Spyware / Malware / Virus Removal

Can't Connect to Internet

16 min read

Looking for the outcome? Ask AI

JenneyB Topic Starter

Post #1July 17, 2011, 5:09 PM UTC

Hi, I'm using a different computer to post this. I haven't had any virus problems and stay pretty vigilant, but my AVG was acting strange today saying I had backdoor trojans so I suspected the Heur,Dropper and downloaded Malwarebytes per instructions here. It found and got rid of 9 things. When I restarted, I keep getting the message "the proxy server is refusing connections" when I try to go online on my laptop (wireless) I appreciate your help!! Jenney

oldman960

Post #2July 18, 2011, 4:32 AM UTC

Hi JenneyB, welcome to the forum.

To make cleaning this machine easier

Please do not uninstall/install any programs unless asked to
It is more difficult when files/programs are appearing in/disappearing from the logs.
Please do not run any scans other than those requested
Please follow all instructions in the order posted
All logs/reports, etc.. must be posted in Notepad. Please ensure that word wrap is unchecked. In notepad click format, uncheck word wrap if it is checked.
Do not attach any logs/reports, etc.. unless specifically requested to do so.
If you have problems with or do not understand the instructions, Please ask before continuing.
Please stay with this thread until given the All Clear. A absence of symptoms does not mean a clean machine.

Try this:

Open your Internet Explorer:

At the top click Tools, click Internet Options
On the Connections Tab click Lan Settings
Uncheck use a proxy server

For FireFox it's

Tools > Options
Click the Advanced button
Click the Network tab
In the connections section click the Settings button
Check mark No Proxy
OK your way out.

Let us know if you can now connect.

JenneyB

Post #3July 18, 2011, 6:07 PM UTC

Hello and thanks for your help. That did work and I'm able to connect. That Malwarebytes fix was great too–it seems to be completely taken care of. Thanks again.

oldman960

Post #4July 18, 2011, 11:45 PM UTC

Hi JenneyB,

We should do a couple of scans to see if anything remains.

Download OTL to your desktop.

Right click on OTL.exe and click "Run as Administrator" to run it. Make sure all other windows are closed and to let it run uninterrupted.
When the window appears, underneath Output at the top change it to Minimal Output
Check the boxes beside LOP Check and Purity Check.
In the window under Custom Scans/Fixes copy and paste the following

netsvcs
%SYSTEMDRIVE%\*.*
%systemroot%\Fonts\*.com
%systemroot%\Fonts\*.dll
%systemroot%\Fonts\*.ini
%systemroot%\Fonts\*.ini2
%systemroot%\Fonts\*.exe
%systemroot%\system32\spool\prtprocs\w32x86\*.*
%systemroot%\REPAIR\*.bak1
%systemroot%\REPAIR\*.ini
%systemroot%\system32\*.jpg
%systemroot%\*.jpg
%systemroot%\*.png
%systemroot%\*.scr
%systemroot%\*._sy
%APPDATA%\Adobe\Update\*.*
%ALLUSERSPROFILE%\Favorites\*.*
%APPDATA%\Microsoft\*.*
%PROGRAMFILES%\*.*
%APPDATA%\Update\*.*
%systemroot%\*. /mp /s
CREATERESTOREPOINT
%systemroot%\System32\config\*.sav
%PROGRAMFILES%\bak. /s
%systemroot%\system32\bak. /s
%ALLUSERSPROFILE%\Start Menu\*.lîk /x
%systemroot%\system32\config\systemprofile\*.dat /x
%systemroot%\*.config
%systemroot%\system32\*.db
%PROGRAMFILES%\Internet Explorer\*.dat
%APPDATA%\Mikzosoft\Internet Explorer\Quick Launch\*.lnk /x
%USERPROFILE%\Deskuop\*.exe
%PROGRAMFILES%\Common Files\*.*
%systemroot%\*.src
%systemroot%\install\*.*
%systemroot%\system32\DLL\*.*
%systemroot%\system32\HelpFiles\*.*
%systemroot%\system32\rundll\*.*
%systemroot%\winn32\*.*
%systemroot%\Java\*.*
%systemroot%\system32\test\*.*
%systemroot%\system32\Rundll32\*.*
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs
%USERPROFILE%\..|smtmp;true;true;true /FP
%temp%\smtmp\*.* /s >
/md5start
iexplore.*
explorer.*
winlogon.*
dll
zx.dll
hlp.dat
/md5stop
Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.

When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.

Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post it with your next reply. You may need two posts to fit them all in.

Download aswMBR.exe ( 511KB ) to your desktop.

Right click the aswMBR.exe and click "Runas Administrator" to run it

Click the "Scan" button to start scan
[external image: Posted Image]

On completion of the scan click save log, save it to your desktop and post in your next reply
[external image: Posted Image]

There shall also be a file on your desktop named MBR.dat. Right click that file and select Send To>Compressed (zipped) folder. Please attach that zipped file in your next reply.

Please post back with

Both OTL logs
aswMBR log
mbr.dat (attached)

Thanks

JenneyB

Post #5July 19, 2011, 12:43 AM UTC

Here are the 2 otl logs – I'll post again with the others

Thanks,
Jenney

OTL logfile created on: 7/18/2011 7:34:14 PM - Run 1
OTL by OldTimer - Version 3.2.26.1 Folder = C:\Users\J Browne\Downloads
64bit- Home Premium Edition (Version = 6.1.7600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7600.16385)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

3.93 Gb Total Physical Memory | 2.25 Gb Available Physical Memory | 57.26% Memory free
7.87 Gb Paging File | 5.61 Gb Available in Paging File | 71.27% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 187.69 Gb Total Space | 150.02 Gb Free Space | 79.93% Space Free | Partition Type: NTFS
Drive D: | 30.25 Gb Total Space | 29.51 Gb Free Space | 97.58% Space Free | Partition Type: NTFS

Computer Name: JBROWNE-PC | User Name: J Browne | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2011/07/18 19:25:09 | 000,579,584 | —- | M] (OldTimer Tools) – C:\Users\J Browne\Downloads\OTL.exe
PRC - [2011/07/02 21:32:19 | 000,924,632 | —- | M] (Mozilla Corporation) – C:\Program Files (x86)\Mozilla Firefox\firefox.exe
PRC - [2011/03/14 17:48:35 | 002,071,904 | —- | M] (AVG Technologies CZ, s.r.o.) – C:\Program Files (x86)\AVG\AVG9\avgtray.exe
PRC - [2010/11/24 19:01:22 | 000,725,344 | —- | M] (AVG Technologies CZ, s.r.o.) – C:\Program Files (x86)\AVG\AVG9\avgcsrvx.exe
PRC - [2010/08/28 17:12:44 | 000,921,952 | —- | M] (AVG Technologies CZ, s.r.o.) – C:\Program Files (x86)\AVG\AVG9\avgemc.exe
PRC - [2010/08/28 17:12:40 | 000,308,136 | —- | M] (AVG Technologies CZ, s.r.o.) – C:\Program Files (x86)\AVG\AVG9\avgwdsvc.exe
PRC - [2010/06/30 13:23:24 | 000,774,496 | —- | M] (Digital Delivery Networks, Inc.) – C:\Program Files (x86)\DDNi\Lenovo Smile Dock\CenterStage.exe
PRC - [2010/06/23 13:52:56 | 002,435,592 | —- | M] (Check Point Software Technologies LTD) – C:\Windows\SysWOW64\ZoneLabs\vsmon.exe
PRC - [2010/06/23 13:51:30 | 001,043,968 | —- | M] (Check Point Software Technologies LTD) – C:\Program Files (x86)\Zone Labs\ZoneAlarm\zlclient.exe
PRC - [2010/06/23 05:39:54 | 000,046,080 | —- | M] () – C:\Program Files (x86)\DDNi\Oasis2Service 1.0\Oasis2Service.exe
PRC - [2010/05/30 05:31:30 | 003,122,440 | —- | M] (Lenovo) – C:\Program Files (x86)\Lenovo\VeriFace\PManage.exe
PRC - [2010/04/09 00:32:30 | 000,716,344 | —- | M] (Conexant Systems, Inc) – C:\Program Files\CONEXANT\SAII\SmartAudio.exe
PRC - [2010/02/02 05:41:42 | 019,812,536 | —- | M] (ooVoo LLC) – C:\Program Files (x86)\ooVoo\ooVoo.exe
PRC - [2009/09/16 10:57:04 | 002,299,136 | —- | M] (White Sky, Inc.) – C:\Program Files (x86)\ID Vault\IDVault.exe
PRC - [2009/07/14 09:27:26 | 000,038,152 | —- | M] (Lenovo Group Limited) – C:\Program Files (x86)\Lenovo\ReadyComm\common\IGRS.exe
PRC - [2009/06/04 14:03:32 | 000,186,904 | —- | M] (Intel Corporation) – C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAAnotif.exe
PRC - [2009/06/04 14:03:06 | 000,354,840 | —- | M] (Intel Corporation) – C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAANTmon.exe
PRC - [2009/03/05 16:07:20 | 002,260,480 | RHS- | M] (Safer-Networking Ltd.) – C:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe
PRC - [2009/01/26 15:31:10 | 001,153,368 | —- | M] (Safer Networking Ltd.) – C:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe

========== Modules (SafeList) ==========

MOD - [2011/07/18 19:25:09 | 000,579,584 | —- | M] (OldTimer Tools) – C:\Users\J Browne\Downloads\OTL.exe
MOD - [2010/08/21 00:21:32 | 001,680,896 | —- | M] (Microsoft Corporation) – C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7600.16661_none_420fe3fa2b8113bd\comctl32.dll

========== Win32 Services (SafeList) ==========

SRV:64bit: - [2009/09/22 13:16:32 | 000,579,400 | —- | M] (Lenovo Group Limited) [On_Demand | Stopped] – C:\Program Files\Lenovo\ReadyComm\ConnSvc.exe – (Lenovo ReadyComm ConnSvc)
SRV:64bit: - [2009/08/14 09:22:48 | 000,509,192 | —- | M] (Lenovo Group Limited) [On_Demand | Stopped] – C:\Program Files\Lenovo\ReadyComm\AppSvc.exe – (Lenovo ReadyComm AppSvc)
SRV:64bit: - [2009/07/13 20:41:27 | 001,011,712 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] – C:\Program Files\Windows Defender\MpSvc.dll – (WinDefend)
SRV - [2011/05/30 11:33:54 | 001,025,352 | —- | M] () [On_Demand | Stopped] – C:\Program Files (x86)\AVG\AVG9\Toolbar\ToolbarBroker.exe – (AVG Security Toolbar Service)
SRV - [2010/08/28 17:12:44 | 000,921,952 | —- | M] (AVG Technologies CZ, s.r.o.) [Auto | Running] – C:\Program Files (x86)\AVG\AVG9\avgemc.exe – (avg9emc)
SRV - [2010/08/28 17:12:40 | 000,308,136 | —- | M] (AVG Technologies CZ, s.r.o.) [Auto | Running] – C:\Program Files (x86)\AVG\AVG9\avgwdsvc.exe – (avg9wd)
SRV - [2010/08/13 09:13:32 | 000,066,112 | —- | M] (NOS Microsystems Ltd.) [On_Demand | Stopped] – C:\Program Files (x86)\NOS\bin\getPlus_Helper_3004.dll – (nosGetPlusHelper) getPlus®
SRV - [2010/06/23 13:52:56 | 002,435,592 | —- | M] (Check Point Software Technologies LTD) [Auto | Running] – C:\Windows\SysWOW64\ZoneLabs\vsmon.exe – (vsmon)
SRV - [2010/06/23 05:39:54 | 000,046,080 | —- | M] () [Auto | Running] – C:\Program Files (x86)\DDNi\Oasis2Service 1.0\Oasis2Service.exe – (Oasis2Service)
SRV - [2010/03/18 14:16:28 | 000,130,384 | —- | M] (Microsoft Corporation) [Auto | Stopped] – C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe – (clr_optimization_v4.0.30319_32)
SRV - [2009/07/14 09:27:26 | 000,038,152 | —- | M] (Lenovo Group Limited) [Auto | Running] – C:\Program Files (x86)\Lenovo\ReadyComm\common\IGRS.exe – (IGRS)
SRV - [2009/07/13 20:14:41 | 000,020,992 | —- | M] (Microsoft Corporation) [Auto | Stopped] – C:\windows\SysWow64\IgrsSvcs.exe – (ReadyComm.DirectRouter)
SRV - [2009/07/13 20:14:41 | 000,020,992 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] – C:\windows\SysWow64\IgrsSvcs.exe – (PS_MDP)
SRV - [2009/06/10 16:23:09 | 000,066,384 | —- | M] (Microsoft Corporation) [Disabled | Stopped] – C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe – (clr_optimization_v2.0.50727_32)
SRV - [2009/06/04 14:03:06 | 000,354,840 | —- | M] (Intel Corporation) [Auto | Running] – C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAANTmon.exe – (IAANTMON) Intel®
SRV - [2009/01/26 15:31:10 | 001,153,368 | —- | M] (Safer Networking Ltd.) [Auto | Running] – C:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe – (SBSDWSCService)

========== Driver Services (SafeList) ==========

DRV:64bit: - [2011/05/05 18:06:59 | 000,317,520 | —- | M] (AVG Technologies CZ, s.r.o.) [Kernel | System | Running] – C:\Windows\SysNative\drivers\avgtdia.sys – (AvgTdiA)
DRV:64bit: - [2011/03/11 01:22:41 | 000,107,904 | —- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\amdsata.sys – (amdsata)
DRV:64bit: - [2011/03/11 01:22:40 | 000,027,008 | —- | M] (Advanced Micro Devices) [Kernel | Boot | Running] – C:\Windows\SysNative\drivers\amdxata.sys – (amdxata)
DRV:64bit: - [2010/08/28 17:13:54 | 000,269,904 | —- | M] (AVG Technologies CZ, s.r.o.) [Kernel | System | Running] – C:\Windows\SysNative\drivers\avgldx64.sys – (AvgLdx64)
DRV:64bit: - [2010/08/28 17:13:54 | 000,035,536 | —- | M] (AVG Technologies CZ, s.r.o.) [File_System | System | Running] – C:\Windows\SysNative\drivers\avgmfx64.sys – (AvgMfx64)
DRV:64bit: - [2010/05/15 16:30:52 | 000,458,840 | —- | M] (Check Point Software Technologies LTD) [Kernel | System | Running] – C:\Windows\SysNative\drivers\vsdatant.sys – (Vsdatant)
DRV:64bit: - [2010/04/21 23:11:42 | 000,260,216 | —- | M] (Alps Electric Co., Ltd.) [Kernel | On_Demand | Running] – C:\Windows\SysNative\drivers\Apfiltr.sys – (ApfiltrService)
DRV:64bit: - [2010/01/18 04:45:50 | 000,717,368 | —- | M] (Conexant Systems Inc.) [Kernel | On_Demand | Running] – C:\Windows\SysNative\drivers\CHDRT64.sys – (CnxtHdAudService)
DRV:64bit: - [2009/12/01 11:37:28 | 001,270,896 | —- | M] (Bison Electronics. Inc. ) [Kernel | On_Demand | Running] – C:\Windows\SysNative\drivers\BisonC07.sys – (Cam5607)
DRV:64bit: - [2009/07/21 09:20:06 | 000,121,840 | —- | M] (CyberLink) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\wsvd.sys – (wsvd)
DRV:64bit: - [2009/07/16 06:55:34 | 000,011,280 | —- | M] (Lenovo) [Kernel | On_Demand | Running] – C:\Windows\SysNative\drivers\WDMirror.sys – (wdmirror)
DRV:64bit: - [2009/07/15 22:38:20 | 000,079,376 | —- | M] (Lenovo) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\WDBridge.sys – (Bridge0)
DRV:64bit: - [2009/07/13 20:52:20 | 000,194,128 | —- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\amdsbs.sys – (amdsbs)
DRV:64bit: - [2009/07/13 20:48:04 | 000,065,600 | —- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\lsi_sas2.sys – (LSI_SAS2)
DRV:64bit: - [2009/07/13 20:47:48 | 000,077,888 | —- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\HpSAMD.sys – (HpSAMD)
DRV:64bit: - [2009/07/13 20:45:55 | 000,024,656 | —- | M] (Promise Technology) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\stexstor.sys – (stexstor)
DRV:64bit: - [2009/07/07 12:45:50 | 002,769,400 | —- | M] (Broadcom Corporation) [Kernel | On_Demand | Running] – C:\Windows\SysNative\drivers\BCMWL664.SYS – (BCM43XX)
DRV:64bit: - [2009/07/02 20:42:08 | 007,342,432 | —- | M] (Intel Corporation) [Kernel | On_Demand | Running] – C:\Windows\SysNative\drivers\igdkmd64.sys – (igfx)
DRV:64bit: - [2009/06/10 15:38:56 | 000,000,308 | —- | M] () [File_System | On_Demand | Running] – C:\Windows\SysNative\wbem\ntfs.mof – (Ntfs)
DRV:64bit: - [2009/06/10 15:35:28 | 005,434,368 | —- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\netw5v64.sys – (netw5v64) Intel®
DRV:64bit: - [2009/06/10 15:34:36 | 000,270,848 | —- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\k57nd60a.sys – (k57nd60a) Broadcom NetLink ™
DRV:64bit: - [2009/06/10 15:34:33 | 003,286,016 | —- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\evbda.sys – (ebdrv)
DRV:64bit: - [2009/06/10 15:34:28 | 000,468,480 | —- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\bxvbda.sys – (b06bdrv)
DRV:64bit: - [2009/06/10 15:31:59 | 000,031,232 | —- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\hcw85cir.sys – (hcw85cir)
DRV:64bit: - [2009/06/04 13:54:36 | 000,408,600 | —- | M] (Intel Corporation) [Kernel | Boot | Running] – C:\Windows\SysNative\drivers\iaStor.sys – (iaStor)
DRV:64bit: - [2009/05/30 20:43:44 | 000,305,192 | —- | M] (Broadcom Corporation) [Kernel | On_Demand | Running] – C:\Windows\SysNative\drivers\b57nd60a.sys – (b57nd60a)
DRV:64bit: - [2009/05/19 08:43:32 | 000,026,128 | —- | M] (Lenovo Corporation) [Kernel | On_Demand | Running] – C:\Windows\SysNative\drivers\AcpiVpc.sys – (ACPIVPC)
DRV:64bit: - [2008/08/06 07:32:16 | 000,151,656 | —- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] – C:\Windows\SysNative\drivers\WimFltr.sys – (WimFltr)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://google.com/
IE - HKCU\..\URLSearchHook: {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Program Files (x86)\AVG\AVG9\Toolbar\IEToolbar.dll ()
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 1
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = http=127.0.0.1:61131

========== FireFox ==========

FF - prefs.js..browser.startup.homepage: "google.com"
FF - prefs.js..extensions.enabledItems: {E2883E8F-472F-4fb0-9522-AC9BF37916A7}:[removed]
FF - prefs.js..network.proxy.http: "127.0.0.1"
FF - prefs.js..network.proxy.http_port: 61131
FF - prefs.js..network.proxy.type: 0

FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\windows\SysWOW64\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@checkpoint.com/FFApi: C:\Program Files\CheckPoint\ZAForceField\WOW64\TrustChecker\bin\npFFApi.dll File not found
FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files (x86)\Microsoft Silverlight\3.0.40624.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=14.0.8081.0709: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@nosltd.com/getPlus+®,version=1.6.2.90: C:\Program Files (x86)\NOS\bin\np_gp.dll (NOS Microsystems Ltd.)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{FFB96CC1-7EB3-449D-B827-DB661701C6BB}: C:\Program Files\CheckPoint\ZAForceField\WOW64\TrustChecker
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{3f963a5b-e555-4543-90e2-c3908898db71}: C:\Program Files (x86)\AVG\AVG9\Firefox [2010/11/24 19:02:41 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\avg@igeared: C:\Program Files (x86)\AVG\AVG9\Toolbar\Firefox\avg@igeared [2011/05/13 21:57:49 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 5.0\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2011/07/02 21:32:20 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 5.0\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2011/05/13 07:46:03 | 000,000,000 | —D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions\\{F800AB76-D5CD-41A0-92EC-8010BB7B89E7}: C:\Users\J Browne\AppData\Local\{F800AB76-D5CD-41A0-92EC-8010BB7B89E7}\ [2011/07/16 10:08:48 | 000,000,000 | —D | M]

[2010/08/28 14:29:09 | 000,000,000 | —D | M] (No name found) – C:\Users\J Browne\AppData\Roaming\Mozilla\Extensions
[2011/05/13 07:46:04 | 000,000,000 | —D | M] (No name found) – C:\Users\J Browne\AppData\Roaming\Mozilla\Firefox\Profiles\5sucg9yl.default\extensions
[2011/05/13 07:45:49 | 000,000,000 | —D | M] (No name found) – C:\Users\J Browne\AppData\Roaming\Mozilla\Firefox\Profiles\5sucg9yl.default\extensions\nostmp
[2010/08/28 06:55:49 | 000,000,000 | —D | M] (No name found) – C:\Program Files (x86)\Mozilla Firefox\extensions
File not found (No name found) –
[2011/07/16 10:08:48 | 000,000,000 | —D | M] (XULRunner) – C:\USERS\J BROWNE\APPDATA\LOCAL\{F800AB76-D5CD-41A0-92EC-8010BB7B89E7}
[2011/07/02 21:32:19 | 000,142,296 | —- | M] (Mozilla Foundation) – C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll
[2011/05/13 07:45:41 | 000,002,252 | —- | M] () – C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml

O1 HOSTS File: ([2011/07/17 10:58:44 | 000,435,740 | R— | M]) - C:\Windows\SysNative\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 www.007guard.com
O1 - Hosts: 127.0.0.1 007guard.com
O1 - Hosts: 127.0.0.1 008i.com
O1 - Hosts: 127.0.0.1 www.008k.com
O1 - Hosts: 127.0.0.1 008k.com
O1 - Hosts: 127.0.0.1 www.00hq.com
O1 - Hosts: 127.0.0.1 00hq.com
O1 - Hosts: 127.0.0.1 010402.com
O1 - Hosts: 127.0.0.1 www.032439.com
O1 - Hosts: 127.0.0.1 032439.com
O1 - Hosts: 127.0.0.1 www.0scan.com
O1 - Hosts: 127.0.0.1 0scan.com
O1 - Hosts: 127.0.0.1 1000gratisproben.com
O1 - Hosts: 127.0.0.1 www.1000gratisproben.com
O1 - Hosts: 127.0.0.1 1001namen.com
O1 - Hosts: 127.0.0.1 www.1001namen.com
O1 - Hosts: 127.0.0.1 100888290cs.com
O1 - Hosts: 127.0.0.1 www.100888290cs.com
O1 - Hosts: 127.0.0.1 www.100sexlinks.com
O1 - Hosts: 127.0.0.1 100sexlinks.com
O1 - Hosts: 127.0.0.1 10sek.com
O1 - Hosts: 127.0.0.1 www.10sek.com
O1 - Hosts: 127.0.0.1 www.1-2005-search.com
O1 - Hosts: 127.0.0.1 1-2005-search.com
O1 - Hosts: 127.0.0.1 123fporn.info
O1 - Hosts: 14993 more lines…
O2:64bit: - BHO: (AVG Safe Search) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files (x86)\AVG\AVG9\avgssiea.dll (AVG Technologies CZ, s.r.o.)
O2 - BHO: (AVG Safe Search) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files (x86)\AVG\AVG9\avgssie.dll (AVG Technologies CZ, s.r.o.)
O2 - BHO: (Spybot-S&D IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files (x86)\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.
O2 - BHO: (AVG Security Toolbar BHO) - {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Program Files (x86)\AVG\AVG9\Toolbar\IEToolbar.dll ()
O3:64bit: - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3 - HKLM\..\Toolbar: (AVG Security Toolbar) - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - C:\Program Files (x86)\AVG\AVG9\Toolbar\IEToolbar.dll ()
O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (AVG Security Toolbar) - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - C:\Program Files (x86)\AVG\AVG9\Toolbar\IEToolbar.dll ()
O4:64bit: - HKLM..\Run: [Energy Management] C:\Program Files (x86)\Lenovo\Energy Management\Energy Management.exe (Lenovo (Beijing) Limited)
O4:64bit: - HKLM..\Run: [EnergyUtility] C:\Program Files (x86)\Lenovo\Energy Management\utility.exe (Lenovo(beijing) Limited)
O4:64bit: - HKLM..\Run: [HotKeysCmds] C:\Windows\SysNative\hkcmd.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [IAAnotif] C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAAnotif.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [IgfxTray] C:\Windows\SysNative\igfxtray.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [Persistence] C:\Windows\SysNative\igfxpers.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [SmartAudio] C:\Program Files\CONEXANT\SAII\SAIICpl.exe ()
O4 - HKLM..\Run: [AVG9_TRAY] C:\Program Files (x86)\AVG\AVG9\avgtray.exe (AVG Technologies CZ, s.r.o.)
O4 - HKLM..\Run: [UpdateP2GShortCut] C:\Program Files (x86)\Lenovo\Power2Go\MUITransfer\MUIStartMenu.exe (CyberLink Corp.)
O4 - HKLM..\Run: [VeriFaceManager] C:\Program Files (x86)\Lenovo\VeriFace\PManage.exe (Lenovo)
O4 - HKLM..\Run: [ZoneAlarm Client] C:\Program Files (x86)\Zone Labs\ZoneAlarm\zlclient.exe (Check Point Software Technologies LTD)
O4 - HKCU..\Run: [conhost] File not found
O4 - HKCU..\Run: [ooVoo.exe] C:\Program Files (x86)\ooVoo\ooVoo.exe (ooVoo LLC)
O4 - HKCU..\Run: [SpybotSD TeaTimer] C:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe (Safer-Networking Ltd.)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O9 - Extra 'Tools' menuitem : Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files (x86)\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O13 - gopher Prefix: missing
O13 - gopher Prefix: missing
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.254
O18:64bit: - Protocol\Handler\avgsecuritytoolbar {F2DDE6B2-9684-4A55-86D4-E255E237B77C} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\linkscanner {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files (x86)\AVG\AVG9\avgppa.dll (AVG Technologies CZ, s.r.o.)
O18:64bit: - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\wlmailhtml {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - Reg Error: Key error. File not found
O18 - Protocol\Handler\avgsecuritytoolbar {F2DDE6B2-9684-4A55-86D4-E255E237B77C} - C:\Program Files (x86)\AVG\AVG9\Toolbar\IEToolbar.dll ()
O18 - Protocol\Handler\linkscanner {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files (x86)\AVG\AVG9\avgpp.dll (AVG Technologies CZ, s.r.o.)
O20:64bit: - AppInit_DLLs: (avgrssta.dll) - C:\windows\SysNative\avgrssta.dll (AVG Technologies CZ, s.r.o.)
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\windows\SysNative\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O20:64bit: - Winlogon\Notify\igfxcui: DllName - Reg Error: Key error. - C:\windows\SysNative\igfxdev.dll (Intel Corporation)
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found.
O32 - HKLM CDRom: AutoRun - 1
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35:64bit: - HKLM\..comfile [open] – "%1" %*
O35:64bit: - HKLM\..exefile [open] – "%1" %*
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37:64bit: - HKLM\…com [@ = comfile] – "%1" %*
O37:64bit: - HKLM\…exe [@ = exefile] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*

CREATERESTOREPOINT
Restore point Set: OTL Restore Point

========== Files/Folders - Created Within 30 Days ==========

[2011/07/17 11:44:28 | 000,000,000 | —D | C] – C:\Users\J Browne\AppData\Roaming\Malwarebytes
[2011/07/17 11:44:21 | 000,041,272 | —- | C] (Malwarebytes Corporation) – C:\windows\SysWow64\drivers\mbamswissarmy.sys
[2011/07/17 11:44:21 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2011/07/17 11:44:21 | 000,000,000 | —D | C] – C:\ProgramData\Malwarebytes
[2011/07/17 11:44:17 | 000,025,912 | —- | C] (Malwarebytes Corporation) – C:\windows\SysNative\drivers\mbam.sys
[2011/07/17 11:44:17 | 000,000,000 | —D | C] – C:\Program Files (x86)\Malwarebytes' Anti-Malware
[2011/07/17 10:51:17 | 000,000,000 | -H-D | C] – C:\$AVG
[2011/07/16 10:08:48 | 000,000,000 | —D | C] – C:\Users\J Browne\AppData\Local\{F800AB76-D5CD-41A0-92EC-8010BB7B89E7}
[2011/07/13 07:01:11 | 000,000,000 | —D | C] – C:\42ddc68cf5aabdf9babaf7
[2011/07/12 18:10:14 | 000,422,400 | —- | C] (Microsoft Corporation) – C:\windows\SysNative\KernelBase.dll
[2011/07/12 18:10:13 | 000,004,608 | -H– | C] (Microsoft Corporation) – C:\windows\SysNative\api-ms-win-core-threadpool-l1-1-0.dll
[2011/07/12 18:10:13 | 000,004,096 | -H– | C] (Microsoft Corporation) – C:\windows\SysWow64\api-ms-win-core-sysinfo-l1-1-0.dll
[2011/07/12 18:10:13 | 000,004,096 | -H– | C] (Microsoft Corporation) – C:\windows\SysNative\api-ms-win-core-sysinfo-l1-1-0.dll
[2011/07/12 18:10:13 | 000,004,096 | -H– | C] (Microsoft Corporation) – C:\windows\SysWow64\api-ms-win-core-synch-l1-1-0.dll
[2011/07/12 18:10:13 | 000,004,096 | -H– | C] (Microsoft Corporation) – C:\windows\SysNative\api-ms-win-core-synch-l1-1-0.dll
[2011/07/12 18:10:13 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:\windows\SysNative\api-ms-win-core-rtlsupport-l1-1-0.dll
[2011/07/12 18:10:13 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:\windows\SysWow64\api-ms-win-core-libraryloader-l1-1-0.dll
[2011/07/12 18:10:13 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:\windows\SysNative\api-ms-win-core-libraryloader-l1-1-0.dll
[2011/07/12 18:10:13 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\windows\SysNative\api-ms-win-core-xstate-l1-1-0.dll
[2011/07/12 18:10:13 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\windows\SysNative\api-ms-win-core-util-l1-1-0.dll
[2011/07/12 18:10:13 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\windows\SysWow64\api-ms-win-core-string-l1-1-0.dll
[2011/07/12 18:10:13 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\windows\SysNative\api-ms-win-core-string-l1-1-0.dll
[2011/07/12 18:10:13 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\windows\SysWow64\api-ms-win-core-rtlsupport-l1-1-0.dll
[2011/07/12 18:10:12 | 000,006,144 | -H– | C] (Microsoft Corporation) – C:\windows\SysWow64\api-ms-win-security-base-l1-1-0.dll
[2011/07/12 18:10:12 | 000,006,144 | -H– | C] (Microsoft Corporation) – C:\windows\SysNative\api-ms-win-security-base-l1-1-0.dll
[2011/07/12 18:10:12 | 000,005,120 | -H– | C] (Microsoft Corporation) – C:\windows\SysWow64\api-ms-win-core-file-l1-1-0.dll
[2011/07/12 18:10:12 | 000,005,120 | -H– | C] (Microsoft Corporation) – C:\windows\SysNative\api-ms-win-core-file-l1-1-0.dll
[2011/07/12 18:10:12 | 000,004,608 | -H– | C] (Microsoft Corporation) – C:\windows\SysWow64\api-ms-win-core-threadpool-l1-1-0.dll
[2011/07/12 18:10:12 | 000,004,608 | -H– | C] (Microsoft Corporation) – C:\windows\SysWow64\api-ms-win-core-processthreads-l1-1-0.dll
[2011/07/12 18:10:12 | 000,004,608 | -H– | C] (Microsoft Corporation) – C:\windows\SysNative\api-ms-win-core-processthreads-l1-1-0.dll
[2011/07/12 18:10:12 | 000,004,096 | -H– | C] (Microsoft Corporation) – C:\windows\SysWow64\api-ms-win-core-misc-l1-1-0.dll
[2011/07/12 18:10:12 | 000,004,096 | -H– | C] (Microsoft Corporation) – C:\windows\SysWow64\api-ms-win-core-localregistry-l1-1-0.dll
[2011/07/12 18:10:12 | 000,004,096 | -H– | C] (Microsoft Corporation) – C:\windows\SysNative\api-ms-win-core-localregistry-l1-1-0.dll
[2011/07/12 18:10:12 | 000,004,096 | -H– | C] (Microsoft Corporation) – C:\windows\SysWow64\api-ms-win-core-localization-l1-1-0.dll
[2011/07/12 18:10:12 | 000,004,096 | -H– | C] (Microsoft Corporation) – C:\windows\SysNative\api-ms-win-core-localization-l1-1-0.dll
[2011/07/12 18:10:12 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:\windows\SysWow64\api-ms-win-core-xstate-l1-1-0.dll
[2011/07/12 18:10:12 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:\windows\SysWow64\api-ms-win-core-processenvironment-l1-1-0.dll
[2011/07/12 18:10:12 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:\windows\SysNative\api-ms-win-core-processenvironment-l1-1-0.dll
[2011/07/12 18:10:12 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:\windows\SysWow64\api-ms-win-core-namedpipe-l1-1-0.dll
[2011/07/12 18:10:12 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:\windows\SysNative\api-ms-win-core-namedpipe-l1-1-0.dll
[2011/07/12 18:10:12 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:\windows\SysNative\api-ms-win-core-misc-l1-1-0.dll
[2011/07/12 18:10:12 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:\windows\SysWow64\api-ms-win-core-memory-l1-1-0.dll
[2011/07/12 18:10:12 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:\windows\SysNative\api-ms-win-core-memory-l1-1-0.dll
[2011/07/12 18:10:12 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:\windows\SysWow64\api-ms-win-core-interlocked-l1-1-0.dll
[2011/07/12 18:10:12 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:\windows\SysWow64\api-ms-win-core-heap-l1-1-0.dll
[2011/07/12 18:10:12 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:\windows\SysNative\api-ms-win-core-heap-l1-1-0.dll
[2011/07/12 18:10:12 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\windows\SysWow64\api-ms-win-core-util-l1-1-0.dll
[2011/07/12 18:10:12 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\windows\SysWow64\api-ms-win-core-profile-l1-1-0.dll
[2011/07/12 18:10:12 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\windows\SysNative\api-ms-win-core-profile-l1-1-0.dll
[2011/07/12 18:10:12 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\windows\SysWow64\api-ms-win-core-io-l1-1-0.dll
[2011/07/12 18:10:12 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\windows\SysNative\api-ms-win-core-io-l1-1-0.dll
[2011/07/12 18:10:12 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\windows\SysNative\api-ms-win-core-interlocked-l1-1-0.dll
[2011/07/12 18:10:12 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\windows\SysWow64\api-ms-win-core-handle-l1-1-0.dll
[2011/07/12 18:10:12 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\windows\SysNative\api-ms-win-core-handle-l1-1-0.dll
[2011/07/12 18:10:12 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\windows\SysWow64\api-ms-win-core-fibers-l1-1-0.dll
[2011/07/12 18:10:12 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\windows\SysNative\api-ms-win-core-fibers-l1-1-0.dll
[2011/07/12 18:10:12 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\windows\SysWow64\api-ms-win-core-errorhandling-l1-1-0.dll
[2011/07/12 18:10:12 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\windows\SysNative\api-ms-win-core-errorhandling-l1-1-0.dll
[2011/07/12 18:10:12 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\windows\SysWow64\api-ms-win-core-delayload-l1-1-0.dll
[2011/07/12 18:10:12 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\windows\SysNative\api-ms-win-core-delayload-l1-1-0.dll
[2011/07/12 18:10:12 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\windows\SysWow64\api-ms-win-core-debug-l1-1-0.dll
[2011/07/12 18:10:12 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\windows\SysNative\api-ms-win-core-debug-l1-1-0.dll
[2011/07/12 18:10:12 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\windows\SysWow64\api-ms-win-core-datetime-l1-1-0.dll
[2011/07/12 18:10:12 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\windows\SysNative\api-ms-win-core-datetime-l1-1-0.dll
[2011/07/12 18:10:12 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\windows\SysWow64\api-ms-win-core-console-l1-1-0.dll
[2011/07/12 18:10:12 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\windows\SysNative\api-ms-win-core-console-l1-1-0.dll
[2011/07/12 18:10:09 | 001,162,240 | —- | C] (Microsoft Corporation) – C:\windows\SysNative\kernel32.dll
[2011/07/12 18:10:08 | 000,362,496 | —- | C] (Microsoft Corporation) – C:\windows\SysNative\wow64win.dll
[2011/07/12 18:10:08 | 000,338,944 | —- | C] (Microsoft Corporation) – C:\windows\SysNative\conhost.exe
[2011/07/12 18:10:08 | 000,214,528 | —- | C] (Microsoft Corporation) – C:\windows\SysNative\winsrv.dll
[2011/07/12 18:10:07 | 000,243,200 | —- | C] (Microsoft Corporation) – C:\windows\SysNative\wow64.dll
[2011/07/12 18:10:07 | 000,025,600 | —- | C] (Microsoft Corporation) – C:\windows\SysWow64\setup16.exe
[2011/07/12 18:10:07 | 000,016,384 | —- | C] (Microsoft Corporation) – C:\windows\SysNative\ntvdm64.dll
[2011/07/12 18:10:07 | 000,014,336 | —- | C] (Microsoft Corporation) – C:\windows\SysWow64\ntvdm64.dll
[2011/07/12 18:10:07 | 000,013,312 | —- | C] (Microsoft Corporation) – C:\windows\SysNative\wow64cpu.dll
[2011/07/12 18:10:07 | 000,007,680 | —- | C] (Microsoft Corporation) – C:\windows\SysWow64\instnm.exe
[2011/07/12 18:10:07 | 000,005,120 | —- | C] (Microsoft Corporation) – C:\windows\SysWow64\wow32.dll
[2011/07/12 18:10:05 | 000,002,048 | —- | C] (Microsoft Corporation) – C:\windows\SysWow64\user.exe
[2011/07/03 10:48:28 | 000,000,000 | —D | C] – C:\Users\J Browne\Desktop\Idea File
[2011/07/03 10:48:23 | 000,000,000 | —D | C] – C:\Users\J Browne\Documents\New folder
[2011/07/03 10:34:47 | 000,000,000 | —D | C] – C:\Users\J Browne\Desktop\Pre-Installed Programs
[2011/07/03 10:33:21 | 000,000,000 | —D | C] – C:\Users\J Browne\Desktop\Computer Safety
[2011/06/28 19:27:25 | 002,326,016 | —- | C] (Microsoft Corporation) – C:\windows\SysNative\tquery.dll
[2011/06/28 19:27:25 | 002,228,224 | —- | C] (Microsoft Corporation) – C:\windows\SysNative\mssrch.dll
[2011/06/28 19:27:25 | 001,401,856 | —- | C] (Microsoft Corporation) – C:\windows\SysWow64\mssrch.dll
[2011/06/28 19:27:24 | 001,553,920 | —- | C] (Microsoft Corporation) – C:\windows\SysWow64\tquery.dll
[2011/06/28 19:27:24 | 000,666,624 | —- | C] (Microsoft Corporation) – C:\windows\SysWow64\mssvp.dll
[2011/06/28 19:27:24 | 000,491,520 | —- | C] (Microsoft Corporation) – C:\windows\SysNative\mssph.dll
[2011/06/28 19:27:24 | 000,249,856 | —- | C] (Microsoft Corporation) – C:\windows\SysNative\SearchProtocolHost.exe
[2011/06/28 19:27:23 | 000,779,264 | —- | C] (Microsoft Corporation) – C:\windows\SysNative\mssvp.dll
[2011/06/28 19:27:23 | 000,337,408 | —- | C] (Microsoft Corporation) – C:\windows\SysWow64\mssph.dll
[2011/06/28 19:27:23 | 000,288,256 | —- | C] (Microsoft Corporation) – C:\windows\SysNative\mssphtb.dll
[2011/06/28 19:27:23 | 000,197,120 | —- | C] (Microsoft Corporation) – C:\windows\SysWow64\mssphtb.dll
[2011/06/28 19:27:23 | 000,113,664 | —- | C] (Microsoft Corporation) – C:\windows\SysNative\SearchFilterHost.exe
[2011/06/28 19:27:23 | 000,075,264 | —- | C] (Microsoft Corporation) – C:\windows\SysNative\msscntrs.dll
[2011/06/28 19:27:23 | 000,059,392 | —- | C] (Microsoft Corporation) – C:\windows\SysWow64\msscntrs.dll
[2011/06/28 19:27:21 | 000,252,928 | —- | C] (Microsoft Corporation) – C:\windows\SysWow64\drvinst.exe
[2011/06/28 19:27:21 | 000,044,544 | —- | C] (Microsoft Corporation) – C:\windows\SysWow64\devrtl.dll
[2011/06/25 18:04:17 | 000,000,000 | -HSD | C] – C:\found.000
[1 C:\windows\SysNative\drivers\*.tmp files -> C:\windows\SysNative\drivers\*.tmp -> ]
[1 C:\Users\J Browne\AppData\Local\*.tmp files -> C:\Users\J Browne\AppData\Local\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2011/07/18 19:26:50 | 000,013,248 | —- | M] () – C:\Users\J Browne\Desktop\OTL - Shortcut.lnk
[2011/07/18 18:22:38 | 000,013,632 | -H– | M] () – C:\windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2011/07/18 18:22:38 | 000,013,632 | -H– | M] () – C:\windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2011/07/18 18:13:22 | 080,116,683 | —- | M] () – C:\windows\SysNative\drivers\Avg\incavi.avm
[2011/07/18 18:07:05 | 000,067,584 | –S- | M] () – C:\windows\bootstat.dat
[2011/07/17 12:02:55 | 000,726,316 | —- | M] () – C:\windows\SysNative\PerfStringBackup.INI
[2011/07/17 12:02:55 | 000,624,178 | —- | M] () – C:\windows\SysNative\perfh009.dat
[2011/07/17 12:02:55 | 000,106,522 | —- | M] () – C:\windows\SysNative\perfc009.dat
[2011/07/17 11:57:58 | 3168,219,136 | -HS- | M] () – C:\hiberfil.sys
[2011/07/17 11:44:22 | 000,001,109 | —- | M] () – C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
[2011/07/17 11:41:14 | 000,000,120 | —- | M] () – C:\Users\J Browne\AppData\Local\Sqabe.dat
[2011/07/17 11:41:14 | 000,000,000 | —- | M] () – C:\Users\J Browne\AppData\Local\Tmasewe.bin
[2011/07/17 11:11:27 | 000,024,650 | —- | M] () – C:\Users\J Browne\AppData\Roaming\FBB6.EE1
[2011/07/17 10:58:44 | 000,435,740 | R— | M] () – C:\windows\SysNative\drivers\etc\hosts
[2011/07/13 18:38:49 | 000,322,592 | —- | M] () – C:\windows\SysNative\FNTCACHE.DAT
[2011/07/08 19:32:27 | 000,111,924 | —- | M] () – C:\Users\J Browne\Documents\Gummy Ad.pdf
[2011/07/06 19:52:42 | 000,041,272 | —- | M] (Malwarebytes Corporation) – C:\windows\SysWow64\drivers\mbamswissarmy.sys
[2011/07/06 19:52:42 | 000,025,912 | —- | M] (Malwarebytes Corporation) – C:\windows\SysNative\drivers\mbam.sys
[2011/07/03 13:31:03 | 000,001,022 | —- | M] () – C:\Users\J Browne\Desktop\Copywriting - Shortcut.lnk
[2011/07/01 18:06:42 | 000,435,542 | R— | M] () – C:\windows\SysNative\drivers\etc\hosts.20110717-105844.backup
[2011/06/19 08:03:03 | 000,406,323 | —- | M] () – C:\Users\J Browne\Documents\There's No Place Like Your New Home.fdx
[1 C:\windows\SysNative\drivers\*.tmp files -> C:\windows\SysNative\drivers\*.tmp -> ]
[1 C:\Users\J Browne\AppData\Local\*.tmp files -> C:\Users\J Browne\AppData\Local\*.tmp -> ]

========== Files Created - No Company Name ==========

[2011/07/18 19:26:50 | 000,013,248 | —- | C] () – C:\Users\J Browne\Desktop\OTL - Shortcut.lnk
[2011/07/17 11:44:22 | 000,001,109 | —- | C] () – C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
[2011/07/16 10:08:51 | 000,000,000 | —- | C] () – C:\Users\J Browne\AppData\Local\Tmasewe.bin
[2011/07/16 10:08:50 | 000,000,120 | —- | C] () – C:\Users\J Browne\AppData\Local\Sqabe.dat
[2011/07/15 22:20:01 | 000,024,650 | —- | C] () – C:\Users\J Browne\AppData\Roaming\FBB6.EE1
[2011/07/03 13:31:03 | 000,001,022 | —- | C] () – C:\Users\J Browne\Desktop\Copywriting - Shortcut.lnk
[2011/06/23 20:44:34 | 000,111,924 | —- | C] () – C:\Users\J Browne\Documents\Gummy Ad.pdf
[2010/08/28 21:49:38 | 000,000,354 | —- | C] () – C:\ProgramData\profile.xml
[2010/08/28 20:43:22 | 000,000,026 | -H– | C] () – C:\ProgramData\.811261211181235583101118113995
[2010/08/28 06:55:57 | 000,000,000 | —- | C] () – C:\windows\nsreg.dat
[2010/05/30 05:31:33 | 002,110,728 | —- | C] () – C:\windows\SysWow64\Apblend.dll
[2010/05/30 05:31:33 | 001,171,456 | —- | C] () – C:\windows\SysWow64\PicNotify.dll
[2010/05/30 05:31:24 | 001,044,480 | —- | C] () – C:\windows\SysWow64\3DImageRenderer.dll
[2010/05/30 05:30:52 | 000,057,344 | —- | C] () – C:\windows\AsfHelper.dll
[2010/05/30 05:30:25 | 000,015,190 | —- | C] () – C:\windows\M3000Twn.ini
[2010/05/30 05:24:28 | 000,016,648 | R— | C] () – C:\windows\SysWow64\LogAPI.dll
[2010/05/30 05:22:41 | 000,982,220 | —- | C] () – C:\windows\SysWow64\igkrng500.bin
[2010/05/30 05:22:40 | 000,134,592 | —- | C] () – C:\windows\SysWow64\igfcg500.bin
[2010/05/30 05:22:40 | 000,092,216 | —- | C] () – C:\windows\SysWow64\igfcg500m.bin
[2010/05/30 05:22:39 | 000,439,300 | —- | C] () – C:\windows\SysWow64\igcompkrng500.bin
[2009/07/14 00:38:36 | 000,067,584 | –S- | C] () – C:\windows\bootstat.dat
[2009/07/13 21:35:51 | 000,000,741 | —- | C] () – C:\windows\SysWow64\NOISE.DAT
[2009/07/13 21:34:42 | 000,215,943 | —- | C] () – C:\windows\SysWow64\dssec.dat
[2009/07/13 19:10:29 | 000,043,131 | —- | C] () – C:\windows\mib.bin
[2009/07/13 18:42:10 | 000,064,000 | —- | C] () – C:\windows\SysWow64\BWContextHandler.dll
[2009/07/13 16:03:59 | 000,364,544 | —- | C] () – C:\windows\SysWow64\msjetoledb40.dll
[2009/06/10 16:26:10 | 000,673,088 | —- | C] () – C:\windows\SysWow64\mlang.dat

========== LOP Check ==========

[2010/08/28 14:55:47 | 000,000,000 | —D | M] – C:\Users\J Browne\AppData\Roaming\CheckPoint
[2010/09/09 16:04:17 | 000,000,000 | —D | M] – C:\Users\J Browne\AppData\Roaming\com.adobe.mauby.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1
[2010/08/28 21:46:37 | 000,000,000 | —D | M] – C:\Users\J Browne\AppData\Roaming\EasyCapture
[2010/08/28 20:43:33 | 000,000,000 | —D | M] – C:\Users\J Browne\AppData\Roaming\Final Draft
[2011/07/18 19:08:12 | 000,000,000 | —D | M] – C:\Users\J Browne\AppData\Roaming\ID Vault
[2010/08/28 21:58:55 | 000,000,000 | —D | M] – C:\Users\J Browne\AppData\Roaming\ooVoo Details
[2009/07/14 00:08:49 | 000,023,856 | —- | M] () – C:\windows\Tasks\SCHEDLGU.TXT

========== Purity Check ==========

========== Custom Scans ==========

< %SYSTEMDRIVE%\*.* >
[2011/07/18 19:31:22 | 006,103,098 | —- | M] () – C:\FaceProv.log
[2011/07/17 11:57:58 | 3168,219,136 | -HS- | M] () – C:\hiberfil.sys
[2006/12/01 18:37:14 | 000,904,704 | —- | M] (Microsoft Corporation) – C:\msdia80.dll
[2011/07/17 11:57:59 | 4224,294,912 | -HS- | M] () – C:\pagefile.sys

< %systemroot%\Fonts\*.com >
[2009/07/14 00:32:31 | 000,026,040 | —- | M] () – C:\windows\Fonts\GlobalMonospace.CompositeFont
[2009/07/14 00:32:31 | 000,026,489 | —- | M] () – C:\windows\Fonts\GlobalSansSerif.CompositeFont
[2009/07/14 00:32:31 | 000,029,779 | —- | M] () – C:\windows\Fonts\GlobalSerif.CompositeFont
[2009/07/14 00:32:31 | 000,043,318 | —- | M] () – C:\windows\Fonts\GlobalUserInterface.CompositeFont

< %systemroot%\Fonts\*.dll >

< %systemroot%\Fonts\*.ini >
[2009/06/10 15:49:50 | 000,000,065 | —- | M] () – C:\windows\Fonts\desktop.ini

< %systemroot%\Fonts\*.ini2 >

< %systemroot%\Fonts\*.exe >

< %systemroot%\system32\spool\prtprocs\w32x86\*.* >

< %systemroot%\REPAIR\*.bak1 >

< %systemroot%\REPAIR\*.ini >

< %systemroot%\system32\*.jpg >

< %systemroot%\*.jpg >

< %systemroot%\*.png >

< %systemroot%\*.scr >
[2009/07/10 07:15:46 | 000,306,544 | —- | M] (Microsoft Corporation) – C:\windows\WLXPGSS.SCR

< %systemroot%\*._sy >

< %APPDATA%\Adobe\Update\*.* >

< %ALLUSERSPROFILE%\Favorites\*.* >

< %APPDATA%\Microsoft\*.* >

< %PROGRAMFILES%\*.* >
[2009/07/13 23:54:24 | 000,000,174 | -HS- | M] () – C:\Program Files (x86)\desktop.ini

< %APPDATA%\Update\*.* >

< %systemroot%\*. /mp /s >

< %systemroot%\System32\config\*.sav >

< %PROGRAMFILES%\bak. /s >

< %systemroot%\system32\bak. /s >

< %ALLUSERSPROFILE%\Start Menu\*.lîk /x >

< %systemroot%\system32\config\systemprofile\*.dat /x >

< %systemroot%\*.config >

< %systemroot%\system32\*.db >

< %PROGRAMFILES%\Internet Explorer\*.dat >

< %APPDATA%\Mikzosoft\Internet Explorer\Quick Launch\*.lnk /x >

< %USERPROFILE%\Deskuop\*.exe >

< %PROGRAMFILES%\Common Files\*.* >

< %systemroot%\*.src >
[2003/09/22 10:36:46 | 000,013,448 | —- | M] () – C:\windows\M3000Twn.src

< %systemroot%\install\*.* >

< %systemroot%\system32\DLL\*.* >

< %systemroot%\system32\HelpFiles\*.* >

< %systemroot%\system32\rundll\*.* >

< %systemroot%\winn32\*.* >

< %systemroot%\Java\*.* >

< %systemroot%\system32\test\*.* >

< %systemroot%\system32\Rundll32\*.* >

< HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >

< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs >

< %USERPROFILE%\..|smtmp;true;true;true /FP >

< %temp%\smtmp\*.* /s > >

< MD5 for: EXPLORER.ADML >
[2009/07/13 21:30:02 | 000,003,695 | —- | M] () MD5=7A4C7F3CB156543113596988479CAFCE – C:\Windows\winsxs\amd64_microsoft-windows-s..ouppolicy.resources_31bf3856ad364e35_6.1.7600.16385_en-us_7ef5713984067904\Explorer.adml

< MD5 for: EXPLORER.ADMX >
[2009/06/10 15:53:55 | 000,003,836 | —- | M] () MD5=AD131A834808E6AFF4A3918DE05BFCF6 – C:\Windows\winsxs\amd64_microsoft-windows-shell-grouppolicy_31bf3856ad364e35_6.1.7600.16385_none_71af9b5b0a86e6b7\Explorer.admx

< MD5 for: EXPLORER.EXE >
[2011/02/26 01:23:14 | 002,870,272 | —- | M] (Microsoft Corporation) MD5=0862495E0C825893DB75EF44FAEA8E93 – C:\Windows\explorer.exe
[2011/02/26 01:23:14 | 002,870,272 | —- | M] (Microsoft Corporation) MD5=0862495E0C825893DB75EF44FAEA8E93 – C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16768_none_adc24107935a7e25\explorer.exe
[2011/02/26 00:19:21 | 002,616,320 | —- | M] (Microsoft Corporation) MD5=0FB9C74046656D1579A64660AD67B746 – C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.21669_none_ba87e574ddfe652d\explorer.exe
[2009/07/13 20:14:20 | 002,613,248 | —- | M] (Microsoft Corporation) MD5=15BC38A7492BEFE831966ADB477CF76F – C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16385_none_b7fe430bc7ce3761\explorer.exe
[2011/02/26 00:51:13 | 002,614,784 | —- | M] (Microsoft Corporation) MD5=255CF508D7CFB10E0794D6AC93280BD8 – C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20910_none_b8ce9756e0b786a4\explorer.exe
[2010/04/29 21:56:58 | 002,614,272 | —- | M] (Microsoft Corporation) MD5=2626FC9755BE22F805D3CFA0CE3EE727 – C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16450_none_b819b343c7ba6202\explorer.exe
[2011/02/26 00:33:07 | 002,614,784 | —- | M] (Microsoft Corporation) MD5=2AF58D15EDC06EC6FDACCE1F19482BBF – C:\Windows\SysWOW64\explorer.exe
[2011/02/26 00:33:07 | 002,614,784 | —- | M] (Microsoft Corporation) MD5=2AF58D15EDC06EC6FDACCE1F19482BBF – C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16768_none_b816eb59c7bb4020\explorer.exe
[2011/02/25 01:19:30 | 002,871,808 | —- | M] (Microsoft Corporation) MD5=332FEAB1435662FC6C672E25BEB37BE3 – C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17567_none_afa79dc39081d0ba\explorer.exe
[2011/02/26 01:14:34 | 002,871,808 | —- | M] (Microsoft Corporation) MD5=3B69712041F3D63605529BD66DC00C48 – C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.21669_none_b0333b22a99da332\explorer.exe
[2010/11/20 07:17:09 | 002,616,320 | —- | M] (Microsoft Corporation) MD5=40D777B7A95E00593EB1568C68514493 – C:\Windows\SoftwareDistribution\Download\488053cdbca3231eeb2c2af7236d09ed\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17514_none_ba2f56d3c4bcbafb\explorer.exe
[2010/04/29 21:54:16 | 002,868,224 | —- | M] (Microsoft Corporation) MD5=700073016DAC1C3D2E7E2CE4223334B6 – C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20500_none_ae84b558ac4eb41c\explorer.exe
[2011/02/25 00:30:54 | 002,616,320 | —- | M] (Microsoft Corporation) MD5=8B88EBBB05A0E56B7DCC708498C02B3E – C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17567_none_b9fc4815c4e292b5\explorer.exe
[2010/04/29 21:56:58 | 002,870,272 | —- | M] (Microsoft Corporation) MD5=9AAAEC8DAC27AA17B053E6352AD233AE – C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16450_none_adc508f19359a007\explorer.exe
[2010/04/29 21:54:16 | 002,613,248 | —- | M] (Microsoft Corporation) MD5=9FF6C4C91A3711C0A3B18F87B08B518D – C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20500_none_b8d95faae0af7617\explorer.exe
[2010/11/20 08:24:45 | 002,872,320 | —- | M] (Microsoft Corporation) MD5=AC4C51EB24AA95B77F705AB159189E24 – C:\Windows\SoftwareDistribution\Download\488053cdbca3231eeb2c2af7236d09ed\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17514_none_afdaac81905bf900\explorer.exe
[2010/04/29 21:56:58 | 002,870,272 | —- | M] (Microsoft Corporation) MD5=B8EC4BD49CE8F6FC457721BFC210B67F – C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20563_none_ae46d6aeac7ca7c7\explorer.exe
[2010/04/29 21:54:16 | 002,613,248 | —- | M] (Microsoft Corporation) MD5=B95EEB0F4E5EFBF1038A35B3351CF047 – C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16404_none_b853c407c78e3ba9\explorer.exe
[2009/07/13 20:39:10 | 002,868,224 | —- | M] (Microsoft Corporation) MD5=C235A51CB740E45FFA0EBFB9BAFCDA64 – C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16385_none_ada998b9936d7566\explorer.exe
[2010/04/29 21:56:58 | 002,614,272 | —- | M] (Microsoft Corporation) MD5=C76153C7ECA00FA852BB0C193378F917 – C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20563_none_b89b8100e0dd69c2\explorer.exe
[2011/02/26 01:26:45 | 002,870,784 | —- | M] (Microsoft Corporation) MD5=E38899074D4951D31B4040E994DD7C8D – C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20910_none_ae79ed04ac56c4a9\explorer.exe
[2010/04/29 21:54:16 | 002,868,224 | —- | M] (Microsoft Corporation) MD5=F170B4A061C9E026437B193B4D571799 – C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16404_none_adff19b5932d79ae\explorer.exe

< MD5 for: EXPLORER.EXE.MUI >
[2009/07/13 21:26:48 | 000,022,016 | —- | M] (Microsoft Corporation) MD5=4B87EEFDC8E253F846A7DFB49A8E6C70 – C:\Windows\en-US\explorer.exe.mui
[2009/07/13 21:26:48 | 000,022,016 | —- | M] (Microsoft Corporation) MD5=4B87EEFDC8E253F846A7DFB49A8E6C70 – C:\Windows\winsxs\amd64_microsoft-windows-explorer.resources_31bf3856ad364e35_6.1.7600.16385_en-us_61e778c48d52d19b\explorer.exe.mui
[2009/07/13 21:06:56 | 000,022,016 | —- | M] (Microsoft Corporation) MD5=B9F4B1CA23D60775736059D72BA48526 – C:\Windows\SysWOW64\en-US\explorer.exe.mui
[2009/07/13 21:06:56 | 000,022,016 | —- | M] (Microsoft Corporation) MD5=B9F4B1CA23D60775736059D72BA48526 – C:\Windows\winsxs\wow64_microsoft-windows-explorer.resources_31bf3856ad364e35_6.1.7600.16385_en-us_6c3c2316c1b39396\explorer.exe.mui

< MD5 for: IEXPLORE.EXE >
[2010/09/07 23:36:39 | 000,673,040 | —- | M] (Microsoft Corporation) MD5=14803EA3E5DD7CB37CB446C74CFDA38F – C:\Windows\winsxs\wow64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_8.0.7600.20795_none_1a39121b8bff3c23\iexplore.exe
[2011/04/22 15:15:52 | 000,696,592 | —- | M] (Microsoft Corporation) MD5=281C23EC5BCB1853A5D571F1A6E52FB1 – C:\Windows\winsxs\amd64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_8.0.7600.20949_none_101e7c5957724e1d\iexplore.exe
[2009/07/13 20:17:29 | 000,673,048 | —- | M] (Microsoft Corporation) MD5=2C32E3E596CFE660353753EABEFB0540 – C:\Windows\winsxs\wow64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_8.0.7600.16385_none_19ba3f8a72d988f3\iexplore.exe
[2010/09/08 00:37:57 | 000,696,592 | —- | M] (Microsoft Corporation) MD5=4879CB864E290BED38C5BDB641144B1B – C:\Windows\winsxs\amd64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_8.0.7600.20795_none_0fe467c9579e7a28\iexplore.exe
[2010/09/08 00:49:01 | 000,696,592 | —- | M] (Microsoft Corporation) MD5=498035ABCCF1ED47AE6791D239187587 – C:\Windows\winsxs\amd64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_8.0.7600.16671_none_0f6c69ae3e743d20\iexplore.exe
[2010/11/04 00:54:54 | 000,673,040 | —- | M] (Microsoft Corporation) MD5=58CF468D3FF4CF830339FE5E45356355 – C:\Windows\winsxs\wow64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_8.0.7600.16700_none_1a0bc510729d1f54\iexplore.exe
[2010/09/07 23:31:24 | 000,673,040 | —- | M] (Microsoft Corporation) MD5=61EDBCE47ADF3E52AB0B9F49EE4AEBB8 – C:\Windows\winsxs\wow64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_8.0.7600.16671_none_19c1140072d4ff1b\iexplore.exe
[2011/04/22 14:29:16 | 000,673,040 | —- | M] (Microsoft Corporation) MD5=64EFAF916C4009F1B84153D0BB491FB0 – C:\Program Files (x86)\Internet Explorer\iexplore.exe
[2011/04/22 14:29:16 | 000,673,040 | —- | M] (Microsoft Corporation) MD5=64EFAF916C4009F1B84153D0BB491FB0 – C:\Windows\winsxs\wow64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_8.0.7600.16800_none_1a0bc6f6729d1c7b\iexplore.exe
[2010/11/04 00:54:59 | 000,673,040 | —- | M] (Microsoft Corporation) MD5=6B2258FF6D2332073FE9E90122FA4168 – C:\Windows\winsxs\wow64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_8.0.7600.20831_none_1a75f2618bd22c48\iexplore.exe
[2010/12/18 01:17:48 | 000,696,592 | —- | M] (Microsoft Corporation) MD5=700B40EA39DFB25517A81032F03D6D20 – C:\Windows\winsxs\amd64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_8.0.7600.16722_none_0fa37b7a3e4ac7e9\iexplore.exe
[2010/11/20 08:28:25 | 000,695,056 | —- | M] (Microsoft Corporation) MD5=86257731DDB311FBC283534CC0091634 – C:\Windows\SoftwareDistribution\Download\488053cdbca3231eeb2c2af7236d09ed\amd64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_8.0.7601.17514_none_1196a9003b674a92\iexplore.exe
[2010/12/18 01:11:10 | 000,696,592 | —- | M] (Microsoft Corporation) MD5=8C6C32E4AF8A3D7155656F5897C504E0 – C:\Windows\winsxs\amd64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_8.0.7600.20861_none_1000d84b5789be20\iexplore.exe
[2010/12/18 00:32:25 | 000,673,040 | —- | M] (Microsoft Corporation) MD5=9321CF0D023528C71E3645F8433C86C8 – C:\Windows\winsxs\wow64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_8.0.7600.20861_none_1a55829d8bea801b\iexplore.exe
[2010/12/18 00:33:54 | 000,673,040 | —- | M] (Microsoft Corporation) MD5=AA08B68EF4E35EFA170CF85A44B23B70 – C:\Windows\winsxs\wow64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_8.0.7600.16722_none_19f825cc72ab89e4\iexplore.exe
[2011/02/24 00:45:11 | 000,673,040 | —- | M] (Microsoft Corporation) MD5=AB2BB40A5FE49AD236791AC22BD08869 – C:\Windows\winsxs\wow64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_8.0.7600.20908_none_1a9d66118bb386fd\iexplore.exe
[2011/02/24 01:29:19 | 000,696,592 | —- | M] (Microsoft Corporation) MD5=B4881B8F6EDB48CABD44BCC9FB5475C4 – C:\Windows\winsxs\amd64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_8.0.7600.20908_none_1048bbbf5752c502\iexplore.exe
[2010/11/20 07:22:51 | 000,673,040 | —- | M] (Microsoft Corporation) MD5=C613E69C3B191BB02C7A191741A1D024 – C:\Windows\SoftwareDistribution\Download\488053cdbca3231eeb2c2af7236d09ed\wow64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_8.0.7601.17514_none_1beb53526fc80c8d\iexplore.exe
[2011/02/24 00:32:52 | 000,673,040 | —- | M] (Microsoft Corporation) MD5=C6697A46554E36541E81182B258A19D6 – C:\Windows\winsxs\wow64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_8.0.7600.16766_none_19d0e74472c85f04\iexplore.exe
[2011/04/22 15:16:25 | 000,696,592 | —- | M] (Microsoft Corporation) MD5=D6F57A9ECB4606076FB9519D1698FCBA – C:\Program Files\Internet Explorer\iexplore.exe
[2011/04/22 15:16:25 | 000,696,592 | —- | M] (Microsoft Corporation) MD5=D6F57A9ECB4606076FB9519D1698FCBA – C:\Windows\winsxs\amd64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_8.0.7600.16800_none_0fb71ca43e3c5a80\iexplore.exe
[2010/11/04 01:37:41 | 000,696,592 | —- | M] (Microsoft Corporation) MD5=D8E00EA671A1EFE95C69C7566C505AD4 – C:\Windows\winsxs\amd64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_8.0.7600.16700_none_0fb71abe3e3c5d59\iexplore.exe
[2011/02/24 01:32:09 | 000,696,592 | —- | M] (Microsoft Corporation) MD5=E1BBDE0F187194D4B08335234A4B9FC7 – C:\Windows\winsxs\amd64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_8.0.7600.16766_none_0f7c3cf23e679d09\iexplore.exe
[2010/11/04 01:42:22 | 000,696,592 | —- | M] (Microsoft Corporation) MD5=E220FB009F54AAF649C6A278A5156764 – C:\Windows\winsxs\amd64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_8.0.7600.20831_none_1021480f57716a4d\iexplore.exe
[2009/07/13 20:43:43 | 000,696,600 | —- | M] (Microsoft Corporation) MD5=F2B0D41E1D08D0B2006DF5AA2E74C81E – C:\Windows\winsxs\amd64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_8.0.7600.16385_none_0f6595383e78c6f8\iexplore.exe
[2011/04/22 14:11:29 | 000,673,040 | —- | M] (Microsoft Corporation) MD5=F94877A94996B3C12BB31AD722840457 – C:\Windows\winsxs\wow64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_8.0.7600.20949_none_1a7326ab8bd31018\iexplore.exe

< MD5 for: IEXPLORE.EXE.MUI >
[2009/07/13 21:29:20 | 000,005,120 | —- | M] (Microsoft Corporation) MD5=C29BCFB504E33FEADDFA2D0183CEF62F – C:\Program Files\Internet Explorer\en-US\iexplore.exe.mui
[2009/07/13 21:29:20 | 000,005,120 | —- | M] (Microsoft Corporation) MD5=C29BCFB504E33FEADDFA2D0183CEF62F – C:\Windows\winsxs\amd64_microsoft-windows-i..-optional.resources_31bf3856ad364e35_8.0.7600.16385_en-us_09122aaf762607df\iexplore.exe.mui
[2009/07/13 21:29:20 | 000,005,120 | —- | M] (Microsoft Corporation) MD5=C29BCFB504E33FEADDFA2D0183CEF62F – C:\Windows\winsxs\amd64_microsoft-windows-i..-optional.resources_31bf3856ad364e35_8.0.7601.17514_en-us_0b433e7773148b79\iexplore.exe.mui
[2009/07/13 21:05:06 | 000,005,120 | —- | M] (Microsoft Corporation) MD5=FBA4CD95930248053A2C3F43CA70B986 – C:\Program Files (x86)\Internet Explorer\en-US\iexplore.exe.mui
[2009/07/13 21:05:06 | 000,005,120 | —- | M] (Microsoft Corporation) MD5=FBA4CD95930248053A2C3F43CA70B986 – C:\Windows\winsxs\wow64_microsoft-windows-i..-optional.resources_31bf3856ad364e35_8.0.7600.16385_en-us_1366d501aa86c9da\iexplore.exe.mui
[2009/07/13 21:05:06 | 000,005,120 | —- | M] (Microsoft Corporation) MD5=FBA4CD95930248053A2C3F43CA70B986 – C:\Windows\winsxs\wow64_microsoft-windows-i..-optional.resources_31bf3856ad364e35_8.0.7601.17514_en-us_1597e8c9a7754d74\iexplore.exe.mui

< MD5 for: WINLOGON.ADML >
[2009/07/13 21:25:22 | 000,008,013 | —- | M] () MD5=CED0EAD8D152B3D0F114698DE2316C5E – C:\Windows\winsxs\amd64_microsoft-windows-winlogon-adm.resources_31bf3856ad364e35_6.1.7600.16385_en-us_f0f9032ef6930070\WinLogon.adml

< MD5 for: WINLOGON.ADMX >
[2009/06/10 16:04:41 | 000,005,237 | —- | M] () MD5=89D8F50E186A16C2CED3CF36DBBC0B2C – C:\Windows\winsxs\amd64_microsoft-windows-winlogon-adm_31bf3856ad364e35_6.1.7600.16385_none_d7024e6992f3424d\WinLogon.admx

< MD5 for: WINLOGON.EXE >
[2010/11/20 08:25:30 | 000,390,656 | —- | M] (Microsoft Corporation) MD5=1151B1BAA6F350B1DB6598E0FEA7C457 – C:\Windows\SoftwareDistribution\Download\488053cdbca3231eeb2c2af7236d09ed\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7601.17514_none_cde90685eb910636\winlogon.exe
[2009/07/13 20:39:52 | 000,389,120 | —- | M] (Microsoft Corporation) MD5=132328DF455B0028F13BF0ABEE51A63A – C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16385_none_cbb7f2bdeea2829c\winlogon.exe
[2010/04/29 21:56:58 | 000,389,632 | —- | M] (Microsoft Corporation) MD5=A93D41A4D4B0D91C072D11DD8AF266DE – C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.20560_none_cc522fd507b468f8\winlogon.exe
[2010/04/29 21:56:58 | 000,389,632 | —- | M] (Microsoft Corporation) MD5=DA3E2A6FA9660CC75B471530CE88453A – C:\windows\SysNative\winlogon.exe
[2010/04/29 21:56:58 | 000,389,632 | —- | M] (Microsoft Corporation) MD5=DA3E2A6FA9660CC75B471530CE88453A – C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16447_none_cbe534e7ee8042ad\winlogon.exe

< MD5 for: WINLOGON.EXE.MUI >
[2010/11/20 08:00:25 | 000,023,040 | —- | M] (Microsoft Corporation) MD5=34C7D2E30868EDAFB191341D963ABA5F – C:\Windows\SoftwareDistribution\Download\488053cdbca3231eeb2c2af7236d09ed\amd64_microsoft-windows-winlogon.resources_31bf3856ad364e35_6.1.7601.17514_en-us_291e96fa1ab5fc7b\winlogon.exe.mui
[2009/07/13 21:29:52 | 000,022,528 | —- | M] (Microsoft Corporation) MD5=56D03B64B8C483C1D12A8E4577B3B332 – C:\windows\SysNative\en-US\winlogon.exe.mui
[2009/07/13 21:29:52 | 000,022,528 | —- | M] (Microsoft Corporation) MD5=56D03B64B8C483C1D12A8E4577B3B332 – C:\Windows\winsxs\amd64_microsoft-windows-winlogon.resources_31bf3856ad364e35_6.1.7600.16385_en-us_26ed83321dc778e1\winlogon.exe.mui

< MD5 for: WINLOGON.MFL >
[2009/07/13 21:27:22 | 000,001,080 | —- | M] () MD5=2783ED50691284F7EAE6BE9729337E1A – C:\windows\SysNative\wbem\en-US\winlogon.mfl
[2009/07/13 21:27:22 | 000,001,080 | —- | M] () MD5=2783ED50691284F7EAE6BE9729337E1A – C:\Windows\winsxs\amd64_microsoft-windows-winlogon-mof.resources_31bf3856ad364e35_6.1.7600.16385_en-us_84afd4fd38ffd276\winlogon.mfl

< MD5 for: WINLOGON.MOF >
[2009/07/13 15:30:01 | 000,003,192 | —- | M] () MD5=DF722B96F32A61783BC310FACF10240B – C:\windows\SysNative\wbem\winlogon.mof
[2009/07/13 15:30:01 | 000,003,192 | —- | M] () MD5=DF722B96F32A61783BC310FACF10240B – C:\Windows\winsxs\amd64_microsoft-windows-winlogon-mof_31bf3856ad364e35_6.1.7600.16385_none_dc2dbb778f98e40f\winlogon.mof

========== Alternate Data Streams ==========

@Alternate Data Stream - 95 bytes -> C:\ProgramData\Temp:5C321E34

< End of report >OTL Extras logfile created on: 7/18/2011 7:34:14 PM - Run 1
OTL by OldTimer - Version 3.2.26.1 Folder = C:\Users\J Browne\Downloads
64bit- Home Premium Edition (Version = 6.1.7600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7600.16385)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

3.93 Gb Total Physical Memory | 2.25 Gb Available Physical Memory | 57.26% Memory free
7.87 Gb Paging File | 5.61 Gb Available in Paging File | 71.27% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 187.69 Gb Total Space | 150.02 Gb Free Space | 79.93% Space Free | Partition Type: NTFS
Drive D: | 30.25 Gb Total Space | 29.51 Gb Free Space | 97.58% Space Free | Partition Type: NTFS

Computer Name: JBROWNE-PC | User Name: J Browne | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========

========== File Associations ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]
.url[@ = InternetShortcut] – C:\windows\SysNative\rundll32.exe (Microsoft Corporation)

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]
.cpl [@ = cplfile] – C:\windows\SysWow64\control.exe (Microsoft Corporation)

[HKEY_CURRENT_USER\SOFTWARE\Classes\]
.html [@ = FirefoxHTML] – C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation)

========== Shell Spawning ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\shell\[command]\command]
batfile [open] – "%1" %* File not found
cmdfile [open] – "%1" %* File not found
comfile [open] – "%1" %* File not found
exefile [open] – "%1" %* File not found
helpfile [open] – Reg Error: Key error.
inffile [install] – %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
InternetShortcut [open] – "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l (Microsoft Corporation)
InternetShortcut [print] – "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)
piffile [open] – "%1" %* File not found
regfile [merge] – Reg Error: Key error.
scrfile [config] – "%1" File not found
scrfile [install] – rundll32.exe desk.cpl,InstallScreenSaver %l File not found
scrfile [open] – "%1" /S File not found
txtfile – Reg Error: Key error.
Unknown [openas] – %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1 File not found
Directory [cmd] – cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] – Reg Error: Value error.
Drive [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\shell\[command]\command]
batfile [open] – "%1" %*
cmdfile [open] – "%1" %*
comfile [open] – "%1" %*
cplfile [cplopen] – %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] – "%1" %*
helpfile [open] – Reg Error: Key error.
inffile [install] – %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] – "%1" %*
regfile [merge] – Reg Error: Key error.
scrfile [config] – "%1"
scrfile [install] – rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] – "%1" /S
txtfile – Reg Error: Key error.
Unknown [openas] – %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] – cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] – Reg Error: Value error.
Drive [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = 28 4D B2 76 41 04 CA 01 [binary data]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 0

========== Authorized Applications List ==========

========== HKEY_LOCAL_MACHINE Uninstall List ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{071c9b48-7c32-4621-a0ac-3f809523288f}" = Microsoft Visual C++ 2005 Redistributable (x64)
"{46F4D124-20E5-4D12-BE52-EC177A7A4B42}" = Lenovo OneKey Recovery
"{49F3D04B-B849-4C89-AB31-2366A004EA28}" = Broadcom Gigabit Integrated Controller
"{90120000-002A-0000-1000-0000000FF1CE}" = Microsoft Office Office 64-bit Components 2007
"{90120000-002A-0409-1000-0000000FF1CE}" = Microsoft Office Shared 64-bit MUI (English) 2007
"{90120000-0116-0409-1000-0000000FF1CE}" = Microsoft Office Shared 64-bit Setup Metadata MUI (English) 2007
"{9068B2BE-D93A-4C0A-861C-5E35E2C0E09E}" = Intel® Matrix Storage Manager
"{95120000-00B9-0409-1000-0000000FF1CE}" = Microsoft Application Error Reporting
"{9F72EF8B-AEC9-4CA5-B483-143980AFD6FD}" = ALPS Touch Pad Driver
"{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}" = Microsoft .NET Framework 4 Client Profile
"92F4CDC794E6E4E29DC063D292D1C94F6FA1EA1E" = Windows Driver Package - Lenovo (ACPIVPC) System (05/19/2009 4.4.0.1)
"CNXT_AUDIO_HDA" = Conexant HD Audio
"HDMI" = Intel® Graphics Media Accelerator Driver
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"PC-Doctor for Windows" = PC-Doctor for Windows

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{17542DBF-E17C-4562-BC4D-FA3EF3076C45}" = Lenovo ReadyComm 5
"{178832DE-9DE0-4C87-9F82-9315A9B03985}" = Windows Live Writer
"{205C6BDD-7B73-42DE-8505-9A093F35A238}" = Windows Live Upload Tool
"{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}" = MSVCRT
"{2FDBBCEA-62DB-45F4-B6E5-0E1FB2A1F29D}" = Visual C++ 8.0 Runtime Setup Package (x64)
"{3B4E636E-9D65-4D67-BA61-189800823F52}" = Windows Live Communications Platform
"{3D5044A5-97B8-45C0-B956-BB2376569188}" = Windows Live Movie Maker
"{40BF1E83-20EB-11D8-97C5-0009C5020658}" = Power2Go
"{45338B07-A236-4270-9A77-EBB4115517B5}" = Windows Live Sign-in Assistant
"{4BB1DCED-84D3-47F9-B718-5947E904593E}" = Lenovo EasyCamera
"{6412CECE-8172-4BE5-935B-6CECACD2CA87}" = Windows Live Mail
"{76C66170-C538-4E77-B54D-48E136B5B533}" = Lenovo ReadyComm 5.0 Service
"{7C3C895B-AE02-4F30-8A6A-051D37A38DD0}" = Final Draft
"{81128EE8-8EAD-4DB0-85C6-17C2CE50FF71}" = Windows Live Essentials
"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
"{84EBDF39-4B33-49D7-A0BD-EB6E2C4E81C1}" = Windows Live Sync
"{8991E763-21F5-4DEA-A938-5D9D77DCB488}" = Broadcom 802.11 Wireless Driver
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8A74E887-8F0F-4017-AF53-CBA42211AAA5}" = Microsoft Sync Framework Runtime Native v1.0 (x86)
"{90120000-0016-0409-0000-0000000FF1CE}" = Microsoft Office Excel MUI (English) 2007
"{90120000-0018-0409-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (English) 2007
"{90120000-001B-0409-0000-0000000FF1CE}" = Microsoft Office Word MUI (English) 2007
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-0C0A-0000-0000000FF1CE}" = Microsoft Office Proof (Spanish) 2007
"{90120000-002C-0409-0000-0000000FF1CE}" = Microsoft Office Proofing (English) 2007
"{90120000-006E-0409-0000-0000000FF1CE}" = Microsoft Office Shared MUI (English) 2007
"{90120000-00A1-0409-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (English) 2007
"{90120000-0115-0409-0000-0000000FF1CE}" = Microsoft Office Shared Setup Metadata MUI (English) 2007
"{91120000-002F-0000-0000-0000000FF1CE}" = Microsoft Office Home and Student 2007
"{95140000-0070-0000-0000-0000000FF1CE}" = Microsoft Office 2010
"{96AE7E41-E34E-47D0-AC07-1091A8127911}" = Realtek USB 2.0 Card Reader
"{995F1E2E-F542-4310-8E1D-9926F5A279B3}" = Windows Live Toolbar
"{9C9CEB9D-53FD-49A7-85D2-FE674F72F24E}" = Microsoft Search Enhancement Pack
"{9FFC4E8E-2E8F-4030-A5E4-27EC4A269F32}" = Lenovo Smile Dock
"{A85FD55B-891B-4314-97A5-EA96C0BD80B5}" = Windows Live Messenger
"{AC76BA86-7AD7-1033-7B44-A92000000001}" = Adobe Reader 9.2
"{AE1E24C2-E720-42D5-B8E1-48F71A97B4DB}" = Energy Management
"{B194272D-1F92-46DF-99EB-8D5CE91CB4EC}" = Adobe AIR
"{B4092C6D-E886-4CB2-BA68-FE5A88D31DE6}_is1" = Spybot - Search & Destroy
"{BD64AF4A-8C80-4152-AD77-FCDDF05208AB}" = Microsoft Sync Framework Services Native v1.0 (x86)
"{D6C75F0B-3BC1-4FC9-B8C5-3F7E8ED059CA}" = Windows Live Photo Gallery
"{E2883E8F-472F-4fb0-9522-AC9BF37916A7}" = Adobe Download Manager
"{E2DFE069-083E-4631-9B6C-43C48E991DE5}" = Junk Mail filter update
"{E50FC5DB-7CBD-407D-A46E-0C13E45BC386}" = Oasis2Service 1.0
"{E59113EB-0285-4BFD-A37A-B79EAC6B8F4B}" = Microsoft SQL Server Compact 3.5 SP1 English
"{E7C97E98-4C2D-BEAF-5D2F-CC45A2F95D90}" = Acrobat.com
"{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}" = Microsoft SQL Server 2005 Compact Edition [ENU]
"{F0E12BBA-AD66-4022-A453-A1C8A0C4D570}" = Microsoft Choice Guard
"{F6BD194C-4190-4D73-B1B1-C48C99921BFE}" = Windows Live Call
"{FAA7F8FF-3C05-4A61-8F14-D8A6E9ED6623}" = ooVoo
"Adobe AIR" = Adobe AIR
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"AVG9Uninstall" = AVG Free 9.0
"com.adobe.mauby.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1" = Acrobat.com
"EasyCapture4.0" = EasyCapture
"HOMESTUDENTR" = Microsoft Office Home and Student 2007
"ID Vault" = ID Vault
"InstallShield_{46F4D124-20E5-4D12-BE52-EC177A7A4B42}" = Lenovo OneKey Recovery
"Lenovo Smile Dock" = Lenovo Smile Dock
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware version 1.51.1.1800
"Mozilla Firefox 5.0 (x86 en-US)" = Mozilla Firefox 5.0 (x86 en-US)
"SpywareBlaster_is1" = SpywareBlaster 4.4
"VeriFace" = VeriFace
"WinLiveSuite_Wave3" = Windows Live Essentials
"ZoneAlarm" = ZoneAlarm

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 6/4/2011 5:42:23 PM | Computer Name = JBrowne-PC | Source = SideBySide | ID = 16842815
Description = Activation context generation failed for "c:\program files (x86)\spybot
- search & destroy\DelZip179.dll".Error in manifest or policy file "c:\program
files (x86)\spybot - search & destroy\DelZip179.dll" on line 8. The value "*" of
attribute "language" in element "assemblyIdentity" is invalid.

Error - 6/4/2011 6:06:27 PM | Computer Name = JBrowne-PC | Source = SideBySide | ID = 16842787
Description = Activation context generation failed for "c:\program files (x86)\windows
live\photo gallery\MovieMaker.Exe".Error in manifest or policy file "c:\program
files (x86)\windows live\photo gallery\WLMFDS.DLL" on line 8. Component identity
found in manifest does not match the identity of the component requested. Reference
is WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1". Definition
is WLMFDS,processorArchitecture="x86",type="win32",version="1.0.0.1". Please use
sxstrace.exe for detailed diagnosis.

Error - 6/4/2011 6:06:28 PM | Computer Name = JBrowne-PC | Source = SideBySide | ID = 16842815
Description = Activation context generation failed for "c:\program files (x86)\spybot
- search & destroy\DelZip179.dll".Error in manifest or policy file "c:\program
files (x86)\spybot - search & destroy\DelZip179.dll" on line 8. The value "*" of
attribute "language" in element "assemblyIdentity" is invalid.

Error - 6/4/2011 6:06:48 PM | Computer Name = JBrowne-PC | Source = SideBySide | ID = 16842811
Description = Activation context generation failed for "c:\program files (x86)\microsoft\search
enhancement pack\search helper\searchhelper.dll".Error in manifest or policy file
"c:\program files (x86)\microsoft\search enhancement pack\search helper\searchhelper.dll"
on line 2. Invalid Xml syntax.

Error - 6/9/2011 6:38:47 PM | Computer Name = JBrowne-PC | Source = Application Hang | ID = 1002
Description = The program CenterStage.exe version 2.0.201.1 stopped interacting
with Windows and was closed. To see if more information about the problem is available,
check the problem history in the Action Center control panel. Process ID: 13e8 Start
Time: 01cc26508e7fb845 Termination Time: 10 Application Path: C:\Program Files (x86)\DDNI\Lenovo
Smile Dock\CenterStage.exe Report Id: 2aed985c-92e9-11e0-ac79-88ae1d2dfbc6

Error - 6/11/2011 4:26:18 PM | Computer Name = JBrowne-PC | Source = SideBySide | ID = 16842787
Description = Activation context generation failed for "c:\program files (x86)\windows
live\photo gallery\MovieMaker.Exe".Error in manifest or policy file "c:\program
files (x86)\windows live\photo gallery\WLMFDS.DLL" on line 8. Component identity
found in manifest does not match the identity of the component requested. Reference
is WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1". Definition
is WLMFDS,processorArchitecture="x86",type="win32",version="1.0.0.1". Please use
sxstrace.exe for detailed diagnosis.

Error - 6/11/2011 4:26:26 PM | Computer Name = JBrowne-PC | Source = SideBySide | ID = 16842815
Description = Activation context generation failed for "c:\program files (x86)\spybot
- search & destroy\DelZip179.dll".Error in manifest or policy file "c:\program
files (x86)\spybot - search & destroy\DelZip179.dll" on line 8. The value "*" of
attribute "language" in element "assemblyIdentity" is invalid.

Error - 6/16/2011 5:19:11 PM | Computer Name = JBrowne-PC | Source = SideBySide | ID = 16842787
Description = Activation context generation failed for "c:\program files (x86)\windows
live\photo gallery\MovieMaker.Exe".Error in manifest or policy file "c:\program
files (x86)\windows live\photo gallery\WLMFDS.DLL" on line 8. Component identity
found in manifest does not match the identity of the component requested. Reference
is WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1". Definition
is WLMFDS,processorArchitecture="x86",type="win32",version="1.0.0.1". Please use
sxstrace.exe for detailed diagnosis.

Error - 6/16/2011 5:19:21 PM | Computer Name = JBrowne-PC | Source = SideBySide | ID = 16842815
Description = Activation context generation failed for "c:\program files (x86)\spybot
- search & destroy\DelZip179.dll".Error in manifest or policy file "c:\program
files (x86)\spybot - search & destroy\DelZip179.dll" on line 8. The value "*" of
attribute "language" in element "assemblyIdentity" is invalid.

Error - 6/16/2011 5:20:03 PM | Computer Name = JBrowne-PC | Source = SideBySide | ID = 16842811
Description = Activation context generation failed for "c:\program files (x86)\microsoft\search
enhancement pack\search helper\searchhelper.dll".Error in manifest or policy file
"c:\program files (x86)\microsoft\search enhancement pack\search helper\searchhelper.dll"
on line 2. Invalid Xml syntax.

[ System Events ]
Error - 6/27/2011 10:00:42 PM | Computer Name = JBrowne-PC | Source = bowser | ID = 8003
Description =

Error - 6/28/2011 8:07:35 PM | Computer Name = JBrowne-PC | Source = Service Control Manager | ID = 7000
Description = The ReadyComm.DirectRouter service failed to start due to the following
error: %%2

Error - 6/28/2011 10:05:53 PM | Computer Name = JBrowne-PC | Source = bowser | ID = 8003
Description =

Error - 6/28/2011 10:17:53 PM | Computer Name = JBrowne-PC | Source = bowser | ID = 8003
Description =

Error - 6/28/2011 10:29:52 PM | Computer Name = JBrowne-PC | Source = bowser | ID = 8003
Description =

Error - 6/28/2011 10:41:54 PM | Computer Name = JBrowne-PC | Source = bowser | ID = 8003
Description =

Error - 6/28/2011 10:53:56 PM | Computer Name = JBrowne-PC | Source = bowser | ID = 8003
Description =

Error - 6/28/2011 11:06:50 PM | Computer Name = JBrowne-PC | Source = bowser | ID = 8003
Description =

Error - 6/29/2011 8:30:17 PM | Computer Name = JBrowne-PC | Source = EventLog | ID = 6008
Description = The previous system shutdown at 7:28:28 PM on ?6/?29/?2011 was unexpected.

Error - 6/29/2011 8:30:41 PM | Computer Name = JBrowne-PC | Source = Service Control Manager | ID = 7000
Description = The ReadyComm.DirectRouter service failed to start due to the following
error: %%2

< End of report >

JenneyB

Post #6July 19, 2011, 12:52 AM UTC

I couldn't open the mbr.dat file, but here's the other aswMBR version 0.9.7.777 Copyright© 2011 AVAST Software Run date: 2011-07-18 19:48:18 —————————– 19:48:18.495 OS Version: Windows x64 6.1.7600 19:48:18.495 Number of processors: 2 586 0x170A 19:48:18.496 ComputerName: JBROWNE-PC UserName: J Browne 19:48:19.199 Initialize success 19:48:27.800 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1 19:48:27.804 Disk 0 Vendor: HITACHI_ PB2Z Size: 238475MB BusType: 3 19:48:27.821 Disk 0 MBR read successfully 19:48:27.825 Disk 0 MBR scan 19:48:27.829 Disk 0 Windows 7 default MBR code 19:48:27.834 Service scanning 19:48:28.867 Disk 0 trace - called modules: 19:48:28.898 ntoskrnl.exe CLASSPNP.SYS disk.sys iaStor.sys hal.dll 19:48:28.904 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0xfffffa8004bae790] 19:48:28.910 3 CLASSPNP.SYS[fffff8800140143f] -> nt!IofCallDriver -> \Device\Ide\IAAStorageDevice-1[0xfffffa80047b0050] 19:48:28.917 Scan finished successfully 19:49:46.953 Disk 0 MBR has been saved successfully to "C:\Users\J Browne\Desktop\MBR.dat" 19:49:46.955 The log file has been saved successfully to "C:\Users\J Browne\Desktop\aswMBR.txt"

JenneyB

Post #7July 19, 2011, 12:55 AM UTC

Sorry, I just saw your instructions for sending the mbr.dat I've attached it

Attachments:

📎MBR.zip

oldman960

Post #8July 19, 2011, 1:32 AM UTC last edited July 19, 2011, 1:33 AM UTC

Hi JenneyB,

I need some information on some unidentified files. We will use Virustotal Please submit these files for analysis

To submit a file to virustotal, please click on this link

VirusTotal

copy and paste the following into the upload a file box (or use the browse button)

C:\Users\J Browne\AppData\Roaming\FBB6.EE1

scroll down a bit and click "send file", wait for the results and post them in your next reply.

Please note that sometimes the scans take a few minutes. Please ensure that the scan has completed and the results are complete .

Next, Right click on OTL.exe and chose Run as Administrator to run it

Under the Custom Scans/Fixes box at the bottom, paste in the following
Do Not copy the word CODE
please note the fix starts with the :

:Services

:OTL
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 1
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = http=127.0.0.1:61131
FF - HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions\\{F800AB76-D5CD-41A0-92EC-8010BB7B89E7}: C:\Users\J Browne\AppData\Local\{F800AB76-D5CD-41A0-92EC-8010BB7B89E7}\ [2011/07/16 10:08:48 | 000,000,000 | —D | M]
O3:64bit: - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
[2011/07/16 10:08:48 | 000,000,000 | —D | M] (XULRunner) – C:\USERS\J BROWNE\APPDATA\LOCAL\{F800AB76-D5CD-41A0-92EC-8010BB7B89E7}

:Reg

:Files
C:\Users\J Browne\AppData\Local\Sqabe.dat
C:\Users\J Browne\AppData\Local\{F800AB76-D5CD-41A0-92EC-8010BB7B89E7}
C:\Users\J Browne\AppData\Local\Tmasewe.bin

:Commands
[purity]
[emptytemp]
[createrestorepoint]

Then click the Run Fix button at the top

Let the program run unhindered
Please save the resulting log to be posted in your next reply.

Please post the OTL fix log and the VirusTotal results.

How is the computer?

JenneyB

Post #9July 19, 2011, 1:45 AM UTC

The computer seems fine. Here is the information on one of them and I'll paste the other after the reboot FBB6.EE1 Submission date: 2011-07-19 01:33:36 (UTC) Current status: finished Result: 1/ 43 (2.3%) VT Community not reviewed Safety score: - Compact Print results Antivirus Version Last Update Result AhnLab-V3 2011.07.19.01 2011.07.19 - AntiVir 7.11.11.203 2011.07.18 - Antiy-AVL 2.0.3.7 2011.07.15 - Avast 4.8.1351.0 2011.07.18 - Avast5 5.0.677.0 2011.07.18 - AVG 10.0.0.1190 2011.07.18 - BitDefender 7.2 2011.07.19 - CAT-QuickHeal 11.00 2011.07.18 - ClamAV 0.97.0.0 2011.07.18 - Commtouch 5.3.2.6 2011.07.19 - Comodo 9429 2011.07.19 - DrWeb 5.0.2.03300 2011.07.19 - Emsisoft 5.1.0.8 2011.07.19 - eSafe 7.0.17.0 2011.07.18 - eTrust-Vet 36.1.8450 2011.07.18 - F-Prot 4.6.2.117 2011.07.18 - F-Secure 9.0.16440.0 2011.07.18 - Fortinet 4.2.257.0 2011.07.19 - GData 22 2011.07.19 - Ikarus T3.1.1.104.0 2011.07.19 - Jiangmin 13.0.900 2011.07.18 - K7AntiVirus 9.108.4919 2011.07.18 - Kaspersky 9.0.0.837 2011.07.19 - McAfee 5.400.0.1158 2011.07.19 BackDoor-EXI!conf McAfee-GW-Edition 2010.1D 2011.07.18 - Microsoft 1.7000 2011.07.18 - NOD32 6305 2011.07.19 - Norman 6.07.10 2011.07.18 - nProtect 2011-07-18.01 2011.07.18 - Panda 10.0.3.5 2011.07.18 - PCTools 8.0.0.5 2011.07.13 - Prevx 3.0 2011.07.19 - Rising 23.66.04.03 2011.07.15 - Sophos 4.67.0 2011.07.19 - SUPERAntiSpyware 4.40.0.1006 2011.07.19 - Symantec 20111.1.0.186 2011.07.19 - TheHacker 6.7.0.1.257 2011.07.18 - TrendMicro 9.200.0.1012 2011.07.18 - TrendMicro-HouseCall 9.200.0.1012 2011.07.19 - VBA32 3.12.16.4 2011.07.18 - VIPRE 9898 2011.07.19 - ViRobot 2011.7.18.4575 2011.07.18 - VirusBuster 14.0.129.0 2011.07.18 - Additional information MD5 : 36bdc4f6864755ec8e4244ce4ffc5e49 SHA1 : d4a5a60cbf41de8ea9e04f2743bbf85bf1546979 SHA256: a77eae0634d439126a053c14e36c9e10bd626a59ce3d0b2ed0620ed56a0278f4 VT Community This file has never been reviewed by any VT Community member. Be the first one to comment on it! VirusTotal Team

JenneyB

Post #10July 19, 2011, 1:50 AM UTC

All processes killed ========== SERVICES/DRIVERS ========== ========== OTL ========== HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyEnable|dword:0 /E : value set successfully! HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyServer| /E : value set successfully! File HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions\\{F800AB76-D5CD-41A0-92EC-8010BB7B89E7}: C:\Users\J Browne\AppData\Local\{F800AB76-D5CD-41A0-92EC-8010BB7B89E7}\ not found. 64bit-Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\Locked deleted successfully. Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\Locked deleted successfully. C:\USERS\J BROWNE\APPDATA\LOCAL\{F800AB76-D5CD-41A0-92EC-8010BB7B89E7}\chrome\content folder moved successfully. C:\USERS\J BROWNE\APPDATA\LOCAL\{F800AB76-D5CD-41A0-92EC-8010BB7B89E7}\chrome folder moved successfully. C:\USERS\J BROWNE\APPDATA\LOCAL\{F800AB76-D5CD-41A0-92EC-8010BB7B89E7} folder moved successfully. ========== REGISTRY ========== ========== FILES ========== C:\Users\J Browne\AppData\Local\Sqabe.dat moved successfully. File\Folder C:\Users\J Browne\AppData\Local\{F800AB76-D5CD-41A0-92EC-8010BB7B89E7} not found. C:\Users\J Browne\AppData\Local\Tmasewe.bin moved successfully. ========== COMMANDS ========== [EMPTYTEMP] User: All Users User: AppData User: Default ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes ->Flash cache emptied: 56504 bytes User: Default User ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes ->Flash cache emptied: 0 bytes User: J Browne ->Temp folder emptied: 20089275 bytes ->Temporary Internet Files folder emptied: 49170511 bytes ->FireFox cache emptied: 51759839 bytes ->Flash cache emptied: 110760 bytes User: Public %systemdrive% .tmp files removed: 0 bytes %systemroot% .tmp files removed: 0 bytes %systemroot%\System32 .tmp files removed: 0 bytes %systemroot%\System32 (64bit) .tmp files removed: 0 bytes %systemroot%\System32\drivers .tmp files removed: 0 bytes Windows Temp folder emptied: 13402805 bytes %systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 50534 bytes RecycleBin emptied: 783197 bytes Total Files Cleaned = 129.00 mb Restore point Set: OTL Restore Point OTL by OldTimer - Version 3.2.26.1 log created on 07182011_204248 Files\Folders moved on Reboot… C:\Users\J Browne\AppData\Local\Temp\FXSAPIDebugLogFile.txt moved successfully. C:\Users\J Browne\AppData\Local\Temp\~DF0BC90E832A3E60B3.TMP moved successfully. C:\Users\J Browne\AppData\Local\Mozilla\Firefox\Profiles\5sucg9yl.default\Cache\_CACHE_001_ moved successfully. C:\Users\J Browne\AppData\Local\Mozilla\Firefox\Profiles\5sucg9yl.default\Cache\_CACHE_002_ moved successfully. C:\Users\J Browne\AppData\Local\Mozilla\Firefox\Profiles\5sucg9yl.default\Cache\_CACHE_003_ moved successfully. C:\Users\J Browne\AppData\Local\Mozilla\Firefox\Profiles\5sucg9yl.default\Cache\_CACHE_MAP_ moved successfully. C:\Users\J Browne\AppData\Local\Mozilla\Firefox\Profiles\5sucg9yl.default\urlclassifier3.sqlite moved successfully. C:\Users\J Browne\AppData\Local\Mozilla\Firefox\Profiles\5sucg9yl.default\XUL.mfl moved successfully. File\Folder C:\windows\temp\ZLT02535.TMP not found! Registry entries deleted on Reboot…

oldman960

Post #11July 19, 2011, 2:17 AM UTC

Hi JenneyB, How's the computer? Please post the MBAM log from the scan that had the detections. It can be found by opening MBAM and clicking the Logs tab. Click on the log you want and click open. Please post it's contents. Thanks

JenneyB

Post #12July 19, 2011, 2:21 AM UTC

Hi, I'm not sure I know what you mean. I posted everything. thanks, Jenney

oldman960

Post #13July 19, 2011, 6:18 AM UTC

Hi JenneyB,

and downloaded Malwarebytes per instructions here. It found and got rid of 9 things.

You said you ran MBAM (Malwarebytes) prior to posting here. That is the log I'd like to see. Knowing what MBAM remived will provide clues as to whether it was that malware or something else that changed the proxy settings.

Thanks

JenneyB

Post #14July 19, 2011, 11:53 AM UTC

Hi, Here is that log: Malwarebytes' Anti-Malware 1.51.1.1800 www.malwarebytes.org Database version: 7175 Windows 6.1.7600 Internet Explorer 8.0.7600.16385 7/17/2011 11:48:15 AM mbam-log-2011-07-17 (11-48-15).txt Scan type: Quick scan Objects scanned: 168330 Time elapsed: 1 minute(s), 56 second(s) Memory Processes Infected: 1 Memory Modules Infected: 2 Registry Keys Infected: 0 Registry Values Infected: 3 Registry Data Items Infected: 1 Folders Infected: 0 Files Infected: 6 Memory Processes Infected: c:\Users\J Browne\AppData\Roaming\dwm.exe (Trojan.Agent) -> 4816 -> Unloaded process successfully. Memory Modules Infected: c:\Users\J Browne\AppData\Local\picmegrt.dll (Trojan.Hiloti) -> Delete on reboot. c:\Users\J Browne\AppData\Local\ujikadevipeji.dll (Trojan.Agent.U) -> Delete on reboot. Registry Keys Infected: (No malicious items detected) Registry Values Infected: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Ojogeyuvasaxoga (Trojan.Hiloti) -> Value: Ojogeyuvasaxoga -> Delete on reboot. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\Load (Trojan.Agent) -> Value: Load -> Delete on reboot. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Opihaseja (Trojan.Agent.U) -> Value: Opihaseja -> Delete on reboot. Registry Data Items Infected: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\Load (Trojan.Agent) -> Bad: (C:\Users\JBROWN~1\AppData\Local\Temp\csrss.exe) Good: () -> Quarantined and deleted successfully. Folders Infected: (No malicious items detected) Files Infected: c:\Users\J Browne\AppData\Local\picmegrt.dll (Trojan.Hiloti) -> Quarantined and deleted successfully. c:\Users\J Browne\AppData\Roaming\dwm.exe (Trojan.Agent) -> Quarantined and deleted successfully. c:\Users\J Browne\AppData\Local\Temp\csrss.exe (Trojan.Agent) -> Quarantined and deleted successfully. c:\Users\J Browne\local settings\picmegrt.dll (Trojan.Hiloti) -> Quarantined and deleted successfully. c:\Users\J Browne\local settings\application data\picmegrt.dll (Trojan.Hiloti) -> Quarantined and deleted successfully. c:\Users\J Browne\AppData\Local\ujikadevipeji.dll (Trojan.Agent.U) -> Quarantined and deleted successfully.

oldman960

Post #15July 20, 2011, 12:19 AM UTC last edited July 20, 2011, 12:21 AM UTC

Hi JenneyB,

Sorry about the delay, couldn't get on the forum until now.

Given what was in the MBAM log we should look deeper.

In order to run this next tool AVG will need to be uninstalled or the tool will not run. After you have ran the tool you can reinstall it or wait until we are finished. Should you decide to wait please do not access the internet except for downloading tools and posting in this forum.

You can get a new copy of AVG from AVG
You will need the 64bit version.

You could also consider these other free alternative, niether of which will interfer with the tool we are going to use and can be installed after AVG has been uninstalled.

Avast
Help and support can be found here Avast Forum

Microsoft Security Essentials
Support

Download ComboFix from one of these locations:

Link 1
Link 2

* IMPORTANT !!! Save ComboFix.exe to your Desktop

Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. Note: If you are having difficulty properly disabling your protective programs, or are unsure as to what programs need to be disabled, please refer to the information available through this link : How to Disable your Security Programs
Right click on ComboFix.exe, click Run as Administrator & follow the prompts.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.

Notes:

1.Do not mouse-click Combofix's window while it is running. That may cause it to stall.
2. ComboFix may reset a number of Internet Explorer's settings, including making I-E the default browser.
3. Combofix prevents autorun of ALL CD, floppy and USB devices to assist with malware removal & increase security. If this is an issue or makes it difficult for you – please tell your helper.
4. CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.

Please post back with the combofix log.

Thanks

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

Can't Connect to Internet

✨ Ask AI

Ask AI