Javascript Disabled Detected

You currently have javascript disabled. Several functions may not work. Please re-enable javascript to access full functionality.

Pop ups [Solved]

Started by Stephen Stato , May 26 2014 11:36 AM

Malware

This topic is locked

#1
Stephen Stato

Posted 26 May 2014 - 11:36 AM

Member

Member
17 posts

I have a recurrence of what i believe to be a Malware problem. Lots of links pop up all over my screen linking me to win something or enlarge something.

Computer has slowed down in general also.

Here is the OTL Results

OTL logfile created on: 5/26/2014 6:00:10 PM - Run 5

OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\Lisa\Downloads

64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation

Internet Explorer (Version = 9.11.9600.17041)

Locale: 00000409 | Country: Ireland | Language: ENI | Date Format: dd/MM/yyyy

3.91 Gb Total Physical Memory | 1.38 Gb Available Physical Memory | 35.27% Memory free

7.82 Gb Paging File | 4.15 Gb Available in Paging File | 53.14% Paging File free

Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)

Drive C: | 149.04 Gb Total Space | 5.67 Gb Free Space | 3.81% Space Free | Partition Type: NTFS

Drive D: | 148.65 Gb Total Space | 111.79 Gb Free Space | 75.20% Space Free | Partition Type: NTFS

Computer Name: LISA-OSUL | User Name: Lisa | Logged in as Administrator.

Boot Mode: Normal | Scan Mode: Current user | Quick Scan | Include 64bit Scans

Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2014/05/26 17:59:59 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Lisa\Downloads\OTL.exe

PRC - [2014/05/15 22:38:02 | 007,631,872 | ---- | M] (Google Inc.) -- C:\Users\Lisa\AppData\Local\Programs\Google\MusicManager\MusicManager.exe

PRC - [2014/05/14 00:40:56 | 000,860,488 | ---- | M] (Google Inc.) -- C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

PRC - [2014/05/12 18:57:06 | 001,272,400 | ---- | M] (BitTorrent Inc.) -- C:\Users\Lisa\AppData\Roaming\uTorrent\uTorrent.exe

PRC - [2014/05/12 18:39:25 | 000,263,048 | ---- | M] (Google Inc.) -- C:\Program Files (x86)\Google\Update\1.3.24.7\GoogleCrashHandler.exe

PRC - [2014/05/09 01:40:44 | 033,312,680 | ---- | M] (Dropbox, Inc.) -- C:\Users\Lisa\AppData\Roaming\Dropbox\bin\Dropbox.exe

PRC - [2014/04/25 10:03:52 | 022,415,552 | ---- | M] (Google) -- C:\Program Files (x86)\Google\Drive\googledrivesync.exe

PRC - [2014/04/11 19:45:50 | 001,764,992 | ---- | M] (Microsoft Corporation) -- C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe

PRC - [2014/04/11 19:45:42 | 001,390,720 | ---- | M] (Microsoft Corporation) -- C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe

PRC - [2013/12/21 07:04:16 | 000,065,432 | ---- | M] (Adobe Systems Incorporated) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe

PRC - [2013/11/30 18:27:51 | 000,295,512 | ---- | M] (RealNetworks, Inc.) -- C:\Program Files (x86)\Real\RealPlayer\Update\realsched.exe

PRC - [2013/11/20 16:43:26 | 000,059,720 | ---- | M] (Apple Inc.) -- C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe

PRC - [2013/11/20 16:43:14 | 000,059,720 | ---- | M] (Apple Inc.) -- C:\Program Files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreamsDownloader.exe

PRC - [2013/11/20 16:43:14 | 000,059,720 | ---- | M] (Apple Inc.) -- C:\Program Files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe

PRC - [2013/09/14 03:27:52 | 000,059,720 | ---- | M] (Apple Inc.) -- C:\Program Files (x86)\Common Files\Apple\Internet Services\APSDaemon.exe

PRC - [2013/08/14 16:19:22 | 000,039,056 | ---- | M] () -- C:\Program Files (x86)\RealNetworks\RealDownloader\rndlresolversvc.exe

PRC - [2013/06/26 19:21:50 | 000,207,528 | ---- | M] (Microsoft Corporation) -- C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe

PRC - [2013/06/26 19:21:46 | 000,523,944 | ---- | M] (Microsoft Corporation) -- C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe

PRC - [2012/10/26 16:24:12 | 001,017,184 | ---- | M] (Evernote Corp., 333 W Evelyn Ave. Mountain View, CA 94041) -- C:\Program Files (x86)\Evernote\Evernote\EvernoteClipper.exe

PRC - [2012/08/08 09:17:00 | 000,540,056 | ---- | M] (Lavasoft) -- C:\ProgramData\Ad-Aware Browsing Protection\adawarebp.exe

PRC - [2011/07/29 00:08:12 | 001,259,376 | ---- | M] () -- C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe

PRC - [2011/02/01 12:24:42 | 002,656,280 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe

PRC - [2011/02/01 12:24:40 | 000,326,168 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe

PRC - [2010/08/16 09:54:50 | 000,034,160 | ---- | M] (TOSHIBA CORPORATION) -- C:\Program Files (x86)\TOSHIBA\Utilities\KeNotify.exe

PRC - [2009/03/10 17:51:20 | 000,046,448 | ---- | M] (TOSHIBA CORPORATION) -- C:\Program Files (x86)\TOSHIBA\ConfigFree\CFSvcs.exe

========== Modules (No Company Name) ==========

MOD - [2014/05/25 13:06:40 | 000,362,029 | ---- | M] () -- C:\Users\Lisa\AppData\Local\Microsoft\DefaultSetup\sqlite3.dll

MOD - [2014/05/23 07:47:24 | 000,043,008 | ---- | M] () -- c:\Users\Lisa\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmphc5fvj.dll

MOD - [2014/05/23 07:46:25 | 001,159,680 | ---- | M] () -- C:\Users\Lisa\AppData\Local\Temp\_MEI46002\_ssl.pyd

MOD - [2014/05/23 07:46:25 | 001,062,400 | ---- | M] () -- C:\Users\Lisa\AppData\Local\Temp\_MEI46002\wx._controls_.pyd

MOD - [2014/05/23 07:46:25 | 000,811,008 | ---- | M] () -- C:\Users\Lisa\AppData\Local\Temp\_MEI46002\wx._windows_.pyd

MOD - [2014/05/23 07:46:25 | 000,805,888 | ---- | M] () -- C:\Users\Lisa\AppData\Local\Temp\_MEI46002\wx._gdi_.pyd

MOD - [2014/05/23 07:46:25 | 000,713,216 | ---- | M] () -- C:\Users\Lisa\AppData\Local\Temp\_MEI46002\_hashlib.pyd

MOD - [2014/05/23 07:46:25 | 000,686,080 | ---- | M] () -- C:\Users\Lisa\AppData\Local\Temp\_MEI46002\unicodedata.pyd

MOD - [2014/05/23 07:46:25 | 000,127,488 | ---- | M] () -- C:\Users\Lisa\AppData\Local\Temp\_MEI46002\pyexpat.pyd

MOD - [2014/05/23 07:46:25 | 000,110,080 | ---- | M] () -- C:\Users\Lisa\AppData\Local\Temp\_MEI46002\PyWinTypes27.dll

MOD - [2014/05/23 07:46:25 | 000,108,544 | ---- | M] () -- C:\Users\Lisa\AppData\Local\Temp\_MEI46002\win32security.pyd

MOD - [2014/05/23 07:46:25 | 000,070,656 | ---- | M] () -- C:\Users\Lisa\AppData\Local\Temp\_MEI46002\wx._html2.pyd

MOD - [2014/05/23 07:46:25 | 000,038,912 | ---- | M] () -- C:\Users\Lisa\AppData\Local\Temp\_MEI46002\win32inet.pyd

MOD - [2014/05/23 07:46:25 | 000,035,840 | ---- | M] () -- C:\Users\Lisa\AppData\Local\Temp\_MEI46002\win32process.pyd

MOD - [2014/05/23 07:46:25 | 000,027,136 | ---- | M] () -- C:\Users\Lisa\AppData\Local\Temp\_MEI46002\_multiprocessing.pyd

MOD - [2014/05/23 07:46:25 | 000,025,600 | ---- | M] () -- C:\Users\Lisa\AppData\Local\Temp\_MEI46002\win32pdh.pyd

MOD - [2014/05/23 07:46:25 | 000,024,064 | ---- | M] () -- C:\Users\Lisa\AppData\Local\Temp\_MEI46002\win32pipe.pyd

MOD - [2014/05/23 07:46:25 | 000,018,432 | ---- | M] () -- C:\Users\Lisa\AppData\Local\Temp\_MEI46002\win32event.pyd

MOD - [2014/05/23 07:46:25 | 000,017,408 | ---- | M] () -- C:\Users\Lisa\AppData\Local\Temp\_MEI46002\win32profile.pyd

MOD - [2014/05/23 07:46:25 | 000,010,240 | ---- | M] () -- C:\Users\Lisa\AppData\Local\Temp\_MEI46002\select.pyd

MOD - [2014/05/23 07:46:24 | 001,175,040 | ---- | M] () -- C:\Users\Lisa\AppData\Local\Temp\_MEI46002\wx._core_.pyd

MOD - [2014/05/23 07:46:24 | 000,557,056 | ---- | M] () -- C:\Users\Lisa\AppData\Local\Temp\_MEI46002\pysqlite2._sqlite.pyd

MOD - [2014/05/23 07:46:24 | 000,525,640 | ---- | M] () -- C:\Users\Lisa\AppData\Local\Temp\_MEI46002\windows._lib_cacheinvalidation.pyd

MOD - [2014/05/23 07:46:24 | 000,364,544 | ---- | M] () -- C:\Users\Lisa\AppData\Local\Temp\_MEI46002\pythoncom27.dll

MOD - [2014/05/23 07:46:24 | 000,320,512 | ---- | M] () -- C:\Users\Lisa\AppData\Local\Temp\_MEI46002\win32com.shell.shell.pyd

MOD - [2014/05/23 07:46:24 | 000,167,936 | ---- | M] () -- C:\Users\Lisa\AppData\Local\Temp\_MEI46002\win32gui.pyd

MOD - [2014/05/23 07:46:24 | 000,128,512 | ---- | M] () -- C:\Users\Lisa\AppData\Local\Temp\_MEI46002\_elementtree.pyd

MOD - [2014/05/23 07:46:24 | 000,119,808 | ---- | M] () -- C:\Users\Lisa\AppData\Local\Temp\_MEI46002\win32file.pyd

MOD - [2014/05/23 07:46:24 | 000,098,816 | ---- | M] () -- C:\Users\Lisa\AppData\Local\Temp\_MEI46002\win32api.pyd

MOD - [2014/05/23 07:46:24 | 000,087,552 | ---- | M] () -- C:\Users\Lisa\AppData\Local\Temp\_MEI46002\_ctypes.pyd

MOD - [2014/05/23 07:46:24 | 000,078,336 | ---- | M] () -- C:\Users\Lisa\AppData\Local\Temp\_MEI46002\wx._animate.pyd

MOD - [2014/05/23 07:46:24 | 000,045,568 | ---- | M] () -- C:\Users\Lisa\AppData\Local\Temp\_MEI46002\_socket.pyd

MOD - [2014/05/23 07:46:24 | 000,022,528 | ---- | M] () -- C:\Users\Lisa\AppData\Local\Temp\_MEI46002\win32ts.pyd

MOD - [2014/05/23 07:46:22 | 000,735,232 | ---- | M] () -- C:\Users\Lisa\AppData\Local\Temp\_MEI46002\wx._misc_.pyd

MOD - [2014/05/23 07:46:20 | 000,122,368 | ---- | M] () -- C:\Users\Lisa\AppData\Local\Temp\_MEI46002\wx._wizard.pyd

MOD - [2014/05/23 07:46:20 | 000,011,264 | ---- | M] () -- C:\Users\Lisa\AppData\Local\Temp\_MEI46002\win32crypt.pyd

MOD - [2014/05/15 22:24:36 | 000,344,064 | ---- | M] () -- C:\Users\Lisa\AppData\Local\Programs\Google\MusicManager\libaudioenc.dll

MOD - [2014/05/15 22:21:24 | 000,253,440 | ---- | M] () -- C:\Users\Lisa\AppData\Local\Programs\Google\MusicManager\libid3tag.dll

MOD - [2014/05/15 22:20:58 | 000,231,936 | ---- | M] () -- C:\Users\Lisa\AppData\Local\Programs\Google\MusicManager\libmpgdec.dll

MOD - [2014/05/15 22:20:54 | 000,117,248 | ---- | M] () -- C:\Users\Lisa\AppData\Local\Programs\Google\MusicManager\libaacdec.dll

MOD - [2014/05/14 00:40:54 | 000,414,536 | ---- | M] () -- C:\Program Files (x86)\Google\Chrome\Application\35.0.1916.114\ppgooglenaclpluginchrome.dll

MOD - [2014/05/14 00:40:53 | 013,695,816 | ---- | M] () -- C:\Program Files (x86)\Google\Chrome\Application\35.0.1916.114\PepperFlash\pepflashplayer.dll

MOD - [2014/05/14 00:40:50 | 004,217,672 | ---- | M] () -- C:\Program Files (x86)\Google\Chrome\Application\35.0.1916.114\pdf.dll

MOD - [2014/05/14 00:40:45 | 000,716,616 | ---- | M] () -- C:\Program Files (x86)\Google\Chrome\Application\35.0.1916.114\libglesv2.dll

MOD - [2014/05/14 00:40:44 | 000,126,280 | ---- | M] () -- C:\Program Files (x86)\Google\Chrome\Application\35.0.1916.114\libegl.dll

MOD - [2014/05/14 00:40:43 | 001,732,424 | ---- | M] () -- C:\Program Files (x86)\Google\Chrome\Application\35.0.1916.114\ffmpegsumo.dll

MOD - [2014/01/20 14:17:04 | 000,073,544 | ---- | M] () -- C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll

MOD - [2014/01/20 14:16:38 | 001,044,808 | ---- | M] () -- C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll

MOD - [2014/01/03 02:09:27 | 003,610,624 | ---- | M] () -- C:\Users\Lisa\AppData\Roaming\Dropbox\bin\wxmsw28uh_vc.dll

MOD - [2013/12/10 22:06:52 | 000,026,624 | ---- | M] () -- C:\Users\Lisa\AppData\Local\Programs\Google\MusicManager\imageformats\qgif4.dll

MOD - [2013/12/10 22:06:42 | 010,683,392 | ---- | M] () -- C:\Users\Lisa\AppData\Local\Programs\Google\MusicManager\QtWebKit4.dll

MOD - [2013/12/10 22:06:40 | 001,681,408 | ---- | M] () -- C:\Users\Lisa\AppData\Local\Programs\Google\MusicManager\QtNetwork4.dll

MOD - [2013/12/10 22:06:38 | 007,741,952 | ---- | M] () -- C:\Users\Lisa\AppData\Local\Programs\Google\MusicManager\QtGui4.dll

MOD - [2013/12/10 22:06:36 | 002,248,192 | ---- | M] () -- C:\Users\Lisa\AppData\Local\Programs\Google\MusicManager\QtCore4.dll

MOD - [2013/09/14 01:51:02 | 000,087,952 | ---- | M] () -- C:\Program Files (x86)\Common Files\Apple\Internet Services\zlib1.dll

MOD - [2013/09/14 01:50:36 | 001,242,952 | ---- | M] () -- C:\Program Files (x86)\Common Files\Apple\Internet Services\libxml2.dll

MOD - [2013/09/05 01:14:10 | 004,300,456 | ---- | M] () -- C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Cultures\OFFICE.ODF

MOD - [2013/08/23 20:01:44 | 025,100,288 | ---- | M] () -- C:\Users\Lisa\AppData\Roaming\Dropbox\bin\libcef.dll

MOD - [2012/09/08 14:16:30 | 000,433,664 | ---- | M] () -- C:\Program Files (x86)\Evernote\Evernote\libxml2.dll

MOD - [2012/09/08 14:16:20 | 000,315,392 | ---- | M] () -- C:\Program Files (x86)\Evernote\Evernote\libtidy.dll

MOD - [2011/07/29 00:09:42 | 000,096,112 | ---- | M] () -- C:\Program Files (x86)\DivX\DivX Update\DivXUpdateCheck.dll

MOD - [2011/07/29 00:08:12 | 001,259,376 | ---- | M] () -- C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe

MOD - [2010/10/20 15:45:26 | 008,801,120 | ---- | M] () -- C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveIntlResource.dll

========== Services (SafeList) ==========

SRV:64bit: - [2014/03/11 12:34:10 | 000,347,872 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Program Files\Microsoft Security Client\NisSrv.exe -- (NisSrv)

SRV:64bit: - [2014/03/11 12:34:10 | 000,023,808 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Microsoft Security Client\MsMpEng.exe -- (MsMpSvc)

SRV:64bit: - [2014/03/06 09:29:14 | 000,111,616 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\IEEtwCollector.exe -- (IEEtwCollectorService)

SRV:64bit: - [2013/05/27 06:50:47 | 001,011,712 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)

SRV:64bit: - [2010/12/09 16:45:26 | 000,489,384 | ---- | M] (TOSHIBA Corporation) [Auto | Running] -- C:\Program Files\TOSHIBA\Power Saver\TosCoSrv.exe -- (TosCoSrv)

SRV:64bit: - [2010/12/08 14:42:54 | 000,137,632 | ---- | M] (TOSHIBA Corporation) [On_Demand | Running] -- C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSmartSrv.exe -- (TOSHIBA HDD SSD Alert Service)

SRV:64bit: - [2010/10/20 13:41:00 | 000,138,656 | ---- | M] (TOSHIBA Corporation) [Auto | Running] -- C:\Windows\SysNative\TODDSrv.exe -- (TODDSrv)

SRV - [2014/05/13 21:00:57 | 000,257,712 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)

SRV - [2014/04/11 19:45:50 | 001,764,992 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe -- (c2cpnrsvc)

SRV - [2014/04/11 19:45:42 | 001,390,720 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe -- (c2cautoupdatesvc)

SRV - [2014/04/03 20:21:48 | 000,315,008 | R--- | M] (Skype Technologies) [Auto | Stopped] -- C:\Program Files (x86)\Skype\Updater\Updater.exe -- (SkypeUpdate)

SRV - [2013/12/21 07:04:16 | 000,065,432 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice)

SRV - [2013/09/11 22:21:54 | 000,105,144 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)

SRV - [2013/08/14 16:19:22 | 000,039,056 | ---- | M] () [Auto | Running] -- C:\Program Files (x86)\RealNetworks\RealDownloader\rndlresolversvc.exe -- (RealNetworks Downloader Resolver Service)

SRV - [2013/06/26 19:21:50 | 000,207,528 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe -- (sftvsa)

SRV - [2013/06/26 19:21:46 | 000,523,944 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe -- (sftlist)

SRV - [2011/02/11 14:45:52 | 000,054,136 | ---- | M] (TOSHIBA Corporation) [On_Demand | Running] -- C:\Program Files (x86)\TOSHIBA\TOSHIBA Service Station\TMachInfo.exe -- (TMachInfo)

SRV - [2011/02/10 08:25:36 | 000,112,080 | ---- | M] (Toshiba Europe GmbH) [On_Demand | Stopped] -- C:\Program Files (x86)\Toshiba TEMPRO\TemproSvc.exe -- (TemproMonitoringService)

SRV - [2011/02/01 12:24:42 | 002,656,280 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe -- (UNS)

SRV - [2011/02/01 12:24:40 | 000,326,168 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe -- (LMS)

SRV - [2010/01/30 01:40:16 | 001,043,584 | ---- | M] (Hewlett-Packard Co.) [Auto | Running] -- C:\Program Files (x86)\HP\Digital Imaging\bin\HPSLPSVC64.DLL -- (HPSLPSVC)

SRV - [2010/01/28 15:44:40 | 000,249,200 | ---- | M] (TOSHIBA CORPORATION) [Auto | Running] -- C:\Program Files (x86)\TOSHIBA\ConfigFree\CFIWmxSvcs64.exe -- (cfWiMAXService)

SRV - [2009/06/10 22:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)

SRV - [2009/03/10 17:51:20 | 000,046,448 | ---- | M] (TOSHIBA CORPORATION) [Auto | Running] -- C:\Program Files (x86)\TOSHIBA\ConfigFree\CFSvcs.exe -- (ConfigFree Service)

========== Driver Services (SafeList) ==========

DRV:64bit: - [2014/03/11 09:52:30 | 000,133,928 | ---- | M] (Microsoft Corporation) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\NisDrvWFP.sys -- (NisDrv)

DRV:64bit: - [2013/07/25 16:53:46 | 000,023,040 | ---- | M] (Apple Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\netaapl64.sys -- (Netaapl)

DRV:64bit: - [2013/06/26 19:21:50 | 000,023,208 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Sftvollh.sys -- (Sftvol)

DRV:64bit: - [2013/06/26 19:21:48 | 000,028,840 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Running] -- C:\Windows\SysNative\drivers\Sftredirlh.sys -- (Sftredir)

DRV:64bit: - [2013/06/26 19:21:46 | 000,273,576 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Sftplaylh.sys -- (Sftplay)

DRV:64bit: - [2013/06/26 19:21:44 | 000,767,144 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Sftfslh.sys -- (Sftfs)

DRV:64bit: - [2012/12/13 13:50:36 | 000,054,784 | ---- | M] (Apple, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\usbaapl64.sys -- (USBAAPL64)

DRV:64bit: - [2012/08/21 14:01:20 | 000,033,240 | ---- | M] (GEAR Software Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\GEARAspiWDM.sys -- (GEARAspiWDM)

DRV:64bit: - [2012/03/01 07:46:16 | 000,023,408 | ---- | M] (Microsoft Corporation) [Recognizer | Boot | Unknown] -- C:\Windows\SysNative\drivers\fs_rec.sys -- (Fs_Rec)

DRV:64bit: - [2011/05/13 03:21:04 | 000,177,640 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ssadmdm.sys -- (ssadmdm)

DRV:64bit: - [2011/05/13 03:21:04 | 000,146,920 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ssadserd.sys -- (ssadserd)

DRV:64bit: - [2011/05/13 03:21:02 | 000,157,672 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ssadbus.sys -- (ssadbus)

DRV:64bit: - [2011/05/13 03:21:02 | 000,036,328 | ---- | M] (Google Inc) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ssadadb.sys -- (androidusb)

DRV:64bit: - [2011/05/13 03:21:02 | 000,016,872 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ssadmdfl.sys -- (ssadmdfl)

DRV:64bit: - [2011/05/09 15:10:00 | 000,020,592 | ---- | M] (Compal Electronics, INC.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\CeKbFilter.sys -- (CeKbFilter)

DRV:64bit: - [2011/04/05 03:10:16 | 012,262,624 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\igdkmd64.sys -- (igfx)

DRV:64bit: - [2011/03/11 07:41:12 | 000,107,904 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata)

DRV:64bit: - [2011/03/11 07:41:12 | 000,027,008 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata)

DRV:64bit: - [2011/02/08 18:07:00 | 000,038,096 | ---- | M] (TOSHIBA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\PGEffect.sys -- (PGEffect)

DRV:64bit: - [2011/02/03 18:59:06 | 001,413,680 | ---- | M] (Synaptics Incorporated) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\SynTP.sys -- (SynTP)

DRV:64bit: - [2011/01/13 19:58:30 | 000,413,800 | ---- | M] (Realtek ) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Rt64win7.sys -- (RTL8167)

DRV:64bit: - [2011/01/12 16:51:44 | 000,439,320 | ---- | M] (Intel Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\iaStor.sys -- (iaStor)

DRV:64bit: - [2010/11/21 04:24:33 | 000,059,392 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbFlt.sys -- (TsUsbFlt)

DRV:64bit: - [2010/11/21 04:23:47 | 000,078,720 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD)

DRV:64bit: - [2010/11/21 04:23:47 | 000,031,232 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbGD.sys -- (TsUsbGD)

DRV:64bit: - [2010/10/19 15:34:26 | 000,056,344 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\HECIx64.sys -- (MEIx64)

DRV:64bit: - [2010/04/28 04:32:20 | 000,932,384 | ---- | M] (Realtek Semiconductor Corporation ) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\rtl8192Ce.sys -- (RTL8192Ce)

DRV:64bit: - [2010/03/22 09:55:20 | 000,046,192 | ---- | M] (COMPAL ELECTRONIC INC.) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\LPCFilter.sys -- (LPCFilter)

DRV:64bit: - [2009/07/30 19:22:04 | 000,027,784 | ---- | M] (TOSHIBA Corporation.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\tdcmdpst.sys -- (tdcmdpst)

DRV:64bit: - [2009/07/14 15:31:18 | 000,026,840 | ---- | M] (TOSHIBA Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\TVALZ_O.SYS -- (TVALZ)

DRV:64bit: - [2009/07/14 02:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs)

DRV:64bit: - [2009/07/14 02:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2)

DRV:64bit: - [2009/07/14 02:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor)

DRV:64bit: - [2009/07/14 01:39:20 | 000,023,040 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\WSDPrint.sys -- (WSDPrintDevice)

DRV:64bit: - [2009/07/14 01:35:32 | 000,012,288 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\serscan.sys -- (StillCam)

DRV:64bit: - [2009/06/24 14:36:48 | 000,482,384 | ---- | M] (TOSHIBA Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\tos_sps64.sys -- (tos_sps64)

DRV:64bit: - [2009/06/20 03:09:57 | 001,394,688 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\athrx.sys -- (athr)

DRV:64bit: - [2009/06/10 21:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv)

DRV:64bit: - [2009/06/10 21:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv)

DRV:64bit: - [2009/06/10 21:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a)

DRV:64bit: - [2009/06/10 21:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir)

DRV - [2009/07/14 02:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE:64bit: - HKLM\..\SearchScopes,DefaultScope =

IE:64bit: - HKLM\..\SearchScopes\{29E7B6D0-0DA9-4C04-81E6-5ACCBC713E74}: "URL" = http://www.bing.com/...rc=IE-SearchBox

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm

IE - HKLM\..\SearchScopes,Backup.Old.DefaultScope = {9BB47C17-9C68-4BB3-B188-DD9AF0FD2406}

IE - HKLM\..\SearchScopes,DefaultScope =

IE - HKLM\..\SearchScopes\{6A83BC61-35DA-49C2-810F-8D3464535C4A}: "URL" = http://www.bing.com/...rc=IE-SearchBox

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://toshiba.msn.com

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.google.com/ie

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = http://www.google.com/ie

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.google.com

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchDefaultBranded = 1

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Secondary Start Pages = http://search.conduit.com/?gd=&cti [Binary data over 200 bytes]

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://ie.msn.com/?p...97&ocid=UP97DHP

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = http://www.google.com/ie

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ie

IE - HKCU\..\URLSearchHook: {7473b6bd-4691-4744-a82b-7854eb3d70b6} - No CLSID value found

IE - HKCU\..\SearchScopes,Backup.Old.DefaultScope = {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}

IE - HKCU\..\SearchScopes,DefaultScope = {87F980E4-059E-490A-BB86-D2740E44185F}

IE - HKCU\..\SearchScopes\{64718D15-4E7C-4385-AE4B-656A0AFB90FE}: "URL" = http://www.bing.com/...rc=IE-SearchBox

IE - HKCU\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://www.google.com/search?q={sear

IE - HKCU\..\SearchScopes\{87F980E4-059E-490A-BB86-D2740E44185F}: "URL" = http://www.bing.com/...rc=IE-SearchBox

IE - HKCU\..\SearchScopes\{8DBC303B-C20B-4A8C-9441-0CF7CEE5AD1F}: "URL" = http://www.amazon.co...ed&linkCode=ur2

IE - HKCU\..\SearchScopes\{A30834C6-8411-4C31-ABAD-AC423646CA1C}: "URL" = http://rover.ebay.co...e={searchTerms}

IE - HKCU\..\SearchScopes\{DE2D1802-0D0C-4ED0-B319-AE88EA7CEE03}: "URL" = http://www.google.co...ie=utf8&oe=utf8

IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

========== FireFox ==========

FF - prefs.js..browser.search.defaultenginename: "Bing "

FF - prefs.js..browser.search.defaultenginename,S: S", ""

FF - prefs.js..browser.search.defaultthis.engineName: ""

FF - prefs.js..browser.search.defaulturl: ""

FF - prefs.js..browser.search.order.1: ""

FF - prefs.js..browser.search.order.1,S: S", ""

FF - prefs.js..browser.search.selectedEngine: "Bing "

FF - prefs.js..browser.search.selectedEngine,S: S", ""

FF - prefs.js..browser.search.useDBForOrder: true

FF - prefs.js..extensions.enabledAddons: [email protected]:3.2.3

FF - prefs.js..extensions.enabledAddons: {DF153AFF-6948-45d7-AC98-4FC4AF8A08E2}:1.3.3

FF - prefs.js..extensions.enabledAddons: 5a6bf058-b978-4b84-a2ec-6f5462cfccb2@10120365-d3c0-4ec9-8624-5fac2592d0df.com:0.94.33

FF - prefs.js..network.proxy.socks_remote_dns: true

FF - prefs.js..network.proxy.type: 0

FF - prefs.js..browser.search.order.3: "Bing "

FF - prefs.js..keyword.URL: "http://www.bing.com/...7DF&PC=UP97&q="

FF - prefs.js..browser.startup.homepage: "http://ie.msn.com/?p...7&ocid=UP97DHP"

FF - user.js - File not found

FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_13_0_0_214.dll File not found

FF:64bit: - HKLM\Software\MozillaPlugins\@divx.com/DivX VOD Helper,version=1.0.0: C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)

FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found

FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_13_0_0_214.dll ()

FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found

FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()

FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)

FF - HKLM\Software\MozillaPlugins\@divx.com/DivX VOD Helper,version=1.0.0: C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)

FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)

FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found

FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~2\MICROS~4\Office14\NPAUTHZ.DLL (Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\PROGRA~2\MICROS~4\Office14\NPSPWRAP.DLL (Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll File not found

FF - HKLM\Software\MozillaPlugins\@real.com/nppl3260;version=16.0.3.51: c:\program files (x86)\real\realplayer\Netscape6\nppl3260.dll (RealNetworks, Inc.)

FF - HKLM\Software\MozillaPlugins\@real.com/nprndlchromebrowserrecordext;version=1.3.3: C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlchromebrowserrecordext.dll (RealNetworks, Inc.)

FF - HKLM\Software\MozillaPlugins\@real.com/nprndlhtml5videoshim;version=1.3.3: C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlhtml5videoshim.dll (RealNetworks, Inc.)

FF - HKLM\Software\MozillaPlugins\@real.com/nprndlpepperflashvideoshim;version=1.3.3: C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlpepperflashvideoshim.dll (RealNetworks, Inc.)

FF - HKLM\Software\MozillaPlugins\@real.com/nprpplugin;version=16.0.3.51: c:\program files (x86)\real\realplayer\Netscape6\nprpplugin.dll (RealPlayer)

FF - HKLM\Software\MozillaPlugins\@realnetworks.com/npdlplugin;version=1: C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\npdlplugin.dll (RealDownloader)

FF - HKLM\Software\MozillaPlugins\@rocketlife.com/RocketLife Secure Plug-In Layer;version=1.0.5: C:\ProgramData\Visan\plugins\npRLSecurePluginLayer.dll (RocketLife, LLP)

FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.24.7\npGoogleUpdate3.dll (Google Inc.)

FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.24.7\npGoogleUpdate3.dll (Google Inc.)

FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Users\Lisa\AppData\Local\Google\Update\1.3.24.7\npGoogleUpdate3.dll (Google Inc.)

FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Users\Lisa\AppData\Local\Google\Update\1.3.24.7\npGoogleUpdate3.dll (Google Inc.)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{23fcfd51-4958-4f00-80a3-ae97e717ed8b}: C:\Program Files (x86)\DivX\DivX Plus Web Player\firefox\DivXHTML5 [2012/03/30 22:14:06 | 000,000,000 | ---D | M]

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{97E22097-9A2F-45b1-8DAF-36AD648C7EF4}: C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{ABDE892B-13A8-4d1b-88E6-365A6E755758}: C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Firefox\Ext [2013/11/30 18:29:15 | 000,000,000 | ---D | M]

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{DF153AFF-6948-45d7-AC98-4FC4AF8A08E2}: C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Firefox\Ext\ [2013/11/30 18:29:15 | 000,000,000 | ---D | M]

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 10.0.2\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2014/02/26 11:17:02 | 000,000,000 | ---D | M]

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 10.0.2\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2014/05/17 17:24:02 | 000,000,000 | ---D | M]

[2011/12/10 21:11:59 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Lisa\AppData\Roaming\Mozilla\Extensions

[2014/04/13 21:02:12 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Lisa\AppData\Roaming\Mozilla\Firefox\Profiles\kug0zld3.default\extensions

[2014/04/10 18:47:31 | 000,000,000 | ---D | M] ("GoPhoto.it V9.0") -- C:\Users\Lisa\AppData\Roaming\Mozilla\Firefox\Profiles\kug0zld3.default\extensions\2ea36bf1-0877-4aaa-882c-ff78f7d9d95c@dfb1672d-116a-4eb4-8be0-44786bd1d3dd.com

[2012/09/23 10:13:48 | 000,000,000 | ---D | M] (wxDownload) -- C:\Users\Lisa\AppData\Roaming\Mozilla\Firefox\Profiles\kug0zld3.default\extensions\[email protected]

[2013/11/05 18:09:05 | 000,000,000 | ---D | M] (FoxyProxy Standard) -- C:\Users\Lisa\AppData\Roaming\Mozilla\Firefox\Profiles\kug0zld3.default\extensions\[email protected]

[2012/11/07 21:09:17 | 000,000,000 | ---D | M] (Lavasoft Search Plugin) -- C:\Users\Lisa\AppData\Roaming\Mozilla\Firefox\Profiles\kug0zld3.default\extensions\jid1-yZwVFzbsyfMrqQ@jetpack

[2014/04/10 18:47:29 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Lisa\AppData\Roaming\Mozilla\Firefox\Profiles\kug0zld3.default\extensions\2ea36bf1-0877-4aaa-882c-ff78f7d9d95c@dfb1672d-116a-4eb4-8be0-44786bd1d3dd.com\extensionData

[2014/04/10 18:47:28 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Lisa\AppData\Roaming\Mozilla\Firefox\Profiles\kug0zld3.default\extensions\2ea36bf1-0877-4aaa-882c-ff78f7d9d95c@dfb1672d-116a-4eb4-8be0-44786bd1d3dd.com\extensionData\plugins

[2012/10/13 19:34:19 | 000,189,644 | ---- | M] () (No name found) -- C:\Users\Lisa\AppData\Roaming\Mozilla\Firefox\Profiles\kug0zld3.default\extensions\[email protected]

[2014/05/25 13:06:41 | 000,006,057 | ---- | M] () -- C:\Users\Lisa\AppData\Roaming\Mozilla\Firefox\Profiles\kug0zld3.default\searchplugins\bingp.xml

[2013/08/15 17:36:30 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\Mozilla Firefox\extensions

[2014/05/25 13:08:08 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\Mozilla Firefox\browser\extensions

[2013/11/30 18:29:15 | 000,000,000 | ---D | M] (RealDownloader) -- C:\PROGRAMDATA\REALNETWORKS\REALDOWNLOADER\BROWSERPLUGINS\FIREFOX\EXT

File not found (No name found) -- C:\USERS\LISA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\KUG0ZLD3.DEFAULT\EXTENSIONS\5A6BF058-B978-4B84-A2EC-6F5462CFCCB2@10120365-D3C0-4EC9-8624-5FAC2592D0DF.COM

[2012/02/27 19:43:36 | 000,134,104 | ---- | M] (Mozilla Foundation) -- C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll

[2010/07/07 14:12:08 | 000,024,376 | ---- | M] (McAfee, Inc.) -- C:\Program Files (x86)\mozilla firefox\components\Scriptff.dll

[2013/11/30 18:28:05 | 000,124,504 | ---- | M] (RealPlayer) -- C:\Program Files (x86)\mozilla firefox\plugins\nprpplugin.dll

[2012/02/27 19:43:34 | 000,001,538 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\amazon-en-GB.xml

[2012/02/27 19:43:34 | 000,002,252 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml

[2012/02/27 19:43:34 | 000,000,947 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\chambers-en-GB.xml

[2012/02/27 19:43:34 | 000,001,180 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-en-GB.xml

[2012/02/27 19:43:34 | 000,001,135 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-en-GB.xml

========== Chrome ==========

CHR - default_search_provider: Google (Enabled)

CHR - default_search_provider: search_url = {google:baseURL}search?q={searchTerms}&{google:RLZ}{google:originalQueryForSuggestion}{google:assistedQueryStats}{google:searchFieldtrialParameter}{google:bookmarkBarPinned}{google:searchClient}{google:sourceId}{google:instantExtendedEnabledParameter}{google:omniboxStartMarginParameter}ie={inputEncoding}

CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client={google:suggestClient}&gs_ri={google:suggestRid}&xssi=t&q={searchTerms}&{google:cursorPosition}{google:currentPageUrl}{google:pageClassification}sugkey={google:suggestAPIKeyParameter},

CHR - homepage: file:///C:/Users/Lisa/Desktop/CERC%20July%202013/DAN%20O%20DONAVAN

CHR - plugin: Remoting Viewer (Enabled) = internal-remoting-viewer

CHR - plugin: Native Client (Enabled) = C:\Program Files (x86)\Google\Chrome\Application\35.0.1916.114\ppGoogleNaClPluginChrome.dll

CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Program Files (x86)\Google\Chrome\Application\35.0.1916.114\pdf.dll

CHR - plugin: Shockwave Flash (Enabled) = C:\Program Files (x86)\Google\Chrome\Application\35.0.1916.114\gcswf32.dll

CHR - plugin: Shockwave Flash (Enabled) = C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll

CHR - plugin: Skype Toolbars (Enabled) = C:\Users\Lisa\AppData\Local\Google\Chrome\User Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl\5.9.0.9216_0\npSkypeChromePlugin.dll

CHR - plugin: Adobe Acrobat (Disabled) = C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll

CHR - plugin: Java Deployment Toolkit 6.0.300.12 (Enabled) = C:\Program Files (x86)\Java\jre6\bin\new_plugin\npdeployJava1.dll

CHR - plugin: Java™ Platform SE 6 U30 (Enabled) = C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll

CHR - plugin: Coupons Inc., Coupon Printer Manager (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npCouponPrinter.dll

CHR - plugin: Coupons Inc., Coupon Printer Manager (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npMozCouponPrinter.dll

CHR - plugin: RealPlayer™ G2 LiveConnect-Enabled Plug-In (32-bit) (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\nppl3260.dll

CHR - plugin: RealPlayer Version Plugin (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\nprpjplug.dll

CHR - plugin: RealPlayer™ HTML5VideoShim Plug-In (32-bit) (Enabled) = C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll

CHR - plugin: QuickTime Plug-in 7.7.1 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin.dll

CHR - plugin: QuickTime Plug-in 7.7.1 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin2.dll

CHR - plugin: QuickTime Plug-in 7.7.1 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin3.dll

CHR - plugin: QuickTime Plug-in 7.7.1 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin4.dll

CHR - plugin: QuickTime Plug-in 7.7.1 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin5.dll

CHR - plugin: QuickTime Plug-in 7.7.1 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin6.dll

CHR - plugin: QuickTime Plug-in 7.7.1 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin7.dll

CHR - plugin: RealJukebox NS Plugin (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\nprjplug.dll

CHR - plugin: Microsoft Office 2010 (Enabled) = C:\PROGRA~2\MICROS~4\Office14\NPSPWRAP.DLL

CHR - plugin: DivX VOD Helper Plug-in (Enabled) = C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll

CHR - plugin: DivX Plus Web Player (Enabled) = C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll

CHR - plugin: Google Update (Enabled) = C:\Program Files (x86)\Google\Update\1.3.21.111\npGoogleUpdate3.dll

CHR - plugin: Silverlight Plug-In (Enabled) = C:\Program Files (x86)\Microsoft Silverlight\4.1.10329.0\npctrl.dll

CHR - plugin: Veetle TV Player (Enabled) = C:\Program Files (x86)\Veetle\Player\npvlc.dll

CHR - plugin: Veetle TV Core (Enabled) = C:\Program Files (x86)\Veetle\plugins\npVeetle.dll

CHR - plugin: WildTangent Games App Presence Detector (Enabled) = C:\Program Files (x86)\WildTangent Games\App\BrowserIntegration\Registered\3\NP_wtapp.dll

CHR - plugin: Windows LiveÂ™ Photo Gallery (Enabled) = C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll

CHR - plugin: iTunes Application Detector (Enabled) = C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll

CHR - plugin: RealNetworks™ Chrome Background Extension Plug-In (32-bit) (Enabled) = C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprpchromebrowserrecordext.dll

CHR - Extension: Google Drive = C:\Users\Lisa\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.3_0\

CHR - Extension: Surf Canyon = C:\Users\Lisa\AppData\Local\Google\Chrome\User Data\Default\Extensions\bcjagnifjocnddgeknajocbkkhlgibem\5.2.2_0\

CHR - Extension: Google Voice Search Hotword (Beta) = C:\Users\Lisa\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn\0.1.1.5019_0\

CHR - Extension: YouTube = C:\Users\Lisa\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_1\

CHR - Extension: GoPhoto.it V9.0 = C:\Users\Lisa\AppData\Local\Google\Chrome\User Data\Default\Extensions\ccfjbdjailljfihgkoccfbiljjapiijb\1.26.219_0\crossrider

CHR - Extension: GoPhoto.it V9.0 = C:\Users\Lisa\AppData\Local\Google\Chrome\User Data\Default\Extensions\ccfjbdjailljfihgkoccfbiljjapiijb\1.26.219_0\

CHR - Extension: Google Search = C:\Users\Lisa\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_1\

CHR - Extension: Online HD TV = C:\Users\Lisa\AppData\Local\Google\Chrome\User Data\Default\Extensions\dkinklhnkmkhkhofcnapakaoehijaoih\1.9_0\

CHR - Extension: Google+ = C:\Users\Lisa\AppData\Local\Google\Chrome\User Data\Default\Extensions\dlppkpafhbajpcmmoheippocdidnckmm\1.0.1.424_0\

CHR - Extension: DoNotTrackMe: Online Privacy Protection = C:\Users\Lisa\AppData\Local\Google\Chrome\User Data\Default\Extensions\epanfjkfahimkgomnigadpkobaefekcd\3.2.1108_0\

CHR - Extension: No name found = C:\Users\Lisa\AppData\Local\Google\Chrome\User Data\Default\Extensions\fahmaaghhglfmonjliepjlchgpgfmobi\1.213.1_0\

CHR - Extension: AdBlock Premium = C:\Users\Lisa\AppData\Local\Google\Chrome\User Data\Default\Extensions\fndlhnanhedoklpdaacidomdnplcjcpj\2.6.4.3_0\

CHR - Extension: AdBlock = C:\Users\Lisa\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom\2.6.34_0\

CHR - Extension: RealDownloader = C:\Users\Lisa\AppData\Local\Google\Chrome\User Data\Default\Extensions\idhngdhcfkoamngbedgpaokgjbnpdiji\1.3.3_0\

CHR - Extension: Wheels On Fire = C:\Users\Lisa\AppData\Local\Google\Chrome\User Data\Default\Extensions\lmnbobhffedhdhfpcjkjphcfpeeiocdn\1.0.0_0\

CHR - Extension: Google Maps = C:\Users\Lisa\AppData\Local\Google\Chrome\User Data\Default\Extensions\lneaknkopdijkpnocmklfnjbeapigfbh\5.2.7_0\

CHR - Extension: Google Wallet = C:\Users\Lisa\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.6.1_0\

CHR - Extension: DivX Plus Web Player HTML5 \u003Cvideo> = C:\Users\Lisa\AppData\Local\Google\Chrome\User Data\Default\Extensions\nneajnkjbffgblleaoojgaacokifdkhm\2.1.2.145_0\

CHR - Extension: Gmail = C:\Users\Lisa\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_1\

O1 HOSTS File: ([2012/11/26 22:07:03 | 000,000,098 | ---- | M]) - C:\Windows\SysNative\drivers\etc\Hosts

O1 - Hosts: 127.0.0.1 localhost

O1 - Hosts: ::1 localhost

O2:64bit: - BHO: (GoPhoto.it V9.0) - {11111111-1111-1111-1111-110311401168} - C:\Program Files (x86)\GoPhoto.it V9.0\GoPhoto.it V9.0-bho64.dll (installdaddy)

O2:64bit: - BHO: (Skype add-on for Internet Explorer) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\SkypeIEPlugin.dll (Microsoft Corporation)

O2 - BHO: (GoPhoto.it V9.0) - {11111111-1111-1111-1111-110311401168} - C:\Program Files (x86)\GoPhoto.it V9.0\GoPhoto.it V9.0-bho.dll (installdaddy)

O2 - BHO: (RealNetworks Download and Record Plugin for Internet Explorer) - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\IE\rndlbrowserrecordplugin.dll (RealDownloader)

O2 - BHO: (DivX Plus Web Player HTML5 <video>) - {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Program Files (x86)\DivX\DivX Plus Web Player\ie\DivXHTML5\DivXHTML5.dll (DivX, LLC)

O2 - BHO: (Fast Search) - {5AB7104A-B71F-49AD-9154-F7F8806AE848} - C:\Program Files (x86)\Surf Canyon\surfcanyon.dll (Surf Canyon Incorporated)

O2 - BHO: (Skype Browser Helper) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Microsoft Corporation)

O2 - BHO: (TOSHIBA Media Controller Plug-in) - {F3C88694-EFFA-4d78-B409-54B7B2535B14} - C:\Program Files (x86)\TOSHIBA\TOSHIBA Media Controller Plug-in\TOSHIBAMediaControllerIE.dll (<TOSHIBA>)

O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {7473B6BD-4691-4744-A82B-7854EB3D70B6} - No CLSID value found.

O4:64bit: - HKLM..\Run: [HotKeysCmds] C:\Windows\SysNative\hkcmd.exe (Intel Corporation)

O4:64bit: - HKLM..\Run: [IgfxTray] C:\Windows\SysNative\igfxtray.exe (Intel Corporation)

O4:64bit: - HKLM..\Run: [MSC] C:\Program Files\Microsoft Security Client\msseces.exe (Microsoft Corporation)

O4:64bit: - HKLM..\Run: [Persistence] C:\Windows\SysNative\igfxpers.exe (Intel Corporation)

O4:64bit: - HKLM..\Run: [SBRegRebootCleaner] "C:\Program Files (x86)\Ad-Aware Antivirus\SBRC.exe" File not found

O4:64bit: - HKLM..\Run: [TCrdMain] C:\Program Files\TOSHIBA\FlashCards\TCrdMain.exe (TOSHIBA Corporation)

O4:64bit: - HKLM..\Run: [Toshiba Registration] C:\Program Files\TOSHIBA\Registration\ToshibaReminder.exe (Toshiba Europe GmbH)

O4:64bit: - HKLM..\Run: [Toshiba TEMPRO] C:\Program Files (x86)\Toshiba TEMPRO\TemproTray.exe (Toshiba Europe GmbH)

O4:64bit: - HKLM..\Run: [TosNC] C:\Program Files\TOSHIBA\BulletinBoard\TosNcCore.exe (TOSHIBA Corporation)

O4:64bit: - HKLM..\Run: [TosReelTimeMonitor] C:\Program Files\TOSHIBA\ReelTime\TosReelTimeMonitor.exe (TOSHIBA Corporation)

O4:64bit: - HKLM..\Run: [TosSENotify] C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosWaitSrv.exe (TOSHIBA Corporation)

O4:64bit: - HKLM..\Run: [TosVolRegulator] C:\Program Files\TOSHIBA\TosVolRegulator\TosVolRegulator.exe (TOSHIBA Corporation)

O4:64bit: - HKLM..\Run: [TPwrMain] C:\Program Files\TOSHIBA\Power Saver\TPwrMain.exe (TOSHIBA Corporation)

O4 - HKLM..\Run: [Ad-Aware Browsing Protection] C:\ProgramData\Ad-Aware Browsing Protection\adawarebp.exe (Lavasoft)

O4 - HKLM..\Run: [Adobe Reader Speed Launcher] "C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Reader_sl.exe" File not found

O4 - HKLM..\Run: [APSDaemon] C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)

O4 - HKLM..\Run: [DivXUpdate] C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe ()

O4 - HKLM..\Run: [HWSetup] C:\Program Files\TOSHIBA\Utilities\HWSetup.exe (TOSHIBA Electronics, Inc.)

O4 - HKLM..\Run: [KeNotify] C:\Program Files (x86)\TOSHIBA\Utilities\KeNotify.exe (TOSHIBA CORPORATION)

O4 - HKLM..\Run: [SVPWUTIL] C:\Program Files (x86)\TOSHIBA\Utilities\SVPWUTIL.exe (TOSHIBA CORPORATION)

O4 - HKLM..\Run: [TkBellExe] C:\Program Files (x86)\Real\RealPlayer\update\realsched.exe (RealNetworks, Inc.)

O4 - HKLM..\Run: [ToshibaServiceStation] C:\Program Files (x86)\TOSHIBA\TOSHIBA Service Station\ToshibaServiceStation.exe (TOSHIBA Corporation)

O4 - HKCU..\Run: [3309D5F84347009DE648571E504BA7F8F4647E7A._service_run] C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.)

O4 - HKCU..\Run: [ApplePhotoStreams] C:\Program Files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe (Apple Inc.)

O4 - HKCU..\Run: [GoogleDriveSync] C:\Program Files (x86)\Google\Drive\googledrivesync.exe (Google)

O4 - HKCU..\Run: [iCloudServices] C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe (Apple Inc.)

O4 - HKCU..\Run: [MobileDocuments] C:\Program Files (x86)\Common Files\Apple\Internet Services\ubd.exe File not found

O4 - HKCU..\Run: [MusicManager] C:\Users\Lisa\AppData\Local\Programs\Google\MusicManager\MusicManager.exe (Google Inc.)

O4 - HKCU..\Run: [TOPI.EXE] C:\Program Files (x86)\TOSHIBA\TOSHIBA Online Product Information\topi.exe (TOSHIBA)

O4 - HKCU..\Run: [uTorrent] C:\Users\Lisa\AppData\Roaming\uTorrent\uTorrent.exe (BitTorrent Inc.)

O4 - Startup: C:\Users\Lisa\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk = C:\Users\Lisa\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)

O4 - Startup: C:\Users\Lisa\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\EvernoteClipper.lnk = C:\Program Files (x86)\Evernote\Evernote\EvernoteClipper.exe (Evernote Corp., 333 W Evelyn Ave. Mountain View, CA 94041)

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3

O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145

O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableLockWorkstation = 0

O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: LogonHoursAction = 2

O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DontDisplayLogonHoursWarnings = 1

O8:64bit: - Extra context menu item: Add to Evernote 4.0 - C:\Program Files (x86)\Evernote\Evernote\EvernoteIE.dll (Evernote Corp., 333 W Evelyn Ave. Mountain View, CA 94041)

O8:64bit: - Extra context menu item: Add to TOSHIBA Bulletin Board - C:\Program Files\TOSHIBA\BulletinBoard\TosBBCom.dll (TODO: <会社名>)

O8 - Extra context menu item: Add to Evernote 4.0 - C:\Program Files (x86)\Evernote\Evernote\EvernoteIE.dll (Evernote Corp., 333 W Evelyn Ave. Mountain View, CA 94041)

O8 - Extra context menu item: Add to TOSHIBA Bulletin Board - C:\Program Files\TOSHIBA\BulletinBoard\TosBBCom.dll (TODO: <会社名>)

O9:64bit: - Extra Button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\SkypeIEPlugin.dll (Microsoft Corporation)

O9 - Extra Button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Microsoft Corporation)

O9 - Extra Button: @C:\Program Files (x86)\Evernote\Evernote\Resource.dll,-101 - {A95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\Program Files (x86)\Evernote\Evernote\EvernoteIE.dll (Evernote Corp., 333 W Evelyn Ave. Mountain View, CA 94041)

O9 - Extra 'Tools' menuitem : @C:\Program Files (x86)\Evernote\Evernote\Resource.dll,-101 - {A95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\Program Files (x86)\Evernote\Evernote\EvernoteIE.dll (Evernote Corp., 333 W Evelyn Ave. Mountain View, CA 94041)

O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000007 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)

O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)

O1364bit: - gopher Prefix: missing

O13 - gopher Prefix: missing

O16 - DPF: {62789780-B744-11D0-986B-00609731A21D} http://planenquiry.c...ad/mgaxctrl.cab (Autodesk MapGuide ActiveX Control)

O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 89.101.160.5 89.101.160.4

O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{B4AF281B-F806-46C8-8A3E-333914F2DB49}: DhcpNameServer = 89.101.160.5 89.101.160.4

O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{BEEFB0CB-BB1B-4920-B6DE-F08C76D5D0CE}: DhcpNameServer = 192.168.219.3

O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{D49DCB1D-7609-4E33-A4BE-FA1E10FEFD91}: DhcpNameServer = 172.20.10.1

O18:64bit: - Protocol\Handler\ms-help - No CLSID value found

O18:64bit: - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\SkypeIEPlugin.dll (Microsoft Corporation)

O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Microsoft Corporation)

O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)

O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)

O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)

O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\SysWow64\userinit.exe (Microsoft Corporation)

O20:64bit: - Winlogon\Notify\igfxcui: DllName - (igfxdev.dll) - C:\Windows\SysNative\igfxdev.dll (Intel Corporation)

O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.

O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.

O32 - HKLM CDRom: AutoRun - 1

O33 - MountPoints2\{7114ee9e-0035-11e2-9d4d-b870f45de2ac}\Shell - "" = AutoRun

O33 - MountPoints2\{7114ee9e-0035-11e2-9d4d-b870f45de2ac}\Shell\AutoRun\command - "" = F:\AutoRun.exe

O33 - MountPoints2\{7114eea1-0035-11e2-9d4d-b870f45de2ac}\Shell - "" = AutoRun

O33 - MountPoints2\{7114eea1-0035-11e2-9d4d-b870f45de2ac}\Shell\AutoRun\command - "" = G:\AutoRun.exe

O33 - MountPoints2\{f6a99523-34e5-11e2-b2fa-b870f45de2ac}\Shell - "" = AutoRun

O33 - MountPoints2\{f6a99523-34e5-11e2-b2fa-b870f45de2ac}\Shell\AutoRun\command - "" = F:\PcOptions.exe

O33 - MountPoints2\{f92e7fa3-5b63-11e2-9bcf-b870f45de2ac}\Shell - "" = AutoRun

O33 - MountPoints2\{f92e7fa3-5b63-11e2-9bcf-b870f45de2ac}\Shell\AutoRun\command - "" = G:\AutoRun.exe

O33 - MountPoints2\{f92e7fc3-5b63-11e2-9bcf-b870f45de2ac}\Shell - "" = AutoRun

O33 - MountPoints2\{f92e7fc3-5b63-11e2-9bcf-b870f45de2ac}\Shell\AutoRun\command - "" = G:\AutoRun.exe

O33 - MountPoints2\{f92e8076-5b63-11e2-9bcf-b870f45de2ac}\Shell - "" = AutoRun

O33 - MountPoints2\{f92e8076-5b63-11e2-9bcf-b870f45de2ac}\Shell\AutoRun\command - "" = G:\AutoRun.exe

O33 - MountPoints2\{fb849760-0419-11e2-b690-b870f45de2ac}\Shell - "" = AutoRun

O33 - MountPoints2\{fb849760-0419-11e2-b690-b870f45de2ac}\Shell\AutoRun\command - "" = G:\AutoRun.exe

O33 - MountPoints2\F\Shell - "" = AutoRun

O33 - MountPoints2\F\Shell\AutoRun\command - "" = F:\AutoRun.exe

O34 - HKLM BootExecute: (autocheck autochk *)

O35:64bit: - HKLM\..comfile [open] -- "%1" %*

O35:64bit: - HKLM\..exefile [open] -- "%1" %*

O35 - HKLM\..comfile [open] -- "%1" %*

O35 - HKLM\..exefile [open] -- "%1" %*

O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*

O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*

O37 - HKLM\...com [@ = comfile] -- "%1" %*

O37 - HKLM\...exe [@ = exefile] -- "%1" %*

O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)

O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)

O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)

========== Files/Folders - Created Within 30 Days ==========

[2014/05/25 13:05:35 | 000,000,000 | ---D | C] -- C:\Users\Lisa\AppData\Local\Skype

[2014/05/25 13:05:19 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype

[2014/05/25 13:05:18 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Skype

[2014/05/25 13:05:16 | 000,000,000 | R--D | C] -- C:\Program Files (x86)\Skype

[2014/05/20 16:08:45 | 000,000,000 | ---D | C] -- C:\Users\Lisa\Desktop\IPHONE PICS

[2014/05/18 22:29:53 | 000,000,000 | ---D | C] -- C:\Users\Lisa\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Music Manager

[2014/05/18 22:25:53 | 000,000,000 | ---D | C] -- C:\Users\Lisa\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps

[2014/05/18 21:39:37 | 000,000,000 | R--D | C] -- C:\Users\Lisa\Google Drive

[2014/05/18 20:03:30 | 000,000,000 | R--D | C] -- C:\Users\Lisa\Dropbox

[2014/05/18 20:01:41 | 000,000,000 | ---D | C] -- C:\Users\Lisa\AppData\Roaming\DropboxMaster

[2014/05/18 20:01:19 | 000,000,000 | ---D | C] -- C:\Users\Lisa\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox

[2014/05/17 09:38:12 | 000,000,000 | ---D | C] -- C:\Users\Lisa\Desktop\Xaviar

[2014/05/14 03:08:11 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\DESIGNER

[2014/05/13 21:57:27 | 000,000,000 | -HSD | C] -- C:\Users\Lisa\AppData\Local\EmieUserList

[2014/05/13 21:57:27 | 000,000,000 | -HSD | C] -- C:\Users\Lisa\AppData\Local\EmieSiteList

[2014/05/08 20:57:54 | 000,000,000 | --SD | C] -- C:\Windows\SysNative\CompatTel

[3 C:\Windows\SysWow64\*.tmp files -> C:\Windows\SysWow64\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2014/05/26 18:00:01 | 000,000,830 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job

[2014/05/26 17:45:00 | 000,000,894 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job

[2014/05/26 17:34:00 | 000,000,904 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-3734433013-2235189305-930175613-1000UA.job

[2014/05/26 12:52:04 | 000,002,780 | ---- | M] () -- C:\Windows\tasks\3acf9a70-1a99-4e96-962c-fb7ed7f05265-3.job

[2014/05/26 12:47:09 | 000,001,438 | ---- | M] () -- C:\Windows\tasks\3acf9a70-1a99-4e96-962c-fb7ed7f05265-5.job

[2014/05/26 12:47:03 | 000,002,126 | ---- | M] () -- C:\Windows\tasks\3acf9a70-1a99-4e96-962c-fb7ed7f05265-4.job

[2014/05/26 12:47:01 | 000,001,330 | ---- | M] () -- C:\Windows\tasks\3acf9a70-1a99-4e96-962c-fb7ed7f05265-2.job

[2014/05/26 12:47:00 | 000,001,366 | ---- | M] () -- C:\Windows\tasks\3acf9a70-1a99-4e96-962c-fb7ed7f05265-1.job

[2014/05/26 09:09:09 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat

[2014/05/26 05:06:16 | 000,000,852 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-3734433013-2235189305-930175613-1000Core.job

[2014/05/25 18:45:00 | 000,000,890 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job

[2014/05/25 13:05:19 | 000,002,515 | ---- | M] () -- C:\Users\Public\Desktop\Skype.lnk

[2014/05/23 23:04:40 | 000,792,556 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI

[2014/05/23 23:04:40 | 000,672,026 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat

[2014/05/23 23:04:40 | 000,131,220 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat

[2014/05/23 07:53:48 | 000,025,120 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

[2014/05/23 07:53:48 | 000,025,120 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

[2014/05/23 07:45:58 | 001,179,648 | ---- | M] () -- C:\Windows\SysNative\Ikeext.etl

[2014/05/23 07:45:38 | 3148,685,312 | -HS- | M] () -- C:\hiberfil.sys

[2014/05/18 21:39:38 | 000,001,703 | ---- | M] () -- C:\Users\Lisa\Desktop\Google Drive.lnk

[2014/05/18 20:03:30 | 000,001,047 | ---- | M] () -- C:\Users\Lisa\Desktop\Dropbox.lnk

[2014/05/18 20:01:48 | 000,001,057 | ---- | M] () -- C:\Users\Lisa\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk

[2014/05/14 08:12:52 | 000,000,632 | RHS- | M] () -- C:\Users\Lisa\ntuser.pol

[2014/05/12 18:57:06 | 000,000,859 | ---- | M] () -- C:\Users\Lisa\Desktop\µTorrent.lnk

[2014/05/12 18:57:06 | 000,000,839 | ---- | M] () -- C:\Users\Lisa\Application Data\Microsoft\Internet Explorer\Quick Launch\µTorrent.lnk

[2014/05/09 12:35:38 | 000,000,000 | -H-- | M] () -- C:\Windows\SysNative\drivers\Msft_Kernel_netaapl64_01009.Wdf

[2014/05/07 07:52:13 | 000,002,009 | ---- | M] () -- C:\Users\Public\Desktop\Google Slides.lnk

[2014/05/07 07:52:13 | 000,002,007 | ---- | M] () -- C:\Users\Public\Desktop\Google Sheets.lnk

[2014/05/07 07:52:13 | 000,001,997 | ---- | M] () -- C:\Users\Public\Desktop\Google Docs.lnk

[3 C:\Windows\SysWow64\*.tmp files -> C:\Windows\SysWow64\*.tmp -> ]

========== Files Created - No Company Name ==========

[2014/05/25 13:05:19 | 000,002,515 | ---- | C] () -- C:\Users\Public\Desktop\Skype.lnk

[2014/05/18 22:29:20 | 000,000,904 | ---- | C] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-3734433013-2235189305-930175613-1000UA.job

[2014/05/18 22:29:19 | 000,000,852 | ---- | C] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-3734433013-2235189305-930175613-1000Core.job

[2014/05/18 21:39:38 | 000,001,703 | ---- | C] () -- C:\Users\Lisa\Desktop\Google Drive.lnk

[2014/05/18 20:03:30 | 000,001,047 | ---- | C] () -- C:\Users\Lisa\Desktop\Dropbox.lnk

[2014/05/18 20:01:48 | 000,001,057 | ---- | C] () -- C:\Users\Lisa\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk

[2014/05/09 12:35:38 | 000,000,000 | -H-- | C] () -- C:\Windows\SysNative\drivers\Msft_Kernel_netaapl64_01009.Wdf

[2014/01/19 12:50:19 | 000,001,195 | ---- | C] () -- C:\Users\Lisa\Downloads - Shortcut.lnk

[2013/11/09 15:28:19 | 000,205,861 | ---- | C] () -- C:\Windows\hpoins46.dat

[2013/11/09 15:28:19 | 000,000,532 | ---- | C] () -- C:\Windows\hpomdl46.dat

[2012/10/18 11:04:28 | 000,000,632 | RHS- | C] () -- C:\Users\Lisa\ntuser.pol

[2012/01/17 22:54:48 | 000,076,055 | ---- | C] () -- C:\Users\Lisa\bucks_of_oranmore.pdf

[2012/01/11 22:39:49 | 000,007,641 | ---- | C] () -- C:\Users\Lisa\AppData\Local\Resmon.ResmonCfg

[2011/12/10 21:37:20 | 000,000,000 | ---- | C] () -- C:\Users\Lisa\.gtk-bookmarks

[2011/12/10 21:32:48 | 000,568,248 | ---- | C] () -- C:\Users\Lisa\.fonts.cache-1

[2011/12/04 13:02:07 | 000,000,056 | -H-- | C] () -- C:\ProgramData\ezsidmv.dat

[2011/10/11 09:22:25 | 000,000,115 | ---- | C] () -- C:\ProgramData\Microsoft.SqlServer.Compact.351.32.bc

[2010/04/26 09:41:58 | 000,096,987 | ---- | C] () -- C:\Users\Lisa\likeuson-facebook.png

========== ZeroAccess Check ==========

[2009/07/14 05:55:00 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini

[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64

[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] /64

[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64

"" = C:\Windows\SysNative\shell32.dll -- [2014/03/25 03:43:12 | 014,175,744 | ---- | M] (Microsoft Corporation)

"ThreadingModel" = Apartment

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

"" = %SystemRoot%\system32\shell32.dll -- [2014/03/25 03:09:54 | 012,874,240 | ---- | M] (Microsoft Corporation)

"ThreadingModel" = Apartment

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] /64

"" = C:\Windows\SysNative\wbem\fastprox.dll -- [2009/07/14 02:40:51 | 000,909,312 | ---- | M] (Microsoft Corporation)

"ThreadingModel" = Free

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]

"" = %systemroot%\system32\wbem\fastprox.dll -- [2010/11/21 04:24:25 | 000,606,208 | ---- | M] (Microsoft Corporation)

"ThreadingModel" = Free

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] /64

"" = C:\Windows\SysNative\wbem\wbemess.dll -- [2009/07/14 02:41:56 | 000,505,856 | ---- | M] (Microsoft Corporation)

"ThreadingModel" = Both

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]

========== LOP Check ==========

[2012/02/28 21:57:14 | 000,000,000 | ---D | M] -- C:\Users\Lisa\AppData\Roaming\.ABC

[2014/04/09 14:28:14 | 000,000,000 | ---D | M] -- C:\Users\Lisa\AppData\Roaming\Audacity

[2014/05/23 07:47:49 | 000,000,000 | ---D | M] -- C:\Users\Lisa\AppData\Roaming\Dropbox

[2014/05/23 07:47:47 | 000,000,000 | ---D | M] -- C:\Users\Lisa\AppData\Roaming\DropboxMaster

[2011/09/18 14:11:51 | 000,000,000 | ---D | M] -- C:\Users\Lisa\AppData\Roaming\PlayFirst

[2014/05/19 21:59:33 | 000,000,000 | ---D | M] -- C:\Users\Lisa\AppData\Roaming\SoftGrid Client

[2011/10/17 23:37:48 | 000,000,000 | ---D | M] -- C:\Users\Lisa\AppData\Roaming\Toshiba

[2013/08/11 10:49:37 | 000,000,000 | ---D | M] -- C:\Users\Lisa\AppData\Roaming\TOSHIBA Online Product Information

[2011/10/18 20:51:32 | 000,000,000 | ---D | M] -- C:\Users\Lisa\AppData\Roaming\TP

[2014/05/26 18:24:10 | 000,000,000 | ---D | M] -- C:\Users\Lisa\AppData\Roaming\uTorrent

[2013/02/19 21:52:08 | 000,000,000 | ---D | M] -- C:\Users\Lisa\AppData\Roaming\Visan

[2013/01/07 16:45:31 | 000,000,000 | ---D | M] -- C:\Users\Lisa\AppData\Roaming\WildTangent

[2012/02/21 10:43:29 | 000,000,000 | ---D | M] -- C:\Users\Lisa\AppData\Roaming\WinBatch

========== Purity Check ==========

========== Alternate Data Streams ==========

@Alternate Data Stream - 112 bytes -> C:\ProgramData\TEMP:D1B5B4F1

< End of report >

#2
Teima

Posted 26 May 2014 - 04:08 PM

Member

Member
833 posts

Hello Stephen Stato,

My name is Teima and I'll be happy to assist you with this issue. Before we commence I'd like to ask that you take into careful thought of the points which I've listed below as they will beneficial to the guidance as to which I'll present yourself with here on Geekstogo.

Notes before we commence:

It's important that you reply within four days. If you haven't replied within that time, the thread will be closed.

As the process of malware removal is often challenging at times I'd like you to take into consideration that it may take multiple replies in order to resolve the issue/issues present.

If you are uncertain about any of the steps as to which I present yourself with. Please feel free to ask myself for further clarification.

It's important that you don't use tools which have been recommended for other users of the forum, failure to follow these guidelines will most likely result in an unbootable machine.

These steps only apply for the user "Stephen Stato". If you're reading this thread and you're requiring assistance, then read this thread and follow the listed steps carefully.

The absence of symptoms does not necessarily mean that your system is clean. Please stick with me until I state that your system is clean.

If It's been a total of three days and you've yet to receive a response from myself. Please send myself a reminder by clicking here and attaching the appropriate thread link where I can respond.

Extra

Please be patient with me as I am currently in training, and all of my responses to you have to be reviewed by my instructor before I post them. Just keep in mind that you get the advantage as you have two people examining your issue. Thanks for your consideration. :thumbsup:

#3
Stephen Stato

Posted 27 May 2014 - 01:37 AM

Member

Topic Starter
Member
17 posts

Teima

Thank you very much for your help.

I look forward to my fist instruction.

Stato

#4
Teima

Posted 29 May 2014 - 09:12 AM

Member

Member
833 posts

Hello. Stephen Stato allow me to commence. I do notice that there's some adware present so we'll remove that first.

Step One

I'd highly recommend that you uninstall uTorrent as this has been identified as additional P2P program.

Please note that even if you are using a safe P2P program, it is only the program that is safe. You will be sharing files from uncertified sources, and these are often infected.

References for the risk of this program can be found at these links below.

Reference One

Reference Two

To remove uTorrent please navigate to Control Panel > Programs and Features and select the uninstall option.

Step Two

Run OTL

Under the Custom Scans/Fixes box at the bottom, copy and paste in the following.

:Commands
[CREATERESTOREPOINT]
 
:OTL

PRC - [2014/05/25 13:06:39 | 002,587,288 | ---- | M] (© 2013 Microsoft Corporation) -- C:\Users\Lisa\AppData\Local\Microsoft\DefaultSetup\DefaultSetup.exe
[2014/04/10 18:47:31 | 000,000,000 | ---D | M] ("GoPhoto.it V9.0") -- C:\Users\Lisa\AppData\Roaming\Mozilla\Firefox\Profiles\kug0zld3.default\extensions\2ea36bf1-0877-4aaa-882c-ff78f7d9d95c@dfb1672d-116a-4eb4-8be0-44786bd1d3dd.com[2014/05/26 12:52:04 | 000,002,780 | ---- | M] () -- C:\Windows\tasks\3acf9a70-1a99-4e96-962c-fb7ed7f05265-3.job
[2014/05/26 12:47:09 | 000,001,438 | ---- | M] () -- C:\Windows\tasks\3acf9a70-1a99-4e96-962c-fb7ed7f05265-5.job
[2014/05/26 12:47:03 | 000,002,126 | ---- | M] () -- C:\Windows\tasks\3acf9a70-1a99-4e96-962c-fb7ed7f05265-4.job
[2014/05/26 12:47:01 | 000,001,330 | ---- | M] () -- C:\Windows\tasks\3acf9a70-1a99-4e96-962c-fb7ed7f05265-2.job
[2014/05/26 12:47:00 | 000,001,366 | ---- | M] () -- C:\Windows\tasks\3acf9a70-1a99-4e96-962c-fb7ed7f05265-1.job
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Secondary Start Pages = http://search.conduit.com/?gd=&cti [Binary data over 200 bytes]
IE - HKCU\..\URLSearchHook: {7473b6bd-4691-4744-a82b-7854eb3d70b6} - No CLSID value found
IE - HKCU\..\SearchScopes,DefaultScope = {87F980E4-059E-490A-BB86-D2740E44185F}
O2 - BHO: (Fast Search) - {5AB7104A-B71F-49AD-9154-F7F8806AE848} - C:\Program Files (x86)\Surf Canyon\surfcanyon.dll (Surf Canyon Incorporated)
CHR - Extension: Surf Canyon = C:\Users\Lisa\AppData\Local\Google\Chrome\User Data\Default\Extensions\bcjagnifjocnddgeknajocbkkhlgibem\5.2.2_0\
@Alternate Data Stream - 112 bytes -> C:\ProgramData\TEMP:D1B5B4F1

:Commands
[emptytemp]

Click run fix.

OTL may ask to reboot the machine. Please click the OK button if prompted.

Once done a report will be displayed. Copy and paste the contents of that report within your next response.

Step Three

Download AdwCleaner from here to your desktop.

Run AdwCleaner via the Scan option and once done select Clean

Once done it will ask to reboot, allow this.

On reboot a log will be produced please attach that for me to review.

#5
Stephen Stato

Posted 29 May 2014 - 01:43 PM

Member

Topic Starter
Member
17 posts

thank you so much for your help,

would you recomend a safer substitute for U Torent.

Thnaks again

Stato

All processes killed
========== COMMANDS ==========
Restore point Set: OTL Restore Point
========== OTL ==========
No active process named DefaultSetup.exe was found!
Folder C:\Users\Lisa\AppData\Roaming\Mozilla\Firefox\Profiles\kug0zld3.default\extensions\2ea36bf1-0877-4aaa-882c-ff78f7d9d95c@dfb1672d-116a-4eb4-8be0-44786bd1d3dd.com[2014/05/26 12:52:04 | 000,002,780 | ---- | M] () -- C:\Windows\tasks\3acf9a70-1a99-4e96-962c-fb7ed7f05265-3.job\ not found.
File C:\Windows\tasks\3acf9a70-1a99-4e96-962c-fb7ed7f05265-5.job not found.
File C:\Windows\tasks\3acf9a70-1a99-4e96-962c-fb7ed7f05265-4.job not found.
File C:\Windows\tasks\3acf9a70-1a99-4e96-962c-fb7ed7f05265-2.job not found.
File C:\Windows\tasks\3acf9a70-1a99-4e96-962c-fb7ed7f05265-1.job not found.
HKCU\SOFTWARE\Microsoft\Internet Explorer\Main\\Secondary Start Pages| /E : value set successfully!
Registry value HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks\\{7473b6bd-4691-4744-a82b-7854eb3d70b6} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7473b6bd-4691-4744-a82b-7854eb3d70b6}\ not found.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope| /E : value set successfully!
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5AB7104A-B71F-49AD-9154-F7F8806AE848}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5AB7104A-B71F-49AD-9154-F7F8806AE848}\ deleted successfully.
C:\Program Files (x86)\Surf Canyon\surfcanyon.dll moved successfully.
C:\Users\Lisa\AppData\Local\Google\Chrome\User Data\Default\Extensions\bcjagnifjocnddgeknajocbkkhlgibem\5.2.2_0 folder moved successfully.
ADS C:\ProgramData\TEMP:D1B5B4F1 deleted successfully.
========== COMMANDS ==========

[EMPTYTEMP]

User: All Users

User: ciala
->Temp folder emptied: 62450630 bytes
->Temporary Internet Files folder emptied: 44155256 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 92179156 bytes
->Google Chrome cache emptied: 266030322 bytes
->Flash cache emptied: 602 bytes

User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: Lisa
->Temp folder emptied: 7327147635 bytes
->Temporary Internet Files folder emptied: 276236315 bytes
->Java cache emptied: 4395224 bytes
->FireFox cache emptied: 105528395 bytes
->Google Chrome cache emptied: 289786759 bytes
->Apple Safari cache emptied: 36864 bytes
->Flash cache emptied: 595 bytes

User: Public

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32 (64bit) .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 654961410 bytes
%systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 42303946 bytes
RecycleBin emptied: 17214500187 bytes

Total Files Cleaned = 25,158.00 mb

OTL by OldTimer - Version 3.2.69.0 log created on 05292014_201001

Files\Folders moved on Reboot...
File\Folder C:\Users\Lisa\AppData\Local\Temp\mozilla-temp-files\mozilla-temp-2579 not found!
File\Folder C:\Users\Lisa\AppData\Local\Temp\etilqs_fTE9ffk3hH3NdOn not found!
File\Folder C:\Users\Lisa\AppData\Local\Temp\etilqs_q7PtQTkyMGSB7Fe not found!
C:\Users\Lisa\AppData\Local\Temp\FXSAPIDebugLogFile.txt moved successfully.
C:\Users\Lisa\AppData\Local\Temp\~DF7FAEC140D5E4567E.TMP moved successfully.
C:\Users\Lisa\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat moved successfully.
C:\Users\Lisa\AppData\Local\Mozilla\Firefox\Profiles\kug0zld3.default\startupCache\startupCache.4.little moved successfully.
C:\Users\Lisa\AppData\Local\Mozilla\Firefox\Profiles\kug0zld3.default\Cache\_CACHE_001_ moved successfully.
C:\Users\Lisa\AppData\Local\Mozilla\Firefox\Profiles\kug0zld3.default\Cache\_CACHE_002_ moved successfully.
C:\Users\Lisa\AppData\Local\Mozilla\Firefox\Profiles\kug0zld3.default\Cache\_CACHE_003_ moved successfully.
C:\Users\Lisa\AppData\Local\Mozilla\Firefox\Profiles\kug0zld3.default\Cache\_CACHE_MAP_ moved successfully.
C:\Users\Lisa\AppData\Local\Mozilla\Firefox\Profiles\kug0zld3.default\_CACHE_CLEAN_ moved successfully.
File move failed. C:\Windows\temp\Low\SkypeClickToCall\Logs\AutoUpdateSvc.log scheduled to be moved on reboot.

PendingFileRenameOperations files...

Registry entries deleted on Reboot...

#6
Stephen Stato

Posted 29 May 2014 - 02:01 PM

Member

Topic Starter
Member
17 posts

And the ADW file

Thamks again,

# AdwCleaner v3.211 - Report created 29/05/2014 at 20:48:41
# Updated 26/05/2014 by Xplode
# Operating System : Windows 7 Home Premium Service Pack 1 (64 bits)
# Username : Lisa - LISA-OSUL
# Running from : C:\Users\Lisa\Downloads\adwcleaner_3.211.exe
# Option : Clean

***** [ Services ] *****

***** [ Files / Folders ] *****

Folder Deleted : C:\ProgramData\apn
Folder Deleted : C:\ProgramData\Computer Updater
Folder Deleted : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\eSupport.com
Folder Deleted : C:\Program Files (x86)\BrowseToSave
Folder Deleted : C:\Program Files (x86)\Surf Canyon
Folder Deleted : C:\Program Files (x86)\Toolbar Cleaner
Folder Deleted : C:\Users\Lisa\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\FirstRowSportApp.com
Folder Deleted : C:\Users\Lisa\AppData\Roaming\Mozilla\Firefox\Profiles\kug0zld3.default\Extensions\[email protected]
Folder Deleted : C:\Users\ciala\AppData\Local\Google\Chrome\User Data\Default\Extensions\bcjagnifjocnddgeknajocbkkhlgibem
Folder Deleted : C:\Users\Lisa\AppData\Local\Google\Chrome\User Data\Default\Extensions\bcjagnifjocnddgeknajocbkkhlgibem
Folder Deleted : C:\Users\ciala\AppData\Local\Google\Chrome\User Data\Default\Extensions\lmnbobhffedhdhfpcjkjphcfpeeiocdn
Folder Deleted : C:\Users\Lisa\AppData\Local\Google\Chrome\User Data\Default\Extensions\lmnbobhffedhdhfpcjkjphcfpeeiocdn
File Deleted : C:\Program Files (x86)\Mozilla Firefox\Extensions\{1FD91A9C-410C-4090-BBCC-55D3450EF433}
File Deleted : C:\Users\Lisa\AppData\Roaming\Mozilla\Firefox\Profiles\kug0zld3.default\searchplugins\bingp.xml
File Deleted : C:\Users\Lisa\AppData\Local\Google\Chrome\User Data\Default\Local Storage\chrome-extension_eooncjejnppfjjklapaamhcdmjbilmde_0.localstorage
File Deleted : C:\Users\Lisa\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_facebook.conduitapps.com_0.localstorage
File Deleted : C:\Users\Lisa\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_facebook.conduitapps.com_0.localstorage-journal
File Deleted : C:\Users\Lisa\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_storage.conduit.com_0.localstorage
File Deleted : C:\Users\Lisa\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_storage.conduit.com_0.localstorage-journal
File Deleted : C:\Windows\System32\Tasks\EPUpdater

***** [ Shortcuts ] *****

***** [ Registry ] *****

Key Deleted : HKLM\SOFTWARE\Google\Chrome\Extensions\bcjagnifjocnddgeknajocbkkhlgibem
Key Deleted : HKCU\Software\Google\Chrome\Extensions\ocoombckbcnabpaghmokhaapnbngahck
Key Deleted : HKLM\SOFTWARE\Google\Chrome\Extensions\ocoombckbcnabpaghmokhaapnbngahck
Key Deleted : HKCU\Software\Classes\VirtualStore\MACHINE\SOFTWARE\Wow6432Node\BabylonToolbar
Key Deleted : HKLM\SOFTWARE\Classes\AppID\surfcanyon.DLL
Key Deleted : HKLM\SOFTWARE\Classes\driverscanner
Key Deleted : HKLM\SOFTWARE\Classes\surfcanyon.BhoSite
Key Deleted : HKLM\SOFTWARE\Classes\surfcanyon.BhoSite.1
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\adawarebp_rasapi32
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\au__rasapi32
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\au__rasmancs
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\ClickPotatoLiteSA_RASAPI32
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\ClickPotatoLiteSA_RASMANCS
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\FirstRowSportApp_RASAPI32
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\FirstRowSportApp_RASMANCS
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\optimizerpro_rasapi32
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\optimizerpro_rasmancs
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SP_f2a323db
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{A3514F71-E63F-440B-8076-14226E21B2BF}
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{C007DADD-132A-624C-088E-59EE6CF0711F}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{00B11DA2-75ED-4364-ABA5-9A95B1F5E946}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{68AD96A1-2A28-4841-ABD0-F5AA45F008C9}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{79FB5FC8-44B9-4AF5-BADD-CCE547F953E5}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{BA3105E9-5DE6-4A1E-A819-6F5046AB67F5}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{5AB7104A-B71F-49AD-9154-F7F8806AE848}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{5AB7104A-B71F-49AD-9154-F7F8806AE848}
Value Deleted : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{7473B6BD-4691-4744-A82B-7854EB3D70B6}]
Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{68AD96A1-2A28-4841-ABD0-F5AA45F008C9}
Key Deleted : HKCU\Software\1ClickDownload
Key Deleted : HKCU\Software\Surf Canyon
Key Deleted : HKCU\Software\AppDataLow\Software
Key Deleted : HKLM\Software\InstallIQ
Key Deleted : HKLM\Software\Toolbar Cleaner
Key Deleted : HKLM\Software\Uniblue
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Toolbar Cleaner

***** [ Browsers ] *****

-\\ Internet Explorer v11.0.9600.17041

-\\ Mozilla Firefox v29.0.1 (en-GB)

[ File : C:\Users\ciala\AppData\Roaming\Mozilla\Firefox\Profiles\ot6icpph.default\prefs.js ]

[ File : C:\Users\Lisa\AppData\Roaming\Mozilla\Firefox\Profiles\kug0zld3.default\prefs.js ]

Line Deleted : user_pref("browser.uiCustomization.state", "{\"placements\":{\"PanelUI-contents\":[\"edit-controls\",\"zoom-controls\",\"new-window-button\",\"privatebrowsing-button\",\"save-page-button\",\"print-but[...]
Line Deleted : user_pref("extensions.crossrider.bic", "14537b6c67757350ec069539d79d0df5");

-\\ Google Chrome v35.0.1916.114

[ File : C:\Users\ciala\AppData\Local\Google\Chrome\User Data\Default\preferences ]

Deleted [Search Provider] : hxxp://www.delta-search.com/?q={searchTerms}&affID=119781&tt=gc_&babsrc=SP_ss&mntrId=DC84002163FC60DF
Deleted [Extension] : bcjagnifjocnddgeknajocbkkhlgibem
Deleted [Extension] : lmnbobhffedhdhfpcjkjphcfpeeiocdn

[ File : C:\Users\Lisa\AppData\Local\Google\Chrome\User Data\Default\preferences ]

Deleted [Search Provider] : hxxp://en.softonic.com/s/{searchTerms}
Deleted [Extension] : bbjciahceamgodcoidkjpchnokgfpphh
Deleted [Extension] : bcjagnifjocnddgeknajocbkkhlgibem
Deleted [Extension] : booedmolknjekdopkepjjeckmjkdpfgl
Deleted [Extension] : ejpbbhjlbipncjklfjjaedaieimbmdda
Deleted [Extension] : eooncjejnppfjjklapaamhcdmjbilmde
Deleted [Extension] : flpcjncodpafbgdpnkljologafpionhb
Deleted [Extension] : lmnbobhffedhdhfpcjkjphcfpeeiocdn
Deleted [Extension] : ocoombckbcnabpaghmokhaapnbngahck
Deleted [Extension] : pgmfkblbflahhponhjmkcnpjinenhlnc

*************************

AdwCleaner[R0].txt - [6885 octets] - [29/05/2014 20:45:03]
AdwCleaner[S0].txt - [6734 octets] - [29/05/2014 20:48:41]

########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [6794 octets] ##########

#7
Teima

Posted 02 June 2014 - 05:32 PM

Member

Member
833 posts

Hello Stephen Stato. Would you be able to advise me as to which torrents you intend to install? Also. How is the machine running at the moment?

Step One

Malwarebytes Anti-Malware

Please download Malwarebytes Anti-Malware from here.

Double click mbam-setup.exe to install the application.
Make sure a checkmark is placed next to Update Malwarebytes Anti-Malware and Launch Malwarebytes Anti-Malware, then click finish.
If an update is found, it will download and install the latest version.
Once the program has loaded, select Perform Quick Scan, then click scan.
When the scan is complete, click OK, then show results to view the scan results.
If anything is found make sure that everything is checked, and then click remove selected.
Once the scan has completed, a log will open in Notepad and you may be prompted to restart.
Please note the log is automatically saved and can be viewed by clicking the logs tab within Malwarebytes.
Copy and paste the entire content of that report within your next response.

Step Two

I would assume you still have OTL on your machine. Right-click on OTL.exe and select Run As Administrator to start the program. If prompted by UAC, please allow it.

Please check the box next to Scan All Users.
Make sure Use SafeList is selected under Extra Registry.
Under the Custom Scans/Fixes box at the bottom, paste in the following:

netsvcs
BASESERVICES
%SYSTEMDRIVE%\*.exe
/md5start
services.*
explorer.exe
winlogon.exe
Userinit.exe
svchost.exe
/md5stop
dir C:\ /S /A:L /C
CREATERESTOREPOINT

Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.
Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time and post them in your reply. If both log won't fit in the same post, you may post them in two separate posts.

#8
Stephen Stato

Posted 03 June 2014 - 04:55 AM

Member

Topic Starter
Member
17 posts

hi Again

I was thinking of using ABC, but having seen the source of all these treats i might have to reconsider the entire approach to accessing TV and Films.

All pops have stopped and i believe there is a pick up in speed. In the last few minutes since removing the treats with the Malware scanner i believe the computer sounds like its getting stuff done faster theres a certain urgency to it s whinings again.

So thanks again...

results of scan logs...

Malwarebytes Anti-Malware

www.malwarebytes.org

Scan Date: 03/06/2014

Scan Time: 11:06:46

Logfile: 03.06.14.txt

Administrator: Yes

Version: 2.00.2.1012

Malware Database: v2014.06.03.03

Rootkit Database: v2014.06.02.01

License: Trial

Malware Protection: Enabled

Malicious Website Protection: Enabled

Self-protection: Disabled

OS: Windows 7 Service Pack 1

CPU: x64

File System: NTFS

User: Lisa

Scan Type: Threat Scan

Result: Completed

Objects Scanned: 328084

Time Elapsed: 29 min, 44 sec

Memory: Enabled

Startup: Enabled

Filesystem: Enabled

Archives: Enabled

Rootkits: Disabled

Heuristics: Enabled

PUP: Enabled

PUM: Enabled

Processes: 0

(No malicious items detected)

Modules: 0

(No malicious items detected)

Registry Keys: 8

PUP.Optional.GoPhoto.A, HKU\S-1-5-18-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\APPDATALOW\SOFTWARE\GoPhoto.it V9.0, Quarantined, [808f353f4f2c44f24251f5a4649e51af],

PUP.Optional.TornTV.A, HKU\S-1-5-18-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\APPDATALOW\SOFTWARE\Torntv V9.0, Quarantined, [739c5321740755e1a50e77330af8c53b],

PUP.Optional.SProtector.A, HKU\S-1-5-21-3734433013-2235189305-930175613-1003-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\APPDATALOW\SProtector, Quarantined, [8f80cba9b7c452e441818444996aad53],

PUP.Optional.CrossRider.A, HKU\S-1-5-21-3734433013-2235189305-930175613-1003-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\APPDATALOW\SOFTWARE\Crossrider, Quarantined, [19f6492badcedb5b8632b426da2927d9],

PUP.Optional.GoPhoto.A, HKU\S-1-5-21-3734433013-2235189305-930175613-1003-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\APPDATALOW\SOFTWARE\GoPhoto.it V9.0, Quarantined, [b25d2a4aaad175c13a59dfba57ab3fc1],

PUP.Optional.MindSpark.A, HKU\S-1-5-21-3734433013-2235189305-930175613-1003-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\APPDATALOW\SOFTWARE\TelevisionFanatic, Quarantined, [f01f6a0a3e3d171f13f50f8552b0d62a],

PUP.Optional.TornTV.A, HKU\S-1-5-21-3734433013-2235189305-930175613-1003-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\APPDATALOW\SOFTWARE\Torntv V9.0, Quarantined, [c44bcfa55b20f343674ca6047290eb15],

PUP.Optional.VidSaver.A, HKU\S-1-5-21-3734433013-2235189305-930175613-1003-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\APPDATALOW\SOFTWARE\Vid-Saver, Quarantined, [e52a8fe5384362d4fc965e4ddd25728e],

Registry Values: 5

PUP.Optional.UTorrentControl.A, HKU\S-1-5-21-3734433013-2235189305-930175613-1003-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\TOOLBAR\WEBBROWSER\{7473B6BD-4691-4744-A82B-7854EB3D70B6}, Quarantined, [65aa80f4611a5ed8e007df54748e3ac6],

PUP.Optional.UTorrentControl.A, HKU\S-1-5-21-3734433013-2235189305-930175613-1003-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\TOOLBAR\WEBBROWSER|{7473B6BD-4691-4744-A82B-7854EB3D70B6}, Â½Â¶stâ??FDGÂ¨+xTÃ«=pÂ¶, Quarantined, [65aa80f4611a5ed8e007df54748e3ac6]

PUP.Optional.UTorrentControl.A, HKU\S-1-5-21-3734433013-2235189305-930175613-1003-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\URLSEARCHHOOKS|{7473B6BD-4691-4744-A82B-7854EB3D70B6}, Quarantined, [65aa80f4611a5ed8e007df54748e3ac6],

PUP.Optional.UTorrentControl.A, HKU\S-1-5-21-3734433013-2235189305-930175613-1003-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\URLSEARCHHOOKS\{7473b6bd-4691-4744-a82b-7854eb3d70b6}, Quarantined, [1cf3c2b2d3a883b3b730d063be440af6],

PUP.Optional.ConduitSearchProtect, HKU\S-1-5-21-3734433013-2235189305-930175613-1003-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN|SearchProtect, C:\Users\ciala\AppData\Roaming\SearchProtect\cltmng.exe, Quarantined, [38d7274db3c83afc2c1303c0f013dd23]

Registry Data: 0

(No malicious items detected)

Folders: 26

PUP.Optional.OnlineVid.A, C:\Program Files (x86)\OnlineHD.TV, Quarantined, [21ee99dbc3b8df57956f661937cbae52],

PUP.Optional.CrossRider.A, C:\Users\ciala\AppData\Local\Google\Chrome\User Data\Default\Extensions\lmnbobhffedhdhfpcjkjphcfpeeiocdn, Quarantined, [10ff4b294a3156e0395f6b159d657a86],

PUP.Optional.CrossRider.A, C:\Users\Lisa\AppData\Local\Google\Chrome\User Data\Default\Extensions\lmnbobhffedhdhfpcjkjphcfpeeiocdn, Quarantined, [d13ea3d1fe7d51e55048344c738f7987],

PUP.Optional.CrossRider.A, C:\Users\Lisa\AppData\Local\Google\Chrome\User Data\Default\Extensions\lmnbobhffedhdhfpcjkjphcfpeeiocdn\1.0.0_0, Quarantined, [d13ea3d1fe7d51e55048344c738f7987],

PUP.Optional.CrossRider.A, C:\Users\Lisa\AppData\Local\Google\Chrome\User Data\Default\Extensions\lmnbobhffedhdhfpcjkjphcfpeeiocdn\1.0.0_0\html, Quarantined, [d13ea3d1fe7d51e55048344c738f7987],

PUP.Optional.CrossRider.A, C:\Users\Lisa\AppData\Local\Google\Chrome\User Data\Default\Extensions\lmnbobhffedhdhfpcjkjphcfpeeiocdn\1.0.0_0\icons, Quarantined, [d13ea3d1fe7d51e55048344c738f7987],

PUP.Optional.CrossRider.A, C:\Users\ciala\AppData\Local\Google\Chrome\User Data\Default\databases\chrome-extension_lmnbobhffedhdhfpcjkjphcfpeeiocdn_0, Quarantined, [40cfe98be992ee48538291f843bffa06],

PUP.Optional.CrossRider.A, C:\Users\ciala\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lmnbobhffedhdhfpcjkjphcfpeeiocdn, Quarantined, [0a059fd5c6b50c2ac21aabdee2200df3],

PUP.Optional.CrossRider.A, C:\Users\ciala\AppData\Local\Google\Chrome\User Data\Default\Extensions\ccfjbdjailljfihgkoccfbiljjapiijb, Quarantined, [0e01a9cb4e2d0d29ad1e088240c2f907],

PUP.Optional.CrossRider.A, C:\Users\ciala\AppData\Local\Google\Chrome\User Data\Default\Extensions\ccfjbdjailljfihgkoccfbiljjapiijb\1.26.219_0, Quarantined, [0e01a9cb4e2d0d29ad1e088240c2f907],

PUP.Optional.CrossRider.A, C:\Users\ciala\AppData\Local\Google\Chrome\User Data\Default\Extensions\ccfjbdjailljfihgkoccfbiljjapiijb\1.26.219_0\extensionData, Quarantined, [0e01a9cb4e2d0d29ad1e088240c2f907],

PUP.Optional.CrossRider.A, C:\Users\ciala\AppData\Local\Google\Chrome\User Data\Default\Extensions\ccfjbdjailljfihgkoccfbiljjapiijb\1.26.219_0\icons, Quarantined, [0e01a9cb4e2d0d29ad1e088240c2f907],

PUP.Optional.CrossRider.A, C:\Users\ciala\AppData\Local\Google\Chrome\User Data\Default\Extensions\ccfjbdjailljfihgkoccfbiljjapiijb\1.26.219_0\icons\actions, Quarantined, [0e01a9cb4e2d0d29ad1e088240c2f907],

PUP.Optional.CrossRider.A, C:\Users\ciala\AppData\Local\Google\Chrome\User Data\Default\Extensions\ccfjbdjailljfihgkoccfbiljjapiijb\1.26.219_0\js, Quarantined, [0e01a9cb4e2d0d29ad1e088240c2f907],

PUP.Optional.CrossRider.A, C:\Users\ciala\AppData\Local\Google\Chrome\User Data\Default\Extensions\ccfjbdjailljfihgkoccfbiljjapiijb\1.26.219_0\js\api, Quarantined, [0e01a9cb4e2d0d29ad1e088240c2f907],

PUP.Optional.CrossRider.A, C:\Users\ciala\AppData\Local\Google\Chrome\User Data\Default\Extensions\ccfjbdjailljfihgkoccfbiljjapiijb\1.26.219_0\js\lib, Quarantined, [0e01a9cb4e2d0d29ad1e088240c2f907],

PUP.Optional.CrossRider.A, C:\Users\ciala\AppData\Local\Google\Chrome\User Data\Default\Extensions\ccfjbdjailljfihgkoccfbiljjapiijb\1.26.219_0\js\lib\popupResource, Quarantined, [0e01a9cb4e2d0d29ad1e088240c2f907],

PUP.Optional.CrossRider.A, C:\Users\Lisa\AppData\Local\Google\Chrome\User Data\Default\Extensions\ccfjbdjailljfihgkoccfbiljjapiijb, Quarantined, [e926462e7407270f418a39516b97ae52],

PUP.Optional.CrossRider.A, C:\Users\Lisa\AppData\Local\Google\Chrome\User Data\Default\Extensions\ccfjbdjailljfihgkoccfbiljjapiijb\1.0.0_0, Quarantined, [e926462e7407270f418a39516b97ae52],

PUP.Optional.CrossRider.A, C:\Users\Lisa\AppData\Local\Google\Chrome\User Data\Default\Extensions\ccfjbdjailljfihgkoccfbiljjapiijb\1.0.0_0\html, Quarantined, [e926462e7407270f418a39516b97ae52],

PUP.Optional.CrossRider.A, C:\Users\Lisa\AppData\Local\Google\Chrome\User Data\Default\Extensions\ccfjbdjailljfihgkoccfbiljjapiijb\1.0.0_0\icons, Quarantined, [e926462e7407270f418a39516b97ae52],

PUP.Optional.CrossRider.A, C:\Users\ciala\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ccfjbdjailljfihgkoccfbiljjapiijb, Quarantined, [709fcaaa047769cdb01c9cee3dc5649c],

PUP.Optional.CrossRider.A, C:\Users\ciala\AppData\Local\Google\Chrome\User Data\Default\databases\chrome-extension_ccfjbdjailljfihgkoccfbiljjapiijb_0, Quarantined, [dc33e98b6813c86e9a333b4fb0526799],

PUP.Optional.SurfCanyon.A, C:\Users\ciala\AppData\Local\Google\Chrome\User Data\Default\Extensions\bcjagnifjocnddgeknajocbkkhlgibem, Quarantined, [c54aea8a7cff88ae57d1038b689af010],

Files: 152

PUP.Optional.OneClickDownloader.A, C:\Users\Lisa\Downloads\Victorious_S03E01_A_Christmas_Tori_480p_WEB-DL_x264-mSD.exe, Quarantined, [917eb9bbc8b3c274523ecb48867bf50b],

PUP.Optional.OneClickDownloader.A, C:\Users\Lisa\Downloads\Love_Hate_S3_E1_TV_XviD_phcon_xvid.exe, Quarantined, [e7280d67314a5fd7c5cb49caf60bd030],

PUP.Optional.OneClickDownloader.A, C:\Users\Lisa\Downloads\Love_Hate_S3_E1_TV_XviD_phcon_xvid_avi (1).exe, Quarantined, [2ee13c38fc7fce684947789b41c040c0],

PUP.Optional.OneClickDownloader.A, C:\Users\Lisa\Downloads\Love_Hate_S3_E1_TV_XviD_phcon_xvid_avi (3).exe, Quarantined, [e22d9ed69eddf93de3ada96a3dc48779],

PUP.Optional.OneClickDownloader.A, C:\Users\Lisa\Downloads\Love_Hate_S3_E1_TV_XviD_phcon_xvid_avi.exe, Quarantined, [c14e99dbb2c9d75faee226ede51c7090],

PUP.Optional.OneClickDownloader.A, C:\Users\Lisa\Downloads\Love_Hate_Season_3_Complete_(2012)_HQ_DVDrip_Xvid_T-AND-A-G_(IrishTorrents (1).exe, Quarantined, [63ac443057243402ccc4c0536b96fb05],

PUP.Optional.OneClickDownloader.A, C:\Users\Lisa\Downloads\Love_Hate_Season_3_Complete_(2012)_HQ_DVDrip_Xvid_T-AND-A-G_(IrishTorrents.exe, Quarantined, [957a1c58a3d86cca464a6da61fe28d73],

PUP.Optional.OneClickDownloader.A, C:\Users\Lisa\Downloads\love_hate_season_3_Direct (1).exe, Quarantined, [78978ee642396cca8a061300926fa55b],

PUP.Optional.OneClickDownloader.A, C:\Users\Lisa\Downloads\love_hate_season_3_Direct.exe, Quarantined, [dc33680c1e5d42f43957977cc041946c],

PUP.Optional.OneClickDownloader.A, C:\Users\Lisa\Downloads\love_hate_season_3_Full (1).exe, Quarantined, [ba55afc5b9c2f640d6bae330db265fa1],

PUP.Optional.OneClickDownloader.A, C:\Users\Lisa\Downloads\love_hate_season_3_Full.exe, Quarantined, [25ea60147a0181b51878da3918e9659b],

PUP.Optional.OneClickDownloader.A, C:\Users\Lisa\Downloads\girls_s4_Full (1).exe, Quarantined, [4bc48fe5037884b2d3bd5eb5c33ea957],

PUP.Optional.OneClickDownloader.A, C:\Users\Lisa\Downloads\girls_s4_Full (2).exe, Quarantined, [2be44e266f0c6ccaeaa66ca7af5212ee],

PUP.Optional.OneClickDownloader.A, C:\Users\Lisa\Downloads\girls_s4_Full.exe, Quarantined, [0609116389f22c0ad6ba2ce751b052ae],

PUP.Optional.OneClickDownloader.A, C:\Users\Lisa\Downloads\girls_season_4_Verified (1).exe, Quarantined, [c04fa3d10e6d47efe3ad8c8799686898],

PUP.Optional.OneClickDownloader.A, C:\Users\Lisa\Downloads\girls_season_4_Verified (2).exe, Quarantined, [42cd0d6797e454e2ccc4848f9e634cb4],

PUP.Optional.OneClickDownloader.A, C:\Users\Lisa\Downloads\girls_season_4_Verified (3).exe, Quarantined, [d9367cf86c0f1e18ff9171a219e8ca36],

PUP.Optional.OneClickDownloader.A, C:\Users\Lisa\Downloads\girls_season_4_Verified.exe, Quarantined, [61aefd778eede5515739ea29bc456a96],

PUP.Optional.OneClickDownloader.A, C:\Users\Lisa\Downloads\[_www_Speed_Cd_]_Victorious_S03E01_A_Christmas_Tori_720p_HDTV_x264_PREMiER (1).exe, Quarantined, [c14eabc9fe7d3204246c779c5ba6ee12],

PUP.Optional.OneClickDownloader.A, C:\Users\Lisa\Downloads\[_www_Speed_Cd_]_Victorious_S03E01_A_Christmas_Tori_720p_HDTV_x264_PREMiER.exe, Quarantined, [36d9e490dc9f8fa710809a79966b8d73],

PUP.Optional.OneClickDownloader.A, C:\Users\Lisa\Downloads\Love_Hate_S3_E1_TV_XviD_phcon_xvid_avi (2).exe, Quarantined, [9f7094e0f28970c62868d43f6e9318e8],

PUP.Optional.ShoppingGate.A, C:\Users\ciala\AppData\Local\Google\Chrome\User Data\Default\Local Storage\https_inst.shoppingate.info_0.localstorage, Quarantined, [60afd0a4cead5dd9fef31d798082a65a],

PUP.Optional.ShoppingGate.A, C:\Users\ciala\AppData\Local\Google\Chrome\User Data\Default\Local Storage\https_inst.shoppingate.info_0.localstorage-journal, Quarantined, [62ad1b5907745bdbda1798fe778b1fe1],

PUP.Optional.ShoppingGate.A, C:\Users\Lisa\AppData\Local\Google\Chrome\User Data\Default\Local Storage\https_inst.shoppingate.info_0.localstorage, Quarantined, [e42ba4d0ed8e2f078b66ebabb74bf20e],

PUP.Optional.ShoppingGate.A, C:\Users\Lisa\AppData\Local\Google\Chrome\User Data\Default\Local Storage\https_inst.shoppingate.info_0.localstorage-journal, Quarantined, [927ded87205b11251cd5d1c50200a65a],

PUP.Optional.Superfish.A, C:\Users\ciala\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_www.superfish.com_0.localstorage, Quarantined, [907fb7bd23588ea82b28d7c08280cc34],

PUP.Optional.Superfish.A, C:\Users\ciala\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_www.superfish.com_0.localstorage-journal, Quarantined, [2be48be9aad11e18c48f118649b9d927],

PUP.Optional.Superfish.A, C:\Users\Lisa\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_www.superfish.com_0.localstorage, Quarantined, [ea25b4c0ea9139fd490ad3c45da5f50b],

PUP.Optional.Superfish.A, C:\Users\Lisa\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_www.superfish.com_0.localstorage-journal, Quarantined, [fe119cd8ed8edb5b64ef395e5ca6a55b],

PUP.Optional.CrossRider.A, C:\Users\ciala\AppData\Local\Google\Chrome\User Data\Default\Local Storage\chrome-extension_ccfjbdjailljfihgkoccfbiljjapiijb_0.localstorage, Quarantined, [a867c7ad44372b0b1a7b940554ae6a96],

PUP.Optional.CrossRider.A, C:\Users\ciala\AppData\Local\Google\Chrome\User Data\Default\Local Storage\chrome-extension_lmnbobhffedhdhfpcjkjphcfpeeiocdn_0.localstorage, Quarantined, [43ccf67ecfac290d6f3dc8d30df532ce],

PUP.Optional.Searchqu.A, C:\Users\Lisa\AppData\Roaming\Mozilla\Extensions\{1FD91A9C-410C-4090-BBCC-55D3450EF433}, Quarantined, [63ac0074ea9178befeacc8fe8281be42],

PUP.Optional.OnlineVid.A, C:\Program Files (x86)\OnlineHD.TV\onhd10.crx, Quarantined, [21ee99dbc3b8df57956f661937cbae52],

PUP.Optional.OnlineVid.A, C:\Program Files (x86)\OnlineHD.TV\onhdtemp.xpi, Quarantined, [21ee99dbc3b8df57956f661937cbae52],

PUP.Optional.OnlineVid.A, C:\Program Files (x86)\OnlineHD.TV\OnlineHDTV.exe, Quarantined, [21ee99dbc3b8df57956f661937cbae52],

PUP.Optional.OnlineVid.A, C:\Program Files (x86)\OnlineHD.TV\uninst.exe, Quarantined, [21ee99dbc3b8df57956f661937cbae52],

PUP.Optional.CrossRider.A, C:\Users\Lisa\AppData\Local\Google\Chrome\User Data\Default\Extensions\lmnbobhffedhdhfpcjkjphcfpeeiocdn\1.0.0_0\manifest.json, Quarantined, [d13ea3d1fe7d51e55048344c738f7987],

PUP.Optional.CrossRider.A, C:\Users\Lisa\AppData\Local\Google\Chrome\User Data\Default\Extensions\lmnbobhffedhdhfpcjkjphcfpeeiocdn\1.0.0_0\html\bg.html, Quarantined, [d13ea3d1fe7d51e55048344c738f7987],

PUP.Optional.CrossRider.A, C:\Users\Lisa\AppData\Local\Google\Chrome\User Data\Default\Extensions\lmnbobhffedhdhfpcjkjphcfpeeiocdn\1.0.0_0\icons\icon128.png, Quarantined, [d13ea3d1fe7d51e55048344c738f7987],

PUP.Optional.CrossRider.A, C:\Users\Lisa\AppData\Local\Google\Chrome\User Data\Default\Extensions\lmnbobhffedhdhfpcjkjphcfpeeiocdn\1.0.0_0\icons\icon16.png, Quarantined, [d13ea3d1fe7d51e55048344c738f7987],

PUP.Optional.CrossRider.A, C:\Users\Lisa\AppData\Local\Google\Chrome\User Data\Default\Extensions\lmnbobhffedhdhfpcjkjphcfpeeiocdn\1.0.0_0\icons\icon48.png, Quarantined, [d13ea3d1fe7d51e55048344c738f7987],

PUP.Optional.CrossRider.A, C:\Users\ciala\AppData\Local\Google\Chrome\User Data\Default\databases\chrome-extension_lmnbobhffedhdhfpcjkjphcfpeeiocdn_0\3, Quarantined, [40cfe98be992ee48538291f843bffa06],

PUP.Optional.CrossRider.A, C:\Users\ciala\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lmnbobhffedhdhfpcjkjphcfpeeiocdn\000022.ldb, Quarantined, [0a059fd5c6b50c2ac21aabdee2200df3],

PUP.Optional.CrossRider.A, C:\Users\ciala\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lmnbobhffedhdhfpcjkjphcfpeeiocdn\000024.ldb, Quarantined, [0a059fd5c6b50c2ac21aabdee2200df3],

PUP.Optional.CrossRider.A, C:\Users\ciala\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lmnbobhffedhdhfpcjkjphcfpeeiocdn\000030.ldb, Quarantined, [0a059fd5c6b50c2ac21aabdee2200df3],

PUP.Optional.CrossRider.A, C:\Users\ciala\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lmnbobhffedhdhfpcjkjphcfpeeiocdn\000033.ldb, Quarantined, [0a059fd5c6b50c2ac21aabdee2200df3],

PUP.Optional.CrossRider.A, C:\Users\ciala\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lmnbobhffedhdhfpcjkjphcfpeeiocdn\000036.ldb, Quarantined, [0a059fd5c6b50c2ac21aabdee2200df3],

PUP.Optional.CrossRider.A, C:\Users\ciala\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lmnbobhffedhdhfpcjkjphcfpeeiocdn\000037.log, Quarantined, [0a059fd5c6b50c2ac21aabdee2200df3],

PUP.Optional.CrossRider.A, C:\Users\ciala\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lmnbobhffedhdhfpcjkjphcfpeeiocdn\000038.ldb, Quarantined, [0a059fd5c6b50c2ac21aabdee2200df3],

PUP.Optional.CrossRider.A, C:\Users\ciala\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lmnbobhffedhdhfpcjkjphcfpeeiocdn\CURRENT, Quarantined, [0a059fd5c6b50c2ac21aabdee2200df3],

PUP.Optional.CrossRider.A, C:\Users\ciala\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lmnbobhffedhdhfpcjkjphcfpeeiocdn\LOCK, Quarantined, [0a059fd5c6b50c2ac21aabdee2200df3],

PUP.Optional.CrossRider.A, C:\Users\ciala\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lmnbobhffedhdhfpcjkjphcfpeeiocdn\LOG, Quarantined, [0a059fd5c6b50c2ac21aabdee2200df3],

PUP.Optional.CrossRider.A, C:\Users\ciala\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lmnbobhffedhdhfpcjkjphcfpeeiocdn\LOG.old, Quarantined, [0a059fd5c6b50c2ac21aabdee2200df3],

PUP.Optional.CrossRider.A, C:\Users\ciala\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lmnbobhffedhdhfpcjkjphcfpeeiocdn\MANIFEST-000035, Quarantined, [0a059fd5c6b50c2ac21aabdee2200df3],

PUP.Optional.CrossRider.A, C:\Users\ciala\AppData\Local\Google\Chrome\User Data\Default\Extensions\ccfjbdjailljfihgkoccfbiljjapiijb\1.26.219_0\background.html, Quarantined, [0e01a9cb4e2d0d29ad1e088240c2f907],

PUP.Optional.CrossRider.A, C:\Users\ciala\AppData\Local\Google\Chrome\User Data\Default\Extensions\ccfjbdjailljfihgkoccfbiljjapiijb\1.26.219_0\chromeCoreFilesIndex.txt, Quarantined, [0e01a9cb4e2d0d29ad1e088240c2f907],

PUP.Optional.CrossRider.A, C:\Users\ciala\AppData\Local\Google\Chrome\User Data\Default\Extensions\ccfjbdjailljfihgkoccfbiljjapiijb\1.26.219_0\crossriderManifest.json, Quarantined, [0e01a9cb4e2d0d29ad1e088240c2f907],

PUP.Optional.CrossRider.A, C:\Users\ciala\AppData\Local\Google\Chrome\User Data\Default\Extensions\ccfjbdjailljfihgkoccfbiljjapiijb\1.26.219_0\manifest.json, Quarantined, [0e01a9cb4e2d0d29ad1e088240c2f907],

PUP.Optional.CrossRider.A, C:\Users\ciala\AppData\Local\Google\Chrome\User Data\Default\Extensions\ccfjbdjailljfihgkoccfbiljjapiijb\1.26.219_0\popup.html, Quarantined, [0e01a9cb4e2d0d29ad1e088240c2f907],

PUP.Optional.CrossRider.A, C:\Users\ciala\AppData\Local\Google\Chrome\User Data\Default\Extensions\ccfjbdjailljfihgkoccfbiljjapiijb\1.26.219_0\icons\icon128.png, Quarantined, [0e01a9cb4e2d0d29ad1e088240c2f907],

PUP.Optional.CrossRider.A, C:\Users\ciala\AppData\Local\Google\Chrome\User Data\Default\Extensions\ccfjbdjailljfihgkoccfbiljjapiijb\1.26.219_0\icons\icon16.png, Quarantined, [0e01a9cb4e2d0d29ad1e088240c2f907],

PUP.Optional.CrossRider.A, C:\Users\ciala\AppData\Local\Google\Chrome\User Data\Default\Extensions\ccfjbdjailljfihgkoccfbiljjapiijb\1.26.219_0\icons\icon48.png, Quarantined, [0e01a9cb4e2d0d29ad1e088240c2f907],

PUP.Optional.CrossRider.A, C:\Users\ciala\AppData\Local\Google\Chrome\User Data\Default\Extensions\ccfjbdjailljfihgkoccfbiljjapiijb\1.26.219_0\js\background.js, Quarantined, [0e01a9cb4e2d0d29ad1e088240c2f907],

PUP.Optional.CrossRider.A, C:\Users\ciala\AppData\Local\Google\Chrome\User Data\Default\Extensions\ccfjbdjailljfihgkoccfbiljjapiijb\1.26.219_0\js\main.js, Quarantined, [0e01a9cb4e2d0d29ad1e088240c2f907],

PUP.Optional.CrossRider.A, C:\Users\ciala\AppData\Local\Google\Chrome\User Data\Default\Extensions\ccfjbdjailljfihgkoccfbiljjapiijb\1.26.219_0\js\platformVersion.js, Quarantined, [0e01a9cb4e2d0d29ad1e088240c2f907],

PUP.Optional.CrossRider.A, C:\Users\ciala\AppData\Local\Google\Chrome\User Data\Default\Extensions\ccfjbdjailljfihgkoccfbiljjapiijb\1.26.219_0\js\api\chrome.js, Quarantined, [0e01a9cb4e2d0d29ad1e088240c2f907],

PUP.Optional.CrossRider.A, C:\Users\ciala\AppData\Local\Google\Chrome\User Data\Default\Extensions\ccfjbdjailljfihgkoccfbiljjapiijb\1.26.219_0\js\api\cookie.js, Quarantined, [0e01a9cb4e2d0d29ad1e088240c2f907],

PUP.Optional.CrossRider.A, C:\Users\ciala\AppData\Local\Google\Chrome\User Data\Default\Extensions\ccfjbdjailljfihgkoccfbiljjapiijb\1.26.219_0\js\api\message.js, Quarantined, [0e01a9cb4e2d0d29ad1e088240c2f907],

PUP.Optional.CrossRider.A, C:\Users\ciala\AppData\Local\Google\Chrome\User Data\Default\Extensions\ccfjbdjailljfihgkoccfbiljjapiijb\1.26.219_0\js\api\monitor.js, Quarantined, [0e01a9cb4e2d0d29ad1e088240c2f907],

PUP.Optional.CrossRider.A, C:\Users\ciala\AppData\Local\Google\Chrome\User Data\Default\Extensions\ccfjbdjailljfihgkoccfbiljjapiijb\1.26.219_0\js\api\pageAction.js, Quarantined, [0e01a9cb4e2d0d29ad1e088240c2f907],

PUP.Optional.CrossRider.A, C:\Users\ciala\AppData\Local\Google\Chrome\User Data\Default\Extensions\ccfjbdjailljfihgkoccfbiljjapiijb\1.26.219_0\js\api\pageActionBG.js, Quarantined, [0e01a9cb4e2d0d29ad1e088240c2f907],

PUP.Optional.CrossRider.A, C:\Users\ciala\AppData\Local\Google\Chrome\User Data\Default\Extensions\ccfjbdjailljfihgkoccfbiljjapiijb\1.26.219_0\js\lib\app_api.js, Quarantined, [0e01a9cb4e2d0d29ad1e088240c2f907],

PUP.Optional.CrossRider.A, C:\Users\ciala\AppData\Local\Google\Chrome\User Data\Default\Extensions\ccfjbdjailljfihgkoccfbiljjapiijb\1.26.219_0\js\lib\bg_app_api.js, Quarantined, [0e01a9cb4e2d0d29ad1e088240c2f907],

PUP.Optional.CrossRider.A, C:\Users\ciala\AppData\Local\Google\Chrome\User Data\Default\Extensions\ccfjbdjailljfihgkoccfbiljjapiijb\1.26.219_0\js\lib\consts.js, Quarantined, [0e01a9cb4e2d0d29ad1e088240c2f907],

PUP.Optional.CrossRider.A, C:\Users\ciala\AppData\Local\Google\Chrome\User Data\Default\Extensions\ccfjbdjailljfihgkoccfbiljjapiijb\1.26.219_0\js\lib\cookie_store.js, Quarantined, [0e01a9cb4e2d0d29ad1e088240c2f907],

PUP.Optional.CrossRider.A, C:\Users\ciala\AppData\Local\Google\Chrome\User Data\Default\Extensions\ccfjbdjailljfihgkoccfbiljjapiijb\1.26.219_0\js\lib\crossriderAPI.js, Quarantined, [0e01a9cb4e2d0d29ad1e088240c2f907],

PUP.Optional.CrossRider.A, C:\Users\ciala\AppData\Local\Google\Chrome\User Data\Default\Extensions\ccfjbdjailljfihgkoccfbiljjapiijb\1.26.219_0\js\lib\delegate.js, Quarantined, [0e01a9cb4e2d0d29ad1e088240c2f907],

PUP.Optional.CrossRider.A, C:\Users\ciala\AppData\Local\Google\Chrome\User Data\Default\Extensions\ccfjbdjailljfihgkoccfbiljjapiijb\1.26.219_0\js\lib\events.js, Quarantined, [0e01a9cb4e2d0d29ad1e088240c2f907],

PUP.Optional.CrossRider.A, C:\Users\ciala\AppData\Local\Google\Chrome\User Data\Default\Extensions\ccfjbdjailljfihgkoccfbiljjapiijb\1.26.219_0\js\lib\extensionDataStore.js, Quarantined, [0e01a9cb4e2d0d29ad1e088240c2f907],

PUP.Optional.CrossRider.A, C:\Users\ciala\AppData\Local\Google\Chrome\User Data\Default\Extensions\ccfjbdjailljfihgkoccfbiljjapiijb\1.26.219_0\js\lib\installer.js, Quarantined, [0e01a9cb4e2d0d29ad1e088240c2f907],

PUP.Optional.CrossRider.A, C:\Users\ciala\AppData\Local\Google\Chrome\User Data\Default\Extensions\ccfjbdjailljfihgkoccfbiljjapiijb\1.26.219_0\js\lib\logFile.js, Quarantined, [0e01a9cb4e2d0d29ad1e088240c2f907],

PUP.Optional.CrossRider.A, C:\Users\ciala\AppData\Local\Google\Chrome\User Data\Default\Extensions\ccfjbdjailljfihgkoccfbiljjapiijb\1.26.219_0\js\lib\logging.js, Quarantined, [0e01a9cb4e2d0d29ad1e088240c2f907],

PUP.Optional.CrossRider.A, C:\Users\ciala\AppData\Local\Google\Chrome\User Data\Default\Extensions\ccfjbdjailljfihgkoccfbiljjapiijb\1.26.219_0\js\lib\onBGDocumentLoad.js, Quarantined, [0e01a9cb4e2d0d29ad1e088240c2f907],

PUP.Optional.CrossRider.A, C:\Users\ciala\AppData\Local\Google\Chrome\User Data\Default\Extensions\ccfjbdjailljfihgkoccfbiljjapiijb\1.26.219_0\js\lib\reports.js, Quarantined, [0e01a9cb4e2d0d29ad1e088240c2f907],

PUP.Optional.CrossRider.A, C:\Users\ciala\AppData\Local\Google\Chrome\User Data\Default\Extensions\ccfjbdjailljfihgkoccfbiljjapiijb\1.26.219_0\js\lib\storageWrapper.js, Quarantined, [0e01a9cb4e2d0d29ad1e088240c2f907],

PUP.Optional.CrossRider.A, C:\Users\ciala\AppData\Local\Google\Chrome\User Data\Default\Extensions\ccfjbdjailljfihgkoccfbiljjapiijb\1.26.219_0\js\lib\updateManager.js, Quarantined, [0e01a9cb4e2d0d29ad1e088240c2f907],

PUP.Optional.CrossRider.A, C:\Users\ciala\AppData\Local\Google\Chrome\User Data\Default\Extensions\ccfjbdjailljfihgkoccfbiljjapiijb\1.26.219_0\js\lib\util.js, Quarantined, [0e01a9cb4e2d0d29ad1e088240c2f907],

PUP.Optional.CrossRider.A, C:\Users\ciala\AppData\Local\Google\Chrome\User Data\Default\Extensions\ccfjbdjailljfihgkoccfbiljjapiijb\1.26.219_0\js\lib\xhr.js, Quarantined, [0e01a9cb4e2d0d29ad1e088240c2f907],

PUP.Optional.CrossRider.A, C:\Users\Lisa\AppData\Local\Google\Chrome\User Data\Default\Extensions\ccfjbdjailljfihgkoccfbiljjapiijb\1.0.0_0\manifest.json, Quarantined, [e926462e7407270f418a39516b97ae52],

PUP.Optional.CrossRider.A, C:\Users\Lisa\AppData\Local\Google\Chrome\User Data\Default\Extensions\ccfjbdjailljfihgkoccfbiljjapiijb\1.0.0_0\html\bg.html, Quarantined, [e926462e7407270f418a39516b97ae52],

PUP.Optional.CrossRider.A, C:\Users\Lisa\AppData\Local\Google\Chrome\User Data\Default\Extensions\ccfjbdjailljfihgkoccfbiljjapiijb\1.0.0_0\icons\icon128.png, Quarantined, [e926462e7407270f418a39516b97ae52],

PUP.Optional.CrossRider.A, C:\Users\Lisa\AppData\Local\Google\Chrome\User Data\Default\Extensions\ccfjbdjailljfihgkoccfbiljjapiijb\1.0.0_0\icons\icon16.png, Quarantined, [e926462e7407270f418a39516b97ae52],

PUP.Optional.CrossRider.A, C:\Users\Lisa\AppData\Local\Google\Chrome\User Data\Default\Extensions\ccfjbdjailljfihgkoccfbiljjapiijb\1.0.0_0\icons\icon48.png, Quarantined, [e926462e7407270f418a39516b97ae52],

PUP.Optional.CrossRider.A, C:\Users\ciala\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ccfjbdjailljfihgkoccfbiljjapiijb\000022.ldb, Quarantined, [709fcaaa047769cdb01c9cee3dc5649c],

PUP.Optional.CrossRider.A, C:\Users\ciala\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ccfjbdjailljfihgkoccfbiljjapiijb\000027.ldb, Quarantined, [709fcaaa047769cdb01c9cee3dc5649c],

PUP.Optional.CrossRider.A, C:\Users\ciala\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ccfjbdjailljfihgkoccfbiljjapiijb\000030.ldb, Quarantined, [709fcaaa047769cdb01c9cee3dc5649c],

PUP.Optional.CrossRider.A, C:\Users\ciala\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ccfjbdjailljfihgkoccfbiljjapiijb\000033.ldb, Quarantined, [709fcaaa047769cdb01c9cee3dc5649c],

PUP.Optional.CrossRider.A, C:\Users\ciala\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ccfjbdjailljfihgkoccfbiljjapiijb\000034.log, Quarantined, [709fcaaa047769cdb01c9cee3dc5649c],

PUP.Optional.CrossRider.A, C:\Users\ciala\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ccfjbdjailljfihgkoccfbiljjapiijb\CURRENT, Quarantined, [709fcaaa047769cdb01c9cee3dc5649c],

PUP.Optional.CrossRider.A, C:\Users\ciala\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ccfjbdjailljfihgkoccfbiljjapiijb\LOCK, Quarantined, [709fcaaa047769cdb01c9cee3dc5649c],

PUP.Optional.CrossRider.A, C:\Users\ciala\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ccfjbdjailljfihgkoccfbiljjapiijb\LOG, Quarantined, [709fcaaa047769cdb01c9cee3dc5649c],

PUP.Optional.CrossRider.A, C:\Users\ciala\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ccfjbdjailljfihgkoccfbiljjapiijb\LOG.old, Quarantined, [709fcaaa047769cdb01c9cee3dc5649c],

PUP.Optional.CrossRider.A, C:\Users\ciala\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ccfjbdjailljfihgkoccfbiljjapiijb\MANIFEST-000032, Quarantined, [709fcaaa047769cdb01c9cee3dc5649c],

PUP.Optional.CrossRider.A, C:\Users\ciala\AppData\Local\Google\Chrome\User Data\Default\databases\chrome-extension_ccfjbdjailljfihgkoccfbiljjapiijb_0\4, Quarantined, [dc33e98b6813c86e9a333b4fb0526799],

Physical Sectors: 0

(No malicious items detected)

(end)

#9
Stephen Stato

Posted 03 June 2014 - 05:22 AM

Member

Topic Starter
Member
17 posts

Step two

Otl report 1

OTL logfile created on: 6/3/2014 11:57:41 AM - Run 1

OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\Lisa\Downloads

64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation

Internet Explorer (Version = 9.11.9600.17041)

Locale: 00000409 | Country: Ireland | Language: ENI | Date Format: dd/MM/yyyy

3.91 Gb Total Physical Memory | 1.38 Gb Available Physical Memory | 35.28% Memory free

7.82 Gb Paging File | 4.78 Gb Available in Paging File | 61.08% Paging File free

Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)

Drive C: | 149.04 Gb Total Space | 19.84 Gb Free Space | 13.31% Space Free | Partition Type: NTFS

Drive D: | 148.65 Gb Total Space | 126.95 Gb Free Space | 85.40% Space Free | Partition Type: NTFS

Computer Name: LISA-OSUL | User Name: Lisa | Logged in as Administrator.

Boot Mode: Normal | Scan Mode: All users | Include 64bit Scans

Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2014/06/03 11:56:16 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Lisa\Downloads\OTL (2).exe

PRC - [2014/05/20 01:45:22 | 033,322,312 | ---- | M] (Dropbox, Inc.) -- C:\Users\Lisa\AppData\Roaming\Dropbox\bin\Dropbox.exe

PRC - [2014/05/15 22:38:02 | 007,631,872 | ---- | M] (Google Inc.) -- C:\Users\Lisa\AppData\Local\Programs\Google\MusicManager\MusicManager.exe

PRC - [2014/05/14 00:40:56 | 000,860,488 | ---- | M] (Google Inc.) -- C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

PRC - [2014/05/12 18:39:25 | 000,263,048 | ---- | M] (Google Inc.) -- C:\Program Files (x86)\Google\Update\1.3.24.7\GoogleCrashHandler.exe

PRC - [2014/05/12 07:24:42 | 000,860,472 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe

PRC - [2014/05/12 07:24:40 | 001,809,720 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe

PRC - [2014/05/12 07:24:34 | 006,970,168 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe