Spyware / Malware / Virus Removal

PUM.Hijack.Startmenu [Closed]

9 min read

Looking for the outcome? Ask AI

bart10 Topic Starter

Post #1June 23, 2012, 8:42 PM UTC

Hi,
My daughter was doing a school search and went to the wrong site. The infection (PUM.Hijack.Startmenu ?) creates multiple warning s and hides most programs and files.No detection on Avira, but MalwareBytes detects the following readout:

Malwarebytes Anti-Malware (PRO) 1.61.0.1400
www.malwarebytes.org

Database version: v2012.06.23.02

Windows 7 Service Pack 1 x86 NTFS (Safe Mode/Networking)
Internet Explorer 8.0.7601.17514
Bart :: SUSAN-TESS-PC [administrator]

Protection: Disabled

6/23/2012 11:46:14 AM
mbam-log-2012-06-23 (11-49-51).txt

Scan type: Quick scan
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
Scan options disabled: P2P
Objects scanned: 223916
Time elapsed: 3 minute(s), 17 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 0
(No malicious items detected)

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 2
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced|Start_ShowMyComputer (PUM.Hijack.StartMenu) -> Bad: (0) Good: (1) -> No action taken.
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced|Start_ShowSearch (PUM.Hijack.StartMenu) -> Bad: (0) Good: (1) -> No action taken.

Folders Detected: 0
(No malicious items detected)

Files Detected: 0
(No malicious items detected)

(end)

——————————————————————————–

ITRIED DELETING THE TWO INSTANCES OF PUM.HIJACK.STARTMENU, BUT ONCE I REBOOTED, THEY SELF-INSTALLED AGAIN.

THIS IS THE OTL SCAN REPORT:

OTL logfile created on: 6/23/2012 1:19:02 PM - Run 3
OTL by OldTimer - Version 3.2.52.0 Folder = D:\Documents
Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7601.17514)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

2.75 Gb Total Physical Memory | 2.34 Gb Available Physical Memory | 85.29% Memory free
5.50 Gb Paging File | 5.10 Gb Available in Paging File | 92.86% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = E: | %SystemRoot% = E:\Windows | %ProgramFiles% = E:\Program Files
Drive C: | 337.77 Gb Total Space | 266.74 Gb Free Space | 78.97% Space Free | Partition Type: NTFS
Drive D: | 232.88 Gb Total Space | 28.51 Gb Free Space | 12.24% Space Free | Partition Type: NTFS
Drive E: | 127.99 Gb Total Space | 49.69 Gb Free Space | 38.82% Space Free | Partition Type: NTFS
Drive F: | 626.31 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: UDF
Drive H: | 1.87 Gb Total Space | 1.87 Gb Free Space | 99.99% Space Free | Partition Type: FAT32

Computer Name: SUSAN-TESS-PC | User Name: Bart | Logged in as Administrator.
Boot Mode: SafeMode with Networking | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 7 Days

========== Processes (SafeList) ==========

PRC - D:\Documents\OTL.exe (OldTimer Tools)
PRC - E:\Windows\explorer.exe (Microsoft Corporation)

========== Modules (No Company Name) ==========

MOD - E:\Program Files\WinRAR\RarExt.dll ()
MOD - E:\Program Files\Nitro PDF\Professional\N5ShellExtension.dll ()

========== Win32 Services (SafeList) ==========

SRV - (AcrSch2Svc) – E:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe File not found
SRV - (MozillaMaintenance) – E:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe (Mozilla Foundation)
SRV - (AntiVirService) – E:\Program Files\Avira\AntiVir Desktop\avguard.exe (Avira Operations GmbH & Co. KG)
SRV - (AntiVirSchedulerService) – E:\Program Files\Avira\AntiVir Desktop\sched.exe (Avira Operations GmbH & Co. KG)
SRV - (MBAMService) – E:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation)
SRV - (TuneUp.UtilitiesSvc) – E:\Program Files\TuneUp Utilities 2012\TuneUpUtilitiesService32.exe (TuneUp Software)
SRV - (SONICWALL_NetExtender) – E:\Program Files\SonicWALL\SSL-VPN\NetExtender\NEService.exe (SonicWALL Inc.)
SRV - (nvUpdatusService) – E:\Program Files\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe (NVIDIA Corporation)
SRV - (CFUACProxy_hddv2nusb3) – E:\ProgramData\Clickfree\HDDV2NUSB3\UACProxy.exe (Storage Appliance Corp.)
SRV - (SacNetAgentService_C57C4F854F53) – E:\ProgramData\Clickfree\HDDV2NUSB3\Reminder\SacNetAgent.exe (Storage Appliance Corporation)
SRV - (LBTServ) – E:\Program Files\Common Files\LogiShrd\Bluetooth\LBTServ.exe (Logitech, Inc.)
SRV - (SwitchBoard) – E:\Program Files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe (Adobe Systems Incorporated)
SRV - (TuneUp.ProgramStatisticsSvc) – E:\Windows\System32\TUProgSt.exe (TuneUp Software)
SRV - (TuneUp.Defrag) – E:\Windows\System32\TuneUpDefragService.exe (TuneUp Software)
SRV - (FLEXnet Licensing Service) – E:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe (Acresso Software Inc.)
SRV - (getPlusHelper) getPlus® – E:\Program Files\NOS\bin\getPlus_Helper.dll (NOS Microsystems Ltd.)
SRV - (SensrSvc) – E:\Windows\System32\sensrsvc.dll (Microsoft Corporation)
SRV - (WinDefend) – E:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)
SRV - (bepldr) – E:\Program Files\Common Files\BCL Technologies\NitroPDF5\bepldr.exe ()

========== Driver Services (SafeList) ==========

DRV - (avipbb) – E:\Windows\System32\drivers\avipbb.sys (Avira GmbH)
DRV - (avgntflt) – E:\Windows\System32\drivers\avgntflt.sys (Avira GmbH)
DRV - (MBAMProtector) – E:\Windows\System32\drivers\mbam.sys (Malwarebytes Corporation)
DRV - (TuneUpUtilitiesDrv) – E:\Program Files\TuneUp Utilities 2012\TuneUpUtilitiesDriver32.sys (TuneUp Software)
DRV - (avkmgr) – E:\Windows\System32\drivers\avkmgr.sys (Avira GmbH)
DRV - (NxDrv) – E:\Windows\System32\drivers\NxDrv.sys (SonicWALL Inc.)
DRV - (nvlddmkm) – E:\Windows\System32\drivers\nvlddmkm.sys (NVIDIA Corporation)
DRV - (TsUsbFlt) – E:\Windows\System32\drivers\TsUsbFlt.sys (Microsoft Corporation)
DRV - (Lbd) – E:\Windows\System32\drivers\Lbd.sys (Lavasoft AB)
DRV - (LMouFilt) – E:\Windows\System32\drivers\LMouFilt.Sys (Logitech, Inc.)
DRV - (LHidFilt) – E:\Windows\System32\drivers\LHidFilt.Sys (Logitech, Inc.)
DRV - (ssmdrv) – E:\Windows\System32\drivers\ssmdrv.sys (Avira GmbH)
DRV - (NtiEnc) – E:\Windows\System32\drivers\NtiEnc.sys (NewTech Infosystems)
DRV - (NVHDA) – E:\Windows\System32\drivers\nvhda32v.sys (NVIDIA Corporation)
DRV - (NVENETFD) – E:\Windows\System32\drivers\nvm62x32.sys (NVIDIA Corporation)
DRV - (ALCXWDM) Service for Realtek AC97 Audio (WDM) – E:\Windows\System32\drivers\RTKVAC.SYS (Realtek Semiconductor Corp.)
DRV - (nvstor32) – E:\Windows\System32\drivers\nvstor32.sys (NVIDIA Corporation)
DRV - (AsIO) – E:\Windows\System32\drivers\AsIO.sys ()
DRV - (MTsensor) – E:\Windows\System32\drivers\ASACPI.sys ()
DRV - (SCDEmu) – E:\Windows\System32\drivers\scdemu.sys (PowerISO Computing, Inc.)
DRV - (pfc) – E:\Windows\System32\drivers\pfc.sys (Padus, Inc.)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
IE - HKLM\..\SearchScopes,DefaultScope = {6A1806CD-94D4-4689-BA73-E35EA1EA9990}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://search.live.com/results.aspx?q={sea…ferrer:source?}
IE - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://www.google.com/search?q={searchTerm…mp;sourceid=ie7

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = http://g.msn.com/0SEENUS/SAOS01?FORM=TOOLBR
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://g.msn.com/0SEENUS/SAOS01?FORM=TOOLBR
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.msn.com/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 2
IE - HKCU\..\SearchScopes,DefaultScope = {6A1806CD-94D4-4689-BA73-E35EA1EA9990}
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}…amp;FORM=IE8SRC
IE - HKCU\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://www.google.com/search?q={searchTerm…1I7GPEA_enUS310
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = ;*.local

========== FireFox ==========

FF - prefs.js..browser.search.selectedEngine: "Yahoo"
FF - user.js - File not found

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: E:\Windows\system32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: E:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: E:\Program Files\DivX\DivX Web Player\npdivx32.dll (DivX,Inc.)
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Player Plugin,version=1.0.0: E:\Program Files\DivX\DivX Player\npDivxPlayerPlugin.dll (DivX, Inc)
FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: E:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: E:\Program Files\Microsoft Silverlight\4.1.10111.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/VirtualEarth3D,version=2.5: E:\Program Files\Virtual Earth 3D\ [2012/02/26 15:39:04 | 000,000,000 | —D | M]
FF - HKLM\Software\MozillaPlugins\@microsoft.com/VirtualEarth3D,version=3.0: E:\Program Files\Virtual Earth 3D\ [2012/02/26 15:39:04 | 000,000,000 | —D | M]
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: E:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@Musicnotes.com/Musicnotes Viewer,version=1.18.1: E:\Program Files\Musicnotes\npmusicn.dll (Musicnotes, Inc.)
FF - HKLM\Software\MozillaPlugins\@pack.google.com/Google Updater;version=14: E:\Program Files\Google\Google Updater\2.4.2432.1652\npCIDetect14.dll (Google)
FF - HKLM\Software\MozillaPlugins\@real.com/nppl3260;version=6.0.12.775: E:\Program Files\Real\RealPlayer\Netscape6\nppl3260.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprjplug;version=1.0.3.775: E:\Program Files\Real\RealPlayer\Netscape6\nprjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprphtml5videoshim;version=1.0.0.0: E:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprpjplug;version=6.0.12.775: E:\Program Files\Real\RealPlayer\Netscape6\nprpjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nsJSRealPlayerPlugin;version=: File not found
FF - HKLM\Software\MozillaPlugins\@Sibelius.com/Scorch Plugin,version=6.1.5.22: E:\Program Files\Musicnotes\npsibelius.dll ()
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: E:\Program Files\Google\Update\1.3.21.111\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: E:\Program Files\Google\Update\1.3.21.111\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: E:\Users\Bart\AppData\Local\Google\Update\1.3.21.111\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: E:\Users\Bart\AppData\Local\Google\Update\1.3.21.111\npGoogleUpdate3.dll (Google Inc.)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{ABDE892B-13A8-4d1b-88E6-365A6E755758}: E:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext [2012/02/26 15:41:48 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 13.0.1\extensions\\Components: E:\Program Files\Mozilla Firefox\components [2012/06/16 12:03:56 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 13.0.1\extensions\\Plugins: E:\Program Files\Mozilla Firefox\plugins [2012/06/07 18:13:21 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Netscape Browser 8.1.2.0\Extensions\\Components: E:\Program Files\Netscape\Netscape Browser\Components [2012/02/26 15:35:47 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Netscape Browser 8.1.2.0\Extensions\\Plugins: E:\Program Files\Netscape\Netscape Browser\Plugins [2012/02/26 15:35:49 | 000,000,000 | —D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 13.0.1\extensions\\Components: E:\Program Files\Mozilla Firefox\components [2012/06/16 12:03:56 | 000,000,000 | —D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 13.0.1\extensions\\Plugins: E:\Program Files\Mozilla Firefox\plugins [2012/06/07 18:13:21 | 000,000,000 | —D | M]

[2012/02/26 16:02:11 | 000,000,000 | —D | M] (No name found) – E:\Users\Bart\AppData\Roaming\Mozilla\Extensions
[2012/06/21 17:30:37 | 000,000,000 | —D | M] (No name found) – E:\Users\Bart\AppData\Roaming\Mozilla\Firefox\Profiles\zbq9fgvp.default\extensions
[2012/02/27 14:11:00 | 000,000,000 | —D | M] (Adblock Plus) – E:\Users\Bart\AppData\Roaming\Mozilla\Firefox\Profiles\zbq9fgvp.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}
[2012/02/26 16:02:13 | 000,000,000 | —D | M] (Adobe DLM (powered by getPlus®)) – E:\Users\Bart\AppData\Roaming\Mozilla\Firefox\Profiles\zbq9fgvp.default\extensions\{E2883E8F-472F-4fb0-9522-AC9BF37916A7}
[2012/06/07 18:13:27 | 000,000,000 | —D | M] (No name found) – E:\Program Files\Mozilla Firefox\extensions
File not found (No name found) – E:\PROGRAM FILES\FLOCK\FLOCK\EXTENSIONS\[removed]
File not found (No name found) – E:\PROGRAM FILES\FLOCK\FLOCK\EXTENSIONS\[removed]
[2012/06/16 12:03:56 | 000,085,472 | —- | M] (Mozilla Foundation) – E:\Program Files\mozilla firefox\components\browsercomps.dll
[2010/04/12 17:29:19 | 000,411,368 | —- | M] (Sun Microsystems, Inc.) – E:\Program Files\mozilla firefox\plugins\npdeployJava1.dll
[2012/06/16 12:03:54 | 000,002,252 | —- | M] () – E:\Program Files\mozilla firefox\searchplugins\bing.xml
[2012/06/16 12:03:54 | 000,002,040 | —- | M] () – E:\Program Files\mozilla firefox\searchplugins\twitter.xml

========== Chrome ==========

CHR - default_search_provider: Google (Enabled)
CHR - default_search_provider: search_url = {google:baseURL}search?{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}{googl
e:searchFieldtrialParameter}{google:instantFieldTrialGroupParameter}sourceid=chro
me&ie;={inputEncoding}&q;={searchTerms}
CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}{google:instantFieldTrialGroupParameter}client
=chrome&hl;={language}&q;={searchTerms}
CHR - plugin: Shockwave Flash (Disabled) = E:\Users\Bart\AppData\Local\Google\Chrome\User Data\PepperFlash\11.1.31.203\pepflashplayer.dll
CHR - plugin: Shockwave Flash (Enabled) = E:\Users\Bart\AppData\Local\Google\Chrome\Application\17.0.963.56\gcswf32.dll
CHR - plugin: Shockwave Flash (Enabled) = E:\Windows\system32\Macromed\Flash\NPSWF32.dll
CHR - plugin: Remoting Viewer (Enabled) = internal-remoting-viewer
CHR - plugin: Native Client (Enabled) = E:\Users\Bart\AppData\Local\Google\Chrome\Application\17.0.963.56\ppGoogleNaClPluginChrome.dll
CHR - plugin: Chrome PDF Viewer (Enabled) = E:\Users\Bart\AppData\Local\Google\Chrome\Application\17.0.963.56\pdf.dll
CHR - plugin: Adobe Acrobat (Disabled) = E:\Program Files\Adobe\Reader 8.0\Reader\Browser\nppdf32.dll
CHR - plugin: Java™ Platform SE 6 U20 (Enabled) = E:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll
CHR - plugin: Java Deployment Toolkit 6.0.200.2 (Enabled) = E:\Program Files\Mozilla Firefox\plugins\npdeployJava1.dll
CHR - plugin: Microsoft\u00AE Windows Media Player Firefox Plugin (Enabled) = E:\Program Files\Mozilla Firefox\plugins\np-mswmp.dll
CHR - plugin: DivX Web Player (Enabled) = E:\Program Files\Mozilla Firefox\plugins\npdivx32.dll
CHR - plugin: DivX Player Netscape Plugin (Enabled) = E:\Program Files\Mozilla Firefox\plugins\npDivxPlayerPlugin.dll
CHR - plugin: 2007 Microsoft Office system (Enabled) = E:\Program Files\Mozilla Firefox\plugins\NPOFF12.DLL
CHR - plugin: RealPlayer™ G2 LiveConnect-Enabled Plug-In (32-bit) (Enabled) = E:\Program Files\Mozilla Firefox\plugins\nppl3260.dll
CHR - plugin: RealPlayer Version Plugin (Enabled) = E:\Program Files\Mozilla Firefox\plugins\nprpjplug.dll
CHR - plugin: RealPlayer™ HTML5VideoShim Plug-In (32-bit) (Enabled) = E:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = E:\Program Files\Mozilla Firefox\plugins\npqtplugin.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = E:\Program Files\Mozilla Firefox\plugins\npqtplugin2.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = E:\Program Files\Mozilla Firefox\plugins\npqtplugin3.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = E:\Program Files\Mozilla Firefox\plugins\npqtplugin4.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = E:\Program Files\Mozilla Firefox\plugins\npqtplugin5.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = E:\Program Files\Mozilla Firefox\plugins\npqtplugin6.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = E:\Program Files\Mozilla Firefox\plugins\npqtplugin7.dll
CHR - plugin: RealJukebox NS Plugin (Enabled) = E:\Program Files\Mozilla Firefox\plugins\nprjplug.dll
CHR - plugin: Google Earth Plugin (Enabled) = E:\Program Files\Google\Google Earth\plugin\npgeplugin.dll
CHR - plugin: Google Updater (Enabled) = E:\Program Files\Google\Google Updater\2.4.2432.1652\npCIDetect14.dll
CHR - plugin: Google Update (Enabled) = E:\Program Files\Google\Update\1.3.21.99\npGoogleUpdate3.dll
CHR - plugin: Silverlight Plug-In (Enabled) = E:\Program Files\Microsoft Silverlight\3.0.50106.0\npctrl.dll
CHR - plugin: Musicnotes (Enabled) = E:\Program Files\Musicnotes\npmusicn.dll
CHR - plugin: ScorchPlugin (Enabled) = E:\Program Files\Musicnotes\npsibelius.dll
CHR - plugin: iTunes Application Detector (Enabled) = E:\Program Files\iTunes\Mozilla Plugins\npitunes.dll
CHR - plugin: Windows Presentation Foundation (Enabled) = E:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll
CHR - plugin: Default Plug-in (Enabled) = default_plugin
CHR - Extension: YouTube = E:\Users\Bart\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.2_0\
CHR - Extension: Google Search = E:\Users\Bart\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.17_0\
CHR - Extension: RealPlayer HTML5Video Downloader Extension = E:\Users\Bart\AppData\Local\Google\Chrome\User Data\Default\Extensions\jfmjfhklogoienhpfnppmbcbjfjnkonk\1.2\
CHR - Extension: Gmail = E:\Users\Bart\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\

O1 HOSTS File: ([2012/02/27 13:46:22 | 000,001,828 | —- | M]) - E:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 activate.adobe.com
O1 - Hosts: 127.0.0.1 practivate.adobe.com
O1 - Hosts: 127.0.0.1 ereg.adobe.com
O1 - Hosts: 127.0.0.1 activate.wip3.adobe.com
O1 - Hosts: 127.0.0.1 wip3.adobe.com
O1 - Hosts: 127.0.0.1 3dns-3.adobe.com
O1 - Hosts: 127.0.0.1 3dns-2.adobe.com
O1 - Hosts: 127.0.0.1 adobe-dns.adobe.com
O1 - Hosts: 127.0.0.1 adobe-dns-2.adobe.com
O1 - Hosts: 127.0.0.1 adobe-dns-3.adobe.com
O1 - Hosts: 127.0.0.1 ereg.wip3.adobe.com
O1 - Hosts: 127.0.0.1 activate-sea.adobe.com
O1 - Hosts: 127.0.0.1 wwis-dubc1-vip60.adobe.com
O1 - Hosts: 127.0.0.1 activate-sjc0.adobe.com
O1 - Hosts: 127.0.0.1 adobe.activate.com
O1 - Hosts: 127.0.0.1 adobeereg.com
O1 - Hosts: 127.0.0.1 www.adobeereg.com
O1 - Hosts: 127.0.0.1 wwis-dubc1-vip60.adobe.com
O1 - Hosts: 127.0.0.1 125.252.224.90
O1 - Hosts: 127.0.0.1 125.252.224.91
O1 - Hosts: 127.0.0.1 hl2rcv.adobe.com
O1 - Hosts: 127.0.0.1 secure.tune-up.com
O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - E:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (RealPlayer Download and Record Plugin for Internet Explorer) - {3049C3E9-B461-4BC5-8870-4C09146192CA} - E:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll (RealPlayer)
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - E:\Program Files\Google\GoogleToolbarNotifier\5.7.7227.1100\swg.dll (Google Inc.)
O4 - HKLM..\Run: [APSDaemon] E:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
O4 - HKLM..\Run: [avgnt] E:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)
O4 - HKLM..\Run: [EvtMgr6] E:\Program Files\Logitech\SetPointP\SetPoint.exe (Logitech, Inc.)
O4 - HKLM..\Run: [Kernel and Hardware Abstraction Layer] E:\Windows\KHALMNPR.Exe (Logitech Inc.)
O4 - HKLM..\Run: [Malwarebytes' Anti-Malware] E:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
O4 - HKLM..\Run: [SoundMan] E:\Windows\SOUNDMAN.EXE (Realtek Semiconductor Corp.)
O4 - HKCU..\Run: [EPSON01BECE] E:\Windows\System32\spool\DRIVERS\W32X86\3\E_FATIFRA.EXE (SEIKO EPSON CORPORATION)
O4 - HKCU..\Run: [HDFDEdWnhRJWy.exe] E:\ProgramData\HDFDEdWnhRJWy.exe ()
O4 - HKCU..\Run: [SacReminderHDDV2N] E:\ProgramData\Clickfree\HDDV2NUSB3\Reminder\SacReminder.exe (Storage Appliance Corp.)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - E:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O13 - gopher Prefix: missing
O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} http://upload.facebook.com/controls/2008.1…toUploader5.cab (Facebook Photo Uploader 5 Control)
O16 - DPF: {1239CC52-59EF-4DFA-8C61-90FFA846DF7E} http://www.musicnotes.com/download/mnviewer.cab (Musicnotes Viewer)
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} http://fpdownload.macromedia.com/get/shock…director/sw.cab (Shockwave ActiveX Control)
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} http://download.microsoft.com/download/9/b…heckControl.cab (Windows Genuine Advantage Validation Tool)
O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262E} http://www.nvidia.com/content/DriverDownlo…/sysreqlab3.cab (System Requirements Lab Class)
O16 - DPF: {4871A87A-BFDD-4106-8153-FFDE2BAC2967} http://dlm.tools.akamai.com/dlmanager/vers…vex-2.2.5.0.cab (DLM Control)
O16 - DPF: {67A5F8DC-1A4B-4D66-9F24-A704AD929EEE} http://www.nvidia.com/content/DriverDownlo…/sysreqlab2.cab (Reg Error: Key error.)
O16 - DPF: {6EEFD7B1-B26C-440D-B55A-1EC677189F30} https://portal.cee-school.org/NELX.cab (NELaunchCtrl Class)
O16 - DPF: {8100D56A-5661-482C-BEE8-AFECE305D968} http://upload.facebook.com/controls/2009.0…oUploader55.cab (Facebook Photo Uploader 5 Control)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.macromedia.com/get/flash…r/ultrashim.cab (Reg Error: Key error.)
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} http://cdn2.zone.msn.com/binFramework/v10/…ro.cab56649.cab (MSN Games - Installer)
O16 - DPF: {C9386579-3C0F-4713-82C6-5BA8088C7C8D} https://secure.shared.live.com/Pa6vGqB728Ax….RichUpload.cab (Windows Live SkyDrive Upload Tool)
O16 - DPF: {CAFEEFAC-0016-0000-0000-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0)
O16 - DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload.macromedia.com/get/shock…ash/swflash.cab (Shockwave Flash Object)
O16 - DPF: {E8F628B5-259A-4734-97EE-BA914D7BE941} http://driveragent.com/files/driveragent.cab (Driver Agent ActiveX Control)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.254
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{38E89F6D-09B9-427F-A0CF-B2B2547BEF34}: Domain = cee-school.org
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{38E89F6D-09B9-427F-A0CF-B2B2547BEF34}: NameServer = 10.30.0.30 10.30.0.14
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{80EF1ACB-D019-4D39-9C47-5957C89DD54C}: DhcpNameServer = 192.168.1.254
O20 - HKLM Winlogon: Shell - (Explorer.exe) - E:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (E:\Windows\system32\userinit.exe) - E:\Windows\System32\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - E:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O24 - Desktop WallPaper: E:\Users\Bart\AppData\Roaming\Microsoft\Windows Live Photo Gallery\Windows Live Photo Gallery Wallpaper.jpg
O24 - Desktop BackupWallPaper: E:\Users\Bart\AppData\Roaming\Microsoft\Windows Live Photo Gallery\Windows Live Photo Gallery Wallpaper.jpg
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009/06/10 14:42:20 | 000,000,024 | —- | M] () - E:\autoexec.bat – [ NTFS ]
O33 - MountPoints2\{690de4b5-60e2-11e1-9f61-0017315c338e}\Shell - "" = AutoRun
O33 - MountPoints2\{690de4b5-60e2-11e1-9f61-0017315c338e}\Shell\AutoRun\command - "" = H:\StartClickFreeBackup.exe
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)

NetSvcs: FastUserSwitchingCompatibility - File not found
NetSvcs: Ias - E:\Windows\System32\ias.dll (Microsoft Corporation)
NetSvcs: Nla - File not found
NetSvcs: Ntmssvc - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: SRService - File not found
NetSvcs: WmdmPmSp - File not found
NetSvcs: LogonHours - File not found
NetSvcs: PCAudit - File not found
NetSvcs: helpsvc - File not found
NetSvcs: uploadmgr - File not found

Drivers32: msacm.l3acm - E:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: vidc.cvid - E:\Windows\System32\iccvid.dll (Radius Inc.)
Drivers32: vidc.DIVX - E:\Windows\System32\DivX.dll (DivX, Inc.)
Drivers32: vidc.XVID - E:\Windows\System32\xvidvfw.dll ()
Drivers32: vidc.yv12 - E:\Windows\System32\DivX.dll (DivX, Inc.)

CREATERESTOREPOINT
Unable to start System Restore Service. Error code 1084

========== Files/Folders - Created Within 7 Days ==========

[2012/06/23 12:54:27 | 000,596,480 | —- | C] (OldTimer Tools) – D:\Documents\OTL.exe
[2012/06/23 01:47:03 | 000,000,000 | —D | C] – E:\Users\Bart\Desktop\RK_Quarantine
[2012/06/23 00:37:16 | 000,000,000 | —D | C] – E:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2012/06/23 00:37:12 | 000,022,344 | —- | C] (Malwarebytes Corporation) – E:\Windows\System32\drivers\mbam.sys
[2012/06/23 00:37:12 | 000,000,000 | —D | C] – E:\Program Files\Malwarebytes' Anti-Malware
[2012/06/20 18:47:26 | 002,422,272 | —- | C] (Microsoft Corporation) – E:\Windows\System32\wucltux.dll
[2012/06/20 18:47:26 | 000,045,080 | —- | C] (Microsoft Corporation) – E:\Windows\System32\wups2.dll
[2012/06/20 18:47:22 | 000,577,048 | —- | C] (Microsoft Corporation) – E:\Windows\System32\wuapi.dll
[2012/06/20 18:47:22 | 000,088,576 | —- | C] (Microsoft Corporation) – E:\Windows\System32\wudriver.dll
[2012/06/20 18:47:22 | 000,035,864 | —- | C] (Microsoft Corporation) – E:\Windows\System32\wups.dll
[2012/06/20 18:47:16 | 000,171,904 | —- | C] (Microsoft Corporation) – E:\Windows\System32\wuwebv.dll
[2012/06/20 18:47:16 | 000,033,792 | —- | C] (Microsoft Corporation) – E:\Windows\System32\wuapp.exe

========== Files - Modified Within 7 Days ==========

[2012/06/23 13:18:47 | 000,618,026 | —- | M] () – E:\Windows\System32\perfh009.dat
[2012/06/23 13:18:47 | 000,104,340 | —- | M] () – E:\Windows\System32\perfc009.dat
[2012/06/23 13:14:36 | 000,067,584 | –S- | M] () – E:\Windows\bootstat.dat
[2012/06/23 13:14:35 | 2213,314,560 | -HS- | M] () – E:\hiberfil.sys
[2012/06/23 13:13:04 | 000,000,882 | —- | M] () – E:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2012/06/23 02:28:06 | 000,000,904 | —- | M] () – E:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-686366199-2891090769-364564458-1000UA.job
[2012/06/23 02:28:06 | 000,000,886 | —- | M] () – E:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2012/06/23 02:26:29 | 000,009,824 | —- | M] () – E:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2012/06/23 02:26:29 | 000,009,824 | —- | M] () – E:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2012/06/23 01:32:16 | 000,596,480 | —- | M] (OldTimer Tools) – D:\Documents\OTL.exe
[2012/06/23 00:37:16 | 000,001,072 | —- | M] () – E:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2012/06/22 22:28:01 | 000,000,852 | —- | M] () – E:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-686366199-2891090769-364564458-1000Core.job
[2012/06/22 22:12:34 | 000,344,824 | —- | M] () – E:\ProgramData\HDFDEdWnhRJWy.exe
[2012/06/22 18:17:45 | 000,000,258 | RHS- | M] () – E:\ProgramData\ntuser.pol
[2012/06/18 11:59:00 | 000,000,868 | —- | M] () – E:\Windows\tasks\Google Software Updater.job

========== Files Created - No Company Name ==========

[2012/06/23 02:16:26 | 000,002,146 | —- | C] () – E:\ProgramData\Microsoft\Windows\Start Menu\Programs\TuneUp Utilities 2012.lnk
[2012/06/23 02:16:26 | 000,002,110 | —- | C] () – E:\ProgramData\Microsoft\Windows\Start Menu\Programs\Nitro PDF Professional.lnk
[2012/06/23 02:16:26 | 000,002,092 | —- | C] () – E:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Live Photo Gallery.lnk
[2012/06/23 02:16:26 | 000,002,001 | —- | C] () – E:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows 7 Upgrade Advisor.lnk
[2012/06/23 02:16:26 | 000,001,984 | —- | C] () – E:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Live Mail.lnk
[2012/06/23 02:16:26 | 000,001,515 | —- | C] () – E:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Media Player.lnk
[2012/06/23 02:16:26 | 000,001,352 | —- | C] () – E:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Anytime Upgrade.lnk
[2012/06/23 02:16:26 | 000,001,345 | —- | C] () – E:\ProgramData\Microsoft\Windows\Start Menu\Programs\Media Center.lnk
[2012/06/23 02:16:26 | 000,001,330 | —- | C] () – E:\ProgramData\Microsoft\Windows\Start Menu\Programs\Sidebar.lnk
[2012/06/23 02:16:26 | 000,001,326 | —- | C] () – E:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows DVD Maker.lnk
[2012/06/23 02:16:26 | 000,001,246 | —- | C] () – E:\ProgramData\Microsoft\Windows\Start Menu\Programs\XPS Viewer.lnk
[2012/06/23 02:16:26 | 000,001,210 | —- | C] () – E:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Fax and Scan.lnk
[2012/06/23 02:16:26 | 000,000,972 | —- | C] () – E:\ProgramData\Microsoft\Windows\Start Menu\Programs\TuneUp Utilities 2009.lnk
[2012/06/23 02:16:25 | 000,002,519 | —- | C] () – E:\ProgramData\Microsoft\Windows\Start Menu\Programs\Apple Software Update.lnk
[2012/06/23 02:16:25 | 000,002,425 | —- | C] () – E:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader 8.lnk
[2012/06/23 02:16:25 | 000,001,436 | —- | C] () – E:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Illustrator CS5.lnk
[2012/06/23 02:16:25 | 000,001,313 | —- | C] () – E:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe ExtendScript Toolkit CS5.lnk
[2012/06/23 02:16:25 | 000,001,269 | —- | C] () – E:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe ExtendScript Toolkit 2.lnk
[2012/06/23 02:16:25 | 000,001,151 | —- | C] () – E:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Extension Manager CS5.lnk
[2012/06/23 02:16:25 | 000,001,060 | —- | C] () – E:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Device Central CS5.lnk
[2012/06/23 02:16:25 | 000,001,005 | —- | C] () – E:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Photoshop CS5.lnk
[2012/06/23 02:16:25 | 000,000,967 | —- | C] () – E:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Bridge CS5.lnk
[2012/06/23 02:16:25 | 000,000,879 | —- | C] () – E:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Help.lnk
[2012/06/23 02:16:25 | 000,000,868 | —- | C] () – E:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Flash CS3 Video Encoder.lnk
[2012/06/23 02:16:25 | 000,000,842 | —- | C] () – E:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Stock Photos CS3.lnk
[2012/06/23 02:16:25 | 000,000,832 | —- | C] () – E:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Extension Manager CS3.lnk
[2012/06/23 02:16:25 | 000,000,825 | —- | C] () – E:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Device Central CS3.lnk
[2012/06/23 02:16:25 | 000,000,804 | —- | C] () – E:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Dreamweaver CS3.lnk
[2012/06/23 02:16:25 | 000,000,762 | —- | C] () – E:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Bridge CS3.lnk
[2012/06/23 02:16:25 | 000,000,752 | —- | C] () – E:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Flash CS3 Professional.lnk
[2012/06/23 01:00:23 | 000,001,072 | —- | C] () – E:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2012/06/22 22:14:52 | 000,344,824 | —- | C] () – E:\ProgramData\HDFDEdWnhRJWy.exe
[2012/02/26 16:36:49 | 000,000,258 | RHS- | C] () – E:\ProgramData\ntuser.pol
[2011/05/15 23:33:07 | 000,000,132 | —- | C] () – E:\Users\Bart\AppData\Roaming\Adobe BMP Format CS5 Prefs
[2010/07/11 20:15:14 | 000,073,220 | —- | C] () – E:\Windows\System32\EPPICPrinterDB.dat
[2010/07/11 20:15:14 | 000,031,053 | —- | C] () – E:\Windows\System32\EPPICPattern131.dat
[2010/07/11 20:15:14 | 000,029,114 | —- | C] () – E:\Windows\System32\EPPICPattern1.dat
[2010/07/11 20:15:14 | 000,027,417 | —- | C] () – E:\Windows\System32\EPPICPattern121.dat
[2010/07/11 20:15:14 | 000,021,021 | —- | C] () – E:\Windows\System32\EPPICPattern3.dat
[2010/07/11 20:15:14 | 000,015,670 | —- | C] () – E:\Windows\System32\EPPICPattern5.dat
[2010/07/11 20:15:14 | 000,013,280 | —- | C] () – E:\Windows\System32\EPPICPattern2.dat
[2010/07/11 20:15:14 | 000,010,673 | —- | C] () – E:\Windows\System32\EPPICPattern4.dat
[2010/07/11 20:15:14 | 000,004,943 | —- | C] () – E:\Windows\System32\EPPICPattern6.dat
[2010/07/11 20:15:14 | 000,001,140 | —- | C] () – E:\Windows\System32\EPPICPresetData_PT.dat
[2010/07/11 20:15:14 | 000,001,140 | —- | C] () – E:\Windows\System32\EPPICPresetData_BP.dat
[2010/07/11 20:15:14 | 000,001,137 | —- | C] () – E:\Windows\System32\EPPICPresetData_ES.dat
[2010/07/11 20:15:14 | 000,001,130 | —- | C] () – E:\Windows\System32\EPPICPresetData_FR.dat
[2010/07/11 20:15:14 | 000,001,130 | —- | C] () – E:\Windows\System32\EPPICPresetData_CF.dat
[2010/07/11 20:15:14 | 000,001,104 | —- | C] () – E:\Windows\System32\EPPICPresetData_EN.dat
[2010/07/11 20:15:14 | 000,000,097 | —- | C] () – E:\Windows\System32\PICSDK.ini
[2009/08/20 10:26:28 | 000,060,744 | —- | C] () – E:\Users\Bart\g2mdlhlpx.exe
[2009/06/05 15:19:25 | 000,000,760 | —- | C] () – E:\Users\Bart\AppData\Roaming\setup_ldm.iss
[2009/01/11 00:19:15 | 2618,793,984 | —- | C] () – E:\Users\Bart\7000.0.081212-1400_client_en-us_Ultimate-GB1CULFRE_EN_DVD.iso
[2008/12/02 19:19:22 | 000,002,834 | —- | C] () – E:\Users\Bart\AppData\Roaming\SAS7_000.DAT
[2008/05/03 19:59:03 | 000,004,204 | —- | C] () – E:\Users\Bart\UserCustomPreset_Adobe Premiere Pro 2.0.vpr
[2007/12/20 12:40:10 | 000,048,245 | —- | C] () – E:\Users\Bart\Those Fat Monkeys.htm
[2007/06/05 17:14:50 | 000,000,028 | —- | C] () – E:\Users\Bart\Adobe Encore DVD_VUI.pref
[2007/05/15 00:59:15 | 000,000,556 | —- | C] () – E:\Users\Bart\AppData\Roaming\AutoGK.ini

========== LOP Check ==========

[2012/02/26 15:58:20 | 000,000,000 | —D | M] – E:\Users\Bart\AppData\Roaming\Acronis
[2012/02/26 15:58:32 | 000,000,000 | —D | M] – E:\Users\Bart\AppData\Roaming\Amazon
[2012/02/26 15:58:45 | 000,000,000 | —D | M] – E:\Users\Bart\AppData\Roaming\Azureus
[2011/01/15 22:59:48 | 000,000,000 | —D | M] – E:\Users\Bart\AppData\Roaming\Canon
[2012/02/26 15:58:45 | 000,000,000 | —D | M] – E:\Users\Bart\AppData\Roaming\chc.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1
[2012/02/26 15:58:46 | 000,000,000 | —D | M] – E:\Users\Bart\AppData\Roaming\Citrix
[2012/02/26 15:58:46 | 000,000,000 | —D | M] – E:\Users\Bart\AppData\Roaming\DeLorme
[2012/02/26 15:58:46 | 000,000,000 | —D | M] – E:\Users\Bart\AppData\Roaming\deskPDF
[2012/02/26 15:58:47 | 000,000,000 | —D | M] – E:\Users\Bart\AppData\Roaming\Dropbox
[2009/02/05 12:20:44 | 000,000,000 | —D | M] – E:\Users\Bart\AppData\Roaming\eMusic
[2012/02/26 15:59:57 | 000,000,000 | —D | M] – E:\Users\Bart\AppData\Roaming\Epson
[2012/02/26 15:59:57 | 000,000,000 | —D | M] – E:\Users\Bart\AppData\Roaming\Final Draft
[2012/02/26 15:59:57 | 000,000,000 | —D | M] – E:\Users\Bart\AppData\Roaming\FlashFXP
[2012/02/26 15:59:57 | 000,000,000 | —D | M] – E:\Users\Bart\AppData\Roaming\Flock
[2012/02/26 15:59:58 | 000,000,000 | —D | M] – E:\Users\Bart\AppData\Roaming\FontCreator
[2012/02/26 15:59:58 | 000,000,000 | —D | M] – E:\Users\Bart\AppData\Roaming\GlobalSCAPE
[2012/02/26 15:59:58 | 000,000,000 | —D | M] – E:\Users\Bart\AppData\Roaming\ICAClient
[2012/02/26 15:59:58 | 000,000,000 | —D | M] – E:\Users\Bart\AppData\Roaming\iolo
[2012/02/26 16:00:00 | 000,000,000 | —D | M] – E:\Users\Bart\AppData\Roaming\Leadertech
[2012/02/26 16:02:13 | 000,000,000 | —D | M] – E:\Users\Bart\AppData\Roaming\NetMedia Providers
[2012/02/26 16:02:13 | 000,000,000 | —D | M] – E:\Users\Bart\AppData\Roaming\Netscape
[2012/02/26 16:02:15 | 000,000,000 | —D | M] – E:\Users\Bart\AppData\Roaming\Nitro PDF
[2012/02/26 16:02:15 | 000,000,000 | —D | M] – E:\Users\Bart\AppData\Roaming\Nuance
[2007/03/10 16:50:59 | 000,000,000 | —D | M] – E:\Users\Bart\AppData\Roaming\Opera
[2012/02/26 16:02:15 | 000,000,000 | —D | M] – E:\Users\Bart\AppData\Roaming\pdf995
[2012/02/26 16:02:15 | 000,000,000 | —D | M] – E:\Users\Bart\AppData\Roaming\Publish Providers
[2012/02/26 16:02:16 | 000,000,000 | —D | M] – E:\Users\Bart\AppData\Roaming\RMS
[2012/02/26 16:02:19 | 000,000,000 | —D | M] – E:\Users\Bart\AppData\Roaming\ScanSoft
[2012/03/30 19:41:58 | 000,000,000 | —D | M] – E:\Users\Bart\AppData\Roaming\SecondLife
[2012/02/26 16:02:19 | 000,000,000 | —D | M] – E:\Users\Bart\AppData\Roaming\SolidDocuments
[2012/02/26 16:02:19 | 000,000,000 | —D | M] – E:\Users\Bart\AppData\Roaming\Sony
[2012/03/29 10:26:47 | 000,000,000 | —D | M] – E:\Users\Bart\AppData\Roaming\Spotify
[2012/02/26 16:02:19 | 000,000,000 | —D | M] – E:\Users\Bart\AppData\Roaming\Steinberg
[2012/02/26 16:02:22 | 000,000,000 | —D | M] – E:\Users\Bart\AppData\Roaming\TaxCut
[2012/02/26 16:02:23 | 000,000,000 | —D | M] – E:\Users\Bart\AppData\Roaming\Thunderbird
[2012/02/27 13:49:58 | 000,000,000 | —D | M] – E:\Users\Bart\AppData\Roaming\TuneUp Software
[2012/02/26 16:02:24 | 000,000,000 | —D | M] – E:\Users\Bart\AppData\Roaming\Web Page Maker
[2012/02/26 16:02:24 | 000,000,000 | —D | M] – E:\Users\Bart\AppData\Roaming\Zeon
[2012/05/26 10:52:40 | 000,032,592 | —- | M] () – E:\Windows\Tasks\SCHEDLGU.TXT

========== Purity Check ==========

========== Custom Scans ==========

< %SYSTEMDRIVE%\*.* >
[2009/09/03 14:53:56 | 000,000,036 | —- | M] () – E:\.uid_xxx
[2009/06/10 14:42:20 | 000,000,024 | —- | M] () – E:\autoexec.bat
[2007/02/16 01:29:38 | 000,000,337 | RHS- | M] () – E:\Boot.ini.saved
[2010/11/20 05:40:08 | 000,383,786 | RHS- | M] () – E:\bootmgr
[2012/02/26 15:20:18 | 000,008,192 | RHS- | M] () – E:\BOOTSECT.BAK
[2009/06/10 14:42:20 | 000,000,010 | —- | M] () – E:\config.sys
[2009/09/03 16:05:38 | 000,000,000 | —- | M] () – E:\famstats.txt
[2007/03/17 04:41:22 | 000,171,136 | RHS- | M] () – E:\grldr
[2012/06/23 13:14:35 | 2213,314,560 | -HS- | M] () – E:\hiberfil.sys
[2010/03/30 11:06:49 | 000,000,109 | —- | M] () – E:\mbam-error.txt
[2001/08/23 05:00:00 | 000,045,124 | RHS- | M] () – E:\NTDETECT.COM
[2001/08/23 05:00:00 | 000,222,368 | RHS- | M] () – E:\ntldr
[2012/06/23 13:14:40 | 2951,086,080 | -HS- | M] () – E:\pagefile.sys

< %systemroot%\Fonts\*.com >
[2009/07/13 21:52:25 | 000,026,040 | —- | M] () – E:\Windows\Fonts\GlobalMonospace.CompositeFont
[2009/07/13 21:52:25 | 000,026,489 | —- | M] () – E:\Windows\Fonts\GlobalSansSerif.CompositeFont
[2009/07/13 21:52:25 | 000,029,779 | —- | M] () – E:\Windows\Fonts\GlobalSerif.CompositeFont
[2009/07/13 21:52:25 | 000,043,318 | —- | M] () – E:\Windows\Fonts\GlobalUserInterface.CompositeFont

< %systemroot%\Fonts\*.dll >

< %systemroot%\Fonts\*.ini >
[2009/06/10 14:31:19 | 000,000,065 | —- | M] () – E:\Windows\Fonts\desktop.ini

< %systemroot%\Fonts\*.ini2 >

< %systemroot%\Fonts\*.exe >

< %systemroot%\system32\spool\prtprocs\w32x86\*.* >
[2009/07/13 18:15:05 | 000,070,144 | —- | M] (CANON INC.) – E:\Windows\system32\spool\prtprocs\w32x86\CNBPP3.DLL
[2006/09/13 14:00:00 | 000,027,136 | —- | M] (CANON INC.) – E:\Windows\system32\spool\prtprocs\w32x86\CNMPD7Q.DLL
[2006/09/13 14:00:00 | 000,069,632 | —- | M] (CANON INC.) – E:\Windows\system32\spool\prtprocs\w32x86\CNMPP7Q.DLL
[2006/11/02 03:46:06 | 000,032,768 | —- | M] (SEIKO EPSON CORPORATION) – E:\Windows\system32\spool\prtprocs\w32x86\EP0NPP01.DLL
[2009/07/13 18:15:35 | 000,022,528 | —- | M] (Microsoft Corporation) – E:\Windows\system32\spool\prtprocs\w32x86\jnwppr.dll
[2006/10/26 20:56:12 | 000,033,104 | —- | M] (Microsoft Corporation) – E:\Windows\system32\spool\prtprocs\w32x86\msonpppr.dll
[2010/11/20 05:21:38 | 000,030,208 | —- | M] (Microsoft Corporation) – E:\Windows\system32\spool\prtprocs\w32x86\winprint.dll

< %systemroot%\REPAIR\*.bak1 >

< %systemroot%\REPAIR\*.ini >

< %systemroot%\system32\*.jpg >

< %systemroot%\*.jpg >

< %systemroot%\*.png >

< %systemroot%\*.scr >
[2008/02/01 11:11:10 | 000,586,240 | —- | M] (Microsoft Corporation) – E:\Windows\WLXPGSS.SCR

< %systemroot%\*._sy >

< %APPDATA%\Adobe\Update\*.* >

< %ALLUSERSPROFILE%\Favorites\*.* >

< %APPDATA%\Microsoft\*.* >

< %PROGRAMFILES%\*.* >
[2009/07/13 21:41:57 | 000,000,174 | -HS- | M] () – E:\Program Files\desktop.ini
[2011/12/21 18:41:05 | 000,026,859 | —- | M] () – E:\Program Files\uninstal.log

< %APPDATA%\Update\*.* >

< %systemroot%\*. /mp /s >

< %systemroot%\System32\config\*.sav >

< %PROGRAMFILES%\bak. /s >

< %systemroot%\system32\bak. /s >

< %ALLUSERSPROFILE%\Start Menu\*.lnk /x >

< %systemroot%\system32\config\systemprofile\*.dat /x >

< %systemroot%\*.config >

< %systemroot%\system32\*.db >

< %PROGRAMFILES%\Internet Explorer\*.dat >

< %APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x >
[2012/02/25 18:33:10 | 000,000,350 | -HS- | M] () – E:\Users\Bart\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop (1).ini
[2012/02/26 16:37:11 | 000,000,221 | -HS- | M] () – E:\Users\Bart\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini

< %USERPROFILE%\Desktop\*.exe >
[2012/01/05 11:57:31 | 024,334,368 | —- | M] (Amazon.com) – E:\Users\Bart\Desktop\KindleForPC-installer.exe

< %PROGRAMFILES%\Common Files\*.* >

< %systemroot%\*.src >

< %systemroot%\install\*.* >

< %systemroot%\system32\DLL\*.* >

< %systemroot%\system32\HelpFiles\*.* >

< %systemroot%\system32\rundll\*.* >

< %systemroot%\winn32\*.* >

< %systemroot%\Java\*.* >

< %systemroot%\system32\test\*.* >

< %systemroot%\system32\Rundll32\*.* >

< %systemroot%\AppPatch\Custom\*.* >

< HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >
"NoAutoUpdate" = 0

< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs >
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install\\LastSuccessTime: 2012-02-27 06:44:25

< End of report >
————————————————————————-

BECAUSE OF HELP WHATTHETECH GAVE SOMEONE ELSE (BELLEMOV, JULY 19-20) WITH THE PROBLEM, I HAVE INSTALLED ROGUEKILLER AND UNHIDE AND HAVE LOGS FROM THEM, IF YOU WOULD LIKE TO SEE THEM.

I have not deleted any files or altered the register pending your advice.

Thanks for any help you can give me.

Satchfan

Post #2June 24, 2012, 8:19 AM UTC

Hello bart10 and welcome to the WTT forum.

My name is Satchfan and I would be glad to help you with your computer problem.

Please read the following guidelines which will help to make cleaning your machine easier:

please follow all instructions in the order posted
please continue to review my answers until I tell you your machine appears to be clear. Absence of symptoms does not mean that everything is clear
all logs/reports, etc. must be posted in Notepad. Please ensure that word wrap is unchecked. In Notepad click Format, uncheck Word wrap if it is checked
if you don't understand something, please don't hesitate to ask for clarification before proceeding
the fixes are specific to your problem and should only be used for this issue on this machine.
please reply within 3 days. If you do not reply within this period I will post a reminder but topics with no reply in 4 days will be closed!

IMPORTANT:

Please DO NOT RUN ANY TEMPORARY FILE CLEANERS
Please DO NOT install/uninstall any programs unless asked to.
Please DO NOT run any scans other than those requested

I am looking at your log now and will reply with instructions shortly

Satchfan

Satchfan

Post #3June 24, 2012, 8:58 AM UTC

Hello again bart10

The fixes I gave to bellemov were for that computer alone and it is very dangerous to follow other topics as they are given for specific circumstances and could damage your computer.

That said, it appears that no harm has come of it luckily.

Please send the results of the RogueKiller log.

The log you sent was the third run of OTL but the first one would have produced an additional log named Attach.txt which should be in D:\Documents

Please also send that.

Can you also tell me if your shortcuts and start menu are both OK.

Thanks

Satchfan

bart10

Post #4June 24, 2012, 5:31 PM UTC

Satchfan

That you so much for your help.

I cannot find the OTL attach file. One trouble I'm having is communicating between computers. The network works between my computer and the infected one, but not back. Consequently, I'm having to save on a usb drive to get files back to my computer. Possibly the attach file was lost in this process, but I don't see how, but I've looked where ever I thought it might be on both computers and can't find it.

After using unhide, the shortcuts and start menu are visible, but if I boot in normal mode the malware comes back and they are gone again. I am currently back in safe mode (unhide run again and menus visible).

Here is the RKreport:

RogueKiller V7.5.4 [06/07/2012] by Tigzy
mail: tigzyRKgmailcom
Feedback: http://www.geekstogo.com/forum/files/file/413-roguekiller/
Blog: http://tigzyrk.blogspot.com

Operating System: Windows 7 (6.1.7601 Service Pack 1) 32 bits version
Started in : Safe mode with network support
User: Bart [Admin rights]
Mode: Scan – Date: 06/23/2012 12:13:47

¤¤¤ Bad processes: 0 ¤¤¤

¤¤¤ Registry Entries: 25 ¤¤¤
[SUSP PATH] HKCU\[…]\Run : SacReminderHDDV2N (E:\ProgramData\Clickfree\HDDV2NUSB3\reminder\SacReminder.exe) -> FOUND
[SUSP PATH] HKCU\[…]\Run : HDFDEdWnhRJWy.exe (E:\ProgramData\HDFDEdWnhRJWy.exe) -> FOUND
[SUSP PATH] HKUS\S-1-5-21-686366199-2891090769-364564458-1000[…]\Run : SacReminderHDDV2N (E:\ProgramData\Clickfree\HDDV2NUSB3\reminder\SacReminder.exe) -> FOUND
[SUSP PATH] HKUS\S-1-5-21-686366199-2891090769-364564458-1000[…]\Run : HDFDEdWnhRJWy.exe (E:\ProgramData\HDFDEdWnhRJWy.exe) -> FOUND
[DNS] HKLM\[…]\ControlSet001\Parameters\Interfaces\{38E89F6D-09B9-427F-A0CF-B2B2547BEF34} : NameServer (10.30.0.30 10.30.0.14) -> FOUND
[DNS] HKLM\[…]\ControlSet002\Parameters\Interfaces\{38E89F6D-09B9-427F-A0CF-B2B2547BEF34} : NameServer (10.30.0.30 10.30.0.14) -> FOUND
[DNS] HKLM\[…]\ControlSet003\Parameters\Interfaces\{38E89F6D-09B9-427F-A0CF-B2B2547BEF34} : NameServer (10.30.0.30 10.30.0.14) -> FOUND
[WallPP] HKCU\[…]\Desktop : Wallpaper () -> FOUND
[HJ] HKCU\[…]\Advanced : Start_ShowMyComputer (0) -> FOUND
[HJ] HKCU\[…]\Advanced : Start_ShowSearch (0) -> FOUND
[HJ] HKCU\[…]\Advanced : Start_ShowMyDocs (0) -> FOUND
[HJ] HKCU\[…]\Advanced : Start_ShowRecentDocs (0) -> FOUND
[HJ] HKCU\[…]\Advanced : Start_ShowUser (0) -> FOUND
[HJ] HKCU\[…]\Advanced : Start_ShowMyPics (0) -> FOUND
[HJ] HKCU\[…]\Advanced : Start_ShowMyGames (0) -> FOUND
[HJ] HKCU\[…]\Advanced : Start_ShowMyMusic (0) -> FOUND
[HJ] HKCU\[…]\Advanced : Start_ShowControlPanel (0) -> FOUND
[HJ] HKCU\[…]\Advanced : Start_ShowHelp (0) -> FOUND
[HJ] HKCU\[…]\Advanced : Start_ShowPrinters (0) -> FOUND
[HJ] HKCU\[…]\Advanced : Start_ShowRun (0) -> FOUND
[HJ] HKCU\[…]\Advanced : Start_ShowSetProgramAccessAndDefaults (0) -> FOUND
[HJ] HKCU\[…]\Advanced : Start_TrackProgs (0) -> FOUND
[HJ] HKCU\[…]\ClassicStartMenu : {59031a47-3f72-44a7-89c5-5595fe6b30ee} (1) -> FOUND
[HJ] HKCU\[…]\ClassicStartMenu : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> FOUND
[HJ] HKCU\[…]\ClassicStartMenu : {645FF040-5081-101B-9F08-00AA002F954E} (1) -> FOUND

¤¤¤ Particular Files / Folders: ¤¤¤

¤¤¤ Driver: [NOT LOADED] ¤¤¤

¤¤¤ Infection : ¤¤¤

¤¤¤ HOSTS File: ¤¤¤
127.0.0.1 activate.adobe.com
127.0.0.1 practivate.adobe.com
127.0.0.1 ereg.adobe.com
127.0.0.1 activate.wip3.adobe.com
127.0.0.1 wip3.adobe.com
127.0.0.1 3dns-3.adobe.com
127.0.0.1 3dns-2.adobe.com
127.0.0.1 adobe-dns.adobe.com
127.0.0.1 adobe-dns-2.adobe.com
127.0.0.1 adobe-dns-3.adobe.com
127.0.0.1 ereg.wip3.adobe.com
127.0.0.1 activate-sea.adobe.com
127.0.0.1 wwis-dubc1-vip60.adobe.com
127.0.0.1 activate-sjc0.adobe.com
127.0.0.1 adobe.activate.com
127.0.0.1 adobeereg.com
127.0.0.1 www.adobeereg.com
127.0.0.1 wwis-dubc1-vip60.adobe.com
127.0.0.1 125.252.224.90
127.0.0.1 125.252.224.91
[…]

¤¤¤ MBR Check: ¤¤¤

+++++ PhysicalDrive0: WDC WD25 00JS-98NCB1 SCSI Disk Device +++++
— User —
[MBR] bf9b05f86bdc7bfbb239897b040e03f7
[BSP] 255ef259b67e73d0e9092b23587ef709 : Windows XP MBR Code
Partition table:
0 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 2048 | Size: 238473 Mo
User = LL1 … OK!
Error reading LL2 MBR!

+++++ PhysicalDrive1: WDC WD50 00AAKS-00V1A SCSI Disk Device +++++
— User —
[MBR] b2c91730bfdcedb0eb6fa667f274ad6b
[BSP] 66a4327ddba51212472989f6d36311bb : Windows 7 MBR Code
Partition table:
0 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 63 | Size: 131061 Mo
1 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 268414020 | Size: 345875 Mo
User = LL1 … OK!
Error reading LL2 MBR!

Finished : << RKreport[3].txt >>
RKreport[1].txt ; RKreport[2].txt ; RKreport[3].txt

Satchfan

Post #5June 24, 2012, 11:23 PM UTC last edited June 24, 2012, 11:32 PM UTC

Thanks for the logs.

Apologies; the log I asked for was the incorrect name but I need you to run more scans so that I can see what is happening.

Run DDS

Please download DDS by sUBs from one of the following links and save it to your desktop.

DDS.scr
DDS.pif

disable any script blocking protection (How to Disable your Security Programs)
double click DDS icon to run the tool (may take up to 3 minutes to run)
when done, DDS.txt will open.
after a few moments, attach.txt will open in a second window.
save both reports to your desktop.
Post the contents of the DDS.txt and Attach.txt reports in your next reply

===================================================

Run aswMBR

download aswMBR.exe to your desktop.
double click aswMBR.exe to run it
if asked, accept the AVAST virus definition download
click the "Scan" button to start scan
on completion of the scan click Save log, save it to your desktop and post in your next reply

Please include the following in your next post :

DDS.txt
Attach.txt
aswMBR log

Thanks

Satchfan

bart10

Post #6June 25, 2012, 1:18 AM UTC

Hi, Here's the DDS log: . DDS (Ver_2011-08-26.01) - NTFSx86 NETWORK Internet Explorer: 8.0.7601.17514 BrowserJavaVersion: 1.6.0_20 Run by [removed] at 17:57:21 on 2012-06-24 Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.2814.2401 [GMT -7:00] . AV: Avira Desktop *Enabled/Updated* {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C} SP: Avira Desktop *Enabled/Updated* {4D1AAC01-E68E-63B1-344F-57F1C6DA4691} SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} . ============== Running Processes =============== . E:\Windows\system32\wininit.exe E:\Windows\system32\lsm.exe E:\Windows\system32\svchost.exe -k DcomLaunch E:\Windows\system32\svchost.exe -k RPCSS E:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted E:\Windows\system32\svchost.exe -k netsvcs E:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted E:\Windows\system32\svchost.exe -k LocalService E:\Windows\system32\svchost.exe -k NetworkService E:\Windows\system32\svchost.exe -k LocalServiceNoNetwork E:\Windows\Explorer.EXE E:\Windows\system32\ctfmon.exe E:\Windows\system32\wbem\wmiprvse.exe E:\Windows\system32\conhost.exe E:\Windows\system32\wbem\wmiprvse.exe . ============== Pseudo HJT Report =============== . uInternet Settings,ProxyOverride = ;*.local BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - e:\program files\common files\adobe\acrobat\activex\AcroIEHelper.dll BHO: RealPlayer Download and Record Plugin for Internet Explorer: {3049c3e9-b461-4bc5-8870-4c09146192ca} - e:\programdata\real\realplayer\browserrecordplugin\ie\rpbrowserrecordplugin.dll BHO: Groove GFS Browser Helper: {72853161-30c5-4d22-b7f9-0bbc1d38a37e} - e:\program files\microsoft office\office12\GrooveShellExtensions.dll BHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - e:\program files\google\google toolbar\GoogleToolbar_32.dll BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - e:\program files\google\googletoolbarnotifier\5.7.7227.1100\swg.dll BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - e:\program files\java\jre6\bin\jp2ssv.dll TB: Google Toolbar: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - e:\program files\google\google toolbar\GoogleToolbar_32.dll uRun: [Sidebar] e:\program files\windows sidebar\sidebar.exe /autoRun uRun: [EPSON01BECE] e:\windows\system32\spool\drivers\w32x86\3\e_fatifra.exe /fu "e:\windows\temp\E_SAD7A.tmp" /EF "HKCU" uRun: [swg] "e:\program files\google\googletoolbarnotifier\GoogleToolbarNotifier.exe" uRun: [SacReminderHDDV2N] e:\programdata\clickfree\hddv2nusb3\reminder\SacReminder.exe uRun: [HDFDEdWnhRJWy.exe] e:\programdata\HDFDEdWnhRJWy.exe mRun: [EvtMgr6] e:\program files\logitech\setpointp\SetPoint.exe /launchGaming mRun: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE mRun: [avgnt] "e:\program files\avira\antivir desktop\avgnt.exe" /min mRun: [APSDaemon] "e:\program files\common files\apple\apple application support\APSDaemon.exe" mRun: [SoundMan] SOUNDMAN.EXE mRun: [Malwarebytes' Anti-Malware] "e:\program files\malwarebytes' anti-malware\mbamgui.exe" /starttray mPolicies-system: ConsentPromptBehaviorAdmin = 5 (0x5) mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3) mPolicies-system: EnableUIADesktopToggle = 0 (0x0) IE: E&xport; to Microsoft Excel - e:\progra~1\micros~3\office12\EXCEL.EXE/3000 IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - e:\program files\windows live\writer\WriterBrowserExtension.dll IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - e:\progra~1\micros~3\office12\ONBttnIE.dll IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - e:\progra~1\micros~3\office12\REFIEBAR.DLL DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} - hxxp://upload.facebook.com/controls/2008.10.10_v5.5.8/FacebookPhotoUploader5.cab DPF: {1239CC52-59EF-4DFA-8C61-90FFA846DF7E} - hxxp://www.musicnotes.com/download/mnviewer.cab DPF: {166B1BCA-3F9C-11CF-8075-444553540000} - hxxp://fpdownload.macromedia.com/get/shockwave/cabs/director/sw.cab DPF: {17492023-C23A-453E-A040-C7C580BBF700} - hxxp://download.microsoft.com/download/9/b/d/9bdc68ef-6a9f-4505-8fb8-d0d2d160e512/LegitCheckControl.cab DPF: {1E54D648-B804-468d-BC78-4AFFED8E262E} - hxxp://www.nvidia.com/content/DriverDownload/srl/3.0.0.0/srl_bin/sysreqlab3.cab DPF: {4871A87A-BFDD-4106-8153-FFDE2BAC2967} - hxxp://dlm.tools.akamai.com/dlmanager/versions/activex/dlm-activex-2.2.5.0.cab DPF: {67A5F8DC-1A4B-4D66-9F24-A704AD929EEE} - hxxp://www.nvidia.com/content/DriverDownload/srl/2.0.0.1/sysreqlab2.cab DPF: {6EEFD7B1-B26C-440D-B55A-1EC677189F30} - hxxps://portal.cee-school.org/NELX.cab DPF: {8100D56A-5661-482C-BEE8-AFECE305D968} - hxxp://upload.facebook.com/controls/2009.07.28_v5.5.8.1/FacebookPhotoUploader55.cab DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} - hxxp://cdn2.zone.msn.com/binFramework/v10/ZIntro.cab56649.cab DPF: {C9386579-3C0F-4713-82C6-5BA8088C7C8D} - hxxps://secure.shared.live.com/Pa6vGqB728AxD-ckvrPc0A/etc/Microsoft.Live.Folders.RichUpload.cab DPF: {CAFEEFAC-0016-0000-0000-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0-windows-i586.cab DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload.macromedia.com/get/shockwave/cabs/flash/swflash.cab DPF: {E8F628B5-259A-4734-97EE-BA914D7BE941} - hxxp://driveragent.com/files/driveragent.cab TCP: DhcpNameServer = 192.168.1.254 TCP: Interfaces\{38E89F6D-09B9-427F-A0CF-B2B2547BEF34} : NameServer = 10.30.0.30 10.30.0.14 TCP: Interfaces\{80EF1ACB-D019-4D39-9C47-5957C89DD54C} : DhcpNameServer = 192.168.1.254 Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - e:\program files\microsoft office\office12\GrooveSystemServices.dll SEH: Groove GFS Stub Execution Hook: {b5a7f190-dda6-4420-b3ba-52453494e6cd} - e:\program files\microsoft office\office12\GrooveShellExtensions.dll . ================= FIREFOX =================== . FF - ProfilePath - e:\users\bart\appdata\roaming\mozilla\firefox\profiles\zbq9fgvp.default\ FF - prefs.js: browser.search.selectedEngine - Yahoo FF - prefs.js: browser.startup.homepage - hxxp://en-us.start.mozilla.com/firefox?client=firefox-a&rls;=org.mozilla:en-US:official FF - component: e:\programdata\real\realplayer\browserrecordplugin\firefox\ext\components\nprpffbrowserrecordext.dll FF - plugin: e:\program files\google\google earth\plugin\npgeplugin.dll FF - plugin: e:\program files\google\google updater\2.4.2432.1652\npCIDetect14.dll FF - plugin: e:\program files\google\update\1.2.183.13\npGoogleOneClick8.dll FF - plugin: e:\program files\google\update\1.2.183.17\npGoogleOneClick8.dll FF - plugin: e:\program files\google\update\1.2.183.23\npGoogleOneClick8.dll FF - plugin: e:\program files\google\update\1.3.21.111\npGoogleUpdate3.dll FF - plugin: e:\program files\google\update\1.3.21.53\npGoogleUpdate3.dll FF - plugin: e:\program files\google\update\1.3.21.57\npGoogleUpdate3.dll FF - plugin: e:\program files\google\update\1.3.21.65\npGoogleUpdate3.dll FF - plugin: e:\program files\google\update\1.3.21.69\npGoogleUpdate3.dll FF - plugin: e:\program files\google\update\1.3.21.79\npGoogleUpdate3.dll FF - plugin: e:\program files\google\update\1.3.21.99\npGoogleUpdate3.dll FF - plugin: e:\program files\microsoft silverlight\4.1.10111.0\npctrlui.dll FF - plugin: e:\program files\mozilla firefox\plugins\npdeployJava1.dll FF - plugin: e:\program files\musicnotes\npmusicn.dll FF - plugin: e:\program files\musicnotes\NPSibelius.dll FF - plugin: e:\program files\virtual earth 3d\npVE3D.dll FF - plugin: e:\programdata\real\realplayer\browserrecordplugin\mozillaplugins\nprphtml5videoshim.dll FF - plugin: e:\users\bart\appdata\local\google\update\1.3.21.111\npGoogleUpdate3.dll . —- FIREFOX POLICIES —- FF - user.js: network.http.max-connections-per-server - 8 FF - user.js: network.http.max-persistent-connections-per-server - 4 FF - user.js: content.max.tokenizing.time - 1800000 FF - user.js: content.notify.interval - 600000 FF - user.js: nglayout.initialpaint.delay - 600 FF - user.js: content.switch.threshold - 600000 . ============= SERVICES / DRIVERS =============== . R0 Lbd;Lbd;e:\windows\system32\drivers\Lbd.sys [2010-9-20 64288] R3 NxDrv;SonicWALL NetExtender Adapter;e:\windows\system32\drivers\NxDrv.sys [2011-7-28 21888] S1 avkmgr;avkmgr;e:\windows\system32\drivers\avkmgr.sys [2012-2-26 36000] S2 AntiVirSchedulerService;Avira Scheduler;e:\program files\avira\antivir desktop\sched.exe [2012-2-26 86224] S2 AntiVirService;Avira Realtime Protection;e:\program files\avira\antivir desktop\avguard.exe [2012-2-26 110032] S2 avgntflt;avgntflt;e:\windows\system32\drivers\avgntflt.sys [2012-2-26 83392] S2 CFUACProxy_hddv2nusb3;CFUACProxy_hddv2nusb3;e:\programdata\clickfree\hddv2nusb3\UACProxy.exe [2012-2-27 83792] S2 gupdate;Google Update Service (gupdate);e:\program files\google\update\GoogleUpdate.exe [2009-12-18 135664] S2 MBAMService;MBAMService;e:\program files\malwarebytes' anti-malware\mbamservice.exe [2012-6-23 654408] S2 nvUpdatusService;NVIDIA Update Service Daemon;e:\program files\nvidia corporation\nvidia updatus\daemonu.exe [2012-2-26 2214504] S2 SacNetAgentService_C57C4F854F53;SacNetAgentService_C57C4F854F53;e:\programdata\clickfree\hddv2nusb3\reminder\SacNetAgent.exe [2012-2-27 163664] S2 TuneUp.UtilitiesSvc;TuneUp Utilities Service;e:\program files\tuneup utilities 2012\TuneUpUtilitiesService32.exe [2011-10-20 1479488] S3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0;e:\windows\system32\drivers\b57nd60x.sys [2009-7-13 229888] S3 bepldr;BCL easyPDF SDK 5 Loader;e:\program files\common files\bcl technologies\nitropdf5\bepldr.exe [2007-11-15 151552] S3 gupdatem;Google Update Service (gupdatem);e:\program files\google\update\GoogleUpdate.exe [2009-12-18 135664] S3 MBAMProtector;MBAMProtector;e:\windows\system32\drivers\mbam.sys [2012-6-23 22344] S3 MozillaMaintenance;Mozilla Maintenance Service;e:\program files\mozilla maintenance service\maintenanceservice.exe [2012-6-7 113120] S3 NtiEnc;NtiEnc;e:\windows\system32\drivers\NtiEnc.sys [2009-9-7 127456] S3 NVHDA;Service for NVIDIA High Definition Audio Driver;e:\windows\system32\drivers\nvhda32v.sys [2010-3-16 66592] S3 SwitchBoard;Adobe SwitchBoard;e:\program files\common files\adobe\switchboard\SwitchBoard.exe [2010-2-19 517096] S3 TsUsbFlt;TsUsbFlt;e:\windows\system32\drivers\TsUsbFlt.sys [2012-2-26 52224] S3 TuneUpUtilitiesDrv;TuneUpUtilitiesDrv;e:\program files\tuneup utilities 2012\TuneUpUtilitiesDriver32.sys [2011-10-20 10064] . =============== Created Last 30 ================ . 2012-06-23 07:37:12 22344 —-a-w- e:\windows\system32\drivers\mbam.sys 2012-06-23 07:37:12 ——– d—–w- e:\program files\Malwarebytes' Anti-Malware 2012-06-23 05:14:52 344824 —-a-w- e:\programdata\HDFDEdWnhRJWy.exe 2012-06-21 01:47:26 2422272 —-a-w- e:\windows\system32\wucltux.dll 2012-06-21 01:47:22 88576 —-a-w- e:\windows\system32\wudriver.dll 2012-06-21 01:47:16 33792 —-a-w- e:\windows\system32\wuapp.exe 2012-06-21 01:47:16 171904 —-a-w- e:\windows\system32\wuwebv.dll 2012-06-16 19:03:55 770384 —-a-w- e:\program files\mozilla firefox\msvcr100.dll 2012-06-16 19:03:55 421200 —-a-w- e:\program files\mozilla firefox\msvcp100.dll 2012-06-15 17:20:09 ——– d—–w- e:\users\bart\appdata\local\Diagnostics . ==================== Find3M ==================== . 2012-05-09 01:07:10 83392 —-a-w- e:\windows\system32\drivers\avgntflt.sys . ============= FINISH: 17:58:10.04 =============== AND HERE'S THE aswMBR log: aswMBR version 0.9.9.1665 Copyright© 2011 AVAST Software Run date: 2012-06-24 18:03:37 —————————– 18:03:37.921 OS Version: Windows 6.1.7601 Service Pack 1 18:03:37.921 Number of processors: 2 586 0x4302 18:03:37.921 ComputerName: SUSAN-TESS-PC UserName: Bart 18:03:38.218 Initialize success 18:06:50.781 AVAST engine defs: 12062401 18:07:11.578 Disk 0 \Device\Harddisk0\DR0 -> \Device\0000005f 18:07:11.578 Disk 0 Vendor: WDC_WD25 10.0 Size: 238475MB BusType: 3 18:07:11.578 Disk 1 (boot) \Device\Harddisk1\DR1 -> \Device\00000060 18:07:11.593 Disk 1 Vendor: WDC_WD50 05.0 Size: 476940MB BusType: 3 18:07:11.593 Disk 1 MBR read successfully 18:07:11.609 Disk 1 MBR scan 18:07:11.609 Disk 1 Windows 7 default MBR code 18:07:11.609 Disk 1 Partition 1 80 (A) 07 HPFS/NTFS NTFS 131061 MB offset 63 18:07:11.625 Disk 1 Partition 2 00 07 HPFS/NTFS NTFS 345875 MB offset 268414020 18:07:11.640 Disk 1 scanning sectors +976768065 18:07:11.718 Disk 1 scanning E:\Windows\system32\drivers 18:07:19.468 Service scanning 18:07:35.859 Modules scanning 18:07:38.484 Disk 1 trace - called modules: 18:07:38.500 ntkrnlpa.exe CLASSPNP.SYS disk.sys ACPI.sys halmacpi.dll storport.sys nvstor32.sys 18:07:38.515 1 nt!IofCallDriver -> \Device\Harddisk1\DR1[0x859e7030] 18:07:38.515 3 CLASSPNP.SYS[8a59059e] -> nt!IofCallDriver -> [0x857eff08] 18:07:38.531 5 ACPI.sys[89fb83d4] -> nt!IofCallDriver -> \Device\00000060[0x857eea58] 18:07:39.109 AVAST engine scan E:\Windows 18:07:41.281 AVAST engine scan E:\Windows\system32 18:09:37.296 AVAST engine scan E:\Windows\system32\drivers 18:09:46.359 AVAST engine scan E:\Users\Bart 18:10:06.875 Disk 1 MBR has been saved successfully to "E:\Users\Bart\Desktop\MBR.dat" 18:10:06.875 The log file has been saved successfully to "E:\Users\Bart\Desktop\aswMBR.txt" —————————————————————————————————————————————- THE "ATTACH.ZIP" FILE IS ATTACHED. Hope this is good. Thanks, Bart

Attachments:

📎Attach.zip

Satchfan

Post #7June 25, 2012, 9:42 AM UTC

Hi Bart

Some positives from those logs but we'll need to run some more scans.

P2P - I see you have P2P software, (Azureus, Vuze), installed on your machine. We are not here to pass judgment on file-sharing as a concept. However, we will warn you that engaging in this activity and having this kind of software installed on your machine will always make you more susceptible to re-infection. If your computer is infected, it almost certainly contributed to your current situation.

Please note: Even if you are using a "safe" P2P program, it is only the program that is safe. You will be sharing files from uncertified sources, and these are more often than not, infected. The bad guys use P2P file-sharing as a major conduit to spread their wares.

Please see this topic for more information:

Perils of P2P File Sharing.

I would strongly recommend that you uninstall it now. You can do so via Control Panel, Programs, and then Programs and Features.

Should you decide to keep it, please don’t use it until we have finished up here.

===================================================

Run RogueKiller

IMPORTANT: Do not reboot your computer if at all possible otherwise the malware will reactivate and you will have to run RogueKiller again
download RogueKiller by tigzy and save it to your desktop
close all programs
double-click RogueKiller.exe
after it has completed it's prescan click Shortcut Fix
when the scan is complete click report
Please post the log.

===================================================

Submit a file to VirusTotal

Go to VirusTotal and submit this file for analysis:

e:\programdata\HDFDEdWnhRJWy.exe
click on Browse
click on the arrow and choose e:
below, double-click on programdata
locate the file HDFDEdWnhRJWy.exe[ click on it and then on Open
click on Send File.
You will get a report back, post the report into this thread for me to see.

Please can you tell me the situation with your start menu, shortcut items and desktop.

Satchfan

bart10

Post #8June 25, 2012, 3:50 PM UTC

Satchfan,

I ran RogueKIller, which seemed to work restoring (it connected with the internet, for example). I didn't check the start menu, though before I ran HDFDEdWnhRJWy.exe. That part was disasterous. Once clicked, the malware started up again. Now there's a message: System Error: Hard Disk Failure Detected. Windows has lost access to the system partition during i/o process… etc. Suggesting I run an HDD scan, with options below to do so.

I have left things as they are without clicking anything else. (Note: Between the past few proceedures, I had booted off until I heard from you, then restarted in safe mode to follow your assignments. Should I just leave the computer on?)

Because of the recurrance of the malware, there is no log for HDFDEdWnhRJWy.exe. Here is the report from RogueKiller:

RogueKiller V7.5.4 [06/07/2012] by Tigzy
mail: tigzyRKgmailcom
Feedback: http://www.geekstogo.com/forum/files/file/413-roguekiller/
Blog: http://tigzyrk.blogspot.com

Operating System: Windows 7 (6.1.7601 Service Pack 1) 32 bits version
Started in : Safe mode with network support
User: Bart [Admin rights]
Mode: Shortcuts HJfix – Date: 06/25/2012 08:32:09

¤¤¤ Bad processes: 0 ¤¤¤

¤¤¤ Driver: [NOT LOADED] ¤¤¤

¤¤¤ File attributes restored: ¤¤¤
Desktop: Success 0 / Fail 0
Quick launch: Success 0 / Fail 0
Programs: Success 5 / Fail 0
Start menu: Success 0 / Fail 0
User folder: Success 6171 / Fail 0
My documents: Success 171 / Fail 0
My favorites: Success 0 / Fail 0
My pictures: Success 0 / Fail 0
My music: Success 0 / Fail 0
My videos: Success 0 / Fail 0
Local drives: Success 104 / Fail 0
Backup: [FOUND] Success 0 / Fail 413

Drives:
[A:] \Device\Floppy0 – 0x2 –> Skipped
[C:] \Device\HarddiskVolume3 – 0x3 –> Restored
[D:] \Device\HarddiskVolume1 – 0x3 –> Restored
[E:] \Device\HarddiskVolume2 – 0x3 –> Restored
[F:] \Device\CdRom0 – 0x5 –> Skipped
[G:] \Device\CdRom1 – 0x5 –> Skipped
[H:] \Device\HarddiskVolume4 – 0x2 –> Restored

¤¤¤ Infection : Rogue.FakeHDD ¤¤¤

Finished : << RKreport[4].txt >>
RKreport[1].txt ; RKreport[2].txt ; RKreport[3].txt ; RKreport[4].txt

bart10

Post #9June 25, 2012, 3:57 PM UTC

Oh, and I should mention that, before, when I started in safe mode, in the start menu the program list would appear when I clicked all programs. To the right, however, only the name icon appeared along with the favorites link– no control panel, computer, printers, etc.

Satchfan

Post #10June 25, 2012, 4:41 PM UTC

You were not supposed to “open” it – my instructions were to upload it for inspection.

We’ll have to begin again but at least we know whay we are dealing with.

Run OTL

double click on the icon to run it.

copy/paste ALL the following text written inside the code box into the Custom Scans/Fixes box located at the bottom of OTL

:Services :OTL O4 - HKCU..\Run: [HDFDEdWnhRJWy.exe] E:\ProgramData\HDFDEdWnhRJWy.exe () :Commands [purity] [Reboot]

click the Run Fix button at the top
let the program run unhindered, reboot when it is done
post a new OTL log (don't check the boxes beside LOP Check or Purity this time)

=================================================

Run Malwarebytes’ Anti-Malware

I noticed that you had MBAM on your system: if you no longer have it, you can download it from here:

start Malwarebytes-Anti-Malware and update it, (“Update” tab}
once it is updated, click on “Scanner” tab, select Perform quick scan, then click Scan.
when the scan is complete, click OK, then Show Results to view the results.
be sure that everything is checked, and click Remove Selected.
when removal is completed, a log report will open in Notepad and you may be prompted to restart your computer. (see Note below)
the log is automatically saved and can be viewed by clicking the Logs tab in MBAM.
copy and paste the contents of that report in your next reply and exit MBAM.

NOTE: If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts. Click OK to either and let MBAM proceed with the disinfection process. If asked to restart the computer, please do so immediately. Failure to reboot will prevent MBAM from removing all the malware.

Logs to include with the next post:

OTL fix log
New OTL log
Mbam.txt

Can you tell me the current situation regarding the start menu and shortcuts.

Satchfan

bart10

Post #11June 25, 2012, 5:30 PM UTC

Wow! Things look good. Everything seems to be operating normally.

Here is the otl report:
RogueKiller V7.5.4 [06/07/2012] by Tigzy
mail: tigzyRKgmailcom
Feedback: http://www.geekstogo.com/forum/files/file/413-roguekiller/
Blog: http://tigzyrk.blogspot.com

Operating System: Windows 7 (6.1.7601 Service Pack 1) 32 bits version
Started in : Safe mode with network support
User: Bart [Admin rights]
Mode: Scan – Date: 06/23/2012 12:13:47

¤¤¤ Bad processes: 0 ¤¤¤

¤¤¤ Registry Entries: 25 ¤¤¤
[SUSP PATH] HKCU\[…]\Run : SacReminderHDDV2N (E:\ProgramData\Clickfree\HDDV2NUSB3\reminder\SacReminder.exe) -> FOUND
[SUSP PATH] HKCU\[…]\Run : HDFDEdWnhRJWy.exe (E:\ProgramData\HDFDEdWnhRJWy.exe) -> FOUND
[SUSP PATH] HKUS\S-1-5-21-686366199-2891090769-364564458-1000[…]\Run : SacReminderHDDV2N (E:\ProgramData\Clickfree\HDDV2NUSB3\reminder\SacReminder.exe) -> FOUND
[SUSP PATH] HKUS\S-1-5-21-686366199-2891090769-364564458-1000[…]\Run : HDFDEdWnhRJWy.exe (E:\ProgramData\HDFDEdWnhRJWy.exe) -> FOUND
[DNS] HKLM\[…]\ControlSet001\Parameters\Interfaces\{38E89F6D-09B9-427F-A0CF-B2B2547BEF34} : NameServer (10.30.0.30 10.30.0.14) -> FOUND
[DNS] HKLM\[…]\ControlSet002\Parameters\Interfaces\{38E89F6D-09B9-427F-A0CF-B2B2547BEF34} : NameServer (10.30.0.30 10.30.0.14) -> FOUND
[DNS] HKLM\[…]\ControlSet003\Parameters\Interfaces\{38E89F6D-09B9-427F-A0CF-B2B2547BEF34} : NameServer (10.30.0.30 10.30.0.14) -> FOUND
[WallPP] HKCU\[…]\Desktop : Wallpaper () -> FOUND
[HJ] HKCU\[…]\Advanced : Start_ShowMyComputer (0) -> FOUND
[HJ] HKCU\[…]\Advanced : Start_ShowSearch (0) -> FOUND
[HJ] HKCU\[…]\Advanced : Start_ShowMyDocs (0) -> FOUND
[HJ] HKCU\[…]\Advanced : Start_ShowRecentDocs (0) -> FOUND
[HJ] HKCU\[…]\Advanced : Start_ShowUser (0) -> FOUND
[HJ] HKCU\[…]\Advanced : Start_ShowMyPics (0) -> FOUND
[HJ] HKCU\[…]\Advanced : Start_ShowMyGames (0) -> FOUND
[HJ] HKCU\[…]\Advanced : Start_ShowMyMusic (0) -> FOUND
[HJ] HKCU\[…]\Advanced : Start_ShowControlPanel (0) -> FOUND
[HJ] HKCU\[…]\Advanced : Start_ShowHelp (0) -> FOUND
[HJ] HKCU\[…]\Advanced : Start_ShowPrinters (0) -> FOUND
[HJ] HKCU\[…]\Advanced : Start_ShowRun (0) -> FOUND
[HJ] HKCU\[…]\Advanced : Start_ShowSetProgramAccessAndDefaults (0) -> FOUND
[HJ] HKCU\[…]\Advanced : Start_TrackProgs (0) -> FOUND
[HJ] HKCU\[…]\ClassicStartMenu : {59031a47-3f72-44a7-89c5-5595fe6b30ee} (1) -> FOUND
[HJ] HKCU\[…]\ClassicStartMenu : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> FOUND
[HJ] HKCU\[…]\ClassicStartMenu : {645FF040-5081-101B-9F08-00AA002F954E} (1) -> FOUND

¤¤¤ Particular Files / Folders: ¤¤¤

¤¤¤ Driver: [NOT LOADED] ¤¤¤

¤¤¤ Infection : ¤¤¤

¤¤¤ HOSTS File: ¤¤¤
127.0.0.1 activate.adobe.com
127.0.0.1 practivate.adobe.com
127.0.0.1 ereg.adobe.com
127.0.0.1 activate.wip3.adobe.com
127.0.0.1 wip3.adobe.com
127.0.0.1 3dns-3.adobe.com
127.0.0.1 3dns-2.adobe.com
127.0.0.1 adobe-dns.adobe.com
127.0.0.1 adobe-dns-2.adobe.com
127.0.0.1 adobe-dns-3.adobe.com
127.0.0.1 ereg.wip3.adobe.com
127.0.0.1 activate-sea.adobe.com
127.0.0.1 wwis-dubc1-vip60.adobe.com
127.0.0.1 activate-sjc0.adobe.com
127.0.0.1 adobe.activate.com
127.0.0.1 adobeereg.com
127.0.0.1 www.adobeereg.com
127.0.0.1 wwis-dubc1-vip60.adobe.com
127.0.0.1 125.252.224.90
127.0.0.1 125.252.224.91
[…]

¤¤¤ MBR Check: ¤¤¤

+++++ PhysicalDrive0: WDC WD25 00JS-98NCB1 SCSI Disk Device +++++
— User —
[MBR] bf9b05f86bdc7bfbb239897b040e03f7
[BSP] 255ef259b67e73d0e9092b23587ef709 : Windows XP MBR Code
Partition table:
0 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 2048 | Size: 238473 Mo
User = LL1 … OK!
Error reading LL2 MBR!

+++++ PhysicalDrive1: WDC WD50 00AAKS-00V1A SCSI Disk Device +++++
— User —
[MBR] b2c91730bfdcedb0eb6fa667f274ad6b
[BSP] 66a4327ddba51212472989f6d36311bb : Windows 7 MBR Code
Partition table:
0 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 63 | Size: 131061 Mo
1 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 268414020 | Size: 345875 Mo
User = LL1 … OK!
Error reading LL2 MBR!

Finished : << RKreport[3].txt >>
RKreport[1].txt ; RKreport[2].txt ; RKreport[3].txt

—————————————————————-
And the MalwareByte report:

Malwarebytes Anti-Malware (PRO) 1.61.0.1400
www.malwarebytes.org

Database version: v2012.06.25.08

Windows 7 Service Pack 1 x86 NTFS
Internet Explorer 8.0.7601.17514
Bart :: SUSAN-TESS-PC [administrator]

Protection: Enabled

6/25/2012 10:12:17 AM
mbam-log-2012-06-25 (10-12-17).txt

Scan type: Quick scan
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
Scan options disabled: P2P
Objects scanned: 225722
Time elapsed: 5 minute(s), 43 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 0
(No malicious items detected)

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 0
(No malicious items detected)

Files Detected: 0
(No malicious items detected)

(end)

I couldn't find any other OTL report.

AMI FIXED??!!

I have to run to an important meeting but will be back in 2 hours, at which time I'll follow your next instructions (and thank you properly)

–Bart

bart10

Post #12June 25, 2012, 5:32 PM UTC

OOPS! Looks like that was an RK report.
Here's the OTL:
OTL logfile created on: 6/23/2012 1:19:02 PM - Run 3
OTL by OldTimer - Version 3.2.52.0 Folder = D:\Documents
Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7601.17514)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

2.75 Gb Total Physical Memory | 2.34 Gb Available Physical Memory | 85.29% Memory free
5.50 Gb Paging File | 5.10 Gb Available in Paging File | 92.86% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = E: | %SystemRoot% = E:\Windows | %ProgramFiles% = E:\Program Files
Drive C: | 337.77 Gb Total Space | 266.74 Gb Free Space | 78.97% Space Free | Partition Type: NTFS
Drive D: | 232.88 Gb Total Space | 28.51 Gb Free Space | 12.24% Space Free | Partition Type: NTFS
Drive E: | 127.99 Gb Total Space | 49.69 Gb Free Space | 38.82% Space Free | Partition Type: NTFS
Drive F: | 626.31 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: UDF
Drive H: | 1.87 Gb Total Space | 1.87 Gb Free Space | 99.99% Space Free | Partition Type: FAT32

Computer Name: SUSAN-TESS-PC | User Name: Bart | Logged in as Administrator.
Boot Mode: SafeMode with Networking | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 7 Days

========== Processes (SafeList) ==========

PRC - D:\Documents\OTL.exe (OldTimer Tools)
PRC - E:\Windows\explorer.exe (Microsoft Corporation)

========== Modules (No Company Name) ==========

MOD - E:\Program Files\WinRAR\RarExt.dll ()
MOD - E:\Program Files\Nitro PDF\Professional\N5ShellExtension.dll ()

========== Win32 Services (SafeList) ==========

SRV - (AcrSch2Svc) – E:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe File not found
SRV - (MozillaMaintenance) – E:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe (Mozilla Foundation)
SRV - (AntiVirService) – E:\Program Files\Avira\AntiVir Desktop\avguard.exe (Avira Operations GmbH & Co. KG)
SRV - (AntiVirSchedulerService) – E:\Program Files\Avira\AntiVir Desktop\sched.exe (Avira Operations GmbH & Co. KG)
SRV - (MBAMService) – E:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation)
SRV - (TuneUp.UtilitiesSvc) – E:\Program Files\TuneUp Utilities 2012\TuneUpUtilitiesService32.exe (TuneUp Software)
SRV - (SONICWALL_NetExtender) – E:\Program Files\SonicWALL\SSL-VPN\NetExtender\NEService.exe (SonicWALL Inc.)
SRV - (nvUpdatusService) – E:\Program Files\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe (NVIDIA Corporation)
SRV - (CFUACProxy_hddv2nusb3) – E:\ProgramData\Clickfree\HDDV2NUSB3\UACProxy.exe (Storage Appliance Corp.)
SRV - (SacNetAgentService_C57C4F854F53) – E:\ProgramData\Clickfree\HDDV2NUSB3\Reminder\SacNetAgent.exe (Storage Appliance Corporation)
SRV - (LBTServ) – E:\Program Files\Common Files\LogiShrd\Bluetooth\LBTServ.exe (Logitech, Inc.)
SRV - (SwitchBoard) – E:\Program Files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe (Adobe Systems Incorporated)
SRV - (TuneUp.ProgramStatisticsSvc) – E:\Windows\System32\TUProgSt.exe (TuneUp Software)
SRV - (TuneUp.Defrag) – E:\Windows\System32\TuneUpDefragService.exe (TuneUp Software)
SRV - (FLEXnet Licensing Service) – E:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe (Acresso Software Inc.)
SRV - (getPlusHelper) getPlus® – E:\Program Files\NOS\bin\getPlus_Helper.dll (NOS Microsystems Ltd.)
SRV - (SensrSvc) – E:\Windows\System32\sensrsvc.dll (Microsoft Corporation)
SRV - (WinDefend) – E:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)
SRV - (bepldr) – E:\Program Files\Common Files\BCL Technologies\NitroPDF5\bepldr.exe ()

========== Driver Services (SafeList) ==========

DRV - (avipbb) – E:\Windows\System32\drivers\avipbb.sys (Avira GmbH)
DRV - (avgntflt) – E:\Windows\System32\drivers\avgntflt.sys (Avira GmbH)
DRV - (MBAMProtector) – E:\Windows\System32\drivers\mbam.sys (Malwarebytes Corporation)
DRV - (TuneUpUtilitiesDrv) – E:\Program Files\TuneUp Utilities 2012\TuneUpUtilitiesDriver32.sys (TuneUp Software)
DRV - (avkmgr) – E:\Windows\System32\drivers\avkmgr.sys (Avira GmbH)
DRV - (NxDrv) – E:\Windows\System32\drivers\NxDrv.sys (SonicWALL Inc.)
DRV - (nvlddmkm) – E:\Windows\System32\drivers\nvlddmkm.sys (NVIDIA Corporation)
DRV - (TsUsbFlt) – E:\Windows\System32\drivers\TsUsbFlt.sys (Microsoft Corporation)
DRV - (Lbd) – E:\Windows\System32\drivers\Lbd.sys (Lavasoft AB)
DRV - (LMouFilt) – E:\Windows\System32\drivers\LMouFilt.Sys (Logitech, Inc.)
DRV - (LHidFilt) – E:\Windows\System32\drivers\LHidFilt.Sys (Logitech, Inc.)
DRV - (ssmdrv) – E:\Windows\System32\drivers\ssmdrv.sys (Avira GmbH)
DRV - (NtiEnc) – E:\Windows\System32\drivers\NtiEnc.sys (NewTech Infosystems)
DRV - (NVHDA) – E:\Windows\System32\drivers\nvhda32v.sys (NVIDIA Corporation)
DRV - (NVENETFD) – E:\Windows\System32\drivers\nvm62x32.sys (NVIDIA Corporation)
DRV - (ALCXWDM) Service for Realtek AC97 Audio (WDM) – E:\Windows\System32\drivers\RTKVAC.SYS (Realtek Semiconductor Corp.)
DRV - (nvstor32) – E:\Windows\System32\drivers\nvstor32.sys (NVIDIA Corporation)
DRV - (AsIO) – E:\Windows\System32\drivers\AsIO.sys ()
DRV - (MTsensor) – E:\Windows\System32\drivers\ASACPI.sys ()
DRV - (SCDEmu) – E:\Windows\System32\drivers\scdemu.sys (PowerISO Computing, Inc.)
DRV - (pfc) – E:\Windows\System32\drivers\pfc.sys (Padus, Inc.)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
IE - HKLM\..\SearchScopes,DefaultScope = {6A1806CD-94D4-4689-BA73-E35EA1EA9990}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://search.live.com/results.aspx?q={sea…ferrer:source?}
IE - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://www.google.com/search?q={searchTerm…mp;sourceid=ie7

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = http://g.msn.com/0SEENUS/SAOS01?FORM=TOOLBR
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://g.msn.com/0SEENUS/SAOS01?FORM=TOOLBR
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.msn.com/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 2
IE - HKCU\..\SearchScopes,DefaultScope = {6A1806CD-94D4-4689-BA73-E35EA1EA9990}
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}…amp;FORM=IE8SRC
IE - HKCU\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://www.google.com/search?q={searchTerm…1I7GPEA_enUS310
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = ;*.local

========== FireFox ==========

FF - prefs.js..browser.search.selectedEngine: "Yahoo"
FF - user.js - File not found

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: E:\Windows\system32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: E:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: E:\Program Files\DivX\DivX Web Player\npdivx32.dll (DivX,Inc.)
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Player Plugin,version=1.0.0: E:\Program Files\DivX\DivX Player\npDivxPlayerPlugin.dll (DivX, Inc)
FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: E:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: E:\Program Files\Microsoft Silverlight\4.1.10111.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/VirtualEarth3D,version=2.5: E:\Program Files\Virtual Earth 3D\ [2012/02/26 15:39:04 | 000,000,000 | —D | M]
FF - HKLM\Software\MozillaPlugins\@microsoft.com/VirtualEarth3D,version=3.0: E:\Program Files\Virtual Earth 3D\ [2012/02/26 15:39:04 | 000,000,000 | —D | M]
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: E:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@Musicnotes.com/Musicnotes Viewer,version=1.18.1: E:\Program Files\Musicnotes\npmusicn.dll (Musicnotes, Inc.)
FF - HKLM\Software\MozillaPlugins\@pack.google.com/Google Updater;version=14: E:\Program Files\Google\Google Updater\2.4.2432.1652\npCIDetect14.dll (Google)
FF - HKLM\Software\MozillaPlugins\@real.com/nppl3260;version=6.0.12.775: E:\Program Files\Real\RealPlayer\Netscape6\nppl3260.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprjplug;version=1.0.3.775: E:\Program Files\Real\RealPlayer\Netscape6\nprjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprphtml5videoshim;version=1.0.0.0: E:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprpjplug;version=6.0.12.775: E:\Program Files\Real\RealPlayer\Netscape6\nprpjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nsJSRealPlayerPlugin;version=: File not found
FF - HKLM\Software\MozillaPlugins\@Sibelius.com/Scorch Plugin,version=6.1.5.22: E:\Program Files\Musicnotes\npsibelius.dll ()
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: E:\Program Files\Google\Update\1.3.21.111\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: E:\Program Files\Google\Update\1.3.21.111\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: E:\Users\Bart\AppData\Local\Google\Update\1.3.21.111\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: E:\Users\Bart\AppData\Local\Google\Update\1.3.21.111\npGoogleUpdate3.dll (Google Inc.)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{ABDE892B-13A8-4d1b-88E6-365A6E755758}: E:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext [2012/02/26 15:41:48 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 13.0.1\extensions\\Components: E:\Program Files\Mozilla Firefox\components [2012/06/16 12:03:56 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 13.0.1\extensions\\Plugins: E:\Program Files\Mozilla Firefox\plugins [2012/06/07 18:13:21 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Netscape Browser 8.1.2.0\Extensions\\Components: E:\Program Files\Netscape\Netscape Browser\Components [2012/02/26 15:35:47 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Netscape Browser 8.1.2.0\Extensions\\Plugins: E:\Program Files\Netscape\Netscape Browser\Plugins [2012/02/26 15:35:49 | 000,000,000 | —D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 13.0.1\extensions\\Components: E:\Program Files\Mozilla Firefox\components [2012/06/16 12:03:56 | 000,000,000 | —D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 13.0.1\extensions\\Plugins: E:\Program Files\Mozilla Firefox\plugins [2012/06/07 18:13:21 | 000,000,000 | —D | M]

[2012/02/26 16:02:11 | 000,000,000 | —D | M] (No name found) – E:\Users\Bart\AppData\Roaming\Mozilla\Extensions
[2012/06/21 17:30:37 | 000,000,000 | —D | M] (No name found) – E:\Users\Bart\AppData\Roaming\Mozilla\Firefox\Profiles\zbq9fgvp.default\extensions
[2012/02/27 14:11:00 | 000,000,000 | —D | M] (Adblock Plus) – E:\Users\Bart\AppData\Roaming\Mozilla\Firefox\Profiles\zbq9fgvp.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}
[2012/02/26 16:02:13 | 000,000,000 | —D | M] (Adobe DLM (powered by getPlus®)) – E:\Users\Bart\AppData\Roaming\Mozilla\Firefox\Profiles\zbq9fgvp.default\extensions\{E2883E8F-472F-4fb0-9522-AC9BF37916A7}
[2012/06/07 18:13:27 | 000,000,000 | —D | M] (No name found) – E:\Program Files\Mozilla Firefox\extensions
File not found (No name found) – E:\PROGRAM FILES\FLOCK\FLOCK\EXTENSIONS\[removed]
File not found (No name found) – E:\PROGRAM FILES\FLOCK\FLOCK\EXTENSIONS\[removed]
[2012/06/16 12:03:56 | 000,085,472 | —- | M] (Mozilla Foundation) – E:\Program Files\mozilla firefox\components\browsercomps.dll
[2010/04/12 17:29:19 | 000,411,368 | —- | M] (Sun Microsystems, Inc.) – E:\Program Files\mozilla firefox\plugins\npdeployJava1.dll
[2012/06/16 12:03:54 | 000,002,252 | —- | M] () – E:\Program Files\mozilla firefox\searchplugins\bing.xml
[2012/06/16 12:03:54 | 000,002,040 | —- | M] () – E:\Program Files\mozilla firefox\searchplugins\twitter.xml

========== Chrome ==========

CHR - default_search_provider: Google (Enabled)
CHR - default_search_provider: search_url = {google:baseURL}search?{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}{googl
e:searchFieldtrialParameter}{google:instantFieldTrialGroupParameter}sourceid=chro
me&ie;={inputEncoding}&q;={searchTerms}
CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}{google:instantFieldTrialGroupParameter}client
=chrome&hl;={language}&q;={searchTerms}
CHR - plugin: Shockwave Flash (Disabled) = E:\Users\Bart\AppData\Local\Google\Chrome\User Data\PepperFlash\11.1.31.203\pepflashplayer.dll
CHR - plugin: Shockwave Flash (Enabled) = E:\Users\Bart\AppData\Local\Google\Chrome\Application\17.0.963.56\gcswf32.dll
CHR - plugin: Shockwave Flash (Enabled) = E:\Windows\system32\Macromed\Flash\NPSWF32.dll
CHR - plugin: Remoting Viewer (Enabled) = internal-remoting-viewer
CHR - plugin: Native Client (Enabled) = E:\Users\Bart\AppData\Local\Google\Chrome\Application\17.0.963.56\ppGoogleNaClPluginChrome.dll
CHR - plugin: Chrome PDF Viewer (Enabled) = E:\Users\Bart\AppData\Local\Google\Chrome\Application\17.0.963.56\pdf.dll
CHR - plugin: Adobe Acrobat (Disabled) = E:\Program Files\Adobe\Reader 8.0\Reader\Browser\nppdf32.dll
CHR - plugin: Java™ Platform SE 6 U20 (Enabled) = E:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll
CHR - plugin: Java Deployment Toolkit 6.0.200.2 (Enabled) = E:\Program Files\Mozilla Firefox\plugins\npdeployJava1.dll
CHR - plugin: Microsoft\u00AE Windows Media Player Firefox Plugin (Enabled) = E:\Program Files\Mozilla Firefox\plugins\np-mswmp.dll
CHR - plugin: DivX Web Player (Enabled) = E:\Program Files\Mozilla Firefox\plugins\npdivx32.dll
CHR - plugin: DivX Player Netscape Plugin (Enabled) = E:\Program Files\Mozilla Firefox\plugins\npDivxPlayerPlugin.dll
CHR - plugin: 2007 Microsoft Office system (Enabled) = E:\Program Files\Mozilla Firefox\plugins\NPOFF12.DLL
CHR - plugin: RealPlayer™ G2 LiveConnect-Enabled Plug-In (32-bit) (Enabled) = E:\Program Files\Mozilla Firefox\plugins\nppl3260.dll
CHR - plugin: RealPlayer Version Plugin (Enabled) = E:\Program Files\Mozilla Firefox\plugins\nprpjplug.dll
CHR - plugin: RealPlayer™ HTML5VideoShim Plug-In (32-bit) (Enabled) = E:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = E:\Program Files\Mozilla Firefox\plugins\npqtplugin.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = E:\Program Files\Mozilla Firefox\plugins\npqtplugin2.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = E:\Program Files\Mozilla Firefox\plugins\npqtplugin3.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = E:\Program Files\Mozilla Firefox\plugins\npqtplugin4.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = E:\Program Files\Mozilla Firefox\plugins\npqtplugin5.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = E:\Program Files\Mozilla Firefox\plugins\npqtplugin6.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = E:\Program Files\Mozilla Firefox\plugins\npqtplugin7.dll
CHR - plugin: RealJukebox NS Plugin (Enabled) = E:\Program Files\Mozilla Firefox\plugins\nprjplug.dll
CHR - plugin: Google Earth Plugin (Enabled) = E:\Program Files\Google\Google Earth\plugin\npgeplugin.dll
CHR - plugin: Google Updater (Enabled) = E:\Program Files\Google\Google Updater\2.4.2432.1652\npCIDetect14.dll
CHR - plugin: Google Update (Enabled) = E:\Program Files\Google\Update\1.3.21.99\npGoogleUpdate3.dll
CHR - plugin: Silverlight Plug-In (Enabled) = E:\Program Files\Microsoft Silverlight\3.0.50106.0\npctrl.dll
CHR - plugin: Musicnotes (Enabled) = E:\Program Files\Musicnotes\npmusicn.dll
CHR - plugin: ScorchPlugin (Enabled) = E:\Program Files\Musicnotes\npsibelius.dll
CHR - plugin: iTunes Application Detector (Enabled) = E:\Program Files\iTunes\Mozilla Plugins\npitunes.dll
CHR - plugin: Windows Presentation Foundation (Enabled) = E:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll
CHR - plugin: Default Plug-in (Enabled) = default_plugin
CHR - Extension: YouTube = E:\Users\Bart\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.2_0\
CHR - Extension: Google Search = E:\Users\Bart\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.17_0\
CHR - Extension: RealPlayer HTML5Video Downloader Extension = E:\Users\Bart\AppData\Local\Google\Chrome\User Data\Default\Extensions\jfmjfhklogoienhpfnppmbcbjfjnkonk\1.2\
CHR - Extension: Gmail = E:\Users\Bart\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\

O1 HOSTS File: ([2012/02/27 13:46:22 | 000,001,828 | —- | M]) - E:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 activate.adobe.com
O1 - Hosts: 127.0.0.1 practivate.adobe.com
O1 - Hosts: 127.0.0.1 ereg.adobe.com
O1 - Hosts: 127.0.0.1 activate.wip3.adobe.com
O1 - Hosts: 127.0.0.1 wip3.adobe.com
O1 - Hosts: 127.0.0.1 3dns-3.adobe.com
O1 - Hosts: 127.0.0.1 3dns-2.adobe.com
O1 - Hosts: 127.0.0.1 adobe-dns.adobe.com
O1 - Hosts: 127.0.0.1 adobe-dns-2.adobe.com
O1 - Hosts: 127.0.0.1 adobe-dns-3.adobe.com
O1 - Hosts: 127.0.0.1 ereg.wip3.adobe.com
O1 - Hosts: 127.0.0.1 activate-sea.adobe.com
O1 - Hosts: 127.0.0.1 wwis-dubc1-vip60.adobe.com
O1 - Hosts: 127.0.0.1 activate-sjc0.adobe.com
O1 - Hosts: 127.0.0.1 adobe.activate.com
O1 - Hosts: 127.0.0.1 adobeereg.com
O1 - Hosts: 127.0.0.1 www.adobeereg.com
O1 - Hosts: 127.0.0.1 wwis-dubc1-vip60.adobe.com
O1 - Hosts: 127.0.0.1 125.252.224.90
O1 - Hosts: 127.0.0.1 125.252.224.91
O1 - Hosts: 127.0.0.1 hl2rcv.adobe.com
O1 - Hosts: 127.0.0.1 secure.tune-up.com
O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - E:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (RealPlayer Download and Record Plugin for Internet Explorer) - {3049C3E9-B461-4BC5-8870-4C09146192CA} - E:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll (RealPlayer)
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - E:\Program Files\Google\GoogleToolbarNotifier\5.7.7227.1100\swg.dll (Google Inc.)
O4 - HKLM..\Run: [APSDaemon] E:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
O4 - HKLM..\Run: [avgnt] E:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)
O4 - HKLM..\Run: [EvtMgr6] E:\Program Files\Logitech\SetPointP\SetPoint.exe (Logitech, Inc.)
O4 - HKLM..\Run: [Kernel and Hardware Abstraction Layer] E:\Windows\KHALMNPR.Exe (Logitech Inc.)
O4 - HKLM..\Run: [Malwarebytes' Anti-Malware] E:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
O4 - HKLM..\Run: [SoundMan] E:\Windows\SOUNDMAN.EXE (Realtek Semiconductor Corp.)
O4 - HKCU..\Run: [EPSON01BECE] E:\Windows\System32\spool\DRIVERS\W32X86\3\E_FATIFRA.EXE (SEIKO EPSON CORPORATION)
O4 - HKCU..\Run: [HDFDEdWnhRJWy.exe] E:\ProgramData\HDFDEdWnhRJWy.exe ()
O4 - HKCU..\Run: [SacReminderHDDV2N] E:\ProgramData\Clickfree\HDDV2NUSB3\Reminder\SacReminder.exe (Storage Appliance Corp.)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - E:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O13 - gopher Prefix: missing
O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} http://upload.facebook.com/controls/2008.1…toUploader5.cab (Facebook Photo Uploader 5 Control)
O16 - DPF: {1239CC52-59EF-4DFA-8C61-90FFA846DF7E} http://www.musicnotes.com/download/mnviewer.cab (Musicnotes Viewer)
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} http://fpdownload.macromedia.com/get/shock…director/sw.cab (Shockwave ActiveX Control)
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} http://download.microsoft.com/download/9/b…heckControl.cab (Windows Genuine Advantage Validation Tool)
O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262E} http://www.nvidia.com/content/DriverDownlo…/sysreqlab3.cab (System Requirements Lab Class)
O16 - DPF: {4871A87A-BFDD-4106-8153-FFDE2BAC2967} http://dlm.tools.akamai.com/dlmanager/vers…vex-2.2.5.0.cab (DLM Control)
O16 - DPF: {67A5F8DC-1A4B-4D66-9F24-A704AD929EEE} http://www.nvidia.com/content/DriverDownlo…/sysreqlab2.cab (Reg Error: Key error.)
O16 - DPF: {6EEFD7B1-B26C-440D-B55A-1EC677189F30} https://portal.cee-school.org/NELX.cab (NELaunchCtrl Class)
O16 - DPF: {8100D56A-5661-482C-BEE8-AFECE305D968} http://upload.facebook.com/controls/2009.0…oUploader55.cab (Facebook Photo Uploader 5 Control)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.macromedia.com/get/flash…r/ultrashim.cab (Reg Error: Key error.)
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} http://cdn2.zone.msn.com/binFramework/v10/…ro.cab56649.cab (MSN Games - Installer)
O16 - DPF: {C9386579-3C0F-4713-82C6-5BA8088C7C8D} https://secure.shared.live.com/Pa6vGqB728Ax….RichUpload.cab (Windows Live SkyDrive Upload Tool)
O16 - DPF: {CAFEEFAC-0016-0000-0000-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0)
O16 - DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload.macromedia.com/get/shock…ash/swflash.cab (Shockwave Flash Object)
O16 - DPF: {E8F628B5-259A-4734-97EE-BA914D7BE941} http://driveragent.com/files/driveragent.cab (Driver Agent ActiveX Control)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.254
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{38E89F6D-09B9-427F-A0CF-B2B2547BEF34}: Domain = cee-school.org
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{38E89F6D-09B9-427F-A0CF-B2B2547BEF34}: NameServer = 10.30.0.30 10.30.0.14
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{80EF1ACB-D019-4D39-9C47-5957C89DD54C}: DhcpNameServer = 192.168.1.254
O20 - HKLM Winlogon: Shell - (Explorer.exe) - E:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (E:\Windows\system32\userinit.exe) - E:\Windows\System32\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - E:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O24 - Desktop WallPaper: E:\Users\Bart\AppData\Roaming\Microsoft\Windows Live Photo Gallery\Windows Live Photo Gallery Wallpaper.jpg
O24 - Desktop BackupWallPaper: E:\Users\Bart\AppData\Roaming\Microsoft\Windows Live Photo Gallery\Windows Live Photo Gallery Wallpaper.jpg
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009/06/10 14:42:20 | 000,000,024 | —- | M] () - E:\autoexec.bat – [ NTFS ]
O33 - MountPoints2\{690de4b5-60e2-11e1-9f61-0017315c338e}\Shell - "" = AutoRun
O33 - MountPoints2\{690de4b5-60e2-11e1-9f61-0017315c338e}\Shell\AutoRun\command - "" = H:\StartClickFreeBackup.exe
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)

NetSvcs: FastUserSwitchingCompatibility - File not found
NetSvcs: Ias - E:\Windows\System32\ias.dll (Microsoft Corporation)
NetSvcs: Nla - File not found
NetSvcs: Ntmssvc - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: SRService - File not found
NetSvcs: WmdmPmSp - File not found
NetSvcs: LogonHours - File not found
NetSvcs: PCAudit - File not found
NetSvcs: helpsvc - File not found
NetSvcs: uploadmgr - File not found

Drivers32: msacm.l3acm - E:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: vidc.cvid - E:\Windows\System32\iccvid.dll (Radius Inc.)
Drivers32: vidc.DIVX - E:\Windows\System32\DivX.dll (DivX, Inc.)
Drivers32: vidc.XVID - E:\Windows\System32\xvidvfw.dll ()
Drivers32: vidc.yv12 - E:\Windows\System32\DivX.dll (DivX, Inc.)

CREATERESTOREPOINT
Unable to start System Restore Service. Error code 1084

========== Files/Folders - Created Within 7 Days ==========

[2012/06/23 12:54:27 | 000,596,480 | —- | C] (OldTimer Tools) – D:\Documents\OTL.exe
[2012/06/23 01:47:03 | 000,000,000 | —D | C] – E:\Users\Bart\Desktop\RK_Quarantine
[2012/06/23 00:37:16 | 000,000,000 | —D | C] – E:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2012/06/23 00:37:12 | 000,022,344 | —- | C] (Malwarebytes Corporation) – E:\Windows\System32\drivers\mbam.sys
[2012/06/23 00:37:12 | 000,000,000 | —D | C] – E:\Program Files\Malwarebytes' Anti-Malware
[2012/06/20 18:47:26 | 002,422,272 | —- | C] (Microsoft Corporation) – E:\Windows\System32\wucltux.dll
[2012/06/20 18:47:26 | 000,045,080 | —- | C] (Microsoft Corporation) – E:\Windows\System32\wups2.dll
[2012/06/20 18:47:22 | 000,577,048 | —- | C] (Microsoft Corporation) – E:\Windows\System32\wuapi.dll
[2012/06/20 18:47:22 | 000,088,576 | —- | C] (Microsoft Corporation) – E:\Windows\System32\wudriver.dll
[2012/06/20 18:47:22 | 000,035,864 | —- | C] (Microsoft Corporation) – E:\Windows\System32\wups.dll
[2012/06/20 18:47:16 | 000,171,904 | —- | C] (Microsoft Corporation) – E:\Windows\System32\wuwebv.dll
[2012/06/20 18:47:16 | 000,033,792 | —- | C] (Microsoft Corporation) – E:\Windows\System32\wuapp.exe

========== Files - Modified Within 7 Days ==========

[2012/06/23 13:18:47 | 000,618,026 | —- | M] () – E:\Windows\System32\perfh009.dat
[2012/06/23 13:18:47 | 000,104,340 | —- | M] () – E:\Windows\System32\perfc009.dat
[2012/06/23 13:14:36 | 000,067,584 | –S- | M] () – E:\Windows\bootstat.dat
[2012/06/23 13:14:35 | 2213,314,560 | -HS- | M] () – E:\hiberfil.sys
[2012/06/23 13:13:04 | 000,000,882 | —- | M] () – E:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2012/06/23 02:28:06 | 000,000,904 | —- | M] () – E:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-686366199-2891090769-364564458-1000UA.job
[2012/06/23 02:28:06 | 000,000,886 | —- | M] () – E:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2012/06/23 02:26:29 | 000,009,824 | —- | M] () – E:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2012/06/23 02:26:29 | 000,009,824 | —- | M] () – E:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2012/06/23 01:32:16 | 000,596,480 | —- | M] (OldTimer Tools) – D:\Documents\OTL.exe
[2012/06/23 00:37:16 | 000,001,072 | —- | M] () – E:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2012/06/22 22:28:01 | 000,000,852 | —- | M] () – E:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-686366199-2891090769-364564458-1000Core.job
[2012/06/22 22:12:34 | 000,344,824 | —- | M] () – E:\ProgramData\HDFDEdWnhRJWy.exe
[2012/06/22 18:17:45 | 000,000,258 | RHS- | M] () – E:\ProgramData\ntuser.pol
[2012/06/18 11:59:00 | 000,000,868 | —- | M] () – E:\Windows\tasks\Google Software Updater.job

========== Files Created - No Company Name ==========

[2012/06/23 02:16:26 | 000,002,146 | —- | C] () – E:\ProgramData\Microsoft\Windows\Start Menu\Programs\TuneUp Utilities 2012.lnk
[2012/06/23 02:16:26 | 000,002,110 | —- | C] () – E:\ProgramData\Microsoft\Windows\Start Menu\Programs\Nitro PDF Professional.lnk
[2012/06/23 02:16:26 | 000,002,092 | —- | C] () – E:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Live Photo Gallery.lnk
[2012/06/23 02:16:26 | 000,002,001 | —- | C] () – E:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows 7 Upgrade Advisor.lnk
[2012/06/23 02:16:26 | 000,001,984 | —- | C] () – E:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Live Mail.lnk
[2012/06/23 02:16:26 | 000,001,515 | —- | C] () – E:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Media Player.lnk
[2012/06/23 02:16:26 | 000,001,352 | —- | C] () – E:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Anytime Upgrade.lnk
[2012/06/23 02:16:26 | 000,001,345 | —- | C] () – E:\ProgramData\Microsoft\Windows\Start Menu\Programs\Media Center.lnk
[2012/06/23 02:16:26 | 000,001,330 | —- | C] () – E:\ProgramData\Microsoft\Windows\Start Menu\Programs\Sidebar.lnk
[2012/06/23 02:16:26 | 000,001,326 | —- | C] () – E:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows DVD Maker.lnk
[2012/06/23 02:16:26 | 000,001,246 | —- | C] () – E:\ProgramData\Microsoft\Windows\Start Menu\Programs\XPS Viewer.lnk
[2012/06/23 02:16:26 | 000,001,210 | —- | C] () – E:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Fax and Scan.lnk
[2012/06/23 02:16:26 | 000,000,972 | —- | C] () – E:\ProgramData\Microsoft\Windows\Start Menu\Programs\TuneUp Utilities 2009.lnk
[2012/06/23 02:16:25 | 000,002,519 | —- | C] () – E:\ProgramData\Microsoft\Windows\Start Menu\Programs\Apple Software Update.lnk
[2012/06/23 02:16:25 | 000,002,425 | —- | C] () – E:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader 8.lnk
[2012/06/23 02:16:25 | 000,001,436 | —- | C] () – E:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Illustrator CS5.lnk
[2012/06/23 02:16:25 | 000,001,313 | —- | C] () – E:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe ExtendScript Toolkit CS5.lnk
[2012/06/23 02:16:25 | 000,001,269 | —- | C] () – E:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe ExtendScript Toolkit 2.lnk
[2012/06/23 02:16:25 | 000,001,151 | —- | C] () – E:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Extension Manager CS5.lnk
[2012/06/23 02:16:25 | 000,001,060 | —- | C] () – E:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Device Central CS5.lnk
[2012/06/23 02:16:25 | 000,001,005 | —- | C] () – E:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Photoshop CS5.lnk
[2012/06/23 02:16:25 | 000,000,967 | —- | C] () – E:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Bridge CS5.lnk
[2012/06/23 02:16:25 | 000,000,879 | —- | C] () – E:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Help.lnk
[2012/06/23 02:16:25 | 000,000,868 | —- | C] () – E:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Flash CS3 Video Encoder.lnk
[2012/06/23 02:16:25 | 000,000,842 | —- | C] () – E:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Stock Photos CS3.lnk
[2012/06/23 02:16:25 | 000,000,832 | —- | C] () – E:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Extension Manager CS3.lnk
[2012/06/23 02:16:25 | 000,000,825 | —- | C] () – E:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Device Central CS3.lnk
[2012/06/23 02:16:25 | 000,000,804 | —- | C] () – E:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Dreamweaver CS3.lnk
[2012/06/23 02:16:25 | 000,000,762 | —- | C] () – E:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Bridge CS3.lnk
[2012/06/23 02:16:25 | 000,000,752 | —- | C] () – E:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Flash CS3 Professional.lnk
[2012/06/23 01:00:23 | 000,001,072 | —- | C] () – E:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2012/06/22 22:14:52 | 000,344,824 | —- | C] () – E:\ProgramData\HDFDEdWnhRJWy.exe
[2012/02/26 16:36:49 | 000,000,258 | RHS- | C] () – E:\ProgramData\ntuser.pol
[2011/05/15 23:33:07 | 000,000,132 | —- | C] () – E:\Users\Bart\AppData\Roaming\Adobe BMP Format CS5 Prefs
[2010/07/11 20:15:14 | 000,073,220 | —- | C] () – E:\Windows\System32\EPPICPrinterDB.dat
[2010/07/11 20:15:14 | 000,031,053 | —- | C] () – E:\Windows\System32\EPPICPattern131.dat
[2010/07/11 20:15:14 | 000,029,114 | —- | C] () – E:\Windows\System32\EPPICPattern1.dat
[2010/07/11 20:15:14 | 000,027,417 | —- | C] () – E:\Windows\System32\EPPICPattern121.dat
[2010/07/11 20:15:14 | 000,021,021 | —- | C] () – E:\Windows\System32\EPPICPattern3.dat
[2010/07/11 20:15:14 | 000,015,670 | —- | C] () – E:\Windows\System32\EPPICPattern5.dat
[2010/07/11 20:15:14 | 000,013,280 | —- | C] () – E:\Windows\System32\EPPICPattern2.dat
[2010/07/11 20:15:14 | 000,010,673 | —- | C] () – E:\Windows\System32\EPPICPattern4.dat
[2010/07/11 20:15:14 | 000,004,943 | —- | C] () – E:\Windows\System32\EPPICPattern6.dat
[2010/07/11 20:15:14 | 000,001,140 | —- | C] () – E:\Windows\System32\EPPICPresetData_PT.dat
[2010/07/11 20:15:14 | 000,001,140 | —- | C] () – E:\Windows\System32\EPPICPresetData_BP.dat
[2010/07/11 20:15:14 | 000,001,137 | —- | C] () – E:\Windows\System32\EPPICPresetData_ES.dat
[2010/07/11 20:15:14 | 000,001,130 | —- | C] () – E:\Windows\System32\EPPICPresetData_FR.dat
[2010/07/11 20:15:14 | 000,001,130 | —- | C] () – E:\Windows\System32\EPPICPresetData_CF.dat
[2010/07/11 20:15:14 | 000,001,104 | —- | C] () – E:\Windows\System32\EPPICPresetData_EN.dat
[2010/07/11 20:15:14 | 000,000,097 | —- | C] () – E:\Windows\System32\PICSDK.ini
[2009/08/20 10:26:28 | 000,060,744 | —- | C] () – E:\Users\Bart\g2mdlhlpx.exe
[2009/06/05 15:19:25 | 000,000,760 | —- | C] () – E:\Users\Bart\AppData\Roaming\setup_ldm.iss
[2009/01/11 00:19:15 | 2618,793,984 | —- | C] () – E:\Users\Bart\7000.0.081212-1400_client_en-us_Ultimate-GB1CULFRE_EN_DVD.iso
[2008/12/02 19:19:22 | 000,002,834 | —- | C] () – E:\Users\Bart\AppData\Roaming\SAS7_000.DAT
[2008/05/03 19:59:03 | 000,004,204 | —- | C] () – E:\Users\Bart\UserCustomPreset_Adobe Premiere Pro 2.0.vpr
[2007/12/20 12:40:10 | 000,048,245 | —- | C] () – E:\Users\Bart\Those Fat Monkeys.htm
[2007/06/05 17:14:50 | 000,000,028 | —- | C] () – E:\Users\Bart\Adobe Encore DVD_VUI.pref
[2007/05/15 00:59:15 | 000,000,556 | —- | C] () – E:\Users\Bart\AppData\Roaming\AutoGK.ini

========== LOP Check ==========

[2012/02/26 15:58:20 | 000,000,000 | —D | M] – E:\Users\Bart\AppData\Roaming\Acronis
[2012/02/26 15:58:32 | 000,000,000 | —D | M] – E:\Users\Bart\AppData\Roaming\Amazon
[2012/02/26 15:58:45 | 000,000,000 | —D | M] – E:\Users\Bart\AppData\Roaming\Azureus
[2011/01/15 22:59:48 | 000,000,000 | —D | M] – E:\Users\Bart\AppData\Roaming\Canon
[2012/02/26 15:58:45 | 000,000,000 | —D | M] – E:\Users\Bart\AppData\Roaming\chc.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1
[2012/02/26 15:58:46 | 000,000,000 | —D | M] – E:\Users\Bart\AppData\Roaming\Citrix
[2012/02/26 15:58:46 | 000,000,000 | —D | M] – E:\Users\Bart\AppData\Roaming\DeLorme
[2012/02/26 15:58:46 | 000,000,000 | —D | M] – E:\Users\Bart\AppData\Roaming\deskPDF
[2012/02/26 15:58:47 | 000,000,000 | —D | M] – E:\Users\Bart\AppData\Roaming\Dropbox
[2009/02/05 12:20:44 | 000,000,000 | —D | M] – E:\Users\Bart\AppData\Roaming\eMusic
[2012/02/26 15:59:57 | 000,000,000 | —D | M] – E:\Users\Bart\AppData\Roaming\Epson
[2012/02/26 15:59:57 | 000,000,000 | —D | M] – E:\Users\Bart\AppData\Roaming\Final Draft
[2012/02/26 15:59:57 | 000,000,000 | —D | M] – E:\Users\Bart\AppData\Roaming\FlashFXP
[2012/02/26 15:59:57 | 000,000,000 | —D | M] – E:\Users\Bart\AppData\Roaming\Flock
[2012/02/26 15:59:58 | 000,000,000 | —D | M] – E:\Users\Bart\AppData\Roaming\FontCreator
[2012/02/26 15:59:58 | 000,000,000 | —D | M] – E:\Users\Bart\AppData\Roaming\GlobalSCAPE
[2012/02/26 15:59:58 | 000,000,000 | —D | M] – E:\Users\Bart\AppData\Roaming\ICAClient
[2012/02/26 15:59:58 | 000,000,000 | —D | M] – E:\Users\Bart\AppData\Roaming\iolo
[2012/02/26 16:00:00 | 000,000,000 | —D | M] – E:\Users\Bart\AppData\Roaming\Leadertech
[2012/02/26 16:02:13 | 000,000,000 | —D | M] – E:\Users\Bart\AppData\Roaming\NetMedia Providers
[2012/02/26 16:02:13 | 000,000,000 | —D | M] – E:\Users\Bart\AppData\Roaming\Netscape
[2012/02/26 16:02:15 | 000,000,000 | —D | M] – E:\Users\Bart\AppData\Roaming\Nitro PDF
[2012/02/26 16:02:15 | 000,000,000 | —D | M] – E:\Users\Bart\AppData\Roaming\Nuance
[2007/03/10 16:50:59 | 000,000,000 | —D | M] – E:\Users\Bart\AppData\Roaming\Opera
[2012/02/26 16:02:15 | 000,000,000 | —D | M] – E:\Users\Bart\AppData\Roaming\pdf995
[2012/02/26 16:02:15 | 000,000,000 | —D | M] – E:\Users\Bart\AppData\Roaming\Publish Providers
[2012/02/26 16:02:16 | 000,000,000 | —D | M] – E:\Users\Bart\AppData\Roaming\RMS
[2012/02/26 16:02:19 | 000,000,000 | —D | M] – E:\Users\Bart\AppData\Roaming\ScanSoft
[2012/03/30 19:41:58 | 000,000,000 | —D | M] – E:\Users\Bart\AppData\Roaming\SecondLife
[2012/02/26 16:02:19 | 000,000,000 | —D | M] – E:\Users\Bart\AppData\Roaming\SolidDocuments
[2012/02/26 16:02:19 | 000,000,000 | —D | M] – E:\Users\Bart\AppData\Roaming\Sony
[2012/03/29 10:26:47 | 000,000,000 | —D | M] – E:\Users\Bart\AppData\Roaming\Spotify
[2012/02/26 16:02:19 | 000,000,000 | —D | M] – E:\Users\Bart\AppData\Roaming\Steinberg
[2012/02/26 16:02:22 | 000,000,000 | —D | M] – E:\Users\Bart\AppData\Roaming\TaxCut
[2012/02/26 16:02:23 | 000,000,000 | —D | M] – E:\Users\Bart\AppData\Roaming\Thunderbird
[2012/02/27 13:49:58 | 000,000,000 | —D | M] – E:\Users\Bart\AppData\Roaming\TuneUp Software
[2012/02/26 16:02:24 | 000,000,000 | —D | M] – E:\Users\Bart\AppData\Roaming\Web Page Maker
[2012/02/26 16:02:24 | 000,000,000 | —D | M] – E:\Users\Bart\AppData\Roaming\Zeon
[2012/05/26 10:52:40 | 000,032,592 | —- | M] () – E:\Windows\Tasks\SCHEDLGU.TXT

========== Purity Check ==========

========== Custom Scans ==========

< %SYSTEMDRIVE%\*.* >
[2009/09/03 14:53:56 | 000,000,036 | —- | M] () – E:\.uid_xxx
[2009/06/10 14:42:20 | 000,000,024 | —- | M] () – E:\autoexec.bat
[2007/02/16 01:29:38 | 000,000,337 | RHS- | M] () – E:\Boot.ini.saved
[2010/11/20 05:40:08 | 000,383,786 | RHS- | M] () – E:\bootmgr
[2012/02/26 15:20:18 | 000,008,192 | RHS- | M] () – E:\BOOTSECT.BAK
[2009/06/10 14:42:20 | 000,000,010 | —- | M] () – E:\config.sys
[2009/09/03 16:05:38 | 000,000,000 | —- | M] () – E:\famstats.txt
[2007/03/17 04:41:22 | 000,171,136 | RHS- | M] () – E:\grldr
[2012/06/23 13:14:35 | 2213,314,560 | -HS- | M] () – E:\hiberfil.sys
[2010/03/30 11:06:49 | 000,000,109 | —- | M] () – E:\mbam-error.txt
[2001/08/23 05:00:00 | 000,045,124 | RHS- | M] () – E:\NTDETECT.COM
[2001/08/23 05:00:00 | 000,222,368 | RHS- | M] () – E:\ntldr
[2012/06/23 13:14:40 | 2951,086,080 | -HS- | M] () – E:\pagefile.sys

< %systemroot%\Fonts\*.com >
[2009/07/13 21:52:25 | 000,026,040 | —- | M] () – E:\Windows\Fonts\GlobalMonospace.CompositeFont
[2009/07/13 21:52:25 | 000,026,489 | —- | M] () – E:\Windows\Fonts\GlobalSansSerif.CompositeFont
[2009/07/13 21:52:25 | 000,029,779 | —- | M] () – E:\Windows\Fonts\GlobalSerif.CompositeFont
[2009/07/13 21:52:25 | 000,043,318 | —- | M] () – E:\Windows\Fonts\GlobalUserInterface.CompositeFont

< %systemroot%\Fonts\*.dll >

< %systemroot%\Fonts\*.ini >
[2009/06/10 14:31:19 | 000,000,065 | —- | M] () – E:\Windows\Fonts\desktop.ini

< %systemroot%\Fonts\*.ini2 >

< %systemroot%\Fonts\*.exe >

< %systemroot%\system32\spool\prtprocs\w32x86\*.* >
[2009/07/13 18:15:05 | 000,070,144 | —- | M] (CANON INC.) – E:\Windows\system32\spool\prtprocs\w32x86\CNBPP3.DLL
[2006/09/13 14:00:00 | 000,027,136 | —- | M] (CANON INC.) – E:\Windows\system32\spool\prtprocs\w32x86\CNMPD7Q.DLL
[2006/09/13 14:00:00 | 000,069,632 | —- | M] (CANON INC.) – E:\Windows\system32\spool\prtprocs\w32x86\CNMPP7Q.DLL
[2006/11/02 03:46:06 | 000,032,768 | —- | M] (SEIKO EPSON CORPORATION) – E:\Windows\system32\spool\prtprocs\w32x86\EP0NPP01.DLL
[2009/07/13 18:15:35 | 000,022,528 | —- | M] (Microsoft Corporation) – E:\Windows\system32\spool\prtprocs\w32x86\jnwppr.dll
[2006/10/26 20:56:12 | 000,033,104 | —- | M] (Microsoft Corporation) – E:\Windows\system32\spool\prtprocs\w32x86\msonpppr.dll
[2010/11/20 05:21:38 | 000,030,208 | —- | M] (Microsoft Corporation) – E:\Windows\system32\spool\prtprocs\w32x86\winprint.dll

< %systemroot%\REPAIR\*.bak1 >

< %systemroot%\REPAIR\*.ini >

< %systemroot%\system32\*.jpg >

< %systemroot%\*.jpg >

< %systemroot%\*.png >

< %systemroot%\*.scr >
[2008/02/01 11:11:10 | 000,586,240 | —- | M] (Microsoft Corporation) – E:\Windows\WLXPGSS.SCR

< %systemroot%\*._sy >

< %APPDATA%\Adobe\Update\*.* >

< %ALLUSERSPROFILE%\Favorites\*.* >

< %APPDATA%\Microsoft\*.* >

< %PROGRAMFILES%\*.* >
[2009/07/13 21:41:57 | 000,000,174 | -HS- | M] () – E:\Program Files\desktop.ini
[2011/12/21 18:41:05 | 000,026,859 | —- | M] () – E:\Program Files\uninstal.log

< %APPDATA%\Update\*.* >

< %systemroot%\*. /mp /s >

< %systemroot%\System32\config\*.sav >

< %PROGRAMFILES%\bak. /s >

< %systemroot%\system32\bak. /s >

< %ALLUSERSPROFILE%\Start Menu\*.lnk /x >

< %systemroot%\system32\config\systemprofile\*.dat /x >

< %systemroot%\*.config >

< %systemroot%\system32\*.db >

< %PROGRAMFILES%\Internet Explorer\*.dat >

< %APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x >
[2012/02/25 18:33:10 | 000,000,350 | -HS- | M] () – E:\Users\Bart\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop (1).ini
[2012/02/26 16:37:11 | 000,000,221 | -HS- | M] () – E:\Users\Bart\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini

< %USERPROFILE%\Desktop\*.exe >
[2012/01/05 11:57:31 | 024,334,368 | —- | M] (Amazon.com) – E:\Users\Bart\Desktop\KindleForPC-installer.exe

< %PROGRAMFILES%\Common Files\*.* >

< %systemroot%\*.src >

< %systemroot%\install\*.* >

< %systemroot%\system32\DLL\*.* >

< %systemroot%\system32\HelpFiles\*.* >

< %systemroot%\system32\rundll\*.* >

< %systemroot%\winn32\*.* >

< %systemroot%\Java\*.* >

< %systemroot%\system32\test\*.* >

< %systemroot%\system32\Rundll32\*.* >

< %systemroot%\AppPatch\Custom\*.* >

< HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >
"NoAutoUpdate" = 0

< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs >
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install\\LastSuccessTime: 2012-02-27 06:44:25

< End of report >

bart10

Post #13June 25, 2012, 8:52 PM UTC

Satchfan,

MY APOLOGIES! I was so frantic trying to get the malware thing done so I could make my meeting on time, I made two mistakes in what I sent you last. The malwarebytes was right, but obviously, the OTL reports were wrong. When I ran the fix as you told me, it asked for a reboot. Once rebooted, there was no report I could find. (I mistakenly sent you an earlier report from OTL).

Now that I'm back, I just ran a quick scan on OTL. I hope this has the information you need.

Again, sorry for the screwups.

-Bart

OTL quick scan report:

OTL logfile created on: 6/25/2012 1:38:56 PM - Run 4
OTL by OldTimer - Version 3.2.52.0 Folder = D:\Documents
Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7601.17514)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

2.75 Gb Total Physical Memory | 1.75 Gb Available Physical Memory | 63.72% Memory free
5.50 Gb Paging File | 4.24 Gb Available in Paging File | 77.07% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = E: | %SystemRoot% = E:\Windows | %ProgramFiles% = E:\Program Files
Drive C: | 337.77 Gb Total Space | 266.74 Gb Free Space | 78.97% Space Free | Partition Type: NTFS
Drive D: | 232.88 Gb Total Space | 28.50 Gb Free Space | 12.24% Space Free | Partition Type: NTFS
Drive E: | 127.99 Gb Total Space | 49.23 Gb Free Space | 38.46% Space Free | Partition Type: NTFS
Drive F: | 626.31 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: UDF

Computer Name: SUSAN-TESS-PC | User Name: Bart | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - D:\Documents\OTL.exe (OldTimer Tools)
PRC - E:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)
PRC - E:\Program Files\Avira\AntiVir Desktop\avguard.exe (Avira Operations GmbH & Co. KG)
PRC - E:\Program Files\Avira\AntiVir Desktop\sched.exe (Avira Operations GmbH & Co. KG)
PRC - E:\Program Files\Avira\AntiVir Desktop\avshadow.exe (Avira Operations GmbH & Co. KG)
PRC - E:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation)
PRC - E:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
PRC - E:\Program Files\TuneUp Utilities 2012\TuneUpUtilitiesApp32.exe (TuneUp Software)
PRC - E:\Program Files\TuneUp Utilities 2012\TuneUpUtilitiesService32.exe (TuneUp Software)
PRC - E:\Program Files\SonicWALL\SSL-VPN\NetExtender\NEService.exe (SonicWALL Inc.)
PRC - E:\Windows\System32\conhost.exe (Microsoft Corporation)
PRC - E:\Program Files\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe (NVIDIA Corporation)
PRC - E:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe (NVIDIA Corporation)
PRC - E:\Program Files\NVIDIA Corporation\Display\nvtray.exe (NVIDIA Corporation)
PRC - E:\Windows\explorer.exe (Microsoft Corporation)
PRC - E:\ProgramData\Clickfree\HDDV2NUSB3\UACProxy.exe (Storage Appliance Corp.)
PRC - E:\ProgramData\Clickfree\HDDV2NUSB3\Reminder\SacReminder.exe (Storage Appliance Corp.)
PRC - E:\ProgramData\Clickfree\HDDV2NUSB3\Reminder\SacNetAgent.exe (Storage Appliance Corporation)
PRC - E:\Windows\System32\taskhost.exe (Microsoft Corporation)
PRC - E:\Program Files\Common Files\LogiShrd\KHAL3\KHALMNPR.exe (Logitech, Inc.)
PRC - E:\Program Files\Logitech\SetPointP\SetPoint.exe (Logitech, Inc.)
PRC - E:\Program Files\Common Files\Adobe\OOBE\PDApp\UWA\AAM Updates Notifier.exe (Adobe Systems Incorporated)
PRC - E:\Windows\SOUNDMAN.EXE (Realtek Semiconductor Corp.)

========== Modules (No Company Name) ==========

========== Win32 Services (SafeList) ==========

SRV - (AcrSch2Svc) – E:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe File not found
SRV - (MozillaMaintenance) – E:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe (Mozilla Foundation)
SRV - (AntiVirService) – E:\Program Files\Avira\AntiVir Desktop\avguard.exe (Avira Operations GmbH & Co. KG)
SRV - (AntiVirSchedulerService) – E:\Program Files\Avira\AntiVir Desktop\sched.exe (Avira Operations GmbH & Co. KG)
SRV - (MBAMService) – E:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation)
SRV - (TuneUp.UtilitiesSvc) – E:\Program Files\TuneUp Utilities 2012\TuneUpUtilitiesService32.exe (TuneUp Software)
SRV - (SONICWALL_NetExtender) – E:\Program Files\SonicWALL\SSL-VPN\NetExtender\NEService.exe (SonicWALL Inc.)
SRV - (nvUpdatusService) – E:\Program Files\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe (NVIDIA Corporation)
SRV - (CFUACProxy_hddv2nusb3) – E:\ProgramData\Clickfree\HDDV2NUSB3\UACProxy.exe (Storage Appliance Corp.)
SRV - (SacNetAgentService_C57C4F854F53) – E:\ProgramData\Clickfree\HDDV2NUSB3\Reminder\SacNetAgent.exe (Storage Appliance Corporation)
SRV - (LBTServ) – E:\Program Files\Common Files\LogiShrd\Bluetooth\LBTServ.exe (Logitech, Inc.)
SRV - (SwitchBoard) – E:\Program Files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe (Adobe Systems Incorporated)
SRV - (TuneUp.ProgramStatisticsSvc) – E:\Windows\System32\TUProgSt.exe (TuneUp Software)
SRV - (TuneUp.Defrag) – E:\Windows\System32\TuneUpDefragService.exe (TuneUp Software)
SRV - (FLEXnet Licensing Service) – E:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe (Acresso Software Inc.)
SRV - (getPlusHelper) getPlus® – E:\Program Files\NOS\bin\getPlus_Helper.dll (NOS Microsystems Ltd.)
SRV - (SensrSvc) – E:\Windows\System32\sensrsvc.dll (Microsoft Corporation)
SRV - (WinDefend) – E:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)
SRV - (bepldr) – E:\Program Files\Common Files\BCL Technologies\NitroPDF5\bepldr.exe ()

========== Driver Services (SafeList) ==========

DRV - (avipbb) – E:\Windows\System32\drivers\avipbb.sys (Avira GmbH)
DRV - (avgntflt) – E:\Windows\System32\drivers\avgntflt.sys (Avira GmbH)
DRV - (MBAMProtector) – E:\Windows\System32\drivers\mbam.sys (Malwarebytes Corporation)
DRV - (TuneUpUtilitiesDrv) – E:\Program Files\TuneUp Utilities 2012\TuneUpUtilitiesDriver32.sys (TuneUp Software)
DRV - (avkmgr) – E:\Windows\System32\drivers\avkmgr.sys (Avira GmbH)
DRV - (NxDrv) – E:\Windows\System32\drivers\NxDrv.sys (SonicWALL Inc.)
DRV - (nvlddmkm) – E:\Windows\System32\drivers\nvlddmkm.sys (NVIDIA Corporation)
DRV - (TsUsbFlt) – E:\Windows\System32\drivers\TsUsbFlt.sys (Microsoft Corporation)
DRV - (Lbd) – E:\Windows\System32\drivers\Lbd.sys (Lavasoft AB)
DRV - (LMouFilt) – E:\Windows\System32\drivers\LMouFilt.Sys (Logitech, Inc.)
DRV - (LHidFilt) – E:\Windows\System32\drivers\LHidFilt.Sys (Logitech, Inc.)
DRV - (ssmdrv) – E:\Windows\System32\drivers\ssmdrv.sys (Avira GmbH)
DRV - (NtiEnc) – E:\Windows\System32\drivers\NtiEnc.sys (NewTech Infosystems)
DRV - (NVHDA) – E:\Windows\System32\drivers\nvhda32v.sys (NVIDIA Corporation)
DRV - (NVENETFD) – E:\Windows\System32\drivers\nvm62x32.sys (NVIDIA Corporation)
DRV - (ALCXWDM) Service for Realtek AC97 Audio (WDM) – E:\Windows\System32\drivers\RTKVAC.SYS (Realtek Semiconductor Corp.)
DRV - (nvstor32) – E:\Windows\System32\drivers\nvstor32.sys (NVIDIA Corporation)
DRV - (AsIO) – E:\Windows\System32\drivers\AsIO.sys ()
DRV - (MTsensor) – E:\Windows\System32\drivers\ASACPI.sys ()
DRV - (SCDEmu) – E:\Windows\System32\drivers\scdemu.sys (PowerISO Computing, Inc.)
DRV - (pfc) – E:\Windows\System32\drivers\pfc.sys (Padus, Inc.)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
IE - HKLM\..\SearchScopes,DefaultScope = {6A1806CD-94D4-4689-BA73-E35EA1EA9990}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://search.live.com/results.aspx?q={sea…ferrer:source?}
IE - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://www.google.com/search?q={searchTerm…mp;sourceid=ie7

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = http://g.msn.com/0SEENUS/SAOS01?FORM=TOOLBR
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://g.msn.com/0SEENUS/SAOS01?FORM=TOOLBR
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.msn.com/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 2
IE - HKCU\..\SearchScopes,DefaultScope = {6A1806CD-94D4-4689-BA73-E35EA1EA9990}
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}…amp;FORM=IE8SRC
IE - HKCU\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://www.google.com/search?q={searchTerm…1I7GPEA_enUS310
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = ;*.local

========== FireFox ==========

FF - prefs.js..browser.search.selectedEngine: "Yahoo"
FF - user.js - File not found

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: E:\Windows\system32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: E:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: E:\Program Files\DivX\DivX Web Player\npdivx32.dll (DivX,Inc.)
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Player Plugin,version=1.0.0: E:\Program Files\DivX\DivX Player\npDivxPlayerPlugin.dll (DivX, Inc)
FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: E:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: E:\Program Files\Microsoft Silverlight\4.1.10111.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/VirtualEarth3D,version=2.5: E:\Program Files\Virtual Earth 3D\ [2012/02/26 15:39:04 | 000,000,000 | —D | M]
FF - HKLM\Software\MozillaPlugins\@microsoft.com/VirtualEarth3D,version=3.0: E:\Program Files\Virtual Earth 3D\ [2012/02/26 15:39:04 | 000,000,000 | —D | M]
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: E:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@Musicnotes.com/Musicnotes Viewer,version=1.18.1: E:\Program Files\Musicnotes\npmusicn.dll (Musicnotes, Inc.)
FF - HKLM\Software\MozillaPlugins\@pack.google.com/Google Updater;version=14: E:\Program Files\Google\Google Updater\2.4.2432.1652\npCIDetect14.dll (Google)
FF - HKLM\Software\MozillaPlugins\@real.com/nppl3260;version=6.0.12.775: E:\Program Files\Real\RealPlayer\Netscape6\nppl3260.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprjplug;version=1.0.3.775: E:\Program Files\Real\RealPlayer\Netscape6\nprjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprphtml5videoshim;version=1.0.0.0: E:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprpjplug;version=6.0.12.775: E:\Program Files\Real\RealPlayer\Netscape6\nprpjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nsJSRealPlayerPlugin;version=: File not found
FF - HKLM\Software\MozillaPlugins\@Sibelius.com/Scorch Plugin,version=6.1.5.22: E:\Program Files\Musicnotes\npsibelius.dll ()
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: E:\Program Files\Google\Update\1.3.21.111\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: E:\Program Files\Google\Update\1.3.21.111\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: E:\Users\Bart\AppData\Local\Google\Update\1.3.21.111\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: E:\Users\Bart\AppData\Local\Google\Update\1.3.21.111\npGoogleUpdate3.dll (Google Inc.)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{ABDE892B-13A8-4d1b-88E6-365A6E755758}: E:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext [2012/02/26 15:41:48 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 13.0.1\extensions\\Components: E:\Program Files\Mozilla Firefox\components [2012/06/16 12:03:56 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 13.0.1\extensions\\Plugins: E:\Program Files\Mozilla Firefox\plugins [2012/06/07 18:13:21 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Netscape Browser 8.1.2.0\Extensions\\Components: E:\Program Files\Netscape\Netscape Browser\Components [2012/02/26 15:35:47 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Netscape Browser 8.1.2.0\Extensions\\Plugins: E:\Program Files\Netscape\Netscape Browser\Plugins [2012/02/26 15:35:49 | 000,000,000 | —D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 13.0.1\extensions\\Components: E:\Program Files\Mozilla Firefox\components [2012/06/16 12:03:56 | 000,000,000 | —D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 13.0.1\extensions\\Plugins: E:\Program Files\Mozilla Firefox\plugins [2012/06/07 18:13:21 | 000,000,000 | —D | M]

[2012/02/26 16:02:11 | 000,000,000 | —D | M] (No name found) – E:\Users\Bart\AppData\Roaming\Mozilla\Extensions
[2012/06/21 17:30:37 | 000,000,000 | —D | M] (No name found) – E:\Users\Bart\AppData\Roaming\Mozilla\Firefox\Profiles\zbq9fgvp.default\extensions
[2012/02/27 14:11:00 | 000,000,000 | —D | M] (Adblock Plus) – E:\Users\Bart\AppData\Roaming\Mozilla\Firefox\Profiles\zbq9fgvp.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}
[2012/02/26 16:02:13 | 000,000,000 | —D | M] (Adobe DLM (powered by getPlus®)) – E:\Users\Bart\AppData\Roaming\Mozilla\Firefox\Profiles\zbq9fgvp.default\extensions\{E2883E8F-472F-4fb0-9522-AC9BF37916A7}
[2012/06/07 18:13:27 | 000,000,000 | —D | M] (No name found) – E:\Program Files\Mozilla Firefox\extensions
File not found (No name found) – E:\PROGRAM FILES\FLOCK\FLOCK\EXTENSIONS\[removed]
File not found (No name found) – E:\PROGRAM FILES\FLOCK\FLOCK\EXTENSIONS\[removed]
[2012/06/16 12:03:56 | 000,085,472 | —- | M] (Mozilla Foundation) – E:\Program Files\mozilla firefox\components\browsercomps.dll
[2010/04/12 17:29:19 | 000,411,368 | —- | M] (Sun Microsystems, Inc.) – E:\Program Files\mozilla firefox\plugins\npdeployJava1.dll
[2012/06/16 12:03:54 | 000,002,252 | —- | M] () – E:\Program Files\mozilla firefox\searchplugins\bing.xml
[2012/06/16 12:03:54 | 000,002,040 | —- | M] () – E:\Program Files\mozilla firefox\searchplugins\twitter.xml

========== Chrome ==========

CHR - default_search_provider: Google (Enabled)
CHR - default_search_provider: search_url = {google:baseURL}search?{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}{googl
e:searchFieldtrialParameter}{google:instantFieldTrialGroupParameter}sourceid=chro
me&ie;={inputEncoding}&q;={searchTerms}
CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}{google:instantFieldTrialGroupParameter}client
=chrome&hl;={language}&q;={searchTerms}
CHR - plugin: Shockwave Flash (Disabled) = E:\Users\Bart\AppData\Local\Google\Chrome\User Data\PepperFlash\11.1.31.203\pepflashplayer.dll
CHR - plugin: Shockwave Flash (Enabled) = E:\Users\Bart\AppData\Local\Google\Chrome\Application\17.0.963.56\gcswf32.dll
CHR - plugin: Shockwave Flash (Enabled) = E:\Windows\system32\Macromed\Flash\NPSWF32.dll
CHR - plugin: Remoting Viewer (Enabled) = internal-remoting-viewer
CHR - plugin: Native Client (Enabled) = E:\Users\Bart\AppData\Local\Google\Chrome\Application\17.0.963.56\ppGoogleNaClPluginChrome.dll
CHR - plugin: Chrome PDF Viewer (Enabled) = E:\Users\Bart\AppData\Local\Google\Chrome\Application\17.0.963.56\pdf.dll
CHR - plugin: Adobe Acrobat (Disabled) = E:\Program Files\Adobe\Reader 8.0\Reader\Browser\nppdf32.dll
CHR - plugin: Java™ Platform SE 6 U20 (Enabled) = E:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll
CHR - plugin: Java Deployment Toolkit 6.0.200.2 (Enabled) = E:\Program Files\Mozilla Firefox\plugins\npdeployJava1.dll
CHR - plugin: Microsoft\u00AE Windows Media Player Firefox Plugin (Enabled) = E:\Program Files\Mozilla Firefox\plugins\np-mswmp.dll
CHR - plugin: DivX Web Player (Enabled) = E:\Program Files\Mozilla Firefox\plugins\npdivx32.dll
CHR - plugin: DivX Player Netscape Plugin (Enabled) = E:\Program Files\Mozilla Firefox\plugins\npDivxPlayerPlugin.dll
CHR - plugin: 2007 Microsoft Office system (Enabled) = E:\Program Files\Mozilla Firefox\plugins\NPOFF12.DLL
CHR - plugin: RealPlayer™ G2 LiveConnect-Enabled Plug-In (32-bit) (Enabled) = E:\Program Files\Mozilla Firefox\plugins\nppl3260.dll
CHR - plugin: RealPlayer Version Plugin (Enabled) = E:\Program Files\Mozilla Firefox\plugins\nprpjplug.dll
CHR - plugin: RealPlayer™ HTML5VideoShim Plug-In (32-bit) (Enabled) = E:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = E:\Program Files\Mozilla Firefox\plugins\npqtplugin.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = E:\Program Files\Mozilla Firefox\plugins\npqtplugin2.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = E:\Program Files\Mozilla Firefox\plugins\npqtplugin3.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = E:\Program Files\Mozilla Firefox\plugins\npqtplugin4.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = E:\Program Files\Mozilla Firefox\plugins\npqtplugin5.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = E:\Program Files\Mozilla Firefox\plugins\npqtplugin6.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = E:\Program Files\Mozilla Firefox\plugins\npqtplugin7.dll
CHR - plugin: RealJukebox NS Plugin (Enabled) = E:\Program Files\Mozilla Firefox\plugins\nprjplug.dll
CHR - plugin: Google Earth Plugin (Enabled) = E:\Program Files\Google\Google Earth\plugin\npgeplugin.dll
CHR - plugin: Google Updater (Enabled) = E:\Program Files\Google\Google Updater\2.4.2432.1652\npCIDetect14.dll
CHR - plugin: Google Update (Enabled) = E:\Program Files\Google\Update\1.3.21.99\npGoogleUpdate3.dll
CHR - plugin: Silverlight Plug-In (Enabled) = E:\Program Files\Microsoft Silverlight\3.0.50106.0\npctrl.dll
CHR - plugin: Musicnotes (Enabled) = E:\Program Files\Musicnotes\npmusicn.dll
CHR - plugin: ScorchPlugin (Enabled) = E:\Program Files\Musicnotes\npsibelius.dll
CHR - plugin: iTunes Application Detector (Enabled) = E:\Program Files\iTunes\Mozilla Plugins\npitunes.dll
CHR - plugin: Windows Presentation Foundation (Enabled) = E:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll
CHR - plugin: Default Plug-in (Enabled) = default_plugin
CHR - Extension: YouTube = E:\Users\Bart\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.2_0\
CHR - Extension: Google Search = E:\Users\Bart\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.17_0\
CHR - Extension: RealPlayer HTML5Video Downloader Extension = E:\Users\Bart\AppData\Local\Google\Chrome\User Data\Default\Extensions\jfmjfhklogoienhpfnppmbcbjfjnkonk\1.2\
CHR - Extension: Gmail = E:\Users\Bart\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\

O1 HOSTS File: ([2012/02/27 13:46:22 | 000,001,828 | —- | M]) - E:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 activate.adobe.com
O1 - Hosts: 127.0.0.1 practivate.adobe.com
O1 - Hosts: 127.0.0.1 ereg.adobe.com
O1 - Hosts: 127.0.0.1 activate.wip3.adobe.com
O1 - Hosts: 127.0.0.1 wip3.adobe.com
O1 - Hosts: 127.0.0.1 3dns-3.adobe.com
O1 - Hosts: 127.0.0.1 3dns-2.adobe.com
O1 - Hosts: 127.0.0.1 adobe-dns.adobe.com
O1 - Hosts: 127.0.0.1 adobe-dns-2.adobe.com
O1 - Hosts: 127.0.0.1 adobe-dns-3.adobe.com
O1 - Hosts: 127.0.0.1 ereg.wip3.adobe.com
O1 - Hosts: 127.0.0.1 activate-sea.adobe.com
O1 - Hosts: 127.0.0.1 wwis-dubc1-vip60.adobe.com
O1 - Hosts: 127.0.0.1 activate-sjc0.adobe.com
O1 - Hosts: 127.0.0.1 adobe.activate.com
O1 - Hosts: 127.0.0.1 adobeereg.com
O1 - Hosts: 127.0.0.1 www.adobeereg.com
O1 - Hosts: 127.0.0.1 wwis-dubc1-vip60.adobe.com
O1 - Hosts: 127.0.0.1 125.252.224.90
O1 - Hosts: 127.0.0.1 125.252.224.91
O1 - Hosts: 127.0.0.1 hl2rcv.adobe.com
O1 - Hosts: 127.0.0.1 secure.tune-up.com
O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - E:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (RealPlayer Download and Record Plugin for Internet Explorer) - {3049C3E9-B461-4BC5-8870-4C09146192CA} - E:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll (RealPlayer)
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - E:\Program Files\Google\GoogleToolbarNotifier\5.7.7227.1100\swg.dll (Google Inc.)
O4 - HKLM..\Run: [APSDaemon] E:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
O4 - HKLM..\Run: [avgnt] E:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)
O4 - HKLM..\Run: [EvtMgr6] E:\Program Files\Logitech\SetPointP\SetPoint.exe (Logitech, Inc.)
O4 - HKLM..\Run: [Kernel and Hardware Abstraction Layer] E:\Windows\KHALMNPR.Exe (Logitech Inc.)
O4 - HKLM..\Run: [Malwarebytes' Anti-Malware] E:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
O4 - HKLM..\Run: [SoundMan] E:\Windows\SOUNDMAN.EXE (Realtek Semiconductor Corp.)
O4 - HKCU..\Run: [EPSON01BECE] E:\Windows\System32\spool\DRIVERS\W32X86\3\E_FATIFRA.EXE (SEIKO EPSON CORPORATION)
O4 - HKCU..\Run: [SacReminderHDDV2N] E:\ProgramData\Clickfree\HDDV2NUSB3\Reminder\SacReminder.exe (Storage Appliance Corp.)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - E:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O13 - gopher Prefix: missing
O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} http://upload.facebook.com/controls/2008.1…toUploader5.cab (Facebook Photo Uploader 5 Control)
O16 - DPF: {1239CC52-59EF-4DFA-8C61-90FFA846DF7E} http://www.musicnotes.com/download/mnviewer.cab (Musicnotes Viewer)
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} http://fpdownload.macromedia.com/get/shock…director/sw.cab (Shockwave ActiveX Control)
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} http://download.microsoft.com/download/9/b…heckControl.cab (Windows Genuine Advantage Validation Tool)
O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262E} http://www.nvidia.com/content/DriverDownlo…/sysreqlab3.cab (System Requirements Lab Class)
O16 - DPF: {4871A87A-BFDD-4106-8153-FFDE2BAC2967} http://dlm.tools.akamai.com/dlmanager/vers…vex-2.2.5.0.cab (DLM Control)
O16 - DPF: {67A5F8DC-1A4B-4D66-9F24-A704AD929EEE} http://www.nvidia.com/content/DriverDownlo…/sysreqlab2.cab (Reg Error: Key error.)
O16 - DPF: {6EEFD7B1-B26C-440D-B55A-1EC677189F30} https://portal.cee-school.org/NELX.cab (NELaunchCtrl Class)
O16 - DPF: {8100D56A-5661-482C-BEE8-AFECE305D968} http://upload.facebook.com/controls/2009.0…oUploader55.cab (Facebook Photo Uploader 5 Control)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.macromedia.com/get/flash…r/ultrashim.cab (Reg Error: Key error.)
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} http://cdn2.zone.msn.com/binFramework/v10/…ro.cab56649.cab (MSN Games - Installer)
O16 - DPF: {C9386579-3C0F-4713-82C6-5BA8088C7C8D} https://secure.shared.live.com/Pa6vGqB728Ax….RichUpload.cab (Windows Live SkyDrive Upload Tool)
O16 - DPF: {CAFEEFAC-0016-0000-0000-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0)
O16 - DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload.macromedia.com/get/shock…ash/swflash.cab (Shockwave Flash Object)
O16 - DPF: {E8F628B5-259A-4734-97EE-BA914D7BE941} http://driveragent.com/files/driveragent.cab (Driver Agent ActiveX Control)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.254
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{38E89F6D-09B9-427F-A0CF-B2B2547BEF34}: Domain = cee-school.org
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{38E89F6D-09B9-427F-A0CF-B2B2547BEF34}: NameServer = 10.30.0.30 10.30.0.14
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{80EF1ACB-D019-4D39-9C47-5957C89DD54C}: DhcpNameServer = 192.168.1.254
O20 - HKLM Winlogon: Shell - (Explorer.exe) - E:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (E:\Windows\system32\userinit.exe) - E:\Windows\System32\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - E:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O24 - Desktop WallPaper: E:\Users\Bart\AppData\Roaming\Microsoft\Windows Live Photo Gallery\Windows Live Photo Gallery Wallpaper.jpg
O24 - Desktop BackupWallPaper: E:\Users\Bart\AppData\Roaming\Microsoft\Windows Live Photo Gallery\Windows Live Photo Gallery Wallpaper.jpg
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009/06/10 14:42:20 | 000,000,024 | —- | M] () - E:\autoexec.bat – [ NTFS ]
O33 - MountPoints2\{690de4b5-60e2-11e1-9f61-0017315c338e}\Shell - "" = AutoRun
O33 - MountPoints2\{690de4b5-60e2-11e1-9f61-0017315c338e}\Shell\AutoRun\command - "" = H:\StartClickFreeBackup.exe
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)

========== Files/Folders - Created Within 30 Days ==========

[2012/06/24 17:56:55 | 000,607,260 | R— | C] (Swearware) – D:\Documents\dds.scr
[2012/06/24 17:56:53 | 004,731,392 | —- | C] (AVAST Software) – D:\Documents\aswMBR.exe
[2012/06/23 12:54:27 | 000,596,480 | —- | C] (OldTimer Tools) – D:\Documents\OTL.exe
[2012/06/23 01:47:03 | 000,000,000 | —D | C] – E:\Users\Bart\Desktop\RK_Quarantine
[2012/06/23 00:37:16 | 000,000,000 | —D | C] – E:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2012/06/23 00:37:12 | 000,022,344 | —- | C] (Malwarebytes Corporation) – E:\Windows\System32\drivers\mbam.sys
[2012/06/23 00:37:12 | 000,000,000 | —D | C] – E:\Program Files\Malwarebytes' Anti-Malware
[2012/06/15 10:20:09 | 000,000,000 | —D | C] – E:\Users\Bart\AppData\Local\Diagnostics
[2012/06/07 18:13:28 | 000,000,000 | —D | C] – E:\Program Files\Mozilla Maintenance Service
[2012/06/07 18:13:28 | 000,000,000 | —D | C] – E:\ProgramData\Mozilla

========== Files - Modified Within 30 Days ==========

[2012/06/25 13:28:00 | 000,000,904 | —- | M] () – E:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-686366199-2891090769-364564458-1000UA.job
[2012/06/25 13:28:00 | 000,000,886 | —- | M] () – E:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2012/06/25 11:59:00 | 000,000,868 | —- | M] () – E:\Windows\tasks\Google Software Updater.job
[2012/06/25 10:16:45 | 000,009,824 | —- | M] () – E:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2012/06/25 10:16:45 | 000,009,824 | —- | M] () – E:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2012/06/25 10:15:44 | 000,630,240 | —- | M] () – E:\Windows\System32\perfh009.dat
[2012/06/25 10:15:44 | 000,108,358 | —- | M] () – E:\Windows\System32\perfc009.dat
[2012/06/25 10:08:18 | 000,000,882 | —- | M] () – E:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2012/06/25 10:07:59 | 000,067,584 | –S- | M] () – E:\Windows\bootstat.dat
[2012/06/25 10:07:43 | 2213,314,560 | -HS- | M] () – E:\hiberfil.sys
[2012/06/24 18:10:06 | 000,000,512 | —- | M] () – E:\Users\Bart\Desktop\MBR.dat
[2012/06/24 17:54:13 | 004,731,392 | —- | M] (AVAST Software) – D:\Documents\aswMBR.exe
[2012/06/24 17:52:15 | 000,607,260 | R— | M] (Swearware) – D:\Documents\dds.scr
[2012/06/23 01:32:16 | 000,596,480 | —- | M] (OldTimer Tools) – D:\Documents\OTL.exe
[2012/06/23 01:27:19 | 001,521,152 | —- | M] () – D:\Documents\RogueKiller.exe
[2012/06/23 00:37:16 | 000,001,072 | —- | M] () – E:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2012/06/22 22:28:01 | 000,000,852 | —- | M] () – E:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-686366199-2891090769-364564458-1000Core.job
[2012/06/22 18:17:45 | 000,000,258 | R-S- | M] () – E:\ProgramData\ntuser.pol
[2012/06/07 18:13:22 | 000,001,846 | —- | M] () – E:\Users\Bart\Application Data\Microsoft\Internet Explorer\Quick Launch\Mozilla Firefox.lnk

========== Files Created - No Company Name ==========

[2012/06/25 08:29:29 | 001,521,152 | —- | C] () – D:\Documents\RogueKiller.exe
[2012/06/24 18:10:06 | 000,000,512 | —- | C] () – E:\Users\Bart\Desktop\MBR.dat
[2012/06/23 02:16:26 | 000,002,146 | —- | C] () – E:\ProgramData\Microsoft\Windows\Start Menu\Programs\TuneUp Utilities 2012.lnk
[2012/06/23 02:16:26 | 000,002,110 | —- | C] () – E:\ProgramData\Microsoft\Windows\Start Menu\Programs\Nitro PDF Professional.lnk
[2012/06/23 02:16:26 | 000,002,092 | —- | C] () – E:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Live Photo Gallery.lnk
[2012/06/23 02:16:26 | 000,002,001 | —- | C] () – E:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows 7 Upgrade Advisor.lnk
[2012/06/23 02:16:26 | 000,001,984 | —- | C] () – E:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Live Mail.lnk
[2012/06/23 02:16:26 | 000,001,515 | —- | C] () – E:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Media Player.lnk
[2012/06/23 02:16:26 | 000,001,352 | —- | C] () – E:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Anytime Upgrade.lnk
[2012/06/23 02:16:26 | 000,001,345 | —- | C] () – E:\ProgramData\Microsoft\Windows\Start Menu\Programs\Media Center.lnk
[2012/06/23 02:16:26 | 000,001,330 | —- | C] () – E:\ProgramData\Microsoft\Windows\Start Menu\Programs\Sidebar.lnk
[2012/06/23 02:16:26 | 000,001,326 | —- | C] () – E:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows DVD Maker.lnk
[2012/06/23 02:16:26 | 000,001,246 | —- | C] () – E:\ProgramData\Microsoft\Windows\Start Menu\Programs\XPS Viewer.lnk
[2012/06/23 02:16:26 | 000,001,210 | —- | C] () – E:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Fax and Scan.lnk
[2012/06/23 02:16:26 | 000,000,972 | —- | C] () – E:\ProgramData\Microsoft\Windows\Start Menu\Programs\TuneUp Utilities 2009.lnk
[2012/06/23 02:16:25 | 000,002,519 | —- | C] () – E:\ProgramData\Microsoft\Windows\Start Menu\Programs\Apple Software Update.lnk
[2012/06/23 02:16:25 | 000,002,425 | —- | C] () – E:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader 8.lnk
[2012/06/23 02:16:25 | 000,001,436 | —- | C] () – E:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Illustrator CS5.lnk
[2012/06/23 02:16:25 | 000,001,313 | —- | C] () – E:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe ExtendScript Toolkit CS5.lnk
[2012/06/23 02:16:25 | 000,001,269 | —- | C] () – E:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe ExtendScript Toolkit 2.lnk
[2012/06/23 02:16:25 | 000,001,151 | —- | C] () – E:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Extension Manager CS5.lnk
[2012/06/23 02:16:25 | 000,001,060 | —- | C] () – E:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Device Central CS5.lnk
[2012/06/23 02:16:25 | 000,001,005 | —- | C] () – E:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Photoshop CS5.lnk
[2012/06/23 02:16:25 | 000,000,967 | —- | C] () – E:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Bridge CS5.lnk
[2012/06/23 02:16:25 | 000,000,879 | —- | C] () – E:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Help.lnk
[2012/06/23 02:16:25 | 000,000,868 | —- | C] () – E:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Flash CS3 Video Encoder.lnk
[2012/06/23 02:16:25 | 000,000,842 | —- | C] () – E:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Stock Photos CS3.lnk
[2012/06/23 02:16:25 | 000,000,832 | —- | C] () – E:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Extension Manager CS3.lnk
[2012/06/23 02:16:25 | 000,000,825 | —- | C] () – E:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Device Central CS3.lnk
[2012/06/23 02:16:25 | 000,000,804 | —- | C] () – E:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Dreamweaver CS3.lnk
[2012/06/23 02:16:25 | 000,000,762 | —- | C] () – E:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Bridge CS3.lnk
[2012/06/23 02:16:25 | 000,000,752 | —- | C] () – E:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Flash CS3 Professional.lnk
[2012/06/23 01:00:23 | 000,001,072 | —- | C] () – E:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2012/02/26 16:36:49 | 000,000,258 | R-S- | C] () – E:\ProgramData\ntuser.pol
[2011/05/15 23:33:07 | 000,000,132 | —- | C] () – E:\Users\Bart\AppData\Roaming\Adobe BMP Format CS5 Prefs
[2010/07/11 20:15:14 | 000,073,220 | —- | C] () – E:\Windows\System32\EPPICPrinterDB.dat
[2010/07/11 20:15:14 | 000,031,053 | —- | C] () – E:\Windows\System32\EPPICPattern131.dat
[2010/07/11 20:15:14 | 000,029,114 | —- | C] () – E:\Windows\System32\EPPICPattern1.dat
[2010/07/11 20:15:14 | 000,027,417 | —- | C] () – E:\Windows\System32\EPPICPattern121.dat
[2010/07/11 20:15:14 | 000,021,021 | —- | C] () – E:\Windows\System32\EPPICPattern3.dat
[2010/07/11 20:15:14 | 000,015,670 | —- | C] () – E:\Windows\System32\EPPICPattern5.dat
[2010/07/11 20:15:14 | 000,013,280 | —- | C] () – E:\Windows\System32\EPPICPattern2.dat
[2010/07/11 20:15:14 | 000,010,673 | —- | C] () – E:\Windows\System32\EPPICPattern4.dat
[2010/07/11 20:15:14 | 000,004,943 | —- | C] () – E:\Windows\System32\EPPICPattern6.dat
[2010/07/11 20:15:14 | 000,001,140 | —- | C] () – E:\Windows\System32\EPPICPresetData_PT.dat
[2010/07/11 20:15:14 | 000,001,140 | —- | C] () – E:\Windows\System32\EPPICPresetData_BP.dat
[2010/07/11 20:15:14 | 000,001,137 | —- | C] () – E:\Windows\System32\EPPICPresetData_ES.dat
[2010/07/11 20:15:14 | 000,001,130 | —- | C] () – E:\Windows\System32\EPPICPresetData_FR.dat
[2010/07/11 20:15:14 | 000,001,130 | —- | C] () – E:\Windows\System32\EPPICPresetData_CF.dat
[2010/07/11 20:15:14 | 000,001,104 | —- | C] () – E:\Windows\System32\EPPICPresetData_EN.dat
[2010/07/11 20:15:14 | 000,000,097 | —- | C] () – E:\Windows\System32\PICSDK.ini
[2009/08/20 10:26:28 | 000,060,744 | —- | C] () – E:\Users\Bart\g2mdlhlpx.exe
[2009/06/05 15:19:25 | 000,000,760 | —- | C] () – E:\Users\Bart\AppData\Roaming\setup_ldm.iss
[2009/01/11 00:19:15 | 2618,793,984 | —- | C] () – E:\Users\Bart\7000.0.081212-1400_client_en-us_Ultimate-GB1CULFRE_EN_DVD.iso
[2008/12/02 19:19:22 | 000,002,834 | —- | C] () – E:\Users\Bart\AppData\Roaming\SAS7_000.DAT
[2008/05/03 19:59:03 | 000,004,204 | —- | C] () – E:\Users\Bart\UserCustomPreset_Adobe Premiere Pro 2.0.vpr
[2007/12/20 12:40:10 | 000,048,245 | —- | C] () – E:\Users\Bart\Those Fat Monkeys.htm
[2007/06/05 17:14:50 | 000,000,028 | —- | C] () – E:\Users\Bart\Adobe Encore DVD_VUI.pref
[2007/05/15 00:59:15 | 000,000,556 | —- | C] () – E:\Users\Bart\AppData\Roaming\AutoGK.ini

========== LOP Check ==========

[2012/02/26 15:58:20 | 000,000,000 | —D | M] – E:\Users\Bart\AppData\Roaming\Acronis
[2012/02/26 15:58:32 | 000,000,000 | —D | M] – E:\Users\Bart\AppData\Roaming\Amazon
[2012/02/26 15:58:45 | 000,000,000 | —D | M] – E:\Users\Bart\AppData\Roaming\Azureus
[2011/01/15 22:59:48 | 000,000,000 | —D | M] – E:\Users\Bart\AppData\Roaming\Canon
[2012/02/26 15:58:45 | 000,000,000 | —D | M] – E:\Users\Bart\AppData\Roaming\chc.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1
[2012/02/26 15:58:46 | 000,000,000 | —D | M] – E:\Users\Bart\AppData\Roaming\Citrix
[2012/02/26 15:58:46 | 000,000,000 | —D | M] – E:\Users\Bart\AppData\Roaming\DeLorme
[2012/02/26 15:58:46 | 000,000,000 | —D | M] – E:\Users\Bart\AppData\Roaming\deskPDF
[2012/02/26 15:58:47 | 000,000,000 | —D | M] – E:\Users\Bart\AppData\Roaming\Dropbox
[2009/02/05 12:20:44 | 000,000,000 | —D | M] – E:\Users\Bart\AppData\Roaming\eMusic
[2012/02/26 15:59:57 | 000,000,000 | —D | M] – E:\Users\Bart\AppData\Roaming\Epson
[2012/02/26 15:59:57 | 000,000,000 | —D | M] – E:\Users\Bart\AppData\Roaming\Final Draft
[2012/02/26 15:59:57 | 000,000,000 | —D | M] – E:\Users\Bart\AppData\Roaming\FlashFXP
[2012/02/26 15:59:57 | 000,000,000 | —D | M] – E:\Users\Bart\AppData\Roaming\Flock
[2012/02/26 15:59:58 | 000,000,000 | —D | M] – E:\Users\Bart\AppData\Roaming\FontCreator
[2012/02/26 15:59:58 | 000,000,000 | —D | M] – E:\Users\Bart\AppData\Roaming\GlobalSCAPE
[2012/02/26 15:59:58 | 000,000,000 | —D | M] – E:\Users\Bart\AppData\Roaming\ICAClient
[2012/02/26 15:59:58 | 000,000,000 | —D | M] – E:\Users\Bart\AppData\Roaming\iolo
[2012/02/26 16:00:00 | 000,000,000 | —D | M] – E:\Users\Bart\AppData\Roaming\Leadertech
[2012/02/26 16:02:13 | 000,000,000 | —D | M] – E:\Users\Bart\AppData\Roaming\NetMedia Providers
[2012/02/26 16:02:13 | 000,000,000 | —D | M] – E:\Users\Bart\AppData\Roaming\Netscape
[2012/02/26 16:02:15 | 000,000,000 | —D | M] – E:\Users\Bart\AppData\Roaming\Nitro PDF
[2012/02/26 16:02:15 | 000,000,000 | —D | M] – E:\Users\Bart\AppData\Roaming\Nuance
[2007/03/10 16:50:59 | 000,000,000 | —D | M] – E:\Users\Bart\AppData\Roaming\Opera
[2012/02/26 16:02:15 | 000,000,000 | —D | M] – E:\Users\Bart\AppData\Roaming\pdf995
[2012/02/26 16:02:15 | 000,000,000 | —D | M] – E:\Users\Bart\AppData\Roaming\Publish Providers
[2012/02/26 16:02:16 | 000,000,000 | —D | M] – E:\Users\Bart\AppData\Roaming\RMS
[2012/02/26 16:02:19 | 000,000,000 | —D | M] – E:\Users\Bart\AppData\Roaming\ScanSoft
[2012/03/30 19:41:58 | 000,000,000 | —D | M] – E:\Users\Bart\AppData\Roaming\SecondLife
[2012/02/26 16:02:19 | 000,000,000 | —D | M] – E:\Users\Bart\AppData\Roaming\SolidDocuments
[2012/02/26 16:02:19 | 000,000,000 | —D | M] – E:\Users\Bart\AppData\Roaming\Sony
[2012/03/29 10:26:47 | 000,000,000 | —D | M] – E:\Users\Bart\AppData\Roaming\Spotify
[2012/02/26 16:02:19 | 000,000,000 | —D | M] – E:\Users\Bart\AppData\Roaming\Steinberg
[2012/02/26 16:02:22 | 000,000,000 | —D | M] – E:\Users\Bart\AppData\Roaming\TaxCut
[2012/02/26 16:02:23 | 000,000,000 | —D | M] – E:\Users\Bart\AppData\Roaming\Thunderbird
[2012/02/27 13:49:58 | 000,000,000 | —D | M] – E:\Users\Bart\AppData\Roaming\TuneUp Software
[2012/02/26 16:02:24 | 000,000,000 | —D | M] – E:\Users\Bart\AppData\Roaming\Web Page Maker
[2012/02/26 16:02:24 | 000,000,000 | —D | M] – E:\Users\Bart\AppData\Roaming\Zeon
[2012/05/26 10:52:40 | 000,032,592 | —- | M] () – E:\Windows\Tasks\SCHEDLGU.TXT

========== Purity Check ==========

< End of report >

Satchfan

Post #14June 25, 2012, 10:38 PM UTC

Hi Bart Don't worry about the mix-up - we all have busy lives and are trying to do too many things at once.

The good thing is that we seem to be getting somewhere. Please let me know the exact situation now and what remaining problems there are. Satchfan

bart10

Post #15June 25, 2012, 11:59 PM UTC

Hi Satchfan, It seems everything is working fine again. The quick links in the taskbar were missing, but easily restored. Programs, internet, files all seem to be normal again. I'll check with my daughter when she gets in to make sure nothing critical is missing (her mother and her share that computer). I think the little malware bugger is gone! Thanks so much for your help. I shall be making a donation via paypal soon. With gratitude, Bart

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

PUM.Hijack.Startmenu [Closed]

✨ Ask AI

Ask AI