What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Babylon [Solved]

32 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1 last edited
So, I was a numbnuts. I was recommended a site where people bought and sold rare music. I found a self released 7 inch vinyl from a local punk band in the mid-90''s that I LOVED, and nearly stuff my pants. Right next to the track list was this huge, invtiting 'DOWNLOAD' button. Of course, in my excitement, I clicked that stuff…like a dumbass. So, I got this Babylon stuff. I managed to get my homepage and default search back by going into about:config in FF and resetting all the babylon entries. I am left with, and completely exasperated by this dayam 'search here' tab. It will not go away. Here's what I've done so far. Booted in safe mode, run MBAM, clean search. Ran Advanced System Care in safemode, no malware found. Ran Spybot – found the babylon.toolbar entry, claimed it was removed. Rebooted into normal move, Spybot ran an auto check with a clean result. Still have the fracking tab. Searched the registry forr Babylon entries – found nothing. I'm at my wits end here. It's not like it's particularly invasive or annoying, but I know it's just a symptom of something greater going on. My googling about on the topic of this particular malware/virus has been disheartening. Oh, I also…rarely…get an install request for 'like.php' from Facebook. Pretty sure it's a separate infection, and at this point is doesn't happen often enough for me to know if it's been cleaned or not. Any help would be appreciated…to the point of transplant donor. Hey, none of us are getting any younger here. :) With love and anticipation, Djinn
Post #2
Hi and Welcome!! :) My name is Jeff. I would be more than happy to take a look at your malware results logs and help you with solving any malware problems you might have. Logs can take a while to research, so please be patient and know that I am working hard to get you a clean and functional system back in your hands. I'd be grateful if you would note the following:
  • I will be working on your Malware issues, this may or may not, solve other issues you have with your machine.
  • The fixes are specific to your problem and should only be used for the issues on this machine.
  • Please continue to review my answers until I tell you your machine appears to be clear. Absence of symptoms does not mean that everything is clear.
  • It's often worth reading through these instructions and printing them for ease of reference.
  • If you don't know or understand something, please don't hesitate to say or ask!! It's better to be sure and safe than sorry.
  • Please reply to this thread. Do not start a new topic.

IMPORTANT NOTE : Please do not delete anything unless instructed to.
DO NOT use any TOOLS such as Combofix or HijackThis fixes without supervision.
Doing so could make your system inoperable and could require a full reinstall of your OS losing all your programs and data.

Vista and Windows 7 users:
These tools MUST be run from the executable (.exe) every time you run them
with Admin Rights (Right click, choose "Run as Administrator")

Stay with this topic until I give you the all clean post.
———-

AS A NOTE: Per our Terms of Use found here, please read the following…

What the Tech is a family friendly site, accessible to anyone over 13 years of age. Please keep all content appropriate.

I have edited your Title Description.
———

OTL
  • Download OTL to your desktop.
  • Right-click and Run as Administrator on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
  • Select All Users
  • When the window appears, underneath Output at the top change it to Minimal Output.
  • Check the boxes beside LOP Check and Purity Check.
  • Under the Custom Scan box paste this in

    netsvcs
    /md5start
    consrv.dll
    explorer.exe
    winlogon.exe
    Userinit.exe
    svchost.exe
    /md5stop
    CREATERESTOREPOINT
  • Click the Quick Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
  • When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt.
    Note:These logs can be located in the OTL. folder on you C:\ drive if they fail to open automatically.
  • Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post it with your next reply. You may need two posts to fit them both in.
———-

Please download aswMBR to your desktop.

  • Right click and Run as Administrator the aswMBR icon to run it.
  • Click the Scan button to start scan.
  • If asked whether you would like to update the Avast virus database please do.
  • When it finishes, press the save log button, save the logfile to your desktop and post its contents in your next reply.

[external image: Posted Image]
Click the image to enlarge it
———-

In your next reply please post the logs made by OTL and aswMBR. :)
Post #3
Sorry for the profanity. I've got a bit of a potty mouth, and I've been screwing around with this since about noon. My aggros are way up.
First thing, the two OTL logs
OTL.txt

OTL logfile created on: 8/5/2012 9:18:55 PM - Run 1
OTL by OldTimer - Version 3.2.56.0 Folder = C:\Users\Heidi\Desktop
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

2.96 Gb Total Physical Memory | 1.23 Gb Available Physical Memory | 41.38% Memory free
6.12 Gb Paging File | 4.21 Gb Available in Paging File | 68.74% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 104.90 Gb Total Space | 31.38 Gb Free Space | 29.91% Space Free | Partition Type: NTFS
Drive E: | 44.11 Gb Total Space | 0.00 Gb Free Space | 0.01% Space Free | Partition Type: NTFS

Computer Name: HEIDI-PC | User Name: Heidi | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Users\Heidi\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Windows\System32\Macromed\Flash\FlashPlayerPlugin_11_3_300_270.exe (Adobe Systems, Inc.)
PRC - C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
PRC - C:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater\11.2.0\ToolbarUpdater.exe ()
PRC - C:\Program Files\AVG Secure Search\vprot.exe ()
PRC - C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation)
PRC - C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
PRC - C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe (Lavasoft Limited)
PRC - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe (Lavasoft Limited)
PRC - C:\Program Files\IObit\Advanced SystemCare 5\ASCTray.exe (IObit)
PRC - C:\Program Files\IObit\Advanced SystemCare 5\ASCService.exe (IObit)
PRC - C:\Program Files\Real\RealPlayer\Update\realsched.exe (RealNetworks, Inc.)
PRC - C:\Program Files\Microsoft Security Client\msseces.exe (Microsoft Corporation)
PRC - c:\Program Files\Microsoft Security Client\MsMpEng.exe (Microsoft Corporation)
PRC - C:\Program Files\WRAL Desktop Alert\liveonline_3977114.exe ()
PRC - C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated)
PRC - C:\Program Files\StartNow Toolbar\ToolbarUpdaterService.exe ()
PRC - C:\Program Files\Immunet Protect\2.0.17\iptray.exe (Immunet)
PRC - C:\Program Files\Immunet Protect\2.0.17\agent.exe (Immunet Corporation)
PRC - C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe (Eastman Kodak Company)
PRC - C:\Program Files\Secunia\PSI\psia.exe (Secunia)
PRC - C:\Program Files\Secunia\PSI\sua.exe (Secunia)
PRC - C:\Program Files\Secunia\PSI\psi_tray.exe (Secunia)
PRC - C:\Windows\System32\sdclt.exe (Microsoft Corporation)
PRC - C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe (ArcSoft Inc.)
PRC - C:\Program Files\Dell DataSafe Local Backup\SftService.exe (SoftThinks SAS)
PRC - C:\Program Files\Dell\QuickSet\quickset.exe (Dell Inc.)
PRC - C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe (ArcSoft Inc.)
PRC - C:\Program Files\IDT\WDM\sttray.exe (IDT, Inc.)
PRC - C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_0145da1d\stacsv.exe (IDT, Inc.)
PRC - C:\Program Files\Logitech\Logitech WebCam Software\LWS.exe ()
PRC - C:\Program Files\Common Files\logishrd\LQCVFX\COCIManager.exe ()
PRC - C:\Program Files\Common Files\logishrd\LVMVFM\LVPrcSrv.exe (Logitech Inc.)
PRC - C:\Program Files\Canon\MyPrinter\BJMYPRT.EXE (CANON INC.)
PRC - C:\Windows\explorer.exe (Microsoft Corporation)
PRC - C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_0145da1d\AEstSrv.exe (Andrea Electronics Corporation)
PRC - C:\Program Files\Canon\IJPLM\ijplmsvc.exe ()
PRC - C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe (Safer Networking Ltd.)
PRC - C:\Program Files\Common Files\Dell\Advanced Networking Service\hnm_svc.exe (Dell Inc.)
PRC - C:\Program Files\Common Files\Dell\Remote Access File Sync Service\dsl_fs_sync.exe (SingleClick Systems)
PRC - C:\Program Files\Dell\DellDock\DellDock.exe (Stardock Corporation)
PRC - C:\Program Files\Dell\DellDock\DockLogin.exe (Stardock Corporation)
PRC - C:\Program Files\DellTPad\hidfind.exe (Alps Electric Co., Ltd.)
PRC - C:\Program Files\DellTPad\Apoint.exe (Alps Electric Co., Ltd.)
PRC - C:\Program Files\DellTPad\ApntEx.exe (Alps Electric Co., Ltd.)
PRC - C:\ProgramData\UltraVNC\winvnc.exe (UltraVNC)
PRC - C:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exe (CyberLink Corp.)
PRC - C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTmon.exe (Intel Corporation)
PRC - C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe (Intel Corporation)
PRC - C:\Program Files\Common Files\Dell\MySQL\bin\mysqld.exe ()
PRC - C:\Program Files\twc\medicsp2\bin\sprtsvc.exe (SupportSoft, Inc.)


========== Modules (No Company Name) ==========

MOD - C:\Windows\System32\Macromed\Flash\NPSWF32_11_3_300_270.dll ()
MOD - C:\Program Files\Mozilla Firefox\mozjs.dll ()
MOD - C:\Program Files\Common Files\AVG Secure Search\SiteSafetyInstaller\11.2.0\SiteSafety.dll ()
MOD - C:\Program Files\AVG Secure Search\vprot.exe ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\MenuSkinning\e4ead33e7390326a9814a511c566054b\MenuSkinning.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\VistaBridgeLibrary\53ff6fb64982a15d164f25e727be6bb4\VistaBridgeLibrary.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\DellDock\a2117f9d2b9670193889149f0ec777d5\DellDock.ni.exe ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\MyDock.Util\d8dfd448743194309366caa97c215c21\MyDock.Util.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Web\508b444db523c5cf20ff12c7f440837b\System.Web.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\f2691cfa7671cdc58179e56ba9227591\System.Windows.Forms.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\18f9789aa214c657113e676b3a9015aa\System.Drawing.ni.dll ()
MOD - C:\Program Files\IObit\Advanced SystemCare 5\ASCv5ExtMenu.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Management\f3d4d5fe5ab848fbfcf91a49960dc8ae\System.Management.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Runtime.Remo#\846b9cf2756fdd15f704c9bab9c70b6f\System.Runtime.Remoting.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Configuration\bd76aaaa03ddc15d1840207b5a480644\System.Configuration.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\Accessibility\1b337cf9a031145849bc48c11b2cfe58\Accessibility.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Xml\3b7181bb19dd5dd74cd063f0312cdf57\System.Xml.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System\28d633338fc8d29f8af31935ef7d001b\System.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\af9c9e9d7e0523cd444f8b551baa9cbf\mscorlib.ni.dll ()
MOD - C:\Program Files\WRAL Desktop Alert\liveonline_3977114.exe ()
MOD - C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll ()
MOD - C:\Program Files\Common Files\Apple\Apple Application Support\libxml2.dll ()
MOD - C:\Program Files\Immunet Protect\2.0.17\dhr.dll ()
MOD - C:\Program Files\Immunet Protect\2.0.17\drs.dll ()
MOD - C:\Program Files\Immunet Protect\2.0.17\dcf.dll ()
MOD - C:\Program Files\Immunet Protect\2.0.17\dut.dll ()
MOD - C:\Program Files\Immunet Protect\2.0.17\dxm.dll ()
MOD - C:\Program Files\Kodak\Kodak EasyShare software\bin\VistaAdapter.esx ()
MOD - C:\Program Files\Kodak\Kodak EasyShare software\bin\ESCom.dll ()
MOD - C:\Program Files\Kodak\Kodak EasyShare software\bin\ESSkin.esx ()
MOD - C:\Program Files\Kodak\Kodak EasyShare software\bin\VistaCDBackup.esx ()
MOD - C:\Program Files\Kodak\Kodak EasyShare software\bin\ESEmail.esx ()
MOD - C:\Program Files\Kodak\Kodak EasyShare software\bin\VPrintOnline.dll ()
MOD - C:\Program Files\Kodak\Kodak EasyShare software\bin\VistaControls.esx ()
MOD - C:\Program Files\Kodak\Kodak EasyShare software\bin\ESCliWicMDRW.esx ()
MOD - C:\Program Files\Kodak\Kodak EasyShare software\bin\VPrintOnlineHelper40.dll ()
MOD - C:\Program Files\Kodak\Kodak EasyShare software\bin\KFx.dll ()
MOD - C:\Program Files\Kodak\Kodak EasyShare software\bin\keml40.dll ()
MOD - C:\Program Files\Kodak\Kodak EasyShare software\bin\AppCore.dll ()
MOD - C:\Program Files\Kodak\Kodak EasyShare software\bin\Atlas.dll ()
MOD - C:\Program Files\Kodak\Kodak EasyShare software\bin\SpiffyExt.dll ()
MOD - C:\Program Files\Kodak\Kodak EasyShare software\bin\IStorageMediaStore.esx ()
MOD - C:\Program Files\Kodak\Kodak EasyShare software\bin\LocCamBack.dll ()
MOD - C:\Program Files\Kodak\Kodak EasyShare software\bin\LocAcqMod.dll ()
MOD - C:\Program Files\Kodak\Kodak EasyShare software\bin\UpdateChecker.esx ()
MOD - C:\Program Files\Kodak\Kodak EasyShare software\bin\kpries40.dll ()
MOD - C:\Program Files\Kodak\Kodak EasyShare software\bin\LocUpdateCheck.dll ()
MOD - C:\Program Files\Kodak\Kodak EasyShare software\bin\VistaPrintOnline.esx ()
MOD - C:\Program Files\Kodak\Kodak EasyShare software\bin\Pcd.esx ()
MOD - C:\Program Files\Kodak\Kodak EasyShare software\bin\KPCDInterface.dll ()
MOD - C:\Program Files\Kodak\Kodak EasyShare software\bin\areaifdll.dll ()
MOD - C:\Program Files\Kodak\Kodak EasyShare software\bin\DXRawFormatHandler.esx ()
MOD - C:\Program Files\Kodak\Kodak EasyShare software\bin\DibLibIP.dll ()
MOD - C:\Program Files\Notepad++\NppShell_01.dll ()
MOD - C:\Program Files\Logitech\Logitech WebCam Software\LWS.exe ()
MOD - C:\Program Files\Common Files\logishrd\LQCVFX\COCIManager.exe ()
MOD - C:\Program Files\Kodak\Kodak EasyShare software\bin\SkinuxCommonV.dll ()
MOD - C:\Program Files\Kodak\Kodak EasyShare software\bin\SkinuxProcV.dll ()
MOD - C:\Program Files\Kodak\Kodak EasyShare software\bin\SkinuxXML2V.dll ()
MOD - C:\Program Files\Kodak\Kodak EasyShare software\bin\SkinuxFFV.dll ()
MOD - C:\Program Files\Kodak\Kodak EasyShare software\bin\SkinuxCmpV.dll ()
MOD - C:\Program Files\Kodak\Kodak EasyShare software\bin\SkinuxImV.dll ()
MOD - C:\Program Files\Kodak\Kodak EasyShare software\bin\SkinuxZipV.dll ()
MOD - C:\Program Files\Kodak\Kodak EasyShare software\bin\SkinuxBaseV.dll ()
MOD - C:\Windows\System32\bcmwlrmt.dll ()


========== Win32 Services (SafeList) ==========

SRV - (SBSDWSCService) – C:\Program Files\Spybot File not found
SRV - (AdobeFlashPlayerUpdateSvc) – C:\Windows\System32\Macromed\Flash\FlashPlayerUpdateService.exe (Adobe Systems Incorporated)
SRV - (MozillaMaintenance) – C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe (Mozilla Foundation)
SRV - (vToolbarUpdater11.2.0) – C:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater\11.2.0\ToolbarUpdater.exe ()
SRV - (MBAMService) – C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation)
SRV - (Lavasoft Ad-Aware Service) – C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe (Lavasoft Limited)
SRV - (AdvancedSystemCareService5) – C:\Program Files\IObit\Advanced SystemCare 5\ASCService.exe (IObit)
SRV - (Ad-Aware Service) – C:\Program Files\Ad-Aware Antivirus\AdAwareService.exe (Lavasoft Limited)
SRV - (NisSrv) – c:\Program Files\Microsoft Security Client\NisSrv.exe (Microsoft Corporation)
SRV - (MsMpSvc) – c:\Program Files\Microsoft Security Client\MsMpEng.exe (Microsoft Corporation)
SRV - (SkypeUpdate) – C:\Program Files\Skype\Updater\Updater.exe (Skype Technologies)
SRV - (AdobeARMservice) – C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated)
SRV - (SBAMSvc) – C:\Program Files\Ad-Aware Antivirus\SBAMSvc.exe (GFI Software)
SRV - (Updater Service for StartNow Toolbar) – C:\Program Files\StartNow Toolbar\ToolbarUpdaterService.exe ()
SRV - (scan) – C:\Program Files\Immunet Protect\tetra\scan.dll (Immunet)
SRV - (ImmunetProtect) – C:\Program Files\Immunet Protect\2.0.17\agent.exe (Immunet Corporation)
SRV - (Secunia PSI Agent) – C:\Program Files\Secunia\PSI\psia.exe (Secunia)
SRV - (Secunia Update Agent) – C:\Program Files\Secunia\PSI\sua.exe (Secunia)
SRV - (SftService) – C:\Program Files\Dell DataSafe Local Backup\SftService.exe (SoftThinks SAS)
SRV - (IS360service) – C:\Program Files\IObit\IObit Security 360\is360srv.exe (IObit)
SRV - (ACDaemon) – C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe (ArcSoft Inc.)
SRV - (STacSV) – C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_0145da1d\stacsv.exe (IDT, Inc.)
SRV - (LVPrcSrv) – C:\Program Files\Common Files\logishrd\LVMVFM\LVPrcSrv.exe (Logitech Inc.)
SRV - (AESTFilters) – C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_0145da1d\AEstSrv.exe (Andrea Electronics Corporation)
SRV - (IJPLMSVC) – C:\Program Files\Canon\IJPLM\ijplmsvc.exe ()
SRV - (GoToAssist) – C:\Program Files\Citrix\GoToAssist\514\g2aservice.exe (Citrix Online, a division of Citrix Systems, Inc.)
SRV - (hnmsvc) – C:\Program Files\Common Files\Dell\Advanced Networking Service\hnm_svc.exe (Dell Inc.)
SRV - (dsl-fs-sync) – C:\Program Files\Common Files\Dell\Remote Access File Sync Service\dsl_fs_sync.exe (SingleClick Systems)
SRV - (DockLoginService) – C:\Program Files\Dell\DellDock\DockLogin.exe (Stardock Corporation)
SRV - (uvnc_service) – C:\ProgramData\UltraVNC\winvnc.exe (UltraVNC)
SRV - (IAANTMON) – C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTmon.exe (Intel Corporation)
SRV - (WinDefend) – C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)
SRV - (dsl-db) – C:\Program Files\Common Files\Dell\MySQL\bin\mysqld.exe ()
SRV - (sprtsvc_medicsp2) – C:\Program Files\twc\medicsp2\bin\sprtsvc.exe (SupportSoft, Inc.)


========== Driver Services (SafeList) ==========

DRV - (SASKUTIL) – C:\Users\Heidi\AppData\Local\Temp\SAS_SelfExtract\SASKUTIL.SYS File not found
DRV - (SASDIFSV) – C:\Users\Heidi\AppData\Local\Temp\SAS_SelfExtract\SASDIFSV.SYS File not found
DRV - (NwlnkFwd) – system32\DRIVERS\nwlnkfwd.sys File not found
DRV - (NwlnkFlt) – system32\DRIVERS\nwlnkflt.sys File not found
DRV - (kwqgcpcj) – System32\drivers\oflneeun.sys File not found
DRV - (IpInIp) – system32\DRIVERS\ipinip.sys File not found
DRV - (MpKsl8570a568) – c:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{C0DBAA48-FA20-44D2-8099-906D0B736139}\MpKsl8570a568.sys (Microsoft Corporation)
DRV - (MBAMProtector) – C:\Windows\System32\drivers\mbam.sys (Malwarebytes Corporation)
DRV - (NisDrv) – C:\Windows\System32\drivers\NisDrvWFP.sys (Microsoft Corporation)
DRV - (SbFw) – C:\Windows\System32\drivers\SbFw.sys (GFI Software)
DRV - (sbhips) – C:\Windows\System32\drivers\sbhips.sys (GFI Software)
DRV - (sbwtis) – C:\Windows\System32\drivers\sbwtis.sys (GFI Software)
DRV - (Lbd) – C:\Windows\System32\drivers\Lbd.sys (Lavasoft AB)
DRV - (Lavasoft Kernexplorer) – C:\Program Files\Lavasoft\Ad-Aware\kernexplorer.sys ()
DRV - (SBFWIMCLMP) – C:\Windows\System32\drivers\SbFwIm.sys (GFI Software)
DRV - (SBFWIMCL) – C:\Windows\System32\drivers\SbFwIm.sys (GFI Software)
DRV - (ImmunetProtectDriver) – C:\Windows\System32\drivers\ImmunetProtect.sys (Windows ® Codename Longhorn DDK provider)
DRV - (ImmunetSelfProtectDriver) – C:\Windows\System32\drivers\ImmunetSelfProtect.sys (Windows ® Codename Longhorn DDK provider)
DRV - (SmartDefragDriver) – C:\Windows\System32\drivers\SmartDefragDriver.sys ()
DRV - (PSI) – C:\Windows\System32\drivers\psi_mf.sys (Secunia)
DRV - (pwdrvio) – C:\Windows\System32\pwdrvio.sys ()
DRV - (pwdspio) – C:\Windows\System32\pwdspio.sys ()
DRV - (STHDA) – C:\Windows\System32\drivers\stwrt.sys (IDT, Inc.)
DRV - (LVPr2Mon) – C:\Windows\System32\drivers\LVPr2Mon.sys ()
DRV - (BCM42RLY) – C:\Windows\System32\drivers\bcm42rly.sys (Broadcom Corporation)
DRV - (ApfiltrService) – C:\Windows\System32\drivers\Apfiltr.sys (Alps Electric Co., Ltd.)
DRV - (Packet) – C:\Windows\System32\drivers\packet.sys (SingleClick Systems)
DRV - (e1express) – C:\Windows\System32\drivers\e1e6032.sys (Intel Corporation)
DRV - (LVUSBSta) – C:\Windows\System32\drivers\LVUSBSta.sys (Logitech Inc.)
DRV - (PID_PEPI) – C:\Windows\System32\drivers\LV302V32.SYS (Logitech Inc.)
DRV - (R300) – C:\Windows\System32\drivers\atikmdag.sys (ATI Technologies Inc.)
DRV - (WimFltr) – C:\Windows\System32\drivers\WimFltr.sys (Microsoft Corporation)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://g.msn.com/USCON/1
IE - HKLM\..\SearchScopes,DefaultScope = {6A1806CD-94D4-4689-BA73-E35EA1EA9990}
IE - HKLM\..\SearchScopes\{2ED7F417-7E96-482C-8B7C-B38575AE7725}: "URL" = http://search.live.com/results.aspx?q={sea…ferrer:source?}
IE - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://www.google.com/search?q={searchTerm…mp;sourceid=ie7


IE - HKU\.DEFAULT\..\SearchScopes,DefaultScope = {6A1806CD-94D4-4689-BA73-E35EA1EA9990}
IE - HKU\.DEFAULT\..\SearchScopes\{2ED7F417-7E96-482C-8B7C-B38575AE7725}: "URL" = http://www.bing.com/search?q={searchTerms}…rc=IE-SearchBox
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-18\..\SearchScopes,DefaultScope = {6A1806CD-94D4-4689-BA73-E35EA1EA9990}
IE - HKU\S-1-5-18\..\SearchScopes\{2ED7F417-7E96-482C-8B7C-B38575AE7725}: "URL" = http://www.bing.com/search?q={searchTerms}…rc=IE-SearchBox
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0



IE - HKU\S-1-5-21-1158375537-2513235221-245670277-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://g.msn.com/USCON/1
IE - HKU\S-1-5-21-1158375537-2513235221-245670277-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.google.com/ie
IE - HKU\S-1-5-21-1158375537-2513235221-245670277-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = http://www.google.com/ie
IE - HKU\S-1-5-21-1158375537-2513235221-245670277-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.google.com
IE - HKU\S-1-5-21-1158375537-2513235221-245670277-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://isearch.avg.com/?cid={046AF6B5-EFF2…mp;d=2012-07-08 14:31:33&v;=11.1.0.12&sap;=hp
IE - HKU\S-1-5-21-1158375537-2513235221-245670277-1001\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKU\S-1-5-21-1158375537-2513235221-245670277-1001\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = http://www.google.com/ie
IE - HKU\S-1-5-21-1158375537-2513235221-245670277-1001\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ie
IE - HKU\S-1-5-21-1158375537-2513235221-245670277-1001\..\SearchScopes,DefaultScope = {6A1806CD-94D4-4689-BA73-E35EA1EA9990}
IE - HKU\S-1-5-21-1158375537-2513235221-245670277-1001\..\SearchScopes\{2ED7F417-7E96-482C-8B7C-B38575AE7725}: "URL" = http://www.bing.com/search?q={searchTerms}…rc=IE-SearchBox
IE - HKU\S-1-5-21-1158375537-2513235221-245670277-1001\..\SearchScopes\{63140ECF-C629-BE59-8F0E-90B4FF340C03}: "URL" = http://www.bing.com/search?q={searchTerms}…eferrer:source}
IE - HKU\S-1-5-21-1158375537-2513235221-245670277-1001\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://www.google.com/search?q={searchTerm…;rlz=1I7GPCK_en
IE - HKU\S-1-5-21-1158375537-2513235221-245670277-1001\..\SearchScopes\{95B7759C-8C7F-4BF1-B163-73684A933233}: "URL" = http://isearch.avg.com/search?cid={046AF6B…mp;d=2012-07-08 14:31:33&v;=11.1.0.12&sap;=dsp&q;={searchTerms}
IE - HKU\S-1-5-21-1158375537-2513235221-245670277-1001\..\SearchScopes\{D5042721-6DFD-85DD-AD1C-6B852F3F6275}: "URL" = http://www.bing.com/search?q={searchTerms}…amp;form=ZGAIDF
IE - HKU\S-1-5-21-1158375537-2513235221-245670277-1001\..\SearchScopes\{DECA3892-BA8F-44b8-A993-A466AD694AE4}: "URL" = http://search.yahoo.com/search?p={searchTe…mp;fr=chr-iobit
IE - HKU\S-1-5-21-1158375537-2513235221-245670277-1001\..\SearchScopes\{FDA3B927-CE90-F095-31E5-29B4FDC893D7}: "URL" = http://www.bing.com/search?q={searchTerms}…eferrer:source}
IE - HKU\S-1-5-21-1158375537-2513235221-245670277-1001\..\SearchScopes\Yahoo!: "URL" = http://search.yahoo.com/search?fr=chr-gree…p={searchTerms}
IE - HKU\S-1-5-21-1158375537-2513235221-245670277-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-21-1158375537-2513235221-245670277-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

IE - HKU\S-1-5-21-1158375537-2513235221-245670277-1002\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://g.msn.com/USCON/1
IE - HKU\S-1-5-21-1158375537-2513235221-245670277-1002\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.google.com/ie
IE - HKU\S-1-5-21-1158375537-2513235221-245670277-1002\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = http://www.google.com/ie
IE - HKU\S-1-5-21-1158375537-2513235221-245670277-1002\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.google.com
IE - HKU\S-1-5-21-1158375537-2513235221-245670277-1002\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKU\S-1-5-21-1158375537-2513235221-245670277-1002\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = http://www.google.com/ie
IE - HKU\S-1-5-21-1158375537-2513235221-245670277-1002\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ie
IE - HKU\S-1-5-21-1158375537-2513235221-245670277-1002\..\SearchScopes,DefaultScope = {6A1806CD-94D4-4689-BA73-E35EA1EA9990}
IE - HKU\S-1-5-21-1158375537-2513235221-245670277-1002\..\SearchScopes\{2ED7F417-7E96-482C-8B7C-B38575AE7725}: "URL" = http://www.bing.com/search?q={searchTerms}…rc=IE-SearchBox
IE - HKU\S-1-5-21-1158375537-2513235221-245670277-1002\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://www.google.com/search?q={searchTerm…;rlz=1I7GPCK_en
IE - HKU\S-1-5-21-1158375537-2513235221-245670277-1002\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-21-1158375537-2513235221-245670277-1002\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

========== FireFox ==========

FF - prefs.js..browser.search.param.yahoo-fr: "chr-greentree_ff&type;=382950"
FF - prefs.js..browser.search.selectedEngine: "Google"
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "http://google.com/"
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20
FF - prefs.js..extensions.enabledItems: {ABDE892B-13A8-4d1b-88E6-365A6E755758}:14.0.2
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}:6.0.21
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}:6.0.22
FF - prefs.js..extensions.enabledItems: [removed]:4.3
FF - prefs.js..extensions.enabledItems: [removed]:4.3
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}:6.0.23
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}:6.0.24


FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32_11_3_300_270.dll ()
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@avg.com/AVG SiteSafety plugin,version=11.0.0.1,application/x-avg-sitesafety-plugin: C:\Program Files\Common Files\AVG Secure Search\SiteSafetyInstaller\11.2.0\\npsitesafety.dll ()
FF - HKLM\Software\MozillaPlugins\@canon.com/EPPEX: C:\Program Files\Canon\Easy-PhotoPrint EX\NPEZFFPI.DLL (CANON INC.)
FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF - HKLM\Software\MozillaPlugins\@google.com/npPicasa2,version=2.0.0: C:\Program Files\Picasa2\npPicasa2.dll (Google, Inc.)
FF - HKLM\Software\MozillaPlugins\@google.com/npPicasa3,version=3.0.0: C:\Program Files\Picasa2\npPicasa3.dll (Google, Inc.)
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=1.6.0_33: C:\Windows\system32\npdeployJava1.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\plugin2\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\5.1.10411.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3508.1109: C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@real.com/nppl3260;version=15.0.4.53: c:\program files\real\realplayer\Netscape6\nppl3260.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprjplug;version=15.0.4.53: c:\program files\real\realplayer\Netscape6\nprjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprpchromebrowserrecordext;version=15.0.4.53: C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprpchromebrowserrecordext.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprphtml5videoshim;version=15.0.4.53: C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprpplugin;version=15.0.4.53: c:\program files\real\realplayer\Netscape6\nprpplugin.dll (RealPlayer)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.115\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.115\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=2.0.1: C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{3112ca9c-de6d-4884-a869-9855de68056c}: C:\ProgramData\Google\Toolbar for Firefox\{3112ca9c-de6d-4884-a869-9855de68056c} [2009/10/11 21:29:22 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{97E22097-9A2F-45b1-8DAF-36AD648C7EF4}: C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext [2012/05/23 05:51:35 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\avg@toolbar: C:\ProgramData\AVG Secure Search\11.1.0.12\ [2012/07/08 14:32:04 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 14.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012/07/29 12:56:59 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 14.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2012/07/08 13:45:06 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 13.0.1\extensions\\Components: C:\Program Files\Mozilla Thunderbird\components [2012/07/08 16:21:02 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 13.0.1\extensions\\Plugins: C:\Program Files\Mozilla Thunderbird\plugins [2012/07/02 21:22:06 | 000,000,000 | —D | M]

[2009/12/13 07:58:54 | 000,000,000 | —D | M] (No name found) – C:\Users\Heidi\AppData\Roaming\Mozilla\Extensions
[2009/12/13 07:58:54 | 000,000,000 | —D | M] (No name found) – C:\Users\Heidi\AppData\Roaming\Mozilla\Extensions\{3550f703-e582-4d05-9a08-453d09bdfdc6}
[2012/07/29 15:40:55 | 000,000,000 | —D | M] (No name found) – C:\Users\Heidi\AppData\Roaming\Mozilla\Firefox\Profiles\60wjxva2.default\extensions
[2010/06/26 07:25:04 | 000,000,000 | —D | M] (Microsoft .NET Framework Assistant) – C:\Users\Heidi\AppData\Roaming\Mozilla\Firefox\Profiles\60wjxva2.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2011/11/27 13:07:45 | 000,000,000 | —D | M] (StartNow Toolbar) – C:\Users\Heidi\AppData\Roaming\Mozilla\Firefox\Profiles\60wjxva2.default\extensions\{5911488E-9D1E-40ec-8CBB-06B231CC153F}
[2012/07/29 14:21:49 | 000,000,000 | —D | M] (ShopToWin12) – C:\Users\Heidi\AppData\Roaming\Mozilla\Firefox\Profiles\60wjxva2.default\extensions\{70263cf9-d46a-4be4-adc6-29500ba884e1}
[2012/05/20 22:35:49 | 000,000,000 | —D | M] (Ad-Aware Security Toolbar) – C:\Users\Heidi\AppData\Roaming\Mozilla\Firefox\Profiles\60wjxva2.default\extensions\{87934c42-161d-45bc-8cef-ef18abe2a30c}
[2011/10/20 09:46:12 | 000,000,000 | —D | M] (Разпознаване на устройство Logitech) – C:\Users\Heidi\AppData\Roaming\Mozilla\Firefox\Profiles\60wjxva2.default\extensions\[removed]
[2012/05/20 22:36:05 | 000,000,000 | —D | M] (Lavasoft Search Plugin) – C:\Users\Heidi\AppData\Roaming\Mozilla\Firefox\Profiles\60wjxva2.default\extensions\jid1-yZwVFzbsyfMrqQ@jetpack
[2011/01/28 20:59:52 | 000,002,232 | —- | M] () – C:\Users\Heidi\AppData\Roaming\Mozilla\Firefox\Profiles\60wjxva2.default\searchplugins\alot-search.xml
[2011/11/27 20:38:13 | 000,001,945 | —- | M] () – C:\Users\Heidi\AppData\Roaming\Mozilla\Firefox\Profiles\60wjxva2.default\searchplugins\bing-zugo.xml
[2012/08/05 20:09:25 | 000,001,982 | —- | M] () – C:\Users\Heidi\AppData\Roaming\Mozilla\Firefox\Profiles\60wjxva2.default\searchplugins\search-here.xml
[2012/07/08 14:10:16 | 000,000,000 | —D | M] (No name found) – C:\Program Files\Mozilla Firefox\extensions
[2012/03/25 09:57:35 | 000,000,000 | —D | M] (Skype Click to Call) – C:\Program Files\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}
[2012/07/08 13:45:09 | 000,000,000 | —D | M] (Java Console) – C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA}
[2012/07/29 12:57:04 | 000,022,392 | —- | M] () (No name found) – C:\USERS\HEIDI\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\60WJXVA2.DEFAULT\EXTENSIONS\[removed]
[2012/07/29 12:56:58 | 000,136,672 | —- | M] (Mozilla Foundation) – C:\Program Files\mozilla firefox\components\browsercomps.dll
[2012/07/02 21:22:04 | 000,466,944 | —- | M] (Catalina Marketing Corporation) – C:\Program Files\mozilla firefox\plugins\NPcol400.dll
[2012/06/20 12:54:54 | 000,091,584 | —- | M] (Coupons, Inc.) – C:\Program Files\mozilla firefox\plugins\npCouponPrinter.dll
[2012/06/20 12:54:56 | 000,091,584 | —- | M] (Coupons, Inc.) – C:\Program Files\mozilla firefox\plugins\npMozCouponPrinter.dll
[2012/05/23 05:49:44 | 000,129,144 | —- | M] (RealPlayer) – C:\Program Files\mozilla firefox\plugins\nprpplugin.dll
[2012/07/29 12:56:29 | 000,001,525 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\amazon-en-GB.xml
[2012/07/08 14:31:08 | 000,003,750 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\avg-secure-search.xml
[2012/07/29 12:55:42 | 000,002,349 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\babylon.xml
[2012/07/29 12:56:29 | 000,002,252 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\bing.xml
[2010/01/01 04:00:00 | 000,002,252 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\bing.xml.old
[2012/07/29 12:56:29 | 000,000,935 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\chambers-en-GB.xml
[2012/07/29 12:56:29 | 000,001,166 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\eBay-en-GB.xml
[2012/07/29 12:56:29 | 000,002,040 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\twitter.xml
[2012/07/29 12:56:29 | 000,001,121 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\yahoo-en-GB.xml

O1 HOSTS File: ([2012/01/21 22:04:54 | 000,440,551 | R— | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: ::1 localhost
O1 - Hosts: 127.0.0.1 www.007guard.com
O1 - Hosts: 127.0.0.1 007guard.com
O1 - Hosts: 127.0.0.1 008i.com
O1 - Hosts: 127.0.0.1 www.008k.com
O1 - Hosts: 127.0.0.1 008k.com
O1 - Hosts: 127.0.0.1 www.00hq.com
O1 - Hosts: 127.0.0.1 00hq.com
O1 - Hosts: 127.0.0.1 010402.com
O1 - Hosts: 127.0.0.1 www.032439.com
O1 - Hosts: 127.0.0.1 032439.com
O1 - Hosts: 127.0.0.1 www.0scan.com
O1 - Hosts: 127.0.0.1 0scan.com
O1 - Hosts: 127.0.0.1 www.1000gratisproben.com
O1 - Hosts: 127.0.0.1 1000gratisproben.com
O1 - Hosts: 127.0.0.1 www.1001namen.com
O1 - Hosts: 127.0.0.1 1001namen.com
O1 - Hosts: 127.0.0.1 100888290cs.com
O1 - Hosts: 127.0.0.1 www.100888290cs.com
O1 - Hosts: 127.0.0.1 100sexlinks.com
O1 - Hosts: 127.0.0.1 www.100sexlinks.com
O1 - Hosts: 127.0.0.1 10sek.com
O1 - Hosts: 127.0.0.1 www.10sek.com
O1 - Hosts: 127.0.0.1 www.1-2005-search.com
O1 - Hosts: 15149 more lines…
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - No CLSID value found.
O2 - BHO: (IObit Toolbar) - {0BDA0769-FD72-49F4-9266-E1FB004F4D8F} - C:\Program Files\IObit Toolbar\IE\4.6\iobitToolbarIE.dll (Spigot, Inc.)
O2 - BHO: (RealPlayer Download and Record Plugin for Internet Explorer) - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll (RealPlayer)
O2 - BHO: (Canon Easy-WebPrint EX BHO) - {3785D0AD-BFFF-47F6-BF5B-A587C162FED9} - C:\Program Files\Canon\Easy-WebPrint EX\ewpexbho.dll (CANON INC.)
O2 - BHO: (no name) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - No CLSID value found.
O2 - BHO: (Spybot-S&D; IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O2 - BHO: (Ad-Aware Security Toolbar) - {6c97a91e-4524-4019-86af-2aa2d567bf5c} - C:\Program Files\adawaretb\adawareDx.dll ()
O2 - BHO: (Java™ Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (AVG Security Toolbar) - {95B7759C-8C7F-4BF1-B163-73684A933233} - C:\Program Files\AVG Secure Search\11.1.0.12\AVG Secure Search_toolbar.dll ()
O2 - BHO: (Skype Browser Helper) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O3 - HKLM\..\Toolbar: (IObit Toolbar) - {0BDA0769-FD72-49F4-9266-E1FB004F4D8F} - C:\Program Files\IObit Toolbar\IE\4.6\iobitToolbarIE.dll (Spigot, Inc.)
O3 - HKLM\..\Toolbar: (no name) - {5911488E-9D1E-40ec-8CBB-06B231CC153F} - No CLSID value found.
O3 - HKLM\..\Toolbar: (Ad-Aware Security Toolbar) - {6c97a91e-4524-4019-86af-2aa2d567bf5c} - C:\Program Files\adawaretb\adawareDx.dll ()
O3 - HKLM\..\Toolbar: (Canon Easy-WebPrint EX) - {759D9886-0C6F-4498-BAB6-4A5F47C6C72F} - C:\Program Files\Canon\Easy-WebPrint EX\ewpexhlp.dll (CANON INC.)
O3 - HKLM\..\Toolbar: (AVG Security Toolbar) - {95B7759C-8C7F-4BF1-B163-73684A933233} - C:\Program Files\AVG Secure Search\11.1.0.12\AVG Secure Search_toolbar.dll ()
O3 - HKLM\..\Toolbar: (no name) - {9D425283-D487-4337-BAB6-AB8354A81457} - No CLSID value found.
O3 - HKU\.DEFAULT\..\Toolbar\WebBrowser: (no name) - {3041D03E-FD4B-44E0-B742-2D9B88305F98} - No CLSID value found.
O3 - HKU\.DEFAULT\..\Toolbar\WebBrowser: (Canon Easy-WebPrint EX) - {759D9886-0C6F-4498-BAB6-4A5F47C6C72F} - C:\Program Files\Canon\Easy-WebPrint EX\ewpexhlp.dll (CANON INC.)
O3 - HKU\S-1-5-18\..\Toolbar\WebBrowser: (no name) - {3041D03E-FD4B-44E0-B742-2D9B88305F98} - No CLSID value found.
O3 - HKU\S-1-5-18\..\Toolbar\WebBrowser: (Canon Easy-WebPrint EX) - {759D9886-0C6F-4498-BAB6-4A5F47C6C72F} - C:\Program Files\Canon\Easy-WebPrint EX\ewpexhlp.dll (CANON INC.)
O3 - HKU\S-1-5-21-1158375537-2513235221-245670277-1001\..\Toolbar\WebBrowser: (no name) - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No CLSID value found.
O3 - HKU\S-1-5-21-1158375537-2513235221-245670277-1001\..\Toolbar\WebBrowser: (no name) - {3041D03E-FD4B-44E0-B742-2D9B88305F98} - No CLSID value found.
O3 - HKU\S-1-5-21-1158375537-2513235221-245670277-1001\..\Toolbar\WebBrowser: (Canon Easy-WebPrint EX) - {759D9886-0C6F-4498-BAB6-4A5F47C6C72F} - C:\Program Files\Canon\Easy-WebPrint EX\ewpexhlp.dll (CANON INC.)
O3 - HKU\S-1-5-21-1158375537-2513235221-245670277-1002\..\Toolbar\WebBrowser: (no name) - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No CLSID value found.
O3 - HKU\S-1-5-21-1158375537-2513235221-245670277-1002\..\Toolbar\WebBrowser: (no name) - {3041D03E-FD4B-44E0-B742-2D9B88305F98} - No CLSID value found.
O3 - HKU\S-1-5-21-1158375537-2513235221-245670277-1002\..\Toolbar\WebBrowser: (Canon Easy-WebPrint EX) - {759D9886-0C6F-4498-BAB6-4A5F47C6C72F} - C:\Program Files\Canon\Easy-WebPrint EX\ewpexhlp.dll (CANON INC.)
O4 - HKLM..\Run: [Apoint] C:\Program Files\DellTPad\Apoint.exe (Alps Electric Co., Ltd.)
O4 - HKLM..\Run: [APSDaemon] C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
O4 - HKLM..\Run: [ArcSoft Connection Service] C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe (ArcSoft Inc.)
O4 - HKLM..\Run: [CanonMyPrinter] C:\Program Files\Canon\MyPrinter\BJMyPrt.exe (CANON INC.)
O4 - HKLM..\Run: [CanonSolutionMenu] C:\Program Files\Canon\SolutionMenu\CNSLMAIN.exe (CANON INC.)
O4 - HKLM..\Run: [CarboniteSetupLite] C:\Program Files\Carbonite\CarbonitePreinstaller.exe (Carbonite, Inc.)
O4 - HKLM..\Run: [HF_G_Jul] C:\Program Files\AVG Secure Search\HF_G_Jul.exe ()
O4 - HKLM..\Run: [IAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe (Intel Corporation)
O4 - HKLM..\Run: [Immunet Protect] C:\Program Files\Immunet Protect\2.0.17\iptray.exe (Immunet)
O4 - HKLM..\Run: [LogitechQuickCamRibbon] C:\Program Files\Logitech\Logitech WebCam Software\LWS.exe ()
O4 - HKLM..\Run: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
O4 - HKLM..\Run: [MSC] c:\Program Files\Microsoft Security Client\msseces.exe (Microsoft Corporation)
O4 - HKLM..\Run: [PDVDDXSrv] C:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exe (CyberLink Corp.)
O4 - HKLM..\Run: [QuickSet] C:\Program Files\Dell\QuickSet\quickset.exe (Dell Inc.)
O4 - HKLM..\Run: [SysTrayApp] C:\Program Files\IDT\WDM\sttray.exe (IDT, Inc.)
O4 - HKLM..\Run: [TkBellExe] c:\program files\real\realplayer\Update\realsched.exe (RealNetworks, Inc.)
O4 - HKLM..\Run: [vProt] C:\Program Files\AVG Secure Search\vprot.exe ()
O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)
O4 - HKU\S-1-5-19..\Run: [WindowsWelcomeCenter] C:\Windows\System32\oobefldr.dll (Microsoft Corporation)
O4 - HKU\S-1-5-20..\Run: [WindowsWelcomeCenter] C:\Windows\System32\oobefldr.dll (Microsoft Corporation)
O4 - HKU\S-1-5-21-1158375537-2513235221-245670277-1001..\Run: [Advanced SystemCare 5] C:\Program Files\IObit\Advanced SystemCare 5\ASCTray.exe (IObit)
O4 - Startup: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dell Dock First Run.lnk = C:\Program Files\Dell\DellDock\DellDock.exe (Stardock Corporation)
O4 - Startup: C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dell Dock First Run.lnk = C:\Program Files\Dell\DellDock\DellDock.exe (Stardock Corporation)
O4 - Startup: C:\Users\Heidi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dell Dock.lnk = C:\Program Files\Dell\DellDock\DellDock.exe (Stardock Corporation)
O4 - Startup: C:\Users\Heidi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WRAL Desktop Alert.lnk = C:\Program Files\WRAL Desktop Alert\liveonline_3977114.exe ()
O4 - Startup: C:\Users\Peter\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dell Dock.lnk = C:\Program Files\Dell\DellDock\DellDock.exe (Stardock Corporation)
O4 - Startup: C:\Users\RA Media Server\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dell Dock First Run.lnk = C:\Program Files\Dell\DellDock\DellDock.exe (Stardock Corporation)
O8 - Extra context menu item: Add to Google Photos Screensa&ver; - C:\Windows\System32\GPhotos.scr (Google Inc.)
O9 - Extra Button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra 'Tools' menuitem : Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra 'Tools' menuitem : Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O13 - gopher Prefix: missing
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_33)
O16 - DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_33)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_33)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1 192.168.2.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{9B676C79-5753-4C0F-AA70-B380E0429E69}: DhcpNameServer = 192.168.2.1 192.168.2.1
O18 - Protocol\Handler\belarc {6318E0AB-2E93-11D1-B8ED-00608CC9A71F} - C:\Program Files\Belarc\Advisor\System\BAVoilaX.dll (Belarc, Inc.)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O18 - Protocol\Handler\viprotocol {B658800C-F66E-4EF3-AB85-6C0C227862A9} - C:\Program Files\Common Files\AVG Secure Search\ViProtocolInstaller\11.2.0\ViProtocol.dll ()
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)
O20 - Winlogon\Notify\GoToAssist: DllName - (C:\Program Files\Citrix\GoToAssist\514\G2AWinLogon.dll) - C:\Program Files\Citrix\GoToAssist\514\g2awinlogon.dll (Citrix Online, a division of Citrix Systems, Inc.)
O24 - Desktop WallPaper: C:\Windows\Web\Wallpaper\img27.jpg
O24 - Desktop BackupWallPaper: C:\Windows\Web\Wallpaper\img27.jpg
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006/09/18 17:43:36 | 000,000,024 | —- | M] () - C:\autoexec.bat – [ NTFS ]
O32 - AutoRun File - [2004/04/30 18:01:00 | 000,000,053 | -HS- | M] () - E:\AUTORUN.INF – [ NTFS ]
O33 - MountPoints2\{399f6cff-808b-11de-9405-0023ae1b5109}\Shell - "" = AutoRun
O33 - MountPoints2\{399f6cff-808b-11de-9405-0023ae1b5109}\Shell\AutoRun\command - "" = F:\LaunchU3.exe -a
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*
O37 - HKU\S-1-5-21-1158375537-2513235221-245670277-1001\…exe [@ = exefile] – Reg Error: Key error. File not found
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)

NetSvcs: FastUserSwitchingCompatibility - File not found
NetSvcs: Ias - C:\Windows\System32\ias.dll (Microsoft Corporation)
NetSvcs: Nla - File not found
NetSvcs: Ntmssvc - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: SRService - File not found
NetSvcs: WmdmPmSp - File not found
NetSvcs: LogonHours - File not found
NetSvcs: PCAudit - File not found
NetSvcs: helpsvc - File not found
NetSvcs: uploadmgr - File not found

CREATERESTOREPOINT
Restore point Set: OTL Restore Point

========== Files/Folders - Created Within 30 Days ==========

[2012/08/05 21:16:06 | 000,596,480 | —- | C] (OldTimer Tools) – C:\Users\Heidi\Desktop\OTL.exe
[2012/08/05 01:10:08 | 000,000,000 | —D | C] – C:\Users\Heidi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\HiJackThis
[2012/08/05 01:10:07 | 000,000,000 | —D | C] – C:\Program Files\Trend Micro
[2012/07/29 12:54:27 | 000,000,000 | —D | C] – C:\Users\Heidi\AppData\Roaming\DefaultTab
[2012/07/29 12:50:31 | 000,000,000 | —D | C] – C:\ProgramData\Tarma Installer
[2012/07/16 23:28:00 | 000,000,000 | —D | C] – C:\Users\Heidi\Desktop\DO NOT OPEN
[2012/07/08 17:17:52 | 000,000,000 | —D | C] – C:\Users\Heidi\AppData\Local\Macromedia
[2012/07/08 16:39:49 | 000,000,000 | –SD | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\OpenOffice.org 3.4
[2012/07/08 14:49:19 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes
[2012/07/08 14:47:14 | 000,000,000 | —D | C] – C:\Program Files\iPod
[2012/07/08 14:46:59 | 000,000,000 | —D | C] – C:\Program Files\iTunes
[2012/07/08 14:32:58 | 000,000,000 | —D | C] – C:\Users\Heidi\AppData\Local\AVG Secure Search
[2012/07/08 14:31:33 | 000,000,000 | —D | C] – C:\ProgramData\AVG Secure Search
[2012/07/08 14:31:23 | 000,000,000 | —D | C] – C:\Program Files\Common Files\AVG Secure Search
[2012/07/08 14:31:10 | 000,000,000 | —D | C] – C:\Program Files\AVG Secure Search
[2012/07/08 14:29:47 | 000,000,000 | -H-D | C] – C:\ProgramData\Common Files

========== Files - Modified Within 30 Days ==========

[2012/08/05 21:35:00 | 000,000,420 | -H– | M] () – C:\Windows\tasks\User_Feed_Synchronization-{1E2F2322-1323-4A6F-8005-2C5E37204C45}.job
[2012/08/05 21:16:12 | 000,596,480 | —- | M] (OldTimer Tools) – C:\Users\Heidi\Desktop\OTL.exe
[2012/08/05 21:09:00 | 000,000,886 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2012/08/05 21:08:14 | 000,067,584 | –S- | M] () – C:\Windows\bootstat.dat
[2012/08/05 18:53:16 | 000,003,616 | -H– | M] () – C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2012/08/05 18:53:16 | 000,003,616 | -H– | M] () – C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2012/08/05 18:44:03 | 000,000,830 | —- | M] () – C:\Windows\tasks\Adobe Flash Player Updater.job
[2012/08/05 16:54:37 | 000,000,000 | RHS- | M] () – C:\MSDOS.SYS
[2012/08/05 16:54:37 | 000,000,000 | RHS- | M] () – C:\IO.SYS
[2012/08/05 16:53:47 | 000,000,882 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2012/08/05 16:47:02 | 000,000,476 | —- | M] () – C:\Windows\wininit.ini
[2012/08/05 14:37:09 | 000,000,064 | —- | M] () – C:\Windows\System32\rp_stats.dat
[2012/08/05 14:37:09 | 000,000,044 | —- | M] () – C:\Windows\System32\rp_rules.dat
[2012/08/05 01:10:08 | 000,001,948 | —- | M] () – C:\Users\Heidi\Desktop\HiJackThis.lnk
[2012/07/29 22:00:00 | 000,000,384 | —- | M] () – C:\Windows\tasks\SmartDefrag.job
[2012/07/29 15:42:38 | 000,000,908 | —- | M] () – C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2012/07/29 12:56:14 | 000,000,304 | —- | M] () – C:\user.js
[2012/07/26 18:58:15 | 000,017,920 | —- | M] () – C:\Users\Heidi\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2012/07/26 18:58:04 | 000,606,916 | —- | M] () – C:\Windows\System32\perfh009.dat
[2012/07/26 18:58:04 | 000,105,670 | —- | M] () – C:\Windows\System32\perfc009.dat
[2012/07/09 17:27:07 | 000,028,031 | —- | M] () – C:\Users\Heidi\Desktop\shri_mandala.jpg
[2012/07/09 17:19:16 | 007,832,232 | —- | M] () – C:\Users\Heidi\Desktop\10mandala-coloring-pages.pdf
[2012/07/08 18:38:31 | 000,000,680 | —- | M] () – C:\Users\Heidi\AppData\Local\d3d9caps.dat
[2012/07/08 18:36:16 | 000,303,184 | —- | M] () – C:\Windows\System32\FNTCACHE.DAT
[2012/07/08 16:39:49 | 000,001,033 | —- | M] () – C:\Users\Public\Desktop\OpenOffice.org 3.4.lnk
[2012/07/08 14:49:20 | 000,001,666 | —- | M] () – C:\Users\Public\Desktop\iTunes.lnk

========== Files Created - No Company Name ==========

[2012/08/05 16:54:37 | 000,000,000 | RHS- | C] () – C:\MSDOS.SYS
[2012/08/05 16:54:37 | 000,000,000 | RHS- | C] () – C:\IO.SYS
[2012/08/05 16:47:02 | 000,000,476 | —- | C] () – C:\Windows\wininit.ini
[2012/08/05 01:10:08 | 000,001,948 | —- | C] () – C:\Users\Heidi\Desktop\HiJackThis.lnk
[2012/07/29 12:56:14 | 000,000,304 | —- | C] () – C:\user.js
[2012/07/09 17:27:06 | 000,028,031 | —- | C] () – C:\Users\Heidi\Desktop\shri_mandala.jpg
[2012/07/09 17:18:58 | 007,832,232 | —- | C] () – C:\Users\Heidi\Desktop\10mandala-coloring-pages.pdf
[2012/07/08 18:38:31 | 000,000,680 | —- | C] () – C:\Users\Heidi\AppData\Local\d3d9caps.dat
[2012/07/08 16:39:49 | 000,001,033 | —- | C] () – C:\Users\Public\Desktop\OpenOffice.org 3.4.lnk
[2012/07/08 14:49:20 | 000,001,666 | —- | C] () – C:\Users\Public\Desktop\iTunes.lnk
[2012/03/31 15:20:58 | 000,017,920 | —- | C] () – C:\Users\Heidi\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2012/01/15 11:13:42 | 000,061,440 | —- | C] () – C:\Windows\uninstall.exe
[2011/12/08 20:39:34 | 000,016,432 | —- | C] () – C:\Windows\System32\lsdelete.exe
[2011/11/27 20:34:03 | 000,001,492 | —- | C] () – C:\ProgramData\ss.ini
[2011/09/10 10:14:19 | 000,025,944 | —- | C] () – C:\Windows\System32\SmartDefragBootTime.exe
[2011/09/10 10:14:19 | 000,015,672 | —- | C] () – C:\Windows\System32\drivers\SmartDefragDriver.sys
[2011/07/01 20:37:18 | 000,140,288 | —- | C] () – C:\Windows\System32\igfxtvcx.dll
[2011/07/01 20:27:03 | 000,982,196 | —- | C] () – C:\Windows\System32\igkrng500.bin
[2011/07/01 20:26:40 | 000,139,824 | —- | C] () – C:\Windows\System32\igfcg500.bin
[2011/07/01 20:26:40 | 000,097,448 | —- | C] () – C:\Windows\System32\igfcg500m.bin
[2011/07/01 20:26:37 | 000,417,344 | —- | C] () – C:\Windows\System32\igcompkrng500.bin
[2011/06/15 09:20:52 | 000,105,240 | —- | C] () – C:\Windows\System32\RSTCoin.dll
[2011/03/20 14:30:23 | 000,725,064 | —- | C] () – C:\Windows\System32\pwNative.exe
[2011/03/20 14:30:22 | 000,016,472 | —- | C] () – C:\Windows\System32\pwdrvio.sys
[2011/03/20 14:30:04 | 000,011,104 | —- | C] () – C:\Windows\System32\pwdspio.sys
[2011/03/20 11:30:02 | 000,000,064 | —- | C] () – C:\Windows\System32\rp_stats.dat
[2011/03/20 11:30:02 | 000,000,044 | —- | C] () – C:\Windows\System32\rp_rules.dat
[2009/03/16 09:00:43 | 000,016,890 | —- | C] () – C:\Users\Heidi\AppData\Roaming\wklnhst.dat

========== LOP Check ==========

[2012/05/20 22:33:48 | 000,000,000 | —D | M] – C:\Users\Heidi\AppData\Roaming\Ad-Aware Antivirus
[2012/06/24 20:30:51 | 000,000,000 | —D | M] – C:\Users\Heidi\AppData\Roaming\Amazon
[2012/07/02 21:22:04 | 000,000,000 | —D | M] – C:\Users\Heidi\AppData\Roaming\Catalina Marketing Corp
[2010/08/19 19:19:22 | 000,000,000 | —D | M] – C:\Users\Heidi\AppData\Roaming\com.adobe.mauby.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1
[2012/07/29 12:54:27 | 000,000,000 | —D | M] – C:\Users\Heidi\AppData\Roaming\DefaultTab
[2011/07/08 09:41:18 | 000,000,000 | —D | M] – C:\Users\Heidi\AppData\Roaming\Downloaded Installations
[2011/04/20 06:39:16 | 000,000,000 | —D | M] – C:\Users\Heidi\AppData\Roaming\GetRightToGo
[2012/05/30 16:39:20 | 000,000,000 | —D | M] – C:\Users\Heidi\AppData\Roaming\InfraRecorder
[2011/11/26 13:29:32 | 000,000,000 | —D | M] – C:\Users\Heidi\AppData\Roaming\IObit
[2009/12/28 15:41:16 | 000,000,000 | —D | M] – C:\Users\Heidi\AppData\Roaming\iolo
[2011/10/20 09:52:18 | 000,000,000 | —D | M] – C:\Users\Heidi\AppData\Roaming\Leadertech
[2009/07/25 22:22:54 | 000,000,000 | —D | M] – C:\Users\Heidi\AppData\Roaming\MailFrontier
[2010/11/10 15:41:11 | 000,000,000 | —D | M] – C:\Users\Heidi\AppData\Roaming\Notepad++
[2011/02/17 21:21:45 | 000,000,000 | —D | M] – C:\Users\Heidi\AppData\Roaming\PCDr
[2009/11/09 21:17:47 | 000,000,000 | —D | M] – C:\Users\Heidi\AppData\Roaming\Skinux
[2009/03/18 19:38:28 | 000,000,000 | —D | M] – C:\Users\Heidi\AppData\Roaming\Template
[2009/12/13 07:58:53 | 000,000,000 | —D | M] – C:\Users\Heidi\AppData\Roaming\Thunderbird
[2009/08/03 22:06:13 | 000,000,000 | —D | M] – C:\Users\Heidi\AppData\Roaming\TuneUp Software
[2012/03/25 11:24:32 | 000,000,000 | —D | M] – C:\Users\Peter\AppData\Roaming\IObit
[2010/03/13 08:44:21 | 000,000,000 | —D | M] – C:\Users\Peter\AppData\Roaming\Skinux
[2010/10/28 06:59:02 | 000,000,000 | —D | M] – C:\Users\Peter\AppData\Roaming\Thunderbird
[2009/08/03 19:06:25 | 000,000,000 | —D | M] – C:\Users\Peter\AppData\Roaming\TuneUp Software
[2012/06/03 13:02:38 | 000,000,400 | —- | M] () – C:\Windows\Tasks\EasyShare Registration Task.job
[2012/08/05 14:32:39 | 000,032,606 | —- | M] () – C:\Windows\Tasks\SCHEDLGU.TXT
[2012/07/29 22:00:00 | 000,000,384 | —- | M] () – C:\Windows\Tasks\SmartDefrag.job
[2010/12/16 15:19:00 | 000,000,418 | -H– | M] () – C:\Windows\Tasks\User_Feed_Synchronization-{06737FB5-171D-4CED-A275-E493946FBD47}.job
[2012/08/05 21:35:00 | 000,000,420 | -H– | M] () – C:\Windows\Tasks\User_Feed_Synchronization-{1E2F2322-1323-4A6F-8005-2C5E37204C45}.job
[2010/01/30 13:25:19 | 000,000,424 | -H– | M] () – C:\Windows\Tasks\User_Feed_Synchronization-{FAAB1E1A-DAFA-4265-B908-E65285CA022E}.job
[2009/07/25 22:22:38 | 000,000,432 | —- | M] () – C:\Windows\Tasks\Wise Disk Cleaner 4.job

========== Purity Check ==========



========== Custom Scans ==========

< MD5 for: EXPLORER.EXE >
[2008/10/29 02:20:29 | 002,923,520 | —- | M] (Microsoft Corporation) MD5=37440D09DEAE0B672A04DCCF7ABF06BE – C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.16771_none_4f83bb287ccdb7e3\explorer.exe
[2008/10/29 02:29:41 | 002,927,104 | —- | M] (Microsoft Corporation) MD5=4F554999D7D5F05DAAEBBA7B5BA1089D – C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6001.18164_none_5177ca9879e978e8\explorer.exe
[2008/10/29 23:59:17 | 002,927,616 | —- | M] (Microsoft Corporation) MD5=50BA5850147410CDE89C523AD3BC606E – C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6001.22298_none_51e4f8c7931bd1e1\explorer.exe
[2009/04/11 02:27:36 | 002,926,592 | —- | M] (Microsoft Corporation) MD5=D07D4C3038F3578FFCE1C0237F2A1253 – C:\Windows\explorer.exe
[2009/04/11 02:27:36 | 002,926,592 | —- | M] (Microsoft Corporation) MD5=D07D4C3038F3578FFCE1C0237F2A1253 – C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6002.18005_none_53a0201e76de3a0b\explorer.exe
[2008/10/27 22:15:02 | 002,923,520 | —- | M] (Microsoft Corporation) MD5=E7156B0B74762D9DE0E66BDCDE06E5FB – C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.20947_none_5033cb5995cd990b\explorer.exe
[2008/01/20 22:24:24 | 002,927,104 | —- | M] (Microsoft Corporation) MD5=FFA764631CB70A30065C12EF8E174F9F – C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6001.18000_none_51b4a71279bc6ebf\explorer.exe

< MD5 for: SVCHOST.EXE >
[2008/01/20 22:23:43 | 000,021,504 | —- | M] (Microsoft Corporation) MD5=3794B461C45882E06856F282EEF025AF – C:\Windows\System32\svchost.exe
[2008/01/20 22:23:43 | 000,021,504 | —- | M] (Microsoft Corporation) MD5=3794B461C45882E06856F282EEF025AF – C:\Windows\winsxs\x86_microsoft-windows-services-svchost_31bf3856ad364e35_6.0.6001.18000_none_b5bb59a1054dbde5\svchost.exe
[2012/07/03 13:46:42 | 000,217,672 | —- | M] () MD5=8A7F34F0BBD076EC3815680A7309114F – C:\Program Files\Malwarebytes' Anti-Malware\Chameleon\svchost.exe

< MD5 for: USERINIT.EXE >
[2008/01/20 22:24:49 | 000,025,088 | —- | M] (Microsoft Corporation) MD5=0E135526E9785D085BCD9AEDE6FBCBF9 – C:\Windows\System32\userinit.exe
[2008/01/20 22:24:49 | 000,025,088 | —- | M] (Microsoft Corporation) MD5=0E135526E9785D085BCD9AEDE6FBCBF9 – C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.0.6001.18000_none_dc28ba15d1aff80b\userinit.exe

< MD5 for: WINLOGON.EXE >
[2009/04/11 02:28:13 | 000,314,368 | —- | M] (Microsoft Corporation) MD5=898E7C06A350D4A1A64A9EA264D55452 – C:\Windows\System32\winlogon.exe
[2009/04/11 02:28:13 | 000,314,368 | —- | M] (Microsoft Corporation) MD5=898E7C06A350D4A1A64A9EA264D55452 – C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6002.18005_none_71ae7a22d2134741\winlogon.exe
[2012/07/03 13:46:42 | 000,217,672 | —- | M] () MD5=8A7F34F0BBD076EC3815680A7309114F – C:\Program Files\Malwarebytes' Anti-Malware\Chameleon\winlogon.exe
[2008/01/20 22:24:49 | 000,314,880 | —- | M] (Microsoft Corporation) MD5=C2610B6BDBEFC053BBDAB4F1B965CB24 – C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6001.18000_none_6fc30116d4f17bf5\winlogon.exe

========== Alternate Data Streams ==========

@Alternate Data Stream - 127 bytes -> C:\ProgramData\TEMP:5D432CE3
@Alternate Data Stream - 121 bytes -> C:\ProgramData\TEMP:DFC5A2B2
@Alternate Data Stream - 114 bytes -> C:\ProgramData\TEMP:FA5F15C4

< End of report >


Extras.txt
OTL Extras logfile created on: 8/5/2012 9:18:55 PM - Run 1
OTL by OldTimer - Version 3.2.56.0 Folder = C:\Users\Heidi\Desktop
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

2.96 Gb Total Physical Memory | 1.23 Gb Available Physical Memory | 41.38% Memory free
6.12 Gb Paging File | 4.21 Gb Available in Paging File | 68.74% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 104.90 Gb Total Space | 31.38 Gb Free Space | 29.91% Space Free | Partition Type: NTFS
Drive E: | 44.11 Gb Total Space | 0.00 Gb Free Space | 0.01% Space Free | Partition Type: NTFS

Computer Name: HEIDI-PC | User Name: Heidi | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========


========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]
.cpl [@ = cplfile] – C:\Windows\System32\control.exe (Microsoft Corporation)
.hlp [@ = hlpfile] – C:\Windows\winhlp32.exe (Microsoft Corporation)

[HKEY_USERS\S-1-5-21-1158375537-2513235221-245670277-1001\SOFTWARE\Classes\]
.exe [@ = exefile] – Reg Error: Key error. File not found
.html [@ = FirefoxHTML] – C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\shell\[command]\command]
batfile [open] – "%1" %*
cmdfile [open] – "%1" %*
comfile [open] – "%1" %*
cplfile [cplopen] – %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] – "%1" %*
helpfile [open] – Reg Error: Key error.
hlpfile [open] – %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
htmlfile – Reg Error: Key error.
htmlfile [print] – rundll32.exe %windir%\system32\mshtml.dll,PrintHTML "%1"
inffile [install] – %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] – "%1" %*
regfile [merge] – Reg Error: Key error.
scrfile [config] – "%1"
scrfile [install] – rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] – "%1" /S
txtfile – Reg Error: Key error.
Unknown [openas] – %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] – "C:\Program Files\VideoLAN\VLC\vlc.exe" –started-from-file –playlist-enqueue "%1" ()
Directory [cmd] – cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] – "C:\Program Files\VideoLAN\VLC\vlc.exe" –started-from-file –no-playlist-enqueue "%1" ()
Folder [open] – %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)
Folder [explore] – %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
"AutoUpdateDisableNotify" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
"VistaSp1" = Reg Error: Unknown registry data type – File not found
"VistaSp2" = Reg Error: Unknown registry data type – File not found

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0

========== Authorized Applications List ==========


========== Vista Active Open Ports Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{0E061474-1E65-40D3-BF8C-4CD26B785646}" = lport=40080 | protocol=6 | dir=in | name=remote access media server |
"{12692219-4EAB-4A02-A68E-B4E55D49BB75}" = rport=138 | protocol=17 | dir=out | app=system |
"{19CEED9A-3857-470F-8E9F-E0D8AD03471E}" = lport=5900 | protocol=6 | dir=in | name=ultravnc server |
"{3CEA3645-CF90-4107-8DC0-360746B9F032}" = lport=40094 | protocol=6 | dir=in | name=streaming web cam |
"{40377A8E-6C82-4509-B913-44D8CC893F9F}" = lport=1900 | protocol=17 | dir=in | name=windows live communications platform (ssdp) |
"{42BA8CE0-35F0-439A-8F21-28EF462BCDBE}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe |
"{4802EE3A-EF4D-43D2-86FA-7FB76C0E7733}" = lport=40093 | protocol=6 | dir=in | name=streaming web cam |
"{49054F52-E4BB-4D5B-BE6F-70D4763AADB1}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=svchost.exe |
"{54D0C2EF-465E-4BA7-8616-6CD0D6D875DD}" = lport=40092 | protocol=6 | dir=in | name=streaming web cam |
"{71422180-E73A-4A93-B31E-D4E177DC8155}" = lport=445 | protocol=6 | dir=in | app=system |
"{A84AD758-1EEC-4205-AB72-6FD0846318FE}" = lport=2869 | protocol=6 | dir=in | name=windows live communications platform (upnp) |
"{ADACC258-09CD-4A25-A8F4-FDF8B999487B}" = lport=2869 | protocol=6 | dir=in | app=system |
"{BE80705D-7A7B-48CB-8F6A-A50D3EA12626}" = lport=40091 | protocol=6 | dir=in | name=streaming web cam |
"{BF8A6F22-5F38-410E-9097-F05BF51B3BB0}" = rport=139 | protocol=6 | dir=out | app=system |
"{C5D1B36D-1920-41E0-8D5A-7B0BFD7DE1B5}" = rport=445 | protocol=6 | dir=out | app=system |
"{CAD4D86C-B7DC-4D24-882E-6AA37CCD7FC4}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 |
"{CE00291C-D926-4E6F-AD5C-B32AB7FABE80}" = rport=137 | protocol=17 | dir=out | app=system |
"{DE598E9E-A059-44BF-98E0-8E6CA3D5362F}" = lport=138 | protocol=17 | dir=in | app=system |
"{E77602D4-6433-4AAC-B2E7-32AEFA0C3ECB}" = lport=40090 | protocol=6 | dir=in | name=streaming web cam |
"{FBE6E480-5094-41B7-B866-F283EFA53244}" = lport=139 | protocol=6 | dir=in | app=system |
"{FEB16BD5-AAEA-4928-B710-3325FA2C62AF}" = lport=137 | protocol=17 | dir=in | app=system |

========== Vista Active Application Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{00A98FC9-41A5-4607-9EBC-EBDCEDAABAB8}" = protocol=6 | dir=in | app=c:\program files\common files\dell\advanced networking service\hnm_svc.exe |
"{08A2A4A5-DE4B-43BA-9D45-70D892554D6E}" = dir=in | app=c:\program files\windows live\contacts\wlcomm.exe |
"{09CF5FA0-D2A5-4DA2-B791-B0B096653ECE}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 |
"{0E154987-FB50-4007-98CA-A36BE5D06299}" = protocol=17 | dir=in | app=c:\program files\dell remote access\ezi_ra.exe |
"{0E46C628-7993-4326-B9A6-7F9F858E6DF5}" = protocol=17 | dir=in | app=c:\program files\yahoo!\messenger\yahoomessenger.exe |
"{101A5576-4C95-4E3E-BC71-5F84E9545EA9}" = protocol=6 | dir=in | app=c:\program files\yahoo!\messenger\yahoomessenger.exe |
"{16FD4C41-70EF-435A-BB71-F95FE81FAEE2}" = protocol=6 | dir=in | app=c:\program files\common files\dell\vlc\vlc.exe |
"{1C5D4E2A-2BDD-4A99-921B-22009553A614}" = dir=in | app=c:\program files\cyberlink\powerdvd dx\pdvddxsrv.exe |
"{200F3F53-EFA8-47E1-A4EE-5BBC10653A50}" = dir=in | app=c:\program files\windows live\sync\windowslivesync.exe |
"{37D548E4-3E79-4796-8162-01930B390F48}" = protocol=17 | dir=in | app=c:\program files\common files\dell\vlc\vlc.exe |
"{3B62B84E-B840-454D-A246-46E42D55E4AB}" = protocol=6 | dir=in | app=c:\program files\adawaretb\dtuser.exe |
"{450D38D1-5C1C-4C77-BD78-574770930519}" = protocol=17 | dir=in | app=c:\program files\common files\dell\mysql\bin\mysqld.exe |
"{488A16F4-3204-4095-8CF8-97891DAB2149}" = protocol=17 | dir=in | app=c:\program files\fedex\fxopd\fxopdmain.exe |
"{5661A20C-26D2-486E-96BD-AF8DABB65628}" = protocol=17 | dir=in | app=c:\program files\common files\dell\apache\bin\httpd.exe |
"{5E50FF3C-8060-4412-B54F-662CA82D9B87}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 |
"{5EFA6BE1-55BE-43B0-A477-FBA5C14356FC}" = protocol=6 | dir=in | app=c:\program files\common files\dell\vlc\vlc.exe |
"{6169E957-FC48-4938-9ED5-199A4C943592}" = protocol=6 | dir=in | app=c:\program files\common files\dell\mysql\bin\mysqld.exe |
"{6287BFCA-E712-4B6D-8C71-E9749BB35DC0}" = protocol=17 | dir=in | app=c:\program files\common files\dell\apache\php.exe |
"{764689CF-6471-45CF-A5D2-E8B9885D1C27}" = dir=in | app=c:\program files\itunes\itunes.exe |
"{8558740A-6A63-4331-92F0-F9A1D5C9C862}" = protocol=17 | dir=in | app=c:\programdata\ultravnc\winvnc.exe |
"{86341803-30EF-435E-A1D1-B19232697529}" = protocol=6 | dir=in | app=c:\program files\common files\dell\mysql\bin\mysql.exe |
"{983D9CCB-26D9-4BAB-B23F-B1F777A6FFD1}" = dir=in | app=c:\program files\cyberlink\powerdvd dx\powerdvd.exe |
"{9CDCB9BF-7F6B-4748-9AC0-3C131634BB94}" = dir=in | app=c:\program files\windows live\mesh\moe.exe |
"{9F1269A7-88ED-41DA-9EB6-FC5358C05D69}" = protocol=6 | dir=in | app=c:\program files\common files\dell\apache\bin\httpd.exe |
"{A0A2CE70-E3DA-45FA-A734-87F1767B0CC5}" = dir=in | app=c:\program files\windows live\messenger\msnmsgr.exe |
"{A44B0A8A-8309-4ED8-9A1F-ADF398501A99}" = protocol=17 | dir=in | app=c:\program files\logitech\vid hd\vid.exe |
"{A9849D40-37B8-4D8B-B60C-6AE6710AEF1D}" = protocol=6 | dir=in | app=c:\program files\dell remote access\ezi_ra.exe |
"{B39B0D69-71A8-4D24-9FDE-4A5D8F7CB3B0}" = protocol=17 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{B4F1CF03-1FE0-4433-9CA4-7476B92C8AB0}" = protocol=6 | dir=in | app=c:\program files\logitech\vid hd\vid.exe |
"{BC9C5AE4-3DBB-47D5-A545-4835698B4809}" = protocol=17 | dir=in | app=c:\program files\common files\dell\advanced networking service\hnm_svc.exe |
"{BFCD2D9A-3D29-4483-B622-990E572D4B78}" = protocol=17 | dir=in | app=c:\program files\common files\dell\mysql\bin\mysql.exe |
"{CEF9C433-58C6-44EF-A50D-B4C5BF439039}" = protocol=6 | dir=in | app=c:\program files\common files\dell\apache\php.exe |
"{D5AC0E09-2C67-400D-9FAD-5DB663693324}" = protocol=17 | dir=in | app=c:\program files\adawaretb\dtuser.exe |
"{D9317F17-25CF-428F-9487-DC29E94014BE}" = protocol=6 | dir=in | app=c:\program files\common files\dell\remote access file sync service\dsl_fs_sync.exe |
"{DAD15162-B2F0-4083-8A3E-5E5D3FBE2BFF}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 |
"{E1072822-CCA6-4FB9-AE10-7958731AA95C}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{EA5EBB1A-87C2-43CF-A0BA-26136DF6F360}" = protocol=17 | dir=in | app=c:\program files\common files\dell\remote access file sync service\dsl_fs_sync.exe |
"{EF388BD0-89CE-423B-856A-7E4DA54B244C}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 |
"{F0997BF3-1413-4A30-B123-69F2AAF4C766}" = protocol=6 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{F10FB49B-F1E4-4BAE-825A-A0A6E321DC80}" = protocol=6 | dir=in | app=c:\program files\fedex\fxopd\fxopdmain.exe |
"{F48874FE-346E-4FA2-AF0B-B22BAA3A2221}" = protocol=6 | dir=in | app=c:\programdata\ultravnc\winvnc.exe |
"{FF7C1226-9A31-47DD-B060-A5E85CE16FAA}" = dir=in | app=c:\program files\common files\apple\apple application support\webkit2webprocess.exe |
"{FFD9F675-9E99-469A-BB02-ACE989E96B1A}" = protocol=17 | dir=in | app=c:\program files\common files\dell\vlc\vlc.exe |
"TCP Query User{BD59F215-3E22-4ADD-AC5D-10177E77CFE0}C:\program files\soulseekns\slsk.exe" = protocol=6 | dir=in | app=c:\program files\soulseekns\slsk.exe |
"TCP Query User{FFF2F769-8D45-4C5A-8441-CA21DD4C4C76}C:\program files\google\google earth\client\googleearth.exe" = protocol=6 | dir=in | app=c:\program files\google\google earth\client\googleearth.exe |
"UDP Query User{7CF7E8D8-D3B9-46FF-949F-9E52FD6CEDBC}C:\program files\soulseekns\slsk.exe" = protocol=17 | dir=in | app=c:\program files\soulseekns\slsk.exe |
"UDP Query User{E05C1583-425E-4E20-BEF9-2C0C2D8983BF}C:\program files\google\google earth\client\googleearth.exe" = protocol=17 | dir=in | app=c:\program files\google\google earth\client\googleearth.exe |

========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
"{007B37D9-0C45-4202-834B-DD5FAAE99D63}" = ArcSoft Print Creations - Slimline Card
"{02E89EFC-7B07-4D5A-AA03-9EC0902914EE}" = VC 9.0 Runtime
"{08E81ABD-79F7-49C2-881F-FD6CB0975693}" = Roxio Creator Data
"{09760D42-E223-42AD-8C3E-55B47D0DDAC3}" = Roxio Creator DE
"{0B0F231F-CE6A-483D-AA23-77B364F75917}" = Windows Live Installer
"{0ED7EE95-6A97-47AA-AD73-152C08A15B04}" = Dell DataSafe Local Backup
"{0F842B77-56EA-4AAF-8295-81A022350B5E}" = Microsoft Security Client
"{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_Canon_MP490_series" = Canon MP490 series MP Drivers
"{122ADF8C-DDA1-480C-9936-C88F2825B265}" = Apple Application Support
"{12FEC00C-027C-4A34-9AAB-562EDA43DC18}_is1" = MiniTool Partition Wizard Home Edition 5.2
"{14D4ED84-6A9A-45A0-96F6-1753768C3CB5}" = ESSPCD
"{15BC8CD0-A65B-47D0-A2DD-90A824590FA8}" = Microsoft Works
"{17504ED4-DB08-40A8-81C2-27D8C01581DA}" = Windows Live Remote Service Resources
"{18455581-E099-4BA8-BC6B-F34B2F06600C}" = Google Toolbar for Internet Explorer
"{19A4A990-5343-4FF7-B3B5-6F046C091EDF}" = Windows Live Remote Client
"{19BA08F7-C728-469C-8A35-BFBD3633BE08}" = Windows Live Movie Maker
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{1F54DAFA-9261-4A62-B59D-6C9F26B48FE4}" = Roxio Creator Tools
"{1F6AB0E7-8CDD-4B93-8A23-AA9EB2FEFCE4}" = Junk Mail filter update
"{200FEC62-3C34-4D60-9CE8-EC372E01C08F}" = Windows Live SOXE Definitions
"{227E8782-B2F4-4E97-B0EE-49DE9CC1C0C0}" = Windows Live Remote Service
"{2318C2B1-4965-11d4-9B18-009027A5CD4F}" = Google Toolbar for Internet Explorer
"{26A24AE4-039D-4CA4-87B4-2F83216022F0}" = Java™ 6 Update 22
"{26A24AE4-039D-4CA4-87B4-2F83216033FF}" = Java™ 6 Update 33
"{28C2DED6-325B-4CC7-983A-1777C8F7FBAB}" = RealUpgrade 1.1
"{2902F983-B4C1-44BA-B85D-5C6D52E2C441}" = Windows Live Mesh ActiveX Control for Remote Connections
"{294BF709-D758-4363-8D75-01479AD20927}" = Windows Live Family Safety
"{29D4D03C-F70B-43d9-82E4-6E5696FB0D1D}" = IObit Toolbar v4.6
"{2CCBABCB-6427-4A55-B091-49864623C43F}" = Google Toolbar for Firefox
"{2D03B6F8-DF36-4980-B7B6-5B93D5BA3A8F}" = essvatgt
"{30465B6C-B53F-49A1-9EBA-A3F187AD502E}" = Roxio Update Manager
"{3336F667-9049-4D46-98B6-4C743EEBC5B1}" = Windows Live Photo Gallery
"{34F4D9A4-42C2-4348-BEF4-E553C84549E7}" = Windows Live Photo Gallery
"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
"{3E29EE6C-963A-4aae-86C1-DC237C4A49FC}" = Intel® Rapid Storage Technology
"{415B2719-AD3A-4944-B404-C472DB6085B3}" = Cisco EAP-FAST Module
"{42938595-0D83-404D-9F73-F8177FDD531A}" = ESScore
"{4537EA4B-F603-4181-89FB-2953FC695AB1}" = netbrdg
"{45A66726-69BC-466B-A7A4-12FCBA4883D7}" = HiJackThis
"{464B3406-A4D0-4914-910F-7CA4380DCC13}" = Windows Live Remote Client Resources
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4CBABDFD-49F8-47FD-BE7D-ECDE7270525A}" = Windows Live PIMT Platform
"{501451DE-5808-4599-B544-8BD0915B6B24}_is1" = FreeRIP v3.61
"{50816F92-1652-4A7C-B9BC-48F682742C4B}" = Messenger Companion
"{51071D66-D034-4239-94E0-723FCA10B6FE}" = OpenOffice.org 3.4
"{5316DFC9-CE99-4458-9AB3-E8726EDE0210}" = skin0001
"{56589DFE-0C29-4DFE-8E42-887B771ECD23}" = ArcSoft Print Creations - Photo Book
"{5A3C1721-F8ED-11E0-8AFB-B8AC6F97B88E}" = Google Earth
"{5B9AC19C-8519-43A1-9578-49CDA1366E66}" = FedEx Office Printer
"{5DA8F6CD-C70E-39D8-8430-3D9808D6BD17}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30411
"{5DD4FCBD-A3C1-4155-9E17-4161C70AAABA}" = Segoe UI
"{605A4E39-613C-4A12-B56F-DEFBE6757237}" = SHASTA
"{61AD15B2-50DB-4686-A739-14FE180D4429}" = Windows Live ID Sign-in Assistant
"{643EAE81-920C-4931-9F0B-4B343B225CA6}" = ESSBrwr
"{6675CA7F-E51B-4F6A-99D4-F8F0124C6EAA}" = Roxio Express Labeler 3
"{669C7BD8-DAA2-49B6-966C-F1E2AAE6B17E}" = Cisco PEAP Module
"{6811CAA0-BF12-11D4-9EA1-0050BAE317E1}" = PowerDVD
"{682B3E4F-696A-42DE-A41C-4C07EA1678B4}" = Windows Live SOXE
"{6A05FEDF-662E-46BF-8A25-010E3F1C9C69}" = Windows Live UX Platform Language Pack
"{6AD9F5F3-5BD0-4000-BD9C-B536CF86D988}" = iTunes
"{6B7B6D4D-8F9B-4CB3-8CA4-BCA9CC4C1A22}" = EDocs
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{73A4F29F-31AC-4EBD-AA1B-0CC5F18C8F83}" = Roxio Creator Audio
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{7770E71B-2D43-4800-9CB3-5B6CAAEBEBEA}" = RealNetworks - Microsoft Visual C++ 2008 Runtime
"{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}" = Apple Software Update
"{78A96B4C-A643-4D0F-98C2-A8E16A6669F9}" = Windows Live Messenger Companion Core
"{79155F2B-9895-49D7-8612-D92580E0DE5B}" = Bonjour
"{7BE15435-2D3E-4B58-867F-9C75BED0208C}" = QuickTime
"{7DB9F1E5-9ACB-410D-A7DC-7A3D023CE045}" = Dell Getting Started Guide
"{80956555-A512-4190-9CAD-B000C36D6B6B}" = Windows Live Messenger
"{83770D14-21B9-44B3-8689-F7B523F94560}" = Cisco LEAP Module
"{86CE85E6-DBAC-3FFD-B977-E4B79F83C909}" = Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570
"{8943CE61-53BD-475E-90E1-A580869E98A2}" = staticcr
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8A502E38-29C9-49FA-BCFA-D727CA062589}" = ESSTOOLS
"{8C6D6116-B724-4810-8F2D-D047E6B7D68E}" = Mesh Runtime
"{8DD46C6A-0056-4FEC-B70A-28BB16A1F11F}" = MSVCRT
"{8E92D746-CD9F-4B90-9668-42B74C14F765}" = ESSini
"{8F1ADE4D-EFAC-4F5A-B346-23C2687FAF50}" = Apple Mobile Device Support
"{90120000-0020-0409-0000-0000000FF1CE}" = Compatibility Pack for the 2007 Office system
"{9068B2BE-D93A-4C0A-861C-5E35E2C0E09E}" = Intel® Matrix Storage Manager
"{91517631-A9F3-4B7C-B482-43E0068FD55A}" = ESSgui
"{92EA4134-10D1-418A-91E1-5A0453131A38}" = Windows Live Movie Maker
"{932D0FC7-6DF1-4136-A2EC-166E8DEFD6A4}" = Ad-Aware
"{95120000-00AF-0409-0000-0000000FF1CE}" = Microsoft Office PowerPoint Viewer 2007 (English)
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{95505508-5E3F-40D6-A1EA-008C75886E21}" = PHP 5.3.9
"{9591C049-5CAE-4E89-A8D9-191F1899628B}" = ArcSoft Print Creations - Funhouse
"{999D43F4-9709-4887-9B1A-83EBB15A8370}" = VPRINTOL
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{9D56775A-93F3-44A3-8092-840E3826DE30}" = Windows Live Mail
"{9F72EF8B-AEC9-4CA5-B483-143980AFD6FD}" = Dell Touchpad
"{A040AC77-C1AA-4CC9-8931-9F648AF178F6}" = VC 9.0 Runtime
"{A0C91188-C88F-4E86-93E6-CD7C9A266649}" = Windows Live Mesh
"{A726AE06-AAA3-43D1-87E3-70F510314F04}" = Windows Live Writer
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{A9668246-FB70-4103-A1E3-66C9BC2EFB49}" = Dell DataSafe Local Backup - Support Software
"{A9BDCA6B-3653-467B-AC83-94367DA3BFE3}" = Windows Live Photo Common
"{AAAFC670-569B-4A2F-82B4-42945E0DE3EF}" = Windows Live Writer
"{AAF454FC-82CA-4F29-AB31-6A109485E76E}" = Windows Live Writer
"{AC76BA86-7AD7-1033-7B44-AA1000000001}" = Adobe Reader X (10.1.3)
"{AC76BA86-7AD7-5464-3428-900000000004}" = Spelling Dictionaries Support For Adobe Reader 9
"{AE1FA02D-E6A4-4EA0-8E58-6483CAC016DD}" = ESSCDBK
"{AF844339-2F8A-4593-81B3-9F4C54038C4E}" = Windows Live MIME IFilter
"{B0D83FCD-9D42-43ED-8315-250326AADA02}" = ArcSoft Print Creations - Scrapbook
"{B162D0A6-9A1D-4B7C-91A5-88FB48113C45}" = OfotoXMI
"{B2544A03-10D0-4E5E-BA69-0362FFC20D18}" = OGA Notifier 2.0.0048.0
"{B4092C6D-E886-4CB2-BA68-FE5A88D31DE6}_is1" = Spybot - Search & Destroy
"{B4B44FE7-41FF-4DAD-8C0A-E406DDA72992}" = CCScore
"{B6A26DE5-F2B5-4D58-9570-4FC760E00FCD}" = Roxio Creator Copy
"{B6CF2967-C81E-40C0-9815-C05774FEF120}" = Skype Click to Call
"{C27BC2A2-30DD-4014-B22E-63EB0DB572F9}" = Logitech Webcam Software
"{C4972073-2BFE-475D-8441-564EA97DA161}" = QuickSet32
"{C66824E4-CBB3-4851-BB3F-E8CFD6350923}" = Windows Live Mail
"{CA9ED5E4-1548-485B-A293-417840060158}" = ArcSoft Print Creations - Photo Calendar
"{CAE8A0F1-B498-4C23-95FA-55047E730C8F}" = ArcSoft Print Creations
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{CE95A79E-E4FC-4FFF-8A75-29F04B942FF2}" = Windows Live UX Platform
"{CFF8B8E8-E086-4DE0-935F-FE22CAB54F80}" = Microsoft Search Enhancement Pack
"{D32470A1-B10C-4059-BA53-CF0486F68EBC}" = Kodak EasyShare software
"{D436F577-1695-4D2F-8B44-AC76C99E0002}" = Windows Live Photo Common
"{D45240D3-B6B3-4FF9-B243-54ECE3E10066}" = Windows Live Communications Platform
"{D88C3E7C-1DA6-4AD7-97FC-75BC8705B266}" = runtime
"{DB02F716-6275-42E9-B8D2-83BA2BF5100B}" = SFR
"{DDC8BDEE-DCAC-404D-8257-3E8D4B782467}" = Windows Live Writer Resources
"{DECDCB7C-58CC-4865-91AF-627F9798FE48}" = Windows Live Mesh
"{E09C4DB7-630C-4F06-A631-8EA7239923AF}" = D3DX10
"{E3A5A8AB-58F6-45FF-AFCB-C9AE18C05001}" = IDT Audio
"{E6B4117F-AC59-4B13-9274-EB136E8897EE}" = ArcSoft Print Creations - Album Page
"{E7C97E98-4C2D-BEAF-5D2F-CC45A2F95D90}" = Acrobat.com
"{EB4DF488-AAEF-406F-A341-CB2AAA315B90}" = Windows Live Messenger
"{ED439A64-F018-4DD4-8BA5-328D85AB09AB}" = Roxio Creator DE
"{EE7257A2-39A2-4D2F-9DAC-F9F25B8AE1D8}" = Skype™ 5.8
"{F04F9557-81A9-4293-BC49-2C216FA325A7}" = ArcSoft Print Creations - Greeting Card
"{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}" = Microsoft SQL Server 2005 Compact Edition [ENU]
"{F333A33D-125C-32A2-8DCE-5C5D14231E27}" = Visual C++ 2008 x86 Runtime - (v9.0.30729)
"{F333A33D-125C-32A2-8DCE-5C5D14231E27}.vc_x86runtime_30729_01" = Visual C++ 2008 x86 Runtime - v9.0.30729.01
"{F47C37A4-7189-430A-B81D-739FF8A7A554}" = Consumer In-Home Service Agreement
"{F4A2E7CC-60CA-4AFA-B67F-AD5E58173C3F}" = SKINXSDK
"{F53D678E-238F-4A71-9742-08BB6774E9DC}" = Windows Live Family Safety
"{F66A31D9-7831-4FBA-BA02-C411C0047CC5}" = Dell Remote Access
"{F6CB42B9-F033-4152-8813-FF11DA8E6A78}" = Dell Dock
"{F9593CFB-D836-49BC-BFF1-0E669A411D9F}" = WIRELESS
"{fc8208f2-b1c1-4253-9e89-d518e983b7bb}" = Ad-Aware Antivirus
"{FCDB1C92-03C6-4C76-8625-371224256091}" = ESSPDock
"{FDB3B167-F4FA-461D-976F-286304A57B2A}" = Adobe AIR
"{FDD810CA-D5E3-40E9-AB7B-36440B0D41EF}" = Windows Live Sync
"{FE044230-9CA5-43F7-9B58-5AC5A28A1F33}" = Windows Live Essentials
"Ad-Aware Browsing Protection" = Ad-Aware Browsing Protection
"adawaretb" = Ad-Aware Security Toolbar
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"Advanced SystemCare 5_is1" = Advanced SystemCare 5
"AVG Secure Search" = AVG Security Toolbar
"Belarc Advisor" = Belarc Advisor 7.2
"Broadcom 802.11 Application" = Dell Wireless WLAN Card Utility
"Canon MP490 series User Registration" = Canon MP490 series User Registration
"CANONIJPLM100" = Canon Inkjet Printer/Scanner/Fax Extended Survey Program
"CanonSolutionMenu" = Canon Utilities Solution Menu
"Carbonite Setup Lite" = Carbonite Online Backup Setup
"com.adobe.mauby.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1" = Acrobat.com
"Coupon Printer for Windows5.0.0.1" = Coupon Printer for Windows
"Easy-PhotoPrint EX" = Canon Utilities Easy-PhotoPrint EX
"Easy-WebPrint EX" = Canon Easy-WebPrint EX
"eMusic Download Manager 5.0.1" = eMusic Download Manager 5.0.1
"FreeApp v1" = FreeApps
"GoToAssist" = GoToAssist 8.0.0.514
"GPL Ghostscript 8.70" = GPL Ghostscript 8.70
"HDMI" = Intel® Graphics Media Accelerator Driver
"Immunet Protect" = Immunet Protect
"InfraRecorder" = InfraRecorder
"IObit Security 360_is1" = IObit Security 360
"Logitech Vid" = Logitech Vid HD
"lvdrivers_12.10" = Logitech Webcam Software Driver Package
"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware version 1.62.0.1300
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft Security Client" = Microsoft Security Essentials
"Mozilla Firefox 14.0.1 (x86 en-GB)" = Mozilla Firefox 14.0.1 (x86 en-GB)
"Mozilla Thunderbird 13.0.1 (x86 en-GB)" = Mozilla Thunderbird 13.0.1 (x86 en-GB)
"MozillaMaintenanceService" = Mozilla Maintenance Service
"MP Navigator EX 3.0" = Canon MP Navigator EX 3.0
"Notepad++" = Notepad++
"Picasa 3" = Picasa 3
"RealPlayer 15.0" = RealPlayer
"Revo Uninstaller" = Revo Uninstaller 1.92
"Road Runner Install_is1" = Road Runner Install
"Road Runner Tech Install_is1" = RoadRunner Tech Install
"RoadRunnerMedic6.1_is1" = Road Runner Medic 6.1
"Secunia PSI" = Secunia PSI (2.0.0.3001)
"Smart Defrag 2_is1" = Smart Defrag 2
"Soulseek2" = SoulSeek 157 NS 13e
"StartNow Toolbar" = StartNow Toolbar
"TVWiz" = Intel® TV Wizard
"VLC media player" = VLC media player 2.0.1
"WinLiveSuite" = Windows Live Essentials
"WRAL Desktop Alert" = WRAL Desktop Alert

========== HKEY_USERS Uninstall List ==========

[HKEY_USERS\S-1-5-21-1158375537-2513235221-245670277-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"f031ef6ac137efc5" = Dell Driver Download Manager

========== HKEY_USERS Uninstall List ==========

[HKEY_USERS\S-1-5-21-1158375537-2513235221-245670277-1002\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"f031ef6ac137efc5" = Dell Driver Download Manager

========== Last 20 Event Log Errors ==========

[ Application Events ]
Error - 8/5/2012 8:27:11 PM | Computer Name = Heidi-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: Continuously busy for more than a second

Error - 8/5/2012 8:27:11 PM | Computer Name = Heidi-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledEvent 1139

Error - 8/5/2012 8:27:11 PM | Computer Name = Heidi-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledSPRetry 1139

Error - 8/5/2012 8:27:12 PM | Computer Name = Heidi-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: Continuously busy for more than a second

Error - 8/5/2012 8:27:12 PM | Computer Name = Heidi-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledEvent 2231

Error - 8/5/2012 8:27:12 PM | Computer Name = Heidi-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledSPRetry 2231

Error - 8/5/2012 8:27:14 PM | Computer Name = Heidi-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: Continuously busy for more than a second

Error - 8/5/2012 8:27:14 PM | Computer Name = Heidi-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledEvent 3682

Error - 8/5/2012 8:27:14 PM | Computer Name = Heidi-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledSPRetry 3682

Error - 8/5/2012 9:51:34 PM | Computer Name = Heidi-PC | Source = Application Error | ID = 1000
Description = Faulting application ToolbarUpdaterService.exe, version 0.0.0.0, time
stamp 0x4e205299, faulting module msxml3.dll, version 8.100.5003.0, time stamp
0x4c126143, exception code 0xc0000005, fault offset 0x0002dc2f, process id 0xe88,
application start time 0x01cd734c79837dd4.

[ Dell Events ]
Error - 12/16/2010 7:16:29 PM | Computer Name = Heidi-PC | Source = DataSafe | ID = 17
Description = The process was interrupted before completion.

Error - 12/16/2010 7:16:29 PM | Computer Name = Heidi-PC | Source = DataSafe | ID = 17
Description = The process was interrupted before completion.

Error - 12/16/2010 9:29:16 PM | Computer Name = Heidi-PC | Source = DataSafe | ID = 17
Description = The process was interrupted before completion.

Error - 12/31/2010 9:10:23 PM | Computer Name = Heidi-PC | Source = DataSafe | ID = 17
Description = The process was interrupted before completion.

Error - 12/31/2010 9:10:23 PM | Computer Name = Heidi-PC | Source = DataSafe | ID = 17
Description = The process was interrupted before completion.

Error - 1/15/2011 8:37:25 AM | Computer Name = Heidi-PC | Source = DataSafe | ID = 17
Description = The process was interrupted before completion.

Error - 1/15/2011 8:37:25 AM | Computer Name = Heidi-PC | Source = DataSafe | ID = 17
Description = The process was interrupted before completion.

Error - 4/30/2011 12:57:34 PM | Computer Name = Heidi-PC | Source = DataSafe | ID = 17
Description = The process was interrupted before completion.

Error - 4/30/2011 12:57:34 PM | Computer Name = Heidi-PC | Source = DataSafe | ID = 17
Description = The process was interrupted before completion.

Error - 5/9/2011 10:13:11 PM | Computer Name = Heidi-PC | Source = DataSafe | ID = 17
Description = The process was interrupted before completion.

[ Media Center Events ]
Error - 4/1/2009 1:30:15 PM | Computer Name = Heidi-PC | Source = MCUpdate | ID = 0
Description = DownloadPackgeTask.SubTasksComplete: failed downloading package SportsSchedule.

Error - 6/11/2009 1:54:55 PM | Computer Name = Heidi-PC | Source = MCUpdate | ID = 0
Description = DownloadPackgeTask.SubTasksComplete: failed downloading package SportsSchedule.

[ System Events ]
Error - 8/5/2012 6:36:55 PM | Computer Name = Heidi-PC | Source = netbt | ID = 4321
Description = The name "IBM-7F675208651:0" could not be registered on the interface
with IP address 192.168.2.102. The computer with the IP address 192.168.2.104 did
not allow the name to be claimed by this computer.

Error - 8/5/2012 6:57:14 PM | Computer Name = Heidi-PC | Source = netbt | ID = 4321
Description = The name "IBM-7F675208651:0" could not be registered on the interface
with IP address 192.168.2.102. The computer with the IP address 192.168.2.104 did
not allow the name to be claimed by this computer.

Error - 8/5/2012 7:17:15 PM | Computer Name = Heidi-PC | Source = netbt | ID = 4321
Description = The name "IBM-7F675208651:0" could not be registered on the interface
with IP address 192.168.2.102. The computer with the IP address 192.168.2.104 did
not allow the name to be claimed by this computer.

Error - 8/5/2012 7:37:41 PM | Computer Name = Heidi-PC | Source = netbt | ID = 4321
Description = The name "IBM-7F675208651:0" could not be registered on the interface
with IP address 192.168.2.102. The computer with the IP address 192.168.2.104 did
not allow the name to be claimed by this computer.

Error - 8/5/2012 7:57:43 PM | Computer Name = Heidi-PC | Source = netbt | ID = 4321
Description = The name "IBM-7F675208651:0" could not be registered on the interface
with IP address 192.168.2.102. The computer with the IP address 192.168.2.104 did
not allow the name to be claimed by this computer.

Error - 8/5/2012 8:07:32 PM | Computer Name = Heidi-PC | Source = WMPNetworkSvc | ID = 866297
Description =

Error - 8/5/2012 8:18:21 PM | Computer Name = Heidi-PC | Source = netbt | ID = 4321
Description = The name "IBM-7F675208651:0" could not be registered on the interface
with IP address 192.168.2.102. The computer with the IP address 192.168.2.104 did
not allow the name to be claimed by this computer.

Error - 8/5/2012 9:08:10 PM | Computer Name = Heidi-PC | Source = Service Control Manager | ID = 7011
Description =

Error - 8/5/2012 9:18:28 PM | Computer Name = Heidi-PC | Source = netbt | ID = 4321
Description = The name "IBM-7F675208651:0" could not be registered on the interface
with IP address 192.168.2.102. The computer with the IP address 192.168.2.104 did
not allow the name to be claimed by this computer.

Error - 8/5/2012 9:52:13 PM | Computer Name = Heidi-PC | Source = Service Control Manager | ID = 7034
Description =


< End of report >

Now I will download the other tool, run it, and post the log shortly. Thanks so much for your help.
Post #4
The aswMBR Logfile aswMBR version 0.9.9.1665 Copyright© 2011 AVAST Software Run date: 2012-08-05 22:14:14 —————————– 22:14:14.704 OS Version: Windows 6.0.6002 Service Pack 2 22:14:14.705 Number of processors: 2 586 0xF0D 22:14:14.711 ComputerName: HEIDI-PC UserName: Heidi 22:14:17.440 Initialize success 22:15:42.216 The log file has been saved successfully to "C:\Users\Heidi\Documents\aswMBR.txt" aswMBR version 0.9.9.1665 Copyright© 2011 AVAST Software Run date: 2012-08-05 22:14:14 —————————– 22:14:14.704 OS Version: Windows 6.0.6002 Service Pack 2 22:14:14.705 Number of processors: 2 586 0xF0D 22:14:14.711 ComputerName: HEIDI-PC UserName: Heidi 22:14:17.440 Initialize success 22:15:42.216 The log file has been saved successfully to "C:\Users\Heidi\Documents\aswMBR.txt" 22:15:46.596 AVAST engine defs: 12080501 22:15:59.569 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1 22:15:59.574 Disk 0 Vendor: Hitachi_ FB2O Size: 152627MB BusType: 3 22:15:59.603 Disk 0 MBR read successfully 22:15:59.609 Disk 0 MBR scan 22:15:59.644 Disk 0 Windows VISTA default MBR code 22:15:59.650 Disk 0 Partition 1 00 DE Dell Utility Dell 8.0 39 MB offset 63 22:15:59.703 Disk 0 Partition 2 00 07 HPFS/NTFS NTFS 45166 MB offset 81920 22:15:59.748 Disk 0 Partition 3 80 (A) 07 HPFS/NTFS NTFS 107418 MB offset 92582595 22:15:59.782 Disk 0 scanning sectors +312576705 22:15:59.886 Disk 0 scanning C:\Windows\system32\drivers 22:17:10.057 Service scanning 22:18:07.464 Service MpKsl8570a568 c:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{C0DBAA48-FA20-44D2-8099-906D0B736139}\MpKsl8570a568.sys **LOCKED** 32 22:19:19.314 Modules scanning 22:19:30.747 Disk 0 trace - called modules: 22:19:30.759 22:19:31.778 AVAST engine scan C:\Windows 22:19:37.945 AVAST engine scan C:\Windows\system32 22:32:18.710 AVAST engine scan C:\Windows\system32\drivers 22:33:53.283 AVAST engine scan C:\Users\Heidi 22:40:38.813 AVAST engine scan C:\ProgramData 22:46:26.579 Scan finished successfully 22:49:41.130 Disk 0 MBR has been saved successfully to "C:\Users\Heidi\Documents\MBR.dat" 22:49:41.142 The log file has been saved successfully to "C:\Users\Heidi\Documents\aswMBR.txt"
Post #5
Hi,

Good job. :)

Please download and run ERUNT (Emergency Recovery Utility NT). This program allows you to keep a complete backup of your registry and restore it when needed. The standard registry backup options that come with Windows back up most of the registry but not all of it. ERUNT however creates a complete backup set, including the Security hive and user related sections. ERUNT is easy to use and since it creates a full backup, there are no options or choices other than to select the location of the backup files. The backup set includes a small executable that will launch the registry restore if needed. **Remember if you are using Windows Vista as your operating system right-click the executable and Run as Administrator.
———-

Run OTL.exe
  • Copy/paste the following text written inside of the code box into the Custom Scans/Fixes box located at the bottom of OTL

    :Services

:OTL
PRC - C:\Program Files\IObit\Advanced SystemCare 5\ASCTray.exe (IObit)
PRC - C:\Program Files\IObit\Advanced SystemCare 5\ASCService.exe (IObit)
PRC - C:\Program Files\StartNow Toolbar\ToolbarUpdaterService.exe ()
MOD - C:\Program Files\IObit\Advanced SystemCare 5\ASCv5ExtMenu.dll ()
SRV - (AdvancedSystemCareService5) – C:\Program Files\IObit\Advanced SystemCare 5\ASCService.exe (IObit)
SRV - (Updater Service for StartNow Toolbar) – C:\Program Files\StartNow Toolbar\ToolbarUpdaterService.exe ()
SRV - (IS360service) – C:\Program Files\IObit\IObit Security 360\is360srv.exe (IObit)
IE - HKU\S-1-5-21-1158375537-2513235221-245670277-1001\..\SearchScopes\{DECA3892-BA8F-44b8-A993-A466AD694AE4}: "URL" = http://search.yahoo.com/search?p={searchTe…mp;fr=chr-iobit
[2011/11/27 13:07:45 | 000,000,000 | —D | M] (StartNow Toolbar) – C:\Users\Heidi\AppData\Roaming\Mozilla\Firefox\Profiles\60wjxva2.default\extensions\{5911488E-9D1E-40ec-8CBB-06B231CC153F}
[2011/01/28 20:59:52 | 000,002,232 | —- | M] () – C:\Users\Heidi\AppData\Roaming\Mozilla\Firefox\Profiles\60wjxva2.default\searchplugins\alot-search.xml
[2011/11/27 20:38:13 | 000,001,945 | —- | M] () – C:\Users\Heidi\AppData\Roaming\Mozilla\Firefox\Profiles\60wjxva2.default\searchplugins\bing-zugo.xml
[2012/08/05 20:09:25 | 000,001,982 | —- | M] () – C:\Users\Heidi\AppData\Roaming\Mozilla\Firefox\Profiles\60wjxva2.default\searchplugins\search-here.xml
[2012/07/29 12:55:42 | 000,002,349 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\babylon.xml
[2012/07/29 12:56:29 | 000,002,252 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\bing.xml
[2010/01/01 04:00:00 | 000,002,252 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\bing.xml.old
O2 - BHO: (IObit Toolbar) - {0BDA0769-FD72-49F4-9266-E1FB004F4D8F} - C:\Program Files\IObit Toolbar\IE\4.6\iobitToolbarIE.dll (Spigot, Inc.)
O3 - HKLM\..\Toolbar: (IObit Toolbar) - {0BDA0769-FD72-49F4-9266-E1FB004F4D8F} - C:\Program Files\IObit Toolbar\IE\4.6\iobitToolbarIE.dll (Spigot, Inc.)
O3 - HKLM\..\Toolbar: (no name) - {5911488E-9D1E-40ec-8CBB-06B231CC153F} - No CLSID value found.
O3 - HKLM\..\Toolbar: (no name) - {9D425283-D487-4337-BAB6-AB8354A81457} - No CLSID value found.
O3 - HKU\.DEFAULT\..\Toolbar\WebBrowser: (no name) - {3041D03E-FD4B-44E0-B742-2D9B88305F98} - No CLSID value found.
O3 - HKU\S-1-5-18\..\Toolbar\WebBrowser: (no name) - {3041D03E-FD4B-44E0-B742-2D9B88305F98} - No CLSID value found.
O3 - HKU\S-1-5-21-1158375537-2513235221-245670277-1001\..\Toolbar\WebBrowser: (no name) - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No CLSID value found.
O3 - HKU\S-1-5-21-1158375537-2513235221-245670277-1001\..\Toolbar\WebBrowser: (no name) - {3041D03E-FD4B-44E0-B742-2D9B88305F98} - No CLSID value found.
O3 - HKU\S-1-5-21-1158375537-2513235221-245670277-1002\..\Toolbar\WebBrowser: (no name) - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No CLSID value found.
O3 - HKU\S-1-5-21-1158375537-2513235221-245670277-1002\..\Toolbar\WebBrowser: (no name) - {3041D03E-FD4B-44E0-B742-2D9B88305F98} - No CLSID value found.
O4 - HKU\S-1-5-21-1158375537-2513235221-245670277-1001..\Run: [Advanced SystemCare 5] C:\Program Files\IObit\Advanced SystemCare 5\ASCTray.exe (IObit)
O32 - AutoRun File - [2004/04/30 18:01:00 | 000,000,053 | -HS- | M] () - E:\AUTORUN.INF – [ NTFS ]
O33 - MountPoints2\{399f6cff-808b-11de-9405-0023ae1b5109}\Shell - "" = AutoRun
O33 - MountPoints2\{399f6cff-808b-11de-9405-0023ae1b5109}\Shell\AutoRun\command - "" = F:\LaunchU3.exe -a
[2012/07/26 18:58:15 | 000,017,920 | —- | M] () – C:\Users\Heidi\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011/04/20 06:39:16 | 000,000,000 | —D | M] – C:\Users\Heidi\AppData\Roaming\GetRightToGo
[2011/11/26 13:29:32 | 000,000,000 | —D | M] – C:\Users\Heidi\AppData\Roaming\IObit
[2012/03/25 11:24:32 | 000,000,000 | —D | M] – C:\Users\Peter\AppData\Roaming\IObit

:Files
ipconfig /flushdns /c

:Commands
[purity]
[emptytemp]
[resethosts]
[start explorer]
[Reboot]
  • Then click the Run Fix button at the top
  • Let the program run unhindered, reboot when it is done
  • Then run a new scan and post a new OTL log ( don't check the boxes beside LOP Check or Purity this time )
———-
Post #6
All right Jeff. As directed, ran the registry back up utility, copied your text into OTL, ran the fix, rebooted, and scanned again. Here is the resulting log:

OTL logfile created on: 8/6/2012 11:38:51 AM - Run 2
OTL by OldTimer - Version 3.2.56.0 Folder = C:\Users\Heidi\Desktop
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

2.96 Gb Total Physical Memory | 1.54 Gb Available Physical Memory | 52.03% Memory free
6.12 Gb Paging File | 4.60 Gb Available in Paging File | 75.18% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 104.90 Gb Total Space | 39.01 Gb Free Space | 37.19% Space Free | Partition Type: NTFS
Drive E: | 44.11 Gb Total Space | 0.00 Gb Free Space | 0.01% Space Free | Partition Type: NTFS

Computer Name: HEIDI-PC | User Name: Heidi | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Users\Heidi\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater\11.2.0\ToolbarUpdater.exe ()
PRC - C:\Program Files\AVG Secure Search\vprot.exe ()
PRC - C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation)
PRC - C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
PRC - C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe (Lavasoft Limited)
PRC - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe (Lavasoft Limited)
PRC - C:\Program Files\Real\RealPlayer\Update\realsched.exe (RealNetworks, Inc.)
PRC - C:\Program Files\Microsoft Security Client\msseces.exe (Microsoft Corporation)
PRC - c:\Program Files\Microsoft Security Client\MsMpEng.exe (Microsoft Corporation)
PRC - C:\Program Files\WRAL Desktop Alert\liveonline_3977114.exe ()
PRC - C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated)
PRC - C:\Program Files\Immunet Protect\2.0.17\iptray.exe (Immunet)
PRC - C:\Program Files\Immunet Protect\2.0.17\agent.exe (Immunet Corporation)
PRC - C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe (Eastman Kodak Company)
PRC - C:\Program Files\Secunia\PSI\psia.exe (Secunia)
PRC - C:\Program Files\Secunia\PSI\sua.exe (Secunia)
PRC - C:\Program Files\Secunia\PSI\psi_tray.exe (Secunia)
PRC - C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe (ArcSoft Inc.)
PRC - C:\Program Files\Dell DataSafe Local Backup\SftService.exe (SoftThinks SAS)
PRC - C:\Program Files\Dell\QuickSet\quickset.exe (Dell Inc.)
PRC - C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe (ArcSoft Inc.)
PRC - C:\Program Files\IDT\WDM\sttray.exe (IDT, Inc.)
PRC - C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_0145da1d\stacsv.exe (IDT, Inc.)
PRC - C:\Program Files\Logitech\Logitech WebCam Software\LWS.exe ()
PRC - C:\Program Files\Common Files\logishrd\LQCVFX\COCIManager.exe ()
PRC - C:\Program Files\Common Files\logishrd\LVMVFM\LVPrcSrv.exe (Logitech Inc.)
PRC - C:\Program Files\Canon\MyPrinter\BJMYPRT.EXE (CANON INC.)
PRC - C:\Windows\explorer.exe (Microsoft Corporation)
PRC - C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_0145da1d\AEstSrv.exe (Andrea Electronics Corporation)
PRC - C:\Program Files\Canon\IJPLM\ijplmsvc.exe ()
PRC - C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe (Safer Networking Ltd.)
PRC - C:\Program Files\Common Files\Dell\Advanced Networking Service\hnm_svc.exe (Dell Inc.)
PRC - C:\Program Files\Common Files\Dell\Remote Access File Sync Service\dsl_fs_sync.exe (SingleClick Systems)
PRC - C:\Program Files\Dell\DellDock\DellDock.exe (Stardock Corporation)
PRC - C:\Program Files\Dell\DellDock\DockLogin.exe (Stardock Corporation)
PRC - C:\Program Files\DellTPad\hidfind.exe (Alps Electric Co., Ltd.)
PRC - C:\Program Files\DellTPad\Apoint.exe (Alps Electric Co., Ltd.)
PRC - C:\Program Files\DellTPad\ApntEx.exe (Alps Electric Co., Ltd.)
PRC - C:\ProgramData\UltraVNC\winvnc.exe (UltraVNC)
PRC - C:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exe (CyberLink Corp.)
PRC - C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTmon.exe (Intel Corporation)
PRC - C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe (Intel Corporation)
PRC - C:\Program Files\Common Files\Dell\MySQL\bin\mysqld.exe ()
PRC - C:\Program Files\twc\medicsp2\bin\sprtsvc.exe (SupportSoft, Inc.)


========== Modules (No Company Name) ==========

MOD - C:\Program Files\Common Files\AVG Secure Search\SiteSafetyInstaller\11.2.0\SiteSafety.dll ()
MOD - C:\Program Files\AVG Secure Search\vprot.exe ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\MenuSkinning\e4ead33e7390326a9814a511c566054b\MenuSkinning.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\VistaBridgeLibrary\53ff6fb64982a15d164f25e727be6bb4\VistaBridgeLibrary.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\DellDock\a2117f9d2b9670193889149f0ec777d5\DellDock.ni.exe ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\MyDock.Util\d8dfd448743194309366caa97c215c21\MyDock.Util.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Web\508b444db523c5cf20ff12c7f440837b\System.Web.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\f2691cfa7671cdc58179e56ba9227591\System.Windows.Forms.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\18f9789aa214c657113e676b3a9015aa\System.Drawing.ni.dll ()
MOD - C:\Program Files\IObit\Advanced SystemCare 5\ASCv5ExtMenu.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Management\f3d4d5fe5ab848fbfcf91a49960dc8ae\System.Management.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Runtime.Remo#\846b9cf2756fdd15f704c9bab9c70b6f\System.Runtime.Remoting.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Configuration\bd76aaaa03ddc15d1840207b5a480644\System.Configuration.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\Accessibility\1b337cf9a031145849bc48c11b2cfe58\Accessibility.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Xml\3b7181bb19dd5dd74cd063f0312cdf57\System.Xml.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System\28d633338fc8d29f8af31935ef7d001b\System.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\af9c9e9d7e0523cd444f8b551baa9cbf\mscorlib.ni.dll ()
MOD - C:\Program Files\WRAL Desktop Alert\liveonline_3977114.exe ()
MOD - C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll ()
MOD - C:\Program Files\Common Files\Apple\Apple Application Support\libxml2.dll ()
MOD - C:\Program Files\Immunet Protect\2.0.17\dhr.dll ()
MOD - C:\Program Files\Immunet Protect\2.0.17\drs.dll ()
MOD - C:\Program Files\Immunet Protect\2.0.17\dcf.dll ()
MOD - C:\Program Files\Immunet Protect\2.0.17\dut.dll ()
MOD - C:\Program Files\Immunet Protect\2.0.17\dxm.dll ()
MOD - C:\Program Files\Kodak\Kodak EasyShare software\bin\VistaAdapter.esx ()
MOD - C:\Program Files\Kodak\Kodak EasyShare software\bin\ESCom.dll ()
MOD - C:\Program Files\Kodak\Kodak EasyShare software\bin\ESSkin.esx ()
MOD - C:\Program Files\Kodak\Kodak EasyShare software\bin\VistaCDBackup.esx ()
MOD - C:\Program Files\Kodak\Kodak EasyShare software\bin\ESEmail.esx ()
MOD - C:\Program Files\Kodak\Kodak EasyShare software\bin\VPrintOnline.dll ()
MOD - C:\Program Files\Kodak\Kodak EasyShare software\bin\VistaControls.esx ()
MOD - C:\Program Files\Kodak\Kodak EasyShare software\bin\ESCliWicMDRW.esx ()
MOD - C:\Program Files\Kodak\Kodak EasyShare software\bin\VPrintOnlineHelper40.dll ()
MOD - C:\Program Files\Kodak\Kodak EasyShare software\bin\KFx.dll ()
MOD - C:\Program Files\Kodak\Kodak EasyShare software\bin\keml40.dll ()
MOD - C:\Program Files\Kodak\Kodak EasyShare software\bin\AppCore.dll ()
MOD - C:\Program Files\Kodak\Kodak EasyShare software\bin\Atlas.dll ()
MOD - C:\Program Files\Kodak\Kodak EasyShare software\bin\SpiffyExt.dll ()
MOD - C:\Program Files\Kodak\Kodak EasyShare software\bin\IStorageMediaStore.esx ()
MOD - C:\Program Files\Kodak\Kodak EasyShare software\bin\LocCamBack.dll ()
MOD - C:\Program Files\Kodak\Kodak EasyShare software\bin\LocAcqMod.dll ()
MOD - C:\Program Files\Kodak\Kodak EasyShare software\bin\UpdateChecker.esx ()
MOD - C:\Program Files\Kodak\Kodak EasyShare software\bin\kpries40.dll ()
MOD - C:\Program Files\Kodak\Kodak EasyShare software\bin\LocUpdateCheck.dll ()
MOD - C:\Program Files\Kodak\Kodak EasyShare software\bin\VistaPrintOnline.esx ()
MOD - C:\Program Files\Kodak\Kodak EasyShare software\bin\Pcd.esx ()
MOD - C:\Program Files\Kodak\Kodak EasyShare software\bin\KPCDInterface.dll ()
MOD - C:\Program Files\Kodak\Kodak EasyShare software\bin\areaifdll.dll ()
MOD - C:\Program Files\Kodak\Kodak EasyShare software\bin\DXRawFormatHandler.esx ()
MOD - C:\Program Files\Kodak\Kodak EasyShare software\bin\DibLibIP.dll ()
MOD - C:\Program Files\Notepad++\NppShell_01.dll ()
MOD - C:\Program Files\Logitech\Logitech WebCam Software\LWS.exe ()
MOD - C:\Program Files\Common Files\logishrd\LQCVFX\COCIManager.exe ()
MOD - C:\Program Files\Kodak\Kodak EasyShare software\bin\SkinuxCommonV.dll ()
MOD - C:\Program Files\Kodak\Kodak EasyShare software\bin\SkinuxProcV.dll ()
MOD - C:\Program Files\Kodak\Kodak EasyShare software\bin\SkinuxXML2V.dll ()
MOD - C:\Program Files\Kodak\Kodak EasyShare software\bin\SkinuxFFV.dll ()
MOD - C:\Program Files\Kodak\Kodak EasyShare software\bin\SkinuxCmpV.dll ()
MOD - C:\Program Files\Kodak\Kodak EasyShare software\bin\SkinuxImV.dll ()
MOD - C:\Program Files\Kodak\Kodak EasyShare software\bin\SkinuxZipV.dll ()
MOD - C:\Program Files\Kodak\Kodak EasyShare software\bin\SkinuxBaseV.dll ()
MOD - C:\Windows\System32\bcmwlrmt.dll ()


========== Win32 Services (SafeList) ==========

SRV - (SBSDWSCService) – C:\Program Files\Spybot File not found
SRV - (AdobeFlashPlayerUpdateSvc) – C:\Windows\System32\Macromed\Flash\FlashPlayerUpdateService.exe (Adobe Systems Incorporated)
SRV - (MozillaMaintenance) – C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe (Mozilla Foundation)
SRV - (vToolbarUpdater11.2.0) – C:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater\11.2.0\ToolbarUpdater.exe ()
SRV - (MBAMService) – C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation)
SRV - (Lavasoft Ad-Aware Service) – C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe (Lavasoft Limited)
SRV - (Ad-Aware Service) – C:\Program Files\Ad-Aware Antivirus\AdAwareService.exe (Lavasoft Limited)
SRV - (NisSrv) – c:\Program Files\Microsoft Security Client\NisSrv.exe (Microsoft Corporation)
SRV - (MsMpSvc) – c:\Program Files\Microsoft Security Client\MsMpEng.exe (Microsoft Corporation)
SRV - (SkypeUpdate) – C:\Program Files\Skype\Updater\Updater.exe (Skype Technologies)
SRV - (AdobeARMservice) – C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated)
SRV - (SBAMSvc) – C:\Program Files\Ad-Aware Antivirus\SBAMSvc.exe (GFI Software)
SRV - (scan) – C:\Program Files\Immunet Protect\tetra\scan.dll (Immunet)
SRV - (ImmunetProtect) – C:\Program Files\Immunet Protect\2.0.17\agent.exe (Immunet Corporation)
SRV - (Secunia PSI Agent) – C:\Program Files\Secunia\PSI\psia.exe (Secunia)
SRV - (Secunia Update Agent) – C:\Program Files\Secunia\PSI\sua.exe (Secunia)
SRV - (SftService) – C:\Program Files\Dell DataSafe Local Backup\SftService.exe (SoftThinks SAS)
SRV - (ACDaemon) – C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe (ArcSoft Inc.)
SRV - (STacSV) – C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_0145da1d\stacsv.exe (IDT, Inc.)
SRV - (LVPrcSrv) – C:\Program Files\Common Files\logishrd\LVMVFM\LVPrcSrv.exe (Logitech Inc.)
SRV - (AESTFilters) – C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_0145da1d\AEstSrv.exe (Andrea Electronics Corporation)
SRV - (IJPLMSVC) – C:\Program Files\Canon\IJPLM\ijplmsvc.exe ()
SRV - (GoToAssist) – C:\Program Files\Citrix\GoToAssist\514\g2aservice.exe (Citrix Online, a division of Citrix Systems, Inc.)
SRV - (hnmsvc) – C:\Program Files\Common Files\Dell\Advanced Networking Service\hnm_svc.exe (Dell Inc.)
SRV - (dsl-fs-sync) – C:\Program Files\Common Files\Dell\Remote Access File Sync Service\dsl_fs_sync.exe (SingleClick Systems)
SRV - (DockLoginService) – C:\Program Files\Dell\DellDock\DockLogin.exe (Stardock Corporation)
SRV - (uvnc_service) – C:\ProgramData\UltraVNC\winvnc.exe (UltraVNC)
SRV - (IAANTMON) – C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTmon.exe (Intel Corporation)
SRV - (WinDefend) – C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)
SRV - (dsl-db) – C:\Program Files\Common Files\Dell\MySQL\bin\mysqld.exe ()
SRV - (sprtsvc_medicsp2) – C:\Program Files\twc\medicsp2\bin\sprtsvc.exe (SupportSoft, Inc.)


========== Driver Services (SafeList) ==========

DRV - (SASKUTIL) – C:\Users\Heidi\AppData\Local\Temp\SAS_SelfExtract\SASKUTIL.SYS File not found
DRV - (SASDIFSV) – C:\Users\Heidi\AppData\Local\Temp\SAS_SelfExtract\SASDIFSV.SYS File not found
DRV - (NwlnkFwd) – system32\DRIVERS\nwlnkfwd.sys File not found
DRV - (NwlnkFlt) – system32\DRIVERS\nwlnkflt.sys File not found
DRV - (kwqgcpcj) – System32\drivers\oflneeun.sys File not found
DRV - (IpInIp) – system32\DRIVERS\ipinip.sys File not found
DRV - (MpKsl256f8b07) – c:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{33C1E60B-C62D-4DD6-BB44-0ED1F15C10CE}\MpKsl256f8b07.sys (Microsoft Corporation)
DRV - (MBAMProtector) – C:\Windows\System32\drivers\mbam.sys (Malwarebytes Corporation)
DRV - (NisDrv) – C:\Windows\System32\drivers\NisDrvWFP.sys (Microsoft Corporation)
DRV - (SbFw) – C:\Windows\System32\drivers\SbFw.sys (GFI Software)
DRV - (sbhips) – C:\Windows\System32\drivers\sbhips.sys (GFI Software)
DRV - (sbwtis) – C:\Windows\System32\drivers\sbwtis.sys (GFI Software)
DRV - (Lbd) – C:\Windows\System32\drivers\Lbd.sys (Lavasoft AB)
DRV - (Lavasoft Kernexplorer) – C:\Program Files\Lavasoft\Ad-Aware\kernexplorer.sys ()
DRV - (SBFWIMCLMP) – C:\Windows\System32\drivers\SbFwIm.sys (GFI Software)
DRV - (SBFWIMCL) – C:\Windows\System32\drivers\SbFwIm.sys (GFI Software)
DRV - (ImmunetProtectDriver) – C:\Windows\System32\drivers\ImmunetProtect.sys (Windows ® Codename Longhorn DDK provider)
DRV - (ImmunetSelfProtectDriver) – C:\Windows\System32\drivers\ImmunetSelfProtect.sys (Windows ® Codename Longhorn DDK provider)
DRV - (SmartDefragDriver) – C:\Windows\System32\drivers\SmartDefragDriver.sys ()
DRV - (PSI) – C:\Windows\System32\drivers\psi_mf.sys (Secunia)
DRV - (pwdrvio) – C:\Windows\System32\pwdrvio.sys ()
DRV - (pwdspio) – C:\Windows\System32\pwdspio.sys ()
DRV - (STHDA) – C:\Windows\System32\drivers\stwrt.sys (IDT, Inc.)
DRV - (LVPr2Mon) – C:\Windows\System32\drivers\LVPr2Mon.sys ()
DRV - (BCM42RLY) – C:\Windows\System32\drivers\bcm42rly.sys (Broadcom Corporation)
DRV - (ApfiltrService) – C:\Windows\System32\drivers\Apfiltr.sys (Alps Electric Co., Ltd.)
DRV - (Packet) – C:\Windows\System32\drivers\packet.sys (SingleClick Systems)
DRV - (e1express) – C:\Windows\System32\drivers\e1e6032.sys (Intel Corporation)
DRV - (LVUSBSta) – C:\Windows\System32\drivers\LVUSBSta.sys (Logitech Inc.)
DRV - (PID_PEPI) – C:\Windows\System32\drivers\LV302V32.SYS (Logitech Inc.)
DRV - (R300) – C:\Windows\System32\drivers\atikmdag.sys (ATI Technologies Inc.)
DRV - (WimFltr) – C:\Windows\System32\drivers\WimFltr.sys (Microsoft Corporation)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://g.msn.com/USCON/1
IE - HKLM\..\SearchScopes,DefaultScope = {6A1806CD-94D4-4689-BA73-E35EA1EA9990}
IE - HKLM\..\SearchScopes\{2ED7F417-7E96-482C-8B7C-B38575AE7725}: "URL" = http://search.live.com/results.aspx?q={sea…ferrer:source?}
IE - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://www.google.com/search?q={searchTerm…mp;sourceid=ie7

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://g.msn.com/USCON/1
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.google.com/ie
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = http://www.google.com/ie
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.google.com
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://isearch.avg.com/?cid={046AF6B5-EFF2…mp;d=2012-07-08 14:31:33&v;=11.1.0.12&sap;=hp
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = http://www.google.com/ie
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ie
IE - HKCU\..\SearchScopes,DefaultScope = {6A1806CD-94D4-4689-BA73-E35EA1EA9990}
IE - HKCU\..\SearchScopes\{2ED7F417-7E96-482C-8B7C-B38575AE7725}: "URL" = http://www.bing.com/search?q={searchTerms}…rc=IE-SearchBox
IE - HKCU\..\SearchScopes\{63140ECF-C629-BE59-8F0E-90B4FF340C03}: "URL" = http://www.bing.com/search?q={searchTerms}…eferrer:source}
IE - HKCU\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://www.google.com/search?q={searchTerm…;rlz=1I7GPCK_en
IE - HKCU\..\SearchScopes\{95B7759C-8C7F-4BF1-B163-73684A933233}: "URL" = http://isearch.avg.com/search?cid={046AF6B…mp;d=2012-07-08 14:31:33&v;=11.1.0.12&sap;=dsp&q;={searchTerms}
IE - HKCU\..\SearchScopes\{D5042721-6DFD-85DD-AD1C-6B852F3F6275}: "URL" = http://www.bing.com/search?q={searchTerms}…amp;form=ZGAIDF
IE - HKCU\..\SearchScopes\{FDA3B927-CE90-F095-31E5-29B4FDC893D7}: "URL" = http://www.bing.com/search?q={searchTerms}…eferrer:source}
IE - HKCU\..\SearchScopes\Yahoo!: "URL" = http://search.yahoo.com/search?fr=chr-gree…p={searchTerms}
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

========== FireFox ==========

FF - prefs.js..browser.search.param.yahoo-fr: "chr-greentree_ff&type;=382950"
FF - prefs.js..browser.search.selectedEngine: "Google"
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "http://google.com/"
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20
FF - prefs.js..extensions.enabledItems: {ABDE892B-13A8-4d1b-88E6-365A6E755758}:14.0.2
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}:6.0.21
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}:6.0.22
FF - prefs.js..extensions.enabledItems: [removed]:4.3
FF - prefs.js..extensions.enabledItems: [removed]:4.3
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}:6.0.23
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}:6.0.24


FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32_11_3_300_270.dll ()
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@avg.com/AVG SiteSafety plugin,version=11.0.0.1,application/x-avg-sitesafety-plugin: C:\Program Files\Common Files\AVG Secure Search\SiteSafetyInstaller\11.2.0\\npsitesafety.dll ()
FF - HKLM\Software\MozillaPlugins\@canon.com/EPPEX: C:\Program Files\Canon\Easy-PhotoPrint EX\NPEZFFPI.DLL (CANON INC.)
FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF - HKLM\Software\MozillaPlugins\@google.com/npPicasa2,version=2.0.0: C:\Program Files\Picasa2\npPicasa2.dll (Google, Inc.)
FF - HKLM\Software\MozillaPlugins\@google.com/npPicasa3,version=3.0.0: C:\Program Files\Picasa2\npPicasa3.dll (Google, Inc.)
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=1.6.0_33: C:\Windows\system32\npdeployJava1.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\plugin2\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\5.1.10411.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3508.1109: C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@real.com/nppl3260;version=15.0.4.53: c:\program files\real\realplayer\Netscape6\nppl3260.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprjplug;version=15.0.4.53: c:\program files\real\realplayer\Netscape6\nprjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprpchromebrowserrecordext;version=15.0.4.53: C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprpchromebrowserrecordext.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprphtml5videoshim;version=15.0.4.53: C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprpplugin;version=15.0.4.53: c:\program files\real\realplayer\Netscape6\nprpplugin.dll (RealPlayer)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.115\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.115\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=2.0.1: C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{3112ca9c-de6d-4884-a869-9855de68056c}: C:\ProgramData\Google\Toolbar for Firefox\{3112ca9c-de6d-4884-a869-9855de68056c} [2009/10/11 21:29:22 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{97E22097-9A2F-45b1-8DAF-36AD648C7EF4}: C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext [2012/05/23 05:51:35 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\avg@toolbar: C:\ProgramData\AVG Secure Search\11.1.0.12\ [2012/07/08 14:32:04 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 14.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012/07/29 12:56:59 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 14.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2012/07/08 13:45:06 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 13.0.1\extensions\\Components: C:\Program Files\Mozilla Thunderbird\components [2012/07/08 16:21:02 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 13.0.1\extensions\\Plugins: C:\Program Files\Mozilla Thunderbird\plugins [2012/07/02 21:22:06 | 000,000,000 | —D | M]

[2009/12/13 07:58:54 | 000,000,000 | —D | M] (No name found) – C:\Users\Heidi\AppData\Roaming\Mozilla\Extensions
[2009/12/13 07:58:54 | 000,000,000 | —D | M] (No name found) – C:\Users\Heidi\AppData\Roaming\Mozilla\Extensions\{3550f703-e582-4d05-9a08-453d09bdfdc6}
[2012/08/06 10:44:09 | 000,000,000 | —D | M] (No name found) – C:\Users\Heidi\AppData\Roaming\Mozilla\Firefox\Profiles\60wjxva2.default\extensions
[2010/06/26 07:25:04 | 000,000,000 | —D | M] (Microsoft .NET Framework Assistant) – C:\Users\Heidi\AppData\Roaming\Mozilla\Firefox\Profiles\60wjxva2.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2012/07/29 14:21:49 | 000,000,000 | —D | M] (ShopToWin12) – C:\Users\Heidi\AppData\Roaming\Mozilla\Firefox\Profiles\60wjxva2.default\extensions\{70263cf9-d46a-4be4-adc6-29500ba884e1}
[2012/05/20 22:35:49 | 000,000,000 | —D | M] (Ad-Aware Security Toolbar) – C:\Users\Heidi\AppData\Roaming\Mozilla\Firefox\Profiles\60wjxva2.default\extensions\{87934c42-161d-45bc-8cef-ef18abe2a30c}
[2011/10/20 09:46:12 | 000,000,000 | —D | M] (Разпознаване на устройство Logitech) – C:\Users\Heidi\AppData\Roaming\Mozilla\Firefox\Profiles\60wjxva2.default\extensions\[removed]
[2012/05/20 22:36:05 | 000,000,000 | —D | M] (Lavasoft Search Plugin) – C:\Users\Heidi\AppData\Roaming\Mozilla\Firefox\Profiles\60wjxva2.default\extensions\jid1-yZwVFzbsyfMrqQ@jetpack
[2012/08/06 11:39:31 | 000,001,982 | —- | M] () – C:\Users\Heidi\AppData\Roaming\Mozilla\Firefox\Profiles\60wjxva2.default\searchplugins\search-here.xml
[2012/07/08 14:10:16 | 000,000,000 | —D | M] (No name found) – C:\Program Files\Mozilla Firefox\extensions
[2012/03/25 09:57:35 | 000,000,000 | —D | M] (Skype Click to Call) – C:\Program Files\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}
[2012/07/08 13:45:09 | 000,000,000 | —D | M] (Java Console) – C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA}
[2012/07/29 12:57:04 | 000,022,392 | —- | M] () (No name found) – C:\USERS\HEIDI\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\60WJXVA2.DEFAULT\EXTENSIONS\[removed]
[2012/07/29 12:56:58 | 000,136,672 | —- | M] (Mozilla Foundation) – C:\Program Files\mozilla firefox\components\browsercomps.dll
[2012/07/02 21:22:04 | 000,466,944 | —- | M] (Catalina Marketing Corporation) – C:\Program Files\mozilla firefox\plugins\NPcol400.dll
[2012/06/20 12:54:54 | 000,091,584 | —- | M] (Coupons, Inc.) – C:\Program Files\mozilla firefox\plugins\npCouponPrinter.dll
[2012/06/20 12:54:56 | 000,091,584 | —- | M] (Coupons, Inc.) – C:\Program Files\mozilla firefox\plugins\npMozCouponPrinter.dll
[2012/05/23 05:49:44 | 000,129,144 | —- | M] (RealPlayer) – C:\Program Files\mozilla firefox\plugins\nprpplugin.dll
[2012/07/29 12:56:29 | 000,001,525 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\amazon-en-GB.xml
[2012/07/08 14:31:08 | 000,003,750 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\avg-secure-search.xml
[2012/07/29 12:56:29 | 000,000,935 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\chambers-en-GB.xml
[2012/07/29 12:56:29 | 000,001,166 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\eBay-en-GB.xml
[2012/07/29 12:56:29 | 000,002,040 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\twitter.xml
[2012/07/29 12:56:29 | 000,001,121 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\yahoo-en-GB.xml

O1 HOSTS File: ([2012/08/06 10:50:52 | 000,000,098 | —- | M]) - C:\Windows\System32\drivers\etc\Hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: ::1 localhost
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - No CLSID value found.
O2 - BHO: (RealPlayer Download and Record Plugin for Internet Explorer) - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll (RealPlayer)
O2 - BHO: (Canon Easy-WebPrint EX BHO) - {3785D0AD-BFFF-47F6-BF5B-A587C162FED9} - C:\Program Files\Canon\Easy-WebPrint EX\ewpexbho.dll (CANON INC.)
O2 - BHO: (no name) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - No CLSID value found.
O2 - BHO: (Spybot-S&D; IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O2 - BHO: (Ad-Aware Security Toolbar) - {6c97a91e-4524-4019-86af-2aa2d567bf5c} - C:\Program Files\adawaretb\adawareDx.dll ()
O2 - BHO: (Java™ Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (AVG Security Toolbar) - {95B7759C-8C7F-4BF1-B163-73684A933233} - C:\Program Files\AVG Secure Search\11.1.0.12\AVG Secure Search_toolbar.dll ()
O2 - BHO: (Skype Browser Helper) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O3 - HKLM\..\Toolbar: (Ad-Aware Security Toolbar) - {6c97a91e-4524-4019-86af-2aa2d567bf5c} - C:\Program Files\adawaretb\adawareDx.dll ()
O3 - HKLM\..\Toolbar: (Canon Easy-WebPrint EX) - {759D9886-0C6F-4498-BAB6-4A5F47C6C72F} - C:\Program Files\Canon\Easy-WebPrint EX\ewpexhlp.dll (CANON INC.)
O3 - HKLM\..\Toolbar: (AVG Security Toolbar) - {95B7759C-8C7F-4BF1-B163-73684A933233} - C:\Program Files\AVG Secure Search\11.1.0.12\AVG Secure Search_toolbar.dll ()
O3 - HKCU\..\Toolbar\WebBrowser: (Canon Easy-WebPrint EX) - {759D9886-0C6F-4498-BAB6-4A5F47C6C72F} - C:\Program Files\Canon\Easy-WebPrint EX\ewpexhlp.dll (CANON INC.)
O4 - HKLM..\Run: [Apoint] C:\Program Files\DellTPad\Apoint.exe (Alps Electric Co., Ltd.)
O4 - HKLM..\Run: [APSDaemon] C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
O4 - HKLM..\Run: [ArcSoft Connection Service] C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe (ArcSoft Inc.)
O4 - HKLM..\Run: [CanonMyPrinter] C:\Program Files\Canon\MyPrinter\BJMyPrt.exe (CANON INC.)
O4 - HKLM..\Run: [CanonSolutionMenu] C:\Program Files\Canon\SolutionMenu\CNSLMAIN.exe (CANON INC.)
O4 - HKLM..\Run: [CarboniteSetupLite] C:\Program Files\Carbonite\CarbonitePreinstaller.exe (Carbonite, Inc.)
O4 - HKLM..\Run: [HF_G_Jul] C:\Program Files\AVG Secure Search\HF_G_Jul.exe ()
O4 - HKLM..\Run: [IAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe (Intel Corporation)
O4 - HKLM..\Run: [Immunet Protect] C:\Program Files\Immunet Protect\2.0.17\iptray.exe (Immunet)
O4 - HKLM..\Run: [LogitechQuickCamRibbon] C:\Program Files\Logitech\Logitech WebCam Software\LWS.exe ()
O4 - HKLM..\Run: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
O4 - HKLM..\Run: [MSC] c:\Program Files\Microsoft Security Client\msseces.exe (Microsoft Corporation)
O4 - HKLM..\Run: [PDVDDXSrv] C:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exe (CyberLink Corp.)
O4 - HKLM..\Run: [QuickSet] C:\Program Files\Dell\QuickSet\quickset.exe (Dell Inc.)
O4 - HKLM..\Run: [SysTrayApp] C:\Program Files\IDT\WDM\sttray.exe (IDT, Inc.)
O4 - HKLM..\Run: [TkBellExe] c:\program files\real\realplayer\Update\realsched.exe (RealNetworks, Inc.)
O4 - HKLM..\Run: [vProt] C:\Program Files\AVG Secure Search\vprot.exe ()
O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)
O4 - Startup: C:\Users\Heidi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dell Dock.lnk = C:\Program Files\Dell\DellDock\DellDock.exe (Stardock Corporation)
O4 - Startup: C:\Users\Heidi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ERUNT AutoBackup.lnk = C:\Program Files\ERUNT\AUTOBACK.EXE ()
O4 - Startup: C:\Users\Heidi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WRAL Desktop Alert.lnk = C:\Program Files\WRAL Desktop Alert\liveonline_3977114.exe ()
O8 - Extra context menu item: Add to Google Photos Screensa&ver; - C:\Windows\System32\GPhotos.scr (Google Inc.)
O9 - Extra Button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra 'Tools' menuitem : Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra 'Tools' menuitem : Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O13 - gopher Prefix: missing
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_33)
O16 - DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_33)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_33)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1 192.168.2.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{9B676C79-5753-4C0F-AA70-B380E0429E69}: DhcpNameServer = 192.168.2.1 192.168.2.1
O18 - Protocol\Handler\belarc {6318E0AB-2E93-11D1-B8ED-00608CC9A71F} - C:\Program Files\Belarc\Advisor\System\BAVoilaX.dll (Belarc, Inc.)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O18 - Protocol\Handler\viprotocol {B658800C-F66E-4EF3-AB85-6C0C227862A9} - C:\Program Files\Common Files\AVG Secure Search\ViProtocolInstaller\11.2.0\ViProtocol.dll ()
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)
O20 - Winlogon\Notify\GoToAssist: DllName - (C:\Program Files\Citrix\GoToAssist\514\G2AWinLogon.dll) - C:\Program Files\Citrix\GoToAssist\514\g2awinlogon.dll (Citrix Online, a division of Citrix Systems, Inc.)
O24 - Desktop WallPaper: C:\Windows\Web\Wallpaper\img27.jpg
O24 - Desktop BackupWallPaper: C:\Windows\Web\Wallpaper\img27.jpg
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006/09/18 17:43:36 | 000,000,024 | —- | M] () - C:\autoexec.bat – [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*
O37 - HKCU\…exe [@ = exefile] – Reg Error: Key error. File not found
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)

========== Files/Folders - Created Within 30 Days ==========

[2012/08/06 10:43:59 | 000,000,000 | —D | C] – C:\_OTL
[2012/08/06 10:42:47 | 000,000,000 | —D | C] – C:\Windows\ERDNT
[2012/08/06 10:42:01 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ERUNT
[2012/08/06 10:41:58 | 000,000,000 | —D | C] – C:\Program Files\ERUNT
[2012/08/06 10:41:01 | 000,791,393 | —- | C] (Lars Hederer ) – C:\Users\Heidi\Desktop\erunt-setup.exe
[2012/08/06 02:17:26 | 000,000,000 | —D | C] – C:\Users\Heidi\Desktop\AA Comm_files
[2012/08/06 01:36:51 | 000,000,000 | —D | C] – C:\Users\Heidi\Desktop\OFF Trans Req_files
[2012/08/05 22:13:19 | 004,731,392 | —- | C] (AVAST Software) – C:\Users\Heidi\Desktop\aswMBR.exe
[2012/08/05 21:16:06 | 000,596,480 | —- | C] (OldTimer Tools) – C:\Users\Heidi\Desktop\OTL.exe
[2012/08/05 01:10:08 | 000,000,000 | —D | C] – C:\Users\Heidi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\HiJackThis
[2012/08/05 01:10:07 | 000,000,000 | —D | C] – C:\Program Files\Trend Micro
[2012/07/29 12:54:27 | 000,000,000 | —D | C] – C:\Users\Heidi\AppData\Roaming\DefaultTab
[2012/07/29 12:50:31 | 000,000,000 | —D | C] – C:\ProgramData\Tarma Installer
[2012/07/16 23:28:00 | 000,000,000 | —D | C] – C:\Users\Heidi\Desktop\DO NOT OPEN
[2012/07/08 17:17:52 | 000,000,000 | —D | C] – C:\Users\Heidi\AppData\Local\Macromedia
[2012/07/08 16:39:49 | 000,000,000 | –SD | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\OpenOffice.org 3.4
[2012/07/08 14:49:19 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes
[2012/07/08 14:47:14 | 000,000,000 | —D | C] – C:\Program Files\iPod
[2012/07/08 14:46:59 | 000,000,000 | —D | C] – C:\Program Files\iTunes
[2012/07/08 14:32:58 | 000,000,000 | —D | C] – C:\Users\Heidi\AppData\Local\AVG Secure Search
[2012/07/08 14:31:33 | 000,000,000 | —D | C] – C:\ProgramData\AVG Secure Search
[2012/07/08 14:31:23 | 000,000,000 | —D | C] – C:\Program Files\Common Files\AVG Secure Search
[2012/07/08 14:31:10 | 000,000,000 | —D | C] – C:\Program Files\AVG Secure Search
[2012/07/08 14:29:47 | 000,000,000 | -H-D | C] – C:\ProgramData\Common Files
[2012/07/08 13:45:06 | 000,476,936 | —- | C] (Sun Microsystems, Inc.) – C:\Windows\System32\npdeployJava1.dll
[2012/07/08 13:45:05 | 000,157,448 | —- | C] (Sun Microsystems, Inc.) – C:\Windows\System32\javaws.exe
[2012/07/08 13:45:05 | 000,149,256 | —- | C] (Sun Microsystems, Inc.) – C:\Windows\System32\javaw.exe
[2012/07/08 13:45:05 | 000,149,256 | —- | C] (Sun Microsystems, Inc.) – C:\Windows\System32\java.exe

========== Files - Modified Within 30 Days ==========

[2012/08/06 11:54:59 | 000,000,420 | -H– | M] () – C:\Windows\tasks\User_Feed_Synchronization-{1E2F2322-1323-4A6F-8005-2C5E37204C45}.job
[2012/08/06 11:44:19 | 000,000,830 | —- | M] () – C:\Windows\tasks\Adobe Flash Player Updater.job
[2012/08/06 11:35:40 | 000,000,882 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2012/08/06 11:33:20 | 000,003,616 | -H– | M] () – C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2012/08/06 11:33:20 | 000,003,616 | -H– | M] () – C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2012/08/06 11:33:13 | 000,067,584 | –S- | M] () – C:\Windows\bootstat.dat
[2012/08/06 11:09:00 | 000,000,886 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2012/08/06 10:50:52 | 000,000,098 | —- | M] () – C:\Windows\System32\drivers\etc\Hosts
[2012/08/06 10:42:29 | 000,000,915 | —- | M] () – C:\Users\Heidi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ERUNT AutoBackup.lnk
[2012/08/06 10:42:01 | 000,000,735 | —- | M] () – C:\Users\Heidi\Desktop\NTREGOPT.lnk
[2012/08/06 10:42:01 | 000,000,716 | —- | M] () – C:\Users\Heidi\Desktop\ERUNT.lnk
[2012/08/06 10:41:06 | 000,791,393 | —- | M] (Lars Hederer ) – C:\Users\Heidi\Desktop\erunt-setup.exe
[2012/08/06 02:17:29 | 000,061,196 | —- | M] () – C:\Users\Heidi\Desktop\AA Comm.html
[2012/08/06 01:40:11 | 000,049,729 | —- | M] () – C:\Users\Heidi\Desktop\TranscriptRequestForm.pdf
[2012/08/06 01:36:53 | 000,044,024 | —- | M] () – C:\Users\Heidi\Desktop\OFF Trans Req.htm
[2012/08/06 01:33:55 | 000,010,257 | —- | M] () – C:\Users\Heidi\Desktop\NHMCCD Transcript.pdf
[2012/08/05 22:49:41 | 000,000,512 | —- | M] () – C:\Users\Heidi\Documents\MBR.dat
[2012/08/05 22:13:54 | 004,731,392 | —- | M] (AVAST Software) – C:\Users\Heidi\Desktop\aswMBR.exe
[2012/08/05 21:16:12 | 000,596,480 | —- | M] (OldTimer Tools) – C:\Users\Heidi\Desktop\OTL.exe
[2012/08/05 16:54:37 | 000,000,000 | RHS- | M] () – C:\MSDOS.SYS
[2012/08/05 16:54:37 | 000,000,000 | RHS- | M] () – C:\IO.SYS
[2012/08/05 16:47:02 | 000,000,476 | —- | M] () – C:\Windows\wininit.ini
[2012/08/05 14:37:09 | 000,000,064 | —- | M] () – C:\Windows\System32\rp_stats.dat
[2012/08/05 14:37:09 | 000,000,044 | —- | M] () – C:\Windows\System32\rp_rules.dat
[2012/08/05 01:10:08 | 000,001,948 | —- | M] () – C:\Users\Heidi\Desktop\HiJackThis.lnk
[2012/08/02 23:44:33 | 000,426,184 | —- | M] (Adobe Systems Incorporated) – C:\Windows\System32\FlashPlayerApp.exe
[2012/08/02 23:44:32 | 000,070,344 | —- | M] (Adobe Systems Incorporated) – C:\Windows\System32\FlashPlayerCPLApp.cpl
[2012/07/29 22:00:00 | 000,000,384 | —- | M] () – C:\Windows\tasks\SmartDefrag.job
[2012/07/29 15:42:38 | 000,000,908 | —- | M] () – C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2012/07/29 12:56:14 | 000,000,304 | —- | M] () – C:\user.js
[2012/07/26 18:58:04 | 000,606,916 | —- | M] () – C:\Windows\System32\perfh009.dat
[2012/07/26 18:58:04 | 000,105,670 | —- | M] () – C:\Windows\System32\perfc009.dat
[2012/07/09 17:27:07 | 000,028,031 | —- | M] () – C:\Users\Heidi\Desktop\shri_mandala.jpg
[2012/07/09 17:19:16 | 007,832,232 | —- | M] () – C:\Users\Heidi\Desktop\10mandala-coloring-pages.pdf
[2012/07/08 18:38:31 | 000,000,680 | —- | M] () – C:\Users\Heidi\AppData\Local\d3d9caps.dat
[2012/07/08 18:36:16 | 000,303,184 | —- | M] () – C:\Windows\System32\FNTCACHE.DAT
[2012/07/08 16:39:49 | 000,001,033 | —- | M] () – C:\Users\Public\Desktop\OpenOffice.org 3.4.lnk
[2012/07/08 14:49:20 | 000,001,666 | —- | M] () – C:\Users\Public\Desktop\iTunes.lnk
[2012/07/08 13:44:42 | 000,157,448 | —- | M] (Sun Microsystems, Inc.) – C:\Windows\System32\javaws.exe
[2012/07/08 13:44:42 | 000,149,256 | —- | M] (Sun Microsystems, Inc.) – C:\Windows\System32\javaw.exe
[2012/07/08 13:44:41 | 000,476,936 | —- | M] (Sun Microsystems, Inc.) – C:\Windows\System32\npdeployJava1.dll
[2012/07/08 13:44:41 | 000,472,840 | —- | M] (Sun Microsystems, Inc.) – C:\Windows\System32\deployJava1.dll
[2012/07/08 13:44:41 | 000,149,256 | —- | M] (Sun Microsystems, Inc.) – C:\Windows\System32\java.exe

========== Files Created - No Company Name ==========

[2012/08/06 10:42:28 | 000,000,915 | —- | C] () – C:\Users\Heidi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ERUNT AutoBackup.lnk
[2012/08/06 10:42:01 | 000,000,735 | —- | C] () – C:\Users\Heidi\Desktop\NTREGOPT.lnk
[2012/08/06 10:42:01 | 000,000,716 | —- | C] () – C:\Users\Heidi\Desktop\ERUNT.lnk
[2012/08/06 02:17:26 | 000,061,196 | —- | C] () – C:\Users\Heidi\Desktop\AA Comm.html
[2012/08/06 01:40:10 | 000,049,729 | —- | C] () – C:\Users\Heidi\Desktop\TranscriptRequestForm.pdf
[2012/08/06 01:36:50 | 000,044,024 | —- | C] () – C:\Users\Heidi\Desktop\OFF Trans Req.htm
[2012/08/06 01:33:54 | 000,010,257 | —- | C] () – C:\Users\Heidi\Desktop\NHMCCD Transcript.pdf
[2012/08/05 22:49:41 | 000,000,512 | —- | C] () – C:\Users\Heidi\Documents\MBR.dat
[2012/08/05 16:54:37 | 000,000,000 | RHS- | C] () – C:\MSDOS.SYS
[2012/08/05 16:54:37 | 000,000,000 | RHS- | C] () – C:\IO.SYS
[2012/08/05 16:47:02 | 000,000,476 | —- | C] () – C:\Windows\wininit.ini
[2012/08/05 01:10:08 | 000,001,948 | —- | C] () – C:\Users\Heidi\Desktop\HiJackThis.lnk
[2012/07/29 12:56:14 | 000,000,304 | —- | C] () – C:\user.js
[2012/07/09 17:27:06 | 000,028,031 | —- | C] () – C:\Users\Heidi\Desktop\shri_mandala.jpg
[2012/07/09 17:18:58 | 007,832,232 | —- | C] () – C:\Users\Heidi\Desktop\10mandala-coloring-pages.pdf
[2012/07/08 18:38:31 | 000,000,680 | —- | C] () – C:\Users\Heidi\AppData\Local\d3d9caps.dat
[2012/07/08 16:39:49 | 000,001,033 | —- | C] () – C:\Users\Public\Desktop\OpenOffice.org 3.4.lnk
[2012/07/08 14:49:20 | 000,001,666 | —- | C] () – C:\Users\Public\Desktop\iTunes.lnk
[2012/01/15 11:13:42 | 000,061,440 | —- | C] () – C:\Windows\uninstall.exe
[2011/12/08 20:39:34 | 000,016,432 | —- | C] () – C:\Windows\System32\lsdelete.exe
[2011/11/27 20:34:03 | 000,001,492 | —- | C] () – C:\ProgramData\ss.ini
[2011/09/10 10:14:19 | 000,025,944 | —- | C] () – C:\Windows\System32\SmartDefragBootTime.exe
[2011/09/10 10:14:19 | 000,015,672 | —- | C] () – C:\Windows\System32\drivers\SmartDefragDriver.sys
[2011/07/01 20:37:18 | 000,140,288 | —- | C] () – C:\Windows\System32\igfxtvcx.dll
[2011/07/01 20:27:03 | 000,982,196 | —- | C] () – C:\Windows\System32\igkrng500.bin
[2011/07/01 20:26:40 | 000,139,824 | —- | C] () – C:\Windows\System32\igfcg500.bin
[2011/07/01 20:26:40 | 000,097,448 | —- | C] () – C:\Windows\System32\igfcg500m.bin
[2011/07/01 20:26:37 | 000,417,344 | —- | C] () – C:\Windows\System32\igcompkrng500.bin
[2011/06/15 09:20:52 | 000,105,240 | —- | C] () – C:\Windows\System32\RSTCoin.dll
[2011/03/20 14:30:23 | 000,725,064 | —- | C] () – C:\Windows\System32\pwNative.exe
[2011/03/20 14:30:22 | 000,016,472 | —- | C] () – C:\Windows\System32\pwdrvio.sys
[2011/03/20 14:30:04 | 000,011,104 | —- | C] () – C:\Windows\System32\pwdspio.sys
[2011/03/20 11:30:02 | 000,000,064 | —- | C] () – C:\Windows\System32\rp_stats.dat
[2011/03/20 11:30:02 | 000,000,044 | —- | C] () – C:\Windows\System32\rp_rules.dat
[2009/03/16 09:00:43 | 000,016,890 | —- | C] () – C:\Users\Heidi\AppData\Roaming\wklnhst.dat

========== Alternate Data Streams ==========

@Alternate Data Stream - 127 bytes -> C:\ProgramData\TEMP:5D432CE3
@Alternate Data Stream - 121 bytes -> C:\ProgramData\TEMP:DFC5A2B2
@Alternate Data Stream - 114 bytes -> C:\ProgramData\TEMP:FA5F15C4

< End of report >
Post #7
Hi,

Malwarebytes

I see that you have Malwarebytes already on your computer. Please open Malwarebytes, update it and then run a Quick Scan. Save the log that is created for your next reply.
———-

Please run a free online scan with the ESET Online Scanner
Note: You will need to use Internet Explorer for this scan
  • Tick the box next to YES, I accept the Terms of Use
  • Click Start
  • When asked, allow the ActiveX control to install
  • Click Start
  • Make sure that the options Remove found threats is NOT selected and the option Scan unwanted applications is selected.
  • Click Scan (This scan can take several hours, so please be patient)
  • Once the scan is completed, you may close the window
  • Use Notepad to open the logfile located at C:\Program Files\EsetOnlineScanner\log.txt
  • Copy and paste that log as a reply to this topic
———-
Post #8
MBAM Log Malwarebytes Anti-Malware 1.62.0.1300 www.malwarebytes.org Database version: v2012.08.05.07 Windows Vista Service Pack 2 x86 NTFS Internet Explorer 9.0.8112.16421 Heidi :: HEIDI-PC [administrator] Protection: Enabled 8/6/2012 6:09:15 PM mbam-log-2012-08-06 (18-09-15).txt Scan type: Quick scan Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM Scan options disabled: P2P Objects scanned: 234380 Time elapsed: 11 minute(s), 56 second(s) Memory Processes Detected: 0 (No malicious items detected) Memory Modules Detected: 0 (No malicious items detected) Registry Keys Detected: 0 (No malicious items detected) Registry Values Detected: 0 (No malicious items detected) Registry Data Items Detected: 0 (No malicious items detected) Folders Detected: 0 (No malicious items detected) Files Detected: 0 (No malicious items detected) (end) Going to the online tool now/
Post #10
Blast it. I can NOT get the online scanner to work. Both buttons on the website are completely unresponsive for me. I've tried typing the URL of the scanner (eset.com/us/online-scanner-popup/) directly into the IE address bar and it redirects to the homepage.
Post #11
Hi,

Lets try another one. :)

Do an online scan with BitDefender QuickScan.
Please be patient as scanning may take some time. If you have problem running the scan, you might want to disable any real time protection that you have.
  • Click here to go to BitDefender QuickScan page.
  • For Firefox users:
    • Click on Free Scan Now. You will be prompted to install a plug-in. Please Allow. In case you get stuck, please refresh the page to try again.
    • A Software Installation window will appear. Click Install Now and the plugin will be installed as an Add-on.
    • Restart Firefox when done. Go back to the BitDefender QuickScan page again and click on Free Scan Now and proceed accordingly.
  • For Internet Explorer users:
    • Click on Free Scan Now. You will be prompted to install an ActiveX control. Please install.
    • The page will refresh. Click on Free Scan Now again and proceed accordingly.
  • When scan has completed, click on View report and a Notepad log shall open.
  • If there are any infections found, you will get a warning and the link to the report will be displayed as the number of infections. Click on it.
  • Post back the contents of this report. It can also be found at C:\Documents and Settings\\Application Data\QuickScan, is the Windows log-in name.
Post #13
BitDefender Scan came up clean: QuickScan 32-bit v0.9.9.119 ————————— Scan date: Tue Aug 07 12:57:19 2012 Machine ID: 3126B930 No infection found. ——————- Processes ——— Adobe® Flash® Player Installer/Uninstal 6260 C:\Windows\System32\Macromed\Flash\FlashUtil32_11_3_300_270_ActiveX.exe Alps Pointing-device Driver 3632 C:\Program Files\DellTPad\Apoint.exe Alps Pointing-device Driver 5616 C:\Program Files\DellTPad\hidfind.exe Alps Pointing-device Driver for Windows 5140 C:\Program Files\DellTPad\ApntEx.exe ArcSoft Connect 2396 C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe Canon My Printer 2960 C:\Program Files\Canon\MyPrinter\BJMYPRT.EXE Cyberlink PowerDVD 1884 C:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exe Dell Dock 3540 C:\Program Files\Dell\DellDock\DellDock.exe Dell Wireless WLAN Card Wireless Networ 176 C:\Windows\System32\WLTRAY.EXE Firefox 5408 C:\Program Files\Mozilla Firefox\firefox.exe Firefox 5524 C:\Program Files\Mozilla Firefox\plugin-container.exe Google Toolbar for Internet Explorer 8024 C:\Program Files\Google\Google Toolbar\GoogleToolbarUser_32.exe IDT PC Audio 4156 C:\Program Files\IDT\WDM\sttray.exe Intel® Common User Interface 4228 C:\Windows\System32\hkcmd.exe Intel® Common User Interface 4240 C:\Windows\System32\igfxpers.exe Intel® Common User Interface 3332 C:\Windows\System32\igfxsrvc.exe Intel® Common User Interface 4196 C:\Windows\System32\igfxtray.exe iTunes 4740 C:\Program Files\iTunes\iTunesHelper.exe Java™ Platform SE Auto Updater 2 0 4684 C:\Program Files\Common Files\Java\Java Update\jusched.exe Microsoft Security Client 4536 C:\Program Files\Microsoft Security Client\msseces.exe Microsoft® Windows® Operating System 3856 C:\Windows\explorer.exe Microsoft® Windows® Operating System 3524 C:\Windows\System32\taskeng.exe Microsoft® Windows® Operating System 6008 C:\Windows\System32\wuauclt.exe QuickSet 4140 C:\Program Files\Dell\QuickSet\quickset.exe RAID Event Monitor 3292 C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe RealPlayer (32-bit) 4876 C:\Program Files\Real\RealPlayer\Update\realsched.exe Secunia PSI Tray 4820 C:\Program Files\Secunia\PSI\psi_tray.exe VProtect Application 4720 C:\Program Files\AVG Secure Search\vprot.exe Windows® Internet Explorer 6084 C:\Program Files\Internet Explorer\iexplore.exe Windows® Internet Explorer 4336 C:\Program Files\Internet Explorer\iexplore.exe Windows® Internet Explorer 7660 C:\Program Files\Internet Explorer\iexplore.exe Windows® Internet Explorer 4016 C:\Program Files\Internet Explorer\iexplore.exe Windows® Internet Explorer 8356 C:\Program Files\Internet Explorer\iexplore.exe (verified) GoogleToolbarNotifier 4796 C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (verified) Microsoft® Windows® Operating System 4276 C:\Program Files\Windows Media Player\wmpnscfg.exe (verified) Microsoft® Windows® Operating System 2296 C:\Windows\System32\dwm.exe Network activity —————- Process iexplore.exe (4336) connected on port 80 (HTTP) –> 174.137.34.100 Process firefox.exe (5408) connected on port 80 (HTTP) –> [removed] Process firefox.exe (5408) connected on port 80 (HTTP) –> [removed] Process firefox.exe (5408) connected on port 80 (HTTP) –> [removed] Process firefox.exe (5408) connected on port 80 (HTTP) –> [removed] Process firefox.exe (5408) connected on port 80 (HTTP) –> [removed] Process firefox.exe (5408) connected on port 80 (HTTP) –> [removed] Process firefox.exe (5408) connected on port 80 (HTTP) –> [removed] Process firefox.exe (5408) connected on port 80 (HTTP) –> [removed] Process firefox.exe (5408) connected on port 80 (HTTP) –> [removed] Process firefox.exe (5408) connected on port 80 (HTTP) –> [removed] Process firefox.exe (5408) connected on port 80 (HTTP) –> [removed] Process firefox.exe (5408) connected on port 80 (HTTP) –> [removed] Process firefox.exe (5408) connected on port 80 (HTTP) –> [removed] Process firefox.exe (5408) connected on port 80 (HTTP) –> [removed] Process firefox.exe (5408) connected on port 80 (HTTP) –> [removed] Process firefox.exe (5408) connected on port 443 (HTTP over SSL) –> [removed] Process iexplore.exe (8356) connected on port 443 (HTTP over SSL) –> 173.194.37.66 Autoruns and critical files ————————— Adobe Reader and Acrobat Manager C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe Alps Pointing-device Driver C:\Program Files\DellTPad\Apoint.exe Apple Push C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe ArcSoft Connect C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe AUTOBACK.EXE C:\Program Files\ERUNT\AUTOBACK.EXE Canon My Printer C:\Program Files\Canon\MyPrinter\BJMYPRT.EXE Carbonite Setup Lite C:\Program Files\Carbonite\CarbonitePreinstaller.exe CNSLMAIN.EXE C:\Program Files\Canon\SolutionMenu\CNSLMAIN.exe Cyberlink PowerDVD C:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exe Dell Dock C:\Program Files\Dell\DellDock\DellDock.exe Dell Wireless WLAN Card Wireless Networ C:\Windows\System32\WLTRAY.EXE GoToAssist C:\Program Files\Citrix\GoToAssist\514\G2AWinLogon.dll HF_G_Jul.exe C:\Program Files\AVG Secure Search\HF_G_Jul.exe IDT PC Audio C:\Program Files\IDT\WDM\sttray.exe Immunet Protect C:\Program Files\Immunet Protect\2.0.17\iptray.exe Intel® Common User Interface C:\Windows\System32\hkcmd.exe Intel® Common User Interface C:\Windows\system32\igfxdev.dll Intel® Common User Interface C:\Windows\System32\igfxpers.exe Intel® Common User Interface C:\Windows\System32\igfxtray.exe iTunes C:\Program Files\iTunes\iTunesHelper.exe Java™ Platform SE Auto Updater 2 0 C:\Program Files\Common Files\Java\Java Update\jusched.exe Kodak EasyShare Software C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe liveonline_3977114.exe C:\Program Files\WRAL Desktop Alert\liveonline_3977114.exe LWS.exe C:\Program Files\Logitech\Logitech WebCam Software\LWS.exe Malwarebytes Anti-Malware C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe Microsoft Security Client C:\Program Files\Microsoft Security Client\msseces.exe Microsoft® Windows® Operating System C:\Windows\system32\Aurora.scr Microsoft® Windows® Operating System C:\Windows\system32\BROWSEUI.dll Mozilla Firefox C:\Program Files\Mozilla Firefox QuickSet C:\Program Files\Dell\QuickSet\quickset.exe QuickTime C:\Program Files\QuickTime\QTTask.exe RAID Event Monitor C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe RealPlayer (32-bit) C:\Program Files\Real\RealPlayer\Update\realsched.exe Secunia PSI Tray C:\Program Files\Secunia\PSI\psi_tray.exe VProtect Application C:\Program Files\AVG Secure Search\vprot.exe Windows® Internet Explorer C:\Windows\system32\msfeedssync.exe Windows® Internet Explorer c:\windows\system32\webcheck.dll (verified) GoogleToolbarNotifier C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (verified) Microsoft® Windows® Operating System c:\windows\system32\userinit.exe (verified) Windows Defender C:\Program Files\Windows Defender\MSASCui.exe Browser plugins ————— AcroIEHelperShim Library C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll Ad-Aware Security Toolbar c:\program files\adawaretb\adawaredx.dll Adobe Acrobat C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll Adobe Acrobat C:\Program Files\Internet Explorer\plugins\nppdf32.dll Adobe Acrobat C:\Program Files\Mozilla Firefox\plugins\nppdf32.dll AVG Secure Search C:\Program Files\AVG Secure Search\11.1.0.12\AVG Secure Search_toolbar.dll AVG SiteSafety plugin C:\Program Files\Common Files\AVG Secure Search\SiteSafetyInstaller\11.2.0\\npsitesafety.dll Bitdefender QuickScan C:\Users\Heidi\AppData\Roaming\Mozilla\Firefox\Profiles\60wjxva2.default\extensions\{e001c731-5e37-4538-a5cb-8168736a2360}\plugins\npqscan.dll Bonjour C:\Program Files\Bonjour\mdnsNSP.dll CANON iMAGE GATEWAY Album Plugin Utilit C:\Program Files\Canon\Easy-PhotoPrint EX\NPEZFFPI.DLL CouponNetwork Coupon Activator Netscape C:\Program Files\Mozilla Firefox\plugins\NPcol400.dll Coupons Inc., Coupon Printer Manager C:\Program Files\Mozilla Firefox\plugins\npCouponPrinter.dll Coupons Inc., Coupon Printer Manager C:\Program Files\Mozilla Firefox\plugins\npMozCouponPrinter.dll DTX broker C:\Users\Heidi\AppData\Roaming\Mozilla\Firefox\Profiles\60wjxva2.default\extensions\{87934c42-161d-45bc-8cef-ef18abe2a30c}\dtUser.exe DTX Toolbar C:\Users\Heidi\AppData\Roaming\Mozilla\Firefox\Profiles\60wjxva2.default\extensions\{87934c42-161d-45bc-8cef-ef18abe2a30c}\components\dtTransparency.dll Easy-WebPrint EX c:\program files\canon\easy-webprint ex\ewpexbho.dll Easy-WebPrint EX c:\program files\canon\easy-webprint ex\ewpexhlp.dll Google Earth Plugin C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll Google Toolbar for Internet Explorer C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll Google Update C:\Program Files\Google\Update\1.3.21.115\npGoogleUpdate3.dll InstallShield Update Service C:\Windows\Downloaded Program Files\dwusplay.exe Java Deployment Toolkit 6.0.330.3 C:\Windows\system32\npdeployJava1.dll Java™ Platform SE 6 U33 c:\program files\java\jre6\bin\jp2ssv.dll Java™ Platform SE 6 U33 C:\Program Files\Java\jre6\bin\plugin2\npjp2.dll Java™ Platform SE 6 U33 c:\program files\java\jre6\bin\ssv.dll Logitech Device Detection C:\Users\Heidi\AppData\Roaming\Mozilla\Firefox\Profiles\60wjxva2.default\extensions\[removed]\plugins\npLogitechDeviceDetection.dll Microsoft Search Enhancement Pack c:\program files\microsoft\search enhancement pack\search helper\sepsearchhelperie.dll Microsoft® CoReXT C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll npitunes.dll C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll NPSWF32_11_3_300_270.dll C:\Windows\system32\Macromed\Flash\NPSWF32_11_3_300_270.dll Picasa C:\Program Files\Picasa2\npPicasa2.dll Picasa C:\Program Files\Picasa2\npPicasa3.dll QuickTime Plug-in 7.7.1 C:\Program Files\Internet Explorer\plugins\npqtplugin.dll QuickTime Plug-in 7.7.1 C:\Program Files\Internet Explorer\plugins\npqtplugin2.dll QuickTime Plug-in 7.7.1 C:\Program Files\Internet Explorer\plugins\npqtplugin3.dll QuickTime Plug-in 7.7.1 C:\Program Files\Internet Explorer\plugins\npqtplugin4.dll QuickTime Plug-in 7.7.1 C:\Program Files\Internet Explorer\plugins\npqtplugin5.dll QuickTime Plug-in 7.7.1 C:\Program Files\Internet Explorer\plugins\npqtplugin6.dll QuickTime Plug-in 7.7.1 C:\Program Files\Internet Explorer\plugins\npqtplugin7.dll QuickTime Plug-in 7.7.1 C:\Program Files\Mozilla Firefox\plugins\npqtplugin.dll QuickTime Plug-in 7.7.1 C:\Program Files\Mozilla Firefox\plugins\npqtplugin2.dll QuickTime Plug-in 7.7.1 C:\Program Files\Mozilla Firefox\plugins\npqtplugin3.dll QuickTime Plug-in 7.7.1 C:\Program Files\Mozilla Firefox\plugins\npqtplugin4.dll QuickTime Plug-in 7.7.1 C:\Program Files\Mozilla Firefox\plugins\npqtplugin5.dll QuickTime Plug-in 7.7.1 C:\Program Files\Mozilla Firefox\plugins\npqtplugin6.dll QuickTime Plug-in 7.7.1 C:\Program Files\Mozilla Firefox\plugins\npqtplugin7.dll RealJukebox NS Plugin C:\Program Files\Mozilla Firefox\plugins\nprjplug.dll RealJukebox NS Plugin c:\program files\real\realplayer\Netscape6\nprjplug.dll RealNetworks™ Chrome Background Exte C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprpchromebrowserrecordext.dll RealPlayer Download and Record Plugin C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll RealPlayer Download Plugin C:\Program Files\Mozilla Firefox\plugins\nprpplugin.dll RealPlayer Download Plugin c:\program files\real\realplayer\Netscape6\nprpplugin.dll RealPlayer™ G2 LiveConnect-Enabled P C:\Program Files\Mozilla Firefox\plugins\nppl3260.dll RealPlayer™ G2 LiveConnect-Enabled P c:\program files\real\realplayer\Netscape6\nppl3260.dll RealPlayer™ HTML5VideoShim Plug-In ( C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll SDHelper.dll C:\Program Files\Spybot - Search & Destroy\SDHelper.dll Silverlight Plug-In c:\Program Files\Microsoft Silverlight\5.1.10411.0\npctrl.dll Skype Click to Call c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll Software Manager C:\Windows\Downloaded Program Files\isusweb.dll VLC Web Plugin C:\Program Files\VideoLAN\VLC\npvlc.dll Windows Live Messenger Companion C:\Program Files\Windows Live\Companion\companioncore.dll Windows Live™ Photo Gallery C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll Windows Presentation Foundation c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll Windows® Internet Explorer C:\Windows\system32\ieframe.dll (verified) InstallShield Update Service C:\Windows\Downloaded Program Files\dwusplay.dll (verified) Microsoft® Windows® Operating System C:\Windows\system32\mswsock.dll (verified) Microsoft® Windows® Operating System C:\Windows\system32\napinsp.dll (verified) Microsoft® Windows® Operating System C:\Windows\System32\nlaapi.dll (verified) Microsoft® Windows® Operating System C:\Windows\system32\pnrpnsp.dll (verified) Microsoft® Windows® Operating System C:\Windows\System32\winrnr.dll Scan —- MD5: 09e61047b0cef21559cfcedf4f14d216 C:\Program Files\Ad-Aware Antivirus\AdAwareService.exe MD5: 4c4a34b8678d887cc08c2c378fca2953 C:\Program Files\Ad-Aware Antivirus\AdAwareShellExtension.dll MD5: bce943896289a91ad75cc5652620b1c6 C:\Program Files\Ad-Aware Antivirus\SBAMSvc.exe MD5: 6b94578ee59fb048f573b9c8c4149fc7 c:\program files\adawaretb\adawaredx.dll MD5: 7ec56424e3e77ebf4bf5e0798175e4e5 C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll MD5: ca0d140c92b5d75763cfa1a4eb2df3c4 C:\Program Files\AVG Secure Search\11.1.0.12\AVG Secure Search_toolbar.dll MD5: 569cddd12656b793732a573d192472f5 C:\Program Files\AVG Secure Search\HF_G_Jul.exe MD5: 1af481fd411221752aa10dac1a01e5a3 C:\Program Files\AVG Secure Search\vprot.exe MD5: 40947436a70e0034e41123df5a0a7702 C:\Program Files\Bonjour\mdnsNSP.dll MD5: db5bea73edaf19ac68b2c0fad0f92b1a C:\Program Files\Bonjour\mDNSResponder.exe MD5: ce252b04fb9f4f773a7db5338bfeea5b C:\Program Files\Canon\Easy-PhotoPrint EX\NPEZFFPI.DLL MD5: 218c88f7bbff295167b5af0e8486e403 c:\program files\canon\easy-webprint ex\ewpexbho.dll MD5: 51a869a31e7816b84eaa2151d48a2c9c c:\program files\canon\easy-webprint ex\ewpexhlp.dll MD5: 0282f454bf380af26efc3913c6d435ff C:\Program Files\Canon\MyPrinter\BJMYPRT.EXE MD5: 762982e3efed750552e4ed852bf7d7c2 C:\Program Files\Canon\MyPrinter\BJMyRes.dll MD5: 223ad0ca4092aeffe0d0de25502a3db6 C:\Program Files\Canon\SolutionMenu\CNSLMAIN.exe MD5: ee9792a8aa80ad58c4f9738d3a301e27 C:\Program Files\Carbonite\CarbonitePreinstaller.exe MD5: d3316f6e3c011435f36e3d6e49b3196c C:\Program Files\Citrix\GoToAssist\514\g2aservice.exe MD5: 02a450fb1b4131b63f0782b3b626bf3d C:\Program Files\Citrix\GoToAssist\514\G2AWinLogon.dll MD5: 76f6365f5417c5e0fd1edc16542e588c C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll MD5: 60e5af8b7b4140c711b050fae5a3ab70 C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll MD5: b8e421c0890356cd4a793d8a346d9096 C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe MD5: 62b7936f9036dd6ed36e6a7efa805dc0 C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe MD5: b45f2c4076acfd9714037b7c69d90167 C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe MD5: ba02f01be7ed88e8974c798acb3075f5 C:\Program Files\Common Files\Apple\Apple Application Support\ASL.dll MD5: af54247f97ccf3539de7505c09972ff9 C:\Program Files\Common Files\Apple\Apple Application Support\CFNetwork.dll MD5: 67b539d844f804ebac7a1e3828fde709 C:\Program Files\Common Files\Apple\Apple Application Support\CoreFoundation.dll MD5: 149d74e1128a86dc9cfb2851fbea11eb C:\Program Files\Common Files\Apple\Apple Application Support\icudt46.dll MD5: 3bde52411df2fe4252c9289f51cb0f7e C:\Program Files\Common Files\Apple\Apple Application Support\libdispatch.dll MD5: fd86c605fd7ad4a41c01ec7a4a1e1c5d C:\Program Files\Common Files\Apple\Apple Application Support\libicuin.dll MD5: a3609397ef273b03295dbb10274be12c C:\Program Files\Common Files\Apple\Apple Application Support\libicuuc.dll MD5: 18301b40411b2108076ab685b4e4b6dc C:\Program Files\Common Files\Apple\Apple Application Support\libxml2.dll MD5: 32d78dcabfb942275e01363d5232c77d C:\Program Files\Common Files\Apple\Apple Application Support\objc.dll MD5: df1c1cd0c7ee95cc00d71e9e415e7bcd C:\Program Files\Common Files\Apple\Apple Application Support\pthreadVC2.dll MD5: c28fd3b37b6f18751c99e6022a2a9782 C:\Program Files\Common Files\Apple\Apple Application Support\SQLite3.dll MD5: a56ccbbfccedce2fd9c69fed24e035e3 C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll MD5: f401929ee0cc92bfe7f15161ca535383 C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe MD5: d5369247b6c11eae2c0650d8303e23b4 C:\Program Files\Common Files\Apple\Mobile Device Support\iTunesMobileDevice.dll MD5: 7548c242d95cbff76908360ad629c09f C:\Program Files\Common Files\ArcSoft\Bin\ArcCon.dll MD5: a7810b302294793de88542aae177d1b1 C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe MD5: 6f91622c1f0a6d6ec4177577bf698705 C:\Program Files\Common Files\AVG Secure Search\SiteSafetyInstaller\11.2.0\\npsitesafety.dll MD5: 1036a44358b538c4329354ae15aa8656 C:\Program Files\Common Files\AVG Secure Search\SiteSafetyInstaller\11.2.0\SiteSafety.dll MD5: 8ed347bad8d1fb7c40b593bfb01786d2 C:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater\11.2.0\ToolbarUpdater.exe MD5: 26018afa49f03032ccd3c26eaa384a4c C:\Program Files\Common Files\Dell\Advanced Networking Service\hnm_svc.exe MD5: 0bb913f9f02677bd4ae96d4967cacfee C:\Program Files\Common Files\Dell\MySQL\bin\mysqld.exe MD5: cdef1d195ea938ccc49b8f288404dae5 C:\Program Files\Common Files\Dell\Remote Access File Sync Service\dsl_fs_sync.exe MD5: 98a078f838a70f84e1bd490d7c7675f4 C:\Program Files\Common Files\Java\Java Update\jusched.exe MD5: 6bf01e200063d7274f3af06d226671f5 C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll MD5: da579734b4375740efee86ffdfed57a7 C:\Program Files\Common Files\Microsoft Shared\Windows Live\wlidcli.dll MD5: 0a70f4022ec2e14c159efc4f69aa2477 C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE MD5: 1d0063597c3666404fcf97698abeb019 C:\Program Files\Common Files\SureThing Shared\stllssvr.exe MD5: d97cad482f0ecce41c8e6e0992495bb4 C:\Program Files\CyberLink\PowerDVD DX\Kernel\common\CLRCEngine3.dll MD5: f35a584e947a5b401feb0fe01db4a0d7 C:\Program Files\CyberLink\PowerDVD DX\MFC71.DLL MD5: 186c9d39541cc0dffcc454f79aa0b0bf C:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exe MD5: e1974a92ac0914a3859359a0a8c82c68 C:\Program Files\Dell DataSafe Local Backup\sftservice.EXE MD5: 58d9c70b01dbf2deaea787a1d7c869bb C:\Program Files\Dell\DellDock\DellDock.exe MD5: db29915209770d8b59654345ec2d943a C:\Program Files\Dell\DellDock\DockLogin.exe MD5: fc77ea9f18d22d6feca318e81a0bc473 C:\Program Files\Dell\DellDock\MyDockLib.dll MD5: 3e9ecf5bcc6b04500ea2ebbc0aea3b02 C:\Program Files\Dell\QuickSet\dadkeyb.dll MD5: 7697b83c440ca941d469d04d01dd3f33 C:\Program Files\Dell\QuickSet\quickset.exe MD5: 359937efd1763df9f8b8d166bd4cc022 C:\Program Files\DellTPad\ApntEx.exe MD5: 388ca4002828d3a50892bd7753b354e8 C:\Program Files\DellTPad\Apoint.dll MD5: 97dceb849b1537e9090135a0982e322d C:\Program Files\DellTPad\Apoint.exe MD5: 81b43f7e896d65cfa3d5f1b640c88f12 C:\Program Files\DellTPad\EzAuto.dll MD5: b3f1e7ed7aecb1d4b8d24a3734b2c641 C:\Program Files\DellTPad\hidfind.exe MD5: e00de20f0f6bed5cd2160247ddc9443b C:\Program Files\ERUNT\AUTOBACK.EXE MD5: 751ee920d6811584e5b1f0b153a5a4e2 C:\Program Files\ESET\ESET Online Scanner\OnlineScanner.ocx MD5: 408ddd80eede47175f6844817b90213e C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe MD5: 2437be68d5a37a75fad51c5f0e9a03ed C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll MD5: 249c198a1a8d8e14c0137e2cea474934 C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_32_17695C964715481C.dll MD5: 8cae3cf7fcec8a0f1726041b211c1b4f C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_6934F32E05F1ABDC.dll MD5: 5b97ab550022b2783894c558fa2e1310 C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll MD5: 7a6dfce4b8033ccd303918faccca9588 C:\Program Files\Google\Google Toolbar\GoogleToolbarUser_32.exe MD5: ab3668c159e1cfea184f72650bd66807 C:\Program Files\Google\GoogleToolbarNotifier\5.7.7227.1100\swg.dll MD5: 8f628060daecf76c537bd89a53228d3b C:\Program Files\Google\Update\1.3.21.115\npGoogleUpdate3.dll MD5: b8d7fc13ba781104e67923b7a0a5719c C:\Program Files\Google\Update\1.3.21.115\psmachine.dll MD5: cadb1c92fdd8ccb9cf6a0c0c7fefc221 C:\Program Files\IDT\WDM\STLang.dll MD5: 684a126ab3a3ad0617490c12c97c3eed C:\Program Files\IDT\WDM\sttray.exe MD5: 0085862d37972a36a5a2c3bf10596c50 C:\Program Files\Immunet Protect\2.0.17\agent.exe MD5: 145095e7b2f1e915e1a5121409978cf9 C:\Program Files\Immunet Protect\2.0.17\dcm.dll MD5: 11d8d7fe1153d856d676c394461047de C:\Program Files\Immunet Protect\2.0.17\iptray.exe MD5: 90e4994582ca688cd6f93af4e2870188 C:\Program Files\Immunet Protect\tetra\scan.dll MD5: a50a6ac7d2ed7f82f23a7d2fb2af758b C:\Program Files\Intel\Intel Matrix Storage Manager\IAAMon_ENU.dll MD5: 2521d0c1b65acb7752ca365f538949e4 C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe MD5: 7b96206e4bdd2fe582f0dbc46f5f410e C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMon.exe MD5: 296b1be8c1b751ec384138c82670f1e0 C:\Program Files\Intel\Intel Matrix Storage Manager\ISDI.dll MD5: faf339801b90638d88dfdc6424c297e3 C:\Program Files\Internet Explorer\ieproxy.dll MD5: 15bd4e217555c6792218614310de14bb C:\Program Files\internet explorer\IEShims.dll MD5: 0129bb16161c2fd9a6b19111ab047198 C:\Program Files\Internet Explorer\iexplore.exe MD5: 7d894ed61ef0505277d8a476d7df43f1 C:\Program Files\Internet Explorer\plugins\nppdf32.dll MD5: 47c3fa43f99202e2f92efa1eb9bdecf7 C:\Program Files\Internet Explorer\plugins\npqtplugin.dll MD5: 47c3fa43f99202e2f92efa1eb9bdecf7 C:\Program Files\Internet Explorer\plugins\npqtplugin2.dll MD5: 47c3fa43f99202e2f92efa1eb9bdecf7 C:\Program Files\Internet Explorer\plugins\npqtplugin3.dll MD5: 47c3fa43f99202e2f92efa1eb9bdecf7 C:\Program Files\Internet Explorer\plugins\npqtplugin4.dll MD5: 47c3fa43f99202e2f92efa1eb9bdecf7 C:\Program Files\Internet Explorer\plugins\npqtplugin5.dll MD5: 47c3fa43f99202e2f92efa1eb9bdecf7 C:\Program Files\Internet Explorer\plugins\npqtplugin6.dll MD5: 47c3fa43f99202e2f92efa1eb9bdecf7 C:\Program Files\Internet Explorer\plugins\npqtplugin7.dll MD5: 85eb954de144975d30bf0e33fe74bc48 C:\Program Files\IObit\Advanced SystemCare 5\ASCv5ExtMenu.dll MD5: e6be7a41a28d8f2db174957454d32448 C:\Program Files\iPod\bin\iPodService.exe MD5: b1ca4aa760ff0ddfa1c38e95d19cfefb C:\Program Files\iTunes\iTunesHelper.dll MD5: 34086f1dbb4065047ea3671cb70505cc C:\Program Files\iTunes\iTunesHelper.exe MD5: e7fe89f69c3cc65cad3d1adc5d6a9f41 C:\Program Files\iTunes\iTunesHelper.Resources\en.lproj\iTunesHelperLocalized.DLL MD5: 0654195051d1024c005e7be135a6fee7 C:\Program Files\iTunes\iTunesHelper.Resources\iTunesHelper.DLL MD5: d28ad1cb902ac6d228532812d3850c7d C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll MD5: 262078b3d34b82246df9ddd5adc71625 c:\program files\java\jre6\bin\jp2ssv.dll MD5: ac6f61b19ffac2d6851931b64b52a6d7 C:\Program Files\Java\jre6\bin\plugin2\npjp2.dll MD5: c12dc63c402155593225916b99667b56 c:\program files\java\jre6\bin\ssv.dll MD5: 6359bea592855f9c85d9535ea5c4d3a4 C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe MD5: 55afd4a9d5ed4ad40d5215ccdf4d65f3 C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe MD5: 6c4a3804510ad8e0f0c07b5be3d44ddb C:\Program Files\Lavasoft\Ad-Aware\KernExplorer.sys MD5: d557e34417045fe1ae75519930f3fa61 C:\Program Files\Lavasoft\Ad-Aware\ShellExt.dll MD5: 2589ffe360bed8f824cbc6171cb5b874 C:\Program Files\Logitech\Logitech WebCam Software\LWS.exe MD5: 55b8c7b701c4d1b0c479f3ffea83850f C:\Program Files\Malwarebytes' Anti-Malware\mbamext.dll MD5: 84db35f319e5b67838a4877c11748866 C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe MD5: 43683e970f008c93c9429ef428147a54 C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe MD5: a8e35801e04a4183a27df60829402867 C:\Program Files\Microsoft Security Client\EppManifest.dll MD5: 410ccadf699cee2c0c741df0fd90f204 C:\Program Files\Microsoft Security Client\mpclient.dll MD5: 891348171414bf1fd6bbbd46159d5446 c:\Program Files\Microsoft Security Client\MpOAv.dll MD5: 24516bf4e12a46cb67302e2cdcb8cddf c:\Program Files\Microsoft Security Client\MsMpEng.exe MD5: 687b71c161b246ece1a13d24aacf0413 C:\Program Files\Microsoft Security Client\msseces.exe MD5: 290c0d4c4889398797f8df3be00b9698 c:\Program Files\Microsoft Security Client\NisSrv.exe MD5: 03af6799c7974352a9a5920e5445cb03 c:\Program Files\Microsoft Security Client\shellext.dll MD5: 9013599b12923a45c029c34e8d2211ac c:\Program Files\Microsoft Silverlight\5.1.10411.0\npctrl.dll MD5: 16a252022535b680046f6e34e136d378 C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe MD5: a4ad1aa4c57409480c1d84bbca6becf0 c:\program files\microsoft\search enhancement pack\search helper\sepsearchhelperie.dll MD5: 6d3ce6a1fe3be6d51a90c3aef6d545ac C:\Program Files\Mozilla Firefox\components\browsercomps.dll MD5: 3f677172f23fc17283d9bce4b42e3f65 C:\Program Files\Mozilla Firefox\firefox.exe MD5: 7ad79ebf2915bb6c9b821932d8d90879 C:\Program Files\Mozilla Firefox\freebl3.dll MD5: be005b2321b30219b43986c713ed31a0 C:\Program Files\Mozilla Firefox\gkmedias.dll MD5: d44761290b0861c8df045cde34eb0705 C:\Program Files\Mozilla Firefox\mozalloc.dll MD5: 4009aca971c4d4e5fa8891b076917069 C:\Program Files\Mozilla Firefox\mozglue.dll MD5: 0fce648f8031872f7b8049f13fa0edc4 C:\Program Files\Mozilla Firefox\mozjs.dll MD5: fde476cfa50f0e1c3ca7b732334b5c3a C:\Program Files\Mozilla Firefox\mozsqlite3.dll MD5: 03e9314004f504a14a61c3d364b62f66 C:\Program Files\Mozilla Firefox\MSVCP100.dll MD5: 67ec459e42d3081dd8fd34356f7cafc1 C:\Program Files\Mozilla Firefox\MSVCR100.dll MD5: d7cb45bead7ff63b8d82abbfb9d74102 C:\Program Files\Mozilla Firefox\nspr4.dll MD5: 714e3f17d0e2e23354f15fd01b4f4ea8 C:\Program Files\Mozilla Firefox\nss3.dll MD5: f661ecddf6b287683139f4bd365478cb C:\Program Files\Mozilla Firefox\nssckbi.dll MD5: eeff5623465b383677699a06070becea C:\Program Files\Mozilla Firefox\nssdbm3.dll MD5: 80d6b31fa7618b97ca9a0112b7cbb0ea C:\Program Files\Mozilla Firefox\nssutil3.dll MD5: 476f7d54970aea25dea456825c64d733 C:\Program Files\Mozilla Firefox\plc4.dll MD5: 5127cdc241d32568dd458cb0d1c4cea1 C:\Program Files\Mozilla Firefox\plds4.dll MD5: a06ab1550658a19e871a6fd7ff1c2cdb C:\Program Files\Mozilla Firefox\plugin-container.exe MD5: ae5e8753ddfd97c7b15bb542a431f396 C:\Program Files\Mozilla Firefox\plugins\NPcol400.dll MD5: 2a8afe4cfe5e08024e971c45573555a0 C:\Program Files\Mozilla Firefox\plugins\npCouponPrinter.dll MD5: 04a7796bdd18582f8db198a4d2a64d96 C:\Program Files\Mozilla Firefox\plugins\npMozCouponPrinter.dll MD5: 7d894ed61ef0505277d8a476d7df43f1 C:\Program Files\Mozilla Firefox\plugins\nppdf32.dll MD5: 4d96a92905be968000b6470996e670a7 C:\Program Files\Mozilla Firefox\plugins\nppl3260.dll MD5: 47c3fa43f99202e2f92efa1eb9bdecf7 C:\Program Files\Mozilla Firefox\plugins\npqtplugin.dll MD5: 47c3fa43f99202e2f92efa1eb9bdecf7 C:\Program Files\Mozilla Firefox\plugins\npqtplugin2.dll MD5: 47c3fa43f99202e2f92efa1eb9bdecf7 C:\Program Files\Mozilla Firefox\plugins\npqtplugin3.dll MD5: 47c3fa43f99202e2f92efa1eb9bdecf7 C:\Program Files\Mozilla Firefox\plugins\npqtplugin4.dll MD5: 47c3fa43f99202e2f92efa1eb9bdecf7 C:\Program Files\Mozilla Firefox\plugins\npqtplugin5.dll MD5: 47c3fa43f99202e2f92efa1eb9bdecf7 C:\Program Files\Mozilla Firefox\plugins\npqtplugin6.dll MD5: 47c3fa43f99202e2f92efa1eb9bdecf7 C:\Program Files\Mozilla Firefox\plugins\npqtplugin7.dll MD5: 90492e00ee4c916123bec5d267894e8c C:\Program Files\Mozilla Firefox\plugins\nprjplug.dll MD5: 1291beebb50451c80bf7719612196508 C:\Program Files\Mozilla Firefox\plugins\nprpplugin.dll MD5: ba6db597377c3d29128aa201e1d94297 C:\Program Files\Mozilla Firefox\smime3.dll MD5: dd74fb796f5d9a2bf5b4f24201429ab8 C:\Program Files\Mozilla Firefox\softokn3.dll MD5: a5a40243d737326e61d296abd4c8aece C:\Program Files\Mozilla Firefox\ssl3.dll MD5: a24cdf378df91a4304a1f3e7247bd513 C:\Program Files\Mozilla Firefox\xpcom.dll MD5: 0bdd5b8ac394de23edbbf8998cbbe2a7 C:\Program Files\Mozilla Firefox\xul.dll MD5: 46297fa8e30a6007f14118fc2b942fbc C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe MD5: 07b6151824600789887c3c9899337f8e C:\Program Files\Notepad++\NppShell_01.dll MD5: 625d0a824f513ce1cabb8861e97f2142 C:\Program Files\Picasa2\npPicasa2.dll MD5: 54bc55d3d9bd33a6ce38f811cf836794 C:\Program Files\Picasa2\npPicasa3.dll MD5: af43c4f7f3c8bc95dad95024f96cdc4a C:\Program Files\QuickTime\QTTask.exe MD5: 4d96a92905be968000b6470996e670a7 c:\program files\real\realplayer\Netscape6\nppl3260.dll MD5: 90492e00ee4c916123bec5d267894e8c c:\program files\real\realplayer\Netscape6\nprjplug.dll MD5: 1291beebb50451c80bf7719612196508 c:\program files\real\realplayer\Netscape6\nprpplugin.dll MD5: 8e53b67fa3816e854b07c5dc66e10730 C:\Program Files\Real\RealPlayer\Update\realsched.exe MD5: d179e1de532c903ab1d57a4e81342f40 C:\Program Files\Secunia\PSI\psi_tray.exe MD5: 7198bbfbe46c0070257278c536386687 C:\Program Files\Secunia\PSI\PSIA.exe MD5: d2fca567f9be87e29b9a9fa32ffe79ca C:\Program Files\Secunia\PSI\sua.exe MD5: ba0d5ddab5424235fda0337ac310c5a7 c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll MD5: 6128e98eaaed364ed1a32708d2fd22cb C:\Program Files\Skype\Updater\Updater.exe MD5: 97926efa3179a0525a3f8d7ca4ece225 C:\Program Files\twc\medicsp2\bin\sprtsvc.exe MD5: 1f8ffde82c52353906244afdc6baf2ab C:\Program Files\VideoLAN\VLC\npvlc.dll MD5: b7dc98f6f4e7611a9c0849945fb28fb9 C:\Program Files\Windows Defender\MpOav.dll MD5: 47bdbce3e2d819b17ab9fa4539b9df71 C:\Program Files\Windows Live\Companion\companioncore.dll MD5: 7e08fddfae091a5a0d22a75c60a14962 C:\Program Files\Windows Live\Family Safety\fsapi.dll MD5: 4ce9dac1518ff7e77bd213e6394b9d77 C:\Program Files\Windows Live\Family Safety\fsssvc.exe MD5: 5b239ff33aeaffc5983aaad4dbf9c87f C:\Program Files\Windows Live\Installer\wlshim.dll MD5: 6067acef367e79914af628fa1e9b5330 C:\Program Files\Windows Live\Mesh\wlcrasvc.exe MD5: ac421a44de902f2627f1e63793ed89cd C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll MD5: 3856e8add648bc2dfeb07406c7f25804 C:\Program Files\Windows Live\Shared\UXCalendar.dll MD5: f0d369b57b0b0b00d4e146f0f53fb86c C:\Program Files\Windows Live\Shared\uxcontacts.dll MD5: e680a55e9488921fc487616f4ede7797 C:\Program Files\Windows Live\Shared\UXCore.dll MD5: cc9e4d197143738bd868282e76ff6731 C:\Program Files\Windows Live\Shared\WLDCore.dll MD5: 5608270262bb7461f885d28ed87a0acc C:\Program Files\WRAL Desktop Alert\liveonline_3977114.exe MD5: 3de544a34b868038bc704cef76c40a09 C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll MD5: 10737b44923217bc0e67d26a9fc1f0aa C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprpchromebrowserrecordext.dll MD5: 2645990c521342dcd08963d2df6cd0d2 C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll MD5: 61a66b66f46a60842d0e40ff241b5b11 C:\ProgramData\UltraVNC\winvnc.exe MD5: 053547f21f43f5cb702759da5343e876 C:\Users\Heidi\AppData\Local\Temp\{6D9FC627-8577-4D6E-902B-94EA768199B0}\fpb.tmp MD5: dfd5a8c94118c4e85b33245c2ddb553a C:\Users\Heidi\AppData\Roaming\Mozilla\Firefox\Profiles\60wjxva2.default\extensions\[removed]\plugins\npLogitechDeviceDetection.dll MD5: 9232d0e2a87b415869b128b2e7dc7953 C:\Users\Heidi\AppData\Roaming\Mozilla\Firefox\Profiles\60wjxva2.default\extensions\{87934c42-161d-45bc-8cef-ef18abe2a30c}\components\dtTransparency.dll MD5: ef1f476c89411d81a6ad65b508199bac C:\Users\Heidi\AppData\Roaming\Mozilla\Firefox\Profiles\60wjxva2.default\extensions\{87934c42-161d-45bc-8cef-ef18abe2a30c}\dtUser.exe MD5: c9e3864fb9cbfa93d9010bcfe18a5697 C:\Users\Heidi\AppData\Roaming\Mozilla\Firefox\Profiles\60wjxva2.default\extensions\{e001c731-5e37-4538-a5cb-8168736a2360}\plugins\npqscan.dll MD5: 3dd74ddfada2d113033ebd87da85893a C:\Windows\assembly\NativeImages_v2.0.50727_32\Accessibility\1b337cf9a031145849bc48c11b2cfe58\Accessibility.ni.dll MD5: d3f7336df6475923f26a732c4672c947 C:\Windows\assembly\NativeImages_v2.0.50727_32\DellDock\a2117f9d2b9670193889149f0ec777d5\DellDock.ni.exe MD5: 6b9f51436b93925bfac9b0b47aee595f C:\Windows\assembly\NativeImages_v2.0.50727_32\MenuSkinning\e4ead33e7390326a9814a511c566054b\MenuSkinning.ni.dll MD5: 015a9d857726c083144ca352a273378a C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\af9c9e9d7e0523cd444f8b551baa9cbf\mscorlib.ni.dll MD5: d30528cc80571fb8435a934bfd11102f C:\Windows\assembly\NativeImages_v2.0.50727_32\MyDock.Util\d8dfd448743194309366caa97c215c21\MyDock.Util.ni.dll MD5: b8876bba284dfec2311d7694483ab8ae C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Configuration\bd76aaaa03ddc15d1840207b5a480644\System.Configuration.ni.dll MD5: f05fdb5756f82c6cbbc9203d974a0c3b C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\18f9789aa214c657113e676b3a9015aa\System.Drawing.ni.dll MD5: 5a6bfe723cf0e6e39021cdc01ca57eed C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Management\f3d4d5fe5ab848fbfcf91a49960dc8ae\System.Management.ni.dll MD5: 5cad3395a4720bf735836d125297229a C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Runtime.Remo#\846b9cf2756fdd15f704c9bab9c70b6f\System.Runtime.Remoting.ni.dll MD5: 41b7f0a4ebf804d9d512637a06d96d34 C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Web\508b444db523c5cf20ff12c7f440837b\System.Web.ni.dll MD5: 279a8be318ebc0c25c5ea9aed19e0cf9 C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\f2691cfa7671cdc58179e56ba9227591\System.Windows.Forms.ni.dll MD5: 203547ce63309c0994ecc9c6fa836e26 C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Xml\3b7181bb19dd5dd74cd063f0312cdf57\System.Xml.ni.dll MD5: 1e03babb4d6ca5c27bd2c822f7f95788 C:\Windows\assembly\NativeImages_v2.0.50727_32\System\28d633338fc8d29f8af31935ef7d001b\System.ni.dll MD5: 8fbf6631a3513b5bfd3f9519fe4c338b C:\Windows\assembly\NativeImages_v2.0.50727_32\VistaBridgeLibrary\53ff6fb64982a15d164f25e727be6bb4\VistaBridgeLibrary.ni.dll MD5: 01e2eca759056f23c73a035fdabb2d6d C:\Windows\Downloaded Program Files\dwusplay.exe MD5: 3787a4bc97ce6c630f4b581425223d96 C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorjit.dll MD5: c42ae64f5db6bc5e947b7e3e1b1e633e C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll MD5: 35a936c7c029a5b705d3ffd40518d660 C:\Windows\Microsoft.NET\Framework\v2.0.50727\WMINet_Utils.dll MD5: ab87eeffd18f2baafc274e7075ea6c67 c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll MD5: 215ce077258cedd5be4c56e9d614db9f C:\Windows\Microsoft.NET\Framework\v4.0.30319\clr.dll MD5: f5df6846f30e9f54ea60ccaeb3fb2055 C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll MD5: e9b9c1b98c8d6d48407e1c1203eac659 C:\Windows\system32\adsldpc.dll MD5: f240b31da00632718cc2392a4d193313 C:\Windows\system32\Aurora.scr MD5: 6dcb6ad4a747b586907a4dc6f318d22e C:\Windows\System32\bcmwlrmt.dll MD5: 74f26fc01b180d4a99a168ed69c30a53 C:\Windows\system32\cmd.exe MD5: 93e317d7ad783d8eaee2e3500bfe889d C:\Windows\system32\credui.dll MD5: f180ede9cfc3ff218d4b45155119f4d9 C:\Windows\System32\CRYPT32.dll MD5: f798a893c8c214f74889dbf9d3a412de C:\Windows\system32\cryptnet.dll MD5: 75c6a297e364014840b48eccd7525e30 C:\Windows\system32\cryptsvc.dll MD5: e9b39c81c87e5b790fce121da9e02701 C:\Windows\system32\d2d1.dll MD5: 8b02d2ecc7ef6e1f6af08459e3f741f6 C:\Windows\system32\d3d10.dll MD5: 5256383d1d266a9eefcdb270340c0e5c C:\Windows\system32\d3d10_1.dll MD5: a441f5b43eaf4bd4e3acfbe38841b46b C:\Windows\system32\d3d10_1core.dll MD5: 9c7094f537782a82b6a29b4a7172e180 C:\Windows\system32\d3d10core.dll MD5: 04802864f51046e93471083a24469ace C:\Windows\system32\D3D10Level9.dll MD5: 4a4c71376eca305d6dea021f1a44816d C:\Windows\system32\D3D10Warp.dll MD5: cb1f79a5b3551273e55f69dddcb919e3 C:\Windows\system32\dispex.dll MD5: 85e861d0b88db2b54acb0839654c09f7 C:\Windows\System32\DNSAPI.dll MD5: 57d762f6f5974af0da2be88a3349baaa C:\Windows\System32\dnsrslvr.dll MD5: 062373995eae5f0eac9eaa9192136bfb C:\Windows\system32\dnssd.dll MD5: 3911b972b55fea0478476b2e777b29fa C:\Windows\system32\drivers\afd.sys MD5: b83f9da84f7079451c1c6a4a2f140920 C:\Windows\system32\DRIVERS\Apfiltr.sys MD5: 0d83c87a801a3dfcd1bf73893fe7518c C:\Windows\system32\drivers\atapi.sys MD5: 423c7b87e886ac93d22936ea82665f83 C:\Windows\system32\drivers\BCM42RLY.sys MD5: 41a70777e892c3dea606758366566a77 C:\Windows\system32\DRIVERS\bcmwl6.sys MD5: 35f376253f687bde63976ccb3f2108ca C:\Windows\system32\DRIVERS\bowser.sys MD5: 622c41a07ca7e6dd91770f50d532cb6c C:\Windows\System32\Drivers\dfsc.sys MD5: 4f59c172c094e1a1d46463a8dc061cbd C:\Windows\system32\DRIVERS\Dot4.sys MD5: 80bf3ba09f6f2523c8f6b7cc6dbf7bd5 C:\Windows\system32\DRIVERS\Dot4Prt.sys MD5: c55004ca6b419b6695970dfe849b122f C:\Windows\system32\DRIVERS\dot4usb.sys MD5: c68ac676b0ef30cfbb1080adce49eb1f C:\Windows\System32\drivers\dxgkrnl.sys MD5: 908ed85b7806e8af3af5e9b74f7809d4 C:\Windows\system32\DRIVERS\e1e6032.sys MD5: d909075fa72c090f27aa926c32cb4612 C:\Windows\system32\DRIVERS\fssfltr.sys MD5: 4b80b97cbf0782b3bb3057f88d42c367 C:\Windows\system32\drivers\iastor.sys MD5: 938753888eaddb29d4b3754139ec19e8 C:\Windows\system32\DRIVERS\igdkmd32.sys MD5: 0452cbd785659bb9e86b6c849bc292f9 C:\Windows\system32\DRIVERS\ImmunetProtect.sys MD5: 426737322b000e3d9d7fb5b13f443b27 C:\Windows\system32\DRIVERS\ImmunetSelfProtect.sys MD5: 2b2f1638466e8cb091400c9019cc730e C:\Windows\System32\Drivers\ksecdd.sys MD5: 336abe8721cbc3110f1c6426da633417 C:\Windows\system32\DRIVERS\Lbd.sys MD5: 0da6c5e0c8da6cebe52daacfe7ae9de6 C:\Windows\system32\DRIVERS\LV302V32.SYS MD5: 1a7db7a00a4b0d8da24cd691a4547291 C:\Windows\system32\DRIVERS\LVPr2Mon.sys MD5: 9e9306063ecd8aa91b3fb76678d3cee2 C:\Windows\system32\DRIVERS\LVUSBSta.sys MD5: 6dfe7f2e8e8a337263aa5c92a215f161 C:\Windows\system32\drivers\mbam.sys MD5: d993bea500e7382dc4e760bf4f35efcb C:\Windows\system32\DRIVERS\MpFilter.sys MD5: 1e94971c4b446ab2290deb71d01cf0c2 C:\Windows\system32\DRIVERS\mrxsmb.sys MD5: 4fccb34d793b116423209c0f8b7a3b03 C:\Windows\system32\DRIVERS\mrxsmb10.sys MD5: c3cb1b40ad4a0124d617a1199b0b9d7c C:\Windows\system32\DRIVERS\mrxsmb20.sys MD5: f70590424eefbf5c27a40c67afdb8383 C:\Windows\system32\drivers\msahci.sys MD5: b52f26bade7d7e4a79706e3fd91834cd C:\Windows\system32\DRIVERS\NisDrvWFP.sys MD5: 9d80e0be979c3edaf2863f23b88f4de6 C:\Windows\system32\DRIVERS\packet.sys MD5: b9c2b89f08670e159f7181891e449cd9 C:\Windows\System32\drivers\partmgr.sys MD5: d24dfd16a1e2a76034df5aa18125c35d C:\Windows\system32\DRIVERS\psi_mf.sys MD5: 03e0fe281823ba64b3782f5b38950e73 C:\Windows\System32\Drivers\PxHelp20.sys MD5: d1fb9a678bd6c2b1129fcb09d5feb6dd C:\Windows\system32\drivers\RTSTOR.SYS MD5: bcf3ba30c1cfa2942cf26c31384b37c7 C:\Windows\system32\drivers\SbFw.sys MD5: 1dcad90cc9c0ddc7d060fd97854f8518 C:\Windows\system32\DRIVERS\sbfwim.sys MD5: 1afd7178ab9c4fce2d332da7aa474fa6 C:\Windows\system32\drivers\sbhips.sys MD5: 9bdf801a6c78e3f1e6fa1c5ca90baa8a C:\Windows\system32\DRIVERS\sbwtis.sys MD5: 46b40982af166bf89c3f51fb13e60d6d C:\Windows\System32\Drivers\SmartDefragDriver.sys MD5: 41987f9fc0e61adf54f581e15029ad91 C:\Windows\System32\DRIVERS\srv.sys MD5: ff33aff99564b1aa534f58868cbe41ef C:\Windows\System32\DRIVERS\srv2.sys MD5: 7605c0e1d01a08f3ecd743f38b834a44 C:\Windows\System32\DRIVERS\srvnet.sys MD5: 02b3ef45094f090e397eea46cbed7b9e C:\Windows\system32\DRIVERS\stwrt.sys MD5: ee7e10bed85c312c1d5d30c435bdda9f C:\Windows\System32\drivers\tcpip.sys MD5: 2c2d4cff5e09c73908f9b5af49a51365 C:\Windows\System32\drivers\tcpipreg.sys MD5: eafe1e00739afe6c51487a050e772e17 C:\Windows\System32\Drivers\usbaapl.sys MD5: 922b2ebd5118b9ab120410807131a921 C:\Windows\system32\DRIVERS\usbccgp.sys MD5: 3d045eaa73414be8f877f292a84abba2 C:\Windows\system32\DRIVERS\usbehci.sys MD5: 1ae77a4c4e4f526ef9759c31a123f2b0 C:\Windows\system32\DRIVERS\usbhub.sys MD5: f69c1aad04f28415f3fbe99fbe56030b C:\Windows\system32\DRIVERS\usbuhci.sys MD5: f9ad3a5e3fd7e0bdb18b8202b0fdd4e4 C:\Windows\system32\DRIVERS\wimfltr.sys MD5: 1a51df1a5c658d534ed980d18f7982de C:\Windows\system32\DRIVERS\yk60x86.sys MD5: 827dbc22c96eecf6d36a13162fabafd3 C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_0145da1d\aestsrv.exe MD5: bf8b7e3c4af6e29025519a70469061a6 C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_0145da1d\STacSV.exe MD5: cabd1b34bd05c986b4dbc18bc0e947ee C:\Windows\system32\DWrite.dll MD5: aaae543c535ed596ecad2ab8761c2c6f C:\Windows\system32\dxgi.dll MD5: 4312debdacbe338f0b90e7f08e7672be C:\Windows\system32\Dxtmsft.dll MD5: ca493a92da9880b6f1a89c3dbd54ba5b C:\Windows\system32\Dxtrans.dll MD5: abaeaee763e287bdd39094c4165e1f3f C:\Windows\system32\fdproxy.dll MD5: 8ce364388c8eca59b14b539179276d44 C:\Windows\system32\FntCache.dll MD5: 43a28d5fdfa6041353ddf718b9012b85 C:\Windows\System32\hccutils.DLL MD5: 2c6199d6492cbfb50430c4df1a584e4e C:\Windows\System32\hkcmd.exe MD5: ed6f6fbbcdec95483b7351e23f4fcdf6 C:\Windows\system32\IEADVPACK.DLL MD5: ee9d715af1b928982f417238b9914484 C:\Windows\system32\ieapfltr.dll MD5: ccb604ce25a818b700005f3a1ba8d2c7 C:\Windows\system32\ieframe.dll MD5: e0c68ce8a3c548b101abc01db3ddb7ca C:\Windows\system32\iertutil.dll MD5: 42b346e66092ae04b8c906723381bcde C:\Windows\system32\IEUI.dll MD5: 67d38992b89f8a18ce85cde6f7e28031 C:\Windows\system32\igdumd32.dll MD5: 6c86dce1d42302b78a5e9de28cc38e38 C:\Windows\system32\igdumdx32.dll MD5: 232d32019747e0f659621e48d5657ef5 C:\Windows\system32\igfxdev.dll MD5: f565b2c95c6216678c755b666528b550 C:\Windows\System32\igfxpers.exe MD5: bebc1a46a669abb242cfdba342419da4 C:\Windows\system32\igfxrENU.lrc MD5: b1b23a6df960fea304ee279cf4339f6f C:\Windows\System32\igfxress.dll MD5: 63fb34cd422b94c04f1d3903f2c44053 C:\Windows\system32\igfxsrvc.dll MD5: 924ffa76d1e9d9365de0ecfb00fe0926 C:\Windows\System32\igfxsrvc.exe MD5: 726232caebcb3cbe45fc55fcd9c4e6cf C:\Windows\system32\igfxTMM.dll MD5: e5e37b2b65b414e841c2d797f3c38da5 C:\Windows\System32\igfxtray.exe MD5: eb49faa5ebbc06356fb12476438781b9 C:\Windows\system32\imagehlp.dll MD5: 68563ac389f92ee79f1c714288ba1dce C:\Windows\system32\ImgUtil.dll MD5: b12f617a5f58e214c701336f4df3b03e C:\Windows\System32\jscript.dll MD5: 7c0fb8b077ad00df1622a9618ad66a89 C:\Windows\System32\jscript9.dll MD5: 11b2f432bfa1d1c1f50dbd761e7bd540 C:\Windows\system32\jsproxy.dll MD5: 574b473facaa0e91702b86578440b525 C:\Windows\system32\KERNEL32.dll MD5: a3e186b4b935905b829219502557314e C:\Windows\system32\lsass.exe MD5: da5842b17ccf99b06af0b22c0031af88 C:\Windows\system32\Macromed\Flash\Flash32_11_3_300_270.ocx MD5: f19c98ad81d2c0e1bbfd8153d2c80ee8 C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe MD5: 053547f21f43f5cb702759da5343e876 C:\Windows\system32\Macromed\Flash\FlashUtil32_11_3_300_270_ActiveX.dll MD5: c21e4e3f5b525ad786cae4f87da9b014 C:\Windows\System32\Macromed\Flash\FlashUtil32_11_3_300_270_ActiveX.exe MD5: 6ad7b1d887d26f06033280f4b5c2034b C:\Windows\system32\Macromed\Flash\NPSWF32_11_3_300_270.dll MD5: 1b593fbb763150bd225df266c69a9329 C:\Windows\system32\MFC42u.DLL MD5: 7940c04ce581288a3498d57ec4ee47d2 C:\Windows\system32\msfeeds.dll MD5: 1d3ee28ba231cbb9600f5d102eaf4ea7 C:\Windows\system32\msfeedssync.exe MD5: 9fb58f71104107d44540af1195f7a14d C:\Windows\system32\MSHTML.dll MD5: 35aae2e841aa1a949775168e119482c9 C:\Windows\system32\msls31.dll MD5: 0b8fe658bd033ec8b1f6fbc305cc65e7 C:\Windows\system32\MSRATING.dll MD5: ff41e1ac301f51e16f61ad7c0f45467c C:\Windows\System32\msshsq.dll MD5: 17af64d727545f2804f6e6d998327e3f C:\Windows\system32\msvcrt.dll MD5: ed3d850c960401b9cbf0afc3a066073d C:\Windows\system32\npdeployJava1.dll MD5: dda770bbd7c2ed024d6f50e279d90e5b C:\Windows\system32\ntdll.dll MD5: 862363973dcbcc31dd161ef41a69153c C:\Windows\system32\ODBC32.dll MD5: 9586e7cb2255a8b097a7e4538202585e C:\Windows\system32\ole32.dll MD5: dc15ab7168c0309d8f04fd95b6240422 C:\Windows\System32\OLEACC.dll MD5: 7e38da8c11833b99766a97cee3f80f07 C:\Windows\system32\oleaccrc.dll MD5: b218342214d9bba0f54ea12ba2e9278c C:\Windows\system32\OLEAUT32.dll MD5: c4f3693767a2b93a64c6d67cfc2dac63 C:\Windows\system32\PRINTUI.dll MD5: c50de6d0c04b230f185a13fde0f047fa C:\Windows\system32\pwdrvio.sys MD5: cdc5704308222400ad606bcf87b006a5 C:\Windows\system32\pwdspio.sys MD5: ab530fdd34c67b497a20171d1234cfe9 C:\Windows\System32\RICHED32.DLL MD5: da61f5c012a646771587a8cb9c0ae590 C:\Windows\system32\schannel.dll MD5: 1a58069db21d05eb2ab58ee5753ebe8d C:\Windows\system32\schedsvc.dll MD5: d602fedbd9155fc2ded6863fb60c950f C:\Windows\System32\Secur32.dll MD5: 167ac31450c0c53a01fa1491e94d7678 C:\Windows\System32\shdocvw.dll MD5: 33ae914c24f546aabf281ba7b138186d C:\Windows\system32\SHELL32.dll MD5: 9176285122b7b849fec2aa1b72a8f7a8 C:\Windows\system32\SHLWAPI.dll MD5: c7230fbee14437716701c15be02c27b8 C:\Windows\System32\shsvcs.dll MD5: 096153883df79c2835936ddfcac3eae0 C:\Windows\system32\spool\DRIVERS\W32X86\3\CNMDR8Z.DLL MD5: ef76b42a984e81f354eddde711c31442 C:\Windows\system32\spool\DRIVERS\W32X86\3\CNMUI8Z.DLL MD5: 8554097e5136c3bf9f69fe578a1b35f4 C:\Windows\System32\spoolsv.exe MD5: 1bf5eebfd518dd7298434d8c862f825d C:\Windows\system32\srvsvc.dll MD5: 726eee4da62ec82c086ac48997bbe23d C:\Windows\system32\stapi32.dll MD5: b5950df243837d8217f4e597919b224a C:\Windows\system32\stobject.dll MD5: bfa034aac103d8a6f591ac9364688339 C:\Windows\system32\t2embed.dll MD5: 3d50c4b10352367d5cb20ed1f50f8da2 C:\Windows\System32\taskeng.exe MD5: 52e129522c1775dbb8cc252e7a0655c7 C:\Windows\system32\taskschd.dll MD5: caaf911d2e61ae5c1518f53bef54c698 C:\Windows\system32\urlmon.dll MD5: 80fff14f1757b9af8be9d314fc1ae88b C:\Windows\system32\USP10.dll MD5: 5e7a2cf7719161c5e6c0e47d67ad45ae C:\Windows\system32\vbscript.dll MD5: ee7e442cc7a7990f3d264a5a5694dda9 C:\Windows\system32\Vxdif.dll MD5: 2c3b09e586bda2cc49a292be7badc589 C:\Windows\system32\wbem\wmiutils.dll MD5: 5193de33f3284c447e0d31dafbf92570 c:\windows\system32\webcheck.dll MD5: dbd02e3e6f061ebbbf9b99a9d7cba30b C:\Windows\system32\WINHTTP.dll MD5: 1c191a4f0960f21b5d58c8a65baf5427 C:\Windows\system32\WININET.dll MD5: 14ff750efe13b0c21e5a06507c3a97b1 C:\Windows\System32\WINMM.dll MD5: 5ec8fb83f31aa2d6f421f02c3f4f4475 C:\Windows\System32\WINSPOOL.DRV MD5: e253e5da1249a471d913f7ea4c81faf6 C:\Windows\system32\WINTRUST.dll MD5: 4b36c7d9710c60ea7725685753bbfa5c C:\Windows\System32\WLTRAY.EXE MD5: a9662bcf218bc76869a8d91635d5f93a C:\Windows\System32\Wpc.dll MD5: 2e0b0a051ffaa86e358465bb0880d453 C:\Windows\System32\wuauclt.exe MD5: fc3ec24fce372c89423e015a2ac1a31e C:\Windows\system32\wuaueng.dll MD5: 285c594c4913fa9dc7bb6ba3ad6f101a C:\Windows\system32\wucltux.dll MD5: bdc0c99e472176c8c2c853a68adc5073 C:\Windows\System32\wups2.dll MD5: 1908cc7673f72601affdca022689cedf C:\Windows\system32\XmlLite.dll MD5: 0b3595a4ff0b36d68e5fc67fd7d70fdc C:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.6195_none_d09154e044272b9 a\MSVCP80.dll MD5: c9564cf4976e7e96b4052737aa2492b4 C:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.6195_none_d09154e044272b9 a\MSVCR80.dll MD5: 58a14c45a5cd2528f10a889e7b0c3fc2 C:\Windows\WinSxS\x86_microsoft.vc90.atl_1fc8b3b9a1e18e3b_9.0.30729.6161_none_51cd0a7abbe4e19 b\ATL90.DLL MD5: 67bdb40fbe6cecc320507161b58d134a C:\Windows\WinSxS\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4148_none_5090ab56bcba71c 2\msvcm90.dll MD5: ca6ade4f7761bb15b3325356dc3b82bb C:\Windows\WinSxS\x86_microsoft.vc90.mfc_1fc8b3b9a1e18e3b_9.0.30729.6161_none_4bf7e3e2bf9ada4 c\mfc90u.dll MD5: fbfca1a574d47ee575448b719cbbf2e4 C:\Windows\WinSxS\x86_microsoft.vc90.mfcloc_1fc8b3b9a1e18e3b_9.0.30729.6161_none_49768ef57548 175e\MFC90ENU.DLL MD5: 35acd5ea63d75e97dd0e9a1629e582b2 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.6002.18305_none_88f3a38569c2c436\COMCTL32.dll MD5: be3c082837866c4c291adaf163c10ea6 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6002.18305_none_5cb72f2a088b0ed3\COMCTL32.dll MD5: 76eaef4ddebbc7c38853f586c0e91dce C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18581_none_9e591052 ca1013d0\gdiplus.dll The following file(s) must be uploaded for server-side scanning: C:\Program Files\WRAL Desktop Alert\liveonline_3977114.exe Upload started - 1 file(s) liveonline_3977114.exe (458752) Upload speed - 42 KB/s Upload finished - 1 uploaded, 0 failed The uploaded file(s) were found clean. Scan finished - communication took 11 sec Total traffic - 0.46 MB sent, 1.35 KB recvd Scanned 869 files and modules - 97 seconds ============================================================================== Just got the like.php install box again, so I know that's still there as well. This thing is a serious pita.
Post #14
Download Combofix from either of the links below, and save it to your desktop.
Link 1
Link 2

**Note: It is important that it is saved directly to your desktop**
If you get a message saying "Illegal operation attempted on a registry key that has been marked for deletion", please restart your computer.


——————————————————————–

IMPORTANT - Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link here

——————————————————————–

Right-Click and Run as Administrator on ComboFix.exe & follow the prompts.
  • When finished, it will produce a report for you.
  • Please post the C:\ComboFix.txt for further review.
Post #15
ComboFix Log

ComboFix 12-08-07.03 - Heidi 08/07/2012 13:39:09.1.2 - x86
Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.1.1033.18.3032.1668 [GMT -4:00]
Running from: c:\users\[removed]\Desktop\ComboFix.exe
AV: Immunet Protect *Enabled/Updated* {E26D838D-778A-C93D-0B41-46E786995C11}
AV: Lavasoft Ad-Watch Live! Anti-Virus *Disabled/Updated* {9FF26384-70D4-CE6B-3ECB-E759A6A40116}
AV: Microsoft Security Essentials *Disabled/Updated* {9765EA51-0D3C-7DFB-6091-10E4E1F341F6}
SP: IObit Security 360 *Disabled/Outdated* {FAE2835A-B90A-9E7A-85DA-82DBDA7C1E3A}
SP: Lavasoft Ad-Watch Live! *Disabled/Updated* {24938260-56EE-C1E5-047B-DC2BDD234BAB}
SP: Microsoft Security Essentials *Disabled/Updated* {2C040BB5-2B06-7275-5A21-2B969A740B4B}
SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
C:\Install.exe
.
.
((((((((((((((((((((((((( Files Created from 2012-07-07 to 2012-08-07 )))))))))))))))))))))))))))))))
.
.
2012-08-07 17:53 . 2012-08-07 17:53 ——– d—–w- c:\users\Heidi\AppData\Local\temp
2012-08-07 17:27 . 2012-08-07 17:27 29904 —-a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{CFFEB027-AB59-40CA-91A3-DE629E2369EC}\MpKsl8ad6064c.sys
2012-08-07 17:25 . 2012-08-07 17:25 56200 —-a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{CFFEB027-AB59-40CA-91A3-DE629E2369EC}\offreg.dll
2012-08-07 16:57 . 2012-08-07 16:57 ——– d—–w- c:\users\Heidi\AppData\Roaming\QuickScan
2012-08-07 15:57 . 2012-06-29 08:44 6891424 —-a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{CFFEB027-AB59-40CA-91A3-DE629E2369EC}\mpengine.dll
2012-08-07 00:15 . 2012-08-07 00:15 ——– d—–w- c:\program files\ESET
2012-08-06 14:54 . 2012-06-29 08:44 6891424 —-a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
2012-08-06 14:43 . 2012-08-06 14:43 ——– d—–w- C:\_OTL
2012-08-06 14:41 . 2012-08-06 14:42 ——– d—–w- c:\program files\ERUNT
2012-08-05 05:10 . 2012-08-05 05:10 388096 —-a-r- c:\users\Heidi\AppData\Roaming\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe
2012-08-05 05:10 . 2012-08-05 05:10 ——– d—–w- c:\program files\Trend Micro
2012-07-29 16:56 . 2012-07-29 16:56 2106216 —-a-w- c:\program files\Mozilla Firefox\D3DCompiler_43.dll
2012-07-29 16:56 . 2012-07-29 16:56 18912 —-a-w- c:\program files\Mozilla Firefox\AccessibleMarshal.dll
2012-07-29 16:56 . 2012-07-29 16:56 136672 —-a-w- c:\program files\Mozilla Firefox\components\browsercomps.dll
2012-07-29 16:56 . 2012-07-29 16:56 117728 —-a-w- c:\program files\Mozilla Firefox\crashreporter.exe
2012-07-29 16:56 . 2012-07-29 16:56 913888 —-a-w- c:\program files\Mozilla Firefox\firefox.exe
2012-07-29 16:56 . 2012-07-29 16:56 258528 —-a-w- c:\program files\Mozilla Firefox\freebl3.dll
2012-07-29 16:56 . 2012-07-29 16:56 1998168 —-a-w- c:\program files\Mozilla Firefox\d3dx9_43.dll
2012-07-29 16:56 . 2012-07-29 16:56 573920 —-a-w- c:\program files\Mozilla Firefox\gkmedias.dll
2012-07-29 16:56 . 2012-07-29 16:56 82400 —-a-w- c:\program files\Mozilla Firefox\libEGL.dll
2012-07-29 16:56 . 2012-07-29 16:56 425952 —-a-w- c:\program files\Mozilla Firefox\libGLESv2.dll
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-08-03 03:44 . 2012-06-20 15:13 426184 —-a-w- c:\windows\system32\FlashPlayerApp.exe
2012-08-03 03:44 . 2011-05-13 23:00 70344 —-a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2012-07-08 17:44 . 2012-07-08 17:45 476936 —-a-w- c:\windows\system32\npdeployJava1.dll
2012-07-08 17:44 . 2010-04-29 02:02 472840 —-a-w- c:\windows\system32\deployJava1.dll
2012-07-03 17:46 . 2011-04-03 16:29 22344 —-a-w- c:\windows\system32\drivers\mbam.sys
2012-07-03 01:21 . 2012-07-03 01:22 489712 —-a-w- c:\users\Heidi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Catalina Marketing Corp\UninstallCouponActivator.exe
2012-06-20 16:54 . 2012-01-30 04:25 71104 —-a-w- c:\windows\CouponPrinter.ocx
2012-06-02 22:19 . 2012-06-22 20:40 53784 —-a-w- c:\windows\system32\wuauclt.exe
2012-06-02 22:19 . 2012-06-22 20:40 45080 —-a-w- c:\windows\system32\wups2.dll
2012-06-02 22:19 . 2012-06-22 20:40 35864 —-a-w- c:\windows\system32\wups.dll
2012-06-02 22:19 . 2012-06-22 20:40 577048 —-a-w- c:\windows\system32\wuapi.dll
2012-06-02 22:19 . 2012-06-22 20:40 1933848 —-a-w- c:\windows\system32\wuaueng.dll
2012-06-02 22:12 . 2012-06-22 20:40 2422272 —-a-w- c:\windows\system32\wucltux.dll
2012-06-02 22:12 . 2012-06-22 20:40 88576 —-a-w- c:\windows\system32\wudriver.dll
2012-06-02 19:19 . 2012-06-22 20:39 171904 —-a-w- c:\windows\system32\wuwebv.dll
2012-06-02 19:12 . 2012-06-22 20:39 33792 —-a-w- c:\windows\system32\wuapp.exe
2012-05-28 20:43 . 2011-12-09 00:39 16432 —-a-w- c:\windows\system32\lsdelete.exe
2012-05-24 14:48 . 2011-12-07 20:40 21888 —-a-w- c:\windows\system32\RegistryDefragBootTime.exe
2012-05-23 09:48 . 2012-03-25 13:42 348160 —-a-w- c:\windows\system32\msvcr71.dll
2012-05-23 09:48 . 2012-03-25 13:42 499712 —-a-w- c:\windows\system32\msvcp71.dll
2012-05-21 12:03 . 2012-05-21 12:03 399192 —-a-r- c:\users\Heidi\AppData\Roaming\Microsoft\Installer\{fc8208f2-b1c1-4253-9e89-d518e983b7bb}\NewShortcut1_FE807111CB594AE5B9A38430EB516D75.exe
2012-05-21 12:03 . 2012-05-21 12:03 128856 —-a-r- c:\users\Heidi\AppData\Roaming\Microsoft\Installer\{fc8208f2-b1c1-4253-9e89-d518e983b7bb}\UNINST_Uninstall_A_DE08FD120270402B91CB0B6B59AB5AF9.exe
2012-05-21 12:03 . 2012-05-21 12:03 399192 —-a-r- c:\users\Heidi\AppData\Roaming\Microsoft\Installer\{fc8208f2-b1c1-4253-9e89-d518e983b7bb}\NewShortcut4_2C44B39324B94969A0B2A3EFCFBC4594.exe
2012-05-21 12:03 . 2012-05-21 12:03 399192 —-a-r- c:\users\Heidi\AppData\Roaming\Microsoft\Installer\{fc8208f2-b1c1-4253-9e89-d518e983b7bb}\ARPPRODUCTICON.exe
2012-05-17 22:45 . 2012-06-13 11:22 1800192 —-a-w- c:\windows\system32\jscript9.dll
2012-05-17 22:35 . 2012-06-13 11:22 1129472 —-a-w- c:\windows\system32\wininet.dll
2012-05-17 22:35 . 2012-06-13 11:22 1427968 —-a-w- c:\windows\system32\inetcpl.cpl
2012-05-17 22:29 . 2012-06-13 11:22 142848 —-a-w- c:\windows\system32\ieUnatt.exe
2012-05-17 22:24 . 2012-06-13 11:22 2382848 —-a-w- c:\windows\system32\mshtml.tlb
2012-05-15 19:51 . 2012-06-13 10:45 2045440 —-a-w- c:\windows\system32\win32k.sys
2012-07-29 16:56 . 2012-07-29 16:56 136672 —-a-w- c:\program files\mozilla firefox\components\browsercomps.dll
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{6c97a91e-4524-4019-86af-2aa2d567bf5c}]
2012-04-11 20:08 87440 —-a-w- c:\program files\adawaretb\adawareDx.dll
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{95B7759C-8C7F-4BF1-B163-73684A933233}]
2012-07-08 18:31 2074208 —-a-w- c:\program files\AVG Secure Search\11.1.0.12\AVG Secure Search_toolbar.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{6c97a91e-4524-4019-86af-2aa2d567bf5c}"= "c:\program files\adawaretb\adawareDx.dll" [2012-04-11 87440]
"{95B7759C-8C7F-4BF1-B163-73684A933233}"= "c:\program files\AVG Secure Search\11.1.0.12\AVG Secure Search_toolbar.dll" [2012-07-08 2074208]
.
[HKEY_CLASSES_ROOT\clsid\{6c97a91e-4524-4019-86af-2aa2d567bf5c}]
.
[HKEY_CLASSES_ROOT\clsid\{95b7759c-8c7f-4bf1-b163-73684a933233}]
[HKEY_CLASSES_ROOT\AVG Secure Search.PugiObj.1]
[HKEY_CLASSES_ROOT\AVG Secure Search.PugiObj]
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-03-11 39408]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Apoint"="c:\program files\DellTPad\Apoint.exe" [2008-09-04 200704]
"Broadcom Wireless Manager UI"="c:\windows\system32\WLTRAY.exe" [2008-11-17 3810304]
"IAAnotif"="c:\program files\Intel\Intel Matrix Storage Manager\iaanotif.exe" [2008-05-07 178712]
"PDVDDXSrv"="c:\program files\CyberLink\PowerDVD DX\PDVDDXSrv.exe" [2008-05-23 128296]
"ArcSoft Connection Service"="c:\program files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe" [2010-10-28 207424]
"CarboniteSetupLite"="c:\program files\Carbonite\CarbonitePreinstaller.exe" [2010-03-09 283792]
"CanonMyPrinter"="c:\program files\Canon\MyPrinter\BJMyPrt.exe" [2009-07-27 1983816]
"CanonSolutionMenu"="c:\program files\Canon\SolutionMenu\CNSLMAIN.exe" [2009-03-18 767312]
"SysTrayApp"="c:\program files\IDT\WDM\sttray.exe" [2010-02-26 495708]
"Immunet Protect"="c:\program files\Immunet Protect\2.0.17\iptray.exe" [2011-03-20 2615624]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2009-01-16 141848]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2009-01-16 173592]
"Persistence"="c:\windows\system32\igfxpers.exe" [2009-01-16 150552]
"APSDaemon"="c:\program files\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2012-05-31 59280]
"LogitechQuickCamRibbon"="c:\program files\Logitech\Logitech WebCam Software\LWS.exe" [2009-10-14 2793304]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2011-10-24 421888]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-01-03 843712]
"MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2012-03-26 931200]
"Malwarebytes' Anti-Malware"="c:\program files\Malwarebytes' Anti-Malware\mbamgui.exe" [2012-07-03 462920]
"TkBellExe"="c:\program files\real\realplayer\Update\realsched.exe" [2012-05-23 296056]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2012-01-18 254696]
"vProt"="c:\program files\AVG Secure Search\vprot.exe" [2012-07-08 1107552]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2012-06-07 421776]
"HF_G_Jul"="c:\program files\AVG Secure Search\HF_G_Jul.exe" [2012-07-19 36960]
.
c:\users\Peter\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Dell Dock.lnk - c:\program files\Dell\DellDock\DellDock.exe [2008-9-24 1295656]
.
c:\users\Heidi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Dell Dock.lnk - c:\program files\Dell\DellDock\DellDock.exe [2008-9-24 1295656]
ERUNT AutoBackup.lnk - c:\program files\ERUNT\AUTOBACK.EXE [2005-10-20 38912]
WRAL Desktop Alert.lnk - c:\program files\WRAL Desktop Alert\liveonline_3977114.exe [2012-1-15 458752]
.
c:\users\RA Media Server\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Dell Dock First Run.lnk - c:\program files\Dell\DellDock\DellDock.exe [2008-9-24 1295656]
.
c:\users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Dell Dock First Run.lnk - c:\program files\Dell\DellDock\DellDock.exe [2008-9-24 1295656]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\GoToAssist]
2009-02-10 00:13 10536 —-a-w- c:\program files\Citrix\GoToAssist\514\g2awinlogon.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Ad-Aware Service]
@="Ad-Aware Service"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]
@="Service"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@="Service"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\SBAMSvc]
@="Service"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdauxservice]
@=""
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdcoreservice]
@=""
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IObit Security 360]
2010-06-11 22:14 1280344 —-a-w- c:\program files\IObit\IObit Security 360\is360tray.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"medicsp2"=c:\program files\twc\medicsp2\bin\sprtcmd.exe /P medicsp2
.
R2 Ad-Aware Service;Ad-Aware Service;c:\program files\Ad-Aware Antivirus\AdAwareService.exe [x]
R3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [x]
S2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files\Common Files\Adobe\ARM\1.0\armsvc.exe [x]
S2 AESTFilters;Andrea ST Filters Service;c:\windows\System32\DriverStore\FileRepository\stwrt.inf_0145da1d\aestsrv.exe [x]
.
.
— Other Services/Drivers In Memory —
.
*NewlyCreated* - MPKSL256F8B07
*NewlyCreated* - MPKSL8AD6064C
*Deregistered* - Lavasoft Kernexplorer
*Deregistered* - MpKsl256f8b07
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache
bdx REG_MULTI_SZ scan sysagent
.
Contents of the 'Scheduled Tasks' folder
.
2012-08-07 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-06-20 03:44]
.
2012-08-07 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-03-11 11:13]
.
2012-08-07 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-03-11 11:13]
.
2010-12-16 c:\windows\Tasks\User_Feed_Synchronization-{06737FB5-171D-4CED-A275-E493946FBD47}.job
- c:\windows\system32\msfeedssync.exe [2011-04-30 14:46]
.
2012-08-07 c:\windows\Tasks\User_Feed_Synchronization-{1E2F2322-1323-4A6F-8005-2C5E37204C45}.job
- c:\windows\system32\msfeedssync.exe [2011-04-30 14:46]
.
2010-01-30 c:\windows\Tasks\User_Feed_Synchronization-{FAAB1E1A-DAFA-4265-B908-E65285CA022E}.job
- c:\windows\system32\msfeedssync.exe [2011-04-30 14:46]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://isearch.avg.com/?cid={046AF6B5-EFF2-46EC-8D08-A63E6A10BD1A}&mid=33ab3240ff3947d0ba9fd16ae8ffb8fa-4289a686838bd6413384c254402c6bb887492930&lang=en&ds=ft011&pr=sa&d=2012-07-08 14:31&v=11.1.0.12&sap=hp
uDefault_Search_URL = hxxp://www.google.com/ie
uInternet Settings,ProxyOverride = *.local
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
TCP: DhcpNameServer = 192.168.2.1 192.168.2.1
Handler: viprotocol - {B658800C-F66E-4EF3-AB85-6C0C227862A9} - c:\program files\Common Files\AVG Secure Search\ViProtocolInstaller\11.2.0\ViProtocol.dll
FF - ProfilePath - c:\users\Heidi\AppData\Roaming\Mozilla\Firefox\Profiles\60wjxva2.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://google.com/
FF - user.js: browser.cache.memory.capacity - 65536
FF - user.js: browser.chrome.favicons - false
FF - user.js: browser.display.show_image_placeholders - true
FF - user.js: browser.turbo.enabled - true
FF - user.js: browser.urlbar.autocomplete.enabled - true
FF - user.js: browser.urlbar.autofill - true
FF - user.js: content.interrupt.parsing - true
FF - user.js: content.max.tokenizing.time - 2250000
FF - user.js: content.notify.backoffcount - 5
FF - user.js: content.notify.interval - 750000
FF - user.js: content.notify.ontimer - true
FF - user.js: content.switch.threshold - 750000
FF - user.js: network.http.max-connections - 48
FF - user.js: network.http.max-connections-per-server - 16
FF - user.js: network.http.max-persistent-connections-per-proxy - 16
FF - user.js: network.http.max-persistent-connections-per-server - 8
FF - user.js: network.http.pipelining - true
FF - user.js: network.http.pipelining.firstrequest - true
FF - user.js: network.http.pipelining.maxrequests - 8
FF - user.js: network.http.proxy.pipelining - true
FF - user.js: network.http.request.max-start-delay - 0
FF - user.js: nglayout.initialpaint.delay - 0
FF - user.js: plugin.expose_full_path - true
FF - user.js: ui.submenuDelay - 0
FF - user.js: extensions.autoDisableScopes - 14
FF - user.js: extensions.BabylonToolbar_i.babTrack - affID=113959&tt=3012_5
FF - user.js: extensions.BabylonToolbar_i.babExt -
FF - user.js: extensions.BabylonToolbar_i.srcExt - ss
FF - user.js: extensions.BabylonToolbar.tlbrSrchUrl - hxxp://www.google.com/search?babsrc=TB_ggl&q=
FF - user.js: extensions.BabylonToolbar.id - 3126b93000000000000000225f6cc78f
FF - user.js: extensions.BabylonToolbar.instlDay - 15550
FF - user.js: extensions.BabylonToolbar.vrsn - [removed]
FF - user.js: extensions.BabylonToolbar.vrsni - [removed]
FF - user.js: extensions.BabylonToolbar_i.vrsnTs - [removed]:56
FF - user.js: extensions.BabylonToolbar.prtnrId - babylon
FF - user.js: extensions.BabylonToolbar.prdct - BabylonToolbar
FF - user.js: extensions.BabylonToolbar.aflt - babsst
FF - user.js: extensions.BabylonToolbar_i.smplGrp - none
FF - user.js: extensions.BabylonToolbar.tlbrId - base
FF - user.js: extensions.BabylonToolbar.instlRef - sst
FF - user.js: extensions.BabylonToolbar.dfltLng - en
FF - user.js: extensions.BabylonToolbar.excTlbr - false
FF - user.js: extensions.BabylonToolbar.admin - false
.
- - - - ORPHANS REMOVED - - - -
.
WebBrowser-{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39} - (no file)
SafeBoot-Wdf01000.sys
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2012-08-07 13:53
Windows 6.0.6002 Service Pack 2 NTFS
.
scanning hidden processes …
.
scanning hidden autostart entries …
.
scanning hidden files …
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
——————— LOCKED REGISTRY KEYS ———————
.
[HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\Approved Extensions]
@Denied: (2) (LocalSystem)
"{759D9886-0C6F-4498-BAB6-4A5F47C6C72F}"=hex:51,66,7a,6c,4c,1d,38,12,e8,9b,8e,
71,5d,42,f6,01,c5,a0,09,1f,42,98,83,3b
"{0BDA0769-FD72-49F4-9266-E1FB004F4D8F}"=hex:51,66,7a,6c,4c,1d,38,12,07,04,c9,
0f,40,b3,9a,0c,ed,70,a2,bb,05,11,09,9b
"{2318C2B1-4965-11D4-9B18-009027A5CD4F}"=hex:51,66,7a,6c,4c,1d,38,12,df,c1,0b,
27,57,07,ba,54,e4,0e,43,d0,22,fb,89,5b
"{18DF081C-E8AD-4283-A596-FA578C2EBDC3}"=hex:51,66,7a,6c,4c,1d,38,12,72,0b,cc,
1c,9f,a6,ed,07,da,80,b9,17,89,70,f9,d7
"{3049C3E9-B461-4BC5-8870-4C09146192CA}"=hex:51,66,7a,6c,4c,1d,38,12,87,c0,5a,
34,53,fa,ab,0e,f7,66,0f,49,11,3f,d6,de
"{3785D0AD-BFFF-47F6-BF5B-A587C162FED9}"=hex:51,66,7a,6c,4c,1d,38,12,c3,d3,96,
33,cd,f1,98,02,c0,4d,e6,c7,c4,3c,ba,cd
"{53707962-6F74-2D53-2644-206D7942484F}"=hex:51,66,7a,6c,4c,1d,38,12,0c,7a,63,
57,46,21,3d,68,59,52,63,2d,7c,1c,0c,5b
"{6EBF7485-159F-4BFF-A14F-B9E3AAC4465B}"=hex:51,66,7a,6c,4c,1d,38,12,eb,77,ac,
6a,ad,5b,91,0e,de,59,fa,a3,af,9a,02,4f
"{9030D464-4C02-4ABF-8ECC-5164760863C6}"=hex:51,66,7a,6c,4c,1d,38,12,0a,d7,23,
94,30,02,d1,0f,f1,da,12,24,73,56,27,d2
"{9FDDE16B-836F-4806-AB1F-1455CBEFF289}"=hex:51,66,7a,6c,4c,1d,38,12,05,e2,ce,
9b,5d,cd,68,0d,d4,09,57,15,ce,b1,b6,9d
"{AA58ED58-01DD-4D91-8333-CF10577473F7}"=hex:51,66,7a,6c,4c,1d,38,12,36,ee,4b,
ae,ef,4f,ff,08,fc,25,8c,50,52,2a,37,e3
"{DBC80044-A445-435B-BC74-9C25C1C588A9}"=hex:51,66,7a,6c,4c,1d,38,12,2a,03,db,
df,77,ea,35,06,c3,62,df,65,c4,9b,cc,bd
"{21347690-EC41-4F9A-8887-1F4AEE672439}"=hex:51,66,7a,6c,4c,1d,38,12,fe,75,27,
25,73,a2,f4,0a,f7,91,5c,0a,eb,39,60,2d
"{32004B8A-44A9-43E7-84E9-808838809519}"=hex:51,66,7a,6c,4c,1d,38,12,e4,48,13,
36,9b,0a,89,06,fb,ff,c3,c8,3d,de,d1,0d
.
[HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration]
@Denied: (2) (LocalSystem)
"Timestamp"=hex:f0,08,3d,9a,ba,24,cc,01
.
[HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\User Preferences]
@Denied: (2) (LocalSystem)
"88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,12,c8,07,6b,8b,c3,77,49,91,39,12,\
"2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,12,c8,07,6b,8b,c3,77,49,91,39,12,\
.
——————— DLLs Loaded Under Running Processes ———————
.
- - - - - - - > 'lsass.exe'(648)
c:\windows\System32\BCMLogon.dll
.
Completion time: 2012-08-07 13:58:53
ComboFix-quarantined-files.txt 2012-08-07 17:58
.
Pre-Run: 40,529,620,992 bytes free
Post-Run: 40,465,674,240 bytes free
.
- - End Of File - - A381E36D8255C5A4D74864D6F8CA8E05

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI