Javascript Disabled Detected

You currently have javascript disabled. Several functions may not work. Please re-enable javascript to access full functionality.

PC help with Browser Redirects [Solved]

Started by amanda222 , Sep 24 2014 11:19 AM

This topic is locked

#1
amanda222

Posted 24 September 2014 - 11:19 AM

Member

Member
16 posts

Hi. I am hoping that someone can help me with an issue with constant browser redirects occuring, on all browser types firefox, chrome, etc. Attached is the requested log

Thanks!

OTL logfile created on: 2014/09/24 1:05:25 PM - Run 8

OTL by OldTimer - Version 3.2.69.0 Folder = d:\data\rainmaker\Desktop

Windows XP Professional Edition Service Pack 2 (Version = 5.1.2600) - Type = NTWorkstation

Internet Explorer (Version = 8.0.6001.18702)

Locale: 00000409 | Country: United States | Language: ENU | Date Format: yyyy/MM/dd

1.49 Gb Total Physical Memory | 0.87 Gb Available Physical Memory | 58.58% Memory free

4.13 Gb Paging File | 3.68 Gb Available in Paging File | 89.21% Paging File free

Paging file location(s): C:\pagefile.sys 2850 4092 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINNT | %ProgramFiles% = C:\Program Files

Drive C: | 60.45 Gb Total Space | 22.15 Gb Free Space | 36.64% Space Free | Partition Type: NTFS

Drive D: | 32.70 Gb Total Space | 5.61 Gb Free Space | 17.17% Space Free | Partition Type: NTFS

Computer Name: 3YFK943Z | User Name: rainmaker | Logged in as Administrator.

Boot Mode: Normal | Scan Mode: Current user | Quick Scan

Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2014/08/26 15:40:15 | 001,082,880 | ---- | M] () -- d:\data\All Users\Application Data\VenusApp Software\SW-Booster\SW-Booster.exe

PRC - [2013/03/29 10:52:25 | 000,602,112 | ---- | M] (OldTimer Tools) -- d:\data\rainmaker\Desktop\OTL.exe

PRC - [2008/11/09 16:48:14 | 000,602,392 | ---- | M] (Yahoo! Inc.) -- C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe

PRC - [2007/12/14 15:06:00 | 000,136,512 | ---- | M] (McAfee, Inc.) -- C:\Program Files\Network Associates\Common Framework\UdaterUI.exe

PRC - [2007/12/14 15:06:00 | 000,136,512 | ---- | M] (McAfee, Inc.) -- C:\Program Files\Network Associates\Common Framework\naPrdMgr.exe

PRC - [2007/12/14 15:06:00 | 000,103,744 | ---- | M] (McAfee, Inc.) -- C:\Program Files\Network Associates\Common Framework\FrameworkService.exe

PRC - [2007/12/14 15:06:00 | 000,086,016 | ---- | M] (McAfee, Inc.) -- C:\Program Files\Network Associates\Common Framework\Mctray.exe

PRC - [2007/10/16 20:50:00 | 000,144,704 | ---- | M] (McAfee, Inc.) -- C:\Program Files\McAfee\VirusScan Enterprise\Mcshield.exe

PRC - [2007/10/16 20:50:00 | 000,111,952 | ---- | M] (McAfee, Inc.) -- C:\Program Files\McAfee\VirusScan Enterprise\shstat.exe

PRC - [2007/10/16 20:50:00 | 000,054,608 | ---- | M] (McAfee, Inc.) -- C:\Program Files\McAfee\VirusScan Enterprise\VsTskMgr.exe

PRC - [2007/07/25 17:16:42 | 000,073,728 | ---- | M] (DameWare Development) -- C:\WINNT\system32\DWRCST.EXE

PRC - [2007/07/25 17:16:30 | 000,222,720 | ---- | M] (DameWare Development LLC) -- C:\WINNT\system32\DWRCS.EXE

PRC - [2006/11/29 17:47:28 | 000,126,976 | ---- | M] (iPass, Inc.) -- C:\Program Files\iPass\iPassConnect\iPassPeriodicUpdateApp.exe

PRC - [2006/11/29 17:47:28 | 000,086,016 | ---- | M] (iPass, Inc.) -- C:\Program Files\iPass\iPassConnect\iPassPeriodicUpdateService.exe

PRC - [2006/02/01 16:10:32 | 000,086,016 | ---- | M] (Lenovo Group Limited) -- C:\Program Files\Lenovo\PkgMgr\HOTKEY_1\TpScrex.exe

PRC - [2006/02/01 16:09:46 | 000,077,824 | ---- | M] () -- C:\Program Files\Lenovo\PkgMgr\HOTKEY\TPONSCR.exe

PRC - [2005/12/02 03:03:00 | 000,225,280 | ---- | M] (Lenovo Group Limited) -- C:\Program Files\ThinkPad\UltraNav Wizard\UNavTray.exe

PRC - [2005/10/28 21:13:44 | 000,155,648 | ---- | M] (IBM) -- C:\Program Files\IBM\IBM Rapid Restore Ultra\br_funcs.exe

PRC - [2005/10/06 23:18:26 | 000,385,024 | ---- | M] () -- C:\Program Files\IBM\IBM Rapid Restore Ultra\rrpcsb.exe

PRC - [2005/09/15 14:57:42 | 000,110,592 | ---- | M] (Synaptics, Inc.) -- C:\Program Files\Synaptics\SynTP\SynTPLpr.exe

PRC - [2005/09/06 16:51:08 | 000,053,248 | ---- | M] (Alexandria Software Consulting) -- c:\Program Files\Nortel Networks\TunnelGuard\CueAgent_srv.exe

PRC - [2005/09/06 16:50:50 | 000,045,056 | ---- | M] (Nortel Networks) -- C:\Program Files\Nortel Networks\TunnelGuard\platforms\win32\TGIconApp.EXE

PRC - [2005/04/27 11:07:16 | 000,221,184 | ---- | M] () -- C:\Program Files\IBM\IBM Rapid Restore Ultra\rrucmd.exe

PRC - [2005/04/27 09:53:08 | 000,090,112 | ---- | M] (IBM Corp.) -- C:\IBMTOOLS\utils\ibmprc.exe

PRC - [2004/08/04 00:56:50 | 001,032,192 | ---- | M] (Microsoft Corporation) -- C:\WINNT\explorer.exe

========== Modules (No Company Name) ==========

MOD - [2014/08/26 15:40:15 | 001,082,880 | ---- | M] () -- d:\data\All Users\Application Data\VenusApp Software\SW-Booster\SW-Booster.exe

MOD - [2014/08/26 15:40:06 | 004,296,192 | ---- | M] () -- c:\Program Files\SW-Booster\Assistant.dll

MOD - [2014/08/26 15:40:06 | 000,174,928 | ---- | M] () -- c:\Program Files\SW-Booster\AssistantSvc.dll

MOD - [2014/02/21 13:16:52 | 000,265,216 | ---- | M] () -- C:\Program Files\Bitcasa\ExplorerMenu.dll

MOD - [2014/02/21 13:06:24 | 002,064,896 | ---- | M] () -- C:\Program Files\Bitcasa\bitcasaui.dll

MOD - [2012/05/25 04:25:00 | 000,921,600 | ---- | M] () -- C:\Program Files\Yahoo!\Messenger\yui.dll

MOD - [2011/05/28 22:04:56 | 000,140,288 | ---- | M] () -- C:\Program Files\WinRAR\RarExt.dll

MOD - [2007/12/14 15:06:00 | 000,156,992 | ---- | M] () -- C:\Program Files\Network Associates\Common Framework\naisign2.dll

MOD - [2007/12/14 15:06:00 | 000,120,128 | ---- | M] () -- C:\Program Files\Network Associates\Common Framework\naXML2_71.dll

MOD - [2006/11/30 08:50:00 | 000,149,080 | ---- | M] () -- C:\Program Files\McAfee\VirusScan Enterprise\VsEvntUI.DLL

MOD - [2006/11/06 14:00:58 | 000,651,264 | ---- | M] () -- C:\Program Files\iPass\iPassConnect\libeay32.dll

MOD - [2006/02/01 16:09:46 | 000,077,824 | ---- | M] () -- C:\Program Files\Lenovo\PkgMgr\HOTKEY\TPONSCR.exe

MOD - [2006/02/01 16:09:42 | 000,024,576 | ---- | M] () -- C:\WINNT\system32\tphklock.dll

MOD - [2005/12/07 02:12:00 | 000,073,728 | ---- | M] () -- C:\Program Files\ThinkPad\Utilities\PWRMGRIF.DLL

MOD - [2005/12/07 02:12:00 | 000,036,864 | ---- | M] () -- C:\Program Files\ThinkPad\Utilities\US\PWRMGRRT.DLL

MOD - [2005/10/06 23:18:26 | 000,385,024 | ---- | M] () -- C:\Program Files\IBM\IBM Rapid Restore Ultra\rrpcsb.exe

MOD - [2005/09/06 16:50:50 | 000,077,824 | ---- | M] () -- C:\Program Files\Nortel Networks\TunnelGuard\platforms\win32\TGIcon.DLL

MOD - [2005/04/27 11:12:28 | 000,131,072 | ---- | M] () -- C:\Program Files\IBM\IBM Rapid Restore Ultra\ui.dll

MOD - [2005/04/27 11:12:22 | 000,139,264 | ---- | M] () -- C:\Program Files\IBM\IBM Rapid Restore Ultra\CDRecord.dll

MOD - [2005/04/27 11:10:04 | 000,069,632 | ---- | M] () -- C:\Program Files\IBM\IBM Rapid Restore Ultra\zlib.dll

MOD - [2005/04/27 11:07:16 | 000,221,184 | ---- | M] () -- C:\Program Files\IBM\IBM Rapid Restore Ultra\rrucmd.exe

MOD - [2003/02/20 16:42:34 | 001,159,289 | R--- | M] () -- c:\Program Files\Nortel Networks\TunnelGuard\jre\bin\client\jvm.dll

MOD - [2003/02/20 16:42:34 | 000,102,511 | R--- | M] () -- c:\Program Files\Nortel Networks\TunnelGuard\jre\bin\java.dll

MOD - [2003/02/20 16:42:34 | 000,057,451 | R--- | M] () -- C:\Program Files\Nortel Networks\TunnelGuard\jre\bin\net.dll

MOD - [2003/02/20 16:42:34 | 000,057,449 | R--- | M] () -- c:\Program Files\Nortel Networks\TunnelGuard\jre\bin\verify.dll

MOD - [2003/02/20 16:42:34 | 000,053,360 | R--- | M] () -- c:\Program Files\Nortel Networks\TunnelGuard\jre\bin\zip.dll

MOD - [2003/02/20 16:42:32 | 000,028,787 | R--- | M] () -- c:\Program Files\Nortel Networks\TunnelGuard\jre\bin\hpi.dll

========== Services (SafeList) ==========

SRV - File not found [On_Demand | Stopped] -- C:\Program Files\Google\Update\GoogleUpdate.exe /medsvc -- (gupdatem)

SRV - File not found [Auto | Stopped] -- C:\Program Files\Google\Update\GoogleUpdate.exe /svc -- (gupdate)

SRV - [2014/06/21 16:01:48 | 000,257,696 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\WINNT\system32\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)

SRV - [2014/06/05 16:21:27 | 000,119,408 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)

SRV - [2008/11/09 16:48:14 | 000,602,392 | ---- | M] (Yahoo! Inc.) [Auto | Running] -- C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe -- (YahooAUService)

SRV - [2007/12/14 15:06:00 | 000,103,744 | ---- | M] (McAfee, Inc.) [Auto | Running] -- C:\Program Files\Network Associates\Common Framework\FrameworkService.exe -- (McAfeeFramework)

SRV - [2007/10/16 20:50:00 | 000,144,704 | ---- | M] (McAfee, Inc.) [Auto | Running] -- C:\Program Files\McAfee\VirusScan Enterprise\Mcshield.exe -- (McShield)

SRV - [2007/10/16 20:50:00 | 000,054,608 | ---- | M] (McAfee, Inc.) [Auto | Running] -- C:\Program Files\McAfee\VirusScan Enterprise\VsTskMgr.exe -- (McTaskManager)

SRV - [2007/07/25 17:16:30 | 000,222,720 | ---- | M] (DameWare Development LLC) [Auto | Running] -- C:\WINNT\system32\DWRCS.EXE -- (DWMRCS)

SRV - [2006/11/30 18:09:32 | 001,310,720 | ---- | M] (iPass, Inc.) [On_Demand | Stopped] -- C:\Program Files\iPass\iPassConnect\iPassConnectEngine.exe -- (iPassConnectEngine)

SRV - [2006/11/29 17:47:28 | 000,126,976 | ---- | M] (iPass, Inc.) [On_Demand | Running] -- C:\Program Files\iPass\iPassConnect\iPassPeriodicUpdateApp.exe -- (iPassPeriodicUpdateApp)

SRV - [2006/11/29 17:47:28 | 000,086,016 | ---- | M] (iPass, Inc.) [Auto | Running] -- C:\Program Files\iPass\iPassConnect\iPassPeriodicUpdateService.exe -- (iPassPeriodicUpdateService)

SRV - [2006/07/25 14:23:30 | 002,635,480 | ---- | M] (Sygate Technologies, Inc.) [Disabled | Stopped] -- c:\Program Files\Sygate\SSA\Smc.exe -- (SmcService)

SRV - [2006/07/25 14:14:52 | 000,323,658 | ---- | M] (Sygate Technologies, Inc.) [On_Demand | Stopped] -- c:\Program Files\Sygate\SSA\Maga\Maga.exe -- (magaService)

SRV - [2006/05/09 17:37:50 | 000,835,584 | ---- | M] (Nortel Networks NA, Inc.) [On_Demand | Stopped] -- C:\Program Files\Nexxia\Extranet_serv.exe -- (ExtranetAccess)

SRV - [2006/02/09 03:50:00 | 000,578,784 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\WINNT\system32\CCM\CcmExec.exe -- (CcmExec)

SRV - [2005/10/06 23:18:26 | 000,385,024 | ---- | M] () [Auto | Running] -- C:\Program Files\IBM\IBM Rapid Restore Ultra\rrpcsb.exe -- (IBM Rapid Restore Ultra Service)

SRV - [2005/09/06 16:51:08 | 000,053,248 | ---- | M] (Alexandria Software Consulting) [Auto | Running] -- c:\Program Files\Nortel Networks\TunnelGuard\CueAgent_srv.exe -- (tunnelguardservice)

========== Driver Services (SafeList) ==========

DRV - [2013/11/25 13:02:58 | 000,346,688 | ---- | M] (EldoS Corporation) [Kernel | System | Running] -- C:\WINNT\system32\drivers\cbfs5.sys -- (cbfs5)

DRV - [2009/04/25 19:16:14 | 000,021,419 | ---- | M] (Meetinghouse Data Communications) [Kernel | Auto | Running] -- C:\WINNT\system32\drivers\iPassP.sys -- (iPassP)

DRV - [2007/10/16 20:50:00 | 000,171,272 | ---- | M] (McAfee, Inc.) [Kernel | On_Demand | Running] -- C:\WINNT\system32\drivers\mfehidk.sys -- (mfehidk)

DRV - [2007/10/16 20:50:00 | 000,072,680 | ---- | M] (McAfee, Inc.) [Kernel | On_Demand | Running] -- C:\WINNT\system32\drivers\mfeavfk.sys -- (mfeavfk)

DRV - [2007/10/16 20:50:00 | 000,064,168 | ---- | M] (McAfee, Inc.) [Kernel | On_Demand | Running] -- C:\WINNT\system32\drivers\mfeapfk.sys -- (mfeapfk)

DRV - [2007/10/16 20:50:00 | 000,051,944 | ---- | M] (McAfee, Inc.) [Kernel | System | Running] -- C:\WINNT\system32\drivers\mfetdik.sys -- (mfetdik)

DRV - [2007/10/16 20:50:00 | 000,033,960 | ---- | M] (McAfee, Inc.) [Kernel | On_Demand | Running] -- C:\WINNT\system32\drivers\mfebopk.sys -- (mfebopk)

DRV - [2007/10/16 20:50:00 | 000,031,784 | ---- | M] (McAfee, Inc.) [Kernel | System | Running] -- C:\Program Files\McAfee\VirusScan Enterprise\mferkdk.sys -- (mferkdk)

DRV - [2007/08/09 17:33:14 | 000,013,360 | ---- | M] (Lenovo Group Limited) [Kernel | On_Demand | Stopped] -- c:\DRIVERS\T60\BIOS\tpflhlp.sys -- (tpflhlp)

DRV - [2007/03/20 16:58:30 | 000,013,184 | ---- | M] (IBM Corporation) [Kernel | Disabled | Stopped] -- C:\WINNT\system32\drivers\psadd.sys -- (psadd)

DRV - [2007/03/20 08:01:07 | 000,099,328 | ---- | M] (LSI Logic) [Kernel | Boot | Running] -- C:\WINNT\system32\drivers\symmpi.sys -- (Symmpi)

DRV - [2007/02/15 08:00:00 | 000,026,624 | ---- | M] (DameWare) [Kernel | System | Running] -- C:\WINNT\system32\drivers\dwvkbd.sys -- (dwvkbd)

DRV - [2007/02/07 08:00:00 | 000,002,944 | ---- | M] (DameWare Development, Inc.) [Kernel | On_Demand | Running] -- C:\WINNT\system32\drivers\DamewareMini.sys -- (DwMirror)

DRV - [2006/07/25 14:24:26 | 000,014,952 | ---- | M] (Sygate Technologies, Inc.) [Kernel | Auto | Running] -- C:\WINNT\system32\drivers\wg6n.sys -- (wg6n)

DRV - [2006/07/25 14:24:24 | 000,014,952 | ---- | M] (Sygate Technologies, Inc.) [Kernel | Auto | Running] -- C:\WINNT\system32\drivers\wg5n.sys -- (wg5n)

DRV - [2006/07/25 14:24:20 | 000,014,952 | ---- | M] (Sygate Technologies, Inc.) [Kernel | Auto | Running] -- C:\WINNT\system32\drivers\wg4n.sys -- (wg4n)

DRV - [2006/07/25 14:24:16 | 000,014,952 | ---- | M] (Sygate Technologies, Inc.) [Kernel | Auto | Running] -- C:\WINNT\system32\drivers\wg3n.sys -- (wg3n)

DRV - [2006/07/25 13:59:48 | 000,021,075 | ---- | M] (Sygate Technologies, Inc.) [Kernel | System | Running] -- C:\WINNT\system32\drivers\wpsdrvnt.sys -- (wpsdrvnt)

DRV - [2006/07/25 13:57:10 | 000,061,008 | ---- | M] (Sygate Technologies, Inc.) [Kernel | Boot | Running] -- C:\WINNT\system32\drivers\Teefer.sys -- (Teefer)

DRV - [2006/05/09 17:47:10 | 000,024,521 | ---- | M] (Nortel Networks) [Kernel | On_Demand | Running] -- C:\WINNT\system32\drivers\eacfilt.sys -- (Eacfilt)

DRV - [2006/05/09 17:46:42 | 000,155,216 | ---- | M] (Nortel Networks NA, Inc.) [Kernel | On_Demand | Running] -- C:\WINNT\system32\drivers\ipsecw2k.sys -- (IPSECSHM)

DRV - [2006/05/09 17:46:42 | 000,155,216 | ---- | M] (Nortel Networks NA, Inc.) [Kernel | On_Demand | Stopped] -- C:\WINNT\system32\drivers\ipsecw2k.sys -- (IPSECEXT)

DRV - [2006/02/09 03:50:00 | 000,020,704 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\WINNT\system32\CCM\PrepDrv.sys -- (prepdrvr)

DRV - [2005/12/07 02:12:00 | 000,004,442 | ---- | M] () [Kernel | System | Running] -- C:\WINNT\system32\drivers\TPPWRIF.SYS -- (TPPWRIF)

DRV - [2005/12/05 18:55:30 | 001,428,096 | ---- | M] (Intel® Corporation) [Kernel | On_Demand | Stopped] -- C:\WINNT\system32\drivers\w39n51.sys -- (w39n51)

DRV - [2005/11/30 02:51:00 | 000,014,848 | ---- | M] (Microsoft Corporation) [Kernel | System | Running] -- C:\WINNT\system32\drivers\SMAPINT.SYS -- (Smapint)

DRV - [2005/11/30 02:51:00 | 000,009,343 | ---- | M] () [Kernel | System | Running] -- C:\WINNT\system32\drivers\TDSMAPI.SYS -- (TDSMAPI)

DRV - [2005/04/27 10:27:34 | 000,063,616 | ---- | M] (IBM) [Kernel | Auto | Running] -- C:\WINNT\system32\drivers\ibmfilter.sys -- (ibmfilter)

DRV - [2005/04/27 09:15:50 | 000,006,912 | ---- | M] (IBM Corp.) [Kernel | Boot | Running] -- C:\WINNT\system32\drivers\ANCSQ.sys -- (ANCSQ)

DRV - [2004/12/15 12:04:14 | 000,069,810 | ---- | M] (AuthenTec, Inc.) [Kernel | On_Demand | Stopped] -- C:\WINNT\system32\drivers\FLMckUSB.sys -- (FLMCKUSB)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\WINNT\system32\blank.htm

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://websearch.fly...616&lg=EN&cc=US

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,CustomizeSearch =

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL =

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant =

IE - HKLM\..\SearchScopes,DefaultScope = {BB74DE59-BC4C-4172-9AC4-73315F71CFFE}

IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/...ms}&FORM=IE8SRC

IE - HKLM\..\SearchScopes\{BB74DE59-BC4C-4172-9AC4-73315F71CFFE}: "URL" = http://websearch.fly...616&lg=EN&cc=US

IE - HKLM\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKLM\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = <-loopback>

IE - HKLM\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = http=127.0.0.1:8877;https=127.0.0.1:8877

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\WINNT\system32\blank.htm

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://websearch.fly...616&lg=EN&cc=US

IE - HKCU\..\URLSearchHook: {81017EA9-9AA8-4A6A-9734-7AF40E7D593F} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll (Yahoo! Inc.)

IE - HKCU\..\SearchScopes,DefaultScope = {BB74DE59-BC4C-4172-9AC4-73315F71CFFE}

IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/...ms}&FORM=IE8SRC

IE - HKCU\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://www.bing.com/...ms}&FORM=IE8SRC

IE - HKCU\..\SearchScopes\{BB74DE59-BC4C-4172-9AC4-73315F71CFFE}: "URL" = http://websearch.fly...616&lg=EN&cc=US

IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..extensions.enabledAddons: %7B972ce4c6-7e08-4474-a285-3208198ce6fd%7D:29.0.1

FF - prefs.js..browser.startup.homepage: "http://websearch.fly...16&lg=EN&cc=US"

FF - prefs.js..browser.search.order.1: "WebSearch"

FF - prefs.js..browser.search.defaultenginename: "WebSearch"

FF - prefs.js..browser.search.selectedEngine: "WebSearch"

FF - prefs.js..browser.search.order.1,S: S", "WebSearch"

FF - prefs.js..browser.search.defaultenginename,S: S", "WebSearch"

FF - prefs.js..browser.search.selectedEngine,S: S", "WebSearch"

FF - prefs.js..keyword.URL: "http://websearch.fly...N&cc=US&l=1&q="

FF - prefs.js..browser.search.defaulturl: "http://websearch.fly...N&cc=US&l=1&q="

FF - user.js - File not found

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINNT\system32\Macromed\Flash\NPSWF32.dll ()

FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()

FF - HKLM\Software\MozillaPlugins\@messenger.yahoo.com/YahooMessengerStatePlugin;version=1.0.0.6: C:\Program Files\Yahoo!\Shared\npYState.dll (Yahoo! Inc.)

FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\2.0.30523.8\npctrl.dll ( Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: C:\WINNT\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.24.15\npGoogleUpdate3.dll File not found

FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.24.15\npGoogleUpdate3.dll File not found

FF - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=2.0.1: C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)

FF - HKCU\Software\MozillaPlugins\@yahoo.com/BrowserPlus,version=2.9.8: d:\data\rainmaker\Local Settings\Application Data\Yahoo!\BrowserPlus\2.9.8\Plugins\npybrowserplus_2.9.8.dll (Yahoo! Inc.)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 29.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 29.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2014/06/05 16:21:14 | 000,000,000 | ---D | M]

[2011/09/03 12:58:15 | 000,000,000 | ---D | M] (No name found) -- d:\data\rainmaker\Application Data\Mozilla\Extensions

[2014/08/26 15:38:45 | 000,000,000 | ---D | M] (No name found) -- d:\data\rainmaker\Application Data\Mozilla\Firefox\Profiles\0gqxbqod.default\extensions

[2014/09/09 21:41:47 | 000,000,000 | ---D | M] (No name found) -- d:\data\rainmaker\Application Data\Mozilla\Firefox\Profiles\0gqxbqod.default\extensions\staged

[2014/03/22 15:56:18 | 002,297,084 | ---- | M] () (No name found) -- d:\data\rainmaker\Application Data\Mozilla\Firefox\Profiles\0gqxbqod.default\extensions\[email protected]

[2014/08/26 15:40:38 | 000,000,636 | ---- | M] () -- d:\data\rainmaker\Application Data\Mozilla\Firefox\Profiles\0gqxbqod.default\searchplugins\WebSearch.xml

[2014/06/05 16:21:10 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\browser\extensions

[2014/06/05 16:21:31 | 000,000,000 | ---D | M] (Default) -- C:\Program Files\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}

========== Chrome ==========

CHR - default_search_provider: WebSearch (Enabled)

CHR - default_search_provider: search_url = http://websearch.fly...616&lg=EN&cc=US

CHR - default_search_provider: suggest_url = http://localhost,

CHR - homepage: http://websearch.fly...616&lg=EN&cc=US

CHR - plugin: Remoting Viewer (Enabled) = internal-remoting-viewer

CHR - plugin: Native Client (Enabled) = C:\Program Files\Google\Chrome\Application\35.0.1916.153\ppGoogleNaClPluginChrome.dll

CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Program Files\Google\Chrome\Application\35.0.1916.153\pdf.dll

CHR - plugin: Shockwave Flash (Enabled) = C:\Program Files\Google\Chrome\Application\35.0.1916.153\gcswf32.dll

CHR - plugin: Shockwave Flash (Enabled) = C:\WINNT\system32\Macromed\Flash\NPSWF32.dll

CHR - plugin: Adobe Acrobat (Enabled) = C:\Program Files\Adobe\Reader 8.0\Reader\Browser\nppdf32.dll

CHR - plugin: QuickTime Plug-in 7.6.2 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin.dll

CHR - plugin: QuickTime Plug-in 7.6.2 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin2.dll

CHR - plugin: QuickTime Plug-in 7.6.2 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin3.dll

CHR - plugin: QuickTime Plug-in 7.6.2 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin4.dll

CHR - plugin: QuickTime Plug-in 7.6.2 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin5.dll

CHR - plugin: QuickTime Plug-in 7.6.2 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin6.dll

CHR - plugin: QuickTime Plug-in 7.6.2 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin7.dll

CHR - plugin: MicrosoftÃƒÂ‚Ã‚Â® DRM (Enabled) = C:\Program Files\Windows Media Player\npdrmv2.dll

CHR - plugin: MicrosoftÃƒÂ‚Ã‚Â® DRM (Enabled) = C:\Program Files\Windows Media Player\npwmsdrm.dll

CHR - plugin: Windows Media Player Plug-in Dynamic Link Library (Enabled) = C:\Program Files\Windows Media Player\npdsplay.dll

CHR - plugin: VLC Web Plugin (Enabled) = C:\Program Files\VideoLAN\VLC\npvlc.dll

CHR - plugin: iTunes Application Detector (Enabled) = C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll

CHR - plugin: Windows Presentation Foundation (Enabled) = C:\WINNT\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll

CHR - plugin: Silverlight Plug-In (Enabled) = c:\Program Files\Microsoft Silverlight\2.0.30523.8\npctrl.dll

CHR - plugin: Google Update (Enabled) = d:\data\rainmaker\Local Settings\Application Data\Google\Update\1.3.21.111\npGoogleUpdate3.dll

CHR - plugin: BrowserPlus (from Yahoo!) v2.9.8 (Enabled) = d:\data\rainmaker\Local Settings\Application Data\Yahoo!\BrowserPlus\2.9.8\Plugins\npybrowserplus_2.9.8.dll

CHR - Extension: Mini Notepad = d:\data\rainmaker\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\apjhdoaiejppfmijnkopdcpjcngdlffj\222\

CHR - Extension: Google Voice Search Hotword (Beta) = d:\data\rainmaker\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn\0.1.1.5023_0\

CHR - Extension: YouTube Flags = d:\data\rainmaker\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\eeammepjjllhpcfnkohocddkmdejjebc\232\

CHR - Extension: Best Save = d:\data\rainmaker\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\ifkgichhpmabepjkbkmfeclembjdbpml\146\

CHR - Extension: Google Wallet = d:\data\rainmaker\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.6.1_0\

CHR - Extension: Responsive Web Design Tester = d:\data\rainmaker\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\objclahbaimlfnbjdeobicmmlnbhamkg\248\

O1 HOSTS File: ([2014/06/21 08:27:04 | 000,000,098 | ---- | M]) - C:\WINNT\system32\drivers\etc\Hosts

O1 - Hosts: 127.0.0.1 localhost

O1 - Hosts: ::1 localhost

O2 - BHO: (&Yahoo! Toolbar Helper) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll (Yahoo! Inc.)

O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)

O2 - BHO: (Adblocker) - {14FECF05-07E6-F00A-022B-972661DBF6D7} - C:\Program Files\Adblocker\AhEu12NXg.dll ()

O2 - BHO: (Search-NeewTab) - {1D2F45C0-E723-C694-063B-A958023E9A1B} - C:\Program Files\Search-NeewTab\0trWpx5X.dll ()

O2 - BHO: (ISavEr) - {48A88D8E-873A-2452-ACF4-2FD4456C5CD2} - d:\data\All Users\Application Data\ISavEr\HqIxdafdhd.dll ()

O2 - BHO: (SSVHelper Class) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll (Sun Microsystems, Inc.)

O2 - BHO: (FFindBeestDoeeall) - {9d91ea96-d5d8-42bf-a426-0f7a7a0cb266} - d:\data\All Users\Application Data\FFindBeestDoeeall\4z9QXXDMby62L6.dll ()

O2 - BHO: (pricecHop) - {AF65D59C-F293-541E-232A-5DEFC263D618} - C:\Program Files\pricecHop\dPtqFGMe.dll ()

O3 - HKLM\..\Toolbar: (Yahoo! Toolbar) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll (Yahoo! Inc.)

O4 - HKLM..\Run: [Bitcasa] C:\Program Files\Bitcasa\BitcasaBoot.exe ()

O4 - HKLM..\Run: [BLOG] C:\Program Files\ThinkPad\Utilities\BATLOGEX.DLL ()

O4 - HKLM..\Run: [IBMPRC] C:\IBMTOOLS\utils\ibmprc.exe (IBM Corp.)

O4 - HKLM..\Run: [McAfeeUpdaterUI] C:\Program Files\Network Associates\Common Framework\UdaterUI.exe (McAfee, Inc.)

O4 - HKLM..\Run: [PWRMGRTR] C:\Program Files\ThinkPad\Utilities\PWRMGRTR.DLL (Lenovo Group Limited)

O4 - HKLM..\Run: [ShStatEXE] C:\Program Files\McAfee\VirusScan Enterprise\SHSTAT.EXE (McAfee, Inc.)

O4 - HKLM..\Run: [SmcService] c:\Program Files\Sygate\SSA\Smc.exe (Sygate Technologies, Inc.)

O4 - HKLM..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe (Synaptics, Inc.)

O4 - HKCU..\Run: [FLV Player] D:\data\rainmaker\Local Settings\Application Data\WebPlayer\FLV Player\WebPlayer.exe File not found

O4 - HKCU..\Run: [LiveSupport] "C:\Program Files\LiveSupport\LiveSupport.exe" /noshow /log File not found

O4 - HKCU..\Run: [Messenger (Yahoo!)] C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe (Yahoo! Inc.)

O4 - Startup: d:\data\All Users\Start Menu\Programs\Startup\TunnelGuard Tray Monitor.lnk = C:\Program Files\Nortel Networks\TunnelGuard\platforms\win32\TGIconApp.EXE (Nortel Networks)

O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoWelcomeScreen = 1

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoSMConfigurePrograms = 1

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: disablecad = 0

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: LogonType = 0

O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present

O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863

O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0

O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145

O8 - Extra context menu item: Sothink Flash Downloader For IE - C:\Program Files\Common Files\SourceTec\SWF Catcher\InternetExplorer.htm ()

O9 - Extra 'Tools' menuitem : Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\NPJPI150_11.dll (Sun Microsystems, Inc.)

O9 - Extra Button: Sothink Flash Downloader For IE - {E19ADC6E-3909-43E4-9A89-B7B676377EE3} - C:\Program Files\Common Files\SourceTec\SWF Catcher\InternetExplorer.htm ()

O9 - Extra 'Tools' menuitem : Sothink Flash Downloader For IE - {E19ADC6E-3909-43E4-9A89-B7B676377EE3} - C:\Program Files\Common Files\SourceTec\SWF Catcher\InternetExplorer.htm ()

O15 - HKLM\..Trusted Domains: rbc.com ([]* in Local intranet)

O15 - HKLM\..Trusted Domains: rbc.com ([*.oak.fg] * in Local intranet)

O15 - HKLM\..Trusted Domains: rbc.com ([mis.fg] https in Trusted sites)

O15 - HKLM\..Trusted Domains: rbc.com ([pmtprojectserver.fg] http in Trusted sites)

O15 - HKLM\..Trusted Domains: rbccm.com ([]https in Trusted sites)

O15 - HKLM\..Trusted Domains: rbccm.com ([crm] * in Local intranet)

O15 - HKLM\..Trusted Domains: royalbank.com ([]* in Local intranet)

O15 - HKCU\..Trusted Domains: rbc.com ([]* in Local intranet)

O15 - HKCU\..Trusted Domains: royalbank.com ([]* in Local intranet)

O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.5.0_11)

O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.ma...t/ultrashim.cab (Reg Error: Key error.)

O16 - DPF: {CAFEEFAC-0015-0000-0011-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.5.0_11)

O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.5.0_11)

O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://download.macr...ash/swflash.cab (Shockwave Flash Object)

O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1

O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = oak.fg.rbc.com

O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{F7CDD4B1-2448-4BD0-9C0C-A8E2B9BEF111}: DhcpNameServer = 192.168.1.1

O20 - AppInit_DLLs: (c:\progra~1\sw-boo~1\assist~1.dll) - c:\Program Files\SW-Booster\Assistant.dll ()

O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINNT\explorer.exe (Microsoft Corporation)

O20 - HKLM Winlogon: UserInit - (C:\WINNT\system32\userinit.exe) - C:\WINNT\system32\userinit.exe (Microsoft Corporation)

O20 - Winlogon\Notify\tpfnf2: DllName - (notifyf2.dll) - C:\WINNT\System32\notifyf2.dll ()

O20 - Winlogon\Notify\tphotkey: DllName - (tphklock.dll) - C:\WINNT\System32\tphklock.dll ()

O21 - SSODL: EldosMountNotificator-cbfs5 - {2FDAFB24-B169-4275-A542-BBBF7E571352} - C:\WINNT\system32\cbfsMntNtf5.dll (EldoS Corporation)

O22 - SharedTaskScheduler: {2FDAFB24-B169-4275-A542-BBBF7E571352} - Virtual Storage Mount Notification - C:\WINNT\system32\cbfsMntNtf5.dll (EldoS Corporation)

O24 - Desktop BackupWallPaper: C:\WINNT\RBCVGA.BMP

O32 - HKLM CDRom: AutoRun - 1

O32 - AutoRun File - [2006/10/18 12:01:14 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]

O34 - HKLM BootExecute: (autocheck autochk *)

O35 - HKLM\..comfile [open] -- "%1" %*

O35 - HKLM\..exefile [open] -- "%1" %*

O37 - HKLM\...com [@ = ComFile] -- "%1" %*

O37 - HKLM\...exe [@ = exefile] -- "%1" %*

O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)

O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)

========== Files/Folders - Created Within 30 Days ==========

[2014/09/24 13:04:33 | 000,000,000 | -HSD | C] -- C:\RECYCLER

[2014/09/19 14:00:31 | 000,000,000 | ---D | C] -- d:\data\All Users\Application Data\FFindBeestDoeeall

[2014/09/09 21:40:03 | 000,000,000 | ---D | C] -- d:\data\All Users\Application Data\ISavEr

[2014/08/28 17:27:10 | 000,000,000 | ---D | C] -- d:\data\NetworkService\Application Data\Yahoo!

[2014/08/26 15:41:23 | 000,000,000 | ---D | C] -- d:\data\All Users\Application Data\Search-NeewTab

[2014/08/26 15:41:22 | 000,000,000 | ---D | C] -- C:\Program Files\Search-NeewTab

[2014/08/26 15:40:15 | 000,000,000 | ---D | C] -- d:\data\All Users\Application Data\VenusApp Software

[2014/08/26 15:40:06 | 000,000,000 | ---D | C] -- C:\Program Files\SW-Booster

[2014/08/26 15:39:08 | 000,000,000 | ---D | C] -- d:\data\All Users\Application Data\Adblocker

[2014/08/26 15:39:07 | 000,000,000 | ---D | C] -- C:\Program Files\Adblocker

[2014/08/26 15:38:48 | 000,000,000 | ---D | C] -- d:\data\All Users\Application Data\pricecHop

[2014/08/26 15:38:48 | 000,000,000 | ---D | C] -- d:\data\All Users\Application Data\3eda283a8b7b0d3d

[2014/08/26 15:38:46 | 000,000,000 | ---D | C] -- C:\Program Files\pricecHop

[2014/08/26 15:38:40 | 000,000,000 | ---D | C] -- d:\data\rainmaker\Local Settings\Application Data\Chromatic Browser

[2014/08/26 15:38:34 | 000,000,000 | ---D | C] -- d:\data\rainmaker\Local Settings\Application Data\Torch

[2014/08/26 15:38:24 | 000,000,000 | ---D | C] -- d:\data\rainmaker\Local Settings\Application Data\Comodo

[2014/08/26 15:37:47 | 000,000,000 | ---D | C] -- d:\data\All Users\Application Data\InstallMate

========== Files - Modified Within 30 Days ==========

[2014/09/24 13:02:08 | 000,000,880 | ---- | M] () -- C:\WINNT\tasks\GoogleUpdateTaskMachineCore.job

[2014/09/24 13:02:06 | 000,000,564 | -H-- | M] () -- C:\WINNT\tasks\SW-Booster-S-787344154.job

[2014/09/24 13:01:31 | 000,002,048 | --S- | M] () -- C:\WINNT\bootstat.dat

[2014/09/23 17:00:01 | 000,000,884 | ---- | M] () -- C:\WINNT\tasks\GoogleUpdateTaskMachineUA.job

[2014/09/23 16:47:20 | 000,000,826 | ---- | M] () -- C:\WINNT\tasks\Adobe Flash Player Updater.job

[2014/09/23 16:44:39 | 000,002,206 | ---- | M] () -- C:\WINNT\System32\wpa.dbl

[2014/08/28 17:27:05 | 000,000,284 | ---- | M] () -- C:\WINNT\tasks\AppleSoftwareUpdate.job

[2014/08/28 16:39:15 | 000,001,324 | ---- | M] () -- C:\WINNT\System32\d3d9caps.dat

========== Files Created - No Company Name ==========

[2014/08/26 15:40:16 | 000,000,564 | -H-- | C] () -- C:\WINNT\tasks\SW-Booster-S-787344154.job

[2014/06/21 10:36:43 | 000,024,064 | ---- | C] () -- C:\WINNT\zoek-delete.exe

[2014/02/28 13:21:06 | 000,000,008 | RHS- | C] () -- d:\data\rainmaker\ntuser.pol

[2013/04/02 16:35:20 | 000,208,896 | ---- | C] () -- C:\WINNT\MBR.exe

[2013/04/02 16:35:19 | 000,256,000 | ---- | C] () -- C:\WINNT\PEV.exe

[2013/04/02 16:35:18 | 000,098,816 | ---- | C] () -- C:\WINNT\sed.exe

[2013/04/02 16:35:18 | 000,080,412 | ---- | C] () -- C:\WINNT\grep.exe

[2013/04/02 16:35:18 | 000,068,096 | ---- | C] () -- C:\WINNT\zip.exe

[2013/03/30 20:35:14 | 000,015,616 | ---- | C] () -- C:\WINNT\System32\drivers\TrueSight.sys

[2011/09/04 15:50:00 | 000,050,688 | ---- | C] () -- d:\data\rainmaker\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

[2011/09/03 12:52:54 | 000,000,118 | ---- | C] () -- d:\data\rainmaker\Local Settings\Application Data\fusioncache.dat

[2010/01/15 22:16:55 | 000,006,954 | RHS- | C] () -- d:\data\All Users\ntuser.pol

========== ZeroAccess Check ==========

[2007/03/20 16:47:16 | 000,000,227 | RHS- | M] () -- C:\WINNT\assembly\Desktop.ini

[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

"" = %SystemRoot%\system32\shdocvw.dll -- [2009/12/22 01:35:10 | 001,509,888 | ---- | M] (Microsoft Corporation)

"ThreadingModel" = Apartment

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]

"" = %systemroot%\system32\wbem\fastprox.dll -- [2009/02/09 06:01:53 | 000,473,088 | ---- | M] (Microsoft Corporation)

"ThreadingModel" = Free

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]

"" = %systemroot%\system32\wbem\wbemess.dll -- [2004/08/04 00:56:48 | 000,273,920 | ---- | M] (Microsoft Corporation)

"ThreadingModel" = Both

========== LOP Check ==========

[2014/09/24 13:18:50 | 000,000,000 | ---D | M] -- d:\data\All Users\Application Data\3eda283a8b7b0d3d

[2014/08/26 15:39:08 | 000,000,000 | ---D | M] -- d:\data\All Users\Application Data\Adblocker

[2008/07/14 19:57:39 | 000,000,000 | ---D | M] -- d:\data\All Users\Application Data\Bloomberg

[2014/09/19 14:00:37 | 000,000,000 | ---D | M] -- d:\data\All Users\Application Data\FFindBeestDoeeall

[2014/08/26 15:40:49 | 000,000,000 | ---D | M] -- d:\data\All Users\Application Data\InstallMate

[2009/04/25 19:16:19 | 000,000,000 | ---D | M] -- d:\data\All Users\Application Data\iPass

[2014/09/09 21:40:09 | 000,000,000 | ---D | M] -- d:\data\All Users\Application Data\ISavEr

[2010/02/05 16:38:28 | 000,000,000 | ---D | M] -- d:\data\All Users\Application Data\LiquidTechnologies

[2007/03/20 17:15:11 | 000,000,000 | ---D | M] -- d:\data\All Users\Application Data\Network Associates

[2014/05/13 10:21:21 | 000,000,000 | ---D | M] -- d:\data\All Users\Application Data\pastaleads

[2013/05/16 11:16:08 | 000,000,000 | ---D | M] -- d:\data\All Users\Application Data\Price Check by AOL

[2014/08/26 15:38:48 | 000,000,000 | ---D | M] -- d:\data\All Users\Application Data\pricecHop

[2014/08/26 15:41:23 | 000,000,000 | ---D | M] -- d:\data\All Users\Application Data\Search-NeewTab

[2014/09/24 13:16:21 | 000,000,000 | ---D | M] -- d:\data\All Users\Application Data\TAkeuTheCoUpOOn

[2014/05/13 10:26:04 | 000,000,000 | ---D | M] -- d:\data\All Users\Application Data\TEMP

[2014/08/26 15:40:50 | 000,000,000 | ---D | M] -- d:\data\All Users\Application Data\VenusApp Software

[2010/02/05 16:38:09 | 000,000,000 | -H-D | M] -- d:\data\All Users\Application Data\{1E2473C2-7307-4952-8F94-5AFE8309DF4D}

[2009/06/17 14:12:31 | 000,000,000 | ---D | M] -- d:\data\All Users\Application Data\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906}

[2012/12/26 15:37:03 | 000,000,000 | ---D | M] -- d:\data\rainmaker\Application Data\Axro

[2014/06/18 13:28:11 | 000,000,000 | ---D | M] -- d:\data\rainmaker\Application Data\BitTorrent

[2012/05/05 12:56:38 | 000,000,000 | ---D | M] -- d:\data\rainmaker\Application Data\Dropbox

[2014/03/23 21:22:10 | 000,000,000 | ---D | M] -- d:\data\rainmaker\Application Data\key-find

[2011/11/22 10:48:41 | 000,000,000 | ---D | M] -- d:\data\rainmaker\Application Data\ZinioReader4.9310D8F796442B71068C511E15D70529A702D19D.1

========== Purity Check ==========

< End of report >

#2
Biscuithd

Posted 24 September 2014 - 12:27 PM

Trusted Helper

Malware Removal
2,573 posts

Hi Amanda,

Yes, I can see the cause of your symptoms and I am willing to work up a fix for you, however, you need to know a few things first. You are using Windows XP which is at it's end of life. Additionally, you are not current on your Services Packs. Last, I see evidence of P2P (Peer-to-Peer) software on your computer. This is a combination that pretty much assures me that you'll be re-infected fairly quickly! So, I'll work up a fix and after that I'll need you to update to the latest Service Pack. Sound good?

#3
amanda222

Posted 24 September 2014 - 12:45 PM

Member

Topic Starter
Member
16 posts

Thanks so much. Lets get started!

#4
Biscuithd

Posted 24 September 2014 - 01:03 PM

Trusted Helper

Malware Removal
2,573 posts

Ok, perform these steps and then let me know how the computer is behaving.

Fix with OTL

Please re-run OTL with this removal script included.

This fix was created for this user for use on that particular machine.
Running it on another one may cause damage and render the system unstable.

Right-click on icon and select Run as Administrator to start the tool.
Under the Custom Scans/Fixes bar in the box paste in the following:

:Commands
[CreateRestorePoint] 
 
:OTL
PRC - [2014/08/26 15:40:15 | 001,082,880 | ---- | M] () -- d:\data\All Users\Application Data\VenusApp Software\SW-Booster\SW-Booster.exe

MOD - [2014/08/26 15:40:15 | 001,082,880 | ---- | M] () -- d:\data\All Users\Application Data\VenusApp Software\SW-Booster\SW-Booster.exe

MOD - [2014/08/26 15:40:06 | 004,296,192 | ---- | M] () -- c:\Program Files\SW-Booster\Assistant.dll

MOD - [2014/08/26 15:40:06 | 000,174,928 | ---- | M] () -- c:\Program Files\SW-Booster\AssistantSvc.dll

O20 - AppInit_DLLs: (c:\progra~1\sw-boo~1\assist~1.dll) - c:\Program Files\SW-Booster\Assistant.dll ()

[2014/08/26 15:40:06 | 000,000,000 | ---D | C] -- C:\Program Files\SW-Booster

[2014/09/24 13:02:06 | 000,000,564 | -H-- | M] () -- C:\WINNT\tasks\SW-Booster-S-787344154.job

SRV - File not found [On_Demand | Stopped] -- C:\Program Files\Google\Update\GoogleUpdate.exe /medsvc -- (gupdatem)

SRV - File not found [Auto | Stopped] -- C:\Program Files\Google\Update\GoogleUpdate.exe /svc -- (gupdate)

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\WINNT\system32\blank.htm

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://websearch.fly...616&lg=EN&cc=US

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,CustomizeSearch =

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL =

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant =

IE - HKLM\..\SearchScopes\{BB74DE59-BC4C-4172-9AC4-73315F71CFFE}: "URL" = http://websearch.fly...616&lg=EN&cc=US

IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/...ms}&FORM=IE8SRC

IE - HKCU\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://www.bing.com/...ms}&FORM=IE8SRC

IE - HKCU\..\SearchScopes\{BB74DE59-BC4C-4172-9AC4-73315F71CFFE}: "URL" = http://websearch.fly...616&lg=EN&cc=US

FF - prefs.js..extensions.enabledAddons: %7B972ce4c6-7e08-4474-a285-3208198ce6fd%7D:29.0.1

FF - prefs.js..browser.startup.homepage: "http://websearch.fly...16&lg=EN&cc=US"

FF - prefs.js..browser.search.order.1: "WebSearch"

FF - prefs.js..browser.search.defaultenginename: "WebSearch"

FF - prefs.js..browser.search.selectedEngine: "WebSearch"

FF - prefs.js..browser.search.order.1,S: S", "WebSearch"

FF - prefs.js..browser.search.defaultenginename,S: S", "WebSearch"

FF - prefs.js..browser.search.selectedEngine,S: S", "WebSearch"

FF - prefs.js..keyword.URL: "http://websearch.fly...N&cc=US&l=1&q="

FF - prefs.js..browser.search.defaulturl: "http://websearch.fly...N&cc=US&l=1&q="

FF - user.js - File not found

FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.24.15\npGoogleUpdate3.dll File not found

FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.24.15\npGoogleUpdate3.dll File not found

[2014/08/26 15:40:38 | 000,000,636 | ---- | M] () -- d:\data\rainmaker\Application Data\Mozilla\Firefox\Profiles\0gqxbqod.default\searchplugins\WebSearch.xml

O2 - BHO: (Adblocker) - {14FECF05-07E6-F00A-022B-972661DBF6D7} - C:\Program Files\Adblocker\AhEu12NXg.dll ()

O2 - BHO: (Search-NeewTab) - {1D2F45C0-E723-C694-063B-A958023E9A1B} - C:\Program Files\Search-NeewTab\0trWpx5X.dll ()

O2 - BHO: (ISavEr) - {48A88D8E-873A-2452-ACF4-2FD4456C5CD2} - d:\data\All Users\Application Data\ISavEr\HqIxdafdhd.dll ()

O2 - BHO: (FFindBeestDoeeall) - {9d91ea96-d5d8-42bf-a426-0f7a7a0cb266} - d:\data\All Users\Application Data\FFindBeestDoeeall\4z9QXXDMby62L6.dll ()

O2 - BHO: (pricecHop) - {AF65D59C-F293-541E-232A-5DEFC263D618} - C:\Program Files\pricecHop\dPtqFGMe.dll ()

O4 - HKCU..\Run: [FLV Player] D:\data\rainmaker\Local Settings\Application Data\WebPlayer\FLV Player\WebPlayer.exe File not found

O4 - HKCU..\Run: [LiveSupport] "C:\Program Files\LiveSupport\LiveSupport.exe" /noshow /log File not found
 
:Files

d:\data\All Users\Application Data\VenusApp Software\SW-Booster\SW-Booster.exe
 
 
:Commands
[ResetHosts] 
[EmptyTemp] 
[Reboot]

Push Run Fix and wait patiently.
If asked to reboot, please allow it to.
A notepad window with a logfile will open after this run. It will be also saved in _OTL\MovedFiles directory on your main drive as (date)_(time).log.

Please include the content of this logfile in your next reply.

#5
amanda222

Posted 24 September 2014 - 07:38 PM

Member

Topic Starter
Member
16 posts

Here is the updated log after running the Fix. PC seems to be running smoother. Will continue to give it a look to see is re-directs continue. Please advise of next step. Thx

OTL logfile created on: 2014/09/24 9:35:00 PM - Run 9

OTL by OldTimer - Version 3.2.69.0 Folder = d:\data\rainmaker\Desktop

Windows XP Professional Edition Service Pack 2 (Version = 5.1.2600) - Type = NTWorkstation

Internet Explorer (Version = 8.0.6001.18702)

Locale: 00000409 | Country: United States | Language: ENU | Date Format: yyyy/MM/dd

1.49 Gb Total Physical Memory | 0.15 Gb Available Physical Memory | 9.98% Memory free

4.13 Gb Paging File | 2.64 Gb Available in Paging File | 63.90% Paging File free

Paging file location(s): C:\pagefile.sys 2850 4092 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINNT | %ProgramFiles% = C:\Program Files

Drive C: | 60.45 Gb Total Space | 22.06 Gb Free Space | 36.49% Space Free | Partition Type: NTFS

Drive D: | 32.70 Gb Total Space | 5.56 Gb Free Space | 17.01% Space Free | Partition Type: NTFS

Computer Name: 3YFK943Z | User Name: rainmaker | Logged in as Administrator.

Boot Mode: Normal | Scan Mode: Current user

Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2014/08/26 15:40:15 | 001,082,880 | ---- | M] () -- d:\data\All Users\Application Data\VenusApp Software\SW-Booster\SW-Booster.exe

PRC - [2014/06/05 09:58:39 | 000,860,488 | ---- | M] (Google Inc.) -- C:\Program Files\Google\Chrome\Application\chrome.exe

PRC - [2013/03/29 10:52:25 | 000,602,112 | ---- | M] (OldTimer Tools) -- d:\data\rainmaker\Desktop\OTL.exe

PRC - [2012/05/25 04:25:02 | 006,595,928 | ---- | M] (Yahoo! Inc.) -- C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe