What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

PUM.Hijack.Startmenu [Solved]

17 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #16
That's good news. Are all your shortcuts back also?

The OTL fix log can be found at C:\_OTL\MovedFiles. The file name will consist of numbers that reflect the date and time the fix was run. It will be something like 21052012_111009.log.

Please copy and paste the contents into your next reply together with a new OTL log.
Post #17
========== SERVICES/DRIVERS ==========
========== OTL ==========
HKU\S-1-5-21-2389996163-2268114237-726783526-1003\SOFTWARE\Microsoft\Internet Explorer\Main\\Start Page| /E : value set successfully!
HKEY_USERS\S-1-5-21-2389996163-2268114237-726783526-1003\Software\Microsoft\Internet Explorer\SearchScopes\\DefaultScope| /E : value set successfully!
Registry key HKEY_USERS\S-1-5-21-2389996163-2268114237-726783526-1003\Software\Microsoft\Internet Explorer\SearchScopes\{36377DD7-B3EB-42f5-986F-680BAF59BA9D}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{36377DD7-B3EB-42f5-986F-680BAF59BA9D}\ not found.
Registry key HKEY_USERS\S-1-5-21-2389996163-2268114237-726783526-1003\Software\Microsoft\Internet Explorer\SearchScopes\{4E1CF49E-1AD9-4E83-BB2E-85568FB6B921}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4E1CF49E-1AD9-4E83-BB2E-85568FB6B921}\ not found.
Registry key HKEY_USERS\S-1-5-21-2389996163-2268114237-726783526-1003\Software\Microsoft\Internet Explorer\SearchScopes\{8C35CC7F-3F7C-4820-B54A-02F883BD76DD}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8C35CC7F-3F7C-4820-B54A-02F883BD76DD}\ not found.
Registry key HKEY_LOCAL_MACHINE\Software\MozillaPlugins\@oberon-media.com/ONCAdapter\ deleted successfully.
C:\Program Files\Common Files\Oberon Media\NCAdapter\1.0.0.7\npapicomadapter.dll moved successfully.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{26D675AC-D925-4bbf-A720-62C2AA4A81EB}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{26D675AC-D925-4bbf-A720-62C2AA4A81EB}\ deleted successfully.
C:\Users\maureen\AppData\Local\RivalGaming\RivalGaming.dll moved successfully.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{CB0D163C-E9F4-4236-9496-0597E24B23A5}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CB0D163C-E9F4-4236-9496-0597E24B23A5}\ deleted successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{6F282B65-56BF-4BD1-A8B2-A4449A05863D} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6F282B65-56BF-4BD1-A8B2-A4449A05863D}\ deleted successfully.
Registry value HKEY_USERS\S-1-5-21-2389996163-2268114237-726783526-1003\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{D4027C7F-154A-4066-A1AD-4243D8127440} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D4027C7F-154A-4066-A1AD-4243D8127440}\ not found.
Registry value HKEY_USERS\S-1-5-21-2389996163-2268114237-726783526-1003\Software\Microsoft\Windows\CurrentVersion\Run\\LgAKeeGGDTtSbJ.exe deleted successfully.
C:\ProgramData\LgAKeeGGDTtSbJ.exe moved successfully.
Registry value HKEY_USERS\S-1-5-21-2389996163-2268114237-726783526-1003\Software\Microsoft\Windows\CurrentVersion\Run\\SearchEngineProtection deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{1A93C934-025B-4c3a-B38E-9654A7003239}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1A93C934-025B-4c3a-B38E-9654A7003239}\ not found.
Starting removal of ActiveX control {E2883E8F-472F-4FB0-9522-AC9BF37916A7}
C:\WINDOWS\Downloaded Program Files\gp.inf not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{E2883E8F-472F-4FB0-9522-AC9BF37916A7}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E2883E8F-472F-4FB0-9522-AC9BF37916A7}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{E2883E8F-472F-4FB0-9522-AC9BF37916A7}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E2883E8F-472F-4FB0-9522-AC9BF37916A7}\ not found.
C:\ProgramData\Oberon Media\Services\Search folder moved successfully.
C:\ProgramData\Oberon Media\Services folder moved successfully.
C:\ProgramData\Oberon Media folder moved successfully.
C:\Users\maureen\AppData\Roaming\Oberon Media\Search\SearchEngineProtection folder moved successfully.
C:\Users\maureen\AppData\Roaming\Oberon Media\Search folder moved successfully.
C:\Users\maureen\AppData\Roaming\Oberon Media folder moved successfully.
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\GamesBar folder moved successfully.
C:\ProgramData\GamesBar\onload folder moved successfully.
C:\ProgramData\GamesBar folder moved successfully.
C:\Program Files\Common Files\Oberon Media\Parts\1.0.0.14 folder moved successfully.
C:\Program Files\Common Files\Oberon Media\Parts folder moved successfully.
C:\Program Files\Common Files\Oberon Media\Odyssey\2.0.0.51 folder moved successfully.
C:\Program Files\Common Files\Oberon Media\Odyssey folder moved successfully.
C:\Program Files\Common Files\Oberon Media\OberonBroker\1.0.0.76 folder moved successfully.
C:\Program Files\Common Files\Oberon Media\OberonBroker folder moved successfully.
C:\Program Files\Common Files\Oberon Media\NCAdapter\1.0.0.7 folder moved successfully.
C:\Program Files\Common Files\Oberon Media\NCAdapter folder moved successfully.
C:\Program Files\Common Files\Oberon Media folder moved successfully.
C:\Users\maureen\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\RivalGaming folder moved successfully.
C:\Users\maureen\AppData\Local\RivalGaming folder moved successfully.
C:\Windows\Tasks\RGames Updater.job moved successfully.
File C:\ProgramData\LgAKeeGGDTtSbJ.exe not found.
File C:\ProgramData\LgAKeeGGDTtSbJ.exe not found.
File C:\ProgramData\LgAKeeGGDTtSbJ.exe not found.
========== FILES ==========
< ipconfig /flushdns /c >
Windows IP Configuration
Successfully flushed the DNS Resolver Cache.
C:\Users\maureen\Desktop\cmd.bat deleted successfully.
C:\Users\maureen\Desktop\cmd.txt deleted successfully.
========== COMMANDS ==========
HOSTS file reset successfully

OTL by OldTimer - Version 3.2.50.0 log created on 06212012_074838
Post #19
Thanks for the fix log but I still don’t have a new OTL log

The background wallpaper is changed to solid black.

It is the infection you had on your computer that changes the background wallpaper to solid black so it will need to be reset.

Cick on the Start button and then select Control Panel. When the Control Panel opens, please click on the Appearance and Personalization category. Then select Change the Theme or Change Desktop Background to revert back to your original Theme and colors.

Please send the new OTL log

Satchfan
Post #22
Run OTL

To be certain we get a current one, delete OTL.txt that is on your desktop and run it again
  • open OTL again and click the Quick Scan button (don't check the boxes beside LOP Check or Purity this time)
  • post the OTL.txt log it produces in your next reply.
Please post back with the log
Post #23
OTL logfile created on: 6/21/2012 10:15:22 AM - Run 2
OTL by OldTimer - Version 3.2.50.0 Folder = C:\Users\maureen\Desktop
Windows Vista Ultimate Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

3.25 Gb Total Physical Memory | 2.12 Gb Available Physical Memory | 65.13% Memory free
6.71 Gb Paging File | 5.28 Gb Available in Paging File | 78.64% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 455.71 Gb Total Space | 251.55 Gb Free Space | 55.20% Space Free | Partition Type: NTFS
Drive D: | 10.00 Gb Total Space | 5.25 Gb Free Space | 52.48% Space Free | Partition Type: NTFS

Computer Name: ROYCROFT-PC | User Name: maureen | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2012/06/20 11:56:44 | 000,596,992 | —- | M] (OldTimer Tools) – C:\Users\maureen\Desktop\OTL.exe
PRC - [2012/03/21 21:16:10 | 001,318,816 | —- | M] (McAfee, Inc.) – C:\Program Files\McAfee.com\Agent\mcagent.exe
PRC - [2012/03/20 13:11:32 | 000,151,880 | —- | M] (McAfee, Inc.) – C:\Program Files\Common Files\McAfee\SystemCore\mfevtps.exe
PRC - [2012/03/20 13:05:00 | 000,161,632 | —- | M] (McAfee, Inc.) – C:\Program Files\Common Files\McAfee\SystemCore\mfefire.exe
PRC - [2012/03/20 13:04:32 | 000,166,288 | —- | M] (McAfee, Inc.) – C:\Program Files\Common Files\McAfee\SystemCore\mcshield.exe
PRC - [2012/01/03 09:10:42 | 000,063,928 | —- | M] (Adobe Systems Incorporated) – C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe
PRC - [2011/12/22 08:31:08 | 000,045,056 | —- | M] (Intuit) – C:\Program Files\Common Files\Intuit\QuickBooks\QBCFMonitorService.exe
PRC - [2011/04/08 14:59:50 | 000,419,904 | —- | M] (McAfee, Inc.) – C:\Program Files\McAfee\MAT\McPvTray.exe
PRC - [2011/01/27 19:28:14 | 000,214,904 | —- | M] (McAfee, Inc.) – C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe
PRC - [2010/04/13 21:11:14 | 000,229,688 | —- | M] (McAfee, Inc.) – C:\Program Files\McAfee Online Backup\MOBKbackup.exe
PRC - [2009/11/11 17:17:02 | 000,771,360 | —- | M] (Apple Inc.) – C:\Program Files\AirPort\APAgent.exe
PRC - [2009/05/21 10:55:32 | 000,206,064 | —- | M] (SupportSoft, Inc.) – C:\Program Files\Dell Support Center\bin\sprtcmd.exe
PRC - [2009/04/11 02:27:36 | 002,926,592 | —- | M] (Microsoft Corporation) – C:\Windows\explorer.exe
PRC - [2008/08/13 18:32:40 | 000,201,968 | —- | M] (SupportSoft, Inc.) – C:\Program Files\Dell Support Center\bin\sprtsvc.exe
PRC - [2008/03/19 17:22:12 | 000,072,704 | —- | M] (Creative Labs) – C:\Program Files\Common Files\Creative Labs Shared\Service\CreativeLicensing.exe
PRC - [2008/01/11 17:50:16 | 000,030,312 | —- | M] (Microsoft Corporation) – C:\Program Files\Microsoft Small Business\Business Contact Manager\BcmSqlStartupSvc.exe
PRC - [2007/05/11 09:26:44 | 004,452,352 | —- | M] (Realtek Semiconductor) – C:\Windows\RtHDVCpl.exe
PRC - [2006/11/27 09:14:52 | 000,180,224 | —- | M] (Creative Technology Ltd) – C:\Program Files\Creative\SBAudigy\Volume Panel\VolPanlu.exe


========== Modules (No Company Name) ==========

MOD - [2012/06/14 11:59:05 | 011,820,032 | —- | M] () – C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Web\508b444db523c5cf20ff12c7f440837b\System.Web.ni.dll
MOD - [2012/06/14 08:11:28 | 012,433,920 | —- | M] () – C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\f2691cfa7671cdc58179e56ba9227591\System.Windows.Forms.ni.dll
MOD - [2012/06/14 08:11:18 | 001,592,320 | —- | M] () – C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\18f9789aa214c657113e676b3a9015aa\System.Drawing.ni.dll
MOD - [2012/05/11 18:32:00 | 000,998,400 | —- | M] () – C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Management\f3d4d5fe5ab848fbfcf91a49960dc8ae\System.Management.ni.dll
MOD - [2012/05/11 18:31:27 | 000,771,584 | —- | M] () – C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Runtime.Remo#\846b9cf2756fdd15f704c9bab9c70b6f\System.Runtime.Remoting.ni.dll
MOD - [2012/05/11 18:31:19 | 000,971,264 | —- | M] () – C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Configuration\bd76aaaa03ddc15d1840207b5a480644\System.Configuration.ni.dll
MOD - [2012/05/11 18:29:44 | 005,450,752 | —- | M] () – C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Xml\d2630342a066a7cb9056d9eb6157687a\System.Xml.ni.dll
MOD - [2012/05/11 18:28:06 | 007,953,408 | —- | M] () – C:\Windows\assembly\NativeImages_v2.0.50727_32\System\28d633338fc8d29f8af31935ef7d001b\System.ni.dll
MOD - [2012/05/11 18:27:45 | 011,492,352 | —- | M] () – C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\af9c9e9d7e0523cd444f8b551baa9cbf\mscorlib.ni.dll
MOD - [2009/09/04 23:15:06 | 000,067,872 | —- | M] () – C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll
MOD - [2008/03/19 17:26:48 | 000,040,960 | —- | M] () – C:\Windows\assembly\GAC_MSIL\CLI.Caste.Graphics.Wizard\2.0.2768.38502__90ba9c70f846762e\CLI.Caste.Graphics.Wizard.dll
MOD - [2008/03/19 17:26:47 | 001,675,264 | —- | M] () – C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DisplaysManager.Graphics.Wizard\2.0.2768.38511__90ba9c70f846762e\CLI.Aspect.DisplaysManager.Graphics.Wizard.dll
MOD - [2008/03/19 17:26:47 | 000,684,032 | —- | M] () – C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceCV.Graphics.Wizard\2.0.2768.38708__90ba9c70f846762e\CLI.Aspect.DeviceCV.Graphics.Wizard.dll
MOD - [2008/03/19 17:26:47 | 000,360,448 | —- | M] () – C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceTV.Graphics.Wizard\2.0.2768.38737__90ba9c70f846762e\CLI.Aspect.DeviceTV.Graphics.Wizard.dll
MOD - [2008/03/19 17:26:47 | 000,237,568 | —- | M] () – C:\Windows\assembly\GAC_MSIL\CLI.Caste.Graphics.Runtime\2.0.2768.38469__90ba9c70f846762e\CLI.Caste.Graphics.Runtime.dll
MOD - [2008/03/19 17:26:47 | 000,184,320 | —- | M] () – C:\Windows\assembly\GAC_MSIL\CLI.Aspect.InfoCentre.Graphics.Wizard\2.0.2768.38524__90ba9c70f846762e\CLI.Aspect.InfoCentre.Graphics.Wizard.dll
MOD - [2008/03/19 17:26:47 | 000,077,824 | —- | M] () – C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceTV.Graphics.Runtime\2.0.2768.38729__90ba9c70f846762e\CLI.Aspect.DeviceTV.Graphics.Runtime.dll
MOD - [2008/03/19 17:26:47 | 000,065,536 | —- | M] () – C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceCV.Graphics.Runtime\2.0.2768.38688__90ba9c70f846762e\CLI.Aspect.DeviceCV.Graphics.Runtime.dll
MOD - [2008/03/19 17:26:47 | 000,032,768 | —- | M] () – C:\Windows\assembly\GAC_MSIL\CLI.Aspect.InfoCentre.Graphics.Runtime\2.0.2768.38523__90ba9c70f846762e\CLI.Aspect.InfoCentre.Graphics.Runtime.dll
MOD - [2008/03/19 17:26:47 | 000,032,768 | —- | M] () – C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceProperty.Graphics.Runtime\2.0.2768.38625__90ba9c70f846762e\CLI.Aspect.DeviceProperty.Graphics.Runtime.dll
MOD - [2008/03/19 17:26:47 | 000,020,480 | —- | M] () – C:\Windows\assembly\GAC_MSIL\CLI.Aspect.HotkeysHandling.Graphics.Runtime\2.0.2768.38488__90ba9c70f846762e\CLI.Aspect.HotkeysHandling.Graphics.Runtime.dll
MOD - [2008/03/19 17:26:46 | 000,483,328 | —- | M] () – C:\Windows\assembly\GAC_MSIL\CLI.Aspect.TransCode.Graphics.Wizard\2.0.2768.38767__90ba9c70f846762e\CLI.Aspect.TransCode.Graphics.Wizard.dll
MOD - [2008/03/19 17:26:33 | 000,073,728 | —- | M] () – C:\Windows\assembly\GAC_MSIL\CLI.Caste.Graphics.Dashboard\2.0.2768.38482__90ba9c70f846762e\CLI.Caste.Graphics.Dashboard.dll
MOD - [2008/03/19 17:26:32 | 000,331,776 | —- | M] () – C:\Windows\assembly\GAC_MSIL\CLI.Aspect.Radeon3D.Graphics.Dashboard\2.0.2768.38696__90ba9c70f846762e\CLI.Aspect.Radeon3D.Graphics.Dashboard.dll
MOD - [2008/03/19 17:26:32 | 000,135,168 | —- | M] () – C:\Windows\assembly\GAC_MSIL\CLI.Aspect.Welcome.Graphics.Dashboard\2.0.2768.38773__90ba9c70f846762e\CLI.Aspect.Welcome.Graphics.Dashboard.dll
MOD - [2008/03/19 17:26:32 | 000,090,112 | —- | M] () – C:\Windows\assembly\GAC_MSIL\CLI.Aspect.Radeon3D.Graphics.Wizard\2.0.2768.38701__90ba9c70f846762e\CLI.Aspect.Radeon3D.Graphics.Wizard.dll
MOD - [2008/03/19 17:26:32 | 000,061,440 | —- | M] () – C:\Windows\assembly\GAC_MSIL\CLI.Aspect.Radeon3D.Graphics.Runtime\2.0.2768.38695__90ba9c70f846762e\CLI.Aspect.Radeon3D.Graphics.Runtime.dll
MOD - [2008/03/19 17:26:31 | 000,425,984 | —- | M] () – C:\Windows\assembly\GAC_MSIL\CLI.Aspect.OverDrive5.Graphics.Dashboard\2.0.2768.38810__90ba9c70f846762e\CLI.Aspect.OverDrive5.Graphics.Dashboard.dll
MOD - [2008/03/19 17:26:31 | 000,065,536 | —- | M] () – C:\Windows\assembly\GAC_MSIL\CLI.Aspect.OverDrive5.Graphics.Runtime\2.0.2768.38810__90ba9c70f846762e\CLI.Aspect.OverDrive5.Graphics.Runtime.dll
MOD - [2008/03/19 17:26:31 | 000,040,960 | —- | M] () – C:\Windows\assembly\GAC_MSIL\CLI.Aspect.PowerPlayDPPE.Graphics.Runtime\2.0.2768.38760__90ba9c70f846762e\CLI.Aspect.PowerPlayDPPE.Graphics.Runtime.dll
MOD - [2008/03/19 17:26:30 | 000,897,024 | —- | M] () – C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceTV.Graphics.Dashboard\2.0.2768.38730__90ba9c70f846762e\CLI.Aspect.DeviceTV.Graphics.Dashboard.dll
MOD - [2008/03/19 17:26:30 | 000,790,528 | —- | M] () – C:\Windows\assembly\GAC_MSIL\CLI.Aspect.MMVideo.Graphics.Dashboard\2.0.2768.38633__90ba9c70f846762e\CLI.Aspect.MMVideo.Graphics.Dashboard.dll
MOD - [2008/03/19 17:26:30 | 000,659,456 | —- | M] () – C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceCV.Graphics.Dashboard\2.0.2768.38689__90ba9c70f846762e\CLI.Aspect.DeviceCV.Graphics.Dashboard.dll
MOD - [2008/03/19 17:26:30 | 000,589,824 | —- | M] () – C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DisplaysColour2.Graphics.Dashboard\2.0.2768.38536__90ba9c70f846762e\CLI.Aspect.DisplaysColour2.Graphics.Dashboard.dll
MOD - [2008/03/19 17:26:30 | 000,475,136 | —- | M] () – C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceCRT.Graphics.Dashboard\2.0.2768.38626__90ba9c70f846762e\CLI.Aspect.DeviceCRT.Graphics.Dashboard.dll
MOD - [2008/03/19 17:26:30 | 000,438,272 | —- | M] () – C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DisplaysManager.Graphics.Dashboard\2.0.2768.38489__90ba9c70f846762e\CLI.Aspect.DisplaysManager.Graphics.Dashboard.dll
MOD - [2008/03/19 17:26:30 | 000,401,408 | —- | M] () – C:\Windows\assembly\GAC_MSIL\CLI.Aspect.MMVideo.Graphics.Wizard\2.0.2768.38715__90ba9c70f846762e\CLI.Aspect.MMVideo.Graphics.Wizard.dll
MOD - [2008/03/19 17:26:30 | 000,327,680 | —- | M] () – C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceDFP.Graphics.Dashboard\2.0.2768.38619__90ba9c70f846762e\CLI.Aspect.DeviceDFP.Graphics.Dashboard.dll
MOD - [2008/03/19 17:26:30 | 000,208,896 | —- | M] () – C:\Windows\assembly\GAC_MSIL\CLI.Aspect.InfoCentre.Graphics.Dashboard\2.0.2768.38530__90ba9c70f846762e\CLI.Aspect.InfoCentre.Graphics.Dashboard.dll
MOD - [2008/03/19 17:26:30 | 000,118,784 | —- | M] () – C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DisplaysOptions.Graphics.Dashboard\2.0.2768.38654__90ba9c70f846762e\CLI.Aspect.DisplaysOptions.Graphics.Dashboard.dll
MOD - [2008/03/19 17:26:30 | 000,065,536 | —- | M] () – C:\Windows\assembly\GAC_MSIL\CLI.Aspect.MMVideo.Graphics.Runtime\2.0.2768.38632__90ba9c70f846762e\CLI.Aspect.MMVideo.Graphics.Runtime.dll
MOD - [2008/03/19 17:26:30 | 000,057,344 | —- | M] () – C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceDFP.Graphics.Runtime\2.0.2768.38625__90ba9c70f846762e\CLI.Aspect.DeviceDFP.Graphics.Runtime.dll
MOD - [2008/03/19 17:26:30 | 000,040,960 | —- | M] () – C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DisplaysColour2.Graphics.Runtime\2.0.2768.38542__90ba9c70f846762e\CLI.Aspect.DisplaysColour2.Graphics.Runtime.dll
MOD - [2008/03/19 17:26:30 | 000,040,960 | —- | M] () – C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceCRT.Graphics.Runtime\2.0.2768.38632__90ba9c70f846762e\CLI.Aspect.DeviceCRT.Graphics.Runtime.dll
MOD - [2008/03/19 17:26:30 | 000,032,768 | —- | M] () – C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DisplaysOptions.Graphics.Runtime\2.0.2768.38653__90ba9c70f846762e\CLI.Aspect.DisplaysOptions.Graphics.Runtime.dll
MOD - [2008/03/19 17:26:30 | 000,032,768 | —- | M] () – C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceLCD.Graphics.Runtime\2.0.2768.38674__90ba9c70f846762e\CLI.Aspect.DeviceLCD.Graphics.Runtime.dll
MOD - [2008/03/19 17:26:30 | 000,020,480 | —- | M] () – C:\Windows\assembly\GAC_MSIL\AEM.Plugin.Hotkeys.Shared\2.0.2729.30202__90ba9c70f846762e\AEM.Plugin.Hotkeys.Shared.dll
MOD - [2008/03/19 17:26:30 | 000,020,480 | —- | M] () – C:\Windows\assembly\GAC_MSIL\AEM.Actions.CCAA.Shared\2.0.2729.30197__90ba9c70f846762e\AEM.Actions.CCAA.Shared.dll
MOD - [2008/03/19 17:26:30 | 000,016,384 | —- | M] () – C:\Windows\assembly\GAC_MSIL\AEM.Plugin.GD.Shared\2.0.2729.30224__90ba9c70f846762e\AEM.Plugin.GD.Shared.dll
MOD - [2008/03/19 17:26:30 | 000,016,384 | —- | M] () – C:\Windows\assembly\GAC_MSIL\AEM.Plugin.EEU.Shared\2.0.2729.30212__90ba9c70f846762e\AEM.Plugin.EEU.Shared.dll
MOD - [2008/03/19 17:26:30 | 000,016,384 | —- | M] () – C:\Windows\assembly\GAC_MSIL\AEM.Plugin.DPPE.Shared\2.0.2729.30222__90ba9c70f846762e\AEM.Plugin.DPPE.Shared.dll
MOD - [2008/03/19 17:26:30 | 000,006,656 | —- | M] () – C:\Windows\assembly\GAC_MSIL\atixclib\1.0.0.0__90ba9c70f846762e\atixclib.dll
MOD - [2008/03/19 17:26:29 | 000,065,536 | —- | M] () – C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceTV.Graphics.Shared\2.0.2729.30231__90ba9c70f846762e\CLI.Aspect.DeviceTV.Graphics.Shared.dll
MOD - [2008/03/19 17:26:29 | 000,057,344 | —- | M] () – C:\Windows\assembly\GAC_MSIL\CLI.Aspect.OverDrive5.Graphics.Shared\2.0.2729.30255__90ba9c70f846762e\CLI.Aspect.OverDrive5.Graphics.Shared.dll
MOD - [2008/03/19 17:26:29 | 000,053,248 | —- | M] () – C:\Windows\assembly\GAC_MSIL\CLI.Aspect.InfoCentre.Graphics.Shared\2.0.2729.30219__90ba9c70f846762e\CLI.Aspect.InfoCentre.Graphics.Shared.dll
MOD - [2008/03/19 17:26:29 | 000,049,152 | —- | M] () – C:\Windows\assembly\GAC_MSIL\CLI.Foundation\2.0.2729.30178__90ba9c70f846762e\CLI.Foundation.dll
MOD - [2008/03/19 17:26:29 | 000,049,152 | —- | M] () – C:\Windows\assembly\GAC_MSIL\CLI.Caste.Graphics.Shared\2.0.2729.30199__90ba9c70f846762e\CLI.Caste.Graphics.Shared.dll
MOD - [2008/03/19 17:26:29 | 000,049,152 | —- | M] () – C:\Windows\assembly\GAC_MSIL\CLI.Aspect.Radeon3D.Graphics.Shared\2.0.2729.30231__90ba9c70f846762e\CLI.Aspect.Radeon3D.Graphics.Shared.dll
MOD - [2008/03/19 17:26:29 | 000,045,056 | —- | M] () – C:\Windows\assembly\GAC_MSIL\DEM.Graphics.I0601\2.0.2573.17685__90ba9c70f846762e\DEM.Graphics.I0601.dll
MOD - [2008/03/19 17:26:29 | 000,045,056 | —- | M] () – C:\Windows\assembly\GAC_MSIL\CLI.Aspect.MMVideo.Graphics.Shared\2.0.2729.30227__90ba9c70f846762e\CLI.Aspect.MMVideo.Graphics.Shared.dll
MOD - [2008/03/19 17:26:29 | 000,040,960 | —- | M] () – C:\Windows\assembly\GAC_MSIL\CLI.Aspect.TransCode.Graphics.Shared\2.0.2729.30264__90ba9c70f846762e\CLI.Aspect.TransCode.Graphics.Shared.dll
MOD - [2008/03/19 17:26:29 | 000,040,960 | —- | M] () – C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceDFP.Graphics.Shared\2.0.2729.30225__90ba9c70f846762e\CLI.Aspect.DeviceDFP.Graphics.Shared.dll
MOD - [2008/03/19 17:26:29 | 000,040,960 | —- | M] () – C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceCV.Graphics.Shared\2.0.2729.30230__90ba9c70f846762e\CLI.Aspect.DeviceCV.Graphics.Shared.dll
MOD - [2008/03/19 17:26:29 | 000,032,768 | —- | M] () – C:\Windows\assembly\GAC_MSIL\LOG.Foundation\2.0.2729.30174__90ba9c70f846762e\LOG.Foundation.dll
MOD - [2008/03/19 17:26:29 | 000,032,768 | —- | M] () – C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceProperty.Graphics.Shared\2.0.2729.30213__90ba9c70f846762e\CLI.Aspect.DeviceProperty.Graphics.Shared.dll
MOD - [2008/03/19 17:26:29 | 000,028,672 | —- | M] () – C:\Windows\assembly\GAC_MSIL\CLI.Foundation.XManifest\2.0.2729.30313__90ba9c70f846762e\CLI.Foundation.XManifest.dll
MOD - [2008/03/19 17:26:29 | 000,028,672 | —- | M] () – C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DisplaysColour2.Graphics.Shared\2.0.2729.30219__90ba9c70f846762e\CLI.Aspect.DisplaysColour2.Graphics.Shared.dll
MOD - [2008/03/19 17:26:29 | 000,028,672 | —- | M] () – C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceLCD.Graphics.Shared\2.0.2729.30259__90ba9c70f846762e\CLI.Aspect.DeviceLCD.Graphics.Shared.dll
MOD - [2008/03/19 17:26:29 | 000,024,576 | —- | M] () – C:\Windows\assembly\GAC_MSIL\NEWAEM.Foundation\2.0.2729.30184__90ba9c70f846762e\NEWAEM.Foundation.dll
MOD - [2008/03/19 17:26:29 | 000,024,576 | —- | M] () – C:\Windows\assembly\GAC_MSIL\CLI.Aspect.PowerPlayDPPE.Graphics.Shared\2.0.2729.30262__90ba9c70f846762e\CLI.Aspect.PowerPlayDPPE.Graphics.Shared.dll
MOD - [2008/03/19 17:26:29 | 000,024,576 | —- | M] () – C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DisplaysOptions.Graphics.Shared\2.0.2729.30228__90ba9c70f846762e\CLI.Aspect.DisplaysOptions.Graphics.Shared.dll
MOD - [2008/03/19 17:26:29 | 000,020,480 | —- | M] () – C:\Windows\assembly\GAC_MSIL\DEM.OS.I0602\2.0.2729.30259__90ba9c70f846762e\DEM.OS.I0602.dll
MOD - [2008/03/19 17:26:29 | 000,020,480 | —- | M] () – C:\Windows\assembly\GAC_MSIL\CLI.Component.Wizard.Shared\2.0.2729.30211__90ba9c70f846762e\CLI.Component.Wizard.Shared.dll
MOD - [2008/03/19 17:26:29 | 000,020,480 | —- | M] () – C:\Windows\assembly\GAC_MSIL\CLI.Component.Dashboard.Shared\2.0.2729.30199__90ba9c70f846762e\CLI.Component.Dashboard.Shared.dll
MOD - [2008/03/19 17:26:29 | 000,020,480 | —- | M] () – C:\Windows\assembly\GAC_MSIL\CLI.Component.Client.Shared\2.0.2729.30185__90ba9c70f846762e\CLI.Component.Client.Shared.dll
MOD - [2008/03/19 17:26:29 | 000,020,480 | —- | M] () – C:\Windows\assembly\GAC_MSIL\CLI.Aspect.HotkeysHandling.Graphics.Shared\2.0.2729.30216__90ba9c70f846762e\CLI.Aspect.HotkeysHandling.Graphics.Shared.dll
MOD - [2008/03/19 17:26:29 | 000,016,384 | —- | M] () – C:\Windows\assembly\GAC_MSIL\MOM.Foundation\2.0.2729.30207__90ba9c70f846762e\MOM.Foundation.dll
MOD - [2008/03/19 17:26:29 | 000,016,384 | —- | M] () – C:\Windows\assembly\GAC_MSIL\DEM.OS\2.0.2729.30242__90ba9c70f846762e\DEM.OS.dll
MOD - [2008/03/19 17:26:29 | 000,016,384 | —- | M] () – C:\Windows\assembly\GAC_MSIL\DEM.Graphics\2.0.2729.30256__90ba9c70f846762e\DEM.Graphics.dll
MOD - [2008/03/19 17:26:29 | 000,016,384 | —- | M] () – C:\Windows\assembly\GAC_MSIL\DEM.Foundation\2.0.2573.17684__90ba9c70f846762e\DEM.Foundation.dll
MOD - [2008/03/19 17:26:29 | 000,016,384 | —- | M] () – C:\Windows\assembly\GAC_MSIL\CLI.Component.Runtime.Shared\2.0.2729.30203__90ba9c70f846762e\CLI.Component.Runtime.Shared.dll
MOD - [2008/03/19 17:26:29 | 000,016,384 | —- | M] () – C:\Windows\assembly\GAC_MSIL\CLI.Caste.Graphics.Wizard.Shared\2.0.2729.30216__90ba9c70f846762e\CLI.Caste.Graphics.Wizard.Shared.dll
MOD - [2008/03/19 17:26:29 | 000,016,384 | —- | M] () – C:\Windows\assembly\GAC_MSIL\CLI.Caste.Graphics.Dashboard.Shared\2.0.2729.30241__90ba9c70f846762e\CLI.Caste.Graphics.Dashboard.Shared.dll
MOD - [2008/03/19 17:26:28 | 000,053,248 | —- | M] () – C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceCRT.Graphics.Shared\2.0.2729.30226__90ba9c70f846762e\CLI.Aspect.DeviceCRT.Graphics.Shared.dll
MOD - [2008/03/19 17:26:28 | 000,024,576 | —- | M] () – C:\Windows\assembly\GAC_MSIL\CLI.Aspect.CustomFormats.Graphics.Shared\2.0.2729.30212__90ba9c70f846762e\CLI.Aspect.CustomFormats.Graphics.Shared.dll
MOD - [2008/03/19 17:26:28 | 000,024,576 | —- | M] () – C:\Windows\assembly\GAC_MSIL\AEM.Foundation\2.0.2729.30176__90ba9c70f846762e\AEM.Foundation.dll
MOD - [2008/03/19 17:26:28 | 000,024,576 | —- | M] () – C:\Windows\assembly\GAC_MSIL\ACE.Graphics.DisplaysManager.Shared\2.0.2573.17685__90ba9c70f846762e\ACE.Graphics.DisplaysManager.Shared.dll
MOD - [2008/03/19 17:26:28 | 000,020,480 | —- | M] () – C:\Windows\assembly\GAC_MSIL\APM.Foundation\2.0.2729.30208__90ba9c70f846762e\APM.Foundation.dll
MOD - [2008/03/19 17:26:28 | 000,016,384 | —- | M] () – C:\Windows\assembly\GAC_MSIL\AEM.Server.Shared\2.0.2729.30201__90ba9c70f846762e\AEM.Server.Shared.dll
MOD - [2008/03/19 17:26:25 | 000,102,400 | —- | M] () – C:\Windows\assembly\GAC_MSIL\MOM.Implementation\2.0.2768.38752__90ba9c70f846762e\MOM.Implementation.dll
MOD - [2008/03/19 17:26:25 | 000,036,864 | —- | M] () – C:\Windows\assembly\GAC_MSIL\AEM.Plugin.Source.Kit.Server\2.0.2768.38796__90ba9c70f846762e\AEM.Plugin.Source.Kit.Server.dll
MOD - [2008/03/19 17:26:25 | 000,032,768 | —- | M] () – C:\Windows\assembly\GAC_MSIL\LOG.Foundation.Private\2.0.2729.30188__90ba9c70f846762e\LOG.Foundation.Private.dll
MOD - [2008/03/19 17:26:25 | 000,020,480 | —- | M] () – C:\Windows\assembly\GAC_MSIL\LOG.Foundation.Implementation.Private\2.0.2729.30211__90ba9c70f846762e\LOG.Foundation.Implementation.Private.dll
MOD - [2008/03/19 17:26:25 | 000,006,656 | —- | M] () – C:\Windows\assembly\GAC_MSIL\CLI.Component.Runtime.Extension.EEU\2.0.2768.38458__90ba9c70f846762e\CLI.Component.Runtime.Extension.EEU.dll
MOD - [2008/03/19 17:26:24 | 001,507,328 | —- | M] () – C:\Windows\assembly\GAC_MSIL\CLI.Component.Dashboard\2.0.2768.38477__90ba9c70f846762e\CLI.Component.Dashboard.dll
MOD - [2008/03/19 17:26:24 | 000,471,040 | —- | M] () – C:\Windows\assembly\GAC_MSIL\CLI.Component.Wizard\2.0.2768.38497__90ba9c70f846762e\CLI.Component.Wizard.dll
MOD - [2008/03/19 17:26:24 | 000,446,464 | —- | M] () – C:\Windows\assembly\GAC_MSIL\CLI.Component.Systemtray\2.0.2768.38744__90ba9c70f846762e\CLI.Component.Systemtray.dll
MOD - [2008/03/19 17:26:24 | 000,069,632 | —- | M] () – C:\Windows\assembly\GAC_MSIL\CLI.Component.Runtime\2.0.2768.38460__90ba9c70f846762e\CLI.Component.Runtime.dll
MOD - [2008/03/19 17:26:24 | 000,065,536 | —- | M] () – C:\Windows\assembly\GAC_MSIL\ATIDEMOS\2.0.2768.38461__90ba9c70f846762e\ATIDEMOS.dll
MOD - [2008/03/19 17:26:24 | 000,061,440 | —- | M] () – C:\Windows\assembly\GAC_MSIL\LOG.Foundation.Implementation\2.0.2768.38750__90ba9c70f846762e\LOG.Foundation.Implementation.dll
MOD - [2008/03/19 17:26:24 | 000,045,056 | —- | M] () – C:\Windows\assembly\GAC_MSIL\APM.Server\2.0.2768.38460__90ba9c70f846762e\APM.Server.dll
MOD - [2008/03/19 17:26:24 | 000,040,960 | —- | M] () – C:\Windows\assembly\GAC_MSIL\CLI.Foundation.Private\2.0.2729.30193__90ba9c70f846762e\CLI.Foundation.Private.dll
MOD - [2008/03/19 17:26:24 | 000,040,960 | —- | M] () – C:\Windows\assembly\GAC_MSIL\CLI.Component.Runtime.Shared.Private\2.0.2729.30209__90ba9c70f846762e\CLI.Component.Runtime.Shared.Private.dll
MOD - [2008/03/19 17:26:24 | 000,040,960 | —- | M] () – C:\Windows\assembly\GAC_MSIL\CLI.Component.Client.Shared.Private\2.0.2729.30205__90ba9c70f846762e\CLI.Component.Client.Shared.Private.dll
MOD - [2008/03/19 17:26:24 | 000,032,768 | —- | M] () – C:\Windows\assembly\GAC_MSIL\CCC.Implementation\2.0.2768.38751__90ba9c70f846762e\CCC.Implementation.dll
MOD - [2008/03/19 17:26:24 | 000,032,768 | —- | M] () – C:\Windows\assembly\GAC_MSIL\ATICCCom\2.0.0.0__90ba9c70f846762e\ATICCCom.dll
MOD - [2008/03/19 17:26:24 | 000,024,576 | —- | M] () – C:\Windows\assembly\GAC_MSIL\CLI.Component.Wizard.Shared.Private\2.0.2729.30258__90ba9c70f846762e\CLI.Component.Wizard.Shared.Private.dll
MOD - [2008/03/19 17:26:24 | 000,020,480 | —- | M] () – C:\Windows\assembly\GAC_MSIL\CLI.Component.Dashboard.Shared.Private\2.0.2729.30214__90ba9c70f846762e\CLI.Component.Dashboard.Shared.Private.dll
MOD - [2008/03/19 17:26:24 | 000,020,480 | —- | M] () – C:\Windows\assembly\GAC_MSIL\CLI.Caste.Graphics.Runtime.Shared.Private\2.0.2729.30243__90ba9c70f846762e\CLI.Caste.Graphics.Runtime.Shared.Private.dll
MOD - [2008/03/19 17:26:23 | 000,045,056 | —- | M] () – C:\Windows\assembly\GAC_MSIL\AEM.Server\2.0.2768.38458__90ba9c70f846762e\AEM.Server.dll
MOD - [2007/08/20 01:08:10 | 000,159,744 | —- | M] () – C:\Windows\System32\atitmmxx.dll
MOD - [2006/12/10 22:51:08 | 000,077,824 | R— | M] () – C:\Program Files\HP\Digital Imaging\bin\crm\xmltok.dll
MOD - [2006/12/10 22:51:08 | 000,065,536 | R— | M] () – C:\Program Files\HP\Digital Imaging\bin\crm\xmlparse.dll
MOD - [2006/11/20 13:29:10 | 000,101,376 | —- | M] () – C:\Windows\System32\APOMngr.dll
MOD - [2006/11/13 10:07:34 | 000,066,560 | —- | M] () – C:\Windows\System32\CmdRtr.dll


========== Win32 Services (SafeList) ==========

SRV - [2012/06/17 08:03:44 | 000,257,224 | —- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] – C:\Windows\System32\Macromed\Flash\FlashPlayerUpdateService.exe – (AdobeFlashPlayerUpdateSvc)
SRV - [2012/04/19 08:21:16 | 000,361,976 | —- | M] (McAfee, Inc.) [On_Demand | Stopped] – C:\Program Files\McAfee\VirusScan\mcods.exe – (McODS)
SRV - [2012/03/20 13:11:32 | 000,151,880 | —- | M] (McAfee, Inc.) [Auto | Running] – C:\Program Files\Common Files\McAfee\SystemCore\mfevtps.exe – (mfevtp)
SRV - [2012/03/20 13:05:00 | 000,161,632 | —- | M] () [Auto | Running] – C:\Program Files\Common Files\McAfee\SystemCore\\mfefire.exe – (mfefire)
SRV - [2012/03/20 13:04:32 | 000,166,288 | —- | M] () [Auto | Running] – C:\Program Files\Common Files\McAfee\SystemCore\\mcshield.exe – (McShield)
SRV - [2012/01/03 09:10:42 | 000,063,928 | —- | M] (Adobe Systems Incorporated) [Auto | Running] – C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe – (AdobeARMservice)
SRV - [2011/12/22 08:31:08 | 000,045,056 | —- | M] (Intuit) [Auto | Running] – C:\Program Files\Common Files\Intuit\QuickBooks\QBCFMonitorService.exe – (QBCFMonitorService)
SRV - [2011/01/27 19:28:14 | 000,214,904 | —- | M] (McAfee, Inc.) [Auto | Running] – C:\Program Files\Common Files\Mcafee\McSvcHost\McSvHost.exe – (MSK80Service)
SRV - [2011/01/27 19:28:14 | 000,214,904 | —- | M] (McAfee, Inc.) [Auto | Running] – C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe – (McProxy)
SRV - [2011/01/27 19:28:14 | 000,214,904 | —- | M] (McAfee, Inc.) [Auto | Running] – C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe – (McNASvc)
SRV - [2011/01/27 19:28:14 | 000,214,904 | —- | M] (McAfee, Inc.) [Auto | Running] – C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe – (McNaiAnn)
SRV - [2011/01/27 19:28:14 | 000,214,904 | —- | M] (McAfee, Inc.) [Auto | Running] – C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe – (mcmscsvc)
SRV - [2011/01/27 19:28:14 | 000,214,904 | —- | M] (McAfee, Inc.) [Auto | Running] – C:\Program Files\Common Files\Mcafee\McSvcHost\McSvHost.exe – (McMPFSvc)
SRV - [2011/01/27 19:28:14 | 000,214,904 | —- | M] (McAfee, Inc.) [Auto | Running] – C:\Program Files\Common Files\Mcafee\McSvcHost\McSvHost.exe – (McAfee SiteAdvisor Service)
SRV - [2010/04/13 21:11:14 | 000,229,688 | —- | M] (McAfee, Inc.) [Auto | Running] – C:\Program Files\McAfee Online Backup\MOBKbackup.exe – (MOBKbackup)
SRV - [2008/08/13 18:32:40 | 000,201,968 | —- | M] (SupportSoft, Inc.) [Auto | Running] – C:\Program Files\Dell Support Center\bin\sprtsvc.exe – (sprtsvc_dellsupportcenter) SupportSoft Sprocket Service (dellsupportcenter)
SRV - [2008/08/08 22:10:46 | 000,061,440 | —- | M] (Intuit Inc.) [On_Demand | Stopped] – C:\Program Files\Common Files\Intuit\QuickBooks\FCS\Intuit.QuickBooks.FCS.exe – (QBFCService)
SRV - [2008/03/19 17:22:12 | 000,072,704 | —- | M] (Creative Labs) [Auto | Running] – C:\Program Files\Common Files\Creative Labs Shared\Service\CreativeLicensing.exe – (Creative Labs Licensing Service)
SRV - [2008/01/19 03:38:24 | 000,272,952 | —- | M] (Microsoft Corporation) [Auto | Stopped] – C:\Program Files\Windows Defender\MpSvc.dll – (WinDefend)
SRV - [2008/01/11 17:50:16 | 000,030,312 | —- | M] (Microsoft Corporation) [Auto | Running] – C:\Program Files\Microsoft Small Business\Business Contact Manager\BcmSqlStartupSvc.exe – (BcmSqlStartupSvc)


========== Driver Services (SafeList) ==========

DRV - File not found [Kernel | On_Demand | Stopped] – system32\DRIVERS\nwlnkfwd.sys – (NwlnkFwd)
DRV - File not found [Kernel | On_Demand | Stopped] – system32\DRIVERS\nwlnkflt.sys – (NwlnkFlt)
DRV - File not found [Kernel | On_Demand | Unknown] – – (mfeavfk01)
DRV - File not found [Kernel | On_Demand | Stopped] – system32\DRIVERS\ipinip.sys – (IpInIp)
DRV - File not found [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\blbdrive.sys – (blbdrive)
DRV - [2012/06/21 07:51:50 | 000,014,080 | —- | M] () [Kernel | On_Demand | Unknown] – C:\Windows\System32\drivers\TrueSight.sys – (TrueSight)
DRV - [2012/02/22 13:29:46 | 000,464,304 | —- | M] (McAfee, Inc.) [Kernel | Boot | Running] – C:\Windows\System32\drivers\mfehidk.sys – (mfehidk)
DRV - [2012/02/22 13:29:46 | 000,340,920 | —- | M] (McAfee, Inc.) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\mfefirek.sys – (mfefirek)
DRV - [2012/02/22 13:29:46 | 000,180,848 | —- | M] (McAfee, Inc.) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\mfeavfk.sys – (mfeavfk)
DRV - [2012/02/22 13:29:46 | 000,169,608 | —- | M] (McAfee, Inc.) [Kernel | System | Running] – C:\Windows\System32\drivers\mfewfpk.sys – (mfewfpk)
DRV - [2012/02/22 13:29:46 | 000,121,544 | —- | M] (McAfee, Inc.) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\mfeapfk.sys – (mfeapfk)
DRV - [2012/02/22 13:29:46 | 000,087,656 | —- | M] (McAfee, Inc.) [Kernel | On_Demand | Stopped] – C:\Windows\System32\drivers\mferkdet.sys – (mferkdet)
DRV - [2012/02/22 13:29:46 | 000,064,912 | —- | M] (McAfee, Inc.) [Kernel | System | Running] – C:\Windows\System32\drivers\mfenlfk.sys – (mfenlfk)
DRV - [2012/02/22 13:29:46 | 000,059,456 | —- | M] (McAfee, Inc.) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\mfebopk.sys – (mfebopk)
DRV - [2012/02/22 13:29:46 | 000,057,600 | —- | M] (McAfee, Inc.) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\cfwids.sys – (cfwids)
DRV - [2011/04/11 15:29:16 | 000,064,048 | —- | M] (McAfee, Inc.) [Kernel | Boot | Running] – C:\Windows\System32\drivers\McPvDrv.sys – (McPvDrv)
DRV - [2010/04/13 21:10:22 | 000,054,776 | —- | M] (Mozy, Inc.) [File_System | System | Running] – C:\Windows\System32\drivers\MOBK.sys – (MOBKFilter)
DRV - [2009/04/11 00:42:52 | 000,031,616 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\System32\drivers\winusb.sys – (winusb)
DRV - [2007/08/20 01:08:08 | 002,930,176 | —- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Stopped] – C:\Windows\System32\drivers\atikmdag.sys – (R300)
DRV - [2007/08/20 01:08:08 | 002,930,176 | —- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\atikmdag.sys – (atikmdag)
DRV - [2007/04/29 04:42:24 | 000,228,224 | —- | M] (Intel Corporation) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\e1e6032.sys – (e1express) Intel®


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.dellnet.com
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = http://www.google.com/ie
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ie
IE - HKLM\..\SearchScopes,DefaultScope = {6A1806CD-94D4-4689-BA73-E35EA1EA9990}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://www.google.com/search?q={searchTerm…amp;rlz=1I7DKUS

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = http://www.google.com/ie
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.google.com
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultName = Google
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultURL = http://www.google.com/search?q={searchTerm…tf8&oe=utf8
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page =
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ie
IE - HKCU\..\SearchScopes,DefaultScope =
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}…amp;FORM=IE8SRC
IE - HKCU\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://www.google.com/search?q={searchTerm…mp;sourceid=ie7
IE - HKCU\..\SearchScopes\{DECA3892-BA8F-44b8-A993-A466AD694AE4}: "URL" = http://search.yahoo.com/search?fr=mcafee&p={searchTerms}
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local


========== FireFox ==========

FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@mcafee.com/MSC,version=10: c:\progra~1\mcafee\msc\npmcsn~1.dll ()
FF - HKLM\Software\MozillaPlugins\@mcafee.com/SAFFPlugin: C:\Program Files\McAfee\SiteAdvisor\npmcffplg32.dll (McAfee, Inc.)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\5.1.10411.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.111\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.111\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKCU\Software\MozillaPlugins\amazon.com/AmazonMP3DownloaderPlugin: C:\Program Files\Amazon\MP3 Downloader\npAmazonMP3DownloaderPlugin.dll (Amazon.com, Inc.)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{4ED1F68A-5463-4931-9384-8FFF5ED91D92}: C:\Program Files\McAfee\SiteAdvisor [2012/02/25 09:07:35 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{D19CA586-DD6C-4a0a-96F8-14644F340D60}: C:\Program Files\Common Files\McAfee\SystemCore [2012/06/21 07:53:59 | 000,000,000 | —D | M]

[2012/06/18 20:34:19 | 000,000,000 | —D | M] (No name found) – C:\Users\maureen\AppData\Roaming\mozilla\Extensions

O1 HOSTS File: ([2012/06/21 07:48:44 | 000,000,098 | —- | M]) - C:\Windows\System32\drivers\etc\Hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: ::1 localhost
O2 - BHO: (&Yahoo! Toolbar Helper) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll (Yahoo! Inc.)
O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (scriptproxy) - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\Common Files\McAfee\SystemCore\ScriptSn.20120427122412.dll (McAfee, Inc.)
O2 - BHO: (McAfee SiteAdvisor BHO) - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - c:\Program Files\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
O2 - BHO: (CBrowserHelperObject Object) - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:\Program Files\Dell\BAE\BAE.dll (Dell Inc.)
O2 - BHO: (SingleInstance Class) - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files\Yahoo!\Companion\Installs\cpn\YTSingleInstance.dll (Yahoo! Inc)
O3 - HKLM\..\Toolbar: (McAfee SiteAdvisor Toolbar) - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\Program Files\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
O3 - HKLM\..\Toolbar: (Yahoo! Toolbar) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll (Yahoo! Inc.)
O4 - HKLM..\Run: [AirPort Base Station Agent] C:\Program Files\AirPort\APAgent.exe (Apple Inc.)
O4 - HKLM..\Run: [DellSupportCenter] C:\Program Files\Dell Support Center\bin\sprtcmd.exe (SupportSoft, Inc.)
O4 - HKLM..\Run: [dscactivate] C:\Program Files\Dell Support Center\gs_agent\custom\dsca.exe ( )
O4 - HKLM..\Run: [Intuit SyncManager] C:\Program Files\Common Files\Intuit\Sync\IntuitSyncManager.exe (Intuit Inc. All rights reserved.)
O4 - HKLM..\Run: [McPvTray_exe] C:\Program Files\McAfee\MAT\McPvTray.exe (McAfee, Inc.)
O4 - HKLM..\Run: [mcui_exe] C:\Program Files\McAfee.com\Agent\mcagent.exe (McAfee, Inc.)
O4 - HKLM..\Run: [RtHDVCpl] C:\Windows\RtHDVCpl.exe (Realtek Semiconductor)
O4 - HKLM..\Run: [StartCCC] C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe ()
O4 - HKLM..\Run: [UpdReg] C:\Windows\UpdReg.EXE (Creative Technology Ltd.)
O4 - HKLM..\Run: [VolPanel] C:\Program Files\Creative\SBAudigy\Volume Panel\VolPanlu.exe (Creative Technology Ltd)
O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)
O4 - HKCU..\Run: [DellSupportCenter] C:\Program Files\Dell Support Center\bin\sprtcmd.exe (SupportSoft, Inc.)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoControlPanel = 0
O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O13 - gopher Prefix: missing
O15 - HKCU\..Trusted Domains: ([]msn in Computer)
O15 - HKCU\..Trusted Domains: //@surf.mar@/ ([]money in Local intranet)
O15 - HKCU\..Trusted Domains: aol.com ([objects] * is out of zone range - 5)
O15 - HKCU\..Trusted Domains: swmric.com ([www] https in Trusted sites)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_29)
O16 - DPF: {CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_29)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_29)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.0.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{F5238A7F-73ED-45E4-A5AA-59CEB7213641}: DhcpNameServer = 192.168.0.1
O18 - Protocol\Handler\dssrequest {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\Program Files\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
O18 - Protocol\Handler\intu-help-qb2 {84D77A00-41B5-4b8b-8ADF-86486D72E749} - C:\Program Files\intuit\QuickBooks 2007\HelpAsyncPluggableProtocol.dll (Intuit, Inc.)
O18 - Protocol\Handler\sacore {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\Program Files\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
O18 - Protocol\Filter\application/x-mfe-ipt {3EF5086B-5478-4598-A054-786C45D75692} - c:\Program Files\McAfee\MSC\McSnIePl.dll (McAfee, Inc.)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)
O24 - Desktop Components:0 () - http://www.fastlane-retrievers.com/pups0013.jpg
O24 - Desktop Components:1 (My Current Home Page) - About:Home
O24 - Desktop WallPaper: C:\Windows\Web\Wallpaper\img8.jpg
O24 - Desktop BackupWallPaper: C:\Windows\Web\Wallpaper\img8.jpg
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006/09/18 17:43:36 | 000,000,024 | —- | M] () - C:\autoexec.bat – [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)

========== Files/Folders - Created Within 30 Days ==========

[2012/06/21 07:48:38 | 000,000,000 | —D | C] – C:\_OTL
[2012/06/20 12:06:59 | 000,596,992 | —- | C] (OldTimer Tools) – C:\Users\maureen\Desktop\OTL.exe
[2012/06/20 10:09:15 | 000,000,000 | —D | C] – C:\Users\maureen\Desktop\RK_Quarantine
[2012/06/18 20:49:07 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2012/06/18 20:49:06 | 000,022,344 | —- | C] (Malwarebytes Corporation) – C:\Windows\System32\drivers\mbam.sys
[2012/06/18 20:34:42 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AbiWord
[2012/06/18 20:34:19 | 000,000,000 | —D | C] – C:\Users\maureen\AppData\Roaming\Mozilla
[2012/06/08 14:59:09 | 000,000,000 | —D | C] – C:\McAfee
[2012/06/07 16:33:23 | 000,000,000 | —D | C] – C:\Users\maureen\2012-06-07
[3 C:\Users\maureen\Documents\*.tmp files -> C:\Users\maureen\Documents\*.tmp -> ]
[1 C:\Windows\System32\*.tmp files -> C:\Windows\System32\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2012/06/21 10:20:51 | 000,663,138 | —- | M] () – C:\Windows\System32\perfh009.dat
[2012/06/21 10:20:51 | 000,126,954 | —- | M] () – C:\Windows\System32\perfc009.dat
[2012/06/21 10:17:00 | 000,000,886 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2012/06/21 10:15:00 | 000,000,830 | —- | M] () – C:\Windows\tasks\Adobe Flash Player Updater.job
[2012/06/21 09:49:43 | 000,003,568 | —- | M] () – C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2012/06/21 09:49:43 | 000,003,568 | —- | M] () – C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2012/06/21 08:17:00 | 000,000,882 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2012/06/21 07:51:50 | 000,014,080 | —- | M] () – C:\Windows\System32\drivers\TrueSight.sys
[2012/06/21 07:49:42 | 000,067,584 | –S- | M] () – C:\Windows\bootstat.dat
[2012/06/21 07:49:38 | 3487,748,096 | -HS- | M] () – C:\hiberfil.sys
[2012/06/21 07:48:44 | 000,000,098 | —- | M] () – C:\Windows\System32\drivers\etc\Hosts
[2012/06/20 11:56:44 | 000,596,992 | —- | M] (OldTimer Tools) – C:\Users\maureen\Desktop\OTL.exe
[2012/06/18 20:49:07 | 000,000,817 | —- | M] () – C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2012/06/18 20:40:16 | 001,012,656 | —- | M] () – C:\Users\maureen\Desktop\help me help you.exe
[2012/06/18 20:34:42 | 000,000,868 | —- | M] () – C:\Users\Public\Desktop\AbiWord.lnk
[2012/06/18 13:39:58 | 000,000,470 | —- | M] () – C:\Users\maureen\Application Data\Microsoft\Internet Explorer\Quick Launch\Facebook.website
[2012/06/18 13:06:52 | 000,000,494 | —- | M] () – C:\Users\maureen\Application Data\Microsoft\Internet Explorer\Quick Launch\WordPress.com.website
[2012/06/18 09:13:42 | 000,000,458 | —- | M] () – C:\Users\maureen\Application Data\Microsoft\Internet Explorer\Quick Launch\Writer Unboxed.website
[2012/06/18 08:16:21 | 000,000,513 | —- | M] () – C:\Users\maureen\Application Data\Microsoft\Internet Explorer\Quick Launch\weather.com.website
[2012/06/18 07:27:51 | 000,001,737 | —- | M] () – C:\Users\Public\Desktop\McAfee Total Protection.lnk
[2012/06/17 10:43:19 | 000,000,601 | —- | M] () – C:\Users\maureen\Application Data\Microsoft\Internet Explorer\Quick Launch\Amazon.com MP3 Downloads Shop 16 million songs and play your music on any Android device, PC, or Mac with Amazon Cloud Drive a.website
[2012/06/14 11:31:17 | 000,000,773 | —- | M] () – C:\Users\maureen\Application Data\Microsoft\Internet Explorer\Quick Launch\AOL Mail Simple, Free, Fun.website
[2012/06/14 08:07:41 | 000,410,264 | —- | M] () – C:\Windows\System32\FNTCACHE.DAT
[2012/06/11 10:26:40 | 000,000,463 | —- | M] () – C:\Users\maureen\Application Data\Microsoft\Internet Explorer\Quick Launch\Twitter - Home.website
[2012/06/08 16:14:47 | 000,000,497 | —- | M] () – C:\Users\maureen\Application Data\Microsoft\Internet Explorer\Quick Launch\Shorten & Share bitly shorten, share and track your links.website
[2012/06/04 12:09:26 | 000,000,622 | —- | M] () – C:\Users\maureen\Application Data\Microsoft\Internet Explorer\Quick Launch\Welcome to Google+.website
[3 C:\Users\maureen\Documents\*.tmp files -> C:\Users\maureen\Documents\*.tmp -> ]
[1 C:\Windows\System32\*.tmp files -> C:\Windows\System32\*.tmp -> ]

========== Files Created - No Company Name ==========

[2012/06/21 07:51:50 | 000,014,080 | —- | C] () – C:\Windows\System32\drivers\TrueSight.sys
[2012/06/21 07:49:38 | 3487,748,096 | -HS- | C] () – C:\hiberfil.sys
[2012/06/20 11:29:12 | 000,001,994 | —- | C] () – C:\Users\Public\Desktop\Amazon Cloud Player.lnk
[2012/06/20 11:29:12 | 000,001,978 | —- | C] () – C:\Users\Public\Desktop\QuickBooks Pro 2009.lnk
[2012/06/20 11:29:12 | 000,001,962 | —- | C] () – C:\Users\Public\Desktop\Dell Support Center.lnk
[2012/06/20 11:29:12 | 000,001,894 | —- | C] () – C:\Users\Public\Desktop\Adobe Reader X.lnk
[2012/06/20 11:29:12 | 000,001,737 | —- | C] () – C:\Users\Public\Desktop\McAfee Total Protection.lnk
[2012/06/20 11:29:12 | 000,001,728 | —- | C] () – C:\Users\Public\Desktop\QuickTime Player.lnk
[2012/06/20 11:29:12 | 000,001,666 | —- | C] () – C:\Users\Public\Desktop\iTunes.lnk
[2012/06/20 11:29:12 | 000,001,666 | —- | C] () – C:\Users\maureen\Application Data\Microsoft\Internet Explorer\Quick Launch\iTunes.lnk
[2012/06/20 11:29:12 | 000,001,623 | —- | C] () – C:\Users\Public\Desktop\Internet Explorer.lnk
[2012/06/20 11:29:12 | 000,001,486 | —- | C] () – C:\Users\Public\Desktop\Windows Media Center.lnk
[2012/06/20 11:29:12 | 000,001,144 | —- | C] () – C:\Users\Public\Desktop\HP Solution Center.lnk
[2012/06/20 11:29:12 | 000,001,089 | —- | C] () – C:\Users\Public\Desktop\Music, Photos & Videos.lnk
[2012/06/20 11:29:12 | 000,000,945 | —- | C] () – C:\Users\maureen\Application Data\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk
[2012/06/20 11:29:12 | 000,000,940 | —- | C] () – C:\Users\maureen\Application Data\Microsoft\Internet Explorer\Quick Launch\Microsoft Office Outlook.lnk
[2012/06/20 11:29:12 | 000,000,868 | —- | C] () – C:\Users\Public\Desktop\AbiWord.lnk
[2012/06/20 11:29:12 | 000,000,817 | —- | C] () – C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2012/06/20 11:29:12 | 000,000,773 | —- | C] () – C:\Users\maureen\Application Data\Microsoft\Internet Explorer\Quick Launch\AOL Mail Simple, Free, Fun.website
[2012/06/20 11:29:12 | 000,000,764 | —- | C] () – C:\Users\Public\Desktop\TweetDeck.lnk
[2012/06/20 11:29:12 | 000,000,622 | —- | C] () – C:\Users\maureen\Application Data\Microsoft\Internet Explorer\Quick Launch\Welcome to Google+.website
[2012/06/20 11:29:12 | 000,000,601 | —- | C] () – C:\Users\maureen\Application Data\Microsoft\Internet Explorer\Quick Launch\Amazon.com MP3 Downloads Shop 16 million songs and play your music on any Android device, PC, or Mac with Amazon Cloud Drive a.website
[2012/06/20 11:29:12 | 000,000,513 | —- | C] () – C:\Users\maureen\Application Data\Microsoft\Internet Explorer\Quick Launch\weather.com.website
[2012/06/20 11:29:12 | 000,000,501 | —- | C] () – C:\Users\maureen\Application Data\Microsoft\Internet Explorer\Quick Launch\Pandora Internet Radio.website
[2012/06/20 11:29:12 | 000,000,497 | —- | C] () – C:\Users\maureen\Application Data\Microsoft\Internet Explorer\Quick Launch\Shorten & Share bitly shorten, share and track your links.website
[2012/06/20 11:29:12 | 000,000,496 | —- | C] () – C:\Users\maureen\Application Data\Microsoft\Internet Explorer\Quick Launch\Reader Unboxed By Readers For Readers.website
[2012/06/20 11:29:12 | 000,000,494 | —- | C] () – C:\Users\maureen\Application Data\Microsoft\Internet Explorer\Quick Launch\WordPress.com.website
[2012/06/20 11:29:12 | 000,000,475 | —- | C] () – C:\Users\maureen\Application Data\Microsoft\Internet Explorer\Quick Launch\Goodreads Recent Updates.website
[2012/06/20 11:29:12 | 000,000,470 | —- | C] () – C:\Users\maureen\Application Data\Microsoft\Internet Explorer\Quick Launch\Facebook.website
[2012/06/20 11:29:12 | 000,000,463 | —- | C] () – C:\Users\maureen\Application Data\Microsoft\Internet Explorer\Quick Launch\Twitter - Home.website
[2012/06/20 11:29:12 | 000,000,458 | —- | C] () – C:\Users\maureen\Application Data\Microsoft\Internet Explorer\Quick Launch\Writer Unboxed.website
[2012/06/20 11:29:12 | 000,000,457 | —- | C] () – C:\Users\maureen\Application Data\Microsoft\Internet Explorer\Quick Launch\Google Maps.website
[2012/06/20 11:29:12 | 000,000,258 | —- | C] () – C:\Users\maureen\Application Data\Microsoft\Internet Explorer\Quick Launch\Shows Desktop.lnk
[2012/06/20 11:29:12 | 000,000,240 | —- | C] () – C:\Users\maureen\Application Data\Microsoft\Internet Explorer\Quick Launch\Window Switcher.lnk
[2012/06/20 11:29:12 | 000,000,104 | —- | C] () – C:\Users\maureen\Application Data\Microsoft\Internet Explorer\Quick Launch\E-mail - Shortcut.lnk
[2012/06/18 20:44:21 | 001,012,656 | —- | C] () – C:\Users\maureen\Desktop\help me help you.exe
[2010/12/09 10:20:08 | 000,000,164 | —- | C] () – C:\Windows\install.dat

========== LOP Check ==========

[2011/09/17 11:34:58 | 000,000,000 | —D | M] – C:\Users\maureen\AppData\Roaming\Amazon
[2011/07/27 19:03:19 | 000,000,000 | —D | M] – C:\Users\maureen\AppData\Roaming\calibre
[2012/05/17 11:13:22 | 000,000,000 | —D | M] – C:\Users\maureen\AppData\Roaming\Image Zone Express
[2011/06/12 11:09:39 | 000,000,000 | —D | M] – C:\Users\maureen\AppData\Roaming\PCDr
[2010/07/27 11:41:46 | 000,000,000 | —D | M] – C:\Users\maureen\AppData\Roaming\Printer Info Cache
[2011/10/03 19:04:38 | 000,000,000 | —D | M] – C:\Users\maureen\AppData\Roaming\Spotify
[2011/04/16 08:42:07 | 000,000,000 | —D | M] – C:\Users\maureen\AppData\Roaming\TweetDeckFast.FFF259DC0CE2657847BBB4AFF0E62062EFC56543.1
[2012/06/20 12:03:12 | 000,032,598 | —- | M] () – C:\Windows\Tasks\SCHEDLGU.TXT

========== Purity Check ==========



< End of report >
Post #24
That looks good apart from one entry I missed. ;)

Run OTL
  • double click on the icon to run it.
  • copy/paste ALL the following text written inside the code box into the Custom Scans/Fixes box located at the bottom of OTL

    :Services

:OTL
IE - HKCU\..\SearchScopes\{DECA3892-BA8F-44b8-A993-A466AD694AE4}: "URL" = http://search.yahoo.com/search?fr=mcafee&p={searchTerms}

:Commands
[purity]
[Reboot]

  • click the Run Fix button at the top
  • let the program run unhindered, reboot when it is done
  • post a new OTL log (don't check the boxes beside LOP Check or Purity this time)

=========================================

Run Malwarebytes’ Anti-Malware

I noticed that you had MBAM on your system: if you no longer have it, you can download it from here:
  • start Malwarebytes-Anti-Malware and update it, (“Update” tab}
  • once it is updated, click on “Scanner” tab, select Perform quick scan, then click Scan.
  • when the scan is complete, click OK, then Show Results to view the results.
  • be sure that everything is checked, and click Remove Selected.
  • when removal is completed, a log report will open in Notepad and you may be prompted to restart your computer. (see Note below)
  • the log is automatically saved and can be viewed by clicking the Logs tab in MBAM.
  • copy and paste the contents of that report in your next reply and exit MBAM.
NOTE: If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts. Click OK to either and let MBAM proceed with the disinfection process. If asked to restart the computer, please do so immediately. Failure to reboot will prevent MBAM from removing all the malware.


Logs to include with the next post:

OTL Fix log
Mbam.txt

Can you tell me if there are any outstanding problems.

Satchfan
Post #25
========== SERVICES/DRIVERS ========== ========== OTL ========== Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{DECA3892-BA8F-44b8-A993-A466AD694AE4}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{DECA3892-BA8F-44b8-A993-A466AD694AE4}\ not found. ========== COMMANDS ========== OTL by OldTimer - Version 3.2.50.0 log created on 06212012_134738 MALWAREBYTES LOG: Malwarebytes Anti-Malware 1.61.0.1400 www.malwarebytes.org Database version: v2012.06.19.01 Windows Vista Service Pack 2 x86 NTFS Internet Explorer 9.0.8112.16421 maureen :: ROYCROFT-PC [administrator] 6/21/2012 1:55:06 PM mbam-log-2012-06-21 (13-55-06).txt Scan type: Quick scan Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM Scan options disabled: P2P Objects scanned: 217903 Time elapsed: 9 minute(s), 12 second(s) Memory Processes Detected: 0 (No malicious items detected) Memory Modules Detected: 0 (No malicious items detected) Registry Keys Detected: 0 (No malicious items detected) Registry Values Detected: 0 (No malicious items detected) Registry Data Items Detected: 0 (No malicious items detected) Folders Detected: 0 (No malicious items detected) Files Detected: 0 (No malicious items detected) (end)
Post #26
When I tried to run the update, it blocked me. I had updated it on the 19th, so thought we were good. After I sent the attached log I tried to update again. This time it let me. So far it has detected on object. I'll follow your earlier directions and send you a new log.
Post #27
This is the Malwarebytes log after the update. Sorry. Malwarebytes Anti-Malware 1.61.0.1400 www.malwarebytes.org Database version: v2012.06.21.08 Windows Vista Service Pack 2 x86 NTFS Internet Explorer 9.0.8112.16421 maureen :: ROYCROFT-PC [administrator] 6/21/2012 2:06:54 PM mbam-log-2012-06-21 (14-06-54).txt Scan type: Quick scan Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM Scan options disabled: P2P Objects scanned: 218219 Time elapsed: 6 minute(s), 35 second(s) Memory Processes Detected: 0 (No malicious items detected) Memory Modules Detected: 0 (No malicious items detected) Registry Keys Detected: 0 (No malicious items detected) Registry Values Detected: 0 (No malicious items detected) Registry Data Items Detected: 0 (No malicious items detected) Folders Detected: 0 (No malicious items detected) Files Detected: 1 C:\Users\maureen\AppData\Local\Temp\2VjjIIZJsg0Sjo.exe.tmp (Trojan.FakeAlert) -> Quarantined and deleted successfully. (end)
Post #28
Thai’s all looking good.

One final scan should show that all is now well.

Run ESET Online Scan

Note: You can use either Internet Explorer or Mozilla FireFox for this scan. You will however need to disable your current installed Anti-Virus, how to do so can be read here.

Hold down Control and click on the following link to open ESET OnlineScan in a new window.

ESET OnlineScan 1. Click the Eset online Scanner button.
2. For alternate browsers only: (Microsoft Internet Explorer users can skip these steps)

• Click on esetinstaller.exe to download the ESET Smart Installer. Save it to your desktop.
• Double click on the Eset installer icon on your desktop.

3. Check Yes, I accept the Terms of Use
4. Click the Start button.
5. Accept any security warnings from your browser.
6. Check Scan archives
7. Push the Start button.
8. ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
9. When the scan completes, push List of found threats
10. Push Export to Text file and save the file to your desktop using a unique name, such as ESETScan. Include the contents of this report in your next reply.
Note - when ESET doesn't find any threats, no report will be created.
11. Push the back button.
12. Push Finish
If a log has been produced post it in your next reply.

NOTE. If Eset doesn't find any threats, it won't produce a log.

Satchfan
Post #30
Some, but not all, of my Word docs have the following symbol before the name: ~$c And others have: ~$ok And still others have nada. Just the old name. Should I only open the ones that say ‘ok’?

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI