What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Babylon - Contact Lee from Browser section [Solved]

42 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #16
Can you send a copt of the log it supplied after the fix.

The OTL fix log can be found at C:\_OTL\MovedFiles. The file name will consist of numbers that reflect the date and time the fix was run. It will be something like 22092012_111009.log.

Please copy and paste the contents into your next reply
Post #17
It still opens in Babylon, but you probably know that. Is this what you need, or should I open the files and send them Index of file:///C:/_OTL/MovedFiles/ Up to higher level directory Name Size Last Modified 08222012_105138 8/22/2012 10:52:20 AM File:08222012_105138.log 83 KB 8/22/2012 10:55:40 AM
Post #18
I have actually missed a few entries in your original which is why they didn't all go. :blush:

The log I want is the one that you can find at that location.The actual log will be similar to the one highlighted in red:

C:/_OTL/MovedFiles/22092012_111009.log.

When you see the file, open it like you did with the OTL log and paste it in your reply.

You are doing a good job and a lot of the bad stuff has gone - we WILL get the rest.

I have to go out for a while now so won't reply until later.

Satchfan
Post #19
YOU HAVE BEEN GREAT AND I FEEL SO HOPEFUL. IT IS FUNNY YOU SHOULD SAY YOU HAVE TO GO OUT FOR AWHILE, I WAS JUST GOING TO TELL YOU I HAD TO GO OUT FOR AWHILE TOO. HERE IS THE LOG: HOW DO YOU KNOW WHAT ALL THIS STUFF MEANS????

All processes killed
========== SERVICES/DRIVERS ==========
========== OTL ==========
No active process named browsemngr.exe was found!
Registry value HKEY_USERS\S-1-5-18\Software\Microsoft\Internet Explorer\URLSearchHooks\\{A3BC75A2-1F87-4686-AA43-5347D756017C} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A3BC75A2-1F87-4686-AA43-5347D756017C}\ not found.
HKU\S-1-5-21-1020532669-3928529439-608603026-1000\SOFTWARE\Microsoft\Internet Explorer\Main\\BrowserMngr Start Page| /E : value set successfully!
HKU\S-1-5-21-1020532669-3928529439-608603026-1000\SOFTWARE\Microsoft\Internet Explorer\Main\\Start Page| /E : value set successfully!
Registry value HKEY_USERS\S-1-5-21-1020532669-3928529439-608603026-1000\Software\Microsoft\Internet Explorer\URLSearchHooks\\ deleted successfully.
HKEY_USERS\S-1-5-21-1020532669-3928529439-608603026-1000\Software\Microsoft\Internet Explorer\SearchScopes\\DefaultScope| /E : value set successfully!
HKEY_USERS\S-1-5-21-1020532669-3928529439-608603026-1000\Software\Microsoft\Internet Explorer\SearchScopes\\DefaultScope| /E : value set successfully!
Registry key HKEY_USERS\S-1-5-21-1020532669-3928529439-608603026-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}\ not found.
Registry key HKEY_USERS\S-1-5-21-1020532669-3928529439-608603026-1000\Software\Microsoft\Internet Explorer\SearchScopes\{171DEBEB-C3D4-40b7-AC73-056A5EBA4A7E}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{171DEBEB-C3D4-40b7-AC73-056A5EBA4A7E}\ not found.
Registry key HKEY_USERS\S-1-5-21-1020532669-3928529439-608603026-1000\Software\Microsoft\Internet Explorer\SearchScopes\{95B7759C-8C7F-4BF1-B163-73684A933233}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{95B7759C-8C7F-4BF1-B163-73684A933233}\ not found.
Registry key HKEY_USERS\S-1-5-21-1020532669-3928529439-608603026-1000\Software\Microsoft\Internet Explorer\SearchScopes\{AE50F836-ADB3-4C15-A150-E81640EBD168}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{AE50F836-ADB3-4C15-A150-E81640EBD168}\ not found.
Registry key HKEY_USERS\S-1-5-21-1020532669-3928529439-608603026-1000\Software\Microsoft\Internet Explorer\SearchScopes\{CFF4DB9B-135F-47c0-9269-B4C6572FD61A}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CFF4DB9B-135F-47c0-9269-B4C6572FD61A}\ not found.
Registry key HKEY_LOCAL_MACHINE\Software\MozillaPlugins\@docu-track.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\Software\MozillaPlugins\@ei.CouponAlert_2p.com/Plugin\ deleted successfully.
C:\Program Files\CouponAlert_2pEI\Installr\5.bin\NP2pEISB.dll moved successfully.
Registry key HKEY_LOCAL_MACHINE\Software\MozillaPlugins\@funwebproducts.com/Plugin\ deleted successfully.
Registry value HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\[removed] deleted successfully.
File C:\Users\Patty\AppData\Local\RewardsArcade\498\Firefox not found.
Registry value HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 14.0.1\extensions\\Components deleted successfully.
C:\Program Files\Mozilla Firefox\components folder moved successfully.
Folder move failed. C:\Users\Patty\AppData\Roaming\mozilla\Firefox\Profiles\5erqatan.default\extensions\{6921B3CC-9935-4D28-9A83-B3D824210580}\defaults\preferences scheduled to be moved on reboot.
Folder move failed. C:\Users\Patty\AppData\Roaming\mozilla\Firefox\Profiles\5erqatan.default\extensions\{6921B3CC-9935-4D28-9A83-B3D824210580}\defaults scheduled to be moved on reboot.
Folder move failed. C:\Users\Patty\AppData\Roaming\mozilla\Firefox\Profiles\5erqatan.default\extensions\{6921B3CC-9935-4D28-9A83-B3D824210580}\chrome\skin scheduled to be moved on reboot.
Folder move failed. C:\Users\Patty\AppData\Roaming\mozilla\Firefox\Profiles\5erqatan.default\extensions\{6921B3CC-9935-4D28-9A83-B3D824210580}\chrome\locale\en-US scheduled to be moved on reboot.
Folder move failed. C:\Users\Patty\AppData\Roaming\mozilla\Firefox\Profiles\5erqatan.default\extensions\{6921B3CC-9935-4D28-9A83-B3D824210580}\chrome\locale scheduled to be moved on reboot.
Folder move failed. C:\Users\Patty\AppData\Roaming\mozilla\Firefox\Profiles\5erqatan.default\extensions\{6921B3CC-9935-4D28-9A83-B3D824210580}\chrome\content\prototype scheduled to be moved on reboot.
Folder move failed. C:\Users\Patty\AppData\Roaming\mozilla\Firefox\Profiles\5erqatan.default\extensions\{6921B3CC-9935-4D28-9A83-B3D824210580}\chrome\content scheduled to be moved on reboot.
Folder move failed. C:\Users\Patty\AppData\Roaming\mozilla\Firefox\Profiles\5erqatan.default\extensions\{6921B3CC-9935-4D28-9A83-B3D824210580}\chrome scheduled to be moved on reboot.
Folder move failed. C:\Users\Patty\AppData\Roaming\mozilla\Firefox\Profiles\5erqatan.default\extensions\{6921B3CC-9935-4D28-9A83-B3D824210580} scheduled to be moved on reboot.
C:\Users\Patty\AppData\Roaming\mozilla\Firefox\Profiles\5erqatan.default\extensions\{806215f3-1fe9-5c04-f5dd-1617f7bae315}\META-INF folder moved successfully.
C:\Users\Patty\AppData\Roaming\mozilla\Firefox\Profiles\5erqatan.default\extensions\{806215f3-1fe9-5c04-f5dd-1617f7bae315}\components folder moved successfully.
C:\Users\Patty\AppData\Roaming\mozilla\Firefox\Profiles\5erqatan.default\extensions\{806215f3-1fe9-5c04-f5dd-1617f7bae315}\chrome\skin\weather folder moved successfully.
C:\Users\Patty\AppData\Roaming\mozilla\Firefox\Profiles\5erqatan.default\extensions\{806215f3-1fe9-5c04-f5dd-1617f7bae315}\chrome\skin\gray03 folder moved successfully.
C:\Users\Patty\AppData\Roaming\mozilla\Firefox\Profiles\5erqatan.default\extensions\{806215f3-1fe9-5c04-f5dd-1617f7bae315}\chrome\skin folder moved successfully.
C:\Users\Patty\AppData\Roaming\mozilla\Firefox\Profiles\5erqatan.default\extensions\{806215f3-1fe9-5c04-f5dd-1617f7bae315}\chrome\content\locale folder moved successfully.
C:\Users\Patty\AppData\Roaming\mozilla\Firefox\Profiles\5erqatan.default\extensions\{806215f3-1fe9-5c04-f5dd-1617f7bae315}\chrome\content\flashradio folder moved successfully.
C:\Users\Patty\AppData\Roaming\mozilla\Firefox\Profiles\5erqatan.default\extensions\{806215f3-1fe9-5c04-f5dd-1617f7bae315}\chrome\content folder moved successfully.
Folder move failed. C:\Users\Patty\AppData\Roaming\mozilla\Firefox\Profiles\5erqatan.default\extensions\{806215f3-1fe9-5c04-f5dd-1617f7bae315}\chrome scheduled to be moved on reboot.
Folder move failed. C:\Users\Patty\AppData\Roaming\mozilla\Firefox\Profiles\5erqatan.default\extensions\{806215f3-1fe9-5c04-f5dd-1617f7bae315} scheduled to be moved on reboot.
C:\Users\Patty\AppData\Roaming\mozilla\Firefox\Profiles\5erqatan.default\extensions\12ffxtbr@MyScrapNook_12.com\META-INF folder moved successfully.
C:\Users\Patty\AppData\Roaming\mozilla\Firefox\Profiles\5erqatan.default\extensions\12ffxtbr@MyScrapNook_12.com\chrome folder moved successfully.
C:\Users\Patty\AppData\Roaming\mozilla\Firefox\Profiles\5erqatan.default\extensions\12ffxtbr@MyScrapNook_12.com folder moved successfully.
C:\Users\Patty\AppData\Roaming\mozilla\Firefox\Profiles\5erqatan.default\extensions\[removed]\chrome folder moved successfully.
C:\Users\Patty\AppData\Roaming\mozilla\Firefox\Profiles\5erqatan.default\extensions\[removed] folder moved successfully.
C:\Users\Patty\AppData\Roaming\mozilla\Firefox\Profiles\5erqatan.default\extensions\[removed]\chrome\content\images folder moved successfully.
C:\Users\Patty\AppData\Roaming\mozilla\Firefox\Profiles\5erqatan.default\extensions\[removed]\chrome\content folder moved successfully.
Folder move failed. C:\Users\Patty\AppData\Roaming\mozilla\Firefox\Profiles\5erqatan.default\extensions\[removed]\chrome scheduled to be moved on reboot.
Folder move failed. C:\Users\Patty\AppData\Roaming\mozilla\Firefox\Profiles\5erqatan.default\extensions\[removed] scheduled to be moved on reboot.
C:\Users\Patty\AppData\Roaming\mozilla\Firefox\Profiles\m1mj1ash.default-1341883794977\extensions\[removed]\skin folder moved successfully.
C:\Users\Patty\AppData\Roaming\mozilla\Firefox\Profiles\m1mj1ash.default-1341883794977\extensions\[removed]\META-INF folder moved successfully.
C:\Users\Patty\AppData\Roaming\mozilla\Firefox\Profiles\m1mj1ash.default-1341883794977\extensions\[removed]\locale\en-US folder moved successfully.
C:\Users\Patty\AppData\Roaming\mozilla\Firefox\Profiles\m1mj1ash.default-1341883794977\extensions\[removed]\locale folder moved successfully.
C:\Users\Patty\AppData\Roaming\mozilla\Firefox\Profiles\m1mj1ash.default-1341883794977\extensions\[removed]\content folder moved successfully.
Folder move failed. C:\Users\Patty\AppData\Roaming\mozilla\Firefox\Profiles\m1mj1ash.default-1341883794977\extensions\[removed] scheduled to be moved on reboot.
C:\Users\Patty\AppData\Roaming\mozilla\Firefox\Profiles\m1mj1ash.default-1341883794977\extensions\[removed]\chrome folder moved successfully.
C:\Users\Patty\AppData\Roaming\mozilla\Firefox\Profiles\m1mj1ash.default-1341883794977\extensions\[removed] folder moved successfully.
Folder move failed. C:\Users\Patty\AppData\Roaming\mozilla\Firefox\Profiles\m1mj1ash.default-1341883794977\extensions scheduled to be moved on reboot.
Folder C:\Users\Patty\AppData\Roaming\mozilla\Firefox\Profiles\m1mj1ash.default-1341883794977\extensions\[removed]\ not found.
Folder move failed. C:\Users\Patty\AppData\Roaming\mozilla\Firefox\Profiles\m1mj1ash.default-1341883794977\extensions\[removed]\locale scheduled to be moved on reboot.
Folder move failed. C:\Users\Patty\AppData\Roaming\mozilla\Firefox\Profiles\m1mj1ash.default-1341883794977\extensions\[removed] scheduled to be moved on reboot.
C:\Users\Patty\AppData\Roaming\Mozilla\Firefox\Profiles\5erqatan.default\searchplugins\askcom.xml moved successfully.
C:\Users\Patty\AppData\Roaming\Mozilla\Firefox\Profiles\5erqatan.default\searchplugins\bing-zugo.xml moved successfully.
C:\Users\Patty\AppData\Roaming\Mozilla\Firefox\Profiles\5erqatan.default\searchplugins\Foxtab Web Search.xml moved successfully.
C:\Users\Patty\AppData\Roaming\Mozilla\Firefox\Profiles\5erqatan.default\searchplugins\funmoods.xml moved successfully.
C:\Users\Patty\AppData\Roaming\Mozilla\Firefox\Profiles\5erqatan.default\searchplugins\search-the-web.xml moved successfully.
C:\Users\Patty\AppData\Roaming\Mozilla\Firefox\Profiles\5erqatan.default\searchplugins\Search_Results.xml moved successfully.
C:\Users\Patty\AppData\Roaming\Mozilla\Firefox\Profiles\5erqatan.default\searchplugins\web-browser-search.xml moved successfully.
Folder move failed. C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}\chrome\locale\zh-TW\ffjcext scheduled to be moved on reboot.
Folder move failed. C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}\chrome\locale\zh-TW scheduled to be moved on reboot.
Folder move failed. C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}\chrome\locale\zh-CN\ffjcext scheduled to be moved on reboot.
Folder move failed. C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}\chrome\locale\zh-CN scheduled to be moved on reboot.
Folder move failed. C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}\chrome\locale\sv-SE\ffjcext scheduled to be moved on reboot.
Folder move failed. C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}\chrome\locale\sv-SE scheduled to be moved on reboot.
Folder move failed. C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}\chrome\locale\ko-KR\ffjcext scheduled to be moved on reboot.
Folder move failed. C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}\chrome\locale\ko-KR scheduled to be moved on reboot.
Folder move failed. C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}\chrome\locale\ja-JP\ffjcext scheduled to be moved on reboot.
Folder move failed. C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}\chrome\locale\ja-JP scheduled to be moved on reboot.
Folder move failed. C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}\chrome\locale\it-IT\ffjcext scheduled to be moved on reboot.
Folder move failed. C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}\chrome\locale\it-IT scheduled to be moved on reboot.
Folder move failed. C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}\chrome\locale\fr-FR\ffjcext scheduled to be moved on reboot.
Folder move failed. C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}\chrome\locale\fr-FR scheduled to be moved on reboot.
Folder move failed. C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}\chrome\locale\es-ES\ffjcext scheduled to be moved on reboot.
Folder move failed. C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}\chrome\locale\es-ES scheduled to be moved on reboot.
Folder move failed. C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}\chrome\locale\en-US\ffjcext scheduled to be moved on reboot.
Folder move failed. C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}\chrome\locale\en-US scheduled to be moved on reboot.
Folder move failed. C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}\chrome\locale\de-DE\ffjcext scheduled to be moved on reboot.
Folder move failed. C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}\chrome\locale\de-DE scheduled to be moved on reboot.
Folder move failed. C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}\chrome\locale scheduled to be moved on reboot.
Folder move failed. C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}\chrome\content\ffjcext scheduled to be moved on reboot.
Folder move failed. C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}\chrome\content scheduled to be moved on reboot.
Folder move failed. C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}\chrome scheduled to be moved on reboot.
Folder move failed. C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA} scheduled to be moved on reboot.
C:\Program Files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd} folder moved successfully.
C:\Program Files\Mozilla Firefox\extensions\[removed]\defaults\preferences folder moved successfully.
C:\Program Files\Mozilla Firefox\extensions\[removed]\defaults folder moved successfully.
Folder move failed. C:\Program Files\Mozilla Firefox\extensions\[removed] scheduled to be moved on reboot.
Folder move failed. C:\Program Files\Mozilla Firefox\extensions scheduled to be moved on reboot.
C:\Program Files\Mozilla Firefox\searchplugins\search.xml moved successfully.
C:\Program Files\Mozilla Firefox\searchplugins\Search_Results.xml moved successfully.
Folder move failed. C:\Program Files\Mozilla Firefox\extensions\[removed]\defaults scheduled to be moved on reboot.
Folder move failed. C:\Program Files\Mozilla Firefox\extensions\[removed] scheduled to be moved on reboot.
C:\Program Files\Mozilla Firefox\searchplugins\babylon.xml moved successfully.
Use Chrome's Settings page to change the HomePage.
Use Chrome's Settings page to change the HomePage.
C:\Users\Patty\AppData\Local\Google\Chrome\User Data\Default\Extensions\dlnembnfbcpjnepmfjmngjenhhajpdfd\2.0.0.460_0\libraries folder moved successfully.
C:\Users\Patty\AppData\Local\Google\Chrome\User Data\Default\Extensions\dlnembnfbcpjnepmfjmngjenhhajpdfd\2.0.0.460_0 folder moved successfully.
C:\Users\Patty\AppData\Local\Google\Chrome\User Data\Default\Extensions\dnfaglepmjgohnkcoieaijlheabmcdeo\1.2 folder moved successfully.
C:\Users\Patty\AppData\Local\Google\Chrome\User Data\Default\Extensions\jfmjfhklogoienhpfnppmbcbjfjnkonk\1.5_0 folder moved successfully.
C:\Users\Patty\AppData\Local\Google\Chrome\User Data\Default\Extensions\nnfegheljpcijmdgonkecjpcaopjlpac\1.24.366_0 folder moved successfully.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{2EECD738-5844-4a99-B4B6-146BF802613B}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2EECD738-5844-4a99-B4B6-146BF802613B}\ not found.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3E7C8B5A-96AB-438F-BF9B-782400655440}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3E7C8B5A-96AB-438F-BF9B-782400655440}\ not found.
File C:\Users\Patty\AppData\Roaming\Qwiklinx\Qwiklinx.dll not found.
Registry delete failed. HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{D0F4A166-B8D4-48b8-9D63-80849FE137CB} scheduled to be deleted on reboot.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D0F4A166-B8D4-48b8-9D63-80849FE137CB}\ not found.
Registry value HKEY_USERS\S-1-5-21-1020532669-3928529439-608603026-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{98279C38-DE4B-4BCF-93C9-8EC26069D6F4} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{98279C38-DE4B-4BCF-93C9-8EC26069D6F4}\ not found.
Registry value HKEY_USERS\S-1-5-21-1020532669-3928529439-608603026-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{CCC7A320-B3CA-4199-B1A6-9F516DD69829} not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CCC7A320-B3CA-4199-B1A6-9F516DD69829}\ not found.
Registry value HKEY_USERS\S-1-5-21-1020532669-3928529439-608603026-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{D4027C7F-154A-4066-A1AD-4243D8127440} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D4027C7F-154A-4066-A1AD-4243D8127440}\ not found.
Registry value HKEY_USERS\S-1-5-21-1020532669-3928529439-608603026-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39}\ deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\\AppInit_Dlls:c:\progra~2\browse~1\22565~1.25\{16cdf~1\browse~1.dll deleted successfully.
c:\ProgramData\Browser Manager\2.2.565.25\{16cdff19-861d-48e3-a751-d99a27784753}\browsemngr.dll moved successfully.
C:\Users\Patty\Documents\ShopToWin folder moved successfully.
Folder C:\Users\Patty\AppData\Roaming\Qwiklinx\ not found.
Folder C:\Program Files\Qwiklinx\ not found.
C:\Users\Patty\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Browser Manager folder moved successfully.
C:\ProgramData\Browser Manager\2.2.565.25\{16cdff19-861d-48e3-a751-d99a27784753}\traking_settings folder moved successfully.
C:\ProgramData\Browser Manager\2.2.565.25\{16cdff19-861d-48e3-a751-d99a27784753}\FirefoxExtension\content folder moved successfully.
C:\ProgramData\Browser Manager\2.2.565.25\{16cdff19-861d-48e3-a751-d99a27784753}\FirefoxExtension\components folder moved successfully.
C:\ProgramData\Browser Manager\2.2.565.25\{16cdff19-861d-48e3-a751-d99a27784753}\FirefoxExtension folder moved successfully.
Folder move failed. C:\ProgramData\Browser Manager\2.2.565.25\{16cdff19-861d-48e3-a751-d99a27784753} scheduled to be moved on reboot.
Folder move failed. C:\ProgramData\Browser Manager\2.2.565.25 scheduled to be moved on reboot.
Folder move failed. C:\ProgramData\Browser Manager scheduled to be moved on reboot.
C:\Program Files\Shop to Win 36\js_components\util folder moved successfully.
C:\Program Files\Shop to Win 36\js_components\res\weatherplugin\proppage folder moved successfully.
C:\Program Files\Shop to Win 36\js_components\res\weatherplugin folder moved successfully.
C:\Program Files\Shop to Win 36\js_components\res\searchcomponent folder moved successfully.
C:\Program Files\Shop to Win 36\js_components\res\rssreader\proppage\images folder moved successfully.
C:\Program Files\Shop to Win 36\js_components\res\rssreader\proppage folder moved successfully.
C:\Program Files\Shop to Win 36\js_components\res\rssreader folder moved successfully.
C:\Program Files\Shop to Win 36\js_components\res\radioplugin\proppage\widgets folder moved successfully.
C:\Program Files\Shop to Win 36\js_components\res\radioplugin\proppage\images folder moved successfully.
C:\Program Files\Shop to Win 36\js_components\res\radioplugin\proppage folder moved successfully.
C:\Program Files\Shop to Win 36\js_components\res\radioplugin\js folder moved successfully.
C:\Program Files\Shop to Win 36\js_components\res\radioplugin\images folder moved successfully.
C:\Program Files\Shop to Win 36\js_components\res\radioplugin\css folder moved successfully.
C:\Program Files\Shop to Win 36\js_components\res\radioplugin folder moved successfully.
C:\Program Files\Shop to Win 36\js_components\res\msgboxplugin folder moved successfully.
C:\Program Files\Shop to Win 36\js_components\res\emailchecker\proppage\widgets folder moved successfully.
C:\Program Files\Shop to Win 36\js_components\res\emailchecker\proppage folder moved successfully.
C:\Program Files\Shop to Win 36\js_components\res\emailchecker folder moved successfully.
C:\Program Files\Shop to Win 36\js_components\res\common\proppage folder moved successfully.
C:\Program Files\Shop to Win 36\js_components\res\common folder moved successfully.
C:\Program Files\Shop to Win 36\js_components\res\bookmarksplugin\proppage\images folder moved successfully.
C:\Program Files\Shop to Win 36\js_components\res\bookmarksplugin\proppage folder moved successfully.
C:\Program Files\Shop to Win 36\js_components\res\bookmarksplugin folder moved successfully.
C:\Program Files\Shop to Win 36\js_components\res folder moved successfully.
C:\Program Files\Shop to Win 36\js_components folder moved successfully.
C:\Program Files\Shop to Win 36 folder moved successfully.
C:\ProgramData\blekko toolbars folder moved successfully.
C:\Program Files\blekkotb_sa5\chrome\skin\weatherbutton\panels\images folder moved successfully.
C:\Program Files\blekkotb_sa5\chrome\skin\weatherbutton\panels folder moved successfully.
C:\Program Files\blekkotb_sa5\chrome\skin\weatherbutton\icons folder moved successfully.
C:\Program Files\blekkotb_sa5\chrome\skin\weatherbutton folder moved successfully.
C:\Program Files\blekkotb_sa5\chrome\skin\searchbar folder moved successfully.
C:\Program Files\blekkotb_sa5\chrome\skin\options folder moved successfully.
C:\Program Files\blekkotb_sa5\chrome\skin\lib\weatherbutton\panels\images folder moved successfully.
C:\Program Files\blekkotb_sa5\chrome\skin\lib\weatherbutton\panels folder moved successfully.
C:\Program Files\blekkotb_sa5\chrome\skin\lib\weatherbutton\icons folder moved successfully.
C:\Program Files\blekkotb_sa5\chrome\skin\lib\weatherbutton folder moved successfully.
C:\Program Files\blekkotb_sa5\chrome\skin\lib\uwa folder moved successfully.
C:\Program Files\blekkotb_sa5\chrome\skin\lib\radio\images folder moved successfully.
C:\Program Files\blekkotb_sa5\chrome\skin\lib\radio\css folder moved successfully.
C:\Program Files\blekkotb_sa5\chrome\skin\lib\radio folder moved successfully.
C:\Program Files\blekkotb_sa5\chrome\skin\lib\panels\images folder moved successfully.
C:\Program Files\blekkotb_sa5\chrome\skin\lib\panels\default\images folder moved successfully.
C:\Program Files\blekkotb_sa5\chrome\skin\lib\panels\default\css folder moved successfully.
C:\Program Files\blekkotb_sa5\chrome\skin\lib\panels\default folder moved successfully.
C:\Program Files\blekkotb_sa5\chrome\skin\lib\panels\css folder moved successfully.
C:\Program Files\blekkotb_sa5\chrome\skin\lib\panels folder moved successfully.
C:\Program Files\blekkotb_sa5\chrome\skin\lib\debugbar folder moved successfully.
C:\Program Files\blekkotb_sa5\chrome\skin\lib folder moved successfully.
C:\Program Files\blekkotb_sa5\chrome\skin folder moved successfully.
C:\Program Files\blekkotb_sa5\chrome\data\weather folder moved successfully.
C:\Program Files\blekkotb_sa5\chrome\data\search folder moved successfully.
C:\Program Files\blekkotb_sa5\chrome\data\rss folder moved successfully.
C:\Program Files\blekkotb_sa5\chrome\data\dynamicElements folder moved successfully.
C:\Program Files\blekkotb_sa5\chrome\data folder moved successfully.
C:\Program Files\blekkotb_sa5\chrome\content\widgets\net.vmn.www.TwitterShortcutImage folder moved successfully.
C:\Program Files\blekkotb_sa5\chrome\content\widgets\net.vmn.www.GoogleMapImage folder moved successfully.
C:\Program Files\blekkotb_sa5\chrome\content\widgets\net.vmn.www.FacebookShortcutImage folder moved successfully.
C:\Program Files\blekkotb_sa5\chrome\content\widgets folder moved successfully.
C:\Program Files\blekkotb_sa5\chrome\content\newtab\images folder moved successfully.
C:\Program Files\blekkotb_sa5\chrome\content\newtab folder moved successfully.
C:\Program Files\blekkotb_sa5\chrome\content\modules folder moved successfully.
C:\Program Files\blekkotb_sa5\chrome\content\lib folder moved successfully.
C:\Program Files\blekkotb_sa5\chrome\content folder moved successfully.
C:\Program Files\blekkotb_sa5\chrome folder moved successfully.
C:\Program Files\blekkotb_sa5 folder moved successfully.
C:\Program Files\Chat Messenger\share\themes\MS-Windows\gtk-2.0 folder moved successfully.
C:\Program Files\Chat Messenger\share\themes\MS-Windows folder moved successfully.
C:\Program Files\Chat Messenger\share\themes folder moved successfully.
C:\Program Files\Chat Messenger\share folder moved successfully.
C:\Program Files\Chat Messenger\lib\gdk-pixbuf-2.0\2.10.0 folder moved successfully.
C:\Program Files\Chat Messenger\lib\gdk-pixbuf-2.0 folder moved successfully.
C:\Program Files\Chat Messenger\lib folder moved successfully.
C:\Program Files\Chat Messenger\etc\pango folder moved successfully.
C:\Program Files\Chat Messenger\etc\gtk-2.0 folder moved successfully.
C:\Program Files\Chat Messenger\etc folder moved successfully.
C:\Program Files\Chat Messenger\bin\sounds\purple folder moved successfully.
C:\Program Files\Chat Messenger\bin\sounds folder moved successfully.
C:\Program Files\Chat Messenger\bin\pixmaps\pidgin\tray\hicolor\48x48\status folder moved successfully.
C:\Program Files\Chat Messenger\bin\pixmaps\pidgin\tray\hicolor\48x48 folder moved successfully.
C:\Program Files\Chat Messenger\bin\pixmaps\pidgin\tray\hicolor\32x32\status folder moved successfully.
C:\Program Files\Chat Messenger\bin\pixmaps\pidgin\tray\hicolor\32x32 folder moved successfully.
C:\Program Files\Chat Messenger\bin\pixmaps\pidgin\tray\hicolor\22x22\status folder moved successfully.
C:\Program Files\Chat Messenger\bin\pixmaps\pidgin\tray\hicolor\22x22 folder moved successfully.
C:\Program Files\Chat Messenger\bin\pixmaps\pidgin\tray\hicolor\16x16\status folder moved successfully.
C:\Program Files\Chat Messenger\bin\pixmaps\pidgin\tray\hicolor\16x16 folder moved successfully.
C:\Program Files\Chat Messenger\bin\pixmaps\pidgin\tray\hicolor folder moved successfully.
C:\Program Files\Chat Messenger\bin\pixmaps\pidgin\tray folder moved successfully.
C:\Program Files\Chat Messenger\bin\pixmaps\pidgin\toolbar\48 folder moved successfully.
C:\Program Files\Chat Messenger\bin\pixmaps\pidgin\toolbar\32 folder moved successfully.
C:\Program Files\Chat Messenger\bin\pixmaps\pidgin\toolbar\22 folder moved successfully.
C:\Program Files\Chat Messenger\bin\pixmaps\pidgin\toolbar\16 folder moved successfully.
C:\Program Files\Chat Messenger\bin\pixmaps\pidgin\toolbar\11 folder moved successfully.
C:\Program Files\Chat Messenger\bin\pixmaps\pidgin\toolbar folder moved successfully.
C:\Program Files\Chat Messenger\bin\pixmaps\pidgin\status\48\rtl folder moved successfully.
C:\Program Files\Chat Messenger\bin\pixmaps\pidgin\status\48 folder moved successfully.
C:\Program Files\Chat Messenger\bin\pixmaps\pidgin\status\32\rtl folder moved successfully.
C:\Program Files\Chat Messenger\bin\pixmaps\pidgin\status\32 folder moved successfully.
C:\Program Files\Chat Messenger\bin\pixmaps\pidgin\status\22\rtl folder moved successfully.
C:\Program Files\Chat Messenger\bin\pixmaps\pidgin\status\22 folder moved successfully.
C:\Program Files\Chat Messenger\bin\pixmaps\pidgin\status\16\rtl folder moved successfully.
C:\Program Files\Chat Messenger\bin\pixmaps\pidgin\status\16 folder moved successfully.
C:\Program Files\Chat Messenger\bin\pixmaps\pidgin\status\11\rtl folder moved successfully.
C:\Program Files\Chat Messenger\bin\pixmaps\pidgin\status\11 folder moved successfully.
C:\Program Files\Chat Messenger\bin\pixmaps\pidgin\status folder moved successfully.
C:\Program Files\Chat Messenger\bin\pixmaps\pidgin\protocols\scalable folder moved successfully.
C:\Program Files\Chat Messenger\bin\pixmaps\pidgin\protocols\48 folder moved successfully.
C:\Program Files\Chat Messenger\bin\pixmaps\pidgin\protocols\22 folder moved successfully.
C:\Program Files\Chat Messenger\bin\pixmaps\pidgin\protocols\16 folder moved successfully.
C:\Program Files\Chat Messenger\bin\pixmaps\pidgin\protocols folder moved successfully.
C:\Program Files\Chat Messenger\bin\pixmaps\pidgin\emotes\small folder moved successfully.
C:\Program Files\Chat Messenger\bin\pixmaps\pidgin\emotes\none folder moved successfully.
C:\Program Files\Chat Messenger\bin\pixmaps\pidgin\emotes\default folder moved successfully.
C:\Program Files\Chat Messenger\bin\pixmaps\pidgin\emotes folder moved successfully.
C:\Program Files\Chat Messenger\bin\pixmaps\pidgin\emblems\scalable folder moved successfully.
C:\Program Files\Chat Messenger\bin\pixmaps\pidgin\emblems\16 folder moved successfully.
C:\Program Files\Chat Messenger\bin\pixmaps\pidgin\emblems folder moved successfully.
C:\Program Files\Chat Messenger\bin\pixmaps\pidgin\dialogs\scalable folder moved successfully.
C:\Program Files\Chat Messenger\bin\pixmaps\pidgin\dialogs\64 folder moved successfully.
C:\Program Files\Chat Messenger\bin\pixmaps\pidgin\dialogs\16 folder moved successfully.
C:\Program Files\Chat Messenger\bin\pixmaps\pidgin\dialogs folder moved successfully.
C:\Program Files\Chat Messenger\bin\pixmaps\pidgin\buttons folder moved successfully.
C:\Program Files\Chat Messenger\bin\pixmaps\pidgin\animations\16 folder moved successfully.
C:\Program Files\Chat Messenger\bin\pixmaps\pidgin\animations folder moved successfully.
C:\Program Files\Chat Messenger\bin\pixmaps\pidgin folder moved successfully.
C:\Program Files\Chat Messenger\bin\pixmaps folder moved successfully.
C:\Program Files\Chat Messenger\bin\ca-certs folder moved successfully.
C:\Program Files\Chat Messenger\bin folder moved successfully.
C:\Program Files\Chat Messenger folder moved successfully.
C:\Program Files\Web Assistant\Firefox\chrome\skin folder moved successfully.
C:\Program Files\Web Assistant\Firefox\chrome\locale\en-US folder moved successfully.
C:\Program Files\Web Assistant\Firefox\chrome\locale folder moved successfully.
C:\Program Files\Web Assistant\Firefox\chrome\content folder moved successfully.
C:\Program Files\Web Assistant\Firefox\chrome folder moved successfully.
C:\Program Files\Web Assistant\Firefox folder moved successfully.
C:\Program Files\Web Assistant folder moved successfully.
C:\Users\Patty\Documents\cc_20120817_125630.reg moved successfully.
C:\Users\Patty\Documents\cc_20120817_123438.reg moved successfully.
C:\Users\Patty\Documents\cc_20120817_123257.reg moved successfully.
C:\user.js moved successfully.
========== FILES ==========
< ipconfig /flushdns /c >
Windows IP Configuration
Successfully flushed the DNS Resolver Cache.
C:\Users\Patty\Downloads\cmd.bat deleted successfully.
C:\Users\Patty\Downloads\cmd.txt deleted successfully.
C:\ProgramData\Browser Manager\2.2.565.25\{16cdff19-861d-48e3-a751-d99a27784753}\traking_settings folder moved successfully.
Folder move failed. C:\ProgramData\Browser Manager\2.2.565.25\{16cdff19-861d-48e3-a751-d99a27784753} scheduled to be moved on reboot.
Folder move failed. C:\ProgramData\Browser Manager\2.2.565.25 scheduled to be moved on reboot.
Folder move failed. C:\ProgramData\Browser Manager scheduled to be moved on reboot.
C:\Users\Patty\AppData\Local\Google\Chrome\User Data\Default\Extensions\nnfegheljpcijmdgonkecjpcaopjlpac folder moved successfully.
C:\Users\Patty\AppData\Local\Google\Chrome\User Data\Default\Extensions\jfmjfhklogoienhpfnppmbcbjfjnkonk folder moved successfully.
C:\Users\Patty\AppData\Local\Google\Chrome\User Data\Default\Extensions\dnfaglepmjgohnkcoieaijlheabmcdeo folder moved successfully.
C:\Users\Patty\AppData\Local\Google\Chrome\User Data\Default\Extensions\dlnembnfbcpjnepmfjmngjenhhajpdfd folder moved successfully.
C:\Users\Patty\AppData\Local\Google\Chrome\User Data\Default\Extensions folder moved successfully.
========== COMMANDS ==========

[EMPTYTEMP]

User: All Users

User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes
->Flash cache emptied: 56466 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: Patti's New Account
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->FireFox cache emptied: 17467724 bytes

User: Patti-PC
->Temp folder emptied: 32348 bytes
->Temporary Internet Files folder emptied: 33170 bytes
->FireFox cache emptied: 5927647 bytes

User: Patty
->Temp folder emptied: 103791385 bytes
->Temporary Internet Files folder emptied: 773547 bytes
->Java cache emptied: 328346 bytes
->FireFox cache emptied: 387985249 bytes
->Google Chrome cache emptied: 47590372 bytes
->Flash cache emptied: 14916222 bytes

User: Public

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 30749 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 73968 bytes
%systemroot%\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 50347 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 552.00 mb


OTL by OldTimer - Version 3.2.58.1 log created on 08222012_105138

Files\Folders moved on Reboot…
File\Folder C:\Users\Patty\AppData\Roaming\mozilla\Firefox\Profiles\5erqatan.default\extensions\{6921B3CC-9935-4D28-9A83-B3D824210580}\defaults\preferences not found!
C:\Users\Patty\AppData\Roaming\mozilla\Firefox\Profiles\5erqatan.default\extensions\{6921B3CC-9935-4D28-9A83-B3D824210580}\defaults folder moved successfully.
File\Folder C:\Users\Patty\AppData\Roaming\mozilla\Firefox\Profiles\5erqatan.default\extensions\{6921B3CC-9935-4D28-9A83-B3D824210580}\chrome\skin not found!
File\Folder C:\Users\Patty\AppData\Roaming\mozilla\Firefox\Profiles\5erqatan.default\extensions\{6921B3CC-9935-4D28-9A83-B3D824210580}\chrome\locale\en-US not found!
C:\Users\Patty\AppData\Roaming\mozilla\Firefox\Profiles\5erqatan.default\extensions\{6921B3CC-9935-4D28-9A83-B3D824210580}\chrome\locale folder moved successfully.
File\Folder C:\Users\Patty\AppData\Roaming\mozilla\Firefox\Profiles\5erqatan.default\extensions\{6921B3CC-9935-4D28-9A83-B3D824210580}\chrome\content\prototype not found!
C:\Users\Patty\AppData\Roaming\mozilla\Firefox\Profiles\5erqatan.default\extensions\{6921B3CC-9935-4D28-9A83-B3D824210580}\chrome\content folder moved successfully.
C:\Users\Patty\AppData\Roaming\mozilla\Firefox\Profiles\5erqatan.default\extensions\{6921B3CC-9935-4D28-9A83-B3D824210580}\chrome folder moved successfully.
C:\Users\Patty\AppData\Roaming\mozilla\Firefox\Profiles\5erqatan.default\extensions\{6921B3CC-9935-4D28-9A83-B3D824210580} folder moved successfully.
C:\Users\Patty\AppData\Roaming\mozilla\Firefox\Profiles\5erqatan.default\extensions\{806215f3-1fe9-5c04-f5dd-1617f7bae315}\chrome folder moved successfully.
C:\Users\Patty\AppData\Roaming\mozilla\Firefox\Profiles\5erqatan.default\extensions\{806215f3-1fe9-5c04-f5dd-1617f7bae315} folder moved successfully.
C:\Users\Patty\AppData\Roaming\mozilla\Firefox\Profiles\5erqatan.default\extensions\[removed]\chrome folder moved successfully.
C:\Users\Patty\AppData\Roaming\mozilla\Firefox\Profiles\5erqatan.default\extensions\[removed] folder moved successfully.
C:\Users\Patty\AppData\Roaming\mozilla\Firefox\Profiles\m1mj1ash.default-1341883794977\extensions\[removed] folder moved successfully.
C:\Users\Patty\AppData\Roaming\mozilla\Firefox\Profiles\m1mj1ash.default-1341883794977\extensions folder moved successfully.
File\Folder C:\Users\Patty\AppData\Roaming\mozilla\Firefox\Profiles\m1mj1ash.default-1341883794977\extensions\[removed]\locale not found!
File\Folder C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}\chrome\locale\zh-TW\ffjcext not found!
File\Folder C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}\chrome\locale\zh-TW not found!
File\Folder C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}\chrome\locale\zh-CN\ffjcext not found!
File\Folder C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}\chrome\locale\zh-CN not found!
File\Folder C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}\chrome\locale\sv-SE\ffjcext not found!
File\Folder C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}\chrome\locale\sv-SE not found!
File\Folder C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}\chrome\locale\ko-KR\ffjcext not found!
File\Folder C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}\chrome\locale\ko-KR not found!
File\Folder C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}\chrome\locale\ja-JP\ffjcext not found!
File\Folder C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}\chrome\locale\ja-JP not found!
File\Folder C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}\chrome\locale\it-IT\ffjcext not found!
File\Folder C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}\chrome\locale\it-IT not found!
File\Folder C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}\chrome\locale\fr-FR\ffjcext not found!
File\Folder C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}\chrome\locale\fr-FR not found!
File\Folder C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}\chrome\locale\es-ES\ffjcext not found!
File\Folder C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}\chrome\locale\es-ES not found!
File\Folder C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}\chrome\locale\en-US\ffjcext not found!
File\Folder C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}\chrome\locale\en-US not found!
File\Folder C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}\chrome\locale\de-DE\ffjcext not found!
File\Folder C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}\chrome\locale\de-DE not found!
File\Folder C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}\chrome\locale not found!
File\Folder C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}\chrome\content\ffjcext not found!
File\Folder C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}\chrome\content not found!
File\Folder C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}\chrome not found!
File\Folder C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA} not found!
C:\Program Files\Mozilla Firefox\extensions\[removed] folder moved successfully.
C:\Program Files\Mozilla Firefox\extensions folder moved successfully.
File\Folder C:\Program Files\Mozilla Firefox\extensions\[removed]\defaults not found!
C:\ProgramData\Browser Manager\2.2.565.25\{16cdff19-861d-48e3-a751-d99a27784753}\traking_settings folder moved successfully.
Folder move failed. C:\ProgramData\Browser Manager\2.2.565.25\{16cdff19-861d-48e3-a751-d99a27784753} scheduled to be moved on reboot.
Folder move failed. C:\ProgramData\Browser Manager\2.2.565.25\{16cdff19-861d-48e3-a751-d99a27784753} scheduled to be moved on reboot.
Folder move failed. C:\ProgramData\Browser Manager\2.2.565.25 scheduled to be moved on reboot.
C:\ProgramData\Browser Manager\2.2.565.25\{16cdff19-861d-48e3-a751-d99a27784753}\traking_settings folder moved successfully.
Folder move failed. C:\ProgramData\Browser Manager\2.2.565.25\{16cdff19-861d-48e3-a751-d99a27784753} scheduled to be moved on reboot.
Folder move failed. C:\ProgramData\Browser Manager\2.2.565.25 scheduled to be moved on reboot.
Folder move failed. C:\ProgramData\Browser Manager scheduled to be moved on reboot.

PendingFileRenameOperations files…

Registry entries deleted on Reboot…
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{D0F4A166-B8D4-48b8-9D63-80849FE137CB} not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D0F4A166-B8D4-48b8-9D63-80849FE137CB}\ not found.
Post #20 last edited
OK Patti, next steps.

Run OTL
  • double click on the icon to run it.
  • copy/paste ALL the following text written inside the code box into the Custom Scans/Fixes box located at the bottom of OTL

    :Services

:OTL
PRC - C:\ProgramData\Browser Manager\2.2.565.25\{16cdff19-861d-48e3-a751-d99a27784753}\browsemngr.exe ()
MOD - C:\ProgramData\Browser Manager\2.2.565.25\{16cdff19-861d-48e3-a751-d99a27784753}\browsemngr.exe ()
SRV - (Browser Manager) – C:\ProgramData\Browser Manager\2.2.565.25\{16cdff19-861d-48e3-a751-d99a27784753}\browsemngr.exe ()
IE - HKCU\..\SearchScopes,BrowserMngrDefaultScope = {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}
IE - HKCU\..\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}: "URL" = http://search.babylon.com/?q={searchTerms}…000002564d80f68
IE - HKCU\..\SearchScopes\{85BB23C7-0F67-4250-6758-200ACEDDE7FE}: "URL" = http://www.bing.com/search?q={searchTerms}…eferrer:source}
IE - HKCU\..\SearchScopes\{DECA3892-BA8F-44b8-A993-A466AD694AE4}: "URL" = http://search.yahoo.com/search?p={searchTerms}&fr=mkg028
IE - HKCU\..\SearchScopes\{EC23C1C8-47E1-22F0-FF5D-CD82BE4273C8}: "URL" = http://www.bing.com/search?q={searchTerms}…eferrer:source}
FF - prefs.js..browser.search.defaultenginename: "Search the web (Babylon)"
FF - prefs.js..browser.search.order.1: "Search the web (Babylon)"
FF - prefs.js..browser.search.selectedEngine: "Search the web (Babylon)"
FF - prefs.js..browser.startup.homepage: "http://search.babylon.com/?affID=110795&tt=bandext_3312_4&babsrc=HP_ss&mntrId=728114cc000000000000002564d80f68"
[2012/07/20 14:49:02 | 000,003,750 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\avg-secure-search.xml
CHR - homepage: http://search.babylon.com/?affID=110795&am…000002564d80f68
CHR - homepage: http://search.babylon.com/?affID=110795&am…000002564d80f68
O2 - BHO: (no name) - {2EECD738-5844-4a99-B4B6-146BF802613B} - No CLSID value found.
O3 - HKLM\..\Toolbar: (no name) - {98889811-442D-49dd-99D7-DC866BE87DBC} - No CLSID value found.
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.7.0/jinstall-…indows-i586.cab (Java Plug-in 10.5.0)
O20 - AppInit_DLLs: (c:\progra~2\browse~1\22565~1.25\{16cdf~1\browse~1.dll) - File not found
[2012/08/17 01:35:50 | 000,000,000 | —D | C] – C:\ProgramData\Browser Manager
[2012/02/10 23:22:27 | 000,000,000 | —D | M] – C:\Users\Patty\AppData\Roaming\AVG10
[2012/07/20 14:23:18 | 000,000,000 | —D | M] – C:\Users\Patty\AppData\Roaming\AVG2012
[2012/02/10 23:22:27 | 000,000,000 | —D | M] – C:\Users\Patty\AppData\Roaming\Babylon
[2012/02/10 23:22:27 | 000,000,000 | —D | M] – C:\Users\Patty\AppData\Roaming\Blitware

:Files
C:\ProgramData\Browser Manager

:Commands
[purity]
[emptytemp]
[Reboot]

  • click the Run Fix button at the top
  • let the program run unhindered, reboot when it is done
===================================================

Download Combofix from either of the links below, and save it to your desktop.

Link 1
Link 2

**Note: It is important that it is saved directly to your desktop**

——————————————————————–
IMPORTANT - Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link here
——————————————————————–

Double click on ComboFix.exe & follow the prompts.
  • When finished, it will produce a report for you.
  • Please post the C:\ComboFix.txt for further review.
Logs to include in the next post:

OTL fix log
New OTL log
ComboFix.txt

Thanks

Satchfan
Post #21
I have ccleaner, malwarebytes, silverlight, MSE, diskcleanup and then I think I I microsofts firewall. Do I disable all these to do the scans? I also am not interested in having "chrome" on my computer if that makes a factor in any of this?
Post #22
You only need to disable MSE and Windows firewall - the others are not real-time protection

If necessary, click here for information on how to disable them.

It is 1am here and I'm off for some beauty sleep now.

I also am not interested in having "chrome" on my computer if that makes a factor in any of this?

Chrome is not the major factor here but I wouldn't uninstall it at this point - let's clean up first.

Satchfan
Post #25
I am getting a little confused with all the logs - I think I am missing one, aren't I? But these two are all I could find. Let me know. ComboFix 12-08-22.03 - Patty 08/23/2012 10:13:05.1.2 - x86 Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.3037.1872 [GMT -4:00] Running from: c:\users\[removed]\Downloads\ComboFix.exe AV: Microsoft Security Essentials *Disabled/Updated* {9765EA51-0D3C-7DFB-6091-10E4E1F341F6} SP: Microsoft Security Essentials *Disabled/Updated* {2C040BB5-2B06-7275-5A21-2B969A740B4B} SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} . . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . . c:\program files\CouponAlert_2pEI c:\program files\CouponAlert_2pEI\Installr\5.bin\2pEIPlug.dll c:\program files\CouponAlert_2pEI\Installr\5.bin\2pEZSETP.dll c:\program files\I Want This c:\program files\I Want This\I Want ThisInstaller.log c:\users\Patty\GoToAssistDownloadHelper.exe c:\windows\system32\roboot.exe J:\Autorun.inf . . ((((((((((((((((((((((((( Files Created from 2012-07-23 to 2012-08-23 ))))))))))))))))))))))))))))))) . . 2012-08-23 14:16 . 2012-08-23 14:17 ——– d—–w- c:\users\Patty\AppData\Local\temp 2012-08-22 20:30 . 2012-08-01 22:51 7023536 —-a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{A45ACC21-E6AA-40D4-92DB-19D3873CC422}\mpengine.dll 2012-08-22 14:51 . 2012-08-22 14:51 ——– d—–w- C:\_OTL 2012-08-21 17:09 . 2012-08-01 22:51 7023536 —-a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll 2012-08-15 10:53 . 2012-07-04 21:14 41984 —-a-w- c:\windows\system32\browcli.dll 2012-08-15 10:53 . 2012-07-04 21:14 102912 —-a-w- c:\windows\system32\browser.dll 2012-08-15 10:53 . 2012-05-14 04:33 769024 —-a-w- c:\windows\system32\localspl.dll 2012-08-14 16:33 . 2012-08-14 16:33 ——– d—–w- c:\users\Patty\AppData\Local\antiphishing-vmninternethelper1_1dn 2012-08-13 21:21 . 2012-08-14 17:00 ——– d—–w- c:\programdata\Yahoo! Companion 2012-08-12 20:01 . 2012-08-12 20:01 ——– d—–w- c:\users\Patty\AppData\Local\APN 2012-08-11 23:58 . 2012-08-11 23:58 ——– d—–w- c:\users\Patty\AppData\Local\Apple Computer 2012-08-11 23:56 . 2012-08-15 10:45 ——– d—–w- c:\program files\Bonjour 2012-08-07 04:34 . 2012-08-15 10:44 ——– d—–w- c:\program files\Awesome Duplicate Photo Finder 2012-08-07 04:25 . 2012-08-07 04:26 ——– d—–w- c:\users\Patty\AppData\Roaming\EasyDuplicateFinder 2012-08-05 19:59 . 2012-08-05 19:59 ——– d—–w- c:\users\Patty\AppData\Local\MyScrapNook_12 2012-08-01 04:30 . 2012-08-01 04:30 ——– d—–w- c:\programdata\boost_interprocess 2012-07-31 19:37 . 2012-08-15 10:44 ——– d—–w- c:\program files\Free Easy CD DVD Burner 2012-07-30 03:04 . 2012-07-30 03:04 ——– d—–w- c:\programdata\Macrium 2012-07-30 03:02 . 2012-07-30 03:02 ——– d—–w- c:\program files\Macrium 2012-07-29 22:40 . 2012-08-01 20:38 ——– dc—-w- c:\users\Patty\AppData\Local\MigWiz . . . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2012-08-15 13:42 . 2012-04-25 02:20 426184 —-a-w- c:\windows\system32\FlashPlayerApp.exe 2012-08-15 13:42 . 2011-12-09 16:53 70344 —-a-w- c:\windows\system32\FlashPlayerCPLApp.cpl 2012-07-13 20:01 . 2012-07-13 20:01 53248 —-a-r- c:\users\Patty\AppData\Roaming\Microsoft\Installer\{F42F3704-4CA7-4D28-9F5B-FDBF2E589EB2}\ARPPRODUCTICON.exe 2012-07-06 02:06 . 2012-07-16 17:59 772544 —-a-w- c:\windows\system32\npDeployJava1.dll 2012-07-06 02:06 . 2011-09-08 22:59 687544 —-a-w- c:\windows\system32\deployJava1.dll 2012-06-27 02:14 . 2012-06-27 02:14 4472832 —-a-w- c:\windows\system32\GPhotos.scr 2012-06-12 15:19 . 2012-06-12 15:19 12992 —-a-w- c:\windows\system32\drivers\PSVolAcc.sys 2012-06-12 15:19 . 2012-06-12 15:19 16064 —-a-w- c:\windows\system32\drivers\pssnap.sys 2012-06-12 15:19 . 2012-06-12 15:19 53952 —-a-w- c:\windows\system32\drivers\psmounter.sys 2012-06-06 12:49 . 2012-06-06 12:49 1070152 —-a-w- c:\windows\system32\MSCOMCTL.OCX 2012-06-06 05:05 . 2012-07-11 00:33 1390080 —-a-w- c:\windows\system32\msxml6.dll 2012-06-06 05:05 . 2012-07-11 00:33 1236992 —-a-w- c:\windows\system32\msxml3.dll 2012-06-06 05:03 . 2012-07-11 00:33 805376 —-a-w- c:\windows\system32\cdosys.dll 2012-06-02 22:19 . 2012-06-22 14:51 53784 —-a-w- c:\windows\system32\wuauclt.exe 2012-06-02 22:19 . 2012-06-22 14:51 45080 —-a-w- c:\windows\system32\wups2.dll 2012-06-02 22:19 . 2012-06-22 14:51 35864 —-a-w- c:\windows\system32\wups.dll 2012-06-02 22:19 . 2012-06-22 14:51 577048 —-a-w- c:\windows\system32\wuapi.dll 2012-06-02 22:19 . 2012-06-22 14:51 1933848 —-a-w- c:\windows\system32\wuaueng.dll 2012-06-02 22:12 . 2012-06-22 14:51 2422272 —-a-w- c:\windows\system32\wucltux.dll 2012-06-02 22:12 . 2012-06-22 14:51 88576 —-a-w- c:\windows\system32\wudriver.dll 2012-06-02 19:19 . 2012-06-22 14:51 171904 —-a-w- c:\windows\system32\wuwebv.dll 2012-06-02 19:12 . 2012-06-22 14:51 33792 —-a-w- c:\windows\system32\wuapp.exe 2012-06-02 04:45 . 2012-07-11 00:33 67440 —-a-w- c:\windows\system32\drivers\ksecdd.sys 2012-06-02 04:45 . 2012-07-11 00:33 134000 —-a-w- c:\windows\system32\drivers\ksecpkg.sys 2012-06-02 04:40 . 2012-07-11 00:33 369336 —-a-w- c:\windows\system32\drivers\cng.sys 2012-06-02 04:40 . 2012-07-11 00:33 225280 —-a-w- c:\windows\system32\schannel.dll 2012-06-02 04:39 . 2012-07-11 00:33 219136 —-a-w- c:\windows\system32\ncrypt.dll 2011-11-16 19:20 . 2011-11-28 20:40 584192 —-a-w- c:\program files\OTL.exe . . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Persistence"="c:\windows\system32\igfxpers.exe" [2010-08-26 170520] "MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2012-03-26 931200] . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "ConsentPromptBehaviorAdmin"= 5 (0x5) "ConsentPromptBehaviorUser"= 3 (0x3) "EnableUIADesktopToggle"= 0 (0x0) . [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "aux1"=wdmaud.drv . [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc] @="Service" . [HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Adobe Gamma Loader.lnk] backup=c:\windows\pss\Adobe Gamma Loader.lnk.CommonStartup backupExtension=.CommonStartup path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\Adobe Gamma Loader.lnk . [HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Event Planner Reminder 2010.lnk] backup=c:\windows\pss\Event Planner Reminder 2010.lnk.CommonStartup backupExtension=.CommonStartup path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\Event Planner Reminder 2010.lnk . [HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^KineticD.lnk] backup=c:\windows\pss\KineticD.lnk.CommonStartup backupExtension=.CommonStartup path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\KineticD.lnk . [HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Kodak EasyShare software.lnk] backup=c:\windows\pss\Kodak EasyShare software.lnk.CommonStartup backupExtension=.CommonStartup path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\Kodak EasyShare software.lnk . [HKLM\~\startupfolder\C:^Users^Patty^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^OneNote 2010 Screen Clipper and Launcher.lnk] backup=c:\windows\pss\OneNote 2010 Screen Clipper and Launcher.lnk.Startup backupExtension=.Startup path=c:\users\Patty\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2010 Screen Clipper and Launcher.lnk . [HKLM\~\startupfolder\C:^Users^Patty^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^ZooskMessenger.lnk] path=c:\users\Patty\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ZooskMessenger.lnk backup=c:\windows\pss\ZooskMessenger.lnk.Startup backupExtension=.Startup . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM] 2012-01-03 07:37 843712 —-a-w- c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher] 2012-04-04 05:53 35736 —-a-w- c:\program files\Adobe\Reader 10.0\Reader\reader_sl.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\APSDaemon] 2011-09-27 12:22 59240 —-a-w- c:\program files\Common Files\Apple\Apple Application Support\APSDaemon.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BCSSync] 2010-03-13 18:54 91520 —-a-w- c:\program files\Microsoft Office2010\Office14\BCSSync.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Garmin Lifetime Updater] 2011-12-15 15:40 1446248 —-a-w- c:\program files\Garmin\Lifetime Updater\GarminLifetime.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HotKeysCmds] 2010-08-26 00:45 171032 —-a-w- c:\windows\System32\hkcmd.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IgfxTray] 2010-08-26 00:45 136216 —-a-w- c:\windows\System32\igfxtray.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSPM] 2006-09-11 08:40 218032 —-a-w- c:\program files\Common Files\InstallShield\UpdateService\ISUSPM.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Malwarebytes' Anti-Malware (reboot)] 2012-01-13 18:53 981680 —-a-w- c:\program files\Malwarebytes' Anti-Malware\mbam.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSC] 2012-03-26 21:08 931200 —-a-w- c:\program files\Microsoft Security Client\msseces.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\OfficeSyncProcess] 2012-01-21 01:03 719672 —-a-w- c:\program files\Microsoft Office2010\Office14\MSOSYNC.EXE . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Persistence] 2010-08-26 00:45 170520 —-a-w- c:\windows\System32\igfxpers.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task] 2011-10-24 19:28 421888 —-a-w- c:\program files\QuickTime\QTTask.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched] 2012-01-17 15:07 252296 —-a-w- c:\program files\Common Files\Java\Java Update\jusched.exe . R3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [x] R3 Microsoft SharePoint Workspace Audit Service;Microsoft SharePoint Workspace Audit Service;c:\program files\Microsoft Office2010\Office14\GROOVE.EXE [x] R3 MozillaMaintenance;Mozilla Maintenance Service;c:\program files\Mozilla Maintenance Service\maintenanceservice.exe [x] R3 NisDrv;Microsoft Network Inspection System;c:\windows\system32\DRIVERS\NisDrvWFP.sys [x] R3 NisSrv;Microsoft Network Inspection;c:\program files\Microsoft Security Client\NisSrv.exe [x] R3 osppsvc;Office Software Protection Platform;c:\program files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [x] R3 Revoflt;Revoflt;c:\windows\system32\DRIVERS\revoflt.sys [x] R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [x] R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [x] R4 sesvc;ShadowExplorer Service;c:\program files\ShadowExplorer\sesvc.exe [x] S0 pssnap;Paramount Software Snapshot Filter;c:\windows\system32\DRIVERS\pssnap.sys [x] S2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files\Common Files\Adobe\ARM\1.0\armsvc.exe [x] S2 ReflectService.exe;Macrium Reflect Image Mounting Service;c:\program files\Macrium\Reflect\ReflectService.exe [x] S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt86win7.sys [x] . . [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost] GPSvcGroup REG_MULTI_SZ GPSvc . Contents of the 'Scheduled Tasks' folder . 2012-08-23 c:\windows\Tasks\Adobe Flash Player Updater.job - c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-25 13:42] . 2012-08-22 c:\windows\Tasks\ParetoLogic Registration3.job - c:\program files\Common Files\ParetoLogic\UUS3\UUS3.dll [2010-09-29 18:43] . 2012-08-23 c:\windows\Tasks\ParetoLogic Update Version3.job - c:\program files\Common Files\ParetoLogic\UUS3\Pareto_Update3.exe [2010-09-29 18:43] . . ——- Supplementary Scan ——- . uStart Page = mStart Page = hxxp://www.yahoo.com/?ilc=8&fr=mkg029 IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200 TCP: DhcpNameServer = [removed] [removed] [removed] FF - ProfilePath - c:\users\Patty\AppData\Roaming\Mozilla\Firefox\Profiles\5erqatan.default\ FF - prefs.js: browser.search.selectedEngine - Search the web (Babylon) FF - prefs.js: browser.startup.homepage - hxxp://search.babylon.com/?affID=110795&tt=bandext_3312_4&babsrc=HP_ss&mntrId=728114cc000000000000002564d80f68 FF - user.js: extensions.BabylonToolbar_i.babTrack - affID=110795&tt=bandext_3312_4 FF - user.js: extensions.BabylonToolbar_i.babExt - FF - user.js: extensions.BabylonToolbar_i.srcExt - ss FF - user.js: extensions.BabylonToolbar.tlbrSrchUrl - hxxp://www.google.com/search?babsrc=TB_ggl&q= FF - user.js: extensions.BabylonToolbar.id - 728114cc000000000000002564d80f68 FF - user.js: extensions.BabylonToolbar.instlDay - 15569 FF - user.js: extensions.BabylonToolbar.vrsn - [removed] FF - user.js: extensions.BabylonToolbar.vrsni - [removed] FF - user.js: extensions.BabylonToolbar_i.vrsnTs - [removed]:35 FF - user.js: extensions.BabylonToolbar.prtnrId - babylon FF - user.js: extensions.BabylonToolbar.prdct - BabylonToolbar FF - user.js: extensions.BabylonToolbar.aflt - babsst FF - user.js: extensions.BabylonToolbar_i.smplGrp - none FF - user.js: extensions.BabylonToolbar.tlbrId - tb9 FF - user.js: extensions.BabylonToolbar.instlRef - sst FF - user.js: extensions.BabylonToolbar.dfltLng - en FF - user.js: extensions.BabylonToolbar.excTlbr - false FF - user.js: extensions.BabylonToolbar.admin - false . - - - - ORPHANS REMOVED - - - - . MSConfigStartUp-ArcSoft Connection Service - c:\program files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe MSConfigStartUp-Messenger (Yahoo!) - c:\progra~1\Yahoo!\Messenger\YahooMessenger.exe MSConfigStartUp-PDVDDXSrv - c:\program files\CyberLink\PowerDVD DX\PDVDDXSrv.exe MSConfigStartUp-SelectRebates - c:\program files\SelectRebates\SelectRebates.exe MSConfigStartUp-SmileboxTray - c:\users\Patty\AppData\Roaming\Smilebox\SmileboxTray.exe AddRemove-{15D2D75C-9CB2-4efd-BAD7-B9B4CB4BC693} - c:\programdata\Browser Manager\2.2.565.25\{16cdff19-861d-48e3-a751-d99a27784753}\uninstall.exe AddRemove-03_Swallowtail - c:\program files\SAMSUNG\USB Drivers\03_Swallowtail\Uninstall.exe AddRemove-04_semseyite - c:\program files\SAMSUNG\USB Drivers\04_semseyite\Uninstall.exe AddRemove-16_Shrewsbury - c:\program files\SAMSUNG\USB Drivers\16_Shrewsbury\Uninstall.exe . . . ——————— LOCKED REGISTRY KEYS ——————— . [HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\User Preferences] @Denied: (2) (LocalSystem) "2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=hex:01,00,00,00,d0,8c,9d,df,01,15, d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,ab,2c,28,fe,93,ff,c0,40,87,15,fd,\ "88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15, d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,ab,2c,28,fe,93,ff,c0,40,87,15,fd,\ . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Environment*] "v5Licence0"="15-D9KX-C4Q6-DN4R-TVH3-4HM1-XCTA125" "Activated"="Y" . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security] @Denied: (Full) (Everyone) . Completion time: 2012-08-23 10:18:46 ComboFix-quarantined-files.txt 2012-08-23 14:18 . Pre-Run: 206,358,278,144 bytes free Post-Run: 206,281,707,520 bytes free . - - End Of File - - 752B978600EDEF92C60B70889B3A2B8E All processes killed ========== SERVICES/DRIVERS ========== ========== OTL ========== No active process named browsemngr.exe was found! Service Browser Manager stopped successfully! Service Browser Manager deleted successfully! C:\ProgramData\Browser Manager\2.2.565.25\{16cdff19-861d-48e3-a751-d99a27784753}\browsemngr.exe moved successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope| /E : value set successfully! Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}\ not found. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{85BB23C7-0F67-4250-6758-200ACEDDE7FE}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{85BB23C7-0F67-4250-6758-200ACEDDE7FE}\ not found. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{DECA3892-BA8F-44b8-A993-A466AD694AE4}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{DECA3892-BA8F-44b8-A993-A466AD694AE4}\ not found. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{EC23C1C8-47E1-22F0-FF5D-CD82BE4273C8}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{EC23C1C8-47E1-22F0-FF5D-CD82BE4273C8}\ not found. C:\Program Files\Mozilla Firefox\searchplugins\avg-secure-search.xml moved successfully. Use Chrome's Settings page to change the HomePage. Use Chrome's Settings page to change the HomePage. Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{2EECD738-5844-4a99-B4B6-146BF802613B}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2EECD738-5844-4a99-B4B6-146BF802613B}\ not found. Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{98889811-442D-49dd-99D7-DC866BE87DBC} deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{98889811-442D-49dd-99D7-DC866BE87DBC}\ not found. Starting removal of ActiveX control {8AD9C840-044E-11D1-B3E9-00805F499D93} Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ deleted successfully. Registry key HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ deleted successfully. Registry key HKEY_USERS\.DEFAULT\SOFTWARE\Classes\CLSID\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ not found. Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\\AppInit_Dlls:c:\progra~2\browse~1\22565~1.25\{16cdf~1\browse~1.dll deleted successfully. C:\ProgramData\Browser Manager\2.2.565.25\{16cdff19-861d-48e3-a751-d99a27784753}\traking_settings folder moved successfully. C:\ProgramData\Browser Manager\2.2.565.25\{16cdff19-861d-48e3-a751-d99a27784753} folder moved successfully. C:\ProgramData\Browser Manager\2.2.565.25 folder moved successfully. C:\ProgramData\Browser Manager folder moved successfully. C:\Users\Patty\AppData\Roaming\AVG10\cfgall folder moved successfully. C:\Users\Patty\AppData\Roaming\AVG10 folder moved successfully. C:\Users\Patty\AppData\Roaming\AVG2012\cfgall folder moved successfully. C:\Users\Patty\AppData\Roaming\AVG2012 folder moved successfully. C:\Users\Patty\AppData\Roaming\Babylon folder moved successfully. C:\Users\Patty\AppData\Roaming\Blitware\DriverRobot\updates folder moved successfully. C:\Users\Patty\AppData\Roaming\Blitware\DriverRobot\logs folder moved successfully. C:\Users\Patty\AppData\Roaming\Blitware\DriverRobot\downloads folder moved successfully. C:\Users\Patty\AppData\Roaming\Blitware\DriverRobot folder moved successfully. C:\Users\Patty\AppData\Roaming\Blitware folder moved successfully. ========== FILES ========== File\Folder C:\ProgramData\Browser Manager not found. ========== COMMANDS ========== [EMPTYTEMP] User: All Users User: Default ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes ->Flash cache emptied: 0 bytes User: Default User ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes ->Flash cache emptied: 0 bytes User: Patti's New Account ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes ->FireFox cache emptied: 0 bytes User: Patti-PC ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes ->FireFox cache emptied: 0 bytes User: Patty ->Temp folder emptied: 1287 bytes ->Temporary Internet Files folder emptied: 33170 bytes ->Java cache emptied: 0 bytes ->FireFox cache emptied: 130703358 bytes ->Google Chrome cache emptied: 0 bytes ->Flash cache emptied: 1751 bytes User: Public %systemdrive% .tmp files removed: 0 bytes %systemroot% .tmp files removed: 0 bytes %systemroot%\System32 .tmp files removed: 0 bytes %systemroot%\System32\drivers .tmp files removed: 0 bytes Windows Temp folder emptied: 12418 bytes RecycleBin emptied: 1784320 bytes Total Files Cleaned = 126.00 mb OTL by OldTimer - Version 3.2.58.1 log created on 08232012_100630 Files\Folders moved on Reboot… PendingFileRenameOperations files… Registry entries deleted on Reboot…
Post #26
All processes killed ========== SERVICES/DRIVERS ========== ========== OTL ========== No active process named browsemngr.exe was found! Service Browser Manager stopped successfully! Service Browser Manager deleted successfully! C:\ProgramData\Browser Manager\2.2.565.25\{16cdff19-861d-48e3-a751-d99a27784753}\browsemngr.exe moved successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope| /E : value set successfully! Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}\ not found. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{85BB23C7-0F67-4250-6758-200ACEDDE7FE}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{85BB23C7-0F67-4250-6758-200ACEDDE7FE}\ not found. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{DECA3892-BA8F-44b8-A993-A466AD694AE4}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{DECA3892-BA8F-44b8-A993-A466AD694AE4}\ not found. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{EC23C1C8-47E1-22F0-FF5D-CD82BE4273C8}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{EC23C1C8-47E1-22F0-FF5D-CD82BE4273C8}\ not found. C:\Program Files\Mozilla Firefox\searchplugins\avg-secure-search.xml moved successfully. Use Chrome's Settings page to change the HomePage. Use Chrome's Settings page to change the HomePage. Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{2EECD738-5844-4a99-B4B6-146BF802613B}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2EECD738-5844-4a99-B4B6-146BF802613B}\ not found. Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{98889811-442D-49dd-99D7-DC866BE87DBC} deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{98889811-442D-49dd-99D7-DC866BE87DBC}\ not found. Starting removal of ActiveX control {8AD9C840-044E-11D1-B3E9-00805F499D93} Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ deleted successfully. Registry key HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ deleted successfully. Registry key HKEY_USERS\.DEFAULT\SOFTWARE\Classes\CLSID\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ not found. Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\\AppInit_Dlls:c:\progra~2\browse~1\22565~1.25\{16cdf~1\browse~1.dll deleted successfully. C:\ProgramData\Browser Manager\2.2.565.25\{16cdff19-861d-48e3-a751-d99a27784753}\traking_settings folder moved successfully. C:\ProgramData\Browser Manager\2.2.565.25\{16cdff19-861d-48e3-a751-d99a27784753} folder moved successfully. C:\ProgramData\Browser Manager\2.2.565.25 folder moved successfully. C:\ProgramData\Browser Manager folder moved successfully. C:\Users\Patty\AppData\Roaming\AVG10\cfgall folder moved successfully. C:\Users\Patty\AppData\Roaming\AVG10 folder moved successfully. C:\Users\Patty\AppData\Roaming\AVG2012\cfgall folder moved successfully. C:\Users\Patty\AppData\Roaming\AVG2012 folder moved successfully. C:\Users\Patty\AppData\Roaming\Babylon folder moved successfully. C:\Users\Patty\AppData\Roaming\Blitware\DriverRobot\updates folder moved successfully. C:\Users\Patty\AppData\Roaming\Blitware\DriverRobot\logs folder moved successfully. C:\Users\Patty\AppData\Roaming\Blitware\DriverRobot\downloads folder moved successfully. C:\Users\Patty\AppData\Roaming\Blitware\DriverRobot folder moved successfully. C:\Users\Patty\AppData\Roaming\Blitware folder moved successfully. ========== FILES ========== File\Folder C:\ProgramData\Browser Manager not found. ========== COMMANDS ========== [EMPTYTEMP] User: All Users User: Default ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes ->Flash cache emptied: 0 bytes User: Default User ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes ->Flash cache emptied: 0 bytes User: Patti's New Account ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes ->FireFox cache emptied: 0 bytes User: Patti-PC ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes ->FireFox cache emptied: 0 bytes User: Patty ->Temp folder emptied: 1287 bytes ->Temporary Internet Files folder emptied: 33170 bytes ->Java cache emptied: 0 bytes ->FireFox cache emptied: 130703358 bytes ->Google Chrome cache emptied: 0 bytes ->Flash cache emptied: 1751 bytes User: Public %systemdrive% .tmp files removed: 0 bytes %systemroot% .tmp files removed: 0 bytes %systemroot%\System32 .tmp files removed: 0 bytes %systemroot%\System32\drivers .tmp files removed: 0 bytes Windows Temp folder emptied: 12418 bytes RecycleBin emptied: 1784320 bytes Total Files Cleaned = 126.00 mb OTL by OldTimer - Version 3.2.58.1 log created on 08232012_100630 Files\Folders moved on Reboot… PendingFileRenameOperations files… Registry entries deleted on Reboot…
Post #27
I'm not surprised you're getting confused but you are coping well and I have the logs I need.

Unfortunately, the dreaded Babylon is still lurking and we need to try to rid it with ComboFix but unfortunately, ComboFix is saved in the wrong place and the fix won't work.

ComboFix must be saved directly on your desktop. It is saved in the "Downloads" folder.

The easiest thing is to delete the copy located here and download a fresh copy to your desktop:

c:\users\Patty\Downloads\ComboFix.exe

Don't worry, about 50% of the people we help do this. "Downloads" is the default, (automatic), choice for Windows to download files to.

I'll give you the links again to save you searching for the right one. This time, when you have clicked on the link and the bar appears for you to choose where to save it, instead of clicking on the word "Save", click on the downward arrow to the right of it and choose "Desktop".

Link

Please run ComboFix again and post a new log.

There may be another delay before I get back so take your time.

Thanks

Satchfan
Post #28
When I go to download combofix, the downloads folder shows up. It gives me no opportunity to save to desktop. Just asks me to run. I have deleted all other copies of it though
Post #29
I could not save combo on the desktop but somehow I was able to make a shortcut and put that on the desktop, so hope it is the same thing. Here is the log ComboFix 12-08-22.03 - Patty 08/23/2012 11:14:54.2.2 - x86 Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.3037.1908 [GMT -4:00] Running from: c:\users\[removed]\Downloads\ComboFix.exe AV: Microsoft Security Essentials *Disabled/Updated* {9765EA51-0D3C-7DFB-6091-10E4E1F341F6} SP: Microsoft Security Essentials *Disabled/Updated* {2C040BB5-2B06-7275-5A21-2B969A740B4B} SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} . . ((((((((((((((((((((((((( Files Created from 2012-07-23 to 2012-08-23 ))))))))))))))))))))))))))))))) . . 2012-08-23 15:17 . 2012-08-23 15:17 ——– d—–w- c:\users\Patti-PC\AppData\Local\temp 2012-08-23 15:17 . 2012-08-23 15:17 ——– d—–w- c:\users\Patti's New Account\AppData\Local\temp 2012-08-23 15:17 . 2012-08-23 15:17 ——– d—–w- c:\users\Default\AppData\Local\temp 2012-08-23 14:18 . 2012-08-23 15:17 ——– d—–w- c:\users\Patty\AppData\Local\temp 2012-08-22 20:30 . 2012-08-01 22:51 7023536 —-a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{A45ACC21-E6AA-40D4-92DB-19D3873CC422}\mpengine.dll 2012-08-22 14:51 . 2012-08-22 14:51 ——– d—–w- C:\_OTL 2012-08-21 17:09 . 2012-08-01 22:51 7023536 —-a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll 2012-08-15 10:53 . 2012-07-04 21:14 41984 —-a-w- c:\windows\system32\browcli.dll 2012-08-15 10:53 . 2012-07-04 21:14 102912 —-a-w- c:\windows\system32\browser.dll 2012-08-15 10:53 . 2012-05-14 04:33 769024 —-a-w- c:\windows\system32\localspl.dll 2012-08-14 16:33 . 2012-08-14 16:33 ——– d—–w- c:\users\Patty\AppData\Local\antiphishing-vmninternethelper1_1dn 2012-08-13 21:21 . 2012-08-14 17:00 ——– d—–w- c:\programdata\Yahoo! Companion 2012-08-12 20:01 . 2012-08-12 20:01 ——– d—–w- c:\users\Patty\AppData\Local\APN 2012-08-11 23:58 . 2012-08-11 23:58 ——– d—–w- c:\users\Patty\AppData\Local\Apple Computer 2012-08-11 23:56 . 2012-08-15 10:45 ——– d—–w- c:\program files\Bonjour 2012-08-07 04:34 . 2012-08-15 10:44 ——– d—–w- c:\program files\Awesome Duplicate Photo Finder 2012-08-07 04:25 . 2012-08-07 04:26 ——– d—–w- c:\users\Patty\AppData\Roaming\EasyDuplicateFinder 2012-08-05 19:59 . 2012-08-05 19:59 ——– d—–w- c:\users\Patty\AppData\Local\MyScrapNook_12 2012-08-01 04:30 . 2012-08-01 04:30 ——– d—–w- c:\programdata\boost_interprocess 2012-07-31 19:37 . 2012-08-15 10:44 ——– d—–w- c:\program files\Free Easy CD DVD Burner 2012-07-30 03:04 . 2012-07-30 03:04 ——– d—–w- c:\programdata\Macrium 2012-07-30 03:02 . 2012-07-30 03:02 ——– d—–w- c:\program files\Macrium 2012-07-29 22:40 . 2012-08-01 20:38 ——– dc—-w- c:\users\Patty\AppData\Local\MigWiz . . . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2012-08-15 13:42 . 2012-04-25 02:20 426184 —-a-w- c:\windows\system32\FlashPlayerApp.exe 2012-08-15 13:42 . 2011-12-09 16:53 70344 —-a-w- c:\windows\system32\FlashPlayerCPLApp.cpl 2012-07-13 20:01 . 2012-07-13 20:01 53248 —-a-r- c:\users\Patty\AppData\Roaming\Microsoft\Installer\{F42F3704-4CA7-4D28-9F5B-FDBF2E589EB2}\ARPPRODUCTICON.exe 2012-07-06 02:06 . 2012-07-16 17:59 772544 —-a-w- c:\windows\system32\npDeployJava1.dll 2012-07-06 02:06 . 2011-09-08 22:59 687544 —-a-w- c:\windows\system32\deployJava1.dll 2012-06-27 02:14 . 2012-06-27 02:14 4472832 —-a-w- c:\windows\system32\GPhotos.scr 2012-06-12 15:19 . 2012-06-12 15:19 12992 —-a-w- c:\windows\system32\drivers\PSVolAcc.sys 2012-06-12 15:19 . 2012-06-12 15:19 16064 —-a-w- c:\windows\system32\drivers\pssnap.sys 2012-06-12 15:19 . 2012-06-12 15:19 53952 —-a-w- c:\windows\system32\drivers\psmounter.sys 2012-06-06 12:49 . 2012-06-06 12:49 1070152 —-a-w- c:\windows\system32\MSCOMCTL.OCX 2012-06-06 05:05 . 2012-07-11 00:33 1390080 —-a-w- c:\windows\system32\msxml6.dll 2012-06-06 05:05 . 2012-07-11 00:33 1236992 —-a-w- c:\windows\system32\msxml3.dll 2012-06-06 05:03 . 2012-07-11 00:33 805376 —-a-w- c:\windows\system32\cdosys.dll 2012-06-02 22:19 . 2012-06-22 14:51 53784 —-a-w- c:\windows\system32\wuauclt.exe 2012-06-02 22:19 . 2012-06-22 14:51 45080 —-a-w- c:\windows\system32\wups2.dll 2012-06-02 22:19 . 2012-06-22 14:51 35864 —-a-w- c:\windows\system32\wups.dll 2012-06-02 22:19 . 2012-06-22 14:51 577048 —-a-w- c:\windows\system32\wuapi.dll 2012-06-02 22:19 . 2012-06-22 14:51 1933848 —-a-w- c:\windows\system32\wuaueng.dll 2012-06-02 22:12 . 2012-06-22 14:51 2422272 —-a-w- c:\windows\system32\wucltux.dll 2012-06-02 22:12 . 2012-06-22 14:51 88576 —-a-w- c:\windows\system32\wudriver.dll 2012-06-02 19:19 . 2012-06-22 14:51 171904 —-a-w- c:\windows\system32\wuwebv.dll 2012-06-02 19:12 . 2012-06-22 14:51 33792 —-a-w- c:\windows\system32\wuapp.exe 2012-06-02 04:45 . 2012-07-11 00:33 67440 —-a-w- c:\windows\system32\drivers\ksecdd.sys 2012-06-02 04:45 . 2012-07-11 00:33 134000 —-a-w- c:\windows\system32\drivers\ksecpkg.sys 2012-06-02 04:40 . 2012-07-11 00:33 369336 —-a-w- c:\windows\system32\drivers\cng.sys 2012-06-02 04:40 . 2012-07-11 00:33 225280 —-a-w- c:\windows\system32\schannel.dll 2012-06-02 04:39 . 2012-07-11 00:33 219136 —-a-w- c:\windows\system32\ncrypt.dll 2011-11-16 19:20 . 2011-11-28 20:40 584192 —-a-w- c:\program files\OTL.exe . . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Persistence"="c:\windows\system32\igfxpers.exe" [2010-08-26 170520] "MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2012-03-26 931200] . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "ConsentPromptBehaviorAdmin"= 5 (0x5) "ConsentPromptBehaviorUser"= 3 (0x3) "EnableUIADesktopToggle"= 0 (0x0) . [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "aux1"=wdmaud.drv . [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc] @="Service" . [HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Adobe Gamma Loader.lnk] backup=c:\windows\pss\Adobe Gamma Loader.lnk.CommonStartup backupExtension=.CommonStartup path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\Adobe Gamma Loader.lnk . [HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Event Planner Reminder 2010.lnk] backup=c:\windows\pss\Event Planner Reminder 2010.lnk.CommonStartup backupExtension=.CommonStartup path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\Event Planner Reminder 2010.lnk . [HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^KineticD.lnk] backup=c:\windows\pss\KineticD.lnk.CommonStartup backupExtension=.CommonStartup path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\KineticD.lnk . [HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Kodak EasyShare software.lnk] backup=c:\windows\pss\Kodak EasyShare software.lnk.CommonStartup backupExtension=.CommonStartup path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\Kodak EasyShare software.lnk . [HKLM\~\startupfolder\C:^Users^Patty^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^OneNote 2010 Screen Clipper and Launcher.lnk] backup=c:\windows\pss\OneNote 2010 Screen Clipper and Launcher.lnk.Startup backupExtension=.Startup path=c:\users\Patty\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2010 Screen Clipper and Launcher.lnk . [HKLM\~\startupfolder\C:^Users^Patty^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^ZooskMessenger.lnk] path=c:\users\Patty\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ZooskMessenger.lnk backup=c:\windows\pss\ZooskMessenger.lnk.Startup backupExtension=.Startup . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM] 2012-01-03 07:37 843712 —-a-w- c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher] 2012-04-04 05:53 35736 —-a-w- c:\program files\Adobe\Reader 10.0\Reader\reader_sl.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\APSDaemon] 2011-09-27 12:22 59240 —-a-w- c:\program files\Common Files\Apple\Apple Application Support\APSDaemon.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BCSSync] 2010-03-13 18:54 91520 —-a-w- c:\program files\Microsoft Office2010\Office14\BCSSync.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Garmin Lifetime Updater] 2011-12-15 15:40 1446248 —-a-w- c:\program files\Garmin\Lifetime Updater\GarminLifetime.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HotKeysCmds] 2010-08-26 00:45 171032 —-a-w- c:\windows\System32\hkcmd.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IgfxTray] 2010-08-26 00:45 136216 —-a-w- c:\windows\System32\igfxtray.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSPM] 2006-09-11 08:40 218032 —-a-w- c:\program files\Common Files\InstallShield\UpdateService\ISUSPM.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Malwarebytes' Anti-Malware (reboot)] 2012-01-13 18:53 981680 —-a-w- c:\program files\Malwarebytes' Anti-Malware\mbam.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSC] 2012-03-26 21:08 931200 —-a-w- c:\program files\Microsoft Security Client\msseces.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\OfficeSyncProcess] 2012-01-21 01:03 719672 —-a-w- c:\program files\Microsoft Office2010\Office14\MSOSYNC.EXE . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Persistence] 2010-08-26 00:45 170520 —-a-w- c:\windows\System32\igfxpers.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task] 2011-10-24 19:28 421888 —-a-w- c:\program files\QuickTime\QTTask.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched] 2012-01-17 15:07 252296 —-a-w- c:\program files\Common Files\Java\Java Update\jusched.exe . R3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [x] R3 Microsoft SharePoint Workspace Audit Service;Microsoft SharePoint Workspace Audit Service;c:\program files\Microsoft Office2010\Office14\GROOVE.EXE [x] R3 MozillaMaintenance;Mozilla Maintenance Service;c:\program files\Mozilla Maintenance Service\maintenanceservice.exe [x] R3 NisDrv;Microsoft Network Inspection System;c:\windows\system32\DRIVERS\NisDrvWFP.sys [x] R3 NisSrv;Microsoft Network Inspection;c:\program files\Microsoft Security Client\NisSrv.exe [x] R3 Revoflt;Revoflt;c:\windows\system32\DRIVERS\revoflt.sys [x] R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [x] R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [x] R4 sesvc;ShadowExplorer Service;c:\program files\ShadowExplorer\sesvc.exe [x] S0 pssnap;Paramount Software Snapshot Filter;c:\windows\system32\DRIVERS\pssnap.sys [x] S2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files\Common Files\Adobe\ARM\1.0\armsvc.exe [x] S2 ReflectService.exe;Macrium Reflect Image Mounting Service;c:\program files\Macrium\Reflect\ReflectService.exe [x] S3 osppsvc;Office Software Protection Platform;c:\program files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [x] S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt86win7.sys [x] . . [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost] GPSvcGroup REG_MULTI_SZ GPSvc . Contents of the 'Scheduled Tasks' folder . 2012-08-23 c:\windows\Tasks\Adobe Flash Player Updater.job - c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-25 13:42] . 2012-08-22 c:\windows\Tasks\ParetoLogic Registration3.job - c:\program files\Common Files\ParetoLogic\UUS3\UUS3.dll [2010-09-29 18:43] . 2012-08-23 c:\windows\Tasks\ParetoLogic Update Version3.job - c:\program files\Common Files\ParetoLogic\UUS3\Pareto_Update3.exe [2010-09-29 18:43] . . ——- Supplementary Scan ——- . uStart Page = mStart Page = hxxp://www.yahoo.com/?ilc=8&fr=mkg029 IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200 TCP: DhcpNameServer = [removed] [removed] [removed] FF - ProfilePath - c:\users\Patty\AppData\Roaming\Mozilla\Firefox\Profiles\5erqatan.default\ FF - prefs.js: browser.search.selectedEngine - Search the web (Babylon) FF - prefs.js: browser.startup.homepage - hxxp://search.babylon.com/?affID=110795&tt=bandext_3312_4&babsrc=HP_ss&mntrId=728114cc000000000000002564d80f68 FF - user.js: extensions.BabylonToolbar_i.babTrack - affID=110795&tt=bandext_3312_4 FF - user.js: extensions.BabylonToolbar_i.babExt - FF - user.js: extensions.BabylonToolbar_i.srcExt - ss FF - user.js: extensions.BabylonToolbar.tlbrSrchUrl - hxxp://www.google.com/search?babsrc=TB_ggl&q= FF - user.js: extensions.BabylonToolbar.id - 728114cc000000000000002564d80f68 FF - user.js: extensions.BabylonToolbar.instlDay - 15569 FF - user.js: extensions.BabylonToolbar.vrsn - [removed] FF - user.js: extensions.BabylonToolbar.vrsni - [removed] FF - user.js: extensions.BabylonToolbar_i.vrsnTs - [removed]:35 FF - user.js: extensions.BabylonToolbar.prtnrId - babylon FF - user.js: extensions.BabylonToolbar.prdct - BabylonToolbar FF - user.js: extensions.BabylonToolbar.aflt - babsst FF - user.js: extensions.BabylonToolbar_i.smplGrp - none FF - user.js: extensions.BabylonToolbar.tlbrId - tb9 FF - user.js: extensions.BabylonToolbar.instlRef - sst FF - user.js: extensions.BabylonToolbar.dfltLng - en FF - user.js: extensions.BabylonToolbar.excTlbr - false FF - user.js: extensions.BabylonToolbar.admin - false . . ——————— LOCKED REGISTRY KEYS ——————— . [HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\User Preferences] @Denied: (2) (LocalSystem) "2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=hex:01,00,00,00,d0,8c,9d,df,01,15, d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,ab,2c,28,fe,93,ff,c0,40,87,15,fd,\ "88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15, d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,ab,2c,28,fe,93,ff,c0,40,87,15,fd,\ . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Environment*] "v5Licence0"="15-D9KX-C4Q6-DN4R-TVH3-4HM1-XCTA125" "Activated"="Y" . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security] @Denied: (Full) (Everyone) . Completion time: 2012-08-23 11:19:20 ComboFix-quarantined-files.txt 2012-08-23 15:19 ComboFix2.txt 2012-08-23 14:18 . Pre-Run: 206,333,263,872 bytes free Post-Run: 206,283,509,760 bytes free . - - End Of File - - 3C8A05E98ECB455D9EF24A77B5F48EAA
Post #30
OK, by going via left overshoe, I just moved the file from downloads to desktop. So here is the log from the actual comobofix, not a shortcut. I don't know if it is different or not. ComboFix 12-08-22.03 - Patty 08/23/2012 11:30:11.3.2 - x86 Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.3037.1955 [GMT -4:00] Running from: c:\users\[removed]\Desktop\ComboFix.exe AV: Microsoft Security Essentials *Disabled/Updated* {9765EA51-0D3C-7DFB-6091-10E4E1F341F6} SP: Microsoft Security Essentials *Disabled/Updated* {2C040BB5-2B06-7275-5A21-2B969A740B4B} SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} . . ((((((((((((((((((((((((( Files Created from 2012-07-23 to 2012-08-23 ))))))))))))))))))))))))))))))) . . 2012-08-23 15:33 . 2012-08-23 15:33 ——– d—–w- c:\users\Patti-PC\AppData\Local\temp 2012-08-23 15:33 . 2012-08-23 15:33 ——– d—–w- c:\users\Patti's New Account\AppData\Local\temp 2012-08-23 15:33 . 2012-08-23 15:33 ——– d—–w- c:\users\Default\AppData\Local\temp 2012-08-23 14:18 . 2012-08-23 15:33 ——– d—–w- c:\users\Patty\AppData\Local\temp 2012-08-22 20:30 . 2012-08-01 22:51 7023536 —-a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{A45ACC21-E6AA-40D4-92DB-19D3873CC422}\mpengine.dll 2012-08-22 14:51 . 2012-08-22 14:51 ——– d—–w- C:\_OTL 2012-08-21 17:09 . 2012-08-01 22:51 7023536 —-a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll 2012-08-15 10:53 . 2012-07-04 21:14 41984 —-a-w- c:\windows\system32\browcli.dll 2012-08-15 10:53 . 2012-07-04 21:14 102912 —-a-w- c:\windows\system32\browser.dll 2012-08-15 10:53 . 2012-05-14 04:33 769024 —-a-w- c:\windows\system32\localspl.dll 2012-08-14 16:33 . 2012-08-14 16:33 ——– d—–w- c:\users\Patty\AppData\Local\antiphishing-vmninternethelper1_1dn 2012-08-13 21:21 . 2012-08-14 17:00 ——– d—–w- c:\programdata\Yahoo! Companion 2012-08-12 20:01 . 2012-08-12 20:01 ——– d—–w- c:\users\Patty\AppData\Local\APN 2012-08-11 23:58 . 2012-08-11 23:58 ——– d—–w- c:\users\Patty\AppData\Local\Apple Computer 2012-08-11 23:56 . 2012-08-15 10:45 ——– d—–w- c:\program files\Bonjour 2012-08-07 04:34 . 2012-08-15 10:44 ——– d—–w- c:\program files\Awesome Duplicate Photo Finder 2012-08-07 04:25 . 2012-08-07 04:26 ——– d—–w- c:\users\Patty\AppData\Roaming\EasyDuplicateFinder 2012-08-05 19:59 . 2012-08-05 19:59 ——– d—–w- c:\users\Patty\AppData\Local\MyScrapNook_12 2012-08-01 04:30 . 2012-08-01 04:30 ——– d—–w- c:\programdata\boost_interprocess 2012-07-31 19:37 . 2012-08-15 10:44 ——– d—–w- c:\program files\Free Easy CD DVD Burner 2012-07-30 03:04 . 2012-07-30 03:04 ——– d—–w- c:\programdata\Macrium 2012-07-30 03:02 . 2012-07-30 03:02 ——– d—–w- c:\program files\Macrium 2012-07-29 22:40 . 2012-08-01 20:38 ——– dc—-w- c:\users\Patty\AppData\Local\MigWiz . . . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2012-08-15 13:42 . 2012-04-25 02:20 426184 —-a-w- c:\windows\system32\FlashPlayerApp.exe 2012-08-15 13:42 . 2011-12-09 16:53 70344 —-a-w- c:\windows\system32\FlashPlayerCPLApp.cpl 2012-07-13 20:01 . 2012-07-13 20:01 53248 —-a-r- c:\users\Patty\AppData\Roaming\Microsoft\Installer\{F42F3704-4CA7-4D28-9F5B-FDBF2E589EB2}\ARPPRODUCTICON.exe 2012-07-06 02:06 . 2012-07-16 17:59 772544 —-a-w- c:\windows\system32\npDeployJava1.dll 2012-07-06 02:06 . 2011-09-08 22:59 687544 —-a-w- c:\windows\system32\deployJava1.dll 2012-06-27 02:14 . 2012-06-27 02:14 4472832 —-a-w- c:\windows\system32\GPhotos.scr 2012-06-12 15:19 . 2012-06-12 15:19 12992 —-a-w- c:\windows\system32\drivers\PSVolAcc.sys 2012-06-12 15:19 . 2012-06-12 15:19 16064 —-a-w- c:\windows\system32\drivers\pssnap.sys 2012-06-12 15:19 . 2012-06-12 15:19 53952 —-a-w- c:\windows\system32\drivers\psmounter.sys 2012-06-06 12:49 . 2012-06-06 12:49 1070152 —-a-w- c:\windows\system32\MSCOMCTL.OCX 2012-06-06 05:05 . 2012-07-11 00:33 1390080 —-a-w- c:\windows\system32\msxml6.dll 2012-06-06 05:05 . 2012-07-11 00:33 1236992 —-a-w- c:\windows\system32\msxml3.dll 2012-06-06 05:03 . 2012-07-11 00:33 805376 —-a-w- c:\windows\system32\cdosys.dll 2012-06-02 22:19 . 2012-06-22 14:51 53784 —-a-w- c:\windows\system32\wuauclt.exe 2012-06-02 22:19 . 2012-06-22 14:51 45080 —-a-w- c:\windows\system32\wups2.dll 2012-06-02 22:19 . 2012-06-22 14:51 35864 —-a-w- c:\windows\system32\wups.dll 2012-06-02 22:19 . 2012-06-22 14:51 577048 —-a-w- c:\windows\system32\wuapi.dll 2012-06-02 22:19 . 2012-06-22 14:51 1933848 —-a-w- c:\windows\system32\wuaueng.dll 2012-06-02 22:12 . 2012-06-22 14:51 2422272 —-a-w- c:\windows\system32\wucltux.dll 2012-06-02 22:12 . 2012-06-22 14:51 88576 —-a-w- c:\windows\system32\wudriver.dll 2012-06-02 19:19 . 2012-06-22 14:51 171904 —-a-w- c:\windows\system32\wuwebv.dll 2012-06-02 19:12 . 2012-06-22 14:51 33792 —-a-w- c:\windows\system32\wuapp.exe 2012-06-02 04:45 . 2012-07-11 00:33 67440 —-a-w- c:\windows\system32\drivers\ksecdd.sys 2012-06-02 04:45 . 2012-07-11 00:33 134000 —-a-w- c:\windows\system32\drivers\ksecpkg.sys 2012-06-02 04:40 . 2012-07-11 00:33 369336 —-a-w- c:\windows\system32\drivers\cng.sys 2012-06-02 04:40 . 2012-07-11 00:33 225280 —-a-w- c:\windows\system32\schannel.dll 2012-06-02 04:39 . 2012-07-11 00:33 219136 —-a-w- c:\windows\system32\ncrypt.dll 2011-11-16 19:20 . 2011-11-28 20:40 584192 —-a-w- c:\program files\OTL.exe . . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Persistence"="c:\windows\system32\igfxpers.exe" [2010-08-26 170520] "MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2012-03-26 931200] . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "ConsentPromptBehaviorAdmin"= 5 (0x5) "ConsentPromptBehaviorUser"= 3 (0x3) "EnableUIADesktopToggle"= 0 (0x0) . [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "aux1"=wdmaud.drv . [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc] @="Service" . [HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Adobe Gamma Loader.lnk] backup=c:\windows\pss\Adobe Gamma Loader.lnk.CommonStartup backupExtension=.CommonStartup path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\Adobe Gamma Loader.lnk . [HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Event Planner Reminder 2010.lnk] backup=c:\windows\pss\Event Planner Reminder 2010.lnk.CommonStartup backupExtension=.CommonStartup path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\Event Planner Reminder 2010.lnk . [HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^KineticD.lnk] backup=c:\windows\pss\KineticD.lnk.CommonStartup backupExtension=.CommonStartup path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\KineticD.lnk . [HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Kodak EasyShare software.lnk] backup=c:\windows\pss\Kodak EasyShare software.lnk.CommonStartup backupExtension=.CommonStartup path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\Kodak EasyShare software.lnk . [HKLM\~\startupfolder\C:^Users^Patty^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^OneNote 2010 Screen Clipper and Launcher.lnk] backup=c:\windows\pss\OneNote 2010 Screen Clipper and Launcher.lnk.Startup backupExtension=.Startup path=c:\users\Patty\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2010 Screen Clipper and Launcher.lnk . [HKLM\~\startupfolder\C:^Users^Patty^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^ZooskMessenger.lnk] path=c:\users\Patty\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ZooskMessenger.lnk backup=c:\windows\pss\ZooskMessenger.lnk.Startup backupExtension=.Startup . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM] 2012-01-03 07:37 843712 —-a-w- c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher] 2012-04-04 05:53 35736 —-a-w- c:\program files\Adobe\Reader 10.0\Reader\reader_sl.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\APSDaemon] 2011-09-27 12:22 59240 —-a-w- c:\program files\Common Files\Apple\Apple Application Support\APSDaemon.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BCSSync] 2010-03-13 18:54 91520 —-a-w- c:\program files\Microsoft Office2010\Office14\BCSSync.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Garmin Lifetime Updater] 2011-12-15 15:40 1446248 —-a-w- c:\program files\Garmin\Lifetime Updater\GarminLifetime.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HotKeysCmds] 2010-08-26 00:45 171032 —-a-w- c:\windows\System32\hkcmd.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IgfxTray] 2010-08-26 00:45 136216 —-a-w- c:\windows\System32\igfxtray.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSPM] 2006-09-11 08:40 218032 —-a-w- c:\program files\Common Files\InstallShield\UpdateService\ISUSPM.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Malwarebytes' Anti-Malware (reboot)] 2012-01-13 18:53 981680 —-a-w- c:\program files\Malwarebytes' Anti-Malware\mbam.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSC] 2012-03-26 21:08 931200 —-a-w- c:\program files\Microsoft Security Client\msseces.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\OfficeSyncProcess] 2012-01-21 01:03 719672 —-a-w- c:\program files\Microsoft Office2010\Office14\MSOSYNC.EXE . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Persistence] 2010-08-26 00:45 170520 —-a-w- c:\windows\System32\igfxpers.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task] 2011-10-24 19:28 421888 —-a-w- c:\program files\QuickTime\QTTask.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched] 2012-01-17 15:07 252296 —-a-w- c:\program files\Common Files\Java\Java Update\jusched.exe . R3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [x] R3 Microsoft SharePoint Workspace Audit Service;Microsoft SharePoint Workspace Audit Service;c:\program files\Microsoft Office2010\Office14\GROOVE.EXE [x] R3 MozillaMaintenance;Mozilla Maintenance Service;c:\program files\Mozilla Maintenance Service\maintenanceservice.exe [x] R3 NisDrv;Microsoft Network Inspection System;c:\windows\system32\DRIVERS\NisDrvWFP.sys [x] R3 NisSrv;Microsoft Network Inspection;c:\program files\Microsoft Security Client\NisSrv.exe [x] R3 Revoflt;Revoflt;c:\windows\system32\DRIVERS\revoflt.sys [x] R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [x] R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [x] R4 sesvc;ShadowExplorer Service;c:\program files\ShadowExplorer\sesvc.exe [x] S0 pssnap;Paramount Software Snapshot Filter;c:\windows\system32\DRIVERS\pssnap.sys [x] S2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files\Common Files\Adobe\ARM\1.0\armsvc.exe [x] S2 ReflectService.exe;Macrium Reflect Image Mounting Service;c:\program files\Macrium\Reflect\ReflectService.exe [x] S3 osppsvc;Office Software Protection Platform;c:\program files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [x] S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt86win7.sys [x] . . [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost] GPSvcGroup REG_MULTI_SZ GPSvc . Contents of the 'Scheduled Tasks' folder . 2012-08-23 c:\windows\Tasks\Adobe Flash Player Updater.job - c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-25 13:42] . 2012-08-22 c:\windows\Tasks\ParetoLogic Registration3.job - c:\program files\Common Files\ParetoLogic\UUS3\UUS3.dll [2010-09-29 18:43] . 2012-08-23 c:\windows\Tasks\ParetoLogic Update Version3.job - c:\program files\Common Files\ParetoLogic\UUS3\Pareto_Update3.exe [2010-09-29 18:43] . . ——- Supplementary Scan ——- . uStart Page = mStart Page = hxxp://www.yahoo.com/?ilc=8&fr=mkg029 IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200 TCP: DhcpNameServer = [removed] [removed] [removed] FF - ProfilePath - c:\users\Patty\AppData\Roaming\Mozilla\Firefox\Profiles\5erqatan.default\ FF - prefs.js: browser.search.selectedEngine - Search the web (Babylon) FF - prefs.js: browser.startup.homepage - hxxp://search.babylon.com/?affID=110795&tt=bandext_3312_4&babsrc=HP_ss&mntrId=728114cc000000000000002564d80f68 FF - user.js: extensions.BabylonToolbar_i.babTrack - affID=110795&tt=bandext_3312_4 FF - user.js: extensions.BabylonToolbar_i.babExt - FF - user.js: extensions.BabylonToolbar_i.srcExt - ss FF - user.js: extensions.BabylonToolbar.tlbrSrchUrl - hxxp://www.google.com/search?babsrc=TB_ggl&q= FF - user.js: extensions.BabylonToolbar.id - 728114cc000000000000002564d80f68 FF - user.js: extensions.BabylonToolbar.instlDay - 15569 FF - user.js: extensions.BabylonToolbar.vrsn - [removed] FF - user.js: extensions.BabylonToolbar.vrsni - [removed] FF - user.js: extensions.BabylonToolbar_i.vrsnTs - [removed]:35 FF - user.js: extensions.BabylonToolbar.prtnrId - babylon FF - user.js: extensions.BabylonToolbar.prdct - BabylonToolbar FF - user.js: extensions.BabylonToolbar.aflt - babsst FF - user.js: extensions.BabylonToolbar_i.smplGrp - none FF - user.js: extensions.BabylonToolbar.tlbrId - tb9 FF - user.js: extensions.BabylonToolbar.instlRef - sst FF - user.js: extensions.BabylonToolbar.dfltLng - en FF - user.js: extensions.BabylonToolbar.excTlbr - false FF - user.js: extensions.BabylonToolbar.admin - false . . ——————— LOCKED REGISTRY KEYS ——————— . [HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\User Preferences] @Denied: (2) (LocalSystem) "2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=hex:01,00,00,00,d0,8c,9d,df,01,15, d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,ab,2c,28,fe,93,ff,c0,40,87,15,fd,\ "88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15, d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,ab,2c,28,fe,93,ff,c0,40,87,15,fd,\ . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Environment*] "v5Licence0"="15-D9KX-C4Q6-DN4R-TVH3-4HM1-XCTA125" "Activated"="Y" . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security] @Denied: (Full) (Everyone) . Completion time: 2012-08-23 11:34:43 ComboFix-quarantined-files.txt 2012-08-23 15:34 ComboFix2.txt 2012-08-23 15:19 ComboFix3.txt 2012-08-23 14:18 . Pre-Run: 206,320,013,312 bytes free Post-Run: 206,275,088,384 bytes free . - - End Of File - - BCBB6BE080742EB3DE1309EEF340482C

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI