Spyware / Malware / Virus Removal

Xoftspyse - Satchfan [Solved]

59 min read

Looking for the outcome? Ask AI

PattiChati Topic Starter

Post #1August 30, 2012, 2:49 PM UTC

I have Xoftspyse back on my computer. Thought I got rid of it months ago. It just pops on on any screen, doesn't matter what I am doing. It is called Pareto self updater. I cannot stop it from updating unless I hit cntr delete. I cannot find it on the computer by its name though. I remember googling this before and people couldn't get rid of it. Can you help again?

PattiChati

Post #2August 30, 2012, 8:09 PM UTC

OTL logfile created on: 8/30/2012 3:57:11 PM - Run 1
OTL by OldTimer - Version 3.2.59.1 Folder = C:\Users\Patty\Downloads
Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7601.17514)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

2.97 Gb Total Physical Memory | 1.97 Gb Available Physical Memory | 66.59% Memory free
5.93 Gb Paging File | 4.53 Gb Available in Paging File | 76.37% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 297.99 Gb Total Space | 238.64 Gb Free Space | 80.08% Space Free | Partition Type: NTFS
Drive J: | 931.51 Gb Total Space | 588.39 Gb Free Space | 63.17% Space Free | Partition Type: NTFS

Computer Name: PATTI-PC | User Name: Patty | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2012/08/30 15:56:22 | 000,598,528 | —- | M] (OldTimer Tools) – C:\Users\Patty\Downloads\OTL(4).exe
PRC - [2012/08/26 23:05:05 | 001,807,560 | —- | M] (Adobe Systems, Inc.) – C:\Windows\System32\Macromed\Flash\FlashPlayerPlugin_11_4_402_265.exe
PRC - [2012/08/20 23:32:24 | 000,224,960 | —- | M] () – C:\Program Files\Macrium\Reflect\ReflectService.exe
PRC - [2012/07/27 16:51:26 | 000,063,960 | —- | M] (Adobe Systems Incorporated) – C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe
PRC - [2012/07/13 20:17:11 | 000,913,888 | —- | M] (Mozilla Corporation) – C:\Program Files\Mozilla Firefox\firefox.exe
PRC - [2012/07/03 13:46:44 | 000,655,944 | —- | M] (Malwarebytes Corporation) – C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
PRC - [2012/07/03 13:46:44 | 000,462,920 | —- | M] (Malwarebytes Corporation) – C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe
PRC - [2012/03/26 17:08:12 | 000,931,200 | —- | M] (Microsoft Corporation) – C:\Program Files\Microsoft Security Client\msseces.exe
PRC - [2012/03/26 17:03:40 | 000,011,552 | —- | M] (Microsoft Corporation) – C:\Program Files\Microsoft Security Client\MsMpEng.exe
PRC - [2011/10/12 08:55:06 | 000,366,496 | —- | M] (Creative Home) – C:\Program Files\Creative Home\Hallmark Card Studio 2012 Deluxe\Planner\PLNRnote.exe
PRC - [2011/08/08 03:55:42 | 003,147,856 | —- | M] (VS Revo Group) – C:\Program Files\VS Revo Group\Revo Uninstaller\Revouninstaller.exe
PRC - [2011/02/25 01:30:54 | 002,616,320 | —- | M] (Microsoft Corporation) – C:\Windows\explorer.exe
PRC - [2010/11/20 08:17:47 | 000,049,152 | —- | M] (Microsoft Corporation) – C:\Windows\System32\taskhost.exe

========== Modules (No Company Name) ==========

MOD - [2012/08/26 23:05:04 | 009,813,704 | —- | M] () – C:\Windows\System32\Macromed\Flash\NPSWF32_11_4_402_265.dll
MOD - [2012/07/13 20:17:14 | 002,003,424 | —- | M] () – C:\Program Files\Mozilla Firefox\mozjs.dll
MOD - [2012/06/14 03:24:50 | 014,340,608 | —- | M] () – C:\Windows\assembly\NativeImages_v2.0.50727_32\PresentationFramewo#\e717a230496832656b05b515eb9f3bc5\PresentationFramework.ni.dll
MOD - [2012/06/14 03:24:28 | 012,237,824 | —- | M] () – C:\Windows\assembly\NativeImages_v2.0.50727_32\PresentationCore\14a87218ea49639f38097e278b98a3da\PresentationCore.ni.dll
MOD - [2012/05/10 03:29:49 | 002,297,856 | —- | M] () – C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Core\dfd33f59a5803a3c73cf408362e6e0b7\System.Core.ni.dll
MOD - [2012/05/10 03:25:10 | 003,347,968 | —- | M] () – C:\Windows\assembly\NativeImages_v2.0.50727_32\WindowsBase\46fce56db7685a586d3eeb7c373e3c1c\WindowsBase.ni.dll
MOD - [2012/05/10 03:25:02 | 007,967,232 | —- | M] () – C:\Windows\assembly\NativeImages_v2.0.50727_32\System\ce9ff6baf9053ed2ed673d948179195c\System.ni.dll
MOD - [2012/05/10 03:24:54 | 011,492,864 | —- | M] () – C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\acfc1391e45fedd2a359778ea57d914c\mscorlib.ni.dll
MOD - [2011/10/11 08:40:16 | 000,045,568 | —- | M] () – C:\Program Files\Creative Home\Hallmark Card Studio 2012 Deluxe\Planner\InteropHelper.dll
MOD - [2011/03/17 00:11:16 | 004,297,568 | —- | M] () – C:\Program Files\Common Files\microsoft shared\OFFICE14\Cultures\OFFICE.ODF
MOD - [2010/10/20 15:45:26 | 008,801,120 | —- | M] () – C:\Program Files\Microsoft Office2010\Office14\1033\GrooveIntlResource.dll

========== Services (SafeList) ==========

SRV - [2012/08/26 23:05:05 | 000,250,568 | —- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] – C:\Windows\System32\Macromed\Flash\FlashPlayerUpdateService.exe – (AdobeFlashPlayerUpdateSvc)
SRV - [2012/08/20 23:32:24 | 000,224,960 | —- | M] () [Auto | Running] – C:\Program Files\Macrium\Reflect\ReflectService.exe – (ReflectService.exe)
SRV - [2012/07/27 16:51:26 | 000,063,960 | —- | M] (Adobe Systems Incorporated) [Auto | Running] – C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe – (AdobeARMservice)
SRV - [2012/07/13 20:17:12 | 000,113,120 | —- | M] (Mozilla Foundation) [On_Demand | Stopped] – C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe – (MozillaMaintenance)
SRV - [2012/07/03 13:46:44 | 000,655,944 | —- | M] (Malwarebytes Corporation) [Auto | Running] – C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe – (MBAMService)
SRV - [2012/03/26 17:03:40 | 000,214,952 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] – C:\Program Files\Microsoft Security Client\NisSrv.exe – (NisSrv)
SRV - [2012/03/26 17:03:40 | 000,011,552 | —- | M] (Microsoft Corporation) [Auto | Running] – C:\Program Files\Microsoft Security Client\MsMpEng.exe – (MsMpSvc)
SRV - [2012/02/11 00:45:21 | 001,343,400 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] – C:\Windows\System32\Wat\WatAdminSvc.exe – (WatAdminSvc)
SRV - [2011/06/12 11:15:00 | 031,125,880 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] – C:\Program Files\Microsoft Office2010\Office14\GROOVE.EXE – (Microsoft SharePoint Workspace Audit Service)
SRV - [2011/01/02 21:29:50 | 000,009,216 | —- | M] (www.shadowexplorer.com) [Disabled | Stopped] – C:\Program Files\ShadowExplorer\sesvc.exe – (sesvc)
SRV - [2009/07/13 21:16:13 | 000,025,088 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] – C:\Windows\System32\sensrsvc.dll – (SensrSvc)
SRV - [2009/07/13 21:15:41 | 000,680,960 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] – C:\Program Files\Windows Defender\MpSvc.dll – (WinDefend)

========== Driver Services (SafeList) ==========

DRV - [2012/08/20 23:33:47 | 000,012,992 | —- | M] (Paramount Software UK Ltd) [File_System | On_Demand | Stopped] – C:\Windows\System32\drivers\PSVolAcc.sys – (PSVolAcc)
DRV - [2012/08/20 23:33:27 | 000,016,064 | —- | M] (Macrium Software) [Kernel | Boot | Running] – C:\Windows\System32\drivers\pssnap.sys – (pssnap)
DRV - [2012/08/20 23:33:19 | 000,053,952 | —- | M] (Macrium Software) [Kernel | On_Demand | Stopped] – C:\Windows\System32\drivers\psmounter.sys – (PSMounter)
DRV - [2012/07/03 13:46:44 | 000,022,344 | —- | M] (Malwarebytes Corporation) [File_System | On_Demand | Running] – C:\Windows\System32\drivers\mbam.sys – (MBAMProtector)
DRV - [2012/03/20 20:44:12 | 000,074,112 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\System32\drivers\NisDrvWFP.sys – (NisDrv)
DRV - [2010/11/20 06:24:41 | 000,052,224 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\System32\drivers\TsUsbFlt.sys – (TsUsbFlt)
DRV - [2010/11/20 05:59:44 | 000,035,968 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\System32\drivers\winusb.sys – (WinUsb)
DRV - [2010/11/11 01:11:46 | 000,132,424 | —- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\System32\drivers\sscdmdm.sys – (sscdmdm)
DRV - [2010/11/11 01:11:46 | 000,110,280 | —- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\System32\drivers\sscdserd.sys – (sscdserd)
DRV - [2010/11/11 01:11:46 | 000,104,648 | —- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\System32\drivers\sscdbus.sys – (sscdbus)
DRV - [2010/11/11 01:11:46 | 000,014,920 | —- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\System32\drivers\sscdmdfl.sys – (sscdmdfl)
DRV - [2009/07/13 19:45:33 | 000,083,456 | —- | M] (Brother Industries Ltd.) [Kernel | System | Running] – C:\Windows\System32\drivers\serial.sys – (Serial)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/?ilc=8&fr=mkg029
IE - HKLM\..\SearchScopes,DefaultScope = {36668FFD-7809-43FB-A609-999C5A7AB5FE}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKLM\..\SearchScopes\{36668FFD-7809-43FB-A609-999C5A7AB5FE}: "URL" = http://search.foxtab.com/?q={searchTerms}&…mp;cr=344294484

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,BrowserMngr Start Page =
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page =
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = en-us
IE - HKCU\..\SearchScopes,BrowserMngrDefaultScope = {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}
IE - HKCU\..\SearchScopes,DefaultScope = {36668FFD-7809-43FB-A609-999C5A7AB5FE}
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}…amp;FORM=IE8SRC
IE - HKCU\..\SearchScopes\{36668FFD-7809-43FB-A609-999C5A7AB5FE}: "URL" = http://search.foxtab.com/?q={searchTerms}&…mp;cr=344294484
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..browser.search.defaultenginename: "Search the web (Babylon)"
FF - prefs.js..browser.search.order.1: "Search the web (Babylon)"
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "http://us.mg5.mail.yahoo.com/neo/launch?.rand=ed87695mvk0e5"

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32_11_4_402_265.dll ()
FF - HKLM\Software\MozillaPlugins\@canon.com/EPPEX: C:\Program Files\Canon\Easy-PhotoPrint EX\NPEZFFPI.DLL (CANON INC.)
FF - HKLM\Software\MozillaPlugins\@google.com/npPicasa3,version=3.0.0: C:\Program Files\Google\Picasa3\npPicasa3.dll (Google, Inc.)
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.5.1: C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.5.0: C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files\Microsoft Silverlight\4.1.10329.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~1\MI4066~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\PROGRA~1\MI4066~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=14.0.8117.0416: C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKCU\Software\MozillaPlugins\@docu-track.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf: File not found
FF - HKCU\Software\MozillaPlugins\@yahoo.com/BrowserPlus,version=2.9.8: C:\Users\Patty\AppData\Local\Yahoo!\BrowserPlus\2.9.8\Plugins\npybrowserplus_2.9.8.dll (Yahoo! Inc.)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 14.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins
FF - HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions\\[removed]: C:\Users\Patty\AppData\Roaming\Mozilla\Firefox\Profiles/5erqatan.default\extensions\[removed]
FF - HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions\\{b64982b1-d112-42b5-b1e4-d3867c4533f8}: C:\ProgramData\Browser Manager\2.2.565.25\{16cdff19-861d-48e3-a751-d99a27784753}\FirefoxExtension

[2012/08/04 13:51:52 | 000,000,000 | —D | M] (No name found) – C:\Users\Patty\AppData\Roaming\mozilla\Extensions
[2012/08/24 15:35:18 | 000,000,000 | —D | M] (No name found) – C:\Users\Patty\AppData\Roaming\mozilla\Firefox\Profiles\5erqatan.default\extensions
[2012/02/10 23:22:37 | 000,000,000 | —D | M] (Garmin Communicator) – C:\Users\Patty\AppData\Roaming\mozilla\Firefox\Profiles\5erqatan.default\extensions\{195A3098-0BD5-4e90-AE22-BA1C540AFD1E}
[2012/08/14 13:00:40 | 000,000,000 | —D | M] (Yahoo! Toolbar) – C:\Users\Patty\AppData\Roaming\mozilla\Firefox\Profiles\5erqatan.default\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}
[2012/08/27 05:26:10 | 000,000,000 | —D | M] (No name found) – C:\Users\Patty\AppData\Roaming\mozilla\Firefox\Profiles\791mcddo.default-1346059307542\extensions
[2012/08/27 02:19:02 | 000,000,000 | —D | M] (No name found) – C:\Users\Patty\AppData\Roaming\mozilla\Firefox\Profiles\7z2enokc.default-1346048094184\extensions
[2012/07/13 20:16:36 | 000,002,252 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\bing.xml
[2012/07/13 20:16:36 | 000,002,040 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\twitter.xml

========== Chrome ==========

CHR - homepage: http://search.babylon.com/?affID=110795&am…000002564d80f68
CHR - homepage: http://search.babylon.com/?affID=110795&am…000002564d80f68

O1 HOSTS File: ([2012/08/23 10:17:00 | 000,000,027 | —- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (Java™ Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
O2 - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office2010\Office14\URLREDIR.DLL (Microsoft Corporation)
O2 - BHO: (Java™ Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O4 - HKLM..\Run: [AddressBookReminderApp] C:\Program Files\Creative Home\Hallmark Card Studio 2012 Deluxe\ReminderApp.exe File not found
O4 - HKLM..\Run: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
O4 - HKLM..\Run: [MSC] C:\Program Files\Microsoft Security Client\msseces.exe (Microsoft Corporation)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O8 - Extra context menu item: Add to Google Photos Screensa&ver - C:\Windows\System32\GPhotos.scr (Google Inc.)
O9 - Extra Button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office2010\Office14\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : Se&nd to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office2010\Office14\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra Button: OneNote Lin&ked Notes - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files\Microsoft Office2010\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : OneNote Lin&ked Notes - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files\Microsoft Office2010\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation)
O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} http://pcpitstop.com/betapit/PCPitStop.CAB (PCPitstop Utility)
O16 - DPF: {CAFEEFAC-0017-0000-0005-ABCDEFFEDCBA} http://java.sun.com/update/1.7.0/jinstall-…indows-i586.cab (Java Plug-in 1.7.0_05)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.7.0/jinstall-…indows-i586.cab (Java Plug-in 10.5.0)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = [removed] [removed] [removed]
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{B3E4F083-98BF-476A-B54A-CA975B5E2AAD}: DhcpNameServer = [removed] [removed] [removed]
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O28 - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\Program Files\Microsoft Office2010\Office14\GROOVEEX.DLL (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009/06/10 17:42:20 | 000,000,024 | —- | M] () - C:\autoexec.bat – [ NTFS ]
O32 - AutoRun File - [2010/11/02 07:19:42 | 000,000,000 | R–D | M] - J:\autorun – [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)

NetSvcs: FastUserSwitchingCompatibility - File not found
NetSvcs: Ias - C:\Windows\System32\ias.dll (Microsoft Corporation)
NetSvcs: Nla - File not found
NetSvcs: Ntmssvc - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: SRService - File not found
NetSvcs: WmdmPmSp - File not found
NetSvcs: LogonHours - File not found
NetSvcs: PCAudit - File not found
NetSvcs: helpsvc - File not found
NetSvcs: uploadmgr - File not found

CREATERESTOREPOINT
Restore point Set: OTL Restore Point

========== Files/Folders - Created Within 30 Days ==========

[2012/08/29 17:25:58 | 000,000,000 | —D | C] – C:\Users\Patty\Desktop\invites
[2012/08/26 23:05:05 | 000,696,520 | —- | C] (Adobe Systems Incorporated) – C:\Windows\System32\FlashPlayerApp.exe
[2012/08/26 23:05:05 | 000,073,416 | —- | C] (Adobe Systems Incorporated) – C:\Windows\System32\FlashPlayerCPLApp.cpl
[2012/08/24 19:43:47 | 000,000,000 | —D | C] – C:\Users\Patty\AppData\Local\NovaRegister
[2012/08/24 19:42:09 | 000,000,000 | —D | C] – C:\Users\Patty\AppData\Local\HCSShell
[2012/08/24 19:38:53 | 000,000,000 | —D | C] – C:\Users\Patty\AppData\Local\Creative Home
[2012/08/24 15:57:02 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2012/08/24 15:56:57 | 000,022,344 | —- | C] (Malwarebytes Corporation) – C:\Windows\System32\drivers\mbam.sys
[2012/08/24 02:06:15 | 000,000,000 | —D | C] – C:\Program Files\ESET
[2012/08/23 16:41:54 | 000,000,000 | —D | C] – C:\Windows\temp
[2012/08/23 16:40:51 | 000,000,000 | -HSD | C] – C:\$RECYCLE.BIN
[2012/08/23 10:18:48 | 000,000,000 | —D | C] – C:\Users\Patty\AppData\Local\temp
[2012/08/23 10:11:28 | 000,000,000 | —D | C] – C:\Windows\erdnt
[2012/08/21 00:41:20 | 000,053,952 | —- | C] (Macrium Software) – C:\Windows\System32\drivers\psmounter.sys
[2012/08/21 00:41:20 | 000,016,064 | —- | C] (Macrium Software) – C:\Windows\System32\drivers\pssnap.sys
[2012/08/21 00:41:20 | 000,012,992 | —- | C] (Paramount Software UK Ltd) – C:\Windows\System32\drivers\PSVolAcc.sys
[2012/08/20 12:26:26 | 000,000,000 | —D | C] – C:\Users\Patty\Desktop\Bunch of pictures
[2012/08/15 16:47:54 | 000,176,640 | —- | C] (Microsoft Corporation) – C:\Windows\System32\ieui.dll
[2012/08/15 16:47:52 | 000,132,096 | —- | C] (Microsoft Corporation) – C:\Windows\System32\url.dll
[2012/08/15 16:47:51 | 001,638,912 | —- | C] (Microsoft Corporation) – C:\Windows\System32\mshtml.tlb
[2012/08/15 16:47:50 | 000,627,712 | —- | C] (Microsoft Corporation) – C:\Windows\System32\msfeeds.dll
[2012/08/15 16:47:49 | 000,048,128 | —- | C] (Microsoft Corporation) – C:\Windows\System32\jsproxy.dll
[2012/08/15 16:47:43 | 002,345,984 | —- | C] (Microsoft Corporation) – C:\Windows\System32\win32k.sys
[2012/08/15 16:47:39 | 000,400,896 | —- | C] (Microsoft Corporation) – C:\Windows\System32\srcore.dll
[2012/08/15 06:53:15 | 000,041,984 | —- | C] (Microsoft Corporation) – C:\Windows\System32\browcli.dll
[2012/08/14 12:33:24 | 000,000,000 | —D | C] – C:\Users\Patty\AppData\Local\antiphishing-vmninternethelper1_1dn
[2012/08/13 17:21:15 | 000,000,000 | —D | C] – C:\ProgramData\Yahoo! Companion
[2012/08/12 16:01:56 | 000,000,000 | —D | C] – C:\Users\Patty\AppData\Local\APN
[2012/08/11 19:58:35 | 000,000,000 | —D | C] – C:\Users\Patty\AppData\Local\Apple Computer
[2012/08/11 19:56:47 | 000,000,000 | —D | C] – C:\Program Files\Bonjour
[2012/08/07 00:34:10 | 000,000,000 | —D | C] – C:\Program Files\Awesome Duplicate Photo Finder
[2012/08/07 00:25:10 | 000,000,000 | —D | C] – C:\Users\Patty\AppData\Roaming\EasyDuplicateFinder
[2012/08/05 15:59:02 | 000,000,000 | —D | C] – C:\Users\Patty\AppData\Local\MyScrapNook_12
[2012/08/01 00:30:42 | 000,000,000 | —D | C] – C:\ProgramData\boost_interprocess
[2011/11/28 16:40:47 | 000,584,192 | —- | C] (OldTimer Tools) – C:\Program Files\OTL.exe

========== Files - Modified Within 30 Days ==========

[2012/08/30 15:48:00 | 000,000,830 | —- | M] () – C:\Windows\tasks\Adobe Flash Player Updater.job
[2012/08/30 15:14:03 | 000,067,584 | –S- | M] () – C:\Windows\bootstat.dat
[2012/08/30 10:50:25 | 011,255,615 | —- | M] () – C:\Users\Patty\Desktop\invite 2.hmk
[2012/08/30 10:44:47 | 000,000,418 | —- | M] () – C:\Windows\tasks\ParetoLogic Update Version3.job
[2012/08/29 18:00:00 | 000,000,444 | —- | M] () – C:\Windows\tasks\ParetoLogic Registration3.job
[2012/08/29 11:51:07 | 000,015,152 | -H– | M] () – C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2012/08/29 11:51:07 | 000,015,152 | -H– | M] () – C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2012/08/29 11:48:37 | 000,626,040 | —- | M] () – C:\Windows\System32\perfh009.dat
[2012/08/29 11:48:37 | 000,107,316 | —- | M] () – C:\Windows\System32\perfc009.dat
[2012/08/29 11:43:48 | 2388,381,696 | -HS- | M] () – C:\hiberfil.sys
[2012/08/28 16:17:25 | 000,297,831 | —- | M] () – C:\Users\Patty\Desktop\external drive.PNG
[2012/08/28 16:14:09 | 000,318,068 | —- | M] () – C:\Users\Patty\Desktop\reflecrt.PNG
[2012/08/26 23:05:05 | 000,696,520 | —- | M] (Adobe Systems Incorporated) – C:\Windows\System32\FlashPlayerApp.exe
[2012/08/26 23:05:05 | 000,073,416 | —- | M] (Adobe Systems Incorporated) – C:\Windows\System32\FlashPlayerCPLApp.cpl
[2012/08/26 18:53:12 | 000,491,648 | —- | M] () – C:\Windows\System32\FNTCACHE.DAT
[2012/08/24 19:35:07 | 000,002,295 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Event Planner Reminder.lnk
[2012/08/24 11:45:07 | 000,098,269 | —- | M] () – C:\Users\Patty\Desktop\adult_online_forms_07_09_rev_06_1136.pdf
[2012/08/24 01:14:42 | 000,002,057 | —- | M] () – C:\Windows\epplauncher.mif
[2012/08/23 10:17:00 | 000,000,027 | —- | M] () – C:\Windows\System32\drivers\etc\hosts
[2012/08/21 11:50:44 | 000,000,448 | —- | M] () – C:\Users\Patty\Documents\cc_20120821_115040.reg
[2012/08/20 23:33:47 | 000,012,992 | —- | M] (Paramount Software UK Ltd) – C:\Windows\System32\drivers\PSVolAcc.sys
[2012/08/20 23:33:27 | 000,016,064 | —- | M] (Macrium Software) – C:\Windows\System32\drivers\pssnap.sys
[2012/08/20 23:33:19 | 000,053,952 | —- | M] (Macrium Software) – C:\Windows\System32\drivers\psmounter.sys
[2012/08/13 20:12:51 | 001,528,314 | —- | M] () – C:\Users\Patty\Documents\P1020734.JPG

========== Files Created - No Company Name ==========

[2012/08/29 11:57:34 | 011,255,615 | —- | C] () – C:\Users\Patty\Desktop\invite 2.hmk
[2012/08/28 16:17:25 | 000,297,831 | —- | C] () – C:\Users\Patty\Desktop\external drive.PNG
[2012/08/28 16:14:09 | 000,318,068 | —- | C] () – C:\Users\Patty\Desktop\reflecrt.PNG
[2012/08/26 23:05:06 | 000,000,830 | —- | C] () – C:\Windows\tasks\Adobe Flash Player Updater.job
[2012/08/24 19:35:07 | 000,002,295 | —- | C] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Event Planner Reminder.lnk
[2012/08/24 11:45:05 | 000,098,269 | —- | C] () – C:\Users\Patty\Desktop\adult_online_forms_07_09_rev_06_1136.pdf
[2012/08/21 11:50:42 | 000,000,448 | —- | C] () – C:\Users\Patty\Documents\cc_20120821_115040.reg
[2012/08/13 20:12:49 | 001,528,314 | —- | C] () – C:\Users\Patty\Documents\P1020734.JPG
[2012/07/20 14:27:03 | 000,027,520 | —- | C] () – C:\Users\Patty\AppData\Local\dt.dat
[2012/03/17 00:25:18 | 000,000,017 | —- | C] () – C:\Users\Patty\AppData\Local\resmon.resmoncfg
[2012/02/10 23:29:32 | 000,021,316 | —- | C] () – C:\Windows\System32\emptyregdb.dat
[2011/09/26 11:00:27 | 000,000,117 | —- | C] () – C:\Windows\restore.INI
[2011/04/17 19:19:47 | 000,000,064 | —- | C] () – C:\Windows\GPlrLanc.dat

========== Custom Scans ==========

< >

< %SYSTEMDRIVE%\*.exe >

< MD5 for: EXPLORER.EXE >
[2011/02/26 01:19:21 | 002,616,320 | —- | M] (Microsoft Corporation) MD5=0FB9C74046656D1579A64660AD67B746 – C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.21669_none_54149f9ef14031fc\explorer.exe
[2009/07/13 21:14:20 | 002,613,248 | —- | M] (Microsoft Corporation) MD5=15BC38A7492BEFE831966ADB477CF76F – C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16385_none_518afd35db100430\explorer.exe
[2011/02/26 01:51:13 | 002,614,784 | —- | M] (Microsoft Corporation) MD5=255CF508D7CFB10E0794D6AC93280BD8 – C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20910_none_525b5180f3f95373\explorer.exe
[2009/10/31 01:45:39 | 002,614,272 | —- | M] (Microsoft Corporation) MD5=2626FC9755BE22F805D3CFA0CE3EE727 – C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16450_none_51a66d6ddafc2ed1\explorer.exe
[2011/02/26 01:33:07 | 002,614,784 | —- | M] (Microsoft Corporation) MD5=2AF58D15EDC06EC6FDACCE1F19482BBF – C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16768_none_51a3a583dafd0cef\explorer.exe
[2010/11/20 08:17:09 | 002,616,320 | —- | M] (Microsoft Corporation) MD5=40D777B7A95E00593EB1568C68514493 – C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17514_none_53bc10fdd7fe87ca\explorer.exe
[2011/02/25 01:30:54 | 002,616,320 | —- | M] (Microsoft Corporation) MD5=8B88EBBB05A0E56B7DCC708498C02B3E – C:\Windows\erdnt\cache\explorer.exe
[2011/02/25 01:30:54 | 002,616,320 | —- | M] (Microsoft Corporation) MD5=8B88EBBB05A0E56B7DCC708498C02B3E – C:\Windows\explorer.exe
[2011/02/25 01:30:54 | 002,616,320 | —- | M] (Microsoft Corporation) MD5=8B88EBBB05A0E56B7DCC708498C02B3E – C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17567_none_5389023fd8245f84\explorer.exe
[2009/08/03 01:49:47 | 002,613,248 | —- | M] (Microsoft Corporation) MD5=9FF6C4C91A3711C0A3B18F87B08B518D – C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20500_none_526619d4f3f142e6\explorer.exe
[2009/08/03 01:35:50 | 002,613,248 | —- | M] (Microsoft Corporation) MD5=B95EEB0F4E5EFBF1038A35B3351CF047 – C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16404_none_51e07e31dad00878\explorer.exe
[2009/10/31 02:00:51 | 002,614,272 | —- | M] (Microsoft Corporation) MD5=C76153C7ECA00FA852BB0C193378F917 – C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20563_none_52283b2af41f3691\explorer.exe

< MD5 for: SVCHOST.EXE >
[2009/07/13 21:14:41 | 000,020,992 | —- | M] (Microsoft Corporation) MD5=54A47F6B5E09A77E61649109C6A08866 – C:\Windows\erdnt\cache\svchost.exe
[2009/07/13 21:14:41 | 000,020,992 | —- | M] (Microsoft Corporation) MD5=54A47F6B5E09A77E61649109C6A08866 – C:\Windows\System32\svchost.exe
[2009/07/13 21:14:41 | 000,020,992 | —- | M] (Microsoft Corporation) MD5=54A47F6B5E09A77E61649109C6A08866 – C:\Windows\winsxs\x86_microsoft-windows-services-svchost_31bf3856ad364e35_6.1.7600.16385_none_b591afc466a15356\svchost.exe
[2012/07/03 13:46:42 | 000,217,672 | —- | M] () MD5=8A7F34F0BBD076EC3815680A7309114F – C:\Program Files\Malwarebytes' Anti-Malware\Chameleon\svchost.exe

< MD5 for: USERINIT.EXE >
[2010/11/20 08:17:48 | 000,026,624 | —- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 – C:\Windows\erdnt\cache\userinit.exe
[2010/11/20 08:17:48 | 000,026,624 | —- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 – C:\Windows\System32\userinit.exe
[2010/11/20 08:17:48 | 000,026,624 | —- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 – C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7601.17514_none_de3024012ff21116\userinit.exe
[2009/07/13 21:14:43 | 000,026,112 | —- | M] (Microsoft Corporation) MD5=6DE80F60D7DE9CE6B8C2DDFDF79EF175 – C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7600.16385_none_dbff103933038d7c\userinit.exe

< MD5 for: WINLOGON.EXE >
[2009/10/28 02:17:59 | 000,285,696 | —- | M] (Microsoft Corporation) MD5=37CDB7E72EB66BA85A87CBE37E7F03FD – C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16447_none_6fc699643622d177\winlogon.exe
[2009/10/28 01:52:08 | 000,285,696 | —- | M] (Microsoft Corporation) MD5=3BABE6767C78FBF5FB8435FEED187F30 – C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.20560_none_703394514f56f7c2\winlogon.exe
[2010/11/20 08:17:54 | 000,286,720 | —- | M] (Microsoft Corporation) MD5=6D13E1406F50C66E2A95D97F22C47560 – C:\Windows\erdnt\cache\winlogon.exe
[2010/11/20 08:17:54 | 000,286,720 | —- | M] (Microsoft Corporation) MD5=6D13E1406F50C66E2A95D97F22C47560 – C:\Windows\System32\winlogon.exe
[2010/11/20 08:17:54 | 000,286,720 | —- | M] (Microsoft Corporation) MD5=6D13E1406F50C66E2A95D97F22C47560 – C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7601.17514_none_71ca6b0233339500\winlogon.exe
[2012/07/03 13:46:42 | 000,217,672 | —- | M] () MD5=8A7F34F0BBD076EC3815680A7309114F – C:\Program Files\Malwarebytes' Anti-Malware\Chameleon\winlogon.exe
[2009/07/13 21:14:45 | 000,285,696 | —- | M] (Microsoft Corporation) MD5=8EC6A4AB12B8F3759E21F8E3A388F2CF – C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16385_none_6f99573a36451166\winlogon.exe

< %systemroot%\*. /rp /s >

========== Drive Information ==========

Physical Drives
—————

Drive: \\\\.\\PHYSICALDRIVE0 - Fixed hard disk media
Interface type: IDE
Media Type: Fixed hard disk media
Model: WDC WD3200AAKS-75L9A0 ATA Device
Partitions: 2
Status: OK
Status Info: 0

Drive: \\\\.\\PHYSICALDRIVE1 -
Interface type: USB
Media Type:
Model: TEAC USB HS-CF Card USB Device
Partitions: 0
Status: OK
Status Info: 0

Drive: \\\\.\\PHYSICALDRIVE2 -
Interface type: USB
Media Type:
Model: TEAC USB HS-xD/SM USB Device
Partitions: 0
Status: OK
Status Info: 0

Drive: \\\\.\\PHYSICALDRIVE3 -
Interface type: USB
Media Type:
Model: TEAC USB HS-MS Card USB Device
Partitions: 0
Status: OK
Status Info: 0

Drive: \\\\.\\PHYSICALDRIVE4 -
Interface type: USB
Media Type:
Model: TEAC USB HS-SD Card USB Device
Partitions: 0
Status: OK
Status Info: 0

Drive: \\\\.\\PHYSICALDRIVE5 -
Interface type: USB
Media Type:
Model: Canon MP500Storage USB Device
Partitions: 0
Status: OK
Status Info: 0

Drive: \\\\.\\PHYSICALDRIVE6 - External hard disk media
Interface type: USB
Media Type: External hard disk media
Model: WD Ext HDD 1021 USB Device
Partitions: 1
Status: OK
Status Info: 0

Partitions
—————

DeviceID: Disk #0, Partition #0
PartitionType: Installable File System
Bootable: True
BootPartition: True
PrimaryPartition: True
Size: 0.00GB
Starting Offset: 1048576
Hidden sectors: 0

DeviceID: Disk #0, Partition #1
PartitionType: Installable File System
Bootable: False
BootPartition: False
PrimaryPartition: True
Size: 298.00GB
Starting Offset: 105906176
Hidden sectors: 0

DeviceID: Disk #6, Partition #0
PartitionType: Installable File System
Bootable: False
BootPartition: False
PrimaryPartition: True
Size: 932.00GB
Starting Offset: 1048576
Hidden sectors: 0

< End of report >

PattiChati

Post #3August 30, 2012, 8:18 PM UTC

The ansmbrlog
OTL logfile created on: 8/30/2012 3:57:11 PM - Run 1
OTL by OldTimer - Version 3.2.59.1 Folder = C:\Users\Patty\Downloads
Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7601.17514)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

2.97 Gb Total Physical Memory | 1.97 Gb Available Physical Memory | 66.59% Memory free
5.93 Gb Paging File | 4.53 Gb Available in Paging File | 76.37% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 297.99 Gb Total Space | 238.64 Gb Free Space | 80.08% Space Free | Partition Type: NTFS
Drive J: | 931.51 Gb Total Space | 588.39 Gb Free Space | 63.17% Space Free | Partition Type: NTFS

Computer Name: PATTI-PC | User Name: Patty | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2012/08/30 15:56:22 | 000,598,528 | —- | M] (OldTimer Tools) – C:\Users\Patty\Downloads\OTL(4).exe
PRC - [2012/08/26 23:05:05 | 001,807,560 | —- | M] (Adobe Systems, Inc.) – C:\Windows\System32\Macromed\Flash\FlashPlayerPlugin_11_4_402_265.exe
PRC - [2012/08/20 23:32:24 | 000,224,960 | —- | M] () – C:\Program Files\Macrium\Reflect\ReflectService.exe
PRC - [2012/07/27 16:51:26 | 000,063,960 | —- | M] (Adobe Systems Incorporated) – C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe
PRC - [2012/07/13 20:17:11 | 000,913,888 | —- | M] (Mozilla Corporation) – C:\Program Files\Mozilla Firefox\firefox.exe
PRC - [2012/07/03 13:46:44 | 000,655,944 | —- | M] (Malwarebytes Corporation) – C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
PRC - [2012/07/03 13:46:44 | 000,462,920 | —- | M] (Malwarebytes Corporation) – C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe
PRC - [2012/03/26 17:08:12 | 000,931,200 | —- | M] (Microsoft Corporation) – C:\Program Files\Microsoft Security Client\msseces.exe
PRC - [2012/03/26 17:03:40 | 000,011,552 | —- | M] (Microsoft Corporation) – C:\Program Files\Microsoft Security Client\MsMpEng.exe
PRC - [2011/10/12 08:55:06 | 000,366,496 | —- | M] (Creative Home) – C:\Program Files\Creative Home\Hallmark Card Studio 2012 Deluxe\Planner\PLNRnote.exe
PRC - [2011/08/08 03:55:42 | 003,147,856 | —- | M] (VS Revo Group) – C:\Program Files\VS Revo Group\Revo Uninstaller\Revouninstaller.exe
PRC - [2011/02/25 01:30:54 | 002,616,320 | —- | M] (Microsoft Corporation) – C:\Windows\explorer.exe
PRC - [2010/11/20 08:17:47 | 000,049,152 | —- | M] (Microsoft Corporation) – C:\Windows\System32\taskhost.exe

========== Modules (No Company Name) ==========

MOD - [2012/08/26 23:05:04 | 009,813,704 | —- | M] () – C:\Windows\System32\Macromed\Flash\NPSWF32_11_4_402_265.dll
MOD - [2012/07/13 20:17:14 | 002,003,424 | —- | M] () – C:\Program Files\Mozilla Firefox\mozjs.dll
MOD - [2012/06/14 03:24:50 | 014,340,608 | —- | M] () – C:\Windows\assembly\NativeImages_v2.0.50727_32\PresentationFramewo#\e717a230496832656b05b515eb9f3bc5\PresentationFramework.ni.dll
MOD - [2012/06/14 03:24:28 | 012,237,824 | —- | M] () – C:\Windows\assembly\NativeImages_v2.0.50727_32\PresentationCore\14a87218ea49639f38097e278b98a3da\PresentationCore.ni.dll
MOD - [2012/05/10 03:29:49 | 002,297,856 | —- | M] () – C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Core\dfd33f59a5803a3c73cf408362e6e0b7\System.Core.ni.dll
MOD - [2012/05/10 03:25:10 | 003,347,968 | —- | M] () – C:\Windows\assembly\NativeImages_v2.0.50727_32\WindowsBase\46fce56db7685a586d3eeb7c373e3c1c\WindowsBase.ni.dll
MOD - [2012/05/10 03:25:02 | 007,967,232 | —- | M] () – C:\Windows\assembly\NativeImages_v2.0.50727_32\System\ce9ff6baf9053ed2ed673d948179195c\System.ni.dll
MOD - [2012/05/10 03:24:54 | 011,492,864 | —- | M] () – C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\acfc1391e45fedd2a359778ea57d914c\mscorlib.ni.dll
MOD - [2011/10/11 08:40:16 | 000,045,568 | —- | M] () – C:\Program Files\Creative Home\Hallmark Card Studio 2012 Deluxe\Planner\InteropHelper.dll
MOD - [2011/03/17 00:11:16 | 004,297,568 | —- | M] () – C:\Program Files\Common Files\microsoft shared\OFFICE14\Cultures\OFFICE.ODF
MOD - [2010/10/20 15:45:26 | 008,801,120 | —- | M] () – C:\Program Files\Microsoft Office2010\Office14\1033\GrooveIntlResource.dll

========== Services (SafeList) ==========

SRV - [2012/08/26 23:05:05 | 000,250,568 | —- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] – C:\Windows\System32\Macromed\Flash\FlashPlayerUpdateService.exe – (AdobeFlashPlayerUpdateSvc)
SRV - [2012/08/20 23:32:24 | 000,224,960 | —- | M] () [Auto | Running] – C:\Program Files\Macrium\Reflect\ReflectService.exe – (ReflectService.exe)
SRV - [2012/07/27 16:51:26 | 000,063,960 | —- | M] (Adobe Systems Incorporated) [Auto | Running] – C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe – (AdobeARMservice)
SRV - [2012/07/13 20:17:12 | 000,113,120 | —- | M] (Mozilla Foundation) [On_Demand | Stopped] – C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe – (MozillaMaintenance)
SRV - [2012/07/03 13:46:44 | 000,655,944 | —- | M] (Malwarebytes Corporation) [Auto | Running] – C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe – (MBAMService)
SRV - [2012/03/26 17:03:40 | 000,214,952 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] – C:\Program Files\Microsoft Security Client\NisSrv.exe – (NisSrv)
SRV - [2012/03/26 17:03:40 | 000,011,552 | —- | M] (Microsoft Corporation) [Auto | Running] – C:\Program Files\Microsoft Security Client\MsMpEng.exe – (MsMpSvc)
SRV - [2012/02/11 00:45:21 | 001,343,400 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] – C:\Windows\System32\Wat\WatAdminSvc.exe – (WatAdminSvc)
SRV - [2011/06/12 11:15:00 | 031,125,880 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] – C:\Program Files\Microsoft Office2010\Office14\GROOVE.EXE – (Microsoft SharePoint Workspace Audit Service)
SRV - [2011/01/02 21:29:50 | 000,009,216 | —- | M] (www.shadowexplorer.com) [Disabled | Stopped] – C:\Program Files\ShadowExplorer\sesvc.exe – (sesvc)
SRV - [2009/07/13 21:16:13 | 000,025,088 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] – C:\Windows\System32\sensrsvc.dll – (SensrSvc)
SRV - [2009/07/13 21:15:41 | 000,680,960 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] – C:\Program Files\Windows Defender\MpSvc.dll – (WinDefend)

========== Driver Services (SafeList) ==========

DRV - [2012/08/20 23:33:47 | 000,012,992 | —- | M] (Paramount Software UK Ltd) [File_System | On_Demand | Stopped] – C:\Windows\System32\drivers\PSVolAcc.sys – (PSVolAcc)
DRV - [2012/08/20 23:33:27 | 000,016,064 | —- | M] (Macrium Software) [Kernel | Boot | Running] – C:\Windows\System32\drivers\pssnap.sys – (pssnap)
DRV - [2012/08/20 23:33:19 | 000,053,952 | —- | M] (Macrium Software) [Kernel | On_Demand | Stopped] – C:\Windows\System32\drivers\psmounter.sys – (PSMounter)
DRV - [2012/07/03 13:46:44 | 000,022,344 | —- | M] (Malwarebytes Corporation) [File_System | On_Demand | Running] – C:\Windows\System32\drivers\mbam.sys – (MBAMProtector)
DRV - [2012/03/20 20:44:12 | 000,074,112 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\System32\drivers\NisDrvWFP.sys – (NisDrv)
DRV - [2010/11/20 06:24:41 | 000,052,224 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\System32\drivers\TsUsbFlt.sys – (TsUsbFlt)
DRV - [2010/11/20 05:59:44 | 000,035,968 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\System32\drivers\winusb.sys – (WinUsb)
DRV - [2010/11/11 01:11:46 | 000,132,424 | —- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\System32\drivers\sscdmdm.sys – (sscdmdm)
DRV - [2010/11/11 01:11:46 | 000,110,280 | —- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\System32\drivers\sscdserd.sys – (sscdserd)
DRV - [2010/11/11 01:11:46 | 000,104,648 | —- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\System32\drivers\sscdbus.sys – (sscdbus)
DRV - [2010/11/11 01:11:46 | 000,014,920 | —- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\System32\drivers\sscdmdfl.sys – (sscdmdfl)
DRV - [2009/07/13 19:45:33 | 000,083,456 | —- | M] (Brother Industries Ltd.) [Kernel | System | Running] – C:\Windows\System32\drivers\serial.sys – (Serial)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/?ilc=8&fr=mkg029
IE - HKLM\..\SearchScopes,DefaultScope = {36668FFD-7809-43FB-A609-999C5A7AB5FE}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKLM\..\SearchScopes\{36668FFD-7809-43FB-A609-999C5A7AB5FE}: "URL" = http://search.foxtab.com/?q={searchTerms}&…mp;cr=344294484

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,BrowserMngr Start Page =
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page =
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = en-us
IE - HKCU\..\SearchScopes,BrowserMngrDefaultScope = {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}
IE - HKCU\..\SearchScopes,DefaultScope = {36668FFD-7809-43FB-A609-999C5A7AB5FE}
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}…amp;FORM=IE8SRC
IE - HKCU\..\SearchScopes\{36668FFD-7809-43FB-A609-999C5A7AB5FE}: "URL" = http://search.foxtab.com/?q={searchTerms}&…mp;cr=344294484
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..browser.search.defaultenginename: "Search the web (Babylon)"
FF - prefs.js..browser.search.order.1: "Search the web (Babylon)"
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "http://us.mg5.mail.yahoo.com/neo/launch?.rand=ed87695mvk0e5"

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32_11_4_402_265.dll ()
FF - HKLM\Software\MozillaPlugins\@canon.com/EPPEX: C:\Program Files\Canon\Easy-PhotoPrint EX\NPEZFFPI.DLL (CANON INC.)
FF - HKLM\Software\MozillaPlugins\@google.com/npPicasa3,version=3.0.0: C:\Program Files\Google\Picasa3\npPicasa3.dll (Google, Inc.)
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.5.1: C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.5.0: C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files\Microsoft Silverlight\4.1.10329.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~1\MI4066~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\PROGRA~1\MI4066~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=14.0.8117.0416: C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKCU\Software\MozillaPlugins\@docu-track.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf: File not found
FF - HKCU\Software\MozillaPlugins\@yahoo.com/BrowserPlus,version=2.9.8: C:\Users\Patty\AppData\Local\Yahoo!\BrowserPlus\2.9.8\Plugins\npybrowserplus_2.9.8.dll (Yahoo! Inc.)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 14.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins
FF - HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions\\[removed]: C:\Users\Patty\AppData\Roaming\Mozilla\Firefox\Profiles/5erqatan.default\extensions\[removed]
FF - HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions\\{b64982b1-d112-42b5-b1e4-d3867c4533f8}: C:\ProgramData\Browser Manager\2.2.565.25\{16cdff19-861d-48e3-a751-d99a27784753}\FirefoxExtension

[2012/08/04 13:51:52 | 000,000,000 | —D | M] (No name found) – C:\Users\Patty\AppData\Roaming\mozilla\Extensions
[2012/08/24 15:35:18 | 000,000,000 | —D | M] (No name found) – C:\Users\Patty\AppData\Roaming\mozilla\Firefox\Profiles\5erqatan.default\extensions
[2012/02/10 23:22:37 | 000,000,000 | —D | M] (Garmin Communicator) – C:\Users\Patty\AppData\Roaming\mozilla\Firefox\Profiles\5erqatan.default\extensions\{195A3098-0BD5-4e90-AE22-BA1C540AFD1E}
[2012/08/14 13:00:40 | 000,000,000 | —D | M] (Yahoo! Toolbar) – C:\Users\Patty\AppData\Roaming\mozilla\Firefox\Profiles\5erqatan.default\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}
[2012/08/27 05:26:10 | 000,000,000 | —D | M] (No name found) – C:\Users\Patty\AppData\Roaming\mozilla\Firefox\Profiles\791mcddo.default-1346059307542\extensions
[2012/08/27 02:19:02 | 000,000,000 | —D | M] (No name found) – C:\Users\Patty\AppData\Roaming\mozilla\Firefox\Profiles\7z2enokc.default-1346048094184\extensions
[2012/07/13 20:16:36 | 000,002,252 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\bing.xml
[2012/07/13 20:16:36 | 000,002,040 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\twitter.xml

========== Chrome ==========

CHR - homepage: http://search.babylon.com/?affID=110795&am…000002564d80f68
CHR - homepage: http://search.babylon.com/?affID=110795&am…000002564d80f68

O1 HOSTS File: ([2012/08/23 10:17:00 | 000,000,027 | —- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (Java™ Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
O2 - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office2010\Office14\URLREDIR.DLL (Microsoft Corporation)
O2 - BHO: (Java™ Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O4 - HKLM..\Run: [AddressBookReminderApp] C:\Program Files\Creative Home\Hallmark Card Studio 2012 Deluxe\ReminderApp.exe File not found
O4 - HKLM..\Run: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
O4 - HKLM..\Run: [MSC] C:\Program Files\Microsoft Security Client\msseces.exe (Microsoft Corporation)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O8 - Extra context menu item: Add to Google Photos Screensa&ver - C:\Windows\System32\GPhotos.scr (Google Inc.)
O9 - Extra Button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office2010\Office14\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : Se&nd to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office2010\Office14\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra Button: OneNote Lin&ked Notes - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files\Microsoft Office2010\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : OneNote Lin&ked Notes - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files\Microsoft Office2010\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation)
O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} http://pcpitstop.com/betapit/PCPitStop.CAB (PCPitstop Utility)
O16 - DPF: {CAFEEFAC-0017-0000-0005-ABCDEFFEDCBA} http://java.sun.com/update/1.7.0/jinstall-…indows-i586.cab (Java Plug-in 1.7.0_05)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.7.0/jinstall-…indows-i586.cab (Java Plug-in 10.5.0)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = [removed] [removed] [removed]
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{B3E4F083-98BF-476A-B54A-CA975B5E2AAD}: DhcpNameServer = [removed] [removed] [removed]
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O28 - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\Program Files\Microsoft Office2010\Office14\GROOVEEX.DLL (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009/06/10 17:42:20 | 000,000,024 | —- | M] () - C:\autoexec.bat – [ NTFS ]
O32 - AutoRun File - [2010/11/02 07:19:42 | 000,000,000 | R–D | M] - J:\autorun – [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)

NetSvcs: FastUserSwitchingCompatibility - File not found
NetSvcs: Ias - C:\Windows\System32\ias.dll (Microsoft Corporation)
NetSvcs: Nla - File not found
NetSvcs: Ntmssvc - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: SRService - File not found
NetSvcs: WmdmPmSp - File not found
NetSvcs: LogonHours - File not found
NetSvcs: PCAudit - File not found
NetSvcs: helpsvc - File not found
NetSvcs: uploadmgr - File not found

CREATERESTOREPOINT
Restore point Set: OTL Restore Point

========== Files/Folders - Created Within 30 Days ==========

[2012/08/29 17:25:58 | 000,000,000 | —D | C] – C:\Users\Patty\Desktop\invites
[2012/08/26 23:05:05 | 000,696,520 | —- | C] (Adobe Systems Incorporated) – C:\Windows\System32\FlashPlayerApp.exe
[2012/08/26 23:05:05 | 000,073,416 | —- | C] (Adobe Systems Incorporated) – C:\Windows\System32\FlashPlayerCPLApp.cpl
[2012/08/24 19:43:47 | 000,000,000 | —D | C] – C:\Users\Patty\AppData\Local\NovaRegister
[2012/08/24 19:42:09 | 000,000,000 | —D | C] – C:\Users\Patty\AppData\Local\HCSShell
[2012/08/24 19:38:53 | 000,000,000 | —D | C] – C:\Users\Patty\AppData\Local\Creative Home
[2012/08/24 15:57:02 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2012/08/24 15:56:57 | 000,022,344 | —- | C] (Malwarebytes Corporation) – C:\Windows\System32\drivers\mbam.sys
[2012/08/24 02:06:15 | 000,000,000 | —D | C] – C:\Program Files\ESET
[2012/08/23 16:41:54 | 000,000,000 | —D | C] – C:\Windows\temp
[2012/08/23 16:40:51 | 000,000,000 | -HSD | C] – C:\$RECYCLE.BIN
[2012/08/23 10:18:48 | 000,000,000 | —D | C] – C:\Users\Patty\AppData\Local\temp
[2012/08/23 10:11:28 | 000,000,000 | —D | C] – C:\Windows\erdnt
[2012/08/21 00:41:20 | 000,053,952 | —- | C] (Macrium Software) – C:\Windows\System32\drivers\psmounter.sys
[2012/08/21 00:41:20 | 000,016,064 | —- | C] (Macrium Software) – C:\Windows\System32\drivers\pssnap.sys
[2012/08/21 00:41:20 | 000,012,992 | —- | C] (Paramount Software UK Ltd) – C:\Windows\System32\drivers\PSVolAcc.sys
[2012/08/20 12:26:26 | 000,000,000 | —D | C] – C:\Users\Patty\Desktop\Bunch of pictures
[2012/08/15 16:47:54 | 000,176,640 | —- | C] (Microsoft Corporation) – C:\Windows\System32\ieui.dll
[2012/08/15 16:47:52 | 000,132,096 | —- | C] (Microsoft Corporation) – C:\Windows\System32\url.dll
[2012/08/15 16:47:51 | 001,638,912 | —- | C] (Microsoft Corporation) – C:\Windows\System32\mshtml.tlb
[2012/08/15 16:47:50 | 000,627,712 | —- | C] (Microsoft Corporation) – C:\Windows\System32\msfeeds.dll
[2012/08/15 16:47:49 | 000,048,128 | —- | C] (Microsoft Corporation) – C:\Windows\System32\jsproxy.dll
[2012/08/15 16:47:43 | 002,345,984 | —- | C] (Microsoft Corporation) – C:\Windows\System32\win32k.sys
[2012/08/15 16:47:39 | 000,400,896 | —- | C] (Microsoft Corporation) – C:\Windows\System32\srcore.dll
[2012/08/15 06:53:15 | 000,041,984 | —- | C] (Microsoft Corporation) – C:\Windows\System32\browcli.dll
[2012/08/14 12:33:24 | 000,000,000 | —D | C] – C:\Users\Patty\AppData\Local\antiphishing-vmninternethelper1_1dn
[2012/08/13 17:21:15 | 000,000,000 | —D | C] – C:\ProgramData\Yahoo! Companion
[2012/08/12 16:01:56 | 000,000,000 | —D | C] – C:\Users\Patty\AppData\Local\APN
[2012/08/11 19:58:35 | 000,000,000 | —D | C] – C:\Users\Patty\AppData\Local\Apple Computer
[2012/08/11 19:56:47 | 000,000,000 | —D | C] – C:\Program Files\Bonjour
[2012/08/07 00:34:10 | 000,000,000 | —D | C] – C:\Program Files\Awesome Duplicate Photo Finder
[2012/08/07 00:25:10 | 000,000,000 | —D | C] – C:\Users\Patty\AppData\Roaming\EasyDuplicateFinder
[2012/08/05 15:59:02 | 000,000,000 | —D | C] – C:\Users\Patty\AppData\Local\MyScrapNook_12
[2012/08/01 00:30:42 | 000,000,000 | —D | C] – C:\ProgramData\boost_interprocess
[2011/11/28 16:40:47 | 000,584,192 | —- | C] (OldTimer Tools) – C:\Program Files\OTL.exe

========== Files - Modified Within 30 Days ==========

[2012/08/30 15:48:00 | 000,000,830 | —- | M] () – C:\Windows\tasks\Adobe Flash Player Updater.job
[2012/08/30 15:14:03 | 000,067,584 | –S- | M] () – C:\Windows\bootstat.dat
[2012/08/30 10:50:25 | 011,255,615 | —- | M] () – C:\Users\Patty\Desktop\invite 2.hmk
[2012/08/30 10:44:47 | 000,000,418 | —- | M] () – C:\Windows\tasks\ParetoLogic Update Version3.job
[2012/08/29 18:00:00 | 000,000,444 | —- | M] () – C:\Windows\tasks\ParetoLogic Registration3.job
[2012/08/29 11:51:07 | 000,015,152 | -H– | M] () – C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2012/08/29 11:51:07 | 000,015,152 | -H– | M] () – C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2012/08/29 11:48:37 | 000,626,040 | —- | M] () – C:\Windows\System32\perfh009.dat
[2012/08/29 11:48:37 | 000,107,316 | —- | M] () – C:\Windows\System32\perfc009.dat
[2012/08/29 11:43:48 | 2388,381,696 | -HS- | M] () – C:\hiberfil.sys
[2012/08/28 16:17:25 | 000,297,831 | —- | M] () – C:\Users\Patty\Desktop\external drive.PNG
[2012/08/28 16:14:09 | 000,318,068 | —- | M] () – C:\Users\Patty\Desktop\reflecrt.PNG
[2012/08/26 23:05:05 | 000,696,520 | —- | M] (Adobe Systems Incorporated) – C:\Windows\System32\FlashPlayerApp.exe
[2012/08/26 23:05:05 | 000,073,416 | —- | M] (Adobe Systems Incorporated) – C:\Windows\System32\FlashPlayerCPLApp.cpl
[2012/08/26 18:53:12 | 000,491,648 | —- | M] () – C:\Windows\System32\FNTCACHE.DAT
[2012/08/24 19:35:07 | 000,002,295 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Event Planner Reminder.lnk
[2012/08/24 11:45:07 | 000,098,269 | —- | M] () – C:\Users\Patty\Desktop\adult_online_forms_07_09_rev_06_1136.pdf
[2012/08/24 01:14:42 | 000,002,057 | —- | M] () – C:\Windows\epplauncher.mif
[2012/08/23 10:17:00 | 000,000,027 | —- | M] () – C:\Windows\System32\drivers\etc\hosts
[2012/08/21 11:50:44 | 000,000,448 | —- | M] () – C:\Users\Patty\Documents\cc_20120821_115040.reg
[2012/08/20 23:33:47 | 000,012,992 | —- | M] (Paramount Software UK Ltd) – C:\Windows\System32\drivers\PSVolAcc.sys
[2012/08/20 23:33:27 | 000,016,064 | —- | M] (Macrium Software) – C:\Windows\System32\drivers\pssnap.sys
[2012/08/20 23:33:19 | 000,053,952 | —- | M] (Macrium Software) – C:\Windows\System32\drivers\psmounter.sys
[2012/08/13 20:12:51 | 001,528,314 | —- | M] () – C:\Users\Patty\Documents\P1020734.JPG

========== Files Created - No Company Name ==========

[2012/08/29 11:57:34 | 011,255,615 | —- | C] () – C:\Users\Patty\Desktop\invite 2.hmk
[2012/08/28 16:17:25 | 000,297,831 | —- | C] () – C:\Users\Patty\Desktop\external drive.PNG
[2012/08/28 16:14:09 | 000,318,068 | —- | C] () – C:\Users\Patty\Desktop\reflecrt.PNG
[2012/08/26 23:05:06 | 000,000,830 | —- | C] () – C:\Windows\tasks\Adobe Flash Player Updater.job
[2012/08/24 19:35:07 | 000,002,295 | —- | C] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Event Planner Reminder.lnk
[2012/08/24 11:45:05 | 000,098,269 | —- | C] () – C:\Users\Patty\Desktop\adult_online_forms_07_09_rev_06_1136.pdf
[2012/08/21 11:50:42 | 000,000,448 | —- | C] () – C:\Users\Patty\Documents\cc_20120821_115040.reg
[2012/08/13 20:12:49 | 001,528,314 | —- | C] () – C:\Users\Patty\Documents\P1020734.JPG
[2012/07/20 14:27:03 | 000,027,520 | —- | C] () – C:\Users\Patty\AppData\Local\dt.dat
[2012/03/17 00:25:18 | 000,000,017 | —- | C] () – C:\Users\Patty\AppData\Local\resmon.resmoncfg
[2012/02/10 23:29:32 | 000,021,316 | —- | C] () – C:\Windows\System32\emptyregdb.dat
[2011/09/26 11:00:27 | 000,000,117 | —- | C] () – C:\Windows\restore.INI
[2011/04/17 19:19:47 | 000,000,064 | —- | C] () – C:\Windows\GPlrLanc.dat

========== Custom Scans ==========

< >

< %SYSTEMDRIVE%\*.exe >

< MD5 for: EXPLORER.EXE >
[2011/02/26 01:19:21 | 002,616,320 | —- | M] (Microsoft Corporation) MD5=0FB9C74046656D1579A64660AD67B746 – C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.21669_none_54149f9ef14031fc\explorer.exe
[2009/07/13 21:14:20 | 002,613,248 | —- | M] (Microsoft Corporation) MD5=15BC38A7492BEFE831966ADB477CF76F – C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16385_none_518afd35db100430\explorer.exe
[2011/02/26 01:51:13 | 002,614,784 | —- | M] (Microsoft Corporation) MD5=255CF508D7CFB10E0794D6AC93280BD8 – C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20910_none_525b5180f3f95373\explorer.exe
[2009/10/31 01:45:39 | 002,614,272 | —- | M] (Microsoft Corporation) MD5=2626FC9755BE22F805D3CFA0CE3EE727 – C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16450_none_51a66d6ddafc2ed1\explorer.exe
[2011/02/26 01:33:07 | 002,614,784 | —- | M] (Microsoft Corporation) MD5=2AF58D15EDC06EC6FDACCE1F19482BBF – C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16768_none_51a3a583dafd0cef\explorer.exe
[2010/11/20 08:17:09 | 002,616,320 | —- | M] (Microsoft Corporation) MD5=40D777B7A95E00593EB1568C68514493 – C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17514_none_53bc10fdd7fe87ca\explorer.exe
[2011/02/25 01:30:54 | 002,616,320 | —- | M] (Microsoft Corporation) MD5=8B88EBBB05A0E56B7DCC708498C02B3E – C:\Windows\erdnt\cache\explorer.exe
[2011/02/25 01:30:54 | 002,616,320 | —- | M] (Microsoft Corporation) MD5=8B88EBBB05A0E56B7DCC708498C02B3E – C:\Windows\explorer.exe
[2011/02/25 01:30:54 | 002,616,320 | —- | M] (Microsoft Corporation) MD5=8B88EBBB05A0E56B7DCC708498C02B3E – C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17567_none_5389023fd8245f84\explorer.exe
[2009/08/03 01:49:47 | 002,613,248 | —- | M] (Microsoft Corporation) MD5=9FF6C4C91A3711C0A3B18F87B08B518D – C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20500_none_526619d4f3f142e6\explorer.exe
[2009/08/03 01:35:50 | 002,613,248 | —- | M] (Microsoft Corporation) MD5=B95EEB0F4E5EFBF1038A35B3351CF047 – C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16404_none_51e07e31dad00878\explorer.exe
[2009/10/31 02:00:51 | 002,614,272 | —- | M] (Microsoft Corporation) MD5=C76153C7ECA00FA852BB0C193378F917 – C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20563_none_52283b2af41f3691\explorer.exe

< MD5 for: SVCHOST.EXE >
[2009/07/13 21:14:41 | 000,020,992 | —- | M] (Microsoft Corporation) MD5=54A47F6B5E09A77E61649109C6A08866 – C:\Windows\erdnt\cache\svchost.exe
[2009/07/13 21:14:41 | 000,020,992 | —- | M] (Microsoft Corporation) MD5=54A47F6B5E09A77E61649109C6A08866 – C:\Windows\System32\svchost.exe
[2009/07/13 21:14:41 | 000,020,992 | —- | M] (Microsoft Corporation) MD5=54A47F6B5E09A77E61649109C6A08866 – C:\Windows\winsxs\x86_microsoft-windows-services-svchost_31bf3856ad364e35_6.1.7600.16385_none_b591afc466a15356\svchost.exe
[2012/07/03 13:46:42 | 000,217,672 | —- | M] () MD5=8A7F34F0BBD076EC3815680A7309114F – C:\Program Files\Malwarebytes' Anti-Malware\Chameleon\svchost.exe

< MD5 for: USERINIT.EXE >
[2010/11/20 08:17:48 | 000,026,624 | —- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 – C:\Windows\erdnt\cache\userinit.exe
[2010/11/20 08:17:48 | 000,026,624 | —- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 – C:\Windows\System32\userinit.exe
[2010/11/20 08:17:48 | 000,026,624 | —- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 – C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7601.17514_none_de3024012ff21116\userinit.exe
[2009/07/13 21:14:43 | 000,026,112 | —- | M] (Microsoft Corporation) MD5=6DE80F60D7DE9CE6B8C2DDFDF79EF175 – C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7600.16385_none_dbff103933038d7c\userinit.exe

< MD5 for: WINLOGON.EXE >
[2009/10/28 02:17:59 | 000,285,696 | —- | M] (Microsoft Corporation) MD5=37CDB7E72EB66BA85A87CBE37E7F03FD – C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16447_none_6fc699643622d177\winlogon.exe
[2009/10/28 01:52:08 | 000,285,696 | —- | M] (Microsoft Corporation) MD5=3BABE6767C78FBF5FB8435FEED187F30 – C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.20560_none_703394514f56f7c2\winlogon.exe
[2010/11/20 08:17:54 | 000,286,720 | —- | M] (Microsoft Corporation) MD5=6D13E1406F50C66E2A95D97F22C47560 – C:\Windows\erdnt\cache\winlogon.exe
[2010/11/20 08:17:54 | 000,286,720 | —- | M] (Microsoft Corporation) MD5=6D13E1406F50C66E2A95D97F22C47560 – C:\Windows\System32\winlogon.exe
[2010/11/20 08:17:54 | 000,286,720 | —- | M] (Microsoft Corporation) MD5=6D13E1406F50C66E2A95D97F22C47560 – C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7601.17514_none_71ca6b0233339500\winlogon.exe
[2012/07/03 13:46:42 | 000,217,672 | —- | M] () MD5=8A7F34F0BBD076EC3815680A7309114F – C:\Program Files\Malwarebytes' Anti-Malware\Chameleon\winlogon.exe
[2009/07/13 21:14:45 | 000,285,696 | —- | M] (Microsoft Corporation) MD5=8EC6A4AB12B8F3759E21F8E3A388F2CF – C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16385_none_6f99573a36451166\winlogon.exe

< %systemroot%\*. /rp /s >

========== Drive Information ==========

Physical Drives
—————

Drive: \\\\.\\PHYSICALDRIVE0 - Fixed hard disk media
Interface type: IDE
Media Type: Fixed hard disk media
Model: WDC WD3200AAKS-75L9A0 ATA Device
Partitions: 2
Status: OK
Status Info: 0

Drive: \\\\.\\PHYSICALDRIVE1 -
Interface type: USB
Media Type:
Model: TEAC USB HS-CF Card USB Device
Partitions: 0
Status: OK
Status Info: 0

Drive: \\\\.\\PHYSICALDRIVE2 -
Interface type: USB
Media Type:
Model: TEAC USB HS-xD/SM USB Device
Partitions: 0
Status: OK
Status Info: 0

Drive: \\\\.\\PHYSICALDRIVE3 -
Interface type: USB
Media Type:
Model: TEAC USB HS-MS Card USB Device
Partitions: 0
Status: OK
Status Info: 0

Drive: \\\\.\\PHYSICALDRIVE4 -
Interface type: USB
Media Type:
Model: TEAC USB HS-SD Card USB Device
Partitions: 0
Status: OK
Status Info: 0

Drive: \\\\.\\PHYSICALDRIVE5 -
Interface type: USB
Media Type:
Model: Canon MP500Storage USB Device
Partitions: 0
Status: OK
Status Info: 0

Drive: \\\\.\\PHYSICALDRIVE6 - External hard disk media
Interface type: USB
Media Type: External hard disk media
Model: WD Ext HDD 1021 USB Device
Partitions: 1
Status: OK
Status Info: 0

Partitions
—————

DeviceID: Disk #0, Partition #0
PartitionType: Installable File System
Bootable: True
BootPartition: True
PrimaryPartition: True
Size: 0.00GB
Starting Offset: 1048576
Hidden sectors: 0

DeviceID: Disk #0, Partition #1
PartitionType: Installable File System
Bootable: False
BootPartition: False
PrimaryPartition: True
Size: 298.00GB
Starting Offset: 105906176
Hidden sectors: 0

DeviceID: Disk #6, Partition #0
PartitionType: Installable File System
Bootable: False
BootPartition: False
PrimaryPartition: True
Size: 932.00GB
Starting Offset: 1048576
Hidden sectors: 0

< End of report >

jeffce

Post #4August 31, 2012, 6:23 PM UTC

Hi and Welcome!!

My name is Jeff. I would be more than happy to take a look at your malware results logs and help you with solving any malware problems you might have. Logs can take a while to research, so please be patient and know that I am working hard to get you a clean and functional system back in your hands. I'd be grateful if you would note the following:

The fixes are specific to your problem and should only be used for the issues on this machine.
It's often worth reading through these instructions and printing them for ease of reference.
If you don't know or understand something, please don't hesitate to say or ask!! It's better to be sure and safe than sorry.
Please reply to this thread. Do not start a new topic.
If you happen to have a flash drive/thumb drive please have that ready in the event that we need to use it.

IMPORTANT NOTE : Please do not delete, download or install anything unless instructed to do so.
DO NOT use any TOOLS such as Combofix or HijackThis fixes without supervision. Doing so could make your system inoperable and could require a full reinstall of your Operating System and losing all your programs and data.

Having said that….Let's get going!!

———-

Please download aswMBR to your desktop.

Double click the aswMBR icon to run it.
Click the Scan button to start scan.
If you are asked to update the Avast Virus database please allow it to do so.
When it finishes, press the save log button, save the logfile to your desktop and post its contents in your next reply.

[external image: Posted Image]
Click the image to enlarge it
———-

PattiChati

Post #5August 31, 2012, 6:39 PM UTC

Thank you so much. I hope this is right. My computer never likes to follow directions very well, but I usually get the end result. If this is not right, let me know, ok.📎aswMBR.txt

PattiChati

Post #6August 31, 2012, 6:41 PM UTC

Read your profile, you sound just like my brother!!!!!!!

jeffce

Post #7August 31, 2012, 6:58 PM UTC last edited August 31, 2012, 9:22 PM UTC

Read your profile, you sound just like my brother!!!!!!!

You poor thing LOL!! I am just teasing.

——-

For the time being I would like for you to uninstall Google Chrome and only use Firefox or Internet Explorer. You can reinstall it later if you like.

We need to remove some entries and that is the easiest way to do so with Google Chrome.
———-

Please download ERUNT (Emergency Recovery Utility NT). This program allows you to keep a complete backup of your registry and restore it when needed. The standard registry backup options that come with Windows back up most of the registry but not all of it. ERUNT however creates a complete backup set, including the Security hive and user related sections. ERUNT is easy to use and since it creates a full backup, there are no options or choices other than to select the location of the backup files. The backup set includes a small executable that will launch the registry restore if needed. **Remember if you are using Windows Vista as your operating system right-click the executable and Run as Administrator.
———-

Run OTL.exe

Copy/paste the following text written inside of the code box into the Custom Scans/Fixes box located at the bottom of OTL

:Services

:OTL
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}…amp;FORM=IE8SRC
FF - prefs.js..browser.search.defaultenginename: "Search the web (Babylon)"
FF - prefs.js..browser.search.order.1: "Search the web (Babylon)"
[2012/07/13 20:16:36 | 000,002,252 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\bing.xml

:Files
ipconfig /flushdns /c

:Commands
[emptytemp]
[resethosts]
[start explorer]
[Reboot]

Then click the Run Fix button at the top
Let the program run unhindered, reboot when it is done
Then run a new scan and post a new OTL log ( don't check the boxes beside LOP Check or Purity this time )

PattiChati

Post #8August 31, 2012, 7:15 PM UTC

Why can't I find Google Chrome. I have revo and couldn't find it there either. I download Erunt. What am I supposed to do with it? I will do the OTL after you say so. Saying you are like my brother is a huge complement. He is deceased, but still has us laugh ting with the memories.

jeffce

Post #9August 31, 2012, 7:20 PM UTC

Hi,

Saying you are like my brother is a huge complement.

Well I take it that way.

——-

Why can't I find Google Chrome.

It should be located at Control Panel >> Programs and Features
——-

With ERUNT…once downloaded, go ahead and run it and this will back up your registry prior to running OTL.

PattiChati

Post #10August 31, 2012, 7:22 PM UTC

I have four chrome setups then an otl and extras that I found under programs, but nothing with Revo Uninstaller. Is that what ERUNT is for?

PattiChati

Post #11August 31, 2012, 7:27 PM UTC

Chrome is not in there either.

PattiChati

Post #12August 31, 2012, 7:30 PM UTC last edited August 31, 2012, 7:31 PM UTC

when I open one of those google setups it asks if I want to run the file. The only thing I can do is right click on the setup files that is under Programs and hit delete, but that probably doesn't get rid of all of it, does it?

jeffce

Post #13August 31, 2012, 7:33 PM UTC

Hi,

With ERUNT…once downloaded, go ahead and run it and this will back up your registry prior to running OTL.

That is what ERUNT is for.
—–

Don't worry about Google Chrome and just continue on with running OTL with the instructions I provided.

PattiChati

Post #14August 31, 2012, 7:34 PM UTC

I am so sorry to be such a pain already, but when it asks where to save registry it puts it in a file I don't know I could find again. Do I just put it where they suggested. It gives you two backup options and right now both are checked - system registry or current user registry?

jeffce

Post #15August 31, 2012, 7:37 PM UTC

I am so sorry to be such a pain already

You are not a pain.

Just go ahead and let ERUNT put the files where it wants to. This is just a safety net for while we are running OTL. When you get the new log made by OTL please post that.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

Xoftspyse - Satchfan [Solved]

✨ Ask AI

Ask AI