Javascript Disabled Detected

You currently have javascript disabled. Several functions may not work. Please re-enable javascript to access full functionality.

Trojan: PSW.OnlineGames4.ALGT [Solved]

Started by RebelSnipe , Apr 24 2013 02:19 AM

This topic is locked

#16
godawgs

Posted 01 May 2013 - 06:43 PM

Teacher

Retired Staff
8,228 posts

I couldn't find the quarantine file in the root directory. I did a search and found one in c:\Qoobox\

Yep, that's my bad. I meant the C:\Qoobox folder. You found the right file.

You gotta' remember, I'm certainly no techie - but the line with the "catchme.log" looks suspicious to me! Is that something of a concern?

Nope. It's part of ComboFix

We need to restore the files and folder that ComboFix quarantined but the log file doesn't show the C:\Windows\PolicyDefinitions folder as being quarantined. The ComboFix log shows it but the ComboFix-quarantined-files.txt log doesn't show it. I want to see if the PolicyDefinitions folder is still in the Windows directory.

This OTL custom scan will produce an abbreviated log so pay close attention to the directions.

Posted Image

OTL Custom Scan

1. Please copy the text in the Quote box below, (Do Not copy the word Quote), and paste it in the Posted Image

box in OTL. To do that:

Highlight everything inside the quote box, (except the word Quote), right click the mouse and click Copy.

dir C:\Windows /c

2. Re-open Posted Image

on the desktop. To do that:

Vista / 7 Users: Right click on the icon and click Run as Administrator)

Make sure all other windows are closed.

You will see a console like the one below:
Click the box beside the None button at the top of the console.<---Very Important
Make sure the Output box at the top is set to Standard Output.
Place the mouse pointer inside the box, right click and click Paste. This will put the above script inside OTL
Click the button. Do not change any settings unless otherwise told to do so.
Let the scan run uninterrupted.
When the scan completes, it will open OTL.Txt on the desktop. This file is also saved in the same location as OTL (it should be on your desktop).
Please copy the contents of this file and paste it into your reply. To do that:
On the OTL.txt file Menu Bar click Edit then click Select All. This will highlight the contents of the file. Then click Copy.
Right click inside the forum post window then click Paste. This will paste the contents of the OTL.txt file in the in the post window.

Paste the OTL.txt log in your next reply.

#17
RebelSnipe

Posted 01 May 2013 - 08:21 PM

Member

Topic Starter
Member
30 posts

Here is the output from the custom scan:

OTL logfile created on: 5/1/2013 9:18:37 PM - Run 3
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\Michael\Desktop
64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.10.9200.16540)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

5.48 Gb Total Physical Memory | 2.91 Gb Available Physical Memory | 53.08% Memory free
10.96 Gb Paging File | 8.69 Gb Available in Paging File | 79.31% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 581.29 Gb Total Space | 395.02 Gb Free Space | 67.96% Space Free | Partition Type: NTFS
Drive D: | 14.59 Gb Total Space | 1.62 Gb Free Space | 11.11% Space Free | Partition Type: NTFS
Drive F: | 99.34 Mb Total Space | 89.20 Mb Free Space | 89.79% Space Free | Partition Type: FAT32

Computer Name: MICHAEL-HP | User Name: Michael | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: Off | File Age = 30 Days

========== Custom Scans ==========

< dir C:\Windows /c >
Volume in drive C has no label.
Volume Serial Number is B00A-B00B
Directory of C:\WINDOWS
04/25/2013 02:48 PM <DIR> .
04/25/2013 02:48 PM <DIR> ..
07/14/2009 12:32 AM <DIR> addins
07/13/2009 10:20 PM <DIR> AppCompat
04/24/2013 07:12 PM <DIR> AppPatch
01/14/2011 03:00 PM 30,831 atiogl.xml
07/21/2011 12:44 PM 0 ativpsrm.bin
11/20/2010 10:24 PM 71,168 bfsvc.exe
07/14/2009 12:32 AM <DIR> Boot
07/14/2009 12:32 AM <DIR> Branding
07/21/2011 01:22 PM 12 CSUP.txt
07/14/2009 12:32 AM <DIR> Cursors
04/24/2013 02:15 PM <DIR> debug
04/23/2013 11:45 PM 121 DeleteOnReboot.bat
07/14/2009 12:32 AM <DIR> diagnostics
07/14/2009 12:37 AM <DIR> DigitalLocker
11/01/2012 01:10 AM 963 DirectX.log
07/14/2009 12:32 AM <DIR> Downloaded Program Files
07/21/2011 12:38 PM 4,622 DPINST.LOG
07/21/2011 12:40 PM <DIR> Driver Cache
07/21/2011 01:05 PM 5,075 DtcInstall.log
01/17/2012 08:48 PM <DIR> ehome
11/01/2012 01:16 AM <DIR> en
11/21/2010 02:06 AM <DIR> en-US
04/24/2013 07:17 PM <DIR> erdnt
04/24/2013 06:53 PM <DIR> ERUNT
02/25/2011 01:19 AM 2,871,808 explorer.exe
07/13/2009 08:39 PM 15,360 fveupdate.exe
11/21/2010 02:19 AM <DIR> Globalization
08/30/2000 07:00 PM 80,412 grep.exe
01/24/2012 09:14 PM <DIR> Help
07/13/2009 08:39 PM 733,696 HelpPane.exe
10/01/2012 04:04 PM <DIR> Hewlett-Packard
07/13/2009 08:39 PM 16,896 hh.exe
06/10/2009 03:30 PM 48,223 HomeBasic.xml
06/10/2009 03:30 PM 48,265 HomePremium.xml
03/03/2011 11:04 PM 7,736 hpDSTRES.DLL
03/20/2013 12:06 PM 7,201 IE10_main.log
07/14/2009 12:37 AM <DIR> IME
04/29/2013 05:18 PM <DIR> inf
07/14/2009 12:32 AM <DIR> L2Schemas
09/16/2012 03:56 PM <DIR> LiveKernelReports
03/20/2013 12:06 PM <DIR> Logs
11/07/2010 12:20 PM 208,896 MBR.exe
04/22/2013 10:37 PM 649,954,062 MEMORY.DMP
07/13/2009 06:06 PM 43,131 mib.bin
02/13/2013 09:16 PM <DIR> Microsoft.NET
04/22/2013 10:37 PM <DIR> Minidump
07/13/2009 09:34 PM <DIR> ModemLogs
06/10/2009 03:36 PM 1,405 msdfmap.ini
08/15/2011 06:15 PM 296,098 msxml4-KB954430-enu.LOG
08/15/2011 06:17 PM 296,980 msxml4-KB973688-enu.LOG
04/19/2009 11:56 PM 60,416 NIRCMD.exe
07/13/2009 08:39 PM 193,536 notepad.exe
04/26/2013 06:08 PM 521,730 ntbtlog.txt
07/14/2009 12:32 AM <DIR> Offline Web Pages
08/14/2011 05:20 AM <DIR> Panther
04/28/2011 07:32 PM <DIR> PCHEALTH
07/14/2009 12:32 AM <DIR> Performance
06/26/2011 01:45 AM 256,000 PEV.exe
04/24/2013 07:43 PM 305,318 PFRO.log
07/13/2009 10:20 PM <DIR> PLA
05/01/2013 06:04 PM <DIR> Prefetch
07/13/2009 08:39 PM 427,008 regedit.exe
07/13/2009 10:20 PM <DIR> Registration
03/20/2013 05:55 PM <DIR> rescache
11/01/2012 12:12 AM <DIR> Resources
07/13/2009 09:35 PM <DIR> SchCache
07/14/2009 12:32 AM <DIR> schemas
07/13/2009 10:20 PM <DIR> security
08/30/2000 07:00 PM 98,816 sed.exe
07/13/2009 11:45 PM <DIR> ServiceProfiles
11/21/2010 02:06 AM <DIR> servicing
04/28/2011 06:58 PM <DIR> Setup
04/29/2013 05:13 PM 88,703 setupact.log
07/13/2009 11:51 PM 0 setuperr.log
08/28/2011 10:10 PM <DIR> SHELLNEW
08/15/2011 04:42 PM <DIR> SoftwareDistribution
11/21/2010 02:06 AM <DIR> Speech
02/11/2012 01:36 AM 67,072 splwow64.exe
06/10/2009 03:31 PM 48,201 Starter.xml
11/28/2011 05:52 PM 1,128,448 sttray64.exe
08/30/2000 07:00 PM 518,144 SWREG.exe
08/30/2000 07:00 PM 406,528 SWSC.exe
08/30/2000 07:00 PM 212,480 SWXCACLS.exe
07/13/2009 09:36 PM <DIR> system
04/24/2013 07:16 PM 215 system.ini
04/29/2013 05:18 PM <DIR> System32
04/29/2013 05:13 PM <DIR> SysWOW64
07/13/2009 11:57 PM <DIR> TAPI
02/26/2013 08:45 PM <DIR> Tasks
05/01/2013 09:18 PM <DIR> temp
07/13/2009 09:34 PM <DIR> tracing
07/21/2011 12:24 PM 5,949 TSSysprep.log
06/10/2009 04:41 PM 94,784 twain.dll
09/23/2012 11:14 PM <DIR> twain_32
11/20/2010 10:25 PM 51,200 twain_32.dll
06/10/2009 04:41 PM 49,680 twunk_16.exe
07/13/2009 08:14 PM 31,232 twunk_32.exe
07/13/2009 10:20 PM <DIR> Vss
07/14/2009 12:32 AM <DIR> Web
07/14/2009 12:09 AM 403 win.ini
05/01/2013 05:53 PM 1,776,268 WindowsUpdate.log
07/13/2009 08:14 PM 9,728 winhlp32.exe
04/24/2013 03:28 AM <DIR> winsxs
09/12/2012 03:57 PM 322,048 WLXPGSS.SCR
06/10/2009 03:52 PM 316,640 WMSysPr9.prx
07/13/2009 08:39 PM 10,240 write.exe
08/30/2000 07:00 PM 68,096 zip.exe
04/28/2011 07:33 PM 20 šo¥
52 File(s) 661,811,864 bytes
58 Dir(s) 424,154,775,552 bytes free

< End of report >

#18
godawgs

Posted 02 May 2013 - 11:54 AM

Teacher

Retired Staff
8,228 posts

Thanks. That gave me what I needed to see. Let's restore some files/folders. But first I want to completely uninstall AVG. This will remove the possibility that AVG can interfere with the restoration process.
After the restoration process is done but before re-installing AVG I want you to see if you can delete the c:\Users\Michael\AppData\Local\Temp\sysoxkq folder. If you can then that Temp folder was probably put there by AVG. Then we will reinstall AVG and check to see if the restorations clear the issues with IE.

If you have any questions STOP and ask before proceeding. You may want to print the instructions or save them to a text file.

1.
Please download a fresh copy of the AVG Free Edition 2013.0.3272(64bit) antivirus program from here and save it to the desktop. Click the Download Latest Version button in the upper right corner of the page. It is 139.05MB
NOTE: You are downloading from the Filehippo site. I didn't link to the AVG site because their download goes through CNET and CNET adds a bunch of adware to their downloads if you aren't careful.

2.
Please download the AVG Remover tool from here and save it to the desktop.

3.
Close all browsers and open windows and disconnect the computer from the internet.

Step-1.

Completely Uninstall AVG

1. Please click the Start Orb

, click Control Panel. Under the Programs and Features heading click Uninstall a program
2. In the list of programs installed, locate the following program(s):

AVG 2012
AVG 2013

3. Right click each program and click Uninstall
4. After the programs have been uninstalled, close the Installed Programs window and the Control Panel.
5. Reboot the computer.

Delete the folders associated with the uninstalled programs.(Only do this if you uninstalled the program)

1. Using Windows Explorer (to get there right-click your Start button and click "Explore"), please delete the following folders(s) (if present):

C:\Program Files (x86)\AVG\AVG2013
C:\Program Files (x86)\AVG\AVG2012
C:\Program Files (x86)\Common Files\AVG Secure Search
C:\Users\Michael\AppData\Roaming\AVG2013

2. Close Windows Explorer.

Step-2.

Run the AVG Remover Tool

Right click on the avgremover64.exe file and click Run as Administrator to run the tool. Follow any on screen prompts.

Step-3.

We need to run a ComboFix script to restore the files and folders that it quarantined. NOTE: Your antivirus has been uninstalled so don't worry about that part of the instructions.

Posted Image

Run a CFScript

1. Close any open Windows, especially browsers.

IMPORTANT:- Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. This fix will require a reboot to correct so make sure these are turned off and will not turn back on at reboot. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to the link here to see a list of programs that should be disabled.
The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.

2. Copy all of the text in the Quote box below (Do Not copy the word Quote) into Notepad. To do that highlight all the text in the Quote box (except the word Quote) then right click the mouse and click Copy.

DeQuarantine::
C:\Qoobox\Quarantine\C\Windows\PolicyDefinitions
C:\Qoobox\Quarantine\C\Windows\PolicyDefinitions\en-US

Note: The above code was created specifically for this user. If you are not this user, do NOT follow these directions as they could damage the workings of your system.

3. Open Notepad. To do that click Start>>Run. in the Open box type notepad and click OK. An empty notepad window will open.

Right click inside the Notepad window and click Paste.
Click File then Save AS.
On the Save AS window click Desktop (on the left side of the window).
In the File Name box type CFScript.txt (NOTE: The file name must be typed exactly as shown.)
Click the Save as type down arrow and click All Files (*.*)
Click Save

This will save the CFScript.txt file to the Desktop.

4. Referring to the animation below, drag the CFScript.txt file onto the ComboFix.exe Cat icon and drop it.
ComboFix will launch and run the CFScript file
.

Posted Image

Note:
1. Do not mousebclick ComboFix's window while it's running. That may cause it to stall.
2. Do not "re-run" ComboFix. If you have a problem, reply back for further instructions.
3. If you receive an error "Illegal operation attempted on a registry key that has been marked for deletion." Please restart the computer. That will cure it.
When finished, ComboFix will produce 2 files. A C:\DeQuarantine_log.txt file and a C:\ComboFix.txt file which I will require in your next reply.

Step-4.

See if the C:\Users\Michael\AppData\Local\Temp\sysoxkq is still there and if it is see if you can delete it.

Step-5.

Reinstall the AVG2013 antivirus program.

Step-6.

Re-connect the computer back to the internet so you can check IE and post the information I need.

Step-7.

Open IE and see if the issues with it are gone.

Step-8.

Things For Your Next Post:
Please post the logs in the order requested. Do Not attach the logs unless I request it.
1. Let me know if there were any problems uninstalling AVG or running the Remover tool.
2. The DeQuarantine_log.txt log
3. The new ComboFix.txt log
4. Let me know if you were able to find the C:\Users\Michael\AppData\Local\Temp\sysoxkq folder and delete it.
5. Let me know if the problems with IE are still there.

#19
RebelSnipe

Posted 02 May 2013 - 01:38 PM

Member

Topic Starter
Member
30 posts

Hey godawgs - thank you again for the continued help!

I understand the instructions but it isn't going quite as planned. I'm posting this reply from a different computer as I am hoping to hear back from you before proceeding on the other one.

Downloaded AVG 2013 - ok
Downloaded AVG Removal Tool - ok
Disconnected from internet - ok
Control Panel -> Uninstall Program -> successfully uninstalled AVG 2013 (no AVG 2012 visable.)
Rebooted - ok
Windows Explorer - file deletes:

C:\Program Files (x86)\AVG\AVG2013 - ok (deleted 21 files, 2 folders, 12.4mb)
C:\Program Files (x86)\AVG\AVG2012 - not present
C:\Program Files (x86)\Common Files\AVG Secure Search - "can't delete because folder or a file is open in another program" error
C:\Users\Michael\AppData\Roaming\AVG2013 - not present

I thought since I couldn't remove the AVG Secure Search directory via Windows Explorer maybe the AVG Removal Tool would nuke it (I know, I know, I shouldn't think.....)

Ran AVG Removal Tool - ok

I checked and the AVG Secure Search directory was still present and I still couldn't remove it.

I realize that I didn't complete the ComboFix DeQuarantine yet but I also looked in Windows Explorer and the C:\Users\Michael\AppData\Local\Temp\sysoxkq directory is still there and I still don't have acces to it.

The AVG Removal Tool log is on the questionable computer and I hate to use any media to move that file to this healthy computer. I read through the log (pretending I had a clue what it was showing me : ) and one group of lines stood out to me:

INFO Processing registry SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows
DEBUG Value SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows:AppInit_DLLs Modify
DEBUG Reading SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows:AppInit_DLLs failed (error: e001003d)
DEBUG Value SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows:AppInit_DLLs Modify failed

So, net / net, I failed at the step of manually deleting the AVG Secure Search directory, ran the AVG removal tool but stopped at the ComboFix step. Suggestions on how to proceed?

#20
godawgs

Posted 02 May 2013 - 02:16 PM

Teacher

Retired Staff
8,228 posts

Continue with Step 3., running the ComboFix script and complete the rest. then let me know where we are.

#21
RebelSnipe

Posted 02 May 2013 - 03:45 PM

Member

Topic Starter
Member
30 posts

OK - I continued on with the rest of the steps.

Ran ComboFix w/ script - ok - logs posted below.
c:\Users\Michael\AppData\Local\Temp\sysoxkq - still exists / access still denied
Installed AVG 2013 - ok
IE - still doesn't work

Sorry this one is being so difficult. What would you suggest to try next?

Here are the logs:

C:\Qoobox\Quarantine\C\Windows\PolicyDefinitions\DeviceRedirection.admx -> C:\Windows\PolicyDefinitions\DeviceRedirection.admx
C:\Qoobox\Quarantine\C\Windows\PolicyDefinitions\EnhancedStorage.admx -> C:\Windows\PolicyDefinitions\EnhancedStorage.admx
C:\Qoobox\Quarantine\C\Windows\PolicyDefinitions\inetres.admx -> C:\Windows\PolicyDefinitions\inetres.admx
C:\Qoobox\Quarantine\C\Windows\PolicyDefinitions\NCSI.admx -> C:\Windows\PolicyDefinitions\NCSI.admx
C:\Qoobox\Quarantine\C\Windows\PolicyDefinitions\RacWmiProv.admx -> C:\Windows\PolicyDefinitions\RacWmiProv.admx
C:\Qoobox\Quarantine\C\Windows\PolicyDefinitions\ReAgent.admx -> C:\Windows\PolicyDefinitions\ReAgent.admx
C:\Qoobox\Quarantine\C\Windows\PolicyDefinitions\sdiageng.admx -> C:\Windows\PolicyDefinitions\sdiageng.admx
C:\Qoobox\Quarantine\C\Windows\PolicyDefinitions\sdiagschd.admx -> C:\Windows\PolicyDefinitions\sdiagschd.admx
C:\Qoobox\Quarantine\C\Windows\PolicyDefinitions\Search.admx -> C:\Windows\PolicyDefinitions\Search.admx
C:\Qoobox\Quarantine\C\Windows\PolicyDefinitions\WindowsMediaDRM.admx -> C:\Windows\PolicyDefinitions\WindowsMediaDRM.admx
C:\Qoobox\Quarantine\C\Windows\PolicyDefinitions\WindowsMediaPlayer.admx -> C:\Windows\PolicyDefinitions\WindowsMediaPlayer.admx
C:\Qoobox\Quarantine\C\Windows\PolicyDefinitions\en-US\DeviceRedirection.adml -> C:\Windows\PolicyDefinitions\en-US\DeviceRedirection.adml
C:\Qoobox\Quarantine\C\Windows\PolicyDefinitions\en-US\EnhancedStorage.adml -> C:\Windows\PolicyDefinitions\en-US\EnhancedStorage.adml
C:\Qoobox\Quarantine\C\Windows\PolicyDefinitions\en-US\InetRes.adml -> C:\Windows\PolicyDefinitions\en-US\InetRes.adml
C:\Qoobox\Quarantine\C\Windows\PolicyDefinitions\en-US\NCSI.adml -> C:\Windows\PolicyDefinitions\en-US\NCSI.adml
C:\Qoobox\Quarantine\C\Windows\PolicyDefinitions\en-US\RacWmiProv.adml -> C:\Windows\PolicyDefinitions\en-US\RacWmiProv.adml
C:\Qoobox\Quarantine\C\Windows\PolicyDefinitions\en-US\ReAgent.adml -> C:\Windows\PolicyDefinitions\en-US\ReAgent.adml
C:\Qoobox\Quarantine\C\Windows\PolicyDefinitions\en-US\sdiageng.adml -> C:\Windows\PolicyDefinitions\en-US\sdiageng.adml
C:\Qoobox\Quarantine\C\Windows\PolicyDefinitions\en-US\sdiagschd.adml -> C:\Windows\PolicyDefinitions\en-US\sdiagschd.adml
C:\Qoobox\Quarantine\C\Windows\PolicyDefinitions\en-US\Search.adml -> C:\Windows\PolicyDefinitions\en-US\Search.adml
C:\Qoobox\Quarantine\C\Windows\PolicyDefinitions\en-US\WindowsMediaDRM.adml -> C:\Windows\PolicyDefinitions\en-US\WindowsMediaDRM.adml
C:\Qoobox\Quarantine\C\Windows\PolicyDefinitions\en-US\WindowsMediaPlayer.adml -> C:\Windows\PolicyDefinitions\en-US\WindowsMediaPlayer.adml
22 File(s) copied

ComboFix 13-04-24.03 - Michael 05/02/2013 15:27:00.2.4 - x64
Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.5611.4007 [GMT -5:00]
Running from: c:\users\Michael\Desktop\ComboFix.exe
Command switches used :: c:\users\Michael\Desktop\CFScript.txt
SP: Windows Defender *Enabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
- REDUCED FUNCTIONALITY MODE -
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\windows\PolicyDefinitions
c:\windows\PolicyDefinitions\DeviceRedirection.admx
c:\windows\PolicyDefinitions\en-US\DeviceRedirection.adml
c:\windows\PolicyDefinitions\en-US\EnhancedStorage.adml
c:\windows\PolicyDefinitions\en-US\InetRes.adml
c:\windows\PolicyDefinitions\en-US\NCSI.adml
c:\windows\PolicyDefinitions\en-US\RacWmiProv.adml
c:\windows\PolicyDefinitions\en-US\ReAgent.adml
c:\windows\PolicyDefinitions\en-US\sdiageng.adml
c:\windows\PolicyDefinitions\en-US\sdiagschd.adml
c:\windows\PolicyDefinitions\en-US\Search.adml
c:\windows\PolicyDefinitions\en-US\WindowsMediaDRM.adml
c:\windows\PolicyDefinitions\en-US\WindowsMediaPlayer.adml
c:\windows\PolicyDefinitions\EnhancedStorage.admx
c:\windows\PolicyDefinitions\inetres.admx
c:\windows\PolicyDefinitions\NCSI.admx
c:\windows\PolicyDefinitions\RacWmiProv.admx
c:\windows\PolicyDefinitions\ReAgent.admx
c:\windows\PolicyDefinitions\sdiageng.admx
c:\windows\PolicyDefinitions\sdiagschd.admx
c:\windows\PolicyDefinitions\Search.admx
c:\windows\PolicyDefinitions\WindowsMediaDRM.admx
c:\windows\PolicyDefinitions\WindowsMediaPlayer.admx
.
.
((((((((((((((((((((((((( Files Created from 2013-04-02 to 2013-05-02 )))))))))))))))))))))))))))))))
.
.
2013-05-02 20:28 . 2013-05-02 20:28 -------- d-----w- c:\users\Default\AppData\Local\temp
2013-05-02 20:28 . 2013-05-02 20:28 -------- d-----w- c:\users\Administrator\AppData\Local\temp
2013-04-26 19:00 . 2013-04-26 19:00 -------- d-----w- c:\program files (x86)\ESET
2013-04-25 19:49 . 2013-04-25 19:49 -------- d-----w- C:\Rooter$
2013-04-25 19:44 . 2013-04-25 19:44 -------- d-----w- c:\users\Michael\AppData\Local\ElevatedDiagnostics
2013-04-24 23:53 . 2013-04-24 23:53 -------- d-----w- c:\windows\ERUNT
2013-04-24 23:52 . 2013-04-24 23:52 -------- d-----w- C:\JRT
2013-04-24 18:59 . 2013-04-24 18:59 -------- d-----w- c:\program files (x86)\Common Files\Java
2013-04-24 18:59 . 2013-04-24 18:58 866720 ----a-w- c:\windows\SysWow64\npDeployJava1.dll
2013-04-24 18:59 . 2013-04-24 18:58 95648 ----a-w- c:\windows\SysWow64\WindowsAccessBridge-32.dll
2013-04-24 18:58 . 2013-04-24 18:58 -------- d-----w- c:\programdata\McAfee
2013-04-24 04:45 . 2013-04-24 04:45 121 ----a-w- c:\windows\DeleteOnReboot.bat
2013-04-24 04:39 . 2013-04-24 04:39 -------- d-----w- c:\users\Michael\AppData\Roaming\Malwarebytes
2013-04-24 04:39 . 2013-04-24 04:39 -------- d-----w- c:\programdata\Malwarebytes
2013-04-24 04:39 . 2013-04-24 04:39 -------- d-----w- c:\program files (x86)\Malwarebytes' Anti-Malware
2013-04-24 04:39 . 2013-04-04 19:50 25928 ----a-w- c:\windows\system32\drivers\mbam.sys
2013-04-24 04:38 . 2013-04-24 04:38 -------- d-----w- c:\users\Michael\AppData\Local\Programs
2013-04-24 04:34 . 2013-04-12 14:45 1656680 ----a-w- c:\windows\system32\drivers\ntfs.sys
2013-04-20 04:06 . 2013-04-23 03:37 -------- d-----w- c:\users\TEMP
2013-04-10 19:34 . 2013-02-15 06:06 3717632 ----a-w- c:\windows\system32\mstscax.dll
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-04-24 18:58 . 2011-04-29 00:39 788896 ----a-w- c:\windows\SysWow64\deployJava1.dll
2013-03-20 17:03 . 2013-03-20 17:03 226304 ----a-w- c:\windows\system32\elshyph.dll
2013-03-20 17:03 . 2013-03-20 17:03 185344 ----a-w- c:\windows\SysWow64\elshyph.dll
2013-03-20 17:03 . 2013-03-20 17:03 158720 ----a-w- c:\windows\SysWow64\msls31.dll
2013-03-20 17:03 . 2013-03-20 17:03 1054720 ----a-w- c:\windows\system32\MsSpellCheckingFacility.exe
2013-03-20 17:03 . 2013-03-20 17:03 719360 ----a-w- c:\windows\SysWow64\mshtmlmedia.dll
2013-03-20 17:03 . 2013-03-20 17:03 523264 ----a-w- c:\windows\SysWow64\vbscript.dll
2013-03-20 17:03 . 2013-03-20 17:03 150528 ----a-w- c:\windows\SysWow64\iexpress.exe
2013-03-20 17:03 . 2013-03-20 17:03 138752 ----a-w- c:\windows\SysWow64\wextract.exe
2013-03-20 17:03 . 2013-03-20 17:03 73728 ----a-w- c:\windows\SysWow64\SetIEInstalledDate.exe
2013-03-20 17:03 . 2013-03-20 17:03 48640 ----a-w- c:\windows\SysWow64\mshtmler.dll
2013-03-20 17:03 . 2013-03-20 17:03 38400 ----a-w- c:\windows\SysWow64\imgutil.dll
2013-03-20 17:03 . 2013-03-20 17:03 137216 ----a-w- c:\windows\SysWow64\ieUnatt.exe
2013-03-20 17:03 . 2013-03-20 17:03 12800 ----a-w- c:\windows\SysWow64\mshta.exe
2013-03-20 17:03 . 2013-03-20 17:03 110592 ----a-w- c:\windows\SysWow64\IEAdvpack.dll
2013-03-20 17:03 . 2013-03-20 17:03 61952 ----a-w- c:\windows\SysWow64\tdc.ocx
2013-03-20 17:03 . 2013-03-20 17:03 361984 ----a-w- c:\windows\SysWow64\html.iec
2013-03-20 17:03 . 2013-03-20 17:03 23040 ----a-w- c:\windows\SysWow64\licmgr10.dll
2013-03-20 17:03 . 2013-03-20 17:03 1441280 ----a-w- c:\windows\SysWow64\inetcpl.cpl
2013-03-20 17:03 . 2013-03-20 17:03 81408 ----a-w- c:\windows\system32\icardie.dll
2013-03-20 17:03 . 2013-03-20 17:03 762368 ----a-w- c:\windows\system32\ieapfltr.dll
2013-03-20 17:03 . 2013-03-20 17:03 452096 ----a-w- c:\windows\system32\dxtmsft.dll
2013-03-20 17:03 . 2013-03-20 17:03 441856 ----a-w- c:\windows\system32\html.iec
2013-03-20 17:03 . 2013-03-20 17:03 281600 ----a-w- c:\windows\system32\dxtrans.dll
2013-03-20 17:03 . 2013-03-20 17:03 216064 ----a-w- c:\windows\system32\msls31.dll
2013-03-20 17:03 . 2013-03-20 17:03 197120 ----a-w- c:\windows\system32\msrating.dll
2013-03-20 17:03 . 2013-03-20 17:03 1400416 ----a-w- c:\windows\system32\ieapfltr.dat
2013-03-20 17:03 . 2013-03-20 17:03 97280 ----a-w- c:\windows\system32\mshtmled.dll
2013-03-20 17:03 . 2013-03-20 17:03 905728 ----a-w- c:\windows\system32\mshtmlmedia.dll
2013-03-20 17:03 . 2013-03-20 17:03 27648 ----a-w- c:\windows\system32\licmgr10.dll
2013-03-20 17:03 . 2013-03-20 17:03 270848 ----a-w- c:\windows\system32\iedkcs32.dll
2013-03-20 17:03 . 2013-03-20 17:03 247296 ----a-w- c:\windows\system32\webcheck.dll
2013-03-20 17:03 . 2013-03-20 17:03 235008 ----a-w- c:\windows\system32\url.dll
2013-03-20 17:03 . 2013-03-20 17:03 167424 ----a-w- c:\windows\system32\iexpress.exe
2013-03-20 17:03 . 2013-03-20 17:03 1509376 ----a-w- c:\windows\system32\inetcpl.cpl
2013-03-20 17:03 . 2013-03-20 17:03 144896 ----a-w- c:\windows\system32\wextract.exe
2013-03-20 17:03 . 2013-03-20 17:03 102912 ----a-w- c:\windows\system32\inseng.dll
2013-03-20 17:03 . 2013-03-20 17:03 599552 ----a-w- c:\windows\system32\vbscript.dll
2013-03-20 17:03 . 2013-03-20 17:03 173568 ----a-w- c:\windows\system32\ieUnatt.exe
2013-03-20 17:03 . 2013-03-20 17:03 149504 ----a-w- c:\windows\system32\occache.dll
2013-03-20 17:03 . 2013-03-20 17:03 92160 ----a-w- c:\windows\system32\SetIEInstalledDate.exe
2013-03-20 17:03 . 2013-03-20 17:03 62976 ----a-w- c:\windows\system32\pngfilt.dll
2013-03-20 17:03 . 2013-03-20 17:03 52224 ----a-w- c:\windows\system32\msfeedsbs.dll
2013-03-20 17:03 . 2013-03-20 17:03 51200 ----a-w- c:\windows\system32\imgutil.dll
2013-03-20 17:03 . 2013-03-20 17:03 48640 ----a-w- c:\windows\system32\mshtmler.dll
2013-03-20 17:03 . 2013-03-20 17:03 13824 ----a-w- c:\windows\system32\mshta.exe
2013-03-20 17:03 . 2013-03-20 17:03 136192 ----a-w- c:\windows\system32\iepeers.dll
2013-03-20 17:03 . 2013-03-20 17:03 135680 ----a-w- c:\windows\system32\IEAdvpack.dll
2013-03-20 17:03 . 2013-03-20 17:03 12800 ----a-w- c:\windows\system32\msfeedssync.exe
2013-03-20 17:03 . 2013-03-20 17:03 77312 ----a-w- c:\windows\system32\tdc.ocx
2013-03-13 03:24 . 2012-04-04 19:45 693976 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe
2013-03-13 03:24 . 2011-08-29 16:50 73432 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2013-02-18 19:05 . 2012-10-01 01:23 39768 ----a-w- c:\windows\system32\drivers\avgtpx64.sys
2013-02-12 05:45 . 2013-03-13 22:05 135168 ----a-w- c:\windows\apppatch\AppPatch64\AcXtrnal.dll
2013-02-12 05:45 . 2013-03-13 22:05 308736 ----a-w- c:\windows\apppatch\AppPatch64\AcGenral.dll
2013-02-12 05:45 . 2013-03-13 22:05 350208 ----a-w- c:\windows\apppatch\AppPatch64\AcLayers.dll
2013-02-12 05:45 . 2013-03-13 22:05 111104 ----a-w- c:\windows\apppatch\AppPatch64\acspecfc.dll
2013-02-12 04:48 . 2013-03-13 22:05 474112 ----a-w- c:\windows\apppatch\AcSpecfc.dll
2013-02-12 04:48 . 2013-03-13 22:05 2176512 ----a-w- c:\windows\apppatch\AcGenral.dll
2013-02-12 04:12 . 2013-03-20 20:37 19968 ----a-w- c:\windows\system32\drivers\usb8023.sys
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrive1]
@="{F241C880-6982-4CE5-8CF7-7085BA96DA5A}"
[HKEY_CLASSES_ROOT\CLSID\{F241C880-6982-4CE5-8CF7-7085BA96DA5A}]
2012-11-01 06:09 220632 ----a-w- c:\users\Michael\AppData\Local\Microsoft\SkyDrive\16.4.6013.0910\SkyDriveShell.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrive2]
@="{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}"
[HKEY_CLASSES_ROOT\CLSID\{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}]
2012-11-01 06:09 220632 ----a-w- c:\users\Michael\AppData\Local\Microsoft\SkyDrive\16.4.6013.0910\SkyDriveShell.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrive3]
@="{BBACC218-34EA-4666-9D7A-C78F2274A524}"
[HKEY_CLASSES_ROOT\CLSID\{BBACC218-34EA-4666-9D7A-C78F2274A524}]
2012-11-01 06:09 220632 ----a-w- c:\users\Michael\AppData\Local\Microsoft\SkyDrive\16.4.6013.0910\SkyDriveShell.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2010-11-21 1475584]
"HP Photosmart 6510 series (NET)"="c:\program files\HP\HP Photosmart 6510 series\Bin\ScanToPCActivationApp.exe" [2011-09-16 2676584]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"StartCCC"="c:\program files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2011-04-02 336384]
"Easybits Recovery"="c:\program files (x86)\EasyBits For Kids\ezRecover.exe" [2011-03-16 61112]
"HPConnectionManager"="c:\program files (x86)\Hewlett-Packard\HP Connection Manager\HPCMDelayStart.exe" [2011-05-23 103992]
"APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2013-01-28 59720]
"HP Quick Launch"="c:\program files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe" [2011-07-11 574008]
"HPOSD"="c:\program files (x86)\Hewlett-Packard\HP On Screen Display\HPOSD.exe" [2011-08-19 379960]
"RemoteControl10"="c:\program files (x86)\CyberLink\PowerDVD10\PDVD10Serv.exe" [2011-03-30 87336]
"BDRegion"="c:\program files (x86)\Cyberlink\Shared files\brs.exe" [2011-12-12 75048]
"QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" [2012-10-25 421888]
"iTunesHelper"="c:\program files (x86)\iTunes\iTunesHelper.exe" [2013-02-20 152392]
"HP Software Update"="c:\program files (x86)\Hp\HP Software Update\HPWuSchd2.exe" [2011-10-28 49208]
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2013-03-12 253816]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-12-18 946352]
.
c:\users\Michael\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
OneNote 2010 Screen Clipper and Launcher.lnk - c:\program files (x86)\Microsoft Office\Office14\ONENOTEM.EXE [2013-1-8 228448]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"EnableShellExecuteHooks"= 1 (0x1)
.
[hkey_local_machine\software\Wow6432Node\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]
"aux2"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk *\0 /sync /restart\0 /sync /restart\0 /sync /restart\0 /sync /restart\0 /sync /restart\0 /sync /restart\0 /sync /restart\0 /sync /restart
.
R2 CLKMSVC10_38F51D56;CyberLink Product - 2011/12/12 15:50;c:\program files (x86)\CyberLink\PowerDVD10\NavFilter\kmsvc.exe [2011-02-25 241648]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe [2012-07-13 160944]
R3 androidusb;ADB Interface Driver;c:\windows\system32\Drivers\androidusb.sys [2010-04-29 32768]
R3 BBSvc;Bing Bar Update Service;c:\program files (x86)\Microsoft\BingBar\BBSvc.EXE [2011-03-02 183560]
R3 BVRPMPR5a64;BVRPMPR5a64 NDIS Protocol Driver;c:\windows\system32\drivers\BVRPMPR5a64.SYS [2010-06-16 35840]
R3 GamesAppService;GamesAppService;c:\program files (x86)\WildTangent Games\App\GamesAppService.exe [2010-10-12 206072]
R3 SrvHsfHDA;SrvHsfHDA;c:\windows\system32\DRIVERS\VSTAZL6.SYS [2009-06-10 292864]
R3 SrvHsfV92;SrvHsfV92;c:\windows\system32\DRIVERS\VSTDPV6.SYS [2009-06-10 1485312]
R3 SrvHsfWinac;SrvHsfWinac;c:\windows\system32\DRIVERS\VSTCNXT6.SYS [2009-06-10 740864]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-21 59392]
R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys [2010-11-21 31232]
R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys [2012-12-13 54784]
R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [2011-08-15 1255736]
S0 amd_sata;amd_sata;c:\windows\system32\DRIVERS\amd_sata.sys [2011-03-04 78976]
S0 amd_xata;amd_xata;c:\windows\system32\DRIVERS\amd_xata.sys [2011-03-04 38528]
S1 avgtp;avgtp;c:\windows\system32\drivers\avgtpx64.sys [2013-02-18 39768]
S2 AESTFilters;Andrea ST Filters Service;c:\program files\IDT\WDM\AESTSr64.exe [2011-11-28 89600]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [2011-04-02 204288]
S2 AMD FUEL Service;AMD FUEL Service;c:\program files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [2011-04-02 365568]
S2 ezSharedSvc;Easybits Services for Windows;c:\windows\System32\ezSharedSvcHost.exe [x]
S2 FPLService;TrueSuiteService;c:\program files (x86)\HP SimplePass 2011\TrueSuiteService.exe [2011-02-18 265544]
S2 HPClientSvc;HP Client Services;c:\program files\Hewlett-Packard\HP Client Services\HPClientServices.exe [2010-10-11 346168]
S2 HPDrvMntSvc.exe;HP Quick Synchronization Service;c:\program files (x86)\Hewlett-Packard\Shared\HPDrvMntSvc.exe [2011-09-01 227896]
S2 hpsrv;HP Service;c:\windows\system32\Hpservice.exe [2011-05-27 30520]
S2 HPWMISVC;HPWMISVC;c:\program files (x86)\Hewlett-Packard\HP Quick Launch\HPWMISVC.exe [2011-07-11 26680]
S2 IconMan_R;IconMan_R;c:\program files (x86)\Realtek\Realtek PCIE Card Reader\RIconMan.exe [2011-03-08 2375168]
S2 RoxioNow Service;RoxioNow Service;c:\program files (x86)\Roxio\RoxioNow Player\RNowSvc.exe [2010-11-26 399344]
S2 vToolbarUpdater14.2.0;vToolbarUpdater14.2.0;c:\program files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\14.2.0\ToolbarUpdater.exe [2013-02-18 968880]
S3 amdhub30;AMD USB 3.0 Hub Driver;c:\windows\system32\DRIVERS\amdhub30.sys [2011-03-18 87168]
S3 amdiox64;AMD IO Driver;c:\windows\system32\DRIVERS\amdiox64.sys [2010-02-18 46136]
S3 amdxhc;AMD USB 3.0 Host Controller Driver;c:\windows\system32\DRIVERS\amdxhc.sys [2011-03-18 188544]
S3 AtiHDAudioService;ATI Function Driver for HD Audio Service;c:\windows\system32\drivers\AtihdW76.sys [2010-11-17 115216]
S3 clwvd;CyberLink WebCam Virtual Driver;c:\windows\system32\DRIVERS\clwvd.sys [2010-07-28 31088]
S3 hpCMSrv;HP Connection Manager 4 Service;c:\program files (x86)\Hewlett-Packard\HP Connection Manager\hpCMSrv.exe [2011-05-23 1098296]
S3 netr28x;Ralink 802.11n Extensible Wireless Driver;c:\windows\system32\DRIVERS\netr28x.sys [2011-07-19 1492992]
S3 RSPCIESTOR;Realtek PCIE CardReader Driver;c:\windows\system32\DRIVERS\RtsPStor.sys [2011-03-25 337512]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [2011-02-17 428136]
S3 usbfilter;AMD USB Filter Driver;c:\windows\system32\DRIVERS\usbfilter.sys [2010-12-16 47232]
.
.
--- Other Services/Drivers In Memory ---
.
*NewlyCreated* - AVGTP
*Deregistered* - CLKMDRV10_38F51D56
.
Contents of the 'Scheduled Tasks' folder
.
2013-05-02 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-04 03:24]
.
2013-05-02 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-12-12 22:14]
.
2013-05-02 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-12-12 22:14]
.
2013-05-01 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-695660584-876410207-1421700361-1001Core.job
- c:\users\Michael\AppData\Local\Google\Update\GoogleUpdate.exe [2011-10-01 03:56]
.
2013-05-02 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-695660584-876410207-1421700361-1001UA.job
- c:\users\Michael\AppData\Local\Google\Update\GoogleUpdate.exe [2011-10-01 03:56]
.
2013-05-02 c:\windows\Tasks\HP Photo Creations Messager.job
- c:\programdata\HP Photo Creations\MessageCheck.exe [2011-02-15 10:11]
.
2013-04-23 c:\windows\Tasks\HPCeeScheduleForMichael.job
- c:\program files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe [2010-09-14 05:15]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrive1]
@="{F241C880-6982-4CE5-8CF7-7085BA96DA5A}"
[HKEY_CLASSES_ROOT\CLSID\{F241C880-6982-4CE5-8CF7-7085BA96DA5A}]
2012-11-01 06:09 244696 ----a-w- c:\users\Michael\AppData\Local\Microsoft\SkyDrive\16.4.6013.0910\amd64\SkyDriveShell64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrive2]
@="{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}"
[HKEY_CLASSES_ROOT\CLSID\{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}]
2012-11-01 06:09 244696 ----a-w- c:\users\Michael\AppData\Local\Microsoft\SkyDrive\16.4.6013.0910\amd64\SkyDriveShell64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrive3]
@="{BBACC218-34EA-4666-9D7A-C78F2274A524}"
[HKEY_CLASSES_ROOT\CLSID\{BBACC218-34EA-4666-9D7A-C78F2274A524}]
2012-11-01 06:09 244696 ----a-w- c:\users\Michael\AppData\Local\Microsoft\SkyDrive\16.4.6013.0910\amd64\SkyDriveShell64.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SynTPEnh"="c:\program files (x86)\Synaptics\SynTP\SynTPEnh.exe" [BU]
"SysTrayApp"="c:\program files\IDT\WDM\sttray64.exe" [2011-11-28 1128448]
.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - LocalService
FontCache
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.yahoo.com/
uLocal Page = c:\windows\system32\blank.htm
mLocal Page = c:\windows\SysWOW64\blank.htm
uInternet Settings,ProxyOverride = *.local
IE: E&xport to Microsoft Excel - c:\progra~2\MICROS~1\Office14\EXCEL.EXE/3000
IE: Se&nd to OneNote - c:\progra~2\MICROS~1\Office14\ONBttnIE.dll/105
FF - ProfilePath - c:\users\Michael\AppData\Roaming\Mozilla\Firefox\Profiles\8c5dcrl5.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.yahoo.com/?ilc=1
.
- - - - ORPHANS REMOVED - - - -
.
Wow6432Node-HKLM-Run-<NO NAME> - (no file)
AddRemove-Adobe Shockwave Player - c:\windows\system32\Adobe\Shockwave 11\uninstaller.exe
AddRemove-Coupon Printer for Windows5.0.0.0 - c:\program files (x86)\Coupons\uninstall.exe
AddRemove-EasyBits Magic Desktop - c:\windows\system32\ezMDUninstall.exe
.
.
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_6_602_180_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_6_602_180_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_6_602_180_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_6_602_180_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_6_602_180.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.11"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_6_602_180.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_6_602_180.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_6_602_180.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Office\Common\Smart Tag\Actions\{B7EFF951-E52F-45CC-9EF7-57124F2177CC}]
@Denied: (A) (Everyone)
"Solution"="{15727DE6-F92D-4E46-ACB4-0E2C58B31A18}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3]
@Denied: (A) (Everyone)
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3\0]
"Key"="ActionsPane3"
"Location"="c:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VSTO\\ActionsPane3.xsd"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Completion time: 2013-05-02 15:31:07
ComboFix-quarantined-files.txt 2013-05-02 20:31
ComboFix2.txt 2013-04-25 00:19
C:\DeQuarantine.txt
.
Pre-Run: 425,846,460,416 bytes free
Post-Run: 425,791,492,096 bytes free
.
- - End Of File - - F1DFD9C14D79903718B10CD83FF9C192

#22
godawgs

Posted 02 May 2013 - 10:44 PM

Teacher

Retired Staff
8,228 posts

Crap. You're not gonna believe this. The ComboFix script restored the files and folders and then ComboFix ran again and quarantined them again. This is my fault. The version of ComboFix that you ran is what is quarantining the files and folders. I should have had you delete that version of ComboFix and download a fresh copy. We need to do it again. I'm sorry.
This time we will see if ComboFix can remove the sysoxkq folder.

1.
Right click the ComboFix program on the desktop and click Delete and confirm to delete it from the desktop.
2.
Delete the CFScript.txt file on the desktop.
3.
Click Here or Here to download a fresh copy of ComboFix. Save it to the desktop.
4.
Close all open browsers and program windows.

Step-1.

Disable Avast

Right- click on the avast! icon in system tray.
Select avast! shields control and there will be options to disable avast for 10 minutes, 1 hour, until the computer is restarted or permanently.
Select Permanently

Step-2.

We need to run a ComboFix script to restore the files and folders that it quarantined.

Posted Image

Run a CFScript

1. Close any open Windows, especially browsers.

IMPORTANT:- Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. This fix will require a reboot to correct so make sure these are turned off and will not turn back on at reboot. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to the link here to see a list of programs that should be disabled.
The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.

DeQuarantine::
C:\Qoobox\Quarantine\C\Windows\PolicyDefinitions
C:\Qoobox\Quarantine\C\Windows\PolicyDefinitions\en-US

Folder::
C:\Users\Michael\AppData\Local\Temp\sysoxkq

Right click inside the Notepad window and click Paste.
Click File then Save AS.
On the Save AS window click Desktop (on the left side of the window).
In the File Name box type CFScript.txt (NOTE: The file name must be typed exactly as shown.)
Click the Save as type down arrow and click All Files (*.*)
Click Save

Note:
1. Do not mouse click ComboFix's window while it's running. That may cause it to stall.
2. Do not "re-run" ComboFix. If you have a problem, reply back for further instructions.
3. If you receive an error "Illegal operation attempted on a registry key that has been marked for deletion." Please restart the computer. That will cure it.
When finished, ComboFix will produce 2 files. A C:\DeQuarantine_log.txt file and a C:\ComboFix.txt file which I will require in your next reply.
NOTE: Don't forget to enable Avast after ComboFix has run.

Step-3

Run OTL again and click the Posted Image

button. Post the OTL.txt log it produces in your next reply.

Step-4.

Things For Your Next Post:
Please post the logs in the order requested. Do Not attach the logs unless I request it.
1. The C:\DeQuarantine_log.txt log
2. The new C:\CombpFix.txt log
3. The new OTL.txt log
4. See if the C:\Users\Michael\AppData\Local\Temp\sysoxkq folder is still there.

#23
RebelSnipe

Posted 03 May 2013 - 07:56 AM

Member

Topic Starter
Member
30 posts

Hey godawgs - I really appreciate your persistance in trying to help me figure this one out!!!

I deleted ComboFix.exe
I did not have a CFScript.txt on my desk top (although we did create one yesterday)

I turned off my wireless internet

I don't have Avast! on my laptop
I disabled AVG for 15 minutes (options were 5, 10, 15 or until reboot)

I dragged the script onto ComboFix. It started running just fine - but then hung - here is what is one the screen:

Scanning for infected files . . .
This typically doesn't take more than 10 minutes
However, scan times for badly infected machines may easily double

Completed Stage_1
Completed Stage_2
Completed Stage_3
Completed Stage_4

Then it just stayed there. I did not click anything, etc. AVG restarted after 15 minutes. It has been 30 minutes and no change. I'll try to leave it until I hear back from you.

Thanks!

#24
RebelSnipe

Posted 03 May 2013 - 09:03 AM

Member

Topic Starter
Member
30 posts

Check that - I had to leave it sit while I attended a meeting and now that I'm back it has progressed to "Completed Stage_33" (It has been running for approx 90 minutes.)

#25
godawgs

Posted 03 May 2013 - 09:26 AM

Teacher

Retired Staff
8,228 posts

I really appreciate your persistance in trying to help me figure this one out!!!

You are welcome.

I don't have Avast! on my laptop
I disabled AVG for 15 minutes (options were 5, 10, 15 or until reboot)

Good Lord my brain must be dying. I knew that. We probably had the problem because ComboFix was trying to reboot the computer and AVG became active again.
Reboot the computer and see if you have the C:\DeQuarantine_log.txt file and C:\ComboFix.txt file from today's run.

#26
RebelSnipe

Posted 03 May 2013 - 09:37 AM

Member

Topic Starter
Member
30 posts

You da' man!

ComboFix did finally complete - after almost 2 hours. It didn't reboot (nor did I.)

C:\Users\Michael\AppData\Local\Temp\sysoxkq - GONE!! yea!!

Unfortunately, IE still doesn't work.

Here are the logs:

C:\Qoobox\Quarantine\C\Windows\PolicyDefinitions\DeviceRedirection.admx -> C:\Windows\PolicyDefinitions\DeviceRedirection.admx
C:\Qoobox\Quarantine\C\Windows\PolicyDefinitions\EnhancedStorage.admx -> C:\Windows\PolicyDefinitions\EnhancedStorage.admx
C:\Qoobox\Quarantine\C\Windows\PolicyDefinitions\inetres.admx -> C:\Windows\PolicyDefinitions\inetres.admx
C:\Qoobox\Quarantine\C\Windows\PolicyDefinitions\NCSI.admx -> C:\Windows\PolicyDefinitions\NCSI.admx
C:\Qoobox\Quarantine\C\Windows\PolicyDefinitions\RacWmiProv.admx -> C:\Windows\PolicyDefinitions\RacWmiProv.admx
C:\Qoobox\Quarantine\C\Windows\PolicyDefinitions\ReAgent.admx -> C:\Windows\PolicyDefinitions\ReAgent.admx
C:\Qoobox\Quarantine\C\Windows\PolicyDefinitions\sdiageng.admx -> C:\Windows\PolicyDefinitions\sdiageng.admx
C:\Qoobox\Quarantine\C\Windows\PolicyDefinitions\sdiagschd.admx -> C:\Windows\PolicyDefinitions\sdiagschd.admx
C:\Qoobox\Quarantine\C\Windows\PolicyDefinitions\Search.admx -> C:\Windows\PolicyDefinitions\Search.admx
C:\Qoobox\Quarantine\C\Windows\PolicyDefinitions\WindowsMediaDRM.admx -> C:\Windows\PolicyDefinitions\WindowsMediaDRM.admx
C:\Qoobox\Quarantine\C\Windows\PolicyDefinitions\WindowsMediaPlayer.admx -> C:\Windows\PolicyDefinitions\WindowsMediaPlayer.admx
C:\Qoobox\Quarantine\C\Windows\PolicyDefinitions\en-US\DeviceRedirection.adml -> C:\Windows\PolicyDefinitions\en-US\DeviceRedirection.adml
C:\Qoobox\Quarantine\C\Windows\PolicyDefinitions\en-US\EnhancedStorage.adml -> C:\Windows\PolicyDefinitions\en-US\EnhancedStorage.adml
C:\Qoobox\Quarantine\C\Windows\PolicyDefinitions\en-US\InetRes.adml -> C:\Windows\PolicyDefinitions\en-US\InetRes.adml
C:\Qoobox\Quarantine\C\Windows\PolicyDefinitions\en-US\NCSI.adml -> C:\Windows\PolicyDefinitions\en-US\NCSI.adml
C:\Qoobox\Quarantine\C\Windows\PolicyDefinitions\en-US\RacWmiProv.adml -> C:\Windows\PolicyDefinitions\en-US\RacWmiProv.adml
C:\Qoobox\Quarantine\C\Windows\PolicyDefinitions\en-US\ReAgent.adml -> C:\Windows\PolicyDefinitions\en-US\ReAgent.adml
C:\Qoobox\Quarantine\C\Windows\PolicyDefinitions\en-US\sdiageng.adml -> C:\Windows\PolicyDefinitions\en-US\sdiageng.adml
C:\Qoobox\Quarantine\C\Windows\PolicyDefinitions\en-US\sdiagschd.adml -> C:\Windows\PolicyDefinitions\en-US\sdiagschd.adml
C:\Qoobox\Quarantine\C\Windows\PolicyDefinitions\en-US\Search.adml -> C:\Windows\PolicyDefinitions\en-US\Search.adml
C:\Qoobox\Quarantine\C\Windows\PolicyDefinitions\en-US\WindowsMediaDRM.adml -> C:\Windows\PolicyDefinitions\en-US\WindowsMediaDRM.adml
C:\Qoobox\Quarantine\C\Windows\PolicyDefinitions\en-US\WindowsMediaPlayer.adml -> C:\Windows\PolicyDefinitions\en-US\WindowsMediaPlayer.adml
22 File(s) copied

ComboFix 13-05-01.03 - Michael 05/03/2013 8:34.3.4 - x64
Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.5611.4053 [GMT -5:00]
Running from: c:\users\Michael\Desktop\ComboFix.exe
Command switches used :: c:\users\Michael\Desktop\CFScript.txt
AV: AVG AntiVirus Free Edition 2013 *Disabled/Updated* {0E9420C4-06B3-7FA0-3AB1-6E49CB52ECD9}
SP: AVG AntiVirus Free Edition 2013 *Disabled/Updated* {B5F5C120-2089-702E-0001-553BB0D5A664}
SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\users\Michael\AppData\Local\Temp\sysoxkq
.
.
((((((((((((((((((((((((( Files Created from 2013-04-03 to 2013-05-03 )))))))))))))))))))))))))))))))
.
.
2013-05-03 15:08 . 2013-05-03 15:08 -------- d-----w- c:\users\Default\AppData\Local\temp
2013-05-03 15:08 . 2013-05-03 15:08 -------- d-----w- c:\users\Administrator\AppData\Local\temp
2013-05-03 13:34 . 2013-05-03 13:34 -------- d-----w- c:\windows\PolicyDefinitions
2013-05-02 20:43 . 2013-05-02 20:43 -------- d-----w- c:\users\Michael\AppData\Roaming\AVG2013
2013-05-02 20:39 . 2013-05-02 20:39 -------- d-----w- c:\users\Michael\AppData\Local\AVG SafeGuard toolbar
2013-05-02 20:39 . 2013-05-02 20:39 -------- d-----w- c:\program files (x86)\AVG SafeGuard toolbar
2013-05-02 20:37 . 2013-05-02 20:37 -------- d-----w- C:\$AVG
2013-05-02 20:37 . 2013-05-02 20:39 -------- d-----w- c:\programdata\AVG2013
2013-05-02 20:36 . 2013-05-02 20:36 -------- d-----w- c:\program files (x86)\AVG
2013-05-02 20:35 . 2013-05-02 20:47 -------- d-----w- c:\users\Michael\AppData\Local\Avg2013
2013-05-02 20:35 . 2013-05-02 20:35 -------- d-----w- c:\programdata\AVG2012
2013-04-26 19:00 . 2013-04-26 19:00 -------- d-----w- c:\program files (x86)\ESET
2013-04-25 19:49 . 2013-04-25 19:49 -------- d-----w- C:\Rooter$
2013-04-25 19:44 . 2013-04-25 19:44 -------- d-----w- c:\users\Michael\AppData\Local\ElevatedDiagnostics
2013-04-24 23:53 . 2013-04-24 23:53 -------- d-----w- c:\windows\ERUNT
2013-04-24 23:52 . 2013-04-24 23:52 -------- d-----w- C:\JRT
2013-04-24 18:59 . 2013-04-24 18:59 -------- d-----w- c:\program files (x86)\Common Files\Java
2013-04-24 18:59 . 2013-04-24 18:58 866720 ----a-w- c:\windows\SysWow64\npDeployJava1.dll
2013-04-24 18:59 . 2013-04-24 18:58 95648 ----a-w- c:\windows\SysWow64\WindowsAccessBridge-32.dll
2013-04-24 18:58 . 2013-04-24 18:58 -------- d-----w- c:\programdata\McAfee
2013-04-24 04:45 . 2013-04-24 04:45 121 ----a-w- c:\windows\DeleteOnReboot.bat
2013-04-24 04:39 . 2013-04-24 04:39 -------- d-----w- c:\users\Michael\AppData\Roaming\Malwarebytes
2013-04-24 04:39 . 2013-04-24 04:39 -------- d-----w- c:\programdata\Malwarebytes
2013-04-24 04:39 . 2013-04-24 04:39 -------- d-----w- c:\program files (x86)\Malwarebytes' Anti-Malware
2013-04-24 04:39 . 2013-04-04 19:50 25928 ----a-w- c:\windows\system32\drivers\mbam.sys
2013-04-24 04:38 . 2013-04-24 04:38 -------- d-----w- c:\users\Michael\AppData\Local\Programs
2013-04-24 04:34 . 2013-04-12 14:45 1656680 ----a-w- c:\windows\system32\drivers\ntfs.sys
2013-04-20 04:06 . 2013-04-23 03:37 -------- d-----w- c:\users\TEMP
2013-04-10 19:34 . 2013-02-15 06:06 3717632 ----a-w- c:\windows\system32\mstscax.dll
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-05-02 20:39 . 2012-10-01 01:23 37720 ----a-w- c:\windows\system32\drivers\avgtpx64.sys
2013-04-24 18:58 . 2011-04-29 00:39 788896 ----a-w- c:\windows\SysWow64\deployJava1.dll
2013-03-20 17:03 . 2013-03-20 17:03 226304 ----a-w- c:\windows\system32\elshyph.dll
2013-03-20 17:03 . 2013-03-20 17:03 185344 ----a-w- c:\windows\SysWow64\elshyph.dll
2013-03-20 17:03 . 2013-03-20 17:03 158720 ----a-w- c:\windows\SysWow64\msls31.dll
2013-03-20 17:03 . 2013-03-20 17:03 1054720 ----a-w- c:\windows\system32\MsSpellCheckingFacility.exe
2013-03-20 17:03 . 2013-03-20 17:03 719360 ----a-w- c:\windows\SysWow64\mshtmlmedia.dll
2013-03-20 17:03 . 2013-03-20 17:03 523264 ----a-w- c:\windows\SysWow64\vbscript.dll
2013-03-20 17:03 . 2013-03-20 17:03 150528 ----a-w- c:\windows\SysWow64\iexpress.exe
2013-03-20 17:03 . 2013-03-20 17:03 138752 ----a-w- c:\windows\SysWow64\wextract.exe
2013-03-20 17:03 . 2013-03-20 17:03 73728 ----a-w- c:\windows\SysWow64\SetIEInstalledDate.exe
2013-03-20 17:03 . 2013-03-20 17:03 48640 ----a-w- c:\windows\SysWow64\mshtmler.dll
2013-03-20 17:03 . 2013-03-20 17:03 38400 ----a-w- c:\windows\SysWow64\imgutil.dll
2013-03-20 17:03 . 2013-03-20 17:03 137216 ----a-w- c:\windows\SysWow64\ieUnatt.exe
2013-03-20 17:03 . 2013-03-20 17:03 12800 ----a-w- c:\windows\SysWow64\mshta.exe
2013-03-20 17:03 . 2013-03-20 17:03 110592 ----a-w- c:\windows\SysWow64\IEAdvpack.dll
2013-03-20 17:03 . 2013-03-20 17:03 61952 ----a-w- c:\windows\SysWow64\tdc.ocx
2013-03-20 17:03 . 2013-03-20 17:03 361984 ----a-w- c:\windows\SysWow64\html.iec
2013-03-20 17:03 . 2013-03-20 17:03 23040 ----a-w- c:\windows\SysWow64\licmgr10.dll
2013-03-20 17:03 . 2013-03-20 17:03 1441280 ----a-w- c:\windows\SysWow64\inetcpl.cpl
2013-03-20 17:03 . 2013-03-20 17:03 81408 ----a-w- c:\windows\system32\icardie.dll
2013-03-20 17:03 . 2013-03-20 17:03 762368 ----a-w- c:\windows\system32\ieapfltr.dll
2013-03-20 17:03 . 2013-03-20 17:03 452096 ----a-w- c:\windows\system32\dxtmsft.dll
2013-03-20 17:03 . 2013-03-20 17:03 441856 ----a-w- c:\windows\system32\html.iec
2013-03-20 17:03 . 2013-03-20 17:03 281600 ----a-w- c:\windows\system32\dxtrans.dll
2013-03-20 17:03 . 2013-03-20 17:03 216064 ----a-w- c:\windows\system32\msls31.dll
2013-03-20 17:03 . 2013-03-20 17:03 197120 ----a-w- c:\windows\system32\msrating.dll
2013-03-20 17:03 . 2013-03-20 17:03 1400416 ----a-w- c:\windows\system32\ieapfltr.dat
2013-03-20 17:03 . 2013-03-20 17:03 97280 ----a-w- c:\windows\system32\mshtmled.dll
2013-03-20 17:03 . 2013-03-20 17:03 905728 ----a-w- c:\windows\system32\mshtmlmedia.dll
2013-03-20 17:03 . 2013-03-20 17:03 27648 ----a-w- c:\windows\system32\licmgr10.dll
2013-03-20 17:03 . 2013-03-20 17:03 270848 ----a-w- c:\windows\system32\iedkcs32.dll
2013-03-20 17:03 . 2013-03-20 17:03 247296 ----a-w- c:\windows\system32\webcheck.dll
2013-03-20 17:03 . 2013-03-20 17:03 235008 ----a-w- c:\windows\system32\url.dll
2013-03-20 17:03 . 2013-03-20 17:03 167424 ----a-w- c:\windows\system32\iexpress.exe
2013-03-20 17:03 . 2013-03-20 17:03 1509376 ----a-w- c:\windows\system32\inetcpl.cpl
2013-03-20 17:03 . 2013-03-20 17:03 144896 ----a-w- c:\windows\system32\wextract.exe
2013-03-20 17:03 . 2013-03-20 17:03 102912 ----a-w- c:\windows\system32\inseng.dll
2013-03-20 17:03 . 2013-03-20 17:03 599552 ----a-w- c:\windows\system32\vbscript.dll
2013-03-20 17:03 . 2013-03-20 17:03 173568 ----a-w- c:\windows\system32\ieUnatt.exe
2013-03-20 17:03 . 2013-03-20 17:03 149504 ----a-w- c:\windows\system32\occache.dll
2013-03-20 17:03 . 2013-03-20 17:03 92160 ----a-w- c:\windows\system32\SetIEInstalledDate.exe
2013-03-20 17:03 . 2013-03-20 17:03 62976 ----a-w- c:\windows\system32\pngfilt.dll
2013-03-20 17:03 . 2013-03-20 17:03 52224 ----a-w- c:\windows\system32\msfeedsbs.dll
2013-03-20 17:03 . 2013-03-20 17:03 51200 ----a-w- c:\windows\system32\imgutil.dll
2013-03-20 17:03 . 2013-03-20 17:03 48640 ----a-w- c:\windows\system32\mshtmler.dll
2013-03-20 17:03 . 2013-03-20 17:03 13824 ----a-w- c:\windows\system32\mshta.exe
2013-03-20 17:03 . 2013-03-20 17:03 136192 ----a-w- c:\windows\system32\iepeers.dll
2013-03-20 17:03 . 2013-03-20 17:03 135680 ----a-w- c:\windows\system32\IEAdvpack.dll
2013-03-20 17:03 . 2013-03-20 17:03 12800 ----a-w- c:\windows\system32\msfeedssync.exe
2013-03-20 17:03 . 2013-03-20 17:03 77312 ----a-w- c:\windows\system32\tdc.ocx
2013-03-13 03:24 . 2012-04-04 19:45 693976 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe
2013-03-13 03:24 . 2011-08-29 16:50 73432 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2013-02-27 04:40 . 2013-02-27 04:40 246072 ----a-w- c:\windows\system32\drivers\avgidsdrivera.sys
2013-02-14 08:52 . 2013-02-14 08:52 239416 ----a-w- c:\windows\system32\drivers\avgtdia.sys
2013-02-12 05:45 . 2013-03-13 22:05 135168 ----a-w- c:\windows\apppatch\AppPatch64\AcXtrnal.dll
2013-02-12 05:45 . 2013-03-13 22:05 308736 ----a-w- c:\windows\apppatch\AppPatch64\AcGenral.dll
2013-02-12 05:45 . 2013-03-13 22:05 350208 ----a-w- c:\windows\apppatch\AppPatch64\AcLayers.dll
2013-02-12 05:45 . 2013-03-13 22:05 111104 ----a-w- c:\windows\apppatch\AppPatch64\acspecfc.dll
2013-02-12 04:48 . 2013-03-13 22:05 474112 ----a-w- c:\windows\apppatch\AcSpecfc.dll
2013-02-12 04:48 . 2013-03-13 22:05 2176512 ----a-w- c:\windows\apppatch\AcGenral.dll
2013-02-12 04:12 . 2013-03-20 20:37 19968 ----a-w- c:\windows\system32\drivers\usb8023.sys
2013-02-08 09:37 . 2013-02-08 09:37 116536 ----a-w- c:\windows\system32\drivers\avgmfx64.sys
2013-02-08 09:37 . 2013-02-08 09:37 311096 ----a-w- c:\windows\system32\drivers\avgloga.sys
2013-02-08 09:37 . 2013-02-08 09:37 71480 ----a-w- c:\windows\system32\drivers\avgidsha.sys
2013-02-08 09:37 . 2013-02-08 09:37 206136 ----a-w- c:\windows\system32\drivers\avgldx64.sys
2013-02-08 09:37 . 2013-02-08 09:37 45880 ----a-w- c:\windows\system32\drivers\avgrkx64.sys
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\~\Browser Helper Objects\{95B7759C-8C7F-4BF1-B163-73684A933233}]
2013-05-02 20:39 1883824 ----a-w- c:\program files (x86)\AVG SafeGuard toolbar\14.0.0.14\AVG SafeGuard toolbar_toolbar.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar]
"{95B7759C-8C7F-4BF1-B163-73684A933233}"= "c:\program files (x86)\AVG SafeGuard toolbar\14.0.0.14\AVG SafeGuard toolbar_toolbar.dll" [2013-05-02 1883824]
.
[HKEY_CLASSES_ROOT\clsid\{95b7759c-8c7f-4bf1-b163-73684a933233}]
[HKEY_CLASSES_ROOT\AVG SafeGuard toolbar.PugiObj.1]
[HKEY_CLASSES_ROOT\AVG SafeGuard toolbar.PugiObj]
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrive1]
@="{F241C880-6982-4CE5-8CF7-7085BA96DA5A}"
[HKEY_CLASSES_ROOT\CLSID\{F241C880-6982-4CE5-8CF7-7085BA96DA5A}]
2012-11-01 06:09 220632 ----a-w- c:\users\Michael\AppData\Local\Microsoft\SkyDrive\16.4.6013.0910\SkyDriveShell.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrive2]
@="{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}"
[HKEY_CLASSES_ROOT\CLSID\{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}]
2012-11-01 06:09 220632 ----a-w- c:\users\Michael\AppData\Local\Microsoft\SkyDrive\16.4.6013.0910\SkyDriveShell.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrive3]
@="{BBACC218-34EA-4666-9D7A-C78F2274A524}"
[HKEY_CLASSES_ROOT\CLSID\{BBACC218-34EA-4666-9D7A-C78F2274A524}]
2012-11-01 06:09 220632 ----a-w- c:\users\Michael\AppData\Local\Microsoft\SkyDrive\16.4.6013.0910\SkyDriveShell.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2010-11-21 1475584]
"HP Photosmart 6510 series (NET)"="c:\program files\HP\HP Photosmart 6510 series\Bin\ScanToPCActivationApp.exe" [2011-09-16 2676584]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"StartCCC"="c:\program files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2011-04-02 336384]
"Easybits Recovery"="c:\program files (x86)\EasyBits For Kids\ezRecover.exe" [2011-03-16 61112]
"HPConnectionManager"="c:\program files (x86)\Hewlett-Packard\HP Connection Manager\HPCMDelayStart.exe" [2011-05-23 103992]
"APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2013-01-28 59720]
"HP Quick Launch"="c:\program files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe" [2011-07-11 574008]
"HPOSD"="c:\program files (x86)\Hewlett-Packard\HP On Screen Display\HPOSD.exe" [2011-08-19 379960]
"RemoteControl10"="c:\program files (x86)\CyberLink\PowerDVD10\PDVD10Serv.exe" [2011-03-30 87336]
"BDRegion"="c:\program files (x86)\Cyberlink\Shared files\brs.exe" [2011-12-12 75048]
"QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" [2012-10-25 421888]
"iTunesHelper"="c:\program files (x86)\iTunes\iTunesHelper.exe" [2013-02-20 152392]
"HP Software Update"="c:\program files (x86)\Hp\HP Software Update\HPWuSchd2.exe" [2011-10-28 49208]
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2013-03-12 253816]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-12-18 946352]
"AVG_UI"="c:\program files (x86)\AVG\AVG2013\avgui.exe" [2013-03-13 4394032]
"vProt"="c:\program files (x86)\AVG SafeGuard toolbar\vprot.exe" [2013-05-02 1101488]
.
c:\users\Michael\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
OneNote 2010 Screen Clipper and Launcher.lnk - c:\program files (x86)\Microsoft Office\Office14\ONENOTEM.EXE [2013-1-8 228448]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"EnableShellExecuteHooks"= 1 (0x1)
.
[hkey_local_machine\software\Wow6432Node\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]
"aux2"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk *\0 /sync /restart\0 /sync /restart\0 /sync /restart\0 /sync /restart\0 /sync /restart\0 /sync /restart\0 /sync /restart\0 /sync /restart
.
R2 CLKMSVC10_38F51D56;CyberLink Product - 2011/12/12 15:50;c:\program files (x86)\CyberLink\PowerDVD10\NavFilter\kmsvc.exe [2011-02-25 241648]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe [2012-07-13 160944]
R3 androidusb;ADB Interface Driver;c:\windows\system32\Drivers\androidusb.sys [2010-04-29 32768]
R3 BBSvc;Bing Bar Update Service;c:\program files (x86)\Microsoft\BingBar\BBSvc.EXE [2011-03-02 183560]
R3 BVRPMPR5a64;BVRPMPR5a64 NDIS Protocol Driver;c:\windows\system32\drivers\BVRPMPR5a64.SYS [2010-06-16 35840]
R3 GamesAppService;GamesAppService;c:\program files (x86)\WildTangent Games\App\GamesAppService.exe [2010-10-12 206072]
R3 SrvHsfHDA;SrvHsfHDA;c:\windows\system32\DRIVERS\VSTAZL6.SYS [2009-06-10 292864]
R3 SrvHsfV92;SrvHsfV92;c:\windows\system32\DRIVERS\VSTDPV6.SYS [2009-06-10 1485312]
R3 SrvHsfWinac;SrvHsfWinac;c:\windows\system32\DRIVERS\VSTCNXT6.SYS [2009-06-10 740864]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-21 59392]
R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys [2010-11-21 31232]
R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys [2012-12-13 54784]
R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [2011-08-15 1255736]
S0 amd_sata;amd_sata;c:\windows\system32\DRIVERS\amd_sata.sys [2011-03-04 78976]
S0 amd_xata;amd_xata;c:\windows\system32\DRIVERS\amd_xata.sys [2011-03-04 38528]
S0 AVGIDSHA;AVGIDSHA;c:\windows\system32\DRIVERS\avgidsha.sys [2013-02-08 71480]
S0 Avgloga;AVG Logging Driver;c:\windows\system32\DRIVERS\avgloga.sys [2013-02-08 311096]
S0 Avgmfx64;AVG Mini-Filter Resident Anti-Virus Shield;c:\windows\system32\DRIVERS\avgmfx64.sys [2013-02-08 116536]
S0 Avgrkx64;AVG Anti-Rootkit Driver;c:\windows\system32\DRIVERS\avgrkx64.sys [2013-02-08 45880]
S1 AVGIDSDriver;AVGIDSDriver;c:\windows\system32\DRIVERS\avgidsdrivera.sys [2013-02-27 246072]
S1 Avgldx64;AVG AVI Loader Driver;c:\windows\system32\DRIVERS\avgldx64.sys [2013-02-08 206136]
S1 Avgtdia;AVG TDI Driver;c:\windows\system32\DRIVERS\avgtdia.sys [2013-02-14 239416]
S1 avgtp;avgtp;c:\windows\system32\drivers\avgtpx64.sys [2013-05-02 37720]
S2 AESTFilters;Andrea ST Filters Service;c:\program files\IDT\WDM\AESTSr64.exe [2011-11-28 89600]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [2011-04-02 204288]
S2 AMD FUEL Service;AMD FUEL Service;c:\program files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [2011-04-02 365568]
S2 AVGIDSAgent;AVGIDSAgent;c:\program files (x86)\AVG\AVG2013\avgidsagent.exe [2013-02-28 4937264]
S2 avgwd;AVG WatchDog;c:\program files (x86)\AVG\AVG2013\avgwdsvc.exe [2013-02-19 282624]
S2 ezSharedSvc;Easybits Services for Windows;c:\windows\System32\ezSharedSvcHost.exe [x]
S2 FPLService;TrueSuiteService;c:\program files (x86)\HP SimplePass 2011\TrueSuiteService.exe [2011-02-18 265544]
S2 HPClientSvc;HP Client Services;c:\program files\Hewlett-Packard\HP Client Services\HPClientServices.exe [2010-10-11 346168]
S2 HPDrvMntSvc.exe;HP Quick Synchronization Service;c:\program files (x86)\Hewlett-Packard\Shared\HPDrvMntSvc.exe [2011-09-01 227896]
S2 hpsrv;HP Service;c:\windows\system32\Hpservice.exe [2011-05-27 30520]
S2 HPWMISVC;HPWMISVC;c:\program files (x86)\Hewlett-Packard\HP Quick Launch\HPWMISVC.exe [2011-07-11 26680]
S2 IconMan_R;IconMan_R;c:\program files (x86)\Realtek\Realtek PCIE Card Reader\RIconMan.exe [2011-03-08 2375168]
S2 RoxioNow Service;RoxioNow Service;c:\program files (x86)\Roxio\RoxioNow Player\RNowSvc.exe [2010-11-26 399344]
S2 vToolbarUpdater14.0.1;vToolbarUpdater14.0.1;c:\program files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\14.0.1\ToolbarUpdater.exe [2013-05-02 945328]
S2 vToolbarUpdater14.2.0;vToolbarUpdater14.2.0;c:\program files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\14.2.0\ToolbarUpdater.exe [2013-02-18 968880]
S3 amdhub30;AMD USB 3.0 Hub Driver;c:\windows\system32\DRIVERS\amdhub30.sys [2011-03-18 87168]
S3 amdiox64;AMD IO Driver;c:\windows\system32\DRIVERS\amdiox64.sys [2010-02-18 46136]
S3 amdxhc;AMD USB 3.0 Host Controller Driver;c:\windows\system32\DRIVERS\amdxhc.sys [2011-03-18 188544]
S3 AtiHDAudioService;ATI Function Driver for HD Audio Service;c:\windows\system32\drivers\AtihdW76.sys [2010-11-17 115216]
S3 clwvd;CyberLink WebCam Virtual Driver;c:\windows\system32\DRIVERS\clwvd.sys [2010-07-28 31088]
S3 hpCMSrv;HP Connection Manager 4 Service;c:\program files (x86)\Hewlett-Packard\HP Connection Manager\hpCMSrv.exe [2011-05-23 1098296]
S3 netr28x;Ralink 802.11n Extensible Wireless Driver;c:\windows\system32\DRIVERS\netr28x.sys [2011-07-19 1492992]
S3 RSPCIESTOR;Realtek PCIE CardReader Driver;c:\windows\system32\DRIVERS\RtsPStor.sys [2011-03-25 337512]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [2011-02-17 428136]
S3 usbfilter;AMD USB Filter Driver;c:\windows\system32\DRIVERS\usbfilter.sys [2010-12-16 47232]
.
.
--- Other Services/Drivers In Memory ---
.
*NewlyCreated* - AVGIDSHA
*Deregistered* - CLKMDRV10_38F51D56
.
Contents of the 'Scheduled Tasks' folder
.
2013-05-03 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-04 03:24]
.
2013-05-02 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-12-12 22:14]
.
2013-05-03 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-12-12 22:14]
.
2013-05-03 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-695660584-876410207-1421700361-1001Core.job
- c:\users\Michael\AppData\Local\Google\Update\GoogleUpdate.exe [2011-10-01 03:56]
.
2013-05-03 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-695660584-876410207-1421700361-1001UA.job
- c:\users\Michael\AppData\Local\Google\Update\GoogleUpdate.exe [2011-10-01 03:56]
.
2013-05-03 c:\windows\Tasks\HP Photo Creations Messager.job
- c:\programdata\HP Photo Creations\MessageCheck.exe [2011-02-15 10:11]
.
2013-04-23 c:\windows\Tasks\HPCeeScheduleForMichael.job
- c:\program files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe [2010-09-14 05:15]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrive1]
@="{F241C880-6982-4CE5-8CF7-7085BA96DA5A}"
[HKEY_CLASSES_ROOT\CLSID\{F241C880-6982-4CE5-8CF7-7085BA96DA5A}]
2012-11-01 06:09 244696 ----a-w- c:\users\Michael\AppData\Local\Microsoft\SkyDrive\16.4.6013.0910\amd64\SkyDriveShell64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrive2]
@="{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}"
[HKEY_CLASSES_ROOT\CLSID\{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}]
2012-11-01 06:09 244696 ----a-w- c:\users\Michael\AppData\Local\Microsoft\SkyDrive\16.4.6013.0910\amd64\SkyDriveShell64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrive3]
@="{BBACC218-34EA-4666-9D7A-C78F2274A524}"
[HKEY_CLASSES_ROOT\CLSID\{BBACC218-34EA-4666-9D7A-C78F2274A524}]
2012-11-01 06:09 244696 ----a-w- c:\users\Michael\AppData\Local\Microsoft\SkyDrive\16.4.6013.0910\amd64\SkyDriveShell64.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SynTPEnh"="c:\program files (x86)\Synaptics\SynTP\SynTPEnh.exe" [BU]
"SysTrayApp"="c:\program files\IDT\WDM\sttray64.exe" [2011-11-28 1128448]
.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - LocalService
FontCache
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.yahoo.com/
uLocal Page = c:\windows\system32\blank.htm
mLocal Page = c:\windows\SysWOW64\blank.htm
uInternet Settings,ProxyOverride = *.local
IE: E&xport to Microsoft Excel - c:\progra~2\MICROS~1\Office14\EXCEL.EXE/3000
IE: Se&nd to OneNote - c:\progra~2\MICROS~1\Office14\ONBttnIE.dll/105
TCP: DhcpNameServer = 75.75.76.76 75.75.75.75 192.168.1.1
Handler: viprotocol - {B658800C-F66E-4EF3-AB85-6C0C227862A9} - c:\program files (x86)\Common Files\AVG Secure Search\ViProtocolInstaller\14.0.1\ViProtocol.dll
FF - ProfilePath - c:\users\Michael\AppData\Roaming\Mozilla\Firefox\Profiles\8c5dcrl5.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.yahoo.com/?ilc=1
.
- - - - ORPHANS REMOVED - - - -
.
Wow6432Node-HKLM-Run-<NO NAME> - (no file)
AddRemove-Adobe Shockwave Player - c:\windows\system32\Adobe\Shockwave 11\uninstaller.exe
AddRemove-Coupon Printer for Windows5.0.0.0 - c:\program files (x86)\Coupons\uninstall.exe
AddRemove-EasyBits Magic Desktop - c:\windows\system32\ezMDUninstall.exe
.
.
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_6_602_180_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_6_602_180_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_6_602_180_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_6_602_180_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_6_602_180.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.11"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_6_602_180.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_6_602_180.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_6_602_180.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Office\Common\Smart Tag\Actions\{B7EFF951-E52F-45CC-9EF7-57124F2177CC}]
@Denied: (A) (Everyone)
"Solution"="{15727DE6-F92D-4E46-ACB4-0E2C58B31A18}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3]
@Denied: (A) (Everyone)
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3\0]
"Key"="ActionsPane3"
"Location"="c:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VSTO\\ActionsPane3.xsd"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Completion time: 2013-05-03 10:11:09
ComboFix-quarantined-files.txt 2013-05-03 15:11
ComboFix2.txt 2013-05-02 20:31
ComboFix3.txt 2013-04-25 00:19
C:\DeQuarantine.txt
.
Pre-Run: 423,811,231,744 bytes free
Post-Run: 423,518,109,696 bytes free
.
- - End Of File - - FDEC6DF37780E6334C76D09757F10794

OTL logfile created on: 5/3/2013 10:13:40 AM - Run 4
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\Michael\Desktop
64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.10.9200.16540)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

5.48 Gb Total Physical Memory | 3.59 Gb Available Physical Memory | 65.56% Memory free
10.96 Gb Paging File | 9.02 Gb Available in Paging File | 82.30% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 581.29 Gb Total Space | 394.52 Gb Free Space | 67.87% Space Free | Partition Type: NTFS
Drive D: | 14.59 Gb Total Space | 1.62 Gb Free Space | 11.11% Space Free | Partition Type: NTFS
Drive F: | 99.34 Mb Total Space | 89.20 Mb Free Space | 89.79% Space Free | Partition Type: FAT32

Computer Name: MICHAEL-HP | User Name: Michael | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan | Include 64bit Scans
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2013/05/02 15:39:11 | 001,101,488 | ---- | M] () -- C:\Program Files (x86)\AVG SafeGuard toolbar\vprot.exe
PRC - [2013/05/02 15:39:11 | 000,945,328 | ---- | M] () -- C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\14.0.1\ToolbarUpdater.exe
PRC - [2013/04/24 02:50:28 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Michael\Desktop\OTL.exe
PRC - [2013/03/13 17:15:00 | 004,394,032 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files (x86)\AVG\AVG2013\avgui.exe
PRC - [2013/02/27 23:42:12 | 004,937,264 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files (x86)\AVG\AVG2013\avgidsagent.exe
PRC - [2013/02/19 04:02:02 | 000,282,624 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files (x86)\AVG\AVG2013\avgwdsvc.exe
PRC - [2013/02/19 04:01:14 | 000,328,752 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files (x86)\AVG\AVG2013\avgcfgex.exe
PRC - [2013/02/18 14:05:11 | 000,968,880 | ---- | M] () -- C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\14.2.0\ToolbarUpdater.exe
PRC - [2012/12/18 14:08:28 | 000,065,192 | ---- | M] (Adobe Systems Incorporated) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
PRC - [2011/12/12 16:43:20 | 000,075,048 | ---- | M] (cyberlink) -- C:\Program Files (x86)\CyberLink\Shared files\brs.exe
PRC - [2011/09/01 18:06:50 | 000,227,896 | ---- | M] (Hewlett-Packard Company) -- C:\Program Files (x86)\Hewlett-Packard\Shared\HPDrvMntSvc.exe
PRC - [2011/08/19 15:48:44 | 000,379,960 | ---- | M] (Hewlett-Packard Development Company, L.P.) -- C:\Program Files (x86)\Hewlett-Packard\HP On Screen Display\HPOSD.exe
PRC - [2011/07/11 15:04:44 | 000,574,008 | ---- | M] (Hewlett-Packard Development Company, L.P.) -- C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe
PRC - [2011/07/11 15:04:44 | 000,026,680 | ---- | M] (Hewlett-Packard Development Company, L.P.) -- C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPWMISVC.exe
PRC - [2011/07/06 20:13:48 | 000,136,488 | ---- | M] (CyberLink) -- C:\Program Files (x86)\CyberLink\YouCam\YCMMirage.exe
PRC - [2011/05/23 11:45:58 | 001,098,296 | ---- | M] (Hewlett-Packard Development Company L.P.) -- C:\Program Files (x86)\Hewlett-Packard\HP Connection Manager\hpCMSrv.exe
PRC - [2011/03/30 15:01:10 | 000,087,336 | ---- | M] (CyberLink Corp.) -- C:\Program Files (x86)\CyberLink\PowerDVD10\PDVD10Serv.exe
PRC - [2011/02/25 12:46:22 | 000,249,648 | ---- | M] (Microsoft Corporation) -- C:\Program Files (x86)\Microsoft\BingBar\SeaPort.EXE
PRC - [2011/02/18 00:48:24 | 000,265,544 | ---- | M] (HP) -- C:\Program Files (x86)\HP SimplePass 2011\TrueSuiteService.exe
PRC - [2010/11/26 09:09:12 | 000,399,344 | ---- | M] (Roxio) -- C:\Program Files (x86)\Roxio\RoxioNow Player\RNowSvc.exe
PRC - [2010/04/23 14:00:00 | 000,514,232 | ---- | M] (EasyBits Software AS) -- C:\Windows\SysWOW64\ezSharedSvcHost.exe
PRC - [2010/04/23 14:00:00 | 000,514,232 | ---- | M] (EasyBits Software AS) -- C:\Windows\SysWOW64\ezSharedSvcHost.exe

========== Modules (No Company Name) ==========

MOD - [2013/05/02 15:39:11 | 001,101,488 | ---- | M] () -- C:\Program Files (x86)\AVG SafeGuard toolbar\vprot.exe
MOD - [2013/05/02 15:39:11 | 000,156,848 | ---- | M] () -- C:\Program Files (x86)\Common Files\AVG Secure Search\SiteSafetyInstaller\14.0.1\SiteSafety.dll
MOD - [2011/06/24 22:56:36 | 000,087,328 | ---- | M] () -- C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll
MOD - [2011/06/24 22:56:14 | 001,241,888 | ---- | M] () -- C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll

========== Services (SafeList) ==========

SRV:64bit: - [2011/11/28 17:52:01 | 000,301,568 | ---- | M] (IDT, Inc.) [Auto | Running] -- C:\Program Files\IDT\WDM\stacsv64.exe -- (STacSV)
SRV:64bit: - [2011/11/28 17:52:00 | 000,089,600 | ---- | M] (Andrea Electronics Corporation) [Auto | Running] -- C:\Program Files\IDT\WDM\AESTSr64.exe -- (AESTFilters)
SRV:64bit: - [2011/05/27 12:20:12 | 000,030,520 | ---- | M] (Hewlett-Packard Company) [Auto | Running] -- C:\Windows\SysNative\hpservice.exe -- (hpsrv)
SRV:64bit: - [2011/04/02 01:54:06 | 000,204,288 | ---- | M] (AMD) [Auto | Running] -- C:\Windows\SysNative\atiesrxx.exe -- (AMD External Events Utility)
SRV:64bit: - [2011/04/02 01:06:22 | 000,365,568 | ---- | M] (Advanced Micro Devices, Inc.) [Auto | Running] -- C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe -- (AMD FUEL Service)
SRV:64bit: - [2010/10/11 04:48:14 | 000,346,168 | ---- | M] (Hewlett-Packard Company) [Auto | Running] -- C:\Program Files\Hewlett-Packard\HP Client Services\HPClientServices.exe -- (HPClientSvc)
SRV:64bit: - [2009/07/13 20:41:27 | 001,011,712 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)
SRV - [2013/05/02 15:39:11 | 000,945,328 | ---- | M] () [Auto | Running] -- C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\14.0.1\ToolbarUpdater.exe -- (vToolbarUpdater14.0.1)
SRV - [2013/04/06 18:49:48 | 000,115,760 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)
SRV - [2013/03/12 22:24:46 | 000,253,656 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)
SRV - [2013/02/27 23:42:12 | 004,937,264 | ---- | M] (AVG Technologies CZ, s.r.o.) [Auto | Running] -- C:\Program Files (x86)\AVG\AVG2013\avgidsagent.exe -- (AVGIDSAgent)
SRV - [2013/02/19 04:02:02 | 000,282,624 | ---- | M] (AVG Technologies CZ, s.r.o.) [Auto | Running] -- C:\Program Files (x86)\AVG\AVG2013\avgwdsvc.exe -- (avgwd)
SRV - [2013/02/18 14:05:11 | 000,968,880 | ---- | M] () [Auto | Running] -- C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\14.2.0\ToolbarUpdater.exe -- (vToolbarUpdater14.2.0)
SRV - [2012/12/18 14:08:28 | 000,065,192 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice)
SRV - [2012/07/13 13:28:36 | 000,160,944 | R--- | M] (Skype Technologies) [Auto | Stopped] -- C:\Program Files (x86)\Skype\Updater\Updater.exe -- (SkypeUpdate)
SRV - [2011/09/01 18:06:50 | 000,227,896 | ---- | M] (Hewlett-Packard Company) [Auto | Running] -- C:\Program Files (x86)\Hewlett-Packard\Shared\HPDrvMntSvc.exe -- (HPDrvMntSvc.exe)
SRV - [2011/07/11 15:04:44 | 000,026,680 | ---- | M] (Hewlett-Packard Development Company, L.P.) [Auto | Running] -- C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPWMISVC.exe -- (HPWMISVC)
SRV - [2011/05/23 11:45:58 | 001,098,296 | ---- | M] (Hewlett-Packard Development Company L.P.) [On_Demand | Running] -- C:\Program Files (x86)\Hewlett-Packard\HP Connection Manager\hpCMSrv.exe -- (hpCMSrv)
SRV - [2011/03/07 19:43:30 | 002,375,168 | ---- | M] (Realsil Microelectronics Inc.) [Auto | Running] -- C:\Program Files (x86)\Realtek\Realtek PCIE Card Reader\RIconMan.exe -- (IconMan_R)
SRV - [2011/03/01 23:23:36 | 000,183,560 | ---- | M] (Microsoft Corporation.) [On_Demand | Stopped] -- C:\Program Files (x86)\Microsoft\BingBar\BBSvc.EXE -- (BBSvc)
SRV - [2011/02/25 12:46:22 | 000,249,648 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files (x86)\Microsoft\BingBar\SeaPort.EXE -- (SeaPort)
SRV - [2011/02/24 22:34:42 | 000,241,648 | ---- | M] (CyberLink) [Auto | Stopped] -- C:\Program Files (x86)\CyberLink\PowerDVD10\NavFilter\kmsvc.exe -- (CLKMSVC10_38F51D56)
SRV - [2011/02/18 00:48:24 | 000,265,544 | ---- | M] (HP) [Auto | Running] -- C:\Program Files (x86)\HP SimplePass 2011\TrueSuiteService.exe -- (FPLService)
SRV - [2010/11/26 09:09:12 | 000,399,344 | ---- | M] (Roxio) [Auto | Running] -- C:\Program Files (x86)\Roxio\RoxioNow Player\RNowSvc.exe -- (RoxioNow Service)
SRV - [2010/10/12 12:59:12 | 000,206,072 | ---- | M] (WildTangent, Inc.) [On_Demand | Stopped] -- C:\Program Files (x86)\WildTangent Games\App\GamesAppService.exe -- (GamesAppService)
SRV - [2010/03/18 15:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)
SRV - [2009/06/10 16:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)

========== Driver Services (SafeList) ==========

DRV:64bit: - [2013/05/02 15:39:11 | 000,037,720 | ---- | M] (AVG Technologies) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\avgtpx64.sys -- (avgtp)
DRV:64bit: - [2013/02/26 23:40:46 | 000,246,072 | ---- | M] (AVG Technologies CZ, s.r.o.) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\avgidsdrivera.sys -- (AVGIDSDriver)
DRV:64bit: - [2013/02/14 03:52:46 | 000,239,416 | ---- | M] (AVG Technologies CZ, s.r.o.) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\avgtdia.sys -- (Avgtdia)
DRV:64bit: - [2013/02/08 04:37:56 | 000,116,536 | ---- | M] (AVG Technologies CZ, s.r.o.) [File_System | Boot | Running] -- C:\Windows\SysNative\drivers\avgmfx64.sys -- (Avgmfx64)
DRV:64bit: - [2013/02/08 04:37:54 | 000,311,096 | ---- | M] (AVG Technologies CZ, s.r.o.) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\avgloga.sys -- (Avgloga)
DRV:64bit: - [2013/02/08 04:37:50 | 000,071,480 | ---- | M] (AVG Technologies CZ, s.r.o.) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\avgidsha.sys -- (AVGIDSHA)
DRV:64bit: - [2013/02/08 04:37:42 | 000,206,136 | ---- | M] (AVG Technologies CZ, s.r.o.) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\avgldx64.sys -- (Avgldx64)
DRV:64bit: - [2013/02/08 04:37:40 | 000,045,880 | ---- | M] (AVG Technologies CZ, s.r.o.) [File_System | Boot | Running] -- C:\Windows\SysNative\drivers\avgrkx64.sys -- (Avgrkx64)
DRV:64bit: - [2012/12/13 14:50:36 | 000,054,784 | ---- | M] (Apple, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\usbaapl64.sys -- (USBAAPL64)
DRV:64bit: - [2012/09/12 15:20:04 | 000,057,856 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\fssfltr.sys -- (fssfltr)
DRV:64bit: - [2012/08/21 13:01:20 | 000,033,240 | ---- | M] (GEAR Software Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\GEARAspiWDM.sys -- (GEARAspiWDM)
DRV:64bit: - [2012/03/01 01:46:16 | 000,023,408 | ---- | M] (Microsoft Corporation) [Recognizer | Boot | Unknown] -- C:\Windows\SysNative\drivers\fs_rec.sys -- (Fs_Rec)
DRV:64bit: - [2011/11/28 17:52:01 | 000,528,384 | ---- | M] (IDT, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\stwrt64.sys -- (STHDA)
DRV:64bit: - [2011/07/19 10:19:16 | 001,492,992 | ---- | M] (Ralink Technology, Corp.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\netr28x.sys -- (netr28x)
DRV:64bit: - [2011/05/27 12:20:12 | 000,043,320 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Accelerometer.sys -- (Accelerometer)
DRV:64bit: - [2011/05/27 12:20:12 | 000,030,008 | ---- | M] (Hewlett-Packard Company) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\hpdskflt.sys -- (hpdskflt)
DRV:64bit: - [2011/04/02 04:42:30 | 009,256,960 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\atikmdag.sys -- (amdkmdag)
DRV:64bit: - [2011/04/02 01:16:22 | 000,300,544 | ---- | M] (Advanced Micro Devices, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\atikmpag.sys -- (amdkmdap)
DRV:64bit: - [2011/03/24 19:20:36 | 000,337,512 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\RtsPStor.sys -- (RSPCIESTOR)
DRV:64bit: - [2011/03/17 23:04:20 | 000,188,544 | ---- | M] (Advanced Micro Devices, INC.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\amdxhc.sys -- (amdxhc)
DRV:64bit: - [2011/03/17 23:04:18 | 000,087,168 | ---- | M] (Advanced Micro Devices, INC.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\amdhub30.sys -- (amdhub30)
DRV:64bit: - [2011/03/11 01:41:12 | 000,107,904 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata)
DRV:64bit: - [2011/03/11 01:41:12 | 000,027,008 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata)
DRV:64bit: - [2011/03/04 17:46:20 | 000,078,976 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amd_sata.sys -- (amd_sata)
DRV:64bit: - [2011/03/04 17:46:20 | 000,038,528 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amd_xata.sys -- (amd_xata)
DRV:64bit: - [2011/02/16 20:11:08 | 000,428,136 | ---- | M] (Realtek ) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Rt64win7.sys -- (RTL8167)
DRV:64bit: - [2010/12/16 21:28:38 | 001,403,440 | ---- | M] (Synaptics Incorporated) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\SynTP.sys -- (SynTP)
DRV:64bit: - [2010/12/16 02:06:46 | 000,047,232 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\usbfilter.sys -- (usbfilter)
DRV:64bit: - [2010/11/20 22:24:33 | 000,059,392 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbFlt.sys -- (TsUsbFlt)
DRV:64bit: - [2010/11/20 22:23:47 | 000,109,056 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\sdbus.sys -- (sdbus)
DRV:64bit: - [2010/11/20 22:23:47 | 000,078,720 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD)
DRV:64bit: - [2010/11/20 22:23:47 | 000,031,232 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbGD.sys -- (TsUsbGD)
DRV:64bit: - [2010/11/17 11:04:32 | 000,115,216 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\AtihdW76.sys -- (AtiHDAudioService)
DRV:64bit: - [2010/07/28 09:13:50 | 000,031,088 | ---- | M] (CyberLink Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\clwvd.sys -- (clwvd)
DRV:64bit: - [2010/06/15 23:58:22 | 000,035,840 | R--- | M] (Avanquest Software) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\BVRPMPR5a64.SYS -- (BVRPMPR5a64)
DRV:64bit: - [2010/04/29 06:55:42 | 000,032,768 | ---- | M] (Google Inc) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\androidusb.sys -- (androidusb)
DRV:64bit: - [2010/02/18 11:18:24 | 000,046,136 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\amdiox64.sys -- (amdiox64)
DRV:64bit: - [2009/07/13 20:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs)
DRV:64bit: - [2009/07/13 20:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2)
DRV:64bit: - [2009/07/13 20:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor)
DRV:64bit: - [2009/07/13 19:35:32 | 000,012,288 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\serscan.sys -- (StillCam)
DRV:64bit: - [2009/06/10 16:01:11 | 001,485,312 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\VSTDPV6.SYS -- (SrvHsfV92)
DRV:64bit: - [2009/06/10 16:01:11 | 000,740,864 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\VSTCNXT6.SYS -- (SrvHsfWinac)
DRV:64bit: - [2009/06/10 16:01:11 | 000,292,864 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\VSTAZL6.SYS -- (SrvHsfHDA)
DRV:64bit: - [2009/06/10 15:35:35 | 000,408,960 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\nvm62x64.sys -- (NVENETFD)
DRV:64bit: - [2009/06/10 15:34:38 | 001,311,232 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\BCMWL664.SYS -- (BCM43XX)
DRV:64bit: - [2009/06/10 15:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv)
DRV:64bit: - [2009/06/10 15:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv)
DRV:64bit: - [2009/06/10 15:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a)
DRV:64bit: - [2009/06/10 15:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir)
DRV - [2009/07/13 20:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE:64bit: - HKLM\..\SearchScopes,DefaultScope =
IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/...rc=IE-SearchBox
IE:64bit: - HKLM\..\SearchScopes\{A22F7BA3-591A-4DDB-B9A3-C974A5B67BEB}: "URL" = http://www.amazon.co...s={searchTerms}
IE:64bit: - HKLM\..\SearchScopes\{b7fca997-d0fb-4fe0-8afd-255e89cf9671}: "URL" = http://search.yahoo....psg&type=HPNTDF
IE:64bit: - HKLM\..\SearchScopes\{d43b3890-80c7-4010-a95d-1e77b5924dc3}: "URL" = http://en.wikipedia....h={searchTerms}
IE:64bit: - HKLM\..\SearchScopes\{D944BB61-2E34-4DBF-A683-47E505C587DC}: "URL" = http://rover.ebay.co...w={searchTerms}
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\..\SearchScopes,DefaultScope =
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/...rc=IE-SearchBox
IE - HKLM\..\SearchScopes\{D944BB61-2E34-4DBF-A683-47E505C587DC}: "URL" = http://rover.ebay.co...w={searchTerms}

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
IE - HKCU\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/...rc=IE-SearchBox
IE - HKCU\..\SearchScopes\{95B7759C-8C7F-4BF1-B163-73684A933233}: "URL" = http://mysearch.avg....fr&d=2013-05-02 15:39:25&v=14.0.0.14&pid=safeguard&sg=&sap=dsp&q={searchTerms}
IE - HKCU\..\SearchScopes\{D944BB61-2E34-4DBF-A683-47E505C587DC}: "URL" = http://rover.ebay.co...w={searchTerms}
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

========== FireFox ==========

FF - prefs.js..browser.startup.homepage: "http://www.yahoo.com/?ilc=1"
FF - user.js - File not found

FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_6_602_180.dll File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\5.1.20125.0\npctrl.dll ( Microsoft Corporation)
FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_6_602_180.dll ()
FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\Windows\system32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@avg.com/AVG SiteSafety plugin,version=11.0.0.1,application/x-avg-sitesafety-plugin: C:\Program Files (x86)\Common Files\AVG Secure Search\SiteSafetyInstaller\14.0.1\\npsitesafety.dll ()
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.21.2: C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.21.2: C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files (x86)\Microsoft Silverlight\5.1.20125.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3508.1109: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=16.4.3505.0912: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.21.145\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.21.145\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@WildTangent.com/GamesAppPresenceDetector,Version=1.0: C:\Program Files (x86)\WildTangent Games\App\BrowserIntegration\Registered\2\NP_wtapp.dll ()
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Users\Michael\AppData\Local\Google\Update\1.3.21.135\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Users\Michael\AppData\Local\Google\Update\1.3.21.135\npGoogleUpdate3.dll (Google Inc.)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{1E73965B-8B48-48be-9C8D-68B920ABC1C4}: C:\Program Files (x86)\AVG\AVG2012\Firefox4\
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\[email protected]: C:\Program Files (x86)\Hewlett-Packard\SmartPrint\QPExtension [2011/01/26 15:27:28 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 16.0.2\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012/12/03 12:30:33 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 16.0.2\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2013/04/24 18:57:29 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 17.0.2\extensions\\Components: C:\Program Files (x86)\Mozilla Thunderbird\components [2013/04/06 18:49:50 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 17.0.2\extensions\\Plugins: C:\Program Files (x86)\Mozilla Thunderbird\plugins
FF - HKEY_LOCAL_MACHINE\software\mozilla\Thunderbird\Extensions\\[email protected]: C:\Program Files (x86)\AVG\AVG2012\Thunderbird\
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 16.0.2\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012/12/03 12:30:33 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 16.0.2\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2013/04/24 18:57:29 | 000,000,000 | ---D | M]

[2011/08/23 21:13:43 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Michael\AppData\Roaming\Mozilla\Extensions
[2012/11/01 00:15:08 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Michael\AppData\Roaming\Mozilla\Firefox\Profiles\8c5dcrl5.default\extensions
[2012/11/06 00:46:06 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\Mozilla Firefox\extensions
[2012/11/06 00:46:06 | 000,000,000 | ---D | M] (TrueSuite Website Logon) -- C:\Program Files (x86)\Mozilla Firefox\extensions\[email protected]
[2012/11/06 00:46:12 | 000,261,600 | ---- | M] (Mozilla Foundation) -- C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll
[2012/10/25 20:43:52 | 000,002,465 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml
[2013/05/02 15:39:29 | 000,000,000 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\safeguard-secure-search.xml
[2012/10/29 22:12:31 | 000,002,058 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\twitter.xml

========== Chrome ==========

CHR - default_search_provider: Google (Enabled)
CHR - default_search_provider: search_url = {google:baseURL}search?q={searchTerms}&{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}{google:assistedQueryStats}{google:searchFieldtrialParameter}{google:searchClient}{google:sourceId}{google:instantExtendedEnabledParameter}ie={inputEncoding}
CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client=chrome&q={searchTerms}&{google:cursorPosition}sugkey={google:suggestAPIKeyParameter}
CHR - homepage: http://www.yahoo.com/
CHR - plugin: Shockwave Flash (Enabled) = C:\Users\Michael\AppData\Local\Google\Chrome\Application\26.0.1410.64\PepperFlash\pepflashplayer.dll
CHR - plugin: Chrome Remote Desktop Viewer (Enabled) = internal-remoting-viewer
CHR - plugin: Native Client (Enabled) = C:\Users\Michael\AppData\Local\Google\Chrome\Application\26.0.1410.64\ppGoogleNaClPluginChrome.dll
CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Users\Michael\AppData\Local\Google\Chrome\Application\26.0.1410.64\pdf.dll
CHR - plugin: Adobe Acrobat (Enabled) = C:\Program Files (x86)\Adobe\Reader 11.0\Reader\Browser\nppdf32.dll
CHR - plugin: QuickTime Plug-in 7.7.3 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin.dll
CHR - plugin: QuickTime Plug-in 7.7.3 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin2.dll
CHR - plugin: QuickTime Plug-in 7.7.3 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin3.dll
CHR - plugin: QuickTime Plug-in 7.7.3 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin4.dll
CHR - plugin: QuickTime Plug-in 7.7.3 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin5.dll
CHR - plugin: QuickTime Plug-in 7.7.3 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin6.dll
CHR - plugin: QuickTime Plug-in 7.7.3 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin7.dll
CHR - plugin: Coupons Inc., Coupon Printer Manager (Enabled) = C:\Users\Michael\AppData\Local\Google\Chrome\Application\plugins\npMozCouponPrinter.dll
CHR - plugin: Microsoft Office 2010 (Enabled) = C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL
CHR - plugin: Microsoft Office 2010 (Enabled) = C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL
CHR - plugin: Google Update (Enabled) = C:\Program Files (x86)\Google\Update\1.3.21.135\npGoogleUpdate3.dll
CHR - plugin: Java™ Platform SE 7 U21 (Enabled) = C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll
CHR - plugin: Photo Gallery (Enabled) = C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll
CHR - plugin: iTunes Application Detector (Enabled) = C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_6_602_180.dll
CHR - plugin: Java Deployment Toolkit 7.0.210.11 (Enabled) = C:\Windows\SysWOW64\npDeployJava1.dll
CHR - plugin: Shockwave for Director (Enabled) = C:\Windows\system32\Adobe\Director\np32dsw.dll
CHR - plugin: Silverlight Plug-In (Enabled) = c:\Program Files (x86)\Microsoft Silverlight\5.1.20125.0\npctrl.dll
CHR - Extension: Website Logon = C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\aepeildmfnnehghlknddebgjghlompfe\1.0_0\

O1 HOSTS File: ([2013/05/02 15:28:46 | 000,000,027 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2:64bit: - BHO: (AVG Do Not Track) - {31332EEF-CB9F-458F-AFEB-D30E9A66B6BA} - C:\Program Files (x86)\AVG\AVG2012\avgdtiea.dll File not found
O2:64bit: - BHO: (no name) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - No CLSID value found.
O2:64bit: - BHO: (TrueSuite Website Log On) - {8590886E-EC8C-43C1-A32C-E4C2B0B6395B} - C:\Program Files (x86)\HP SimplePass 2011\x64\IEBHO.dll (HP)
O2:64bit: - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
O2 - BHO: (AVG Safe Search) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files (x86)\AVG\AVG2012\avgssie.dll File not found
O2 - BHO: (Java™ Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
O2 - BHO: (TrueSuite Website Log On) - {8590886E-EC8C-43C1-A32C-E4C2B0B6395B} - C:\Program Files (x86)\HP SimplePass 2011\IEBHO.dll (HP)
O2 - BHO: (AVG SafeGuard toolbar) - {95B7759C-8C7F-4BF1-B163-73684A933233} - C:\Program Files (x86)\AVG SafeGuard toolbar\14.0.0.14\AVG SafeGuard toolbar_toolbar.dll ()
O2 - BHO: (Bing Bar Helper) - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.)
O2 - BHO: (Java™ Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O3:64bit: - HKLM\..\Toolbar: (Google Toolbar) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
O3 - HKLM\..\Toolbar: (Bing Bar) - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.)
O3 - HKLM\..\Toolbar: (AVG SafeGuard toolbar) - {95B7759C-8C7F-4BF1-B163-73684A933233} - C:\Program Files (x86)\AVG SafeGuard toolbar\14.0.0.14\AVG SafeGuard toolbar_toolbar.dll ()
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - No CLSID value found.
O4:64bit: - HKLM..\Run: [SysTrayApp] C:\Program Files\IDT\WDM\sttray64.exe (IDT, Inc.)
O4 - HKLM..\Run: [] File not found
O4 - HKLM..\Run: [APSDaemon] C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
O4 - HKLM..\Run: [AVG_UI] C:\Program Files (x86)\AVG\AVG2013\avgui.exe (AVG Technologies CZ, s.r.o.)
O4 - HKLM..\Run: [BDRegion] C:\Program Files (x86)\CyberLink\Shared files\brs.exe (cyberlink)
O4 - HKLM..\Run: [Easybits Recovery] C:\Program Files (x86)\EasyBits For Kids\ezRecover.exe (EasyBits Software AS)
O4 - HKLM..\Run: [HP Quick Launch] C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe (Hewlett-Packard Development Company, L.P.)
O4 - HKLM..\Run: [HPConnectionManager] C:\Program Files (x86)\Hewlett-Packard\HP Connection Manager\HPCMDelayStart.exe (Hewlett-Packard Development Company L.P.)
O4 - HKLM..\Run: [HPOSD] C:\Program Files (x86)\Hewlett-Packard\HP On Screen Display\HPOSD.exe (Hewlett-Packard Development Company, L.P.)
O4 - HKLM..\Run: [RemoteControl10] C:\Program Files (x86)\CyberLink\PowerDVD10\PDVD10Serv.exe (CyberLink Corp.)
O4 - HKLM..\Run: [StartCCC] C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.)
O4 - HKLM..\Run: [vProt] C:\Program Files (x86)\AVG SafeGuard toolbar\vprot.exe ()
O4 - HKCU..\Run: [HP Photosmart 6510 series (NET)] C:\Program Files\HP\HP Photosmart 6510 series\Bin\ScanToPCActivationApp.exe (Hewlett-Packard Co.)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: EnableShellExecuteHooks = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O9:64bit: - Extra Button: AVG Do Not Track - {68BCFFE1-A2DA-4B40-9068-87ECBFC19D16} - C:\Program Files (x86)\AVG\AVG2012\avgdtiea.dll File not found
O9 - Extra Button: HP Smart Print - {22CC3EBD-C286-43aa-B8E6-06B115F74162} - C:\Program Files (x86)\Hewlett-Packard\SmartPrint\smartprintsetup.exe (Hewlett-Packard)
O9 - Extra 'Tools' menuitem : SmartPrint - {22CC3EBD-C286-43aa-B8E6-06B115F74162} - C:\Program Files (x86)\Hewlett-Packard\SmartPrint\smartprintsetup.exe (Hewlett-Packard)
O9 - Extra Button: @C:\Program Files (x86)\Evernote\Evernote\Resource.dll,-101 - {A95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\Program Files (x86)\Evernote\Evernote\EvernoteIE.dll (Evernote Corp., 333 W Evelyn Ave. Mountain View, CA 94041)
O9 - Extra 'Tools' menuitem : @C:\Program Files (x86)\Evernote\Evernote\Resource.dll,-101 - {A95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\Program Files (x86)\Evernote\Evernote\EvernoteIE.dll (Evernote Corp., 333 W Evelyn Ave. Mountain View, CA 94041)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000007 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)
O13 - gopher Prefix: missing
O16:64bit: - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_24)
O16:64bit: - DPF: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_24)
O16:64bit: - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_24)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/...indows-i586.cab (Reg Error: Value error.)
O16 - DPF: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_24)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Java Plug-in 10.21.2)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 75.75.76.76 75.75.75.75 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{5362F98F-F69B-4EA9-A142-537D8503BA14}: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{FC5CC95D-6A30-4329-9A56-642B1240DCD6}: DhcpNameServer = 75.75.76.76 75.75.75.75 192.168.1.1
O18:64bit: - Protocol\Handler\linkscanner - No CLSID value found
O18:64bit: - Protocol\Handler\livecall - No CLSID value found
O18:64bit: - Protocol\Handler\ms-help - No CLSID value found
O18:64bit: - Protocol\Handler\msnim - No CLSID value found
O18:64bit: - Protocol\Handler\skype4com - No CLSID value found
O18:64bit: - Protocol\Handler\viprotocol - No CLSID value found
O18:64bit: - Protocol\Handler\wlmailhtml - No CLSID value found
O18:64bit: - Protocol\Handler\wlpg - No CLSID value found
O18 - Protocol\Handler\linkscanner {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files (x86)\AVG\AVG2012\avgpp.dll File not found
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Handler\viprotocol {B658800C-F66E-4EF3-AB85-6C0C227862A9} - C:\Program Files (x86)\Common Files\AVG Secure Search\ViProtocolInstaller\14.0.1\ViProtocol.dll ()
O20:64bit: - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysWOW64\userinit.exe (Microsoft Corporation)
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O28 - HKLM ShellExecuteHooks: {E54729E8-BB3D-4270-9D49-7389EA579090} - C:\Windows\SysWOW64\ezUPBHook.dll (EasyBits Software Corp.)
O32 - HKLM CDRom: AutoRun - 1
O34 - HKLM BootExecute: (autocheck autochk *)
O34 - HKLM BootExecute: (/sync /restart)
O34 - HKLM BootExecute: (/sync /restart)
O34 - HKLM BootExecute: (/sync /restart)
O34 - HKLM BootExecute: (/sync /restart)
O34 - HKLM BootExecute: (/sync /restart)
O34 - HKLM BootExecute: (/sync /restart)
O34 - HKLM BootExecute: (/sync /restart)
O34 - HKLM BootExecute: (/sync /restart)
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:64bit: - HKLM\...com [@ = ComFile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = ComFile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)

========== Files/Folders - Created Within 30 Days ==========

[2013/05/03 10:11:11 | 000,000,000 | ---D | C] -- C:\Windows\temp
[2013/05/03 08:34:02 | 000,000,000 | ---D | C] -- C:\Windows\PolicyDefinitions
[2013/05/03 08:26:04 | 005,064,153 | R--- | C] (Swearware) -- C:\Users\Michael\Desktop\ComboFix.exe
[2013/05/02 15:43:57 | 000,000,000 | ---D | C] -- C:\Users\Michael\AppData\Roaming\AVG2013
[2013/05/02 15:39:41 | 000,000,000 | ---D | C] -- C:\Users\Michael\AppData\Local\AVG SafeGuard toolbar
[2013/05/02 15:39:30 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AVG
[2013/05/02 15:39:21 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\AVG SafeGuard toolbar
[2013/05/02 15:37:45 | 000,000,000 | ---D | C] -- C:\$AVG
[2013/05/02 15:37:44 | 000,000,000 | ---D | C] -- C:\ProgramData\AVG2013
[2013/05/02 15:36:22 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\AVG
[2013/05/02 15:35:28 | 000,000,000 | ---D | C] -- C:\Users\Michael\AppData\Local\Avg2013
[2013/05/02 15:35:28 | 000,000,000 | ---D | C] -- C:\ProgramData\AVG2012
[2013/05/02 15:25:35 | 000,518,144 | ---- | C] (SteelWerX) -- C:\Windows\SWREG.exe
[2013/05/02 15:25:35 | 000,406,528 | ---- | C] (SteelWerX) -- C:\Windows\SWSC.exe
[2013/05/02 15:25:35 | 000,060,416 | ---- | C] (NirSoft) -- C:\Windows\NIRCMD.exe
[2013/05/02 13:36:44 | 001,316,632 | ---- | C] (AVG Technologies CZ, s.r.o.) -- C:\Users\Michael\Desktop\avgremoverx64.exe
[2013/05/02 13:35:16 | 145,809,640 | ---- | C] (AVG Technologies) -- C:\Users\Michael\Desktop\avg_free_x64_all_2013_3272a6212.exe
[2013/04/29 17:01:50 | 000,448,512 | ---- | C] (OldTimer Tools) -- C:\Users\Michael\Desktop\TFC.exe
[2013/04/27 12:37:47 | 004,745,728 | ---- | C] (AVAST Software) -- C:\Users\Michael\Desktop\aswMBR(1).exe
[2013/04/26 14:00:38 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\ESET
[2013/04/26 14:00:25 | 002,347,384 | ---- | C] (ESET) -- C:\Users\Michael\Desktop\esetsmartinstaller_enu.exe
[2013/04/25 22:14:18 | 000,000,000 | ---D | C] -- C:\Users\Michael\Desktop\RK_Quarantine
[2013/04/25 21:04:40 | 004,745,728 | ---- | C] (AVAST Software) -- C:\Users\Michael\Desktop\aswMBR - old.exe
[2013/04/25 18:01:14 | 000,000,000 | ---D | C] -- C:\Users\Michael\Desktop\tdsskiller
[2013/04/25 14:49:15 | 000,000,000 | ---D | C] -- C:\Rooter$
[2013/04/25 14:47:55 | 000,173,119 | ---- | C] (Eric_71) -- C:\Users\Michael\Desktop\Rooter.exe
[2013/04/25 14:44:08 | 000,000,000 | ---D | C] -- C:\Users\Michael\AppData\Local\ElevatedDiagnostics
[2013/04/24 19:05:42 | 000,000,000 | ---D | C] -- C:\Qoobox
[2013/04/24 19:05:28 | 000,000,000 | ---D | C] -- C:\Windows\erdnt
[2013/04/24 18:53:13 | 000,000,000 | ---D | C] -- C:\Windows\ERUNT
[2013/04/24 18:52:48 | 000,000,000 | ---D | C] -- C:\JRT
[2013/04/24 18:46:31 | 000,535,764 | ---- | C] (Oleg N. Scherbakov) -- C:\Users\Michael\Desktop\JRT.exe
[2013/04/24 14:05:21 | 000,000,000 | ---D | C] -- C:\Users\Michael\Desktop\JavaRa
[2013/04/24 13:59:57 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Java
[2013/04/24 13:58:06 | 000,000,000 | ---D | C] -- C:\ProgramData\McAfee
[2013/04/24 02:50:22 | 000,602,112 | ---- | C] (OldTimer Tools) -- C:\Users\Michael\Desktop\OTL.exe
[2013/04/23 23:39:29 | 000,000,000 | ---D | C] -- C:\Users\Michael\AppData\Roaming\Malwarebytes
[2013/04/23 23:39:04 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2013/04/23 23:39:03 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2013/04/23 23:39:02 | 000,025,928 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys
[2013/04/23 23:39:02 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware
[2013/04/23 23:38:43 | 000,000,000 | ---D | C] -- C:\Users\Michael\AppData\Local\Programs

========== Files - Modified Within 30 Days ==========

[2013/05/03 10:08:00 | 000,000,916 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-695660584-876410207-1421700361-1001UA.job
[2013/05/03 10:01:00 | 000,000,260 | ---- | M] () -- C:\Windows\tasks\HP Photo Creations Messager.job
[2013/05/03 09:33:00 | 000,000,900 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2013/05/03 09:24:00 | 000,000,830 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job
[2013/05/03 08:32:14 | 000,000,864 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-695660584-876410207-1421700361-1001Core.job
[2013/05/03 08:25:32 | 005,064,153 | R--- | M] (Swearware) -- C:\Users\Michael\Desktop\ComboFix.exe
[2013/05/03 08:21:46 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2013/05/02 16:39:11 | 000,032,064 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2013/05/02 16:39:11 | 000,032,064 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2013/05/02 16:37:52 | 000,779,266 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
[2013/05/02 16:37:52 | 000,660,530 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
[2013/05/02 16:37:52 | 000,121,426 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
[2013/05/02 16:33:42 | 000,000,896 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2013/05/02 16:31:25 | 117,624,831 | -HS- | M] () -- C:\hiberfil.sys
[2013/05/02 15:39:30 | 000,000,965 | ---- | M] () -- C:\Users\Public\Desktop\AVG 2013.lnk
[2013/05/02 15:39:11 | 000,037,720 | ---- | M] (AVG Technologies) -- C:\Windows\SysNative\drivers\avgtpx64.sys
[2013/05/02 15:28:46 | 000,000,027 | ---- | M] () -- C:\Windows\SysNative\drivers\etc\hosts
[2013/05/02 13:59:02 | 000,094,172 | ---- | M] () -- C:\Users\Michael\Desktop\AVG files deleted manually 2.jpg
[2013/05/02 13:58:10 | 000,143,755 | ---- | M] () -- C:\Users\Michael\Desktop\AVG files deleted manually.jpg
[2013/05/02 13:36:10 | 001,316,632 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Users\Michael\Desktop\avgremoverx64.exe
[2013/05/02 13:34:34 | 145,809,640 | ---- | M] (AVG Technologies) -- C:\Users\Michael\Desktop\avg_free_x64_all_2013_3272a6212.exe
[2013/04/29 17:19:24 | 000,088,619 | ---- | M] () -- C:\Users\Michael\Desktop\Print screen of directory after TFC.jpg
[2013/04/29 17:01:26 | 000,448,512 | ---- | M] (OldTimer Tools) -- C:\Users\Michael\Desktop\TFC.exe
[2013/04/27 13:01:35 | 000,000,512 | ---- | M] () -- C:\Users\Michael\Desktop\MBR.dat
[2013/04/27 12:37:19 | 004,745,728 | ---- | M] (AVAST Software) -- C:\Users\Michael\Desktop\aswMBR(1).exe
[2013/04/27 11:50:50 | 000,076,134 | ---- | M] () -- C:\Users\Michael\Desktop\folder access denied and security settings.jpg
[2013/04/26 19:57:50 | 000,032,539 | ---- | M] () -- C:\Users\Michael\Desktop\folder access denied.jpg
[2013/04/26 19:55:41 | 000,059,033 | ---- | M] () -- C:\Users\Michael\Desktop\directory properties in safe mode.jpg
[2013/04/26 13:59:26 | 002,347,384 | ---- | M] (ESET) -- C:\Users\Michael\Desktop\esetsmartinstaller_enu.exe
[2013/04/25 22:13:22 | 000,816,128 | ---- | M] () -- C:\Users\Michael\Desktop\RogueKiller.exe
[2013/04/25 21:54:43 | 000,154,640 | ---- | M] () -- C:\Users\Michael\Desktop\Untitled.jpg
[2013/04/25 21:53:36 | 000,000,512 | ---- | M] () -- C:\Users\Michael\Desktop\MBR - old.dat
[2013/04/25 21:03:58 | 004,745,728 | ---- | M] (AVAST Software) -- C:\Users\Michael\Desktop\aswMBR - old.exe
[2013/04/25 18:00:07 | 002,218,636 | ---- | M] () -- C:\Users\Michael\Desktop\tdsskiller.zip
[2013/04/25 14:47:21 | 000,173,119 | ---- | M] (Eric_71) -- C:\Users\Michael\Desktop\Rooter.exe
[2013/04/24 18:51:43 | 000,025,006 | ---- | M] () -- C:\Users\Michael\Desktop\RunDLL error screen shot.jpg
[2013/04/24 18:46:31 | 000,535,764 | ---- | M] (Oleg N. Scherbakov) -- C:\Users\Michael\Desktop\JRT.exe
[2013/04/24 14:47:25 | 000,106,593 | ---- | M] () -- C:\Users\Michael\Desktop\AVG screen captures.jpg
[2013/04/24 14:31:13 | 000,112,565 | ---- | M] () -- C:\Users\Michael\Desktop\AVG screen shots2.jpg
[2013/04/24 14:12:50 | 000,002,019 | ---- | M] () -- C:\Users\Public\Desktop\Adobe Reader XI.lnk
[2013/04/24 14:05:06 | 000,160,350 | ---- | M] () -- C:\Users\Michael\Desktop\JavaRa.zip
[2013/04/24 02:50:28 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Michael\Desktop\OTL.exe
[2013/04/23 23:45:16 | 000,000,121 | ---- | M] () -- C:\Windows\DeleteOnReboot.bat
[2013/04/23 23:39:04 | 000,001,109 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2013/04/22 22:37:17 | 649,954,062 | ---- | M] () -- C:\Windows\MEMORY.DMP
[2013/04/22 21:17:07 | 000,000,340 | ---- | M] () -- C:\Windows\tasks\HPCeeScheduleForMichael.job
[2013/04/21 14:34:28 | 000,000,328 | ---- | M] () -- C:\Users\Michael\Desktop\HP Printer Diagnostic Tools.url
[2013/04/11 16:10:52 | 000,002,376 | ---- | M] () -- C:\Users\Michael\Desktop\Google Chrome.lnk
[2013/04/11 11:05:49 | 000,343,728 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT
[2013/04/08 20:13:42 | 000,000,000 | -H-- | M] () -- C:\Windows\SysNative\drivers\Msft_Kernel_androidusb_01009.Wdf
[2013/04/06 18:49:54 | 000,002,110 | ---- | M] () -- C:\Users\Michael\Application Data\Microsoft\Internet Explorer\Quick Launch\Mozilla Thunderbird.lnk
[2013/04/04 14:50:32 | 000,025,928 | ---- | M] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys

========== Files Created - No Company Name ==========

[2013/05/02 15:39:30 | 000,000,965 | ---- | C] () -- C:\Users\Public\Desktop\AVG 2013.lnk
[2013/05/02 15:25:35 | 000,256,000 | ---- | C] () -- C:\Windows\PEV.exe
[2013/05/02 15:25:35 | 000,208,896 | ---- | C] () -- C:\Windows\MBR.exe
[2013/05/02 15:25:35 | 000,098,816 | ---- | C] () -- C:\Windows\sed.exe
[2013/05/02 15:25:35 | 000,080,412 | ---- | C] () -- C:\Windows\grep.exe
[2013/05/02 15:25:35 | 000,068,096 | ---- | C] () -- C:\Windows\zip.exe
[2013/05/02 13:59:02 | 000,094,172 | ---- | C] () -- C:\Users\Michael\Desktop\AVG files deleted manually 2.jpg
[2013/05/02 13:58:10 | 000,143,755 | ---- | C] () -- C:\Users\Michael\Desktop\AVG files deleted manually.jpg
[2013/04/29 17:19:24 | 000,088,619 | ---- | C] () -- C:\Users\Michael\Desktop\Print screen of directory after TFC.jpg
[2013/04/27 13:01:35 | 000,000,512 | ---- | C] () -- C:\Users\Michael\Desktop\MBR.dat
[2013/04/27 11:50:50 | 000,076,134 | ---- | C] () -- C:\Users\Michael\Desktop\folder access denied and security settings.jpg
[2013/04/26 19:57:50 | 000,032,539 | ---- | C] () -- C:\Users\Michael\Desktop\folder access denied.jpg
[2013/04/26 19:55:41 | 000,059,033 | ---- | C] () -- C:\Users\Michael\Desktop\directory properties in safe mode.jpg
[2013/04/25 22:13:52 | 000,816,128 | ---- | C] () -- C:\Users\Michael\Desktop\RogueKiller.exe
[2013/04/25 21:54:43 | 000,154,640 | ---- | C] () -- C:\Users\Michael\Desktop\Untitled.jpg
[2013/04/25 21:47:05 | 000,000,512 | ---- | C] () -- C:\Users\Michael\Desktop\MBR - old.dat
[2013/04/25 18:00:48 | 002,218,636 | ---- | C] () -- C:\Users\Michael\Desktop\tdsskiller.zip
[2013/04/24 18:51:43 | 000,025,006 | ---- | C] () -- C:\Users\Michael\Desktop\RunDLL error screen shot.jpg
[2013/04/24 14:46:11 | 000,106,593 | ---- | C] () -- C:\Users\Michael\Desktop\AVG screen captures.jpg
[2013/04/24 14:31:13 | 000,112,565 | ---- | C] () -- C:\Users\Michael\Desktop\AVG screen shots2.jpg
[2013/04/24 14:12:50 | 000,002,441 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader XI.lnk
[2013/04/24 14:12:50 | 000,002,019 | ---- | C] () -- C:\Users\Public\Desktop\Adobe Reader XI.lnk
[2013/04/24 14:05:01 | 000,160,350 | ---- | C] () -- C:\Users\Michael\Desktop\JavaRa.zip
[2013/04/23 23:45:09 | 000,000,121 | ---- | C] () -- C:\Windows\DeleteOnReboot.bat
[2013/04/23 23:39:04 | 000,001,109 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2013/04/21 14:34:28 | 000,000,328 | ---- | C] () -- C:\Users\Michael\Desktop\HP Printer Diagnostic Tools.url
[2013/04/08 20:13:42 | 000,000,000 | -H-- | C] () -- C:\Windows\SysNative\drivers\Msft_Kernel_androidusb_01009.Wdf
[2012/11/01 10:36:43 | 000,025,600 | ---- | C] () -- C:\Users\Michael\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2012/10/31 23:55:46 | 000,057,344 | ---- | C] () -- C:\Windows\SysWow64\ff_vfw.dll
[2012/09/23 23:13:11 | 000,000,057 | ---- | C] () -- C:\ProgramData\Ament.ini
[2011/10/03 14:59:54 | 000,014,119 | ---- | C] () -- C:\Windows\SysWow64\RaCoInst.dat
[2011/08/23 20:31:05 | 000,007,599 | ---- | C] () -- C:\Users\Michael\AppData\Local\Resmon.ResmonCfg
[2011/07/21 12:44:19 | 000,000,000 | ---- | C] () -- C:\Windows\ativpsrm.bin
[2011/07/21 12:36:43 | 000,773,482 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI
[2011/07/21 12:24:37 | 000,000,056 | -H-- | C] () -- C:\Windows\SysWow64\ezsidmv.dat

========== ZeroAccess Check ==========

[2009/07/13 23:55:00 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini

[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64

[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] /64

[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
"" = C:\Windows\SysNative\shell32.dll -- [2012/06/09 00:43:10 | 014,172,672 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shell32.dll -- [2012/06/08 23:41:00 | 012,873,728 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\fastprox.dll -- [2009/07/13 20:40:51 | 000,909,312 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\system32\wbem\fastprox.dll -- [2010/11/20 22:24:25 | 000,606,208 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\wbemess.dll -- [2009/07/13 20:41:56 | 000,505,856 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Both

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]

========== LOP Check ==========

[2013/05/02 15:43:57 | 000,000,000 | ---D | M] -- C:\Users\Michael\AppData\Roaming\AVG2013
[2011/08/13 23:50:36 | 000,000,000 | ---D | M] -- C:\Users\Michael\AppData\Roaming\Blio
[2011/09/20 15:41:29 | 000,000,000 | ---D | M] -- C:\Users\Michael\AppData\Roaming\funkitron
[2011/08/13 23:53:27 | 000,000,000 | ---D | M] -- C:\Users\Michael\AppData\Roaming\IDT
[2011/08/13 22:28:24 | 000,000,000 | ---D | M] -- C:\Users\Michael\AppData\Roaming\Synaptics
[2011/08/23 21:13:43 | 000,000,000 | ---D | M] -- C:\Users\Michael\AppData\Roaming\Thunderbird
[2012/09/30 20:23:23 | 000,000,000 | ---D | M] -- C:\Users\Michael\AppData\Roaming\TuneUp Software
[2011/12/31 13:36:45 | 000,000,000 | ---D | M] -- C:\Users\Michael\AppData\Roaming\WebApp

========== Purity Check ==========

< End of report >

#27
RebelSnipe

Posted 03 May 2013 - 09:44 AM

Member

Topic Starter
Member
30 posts

OK - the plot thickens!

Can't even explain why I thought of trying this but because IE isn't working, I tried right mouse clicking on the IE icon, selected "Run as administrator" and it works?!?!? I verified opening it the normal way - doesn't work. Maybe something got messed up with security on this laptop? (i.e. IE not working, couldn't access that directory, etc. ?? - again, I don't have a clue, just grasping at straws.....)

#28
godawgs

Posted 03 May 2013 - 11:32 AM

Teacher

Retired Staff
8,228 posts

Hi,

ComboFix did finally complete - after almost 2 hours. It didn't reboot (nor did I.)

C:\Users\Michael\AppData\Local\Temp\sysoxkq - GONE!! yea!!

I'm glad to see we finally got those issues resolved.

Unfortunately, IE still doesn't work.

We are gonna work on that. The ComboFix scan doesn't show anything else. The last OTL scan shows some residual entries that we will clean up. Then we are gonna scan for any other residual files, I have seen this cure the problem you are having with IE, make sure your services are all running and see if any programs need updating. Updating Adobe Flash has been known to resolve that particular issue with IE so the scan will tell us if it is out of date.

Step-1.

Posted Image

OTL Fix

Be advised that when the fix commences it will shut down all running processes and you may lose the desktop and icons, they will return on reboot

1. Please copy all of the text in the quote box below (Do Not copy the word Quote. To do this, highlight everything
inside the quote box (except the word Quote) , right click and click Copy.

:COMMANDS
[createrestorepoint]

:OTL
O2:64bit: - BHO: (no name) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - No CLSID value found.
O16:64bit: - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_24)
O16:64bit: - DPF: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_24)
O16:64bit: - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_24)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/...indows-i586.cab (Reg Error: Value error.)
O16 - DPF: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_24)

:FILES
ipconfig /flushdns /c

:COMMANDS
[emptytemp]

Warning: This fix is relevant for this system and no other. If you are not this user, do NOT follow these directions as they could damage the workings of your system.

2. Please re-open Posted Image

on your desktop. To do that:

Vista and 7 users: Right click the icon and click Run as Administrator

3. Place the mouse pointer inside the Posted Image

textbox, right click and click Paste. This will put the above script inside the textbox.
4. Click the Posted Image

button.
5. Let the program run unhindered.
6. OTL may ask to reboot the machine. Please do so if asked.
7. Click the Posted Image

button.
8. A report will open. Copy and Paste that report in your next reply.
9. If the machine reboots, the log will be located at C:\_OTL\MovedFiles\mmddyyyy_hhmmss.log, (where mmddyyyy_hhmmss is the date of the tool run).

NOTE: Berore completing Steps 2 and 3 I want you to disable any screen saver you might have running.

Step-2.

Posted Image

Malwarebytes' Anti-Malware

Close all programs and browsers on your computer.

Right click on the MalwareBytes icon on the desktop and click Run As Administrator, then click the Continue button on the UAC window.). You will now be at the main program as shown below.

Posted Image

Click the Update Tab and update the program if required.
Click the Scanner tab, make sure the the Perform full scan option is selected and then click on the Scan button to start scanning your computer.
MBAM will now start scanning your computer for malware. This process can take quite a while, so I suggest you go and do something else and periodically check on the status of the scan. When MBAM is scanning it will look like the image below.
When the scan is finished a message box will appear as shown in the image below.

You should click on the OK button to close the message box and continue with the removal process.
You will now be back at the main Scanner screen. At this point you should click on the Show Results button.
A screen displaying all the malware that the program found will be shown as seen in the image below. Please note that the infections found may be different than what is shown in the image.
Make sure that everything is checked EXCEPT items in System Restore, and click Remove Selected.<---Very Important
When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
Copy&Paste the entire report in your next reply.

Extra Note: If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process. If asked to restart the computer, please do so immediately.

Step-3.

Run ESET Online Scanner:

Note: You can use either Internet Explorer or Mozilla FireFox for this scan. You will however need to disable your current installed Anti-Virus, how to do so can be read here.

Vista / 7 users: You will need to to right-click on the either the IE or FF icon in the Start Menu or Quick Launch Bar on the Taskbar and select Run as Administrator from the context menu.

Please go here then click on:

Note: If using Mozilla Firefox you will need to download esetsmartinstaller_enu.exe when prompted then double click on it to install.
All of the below instructions are compatible with either Internet Explorer or Mozilla FireFox.
Select the option YES, I accept the Terms of Use then click on:
When prompted allow the Add-On/Active X to install.
Uncheck the box beside Remove Found Threats
Make sure that the option Scan archives is checked.
Now click on Advanced Settings and select the following:
- Scan for potentially unwanted applications
- Scan for potentially unsafe applications
- Enable Anti-Stealth Technology
Now click on:
The virus signature database... will begin to download. Be patient this make take some time depending on the speed of your Internet Connection.
When completed the Online Scan will begin automatically. The scan may take several hours.
Wait for the scan to finish. Do not touch either the Mouse or keyboard during the scan. Otherwise it may stall.

When The Scan is Complete:

If No Threats Were Found:
- Put a checkmark in "Uninstall application on close"
- Close the program
- Report to me that nothing was found
If Threats Were Found:
- Click on "list of threats found"
- Click on "export to text file" and save it to the desktop as ESET SCAN.txt
- Click on Back
- Put a checkmark in "Uninstall application on close" (Be sure you have saved the file first)
- Click on Finish
- Close the program
- Copy and paste the report here

Note: Do not forget to re-enable your Anti-Virus application and screen saver after running the above scans!

Step-4.

Run Farbar Service Scanner

Please download Farbar Service Scanner to the desktop.
Vista and 7 users may need to right click the file and click Run as Administrator)

Make sure the following options are checked:
- Internet Services
- Windows Firewall
- System Restore
- Security Center
- Windows Update
- Windows Defender
- Other Services
Press "Scan".
It will create a log (FSS.txt) in the same directory the tool is run.
Please copy and paste the log to your reply.

Step-5.

Run Security Check

Download Security Check from here or here.

Save it to your Desktop.
Double click SecurityCheck.exe and follow the onscreen instructions inside of the black box.
A Notepad document should open automatically called checkup.txt; please post the contents of that document.

Step-6

Things For Your Next Post:
Please post the logs in the order requested. Do Not attach the logs unless I request it.
1. The OTL Fixes log
2. The MalwareBytes log
3. The ESET log (IF it found anything). If it didn't just tell me
4. The FSS.txt log
5. The checkup.txt log

#29
RebelSnipe

Posted 03 May 2013 - 05:16 PM

Member

Topic Starter
Member
30 posts

Hi godawgs - that was a lot of scanning!! :thumbsup:

Everything seemed to run just fine. Here are the outputs:

All processes killed
========== COMMANDS ==========
Restore point Set: OTL Restore Point
========== OTL ==========
64bit-Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0}\ deleted successfully.
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0}\ not found.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA}\ not found.
Starting removal of ActiveX control {8AD9C840-044E-11D1-B3E9-00805F499D93}
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ deleted successfully.
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ deleted successfully.
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ not found.
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ not found.
Starting removal of ActiveX control {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}\ deleted successfully.
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}\ deleted successfully.
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}\ not found.
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}\ not found.
Starting removal of ActiveX control {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}\ deleted successfully.
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}\ deleted successfully.
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}\ not found.
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}\ not found.
Starting removal of ActiveX control {8AD9C840-044E-11D1-B3E9-00805F499D93}
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ not found.
Starting removal of ActiveX control {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}\ not found.
========== FILES ==========
< ipconfig /flushdns /c >
Windows IP Configuration
Successfully flushed the DNS Resolver Cache.
C:\Users\Michael\Desktop\cmd.bat deleted successfully.
C:\Users\Michael\Desktop\cmd.txt deleted successfully.
========== COMMANDS ==========

[EMPTYTEMP]

User: Administrator
->Temp folder emptied: 0 bytes

User: All Users

User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: Michael
->Temp folder emptied: 112814 bytes
->Temporary Internet Files folder emptied: 10425988 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 89617891 bytes
->Google Chrome cache emptied: 0 bytes
->Flash cache emptied: 929 bytes

User: Public
->Temp folder emptied: 0 bytes

User: TEMP
->Temp folder emptied: 0 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32 (64bit) .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 2620 bytes
%systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 0 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 96.00 mb

OTL by OldTimer - Version 3.2.69.0 log created on 05032013_124256

Files\Folders moved on Reboot...
C:\Users\Michael\AppData\Local\Temp\FXSAPIDebugLogFile.txt moved successfully.
C:\Users\Michael\AppData\Local\Temp\VGXB72D.tmp moved successfully.
C:\Users\Michael\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat moved successfully.

PendingFileRenameOperations files...

Registry entries deleted on Reboot...

Malwarebytes Anti-Malware 1.75.0.1300
www.malwarebytes.org

Database version: v2013.05.03.07

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 10.0.9200.16540
Michael :: MICHAEL-HP [administrator]

5/3/2013 12:55:51 PM
mbam-log-2013-05-03 (12-55-51).txt

Scan type: Full scan (C:\|D:\|F:\|)
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
Scan options disabled: P2P
Objects scanned: 488938
Time elapsed: 1 hour(s), 52 minute(s),

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 0
(No malicious items detected)

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 0
(No malicious items detected)

Files Detected: 0
(No malicious items detected)

(end)

ESET log:

C:\Users\Michael\Downloads\cbsidlm-cbsi5_2_0_83-Free_Movie_DVD_Maker-ORG2-10669082.exe a variant of Win32/CNETInstaller.A application
C:\Users\Michael\Downloads\cbsidlm-tr1_7-Media_Cope-ORG2-10977511.exe Win32/DownloadAdmin.D application
C:\Users\Michael\Downloads\EzvidSetup.exe a variant of Win32/InstallCore.AY application
C:\Users\Michael\Downloads\MediaCopeSetupD.exe a variant of Win32/Toolbar.Babylon.A application

Farbar Service Scanner Version: 14-04-2013
Ran by Michael (administrator) on 03-05-2013 at 17:57:55
Running from "C:\Users\Michael\Desktop"
Windows 7 Home Premium Service Pack 1 (X64)
Boot Mode: Normal
****************************************************************

Internet Services:
============

Connection Status:
==============
Localhost is accessible.
LAN connected.
Google IP is accessible.
Google.com is accessible.
Attempt to access Yahoo IP returned error. Yahoo IP is offline
Yahoo.com is accessible.

Windows Firewall:
=============

Firewall Disabled Policy:
==================

System Restore:
============

System Restore Disabled Policy:
========================

Action Center:
============

Windows Update:
============

Windows Autoupdate Disabled Policy:
============================

Windows Defender:
==============
WinDefend Service is not running. Checking service configuration:
The start type of WinDefend service is set to Demand. The default start type is Auto.
The ImagePath of WinDefend service is OK.
The ServiceDll of WinDefend service is OK.

Windows Defender Disabled Policy:
==========================
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender]
"DisableAntiSpyware"=DWORD:1

Other Services:
==============

File Check:
========
C:\Windows\System32\nsisvc.dll => MD5 is legit
C:\Windows\System32\drivers\nsiproxy.sys => MD5 is legit
C:\Windows\System32\dhcpcore.dll => MD5 is legit
C:\Windows\System32\drivers\afd.sys => MD5 is legit
C:\Windows\System32\drivers\tdx.sys => MD5 is legit
C:\Windows\System32\Drivers\tcpip.sys => MD5 is legit
C:\Windows\System32\dnsrslvr.dll => MD5 is legit
C:\Windows\System32\mpssvc.dll => MD5 is legit
C:\Windows\System32\bfe.dll => MD5 is legit
C:\Windows\System32\drivers\mpsdrv.sys => MD5 is legit
C:\Windows\System32\SDRSVC.dll => MD5 is legit
C:\Windows\System32\vssvc.exe => MD5 is legit
C:\Windows\System32\wscsvc.dll => MD5 is legit
C:\Windows\System32\wbem\WMIsvc.dll => MD5 is legit
C:\Windows\System32\wuaueng.dll => MD5 is legit
C:\Windows\System32\qmgr.dll => MD5 is legit
C:\Windows\System32\es.dll => MD5 is legit
C:\Windows\System32\cryptsvc.dll => MD5 is legit
C:\Program Files\Windows Defender\MpSvc.dll => MD5 is legit
C:\Windows\System32\ipnathlp.dll => MD5 is legit
C:\Windows\System32\iphlpsvc.dll => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit

**** End of log ****

Results of screen317's Security Check version 0.99.63
Windows 7 Service Pack 1 x64 (UAC is enabled)
Internet Explorer 9
``````````````Antivirus/Firewall Check:``````````````
Windows Firewall Enabled!
AVG AntiVirus Free Edition 2013
Antivirus up to date!
`````````Anti-malware/Other Utilities Check:`````````
Malwarebytes Anti-Malware version 1.75.0.1300
Java™ 6 Update 24
Java 7 Update 21
Adobe Flash Player 11.6.602.180
Adobe Reader XI
Mozilla Firefox 16.0.2 Firefox out of Date!
Mozilla Thunderbird (17.0.2)
Google Chrome 26.0.1410.43
Google Chrome 26.0.1410.64
Google Chrome plugins...
````````Process Check: objlist.exe by Laurent````````
AVG avgwdsvc.exe
`````````````````System Health check`````````````````
Total Fragmentation on Drive C: 3%
````````````````````End of Log``````````````````````

#30
godawgs

Posted 03 May 2013 - 05:37 PM

Teacher

Retired Staff
8,228 posts

Hi,

Step-1.

Please delete the following files:

C:\Users\Michael\Downloads\cbsidlm-cbsi5_2_0_83-Free_Movie_DVD_Maker-ORG2-10669082.exe
C:\Users\Michael\Downloads\cbsidlm-tr1_7-Media_Cope-ORG2-10977511.exe
C:\Users\Michael\Downloads\EzvidSetup.exe
C:\Users\Michael\Downloads\MediaCopeSetupD.exe

Step-2.

Uninstall Java 6 Update 21

1. Please click the Start Orb

, click Control Panel. Under the Programs and Features heading click Uninstall a program
2. In the list of programs installed, locate the following program(s):

Java 6 Update 21

3. Vista/7 users: right click the program and click Uninstall
4. After the programs have been uninstalled, close the Installed Programs window and the Control Panel.
5. Reboot the computer.

Step-3.

Update Firefox

Your Firefox is out of date.

At the top of the Firefox window click the Firefox button.
Go over to the Help menu and select About Firefox.
The About Firefox window will open and Firefox will begin checking for updates. If updates are available, they will begin downloading automatically.
When the updates are downloaded and ready to be installed, click Apply Update. Firefox will be restarted and the updates will be installed.