivers\N360x64\1402000.013\symefa.inf
[2012/11/03 16:56:02 | 000,002,851 | ---- | C] () -- C:\Windows\SysNative\drivers\N360x64\1402000.013\symds.inf
[2012/11/03 16:56:02 | 000,001,440 | ---- | C] () -- C:\Windows\SysNative\drivers\N360x64\1402000.013\symnet.inf
[2012/11/03 16:56:02 | 000,001,437 | ---- | C] () -- C:\Windows\SysNative\drivers\N360x64\1402000.013\srtsp64.inf
[2012/11/03 16:56:02 | 000,001,418 | ---- | C] () -- C:\Windows\SysNative\drivers\N360x64\1402000.013\srtspx64.inf
[2012/11/03 16:56:02 | 000,000,996 | R--- | C] () -- C:\Windows\SysNative\drivers\N360x64\1402000.013\symelam.inf
[2012/11/03 16:56:02 | 000,000,853 | ---- | C] () -- C:\Windows\SysNative\drivers\N360x64\1402000.013\ccsetx64.inf
[2012/11/03 16:56:02 | 000,000,767 | ---- | C] () -- C:\Windows\SysNative\drivers\N360x64\1402000.013\iron.inf
[2012/11/03 16:55:00 | 000,009,103 | ---- | C] () -- C:\Windows\SysNative\drivers\N360x64\1402000.013\symvtcer.dat
[2012/11/03 16:54:59 | 000,000,172 | ---- | C] () -- C:\Windows\SysNative\drivers\N360x64\1402000.013\isolate.ini
[2012/11/03 13:51:28 | 000,007,466 | ---- | C] () -- C:\Windows\SysNative\drivers\SYMEVENT64x86.CAT
[2012/11/03 13:51:28 | 000,000,855 | ---- | C] () -- C:\Windows\SysNative\drivers\SYMEVENT64x86.INF
[2012/11/01 21:04:29 | 000,012,288 | ---- | C] () -- C:\Users\Don\Desktop\Outline of Kim.wps
[2012/11/01 06:21:09 | 000,010,240 | ---- | C] () -- C:\Users\Don\Desktop\Girl Scouts.wps
[2012/10/28 18:38:38 | 000,008,380 | ---- | C] () -- C:\Users\Don\Desktop\Finance tracker by Kim.csv
[2012/10/28 18:33:02 | 000,008,264 | ---- | C] () -- C:\Users\Don\Desktop\Finance tracker.csv
[2012/10/28 17:26:05 | 000,001,052 | ---- | C] () -- C:\Users\Don\Desktop\Dropbox.lnk
[2012/10/27 21:58:49 | 000,001,062 | ---- | C] () -- C:\Users\Don\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
[2012/10/27 11:29:36 | 000,009,728 | ---- | C] () -- C:\Users\Don\Documents\daniel contract broken 10-27-12.wps
[2012/10/25 18:58:13 | 000,013,749 | ---- | C] () -- C:\Users\Don\Desktop\MLA format of Mr.Kim.odt
[2012/10/24 23:38:52 | 007,467,359 | ---- | C] () -- C:\Users\Don\AppData\Local\census.cache
[2012/10/24 23:33:24 | 000,131,889 | ---- | C] () -- C:\Users\Don\AppData\Local\ars.cache
[2012/10/22 22:22:50 | 000,000,036 | ---- | C] () -- C:\Users\Don\AppData\Local\housecall.guid.cache
[2012/10/14 22:58:41 | 000,000,321 | ---- | C] () -- C:\Users\Don\Desktop\Already tagged.URL
[2012/10/14 22:18:55 | 000,019,002 | ---- | C] () -- C:\Users\Don\Desktop\Les Miserable.odt
[2012/10/10 12:31:19 | 000,060,304 | ---- | C] () -- C:\Users\Don\g2mdlhlpx.exe
[2012/09/12 17:44:36 | 000,001,151 | ---- | C] () -- C:\Users\Don\AppData\Roaming\com.picaboo.Picaboo_state.xml
[2012/07/13 21:31:29 | 000,871,486 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI
[2012/07/13 21:13:38 | 000,000,110 | ---- | C] () -- C:\Windows\wininit.ini
[2011/12/24 17:27:10 | 000,001,328 | -HS- | C] () -- C:\Users\Don\AppData\Local\446634r8b484q006u873e8ypr2j2
[2011/12/24 17:27:10 | 000,001,328 | -HS- | C] () -- C:\ProgramData\446634r8b484q006u873e8ypr2j2
[2011/12/16 20:45:37 | 000,001,400 | -HS- | C] () -- C:\Users\Don\AppData\Local\xluygn5w0ydf0hnr0fgh6n138r8k
[2011/12/16 20:45:37 | 000,001,400 | -HS- | C] () -- C:\ProgramData\xluygn5w0ydf0hnr0fgh6n138r8k
[2011/08/30 23:04:57 | 000,000,000 | ---- | C] () -- C:\Users\Don\AppData\Local\{F4AFC87A-A2E2-47B5-A2B1-7313E5D60083}
[2011/08/11 17:08:40 | 000,012,288 | ---- | C] () -- C:\Users\Don\Diabetes.wps
[2011/08/01 23:07:46 | 000,002,285 | ---- | C] () -- C:\Windows\checkip.dat
[2011/03/26 00:37:35 | 000,004,608 | ---- | C] () -- C:\Users\Don\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011/02/16 21:14:52 | 000,000,028 | ---- | C] () -- C:\Windows\pdf995.ini
[2011/02/16 21:13:21 | 000,047,616 | ---- | C] () -- C:\Windows\SysWow64\pdf995mon64.dll
[2011/02/16 21:13:21 | 000,000,060 | ---- | C] () -- C:\Windows\wpd99.drv
[2010/10/20 21:12:20 | 000,000,056 | -H-- | C] () -- C:\ProgramData\ezsidmv.dat
[2010/09/24 21:02:07 | 000,007,605 | ---- | C] () -- C:\Users\Don\AppData\Local\Resmon.ResmonCfg
[2010/03/19 15:15:59 | 000,010,870 | ---- | C] () -- C:\Users\Don\AppData\Roaming\wklnhst.dat
[2010/03/15 06:26:48 | 000,000,632 | RHS- | C] () -- C:\Users\Don\ntuser.pol

========== ZeroAccess Check ==========

[2009/07/13 23:55:00 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini

[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64

[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] /64

[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
"" = C:\Windows\SysNative\shell32.dll -- [2012/06/09 00:43:10 | 014,172,672 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shell32.dll -- [2012/06/08 23:41:00 | 012,873,728 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\fastprox.dll -- [2009/07/13 20:40:51 | 000,909,312 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\system32\wbem\fastprox.dll -- [2010/11/20 07:19:02 | 000,606,208 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\wbemess.dll -- [2009/07/13 20:41:56 | 000,505,856 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Both

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]

========== LOP Check ==========

[2012/09/11 07:24:38 | 000,000,000 | ---D | M] -- C:\Users\Don\AppData\Roaming\AVG
[2011/09/22 20:03:44 | 000,000,000 | ---D | M] -- C:\Users\Don\AppData\Roaming\AVG2012
[2010/08/11 21:34:02 | 000,000,000 | ---D | M] -- C:\Users\Don\AppData\Roaming\com.picaboo.Picaboo.A382D4714709B456C4E0088DFC1F7243AF9EBF75.1
[2012/11/05 21:54:17 | 000,000,000 | ---D | M] -- C:\Users\Don\AppData\Roaming\Dropbox
[2012/05/02 22:24:22 | 000,000,000 | ---D | M] -- C:\Users\Don\AppData\Roaming\GARMIN
[2010/04/07 16:10:51 | 000,000,000 | ---D | M] -- C:\Users\Don\AppData\Roaming\GlobalSCAPE
[2011/12/19 22:28:28 | 000,000,000 | ---D | M] -- C:\Users\Don\AppData\Roaming\Nuance
[2010/03/14 23:14:34 | 000,000,000 | ---D | M] -- C:\Users\Don\AppData\Roaming\OpenOffice.org
[2011/04/03 06:27:16 | 000,000,000 | ---D | M] -- C:\Users\Don\AppData\Roaming\Packard Bell
[2011/02/16 21:14:52 | 000,000,000 | ---D | M] -- C:\Users\Don\AppData\Roaming\pdf995
[2012/02/12 18:17:54 | 000,000,000 | ---D | M] -- C:\Users\Don\AppData\Roaming\SmartDraw
[2010/03/20 15:28:19 | 000,000,000 | ---D | M] -- C:\Users\Don\AppData\Roaming\Template
[2012/09/10 23:22:30 | 000,000,000 | ---D | M] -- C:\Users\Don\AppData\Roaming\TuneUp Software
[2010/11/22 06:51:14 | 000,000,000 | ---D | M] -- C:\Users\Don\AppData\Roaming\Windows Live Writer
[2011/12/04 00:41:04 | 000,000,000 | ---D | M] -- C:\Users\Don\AppData\Roaming\Zeon

========== Purity Check ==========



< End of report >

Also, here is the Extras report, whatever that is.

OTL Extras logfile created on: 11/8/2012 12:28:45 AM - Run 1
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\Don\Downloads
64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

5.87 Gb Total Physical Memory | 3.81 Gb Available Physical Memory | 65.03% Memory free
14.66 Gb Paging File | 11.37 Gb Available in Paging File | 77.53% Paging File free
Paging file location(s): c:\pagefile.sys 9010 9010 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 919.41 Gb Total Space | 611.47 Gb Free Space | 66.51% Space Free | Partition Type: NTFS
Drive F: | 3.61 Gb Total Space | 2.99 Gb Free Space | 82.97% Space Free | Partition Type: FAT32

Computer Name: GATEWAY-KITCHEN | User Name: Don | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan | Include 64bit Scans
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========


========== File Associations ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.url[@ = InternetShortcut] -- C:\Windows\SysNative\rundll32.exe (Microsoft Corporation)

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\SysWow64\control.exe (Microsoft Corporation)

========== Shell Spawning ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
InternetShortcut [open] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l (Microsoft Corporation)
InternetShortcut [print] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 0

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = 28 4D B2 76 41 04 CA 01 [binary data]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

========== Authorized Applications List ==========


========== Vista Active Open Ports Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{008E28CF-86EE-4042-90F0-69D50ECCB1AA}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{09A8428E-193F-438B-A0EC-FF93D29D5A22}" = lport=2869 | protocol=6 | dir=in | app=system |
"{10058B17-462F-4067-A8A5-45DCE334AAEB}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{1A0658D8-428D-4334-A9CD-83AE2AFD7EFF}" = rport=10243 | protocol=6 | dir=out | app=system |
"{2C98A0F2-E626-45D7-BDD2-E0BA20661D89}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=c:\windows\system32\svchost.exe |
"{48237750-47E6-40AF-9E8F-31371B1B20B2}" = rport=138 | protocol=17 | dir=out | app=system |
"{509F06E3-11BD-41FA-8491-3067EA80D1D1}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{5D625B13-57CE-42C0-AB12-D601F5B1BCCF}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=file and printer sharing (spooler service - rpc-epmap) |
"{6653C8EA-2E4A-4716-B870-017FFDCB5E0E}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{6D8C20A6-1D31-40C0-BFD2-845DB6F0EE73}" = lport=10243 | protocol=6 | dir=in | app=system |
"{763DFE84-D19F-4C95-972E-A9B03E982316}" = lport=2869 | protocol=6 | dir=in | name=windows live communications platform (upnp) |
"{7B7FBF90-4A96-4F43-9447-5A234CCE7D30}" = lport=445 | protocol=6 | dir=in | app=system |
"{86403653-D065-4AE5-8F64-D211611FC1C3}" = lport=2869 | protocol=6 | dir=in | app=system |
"{A1D7DB2C-D338-4464-ADC8-A8F868743C47}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=c:\windows\system32\spoolsv.exe |
"{A355E17C-36A7-438A-8A04-460BC7F4C6ED}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=c:\windows\system32\svchost.exe |
"{B274C5DF-8DD4-4A05-A8B1-2FB9514D2681}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{B5C6DC03-E97F-480F-8784-4EAC886D0674}" = lport=137 | protocol=17 | dir=in | app=system |
"{C4E55240-20E6-4E6B-88CA-02DE362428BE}" = lport=139 | protocol=6 | dir=in | app=system |
"{C7B51AC7-388A-4A3A-9F54-F829BF04FAD1}" = rport=139 | protocol=6 | dir=out | app=system |
"{C895204F-F435-42E2-B62B-724E1649DCC5}" = lport=138 | protocol=17 | dir=in | app=system |
"{D01C274E-EDE5-4583-B840-D705AE5DAD68}" = rport=80 | protocol=6 | dir=out | app=c:\program files (x86)\common files\intuit\update service\intuitupdateservice.exe |
"{DBE85A60-E9AA-4448-9707-82078DCCE46D}" = rport=445 | protocol=6 | dir=out | app=system |
"{E2C56D8C-B71F-4392-B8EE-F532BCFEA90A}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=svchost.exe |
"{E9147DAC-992C-401E-B7B7-DB6016CC1078}" = rport=80 | protocol=6 | dir=out | app=c:\program files (x86)\common files\intuit\update service\intuitupdater.exe |
"{EB02F7C1-BD99-47A3-B339-14809C95018D}" = lport=1900 | protocol=17 | dir=in | name=windows live communications platform (ssdp) |
"{F0DC97D9-BE1A-4C1B-962A-42F7D22C2E20}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{F148D03B-CAFC-4A22-9253-45B4A29C513B}" = rport=137 | protocol=17 | dir=out | app=system |
"{FB322EB7-A9C8-46BE-8FCF-EBA427A080BC}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{FC486925-529F-4DD6-BC8C-A5B7B0DA8016}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe |

========== Vista Active Application Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{1401AAAF-187D-4FC0-9FAD-BF4C0974D1B0}" = protocol=17 | dir=in | app=c:\program files (x86)\bonjour\mdnsresponder.exe |
"{1F50608D-9477-4E72-8CC1-FF15A3E35ECD}" = protocol=6 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe |
"{23629B57-5F6E-4F2D-9C1A-F6E258DD294B}" = protocol=6 | dir=out | app=system |
"{277FC2AA-3F76-49CC-9343-FCD04FC411FF}" = protocol=17 | dir=in | app=%programfiles(x86)%\windows media player\wmplayer.exe |
"{327E46AC-E2AD-40FA-A73F-76AF65BCA020}" = protocol=58 | dir=out | name=file and printer sharing (echo request - icmpv6-out) |
"{33364AFB-CAD8-4D2B-A92B-E13883E6FA1E}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{38283ABD-7ECF-4602-99F4-5FD70123BA41}" = protocol=6 | dir=in | app=c:\program files (x86)\avg\avg2012\avgdiagex.exe |
"{387F642A-F7FD-4926-A85E-F09563B17232}" = protocol=6 | dir=in | app=c:\program files (x86)\avg\avg10\avgdiagex.exe |
"{3FA59616-771A-40B6-AE33-6C0727F248D6}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{49F1EAE6-E480-4275-8443-7C5CA8411232}" = dir=in | app=c:\program files (x86)\windows live\mesh\moe.exe |
"{4CF60B73-9132-4CBB-8C86-781E6C4357DC}" = protocol=6 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{5220F328-7FA6-4ED1-A6FE-DC4DEE121532}" = protocol=17 | dir=in | app=c:\program files (x86)\avg\avg10\avgmfapx.exe |
"{531309F7-9EDA-405E-AEEB-1B631219F3ED}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{553F6953-DAE0-4EE9-A8E2-09593413666F}" = protocol=6 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{59F3E4A6-312F-49EE-95B8-32C4381F3D9B}" = protocol=17 | dir=in | app=c:\program files (x86)\avg\avg2012\avgnsa.exe |
"{5A025072-B309-463B-8E36-E7BE887A1EF7}" = protocol=17 | dir=in | app=c:\program files (x86)\avg\avg10\avgnsa.exe |
"{5A261C9F-7EFA-466C-8B3B-FD8A4D8DB215}" = protocol=6 | dir=in | app=c:\program files (x86)\avg\avg10\avgnsa.exe |
"{67C2EFF5-20AB-43EE-A553-DF04FD2ABCEC}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe |
"{6CEB1B24-B7B6-4DF2-B8DE-C53354CAA5F4}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{7315CECC-5420-4CF7-BEA3-E5AD7A345C98}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{7C474681-DB07-4968-9794-A0F05022B680}" = protocol=6 | dir=in | app=c:\program files (x86)\microsoft office\office12\onenote.exe |
"{7E59FE5A-DE9B-47DD-B94C-2E98B00261BA}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{8C3C8928-A7F7-4802-89EE-12AF3559DA8B}" = protocol=17 | dir=in | app=c:\program files (x86)\avg\avg2012\avgmfapx.exe |
"{8E703E43-13AC-49B9-B4C2-621A29261B6D}" = protocol=6 | dir=in | app=c:\program files (x86)\avg\avg2012\avgmfapx.exe |
"{97B7386A-445D-4B41-8EE2-CACCEAF61B97}" = dir=in | app=c:\program files (x86)\itunes\itunes.exe |
"{9A9F7D20-B015-4B98-9193-B2B49604F332}" = dir=in | app=c:\program files (x86)\windows live\sync\windowslivesync.exe |
"{9F37AF4B-67BE-4EB9-AA38-79C3C96F0AA8}" = protocol=58 | dir=in | name=file and printer sharing (echo request - icmpv6-in) |
"{9F558130-E9A8-4A64-B833-AB5FF1A94AA2}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{AB98B370-2200-4EE2-9206-3A43FD211969}" = protocol=17 | dir=in | app=c:\program files (x86)\avg\avg2012\avgdiagex.exe |
"{AC3FF766-ECF6-4D43-8F6C-DBC1631D85AA}" = protocol=17 | dir=in | app=c:\program files (x86)\microsoft office\office12\onenote.exe |
"{ADE08F2C-1C5B-4DD7-821A-39D7A80A6F5E}" = protocol=17 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe |
"{AFC8F865-F0C9-47EC-B09A-04A97E7EE974}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{B070EED9-153A-49AF-B227-454D367D9B96}" = protocol=6 | dir=in | app=c:\program files (x86)\avg\avg10\avgmfapx.exe |
"{B1334C11-249A-4347-B906-B714CE24C88A}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{B5A4E867-8F2E-4F7A-A8AE-DA6B65B8070D}" = dir=in | app=c:\program files (x86)\common files\apple\apple application support\webkit2webprocess.exe |
"{B6A596E6-010A-4184-BCA3-95C5A1B5014A}" = protocol=1 | dir=in | name=file and printer sharing (echo request - icmpv4-in) |
"{BFCFCAEB-9DDC-4FF9-8464-93E7D2EF7F08}" = protocol=17 | dir=in | app=c:\program files (x86)\avg\avg10\avgdiagex.exe |
"{C4D67D9B-53A1-4939-B4E0-997EDCDA0180}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{D535F7ED-FAE7-4D67-A53D-13C0EFA96CD0}" = protocol=6 | dir=in | app=c:\program files (x86)\avg\avg2012\avgnsa.exe |
"{DA8C6931-1A3C-4D0E-8C30-62CFF3B46EBE}" = protocol=6 | dir=in | app=c:\program files (x86)\bonjour\mdnsresponder.exe |
"{DD1613B5-F206-4FE0-AE91-760C1A8B79AA}" = protocol=1 | dir=out | name=file and printer sharing (echo request - icmpv4-out) |
"{EB255A94-71E5-4DE3-B9BA-49291F864F67}" = dir=in | app=c:\program files (x86)\windows live\contacts\wlcomm.exe |
"{F6EEF912-0EFF-463B-9D80-81BE2EAB1808}" = protocol=17 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{FA6C3861-5535-41FC-A3B4-12D634C3C5C3}" = dir=in | app=c:\program files (x86)\windows live\messenger\msnmsgr.exe |
"TCP Query User{092B0262-4511-4575-931A-F2AE34E0840A}C:\program files (x86)\internet explorer\iexplore.exe" = protocol=6 | dir=in | app=c:\program files (x86)\internet explorer\iexplore.exe |
"TCP Query User{2F1C0842-4B05-4D8B-94D4-776C9AB863D7}C:\program files (x86)\urbanterror\iourbanterror.exe" = protocol=6 | dir=in | app=c:\program files (x86)\urbanterror\iourbanterror.exe |
"TCP Query User{2FBFDEEF-57B0-4FFB-B73B-E9A2BC13B2E8}C:\program files (x86)\microsoft office\office11\frontpg.exe" = protocol=6 | dir=in | app=c:\program files (x86)\microsoft office\office11\frontpg.exe |
"TCP Query User{B46F5319-DC3A-4661-BBD6-451D8E82E449}C:\windows\explorer.exe" = protocol=6 | dir=in | app=c:\windows\explorer.exe |
"TCP Query User{FBA71E4A-643D-48C9-B5DF-CCA4540C4B8E}C:\program files (x86)\urbanterror\iourbanterror.exe" = protocol=6 | dir=in | app=c:\program files (x86)\urbanterror\iourbanterror.exe |
"UDP Query User{5F00FD8D-0A31-42F5-A635-84B3418FB136}C:\program files (x86)\urbanterror\iourbanterror.exe" = protocol=17 | dir=in | app=c:\program files (x86)\urbanterror\iourbanterror.exe |
"UDP Query User{756EC38B-01EC-4C1A-9237-AA367BFC92EF}C:\windows\explorer.exe" = protocol=17 | dir=in | app=c:\windows\explorer.exe |
"UDP Query User{9458D2C8-ADBA-4842-8A68-E6784D5434D0}C:\program files (x86)\microsoft office\office11\frontpg.exe" = protocol=17 | dir=in | app=c:\program files (x86)\microsoft office\office11\frontpg.exe |
"UDP Query User{BFA66A43-1E49-47B2-8E42-BC13D4EF97DD}C:\program files (x86)\urbanterror\iourbanterror.exe" = protocol=17 | dir=in | app=c:\program files (x86)\urbanterror\iourbanterror.exe |
"UDP Query User{D2F7F138-ABF3-4827-9FF8-173E435AF53E}C:\program files (x86)\internet explorer\iexplore.exe" = protocol=17 | dir=in | app=c:\program files (x86)\internet explorer\iexplore.exe |

========== HKEY_LOCAL_MACHINE Uninstall List ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{027E5FAB-1476-4C59-AAB4-32EF28520399}" = Windows Live Language Selector
"{02A5BD31-16AC-45DF-BE9F-A3167BC4AFB2}" = Windows Live Family Safety
"{071c9b48-7c32-4621-a0ac-3f809523288f}" = Microsoft Visual C++ 2005 Redistributable (x64)
"{0826F9E4-787E-481D-83E0-BC6A57B056D5}" = Microsoft SQL Server VSS Writer
"{0D87AE67-14EB-4C10-88A5-DA6C3181EB18}" = Windows Live Family Safety
"{1ACC8FFB-9D84-4C05-A4DE-D28A9BC91698}" = Windows Live ID Sign-in Assistant
"{21B133D6-5979-47F0-BE1C-F6A6B304693F}" = Visual Studio 2010 x64 Redistributables
"{2F14965D-567B-4E59-ADEB-0A2CC1E3ADDF}" = Sql Server Customer Experience Improvement Program
"{350AA351-21FA-3270-8B7A-835434E766AD}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.21022
"{5340A3B5-3853-4745-BED2-DD9FF5371331}" = Microsoft SQL Server 2008 Common Files
"{59D3F691-179D-4E52-832C-D22B81541AC5}" = Microsoft SQL Server 2008 Setup Support Files
"{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161
"{656DEEDE-F6AC-47CA-A568-A1B4E34B5760}" = Windows Live Remote Service Resources
"{6A76BEAF-6D1F-4273-A79B-DA8410A2E56B}" = Apple Mobile Device Support
"{6DD01FF3-63CE-436B-96DB-61363EAA4EB8}" = MobileMe Control Panel
"{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}" = Bonjour
"{7ACE202B-1B01-4B43-B6AE-03D66D621CDE}" = Microsoft SQL Server 2008 RsFx Driver
"{8338783A-0968-3B85-AFC7-BAAE0A63DC50}" = Microsoft Visual C++ 2008 Redistributable - KB2467174 - x64 9.0.30729.5570
"{840A3BAA-4C68-4581-9C7A-6F8D6CF531B9}" = iTunes
"{847B0532-55E3-4AAF-8D7B-E3A1A7CD17E5}" = Windows Live Remote Client Resources
"{893F27E6-D6BE-4B9F-80E6-0ADA694A31A8}" = Microsoft SQL Server 2008 Common Files
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8B485965-8EFE-464A-842F-CF8F18C3DFD7}" = iCloud
"{90120000-002A-0000-1000-0000000FF1CE}" = Microsoft Office Office 64-bit Components 2007
"{90120000-002A-0409-1000-0000000FF1CE}" = Microsoft Office Shared 64-bit MUI (English) 2007
"{90120000-0116-0409-1000-0000000FF1CE}" = Microsoft Office Shared 64-bit Setup Metadata MUI (English) 2007
"{90A80D89-A0E4-33C1-B13D-B93CB3496867}" = Microsoft Visual Studio 2008 Remote Debugger Light (x64) - ENU
"{95120000-00B9-0409-1000-0000000FF1CE}" = Microsoft Application Error Reporting
"{aac9fcc4-dd9e-4add-901c-b5496a07ab2e}" = Microsoft Visual C++ 2005 Redistributable (x64) - KB2467175
"{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}" = Microsoft Visual C++ 2005 Redistributable (x64)
"{B67C01B3-8502-4BE7-AEAB-BBDE910AD3EE}" = Microsoft Web Platform Installer 2.0
"{B6901D72-1BF0-30FB-B9BC-B6DC1266E0F4}" = Microsoft Windows SDK for Visual Studio 2008 SP1 Express Tools for Web - enu
"{B6E3757B-5E77-3915-866A-CCFC4B8D194C}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x64 8.0.50727.4053
"{BBDE8A3D-64A2-43A6-95F3-C27B87DF7AC1}" = Microsoft SQL Server 2008 Native Client
"{CC8BA866-16A7-4667-BA0C-C494A1E7B2BF}" = Microsoft SQL Server 2008 Database Engine Shared
"{DA54F80E-261C-41A2-A855-549A144F2F59}" = Windows Live MIME IFilter
"{DF167CE3-60E7-44EA-99EC-2507C51F37AE}" = Microsoft SQL Server 2008 Database Engine Shared
"{DF6D988A-EEA0-4277-AAB8-158E086E439B}" = Windows Live Remote Client
"{E02A6548-6FDE-40E2-8ED9-119D7D7E641F}" = Windows Live Remote Service
"{E8B56B39-A826-11DB-8C83-0011430C73A4}" = Microsoft Forefront Client Security State Assessment Service
"{EE936C7A-EA40-31D5-9B65-8E3E089C3828}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x64 9.0.30729.4148
"{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}" = Microsoft .NET Framework 4 Client Profile
"{FA7394B8-CE65-4F9E-AC99-F372AD365424}" = Microsoft SQL Server 2008 Database Engine Services
"{FBBC4667-2521-4E78-B1BD-8706F774549B}" = Best Buy pc app
"{FBD367D1-642F-47CF-B79B-9BE48FB34007}" = Microsoft SQL Server 2008 Database Engine Services
"49CF605F02C7954F4E139D18828DE298CD59217C" = Windows Driver Package - Garmin (grmnusb) GARMIN Devices (06/03/2009 2.3.0.0)
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft SQL Server 10" = Microsoft SQL Server 2008 (64-bit)
"Microsoft SQL Server 10 Release" = Microsoft SQL Server 2008 (64-bit)
"Microsoft Visual Studio 2008 Remote Debugger Light (x64) - ENU" = Microsoft Visual Studio 2008 Remote Debugger Light (x64) - ENU
"SmartDraw PDF Export_is1" = SmartDraw PDF Export (novaPDF 6.4 printer)

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
"{0A1E0BDA-5E8F-436d-8BE5-7E97C5CB899D}" = Quicken 2012
"{0B0F231F-CE6A-483D-AA23-77B364F75917}" = Windows Live Installer
"{0D2E80C8-0875-43EB-9623-47118E2DFBCA}" = Quicken 2007
"{0E64B098-8018-4256-BA23-C316A43AD9B0}" = QuickTime
"{122ADF8C-DDA1-480C-9936-C88F2825B265}" = Apple Application Support
"{18A8E78B-9EF2-496E-B310-BCD8E4C1DAB3}" = iSEEK AnswerWorks English Runtime
"{19BA08F7-C728-469C-8A35-BFBD3633BE08}" = Windows Live Movie Maker
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{1F6AB0E7-8CDD-4B93-8A23-AA9EB2FEFCE4}" = Junk Mail filter update
"{200FEC62-3C34-4D60-9CE8-EC372E01C08F}" = Windows Live SOXE Definitions
"{26A24AE4-039D-4CA4-87B4-2F83217009FF}" = Java 7 Update 9
"{287ECFA4-719A-2143-A09B-D6A12DE54E40}" = Acrobat.com
"{2902F983-B4C1-44BA-B85D-5C6D52E2C441}" = Windows Live Mesh ActiveX Control for Remote Connections
"{2A3FC24C-6EC0-4519-A52B-FDA4EA9B2D24}" = Windows Live Messenger
"{2FDBBCEA-62DB-45F4-B6E5-0E1FB2A1F29D}" = Visual C++ 8.0 Runtime Setup Package (x64)
"{30465B6C-B53F-49A1-9EBA-A3F187AD502E}" = Roxio Update Manager
"{3336F667-9049-4D46-98B6-4C743EEBC5B1}" = Windows Live Photo Gallery
"{342D4AD7-EC4C-4EC8-AEA6-E70F5905A490}" = SQL Server System CLR Types
"{34F4D9A4-42C2-4348-BEF4-E553C84549E7}" = Windows Live Photo Gallery
"{3881DB80-EAA2-012B-ADAE-000000000000}" = TurboTax 2009 WinPerFedFormset
"{38975F50-EAA2-012B-ADB4-000000000000}" = TurboTax 2009 WinPerReleaseEngine
"{38A34630-EAA2-012B-ADB6-000000000000}" = TurboTax 2009 WinPerTaxSupport
"{3A1B5D40-41E9-43FA-8C7B-A8667F5586EF}" = JMicron JMB36X Driver
"{3B1D4D6D-E038-466F-B64D-0BF6EE97BE6A}" = Punch! Home and Landscape
"{3BAC6780-EAA2-012B-AE74-000000000000}" = TurboTax 2009 wohiper
"{3C3D696B-0DB7-3C6D-A356-3DB8CE541918}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729
"{3C5A81D0-EAA2-012B-AE9F-000000000000}" = TurboTax 2009 wrapper
"{3E29EE6C-963A-4aae-86C1-DC237C4A49FC}" = Intel® Rapid Storage Technology
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{50816F92-1652-4A7C-B9BC-48F682742C4B}" = Messenger Companion
"{510D2239-6C2E-457B-9590-485EC552D94D}" = Garmin USB Drivers
"{579684A4-DDD5-4CA3-9EA8-7BE7D9593DB4}" = Windows Live UX Platform Language Pack
"{65153EA5-8B6E-43B6-857B-C6E4FC25798A}" = Intel® Management Engine Components
"{67E03279-F703-408F-B4BF-46B5FC8D70CD}" = Microsoft Works
"{682B3E4F-696A-42DE-A41C-4C07EA1678B4}" = Windows Live SOXE
"{6ADD0603-16EF-400D-9F9E-486432835002}" = OpenOffice.org 3.2
"{6C94A234-CA2C-4D3C-81E6-6AAA8069825D}" = Garmin WebUpdater
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}" = Apple Software Update
"{78A96B4C-A643-4D0F-98C2-A8E16A6669F9}" = Windows Live Messenger Companion Core
"{7F811A54-5A09-4579-90E1-C93498E230D9}" = Gateway Recovery Management
"{83C292B7-38A5-440B-A731-07070E81A64F}" = Windows Live PIMT Platform
"{84EBDF39-4B33-49D7-A0BD-EB6E2C4E81C1}" = Windows Live Sync
"{86CE85E6-DBAC-3FFD-B977-E4B79F83C909}" = Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570
"{8C6D6116-B724-4810-8F2D-D047E6B7D68E}" = Mesh Runtime
"{8DD46C6A-0056-4FEC-B70A-28BB16A1F11F}" = MSVCRT
"{8E6AE459-9D8F-7365-E848-877D508F5A48}" = Picaboo X
"{90024193-9F13-4877-89D5-A1CDF0CBBF28}" = Feedback Tool
"{90120000-0016-0409-0000-0000000FF1CE}" = Microsoft Office Excel MUI (English) 2007
"{90120000-0016-0409-0000-0000000FF1CE}_HOMESTUDENTR_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0018-0409-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (English) 2007
"{90120000-0018-0409-0000-0000000FF1CE}_HOMESTUDENTR_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-001B-0409-0000-0000000FF1CE}" = Microsoft Office Word MUI (English) 2007
"{90120000-001B-0409-0000-0000000FF1CE}_HOMESTUDENTR_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-0409-0000-0000000FF1CE}_HOMESTUDENTR_{1FF96026-A04A-4C3E-B50A-BB7022654D0F}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-040C-0000-0000000FF1CE}_HOMESTUDENTR_{71F055E8-E2C6-4214-BB3D-BFE03561B89E}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-0C0A-0000-0000000FF1CE}" = Microsoft Office Proof (Spanish) 2007
"{90120000-001F-0C0A-0000-0000000FF1CE}_HOMESTUDENTR_{2314F9A1-126F-45CC-8A5E-DFAF866F3FBC}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-0020-0409-0000-0000000FF1CE}" = Compatibility Pack for the 2007 Office system
"{90120000-0021-0000-0000-0000000FF1CE}" = Microsoft Office Visual Web Developer 2007
"{90120000-0021-0409-0000-0000000FF1CE}" = Microsoft Office Visual Web Developer MUI (English) 2007
"{90120000-0021-0409-0000-0000000FF1CE}_VisualWebDeveloper_{C00A9857-850C-4C68-A583-2EF4F24706F5}" = Microsoft Office SharePoint Designer 2007 Service Pack 3 (SP3)
"{90120000-002A-0000-1000-0000000FF1CE}_HOMESTUDENTR_{664655D8-B9BB-455D-8A58-7EAF7B0B2862}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-002A-0409-1000-0000000FF1CE}_HOMESTUDENTR_{98333358-268C-4164-B6D4-C96DF5153727}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-002C-0409-0000-0000000FF1CE}" = Microsoft Office Proofing (English) 2007
"{90120000-006E-0409-0000-0000000FF1CE}" = Microsoft Office Shared MUI (English) 2007
"{90120000-006E-0409-0000-0000000FF1CE}_HOMESTUDENTR_{98333358-268C-4164-B6D4-C96DF5153727}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-006E-0409-0000-0000000FF1CE}_VisualWebDeveloper_{98333358-268C-4164-B6D4-C96DF5153727}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-00A1-0409-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (English) 2007
"{90120000-00A1-0409-0000-0000000FF1CE}_HOMESTUDENTR_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0115-0409-0000-0000000FF1CE}" = Microsoft Office Shared Setup Metadata MUI (English) 2007
"{90120000-0115-0409-0000-0000000FF1CE}_HOMESTUDENTR_{98333358-268C-4164-B6D4-C96DF5153727}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0115-0409-0000-0000000FF1CE}_VisualWebDeveloper_{98333358-268C-4164-B6D4-C96DF5153727}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0116-0409-1000-0000000FF1CE}_HOMESTUDENTR_{98333358-268C-4164-B6D4-C96DF5153727}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90140000-2005-0000-0000-0000000FF1CE}" = Microsoft Office File Validation Add-In
"{91120000-002F-0000-0000-0000000FF1CE}" = Microsoft Office Home and Student 2007
"{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{91170409-6000-11D3-8CFE-0150048383C9}" = Microsoft Office FrontPage 2003
"{92EA4134-10D1-418A-91E1-5A0453131A38}" = Windows Live Movie Maker
"{95120000-00AF-0409-0000-0000000FF1CE}" = Microsoft Office PowerPoint Viewer 2007 (English)
"{9559F7CA-5E34-4237-A2D9-D856464AD727}" = Project64 1.6
"{9A33B83D-FFC4-44CF-BEEF-632DECEF2FCD}" = Microsoft SQL Server Database Publishing Wizard 1.3
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{9D56775A-93F3-44A3-8092-840E3826DE30}" = Windows Live Mail
"{9E5A03E3-6246-4920-9630-0527D5DA9B07}" = iSEEK AnswerWorks English Runtime
"{A0C91188-C88F-4E86-93E6-CD7C9A266649}" = Windows Live Mesh
"{A33E7B0C-B99C-4EC9-B702-8A328B161AF9}" = Roxio Burn
"{A726AE06-AAA3-43D1-87E3-70F510314F04}" = Windows Live Writer
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{A9BDCA6B-3653-467B-AC83-94367DA3BFE3}" = Windows Live Photo Common
"{AAAFC670-569B-4A2F-82B4-42945E0DE3EF}" = Windows Live Writer
"{AAF454FC-82CA-4F29-AB31-6A109485E76E}" = Windows Live Writer
"{AC76BA86-7AD7-FFFF-7B44-A91000000001}" = Adobe Reader 9.4.6 MUI
"{AFBAB9A0-DDE8-49AE-8C17-A01B61BEE64B}" = Garmin MapSource
"{B194272D-1F92-46DF-99EB-8D5CE91CB4EC}" = Adobe AIR
"{B2E47DE7-800B-40BB-BD1F-9F221C3AEE87}" = Roxio Burn
"{B92C5909-1D37-4C51-8397-A28BB28E5DC3}" = Facebook Video Calling 1.2.0.287
"{C66824E4-CBB3-4851-BB3F-E8CFD6350923}" = Windows Live Mail
"{C688457E-03FD-4941-923B-A27F4D42A7DD}" = Microsoft SQL Server 2008 Browser
"{C6DB11F1-EBD1-3AA4-A44D-55630E1E6FDA}" = Microsoft Visual Web Developer 2008 Express Edition with SP1 - ENU
"{CE95A79E-E4FC-4FFF-8A75-29F04B942FF2}" = Windows Live UX Platform
"{D0B44725-3666-492D-BEF6-587A14BD9BD9}" = MSVCRT_amd64
"{D436F577-1695-4D2F-8B44-AC76C99E0002}" = Windows Live Photo Common
"{D45240D3-B6B3-4FF9-B243-54ECE3E10066}" = Windows Live Communications Platform
"{DDC8BDEE-DCAC-404D-8257-3E8D4B782467}" = Windows Live Writer Resources
"{DECDCB7C-58CC-4865-91AF-627F9798FE48}" = Windows Live Mesh
"{DF1C5B60-29DE-463C-BF2C-708D95F3F752}" = Garmin BaseCamp
"{E09C4DB7-630C-4F06-A631-8EA7239923AF}" = D3DX10
"{E50AE784-FABE-46DA-A1F8-7B6B56DCB22E}" = Microsoft Office Suite Activation Assistant
"{E5B21F11-6933-4E0B-A25C-7963E3C07D11}" = Windows Live Messenger
"{EE171732-BEB4-4576-887D-CB62727F01CA}" = Gateway Updater
"{EE7257A2-39A2-4D2F-9DAC-F9F25B8AE1D8}" = Skype™ 5.10
"{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}" = Microsoft SQL Server 2005 Compact Edition [ENU]
"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219
"{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}" = Intel® Graphics Media Accelerator Driver
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F5E87B12-3C27-452F-8E78-21D42164FD83}" = Microsoft SQL Server 2008 Management Objects
"{F8A9085D-4C7A-41a9-8A77-C8998A96C421}" = Intel® Control Center
"{FA4C2D53-205F-4245-9717-F3761154824D}" = Safari
"{FBBC4667-2521-4E78-B1BD-8706F774549B}" = Best Buy pc app
"{FCDBEA60-79F0-4FAE-BBA8-55A26C609A49}" = Visual Studio 2008 x64 Redistributables
"{FE044230-9CA5-43F7-9B58-5AC5A28A1F33}" = Windows Live Essentials
"{FF1C72E2-203C-4E95-8D24-735196D29E04}" = HP Install Network Printer Wizard
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"Adobe Photoshop Elements 2.0" = Adobe Photoshop Elements 2.0
"ATT-PRT22" = ATT-PRT22
"ATT-SST" = AT&T Service & Support Tool
"com.picaboo.Picaboo.A382D4714709B456C4E0088DFC1F7243AF9EBF75.1" = Picaboo X
"Free WMA to MP3 Converter_is1" = Free WMA to MP3 Converter 1.16
"Gadwin PrintScreen" = Gadwin PrintScreen
"Gateway InfoCentre" = Gateway InfoCentre
"Gateway Photo Frame" = Gateway Photo Frame 4.2.3.10
"Gateway Registration" = Gateway Registration
"Gateway Screensaver" = Gateway ScreenSaver
"Gateway Welcome Center" = Welcome Center
"Google Chrome" = Google Chrome
"HOMESTUDENTR" = Microsoft Office Home and Student 2007
"Identity Card" = Identity Card
"InfoAtoms" = InfoAtoms
"Lincoln DesignIt - Lincoln Financial Distributors" = Lincoln DesignIt - Lincoln Financial Distributors
"Microsoft Visual Web Developer 2008 Express Edition with SP1 - ENU" = Microsoft Visual Web Developer 2008 Express Edition with SP1 - ENU
"Mozilla Firefox 16.0.2 (x86 en-US)" = Mozilla Firefox 16.0.2 (x86 en-US)
"MozillaMaintenanceService" = Mozilla Maintenance Service
"My Trails" = My Trail Maps
"N360" = Norton 360
"Pdf995" = Pdf995
"Picasa 3" = Picasa 3
"PricePeep" = PricePeep
"TurboTax 2009" = TurboTax 2009
"Urban Terror_is1" = Urban Terror 4.1
"us_p_nc" = US Planimetric NC
"VisualWebDeveloper" = Microsoft Visual Studio Web Authoring Component
"VLC media player" = VLC media player 1.0.1
"Wajam" = Wajam
"WinLiveSuite" = Windows Live Essentials

========== HKEY_CURRENT_USER Uninstall List ==========

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"blinkx beat" = blinkx beat
"Dropbox" = Dropbox
"GoToMeeting" = GoToMeeting 5.1.0.880
"SmartDraw 2010" = SmartDraw 2010

========== Last 20 Event Log Errors ==========

[ Application Events ]
Error - 12/31/2011 1:31:59 AM | Computer Name = Gateway-Kitchen | Source = SideBySide | ID = 16842785
Description = Activation context generation failed for "c:\Windows\Installer\{67E03279-F703-408F-B4BF-46B5FC8D70CD}\WksWP.exe".
Dependent
Assembly msadctls,processorArchitecture="x86",type="win32",version="1.0.1801.0"
could not be found. Please use sxstrace.exe for detailed diagnosis.

Error - 1/1/2012 1:32:10 AM | Computer Name = Gateway-Kitchen | Source = SideBySide | ID = 16842785
Description = Activation context generation failed for "c:\Windows\Installer\{67E03279-F703-408F-B4BF-46B5FC8D70CD}\WksCal.exe".
Dependent
Assembly msadctls,processorArchitecture="x86",type="win32",version="1.0.1801.0"
could not be found. Please use sxstrace.exe for detailed diagnosis.

Error - 1/1/2012 1:32:10 AM | Computer Name = Gateway-Kitchen | Source = SideBySide | ID = 16842785
Description = Activation context generation failed for "c:\Windows\Installer\{67E03279-F703-408F-B4BF-46B5FC8D70CD}\wksdb.exe".
Dependent
Assembly msadctls,processorArchitecture="x86",type="win32",version="1.0.1801.0"
could not be found. Please use sxstrace.exe for detailed diagnosis.

Error - 1/1/2012 1:32:10 AM | Computer Name = Gateway-Kitchen | Source = SideBySide | ID = 16842785
Description = Activation context generation failed for "C:\Windows\Installer\{67E03279-F703-408F-B4BF-46B5FC8D70CD}\wksss.exe".
Dependent
Assembly msadctls,processorArchitecture="x86",type="win32",version="1.0.1801.0"
could not be found. Please use sxstrace.exe for detailed diagnosis.

Error - 1/1/2012 1:32:10 AM | Computer Name = Gateway-Kitchen | Source = SideBySide | ID = 16842785
Description = Activation context generation failed for "c:\Windows\Installer\{67E03279-F703-408F-B4BF-46B5FC8D70CD}\WksWP.exe".
Dependent
Assembly msadctls,processorArchitecture="x86",type="win32",version="1.0.1801.0"
could not be found. Please use sxstrace.exe for detailed diagnosis.

Error - 1/2/2012 2:12:55 AM | Computer Name = Gateway-Kitchen | Source = SideBySide | ID = 16842785
Description = Activation context generation failed for "c:\Windows\Installer\{67E03279-F703-408F-B4BF-46B5FC8D70CD}\WksCal.exe".
Dependent
Assembly msadctls,processorArchitecture="x86",type="win32",version="1.0.1801.0"
could not be found. Please use sxstrace.exe for detailed diagnosis.

Error - 1/2/2012 2:12:55 AM | Computer Name = Gateway-Kitchen | Source = SideBySide | ID = 16842785
Description = Activation context generation failed for "c:\Windows\Installer\{67E03279-F703-408F-B4BF-46B5FC8D70CD}\wksdb.exe".
Dependent
Assembly msadctls,processorArchitecture="x86",type="win32",version="1.0.1801.0"
could not be found. Please use sxstrace.exe for detailed diagnosis.

Error - 1/2/2012 2:12:55 AM | Computer Name = Gateway-Kitchen | Source = SideBySide | ID = 16842785
Description = Activation context generation failed for "C:\Windows\Installer\{67E03279-F703-408F-B4BF-46B5FC8D70CD}\wksss.exe".
Dependent
Assembly msadctls,processorArchitecture="x86",type="win32",version="1.0.1801.0"
could not be found. Please use sxstrace.exe for detailed diagnosis.

Error - 1/2/2012 2:12:55 AM | Computer Name = Gateway-Kitchen | Source = SideBySide | ID = 16842785
Description = Activation context generation failed for "c:\Windows\Installer\{67E03279-F703-408F-B4BF-46B5FC8D70CD}\WksWP.exe".
Dependent
Assembly msadctls,processorArchitecture="x86",type="win32",version="1.0.1801.0"
could not be found. Please use sxstrace.exe for detailed diagnosis.

Error - 1/2/2012 5:51:45 PM | Computer Name = Gateway-Kitchen | Source = RasClient | ID = 20227
Description =

[ Media Center Events ]
Error - 4/13/2010 1:36:06 AM | Computer Name = Gateway-Kitchen | Source = MCUpdate | ID = 0
Description = 1:36:03 AM - Failed to retrieve SportsSchedule-2.enc (Error: HTTP
status 404: The requested URL does not exist on the server. )

Error - 7/8/2010 3:38:58 PM | Computer Name = Gateway-Kitchen | Source = MCUpdate | ID = 0
Description = 3:38:58 PM - Error connecting to the internet. 3:38:58 PM - Unable
to contact server..

Error - 7/8/2010 3:39:09 PM | Computer Name = Gateway-Kitchen | Source = MCUpdate | ID = 0
Description = 3:39:03 PM - Error connecting to the internet. 3:39:03 PM - Unable
to contact server..

Error - 9/20/2010 1:38:15 PM | Computer Name = Gateway-Kitchen | Source = MCUpdate | ID = 0
Description = 1:38:15 PM - Error connecting to the internet. 1:38:15 PM - Unable
to contact server..

Error - 9/20/2010 1:38:46 PM | Computer Name = Gateway-Kitchen | Source = MCUpdate | ID = 0
Description = 1:38:44 PM - Error connecting to the internet. 1:38:44 PM - Unable
to contact server..

Error - 9/20/2010 2:40:15 PM | Computer Name = Gateway-Kitchen | Source = MCUpdate | ID = 0
Description = 2:40:15 PM - Failed to retrieve SportsSchedule (Error: The underlying
connection was closed: Could not establish trust relationship for the SSL/TLS secure
channel.)

[ System Events ]
Error - 11/6/2012 8:52:31 AM | Computer Name = Gateway-Kitchen | Source = DCOM | ID = 10016
Description =

Error - 11/6/2012 8:55:46 AM | Computer Name = Gateway-Kitchen | Source = DCOM | ID = 10016
Description =

Error - 11/6/2012 6:25:03 PM | Computer Name = Gateway-Kitchen | Source = DCOM | ID = 10016
Description =

Error - 11/6/2012 7:02:15 PM | Computer Name = Gateway-Kitchen | Source = DCOM | ID = 10016
Description =

Error - 11/6/2012 7:05:06 PM | Computer Name = Gateway-Kitchen | Source = DCOM | ID = 10016
Description =

Error - 11/7/2012 12:10:20 AM | Computer Name = Gateway-Kitchen | Source = DCOM | ID = 10016
Description =

Error - 11/7/2012 7:37:33 AM | Computer Name = Gateway-Kitchen | Source = DCOM | ID = 10016
Description =

Error - 11/7/2012 7:38:05 AM | Computer Name = Gateway-Kitchen | Source = DCOM | ID = 10016
Description =

Error - 11/8/2012 12:51:36 AM | Computer Name = Gateway-Kitchen | Source = DCOM | ID = 10016
Description =

Error - 11/8/2012 1:36:02 AM | Computer Name = Gateway-Kitchen | Source = DCOM | ID = 10016
Description =


< End of report >

Edited by dcurtis113, 07 November 2012 - 11:51 PM.

[Advertisements]

Hello dcurtis113 and welcome to my office here at G2G!

My nick is maliprog and I'll be your technical support on this issue. Before we start please read my notes carefully:

NOTES:

• Malware removal is NOT instantaneous, most infections require several courses of action to completely eradicate.
• Absence of symptoms does not always mean the computer is clean
• Kindly follow my instructions in the order posted. Order is crucial in cleaning process.
• Please DO NOT run any scans or fix on your own without my direction.
• Please read all of my response through at least once before attempting to follow the procedures described.
• If there's anything you don't understand or isn't totally clear, please come back to me for clarification.
• Please do not attach any log files to your replies unless I specifically ask you. Instead please copy and paste it to include the log in your reply.
• You must reply within 3 days or your topic will be closed

Step 1

Run OTL

• Under the Custom Scans/Fixes box at the bottom, paste in the following
  
  

  :OTL
  CHR - homepage: http://www.searchnu.com/406
  CHR - homepage: http://www.searchnu.com/406
  O2 - BHO: (PricePeep) - {FD6D90C0-E6EE-4BC6-B9F7-9ED319698007} - C:\Program Files (x86)\PricePeep\pricepeep.dll (PricePeep)
  O2 - BHO: (Wajam) - {A7A6995D-6EE1-4FD1-A258-49395D5BF99C} - C:\Program Files (x86)\Wajam\IE\priam_bho.dll (Wajam)
  [2012/11/04 10:10:06 | 000,000,000 | ---D | C] -- C:\Users\Don\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Wajam
  [2012/11/04 10:10:03 | 000,000,000 | ---D | C] -- C:\Users\Don\AppData\Local\Wajam
  [2012/11/04 10:10:02 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Wajam
  [2012/11/04 10:09:53 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\PricePeep
  [2012/11/06 07:45:01 | 000,000,000 | ---D | C] -- C:\Users\Don\AppData\Local\{645359A3-3E98-41FF-BAAE-D8AE408113C5}
  [2012/11/05 18:18:03 | 000,000,000 | ---D | C] -- C:\Users\Don\AppData\Local\{C2591D4A-637E-4BE8-849E-4E7A80BF97B8}
  [2012/11/04 07:40:17 | 000,000,000 | ---D | C] -- C:\Users\Don\AppData\Local\{5D9E46C7-69BD-4A76-B5DB-F7F1B5CA4549}
  [2012/11/03 19:39:51 | 000,000,000 | ---D | C] -- C:\Users\Don\AppData\Local\{9ADF526F-23FC-4839-ADBC-21624D093ECF}
  [2012/11/03 07:39:27 | 000,000,000 | ---D | C] -- C:\Users\Don\AppData\Local\{28667192-D27C-4262-B860-781D5F5C6272}
  [2012/11/01 20:26:33 | 000,000,000 | ---D | C] -- C:\Users\Don\AppData\Local\{E4D52803-0C42-4D19-9077-DBF5AE023AD0}
  [2012/11/01 06:18:58 | 000,000,000 | ---D | C] -- C:\Users\Don\AppData\Local\{C832AF8E-8D41-44E2-BE7A-730EB1ECABA2}
  [2012/10/31 18:18:34 | 000,000,000 | ---D | C] -- C:\Users\Don\AppData\Local\{057CC137-5AA2-454F-986E-0FBCA73CA2FB}
  [2012/10/29 05:59:34 | 000,000,000 | ---D | C] -- C:\Users\Don\AppData\Local\{632AFADD-B58A-4566-A237-F6187C4EB629}
  [2012/10/28 16:48:36 | 000,000,000 | ---D | C] -- C:\Users\Don\AppData\Local\{24B60F8E-DCE2-4CC3-A9C7-42D8BA4CA3B8}
  [2012/10/24 04:12:23 | 000,000,000 | ---D | C] -- C:\Users\Don\AppData\Local\{F83318D8-FA48-416A-A6E3-200D7BCCEC4B}
  [2012/10/18 18:30:50 | 000,000,000 | ---D | C] -- C:\Users\Don\AppData\Local\{56C2019B-0890-4A4D-BBA4-21A07B700DB2}
  [2012/10/16 18:29:50 | 000,000,000 | ---D | C] -- C:\Users\Don\AppData\Local\{885F6081-48C0-4248-B752-FAD84C4BD3D0}
  [2012/10/15 18:29:38 | 000,000,000 | ---D | C] -- C:\Users\Don\AppData\Local\{B576AC9D-0002-43BB-A12C-76008E0F70A3}
  [2012/10/15 18:23:57 | 000,000,000 | ---D | C] -- C:\Users\Don\AppData\Local\{CC2E532F-57A2-46F8-ABA0-850DE384CDAF}
  [2012/10/15 18:03:17 | 000,000,000 | ---D | C] -- C:\Users\Don\AppData\Local\{816D545A-E804-4B52-A39B-F04EF8EFDC9D}
  [2012/10/15 06:03:05 | 000,000,000 | ---D | C] -- C:\Users\Don\AppData\Local\{45BD9130-4EC6-4CB5-B99A-2EABF35B78DE}
  [2012/10/14 13:33:53 | 000,000,000 | ---D | C] -- C:\Users\Don\AppData\Local\{CB677BA9-D13D-4375-B527-A2F3237ECB22}
  [2012/10/11 05:17:54 | 000,000,000 | ---D | C] -- C:\Users\Don\AppData\Local\{C2B2CA9F-0FF9-4DD1-A6D4-9C623E82F182}
  [2011/12/24 17:27:10 | 000,001,328 | -HS- | C] () -- C:\Users\Don\AppData\Local\446634r8b484q006u873e8ypr2j2
  [2011/12/24 17:27:10 | 000,001,328 | -HS- | C] () -- C:\ProgramData\446634r8b484q006u873e8ypr2j2
  [2011/12/16 20:45:37 | 000,001,400 | -HS- | C] () -- C:\Users\Don\AppData\Local\xluygn5w0ydf0hnr0fgh6n138r8k
  [2011/12/16 20:45:37 | 000,001,400 | -HS- | C] () -- C:\ProgramData\xluygn5w0ydf0hnr0fgh6n138r8k
  [2011/08/30 23:04:57 | 000,000,000 | ---- | C] () -- C:\Users\Don\AppData\Local\{F4AFC87A-A2E2-47B5-A2B1-7313E5D60083}
  
  :Files
  C:\Users\Don\AppData\Local\446634r8b484q006u873e8ypr2j2
  C:\ProgramData\446634r8b484q006u873e8ypr2j2
  C:\Users\Don\AppData\Local\xluygn5w0ydf0hnr0fgh6n138r8k
  C:\ProgramData\xluygn5w0ydf0hnr0fgh6n138r8k
  
  :Commands
  [purity]
  [resethosts]
  [Reboot]

• Then click the Run Fix button at the top
• Let the program run unhindered, reboot the PC when it is done
• Open OTL again and click the Quick Scan button. Post the log it produces in your next reply.

Step 2

Download the adwCleaner

• Run the Tool
  (Windows Vista and Windows 7 users: right click in the adwCleaner.exe and select the Run as Administrator option)
• Select the Delete button.
• When the scan completes, it will open a notepad windows.
• Please, copy the content of this file in your next reply.

Step 3

Please download Malwarebytes' Anti-Malware

Double Click mbam-setup.exe to install the application.

• Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
• If an update is found, it will download and install the latest version.
• Once the program has loaded, select "Perform Quick Scan", then click Scan.
• The scan may take some time to finish, so please be patient.
• When the scan is complete, click OK, then Show Results to view the results.
• Make sure that everything is checked, and click Remove Selected.
• When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
• The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
• Copy&Paste the entire report in your next reply.

Extra Note:
If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts, click OK to either and let MBAM proceed with the disinfection process, if asked to restart the computer, please do so immediately.


Step 4

Please don't forget to include these items in your reply:

• OTL fix log
• adwCleaner log
• Malwarebytes log

It would be helpful if you could post each log in separate post using "Add Reply" button

[maliprog]

Hello dcurtis113 and welcome to my office here at G2G!

My nick is maliprog and I'll be your technical support on this issue. Before we start please read my notes carefully:

NOTES:

• Malware removal is NOT instantaneous, most infections require several courses of action to completely eradicate.
• Absence of symptoms does not always mean the computer is clean
• Kindly follow my instructions in the order posted. Order is crucial in cleaning process.
• Please DO NOT run any scans or fix on your own without my direction.
• Please read all of my response through at least once before attempting to follow the procedures described.
• If there's anything you don't understand or isn't totally clear, please come back to me for clarification.
• Please do not attach any log files to your replies unless I specifically ask you. Instead please copy and paste it to include the log in your reply.
• You must reply within 3 days or your topic will be closed

Step 1

Run OTL

• Under the Custom Scans/Fixes box at the bottom, paste in the following
  
  

  :OTL
  CHR - homepage: http://www.searchnu.com/406
  CHR - homepage: http://www.searchnu.com/406
  O2 - BHO: (PricePeep) - {FD6D90C0-E6EE-4BC6-B9F7-9ED319698007} - C:\Program Files (x86)\PricePeep\pricepeep.dll (PricePeep)
  O2 - BHO: (Wajam) - {A7A6995D-6EE1-4FD1-A258-49395D5BF99C} - C:\Program Files (x86)\Wajam\IE\priam_bho.dll (Wajam)
  [2012/11/04 10:10:06 | 000,000,000 | ---D | C] -- C:\Users\Don\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Wajam
  [2012/11/04 10:10:03 | 000,000,000 | ---D | C] -- C:\Users\Don\AppData\Local\Wajam
  [2012/11/04 10:10:02 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Wajam
  [2012/11/04 10:09:53 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\PricePeep
  [2012/11/06 07:45:01 | 000,000,000 | ---D | C] -- C:\Users\Don\AppData\Local\{645359A3-3E98-41FF-BAAE-D8AE408113C5}
  [2012/11/05 18:18:03 | 000,000,000 | ---D | C] -- C:\Users\Don\AppData\Local\{C2591D4A-637E-4BE8-849E-4E7A80BF97B8}
  [2012/11/04 07:40:17 | 000,000,000 | ---D | C] -- C:\Users\Don\AppData\Local\{5D9E46C7-69BD-4A76-B5DB-F7F1B5CA4549}
  [2012/11/03 19:39:51 | 000,000,000 | ---D | C] -- C:\Users\Don\AppData\Local\{9ADF526F-23FC-4839-ADBC-21624D093ECF}
  [2012/11/03 07:39:27 | 000,000,000 | ---D | C] -- C:\Users\Don\AppData\Local\{28667192-D27C-4262-B860-781D5F5C6272}
  [2012/11/01 20:26:33 | 000,000,000 | ---D | C] -- C:\Users\Don\AppData\Local\{E4D52803-0C42-4D19-9077-DBF5AE023AD0}
  [2012/11/01 06:18:58 | 000,000,000 | ---D | C] -- C:\Users\Don\AppData\Local\{C832AF8E-8D41-44E2-BE7A-730EB1ECABA2}
  [2012/10/31 18:18:34 | 000,000,000 | ---D | C] -- C:\Users\Don\AppData\Local\{057CC137-5AA2-454F-986E-0FBCA73CA2FB}
  [2012/10/29 05:59:34 | 000,000,000 | ---D | C] -- C:\Users\Don\AppData\Local\{632AFADD-B58A-4566-A237-F6187C4EB629}
  [2012/10/28 16:48:36 | 000,000,000 | ---D | C] -- C:\Users\Don\AppData\Local\{24B60F8E-DCE2-4CC3-A9C7-42D8BA4CA3B8}
  [2012/10/24 04:12:23 | 000,000,000 | ---D | C] -- C:\Users\Don\AppData\Local\{F83318D8-FA48-416A-A6E3-200D7BCCEC4B}
  [2012/10/18 18:30:50 | 000,000,000 | ---D | C] -- C:\Users\Don\AppData\Local\{56C2019B-0890-4A4D-BBA4-21A07B700DB2}
  [2012/10/16 18:29:50 | 000,000,000 | ---D | C] -- C:\Users\Don\AppData\Local\{885F6081-48C0-4248-B752-FAD84C4BD3D0}
  [2012/10/15 18:29:38 | 000,000,000 | ---D | C] -- C:\Users\Don\AppData\Local\{B576AC9D-0002-43BB-A12C-76008E0F70A3}
  [2012/10/15 18:23:57 | 000,000,000 | ---D | C] -- C:\Users\Don\AppData\Local\{CC2E532F-57A2-46F8-ABA0-850DE384CDAF}
  [2012/10/15 18:03:17 | 000,000,000 | ---D | C] -- C:\Users\Don\AppData\Local\{816D545A-E804-4B52-A39B-F04EF8EFDC9D}
  [2012/10/15 06:03:05 | 000,000,000 | ---D | C] -- C:\Users\Don\AppData\Local\{45BD9130-4EC6-4CB5-B99A-2EABF35B78DE}
  [2012/10/14 13:33:53 | 000,000,000 | ---D | C] -- C:\Users\Don\AppData\Local\{CB677BA9-D13D-4375-B527-A2F3237ECB22}
  [2012/10/11 05:17:54 | 000,000,000 | ---D | C] -- C:\Users\Don\AppData\Local\{C2B2CA9F-0FF9-4DD1-A6D4-9C623E82F182}
  [2011/12/24 17:27:10 | 000,001,328 | -HS- | C] () -- C:\Users\Don\AppData\Local\446634r8b484q006u873e8ypr2j2
  [2011/12/24 17:27:10 | 000,001,328 | -HS- | C] () -- C:\ProgramData\446634r8b484q006u873e8ypr2j2
  [2011/12/16 20:45:37 | 000,001,400 | -HS- | C] () -- C:\Users\Don\AppData\Local\xluygn5w0ydf0hnr0fgh6n138r8k
  [2011/12/16 20:45:37 | 000,001,400 | -HS- | C] () -- C:\ProgramData\xluygn5w0ydf0hnr0fgh6n138r8k
  [2011/08/30 23:04:57 | 000,000,000 | ---- | C] () -- C:\Users\Don\AppData\Local\{F4AFC87A-A2E2-47B5-A2B1-7313E5D60083}
  
  :Files
  C:\Users\Don\AppData\Local\446634r8b484q006u873e8ypr2j2
  C:\ProgramData\446634r8b484q006u873e8ypr2j2
  C:\Users\Don\AppData\Local\xluygn5w0ydf0hnr0fgh6n138r8k
  C:\ProgramData\xluygn5w0ydf0hnr0fgh6n138r8k
  
  :Commands
  [purity]
  [resethosts]
  [Reboot]

• Then click the Run Fix button at the top
• Let the program run unhindered, reboot the PC when it is done
• Open OTL again and click the Quick Scan button. Post the log it produces in your next reply.

Step 2

Download the adwCleaner

• Run the Tool
  (Windows Vista and Windows 7 users: right click in the adwCleaner.exe and select the Run as Administrator option)
• Select the Delete button.
• When the scan completes, it will open a notepad windows.
• Please, copy the content of this file in your next reply.

Step 3

Please download Malwarebytes' Anti-Malware

Double Click mbam-setup.exe to install the application.

• Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
• If an update is found, it will download and install the latest version.
• Once the program has loaded, select "Perform Quick Scan", then click Scan.
• The scan may take some time to finish, so please be patient.
• When the scan is complete, click OK, then Show Results to view the results.
• Make sure that everything is checked, and click Remove Selected.
• When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
• The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
• Copy&Paste the entire report in your next reply.

Extra Note:
If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts, click OK to either and let MBAM proceed with the disinfection process, if asked to restart the computer, please do so immediately.


Step 4

Please don't forget to include these items in your reply:

• OTL fix log
• adwCleaner log
• Malwarebytes log

It would be helpful if you could post each log in separate post using "Add Reply" button

[maliprog]

Due to lack of feedback, this topic has been closed.

If you need this topic reopened, please contact a staff member. This applies only to the original topic starter. Everyone else please begin a New Topic.