dumbredirectvir
Topic Starter
My wife noticed when she clicked on things it went to other websites. Microsoft Security Essentials didn't notice anything. I ran Kapersky and it found some stuff that appears to have been installed about the same time but it didn't solve the redirect issue. I ran Housecall, Spybot S&D;, Malwarebytes, maybe some others I need to uninstall first and others that were just to try to see what was going on, and nothing found the actual files.
I reinstalled Firefox from 4 to 6 but the issue stuck around.
I ran Kapersky from safe mode, no luck.
I looked at some other forums and they all had the cut and paste OTL/OTS instructions and I wasn't sure how to modify them to work on my machine.
So now I'm taking my hands off and posting to see if I can get any help before I make a mess if I haven't already, I was really hoping one of those products could fix it. Malwarebytes trial is running as a service.
Here is what I got from OTL. Thank you for your help!
OTL logfile created on: 8/16/2011 11:02:18 PM - Run 1
OTL by OldTimer - Version 3.2.26.5 Folder = C:UsersMorningwyndDownloads
64bit- Home Premium Edition (Version = 6.1.7600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7600.16385)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy
4.00 Gb Total Physical Memory | 2.60 Gb Available Physical Memory | 64.90% Memory free
8.00 Gb Paging File | 6.35 Gb Available in Paging File | 79.35% Paging File free
Paging file location(s): ?:pagefile.sys [binary data]
%SystemDrive% = C: | %SystemRoot% = C:Windows | %ProgramFiles% = C:Program Files (x86)
Drive C: | 283.40 Gb Total Space | 169.09 Gb Free Space | 59.66% Space Free | Partition Type: NTFS
Computer Name: MORNINGWYND-PC | User Name: Morningwynd | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
========== Processes (SafeList) ==========
PRC - C:UsersMorningwyndDownloadsOTL.exe (OldTimer Tools)
PRC - C:Program Files (x86)Mozilla Firefoxfirefox.exe (Mozilla Corporation)
PRC - C:Program Files (x86)Malwarebytes' Anti-Malwarembamgui.exe (Malwarebytes Corporation)
PRC - C:Program Files (x86)Malwarebytes' Anti-Malwarembamservice.exe (Malwarebytes Corporation)
PRC - C:WindowsSysWOW64MacromedFlashFlashUtil10p_ActiveX.exe (Adobe Systems, Inc.)
PRC - C:Program Files (x86)NVIDIA Corporation3D VisionnvSCPAPISvr.exe (NVIDIA Corporation)
PRC - C:Program Files (x86)CyberLinkPowerDVD DXPDVDDXSrv.exe (CyberLink Corp.)
PRC - C:Program Files (x86)SkypeToolbarsSharedSkypeNames2.exe (Skype Technologies S.A.)
PRC - C:Program Files (x86)RoxioRoxio BurnRoxioBurnLauncher.exe ()
PRC - C:Program FilesDellDellDockDockLogin.exe (Stardock Corporation)
PRC - C:Program Files (x86)IntelIntel Matrix Storage ManagerIAAnotif.exe (Intel Corporation)
PRC - C:Program Files (x86)IntelIntel Matrix Storage ManagerIAANTmon.exe (Intel Corporation)
========== Modules (No Company Name) ==========
MOD - C:WindowsSysWOW64MacromedFlashNPSWF32.dll ()
MOD - C:Program Files (x86)Mozilla Firefoxmozjs.dll ()
MOD - C:Program Files (x86)Common FilesAppleApple Application Supportzlib1.dll ()
MOD - C:Program Files (x86)RoxioRoxio BurnRoxioBurnLauncher.exe ()
========== Win32 Services (SafeList) ==========
SRV:64bit: - (NisSrv) – c:Program FilesMicrosoft Security ClientAntimalwareNisSrv.exe (Microsoft Corporation)
SRV:64bit: - (MsMpSvc) – c:Program FilesMicrosoft Security ClientAntimalwareMsMpEng.exe (Microsoft Corporation)
SRV:64bit: - (WinDefend) – C:Program FilesWindows DefenderMpSvc.dll (Microsoft Corporation)
SRV:64bit: - (DockLoginService) – C:Program FilesDellDellDockDockLogin.exe (Stardock Corporation)
SRV - (MBAMService) – C:Program Files (x86)Malwarebytes' Anti-Malwarembamservice.exe (Malwarebytes Corporation)
SRV - (Stereo Service) – C:Program Files (x86)NVIDIA Corporation3D VisionnvSCPAPISvr.exe (NVIDIA Corporation)
SRV - (clr_optimization_v4.0.30319_32) – C:WindowsMicrosoft.NETFrameworkv4.0.30319mscorsvw.exe (Microsoft Corporation)
SRV - (clr_optimization_v2.0.50727_32) – C:WindowsMicrosoft.NETFrameworkv2.0.50727mscorsvw.exe (Microsoft Corporation)
SRV - (IAANTMON) Intel® – C:Program Files (x86)IntelIntel Matrix Storage ManagerIAANTmon.exe (Intel Corporation)
========== Driver Services (SafeList) ==========
DRV:64bit: - (MBAMProtector) – C:WindowsSysNativedriversmbam.sys (Malwarebytes Corporation)
DRV:64bit: - (NisDrv) – C:WindowsSysNativedriversNisDrvWFP.sys (Microsoft Corporation)
DRV:64bit: - (amdsata) – C:WindowsSysNativedriversamdsata.sys (Advanced Micro Devices)
DRV:64bit: - (amdxata) – C:WindowsSysNativedriversamdxata.sys (Advanced Micro Devices)
DRV:64bit: - (USBAAPL64) – C:WindowsSysNativedriversusbaapl64.sys (Apple, Inc.)
DRV:64bit: - (NVHDA) – C:WindowsSysNativedriversnvhda64v.sys (NVIDIA Corporation)
DRV:64bit: - (RTL8167) – C:WindowsSysNativedriversRt64win7.sys (Realtek )
DRV:64bit: - (amdsbs) – C:WindowsSysNativedriversamdsbs.sys (AMD Technologies Inc.)
DRV:64bit: - (LSI_SAS2) – C:WindowsSysNativedriverslsi_sas2.sys (LSI Corporation)
DRV:64bit: - (HpSAMD) – C:WindowsSysNativedriversHpSAMD.sys (Hewlett-Packard Company)
DRV:64bit: - (stexstor) – C:WindowsSysNativedriversstexstor.sys (Promise Technology)
DRV:64bit: - (PxHlpa64) – C:WindowsSysNativedriversPxHlpa64.sys (Sonic Solutions)
DRV:64bit: - (igfx) – C:WindowsSysNativedriversigdkmd64.sys (Intel Corporation)
DRV:64bit: - (ebdrv) – C:WindowsSysNativedriversevbda.sys (Broadcom Corporation)
DRV:64bit: - (b06bdrv) – C:WindowsSysNativedriversbxvbda.sys (Broadcom Corporation)
DRV:64bit: - (b57nd60a) – C:WindowsSysNativedriversb57nd60a.sys (Broadcom Corporation)
DRV:64bit: - (hcw85cir) – C:WindowsSysNativedrivershcw85cir.sys (Hauppauge Computer Works, Inc.)
DRV:64bit: - (iaStor) – C:WindowsSysNativedriversiaStor.sys (Intel Corporation)
DRV:64bit: - (IntcHdmiAddService) Intel® – C:WindowsSysNativedriversIntcHdmi.sys (Intel® Corporation)
DRV:64bit: - (GEARAspiWDM) – C:WindowsSysNativedriversGEARAspiWDM.sys (GEAR Software Inc.)
DRV:64bit: - (Alpham1) – C:WindowsSysNativedriversAlpham164.sys (Ideazon Corporation)
DRV:64bit: - (Alpham2) – C:WindowsSysNativedriversAlpham264.sys (Ideazon Corporation)
DRV:64bit: - (WimFltr) – C:WindowsSysNativedriversWimFltr.sys (Microsoft Corporation)
DRV - (WIMMount) – C:WindowsSysWOW64driverswimmount.sys (Microsoft Corporation)
========== Standard Registry (SafeList) ==========
========== Internet Explorer ==========
IE - HKLMSOFTWAREMicrosoftInternet ExplorerMain,Local Page = C:WindowsSysWOW64blank.htm
IE - HKCUSOFTWAREMicrosoftInternet ExplorerMain,Default_Page_URL = http://g.msn.com/USCON/1
IE - HKCUSOFTWAREMicrosoftInternet ExplorerMain,Start Page = http://g.msn.com/USCON/1
IE - HKCUSoftwareMicrosoftWindowsCurrentVersionInternet Settings: "ProxyEnable" = 0
IE - HKCUSoftwareMicrosoftWindowsCurrentVersionInternet Settings: "ProxyOverride" = *.local
========== FireFox ==========
FF - prefs.js..browser.startup.homepage: "http://www.joyandtom.com"
FF - prefs.js..extensions.enabledItems: {9EB34849-81D3-4841-939D-666D522B889A}:1.5.1.119
FF - prefs.js..extensions.enabledItems: {c527ef3c-9e07-425a-bcde-f24bc1faf2b4}:1.0
FF - prefs.js..network.proxy.no_proxies_on: "localhost, 127.0.0.1/32"
FF - prefs.js..network.proxy.type: 1
FF:64bit: - [removed]/JavaPlugin: C:Program FilesJavajre7binnew_pluginnpjp2.dll (Oracle Corporation)
FF:64bit: - [removed]/GENUINE: disabled File not found
FF - [removed]/FlashPlayer: C:WindowsSysWOW64MacromedFlashNPSWF32.dll ()
FF - [removed]/iTunes,version=: File not found
FF - [removed]/iTunes,version=1.0: C:Program Files (x86)iTunesMozilla Pluginsnpitunes.dll ()
FF - [removed]/GENUINE: disabled File not found
FF - [removed]/NpCtrl,version=1.0: c:Program Files (x86)Microsoft Silverlight4.0.60531.0npctrl.dll ( Microsoft Corporation)
FF - [removed]/WLPG,version=14.0.8081.0709: C:Program Files (x86)Windows LivePhoto GalleryNPWLPG.dll (Microsoft Corporation)
FF - [removed]/3DVision: C:Program Files (x86)NVIDIA Corporation3D Visionnpnv3dv.dll (NVIDIA Corporation)
FF - [removed]/3DVisionStreaming: C:Program Files (x86)NVIDIA Corporation3D Visionnpnv3dvstreaming.dll (NVIDIA Corporation)
FF - [removed]/FBPlugin,version=1.0.3: C:UsersMorningwyndAppDataRoamingFacebooknpfbplugin_1_0_3.dll ( )
FF - [removed]/Google Update;version=3: C:UsersMorningwyndAppDataLocalGoogleUpdate1.3.21.65npGoogleUpdate3.dll (Google Inc.)
FF - [removed]/Google Update;version=9: C:UsersMorningwyndAppDataLocalGoogleUpdate1.3.21.65npGoogleUpdate3.dll (Google Inc.)
FF - HKEY_LOCAL_MACHINEsoftwaremozillaMozilla Firefox 6.0extensionsComponents: C:Program Files (x86)Mozilla Firefoxcomponents [2011/08/16 22:44:02 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINEsoftwaremozillaMozilla Firefox 6.0extensionsPlugins: C:Program Files (x86)Mozilla Firefoxplugins [2011/08/16 04:31:56 | 000,000,000 | —D | M]
[2010/04/30 17:19:48 | 000,000,000 | —D | M] (No name found) – C:UsersMorningwyndAppDataRoamingMozillaExtensions
[2011/08/15 23:43:13 | 000,000,000 | —D | M] (No name found) – C:UsersMorningwyndAppDataRoamingMozillaFirefoxProfiles7iccdgpp.defaulte
xtensions
[2011/06/10 19:26:06 | 000,000,000 | —D | M] (WebSlingPlayer) – C:UsersMorningwyndAppDataRoamingMozillaFirefoxProfiles7iccdgpp.defaulte
xtensions{9EB34849-81D3-4841-939D-666D522B889A}
[2011/07/26 21:31:07 | 000,000,000 | —D | M] (XUL Cache) – C:UsersMorningwyndAppDataRoamingMozillaFirefoxProfiles7iccdgpp.defaulte
xtensions{c527ef3c-9e07-425a-bcde-f24bc1faf2b4}
[2011/08/16 22:44:02 | 000,000,000 | —D | M] (No name found) – C:Program Files (x86)Mozilla Firefoxextensions
File not found (No name found) –
[2011/08/12 01:57:31 | 000,134,104 | —- | M] (Mozilla Foundation) – C:Program Files (x86)mozilla firefoxcomponentsbrowsercomps.dll
[2011/08/11 23:16:35 | 000,002,252 | —- | M] () – C:Program Files (x86)mozilla firefoxsearchpluginsbing.xml
Hosts file not found
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - No CLSID value found.
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.
O2 - BHO: (Skype add-on for Internet Explorer) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:Program Files (x86)SkypeToolbarsInternet Explorerskypeieplugin.dll (Skype Technologies S.A.)
O2 - BHO: (Java™ Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - File not found
O3:64bit: - HKLM..Toolbar: (no name) - Locked - No CLSID value found.
O3 - HKLM..Toolbar: (no name) - Locked - No CLSID value found.
O4:64bit: - HKLM..Run: [HotKeysCmds] C:WindowsSysNativehkcmd.exe (Intel Corporation)
O4:64bit: - HKLM..Run: [IAAnotif] C:Program Files (x86)IntelIntel Matrix Storage ManagerIAAnotif.exe (Intel Corporation)
O4:64bit: - HKLM..Run: [IgfxTray] C:WindowsSysNativeigfxtray.exe (Intel Corporation)
O4:64bit: - HKLM..Run: [MSC] c:Program FilesMicrosoft Security Clientmsseces.exe (Microsoft Corporation)
O4:64bit: - HKLM..Run: [Persistence] C:WindowsSysNativeigfxpers.exe (Intel Corporation)
O4 - HKLM..Run: [Desktop Disc Tool] c:Program Files (x86)RoxioRoxio BurnRoxioBurnLauncher.exe ()
O4 - HKLM..Run: [Malwarebytes' Anti-Malware] C:Program Files (x86)Malwarebytes' Anti-Malwarembamgui.exe (Malwarebytes Corporation)
O4 - HKLM..Run: [PDVDDXSrv] C:Program Files (x86)CyberLinkPowerDVD DXPDVDDXSrv.exe (CyberLink Corp.)
O4 - Startup: C:UsersMorningwyndAppDataRoamingMicrosoftWindowsStart MenuProgramsStartupDell Dock.lnk = File not found
O6 - HKLMSOFTWAREMicrosoftWindowsCurrentVersionpoliciesExplorer: NoActiveDesktop = 1
O6 - HKLMSOFTWAREMicrosoftWindowsCurrentVersionpoliciesExplorer: NoActiveDesktopChanges = 1
O6 - HKLMSOFTWAREMicrosoftWindowsCurrentVersionpoliciesSystem: ConsentPromptBehaviorAdmin = 5
O6 - HKLMSOFTWAREMicrosoftWindowsCurrentVersionpoliciesSystem: ConsentPromptBehaviorUser = 3
O9 - Extra Button: Skype add-on for Internet Explorer - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:Program Files (x86)SkypeToolbarsInternet Explorerskypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra 'Tools' menuitem : Skype add-on for Internet Explorer - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:Program Files (x86)SkypeToolbarsInternet Explorerskypeieplugin.dll (Skype Technologies S.A.)
O10:64bit: - NameSpace_Catalog5Catalog_Entries\000000000007 [] - C:Program Files (x86)BonjourmdnsNSP.dll (Apple Inc.)
O10 - NameSpace_Catalog5Catalog_Entries\000000000007 [] - C:Program Files (x86)BonjourmdnsNSP.dll (Apple Inc.)
O13 - gopher Prefix: missing
O13 - gopher Prefix: missing
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.7.0/jinstall-…indows-i586.cab (Java Plug-in 1.7.0)
O16 - DPF: {CAFEEFAC-0017-0000-0000-ABCDEFFEDCBA} http://java.sun.com/update/1.7.0/jinstall-…indows-i586.cab (Java Plug-in 1.7.0)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.7.0/jinstall-…indows-i586.cab (Java Plug-in 1.7.0)
O17 - HKLMSystemCCSServicesTcpipParameters: DhcpNameServer = 10.0.0.1
O18:64bit: - ProtocolHandlerlivecall {828030A1-22C1-4009-854F-8E305202313F} - Reg Error: Key error. File not found
O18:64bit: - ProtocolHandlermsnim {828030A1-22C1-4009-854F-8E305202313F} - Reg Error: Key error. File not found
O18:64bit: - ProtocolHandlerskype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - Reg Error: Key error. File not found
O18:64bit: - ProtocolHandlerskype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - Reg Error: Key error. File not found
O18:64bit: - ProtocolHandlerwlmailhtml {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - Reg Error: Key error. File not found
O18 - ProtocolHandlerskype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:Program Files (x86)Common FilesSkypeSkype4COM.dll (Skype Technologies)
O18 - ProtocolHandlerskype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:Program Files (x86)SkypeToolbarsInternet Explorerskypeieplugin.dll (Skype Technologies S.A.)
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:Windowsexplorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:Windowssystem32userinit.exe) - C:WindowsSysNativeuserinit.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:WindowsSysNativeSystemPropertiesPerformance.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:WindowsSysWow64explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:WindowsSysWow64userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O20:64bit: - WinlogonNotifyigfxcui: DllName - Reg Error: Key error. - C:WindowsSysNativeigfxdev.dll (Intel Corporation)
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found.
O32 - HKLM CDRom: AutoRun - 1
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35:64bit: - HKLM..comfile [open] – "%1" %*
O35:64bit: - HKLM..exefile [open] – "%1" %*
O35 - HKLM..comfile [open] – "%1" %*
O35 - HKLM..exefile [open] – "%1" %*
O37:64bit: - HKLM…com [@ = comfile] – "%1" %*
O37:64bit: - HKLM…exe [@ = exefile] – "%1" %*
O37 - HKLM…com [@ = comfile] – "%1" %*
O37 - HKLM…exe [@ = exefile] – "%1" %*
Drivers32:64bit: msacm.l3acm - C:WindowsSystem32l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.l3acm - C:WindowsSysWOW64l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: vidc.cvid - C:WindowsSysWow64iccvid.dll (Radius Inc.)
CREATERESTOREPOINT
Restore point Set: OTL Restore Point
========== Files/Folders - Created Within 30 Days ==========
[2011/08/16 20:13:21 | 000,000,000 | —D | C] – C:_OTS
[2011/08/16 08:31:54 | 000,000,000 | —D | C] – C:UsersMorningwyndAppDataRoamingMalwarebytes
[2011/08/16 08:31:33 | 000,041,272 | —- | C] (Malwarebytes Corporation) – C:WindowsSysWow64driversmbamswissarmy.sys
[2011/08/16 08:31:33 | 000,000,000 | —D | C] – C:ProgramDataMicrosoftWindowsStart MenuProgramsMalwarebytes' Anti-Malware
[2011/08/16 08:31:33 | 000,000,000 | —D | C] – C:ProgramDataMalwarebytes
[2011/08/16 08:31:30 | 000,025,912 | —- | C] (Malwarebytes Corporation) – C:WindowsSysNativedriversmbam.sys
[2011/08/16 08:31:29 | 000,000,000 | —D | C] – C:Program Files (x86)Malwarebytes' Anti-Malware
[2011/08/16 04:43:22 | 000,000,000 | —D | C] – C:ProgramDataKaspersky Lab
[2011/08/16 04:35:14 | 000,404,640 | —- | C] (Adobe Systems Incorporated) – C:WindowsSysWow64FlashPlayerCPLApp.cpl
[2011/08/16 00:11:46 | 000,000,000 | —D | C] – C:ProgramDataSpybot - Search & Destroy
[2011/08/16 00:11:46 | 000,000,000 | —D | C] – C:Program Files (x86)Spybot - Search & Destroy
[2011/08/15 23:48:02 | 000,000,000 | —D | C] – C:ProgramDataHitman Pro
[2011/08/15 23:37:16 | 000,000,000 | —D | C] – C:UsersMorningwyndAppDataRoamingMicrosoftWindowsStart MenuProgramsHiJackThis
[2011/08/15 23:37:15 | 000,000,000 | —D | C] – C:Program Files (x86)Trend Micro
[2011/08/15 23:34:01 | 000,000,000 | -HSD | C] – C:Config.Msi
[2011/08/15 23:20:52 | 000,627,600 | —- | C] (Oracle Corporation) – C:WindowsSysNativedeployJava1.dll
[2011/08/15 03:06:54 | 000,000,000 | —D | C] – C:Program Files (x86)Microsoft Security Client
[2011/08/14 18:41:08 | 000,199,680 | —- | C] (Microsoft Corporation) – C:WindowsSysNativexmllite.dll
[2011/08/14 18:41:07 | 000,319,488 | —- | C] (Microsoft Corporation) – C:WindowsSysWow64odbcjt32.dll
[2011/08/14 18:41:07 | 000,212,992 | —- | C] (Microsoft Corporation) – C:WindowsSysNativeodbctrac.dll
[2011/08/14 18:41:07 | 000,163,840 | —- | C] (Microsoft Corporation) – C:WindowsSysNativeodbccp32.dll
[2011/08/14 18:41:07 | 000,122,880 | —- | C] (Microsoft Corporation) – C:WindowsSysWow64odbccp32.dll
[2011/08/14 18:41:07 | 000,106,496 | —- | C] (Microsoft Corporation) – C:WindowsSysNativeodbccu32.dll
[2011/08/14 18:41:07 | 000,106,496 | —- | C] (Microsoft Corporation) – C:WindowsSysNativeodbccr32.dll
[2011/08/14 18:41:04 | 000,086,016 | —- | C] (Microsoft Corporation) – C:WindowsSysWow64odbccu32.dll
[2011/08/14 18:41:04 | 000,081,920 | —- | C] (Microsoft Corporation) – C:WindowsSysWow64odbccr32.dll
[2011/08/14 18:41:03 | 000,163,840 | —- | C] (Microsoft Corporation) – C:WindowsSysWow64odbctrac.dll
[2011/08/14 18:40:57 | 001,162,240 | —- | C] (Microsoft Corporation) – C:WindowsSysNativekernel32.dll
[2011/08/14 18:40:57 | 000,422,400 | —- | C] (Microsoft Corporation) – C:WindowsSysNativeKernelBase.dll
[2011/08/14 18:40:57 | 000,362,496 | —- | C] (Microsoft Corporation) – C:WindowsSysNativewow64win.dll
[2011/08/14 18:40:57 | 000,338,432 | —- | C] (Microsoft Corporation) – C:WindowsSysNativeconhost.exe
[2011/08/14 18:40:57 | 000,243,200 | —- | C] (Microsoft Corporation) – C:WindowsSysNativewow64.dll
[2011/08/14 18:40:57 | 000,214,528 | —- | C] (Microsoft Corporation) – C:WindowsSysNativewinsrv.dll
[2011/08/14 18:40:57 | 000,025,600 | —- | C] (Microsoft Corporation) – C:WindowsSysWow64setup16.exe
[2011/08/14 18:40:57 | 000,016,384 | —- | C] (Microsoft Corporation) – C:WindowsSysNativentvdm64.dll
[2011/08/14 18:40:57 | 000,014,336 | —- | C] (Microsoft Corporation) – C:WindowsSysWow64ntvdm64.dll
[2011/08/14 18:40:57 | 000,013,312 | —- | C] (Microsoft Corporation) – C:WindowsSysNativewow64cpu.dll
[2011/08/14 18:40:56 | 000,005,120 | —- | C] (Microsoft Corporation) – C:WindowsSysWow64wow32.dll
[2011/08/14 18:40:55 | 000,004,608 | -H– | C] (Microsoft Corporation) – C:WindowsSysWow64api-ms-win-core-processthreads-l1-1-0.dll
[2011/08/14 18:40:55 | 000,004,096 | -H– | C] (Microsoft Corporation) – C:WindowsSysWow64api-ms-win-core-sysinfo-l1-1-0.dll
[2011/08/14 18:40:55 | 000,004,096 | -H– | C] (Microsoft Corporation) – C:WindowsSysWow64api-ms-win-core-synch-l1-1-0.dll
[2011/08/14 18:40:55 | 000,004,096 | -H– | C] (Microsoft Corporation) – C:WindowsSysWow64api-ms-win-core-misc-l1-1-0.dll
[2011/08/14 18:40:55 | 000,004,096 | -H– | C] (Microsoft Corporation) – C:WindowsSysWow64api-ms-win-core-localregistry-l1-1-0.dll
[2011/08/14 18:40:55 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:WindowsSysWow64api-ms-win-core-processenvironment-l1-1-0.dll
[2011/08/14 18:40:55 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:WindowsSysWow64api-ms-win-core-namedpipe-l1-1-0.dll
[2011/08/14 18:40:55 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:WindowsSysWow64api-ms-win-core-memory-l1-1-0.dll
[2011/08/14 18:40:55 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:WindowsSysWow64api-ms-win-core-libraryloader-l1-1-0.dll
[2011/08/14 18:40:55 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:WindowsSysWow64api-ms-win-core-heap-l1-1-0.dll
[2011/08/14 18:40:55 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:WindowsSysWow64api-ms-win-core-string-l1-1-0.dll
[2011/08/14 18:40:55 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:WindowsSysNativeapi-ms-win-core-string-l1-1-0.dll
[2011/08/14 18:40:55 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:WindowsSysWow64api-ms-win-core-rtlsupport-l1-1-0.dll
[2011/08/14 18:40:55 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:WindowsSysWow64api-ms-win-core-profile-l1-1-0.dll
[2011/08/14 18:40:55 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:WindowsSysNativeapi-ms-win-core-profile-l1-1-0.dll
[2011/08/14 18:40:54 | 000,005,120 | -H– | C] (Microsoft Corporation) – C:WindowsSysWow64api-ms-win-core-file-l1-1-0.dll
[2011/08/14 18:40:54 | 000,004,608 | -H– | C] (Microsoft Corporation) – C:WindowsSysNativeapi-ms-win-core-threadpool-l1-1-0.dll
[2011/08/14 18:40:54 | 000,004,096 | -H– | C] (Microsoft Corporation) – C:WindowsSysNativeapi-ms-win-core-sysinfo-l1-1-0.dll
[2011/08/14 18:40:54 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:WindowsSysWow64api-ms-win-core-interlocked-l1-1-0.dll
[2011/08/14 18:40:54 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:WindowsSysNativeapi-ms-win-core-xstate-l1-1-0.dll
[2011/08/14 18:40:54 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:WindowsSysNativeapi-ms-win-core-util-l1-1-0.dll
[2011/08/14 18:40:54 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:WindowsSysWow64api-ms-win-core-io-l1-1-0.dll
[2011/08/14 18:40:54 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:WindowsSysWow64api-ms-win-core-handle-l1-1-0.dll
[2011/08/14 18:40:54 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:WindowsSysWow64api-ms-win-core-fibers-l1-1-0.dll
[2011/08/14 18:40:54 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:WindowsSysWow64api-ms-win-core-errorhandling-l1-1-0.dll
[2011/08/14 18:40:54 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:WindowsSysWow64api-ms-win-core-debug-l1-1-0.dll
[2011/08/14 18:40:54 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:WindowsSysNativeapi-ms-win-core-debug-l1-1-0.dll
[2011/08/14 18:40:54 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:WindowsSysWow64api-ms-win-core-datetime-l1-1-0.dll
[2011/08/14 18:40:54 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:WindowsSysNativeapi-ms-win-core-datetime-l1-1-0.dll
[2011/08/14 18:40:53 | 000,006,144 | -H– | C] (Microsoft Corporation) – C:WindowsSysWow64api-ms-win-security-base-l1-1-0.dll
[2011/08/14 18:40:53 | 000,006,144 | -H– | C] (Microsoft Corporation) – C:WindowsSysNativeapi-ms-win-security-base-l1-1-0.dll
[2011/08/14 18:40:53 | 000,005,120 | -H– | C] (Microsoft Corporation) – C:WindowsSysNativeapi-ms-win-core-file-l1-1-0.dll
[2011/08/14 18:40:53 | 000,004,608 | -H– | C] (Microsoft Corporation) – C:WindowsSysWow64api-ms-win-core-threadpool-l1-1-0.dll
[2011/08/14 18:40:53 | 000,004,608 | -H– | C] (Microsoft Corporation) – C:WindowsSysNativeapi-ms-win-core-processthreads-l1-1-0.dll
[2011/08/14 18:40:53 | 000,004,096 | -H– | C] (Microsoft Corporation) – C:WindowsSysNativeapi-ms-win-core-synch-l1-1-0.dll
[2011/08/14 18:40:53 | 000,004,096 | -H– | C] (Microsoft Corporation) – C:WindowsSysNativeapi-ms-win-core-localregistry-l1-1-0.dll
[2011/08/14 18:40:53 | 000,004,096 | -H– | C] (Microsoft Corporation) – C:WindowsSysWow64api-ms-win-core-localization-l1-1-0.dll
[2011/08/14 18:40:53 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:WindowsSysWow64api-ms-win-core-xstate-l1-1-0.dll
[2011/08/14 18:40:53 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:WindowsSysNativeapi-ms-win-core-rtlsupport-l1-1-0.dll
[2011/08/14 18:40:53 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:WindowsSysNativeapi-ms-win-core-processenvironment-l1-1-0.dll
[2011/08/14 18:40:53 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:WindowsSysNativeapi-ms-win-core-namedpipe-l1-1-0.dll
[2011/08/14 18:40:53 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:WindowsSysNativeapi-ms-win-core-misc-l1-1-0.dll
[2011/08/14 18:40:53 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:WindowsSysNativeapi-ms-win-core-memory-l1-1-0.dll
[2011/08/14 18:40:53 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:WindowsSysNativeapi-ms-win-core-libraryloader-l1-1-0.dll
[2011/08/14 18:40:53 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:WindowsSysNativeapi-ms-win-core-heap-l1-1-0.dll
[2011/08/14 18:40:53 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:WindowsSysWow64api-ms-win-core-util-l1-1-0.dll
[2011/08/14 18:40:53 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:WindowsSysNativeapi-ms-win-core-io-l1-1-0.dll
[2011/08/14 18:40:53 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:WindowsSysNativeapi-ms-win-core-interlocked-l1-1-0.dll
[2011/08/14 18:40:53 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:WindowsSysNativeapi-ms-win-core-handle-l1-1-0.dll
[2011/08/14 18:40:53 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:WindowsSysNativeapi-ms-win-core-fibers-l1-1-0.dll
[2011/08/14 18:40:53 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:WindowsSysNativeapi-ms-win-core-errorhandling-l1-1-0.dll
[2011/08/14 18:40:53 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:WindowsSysWow64api-ms-win-core-delayload-l1-1-0.dll
[2011/08/14 18:40:53 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:WindowsSysNativeapi-ms-win-core-delayload-l1-1-0.dll
[2011/08/14 18:40:52 | 000,007,680 | —- | C] (Microsoft Corporation) – C:WindowsSysWow64instnm.exe
[2011/08/14 18:40:52 | 000,004,096 | -H– | C] (Microsoft Corporation) – C:WindowsSysNativeapi-ms-win-core-localization-l1-1-0.dll
[2011/08/14 18:40:52 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:WindowsSysWow64api-ms-win-core-console-l1-1-0.dll
[2011/08/14 18:40:52 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:WindowsSysNativeapi-ms-win-core-console-l1-1-0.dll
[2011/08/14 18:40:52 | 000,002,048 | —- | C] (Microsoft Corporation) – C:WindowsSysWow64user.exe
[2011/08/14 18:40:42 | 000,703,488 | —- | C] (Microsoft Corporation) – C:WindowsSysNativemsfeeds.dll
[2011/08/14 18:40:41 | 000,256,000 | —- | C] (Microsoft Corporation) – C:WindowsSysNativeiepeers.dll
[2011/08/14 18:40:41 | 000,247,808 | —- | C] (Microsoft Corporation) – C:WindowsSysNativeieui.dll
[2011/08/14 18:40:41 | 000,176,640 | —- | C] (Microsoft Corporation) – C:WindowsSysWow64ieui.dll
[2011/08/14 18:40:41 | 000,134,144 | —- | C] (Microsoft Corporation) – C:WindowsSysNativeurl.dll
[2011/08/14 18:40:40 | 000,185,856 | —- | C] (Microsoft Corporation) – C:WindowsSysWow64iepeers.dll
[2011/08/14 18:40:40 | 000,132,096 | —- | C] (Microsoft Corporation) – C:WindowsSysWow64url.dll
[2011/08/14 18:40:40 | 000,097,280 | —- | C] (Microsoft Corporation) – C:WindowsSysNativemshtmled.dll
[2011/08/14 18:40:40 | 000,067,072 | —- | C] (Microsoft Corporation) – C:WindowsSysWow64mshtmled.dll
[2011/08/14 18:40:40 | 000,057,856 | —- | C] (Microsoft Corporation) – C:WindowsSysNativelicmgr10.dll
[2011/08/14 18:40:40 | 000,044,544 | —- | C] (Microsoft Corporation) – C:WindowsSysWow64licmgr10.dll
[2011/08/14 18:40:40 | 000,012,800 | —- | C] (Microsoft Corporation) – C:WindowsSysWow64msfeedssync.exe
[2011/08/14 18:40:40 | 000,012,288 | —- | C] (Microsoft Corporation) – C:WindowsSysNativemsfeedssync.exe
[2011/08/14 18:40:39 | 000,482,816 | —- | C] (Microsoft Corporation) – C:WindowsSysNativehtml.iec
[2011/08/14 18:40:39 | 000,386,048 | —- | C] (Microsoft Corporation) – C:WindowsSysWow64html.iec
[2011/08/14 18:40:38 | 005,507,968 | —- | C] (Microsoft Corporation) – C:WindowsSysNativentoskrnl.exe
[2011/08/14 18:40:37 | 003,957,120 | —- | C] (Microsoft Corporation) – C:WindowsSysWow64ntkrnlpa.exe
[2011/08/14 18:40:36 | 003,902,336 | —- | C] (Microsoft Corporation) – C:WindowsSysWow64ntoskrnl.exe
[2011/07/31 10:53:13 | 000,000,000 | —D | C] – C:Program Files (x86)Apple Software Update
[2010/04/30 17:19:15 | 008,656,832 | —- | C] (Dell, Inc. ) – C:UsersMorningwyndAppDataRoamingDataSafeDotNet.exe
========== Files - Modified Within 30 Days ==========
[2011/08/16 22:48:01 | 000,000,932 | —- | M] () – C:WindowstasksGoogleUpdateTaskUserS-1-5-21-153549276-194435143-977033974-1000UA.job
[2011/08/16 22:44:03 | 000,001,132 | —- | M] () – C:UsersPublicDesktopMozilla Firefox.lnk
[2011/08/16 21:57:45 | 000,014,240 | -H– | M] () – C:WindowsSysNative7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2011/08/16 21:57:45 | 000,014,240 | -H– | M] () – C:WindowsSysNative7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2011/08/16 21:54:41 | 000,729,688 | —- | M] () – C:WindowsSysNativePerfStringBackup.INI
[2011/08/16 21:54:41 | 000,626,040 | —- | M] () – C:WindowsSysNativeperfh009.dat
[2011/08/16 21:54:41 | 000,107,316 | —- | M] () – C:WindowsSysNativeperfc009.dat
[2011/08/16 21:50:27 | 000,067,584 | –S- | M] () – C:Windowsbootstat.dat
[2011/08/16 21:50:22 | 3220,426,752 | -HS- | M] () – C:hiberfil.sys
[2011/08/16 19:51:34 | 000,000,880 | —- | M] () – C:WindowstasksGoogleUpdateTaskUserS-1-5-21-153549276-194435143-977033974-1000Core.job
[2011/08/16 08:31:34 | 000,001,107 | —- | M] () – C:UsersPublicDesktopMalwarebytes' Anti-Malware.lnk
[2011/08/16 04:53:13 | 000,000,306 | -HS- | M] () – C:Windows3212110drv.spi
[2011/08/16 04:35:14 | 000,404,640 | —- | M] (Adobe Systems Incorporated) – C:WindowsSysWow64FlashPlayerCPLApp.cpl
[2011/08/16 00:03:12 | 000,791,655 | —- | M] () – C:UsersMorningwyndAppDataLocalcensus.cache
[2011/08/16 00:02:39 | 000,093,202 | —- | M] () – C:UsersMorningwyndAppDataLocalars.cache
[2011/08/15 23:57:16 | 000,000,036 | —- | M] () – C:UsersMorningwyndAppDataLocalhousecall.guid.cache
[2011/08/15 23:49:11 | 000,025,160 | —- | M] () – C:WindowsSysNativedrivershitmanpro35.sys
[2011/08/15 23:37:16 | 000,003,003 | —- | M] () – C:UsersMorningwyndDesktopHiJackThis.lnk
[2011/08/15 23:20:46 | 000,252,296 | —- | M] (Oracle Corporation) – C:WindowsSysNativejavaws.exe
[2011/08/15 23:20:46 | 000,188,808 | —- | M] (Oracle Corporation) – C:WindowsSysNativejavaw.exe
[2011/08/15 23:20:46 | 000,188,808 | —- | M] (Oracle Corporation) – C:WindowsSysNativejava.exe
[2011/08/15 23:20:45 | 000,627,600 | —- | M] (Oracle Corporation) – C:WindowsSysNativedeployJava1.dll
[2011/08/15 03:07:08 | 000,001,945 | —- | M] () – C:Windowsepplauncher.mif
[2011/08/15 03:06:55 | 000,743,066 | —- | M] () – C:WindowsSysWow64PerfStringBackup.INI
[2011/08/14 18:48:48 | 000,002,387 | —- | M] () – C:UsersMorningwyndDesktopGoogle Chrome.lnk
[2011/07/26 21:31:09 | 000,000,081 | —- | M] () – C:WindowsSysWow641055906881
========== Files Created - No Company Name ==========
[2011/08/16 22:44:03 | 000,001,144 | —- | C] () – C:ProgramDataMicrosoftWindowsStart MenuProgramsMozilla Firefox.lnk
[2011/08/16 22:44:03 | 000,001,132 | —- | C] () – C:UsersPublicDesktopMozilla Firefox.lnk
[2011/08/16 08:31:34 | 000,001,107 | —- | C] () – C:UsersPublicDesktopMalwarebytes' Anti-Malware.lnk
[2011/08/16 04:53:13 | 000,000,306 | -HS- | C] () – C:Windows3212110drv.spi
[2011/08/16 00:03:12 | 000,791,655 | —- | C] () – C:UsersMorningwyndAppDataLocalcensus.cache
[2011/08/16 00:02:39 | 000,093,202 | —- | C] () – C:UsersMorningwyndAppDataLocalars.cache
[2011/08/15 23:57:16 | 000,000,036 | —- | C] () – C:UsersMorningwyndAppDataLocalhousecall.guid.cache
[2011/08/15 23:49:11 | 000,025,160 | —- | C] () – C:WindowsSysNativedrivershitmanpro35.sys
[2011/08/15 23:37:16 | 000,003,003 | —- | C] () – C:UsersMorningwyndDesktopHiJackThis.lnk
[2011/07/26 21:31:07 | 000,000,081 | —- | C] () – C:WindowsSysWow641055906881
[2011/04/04 19:46:52 | 000,000,268 | —- | C] () – C:Windows{789289CA-F73A-4A16-A331-54D498CE069F}_WiseFW.ini
[2011/03/06 23:11:23 | 000,743,066 | —- | C] () – C:WindowsSysWow64PerfStringBackup.INI
[2010/09/06 16:53:47 | 000,000,410 | —- | C] () – C:WindowsBRWMARK.INI
[2010/09/06 16:53:47 | 000,000,034 | —- | C] () – C:WindowsSysWow64BD2070N.DAT
[2010/04/30 17:33:01 | 000,007,605 | —- | C] () – C:UsersMorningwyndAppDataLocalresmon.resmoncfg
[2010/04/27 23:00:03 | 000,982,220 | —- | C] () – C:WindowsSysWow64igkrng500.bin
[2010/04/27 23:00:03 | 000,134,592 | —- | C] () – C:WindowsSysWow64igfcg500.bin
[2010/04/27 23:00:03 | 000,092,216 | —- | C] () – C:WindowsSysWow64igfcg500m.bin
[2010/04/27 23:00:02 | 000,439,300 | —- | C] () – C:WindowsSysWow64igcompkrng500.bin
[2009/07/14 01:38:36 | 000,067,584 | –S- | C] () – C:Windowsbootstat.dat
[2009/07/13 22:35:51 | 000,000,741 | —- | C] () – C:WindowsSysWow64NOISE.DAT
[2009/07/13 22:34:42 | 000,215,943 | —- | C] () – C:WindowsSysWow64dssec.dat
[2009/07/13 20:10:29 | 000,043,131 | —- | C] () – C:Windowsmib.bin
[2009/07/13 19:42:10 | 000,064,000 | —- | C] () – C:WindowsSysWow64BWContextHandler.dll
[2009/07/13 17:03:59 | 000,364,544 | —- | C] () – C:WindowsSysWow64msjetoledb40.dll
[2009/06/10 17:26:10 | 000,673,088 | —- | C] () – C:WindowsSysWow64mlang.dat
========== LOP Check ==========
[2010/06/14 18:38:35 | 000,000,000 | —D | M] – C:UsersMorningwyndAppDataRoamingFacebook
[2011/06/10 19:26:10 | 000,000,000 | —D | M] – C:UsersMorningwyndAppDataRoamingSling Media
[2010/09/07 10:02:09 | 000,032,584 | —- | M] () – C:WindowsTasksSCHEDLGU.TXT
========== Purity Check ==========
========== Custom Scans ==========
< %SYSTEMDRIVE%*.* >
[2010/04/27 23:04:54 | 000,026,615 | RH– | M] () – C:dell.sdr
[2011/08/16 21:50:22 | 3220,426,752 | -HS- | M] () – C:hiberfil.sys
[2011/08/16 21:50:26 | 4293,902,336 | -HS- | M] () – C:pagefile.sys
< %systemroot%Fonts*.com >
[2009/07/14 01:32:31 | 000,026,040 | —- | M] () – C:WindowsFontsGlobalMonospace.CompositeFont
[2009/07/14 01:32:31 | 000,026,489 | —- | M] () – C:WindowsFontsGlobalSansSerif.CompositeFont
[2009/07/14 01:32:31 | 000,029,779 | —- | M] () – C:WindowsFontsGlobalSerif.CompositeFont
[2009/07/14 01:32:31 | 000,043,318 | —- | M] () – C:WindowsFontsGlobalUserInterface.CompositeFont
< %systemroot%Fonts*.dll >
< %systemroot%Fonts*.ini >
[2009/06/10 16:49:50 | 000,000,065 | —- | M] () – C:WindowsFontsdesktop.ini
< %systemroot%Fonts*.ini2 >
< %systemroot%Fonts*.exe >
< %systemroot%system32spoolprtprocsw32x86*.* >
< %systemroot%REPAIR*.bak1 >
< %systemroot%REPAIR*.ini >
< %systemroot%system32*.jpg >
< %systemroot%*.jpg >
< %systemroot%*.png >
< %systemroot%*.scr >
[2009/07/10 13:15:46 | 000,306,544 | —- | M] (Microsoft Corporation) – C:WindowsWLXPGSS.SCR
< %systemroot%*._sy >
< %APPDATA%AdobeUpdate*.* >
< %ALLUSERSPROFILE%Favorites*.* >
< %APPDATA%Microsoft*.* >
< %PROGRAMFILES%*.* >
[2009/07/14 00:54:24 | 000,000,174 | -HS- | M] () – C:Program Files (x86)desktop.ini
< %APPDATA%Update*.* >
< %systemroot%*. /mp /s >
< %systemroot%System32config*.sav >
< %PROGRAMFILES%bak. /s >
< %systemroot%system32bak. /s >
< %ALLUSERSPROFILE%Start Menu*.lnk /x >
< %systemroot%system32configsystemprofile*.dat /x >
< %systemroot%*.config >
< %systemroot%system32*.db >
< %PROGRAMFILES%Internet Explorer*.dat >
< %APPDATA%MicrosoftInternet ExplorerQuick Launch*.lnk /x >
[2010/04/30 17:15:54 | 000,000,221 | -HS- | M] () – C:UsersMorningwyndAppDataRoamingMicrosoftInternet ExplorerQuick Launchdesktop.ini
< %USERPROFILE%Desktop*.exe >
< %PROGRAMFILES%Common Files*.* >
< %systemroot%*.src >
< %systemroot%install*.* >
< %systemroot%system32DLL*.* >
< %systemroot%system32HelpFiles*.* >
< %systemroot%system32rundll*.* >
< %systemroot%winn32*.* >
< %systemroot%Java*.* >
< %systemroot%system32test*.* >
< %systemroot%system32Rundll32*.* >
< %systemroot%AppPatchCustom*.* >
< HKEY_LOCAL_MACHINESOFTWAREPoliciesMicrosoftWindowsWindowsUpdateAU >
< HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionWindowsUpdateAuto UpdateResultsInstall|LastSuccessTime /rs >
< End of report >
Another thing is it seems some people had their home page changed, It seems ours never did that. It does seem like it gave up on the fast answers site and now returns sites like local411, easymademortgage and many others.
I reinstalled Firefox from 4 to 6 but the issue stuck around.
I ran Kapersky from safe mode, no luck.
I looked at some other forums and they all had the cut and paste OTL/OTS instructions and I wasn't sure how to modify them to work on my machine.
So now I'm taking my hands off and posting to see if I can get any help before I make a mess if I haven't already, I was really hoping one of those products could fix it. Malwarebytes trial is running as a service.
Here is what I got from OTL. Thank you for your help!
OTL logfile created on: 8/16/2011 11:02:18 PM - Run 1
OTL by OldTimer - Version 3.2.26.5 Folder = C:UsersMorningwyndDownloads
64bit- Home Premium Edition (Version = 6.1.7600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7600.16385)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy
4.00 Gb Total Physical Memory | 2.60 Gb Available Physical Memory | 64.90% Memory free
8.00 Gb Paging File | 6.35 Gb Available in Paging File | 79.35% Paging File free
Paging file location(s): ?:pagefile.sys [binary data]
%SystemDrive% = C: | %SystemRoot% = C:Windows | %ProgramFiles% = C:Program Files (x86)
Drive C: | 283.40 Gb Total Space | 169.09 Gb Free Space | 59.66% Space Free | Partition Type: NTFS
Computer Name: MORNINGWYND-PC | User Name: Morningwynd | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
========== Processes (SafeList) ==========
PRC - C:UsersMorningwyndDownloadsOTL.exe (OldTimer Tools)
PRC - C:Program Files (x86)Mozilla Firefoxfirefox.exe (Mozilla Corporation)
PRC - C:Program Files (x86)Malwarebytes' Anti-Malwarembamgui.exe (Malwarebytes Corporation)
PRC - C:Program Files (x86)Malwarebytes' Anti-Malwarembamservice.exe (Malwarebytes Corporation)
PRC - C:WindowsSysWOW64MacromedFlashFlashUtil10p_ActiveX.exe (Adobe Systems, Inc.)
PRC - C:Program Files (x86)NVIDIA Corporation3D VisionnvSCPAPISvr.exe (NVIDIA Corporation)
PRC - C:Program Files (x86)CyberLinkPowerDVD DXPDVDDXSrv.exe (CyberLink Corp.)
PRC - C:Program Files (x86)SkypeToolbarsSharedSkypeNames2.exe (Skype Technologies S.A.)
PRC - C:Program Files (x86)RoxioRoxio BurnRoxioBurnLauncher.exe ()
PRC - C:Program FilesDellDellDockDockLogin.exe (Stardock Corporation)
PRC - C:Program Files (x86)IntelIntel Matrix Storage ManagerIAAnotif.exe (Intel Corporation)
PRC - C:Program Files (x86)IntelIntel Matrix Storage ManagerIAANTmon.exe (Intel Corporation)
========== Modules (No Company Name) ==========
MOD - C:WindowsSysWOW64MacromedFlashNPSWF32.dll ()
MOD - C:Program Files (x86)Mozilla Firefoxmozjs.dll ()
MOD - C:Program Files (x86)Common FilesAppleApple Application Supportzlib1.dll ()
MOD - C:Program Files (x86)RoxioRoxio BurnRoxioBurnLauncher.exe ()
========== Win32 Services (SafeList) ==========
SRV:64bit: - (NisSrv) – c:Program FilesMicrosoft Security ClientAntimalwareNisSrv.exe (Microsoft Corporation)
SRV:64bit: - (MsMpSvc) – c:Program FilesMicrosoft Security ClientAntimalwareMsMpEng.exe (Microsoft Corporation)
SRV:64bit: - (WinDefend) – C:Program FilesWindows DefenderMpSvc.dll (Microsoft Corporation)
SRV:64bit: - (DockLoginService) – C:Program FilesDellDellDockDockLogin.exe (Stardock Corporation)
SRV - (MBAMService) – C:Program Files (x86)Malwarebytes' Anti-Malwarembamservice.exe (Malwarebytes Corporation)
SRV - (Stereo Service) – C:Program Files (x86)NVIDIA Corporation3D VisionnvSCPAPISvr.exe (NVIDIA Corporation)
SRV - (clr_optimization_v4.0.30319_32) – C:WindowsMicrosoft.NETFrameworkv4.0.30319mscorsvw.exe (Microsoft Corporation)
SRV - (clr_optimization_v2.0.50727_32) – C:WindowsMicrosoft.NETFrameworkv2.0.50727mscorsvw.exe (Microsoft Corporation)
SRV - (IAANTMON) Intel® – C:Program Files (x86)IntelIntel Matrix Storage ManagerIAANTmon.exe (Intel Corporation)
========== Driver Services (SafeList) ==========
DRV:64bit: - (MBAMProtector) – C:WindowsSysNativedriversmbam.sys (Malwarebytes Corporation)
DRV:64bit: - (NisDrv) – C:WindowsSysNativedriversNisDrvWFP.sys (Microsoft Corporation)
DRV:64bit: - (amdsata) – C:WindowsSysNativedriversamdsata.sys (Advanced Micro Devices)
DRV:64bit: - (amdxata) – C:WindowsSysNativedriversamdxata.sys (Advanced Micro Devices)
DRV:64bit: - (USBAAPL64) – C:WindowsSysNativedriversusbaapl64.sys (Apple, Inc.)
DRV:64bit: - (NVHDA) – C:WindowsSysNativedriversnvhda64v.sys (NVIDIA Corporation)
DRV:64bit: - (RTL8167) – C:WindowsSysNativedriversRt64win7.sys (Realtek )
DRV:64bit: - (amdsbs) – C:WindowsSysNativedriversamdsbs.sys (AMD Technologies Inc.)
DRV:64bit: - (LSI_SAS2) – C:WindowsSysNativedriverslsi_sas2.sys (LSI Corporation)
DRV:64bit: - (HpSAMD) – C:WindowsSysNativedriversHpSAMD.sys (Hewlett-Packard Company)
DRV:64bit: - (stexstor) – C:WindowsSysNativedriversstexstor.sys (Promise Technology)
DRV:64bit: - (PxHlpa64) – C:WindowsSysNativedriversPxHlpa64.sys (Sonic Solutions)
DRV:64bit: - (igfx) – C:WindowsSysNativedriversigdkmd64.sys (Intel Corporation)
DRV:64bit: - (ebdrv) – C:WindowsSysNativedriversevbda.sys (Broadcom Corporation)
DRV:64bit: - (b06bdrv) – C:WindowsSysNativedriversbxvbda.sys (Broadcom Corporation)
DRV:64bit: - (b57nd60a) – C:WindowsSysNativedriversb57nd60a.sys (Broadcom Corporation)
DRV:64bit: - (hcw85cir) – C:WindowsSysNativedrivershcw85cir.sys (Hauppauge Computer Works, Inc.)
DRV:64bit: - (iaStor) – C:WindowsSysNativedriversiaStor.sys (Intel Corporation)
DRV:64bit: - (IntcHdmiAddService) Intel® – C:WindowsSysNativedriversIntcHdmi.sys (Intel® Corporation)
DRV:64bit: - (GEARAspiWDM) – C:WindowsSysNativedriversGEARAspiWDM.sys (GEAR Software Inc.)
DRV:64bit: - (Alpham1) – C:WindowsSysNativedriversAlpham164.sys (Ideazon Corporation)
DRV:64bit: - (Alpham2) – C:WindowsSysNativedriversAlpham264.sys (Ideazon Corporation)
DRV:64bit: - (WimFltr) – C:WindowsSysNativedriversWimFltr.sys (Microsoft Corporation)
DRV - (WIMMount) – C:WindowsSysWOW64driverswimmount.sys (Microsoft Corporation)
========== Standard Registry (SafeList) ==========
========== Internet Explorer ==========
IE - HKLMSOFTWAREMicrosoftInternet ExplorerMain,Local Page = C:WindowsSysWOW64blank.htm
IE - HKCUSOFTWAREMicrosoftInternet ExplorerMain,Default_Page_URL = http://g.msn.com/USCON/1
IE - HKCUSOFTWAREMicrosoftInternet ExplorerMain,Start Page = http://g.msn.com/USCON/1
IE - HKCUSoftwareMicrosoftWindowsCurrentVersionInternet Settings: "ProxyEnable" = 0
IE - HKCUSoftwareMicrosoftWindowsCurrentVersionInternet Settings: "ProxyOverride" = *.local
========== FireFox ==========
FF - prefs.js..browser.startup.homepage: "http://www.joyandtom.com"
FF - prefs.js..extensions.enabledItems: {9EB34849-81D3-4841-939D-666D522B889A}:1.5.1.119
FF - prefs.js..extensions.enabledItems: {c527ef3c-9e07-425a-bcde-f24bc1faf2b4}:1.0
FF - prefs.js..network.proxy.no_proxies_on: "localhost, 127.0.0.1/32"
FF - prefs.js..network.proxy.type: 1
FF:64bit: - [removed]/JavaPlugin: C:Program FilesJavajre7binnew_pluginnpjp2.dll (Oracle Corporation)
FF:64bit: - [removed]/GENUINE: disabled File not found
FF - [removed]/FlashPlayer: C:WindowsSysWOW64MacromedFlashNPSWF32.dll ()
FF - [removed]/iTunes,version=: File not found
FF - [removed]/iTunes,version=1.0: C:Program Files (x86)iTunesMozilla Pluginsnpitunes.dll ()
FF - [removed]/GENUINE: disabled File not found
FF - [removed]/NpCtrl,version=1.0: c:Program Files (x86)Microsoft Silverlight4.0.60531.0npctrl.dll ( Microsoft Corporation)
FF - [removed]/WLPG,version=14.0.8081.0709: C:Program Files (x86)Windows LivePhoto GalleryNPWLPG.dll (Microsoft Corporation)
FF - [removed]/3DVision: C:Program Files (x86)NVIDIA Corporation3D Visionnpnv3dv.dll (NVIDIA Corporation)
FF - [removed]/3DVisionStreaming: C:Program Files (x86)NVIDIA Corporation3D Visionnpnv3dvstreaming.dll (NVIDIA Corporation)
FF - [removed]/FBPlugin,version=1.0.3: C:UsersMorningwyndAppDataRoamingFacebooknpfbplugin_1_0_3.dll ( )
FF - [removed]/Google Update;version=3: C:UsersMorningwyndAppDataLocalGoogleUpdate1.3.21.65npGoogleUpdate3.dll (Google Inc.)
FF - [removed]/Google Update;version=9: C:UsersMorningwyndAppDataLocalGoogleUpdate1.3.21.65npGoogleUpdate3.dll (Google Inc.)
FF - HKEY_LOCAL_MACHINEsoftwaremozillaMozilla Firefox 6.0extensionsComponents: C:Program Files (x86)Mozilla Firefoxcomponents [2011/08/16 22:44:02 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINEsoftwaremozillaMozilla Firefox 6.0extensionsPlugins: C:Program Files (x86)Mozilla Firefoxplugins [2011/08/16 04:31:56 | 000,000,000 | —D | M]
[2010/04/30 17:19:48 | 000,000,000 | —D | M] (No name found) – C:UsersMorningwyndAppDataRoamingMozillaExtensions
[2011/08/15 23:43:13 | 000,000,000 | —D | M] (No name found) – C:UsersMorningwyndAppDataRoamingMozillaFirefoxProfiles7iccdgpp.defaulte
xtensions
[2011/06/10 19:26:06 | 000,000,000 | —D | M] (WebSlingPlayer) – C:UsersMorningwyndAppDataRoamingMozillaFirefoxProfiles7iccdgpp.defaulte
xtensions{9EB34849-81D3-4841-939D-666D522B889A}
[2011/07/26 21:31:07 | 000,000,000 | —D | M] (XUL Cache) – C:UsersMorningwyndAppDataRoamingMozillaFirefoxProfiles7iccdgpp.defaulte
xtensions{c527ef3c-9e07-425a-bcde-f24bc1faf2b4}
[2011/08/16 22:44:02 | 000,000,000 | —D | M] (No name found) – C:Program Files (x86)Mozilla Firefoxextensions
File not found (No name found) –
[2011/08/12 01:57:31 | 000,134,104 | —- | M] (Mozilla Foundation) – C:Program Files (x86)mozilla firefoxcomponentsbrowsercomps.dll
[2011/08/11 23:16:35 | 000,002,252 | —- | M] () – C:Program Files (x86)mozilla firefoxsearchpluginsbing.xml
Hosts file not found
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - No CLSID value found.
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.
O2 - BHO: (Skype add-on for Internet Explorer) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:Program Files (x86)SkypeToolbarsInternet Explorerskypeieplugin.dll (Skype Technologies S.A.)
O2 - BHO: (Java™ Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - File not found
O3:64bit: - HKLM..Toolbar: (no name) - Locked - No CLSID value found.
O3 - HKLM..Toolbar: (no name) - Locked - No CLSID value found.
O4:64bit: - HKLM..Run: [HotKeysCmds] C:WindowsSysNativehkcmd.exe (Intel Corporation)
O4:64bit: - HKLM..Run: [IAAnotif] C:Program Files (x86)IntelIntel Matrix Storage ManagerIAAnotif.exe (Intel Corporation)
O4:64bit: - HKLM..Run: [IgfxTray] C:WindowsSysNativeigfxtray.exe (Intel Corporation)
O4:64bit: - HKLM..Run: [MSC] c:Program FilesMicrosoft Security Clientmsseces.exe (Microsoft Corporation)
O4:64bit: - HKLM..Run: [Persistence] C:WindowsSysNativeigfxpers.exe (Intel Corporation)
O4 - HKLM..Run: [Desktop Disc Tool] c:Program Files (x86)RoxioRoxio BurnRoxioBurnLauncher.exe ()
O4 - HKLM..Run: [Malwarebytes' Anti-Malware] C:Program Files (x86)Malwarebytes' Anti-Malwarembamgui.exe (Malwarebytes Corporation)
O4 - HKLM..Run: [PDVDDXSrv] C:Program Files (x86)CyberLinkPowerDVD DXPDVDDXSrv.exe (CyberLink Corp.)
O4 - Startup: C:UsersMorningwyndAppDataRoamingMicrosoftWindowsStart MenuProgramsStartupDell Dock.lnk = File not found
O6 - HKLMSOFTWAREMicrosoftWindowsCurrentVersionpoliciesExplorer: NoActiveDesktop = 1
O6 - HKLMSOFTWAREMicrosoftWindowsCurrentVersionpoliciesExplorer: NoActiveDesktopChanges = 1
O6 - HKLMSOFTWAREMicrosoftWindowsCurrentVersionpoliciesSystem: ConsentPromptBehaviorAdmin = 5
O6 - HKLMSOFTWAREMicrosoftWindowsCurrentVersionpoliciesSystem: ConsentPromptBehaviorUser = 3
O9 - Extra Button: Skype add-on for Internet Explorer - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:Program Files (x86)SkypeToolbarsInternet Explorerskypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra 'Tools' menuitem : Skype add-on for Internet Explorer - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:Program Files (x86)SkypeToolbarsInternet Explorerskypeieplugin.dll (Skype Technologies S.A.)
O10:64bit: - NameSpace_Catalog5Catalog_Entries\000000000007 [] - C:Program Files (x86)BonjourmdnsNSP.dll (Apple Inc.)
O10 - NameSpace_Catalog5Catalog_Entries\000000000007 [] - C:Program Files (x86)BonjourmdnsNSP.dll (Apple Inc.)
O13 - gopher Prefix: missing
O13 - gopher Prefix: missing
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.7.0/jinstall-…indows-i586.cab (Java Plug-in 1.7.0)
O16 - DPF: {CAFEEFAC-0017-0000-0000-ABCDEFFEDCBA} http://java.sun.com/update/1.7.0/jinstall-…indows-i586.cab (Java Plug-in 1.7.0)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.7.0/jinstall-…indows-i586.cab (Java Plug-in 1.7.0)
O17 - HKLMSystemCCSServicesTcpipParameters: DhcpNameServer = 10.0.0.1
O18:64bit: - ProtocolHandlerlivecall {828030A1-22C1-4009-854F-8E305202313F} - Reg Error: Key error. File not found
O18:64bit: - ProtocolHandlermsnim {828030A1-22C1-4009-854F-8E305202313F} - Reg Error: Key error. File not found
O18:64bit: - ProtocolHandlerskype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - Reg Error: Key error. File not found
O18:64bit: - ProtocolHandlerskype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - Reg Error: Key error. File not found
O18:64bit: - ProtocolHandlerwlmailhtml {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - Reg Error: Key error. File not found
O18 - ProtocolHandlerskype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:Program Files (x86)Common FilesSkypeSkype4COM.dll (Skype Technologies)
O18 - ProtocolHandlerskype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:Program Files (x86)SkypeToolbarsInternet Explorerskypeieplugin.dll (Skype Technologies S.A.)
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:Windowsexplorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:Windowssystem32userinit.exe) - C:WindowsSysNativeuserinit.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:WindowsSysNativeSystemPropertiesPerformance.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:WindowsSysWow64explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:WindowsSysWow64userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O20:64bit: - WinlogonNotifyigfxcui: DllName - Reg Error: Key error. - C:WindowsSysNativeigfxdev.dll (Intel Corporation)
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found.
O32 - HKLM CDRom: AutoRun - 1
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35:64bit: - HKLM..comfile [open] – "%1" %*
O35:64bit: - HKLM..exefile [open] – "%1" %*
O35 - HKLM..comfile [open] – "%1" %*
O35 - HKLM..exefile [open] – "%1" %*
O37:64bit: - HKLM…com [@ = comfile] – "%1" %*
O37:64bit: - HKLM…exe [@ = exefile] – "%1" %*
O37 - HKLM…com [@ = comfile] – "%1" %*
O37 - HKLM…exe [@ = exefile] – "%1" %*
Drivers32:64bit: msacm.l3acm - C:WindowsSystem32l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.l3acm - C:WindowsSysWOW64l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: vidc.cvid - C:WindowsSysWow64iccvid.dll (Radius Inc.)
CREATERESTOREPOINT
Restore point Set: OTL Restore Point
========== Files/Folders - Created Within 30 Days ==========
[2011/08/16 20:13:21 | 000,000,000 | —D | C] – C:_OTS
[2011/08/16 08:31:54 | 000,000,000 | —D | C] – C:UsersMorningwyndAppDataRoamingMalwarebytes
[2011/08/16 08:31:33 | 000,041,272 | —- | C] (Malwarebytes Corporation) – C:WindowsSysWow64driversmbamswissarmy.sys
[2011/08/16 08:31:33 | 000,000,000 | —D | C] – C:ProgramDataMicrosoftWindowsStart MenuProgramsMalwarebytes' Anti-Malware
[2011/08/16 08:31:33 | 000,000,000 | —D | C] – C:ProgramDataMalwarebytes
[2011/08/16 08:31:30 | 000,025,912 | —- | C] (Malwarebytes Corporation) – C:WindowsSysNativedriversmbam.sys
[2011/08/16 08:31:29 | 000,000,000 | —D | C] – C:Program Files (x86)Malwarebytes' Anti-Malware
[2011/08/16 04:43:22 | 000,000,000 | —D | C] – C:ProgramDataKaspersky Lab
[2011/08/16 04:35:14 | 000,404,640 | —- | C] (Adobe Systems Incorporated) – C:WindowsSysWow64FlashPlayerCPLApp.cpl
[2011/08/16 00:11:46 | 000,000,000 | —D | C] – C:ProgramDataSpybot - Search & Destroy
[2011/08/16 00:11:46 | 000,000,000 | —D | C] – C:Program Files (x86)Spybot - Search & Destroy
[2011/08/15 23:48:02 | 000,000,000 | —D | C] – C:ProgramDataHitman Pro
[2011/08/15 23:37:16 | 000,000,000 | —D | C] – C:UsersMorningwyndAppDataRoamingMicrosoftWindowsStart MenuProgramsHiJackThis
[2011/08/15 23:37:15 | 000,000,000 | —D | C] – C:Program Files (x86)Trend Micro
[2011/08/15 23:34:01 | 000,000,000 | -HSD | C] – C:Config.Msi
[2011/08/15 23:20:52 | 000,627,600 | —- | C] (Oracle Corporation) – C:WindowsSysNativedeployJava1.dll
[2011/08/15 03:06:54 | 000,000,000 | —D | C] – C:Program Files (x86)Microsoft Security Client
[2011/08/14 18:41:08 | 000,199,680 | —- | C] (Microsoft Corporation) – C:WindowsSysNativexmllite.dll
[2011/08/14 18:41:07 | 000,319,488 | —- | C] (Microsoft Corporation) – C:WindowsSysWow64odbcjt32.dll
[2011/08/14 18:41:07 | 000,212,992 | —- | C] (Microsoft Corporation) – C:WindowsSysNativeodbctrac.dll
[2011/08/14 18:41:07 | 000,163,840 | —- | C] (Microsoft Corporation) – C:WindowsSysNativeodbccp32.dll
[2011/08/14 18:41:07 | 000,122,880 | —- | C] (Microsoft Corporation) – C:WindowsSysWow64odbccp32.dll
[2011/08/14 18:41:07 | 000,106,496 | —- | C] (Microsoft Corporation) – C:WindowsSysNativeodbccu32.dll
[2011/08/14 18:41:07 | 000,106,496 | —- | C] (Microsoft Corporation) – C:WindowsSysNativeodbccr32.dll
[2011/08/14 18:41:04 | 000,086,016 | —- | C] (Microsoft Corporation) – C:WindowsSysWow64odbccu32.dll
[2011/08/14 18:41:04 | 000,081,920 | —- | C] (Microsoft Corporation) – C:WindowsSysWow64odbccr32.dll
[2011/08/14 18:41:03 | 000,163,840 | —- | C] (Microsoft Corporation) – C:WindowsSysWow64odbctrac.dll
[2011/08/14 18:40:57 | 001,162,240 | —- | C] (Microsoft Corporation) – C:WindowsSysNativekernel32.dll
[2011/08/14 18:40:57 | 000,422,400 | —- | C] (Microsoft Corporation) – C:WindowsSysNativeKernelBase.dll
[2011/08/14 18:40:57 | 000,362,496 | —- | C] (Microsoft Corporation) – C:WindowsSysNativewow64win.dll
[2011/08/14 18:40:57 | 000,338,432 | —- | C] (Microsoft Corporation) – C:WindowsSysNativeconhost.exe
[2011/08/14 18:40:57 | 000,243,200 | —- | C] (Microsoft Corporation) – C:WindowsSysNativewow64.dll
[2011/08/14 18:40:57 | 000,214,528 | —- | C] (Microsoft Corporation) – C:WindowsSysNativewinsrv.dll
[2011/08/14 18:40:57 | 000,025,600 | —- | C] (Microsoft Corporation) – C:WindowsSysWow64setup16.exe
[2011/08/14 18:40:57 | 000,016,384 | —- | C] (Microsoft Corporation) – C:WindowsSysNativentvdm64.dll
[2011/08/14 18:40:57 | 000,014,336 | —- | C] (Microsoft Corporation) – C:WindowsSysWow64ntvdm64.dll
[2011/08/14 18:40:57 | 000,013,312 | —- | C] (Microsoft Corporation) – C:WindowsSysNativewow64cpu.dll
[2011/08/14 18:40:56 | 000,005,120 | —- | C] (Microsoft Corporation) – C:WindowsSysWow64wow32.dll
[2011/08/14 18:40:55 | 000,004,608 | -H– | C] (Microsoft Corporation) – C:WindowsSysWow64api-ms-win-core-processthreads-l1-1-0.dll
[2011/08/14 18:40:55 | 000,004,096 | -H– | C] (Microsoft Corporation) – C:WindowsSysWow64api-ms-win-core-sysinfo-l1-1-0.dll
[2011/08/14 18:40:55 | 000,004,096 | -H– | C] (Microsoft Corporation) – C:WindowsSysWow64api-ms-win-core-synch-l1-1-0.dll
[2011/08/14 18:40:55 | 000,004,096 | -H– | C] (Microsoft Corporation) – C:WindowsSysWow64api-ms-win-core-misc-l1-1-0.dll
[2011/08/14 18:40:55 | 000,004,096 | -H– | C] (Microsoft Corporation) – C:WindowsSysWow64api-ms-win-core-localregistry-l1-1-0.dll
[2011/08/14 18:40:55 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:WindowsSysWow64api-ms-win-core-processenvironment-l1-1-0.dll
[2011/08/14 18:40:55 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:WindowsSysWow64api-ms-win-core-namedpipe-l1-1-0.dll
[2011/08/14 18:40:55 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:WindowsSysWow64api-ms-win-core-memory-l1-1-0.dll
[2011/08/14 18:40:55 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:WindowsSysWow64api-ms-win-core-libraryloader-l1-1-0.dll
[2011/08/14 18:40:55 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:WindowsSysWow64api-ms-win-core-heap-l1-1-0.dll
[2011/08/14 18:40:55 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:WindowsSysWow64api-ms-win-core-string-l1-1-0.dll
[2011/08/14 18:40:55 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:WindowsSysNativeapi-ms-win-core-string-l1-1-0.dll
[2011/08/14 18:40:55 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:WindowsSysWow64api-ms-win-core-rtlsupport-l1-1-0.dll
[2011/08/14 18:40:55 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:WindowsSysWow64api-ms-win-core-profile-l1-1-0.dll
[2011/08/14 18:40:55 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:WindowsSysNativeapi-ms-win-core-profile-l1-1-0.dll
[2011/08/14 18:40:54 | 000,005,120 | -H– | C] (Microsoft Corporation) – C:WindowsSysWow64api-ms-win-core-file-l1-1-0.dll
[2011/08/14 18:40:54 | 000,004,608 | -H– | C] (Microsoft Corporation) – C:WindowsSysNativeapi-ms-win-core-threadpool-l1-1-0.dll
[2011/08/14 18:40:54 | 000,004,096 | -H– | C] (Microsoft Corporation) – C:WindowsSysNativeapi-ms-win-core-sysinfo-l1-1-0.dll
[2011/08/14 18:40:54 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:WindowsSysWow64api-ms-win-core-interlocked-l1-1-0.dll
[2011/08/14 18:40:54 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:WindowsSysNativeapi-ms-win-core-xstate-l1-1-0.dll
[2011/08/14 18:40:54 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:WindowsSysNativeapi-ms-win-core-util-l1-1-0.dll
[2011/08/14 18:40:54 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:WindowsSysWow64api-ms-win-core-io-l1-1-0.dll
[2011/08/14 18:40:54 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:WindowsSysWow64api-ms-win-core-handle-l1-1-0.dll
[2011/08/14 18:40:54 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:WindowsSysWow64api-ms-win-core-fibers-l1-1-0.dll
[2011/08/14 18:40:54 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:WindowsSysWow64api-ms-win-core-errorhandling-l1-1-0.dll
[2011/08/14 18:40:54 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:WindowsSysWow64api-ms-win-core-debug-l1-1-0.dll
[2011/08/14 18:40:54 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:WindowsSysNativeapi-ms-win-core-debug-l1-1-0.dll
[2011/08/14 18:40:54 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:WindowsSysWow64api-ms-win-core-datetime-l1-1-0.dll
[2011/08/14 18:40:54 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:WindowsSysNativeapi-ms-win-core-datetime-l1-1-0.dll
[2011/08/14 18:40:53 | 000,006,144 | -H– | C] (Microsoft Corporation) – C:WindowsSysWow64api-ms-win-security-base-l1-1-0.dll
[2011/08/14 18:40:53 | 000,006,144 | -H– | C] (Microsoft Corporation) – C:WindowsSysNativeapi-ms-win-security-base-l1-1-0.dll
[2011/08/14 18:40:53 | 000,005,120 | -H– | C] (Microsoft Corporation) – C:WindowsSysNativeapi-ms-win-core-file-l1-1-0.dll
[2011/08/14 18:40:53 | 000,004,608 | -H– | C] (Microsoft Corporation) – C:WindowsSysWow64api-ms-win-core-threadpool-l1-1-0.dll
[2011/08/14 18:40:53 | 000,004,608 | -H– | C] (Microsoft Corporation) – C:WindowsSysNativeapi-ms-win-core-processthreads-l1-1-0.dll
[2011/08/14 18:40:53 | 000,004,096 | -H– | C] (Microsoft Corporation) – C:WindowsSysNativeapi-ms-win-core-synch-l1-1-0.dll
[2011/08/14 18:40:53 | 000,004,096 | -H– | C] (Microsoft Corporation) – C:WindowsSysNativeapi-ms-win-core-localregistry-l1-1-0.dll
[2011/08/14 18:40:53 | 000,004,096 | -H– | C] (Microsoft Corporation) – C:WindowsSysWow64api-ms-win-core-localization-l1-1-0.dll
[2011/08/14 18:40:53 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:WindowsSysWow64api-ms-win-core-xstate-l1-1-0.dll
[2011/08/14 18:40:53 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:WindowsSysNativeapi-ms-win-core-rtlsupport-l1-1-0.dll
[2011/08/14 18:40:53 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:WindowsSysNativeapi-ms-win-core-processenvironment-l1-1-0.dll
[2011/08/14 18:40:53 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:WindowsSysNativeapi-ms-win-core-namedpipe-l1-1-0.dll
[2011/08/14 18:40:53 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:WindowsSysNativeapi-ms-win-core-misc-l1-1-0.dll
[2011/08/14 18:40:53 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:WindowsSysNativeapi-ms-win-core-memory-l1-1-0.dll
[2011/08/14 18:40:53 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:WindowsSysNativeapi-ms-win-core-libraryloader-l1-1-0.dll
[2011/08/14 18:40:53 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:WindowsSysNativeapi-ms-win-core-heap-l1-1-0.dll
[2011/08/14 18:40:53 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:WindowsSysWow64api-ms-win-core-util-l1-1-0.dll
[2011/08/14 18:40:53 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:WindowsSysNativeapi-ms-win-core-io-l1-1-0.dll
[2011/08/14 18:40:53 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:WindowsSysNativeapi-ms-win-core-interlocked-l1-1-0.dll
[2011/08/14 18:40:53 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:WindowsSysNativeapi-ms-win-core-handle-l1-1-0.dll
[2011/08/14 18:40:53 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:WindowsSysNativeapi-ms-win-core-fibers-l1-1-0.dll
[2011/08/14 18:40:53 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:WindowsSysNativeapi-ms-win-core-errorhandling-l1-1-0.dll
[2011/08/14 18:40:53 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:WindowsSysWow64api-ms-win-core-delayload-l1-1-0.dll
[2011/08/14 18:40:53 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:WindowsSysNativeapi-ms-win-core-delayload-l1-1-0.dll
[2011/08/14 18:40:52 | 000,007,680 | —- | C] (Microsoft Corporation) – C:WindowsSysWow64instnm.exe
[2011/08/14 18:40:52 | 000,004,096 | -H– | C] (Microsoft Corporation) – C:WindowsSysNativeapi-ms-win-core-localization-l1-1-0.dll
[2011/08/14 18:40:52 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:WindowsSysWow64api-ms-win-core-console-l1-1-0.dll
[2011/08/14 18:40:52 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:WindowsSysNativeapi-ms-win-core-console-l1-1-0.dll
[2011/08/14 18:40:52 | 000,002,048 | —- | C] (Microsoft Corporation) – C:WindowsSysWow64user.exe
[2011/08/14 18:40:42 | 000,703,488 | —- | C] (Microsoft Corporation) – C:WindowsSysNativemsfeeds.dll
[2011/08/14 18:40:41 | 000,256,000 | —- | C] (Microsoft Corporation) – C:WindowsSysNativeiepeers.dll
[2011/08/14 18:40:41 | 000,247,808 | —- | C] (Microsoft Corporation) – C:WindowsSysNativeieui.dll
[2011/08/14 18:40:41 | 000,176,640 | —- | C] (Microsoft Corporation) – C:WindowsSysWow64ieui.dll
[2011/08/14 18:40:41 | 000,134,144 | —- | C] (Microsoft Corporation) – C:WindowsSysNativeurl.dll
[2011/08/14 18:40:40 | 000,185,856 | —- | C] (Microsoft Corporation) – C:WindowsSysWow64iepeers.dll
[2011/08/14 18:40:40 | 000,132,096 | —- | C] (Microsoft Corporation) – C:WindowsSysWow64url.dll
[2011/08/14 18:40:40 | 000,097,280 | —- | C] (Microsoft Corporation) – C:WindowsSysNativemshtmled.dll
[2011/08/14 18:40:40 | 000,067,072 | —- | C] (Microsoft Corporation) – C:WindowsSysWow64mshtmled.dll
[2011/08/14 18:40:40 | 000,057,856 | —- | C] (Microsoft Corporation) – C:WindowsSysNativelicmgr10.dll
[2011/08/14 18:40:40 | 000,044,544 | —- | C] (Microsoft Corporation) – C:WindowsSysWow64licmgr10.dll
[2011/08/14 18:40:40 | 000,012,800 | —- | C] (Microsoft Corporation) – C:WindowsSysWow64msfeedssync.exe
[2011/08/14 18:40:40 | 000,012,288 | —- | C] (Microsoft Corporation) – C:WindowsSysNativemsfeedssync.exe
[2011/08/14 18:40:39 | 000,482,816 | —- | C] (Microsoft Corporation) – C:WindowsSysNativehtml.iec
[2011/08/14 18:40:39 | 000,386,048 | —- | C] (Microsoft Corporation) – C:WindowsSysWow64html.iec
[2011/08/14 18:40:38 | 005,507,968 | —- | C] (Microsoft Corporation) – C:WindowsSysNativentoskrnl.exe
[2011/08/14 18:40:37 | 003,957,120 | —- | C] (Microsoft Corporation) – C:WindowsSysWow64ntkrnlpa.exe
[2011/08/14 18:40:36 | 003,902,336 | —- | C] (Microsoft Corporation) – C:WindowsSysWow64ntoskrnl.exe
[2011/07/31 10:53:13 | 000,000,000 | —D | C] – C:Program Files (x86)Apple Software Update
[2010/04/30 17:19:15 | 008,656,832 | —- | C] (Dell, Inc. ) – C:UsersMorningwyndAppDataRoamingDataSafeDotNet.exe
========== Files - Modified Within 30 Days ==========
[2011/08/16 22:48:01 | 000,000,932 | —- | M] () – C:WindowstasksGoogleUpdateTaskUserS-1-5-21-153549276-194435143-977033974-1000UA.job
[2011/08/16 22:44:03 | 000,001,132 | —- | M] () – C:UsersPublicDesktopMozilla Firefox.lnk
[2011/08/16 21:57:45 | 000,014,240 | -H– | M] () – C:WindowsSysNative7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2011/08/16 21:57:45 | 000,014,240 | -H– | M] () – C:WindowsSysNative7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2011/08/16 21:54:41 | 000,729,688 | —- | M] () – C:WindowsSysNativePerfStringBackup.INI
[2011/08/16 21:54:41 | 000,626,040 | —- | M] () – C:WindowsSysNativeperfh009.dat
[2011/08/16 21:54:41 | 000,107,316 | —- | M] () – C:WindowsSysNativeperfc009.dat
[2011/08/16 21:50:27 | 000,067,584 | –S- | M] () – C:Windowsbootstat.dat
[2011/08/16 21:50:22 | 3220,426,752 | -HS- | M] () – C:hiberfil.sys
[2011/08/16 19:51:34 | 000,000,880 | —- | M] () – C:WindowstasksGoogleUpdateTaskUserS-1-5-21-153549276-194435143-977033974-1000Core.job
[2011/08/16 08:31:34 | 000,001,107 | —- | M] () – C:UsersPublicDesktopMalwarebytes' Anti-Malware.lnk
[2011/08/16 04:53:13 | 000,000,306 | -HS- | M] () – C:Windows3212110drv.spi
[2011/08/16 04:35:14 | 000,404,640 | —- | M] (Adobe Systems Incorporated) – C:WindowsSysWow64FlashPlayerCPLApp.cpl
[2011/08/16 00:03:12 | 000,791,655 | —- | M] () – C:UsersMorningwyndAppDataLocalcensus.cache
[2011/08/16 00:02:39 | 000,093,202 | —- | M] () – C:UsersMorningwyndAppDataLocalars.cache
[2011/08/15 23:57:16 | 000,000,036 | —- | M] () – C:UsersMorningwyndAppDataLocalhousecall.guid.cache
[2011/08/15 23:49:11 | 000,025,160 | —- | M] () – C:WindowsSysNativedrivershitmanpro35.sys
[2011/08/15 23:37:16 | 000,003,003 | —- | M] () – C:UsersMorningwyndDesktopHiJackThis.lnk
[2011/08/15 23:20:46 | 000,252,296 | —- | M] (Oracle Corporation) – C:WindowsSysNativejavaws.exe
[2011/08/15 23:20:46 | 000,188,808 | —- | M] (Oracle Corporation) – C:WindowsSysNativejavaw.exe
[2011/08/15 23:20:46 | 000,188,808 | —- | M] (Oracle Corporation) – C:WindowsSysNativejava.exe
[2011/08/15 23:20:45 | 000,627,600 | —- | M] (Oracle Corporation) – C:WindowsSysNativedeployJava1.dll
[2011/08/15 03:07:08 | 000,001,945 | —- | M] () – C:Windowsepplauncher.mif
[2011/08/15 03:06:55 | 000,743,066 | —- | M] () – C:WindowsSysWow64PerfStringBackup.INI
[2011/08/14 18:48:48 | 000,002,387 | —- | M] () – C:UsersMorningwyndDesktopGoogle Chrome.lnk
[2011/07/26 21:31:09 | 000,000,081 | —- | M] () – C:WindowsSysWow641055906881
========== Files Created - No Company Name ==========
[2011/08/16 22:44:03 | 000,001,144 | —- | C] () – C:ProgramDataMicrosoftWindowsStart MenuProgramsMozilla Firefox.lnk
[2011/08/16 22:44:03 | 000,001,132 | —- | C] () – C:UsersPublicDesktopMozilla Firefox.lnk
[2011/08/16 08:31:34 | 000,001,107 | —- | C] () – C:UsersPublicDesktopMalwarebytes' Anti-Malware.lnk
[2011/08/16 04:53:13 | 000,000,306 | -HS- | C] () – C:Windows3212110drv.spi
[2011/08/16 00:03:12 | 000,791,655 | —- | C] () – C:UsersMorningwyndAppDataLocalcensus.cache
[2011/08/16 00:02:39 | 000,093,202 | —- | C] () – C:UsersMorningwyndAppDataLocalars.cache
[2011/08/15 23:57:16 | 000,000,036 | —- | C] () – C:UsersMorningwyndAppDataLocalhousecall.guid.cache
[2011/08/15 23:49:11 | 000,025,160 | —- | C] () – C:WindowsSysNativedrivershitmanpro35.sys
[2011/08/15 23:37:16 | 000,003,003 | —- | C] () – C:UsersMorningwyndDesktopHiJackThis.lnk
[2011/07/26 21:31:07 | 000,000,081 | —- | C] () – C:WindowsSysWow641055906881
[2011/04/04 19:46:52 | 000,000,268 | —- | C] () – C:Windows{789289CA-F73A-4A16-A331-54D498CE069F}_WiseFW.ini
[2011/03/06 23:11:23 | 000,743,066 | —- | C] () – C:WindowsSysWow64PerfStringBackup.INI
[2010/09/06 16:53:47 | 000,000,410 | —- | C] () – C:WindowsBRWMARK.INI
[2010/09/06 16:53:47 | 000,000,034 | —- | C] () – C:WindowsSysWow64BD2070N.DAT
[2010/04/30 17:33:01 | 000,007,605 | —- | C] () – C:UsersMorningwyndAppDataLocalresmon.resmoncfg
[2010/04/27 23:00:03 | 000,982,220 | —- | C] () – C:WindowsSysWow64igkrng500.bin
[2010/04/27 23:00:03 | 000,134,592 | —- | C] () – C:WindowsSysWow64igfcg500.bin
[2010/04/27 23:00:03 | 000,092,216 | —- | C] () – C:WindowsSysWow64igfcg500m.bin
[2010/04/27 23:00:02 | 000,439,300 | —- | C] () – C:WindowsSysWow64igcompkrng500.bin
[2009/07/14 01:38:36 | 000,067,584 | –S- | C] () – C:Windowsbootstat.dat
[2009/07/13 22:35:51 | 000,000,741 | —- | C] () – C:WindowsSysWow64NOISE.DAT
[2009/07/13 22:34:42 | 000,215,943 | —- | C] () – C:WindowsSysWow64dssec.dat
[2009/07/13 20:10:29 | 000,043,131 | —- | C] () – C:Windowsmib.bin
[2009/07/13 19:42:10 | 000,064,000 | —- | C] () – C:WindowsSysWow64BWContextHandler.dll
[2009/07/13 17:03:59 | 000,364,544 | —- | C] () – C:WindowsSysWow64msjetoledb40.dll
[2009/06/10 17:26:10 | 000,673,088 | —- | C] () – C:WindowsSysWow64mlang.dat
========== LOP Check ==========
[2010/06/14 18:38:35 | 000,000,000 | —D | M] – C:UsersMorningwyndAppDataRoamingFacebook
[2011/06/10 19:26:10 | 000,000,000 | —D | M] – C:UsersMorningwyndAppDataRoamingSling Media
[2010/09/07 10:02:09 | 000,032,584 | —- | M] () – C:WindowsTasksSCHEDLGU.TXT
========== Purity Check ==========
========== Custom Scans ==========
< %SYSTEMDRIVE%*.* >
[2010/04/27 23:04:54 | 000,026,615 | RH– | M] () – C:dell.sdr
[2011/08/16 21:50:22 | 3220,426,752 | -HS- | M] () – C:hiberfil.sys
[2011/08/16 21:50:26 | 4293,902,336 | -HS- | M] () – C:pagefile.sys
< %systemroot%Fonts*.com >
[2009/07/14 01:32:31 | 000,026,040 | —- | M] () – C:WindowsFontsGlobalMonospace.CompositeFont
[2009/07/14 01:32:31 | 000,026,489 | —- | M] () – C:WindowsFontsGlobalSansSerif.CompositeFont
[2009/07/14 01:32:31 | 000,029,779 | —- | M] () – C:WindowsFontsGlobalSerif.CompositeFont
[2009/07/14 01:32:31 | 000,043,318 | —- | M] () – C:WindowsFontsGlobalUserInterface.CompositeFont
< %systemroot%Fonts*.dll >
< %systemroot%Fonts*.ini >
[2009/06/10 16:49:50 | 000,000,065 | —- | M] () – C:WindowsFontsdesktop.ini
< %systemroot%Fonts*.ini2 >
< %systemroot%Fonts*.exe >
< %systemroot%system32spoolprtprocsw32x86*.* >
< %systemroot%REPAIR*.bak1 >
< %systemroot%REPAIR*.ini >
< %systemroot%system32*.jpg >
< %systemroot%*.jpg >
< %systemroot%*.png >
< %systemroot%*.scr >
[2009/07/10 13:15:46 | 000,306,544 | —- | M] (Microsoft Corporation) – C:WindowsWLXPGSS.SCR
< %systemroot%*._sy >
< %APPDATA%AdobeUpdate*.* >
< %ALLUSERSPROFILE%Favorites*.* >
< %APPDATA%Microsoft*.* >
< %PROGRAMFILES%*.* >
[2009/07/14 00:54:24 | 000,000,174 | -HS- | M] () – C:Program Files (x86)desktop.ini
< %APPDATA%Update*.* >
< %systemroot%*. /mp /s >
< %systemroot%System32config*.sav >
< %PROGRAMFILES%bak. /s >
< %systemroot%system32bak. /s >
< %ALLUSERSPROFILE%Start Menu*.lnk /x >
< %systemroot%system32configsystemprofile*.dat /x >
< %systemroot%*.config >
< %systemroot%system32*.db >
< %PROGRAMFILES%Internet Explorer*.dat >
< %APPDATA%MicrosoftInternet ExplorerQuick Launch*.lnk /x >
[2010/04/30 17:15:54 | 000,000,221 | -HS- | M] () – C:UsersMorningwyndAppDataRoamingMicrosoftInternet ExplorerQuick Launchdesktop.ini
< %USERPROFILE%Desktop*.exe >
< %PROGRAMFILES%Common Files*.* >
< %systemroot%*.src >
< %systemroot%install*.* >
< %systemroot%system32DLL*.* >
< %systemroot%system32HelpFiles*.* >
< %systemroot%system32rundll*.* >
< %systemroot%winn32*.* >
< %systemroot%Java*.* >
< %systemroot%system32test*.* >
< %systemroot%system32Rundll32*.* >
< %systemroot%AppPatchCustom*.* >
< HKEY_LOCAL_MACHINESOFTWAREPoliciesMicrosoftWindowsWindowsUpdateAU >
< HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionWindowsUpdateAuto UpdateResultsInstall|LastSuccessTime /rs >
< End of report >
Another thing is it seems some people had their home page changed, It seems ours never did that. It does seem like it gave up on the fast answers site and now returns sites like local411, easymademortgage and many others.
