What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

PUM.Hijack.Startmenu [Solved]

17 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
The virus has overtaken the start menu and very few programs are available. Then several warnings pop up that the hard drive has been compromised. In safemode I downloaded and ran rkill, and Malwarebytes which found two infected files. HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced|Start_ShowMyComputer and HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced|Start_ShowSearch. It removed them both last night, and again this morning. I ran dds and have attached my dds and attach files.

Attachments:

Post #2
Hello bellemov and welcome to the WTT forum.

My name is Satchfan and I would be glad to help you with your computer problem.

Please read the following guidelines which will help to make cleaning your machine easier:
  • please follow all instructions in the order posted
  • please continue to review my answers until I tell you your machine appears to be clear. Absence of symptoms does not mean that everything is clear
  • all logs/reports, etc. must be posted in Notepad. Please ensure that word wrap is unchecked. In Notepad click Format, uncheck Word wrap if it is checked
  • if you don't understand something, please don't hesitate to ask for clarification before proceeding
  • the fixes are specific to your problem and should only be used for this issue on this machine.
  • please reply within 3 days. If you do not reply within this period I will post a reminder but topics with no reply in 4 days will be closed!
IMPORTANT:

Please DO NOT RUN ANY TEMPORARY FILE CLEANERS
Please DO NOT install/uninstall any programs unless asked to.
Please DO NOT run any scans other than those requested

I am looking at your log now and will reply with instructions shortly

Satchfan
Post #3
Hello again bellemov

It sounds like you have a “Rogue” program that has hidden your start menu items and running any temporary file cleaner will lose them permanently. While I finish looking at your log, I’d like you to run another scan.

Run RogueKiller

IMPORTANT: Do not reboot your computer if at all possible otherwise the malware will reactivate and you will have to run RogueKiller again

Download RogueKiller to your desktop.
  • close all running programs
  • for Windows Vista/Seven, right click -> run as administrator, for XP simply double-click on RogueKiller.exe
  • when the prescan is finished, click on Scan
  • click on Report and copy/paste the content in your next post.[/list
    If the program is blocked, do not hesitate to try several times. If it really does not work (it could happen), rename it to winlogon.exe
Please post the contents of the RKreport.txt in your next reply.

Remember: do not reboot your computer if at all possible otherwise the malware will reactivate and you will have to run RogueKiller again.

Please do not attach files, just copy and paste them in your post.

Thanks

Satchfan
Post #4 last edited
Hi Satchfan,
Thank you so much for your help. Below is the RogueKiller report results. Looks like it found something :)




RogueKiller V7.5.4 [06/07/2012] by Tigzy
mail: tigzyRKgmailcom
Feedback: http://www.geekstogo.com/forum/files/file/413-roguekiller/
Blog: http://tigzyrk.blogspot.com

Operating System: Windows Vista (6.0.6002 Service Pack 2) 32 bits version
Started in : Safe mode with network support
User: maureen [Admin rights]
Mode: Scan – Date: 06/20/2012 10:10:14

¤¤¤ Bad processes: 0 ¤¤¤

¤¤¤ Registry Entries: 20 ¤¤¤
[SUSP PATH] HKCU\[…]\Run : LgAKeeGGDTtSbJ.exe (C:\ProgramData\LgAKeeGGDTtSbJ.exe) -> FOUND
[SUSP PATH] HKUS\S-1-5-21-2389996163-2268114237-726783526-1003[…]\Run : LgAKeeGGDTtSbJ.exe (C:\ProgramData\LgAKeeGGDTtSbJ.exe) -> FOUND
[SUSP PATH] RGames Updater.job @ : C:\Users\maureen\AppData\Local\RivalGaming\Updater.exe -> FOUND
[HJ] HKCU\[…]\Advanced : Start_ShowMyDocs (0) -> FOUND
[HJ] HKCU\[…]\Advanced : Start_ShowRecentDocs (0) -> FOUND
[HJ] HKCU\[…]\Advanced : Start_ShowUser (0) -> FOUND
[HJ] HKCU\[…]\Advanced : Start_ShowMyPics (0) -> FOUND
[HJ] HKCU\[…]\Advanced : Start_ShowMyGames (0) -> FOUND
[HJ] HKCU\[…]\Advanced : Start_ShowMyMusic (0) -> FOUND
[HJ] HKCU\[…]\Advanced : Start_ShowControlPanel (0) -> FOUND
[HJ] HKCU\[…]\Advanced : Start_ShowHelp (0) -> FOUND
[HJ] HKCU\[…]\Advanced : Start_ShowPrinters (0) -> FOUND
[HJ] HKCU\[…]\Advanced : Start_ShowRun (0) -> FOUND
[HJ] HKCU\[…]\Advanced : Start_ShowSetProgramAccessAndDefaults (0) -> FOUND
[HJ] HKCU\[…]\Advanced : Start_TrackProgs (0) -> FOUND
[HJ] HKLM\[…]\NewStartPanel : {59031a47-3f72-44a7-89c5-5595fe6b30ee} (1) -> FOUND
[HJ] HKCU\[…]\ClassicStartMenu : {59031a47-3f72-44a7-89c5-5595fe6b30ee} (1) -> FOUND
[HJ] HKLM\[…]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> FOUND
[HJ] HKCU\[…]\ClassicStartMenu : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> FOUND
[HJ] HKCU\[…]\ClassicStartMenu : {645FF040-5081-101B-9F08-00AA002F954E} (1) -> FOUND

¤¤¤ Particular Files / Folders: ¤¤¤

¤¤¤ Driver: [NOT LOADED] ¤¤¤

¤¤¤ Infection : ¤¤¤

¤¤¤ HOSTS File: ¤¤¤


¤¤¤ MBR Check: ¤¤¤

+++++ PhysicalDrive0: ST3500630AS ATA Device +++++
— User —
[MBR] f099720723d4e3a0fdeb4fff6dc11fac
[BSP] 5114e3fd9951cb2acb33983720a9f917 : Windows Vista MBR Code
Partition table:
0 - [XXXXXX] DELL-UTIL (0xde) [VISIBLE] Offset (sectors): 63 | Size: 54 Mo
1 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 112640 | Size: 10240 Mo
2 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 21084160 | Size: 466644 Mo
User = LL1 … OK!
User = LL2 … OK!

Finished : << RKreport[1].txt >>
RKreport[1].txt
Post #5
Hi bellemov

Run Unhide

Download Unhide.exe

Once the program has been downloaded, double-click on the Unhide.exe icon on your desktop and allow the program to run. This program will remove the +H, or hidden, attribute from all the files on your hard drives. If there are any files that were purposely hidden by you, you will need to hide them again after this tool is run.

===================================================

Download and run OTL

Please try running this in normal, not safe mode.
  • download OTL to your desktop.
  • double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
  • click Scan all users.
  • under Custom Scan paste this in


    netsvcs
    %SYSTEMDRIVE%\*.exe
    /md5start
    explorer.exe
    winlogon.exe
    Userinit.exe
    svchost.exe
    consrv.dll
    /md5stop
    %systemroot%\*. /rp /s
    DRIVES
    CREATERESTOREPOINT

  • click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan won’t take long.
  • when the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.
  • please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post it with your next reply.
  • you may need two posts to fit them both in.
Please can you tell me if your start menu items are back

Satchfan
Post #8 last edited
When I start in regular mode, a bunch of warning boxes pop up. Write command during the test has failed to complete" pops up 20 times. Catalyst Control Centre: Host application has stopped working. System Error. Hard disck failure detected. Scan and repair. or Scan later. Should I run OTL over this stuff, or run in safe mode?
Post #10
OTL logfile created on: 6/20/2012 12:55:40 PM - Run 1
OTL by OldTimer - Version 3.2.50.0 Folder = C:\Users\maureen\Desktop
Windows Vista Ultimate Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

3.25 Gb Total Physical Memory | 2.62 Gb Available Physical Memory | 80.63% Memory free
6.68 Gb Paging File | 6.27 Gb Available in Paging File | 93.79% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 455.71 Gb Total Space | 255.11 Gb Free Space | 55.98% Space Free | Partition Type: NTFS
Drive D: | 10.00 Gb Total Space | 5.25 Gb Free Space | 52.48% Space Free | Partition Type: NTFS
Drive K: | 3.75 Gb Total Space | 3.14 Gb Free Space | 83.51% Space Free | Partition Type: FAT32

Computer Name: ROYCROFT-PC | User Name: maureen | Logged in as Administrator.
Boot Mode: SafeMode with Networking | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2012/06/20 11:56:44 | 000,596,992 | —- | M] (OldTimer Tools) – C:\Users\maureen\Desktop\OTL.exe
PRC - [2012/03/21 21:16:10 | 001,318,816 | —- | M] (McAfee, Inc.) – c:\Program Files\McAfee.com\Agent\mcagent.exe
PRC - [2012/03/20 13:11:32 | 000,151,880 | —- | M] (McAfee, Inc.) – C:\Program Files\Common Files\McAfee\SystemCore\mfevtps.exe
PRC - [2012/03/20 13:05:00 | 000,161,632 | —- | M] (McAfee, Inc.) – C:\Program Files\Common Files\McAfee\SystemCore\mfefire.exe
PRC - [2011/01/27 19:28:14 | 000,214,904 | —- | M] (McAfee, Inc.) – C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe
PRC - [2009/04/11 02:27:36 | 002,926,592 | —- | M] (Microsoft Corporation) – C:\Windows\explorer.exe


========== Modules (No Company Name) ==========

MOD - [2007/03/02 11:44:34 | 000,073,728 | —- | M] () – C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\atiacmxx.dll


========== Win32 Services (SafeList) ==========

SRV - [2012/06/17 08:03:44 | 000,257,224 | —- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] – C:\Windows\System32\Macromed\Flash\FlashPlayerUpdateService.exe – (AdobeFlashPlayerUpdateSvc)
SRV - [2012/04/19 08:21:16 | 000,361,976 | —- | M] (McAfee, Inc.) [On_Demand | Stopped] – C:\Program Files\McAfee\VirusScan\mcods.exe – (McODS)
SRV - [2012/03/20 13:11:32 | 000,151,880 | —- | M] (McAfee, Inc.) [Auto | Running] – C:\Program Files\Common Files\McAfee\SystemCore\mfevtps.exe – (mfevtp)
SRV - [2012/03/20 13:05:00 | 000,161,632 | —- | M] () [Auto | Running] – C:\Program Files\Common Files\McAfee\SystemCore\\mfefire.exe – (mfefire)
SRV - [2012/03/20 13:04:32 | 000,166,288 | —- | M] () [Auto | Stopped] – C:\Program Files\Common Files\McAfee\SystemCore\\mcshield.exe – (McShield)
SRV - [2012/01/03 09:10:42 | 000,063,928 | —- | M] (Adobe Systems Incorporated) [Auto | Stopped] – C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe – (AdobeARMservice)
SRV - [2011/12/22 08:31:08 | 000,045,056 | —- | M] (Intuit) [Auto | Stopped] – C:\Program Files\Common Files\Intuit\QuickBooks\QBCFMonitorService.exe – (QBCFMonitorService)
SRV - [2011/01/27 19:28:14 | 000,214,904 | —- | M] (McAfee, Inc.) [Auto | Stopped] – C:\Program Files\Common Files\Mcafee\McSvcHost\McSvHost.exe – (MSK80Service)
SRV - [2011/01/27 19:28:14 | 000,214,904 | —- | M] (McAfee, Inc.) [Auto | Stopped] – C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe – (McProxy)
SRV - [2011/01/27 19:28:14 | 000,214,904 | —- | M] (McAfee, Inc.) [Auto | Stopped] – C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe – (McNASvc)
SRV - [2011/01/27 19:28:14 | 000,214,904 | —- | M] (McAfee, Inc.) [Auto | Stopped] – C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe – (McNaiAnn)
SRV - [2011/01/27 19:28:14 | 000,214,904 | —- | M] (McAfee, Inc.) [Auto | Running] – C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe – (mcmscsvc)
SRV - [2011/01/27 19:28:14 | 000,214,904 | —- | M] (McAfee, Inc.) [Auto | Running] – C:\Program Files\Common Files\Mcafee\McSvcHost\McSvHost.exe – (McMPFSvc)
SRV - [2011/01/27 19:28:14 | 000,214,904 | —- | M] (McAfee, Inc.) [Auto | Stopped] – C:\Program Files\Common Files\Mcafee\McSvcHost\McSvHost.exe – (McAfee SiteAdvisor Service)
SRV - [2010/04/13 21:11:14 | 000,229,688 | —- | M] (McAfee, Inc.) [Auto | Stopped] – C:\Program Files\McAfee Online Backup\MOBKbackup.exe – (MOBKbackup)
SRV - [2008/08/13 18:32:40 | 000,201,968 | —- | M] (SupportSoft, Inc.) [Auto | Stopped] – C:\Program Files\Dell Support Center\bin\sprtsvc.exe – (sprtsvc_dellsupportcenter) SupportSoft Sprocket Service (dellsupportcenter)
SRV - [2008/08/08 22:10:46 | 000,061,440 | —- | M] (Intuit Inc.) [On_Demand | Stopped] – C:\Program Files\Common Files\Intuit\QuickBooks\FCS\Intuit.QuickBooks.FCS.exe – (QBFCService)
SRV - [2008/03/19 17:22:12 | 000,072,704 | —- | M] (Creative Labs) [Auto | Stopped] – C:\Program Files\Common Files\Creative Labs Shared\Service\CreativeLicensing.exe – (Creative Labs Licensing Service)
SRV - [2008/01/19 03:38:24 | 000,272,952 | —- | M] (Microsoft Corporation) [Auto | Stopped] – C:\Program Files\Windows Defender\MpSvc.dll – (WinDefend)
SRV - [2008/01/11 17:50:16 | 000,030,312 | —- | M] (Microsoft Corporation) [Auto | Stopped] – C:\Program Files\Microsoft Small Business\Business Contact Manager\BcmSqlStartupSvc.exe – (BcmSqlStartupSvc)


========== Driver Services (SafeList) ==========

DRV - File not found [Kernel | On_Demand | Stopped] – system32\DRIVERS\nwlnkfwd.sys – (NwlnkFwd)
DRV - File not found [Kernel | On_Demand | Stopped] – system32\DRIVERS\nwlnkflt.sys – (NwlnkFlt)
DRV - File not found [Kernel | On_Demand | Stopped] – system32\DRIVERS\ipinip.sys – (IpInIp)
DRV - File not found [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\blbdrive.sys – (blbdrive)
DRV - [2012/02/22 13:29:46 | 000,464,304 | —- | M] (McAfee, Inc.) [Kernel | Boot | Running] – C:\Windows\System32\drivers\mfehidk.sys – (mfehidk)
DRV - [2012/02/22 13:29:46 | 000,340,920 | —- | M] (McAfee, Inc.) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\mfefirek.sys – (mfefirek)
DRV - [2012/02/22 13:29:46 | 000,180,848 | —- | M] (McAfee, Inc.) [Kernel | On_Demand | Stopped] – C:\Windows\System32\drivers\mfeavfk.sys – (mfeavfk)
DRV - [2012/02/22 13:29:46 | 000,169,608 | —- | M] (McAfee, Inc.) [Kernel | System | Running] – C:\Windows\System32\drivers\mfewfpk.sys – (mfewfpk)
DRV - [2012/02/22 13:29:46 | 000,121,544 | —- | M] (McAfee, Inc.) [Kernel | On_Demand | Stopped] – C:\Windows\System32\drivers\mfeapfk.sys – (mfeapfk)
DRV - [2012/02/22 13:29:46 | 000,087,656 | —- | M] (McAfee, Inc.) [Kernel | On_Demand | Stopped] – C:\Windows\System32\drivers\mferkdet.sys – (mferkdet)
DRV - [2012/02/22 13:29:46 | 000,064,912 | —- | M] (McAfee, Inc.) [Kernel | System | Running] – C:\Windows\System32\drivers\mfenlfk.sys – (mfenlfk)
DRV - [2012/02/22 13:29:46 | 000,059,456 | —- | M] (McAfee, Inc.) [Kernel | On_Demand | Stopped] – C:\Windows\System32\drivers\mfebopk.sys – (mfebopk)
DRV - [2012/02/22 13:29:46 | 000,057,600 | —- | M] (McAfee, Inc.) [Kernel | On_Demand | Stopped] – C:\Windows\System32\drivers\cfwids.sys – (cfwids)
DRV - [2011/04/11 15:29:16 | 000,064,048 | —- | M] (McAfee, Inc.) [Kernel | Boot | Running] – C:\Windows\System32\drivers\McPvDrv.sys – (McPvDrv)
DRV - [2010/04/13 21:10:22 | 000,054,776 | —- | M] (Mozy, Inc.) [File_System | System | Stopped] – C:\Windows\System32\drivers\MOBK.sys – (MOBKFilter)
DRV - [2009/04/11 00:42:52 | 000,031,616 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\System32\drivers\winusb.sys – (winusb)
DRV - [2007/08/20 01:08:08 | 002,930,176 | —- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Stopped] – C:\Windows\System32\drivers\atikmdag.sys – (R300)
DRV - [2007/08/20 01:08:08 | 002,930,176 | —- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Stopped] – C:\Windows\System32\drivers\atikmdag.sys – (atikmdag)
DRV - [2007/04/29 04:42:24 | 000,228,224 | —- | M] (Intel Corporation) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\e1e6032.sys – (e1express) Intel®


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.dellnet.com
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = http://www.google.com/ie
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ie
IE - HKLM\..\SearchScopes,DefaultScope = {6A1806CD-94D4-4689-BA73-E35EA1EA9990}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://www.google.com/search?q={searchTerm…amp;rlz=1I7DKUS


IE - HKU\.DEFAULT\..\URLSearchHook: {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll (Yahoo! Inc.)
IE - HKU\.DEFAULT\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKU\.DEFAULT\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://search.live.com/results.aspx?q={sea…amp;Form=IE8SRC
IE - HKU\.DEFAULT\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://www.google.com/search?q={searchTerm…amp;rlz=1I7DKUS
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

IE - HKU\S-1-5-18\..\URLSearchHook: {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll (Yahoo! Inc.)
IE - HKU\S-1-5-18\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKU\S-1-5-18\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://search.live.com/results.aspx?q={sea…amp;Form=IE8SRC
IE - HKU\S-1-5-18\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://www.google.com/search?q={searchTerm…amp;rlz=1I7DKUS
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local



IE - HKU\S-1-5-21-2389996163-2268114237-726783526-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = http://www.google.com/ie
IE - HKU\S-1-5-21-2389996163-2268114237-726783526-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.google.com
IE - HKU\S-1-5-21-2389996163-2268114237-726783526-1003\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultName = Google
IE - HKU\S-1-5-21-2389996163-2268114237-726783526-1003\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultURL = http://www.google.com/search?q={searchTerm…tf8&oe=utf8
IE - HKU\S-1-5-21-2389996163-2268114237-726783526-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://start.iplay.com/?o=shp
IE - HKU\S-1-5-21-2389996163-2268114237-726783526-1003\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKU\S-1-5-21-2389996163-2268114237-726783526-1003\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ie
IE - HKU\S-1-5-21-2389996163-2268114237-726783526-1003\..\SearchScopes,DefaultScope = {8C35CC7F-3F7C-4820-B54A-02F883BD76DD}
IE - HKU\S-1-5-21-2389996163-2268114237-726783526-1003\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}…amp;FORM=IE8SRC
IE - HKU\S-1-5-21-2389996163-2268114237-726783526-1003\..\SearchScopes\{36377DD7-B3EB-42f5-986F-680BAF59BA9D}: "URL" = http://start.iplay.com/searchresults.aspx?…q={searchTerms}
IE - HKU\S-1-5-21-2389996163-2268114237-726783526-1003\..\SearchScopes\{4E1CF49E-1AD9-4E83-BB2E-85568FB6B921}: "URL" = http://websearch.ask.com/redirect?client=i…68-F5FEC694BFEA
IE - HKU\S-1-5-21-2389996163-2268114237-726783526-1003\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://www.google.com/search?q={searchTerm…mp;sourceid=ie7
IE - HKU\S-1-5-21-2389996163-2268114237-726783526-1003\..\SearchScopes\{8C35CC7F-3F7C-4820-B54A-02F883BD76DD}: "URL" = http://www.google.com/search?q={searchTerm…;rlz=1I7DLUS_en
IE - HKU\S-1-5-21-2389996163-2268114237-726783526-1003\..\SearchScopes\{DECA3892-BA8F-44b8-A993-A466AD694AE4}: "URL" = http://search.yahoo.com/search?fr=mcafee&p={searchTerms}
IE - HKU\S-1-5-21-2389996163-2268114237-726783526-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-21-2389996163-2268114237-726783526-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local


========== FireFox ==========

FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@mcafee.com/MSC,version=10: c:\progra~1\mcafee\msc\npmcsn~1.dll ()
FF - HKLM\Software\MozillaPlugins\@mcafee.com/SAFFPlugin: C:\Program Files\McAfee\SiteAdvisor\npmcffplg32.dll (McAfee, Inc.)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\5.1.10411.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@oberon-media.com/ONCAdapter: C:\Program Files\Common Files\Oberon Media\NCAdapter\1.0.0.7\npapicomadapter.dll (Oberon-Media )
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.111\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.111\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKCU\Software\MozillaPlugins\amazon.com/AmazonMP3DownloaderPlugin: C:\Program Files\Amazon\MP3 Downloader\npAmazonMP3DownloaderPlugin.dll (Amazon.com, Inc.)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{4ED1F68A-5463-4931-9384-8FFF5ED91D92}: C:\Program Files\McAfee\SiteAdvisor [2012/02/25 09:07:35 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{D19CA586-DD6C-4a0a-96F8-14644F340D60}: C:\Program Files\Common Files\McAfee\SystemCore [2012/06/18 19:58:02 | 000,000,000 | —D | M]

[2012/06/18 20:34:19 | 000,000,000 | —D | M] (No name found) – C:\Users\maureen\AppData\Roaming\mozilla\Extensions

Hosts file not found
O2 - BHO: (&Yahoo! Toolbar Helper) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll (Yahoo! Inc.)
O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (RivalGaming Games) - {26D675AC-D925-4bbf-A720-62C2AA4A81EB} - C:\Users\maureen\AppData\Local\RivalGaming\RivalGaming.dll (RivalGaming)
O2 - BHO: (scriptproxy) - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\Common Files\McAfee\SystemCore\ScriptSn.20120427122412.dll (McAfee, Inc.)
O2 - BHO: (McAfee SiteAdvisor BHO) - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - c:\Program Files\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
O2 - BHO: (CBrowserHelperObject Object) - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:\Program Files\Dell\BAE\BAE.dll (Dell Inc.)
O2 - BHO: (GamesBarBHO Class) - {CB0D163C-E9F4-4236-9496-0597E24B23A5} - C:\Program Files\GamesBar\2.0.1.82\oberontb.dll File not found
O2 - BHO: (SingleInstance Class) - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files\Yahoo!\Companion\Installs\cpn\YTSingleInstance.dll (Yahoo! Inc)
O3 - HKLM\..\Toolbar: (McAfee SiteAdvisor Toolbar) - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\Program Files\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
O3 - HKLM\..\Toolbar: (GamesBar) - {6F282B65-56BF-4BD1-A8B2-A4449A05863D} - C:\Program Files\GamesBar\2.0.1.82\oberontb.dll File not found
O3 - HKLM\..\Toolbar: (Yahoo! Toolbar) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll (Yahoo! Inc.)
O3 - HKU\S-1-5-21-2389996163-2268114237-726783526-1003\..\Toolbar\WebBrowser: (no name) - {D4027C7F-154A-4066-A1AD-4243D8127440} - No CLSID value found.
O4 - HKLM..\Run: [AirPort Base Station Agent] C:\Program Files\AirPort\APAgent.exe (Apple Inc.)
O4 - HKLM..\Run: [DellSupportCenter] C:\Program Files\Dell Support Center\bin\sprtcmd.exe (SupportSoft, Inc.)
O4 - HKLM..\Run: [dscactivate] C:\Program Files\Dell Support Center\gs_agent\custom\dsca.exe ( )
O4 - HKLM..\Run: [Intuit SyncManager] C:\Program Files\Common Files\Intuit\Sync\IntuitSyncManager.exe (Intuit Inc. All rights reserved.)
O4 - HKLM..\Run: [McPvTray_exe] C:\Program Files\McAfee\MAT\McPvTray.exe (McAfee, Inc.)
O4 - HKLM..\Run: [mcui_exe] C:\Program Files\McAfee.com\Agent\mcagent.exe (McAfee, Inc.)
O4 - HKLM..\Run: [RtHDVCpl] C:\Windows\RtHDVCpl.exe (Realtek Semiconductor)
O4 - HKLM..\Run: [StartCCC] C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe ()
O4 - HKLM..\Run: [UpdReg] C:\Windows\UpdReg.EXE (Creative Technology Ltd.)
O4 - HKLM..\Run: [VolPanel] C:\Program Files\Creative\SBAudigy\Volume Panel\VolPanlu.exe (Creative Technology Ltd)
O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)
O4 - HKU\S-1-5-19..\Run: [WindowsWelcomeCenter] C:\Windows\System32\oobefldr.dll (Microsoft Corporation)
O4 - HKU\S-1-5-20..\Run: [WindowsWelcomeCenter] C:\Windows\System32\oobefldr.dll (Microsoft Corporation)
O4 - HKU\S-1-5-21-2389996163-2268114237-726783526-1003..\Run: [DellSupportCenter] C:\Program Files\Dell Support Center\bin\sprtcmd.exe (SupportSoft, Inc.)
O4 - HKU\S-1-5-21-2389996163-2268114237-726783526-1003..\Run: [LgAKeeGGDTtSbJ.exe] C:\ProgramData\LgAKeeGGDTtSbJ.exe ()
O4 - HKU\S-1-5-21-2389996163-2268114237-726783526-1003..\Run: [SearchEngineProtection] C:\Program Files\Gamesbar\SearchEngineProtection.exe File not found
O9 - Extra 'Tools' menuitem : GamesBar - {1A93C934-025B-4c3a-B38E-9654A7003239} - Reg Error: Value error. File not found
O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O13 - gopher Prefix: missing
O15 - HKU\S-1-5-21-2389996163-2268114237-726783526-1003\..Trusted Domains: ([]msn in Computer)
O15 - HKU\S-1-5-21-2389996163-2268114237-726783526-1003\..Trusted Domains: //@surf.mar@/ ([]money in Local intranet)
O15 - HKU\S-1-5-21-2389996163-2268114237-726783526-1003\..Trusted Domains: aol.com ([objects] * is out of zone range - 5)
O15 - HKU\S-1-5-21-2389996163-2268114237-726783526-1003\..Trusted Domains: swmric.com ([www] https in Trusted sites)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_29)
O16 - DPF: {CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_29)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_29)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.0.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{F5238A7F-73ED-45E4-A5AA-59CEB7213641}: DhcpNameServer = 192.168.0.1
O18 - Protocol\Handler\dssrequest {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\Program Files\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
O18 - Protocol\Handler\intu-help-qb2 {84D77A00-41B5-4b8b-8ADF-86486D72E749} - C:\Program Files\intuit\QuickBooks 2007\HelpAsyncPluggableProtocol.dll (Intuit, Inc.)
O18 - Protocol\Handler\sacore {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\Program Files\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
O18 - Protocol\Filter\application/x-mfe-ipt {3EF5086B-5478-4598-A054-786C45D75692} - c:\Program Files\McAfee\MSC\McSnIePl.dll (McAfee, Inc.)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)
O24 - Desktop Components:0 () - http://www.fastlane-retrievers.com/pups0013.jpg
O24 - Desktop Components:1 (My Current Home Page) - About:Home
O24 - Desktop WallPaper: C:\Windows\Web\Wallpaper\img8.jpg
O24 - Desktop BackupWallPaper: C:\Windows\Web\Wallpaper\img8.jpg
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006/09/18 17:43:36 | 000,000,024 | —- | M] () - C:\autoexec.bat – [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)

NetSvcs: FastUserSwitchingCompatibility - File not found
NetSvcs: Ias - C:\Windows\System32\ias.dll (Microsoft Corporation)
NetSvcs: Nla - File not found
NetSvcs: Ntmssvc - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: SRService - File not found
NetSvcs: WmdmPmSp - File not found
NetSvcs: LogonHours - File not found
NetSvcs: PCAudit - File not found
NetSvcs: helpsvc - File not found
NetSvcs: uploadmgr - File not found

CREATERESTOREPOINT
Unable to start System Restore Service. Error code 1084

========== Files/Folders - Created Within 30 Days ==========

[2012/06/20 12:06:59 | 000,596,992 | —- | C] (OldTimer Tools) – C:\Users\maureen\Desktop\OTL.exe
[2012/06/20 10:09:15 | 000,000,000 | —D | C] – C:\Users\maureen\Desktop\RK_Quarantine
[2012/06/18 20:49:07 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2012/06/18 20:49:06 | 000,022,344 | —- | C] (Malwarebytes Corporation) – C:\Windows\System32\drivers\mbam.sys
[2012/06/18 20:43:33 | 000,172,032 | —- | C] (Intel Corporation) – C:\Windows\System32\igfxres.dll
[2012/06/18 20:34:42 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AbiWord
[2012/06/18 20:34:38 | 000,000,000 | —D | C] – C:\ProgramData\Oberon Media
[2012/06/18 20:34:33 | 000,000,000 | —D | C] – C:\Users\maureen\AppData\Roaming\Oberon Media
[2012/06/18 20:34:32 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\GamesBar
[2012/06/18 20:34:31 | 000,000,000 | —D | C] – C:\ProgramData\GamesBar
[2012/06/18 20:34:27 | 000,000,000 | —D | C] – C:\Program Files\Common Files\Oberon Media
[2012/06/18 20:34:19 | 000,000,000 | —D | C] – C:\Users\maureen\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\RivalGaming
[2012/06/18 20:34:19 | 000,000,000 | —D | C] – C:\Users\maureen\AppData\Local\RivalGaming
[2012/06/18 20:34:19 | 000,000,000 | —D | C] – C:\Users\maureen\AppData\Roaming\Mozilla
[2012/06/13 18:01:26 | 002,382,848 | —- | C] (Microsoft Corporation) – C:\Windows\System32\mshtml.tlb
[2012/06/13 18:01:25 | 000,176,640 | —- | C] (Microsoft Corporation) – C:\Windows\System32\ieui.dll
[2012/06/13 18:01:25 | 000,142,848 | —- | C] (Microsoft Corporation) – C:\Windows\System32\ieUnatt.exe
[2012/06/13 18:01:24 | 001,800,192 | —- | C] (Microsoft Corporation) – C:\Windows\System32\jscript9.dll
[2012/06/13 18:01:24 | 000,231,936 | —- | C] (Microsoft Corporation) – C:\Windows\System32\url.dll
[2012/06/13 18:01:24 | 000,065,024 | —- | C] (Microsoft Corporation) – C:\Windows\System32\jsproxy.dll
[2012/06/13 18:01:23 | 001,427,968 | —- | C] (Microsoft Corporation) – C:\Windows\System32\inetcpl.cpl
[2012/06/13 16:46:20 | 002,045,440 | —- | C] (Microsoft Corporation) – C:\Windows\System32\win32k.sys
[2012/06/08 14:59:09 | 000,000,000 | —D | C] – C:\McAfee
[2012/06/07 16:33:23 | 000,000,000 | —D | C] – C:\Users\maureen\2012-06-07
[3 C:\Users\maureen\Documents\*.tmp files -> C:\Users\maureen\Documents\*.tmp -> ]
[1 C:\Windows\System32\*.tmp files -> C:\Windows\System32\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2012/06/20 12:04:46 | 000,067,584 | –S- | M] () – C:\Windows\bootstat.dat
[2012/06/20 11:58:48 | 000,003,568 | —- | M] () – C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2012/06/20 11:58:48 | 000,003,568 | —- | M] () – C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2012/06/20 11:58:48 | 000,000,882 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2012/06/20 11:56:44 | 000,596,992 | —- | M] (OldTimer Tools) – C:\Users\maureen\Desktop\OTL.exe
[2012/06/18 20:49:07 | 000,000,817 | —- | M] () – C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2012/06/18 20:41:56 | 000,662,374 | —- | M] () – C:\Windows\System32\perfh009.dat
[2012/06/18 20:41:56 | 000,126,560 | —- | M] () – C:\Windows\System32\perfc009.dat
[2012/06/18 20:40:16 | 001,012,656 | —- | M] () – C:\Users\maureen\Desktop\help me help you.exe
[2012/06/18 20:34:42 | 000,000,868 | —- | M] () – C:\Users\Public\Desktop\AbiWord.lnk
[2012/06/18 20:34:19 | 000,000,268 | —- | M] () – C:\Windows\tasks\RGames Updater.job
[2012/06/18 13:39:58 | 000,000,470 | —- | M] () – C:\Users\maureen\Application Data\Microsoft\Internet Explorer\Quick Launch\Facebook.website
[2012/06/18 13:35:38 | 000,346,760 | —- | M] () – C:\ProgramData\LgAKeeGGDTtSbJ.exe
[2012/06/18 13:17:01 | 000,000,886 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2012/06/18 13:14:59 | 000,000,830 | —- | M] () – C:\Windows\tasks\Adobe Flash Player Updater.job
[2012/06/18 13:06:52 | 000,000,494 | —- | M] () – C:\Users\maureen\Application Data\Microsoft\Internet Explorer\Quick Launch\WordPress.com.website
[2012/06/18 09:13:42 | 000,000,458 | —- | M] () – C:\Users\maureen\Application Data\Microsoft\Internet Explorer\Quick Launch\Writer Unboxed.website
[2012/06/18 08:16:21 | 000,000,513 | —- | M] () – C:\Users\maureen\Application Data\Microsoft\Internet Explorer\Quick Launch\weather.com.website
[2012/06/18 07:27:51 | 000,001,737 | —- | M] () – C:\Users\Public\Desktop\McAfee Total Protection.lnk
[2012/06/17 10:43:19 | 000,000,601 | —- | M] () – C:\Users\maureen\Application Data\Microsoft\Internet Explorer\Quick Launch\Amazon.com MP3 Downloads Shop 16 million songs and play your music on any Android device, PC, or Mac with Amazon Cloud Drive a.website
[2012/06/17 08:03:44 | 000,426,184 | —- | M] (Adobe Systems Incorporated) – C:\Windows\System32\FlashPlayerApp.exe
[2012/06/17 08:03:44 | 000,070,344 | —- | M] (Adobe Systems Incorporated) – C:\Windows\System32\FlashPlayerCPLApp.cpl
[2012/06/14 11:31:17 | 000,000,773 | —- | M] () – C:\Users\maureen\Application Data\Microsoft\Internet Explorer\Quick Launch\AOL Mail Simple, Free, Fun.website
[2012/06/14 08:07:41 | 000,410,264 | —- | M] () – C:\Windows\System32\FNTCACHE.DAT
[2012/06/11 10:26:40 | 000,000,463 | —- | M] () – C:\Users\maureen\Application Data\Microsoft\Internet Explorer\Quick Launch\Twitter - Home.website
[2012/06/08 16:14:47 | 000,000,497 | —- | M] () – C:\Users\maureen\Application Data\Microsoft\Internet Explorer\Quick Launch\Shorten & Share bitly shorten, share and track your links.website
[2012/06/04 12:09:26 | 000,000,622 | —- | M] () – C:\Users\maureen\Application Data\Microsoft\Internet Explorer\Quick Launch\Welcome to Google+.website
[3 C:\Users\maureen\Documents\*.tmp files -> C:\Users\maureen\Documents\*.tmp -> ]
[1 C:\Windows\System32\*.tmp files -> C:\Windows\System32\*.tmp -> ]

========== Files Created - No Company Name ==========

[2012/06/20 11:29:12 | 000,001,994 | —- | C] () – C:\Users\Public\Desktop\Amazon Cloud Player.lnk
[2012/06/20 11:29:12 | 000,001,978 | —- | C] () – C:\Users\Public\Desktop\QuickBooks Pro 2009.lnk
[2012/06/20 11:29:12 | 000,001,962 | —- | C] () – C:\Users\Public\Desktop\Dell Support Center.lnk
[2012/06/20 11:29:12 | 000,001,894 | —- | C] () – C:\Users\Public\Desktop\Adobe Reader X.lnk
[2012/06/20 11:29:12 | 000,001,737 | —- | C] () – C:\Users\Public\Desktop\McAfee Total Protection.lnk
[2012/06/20 11:29:12 | 000,001,728 | —- | C] () – C:\Users\Public\Desktop\QuickTime Player.lnk
[2012/06/20 11:29:12 | 000,001,666 | —- | C] () – C:\Users\Public\Desktop\iTunes.lnk
[2012/06/20 11:29:12 | 000,001,666 | —- | C] () – C:\Users\maureen\Application Data\Microsoft\Internet Explorer\Quick Launch\iTunes.lnk
[2012/06/20 11:29:12 | 000,001,623 | —- | C] () – C:\Users\Public\Desktop\Internet Explorer.lnk
[2012/06/20 11:29:12 | 000,001,486 | —- | C] () – C:\Users\Public\Desktop\Windows Media Center.lnk
[2012/06/20 11:29:12 | 000,001,144 | —- | C] () – C:\Users\Public\Desktop\HP Solution Center.lnk
[2012/06/20 11:29:12 | 000,001,089 | —- | C] () – C:\Users\Public\Desktop\Music, Photos & Videos.lnk
[2012/06/20 11:29:12 | 000,000,945 | —- | C] () – C:\Users\maureen\Application Data\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk
[2012/06/20 11:29:12 | 000,000,940 | —- | C] () – C:\Users\maureen\Application Data\Microsoft\Internet Explorer\Quick Launch\Microsoft Office Outlook.lnk
[2012/06/20 11:29:12 | 000,000,868 | —- | C] () – C:\Users\Public\Desktop\AbiWord.lnk
[2012/06/20 11:29:12 | 000,000,817 | —- | C] () – C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2012/06/20 11:29:12 | 000,000,773 | —- | C] () – C:\Users\maureen\Application Data\Microsoft\Internet Explorer\Quick Launch\AOL Mail Simple, Free, Fun.website
[2012/06/20 11:29:12 | 000,000,764 | —- | C] () – C:\Users\Public\Desktop\TweetDeck.lnk
[2012/06/20 11:29:12 | 000,000,622 | —- | C] () – C:\Users\maureen\Application Data\Microsoft\Internet Explorer\Quick Launch\Welcome to Google+.website
[2012/06/20 11:29:12 | 000,000,601 | —- | C] () – C:\Users\maureen\Application Data\Microsoft\Internet Explorer\Quick Launch\Amazon.com MP3 Downloads Shop 16 million songs and play your music on any Android device, PC, or Mac with Amazon Cloud Drive a.website
[2012/06/20 11:29:12 | 000,000,513 | —- | C] () – C:\Users\maureen\Application Data\Microsoft\Internet Explorer\Quick Launch\weather.com.website
[2012/06/20 11:29:12 | 000,000,501 | —- | C] () – C:\Users\maureen\Application Data\Microsoft\Internet Explorer\Quick Launch\Pandora Internet Radio.website
[2012/06/20 11:29:12 | 000,000,497 | —- | C] () – C:\Users\maureen\Application Data\Microsoft\Internet Explorer\Quick Launch\Shorten & Share bitly shorten, share and track your links.website
[2012/06/20 11:29:12 | 000,000,496 | —- | C] () – C:\Users\maureen\Application Data\Microsoft\Internet Explorer\Quick Launch\Reader Unboxed By Readers For Readers.website
[2012/06/20 11:29:12 | 000,000,494 | —- | C] () – C:\Users\maureen\Application Data\Microsoft\Internet Explorer\Quick Launch\WordPress.com.website
[2012/06/20 11:29:12 | 000,000,475 | —- | C] () – C:\Users\maureen\Application Data\Microsoft\Internet Explorer\Quick Launch\Goodreads Recent Updates.website
[2012/06/20 11:29:12 | 000,000,470 | —- | C] () – C:\Users\maureen\Application Data\Microsoft\Internet Explorer\Quick Launch\Facebook.website
[2012/06/20 11:29:12 | 000,000,463 | —- | C] () – C:\Users\maureen\Application Data\Microsoft\Internet Explorer\Quick Launch\Twitter - Home.website
[2012/06/20 11:29:12 | 000,000,458 | —- | C] () – C:\Users\maureen\Application Data\Microsoft\Internet Explorer\Quick Launch\Writer Unboxed.website
[2012/06/20 11:29:12 | 000,000,457 | —- | C] () – C:\Users\maureen\Application Data\Microsoft\Internet Explorer\Quick Launch\Google Maps.website
[2012/06/20 11:29:12 | 000,000,258 | —- | C] () – C:\Users\maureen\Application Data\Microsoft\Internet Explorer\Quick Launch\Shows Desktop.lnk
[2012/06/20 11:29:12 | 000,000,240 | —- | C] () – C:\Users\maureen\Application Data\Microsoft\Internet Explorer\Quick Launch\Window Switcher.lnk
[2012/06/20 11:29:12 | 000,000,104 | —- | C] () – C:\Users\maureen\Application Data\Microsoft\Internet Explorer\Quick Launch\E-mail - Shortcut.lnk
[2012/06/18 20:44:21 | 001,012,656 | —- | C] () – C:\Users\maureen\Desktop\help me help you.exe
[2012/06/18 20:34:19 | 000,000,268 | —- | C] () – C:\Windows\tasks\RGames Updater.job
[2012/06/18 13:37:59 | 000,346,760 | —- | C] () – C:\ProgramData\LgAKeeGGDTtSbJ.exe
[2010/12/09 10:20:08 | 000,000,164 | —- | C] () – C:\Windows\install.dat

========== Custom Scans ==========

< %SYSTEMDRIVE%\*.exe >
[2005/12/07 21:15:20 | 000,010,920 | —- | M] () – C:\aolconnfix.exe

< MD5 for: EXPLORER.EXE >
[2008/10/29 02:20:29 | 002,923,520 | —- | M] (Microsoft Corporation) MD5=37440D09DEAE0B672A04DCCF7ABF06BE – C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.16771_none_4f83bb287ccdb7e3\explorer.exe
[2011/01/16 15:55:21 | 000,255,488 | —- | M] () MD5=3C33B26F2F7FA61D882515F2D6078691 – C:\Users\maureen\AppData\Local\Temp\RarSFX2\procs\explorer.exe
[2011/01/16 15:55:21 | 000,255,488 | —- | M] () MD5=3C33B26F2F7FA61D882515F2D6078691 – C:\Users\maureen\AppData\Local\Temp\RarSFX4\procs\explorer.exe
[2011/01/16 15:55:21 | 000,255,488 | —- | M] () MD5=3C33B26F2F7FA61D882515F2D6078691 – C:\Users\maureen\AppData\Local\Temp\RarSFX6\procs\explorer.exe
[2008/10/29 02:29:41 | 002,927,104 | —- | M] (Microsoft Corporation) MD5=4F554999D7D5F05DAAEBBA7B5BA1089D – C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6001.18164_none_5177ca9879e978e8\explorer.exe
[2008/10/29 23:59:17 | 002,927,616 | —- | M] (Microsoft Corporation) MD5=50BA5850147410CDE89C523AD3BC606E – C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6001.22298_none_51e4f8c7931bd1e1\explorer.exe
[2008/03/20 00:54:15 | 002,923,520 | —- | M] (Microsoft Corporation) MD5=6D06CD98D954FE87FB2DB8108793B399 – C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.16549_none_4fac29707cae347a\explorer.exe
[2005/08/16 01:54:58 | 000,001,536 | —- | M] () MD5=ABC6379205DE2618851C4FCBF72112EB – C:\Users\maureen\AppData\Local\Temp\RarSFX2\h\explorer.exe
[2005/08/16 01:54:58 | 000,001,536 | —- | M] () MD5=ABC6379205DE2618851C4FCBF72112EB – C:\Users\maureen\AppData\Local\Temp\RarSFX4\h\explorer.exe
[2005/08/16 01:54:58 | 000,001,536 | —- | M] () MD5=ABC6379205DE2618851C4FCBF72112EB – C:\Users\maureen\AppData\Local\Temp\RarSFX6\h\explorer.exe
[2008/03/20 00:54:15 | 002,923,520 | —- | M] (Microsoft Corporation) MD5=BD06F0BF753BC704B653C3A50F89D362 – C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.20668_none_501f261995dcf2cf\explorer.exe
[2009/04/11 02:27:36 | 002,926,592 | —- | M] (Microsoft Corporation) MD5=D07D4C3038F3578FFCE1C0237F2A1253 – C:\Windows\explorer.exe
[2009/04/11 02:27:36 | 002,926,592 | —- | M] (Microsoft Corporation) MD5=D07D4C3038F3578FFCE1C0237F2A1253 – C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6002.18005_none_53a0201e76de3a0b\explorer.exe
[2008/10/27 22:15:02 | 002,923,520 | —- | M] (Microsoft Corporation) MD5=E7156B0B74762D9DE0E66BDCDE06E5FB – C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.20947_none_5033cb5995cd990b\explorer.exe
[2006/11/02 05:45:07 | 002,923,520 | —- | M] (Microsoft Corporation) MD5=FD8C53FB002217F6F888BCF6F5D7084D – C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.16386_none_4f7de5167cd15deb\explorer.exe
[2008/01/19 03:33:10 | 002,927,104 | —- | M] (Microsoft Corporation) MD5=FFA764631CB70A30065C12EF8E174F9F – C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6001.18000_none_51b4a71279bc6ebf\explorer.exe

< MD5 for: SVCHOST.EXE >
[2012/04/04 15:56:38 | 000,199,240 | —- | M] () MD5=097D0E812D7A9A3101CE46CB2BE0474D – C:\My Downloads\Malwarebytes' Anti-Malware\Chameleon\svchost.exe
[2001/08/18 07:00:00 | 000,012,800 | —- | M] (Microsoft Corporation) MD5=0F7D9C87B0CE1FA520473119752C6F79 – C:\I386\SVCHOST.EXE
[2006/11/02 05:45:47 | 000,022,016 | —- | M] (Microsoft Corporation) MD5=10DA15933D582D2FEDCF705EFE394B09 – C:\Windows\winsxs\x86_microsoft-windows-services-svchost_31bf3856ad364e35_6.0.6000.16386_none_b38497a50862ad11\svchost.exe
[2008/01/19 03:33:32 | 000,021,504 | —- | M] (Microsoft Corporation) MD5=3794B461C45882E06856F282EEF025AF – C:\Windows\System32\svchost.exe
[2008/01/19 03:33:32 | 000,021,504 | —- | M] (Microsoft Corporation) MD5=3794B461C45882E06856F282EEF025AF – C:\Windows\winsxs\x86_microsoft-windows-services-svchost_31bf3856ad364e35_6.0.6001.18000_none_b5bb59a1054dbde5\svchost.exe

< MD5 for: USERINIT.EXE >
[2008/01/19 03:33:33 | 000,025,088 | —- | M] (Microsoft Corporation) MD5=0E135526E9785D085BCD9AEDE6FBCBF9 – C:\Windows\System32\userinit.exe
[2008/01/19 03:33:33 | 000,025,088 | —- | M] (Microsoft Corporation) MD5=0E135526E9785D085BCD9AEDE6FBCBF9 – C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.0.6001.18000_none_dc28ba15d1aff80b\userinit.exe
[2006/11/02 05:45:50 | 000,024,576 | —- | M] (Microsoft Corporation) MD5=22027835939F86C3E47AD8E3FBDE3D11 – C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.0.6000.16386_none_d9f1f819d4c4e737\userinit.exe
[2001/08/18 07:00:00 | 000,021,504 | —- | M] (Microsoft Corporation) MD5=585398603F570F9705774D65D292E5D1 – C:\I386\USERINIT.EXE
[2009/05/26 18:47:22 | 000,031,232 | —- | M] (NirSoft) MD5=AC6094297CD882B8626466CDEB64F19F – C:\Users\maureen\AppData\Local\Temp\RarSFX2\userinit.exe
[2009/05/26 18:47:22 | 000,031,232 | —- | M] (NirSoft) MD5=AC6094297CD882B8626466CDEB64F19F – C:\Users\maureen\AppData\Local\Temp\RarSFX4\userinit.exe
[2009/05/26 18:47:22 | 000,031,232 | —- | M] (NirSoft) MD5=AC6094297CD882B8626466CDEB64F19F – C:\Users\maureen\AppData\Local\Temp\RarSFX6\userinit.exe

< MD5 for: WINLOGON.EXE >
[2012/04/04 15:56:38 | 000,199,240 | —- | M] () MD5=097D0E812D7A9A3101CE46CB2BE0474D – C:\My Downloads\Malwarebytes' Anti-Malware\Chameleon\winlogon.exe
[2009/04/11 02:28:13 | 000,314,368 | —- | M] (Microsoft Corporation) MD5=898E7C06A350D4A1A64A9EA264D55452 – C:\Windows\System32\winlogon.exe
[2009/04/11 02:28:13 | 000,314,368 | —- | M] (Microsoft Corporation) MD5=898E7C06A350D4A1A64A9EA264D55452 – C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6002.18005_none_71ae7a22d2134741\winlogon.exe
[2006/11/02 05:45:57 | 000,308,224 | —- | M] (Microsoft Corporation) MD5=9F75392B9128A91ABAFB044EA350BAAD – C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6000.16386_none_6d8c3f1ad8066b21\winlogon.exe
[2009/05/26 18:47:22 | 000,031,232 | —- | M] (NirSoft) MD5=AC6094297CD882B8626466CDEB64F19F – C:\Users\maureen\AppData\Local\Temp\RarSFX2\winlogon.exe
[2009/05/26 18:47:22 | 000,031,232 | —- | M] (NirSoft) MD5=AC6094297CD882B8626466CDEB64F19F – C:\Users\maureen\AppData\Local\Temp\RarSFX4\winlogon.exe
[2009/05/26 18:47:22 | 000,031,232 | —- | M] (NirSoft) MD5=AC6094297CD882B8626466CDEB64F19F – C:\Users\maureen\AppData\Local\Temp\RarSFX6\winlogon.exe
[2008/01/19 03:33:37 | 000,314,880 | —- | M] (Microsoft Corporation) MD5=C2610B6BDBEFC053BBDAB4F1B965CB24 – C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6001.18000_none_6fc30116d4f17bf5\winlogon.exe
[2002/02/21 11:54:16 | 000,429,056 | —- | M] (Microsoft Corporation) MD5=C605FFF733AAD029D6B533E609C8A6E6 – C:\I386\winlogon.exe

< %systemroot%\*. /rp /s >

========== Drive Information ==========

Physical Drives
—————

Drive: \\\\.\\PHYSICALDRIVE0 - Fixed hard disk media
Interface type: IDE
Media Type: Fixed hard disk media
Model: ST3500630AS ATA Device
Partitions: 3
Status: OK
Status Info: 0

Drive: \\\\.\\PHYSICALDRIVE1 - Removable Media
Interface type: USB
Media Type: Removable Media
Model: Kingston DataTraveler 2.0 USB Device
Partitions: 1
Status: OK
Status Info: 0

Drive: \\\\.\\PHYSICALDRIVE2 -
Interface type: USB
Media Type:
Model: TEAC USB HS-CF Card USB Device
Partitions: 0
Status: OK
Status Info: 0

Drive: \\\\.\\PHYSICALDRIVE3 -
Interface type: USB
Media Type:
Model: TEAC USB HS-xD/SM USB Device
Partitions: 0
Status: OK
Status Info: 0

Drive: \\\\.\\PHYSICALDRIVE4 -
Interface type: USB
Media Type:
Model: TEAC USB HS-MS Card USB Device
Partitions: 0
Status: OK
Status Info: 0

Drive: \\\\.\\PHYSICALDRIVE5 -
Interface type: USB
Media Type:
Model: TEAC USB HS-SD Card USB Device
Partitions: 0
Status: OK
Status Info: 0

Partitions
—————

DeviceID: Disk #0, Partition #0
PartitionType: Unknown
Bootable: False
BootPartition: False
PrimaryPartition: True
Size: 0.00GB
Starting Offset: 32256
Hidden sectors: 0


DeviceID: Disk #0, Partition #1
PartitionType: Installable File System
Bootable: False
BootPartition: False
PrimaryPartition: True
Size: 10.00GB
Starting Offset: 57671680
Hidden sectors: 0


DeviceID: Disk #0, Partition #2
PartitionType: Installable File System
Bootable: True
BootPartition: True
PrimaryPartition: True
Size: 456.00GB
Starting Offset: 10795089920
Hidden sectors: 0


DeviceID: Disk #1, Partition #0
PartitionType: Unknown
Bootable: False
BootPartition: False
PrimaryPartition: True
Size: 4.00GB
Starting Offset: 4096
Hidden sectors: 0


< End of report >
Post #11
Here's the extra.

OTL Extras logfile created on: 6/20/2012 12:55:40 PM - Run 1
OTL by OldTimer - Version 3.2.50.0 Folder = C:\Users\maureen\Desktop
Windows Vista Ultimate Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

3.25 Gb Total Physical Memory | 2.62 Gb Available Physical Memory | 80.63% Memory free
6.68 Gb Paging File | 6.27 Gb Available in Paging File | 93.79% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 455.71 Gb Total Space | 255.11 Gb Free Space | 55.98% Space Free | Partition Type: NTFS
Drive D: | 10.00 Gb Total Space | 5.25 Gb Free Space | 52.48% Space Free | Partition Type: NTFS
Drive K: | 3.75 Gb Total Space | 3.14 Gb Free Space | 83.51% Space Free | Partition Type: FAT32

Computer Name: ROYCROFT-PC | User Name: maureen | Logged in as Administrator.
Boot Mode: SafeMode with Networking | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========


========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]
.cpl [@ = cplfile] – C:\Windows\System32\control.exe (Microsoft Corporation)
.hlp [@ = hlpfile] – C:\Windows\winhlp32.exe (Microsoft Corporation)

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\shell\[command]\command]
batfile [open] – "%1" %*
cmdfile [open] – "%1" %*
comfile [open] – "%1" %*
cplfile [cplopen] – %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] – "%1" %*
helpfile [open] – Reg Error: Key error.
hlpfile [open] – %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
inffile [install] – %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] – "%1" %*
regfile [merge] – Reg Error: Key error.
scrfile [config] – "%1"
scrfile [install] – rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] – "%1" /S
txtfile – Reg Error: Key error.
Unknown [openas] – %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] – cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] – %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)
Folder [explore] – %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiSpyware]
"DisableMonitoring" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
"VistaSp1" = Reg Error: Unknown registry data type – File not found
"VistaSp2" = Reg Error: Unknown registry data type – File not found

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 0

========== Authorized Applications List ==========


========== Vista Active Open Ports Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{B40E16EE-47ED-468C-8853-417B1E00BEF0}" = lport=6004 | protocol=17 | dir=in | app=c:\program files\microsoft office\office12\outlook.exe |
"{C099BD02-B319-4FD1-AE90-F1E72E5BA396}" = lport=5353 | protocol=17 | dir=in | name=bonjour |

========== Vista Active Application Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{17A55266-EACE-43F1-8A44-18A58F7AB05B}" = dir=in | app=c:\program files\common files\mcafee\mcsvchost\mcsvhost.exe |
"{256F9973-04FE-4445-80D1-2201DC148A00}" = dir=in | app=c:\program files\common files\mcafee\mna\mcnasvc.exe |
"{6928E0E5-4233-42FA-A825-71B20ADA4AEB}" = protocol=6 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{7B215B07-F675-41F9-8EEE-549D9EE404D2}" = protocol=6 | dir=in | app=c:\program files\airport\apagent.exe |
"{96E0564E-2B87-446E-B188-47CC4888D496}" = protocol=17 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{A2666CE5-510B-4F9C-97BB-90A296755CB6}" = protocol=17 | dir=in | app=c:\program files\common files\mcafee\mcsvchost\mcsvhost.exe |
"{B67974AD-37D8-45D6-81F5-2675FA9AEEC0}" = protocol=6 | dir=in | app=c:\program files\common files\mcafee\mcsvchost\mcsvhost.exe |
"{B981E5EE-D2D9-4CFB-8CF1-BC96AF7B3FBB}" = dir=in | app=c:\program files\itunes\itunes.exe |
"{DE7D9238-1DE8-4CA7-8B59-A0305E85C95A}" = protocol=17 | dir=in | app=c:\program files\airport\apagent.exe |

========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{045DB95B-F123-B440-D999-AD083AA55196}" = CCC Help German
"{055EE59D-217B-43A7-ABFF-507B966405D8}" = ATI Catalyst Control Center
"{08E81ABD-79F7-49C2-881F-FD6CB0975693}" = Roxio Creator Data
"{09760D42-E223-42AD-8C3E-55B47D0DDAC3}" = Roxio Creator DE
"{0D2E9DCB-9938-475E-B4DD-8851738852FF}" = AIO_Scan
"{11CB6E0D-FFB2-7FAE-17FC-CA92BEE8F24A}" = Catalyst Control Center Localization Japanese
"{1400192B-D969-6FD4-8044-E2D07C5ADE3A}" = Catalyst Control Center Localization German
"{14BD87BE-02AA-8E04-602C-B20A43267F5B}" = CCC Help Japanese
"{1662D4E1-B469-D6A3-085B-0B5350BF7CA5}" = Catalyst Control Center Localization Italian
"{168879EE-A348-BFB7-3622-3651449C629F}" = CCC Help Italian
"{1746EA69-DCB6-4408-B5A5-E75F55439CDF}" = Scan
"{179C56A4-F57F-4561-8BBF-F911D26EB435}" = WebReg
"{18455581-E099-4BA8-BC6B-F34B2F06600C}" = Google Toolbar for Internet Explorer
"{1A8E3C5D-B772-CB4A-1117-751B5D79787B}" = Catalyst Control Center Graphics Light
"{1B2E11A4-8566-B8C7-3FB6-0D2A6F8D2139}" = CCC Help Portuguese
"{1F54DAFA-9261-4A62-B59D-6C9F26B48FE4}" = Roxio Creator Tools
"{2318C2B1-4965-11d4-9B18-009027A5CD4F}" = Google Toolbar for Internet Explorer
"{2357B8BC-88C9-4A72-818C-050CC4EB0778}" = AOL Install
"{2614F54E-A828-49FA-93BA-45A3F756BFAA}" = 32 Bit HP CIO Components Installer
"{266156C9-F681-A84B-083C-D2052A461583}" = Catalyst Control Center Graphics Full New
"{26A24AE4-039D-4CA4-87B4-2F83216024FF}" = Java™ 6 Update 29
"{27C467F8-F8EF-4f68-BD72-D63632B2096C}" = McAfee Online Backup
"{2A6FFA23-9188-E796-4AFF-196A2004AA39}" = ccc-utility
"{2AFFFDD7-ED85-4A90-8C52-5DA9EBDC9B8F}" = Microsoft SQL Server 2005 Express Edition (MSSMLBIZ)
"{2B14A44F-5815-4136-9ECF-B56E928CEC0F}" = 6200
"{2EE437A9-75E3-10D1-3633-D4E8D6043503}" = CCC Help Spanish
"{2F3BCA05-4FD4-9418-1976-32F783E43DF4}" = Catalyst Control Center Graphics Full Existing
"{30465B6C-B53F-49A1-9EBA-A3F187AD502E}" = Roxio Update Manager
"{32343DB6-9A52-40C9-87E4-5E7C79791C87}" = MSXML 4.0 SP2 and SOAP Toolkit 3.0
"{36FDBE6E-6684-462B-AE98-9A39A1B200CC}" = HP Product Assistant
"{388E4B09-3E71-4649-8921-F44A3A2954A7}" = Microsoft Visual Studio 2005 Tools for Office Runtime
"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
"{3CE8C77E-8703-B62E-8F7C-31F7AA97F2A7}" = Catalyst Control Center Localization French
"{4524E7FD-A547-C564-CD8F-A872F7C39029}" = CCC Help French
"{47FA2C44-D148-4DBC-AF60-B91934AA4842}" = Adobe AIR
"{49F2B650-2D7B-4F59-B33D-346F63776BD3}" = DocProc
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4C0F8A40-2273-43E1-8C61-40D7F0573EDE}" = AirPort
"{4D3C9F4B-4B7D-4E5D-99B9-0123AB0D51ED}" = Dell DataSafe Online
"{50120000-1105-0000-0000-0000000FF1CE}" = Microsoft Office 2007 Primary Interop Assemblies
"{53C6D09E-EAB6-49E5-BA4C-BA7FF13830FB}" = Sound Blaster Audigy ADVANCED MB
"{53F5C3EE-05ED-4830-994B-50B2F0D50FCE}" = Microsoft SQL Server Setup Support Files (English)
"{55584E16-4D70-44EE-93DD-F144E8B7D4B7}" = QuickBooks Product Listing Service
"{57752979-A1C9-4C02-856B-FBB27AC4E02C}" = QuickTime
"{58E6A969-8215-4ABC-BD73-FCB25EA6F544}" = FormViewer
"{5A3F6A80-7913-475E-8B96-477A952CFA43}" = SupportSoft Assisted Service
"{5CD29180-A95E-11D3-A4EB-00C04F7BDB2C}" = User's Guides
"{5E68BB65-4059-4FE5-AAC4-0CD1D79BBDE2}" = EarthLink Setup Files
"{606BC780-101C-41DB-808D-4539BFA0774A}" = MobileMe Control Panel
"{62230596-37E5-4618-A329-0D21F529A86F}" = Browser Address Error Redirector
"{6675CA7F-E51B-4F6A-99D4-F8F0124C6EAA}" = Roxio Express Labeler 3
"{66E6CE0C-5A1E-430C-B40A-0C90FF1804A8}" = eSupportQFolder
"{67D3F1A0-A1F2-49b7-B9EE-011277B170CD}" = HPProductAssistant
"{68AB3A70-25E1-4D41-BDFF-7ED20C07D623}" = 6200Trb
"{691652E3-D900-49C8-843B-2EB459A13653}" = Rapattoni MLS PDF Creator
"{6956856F-B6B3-4BE0-BA0B-8F495BE32033}" = Apple Software Update
"{6E4FC36F-A7B5-EE38-2FE4-7D0D94D230F5}" = Catalyst Control Center Localization Portuguese
"{6EF2AFEF-2044-4A85-ED1F-E70A568D7ED9}" = Catalyst Control Center Localization Turkish
"{6F5E2F4A-377D-4700-B0E3-8F7F7507EA15}" = CustomerResearchQFolder
"{716E0306-8318-4364-8B8F-0CC4E9376BAC}" = MSXML 4.0 SP2 Parser and SDK
"{73A4F29F-31AC-4EBD-AA1B-0CC5F18C8F83}" = Roxio Creator Audio
"{75F8E142-7720-156D-C74C-80AA0974B993}" = CCC Help Polish
"{7670D32F-DAE6-4E49-8C8B-B3F08B5B1686}" = Microsoft SQL Server Native Client
"{7727DA6C-A845-890D-2B48-7863A93F167C}" = Catalyst Control Center Localization Korean
"{777CA40C-0206-4EF6-A0FC-618BF06BF8D0}" = Intel® PRO Network Connections 12.1.11.0
"{787D1A33-A97B-4245-87C0-7174609A540C}" = HP Update
"{7985F97F-7363-4A1E-80B9-50C4F0E8D19E}" = 6200_Help
"{7A7DC702-DEDE-42A8-8722-B3BA724D546F}" = Fax
"{7C5B4583-7CBF-4289-B195-03B553959DEA}" = VoiceOver Kit
"{7DB9F1E5-9ACB-410D-A7DC-7A3D023CE045}" = Dell Getting Started Guide
"{7E6066E6-8B5B-4100-B0FA-1D9E9B663CBA}" = iTunes
"{7F1B3341-A94E-4F5C-B587-CA0EB964221E}" = Microsoft Money Shared Libraries
"{87CA11B3-C4CE-D989-42C7-C6197B266EFD}" = CCC Help Chinese Standard
"{87E2B986-07E8-477a-93DC-AF0B6758B192}" = DocProcQFolder
"{89CEAE14-DD0F-448E-9554-15781EC9DB24}" = Product Documentation Launcher
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{90120000-0016-0409-0000-0000000FF1CE}" = Microsoft Office Excel MUI (English) 2007
"{90120000-0016-0409-0000-0000000FF1CE}_SMALLBUSINESSR_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0018-0409-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (English) 2007
"{90120000-0018-0409-0000-0000000FF1CE}_SMALLBUSINESSR_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0019-0409-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (English) 2007
"{90120000-0019-0409-0000-0000000FF1CE}_SMALLBUSINESSR_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-001A-0409-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (English) 2007
"{90120000-001A-0409-0000-0000000FF1CE}_SMALLBUSINESSR_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-001B-0409-0000-0000000FF1CE}" = Microsoft Office Word MUI (English) 2007
"{90120000-001B-0409-0000-0000000FF1CE}_SMALLBUSINESSR_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-0409-0000-0000000FF1CE}_SMALLBUSINESSR_{1FF96026-A04A-4C3E-B50A-BB7022654D0F}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-040C-0000-0000000FF1CE}_SMALLBUSINESSR_{71F055E8-E2C6-4214-BB3D-BFE03561B89E}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-0C0A-0000-0000000FF1CE}" = Microsoft Office Proof (Spanish) 2007
"{90120000-001F-0C0A-0000-0000000FF1CE}_SMALLBUSINESSR_{2314F9A1-126F-45CC-8A5E-DFAF866F3FBC}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-002C-0409-0000-0000000FF1CE}" = Microsoft Office Proofing (English) 2007
"{90120000-006E-0409-0000-0000000FF1CE}" = Microsoft Office Shared MUI (English) 2007
"{90120000-006E-0409-0000-0000000FF1CE}_SMALLBUSINESSR_{98333358-268C-4164-B6D4-C96DF5153727}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0115-0409-0000-0000000FF1CE}" = Microsoft Office Shared Setup Metadata MUI (English) 2007
"{90120000-0115-0409-0000-0000000FF1CE}_SMALLBUSINESSR_{98333358-268C-4164-B6D4-C96DF5153727}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90A40409-6000-11D3-8CFE-0150048383C9}" = Microsoft Office 2003 Web Components
"{91120000-00CA-0000-0000-0000000FF1CE}" = Microsoft Office Small Business 2007
"{91120000-00CA-0000-0000-0000000FF1CE}_SMALLBUSINESSR_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{91F2493D-8A65-7BF3-5684-9D6397F8847D}" = Catalyst Control Center Core Implementation
"{95D08F4E-DFC2-4ce3-ACB7-8C8E206217E9}" = MarketResearch
"{978C25EE-5777-46e4-8988-732C297CBDBD}" = Status
"{9794B30C-0FCB-3658-B44F-33BDDC788C2D}" = CCC Help English
"{994FCE98-1379-2A33-24BC-F092466CC5C4}" = Catalyst Control Center Localization Thai
"{9A2F0810-3622-4E86-9072-973FBE1679C5}" = QuickBooks Pro 2009
"{9A2F0810-369F-4E86-9072-973FBE1679C5}" = QuickBooks
"{9B1FD9CE-0776-4f0b-A6F5-C6AB7B650CDF}" = Destinations
"{A36CD345-625C-4d6c-B3E2-76E1248CB451}" = SolutionCenter
"{A3B7C670-4A1E-4EE2-950E-C875BC1965D0}" = Copy
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{A939D341-5A04-4E0A-BB55-3E65B386432D}" = Microsoft Office Small Business Connectivity Components
"{AB5D51AE-EBC3-438D-872C-705C7C2084B0}" = DeviceManagementQFolder
"{AC76BA86-7AD7-1033-7B44-A81300000003}_814" = KB408682
"{AC76BA86-7AD7-1033-7B44-AA1000000001}" = Adobe Reader X (10.1.3)
"{AC76BA86-7AD7-5464-3428-800000000003}" = Spelling Dictionaries Support For Adobe Reader 8
"{AC7C7307-6324-D891-1E53-77B00E4F0961}" = CCC Help Turkish
"{AFAC914D-9E83-4A89-8ABE-427521C82CCF}" = Safari
"{B2544A03-10D0-4E5E-BA69-0362FFC20D18}" = OGA Notifier 2.0.0048.0
"{B32C4059-6E7A-41EF-AD20-56DF1872B923}" = Business Contact Manager for Outlook 2007 SP2
"{B3575D00-27EF-49C2-B9E0-14B3D954E992}" = Apple Application Support
"{B6A26DE5-F2B5-4D58-9570-4FC760E00FCD}" = Roxio Creator Copy
"{B6EECBB7-BDA4-4E52-2BD6-69D70215AC48}" = Catalyst Control Center Localization Polish
"{BCE72AED-3332-4863-9567-C5DCB9052CA2}" = Netflix Movie Viewer
"{BE77A81F-B315-4666-9BF3-AE70C0ADB057}" = BufferChm
"{BEEFC4F8-2909-48B3-AFAA-55D3533FDEDD}" = Creative MediaSource 5
"{C23CD6DA-1958-43A5-ADD0-59396572E02E}" = Apple Mobile Device Support
"{C279E4B3-9FCD-9D82-7A83-B773C2D4E526}" = Catalyst Control Center Localization Hungarian
"{C2D192BE-5E2C-92CF-56A0-28C7D9D67B96}" = CCC Help Hungarian
"{C2E4B5BD-32DB-4817-A060-341AB17C3F90}" = Bonjour
"{C2F3DB53-EF8E-4885-36C4-34C4911FEAE0}" = ccc-core-static
"{C486C7E9-5591-8777-CEB5-FA373AFE6711}" = Catalyst Control Center Localization Spanish
"{C57606D6-7A44-4A99-D6D0-BA07FD3ACCEA}" = Catalyst Control Center Localization Chinese Traditional
"{C716522C-3731-4667-8579-40B098294500}" = Toolbox
"{C916D86C-AB76-49c7-B0E4-A946E0FD9BC2}" = HP Photosmart, Officejet, PSC and Deskjet All-In-One Driver Software 8.0.B
"{CCFF1E13-77A2-4032-8B12-7566982A27DF}" = Internet Service Offers Launcher
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{CFF4500E-C5D6-695D-A027-B3D4DDED2CC3}" = McAfee Online Backup
"{D379100F-65A2-4B54-D568-CD2BE238C6A3}" = Catalyst Control Center Graphics Previews Vista
"{D7769185-9A7C-48D4-8874-5388743A1DE2}" = Music, Photos & Videos Launcher
"{D973AE1D-ACB1-2C54-92FE-A29E2A7482C0}" = CCC Help Thai
"{E06F04B9-45E6-4AC0-8083-85F7515F40F7}" = UnloadSupport
"{E09575B2-498D-4C8B-A9D2-623F78574F29}" = AIO_CDB_Software
"{E0EFA6E0-2A18-A83B-34EA-8435EFEE1285}" = CCC Help Korean
"{E24EDDF0-93A0-95CC-509A-1C012180F8CB}" = Skins
"{E3BFEE55-39E2-4BE0-B966-89FE583822C1}" = Dell Support Center (Support Software)
"{E53C563F-1157-20B2-1276-755A22E814D2}" = Catalyst Control Center Localization Chinese Standard
"{E7084B89-69E0-46B3-A118-8F99D06988CD}" = Microsoft SQL Server VSS Writer
"{E7112940-5F8E-4918-B9FE-251F2F8DC81F}" = AIO_CDB_ProductContext
"{E8C06CB3-5DB2-4689-B1DC-4A0220DEA96C}" = Consumer Complete Care Services Agreement
"{EAEFE1C0-EB56-8963-9EC5-A0EB5FBA358D}" = TweetDeck
"{EB21A812-671B-4D08-B974-2A347F0D8F70}" = HP Photosmart Essential
"{EB75DE50-5754-4F6F-875D-126EDF8E4CB3}" = HPSSupply
"{ED439A64-F018-4DD4-8BA5-328D85AB09AB}" = Roxio Creator DE
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F6B8797E-923E-4902-9698-62937FE80FAB}" = CCC Help Chinese Traditional
"{FA54AFB1-5745-4389-B8C1-9F7509672ED1}" = iPhone Configuration Utility
"{FBF1268D-3323-545E-4DD0-F45AD313E37E}" = Catalyst Control Center Graphics Previews Common
"{FF075778-6E50-47ed-991D-3B07FD4E3250}" = TrayApp
"AbiWord" = AbiWord v2.8.6
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX
"Amazon MP3 Downloader" = Amazon MP3 Downloader 1.0.14
"Business Contact Manager" = Business Contact Manager for Outlook 2007 SP2
"GamesBar" = GamesBar [removed]
"HDMI" = Intel® Graphics Media Accelerator Driver
"HP Imaging Device Functions" = HP Imaging Device Functions 8.0
"HP Solution Center & Imaging Support Tools" = HP Solution Center 8.0
"HPExtendedCapabilities" = HP Customer Participation Program 8.0
"HPOCR" = HP OCR Software 8.0
"InstallShield_{58E6A969-8215-4ABC-BD73-FCB25EA6F544}" = FormViewer
"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware version 1.61.0.1400
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft SQL Server 2005" = Microsoft SQL Server 2005
"Microsoft Visual Studio 2005 Tools for Office Runtime" = Visual Studio 2005 Tools for Office Second Edition Runtime
"Money2008b" = Microsoft Money Plus
"MSC" = McAfee Total Protection
"PROSetDX" = Intel® PRO Network Connections 12.1.11.0
"SMALLBUSINESSR" = Microsoft Office Small Business 2007
"TweetDeckFast.FFF259DC0CE2657847BBB4AFF0E62062EFC56543.1" = TweetDeck
"Yahoo! Companion" = Yahoo! Toolbar

========== HKEY_USERS Uninstall List ==========

[HKEY_USERS\S-1-5-21-2389996163-2268114237-726783526-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Move Networks Player - IE" = Move Networks Media Player for Internet Explorer
"RivalGaming" = RivalGaming
"Spotify" = Spotify

========== Last 20 Event Log Errors ==========

[ Application Events ]
Error - 6/20/2012 11:54:57 AM | Computer Name = Roycroft-PC | Source = Windows Search Service | ID = 9000
Description =

Error - 6/20/2012 11:54:57 AM | Computer Name = Roycroft-PC | Source = Windows Search Service | ID = 7040
Description =

Error - 6/20/2012 11:54:57 AM | Computer Name = Roycroft-PC | Source = Windows Search Service | ID = 9002
Description =

Error - 6/20/2012 11:54:57 AM | Computer Name = Roycroft-PC | Source = Windows Search Service | ID = 3029
Description =

Error - 6/20/2012 11:54:58 AM | Computer Name = Roycroft-PC | Source = Windows Search Service | ID = 3029
Description =

Error - 6/20/2012 11:54:58 AM | Computer Name = Roycroft-PC | Source = Windows Search Service | ID = 3028
Description =

Error - 6/20/2012 11:54:58 AM | Computer Name = Roycroft-PC | Source = Windows Search Service | ID = 3058
Description =

Error - 6/20/2012 11:57:29 AM | Computer Name = Roycroft-PC | Source = EventSystem | ID = 4621
Description =

Error - 6/20/2012 12:03:06 PM | Computer Name = Roycroft-PC | Source = EventSystem | ID = 4621
Description =

Error - 6/20/2012 12:05:48 PM | Computer Name = Roycroft-PC | Source = EventSystem | ID = 4609
Description =

[ Media Center Events ]
Error - 4/16/2008 5:42:19 PM | Computer Name = Roycroft-PC | Source = MCUpdate | ID = 0
Description = DownloadPackgeTask.SubTasksComplete: failed downloading package MCESpotlight.

Error - 5/23/2008 4:04:47 PM | Computer Name = Roycroft-PC | Source = MCUpdate | ID = 0
Description = DownloadPackgeTask.SubTasksComplete: failed downloading package MCESpotlight.

Error - 5/30/2008 6:36:58 AM | Computer Name = Roycroft-PC | Source = MCUpdate | ID = 0
Description = DownloadPackgeTask.SubTasksComplete: failed downloading package MCESpotlight.

Error - 6/3/2008 7:52:29 AM | Computer Name = Roycroft-PC | Source = MCUpdate | ID = 0
Description = DownloadPackgeTask.SubTasksComplete: failed downloading package MCESpotlight.

Error - 8/28/2008 9:17:59 AM | Computer Name = Roycroft-PC | Source = MCUpdate | ID = 0
Description = DownloadPackgeTask.SubTasksComplete: failed downloading package SportsSchedule.

Error - 9/7/2008 3:35:43 PM | Computer Name = Roycroft-PC | Source = MCUpdate | ID = 0
Description = DownloadPackgeTask.SubTasksComplete: failed downloading package SportsSchedule.

Error - 6/9/2009 9:04:36 AM | Computer Name = Roycroft-PC | Source = MCUpdate | ID = 0
Description = DownloadPackgeTask.SubTasksComplete: failed downloading package SportsSchedule.

Error - 12/17/2009 1:12:46 AM | Computer Name = Roycroft-PC | Source = MCUpdate | ID = 0
Description = DownloadPackgeTask.SubTasksComplete: failed downloading package SportsSchedule.

[ OSession Events ]
Error - 5/15/2010 9:46:21 AM | Computer Name = Roycroft-PC | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 6, Application Name: Microsoft Office Outlook, Application Version:
12.0.6514.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 69
seconds with 60 seconds of active time. This session ended with a crash.

[ System Events ]
Error - 6/20/2012 11:55:47 AM | Computer Name = Roycroft-PC | Source = DCOM | ID = 10010
Description =

Error - 6/20/2012 11:56:02 AM | Computer Name = Roycroft-PC | Source = Service Control Manager | ID = 7024
Description =

Error - 6/20/2012 11:56:02 AM | Computer Name = Roycroft-PC | Source = Service Control Manager | ID = 7031
Description =

Error - 6/20/2012 12:05:33 PM | Computer Name = Roycroft-PC | Source = DCOM | ID = 10005
Description =

Error - 6/20/2012 12:05:48 PM | Computer Name = Roycroft-PC | Source = DCOM | ID = 10005
Description =

Error - 6/20/2012 12:05:51 PM | Computer Name = Roycroft-PC | Source = DCOM | ID = 10005
Description =

Error - 6/20/2012 12:05:59 PM | Computer Name = Roycroft-PC | Source = Service Control Manager | ID = 7001
Description =

Error - 6/20/2012 12:05:59 PM | Computer Name = Roycroft-PC | Source = Service Control Manager | ID = 7026
Description =

Error - 6/20/2012 12:05:59 PM | Computer Name = Roycroft-PC | Source = DCOM | ID = 10005
Description =

Error - 6/20/2012 12:09:35 PM | Computer Name = Roycroft-PC | Source = DCOM | ID = 10005
Description =


< End of report >
Post #12
I will look at your log and reply as soon as I can.

Meanwhile, I asked you tou run another scan, (Unhide), and asked for the result.

Please tell me if there is any change with your start menu.
Post #13
It's a lot of lines of log to look through, thank you so much.

My start menu is back in safe mode, as are most, if not all, of my desktop shortcuts. Here is the unhide log.

Unhide by Lawrence Abrams (Grinler)
http://www.bleepingcomputer.com/
Copyright 2008-2012 BleepingComputer.com
More Information about Unhide.exe can be found at this link:
http://www.bleepingcomputer.com/forums/topic405109.html

Program started at: 06/20/2012 08:55:42 PM
Windows Version: Windows Vista

Please be patient while your files are made visible again.

Processing the C:\ drive
Finished processing the C:\ drive. 279627 files processed.

Processing the D:\ drive
Finished processing the D:\ drive. 11751 files processed.

Processing the G:\ drive
Finished processing the G:\ drive. 0 files processed.

Processing the H:\ drive
Finished processing the H:\ drive. 0 files processed.

Processing the I:\ drive
Finished processing the I:\ drive. 0 files processed.

Processing the J:\ drive
Finished processing the J:\ drive. 0 files processed.

Processing the K:\ drive
Finished processing the K:\ drive. 159 files processed.

Restoring the Start Menu.
* 35 Shortcuts and Desktop items were restored.


Searching for Windows Registry changes made by FakeHDD rogues.
- Checking HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer
- Checking HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer
- Checking HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System
- Checking HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced
* Start_ShowControlPanel was set to 0! It was set back to 1!
* Start_ShowHelp was set to 0! It was set back to 1!
* Start_ShowMyComputer was set to 0! It was set back to 1!
* Start_ShowMyDocs was set to 0! It was set back to 1!
* Start_ShowMyMusic was set to 0! It was set back to 1!
* Start_ShowMyPics was set to 0! It was set back to 1!
* Start_ShowPrinters was set to 0! It was set back to 1!
* Start_ShowRun was set to 0! It was set back to 1!
* Start_ShowSearch was set to 0! It was set back to 1!
* Start_ShowSetProgramAccessAndDefaults was set to 0! It was set back to 1!
* Start_ShowRecentDocs was set to 0! It was set back to 2!
* Start_ShowNetConn was set to 0! It was set back to 1!
* Start_ShowNetPlaces was set to 0! It was set back to 1!
* Start_TrackDocs was set to 0! It was set back to 1!
* Start_TrackProgs was set to 0! It was set back to 1!
* Start_ShowUser was set to 0! It was set back to 1!
* Start_ShowMyGames was set to 0! It was set back to 1!

Restarting Explorer.exe in order to apply changes.

Program finished at: 06/20/2012 09:02:23 PM
Execution time: 0 hours(s), 6 minute(s), and 40 seconds(s)
Post #14 last edited
Hi bellemov

Thanks for the unhide log.

Run OTL
  • double click on the icon to run it.
  • copy/paste ALL the following text written inside the code box into the Custom Scans/Fixes box located at the bottom of OTL

    :Services

:OTL
IE - HKU\S-1-5-21-2389996163-2268114237-726783526-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://start.iplay.com/?o=shp
IE - HKU\S-1-5-21-2389996163-2268114237-726783526-1003\..\SearchScopes,DefaultScope = {8C35CC7F-3F7C-4820-B54A-02F883BD76DD}
IE - HKU\S-1-5-21-2389996163-2268114237-726783526-1003\..\SearchScopes\{36377DD7-B3EB-42f5-986F-680BAF59BA9D}: "URL" = http://start.iplay.com/searchresults.aspx?…q={searchTerms}
IE - HKU\S-1-5-21-2389996163-2268114237-726783526-1003\..\SearchScopes\{4E1CF49E-1AD9-4E83-BB2E-85568FB6B921}: "URL" = http://websearch.ask.com/redirect?client=i…68-F5FEC694BFEA
IE - HKU\S-1-5-21-2389996163-2268114237-726783526-1003\..\SearchScopes\{8C35CC7F-3F7C-4820-B54A-02F883BD76DD}: "URL" = http://www.google.com/search?q={searchTerm…;rlz=1I7DLUS_en
FF - HKLM\Software\MozillaPlugins\@oberon-media.com/ONCAdapter: C:\Program Files\Common Files\Oberon Media\NCAdapter\1.0.0.7\npapicomadapter.dll (Oberon-Media )
O2 - BHO: (RivalGaming Games) - {26D675AC-D925-4bbf-A720-62C2AA4A81EB} - C:\Users\maureen\AppData\Local\RivalGaming\RivalGaming.dll (RivalGaming)
O2 - BHO: (GamesBarBHO Class) - {CB0D163C-E9F4-4236-9496-0597E24B23A5} - C:\Program Files\GamesBar\2.0.1.82\oberontb.dll File not found
O3 - HKLM\..\Toolbar: (GamesBar) - {6F282B65-56BF-4BD1-A8B2-A4449A05863D} - C:\Program Files\GamesBar\2.0.1.82\oberontb.dll File not found
O3 - HKU\S-1-5-21-2389996163-2268114237-726783526-1003\..\Toolbar\WebBrowser: (no name) - {D4027C7F-154A-4066-A1AD-4243D8127440} - No CLSID value found.
O4 - HKU\S-1-5-21-2389996163-2268114237-726783526-1003..\Run: [LgAKeeGGDTtSbJ.exe] C:\ProgramData\LgAKeeGGDTtSbJ.exe ()
O4 - HKU\S-1-5-21-2389996163-2268114237-726783526-1003..\Run: [SearchEngineProtection] C:\Program Files\Gamesbar\SearchEngineProtection.exe File not found
O9 - Extra 'Tools' menuitem : GamesBar - {1A93C934-025B-4c3a-B38E-9654A7003239} - Reg Error: Value error. File not found
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
[2012/06/18 20:34:38 | 000,000,000 | —D | C] – C:\ProgramData\Oberon Media
[2012/06/18 20:34:33 | 000,000,000 | —D | C] – C:\Users\maureen\AppData\Roaming\Oberon Media
[2012/06/18 20:34:32 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\GamesBar
[2012/06/18 20:34:31 | 000,000,000 | —D | C] – C:\ProgramData\GamesBar
[2012/06/18 20:34:27 | 000,000,000 | —D | C] – C:\Program Files\Common Files\Oberon Media
[2012/06/18 20:34:19 | 000,000,000 | —D | C] – C:\Users\maureen\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\RivalGaming
[2012/06/18 20:34:19 | 000,000,000 | —D | C] – C:\Users\maureen\AppData\Local\RivalGaming
[2012/06/18 20:34:19 | 000,000,268 | —- | M] () – C:\Windows\tasks\RGames Updater.job
[2012/06/18 13:35:38 | 000,346,760 | —- | M] () – C:\ProgramData\LgAKeeGGDTtSbJ.exe
[2012/06/18 13:35:38 | 000,346,760 | —- | M] () – C:\ProgramData\LgAKeeGGDTtSbJ.exe
[2012/06/18 13:37:59 | 000,346,760 | —- | C] () – C:\ProgramData\LgAKeeGGDTtSbJ.exe

:Files
ipconfig /flushdns /c

:Commands
[purity]
[resethosts]
[Reboot]

  • click the Run Fix button at the top
  • let the program run unhindered, reboot when it is done
  • post a new OTL log (don't check the boxes beside LOP Check or Purity this time)

=========================================

Run RogueKiller

IMPORTANT: Do not reboot your computer if at all possible otherwise the malware will reactivate and you will have to run RogueKiller again
  • download RogueKiller by tigzy and save it to your desktop
  • close all programs
  • double-click RogueKiller.exe
  • after it has completed it's prescan click Shortcut Fix
  • when the scan is complete click report
Please post the log.

Logs to include in the next post:

OTL fix log
New OTL log
RogueKiller log

Please tell me if your shortcuts are back and try booting in normal mode and tell me what happens.

Thanks

Satchfan
Post #15
When OTL was done running, it immediately rebooted. I can't see any logs after the reboot.
It rebooted normally and none of the pop-up warnings appeared this time.
Here is the Rogue Killer log.

RogueKiller V7.5.4 [06/07/2012] by Tigzy
mail: tigzyRKgmailcom
Feedback: http://www.geekstogo.com/forum/files/file/413-roguekiller/
Blog: http://tigzyrk.blogspot.com

Operating System: Windows Vista (6.0.6002 Service Pack 2) 32 bits version
Started in : Normal mode
User: maureen [Admin rights]
Mode: Scan – Date: 06/21/2012 07:54:08

¤¤¤ Bad processes: 1 ¤¤¤
[SUSP PATH] OTL.exe – C:\Users\maureen\Desktop\OTL.exe -> KILLED [TermProc]

¤¤¤ Registry Entries: 5 ¤¤¤
[HJ] HKLM\[…]\NewStartPanel : {59031a47-3f72-44a7-89c5-5595fe6b30ee} (1) -> FOUND
[HJ] HKCU\[…]\ClassicStartMenu : {59031a47-3f72-44a7-89c5-5595fe6b30ee} (1) -> FOUND
[HJ] HKLM\[…]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> FOUND
[HJ] HKCU\[…]\ClassicStartMenu : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> FOUND
[HJ] HKCU\[…]\ClassicStartMenu : {645FF040-5081-101B-9F08-00AA002F954E} (1) -> FOUND

¤¤¤ Particular Files / Folders: ¤¤¤

¤¤¤ Driver: [LOADED] ¤¤¤

¤¤¤ Infection : ¤¤¤

¤¤¤ HOSTS File: ¤¤¤
ÿþ1

¤¤¤ MBR Check: ¤¤¤

+++++ PhysicalDrive0: ST3500630AS ATA Device +++++
— User —
[MBR] f099720723d4e3a0fdeb4fff6dc11fac
[BSP] 5114e3fd9951cb2acb33983720a9f917 : Windows Vista MBR Code
Partition table:
0 - [XXXXXX] DELL-UTIL (0xde) [VISIBLE] Offset (sectors): 63 | Size: 54 Mo
1 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 112640 | Size: 10240 Mo
2 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 21084160 | Size: 466644 Mo
User = LL1 … OK!
User = LL2 … OK!

+++++ PhysicalDrive1: Kingston DataTraveler 2.0 USB Device +++++
— User —
[MBR] 967c604016f09924d52a16ee2abcf1ab
[BSP] ec038f3ca5091360f60d743d6f1c7fdb : Standard MBR Code
Partition table:
0 - [XXXXXX] FAT32 (0x0b) [VISIBLE] Offset (sectors): 8 | Size: 3851 Mo
User = LL1 … OK!
Error reading LL2 MBR!

Finished : << RKreport[2].txt >>
RKreport[1].txt ; RKreport[2].txt

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI