What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Babylon [Solved]

32 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #16
  • Please open Notepad (Start -> Run -> type notepad in the Open field -> OK) and copy and paste the text present inside the code box below:
    ClearJavaCache::

Firefox::
FF - ProfilePath - c:\users\Heidi\AppData\Roaming\Mozilla\Firefox\Profiles\60wjxva2.default\
FF - user.js: extensions.BabylonToolbar_i.babTrack - affID=113959&tt=3012_5
FF - user.js: extensions.BabylonToolbar_i.babExt - 
FF - user.js: extensions.BabylonToolbar_i.srcExt - ss
FF - user.js: extensions.BabylonToolbar.tlbrSrchUrl - hxxp://www.google.com/search?babsrc=TB_ggl&q=
FF - user.js: extensions.BabylonToolbar.id - 3126b93000000000000000225f6cc78f
FF - user.js: extensions.BabylonToolbar.instlDay - 15550
FF - user.js: extensions.BabylonToolbar.vrsn - [removed]
FF - user.js: extensions.BabylonToolbar.vrsni - [removed]
FF - user.js: extensions.BabylonToolbar_i.vrsnTs - [removed]:56
FF - user.js: extensions.BabylonToolbar.prtnrId - babylon
FF - user.js: extensions.BabylonToolbar.prdct - BabylonToolbar
FF - user.js: extensions.BabylonToolbar.aflt - babsst
FF - user.js: extensions.BabylonToolbar_i.smplGrp - none
FF - user.js: extensions.BabylonToolbar.tlbrId - base
FF - user.js: extensions.BabylonToolbar.instlRef - sst
FF - user.js: extensions.BabylonToolbar.dfltLng - en
FF - user.js: extensions.BabylonToolbar.excTlbr - false
FF - user.js: extensions.BabylonToolbar.admin - false
  • Save this as CFScript.txt and change the "Save as type" to "All Files" and place it on your desktop.

    [external image: Posted Image]
  • Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before following the steps below. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
  • Referring to the screenshot above, drag CFScript.txt into ComboFix.exe.
  • ComboFix will now run a scan on your system. It may reboot your system when it finishes. This is normal.
  • When finished, it shall produce a log for you. Copy and paste the contents of the log in your next reply.
CAUTION: Do not mouse-click ComboFix's window while it is running. That may cause it to stall.
———-
Post #17
ComboFix Log Part Deaux

ComboFix 12-08-08.01 - Heidi 08/08/2012 17:00:30.2.2 - x86
Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.1.1033.18.3032.1565 [GMT -4:00]
Running from: c:\users\[removed]\Desktop\ComboFix.exe
Command switches used :: c:\users\Heidi\Desktop\CFScript.txt
AV: Immunet Protect *Enabled/Updated* {E26D838D-778A-C93D-0B41-46E786995C11}
AV: Lavasoft Ad-Watch Live! Anti-Virus *Disabled/Updated* {9FF26384-70D4-CE6B-3ECB-E759A6A40116}
AV: Microsoft Security Essentials *Disabled/Updated* {9765EA51-0D3C-7DFB-6091-10E4E1F341F6}
SP: IObit Security 360 *Disabled/Outdated* {FAE2835A-B90A-9E7A-85DA-82DBDA7C1E3A}
SP: Lavasoft Ad-Watch Live! *Disabled/Updated* {24938260-56EE-C1E5-047B-DC2BDD234BAB}
SP: Microsoft Security Essentials *Disabled/Updated* {2C040BB5-2B06-7275-5A21-2B969A740B4B}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
* Created a new restore point
.
.
((((((((((((((((((((((((( Files Created from 2012-07-08 to 2012-08-08 )))))))))))))))))))))))))))))))
.
.
2012-08-08 21:13 . 2012-08-08 21:14 ——– d—–w- c:\users\Heidi\AppData\Local\temp
2012-08-08 21:13 . 2012-08-08 21:13 ——– d—–w- c:\users\RA Media Server\AppData\Local\temp
2012-08-08 21:13 . 2012-08-08 21:13 ——– d—–w- c:\users\Peter\AppData\Local\temp
2012-08-08 21:13 . 2012-08-08 21:13 ——– d—–w- c:\users\Default\AppData\Local\temp
2012-08-08 20:05 . 2012-06-29 08:44 6891424 —-a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{E6ACE116-2802-4297-B50D-40BCF524C3E5}\mpengine.dll
2012-08-07 18:12 . 2012-07-16 06:41 6891424 —-a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{0D56C05F-3AB5-4386-B11E-227EC9926470}\mpengine.dll
2012-08-07 16:57 . 2012-08-07 16:57 ——– d—–w- c:\users\Heidi\AppData\Roaming\QuickScan
2012-08-07 15:57 . 2012-06-29 08:44 6891424 —-a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
2012-08-07 00:15 . 2012-08-07 00:15 ——– d—–w- c:\program files\ESET
2012-08-06 14:43 . 2012-08-06 14:43 ——– d—–w- C:\_OTL
2012-08-06 14:41 . 2012-08-06 14:42 ——– d—–w- c:\program files\ERUNT
2012-08-05 05:10 . 2012-08-05 05:10 388096 —-a-r- c:\users\Heidi\AppData\Roaming\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe
2012-08-05 05:10 . 2012-08-05 05:10 ——– d—–w- c:\program files\Trend Micro
2012-07-29 16:56 . 2012-07-29 16:56 2106216 —-a-w- c:\program files\Mozilla Firefox\D3DCompiler_43.dll
2012-07-29 16:56 . 2012-07-29 16:56 18912 —-a-w- c:\program files\Mozilla Firefox\AccessibleMarshal.dll
2012-07-29 16:56 . 2012-07-29 16:56 136672 —-a-w- c:\program files\Mozilla Firefox\components\browsercomps.dll
2012-07-29 16:56 . 2012-07-29 16:56 117728 —-a-w- c:\program files\Mozilla Firefox\crashreporter.exe
2012-07-29 16:56 . 2012-07-29 16:56 913888 —-a-w- c:\program files\Mozilla Firefox\firefox.exe
2012-07-29 16:56 . 2012-07-29 16:56 258528 —-a-w- c:\program files\Mozilla Firefox\freebl3.dll
2012-07-29 16:56 . 2012-07-29 16:56 1998168 —-a-w- c:\program files\Mozilla Firefox\d3dx9_43.dll
2012-07-29 16:56 . 2012-07-29 16:56 573920 —-a-w- c:\program files\Mozilla Firefox\gkmedias.dll
2012-07-29 16:56 . 2012-07-29 16:56 82400 —-a-w- c:\program files\Mozilla Firefox\libEGL.dll
2012-07-29 16:56 . 2012-07-29 16:56 425952 —-a-w- c:\program files\Mozilla Firefox\libGLESv2.dll
2012-07-29 16:56 . 2012-07-29 16:56 113120 —-a-w- c:\program files\Mozilla Firefox\maintenanceservice.exe
2012-07-29 16:56 . 2012-07-29 16:56 304 —-a-w- C:\user.js
2012-07-29 16:54 . 2012-07-29 16:54 ——– d—–w- c:\users\Heidi\AppData\Roaming\DefaultTab
2012-07-29 16:50 . 2012-07-29 19:40 ——– d—–w- c:\programdata\Tarma Installer
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-08-03 03:44 . 2012-06-20 15:13 426184 —-a-w- c:\windows\system32\FlashPlayerApp.exe
2012-08-03 03:44 . 2011-05-13 23:00 70344 —-a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2012-07-08 17:44 . 2012-07-08 17:45 476936 —-a-w- c:\windows\system32\npdeployJava1.dll
2012-07-08 17:44 . 2010-04-29 02:02 472840 —-a-w- c:\windows\system32\deployJava1.dll
2012-07-03 17:46 . 2011-04-03 16:29 22344 —-a-w- c:\windows\system32\drivers\mbam.sys
2012-07-03 01:21 . 2012-07-03 01:22 489712 —-a-w- c:\users\Heidi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Catalina Marketing Corp\UninstallCouponActivator.exe
2012-06-20 16:54 . 2012-01-30 04:25 71104 —-a-w- c:\windows\CouponPrinter.ocx
2012-06-02 22:19 . 2012-06-22 20:40 53784 —-a-w- c:\windows\system32\wuauclt.exe
2012-06-02 22:19 . 2012-06-22 20:40 45080 —-a-w- c:\windows\system32\wups2.dll
2012-06-02 22:19 . 2012-06-22 20:40 35864 —-a-w- c:\windows\system32\wups.dll
2012-06-02 22:19 . 2012-06-22 20:40 577048 —-a-w- c:\windows\system32\wuapi.dll
2012-06-02 22:19 . 2012-06-22 20:40 1933848 —-a-w- c:\windows\system32\wuaueng.dll
2012-06-02 22:12 . 2012-06-22 20:40 2422272 —-a-w- c:\windows\system32\wucltux.dll
2012-06-02 22:12 . 2012-06-22 20:40 88576 —-a-w- c:\windows\system32\wudriver.dll
2012-06-02 19:19 . 2012-06-22 20:39 171904 —-a-w- c:\windows\system32\wuwebv.dll
2012-06-02 19:12 . 2012-06-22 20:39 33792 —-a-w- c:\windows\system32\wuapp.exe
2012-05-31 16:25 . 2009-10-03 06:12 237072 ——w- c:\windows\system32\MpSigStub.exe
2012-05-28 20:43 . 2011-12-09 00:39 16432 —-a-w- c:\windows\system32\lsdelete.exe
2012-05-24 14:48 . 2011-12-07 20:40 21888 —-a-w- c:\windows\system32\RegistryDefragBootTime.exe
2012-05-23 09:48 . 2012-03-25 13:42 348160 —-a-w- c:\windows\system32\msvcr71.dll
2012-05-23 09:48 . 2012-03-25 13:42 499712 —-a-w- c:\windows\system32\msvcp71.dll
2012-05-21 12:03 . 2012-05-21 12:03 399192 —-a-r- c:\users\Heidi\AppData\Roaming\Microsoft\Installer\{fc8208f2-b1c1-4253-9e89-d518e983b7bb}\NewShortcut1_FE807111CB594AE5B9A38430EB516D75.exe
2012-05-21 12:03 . 2012-05-21 12:03 128856 —-a-r- c:\users\Heidi\AppData\Roaming\Microsoft\Installer\{fc8208f2-b1c1-4253-9e89-d518e983b7bb}\UNINST_Uninstall_A_DE08FD120270402B91CB0B6B59AB5AF9.exe
2012-05-21 12:03 . 2012-05-21 12:03 399192 —-a-r- c:\users\Heidi\AppData\Roaming\Microsoft\Installer\{fc8208f2-b1c1-4253-9e89-d518e983b7bb}\NewShortcut4_2C44B39324B94969A0B2A3EFCFBC4594.exe
2012-05-21 12:03 . 2012-05-21 12:03 399192 —-a-r- c:\users\Heidi\AppData\Roaming\Microsoft\Installer\{fc8208f2-b1c1-4253-9e89-d518e983b7bb}\ARPPRODUCTICON.exe
2012-05-17 22:45 . 2012-06-13 11:22 1800192 —-a-w- c:\windows\system32\jscript9.dll
2012-05-17 22:35 . 2012-06-13 11:22 1129472 —-a-w- c:\windows\system32\wininet.dll
2012-05-17 22:35 . 2012-06-13 11:22 1427968 —-a-w- c:\windows\system32\inetcpl.cpl
2012-05-17 22:29 . 2012-06-13 11:22 142848 —-a-w- c:\windows\system32\ieUnatt.exe
2012-05-17 22:24 . 2012-06-13 11:22 2382848 —-a-w- c:\windows\system32\mshtml.tlb
2012-05-15 19:51 . 2012-06-13 10:45 2045440 —-a-w- c:\windows\system32\win32k.sys
2012-07-29 16:56 . 2012-07-29 16:56 136672 —-a-w- c:\program files\mozilla firefox\components\browsercomps.dll
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{6c97a91e-4524-4019-86af-2aa2d567bf5c}]
2012-04-11 20:08 87440 —-a-w- c:\program files\adawaretb\adawareDx.dll
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{95B7759C-8C7F-4BF1-B163-73684A933233}]
2012-07-08 18:31 2074208 —-a-w- c:\program files\AVG Secure Search\11.1.0.12\AVG Secure Search_toolbar.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{6c97a91e-4524-4019-86af-2aa2d567bf5c}"= "c:\program files\adawaretb\adawareDx.dll" [2012-04-11 87440]
"{95B7759C-8C7F-4BF1-B163-73684A933233}"= "c:\program files\AVG Secure Search\11.1.0.12\AVG Secure Search_toolbar.dll" [2012-07-08 2074208]
.
[HKEY_CLASSES_ROOT\clsid\{6c97a91e-4524-4019-86af-2aa2d567bf5c}]
.
[HKEY_CLASSES_ROOT\clsid\{95b7759c-8c7f-4bf1-b163-73684a933233}]
[HKEY_CLASSES_ROOT\AVG Secure Search.PugiObj.1]
[HKEY_CLASSES_ROOT\AVG Secure Search.PugiObj]
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-03-11 39408]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Apoint"="c:\program files\DellTPad\Apoint.exe" [2008-09-04 200704]
"Broadcom Wireless Manager UI"="c:\windows\system32\WLTRAY.exe" [2008-11-17 3810304]
"IAAnotif"="c:\program files\Intel\Intel Matrix Storage Manager\iaanotif.exe" [2008-05-07 178712]
"PDVDDXSrv"="c:\program files\CyberLink\PowerDVD DX\PDVDDXSrv.exe" [2008-05-23 128296]
"ArcSoft Connection Service"="c:\program files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe" [2010-10-28 207424]
"CarboniteSetupLite"="c:\program files\Carbonite\CarbonitePreinstaller.exe" [2010-03-09 283792]
"CanonMyPrinter"="c:\program files\Canon\MyPrinter\BJMyPrt.exe" [2009-07-27 1983816]
"CanonSolutionMenu"="c:\program files\Canon\SolutionMenu\CNSLMAIN.exe" [2009-03-18 767312]
"SysTrayApp"="c:\program files\IDT\WDM\sttray.exe" [2010-02-26 495708]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2009-01-16 141848]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2009-01-16 173592]
"Persistence"="c:\windows\system32\igfxpers.exe" [2009-01-16 150552]
"APSDaemon"="c:\program files\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2012-05-31 59280]
"LogitechQuickCamRibbon"="c:\program files\Logitech\Logitech WebCam Software\LWS.exe" [2009-10-14 2793304]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2011-10-24 421888]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-01-03 843712]
"MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2012-03-26 931200]
"Malwarebytes' Anti-Malware"="c:\program files\Malwarebytes' Anti-Malware\mbamgui.exe" [2012-07-03 462920]
"TkBellExe"="c:\program files\real\realplayer\Update\realsched.exe" [2012-05-23 296056]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2012-01-18 254696]
"vProt"="c:\program files\AVG Secure Search\vprot.exe" [2012-07-08 1107552]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2012-06-07 421776]
"HF_G_Jul"="c:\program files\AVG Secure Search\HF_G_Jul.exe" [2012-07-19 36960]
.
c:\users\Peter\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Dell Dock.lnk - c:\program files\Dell\DellDock\DellDock.exe [2008-9-24 1295656]
.
c:\users\Heidi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Dell Dock.lnk - c:\program files\Dell\DellDock\DellDock.exe [2008-9-24 1295656]
ERUNT AutoBackup.lnk - c:\program files\ERUNT\AUTOBACK.EXE [2005-10-20 38912]
WRAL Desktop Alert.lnk - c:\program files\WRAL Desktop Alert\liveonline_3977114.exe [2012-1-15 458752]
.
c:\users\RA Media Server\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Dell Dock First Run.lnk - c:\program files\Dell\DellDock\DellDock.exe [2008-9-24 1295656]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Kodak EasyShare software.lnk - c:\program files\Kodak\Kodak EasyShare software\bin\EasyShare.exe [2011-2-23 323584]
Secunia PSI Tray.lnk - c:\program files\Secunia\PSI\psi_tray.exe [2011-1-10 291896]
.
c:\users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Dell Dock First Run.lnk - c:\program files\Dell\DellDock\DellDock.exe [2008-9-24 1295656]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\GoToAssist]
2009-02-10 00:13 10536 —-a-w- c:\program files\Citrix\GoToAssist\514\g2awinlogon.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Ad-Aware Service]
@="Ad-Aware Service"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]
@="Service"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@="Service"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\SBAMSvc]
@="Service"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdauxservice]
@=""
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdcoreservice]
@=""
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IObit Security 360]
2010-06-11 22:14 1280344 —-a-w- c:\program files\IObit\IObit Security 360\is360tray.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"medicsp2"=c:\program files\twc\medicsp2\bin\sprtcmd.exe /P medicsp2
.
R2 Ad-Aware Service;Ad-Aware Service;c:\program files\Ad-Aware Antivirus\AdAwareService.exe [x]
R3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [x]
S2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files\Common Files\Adobe\ARM\1.0\armsvc.exe [x]
S2 AESTFilters;Andrea ST Filters Service;c:\windows\System32\DriverStore\FileRepository\stwrt.inf_0145da1d\aestsrv.exe [x]
.
.
— Other Services/Drivers In Memory —
.
*NewlyCreated* - MPKSL256F8B07
*Deregistered* - Lavasoft Kernexplorer
*Deregistered* - MpKsl256f8b07
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache
bdx REG_MULTI_SZ scan sysagent
.
Contents of the 'Scheduled Tasks' folder
.
2012-08-08 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-06-20 03:44]
.
2012-08-07 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-03-11 11:13]
.
2012-08-08 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-03-11 11:13]
.
2010-12-16 c:\windows\Tasks\User_Feed_Synchronization-{06737FB5-171D-4CED-A275-E493946FBD47}.job
- c:\windows\system32\msfeedssync.exe [2011-04-30 14:46]
.
2012-08-08 c:\windows\Tasks\User_Feed_Synchronization-{1E2F2322-1323-4A6F-8005-2C5E37204C45}.job
- c:\windows\system32\msfeedssync.exe [2011-04-30 14:46]
.
2010-01-30 c:\windows\Tasks\User_Feed_Synchronization-{FAAB1E1A-DAFA-4265-B908-E65285CA022E}.job
- c:\windows\system32\msfeedssync.exe [2011-04-30 14:46]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://isearch.avg.com/?cid={046AF6B5-EFF2-46EC-8D08-A63E6A10BD1A}&mid=33ab3240ff3947d0ba9fd16ae8ffb8fa-4289a686838bd6413384c254402c6bb887492930&lang=en&ds=ft011&pr=sa&d=2012-07-08 14:31&v=11.1.0.12&sap=hp
uDefault_Search_URL = hxxp://www.google.com/ie
uInternet Settings,ProxyOverride = *.local
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
TCP: DhcpNameServer = 192.168.2.1 192.168.2.1
Handler: viprotocol - {B658800C-F66E-4EF3-AB85-6C0C227862A9} - c:\program files\Common Files\AVG Secure Search\ViProtocolInstaller\11.2.0\ViProtocol.dll
FF - ProfilePath - c:\users\Heidi\AppData\Roaming\Mozilla\Firefox\Profiles\60wjxva2.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://google.com/
FF - user.js: browser.cache.memory.capacity - 65536
FF - user.js: browser.chrome.favicons - false
FF - user.js: browser.display.show_image_placeholders - true
FF - user.js: browser.turbo.enabled - true
FF - user.js: browser.urlbar.autocomplete.enabled - true
FF - user.js: browser.urlbar.autofill - true
FF - user.js: content.interrupt.parsing - true
FF - user.js: content.max.tokenizing.time - 2250000
FF - user.js: content.notify.backoffcount - 5
FF - user.js: content.notify.interval - 750000
FF - user.js: content.notify.ontimer - true
FF - user.js: content.switch.threshold - 750000
FF - user.js: network.http.max-connections - 48
FF - user.js: network.http.max-connections-per-server - 16
FF - user.js: network.http.max-persistent-connections-per-proxy - 16
FF - user.js: network.http.max-persistent-connections-per-server - 8
FF - user.js: network.http.pipelining - true
FF - user.js: network.http.pipelining.firstrequest - true
FF - user.js: network.http.pipelining.maxrequests - 8
FF - user.js: network.http.proxy.pipelining - true
FF - user.js: network.http.request.max-start-delay - 0
FF - user.js: nglayout.initialpaint.delay - 0
FF - user.js: plugin.expose_full_path - true
FF - user.js: ui.submenuDelay - 0
FF - user.js: extensions.autoDisableScopes - 14
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2012-08-08 17:14
Windows 6.0.6002 Service Pack 2 NTFS
.
scanning hidden processes …
.
scanning hidden autostart entries …
.
scanning hidden files …
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
——————— LOCKED REGISTRY KEYS ———————
.
[HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\Approved Extensions]
@Denied: (2) (LocalSystem)
"{759D9886-0C6F-4498-BAB6-4A5F47C6C72F}"=hex:51,66,7a,6c,4c,1d,38,12,e8,9b,8e,
71,5d,42,f6,01,c5,a0,09,1f,42,98,83,3b
"{0BDA0769-FD72-49F4-9266-E1FB004F4D8F}"=hex:51,66,7a,6c,4c,1d,38,12,07,04,c9,
0f,40,b3,9a,0c,ed,70,a2,bb,05,11,09,9b
"{2318C2B1-4965-11D4-9B18-009027A5CD4F}"=hex:51,66,7a,6c,4c,1d,38,12,df,c1,0b,
27,57,07,ba,54,e4,0e,43,d0,22,fb,89,5b
"{18DF081C-E8AD-4283-A596-FA578C2EBDC3}"=hex:51,66,7a,6c,4c,1d,38,12,72,0b,cc,
1c,9f,a6,ed,07,da,80,b9,17,89,70,f9,d7
"{3049C3E9-B461-4BC5-8870-4C09146192CA}"=hex:51,66,7a,6c,4c,1d,38,12,87,c0,5a,
34,53,fa,ab,0e,f7,66,0f,49,11,3f,d6,de
"{3785D0AD-BFFF-47F6-BF5B-A587C162FED9}"=hex:51,66,7a,6c,4c,1d,38,12,c3,d3,96,
33,cd,f1,98,02,c0,4d,e6,c7,c4,3c,ba,cd
"{53707962-6F74-2D53-2644-206D7942484F}"=hex:51,66,7a,6c,4c,1d,38,12,0c,7a,63,
57,46,21,3d,68,59,52,63,2d,7c,1c,0c,5b
"{6EBF7485-159F-4BFF-A14F-B9E3AAC4465B}"=hex:51,66,7a,6c,4c,1d,38,12,eb,77,ac,
6a,ad,5b,91,0e,de,59,fa,a3,af,9a,02,4f
"{9030D464-4C02-4ABF-8ECC-5164760863C6}"=hex:51,66,7a,6c,4c,1d,38,12,0a,d7,23,
94,30,02,d1,0f,f1,da,12,24,73,56,27,d2
"{9FDDE16B-836F-4806-AB1F-1455CBEFF289}"=hex:51,66,7a,6c,4c,1d,38,12,05,e2,ce,
9b,5d,cd,68,0d,d4,09,57,15,ce,b1,b6,9d
"{AA58ED58-01DD-4D91-8333-CF10577473F7}"=hex:51,66,7a,6c,4c,1d,38,12,36,ee,4b,
ae,ef,4f,ff,08,fc,25,8c,50,52,2a,37,e3
"{DBC80044-A445-435B-BC74-9C25C1C588A9}"=hex:51,66,7a,6c,4c,1d,38,12,2a,03,db,
df,77,ea,35,06,c3,62,df,65,c4,9b,cc,bd
"{21347690-EC41-4F9A-8887-1F4AEE672439}"=hex:51,66,7a,6c,4c,1d,38,12,fe,75,27,
25,73,a2,f4,0a,f7,91,5c,0a,eb,39,60,2d
"{32004B8A-44A9-43E7-84E9-808838809519}"=hex:51,66,7a,6c,4c,1d,38,12,e4,48,13,
36,9b,0a,89,06,fb,ff,c3,c8,3d,de,d1,0d
.
[HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration]
@Denied: (2) (LocalSystem)
"Timestamp"=hex:f0,08,3d,9a,ba,24,cc,01
.
[HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\User Preferences]
@Denied: (2) (LocalSystem)
"88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,12,c8,07,6b,8b,c3,77,49,91,39,12,\
"2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,12,c8,07,6b,8b,c3,77,49,91,39,12,\
.
——————— DLLs Loaded Under Running Processes ———————
.
- - - - - - - > 'lsass.exe'(648)
c:\windows\System32\BCMLogon.dll
.
Completion time: 2012-08-08 17:17:58
ComboFix-quarantined-files.txt 2012-08-08 21:17
ComboFix2.txt 2012-08-07 17:58
.
Pre-Run: 42,350,731,264 bytes free
Post-Run: 42,005,606,400 bytes free
.
- - End Of File - - 254E8E1FE1AA0C6652136FA2FD740A9A
Post #18
Hi,

The logs are looking good. I see that you have several antivirus programs on your system. Even if you don't have them running they still have processes running in the background and this can cause problems. In your malware logs, I see Immunet Protect, Lavasoft AdWatch Live, Microsoft Security Essentials and IObit Security 360. You should remove all but one of those by going to Start >> Control Panel >> Programs and Features and then remove all but one of the programs listed above.

Let me know how your system is running. :)
Post #19
Well, I still have the blasted tab, the 'like.php' install dialogue still pops up, so I'm assuming whatever I had I still have. I'll go deal with the unneeded virus software, and google around about this. Any other ideas you might have would be helpful…I appreciate everything you've helped with so far.
Post #21
So, some googling and some thought has led me to the notion that the like,php dialogue box is not an infection, but is somehow associated with the programming of Facebook 'Like' buttons on other sites. The tab is related to www.mysearchresults.com. Just a refugee of the original infection, or something separate?
Post #23

So, some googling and some thought has led me to the notion that the like,php dialogue box is not an infection, but is somehow associated with the programming of Facebook 'Like' buttons on other sites.

That was exactly what I came up with as well.

How is your system running now?
Post #24
The same. Stupid tab still there, but otherwise fine. There's a couple of threads here about the mysearchresults, but it seems like it's been cleared up by MBAM or something similar for other people. I've run now like ten different tools on this machine, and from my own experience and what you've told me, everything is fine. Some googling has led me to sites that talk about symptoms I don't have. I only get sent to it's search if I use the tab, it doesn't redirect searches if I manually go to google.com, it doesn't redirect my homepage after I changed the entries in about:config in FF. It's a total refugee symptom, but obnoxious nontheless. I don't find myself getting more popups than usual, I haven't had toolbars mysteriously downloaded. So…if we can figure out how to get rid of it, it would be awesome. If we can't…well, I'll just try to ignore it. It worries me a little, that there's maybe still some backdoor left open cause of it, but nothing really seems too negatively impacted either. *grumble*
Post #26
OTL logfile created on: 8/9/2012 5:27:13 PM - Run 3
OTL by OldTimer - Version 3.2.56.0 Folder = C:\Users\Heidi\Desktop
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

2.96 Gb Total Physical Memory | 1.49 Gb Available Physical Memory | 50.27% Memory free
6.12 Gb Paging File | 4.48 Gb Available in Paging File | 73.12% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 104.90 Gb Total Space | 38.37 Gb Free Space | 36.58% Space Free | Partition Type: NTFS
Drive E: | 44.11 Gb Total Space | 7.79 Gb Free Space | 17.65% Space Free | Partition Type: NTFS

Computer Name: HEIDI-PC | User Name: Heidi | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Users\Heidi\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Program Files\Panda Security\Panda Cloud Cleaner\PCloudCleaner.exe ()
PRC - C:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater\11.2.0\ToolbarUpdater.exe ()
PRC - C:\Program Files\AVG Secure Search\vprot.exe ()
PRC - C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation)
PRC - C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
PRC - C:\Program Files\Real\RealPlayer\Update\realsched.exe (RealNetworks, Inc.)
PRC - C:\Program Files\Microsoft Security Client\msseces.exe (Microsoft Corporation)
PRC - c:\Program Files\Microsoft Security Client\MsMpEng.exe (Microsoft Corporation)
PRC - C:\Program Files\WRAL Desktop Alert\liveonline_3977114.exe ()
PRC - C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated)
PRC - C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe (Eastman Kodak Company)
PRC - C:\Program Files\Secunia\PSI\psia.exe (Secunia)
PRC - C:\Program Files\Secunia\PSI\sua.exe (Secunia)
PRC - C:\Program Files\Secunia\PSI\psi_tray.exe (Secunia)
PRC - C:\Windows\System32\sdclt.exe (Microsoft Corporation)
PRC - C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe (ArcSoft Inc.)
PRC - C:\Program Files\Dell DataSafe Local Backup\SftService.exe (SoftThinks SAS)
PRC - C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe (ArcSoft Inc.)
PRC - C:\Program Files\IDT\WDM\sttray.exe (IDT, Inc.)
PRC - C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_0145da1d\stacsv.exe (IDT, Inc.)
PRC - C:\Program Files\Logitech\Logitech WebCam Software\LWS.exe ()
PRC - C:\Program Files\Common Files\logishrd\LQCVFX\COCIManager.exe ()
PRC - C:\Program Files\Common Files\logishrd\LVMVFM\LVPrcSrv.exe (Logitech Inc.)
PRC - C:\Program Files\Canon\MyPrinter\BJMYPRT.EXE (CANON INC.)
PRC - C:\Windows\explorer.exe (Microsoft Corporation)
PRC - C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_0145da1d\AEstSrv.exe (Andrea Electronics Corporation)
PRC - C:\Program Files\Canon\IJPLM\ijplmsvc.exe ()
PRC - C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe (Safer Networking Ltd.)
PRC - C:\Program Files\Common Files\Dell\Advanced Networking Service\hnm_svc.exe (Dell Inc.)
PRC - C:\Program Files\Common Files\Dell\Remote Access File Sync Service\dsl_fs_sync.exe (SingleClick Systems)
PRC - C:\Program Files\Dell\DellDock\DellDock.exe (Stardock Corporation)
PRC - C:\Program Files\Dell\DellDock\DockLogin.exe (Stardock Corporation)
PRC - C:\Program Files\DellTPad\hidfind.exe (Alps Electric Co., Ltd.)
PRC - C:\Program Files\DellTPad\Apoint.exe (Alps Electric Co., Ltd.)
PRC - C:\Program Files\DellTPad\ApntEx.exe (Alps Electric Co., Ltd.)
PRC - C:\ProgramData\UltraVNC\winvnc.exe (UltraVNC)
PRC - C:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exe (CyberLink Corp.)
PRC - C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTmon.exe (Intel Corporation)
PRC - C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe (Intel Corporation)
PRC - C:\Program Files\Common Files\Dell\MySQL\bin\mysqld.exe ()
PRC - C:\Program Files\twc\medicsp2\bin\sprtsvc.exe (SupportSoft, Inc.)


========== Modules (No Company Name) ==========

MOD - C:\Program Files\Panda Security\Panda Cloud Cleaner\PCloudCleaner.exe ()
MOD - C:\Program Files\Panda Security\Panda Cloud Cleaner\pascplh.dll ()
MOD - C:\Program Files\Panda Security\Panda Cloud Cleaner\CommonCmp.dll ()
MOD - C:\Program Files\Common Files\AVG Secure Search\SiteSafetyInstaller\11.2.0\SiteSafety.dll ()
MOD - C:\Program Files\AVG Secure Search\vprot.exe ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\MenuSkinning\e4ead33e7390326a9814a511c566054b\MenuSkinning.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\VistaBridgeLibrary\53ff6fb64982a15d164f25e727be6bb4\VistaBridgeLibrary.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\DellDock\a2117f9d2b9670193889149f0ec777d5\DellDock.ni.exe ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\MyDock.Util\d8dfd448743194309366caa97c215c21\MyDock.Util.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Web\508b444db523c5cf20ff12c7f440837b\System.Web.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\f2691cfa7671cdc58179e56ba9227591\System.Windows.Forms.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\18f9789aa214c657113e676b3a9015aa\System.Drawing.ni.dll ()
MOD - C:\Program Files\IObit\Advanced SystemCare 5\ASCv5ExtMenu.dll ()
MOD - C:\Program Files\Panda Security\Panda Cloud Cleaner\PRSBLib.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Management\f3d4d5fe5ab848fbfcf91a49960dc8ae\System.Management.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Runtime.Remo#\846b9cf2756fdd15f704c9bab9c70b6f\System.Runtime.Remoting.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Configuration\bd76aaaa03ddc15d1840207b5a480644\System.Configuration.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\Accessibility\1b337cf9a031145849bc48c11b2cfe58\Accessibility.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Xml\3b7181bb19dd5dd74cd063f0312cdf57\System.Xml.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System\28d633338fc8d29f8af31935ef7d001b\System.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\af9c9e9d7e0523cd444f8b551baa9cbf\mscorlib.ni.dll ()
MOD - C:\Program Files\Panda Security\Panda Cloud Cleaner\libxml2.dll ()
MOD - C:\Program Files\Panda Security\Panda Cloud Cleaner\PRExcHash.dll ()
MOD - C:\Program Files\WRAL Desktop Alert\liveonline_3977114.exe ()
MOD - C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll ()
MOD - C:\Program Files\Common Files\Apple\Apple Application Support\libxml2.dll ()
MOD - C:\Program Files\Kodak\Kodak EasyShare software\bin\VistaAdapter.esx ()
MOD - C:\Program Files\Kodak\Kodak EasyShare software\bin\ESCom.dll ()
MOD - C:\Program Files\Kodak\Kodak EasyShare software\bin\ESSkin.esx ()
MOD - C:\Program Files\Kodak\Kodak EasyShare software\bin\VistaCDBackup.esx ()
MOD - C:\Program Files\Kodak\Kodak EasyShare software\bin\ESEmail.esx ()
MOD - C:\Program Files\Kodak\Kodak EasyShare software\bin\VPrintOnline.dll ()
MOD - C:\Program Files\Kodak\Kodak EasyShare software\bin\VistaControls.esx ()
MOD - C:\Program Files\Kodak\Kodak EasyShare software\bin\ESCliWicMDRW.esx ()
MOD - C:\Program Files\Kodak\Kodak EasyShare software\bin\VPrintOnlineHelper40.dll ()
MOD - C:\Program Files\Kodak\Kodak EasyShare software\bin\KFx.dll ()
MOD - C:\Program Files\Kodak\Kodak EasyShare software\bin\keml40.dll ()
MOD - C:\Program Files\Kodak\Kodak EasyShare software\bin\AppCore.dll ()
MOD - C:\Program Files\Kodak\Kodak EasyShare software\bin\Atlas.dll ()
MOD - C:\Program Files\Kodak\Kodak EasyShare software\bin\SpiffyExt.dll ()
MOD - C:\Program Files\Kodak\Kodak EasyShare software\bin\IStorageMediaStore.esx ()
MOD - C:\Program Files\Kodak\Kodak EasyShare software\bin\LocCamBack.dll ()
MOD - C:\Program Files\Kodak\Kodak EasyShare software\bin\LocAcqMod.dll ()
MOD - C:\Program Files\Kodak\Kodak EasyShare software\bin\UpdateChecker.esx ()
MOD - C:\Program Files\Kodak\Kodak EasyShare software\bin\kpries40.dll ()
MOD - C:\Program Files\Kodak\Kodak EasyShare software\bin\LocUpdateCheck.dll ()
MOD - C:\Program Files\Kodak\Kodak EasyShare software\bin\VistaPrintOnline.esx ()
MOD - C:\Program Files\Kodak\Kodak EasyShare software\bin\Pcd.esx ()
MOD - C:\Program Files\Kodak\Kodak EasyShare software\bin\KPCDInterface.dll ()
MOD - C:\Program Files\Kodak\Kodak EasyShare software\bin\areaifdll.dll ()
MOD - C:\Program Files\Kodak\Kodak EasyShare software\bin\DXRawFormatHandler.esx ()
MOD - C:\Program Files\Kodak\Kodak EasyShare software\bin\DibLibIP.dll ()
MOD - C:\Program Files\Notepad++\NppShell_01.dll ()
MOD - C:\Program Files\Logitech\Logitech WebCam Software\LWS.exe ()
MOD - C:\Program Files\Common Files\logishrd\LQCVFX\COCIManager.exe ()
MOD - C:\Program Files\Kodak\Kodak EasyShare software\bin\SkinuxCommonV.dll ()
MOD - C:\Program Files\Kodak\Kodak EasyShare software\bin\SkinuxProcV.dll ()
MOD - C:\Program Files\Kodak\Kodak EasyShare software\bin\SkinuxXML2V.dll ()
MOD - C:\Program Files\Kodak\Kodak EasyShare software\bin\SkinuxFFV.dll ()
MOD - C:\Program Files\Kodak\Kodak EasyShare software\bin\SkinuxCmpV.dll ()
MOD - C:\Program Files\Kodak\Kodak EasyShare software\bin\SkinuxImV.dll ()
MOD - C:\Program Files\Kodak\Kodak EasyShare software\bin\SkinuxZipV.dll ()
MOD - C:\Program Files\Kodak\Kodak EasyShare software\bin\SkinuxBaseV.dll ()
MOD - C:\Windows\System32\bcmwlrmt.dll ()


========== Win32 Services (SafeList) ==========

SRV - (SBSDWSCService) – C:\Program Files\Spybot File not found
SRV - (ImmunetProtect) – C:\Program Files\Immunet Protect\2.0.17\agent.exe File not found
SRV - (AdobeFlashPlayerUpdateSvc) – C:\Windows\System32\Macromed\Flash\FlashPlayerUpdateService.exe (Adobe Systems Incorporated)
SRV - (MozillaMaintenance) – C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe (Mozilla Foundation)
SRV - (vToolbarUpdater11.2.0) – C:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater\11.2.0\ToolbarUpdater.exe ()
SRV - (MBAMService) – C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation)
SRV - (Ad-Aware Service) – C:\Program Files\Ad-Aware Antivirus\AdAwareService.exe (Lavasoft Limited)
SRV - (NisSrv) – c:\Program Files\Microsoft Security Client\NisSrv.exe (Microsoft Corporation)
SRV - (MsMpSvc) – c:\Program Files\Microsoft Security Client\MsMpEng.exe (Microsoft Corporation)
SRV - (SkypeUpdate) – C:\Program Files\Skype\Updater\Updater.exe (Skype Technologies)
SRV - (AdobeARMservice) – C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated)
SRV - (SBAMSvc) – C:\Program Files\Ad-Aware Antivirus\SBAMSvc.exe (GFI Software)
SRV - (scan) – C:\Program Files\Immunet Protect\tetra\scan.dll (Immunet)
SRV - (Secunia PSI Agent) – C:\Program Files\Secunia\PSI\psia.exe (Secunia)
SRV - (Secunia Update Agent) – C:\Program Files\Secunia\PSI\sua.exe (Secunia)
SRV - (SftService) – C:\Program Files\Dell DataSafe Local Backup\SftService.exe (SoftThinks SAS)
SRV - (ACDaemon) – C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe (ArcSoft Inc.)
SRV - (STacSV) – C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_0145da1d\stacsv.exe (IDT, Inc.)
SRV - (LVPrcSrv) – C:\Program Files\Common Files\logishrd\LVMVFM\LVPrcSrv.exe (Logitech Inc.)
SRV - (AESTFilters) – C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_0145da1d\AEstSrv.exe (Andrea Electronics Corporation)
SRV - (IJPLMSVC) – C:\Program Files\Canon\IJPLM\ijplmsvc.exe ()
SRV - (GoToAssist) – C:\Program Files\Citrix\GoToAssist\514\g2aservice.exe (Citrix Online, a division of Citrix Systems, Inc.)
SRV - (hnmsvc) – C:\Program Files\Common Files\Dell\Advanced Networking Service\hnm_svc.exe (Dell Inc.)
SRV - (dsl-fs-sync) – C:\Program Files\Common Files\Dell\Remote Access File Sync Service\dsl_fs_sync.exe (SingleClick Systems)
SRV - (DockLoginService) – C:\Program Files\Dell\DellDock\DockLogin.exe (Stardock Corporation)
SRV - (uvnc_service) – C:\ProgramData\UltraVNC\winvnc.exe (UltraVNC)
SRV - (IAANTMON) – C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTmon.exe (Intel Corporation)
SRV - (WinDefend) – C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)
SRV - (dsl-db) – C:\Program Files\Common Files\Dell\MySQL\bin\mysqld.exe ()
SRV - (sprtsvc_medicsp2) – C:\Program Files\twc\medicsp2\bin\sprtsvc.exe (SupportSoft, Inc.)


========== Driver Services (SafeList) ==========

DRV - (SASKUTIL) – C:\Users\Heidi\AppData\Local\Temp\SAS_SelfExtract\SASKUTIL.SYS File not found
DRV - (SASDIFSV) – C:\Users\Heidi\AppData\Local\Temp\SAS_SelfExtract\SASDIFSV.SYS File not found
DRV - (NwlnkFwd) – system32\DRIVERS\nwlnkfwd.sys File not found
DRV - (NwlnkFlt) – system32\DRIVERS\nwlnkflt.sys File not found
DRV - (Lbd) – system32\DRIVERS\Lbd.sys File not found
DRV - (kwqgcpcj) – System32\drivers\oflneeun.sys File not found
DRV - (IpInIp) – system32\DRIVERS\ipinip.sys File not found
DRV - (ImmunetSelfProtectDriver) – system32\DRIVERS\ImmunetSelfProtect.sys File not found
DRV - (ImmunetProtectDriver) – system32\DRIVERS\ImmunetProtect.sys File not found
DRV - (catchme) – C:\Users\Heidi\AppData\Local\Temp\catchme.sys File not found
DRV - (MpKslc9e314ac) – c:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{F70FBE62-9910-4E02-801F-89363B0CC2F1}\MpKslc9e314ac.sys (Microsoft Corporation)
DRV - (MBAMProtector) – C:\Windows\System32\drivers\mbam.sys (Malwarebytes Corporation)
DRV - (Pavboot) – C:\Windows\System32\drivers\pavboot.sys (Panda Security, S.L.)
DRV - (NisDrv) – C:\Windows\System32\drivers\NisDrvWFP.sys (Microsoft Corporation)
DRV - (SbFw) – C:\Windows\System32\drivers\SbFw.sys (GFI Software)
DRV - (sbhips) – C:\Windows\System32\drivers\sbhips.sys (GFI Software)
DRV - (sbwtis) – C:\Windows\System32\drivers\sbwtis.sys (GFI Software)
DRV - (SBFWIMCLMP) – C:\Windows\System32\drivers\SbFwIm.sys (GFI Software)
DRV - (SBFWIMCL) – C:\Windows\System32\drivers\SbFwIm.sys (GFI Software)
DRV - (SmartDefragDriver) – C:\Windows\System32\drivers\SmartDefragDriver.sys ()
DRV - (PSI) – C:\Windows\System32\drivers\psi_mf.sys (Secunia)
DRV - (pwdrvio) – C:\Windows\System32\pwdrvio.sys ()
DRV - (pwdspio) – C:\Windows\System32\pwdspio.sys ()
DRV - (STHDA) – C:\Windows\System32\drivers\stwrt.sys (IDT, Inc.)
DRV - (LVPr2Mon) – C:\Windows\System32\drivers\LVPr2Mon.sys ()
DRV - (BCM42RLY) – C:\Windows\System32\drivers\bcm42rly.sys (Broadcom Corporation)
DRV - (ApfiltrService) – C:\Windows\System32\drivers\Apfiltr.sys (Alps Electric Co., Ltd.)
DRV - (Packet) – C:\Windows\System32\drivers\packet.sys (SingleClick Systems)
DRV - (e1express) – C:\Windows\System32\drivers\e1e6032.sys (Intel Corporation)
DRV - (LVUSBSta) – C:\Windows\System32\drivers\LVUSBSta.sys (Logitech Inc.)
DRV - (PID_PEPI) – C:\Windows\System32\drivers\LV302V32.SYS (Logitech Inc.)
DRV - (R300) – C:\Windows\System32\drivers\atikmdag.sys (ATI Technologies Inc.)
DRV - (WimFltr) – C:\Windows\System32\drivers\WimFltr.sys (Microsoft Corporation)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\..\SearchScopes,DefaultScope = {6A1806CD-94D4-4689-BA73-E35EA1EA9990}
IE - HKLM\..\SearchScopes\{2ED7F417-7E96-482C-8B7C-B38575AE7725}: "URL" = http://search.live.com/results.aspx?q={sea…ferrer:source?}
IE - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://www.google.com/search?q={searchTerm…mp;sourceid=ie7


IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0



IE - HKU\S-1-5-21-1158375537-2513235221-245670277-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://g.msn.com/USCON/1
IE - HKU\S-1-5-21-1158375537-2513235221-245670277-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.google.com/ie
IE - HKU\S-1-5-21-1158375537-2513235221-245670277-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = http://www.google.com/ie
IE - HKU\S-1-5-21-1158375537-2513235221-245670277-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.google.com
IE - HKU\S-1-5-21-1158375537-2513235221-245670277-1000\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKU\S-1-5-21-1158375537-2513235221-245670277-1000\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = http://www.google.com/ie
IE - HKU\S-1-5-21-1158375537-2513235221-245670277-1000\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ie
IE - HKU\S-1-5-21-1158375537-2513235221-245670277-1000\..\URLSearchHook: {0BDA0769-FD72-49F4-9266-E1FB004F4D8F} - No CLSID value found
IE - HKU\S-1-5-21-1158375537-2513235221-245670277-1000\..\SearchScopes,DefaultScope = {6A1806CD-94D4-4689-BA73-E35EA1EA9990}
IE - HKU\S-1-5-21-1158375537-2513235221-245670277-1000\..\SearchScopes\{2ED7F417-7E96-482C-8B7C-B38575AE7725}: "URL" = http://www.bing.com/search?q={searchTerms}…rc=IE-SearchBox
IE - HKU\S-1-5-21-1158375537-2513235221-245670277-1000\..\SearchScopes\{53BC67F4-DEFF-41DD-9C1E-C92E3FAA750C}: "URL" = http://search.yahoo.com/search?fr=chr-gree…p={searchTerms}
IE - HKU\S-1-5-21-1158375537-2513235221-245670277-1000\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://www.google.com/search?q={searchTerm…;rlz=1I7GPCK_en
IE - HKU\S-1-5-21-1158375537-2513235221-245670277-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-21-1158375537-2513235221-245670277-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

IE - HKU\S-1-5-21-1158375537-2513235221-245670277-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.google.com/ie
IE - HKU\S-1-5-21-1158375537-2513235221-245670277-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://isearch.avg.com/?cid={046AF6B5-EFF2…mp;d=2012-07-08 14:31:33&v;=11.1.0.12&sap;=hp
IE - HKU\S-1-5-21-1158375537-2513235221-245670277-1001\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKU\S-1-5-21-1158375537-2513235221-245670277-1001\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = http://www.google.com/ie
IE - HKU\S-1-5-21-1158375537-2513235221-245670277-1001\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ie
IE - HKU\S-1-5-21-1158375537-2513235221-245670277-1001\..\SearchScopes,DefaultScope = {6A1806CD-94D4-4689-BA73-E35EA1EA9990}
IE - HKU\S-1-5-21-1158375537-2513235221-245670277-1001\..\SearchScopes\{2ED7F417-7E96-482C-8B7C-B38575AE7725}: "URL" = http://www.bing.com/search?q={searchTerms}…rc=IE-SearchBox
IE - HKU\S-1-5-21-1158375537-2513235221-245670277-1001\..\SearchScopes\{63140ECF-C629-BE59-8F0E-90B4FF340C03}: "URL" = http://www.bing.com/search?q={searchTerms}…eferrer:source}
IE - HKU\S-1-5-21-1158375537-2513235221-245670277-1001\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://www.google.com/search?q={searchTerm…;rlz=1I7GPCK_en
IE - HKU\S-1-5-21-1158375537-2513235221-245670277-1001\..\SearchScopes\{95B7759C-8C7F-4BF1-B163-73684A933233}: "URL" = http://isearch.avg.com/search?cid={046AF6B…mp;d=2012-07-08 14:31:33&v;=11.1.0.12&sap;=dsp&q;={searchTerms}
IE - HKU\S-1-5-21-1158375537-2513235221-245670277-1001\..\SearchScopes\{D5042721-6DFD-85DD-AD1C-6B852F3F6275}: "URL" = http://www.bing.com/search?q={searchTerms}…amp;form=ZGAIDF
IE - HKU\S-1-5-21-1158375537-2513235221-245670277-1001\..\SearchScopes\{FDA3B927-CE90-F095-31E5-29B4FDC893D7}: "URL" = http://www.bing.com/search?q={searchTerms}…eferrer:source}
IE - HKU\S-1-5-21-1158375537-2513235221-245670277-1001\..\SearchScopes\Yahoo!: "URL" = http://search.yahoo.com/search?fr=chr-gree…p={searchTerms}
IE - HKU\S-1-5-21-1158375537-2513235221-245670277-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-21-1158375537-2513235221-245670277-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

IE - HKU\S-1-5-21-1158375537-2513235221-245670277-1002\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://g.msn.com/USCON/1
IE - HKU\S-1-5-21-1158375537-2513235221-245670277-1002\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.google.com/ie
IE - HKU\S-1-5-21-1158375537-2513235221-245670277-1002\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = http://www.google.com/ie
IE - HKU\S-1-5-21-1158375537-2513235221-245670277-1002\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.google.com
IE - HKU\S-1-5-21-1158375537-2513235221-245670277-1002\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKU\S-1-5-21-1158375537-2513235221-245670277-1002\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = http://www.google.com/ie
IE - HKU\S-1-5-21-1158375537-2513235221-245670277-1002\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ie
IE - HKU\S-1-5-21-1158375537-2513235221-245670277-1002\..\SearchScopes,DefaultScope = {6A1806CD-94D4-4689-BA73-E35EA1EA9990}
IE - HKU\S-1-5-21-1158375537-2513235221-245670277-1002\..\SearchScopes\{2ED7F417-7E96-482C-8B7C-B38575AE7725}: "URL" = http://www.bing.com/search?q={searchTerms}…rc=IE-SearchBox
IE - HKU\S-1-5-21-1158375537-2513235221-245670277-1002\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://www.google.com/search?q={searchTerm…;rlz=1I7GPCK_en
IE - HKU\S-1-5-21-1158375537-2513235221-245670277-1002\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-21-1158375537-2513235221-245670277-1002\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

========== FireFox ==========

FF - prefs.js..browser.search.param.yahoo-fr: "chr-greentree_ff&type;=382950"
FF - prefs.js..browser.search.selectedEngine: "Google"
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "http://google.com/"
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20
FF - prefs.js..extensions.enabledItems: {ABDE892B-13A8-4d1b-88E6-365A6E755758}:14.0.2
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}:6.0.21
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}:6.0.22
FF - prefs.js..extensions.enabledItems: [removed]:4.3
FF - prefs.js..extensions.enabledItems: [removed]:4.3
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}:6.0.23
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}:6.0.24


FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32_11_3_300_270.dll ()
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@avg.com/AVG SiteSafety plugin,version=11.0.0.1,application/x-avg-sitesafety-plugin: C:\Program Files\Common Files\AVG Secure Search\SiteSafetyInstaller\11.2.0\\npsitesafety.dll ()
FF - HKLM\Software\MozillaPlugins\@canon.com/EPPEX: C:\Program Files\Canon\Easy-PhotoPrint EX\NPEZFFPI.DLL (CANON INC.)
FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF - HKLM\Software\MozillaPlugins\@google.com/npPicasa2,version=2.0.0: C:\Program Files\Picasa2\npPicasa2.dll (Google, Inc.)
FF - HKLM\Software\MozillaPlugins\@google.com/npPicasa3,version=3.0.0: C:\Program Files\Picasa2\npPicasa3.dll (Google, Inc.)
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=1.6.0_33: C:\Windows\system32\npdeployJava1.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\plugin2\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\5.1.10411.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3508.1109: C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@real.com/nppl3260;version=15.0.4.53: c:\program files\real\realplayer\Netscape6\nppl3260.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprjplug;version=15.0.4.53: c:\program files\real\realplayer\Netscape6\nprjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprpchromebrowserrecordext;version=15.0.4.53: C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprpchromebrowserrecordext.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprphtml5videoshim;version=15.0.4.53: C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprpplugin;version=15.0.4.53: c:\program files\real\realplayer\Netscape6\nprpplugin.dll (RealPlayer)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.115\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.115\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=2.0.1: C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{3112ca9c-de6d-4884-a869-9855de68056c}: C:\ProgramData\Google\Toolbar for Firefox\{3112ca9c-de6d-4884-a869-9855de68056c} [2009/10/11 21:29:22 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{97E22097-9A2F-45b1-8DAF-36AD648C7EF4}: C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext [2012/05/23 05:51:35 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\avg@toolbar: C:\ProgramData\AVG Secure Search\11.1.0.12\ [2012/07/08 14:32:04 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 14.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012/08/08 22:45:53 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 14.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2012/07/08 13:45:06 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 13.0.1\extensions\\Components: C:\Program Files\Mozilla Thunderbird\components [2012/07/08 16:21:02 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 13.0.1\extensions\\Plugins: C:\Program Files\Mozilla Thunderbird\plugins [2012/07/02 21:22:06 | 000,000,000 | —D | M]

[2009/12/13 07:58:54 | 000,000,000 | —D | M] (No name found) – C:\Users\Heidi\AppData\Roaming\Mozilla\Extensions
[2009/12/13 07:58:54 | 000,000,000 | —D | M] (No name found) – C:\Users\Heidi\AppData\Roaming\Mozilla\Extensions\{3550f703-e582-4d05-9a08-453d09bdfdc6}
[2012/08/08 23:29:29 | 000,000,000 | —D | M] (No name found) – C:\Users\Heidi\AppData\Roaming\Mozilla\Firefox\Profiles\60wjxva2.default\extensions
[2010/06/26 07:25:04 | 000,000,000 | —D | M] (Microsoft .NET Framework Assistant) – C:\Users\Heidi\AppData\Roaming\Mozilla\Firefox\Profiles\60wjxva2.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2012/08/07 12:57:10 | 000,000,000 | —D | M] (Bitdefender QuickScan) – C:\Users\Heidi\AppData\Roaming\Mozilla\Firefox\Profiles\60wjxva2.default\extensions\{e001c731-5e37-4538-a5cb-8168736a2360}
[2011/10/20 09:46:12 | 000,000,000 | —D | M] (Разпознаване на устройство Logitech) – C:\Users\Heidi\AppData\Roaming\Mozilla\Firefox\Profiles\60wjxva2.default\extensions\[removed]
[2012/05/20 22:36:05 | 000,000,000 | —D | M] (Lavasoft Search Plugin) – C:\Users\Heidi\AppData\Roaming\Mozilla\Firefox\Profiles\60wjxva2.default\extensions\jid1-yZwVFzbsyfMrqQ@jetpack
[2012/08/09 02:25:35 | 000,001,982 | —- | M] () – C:\Users\Heidi\AppData\Roaming\Mozilla\Firefox\Profiles\60wjxva2.default\searchplugins\search-here.xml
[2012/08/07 14:13:06 | 000,000,000 | —D | M] (No name found) – C:\Program Files\Mozilla Firefox\extensions
[2012/03/25 09:57:35 | 000,000,000 | —D | M] (Skype Click to Call) – C:\Program Files\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}
[2012/07/08 13:45:09 | 000,000,000 | —D | M] (Java Console) – C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA}
[2012/07/29 12:57:04 | 000,022,392 | —- | M] () (No name found) – C:\USERS\HEIDI\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\60WJXVA2.DEFAULT\EXTENSIONS\[removed]
[2012/07/29 12:56:58 | 000,136,672 | —- | M] (Mozilla Foundation) – C:\Program Files\mozilla firefox\components\browsercomps.dll
[2012/07/02 21:22:04 | 000,466,944 | —- | M] (Catalina Marketing Corporation) – C:\Program Files\mozilla firefox\plugins\NPcol400.dll
[2012/06/20 12:54:54 | 000,091,584 | —- | M] (Coupons, Inc.) – C:\Program Files\mozilla firefox\plugins\npCouponPrinter.dll
[2012/06/20 12:54:56 | 000,091,584 | —- | M] (Coupons, Inc.) – C:\Program Files\mozilla firefox\plugins\npMozCouponPrinter.dll
[2012/05/23 05:49:44 | 000,129,144 | —- | M] (RealPlayer) – C:\Program Files\mozilla firefox\plugins\nprpplugin.dll
[2012/07/29 12:56:29 | 000,001,525 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\amazon-en-GB.xml
[2012/07/08 14:31:08 | 000,003,750 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\avg-secure-search.xml
[2012/07/29 12:56:29 | 000,000,935 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\chambers-en-GB.xml
[2012/07/29 12:56:29 | 000,001,166 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\eBay-en-GB.xml
[2012/07/29 12:56:29 | 000,002,040 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\twitter.xml
[2012/07/29 12:56:29 | 000,001,121 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\yahoo-en-GB.xml

O1 HOSTS File: ([2012/08/07 13:53:08 | 000,000,027 | —- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - No CLSID value found.
O2 - BHO: (RealPlayer Download and Record Plugin for Internet Explorer) - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll (RealPlayer)
O2 - BHO: (Canon Easy-WebPrint EX BHO) - {3785D0AD-BFFF-47F6-BF5B-A587C162FED9} - C:\Program Files\Canon\Easy-WebPrint EX\ewpexbho.dll (CANON INC.)
O2 - BHO: (no name) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - No CLSID value found.
O2 - BHO: (Spybot-S&D; IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O2 - BHO: (Java™ Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (AVG Security Toolbar) - {95B7759C-8C7F-4BF1-B163-73684A933233} - C:\Program Files\AVG Secure Search\11.1.0.12\AVG Secure Search_toolbar.dll ()
O2 - BHO: (Skype Browser Helper) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O3 - HKLM\..\Toolbar: (Canon Easy-WebPrint EX) - {759D9886-0C6F-4498-BAB6-4A5F47C6C72F} - C:\Program Files\Canon\Easy-WebPrint EX\ewpexhlp.dll (CANON INC.)
O3 - HKLM\..\Toolbar: (AVG Security Toolbar) - {95B7759C-8C7F-4BF1-B163-73684A933233} - C:\Program Files\AVG Secure Search\11.1.0.12\AVG Secure Search_toolbar.dll ()
O3 - HKU\.DEFAULT\..\Toolbar\WebBrowser: (Canon Easy-WebPrint EX) - {759D9886-0C6F-4498-BAB6-4A5F47C6C72F} - C:\Program Files\Canon\Easy-WebPrint EX\ewpexhlp.dll (CANON INC.)
O3 - HKU\S-1-5-18\..\Toolbar\WebBrowser: (Canon Easy-WebPrint EX) - {759D9886-0C6F-4498-BAB6-4A5F47C6C72F} - C:\Program Files\Canon\Easy-WebPrint EX\ewpexhlp.dll (CANON INC.)
O3 - HKU\S-1-5-21-1158375537-2513235221-245670277-1000\..\Toolbar\WebBrowser: (no name) - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No CLSID value found.
O3 - HKU\S-1-5-21-1158375537-2513235221-245670277-1000\..\Toolbar\WebBrowser: (no name) - {3041D03E-FD4B-44E0-B742-2D9B88305F98} - No CLSID value found.
O3 - HKU\S-1-5-21-1158375537-2513235221-245670277-1000\..\Toolbar\WebBrowser: (Canon Easy-WebPrint EX) - {759D9886-0C6F-4498-BAB6-4A5F47C6C72F} - C:\Program Files\Canon\Easy-WebPrint EX\ewpexhlp.dll (CANON INC.)
O3 - HKU\S-1-5-21-1158375537-2513235221-245670277-1001\..\Toolbar\WebBrowser: (Canon Easy-WebPrint EX) - {759D9886-0C6F-4498-BAB6-4A5F47C6C72F} - C:\Program Files\Canon\Easy-WebPrint EX\ewpexhlp.dll (CANON INC.)
O3 - HKU\S-1-5-21-1158375537-2513235221-245670277-1002\..\Toolbar\WebBrowser: (Canon Easy-WebPrint EX) - {759D9886-0C6F-4498-BAB6-4A5F47C6C72F} - C:\Program Files\Canon\Easy-WebPrint EX\ewpexhlp.dll (CANON INC.)
O4 - HKLM..\Run: [Apoint] C:\Program Files\DellTPad\Apoint.exe (Alps Electric Co., Ltd.)
O4 - HKLM..\Run: [APSDaemon] C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
O4 - HKLM..\Run: [ArcSoft Connection Service] C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe (ArcSoft Inc.)
O4 - HKLM..\Run: [CanonMyPrinter] C:\Program Files\Canon\MyPrinter\BJMyPrt.exe (CANON INC.)
O4 - HKLM..\Run: [CanonSolutionMenu] C:\Program Files\Canon\SolutionMenu\CNSLMAIN.exe (CANON INC.)
O4 - HKLM..\Run: [CarboniteSetupLite] C:\Program Files\Carbonite\CarbonitePreinstaller.exe (Carbonite, Inc.)
O4 - HKLM..\Run: [HF_G_Jul] C:\Program Files\AVG Secure Search\HF_G_Jul.exe ()
O4 - HKLM..\Run: [IAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe (Intel Corporation)
O4 - HKLM..\Run: [LogitechQuickCamRibbon] C:\Program Files\Logitech\Logitech WebCam Software\LWS.exe ()
O4 - HKLM..\Run: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
O4 - HKLM..\Run: [MSC] c:\Program Files\Microsoft Security Client\msseces.exe (Microsoft Corporation)
O4 - HKLM..\Run: [PDVDDXSrv] C:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exe (CyberLink Corp.)
O4 - HKLM..\Run: [SysTrayApp] C:\Program Files\IDT\WDM\sttray.exe (IDT, Inc.)
O4 - HKLM..\Run: [TkBellExe] c:\program files\real\realplayer\Update\realsched.exe (RealNetworks, Inc.)
O4 - HKLM..\Run: [vProt] C:\Program Files\AVG Secure Search\vprot.exe ()
O4 - HKU\S-1-5-21-1158375537-2513235221-245670277-1000..\Run: [Advanced SystemCare 5] "C:\Program Files\IObit\Advanced SystemCare 5\ASCTray.exe" /AutoStart File not found
O4 - Startup: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dell Dock First Run.lnk = C:\Program Files\Dell\DellDock\DellDock.exe (Stardock Corporation)
O4 - Startup: C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dell Dock First Run.lnk = C:\Program Files\Dell\DellDock\DellDock.exe (Stardock Corporation)
O4 - Startup: C:\Users\Heidi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dell Dock.lnk = C:\Program Files\Dell\DellDock\DellDock.exe (Stardock Corporation)
O4 - Startup: C:\Users\Heidi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ERUNT AutoBackup.lnk = File not found
O4 - Startup: C:\Users\Heidi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WRAL Desktop Alert.lnk = C:\Program Files\WRAL Desktop Alert\liveonline_3977114.exe ()
O4 - Startup: C:\Users\Peter\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dell Dock.lnk = C:\Program Files\Dell\DellDock\DellDock.exe (Stardock Corporation)
O4 - Startup: C:\Users\RA Media Server\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dell Dock First Run.lnk = C:\Program Files\Dell\DellDock\DellDock.exe (Stardock Corporation)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-1158375537-2513235221-245670277-1000\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-1158375537-2513235221-245670277-1001\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-1158375537-2513235221-245670277-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKU\S-1-5-21-1158375537-2513235221-245670277-1002\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: Add to Google Photos Screensa&ver; - C:\Windows\System32\GPhotos.scr (Google Inc.)
O9 - Extra Button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra 'Tools' menuitem : Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra 'Tools' menuitem : Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} http://download.eset.com/special/eos/OnlineScanner.cab (OnlineScanner Control)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_33)
O16 - DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_33)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_33)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1 192.168.2.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{9B676C79-5753-4C0F-AA70-B380E0429E69}: DhcpNameServer = 192.168.2.1 192.168.2.1
O18 - Protocol\Handler\belarc {6318E0AB-2E93-11D1-B8ED-00608CC9A71F} - C:\Program Files\Belarc\Advisor\System\BAVoilaX.dll (Belarc, Inc.)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O18 - Protocol\Handler\viprotocol {B658800C-F66E-4EF3-AB85-6C0C227862A9} - C:\Program Files\Common Files\AVG Secure Search\ViProtocolInstaller\11.2.0\ViProtocol.dll ()
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)
O20 - Winlogon\Notify\GoToAssist: DllName - (C:\Program Files\Citrix\GoToAssist\514\G2AWinLogon.dll) - C:\Program Files\Citrix\GoToAssist\514\g2awinlogon.dll (Citrix Online, a division of Citrix Systems, Inc.)
O24 - Desktop WallPaper: C:\Windows\Web\Wallpaper\img27.jpg
O24 - Desktop BackupWallPaper: C:\Windows\Web\Wallpaper\img27.jpg
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006/09/18 17:43:36 | 000,000,024 | —- | M] () - C:\autoexec.bat – [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = ComFile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)

========== Files/Folders - Created Within 30 Days ==========

[2012/08/09 00:01:08 | 000,026,696 | —- | C] (Panda Security, S.L.) – C:\Windows\System32\drivers\pavboot.sys
[2012/08/09 00:00:17 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Panda Security
[2012/08/09 00:00:17 | 000,000,000 | —D | C] – C:\Program Files\Panda Security
[2012/08/08 23:04:54 | 002,047,488 | —- | C] (Microsoft Corporation) – C:\Windows\System32\win32k.sys
[2012/08/08 23:01:31 | 002,382,848 | —- | C] (Microsoft Corporation) – C:\Windows\System32\mshtml.tlb
[2012/08/08 23:01:29 | 000,176,640 | —- | C] (Microsoft Corporation) – C:\Windows\System32\ieui.dll
[2012/08/08 23:01:29 | 000,142,848 | —- | C] (Microsoft Corporation) – C:\Windows\System32\ieUnatt.exe
[2012/08/08 23:01:28 | 001,800,192 | —- | C] (Microsoft Corporation) – C:\Windows\System32\jscript9.dll
[2012/08/08 23:01:28 | 000,231,936 | —- | C] (Microsoft Corporation) – C:\Windows\System32\url.dll
[2012/08/08 23:01:27 | 000,065,024 | —- | C] (Microsoft Corporation) – C:\Windows\System32\jsproxy.dll
[2012/08/08 23:01:26 | 001,427,968 | —- | C] (Microsoft Corporation) – C:\Windows\System32\inetcpl.cpl
[2012/08/08 17:18:02 | 000,000,000 | —D | C] – C:\Windows\temp
[2012/08/08 17:18:02 | 000,000,000 | —D | C] – C:\Users\Heidi\AppData\Local\temp
[2012/08/08 17:15:58 | 000,000,000 | -HSD | C] – C:\$RECYCLE.BIN
[2012/08/08 16:58:08 | 000,000,000 | —D | C] – C:\ComboFix
[2012/08/07 13:36:24 | 000,518,144 | —- | C] (SteelWerX) – C:\Windows\SWREG.exe
[2012/08/07 13:36:24 | 000,406,528 | —- | C] (SteelWerX) – C:\Windows\SWSC.exe
[2012/08/07 13:36:24 | 000,060,416 | —- | C] (NirSoft) – C:\Windows\NIRCMD.exe
[2012/08/07 13:27:32 | 000,000,000 | —D | C] – C:\Qoobox
[2012/08/07 13:24:21 | 004,727,110 | R— | C] (Swearware) – C:\Users\Heidi\Desktop\ComboFix.exe
[2012/08/07 12:57:16 | 000,000,000 | —D | C] – C:\Users\Heidi\AppData\Roaming\QuickScan
[2012/08/06 20:15:13 | 000,000,000 | —D | C] – C:\Program Files\ESET
[2012/08/06 10:43:59 | 000,000,000 | —D | C] – C:\_OTL
[2012/08/06 10:42:47 | 000,000,000 | —D | C] – C:\Windows\ERDNT
[2012/08/06 10:42:01 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ERUNT
[2012/08/06 10:41:01 | 000,791,393 | —- | C] (Lars Hederer ) – C:\Users\Heidi\Desktop\erunt-setup.exe
[2012/08/06 02:17:26 | 000,000,000 | —D | C] – C:\Users\Heidi\Desktop\AA Comm_files
[2012/08/06 01:36:51 | 000,000,000 | —D | C] – C:\Users\Heidi\Desktop\OFF Trans Req_files
[2012/08/05 22:13:19 | 004,731,392 | —- | C] (AVAST Software) – C:\Users\Heidi\Desktop\aswMBR.exe
[2012/08/05 21:16:06 | 000,596,480 | —- | C] (OldTimer Tools) – C:\Users\Heidi\Desktop\OTL.exe
[2012/08/05 01:10:08 | 000,000,000 | —D | C] – C:\Users\Heidi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\HiJackThis
[2012/08/05 01:10:07 | 000,000,000 | —D | C] – C:\Program Files\Trend Micro
[2012/07/29 12:54:27 | 000,000,000 | —D | C] – C:\Users\Heidi\AppData\Roaming\DefaultTab
[2012/07/29 12:50:31 | 000,000,000 | —D | C] – C:\ProgramData\Tarma Installer
[2012/07/16 23:28:00 | 000,000,000 | —D | C] – C:\Users\Heidi\Desktop\DO NOT OPEN
[2012/07/11 14:06:58 | 000,204,288 | —- | C] (Microsoft Corporation) – C:\Windows\System32\ncrypt.dll

========== Files - Modified Within 30 Days ==========

[2012/08/09 17:34:59 | 000,000,420 | -H– | M] () – C:\Windows\tasks\User_Feed_Synchronization-{1E2F2322-1323-4A6F-8005-2C5E37204C45}.job
[2012/08/09 17:25:35 | 000,000,830 | —- | M] () – C:\Windows\tasks\Adobe Flash Player Updater.job
[2012/08/09 17:25:33 | 000,067,584 | –S- | M] () – C:\Windows\bootstat.dat
[2012/08/09 17:25:31 | 000,000,886 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2012/08/09 02:25:24 | 000,003,616 | -H– | M] () – C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2012/08/09 02:25:23 | 000,003,616 | -H– | M] () – C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2012/08/09 00:00:33 | 000,001,077 | —- | M] () – C:\Users\Public\Desktop\Panda Cloud Cleaner.lnk
[2012/08/08 23:13:40 | 000,000,882 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2012/08/08 23:10:57 | 000,303,184 | —- | M] () – C:\Windows\System32\FNTCACHE.DAT
[2012/08/08 16:53:52 | 004,727,110 | R— | M] (Swearware) – C:\Users\Heidi\Desktop\ComboFix.exe
[2012/08/07 13:53:08 | 000,000,027 | —- | M] () – C:\Windows\System32\drivers\etc\hosts
[2012/08/07 12:20:37 | 000,109,187 | —- | M] () – C:\Users\Heidi\Desktop\obiefawn.jpg
[2012/08/06 10:42:29 | 000,000,915 | —- | M] () – C:\Users\Heidi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ERUNT AutoBackup.lnk
[2012/08/06 10:42:01 | 000,000,735 | —- | M] () – C:\Users\Heidi\Desktop\NTREGOPT.lnk
[2012/08/06 10:42:01 | 000,000,716 | —- | M] () – C:\Users\Heidi\Desktop\ERUNT.lnk
[2012/08/06 10:41:06 | 000,791,393 | —- | M] (Lars Hederer ) – C:\Users\Heidi\Desktop\erunt-setup.exe
[2012/08/06 02:17:29 | 000,061,196 | —- | M] () – C:\Users\Heidi\Desktop\AA Comm.html
[2012/08/06 01:40:11 | 000,049,729 | —- | M] () – C:\Users\Heidi\Desktop\TranscriptRequestForm.pdf
[2012/08/06 01:36:53 | 000,044,024 | —- | M] () – C:\Users\Heidi\Desktop\OFF Trans Req.htm
[2012/08/06 01:33:55 | 000,010,257 | —- | M] () – C:\Users\Heidi\Desktop\NHMCCD Transcript.pdf
[2012/08/05 22:49:41 | 000,000,512 | —- | M] () – C:\Users\Heidi\Documents\MBR.dat
[2012/08/05 22:13:54 | 004,731,392 | —- | M] (AVAST Software) – C:\Users\Heidi\Desktop\aswMBR.exe
[2012/08/05 21:16:12 | 000,596,480 | —- | M] (OldTimer Tools) – C:\Users\Heidi\Desktop\OTL.exe
[2012/08/05 16:54:37 | 000,000,000 | RHS- | M] () – C:\MSDOS.SYS
[2012/08/05 16:54:37 | 000,000,000 | RHS- | M] () – C:\IO.SYS
[2012/08/05 16:47:02 | 000,000,476 | —- | M] () – C:\Windows\wininit.ini
[2012/08/05 14:37:09 | 000,000,064 | —- | M] () – C:\Windows\System32\rp_stats.dat
[2012/08/05 14:37:09 | 000,000,044 | —- | M] () – C:\Windows\System32\rp_rules.dat
[2012/08/05 01:10:08 | 000,001,948 | —- | M] () – C:\Users\Heidi\Desktop\HiJackThis.lnk
[2012/08/02 23:44:33 | 000,426,184 | —- | M] (Adobe Systems Incorporated) – C:\Windows\System32\FlashPlayerApp.exe
[2012/08/02 23:44:32 | 000,070,344 | —- | M] (Adobe Systems Incorporated) – C:\Windows\System32\FlashPlayerCPLApp.cpl
[2012/07/29 15:42:38 | 000,000,908 | —- | M] () – C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2012/07/29 12:56:14 | 000,000,304 | —- | M] () – C:\user.js
[2012/07/26 18:58:04 | 000,606,916 | —- | M] () – C:\Windows\System32\perfh009.dat
[2012/07/26 18:58:04 | 000,105,670 | —- | M] () – C:\Windows\System32\perfc009.dat

========== Files Created - No Company Name ==========

[2012/08/09 00:00:33 | 000,001,077 | —- | C] () – C:\Users\Public\Desktop\Panda Cloud Cleaner.lnk
[2012/08/07 13:36:24 | 000,256,000 | —- | C] () – C:\Windows\PEV.exe
[2012/08/07 13:36:24 | 000,208,896 | —- | C] () – C:\Windows\MBR.exe
[2012/08/07 13:36:24 | 000,098,816 | —- | C] () – C:\Windows\sed.exe
[2012/08/07 13:36:24 | 000,080,412 | —- | C] () – C:\Windows\grep.exe
[2012/08/07 13:36:24 | 000,068,096 | —- | C] () – C:\Windows\zip.exe
[2012/08/07 12:20:31 | 000,109,187 | —- | C] () – C:\Users\Heidi\Desktop\obiefawn.jpg
[2012/08/06 10:42:28 | 000,000,915 | —- | C] () – C:\Users\Heidi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ERUNT AutoBackup.lnk
[2012/08/06 10:42:01 | 000,000,735 | —- | C] () – C:\Users\Heidi\Desktop\NTREGOPT.lnk
[2012/08/06 10:42:01 | 000,000,716 | —- | C] () – C:\Users\Heidi\Desktop\ERUNT.lnk
[2012/08/06 02:17:26 | 000,061,196 | —- | C] () – C:\Users\Heidi\Desktop\AA Comm.html
[2012/08/06 01:40:10 | 000,049,729 | —- | C] () – C:\Users\Heidi\Desktop\TranscriptRequestForm.pdf
[2012/08/06 01:36:50 | 000,044,024 | —- | C] () – C:\Users\Heidi\Desktop\OFF Trans Req.htm
[2012/08/06 01:33:54 | 000,010,257 | —- | C] () – C:\Users\Heidi\Desktop\NHMCCD Transcript.pdf
[2012/08/05 22:49:41 | 000,000,512 | —- | C] () – C:\Users\Heidi\Documents\MBR.dat
[2012/08/05 16:54:37 | 000,000,000 | RHS- | C] () – C:\MSDOS.SYS
[2012/08/05 16:54:37 | 000,000,000 | RHS- | C] () – C:\IO.SYS
[2012/08/05 16:47:02 | 000,000,476 | —- | C] () – C:\Windows\wininit.ini
[2012/08/05 01:10:08 | 000,001,948 | —- | C] () – C:\Users\Heidi\Desktop\HiJackThis.lnk
[2012/07/29 12:56:14 | 000,000,304 | —- | C] () – C:\user.js
[2012/07/08 18:38:31 | 000,000,680 | —- | C] () – C:\Users\Heidi\AppData\Local\d3d9caps.dat
[2012/01/15 11:13:42 | 000,061,440 | —- | C] () – C:\Windows\uninstall.exe
[2011/11/27 20:34:03 | 000,001,492 | —- | C] () – C:\ProgramData\ss.ini
[2011/09/10 10:14:19 | 000,025,944 | —- | C] () – C:\Windows\System32\SmartDefragBootTime.exe
[2011/09/10 10:14:19 | 000,015,672 | —- | C] () – C:\Windows\System32\drivers\SmartDefragDriver.sys
[2011/07/01 20:37:18 | 000,140,288 | —- | C] () – C:\Windows\System32\igfxtvcx.dll
[2011/07/01 20:27:03 | 000,982,196 | —- | C] () – C:\Windows\System32\igkrng500.bin
[2011/07/01 20:26:40 | 000,139,824 | —- | C] () – C:\Windows\System32\igfcg500.bin
[2011/07/01 20:26:40 | 000,097,448 | —- | C] () – C:\Windows\System32\igfcg500m.bin
[2011/07/01 20:26:37 | 000,417,344 | —- | C] () – C:\Windows\System32\igcompkrng500.bin
[2011/06/15 09:20:52 | 000,105,240 | —- | C] () – C:\Windows\System32\RSTCoin.dll
[2011/03/20 14:30:23 | 000,725,064 | —- | C] () – C:\Windows\System32\pwNative.exe
[2011/03/20 14:30:22 | 000,016,472 | —- | C] () – C:\Windows\System32\pwdrvio.sys
[2011/03/20 14:30:04 | 000,011,104 | —- | C] () – C:\Windows\System32\pwdspio.sys
[2011/03/20 11:30:02 | 000,000,064 | —- | C] () – C:\Windows\System32\rp_stats.dat
[2011/03/20 11:30:02 | 000,000,044 | —- | C] () – C:\Windows\System32\rp_rules.dat
[2009/03/16 09:00:43 | 000,016,890 | —- | C] () – C:\Users\Heidi\AppData\Roaming\wklnhst.dat

========== LOP Check ==========

[2012/05/20 22:33:48 | 000,000,000 | —D | M] – C:\Users\Heidi\AppData\Roaming\Ad-Aware Antivirus
[2012/06/24 20:30:51 | 000,000,000 | —D | M] – C:\Users\Heidi\AppData\Roaming\Amazon
[2012/07/02 21:22:04 | 000,000,000 | —D | M] – C:\Users\Heidi\AppData\Roaming\Catalina Marketing Corp
[2010/08/19 19:19:22 | 000,000,000 | —D | M] – C:\Users\Heidi\AppData\Roaming\com.adobe.mauby.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1
[2012/07/29 12:54:27 | 000,000,000 | —D | M] – C:\Users\Heidi\AppData\Roaming\DefaultTab
[2011/07/08 09:41:18 | 000,000,000 | —D | M] – C:\Users\Heidi\AppData\Roaming\Downloaded Installations
[2012/05/30 16:39:20 | 000,000,000 | —D | M] – C:\Users\Heidi\AppData\Roaming\InfraRecorder
[2009/12/28 15:41:16 | 000,000,000 | —D | M] – C:\Users\Heidi\AppData\Roaming\iolo
[2011/10/20 09:52:18 | 000,000,000 | —D | M] – C:\Users\Heidi\AppData\Roaming\Leadertech
[2009/07/25 22:22:54 | 000,000,000 | —D | M] – C:\Users\Heidi\AppData\Roaming\MailFrontier
[2010/11/10 15:41:11 | 000,000,000 | —D | M] – C:\Users\Heidi\AppData\Roaming\Notepad++
[2011/02/17 21:21:45 | 000,000,000 | —D | M] – C:\Users\Heidi\AppData\Roaming\PCDr
[2012/08/09 00:19:34 | 000,000,000 | —D | M] – C:\Users\Heidi\AppData\Roaming\QuickScan
[2009/11/09 21:17:47 | 000,000,000 | —D | M] – C:\Users\Heidi\AppData\Roaming\Skinux
[2009/03/18 19:38:28 | 000,000,000 | —D | M] – C:\Users\Heidi\AppData\Roaming\Template
[2009/12/13 07:58:53 | 000,000,000 | —D | M] – C:\Users\Heidi\AppData\Roaming\Thunderbird
[2009/08/03 22:06:13 | 000,000,000 | —D | M] – C:\Users\Heidi\AppData\Roaming\TuneUp Software
[2010/03/13 08:44:21 | 000,000,000 | —D | M] – C:\Users\Peter\AppData\Roaming\Skinux
[2010/10/28 06:59:02 | 000,000,000 | —D | M] – C:\Users\Peter\AppData\Roaming\Thunderbird
[2009/08/03 19:06:25 | 000,000,000 | —D | M] – C:\Users\Peter\AppData\Roaming\TuneUp Software
[2012/08/08 23:06:27 | 000,032,606 | —- | M] () – C:\Windows\Tasks\SCHEDLGU.TXT
[2010/12/16 15:19:00 | 000,000,418 | -H– | M] () – C:\Windows\Tasks\User_Feed_Synchronization-{06737FB5-171D-4CED-A275-E493946FBD47}.job
[2012/08/09 17:34:59 | 000,000,420 | -H– | M] () – C:\Windows\Tasks\User_Feed_Synchronization-{1E2F2322-1323-4A6F-8005-2C5E37204C45}.job
[2010/01/30 13:25:19 | 000,000,424 | -H– | M] () – C:\Windows\Tasks\User_Feed_Synchronization-{FAAB1E1A-DAFA-4265-B908-E65285CA022E}.job

========== Purity Check ==========



========== Alternate Data Streams ==========

@Alternate Data Stream - 127 bytes -> C:\ProgramData\TEMP:5D432CE3
@Alternate Data Stream - 121 bytes -> C:\ProgramData\TEMP:DFC5A2B2
@Alternate Data Stream - 114 bytes -> C:\ProgramData\TEMP:FA5F15C4

< End of report >


I guess I need to run one of those things that cleans up orphan files, because I've deleted all the excess antivirus, but it's still sitting up there. Well, lets see what we see.
Post #27
Run OTL.exe
  • Copy/paste the following text written inside of the code box into the Custom Scans/Fixes box located at the bottom of OTL


    :Services

    :OTL
    FF - prefs.js..browser.search.param.yahoo-fr: "chr-greentree_ff&type;=382950"
    FF - prefs.js..browser.search.selectedEngine: "Google"
    FF - prefs.js..browser.search.useDBForOrder: true
    FF - prefs.js..browser.startup.homepage: "http://google.com/"
    FF - prefs.js..extensions.enabledItems: [removed]:4.3
    FF - prefs.js..extensions.enabledItems: [removed]:4.3
    [2012/08/09 02:25:35 | 000,001,982 | —- | M] () – C:\Users\Heidi\AppData\Roaming\Mozilla\Firefox\Profiles\60wjxva2.default\searchplugins\search-here.xml
    [2012/07/29 12:57:04 | 000,022,392 | —- | M] () (No name found) – C:\USERS\HEIDI\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\60WJXVA2.DEFAULT\EXTENSIONS\[removed]
    @Alternate Data Stream - 127 bytes -> C:\ProgramData\TEMP:5D432CE3
    @Alternate Data Stream - 121 bytes -> C:\ProgramData\TEMP:DFC5A2B2
    @Alternate Data Stream - 114 bytes -> C:\ProgramData\TEMP:FA5F15C4

    :Commands
    [purity]
    [emptytemp]
    [start explorer]
    [Reboot]

  • Then click the Run Fix button at the top
  • Let the program run unhindered, reboot when it is done
  • Then run a new scan and post a new OTL log ( don't check the boxes beside LOP Check or Purity this time )
———-
Post #28
HAH!! You, sir, are a certified BAMF. All processes killed ========== SERVICES/DRIVERS ========== ========== OTL ========== Prefs.js: "chr-greentree_ff&type;=382950" removed from browser.search.param.yahoo-fr Prefs.js: "Google" removed from browser.search.selectedEngine Prefs.js: true removed from browser.search.useDBForOrder Prefs.js: "http://google.com/" removed from browser.startup.homepage Prefs.js: [removed]:4.3 removed from extensions.enabledItems Prefs.js: [removed]:4.3 removed from extensions.enabledItems C:\Users\Heidi\AppData\Roaming\Mozilla\Firefox\Profiles\60wjxva2.default\searchplugins\search-here.xml moved successfully. C:\Users\Heidi\AppData\Roaming\Mozilla\Firefox\Profiles\60wjxva2.default\extensions\[removed] moved successfully. ADS C:\ProgramData\TEMP:5D432CE3 deleted successfully. ADS C:\ProgramData\TEMP:DFC5A2B2 deleted successfully. ADS C:\ProgramData\TEMP:FA5F15C4 deleted successfully. ========== COMMANDS ========== [EMPTYTEMP] User: All Users User: Default ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes ->Flash cache emptied: 0 bytes User: Default User ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes ->Flash cache emptied: 0 bytes User: Heidi ->Temp folder emptied: 15749997 bytes ->Temporary Internet Files folder emptied: 46218713 bytes ->Java cache emptied: 0 bytes ->FireFox cache emptied: 273699731 bytes ->Flash cache emptied: 23592 bytes User: Peter ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes ->Java cache emptied: 0 bytes ->FireFox cache emptied: 0 bytes ->Flash cache emptied: 0 bytes User: Public ->Temp folder emptied: 0 bytes User: RA Media Server ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes ->Flash cache emptied: 0 bytes %systemdrive% .tmp files removed: 0 bytes %systemroot% .tmp files removed: 0 bytes %systemroot%\System32 .tmp files removed: 0 bytes %systemroot%\System32\drivers .tmp files removed: 0 bytes Windows Temp folder emptied: 179167 bytes %systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 0 bytes %systemroot%\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 350368 bytes %systemroot%\system32\config\systemprofile\AppData\LocalLow\Sun\Java\Deployment folder emptied: 635 bytes RecycleBin emptied: 669247 bytes Total Files Cleaned = 321.00 mb OTL by OldTimer - Version 3.2.56.0 log created on 08092012_200907 Files\Folders moved on Reboot… File move failed. C:\Windows\temp\logishrd\LVPrcInj01.dll scheduled to be moved on reboot. PendingFileRenameOperations files… [2009/10/07 01:47:22 | 000,109,080 | —- | M] (Logitech Inc.) C:\Windows\temp\logishrd\LVPrcInj01.dll : Unable to obtain MD5 Registry entries deleted on Reboot…

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI