[noluv]

im on my sons acct who told me about this site when i described my problem.

theres a man witha headset on everyscreen that wont go away

i tried malware bytes but that didnt work either

please any help would be grateful

 

Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version:12-09-2015
Ran by Tyrone (administrator) on TYRONE-PC (23-03-2014 18:25:46)
Running from C:\Users\Tyrone\Downloads
Loaded Profiles: Tyrone (Available Profiles: Tyrone)
Platform: Windows Vista ™ Home Premium Service Pack 2 (X64) Language: English (United States)
Internet Explorer Version 9 (Default browser: IE)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo...very-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(NVIDIA Corporation) C:\WINDOWS\System32\nvvsvc.exe
(Microsoft Corporation) C:\WINDOWS\System32\SLsvc.exe
(Microsoft Corporation) C:\WINDOWS\System32\wlanext.exe
(PCRx.com, LLC) C:\Program Files (x86)\24x7Help\App24x7Svc.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe
() C:\Program Files (x86)\HP\QuickPlay\Kernel\TV\QPCapSvc.exe
() C:\Program Files (x86)\CyberLink\Shared Files\RichVideo.exe
() C:\Program Files (x86)\Feather Mail Toolbar\ToolbarUpdaterService.exe
(Conexant Systems, Inc.) C:\WINDOWS\System32\drivers\XAudio64.exe
(Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\Shared\hpqWmiEx.exe
() C:\Program Files (x86)\HP\QuickPlay\Kernel\TV\QPSched.exe
(Microsoft Corporation) C:\WINDOWS\System32\rundll32.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe
(Microsoft Corporation) C:\WINDOWS\System32\rundll32.exe
(Alps Electric Co., Ltd.) C:\Program Files\Apoint2K\Apoint.exe
( Hewlett-Packard Development Company, L.P.) C:\Program Files\Hewlett-Packard\HP QuickTouch\HPKBDAPP.exe
(Microsoft Corporation) C:\Program Files\Windows Defender\MSASCui.exe
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe
(Inbox.com, Inc.) C:\Program Files (x86)\RebateInformer\RebateInf.exe
(Microsoft Corporation) C:\WINDOWS\ehome\ehtray.exe
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Office\Office12\ONENOTEM.EXE
(CyberLink Corp.) C:\Program Files (x86)\HP\QuickPlay\QPService.exe
( Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch Buttons\QLBCTRL.exe
(Hewlett-Packard) C:\Program Files (x86)\HP\Digital Imaging\bin\HpqSRmon.exe
(Hewlett-Packard) C:\Program Files (x86)\HP\HP Software Update\hpwuSchd2.exe
(Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
(Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe
(Sun Microsystems, Inc.) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Microsoft Corporation) C:\WINDOWS\ehome\ehmsas.exe
(Bandoo Media, inc) C:\Program Files (x86)\Searchqu Toolbar\Datamngr\datamngrUI.exe
(Crawler, LLC) C:\Program Files (x86)\SiteRanker\SiteRankTray.exe
(Alps Electric Co., Ltd.) C:\Program Files\Apoint2K\ApMsgFwd.exe
(Crawler.com) C:\Program Files (x86)\PCPowerSpeed\PCPowerTray.exe
(Alps Electric Co., Ltd.) C:\Program Files\Apoint2K\ApntEx.exe
(Inbox.com, Inc.) C:\Program Files (x86)\Inbox Toolbar\Inbox.exe
(Crawler.com) C:\Program Files (x86)\OnlineVault\OVTray.exe
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\BTStackServer.exe
() C:\Program Files (x86)\Hewlett-Packard\Shared\HpqToaster.exe
(Crawler, LLC) C:\Program Files (x86)\24x7Help\App24x7Help.exe
(PCRx.com, LLC) C:\Program Files (x86)\24x7Help\App24x7Hook.exe
(PCRx.com, LLC) C:\Program Files (x86)\24x7Help\App24x7Hook64.exe
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\BluetoothHeadsetProxy.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbam.exe
(Symantec Corporation) C:\Program Files (x86)\Symantec\LiveUpdate\AluSchedulerSvc.exe
(Hewlett-Packard) C:\Program Files (x86)\Hewlett-Packard\HP Health Check\HPHC_Service.exe
(Microsoft Corporation) C:\Program Files\Windows Media Player\wmpnscfg.exe
(Adobe Systems, Inc.) C:\WINDOWS\SysWOW64\Macromed\Flash\FlashUtil10w_ActiveX.exe

==================== Registry (Whitelisted) ===========================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [NvCplDaemon] => RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
HKLM\...\Run: [NvMediaCenter] => RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
HKLM\...\Run: [Apoint] => C:\Program Files\Apoint2K\Apoint.exe [218112 2007-07-08] (Alps Electric Co., Ltd.)
HKLM\...\Run: [OnScreenDisplay] => C:\Program Files\Hewlett-Packard\HP QuickTouch\HPKBDAPP.exe [701440 2007-09-04] ( Hewlett-Packard Development Company, L.P.)
HKLM\...\Run: [Windows Defender] => C:\Program Files\Windows Defender\MSASCui.exe [1584184 2008-01-20] (Microsoft Corporation)
HKLM\...\Run: [HP Health Check Scheduler] => [ProgramFilesFolder]Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe
HKLM-x32\...\Run: [QPService] => C:\Program Files (x86)\HP\QuickPlay\QPService.exe [468264 2007-12-19] (CyberLink Corp.)
HKLM-x32\...\Run: [QlbCtrl] => C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe [202032 2007-09-19] ( Hewlett-Packard Development Company, L.P.)
HKLM-x32\...\Run: [UCam_Menu] => C:\Program Files (x86)\CyberLink\YouCam\MUITransfer\MUIStartMenu.exe [218408 2007-08-16] (CyberLink Corp.)
HKLM-x32\...\Run: [hpqSRMon] => C:\Program Files (x86)\HP\Digital Imaging\bin\hpqSRMon.exe [80896 2007-08-22] (Hewlett-Packard)
HKLM-x32\...\Run: [Adobe Reader Speed Launcher] => C:\Program Files (x86)\Adobe\Reader 8.0\Reader\Reader_sl.exe [40048 2007-05-11] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [HP Software Update] => C:\Program Files (x86)\Hp\HP Software Update\HPWuSchd2.exe [54840 2007-05-08] (Hewlett-Packard)
HKLM-x32\...\Run: [hpWirelessAssistant] => C:\Program Files (x86)\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe [480560 2007-09-13] (Hewlett-Packard Development Company, L.P.)
HKLM-x32\...\Run: [WAWifiMessage] => C:\Program Files (x86)\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe [311296 2007-01-08] (Hewlett-Packard Development Company, L.P.)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [254696 2011-04-08] (Sun Microsystems, Inc.)
HKLM-x32\...\Run: [DATAMNGR] => C:\Program Files (x86)\Searchqu Toolbar\Datamngr\datamngrUI.exe [1694608 2012-03-12] (Bandoo Media, inc)
HKLM-x32\...\Run: [SiteRanker] => C:\Program Files (x86)\SiteRanker\SiteRankTray.exe [320000 2011-11-16] (Crawler, LLC)
HKLM-x32\...\Run: [PCPowerSpeed] => C:\Program Files (x86)\PCPowerSpeed\PCPowerTray.exe [385664 2011-09-27] (Crawler.com)
HKLM-x32\...\Run: [24x7HELP] => C:\Program Files (x86)\24x7Help\App24x7Help.exe [1766040 2012-12-11] (Crawler, LLC)
HKLM-x32\...\Run: [InboxToolbar] => C:\Program Files (x86)\Inbox Toolbar\Inbox.exe [1681120 2012-10-24] (Inbox.com, Inc.)
HKLM-x32\...\Run: [Online Vault] => C:\Program Files (x86)\OnlineVault\OVTray.exe [371360 2012-11-21] (Crawler.com)
HKU\S-1-5-21-3224521152-2373409109-2273049155-1000\...\Run: [LightScribe Control Panel] => C:\Program Files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe [455968 2007-08-23] (Hewlett-Packard Company)
HKU\S-1-5-21-3224521152-2373409109-2273049155-1000\...\Run: [RebateInformer] => C:\Program Files (x86)\RebateInformer\RebateInf.exe [1114112 2011-11-16] (Inbox.com, Inc.)
HKU\S-1-5-21-3224521152-2373409109-2273049155-1000\...\Run: [ehTray.exe] => C:\Windows\ehome\ehTray.exe [138240 2008-01-20] (Microsoft Corporation)
AppInit_DLLs: C:\PROGRA~2\SEARCH~1\Datamngr\x64\datamngr.dll => C:\Program Files (x86)\Searchqu Toolbar\Datamngr\x64\datamngr.dll [1778584 2012-03-12] (Bandoo Media, inc)
AppInit_DLLs:  C:\PROGRA~2\SEARCH~1\Datamngr\x64\IEBHO.dll => C:\Program Files (x86)\Searchqu Toolbar\Datamngr\x64\IEBHO.dll [1791384 2012-03-12] (Bandoo Media, inc)
AppInit_DLLs-x32: C:\PROGRA~2\SEARCH~1\Datamngr\datamngr.dll => C:\Program Files (x86)\Searchqu Toolbar\Datamngr\datamngr.dll [1236368 2012-03-12] (Bandoo Media, inc)
AppInit_DLLs-x32:  C:\PROGRA~2\SEARCH~1\Datamngr\IEBHO.dll => C:\Program Files (x86)\Searchqu Toolbar\Datamngr\IEBHO.dll [1233816 2012-03-12] (Bandoo Media, inc)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Bluetooth.lnk [2008-04-18]
ShortcutTarget: Bluetooth.lnk -> C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe (Broadcom Corporation.)
Startup: C:\Users\Tyrone\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2007 Screen Clipper and Launcher.lnk [2013-12-12]
ShortcutTarget: OneNote 2007 Screen Clipper and Launcher.lnk -> C:\Program Files (x86)\Microsoft Office\Office12\ONENOTEM.EXE (Microsoft Corporation)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

Tcpip\Parameters: [DhcpNameServer] 192.168.43.1
Tcpip\..\Interfaces\{A6F72DFA-B7A3-48FB-B1BD-E2F6DB769AD7}: [DhcpNameServer] 192.168.43.1
Tcpip\..\Interfaces\{CDD5C042-DC5D-4F15-9570-894BBAA3672F}: [DhcpNameServer] 192.168.1.1

Internet Explorer:
==================
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=en_us&c=81&bd=Pavilion&pf=laptop
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=en_us&c=81&bd=Pavilion&pf=laptop
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=en_us&c=81&bd=Pavilion&pf=laptop
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=en_us&c=81&bd=Pavilion&pf=laptop
HKU\S-1-5-21-3224521152-2373409109-2273049155-1000\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.inbox.com/homepage.aspx?tbid=80291&lng=en
HKU\S-1-5-21-3224521152-2373409109-2273049155-1000\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=en_us&c=81&bd=Pavilion&pf=laptop
HKU\S-1-5-21-3224521152-2373409109-2273049155-1000\Software\Microsoft\Internet Explorer\Main,Search Bar = hxxp://toolbar.inbox.com/search/dispatcher.aspx?tp=aus&qkw=%s&tbid=%tb_id&%language
HKU\S-1-5-21-3224521152-2373409109-2273049155-1000\Software\Microsoft\Internet Explorer\Main,Start Page Restore = hxxp://www.inbox.com/homepage.aspx?tbid=80291&lng=en
URLSearchHook: HKLM-x32 - Produtools Manuals Toolbar - {16bb67e0-6319-4077-be84-f41269e051f3} - C:\Program Files (x86)\Produtools_Manuals\prxtbProd.dll (Conduit Ltd.)
URLSearchHook: HKLM-x32 - Produtools Manuals 2.1 Toolbar - {b2bf7b3f-bf0b-4c48-aec6-f92c51be63e1} - C:\Program Files (x86)\Produtools_Manuals_2.1\prxtbProd.dll (Conduit Ltd.)
URLSearchHook: [S-1-5-21-3224521152-2373409109-2273049155-1000] ATTENTION => Default URLSearchHook is missing
URLSearchHook: HKU\S-1-5-21-3224521152-2373409109-2273049155-1000 - Inbox Toolbar - {D3D233D5-9F6D-436C-B6C7-E63F77503B30} - C:\Program Files (x86)\Inbox Toolbar\Inbox.dll (Inbox.com, Inc.)
URLSearchHook: HKU\S-1-5-21-3224521152-2373409109-2273049155-1000 - Produtools Manuals Toolbar - {16bb67e0-6319-4077-be84-f41269e051f3} - C:\Program Files (x86)\Produtools_Manuals\prxtbProd.dll (Conduit Ltd.)
URLSearchHook: HKU\S-1-5-21-3224521152-2373409109-2273049155-1000 - Produtools Manuals 2.1 Toolbar - {b2bf7b3f-bf0b-4c48-aec6-f92c51be63e1} - C:\Program Files (x86)\Produtools_Manuals_2.1\prxtbProd.dll (Conduit Ltd.)
SearchScopes: HKLM -> DefaultScope {9BB47C17-9C68-4BB3-B188-DD9AF0FD21} URL = hxxp://dts.search-results.com/sr?src=ieb&gct=ds&appid=221&systemid=1&apn_dtid=IME001&apn_ptnrs=AGE&o=APN10653&apn_uid=1042151012054953&q={searchTerms}
SearchScopes: HKLM -> {0CF6313C-7FEA-4F4C-AF17-E203F661BD27} URL = hxxp://search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=hp-pvdt
SearchScopes: HKLM -> {9BB47C17-9C68-4BB3-B188-DD9AF0FD21} URL = hxxp://dts.search-results.com/sr?src=ieb&gct=ds&appid=221&systemid=1&apn_dtid=IME001&apn_ptnrs=AGE&o=APN10653&apn_uid=1042151012054953&q={searchTerms}
SearchScopes: HKLM -> {9BB47C17-9C68-4BB3-B188-DD9AF0FD2406} URL = hxxp://dts.search-results.com/sr?src=ieb&appid=139&systemid=406&sr=0&q={searchTerms}
SearchScopes: HKLM -> {A980C307-6F73-41E8-9246-3266F5CA6BB2} URL = hxxp://www.ask.com/web?q={searchterms}&l=dis&o=ushpd
SearchScopes: HKLM-x32 -> DefaultScope {9BB47C17-9C68-4BB3-B188-DD9AF0FD21} URL = hxxp://dts.search-results.com/sr?src=ieb&gct=ds&appid=221&systemid=1&apn_dtid=IME001&apn_ptnrs=AGE&o=APN10653&apn_uid=1042151012054953&q={searchTerms}
SearchScopes: HKLM-x32 -> {0CF6313C-7FEA-4F4C-AF17-E203F661BD27} URL = hxxp://search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=hp-pvdt
SearchScopes: HKLM-x32 -> {9BB47C17-9C68-4BB3-B188-DD9AF0FD21} URL = hxxp://dts.search-results.com/sr?src=ieb&gct=ds&appid=221&systemid=1&apn_dtid=IME001&apn_ptnrs=AGE&o=APN10653&apn_uid=1042151012054953&q={searchTerms}
SearchScopes: HKLM-x32 -> {9BB47C17-9C68-4BB3-B188-DD9AF0FD2406} URL = hxxp://dts.search-results.com/sr?src=ieb&appid=139&systemid=406&sr=0&q={searchTerms}
SearchScopes: HKLM-x32 -> {A980C307-6F73-41E8-9246-3266F5CA6BB2} URL = hxxp://www.ask.com/web?q={searchterms}&l=dis&o=ushpd
SearchScopes: HKU\S-1-5-21-3224521152-2373409109-2273049155-1000 -> DefaultScope {9BB47C17-9C68-4BB3-B188-DD9AF0FD21} URL = hxxp://dts.search-results.com/sr?src=ieb&gct=ds&appid=221&systemid=1&apn_dtid=IME001&apn_ptnrs=AGE&o=APN10653&apn_uid=1042151012054953&q={searchTerms}
SearchScopes: HKU\S-1-5-21-3224521152-2373409109-2273049155-1000 -> {0CF6313C-7FEA-4F4C-AF17-E203F661BD27} URL = hxxp://search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=hp-pvdt
SearchScopes: HKU\S-1-5-21-3224521152-2373409109-2273049155-1000 -> {18F2C19B-BDD3-49BD-BAD3-E8E445FFE558} URL = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}&ie={inputEncoding}&oe={outputEncoding}&startIndex={startIndex?}&startPage={startPage}
SearchScopes: HKU\S-1-5-21-3224521152-2373409109-2273049155-1000 -> {9BB47C17-9C68-4BB3-B188-DD9AF0FD21} URL = hxxp://dts.search-results.com/sr?src=ieb&gct=ds&appid=221&systemid=1&apn_dtid=IME001&apn_ptnrs=AGE&o=APN10653&apn_uid=1042151012054953&q={searchTerms}
SearchScopes: HKU\S-1-5-21-3224521152-2373409109-2273049155-1000 -> {9BB47C17-9C68-4BB3-B188-DD9AF0FD2406} URL = hxxp://dts.search-results.com/sr?src=ieb&appid=139&systemid=406&sr=0&q={searchTerms}
SearchScopes: HKU\S-1-5-21-3224521152-2373409109-2273049155-1000 -> {A980C307-6F73-41E8-9246-3266F5CA6BB2} URL = hxxp://www.ask.com/web?q={searchterms}&l=dis&o=ushpd
SearchScopes: HKU\S-1-5-21-3224521152-2373409109-2273049155-1000 -> {C04B7D22-5AEC-4561-8F49-27F6269208F6} URL = hxxp://www2.inbox.com/search/dispatcher.aspx?tp=bs&qkw={searchTerms}&tbid=80291&lng=en
SearchScopes: HKU\S-1-5-21-3224521152-2373409109-2273049155-1000 -> {CB91D0ED-051F-EAAD-1F55-1B61DF44075C} URL = hxxp://www.bing.com/search?q={searchTerms}&pc=Z211&form=ZGAIDF&install_date=20111119&iesrc={referrer:source}
BHO: DataMngr -> {9D717F81-9148-4f12-8568-69135F087DB0} -> C:\Program Files (x86)\Searchqu Toolbar\Datamngr\x64\BrowserConnection.dll [2012-03-12] (Bandoo Media, inc)
BHO-x32: No Name -> {02478D38-C3F9-4efb-9B51-7695ECA05670} ->  No File
BHO-x32: Adobe PDF Reader Link Helper -> {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} -> C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll [2006-10-23] (Adobe Systems Incorporated)
BHO-x32: No Name -> {11BF46C6-B3DE-48BD-BF70-3AD85CAB80B5} -> C:\Program Files (x86)\SiteRanker\SiteRank.dll [2012-02-20] (Crawler, LLC)
BHO-x32: Produtools Manuals Toolbar -> {16bb67e0-6319-4077-be84-f41269e051f3} -> C:\Program Files (x86)\Produtools_Manuals\prxtbProd.dll [2011-05-09] (Conduit Ltd.)
BHO-x32: Search-Results Toolbar -> {31d8407c-62e4-4125-a4a9-717efb1a56ae} -> C:\Program Files (x86)\iMesh Applications\Mediabar\Datamngr\SRTOOL~1\searchresultsDx.dll [2012-10-02] (APN LLC)
BHO-x32: No Name -> {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} ->  No File
BHO-x32: Feather Mail Toolbar Helper -> {657A4245-5212-4390-A997-C3CB0C6D60B4} -> C:\Program Files (x86)\Feather Mail Toolbar\Toolbar32.dll [2011-11-15] ()
BHO-x32: AppGraffiti -> {6F6A5334-78E9-4D9B-8182-8B41EA8C39EF} -> C:\Program Files (x86)\AppGraffiti\AppGraffiti.dll [2013-03-20] (Omega Partners Ltd)
BHO-x32: Searchqu Toolbar -> {99079a25-328f-4bd4-be04-00955acaa0a7} -> C:\Program Files (x86)\Searchqu Toolbar\Datamngr\ToolBar\searchqudtx.dll [2012-02-27] ()
BHO-x32: DataMngr -> {9D717F81-9148-4f12-8568-69135F087DB0} -> C:\Program Files (x86)\Searchqu Toolbar\Datamngr\BrowserConnection.dll [2012-03-12] (Bandoo Media, inc)
BHO-x32: Produtools Manuals 2.1 Toolbar -> {b2bf7b3f-bf0b-4c48-aec6-f92c51be63e1} -> C:\Program Files (x86)\Produtools_Manuals_2.1\prxtbProd.dll [2011-05-09] (Conduit Ltd.)
BHO-x32: No Name -> {CCB69577-088B-4004-9ED8-FF5BCC83A039} -> C:\Program Files (x86)\RebateInformer\RebateI.dll [2011-11-16] (Inbox.com, Inc.)
BHO-x32: Inbox Toolbar -> {D3D233D5-9F6D-436C-B6C7-E63F77503B30} -> C:\Program Files (x86)\Inbox Toolbar\Inbox.dll [2012-10-24] (Inbox.com, Inc.)
BHO-x32: Java™ Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll [2011-09-11] (Sun Microsystems, Inc.)
BHO-x32: HP Print Clips -> {FFFFFFFF-FF12-44C5-91EC-068E3AA1B2D7} -> c:\Program Files (x86)\HP\Smart Web Printing\hpswp_framework.dll [2007-08-31] (Hewlett-Packard Co.)
Toolbar: HKLM-x32 - No Name - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} -  No File
Toolbar: HKLM-x32 - &Inbox Toolbar - {D7E97865-918F-41E4-9CD0-25AB1C574CE8} - C:\Program Files (x86)\Inbox Toolbar\Inbox.dll [2012-10-24] (Inbox.com, Inc.)
Toolbar: HKLM-x32 - Feather Mail Toolbar - {271898BB-6159-4ED2-AADA-564C975024BF} - C:\Program Files (x86)\Feather Mail Toolbar\Toolbar32.dll [2011-11-15] ()
Toolbar: HKLM-x32 - Produtools Manuals Toolbar - {16bb67e0-6319-4077-be84-f41269e051f3} - C:\Program Files (x86)\Produtools_Manuals\prxtbProd.dll [2011-05-09] (Conduit Ltd.)
Toolbar: HKLM-x32 - Produtools Manuals 2.1 Toolbar - {b2bf7b3f-bf0b-4c48-aec6-f92c51be63e1} - C:\Program Files (x86)\Produtools_Manuals_2.1\prxtbProd.dll [2011-05-09] (Conduit Ltd.)
Toolbar: HKLM-x32 - Searchqu Toolbar - {99079a25-328f-4bd4-be04-00955acaa0a7} - C:\Program Files (x86)\Searchqu Toolbar\Datamngr\ToolBar\searchqudtx.dll [2012-02-27] ()
Toolbar: HKLM-x32 - Search-Results Toolbar - {31d8407c-62e4-4125-a4a9-717efb1a56ae} - C:\Program Files (x86)\iMesh Applications\Mediabar\Datamngr\SRTOOL~1\searchresultsDx.dll [2012-10-02] (APN LLC)
Handler-x32: inbox - {37540F19-DD4C-478B-B2DF-C19281BCAF27} - C:\Program Files (x86)\Inbox Toolbar\Inbox.dll [2012-10-24] (Inbox.com, Inc.)
Handler-x32: rebinfo - {AF808758-C780-404C-A4EE-4526323FD9B6} - C:\Program Files (x86)\RebateInformer\RebateI.dll [2011-11-16] (Inbox.com, Inc.)

FireFox:
========
FF Plugin-x32: @java.com/JavaPlugin -> C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll [2011-09-11] (Sun Microsystems, Inc.)
FF Plugin-x32: @microsoft.com/WPF,version=3.5 -> c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll [2008-07-29] (Microsoft Corporation)
FF Plugin-x32: @viewpoint.com/VMP -> C:\Program Files (x86)\Viewpoint\Viewpoint Experience Technology\npViewpoint.dll [2004-02-20] ()
FF HKLM-x32\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
FF Extension: Microsoft .NET Framework Assistant - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension [2011-09-11]
FF HKLM-x32\...\Firefox\Extensions: [[email protected]] - C:\Program Files (x86)\SiteRanker\firefox
FF Extension: SiteRanker - C:\Program Files (x86)\SiteRanker\firefox [2012-03-02]

==================== Services (Whitelisted) ========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R2 24x7HelpSvc; C:\Program Files (x86)\24x7Help\App24x7Svc.exe [394352 2012-02-29] (PCRx.com, LLC)
R2 Automatic LiveUpdate Scheduler; c:\Program Files (x86)\Symantec\LiveUpdate\AluSchedulerSvc.exe [243064 2007-08-31] (Symantec Corporation)
S3 Com4Qlb; C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch Buttons\Com4Qlb.exe [110592 2007-03-05] (Hewlett-Packard Development Company, L.P.) [File not signed]
R2 HP Health Check Service; c:\Program Files (x86)\Hewlett-Packard\HP Health Check\hphc_service.exe [65536 2007-09-19] (Hewlett-Packard) [File not signed]
R2 hpqwmiex; C:\Program Files (x86)\Hewlett-Packard\Shared\hpqWmiEx.exe [135168 2006-05-02] (Hewlett-Packard Development Company, L.P.) [File not signed]
S3 IDriverT; C:\Program Files (x86)\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe [69632 2005-04-04] (Macrovision Corporation) [File not signed]
S3 LiveUpdate; c:\Program Files (x86)\Symantec\LiveUpdate\LuComServer_3_4.EXE [3192184 2007-08-23] (Symantec Corporation)
R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [398184 2012-12-14] (Malwarebytes Corporation) [File not signed]
R2 MBAMService; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [682344 2012-12-14] (Malwarebytes Corporation) [File not signed]
R2 QPCapSvc; C:\Program Files (x86)\HP\QuickPlay\Kernel\TV\QPCapSvc.exe [271760 2007-12-19] ()
R2 QPSched; C:\Program Files (x86)\HP\QuickPlay\Kernel\TV\QPSched.exe [112016 2007-12-19] ()
R2 RichVideo; C:\Program Files (x86)\CyberLink\Shared Files\RichVideo.exe [272024 2007-01-09] ()
R2 Updater Service for Feather Mail Toolbar; C:\Program Files (x86)\Feather Mail Toolbar\ToolbarUpdaterService.exe [244960 2011-11-15] ()
R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [383544 2008-01-20] (Microsoft Corporation)

===================== Drivers (Whitelisted) ==========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

S3 HdAudAddService; C:\Windows\System32\drivers\CHDART64.sys [207872 2007-10-01] (Conexant Systems Inc.)
R3 HpqRemHid; C:\Windows\System32\DRIVERS\HpqRemHid.sys [9088 2007-07-11] (Hewlett-Packard Development Company, L.P.)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [24176 2012-12-14] (Malwarebytes Corporation) [File not signed]
U1 eabfiltr; no ImagePath
S3 IpInIp; system32\DRIVERS\ipinip.sys [X]
S3 NwlnkFlt; system32\DRIVERS\nwlnkflt.sys [X]
S3 NwlnkFwd; system32\DRIVERS\nwlnkfwd.sys [X]
S3 SymIMMP; system32\DRIVERS\SymIM.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

==================== One Month Created files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2014-03-23 18:25 - 2014-03-23 18:27 - 00023675 _____ C:\Users\Tyrone\Downloads\FRST.txt
2014-03-23 18:24 - 2014-03-23 18:25 - 00000000 ____D C:\FRST
2014-03-23 18:24 - 2014-03-23 18:24 - 02190848 _____ (Farbar) C:\Users\Tyrone\Downloads\FRST64.exe
2014-03-23 18:22 - 2014-03-23 18:23 - 01692160 _____ (Farbar) C:\Users\Tyrone\Downloads\FRST.exe
2014-03-23 17:39 - 2014-03-23 17:39 - 00710504 _____ C:\Windows\isRS-000.tmp

==================== One Month Modified files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2014-03-23 18:18 - 2011-11-19 13:45 - 00000000 ____D C:\Program Files (x86)\RebateInformer
2014-03-23 18:17 - 2008-04-18 16:48 - 01801286 _____ C:\Windows\WindowsUpdate.log
2014-03-23 17:48 - 2006-11-02 05:46 - 00005526 _____ C:\Windows\system32\PerfStringBackup.INI
2014-03-23 17:41 - 2011-09-11 12:34 - 00064670 _____ C:\ProgramData\nvModes.001
2014-03-23 17:40 - 2011-09-11 10:52 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2014-03-23 17:40 - 2008-04-18 17:09 - 00000264 _____ C:\Users\Public\Documents\hpqp.ini
2014-03-23 17:40 - 2006-11-02 08:42 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2014-03-23 17:40 - 2006-11-02 08:22 - 00003216 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
2014-03-23 17:40 - 2006-11-02 08:22 - 00003216 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
2014-03-23 17:39 - 2012-01-21 18:05 - 00000948 _____ C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2014-03-23 17:39 - 2011-09-11 10:52 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
2014-03-23 17:39 - 2008-04-18 16:48 - 00000012 _____ C:\Windows\bthservsdp.dat
2014-03-23 17:39 - 2006-11-02 08:42 - 00032526 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2014-03-23 17:04 - 2011-09-11 12:34 - 00064670 _____ C:\ProgramData\nvModes.dat
2014-03-23 08:28 - 2011-11-19 13:45 - 00000000 ____D C:\Users\Tyrone\AppData\Roaming\PCPowerSpeed
2014-03-23 08:24 - 2011-09-20 15:15 - 00000852 _____ C:\Users\Tyrone\AppData\Roaming\wklnhst.dat
2014-03-15 21:27 - 2011-09-11 09:01 - 00010240 _____ C:\Users\Tyrone\Documents\1155 hamilton32205.wps
2014-03-15 13:53 - 2011-11-19 13:45 - 00000000 ____D C:\Program Files (x86)\SiteRanker
2014-03-15 00:34 - 2011-10-19 15:06 - 00000021 _____ C:\Users\Public\Documents\hpqp.txt

==================== Files in the root of some directories =======

2011-09-20 15:15 - 2014-03-23 08:24 - 0000852 _____ () C:\Users\Tyrone\AppData\Roaming\wklnhst.dat
2011-09-11 10:36 - 2011-09-11 10:36 - 0000000 _____ () C:\Users\Tyrone\AppData\Local\AtStart.txt
2012-02-12 15:10 - 2012-02-12 15:10 - 0000680 _____ () C:\Users\Tyrone\AppData\Local\d3d9caps.dat
2011-09-13 18:58 - 2013-12-12 08:25 - 0008192 _____ () C:\Users\Tyrone\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2011-09-11 10:36 - 2011-09-11 10:36 - 0000000 _____ () C:\Users\Tyrone\AppData\Local\DSwitch.txt
2011-12-23 16:06 - 2011-12-23 16:06 - 0002570 ___SH () C:\Users\Tyrone\AppData\Local\l33f14671p7lcw2vi6qh847
2011-09-11 10:36 - 2011-09-11 10:36 - 0000000 _____ () C:\Users\Tyrone\AppData\Local\QSwitch.txt
2008-02-22 10:19 - 2008-02-22 10:20 - 0000371 _____ () C:\ProgramData\hpzinstall.log
2011-12-23 16:06 - 2011-12-23 16:06 - 0002570 ___SH () C:\ProgramData\l33f14671p7lcw2vi6qh847
2011-09-11 17:04 - 2011-09-11 17:20 - 0454796 _____ () C:\ProgramData\LuUninstall.LiveUpdate
2011-09-11 12:34 - 2014-03-23 17:41 - 0064670 _____ () C:\ProgramData\nvModes.001
2011-09-11 12:34 - 2014-03-23 17:04 - 0064670 _____ () C:\ProgramData\nvModes.dat

Some files in TEMP:
====================
C:\Users\Tyrone\AppData\Local\Temp\386.2475.exe
C:\Users\Tyrone\AppData\Local\Temp\AdbeRdr1012_en_US.exe
C:\Users\Tyrone\AppData\Local\Temp\FlashPlayerUpdate.exe
C:\Users\Tyrone\AppData\Local\Temp\GoogleToolbarInstaller_en32_signed.exe
C:\Users\Tyrone\AppData\Local\Temp\gtbcheck.exe
C:\Users\Tyrone\AppData\Local\Temp\HPQSi.exe
C:\Users\Tyrone\AppData\Local\Temp\iMesh_setup.exe
C:\Users\Tyrone\AppData\Local\Temp\installhelper.dll
C:\Users\Tyrone\AppData\Local\Temp\install_reader10_en_gtba_aih.exe
C:\Users\Tyrone\AppData\Local\Temp\jre-6u33-windows-i586-iftw.exe
C:\Users\Tyrone\AppData\Local\Temp\SetupDataMngr_Searchqu.exe
C:\Users\Tyrone\AppData\Local\Temp\SRAssetsHelper.dll

==================== Bamital & volsnap =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\dnsapi.dll => File is digitally signed
C:\Windows\SysWOW64\dnsapi.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed

LastRegBack: 2014-03-23 18:09

==================== End of FRST.txt ============================

 

 

 

 

 

 

 

 

 

Additional scan result of Farbar Recovery Scan Tool (x64) Version:12-09-2015
Ran by Tyrone (2014-03-23 18:27:51)
Running from C:\Users\Tyrone\Downloads
Windows Vista ™ Home Premium Service Pack 2 (X64) (2008-04-18 23:48:54)
Boot Mode: Normal
==========================================================

==================== Accounts: =============================

Administrator (S-1-5-21-3224521152-2373409109-2273049155-500 - Administrator - Disabled)
Guest (S-1-5-21-3224521152-2373409109-2273049155-501 - Limited - Disabled)
Tyrone (S-1-5-21-3224521152-2373409109-2273049155-1000 - Administrator - Enabled) => C:\Users\Tyrone

==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AS: Windows Defender (Enabled - Out of date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

(Only the adware programs with "Hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

24x7 Help (HKLM-x32\...\{A957F04C-49F4-4375-8C8A-D04B769EFE47}_is1) (Version: 1.0.0.2 - PCRx.com, LLC) <==== ATTENTION
Activation Assistant for the 2007 Microsoft Office suites (HKLM-x32\...\Activation Assistant for the 2007 Microsoft Office suites) (Version:  - Microsoft Corporation)
Activation Assistant for the 2007 Microsoft Office suites (x32 Version: 1.0 - Microsoft Corporation) Hidden
Adobe Flash Player 10 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 10.3.183.7 - Adobe Systems Incorporated)
Adobe Reader 8.1.0 (HKLM-x32\...\{AC76BA86-7AD7-1033-7B44-A81000000003}) (Version: 8.1.0 - Adobe Systems Incorporated)
AIM 6 (HKLM-x32\...\AIM_6) (Version:  - )
AppGraffiti (HKLM-x32\...\{6F6A5334-78E9-4D9B-8182-8B41EA8C39EF}_is1) (Version: 1.0.0.28 - Omega Partners Ltd)
Broadcom 802.11 Wireless LAN Adapter (HKLM\...\Broadcom 802.11b Network Adapter) (Version: 4.170.25.12 - Broadcom Corporation)
Cards_Calendar_OrderGift_DoMorePlugout (x32 Version: 1.00.0000 - Hewlett-Packard) Hidden
Compatibility Pack for the 2007 Office system (HKLM-x32\...\{90120000-0020-0409-0000-0000000FF1CE}) (Version: 12.0.6612.1000 - Microsoft Corporation)
Conexant HD Audio (HKLM\...\CNXT_AUDIO_HDA) (Version: 4.36.7.60 - Conexant)
CyberLink YouCam (HKLM-x32\...\InstallShield_{01FB4998-33C4-4431-85ED-079E3EEFE75D}) (Version: 1.0.1002 - CyberLink Corp.)
DVD Suite (HKLM-x32\...\{1FBF6C24-C1FD-4101-A42B-0C564F9E8E79}) (Version: 5.5.0928 - CyberLink Corp.)
EA Link (HKLM-x32\...\InstallShield_{F5577101-33CC-4711-8235-3A95BCD49DB0}) (Version: 3.1.1.4 - Electronic Arts)
EA Link (x32 Version: 3.1.1.4 - Electronic Arts) Hidden
Email Notifier (HKLM-x32\...\Email Notifier) (Version:  - Discordia Limited.)
Feather Mail Toolbar (HKLM-x32\...\Feather Mail Toolbar) (Version: 2.4.0 - Bullet Media)
Hauppauge MCE XP/Vista Software Encoder (2.0.25149) (HKLM-x32\...\Hauppauge MCE2005 Software Encoder) (Version: 2.0.25149 - Hauppauge Computer Works, Inc.)
HDAUDIO Soft Data Fax Modem with SmartCP (HKLM\...\CNXT_MODEM_HDAUDIO_HERMOSA_HSF) (Version:  - )
Hewlett-Packard Active Check (x32 Version: 1.1.11.0 - Hewlett-Packard) Hidden
Hewlett-Packard Asset Agent for Health Check (x32 Version: 2.0.62.5 - HP) Hidden
HP Active Support Library (HKLM-x32\...\{11BB336F-0E58-4977-B866-F24FA334616B}) (Version: 2.3.0.2 - Hewlett-Packard)
HP Customer Experience Enhancements (HKLM-x32\...\{BD0E2B92-3814-46F0-893B-4612EA010C7E}) (Version: 5.4.0.2430 - Hewlett-Packard)
HP Doc Viewer (HKLM-x32\...\{082702D5-5DD8-4600-BCE5-48B15174687F}) (Version: 1.02.0001 - Hewlett-Packard)
HP Easy Setup - Frontend (HKLM-x32\...\{9885A11E-60E4-417C-B58B-8B31B21C0B8A}) (Version: 5.4.0.2430 - Hewlett-Packard)
HP Help and Support (HKLM\...\{A348C751-0EFF-4B9D-8065-B5339BEFBE27}) (Version: 1.5.0 - Hewlett-Packard)
HP Integrated Module with Bluetooth wireless technology 6.0.1.5500 (HKLM\...\{03D1988F-469F-4843-8E6E-E5FE9D17889D}) (Version: 6.0.1.5500 - HP)
HP Photosmart Essential 2.5 (HKLM\...\HP Photosmart Essential) (Version: 2.5 - HP)
HP Quick Launch Buttons 6.30 E1 (HKLM-x32\...\{34D2AB40-150D-475D-AE32-BD23FB5EE355}) (Version: 6.30 E1 - Hewlett-Packard)
HP QuickPlay 3.6 (HKLM-x32\...\{45D707E9-F3C4-11D9-A373-0050BAE317E1}) (Version:  - )
HP QuickTouch 1.00 C3 (HKLM\...\{11192F89-510C-4E23-A62A-D3BEA9139596}) (Version: 1.0.5 - Hewlett-Packard)
HP Smart Web Printing (HKLM-x32\...\HP Smart Web Printing) (Version: 3.0.17.0 - Hewlett-Packard)
HP Update (HKLM-x32\...\{D063F201-FAC4-4D5C-B10B-615058ADE5A7}) (Version: 4.000.009.002 - Hewlett-Packard)
HP User Guides 0090 (HKLM-x32\...\{B53620C0-3A83-4F50-A7AB-175DB64C1CE3}) (Version: 1.00.0000 - Hewlett-Packard)
HP Wireless Assistant (HKLM-x32\...\{CBAE4F50-9FC9-4557-AB36-9826DF3C103C}) (Version: 3.00 H2 - Hewlett-Packard)
HPPhotoSmartDiscLabel_PaperLabel (x32 Version: 2.02.0000 - Hewlett-Packard) Hidden
HPPhotoSmartDiscLabel_PrintOnDisc (x32 Version: 2.02.0000 - Hewlett-Packard) Hidden
HPPhotoSmartDiscLabel_Tattoo (x32 Version: 2.02.0000 - Hewlett-Packard) Hidden
HPPhotoSmartDiscLabelContent1 (x32 Version: 2.02.0000 - Hewlett-Packard) Hidden
hpphotosmartdisclabelplugin (x32 Version: 2.02.0000 - Hewlett-Packard) Hidden
HPPhotoSmartPhotobookHolidayPack1 (x32 Version: 1.00.0000 - Hewlett-Packard) Hidden
HPPhotoSmartPhotobookModernPack1 (x32 Version: 1.00.0000 - Hewlett-Packard) Hidden
HPPhotoSmartPhotobookPlayfulPack1 (x32 Version: 1.00.0000 - Hewlett-Packard) Hidden
HPPhotoSmartPhotobookScrapbookPack1 (x32 Version: 1.00.0000 - Hewlett-Packard) Hidden
HPPhotoSmartPhotobookWebPack1 (x32 Version: 1.00.0000 - Hewlett-Packard) Hidden
iLivid (HKLM-x32\...\iLivid) (Version: 1.92 - Bandoo Media Inc) <==== ATTENTION
iLivid (x32 Version: 1.92.0.117387 - Bandoo Media Inc.) Hidden <==== ATTENTION
iMesh (HKLM-x32\...\iMesh) (Version: 11.0.0.129514 - iMesh Inc.) <==== ATTENTION
iMesh (x32 Version: 11.0.0.129514 - iMesh Inc.) Hidden <==== ATTENTION
Inbox Toolbar (HKLM-x32\...\{612AD33D-9824-4E87-8396-92374E91C4BB}_is1) (Version: 2.0.0.36 - Inbox.com, Inc.)
Java™ 6 Update 2 (HKLM-x32\...\{3248F0A8-6813-11D6-A77B-00B0D0160020}) (Version: 1.6.0.20 - Sun Microsystems, Inc.)
Java™ 6 Update 26 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83216026FF}) (Version: 6.0.260 - Oracle)
K-Lite Codec Pack 7.7.0 (Full) (HKLM-x32\...\KLiteCodecPack_is1) (Version: 7.7.0 - )
LabelPrint (HKLM-x32\...\{C59C179C-668D-49A9-B6EA-0121CCFC1243}) (Version: 2.20.2128 - CyberLink Corp.)
LightScribe System Software  1.10.13.1 (x32 Version: 1.10.13.1 - http://www.lightscribe.com) Hidden
LiveUpdate (Symantec Corporation) (HKLM-x32\...\PsuedoLiveUpdate) (Version: 3.4.0.162 - Symantec)
LiveUpdate (Symantec Corporation) (x32 Version: 3.4.0.164 - Symantec) Hidden
Malwarebytes Anti-Malware version 1.70.0.1100 (HKLM-x32\...\Malwarebytes' Anti-Malware_is1) (Version: 1.70.0.1100 - Malwarebytes Corporation)
Microsoft .NET Framework 3.5 SP1 (HKLM\...\Microsoft .NET Framework 3.5 SP1) (Version:  - Microsoft Corporation)
Microsoft .NET Framework 4 Client Profile (HKLM\...\Microsoft .NET Framework 4 Client Profile) (Version: 4.0.30319 - Microsoft Corporation)
Microsoft Office 2007 Service Pack 3 (SP3) (HKLM-x32\...\{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}) (Version:  - Microsoft)
Microsoft Office Home and Student 2007 (HKLM-x32\...\HOMESTUDENTR) (Version: 12.0.6612.1000 - Microsoft Corporation)
Microsoft Office PowerPoint Viewer 2007 (English) (HKLM-x32\...\{95120000-00AF-0409-0000-0000000FF1CE}) (Version: 12.0.6612.1000 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Works (HKLM-x32\...\{15BC8CD0-A65B-47D0-A2DD-90A824590FA8}) (Version: 9.7.0621 - Microsoft Corporation)
MSXML 4.0 SP2 (KB954430) (HKLM-x32\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (HKLM-x32\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
muvee autoProducer 6.1 (HKLM-x32\...\{250E9609-E830-43EB-B379-DAB7546A2422}) (Version: 6.10.050 - muvee Technologies)
My HP Games (HKLM-x32\...\WildTangent hp Master Uninstall) (Version: HPCMPQ1902 - WildTangent)
NetWaiting (HKLM-x32\...\{3F92ABBB-6BBF-11D5-B229-002078017FBF}) (Version: 2.5.46 - BVRP Software, Inc)
NVIDIA Drivers (HKLM\...\NVIDIA Drivers) (Version: 1.4 - NVIDIA Corporation)
Online Vault (HKLM-x32\...\{FE60B87C-63A2-4A45-AC06-FFEFD5DB7846}_is1) (Version:  - Crawler.com)
PC Power Speed 1.0.0.24 (HKLM-x32\...\{B0C56FD7-493D-44DD-B007-BBB5117D6E6F}_is1) (Version: 1.0.0.24 - Crawler, LLC.)
Power2Go (HKLM-x32\...\{40BF1E83-20EB-11D8-97C5-0009C5020658}) (Version: 5.6.3327 - CyberLink Corp.)
PowerDirector (HKLM-x32\...\InstallShield_{CB099890-1D5F-11D5-9EA9-0050BAE317E1}) (Version: 6.5.2129 - CyberLink Corp.)
PowerDirector (x32 Version: 6.5.2129 - CyberLink Corp.) Hidden
Produtools Manuals 2.1 Toolbar (HKLM-x32\...\Produtools_Manuals_2.1 Toolbar) (Version: 6.8.9.0 - Produtools Manuals 2.1) <==== ATTENTION
Produtools Manuals Toolbar (HKLM-x32\...\Produtools_Manuals Toolbar) (Version: 6.8.5.1 - Produtools Manuals) <==== ATTENTION
PSSWCORE (x32 Version: 2.02.0000 - Hewlett-Packard) Hidden
QuickPlay SlingPlayer 0.4.6 (HKLM-x32\...\SlingMedia.QPSlingPlayer_is1) (Version: 0.4.6 - SlingMedia)
RebateInformer (HKLM-x32\...\{4EF645BD-65B0-4F98-AD56-D0437B7045F6}_is1) (Version: 1.0.0.82 - Inbox.com, Inc.) <==== ATTENTION
RICOH R5C83x/84x Flash Media Controller Driver Ver.3.52.02 (HKLM-x32\...\{59F6A514-9813-47A3-948C-8A155460CC2A}) (Version: 3.52.02 - )
Searchqu Toolbar (HKLM-x32\...\Searchqu Toolbar) (Version: 3.0.0.122375 - Bandoo Media Inc) <==== ATTENTION
Search-Results Toolbar (HKLM-x32\...\imeshtoolbarguid) (Version: 1.0.0.12 - APN LLC) <==== ATTENTION
SiteRanker (HKLM-x32\...\{11BF46C6-B3DE-48BD-BF70-3AD85CAB80B5}_is1) (Version: 1.0.0.21 - Crawler, LLC) <==== ATTENTION
Slingbox Flash Tour (HKLM-x32\...\{38EAC694-0D90-445F-8C17-8B50ADFE3162}) (Version: 1.0.0 - Sling Media)
SlingPlayer (HKLM-x32\...\InstallShield_{004B0DCB-4C60-465B-8F01-44B0A4111187}) (Version: 1.04.0206 - Sling Media)
SlingPlayer (x32 Version: 1.04.0206 - Sling Media) Hidden
SPBBC 64bit (Version: 107.0.0.134 - Symantec Corporation) Hidden
The Sims™ Life Stories (HKLM-x32\...\{2284D904-C138-4B58-93EC-5C362AB5130A}) (Version: 1.00.0000 - Electronic Arts)
Touch Pad Driver (HKLM\...\{9F72EF8B-AEC9-4CA5-B483-143980AFD6FD}) (Version:  - )
Update for 2007 Microsoft Office System (KB967642) (HKLM-x32\...\{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{C444285D-5E4F-48A4-91DD-47AAAA68E92D}) (Version:  - Microsoft)
VideoToolkit01 (x32 Version: 100.0.128.000 - Hewlett-Packard) Hidden
Viewpoint Media Player (HKLM-x32\...\ViewpointMediaPlayer) (Version:  - )
WeatherBug Gadget (Version: 1.0.0.6 - AWS Convergence Technologies) Hidden
Windows iLivid Toolbar (HKLM-x32\...\Windows Searchqu Toolbar) (Version: 3.0.0.117530 - Bandoo Media, Inc) <==== ATTENTION

==================== Custom CLSID (Whitelisted): ==========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

==================== Restore Points =========================

28-10-2012 16:17:17 Windows Update
03-11-2012 19:00:35 Windows Update
08-11-2012 18:29:18 Windows Update
15-11-2012 16:11:08 Windows Update
21-11-2012 15:07:17 Windows Update
29-11-2012 13:56:37 Windows Update
04-12-2012 19:07:23 Windows Update
08-12-2012 18:28:00 Windows Update
10-12-2012 08:42:32 Scheduled Checkpoint
12-12-2012 07:31:37 Windows Update
13-12-2012 15:44:52 Windows Update
19-12-2012 19:31:51 Windows Update
24-12-2012 07:25:01 Windows Update
30-12-2012 14:26:19 Windows Update
21-01-2013 10:45:10 Windows Update
22-01-2013 04:01:28 Windows Update
25-01-2013 16:45:43 Windows Update
25-03-2013 19:26:57 Windows Update
27-03-2013 18:51:17 Windows Update
28-10-2013 08:20:10 Windows Update
12-12-2013 08:02:43 Windows Update
23-03-2014 08:16:09 Windows Update

==================== Hosts content: ===============================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2006-11-02 05:34 - 2006-09-18 14:37 - 00000761 ____A C:\Windows\system32\Drivers\etc\hosts
127.0.0.1       localhost
::1             localhost

==================== Scheduled Tasks (Whitelisted) =============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)

==================== Loaded Modules (Whitelisted) ==============

2008-04-18 17:08 - 2007-12-19 19:28 - 00271760 _____ () C:\Program Files (x86)\HP\QuickPlay\Kernel\TV\QPCapSvc.exe
2008-02-22 10:33 - 2007-01-09 03:25 - 00272024 _____ () C:\Program Files (x86)\CyberLink\Shared Files\RichVideo.exe
2011-11-15 03:34 - 2011-11-15 03:34 - 00244960 _____ () C:\Program Files (x86)\Feather Mail Toolbar\ToolbarUpdaterService.exe
2008-04-18 17:08 - 2007-12-19 19:28 - 00112016 _____ () C:\Program Files (x86)\HP\QuickPlay\Kernel\TV\QPSched.exe
2007-09-05 13:41 - 2007-09-05 13:41 - 00167936 _____ () C:\Program Files\WIDCOMM\Bluetooth Software\btkeyind.dll
2007-09-05 13:32 - 2007-09-05 13:32 - 00478208 _____ () C:\Windows\system32\btwhidcs.DLL
2008-04-18 17:07 - 2007-12-19 19:27 - 00074536 _____ () C:\Program Files (x86)\HP\QuickPlay\Kernel\Common\MCEMediaStatus64.dll
2007-05-16 11:43 - 2007-05-16 11:43 - 00677432 ____R () C:\Program Files (x86)\Hewlett-Packard\Shared\HpqToaster.exe
2008-04-18 17:08 - 2007-12-19 19:28 - 00251288 _____ () C:\Program Files (x86)\HP\QuickPlay\Kernel\TV\CLCapEngine.dll
2008-04-18 17:08 - 2007-12-19 19:28 - 00038184 _____ () C:\Program Files (x86)\HP\QuickPlay\Kernel\TV\CLCapSvcps.dll
2008-04-18 17:08 - 2007-12-19 19:28 - 00120208 _____ () C:\Program Files (x86)\HP\QuickPlay\Kernel\TV\CLSchMgr.dll
2008-04-18 17:08 - 2007-12-19 19:28 - 00345384 _____ () C:\Program Files (x86)\HP\QuickPlay\Kernel\TV\CLTinyDB.dll
2007-07-12 13:55 - 2007-07-12 13:55 - 01581056 _____ () C:\Program Files (x86)\Common Files\LightScribe\QtCore4.dll
2007-08-14 15:43 - 2007-08-14 15:43 - 06365184 _____ () C:\Program Files (x86)\Common Files\LightScribe\QtGui4.dll
2007-07-12 13:55 - 2007-07-12 13:55 - 00131072 _____ () C:\Program Files (x86)\Common Files\LightScribe\plugins\imageformats\qjpeg4.dll
2012-02-27 01:42 - 2012-02-27 01:42 - 00088976 _____ () C:\Program Files (x86)\Searchqu Toolbar\Datamngr\ToolBar\searchqudtx.dll

==================== Alternate Data Streams (Whitelisted) =========

(If an entry is included in the fixlist, only the ADS will be removed.)

==================== Safe Mode (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\Wdf01000.sys => ""="Driver"

==================== EXE Association (Whitelisted) ===============

(If an entry is included in the fixlist, the registry item will be restored to default or removed.)

==================== Internet Explorer trusted/restricted ===============

(If an entry is included in the fixlist, it will be removed from the registry.)

==================== Other Areas ============================

(Currently there is no automatic fix for this section.)

HKU\S-1-5-21-3224521152-2373409109-2273049155-1000\Control Panel\Desktop\\Wallpaper -> C:\Windows\web\Wallpaper\img24.jpg
DNS Servers: 192.168.43.1
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 2) (ConsentPromptBehaviorUser: 1) (EnableLUA: 1)
Windows Firewall is enabled.

==================== MSCONFIG/TASK MANAGER disabled items ==

(Currently there is no automatic fix for this section.)

==================== FirewallRules (Whitelisted) ===============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

FirewallRules: [WinCollab-Out-UDP] => (Allow) %ProgramFiles%\Windows Collaboration\WinCollab.exe
FirewallRules: [WinCollab-In-UDP] => (Allow) %ProgramFiles%\Windows Collaboration\WinCollab.exe
FirewallRules: [WinCollab-Out-TCP] => (Allow) %ProgramFiles%\Windows Collaboration\WinCollab.exe
FirewallRules: [WinCollab-In-TCP] => (Allow) %ProgramFiles%\Windows Collaboration\WinCollab.exe
FirewallRules: [WinCollab-DFSR-Out-TCP] => (Allow) %SystemRoot%\system32\dfsr.exe
FirewallRules: [WinCollab-DFSR-In-TCP] => (Allow) %SystemRoot%\system32\dfsr.exe
FirewallRules: [{109647F6-8FDA-479B-B52D-DE2AC5911B61}] => (Allow) C:\Program Files (x86)\Common Files\AOL\Loader\aolload.exe
FirewallRules: [{61F7AD8E-139E-42B7-9C5C-A7BD525CFFBC}] => (Allow) C:\Program Files (x86)\Common Files\AOL\Loader\aolload.exe
FirewallRules: [{9480CE52-8E38-4CE8-8C2C-C8DCB9E8039D}] => (Allow) C:\Program Files (x86)\Cyberlink\PowerDirector\PDR.EXE
FirewallRules: [{B42AE0CE-D607-488D-805A-BE349DFCB648}] => (Allow) C:\Program Files (x86)\HP\QuickPlay\QP.exe
FirewallRules: [{236258DF-47BA-46E1-A781-DA691D6DEA58}] => (Allow) C:\Program Files (x86)\HP\QuickPlay\QPService.exe
FirewallRules: [{D53F4032-70B1-45CB-8E0B-9C2CAE4E0637}] => (Allow) LPort=80
FirewallRules: [{80EEB763-25AD-4B82-AE6A-201E89FD30ED}] => (Allow) LPort=80
FirewallRules: [{393B001B-9E21-4B71-BD94-B6F328C99953}] => (Allow) LPort=80
FirewallRules: [{E30FB37B-1A78-4730-9E78-08D4026C0B70}] => (Allow) C:\Program Files (x86)\Windows iLivid Toolbar\Datamngr\ToolBar\dtUser.exe
FirewallRules: [{62648CA4-ED0C-4AD0-A893-C4296F32AD19}] => (Allow) C:\Program Files (x86)\Windows iLivid Toolbar\Datamngr\ToolBar\dtUser.exe
FirewallRules: [{C5D0A1AD-1D39-4030-B42B-8A0CEA1BFE60}] => (Allow) C:\Program Files (x86)\Searchqu Toolbar\Datamngr\ToolBar\dtUser.exe
FirewallRules: [{3F69B8C9-48FF-43E0-A0B8-ED0465FB35D0}] => (Allow) C:\Program Files (x86)\Searchqu Toolbar\Datamngr\ToolBar\dtUser.exe
FirewallRules: [{B28CD5A2-A4FD-4C2C-B110-281E42C18AA6}] => (Allow) C:\Program Files (x86)\iMesh Applications\iMesh\iMesh.exe
FirewallRules: [{3F1FBE77-5C33-4C30-B97B-A55CC460929F}] => (Allow) C:\Program Files (x86)\iMesh Applications\iMesh\iMesh.exe
FirewallRules: [TCP Query User{6924F7FA-FB91-4083-96C0-8A9AAAA94F51}C:\program files (x86)\imesh applications\imesh\imesh.exe] => (Allow) C:\program files (x86)\imesh applications\imesh\imesh.exe
FirewallRules: [UDP Query User{02AD42F8-6B9A-42C4-A0FF-AAFB1434A2B6}C:\program files (x86)\imesh applications\imesh\imesh.exe] => (Allow) C:\program files (x86)\imesh applications\imesh\imesh.exe
FirewallRules: [{B4BFC39E-88DF-4475-B6CB-775E0D1D551B}] => (Allow) C:\Program Files (x86)\iMesh Applications\Mediabar\Datamngr\SRTOOL~1\dtUser.exe
FirewallRules: [{D9B054BA-9700-4773-8161-627740564EA4}] => (Allow) C:\Program Files (x86)\iMesh Applications\Mediabar\Datamngr\SRTOOL~1\dtUser.exe
FirewallRules: [TCP Query User{300F5E74-C985-44C8-BB0B-262A2BADEE25}C:\program files (x86)\imesh applications\imesh\imesh.exe] => (Block) C:\program files (x86)\imesh applications\imesh\imesh.exe
FirewallRules: [UDP Query User{0527D5DF-97C0-4BFE-B604-5E0B1553F3E2}C:\program files (x86)\imesh applications\imesh\imesh.exe] => (Block) C:\program files (x86)\imesh applications\imesh\imesh.exe
StandardProfile\AuthorizedApplications: [C:\Program Files (x86)\EarthLink TotalAccess\TaskPanl.exe] => Enabled:Earthlink

==================== Faulty Device Manager Devices =============

==================== Event log errors: =========================

Application errors:
==================
Error: (03/23/2014 06:26:10 PM) (Source: Microsoft-Windows-CAPI2) (EventID: 11) (User: )
Description: http://ctldl.windows...uthrootstl.cabA required certificate is not within its validity period when verifying against the current system clock or the timestamp in the signed file.

Error: (03/23/2014 06:26:10 PM) (Source: Microsoft-Windows-CAPI2) (EventID: 11) (User: )
Description: http://ctldl.windows...uthrootstl.cabA required certificate is not within its validity period when verifying against the current system clock or the timestamp in the signed file.

Error: (03/23/2014 06:19:03 PM) (Source: Microsoft-Windows-CAPI2) (EventID: 11) (User: )
Description: http://ctldl.windows...uthrootstl.cabA required certificate is not within its validity period when verifying against the current system clock or the timestamp in the signed file.

Error: (03/23/2014 06:19:03 PM) (Source: Microsoft-Windows-CAPI2) (EventID: 11) (User: )
Description: http://ctldl.windows...uthrootstl.cabA required certificate is not within its validity period when verifying against the current system clock or the timestamp in the signed file.

Error: (03/23/2014 06:19:03 PM) (Source: Microsoft-Windows-CAPI2) (EventID: 11) (User: )
Description: http://ctldl.windows...uthrootstl.cabA required certificate is not within its validity period when verifying against the current system clock or the timestamp in the signed file.

Error: (03/23/2014 05:48:07 PM) (Source: LoadPerf) (EventID: 3011) (User: )
Description: WmiApRplWmiApRpl8

Error: (03/23/2014 05:48:07 PM) (Source: LoadPerf) (EventID: 3012) (User: )
Description: Performance16

Error: (03/23/2014 05:40:50 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (03/23/2014 05:13:30 PM) (Source: LoadPerf) (EventID: 3011) (User: )
Description: WmiApRplWmiApRpl8

Error: (03/23/2014 05:13:30 PM) (Source: LoadPerf) (EventID: 3012) (User: )
Description: Performance16

System errors:
=============
Error: (03/23/2014 06:17:25 PM) (Source: W32Time) (EventID: 34) (User: )
Description: The time service has detected that the system time needs to be  changed by +46462555 seconds. The time service will not change the system time by more than +54000 seconds. Verify that your time and time zone are correct, and that the time source time.windows.com,0x9 (ntp.m|0x9|0.0.0.0:123->191.233.81.105:123) is working properly.

Error: (03/23/2014 05:40:51 PM) (Source: Service Control Manager) (EventID: 7026) (User: )
Description: cdrom

Error: (03/23/2014 05:04:19 PM) (Source: Service Control Manager) (EventID: 7026) (User: )
Description: cdrom

Error: (03/23/2014 08:18:11 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Windows Installer%%1053

Error: (03/23/2014 08:18:11 AM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: 30000Windows Installer

Error: (03/23/2014 08:18:11 AM) (Source: DCOM) (EventID: 10005) (User: )
Description: 1053MSIServer{000C101C-0000-0000-C000-000000000046}

Error: (03/23/2014 08:12:55 AM) (Source: Service Control Manager) (EventID: 7026) (User: )
Description: cdrom

Error: (03/16/2014 12:01:51 AM) (Source: Service Control Manager) (EventID: 7026) (User: )
Description: cdrom

Error: (03/15/2014 11:09:34 PM) (Source: Service Control Manager) (EventID: 7026) (User: )
Description: cdrom

Error: (03/15/2014 09:19:26 PM) (Source: Service Control Manager) (EventID: 7026) (User: )
Description: cdrom

Microsoft Office:
=========================

CodeIntegrity:
===================================
  Date: 2013-12-12 08:29:06.851
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume1\Program Files (x86)\24x7Help\App24x7Hook64.dll because the set of per-page image hashes could not be found on the system.

  Date: 2013-12-12 08:29:06.609
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume1\Program Files (x86)\24x7Help\App24x7Hook64.dll because the set of per-page image hashes could not be found on the system.

  Date: 2013-12-12 08:29:06.349
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume1\Program Files (x86)\24x7Help\App24x7Hook64.dll because the set of per-page image hashes could not be found on the system.

  Date: 2013-12-12 08:29:06.096
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume1\Program Files (x86)\24x7Help\App24x7Hook64.dll because the set of per-page image hashes could not be found on the system.

  Date: 2013-12-12 08:29:05.835
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume1\Program Files (x86)\24x7Help\App24x7Hook64.dll because the set of per-page image hashes could not be found on the system.

  Date: 2013-12-12 08:29:05.593
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume1\Program Files (x86)\24x7Help\App24x7Hook64.dll because the set of per-page image hashes could not be found on the system.

  Date: 2013-12-12 08:29:05.338
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume1\Program Files (x86)\24x7Help\App24x7Hook64.dll because the set of per-page image hashes could not be found on the system.

  Date: 2013-12-12 08:29:05.087
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume1\Program Files (x86)\24x7Help\App24x7Hook64.dll because the set of per-page image hashes could not be found on the system.

  Date: 2013-12-12 08:29:04.845
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume1\Program Files (x86)\24x7Help\App24x7Hook64.dll because the set of per-page image hashes could not be found on the system.

  Date: 2013-12-12 08:29:04.573
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume1\Program Files (x86)\24x7Help\App24x7Hook64.dll because the set of per-page image hashes could not be found on the system.

==================== Memory info ===========================

Processor: AMD Turion™ 64 X2 TL-60
Percentage of memory in use: 55%
Total physical RAM: 4029.99 MB
Available physical RAM: 1804.62 MB
Total Virtual: 8278.53 MB
Available Virtual: 5943.68 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:219.85 GB) (Free:126.96 GB) NTFS ==>[drive with boot components (obtained from BCD)]
Drive d: (HP_RECOVERY) (Fixed) (Total:13.03 GB) (Free:1.8 GB) NTFS ==>[system with boot components (obtained from reading drive)]

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (Size: 232.9 GB) (Disk ID: 8FFE8FFE)
Partition 1: (Active) - (Size=219.9 GB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=13 GB) - (Type=07 NTFS)

==================== End of Addition.txt ============================

[Advertisements]

Hello and welcome to Geeks To Go! My nickname is Pystryker , and I will be helping you with your issue today.


Before we get started, I have a few things I need to go over with you

• If you are receiving help for this issue at another forum, please let me know so I can close this thread.
• Please download to and run all requested tools from your Desktop.
• Please do not install any new software during the cleaning process other than the tools I provide for you. This can hinder the cleaning process.
• At the top of your post, please click on the "Follow this topic" button and make sure that the "Received notification" box is checked and set to "Instantly" This will send an email to you as soon as I reply to your topic, allowing us to solve your problem faster.
• If any of your security programs give you a warning about any tool I ask you to use, please do not worry. All the links and tools I provide to you will be safe.
• Please do not run any tools other than the ones I ask you to, when I ask you to. Some of these tools can be very dangerous if used improperly. Also, if you use a tool that I have not requested you use, it can cause false positives, thereby delaying the complete cleaning of your machine.
• This is a complicated process. It requires several steps, patience, and careful following of my instructions in the order they are given to diagnose your problems to get your machine back in working order.
• Please stay with me until the end of all steps and procedures and I declare your system clean. Just because there is a lack of symptoms does not indicate a clean machine. I promise to do the same for you.
• It is impossible for me to know what interactions may happen between your computer's software and the tools we will use to clean your machine. Therefore, I highly recommend you backup any critical personal files on your machine before we start.
• If you have any questions at all, please don't hesitate to ask. There's no such thing as a stupid question when dealing with malware.
• If you are unsure of an instruction I give you, or if something unexpected occurs, Do NOT proceed! Stop and ask for clarification of the instruction or tell me what occurred.
• Please remember, the fixes are for your machine and your machine ONLY! Do not use these fixes on any other machine, each fix is tailor made for your system only. Using a fix on another machine can and will cause serious damage.
• Once we have cleaned your machine, we'll have some cleanup and prevention steps to go through. We will also provide you with some information about how to reduce your chances of infection and get some protections in place to help defend you against this in the future
• Please be patient while I am analyzing your logs. I know you are probably scared and very frustrated with this problem, but I am a volunteer and sometimes life does get in the way.

Now, let's get started, shall we?

Hello

We have a lot of work to do, so let's start showing your uninvited guests the door. Please take your time and read each step's instructions thoroughly, and proceed at a pace you are comfortable with.



Step 1: Program Uninstalls

Please uninstall the following programs from your machine as they are adware/malware related. If one of the programs fails to uninstall, please move on to the next one in the list.

• 24x7 Help
• AppGraffiti
• Feather Mail Toolbar
• iLivid
• iMesh
• Inbox Toolbar
• PC Power Speed 1.0.0.24
• Produtools Manuals 2.1 Toolbar
• Produtools Manuals Toolbar
• RebateInformer
• Searchqu Toolbar
• Search-Results Toolbar
• SiteRanker
• Windows iLivid Toolbar

Step 2: Fix with FRST

Note: Before performing this step, please move FRST64.exe from C:\Users\Tyrone\Downloads to your Desktop or the fix will not work.

• Open notepad (Start =>All Programs => Accessories => Notepad). Please copy the entire contents of the code box below. (To do this highlight the contents of the box, right click on it and select copy.
• Right-click in the open notepad and select Paste).
• Save it on the desktop as fixlist.txt
  
  NOTE: It's important that both files, FRST/FRST64 and fixlist.txt are in the same location or the fix will not work.

Start
CreateRestorePoint:
CloseProcesses:
iLivid (x32 Version: 1.92.0.117387 - Bandoo Media Inc.) Hidden <==== ATTENTION
iMesh (x32 Version: 11.0.0.129514 - iMesh Inc.) Hidden <==== ATTENTION
(PCRx.com, LLC) C:\Program Files (x86)\24x7Help\App24x7Svc.exe
C:\Program Files (x86)\24x7Help
() C:\Program Files (x86)\Feather Mail Toolbar\ToolbarUpdaterService.exe
C:\Program Files (x86)\Feather Mail Toolbar
(Inbox.com, Inc.) C:\Program Files (x86)\RebateInformer\RebateInf.exe
C:\Program Files (x86)\RebateInformer
(Bandoo Media, inc) C:\Program Files (x86)\Searchqu Toolbar\Datamngr\datamngrUI.exe
(Crawler, LLC) C:\Program Files (x86)\SiteRanker\SiteRankTray.exe
C:\Program Files (x86)\Searchqu Toolbar
C:\Program Files (x86)\SiteRanker
(Crawler.com) C:\Program Files (x86)\PCPowerSpeed\PCPowerTray.exe
C:\Program Files (x86)\PCPowerSpeed
(Inbox.com, Inc.) C:\Program Files (x86)\Inbox Toolbar\Inbox.exe
(Crawler.com) C:\Program Files (x86)\OnlineVault\OVTray.exe
C:\Program Files (x86)\Inbox Toolbar
C:\Program Files (x86)\OnlineVault
(Crawler, LLC) C:\Program Files (x86)\24x7Help\App24x7Help.exe
(PCRx.com, LLC) C:\Program Files (x86)\24x7Help\App24x7Hook.exe
(PCRx.com, LLC) C:\Program Files (x86)\24x7Help\App24x7Hook64.exe
HKLM-x32\...\Run: [DATAMNGR] => C:\Program Files (x86)\Searchqu Toolbar\Datamngr\datamngrUI.exe [1694608 2012-03-12] (Bandoo Media, inc)
HKLM-x32\...\Run: [SiteRanker] => C:\Program Files (x86)\SiteRanker\SiteRankTray.exe [320000 2011-11-16] (Crawler, LLC)
HKLM-x32\...\Run: [PCPowerSpeed] => C:\Program Files (x86)\PCPowerSpeed\PCPowerTray.exe [385664 2011-09-27] (Crawler.com)
HKLM-x32\...\Run: [24x7HELP] => C:\Program Files (x86)\24x7Help\App24x7Help.exe [1766040 2012-12-11] (Crawler, LLC)
HKLM-x32\...\Run: [InboxToolbar] => C:\Program Files (x86)\Inbox Toolbar\Inbox.exe [1681120 2012-10-24] (Inbox.com, Inc.)
HKLM-x32\...\Run: [Online Vault] => C:\Program Files (x86)\OnlineVault\OVTray.exe [371360 2012-11-21] (Crawler.com)
HKU\S-1-5-21-3224521152-2373409109-2273049155-1000\...\Run: [RebateInformer] => C:\Program Files (x86)\RebateInformer\RebateInf.exe [1114112 2011-11-16] (Inbox.com, Inc.)
AppInit_DLLs: C:\PROGRA~2\SEARCH~1\Datamngr\x64\datamngr.dll => C:\Program Files (x86)\Searchqu Toolbar\Datamngr\x64\datamngr.dll [1778584 2012-03-12] (Bandoo Media, inc)
AppInit_DLLs: C:\PROGRA~2\SEARCH~1\Datamngr\x64\IEBHO.dll => C:\Program Files (x86)\Searchqu Toolbar\Datamngr\x64\IEBHO.dll [1791384 2012-03-12] (Bandoo Media, inc)
AppInit_DLLs-x32: C:\PROGRA~2\SEARCH~1\Datamngr\datamngr.dll => C:\Program Files (x86)\Searchqu Toolbar\Datamngr\datamngr.dll [1236368 2012-03-12] (Bandoo Media, inc)
AppInit_DLLs-x32: C:\PROGRA~2\SEARCH~1\Datamngr\IEBHO.dll => C:\Program Files (x86)\Searchqu Toolbar\Datamngr\IEBHO.dll [1233816 2012-03-12] (Bandoo Media, inc)
HKU\S-1-5-21-3224521152-2373409109-2273049155-1000\Software\Microsoft\Internet Explorer\Main,Search Bar = hxxp://toolbar.inbox.com/search/dispatcher.aspx?tp=aus&qkw=%s&tbid=%tb_id&%language
HKU\S-1-5-21-3224521152-2373409109-2273049155-1000\Software\Microsoft\Internet Explorer\Main,Start Page Restore = hxxp://www.inbox.com/homepage.aspx?tbid=80291&lng=en
URLSearchHook: HKLM-x32 - Produtools Manuals Toolbar - {16bb67e0-6319-4077-be84-f41269e051f3} - C:\Program Files (x86)\Produtools_Manuals\prxtbProd.dll (Conduit Ltd.)
URLSearchHook: HKLM-x32 - Produtools Manuals 2.1 Toolbar - {b2bf7b3f-bf0b-4c48-aec6-f92c51be63e1} - C:\Program Files (x86)\Produtools_Manuals_2.1\prxtbProd.dll (Conduit Ltd.)
URLSearchHook: [S-1-5-21-3224521152-2373409109-2273049155-1000] ATTENTION => Default URLSearchHook is missing
URLSearchHook: HKU\S-1-5-21-3224521152-2373409109-2273049155-1000 - Inbox Toolbar - {D3D233D5-9F6D-436C-B6C7-E63F77503B30} - C:\Program Files (x86)\Inbox Toolbar\Inbox.dll (Inbox.com, Inc.)
URLSearchHook: HKU\S-1-5-21-3224521152-2373409109-2273049155-1000 - Produtools Manuals Toolbar - {16bb67e0-6319-4077-be84-f41269e051f3} - C:\Program Files (x86)\Produtools_Manuals\prxtbProd.dll (Conduit Ltd.)
URLSearchHook: HKU\S-1-5-21-3224521152-2373409109-2273049155-1000 - Produtools Manuals 2.1 Toolbar - {b2bf7b3f-bf0b-4c48-aec6-f92c51be63e1} - C:\Program Files (x86)\Produtools_Manuals_2.1\prxtbProd.dll (Conduit Ltd.)
SearchScopes: HKLM -> DefaultScope {9BB47C17-9C68-4BB3-B188-DD9AF0FD21} URL = hxxp://dts.search-results.com/sr?src=ieb&gct=ds&appid=221&systemid=1&apn_dtid=IME001&apn_ptnrs=AGE&o=APN10653&apn_uid=1042151012054953&q={searchTerms}
SearchScopes: HKLM -> {9BB47C17-9C68-4BB3-B188-DD9AF0FD21} URL = hxxp://dts.search-results.com/sr?src=ieb&gct=ds&appid=221&systemid=1&apn_dtid=IME001&apn_ptnrs=AGE&o=APN10653&apn_uid=1042151012054953&q={searchTerms}
SearchScopes: HKLM -> {9BB47C17-9C68-4BB3-B188-DD9AF0FD2406} URL = hxxp://dts.search-results.com/sr?src=ieb&appid=139&systemid=406&sr=0&q={searchTerms}
SearchScopes: HKLM -> {A980C307-6F73-41E8-9246-3266F5CA6BB2} URL = hxxp://www.ask.com/web?q={searchterms}&l=dis&o=ushpd
SearchScopes: HKLM-x32 -> DefaultScope {9BB47C17-9C68-4BB3-B188-DD9AF0FD21} URL = hxxp://dts.search-results.com/sr?src=ieb&gct=ds&appid=221&systemid=1&apn_dtid=IME001&apn_ptnrs=AGE&o=APN10653&apn_uid=1042151012054953&q={searchTerms}
SearchScopes: HKLM-x32 -> {9BB47C17-9C68-4BB3-B188-DD9AF0FD21} URL = hxxp://dts.search-results.com/sr?src=ieb&gct=ds&appid=221&systemid=1&apn_dtid=IME001&apn_ptnrs=AGE&o=APN10653&apn_uid=1042151012054953&q={searchTerms}
SearchScopes: HKLM-x32 -> {9BB47C17-9C68-4BB3-B188-DD9AF0FD2406} URL = hxxp://dts.search-results.com/sr?src=ieb&appid=139&systemid=406&sr=0&q={searchTerms}
SearchScopes: HKLM-x32 -> {A980C307-6F73-41E8-9246-3266F5CA6BB2} URL = hxxp://www.ask.com/web?q={searchterms}&l=dis&o=ushpd
SearchScopes: HKU\S-1-5-21-3224521152-2373409109-2273049155-1000 -> DefaultScope {9BB47C17-9C68-4BB3-B188-DD9AF0FD21} URL = hxxp://dts.search-results.com/sr?src=ieb&gct=ds&appid=221&systemid=1&apn_dtid=IME001&apn_ptnrs=AGE&o=APN10653&apn_uid=1042151012054953&q={searchTerms}
SearchScopes: HKU\S-1-5-21-3224521152-2373409109-2273049155-1000 -> {9BB47C17-9C68-4BB3-B188-DD9AF0FD21} URL = hxxp://dts.search-results.com/sr?src=ieb&gct=ds&appid=221&systemid=1&apn_dtid=IME001&apn_ptnrs=AGE&o=APN10653&apn_uid=1042151012054953&q={searchTerms}
SearchScopes: HKU\S-1-5-21-3224521152-2373409109-2273049155-1000 -> {9BB47C17-9C68-4BB3-B188-DD9AF0FD2406} URL = hxxp://dts.search-results.com/sr?src=ieb&appid=139&systemid=406&sr=0&q={searchTerms}
SearchScopes: HKU\S-1-5-21-3224521152-2373409109-2273049155-1000 -> {A980C307-6F73-41E8-9246-3266F5CA6BB2} URL = hxxp://www.ask.com/web?q={searchterms}&l=dis&o=ushpd
SearchScopes: HKU\S-1-5-21-3224521152-2373409109-2273049155-1000 -> {C04B7D22-5AEC-4561-8F49-27F6269208F6} URL = hxxp://www2.inbox.com/search/dispatcher.aspx?tp=bs&qkw={searchTerms}&tbid=80291&lng=en
BHO: DataMngr -> {9D717F81-9148-4f12-8568-69135F087DB0} -> C:\Program Files (x86)\Searchqu Toolbar\Datamngr\x64\BrowserConnection.dll [2012-03-12] (Bandoo Media, inc)
BHO-x32: No Name -> {02478D38-C3F9-4efb-9B51-7695ECA05670} -> No File
BHO-x32: No Name -> {11BF46C6-B3DE-48BD-BF70-3AD85CAB80B5} -> C:\Program Files (x86)\SiteRanker\SiteRank.dll [2012-02-20] (Crawler, LLC)
BHO-x32: Produtools Manuals Toolbar -> {16bb67e0-6319-4077-be84-f41269e051f3} -> C:\Program Files (x86)\Produtools_Manuals\prxtbProd.dll [2011-05-09] (Conduit Ltd.)
BHO-x32: Search-Results Toolbar -> {31d8407c-62e4-4125-a4a9-717efb1a56ae} -> C:\Program Files (x86)\iMesh Applications\Mediabar\Datamngr\SRTOOL~1\searchresultsDx.dll [2012-10-02] (APN LLC)
BHO-x32: No Name -> {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} -> No File
BHO-x32: Feather Mail Toolbar Helper -> {657A4245-5212-4390-A997-C3CB0C6D60B4} -> C:\Program Files (x86)\Feather Mail Toolbar\Toolbar32.dll [2011-11-15] ()
BHO-x32: AppGraffiti -> {6F6A5334-78E9-4D9B-8182-8B41EA8C39EF} -> C:\Program Files (x86)\AppGraffiti\AppGraffiti.dll [2013-03-20] (Omega Partners Ltd)
BHO-x32: Searchqu Toolbar -> {99079a25-328f-4bd4-be04-00955acaa0a7} -> C:\Program Files (x86)\Searchqu Toolbar\Datamngr\ToolBar\searchqudtx.dll [2012-02-27] ()
BHO-x32: DataMngr -> {9D717F81-9148-4f12-8568-69135F087DB0} -> C:\Program Files (x86)\Searchqu Toolbar\Datamngr\BrowserConnection.dll [2012-03-12] (Bandoo Media, inc)
BHO-x32: Produtools Manuals 2.1 Toolbar -> {b2bf7b3f-bf0b-4c48-aec6-f92c51be63e1} -> C:\Program Files (x86)\Produtools_Manuals_2.1\prxtbProd.dll [2011-05-09] (Conduit Ltd.)
BHO-x32: No Name -> {CCB69577-088B-4004-9ED8-FF5BCC83A039} -> C:\Program Files (x86)\RebateInformer\RebateI.dll [2011-11-16] (Inbox.com, Inc.)
BHO-x32: Inbox Toolbar -> {D3D233D5-9F6D-436C-B6C7-E63F77503B30} -> C:\Program Files (x86)\Inbox Toolbar\Inbox.dll [2012-10-24] (Inbox.com, Inc.)
C:\Program Files (x86)\AppGraffiti
C:\Program Files (x86)\Produtools_Manuals_2.1
BHO-x32: No Name -> {CCB69577-088B-4004-9ED8-FF5BCC83A039} -> C:\Program Files (x86)\RebateInformer\RebateI.dll [2011-11-16] (Inbox.com, Inc.)
BHO-x32: Inbox Toolbar -> {D3D233D5-9F6D-436C-B6C7-E63F77503B30} -> C:\Program Files (x86)\Inbox Toolbar\Inbox.dll [2012-10-24] (Inbox.com, Inc.)
Toolbar: HKLM-x32 - No Name - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - No File
Toolbar: HKLM-x32 - &Inbox Toolbar - {D7E97865-918F-41E4-9CD0-25AB1C574CE8} - C:\Program Files (x86)\Inbox Toolbar\Inbox.dll [2012-10-24] (Inbox.com, Inc.)
Toolbar: HKLM-x32 - Feather Mail Toolbar - {271898BB-6159-4ED2-AADA-564C975024BF} - C:\Program Files (x86)\Feather Mail Toolbar\Toolbar32.dll [2011-11-15] ()
Toolbar: HKLM-x32 - Produtools Manuals Toolbar - {16bb67e0-6319-4077-be84-f41269e051f3} - C:\Program Files (x86)\Produtools_Manuals\prxtbProd.dll [2011-05-09] (Conduit Ltd.)
Toolbar: HKLM-x32 - Produtools Manuals 2.1 Toolbar - {b2bf7b3f-bf0b-4c48-aec6-f92c51be63e1} - C:\Program Files (x86)\Produtools_Manuals_2.1\prxtbProd.dll [2011-05-09] (Conduit Ltd.)
Toolbar: HKLM-x32 - Searchqu Toolbar - {99079a25-328f-4bd4-be04-00955acaa0a7} - C:\Program Files (x86)\Searchqu Toolbar\Datamngr\ToolBar\searchqudtx.dll [2012-02-27] ()
Toolbar: HKLM-x32 - Search-Results Toolbar - {31d8407c-62e4-4125-a4a9-717efb1a56ae} - C:\Program Files (x86)\iMesh Applications\Mediabar\Datamngr\SRTOOL~1\searchresultsDx.dll [2012-10-02] (APN LLC)
Handler-x32: inbox - {37540F19-DD4C-478B-B2DF-C19281BCAF27} - C:\Program Files (x86)\Inbox Toolbar\Inbox.dll [2012-10-24] (Inbox.com, Inc.)
Handler-x32: rebinfo - {AF808758-C780-404C-A4EE-4526323FD9B6} - C:\Program Files (x86)\RebateInformer\RebateI.dll [2011-11-16] (Inbox.com, Inc.)
C:\Program Files (x86)\Inbox Toolbar
FF Extension: SiteRanker - C:\Program Files (x86)\SiteRanker\firefox [2012-03-02]
C:\Program Files (x86)\SiteRanker
R2 24x7HelpSvc; C:\Program Files (x86)\24x7Help\App24x7Svc.exe [394352 2012-02-29] (PCRx.com, LLC)
R2 Updater Service for Feather Mail Toolbar; C:\Program Files (x86)\Feather Mail Toolbar\ToolbarUpdaterService.exe [244960 2011-11-15] ()
U1 eabfiltr; no ImagePath
S3 IpInIp; system32\DRIVERS\ipinip.sys [X]
S3 NwlnkFlt; system32\DRIVERS\nwlnkflt.sys [X]
S3 NwlnkFwd; system32\DRIVERS\nwlnkfwd.sys [X]
S3 SymIMMP; system32\DRIVERS\SymIM.sys [X]
C:\Program Files (x86)\RebateInformer
C:\Users\Tyrone\AppData\Roaming\PCPowerSpeed
C:\Program Files (x86)\SiteRanker
CMD: bitsadmin /reset /allusers
CMD: netsh advfirewall reset
CMD: netsh advfirewall set allprofiles state on
CMD: ipconfig /flushdns
Emptytemp:
Hosts:
End

NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system.


Run FRST and press the Fix button just once and wait. The tool will make a log on the desktop (Fixlog.txt) please post it in your next reply.


Step 3: Program Uninstalls Part 2

The fix with FRST will cause 2 malware programs that were hidden to be seen now. Please uninstall the 2 programs listed below. There were actually 2 copies each of iLivid and iMesh installed on the machine. However, 2 of them were hidden, and now the FRST fix has made it where we can remove them now.

• iLivid (x32 Version: 1.92.0.117387 - Bandoo Media Inc.)
• iMesh (x32 Version: 11.0.0.129514 - iMesh Inc.)

Things I need to see in your next post:

Fixlog.txt Log

[pystryker]

Hello and welcome to Geeks To Go! My nickname is Pystryker , and I will be helping you with your issue today.


Before we get started, I have a few things I need to go over with you

• If you are receiving help for this issue at another forum, please let me know so I can close this thread.
• Please download to and run all requested tools from your Desktop.
• Please do not install any new software during the cleaning process other than the tools I provide for you. This can hinder the cleaning process.
• At the top of your post, please click on the "Follow this topic" button and make sure that the "Received notification" box is checked and set to "Instantly" This will send an email to you as soon as I reply to your topic, allowing us to solve your problem faster.
• If any of your security programs give you a warning about any tool I ask you to use, please do not worry. All the links and tools I provide to you will be safe.
• Please do not run any tools other than the ones I ask you to, when I ask you to. Some of these tools can be very dangerous if used improperly. Also, if you use a tool that I have not requested you use, it can cause false positives, thereby delaying the complete cleaning of your machine.
• This is a complicated process. It requires several steps, patience, and careful following of my instructions in the order they are given to diagnose your problems to get your machine back in working order.
• Please stay with me until the end of all steps and procedures and I declare your system clean. Just because there is a lack of symptoms does not indicate a clean machine. I promise to do the same for you.
• It is impossible for me to know what interactions may happen between your computer's software and the tools we will use to clean your machine. Therefore, I highly recommend you backup any critical personal files on your machine before we start.
• If you have any questions at all, please don't hesitate to ask. There's no such thing as a stupid question when dealing with malware.
• If you are unsure of an instruction I give you, or if something unexpected occurs, Do NOT proceed! Stop and ask for clarification of the instruction or tell me what occurred.
• Please remember, the fixes are for your machine and your machine ONLY! Do not use these fixes on any other machine, each fix is tailor made for your system only. Using a fix on another machine can and will cause serious damage.
• Once we have cleaned your machine, we'll have some cleanup and prevention steps to go through. We will also provide you with some information about how to reduce your chances of infection and get some protections in place to help defend you against this in the future
• Please be patient while I am analyzing your logs. I know you are probably scared and very frustrated with this problem, but I am a volunteer and sometimes life does get in the way.

Now, let's get started, shall we?

Hello

We have a lot of work to do, so let's start showing your uninvited guests the door. Please take your time and read each step's instructions thoroughly, and proceed at a pace you are comfortable with.



Step 1: Program Uninstalls

Please uninstall the following programs from your machine as they are adware/malware related. If one of the programs fails to uninstall, please move on to the next one in the list.

• 24x7 Help
• AppGraffiti
• Feather Mail Toolbar
• iLivid
• iMesh
• Inbox Toolbar
• PC Power Speed 1.0.0.24
• Produtools Manuals 2.1 Toolbar
• Produtools Manuals Toolbar
• RebateInformer
• Searchqu Toolbar
• Search-Results Toolbar
• SiteRanker
• Windows iLivid Toolbar

Step 2: Fix with FRST

Note: Before performing this step, please move FRST64.exe from C:\Users\Tyrone\Downloads to your Desktop or the fix will not work.

• Open notepad (Start =>All Programs => Accessories => Notepad). Please copy the entire contents of the code box below. (To do this highlight the contents of the box, right click on it and select copy.
• Right-click in the open notepad and select Paste).
• Save it on the desktop as fixlist.txt
  
  NOTE: It's important that both files, FRST/FRST64 and fixlist.txt are in the same location or the fix will not work.

Start
CreateRestorePoint:
CloseProcesses:
iLivid (x32 Version: 1.92.0.117387 - Bandoo Media Inc.) Hidden <==== ATTENTION
iMesh (x32 Version: 11.0.0.129514 - iMesh Inc.) Hidden <==== ATTENTION
(PCRx.com, LLC) C:\Program Files (x86)\24x7Help\App24x7Svc.exe
C:\Program Files (x86)\24x7Help
() C:\Program Files (x86)\Feather Mail Toolbar\ToolbarUpdaterService.exe
C:\Program Files (x86)\Feather Mail Toolbar
(Inbox.com, Inc.) C:\Program Files (x86)\RebateInformer\RebateInf.exe
C:\Program Files (x86)\RebateInformer
(Bandoo Media, inc) C:\Program Files (x86)\Searchqu Toolbar\Datamngr\datamngrUI.exe
(Crawler, LLC) C:\Program Files (x86)\SiteRanker\SiteRankTray.exe
C:\Program Files (x86)\Searchqu Toolbar
C:\Program Files (x86)\SiteRanker
(Crawler.com) C:\Program Files (x86)\PCPowerSpeed\PCPowerTray.exe
C:\Program Files (x86)\PCPowerSpeed
(Inbox.com, Inc.) C:\Program Files (x86)\Inbox Toolbar\Inbox.exe
(Crawler.com) C:\Program Files (x86)\OnlineVault\OVTray.exe
C:\Program Files (x86)\Inbox Toolbar
C:\Program Files (x86)\OnlineVault
(Crawler, LLC) C:\Program Files (x86)\24x7Help\App24x7Help.exe
(PCRx.com, LLC) C:\Program Files (x86)\24x7Help\App24x7Hook.exe
(PCRx.com, LLC) C:\Program Files (x86)\24x7Help\App24x7Hook64.exe
HKLM-x32\...\Run: [DATAMNGR] => C:\Program Files (x86)\Searchqu Toolbar\Datamngr\datamngrUI.exe [1694608 2012-03-12] (Bandoo Media, inc)
HKLM-x32\...\Run: [SiteRanker] => C:\Program Files (x86)\SiteRanker\SiteRankTray.exe [320000 2011-11-16] (Crawler, LLC)
HKLM-x32\...\Run: [PCPowerSpeed] => C:\Program Files (x86)\PCPowerSpeed\PCPowerTray.exe [385664 2011-09-27] (Crawler.com)
HKLM-x32\...\Run: [24x7HELP] => C:\Program Files (x86)\24x7Help\App24x7Help.exe [1766040 2012-12-11] (Crawler, LLC)
HKLM-x32\...\Run: [InboxToolbar] => C:\Program Files (x86)\Inbox Toolbar\Inbox.exe [1681120 2012-10-24] (Inbox.com, Inc.)
HKLM-x32\...\Run: [Online Vault] => C:\Program Files (x86)\OnlineVault\OVTray.exe [371360 2012-11-21] (Crawler.com)
HKU\S-1-5-21-3224521152-2373409109-2273049155-1000\...\Run: [RebateInformer] => C:\Program Files (x86)\RebateInformer\RebateInf.exe [1114112 2011-11-16] (Inbox.com, Inc.)
AppInit_DLLs: C:\PROGRA~2\SEARCH~1\Datamngr\x64\datamngr.dll => C:\Program Files (x86)\Searchqu Toolbar\Datamngr\x64\datamngr.dll [1778584 2012-03-12] (Bandoo Media, inc)
AppInit_DLLs: C:\PROGRA~2\SEARCH~1\Datamngr\x64\IEBHO.dll => C:\Program Files (x86)\Searchqu Toolbar\Datamngr\x64\IEBHO.dll [1791384 2012-03-12] (Bandoo Media, inc)
AppInit_DLLs-x32: C:\PROGRA~2\SEARCH~1\Datamngr\datamngr.dll => C:\Program Files (x86)\Searchqu Toolbar\Datamngr\datamngr.dll [1236368 2012-03-12] (Bandoo Media, inc)
AppInit_DLLs-x32: C:\PROGRA~2\SEARCH~1\Datamngr\IEBHO.dll => C:\Program Files (x86)\Searchqu Toolbar\Datamngr\IEBHO.dll [1233816 2012-03-12] (Bandoo Media, inc)
HKU\S-1-5-21-3224521152-2373409109-2273049155-1000\Software\Microsoft\Internet Explorer\Main,Search Bar = hxxp://toolbar.inbox.com/search/dispatcher.aspx?tp=aus&qkw=%s&tbid=%tb_id&%language
HKU\S-1-5-21-3224521152-2373409109-2273049155-1000\Software\Microsoft\Internet Explorer\Main,Start Page Restore = hxxp://www.inbox.com/homepage.aspx?tbid=80291&lng=en
URLSearchHook: HKLM-x32 - Produtools Manuals Toolbar - {16bb67e0-6319-4077-be84-f41269e051f3} - C:\Program Files (x86)\Produtools_Manuals\prxtbProd.dll (Conduit Ltd.)
URLSearchHook: HKLM-x32 - Produtools Manuals 2.1 Toolbar - {b2bf7b3f-bf0b-4c48-aec6-f92c51be63e1} - C:\Program Files (x86)\Produtools_Manuals_2.1\prxtbProd.dll (Conduit Ltd.)
URLSearchHook: [S-1-5-21-3224521152-2373409109-2273049155-1000] ATTENTION => Default URLSearchHook is missing
URLSearchHook: HKU\S-1-5-21-3224521152-2373409109-2273049155-1000 - Inbox Toolbar - {D3D233D5-9F6D-436C-B6C7-E63F77503B30} - C:\Program Files (x86)\Inbox Toolbar\Inbox.dll (Inbox.com, Inc.)
URLSearchHook: HKU\S-1-5-21-3224521152-2373409109-2273049155-1000 - Produtools Manuals Toolbar - {16bb67e0-6319-4077-be84-f41269e051f3} - C:\Program Files (x86)\Produtools_Manuals\prxtbProd.dll (Conduit Ltd.)
URLSearchHook: HKU\S-1-5-21-3224521152-2373409109-2273049155-1000 - Produtools Manuals 2.1 Toolbar - {b2bf7b3f-bf0b-4c48-aec6-f92c51be63e1} - C:\Program Files (x86)\Produtools_Manuals_2.1\prxtbProd.dll (Conduit Ltd.)
SearchScopes: HKLM -> DefaultScope {9BB47C17-9C68-4BB3-B188-DD9AF0FD21} URL = hxxp://dts.search-results.com/sr?src=ieb&gct=ds&appid=221&systemid=1&apn_dtid=IME001&apn_ptnrs=AGE&o=APN10653&apn_uid=1042151012054953&q={searchTerms}
SearchScopes: HKLM -> {9BB47C17-9C68-4BB3-B188-DD9AF0FD21} URL = hxxp://dts.search-results.com/sr?src=ieb&gct=ds&appid=221&systemid=1&apn_dtid=IME001&apn_ptnrs=AGE&o=APN10653&apn_uid=1042151012054953&q={searchTerms}
SearchScopes: HKLM -> {9BB47C17-9C68-4BB3-B188-DD9AF0FD2406} URL = hxxp://dts.search-results.com/sr?src=ieb&appid=139&systemid=406&sr=0&q={searchTerms}
SearchScopes: HKLM -> {A980C307-6F73-41E8-9246-3266F5CA6BB2} URL = hxxp://www.ask.com/web?q={searchterms}&l=dis&o=ushpd
SearchScopes: HKLM-x32 -> DefaultScope {9BB47C17-9C68-4BB3-B188-DD9AF0FD21} URL = hxxp://dts.search-results.com/sr?src=ieb&gct=ds&appid=221&systemid=1&apn_dtid=IME001&apn_ptnrs=AGE&o=APN10653&apn_uid=1042151012054953&q={searchTerms}
SearchScopes: HKLM-x32 -> {9BB47C17-9C68-4BB3-B188-DD9AF0FD21} URL = hxxp://dts.search-results.com/sr?src=ieb&gct=ds&appid=221&systemid=1&apn_dtid=IME001&apn_ptnrs=AGE&o=APN10653&apn_uid=1042151012054953&q={searchTerms}
SearchScopes: HKLM-x32 -> {9BB47C17-9C68-4BB3-B188-DD9AF0FD2406} URL = hxxp://dts.search-results.com/sr?src=ieb&appid=139&systemid=406&sr=0&q={searchTerms}
SearchScopes: HKLM-x32 -> {A980C307-6F73-41E8-9246-3266F5CA6BB2} URL = hxxp://www.ask.com/web?q={searchterms}&l=dis&o=ushpd
SearchScopes: HKU\S-1-5-21-3224521152-2373409109-2273049155-1000 -> DefaultScope {9BB47C17-9C68-4BB3-B188-DD9AF0FD21} URL = hxxp://dts.search-results.com/sr?src=ieb&gct=ds&appid=221&systemid=1&apn_dtid=IME001&apn_ptnrs=AGE&o=APN10653&apn_uid=1042151012054953&q={searchTerms}
SearchScopes: HKU\S-1-5-21-3224521152-2373409109-2273049155-1000 -> {9BB47C17-9C68-4BB3-B188-DD9AF0FD21} URL = hxxp://dts.search-results.com/sr?src=ieb&gct=ds&appid=221&systemid=1&apn_dtid=IME001&apn_ptnrs=AGE&o=APN10653&apn_uid=1042151012054953&q={searchTerms}
SearchScopes: HKU\S-1-5-21-3224521152-2373409109-2273049155-1000 -> {9BB47C17-9C68-4BB3-B188-DD9AF0FD2406} URL = hxxp://dts.search-results.com/sr?src=ieb&appid=139&systemid=406&sr=0&q={searchTerms}
SearchScopes: HKU\S-1-5-21-3224521152-2373409109-2273049155-1000 -> {A980C307-6F73-41E8-9246-3266F5CA6BB2} URL = hxxp://www.ask.com/web?q={searchterms}&l=dis&o=ushpd
SearchScopes: HKU\S-1-5-21-3224521152-2373409109-2273049155-1000 -> {C04B7D22-5AEC-4561-8F49-27F6269208F6} URL = hxxp://www2.inbox.com/search/dispatcher.aspx?tp=bs&qkw={searchTerms}&tbid=80291&lng=en
BHO: DataMngr -> {9D717F81-9148-4f12-8568-69135F087DB0} -> C:\Program Files (x86)\Searchqu Toolbar\Datamngr\x64\BrowserConnection.dll [2012-03-12] (Bandoo Media, inc)
BHO-x32: No Name -> {02478D38-C3F9-4efb-9B51-7695ECA05670} -> No File
BHO-x32: No Name -> {11BF46C6-B3DE-48BD-BF70-3AD85CAB80B5} -> C:\Program Files (x86)\SiteRanker\SiteRank.dll [2012-02-20] (Crawler, LLC)
BHO-x32: Produtools Manuals Toolbar -> {16bb67e0-6319-4077-be84-f41269e051f3} -> C:\Program Files (x86)\Produtools_Manuals\prxtbProd.dll [2011-05-09] (Conduit Ltd.)
BHO-x32: Search-Results Toolbar -> {31d8407c-62e4-4125-a4a9-717efb1a56ae} -> C:\Program Files (x86)\iMesh Applications\Mediabar\Datamngr\SRTOOL~1\searchresultsDx.dll [2012-10-02] (APN LLC)
BHO-x32: No Name -> {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} -> No File
BHO-x32: Feather Mail Toolbar Helper -> {657A4245-5212-4390-A997-C3CB0C6D60B4} -> C:\Program Files (x86)\Feather Mail Toolbar\Toolbar32.dll [2011-11-15] ()
BHO-x32: AppGraffiti -> {6F6A5334-78E9-4D9B-8182-8B41EA8C39EF} -> C:\Program Files (x86)\AppGraffiti\AppGraffiti.dll [2013-03-20] (Omega Partners Ltd)
BHO-x32: Searchqu Toolbar -> {99079a25-328f-4bd4-be04-00955acaa0a7} -> C:\Program Files (x86)\Searchqu Toolbar\Datamngr\ToolBar\searchqudtx.dll [2012-02-27] ()
BHO-x32: DataMngr -> {9D717F81-9148-4f12-8568-69135F087DB0} -> C:\Program Files (x86)\Searchqu Toolbar\Datamngr\BrowserConnection.dll [2012-03-12] (Bandoo Media, inc)
BHO-x32: Produtools Manuals 2.1 Toolbar -> {b2bf7b3f-bf0b-4c48-aec6-f92c51be63e1} -> C:\Program Files (x86)\Produtools_Manuals_2.1\prxtbProd.dll [2011-05-09] (Conduit Ltd.)
BHO-x32: No Name -> {CCB69577-088B-4004-9ED8-FF5BCC83A039} -> C:\Program Files (x86)\RebateInformer\RebateI.dll [2011-11-16] (Inbox.com, Inc.)
BHO-x32: Inbox Toolbar -> {D3D233D5-9F6D-436C-B6C7-E63F77503B30} -> C:\Program Files (x86)\Inbox Toolbar\Inbox.dll [2012-10-24] (Inbox.com, Inc.)
C:\Program Files (x86)\AppGraffiti
C:\Program Files (x86)\Produtools_Manuals_2.1
BHO-x32: No Name -> {CCB69577-088B-4004-9ED8-FF5BCC83A039} -> C:\Program Files (x86)\RebateInformer\RebateI.dll [2011-11-16] (Inbox.com, Inc.)
BHO-x32: Inbox Toolbar -> {D3D233D5-9F6D-436C-B6C7-E63F77503B30} -> C:\Program Files (x86)\Inbox Toolbar\Inbox.dll [2012-10-24] (Inbox.com, Inc.)
Toolbar: HKLM-x32 - No Name - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - No File
Toolbar: HKLM-x32 - &Inbox Toolbar - {D7E97865-918F-41E4-9CD0-25AB1C574CE8} - C:\Program Files (x86)\Inbox Toolbar\Inbox.dll [2012-10-24] (Inbox.com, Inc.)
Toolbar: HKLM-x32 - Feather Mail Toolbar - {271898BB-6159-4ED2-AADA-564C975024BF} - C:\Program Files (x86)\Feather Mail Toolbar\Toolbar32.dll [2011-11-15] ()
Toolbar: HKLM-x32 - Produtools Manuals Toolbar - {16bb67e0-6319-4077-be84-f41269e051f3} - C:\Program Files (x86)\Produtools_Manuals\prxtbProd.dll [2011-05-09] (Conduit Ltd.)
Toolbar: HKLM-x32 - Produtools Manuals 2.1 Toolbar - {b2bf7b3f-bf0b-4c48-aec6-f92c51be63e1} - C:\Program Files (x86)\Produtools_Manuals_2.1\prxtbProd.dll [2011-05-09] (Conduit Ltd.)
Toolbar: HKLM-x32 - Searchqu Toolbar - {99079a25-328f-4bd4-be04-00955acaa0a7} - C:\Program Files (x86)\Searchqu Toolbar\Datamngr\ToolBar\searchqudtx.dll [2012-02-27] ()
Toolbar: HKLM-x32 - Search-Results Toolbar - {31d8407c-62e4-4125-a4a9-717efb1a56ae} - C:\Program Files (x86)\iMesh Applications\Mediabar\Datamngr\SRTOOL~1\searchresultsDx.dll [2012-10-02] (APN LLC)
Handler-x32: inbox - {37540F19-DD4C-478B-B2DF-C19281BCAF27} - C:\Program Files (x86)\Inbox Toolbar\Inbox.dll [2012-10-24] (Inbox.com, Inc.)
Handler-x32: rebinfo - {AF808758-C780-404C-A4EE-4526323FD9B6} - C:\Program Files (x86)\RebateInformer\RebateI.dll [2011-11-16] (Inbox.com, Inc.)
C:\Program Files (x86)\Inbox Toolbar
FF Extension: SiteRanker - C:\Program Files (x86)\SiteRanker\firefox [2012-03-02]
C:\Program Files (x86)\SiteRanker
R2 24x7HelpSvc; C:\Program Files (x86)\24x7Help\App24x7Svc.exe [394352 2012-02-29] (PCRx.com, LLC)
R2 Updater Service for Feather Mail Toolbar; C:\Program Files (x86)\Feather Mail Toolbar\ToolbarUpdaterService.exe [244960 2011-11-15] ()
U1 eabfiltr; no ImagePath
S3 IpInIp; system32\DRIVERS\ipinip.sys [X]
S3 NwlnkFlt; system32\DRIVERS\nwlnkflt.sys [X]
S3 NwlnkFwd; system32\DRIVERS\nwlnkfwd.sys [X]
S3 SymIMMP; system32\DRIVERS\SymIM.sys [X]
C:\Program Files (x86)\RebateInformer
C:\Users\Tyrone\AppData\Roaming\PCPowerSpeed
C:\Program Files (x86)\SiteRanker
CMD: bitsadmin /reset /allusers
CMD: netsh advfirewall reset
CMD: netsh advfirewall set allprofiles state on
CMD: ipconfig /flushdns
Emptytemp:
Hosts:
End

NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system.


Run FRST and press the Fix button just once and wait. The tool will make a log on the desktop (Fixlog.txt) please post it in your next reply.


Step 3: Program Uninstalls Part 2

The fix with FRST will cause 2 malware programs that were hidden to be seen now. Please uninstall the 2 programs listed below. There were actually 2 copies each of iLivid and iMesh installed on the machine. However, 2 of them were hidden, and now the FRST fix has made it where we can remove them now.

• iLivid (x32 Version: 1.92.0.117387 - Bandoo Media Inc.)
• iMesh (x32 Version: 11.0.0.129514 - iMesh Inc.)

Things I need to see in your next post:

Fixlog.txt Log

[pystryker]

Due to lack of feedback, this topic has been closed.

If you need this topic reopened, please contact a staff member. This applies only to the original topic starter. Everyone else please begin a New Topic.