Search engine redirects [Solved] (page 4) — What the Tech Forum Archive

Conspire

Post #46June 25, 2012, 3:38 PM UTC

Alright, probably McAfee has nuked it once again. Since you are not experiencing any redirects. I would need you to run an OTL scan for me so that I can be sure that they are cleared.

SuMMiT

Post #47June 25, 2012, 8:17 PM UTC

did you see in my follow up posting that it is still there and i had just neglected to 'ok' the folder settings?

here's the otl:
OTL logfile created on: 6/25/2012 4:08:51 PM - Run 5
OTL by OldTimer - Version 3.2.47.0 Folder = C:\Documents and Settings\jzipkin\Desktop
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

3.49 Gb Total Physical Memory | 2.84 Gb Available Physical Memory | 81.29% Memory free
5.32 Gb Paging File | 4.24 Gb Available in Paging File | 79.71% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 148.99 Gb Total Space | 108.08 Gb Free Space | 72.54% Space Free | Partition Type: NTFS
Drive E: | 60.35 Mb Total Space | 50.11 Mb Free Space | 83.03% Space Free | Partition Type: FAT

Computer Name: C4LHXH1 | User Name: JZipkin | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Documents and Settings\jzipkin\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Program Files\Oracle\JavaFX 2.1 Runtime\bin\jqs.exe (Oracle Corporation)
PRC - C:\Program Files\Adobe\Acrobat 9.0\Acrobat\acrotray.exe (Adobe Systems Inc.)
PRC - C:\Documents and Settings\jzipkin\Local Settings\Application Data\Facebook\Update\FacebookUpdate.exe (Facebook Inc.)
PRC - C:\Program Files\McAfee\Managed VirusScan\DesktopUI\TOPSConsole.exe (McAfee, Inc.)
PRC - C:\Program Files\McAfee\Managed VirusScan\DesktopUI\XTray.exe (McAfee, Inc.)
PRC - C:\Program Files\McAfee\Managed VirusScan\Agent\myAgtSvc.exe (McAfee, Inc.)
PRC - C:\Program Files\Common Files\McAfee\SystemCore\mfeann.exe (McAfee, Inc.)
PRC - C:\Program Files\Common Files\McAfee\SystemCore\mcshield.exe (McAfee, Inc.)
PRC - C:\WINDOWS\system32\mfevtps.exe (McAfee, Inc.)
PRC - C:\Program Files\real\realplayer\Update\realsched.exe (RealNetworks, Inc.)
PRC - C:\Program Files\McAfee\SiteAdvisor Enterprise\McSACore.exe (McAfee, Inc.)
PRC - C:\WINDOWS\system32\HPSIsvc.exe (HP)
PRC - C:\Program Files\Logitech\SetPointP\SetPoint.exe (Logitech, Inc.)
PRC - C:\Program Files\Common Files\LogiShrd\KHAL3\KHALMNPR.exe (Logitech, Inc.)
PRC - C:\Program Files\Xobni\XobniService.exe (Xobni Corporation)
PRC - C:\Program Files\IDT\WDM\sttray.exe (IDT, Inc.)
PRC - c:\drivers\audio\R267815\payload\WDM\stacsv.exe (IDT, Inc.)
PRC - C:\WINDOWS\system32\AESTFltr.exe (Andrea Electronics Corporation)
PRC - C:\Program Files\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe (Intel Corporation)
PRC - C:\Program Files\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe (Intel Corporation)
PRC - C:\Program Files\DellTPad\Apoint.exe (Alps Electric Co., Ltd.)
PRC - C:\Program Files\DellTPad\ApMsgFwd.exe (Alps Electric Co., Ltd.)
PRC - C:\WINDOWS\OA001Mon.exe (Creative Technology Ltd.)
PRC - C:\Program Files\Yahoo!\Common\YMailAdvisor.exe (Yahoo! Inc.)
PRC - C:\Program Files\ACT\Act for Windows\Act.Outlook.Service.exe (Sage Software, Inc.)
PRC - C:\Program Files\DellTPad\ApntEx.exe (Alps Electric Co., Ltd.)
PRC - C:\Program Files\DellTPad\hidfind.exe (Alps Electric Co., Ltd.)
PRC - C:\Program Files\Broadcom Corporation\Broadcom USH Host Components\CV\bin\HostStorageService.exe (Broadcom Corporation)
PRC - C:\Program Files\Broadcom Corporation\Broadcom USH Host Components\CV\bin\HostControlService.exe (Broadcom Corporation)
PRC - C:\Program Files\Dell\Dell ControlPoint\System Manager\DCPSysMgrSvc.exe (Dell Inc.)
PRC - C:\Program Files\Dell\Dell ControlPoint\System Manager\DCPSysMgr.exe (Dell Inc.)
PRC - C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe (Yahoo! Inc.)
PRC - C:\Program Files\Dell Webcam\Dell Webcam Central\WebcamDell.exe (Creative Technology Ltd.)
PRC - C:\Program Files\Dell\Dell ControlPoint\Connection Manager\Dell.UCM.exe (Smith Micro Software, Inc.)
PRC - C:\Program Files\Dell\Dell ControlPoint\Connection Manager\SMManager.exe (Smith Micro Software, Inc.)
PRC - C:\Program Files\Dell\Dell ControlPoint\DCPButtonSvc.exe (Dell Inc.)
PRC - C:\Program Files\Dell\Dell ControlPoint\Dell.ControlPoint.exe (Dell, Inc.)
PRC - C:\Program Files\WIDCOMM\Bluetooth Software\BTStackServer.exe (Broadcom Corporation.)
PRC - C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe (Broadcom Corporation.)
PRC - C:\Program Files\Wave Systems Corp\SecureUpgrade.exe (Wave Systems Corp.)
PRC - C:\Program Files\Wave Systems Corp\Trusted Drive Manager\TdmService.exe (Wave Systems Corp.)
PRC - C:\Program Files\Wave Systems Corp\Services Manager\DocMgr\bin\WavXDocMgr.exe (Wave Systems Corp.)
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
PRC - C:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe (Protexis Inc.)
PRC - C:\Program Files\Intel\ASF Agent\ASFAgent.exe (Intel Corporation)

========== Modules (No Company Name) ==========

MOD - C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll ()
MOD - C:\Program Files\Common Files\Apple\Apple Application Support\libxml2.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Genghis\4ec6587ba23030fa1c14ef684a18351e\Genghis.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Web\62e34cfb5a8b233667c7c5a47a32ad93\System.Web.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Runtime.Remo#\3c272cad7afb127e2a2bdb8a5a808512\System.Runtime.Remoting.ni.dll ()
MOD - C:\WINDOWS\assembly\GAC_32\System.Data\2.0.0.0__b77a5c561934e089\System.Data.dll ()
MOD - C:\WINDOWS\assembly\GAC_32\System.Transactions\2.0.0.0__b77a5c561934e089\System.Transactions.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\IsdiInterop\733a109cdd12f97bbfff91e63924bea8\IsdiInterop.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Management\90b90e700e59d73d6d692cf74e1ba16e\System.Management.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\IAStorUtil\ef89196608b35dfab2f5b31b878730ac\IAStorUtil.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\IAStorDataMgr\5441b605b1d8c2cf5ccbab0573811e3f\IAStorDataMgr.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\IAStorDataMgrSvc\3c352231fca566d7612b47ba71bf6afa\IAStorDataMgrSvc.ni.exe ()
MOD - C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Act.Shared.Windows.#\15a297b280cef43a5f9a9477c59564f2\Act.Shared.Windows.Forms.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Act.Shared.Win32\70f279b356c2e26601831c764a83517b\Act.Shared.Win32.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Act.Shared.Utilities\7526aa275aa0f9e11e2f2c1c57ad812c\Act.Shared.Utilities.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Act.Shared.LicProvi#\40e614dcbf0dca144f00ab72a1b18e85\Act.Shared.LicProvider.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Act.Shared.Images\2e21ec6a78917b8706761e73a6ea1e87\Act.Shared.Images.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Act.Shared.Licensing\828a2ff08f117ccb30871bd2ab5d9a32\Act.Shared.Licensing.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Act.Shared.Diagnost#\db44282e964afaec6efe510148054c6e\Act.Shared.Diagnostics.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Act.Shared.Config\8f3349920ebd24120eb3b88fa49cf26e\Act.Shared.Config.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Act.Shared.Collecti#\79892a316118891749163853e5f946ab\Act.Shared.Collections.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Act.Framework\3157390a3579a9cef986e6ab0331c0e9\Act.Framework.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Act.Data.Resources\7e585554b28d9b7c9aa299b105c09f66\Act.Data.Resources.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Act.Data.ActDb\0f66bf416f375b7e90f50bb07f832445\Act.Data.ActDb.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Act.Data\e81ea38cd416b481949046a57d5fd181\Act.Data.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.ServiceProce#\abef85f2fb8ba830eda73e2d12e8d41e\System.ServiceProcess.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.EnterpriseSe#\69792bef8a100a055db88848836a7d88\System.EnterpriseServices.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Transactions\8efcd633af87989355382b5039f1b7df\System.Transactions.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Data\ec323cf1df697cc0a45f67de685db90c\System.Data.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\71a2ae9ad561a62181cbd9fb11e9de7a\System.Windows.Forms.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Drawing\c10bea3c4bb7ef654651141bf9419090\System.Drawing.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\WindowsBase\1adc4ae51a5ac63e896a1402749ca495\WindowsBase.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Xml\70cacc44f0b4257f6037eda7a59a0aeb\System.Xml.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Configuration\bce0720436dc6cb76006377f295ea365\System.Configuration.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System\af39f6e644af02873b9bae319f2bfb13\System.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\mscorlib\ca87ba84221991839abbe7d4bc9c6721\mscorlib.ni.dll ()
MOD - C:\WINDOWS\system32\HP1100LM.DLL ()
MOD - C:\WINDOWS\system32\spool\prtprocs\w32x86\HP1100PP.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\Act.Outlook.Service.Shared\11.1.183.0__ebf6b2ff4d0a08aa\Act.Outlook.Service.Shared.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\Act.Outlook.Service.Desktop\11.1.183.0__ebf6b2ff4d0a08aa\Act.Outlook.Service.Desktop.dll ()
MOD - C:\WINDOWS\assembly\GAC_32\Act.Outlook.Message.Reader\11.1.183.0__ebf6b2ff4d0a08aa\Act.Outlook.Message.Reader.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\Act.Outlook.Service.AppCommon\11.1.183.0__ebf6b2ff4d0a08aa\Act.Outlook.Service.AppCommon.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\Act.Outlook.Service.Interfaces\11.1.183.0__ebf6b2ff4d0a08aa\Act.Outlook.Service.Interfaces.dll ()
MOD - C:\Program Files\Intel\Intel® Rapid Storage Technology\IsdiInterop.dll ()
MOD - C:\Program Files\Adobe\Acrobat 9.0\Acrobat\AcroTray.DEU ()
MOD - C:\Program Files\Adobe\Acrobat 9.0\Acrobat\AcroTray.FRA ()
MOD - C:\Program Files\Dell\Dell ControlPoint\Connection Manager\UCMPlugin\SmithMicro.Common.dll ()
MOD - C:\Program Files\Dell\Dell ControlPoint\Connection Manager\SMProfileManager.dll ()
MOD - C:\Program Files\Dell\Dell ControlPoint\Connection Manager\Dell.SharedUI.dll ()
MOD - C:\Program Files\Dell\Dell ControlPoint\Connection Manager\SMMessages.dll ()
MOD - C:\Program Files\Dell\Dell ControlPoint\Connection Manager\SmithMicro.AsyncOperations.dll ()
MOD - C:\Program Files\Dell\Dell ControlPoint\Connection Manager\VpnWrapper.dll ()
MOD - C:\Program Files\Dell\Dell ControlPoint\Connection Manager\SmithMicro.VpnController.dll ()
MOD - C:\Program Files\Dell\Dell ControlPoint\Connection Manager\SmithMicro.Application.dll ()
MOD - C:\Program Files\Dell\Dell ControlPoint\Connection Manager\SmithMicro.Message.dll ()
MOD - C:\Program Files\Dell\Dell ControlPoint\Connection Manager\SmithMicro.Common.dll ()
MOD - C:\Program Files\Dell\Dell ControlPoint\Dell.DcpPlugin.dll ()
MOD - C:\Program Files\Dell\Dell ControlPoint\SmithMicro.Common.dll ()
MOD - C:\WINDOWS\system32\btwicons.dll ()
MOD - C:\WINDOWS\system32\Wavx_ESC_Logging.dll ()
MOD - C:\WINDOWS\system32\wxvault.dll ()
MOD - C:\Program Files\ACT\Act for Windows\PSIClient.dll ()
MOD - C:\WINDOWS\system32\msdmo.dll ()
MOD - C:\Program Files\NTRU Cryptosystems\NTRU TCG Software Stack\bin\TspPopup_ENU.dll ()

========== Win32 Services (SafeList) ==========

SRV - (slee_503_service) – %systemroot%\system32\AMDPCI.dll File not found
SRV - (pavprsrv) – %systemroot%\system32\rasacd.dll File not found
SRV - (nwcworkstation) – %systemroot%\system32\yats32.dll File not found
SRV - (idebusdr) – %systemroot%\system32\dlbu_device.dll File not found
SRV - (AdobeFlashPlayerUpdateSvc) – C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe (Adobe Systems Incorporated)
SRV - (JavaQuickStarterService) – C:\Program Files\Oracle\JavaFX 2.1 Runtime\bin\jqs.exe (Oracle Corporation)
SRV - (RumorServer) – C:\Program Files\McAfee\Managed VirusScan\Agent\myAgtSvc.exe (McAfee, Inc.)
SRV - (myAgtSvc) – C:\Program Files\McAfee\Managed VirusScan\Agent\myAgtSvc.exe (McAfee, Inc.)
SRV - (McShield) – C:\Program Files\Common Files\McAfee\SystemCore\\mcshield.exe ()
SRV - (mfevtp) – C:\WINDOWS\system32\mfevtps.exe (McAfee, Inc.)
SRV - (McAfee SiteAdvisor Enterprise Service) – C:\Program Files\McAfee\SiteAdvisor Enterprise\McSACore.exe (McAfee, Inc.)
SRV - (HPSIService) – C:\WINDOWS\system32\HPSIsvc.exe (HP)
SRV - (FLEXnet Licensing Service) – C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe (Macrovision Europe Ltd.)
SRV - (XobniService) – C:\Program Files\Xobni\XobniService.exe (Xobni Corporation)
SRV - (LBTServ) – C:\Program Files\Common Files\LogiShrd\Bluetooth\LBTServ.exe (Logitech, Inc.)
SRV - (STacSV) – c:\drivers\audio\R267815\payload\WDM\stacsv.exe (IDT, Inc.)
SRV - (IAStorDataMgrSvc) Intel® – C:\Program Files\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe (Intel Corporation)
SRV - (ACT! Scheduler) – C:\Program Files\ACT\Act for Windows\Act.Scheduler.exe (Sage Software, Inc.)
SRV - (Credential Vault Host Storage) – C:\Program Files\Broadcom Corporation\Broadcom USH Host Components\CV\bin\HostStorageService.exe (Broadcom Corporation)
SRV - (Credential Vault Host Control Service) – C:\Program Files\Broadcom Corporation\Broadcom USH Host Components\CV\bin\HostControlService.exe (Broadcom Corporation)
SRV - (dcpsysmgrsvc) – C:\Program Files\Dell\Dell ControlPoint\System Manager\DCPSysMgrSvc.exe (Dell Inc.)
SRV - (YahooAUService) – C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe (Yahoo! Inc.)
SRV - (SMManager) – C:\Program Files\Dell\Dell ControlPoint\Connection Manager\SMManager.exe (Smith Micro Software, Inc.)
SRV - (buttonsvc32) – C:\Program Files\Dell\Dell ControlPoint\DCPButtonSvc.exe (Dell Inc.)
SRV - (TdmService) – C:\Program Files\Wave Systems Corp\Trusted Drive Manager\TdmService.exe (Wave Systems Corp.)
SRV - (SecureStorageService) – C:\Program Files\Wave Systems Corp\Secure Storage Manager\SecureStorageService.exe (Wave Systems Corp.)
SRV - (tcsd_win32.exe) – C:\Program Files\NTRU Cryptosystems\NTRU TCG Software Stack\bin\tcsd_win32.exe ()
SRV - (PSI_SVC_2) – C:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe (Protexis Inc.)
SRV - (ASFAgent) – C:\Program Files\Intel\ASF Agent\ASFAgent.exe (Intel Corporation)

========== Driver Services (SafeList) ==========

DRV - (WinDriver6) – system32\drivers\windrvr6.sys File not found
DRV - (WDICA) – File not found
DRV - (TRMUSB5K) – system32\drivers\TRMUSB5K.sys File not found
DRV - (PDRFRAME) – File not found
DRV - (PDRELI) – File not found
DRV - (PDFRAME) – File not found
DRV - (PDCOMP) – File not found
DRV - (PCIDump) – File not found
DRV - (mfeavfk01) – File not found
DRV - (mbr) – C:\DOCUME~1\jzipkin\LOCALS~1\Temp\mbr.sys File not found
DRV - (lbrtfdc) – File not found
DRV - (Changer) – File not found
DRV - (CFcatchme) – C:\DOCUME~1\jzipkin\LOCALS~1\Temp\CFcatchme.sys File not found
DRV - (catchme) – C:\ComboFix\catchme.sys File not found
DRV - (RsFx0105) – C:\WINDOWS\system32\drivers\RsFx0105.sys (Microsoft Corporation)
DRV - (mfehidk) – C:\WINDOWS\system32\drivers\mfehidk.sys (McAfee, Inc.)
DRV - (MfeAVFK) – C:\WINDOWS\system32\drivers\mfeavfk.sys (McAfee, Inc.)
DRV - (mfeapfk) – C:\WINDOWS\system32\drivers\mfeapfk.sys (McAfee, Inc.)
DRV - (mfetdi2k) – C:\WINDOWS\system32\drivers\mfetdi2k.sys (McAfee, Inc.)
DRV - (mferkdet) – C:\WINDOWS\system32\drivers\mferkdet.sys (McAfee, Inc.)
DRV - (MfeBOPK) – C:\WINDOWS\system32\drivers\mfebopk.sys (McAfee, Inc.)
DRV - (SMSIVZAM5) – C:\Program Files\Verizon Wireless\VZAccess Manager\SMSIVZAM5.sys (Smith Micro Inc.)
DRV - (STHDA) – C:\WINDOWS\system32\drivers\sthda.sys (IDT, Inc.)
DRV - (AESTAud) – C:\WINDOWS\system32\drivers\AESTAud.sys (Andrea Electronics Corporation)
DRV - (LMouFilt) – C:\WINDOWS\system32\drivers\LMouFilt.Sys (Logitech, Inc.)
DRV - (LHidFilt) – C:\WINDOWS\system32\drivers\LHidFilt.Sys (Logitech, Inc.)
DRV - (LBeepKE) – C:\WINDOWS\system32\drivers\LBeepKE.sys (Logitech, Inc.)
DRV - (ApfiltrService) – C:\WINDOWS\system32\drivers\Apfiltr.sys (Alps Electric Co., Ltd.)
DRV - (OA001Vid) – C:\WINDOWS\system32\drivers\OA001Vid.sys (Creative Technology Ltd.)
DRV - (NWUSBCDFIL) – C:\WINDOWS\system32\drivers\NwUsbCdFil.sys (Novatel Wireless Inc.)
DRV - (NWADI) – C:\WINDOWS\system32\drivers\NWADIenum.sys (Novatel Wireless Inc)
DRV - (NWUSBPort2) – C:\WINDOWS\system32\drivers\nwusbser2.sys (Novatel Wireless Inc.)
DRV - (NWUSBPort) – C:\WINDOWS\system32\drivers\nwusbser.sys (Novatel Wireless Inc.)
DRV - (NWUSBModem) – C:\WINDOWS\system32\drivers\nwusbmdm.sys (Novatel Wireless Inc.)
DRV - (mfetdik) – C:\WINDOWS\system32\drivers\mfetdik.sys (McAfee, Inc.)
DRV - (MfeRKDK) – C:\WINDOWS\system32\drivers\mferkdk.sys (McAfee, Inc.)
DRV - (NAL) – C:\WINDOWS\system32\drivers\iqvw32.sys (Intel Corporation )
DRV - (e1yexpress) Intel® – C:\WINDOWS\system32\drivers\e1y5132.sys (Intel Corporation)
DRV - (OA001Afx) – C:\WINDOWS\system32\drivers\OA001Afx.sys (Creative Technology Ltd.)
DRV - (rimmptsk) – C:\WINDOWS\system32\drivers\rimmptsk.sys (REDC)
DRV - (OA001Ufd) – C:\WINDOWS\system32\drivers\OA001Ufd.sys (Creative Technology Ltd.)
DRV - (cvusbdrv) – C:\WINDOWS\system32\drivers\cvusbdrv.sys (Broadcom Corporation)
DRV - (USBCCID) – C:\WINDOWS\system32\drivers\usbccid.sys (Microsoft Corporation)
DRV - (CCIDFILTER) – C:\WINDOWS\system32\drivers\ccidflt.sys (Broadcom Corporation)
DRV - (BCM43XX) – C:\WINDOWS\system32\drivers\BCMWL5.SYS (Broadcom Corporation)
DRV - (btwmodem) – C:\WINDOWS\system32\drivers\btwmodem.sys (Broadcom Corporation.)
DRV - (btwhid) – C:\WINDOWS\system32\drivers\btwhid.sys (Broadcom Corporation.)
DRV - (BTWDNDIS) – C:\WINDOWS\system32\drivers\btwdndis.sys (Broadcom Corporation.)
DRV - (BTDriver) – C:\WINDOWS\system32\drivers\btport.sys (Broadcom Corporation.)
DRV - (BTKRNL) – C:\WINDOWS\system32\drivers\btkrnl.sys (Broadcom Corporation.)
DRV - (btaudio) – C:\WINDOWS\system32\drivers\btaudio.sys (Broadcom Corporation.)
DRV - (BTWUSB) – C:\WINDOWS\system32\drivers\btwusb.sys (Broadcom Corporation.)
DRV - (WavxDMgr) – C:\WINDOWS\system32\drivers\WavxDMgr.sys (Wave Systems Corp.)
DRV - (PBADRV) – C:\WINDOWS\system32\drivers\PBADRV.sys (Dell Inc)
DRV - (USA19H) – C:\WINDOWS\system32\drivers\USA19H2k.sys (Keyspan)
DRV - (USA19H2KP) – C:\WINDOWS\system32\drivers\USA19H2kp.sys (Keyspan)
DRV - (TrmbTS) – C:\WINDOWS\system32\drivers\TrmbTS.sys (Trimble AB, Sweden)
DRV - (PCASp50) – C:\WINDOWS\system32\drivers\PCASp50.sys (Printing Communications Assoc., Inc. (PCAUSA))
DRV - (Sentinel) – C:\WINDOWS\system32\drivers\sentinel.sys (Rainbow Technologies, Inc.)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Help_Page = http://support.dell.com/support/index.aspx…;l=en&s=gen
IE - HKLM\..\SearchScopes,DefaultScope = {9BB47C17-9C68-4BB3-B188-DD9AF0FD2410}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://search.live.com/results.aspx?q={sea…ferrer:source?}
IE - HKLM\..\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2410}: "URL" = http://dts.search-results.com/sr?src=ieb&a;…q={searchTerms}

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://my.yahoo.com/
IE - HKCU\..\URLSearchHook: {81017EA9-9AA8-4A6A-9734-7AF40E7D593F} - C:\Program Files\Yahoo!\Companion\Installs\cpn3\yt.dll (Yahoo! Inc.)
IE - HKCU\..\SearchScopes,DefaultScope = {1866F458-8483-4815-BAD5-D7640059E447}
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}…amp;FORM=IE8SRC
IE - HKCU\..\SearchScopes\{1866F458-8483-4815-BAD5-D7640059E447}: "URL" = http://www.google.com/search?q={searchTerm…utputEncoding?}
IE - HKCU\..\SearchScopes\{7AB1F9F9-BDC2-46CC-9008-2CB7C62AB53E}: "URL" = http://search.yahoo.com/search?p={searchTe…ge?}&fr=ie8
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

========== FireFox ==========

FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\WINDOWS\system32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.4.1: C:\WINDOWS\system32\npDeployJava1.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.4.1: C:\Program Files\Oracle\JavaFX 2.1 Runtime\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@messenger.yahoo.com/YahooMessengerStatePlugin;version=1.0.0.6: C:\Program Files\Yahoo!\Shared\npYState.dll (Yahoo! Inc.)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\4.1.10111.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@real.com/nppl3260;version=12.0.1.647: c:\program files\real\realplayer\Netscape6\nppl3260.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprjplug;version=12.0.1.647: c:\program files\real\realplayer\Netscape6\nprjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprpchromebrowserrecordext;version=12.0.1.652: C:\Documents and Settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprpchromebrowserrecordext.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprphtml5videoshim;version=12.0.1.652: C:\Documents and Settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprpjplug;version=12.0.1.647: c:\program files\real\realplayer\Netscape6\nprpjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nsJSRealPlayerPlugin;version=: File not found
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.111\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.111\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@veetle.com/vbp;version=0.9.17: C:\Program Files\Veetle\VLCBroadcast\npvbp.dll File not found
FF - HKLM\Software\MozillaPlugins\Adobe Acrobat: C:\Program Files\Adobe\Acrobat 9.0\Acrobat\Air\nppdf32.dll (Adobe Systems Inc.)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKCU\Software\MozillaPlugins\@Skype Limited.com/Facebook Video Calling Plugin: C:\Documents and Settings\jzipkin\Local Settings\Application Data\Facebook\Video\Skype\npFacebookVideoCalling.dll (Skype Limited)
FF - HKCU\Software\MozillaPlugins\@unity3d.com/UnityPlayer,version=1.0: C:\Documents and Settings\jzipkin\Local Settings\Application Data\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS)
FF - HKCU\Software\MozillaPlugins\@yahoo.com/BrowserPlus,version=2.9.8: C:\Documents and Settings\jzipkin\Local Settings\Application Data\Yahoo!\BrowserPlus\2.9.8\Plugins\npybrowserplus_2.9.8.dll (Yahoo! Inc.)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{ABDE892B-13A8-4d1b-88E6-365A6E755758}: C:\Documents and Settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext [2011/06/29 11:23:39 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{B7082FAA-CB62-4872-9106-E42DD88EDE45}: C:\Program Files\McAfee\SiteAdvisor Enterprise\ [2011/08/23 13:10:08 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{D19CA586-DD6C-4a0a-96F8-14644F340D60}: C:\Program Files\Common Files\McAfee\SystemCore [2011/09/19 20:00:24 | 000,000,000 | —D | M]

O1 HOSTS File: ([2012/06/22 10:43:28 | 000,000,027 | —- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (&Yahoo! Toolbar Helper) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn3\yt.dll (Yahoo! Inc.)
O2 - BHO: (RealPlayer Download and Record Plugin for Internet Explorer) - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Documents and Settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll (RealPlayer)
O2 - BHO: (Java™ Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Oracle\JavaFX 2.1 Runtime\bin\ssv.dll (Oracle Corporation)
O2 - BHO: (scriptproxy) - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\Common Files\McAfee\SystemCore\ScriptSn.20110919093418.dll (McAfee, Inc.)
O2 - BHO: (Adobe PDF Conversion Toolbar Helper) - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O2 - BHO: (McAfee SiteAdvisor BHO) - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - C:\Program Files\McAfee\SiteAdvisor Enterprise\McIEPlg.dll (McAfee, Inc.)
O2 - BHO: (Java™ Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Oracle\JavaFX 2.1 Runtime\bin\jp2ssv.dll (Oracle Corporation)
O2 - BHO: (SmartSelect Class) - {F4971EE7-DAA0-4053-9964-665D8EE6A077} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O2 - BHO: (SingleInstance Class) - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files\Yahoo!\Companion\Installs\cpn1\YTSingleInstance.dll (Yahoo! Inc)
O3 - HKLM\..\Toolbar: (McAfee SiteAdvisor Toolbar) - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - C:\Program Files\McAfee\SiteAdvisor Enterprise\McIEPlg.dll (McAfee, Inc.)
O3 - HKLM\..\Toolbar: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O3 - HKLM\..\Toolbar: (Yahoo! Toolbar) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn3\yt.dll (Yahoo! Inc.)
O3 - HKCU\..\Toolbar\WebBrowser: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O4 - HKLM..\Run: [Acrobat Assistant 8.0] C:\Program Files\Adobe\Acrobat 9.0\Acrobat\Acrotray.exe (Adobe Systems Inc.)
O4 - HKLM..\Run: [Act! Preloader] C:\Program Files\ACT\Act for Windows\ActSage.exe (Sage Software, Inc.)
O4 - HKLM..\Run: [Act.Outlook.Service] C:\Program Files\ACT\Act for Windows\Act.Outlook.Service.exe (Sage Software, Inc.)
O4 - HKLM..\Run: [Adobe Acrobat Speed Launcher] C:\Program Files\Adobe\Acrobat 9.0\Acrobat\Acrobat_sl.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [AESTFltr] C:\WINDOWS\System32\AESTFltr.exe (Andrea Electronics Corporation)
O4 - HKLM..\Run: [Apoint] C:\Program Files\DellTPad\Apoint.exe (Alps Electric Co., Ltd.)
O4 - HKLM..\Run: [APSDaemon] C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
O4 - HKLM..\Run: [ChangeTPMAuth] C:\Program Files\Wave Systems Corp\Common\ChangeTPMAuth.exe (Wave Systems Corp.)
O4 - HKLM..\Run: [DCPstrApp] C:\Program Files\Dell\Dell ControlPoint\Security Manager\SecurityDeviceInfoSetRegistryString.exe (Broadcom Corporation)
O4 - HKLM..\Run: [Dell Webcam Central] C:\Program Files\Dell Webcam\Dell Webcam Central\WebcamDell.exe (Creative Technology Ltd.)
O4 - HKLM..\Run: [DellConnectionManager] C:\Program Files\Dell\Dell ControlPoint\Connection Manager\Dell.UCM.exe (Smith Micro Software, Inc.)
O4 - HKLM..\Run: [DellControlPoint] C:\Program Files\Dell\Dell ControlPoint\Dell.ControlPoint.exe (Dell, Inc.)
O4 - HKLM..\Run: [EmbassySecurityCheck] C:\Program Files\Wave Systems Corp\EMBASSY Security Setup\EMBASSYSecurityCheck.exe (Wave Systems Corp.)
O4 - HKLM..\Run: [EvtMgr6] C:\Program Files\Logitech\SetPointP\SetPoint.exe (Logitech, Inc.)
O4 - HKLM..\Run: [IAStorIcon] C:\Program Files\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe (Intel Corporation)
O4 - HKLM..\Run: [MVS Splash] C:\Program Files\McAfee\Managed VirusScan\DesktopUI\XTray.exe (McAfee, Inc.)
O4 - HKLM..\Run: [NvCplDaemon] C:\WINDOWS\System32\NvCpl.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [NVHotkey] C:\WINDOWS\System32\nvhotkey.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [NvMediaCenter] C:\WINDOWS\System32\NvMcTray.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [nwiz] C:\WINDOWS\System32\nwiz.exe ()
O4 - HKLM..\Run: [OA001Mon] C:\WINDOWS\OA001Mon.exe (Creative Technology Ltd.)
O4 - HKLM..\Run: [SecureUpgrade] C:\Program Files\Wave Systems Corp\SecureUpgrade.exe (Wave Systems Corp.)
O4 - HKLM..\Run: [SysTrayApp] C:\Program Files\IDT\WDM\sttray.exe (IDT, Inc.)
O4 - HKLM..\Run: [TkBellExe] C:\program files\real\realplayer\update\realsched.exe (RealNetworks, Inc.)
O4 - HKLM..\Run: [WavXMgr] C:\Program Files\Wave Systems Corp\Services Manager\DocMgr\bin\WavXDocMgr.exe (Wave Systems Corp.)
O4 - HKLM..\Run: [YMailAdvisor] C:\Program Files\Yahoo!\Common\YMailAdvisor.exe (Yahoo! Inc.)
O4 - HKCU..\Run: [Facebook Update] C:\Documents and Settings\jzipkin\Local Settings\Application Data\Facebook\Update\FacebookUpdate.exe (Facebook Inc.)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Bluetooth.lnk = C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe (Broadcom Corporation.)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Dell ControlPoint System Manager.lnk = C:\Program Files\Dell\Dell ControlPoint\System Manager\DCPSysMgr.exe (Dell Inc.)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoWelcomeScreen = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoControlPanel = 0
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O8 - Extra context menu item: Append Link Target to Existing PDF - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Append to Existing PDF - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Convert Link Target to Adobe PDF - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Convert to Adobe PDF - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Send to &Bluetooth Device… - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm ()
O8 - Extra context menu item: Send To Bluetooth - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O9 - Extra Button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O9 - Extra 'Tools' menuitem : @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O15 - HKLM\..Trusted Domains: //about.htm/ ([]myui in Trusted sites)
O15 - HKLM\..Trusted Domains: //Exclude.htm/ ([]myui in Trusted sites)
O15 - HKLM\..Trusted Domains: //LanguageSelection.htm/ ([]myui in Trusted sites)
O15 - HKLM\..Trusted Domains: //Message.htm/ ([]myui in Trusted sites)
O15 - HKLM\..Trusted Domains: //MyAgttryCmd.htm/ ([]myui in Trusted sites)
O15 - HKLM\..Trusted Domains: //MyAgttryNag.htm/ ([]myui in Trusted sites)
O15 - HKLM\..Trusted Domains: //MyNotification.htm/ ([]myui in Trusted sites)
O15 - HKLM\..Trusted Domains: //NOCLessUpdate.htm/ ([]myui in Trusted sites)
O15 - HKLM\..Trusted Domains: //quarantine.htm/ ([]myui in Trusted sites)
O15 - HKLM\..Trusted Domains: //ScanNow.htm/ ([]myui in Trusted sites)
O15 - HKLM\..Trusted Domains: //strings.vbs/ ([]myui in Trusted sites)
O15 - HKLM\..Trusted Domains: //Template.htm/ ([]myui in Trusted sites)
O15 - HKLM\..Trusted Domains: //Update.htm/ ([]myui in Trusted sites)
O15 - HKLM\..Trusted Domains: //VirFound.htm/ ([]myui in Trusted sites)
O15 - HKLM\..Trusted Domains: mcafee.com ([*]http in Trusted sites)

O15 - HKLM\..Trusted Domains: mcafee.com ([*]https in Trusted sites)

O15 - HKLM\..Trusted Domains: mcafeeasap.com ([betavscan] http in Trusted sites)
O15 - HKLM\..Trusted Domains: mcafeeasap.com ([betavscan] https in Trusted sites)
O15 - HKLM\..Trusted Domains: mcafeeasap.com ([vs] http in Trusted sites)
O15 - HKLM\..Trusted Domains: mcafeeasap.com ([vs] https in Trusted sites)
O15 - HKLM\..Trusted Domains: mcafeeasap.com ([www] http in Trusted sites)
O15 - HKLM\..Trusted Domains: mcafeeasap.com ([www] https in Trusted sites)
O16 - DPF: {02BCC737-B171-4746-94C9-0D8A0B2C0089} http://office.microsoft.com/sites/production/ieawsdc32.cab (Microsoft Office Template and Media Control)
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} http://download.macromedia.com/pub/shockwa…director/sw.cab (Shockwave ActiveX Control)
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} C:\Program Files\Yahoo!\Common\Yinsthelper.dll (Installation Support)
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} http://www.update.microsoft.com/microsoftu…b?1307550125529 (MUWebControl Class)
O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} http://download.eset.com/special/eos/OnlineScanner.cab (Reg Error: Key error.)
O16 - DPF: {C1FDEE68-98D5-4F42-A4DD-D0BECF5077EB} http://tools.ebayimg.com/eps/wl/activex/eB…l_v1-0-31-0.cab (EPUImageControl Class)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = waypoint.local
O18 - Protocol\Handler\dssrequest {5513F07E-936B-4E52-9B00-067394E91CC5} - C:\Program Files\McAfee\SiteAdvisor Enterprise\McIEPlg.dll (McAfee, Inc.)
O18 - Protocol\Handler\myrm {4D034FC3-013F-4b95-B544-44D49ABE3E76} - C:\Program Files\McAfee\Managed VirusScan\Agent\MyRmProt5.0.0.811.dll (McAfee, Inc.)
O18 - Protocol\Handler\sacore {5513F07E-936B-4E52-9B00-067394E91CC5} - C:\Program Files\McAfee\SiteAdvisor Enterprise\McIEPlg.dll (McAfee, Inc.)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) - C:\WINDOWS\system32\userinit.exe (Microsoft Corporation)
O20 - Winlogon\Notify\LBTWlgn: DllName - (c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll) - c:\Program Files\Common Files\LogiShrd\Bluetooth\LBTWLgn.dll (Logitech, Inc.)
O24 - Desktop WallPaper: C:\Documents and Settings\jzipkin\Application Data\Microsoft\Internet Explorer\Internet Explorer Wallpaper.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\jzipkin\Application Data\Microsoft\Internet Explorer\Internet Explorer Wallpaper.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2008/04/25 17:29:32 | 000,000,000 | —- | M] () - C:\AUTOEXEC.BAT – [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = ComFile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)

NetSvcs: 6to4 - File not found
NetSvcs: Ias - File not found
NetSvcs: Iprip - File not found
NetSvcs: Irmon - File not found
NetSvcs: NWCWorkstation - %systemroot%\system32\yats32.dll File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: pavprsrv - %systemroot%\system32\rasacd.dll File not found
NetSvcs: slee_503_service - %systemroot%\system32\AMDPCI.dll File not found
NetSvcs: idebusdr - %systemroot%\system32\dlbu_device.dll File not found
NetSvcs: slimsvc - File not found
NetSvcs: nwcworkstation - %systemroot%\system32\yats32.dll File not found
NetSvcs: PAC7302 - File not found
NetSvcs: WmdmPmSp - File not found

Drivers32: msacm.iac2 - C:\WINDOWS\system32\iac25_32.ax (Intel Corporation)
Drivers32: msacm.l3acm - C:\WINDOWS\system32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.sl_anet - C:\WINDOWS\System32\sl_anet.acm (Sipro Lab Telecom Inc.)
Drivers32: msacm.trspch - C:\WINDOWS\System32\tssoft32.acm (DSP GROUP, INC.)
Drivers32: MSVideo8 - C:\WINDOWS\System32\vfwwdm32.dll (Microsoft Corporation)
Drivers32: SENTINEL - C:\WINDOWS\System32\snti386.dll (Rainbow Technologies, Inc.)
Drivers32: vidc.cvid - C:\WINDOWS\System32\iccvid.dll (Radius Inc.)
Drivers32: vidc.iv31 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv32 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv41 - C:\WINDOWS\System32\ir41_32.ax (Intel Corporation)
Drivers32: vidc.iv50 - C:\WINDOWS\System32\ir50_32.dll (Intel Corporation)

CREATERESTOREPOINT
Restore point Set: OTL Restore Point

========== Files/Folders - Created Within 30 Days ==========

[2012/06/18 12:54:01 | 000,000,000 | —D | C] – C:\Config.Msi
[2012/06/12 10:11:47 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\Yahoo! Companion
[2012/06/08 13:46:58 | 000,595,456 | —- | C] (OldTimer Tools) – C:\Documents and Settings\jzipkin\Desktop\OTL.exe
[2012/06/08 09:44:27 | 004,731,392 | —- | C] (AVAST Software) – C:\Documents and Settings\jzipkin\Desktop\aswMBR.exe
[2012/06/07 13:38:18 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\Malwarebytes' Anti-Malware
[2012/06/07 13:38:15 | 000,022,344 | —- | C] (Malwarebytes Corporation) – C:\WINDOWS\System32\drivers\mbam.sys
[2012/06/07 12:14:22 | 010,063,000 | —- | C] (Malwarebytes Corporation ) – C:\Documents and Settings\jzipkin\Desktop\mbam-setup-1.61.0.1400.exe
[2012/06/07 12:13:21 | 000,446,464 | —- | C] (OldTimer Tools) – C:\Documents and Settings\jzipkin\Desktop\TFC.exe
[2012/06/06 11:08:44 | 000,518,144 | —- | C] (SteelWerX) – C:\WINDOWS\SWREG.exe
[2012/06/06 11:08:44 | 000,406,528 | —- | C] (SteelWerX) – C:\WINDOWS\SWSC.exe
[2012/06/06 11:08:44 | 000,212,480 | —- | C] (SteelWerX) – C:\WINDOWS\SWXCACLS.exe
[2012/06/06 11:08:44 | 000,060,416 | —- | C] (NirSoft) – C:\WINDOWS\NIRCMD.exe
[2012/06/06 11:08:27 | 000,000,000 | —D | C] – C:\Qoobox
[2012/06/06 11:02:08 | 000,000,000 | —D | C] – C:\Documents and Settings\jzipkin\Desktop\tdsskiller
[2012/06/05 09:30:09 | 000,000,000 | —D | C] – C:\Documents and Settings\jzipkin\Desktop\JZpersonal

========== Files - Modified Within 30 Days ==========

[2012/06/25 16:02:31 | 000,000,290 | —- | M] () – C:\WINDOWS\tasks\RealUpgradeScheduledTaskS-1-5-21-308600077-3542235570-3293604796-1145.job
[2012/06/25 16:02:31 | 000,000,282 | —- | M] () – C:\WINDOWS\tasks\RealUpgradeLogonTaskS-1-5-21-308600077-3542235570-3293604796-1145.job
[2012/06/25 15:27:00 | 000,000,888 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2012/06/25 15:24:00 | 000,000,830 | —- | M] () – C:\WINDOWS\tasks\Adobe Flash Player Updater.job
[2012/06/25 14:48:54 | 000,001,994 | -HS- | M] () – C:\Documents and Settings\All Users\Application Data\KGyGaAvL.sys
[2012/06/25 14:27:00 | 000,000,884 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2012/06/25 13:51:00 | 000,001,006 | —- | M] () – C:\WINDOWS\tasks\FacebookUpdateTaskUserS-1-5-21-308600077-3542235570-3293604796-1145UA.job
[2012/06/25 13:51:00 | 000,000,984 | —- | M] () – C:\WINDOWS\tasks\FacebookUpdateTaskUserS-1-5-21-308600077-3542235570-3293604796-1145Core.job
[2012/06/25 10:36:45 | 000,002,539 | —- | M] () – C:\Documents and Settings\jzipkin\Application Data\Microsoft\Internet Explorer\Quick Launch\Microsoft Office Outlook 2007.lnk
[2012/06/25 09:13:57 | 000,090,083 | —- | M] () – C:\Documents and Settings\jzipkin\My Documents\scrsht.pdf
[2012/06/25 08:44:42 | 000,203,657 | —- | M] () – C:\WINDOWS\System32\nvModes.001
[2012/06/22 10:45:34 | 000,560,798 | —- | M] () – C:\WINDOWS\System32\perfh009.dat
[2012/06/22 10:45:34 | 000,117,144 | —- | M] () – C:\WINDOWS\System32\perfc009.dat
[2012/06/22 10:45:01 | 000,000,008 | RHS- | M] () – C:\Documents and Settings\All Users\Application Data\8615B8621C.sys
[2012/06/22 10:44:16 | 000,000,000 | —- | M] () – C:\Documents and Settings\jzipkin\Local Settings\Application Data\WavXMapDrive.bat
[2012/06/22 10:43:59 | 000,243,584 | —- | M] () – C:\WINDOWS\System32\NvApps.xml
[2012/06/22 10:43:28 | 000,000,027 | —- | M] () – C:\WINDOWS\System32\drivers\etc\hosts
[2012/06/22 10:43:13 | 000,001,158 | —- | M] () – C:\WINDOWS\System32\wpa.dbl
[2012/06/22 10:31:46 | 000,002,048 | –S- | M] () – C:\WINDOWS\bootstat.dat
[2012/06/22 10:31:36 | 3745,406,976 | -HS- | M] () – C:\hiberfil.sys
[2012/06/19 12:22:36 | 000,000,338 | —- | M] () – C:\Documents and Settings\jzipkin\Desktop\533392-00110-5031493382.lic
[2012/06/18 10:12:12 | 000,426,184 | —- | M] (Adobe Systems Incorporated) – C:\WINDOWS\System32\FlashPlayerApp.exe
[2012/06/18 10:12:11 | 000,070,344 | —- | M] (Adobe Systems Incorporated) – C:\WINDOWS\System32\FlashPlayerCPLApp.cpl
[2012/06/13 14:09:58 | 000,000,143 | —- | M] () – C:\WINDOWS\TRIMSURV.INI
[2012/06/12 09:31:26 | 000,000,664 | —- | M] () – C:\WINDOWS\System32\d3d9caps.dat
[2012/06/08 13:46:58 | 000,595,456 | —- | M] (OldTimer Tools) – C:\Documents and Settings\jzipkin\Desktop\OTL.exe
[2012/06/08 10:53:34 | 000,058,520 | —- | M] () – C:\Documents and Settings\jzipkin\Desktop\all
[2012/06/08 10:14:38 | 000,000,559 | —- | M] () – C:\Documents and Settings\jzipkin\Desktop\MBR.zip
[2012/06/08 10:13:51 | 000,000,512 | —- | M] () – C:\Documents and Settings\jzipkin\Desktop\MBR.dat
[2012/06/08 09:44:40 | 004,731,392 | —- | M] (AVAST Software) – C:\Documents and Settings\jzipkin\Desktop\aswMBR.exe
[2012/06/07 13:38:18 | 000,000,788 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Malwarebytes Anti-Malware.lnk
[2012/06/07 12:14:28 | 010,063,000 | —- | M] (Malwarebytes Corporation ) – C:\Documents and Settings\jzipkin\Desktop\mbam-setup-1.61.0.1400.exe
[2012/06/07 12:13:21 | 000,446,464 | —- | M] (OldTimer Tools) – C:\Documents and Settings\jzipkin\Desktop\TFC.exe
[2012/06/06 11:01:04 | 002,108,959 | —- | M] () – C:\Documents and Settings\jzipkin\Desktop\tdsskiller.zip
[2012/06/05 14:15:54 | 000,388,608 | —- | M] (Trend Micro Inc.) – C:\Documents and Settings\jzipkin\Desktop\HiJackThis.exe
[2012/06/05 12:59:21 | 000,006,144 | —- | M] () – C:\Documents and Settings\jzipkin\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

========== Files Created - No Company Name ==========

[2012/06/25 09:13:57 | 000,090,083 | —- | C] () – C:\Documents and Settings\jzipkin\My Documents\scrsht.pdf
[2012/06/22 10:45:01 | 000,000,008 | RHS- | C] () – C:\Documents and Settings\All Users\Application Data\8615B8621C.sys
[2012/06/19 14:00:48 | 000,000,338 | —- | C] () – C:\Documents and Settings\jzipkin\Desktop\533392-00110-5031493382.lic
[2012/06/13 10:25:41 | 004,819,655 | —- | C] () – C:\Documents and Settings\jzipkin\Desktop\backupimg.pbf
[2012/06/08 10:53:32 | 000,058,520 | —- | C] () – C:\Documents and Settings\jzipkin\Desktop\all
[2012/06/08 10:14:38 | 000,000,559 | —- | C] () – C:\Documents and Settings\jzipkin\Desktop\MBR.zip
[2012/06/08 10:13:51 | 000,000,512 | —- | C] () – C:\Documents and Settings\jzipkin\Desktop\MBR.dat
[2012/06/07 13:38:18 | 000,000,788 | —- | C] () – C:\Documents and Settings\All Users\Desktop\Malwarebytes Anti-Malware.lnk
[2012/06/06 11:08:44 | 000,256,000 | —- | C] () – C:\WINDOWS\PEV.exe
[2012/06/06 11:08:44 | 000,208,896 | —- | C] () – C:\WINDOWS\MBR.exe
[2012/06/06 11:08:44 | 000,098,816 | —- | C] () – C:\WINDOWS\sed.exe
[2012/06/06 11:08:44 | 000,080,412 | —- | C] () – C:\WINDOWS\grep.exe
[2012/06/06 11:08:44 | 000,068,096 | —- | C] () – C:\WINDOWS\zip.exe
[2012/06/06 11:00:57 | 002,108,959 | —- | C] () – C:\Documents and Settings\jzipkin\Desktop\tdsskiller.zip
[2012/05/25 11:49:01 | 000,484,352 | —- | C] () – C:\WINDOWS\System32\lame_enc.dll
[2012/03/21 09:57:40 | 000,270,848 | —- | C] () – C:\WINDOWS\System32\unwise32.exe
[2011/12/29 16:47:18 | 001,511,424 | —- | C] () – C:\WINDOWS\System32\HP1100SM.EXE
[2011/12/29 16:47:18 | 000,151,552 | —- | C] () – C:\WINDOWS\System32\HP1100LM.DLL
[2011/12/29 16:46:46 | 000,284,160 | —- | C] () – C:\WINDOWS\System32\mvhlewsi.DLL
[2011/12/29 16:46:38 | 000,047,104 | —- | C] () – C:\WINDOWS\System32\HP1100SMs.dll
[2011/11/04 16:18:01 | 000,000,664 | —- | C] () – C:\WINDOWS\System32\d3d9caps.dat
[2011/10/25 12:36:01 | 000,000,133 | —- | C] () – C:\Documents and Settings\All Users\Application Data\Microsoft.SqlServer.Compact.351.32.bc
[2011/07/29 09:26:25 | 000,015,188 | -HS- | C] () – C:\Documents and Settings\jzipkin\Local Settings\Application Data\4jt08j3453lv6eerv3ryh58wlpwkbx274umkyc5s2batk27
[2011/07/29 09:26:25 | 000,015,188 | -HS- | C] () – C:\Documents and Settings\All Users\Application Data\4jt08j3453lv6eerv3ryh58wlpwkbx274umkyc5s2batk27
[2011/04/19 14:30:22 | 000,000,041 | —- | C] () – C:\WINDOWS\ArcPad.INI
[2010/11/29 15:01:51 | 000,006,144 | —- | C] () – C:\Documents and Settings\jzipkin\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010/09/08 12:33:15 | 000,000,000 | —- | C] () – C:\WINDOWS\SSFEdit.INI
[2010/09/08 10:54:16 | 000,000,000 | —- | C] () – C:\WINDOWS\Check.INI
[2010/08/27 12:08:29 | 000,009,136 | —- | C] () – C:\WINDOWS\System32\INETWH16.DLL
[2010/08/13 15:56:37 | 000,049,152 | —- | C] () – C:\WINDOWS\System32\k19hinst.dll
[2010/07/28 13:01:55 | 000,000,025 | —- | C] () – C:\WINDOWS\cdplayer.ini
[2010/07/27 22:06:32 | 000,000,000 | —- | C] () – C:\WINDOWS\Export.INI
[2010/07/27 09:29:43 | 000,002,528 | —- | C] () – C:\Documents and Settings\jzipkin\Application Data\$_hpcst$.hpc
[2010/07/26 14:14:03 | 000,001,994 | -HS- | C] () – C:\Documents and Settings\All Users\Application Data\KGyGaAvL.sys
[2010/07/26 11:28:09 | 000,000,143 | —- | C] () – C:\WINDOWS\TRIMSURV.INI
[2010/07/23 14:20:07 | 000,000,000 | —- | C] () – C:\Documents and Settings\jzipkin\Local Settings\Application Data\WavXMapDrive.bat
[2010/07/22 13:24:24 | 000,000,061 | —- | C] () – C:\WINDOWS\smscfg.ini
[2010/07/22 13:11:54 | 000,279,888 | —- | C] () – C:\WINDOWS\System32\brcmbsp.dll
[2010/07/22 13:11:47 | 000,080,368 | —- | C] () – C:\WINDOWS\System32\pbadrvdll.dll
[2010/07/22 13:03:29 | 000,203,657 | —- | C] () – C:\WINDOWS\System32\nvModes.dat
[2010/07/22 12:48:45 | 000,064,200 | —- | C] () – C:\Documents and Settings\LocalService\Local Settings\Application Data\FontCache3.0.0.0.dat
[2010/07/21 17:27:17 | 001,584,326 | —- | C] () – C:\WINDOWS\System32\nvdata.bin
[2010/07/21 17:25:26 | 000,077,824 | —- | C] () – C:\WINDOWS\setpwr32.exe
[2010/07/21 17:23:40 | 000,001,156 | —- | C] () – C:\WINDOWS\System32\OEMINFO.INI

========== Custom Scans ==========

< >

< %SYSTEMDRIVE%\*.* >
[2012/01/04 17:27:56 | 000,000,268 | —- | M] () – C:\ab_1.gif
[2011/01/10 11:59:49 | 000,000,042 | —- | M] () – C:\alrt_204.data
[2011/07/27 15:40:50 | 000,065,484 | —- | M] () – C:\ASLog.txt
[2008/04/25 17:29:32 | 000,000,000 | —- | M] () – C:\AUTOEXEC.BAT
[2010/07/22 13:31:21 | 000,000,211 | —- | M] () – C:\Boot.bak
[2011/07/25 10:37:27 | 000,000,327 | RHS- | M] () – C:\boot.ini
[2004/08/03 23:00:00 | 000,260,272 | RHS- | M] () – C:\cmldr
[2012/06/22 10:52:07 | 000,022,932 | —- | M] () – C:\ComboFix.txt
[2008/04/25 17:29:32 | 000,000,000 | —- | M] () – C:\CONFIG.SYS
[2010/07/21 17:27:48 | 000,006,172 | R— | M] () – C:\dell.sdr
[2012/01/04 17:27:57 | 000,000,103 | —- | M] () – C:\del_1.gif
[2012/01/04 17:27:56 | 000,000,304 | —- | M] () – C:\dir.bmp
[2012/01/04 17:27:56 | 000,000,380 | —- | M] () – C:\edu.bmp
[2008/04/11 11:07:18 | 000,003,820 | —- | M] () – C:\eula.1028.txt
[2008/04/11 11:07:18 | 000,015,428 | —- | M] () – C:\eula.1031.txt
[2008/04/11 11:07:18 | 000,010,058 | —- | M] () – C:\eula.1033.txt
[2008/04/11 11:07:18 | 000,012,246 | —- | M] () – C:\eula.1036.txt
[2008/04/11 11:07:18 | 000,013,912 | —- | M] () – C:\eula.1040.txt
[2008/04/11 11:07:18 | 000,005,868 | —- | M] () – C:\eula.1041.txt
[2008/04/11 11:07:18 | 000,005,970 | —- | M] () – C:\eula.1042.txt
[2008/04/11 11:07:18 | 000,010,134 | —- | M] () – C:\eula.1049.txt
[2008/04/11 11:07:18 | 000,003,814 | —- | M] () – C:\eula.2052.txt
[2008/04/11 11:07:18 | 000,012,936 | —- | M] () – C:\eula.3082.txt
[2012/01/04 17:27:57 | 000,000,138 | —- | M] () – C:\flk2.gif
[2008/04/11 11:07:18 | 000,001,110 | —- | M] () – C:\globdata.ini
[2012/06/22 10:31:36 | 3745,406,976 | -HS- | M] () – C:\hiberfil.sys
[2012/04/26 13:04:32 | 000,388,608 | —- | M] (Trend Micro Inc.) – C:\HiJackThis.exe
[2012/04/26 13:06:46 | 000,017,645 | —- | M] () – C:\hijackthis.log
[2012/01/04 17:27:56 | 000,000,279 | —- | M] () – C:\hj_1.gif
[2008/04/11 11:07:18 | 000,000,843 | —- | M] () – C:\install.ini
[2008/04/11 09:03:48 | 000,076,304 | —- | M] (Microsoft Corporation) – C:\install.res.1028.dll
[2008/04/11 09:03:48 | 000,096,272 | —- | M] (Microsoft Corporation) – C:\install.res.1031.dll
[2008/04/11 09:03:48 | 000,091,152 | —- | M] (Microsoft Corporation) – C:\install.res.1033.dll
[2008/04/11 09:03:48 | 000,097,296 | —- | M] (Microsoft Corporation) – C:\install.res.1036.dll
[2008/04/11 09:03:48 | 000,095,248 | —- | M] (Microsoft Corporation) – C:\install.res.1040.dll
[2008/04/11 09:03:48 | 000,081,424 | —- | M] (Microsoft Corporation) – C:\install.res.1041.dll
[2008/04/11 09:03:48 | 000,079,888 | —- | M] (Microsoft Corporation) – C:\install.res.1042.dll
[2008/04/11 11:09:24 | 000,093,200 | —- | M] (Microsoft Corporation) – C:\install.res.1049.dll
[2008/04/11 09:03:48 | 000,075,792 | —- | M] (Microsoft Corporation) – C:\install.res.2052.dll
[2008/04/11 09:03:48 | 000,096,272 | —- | M] (Microsoft Corporation) – C:\install.res.3082.dll
[2008/04/25 17:29:32 | 000,000,000 | —- | M] () – C:\IO.SYS
[2012/01/04 17:27:57 | 000,000,277 | —- | M] () – C:\mov_1.gif
[2008/04/25 17:29:32 | 000,000,000 | —- | M] () – C:\MSDOS.SYS
[2010/07/21 17:28:03 | 000,047,564 | RHS- | M] () – C:\NTDETECT.COM
[2010/07/21 17:28:03 | 000,250,048 | RHS- | M] () – C:\ntldr
[2009/12/15 05:31:08 | 047,582,528 | —- | M] (NVIDIA Corporation ) – C:\NvCplSetupInt.exe
[2012/06/22 10:31:33 | 2145,386,496 | -HS- | M] () – C:\pagefile.sys
[2012/01/04 17:27:55 | 000,000,235 | —- | M] () – C:\srch_1.gif
[2012/01/04 17:27:56 | 000,000,265 | —- | M] () – C:\srch_ans_1.gif
[2012/01/04 17:27:56 | 000,000,113 | —- | M] () – C:\srch_aud_1.gif
[2012/01/04 17:27:56 | 000,000,112 | —- | M] () – C:\srch_img_1.gif
[2012/01/04 17:27:56 | 000,000,131 | —- | M] () – C:\srch_loc_1.gif
[2012/01/04 17:27:57 | 000,000,284 | —- | M] () – C:\srch_map_1.gif
[2012/01/04 17:27:56 | 000,000,121 | —- | M] () – C:\srch_nws_1.gif
[2012/01/04 17:27:56 | 000,000,123 | —- | M] () – C:\srch_sh_1.gif
[2012/01/04 17:27:57 | 000,000,240 | —- | M] () – C:\srch_site_1.gif
[2012/01/04 17:27:57 | 000,000,273 | —- | M] () – C:\srch_stk_1.gif
[2012/01/04 17:27:56 | 000,000,112 | —- | M] () – C:\srch_vid_1.gif
[2012/04/26 22:52:53 | 000,122,974 | —- | M] () – C:\TDSSKiller.2.7.33.0_26.04.2012_22.46.51_log.txt
[2012/05/09 12:02:01 | 000,109,446 | —- | M] () – C:\TDSSKiller.2.7.34.0_09.05.2012_11.58.50_log.txt
[2012/06/06 11:05:45 | 000,111,840 | —- | M] () – C:\TDSSKiller.2.7.36.0_06.06.2012_11.02.27_log.txt
[2012/06/06 11:06:36 | 000,111,758 | —- | M] () – C:\TDSSKiller.2.7.36.0_06.06.2012_11.05.57_log.txt
[2012/06/07 09:32:51 | 000,112,632 | —- | M] () – C:\TDSSKiller.2.7.36.0_07.06.2012_09.32.14_log.txt
[2011/03/03 15:10:35 | 000,000,258 | —- | M] () – C:\TerraSync.ini
[2012/01/04 17:27:57 | 000,000,274 | —- | M] () – C:\trav_1.gif
[2008/04/11 11:07:18 | 000,005,686 | —- | M] () – C:\vcredist.bmp
[2008/04/11 11:09:38 | 003,797,292 | —- | M] () – C:\VC_RED.cab
[2008/04/11 11:11:40 | 000,233,472 | —- | M] () – C:\VC_RED.MSI

< %systemroot%\Fonts\*.com >
[2006/04/18 23:39:28 | 000,026,040 | —- | M] () – C:\WINDOWS\Fonts\GlobalMonospace.CompositeFont
[2006/06/29 22:53:56 | 000,026,489 | —- | M] () – C:\WINDOWS\Fonts\GlobalSansSerif.CompositeFont
[2006/04/18 23:39:28 | 000,029,779 | —- | M] () – C:\WINDOWS\Fonts\GlobalSerif.CompositeFont
[2006/06/29 22:58:52 | 000,030,808 | —- | M] () – C:\WINDOWS\Fonts\GlobalUserInterface.CompositeFont

< %systemroot%\Fonts\*.dll >

< %systemroot%\Fonts\*.ini >
[2008/04/25 17:29:00 | 000,000,067 | -HS- | M] () – C:\WINDOWS\Fonts\desktop.ini

< %systemroot%\Fonts\*.ini2 >

< %systemroot%\Fonts\*.exe >

< %systemroot%\system32\spool\prtprocs\w32x86\*.* >
[2007/05/21 21:00:00 | 000,027,136 | —- | M] (CANON INC.) – C:\WINDOWS\system32\spool\prtprocs\w32x86\CNMPD95.DLL
[2007/05/21 21:00:00 | 000,069,632 | —- | M] (CANON INC.) – C:\WINDOWS\system32\spool\prtprocs\w32x86\CNMPP95.DLL
[2008/07/06 08:06:10 | 000,089,088 | —- | M] (Microsoft Corporation) – C:\WINDOWS\system32\spool\prtprocs\w32x86\filterpipelineprintproc.dll
[2011/04/02 17:03:22 | 000,069,632 | —- | M] () – C:\WINDOWS\system32\spool\prtprocs\w32x86\HP1100PP.dll
[2008/07/06 06:50:03 | 000,597,504 | —- | M] (Microsoft Corporation) – C:\WINDOWS\system32\spool\prtprocs\w32x86\printfilterpipelinesvc.exe

< %systemroot%\REPAIR\*.bak1 >

< %systemroot%\REPAIR\*.ini >

< %systemroot%\system32\*.jpg >

< %systemroot%\*.jpg >

< %systemroot%\*.png >

< %systemroot%\*.scr >

< %systemroot%\*._sy >

< %APPDATA%\Adobe\Update\*.* >

< %ALLUSERSPROFILE%\Favorites\*.* >

< %APPDATA%\Microsoft\*.* >

< %PROGRAMFILES%\*.* >

< %APPDATA%\Update\*.* >

< %systemroot%\*. /mp /s >

< %systemroot%\System32\config\*.sav >
[2008/04/25 05:21:09 | 000,094,208 | —- | M] () – C:\WINDOWS\System32\config\default.sav
[2008/04/25 05:21:09 | 001,089,536 | —- | M] () – C:\WINDOWS\System32\config\software.sav
[2008/04/25 05:21:09 | 000,905,216 | —- | M] () – C:\WINDOWS\System32\config\system.sav

< %PROGRAMFILES%\bak. /s >

< %systemroot%\system32\bak. /s >

< %ALLUSERSPROFILE%\Start Menu\*.lnk /x >

< %systemroot%\system32\config\systemprofile\*.dat /x >
[2010/07/22 13:15:05 | 000,000,837 | —- | M] () – C:\WINDOWS\system32\config\systemprofile\wave_license.txt

< %systemroot%\*.config >

< %systemroot%\system32\*.db >

< %PROGRAMFILES%\Internet Explorer\*.dat >

< %APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x >
[2011/12/01 11:16:57 | 000,000,060 | -HS- | M] () – C:\Documents and Settings\jzipkin\Application Data\Microsoft\Internet Explorer\Quick Launch\desktop.ini
[2011/12/01 11:16:12 | 000,000,079 | —- | M] () – C:\Documents and Settings\jzipkin\Application Data\Microsoft\Internet Explorer\Quick Launch\Show Desktop.scf

< %USERPROFILE%\Desktop\*.exe >
[2012/06/08 09:44:40 | 004,731,392 | —- | M] (AVAST Software) – C:\Documents and Settings\jzipkin\Desktop\aswMBR.exe
[2012/06/05 14:15:54 | 000,388,608 | —- | M] (Trend Micro Inc.) – C:\Documents and Settings\jzipkin\Desktop\HiJackThis.exe
[2012/06/07 12:14:28 | 010,063,000 | —- | M] (Malwarebytes Corporation ) – C:\Documents and Settings\jzipkin\Desktop\mbam-setup-1.61.0.1400.exe
[2012/06/08 13:46:58 | 000,595,456 | —- | M] (OldTimer Tools) – C:\Documents and Settings\jzipkin\Desktop\OTL.exe
[2012/06/07 12:13:21 | 000,446,464 | —- | M] (OldTimer Tools) – C:\Documents and Settings\jzipkin\Desktop\TFC.exe

< %PROGRAMFILES%\Common Files\*.* >

< %systemroot%\*.src >

< %systemroot%\install\*.* >

< %systemroot%\system32\DLL\*.* >

< %systemroot%\system32\HelpFiles\*.* >

< %systemroot%\system32\rundll\*.* >

< %systemroot%\winn32\*.* >

< %systemroot%\Java\*.* >

< %systemroot%\system32\test\*.* >

< %systemroot%\system32\Rundll32\*.* >

< %systemroot%\AppPatch\Custom\*.* >

< HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >
"NoAutoUpdate" = 0
"AUOptions" = 4
"RescheduleWaitTimeEnabled" = 1
"RescheduleWaitTime" = 1
"RebootWarningTimeoutEnabled" = 1
"RebootWarningTimeout" = 5
"RebootRelaunchTimeoutEnabled" = 1
"RebootRelaunchTimeout" = 10
"DetectionFrequencyEnabled" = 1
"DetectionFrequency" = 1
"AutoInstallMinorUpdates" = 1
"UseWUServer" = 1
"NoAutoRebootWithLoggedOnUsers" = 0
"ScheduledInstallDay" = 0
"ScheduledInstallTime" = 3

< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs >
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install\\LastSuccessTime: 2012-01-16 14:31:18

< End of report >

Conspire

Post #48June 26, 2012, 6:13 AM UTC

Yes I did and apparently those are OK. I was pointing on c:\windows\system32\c_12571.dll that McAfee was targeting and I'm not seeing those laying in the log anymore.

Please download SystemLook from one of the links below and save it to your Desktop.
Download Mirror #1
Download Mirror #2

Double-click SystemLook.exe to run it.

Copy the content of the following codebox into the main textfield:

:filefind
*c_12571*

:dir
C:\Documents and Settings\jzipkin\Local Settings\Application Data\4jt08j3453lv6eerv3ryh58wlpwkbx274umkyc5s2batk27 /s /md5
C:\Documents and Settings\All Users\Application Data\4jt08j3453lv6eerv3ryh58wlpwkbx274umkyc5s2batk27 /s /md5

:regfind
c_12571.dll

Click the Look button to start the scan.
When finished, a notepad window will open with the results of the scan. Please post this log in your next reply.

Note: The log can also be found on your Desktop entitled SystemLook.txt

SuMMiT

Post #49June 28, 2012, 3:22 PM UTC

here is the systemlook results: SystemLook 30.07.11 by jpshortstuff Log created at 11:17 on 28/06/2012 by jzipkin Administrator - Elevation successful ========== filefind ========== Searching for "*c_12571*" No files found. ========== dir ========== C:\Documents and Settings\jzipkin\Local Settings\Application Data\4jt08j3453lv6eerv3ryh58wlpwkbx274umkyc5s2batk27 - Unable to find folder. C:\Documents and Settings\All Users\Application Data\4jt08j3453lv6eerv3ryh58wlpwkbx274umkyc5s2batk27 - Unable to find folder. ========== regfind ========== Searching for "c_12571.dll" No data found. -= EOF =-

Conspire

Post #50June 29, 2012, 2:40 AM UTC

No where to be found. You shouldn't be experiencing any redirects anymore. If that's the case, you're good to go.

SuMMiT

Post #51June 29, 2012, 3:25 AM UTC

Nope, no redirects. Thx for all your help.

Conspire

Post #52June 29, 2012, 3:34 AM UTC

Follow these steps to uninstall Combofix

Click START then RUN
Now copy/paste the code into the runbox and click OK. Note the space between the ..X and the /U, it needs to be there.

Combofix /Uninstall

[external image: Posted Image]

===================================================

Clean up with OTL:

Double-click OTL.exe to start the program.
Close all other programs apart from OTL as this step will require a reboot
On the OTL main screen, press the CLEANUP button
Say Yes to the prompt and then allow the program to reboot your computer.

===================================================

Thank you for your patience, and performing all of the procedures requested. I would also like to take this opportunity to apologize for any delay that may have occurred.

————————————————————————————————————–

MICROSOFT UPDATES
It is very important that you get all of the critical updates for your Operating System and Internet Explorer. Keeping your OS and browser up to date will help make you less susceptible to attacks by Trojans and viruses. Please go to Microsoft and download all the critical updates to help prevent possible re-infection.

Passwords
It is good security practice to change your passwords to all your online accounts on a fairly regular basis, this is especially true after an infection. Refer to this Microsoft article
Strong passwords: How to create and use them and consider a password keeper, to keep all your passwords safe.

SPYWARE PREVENTION
This is a good time to set up protection against further attacks. In light of your recent problem, I'm sure you'd like to avoid any future infections. Please read these well written articles:

How Did I Get Infected In The First Place? by TonyKlein
How to Prevent Malware by miekiemoes
PC Safety and Security–What Do I Need?

To help protect your computer in the future I recommend that you get the following free programs if you do not already have them:

WOT, Web of Trust, warns you about risky websites that try to scam visitors, deliver malware or send spam. Protect your computer against online threats by using WOT as your front-line layer of protection when browsing or searching in unfamiliar territory. WOT's color-coded icons show you ratings for 21 million websites, helping you avoid the dangerous sites:
Green to go
Yellow for caution
Red to stop

WOT has an add-on available for both Firefox and IE.

SpywareBlaster prevents the installation of ActiveX-based malware, blocks cookies, and restricts the actions of "bad" sites. See tutorial here

MVPS HOSTS FILE replaces your current HOSTS file with one that will restrict known ad sites from serving you unsolicited advertisements. It basically prevents your computer from connecting to those sites by redirecting the attempted connections to 127.0.0.1, which is the IP of your local computer. See guide here and for Windows Vista here
Download Host.zip and Save it to your Desktop.
Right-click hosts.zip and select 'Extract all files' or 'Extract files…'.
Follow the prompts and click 'Finish'.
This will open the newly created hosts folder on your Desktop.
Double-click on the included mvps.bat file, this will rename the existing HOSTS file to HOSTS.MVP, then it will copy the included updated HOSTS file to the correct location on your machine.
Once updated you should see another prompt that the task was completed.

Follow this list and keep your antivirus program and antispyware programs updated and scan with them on a regular basis. By doing so, your potential for being infected again will reduce dramatically.

Hopefully this should take care of your problems! Good luck.

Do you have any questions or problems to ask? Please do not hesitate to do so.

**Please respond this one more time to ensure it is resolved and close this topic.

Conspire

Post #53July 1, 2012, 8:33 AM UTC

Since this issue appears to be resolved … this Topic has been closed. Glad we could be of assistance.

If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread.

Everyone else please follow the instructions here http://forums.whatthetech.com/you_Infected_t106388.html
and start a New Topic.

Search engine redirects [Solved]

✨ Ask AI

Ask AI