Spyware / Malware / Virus Removal

Babylon - Contact Lee from Browser section [Solved]

42 min read

Looking for the outcome? Ask AI

PattiChati Topic Starter

Post #1August 21, 2012, 9:35 PM UTC

I have been working with Lee from the area of browsers and he wants to work with you and told me to give you his link. I would really appreciate it if between the two of you we can get rid of this
http://forums.whatthetech.com/index.php?sh…view=getnewpost

Satchfan

Post #2August 21, 2012, 9:47 PM UTC

Hello PattiChati and welcome to the WTT forum.

My name is Satchfan and I would be glad to help you with your computer problem.

Please read the following guidelines which will help to make cleaning your machine easier:

please follow all instructions in the order posted
please continue to review my answers until I tell you your machine appears to be clear. Absence of symptoms does not mean that everything is clear
all logs/reports, etc. must be posted in Notepad. Please ensure that word wrap is unchecked. In Notepad click Format, uncheck Word wrap if it is checked
if you don't understand something, please don't hesitate to ask for clarification before proceeding
the fixes are specific to your problem and should only be used for this issue on this machine.
please reply within 3 days. If you do not reply within this period I will post a reminder but topics with no reply in 4 days will be closed!

IMPORTANT:

Please DO NOT install/uninstall any programs unless asked to.
Please DO NOT run any scans other than those requested

===================================================

It will take some time to read through the previous posts but meanwhile I would like you to run some scans so that I can see what the current situation is with your computer.

Download and run OTL

download OTL to your desktop.
double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
click Scan all users.
under Custom Scan paste this in

netsvcs
%SYSTEMDRIVE%\*.exe
/md5start
explorer.exe
winlogon.exe
Userinit.exe
svchost.exe
consrv.dll
/md5stop
%systemroot%\*. /rp /s
DRIVES
CREATERESTOREPOINT
click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan won’t take long.
when the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.
please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post it with your next reply.
you may need two posts to fit them both in.

===================================================

Run aswMBR

download aswMBR.exe to your desktop.
double click the aswMBR.exe to run it
if asked, accept the AVAST virus definition download
click the "Scan" button to start scan
on completion of the scan click Save log, save it to your desktop and post in your next reply

Logs to include with next post:

OTL.txt
Extras.txt
aswMBR log

Thanks

Satchfan

PattiChati

Post #3August 22, 2012, 1:28 AM UTC

before I get started, you say post in notepad, when I go to save will it give the option to save in notepad? and where do I go to uncheck word wrap. Once it is in notepad, I just copy and paste to you in this reply section? am familiar with these places just don't know how to get to them. I am excited.

PattiChati

Post #4August 22, 2012, 1:57 AM UTC

I FIGURED OUT THE NOTEPAD AND WORDPAD THING - IT WAS OBVIOUS! BUT I DON'T KNOW IF THIS WAS ACCURATE, A QUICK ERROR POPPED UP, COLDN'T READ IT ALL, BUT IT WAS SOMETHING ABOUT "MY BROWSERS BEING LOCKED AND COULDN'T BE CHANGED"? I DON'T KNOW IF THIS WILL AFFECT THE OUTCOME
ALSO, I DID NOT HAVE TWO NOTEPAD WINDOWS OPENED, JUST ONE AND BELOW IS WHAT IT WAS. I WON'T GO ANY FURTHER UNTIL I HEAR FROM YOU IN CASE YOU WANT IT REDONE AND LOOKING AT THE REST OF YOUR POST, WHERE DO I GT THE EXTRAS.TXT LOG? THANKS.

OTL logfile created on: 8/21/2012 9:45:53 PM - Run 1
OTL by OldTimer - Version 3.2.58.1 Folder = C:\Users\Patty\Downloads
Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7601.17514)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

2.97 Gb Total Physical Memory | 2.16 Gb Available Physical Memory | 72.79% Memory free
5.93 Gb Paging File | 4.78 Gb Available in Paging File | 80.58% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 297.99 Gb Total Space | 191.94 Gb Free Space | 64.41% Space Free | Partition Type: NTFS
Drive J: | 931.51 Gb Total Space | 590.95 Gb Free Space | 63.44% Space Free | Partition Type: NTFS

Computer Name: PATTI-PC | User Name: Patty | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Users\Patty\Downloads\OTL.exe (OldTimer Tools)
PRC - C:\ProgramData\Browser Manager\2.2.565.25\{16cdff19-861d-48e3-a751-d99a27784753}\browsemngr.exe ()
PRC - C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
PRC - C:\Windows\System32\Macromed\Flash\FlashPlayerPlugin_11_3_300_262.exe (Adobe Systems, Inc.)
PRC - C:\Program Files\Macrium\Reflect\ReflectService.exe ()
PRC - C:\Program Files\Microsoft Security Client\msseces.exe (Microsoft Corporation)
PRC - C:\Program Files\Microsoft Security Client\MpCmdRun.exe (Microsoft Corporation)
PRC - C:\Program Files\Microsoft Security Client\MsMpEng.exe (Microsoft Corporation)
PRC - C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated)
PRC - C:\Windows\explorer.exe (Microsoft Corporation)
PRC - C:\Windows\System32\taskhost.exe (Microsoft Corporation)

========== Modules (No Company Name) ==========

MOD - c:\ProgramData\Browser Manager\2.2.565.25\{16cdff19-861d-48e3-a751-d99a27784753}\browsemngr.dll ()
MOD - C:\ProgramData\Browser Manager\2.2.565.25\{16cdff19-861d-48e3-a751-d99a27784753}\browsemngr.exe ()
MOD - C:\Program Files\Mozilla Firefox\mozjs.dll ()
MOD - C:\Windows\System32\Macromed\Flash\NPSWF32_11_3_300_262.dll ()
MOD - C:\Program Files\Common Files\microsoft shared\OFFICE14\Cultures\OFFICE.ODF ()
MOD - C:\Program Files\Microsoft Office2010\Office14\1033\GrooveIntlResource.dll ()

========== Win32 Services (SafeList) ==========

SRV - (Browser Manager) – C:\ProgramData\Browser Manager\2.2.565.25\{16cdff19-861d-48e3-a751-d99a27784753}\browsemngr.exe ()
SRV - (AdobeFlashPlayerUpdateSvc) – C:\Windows\System32\Macromed\Flash\FlashPlayerUpdateService.exe (Adobe Systems Incorporated)
SRV - (MozillaMaintenance) – C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe (Mozilla Foundation)
SRV - (ReflectService.exe) – C:\Program Files\Macrium\Reflect\ReflectService.exe ()
SRV - (NisSrv) – C:\Program Files\Microsoft Security Client\NisSrv.exe (Microsoft Corporation)
SRV - (MsMpSvc) – C:\Program Files\Microsoft Security Client\MsMpEng.exe (Microsoft Corporation)
SRV - (WatAdminSvc) – C:\Windows\System32\Wat\WatAdminSvc.exe (Microsoft Corporation)
SRV - (AdobeARMservice) – C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated)
SRV - (Microsoft SharePoint Workspace Audit Service) – C:\Program Files\Microsoft Office2010\Office14\GROOVE.EXE (Microsoft Corporation)
SRV - (sesvc) – C:\Program Files\ShadowExplorer\sesvc.exe (www.shadowexplorer.com)
SRV - (SensrSvc) – C:\Windows\System32\sensrsvc.dll (Microsoft Corporation)
SRV - (WinDefend) – C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)

========== Driver Services (SafeList) ==========

DRV - (pssnap) – C:\Windows\System32\drivers\pssnap.sys (Macrium Software)
DRV - (NisDrv) – C:\Windows\System32\drivers\NisDrvWFP.sys (Microsoft Corporation)
DRV - (TsUsbFlt) – C:\Windows\System32\drivers\TsUsbFlt.sys (Microsoft Corporation)
DRV - (WinUsb) – C:\Windows\System32\drivers\winusb.sys (Microsoft Corporation)
DRV - (sscdmdm) – C:\Windows\System32\drivers\sscdmdm.sys (MCCI Corporation)
DRV - (sscdserd) – C:\Windows\System32\drivers\sscdserd.sys (MCCI Corporation)
DRV - (sscdbus) – C:\Windows\System32\drivers\sscdbus.sys (MCCI Corporation)
DRV - (sscdmdfl) – C:\Windows\System32\drivers\sscdmdfl.sys (MCCI Corporation)
DRV - (Revoflt) – C:\Windows\System32\drivers\revoflt.sys (VS Revo Group)
DRV - (Serial) – C:\Windows\System32\drivers\serial.sys (Brother Industries Ltd.)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.yahoo.com/?ilc=8&fr=mkg029
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/?ilc=8&fr=mkg029
IE - HKLM\..\SearchScopes,DefaultScope = {36668FFD-7809-43FB-A609-999C5A7AB5FE}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKLM\..\SearchScopes\{36668FFD-7809-43FB-A609-999C5A7AB5FE}: "URL" = http://search.foxtab.com/?q={searchTerms}&…mp;cr=344294484

IE - HKU\.DEFAULT\..\URLSearchHook: {A3BC75A2-1F87-4686-AA43-5347D756017C} - No CLSID value found
IE - HKU\.DEFAULT\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKU\.DEFAULT\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}…amp;FORM=IE8SRC
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-18\..\URLSearchHook: {A3BC75A2-1F87-4686-AA43-5347D756017C} - No CLSID value found
IE - HKU\S-1-5-18\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKU\S-1-5-18\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}…amp;FORM=IE8SRC
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-21-1020532669-3928529439-608603026-1000\SOFTWARE\Microsoft\Internet Explorer\Main,BrowserMngr Start Page = http://search.babylon.com/?affID=110795&am…000002564d80f68
IE - HKU\S-1-5-21-1020532669-3928529439-608603026-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = Preserve
IE - HKU\S-1-5-21-1020532669-3928529439-608603026-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://search.babylon.com/?affID=110795&am…000002564d80f68
IE - HKU\S-1-5-21-1020532669-3928529439-608603026-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://www.msn.com/
IE - HKU\S-1-5-21-1020532669-3928529439-608603026-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = en-us
IE - HKU\S-1-5-21-1020532669-3928529439-608603026-1000\..\URLSearchHook: - No CLSID value found
IE - HKU\S-1-5-21-1020532669-3928529439-608603026-1000\..\SearchScopes,BrowserMngrDefaultScope = {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}
IE - HKU\S-1-5-21-1020532669-3928529439-608603026-1000\..\SearchScopes,DefaultScope = {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}
IE - HKU\S-1-5-21-1020532669-3928529439-608603026-1000\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}…amp;FORM=IE8SRC
IE - HKU\S-1-5-21-1020532669-3928529439-608603026-1000\..\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}: "URL" = http://search.babylon.com/?q={searchTerms}…000002564d80f68
IE - HKU\S-1-5-21-1020532669-3928529439-608603026-1000\..\SearchScopes\{171DEBEB-C3D4-40b7-AC73-056A5EBA4A7E}: "URL" = http://websearch.ask.com/redirect?client=i…0E-BF5800F1E5F5
IE - HKU\S-1-5-21-1020532669-3928529439-608603026-1000\..\SearchScopes\{36668FFD-7809-43FB-A609-999C5A7AB5FE}: "URL" = http://search.foxtab.com/?q={searchTerms}&…mp;cr=344294484
IE - HKU\S-1-5-21-1020532669-3928529439-608603026-1000\..\SearchScopes\{85BB23C7-0F67-4250-6758-200ACEDDE7FE}: "URL" = http://www.bing.com/search?q={searchTerms}…eferrer:source}
IE - HKU\S-1-5-21-1020532669-3928529439-608603026-1000\..\SearchScopes\{95B7759C-8C7F-4BF1-B163-73684A933233}: "URL" = https://isearch.avg.com/search?cid={01096D0…mp;d=2012-07-20 14:49:11&v=12.1.0.20&sap=dsp&q={searchTerms}
IE - HKU\S-1-5-21-1020532669-3928529439-608603026-1000\..\SearchScopes\{AE50F836-ADB3-4C15-A150-E81640EBD168}: "URL" = http://search.avg.com/route/?d=4c7c5d55&am…=b&ychte=us
IE - HKU\S-1-5-21-1020532669-3928529439-608603026-1000\..\SearchScopes\{CFF4DB9B-135F-47c0-9269-B4C6572FD61A}: "URL" = http://mystart.incredimail.com//?search={s…p;a=1pb92YCqZe4
IE - HKU\S-1-5-21-1020532669-3928529439-608603026-1000\..\SearchScopes\{DECA3892-BA8F-44b8-A993-A466AD694AE4}: "URL" = http://search.yahoo.com/search?p={searchTerms}&fr=mkg028
IE - HKU\S-1-5-21-1020532669-3928529439-608603026-1000\..\SearchScopes\{EC23C1C8-47E1-22F0-FF5D-CD82BE4273C8}: "URL" = http://www.bing.com/search?q={searchTerms}…eferrer:source}
IE - HKU\S-1-5-21-1020532669-3928529439-608603026-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..browser.search.defaultenginename: "Search the web (Babylon)"
FF - prefs.js..browser.search.order.1: "Search the web (Babylon)"
FF - prefs.js..browser.search.selectedEngine: "Search the web (Babylon)"
FF - prefs.js..browser.startup.homepage: "http://search.babylon.com/?affID=110795&tt=bandext_3312_4&babsrc=HP_ss&mntrId=728114cc000000000000002564d80f68"

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32_11_3_300_271.dll ()
FF - HKLM\Software\MozillaPlugins\@canon.com/EPPEX: C:\Program Files\Canon\Easy-PhotoPrint EX\NPEZFFPI.DLL (CANON INC.)
FF - HKLM\Software\MozillaPlugins\@docu-track.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf: File not found
FF - HKLM\Software\MozillaPlugins\@ei.CouponAlert_2p.com/Plugin: C:\Program Files\CouponAlert_2pEI\Installr\5.bin\NP2pEISB.dll (CouponAlert)
FF - HKLM\Software\MozillaPlugins\@funwebproducts.com/Plugin: C:\Program Files\FunWebProducts\Installr\3.bin\NPFunWeb.dll File not found
FF - HKLM\Software\MozillaPlugins\@google.com/npPicasa3,version=3.0.0: C:\Program Files\Google\Picasa3\npPicasa3.dll (Google, Inc.)
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.5.1: C:\Program Files\Oracle\JavaFX 2.1 Runtime\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.5.1: C:\Program Files\Oracle\JavaFX 2.1 Runtime\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files\Microsoft Silverlight\4.1.10329.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~1\MI4066~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\PROGRA~1\MI4066~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=14.0.8117.0416: C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKCU\Software\MozillaPlugins\@docu-track.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf: File not found
FF - HKCU\Software\MozillaPlugins\@yahoo.com/BrowserPlus,version=2.9.8: C:\Users\Patty\AppData\Local\Yahoo!\BrowserPlus\2.9.8\Plugins\npybrowserplus_2.9.8.dll (Yahoo! Inc.)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\[removed]: C:\Users\Patty\AppData\Local\RewardsArcade\498\Firefox
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 14.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012/08/17 02:25:48 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 14.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins
FF - HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions\\[removed]: C:\Users\Patty\AppData\Roaming\Mozilla\Firefox\Profiles/5erqatan.default\extensions\[removed]
FF - HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions\\{b64982b1-d112-42b5-b1e4-d3867c4533f8}: C:\ProgramData\Browser Manager\2.2.565.25\{16cdff19-861d-48e3-a751-d99a27784753}\FirefoxExtension [2012/08/17 01:35:52 | 000,000,000 | —D | M]

[2012/08/04 13:51:52 | 000,000,000 | —D | M] (No name found) – C:\Users\Patty\AppData\Roaming\mozilla\Extensions
[2012/08/21 10:53:03 | 000,000,000 | —D | M] (No name found) – C:\Users\Patty\AppData\Roaming\mozilla\Firefox\Profiles\5erqatan.default\extensions
[2012/02/10 23:22:37 | 000,000,000 | —D | M] (Garmin Communicator) – C:\Users\Patty\AppData\Roaming\mozilla\Firefox\Profiles\5erqatan.default\extensions\{195A3098-0BD5-4e90-AE22-BA1C540AFD1E}
[2012/08/14 13:00:40 | 000,000,000 | —D | M] (Yahoo! Toolbar) – C:\Users\Patty\AppData\Roaming\mozilla\Firefox\Profiles\5erqatan.default\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}
[2012/08/17 01:36:18 | 000,000,000 | —D | M] (Qwiklinx for Firefox) – C:\Users\Patty\AppData\Roaming\mozilla\Firefox\Profiles\5erqatan.default\extensions\{6921B3CC-9935-4D28-9A83-B3D824210580}
[2012/08/17 22:10:44 | 000,000,000 | —D | M] (Shop to Win 36) – C:\Users\Patty\AppData\Roaming\mozilla\Firefox\Profiles\5erqatan.default\extensions\{806215f3-1fe9-5c04-f5dd-1617f7bae315}
[2012/08/15 06:43:58 | 000,000,000 | —D | M] (My Scrap Nook) – C:\Users\Patty\AppData\Roaming\mozilla\Firefox\Profiles\5erqatan.default\extensions\12ffxtbr@MyScrapNook_12.com
[2012/08/14 13:00:41 | 000,000,000 | —D | M] (My Web Search) – C:\Users\Patty\AppData\Roaming\mozilla\Firefox\Profiles\5erqatan.default\extensions\[removed]
[2012/07/09 22:11:20 | 000,000,000 | —D | M] (PlayBryte) – C:\Users\Patty\AppData\Roaming\mozilla\Firefox\Profiles\5erqatan.default\extensions\[removed]
[2012/08/14 12:33:02 | 000,000,000 | —D | M] (No name found) – C:\Users\Patty\AppData\Roaming\mozilla\Firefox\Profiles\m1mj1ash.default-1341883794977\extensions
[2012/08/14 13:00:40 | 000,000,000 | —D | M] (My Web Search) – C:\Users\Patty\AppData\Roaming\mozilla\Firefox\Profiles\m1mj1ash.default-1341883794977\extensions\[removed]
[2012/08/14 13:00:40 | 000,000,000 | —D | M] (Yontoo) – C:\Users\Patty\AppData\Roaming\mozilla\Firefox\Profiles\m1mj1ash.default-1341883794977\extensions\[removed]
[2012/08/13 17:04:53 | 000,002,572 | —- | M] () – C:\Users\Patty\AppData\Roaming\Mozilla\Firefox\Profiles\5erqatan.default\searchplugins\askcom.xml
[2011/11/28 13:39:03 | 000,001,945 | —- | M] () – C:\Users\Patty\AppData\Roaming\Mozilla\Firefox\Profiles\5erqatan.default\searchplugins\bing-zugo.xml
[2011/11/10 11:32:08 | 000,005,423 | —- | M] () – C:\Users\Patty\AppData\Roaming\Mozilla\Firefox\Profiles\5erqatan.default\searchplugins\Foxtab Web Search.xml
[2012/01/26 23:00:03 | 000,001,800 | —- | M] () – C:\Users\Patty\AppData\Roaming\Mozilla\Firefox\Profiles\5erqatan.default\searchplugins\funmoods.xml
[2012/08/14 12:33:24 | 000,001,259 | —- | M] () – C:\Users\Patty\AppData\Roaming\Mozilla\Firefox\Profiles\5erqatan.default\searchplugins\search-the-web.xml
[2012/07/31 15:38:01 | 000,002,519 | —- | M] () – C:\Users\Patty\AppData\Roaming\Mozilla\Firefox\Profiles\5erqatan.default\searchplugins\Search_Results.xml
[2011/09/09 23:59:28 | 000,005,352 | —- | M] () – C:\Users\Patty\AppData\Roaming\Mozilla\Firefox\Profiles\5erqatan.default\searchplugins\web-browser-search.xml
[2012/08/17 21:17:18 | 000,000,000 | —D | M] (No name found) – C:\Program Files\Mozilla Firefox\extensions
[2012/08/17 21:17:18 | 000,000,000 | —D | M] (Java Console) – C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}
[2012/08/17 01:35:46 | 000,000,000 | —D | M] (No name found) – C:\Program Files\Mozilla Firefox\extensions\[removed]
[2012/07/13 20:17:47 | 000,136,672 | —- | M] (Mozilla Foundation) – C:\Program Files\mozilla firefox\components\browsercomps.dll
[2012/07/20 14:49:02 | 000,003,750 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\avg-secure-search.xml
[2012/08/17 01:35:40 | 000,002,357 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\babylon.xml
[2012/07/13 20:16:36 | 000,002,252 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\bing.xml
[2012/08/14 12:32:47 | 000,002,191 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\search.xml
[2012/07/31 15:38:01 | 000,002,519 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\Search_Results.xml
[2012/07/13 20:16:36 | 000,002,040 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\twitter.xml

========== Chrome ==========

CHR - homepage: http://search.babylon.com/?affID=110795&am…000002564d80f68
CHR - homepage: http://search.babylon.com/?affID=110795&am…000002564d80f68
CHR - Extension: No name found = C:\Users\Patty\AppData\Local\Google\Chrome\User Data\Default\Extensions\dlnembnfbcpjnepmfjmngjenhhajpdfd\2.0.0.460_0\
CHR - Extension: Qwiklinx = C:\Users\Patty\AppData\Local\Google\Chrome\User Data\Default\Extensions\dnfaglepmjgohnkcoieaijlheabmcdeo\1.2\
CHR - Extension: No name found = C:\Users\Patty\AppData\Local\Google\Chrome\User Data\Default\Extensions\jfmjfhklogoienhpfnppmbcbjfjnkonk\1.5_0\
CHR - Extension: No name found = C:\Users\Patty\AppData\Local\Google\Chrome\User Data\Default\Extensions\nnfegheljpcijmdgonkecjpcaopjlpac\1.24.366_0\

O1 HOSTS File: ([2010/09/13 15:26:31 | 000,419,251 | —- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 www.007guard.com
O1 - Hosts: 127.0.0.1 007guard.com
O1 - Hosts: 127.0.0.1 008i.com
O1 - Hosts: 127.0.0.1 www.008k.com
O1 - Hosts: 127.0.0.1 008k.com
O1 - Hosts: 127.0.0.1 www.00hq.com
O1 - Hosts: 127.0.0.1 00hq.com
O1 - Hosts: 127.0.0.1 010402.com
O1 - Hosts: 127.0.0.1 www.032439.com
O1 - Hosts: 127.0.0.1 032439.com
O1 - Hosts: 127.0.0.1 www.0scan.com
O1 - Hosts: 127.0.0.1 0scan.com
O1 - Hosts: 127.0.0.1 1000gratisproben.com
O1 - Hosts: 127.0.0.1 www.1000gratisproben.com
O1 - Hosts: 127.0.0.1 1001namen.com
O1 - Hosts: 127.0.0.1 www.1001namen.com
O1 - Hosts: 127.0.0.1 100888290cs.com
O1 - Hosts: 127.0.0.1 www.100888290cs.com
O1 - Hosts: 127.0.0.1 www.100sexlinks.com
O1 - Hosts: 127.0.0.1 100sexlinks.com
O1 - Hosts: 127.0.0.1 10sek.com
O1 - Hosts: 127.0.0.1 www.10sek.com
O1 - Hosts: 127.0.0.1 www.1-2005-search.com
O1 - Hosts: 127.0.0.1 1-2005-search.com
O1 - Hosts: 127.0.0.1 123fporn.info
O1 - Hosts: 14465 more lines…
O2 - BHO: (no name) - {2EECD738-5844-4a99-B4B6-146BF802613B} - No CLSID value found.
O2 - BHO: (Qwiklinx) - {3E7C8B5A-96AB-438F-BF9B-782400655440} - C:\Users\Patty\AppData\Roaming\Qwiklinx\Qwiklinx.dll (Qwiklinx, Inc.)
O2 - BHO: (Java™ Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Oracle\JavaFX 2.1 Runtime\bin\ssv.dll (Oracle Corporation)
O2 - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office2010\Office14\URLREDIR.DLL (Microsoft Corporation)
O2 - BHO: (Java™ Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Oracle\JavaFX 2.1 Runtime\bin\jp2ssv.dll (Oracle Corporation)
O3 - HKLM\..\Toolbar: (no name) - {D0F4A166-B8D4-48b8-9D63-80849FE137CB} - No CLSID value found.
O3 - HKU\S-1-5-21-1020532669-3928529439-608603026-1000\..\Toolbar\WebBrowser: (no name) - {98279C38-DE4B-4BCF-93C9-8EC26069D6F4} - No CLSID value found.
O3 - HKU\S-1-5-21-1020532669-3928529439-608603026-1000\..\Toolbar\WebBrowser: (no name) - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - No CLSID value found.
O3 - HKU\S-1-5-21-1020532669-3928529439-608603026-1000\..\Toolbar\WebBrowser: (no name) - {D4027C7F-154A-4066-A1AD-4243D8127440} - No CLSID value found.
O3 - HKU\S-1-5-21-1020532669-3928529439-608603026-1000\..\Toolbar\WebBrowser: (no name) - {E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39} - No CLSID value found.
O4 - HKLM..\Run: [MSC] C:\Program Files\Microsoft Security Client\msseces.exe (Microsoft Corporation)
O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (Microsoft Corporation)
O4 - HKU\S-1-5-20..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (Microsoft Corporation)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O8 - Extra context menu item: Add to Google Photos Screensa&ver - C:\Windows\System32\GPhotos.scr (Google Inc.)
O9 - Extra Button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office2010\Office14\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : Se&nd to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office2010\Office14\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra Button: OneNote Lin&ked Notes - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files\Microsoft Office2010\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : OneNote Lin&ked Notes - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files\Microsoft Office2010\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation)
O13 - gopher Prefix: missing
O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} http://pcpitstop.com/betapit/PCPitStop.CAB (PCPitstop Utility)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.7.0/jinstall-…indows-i586.cab (Java Plug-in 10.5.1)
O16 - DPF: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_23)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 10.5.1)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = [removed] [removed] [removed]
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{B3E4F083-98BF-476A-B54A-CA975B5E2AAD}: DhcpNameServer = [removed] [removed] [removed]
O20 - AppInit_DLLs: (c:\progra~2\browse~1\22565~1.25\{16cdf~1\browse~1.dll) - c:\ProgramData\Browser Manager\2.2.565.25\{16cdff19-861d-48e3-a751-d99a27784753}\browsemngr.dll ()
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O28 - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\Program Files\Microsoft Office2010\Office14\GROOVEEX.DLL (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009/06/10 17:42:20 | 000,000,024 | —- | M] () - C:\autoexec.bat – [ NTFS ]
O32 - AutoRun File - [2010/11/02 07:19:42 | 000,000,000 | RH-D | M] - J:\autorun – [ NTFS ]
O32 - AutoRun File - [2002/10/16 08:56:50 | 000,000,036 | RH– | M] () - J:\autorun.inf – [ NTFS ]
O33 - MountPoints2\{94aaf99a-5e9b-11e1-a4a8-002564d80f68}\Shell - "" = AutoRun
O33 - MountPoints2\{94aaf99a-5e9b-11e1-a4a8-002564d80f68}\Shell\AutoRun\command - "" = L:\TLBootstrap_WPP.exe
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)

NetSvcs: FastUserSwitchingCompatibility - File not found
NetSvcs: Ias - C:\Windows\System32\ias.dll (Microsoft Corporation)
NetSvcs: Nla - File not found
NetSvcs: Ntmssvc - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: SRService - File not found
NetSvcs: WmdmPmSp - File not found
NetSvcs: LogonHours - File not found
NetSvcs: PCAudit - File not found
NetSvcs: helpsvc - File not found
NetSvcs: uploadmgr - File not found

CREATERESTOREPOINT
Restore point Set: OTL Restore Point

========== Files/Folders - Created Within 30 Days ==========

[2012/08/20 12:26:26 | 000,000,000 | —D | C] – C:\Users\Patty\Desktop\Bunch of pictures
[2012/08/17 01:36:21 | 000,000,000 | —D | C] – C:\Users\Patty\Documents\ShopToWin
[2012/08/17 01:36:09 | 000,000,000 | —D | C] – C:\Users\Patty\AppData\Roaming\Qwiklinx
[2012/08/17 01:36:09 | 000,000,000 | —D | C] – C:\Program Files\Qwiklinx
[2012/08/17 01:36:01 | 000,000,000 | —D | C] – C:\Users\Patty\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Browser Manager
[2012/08/17 01:35:50 | 000,000,000 | —D | C] – C:\ProgramData\Browser Manager
[2012/08/17 01:35:40 | 000,000,000 | —D | C] – C:\Program Files\Shop to Win 36
[2012/08/15 16:47:54 | 000,176,640 | —- | C] (Microsoft Corporation) – C:\Windows\System32\ieui.dll
[2012/08/15 16:47:52 | 000,132,096 | —- | C] (Microsoft Corporation) – C:\Windows\System32\url.dll
[2012/08/15 16:47:51 | 001,638,912 | —- | C] (Microsoft Corporation) – C:\Windows\System32\mshtml.tlb
[2012/08/15 16:47:50 | 000,627,712 | —- | C] (Microsoft Corporation) – C:\Windows\System32\msfeeds.dll
[2012/08/15 16:47:49 | 000,048,128 | —- | C] (Microsoft Corporation) – C:\Windows\System32\jsproxy.dll
[2012/08/15 16:47:43 | 002,345,984 | —- | C] (Microsoft Corporation) – C:\Windows\System32\win32k.sys
[2012/08/15 16:47:39 | 000,400,896 | —- | C] (Microsoft Corporation) – C:\Windows\System32\srcore.dll
[2012/08/15 06:53:15 | 000,041,984 | —- | C] (Microsoft Corporation) – C:\Windows\System32\browcli.dll
[2012/08/14 12:33:24 | 000,000,000 | —D | C] – C:\Users\Patty\AppData\Local\antiphishing-vmninternethelper1_1dn
[2012/08/14 12:32:51 | 000,000,000 | —D | C] – C:\ProgramData\blekko toolbars
[2012/08/14 12:32:28 | 000,000,000 | —D | C] – C:\Program Files\blekkotb_sa5
[2012/08/14 12:32:27 | 000,000,000 | —D | C] – C:\Program Files\Chat Messenger
[2012/08/13 17:21:15 | 000,000,000 | —D | C] – C:\ProgramData\Yahoo! Companion
[2012/08/12 16:01:56 | 000,000,000 | —D | C] – C:\Users\Patty\AppData\Local\APN
[2012/08/11 19:58:35 | 000,000,000 | —D | C] – C:\Users\Patty\AppData\Local\Apple Computer
[2012/08/11 19:56:47 | 000,000,000 | —D | C] – C:\Program Files\Bonjour
[2012/08/07 00:34:10 | 000,000,000 | —D | C] – C:\Program Files\Awesome Duplicate Photo Finder
[2012/08/07 00:25:10 | 000,000,000 | —D | C] – C:\Users\Patty\AppData\Roaming\EasyDuplicateFinder
[2012/08/05 15:59:02 | 000,000,000 | —D | C] – C:\Users\Patty\AppData\Local\MyScrapNook_12
[2012/08/04 12:28:43 | 000,000,000 | —D | C] – C:\Program Files\Web Assistant
[2012/08/01 00:30:42 | 000,000,000 | —D | C] – C:\ProgramData\boost_interprocess
[2012/07/31 15:37:51 | 000,000,000 | —D | C] – C:\Program Files\Free Easy CD DVD Burner
[2012/07/29 23:23:51 | 000,000,000 | —D | C] – C:\Users\Patty\Documents\Reflect
[2012/07/29 23:04:00 | 000,000,000 | —D | C] – C:\ProgramData\Macrium
[2012/07/29 23:02:50 | 000,000,000 | —D | C] – C:\Users\Patty\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Macrium
[2012/07/29 23:02:48 | 000,000,000 | —D | C] – C:\Program Files\Macrium
[2012/07/29 18:40:50 | 000,000,000 | —D | C] – C:\Users\Patty\AppData\Local\MigWiz
[2012/07/28 09:58:23 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Picasa 3
[2011/11/28 16:40:47 | 000,584,192 | —- | C] (OldTimer Tools) – C:\Program Files\OTL.exe
[1 C:\Windows\System32\*.tmp files -> C:\Windows\System32\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2012/08/21 21:22:44 | 000,000,830 | —- | M] () – C:\Windows\tasks\Adobe Flash Player Updater.job
[2012/08/21 21:22:43 | 000,067,584 | –S- | M] () – C:\Windows\bootstat.dat
[2012/08/21 18:00:00 | 000,000,444 | —- | M] () – C:\Windows\tasks\ParetoLogic Registration3.job
[2012/08/21 13:05:01 | 000,015,152 | -H– | M] () – C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2012/08/21 13:05:01 | 000,015,152 | -H– | M] () – C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2012/08/21 13:02:08 | 000,626,040 | —- | M] () – C:\Windows\System32\perfh009.dat
[2012/08/21 13:02:08 | 000,107,316 | —- | M] () – C:\Windows\System32\perfc009.dat
[2012/08/21 12:57:47 | 2388,381,696 | -HS- | M] () – C:\hiberfil.sys
[2012/08/21 11:50:44 | 000,000,448 | —- | M] () – C:\Users\Patty\Documents\cc_20120821_115040.reg
[2012/08/20 21:27:21 | 000,005,977 | —- | M] () – C:\Users\Patty\Desktop\GROCERIES.odt
[2012/08/19 09:42:04 | 000,000,382 | —- | M] () – C:\Windows\tasks\RegSERVO.job
[2012/08/19 09:42:04 | 000,000,376 | —- | M] () – C:\Windows\tasks\XoftSpySE.job
[2012/08/17 12:56:35 | 000,002,190 | —- | M] () – C:\Users\Patty\Documents\cc_20120817_125630.reg
[2012/08/17 12:34:50 | 000,000,302 | —- | M] () – C:\Users\Patty\Documents\cc_20120817_123438.reg
[2012/08/17 12:33:03 | 000,007,468 | —- | M] () – C:\Users\Patty\Documents\cc_20120817_123257.reg
[2012/08/17 01:36:00 | 000,000,312 | —- | M] () – C:\user.js
[2012/08/16 03:41:02 | 000,000,418 | —- | M] () – C:\Windows\tasks\ParetoLogic Update Version3.job
[2012/08/16 03:18:10 | 000,487,232 | —- | M] () – C:\Windows\System32\FNTCACHE.DAT
[2012/08/15 09:42:54 | 000,426,184 | —- | M] (Adobe Systems Incorporated) – C:\Windows\System32\FlashPlayerApp.exe
[2012/08/15 09:42:54 | 000,070,344 | —- | M] (Adobe Systems Incorporated) – C:\Windows\System32\FlashPlayerCPLApp.cpl
[2012/08/13 20:12:51 | 001,528,314 | —- | M] () – C:\Users\Patty\Documents\P1020734.JPG
[2012/07/29 23:02:50 | 000,002,929 | —- | M] () – C:\Users\Patty\Desktop\Reflect.lnk
[1 C:\Windows\System32\*.tmp files -> C:\Windows\System32\*.tmp -> ]

========== Files Created - No Company Name ==========

[2012/08/21 11:50:42 | 000,000,448 | —- | C] () – C:\Users\Patty\Documents\cc_20120821_115040.reg
[2012/08/20 12:13:21 | 000,005,977 | —- | C] () – C:\Users\Patty\Desktop\GROCERIES.odt
[2012/08/17 12:56:33 | 000,002,190 | —- | C] () – C:\Users\Patty\Documents\cc_20120817_125630.reg
[2012/08/17 12:34:40 | 000,000,302 | —- | C] () – C:\Users\Patty\Documents\cc_20120817_123438.reg
[2012/08/17 12:33:00 | 000,007,468 | —- | C] () – C:\Users\Patty\Documents\cc_20120817_123257.reg
[2012/08/17 01:36:00 | 000,000,312 | —- | C] () – C:\user.js
[2012/08/13 20:12:49 | 001,528,314 | —- | C] () – C:\Users\Patty\Documents\P1020734.JPG
[2012/07/29 23:02:50 | 000,002,929 | —- | C] () – C:\Users\Patty\Desktop\Reflect.lnk
[2012/07/20 14:27:03 | 000,027,520 | —- | C] () – C:\Users\Patty\AppData\Local\dt.dat
[2012/03/17 00:25:18 | 000,000,017 | —- | C] () – C:\Users\Patty\AppData\Local\resmon.resmoncfg
[2012/02/10 23:29:32 | 000,021,316 | —- | C] () – C:\Windows\System32\emptyregdb.dat
[2011/09/26 11:00:27 | 000,000,117 | —- | C] () – C:\Windows\restore.INI
[2011/04/17 19:19:47 | 000,000,064 | —- | C] () – C:\Windows\GPlrLanc.dat
[2010/09/20 12:47:55 | 000,103,784 | —- | C] () – C:\Users\Patty\GoToAssistDownloadHelper.exe
[2010/08/30 19:54:35 | 000,000,234 | —- | C] () – C:\Windows\wininit.ini
[2010/08/25 20:30:02 | 000,439,308 | —- | C] () – C:\Windows\System32\igcompkrng500.bin
[2010/08/25 20:30:00 | 000,982,240 | —- | C] () – C:\Windows\System32\igkrng500.bin
[2010/08/25 20:30:00 | 000,092,356 | —- | C] () – C:\Windows\System32\igfcg500m.bin
[2010/08/25 19:59:08 | 000,004,096 | —- | C] ( ) – C:\Windows\System32\IGFXDEVLib.dll
[2010/08/25 19:57:00 | 000,000,151 | —- | C] () – C:\Windows\System32\GfxUI.exe.config
[2010/08/25 19:52:00 | 000,208,896 | —- | C] () – C:\Windows\System32\iglhsip32.dll
[2010/08/25 19:52:00 | 000,143,360 | —- | C] () – C:\Windows\System32\iglhcp32.dll

========== Custom Scans ==========

< %SYSTEMDRIVE%\*.exe >

< MD5 for: EXPLORER.EXE >
[2011/02/26 01:19:21 | 002,616,320 | —- | M] (Microsoft Corporation) MD5=0FB9C74046656D1579A64660AD67B746 – C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.21669_none_54149f9ef14031fc\explorer.exe
[2009/07/13 21:14:20 | 002,613,248 | —- | M] (Microsoft Corporation) MD5=15BC38A7492BEFE831966ADB477CF76F – C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16385_none_518afd35db100430\explorer.exe
[2011/02/26 01:51:13 | 002,614,784 | —- | M] (Microsoft Corporation) MD5=255CF508D7CFB10E0794D6AC93280BD8 – C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20910_none_525b5180f3f95373\explorer.exe
[2009/10/31 01:45:39 | 002,614,272 | —- | M] (Microsoft Corporation) MD5=2626FC9755BE22F805D3CFA0CE3EE727 – C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16450_none_51a66d6ddafc2ed1\explorer.exe
[2011/02/26 01:33:07 | 002,614,784 | —- | M] (Microsoft Corporation) MD5=2AF58D15EDC06EC6FDACCE1F19482BBF – C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16768_none_51a3a583dafd0cef\explorer.exe
[2010/11/20 08:17:09 | 002,616,320 | —- | M] (Microsoft Corporation) MD5=40D777B7A95E00593EB1568C68514493 – C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17514_none_53bc10fdd7fe87ca\explorer.exe
[2011/02/25 01:30:54 | 002,616,320 | —- | M] (Microsoft Corporation) MD5=8B88EBBB05A0E56B7DCC708498C02B3E – C:\Windows\explorer.exe
[2011/02/25 01:30:54 | 002,616,320 | —- | M] (Microsoft Corporation) MD5=8B88EBBB05A0E56B7DCC708498C02B3E – C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17567_none_5389023fd8245f84\explorer.exe
[2009/08/03 01:49:47 | 002,613,248 | —- | M] (Microsoft Corporation) MD5=9FF6C4C91A3711C0A3B18F87B08B518D – C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20500_none_526619d4f3f142e6\explorer.exe
[2009/08/03 01:35:50 | 002,613,248 | —- | M] (Microsoft Corporation) MD5=B95EEB0F4E5EFBF1038A35B3351CF047 – C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16404_none_51e07e31dad00878\explorer.exe
[2009/10/31 02:00:51 | 002,614,272 | —- | M] (Microsoft Corporation) MD5=C76153C7ECA00FA852BB0C193378F917 – C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20563_none_52283b2af41f3691\explorer.exe

< MD5 for: SVCHOST.EXE >
[2009/07/13 21:14:41 | 000,020,992 | —- | M] (Microsoft Corporation) MD5=54A47F6B5E09A77E61649109C6A08866 – C:\Windows\System32\svchost.exe
[2009/07/13 21:14:41 | 000,020,992 | —- | M] (Microsoft Corporation) MD5=54A47F6B5E09A77E61649109C6A08866 – C:\Windows\winsxs\x86_microsoft-windows-services-svchost_31bf3856ad364e35_6.1.7600.16385_none_b591afc466a15356\svchost.exe
[2012/01/13 14:53:20 | 000,182,856 | —- | M] () MD5=63EEC8A8B221AB79045E776E5F592868 – C:\Program Files\Malwarebytes' Anti-Malware\Chameleon\svchost.exe

< MD5 for: USERINIT.EXE >
[2010/11/20 08:17:48 | 000,026,624 | —- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 – C:\Windows\System32\userinit.exe
[2010/11/20 08:17:48 | 000,026,624 | —- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 – C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7601.17514_none_de3024012ff21116\userinit.exe
[2009/07/13 21:14:43 | 000,026,112 | —- | M] (Microsoft Corporation) MD5=6DE80F60D7DE9CE6B8C2DDFDF79EF175 – C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7600.16385_none_dbff103933038d7c\userinit.exe

< MD5 for: WINLOGON.EXE >
[2009/10/28 02:17:59 | 000,285,696 | —- | M] (Microsoft Corporation) MD5=37CDB7E72EB66BA85A87CBE37E7F03FD – C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16447_none_6fc699643622d177\winlogon.exe
[2009/10/28 01:52:08 | 000,285,696 | —- | M] (Microsoft Corporation) MD5=3BABE6767C78FBF5FB8435FEED187F30 – C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.20560_none_703394514f56f7c2\winlogon.exe
[2012/01/13 14:53:20 | 000,182,856 | —- | M] () MD5=63EEC8A8B221AB79045E776E5F592868 – C:\Program Files\Malwarebytes' Anti-Malware\Chameleon\winlogon.exe
[2010/11/20 08:17:54 | 000,286,720 | —- | M] (Microsoft Corporation) MD5=6D13E1406F50C66E2A95D97F22C47560 – C:\Windows\System32\winlogon.exe
[2010/11/20 08:17:54 | 000,286,720 | —- | M] (Microsoft Corporation) MD5=6D13E1406F50C66E2A95D97F22C47560 – C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7601.17514_none_71ca6b0233339500\winlogon.exe
[2009/07/13 21:14:45 | 000,285,696 | —- | M] (Microsoft Corporation) MD5=8EC6A4AB12B8F3759E21F8E3A388F2CF – C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16385_none_6f99573a36451166\winlogon.exe

< %systemroot%\*. /rp /s >

========== Drive Information ==========

Physical Drives
—————

Drive: \\\\.\\PHYSICALDRIVE0 - Fixed hard disk media
Interface type: IDE
Media Type: Fixed hard disk media
Model: WDC WD3200AAKS-75L9A0 ATA Device
Partitions: 2
Status: OK
Status Info: 0

Drive: \\\\.\\PHYSICALDRIVE1 -
Interface type: USB
Media Type:
Model: TEAC USB HS-CF Card USB Device
Partitions: 0
Status: OK
Status Info: 0

Drive: \\\\.\\PHYSICALDRIVE2 -
Interface type: USB
Media Type:
Model: TEAC USB HS-xD/SM USB Device
Partitions: 0
Status: OK
Status Info: 0

Drive: \\\\.\\PHYSICALDRIVE3 -
Interface type: USB
Media Type:
Model: TEAC USB HS-MS Card USB Device
Partitions: 0
Status: OK
Status Info: 0

Drive: \\\\.\\PHYSICALDRIVE4 -
Interface type: USB
Media Type:
Model: TEAC USB HS-SD Card USB Device
Partitions: 0
Status: OK
Status Info: 0

Drive: \\\\.\\PHYSICALDRIVE5 -
Interface type: USB
Media Type:
Model: Canon MP500Storage USB Device
Partitions: 0
Status: OK
Status Info: 0

Drive: \\\\.\\PHYSICALDRIVE6 - External hard disk media
Interface type: USB
Media Type: External hard disk media
Model: WD Ext HDD 1021 USB Device
Partitions: 1
Status: OK
Status Info: 0

Partitions
—————

DeviceID: Disk #0, Partition #0
PartitionType: Installable File System
Bootable: True
BootPartition: True
PrimaryPartition: True
Size: 0.00GB
Starting Offset: 1048576
Hidden sectors: 0

DeviceID: Disk #0, Partition #1
PartitionType: Installable File System
Bootable: False
BootPartition: False
PrimaryPartition: True
Size: 298.00GB
Starting Offset: 105906176
Hidden sectors: 0

DeviceID: Disk #6, Partition #0
PartitionType: Installable File System
Bootable: False
BootPartition: False
PrimaryPartition: True
Size: 932.00GB
Starting Offset: 1048576
Hidden sectors: 0

< End of report >

Satchfan

Post #5August 22, 2012, 6:59 AM UTC

You are doing fine.

You say your icons are missing. Please do not run any temporary file cleaners, (or any other programs), unless I ask you to or you may not get them back..

We may have to run 2 or 3 scans to find out exacrly what is happening here so you will need a little patience.

You can find the Extras.txt here:

C:\Users\Patty\Downloads

Please also post the aswMBR log

Thanks

Satchfan

PattiChati

Post #6August 22, 2012, 7:22 AM UTC

I MANAGED TO GET THE ICONS BACK A COUPLE OF DAYS AGO AS I TOLD LEE, BUT UNFORTUNATELY DON'T REMEMBER HOW. I THINK I HAD A VIEW SETTING WRONG. HERE IS THE EXE FILE ile:///C:/Users/Patty/Downloads/ Up to higher level directory Name Size Last Modified File:2010HallmarkRegistrationBonusPack1.2.exe 5218 KB 9/21/2010 11:02:27 AM File:254010_10150211706444710_503029709_6632381_257719_n.jpg 56 KB 6/17/2011 7:25:38 PM File:32096_397040364709_503029709_3876544_65266_n.jpg 52 KB 6/30/2011 11:38:06 AM File:ARO2011_tbt.exe 5746 KB 5/29/2011 5:02:07 PM File:ARO2012_tbt.exe 6561 KB 7/20/2012 2:36:09 PM File:Brunch-Sept-20102.pub 269 KB 9/10/2010 2:23:35 PM File:CT2207613_00699_00706_072054_BL.EXE 41022 KB 12/9/2011 11:22:58 PM File:Capture.PNG 25 KB 8/1/2012 9:47:51 PM File:ChromeSetup (1).exe 593 KB 1/14/2012 6:54:43 PM File:ChromeSetup (2).exe 593 KB 1/14/2012 7:00:00 PM File:ChromeSetup (3).exe 593 KB 1/14/2012 7:00:11 PM File:ChromeSetup.exe 593 KB 12/2/2011 4:33:17 PM File:CommunicatorPlugin_301.exe 7199 KB 1/1/2012 1:14:03 PM File:CrystalDiskInfo4_1_3-en.exe 1673 KB 11/28/2011 3:28:59 PM File:DellDriverDownloadManager.application 10 KB 10/12/2010 9:45:54 AM File:DriverPerformer-T2FIBDCO.exe 268 KB 11/28/2011 12:37:39 PM File:DriverPerformer_V15.exe 228 KB 6/4/2011 7:57:35 AM File:Elevated_Command_Prompt.zip 1 KB 5/25/2011 8:57:19 PM File:Extras.Txt 51 KB 8/21/2012 9:52:07 PM File:Firefox Setup 8.0.1.exe 14416 KB 12/3/2011 1:19:09 PM File:Firefox Setup 8.0.exe 14409 KB 11/18/2011 10:56:56 AM File:Firefox_Setup_14.0.1.exe 16408 KB 8/17/2012 1:53:04 AM File:GarminLifetimeUpdaterInstaller.exe 12059 KB 1/1/2012 12:27:00 PM File:GarminMapUpdater_v3.0.5.exe 4187 KB 1/1/2012 7:39:14 PM File:GoToAssist.exe 1160 KB 10/4/2010 6:59:03 PM File:INTEL_CHIPSET-SOFTWARE-INSTA_A01_R230170.exe 2426 KB 9/20/2010 12:56:24 PM File:Intel_Matrix-Storage-Manager_A00_R229283.exe 329 KB 10/4/2010 7:25:23 PM File:JavaSetup6u23.exe 863 KB 9/8/2011 6:58:49 PM File:Mats_Run.devices.exe 542 KB 9/14/2010 3:50:16 PM File:MicrosoftFixit.WinMediaPlayer.Run.exe 340 KB 12/9/2011 3:58:02 PM File:MicrosoftFixit50195.msi 645 KB 2/11/2012 11:53:13 PM File:OTL.Txt 81 KB 8/21/2012 9:50:57 PM File:OTL.exe 583 KB 8/21/2012 9:43:19 PM File:QuickTimeInstaller(2).exe 37254 KB 12/20/2010 7:31:16 AM File:QuickTimeInstaller.exe 38478 KB 1/1/2012 12:17:47 PM File:RSIT.exe 764 KB 11/15/2011 1:08:42 PM File:RealPlayer.exe 585 KB 12/14/2010 2:49:56 PM File:RevoUninProSetup.exe 7677 KB 11/10/2011 10:33:05 AM File:SASUNINST.EXE 100 KB 4/29/2011 6:36:44 PM File:SUPERAntiSpyware.exe 10653 KB 4/17/2011 8:55:21 PM File:Silverlight.exe 6129 KB 9/6/2010 12:12:22 PM File:SmileboxInstaller.exe 568 KB 5/16/2011 5:14:50 PM File:TFC.exe 436 KB 12/24/2010 3:02:54 AM File:TeamViewer_Setup_en.exe 3117 KB 11/18/2011 11:23:45 AM File:TuneUp360_Setup.exe 3029 KB 5/23/2011 9:21:59 PM File:Verizon_SCH-U640_Convoy__ug_eng.pdf.pdf.djvu 1298 KB 10/18/2010 4:49:57 PM File:Windows 7 Product Guide.pdf 63445 KB 9/4/2010 4:10:16 PM File:WindowsActivationUpdate.exe 156 KB 2/10/2012 11:44:22 PM File:aswMBR.exe 4621 KB 8/21/2012 10:02:02 PM File:avg_avct_stb_all_2012_2197_ppc2.exe 3789 KB 7/20/2012 2:17:49 PM File:avg_free_stb_all_2012_2197_cnet.exe 3789 KB 7/20/2012 2:37:39 PM File:br_free_adv.msi 96578 KB 11/2/2010 8:26:44 PM File:ccsetup310.exe 3399 KB 9/4/2011 4:40:37 PM File:ccsetup313.exe 3469 KB 12/3/2011 1:53:45 PM File:ccsetup315.exe 3504 KB 1/28/2012 6:48:00 PM File:ccsetup316.exe 3543 KB 2/25/2012 12:59:54 PM File:ccsetup318.exe 3570 KB 4/26/2012 11:38:41 AM File:ccsetup319.exe 3772 KB 5/27/2012 5:36:15 PM File:ccsetup320.exe 3799 KB 6/26/2012 12:44:40 PM File:ccsetup321.exe 3817 KB 8/17/2012 12:54:48 PM File:couponprinter(5).exe 1255 KB 6/17/2011 6:12:45 PM File:dopdf-7.exe 4065 KB 12/14/2010 10:11:44 AM File:eppexwin320en.exe 44518 KB 10/4/2010 7:55:22 PM File:ezgamecheats.exe 2270 KB 2/26/2011 4:31:40 PM File:free-disk-defrag.exe 821 KB 11/2/2010 8:27:00 PM File:hairstyle-for-short-hair-2010.319143250_large.jpg 31 KB 5/20/2011 1:46:36 PM File:incredimail_install.exe 450 KB 5/16/2011 5:03:42 PM File:install_easyshare.exe 1960 KB 12/25/2010 10:14:55 AM File:install_flash_player(2).exe 2726 KB 12/14/2010 1:37:47 PM File:jenkatgame.exe 2270 KB 2/26/2011 4:39:08 PM File:jxpiinstall.exe 873 KB 7/16/2012 1:58:11 PM File:l5m-usjobsearch-dtx.exe 268 KB 9/8/2011 11:08:01 PM File:magictalk.exe 12533 KB 3/6/2011 5:22:01 PM File:mbam-setup.exe 7553 KB 5/14/2011 11:23:33 AM File:memtest86+-4.20.iso.gz 68 KB 5/23/2011 9:18:10 PM File:mozilla-firefox-toDownload.exe 1072 KB 8/17/2012 1:34:39 AM File:mp500win111ej.exe 9806 KB 10/4/2010 7:51:18 PM File:mpnmp500win202ea13.exe 9663 KB 10/4/2010 7:53:52 PM File:mpnx_4_1-win-mx360-4_1_0-ea23_2.exe 48658 KB 6/4/2011 8:07:42 AM File:mseinstall.exe 7880 KB 11/18/2011 12:11:22 PM File:msgr10us.exe 409 KB 10/22/2010 5:59:22 PM File:pic of me.jpg 10 KB 9/3/2011 3:52:20 PM File:picasa39-setup.exe 14910 KB 7/28/2012 9:57:36 AM File:postage.htm 1 KB 6/25/2012 4:55:06 PM postage_files 6/25/2012 4:55:05 PM File:reflect_setup_free.exe 32224 KB 7/29/2012 10:53:48 PM File:registrybooster(2).exe 6943 KB 5/29/2011 5:07:47 PM File:revosetup.exe 2556 KB 11/10/2011 10:32:00 AM File:setup_av_free.exe 55590 KB 5/29/2011 4:57:49 PM File:spsetup114(1).exe 4291 KB 12/7/2011 7:41:35 PM File:spsetup114.exe 4291 KB 12/7/2011 7:40:21 PM File:spybotsd162.exe 16026 KB 4/17/2011 8:41:49 PM File:winmail.dat 7 KB 9/22/2010 5:27:00 PM File:wlsetup-web.exe 1218 KB 9/27/2010 7:20:39 PM File:xlw3228.exe 4160 KB 2/21/2011 3:14:44 PM File:yahoo_firefox_3.6.10_setup_us.exe 8579 KB 12/9/2010 7:11:02 PM File:yahoomailuploader_0.5(3).exe 1109 KB 7/3/2011 7:49:48 AM asmMNR.exe aswMBR version 0.9.9.1665 Copyright© 2011 AVAST Software Run date: 2012-08-21 22:02:08 —————————– 22:02:08.555 OS Version: Windows 6.1.7601 Service Pack 1 22:02:08.555 Number of processors: 2 586 0x170A 22:02:08.555 ComputerName: PATTI-PC UserName: Patty 22:02:09.965 Initialize success 22:02:56.828 AVAST engine defs: 12082100 22:03:04.755 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-0 22:03:04.755 Disk 0 Vendor: WDC_WD3200AAKS-75L9A0 01.03E01 Size: 305245MB BusType: 11 22:03:04.771 Disk 0 MBR read successfully 22:03:04.787 Disk 0 MBR scan 22:03:04.787 Disk 0 Windows 7 default MBR code 22:03:04.802 Disk 0 Partition 1 80 (A) 07 HPFS/NTFS NTFS 100 MB offset 2048 22:03:04.865 Disk 0 Partition 2 00 07 HPFS/NTFS NTFS 305143 MB offset 206848 22:03:04.896 Disk 0 scanning sectors +625139712 22:03:05.021 Disk 0 scanning C:\Windows\system32\drivers 22:03:18.032 Service scanning 22:03:29.469 Service MpKsl3563227f C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{417F43BA-7559-4DA4-A569-5FAD26498D6C}\MpKsl3563227f.sys **LOCKED** 32 22:03:43.308 Modules scanning 22:03:49.782 Disk 0 trace - called modules: 22:03:49.813 ntkrnlpa.exe CLASSPNP.SYS disk.sys ACPI.sys halmacpi.dll ataport.SYS PCIIDEX.SYS msahci.sys intelppm.sys 22:03:49.813 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x865a2030] 22:03:49.813 3 CLASSPNP.SYS[8b7ae59e] -> nt!IofCallDriver -> [0x8649cc10] 22:03:49.829 5 ACPI.sys[8b2b13d4] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP0T0L0-0[0x860b3030] 22:03:50.874 AVAST engine scan C:\Windows 22:03:52.761 AVAST engine scan C:\Windows\system32 22:06:40.751 AVAST engine scan C:\Windows\system32\drivers 22:06:55.414 AVAST engine scan C:\Users\Patty 22:07:45.957 Disk 0 MBR has been saved successfully to "C:\Users\Patty\Desktop\MBR.dat" 22:07:45.973 The log file has been saved successfully to "C:\Users\Patty\Desktop\aswMBR.txt"

PattiChati

Post #7August 22, 2012, 7:26 AM UTC

I am not doing anything with my computer except read email or enter numbers in my excel file. No downloads or scans or anything besides just looking, not changing a thing.

Satchfan

Post #8August 22, 2012, 7:32 AM UTC

Thanks for the aswMBR log.

The other one I need is located in your downloads folder and is called Extras.txt

PattiChati

Post #9August 22, 2012, 1:37 PM UTC

📎Extras.Txt Is that it?

Satchfan

Post #10August 22, 2012, 2:17 PM UTC

Hi Patti

I can see why you are having Internet problems as you do have a lot of infections but it appears mostly to be adware/spyware but we’ll do some further checks to be sure.

Uninstall the following program, if present:

Qwiklinx
Java™ 6 Update 23 - do NOT uninstall Java™ 7 Update 5
1. Click Start, Control Panel, Programs, and then Programs and Features.
2. A new dialog box appears, Adjust your computer's settings. Choose Programs. Click on it.
3. Click on Qwiklinx, and then Uninstall. Repeat this for all versions of Java or JRE runtime EXCEPT Java™ 7 Update 5.
If you are prompted for an administrator password or confirmation, type the password or provide confirmation.

I see you have Revo Uninstaller Pro so if it doesn’t uninstall Qwiklinx normally, use that to uninstall it.

===================================================

Run AVG removal tool

There are some remnants of AVG on your computer even after the uninstall so please download and run AVG Removal Tool from here.

===================================================

Run OTL

double click on the icon to run it.

copy/paste ALL the following text written inside the code box into the Custom Scans/Fixes box located at the bottom of OTL

:Services :OTL PRC - C:\ProgramData\Browser Manager\2.2.565.25\{16cdff19-861d-48e3-a751-d99a27784753}\browsemngr.exe () IE - HKU\S-1-5-18\..\URLSearchHook: {A3BC75A2-1F87-4686-AA43-5347D756017C} - No CLSID value found IE - HKU\S-1-5-21-1020532669-3928529439-608603026-1000\SOFTWARE\Microsoft\Internet Explorer\Main,BrowserMngr Start Page = http://search.babylon.com/?affID=110795&am…000002564d80f68 IE - HKU\S-1-5-21-1020532669-3928529439-608603026-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://search.babylon.com/?affID=110795&am…000002564d80f68 IE - HKU\S-1-5-21-1020532669-3928529439-608603026-1000\..\URLSearchHook: - No CLSID value found IE - HKU\S-1-5-21-1020532669-3928529439-608603026-1000\..\SearchScopes,BrowserMngrDefaultScope = {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9} IE - HKU\S-1-5-21-1020532669-3928529439-608603026-1000\..\SearchScopes,DefaultScope = {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9} IE - HKU\S-1-5-21-1020532669-3928529439-608603026-1000\..\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}: "URL" = http://search.babylon.com/?q={searchTerms}…000002564d80f68 IE - HKU\S-1-5-21-1020532669-3928529439-608603026-1000\..\SearchScopes\{171DEBEB-C3D4-40b7-AC73-056A5EBA4A7E}: "URL" = http://websearch.ask.com/redirect?client=i…0E-BF5800F1E5F5 IE - HKU\S-1-5-21-1020532669-3928529439-608603026-1000\..\SearchScopes\{95B7759C-8C7F-4BF1-B163-73684A933233}: "URL" = https://isearch.avg.com/search?cid={01096D0…mp;d=2012-07-20 14:49:11&v=12.1.0.20&sap=dsp&q={searchTerms} IE - HKU\S-1-5-21-1020532669-3928529439-608603026-1000\..\SearchScopes\{AE50F836-ADB3-4C15-A150-E81640EBD168}: "URL" = http://search.avg.com/route/?d=4c7c5d55&am…=b&ychte=us IE - HKU\S-1-5-21-1020532669-3928529439-608603026-1000\..\SearchScopes\{CFF4DB9B-135F-47c0-9269-B4C6572FD61A}: "URL" = http://mystart.incredimail.com//?search={s…p;a=1pb92YCqZe4 FF - prefs.js..browser.search.defaultenginename: "Search the web (Babylon)" FF - prefs.js..browser.search.order.1: "Search the web (Babylon)" FF - prefs.js..browser.search.selectedEngine: "Search the web (Babylon)" FF - prefs.js..browser.startup.homepage: "http://search.babylon.com/?affID=110795&tt=bandext_3312_4&babsrc=HP_ss&mntrId=728114cc000000000000002564d80f68" FF - HKLM\Software\MozillaPlugins\@docu-track.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf: File not found FF - HKLM\Software\MozillaPlugins\@ei.CouponAlert_2p.com/Plugin: C:\Program Files\CouponAlert_2pEI\Installr\5.bin\NP2pEISB.dll (CouponAlert) FF - HKLM\Software\MozillaPlugins\@funwebproducts.com/Plugin: C:\Program Files\FunWebProducts\Installr\3.bin\NPFunWeb.dll File not found FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\[removed]: C:\Users\Patty\AppData\Local\RewardsArcade\498\Firefox FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 14.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012/08/17 02:25:48 | 000,000,000 | —D | M] [2012/08/17 01:36:18 | 000,000,000 | —D | M] (Qwiklinx for Firefox) – C:\Users\Patty\AppData\Roaming\mozilla\Firefox\Profiles\5erqatan.default\extensions\{6921B3CC-9935-4D28-9A83-B3D824210580} [2012/08/17 22:10:44 | 000,000,000 | —D | M] (Shop to Win 36) – C:\Users\Patty\AppData\Roaming\mozilla\Firefox\Profiles\5erqatan.default\extensions\{806215f3-1fe9-5c04-f5dd-1617f7bae315} [2012/08/15 06:43:58 | 000,000,000 | —D | M] (My Scrap Nook) – C:\Users\Patty\AppData\Roaming\mozilla\Firefox\Profiles\5erqatan.default\extensions\12ffxtbr@MyScrapNook_12.com [2012/08/14 13:00:41 | 000,000,000 | —D | M] (My Web Search) – C:\Users\Patty\AppData\Roaming\mozilla\Firefox\Profiles\5erqatan.default\extensions\[removed] [2012/07/09 22:11:20 | 000,000,000 | —D | M] (PlayBryte) – C:\Users\Patty\AppData\Roaming\mozilla\Firefox\Profiles\5erqatan.default\extensions\[removed] [2012/08/14 12:33:02 | 000,000,000 | —D | M] (No name found) – C:\Users\Patty\AppData\Roaming\mozilla\Firefox\Profiles\m1mj1ash.default-1341883794977\extensions [2012/08/14 13:00:40 | 000,000,000 | —D | M] (My Web Search) – C:\Users\Patty\AppData\Roaming\mozilla\Firefox\Profiles\m1mj1ash.default-1341883794977\extensions\[removed] [2012/08/14 13:00:40 | 000,000,000 | —D | M] (Yontoo) – C:\Users\Patty\AppData\Roaming\mozilla\Firefox\Profiles\m1mj1ash.default-1341883794977\extensions\[removed] [2012/08/13 17:04:53 | 000,002,572 | —- | M] () – C:\Users\Patty\AppData\Roaming\Mozilla\Firefox\Profiles\5erqatan.default\searchplugins\askcom.xml [2011/11/28 13:39:03 | 000,001,945 | —- | M] () – C:\Users\Patty\AppData\Roaming\Mozilla\Firefox\Profiles\5erqatan.default\searchplugins\bing-zugo.xml [2011/11/10 11:32:08 | 000,005,423 | —- | M] () – C:\Users\Patty\AppData\Roaming\Mozilla\Firefox\Profiles\5erqatan.default\searchplugins\Foxtab Web Search.xml [2012/01/26 23:00:03 | 000,001,800 | —- | M] () – C:\Users\Patty\AppData\Roaming\Mozilla\Firefox\Profiles\5erqatan.default\searchplugins\funmoods.xml [2012/08/14 12:33:24 | 000,001,259 | —- | M] () – C:\Users\Patty\AppData\Roaming\Mozilla\Firefox\Profiles\5erqatan.default\searchplugins\search-the-web.xml [2012/07/31 15:38:01 | 000,002,519 | —- | M] () – C:\Users\Patty\AppData\Roaming\Mozilla\Firefox\Profiles\5erqatan.default\searchplugins\Search_Results.xml [2011/09/09 23:59:28 | 000,005,352 | —- | M] () – C:\Users\Patty\AppData\Roaming\Mozilla\Firefox\Profiles\5erqatan.default\searchplugins\web-browser-search.xml [2012/08/17 21:17:18 | 000,000,000 | —D | M] (No name found) – C:\Program Files\Mozilla Firefox\extensions [2012/08/14 12:32:47 | 000,002,191 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\search.xml [2012/07/31 15:38:01 | 000,002,519 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\Search_Results.xml [2012/08/17 01:35:46 | 000,000,000 | —D | M] (No name found) – C:\Program Files\Mozilla Firefox\extensions\[removed] [2012/08/17 01:35:40 | 000,002,357 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\babylon.xml CHR - homepage: http://search.babylon.com/?affID=110795&am…000002564d80f68 CHR - homepage: http://search.babylon.com/?affID=110795&am…000002564d80f68 CHR - Extension: No name found = C:\Users\Patty\AppData\Local\Google\Chrome\User Data\Default\Extensions\dlnembnfbcpjnepmfjmngjenhhajpdfd\2.0.0.460_0\ CHR - Extension: Qwiklinx = C:\Users\Patty\AppData\Local\Google\Chrome\User Data\Default\Extensions\dnfaglepmjgohnkcoieaijlheabmcdeo\1.2\ CHR - Extension: No name found = C:\Users\Patty\AppData\Local\Google\Chrome\User Data\Default\Extensions\jfmjfhklogoienhpfnppmbcbjfjnkonk\1.5_0\ CHR - Extension: No name found = C:\Users\Patty\AppData\Local\Google\Chrome\User Data\Default\Extensions\nnfegheljpcijmdgonkecjpcaopjlpac\1.24.366_0\ O2 - BHO: (no name) - {2EECD738-5844-4a99-B4B6-146BF802613B} - No CLSID value found. O2 - BHO: (Qwiklinx) - {3E7C8B5A-96AB-438F-BF9B-782400655440} - C:\Users\Patty\AppData\Roaming\Qwiklinx\Qwiklinx.dll (Qwiklinx, Inc.) O3 - HKLM\..\Toolbar: (no name) - {D0F4A166-B8D4-48b8-9D63-80849FE137CB} - No CLSID value found. O3 - HKU\S-1-5-21-1020532669-3928529439-608603026-1000\..\Toolbar\WebBrowser: (no name) - {98279C38-DE4B-4BCF-93C9-8EC26069D6F4} - No CLSID value found O3 - HKU\S-1-5-21-1020532669-3928529439-608603026-1000\..\Toolbar\WebBrowser: (no name) - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - No CLSID value found O3 - HKU\S-1-5-21-1020532669-3928529439-608603026-1000\..\Toolbar\WebBrowser: (no name) - {D4027C7F-154A-4066-A1AD-4243D8127440} - No CLSID value found O3 - HKU\S-1-5-21-1020532669-3928529439-608603026-1000\..\Toolbar\WebBrowser: (no name) - {E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39} - No CLSID value found O20 - AppInit_DLLs: (c:\progra~2\browse~1\22565~1.25\{16cdf~1\browse~1.dll) - c:\ProgramData\Browser Manager\2.2.565.25\{16cdff19-861d-48e3-a751-d99a27784753}\browsemngr.dll () [2012/08/17 01:36:21 | 000,000,000 | —D | C] – C:\Users\Patty\Documents\ShopToWin [2012/08/17 01:36:09 | 000,000,000 | —D | C] – C:\Users\Patty\AppData\Roaming\Qwiklinx [2012/08/17 01:36:09 | 000,000,000 | —D | C] – C:\Program Files\Qwiklinx [2012/08/17 01:36:01 | 000,000,000 | —D | C] – C:\Users\Patty\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Browser Manager [2012/08/17 01:35:50 | 000,000,000 | —D | C] – C:\ProgramData\Browser Manager [2012/08/17 01:35:40 | 000,000,000 | —D | C] – C:\Program Files\Shop to Win 36 [2012/08/14 12:32:51 | 000,000,000 | —D | C] – C:\ProgramData\blekko toolbars [2012/08/14 12:32:28 | 000,000,000 | —D | C] – C:\Program Files\blekkotb_sa5 [2012/08/14 12:32:27 | 000,000,000 | —D | C] – C:\Program Files\Chat Messenger [2012/08/04 12:28:43 | 000,000,000 | —D | C] – C:\Program Files\Web Assistant [2012/08/17 12:56:35 | 000,002,190 | —- | M] () – C:\Users\Patty\Documents\cc_20120817_125630.reg [2012/08/17 12:34:50 | 000,000,302 | —- | M] () – C:\Users\Patty\Documents\cc_20120817_123438.reg [2012/08/17 12:33:03 | 000,007,468 | —- | M] () – C:\Users\Patty\Documents\cc_20120817_123257.reg [2012/08/17 01:36:00 | 000,000,312 | —- | M] () – C:\user.js :Files ipconfig /flushdns /c C:\ProgramData\Browser Manager C:\Users\Patty\AppData\Local\Google\Chrome\User Data\Default\Extensions :Commands [purity] [emptytemp] [Reboot]

click the Run Fix button at the top
let the program run unhindered, reboot when it is done
post a new OTL log (don't check the boxes beside LOP Check or Purity this time)

Logs to include in the next post:

OTL fix log
New OTL log

Satchfan

PattiChati

Post #11August 22, 2012, 3:01 PM UTC

when I run the new otl log do I still add the following and do everything I did before. When doing the scans, got the error "attempt to install a browser toolbar was blocked" netsvcs %SYSTEMDRIVE%\*.exe /md5start explorer.exe winlogon.exe Userinit.exe svchost.exe consrv.dll /md5stop %systemroot%\*. /rp /s DRIVES CREATERESTOREPOINT

Satchfan

Post #12August 22, 2012, 3:18 PM UTC last edited August 22, 2012, 3:25 PM UTC

got the error "attempt to install a browser toolbar was blocked"

Did OTL run after that?

when I run the new otl log do I still add the following and do everything I did before

No, sorry if I wasn't clear.

Run OTL

open OTL again and click the Quick Scan button (don't check the boxes beside LOP Check or Purity this time)
post the OTL.txt log it produces in your next reply.

Satchfan

PattiChati

Post #13August 22, 2012, 3:32 PM UTC

HERE IS THE NEW OTL SCAN

OTL logfile created on: 8/22/2012 11:26:05 AM - Run 2
OTL by OldTimer - Version 3.2.58.1 Folder = C:\Users\Patty\Downloads
Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7601.17514)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

2.97 Gb Total Physical Memory | 1.81 Gb Available Physical Memory | 60.90% Memory free
5.93 Gb Paging File | 4.80 Gb Available in Paging File | 80.90% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 297.99 Gb Total Space | 191.65 Gb Free Space | 64.32% Space Free | Partition Type: NTFS
Drive J: | 931.51 Gb Total Space | 590.95 Gb Free Space | 63.44% Space Free | Partition Type: NTFS

Computer Name: PATTI-PC | User Name: Patty | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Users\Patty\Downloads\OTL(1).exe (OldTimer Tools)
PRC - C:\ProgramData\Browser Manager\2.2.565.25\{16cdff19-861d-48e3-a751-d99a27784753}\browsemngr.exe ()
PRC - C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
PRC - C:\Windows\System32\Macromed\Flash\FlashPlayerPlugin_11_3_300_262.exe (Adobe Systems, Inc.)
PRC - C:\Program Files\Macrium\Reflect\ReflectService.exe ()
PRC - C:\Program Files\Microsoft Security Client\msseces.exe (Microsoft Corporation)
PRC - C:\Program Files\Microsoft Security Client\MsMpEng.exe (Microsoft Corporation)
PRC - C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated)
PRC - C:\Windows\System32\conhost.exe (Microsoft Corporation)
PRC - C:\Windows\explorer.exe (Microsoft Corporation)
PRC - C:\Windows\System32\taskhost.exe (Microsoft Corporation)
PRC - C:\Windows\System32\schtasks.exe (Microsoft Corporation)

========== Modules (No Company Name) ==========

MOD - C:\ProgramData\Browser Manager\2.2.565.25\{16cdff19-861d-48e3-a751-d99a27784753}\browsemngr.exe ()
MOD - C:\Program Files\Mozilla Firefox\mozjs.dll ()
MOD - C:\Windows\System32\Macromed\Flash\NPSWF32_11_3_300_262.dll ()
MOD - C:\Program Files\Common Files\microsoft shared\OFFICE14\Cultures\OFFICE.ODF ()
MOD - C:\Program Files\Microsoft Office2010\Office14\1033\GrooveIntlResource.dll ()

========== Win32 Services (SafeList) ==========

SRV - (Browser Manager) – C:\ProgramData\Browser Manager\2.2.565.25\{16cdff19-861d-48e3-a751-d99a27784753}\browsemngr.exe ()
SRV - (AdobeFlashPlayerUpdateSvc) – C:\Windows\System32\Macromed\Flash\FlashPlayerUpdateService.exe (Adobe Systems Incorporated)
SRV - (MozillaMaintenance) – C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe (Mozilla Foundation)
SRV - (ReflectService.exe) – C:\Program Files\Macrium\Reflect\ReflectService.exe ()
SRV - (NisSrv) – C:\Program Files\Microsoft Security Client\NisSrv.exe (Microsoft Corporation)
SRV - (MsMpSvc) – C:\Program Files\Microsoft Security Client\MsMpEng.exe (Microsoft Corporation)
SRV - (WatAdminSvc) – C:\Windows\System32\Wat\WatAdminSvc.exe (Microsoft Corporation)
SRV - (AdobeARMservice) – C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated)
SRV - (Microsoft SharePoint Workspace Audit Service) – C:\Program Files\Microsoft Office2010\Office14\GROOVE.EXE (Microsoft Corporation)
SRV - (sesvc) – C:\Program Files\ShadowExplorer\sesvc.exe (www.shadowexplorer.com)
SRV - (SensrSvc) – C:\Windows\System32\sensrsvc.dll (Microsoft Corporation)
SRV - (WinDefend) – C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)

========== Driver Services (SafeList) ==========

DRV - (MpKsl3563227f) – C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{417F43BA-7559-4DA4-A569-5FAD26498D6C}\MpKsl3563227f.sys (Microsoft Corporation)
DRV - (pssnap) – C:\Windows\System32\drivers\pssnap.sys (Macrium Software)
DRV - (NisDrv) – C:\Windows\System32\drivers\NisDrvWFP.sys (Microsoft Corporation)
DRV - (TsUsbFlt) – C:\Windows\System32\drivers\TsUsbFlt.sys (Microsoft Corporation)
DRV - (WinUsb) – C:\Windows\System32\drivers\winusb.sys (Microsoft Corporation)
DRV - (sscdmdm) – C:\Windows\System32\drivers\sscdmdm.sys (MCCI Corporation)
DRV - (sscdserd) – C:\Windows\System32\drivers\sscdserd.sys (MCCI Corporation)
DRV - (sscdbus) – C:\Windows\System32\drivers\sscdbus.sys (MCCI Corporation)
DRV - (sscdmdfl) – C:\Windows\System32\drivers\sscdmdfl.sys (MCCI Corporation)
DRV - (Revoflt) – C:\Windows\System32\drivers\revoflt.sys (VS Revo Group)
DRV - (Serial) – C:\Windows\System32\drivers\serial.sys (Brother Industries Ltd.)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.yahoo.com/?ilc=8&fr=mkg029
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/?ilc=8&fr=mkg029
IE - HKLM\..\SearchScopes,DefaultScope = {36668FFD-7809-43FB-A609-999C5A7AB5FE}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKLM\..\SearchScopes\{36668FFD-7809-43FB-A609-999C5A7AB5FE}: "URL" = http://search.foxtab.com/?q={searchTerms}&…mp;cr=344294484

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,BrowserMngr Start Page =
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = Preserve
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page =
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://www.msn.com/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = en-us
IE - HKCU\..\SearchScopes,BrowserMngrDefaultScope = {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}
IE - HKCU\..\SearchScopes,DefaultScope =
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}…amp;FORM=IE8SRC
IE - HKCU\..\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}: "URL" = http://search.babylon.com/?q={searchTerms}…000002564d80f68
IE - HKCU\..\SearchScopes\{36668FFD-7809-43FB-A609-999C5A7AB5FE}: "URL" = http://search.foxtab.com/?q={searchTerms}&…mp;cr=344294484
IE - HKCU\..\SearchScopes\{85BB23C7-0F67-4250-6758-200ACEDDE7FE}: "URL" = http://www.bing.com/search?q={searchTerms}…eferrer:source}
IE - HKCU\..\SearchScopes\{DECA3892-BA8F-44b8-A993-A466AD694AE4}: "URL" = http://search.yahoo.com/search?p={searchTerms}&fr=mkg028
IE - HKCU\..\SearchScopes\{EC23C1C8-47E1-22F0-FF5D-CD82BE4273C8}: "URL" = http://www.bing.com/search?q={searchTerms}…eferrer:source}
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..browser.search.defaultenginename: "Search the web (Babylon)"
FF - prefs.js..browser.search.order.1: "Search the web (Babylon)"
FF - prefs.js..browser.search.selectedEngine: "Search the web (Babylon)"
FF - prefs.js..browser.startup.homepage: "http://search.babylon.com/?affID=110795&tt=bandext_3312_4&babsrc=HP_ss&mntrId=728114cc000000000000002564d80f68"

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32_11_3_300_271.dll ()
FF - HKLM\Software\MozillaPlugins\@canon.com/EPPEX: C:\Program Files\Canon\Easy-PhotoPrint EX\NPEZFFPI.DLL (CANON INC.)
FF - HKLM\Software\MozillaPlugins\@google.com/npPicasa3,version=3.0.0: C:\Program Files\Google\Picasa3\npPicasa3.dll (Google, Inc.)
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.5.1: C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.5.0: C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files\Microsoft Silverlight\4.1.10329.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~1\MI4066~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\PROGRA~1\MI4066~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=14.0.8117.0416: C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKCU\Software\MozillaPlugins\@docu-track.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf: File not found
FF - HKCU\Software\MozillaPlugins\@yahoo.com/BrowserPlus,version=2.9.8: C:\Users\Patty\AppData\Local\Yahoo!\BrowserPlus\2.9.8\Plugins\npybrowserplus_2.9.8.dll (Yahoo! Inc.)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 14.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins
FF - HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions\\[removed]: C:\Users\Patty\AppData\Roaming\Mozilla\Firefox\Profiles/5erqatan.default\extensions\[removed]
FF - HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions\\{b64982b1-d112-42b5-b1e4-d3867c4533f8}: C:\ProgramData\Browser Manager\2.2.565.25\{16cdff19-861d-48e3-a751-d99a27784753}\FirefoxExtension

[2012/08/04 13:51:52 | 000,000,000 | —D | M] (No name found) – C:\Users\Patty\AppData\Roaming\mozilla\Extensions
[2012/08/22 10:55:34 | 000,000,000 | —D | M] (No name found) – C:\Users\Patty\AppData\Roaming\mozilla\Firefox\Profiles\5erqatan.default\extensions
[2012/02/10 23:22:37 | 000,000,000 | —D | M] (Garmin Communicator) – C:\Users\Patty\AppData\Roaming\mozilla\Firefox\Profiles\5erqatan.default\extensions\{195A3098-0BD5-4e90-AE22-BA1C540AFD1E}
[2012/08/14 13:00:40 | 000,000,000 | —D | M] (Yahoo! Toolbar) – C:\Users\Patty\AppData\Roaming\mozilla\Firefox\Profiles\5erqatan.default\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}
[2012/07/20 14:49:02 | 000,003,750 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\avg-secure-search.xml
[2012/07/13 20:16:36 | 000,002,252 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\bing.xml
[2012/07/13 20:16:36 | 000,002,040 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\twitter.xml

========== Chrome ==========

CHR - homepage: http://search.babylon.com/?affID=110795&am…000002564d80f68
CHR - homepage: http://search.babylon.com/?affID=110795&am…000002564d80f68

O1 HOSTS File: ([2010/09/13 15:26:31 | 000,419,251 | —- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 www.007guard.com
O1 - Hosts: 127.0.0.1 007guard.com
O1 - Hosts: 127.0.0.1 008i.com
O1 - Hosts: 127.0.0.1 www.008k.com
O1 - Hosts: 127.0.0.1 008k.com
O1 - Hosts: 127.0.0.1 www.00hq.com
O1 - Hosts: 127.0.0.1 00hq.com
O1 - Hosts: 127.0.0.1 010402.com
O1 - Hosts: 127.0.0.1 www.032439.com
O1 - Hosts: 127.0.0.1 032439.com
O1 - Hosts: 127.0.0.1 www.0scan.com
O1 - Hosts: 127.0.0.1 0scan.com
O1 - Hosts: 127.0.0.1 1000gratisproben.com
O1 - Hosts: 127.0.0.1 www.1000gratisproben.com
O1 - Hosts: 127.0.0.1 1001namen.com
O1 - Hosts: 127.0.0.1 www.1001namen.com
O1 - Hosts: 127.0.0.1 100888290cs.com
O1 - Hosts: 127.0.0.1 www.100888290cs.com
O1 - Hosts: 127.0.0.1 www.100sexlinks.com
O1 - Hosts: 127.0.0.1 100sexlinks.com
O1 - Hosts: 127.0.0.1 10sek.com
O1 - Hosts: 127.0.0.1 www.10sek.com
O1 - Hosts: 127.0.0.1 www.1-2005-search.com
O1 - Hosts: 127.0.0.1 1-2005-search.com
O1 - Hosts: 127.0.0.1 123fporn.info
O1 - Hosts: 14465 more lines…
O2 - BHO: (no name) - {2EECD738-5844-4a99-B4B6-146BF802613B} - No CLSID value found.
O2 - BHO: (Java™ Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
O2 - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office2010\Office14\URLREDIR.DLL (Microsoft Corporation)
O2 - BHO: (Java™ Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O3 - HKLM\..\Toolbar: (no name) - {98889811-442D-49dd-99D7-DC866BE87DBC} - No CLSID value found.
O4 - HKLM..\Run: [MSC] C:\Program Files\Microsoft Security Client\msseces.exe (Microsoft Corporation)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O8 - Extra context menu item: Add to Google Photos Screensa&ver - C:\Windows\System32\GPhotos.scr (Google Inc.)
O9 - Extra Button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office2010\Office14\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : Se&nd to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office2010\Office14\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra Button: OneNote Lin&ked Notes - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files\Microsoft Office2010\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : OneNote Lin&ked Notes - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files\Microsoft Office2010\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation)
O13 - gopher Prefix: missing
O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} http://pcpitstop.com/betapit/PCPitStop.CAB (PCPitstop Utility)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.7.0/jinstall-…indows-i586.cab (Java Plug-in 10.5.0)
O16 - DPF: {CAFEEFAC-0017-0000-0005-ABCDEFFEDCBA} http://java.sun.com/update/1.7.0/jinstall-…indows-i586.cab (Java Plug-in 1.7.0_05)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.7.0/jinstall-…indows-i586.cab (Java Plug-in 10.5.0)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = [removed] [removed] [removed]
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{B3E4F083-98BF-476A-B54A-CA975B5E2AAD}: DhcpNameServer = [removed] [removed] [removed]
O20 - AppInit_DLLs: (c:\progra~2\browse~1\22565~1.25\{16cdf~1\browse~1.dll) - File not found
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O28 - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\Program Files\Microsoft Office2010\Office14\GROOVEEX.DLL (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009/06/10 17:42:20 | 000,000,024 | —- | M] () - C:\autoexec.bat – [ NTFS ]
O32 - AutoRun File - [2010/11/02 07:19:42 | 000,000,000 | RH-D | M] - J:\autorun – [ NTFS ]
O32 - AutoRun File - [2002/10/16 08:56:50 | 000,000,036 | RH– | M] () - J:\autorun.inf – [ NTFS ]
O33 - MountPoints2\{94aaf99a-5e9b-11e1-a4a8-002564d80f68}\Shell - "" = AutoRun
O33 - MountPoints2\{94aaf99a-5e9b-11e1-a4a8-002564d80f68}\Shell\AutoRun\command - "" = L:\TLBootstrap_WPP.exe
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)

========== Files/Folders - Created Within 30 Days ==========

[2012/08/22 10:51:38 | 000,000,000 | —D | C] – C:\_OTL
[2012/08/20 12:26:26 | 000,000,000 | —D | C] – C:\Users\Patty\Desktop\Bunch of pictures
[2012/08/17 01:35:50 | 000,000,000 | —D | C] – C:\ProgramData\Browser Manager
[2012/08/14 12:33:24 | 000,000,000 | —D | C] – C:\Users\Patty\AppData\Local\antiphishing-vmninternethelper1_1dn
[2012/08/13 17:21:15 | 000,000,000 | —D | C] – C:\ProgramData\Yahoo! Companion
[2012/08/12 16:01:56 | 000,000,000 | —D | C] – C:\Users\Patty\AppData\Local\APN
[2012/08/11 19:58:35 | 000,000,000 | —D | C] – C:\Users\Patty\AppData\Local\Apple Computer
[2012/08/11 19:56:47 | 000,000,000 | —D | C] – C:\Program Files\Bonjour
[2012/08/07 00:34:10 | 000,000,000 | —D | C] – C:\Program Files\Awesome Duplicate Photo Finder
[2012/08/07 00:25:10 | 000,000,000 | —D | C] – C:\Users\Patty\AppData\Roaming\EasyDuplicateFinder
[2012/08/05 15:59:02 | 000,000,000 | —D | C] – C:\Users\Patty\AppData\Local\MyScrapNook_12
[2012/08/01 00:30:42 | 000,000,000 | —D | C] – C:\ProgramData\boost_interprocess
[2012/07/31 15:37:51 | 000,000,000 | —D | C] – C:\Program Files\Free Easy CD DVD Burner
[2012/07/29 23:23:51 | 000,000,000 | —D | C] – C:\Users\Patty\Documents\Reflect
[2012/07/29 23:04:00 | 000,000,000 | —D | C] – C:\ProgramData\Macrium
[2012/07/29 23:02:50 | 000,000,000 | —D | C] – C:\Users\Patty\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Macrium
[2012/07/29 23:02:48 | 000,000,000 | —D | C] – C:\Program Files\Macrium
[2012/07/29 18:40:50 | 000,000,000 | —D | C] – C:\Users\Patty\AppData\Local\MigWiz
[2012/07/28 09:58:23 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Picasa 3
[2011/11/28 16:40:47 | 000,584,192 | —- | C] (OldTimer Tools) – C:\Program Files\OTL.exe

========== Files - Modified Within 30 Days ==========

[2012/08/22 11:12:00 | 000,000,830 | —- | M] () – C:\Windows\tasks\Adobe Flash Player Updater.job
[2012/08/22 11:01:57 | 000,015,152 | -H– | M] () – C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2012/08/22 11:01:57 | 000,015,152 | -H– | M] () – C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2012/08/22 11:01:17 | 000,626,040 | —- | M] () – C:\Windows\System32\perfh009.dat
[2012/08/22 11:01:17 | 000,107,316 | —- | M] () – C:\Windows\System32\perfc009.dat
[2012/08/22 10:54:53 | 000,000,376 | —- | M] () – C:\Windows\tasks\XoftSpySE.job
[2012/08/22 10:54:47 | 000,067,584 | –S- | M] () – C:\Windows\bootstat.dat
[2012/08/22 10:54:31 | 2388,381,696 | -HS- | M] () – C:\hiberfil.sys
[2012/08/21 22:07:45 | 000,000,512 | —- | M] () – C:\Users\Patty\Desktop\MBR.dat
[2012/08/21 18:00:00 | 000,000,444 | —- | M] () – C:\Windows\tasks\ParetoLogic Registration3.job
[2012/08/21 11:50:44 | 000,000,448 | —- | M] () – C:\Users\Patty\Documents\cc_20120821_115040.reg
[2012/08/20 21:27:21 | 000,005,977 | —- | M] () – C:\Users\Patty\Desktop\GROCERIES.odt
[2012/08/19 09:42:04 | 000,000,382 | —- | M] () – C:\Windows\tasks\RegSERVO.job
[2012/08/16 03:41:02 | 000,000,418 | —- | M] () – C:\Windows\tasks\ParetoLogic Update Version3.job
[2012/08/16 03:18:10 | 000,487,232 | —- | M] () – C:\Windows\System32\FNTCACHE.DAT
[2012/08/13 20:12:51 | 001,528,314 | —- | M] () – C:\Users\Patty\Documents\P1020734.JPG
[2012/07/29 23:02:50 | 000,002,929 | —- | M] () – C:\Users\Patty\Desktop\Reflect.lnk

========== Files Created - No Company Name ==========

[2012/08/21 22:07:45 | 000,000,512 | —- | C] () – C:\Users\Patty\Desktop\MBR.dat
[2012/08/21 11:50:42 | 000,000,448 | —- | C] () – C:\Users\Patty\Documents\cc_20120821_115040.reg
[2012/08/20 12:13:21 | 000,005,977 | —- | C] () – C:\Users\Patty\Desktop\GROCERIES.odt
[2012/08/13 20:12:49 | 001,528,314 | —- | C] () – C:\Users\Patty\Documents\P1020734.JPG
[2012/07/29 23:02:50 | 000,002,929 | —- | C] () – C:\Users\Patty\Desktop\Reflect.lnk
[2012/07/20 14:27:03 | 000,027,520 | —- | C] () – C:\Users\Patty\AppData\Local\dt.dat
[2012/03/17 00:25:18 | 000,000,017 | —- | C] () – C:\Users\Patty\AppData\Local\resmon.resmoncfg
[2012/02/10 23:29:32 | 000,021,316 | —- | C] () – C:\Windows\System32\emptyregdb.dat
[2011/09/26 11:00:27 | 000,000,117 | —- | C] () – C:\Windows\restore.INI
[2011/04/17 19:19:47 | 000,000,064 | —- | C] () – C:\Windows\GPlrLanc.dat
[2010/09/20 12:47:55 | 000,103,784 | —- | C] () – C:\Users\Patty\GoToAssistDownloadHelper.exe
[2010/08/30 19:54:35 | 000,000,234 | —- | C] () – C:\Windows\wininit.ini
[2010/08/25 20:30:02 | 000,439,308 | —- | C] () – C:\Windows\System32\igcompkrng500.bin
[2010/08/25 20:30:00 | 000,982,240 | —- | C] () – C:\Windows\System32\igkrng500.bin
[2010/08/25 20:30:00 | 000,092,356 | —- | C] () – C:\Windows\System32\igfcg500m.bin
[2010/08/25 19:59:08 | 000,004,096 | —- | C] ( ) – C:\Windows\System32\IGFXDEVLib.dll
[2010/08/25 19:57:00 | 000,000,151 | —- | C] () – C:\Windows\System32\GfxUI.exe.config
[2010/08/25 19:52:00 | 000,208,896 | —- | C] () – C:\Windows\System32\iglhsip32.dll
[2010/08/25 19:52:00 | 000,143,360 | —- | C] () – C:\Windows\System32\iglhcp32.dll

========== LOP Check ==========

[2012/02/10 23:22:26 | 000,000,000 | —D | M] – C:\Users\Patty\AppData\Roaming\.purple
[2012/02/10 23:22:27 | 000,000,000 | —D | M] – C:\Users\Patty\AppData\Roaming\AVG10
[2012/07/20 14:23:18 | 000,000,000 | —D | M] – C:\Users\Patty\AppData\Roaming\AVG2012
[2012/02/10 23:22:27 | 000,000,000 | —D | M] – C:\Users\Patty\AppData\Roaming\Babylon
[2012/02/10 23:22:27 | 000,000,000 | —D | M] – C:\Users\Patty\AppData\Roaming\Blitware
[2012/07/31 15:54:31 | 000,000,000 | —D | M] – C:\Users\Patty\AppData\Roaming\Canon
[2012/05/04 17:46:26 | 000,000,000 | —D | M] – C:\Users\Patty\AppData\Roaming\com.zoosk.Desktop.096E6A67431258A508A2446A847B240591D2C99B.1
[2012/06/19 17:43:15 | 000,000,000 | —D | M] – C:\Users\Patty\AppData\Roaming\DriverCure
[2012/08/07 00:26:27 | 000,000,000 | —D | M] – C:\Users\Patty\AppData\Roaming\EasyDuplicateFinder
[2012/02/10 23:22:27 | 000,000,000 | —D | M] – C:\Users\Patty\AppData\Roaming\Foxit Software
[2012/02/10 23:22:27 | 000,000,000 | —D | M] – C:\Users\Patty\AppData\Roaming\Garmin
[2012/02/10 23:22:27 | 000,000,000 | —D | M] – C:\Users\Patty\AppData\Roaming\Jenkat
[2012/02/10 23:22:32 | 000,000,000 | —D | M] – C:\Users\Patty\AppData\Roaming\mjusbsp
[2012/02/10 23:22:38 | 000,000,000 | —D | M] – C:\Users\Patty\AppData\Roaming\OpenCandy
[2012/06/19 17:43:15 | 000,000,000 | —D | M] – C:\Users\Patty\AppData\Roaming\ParetoLogic
[2010/12/25 11:19:30 | 000,000,000 | —D | M] – C:\Users\Patty\AppData\Roaming\Skinux
[2011/09/26 00:51:45 | 000,000,000 | —D | M] – C:\Users\Patty\AppData\Roaming\Systweak
[2012/02/10 23:22:38 | 000,000,000 | —D | M] – C:\Users\Patty\AppData\Roaming\TeamViewer
[2012/02/10 23:22:38 | 000,000,000 | —D | M] – C:\Users\Patty\AppData\Roaming\ViquaSoft
[2012/02/10 23:22:38 | 000,000,000 | —D | M] – C:\Users\Patty\AppData\Roaming\www.shadowexplorer.com
[2012/02/10 23:22:38 | 000,000,000 | —D | M] – C:\Users\Patty\AppData\Roaming\Xlinkw
[2011/05/13 10:55:23 | 000,000,370 | —- | M] () – C:\Windows\Tasks\Ad-Aware Update (Weekly).job
[2012/08/21 18:00:00 | 000,000,444 | —- | M] () – C:\Windows\Tasks\ParetoLogic Registration3.job
[2012/08/16 03:41:02 | 000,000,418 | —- | M] () – C:\Windows\Tasks\ParetoLogic Update Version3.job
[2012/08/19 09:42:04 | 000,000,382 | —- | M] () – C:\Windows\Tasks\RegSERVO.job
[2009/07/14 00:53:46 | 000,019,164 | —- | M] () – C:\Windows\Tasks\SCHEDLGU.TXT

========== Purity Check ==========

< End of report >

HERE IS THE FIX SCAN

OTL logfile created on: 8/22/2012 10:58:23 AM - Run 2
OTL by OldTimer - Version 3.2.58.1 Folder = C:\Users\Patty\Downloads
Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7601.17514)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

2.97 Gb Total Physical Memory | 1.92 Gb Available Physical Memory | 64.64% Memory free
5.93 Gb Paging File | 4.88 Gb Available in Paging File | 82.21% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 297.99 Gb Total Space | 191.62 Gb Free Space | 64.30% Space Free | Partition Type: NTFS
Drive J: | 931.51 Gb Total Space | 590.95 Gb Free Space | 63.44% Space Free | Partition Type: NTFS

Computer Name: PATTI-PC | User Name: Patty | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Users\Patty\Downloads\OTL(1).exe (OldTimer Tools)
PRC - C:\ProgramData\Browser Manager\2.2.565.25\{16cdff19-861d-48e3-a751-d99a27784753}\browsemngr.exe ()
PRC - C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
PRC - C:\Windows\System32\Macromed\Flash\FlashPlayerPlugin_11_3_300_262.exe (Adobe Systems, Inc.)
PRC - C:\Program Files\Macrium\Reflect\ReflectService.exe ()
PRC - C:\Program Files\Microsoft Security Client\msseces.exe (Microsoft Corporation)
PRC - C:\Program Files\Microsoft Security Client\MsMpEng.exe (Microsoft Corporation)
PRC - C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated)
PRC - C:\Windows\System32\conhost.exe (Microsoft Corporation)
PRC - C:\Windows\explorer.exe (Microsoft Corporation)
PRC - C:\Windows\System32\taskhost.exe (Microsoft Corporation)
PRC - C:\Windows\System32\schtasks.exe (Microsoft Corporation)

========== Modules (No Company Name) ==========

MOD - C:\ProgramData\Browser Manager\2.2.565.25\{16cdff19-861d-48e3-a751-d99a27784753}\browsemngr.exe ()
MOD - C:\Program Files\Mozilla Firefox\mozjs.dll ()
MOD - C:\Windows\System32\Macromed\Flash\NPSWF32_11_3_300_262.dll ()
MOD - C:\Program Files\Common Files\microsoft shared\OFFICE14\Cultures\OFFICE.ODF ()
MOD - C:\Program Files\Microsoft Office2010\Office14\1033\GrooveIntlResource.dll ()

========== Win32 Services (SafeList) ==========

SRV - (Browser Manager) – C:\ProgramData\Browser Manager\2.2.565.25\{16cdff19-861d-48e3-a751-d99a27784753}\browsemngr.exe ()
SRV - (AdobeFlashPlayerUpdateSvc) – C:\Windows\System32\Macromed\Flash\FlashPlayerUpdateService.exe (Adobe Systems Incorporated)
SRV - (MozillaMaintenance) – C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe (Mozilla Foundation)
SRV - (ReflectService.exe) – C:\Program Files\Macrium\Reflect\ReflectService.exe ()
SRV - (NisSrv) – C:\Program Files\Microsoft Security Client\NisSrv.exe (Microsoft Corporation)
SRV - (MsMpSvc) – C:\Program Files\Microsoft Security Client\MsMpEng.exe (Microsoft Corporation)
SRV - (WatAdminSvc) – C:\Windows\System32\Wat\WatAdminSvc.exe (Microsoft Corporation)
SRV - (AdobeARMservice) – C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated)
SRV - (Microsoft SharePoint Workspace Audit Service) – C:\Program Files\Microsoft Office2010\Office14\GROOVE.EXE (Microsoft Corporation)
SRV - (sesvc) – C:\Program Files\ShadowExplorer\sesvc.exe (www.shadowexplorer.com)
SRV - (SensrSvc) – C:\Windows\System32\sensrsvc.dll (Microsoft Corporation)
SRV - (WinDefend) – C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)

========== Driver Services (SafeList) ==========

DRV - (MpKsl3563227f) – C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{417F43BA-7559-4DA4-A569-5FAD26498D6C}\MpKsl3563227f.sys (Microsoft Corporation)
DRV - (pssnap) – C:\Windows\System32\drivers\pssnap.sys (Macrium Software)
DRV - (NisDrv) – C:\Windows\System32\drivers\NisDrvWFP.sys (Microsoft Corporation)
DRV - (TsUsbFlt) – C:\Windows\System32\drivers\TsUsbFlt.sys (Microsoft Corporation)
DRV - (WinUsb) – C:\Windows\System32\drivers\winusb.sys (Microsoft Corporation)
DRV - (sscdmdm) – C:\Windows\System32\drivers\sscdmdm.sys (MCCI Corporation)
DRV - (sscdserd) – C:\Windows\System32\drivers\sscdserd.sys (MCCI Corporation)
DRV - (sscdbus) – C:\Windows\System32\drivers\sscdbus.sys (MCCI Corporation)
DRV - (sscdmdfl) – C:\Windows\System32\drivers\sscdmdfl.sys (MCCI Corporation)
DRV - (Revoflt) – C:\Windows\System32\drivers\revoflt.sys (VS Revo Group)
DRV - (Serial) – C:\Windows\System32\drivers\serial.sys (Brother Industries Ltd.)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.yahoo.com/?ilc=8&fr=mkg029
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/?ilc=8&fr=mkg029
IE - HKLM\..\SearchScopes,DefaultScope = {36668FFD-7809-43FB-A609-999C5A7AB5FE}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKLM\..\SearchScopes\{36668FFD-7809-43FB-A609-999C5A7AB5FE}: "URL" = http://search.foxtab.com/?q={searchTerms}&…mp;cr=344294484

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,BrowserMngr Start Page =
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = Preserve
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page =
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://www.msn.com/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = en-us
IE - HKCU\..\SearchScopes,BrowserMngrDefaultScope = {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}
IE - HKCU\..\SearchScopes,DefaultScope =
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}…amp;FORM=IE8SRC
IE - HKCU\..\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}: "URL" = http://search.babylon.com/?q={searchTerms}…000002564d80f68
IE - HKCU\..\SearchScopes\{36668FFD-7809-43FB-A609-999C5A7AB5FE}: "URL" = http://search.foxtab.com/?q={searchTerms}&…mp;cr=344294484
IE - HKCU\..\SearchScopes\{85BB23C7-0F67-4250-6758-200ACEDDE7FE}: "URL" = http://www.bing.com/search?q={searchTerms}…eferrer:source}
IE - HKCU\..\SearchScopes\{DECA3892-BA8F-44b8-A993-A466AD694AE4}: "URL" = http://search.yahoo.com/search?p={searchTerms}&fr=mkg028
IE - HKCU\..\SearchScopes\{EC23C1C8-47E1-22F0-FF5D-CD82BE4273C8}: "URL" = http://www.bing.com/search?q={searchTerms}…eferrer:source}
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..browser.search.defaultenginename: "Search the web (Babylon)"
FF - prefs.js..browser.search.order.1: "Search the web (Babylon)"
FF - prefs.js..browser.search.selectedEngine: "Search the web (Babylon)"
FF - prefs.js..browser.startup.homepage: "http://search.babylon.com/?affID=110795&tt=bandext_3312_4&babsrc=HP_ss&mntrId=728114cc000000000000002564d80f68"

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32_11_3_300_271.dll ()
FF - HKLM\Software\MozillaPlugins\@canon.com/EPPEX: C:\Program Files\Canon\Easy-PhotoPrint EX\NPEZFFPI.DLL (CANON INC.)
FF - HKLM\Software\MozillaPlugins\@google.com/npPicasa3,version=3.0.0: C:\Program Files\Google\Picasa3\npPicasa3.dll (Google, Inc.)
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.5.1: C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.5.0: C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files\Microsoft Silverlight\4.1.10329.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~1\MI4066~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\PROGRA~1\MI4066~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=14.0.8117.0416: C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKCU\Software\MozillaPlugins\@docu-track.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf: File not found
FF - HKCU\Software\MozillaPlugins\@yahoo.com/BrowserPlus,version=2.9.8: C:\Users\Patty\AppData\Local\Yahoo!\BrowserPlus\2.9.8\Plugins\npybrowserplus_2.9.8.dll (Yahoo! Inc.)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 14.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins
FF - HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions\\[removed]: C:\Users\Patty\AppData\Roaming\Mozilla\Firefox\Profiles/5erqatan.default\extensions\[removed]
FF - HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions\\{b64982b1-d112-42b5-b1e4-d3867c4533f8}: C:\ProgramData\Browser Manager\2.2.565.25\{16cdff19-861d-48e3-a751-d99a27784753}\FirefoxExtension

[2012/08/04 13:51:52 | 000,000,000 | —D | M] (No name found) – C:\Users\Patty\AppData\Roaming\mozilla\Extensions
[2012/08/22 10:55:34 | 000,000,000 | —D | M] (No name found) – C:\Users\Patty\AppData\Roaming\mozilla\Firefox\Profiles\5erqatan.default\extensions
[2012/02/10 23:22:37 | 000,000,000 | —D | M] (Garmin Communicator) – C:\Users\Patty\AppData\Roaming\mozilla\Firefox\Profiles\5erqatan.default\extensions\{195A3098-0BD5-4e90-AE22-BA1C540AFD1E}
[2012/08/14 13:00:40 | 000,000,000 | —D | M] (Yahoo! Toolbar) – C:\Users\Patty\AppData\Roaming\mozilla\Firefox\Profiles\5erqatan.default\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}
[2012/07/20 14:49:02 | 000,003,750 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\avg-secure-search.xml
[2012/07/13 20:16:36 | 000,002,252 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\bing.xml
[2012/07/13 20:16:36 | 000,002,040 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\twitter.xml

========== Chrome ==========

CHR - homepage: http://search.babylon.com/?affID=110795&am…000002564d80f68
CHR - homepage: http://search.babylon.com/?affID=110795&am…000002564d80f68

O1 HOSTS File: ([2010/09/13 15:26:31 | 000,419,251 | —- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 www.007guard.com
O1 - Hosts: 127.0.0.1 007guard.com
O1 - Hosts: 127.0.0.1 008i.com
O1 - Hosts: 127.0.0.1 www.008k.com
O1 - Hosts: 127.0.0.1 008k.com
O1 - Hosts: 127.0.0.1 www.00hq.com
O1 - Hosts: 127.0.0.1 00hq.com
O1 - Hosts: 127.0.0.1 010402.com
O1 - Hosts: 127.0.0.1 www.032439.com
O1 - Hosts: 127.0.0.1 032439.com
O1 - Hosts: 127.0.0.1 www.0scan.com
O1 - Hosts: 127.0.0.1 0scan.com
O1 - Hosts: 127.0.0.1 1000gratisproben.com
O1 - Hosts: 127.0.0.1 www.1000gratisproben.com
O1 - Hosts: 127.0.0.1 1001namen.com
O1 - Hosts: 127.0.0.1 www.1001namen.com
O1 - Hosts: 127.0.0.1 100888290cs.com
O1 - Hosts: 127.0.0.1 www.100888290cs.com
O1 - Hosts: 127.0.0.1 www.100sexlinks.com
O1 - Hosts: 127.0.0.1 100sexlinks.com
O1 - Hosts: 127.0.0.1 10sek.com
O1 - Hosts: 127.0.0.1 www.10sek.com
O1 - Hosts: 127.0.0.1 www.1-2005-search.com
O1 - Hosts: 127.0.0.1 1-2005-search.com
O1 - Hosts: 127.0.0.1 123fporn.info
O1 - Hosts: 14465 more lines…
O2 - BHO: (no name) - {2EECD738-5844-4a99-B4B6-146BF802613B} - No CLSID value found.
O2 - BHO: (Java™ Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
O2 - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office2010\Office14\URLREDIR.DLL (Microsoft Corporation)
O2 - BHO: (Java™ Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O3 - HKLM\..\Toolbar: (no name) - {98889811-442D-49dd-99D7-DC866BE87DBC} - No CLSID value found.
O4 - HKLM..\Run: [MSC] C:\Program Files\Microsoft Security Client\msseces.exe (Microsoft Corporation)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O8 - Extra context menu item: Add to Google Photos Screensa&ver - C:\Windows\System32\GPhotos.scr (Google Inc.)
O9 - Extra Button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office2010\Office14\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : Se&nd to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office2010\Office14\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra Button: OneNote Lin&ked Notes - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files\Microsoft Office2010\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : OneNote Lin&ked Notes - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files\Microsoft Office2010\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation)
O13 - gopher Prefix: missing
O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} http://pcpitstop.com/betapit/PCPitStop.CAB (PCPitstop Utility)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.7.0/jinstall-…indows-i586.cab (Java Plug-in 10.5.0)
O16 - DPF: {CAFEEFAC-0017-0000-0005-ABCDEFFEDCBA} http://java.sun.com/update/1.7.0/jinstall-…indows-i586.cab (Java Plug-in 1.7.0_05)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.7.0/jinstall-…indows-i586.cab (Java Plug-in 10.5.0)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = [removed] [removed] [removed]
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{B3E4F083-98BF-476A-B54A-CA975B5E2AAD}: DhcpNameServer = [removed] [removed] [removed]
O20 - AppInit_DLLs: (c:\progra~2\browse~1\22565~1.25\{16cdf~1\browse~1.dll) - File not found
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O28 - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\Program Files\Microsoft Office2010\Office14\GROOVEEX.DLL (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009/06/10 17:42:20 | 000,000,024 | —- | M] () - C:\autoexec.bat – [ NTFS ]
O32 - AutoRun File - [2010/11/02 07:19:42 | 000,000,000 | RH-D | M] - J:\autorun – [ NTFS ]
O32 - AutoRun File - [2002/10/16 08:56:50 | 000,000,036 | RH– | M] () - J:\autorun.inf – [ NTFS ]
O33 - MountPoints2\{94aaf99a-5e9b-11e1-a4a8-002564d80f68}\Shell - "" = AutoRun
O33 - MountPoints2\{94aaf99a-5e9b-11e1-a4a8-002564d80f68}\Shell\AutoRun\command - "" = L:\TLBootstrap_WPP.exe
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)

========== Files/Folders - Created Within 30 Days ==========

[2012/08/22 10:51:38 | 000,000,000 | —D | C] – C:\_OTL
[2012/08/20 12:26:26 | 000,000,000 | —D | C] – C:\Users\Patty\Desktop\Bunch of pictures
[2012/08/17 01:35:50 | 000,000,000 | —D | C] – C:\ProgramData\Browser Manager
[2012/08/15 16:47:54 | 000,176,640 | —- | C] (Microsoft Corporation) – C:\Windows\System32\ieui.dll
[2012/08/15 16:47:52 | 000,132,096 | —- | C] (Microsoft Corporation) – C:\Windows\System32\url.dll
[2012/08/15 16:47:51 | 001,638,912 | —- | C] (Microsoft Corporation) – C:\Windows\System32\mshtml.tlb
[2012/08/15 16:47:50 | 000,627,712 | —- | C] (Microsoft Corporation) – C:\Windows\System32\msfeeds.dll
[2012/08/15 16:47:49 | 000,048,128 | —- | C] (Microsoft Corporation) – C:\Windows\System32\jsproxy.dll
[2012/08/15 16:47:43 | 002,345,984 | —- | C] (Microsoft Corporation) – C:\Windows\System32\win32k.sys
[2012/08/15 16:47:39 | 000,400,896 | —- | C] (Microsoft Corporation) – C:\Windows\System32\srcore.dll
[2012/08/15 06:53:15 | 000,041,984 | —- | C] (Microsoft Corporation) – C:\Windows\System32\browcli.dll
[2012/08/14 12:33:24 | 000,000,000 | —D | C] – C:\Users\Patty\AppData\Local\antiphishing-vmninternethelper1_1dn
[2012/08/13 17:21:15 | 000,000,000 | —D | C] – C:\ProgramData\Yahoo! Companion
[2012/08/12 16:01:56 | 000,000,000 | —D | C] – C:\Users\Patty\AppData\Local\APN
[2012/08/11 19:58:35 | 000,000,000 | —D | C] – C:\Users\Patty\AppData\Local\Apple Computer
[2012/08/11 19:56:47 | 000,000,000 | —D | C] – C:\Program Files\Bonjour
[2012/08/07 00:34:10 | 000,000,000 | —D | C] – C:\Program Files\Awesome Duplicate Photo Finder
[2012/08/07 00:25:10 | 000,000,000 | —D | C] – C:\Users\Patty\AppData\Roaming\EasyDuplicateFinder
[2012/08/05 15:59:02 | 000,000,000 | —D | C] – C:\Users\Patty\AppData\Local\MyScrapNook_12
[2012/08/01 00:30:42 | 000,000,000 | —D | C] – C:\ProgramData\boost_interprocess
[2012/07/31 15:37:51 | 000,000,000 | —D | C] – C:\Program Files\Free Easy CD DVD Burner
[2012/07/29 23:23:51 | 000,000,000 | —D | C] – C:\Users\Patty\Documents\Reflect
[2012/07/29 23:04:00 | 000,000,000 | —D | C] – C:\ProgramData\Macrium
[2012/07/29 23:02:50 | 000,000,000 | —D | C] – C:\Users\Patty\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Macrium
[2012/07/29 23:02:48 | 000,000,000 | —D | C] – C:\Program Files\Macrium
[2012/07/29 18:40:50 | 000,000,000 | —D | C] – C:\Users\Patty\AppData\Local\MigWiz
[2012/07/28 09:58:23 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Picasa 3
[2011/11/28 16:40:47 | 000,584,192 | —- | C] (OldTimer Tools) – C:\Program Files\OTL.exe

========== Files - Modified Within 30 Days ==========

[2012/08/22 11:01:17 | 000,626,040 | —- | M] () – C:\Windows\System32\perfh009.dat
[2012/08/22 11:01:17 | 000,107,316 | —- | M] () – C:\Windows\System32\perfc009.dat
[2012/08/22 10:54:53 | 000,000,376 | —- | M] () – C:\Windows\tasks\XoftSpySE.job
[2012/08/22 10:54:47 | 000,067,584 | –S- | M] () – C:\Windows\bootstat.dat
[2012/08/22 10:54:31 | 2388,381,696 | -HS- | M] () – C:\hiberfil.sys
[2012/08/22 10:12:00 | 000,000,830 | —- | M] () – C:\Windows\tasks\Adobe Flash Player Updater.job
[2012/08/21 22:07:45 | 000,000,512 | —- | M] () – C:\Users\Patty\Desktop\MBR.dat
[2012/08/21 18:00:00 | 000,000,444 | —- | M] () – C:\Windows\tasks\ParetoLogic Registration3.job
[2012/08/21 13:05:01 | 000,015,152 | -H– | M] () – C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2012/08/21 13:05:01 | 000,015,152 | -H– | M] () – C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2012/08/21 11:50:44 | 000,000,448 | —- | M] () – C:\Users\Patty\Documents\cc_20120821_115040.reg
[2012/08/20 21:27:21 | 000,005,977 | —- | M] () – C:\Users\Patty\Desktop\GROCERIES.odt
[2012/08/19 09:42:04 | 000,000,382 | —- | M] () – C:\Windows\tasks\RegSERVO.job
[2012/08/16 03:41:02 | 000,000,418 | —- | M] () – C:\Windows\tasks\ParetoLogic Update Version3.job
[2012/08/16 03:18:10 | 000,487,232 | —- | M] () – C:\Windows\System32\FNTCACHE.DAT
[2012/08/15 09:42:54 | 000,426,184 | —- | M] (Adobe Systems Incorporated) – C:\Windows\System32\FlashPlayerApp.exe
[2012/08/15 09:42:54 | 000,070,344 | —- | M] (Adobe Systems Incorporated) – C:\Windows\System32\FlashPlayerCPLApp.cpl
[2012/08/13 20:12:51 | 001,528,314 | —- | M] () – C:\Users\Patty\Documents\P1020734.JPG
[2012/07/29 23:02:50 | 000,002,929 | —- | M] () – C:\Users\Patty\Desktop\Reflect.lnk

========== Files Created - No Company Name ==========

[2012/08/21 22:07:45 | 000,000,512 | —- | C] () – C:\Users\Patty\Desktop\MBR.dat
[2012/08/21 11:50:42 | 000,000,448 | —- | C] () – C:\Users\Patty\Documents\cc_20120821_115040.reg
[2012/08/20 12:13:21 | 000,005,977 | —- | C] () – C:\Users\Patty\Desktop\GROCERIES.odt
[2012/08/13 20:12:49 | 001,528,314 | —- | C] () – C:\Users\Patty\Documents\P1020734.JPG
[2012/07/29 23:02:50 | 000,002,929 | —- | C] () – C:\Users\Patty\Desktop\Reflect.lnk
[2012/07/20 14:27:03 | 000,027,520 | —- | C] () – C:\Users\Patty\AppData\Local\dt.dat
[2012/03/17 00:25:18 | 000,000,017 | —- | C] () – C:\Users\Patty\AppData\Local\resmon.resmoncfg
[2012/02/10 23:29:32 | 000,021,316 | —- | C] () – C:\Windows\System32\emptyregdb.dat
[2011/09/26 11:00:27 | 000,000,117 | —- | C] () – C:\Windows\restore.INI
[2011/04/17 19:19:47 | 000,000,064 | —- | C] () – C:\Windows\GPlrLanc.dat
[2010/09/20 12:47:55 | 000,103,784 | —- | C] () – C:\Users\Patty\GoToAssistDownloadHelper.exe
[2010/08/30 19:54:35 | 000,000,234 | —- | C] () – C:\Windows\wininit.ini
[2010/08/25 20:30:02 | 000,439,308 | —- | C] () – C:\Windows\System32\igcompkrng500.bin
[2010/08/25 20:30:00 | 000,982,240 | —- | C] () – C:\Windows\System32\igkrng500.bin
[2010/08/25 20:30:00 | 000,092,356 | —- | C] () – C:\Windows\System32\igfcg500m.bin
[2010/08/25 19:59:08 | 000,004,096 | —- | C] ( ) – C:\Windows\System32\IGFXDEVLib.dll
[2010/08/25 19:57:00 | 000,000,151 | —- | C] () – C:\Windows\System32\GfxUI.exe.config
[2010/08/25 19:52:00 | 000,208,896 | —- | C] () – C:\Windows\System32\iglhsip32.dll
[2010/08/25 19:52:00 | 000,143,360 | —- | C] () – C:\Windows\System32\iglhcp32.dll

< End of report >

Satchfan

Post #14August 22, 2012, 3:47 PM UTC last edited August 22, 2012, 3:52 PM UTC

It appears that some of the infections are still there. When you ran the fix,is that when you got the error message - if so, did the scan not complete after that?

PattiChati

Post #15August 22, 2012, 3:53 PM UTC

Yes, that is when I got the error, but the scan completed

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

Babylon - Contact Lee from Browser section [Solved]

✨ Ask AI

Ask AI