Browser Hijacked, Trojan? [Solved]

browser is hijacked and antivirus program shows viruses.


OTL logfile created on: 9/3/2012 6:10:39 PM - Run 1
OTL by OldTimer - Version 3.2.60.0 Folder = C:\Users\Jack\Downloads
64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

5.91 Gb Total Physical Memory | 3.97 Gb Available Physical Memory | 67.17% Memory free
11.82 Gb Paging File | 9.87 Gb Available in Paging File | 83.52% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 919.58 Gb Total Space | 864.22 Gb Free Space | 93.98% Space Free | Partition Type: NTFS
Drive D: | 11.83 Gb Total Space | 1.45 Gb Free Space | 12.25% Space Free | Partition Type: NTFS
Drive E: | 338.06 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS

Computer Name: ZEKE-HP | User Name: Jack | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Users\Jack\Downloads\OTL.exe (OldTimer Tools)
PRC - C:\Program Files (x86)\Common Files\Spigot\Search Settings\SearchSettings.exe (Spigot, Inc.)
PRC - C:\Program Files (x86)\Application Updater\ApplicationUpdater.exe (Spigot, Inc.)
PRC - C:\Program Files (x86)\AVG\AVG2012\avgidsagent.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files (x86)\AVG\AVG2012\avgtray.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files (x86)\AVG\AVG2012\avgwdsvc.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files (x86)\Common Files\Intuit\Update Service v4\IntuitUpdateService.exe (Intuit Inc.)
PRC - C:\Program Files (x86)\HP SimplePass 2011\TrueSuiteService.exe (HP)
PRC - C:\Program Files (x86)\HP SimplePass 2011\TouchControl.exe (HP)
PRC - C:\Program Files (x86)\HP SimplePass 2011\BioMonitor.exe (HP)
PRC - C:\Program Files (x86)\PDF Complete\pdfsvc.exe (PDF Complete Inc)
PRC - C:\Program Files (x86)\Hewlett-Packard\Shared\HPDrvMntSvc.exe (Hewlett-Packard Company)
PRC - C:\Program Files (x86)\Microsoft\BingBar\SeaPort.EXE (Microsoft Corporation)
PRC - C:\Program Files (x86)\Intel\Services\IPT\jhi_service.exe (Intel Corporation)
PRC - C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe (Intel Corporation)
PRC - C:\Program Files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe (Intel Corporation)
PRC - C:\Program Files (x86)\Roxio\RoxioNow Player\RNowSvc.exe (Roxio)
PRC - C:\Program Files (x86)\McAfee Security Scan\2.0.189\SSScheduler.exe (McAfee, Inc.)
PRC - C:\Program Files (x86)\Hewlett-Packard\HP Odometer\hpsysdrv.exe (Hewlett-Packard)


========== Modules (No Company Name) ==========


========== Services (SafeList) ==========

SRV:64bit: - (HPAuto) – C:\Program Files\Hewlett-Packard\HP Auto\HPAuto.exe (Hewlett-Packard)
SRV:64bit: - (HPClientSvc) – C:\Program Files\Hewlett-Packard\HP Client Services\HPClientServices.exe (Hewlett-Packard Company)
SRV:64bit: - (wlcrasvc) – C:\Program Files\Windows Live\Mesh\wlcrasvc.exe (Microsoft Corporation)
SRV - (AdobeFlashPlayerUpdateSvc) – C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe (Adobe Systems Incorporated)
SRV - (Application Updater) – C:\Program Files (x86)\Application Updater\ApplicationUpdater.exe (Spigot, Inc.)
SRV - (MozillaMaintenance) – C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe (Mozilla Foundation)
SRV - (AVGIDSAgent) – C:\Program Files (x86)\AVG\AVG2012\avgidsagent.exe (AVG Technologies CZ, s.r.o.)
SRV - (avgwd) – C:\Program Files (x86)\AVG\AVG2012\avgwdsvc.exe (AVG Technologies CZ, s.r.o.)
SRV - (IntuitUpdateServiceV4) – C:\Program Files (x86)\Common Files\Intuit\Update Service v4\IntuitUpdateService.exe (Intuit Inc.)
SRV - (HP Support Assistant Service) – C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSA_Service.exe (Hewlett-Packard Company)
SRV - (FPLService) – C:\Program Files (x86)\HP SimplePass 2011\TrueSuiteService.exe (HP)
SRV - (pdfcDispatcher) – C:\Program Files (x86)\PDF Complete\pdfsvc.exe (PDF Complete Inc)
SRV - (HPDrvMntSvc.exe) – C:\Program Files (x86)\Hewlett-Packard\Shared\HPDrvMntSvc.exe (Hewlett-Packard Company)
SRV - (BBSvc) – C:\Program Files (x86)\Microsoft\BingBar\BBSvc.EXE (Microsoft Corporation.)
SRV - (SeaPort) – C:\Program Files (x86)\Microsoft\BingBar\SeaPort.EXE (Microsoft Corporation)
SRV - (jhi_service) – C:\Program Files (x86)\Intel\Services\IPT\jhi_service.exe (Intel Corporation)
SRV - (UNS) – C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe (Intel Corporation)
SRV - (LMS) – C:\Program Files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe (Intel Corporation)
SRV - (RoxioNow Service) – C:\Program Files (x86)\Roxio\RoxioNow Player\RNowSvc.exe (Roxio)
SRV - (HPSLPSVC) – C:\Program Files (x86)\Hp\Digital Imaging\bin\HPSLPSVC64.DLL (Hewlett-Packard Co.)
SRV - (GamesAppService) – C:\Program Files (x86)\WildTangent Games\App\GamesAppService.exe (WildTangent, Inc.)
SRV - (McComponentHostService) – C:\Program Files (x86)\McAfee Security Scan\2.0.189\McCHSvc.exe (McAfee, Inc.)
SRV - (NOBU) – C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe (Symantec Corporation)
SRV - (clr_optimization_v4.0.30319_32) – C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (Microsoft Corporation)
SRV - (clr_optimization_v2.0.50727_32) – C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (Microsoft Corporation)


========== Driver Services (SafeList) ==========

DRV:64bit: - (AVGIDSHA) – C:\Windows\SysNative\drivers\avgidsha.sys (AVG Technologies CZ, s.r.o. )
DRV:64bit: - (Avgtdia) – C:\Windows\SysNative\drivers\avgtdia.sys (AVG Technologies CZ, s.r.o.)
DRV:64bit: - (Fs_Rec) – C:\Windows\SysNative\drivers\fs_rec.sys (Microsoft Corporation)
DRV:64bit: - (Avgldx64) – C:\Windows\SysNative\drivers\avgldx64.sys (AVG Technologies CZ, s.r.o.)
DRV:64bit: - (Avgrkx64) – C:\Windows\SysNative\drivers\avgrkx64.sys (AVG Technologies CZ, s.r.o.)
DRV:64bit: - (Avgmfx64) – C:\Windows\SysNative\drivers\avgmfx64.sys (AVG Technologies CZ, s.r.o.)
DRV:64bit: - (AVGIDSFilter) – C:\Windows\SysNative\drivers\avgidsfiltera.sys (AVG Technologies CZ, s.r.o. )
DRV:64bit: - (AVGIDSDriver) – C:\Windows\SysNative\drivers\avgidsdrivera.sys (AVG Technologies CZ, s.r.o. )
DRV:64bit: - (pmxdrv) – C:\Windows\SysNative\drivers\pmxdrv.sys ()
DRV:64bit: - (amdsata) – C:\Windows\SysNative\drivers\amdsata.sys (Advanced Micro Devices)
DRV:64bit: - (amdxata) – C:\Windows\SysNative\drivers\amdxata.sys (Advanced Micro Devices)
DRV:64bit: - (iaStor) – C:\Windows\SysNative\drivers\iaStor.sys (Intel Corporation)
DRV:64bit: - (RTL8167) – C:\Windows\SysNative\drivers\Rt64win7.sys (Realtek )
DRV:64bit: - (netr28x) – C:\Windows\SysNative\drivers\netr28x.sys (Ralink Technology, Corp.)
DRV:64bit: - (igfx) – C:\Windows\SysNative\drivers\igdkmd64.sys (Intel Corporation)
DRV:64bit: - (TsUsbFlt) – C:\Windows\SysNative\drivers\TsUsbFlt.sys (Microsoft Corporation)
DRV:64bit: - (HpSAMD) – C:\Windows\SysNative\drivers\HpSAMD.sys (Hewlett-Packard Company)
DRV:64bit: - (TsUsbGD) – C:\Windows\SysNative\drivers\TsUsbGD.sys (Microsoft Corporation)
DRV:64bit: - (MEIx64) – C:\Windows\SysNative\drivers\HECIx64.sys (Intel Corporation)
DRV:64bit: - (Impcd) – C:\Windows\SysNative\drivers\Impcd.sys (Intel Corporation)
DRV:64bit: - (amdsbs) – C:\Windows\SysNative\drivers\amdsbs.sys (AMD Technologies Inc.)
DRV:64bit: - (LSI_SAS2) – C:\Windows\SysNative\drivers\lsi_sas2.sys (LSI Corporation)
DRV:64bit: - (stexstor) – C:\Windows\SysNative\drivers\stexstor.sys (Promise Technology)
DRV:64bit: - (WSDPrintDevice) – C:\Windows\SysNative\drivers\WSDPrint.sys (Microsoft Corporation)
DRV:64bit: - (StillCam) – C:\Windows\SysNative\drivers\serscan.sys (Microsoft Corporation)
DRV:64bit: - (ebdrv) – C:\Windows\SysNative\drivers\evbda.sys (Broadcom Corporation)
DRV:64bit: - (b06bdrv) – C:\Windows\SysNative\drivers\bxvbda.sys (Broadcom Corporation)
DRV:64bit: - (b57nd60a) – C:\Windows\SysNative\drivers\b57nd60a.sys (Broadcom Corporation)
DRV:64bit: - (hcw85cir) – C:\Windows\SysNative\drivers\hcw85cir.sys (Hauppauge Computer Works, Inc.)
DRV - (WIMMount) – C:\Windows\SysWOW64\drivers\wimmount.sys (Microsoft Corporation)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://g.msn.com/HPDSK/1
IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://g.msn.com/HPDSK/1
IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}…rc=IE-SearchBox
IE:64bit: - HKLM\..\SearchScopes\{2fa28606-de77-4029-af96-b231e3b8f827}: "URL" = http://search.ask.com/web?q={searchterms}&…is&o=HPDTDF
IE:64bit: - HKLM\..\SearchScopes\{b7fca997-d0fb-4fe0-8afd-255e89cf9671}: "URL" = http://search.yahoo.com/search?p={searchTe…amp;type=HPDTDF
IE:64bit: - HKLM\..\SearchScopes\{CBEE8B4A-B645-4BB3-985F-45A1625B4BE7}: "URL" = http://www.amazon.com/s/ref=azs_osd_iea?ie…s={searchTerms}
IE:64bit: - HKLM\..\SearchScopes\{d43b3890-80c7-4010-a95d-1e77b5924dc3}: "URL" = http://en.wikipedia.org/wiki/Special:Searc…h={searchTerms}
IE:64bit: - HKLM\..\SearchScopes\{D944BB61-2E34-4DBF-A683-47E505C587DC}: "URL" = http://rover.ebay.com/rover/1/711-30572-11…w={searchTerms}
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://g.msn.com/HPDSK/1
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://g.msn.com/HPDSK/1
IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}…rc=IE-SearchBox
IE - HKLM\..\SearchScopes\{2fa28606-de77-4029-af96-b231e3b8f827}: "URL" = http://search.ask.com/web?q={searchterms}&…is&o=HPDTDF
IE - HKLM\..\SearchScopes\{b7fca997-d0fb-4fe0-8afd-255e89cf9671}: "URL" = http://search.yahoo.com/search?p={searchTe…amp;type=HPDTDF
IE - HKLM\..\SearchScopes\{CBEE8B4A-B645-4BB3-985F-45A1625B4BE7}: "URL" = http://www.amazon.com/s/ref=azs_osd_iea?ie…s={searchTerms}
IE - HKLM\..\SearchScopes\{d43b3890-80c7-4010-a95d-1e77b5924dc3}: "URL" = http://en.wikipedia.org/wiki/Special:Searc…h={searchTerms}
IE - HKLM\..\SearchScopes\{D944BB61-2E34-4DBF-A683-47E505C587DC}: "URL" = http://rover.ebay.com/rover/1/711-30572-11…w={searchTerms}

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://g.msn.com/HPDSK/1
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,First Home Page = http://g.msn.com/HPDSK/1
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://g.msn.com/HPDSK/1
IE - HKCU\..\URLSearchHook: {F3FEE66E-E034-436a-86E4-9690573BEE8A} - C:\Program Files (x86)\YTD Toolbar\IE\6.2\ytdToolbarIE.dll (Spigot, Inc.)
IE - HKCU\..\SearchScopes,DefaultScope = {8542D6A7-F796-42C2-9B61-7D8CD69AB665}
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}…rc=IE-SearchBox
IE - HKCU\..\SearchScopes\{2fa28606-de77-4029-af96-b231e3b8f827}: "URL" = http://search.ask.com/web?q={searchterms}&…is&o=HPDTDF
IE - HKCU\..\SearchScopes\{8542D6A7-F796-42C2-9B61-7D8CD69AB665}: "URL" = http://search.yahoo.com/search?fr=chr-gree…p={searchTerms}
IE - HKCU\..\SearchScopes\{b7fca997-d0fb-4fe0-8afd-255e89cf9671}: "URL" = http://search.yahoo.com/search?p={searchTe…amp;type=HPDTDF
IE - HKCU\..\SearchScopes\{CBEE8B4A-B645-4BB3-985F-45A1625B4BE7}: "URL" = http://www.amazon.com/s/ref=azs_osd_iea?ie…s={searchTerms}
IE - HKCU\..\SearchScopes\{d43b3890-80c7-4010-a95d-1e77b5924dc3}: "URL" = http://en.wikipedia.org/wiki/Special:Searc…h={searchTerms}
IE - HKCU\..\SearchScopes\{D944BB61-2E34-4DBF-A683-47E505C587DC}: "URL" = http://rover.ebay.com/rover/1/711-30572-11…w={searchTerms}
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..browser.search.defaultenginename: "Yahoo"
FF - prefs.js..browser.search.param.yahoo-fr: "chr-greentree_ff&ilc=12&type=937811"
FF - prefs.js..browser.search.selectedEngine: "Google"
FF - prefs.js..keyword.URL: "http://search.yahoo.com/search?fr=greentree_ff1&ei=utf-8&ilc=12&type=937811&p="
FF - user.js - File not found

FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_4_402_265.dll File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_4_402_265.dll ()
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.7.2: C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.7.2: C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files (x86)\Microsoft Silverlight\4.1.10329.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3508.1109: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3555.0308: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@WildTangent.com/GamesAppPresenceDetector,Version=1.0: C:\Program Files (x86)\WildTangent Games\App\BrowserIntegration\Registered\6\NP_wtapp.dll ()

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{1E73965B-8B48-48be-9C8D-68B920ABC1C4}: C:\Program Files (x86)\AVG\AVG2012\Firefox4\ [2012/07/17 09:28:33 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\[removed]: C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2012/01/03 18:03:08 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{F53C93F1-07D5-430c-86D4-C9531B27DFAF}: C:\Program Files (x86)\AVG\AVG2012\Firefox\DoNotTrack\ [2012/07/02 08:58:34 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\[removed]: C:\Program Files (x86)\Hewlett-Packard\SmartPrint\QPExtension [2011/01/26 15:27:28 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 14.0.1\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012/08/15 16:09:47 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 14.0.1\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2012/08/31 19:17:11 | 000,000,000 | —D | M]

[2011/12/19 12:21:13 | 000,000,000 | —D | M] (No name found) – C:\Users\Jack\AppData\Roaming\Mozilla\Extensions
[2012/09/03 14:32:23 | 000,000,000 | —D | M] (No name found) – C:\Users\Jack\AppData\Roaming\Mozilla\Firefox\Profiles\vgt1h20z.default\extensions
[2012/03/05 00:04:20 | 000,000,000 | —D | M] (Coupon Alert) – C:\Users\Jack\AppData\Roaming\Mozilla\Firefox\Profiles\vgt1h20z.default\extensions\2pffxtbr@CouponAlert_2p.com
[2012/07/24 10:21:42 | 000,000,000 | —D | M] (No name found) – C:\Program Files (x86)\Mozilla Firefox\extensions
[2012/07/24 10:21:42 | 000,000,000 | —D | M] (TrueSuite Website Logon) – C:\Program Files (x86)\Mozilla Firefox\extensions\[removed]
[2012/07/20 08:43:22 | 000,136,672 | —- | M] (Mozilla Foundation) – C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll
[2012/02/07 00:40:23 | 000,466,944 | —- | M] (Catalina Marketing Corporation) – C:\Program Files (x86)\mozilla firefox\plugins\NPcol400.dll
[2011/07/13 17:52:56 | 000,091,552 | —- | M] (Coupons, Inc.) – C:\Program Files (x86)\mozilla firefox\plugins\npCouponPrinter.dll
[2011/07/13 17:52:58 | 000,091,552 | —- | M] (Coupons, Inc.) – C:\Program Files (x86)\mozilla firefox\plugins\npMozCouponPrinter.dll
[2012/05/14 22:24:04 | 000,003,739 | —- | M] () – C:\Program Files (x86)\mozilla firefox\searchplugins\avg-secure-search.xml
[2012/06/27 10:40:39 | 000,002,252 | —- | M] () – C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml
[2012/06/27 10:40:39 | 000,002,040 | —- | M] () – C:\Program Files (x86)\mozilla firefox\searchplugins\twitter.xml

O1 HOSTS File: ([2009/06/10 17:00:26 | 000,000,824 | —- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O2:64bit: - BHO: (AVG Do Not Track) - {31332EEF-CB9F-458F-AFEB-D30E9A66B6BA} - C:\Program Files (x86)\AVG\AVG2012\avgdtiea.dll (AVG Technologies CZ, s.r.o.)
O2:64bit: - BHO: (AVG Safe Search) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files (x86)\AVG\AVG2012\avgssiea.dll (AVG Technologies CZ, s.r.o.)
O2:64bit: - BHO: (TrueSuite Website Log On) - {8590886E-EC8C-43C1-A32C-E4C2B0B6395B} - C:\Program Files (x86)\HP SimplePass 2011\x64\IEBHO.dll (HP)
O2 - BHO: (AVG Do Not Track) - {31332EEF-CB9F-458F-AFEB-D30E9A66B6BA} - C:\Program Files (x86)\AVG\AVG2012\avgdtiex.dll (AVG Technologies CZ, s.r.o.)
O2 - BHO: (AVG Safe Search) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files (x86)\AVG\AVG2012\avgssie.dll (AVG Technologies CZ, s.r.o.)
O2 - BHO: (Java™ Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
O2 - BHO: (TrueSuite Website Log On) - {8590886E-EC8C-43C1-A32C-E4C2B0B6395B} - C:\Program Files (x86)\HP SimplePass 2011\IEBHO.dll (HP)
O2 - BHO: (Bing Bar Helper) - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.)
O2 - BHO: (Java™ Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O2 - BHO: (YTD Toolbar) - {F3FEE66E-E034-436a-86E4-9690573BEE8A} - C:\Program Files (x86)\YTD Toolbar\IE\6.2\ytdToolbarIE.dll (Spigot, Inc.)
O3 - HKLM\..\Toolbar: (Bing Bar) - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.)
O3 - HKLM\..\Toolbar: (YTD Toolbar) - {F3FEE66E-E034-436a-86E4-9690573BEE8A} - C:\Program Files (x86)\YTD Toolbar\IE\6.2\ytdToolbarIE.dll (Spigot, Inc.)
O4:64bit: - HKLM..\Run: [HotKeysCmds] C:\Windows\SysNative\hkcmd.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [hpsysdrv] c:\Program Files (x86)\Hewlett-Packard\HP Odometer\hpsysdrv.exe (Hewlett-Packard)
O4:64bit: - HKLM..\Run: [IgfxTray] C:\Windows\SysNative\igfxtray.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [Persistence] C:\Windows\SysNative\igfxpers.exe (Intel Corporation)
O4 - HKLM..\Run: [] File not found
O4 - HKLM..\Run: [AVG_TRAY] C:\Program Files (x86)\AVG\AVG2012\avgtray.exe (AVG Technologies CZ, s.r.o.)
O4 - HKLM..\Run: [Norton Online Backup] C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuClient.exe (Symantec Corporation)
O4 - HKLM..\Run: [PDF Complete] C:\Program Files (x86)\PDF Complete\pdfsty.exe (PDF Complete Inc)
O4 - HKLM..\Run: [SearchSettings] C:\Program Files (x86)\Common Files\Spigot\Search Settings\SearchSettings.exe (Spigot, Inc.)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: LogonHoursAction = 2
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DontDisplayLogonHoursWarnings = 1
O9:64bit: - Extra Button: AVG Do Not Track - {68BCFFE1-A2DA-4B40-9068-87ECBFC19D16} - C:\Program Files (x86)\AVG\AVG2012\avgdtiea.dll (AVG Technologies CZ, s.r.o.)
O9 - Extra Button: HP Smart Print - {22CC3EBD-C286-43aa-B8E6-06B115F74162} - C:\Program Files (x86)\Hewlett-Packard\SmartPrint\smartprintsetup.exe (Hewlett-Packard)
O9 - Extra 'Tools' menuitem : SmartPrint - {22CC3EBD-C286-43aa-B8E6-06B115F74162} - C:\Program Files (x86)\Hewlett-Packard\SmartPrint\smartprintsetup.exe (Hewlett-Packard)
O9 - Extra Button: AVG Do Not Track - {68BCFFE1-A2DA-4B40-9068-87ECBFC19D16} - C:\Program Files (x86)\AVG\AVG2012\avgdtiex.dll (AVG Technologies CZ, s.r.o.)
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000001 - mmswsock.dll File not found
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000002 - mmswsock.dll File not found
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000003 - mmswsock.dll File not found
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000004 - mmswsock.dll File not found
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000005 - mmswsock.dll File not found
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000006 - mmswsock.dll File not found
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000007 - mmswsock.dll File not found
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000008 - mmswsock.dll File not found
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000009 - mmswsock.dll File not found
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000010 - mmswsock.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000003 - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000004 - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000005 - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000006 - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000007 - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000008 - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000009 - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000010 - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL File not found
O1364bit: - gopher Prefix: missing
O13 - gopher Prefix: missing
O15 - HKCU\..Trusted Domains: intuit.com ([ttlc] https in Trusted sites)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.0.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{0F6796A7-F9F3-4EB2-941F-1588FCCD102D}: DhcpNameServer = 192.168.0.1
O18:64bit: - Protocol\Handler\grooveLocalGWS - No CLSID value found
O18:64bit: - Protocol\Handler\linkscanner {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files (x86)\AVG\AVG2012\avgppa.dll (AVG Technologies CZ, s.r.o.)
O18:64bit: - Protocol\Handler\livecall - No CLSID value found
O18:64bit: - Protocol\Handler\ms-help - No CLSID value found
O18:64bit: - Protocol\Handler\msnim - No CLSID value found
O18:64bit: - Protocol\Handler\wlmailhtml - No CLSID value found
O18:64bit: - Protocol\Handler\wlpg - No CLSID value found
O18 - Protocol\Handler\linkscanner {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files (x86)\AVG\AVG2012\avgpp.dll (AVG Technologies CZ, s.r.o.)
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\SysWow64\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O20:64bit: - Winlogon\Notify\igfxcui: DllName - (igfxdev.dll) - C:\Windows\SysNative\igfxdev.dll (Intel Corporation)
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2011/09/09 17:45:49 | 000,000,129 | R— | M] () - E:\Autorun.inf – [ CDFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O34 - HKLM BootExecute: (C:\PROGRA~2\AVG\AVG2012\avgrsa.exe /sync /restart)
O35:64bit: - HKLM\..comfile [open] – "%1" %*
O35:64bit: - HKLM\..exefile [open] – "%1" %*
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37:64bit: - HKLM\…com [@ = comfile] – "%1" %*
O37:64bit: - HKLM\…exe [@ = exefile] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)


Drivers32:64bit: msacm.l3acm - C:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.l3acm - C:\Windows\SysWOW64\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: vidc.cvid - C:\Windows\SysWow64\iccvid.dll (Radius Inc.)

CREATERESTOREPOINT
Restore point Set: OTL Restore Point

========== Files/Folders - Created Within 30 Days ==========

[2012/09/03 16:40:29 | 000,000,000 | —D | C] – C:\ProgramData\Adobe
[2012/09/03 14:40:14 | 000,000,000 | —D | C] – C:\Users\Jack\AppData\Roaming\Malwarebytes
[2012/09/03 14:40:11 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2012/09/03 14:40:09 | 000,038,224 | —- | C] (Malwarebytes Corporation) – C:\Windows\SysWow64\drivers\mbamswissarmy.sys
[2012/09/03 14:40:06 | 000,024,904 | —- | C] (Malwarebytes Corporation) – C:\Windows\SysNative\drivers\mbam.sys
[2012/09/03 14:40:06 | 000,000,000 | —D | C] – C:\Program Files (x86)\Malwarebytes' Anti-Malware
[2012/09/03 14:40:06 | 000,000,000 | —D | C] – C:\ProgramData\Malwarebytes
[2012/09/03 14:38:10 | 000,000,000 | —D | C] – C:\Users\Jack\AppData\Local\HP
[2012/09/01 20:09:04 | 000,000,000 | —D | C] – C:\Users\Jack\AppData\Local\AuthenTec
[2012/08/31 19:17:19 | 000,000,000 | —D | C] – C:\Program Files (x86)\Common Files\Java
[2012/08/31 19:17:11 | 000,821,736 | —- | C] (Oracle Corporation) – C:\Windows\SysWow64\npDeployJava1.dll
[2012/08/31 19:17:11 | 000,246,760 | —- | C] (Oracle Corporation) – C:\Windows\SysWow64\javaws.exe
[2012/08/31 19:17:03 | 000,174,056 | —- | C] (Oracle Corporation) – C:\Windows\SysWow64\javaw.exe
[2012/08/31 19:17:03 | 000,174,056 | —- | C] (Oracle Corporation) – C:\Windows\SysWow64\java.exe
[2012/08/31 19:17:03 | 000,095,208 | —- | C] (Oracle Corporation) – C:\Windows\SysWow64\WindowsAccessBridge-32.dll
[2012/08/15 16:09:46 | 000,000,000 | —D | C] – C:\Program Files (x86)\Coupons
[2012/08/08 14:01:07 | 000,000,000 | -HSD | C] – C:\Windows\SysWow64\%APPDATA%
[2012/08/06 09:04:52 | 000,778,088 | —- | C] (Hewlett-Packard Co.) – C:\Windows\SysNative\HPDiscoPM5912.dll

========== Files - Modified Within 30 Days ==========

[2012/09/03 17:48:00 | 000,000,830 | —- | M] () – C:\Windows\tasks\Adobe Flash Player Updater.job
[2012/09/03 17:12:23 | 000,315,254 | —- | M] () – C:\Windows\SysNative\drivers\AVG\iavichjg.avm
[2012/09/03 16:40:54 | 000,696,520 | —- | M] (Adobe Systems Incorporated) – C:\Windows\SysWow64\FlashPlayerApp.exe
[2012/09/03 16:40:54 | 000,073,416 | —- | M] (Adobe Systems Incorporated) – C:\Windows\SysWow64\FlashPlayerCPLApp.cpl
[2012/09/03 15:06:43 | 000,024,608 | -H– | M] () – C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2012/09/03 15:06:43 | 000,024,608 | -H– | M] () – C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2012/09/03 15:06:11 | 000,778,660 | —- | M] () – C:\Windows\SysNative\PerfStringBackup.INI
[2012/09/03 15:06:11 | 000,660,068 | —- | M] () – C:\Windows\SysNative\perfh009.dat
[2012/09/03 15:06:11 | 000,120,996 | —- | M] () – C:\Windows\SysNative\perfc009.dat
[2012/09/03 14:59:15 | 000,000,328 | —- | M] () – C:\Windows\tasks\HPCeeScheduleForZeke.job
[2012/09/03 14:59:09 | 000,067,584 | –S- | M] () – C:\Windows\bootstat.dat
[2012/09/03 14:59:05 | 463,351,807 | -HS- | M] () – C:\hiberfil.sys
[2012/09/03 14:33:27 | 093,601,386 | —- | M] () – C:\Windows\SysNative\drivers\AVG\incavi.avm
[2012/09/02 21:20:48 | 000,002,450 | —- | M] () – C:\Users\Public\Desktop\WildTangent Games App - hp.lnk
[2012/08/31 19:16:59 | 000,095,208 | —- | M] (Oracle Corporation) – C:\Windows\SysWow64\WindowsAccessBridge-32.dll
[2012/08/31 19:16:58 | 000,821,736 | —- | M] (Oracle Corporation) – C:\Windows\SysWow64\npDeployJava1.dll
[2012/08/31 19:16:58 | 000,746,984 | —- | M] (Oracle Corporation) – C:\Windows\SysWow64\deployJava1.dll
[2012/08/31 19:16:58 | 000,246,760 | —- | M] (Oracle Corporation) – C:\Windows\SysWow64\javaws.exe
[2012/08/31 19:16:58 | 000,174,056 | —- | M] (Oracle Corporation) – C:\Windows\SysWow64\javaw.exe
[2012/08/31 19:16:58 | 000,174,056 | —- | M] (Oracle Corporation) – C:\Windows\SysWow64\java.exe
[2012/08/30 00:23:59 | 000,000,340 | —- | M] () – C:\Windows\tasks\HPCeeScheduleForZEKE-HP$.job
[2012/08/26 23:12:00 | 000,210,722 | —- | M] () – C:\Windows\hpoins21.dat
[2012/08/26 23:10:22 | 000,000,000 | —- | M] () – C:\Windows\SysNative\CN25NBR1SK05KD
[2012/08/13 16:57:04 | 000,000,348 | —- | M] () – C:\Windows\tasks\HPCeeScheduleForMike&Matt.job
[2012/08/06 09:04:51 | 000,002,166 | —- | M] () – C:\Users\Public\Desktop\HP Officejet Pro 8600.lnk
[2012/08/06 09:04:51 | 000,001,860 | —- | M] () – C:\Users\Public\Desktop\HP ePrintCenter - HP Officejet Pro 8600.lnk
[2012/08/06 09:04:51 | 000,001,154 | —- | M] () – C:\Users\Public\Desktop\Shop for Supplies - HP Officejet Pro 8600.lnk
[2012/08/06 09:03:09 | 000,000,057 | —- | M] () – C:\ProgramData\Ament.ini

========== Files Created - No Company Name ==========

[2012/09/03 14:59:32 | 000,232,960 | —- | C] () – C:\Windows\Installer\{3fc22eb8-6828-94c8-a4f9-b7155f238540}\U\00000008.@
[2012/09/03 14:59:29 | 000,016,896 | —- | C] () – C:\Windows\Installer\{3fc22eb8-6828-94c8-a4f9-b7155f238540}\U\80000000.@
[2012/09/03 14:59:29 | 000,001,632 | —- | C] () – C:\Windows\Installer\{3fc22eb8-6828-94c8-a4f9-b7155f238540}\U\000000cb.@
[2012/08/26 23:10:22 | 000,000,000 | —- | C] () – C:\Windows\SysNative\CN25NBR1SK05KD
[2012/08/13 16:38:17 | 000,000,348 | —- | C] () – C:\Windows\tasks\HPCeeScheduleForMike&Matt.job
[2012/08/08 13:55:48 | 000,090,624 | —- | C] () – C:\Windows\Installer\{3fc22eb8-6828-94c8-a4f9-b7155f238540}\U\80000032.@
[2012/08/08 13:55:45 | 000,002,048 | —- | C] () – C:\Windows\Installer\{3fc22eb8-6828-94c8-a4f9-b7155f238540}\U\00000004.@
[2012/08/08 13:55:45 | 000,000,804 | —- | C] () – C:\Windows\Installer\{3fc22eb8-6828-94c8-a4f9-b7155f238540}\L\00000004.@
[2012/08/08 13:55:43 | 000,077,824 | —- | C] () – C:\Windows\Installer\{3fc22eb8-6828-94c8-a4f9-b7155f238540}\U\80000064.@
[2012/08/06 09:04:51 | 000,002,166 | —- | C] () – C:\Users\Public\Desktop\HP Officejet Pro 8600.lnk
[2012/08/06 09:04:51 | 000,001,860 | —- | C] () – C:\Users\Public\Desktop\HP ePrintCenter - HP Officejet Pro 8600.lnk
[2012/08/06 09:04:51 | 000,001,154 | —- | C] () – C:\Users\Public\Desktop\Shop for Supplies - HP Officejet Pro 8600.lnk
[2012/08/06 09:03:09 | 000,000,057 | —- | C] () – C:\ProgramData\Ament.ini
[2012/07/10 17:46:42 | 000,232,960 | —- | C] () – C:\Users\Zeke\AppData\Local\{3fc22eb8-6828-94c8-a4f9-b7155f238540}\U\00000008.@
[2012/07/10 17:46:35 | 000,080,896 | —- | C] () – C:\Users\Zeke\AppData\Local\{3fc22eb8-6828-94c8-a4f9-b7155f238540}\U\80000064.@
[2012/07/10 17:46:35 | 000,000,804 | —- | C] () – C:\Users\Zeke\AppData\Local\{3fc22eb8-6828-94c8-a4f9-b7155f238540}\L\00000004.@
[2012/07/10 17:46:34 | 000,002,048 | —- | C] () – C:\Users\Zeke\AppData\Local\{3fc22eb8-6828-94c8-a4f9-b7155f238540}\U\00000004.@
[2012/07/10 17:46:33 | 000,095,744 | —- | C] () – C:\Users\Zeke\AppData\Local\{3fc22eb8-6828-94c8-a4f9-b7155f238540}\U\80000032.@
[2012/07/10 17:46:32 | 000,016,896 | —- | C] () – C:\Users\Zeke\AppData\Local\{3fc22eb8-6828-94c8-a4f9-b7155f238540}\U\80000000.@
[2012/07/10 17:46:13 | 000,001,632 | —- | C] () – C:\Users\Zeke\AppData\Local\{3fc22eb8-6828-94c8-a4f9-b7155f238540}\U\000000cb.@
[2012/03/24 20:21:31 | 000,000,469 | —- | C] () – C:\ProgramData\Microsoft.SqlServer.Compact.400.32.bc
[2012/01/11 06:58:39 | 000,002,048 | -HS- | C] () – C:\Windows\Installer\{3fc22eb8-6828-94c8-a4f9-b7155f238540}\@
[2012/01/11 06:58:39 | 000,002,048 | -HS- | C] () – C:\Users\Zeke\AppData\Local\{3fc22eb8-6828-94c8-a4f9-b7155f238540}\@
[2012/01/03 23:00:21 | 000,005,474 | —- | C] () – C:\Windows\hpomdl21.dat.temp
[2012/01/03 18:00:09 | 000,210,722 | —- | C] () – C:\Windows\hpoins21.dat
[2012/01/03 18:00:08 | 000,005,474 | —- | C] () – C:\Windows\hpomdl21.dat
[2011/12/19 12:04:44 | 000,000,632 | RHS- | C] () – C:\Users\Jack\ntuser.pol
[2011/10/05 17:30:50 | 000,002,792 | —- | C] () – C:\Program Files\HP SimplePass 2011
[2011/10/05 17:09:35 | 000,960,940 | —- | C] () – C:\Windows\SysWow64\igkrng600.bin
[2011/10/05 17:09:34 | 000,213,332 | —- | C] () – C:\Windows\SysWow64\igfcg600m.bin
[2011/10/05 17:09:33 | 000,145,804 | —- | C] () – C:\Windows\SysWow64\igcompkrng600.bin
[2011/06/21 03:07:00 | 000,007,736 | —- | C] () – C:\Windows\hpDSTRES.DLL
[2011/02/11 13:15:43 | 000,772,558 | —- | C] () – C:\Windows\SysWow64\PerfStringBackup.INI

========== LOP Check ==========

[2011/12/19 12:05:17 | 000,000,000 | —D | M] – C:\Users\Jack\AppData\Roaming\AVG2012
[2009/07/14 01:08:49 | 000,015,920 | —- | M] () – C:\Windows\Tasks\SCHEDLGU.TXT

========== Purity Check ==========



========== Custom Scans ==========

< %SYSTEMDRIVE%\*.* >
[2011/02/11 13:00:42 | 000,008,192 | RHS- | M] () – C:\BOOTSECT.BAK
[2012/09/03 14:59:05 | 463,351,807 | -HS- | M] () – C:\hiberfil.sys
[2011/10/05 16:52:19 | 000,000,000 | RHS- | M] () – C:\OS
[2012/09/03 14:59:05 | 2049,458,175 | -HS- | M] () – C:\pagefile.sys

< %systemroot%\Fonts\*.com >
[2009/07/14 01:32:31 | 000,026,040 | —- | M] () – C:\Windows\Fonts\GlobalMonospace.CompositeFont
[2009/07/14 01:32:31 | 000,026,489 | —- | M] () – C:\Windows\Fonts\GlobalSansSerif.CompositeFont
[2009/07/14 01:32:31 | 000,029,779 | —- | M] () – C:\Windows\Fonts\GlobalSerif.CompositeFont
[2009/07/14 01:32:31 | 000,043,318 | —- | M] () – C:\Windows\Fonts\GlobalUserInterface.CompositeFont

< %systemroot%\Fonts\*.dll >

< %systemroot%\Fonts\*.ini >
[2009/06/10 16:49:50 | 000,000,065 | —- | M] () – C:\Windows\Fonts\desktop.ini

< %systemroot%\Fonts\*.ini2 >

< %systemroot%\Fonts\*.exe >

< %systemroot%\system32\spool\prtprocs\w32x86\*.* >

< %systemroot%\REPAIR\*.bak1 >

< %systemroot%\REPAIR\*.ini >

< %systemroot%\system32\*.jpg >

< %systemroot%\*.jpg >

< %systemroot%\*.png >

< %systemroot%\*.scr >
[2012/03/08 18:37:20 | 000,302,448 | —- | M] (Microsoft Corporation) – C:\Windows\WLXPGSS.SCR

< %systemroot%\*._sy >

< %APPDATA%\Adobe\Update\*.* >

< %ALLUSERSPROFILE%\Favorites\*.* >

< %APPDATA%\Microsoft\*.* >

< %PROGRAMFILES%\*.* >
[2009/07/14 00:54:24 | 000,000,174 | -HS- | M] () – C:\Program Files (x86)\desktop.ini

< %APPDATA%\Update\*.* >

< %systemroot%\*. /mp /s >

< %systemroot%\System32\config\*.sav >

< %PROGRAMFILES%\bak. /s >

< %systemroot%\system32\bak. /s >

< %ALLUSERSPROFILE%\Start Menu\*.lnk /x >

< %systemroot%\system32\config\systemprofile\*.dat /x >

< %systemroot%\*.config >

< %systemroot%\system32\*.db >

< %PROGRAMFILES%\Internet Explorer\*.dat >

< %APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x >
[2009/07/14 00:49:38 | 000,000,146 | -HS- | M] () – C:\Users\Jack\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini

< %USERPROFILE%\Desktop\*.exe >

< %PROGRAMFILES%\Common Files\*.* >

< %systemroot%\*.src >

< %systemroot%\install\*.* >

< %systemroot%\system32\DLL\*.* >

< %systemroot%\system32\HelpFiles\*.* >

< %systemroot%\system32\rundll\*.* >

< %systemroot%\winn32\*.* >

< %systemroot%\Java\*.* >

< %systemroot%\system32\test\*.* >

< %systemroot%\system32\Rundll32\*.* >

< %systemroot%\AppPatch\Custom\*.* >

< HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >

< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs >

========== Alternate Data Streams ==========

@Alternate Data Stream - 133 bytes -> C:\ProgramData\Temp:0B4227B4

< End of report >

OTL Extras logfile created on: 9/3/2012 6:10:39 PM - Run 1
OTL by OldTimer - Version 3.2.60.0 Folder = C:\Users\Jack\Downloads
64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

5.91 Gb Total Physical Memory | 3.97 Gb Available Physical Memory | 67.17% Memory free
11.82 Gb Paging File | 9.87 Gb Available in Paging File | 83.52% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 919.58 Gb Total Space | 864.22 Gb Free Space | 93.98% Space Free | Partition Type: NTFS
Drive D: | 11.83 Gb Total Space | 1.45 Gb Free Space | 12.25% Space Free | Partition Type: NTFS
Drive E: | 338.06 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS

Computer Name: ZEKE-HP | User Name: Jack | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========


========== File Associations ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]
.url[@ = InternetShortcut] – C:\Windows\SysNative\rundll32.exe (Microsoft Corporation)

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]
.cpl [@ = cplfile] – C:\Windows\SysWow64\control.exe (Microsoft Corporation)

[HKEY_CURRENT_USER\SOFTWARE\Classes\]
.html [@ = FirefoxHTML] – C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation)

========== Shell Spawning ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\shell\[command]\command]
batfile [open] – "%1" %*
cmdfile [open] – "%1" %*
comfile [open] – "%1" %*
exefile [open] – "%1" %*
helpfile [open] – Reg Error: Key error.
inffile [install] – %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
InternetShortcut [open] – "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l (Microsoft Corporation)
InternetShortcut [print] – "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)
piffile [open] – "%1" %*
regfile [merge] – Reg Error: Key error.
scrfile [config] – "%1"
scrfile [install] – rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] – "%1" /S
txtfile – Reg Error: Key error.
Unknown [openas] – %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] – cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [MediaMonkey.1Play] – "C:\Program Files (x86)\MediaMonkey\MediaMonkey.exe" "%1" (Ventis Media Inc.)
Directory [MediaMonkey.2PlayNext] – "C:\Program Files (x86)\MediaMonkey\MediaMonkey.exe" /NEXT "%1" (Ventis Media Inc.)
Directory [MediaMonkey.3Enqueue] – "C:\Program Files (x86)\MediaMonkey\MediaMonkey.exe" /ADD "%1" (Ventis Media Inc.)
Folder [open] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] – Reg Error: Value error.
Drive [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\shell\[command]\command]
batfile [open] – "%1" %*
cmdfile [open] – "%1" %*
comfile [open] – "%1" %*
cplfile [cplopen] – %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] – "%1" %*
helpfile [open] – Reg Error: Key error.
inffile [install] – %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] – "%1" %*
regfile [merge] – Reg Error: Key error.
scrfile [config] – "%1"
scrfile [install] – rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] – "%1" /S
txtfile – Reg Error: Key error.
Unknown [openas] – %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] – cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [MediaMonkey.1Play] – "C:\Program Files (x86)\MediaMonkey\MediaMonkey.exe" "%1" (Ventis Media Inc.)
Directory [MediaMonkey.2PlayNext] – "C:\Program Files (x86)\MediaMonkey\MediaMonkey.exe" /NEXT "%1" (Ventis Media Inc.)
Directory [MediaMonkey.3Enqueue] – "C:\Program Files (x86)\MediaMonkey\MediaMonkey.exe" /ADD "%1" (Ventis Media Inc.)
Folder [open] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] – Reg Error: Value error.
Drive [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 0

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = 28 4D B2 76 41 04 CA 01 [binary data]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]

========== Firewall Settings ==========

========== Authorized Applications List ==========


========== HKEY_LOCAL_MACHINE Uninstall List ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{027E5FAB-1476-4C59-AAB4-32EF28520399}" = Windows Live Language Selector
"{054EF02F-95D8-48F4-9EEB-2F9CE3072ED8}" = AuthenTec TrueAPI
"{05EFBF37-0E52-4579-875C-7EEF0DFB4FCB}" = Network64
"{071c9b48-7c32-4621-a0ac-3f809523288f}" = Microsoft Visual C++ 2005 Redistributable (x64)
"{1ACC8FFB-9D84-4C05-A4DE-D28A9BC91698}" = Windows Live ID Sign-in Assistant
"{2856A1C2-70C5-4EC3-AFF7-E5B51E5530A2}" = HP Client Services
"{2D5E3D2B-919F-407C-8757-E64827518BB6}" = HP Officejet Pro 8600 Basic Device Software
"{3C8159DD-1890-4625-A5B2-E3D8D78D4486}" = AVG 2012
"{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148
"{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161
"{656DEEDE-F6AC-47CA-A568-A1B4E34B5760}" = Windows Live Remote Service Resources
"{6BFAB6C1-6D46-46DB-A538-A269907C9F2F}" = Network64
"{6ce5bae9-d3ca-4b99-891a-1dc6c118a5fc}" = Microsoft Visual C++ 2005 Redistributable (x64)
"{8220EEFE-38CD-377E-8595-13398D740ACE}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17
"{847B0532-55E3-4AAF-8D7B-E3A1A7CD17E5}" = Windows Live Remote Client Resources
"{8E34682C-8118-31F1-BC4C-98CD9675E1C2}" = Microsoft .NET Framework 4 Extended
"{90120000-002A-0000-1000-0000000FF1CE}" = Microsoft Office Office 64-bit Components 2007
"{90120000-002A-0409-1000-0000000FF1CE}" = Microsoft Office Shared 64-bit MUI (English) 2007
"{90120000-0116-0409-1000-0000000FF1CE}" = Microsoft Office Shared 64-bit Setup Metadata MUI (English) 2007
"{95120000-00B9-0409-1000-0000000FF1CE}" = Microsoft Application Error Reporting
"{988329F4-A1A1-4D51-803C-EF2725A97627}" = HP Photosmart All-In-One Driver Software 13.0 Rel. 2
"{A108BD40-0A8C-4385-8874-74C4B6086CC3}" = AVG 2012
"{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}" = Microsoft Visual C++ 2005 Redistributable (x64)
"{BCA9334F-B6C9-4F65-9A73-AC5A329A4D04}" = PlayReady PC Runtime amd64
"{CC4D56B7-6F18-470B-8734-ABCD75BCF4F1}" = HP Auto
"{D79A02E9-6713-4335-9668-AAC7474C0C0E}" = HP Vision Hardware Diagnostics
"{DA54F80E-261C-41A2-A855-549A144F2F59}" = Windows Live MIME IFilter
"{DA5E371C-6333-3D8A-93A4-6FD5B20BCC6E}" = Microsoft Visual C++ 2010 x64 Redistributable - 10.0.30319
"{DF6D988A-EEA0-4277-AAB8-158E086E439B}" = Windows Live Remote Client
"{E02A6548-6FDE-40E2-8ED9-119D7D7E641F}" = Windows Live Remote Service
"{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}" = Microsoft .NET Framework 4 Client Profile
"{F792E5B0-11C4-4C68-8A63-FB5F52749180}" = HP Officejet Pro 8600 Product Improvement Study
"{FF21C3E6-97FD-474F-9518-8DCBE94C2854}" = 64 Bit HP CIO Components Installer
"AVG" = AVG 2012
"HP Imaging Device Functions" = HP Imaging Device Functions 13.0
"HP Photosmart Essential" = HP Photosmart Essential 3.5
"HP Smart Web Printing" = HP Smart Web Printing 4.51
"HP Solution Center & Imaging Support Tools" = HP Solution Center 13.0
"HPExtendedCapabilities" = HP Customer Participation Program 13.0
"HPOCR" = OCR Software by I.R.I.S. 13.0
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Extended" = Microsoft .NET Framework 4 Extended
"Shop for HP Supplies" = Shop for HP Supplies

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{00FF4EB6-6AAC-4E9D-A60A-8F388691BB27}" = HP SimplePass PE 2011
"{07FA4960-B038-49EB-891B-9F95930AA544}" = HP Customer Experience Enhancements
"{0B0F231F-CE6A-483D-AA23-77B364F75917}" = Windows Live Installer
"{0EDEB615-1A60-425E-8306-0E10519C7B55}" = RoxioNow Player
"{0EF5BEA9-B9D3-46d7-8958-FB69A0BAEACC}" = Status
"{0F367CA3-3B2F-43F9-A44A-25A8EE69E45D}" = Scan
"{120262A6-7A4B-4889-AE85-F5E5688D3683}" = HP MovieStore
"{16FC3056-90C0-4757-8A68-64D8DA846ADA}" = Remote Graphics Receiver
"{175F0111-2968-4935-8F70-33108C6A4DE3}" = MarketResearch
"{196BB40D-1578-3D01-B289-BEFC77A11A1E}" = Microsoft Visual C++ 2010 x86 Redistributable - 10.0.30319
"{19BA08F7-C728-469C-8A35-BFBD3633BE08}" = Windows Live Movie Maker
"{1a413f37-ed88-4fec-9666-5c48dc4b7bb7}" = YouTube Downloader 3.5
"{1E03DB52-D5CB-4338-A338-E526DD4D4DB1}" = Bing Bar
"{1EC71BFB-01A3-4239-B6AF-B1AE656B15C0}" = TrayApp
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{1F6AB0E7-8CDD-4B93-8A23-AA9EB2FEFCE4}" = Junk Mail filter update
"{200FEC62-3C34-4D60-9CE8-EC372E01C08F}" = Windows Live SOXE Definitions
"{20EFC9AA-BBC1-4DFD-81FF-99654F71CBF8}" = HPPhotoSmartDiscLabel_PrintOnDisc
"{26A24AE4-039D-4CA4-87B4-2F83217007FF}" = Java 7 Update 7
"{2902F983-B4C1-44BA-B85D-5C6D52E2C441}" = Windows Live Mesh ActiveX Control for Remote Connections
"{2A3FC24C-6EC0-4519-A52B-FDA4EA9B2D24}" = Windows Live Messenger
"{2EEA7AA4-C203-4b90-A34F-19FB7EF1C81C}" = BufferChm
"{2EFA4E4C-7B5F-48F7-A1C0-1AA882B7A9C3}" = HP Update
"{2FA94A64-C84E-49d1-97DD-7BF06C7BBFB2}.WildTangent Games App" = Update Installer for WildTangent Games App
"{2FF8C687-DB7D-4adc-A5DC-57983EC25046}" = DeviceDiscovery
"{3336F667-9049-4D46-98B6-4C743EEBC5B1}" = Windows Live Photo Gallery
"{34F4D9A4-42C2-4348-BEF4-E553C84549E7}" = Windows Live Photo Gallery
"{3C92B2E6-380D-4fef-B4DF-4A3B4B669771}" = Copy
"{40A66DF6-22D3-44B5-A7D3-83B118A2C0DC}" = Norton Online Backup
"{40BF1E83-20EB-11D8-97C5-0009C5020658}" = Power2Go
"{43CDF946-F5D9-4292-B006-BA0D92013021}" = WebReg
"{440B915A-0C85-45DB-92AE-75AE14704A64}" = Fax
"{44B2A0AB-412E-4F8C-B058-D1E8AECCDFF5}" = Recovery Manager
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4A70EF07-7F88-4434-BB61-D1DE8AE93DD4}" = SolutionCenter
"{4D090F70-6F08-4B60-9357-A1DFD4458F09}" = Microsoft Mathematics
"{4E7C28C7-D5DA-4E9F-A1CA-60490B54AE35}" = UnloadSupport
"{50316C0A-CC2A-460A-9EA5-F486E54AC17D}_is1" = AVG PC Tuneup
"{579684A4-DDD5-4CA3-9EA8-7BE7D9593DB4}" = Windows Live UX Platform Language Pack
"{63FF21C9-A810-464F-B60A-3111747B1A6D}" = GPBaseService2
"{65153EA5-8B6E-43B6-857B-C6E4FC25798A}" = Intel® Management Engine Components
"{681B698F-C997-42C3-B184-B489C6CA24C9}" = HPPhotoSmartDiscLabelContent1
"{682B3E4F-696A-42DE-A41C-4C07EA1678B4}" = Windows Live SOXE
"{685B0843-6C8D-4E42-B60D-2B86B45526E0}" = PS_AIO_02_Software_Min
"{6B2FFB21-AC88-45C3-9A7D-4BB3E744EC91}" = HPSSupply
"{6BBA26E9-AB03-4FE7-831A-3535584CA002}" = Toolbox
"{6C528316-05A0-4594-A949-94B792EC396C}" = TurboTax 2011 wpaiper
"{6F340107-F9AA-47C6-B54C-C3A19F11553F}" = Hewlett-Packard ACLM.NET v1.1.2.0
"{6F44AF95-3CDE-4513-AD3F-6D45F17BF324}" = HP Support Assistant
"{70B446D1-E03B-4ab0-9B3C-0832142C9AA8}.WildTangent Games App-hp" = WildTangent Games App (HP Games)
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{7F2A11F4-EAE8-4325-83EC-E3E99F85169E}" = HP Support Information
"{7FB00B6B-6843-97EC-EED6-78BD6D35370A}" = Zinio Reader 4
"{83C292B7-38A5-440B-A731-07070E81A64F}" = Windows Live PIMT Platform
"{846B5DED-DC8C-4E1A-B5B4-9F5B39A0CACE}" = HPDiagnosticAlert
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8C6D6116-B724-4810-8F2D-D047E6B7D68E}" = Mesh Runtime
"{8DD46C6A-0056-4FEC-B70A-28BB16A1F11F}" = MSVCRT
"{8FC4F1DD-F7FD-4766-804D-3C8FF1D309AF}" = 802.11n Wireless LAN Card
"{9008D736-35CA-40DB-A2BE-5F32D954E5AA}" = HP MovieStore
"{90120000-0015-0409-0000-0000000FF1CE}" = Microsoft Office Access MUI (English) 2007
"{90120000-0015-0409-0000-0000000FF1CE}_ENTERPRISE_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0016-0409-0000-0000000FF1CE}" = Microsoft Office Excel MUI (English) 2007
"{90120000-0016-0409-0000-0000000FF1CE}_ENTERPRISE_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0018-0409-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (English) 2007
"{90120000-0018-0409-0000-0000000FF1CE}_ENTERPRISE_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0019-0409-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (English) 2007
"{90120000-0019-0409-0000-0000000FF1CE}_ENTERPRISE_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-001A-0409-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (English) 2007
"{90120000-001A-0409-0000-0000000FF1CE}_ENTERPRISE_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-001B-0409-0000-0000000FF1CE}" = Microsoft Office Word MUI (English) 2007
"{90120000-001B-0409-0000-0000000FF1CE}_ENTERPRISE_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-0409-0000-0000000FF1CE}_ENTERPRISE_{1FF96026-A04A-4C3E-B50A-BB7022654D0F}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-040C-0000-0000000FF1CE}_ENTERPRISE_{71F055E8-E2C6-4214-BB3D-BFE03561B89E}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-0C0A-0000-0000000FF1CE}" = Microsoft Office Proof (Spanish) 2007
"{90120000-001F-0C0A-0000-0000000FF1CE}_ENTERPRISE_{2314F9A1-126F-45CC-8A5E-DFAF866F3FBC}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-002A-0000-1000-0000000FF1CE}_ENTERPRISE_{664655D8-B9BB-455D-8A58-7EAF7B0B2862}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-002A-0409-1000-0000000FF1CE}_ENTERPRISE_{98333358-268C-4164-B6D4-C96DF5153727}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-002C-0409-0000-0000000FF1CE}" = Microsoft Office Proofing (English) 2007
"{90120000-0030-0000-0000-0000000FF1CE}" = Microsoft Office Enterprise 2007
"{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0044-0409-0000-0000000FF1CE}" = Microsoft Office InfoPath MUI (English) 2007
"{90120000-0044-0409-0000-0000000FF1CE}_ENTERPRISE_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-006E-0409-0000-0000000FF1CE}" = Microsoft Office Shared MUI (English) 2007
"{90120000-006E-0409-0000-0000000FF1CE}_ENTERPRISE_{98333358-268C-4164-B6D4-C96DF5153727}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-00A1-0409-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (English) 2007
"{90120000-00A1-0409-0000-0000000FF1CE}_ENTERPRISE_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-00BA-0409-0000-0000000FF1CE}" = Microsoft Office Groove MUI (English) 2007
"{90120000-00BA-0409-0000-0000000FF1CE}_ENTERPRISE_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0114-0409-0000-0000000FF1CE}" = Microsoft Office Groove Setup Metadata MUI (English) 2007
"{90120000-0114-0409-0000-0000000FF1CE}_ENTERPRISE_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0115-0409-0000-0000000FF1CE}" = Microsoft Office Shared Setup Metadata MUI (English) 2007
"{90120000-0115-0409-0000-0000000FF1CE}_ENTERPRISE_{98333358-268C-4164-B6D4-C96DF5153727}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0116-0409-1000-0000000FF1CE}_ENTERPRISE_{98333358-268C-4164-B6D4-C96DF5153727}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0117-0409-0000-0000000FF1CE}" = Microsoft Office Access Setup Metadata MUI (English) 2007
"{90120000-0117-0409-0000-0000000FF1CE}_ENTERPRISE_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90140000-2005-0000-0000-0000000FF1CE}" = Microsoft Office File Validation Add-In
"{912CED74-88D3-4C5B-ACB0-132318649765}" = PressReader
"{92EA4134-10D1-418A-91E1-5A0453131A38}" = Windows Live Movie Maker
"{9368DDD5-CE7F-4BD7-A83A-F00FABE338EC}" = Blio
"{94F8D42D-BB31-4858-9705-7D756D8D9655}" = PS_AIO_02_Software
"{95140000-0070-0000-0000-0000000FF1CE}" = Microsoft Office 2010
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9B362566-EC1B-4700-BB9C-EC661BDE2175}" = DocProc
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{9D56775A-93F3-44A3-8092-840E3826DE30}" = Windows Live Mail
"{A0C91188-C88F-4E86-93E6-CD7C9A266649}" = Windows Live Mesh
"{A726AE06-AAA3-43D1-87E3-70F510314F04}" = Windows Live Writer
"{A9BDCA6B-3653-467B-AC83-94367DA3BFE3}" = Windows Live Photo Common
"{AAAFC670-569B-4A2F-82B4-42945E0DE3EF}" = Windows Live Writer
"{AAF454FC-82CA-4F29-AB31-6A109485E76E}" = Windows Live Writer
"{AE856388-AFAD-4753-81DF-D96B19D0A17C}" = HP Setup Manager
"{AFF7E080-1974-45BF-9310-10DE1A1F5ED0}" = Adobe AIR
"{B28635AB-1DF3-4F07-BFEA-975D911B549B}" = hpphotosmartdisclabelplugin
"{B6F5C6D8-C443-4B55-932F-AE11B5743FC4}" = HP Officejet Pro 8600 Help
"{B8AC1A89-FFD1-4F97-8051-E505A160F562}" = HP Odometer
"{BCC315E7-2E8F-4EFD-8A0B-F8F276FE73F2}" = YTD Toolbar v6.2
"{BD7204BA-DD64-499E-9B55-6A282CDF4FA4}" = Destinations
"{C01A86F5-56E7-101F-9BC9-E3F1025EB779}" = Intel® Identity Protection Technology 1.1.2.0
"{C43326F5-F135-4551-8270-7F7ABA0462E1}" = HPProductAssistant
"{C59C179C-668D-49A9-B6EA-0121CCFC1243}" = LabelPrint
"{C66824E4-CBB3-4851-BB3F-E8CFD6350923}" = Windows Live Mail
"{CA6BCA2F-EDEB-408F-850B-31404BE16A61}" = I.R.I.S. OCR
"{CAE4213F-F797-439D-BD9E-79B71D115BE3}" = HPPhotoGadget
"{CAF5B770-082F-40C4-853D-3973BB81BDAA}" = TurboTax 2011 WinPerTaxSupport
"{CCA5EAAD-92F4-4B7A-B5EE-14294C66AB61}" = PlayReady PC Runtime x86
"{CE95A79E-E4FC-4FFF-8A75-29F04B942FF2}" = Windows Live UX Platform
"{D0B44725-3666-492D-BEF6-587A14BD9BD9}" = MSVCRT_amd64
"{D35B72B6-F0E4-462B-BDEB-E08032B3B681}" = HP Setup
"{D436F577-1695-4D2F-8B44-AC76C99E0002}" = Windows Live Photo Common
"{D45240D3-B6B3-4FF9-B243-54ECE3E10066}" = Windows Live Communications Platform
"{D79113E7-274C-470B-BD46-01B10219DF6A}" = HPPhotosmartEssential
"{D86B0E2E-DF9A-441C-AF77-8D1A0FF00FA6}" = AIO_Scan
"{D9D8F2CF-FE2D-4644-9762-01F916FE90A9}" = HPPhotoSmartDiscLabel_PaperLabel
"{DB3147AB-4024-4773-8EC0-A1FE5B44933D}" = HP LinkUp
"{DC635845-46D3-404B-BCB1-FC4A91091AFA}" = SmartWebPrinting
"{DDC8BDEE-DCAC-404D-8257-3E8D4B782467}" = Windows Live Writer Resources
"{DECDCB7C-58CC-4865-91AF-627F9798FE48}" = Windows Live Mesh
"{E09C4DB7-630C-4F06-A631-8EA7239923AF}" = D3DX10
"{E3E71D07-CD27-46CB-8448-16D4FB29AA13}" = Microsoft WSE 3.0 Runtime
"{E463E171-4082-4744-A466-F7CBE8502789}" = TurboTax 2011 WinPerReleaseEngine
"{E5B21F11-6933-4E0B-A25C-7963E3C07D11}" = Windows Live Messenger
"{EE556A3E-EB37-4392-9637-BAA8EC2F47FA}" = TurboTax 2011 wrapper
"{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}" = Microsoft SQL Server 2005 Compact Edition [ENU]
"{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}" = Intel® Processor Graphics
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F8A9085D-4C7A-41a9-8A77-C8998A96C421}" = Intel® Control Center
"{FAD3D68B-2F9C-459B-AA79-C04B9090FD72}" = TurboTax 2011 WinPerFedFormset
"{FCDBEA60-79F0-4FAE-BBA8-55A26C609A49}" = Visual Studio 2008 x64 Redistributables
"{FE044230-9CA5-43F7-9B58-5AC5A28A1F33}" = Windows Live Essentials
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"Coupon Printer for Windows5.0.0.1" = Coupon Printer for Windows
"ENTERPRISE" = Microsoft Office Enterprise 2007
"FileStream pcPhotos" = FileStream pcPhotos
"InstallShield_{40BF1E83-20EB-11D8-97C5-0009C5020658}" = Power2Go
"InstallShield_{C59C179C-668D-49A9-B6EA-0121CCFC1243}" = LabelPrint
"Kobo" = Kobo
"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware version 1.62.0.1300
"McAfee Security Scan" = McAfee Security Scan Plus
"MediaMonkey_is1" = MediaMonkey 3.1
"Mozilla Firefox 14.0.1 (x86 en-US)" = Mozilla Firefox 14.0.1 (x86 en-US)
"MozillaMaintenanceService" = Mozilla Maintenance Service
"PDF Complete" = PDF Complete Special Edition
"Rhapsody" = Rhapsody
"SyncBack_is1" = SyncBack
"TurboTax 2011" = TurboTax 2011
"VIP Access SDK" = VIP Access SDK (1.0.1.4)
"WildTangent hp Master Uninstall" = HP Games
"WinLiveSuite" = Windows Live Essentials
"WTA-11f2f337-e62e-43e0-bc7c-eb0192c4569a" = Vacation Quest - The Hawaiian Islands
"WTA-230ebde5-e2aa-4d01-b228-bc100df002cd" = Agatha Christie - Peril at End House
"WTA-409df81a-8b37-4592-9784-ecff9b88d0ad" = Jewel Quest: The Sleepless Star - Collector's Edition
"WTA-470e2bee-2de1-49cc-97df-79f5367b22be" = Plants vs. Zombies - Game of the Year
"WTA-4c1d531a-5ebd-41a2-8d17-e42d767c132d" = Blackhawk Striker 2
"WTA-5391b64e-4d80-4643-8724-de572ecd1f0e" = Blasterball 3
"WTA-5b706047-8f48-476f-bfae-f14ffeef3cb8" = Mystery of Mortlake Mansion
"WTA-5ea8a6b2-b777-4b53-a433-30fe79752a9c" = Poker Superstars III
"WTA-713fb09c-19fa-4cd7-b645-90d851d740c3" = Virtual Villagers 5 - New Believers
"WTA-7da56451-7769-420e-a5f5-14aa98d1b33c" = Namco All-Stars: PAC-MAN
"WTA-89ccc4aa-f517-44f7-87ff-ccec15258491" = Cradle of Rome 2
"WTA-8fee4af8-0144-4b07-bf4d-c08cfb44f16c" = Bounce Symphony
"WTA-99424bb3-51d0-492b-98f1-e344eaeefe0c" = Mah Jong Medley
"WTA-9a27c006-5649-482d-9ffe-86c03dca17c9" = Polar Bowler
"WTA-9cd40b20-d5e0-420f-977d-89775d4d92da" = Chronicles of Albian
"WTA-a980a788-e984-4453-89d2-bbf795d53208" = Zuma Deluxe
"WTA-b1c0758c-d2ec-46f7-a2b9-8bb644f6d033" = Bejeweled 3
"WTA-b9a9abf7-22bf-467d-a636-f5583f54e488" = Penguins!
"WTA-ba6a9eb4-c681-483e-9e04-2a83bbd5e5c7" = Governor of Poker 2 Premium Edition
"WTA-c32e14ba-c8a5-4352-9519-6c51191cef73" = Cake Mania
"WTA-d59690d6-1fc2-4115-a044-1b22aa9409af" = Polar Golfer
"WTA-dd205137-13b0-4eb7-9700-e596ab85d579" = Chuzzle Deluxe
"WTA-ebb05533-3225-4d24-8924-e66d46cc67fa" = Farm Frenzy
"WTA-ec112294-be97-4ad5-858e-4f52c0536312" = FATE
"WTA-fbb644a1-a698-470c-8c30-6c0e9d20b049" = Slingo Supreme
"ZinioReader4" = Zinio Reader 4

========== Last 20 Event Log Errors ==========

[ Application Events ]
Error - 2/28/2012 8:01:35 AM | Computer Name = Zeke-HP | Source = Application Error | ID = 1000
Description = Faulting application name: svchost.exe_HomeGroupListener, version:
6.1.7600.16385, time stamp: 0x4a5bc3c1 Faulting module name: wmp.dll_unloaded, version:
0.0.0.0, time stamp: 0x4ce7ca81 Exception code: 0xc0000005 Fault offset: 0x000007fef27af3ea
Faulting
process id: 0x448 Faulting application start time: 0x01ccf1070085b0f3 Faulting application
path: C:\Windows\System32\svchost.exe Faulting module path: wmp.dll Report Id: f592b3bf-6203-11e1-ae02-386077829cb2

Error - 3/4/2012 8:23:38 PM | Computer Name = Zeke-HP | Source = Application Error | ID = 1000
Description = Faulting application name: Explorer.EXE, version: 6.1.7601.17567,
time stamp: 0x4d672ee4 Faulting module name: unknown, version: 0.0.0.0, time stamp:
0x00000000 Exception code: 0xc0000005 Fault offset: 0x00000000002d9090 Faulting process
id: 0x1d4c Faulting application start time: 0x01ccfa662ec40984 Faulting application
path: C:\Windows\Explorer.EXE Faulting module path: unknown Report Id: 73adf22d-6659-11e1-ae02-386077829cb2

Error - 3/4/2012 8:24:44 PM | Computer Name = Zeke-HP | Source = Application Error | ID = 1000
Description = Faulting application name: GameConsole-wt.exe, version: 4.0.15.18,
time stamp: 0x4f347e54 Faulting module name: unknown, version: 0.0.0.0, time stamp:
0x00000000 Exception code: 0xc0000005 Fault offset: 0x746f6e20 Faulting process id:
0x1048 Faulting application start time: 0x01ccfa664d7c9548 Faulting application path:
C:\Program Files (x86)\WildTangent Games\App\GameConsole-wt.exe Faulting module
path: unknown Report Id: 9b0c5518-6659-11e1-ae02-386077829cb2

Error - 3/24/2012 9:13:41 PM | Computer Name = Zeke-HP | Source = Application Hang | ID = 1002
Description = The program pdfvista.exe version 4.0.54.2001 stopped interacting with
Windows and was closed. To see if more information about the problem is available,
check the problem history in the Action Center control panel. Process ID: 120c Start
Time: 01cd0a1ef1807421 Termination Time: 12 Application Path: C:\Program Files (x86)\PDF
Complete\pdfvista.exe Report Id: bd5655aa-7617-11e1-9cfc-386077829cb2

Error - 3/27/2012 8:11:34 PM | Computer Name = Zeke-HP | Source = Application Error | ID = 1000
Description = Faulting application name: GameConsole-wt.exe, version: 4.0.15.18,
time stamp: 0x4f347e54 Faulting module name: ntdll.dll, version: 6.1.7601.17725,
time stamp: 0x4ec49b8f Exception code: 0xc0000005 Fault offset: 0x00038dc9 Faulting
process id: 0x23e0 Faulting application start time: 0x01cd0c7745d4224e Faulting application
path: C:\Program Files (x86)\WildTangent Games\App\GameConsole-wt.exe Faulting module
path: C:\Windows\SysWOW64\ntdll.dll Report Id: 93ab0160-786a-11e1-b04d-386077829cb2

Error - 4/29/2012 7:42:40 PM | Computer Name = Zeke-HP | Source = Application Error | ID = 1000
Description = Faulting application name: iexplore.exe, version: 9.0.8112.16421,
time stamp: 0x4d76255d Faulting module name: ntdll.dll, version: 6.1.7601.17725,
time stamp: 0x4ec49b8f Exception code: 0xc0000374 Fault offset: 0x000ce6c3 Faulting
process id: 0x20d0 Faulting application start time: 0x01cd2661b6c91b03 Faulting application
path: C:\Program Files (x86)\Internet Explorer\iexplore.exe Faulting module path:
C:\Windows\SysWOW64\ntdll.dll Report Id: 016c8875-9255-11e1-b83f-386077829cb2

Error - 5/6/2012 11:42:17 PM | Computer Name = Zeke-HP | Source = Application Error | ID = 1000
Description = Faulting application name: TrueSuiteService.exe, version: 5.3.0.194,
time stamp: 0x4df09290 Faulting module name: TrueSuiteService.exe, version: 5.3.0.194,
time stamp: 0x4df09290 Exception code: 0xc0000417 Fault offset: 0x0001280a Faulting
process id: 0x304 Faulting application start time: 0x01cd2c035c5cf571 Faulting application
path: C:\Program Files (x86)\HP SimplePass 2011\TrueSuiteService.exe Faulting module
path: C:\Program Files (x86)\HP SimplePass 2011\TrueSuiteService.exe Report Id:
a3fe5d39-97f6-11e1-8271-386077829cb2

Error - 5/14/2012 10:24:04 PM | Computer Name = Zeke-HP | Source = Application Error | ID = 1000
Description = Faulting application name: AVGTBInstall.exe, version: 11.0.0.9, time
stamp: 0x4f83f872 Faulting module name: AVGTBInstall.exe, version: 11.0.0.9, time
stamp: 0x4f83f872 Exception code: 0xc00000fd Fault offset: 0x000f01b7 Faulting process
id: 0x19a8 Faulting application start time: 0x01cd3241caa07d9b Faulting application
path: C:\Program Files (x86)\AVG\AVG2012\AVGTBInstall.exe Faulting module path:
C:\Program Files (x86)\AVG\AVG2012\AVGTBInstall.exe Report Id: 0a197159-9e35-11e1-a047-386077829cb2

Error - 6/29/2012 6:32:57 PM | Computer Name = Zeke-HP | Source = Application Error | ID = 1000
Description = Faulting application name: TrueSuiteService.exe, version: 5.3.0.194,
time stamp: 0x4df09290 Faulting module name: TrueSuiteService.exe, version: 5.3.0.194,
time stamp: 0x4df09290 Exception code: 0xc0000417 Fault offset: 0x0001280a Faulting
process id: 0x31c Faulting application start time: 0x01cd56471b64f555 Faulting application
path: C:\Program Files (x86)\HP SimplePass 2011\TrueSuiteService.exe Faulting module
path: C:\Program Files (x86)\HP SimplePass 2011\TrueSuiteService.exe Report Id:
5f6bc906-c23a-11e1-9d40-386077829cb2

Error - 7/7/2012 10:18:00 PM | Computer Name = Zeke-HP | Source = Application Error | ID = 1000
Description = Faulting application name: GameConsole-wt.exe, version: 4.0.16.40,
time stamp: 0x4f977452 Faulting module name: ntdll.dll, version: 6.1.7601.17725,
time stamp: 0x4ec49b8f Exception code: 0xc0000374 Fault offset: 0x000ce6c3 Faulting
process id: 0x18f8 Faulting application start time: 0x01cd5cafd6cf8cfc Faulting application
path: C:\Program Files (x86)\WildTangent Games\App\GameConsole-wt.exe Faulting module
path: C:\Windows\SysWOW64\ntdll.dll Report Id: 23251728-c8a3-11e1-8f97-386077829cb2

[ Hewlett-Packard Events ]
Error - 6/5/2012 4:14:58 PM | Computer Name = Zeke-HP | Source = HPSF.exe | ID = 2000
Description = HP Error ID: -2147467262HPSF.exe at HP.SupportAssistant.Common.CustomerExperience.HPSFReporting.SaveSessionInfo(Data
Row
dr, Boolean bOnlyDetected, HPSASession SFSession) Message: Unable to cast object
of type 'System.DBNull' to type 'System.String'. StackTrace: at HP.SupportAssistant.Common.CustomerExperience.HPSFReporting.SaveSessionInfo(Data
Row
dr, Boolean bOnlyDetected, HPSASession SFSession) Source: HP.SupportAssistant.Common

Name:
HPSF.exe Version: 06.00.01.01 Path: C:\Program Files (x86)\Hewlett-Packard\HP Support
Framework\HPSF.exe Format: en-US RAM: 6050 Ram Utilization: 30 TargetSite: Void SaveSessionInfo(System.Data.DataRow,
Boolean, HP.SupportAssistant.Common.CustomerExperience.HPSASession)

Error - 6/27/2012 10:27:00 AM | Computer Name = Zeke-HP | Source = HPSF.exe | ID = 4000
Description =

Error - 6/27/2012 11:59:01 AM | Computer Name = Zeke-HP | Source = HPSF.exe | ID = 4000
Description =

Error - 6/27/2012 4:04:43 PM | Computer Name = Zeke-HP | Source = HPSF.exe | ID = 4000
Description =

Error - 6/27/2012 9:14:37 PM | Computer Name = Zeke-HP | Source = HPSF.exe | ID = 4000
Description =

Error - 8/7/2012 4:24:16 PM | Computer Name = Zeke-HP | Source = HPSF.exe | ID = 2000
Description = HP Error ID: -2147467262 at HP.SupportAssistant.Common.CustomerExperience.HPSFReporting.SaveSessionInfo(Data
Row
dr, Boolean bOnlyDetected, HPSASession SFSession) Message: Unable to cast object
of type 'System.DBNull' to type 'System.String'. StackTrace: at HP.SupportAssistant.Common.CustomerExperience.HPSFReporting.SaveSessionInfo(Data
Row
dr, Boolean bOnlyDetected, HPSASession SFSession) Source: HP.SupportAssistant.Common

Name:
HPSF.exe Version: 06.00.01.01 Path: C:\Program Files (x86)\Hewlett-Packard\HP Support
Framework\HPSF.exe Format: en-US RAM: 6050 Ram Utilization: 30 TargetSite: Void SaveSessionInfo(System.Data.DataRow,
Boolean, HP.SupportAssistant.Common.CustomerExperience.HPSASession)

Error - 8/7/2012 4:24:17 PM | Computer Name = Zeke-HP | Source = HPSF.exe | ID = 2000
Description = HP Error ID: -2147467262HPSF.exe at HP.SupportAssistant.Common.CustomerExperience.HPSFReporting.SaveSessionInfo(Data
Row
dr, Boolean bOnlyDetected, HPSASession SFSession) Message: Unable to cast object
of type 'System.DBNull' to type 'System.String'. StackTrace: at HP.SupportAssistant.Common.CustomerExperience.HPSFReporting.SaveSessionInfo(Data
Row
dr, Boolean bOnlyDetected, HPSASession SFSession) Source: HP.SupportAssistant.Common

Name:
HPSF.exe Version: 06.00.01.01 Path: C:\Program Files (x86)\Hewlett-Packard\HP Support
Framework\HPSF.exe Format: en-US RAM: 6050 Ram Utilization: 30 TargetSite: Void SaveSessionInfo(System.Data.DataRow,
Boolean, HP.SupportAssistant.Common.CustomerExperience.HPSASession)

Error - 8/14/2012 4:02:58 PM | Computer Name = Zeke-HP | Source = HPSF.exe | ID = 2000
Description = HP Error ID: -2147467262 at HP.SupportAssistant.Common.CustomerExperience.HPSFReporting.SaveSessionInfo(Data
Row
dr, Boolean bOnlyDetected, HPSASession SFSession) Message: Unable to cast object
of type 'System.DBNull' to type 'System.String'. StackTrace: at HP.SupportAssistant.Common.CustomerExperience.HPSFReporting.SaveSessionInfo(Data
Row
dr, Boolean bOnlyDetected, HPSASession SFSession) Source: HP.SupportAssistant.Common

Name:
HPSF.exe Version: 06.00.01.01 Path: C:\Program Files (x86)\Hewlett-Packard\HP Support
Framework\HPSF.exe Format: en-US RAM: 6050 Ram Utilization: 20 TargetSite: Void SaveSessionInfo(System.Data.DataRow,
Boolean, HP.SupportAssistant.Common.CustomerExperience.HPSASession)

Error - 8/14/2012 4:02:58 PM | Computer Name = Zeke-HP | Source = HPSF.exe | ID = 2000
Description = HP Error ID: -2147467262HPSF.exe at HP.SupportAssistant.Common.CustomerExperience.HPSFReporting.SaveSessionInfo(Data
Row
dr, Boolean bOnlyDetected, HPSASession SFSession) Message: Unable to cast object
of type 'System.DBNull' to type 'System.String'. StackTrace: at HP.SupportAssistant.Common.CustomerExperience.HPSFReporting.SaveSessionInfo(Data
Row
dr, Boolean bOnlyDetected, HPSASession SFSession) Source: HP.SupportAssistant.Common

Name:
HPSF.exe Version: 06.00.01.01 Path: C:\Program Files (x86)\Hewlett-Packard\HP Support
Framework\HPSF.exe Format: en-US RAM: 6050 Ram Utilization: 20 TargetSite: Void SaveSessionInfo(System.Data.DataRow,
Boolean, HP.SupportAssistant.Common.CustomerExperience.HPSASession)

Error - 8/21/2012 4:08:52 PM | Computer Name = Zeke-HP | Source = HPSF.exe | ID = 2000
Description = HP Error ID: -2147467262 at HP.SupportAssistant.Common.CustomerExperience.HPSFReporting.SaveSessionInfo(Data
Row
dr, Boolean bOnlyDetected, HPSASession SFSession) Message: Unable to cast object
of type 'System.DBNull' to type 'System.String'. StackTrace: at HP.SupportAssistant.Common.CustomerExperience.HPSFReporting.SaveSessionInfo(Data
Row
dr, Boolean bOnlyDetected, HPSASession SFSession) Source: HP.SupportAssistant.Common

Name:
HPSF.exe Version: 06.00.01.01 Path: C:\Program Files (x86)\Hewlett-Packard\HP Support
Framework\HPSF.exe Format: en-US RAM: 6050 Ram Utilization: 40 TargetSite: Void SaveSessionInfo(System.Data.DataRow,
Boolean, HP.SupportAssistant.Common.CustomerExperience.HPSASession)

[ System Events ]
Error - 8/28/2012 11:38:36 PM | Computer Name = Zeke-HP | Source = Service Control Manager | ID = 7001
Description = The HomeGroup Provider service depends on the Function Discovery Resource
Publication service which failed to start because of the following error: %%-2147024891

Error - 8/28/2012 11:46:37 PM | Computer Name = Zeke-HP | Source = Service Control Manager | ID = 7023
Description = The Computer Browser service terminated with the following error:
%%1060

Error - 8/28/2012 11:46:38 PM | Computer Name = Zeke-HP | Source = Service Control Manager | ID = 7023
Description = The Function Discovery Resource Publication service terminated with
the following error: %%-2147024891

Error - 8/28/2012 11:46:39 PM | Computer Name = Zeke-HP | Source = Service Control Manager | ID = 7003
Description = The IKE and AuthIP IPsec Keying Modules service depends the following
service: BFE. This service might not be installed.

Error - 8/28/2012 11:46:40 PM | Computer Name = Zeke-HP | Source = Service Control Manager | ID = 7003
Description = The IPsec Policy Agent service depends the following service: BFE.
This service might not be installed.

Error - 8/28/2012 11:47:48 PM | Computer Name = Zeke-HP | Source = DCOM | ID = 10016
Description =

Error - 8/28/2012 11:50:07 PM | Computer Name = Zeke-HP | Source = Service Control Manager | ID = 7023
Description = The Function Discovery Resource Publication service terminated with
the following error: %%-2147024891

Error - 8/28/2012 11:50:07 PM | Computer Name = Zeke-HP | Source = Service Control Manager | ID = 7001
Description = The HomeGroup Provider service depends on the Function Discovery Resource
Publication service which failed to start because of the following error: %%-2147024891

Error - 8/29/2012 10:41:51 AM | Computer Name = Zeke-HP | Source = Service Control Manager | ID = 7001
Description = The HomeGroup Provider service depends on the Function Discovery Resource
Publication service which failed to start because of the following error: %%-2147024891

Error - 8/29/2012 10:41:51 AM | Computer Name = Zeke-HP | Source = Service Control Manager | ID = 7023
Description = The Function Discovery Resource Publication service terminated with
the following error: %%-2147024891


< End of report >

Hi and Welcome!! My name is Jeff. I would be more than happy to take a look at your malware results logs and help you with solving any malware problems you might have. Logs can take a while to research, so please be patient and know that I am working hard to get you a clean and functional system back in your hands. I'd be grateful if you would note the following:

• I will be working on your Malware issues, this may or may not, solve other issues you have with your machine.
  
• The fixes are specific to your problem and should only be used for the issues on this machine.
  
• Please continue to review my answers until I tell you your machine appears to be clear. Absence of symptoms does not mean that everything is clear.
  
• It's often worth reading through these instructions and printing them for ease of reference.
  
• If you don't know or understand something, please don't hesitate to say or ask!! It's better to be sure and safe than sorry.
  
• Please reply to this thread. Do not start a new topic.

IMPORTANT NOTE : Please do not delete anything unless instructed to.
DO NOT use any TOOLS such as Combofix or HijackThis fixes without supervision.
Doing so could make your system inoperable and could require a full reinstall of your OS losing all your programs and data.

Vista and Windows 7 users:
These tools MUST be run from the executable (.exe) every time you run them
with Admin Rights (Right click, choose "Run as Administrator")

Stay with this topic until I give you the all clean post.
———

**WARNING**Unfortunately one or more of the infections I have identified are Backdoor Trojans, IRCBots or other Malware capable of stealing very important information. You need to stop using all Internet Banking sites, change passwords to all sites with sensitive information from a clean computer and phone your bank to inform them that you may be a victim of identify theft. More often than not, we advise users that a full reinstallation of their Operating System is the only way to ensure that their computer will ever be 100% clean again.

Unfortunately I have found what is known as the ZeroAccess rootkit on your system. It is an especially nasty infection that can take quite some time to clean as well as may have damaged your system files itself. As a warning, during the cleaning (if you choose to do so) you may lose internet access with this computer and in the end we may need to reinstall the operating system anyway depending on the extent of the infection.

If you would like to format and reinstall your Operating System please let me know and we can assist you with that.

If you would like to continue with the cleaning, please continue with the following instructions and I will be more than happy to help.
———-

Please download TDSSKiller.zip

• Extract it to your desktop
• Double click TDSSKiller.exe
• click OK
• Press Start Scan
• If Malicious objects are found, select Skip by changing the Cure dropdown in the upper right.
• Do Not Attempt To Fix Anything Now. We just need to look over the report and be sure we are removing the correct
  items.
• Attach the log in your next reply
  
• A copy of the log will be saved automatically to the root of the drive (typically C:\)

———-

Regarding the network storage, downloaded programs are also backed up there.

On the computer…

• Temporarily disabled AVG. Ran Combofix but it shut off and produced no log.
• Ran Combofix again,got hung up in first window, still no log.
• Restarted in Safe Mode with Networking and tried to run Combofix and got an error message, "Error launching installer".
• Restarted Windows normally, while it was "preparing desktop" got a dialog box titled "Location is not available" with the message "C:\\Windows\system32\config\systemprofile\Desktop is not accessible. Access is denied." Also a pop-up bubble in the lower-right which says "Failed to connect to a windows service. Windows could not connect to the System Event Notification Service service. This problem prevents standard users from logging on to the system. As an administrative user, you can review the System Event Log for details about why the service didn't respond" All that shows on the desktop is the recycle bin. Forgot to disable AVG, browsed to Desktop, ran Combofix, got hung up, computer shut down and restarted itself.
• Opened with a "Warning!!" message that Combofix detected AVG running. Tried to open AVG interface to disable, got an error message "Illegal operation attempted on a registry key that has been marked for deletion.", Ctrl+Alt+Del restart
• Temporarily disabled AVG. Ran Combofix, got to command window, got to deleting folders and restarted itself. Opened to Combofix preparing a log report.

ComboFix 12-09-04.02 - Jack 09/04/2012 21:45:40.1.4 - x64
Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.6051.4732 [GMT -4:00]
Running from: c:\users\[removed]\Desktop\ComboFix.exe
AV: AVG Anti-Virus Free Edition 2012 *Disabled/Updated* {5A2746B1-DEE9-F85A-FBCD-ADB11639C5F0}
SP: AVG Anti-Virus Free Edition 2012 *Disabled/Updated* {E146A755-F8D3-F7D4-C17D-96C36DBE8F4D}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\program files (x86)\CouponAlert_2p
c:\users\Zeke\AppData\Roaming\Roaming
c:\windows\assembly\GAC_32\Desktop.ini
c:\windows\assembly\GAC_64\Desktop.ini
c:\windows\Installer\{3fc22eb8-6828-94c8-a4f9-b7155f238540}\@
c:\windows\Installer\{3fc22eb8-6828-94c8-a4f9-b7155f238540}\L\00000004.@
c:\windows\Installer\{3fc22eb8-6828-94c8-a4f9-b7155f238540}\L\201d3dde
c:\windows\Installer\{3fc22eb8-6828-94c8-a4f9-b7155f238540}\U\00000004.@
c:\windows\Installer\{3fc22eb8-6828-94c8-a4f9-b7155f238540}\U\00000008.@
c:\windows\Installer\{3fc22eb8-6828-94c8-a4f9-b7155f238540}\U\000000cb.@
c:\windows\Installer\{3fc22eb8-6828-94c8-a4f9-b7155f238540}\U\80000000.@
c:\windows\Installer\{3fc22eb8-6828-94c8-a4f9-b7155f238540}\U\80000032.@
c:\windows\Installer\{3fc22eb8-6828-94c8-a4f9-b7155f238540}\U\80000064.@
.
Infected copy of c:\windows\system32\services.exe was found and disinfected
Restored copy from - c:\windows\winsxs\amd64_microsoft-windows-s..s-servicecontroller_31bf3856ad364e35_6.1.7600.16385_none_2b54b20ee6fa07b1\services.exe
.
.
((((((((((((((((((((((((( Files Created from 2012-08-05 to 2012-09-05 )))))))))))))))))))))))))))))))
.
.
2012-09-04 20:35 . 2012-09-04 20:35 ——– d—–w- c:\users\Jack\AppData\Roaming\Hewlett-Packard
2012-09-04 20:34 . 2012-09-04 20:34 ——– d—–w- c:\users\Jack\AppData\Roaming\HpUpdate
2012-09-04 20:34 . 2012-09-04 20:34 ——– d—–w- c:\users\Jack\AppData\Local\Hewlett-Packard
2012-09-03 18:40 . 2012-09-03 18:40 ——– d—–w- c:\users\Jack\AppData\Roaming\Malwarebytes
2012-09-03 18:40 . 2010-03-30 04:46 38224 —-a-w- c:\windows\SysWow64\drivers\mbamswissarmy.sys
2012-09-03 18:40 . 2012-09-03 18:41 ——– d—–w- c:\program files (x86)\Malwarebytes' Anti-Malware
2012-09-03 18:40 . 2012-09-03 18:40 ——– d—–w- c:\programdata\Malwarebytes
2012-09-03 18:40 . 2012-07-03 17:46 24904 —-a-w- c:\windows\system32\drivers\mbam.sys
2012-09-03 18:38 . 2012-09-03 18:38 ——– d—–w- c:\users\Jack\AppData\Local\HP
2012-09-03 14:07 . 2012-09-03 14:07 ——– d—–w- c:\users\Mike&Matt;\AppData\Local\Diagnostics
2012-09-03 01:21 . 2012-09-03 01:35 ——– d—–w- c:\users\Mike&Matt;\AppData\Local\Microsoft Games
2012-09-03 01:20 . 2012-09-03 01:20 ——– d—–w- c:\users\Mike&Matt;\AppData\Roaming\WildTangent
2012-09-02 00:09 . 2012-09-02 00:09 ——– d—–w- c:\users\Jack\AppData\Local\AuthenTec
2012-08-31 23:17 . 2012-08-31 23:17 ——– d—–w- c:\program files (x86)\Common Files\Java
2012-08-31 23:17 . 2012-08-31 23:16 821736 —-a-w- c:\windows\SysWow64\npDeployJava1.dll
2012-08-31 23:17 . 2012-08-31 23:16 95208 —-a-w- c:\windows\SysWow64\WindowsAccessBridge-32.dll
2012-08-15 20:09 . 2012-08-15 20:09 ——– d—–w- c:\program files (x86)\Coupons
2012-08-14 18:09 . 2012-08-14 18:23 ——– d—–w- c:\users\Zeke\AppData\Local\Roblox
2012-08-13 20:38 . 2012-08-13 20:38 ——– d–h–w- c:\users\Mike&Matt;\AppData\Roaming\Hewlett-Packard
2012-08-13 20:38 . 2012-08-13 20:38 ——– d–h–w- c:\users\Mike&Matt;\AppData\Local\Hewlett-Packard
2012-08-08 18:01 . 2012-08-08 18:01 ——– d-sh–w- c:\windows\SysWow64\%APPDATA%
2012-08-06 13:04 . 2011-09-09 20:22 778088 ——w- c:\windows\system32\HPDiscoPM5912.dll
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-09-03 20:40 . 2012-04-11 20:13 696520 —-a-w- c:\windows\SysWow64\FlashPlayerApp.exe
2012-09-03 20:40 . 2011-10-05 21:25 73416 —-a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2012-08-31 23:16 . 2011-12-19 09:31 746984 —-a-w- c:\windows\SysWow64\deployJava1.dll
2012-07-18 02:34 . 2012-07-18 02:35 19736 —-a-w- c:\programdata\Microsoft\IdentityCRL\production\ppcrlconfig600.dll
2012-07-11 07:01 . 2012-01-02 19:20 59701280 —-a-w- c:\windows\system32\MRT.exe
2012-06-12 03:08 . 2012-07-11 07:03 3148800 —-a-w- c:\windows\system32\win32k.sys
2012-06-09 05:43 . 2012-07-10 23:47 14172672 —-a-w- c:\windows\system32\shell32.dll
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"Norton Online Backup"="c:\program files (x86)\Symantec\Norton Online Backup\NOBuClient.exe" [2010-06-01 1155928]
"PDF Complete"="c:\program files (x86)\PDF Complete\pdfsty.exe" [2011-05-05 658424]
"GrooveMonitor"="c:\program files (x86)\Microsoft Office\Office12\GrooveMonitor.exe" [2009-02-26 30040]
"AVG_TRAY"="c:\program files (x86)\AVG\AVG2012\avgtray.exe" [2012-04-05 2587008]
"hpqSRMon"="c:\program files (x86)\HP\Digital Imaging\bin\hpqSRMon.exe" [2008-07-22 150528]
"HP Software Update"="c:\program files (x86)\HP\HP Software Update\HPWuSchd2.exe" [2011-05-10 49208]
"SearchSettings"="c:\program files (x86)\Common Files\Spigot\Search Settings\SearchSettings.exe" [2012-07-26 1095560]
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2012-07-03 252848]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
HP Digital Imaging Monitor.lnk - c:\program files (x86)\Hp\Digital Imaging\bin\hpqtra08.exe [2009-9-20 270336]
McAfee Security Scan Plus.lnk - c:\program files (x86)\McAfee Security Scan\2.0.189\SSScheduler.exe [2010-9-2 255536]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk *\0c:\progra~2\AVG\AVG2012\avgrsa.exe /sync /restart
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Security Packages REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp
.
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R2 HP Support Assistant Service;HP Support Assistant Service;c:\program files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe [2011-09-09 86072]
R3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-09-03 250568]
R3 BBSvc;Bing Bar Update Service;c:\program files (x86)\Microsoft\BingBar\BBSvc.EXE [2011-03-02 183560]
R3 GamesAppService;GamesAppService;c:\program files (x86)\WildTangent Games\App\GamesAppService.exe [2010-10-12 206072]
R3 Impcd;Impcd;c:\windows\system32\drivers\Impcd.sys [2010-02-27 158976]
R3 McComponentHostService;McAfee Security Scan Component Host Service;c:\program files (x86)\McAfee Security Scan\2.0.189\McCHSvc.exe [2010-09-02 227232]
R3 MozillaMaintenance;Mozilla Maintenance Service;c:\program files (x86)\Mozilla Maintenance Service\maintenanceservice.exe [2012-07-20 113120]
R3 pmxdrv;pmxdrv;c:\windows\system32\drivers\pmxdrv.sys [2011-10-05 31152]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-21 59392]
R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys [2010-11-21 31232]
R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [2011-12-10 1255736]
R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe [2010-09-23 57184]
S0 AVGIDSHA;AVGIDSHA;c:\windows\system32\DRIVERS\avgidsha.sys [2012-04-19 28480]
S0 Avgrkx64;AVG Anti-Rootkit Driver;c:\windows\system32\DRIVERS\avgrkx64.sys [2012-01-31 36944]
S1 Avgldx64;AVG AVI Loader Driver;c:\windows\system32\DRIVERS\avgldx64.sys [2012-02-22 289872]
S1 Avgmfx64;AVG Mini-Filter Resident Anti-Virus Shield;c:\windows\system32\DRIVERS\avgmfx64.sys [2011-12-23 47696]
S1 Avgtdia;AVG TDI Driver;c:\windows\system32\DRIVERS\avgtdia.sys [2012-03-19 383808]
S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [2009-07-14 59904]
S2 Application Updater;Application Updater;c:\program files (x86)\Application Updater\ApplicationUpdater.exe [2012-07-26 794560]
S2 AVGIDSAgent;AVGIDSAgent;c:\program files (x86)\AVG\AVG2012\AVGIDSAgent.exe [2012-07-04 5160568]
S2 avgwd;AVG WatchDog;c:\program files (x86)\AVG\AVG2012\avgwdsvc.exe [2012-02-14 193288]
S2 FPLService;TrueSuiteService;c:\program files (x86)\HP SimplePass 2011\TrueSuiteService.exe [2011-06-09 264008]
S2 HPAuto;HP Auto;c:\program files\Hewlett-Packard\HP Auto\HPAuto.exe [2011-02-17 682040]
S2 HPClientSvc;HP Client Services;c:\program files\Hewlett-Packard\HP Client Services\HPClientServices.exe [2010-10-11 346168]
S2 HPDrvMntSvc.exe;HP Quick Synchronization Service;c:\program files (x86)\Hewlett-Packard\Shared\HPDrvMntSvc.exe [2011-03-28 94264]
S2 IntuitUpdateServiceV4;Intuit Update Service v4;c:\program files (x86)\Common Files\Intuit\Update Service v4\IntuitUpdateService.exe [2012-02-06 13672]
S2 jhi_service;Intel® Identity Protection Technology Host Interface Service;c:\program files (x86)\Intel\Services\IPT\jhi_service.exe [2011-02-24 212944]
S2 NOBU;Norton Online Backup;c:\program files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe SERVICE [x]
S2 pdfcDispatcher;PDF Document Manager;c:\program files (x86)\PDF Complete\pdfsvc.exe [2011-05-05 1128952]
S2 RoxioNow Service;RoxioNow Service;c:\program files (x86)\Roxio\RoxioNow Player\RNowSvc.exe [2010-11-26 399344]
S2 UNS;Intel® Management and Security Application User Notification Service;c:\program files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe [2011-02-01 2656280]
S3 AVGIDSDriver;AVGIDSDriver;c:\windows\system32\DRIVERS\avgidsdrivera.sys [2011-12-23 124496]
S3 AVGIDSFilter;AVGIDSFilter;c:\windows\system32\DRIVERS\avgidsfiltera.sys [2011-12-23 29776]
S3 MEIx64;Intel® Management Engine Interface;c:\windows\system32\drivers\HECIx64.sys [2010-10-19 56344]
S3 netr28x;Ralink 802.11n Extensible Wireless Driver;c:\windows\system32\DRIVERS\netr28x.sys [2011-04-22 1360960]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [2011-04-22 471144]
S3 vwifimp;Microsoft Virtual WiFi Miniport Service;c:\windows\system32\DRIVERS\vwifimp.sys [2009-07-14 17920]
S3 WSDPrintDevice;WSD Print Support via UMB;c:\windows\system32\DRIVERS\WSDPrint.sys [2009-07-14 23040]
.
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\svchost]
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
.
Contents of the 'Scheduled Tasks' folder
.
2012-09-05 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-11 20:40]
.
2012-09-05 c:\windows\Tasks\HPCeeScheduleForJack.job
- c:\program files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe [2010-09-14 05:15]
.
2012-08-13 c:\windows\Tasks\HPCeeScheduleForMike&Matt.job;
- c:\program files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe [2010-09-14 05:15]
.
2012-08-30 c:\windows\Tasks\HPCeeScheduleForZEKE-HP$.job
- c:\program files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe [2010-09-14 05:15]
.
2012-09-03 c:\windows\Tasks\HPCeeScheduleForZeke.job
- c:\program files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe [2010-09-14 05:15]
.
.
——— X64 Entries ———–
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2011-04-25 168216]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2011-04-25 391960]
"Persistence"="c:\windows\system32\igfxpers.exe" [2011-04-25 418584]
"hpsysdrv"="c:\program files (x86)\hewlett-packard\HP odometer\hpsysdrv.exe" [2008-11-20 62768]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"LoadAppInit_DLLs"=0x0
.
——- Supplementary Scan ——-
.
uLocal Page = c:\windows\system32\blank.htm
mLocal Page = c:\windows\SysWOW64\blank.htm
IE: E&xport; to Microsoft Excel - c:\progra~2\MICROS~1\Office12\EXCEL.EXE/3000
Trusted Zone: intuit.com\ttlc
TCP: DhcpNameServer = 192.168.0.1
FF - ProfilePath - c:\users\Jack\AppData\Roaming\Mozilla\Firefox\Profiles\vgt1h20z.default\
FF - prefs.js: browser.search.selectedEngine - Yahoo
FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?fr=greentree_ff1&ei;=utf-8&ilc;=12&type;=937811&p;=
.
- - - - ORPHANS REMOVED - - - -
.
AddRemove-{6F44AF95-3CDE-4513-AD3F-6D45F17BF324} - c:\program files (x86)\InstallShield Installation Information\{6F44AF95-3CDE-4513-AD3F-6D45F17BF324}\setup.exe
.
.
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\pdfcDispatcher]
"ImagePath"="c:\program files (x86)\PDF Complete\pdfsvc.exe /startedbyscm:66B66708-40E2BE4D-pdfcService"
.
——————— LOCKED REGISTRY KEYS ———————
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_3_300_271_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_3_300_271_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_3_300_271.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.11"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_3_300_271.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_3_300_271.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_3_300_271.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
———————— Other Running Processes ————————
.
c:\program files (x86)\Microsoft\BingBar\SeaPort.EXE
c:\program files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe
.
**************************************************************************
.
Completion time: 2012-09-04 21:58:39 - machine was rebooted
ComboFix-quarantined-files.txt 2012-09-05 01:58
.
Pre-Run: 929,032,691,712 bytes free
Post-Run: 929,327,706,112 bytes free
.
- - End Of File - - 6759E1EC0580B0DE4F91E04FC8062565

ListParts by Farbar Version: 10-08-2012
Ran by [removed] (administrator) on 04-09-2012 at 22:01:19
Windows 7 (X64)
Running From: C:\Users\[removed]\Desktop
Language: 0409
************************************************************

========================= Memory info ======================

Percentage of memory in use: 26%
Total physical RAM: 6050.52 MB
Available physical RAM: 4420.55 MB
Total Pagefile: 12099.22 MB
Available Pagefile: 10505.57 MB
Total Virtual: 8192 MB
Available Virtual: 8191.89 MB

======================= Partitions =========================

1 Drive c: (OS) (Fixed) (Total:919.58 GB) (Free:865.59 GB) NTFS
2 Drive d: (HP_RECOVERY) (Fixed) (Total:11.83 GB) (Free:1.45 GB) NTFS ==>[System with boot components (obtained from reading drive)]
3 Drive e: (HP OJ8600) (CDROM) (Total:0.33 GB) (Free:0 GB) CDFS

Disk ### Status Size Free Dyn Gpt
——– ————- ——- ——- — —
Disk 0 Online 931 GB 0 B
Disk 1 No Media 0 B 0 B
Disk 2 No Media 0 B 0 B
Disk 3 No Media 0 B 0 B
Disk 4 No Media 0 B 0 B

Partitions of Disk 0:
===============

Partition ### Type Size Offset
————- —————- ——- ——-
Partition 1 Primary 100 MB 1024 KB
Partition 2 Primary 919 GB 101 MB
Partition 3 Primary 11 GB 919 GB

================================================================================
======================

Disk: 0
Partition 1
Type : 07
Hidden: No
Active: Yes

Volume ### Ltr Label Fs Type Size Status Info
———- — ———– —– ———- ——- ——— ——–
* Volume 1 SYSTEM NTFS Partition 100 MB Healthy System (partition with boot components)

================================================================================
======================

Disk: 0
Partition 2
Type : 07
Hidden: No
Active: No

Volume ### Ltr Label Fs Type Size Status Info
———- — ———– —– ———- ——- ——— ——–
* Volume 2 C OS NTFS Partition 919 GB Healthy Boot

================================================================================
======================

Disk: 0
Partition 3
Type : 07
Hidden: No
Active: No

Volume ### Ltr Label Fs Type Size Status Info
———- — ———– —– ———- ——- ——— ——–
* Volume 3 D HP_RECOVERY NTFS Partition 11 GB Healthy

================================================================================
======================

****** End Of Log ******

Scan result of Farbar Recovery Scan Tool (x64) Version: 04-09-2012 Ran by [removed] at 04-09-2012 22:25:57 Running from K:\ Windows 7 Home Premium Service Pack 1 (X64) OS Language: English(US) The current controlset is ControlSet001 ==================== Registry (Whitelisted) =================== HKLM\…\Run: [hpsysdrv] c:\program files (x86)\hewlett-packard\HP odometer\hpsysdrv.exe [62768 2008-11-20] (Hewlett-Packard) HKLM-x32\…\Run: [Norton Online Backup] C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuClient.exe [1155928 2010-06-01] (Symantec Corporation) HKLM-x32\…\Run: [PDF Complete] C:\Program Files (x86)\PDF Complete\pdfsty.exe [658424 2011-05-05] (PDF Complete Inc) HKLM-x32\…\Run: [GrooveMonitor] "C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe" [30040 2009-02-26] (Microsoft Corporation) HKLM-x32\…\Run: [AVG_TRAY] "C:\Program Files (x86)\AVG\AVG2012\avgtray.exe" [2587008 2012-04-05] (AVG Technologies CZ, s.r.o.) HKLM-x32\…\Run: [hpqSRMon] C:\Program Files (x86)\HP\Digital Imaging\bin\hpqSRMon.exe [150528 2008-07-22] (Hewlett-Packard) HKLM-x32\…\Run: [HP Software Update] C:\Program Files (x86)\HP\HP Software Update\HPWuSchd2.exe [49208 2011-05-09] (Hewlett-Packard) HKLM-x32\…\Run: [SearchSettings] "C:\Program Files (x86)\Common Files\Spigot\Search Settings\SearchSettings.exe" [1095560 2012-07-26] (Spigot, Inc.) HKLM-x32\…\Run: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe" [252848 2012-07-03] (Sun Microsystems, Inc.) HKU\Jack\…\Policies\system: [LogonHoursAction] 2 HKU\Jack\…\Policies\system: [DontDisplayLogonHoursWarnings] 1 HKU\Mike&Matt;\…\Policies\system: [LogonHoursAction] 2 HKU\Mike&Matt;\…\Policies\system: [DontDisplayLogonHoursWarnings] 1 HKU\Zeke\…\Run: [HP Officejet Pro 8600 (NET)] "C:\Program Files\hp\HP Officejet Pro 8600\Bin\ScanToPCActivationApp.exe" -deviceID "CN25NBR1SK05KD:NW" -scfn "HP Officejet Pro 8600 (NET)" -AutoStart 1 [2676584 2011-09-09] (Hewlett-Packard Co.) HKU\Zeke\…\Policies\system: [LogonHoursAction] 2 HKU\Zeke\…\Policies\system: [DontDisplayLogonHoursWarnings] 1 HKU\Zeke\…\Winlogon: [Shell] Tcpip\Parameters: [DhcpNameServer] 192.168.0.1 Startup: C:\Users\All Users\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk ShortcutTarget: HP Digital Imaging Monitor.lnk -> C:\Program Files (x86)\Hp\Digital Imaging\bin\hpqtra08.exe (Hewlett-Packard Co.) Startup: C:\Users\All Users\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk ShortcutTarget: McAfee Security Scan Plus.lnk -> C:\Program Files (x86)\McAfee Security Scan\2.0.189\SSScheduler.exe (McAfee, Inc.) Startup: C:\Users\Zeke\Start Menu\Programs\Startup\Monitor Ink Alerts - .lnk ShortcutTarget: Monitor Ink Alerts - .lnk -> C:\Windows\System32\RunDll32.exe (Microsoft Corporation) ==================== Services (Whitelisted) ====== 2 AVGIDSAgent; "C:\Program Files (x86)\AVG\AVG2012\AVGIDSAgent.exe" [5160568 2012-07-04] (AVG Technologies CZ, s.r.o.) 2 avgwd; "C:\Program Files (x86)\AVG\AVG2012\avgwdsvc.exe" [193288 2012-02-14] (AVG Technologies CZ, s.r.o.) 2 HPAuto; "C:\Program Files\Hewlett-Packard\HP Auto\HPAuto.exe" [682040 2011-02-16] (Hewlett-Packard) 3 McComponentHostService; "C:\Program Files (x86)\McAfee Security Scan\2.0.189\McCHSvc.exe" [227232 2010-09-02] (McAfee, Inc.) 2 NOBU; "C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe" SERVICE [2804568 2010-06-01] (Symantec Corporation) ==================== Drivers (Whitelisted) =================== 3 AVGIDSDriver; C:\Windows\System32\DRIVERS\avgidsdrivera.sys [124496 2011-12-23] (AVG Technologies CZ, s.r.o. ) 3 AVGIDSFilter; C:\Windows\System32\DRIVERS\avgidsfiltera.sys [29776 2011-12-23] (AVG Technologies CZ, s.r.o. ) 0 AVGIDSHA; C:\Windows\System32\Drivers\AVGIDSHA.sys [28480 2012-04-19] (AVG Technologies CZ, s.r.o. ) 1 Avgldx64; C:\Windows\System32\Drivers\Avgldx64.sys [289872 2012-02-22] (AVG Technologies CZ, s.r.o.) 1 Avgmfx64; C:\Windows\System32\Drivers\Avgmfx64.sys [47696 2011-12-23] (AVG Technologies CZ, s.r.o.) 0 Avgrkx64; C:\Windows\System32\Drivers\Avgrkx64.sys [36944 2012-01-31] (AVG Technologies CZ, s.r.o.) 1 Avgtdia; C:\Windows\System32\Drivers\Avgtdia.sys [383808 2012-03-19] (AVG Technologies CZ, s.r.o.) 3 pmxdrv; C:\Windows\System32\Drivers\pmxdrv.sys [31152 2011-10-05] () 3 catchme; \??\C:\ComboFix\catchme.sys [x] ==================== NetSvcs (Whitelisted) ================= ==================== One Month Created Files and Folders ====================== 2012-09-04 22:25 - 2012-09-04 22:25 - 00000000 ____D C:\FRST 2012-09-04 18:01 - 2012-09-04 18:01 - 00002922 ____A C:\Users\Jack\Desktop\Result.txt 2012-09-04 17:58 - 2012-09-04 17:58 - 00017755 ____A C:\ComboFix.txt 2012-09-04 17:42 - 2011-06-25 22:45 - 00256000 ____A C:\Windows\PEV.exe 2012-09-04 17:42 - 2010-11-07 09:20 - 00208896 ____A C:\Windows\MBR.exe 2012-09-04 17:42 - 2009-04-19 20:56 - 00060416 ____A (NirSoft) C:\Windows\NIRCMD.exe 2012-09-04 17:42 - 2000-08-30 16:00 - 00518144 ____A (SteelWerX) C:\Windows\SWREG.exe 2012-09-04 17:42 - 2000-08-30 16:00 - 00406528 ____A (SteelWerX) C:\Windows\SWSC.exe 2012-09-04 17:42 - 2000-08-30 16:00 - 00098816 ____A C:\Windows\sed.exe 2012-09-04 17:42 - 2000-08-30 16:00 - 00080412 ____A C:\Windows\grep.exe 2012-09-04 17:42 - 2000-08-30 16:00 - 00068096 ____A C:\Windows\zip.exe 2012-09-04 17:16 - 2012-09-04 17:58 - 00000000 ____D C:\Qoobox 2012-09-04 17:15 - 2012-09-04 17:57 - 00000000 ____D C:\Windows\erdnt 2012-09-04 17:13 - 2012-09-04 17:12 - 04744582 ____R (Swearware) C:\Users\Jack\Desktop\ComboFix.exe 2012-09-04 17:13 - 2012-09-04 17:12 - 00814913 ____A (Farbar) C:\Users\Jack\Desktop\ListParts64.exe 2012-09-04 12:36 - 2012-09-04 17:17 - 00000328 ____A C:\Windows\Tasks\HPCeeScheduleForJack.job 2012-09-04 12:35 - 2012-09-04 12:35 - 00000000 ____D C:\Users\Jack\AppData\Roaming\Hewlett-Packard 2012-09-04 12:34 - 2012-09-04 12:34 - 00000000 ____D C:\Users\Jack\AppData\Roaming\HpUpdate 2012-09-04 12:34 - 2012-09-04 12:34 - 00000000 ____D C:\Users\Jack\AppData\Local\Hewlett-Packard 2012-09-03 14:15 - 2012-09-03 14:15 - 00076220 ____A C:\Users\Jack\Downloads\Extras.Txt 2012-09-03 14:14 - 2012-09-03 14:14 - 00082672 ____A C:\Users\Jack\Downloads\OTL.Txt 2012-09-03 12:50 - 2012-09-03 12:50 - 00599040 ____A (OldTimer Tools) C:\Users\Jack\Downloads\OTL.exe 2012-09-03 12:40 - 2012-09-03 12:46 - 00000000 ____D C:\Users\All Users\Adobe 2012-09-03 10:41 - 2012-09-03 10:41 - 10652120 ____A (Malwarebytes Corporation ) C:\Users\Jack\Downloads\mbam-setup-1.62.0.1300.exe 2012-09-03 10:40 - 2012-09-03 10:41 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware 2012-09-03 10:40 - 2012-09-03 10:40 - 00000000 ____D C:\Users\Jack\AppData\Roaming\Malwarebytes 2012-09-03 10:40 - 2012-09-03 10:40 - 00000000 ____D C:\Users\All Users\Malwarebytes 2012-09-03 10:40 - 2012-07-03 09:46 - 00024904 ____A (Malwarebytes Corporation) C:\Windows\System32\Drivers\mbam.sys 2012-09-03 10:40 - 2010-03-29 20:46 - 00038224 ____A (Malwarebytes Corporation) C:\Windows\SysWOW64\Drivers\mbamswissarmy.sys 2012-09-03 10:38 - 2012-09-03 10:38 - 00000000 ____D C:\Users\Jack\AppData\Local\HP 2012-09-03 08:27 - 2012-09-03 08:27 - 00000000 ___AH C:\Users\Zeke\Documents\Default.rdp 2012-09-02 17:21 - 2012-09-02 17:35 - 00000000 ____D C:\Users\Mike&Matt;\AppData\Local\Microsoft Games 2012-09-02 17:20 - 2012-09-02 17:20 - 00000000 ____D C:\Users\Mike&Matt;\AppData\Roaming\WildTangent 2012-09-01 16:09 - 2012-09-01 16:09 - 00000000 ____D C:\Users\Jack\AppData\Local\AuthenTec 2012-08-31 15:17 - 2012-08-31 15:16 - 00821736 ____A (Oracle Corporation) C:\Windows\SysWOW64\npDeployJava1.dll 2012-08-31 15:17 - 2012-08-31 15:16 - 00246760 ____A (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe 2012-08-31 15:17 - 2012-08-31 15:16 - 00174056 ____A (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe 2012-08-31 15:17 - 2012-08-31 15:16 - 00174056 ____A (Oracle Corporation) C:\Windows\SysWOW64\java.exe 2012-08-31 15:17 - 2012-08-31 15:16 - 00095208 ____A (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll 2012-08-31 15:15 - 2012-08-31 15:15 - 00894952 ____A (Oracle Corporation) C:\Users\Jack\Downloads\jxpiinstall.exe 2012-08-29 10:58 - 2012-08-29 10:58 - 04755448 ____A C:\Users\Zeke\Downloads\HPPSdr.exe 2012-08-28 19:50 - 2012-08-28 19:50 - 00999840 ____A (Solid State Networks) C:\Users\Zeke\Downloads\install_flashplayer11x32_mssa_au_aih.exe 2012-08-26 19:10 - 2012-08-26 19:10 - 00000000 ___AT C:\Windows\System32\CN25NBR1SK05KD 2012-08-24 09:28 - 2012-09-03 18:34 - 02211928 ____A (Kaspersky Lab ZAO) C:\Users\Jack\Desktop\TDSSKiller.exe 2012-08-21 14:43 - 2012-08-21 14:44 - 06717808 ____A (Support.com ) C:\Users\Zeke\Downloads\ARO2012_tbt(1).exe 2012-08-21 14:43 - 2012-08-21 14:43 - 06717808 ____A (Support.com ) C:\Users\Zeke\Downloads\ARO2012_tbt.exe 2012-08-15 12:09 - 2012-08-15 12:09 - 00000000 ____D C:\Program Files (x86)\Coupons 2012-08-14 10:09 - 2012-08-20 08:04 - 00001350 ____A C:\Users\Zeke\Desktop\ROBLOX Player.lnk 2012-08-14 10:09 - 2012-08-14 10:23 - 00000000 ____D C:\Users\Zeke\AppData\Local\Roblox 2012-08-14 10:08 - 2012-08-14 10:08 - 00504248 ____A (Roblox Corporation) C:\Users\Zeke\Downloads\RobloxPlayerLauncher.exe 2012-08-13 12:38 - 2012-08-13 12:57 - 00000348 ____A C:\Windows\Tasks\HPCeeScheduleForMike&Matt.job; 2012-08-13 12:38 - 2012-08-13 12:38 - 00000000 ___HD C:\Users\Mike&Matt;\AppData\Roaming\Hewlett-Packard 2012-08-13 12:38 - 2012-08-13 12:38 - 00000000 ___HD C:\Users\Mike&Matt;\AppData\Local\Hewlett-Packard 2012-08-08 10:01 - 2012-08-08 10:01 - 00000000 __SHD C:\Windows\SysWOW64\%APPDATA% 2012-08-06 05:04 - 2012-08-06 05:04 - 00002166 ____A C:\Users\Public\Desktop\HP Officejet Pro 8600.lnk 2012-08-06 05:04 - 2012-08-06 05:04 - 00001860 ____A C:\Users\Public\Desktop\HP ePrintCenter - HP Officejet Pro 8600.lnk 2012-08-06 05:04 - 2012-08-06 05:04 - 00001154 ____A C:\Users\Public\Desktop\Shop for Supplies - HP Officejet Pro 8600.lnk 2012-08-06 05:04 - 2011-09-09 12:22 - 00778088 ____N (Hewlett-Packard Co.) C:\Windows\System32\HPDiscoPM5912.dll 2012-08-06 05:03 - 2012-08-06 05:03 - 00000057 ____A C:\Users\All Users\Ament.ini ==================== 3 Months Modified Files ================================ 2012-09-04 18:21 - 2011-12-05 10:51 - 02039457 ____A C:\Windows\WindowsUpdate.log 2012-09-04 18:20 - 2009-07-13 20:51 - 00046086 ____A C:\Windows\setupact.log 2012-09-04 18:01 - 2012-09-04 18:01 - 00002922 ____A C:\Users\Jack\Desktop\Result.txt 2012-09-04 18:01 - 2009-07-13 20:45 - 00024608 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 2012-09-04 18:01 - 2009-07-13 20:45 - 00024608 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 2012-09-04 17:59 - 2009-07-13 21:13 - 00778660 ____A C:\Windows\System32\PerfStringBackup.INI 2012-09-04 17:58 - 2012-09-04 17:58 - 00017755 ____A C:\ComboFix.txt 2012-09-04 17:53 - 2009-07-13 18:34 - 00000215 ____A C:\Windows\system.ini 2012-09-04 17:52 - 2010-11-20 19:47 - 00824526 ____A C:\Windows\PFRO.log 2012-09-04 17:52 - 2009-07-13 21:08 - 00000006 ___AH C:\Windows\Tasks\SA.DAT 2012-09-04 17:48 - 2012-04-11 12:13 - 00000830 ____A C:\Windows\Tasks\Adobe Flash Player Updater.job 2012-09-04 17:32 - 2009-07-13 21:08 - 00017904 ____A C:\Windows\Tasks\SCHEDLGU.TXT 2012-09-04 17:26 - 2011-12-19 08:04 - 00000632 _RASH C:\Users\Jack\ntuser.pol 2012-09-04 17:17 - 2012-09-04 12:36 - 00000328 ____A C:\Windows\Tasks\HPCeeScheduleForJack.job 2012-09-04 17:12 - 2012-09-04 17:13 - 04744582 ____R (Swearware) C:\Users\Jack\Desktop\ComboFix.exe 2012-09-04 17:12 - 2012-09-04 17:13 - 00814913 ____A (Farbar) C:\Users\Jack\Desktop\ListParts64.exe 2012-09-04 12:35 - 2011-12-09 19:16 - 00000052 ____A C:\Windows\SysWOW64\DOErrors.log 2012-09-03 18:34 - 2012-08-24 09:28 - 02211928 ____A (Kaspersky Lab ZAO) C:\Users\Jack\Desktop\TDSSKiller.exe 2012-09-03 14:15 - 2012-09-03 14:15 - 00076220 ____A C:\Users\Jack\Downloads\Extras.Txt 2012-09-03 14:14 - 2012-09-03 14:14 - 00082672 ____A C:\Users\Jack\Downloads\OTL.Txt 2012-09-03 12:50 - 2012-09-03 12:50 - 00599040 ____A (OldTimer Tools) C:\Users\Jack\Downloads\OTL.exe 2012-09-03 12:40 - 2012-04-11 12:13 - 00696520 ____A (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe 2012-09-03 12:40 - 2011-10-05 13:25 - 00073416 ____A (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl 2012-09-03 10:59 - 2011-12-05 13:10 - 00000328 ____A C:\Windows\Tasks\HPCeeScheduleForZeke.job 2012-09-03 10:41 - 2012-09-03 10:41 - 10652120 ____A (Malwarebytes Corporation ) C:\Users\Jack\Downloads\mbam-setup-1.62.0.1300.exe 2012-09-03 08:27 - 2012-09-03 08:27 - 00000000 ___AH C:\Users\Zeke\Documents\Default.rdp 2012-09-02 17:20 - 2012-02-13 16:15 - 00002450 ____N C:\Users\Public\Desktop\WildTangent Games App - hp.lnk 2012-08-31 15:16 - 2012-08-31 15:17 - 00821736 ____A (Oracle Corporation) C:\Windows\SysWOW64\npDeployJava1.dll 2012-08-31 15:16 - 2012-08-31 15:17 - 00246760 ____A (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe 2012-08-31 15:16 - 2012-08-31 15:17 - 00174056 ____A (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe 2012-08-31 15:16 - 2012-08-31 15:17 - 00174056 ____A (Oracle Corporation) C:\Windows\SysWOW64\java.exe 2012-08-31 15:16 - 2012-08-31 15:17 - 00095208 ____A (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll 2012-08-31 15:16 - 2011-12-19 01:31 - 00746984 ____A (Oracle Corporation) C:\Windows\SysWOW64\deployJava1.dll 2012-08-31 15:15 - 2012-08-31 15:15 - 00894952 ____A (Oracle Corporation) C:\Users\Jack\Downloads\jxpiinstall.exe 2012-08-29 20:23 - 2011-12-17 12:05 - 00000340 ____A C:\Windows\Tasks\HPCeeScheduleForZEKE-HP$.job 2012-08-29 10:58 - 2012-08-29 10:58 - 04755448 ____A C:\Users\Zeke\Downloads\HPPSdr.exe 2012-08-28 19:50 - 2012-08-28 19:50 - 00999840 ____A (Solid State Networks) C:\Users\Zeke\Downloads\install_flashplayer11x32_mssa_au_aih.exe 2012-08-26 19:12 - 2012-01-03 14:00 - 00210722 ____A C:\Windows\hpoins21.dat 2012-08-26 19:12 - 2012-01-03 10:35 - 00005469 ____A C:\Users\All Users\hpzinstall.log 2012-08-26 19:10 - 2012-08-26 19:10 - 00000000 ___AT C:\Windows\System32\CN25NBR1SK05KD 2012-08-21 14:44 - 2012-08-21 14:43 - 06717808 ____A (Support.com ) C:\Users\Zeke\Downloads\ARO2012_tbt(1).exe 2012-08-21 14:43 - 2012-08-21 14:43 - 06717808 ____A (Support.com ) C:\Users\Zeke\Downloads\ARO2012_tbt.exe 2012-08-20 08:04 - 2012-08-14 10:09 - 00001350 ____A C:\Users\Zeke\Desktop\ROBLOX Player.lnk 2012-08-14 10:08 - 2012-08-14 10:08 - 00504248 ____A (Roblox Corporation) C:\Users\Zeke\Downloads\RobloxPlayerLauncher.exe 2012-08-13 12:57 - 2012-08-13 12:38 - 00000348 ____A C:\Windows\Tasks\HPCeeScheduleForMike&Matt.job; 2012-08-13 08:20 - 2012-07-30 07:56 - 00001355 ___AH C:\Users\Mike&Matt;\Desktop\ROBLOX Player.lnk 2012-08-13 08:20 - 2012-07-30 07:56 - 00001154 ___AH C:\Users\Mike&Matt;\Desktop\ROBLOX Studio.lnk 2012-08-06 05:04 - 2012-08-06 05:04 - 00002166 ____A C:\Users\Public\Desktop\HP Officejet Pro 8600.lnk 2012-08-06 05:04 - 2012-08-06 05:04 - 00001860 ____A C:\Users\Public\Desktop\HP ePrintCenter - HP Officejet Pro 8600.lnk 2012-08-06 05:04 - 2012-08-06 05:04 - 00001154 ____A C:\Users\Public\Desktop\Shop for Supplies - HP Officejet Pro 8600.lnk 2012-08-06 05:03 - 2012-08-06 05:03 - 00000057 ____A C:\Users\All Users\Ament.ini 2012-07-24 12:43 - 2011-12-20 13:10 - 00000000 ____A C:\Windows\System32\HP_ActiveX_Patch_NOT_DETECTED.txt 2012-07-17 18:34 - 2011-10-05 13:27 - 00000583 ____A C:\Windows\DirectX.log 2012-07-17 05:28 - 2011-12-18 09:36 - 00000967 ____A C:\Users\Public\Desktop\AVG 2012.lnk 2012-07-10 23:20 - 2009-07-13 20:45 - 00422080 ____A C:\Windows\System32\FNTCACHE.DAT 2012-07-10 23:03 - 2009-07-13 18:34 - 00000478 ____A C:\Windows\win.ini 2012-07-10 23:01 - 2012-01-02 11:20 - 59701280 ____A (Microsoft Corporation) C:\Windows\System32\MRT.exe 2012-07-03 09:46 - 2012-09-03 10:40 - 00024904 ____A (Malwarebytes Corporation) C:\Windows\System32\Drivers\mbam.sys 2012-06-15 07:38 - 2012-06-15 07:38 - 03879304 ____A (AVG Technologies) C:\Users\Zeke\Downloads\avg_free_stb_all_2012_2180_cnet.exe 2012-06-11 19:08 - 2012-07-10 23:03 - 03148800 ____A (Microsoft Corporation) C:\Windows\System32\win32k.sys 2012-06-08 21:43 - 2012-07-10 15:47 - 14172672 ____A (Microsoft Corporation) C:\Windows\System32\shell32.dll 2012-06-08 20:41 - 2012-07-10 15:47 - 12873728 ____A (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll ZeroAccess: C:\Windows\Installer\{3fc22eb8-6828-94c8-a4f9-b7155f238540} C:\Windows\Installer\{3fc22eb8-6828-94c8-a4f9-b7155f238540}\L C:\Windows\Installer\{3fc22eb8-6828-94c8-a4f9-b7155f238540}\U ZeroAccess: C:\Users\Zeke\AppData\Local\{3fc22eb8-6828-94c8-a4f9-b7155f238540} C:\Users\Zeke\AppData\Local\{3fc22eb8-6828-94c8-a4f9-b7155f238540}\@ C:\Users\Zeke\AppData\Local\{3fc22eb8-6828-94c8-a4f9-b7155f238540}\L C:\Users\Zeke\AppData\Local\{3fc22eb8-6828-94c8-a4f9-b7155f238540}\U C:\Users\Zeke\AppData\Local\{3fc22eb8-6828-94c8-a4f9-b7155f238540}\L\00000004.@ C:\Users\Zeke\AppData\Local\{3fc22eb8-6828-94c8-a4f9-b7155f238540}\L\1afb2d56 C:\Users\Zeke\AppData\Local\{3fc22eb8-6828-94c8-a4f9-b7155f238540}\U\00000004.@ C:\Users\Zeke\AppData\Local\{3fc22eb8-6828-94c8-a4f9-b7155f238540}\U\00000008.@ C:\Users\Zeke\AppData\Local\{3fc22eb8-6828-94c8-a4f9-b7155f238540}\U\000000cb.@ C:\Users\Zeke\AppData\Local\{3fc22eb8-6828-94c8-a4f9-b7155f238540}\U\80000000.@ C:\Users\Zeke\AppData\Local\{3fc22eb8-6828-94c8-a4f9-b7155f238540}\U\80000032.@ C:\Users\Zeke\AppData\Local\{3fc22eb8-6828-94c8-a4f9-b7155f238540}\U\80000064.@ ==================== Known DLLs (Whitelisted) ================= ==================== Bamital & volsnap Check ================= C:\Windows\System32\winlogon.exe => MD5 is legit C:\Windows\System32\wininit.exe => MD5 is legit C:\Windows\SysWOW64\wininit.exe => MD5 is legit C:\Windows\explorer.exe => MD5 is legit C:\Windows\SysWOW64\explorer.exe => MD5 is legit C:\Windows\System32\svchost.exe => MD5 is legit C:\Windows\SysWOW64\svchost.exe => MD5 is legit C:\Windows\System32\services.exe => MD5 is legit C:\Windows\System32\User32.dll => MD5 is legit C:\Windows\SysWOW64\User32.dll => MD5 is legit C:\Windows\System32\userinit.exe => MD5 is legit C:\Windows\SysWOW64\userinit.exe => MD5 is legit C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit ==================== EXE ASSOCIATION ===================== HKLM\…\.exe: exefile => OK HKLM\…\exefile\DefaultIcon: %1 => OK HKLM\…\exefile\open\command: "%1" %* => OK ==================== Restore Points ========================= Restore point made on: 2012-08-02 20:36:56 Restore point made on: 2012-08-10 20:00:10 Restore point made on: 2012-08-17 20:00:16 Restore point made on: 2012-08-25 20:00:10 Restore point made on: 2012-08-26 18:20:24 Restore point made on: 2012-08-31 15:14:51 Restore point made on: 2012-08-31 15:16:51 Restore point made on: 2012-09-03 14:11:45 ==================== Memory info =========================== Percentage of memory in use: 16% Total physical RAM: 6050.52 MB Available physical RAM: 5027.49 MB Total Pagefile: 6048.71 MB Available Pagefile: 5017.65 MB Total Virtual: 8192 MB Available Virtual: 8191.89 MB ==================== Partitions ============================ 1 Drive c: (OS) (Fixed) (Total:919.58 GB) (Free:865.52 GB) NTFS 2 Drive e: (HP_RECOVERY) (Fixed) (Total:11.83 GB) (Free:1.45 GB) NTFS ==>[System with boot components (obtained from reading drive)] 3 Drive f: (HP OJ8600) (CDROM) (Total:0.33 GB) (Free:0 GB) CDFS 8 Drive k: (KINGSTON) (Removable) (Total:1.89 GB) (Free:1.85 GB) FAT 9 Drive x: (Boot) (Fixed) (Total:0.12 GB) (Free:0.12 GB) NTFS 10 Drive y: (SYSTEM) (Fixed) (Total:0.1 GB) (Free:0.07 GB) NTFS ==>[System with boot components (obtained from reading drive)] Disk ### Status Size Free Dyn Gpt ——– ————- ——- ——- — — Disk 0 Online 931 GB 0 B Disk 1 No Media 0 B 0 B Disk 2 No Media 0 B 0 B Disk 3 No Media 0 B 0 B Disk 4 No Media 0 B 0 B Disk 5 Online 1937 MB 0 B Partitions of Disk 0: =============== Partition ### Type Size Offset ————- —————- ——- ——- Partition 1 Primary 100 MB 1024 KB Partition 2 Primary 919 GB 101 MB Partition 3 Primary 11 GB 919 GB ================================================================================ == Disk: 0 Partition 1 Type : 07 Hidden: No Active: Yes Volume ### Ltr Label Fs Type Size Status Info ———- — ———– —– ———- ——- ——— ——– * Volume 1 Y SYSTEM NTFS Partition 100 MB Healthy ================================================================================ == Disk: 0 Partition 2 Type : 07 Hidden: No Active: No Volume ### Ltr Label Fs Type Size Status Info ———- — ———– —– ———- ——- ——— ——– * Volume 2 C OS NTFS Partition 919 GB Healthy ================================================================================ == Disk: 0 Partition 3 Type : 07 Hidden: No Active: No Volume ### Ltr Label Fs Type Size Status Info ———- — ———– —– ———- ——- ——— ——– * Volume 3 E HP_RECOVERY NTFS Partition 11 GB Healthy ================================================================================ == Partitions of Disk 5: =============== Partition ### Type Size Offset ————- —————- ——- ——- Partition 1 Primary 1933 MB 4032 KB ================================================================================ == Disk: 5 Partition 1 Type : 0E Hidden: No Active: Yes Volume ### Ltr Label Fs Type Size Status Info ———- — ———– —– ———- ——- ——— ——– * Volume 8 K KINGSTON FAT Removable 1933 MB Healthy ================================================================================ == Last Boot: 2012-08-26 20:24 ==================== End Of Log =============================

I ran combofix, then tried to start firefox and got that error message "Illegal operation attempted on a registry key that has been marked for deletion." so I restarted. Firefox opened fine. Doesn't seem to be hijacked anymore. ComboFix 12-09-07.03 - Jack 09/07/2012 21:18:49.2.4 - x64 Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.6051.4754 [GMT -4:00] Running from: c:\users\[removed]\Desktop\ComboFix.exe Command switches used :: c:\users\Jack\Desktop\CFScript.txt AV: AVG Anti-Virus Free Edition 2012 *Disabled/Updated* {5A2746B1-DEE9-F85A-FBCD-ADB11639C5F0} SP: AVG Anti-Virus Free Edition 2012 *Disabled/Updated* {E146A755-F8D3-F7D4-C17D-96C36DBE8F4D} SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} . FILE :: "c:\program files (x86)\Common Files\Spigot\Search Settings\SearchSettings.exe" "c:\program files (x86)\Common Files\Spigot\wtxpcom\components\WidgiToolbarFF.dll" "c:\program files (x86)\Common Files\Spigot\wtxpcom\components\WidgiToolbarFF.dll.10" "c:\program files (x86)\Common Files\Spigot\wtxpcom\components\WidgiToolbarFF.dll.11" "c:\program files (x86)\Common Files\Spigot\wtxpcom\components\WidgiToolbarFF.dll.12" "c:\program files (x86)\Common Files\Spigot\wtxpcom\components\WidgiToolbarFF.dll.13" "c:\program files (x86)\Common Files\Spigot\wtxpcom\components\WidgiToolbarFF.dll.14" "c:\program files (x86)\Common Files\Spigot\wtxpcom\components\WidgiToolbarFF.dll.15" "c:\program files (x86)\Common Files\Spigot\wtxpcom\components\WidgiToolbarFF.dll.5" "c:\program files (x86)\Common Files\Spigot\wtxpcom\components\WidgiToolbarFF.dll.6" "c:\program files (x86)\Common Files\Spigot\wtxpcom\components\WidgiToolbarFF.dll.7" "c:\program files (x86)\Common Files\Spigot\wtxpcom\components\WidgiToolbarFF.dll.8" "c:\program files (x86)\Common Files\Spigot\wtxpcom\components\WidgiToolbarFF.dll.9" "c:\program files (x86)\YTD Toolbar\IE\6.2\ytdToolbarIE.dll" "c:\programdata\YouTube Downloader\ytd_installer.exe" "c:\users\All Users\YouTube Downloader\ytd_installer.exe" "c:\users\Mike&Matt\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\EG7VRW48\q[1].htm" "c:\users\Mike&Matt\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\36\87d7164-7172b72f" "c:\users\Zeke\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\13\263b4acd-77eda4a3" "c:\users\Zeke\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\22\3ea2a0d6-7f5e9431" "c:\users\Zeke\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\22\4ace8d16-7071f9ec" "c:\users\Zeke\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\24\1ecc2fd8-148cd553" "c:\users\Zeke\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\34\63c20f22-26ebd3cd" "c:\users\Zeke\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\43\1de1e2b-75310e65" "c:\users\Zeke\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\46\41fe522e-40edc995" "c:\users\Zeke\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\50\4c24ee72-65dd08c5" "c:\users\Zeke\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\51\1edc87b3-377feafb" "c:\users\Zeke\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\54\4af09c36-2429e206" "c:\users\Zeke\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\55\29f90af7-18e3d52d" "c:\users\Zeke\AppData\Roaming\AVG\Rescue\PC Tuneup 2011\111223002127881.rsc" "c:\users\Zeke\Desktop\AZ's Stuff\couponprinter.exe" "c:\users\Zeke\Downloads\musicoasis.exe" "c:\users\Zeke\Downloads\PhotoCutterSetup.exe" "c:\users\Zeke\Downloads\registrybooster.exe" "c:\users\Zeke\Downloads\YouTubeDownloaderSetup33 (1).exe" "c:\users\Zeke\Downloads\YouTubeDownloaderSetup33.exe" "c:\users\Zeke\Downloads\YouTubeDownloaderSetup35.exe" "c:\windows\Installer\9cd3dd3.msi" . . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . . c:\program files (x86)\Common Files\Spigot\Search Settings\SearchSettings.exe c:\program files (x86)\Common Files\Spigot\wtxpcom\components\WidgiToolbarFF.dll c:\program files (x86)\Common Files\Spigot\wtxpcom\components\WidgiToolbarFF.dll.10 c:\program files (x86)\Common Files\Spigot\wtxpcom\components\WidgiToolbarFF.dll.11 c:\program files (x86)\Common Files\Spigot\wtxpcom\components\WidgiToolbarFF.dll.12 c:\program files (x86)\Common Files\Spigot\wtxpcom\components\WidgiToolbarFF.dll.13 c:\program files (x86)\Common Files\Spigot\wtxpcom\components\WidgiToolbarFF.dll.14 c:\program files (x86)\Common Files\Spigot\wtxpcom\components\WidgiToolbarFF.dll.15 c:\program files (x86)\Common Files\Spigot\wtxpcom\components\WidgiToolbarFF.dll.5 c:\program files (x86)\Common Files\Spigot\wtxpcom\components\WidgiToolbarFF.dll.6 c:\program files (x86)\Common Files\Spigot\wtxpcom\components\WidgiToolbarFF.dll.7 c:\program files (x86)\Common Files\Spigot\wtxpcom\components\WidgiToolbarFF.dll.8 c:\program files (x86)\Common Files\Spigot\wtxpcom\components\WidgiToolbarFF.dll.9 c:\program files (x86)\YTD Toolbar\IE\6.2\ytdToolbarIE.dll c:\programdata\YouTube Downloader\ytd_installer.exe c:\users\All Users\YouTube Downloader\ytd_installer.exe c:\users\Mike&Matt\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\EG7VRW48\q[1].htm c:\users\Zeke\AppData\Roaming\AVG\Rescue\PC Tuneup 2011\111223002127881.rsc c:\users\Zeke\Desktop\AZ's Stuff\couponprinter.exe c:\users\Zeke\Downloads\musicoasis.exe c:\users\Zeke\Downloads\PhotoCutterSetup.exe c:\users\Zeke\Downloads\registrybooster.exe c:\users\Zeke\Downloads\YouTubeDownloaderSetup33 (1).exe c:\users\Zeke\Downloads\YouTubeDownloaderSetup33.exe c:\users\Zeke\Downloads\YouTubeDownloaderSetup35.exe c:\windows\Installer\9cd3dd3.msi . . ((((((((((((((((((((((((( Files Created from 2012-08-08 to 2012-09-08 ))))))))))))))))))))))))))))))) . . 2012-09-08 01:24 . 2012-09-08 01:24 ——– d—–w- c:\users\Zeke\AppData\Local\temp 2012-09-08 01:24 . 2012-09-08 01:24 ——– d—–w- c:\users\Mike&Matt\AppData\Local\temp 2012-09-08 01:24 . 2012-09-08 01:24 ——– d—–w- c:\users\Default\AppData\Local\temp 2012-09-06 02:23 . 2012-09-06 02:23 ——– d—–w- c:\program files (x86)\ESET 2012-09-06 02:15 . 2012-09-06 02:15 ——– d—–w- c:\program files (x86)\Common Files\Java 2012-09-06 02:15 . 2012-09-06 02:15 95208 —-a-w- c:\windows\SysWow64\WindowsAccessBridge-32.dll 2012-09-05 06:25 . 2012-09-05 06:25 ——– d—–w- C:\FRST 2012-09-04 20:35 . 2012-09-04 20:35 ——– d—–w- c:\users\Jack\AppData\Roaming\Hewlett-Packard 2012-09-04 20:34 . 2012-09-04 20:34 ——– d—–w- c:\users\Jack\AppData\Roaming\HpUpdate 2012-09-04 20:34 . 2012-09-04 20:34 ——– d—–w- c:\users\Jack\AppData\Local\Hewlett-Packard 2012-09-03 18:40 . 2012-09-03 18:40 ——– d—–w- c:\users\Jack\AppData\Roaming\Malwarebytes 2012-09-03 18:40 . 2010-03-30 04:46 38224 —-a-w- c:\windows\SysWow64\drivers\mbamswissarmy.sys 2012-09-03 18:40 . 2012-09-03 18:41 ——– d—–w- c:\program files (x86)\Malwarebytes' Anti-Malware 2012-09-03 18:40 . 2012-09-03 18:40 ——– d—–w- c:\programdata\Malwarebytes 2012-09-03 18:40 . 2012-07-03 17:46 24904 —-a-w- c:\windows\system32\drivers\mbam.sys 2012-09-03 18:38 . 2012-09-03 18:38 ——– d—–w- c:\users\Jack\AppData\Local\HP 2012-09-03 14:07 . 2012-09-03 14:07 ——– d—–w- c:\users\Mike&Matt\AppData\Local\Diagnostics 2012-09-03 01:21 . 2012-09-03 01:35 ——– d—–w- c:\users\Mike&Matt\AppData\Local\Microsoft Games 2012-09-03 01:20 . 2012-09-03 01:20 ——– d—–w- c:\users\Mike&Matt\AppData\Roaming\WildTangent 2012-09-02 00:09 . 2012-09-02 00:09 ——– d—–w- c:\users\Jack\AppData\Local\AuthenTec 2012-08-31 23:17 . 2012-09-06 02:15 821736 —-a-w- c:\windows\SysWow64\npDeployJava1.dll 2012-08-15 20:09 . 2012-08-15 20:09 ——– d—–w- c:\program files (x86)\Coupons 2012-08-14 18:09 . 2012-08-14 18:23 ——– d—–w- c:\users\Zeke\AppData\Local\Roblox 2012-08-13 20:38 . 2012-08-13 20:38 ——– d–h–w- c:\users\Mike&Matt\AppData\Roaming\Hewlett-Packard 2012-08-13 20:38 . 2012-08-13 20:38 ——– d–h–w- c:\users\Mike&Matt\AppData\Local\Hewlett-Packard . . . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2012-09-06 02:15 . 2011-12-19 09:31 746984 —-a-w- c:\windows\SysWow64\deployJava1.dll 2012-09-03 20:40 . 2012-04-11 20:13 696520 —-a-w- c:\windows\SysWow64\FlashPlayerApp.exe 2012-09-03 20:40 . 2011-10-05 21:25 73416 —-a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl 2012-07-18 02:34 . 2012-07-18 02:35 19736 —-a-w- c:\programdata\Microsoft\IdentityCRL\production\ppcrlconfig600.dll 2012-07-11 07:01 . 2012-01-02 19:20 59701280 —-a-w- c:\windows\system32\MRT.exe 2012-06-12 03:08 . 2012-07-11 07:03 3148800 —-a-w- c:\windows\system32\win32k.sys . . ((((((((((((((((((((((((((((( SnapShot@2012-09-05_01.53.35 ))))))))))))))))))))))))))))))))))))))))) . + 2010-11-21 03:09 . 2012-09-08 01:17 34582 c:\windows\system32\wdi\ShutdownPerformanceDiagnostics_SystemData.bin + 2009-07-14 05:10 . 2012-09-08 01:17 33968 c:\windows\system32\wdi\BootPerformanceDiagnostics_SystemData.bin + 2011-10-13 17:28 . 2012-09-06 02:08 16384 c:\windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat - 2011-10-13 17:28 . 2012-09-03 19:01 16384 c:\windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat + 2011-10-13 17:28 . 2012-09-06 02:08 32768 c:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat - 2011-10-13 17:28 . 2012-09-03 19:01 32768 c:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat - 2009-07-14 04:54 . 2012-09-03 19:01 16384 c:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat + 2009-07-14 04:54 . 2012-09-06 02:08 16384 c:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat + 2009-07-14 04:46 . 2012-09-08 01:19 93232 c:\windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\SoftwareProtectionPlatform\Cache\cache.dat + 2012-09-05 01:27 . 2012-09-08 01:17 3170 c:\windows\system32\wdi\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-3805376401-1662035509-791222529-1003_UserData.bin - 2012-09-05 01:52 . 2012-09-05 01:52 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat + 2012-09-08 01:25 . 2012-09-08 01:25 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat + 2012-09-08 01:25 . 2012-09-08 01:25 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat - 2012-09-05 01:52 . 2012-09-05 01:52 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat + 2012-09-06 02:15 . 2012-09-06 02:15 246760 c:\windows\SysWOW64\javaws.exe - 2012-08-31 23:17 . 2012-08-31 23:16 246760 c:\windows\SysWOW64\javaws.exe - 2012-08-31 23:17 . 2012-08-31 23:16 174056 c:\windows\SysWOW64\javaw.exe + 2012-09-06 02:15 . 2012-09-06 02:15 174056 c:\windows\SysWOW64\javaw.exe - 2012-08-31 23:17 . 2012-08-31 23:16 174056 c:\windows\SysWOW64\java.exe + 2012-09-06 02:15 . 2012-09-06 02:15 174056 c:\windows\SysWOW64\java.exe + 2009-07-14 04:54 . 2012-09-08 01:15 147456 c:\windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat - 2009-07-14 04:54 . 2012-09-05 01:39 147456 c:\windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat - 2009-07-14 02:36 . 2012-09-05 01:46 660068 c:\windows\system32\perfh009.dat + 2009-07-14 02:36 . 2012-09-08 01:22 660068 c:\windows\system32\perfh009.dat + 2009-07-14 02:36 . 2012-09-08 01:22 120996 c:\windows\system32\perfc009.dat - 2009-07-14 02:36 . 2012-09-05 01:46 120996 c:\windows\system32\perfc009.dat + 2009-07-14 05:01 . 2012-09-08 01:24 395796 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-System.dat - 2009-07-14 05:01 . 2012-09-05 01:52 395796 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-System.dat + 2012-09-06 02:15 . 2012-09-06 02:15 179200 c:\windows\Installer\47997.msi + 2012-01-04 05:51 . 2012-09-08 01:15 4348868 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-S-1-5-21-3805376401-1662035509-791222529-1003-8192.dat - 2009-07-14 04:54 . 2012-09-05 01:39 15695872 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat + 2009-07-14 04:54 . 2012-09-08 01:15 15695872 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat + 2009-07-14 04:54 . 2012-09-08 01:15 16187392 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat - 2009-07-14 04:54 . 2012-09-05 01:39 16187392 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat + 2012-09-06 02:14 . 2012-09-06 02:14 27545600 c:\windows\Installer\47991.msi . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 . [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] "PDF Complete"="c:\program files (x86)\PDF Complete\pdfsty.exe" [2011-05-05 658424] "GrooveMonitor"="c:\program files (x86)\Microsoft Office\Office12\GrooveMonitor.exe" [2009-02-26 30040] "hpqSRMon"="c:\program files (x86)\HP\Digital Imaging\bin\hpqSRMon.exe" [2008-07-22 150528] "HP Software Update"="c:\program files (x86)\HP\HP Software Update\HPWuSchd2.exe" [2011-05-10 49208] "SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2012-07-03 252848] . c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\ HP Digital Imaging Monitor.lnk - c:\program files (x86)\Hp\Digital Imaging\bin\hpqtra08.exe [2009-9-20 270336] . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "ConsentPromptBehaviorAdmin"= 5 (0x5) "ConsentPromptBehaviorUser"= 3 (0x3) "EnableUIADesktopToggle"= 0 (0x0) . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32] "aux"=wdmaud.drv . [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager] BootExecute REG_MULTI_SZ autocheck autochk *\0c:\progra~2\AVG\AVG2012\avgrsa.exe /sync /restart . [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa] Security Packages REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp . R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576] R2 HP Support Assistant Service;HP Support Assistant Service;c:\program files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe [2011-09-09 86072] R3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-09-03 250568] R3 BBSvc;Bing Bar Update Service;c:\program files (x86)\Microsoft\BingBar\BBSvc.EXE [2011-03-02 183560] R3 GamesAppService;GamesAppService;c:\program files (x86)\WildTangent Games\App\GamesAppService.exe [2010-10-12 206072] R3 Impcd;Impcd;c:\windows\system32\drivers\Impcd.sys [2010-02-27 158976] R3 McComponentHostService;McAfee Security Scan Component Host Service;c:\program files (x86)\McAfee Security Scan\2.0.189\McCHSvc.exe [2010-09-02 227232] R3 MozillaMaintenance;Mozilla Maintenance Service;c:\program files (x86)\Mozilla Maintenance Service\maintenanceservice.exe [2012-07-20 113120] R3 pmxdrv;pmxdrv;c:\windows\system32\drivers\pmxdrv.sys [2011-10-05 31152] R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-21 59392] R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys [2010-11-21 31232] R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [2011-12-10 1255736] R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe [2010-09-23 57184] S0 AVGIDSHA;AVGIDSHA;c:\windows\system32\DRIVERS\avgidsha.sys [2012-04-19 28480] S0 Avgrkx64;AVG Anti-Rootkit Driver;c:\windows\system32\DRIVERS\avgrkx64.sys [2012-01-31 36944] S1 Avgldx64;AVG AVI Loader Driver;c:\windows\system32\DRIVERS\avgldx64.sys [2012-02-22 289872] S1 Avgmfx64;AVG Mini-Filter Resident Anti-Virus Shield;c:\windows\system32\DRIVERS\avgmfx64.sys [2011-12-23 47696] S1 Avgtdia;AVG TDI Driver;c:\windows\system32\DRIVERS\avgtdia.sys [2012-03-19 383808] S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [2009-07-14 59904] S2 Application Updater;Application Updater;c:\program files (x86)\Application Updater\ApplicationUpdater.exe [2012-07-26 794560] S2 AVGIDSAgent;AVGIDSAgent;c:\program files (x86)\AVG\AVG2012\AVGIDSAgent.exe [2012-07-04 5160568] S2 avgwd;AVG WatchDog;c:\program files (x86)\AVG\AVG2012\avgwdsvc.exe [2012-02-14 193288] S2 FPLService;TrueSuiteService;c:\program files (x86)\HP SimplePass 2011\TrueSuiteService.exe [2011-06-09 264008] S2 HPAuto;HP Auto;c:\program files\Hewlett-Packard\HP Auto\HPAuto.exe [2011-02-17 682040] S2 HPClientSvc;HP Client Services;c:\program files\Hewlett-Packard\HP Client Services\HPClientServices.exe [2010-10-11 346168] S2 HPDrvMntSvc.exe;HP Quick Synchronization Service;c:\program files (x86)\Hewlett-Packard\Shared\HPDrvMntSvc.exe [2011-03-28 94264] S2 IntuitUpdateServiceV4;Intuit Update Service v4;c:\program files (x86)\Common Files\Intuit\Update Service v4\IntuitUpdateService.exe [2012-02-06 13672] S2 jhi_service;Intel® Identity Protection Technology Host Interface Service;c:\program files (x86)\Intel\Services\IPT\jhi_service.exe [2011-02-24 212944] S2 NOBU;Norton Online Backup;c:\program files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe SERVICE [x] S2 pdfcDispatcher;PDF Document Manager;c:\program files (x86)\PDF Complete\pdfsvc.exe [2011-05-05 1128952] S2 RoxioNow Service;RoxioNow Service;c:\program files (x86)\Roxio\RoxioNow Player\RNowSvc.exe [2010-11-26 399344] S2 UNS;Intel® Management and Security Application User Notification Service;c:\program files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe [2011-02-01 2656280] S3 AVGIDSDriver;AVGIDSDriver;c:\windows\system32\DRIVERS\avgidsdrivera.sys [2011-12-23 124496] S3 AVGIDSFilter;AVGIDSFilter;c:\windows\system32\DRIVERS\avgidsfiltera.sys [2011-12-23 29776] S3 MEIx64;Intel® Management Engine Interface;c:\windows\system32\drivers\HECIx64.sys [2010-10-19 56344] S3 netr28x;Ralink 802.11n Extensible Wireless Driver;c:\windows\system32\DRIVERS\netr28x.sys [2011-04-22 1360960] S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [2011-04-22 471144] S3 vwifimp;Microsoft Virtual WiFi Miniport Service;c:\windows\system32\DRIVERS\vwifimp.sys [2009-07-14 17920] S3 WSDPrintDevice;WSD Print Support via UMB;c:\windows\system32\DRIVERS\WSDPrint.sys [2009-07-14 23040] . . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\svchost] hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc . Contents of the 'Scheduled Tasks' folder . 2012-09-08 c:\windows\Tasks\Adobe Flash Player Updater.job - c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-11 20:40] . 2012-09-05 c:\windows\Tasks\HPCeeScheduleForJack.job - c:\program files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe [2010-09-14 05:15] . 2012-08-13 c:\windows\Tasks\HPCeeScheduleForMike&Matt.job - c:\program files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe [2010-09-14 05:15] . 2012-09-06 c:\windows\Tasks\HPCeeScheduleForZEKE-HP$.job - c:\program files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe [2010-09-14 05:15] . 2012-09-03 c:\windows\Tasks\HPCeeScheduleForZeke.job - c:\program files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe [2010-09-14 05:15] . . ——— X64 Entries ———– . . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "IgfxTray"="c:\windows\system32\igfxtray.exe" [2011-04-25 168216] "HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2011-04-25 391960] "Persistence"="c:\windows\system32\igfxpers.exe" [2011-04-25 418584] "hpsysdrv"="c:\program files (x86)\hewlett-packard\HP odometer\hpsysdrv.exe" [2008-11-20 62768] . ——- Supplementary Scan ——- . uLocal Page = c:\windows\system32\blank.htm mLocal Page = c:\windows\SysWOW64\blank.htm IE: E&xport to Microsoft Excel - c:\progra~2\MICROS~1\Office12\EXCEL.EXE/3000 Trusted Zone: intuit.com\ttlc TCP: DhcpNameServer = 192.168.0.1 FF - ProfilePath - c:\users\Jack\AppData\Roaming\Mozilla\Firefox\Profiles\vgt1h20z.default\ FF - prefs.js: browser.search.selectedEngine - Yahoo FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?fr=greentree_ff1&ei=utf-8&ilc=12&type=937811&p= . . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\pdfcDispatcher] "ImagePath"="c:\program files (x86)\PDF Complete\pdfsvc.exe /startedbyscm:66B66708-40E2BE4D-pdfcService" . ——————— LOCKED REGISTRY KEYS ——————— . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}] @Denied: (A 2) (Everyone) @="FlashBroker" "LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_3_300_271_ActiveX.exe,-101" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation] "Enabled"=dword:00000001 . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_3_300_271_ActiveX.exe" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}] @Denied: (A 2) (Everyone) @="Shockwave Flash Object" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_3_300_271.ocx" "ThreadingModel"="Apartment" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus] @="0" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID] @="ShockwaveFlash.ShockwaveFlash.11" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_3_300_271.ocx, 1" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib] @="{D27CDB6B-AE6D-11cf-96B8-444553540000}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version] @="1.0" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID] @="ShockwaveFlash.ShockwaveFlash" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}] @Denied: (A 2) (Everyone) @="Macromedia Flash Factory Object" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_3_300_271.ocx" "ThreadingModel"="Apartment" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID] @="FlashFactory.FlashFactory.1" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_3_300_271.ocx, 1" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib] @="{D27CDB6B-AE6D-11cf-96B8-444553540000}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version] @="1.0" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID] @="FlashFactory.FlashFactory" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}] @Denied: (A 2) (Everyone) @="IFlashBroker4" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32] @="{00020424-0000-0000-C000-000000000046}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" "Version"="1.0" . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security] @Denied: (Full) (Everyone) . ———————— Other Running Processes ———————— . c:\program files (x86)\Microsoft\BingBar\SeaPort.EXE c:\program files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe . ************************************************************************** . Completion time: 2012-09-07 21:30:04 - machine was rebooted ComboFix-quarantined-files.txt 2012-09-08 01:30 ComboFix2.txt 2012-09-05 01:58 . Pre-Run: 928,533,979,136 bytes free Post-Run: 928,355,930,112 bytes free . - - End Of File - - B0E2EDFE356F182F78740468285FC418