What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Possible golrjkntt.dll infection [Closed]

12 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
hello tech's, i'm hoping you can help me clean up my laptop. stopzilla came up with a report that said i was infected with golrjkntt.dll. from wha i've read this is an ugly one. would you be able to look over my log to see if this is indeed the problem and if i have any others? your help with cleaning up my pc would be much appreciated. thank you.



Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 12:36:59 PM, on 7/31/2012
Platform: Windows 7 SP1 (WinNT 6.00.3505)
MSIE: Internet Explorer v9.00 (9.00.8112.16447)
Boot mode: Normal

Running processes:
C:\Program Files (x86)\Dell Stage\Dell Stage\stage_primary.exe
C:\Program Files (x86)\Common Files\Apple\Internet Services\ubd.exe
C:\Windows\SysWOW64\rundll32.exe
C:\Program Files (x86)\Dell Webcam\Dell Webcam Central\WebcamDell2.exe
C:\Program Files (x86)\Roxio\OEM\Roxio Burn\RoxioBurnLauncher.exe
C:\Program Files (x86)\Common Files\Apple\Apple Application Support\distnoted.exe
C:\Program Files (x86)\VTech\DownloadManager\System\AgentMonitor.exe
C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
C:\Program Files (x86)\Dell Stage\Dell Stage\AccuWeather\accuweather.exe
C:\Program Files (x86)\iTunes\iTunesHelper.exe
C:\Program Files (x86)\Windows Live\Mail\wlmail.exe
C:\Program Files (x86)\Dell Stage\Dell Stage\stage_secondary.exe
C:\Program Files (x86)\STOPzilla!\STOPzilla.exe
C:\Program Files (x86)\Windows Live\Contacts\wlcomm.exe
C:\Program Files (x86)\iTunes\iTunes.exe
C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceHelper.exe
C:\Windows\SysWOW64\DllHost.exe
C:\Program Files (x86)\Internet Explorer\iexplore.exe
C:\Program Files (x86)\Internet Explorer\iexplore.exe
C:\Program Files (x86)\Roxio\OEM\Roxio Burn\Roxio Burn.exe
C:\Windows\SysWOW64\Macromed\Flash\FlashUtil32_11_3_300_268_ActiveX.exe
C:\Program Files (x86)\Trend Micro\HiJackThis\HiJackThis.exe
C:\Windows\SysWOW64\DllHost.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
O2 - BHO: (no name) - {1036AD63-AEAC-460B-9060-C96005D4DC86} - (no file)
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Funmoods Helper Object - {75EBB0AA-4214-4CB4-90EC-E3E07ECD04F7} - (no file)
O2 - BHO: Java™ Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre6\bin\ssv.dll
O2 - BHO: IESpeakDoc - {8D10F6C4-0E01-4BD4-8601-11AC1FDF8126} - C:\Program Files (x86)\Dell Wireless\Bluetooth Suite\IEPlugIn.dll
O2 - BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Windows Live Messenger Companion Helper - {9FDDE16B-836F-4806-AB1F-1455CBEFF289} - C:\Program Files (x86)\Windows Live\Companion\companioncore.dll
O2 - BHO: Privacy SafeGuard - {A42D2EB4-DD31-4BB5-8AA5-8D4E04806DBE} - C:\Program Files\PrivacySafeGuard\PrivacySafeGuard.dll
O2 - BHO: SkypeIEPluginBHO - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll
O3 - Toolbar: (no name) - {99079a25-328f-4bd4-be04-00955acaa0a7} - (no file)
O3 - Toolbar: (no name) - {A4C272EC-ED9E-4ACE-A6F2-9558C7F29EF3} - (no file)
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [Dell Webcam Central] "C:\Program Files (x86)\Dell Webcam\Dell Webcam Central\WebcamDell2.exe" /mode2
O4 - HKLM\..\Run: [Dell DataSafe Online] C:\Program Files (x86)\Dell\Dell Datasafe Online\NOBuClient.exe
O4 - HKLM\..\Run: [RoxWatchTray] "C:\Program Files (x86)\Common Files\Roxio Shared\OEM\12.0\SharedCOM\RoxWatchTray12OEM.exe"
O4 - HKLM\..\Run: [Desktop Disc Tool] "C:\Program Files (x86)\Roxio\OEM\Roxio Burn\RoxioBurnLauncher.exe"
O4 - HKLM\..\Run: [APSDaemon] "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe"
O4 - HKLM\..\Run: [AgentMonitor] C:\Program Files (x86)\VTech\DownloadManager\System\AgentMonitor.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [AccuWeatherWidget] "C:\Program Files (x86)\Dell Stage\Dell Stage\AccuWeather\accuweather.exe" "C:\Program Files (x86)\Dell Stage\Dell Stage\AccuWeather\start.umj" –startup
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files (x86)\iTunes\iTunesHelper.exe"
O4 - HKCU\..\Run: [MobileDocuments] C:\Program Files (x86)\Common Files\Apple\Internet Services\ubd.exe
O4 - HKCU\..\Run: [Facebook Update] "C:\Users\A Southard Design.asoutharddesign\AppData\Local\Facebook\Update\FacebookUpdate.exe" /c /nocrashserver
O4 - HKCU\..\Run: [Dell] rundll32.exe "C:\Users\A Southard Design.asoutharddesign\AppData\Local\Deployment\Dell\golrjkntt.dll",CreateInstance
O4 - Global Startup: QuickBooks Update Agent.lnk = C:\Program Files (x86)\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe
O9 - Extra button: @C:\Program Files (x86)\Windows Live\Companion\companionlang.dll,-600 - {0000036B-C524-4050-81A0-243669A86B9F} - C:\Program Files (x86)\Windows Live\Companion\companioncore.dll
O9 - Extra button: @C:\Program Files (x86)\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1004 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: @C:\Program Files (x86)\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1003 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: (no name) - {7815BE26-237D-41A8-A98F-F7BD75F71086} - C:\Program Files (x86)\Dell Wireless\Bluetooth Suite\IEPlugIn.dll
O9 - Extra 'Tools' menuitem: Send by Bluetooth to - {7815BE26-237D-41A8-A98F-F7BD75F71086} - C:\Program Files (x86)\Dell Wireless\Bluetooth Suite\IEPlugIn.dll
O9 - Extra button: Skype add-on for Internet Explorer - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O9 - Extra 'Tools' menuitem: Skype add-on for Internet Explorer - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~2\MICROS~1\OFFICE11\REFIEBAR.DLL
O10 - Unknown file in Winsock LSP: c:\program files (x86)\common files\microsoft shared\windows live\wlidnsp.dll
O10 - Unknown file in Winsock LSP: c:\program files (x86)\common files\microsoft shared\windows live\wlidnsp.dll
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O16 - DPF: {49312E18-AA92-4CC2-BB97-55DEA7BCADD6} (WMI Class) - https://support.dell.com/systemprofiler/SysProExe.CAB
O16 - DPF: {705EC6D4-B138-4079-A307-EF13E4889A82} (CSD ActiveX Installer) - https://vpn1.judiciary.state.nj.us/CACHE/sd…ies/instweb.cab
O16 - DPF: {8CFCF42C-1C64-47D6-AEEC-F9D001832ED3} (DellSystem.Scanner) - http://xserv.dell.com/DellDriverScanner/DellSystem.CAB
O18 - Protocol: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL
O18 - Protocol: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files (x86)\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll
O20 - AppInit_DLLs:
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files (x86)\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Adobe Acrobat Update Service (AdobeARMservice) - Adobe Systems Incorporated - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
O23 - Service: Andrea RT Filters Service (AERTFilters) - Andrea Electronics Corporation - C:\Program Files\Realtek\Audio\HDA\AERTSr64.exe
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
O23 - Service: ASP.NET State Service (aspnet_state) - Unknown owner - C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe (file missing)
O23 - Service: Atheros Bt&Wlan Coex Agent - Atheros - C:\Program Files (x86)\Dell Wireless\Ath_CoexAgent.exe
O23 - Service: AtherosSvc - Atheros Commnucations - C:\Program Files (x86)\Dell Wireless\Bluetooth Suite\adminservice.exe
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing)
O23 - Service: GoToAssist - Citrix Online, a division of Citrix Systems, Inc. - C:\Program Files (x86)\Citrix\GoToAssist\615\g2aservice.exe
O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: Google Update Service (gupdatem) (gupdatem) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Intel® Management and Security Application Local Management Service (LMS) - Intel Corporation - C:\Program Files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe
O23 - Service: Mozilla Maintenance Service (MozillaMaintenance) - Mozilla Foundation - C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Dell DataSafe Online (NOBU) - Dell, Inc. - C:\Program Files (x86)\Dell\Dell Datasafe Online\NOBuAgent.exe
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Intuit QuickBooks FCS (QBFCService) - Intuit Inc. - C:\Program Files (x86)\Common Files\Intuit\QuickBooks\FCS\Intuit.QuickBooks.FCS.exe
O23 - Service: RoxMediaDB12OEM - Sonic Solutions - C:\Program Files (x86)\Common Files\Roxio Shared\OEM\12.0\SharedCOM\RoxMediaDB12OEM.exe
O23 - Service: Roxio Hard Drive Watcher 12 (RoxWatch12) - Sonic Solutions - C:\Program Files (x86)\Common Files\Roxio Shared\OEM\12.0\SharedCOM\RoxWatch12OEM.exe
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)
O23 - Service: SafeBox - Bitdefender - C:\Program Files\Bitdefender\Bitdefender SafeBox\safeboxservice.exe
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: SoftThinks Agent Service (SftService) - SoftThinks SAS - C:\Program Files (x86)\Dell DataSafe Local Backup\sftservice.EXE
O23 - Service: Skype Updater (SkypeUpdate) - Skype Technologies - C:\Program Files (x86)\Skype\Updater\Updater.exe
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing)
O23 - Service: stllssvr - MicroVision Development, Inc. - C:\Program Files (x86)\Common Files\SureThing Shared\stllssvr.exe
O23 - Service: STOPzilla Service (szserver) - iS3, Inc. - C:\Program Files (x86)\Common Files\iS3\Anti-Spyware\SZServer.exe
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)
O23 - Service: Intel® Management and Security Application User Notification Service (UNS) - Intel Corporation - C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe
O23 - Service: BitDefender Update Server v2 (Update Server) - BitDefender - C:\Program Files\Common Files\Bitdefender\Bitdefender Arrakis Server\bin\arrakis3.exe
O23 - Service: BitDefender Desktop Update Service (UPDATESRV) - Bitdefender - C:\Program Files\Bitdefender\Bitdefender 2012\updatesrv.exe
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)
O23 - Service: BitDefender Virus Shield (VSSERV) - Bitdefender - C:\Program Files\Bitdefender\Bitdefender 2012\vsserv.exe
O23 - Service: @%SystemRoot%\system32\Wat\WatUX.exe,-601 (WatAdminSvc) - Unknown owner - C:\Windows\system32\Wat\WatAdminSvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)

–
End of file - 14517 bytes
Post #2
Hi,

:welcome:

My name is NoodleTech. I would be glad to assist you with solving any malware problems. Logs can take a while to research, so please be patient and I'd be grateful if you would note the following:

  • I will be working on your Malware issues, this may or may not, solve other issues you have with your machine.
  • Please be aware that removing malware is not without risk and while unrecoverable damage to systems is rare, it can happen and may require a re-format and re-install of your operating system. Because of this it is a good idea to back-up anything important saved on your computer.
  • The fixes are specific to your problem and should only be used for the issues on this machine.
  • Do not delete anything unless instructed to.
  • DO NOT use tools such as ComboFix without supervision.
  • Please continue to review my answers until I tell you your machine appears to be clean. Absence of symptoms does not mean that everything is clean.
  • It's often worth reading through these instructions and printing them for ease of reference.
  • If you don't know or understand something, please don't hesitate to say or ask!! It's better to be sure and safe than sorry.
  • Please reply to this thread. Do not start a new topic.
  • Failure to respond within 3 days will result in this topic being closed - If you need more time to complete the steps required, please let me know.
===================================================

Please download DDS by sUBs from one of the following links and save it to your desktop.
    • DDS.scr
    • DDS.pif
  • Disable any script blocking protection (How to Disable your Security Programs)
  • Double click DDS icon to run the tool (may take up to 3 minutes to run)
  • When done, DDS.txt will open.
  • After a few moments,  attach.txt will open in a second window.
  • Save both reports to your desktop.
—————————————————
  • Post the contents of the DDS.txt report in your next reply
  • Attach the Attach.txt report to your post by scrolling down to the Attachments area and then clicking Browse. Browse to where you saved the file, and click Open and then click UPLOAD.
===================================================

Please download aswMBR.exe and save it to your desktop. 

Double click aswMBR.exe to start the tool. (Vista/Windows 7 users - right click to run as administrator)

Click Scan
  • Upon completion of the scan, click Save log and save it to your desktop, and post that log in your next reply for review.
  • Note - do NOT attempt any Fix yet.
  • You will also notice another file created on the desktop named MBR.dat.
  • Right click that file and select Send To>Compressed (zipped) file.
  • Attach that zipped file in your next reply as well.
Post #3
hello noodletech, and thank you for your help. here are the logs that you requested. . DDS (Ver_2011-08-26.01) - NTFSAMD64 Internet Explorer: 9.0.8112.16421 Run by [removed] at 1:40:52 on 2012-08-01 Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.4010.1803 [GMT -4:00] . AV: Bitdefender Antivirus *Disabled/Outdated* {50909708-FF80-02AF-F814-B28405891E92} SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} SP: STOPzilla Anti-Spyware *Enabled/Updated* {B2E69928-50DC-94CA-6A80-AAB054008761} SP: Bitdefender Antispyware *Disabled/Outdated* {EBF176EC-D9BA-0D21-C2A4-89F67E0E542F} FW: Bitdefender Firewall *Disabled* {68AB162D-B5EF-03F7-D34B-1BB1FB5A59E9} . ============== Running Processes =============== . C:\Windows\system32\wininit.exe C:\Windows\system32\lsm.exe C:\Windows\system32\svchost.exe -k DcomLaunch C:\Program Files\Bitdefender\Bitdefender 2012\vsserv.exe C:\Windows\system32\svchost.exe -k RPCSS C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted C:\Program Files (x86)\Common Files\iS3\Anti-Spyware\SZServer.exe C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted C:\Windows\system32\svchost.exe -k netsvcs C:\Windows\system32\svchost.exe -k LocalService C:\Windows\system32\svchost.exe -k NetworkService C:\Windows\System32\spoolsv.exe C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe C:\Program Files\Realtek\Audio\HDA\AERTSr64.exe C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe C:\Program Files (x86)\Dell Wireless\Ath_CoexAgent.exe C:\Program Files (x86)\Dell Wireless\Bluetooth Suite\adminservice.exe C:\Program Files (x86)\Dell\Dell Datasafe Online\NOBuAgent.exe C:\Program Files (x86)\Dell DataSafe Local Backup\sftservice.EXE C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe C:\Windows\system32\svchost.exe -k imgsvc C:\Program Files\Bitdefender\Bitdefender 2012\updatesrv.exe C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe C:\Windows\system32\wbem\wmiprvse.exe C:\Windows\system32\taskhost.exe C:\Windows\system32\Dwm.exe C:\Windows\Explorer.EXE C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE C:\Program Files (x86)\Dell DataSafe Local Backup\TOASTER.EXE C:\Program Files (x86)\Dell DataSafe Local Backup\COMPONENTS\SCHEDULER\STSERVICE.EXE C:\Program Files (x86)\Dell DataSafe Local Backup\Components\DSUpdate\DSUpd.exe C:\Windows\system32\SearchIndexer.exe C:\Windows\system32\svchost.exe -k bthsvcs C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted C:\Program Files\Synaptics\SynTP\SynTPEnh.exe C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe C:\Program Files (x86)\Dell Wireless\Bluetooth Suite\BtvStack.exe C:\Program Files (x86)\Dell Wireless\Bluetooth Suite\AthBtTray.exe C:\Program Files\Dell\QuickSet\quickset.exe C:\Program Files\Bitdefender\Bitdefender 2012\bdagent.exe C:\Windows\System32\igfxtray.exe C:\Program Files\Synaptics\SynTP\SynTPHelper.exe C:\Windows\System32\hkcmd.exe C:\Windows\System32\igfxpers.exe C:\Program Files (x86)\Dell Stage\Dell Stage\stage_primary.exe C:\Program Files (x86)\Common Files\Apple\Internet Services\ubd.exe C:\Program Files\Windows Media Player\wmpnetwk.exe C:\Program Files (x86)\Dell Webcam\Dell Webcam Central\WebcamDell2.exe C:\Program Files (x86)\Common Files\Apple\Apple Application Support\distnoted.exe C:\Windows\system32\conhost.exe C:\Program Files (x86)\Roxio\OEM\Roxio Burn\RoxioBurnLauncher.exe C:\Program Files (x86)\VTech\DownloadManager\System\AgentMonitor.exe C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe C:\Program Files (x86)\Dell Stage\Dell Stage\AccuWeather\accuweather.exe C:\Program Files (x86)\iTunes\iTunesHelper.exe C:\Program Files\iPod\bin\iPodService.exe C:\Program Files (x86)\Dell Stage\Dell Stage\stage_secondary.exe C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation C:\Windows\System32\svchost.exe -k LocalServicePeerNet C:\Program Files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe C:\Windows\System32\svchost.exe -k secsvcs C:\Windows\system32\DllHost.exe C:\Windows\system32\svchost.exe -k SDRSVC C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe C:\Windows\SysWOW64\Macromed\Flash\FlashUtil32_11_3_300_268_ActiveX.exe C:\Program Files (x86)\Mozilla Firefox\firefox.exe C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_3_300_268.exe C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_3_300_268.exe C:\Windows\system32\SearchProtocolHost.exe C:\Windows\system32\SearchFilterHost.exe C:\Windows\system32\DllHost.exe C:\Windows\system32\DllHost.exe C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\conhost.exe C:\Windows\SysWOW64\cscript.exe C:\Windows\system32\wbem\wmiprvse.exe . ============== Pseudo HJT Report =============== . uStart Page = about:blank mStart Page = hxxp://start.funmoods.com/?f=1&a=adknlg&chnl=adknlg&cd=2XzuyEtN2Y1L1Qzu0EtB0Fzz0D0AtAyD0FtCzyyDyBtCyCzztN0D0Tzu0CtBtDzztN1L2Xzut BtFtCtFtCtFtAtCtB&cr=1300867293 mURLSearchHooks: H - No File BHO: {02478D38-C3F9-4efb-9B51-7695ECA05670} - No File BHO: {1036AD63-AEAC-460B-9060-C96005D4DC86} - No File BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll BHO: {75EBB0AA-4214-4CB4-90EC-E3E07ECD04F7} - No File BHO: Java™ Plug-In SSV Helper: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - C:\Program Files (x86)\Java\jre6\bin\ssv.dll BHO: CIESpeechBHO Class: {8d10f6c4-0e01-4bd4-8601-11ac1fdf8126} - C:\Program Files (x86)\Dell Wireless\Bluetooth Suite\IEPlugIn.dll BHO: Windows Live ID Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll BHO: Windows Live Messenger Companion Helper: {9fdde16b-836f-4806-ab1f-1455cbeff289} - C:\Program Files (x86)\Windows Live\Companion\companioncore.dll BHO: Privacy Safeguard BHO: {a42d2eb4-dd31-4bb5-8aa5-8d4e04806dbe} - C:\Program Files\PrivacySafeGuard\PrivacySafeGuard.dll BHO: Skype add-on for Internet Explorer: {ae805869-2e5c-4ed4-8f7b-f1f7851a4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll TB: {99079a25-328f-4bd4-be04-00955acaa0a7} - No File TB: {A4C272EC-ED9E-4ACE-A6F2-9558C7F29EF3} - No File TB: {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No File TB: {71576546-354D-41C9-AAE8-31F2EC22BF0D} - No File EB: {c585d593-e7f4-4852-a200-561686ee02e4} - No File uRun: [MobileDocuments] C:\Program Files (x86)\Common Files\Apple\Internet Services\ubd.exe uRun: [Facebook Update] "C:\Users\A Southard Design.asoutharddesign\AppData\Local\Facebook\Update\FacebookUpdate.exe" /c /nocrashserver uRun: [Dell] rundll32.exe "C:\Users\A Southard Design.asoutharddesign\AppData\Local\Deployment\Dell\golrjkntt.dll",CreateInstance mRun: [Adobe Reader Speed Launcher] "C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Reader_sl.exe" mRun: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" mRun: [Dell Webcam Central] "C:\Program Files (x86)\Dell Webcam\Dell Webcam Central\WebcamDell2.exe" /mode2 mRun: [Dell DataSafe Online] C:\Program Files (x86)\Dell\Dell Datasafe Online\NOBuClient.exe mRun: [RoxWatchTray] "C:\Program Files (x86)\Common Files\Roxio Shared\OEM\12.0\SharedCOM\RoxWatchTray12OEM.exe" mRun: [Desktop Disc Tool] "C:\Program Files (x86)\Roxio\OEM\Roxio Burn\RoxioBurnLauncher.exe" mRun: [APSDaemon] "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" mRun: [AgentMonitor] C:\Program Files (x86)\VTech\DownloadManager\System\AgentMonitor.exe mRun: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe" mRun: [AccuWeatherWidget] "C:\Program Files (x86)\Dell Stage\Dell Stage\AccuWeather\accuweather.exe" "C:\Program Files (x86)\Dell Stage\Dell Stage\AccuWeather\start.umj" –startup mRun: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime mRun: [iTunesHelper] "C:\Program Files (x86)\iTunes\iTunesHelper.exe" StartupFolder: C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\Startup\QUICKB~1.LNK - C:\Program Files (x86)\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe mPolicies-explorer: NoActiveDesktop = 1 (0x1) mPolicies-explorer: NoActiveDesktopChanges = 1 (0x1) mPolicies-system: ConsentPromptBehaviorAdmin = 5 (0x5) mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3) mPolicies-system: EnableUIADesktopToggle = 0 (0x0) IE: {0000036B-C524-4050-81A0-243669A86B9F} - {B63DBA5F-523F-4B9C-A43D-65DF1977EAD3} - C:\Program Files (x86)\Windows Live\Companion\companioncore.dll IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll IE: {7815BE26-237D-41A8-A98F-F7BD75F71086} - {8D10F6C4-0E01-4BD4-8601-11AC1FDF8126} - C:\Program Files (x86)\Dell Wireless\Bluetooth Suite\IEPlugIn.dll IE: {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - C:\PROGRA~2\MICROS~1\OFFICE11\REFIEBAR.DLL Trusted Zone: state.nj.us\vpn1.judiciary DPF: {02BCC737-B171-4746-94C9-0D8A0B2C0089} - hxxp://office.microsoft.com/sites/production/ieawsdc32.cab DPF: {49312E18-AA92-4CC2-BB97-55DEA7BCADD6} - hxxps://support.dell.com/systemprofiler/SysProExe.CAB DPF: {705EC6D4-B138-4079-A307-EF13E4889A82} - hxxps://vpn1.judiciary.state.nj.us/CACHE/sdesktop/install/binaries/instweb.cab DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab DPF: {8CFCF42C-1C64-47D6-AEEC-F9D001832ED3} - hxxp://xserv.dell.com/DellDriverScanner/DellSystem.CAB DPF: {CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab TCP: DhcpNameServer = 192.168.1.1 TCP: Interfaces\{088F752B-A292-48C5-97A6-316A6C8C834B} : DhcpNameServer = 192.168.1.1 TCP: Interfaces\{088F752B-A292-48C5-97A6-316A6C8C834B}\075616365647271696E6132333 : DhcpNameServer = 192.168.1.1 TCP: Interfaces\{088F752B-A292-48C5-97A6-316A6C8C834B}\75E4438333 : DhcpNameServer = 192.168.1.1 [removed] TCP: Interfaces\{088F752B-A292-48C5-97A6-316A6C8C834B}\E4544574541425 : DhcpNameServer = 192.168.1.1 TCP: Interfaces\{088F752B-A292-48C5-97A6-316A6C8C834B}\F6074796D657D677966696 : DhcpNameServer = 10.240.205.161 10.240.205.162 Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files (x86)\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll AppInit_DLLs: BHO-X64: {02478D38-C3F9-4efb-9B51-7695ECA05670} - No File BHO-X64: 0x1 - No File BHO-X64: {1036AD63-AEAC-460B-9060-C96005D4DC86} - No File BHO-X64: Adobe PDF Link Helper: {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll BHO-X64: AcroIEHelperStub - No File BHO-X64: {75EBB0AA-4214-4CB4-90EC-E3E07ECD04F7} - No File BHO-X64: Funmoods Helper Object - No File BHO-X64: Java™ Plug-In SSV Helper: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre6\bin\ssv.dll BHO-X64: CIESpeechBHO Class: {8D10F6C4-0E01-4BD4-8601-11AC1FDF8126} - C:\Program Files (x86)\Dell Wireless\Bluetooth Suite\IEPlugIn.dll BHO-X64: IESpeakDoc - No File BHO-X64: Windows Live ID Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll BHO-X64: Windows Live Messenger Companion Helper: {9FDDE16B-836F-4806-AB1F-1455CBEFF289} - C:\Program Files (x86)\Windows Live\Companion\companioncore.dll BHO-X64: Privacy Safeguard BHO: {A42D2EB4-DD31-4BB5-8AA5-8D4E04806DBE} - C:\Program Files\PrivacySafeGuard\PrivacySafeGuard.dll BHO-X64: Privacy SafeGuard - No File BHO-X64: Skype add-on for Internet Explorer: {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll BHO-X64: SkypeIEPluginBHO - No File BHO-X64: Java™ Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll TB-X64: {99079a25-328f-4bd4-be04-00955acaa0a7} - No File TB-X64: {A4C272EC-ED9E-4ACE-A6F2-9558C7F29EF3} - No File TB-X64: {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No File TB-X64: {71576546-354D-41C9-AAE8-31F2EC22BF0D} - No File EB-X64: {c585d593-e7f4-4852-a200-561686ee02e4} - No File mRun-x64: [Adobe Reader Speed Launcher] "C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Reader_sl.exe" mRun-x64: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" mRun-x64: [Dell Webcam Central] "C:\Program Files (x86)\Dell Webcam\Dell Webcam Central\WebcamDell2.exe" /mode2 mRun-x64: [Dell DataSafe Online] C:\Program Files (x86)\Dell\Dell Datasafe Online\NOBuClient.exe mRun-x64: [RoxWatchTray] "C:\Program Files (x86)\Common Files\Roxio Shared\OEM\12.0\SharedCOM\RoxWatchTray12OEM.exe" mRun-x64: [Desktop Disc Tool] "C:\Program Files (x86)\Roxio\OEM\Roxio Burn\RoxioBurnLauncher.exe" mRun-x64: [APSDaemon] "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" mRun-x64: [AgentMonitor] C:\Program Files (x86)\VTech\DownloadManager\System\AgentMonitor.exe mRun-x64: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe" mRun-x64: [AccuWeatherWidget] "C:\Program Files (x86)\Dell Stage\Dell Stage\AccuWeather\accuweather.exe" "C:\Program Files (x86)\Dell Stage\Dell Stage\AccuWeather\start.umj" –startup mRun-x64: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime mRun-x64: [iTunesHelper] "C:\Program Files (x86)\iTunes\iTunesHelper.exe" AppInit_DLLs-X64: . ================= FIREFOX =================== . FF - ProfilePath - C:\Users\A Southard Design.asoutharddesign\AppData\Roaming\Mozilla\Firefox\Profiles\3xbe4tw4.default\ FF - prefs.js: network.proxy.type - 0 FF - plugin: C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL FF - plugin: C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll FF - plugin: C:\Program Files (x86)\Google\Update\1.3.21.115\npGoogleUpdate3.dll FF - plugin: C:\Program Files (x86)\Java\jre6\bin\plugin2\npdeployJava1.dll FF - plugin: C:\Program Files (x86)\Java\jre6\bin\plugin2\npjp2.dll FF - plugin: c:\Program Files (x86)\Microsoft Silverlight\4.1.10329.0\npctrlui.dll FF - plugin: C:\Program Files (x86)\RadioRage_4jEI\Installr\1.bin\NP4jEISb.dll FF - plugin: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll FF - plugin: C:\Users\A Southard Design.asoutharddesign\AppData\Local\Facebook\Video\Skype\npFacebookVideoCalling.dll FF - plugin: C:\Users\A Southard Design.asoutharddesign\AppData\Local\Roblox\Versions\version-3f2bb30af20140a4\NPRobloxProxy.dll FF - plugin: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_3_300_268.dll . ============= SERVICES / DRIVERS =============== . R0 avc3;avc3;C:\Windows\system32\DRIVERS\avc3.sys –> C:\Windows\system32\DRIVERS\avc3.sys [?] R0 PxHlpa64;PxHlpa64;C:\Windows\system32\Drivers\PxHlpa64.sys –> C:\Windows\system32\Drivers\PxHlpa64.sys [?] R1 BdfNdisf;BitDefender Firewall NDIS 6 Filter Driver;C:\Program Files\Common Files\Bitdefender\Bitdefender Firewall\bdfndisf6.sys [2011-11-14 90192] R1 bdfwfpf;bdfwfpf;C:\Program Files\Common Files\Bitdefender\Bitdefender Firewall\bdfwfpf.sys [2011-11-14 103504] R1 BDVEDISK;BDVEDISK;C:\Windows\system32\DRIVERS\bdvedisk.sys –> C:\Windows\system32\DRIVERS\bdvedisk.sys [?] R1 SBRE;SBRE;\??\C:\Windows\system32\drivers\SBREdrv.sys –> C:\Windows\system32\drivers\SBREdrv.sys [?] R1 vwififlt;Virtual WiFi Filter Driver;C:\Windows\system32\DRIVERS\vwififlt.sys –> C:\Windows\system32\DRIVERS\vwififlt.sys [?] R2 AdobeARMservice;Adobe Acrobat Update Service;C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2012-1-3 63928] R2 AERTFilters;Andrea RT Filters Service;C:\Program Files\Realtek\Audio\HDA\AERTSr64.exe [2011-5-8 98208] R2 Atheros Bt&Wlan Coex Agent;Atheros Bt&Wlan Coex Agent;C:\Program Files (x86)\Dell Wireless\Ath_CoexAgent.exe [2011-5-8 151552] R2 AtherosSvc;AtherosSvc;C:\Program Files (x86)\Dell Wireless\Bluetooth Suite\AdminService.exe [2010-12-17 53920] R2 cvhsvc;Client Virtualization Handler;C:\Program Files (x86)\Common Files\microsoft shared\Virtualization Handler\CVHSVC.EXE [2012-1-4 822624] R2 NOBU;Dell DataSafe Online;C:\Program Files (x86)\Dell\Dell Datasafe Online\NOBuAgent.exe [2010-8-25 2823000] R2 sftlist;Application Virtualization Client;C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe [2011-10-1 508776] R2 SftService;SoftThinks Agent Service;C:\Program Files (x86)\Dell DataSafe Local Backup\SftService.exe [2011-5-8 1692480] R2 UNS;Intel® Management and Security Application User Notification Service;C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe [2011-5-8 2656280] R2 UPDATESRV;BitDefender Desktop Update Service;C:\Program Files\Bitdefender\Bitdefender 2012\updatesrv.exe [2011-11-17 66096] R3 AthBTPort;Atheros Virtual Bluetooth Class;C:\Windows\system32\DRIVERS\btath_flt.sys –> C:\Windows\system32\DRIVERS\btath_flt.sys [?] R3 avchv;avchv Function Driver;C:\Windows\system32\DRIVERS\avchv.sys –> C:\Windows\system32\DRIVERS\avchv.sys [?] R3 avckf;avckf;C:\Windows\system32\DRIVERS\avckf.sys –> C:\Windows\system32\DRIVERS\avckf.sys [?] R3 BTATH_A2DP;Bluetooth A2DP Audio Driver;C:\Windows\system32\drivers\btath_a2dp.sys –> C:\Windows\system32\drivers\btath_a2dp.sys [?] R3 BTATH_BUS;Atheros Bluetooth Bus;C:\Windows\system32\DRIVERS\btath_bus.sys –> C:\Windows\system32\DRIVERS\btath_bus.sys [?] R3 BTATH_HCRP;Bluetooth HCRP Server driver;C:\Windows\system32\DRIVERS\btath_hcrp.sys –> C:\Windows\system32\DRIVERS\btath_hcrp.sys [?] R3 BTATH_LWFLT;Bluetooth LWFLT Device;C:\Windows\system32\DRIVERS\btath_lwflt.sys –> C:\Windows\system32\DRIVERS\btath_lwflt.sys [?] R3 BTATH_RCP;Bluetooth AVRCP Device;C:\Windows\system32\DRIVERS\btath_rcp.sys –> C:\Windows\system32\DRIVERS\btath_rcp.sys [?] R3 BtFilter;BtFilter;C:\Windows\system32\DRIVERS\btfilter.sys –> C:\Windows\system32\DRIVERS\btfilter.sys [?] R3 CtClsFlt;Creative Camera Class Upper Filter Driver;C:\Windows\system32\DRIVERS\CtClsFlt.sys –> C:\Windows\system32\DRIVERS\CtClsFlt.sys [?] R3 IntcDAud;Intel® Display Audio;C:\Windows\system32\DRIVERS\IntcDAud.sys –> C:\Windows\system32\DRIVERS\IntcDAud.sys [?] R3 MEIx64;Intel® Management Engine Interface;C:\Windows\system32\DRIVERS\HECIx64.sys –> C:\Windows\system32\DRIVERS\HECIx64.sys [?] R3 nusb3hub;Renesas Electronics USB 3.0 Hub Driver;C:\Windows\system32\DRIVERS\nusb3hub.sys –> C:\Windows\system32\DRIVERS\nusb3hub.sys [?] R3 nusb3xhc;Renesas Electronics USB 3.0 Host Controller Driver;C:\Windows\system32\DRIVERS\nusb3xhc.sys –> C:\Windows\system32\DRIVERS\nusb3xhc.sys [?] R3 RTL8167;Realtek 8167 NT Driver;C:\Windows\system32\DRIVERS\Rt64win7.sys –> C:\Windows\system32\DRIVERS\Rt64win7.sys [?] R3 Sftfs;Sftfs;C:\Windows\system32\DRIVERS\Sftfslh.sys –> C:\Windows\system32\DRIVERS\Sftfslh.sys [?] R3 Sftplay;Sftplay;C:\Windows\system32\DRIVERS\Sftplaylh.sys –> C:\Windows\system32\DRIVERS\Sftplaylh.sys [?] R3 Sftredir;Sftredir;C:\Windows\system32\DRIVERS\Sftredirlh.sys –> C:\Windows\system32\DRIVERS\Sftredirlh.sys [?] R3 Sftvol;Sftvol;C:\Windows\system32\DRIVERS\Sftvollh.sys –> C:\Windows\system32\DRIVERS\Sftvollh.sys [?] R3 sftvsa;Application Virtualization Service Agent;C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe [2011-10-1 219496] R3 vwifimp;Microsoft Virtual WiFi Miniport Service;C:\Windows\system32\DRIVERS\vwifimp.sys –> C:\Windows\system32\DRIVERS\vwifimp.sys [?] S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384] S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-3-18 138576] S2 gupdate;Google Update Service (gupdate);C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2012-3-3 136176] S2 RoxWatch12;Roxio Hard Drive Watcher 12;C:\Program Files (x86)\Common Files\Roxio Shared\OEM\12.0\SharedCOM\RoxWatch12OEM.exe [2010-11-25 219632] S2 SkypeUpdate;Skype Updater;C:\Program Files (x86)\Skype\Updater\Updater.exe [2012-2-15 158856] S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-4-4 250056] S3 AthDfu;Atheros Valkyrie USB BootROM;C:\Windows\system32\Drivers\AthDfu.sys –> C:\Windows\system32\Drivers\AthDfu.sys [?] S3 bdsandbox;bdsandbox;\??\C:\Windows\system32\drivers\bdsandbox.sys –> C:\Windows\system32\drivers\bdsandbox.sys [?] S3 EvolveVirtualAdapter;Evolve Virtual Miniport Driver;C:\Windows\system32\DRIVERS\evolve.sys –> C:\Windows\system32\DRIVERS\evolve.sys [?] S3 gupdatem;Google Update Service (gupdatem);C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2012-3-3 136176] S3 Impcd;Impcd;C:\Windows\system32\DRIVERS\Impcd.sys –> C:\Windows\system32\DRIVERS\Impcd.sys [?] S3 MozillaMaintenance;Mozilla Maintenance Service;C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe [2012-7-27 113120] S3 osppsvc;Office Software Protection Platform;C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-1-9 4925184] S3 RoxMediaDB12OEM;RoxMediaDB12OEM;C:\Program Files (x86)\Common Files\Roxio Shared\OEM\12.0\SharedCOM\RoxMediaDB12OEM.exe [2010-11-25 1116656] S3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;C:\Windows\system32\Drivers\RtsUStor.sys –> C:\Windows\system32\Drivers\RtsUStor.sys [?] S3 SafeBox;SafeBox;C:\Program Files\Bitdefender\Bitdefender Safebox\safeboxservice.exe [2011-12-22 75384] S3 TsUsbFlt;TsUsbFlt;C:\Windows\system32\drivers\tsusbflt.sys –> C:\Windows\system32\drivers\tsusbflt.sys [?] S3 Update Server;BitDefender Update Server v2;C:\Program Files\Common Files\Bitdefender\Bitdefender Arrakis Server\bin\arrakis3.exe [2011-10-14 466736] S3 USBAAPL64;Apple Mobile USB Driver;C:\Windows\system32\Drivers\usbaapl64.sys –> C:\Windows\system32\Drivers\usbaapl64.sys [?] S3 WatAdminSvc;Windows Activation Technologies Service;C:\Windows\system32\Wat\WatAdminSvc.exe –> C:\Windows\system32\Wat\WatAdminSvc.exe [?] S4 wlcrasvc;Windows Live Mesh remote connections service;C:\Program Files\Windows Live\Mesh\wlcrasvc.exe [2010-9-22 57184] . =============== Created Last 30 ================ . 2012-08-01 03:13:01 ——– d—–w- C:\Users\A Southard Design.asoutharddesign\AppData\Local\{5819217F-DA3B-417B-BFF6-6438193E5318} 2012-08-01 03:12:49 ——– d—–w- C:\Users\A Southard Design.asoutharddesign\AppData\Local\{2725364E-44F9-4963-BDDD-F506E5FCC4FB} 2012-08-01 02:15:05 69000 —-a-w- C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{299B91E4-2B56-4826-A555-5611D86A8ADF}\offreg.dll 2012-08-01 01:35:57 9133488 —-a-w- C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{299B91E4-2B56-4826-A555-5611D86A8ADF}\mpengine.dll 2012-07-31 15:08:20 ——– d—–w- C:\Users\A Southard Design.asoutharddesign\AppData\Local\{1380FEBE-F89C-4AF7-930B-C55FF04039AA} 2012-07-31 15:08:07 ——– d—–w- C:\Users\A Southard Design.asoutharddesign\AppData\Local\{A4D15B3D-682A-4617-87AC-79FF83D223C7} 2012-07-31 09:22:19 ——– d—–w- C:\Users\A Southard Design.asoutharddesign\AppData\Local\{40400F17-B325-4042-82F6-4AFD865799DA} 2012-07-30 21:03:51 ——– d—–w- C:\Users\A Southard Design.asoutharddesign\AppData\Local\{2BCF3711-ABC4-4766-86F7-9420427E776F} 2012-07-30 21:03:37 ——– d—–w- C:\Users\A Southard Design.asoutharddesign\AppData\Local\{6FF7B2A4-BCE7-411C-90CA-265DF5E4E952} 2012-07-29 16:12:12 ——– d—–w- C:\Users\A Southard Design.asoutharddesign\AppData\Local\{8FB0BA6C-91E9-41CC-B33B-5DAF2E22A6BC} 2012-07-29 16:11:00 ——– d—–w- C:\Users\A Southard Design.asoutharddesign\AppData\Local\{2D0A9515-3882-45B3-B668-439FAD069410} 2012-07-28 23:30:07 ——– d—–w- C:\Users\A Southard Design.asoutharddesign\AppData\Local\{AA8E7A19-8237-4C29-8C77-8EB7645A3F1F} 2012-07-28 23:29:55 ——– d—–w- C:\Users\A Southard Design.asoutharddesign\AppData\Local\{959F7B1B-5715-4978-84FA-C66AFDC5BDD7} 2012-07-28 09:51:17 ——– d—–w- C:\Users\A Southard Design.asoutharddesign\AppData\Local\{803F68CF-2E43-4772-A3BE-931DB2B906F1} 2012-07-28 09:51:04 ——– d—–w- C:\Users\A Southard Design.asoutharddesign\AppData\Local\{83F33468-9368-4BF8-9131-108C02834E61} 2012-07-27 04:48:31 57976 —-a-r- C:\Windows\System32\drivers\SBREDrv.sys 2012-07-27 04:48:27 ——– d—–w- C:\ProgramData\STOPzilla! 2012-07-27 04:48:27 ——– d—–w- C:\Program Files (x86)\STOPzilla! 2012-07-27 04:48:27 ——– d—–w- C:\Program Files (x86)\Common Files\iS3 2012-07-27 04:33:57 388096 —-a-r- C:\Users\A Southard Design.asoutharddesign\AppData\Roaming\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe 2012-07-27 04:33:54 ——– d—–w- C:\Program Files (x86)\Trend Micro 2012-07-27 04:21:37 ——– d—–w- C:\Users\A Southard Design.asoutharddesign\AppData\Local\Macromedia 2012-07-27 04:19:49 ——– d—–w- C:\Users\A Southard Design.asoutharddesign\AppData\Local\Mozilla 2012-07-26 23:05:40 ——– d—–w- C:\Users\A Southard Design.asoutharddesign\AppData\Local\{849E355B-6D71-4494-A389-BCB653CD00A0} 2012-07-26 23:05:28 ——– d—–w- C:\Users\A Southard Design.asoutharddesign\AppData\Local\{E2D140EA-1E38-4364-B50B-463B554D61BE} 2012-07-26 19:20:43 ——– d—–w- C:\Users\A Southard Design.asoutharddesign\AppData\Local\{6A1988E2-E635-4990-B640-22408D5D27D8} 2012-07-26 19:18:46 ——– d—–w- C:\Users\A Southard Design.asoutharddesign\AppData\Local\{3F52C618-8C40-47AC-90D1-C6AD9978B298} 2012-07-25 20:59:58 ——– d—–w- C:\Users\A Southard Design.asoutharddesign\AppData\Local\{79862248-9CD0-4394-8469-792C168FC526} 2012-07-25 03:17:58 ——– d—–w- C:\Users\A Southard Design.asoutharddesign\AppData\Local\{5ED23088-2725-47E8-940D-317851A7FD8D} 2012-07-25 03:17:47 ——– d—–w- C:\Users\A Southard Design.asoutharddesign\AppData\Local\{1D5007F3-3962-4A1A-BE9B-EBD8E4F76CE9} 2012-07-24 15:16:38 ——– d—–w- C:\Users\A Southard Design.asoutharddesign\AppData\Local\{ADD40946-A8E9-47AF-879E-E991F7CDC0AD} 2012-07-24 15:16:23 ——– d—–w- C:\Users\A Southard Design.asoutharddesign\AppData\Local\{BD1A2538-F882-44E7-B4D3-57F0846BF94E} 2012-07-23 22:38:10 ——– d—–w- C:\Users\A Southard Design.asoutharddesign\AppData\Local\{7735B990-CC5D-4CDA-AB67-6D1D402841D2} 2012-07-23 22:37:54 ——– d—–w- C:\Users\A Southard Design.asoutharddesign\AppData\Local\{CD4BC138-FE2A-4F37-82E0-75DBB55D4165} 2012-07-23 03:09:41 ——– d—–w- C:\Users\A Southard Design.asoutharddesign\AppData\Local\{35CC68D2-DBAA-4ABE-9272-F59A9B14B4C2} 2012-07-23 03:09:29 ——– d—–w- C:\Users\A Southard Design.asoutharddesign\AppData\Local\{8A9FDDB5-A23C-4969-B83A-480FBFC5862A} 2012-07-22 14:22:07 ——– d—–w- C:\Users\A Southard Design.asoutharddesign\AppData\Local\{FA51A7A2-D7D0-43C5-8B11-51D096F512B4} 2012-07-22 14:21:42 ——– d—–w- C:\Users\A Southard Design.asoutharddesign\AppData\Local\{331807DA-60B8-4303-B2F1-7BB98ECFFB7F} 2012-07-21 21:35:40 ——– d—–w- C:\Users\A Southard Design.asoutharddesign\AppData\Local\{2A4E4A54-30B9-4071-AF35-798667B416E8} 2012-07-21 21:35:05 ——– d—–w- C:\Users\A Southard Design.asoutharddesign\AppData\Local\{D9F5F4C8-E7ED-43D0-A485-12E2C976CCD9} 2012-07-21 08:11:36 ——– d—–w- C:\Users\A Southard Design.asoutharddesign\AppData\Local\{4948F8BA-94C2-4672-9571-3AFBF7BA9F5B} 2012-07-21 00:31:44 ——– d—–w- C:\Users\A Southard Design.asoutharddesign\AppData\Local\{2F60DAC6-5A65-4E02-BCEF-B7353969A629} 2012-07-20 11:13:50 ——– d—–w- C:\Users\A Southard Design.asoutharddesign\AppData\Local\{B692D3D7-D5B7-4AFB-AAA1-D4BE986EF8C6} 2012-07-20 11:13:19 ——– d—–w- C:\Users\A Southard Design.asoutharddesign\AppData\Local\{1F4A55B2-2A1C-4528-B93B-C6EB6BA85C08} 2012-07-19 21:13:00 ——– d—–w- C:\Users\A Southard Design.asoutharddesign\AppData\Local\{7EA71847-B72F-4EB4-9DC3-3FE32AC78C6C} 2012-07-19 21:11:21 ——– d—–w- C:\Users\A Southard Design.asoutharddesign\AppData\Local\{8DD6F395-FA63-425B-9BF6-C7157482F869} 2012-07-19 09:07:19 ——– d—–w- C:\Users\A Southard Design.asoutharddesign\AppData\Local\{95AE3DA9-51AD-4BB0-868E-6208E46DA323} 2012-07-18 19:05:10 ——– d—–w- C:\Users\A Southard Design.asoutharddesign\AppData\Local\{F0157D06-51D6-4ADD-8C19-113C053B25C8} 2012-07-18 19:04:59 ——– d—–w- C:\Users\A Southard Design.asoutharddesign\AppData\Local\{ABD89C58-4328-444C-A641-A0D8BCD8B83E} 2012-07-18 16:50:04 ——– d—–w- C:\ProgramData\Tarma Installer 2012-07-18 16:49:58 ——– d—–w- C:\Program Files (x86)\Smart PC Cleaner 2012-07-18 06:10:16 ——– d—–w- C:\Users\A Southard Design.asoutharddesign\AppData\Local\{C4DEAB80-7E8E-4F41-B94E-395AEBB55BE1} 2012-07-18 06:10:03 ——– d—–w- C:\Users\A Southard Design.asoutharddesign\AppData\Local\{6AF92F12-93C8-4DE4-BE01-8CA5E8651E48} 2012-07-17 15:17:53 ——– d—–w- C:\Users\A Southard Design.asoutharddesign\AppData\Local\{AF936FF6-0FE8-4EF8-9AC5-5722F67B103A} 2012-07-17 15:17:25 ——– d—–w- C:\Users\A Southard Design.asoutharddesign\AppData\Local\{0C9C7F52-966B-4821-B85E-5F27617546BC} 2012-07-16 17:14:04 ——– d—–w- C:\Users\A Southard Design.asoutharddesign\AppData\Local\{82907994-D672-4720-B7DF-A0FF349AD6DA} 2012-07-16 17:13:53 ——– d—–w- C:\Users\A Southard Design.asoutharddesign\AppData\Local\{8EF90BD0-E612-455F-AEA3-9C185BCB56D4} 2012-07-16 05:13:37 ——– d—–w- C:\Users\A Southard Design.asoutharddesign\AppData\Local\{2D518F4C-26D5-44CB-9F85-BBD2498F475D} 2012-07-16 05:13:26 ——– d—–w- C:\Users\A Southard Design.asoutharddesign\AppData\Local\{4CE5CDB2-DAF1-48F0-8594-C6527AF301D2} 2012-07-15 17:12:52 ——– d—–w- C:\Users\A Southard Design.asoutharddesign\AppData\Local\{5B9198E9-2808-44E0-968B-03088C9951CD} 2012-07-15 17:12:38 ——– d—–w- C:\Users\A Southard Design.asoutharddesign\AppData\Local\{91CB5ADE-143B-4A77-9BC4-7348CDD9D70C} 2012-07-15 05:12:51 ——– d—–w- C:\Users\A Southard Design.asoutharddesign\AppData\Local\{80356D07-9A62-488E-8C01-73D7FCA53FDC} 2012-07-14 16:26:08 ——– d—–w- C:\Users\A Southard Design.asoutharddesign\AppData\Local\{8B5A7348-FD3C-4EFB-A376-DD616BF8F0C3} 2012-07-14 16:25:35 ——– d—–w- C:\Users\A Southard Design.asoutharddesign\AppData\Local\{97360A56-26AE-4716-A224-C365D22BB5F1} 2012-07-14 02:13:40 ——– d—–w- C:\Users\A Southard Design.asoutharddesign\AppData\Local\{3D82E14E-33BE-4097-9C20-56C79DBC4022} 2012-07-14 02:13:28 ——– d—–w- C:\Users\A Southard Design.asoutharddesign\AppData\Local\{264A50E8-D78B-47FF-9404-B96CCB66A4DA} 2012-07-13 14:14:03 ——– d—–w- C:\Users\A Southard Design.asoutharddesign\AppData\Local\{4D362718-19B1-4FC1-B176-082E75BE8D93} 2012-07-12 21:37:57 ——– d—–w- C:\Users\A Southard Design.asoutharddesign\AppData\Local\{C981DD00-7675-409E-A42B-7CA49C3D18A4} 2012-07-12 21:37:44 ——– d—–w- C:\Users\A Southard Design.asoutharddesign\AppData\Local\{228CF911-9AB4-49CF-9F32-81AFA6B260D8} 2012-07-12 02:54:41 3148800 —-a-w- C:\Windows\System32\win32k.sys 2012-07-11 19:17:37 805376 —-a-w- C:\Windows\SysWow64\cdosys.dll 2012-07-11 19:17:37 495616 —-a-w- C:\Program Files\Common Files\System\ado\msadox.dll 2012-07-11 19:17:37 466944 —-a-w- C:\Program Files\Common Files\System\ado\msadomd.dll 2012-07-11 19:17:37 258048 —-a-w- C:\Program Files\Common Files\System\msadc\msadco.dll 2012-07-11 19:17:37 1499136 —-a-w- C:\Program Files\Common Files\System\ado\msado15.dll 2012-07-11 19:17:37 1019904 —-a-w- C:\Program Files (x86)\Common Files\System\ado\msado15.dll 2012-07-11 19:17:36 61440 —-a-w- C:\Program Files\Common Files\System\ado\msador15.dll 2012-07-11 19:17:36 57344 —-a-w- C:\Program Files (x86)\Common Files\System\ado\msador15.dll 2012-07-11 19:17:36 372736 —-a-w- C:\Program Files (x86)\Common Files\System\ado\msadox.dll 2012-07-11 19:17:36 352256 —-a-w- C:\Program Files (x86)\Common Files\System\ado\msadomd.dll 2012-07-11 19:17:36 212992 —-a-w- C:\Program Files (x86)\Common Files\System\msadc\msadco.dll 2012-07-11 19:17:36 143360 —-a-w- C:\Program Files (x86)\Common Files\System\ado\msjro.dll 2012-07-11 19:17:36 1133568 —-a-w- C:\Windows\System32\cdosys.dll 2012-07-11 16:47:26 ——– d—–w- C:\Users\A Southard Design.asoutharddesign\AppData\Local\{53B236A0-3634-4378-BCA1-68D5316D3331} 2012-07-11 16:47:12 ——– d—–w- C:\Users\A Southard Design.asoutharddesign\AppData\Local\{F8E59A22-F718-4DD3-B81D-C2E8DC4204A6} 2012-07-11 03:59:09 ——– d—–w- C:\Users\A Southard Design.asoutharddesign\AppData\Local\{3AD433D2-9D0E-4A55-B37E-CD9C0441C686} 2012-07-11 03:58:58 ——– d—–w- C:\Users\A Southard Design.asoutharddesign\AppData\Local\{5637284B-723A-4446-ACE7-1A4745227B41} 2012-07-10 15:58:40 ——– d—–w- C:\Users\A Southard Design.asoutharddesign\AppData\Local\{DF346790-EDEA-4290-B705-258A6FC1EC47} 2012-07-10 15:58:25 ——– d—–w- C:\Users\A Southard Design.asoutharddesign\AppData\Local\{C3E8EF54-C717-43A5-A646-6AFB56B5D450} 2012-07-10 03:51:41 ——– d—–w- C:\Users\A Southard Design.asoutharddesign\AppData\Local\{FDDE164C-918F-47A8-830C-BB0B6809A2CA} 2012-07-10 03:51:30 ——– d—–w- C:\Users\A Southard Design.asoutharddesign\AppData\Local\{9633962E-A21C-43C7-AEF7-E5BB0966B19A} 2012-07-09 10:51:39 ——– d—–w- C:\Users\A Southard Design.asoutharddesign\AppData\Local\{BDB72AAE-6227-4E6A-908F-CC89F89DE2FE} 2012-07-08 19:45:11 ——– d—–w- C:\Users\A Southard Design.asoutharddesign\AppData\Local\{B5FAD673-84B1-4953-95FE-12B855843A4C} 2012-07-08 19:44:58 ——– d—–w- C:\Users\A Southard Design.asoutharddesign\AppData\Local\{1D36CE51-EDF7-41A8-B0F9-2E8AC49504B5} 2012-07-06 21:05:34 ——– d—–w- C:\Users\A Southard Design.asoutharddesign\AppData\Local\{A6710E19-2A69-486C-84A8-8B8728DF9023} 2012-07-06 21:05:20 ——– d—–w- C:\Users\A Southard Design.asoutharddesign\AppData\Local\{0DA3FA4A-DAD9-4325-9479-328F598B5A24} 2012-07-05 23:34:09 ——– d—–w- C:\Users\A Southard Design.asoutharddesign\AppData\Local\{8C8871A1-BE3B-4AD2-847B-79860CB365ED} 2012-07-05 23:32:57 ——– d—–w- C:\Users\A Southard Design.asoutharddesign\AppData\Local\{367B2F51-02BD-42E5-8C00-BB55B9B37A2E} 2012-07-04 15:26:07 ——– d—–w- C:\Users\A Southard Design.asoutharddesign\AppData\Local\{4A50839D-02B4-456F-B1A0-BD2D2D8FF5CB} 2012-07-04 15:25:55 ——– d—–w- C:\Users\A Southard Design.asoutharddesign\AppData\Local\{F0744F18-B3C0-4A49-8B4D-AC515F74F7DB} 2012-07-04 03:25:40 ——– d—–w- C:\Users\A Southard Design.asoutharddesign\AppData\Local\{D52775F3-21AE-4F1F-96B1-A5943E7122EA} 2012-07-04 03:25:29 ——– d—–w- C:\Users\A Southard Design.asoutharddesign\AppData\Local\{98CB33A1-4D12-46FA-94FC-6ECE75071C82} 2012-07-03 15:38:39 ——– d—–w- C:\Users\A Southard Design.asoutharddesign\AppData\Local\Ilivid Player 2012-07-03 15:25:00 ——– d—–w- C:\Users\A Southard Design.asoutharddesign\AppData\Local\{5D1622D0-46E6-40B8-9983-F5AEBB4A44B8} 2012-07-03 15:24:44 ——– d—–w- C:\Users\A Southard Design.asoutharddesign\AppData\Local\{14D0F80E-C1C8-4C8A-AE29-0B2D893C6C19} 2012-07-03 02:48:59 ——– d—–w- C:\Users\A Southard Design.asoutharddesign\AppData\Local\{00CC2A97-C29C-489F-A125-890E82226E85} 2012-07-03 02:48:48 ——– d—–w- C:\Users\A Southard Design.asoutharddesign\AppData\Local\{7EC875D4-B4AC-46B0-984C-8320755D2C81} 2012-07-02 16:02:39 ——– d—–w- C:\Windows\SysWow64\directx 2012-07-02 16:01:50 21656 —-a-w- C:\Windows\System32\drivers\evolve.sys 2012-07-02 16:01:25 ——– d—–w- C:\Program Files\Echobit 2012-07-02 15:59:28 ——– d—–w- C:\ProgramData\Echobit 2012-07-02 15:59:04 ——– d—–w- C:\Users\A Southard Design.asoutharddesign\AppData\Local\Echobit 2012-07-02 14:48:04 ——– d—–w- C:\Users\A Southard Design.asoutharddesign\AppData\Local\{3046A273-3682-4D98-A495-C576C1C20F00} 2012-07-02 14:47:41 ——– d—–w- C:\Users\A Southard Design.asoutharddesign\AppData\Local\{920DB1A4-A069-4B9F-B0A6-0ED859BBE521} . ==================== Find3M ==================== . 2012-07-27 04:24:11 70344 —-a-w- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl 2012-07-27 04:24:11 426184 —-a-w- C:\Windows\SysWow64\FlashPlayerApp.exe 2012-06-06 06:06:16 2004480 —-a-w- C:\Windows\System32\msxml6.dll 2012-06-06 06:06:16 1881600 —-a-w- C:\Windows\System32\msxml3.dll 2012-06-06 05:05:52 1390080 —-a-w- C:\Windows\SysWow64\msxml6.dll 2012-06-06 05:05:52 1236992 —-a-w- C:\Windows\SysWow64\msxml3.dll 2012-06-02 22:15:31 2622464 —-a-w- C:\Windows\System32\wucltux.dll 2012-06-02 22:15:08 99840 —-a-w- C:\Windows\System32\wudriver.dll 2012-06-02 19:19:42 186752 —-a-w- C:\Windows\System32\wuwebv.dll 2012-06-02 19:15:12 36864 —-a-w- C:\Windows\System32\wuapp.exe 2012-06-02 12:12:17 2311680 —-a-w- C:\Windows\System32\jscript9.dll 2012-06-02 12:05:28 1392128 —-a-w- C:\Windows\System32\wininet.dll 2012-06-02 12:04:50 1494528 —-a-w- C:\Windows\System32\inetcpl.cpl 2012-06-02 12:01:40 173056 —-a-w- C:\Windows\System32\ieUnatt.exe 2012-06-02 11:57:08 2382848 —-a-w- C:\Windows\System32\mshtml.tlb 2012-06-02 08:33:25 1800192 —-a-w- C:\Windows\SysWow64\jscript9.dll 2012-06-02 08:25:08 1129472 —-a-w- C:\Windows\SysWow64\wininet.dll 2012-06-02 08:25:03 1427968 —-a-w- C:\Windows\SysWow64\inetcpl.cpl 2012-06-02 08:20:33 142848 —-a-w- C:\Windows\SysWow64\ieUnatt.exe 2012-06-02 08:16:52 2382848 —-a-w- C:\Windows\SysWow64\mshtml.tlb 2012-06-02 05:50:10 458704 —-a-w- C:\Windows\System32\drivers\cng.sys 2012-06-02 05:48:16 95600 —-a-w- C:\Windows\System32\drivers\ksecdd.sys 2012-06-02 05:48:16 151920 —-a-w- C:\Windows\System32\drivers\ksecpkg.sys 2012-06-02 05:45:31 340992 —-a-w- C:\Windows\System32\schannel.dll 2012-06-02 05:44:21 307200 —-a-w- C:\Windows\System32\ncrypt.dll 2012-06-02 04:40:42 22016 —-a-w- C:\Windows\SysWow64\secur32.dll 2012-06-02 04:40:39 225280 —-a-w- C:\Windows\SysWow64\schannel.dll 2012-06-02 04:39:10 219136 —-a-w- C:\Windows\SysWow64\ncrypt.dll 2012-06-02 04:34:09 96768 —-a-w- C:\Windows\SysWow64\sspicli.dll 2012-05-31 16:25:12 279656 ——w- C:\Windows\System32\MpSigStub.exe 2012-05-04 11:06:22 5559664 —-a-w- C:\Windows\System32\ntoskrnl.exe 2012-05-04 11:00:43 366592 —-a-w- C:\Windows\System32\qdvd.dll 2012-05-04 10:03:53 3968368 —-a-w- C:\Windows\SysWow64\ntkrnlpa.exe 2012-05-04 10:03:50 3913072 —-a-w- C:\Windows\SysWow64\ntoskrnl.exe 2012-05-04 09:59:54 514560 —-a-w- C:\Windows\SysWow64\qdvd.dll . ============= FINISH: 1:42:41.61 ===============

Attachments:

Post #4
second part of your request. aswMBR version 0.9.9.1665 Copyright© 2011 AVAST Software Run date: 2012-08-01 01:47:42 —————————– 01:47:42.391 OS Version: Windows x64 6.1.7601 Service Pack 1 01:47:42.391 Number of processors: 2 586 0x2A07 01:47:42.401 ComputerName: ASOUTHARDDESIGN UserName: 01:47:43.661 Initialize success 01:48:27.842 AVAST engine defs: 12073102 01:48:42.670 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1 01:48:42.686 Disk 0 Vendor: SAMSUNG_ 2AJ1 Size: 305245MB BusType: 3 01:48:42.702 Disk 0 MBR read successfully 01:48:42.702 Disk 0 MBR scan 01:48:42.795 Disk 0 Windows VISTA default MBR code 01:48:42.795 Disk 0 Partition 1 00 DE Dell Utility Dell 8.0 101 MB offset 63 01:48:42.856 Disk 0 Partition 2 80 (A) 07 HPFS/NTFS NTFS 15000 MB offset 208845 01:48:42.876 Disk 0 Partition 3 00 07 HPFS/NTFS NTFS 290142 MB offset 30928845 01:48:42.916 Disk 0 scanning C:\Windows\system32\drivers 01:48:59.599 Service scanning 01:49:33.688 Modules scanning 01:49:33.704 Disk 0 trace - called modules: 01:49:33.719 01:49:34.421 AVAST engine scan C:\Windows 01:49:36.808 AVAST engine scan C:\Windows\system32 01:54:32.478 AVAST engine scan C:\Windows\system32\drivers 01:54:51.066 AVAST engine scan C:\Users\A Southard Design.asoutharddesign 01:57:57.050 Disk 0 MBR has been saved successfully to "C:\Users\A Southard Design.asoutharddesign\Desktop\MBR.dat" 01:57:57.057 The log file has been saved successfully to "C:\Users\A Southard Design.asoutharddesign\Desktop\aswMBR.txt"

Attachments:

Post #5
Hi nikid506,

You are very welcome :).

Please do the following

Refer to the ComboFix User's Guide

  • Download ComboFix from one of these locations:

    Link 1
    Link 2

    * IMPORTANT !!! Place ComboFix.exe on your Desktop
  • Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with ComboFix.
    You can get help on disabling your protection programs here
  • Double click on ComboFix.exe & follow the prompts.
  • Your desktop may go blank. This is normal. It will return when ComboFix is done. ComboFix may reboot your machine. This is normal.
  • When finished, it shall produce a log for you. Post that log in your next reply

    Note:
    Do not mouseclick combofix's window whilst it's running. That may cause it to stall.

    ———————————————————————————————
  • Ensure your AntiVirus and AntiSpyware applications are re-enabled.

    ———————————————————————————————

NOTE: If you encounter a message "illegal operation attempted on registry key that has been marked for deletion" and no programs will run - please just reboot and that will resolve that error.
Post #6
combo fix ComboFix 12-07-31.03 - A Southard Design 08/02/2012 0:39.1.2 - x64 Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.4010.1853 [GMT -4:00] Running from: c:\users\[removed]\Downloads\ComboFix.exe AV: Bitdefender Antivirus *Enabled/Updated* {50909708-FF80-02AF-F814-B28405891E92} FW: Bitdefender Firewall *Disabled* {68AB162D-B5EF-03F7-D34B-1BB1FB5A59E9} SP: Bitdefender Antispyware *Enabled/Updated* {EBF176EC-D9BA-0D21-C2A4-89F67E0E542F} SP: STOPzilla Anti-Spyware *Enabled/Updated* {B2E69928-50DC-94CA-6A80-AAB054008761} SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} . . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . . c:\program files (x86)\RadioRage_4jEI c:\program files (x86)\RadioRage_4jEI\Installr\1.bin\4jEIPlug.dll c:\program files (x86)\RadioRage_4jEI\Installr\1.bin\4jEZSETP.dll c:\program files (x86)\RadioRage_4jEI\Installr\1.bin\NP4jEISb.dll c:\program files\PrivacySafeGuard\PrIVacysafeguard.dll c:\programdata\1324527263.bdinstall.bin c:\programdata\PCDr\5907\Downloads\246b20c1-8ea9-4148-a34e-d03c8a1d5a76.dll c:\programdata\PCDr\5907\Downloads\27e5bc9a-105f-4d7f-8352-e6ef1c8933dd.dll c:\programdata\PCDr\5907\Downloads\a2192d8a-3d73-4ff7-be9b-02134f41db63.dll c:\windows\SysWow64\URTTemp c:\windows\SysWow64\URTTemp\regtlib.exe . . ((((((((((((((((((((((((( Files Created from 2012-07-02 to 2012-08-02 ))))))))))))))))))))))))))))))) . . 2012-08-02 04:53 . 2012-08-02 04:53 ——– d—–w- c:\users\Default\AppData\Local\temp 2012-08-02 04:53 . 2012-08-02 04:53 ——– d—–w- c:\users\a southard design\AppData\Local\temp 2012-08-02 04:53 . 2012-08-02 04:53 ——– d—–w- c:\users\Ryan\AppData\Local\temp 2012-08-01 02:15 . 2012-08-02 04:39 69000 —-a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{299B91E4-2B56-4826-A555-5611D86A8ADF}\offreg.dll 2012-08-01 01:35 . 2012-06-29 10:04 9133488 —-a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{299B91E4-2B56-4826-A555-5611D86A8ADF}\mpengine.dll 2012-07-27 04:48 . 2012-01-12 13:28 57976 —-a-r- c:\windows\system32\drivers\SBREDrv.sys 2012-07-27 04:48 . 2012-08-02 04:30 ——– d—–w- c:\programdata\STOPzilla! 2012-07-27 04:48 . 2012-07-27 04:49 ——– d—–w- c:\program files (x86)\STOPzilla! 2012-07-27 04:48 . 2012-07-27 04:48 ——– d—–w- c:\program files (x86)\Common Files\iS3 2012-07-27 04:33 . 2012-07-27 04:33 388096 —-a-r- c:\users\A Southard Design.asoutharddesign\AppData\Roaming\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe 2012-07-27 04:33 . 2012-07-27 04:33 ——– d—–w- c:\program files (x86)\Trend Micro 2012-07-27 04:21 . 2012-07-27 04:21 ——– d—–w- c:\users\A Southard Design.asoutharddesign\AppData\Local\Macromedia 2012-07-27 04:19 . 2012-07-27 04:19 ——– d—–w- c:\users\A Southard Design.asoutharddesign\AppData\Local\Mozilla 2012-07-27 04:18 . 2012-08-01 01:24 ——– d—–w- c:\program files (x86)\Mozilla Maintenance Service 2012-07-27 04:18 . 2012-08-02 04:51 ——– d—–w- c:\program files\PrivacySafeGuard 2012-07-25 16:34 . 2012-07-25 16:34 ——– d—–w- c:\users\Mia\AppData\Local\Apple Computer 2012-07-25 16:33 . 2012-07-25 16:33 ——– d—–w- c:\users\Mia\AppData\Local\CrashDumps 2012-07-18 16:50 . 2012-07-23 01:23 ——– d—–w- c:\programdata\Tarma Installer 2012-07-18 16:49 . 2012-07-23 01:21 ——– d—–w- c:\program files (x86)\Smart PC Cleaner 2012-07-12 02:54 . 2012-06-12 03:08 3148800 —-a-w- c:\windows\system32\win32k.sys 2012-07-11 19:18 . 2012-06-09 05:43 14172672 —-a-w- c:\windows\system32\shell32.dll 2012-07-11 19:17 . 2012-06-06 06:05 495616 —-a-w- c:\program files\Common Files\System\ado\msadox.dll 2012-07-11 19:17 . 2012-06-06 06:05 466944 —-a-w- c:\program files\Common Files\System\ado\msadomd.dll 2012-07-11 19:17 . 2012-06-06 06:05 1499136 —-a-w- c:\program files\Common Files\System\ado\msado15.dll 2012-07-11 19:17 . 2012-06-06 06:05 258048 —-a-w- c:\program files\Common Files\System\msadc\msadco.dll 2012-07-11 19:17 . 2012-06-06 05:05 1019904 —-a-w- c:\program files (x86)\Common Files\System\ado\msado15.dll 2012-07-11 19:17 . 2012-06-06 05:03 805376 —-a-w- c:\windows\SysWow64\cdosys.dll 2012-07-11 19:17 . 2012-06-06 06:05 61440 —-a-w- c:\program files\Common Files\System\ado\msador15.dll 2012-07-11 19:17 . 2012-06-06 06:02 1133568 —-a-w- c:\windows\system32\cdosys.dll 2012-07-11 19:17 . 2012-06-06 05:05 143360 —-a-w- c:\program files (x86)\Common Files\System\ado\msjro.dll 2012-07-11 19:17 . 2012-06-06 05:05 372736 —-a-w- c:\program files (x86)\Common Files\System\ado\msadox.dll 2012-07-11 19:17 . 2012-06-06 05:05 57344 —-a-w- c:\program files (x86)\Common Files\System\ado\msador15.dll 2012-07-11 19:17 . 2012-06-06 05:05 352256 —-a-w- c:\program files (x86)\Common Files\System\ado\msadomd.dll 2012-07-11 19:17 . 2012-06-06 05:05 212992 —-a-w- c:\program files (x86)\Common Files\System\msadc\msadco.dll 2012-07-11 03:53 . 2012-07-11 03:53 ——– d—–w- c:\users\Mia\AppData\Roaming\.minecraft 2012-07-03 15:38 . 2012-07-03 15:38 ——– d—–w- c:\users\A Southard Design.asoutharddesign\AppData\Local\Ilivid Player . . . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2012-07-29 02:22 . 2012-07-29 02:23 416 —-a-w- c:\windows\Fonts\HARRINGT.pfm 2012-07-27 04:24 . 2012-04-04 10:38 426184 —-a-w- c:\windows\SysWow64\FlashPlayerApp.exe 2012-07-27 04:24 . 2011-10-11 17:37 70344 —-a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl 2012-07-12 02:52 . 2011-10-03 17:12 59701280 —-a-w- c:\windows\system32\MRT.exe 2012-07-02 16:01 . 2012-07-02 16:01 21656 —-a-w- c:\windows\system32\drivers\evolve.sys 2012-06-02 22:19 . 2012-06-19 10:13 38424 —-a-w- c:\windows\system32\wups.dll 2012-06-02 22:19 . 2012-06-19 10:13 2428952 —-a-w- c:\windows\system32\wuaueng.dll 2012-06-02 22:19 . 2012-06-19 10:13 57880 —-a-w- c:\windows\system32\wuauclt.exe 2012-06-02 22:19 . 2012-06-19 10:13 44056 —-a-w- c:\windows\system32\wups2.dll 2012-06-02 22:19 . 2012-06-19 10:13 701976 —-a-w- c:\windows\system32\wuapi.dll 2012-06-02 22:15 . 2012-06-19 10:13 2622464 —-a-w- c:\windows\system32\wucltux.dll 2012-06-02 22:15 . 2012-06-19 10:13 99840 —-a-w- c:\windows\system32\wudriver.dll 2012-06-02 19:19 . 2012-06-19 10:13 186752 —-a-w- c:\windows\system32\wuwebv.dll 2012-06-02 19:15 . 2012-06-19 10:13 36864 —-a-w- c:\windows\system32\wuapp.exe 2012-05-31 16:25 . 2011-11-02 04:31 279656 ——w- c:\windows\system32\MpSigStub.exe 2012-05-04 11:06 . 2012-06-13 02:19 5559664 —-a-w- c:\windows\system32\ntoskrnl.exe 2012-05-04 11:00 . 2012-06-30 19:51 366592 —-a-w- c:\windows\system32\qdvd.dll 2012-05-04 10:03 . 2012-06-13 02:19 3968368 —-a-w- c:\windows\SysWow64\ntkrnlpa.exe 2012-05-04 10:03 . 2012-06-13 02:19 3913072 —-a-w- c:\windows\SysWow64\ntoskrnl.exe 2012-05-04 09:59 . 2012-06-30 19:51 514560 —-a-w- c:\windows\SysWow64\qdvd.dll . . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 . [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "MobileDocuments"="c:\program files (x86)\Common Files\Apple\Internet Services\ubd.exe" [2012-02-23 59240] "Facebook Update"="c:\users\A Southard Design.asoutharddesign\AppData\Local\Facebook\Update\FacebookUpdate.exe" [2012-07-12 138096] . [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] "Adobe Reader Speed Launcher"="c:\program files (x86)\Adobe\Reader 10.0\Reader\Reader_sl.exe" [2012-04-04 35736] "Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-01-03 843712] "Dell Webcam Central"="c:\program files (x86)\Dell Webcam\Dell Webcam Central\WebcamDell2.exe" [2010-08-19 487562] "Dell DataSafe Online"="c:\program files (x86)\Dell\Dell Datasafe Online\NOBuClient.exe" [2010-08-26 1117528] "RoxWatchTray"="c:\program files (x86)\Common Files\Roxio Shared\OEM\12.0\SharedCOM\RoxWatchTray12OEM.exe" [2010-11-25 240112] "Desktop Disc Tool"="c:\program files (x86)\Roxio\OEM\Roxio Burn\RoxioBurnLauncher.exe" [2010-11-17 514544] "APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2012-05-31 59280] "AgentMonitor"="c:\program files (x86)\VTech\DownloadManager\System\AgentMonitor.exe" [2012-06-28 365512] "SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2012-01-18 254696] "AccuWeatherWidget"="c:\program files (x86)\Dell Stage\Dell Stage\AccuWeather\accuweather.exe" [2012-02-01 968048] "QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" [2012-04-19 421888] "iTunesHelper"="c:\program files (x86)\iTunes\iTunesHelper.exe" [2012-06-07 421776] . c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\ QuickBooks Update Agent.lnk - c:\program files (x86)\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe [2006-10-17 960032] . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "ConsentPromptBehaviorAdmin"= 5 (0x5) "ConsentPromptBehaviorUser"= 3 (0x3) "EnableUIADesktopToggle"= 0 (0x0) . [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa] Security Packages REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp . [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS] @="" . R0 is3srv;is3srv;c:\windows\SySWOW64\drivers\is3srv64.sys [2011-09-26 74768] R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576] R2 gupdate;Google Update Service (gupdate);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-03-03 136176] R2 RoxWatch12;Roxio Hard Drive Watcher 12;c:\program files (x86)\Common Files\Roxio Shared\OEM\12.0\SharedCOM\RoxWatch12OEM.exe [2010-11-25 219632] R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe [2012-02-15 158856] R3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-07-27 250056] R3 AthDfu;Atheros Valkyrie USB BootROM;c:\windows\System32\Drivers\AthDfu.sys [2010-12-16 51872] R3 bdsandbox;bdsandbox;c:\windows\system32\drivers\bdsandbox.sys [2012-02-03 79952] R3 EvolveVirtualAdapter;Evolve Virtual Miniport Driver;c:\windows\system32\DRIVERS\evolve.sys [2012-07-02 21656] R3 gupdatem;Google Update Service (gupdatem);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-03-03 136176] R3 Impcd;Impcd;c:\windows\system32\DRIVERS\Impcd.sys [2010-02-26 158976] R3 MozillaMaintenance;Mozilla Maintenance Service;c:\program files (x86)\Mozilla Maintenance Service\maintenanceservice.exe [2012-07-31 113120] R3 osppsvc;Office Software Protection Platform;c:\program files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-01-10 4925184] R3 RoxMediaDB12OEM;RoxMediaDB12OEM;c:\program files (x86)\Common Files\Roxio Shared\OEM\12.0\SharedCOM\RoxMediaDB12OEM.exe [2010-11-25 1116656] R3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;c:\windows\system32\Drivers\RtsUStor.sys [2010-12-01 250984] R3 SafeBox;SafeBox;c:\program files\Bitdefender\Bitdefender SafeBox\safeboxservice.exe [2012-03-02 75384] R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-20 59392] R3 Update Server;BitDefender Update Server v2;c:\program files\Common Files\Bitdefender\Bitdefender Arrakis Server\bin\arrakis3.exe [2011-10-15 466736] R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys [2012-02-15 52736] R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [2011-09-22 1255736] R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe [2010-09-22 57184] S0 avc3;avc3;c:\windows\system32\DRIVERS\avc3.sys [2012-04-06 691896] S0 PxHlpa64;PxHlpa64;c:\windows\System32\Drivers\PxHlpa64.sys [2010-03-19 55856] S0 szkg5;szkg5;c:\windows\SySWOW64\DRIVERS\szkg64.sys [2011-09-26 74768] S1 BdfNdisf;BitDefender Firewall NDIS 6 Filter Driver;c:\program files\common files\bitdefender\bitdefender firewall\bdfndisf6.sys [2011-11-15 90192] S1 bdfwfpf;bdfwfpf;c:\program files\Common Files\Bitdefender\Bitdefender Firewall\bdfwfpf.sys [2011-11-15 103504] S1 BDVEDISK;BDVEDISK;c:\windows\system32\DRIVERS\bdvedisk.sys [2010-01-19 103944] S1 SBRE;SBRE;c:\windows\system32\drivers\SBREdrv.sys [2012-01-12 57976] S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [2009-07-14 59904] S2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2012-01-03 63928] S2 AERTFilters;Andrea RT Filters Service;c:\program files\Realtek\Audio\HDA\AERTSr64.exe [2009-11-18 98208] S2 Atheros Bt&Wlan Coex Agent;Atheros Bt&Wlan Coex Agent;c:\program files (x86)\Dell Wireless\Ath_CoexAgent.exe [2010-10-01 151552] S2 AtherosSvc;AtherosSvc;c:\program files (x86)\Dell Wireless\Bluetooth Suite\adminservice.exe [2010-12-17 53920] S2 cvhsvc;Client Virtualization Handler;c:\program files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE [2012-01-04 822624] S2 NOBU;Dell DataSafe Online;c:\program files (x86)\Dell\Dell Datasafe Online\NOBuAgent.exe SERVICE [x] S2 sftlist;Application Virtualization Client;c:\program files (x86)\Microsoft Application Virtualization Client\sftlist.exe [2011-10-01 508776] S2 SftService;SoftThinks Agent Service;c:\program files (x86)\Dell DataSafe Local Backup\sftservice.EXE [2011-08-18 1692480] S2 UNS;Intel® Management and Security Application User Notification Service;c:\program files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe [2010-12-20 2656280] S2 UPDATESRV;BitDefender Desktop Update Service;c:\program files\Bitdefender\Bitdefender 2012\updatesrv.exe [2012-04-06 66096] S3 AthBTPort;Atheros Virtual Bluetooth Class;c:\windows\system32\DRIVERS\btath_flt.sys [2010-12-17 36000] S3 avchv;avchv Function Driver;c:\windows\system32\DRIVERS\avchv.sys [2011-11-25 258736] S3 avckf;avckf;c:\windows\system32\DRIVERS\avckf.sys [2012-03-02 545064] S3 BTATH_A2DP;Bluetooth A2DP Audio Driver;c:\windows\system32\drivers\btath_a2dp.sys [2010-12-17 298144] S3 BTATH_BUS;Atheros Bluetooth Bus;c:\windows\system32\DRIVERS\btath_bus.sys [2010-12-16 28832] S3 BTATH_HCRP;Bluetooth HCRP Server driver;c:\windows\system32\DRIVERS\btath_hcrp.sys [2010-12-16 201376] S3 BTATH_LWFLT;Bluetooth LWFLT Device;c:\windows\system32\DRIVERS\btath_lwflt.sys [2010-12-17 55456] S3 BTATH_RCP;Bluetooth AVRCP Device;c:\windows\system32\DRIVERS\btath_rcp.sys [2010-12-16 154272] S3 BtFilter;BtFilter;c:\windows\system32\DRIVERS\btfilter.sys [2010-12-17 275616] S3 CtClsFlt;Creative Camera Class Upper Filter Driver;c:\windows\system32\DRIVERS\CtClsFlt.sys [2010-08-12 175168] S3 IntcDAud;Intel® Display Audio;c:\windows\system32\DRIVERS\IntcDAud.sys [2010-10-15 317440] S3 MEIx64;Intel® Management Engine Interface;c:\windows\system32\DRIVERS\HECIx64.sys [2010-10-20 56344] S3 nusb3hub;Renesas Electronics USB 3.0 Hub Driver;c:\windows\system32\DRIVERS\nusb3hub.sys [2010-11-19 80384] S3 nusb3xhc;Renesas Electronics USB 3.0 Host Controller Driver;c:\windows\system32\DRIVERS\nusb3xhc.sys [2010-11-19 181248] S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [2011-06-10 539240] S3 Sftfs;Sftfs;c:\windows\system32\DRIVERS\Sftfslh.sys [2011-10-01 764264] S3 Sftplay;Sftplay;c:\windows\system32\DRIVERS\Sftplaylh.sys [2011-10-01 268648] S3 Sftredir;Sftredir;c:\windows\system32\DRIVERS\Sftredirlh.sys [2011-10-01 25960] S3 Sftvol;Sftvol;c:\windows\system32\DRIVERS\Sftvollh.sys [2011-10-01 22376] S3 sftvsa;Application Virtualization Service Agent;c:\program files (x86)\Microsoft Application Virtualization Client\sftvsa.exe [2011-10-01 219496] S3 vwifimp;Microsoft Virtual WiFi Miniport Service;c:\windows\system32\DRIVERS\vwifimp.sys [2009-07-14 17920] . . Contents of the 'Scheduled Tasks' folder . 2012-08-02 c:\windows\Tasks\Adobe Flash Player Updater.job - c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-04 04:24] . 2012-08-01 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-2729111025-2427052716-901129613-1000Core.job - c:\users\a southard design\AppData\Local\Facebook\Update\FacebookUpdate.exe [2011-12-30 20:56] . 2012-08-02 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-2729111025-2427052716-901129613-1000UA.job - c:\users\a southard design\AppData\Local\Facebook\Update\FacebookUpdate.exe [2011-12-30 20:56] . 2012-08-02 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-2729111025-2427052716-901129613-1005Core.job - c:\users\A Southard Design.asoutharddesign\AppData\Local\Facebook\Update\FacebookUpdate.exe [2012-04-29 01:11] . 2012-08-02 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-2729111025-2427052716-901129613-1005UA.job - c:\users\A Southard Design.asoutharddesign\AppData\Local\Facebook\Update\FacebookUpdate.exe [2012-04-29 01:11] . 2012-08-02 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job - c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-03-03 12:12] . 2012-08-02 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job - c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-03-03 12:12] . 2012-08-01 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2729111025-2427052716-901129613-1000Core.job - c:\users\a southard design\AppData\Local\Google\Update\GoogleUpdate.exe [2012-01-07 06:16] . 2012-08-02 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2729111025-2427052716-901129613-1000UA.job - c:\users\a southard design\AppData\Local\Google\Update\GoogleUpdate.exe [2012-01-07 06:16] . 2012-08-01 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2729111025-2427052716-901129613-1006Core.job - c:\users\Mia\AppData\Local\Google\Update\GoogleUpdate.exe [2012-07-01 19:05] . 2012-08-02 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2729111025-2427052716-901129613-1006UA.job - c:\users\Mia\AppData\Local\Google\Update\GoogleUpdate.exe [2012-07-01 19:05] . 2012-08-02 c:\windows\Tasks\PCDoctorBackgroundMonitorTask.job - c:\program files\Dell Support Center\uaclauncher.exe [2012-02-07 23:32] . 2012-08-02 c:\windows\Tasks\SystemToolsDailyTest.job - c:\program files\Dell Support Center\uaclauncher.exe [2012-02-07 23:32] . . ——— X64 Entries ———– . . [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{1036AD63-AEAC-460B-9060-C96005D4DC86}] 2012-07-19 18:14 105472 —-a-w- c:\program files\PrivacySafeGuard\PrivacySafeGuard-x64.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\__SafeBox1] @="{152C96EB-288E-4EDC-B7C6-D21F8250ADF3}" [HKEY_CLASSES_ROOT\CLSID\{152C96EB-288E-4EDC-B7C6-D21F8250ADF3}] 2012-03-02 02:12 266952 ——w- c:\program files\Bitdefender\Bitdefender Safebox\safeboxshell.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\__SafeBox2] @="{342DAA0B-D796-460D-8566-901E08A1CCAD}" [HKEY_CLASSES_ROOT\CLSID\{342DAA0B-D796-460D-8566-901E08A1CCAD}] 2012-03-02 02:12 266952 ——w- c:\program files\Bitdefender\Bitdefender Safebox\safeboxshell.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\__SafeBox3] @="{57595DAE-1AE1-4D97-A49E-67CBB53B52DF}" [HKEY_CLASSES_ROOT\CLSID\{57595DAE-1AE1-4D97-A49E-67CBB53B52DF}] 2012-03-02 02:12 266952 ——w- c:\program files\Bitdefender\Bitdefender Safebox\safeboxshell.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\__SafeBox4] @="{33816773-98AE-4723-ADE0-EBE54C8B5A67}" [HKEY_CLASSES_ROOT\CLSID\{33816773-98AE-4723-ADE0-EBE54C8B5A67}] 2012-03-02 02:12 266952 ——w- c:\program files\Bitdefender\Bitdefender Safebox\safeboxshell.dll . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "RTHDVCPL"="c:\program files\Realtek\Audio\HDA\RtkNGUI64.exe" [2010-12-14 6561384] "AtherosBtStack"="c:\program files (x86)\Dell Wireless\Bluetooth Suite\BtvStack.exe" [2010-12-17 613536] "AthBtTray"="c:\program files (x86)\Dell Wireless\Bluetooth Suite\AthBtTray.exe" [2010-12-17 379040] "QuickSet"="c:\program files\Dell\QuickSet\QuickSet.exe" [2011-01-25 4479648] "BDAgent"="c:\program files\Bitdefender\Bitdefender 2012\bdagent.exe" [2012-04-06 1067256] "IgfxTray"="c:\windows\system32\igfxtray.exe" [2011-04-07 167256] "HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2011-04-07 391512] "Persistence"="c:\windows\system32\igfxpers.exe" [2011-04-07 415064] "DellStage"="c:\program files (x86)\Dell Stage\Dell Stage\stage_primary.exe" [2012-02-01 2195824] . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows] "LoadAppInit_DLLs"=0x1 . ——- Supplementary Scan ——- . uLocal Page = c:\windows\system32\blank.htm uStart Page = about:blank mStart Page = hxxp://start.funmoods.com/?f=1&a=adknlg&chnl=adknlg&cd=2XzuyEtN2Y1L1Qzu0EtB0Fzz0D0AtAyD0FtCzyyDyBtCyCzztN0D0Tzu0CtBtDzztN1L2Xzut BtFtCtFtCtFtAtCtB&cr=1300867293 mLocal Page = c:\windows\SysWOW64\blank.htm Trusted Zone: state.nj.us\vpn1.judiciary TCP: DhcpNameServer = 192.168.1.1 FF - ProfilePath - c:\users\A Southard Design.asoutharddesign\AppData\Roaming\Mozilla\Firefox\Profiles\3xbe4tw4.default\ FF - prefs.js: network.proxy.type - 0 . - - - - ORPHANS REMOVED - - - - . Toolbar-Locked - (no file) Toolbar-10 - (no file) Wow6432Node-HKCU-Run-Dell - c:\users\A Southard Design.asoutharddesign\AppData\Local\Deployment\Dell\golrjkntt.dll Toolbar-Locked - (no file) Toolbar-10 - (no file) HKLM-Run-SynTPEnh - c:\program files (x86)\Synaptics\SynTP\SynTPEnh.exe . . . ——————— LOCKED REGISTRY KEYS ——————— . [HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\Approved Extensions] @Denied: (2) (LocalSystem) "{D4027C7F-154A-4066-A1AD-4243D8127440}"=hex:51,66,7a,6c,4c,1d,38,12,11,7f,11, d0,78,5b,08,05,de,bb,01,03,dd,4c,30,54 "{5911488E-9D1E-40EC-8CBB-06B231CC153F}"=hex:51,66,7a,6c,4c,1d,38,12,e0,4b,02, 5d,2c,d3,82,05,f3,ad,45,f2,34,92,51,2b "{EF99BD32-C1FB-11D2-892F-0090271D4F88}"=hex:51,66,7a,6c,4c,1d,38,12,5c,be,8a, eb,c9,8f,bc,54,f6,39,43,d0,22,43,0b,9c "{47833539-D0C5-4125-9FA8-0819E2EAAC93}"=hex:51,66,7a,6c,4c,1d,38,12,57,36,90, 43,f7,9e,4b,04,e0,be,4b,59,e7,b4,e8,87 "{8DCB7100-DF86-4384-8842-8FA844297B3F}"=hex:51,66,7a,6c,4c,1d,38,12,6e,72,d8, 89,b4,91,ea,06,f7,54,cc,e8,41,77,3f,2b "{02478D38-C3F9-4EFB-9B51-7695ECA05670}"=hex:51,66,7a,6c,4c,1d,38,12,56,8e,54, 06,cb,8d,95,0b,e4,47,35,d5,e9,fe,12,64 "{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}"=hex:51,66,7a,6c,4c,1d,38,12,f1,9d,97, 02,e5,86,37,08,c7,6b,3b,0b,78,35,a4,a7 "{18DF081C-E8AD-4283-A596-FA578C2EBDC3}"=hex:51,66,7a,6c,4c,1d,38,12,72,0b,cc, 1c,9f,a6,ed,07,da,80,b9,17,89,70,f9,d7 "{59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C}"=hex:51,66,7a,6c,4c,1d,38,12,da,39,34, 5d,e1,a9,97,05,de,be,2c,e9,c9,ff,c2,38 "{5AB7104A-B71F-49AD-9154-F7F8806AE848}"=hex:51,66,7a,6c,4c,1d,38,12,24,13,a4, 5e,2d,f9,c3,0c,ee,42,b4,b8,85,34,ac,5c "{6E13D095-45C3-4271-9475-F3B48227DD9F}"=hex:51,66,7a,6c,4c,1d,38,12,fb,d3,00, 6a,f1,0b,1f,07,eb,63,b0,f4,87,79,99,8b "{8D10F6C4-0E01-4BD4-8601-11AC1FDF8126}"=hex:51,66,7a,6c,4c,1d,38,12,aa,f5,03, 89,33,40,ba,0e,f9,17,52,ec,1a,81,c5,32 "{9030D464-4C02-4ABF-8ECC-5164760863C6}"=hex:51,66,7a,6c,4c,1d,38,12,0a,d7,23, 94,30,02,d1,0f,f1,da,12,24,73,56,27,d2 "{9FDDE16B-836F-4806-AB1F-1455CBEFF289}"=hex:51,66,7a,6c,4c,1d,38,12,05,e2,ce, 9b,5d,cd,68,0d,d4,09,57,15,ce,b1,b6,9d "{AE7CD045-E861-484F-8273-0445EE161910}"=hex:51,66,7a,6c,4c,1d,38,12,2b,d3,6f, aa,53,a6,21,0d,fd,65,47,05,eb,48,5d,04 "{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}"=hex:51,66,7a,6c,4c,1d,38,12,07,5b,93, aa,6e,60,ba,0b,f0,6d,b2,b7,80,44,00,83 "{D2CE3E00-F94A-4740-988E-03DC2F38C34F}"=hex:51,66,7a,6c,4c,1d,38,12,6e,3d,dd, d6,78,b7,2e,02,e7,98,40,9c,2a,66,87,5b "{D824F0DE-3D60-4F57-9EB1-66033ECD8ABB}"=hex:51,66,7a,6c,4c,1d,38,12,b0,f3,37, dc,52,73,39,0a,e1,a7,25,43,3b,93,ce,af "{DBC80044-A445-435B-BC74-9C25C1C588A9}"=hex:51,66,7a,6c,4c,1d,38,12,2a,03,db, df,77,ea,35,06,c3,62,df,65,c4,9b,cc,bd "{E33CF602-D945-461A-83F0-819F76A199F8}"=hex:51,66,7a,6c,4c,1d,38,12,6c,f5,2f, e7,77,97,74,03,fc,e6,c2,df,73,ff,dd,ec "{FDAD4DA1-61A2-4FD8-9C17-86F7AC245081}"=hex:51,66,7a,6c,4c,1d,38,12,cf,4e,be, f9,90,2f,b6,0a,e3,01,c5,b7,a9,7a,14,95 "{182EC0BE-5110-49C8-A062-BEB1D02A220B}"=hex:51,66,7a,6c,4c,1d,38,12,d0,c3,3d, 1c,22,1f,a6,0c,df,74,fd,f1,d5,74,66,1f "{FF059E31-CC5A-4E2E-BF3B-96E929D65503}"=hex:51,66,7a,6c,4c,1d,38,12,5f,9d,16, fb,68,82,40,0b,c0,2d,d5,a9,2c,88,11,17 "{BDEADE7F-C265-11D0-BCED-00A0C90AB50F}"=hex:51,66,7a,6c,4c,1d,38,12,11,dd,f9, b9,57,8c,be,54,c3,fb,43,e0,cc,54,f1,1b . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}] @Denied: (A 2) (Everyone) @="FlashBroker" "LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_3_300_268_ActiveX.exe,-101" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation] "Enabled"=dword:00000001 . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_3_300_268_ActiveX.exe" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}] @Denied: (A 2) (Everyone) @="Shockwave Flash Object" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_3_300_268.ocx" "ThreadingModel"="Apartment" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus] @="0" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID] @="ShockwaveFlash.ShockwaveFlash.11" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_3_300_268.ocx, 1" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib] @="{D27CDB6B-AE6D-11cf-96B8-444553540000}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version] @="1.0" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID] @="ShockwaveFlash.ShockwaveFlash" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}] @Denied: (A 2) (Everyone) @="Macromedia Flash Factory Object" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_3_300_268.ocx" "ThreadingModel"="Apartment" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID] @="FlashFactory.FlashFactory.1" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_3_300_268.ocx, 1" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib] @="{D27CDB6B-AE6D-11cf-96B8-444553540000}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version] @="1.0" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID] @="FlashFactory.FlashFactory" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}] @Denied: (A 2) (Everyone) @="IFlashBroker4" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32] @="{00020424-0000-0000-C000-000000000046}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" "Version"="1.0" . [HKEY_LOCAL_MACHINE\SOFTWARE\McAfee] "SymbolicLinkValue"=hex(6):5c,00,72,00,65,00,67,00,69,00,73,00,74,00,72,00,79, 00,5c,00,6d,00,61,00,63,00,68,00,69,00,6e,00,65,00,5c,00,53,00,6f,00,66,00,\ . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security] @Denied: (Full) (Everyone) . Completion time: 2012-08-02 01:02:53 ComboFix-quarantined-files.txt 2012-08-02 05:02 . Pre-Run: 232,764,928,000 bytes free Post-Run: 233,217,736,704 bytes free . - - End Of File - - 850A3C44954676FEBC70E9623DE11F1D
Post #7
Hi nikid506,

Copy/paste the text in the Codebox below into notepad:

Here's how to do that:
Click Start > Run type Notepad click OK.
This will open an empty notepad file:

Take your mouse, and place your cursor at the beginning of the text in the box below, then click and hold the left mouse button, while pulling your mouse over the text. This should highlight the text. Now release the left mouse button. Now, with the cursor over the highlighted text, right click the mouse for options, and select 'copy'. Now over the empty Notepad box, right click your mouse again, and select 'paste' and you will have copied and pasted the text. 

DDS::
mStart Page = hxxp://start.funmoods.com/?f=1&a=adknlg&chnl=adknlg&cd=2XzuyEtN2Y1L1Qzu0EtB0Fzz0D0AtAyD0FtCzyyDyBtCyCzztN0D0Tzu0CtBtDzztN1L2Xzut
BtFtCtFtCtFtAtCtB&cr=1300867293

Folder::
c:\users\A Southard Design.asoutharddesign\AppData\Local\Ilivid Player
c:\program files (x86)\Smart PC Cleaner
Save this file to your desktop, Save this as "CFScript"

Here's how to do that:
1.Click File;
2.Click Save As… Change the directory to your desktop;
3.Change the Save as type to "All Files";
4.Type in the file name: CFScript
5.Click Save …


[external image: Posted Image]

Drag CFScript.txt into ComboFix.exe



Then post the results log using Copy / Paste
Post #8
hi, i did as requested and it seems to be stuck on stage 3 since late last night. i see that the process is still running..should i kill the process and try again? thanks i'm attaching a screen shot to show you where its been since last night and the task manager showing that its still running. thanks

Attachments:

Post #10
I killed the process and started over and it stopped after stage 3 again. even though i've closed down bitdefender I see that bdagent.exe is still running from the task manager, and i can't end the process (access denied). Maybe that has something to do with it? any new suggestions? thank you!
Post #11
hi, i finally got it to run. here is the log. ComboFix 12-07-31.04 - A Southard Design 08/03/2012 7:58.4.2 - x64 Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.4010.2191 [GMT -4:00] Running from: c:\users\[removed]\Desktop\ComboFix.exe Command switches used :: c:\users\A Southard Design.asoutharddesign\Desktop\CFScript.txt AV: Bitdefender Antivirus *Disabled/Updated* {50909708-FF80-02AF-F814-B28405891E92} FW: Bitdefender Firewall *Disabled* {68AB162D-B5EF-03F7-D34B-1BB1FB5A59E9} SP: Bitdefender Antispyware *Disabled/Updated* {EBF176EC-D9BA-0D21-C2A4-89F67E0E542F} SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} . . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . . c:\program files (x86)\Smart PC Cleaner c:\users\A Southard Design.asoutharddesign\AppData\Local\Ilivid Player c:\users\A Southard Design.asoutharddesign\AppData\Local\Ilivid Player\script.qscript . . ((((((((((((((((((((((((( Files Created from 2012-07-03 to 2012-08-03 ))))))))))))))))))))))))))))))) . . 2012-08-03 12:10 . 2012-08-03 12:10 ——– d—–w- c:\windows\system32\config\systemprofile\AppData\Local\temp 2012-08-03 12:10 . 2012-08-03 12:10 ——– d—–w- c:\users\Ryan\AppData\Local\temp 2012-08-03 12:10 . 2012-08-03 12:10 ——– d—–w- c:\users\Mia\AppData\Local\temp 2012-08-03 12:10 . 2012-08-03 12:10 ——– d—–w- c:\users\Default\AppData\Local\temp 2012-08-03 12:10 . 2012-08-03 12:10 ——– d—–w- c:\users\a southard design\AppData\Local\temp 2012-08-02 21:57 . 2012-08-02 21:57 ——– d—–w- c:\users\A Southard Design.asoutharddesign\AppData\Local\ArcSoft 2012-08-01 02:15 . 2012-08-02 04:39 69000 —-a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{299B91E4-2B56-4826-A555-5611D86A8ADF}\offreg.dll 2012-08-01 01:35 . 2012-06-29 10:04 9133488 —-a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{299B91E4-2B56-4826-A555-5611D86A8ADF}\mpengine.dll 2012-07-27 04:48 . 2012-01-12 13:28 57976 —-a-r- c:\windows\system32\drivers\SBREDrv.sys 2012-07-27 04:33 . 2012-07-27 04:33 388096 —-a-r- c:\users\A Southard Design.asoutharddesign\AppData\Roaming\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe 2012-07-27 04:33 . 2012-07-27 04:33 ——– d—–w- c:\program files (x86)\Trend Micro 2012-07-27 04:21 . 2012-07-27 04:21 ——– d—–w- c:\users\A Southard Design.asoutharddesign\AppData\Local\Macromedia 2012-07-27 04:19 . 2012-07-27 04:19 ——– d—–w- c:\users\A Southard Design.asoutharddesign\AppData\Local\Mozilla 2012-07-27 04:18 . 2012-08-01 01:24 ——– d—–w- c:\program files (x86)\Mozilla Maintenance Service 2012-07-27 04:18 . 2012-08-02 04:51 ——– d—–w- c:\program files\PrivacySafeGuard 2012-07-25 16:34 . 2012-07-25 16:34 ——– d—–w- c:\users\Mia\AppData\Local\Apple Computer 2012-07-25 16:33 . 2012-07-25 16:33 ——– d—–w- c:\users\Mia\AppData\Local\CrashDumps 2012-07-18 16:50 . 2012-07-23 01:23 ——– d—–w- c:\programdata\Tarma Installer 2012-07-12 02:54 . 2012-06-12 03:08 3148800 —-a-w- c:\windows\system32\win32k.sys 2012-07-11 19:18 . 2012-06-09 05:43 14172672 —-a-w- c:\windows\system32\shell32.dll 2012-07-11 19:17 . 2012-06-06 06:05 495616 —-a-w- c:\program files\Common Files\System\ado\msadox.dll 2012-07-11 19:17 . 2012-06-06 06:05 466944 —-a-w- c:\program files\Common Files\System\ado\msadomd.dll 2012-07-11 19:17 . 2012-06-06 06:05 1499136 —-a-w- c:\program files\Common Files\System\ado\msado15.dll 2012-07-11 19:17 . 2012-06-06 06:05 258048 —-a-w- c:\program files\Common Files\System\msadc\msadco.dll 2012-07-11 19:17 . 2012-06-06 05:05 1019904 —-a-w- c:\program files (x86)\Common Files\System\ado\msado15.dll 2012-07-11 19:17 . 2012-06-06 05:03 805376 —-a-w- c:\windows\SysWow64\cdosys.dll 2012-07-11 19:17 . 2012-06-06 06:05 61440 —-a-w- c:\program files\Common Files\System\ado\msador15.dll 2012-07-11 19:17 . 2012-06-06 06:02 1133568 —-a-w- c:\windows\system32\cdosys.dll 2012-07-11 19:17 . 2012-06-06 05:05 143360 —-a-w- c:\program files (x86)\Common Files\System\ado\msjro.dll 2012-07-11 19:17 . 2012-06-06 05:05 372736 —-a-w- c:\program files (x86)\Common Files\System\ado\msadox.dll 2012-07-11 19:17 . 2012-06-06 05:05 57344 —-a-w- c:\program files (x86)\Common Files\System\ado\msador15.dll 2012-07-11 19:17 . 2012-06-06 05:05 352256 —-a-w- c:\program files (x86)\Common Files\System\ado\msadomd.dll 2012-07-11 19:17 . 2012-06-06 05:05 212992 —-a-w- c:\program files (x86)\Common Files\System\msadc\msadco.dll 2012-07-11 03:53 . 2012-07-11 03:53 ——– d—–w- c:\users\Mia\AppData\Roaming\.minecraft . . . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2012-07-29 02:22 . 2012-07-29 02:23 416 —-a-w- c:\windows\Fonts\HARRINGT.pfm 2012-07-27 04:24 . 2012-04-04 10:38 426184 —-a-w- c:\windows\SysWow64\FlashPlayerApp.exe 2012-07-27 04:24 . 2011-10-11 17:37 70344 —-a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl 2012-07-12 02:52 . 2011-10-03 17:12 59701280 —-a-w- c:\windows\system32\MRT.exe 2012-07-02 16:01 . 2012-07-02 16:01 21656 —-a-w- c:\windows\system32\drivers\evolve.sys 2012-06-02 22:19 . 2012-06-19 10:13 38424 —-a-w- c:\windows\system32\wups.dll 2012-06-02 22:19 . 2012-06-19 10:13 2428952 —-a-w- c:\windows\system32\wuaueng.dll 2012-06-02 22:19 . 2012-06-19 10:13 57880 —-a-w- c:\windows\system32\wuauclt.exe 2012-06-02 22:19 . 2012-06-19 10:13 44056 —-a-w- c:\windows\system32\wups2.dll 2012-06-02 22:19 . 2012-06-19 10:13 701976 —-a-w- c:\windows\system32\wuapi.dll 2012-06-02 22:15 . 2012-06-19 10:13 2622464 —-a-w- c:\windows\system32\wucltux.dll 2012-06-02 22:15 . 2012-06-19 10:13 99840 —-a-w- c:\windows\system32\wudriver.dll 2012-06-02 19:19 . 2012-06-19 10:13 186752 —-a-w- c:\windows\system32\wuwebv.dll 2012-06-02 19:15 . 2012-06-19 10:13 36864 —-a-w- c:\windows\system32\wuapp.exe 2012-05-31 16:25 . 2011-11-02 04:31 279656 ——w- c:\windows\system32\MpSigStub.exe . . ((((((((((((((((((((((((((((( SnapShot@2012-08-02_04.55.33 ))))))))))))))))))))))))))))))))))))))))) . - 2012-07-31 17:09 . 2012-07-31 17:09 13271 c:\windows\SysWOW64\config\systemprofile\AppData\Roaming\SoftGrid Client\Icon Cache\icon_ex.dat + 2012-08-03 11:34 . 2012-08-03 11:34 13271 c:\windows\SysWOW64\config\systemprofile\AppData\Roaming\SoftGrid Client\Icon Cache\icon_ex.dat + 2009-07-14 05:10 . 2012-08-03 11:43 40062 c:\windows\system32\wdi\BootPerformanceDiagnostics_SystemData.bin + 2012-03-06 03:04 . 2012-08-03 11:43 7428 c:\windows\system32\wdi\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-2729111025-2427052716-901129613-1005_UserData.bin + 2012-08-03 11:35 . 2012-08-03 11:35 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat - 2012-08-01 01:25 . 2012-08-01 06:01 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat - 2012-08-01 01:25 . 2012-08-01 06:01 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat + 2012-08-03 11:35 . 2012-08-03 11:35 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat + 2011-09-20 23:04 . 2012-08-02 21:46 293552 c:\windows\system32\wdi\SuspendPerformanceDiagnostics_SystemData_S4.bin + 2011-09-02 23:55 . 2012-08-03 08:01 272400 c:\windows\system32\wdi\SuspendPerformanceDiagnostics_SystemData_S3.bin - 2009-07-14 02:36 . 2012-08-02 04:13 633770 c:\windows\system32\perfh009.dat + 2009-07-14 02:36 . 2012-08-03 11:42 633770 c:\windows\system32\perfh009.dat - 2009-07-14 02:36 . 2012-08-02 04:13 111114 c:\windows\system32\perfc009.dat + 2009-07-14 02:36 . 2012-08-03 11:42 111114 c:\windows\system32\perfc009.dat - 2009-07-14 05:01 . 2012-07-31 17:09 449064 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-System.dat + 2009-07-14 05:01 . 2012-08-03 11:33 449064 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-System.dat + 2012-03-06 03:50 . 2012-08-03 11:34 27518567 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-S-1-5-21-2729111025-2427052716-901129613-1005-8192.dat . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 . [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "MobileDocuments"="c:\program files (x86)\Common Files\Apple\Internet Services\ubd.exe" [2012-02-23 59240] "Facebook Update"="c:\users\A Southard Design.asoutharddesign\AppData\Local\Facebook\Update\FacebookUpdate.exe" [2012-07-12 138096] . [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] "Adobe Reader Speed Launcher"="c:\program files (x86)\Adobe\Reader 10.0\Reader\Reader_sl.exe" [2012-04-04 35736] "Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-01-03 843712] "Dell Webcam Central"="c:\program files (x86)\Dell Webcam\Dell Webcam Central\WebcamDell2.exe" [2010-08-19 487562] "Dell DataSafe Online"="c:\program files (x86)\Dell\Dell Datasafe Online\NOBuClient.exe" [2010-08-26 1117528] "RoxWatchTray"="c:\program files (x86)\Common Files\Roxio Shared\OEM\12.0\SharedCOM\RoxWatchTray12OEM.exe" [2010-11-25 240112] "Desktop Disc Tool"="c:\program files (x86)\Roxio\OEM\Roxio Burn\RoxioBurnLauncher.exe" [2010-11-17 514544] "APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2012-05-31 59280] "AgentMonitor"="c:\program files (x86)\VTech\DownloadManager\System\AgentMonitor.exe" [2012-06-28 365512] "SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2012-01-18 254696] "AccuWeatherWidget"="c:\program files (x86)\Dell Stage\Dell Stage\AccuWeather\accuweather.exe" [2012-02-01 968048] "QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" [2012-04-19 421888] "iTunesHelper"="c:\program files (x86)\iTunes\iTunesHelper.exe" [2012-06-07 421776] . c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\ QuickBooks Update Agent.lnk - c:\program files (x86)\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe [2006-10-17 960032] . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "ConsentPromptBehaviorAdmin"= 5 (0x5) "ConsentPromptBehaviorUser"= 3 (0x3) "EnableUIADesktopToggle"= 0 (0x0) . [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa] Security Packages REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp . [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS] @="" . R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576] R2 gupdate;Google Update Service (gupdate);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-03-03 136176] R3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-07-27 250056] R3 AthDfu;Atheros Valkyrie USB BootROM;c:\windows\System32\Drivers\AthDfu.sys [2010-12-16 51872] R3 avckf;avckf;c:\windows\system32\DRIVERS\avckf.sys [2012-03-02 545064] R3 bdsandbox;bdsandbox;c:\windows\system32\drivers\bdsandbox.sys [2012-02-03 79952] R3 EvolveVirtualAdapter;Evolve Virtual Miniport Driver;c:\windows\system32\DRIVERS\evolve.sys [2012-07-02 21656] R3 gupdatem;Google Update Service (gupdatem);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-03-03 136176] R3 Impcd;Impcd;c:\windows\system32\DRIVERS\Impcd.sys [2010-02-26 158976] S0 avc3;avc3;c:\windows\system32\DRIVERS\avc3.sys [2012-04-06 691896] S1 BdfNdisf;BitDefender Firewall NDIS 6 Filter Driver;c:\program files\common files\bitdefender\bitdefender firewall\bdfndisf6.sys [2011-11-15 90192] S1 bdfwfpf;bdfwfpf;c:\program files\Common Files\Bitdefender\Bitdefender Firewall\bdfwfpf.sys [2011-11-15 103504] S1 BDVEDISK;BDVEDISK;c:\windows\system32\DRIVERS\bdvedisk.sys [2010-01-19 103944] S2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2012-01-03 63928] S2 AERTFilters;Andrea RT Filters Service;c:\program files\Realtek\Audio\HDA\AERTSr64.exe [2009-11-18 98208] S2 Atheros Bt&Wlan Coex Agent;Atheros Bt&Wlan Coex Agent;c:\program files (x86)\Dell Wireless\Ath_CoexAgent.exe [2010-10-01 151552] S2 AtherosSvc;AtherosSvc;c:\program files (x86)\Dell Wireless\Bluetooth Suite\adminservice.exe [2010-12-17 53920] S2 cvhsvc;Client Virtualization Handler;c:\program files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE [2012-01-04 822624] S3 AthBTPort;Atheros Virtual Bluetooth Class;c:\windows\system32\DRIVERS\btath_flt.sys [2010-12-17 36000] S3 avchv;avchv Function Driver;c:\windows\system32\DRIVERS\avchv.sys [2011-11-25 258736] S3 BTATH_A2DP;Bluetooth A2DP Audio Driver;c:\windows\system32\drivers\btath_a2dp.sys [2010-12-17 298144] S3 BTATH_BUS;Atheros Bluetooth Bus;c:\windows\system32\DRIVERS\btath_bus.sys [2010-12-16 28832] S3 BTATH_HCRP;Bluetooth HCRP Server driver;c:\windows\system32\DRIVERS\btath_hcrp.sys [2010-12-16 201376] S3 BTATH_LWFLT;Bluetooth LWFLT Device;c:\windows\system32\DRIVERS\btath_lwflt.sys [2010-12-17 55456] S3 BTATH_RCP;Bluetooth AVRCP Device;c:\windows\system32\DRIVERS\btath_rcp.sys [2010-12-16 154272] S3 BtFilter;BtFilter;c:\windows\system32\DRIVERS\btfilter.sys [2010-12-17 275616] S3 CtClsFlt;Creative Camera Class Upper Filter Driver;c:\windows\system32\DRIVERS\CtClsFlt.sys [2010-08-12 175168] S3 IntcDAud;Intel® Display Audio;c:\windows\system32\DRIVERS\IntcDAud.sys [2010-10-15 317440] . . — Other Services/Drivers In Memory — . *NewlyCreated* - WS2IFSL . Contents of the 'Scheduled Tasks' folder . 2012-08-03 c:\windows\Tasks\Adobe Flash Player Updater.job - c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-04 04:24] . 2012-08-01 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-2729111025-2427052716-901129613-1000Core.job - c:\users\a southard design\AppData\Local\Facebook\Update\FacebookUpdate.exe [2011-12-30 20:56] . 2012-08-03 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-2729111025-2427052716-901129613-1000UA.job - c:\users\a southard design\AppData\Local\Facebook\Update\FacebookUpdate.exe [2011-12-30 20:56] . 2012-08-03 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-2729111025-2427052716-901129613-1005Core.job - c:\users\A Southard Design.asoutharddesign\AppData\Local\Facebook\Update\FacebookUpdate.exe [2012-04-29 01:11] . 2012-08-03 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-2729111025-2427052716-901129613-1005UA.job - c:\users\A Southard Design.asoutharddesign\AppData\Local\Facebook\Update\FacebookUpdate.exe [2012-04-29 01:11] . 2012-08-03 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job - c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-03-03 12:12] . 2012-08-03 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job - c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-03-03 12:12] . 2012-08-02 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2729111025-2427052716-901129613-1000Core.job - c:\users\a southard design\AppData\Local\Google\Update\GoogleUpdate.exe [2012-01-07 06:16] . 2012-08-03 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2729111025-2427052716-901129613-1000UA.job - c:\users\a southard design\AppData\Local\Google\Update\GoogleUpdate.exe [2012-01-07 06:16] . 2012-08-03 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2729111025-2427052716-901129613-1006Core.job - c:\users\Mia\AppData\Local\Google\Update\GoogleUpdate.exe [2012-07-01 19:05] . 2012-08-03 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2729111025-2427052716-901129613-1006UA.job - c:\users\Mia\AppData\Local\Google\Update\GoogleUpdate.exe [2012-07-01 19:05] . 2012-08-03 c:\windows\Tasks\PCDoctorBackgroundMonitorTask.job - c:\program files\Dell Support Center\uaclauncher.exe [2012-02-07 23:32] . 2012-08-03 c:\windows\Tasks\SystemToolsDailyTest.job - c:\program files\Dell Support Center\uaclauncher.exe [2012-02-07 23:32] . . ——— X64 Entries ———– . . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\__SafeBox1] @="{152C96EB-288E-4EDC-B7C6-D21F8250ADF3}" [HKEY_CLASSES_ROOT\CLSID\{152C96EB-288E-4EDC-B7C6-D21F8250ADF3}] 2012-03-02 02:12 266952 ——w- c:\program files\Bitdefender\Bitdefender Safebox\safeboxshell.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\__SafeBox2] @="{342DAA0B-D796-460D-8566-901E08A1CCAD}" [HKEY_CLASSES_ROOT\CLSID\{342DAA0B-D796-460D-8566-901E08A1CCAD}] 2012-03-02 02:12 266952 ——w- c:\program files\Bitdefender\Bitdefender Safebox\safeboxshell.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\__SafeBox3] @="{57595DAE-1AE1-4D97-A49E-67CBB53B52DF}" [HKEY_CLASSES_ROOT\CLSID\{57595DAE-1AE1-4D97-A49E-67CBB53B52DF}] 2012-03-02 02:12 266952 ——w- c:\program files\Bitdefender\Bitdefender Safebox\safeboxshell.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\__SafeBox4] @="{33816773-98AE-4723-ADE0-EBE54C8B5A67}" [HKEY_CLASSES_ROOT\CLSID\{33816773-98AE-4723-ADE0-EBE54C8B5A67}] 2012-03-02 02:12 266952 ——w- c:\program files\Bitdefender\Bitdefender Safebox\safeboxshell.dll . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SynTPEnh"="c:\program files (x86)\Synaptics\SynTP\SynTPEnh.exe" [BU] "RTHDVCPL"="c:\program files\Realtek\Audio\HDA\RtkNGUI64.exe" [2010-12-14 6561384] "AtherosBtStack"="c:\program files (x86)\Dell Wireless\Bluetooth Suite\BtvStack.exe" [2010-12-17 613536] "AthBtTray"="c:\program files (x86)\Dell Wireless\Bluetooth Suite\AthBtTray.exe" [2010-12-17 379040] "BDAgent"="c:\program files\Bitdefender\Bitdefender 2012\bdagent.exe" [2012-04-06 1067256] "IgfxTray"="c:\windows\system32\igfxtray.exe" [2011-04-07 167256] "HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2011-04-07 391512] "Persistence"="c:\windows\system32\igfxpers.exe" [2011-04-07 415064] "DellStage"="c:\program files (x86)\Dell Stage\Dell Stage\stage_primary.exe" [2012-02-01 2195824] . ——- Supplementary Scan ——- . uLocal Page = c:\windows\system32\blank.htm uStart Page = about:blank mLocal Page = c:\windows\SysWOW64\blank.htm Trusted Zone: state.nj.us\vpn1.judiciary TCP: DhcpNameServer = 192.168.1.1 FF - ProfilePath - c:\users\A Southard Design.asoutharddesign\AppData\Roaming\Mozilla\Firefox\Profiles\3xbe4tw4.default\ FF - prefs.js: network.proxy.type - 0 . - - - - ORPHANS REMOVED - - - - . Toolbar-Locked - (no file) Toolbar-10 - (no file) . . . ——————— LOCKED REGISTRY KEYS ——————— . [HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\Approved Extensions] @Denied: (2) (LocalSystem) "{D4027C7F-154A-4066-A1AD-4243D8127440}"=hex:51,66,7a,6c,4c,1d,38,12,11,7f,11, d0,78,5b,08,05,de,bb,01,03,dd,4c,30,54 "{5911488E-9D1E-40EC-8CBB-06B231CC153F}"=hex:51,66,7a,6c,4c,1d,38,12,e0,4b,02, 5d,2c,d3,82,05,f3,ad,45,f2,34,92,51,2b "{EF99BD32-C1FB-11D2-892F-0090271D4F88}"=hex:51,66,7a,6c,4c,1d,38,12,5c,be,8a, eb,c9,8f,bc,54,f6,39,43,d0,22,43,0b,9c "{47833539-D0C5-4125-9FA8-0819E2EAAC93}"=hex:51,66,7a,6c,4c,1d,38,12,57,36,90, 43,f7,9e,4b,04,e0,be,4b,59,e7,b4,e8,87 "{8DCB7100-DF86-4384-8842-8FA844297B3F}"=hex:51,66,7a,6c,4c,1d,38,12,6e,72,d8, 89,b4,91,ea,06,f7,54,cc,e8,41,77,3f,2b "{02478D38-C3F9-4EFB-9B51-7695ECA05670}"=hex:51,66,7a,6c,4c,1d,38,12,56,8e,54, 06,cb,8d,95,0b,e4,47,35,d5,e9,fe,12,64 "{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}"=hex:51,66,7a,6c,4c,1d,38,12,f1,9d,97, 02,e5,86,37,08,c7,6b,3b,0b,78,35,a4,a7 "{18DF081C-E8AD-4283-A596-FA578C2EBDC3}"=hex:51,66,7a,6c,4c,1d,38,12,72,0b,cc, 1c,9f,a6,ed,07,da,80,b9,17,89,70,f9,d7 "{59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C}"=hex:51,66,7a,6c,4c,1d,38,12,da,39,34, 5d,e1,a9,97,05,de,be,2c,e9,c9,ff,c2,38 "{5AB7104A-B71F-49AD-9154-F7F8806AE848}"=hex:51,66,7a,6c,4c,1d,38,12,24,13,a4, 5e,2d,f9,c3,0c,ee,42,b4,b8,85,34,ac,5c "{6E13D095-45C3-4271-9475-F3B48227DD9F}"=hex:51,66,7a,6c,4c,1d,38,12,fb,d3,00, 6a,f1,0b,1f,07,eb,63,b0,f4,87,79,99,8b "{8D10F6C4-0E01-4BD4-8601-11AC1FDF8126}"=hex:51,66,7a,6c,4c,1d,38,12,aa,f5,03, 89,33,40,ba,0e,f9,17,52,ec,1a,81,c5,32 "{9030D464-4C02-4ABF-8ECC-5164760863C6}"=hex:51,66,7a,6c,4c,1d,38,12,0a,d7,23, 94,30,02,d1,0f,f1,da,12,24,73,56,27,d2 "{9FDDE16B-836F-4806-AB1F-1455CBEFF289}"=hex:51,66,7a,6c,4c,1d,38,12,05,e2,ce, 9b,5d,cd,68,0d,d4,09,57,15,ce,b1,b6,9d "{AE7CD045-E861-484F-8273-0445EE161910}"=hex:51,66,7a,6c,4c,1d,38,12,2b,d3,6f, aa,53,a6,21,0d,fd,65,47,05,eb,48,5d,04 "{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}"=hex:51,66,7a,6c,4c,1d,38,12,07,5b,93, aa,6e,60,ba,0b,f0,6d,b2,b7,80,44,00,83 "{D2CE3E00-F94A-4740-988E-03DC2F38C34F}"=hex:51,66,7a,6c,4c,1d,38,12,6e,3d,dd, d6,78,b7,2e,02,e7,98,40,9c,2a,66,87,5b "{D824F0DE-3D60-4F57-9EB1-66033ECD8ABB}"=hex:51,66,7a,6c,4c,1d,38,12,b0,f3,37, dc,52,73,39,0a,e1,a7,25,43,3b,93,ce,af "{DBC80044-A445-435B-BC74-9C25C1C588A9}"=hex:51,66,7a,6c,4c,1d,38,12,2a,03,db, df,77,ea,35,06,c3,62,df,65,c4,9b,cc,bd "{E33CF602-D945-461A-83F0-819F76A199F8}"=hex:51,66,7a,6c,4c,1d,38,12,6c,f5,2f, e7,77,97,74,03,fc,e6,c2,df,73,ff,dd,ec "{FDAD4DA1-61A2-4FD8-9C17-86F7AC245081}"=hex:51,66,7a,6c,4c,1d,38,12,cf,4e,be, f9,90,2f,b6,0a,e3,01,c5,b7,a9,7a,14,95 "{182EC0BE-5110-49C8-A062-BEB1D02A220B}"=hex:51,66,7a,6c,4c,1d,38,12,d0,c3,3d, 1c,22,1f,a6,0c,df,74,fd,f1,d5,74,66,1f "{FF059E31-CC5A-4E2E-BF3B-96E929D65503}"=hex:51,66,7a,6c,4c,1d,38,12,5f,9d,16, fb,68,82,40,0b,c0,2d,d5,a9,2c,88,11,17 "{BDEADE7F-C265-11D0-BCED-00A0C90AB50F}"=hex:51,66,7a,6c,4c,1d,38,12,11,dd,f9, b9,57,8c,be,54,c3,fb,43,e0,cc,54,f1,1b . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}] @Denied: (A 2) (Everyone) @="FlashBroker" "LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_3_300_268_ActiveX.exe,-101" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation] "Enabled"=dword:00000001 . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_3_300_268_ActiveX.exe" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}] @Denied: (A 2) (Everyone) @="Shockwave Flash Object" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_3_300_268.ocx" "ThreadingModel"="Apartment" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus] @="0" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID] @="ShockwaveFlash.ShockwaveFlash.11" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_3_300_268.ocx, 1" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib] @="{D27CDB6B-AE6D-11cf-96B8-444553540000}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version] @="1.0" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID] @="ShockwaveFlash.ShockwaveFlash" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}] @Denied: (A 2) (Everyone) @="Macromedia Flash Factory Object" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_3_300_268.ocx" "ThreadingModel"="Apartment" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID] @="FlashFactory.FlashFactory.1" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_3_300_268.ocx, 1" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib] @="{D27CDB6B-AE6D-11cf-96B8-444553540000}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version] @="1.0" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID] @="FlashFactory.FlashFactory" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}] @Denied: (A 2) (Everyone) @="IFlashBroker4" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32] @="{00020424-0000-0000-C000-000000000046}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" "Version"="1.0" . [HKEY_LOCAL_MACHINE\SOFTWARE\McAfee] "SymbolicLinkValue"=hex(6):5c,00,72,00,65,00,67,00,69,00,73,00,74,00,72,00,79, 00,5c,00,6d,00,61,00,63,00,68,00,69,00,6e,00,65,00,5c,00,53,00,6f,00,66,00,\ . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security] @Denied: (Full) (Everyone) . Completion time: 2012-08-03 08:14:51 ComboFix-quarantined-files.txt 2012-08-03 12:14 ComboFix2.txt 2012-08-02 05:02 . Pre-Run: 235,965,517,824 bytes free Post-Run: 235,526,864,896 bytes free . - - End Of File - - D4D0A9AFB40E6E48EA3A6BEC544B2476
Post #12
Hi, how is your computer behaving now? Any issues?

Your Java is out of date. Older versions have vulnerabilities that malware can use to infect your system. Please follow these steps to remove older version Java components and update.

Updating Java:
  • Download the latest version of Java Runtime Environment (JRE) 7 Update 5.
  • After the download completes, close any programs you may have running - especially your web browser.
  • Go to Start > Control Panel double-click on Add/Remove programs and remove all older versions of Java.
  • Check any item with Java Runtime Environment (JRE or J2SE) in the name.
  • Click the Remove or Change/Remove button.
  • Repeat as many times as necessary to remove each Java versions.
  • Reboot your computer once all Java components are removed.
  • Double click the Java setup file you just downloaded and follow the prompts to begin the installation.
Now to Clean out the Java cache:

Go into the Control Panel and double-click the Java Icon. [external image: Posted Image]
  • Under Temporary Internet Files, click the Settings… button
  • click the Delete Files button.
  • There are three options in the window to clear the cache - Leave all 3 Checked
    • Downloaded Applets
      Downloaded Applications
      Other Files
  • Click OK on Delete Temporary Files Window
    Note: This deletes ALL the Downloaded Applications and Applets from the CACHE.
  • Click OK to leave the Temporary Files Settings
  • Click OK to leave the Java Control Panel.
===================================================

Please download Malwarebytes' Anti-Malware to your desktop.

  • Double-click mbam-setup.exe and follow the prompts to install the program.
  • At the end, be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
  • If an update is found, it will download and install the latest version.
  • Once the program has loaded, select Perform quick scan, then click Scan.
  • When the scan is complete, click OK, then Show Results to view the results.
  • Be sure that everything is checked, and click Remove Selected.
  • When completed, a log will open in Notepad. Please save it to a convenient location and post the results.
===================================================

I need you to run the following scan: Eset Online Scanner
  • Place a check mark in the box YES, I accept the Terms Of Use
  • Click the Start button.
  • Now click the Install button.
  • Click Start.  The scanner engine will initialize and update.
  • Do Not place a check mark in the box beside Remove found threats.
  • Click the Scan button.  The scan will now run, please be patient.
  • When the scan finishes click the Details tab.
  • Copy and paste the contents of the C:\Program Files\ESET\log.txt into your next reply.
Post #13
one main issue… 1. when i open up the IE browser my homepage gets redirected to about blank and i can't change it. I thought it was the golrjkntt.dll infection - were the scans you had me perform get rid of that? btw, what do you think of stopzilla? ty Note: I will follow your instructions and post my reply later today.
Post #14
Hi nikid506, I can try to address that, but I want to see the latest logs first. Yes, the scans I had you run removed that file and some others. I have never used StopZilla, so I can't comment on it. Personally, I use Microsoft Security Essentials as my comprehensive anti-malware/anti-virus/anti-spyware solution.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI