Spyware / Malware / Virus Removal

blekkosearch.mysearch [Closed]

8 min read

Looking for the outcome? Ask AI

lesae9 Topic Starter

Post #1September 19, 2012, 7:36 PM UTC

I clicked on a link for an Adobe Update from what I thought was the Adobe website. Afterward, whenever I opened up a browser window Mystart was coming up as my homepage/search engine. I went into my programs and deleted MyStart as well as something called Wajam. and anything else that showed that it was downloaded or added to my computer with today's date (9/12/12). I also went into my internet options and removed mystart as my homepage and replaced it with google.com. I also removed the extensions/plug ins for MyStart. Afterward, in normal mode I ran my AVG, Spybot Search and Destroy, Tdsskiller.exe, and Malwarebytes Anti-Malware but Mystart still appears when I open a new browser window first. Also, now I keep getting a pop up that keeps asking me to enter a user name and password to authenticate my proxy server. I would like to know how to resolve the Proxy Server Authentication issue and especially remove MyStart and anything affliated with it from my computer completely. Please help me. I'm not sure what else to do. Any and all help that you can provide is greatly appreciated. Thank you so much.

Tomk

Post #2September 20, 2012, 2:07 PM UTC

Hi lesae9,

My name is Tomk. I would be glad to take a look at your log and help you with solving any malware problems. Logs can take a while to research, so please be patient and I'd be grateful if you would note the following:

I will be working on your Malware issues, this may or may not, solve other issues you have with your machine.
The fixes are specific to your problem and should only be used for the issues on this machine.
Please continue to review my answers until I tell you your machine appears to be clear. Absence of symptoms does not mean that everything is clear.
It's often worth reading through these instructions and printing them for ease of reference.
If you don't know or understand something, please don't hesitate to say or ask!! It's better to be sure and safe than sorry.
Please reply to this thread. Do not start a new topic.

To start with… I'm going to need to see a log so I have something to work with.

Download OTL to your desktop.
Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
Check the boxes beside LOP Check and Purity Check.

Under Custom Scan paste this in

netsvcs
drivers32
%SYSTEMDRIVE%\*.*
%systemroot%\Fonts\*.com
%systemroot%\Fonts\*.dll
%systemroot%\Fonts\*.ini
%systemroot%\Fonts\*.ini2
%systemroot%\Fonts\*.exe
%systemroot%\system32\spool\prtprocs\w32x86\*.*
%systemroot%\REPAIR\*.bak1
%systemroot%\REPAIR\*.ini
%systemroot%\system32\*.jpg
%systemroot%\*.jpg
%systemroot%\*.png
%systemroot%\*.scr
%systemroot%\*._sy
%APPDATA%\Adobe\Update\*.*
%ALLUSERSPROFILE%\Favorites\*.*
%APPDATA%\Microsoft\*.*
%PROGRAMFILES%\*.*
%APPDATA%\Update\*.*
%systemroot%\*. /mp /s
CREATERESTOREPOINT
%systemroot%\System32\config\*.sav
%PROGRAMFILES%\bak. /s
%systemroot%\system32\bak. /s
%ALLUSERSPROFILE%\Start Menu\*.lnk /x
%systemroot%\system32\config\systemprofile\*.dat /x
%systemroot%\*.config
%systemroot%\system32\*.db
%PROGRAMFILES%\Internet Explorer\*.dat
%APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x
%USERPROFILE%\Desktop\*.exe
%PROGRAMFILES%\Common Files\*.*
%systemroot%\*.src
%systemroot%\install\*.*
%systemroot%\system32\DLL\*.*
%systemroot%\system32\HelpFiles\*.*
%systemroot%\system32\rundll\*.*
%systemroot%\winn32\*.*
%systemroot%\Java\*.*
%systemroot%\system32\test\*.*
%systemroot%\system32\Rundll32\*.*
%systemroot%\AppPatch\Custom\*.*
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs

Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt.
Note:These logs can be located in the OTL. folder on you C:\ drive if they fail to open automatically.
Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post it with your next reply. You may need two posts to fit them both in.

lesae9

Post #3September 21, 2012, 6:35 AM UTC

Hello Tomk. Thank you in advance for your time, efforts, energy and help to resolve this issue with my computer. I truly, truly appreciate it. Here it the OTL.txt log you requested. No Extras.txt Report was generated. I ran OTL.ext twice just to make sure that no Extras.txt. report was generated.

OTL.txt

OTL logfile created on: 9/20/2012 10:51:24 PM - Run 3
OTL by OldTimer - Version 3.2.65.0 Folder = C:\Users\lesae9\Downloads
64bit-Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

4.00 Gb Total Physical Memory | 1.48 Gb Available Physical Memory | 37.08% Memory free
8.20 Gb Paging File | 5.44 Gb Available in Paging File | 66.40% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 285.62 Gb Total Space | 171.11 Gb Free Space | 59.91% Space Free | Partition Type: NTFS
Drive D: | 12.47 Gb Total Space | 1.97 Gb Free Space | 15.77% Space Free | Partition Type: NTFS

Computer Name: LESAE9-PC | User Name: lesae9 | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Users\lesae9\Downloads\OTL.exe (OldTimer Tools)
PRC - C:\Program Files (x86)\AVG Secure Search\vprot.exe ()
PRC - C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\12.2.6\ToolbarUpdater.exe ()
PRC - C:\Users\lesae9\AppData\Local\Programs\Google\MusicManager\MusicManager.exe (Google Inc.)
PRC - C:\Program Files\Backup Assistant Plus\V CAST Backup Scheduler.exe ()
PRC - C:\Program Files (x86)\AVG\AVG2012\avgidsagent.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files (x86)\Real\realplayer\Update\realsched.exe (RealNetworks, Inc.)
PRC - C:\Program Files (x86)\AVG\AVG2012\avgtray.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated)
PRC - C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe (Skype Technologies S.A.)
PRC - C:\Program Files (x86)\AVG\AVG2012\avgfws.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files (x86)\Motorola Mobility\MotoCast\MotoCast.exe (Motorola Mobility Inc.)
PRC - C:\Program Files (x86)\Motorola Mobility\MotoCast\bin\MotoCast-thumbnailer.exe ()
PRC - C:\Program Files (x86)\Motorola Media Link\Lite\NServiceEntry.exe (Nero AG)
PRC - C:\Program Files (x86)\AVG\AVG2012\avgwdsvc.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files (x86)\Motorola\MotoHelper\MotoHelperAgent.exe ()
PRC - C:\Program Files (x86)\Motorola\MotoHelper\MotoHelperService.exe ()
PRC - C:\Program Files (x86)\Tango\Tango.exe (Tango Inc.)
PRC - C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe ()
PRC - C:\Program Files (x86)\McAfee Security Scan\2.1.121\SSScheduler.exe (McAfee, Inc.)
PRC - C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe (ArcSoft Inc.)
PRC - C:\Program Files (x86)\Flip Video\FlipShare\FlipShareService.exe ()
PRC - C:\Program Files (x86)\Hewlett-Packard\Media\TV\Kernel\TV\TVCapSvc.exe ()
PRC - C:\Program Files (x86)\Hewlett-Packard\Media\TV\Kernel\TV\TVSched.exe ()
PRC - C:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe (Safer-Networking Ltd.)
PRC - C:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe (Safer Networking Ltd.)
PRC - C:\Program Files (x86)\Yahoo!\SoftwareUpdate\YahooAUService.exe (Yahoo! Inc.)
PRC - C:\Program Files (x86)\SMINST\BLService.exe ()
PRC - C:\Users\lesae9\AppData\Roaming\Google\Google Talk\googletalk.exe (Google)

========== Modules (No Company Name) ==========

MOD - C:\Users\lesae9\AppData\Local\Temp\ZumoLocalGateway.dll2916416853964014744.lib ()
MOD - C:\Users\lesae9\AppData\Local\Temp\WindowsFolderWatcher.dll7729698039230739266.lib ()
MOD - C:\Users\lesae9\AppData\Local\Temp\WindowsAPI.dll4889839448261110918.lib ()
MOD - C:\Program Files (x86)\AVG Secure Search\vprot.exe ()
MOD - C:\Program Files (x86)\Common Files\AVG Secure Search\DNTInstaller\12.2.6\avgdttbx.dll ()
MOD - C:\Program Files (x86)\Common Files\AVG Secure Search\SiteSafetyInstaller\12.2.6\SiteSafety.dll ()
MOD - C:\Users\lesae9\AppData\Local\Programs\Google\MusicManager\libaudioenc.dll ()
MOD - C:\Users\lesae9\AppData\Local\Programs\Google\MusicManager\libmpgdec.dll ()
MOD - C:\Users\lesae9\AppData\Local\Programs\Google\MusicManager\libid3tag.dll ()
MOD - C:\Users\lesae9\AppData\Local\Programs\Google\MusicManager\libaacdec.dll ()
MOD - C:\Users\lesae9\AppData\Local\Google\Chrome\Application\21.0.1180.89\ppGoogleNaClPluginChrome.dll ()
MOD - C:\Users\lesae9\AppData\Local\Google\Chrome\Application\21.0.1180.89\pdf.dll ()
MOD - C:\Users\lesae9\AppData\Local\Google\Chrome\Application\21.0.1180.89\avutil-51.dll ()
MOD - C:\Users\lesae9\AppData\Local\Google\Chrome\Application\21.0.1180.89\avformat-54.dll ()
MOD - C:\Users\lesae9\AppData\Local\Google\Chrome\Application\21.0.1180.89\avcodec-54.dll ()
MOD - C:\Users\lesae9\AppData\Local\Programs\Google\MusicManager\imageformats\qgif4.dll ()
MOD - C:\Users\lesae9\AppData\Local\Programs\Google\MusicManager\QtWebKit4.dll ()
MOD - C:\Users\lesae9\AppData\Local\Programs\Google\MusicManager\QtNetwork4.dll ()
MOD - C:\Users\lesae9\AppData\Local\Programs\Google\MusicManager\QtGui4.dll ()
MOD - C:\Users\lesae9\AppData\Local\Programs\Google\MusicManager\QtCore4.dll ()
MOD - C:\Program Files\Backup Assistant Plus\V CAST Backup Scheduler.exe ()
MOD - C:\Program Files\Backup Assistant Plus\swscale-2.dll ()
MOD - C:\Program Files\Backup Assistant Plus\avformat-54.dll ()
MOD - C:\Program Files\Backup Assistant Plus\avutil-51.dll ()
MOD - C:\Program Files\Backup Assistant Plus\avcodec-54.dll ()
MOD - C:\Program Files\Backup Assistant Plus\libexpat.dll ()
MOD - C:\Program Files\Backup Assistant Plus\sqlite3.dll ()
MOD - C:\Users\lesae9\AppData\Local\Temp\sqlite-3.6.20-sqlitejdbc.dll ()
MOD - C:\Program Files (x86)\Motorola Mobility\MotoCast\bin\plugins\libgstfluh264dec.dll ()
MOD - C:\Program Files (x86)\Motorola Mobility\MotoCast\bin\plugins\libgstfluaacdec.dll ()
MOD - C:\Program Files (x86)\Motorola Mobility\MotoCast\bin\plugins\libgstflump3enc.dll ()
MOD - C:\Program Files (x86)\Motorola Mobility\MotoCast\bin\libxml2-2.dll ()
MOD - C:\Program Files (x86)\Motorola Mobility\MotoCast\bin\plugins\libgstflump3dec.dll ()
MOD - C:\Program Files (x86)\Motorola Mobility\MotoCast\bin\plugins\libgstflumpeg4video.dll ()
MOD - C:\Program Files (x86)\Motorola Mobility\MotoCast\bin\plugins\libgstflumpeg2video.dll ()
MOD - C:\Program Files (x86)\Motorola Mobility\MotoCast\bin\libwavpack-1.dll ()
MOD - C:\Program Files (x86)\Motorola Mobility\MotoCast\bin\plugins\libgstffmpegcolorspace.dll ()
MOD - C:\Program Files (x86)\Motorola Mobility\MotoCast\bin\plugins\libgstcoreelements.dll ()
MOD - C:\Program Files (x86)\Motorola Mobility\MotoCast\bin\plugins\libgstmatroska.dll ()
MOD - C:\Program Files (x86)\Motorola Mobility\MotoCast\bin\plugins\libgstmpegdemux.dll ()
MOD - C:\Program Files (x86)\Motorola Mobility\MotoCast\bin\plugins\libgstqtdemux.dll ()
MOD - C:\Program Files (x86)\Motorola Mobility\MotoCast\bin\plugins\libgstogg.dll ()
MOD - C:\Program Files (x86)\Motorola Mobility\MotoCast\bin\plugins\libgstfluasfdemux.dll ()
MOD - C:\Program Files (x86)\Motorola Mobility\MotoCast\bin\plugins\libgstavi.dll ()
MOD - C:\Program Files (x86)\Motorola Mobility\MotoCast\bin\plugins\libgstflumpegdemux.dll ()
MOD - C:\Program Files (x86)\Motorola Mobility\MotoCast\bin\plugins\libgstqtmux.dll ()
MOD - C:\Program Files (x86)\Motorola Mobility\MotoCast\bin\plugins\libgstdshowdecwrapper.dll ()
MOD - C:\Program Files (x86)\Motorola Mobility\MotoCast\bin\plugins\libgstflummssrc.dll ()
MOD - C:\Program Files (x86)\Motorola Mobility\MotoCast\bin\z.dll ()
MOD - C:\Program Files (x86)\Motorola Mobility\MotoCast\bin\plugins\libgstdecodebin2.dll ()
MOD - C:\Program Files (x86)\Motorola Mobility\MotoCast\bin\plugins\libgstaudioconvert.dll ()
MOD - C:\Program Files (x86)\Motorola Mobility\MotoCast\bin\plugins\libgstflv.dll ()
MOD - C:\Program Files (x86)\Motorola Mobility\MotoCast\bin\plugins\libgstdshowsrcwrapper.dll ()
MOD - C:\Program Files (x86)\Motorola Mobility\MotoCast\bin\plugins\libgstvideoscale.dll ()
MOD - C:\Program Files (x86)\Motorola Mobility\MotoCast\bin\plugins\libgstflac.dll ()
MOD - C:\Program Files (x86)\Motorola Mobility\MotoCast\bin\plugins\libgstjpeg.dll ()
MOD - C:\Program Files (x86)\Motorola Mobility\MotoCast\bin\plugins\libgstvideobox.dll ()
MOD - C:\Program Files (x86)\Motorola Mobility\MotoCast\bin\plugins\libgsttypefindfunctions.dll ()
MOD - C:\Program Files (x86)\Motorola Mobility\MotoCast\bin\plugins\libgstsmpte.dll ()
MOD - C:\Program Files (x86)\Motorola Mobility\MotoCast\bin\plugins\libgstvorbis.dll ()
MOD - C:\Program Files (x86)\Motorola Mobility\MotoCast\bin\plugins\libgstsubparse.dll ()
MOD - C:\Program Files (x86)\Motorola Mobility\MotoCast\bin\plugins\libgstwavpack.dll ()
MOD - C:\Program Files (x86)\Motorola Mobility\MotoCast\bin\plugins\libgstaudioresample.dll ()
MOD - C:\Program Files (x86)\Motorola Mobility\MotoCast\bin\plugins\libgstalpha.dll ()
MOD - C:\Program Files (x86)\Motorola Mobility\MotoCast\bin\plugins\libgstmpegaudioparse.dll ()
MOD - C:\Program Files (x86)\Motorola Mobility\MotoCast\bin\plugins\libgstwavparse.dll ()
MOD - C:\Program Files (x86)\Motorola Mobility\MotoCast\bin\plugins\libgstmpegtsmux.dll ()
MOD - C:\Program Files (x86)\Motorola Mobility\MotoCast\bin\plugins\libgstaiff.dll ()
MOD - C:\Program Files (x86)\Motorola Mobility\MotoCast\bin\plugins\libgstgio.dll ()
MOD - C:\Program Files (x86)\Motorola Mobility\MotoCast\bin\plugins\libgstflumch264enc.dll ()
MOD - C:\Program Files (x86)\Motorola Mobility\MotoCast\bin\plugins\libgstselector.dll ()
MOD - C:\Program Files (x86)\Motorola Mobility\MotoCast\bin\plugins\libgstinterleave.dll ()
MOD - C:\Program Files (x86)\Motorola Mobility\MotoCast\bin\plugins\libgstreplaygain.dll ()
MOD - C:\Program Files (x86)\Motorola Mobility\MotoCast\bin\plugins\libgstvolume.dll ()
MOD - C:\Program Files (x86)\Motorola Mobility\MotoCast\bin\plugins\libgstid3tag.dll ()
MOD - C:\Program Files (x86)\Motorola Mobility\MotoCast\bin\plugins\libgstflumcaacenc.dll ()
MOD - C:\Program Files (x86)\Motorola Mobility\MotoCast\bin\plugins\libgstvideocrop.dll ()
MOD - C:\Program Files (x86)\Motorola Mobility\MotoCast\bin\plugins\libgstid3demux.dll ()
MOD - C:\Program Files (x86)\Motorola Mobility\MotoCast\bin\plugins\libgstadder.dll ()
MOD - C:\Program Files (x86)\Motorola Mobility\MotoCast\bin\plugins\libgstgdp.dll ()
MOD - C:\Program Files (x86)\Motorola Mobility\MotoCast\bin\plugins\libgstautodetect.dll ()
MOD - C:\Program Files (x86)\Motorola Mobility\MotoCast\bin\plugins\libgstautoconvert.dll ()
MOD - C:\Program Files (x86)\Motorola Mobility\MotoCast\bin\plugins\libgstpng.dll ()
MOD - C:\Program Files (x86)\Motorola Mobility\MotoCast\bin\plugins\libgstequalizer.dll ()
MOD - C:\Program Files (x86)\Motorola Mobility\MotoCast\bin\plugins\libgstmpegvideoparse.dll ()
MOD - C:\Program Files (x86)\Motorola Mobility\MotoCast\bin\plugins\libgstmultipart.dll ()
MOD - C:\Program Files (x86)\Motorola Mobility\MotoCast\bin\plugins\libgstvideorate.dll ()
MOD - C:\Program Files (x86)\Motorola Mobility\MotoCast\bin\plugins\libgstmultifile.dll ()
MOD - C:\Program Files (x86)\Motorola Mobility\MotoCast\bin\plugins\libgstamrnb.dll ()
MOD - C:\Program Files (x86)\Motorola Mobility\MotoCast\bin\plugins\libgstaudiorate.dll ()
MOD - C:\Program Files (x86)\Motorola Mobility\MotoCast\bin\plugins\libgstlevel.dll ()
MOD - C:\Program Files (x86)\Motorola Mobility\MotoCast\bin\plugins\libgstauparse.dll ()
MOD - C:\Program Files (x86)\Motorola Mobility\MotoCast\bin\plugins\libgstalaw.dll ()
MOD - C:\Program Files (x86)\Motorola Mobility\MotoCast\bin\plugins\libgstalphacolor.dll ()
MOD - C:\Program Files (x86)\Motorola Mobility\MotoCast\bin\plugins\libgstcutter.dll ()
MOD - C:\Program Files (x86)\Motorola Mobility\MotoCast\bin\plugins\libgstmulaw.dll ()
MOD - C:\Program Files (x86)\Motorola Mobility\MotoCast\bin\plugins\libgstapetag.dll ()
MOD - C:\Program Files (x86)\Motorola Mobility\MotoCast\bin\plugins\libgstamrwbdec.dll ()
MOD - C:\Program Files (x86)\Motorola Mobility\MotoCast\bin\plugins\libgstadpcmdec.dll ()
MOD - C:\Program Files (x86)\Motorola Mobility\MotoCast\bin\plugins\libgsty4menc.dll ()
MOD - C:\Program Files (x86)\Motorola Mobility\MotoCast\bin\plugins\libgstcoreindexers.dll ()
MOD - C:\Program Files (x86)\Motorola Mobility\MotoCast\bin\plugins\libshift.dll ()
MOD - C:\Program Files (x86)\Motorola Mobility\MotoCast\bin\plugins\libgstapp.dll ()
MOD - C:\Program Files (x86)\Motorola Mobility\MotoCast\bin\libvorbisenc-2.dll ()
MOD - C:\Program Files (x86)\Motorola Mobility\MotoCast\bin\libgstreamer-0.10.dll ()
MOD - C:\Program Files (x86)\Motorola Mobility\MotoCast\bin\liborc-0.4-0.dll ()
MOD - C:\Program Files (x86)\Motorola Mobility\MotoCast\bin\libFLAC-8.dll ()
MOD - C:\Program Files (x86)\Motorola Mobility\MotoCast\bin\libjpeg-8.dll ()
MOD - C:\Program Files (x86)\Motorola Mobility\MotoCast\bin\libopencore-amrnb.0.1.1.dll ()
MOD - C:\Program Files (x86)\Motorola Mobility\MotoCast\bin\MotoCast-thumbnailer.exe ()
MOD - C:\Program Files (x86)\Motorola Mobility\MotoCast\bin\libgstbase-0.10.dll ()
MOD - C:\Program Files (x86)\Motorola Mobility\MotoCast\bin\libpng14-14.dll ()
MOD - C:\Program Files (x86)\Motorola Mobility\MotoCast\bin\libvorbis-0.dll ()
MOD - C:\Program Files (x86)\Motorola Mobility\MotoCast\bin\libgstcontroller-0.10.dll ()
MOD - C:\Program Files (x86)\Motorola Mobility\MotoCast\bin\libgsttag-0.10.dll ()
MOD - C:\Program Files (x86)\Motorola Mobility\MotoCast\bin\libopencore-amrwb.0.1.1.dll ()
MOD - C:\Program Files (x86)\Motorola Mobility\MotoCast\bin\libgstaudio-0.10.dll ()
MOD - C:\Program Files (x86)\Motorola Mobility\MotoCast\bin\libgstpbutils-0.10.dll ()
MOD - C:\Program Files (x86)\Motorola Mobility\MotoCast\bin\libgstrtp-0.10.dll ()
MOD - C:\Program Files (x86)\Motorola Mobility\MotoCast\bin\libgstinterfaces-0.10.dll ()
MOD - C:\Program Files (x86)\Motorola Mobility\MotoCast\bin\libgstriff-0.10.dll ()
MOD - C:\Program Files (x86)\Motorola Mobility\MotoCast\bin\libgstapp-0.10.dll ()
MOD - C:\Program Files (x86)\Motorola Mobility\MotoCast\bin\libgstvideo-0.10.dll ()
MOD - C:\Program Files (x86)\Motorola Mobility\MotoCast\bin\libogg-0.dll ()
MOD - C:\Program Files (x86)\Motorola Mobility\MotoCast\bin\libgstdataprotocol-0.10.dll ()
MOD - C:\Program Files (x86)\Motorola\MotoHelper\MotoHelperAgent.exe ()
MOD - C:\Program Files (x86)\Tango\CrashRpt.dll ()
MOD - C:\Program Files (x86)\DivX\DivX Update\DivXUpdateCheck.dll ()
MOD - C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe ()
MOD - C:\Program Files (x86)\Tango\QtWebKit4.dll ()
MOD - C:\Program Files (x86)\Tango\QtMultimedia4.dll ()
MOD - C:\Program Files (x86)\Tango\phonon4.dll ()
MOD - C:\Program Files (x86)\Tango\QtGui4.dll ()
MOD - C:\Program Files (x86)\Tango\QtNetwork4.dll ()
MOD - C:\Program Files (x86)\Tango\QtCore4.dll ()
MOD - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll ()
MOD - C:\Program Files (x86)\Yahoo!\Messenger\yui.dll ()

========== Services (SafeList) ==========

SRV:64bit: - (hpsrv) – C:\Windows\SysNative\Hpservice.exe (Hewlett-Packard Company)
SRV:64bit: - (STacSV) – C:\Windows\SysNative\DriverStore\FileRepository\stwrt64.inf_58be29c0\STacSV64.exe (IDT, Inc.)
SRV:64bit: - (WinDefend) – C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)
SRV:64bit: - (AgereModemAudio) – C:\Windows\SysNative\agr64svc.exe (Agere Systems)
SRV - (vToolbarUpdater12.2.6) – C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\12.2.6\ToolbarUpdater.exe ()
SRV - (AdobeFlashPlayerUpdateSvc) – C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe (Adobe Systems Incorporated)
SRV - (AVGIDSAgent) – C:\Program Files (x86)\AVG\AVG2012\avgidsagent.exe (AVG Technologies CZ, s.r.o.)
SRV - (AdobeARMservice) – C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated)
SRV - (SkypeUpdate) – C:\Program Files (x86)\Skype\Updater\Updater.exe (Skype Technologies)
SRV - (Skype C2C Service) – C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe (Skype Technologies S.A.)
SRV - (avgfws) – C:\Program Files (x86)\AVG\AVG2012\avgfws.exe (AVG Technologies CZ, s.r.o.)
SRV - (DeviceMonitorService) – C:\Program Files (x86)\Motorola Media Link\Lite\NServiceEntry.exe (Nero AG)
SRV - (avgwd) – C:\Program Files (x86)\AVG\AVG2012\avgwdsvc.exe (AVG Technologies CZ, s.r.o.)
SRV - (MotoHelper) – C:\Program Files (x86)\Motorola\MotoHelper\MotoHelperService.exe ()
SRV - (McComponentHostService) – C:\Program Files (x86)\McAfee Security Scan\2.1.121\McCHSvc.exe (McAfee, Inc.)
SRV - (clr_optimization_v4.0.30319_32) – C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (Microsoft Corporation)
SRV - (ACDaemon) – C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe (ArcSoft Inc.)
SRV - (FlipShare Service) – C:\Program Files (x86)\Flip Video\FlipShare\FlipShareService.exe ()
SRV - (TVCapSvc) – C:\Program Files (x86)\Hewlett-Packard\Media\TV\Kernel\TV\TVCapSvc.exe ()
SRV - (TVSched) – C:\Program Files (x86)\Hewlett-Packard\Media\TV\Kernel\TV\TVSched.exe ()
SRV - (clr_optimization_v2.0.50727_32) – C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (Microsoft Corporation)
SRV - (YahooAUService) – C:\Program Files (x86)\Yahoo!\SoftwareUpdate\YahooAUService.exe (Yahoo! Inc.)
SRV - (Recovery Service for Windows) – C:\Program Files (x86)\SMINST\BLService.exe ()
SRV - (WcesComm) – C:\Windows\WindowsMobile\wcescomm.dll (Microsoft Corporation)
SRV - (RapiMgr) – C:\Windows\WindowsMobile\rapimgr.dll (Microsoft Corporation)

========== Driver Services (SafeList) ==========

DRV:64bit: - (avgtp) – C:\Windows\SysNative\drivers\avgtpx64.sys (AVG Technologies)
DRV:64bit: - (Avgtdia) – C:\Windows\SysNative\DRIVERS\avgtdia.sys (AVG Technologies CZ, s.r.o.)
DRV:64bit: - (Avgldx64) – C:\Windows\SysNative\DRIVERS\avgldx64.sys (AVG Technologies CZ, s.r.o.)
DRV:64bit: - (AVGIDSHA) – C:\Windows\SysNative\DRIVERS\avgidsha.sys (AVG Technologies CZ, s.r.o. )
DRV:64bit: - (Fs_Rec) – C:\Windows\SysNative\drivers\fs_rec.sys (Microsoft Corporation)
DRV:64bit: - (Avgrkx64) – C:\Windows\SysNative\DRIVERS\avgrkx64.sys (AVG Technologies CZ, s.r.o.)
DRV:64bit: - (Motousbnet) – C:\Windows\SysNative\DRIVERS\Motousbnet.sys (Motorola Mobility Inc)
DRV:64bit: - (motmodem) – C:\Windows\SysNative\DRIVERS\motmodem.sys (Motorola Mobility Inc)
DRV:64bit: - (motccgpfl) – C:\Windows\SysNative\DRIVERS\motccgpfl.sys (Motorola Mobility Inc)
DRV:64bit: - (motccgp) – C:\Windows\SysNative\DRIVERS\motccgp.sys (Motorola Mobility Inc)
DRV:64bit: - (Avgmfx64) – C:\Windows\SysNative\DRIVERS\avgmfx64.sys (AVG Technologies CZ, s.r.o.)
DRV:64bit: - (AVGIDSFilter) – C:\Windows\SysNative\DRIVERS\avgidsfiltera.sys (AVG Technologies CZ, s.r.o. )
DRV:64bit: - (AVGIDSDriver) – C:\Windows\SysNative\DRIVERS\avgidsdrivera.sys (AVG Technologies CZ, s.r.o. )
DRV:64bit: - (motusbdevice) – C:\Windows\SysNative\DRIVERS\motusbdevice.sys (Motorola Inc)
DRV:64bit: - (Avgfwfd) – C:\Windows\SysNative\DRIVERS\avgfwd6a.sys (AVG Technologies CZ, s.r.o.)
DRV:64bit: - (hpdskflt) – C:\Windows\SysNative\DRIVERS\hpdskflt.sys (Hewlett-Packard Company)
DRV:64bit: - (Accelerometer) – C:\Windows\SysNative\DRIVERS\Accelerometer.sys (Hewlett-Packard Company)
DRV:64bit: - (WpdUsb) – C:\Windows\SysNative\DRIVERS\wpdusb.sys (Microsoft Corporation)
DRV:64bit: - (RTL8169) – C:\Windows\SysNative\DRIVERS\Rtlh64.sys (Realtek )
DRV:64bit: - (NVHDA) – C:\Windows\SysNative\drivers\nvhda64v.sys (NVIDIA Corporation)
DRV:64bit: - (STHDA) – C:\Windows\SysNative\DRIVERS\stwrt64.sys (IDT, Inc.)
DRV:64bit: - (motandroidusb) – C:\Windows\SysNative\Drivers\motoandroid.sys (Motorola)
DRV:64bit: - (androidusb) – C:\Windows\SysNative\Drivers\motoandroid.sys (Motorola)
DRV:64bit: - (GEARAspiWDM) – C:\Windows\SysNative\DRIVERS\GEARAspiWDM.sys (GEAR Software Inc.)
DRV:64bit: - (usb_rndisx) – C:\Windows\SysNative\DRIVERS\usb8023x.sys (Microsoft Corporation)
DRV:64bit: - (BTCFilterService) – C:\Windows\SysNative\DRIVERS\motfilt.sys (Motorola Inc)
DRV:64bit: - (AgereSoftModem) – C:\Windows\SysNative\DRIVERS\agrsm64.sys (Agere Systems)
DRV:64bit: - (rcmirror) – C:\Windows\SysNative\DRIVERS\rcmirror.sys (Windows ® Codename Longhorn DDK provider)
DRV:64bit: - (enecir) – C:\Windows\SysNative\DRIVERS\enecir.sys (ENE TECHNOLOGY INC.)
DRV:64bit: - (NETw5v64) – C:\Windows\SysNative\DRIVERS\NETw5v64.sys (Intel Corporation)
DRV:64bit: - (JMCR) – C:\Windows\SysNative\DRIVERS\jmcr.sys (JMicron Technology Corporation)
DRV:64bit: - (PTDLWWAN) – C:\Windows\SysNative\DRIVERS\PTDLWWAN.sys (DEVGURU Co,LTD.)
DRV:64bit: - (PTDLVsp) – C:\Windows\SysNative\DRIVERS\PTDLVsp.sys (DEVGURU Co,LTD.)
DRV:64bit: - (PTDLMdm) – C:\Windows\SysNative\DRIVERS\PTDLMdm.sys (DEVGURU Co,LTD.)
DRV:64bit: - (PTDLBus) – C:\Windows\SysNative\DRIVERS\PTDLBus.sys (DEVGURU Co,LTD.)
DRV:64bit: - (SynTP) – C:\Windows\SysNative\DRIVERS\SynTP.sys (Synaptics, Inc.)
DRV:64bit: - (GT72NDISIPXP) – C:\Windows\SysNative\DRIVERS\Gt51Ip.sys (Option N.V.)
DRV:64bit: - (GT72UBUS) – C:\Windows\SysNative\DRIVERS\gt72ubus.sys (Option N.V.)
DRV:64bit: - (NETw3v64) – C:\Windows\SysNative\DRIVERS\NETw3v64.sys (Intel Corporation)
DRV:64bit: - (sdbus) – C:\Windows\SysNative\DRIVERS\sdbus.sys (Microsoft Corporation)
DRV:64bit: - (MotoSwitchService) – C:\Windows\SysNative\DRIVERS\motswch.sys (Motorola)
DRV:64bit: - (HpqKbFiltr) – C:\Windows\SysNative\DRIVERS\HpqKbFiltr.sys (Hewlett-Packard Development Company, L.P.)
DRV:64bit: - (GTPTSER) – C:\Windows\SysNative\DRIVERS\gtptser.sys (Option N.V.)
DRV:64bit: - (yukonx64) – C:\Windows\SysNative\DRIVERS\yk60x64.sys (Marvell)
DRV - ({55662437-DA8C-40c0-AADA-2C816A897A49}) – C:\Program Files (x86)\Hewlett-Packard\Media\DVD\000.fcl (Cyberlink Corp.)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a;…ion&pf;=cnnb
IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {9BB47C17-9C68-4BB3-B188-DD9AF0FD2406}
IE:64bit: - HKLM\..\SearchScopes\{0A2EA0A6-500B-43AC-83DB-176C72C2E6EF}: "URL" = http://www.ask.com/web?q={searchterms}&l;=dis&o;=ushpl
IE:64bit: - HKLM\..\SearchScopes\{66F68601-0E0C-42D4-82B7-190449980FA2}: "URL" = http://search.live.com/results.aspx?q={sea…amp;FORM=HPNTDF
IE:64bit: - HKLM\..\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2406}: "URL" = http://dts.search-results.com/sr?src=ieb&a;…q={searchTerms}
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaul…rch/search.html
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,CustomSearch = http://us.rd.yahoo.com/customize/ie/defaul…rch/search.html
IE - HKLM\..\SearchScopes,DefaultScope = {9BB47C17-9C68-4BB3-B188-DD9AF0FD2406}
IE - HKLM\..\SearchScopes\{0A2EA0A6-500B-43AC-83DB-176C72C2E6EF}: "URL" = http://www.ask.com/web?q={searchterms}&l;=dis&o;=ushpl
IE - HKLM\..\SearchScopes\{66F68601-0E0C-42D4-82B7-190449980FA2}: "URL" = http://search.live.com/results.aspx?q={sea…amp;FORM=HPNTDF
IE - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://www.google.com/search?q={searchTerm…mp;sourceid=ie7
IE - HKLM\..\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2406}: "URL" = http://dts.search-results.com/sr?src=ieb&a;…q={searchTerms}

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.google.com/ie
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = www.live.com [binary data]
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = http://www.google.com/ie
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.google.com
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchDefaultBranded = 1
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = http://www.google.com/ie
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ie
IE - HKCU\..\URLSearchHook: {81017EA9-9AA8-4A6A-9734-7AF40E7D593F} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn3\yt.dll (Yahoo! Inc.)
IE - HKCU\..\SearchScopes,DefaultScope = {3BD44F0E-0596-4008-AEE0-45D47E3A8F0E}
IE - HKCU\..\SearchScopes\{0A2EA0A6-500B-43AC-83DB-176C72C2E6EF}: "URL" = http://www.ask.com/web?q={searchterms}&l;=dis&o;=ushpl
IE - HKCU\..\SearchScopes\{426D440F-47F8-4638-90FA-559A71FE576E}: "URL" = http://www.bing.com/search?q={searchTerms}…rc=IE-SearchBox
IE - HKCU\..\SearchScopes\{4408C5D3-D063-47B7-F412-10B06D154E1C}: "URL" = http://www.bing.com/search?q={searchTerms}…eferrer:source}
IE - HKCU\..\SearchScopes\{66F68601-0E0C-42D4-82B7-190449980FA2}: "URL" = http://www.bing.com/search?q={searchTerms}…rc=IE-SearchBox
IE - HKCU\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://www.google.com/search?q={searchTerm…mp;sourceid=ie7
IE - HKCU\..\SearchScopes\{95B7759C-8C7F-4BF1-B163-73684A933233}: "URL" = https://isearch.avg.com/search?cid={B7D2FEC…mp;d=2012-09-12 19:45:59&v;=12.2.5.34&sap;=dsp&q;={searchTerms}
IE - HKCU\..\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2406}: "URL" = http://dts.search-results.com/sr?src=ieb&a;…q={searchTerms}
IE - HKCU\..\SearchScopes\{DECA3892-BA8F-44b8-A993-A466AD694AE4}: "URL" = http://search.yahoo.com/search?p={searchTerms}
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local;192.168.*.*

========== FireFox ==========

FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_4_402_278.dll File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@divx.com/DivX VOD Helper,version=1.0.0: C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/VirtualEarth3D,version=4.0: C:\Program Files (x86)\Virtual Earth 3D\ File not found
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_4_402_278.dll ()
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@avg.com/AVG SiteSafety plugin,version=11.0.0.1,application/x-avg-sitesafety-plugin: C:\Program Files (x86)\Common Files\AVG Secure Search\SiteSafetyInstaller\12.2.6\\npsitesafety.dll ()
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX VOD Helper,version=1.0.0: C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF - HKLM\Software\MozillaPlugins\@google.com/npPicasa3,version=3.0.0: C:\Program Files (x86)\Google\Picasa3\npPicasa3.dll (Google, Inc.)
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=1.6.0_35: C:\Windows\SysWOW64\npdeployJava1.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files (x86)\Java\jre6\bin\plugin2\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@messenger.yahoo.com/YahooMessengerStatePlugin;version=1.0.0.6: C:\Program Files (x86)\Yahoo!\Shared\npYState.dll (Yahoo! Inc.)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files (x86)\Microsoft Silverlight\5.1.10411.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeLive,version=1.5: C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@real.com/nppl3260;version=15.0.6.14: c:\program files (x86)\real\realplayer\Netscape6\nppl3260.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprjplug;version=15.0.6.14: c:\program files (x86)\real\realplayer\Netscape6\nprjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprpchromebrowserrecordext;version=15.0.6.14: C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprpchromebrowserrecordext.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprphtml5videoshim;version=15.0.6.14: C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprpplugin;version=15.0.6.14: c:\program files (x86)\real\realplayer\Netscape6\nprpplugin.dll (RealPlayer)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKCU\Software\MozillaPlugins\@movenetworks.com/Quantum Media Player: C:\Users\lesae9\AppData\Roaming\Move Networks\plugins\npqmp071500000347.dll (Move Networks)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Users\lesae9\AppData\Local\Google\Update\1.3.21.123\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Users\lesae9\AppData\Local\Google\Update\1.3.21.123\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@yahoo.com/BrowserPlus,version=2.7.1: C:\Users\lesae9\AppData\Local\Yahoo!\BrowserPlus\2.7.1\Plugins\npybrowserplus_2.7.1.dll (Yahoo! Inc.)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{B728AB94-9BC7-49b7-B76A-422BB31B2FD0}: C:\Program Files (x86)\ArcSoft\Media Converter for Philips\Internet Video Downloader\Plugin_FireFox [2009/12/01 20:38:05 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\[removed]: C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2010/01/26 21:44:42 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{1E73965B-8B48-48be-9C8D-68B920ABC1C4}: C:\Program Files (x86)\AVG\AVG2012\Firefox4\ [2012/09/10 17:43:30 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{ABDE892B-13A8-4d1b-88E6-365A6E755758}: C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext [2012/08/11 11:28:52 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\avg@toolbar: C:\ProgramData\AVG Secure Search\12.2.5.34\ [2012/09/12 19:46:30 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{97E22097-9A2F-45b1-8DAF-36AD648C7EF4}: C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext [2012/08/11 11:28:52 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{0153E448-190B-4987-BDE1-F256CADA672F}: C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext [2012/08/11 11:28:52 | 000,000,000 | —D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions\\[removed]: C:\Users\lesae9\AppData\Roaming\Move Networks [2009/06/05 17:15:57 | 000,000,000 | —D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions\\[removed]: C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2010/01/26 21:44:42 | 000,000,000 | —D | M]

========== Chrome ==========

CHR - homepage: http://www.google.com/
CHR - default_search_provider: Google (Enabled)
CHR - default_search_provider: search_url = {google:baseURL}search?q={searchTerms}&{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}{g
oogle:searchFieldtrialParameter}sourceid=chrome&ie;={inputEncoding}
CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client=chrome&hl;={language}&q;={searchTerms},
CHR - homepage: http://www.google.com/
CHR - plugin: Remoting Viewer (Enabled) = internal-remoting-viewer
CHR - plugin: Native Client (Enabled) = C:\Users\lesae9\AppData\Local\Google\Chrome\Application\21.0.1180.89\ppGoogleNaClPluginChrome.dll
CHR - plugin: Chrome PDF Viewer (Disabled) = C:\Users\lesae9\AppData\Local\Google\Chrome\Application\21.0.1180.89\pdf.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Users\lesae9\AppData\Local\Google\Chrome\Application\21.0.1180.89\gcswf32.dll
CHR - plugin: Shockwave Flash (Disabled) = C:\Users\lesae9\AppData\Local\Google\Chrome\User Data\PepperFlash\11.1.31.203\pepflashplayer.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Windows\system32\Macromed\Flash\NPSWF32.dll
CHR - plugin: AVG Internet Security (Enabled) = C:\Users\lesae9\AppData\Local\Google\Chrome\User Data\Default\Extensions\jmfkcklnlgedgbglfkkgedjfmejoahla\12.0.0.2161_0\plugins/avgnpss.dll
CHR - plugin: Skype Toolbars (Enabled) = C:\Users\lesae9\AppData\Local\Google\Chrome\User Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl\5.8.0.8855_0\npSkypeChromePlugin.dll
CHR - plugin: Adobe Acrobat (Enabled) = C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll
CHR - plugin: AVG SiteSafety plugin (Enabled) = C:\Program Files (x86)\Common Files\AVG Secure Search\SiteSafetyInstaller\11.0.2\\npsitesafety.dll
CHR - plugin: Java™ Platform SE 6 U31 (Enabled) = C:\Program Files (x86)\Java\jre6\bin\plugin2\npjp2.dll
CHR - plugin: Microsoft Office Live Plug-in for Firefox (Enabled) = C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll
CHR - plugin: iTunes Application Detector (Enabled) = C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll
CHR - plugin: RealNetworks™ Chrome Background Extension Plug-In (32-bit) (Enabled) = C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprpchromebrowserrecordext.dll
CHR - plugin: RealPlayer™ HTML5VideoShim Plug-In (32-bit) (Enabled) = C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll
CHR - plugin: RealPlayer™ G2 LiveConnect-Enabled Plug-In (32-bit) (Enabled) = c:\program files (x86)\real\realplayer\Netscape6\nppl3260.dll
CHR - plugin: RealPlayer Version Plugin (Enabled) = c:\program files (x86)\real\realplayer\Netscape6\nprpjplug.dll
CHR - plugin: Google Update (Enabled) = C:\Users\lesae9\AppData\Local\Google\Update\1.3.21.111\npGoogleUpdate3.dll
CHR - plugin: BrowserPlus (from Yahoo!) v2.7.1 (Enabled) = C:\Users\lesae9\AppData\Local\Yahoo!\BrowserPlus\2.7.1\Plugins\npybrowserplus_2.7.1.dll
CHR - plugin: Move Streaming Media Player (Enabled) = C:\Users\lesae9\AppData\Roaming\Move Networks\plugins\npqmp071500000347.dll
CHR - plugin: Silverlight Plug-In (Enabled) = c:\Program Files (x86)\Microsoft Silverlight\5.0.61118.0\npctrl.dll
CHR - plugin: Windows Presentation Foundation (Enabled) = c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll
CHR - plugin: RealJukebox NS Plugin (Enabled) = c:\program files (x86)\real\realplayer\Netscape6\nprjplug.dll
CHR - Extension: Angry Birds = C:\Users\lesae9\AppData\Local\Google\Chrome\User Data\Default\Extensions\aknpkdffaafgjchaibgeefbgmgeghloj\1.5.0.7_0\
CHR - Extension: YouTube = C:\Users\lesae9\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\
CHR - Extension: AT_AnnaSui = C:\Users\lesae9\AppData\Local\Google\Chrome\User Data\Default\Extensions\cjohejgigkmiclpgnilojffhiohcglib\3_0\
CHR - Extension: Google Search = C:\Users\lesae9\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\
CHR - Extension: RealPlayer HTML5Video Downloader Extension = C:\Users\lesae9\AppData\Local\Google\Chrome\User Data\Default\Extensions\jfmjfhklogoienhpfnppmbcbjfjnkonk\1.5_0\
CHR - Extension: AVG Safe Search = C:\Users\lesae9\AppData\Local\Google\Chrome\User Data\Default\Extensions\jmfkcklnlgedgbglfkkgedjfmejoahla\12.0.0.2210_0\
CHR - Extension: Skype Click to Call = C:\Users\lesae9\AppData\Local\Google\Chrome\User Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl\6.1.0.10441_0\
CHR - Extension: AVG Secure Search = C:\Users\lesae9\AppData\Local\Google\Chrome\User Data\Default\Extensions\ndibdjnfmopecpmkdieinmbadjfpblof\12.2.5.34_0\
CHR - Extension: Gmail = C:\Users\lesae9\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\

O1 HOSTS File: ([2012/06/29 19:09:19 | 000,000,027 | —- | M]) - C:\Windows\SysNative\drivers\etc\Hosts
O1 - Hosts: 127.0.0.1 localhost
O2:64bit: - BHO: (AVG Do Not Track) - {31332EEF-CB9F-458F-AFEB-D30E9A66B6BA} - C:\Program Files (x86)\AVG\AVG2012\avgdtiea.dll (AVG Technologies CZ, s.r.o.)
O2:64bit: - BHO: (AVG Safe Search) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files (x86)\AVG\AVG2012\avgssiea.dll (AVG Technologies CZ, s.r.o.)
O2:64bit: - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.3.4501.1418\swg64.dll (Google Inc.)
O2 - BHO: (&Yahoo;! Toolbar Helper) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn3\yt.dll (Yahoo! Inc.)
O2 - BHO: (IEPlugin Class) - {11222041-111B-46E3-BD29-EFB2449479B1} - C:\Program Files (x86)\ArcSoft\Media Converter for Philips\Internet Video Downloader\ArcURLRecord.dll (ArcSoft, Inc.)
O2 - BHO: (RealPlayer Download and Record Plugin for Internet Explorer) - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll (RealPlayer)
O2 - BHO: (AVG Safe Search) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files (x86)\AVG\AVG2012\avgssie.dll (AVG Technologies CZ, s.r.o.)
O2 - BHO: (Spybot-S&D; IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files (x86)\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O2 - BHO: (Java™ Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (AVG Security Toolbar) - {95B7759C-8C7F-4BF1-B163-73684A933233} - C:\Program Files (x86)\AVG Secure Search\12.2.5.34\AVG Secure Search_toolbar.dll ()
O2 - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar.dll (Google Inc.)
O2 - BHO: (Skype Browser Helper) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files (x86)\Google\GoogleToolbarNotifier\5.3.4501.1418\swg.dll (Google Inc.)
O2 - BHO: (Google Dictionary Compression sdch) - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files (x86)\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll (Google Inc.)
O2 - BHO: (Microsoft Live Search Toolbar Helper) - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - c:\Program Files (x86)\MSN\Toolbar\3.0.0541.0\msneshellx.dll (Microsoft Corp.)
O2 - BHO: (SingleInstance Class) - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn2\YTSingleInstance.dll (Yahoo! Inc)
O3:64bit: - HKLM\..\Toolbar: (no name) - !{5911488E-9D1E-40ec-8CBB-06B231CC153F} - No CLSID value found.
O3 - HKLM\..\Toolbar: (Microsoft Live Search Toolbar) - {1E61ED7C-7CB8-49d6-B9E9-AB4C880C8414} - c:\Program Files (x86)\MSN\Toolbar\3.0.0541.0\msneshellx.dll (Microsoft Corp.)
O3 - HKLM\..\Toolbar: (Google Toolbar) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar.dll (Google Inc.)
O3 - HKLM\..\Toolbar: (AVG Security Toolbar) - {95B7759C-8C7F-4BF1-B163-73684A933233} - C:\Program Files (x86)\AVG Secure Search\12.2.5.34\AVG Secure Search_toolbar.dll ()
O3 - HKLM\..\Toolbar: (Yahoo! Toolbar) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn3\yt.dll (Yahoo! Inc.)
O3 - HKLM\..\Toolbar: (no name) - 10 - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (Google Toolbar) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar.dll (Google Inc.)
O4:64bit: - HKLM..\Run: [NvCplDaemon] C:\Windows\SysNative\NvCpl.dll (NVIDIA Corporation)
O4:64bit: - HKLM..\Run: [SmartMenu] C:\Program Files\Hewlett-Packard\HP MediaSmart\SmartMenu.exe (Hewlett-Packard)
O4 - HKLM..\Run: [AVG_TRAY] C:\Program Files (x86)\AVG\AVG2012\avgtray.exe (AVG Technologies CZ, s.r.o.)
O4 - HKLM..\Run: [DivXUpdate] C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe ()
O4 - HKLM..\Run: [ROC_ROC_JULY_P1] "C:\Program Files (x86)\AVG Secure Search\ROC_ROC_JULY_P1.exe" / /PROMPT /CMPID=ROC_JULY_P1 File not found
O4 - HKLM..\Run: [ROC_ROC_NT] C:\Program Files (x86)\AVG Secure Search\ROC_ROC_NT.exe ()
O4 - HKLM..\Run: [TkBellExe] c:\program files (x86)\real\realplayer\Update\realsched.exe (RealNetworks, Inc.)
O4 - HKLM..\Run: [vProt] C:\Program Files (x86)\AVG Secure Search\vprot.exe ()
O4 - HKCU..\Run: [googletalk] C:\Users\lesae9\AppData\Roaming\Google\Google Talk\googletalk.exe (Google)
O4 - HKCU..\Run: [HLBackupScheduler] C:\Program Files\Backup Assistant Plus\V CAST Backup Scheduler.exe ()
O4 - HKCU..\Run: [Messenger (Yahoo!)] C:\Program Files (x86)\Yahoo!\Messenger\YahooMessenger.exe (Yahoo! Inc.)
O4 - HKCU..\Run: [MotoCast] C:\Program Files (x86)\Motorola Mobility\MotoCast\MotoLauncher.lnk ()
O4 - HKCU..\Run: [MusicManager] C:\Users\lesae9\AppData\Local\Programs\Google\MusicManager\MusicManager.exe (Google Inc.)
O4 - HKCU..\Run: [SpybotSD TeaTimer] C:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe (Safer-Networking Ltd.)
O4 - HKCU..\Run: [Tango] C:\Program Files (x86)\Tango\Tango.exe (Tango Inc.)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O8:64bit: - Extra context menu item: Add to Google Photos Screensa&ver; - res://C:\Windows\system32\GPhotos.scr/200 File not found
O8 - Extra context menu item: Add to Google Photos Screensa&ver; - C:\Windows\SysWow64\GPhotos.scr (Google Inc.)
O9:64bit: - Extra Button: AVG Do Not Track - {68BCFFE1-A2DA-4B40-9068-87ECBFC19D16} - C:\Program Files (x86)\AVG\AVG2012\avgdtiea.dll (AVG Technologies CZ, s.r.o.)
O9 - Extra Button: @C:\Windows\WindowsMobile\INetRepl.dll,-222 - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : @C:\Windows\WindowsMobile\INetRepl.dll,-223 - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll (Microsoft Corporation)
O9 - Extra Button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra 'Tools' menuitem : Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files (x86)\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000007 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)
O15 - HKCU\..Trusted Domains: apollogrp.edu ([]* in Trusted sites)
O15 - HKCU\..Trusted Domains: rhapsody.com ([rhap-app-4-0] https in Trusted sites)
O15 - HKCU\..Trusted Domains: rhapsody.com ([rhapreg] https in Trusted sites)
O15 - HKCU\..Trusted Ranges: Range1 ([http] in Local intranet)
O16 - DPF: {1851174C-97BD-4217-A0CC-E908F60D5B7A} https://h20364.www2.hp.com/CSMWeb/Customer/…DataManager.CAB (Hewlett-Packard Online Support Services)
O16 - DPF: {7E980B9B-8AE5-466A-B6D6-DA8CF814E78A} http://zone.msn.com/bingame/luxr/default/mjolauncher.cab (MJLauncherCtrl Class)
O16 - DPF: {8100D56A-5661-482C-BEE8-AFECE305D968} http://upload.facebook.com/controls/2009.0…oUploader55.cab (Facebook Photo Uploader 5 Control)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_35)
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.macromedia.com/get/flash…r/ultrashim.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_07)
O16 - DPF: {CAFEEFAC-0016-0000-0035-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_35)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_35)
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} http://zone.msn.com/bingame/dim2/default/popcaploader_v6.cab (PopCapLoader Object)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.254
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{09A9A164-1CC4-4770-A598-93A1B557513F}: DhcpNameServer = 192.168.0.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{58DD82A2-A9E1-44C7-80C3-2DA5783303A2}: DhcpNameServer = 192.168.1.254
O18:64bit: - Protocol\Handler\grooveLocalGWS - No CLSID value found
O18:64bit: - Protocol\Handler\linkscanner {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files (x86)\AVG\AVG2012\avgppa.dll (AVG Technologies CZ, s.r.o.)
O18:64bit: - Protocol\Handler\ms-help - No CLSID value found
O18:64bit: - Protocol\Handler\ms-itss - No CLSID value found
O18:64bit: - Protocol\Handler\skype4com - No CLSID value found
O18:64bit: - Protocol\Handler\skype-ie-addon-data - No CLSID value found
O18:64bit: - Protocol\Handler\viprotocol - No CLSID value found
O18 - Protocol\Handler\linkscanner {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files (x86)\AVG\AVG2012\avgpp.dll (AVG Technologies CZ, s.r.o.)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O18 - Protocol\Handler\viprotocol {B658800C-F66E-4EF3-AB85-6C0C227862A9} - C:\Program Files (x86)\Common Files\AVG Secure Search\ViProtocolInstaller\12.2.6\ViProtocol.dll ()
O18:64bit: - Protocol\Filter\x-sdch - No CLSID value found
O18 - Protocol\Filter\x-sdch {B1759355-3EEC-4C1E-B0F1-B719FE26E377} - C:\Program Files (x86)\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll (Google Inc.)
O20:64bit: - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysWOW64\userinit.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\Users\lesae9\AppData\Roaming\Microsoft\Windows Photo Gallery\Windows Photo Gallery Wallpaper.jpg
O24 - Desktop BackupWallPaper: C:\Users\lesae9\AppData\Roaming\Microsoft\Windows Photo Gallery\Windows Photo Gallery Wallpaper.jpg
O32 - HKLM CDRom: AutoRun - 1
O34 - HKLM BootExecute: (autocheck autochk *)
O34 - HKLM BootExecute: (C:\PROGRA~2\AVG\AVG2012\avgrsa.exe /sync /restart)
O35:64bit: - HKLM\..comfile [open] – "%1" %*
O35:64bit: - HKLM\..exefile [open] – "%1" %*
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37:64bit: - HKLM\…com [@ = ComFile] – "%1" %*
O37:64bit: - HKLM\…exe [@ = exefile] – "%1" %*
O37 - HKLM\…com [@ = ComFile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)

Drivers32:64bit: msacm.l3acm - C:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.l3acm - C:\Windows\SysWOW64\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.l3codecp - C:\Windows\SysWow64\l3codecp.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: vidc.3IV2 - C:\Windows\SysWow64\3ivxVfWCodec.dll (3ivx Technologies Pty. Ltd.)
Drivers32: vidc.cvid - C:\Windows\SysWow64\iccvid.dll (Radius Inc.)
Drivers32: vidc.DIVX - C:\Windows\SysWow64\DivX.dll (DivX, Inc.)
Drivers32: VIDC.FFDS - C:\Windows\SysWow64\ff_vfw.dll ()
Drivers32: vidc.xvid - C:\Windows\SysWow64\xvid.dll ()
Drivers32: vidc.yv12 - C:\Windows\SysWow64\DivX.dll (DivX, Inc.)

CREATERESTOREPOINT
Restore point Set: OTL Restore Point

========== Files/Folders - Created Within 30 Days ==========

[2012/09/12 19:45:42 | 000,000,000 | —D | C] – C:\Program Files (x86)\AVG Secure Search
[2012/09/12 18:54:17 | 000,000,000 | —D | C] – C:\Users\lesae9\AppData\Local\Wajam
[2012/09/12 18:54:16 | 000,000,000 | —D | C] – C:\Program Files (x86)\HiDefMedia
[2012/09/12 18:53:55 | 000,000,000 | —D | C] – C:\ProgramData\blekko toolbars
[2012/09/10 17:43:31 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AVG
[2012/09/04 18:03:38 | 000,031,080 | —- | C] (AVG Technologies) – C:\Windows\SysNative\drivers\avgtpx64.sys
[2012/09/03 17:44:00 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\McAfee Security Scan Plus
[2012/09/03 16:33:39 | 000,000,000 | —D | C] – C:\ProgramData\McAfee Security Scan
[2012/09/03 16:33:33 | 000,000,000 | —D | C] – C:\Program Files (x86)\McAfee Security Scan
[2012/09/03 16:32:56 | 000,157,680 | —- | C] (Sun Microsystems, Inc.) – C:\Windows\SysWow64\javaws.exe
[2012/09/03 16:32:56 | 000,149,488 | —- | C] (Sun Microsystems, Inc.) – C:\Windows\SysWow64\javaw.exe
[2012/09/03 16:32:56 | 000,149,488 | —- | C] (Sun Microsystems, Inc.) – C:\Windows\SysWow64\java.exe
[2012/09/03 16:30:58 | 000,000,000 | —D | C] – C:\ProgramData\McAfee
[2012/08/24 15:43:16 | 000,384,352 | —- | C] (AVG Technologies CZ, s.r.o.) – C:\Windows\SysNative\drivers\avgtdia.sys
[1 C:\Windows\SysWow64\*.tmp files -> C:\Windows\SysWow64\*.tmp -> ]
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2012/09/20 22:54:41 | 000,000,830 | —- | M] () – C:\Windows\tasks\Adobe Flash Player Updater.job
[2012/09/20 22:54:36 | 000,696,240 | —- | M] (Adobe Systems Incorporated) – C:\Windows\SysWow64\FlashPlayerApp.exe
[2012/09/20 22:54:36 | 000,073,136 | —- | M] (Adobe Systems Incorporated) – C:\Windows\SysWow64\FlashPlayerCPLApp.cpl
[2012/09/20 22:33:52 | 095,392,513 | —- | M] () – C:\Windows\SysNative\drivers\AVG\incavi.avm
[2012/09/20 22:31:50 | 000,110,638 | —- | M] () – C:\ProgramData\nvModes.001
[2012/09/20 22:31:44 | 000,110,638 | —- | M] () – C:\ProgramData\nvModes.dat
[2012/09/20 22:29:27 | 000,065,536 | —- | M] () – C:\Windows\SysNative\Ikeext.etl
[2012/09/20 22:29:21 | 000,003,216 | -H– | M] () – C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2012/09/20 22:29:21 | 000,003,216 | -H– | M] () – C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2012/09/20 22:29:08 | 000,067,584 | –S- | M] () – C:\Windows\bootstat.dat
[2012/09/20 22:29:03 | 4292,038,656 | -HS- | M] () – C:\hiberfil.sys
[2012/09/20 00:07:28 | 000,000,912 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-2409464188-3064301150-2695696042-1000UA.job
[2012/09/19 18:07:55 | 000,000,860 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-2409464188-3064301150-2695696042-1000Core.job
[2012/09/19 17:31:23 | 000,002,651 | —- | M] () – C:\Users\lesae9\Desktop\Microsoft Office Word 2007.lnk
[2012/09/17 01:09:02 | 000,000,404 | -H– | M] () – C:\Windows\tasks\Norton Security Scan for lesae9.job
[2012/09/12 19:44:01 | 000,000,000 | —- | M] () – C:\Windows\SysWow64\drivers\AVG\iavifw.avm
[2012/09/12 19:17:09 | 000,000,055 | —- | M] () – C:\Users\lesae9\AppData\Roaming\mbam.context.scan
[2012/09/11 21:30:02 | 000,870,128 | —- | M] () – C:\Users\lesae9\AppData\Roaming\mcs.rma
[2012/09/11 21:30:02 | 000,000,004 | —- | M] () – C:\Users\lesae9\AppData\Roaming\F9770B
[2012/09/11 20:09:28 | 000,892,288 | —- | M] () – C:\Windows\SysNative\drivers\AVG\iavichjg.avm
[2012/09/10 17:43:31 | 000,000,828 | —- | M] () – C:\Users\Public\Desktop\AVG 2012.lnk
[2012/09/04 18:03:38 | 000,031,080 | —- | M] (AVG Technologies) – C:\Windows\SysNative\drivers\avgtpx64.sys
[2012/09/03 17:44:01 | 000,001,727 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk
[2012/09/03 04:03:43 | 000,002,047 | —- | M] () – C:\Users\lesae9\Desktop\Google Chrome.lnk
[2012/09/03 04:03:43 | 000,002,009 | —- | M] () – C:\Users\lesae9\Application Data\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk
[2012/08/31 15:03:44 | 000,627,150 | —- | M] () – C:\Windows\SysNative\drivers\AVG\iavifw.avm
[2012/08/28 20:24:56 | 000,477,168 | —- | M] (Sun Microsystems, Inc.) – C:\Windows\SysWow64\npdeployJava1.dll
[2012/08/28 20:24:53 | 000,473,072 | —- | M] (Sun Microsystems, Inc.) – C:\Windows\SysWow64\deployJava1.dll
[2012/08/28 20:10:12 | 000,157,680 | —- | M] (Sun Microsystems, Inc.) – C:\Windows\SysWow64\javaws.exe
[2012/08/28 20:10:07 | 000,149,488 | —- | M] (Sun Microsystems, Inc.) – C:\Windows\SysWow64\javaw.exe
[2012/08/28 20:09:57 | 000,149,488 | —- | M] (Sun Microsystems, Inc.) – C:\Windows\SysWow64\java.exe
[2012/08/27 19:56:57 | 000,000,000 | -H– | M] () – C:\Windows\SysNative\drivers\Msft_Kernel_motusbdevice_01007.Wdf
[2012/08/27 19:24:13 | 000,604,502 | —- | M] () – C:\Windows\SysNative\perfh009.dat
[2012/08/27 19:24:10 | 000,703,388 | —- | M] () – C:\Windows\SysNative\PerfStringBackup.INI
[2012/08/27 19:24:10 | 000,104,170 | —- | M] () – C:\Windows\SysNative\perfc009.dat
[2012/08/24 15:43:16 | 000,384,352 | —- | M] (AVG Technologies CZ, s.r.o.) – C:\Windows\SysNative\drivers\avgtdia.sys
[1 C:\Windows\SysWow64\*.tmp files -> C:\Windows\SysWow64\*.tmp -> ]
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]

========== Files Created - No Company Name ==========

[2012/09/12 19:17:09 | 000,000,055 | —- | C] () – C:\Users\lesae9\AppData\Roaming\mbam.context.scan
[2012/09/03 16:33:34 | 000,001,727 | —- | C] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk
[2012/08/27 19:56:57 | 000,000,000 | -H– | C] () – C:\Windows\SysNative\drivers\Msft_Kernel_motusbdevice_01007.Wdf
[2012/08/20 01:18:30 | 000,602,112 | —- | C] () – C:\Windows\SysWow64\xvid.dll
[2012/07/18 17:19:12 | 000,000,004 | —- | C] () – C:\Users\lesae9\AppData\Roaming\F9770B
[2012/07/01 08:03:13 | 000,057,344 | —- | C] () – C:\Windows\SysWow64\ff_vfw.dll
[2012/06/29 18:51:03 | 000,256,000 | —- | C] () – C:\Windows\PEV.exe
[2012/06/29 18:51:03 | 000,208,896 | —- | C] () – C:\Windows\MBR.exe
[2012/06/29 18:51:03 | 000,098,816 | —- | C] () – C:\Windows\sed.exe
[2012/06/29 18:51:03 | 000,080,412 | —- | C] () – C:\Windows\grep.exe
[2012/06/29 18:51:03 | 000,068,096 | —- | C] () – C:\Windows\zip.exe
[2012/03/23 18:26:51 | 000,870,128 | —- | C] () – C:\Users\lesae9\AppData\Roaming\mcs.rma
[2011/11/04 00:19:12 | 000,000,000 | —- | C] () – C:\Users\lesae9\AppData\Local\{FBF98B80-98C2-45C2-B4E3-AE7C5FD83241}
[2011/02/05 23:44:11 | 000,004,096 | -H– | C] () – C:\Users\lesae9\AppData\Local\keyfile3.drm
[2011/01/20 18:24:03 | 000,031,049 | —- | C] () – C:\Users\lesae9\AppData\Roaming\UserTile.png
[2010/11/22 17:16:31 | 000,000,680 | —- | C] () – C:\Users\lesae9\AppData\Local\d3d9caps.dat
[2010/08/17 19:03:37 | 003,026,654 | —- | C] () – C:\Users\lesae9\divorce papers.pdf
[2010/06/14 23:07:31 | 000,002,025 | —- | C] () – C:\Users\lesae9\Google Chrome.lnk
[2009/11/18 20:26:20 | 000,038,442 | —- | C] () – C:\Users\lesae9\AppData\Roaming\Comma Separated Values (Windows).ADR
[2009/09/04 00:34:50 | 000,110,638 | —- | C] () – C:\ProgramData\nvModes.001
[2009/09/04 00:34:39 | 000,110,638 | —- | C] () – C:\ProgramData\nvModes.dat
[2009/04/11 16:26:19 | 000,000,580 | —- | C] () – C:\Users\lesae9\AppData\Roaming\wklnhst.dat
[2009/04/11 04:21:35 | 000,000,056 | -H– | C] () – C:\ProgramData\ezsidmv.dat
[2009/03/13 17:50:16 | 000,072,704 | —- | C] () – C:\Users\lesae9\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

========== ZeroAccess Check ==========

[2012/09/01 01:23:36 | 000,000,082 | —- | M] () – C:\Users\lesae9\AppData\Local\Google\Chrome\User Data\Default\Pepper Data\Shockwave Flash\WritableRoot\#SharedObjects\4RGJVURY\t.cxt.ms\lso.swf\u.sol
[2009/12/18 00:05:13 | 000,000,000 | —D | M] – C:\Users\lesae9\AppData\LocalLow\Microsoft\Silverlight\is\bhksxpq3.xts\fzy1wzgd.ff1\1\l
[2006/11/02 08:30:40 | 000,000,227 | RHS- | M] () – C:\Windows\assembly\Desktop.ini

========== LOP Check ==========

[2009/03/24 18:22:06 | 000,000,000 | —D | M] – C:\Users\lesae9\AppData\Roaming\aAvgApi
[2011/05/15 22:16:57 | 000,000,000 | —D | M] – C:\Users\lesae9\AppData\Roaming\acccore
[2012/04/30 23:32:43 | 000,000,000 | —D | M] – C:\Users\lesae9\AppData\Roaming\AVG
[2011/10/09 23:59:44 | 000,000,000 | —D | M] – C:\Users\lesae9\AppData\Roaming\AVG2012
[2009/09/10 21:28:21 | 000,000,000 | —D | M] – C:\Users\lesae9\AppData\Roaming\com.adobe.mauby.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1
[2012/03/13 19:05:13 | 000,000,000 | —D | M] – C:\Users\lesae9\AppData\Roaming\go
[2012/09/20 22:33:41 | 000,000,000 | —D | M] – C:\Users\lesae9\AppData\Roaming\MotoCast
[2012/02/23 22:19:39 | 000,000,000 | —D | M] – C:\Users\lesae9\AppData\Roaming\motorola
[2011/01/20 18:24:03 | 000,000,000 | —D | M] – C:\Users\lesae9\AppData\Roaming\PeerNetworking
[2009/03/11 20:26:39 | 000,000,000 | —D | M] – C:\Users\lesae9\AppData\Roaming\Smith Micro
[2009/04/11 16:26:22 | 000,000,000 | —D | M] – C:\Users\lesae9\AppData\Roaming\Template
[2009/03/11 23:58:27 | 000,000,000 | —D | M] – C:\Users\lesae9\AppData\Roaming\WildTangent

========== Purity Check ==========

========== Custom Scans ==========

< %SYSTEMDRIVE%\*.* >
[2009/04/10 23:36:36 | 000,333,257 | RHS- | M] () – C:\bootmgr
[2012/06/29 19:18:38 | 000,022,552 | —- | M] () – C:\ComboFix.txt
[2007/11/07 08:00:40 | 000,017,734 | —- | M] () – C:\eula.1028.txt
[2007/11/07 08:00:40 | 000,017,734 | —- | M] () – C:\eula.1031.txt
[2007/11/07 08:00:40 | 000,010,134 | —- | M] () – C:\eula.1033.txt
[2007/11/07 08:00:40 | 000,017,734 | —- | M] () – C:\eula.1036.txt
[2007/11/07 08:00:40 | 000,017,734 | —- | M] () – C:\eula.1040.txt
[2007/11/07 08:00:40 | 000,000,118 | —- | M] () – C:\eula.1041.txt
[2007/11/07 08:00:40 | 000,017,734 | —- | M] () – C:\eula.1042.txt
[2007/11/07 08:00:40 | 000,017,734 | —- | M] () – C:\eula.2052.txt
[2007/11/07 08:00:40 | 000,017,734 | —- | M] () – C:\eula.3082.txt
[2007/11/07 08:00:40 | 000,001,110 | —- | M] () – C:\globdata.ini
[2012/09/20 22:29:03 | 4292,038,656 | -HS- | M] () – C:\hiberfil.sys
[2007/11/07 08:03:18 | 000,562,688 | —- | M] (Microsoft Corporation) – C:\install.exe
[2007/11/07 08:00:40 | 000,000,843 | —- | M] () – C:\install.ini
[2007/11/07 08:03:18 | 000,076,304 | —- | M] (Microsoft Corporation) – C:\install.res.1028.dll
[2007/11/07 08:03:18 | 000,096,272 | —- | M] (Microsoft Corporation) – C:\install.res.1031.dll
[2007/11/07 08:03:18 | 000,091,152 | —- | M] (Microsoft Corporation) – C:\install.res.1033.dll
[2007/11/07 08:03:18 | 000,097,296 | —- | M] (Microsoft Corporation) – C:\install.res.1036.dll
[2007/11/07 08:03:18 | 000,095,248 | —- | M] (Microsoft Corporation) – C:\install.res.1040.dll
[2007/11/07 08:03:18 | 000,081,424 | —- | M] (Microsoft Corporation) – C:\install.res.1041.dll
[2007/11/07 08:03:18 | 000,079,888 | —- | M] (Microsoft Corporation) – C:\install.res.1042.dll
[2007/11/07 08:03:18 | 000,075,792 | —- | M] (Microsoft Corporation) – C:\install.res.2052.dll
[2007/11/07 08:03:18 | 000,096,272 | —- | M] (Microsoft Corporation) – C:\install.res.3082.dll
[2011/05/20 06:52:02 | 000,001,121 | -H– | M] () – C:\IPH.PH
[2006/12/01 23:37:14 | 000,904,704 | —- | M] (Microsoft Corporation) – C:\msdia80.dll
[2012/09/20 22:28:51 | 310,657,023 | -HS- | M] () – C:\pagefile.sys
[2012/07/05 00:19:47 | 000,000,348 | —- | M] () – C:\TDSSKiller.2.7.40.0_05.07.2012_00.19.41_log.txt
[2012/07/11 00:52:50 | 000,000,348 | —- | M] () – C:\TDSSKiller.2.7.40.0_11.07.2012_00.52.45_log.txt
[2012/07/11 00:53:41 | 000,000,348 | —- | M] () – C:\TDSSKiller.2.7.40.0_11.07.2012_00.53.30_log.txt
[2012/06/16 12:22:33 | 000,124,668 | —- | M] () – C:\TDSSKiller.2.7.40.0_16.06.2012_12.21.19_log.txt
[2012/06/16 14:55:45 | 000,246,108 | —- | M] () – C:\TDSSKiller.2.7.40.0_16.06.2012_13.46.29_log.txt
[2012/06/18 20:31:30 | 000,245,524 | —- | M] () – C:\TDSSKiller.2.7.40.0_18.06.2012_20.15.12_log.txt
[2012/07/23 22:26:02 | 000,000,348 | —- | M] () – C:\TDSSKiller.2.7.40.0_23.07.2012_22.25.53_log.txt
[2012/07/05 00:22:03 | 000,125,624 | —- | M] () – C:\TDSSKiller.2.7.44.0_05.07.2012_00.20.28_log.txt
[2012/07/11 00:58:32 | 000,125,542 | —- | M] () – C:\TDSSKiller.2.7.45.0_11.07.2012_00.54.07_log.txt
[2012/09/09 23:07:51 | 000,000,354 | —- | M] () – C:\TDSSKiller.2.7.47.0_09.09.2012_23.07.45_log.txt
[2012/09/12 19:31:50 | 000,126,958 | —- | M] () – C:\TDSSKiller.2.7.47.0_12.09.2012_19.15.38_log.txt
[2012/08/15 00:51:01 | 000,000,348 | —- | M] () – C:\TDSSKiller.2.7.47.0_15.08.2012_00.50.56_log.txt
[2012/08/15 00:51:45 | 000,000,348 | —- | M] () – C:\TDSSKiller.2.7.47.0_15.08.2012_00.51.39_log.txt
[2012/08/20 01:01:40 | 000,000,348 | —- | M] () – C:\TDSSKiller.2.7.47.0_20.08.2012_01.01.35_log.txt
[2012/07/23 22:50:24 | 000,125,916 | —- | M] () – C:\TDSSKiller.2.7.47.0_23.07.2012_22.27.35_log.txt
[2012/07/25 00:14:10 | 000,000,348 | —- | M] () – C:\TDSSKiller.2.7.47.0_25.07.2012_00.14.05_log.txt
[2012/07/25 00:16:23 | 000,125,542 | —- | M] () – C:\TDSSKiller.2.7.48.0_25.07.2012_00.15.08_log.txt
[2012/08/15 01:06:09 | 000,257,350 | —- | M] () – C:\TDSSKiller.2.8.6.0_15.08.2012_00.52.15_log.txt
[2012/08/20 01:03:14 | 000,130,354 | —- | M] () – C:\TDSSKiller.2.8.6.0_20.08.2012_01.02.30_log.txt
[2012/07/15 18:03:42 | 000,184,891 | —- | M] () – C:\torrent.exe
[2007/11/07 08:00:40 | 000,005,686 | —- | M] () – C:\vcredist.bmp
[2007/11/07 08:09:22 | 001,442,522 | —- | M] () – C:\VC_RED.cab
[2007/11/07 08:12:28 | 000,232,960 | —- | M] () – C:\VC_RED.MSI

< %systemroot%\Fonts\*.com >
[2006/11/02 08:06:41 | 000,026,040 | —- | M] () – C:\Windows\Fonts\GlobalMonospace.CompositeFont
[2006/11/02 08:06:41 | 000,026,489 | —- | M] () – C:\Windows\Fonts\GlobalSansSerif.CompositeFont
[2006/11/02 08:06:41 | 000,029,779 | —- | M] () – C:\Windows\Fonts\GlobalSerif.CompositeFont
[2009/12/04 19:57:15 | 000,037,665 | —- | M] () – C:\Windows\Fonts\GlobalUserInterface.CompositeFont

< %systemroot%\Fonts\*.dll >

< %systemroot%\Fonts\*.ini >
[2006/09/18 14:35:48 | 000,000,065 | -H– | M] () – C:\Windows\Fonts\desktop.ini

< %systemroot%\Fonts\*.ini2 >

< %systemroot%\Fonts\*.exe >

< %systemroot%\system32\spool\prtprocs\w32x86\*.* >

< %systemroot%\REPAIR\*.bak1 >

< %systemroot%\REPAIR\*.ini >

< %systemroot%\system32\*.jpg >

< %systemroot%\*.jpg >

< %systemroot%\*.png >

< %systemroot%\*.scr >

< %systemroot%\*._sy >

< %APPDATA%\Adobe\Update\*.* >

< %ALLUSERSPROFILE%\Favorites\*.* >

< %APPDATA%\Microsoft\*.* >

< %PROGRAMFILES%\*.* >
[2008/01/20 20:21:59 | 000,000,174 | -HS- | M] () – C:\Program Files (x86)\desktop.ini

< %APPDATA%\Update\*.* >

< %systemroot%\*. /mp /s >

< %systemroot%\System32\config\*.sav >

< %PROGRAMFILES%\bak. /s >

< %systemroot%\system32\bak. /s >

< %ALLUSERSPROFILE%\Start Menu\*.lnk /x >

< %systemroot%\system32\config\systemprofile\*.dat /x >

< %systemroot%\*.config >

< %systemroot%\system32\*.db >

< %PROGRAMFILES%\Internet Explorer\*.dat >

< %APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x >
[2011/11/04 16:34:30 | 000,000,680 | -HS- | M] () – C:\Users\lesae9\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini

< %USERPROFILE%\Desktop\*.exe >
[2011/10/29 12:43:32 | 000,909,600 | —- | M] (Sun Microsystems, Inc.) – C:\Users\lesae9\Desktop\chromeinstall-6u29.exe
[2012/06/29 18:50:04 | 004,566,027 | R— | M] (Swearware) – C:\Users\lesae9\Desktop\ComboFix.exe
[2012/06/18 21:45:52 | 000,595,968 | —- | M] (OldTimer Tools) – C:\Users\lesae9\Desktop\OTL.exe
[2012/07/01 08:52:05 | 015,267,728 | —- | M] (Google Inc.) – C:\Users\lesae9\Desktop\picasa39-setup.exe
[2009/06/27 01:37:13 | 005,990,424 | —- | M] (Hewlett-Packard Company ) – C:\Users\lesae9\Desktop\sp28805.exe
[2012/07/23 22:27:16 | 002,136,152 | —- | M] (Kaspersky Lab ZAO) – C:\Users\lesae9\Desktop\tdsskiller.exe
[2012/07/05 00:00:11 | 000,686,792 | —- | M] (Adobe Systems Incorporated) – C:\Users\lesae9\Desktop\uninstall_flash_player.exe
[2012/07/01 07:50:20 | 143,749,104 | —- | M] (Installation Program) – C:\Users\lesae9\Desktop\Verizon Droid Sync Assistant.exe
[2011/10/29 12:39:01 | 000,318,904 | —- | M] (Microsoft Corporation) – C:\Users\lesae9\Desktop\wmpfirefoxplugin.exe

< %PROGRAMFILES%\Common Files\*.* >

< %systemroot%\*.src >

< %systemroot%\install\*.* >

< %systemroot%\system32\DLL\*.* >

< %systemroot%\system32\HelpFiles\*.* >

< %systemroot%\system32\rundll\*.* >

< %systemroot%\winn32\*.* >

< %systemroot%\Java\*.* >

< %systemroot%\system32\test\*.* >

< %systemroot%\system32\Rundll32\*.* >

< %systemroot%\AppPatch\Custom\*.* >

< HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >

< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs >

========== Alternate Data Streams ==========

@Alternate Data Stream - 133 bytes -> C:\ProgramData\Temp:0B4227B4

< End of report >

No Extras.txt Report was generated.

Tomk

Post #4September 21, 2012, 7:30 PM UTC

Double click on OTL

Under the Custom Scans/Fixes box at the bottom, paste in the following
Do Not copy the word CODE
please note the fix starts with the :

:Processes

:OTL
IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {9BB47C17-9C68-4BB3-B188-DD9AF0FD2406}
IE:64bit: - HKLM\..\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2406}: "URL" = http://dts.search-results.com/sr?src=ieb&a…q={searchTerms}
IE - HKLM\..\SearchScopes,DefaultScope = {9BB47C17-9C68-4BB3-B188-DD9AF0FD2406}
IE - HKLM\..\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2406}: "URL" = http://dts.search-results.com/sr?src=ieb&a…q={searchTerms}
IE - HKCU\..\SearchScopes,DefaultScope = {3BD44F0E-0596-4008-AEE0-45D47E3A8F0E}
IE - HKCU\..\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2406}: "URL" = http://dts.search-results.com/sr?src=ieb&a…q={searchTerms}
O3:64bit: - HKLM\..\Toolbar: (no name) - !{5911488E-9D1E-40ec-8CBB-06B231CC153F} - No CLSID value found.
O3 - HKLM\..\Toolbar: (no name) - 10 - No CLSID value found.
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.macromedia.com/get/flash…r/ultrashim.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_07)
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} http://zone.msn.com/bingame/dim2/default/popcaploader_v6.cab (PopCapLoader Object)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)

:Commands
[purity]
[emptytemp]
[start explorer]
[Reboot]

Then click the Run Fix button at the top

Let the program run unhindered
Please save the resulting log to be posted in your next reply.
Reboot your computer

Please post the OTL log.

lesae9

Post #5September 22, 2012, 2:57 AM UTC

Hello again Tomk. I had to run the OTL.exe fix twice because it stopped in the middle of processing so I will post both logs. Files\Folders moved on Reboot… File move failed. C:\Users\lesae9\AppData\Local\Temp\ehmsas.txt scheduled to be moved on reboot. File\Folder C:\Users\lesae9\AppData\Local\Temp\~DF3DD5.tmp not found! File\Folder C:\Users\lesae9\AppData\Local\Temp\~DF6E76.tmp not found! File\Folder C:\Users\lesae9\AppData\Local\Temp\~DF72C0.tmp not found! File\Folder C:\Users\lesae9\AppData\Local\Temp\~DF8640.tmp not found! File\Folder C:\Users\lesae9\AppData\Local\Temp\~DF8670.tmp not found! File\Folder C:\Users\lesae9\AppData\Local\Temp\~DF9368.tmp not found! File\Folder C:\Users\lesae9\AppData\Local\Temp\~DF93F0.tmp not found! File\Folder C:\Users\lesae9\AppData\Local\Temp\~DF9FD3.tmp not found! File\Folder C:\Users\lesae9\AppData\Local\Temp\~DFAD40.tmp not found! File\Folder C:\Users\lesae9\AppData\Local\Temp\~DFB119.tmp not found! File\Folder C:\Users\lesae9\AppData\Local\Temp\~DFC8D2.tmp not found! File\Folder C:\Users\lesae9\AppData\Local\Temp\~DFD092.tmp not found! Registry entries deleted on Reboot… Files\Folders moved on Reboot… File move failed. C:\Users\lesae9\AppData\Local\Temp\ehmsas.txt scheduled to be moved on reboot. Registry entries deleted on Reboot… I hope this is what you were looking for. Please let me know what else I can do to help. Have a great night.

Tomk

Post #6September 22, 2012, 3:56 AM UTC

Information seems to be missing…

Let's try this:

Download ComboFix:

http://download.bleepingcomputer.com/sUBs/ComboFix.exe

* IMPORTANT !!! Save ComboFix.exe to your Desktop

Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link –> http://forums.whatthetech.com/How_Disable_…ams_t96260.html
Double click on ComboFix.exe & follow the prompts.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.

Notes:

1. Do not mouse-click Combofix's window while it is running. That may cause it to stall.
2. Do not "re-run" Combofix. If you have a problem, reply back for further instructions.
3. ComboFix may reset a number of Internet Explorer's settings, including making I-E the default browser.
4. CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.

lesae9

Post #7September 22, 2012, 5:09 AM UTC

Hello again Tomk, Here's the ComboFix.txt ComboFix 12-09-21.01 - lesae9 09/21/2012 21:19:06.2.2 - x64 Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.1.1033.18.4092.2299 [GMT -7:00] Running from: c:\users\[removed]\Downloads\ComboFix.exe AV: AVG Internet Security 2012 *Disabled/Updated* {5A2746B1-DEE9-F85A-FBCD-ADB11639C5F0} FW: AVG Internet Security 2012 *Enabled* {621CC794-9486-F902-D092-0484E8EA828B} SP: AVG Internet Security 2012 *Disabled/Updated* {E146A755-F8D3-F7D4-C17D-96C36DBE8F4D} SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} . . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . . C:\Install.exe c:\users\lesae9\AppData\Roaming\F9770B c:\windows\SysWow64\Cache c:\windows\SysWow64\Cache\272512937d9e61a4.fb c:\windows\SysWow64\Cache\287204568329e189.fb c:\windows\SysWow64\Cache\28bc8f716fd76a47.fb c:\windows\SysWow64\Cache\2c53092c95605355.fb c:\windows\SysWow64\Cache\31a0997e9a5b5eb3.fb c:\windows\SysWow64\Cache\32c84fe32bb74d60.fb c:\windows\SysWow64\Cache\3917078cb68ec657.fb c:\windows\SysWow64\Cache\590ba23ce359fd0c.fb c:\windows\SysWow64\Cache\610289e025a3ee9a.fb c:\windows\SysWow64\Cache\651c5d3cdbfb8bd1.fb c:\windows\SysWow64\Cache\6c59ac5e7e7a3ad0.fb c:\windows\SysWow64\Cache\6d03dad1035885d3.fb c:\windows\SysWow64\Cache\7d6dea10cbec8821.fb c:\windows\SysWow64\Cache\a8556537add6dfc5.fb c:\windows\SysWow64\Cache\ad10a52aff5e038d.fb c:\windows\SysWow64\Cache\c1fa887b03019701.fb c:\windows\SysWow64\Cache\c4d28dca2e7648be.fb c:\windows\SysWow64\Cache\d201ef9910cd39de.fb c:\windows\SysWow64\Cache\d2e94710a5708128.fb c:\windows\SysWow64\Cache\d79b9dfe81484ec4.fb c:\windows\SysWow64\Cache\f58397d8414d6c74.fb c:\windows\SysWow64\Cache\f998975c9cc711ee.fb . . ((((((((((((((((((((((((( Files Created from 2012-08-22 to 2012-09-22 ))))))))))))))))))))))))))))))) . . 2012-09-22 04:31 . 2012-09-22 04:31 ——– d—–w- c:\windows\system32\config\systemprofile\AppData\Local\temp 2012-09-22 04:31 . 2012-09-22 04:31 ——– d—–w- c:\users\Public\AppData\Local\temp 2012-09-22 04:31 . 2012-09-22 04:31 ——– d—–w- c:\users\Guest\AppData\Local\temp 2012-09-22 04:31 . 2012-09-22 04:31 ——– d—–w- c:\users\Default\AppData\Local\temp 2012-09-22 04:31 . 2012-09-22 04:31 ——– d—–w- c:\users\AppData\AppData\Local\temp 2012-09-22 02:10 . 2012-09-22 02:10 ——– d—–w- C:\_OTL 2012-09-13 02:45 . 2012-09-13 02:46 ——– d—–w- c:\program files (x86)\AVG Secure Search 2012-09-13 01:54 . 2012-09-13 01:54 ——– d—–w- c:\users\lesae9\AppData\Local\Wajam 2012-09-13 01:54 . 2012-09-13 01:54 ——– d—–w- c:\program files (x86)\HiDefMedia 2012-09-13 01:53 . 2012-09-13 02:05 ——– d—–w- c:\programdata\blekko toolbars 2012-09-05 01:03 . 2012-09-05 01:03 31080 —-a-w- c:\windows\system32\drivers\avgtpx64.sys 2012-09-03 23:33 . 2012-09-03 23:33 ——– d—–w- c:\programdata\McAfee Security Scan 2012-09-03 23:33 . 2012-09-04 00:44 ——– d—–w- c:\program files (x86)\McAfee Security Scan 2012-09-03 23:30 . 2012-09-03 23:30 ——– d—–w- c:\programdata\McAfee 2012-08-24 22:43 . 2012-08-24 22:43 384352 —-a-w- c:\windows\system32\drivers\avgtdia.sys . . . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2012-09-21 05:54 . 2012-07-05 07:04 73136 —-a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl 2012-09-21 05:54 . 2012-07-05 07:04 696240 —-a-w- c:\windows\SysWow64\FlashPlayerApp.exe 2012-08-30 07:27 . 2012-09-22 02:38 9308616 —-a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{EFE682C6-5E0A-42FC-8B98-E2AD9ACDBF3B}\mpengine.dll 2012-08-29 03:24 . 2012-06-16 18:09 477168 —-a-w- c:\windows\SysWow64\npdeployJava1.dll 2012-08-29 03:24 . 2011-09-23 04:48 473072 —-a-w- c:\windows\SysWow64\deployJava1.dll 2012-08-20 08:18 . 2012-08-20 08:18 602112 —-a-w- c:\windows\SysWow64\xvid.dll 2012-08-15 10:02 . 2006-11-02 12:35 62134624 —-a-w- c:\windows\system32\mrt.exe 2012-08-11 18:28 . 2012-05-21 23:24 499712 —-a-w- c:\windows\SysWow64\msvcp71.dll 2012-08-11 18:28 . 2012-05-21 23:24 348160 —-a-w- c:\windows\SysWow64\msvcr71.dll 2012-07-26 10:21 . 2012-07-26 10:21 291680 —-a-w- c:\windows\system32\drivers\avgldx64.sys 2012-07-16 01:03 . 2012-07-16 01:03 184891 —-a-w- C:\torrent.exe 2012-07-04 14:33 . 2012-08-15 10:14 2769408 —-a-w- c:\windows\system32\win32k.sys 2012-07-03 20:46 . 2012-06-16 19:24 24904 —-a-w- c:\windows\system32\drivers\mbam.sys 2012-06-29 16:20 . 2012-08-15 01:23 648192 —-a-w- c:\windows\system32\netapi32.dll 2012-06-28 04:10 . 2012-08-15 10:17 17809920 —-a-w- c:\windows\system32\mshtml.dll 2012-06-28 03:39 . 2012-08-15 10:17 10925568 —-a-w- c:\windows\system32\ieframe.dll 2012-06-28 03:28 . 2012-08-15 10:17 2312704 —-a-w- c:\windows\system32\jscript9.dll 2012-06-28 03:22 . 2012-08-15 10:17 1346048 —-a-w- c:\windows\system32\urlmon.dll 2012-06-28 03:21 . 2012-08-15 10:17 1392128 —-a-w- c:\windows\system32\wininet.dll 2012-06-28 03:20 . 2012-08-15 10:17 1494528 —-a-w- c:\windows\system32\inetcpl.cpl 2012-06-28 03:19 . 2012-08-15 10:17 237056 —-a-w- c:\windows\system32\url.dll 2012-06-28 03:17 . 2012-08-15 10:17 85504 —-a-w- c:\windows\system32\jsproxy.dll 2012-06-28 03:16 . 2012-08-15 10:17 816640 —-a-w- c:\windows\system32\jscript.dll 2012-06-28 03:16 . 2012-08-15 10:17 173056 —-a-w- c:\windows\system32\ieUnatt.exe 2012-06-28 03:14 . 2012-08-15 10:17 2144768 —-a-w- c:\windows\system32\iertutil.dll 2012-06-28 03:13 . 2012-08-15 10:17 96768 —-a-w- c:\windows\system32\mshtmled.dll 2012-06-28 03:12 . 2012-08-15 10:17 2382848 —-a-w- c:\windows\system32\mshtml.tlb 2012-06-28 03:08 . 2012-08-15 10:17 248320 —-a-w- c:\windows\system32\ieui.dll 2012-06-28 00:27 . 2012-08-15 10:17 1800704 —-a-w- c:\windows\SysWow64\jscript9.dll 2012-06-28 00:19 . 2012-08-15 10:17 1427968 —-a-w- c:\windows\SysWow64\inetcpl.cpl 2012-06-28 00:18 . 2012-08-15 10:17 1129472 —-a-w- c:\windows\SysWow64\wininet.dll 2012-06-28 00:12 . 2012-08-15 10:17 142848 —-a-w- c:\windows\SysWow64\ieUnatt.exe 2012-06-28 00:07 . 2012-08-15 10:17 2382848 —-a-w- c:\windows\SysWow64\mshtml.tlb . . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 . [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks] "{81017EA9-9AA8-4A6A-9734-7AF40E7D593F}"= "c:\program files (x86)\Yahoo!\Companion\Installs\cpn3\yt.dll" [2012-01-12 1517368] . [HKEY_CLASSES_ROOT\clsid\{81017ea9-9aa8-4a6a-9734-7af40e7d593f}] [HKEY_CLASSES_ROOT\yt.YTNavAssistPlugin.1] [HKEY_CLASSES_ROOT\TypeLib\{003028C2-EA1C-4676-A316-B5CB50917002}] [HKEY_CLASSES_ROOT\yt.YTNavAssistPlugin] . [HKEY_LOCAL_MACHINE\Wow6432Node\~\Browser Helper Objects\{95B7759C-8C7F-4BF1-B163-73684A933233}] 2012-09-13 02:45 1734240 —-a-w- c:\program files (x86)\AVG Secure Search\12.2.5.34\AVG Secure Search_toolbar.dll . [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar] "{95B7759C-8C7F-4BF1-B163-73684A933233}"= "c:\program files (x86)\AVG Secure Search\12.2.5.34\AVG Secure Search_toolbar.dll" [2012-09-13 1734240] . [HKEY_CLASSES_ROOT\clsid\{95b7759c-8c7f-4bf1-b163-73684a933233}] [HKEY_CLASSES_ROOT\AVG Secure Search.PugiObj.1] [HKEY_CLASSES_ROOT\AVG Secure Search.PugiObj] . [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-21 138240] "googletalk"="c:\users\lesae9\AppData\Roaming\Google\Google Talk\googletalk.exe" [2007-01-01 3739648] "Messenger (Yahoo!)"="c:\progra~2\Yahoo!\MESSEN~1\YahooMessenger.exe" [2010-05-11 5252408] "MotoCast"="c:\program files (x86)\Motorola Mobility\MotoCast\MotoLauncher.lnk" [2012-03-14 1886] "Skype"="c:\program files (x86)\Skype\Phone\Skype.exe" [2012-07-13 17420464] "SpybotSD TeaTimer"="c:\program files (x86)\Spybot - Search & Destroy\TeaTimer.exe" [2009-03-05 2260480] "MusicManager"="c:\users\lesae9\AppData\Local\Programs\Google\MusicManager\MusicManager.exe" [2012-08-31 7321600] "Tango"="c:\program files (x86)\Tango\Tango.exe" [2011-11-04 13489992] "HLBackupScheduler"="c:\program files\Backup Assistant Plus\V CAST Backup Scheduler.exe" [2012-08-20 7065224] . [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] "AVG_TRAY"="c:\program files (x86)\AVG\AVG2012\avgtray.exe" [2012-07-31 2596984] "iTunesHelper"="c:\program files (x86)\iTunes\iTunesHelper.exe" [2010-12-14 421160] "GrooveMonitor"="c:\program files (x86)\Microsoft Office\Office12\GrooveMonitor.exe" [2009-02-27 30040] "vProt"="c:\program files (x86)\AVG Secure Search\vprot.exe" [2012-09-13 947808] "Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-07-27 919008] "DivXUpdate"="c:\program files (x86)\DivX\DivX Update\DivXUpdate.exe" [2011-07-28 1259376] "SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2012-01-18 254696] "QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" [2012-04-19 421888] "TkBellExe"="c:\program files (x86)\real\realplayer\Update\realsched.exe" [2012-08-11 296096] "ROC_ROC_NT"="c:\program files (x86)\AVG Secure Search\ROC_ROC_NT.exe" [2012-09-13 856160] . c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\ McAfee Security Scan Plus.lnk - c:\program files (x86)\McAfee Security Scan\2.1.121\SSScheduler.exe [2010-9-2 255536] . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "EnableUIADesktopToggle"= 0 (0x0) . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32] "mixer1"=wdmaud.drv . [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager] BootExecute REG_MULTI_SZ autocheck autochk *\0c:\progra~2\AVG\AVG2012\avgrsa.exe /sync /restart . [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys] @="Driver" . R3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-09-21 250288] S2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2012-07-27 63960] . . HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs Themes . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}] 2008-06-09 18:14 451872 —-a-w- c:\program files (x86)\Common Files\LightScribe\LSRunOnce.exe . Contents of the 'Scheduled Tasks' folder . 2012-09-22 c:\windows\Tasks\Adobe Flash Player Updater.job - c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-07-05 05:54] . 2012-09-20 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2409464188-3064301150-2695696042-1000Core.job - c:\users\lesae9\AppData\Local\Google\Update\GoogleUpdate.exe [2011-11-04 05:41] . 2012-09-22 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2409464188-3064301150-2695696042-1000UA.job - c:\users\lesae9\AppData\Local\Google\Update\GoogleUpdate.exe [2011-11-04 05:41] . 2012-09-17 c:\windows\Tasks\Norton Security Scan for lesae9.job - c:\progra~2\NORTON~2\Engine\312~1.9\Nss.exe [2011-05-22 09:45] . . ——— X64 Entries ———– . . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2008-06-20 1533736] "SmartMenu"="c:\program files (x86)\Hewlett-Packard\HP MediaSmart\SmartMenu.exe" [BU] "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2009-10-03 16395880] . ——- Supplementary Scan ——- . uStart Page = hxxp://www.google.com/ uLocal Page = c:\windows\system32\blank.htm uDefault_Search_URL = hxxp://www.google.com/ie mStart Page = hxxp://www.yahoo.com mLocal Page = c:\windows\SysWOW64\blank.htm mSearch Bar = hxxp://us.rd.yahoo.com/customize/ie/defaults/sb/msgr9/*http://www.yahoo.com/ext/search/search.html uInternet Settings,ProxyOverride = *.local;192.168.*.* uSearchAssistant = hxxp://www.google.com/ie uSearchURL,(Default) = hxxp://www.google.com/search?q=%s IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200 IE: E&xport to Microsoft Excel - c:\progra~2\MICROS~2\Office12\EXCEL.EXE/3000 Trusted Zone: apollogrp.edu Trusted Zone: rhapsody.com\rhap-app-4-0 Trusted Zone: rhapsody.com\rhapreg TCP: DhcpNameServer = 192.168.1.254 Handler: viprotocol - {B658800C-F66E-4EF3-AB85-6C0C227862A9} - c:\program files (x86)\Common Files\AVG Secure Search\ViProtocolInstaller\12.2.6\ViProtocol.dll CLSID: {603d3801-bd81-11d0-a3a5-00c04fd706ec} - %SystemRoot%\SysWow64\browseui.dll . - - - - ORPHANS REMOVED - - - - . Wow6432Node-HKLM-Run-ROC_ROC_JULY_P1 - c:\program files (x86)\AVG Secure Search\ROC_ROC_JULY_P1.exe WebBrowser-{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39} - (no file) . . . [HKEY_LOCAL_MACHINE\system\ControlSet001\Services\Norton Internet Security] "ImagePath"="\"c:\program files (x86)\Norton Internet Security\Engine\16.0.0.125\ccSvcHst.exe\" /s \"Norton Internet Security\" /m \"c:\program files (x86)\Norton Internet Security\Engine\16.0.0.125\diMaster.dll\" /prefetch:1" . [HKEY_LOCAL_MACHINE\system\ControlSet001\Services\{55662437-DA8C-40c0-AADA-2C816A897A49}] "ImagePath"="\??\c:\program files (x86)\Hewlett-Packard\Media\DVD\000.fcl" . ——————— LOCKED REGISTRY KEYS ——————— . [HKEY_LOCAL_MACHINE\software\Microsoft\Windows CE Services] "SymbolicLinkValue"=hex(6):5c,00,72,00,65,00,67,00,69,00,73,00,74,00,72,00,79, 00,5c,00,4d,00,41,00,43,00,48,00,49,00,4e,00,45,00,5c,00,53,00,4f,00,46,00,\ . [HKEY_LOCAL_MACHINE\software\Wow6432Node\Classes] "SymbolicLinkValue"=hex(6):5c,00,52,00,45,00,47,00,49,00,53,00,54,00,52,00,59, 00,5c,00,4d,00,41,00,43,00,48,00,49,00,4e,00,45,00,5c,00,53,00,4f,00,46,00,\ . [HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 "MSCurrentCountry"=dword:000000b5 . [HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 . [HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 . ———————— Other Running Processes ———————— . c:\program files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe c:\program files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe c:\program files (x86)\AVG\AVG2012\avgfws.exe c:\program files (x86)\AVG\AVG2012\avgwdsvc.exe c:\program files (x86)\Bonjour\mDNSResponder.exe c:\program files (x86)\Motorola Media Link\Lite\NServiceEntry.exe c:\program files (x86)\Flip Video\FlipShare\FlipShareService.exe c:\program files (x86)\Common Files\LightScribe\LSSrvc.exe c:\program files (x86)\Motorola\MotoHelper\MotoHelperService.exe c:\program files (x86)\SMINST\BLService.exe c:\program files (x86)\CyberLink\Shared files\RichVideo.exe c:\programdata\Skype\Toolbars\Skype C2C Service\c2c_service.exe c:\program files (x86)\Hewlett-Packard\Media\TV\Kernel\TV\TVCapSvc.exe c:\program files (x86)\Hewlett-Packard\Media\TV\Kernel\TV\TVSched.exe c:\program files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\12.2.6\ToolbarUpdater.exe c:\program files (x86)\Motorola\MotoHelper\MotoHelperAgent.exe c:\program files (x86)\Yahoo!\SoftwareUpdate\YahooAUService.exe c:\program files (x86)\Spybot - Search & Destroy\SDWinSec.exe c:\program files (x86)\AVG\AVG2012\AVGIDSAgent.exe . ************************************************************************** . Completion time: 2012-09-21 22:00:30 - machine was rebooted ComboFix-quarantined-files.txt 2012-09-22 05:00 ComboFix2.txt 2012-06-30 02:18 . Pre-Run: 182,447,017,984 bytes free Post-Run: 182,391,660,544 bytes free . - - End Of File - - 266FCC58EE736E961798DA8C1789FD89

Tomk

Post #8September 22, 2012, 5:56 AM UTC

COMBOFIX-Script

Please open Notepad (Start -> Run -> type notepad in the Open field -> OK) and copy and paste the text present inside the code box below:
```
Folder::
c:\programdata\blekko toolbars
```
Save this as CFScript.txt and change the "Save as type" to "All Files" and place it on your desktop.

[external image: Posted Image]
Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before following the steps below. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
Referring to the screenshot above, drag CFScript.txt into ComboFix.exe.
ComboFix will now run a scan on your system. It may reboot your system when it finishes. This is normal.
When finished, it shall produce a log for you. Copy and paste the contents of the log in your next reply.

CAUTION: Do not mouse-click ComboFix's window while it is running. That may cause it to stall.

Then:

Please update your Malwarebytes', and run a scan for me. Please post the log.

lesae9

Post #9September 23, 2012, 10:48 PM UTC

Hello again TomK, Thank you again for your prompt response. Here are the logs you've requested. Here's the log from the specific ComboFix Scan you requested. ComboFix 12-06-28.03 - lesae9 09/23/2012 14:58:08.3.2 - x64 Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.1.1033.18.4092.2331 [GMT -7:00] Running from: c:\users\[removed]\Desktop\ComboFix.exe Command switches used :: c:\users\lesae9\Desktop\CFScript.txt AV: AVG Internet Security 2012 *Disabled/Updated* {5A2746B1-DEE9-F85A-FBCD-ADB11639C5F0} FW: AVG Internet Security 2012 *Disabled* {621CC794-9486-F902-D092-0484E8EA828B} SP: AVG Internet Security 2012 *Disabled/Updated* {E146A755-F8D3-F7D4-C17D-96C36DBE8F4D} SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} . . ((((((((((((((((((((((((( Files Created from 2012-08-23 to 2012-09-23 ))))))))))))))))))))))))))))))) . . 2012-09-23 22:07 . 2012-09-23 22:07 ——– d—–w- c:\windows\system32\config\systemprofile\AppData\Local\temp 2012-09-23 22:07 . 2012-09-23 22:07 ——– d—–w- c:\users\Public\AppData\Local\temp 2012-09-23 22:07 . 2012-09-23 22:07 ——– d—–w- c:\users\Guest\AppData\Local\temp 2012-09-23 22:07 . 2012-09-23 22:07 ——– d—–w- c:\users\Default\AppData\Local\temp 2012-09-23 22:07 . 2012-09-23 22:07 ——– d—–w- c:\users\AppData\AppData\Local\temp 2012-09-22 02:38 . 2012-08-30 07:27 9308616 —-a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{EFE682C6-5E0A-42FC-8B98-E2AD9ACDBF3B}\mpengine.dll 2012-09-22 02:10 . 2012-09-22 02:10 ——– d—–w- C:\_OTL 2012-09-13 02:45 . 2012-09-13 02:46 ——– d—–w- c:\program files (x86)\AVG Secure Search 2012-09-13 01:54 . 2012-09-13 01:54 ——– d—–w- c:\users\lesae9\AppData\Local\Wajam 2012-09-13 01:54 . 2012-09-13 01:54 ——– d—–w- c:\program files (x86)\HiDefMedia 2012-09-13 01:53 . 2012-09-13 02:05 ——– d—–w- c:\programdata\blekko toolbars 2012-09-05 01:03 . 2012-09-05 01:03 31080 —-a-w- c:\windows\system32\drivers\avgtpx64.sys 2012-09-03 23:33 . 2012-09-03 23:33 ——– d—–w- c:\programdata\McAfee Security Scan 2012-09-03 23:33 . 2012-09-04 00:44 ——– d—–w- c:\program files (x86)\McAfee Security Scan 2012-09-03 23:30 . 2012-09-03 23:30 ——– d—–w- c:\programdata\McAfee 2012-08-24 22:43 . 2012-08-24 22:43 384352 —-a-w- c:\windows\system32\drivers\avgtdia.sys . . . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2012-09-21 05:54 . 2012-07-05 07:04 73136 —-a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl 2012-09-21 05:54 . 2012-07-05 07:04 696240 —-a-w- c:\windows\SysWow64\FlashPlayerApp.exe 2012-08-29 03:24 . 2012-06-16 18:09 477168 —-a-w- c:\windows\SysWow64\npdeployJava1.dll 2012-08-29 03:24 . 2011-09-23 04:48 473072 —-a-w- c:\windows\SysWow64\deployJava1.dll 2012-08-20 08:18 . 2012-08-20 08:18 602112 —-a-w- c:\windows\SysWow64\xvid.dll 2012-08-11 18:28 . 2012-05-21 23:24 499712 —-a-w- c:\windows\SysWow64\msvcp71.dll 2012-08-11 18:28 . 2012-05-21 23:24 348160 —-a-w- c:\windows\SysWow64\msvcr71.dll 2012-07-26 10:21 . 2012-07-26 10:21 291680 —-a-w- c:\windows\system32\drivers\avgldx64.sys 2012-07-16 01:03 . 2012-07-16 01:03 184891 —-a-w- C:\torrent.exe 2012-07-04 14:33 . 2012-08-15 10:14 2769408 —-a-w- c:\windows\system32\win32k.sys 2012-07-03 20:46 . 2012-06-16 19:24 24904 —-a-w- c:\windows\system32\drivers\mbam.sys . . ((((((((((((((((((((((((((((( SnapShot@2012-06-30_02.09.29 ))))))))))))))))))))))))))))))))))))))))) . + 2012-07-11 20:32 . 2012-06-02 00:05 77312 c:\windows\SysWOW64\secur32.dll - 2012-01-31 12:14 . 2011-11-16 16:24 77312 c:\windows\SysWOW64\secur32.dll + 2012-07-01 15:03 . 2008-12-11 20:26 60273 c:\windows\SysWOW64\pthreadGC2.dll + 2012-09-22 10:01 . 2012-08-24 06:44 73216 c:\windows\SysWOW64\mshtmled.dll - 2012-06-14 01:22 . 2012-05-17 22:25 73216 c:\windows\SysWOW64\mshtmled.dll + 2012-09-22 10:01 . 2012-08-24 06:48 66048 c:\windows\SysWOW64\migration\WininetPlugin.dll - 2012-06-14 01:22 . 2012-05-17 22:31 66048 c:\windows\SysWOW64\migration\WininetPlugin.dll + 2012-09-22 10:01 . 2012-08-24 06:48 65024 c:\windows\SysWOW64\jsproxy.dll - 2012-06-14 01:22 . 2012-05-17 22:31 65024 c:\windows\SysWOW64\jsproxy.dll + 2012-07-01 15:03 . 2008-12-18 02:22 57344 c:\windows\SysWOW64\ff_vfw.dll + 2008-01-21 03:20 . 2012-09-22 10:20 32768 c:\windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat - 2008-01-21 03:20 . 2012-06-30 01:10 32768 c:\windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat + 2008-01-21 03:20 . 2012-09-22 10:20 98304 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat - 2008-01-21 03:20 . 2012-06-30 01:10 98304 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat + 2008-01-21 03:20 . 2012-09-22 10:20 16384 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat - 2008-01-21 03:20 . 2012-06-30 01:10 16384 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat + 2008-01-21 02:23 . 2012-09-22 04:53 98170 c:\windows\system32\WDI\ShutdownPerformanceDiagnostics_SystemData.bin + 2009-03-12 02:53 . 2012-09-22 05:35 37402 c:\windows\system32\WDI\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-2409464188-3064301150-2695696042-1000_UserData.bin + 2012-09-22 10:01 . 2012-08-24 10:10 96768 c:\windows\system32\mshtmled.dll - 2012-06-14 01:22 . 2012-05-18 01:51 96768 c:\windows\system32\mshtmled.dll - 2012-06-14 01:22 . 2012-05-18 01:56 86528 c:\windows\system32\migration\WininetPlugin.dll + 2012-09-22 10:01 . 2012-08-24 10:17 86528 c:\windows\system32\migration\WininetPlugin.dll - 2012-06-14 01:22 . 2012-05-18 01:56 85504 c:\windows\system32\jsproxy.dll + 2012-09-22 10:01 . 2012-08-24 10:17 85504 c:\windows\system32\jsproxy.dll + 2011-05-23 08:03 . 2011-05-23 08:03 48992 c:\windows\system32\DriverStore\FileRepository\avgfwfd6.inf_85b84ac1\avgfwd6a.sys + 2011-11-08 20:59 . 2011-11-08 20:59 11776 c:\windows\system32\drivers\motusbdevice.sys + 2012-01-25 21:58 . 2012-01-25 21:58 27136 c:\windows\system32\drivers\Motousbnet.sys + 2012-01-25 21:57 . 2012-01-25 21:57 30720 c:\windows\system32\drivers\motmodem.sys + 2011-05-23 08:03 . 2011-05-23 08:03 48992 c:\windows\system32\drivers\avgfwd6a.sys - 2009-01-04 08:14 . 2012-06-16 20:36 16384 c:\windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat + 2009-01-04 08:14 . 2012-09-22 02:52 16384 c:\windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat + 2009-01-04 08:14 . 2012-09-22 02:52 32768 c:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat - 2009-01-04 08:14 . 2012-06-16 20:36 32768 c:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat + 2009-01-04 08:14 . 2012-09-22 02:52 16384 c:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat - 2009-01-04 08:14 . 2012-06-16 20:36 16384 c:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat + 2012-08-11 18:29 . 2012-08-11 18:29 18944 c:\windows\Installer\3ecbc16.msi + 2012-08-11 18:28 . 2012-08-11 18:28 92672 c:\windows\Installer\3ecbc0b.msi + 2012-08-15 10:19 . 2012-08-15 10:19 49936 c:\windows\Installer\{95120000-00AF-0409-0000-0000000FF1CE}\ppvwicon.exe - 2012-05-11 18:16 . 2012-05-11 18:16 49936 c:\windows\Installer\{95120000-00AF-0409-0000-0000000FF1CE}\ppvwicon.exe + 2009-03-23 01:13 . 2012-09-16 10:04 35088 c:\windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\oisicon.exe - 2009-03-23 01:13 . 2012-06-14 01:23 35088 c:\windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\oisicon.exe - 2009-03-23 01:13 . 2012-06-14 01:23 18704 c:\windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\mspicons.exe + 2009-03-23 01:13 . 2012-09-16 10:04 18704 c:\windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\mspicons.exe + 2009-03-23 01:13 . 2012-09-16 10:04 20240 c:\windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\cagicon.exe - 2009-03-23 01:13 . 2012-06-14 01:23 20240 c:\windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\cagicon.exe + 2012-08-15 10:19 . 2012-08-15 10:19 35600 c:\windows\Installer\{90120000-0020-0409-0000-0000000FF1CE}\O12ConvIcon.exe - 2012-05-11 18:41 . 2012-05-11 18:41 35600 c:\windows\Installer\{90120000-0020-0409-0000-0000000FF1CE}\O12ConvIcon.exe + 2012-07-19 05:42 . 2012-07-19 05:42 27136 c:\windows\Installer\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}\AppleSoftwareUpdateIco.exe + 2011-07-20 13:28 . 2011-07-20 13:28 54104 c:\windows\Installer\$PatchCache$\Managed\00002109030000000000000000F01FEC\12.0.6612\SCANOST.EXE + 2011-07-20 13:28 . 2011-07-20 13:28 75624 c:\windows\Installer\$PatchCache$\Managed\00002109030000000000000000F01FEC\12.0.6612\RM.DLL + 2011-07-20 13:28 . 2011-07-20 13:28 38248 c:\windows\Installer\$PatchCache$\Managed\00002109030000000000000000F01FEC\12.0.6612\RECALL.DLL + 2011-05-27 03:18 . 2011-05-27 03:18 52088 c:\windows\Installer\$PatchCache$\Managed\00002109030000000000000000F01FEC\12.0.6612\OUTLVBA.DLL + 2011-07-20 13:28 . 2011-07-20 13:28 34208 c:\windows\Installer\$PatchCache$\Managed\00002109030000000000000000F01FEC\12.0.6612\DUMPSTER.DLL + 2011-07-20 13:28 . 2011-07-20 13:28 87408 c:\windows\Installer\$PatchCache$\Managed\00002109030000000000000000F01FEC\12.0.6612\DLGSETP.DLL - 2006-11-02 12:40 . 2012-02-24 05:18 86016 c:\windows\inf\infstor.dat + 2006-11-02 12:40 . 2012-09-13 02:42 86016 c:\windows\inf\infstor.dat + 2006-11-02 12:40 . 2012-09-13 02:42 51200 c:\windows\inf\infpub.dat - 2006-11-02 12:40 . 2012-02-24 05:18 51200 c:\windows\inf\infpub.dat - 2012-05-21 23:24 . 2012-05-21 23:24 5632 c:\windows\SysWOW64\pndx5032.dll + 2012-05-21 23:24 . 2012-08-11 18:28 5632 c:\windows\SysWOW64\pndx5032.dll + 2012-05-21 23:24 . 2012-08-11 18:28 6656 c:\windows\SysWOW64\pndx5016.dll - 2012-05-21 23:24 . 2012-05-21 23:24 6656 c:\windows\SysWOW64\pndx5016.dll + 2009-03-14 07:58 . 2012-09-14 08:03 3404 c:\windows\system32\WDI\ERCQueuedResolutions.dat + 2012-08-27 07:49 . 2012-08-27 07:49 9560 c:\windows\system32\networklist\icons\{43A30118-0632-4A10-9545-B7D675A0D1BA}_48.bin + 2012-08-27 07:49 . 2012-08-27 07:49 4280 c:\windows\system32\networklist\icons\{43A30118-0632-4A10-9545-B7D675A0D1BA}_32.bin + 2012-08-27 07:49 . 2012-08-27 07:49 2456 c:\windows\system32\networklist\icons\{43A30118-0632-4A10-9545-B7D675A0D1BA}_24.bin + 2009-01-30 01:11 . 2009-01-30 01:11 6144 c:\windows\system32\drivers\motfilt.sys - 2012-06-30 02:07 . 2012-06-30 02:07 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat + 2012-09-23 22:09 . 2012-09-23 22:09 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat - 2012-06-30 02:07 . 2012-06-30 02:07 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat + 2012-09-23 22:09 . 2012-09-23 22:09 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat - 2011-11-04 08:04 . 2011-11-04 08:04 420864 c:\windows\SysWOW64\vbscript.dll + 2012-09-22 10:01 . 2012-08-24 06:47 420864 c:\windows\SysWOW64\vbscript.dll - 2012-06-14 01:22 . 2012-05-17 22:33 231936 c:\windows\SysWOW64\url.dll + 2012-09-22 10:01 . 2012-08-24 06:49 231936 c:\windows\SysWOW64\url.dll + 2012-07-11 20:32 . 2012-06-02 00:04 278528 c:\windows\SysWOW64\schannel.dll - 2012-01-31 12:14 . 2011-11-16 16:23 278528 c:\windows\SysWOW64\schannel.dll + 2012-05-21 23:24 . 2012-08-11 18:28 198864 c:\windows\SysWOW64\rmoc3260.dll + 2012-05-21 23:24 . 2012-08-11 18:28 272896 c:\windows\SysWOW64\pncrt.dll - 2012-05-21 23:24 . 2012-05-21 23:24 272896 c:\windows\SysWOW64\pncrt.dll + 2012-08-15 01:23 . 2012-06-29 16:01 467968 c:\windows\SysWOW64\netapi32.dll - 2009-12-04 06:41 . 2009-04-11 06:28 204288 c:\windows\SysWOW64\ncrypt.dll + 2012-07-11 20:32 . 2012-06-02 00:03 204288 c:\windows\SysWOW64\ncrypt.dll + 2012-09-22 10:01 . 2012-08-24 06:45 607744 c:\windows\SysWOW64\msfeeds.dll + 2012-09-21 05:54 . 2012-09-21 05:54 690096 c:\windows\SysWOW64\Macromed\Flash\FlashUtil32_11_4_402_278_Plugin.exe + 2012-07-05 07:04 . 2012-09-21 05:54 250288 c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe - 2009-06-12 00:52 . 2009-04-23 12:14 623616 c:\windows\SysWOW64\localspl.dll + 2012-08-15 01:24 . 2012-05-11 15:57 623616 c:\windows\SysWOW64\localspl.dll + 2012-09-22 10:01 . 2012-08-24 06:47 717824 c:\windows\SysWOW64\jscript.dll + 2012-09-03 23:32 . 2012-08-29 03:10 157680 c:\windows\SysWOW64\javaws.exe + 2012-09-03 23:32 . 2012-08-29 03:10 149488 c:\windows\SysWOW64\javaw.exe + 2012-09-03 23:32 . 2012-08-29 03:09 149488 c:\windows\SysWOW64\java.exe + 2012-09-22 10:01 . 2012-08-24 06:47 142848 c:\windows\SysWOW64\ieUnatt.exe - 2012-06-14 01:22 . 2012-05-17 22:29 142848 c:\windows\SysWOW64\ieUnatt.exe + 2012-09-22 10:01 . 2012-08-24 06:40 176640 c:\windows\SysWOW64\ieui.dll - 2012-06-14 01:22 . 2012-05-17 22:20 176640 c:\windows\SysWOW64\ieui.dll + 2009-03-15 23:11 . 2012-09-22 16:55 408146 c:\windows\system32\WDI\SuspendPerformanceDiagnostics_SystemData_S4.bin + 2009-03-12 04:28 . 2012-09-22 22:26 301884 c:\windows\system32\WDI\SuspendPerformanceDiagnostics_SystemData_S3.bin + 2006-11-02 15:45 . 2012-09-23 21:46 117264 c:\windows\system32\WDI\BootPerformanceDiagnostics_SystemData.bin + 2012-09-22 10:01 . 2012-08-24 10:13 599040 c:\windows\system32\vbscript.dll - 2012-06-14 01:22 . 2012-05-18 01:58 237056 c:\windows\system32\url.dll + 2012-09-22 10:01 . 2012-08-24 10:18 237056 c:\windows\system32\url.dll - 2012-01-31 12:14 . 2011-11-16 16:42 347136 c:\windows\system32\schannel.dll + 2012-07-11 20:32 . 2012-06-02 00:22 347136 c:\windows\system32\schannel.dll - 2006-11-02 12:46 . 2012-06-16 14:59 604502 c:\windows\system32\perfh009.dat + 2006-11-02 12:46 . 2012-08-28 02:24 604502 c:\windows\system32\perfh009.dat - 2006-11-02 12:46 . 2012-06-16 14:59 104170 c:\windows\system32\perfc009.dat + 2006-11-02 12:46 . 2012-08-28 02:24 104170 c:\windows\system32\perfc009.dat + 2012-08-15 01:23 . 2012-06-29 16:20 648192 c:\windows\system32\netapi32.dll - 2009-12-04 06:41 . 2009-04-11 07:11 648192 c:\windows\system32\netapi32.dll + 2012-07-11 20:32 . 2012-06-02 00:22 254464 c:\windows\system32\ncrypt.dll + 2012-09-22 10:01 . 2012-08-24 10:11 729088 c:\windows\system32\msfeeds.dll + 2009-10-03 21:24 . 2012-05-31 19:25 279656 c:\windows\system32\MpSigStub.exe + 2012-09-21 05:54 . 2012-09-21 05:54 420272 c:\windows\system32\Macromed\Flash\FlashUtil64_11_4_402_278_Plugin.exe + 2012-08-15 01:24 . 2012-05-11 16:34 788480 c:\windows\system32\localspl.dll + 2012-09-22 10:01 . 2012-08-24 10:14 816640 c:\windows\system32\jscript.dll + 2012-09-22 10:01 . 2012-08-24 10:14 173056 c:\windows\system32\ieUnatt.exe - 2012-06-14 01:22 . 2012-05-18 01:55 173056 c:\windows\system32\ieUnatt.exe + 2012-09-22 10:01 . 2012-08-24 10:04 248320 c:\windows\system32\ieui.dll - 2012-06-14 01:22 . 2012-05-18 01:47 248320 c:\windows\system32\ieui.dll + 2006-11-02 15:21 . 2012-08-15 10:40 393248 c:\windows\system32\FNTCACHE.DAT - 2006-11-02 15:21 . 2012-06-14 02:00 393248 c:\windows\system32\FNTCACHE.DAT + 2012-07-11 20:32 . 2012-06-04 15:29 516480 c:\windows\system32\drivers\ksecdd.sys + 2009-01-04 09:03 . 2012-09-23 22:07 336584 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache3.0.0.0.dat - 2009-01-04 09:03 . 2012-06-30 02:05 336584 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache3.0.0.0.dat + 2011-02-10 16:48 . 2012-09-23 22:07 378288 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-System.dat - 2011-02-10 16:48 . 2012-06-30 02:05 378288 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-System.dat - 2011-11-12 18:06 . 2012-06-23 15:12 980504 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-S-1-5-21-2409464188-3064301150-2695696042-1000-12288.dat + 2011-11-12 18:06 . 2012-09-13 02:50 980504 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-S-1-5-21-2409464188-3064301150-2695696042-1000-12288.dat + 2012-07-01 15:04 . 2012-07-01 15:04 228352 c:\windows\Installer\3ac22c.msi + 2012-07-18 22:46 . 2012-07-18 22:46 593408 c:\windows\Installer\16b0dcf.msp - 2012-06-10 18:31 . 2012-06-10 18:31 371272 c:\windows\Installer\{EE7257A2-39A2-4D2F-9DAC-F9F25B8AE1D8}\SkypeIcon.exe + 2012-09-07 01:02 . 2012-09-07 01:02 371272 c:\windows\Installer\{EE7257A2-39A2-4D2F-9DAC-F9F25B8AE1D8}\SkypeIcon.exe - 2009-03-23 01:13 . 2012-06-14 01:23 888080 c:\windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\wordicon.exe + 2009-03-23 01:13 . 2012-09-16 10:04 888080 c:\windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\wordicon.exe - 2009-03-23 01:13 . 2012-06-14 01:23 272648 c:\windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\pubs.exe + 2009-03-23 01:13 . 2012-09-16 10:04 272648 c:\windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\pubs.exe - 2009-03-23 01:13 . 2012-06-14 01:23 922384 c:\windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\pptico.exe + 2009-03-23 01:13 . 2012-09-16 10:04 922384 c:\windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\pptico.exe + 2009-03-23 01:13 . 2012-09-16 10:04 845584 c:\windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\outicon.exe - 2009-03-23 01:13 . 2012-06-14 01:23 845584 c:\windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\outicon.exe + 2009-03-23 01:13 . 2012-09-16 10:04 217864 c:\windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\misc.exe - 2009-03-23 01:13 . 2012-06-14 01:23 217864 c:\windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\misc.exe - 2009-03-23 01:13 . 2012-06-14 01:23 184080 c:\windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\joticon.exe + 2009-03-23 01:13 . 2012-09-16 10:04 184080 c:\windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\joticon.exe + 2009-03-23 01:13 . 2012-09-16 10:04 159504 c:\windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\inficon.exe - 2009-03-23 01:13 . 2012-06-14 01:23 159504 c:\windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\inficon.exe + 2011-06-06 20:55 . 2011-06-06 20:55 686464 c:\windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744AA0100000010\10.1.0\JP2KLib.dll + 2012-01-03 07:37 . 2012-01-03 07:37 320456 c:\windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744AA0100000010\10.1.0\adobearmhelper.exe + 2011-06-06 19:55 . 2011-06-06 19:55 937920 c:\windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744AA0100000010\10.1.0\adobearm.exe + 2011-07-20 13:28 . 2011-07-20 13:28 282032 c:\windows\Installer\$PatchCache$\Managed\00002109030000000000000000F01FEC\12.0.6612\SCNPST64.DLL + 2011-07-20 13:28 . 2011-07-20 13:28 273832 c:\windows\Installer\$PatchCache$\Managed\00002109030000000000000000F01FEC\12.0.6612\SCNPST32.DLL + 2011-07-27 11:55 . 2011-07-27 11:55 410992 c:\windows\Installer\$PatchCache$\Managed\00002109030000000000000000F01FEC\12.0.6612\RTFHTML.DLL + 2011-07-20 14:06 . 2011-07-20 14:06 770480 c:\windows\Installer\$PatchCache$\Managed\00002109030000000000000000F01FEC\12.0.6612\REGFORM.EXE + 2011-07-20 13:28 . 2011-07-20 13:28 421736 c:\windows\Installer\$PatchCache$\Managed\00002109030000000000000000F01FEC\12.0.6612\PSTPRX32.DLL + 2011-05-31 23:15 . 2011-05-31 23:15 177040 c:\windows\Installer\$PatchCache$\Managed\00002109030000000000000000F01FEC\12.0.6612\OUTLPH.DLL + 2011-07-27 11:55 . 2011-07-27 11:55 596888 c:\windows\Installer\$PatchCache$\Managed\00002109030000000000000000F01FEC\12.0.6612\OUTLMIME.DLL + 2011-05-27 03:18 . 2011-05-27 03:18 136536 c:\windows\Installer\$PatchCache$\Managed\00002109030000000000000000F01FEC\12.0.6612\OUTLCTL.DLL + 2011-07-27 13:03 . 2011-07-27 13:03 194448 c:\windows\Installer\$PatchCache$\Managed\00002109030000000000000000F01FEC\12.0.6612\OMSXP32.DLL + 2011-07-27 13:03 . 2011-07-27 13:03 661888 c:\windows\Installer\$PatchCache$\Managed\00002109030000000000000000F01FEC\12.0.6612\OMSMAIN.DLL + 2011-07-20 13:28 . 2011-07-20 13:28 253824 c:\windows\Installer\$PatchCache$\Managed\00002109030000000000000000F01FEC\12.0.6612\OLKFSTUB.DLL + 2011-06-23 16:54 . 2011-06-23 16:54 119160 c:\windows\Installer\$PatchCache$\Managed\00002109030000000000000000F01FEC\12.0.6612\MSCONV97.DLL + 2011-07-20 13:28 . 2011-07-20 13:28 340320 c:\windows\Installer\$PatchCache$\Managed\00002109030000000000000000F01FEC\12.0.6612\MIMEDIR.DLL + 2011-11-05 02:31 . 2011-11-05 02:31 117160 c:\windows\Installer\$PatchCache$\Managed\00002109030000000000000000F01FEC\12.0.6612\IPOMINT.DLL + 2011-07-20 14:06 . 2011-07-20 14:06 176024 c:\windows\Installer\$PatchCache$\Managed\00002109030000000000000000F01FEC\12.0.6612\IPOLK.DLL + 2011-07-20 13:28 . 2011-07-20 13:28 138088 c:\windows\Installer\$PatchCache$\Managed\00002109030000000000000000F01FEC\12.0.6612\IMPMAIL.DLL + 2011-05-27 03:18 . 2011-05-27 03:18 115584 c:\windows\Installer\$PatchCache$\Managed\00002109030000000000000000F01FEC\12.0.6612\EMABLT32.DLL + 2011-07-27 11:55 . 2011-07-27 11:55 128376 c:\windows\Installer\$PatchCache$\Managed\00002109030000000000000000F01FEC\12.0.6612\CONTAB32.DLL + 2006-11-02 12:40 . 2012-09-13 02:42 143360 c:\windows\inf\infstrng.dat - 2006-11-02 12:40 . 2012-02-24 05:18 143360 c:\windows\inf\infstrng.dat + 2012-07-14 20:44 . 2012-07-14 20:44 117160 c:\windows\assembly\GAC_32\Microsoft.Office.InfoPath.Client.Internal.Host.Interop\12.0.0.0__71e9bce111e9429c\Microsoft.Office.Infopath.Client.Internal.Host.Interop.dll - 2011-11-05 02:31 . 2011-11-05 02:31 117160 c:\windows\assembly\GAC_32\Microsoft.Office.InfoPath.Client.Internal.Host.Interop\12.0.0.0__71e9bce111e9429c\Microsoft.Office.Infopath.Client.Internal.Host.Interop.dll + 2012-09-22 10:01 . 2012-08-24 06:51 1129472 c:\windows\SysWOW64\wininet.dll - 2012-06-14 01:22 . 2012-05-17 22:35 1129472 c:\windows\SysWOW64\wininet.dll - 2012-06-14 01:22 . 2012-05-17 22:36 1103872 c:\windows\SysWOW64\urlmon.dll + 2012-09-22 10:01 . 2012-08-24 06:51 1103872 c:\windows\SysWOW64\urlmon.dll - 2009-11-25 07:18 . 2009-08-11 16:44 1401856 c:\windows\SysWOW64\msxml6.dll + 2012-07-11 20:32 . 2012-06-05 16:47 1401856 c:\windows\SysWOW64\msxml6.dll - 2010-08-13 04:11 . 2010-06-11 16:15 1248768 c:\windows\SysWOW64\msxml3.dll + 2012-07-11 20:32 . 2012-06-05 16:47 1248768 c:\windows\SysWOW64\msxml3.dll + 2012-09-21 05:54 . 2012-09-21 05:54 9813424 c:\windows\SysWOW64\Macromed\Flash\NPSWF32_11_4_402_278.dll + 2012-09-21 05:54 . 2012-09-21 05:54 1807280 c:\windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_4_402_278.exe + 2012-09-22 10:01 . 2012-08-24 06:59 1800704 c:\windows\SysWOW64\jscript9.dll + 2012-09-22 10:01 . 2012-08-24 06:44 1793024 c:\windows\SysWOW64\iertutil.dll - 2012-06-14 01:22 . 2012-05-17 22:27 1793024 c:\windows\SysWOW64\iertutil.dll + 2012-09-22 10:01 . 2012-08-24 07:03 9738240 c:\windows\SysWOW64\ieframe.dll + 2012-05-24 21:18 . 2012-05-24 21:18 4472832 c:\windows\SysWOW64\GPhotos.scr - 2012-06-14 01:22 . 2012-05-18 01:59 1392128 c:\windows\system32\wininet.dll + 2012-09-22 10:01 . 2012-08-24 10:21 1392128 c:\windows\system32\wininet.dll + 2012-09-22 10:01 . 2012-08-24 10:22 1346048 c:\windows\system32\urlmon.dll - 2012-06-14 01:22 . 2012-05-18 01:59 1346048 c:\windows\system32\urlmon.dll + 2012-07-11 20:32 . 2012-06-05 16:22 1797120 c:\windows\system32\msxml6.dll - 2009-11-25 07:18 . 2009-08-11 17:06 1797120 c:\windows\system32\msxml6.dll - 2010-08-13 04:11 . 2010-06-11 16:38 1869824 c:\windows\system32\msxml3.dll + 2012-07-11 20:32 . 2012-06-05 16:22 1869824 c:\windows\system32\msxml3.dll + 2012-09-22 10:01 . 2012-08-24 10:31 2312704 c:\windows\system32\jscript9.dll - 2012-06-14 01:22 . 2012-05-18 01:54 2144768 c:\windows\system32\iertutil.dll + 2012-09-22 10:01 . 2012-08-24 10:12 2144768 c:\windows\system32\iertutil.dll + 2011-11-05 17:36 . 2012-09-23 22:07 2294140 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-S-1-5-21-2409464188-3064301150-2695696042-1000-8192.dat + 2012-05-30 14:18 . 2012-05-30 14:18 1739264 c:\windows\Installer\ae124.msp + 2012-06-19 19:54 . 2012-06-19 19:54 2239488 c:\windows\Installer\ae11a.msp + 2012-06-19 19:54 . 2012-06-19 19:54 5009920 c:\windows\Installer\ae103.msp + 2012-04-05 05:37 . 2012-04-05 05:37 2540544 c:\windows\Installer\ae0ec.msp + 2012-04-05 05:37 . 2012-04-05 05:37 3149824 c:\windows\Installer\ae0d5.msp + 2012-07-19 00:37 . 2012-07-19 00:37 9474048 c:\windows\Installer\8ae67.msi + 2012-09-07 01:03 . 2012-09-07 01:03 1259008 c:\windows\Installer\6c10f.msi + 2012-09-07 01:02 . 2012-09-07 01:02 1648640 c:\windows\Installer\6c108.msi + 2012-09-11 00:43 . 2012-09-11 00:43 8465408 c:\windows\Installer\68e95.msi + 2012-09-19 19:13 . 2012-09-19 19:13 2871808 c:\windows\Installer\4686b.msi + 2012-08-30 10:06 . 2012-08-30 10:06 5007872 c:\windows\Installer\1783a00.msp + 2012-06-27 01:03 . 2012-06-27 01:03 3875840 c:\windows\Installer\16b0def.msp + 2012-07-18 22:53 . 2012-07-18 22:53 5009920 c:\windows\Installer\16b0d93.msp + 2012-07-19 05:42 . 2012-07-19 05:42 1769984 c:\windows\Installer\1098a6.msi - 2009-03-23 01:13 . 2012-06-14 01:23 1172240 c:\windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\xlicons.exe + 2009-03-23 01:13 . 2012-09-16 10:04 1172240 c:\windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\xlicons.exe + 2009-03-23 01:13 . 2012-09-16 10:04 1165584 c:\windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\accicons.exe - 2009-03-23 01:13 . 2012-06-14 01:23 1165584 c:\windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\accicons.exe + 2011-06-06 20:55 . 2011-06-06 20:55 5509512 c:\windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744AA0100000010\10.1.0\AGM.dll + 2011-07-27 11:55 . 2011-07-27 11:55 3004800 c:\windows\Installer\$PatchCache$\Managed\00002109030000000000000000F01FEC\12.0.6612\OLMAPI32.DLL + 2011-07-27 12:09 . 2011-07-27 12:09 5310848 c:\windows\Installer\$PatchCache$\Managed\00002109030000000000000000F01FEC\12.0.6612\IPEDITOR.DLL + 2011-07-27 12:09 . 2011-07-27 12:09 5484416 c:\windows\Installer\$PatchCache$\Managed\00002109030000000000000000F01FEC\12.0.6612\IPDESIGN.DLL + 2011-07-27 12:09 . 2011-07-27 12:09 1460088 c:\windows\Installer\$PatchCache$\Managed\00002109030000000000000000F01FEC\12.0.6612\INFOPATH.EXE - 2011-02-09 00:55 . 2011-01-21 16:35 11586048 c:\windows\SysWOW64\shell32.dll + 2012-07-11 20:32 . 2012-06-08 17:47 11586048 c:\windows\SysWOW64\shell32.dll + 2012-09-22 10:01 . 2012-08-24 07:27 12319744 c:\windows\SysWOW64\mshtml.dll + 2006-11-02 12:33 . 2012-09-22 10:19 11010048 c:\windows\system32\SMI\Store\Machine\schema.dat - 2006-11-02 12:33 . 2012-06-23 04:30 11010048 c:\windows\system32\SMI\Store\Machine\schema.dat + 2012-07-11 20:32 . 2012-06-08 17:59 12899840 c:\windows\system32\shell32.dll - 2011-02-09 00:55 . 2011-01-21 16:50 12899840 c:\windows\system32\shell32.dll + 2012-09-22 10:01 . 2012-08-24 11:15 17810944 c:\windows\system32\mshtml.dll + 2006-11-02 12:35 . 2012-08-15 10:02 62134624 c:\windows\system32\mrt.exe + 2012-09-21 05:54 . 2012-09-21 05:54 12812208 c:\windows\system32\Macromed\Flash\NPSWF64_11_4_402_278.dll + 2012-09-22 10:01 . 2012-08-24 10:39 10925568 c:\windows\system32\ieframe.dll + 2012-05-30 14:18 . 2012-05-30 14:18 11885056 c:\windows\Installer\ae154.msp + 2012-07-28 01:47 . 2012-07-28 01:47 13123584 c:\windows\Installer\42462.msp + 2012-07-25 23:59 . 2012-07-25 23:59 11032064 c:\windows\Installer\16b0de6.msp + 2012-07-18 22:53 . 2012-07-18 22:53 10937344 c:\windows\Installer\16b0d9c.msp + 2011-08-04 01:18 . 2011-08-04 01:18 12997488 c:\windows\Installer\$PatchCache$\Managed\00002109030000000000000000F01FEC\12.0.6612\OUTLOOK.EXE + 2011-08-04 02:53 . 2011-08-04 02:53 17324928 c:\windows\Installer\$PatchCache$\Managed\00002109020090400000000000F01FEC\12.0.6612\MSO.DLL . – Snapshot reset to current date – . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 . [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks] "{81017EA9-9AA8-4A6A-9734-7AF40E7D593F}"= "c:\program files (x86)\Yahoo!\Companion\Installs\cpn3\yt.dll" [2012-01-12 1517368] . [HKEY_CLASSES_ROOT\clsid\{81017ea9-9aa8-4a6a-9734-7af40e7d593f}] [HKEY_CLASSES_ROOT\yt.YTNavAssistPlugin.1] [HKEY_CLASSES_ROOT\TypeLib\{003028C2-EA1C-4676-A316-B5CB50917002}] [HKEY_CLASSES_ROOT\yt.YTNavAssistPlugin] . [HKEY_LOCAL_MACHINE\Wow6432Node\~\Browser Helper Objects\{95B7759C-8C7F-4BF1-B163-73684A933233}] 2012-09-13 02:45 1734240 —-a-w- c:\program files (x86)\AVG Secure Search\12.2.5.34\AVG Secure Search_toolbar.dll . [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar] "{95B7759C-8C7F-4BF1-B163-73684A933233}"= "c:\program files (x86)\AVG Secure Search\12.2.5.34\AVG Secure Search_toolbar.dll" [2012-09-13 1734240] . [HKEY_CLASSES_ROOT\clsid\{95b7759c-8c7f-4bf1-b163-73684a933233}] [HKEY_CLASSES_ROOT\AVG Secure Search.PugiObj.1] [HKEY_CLASSES_ROOT\AVG Secure Search.PugiObj] . [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-21 138240] "googletalk"="c:\users\lesae9\AppData\Roaming\Google\Google Talk\googletalk.exe" [2007-01-01 3739648] "Messenger (Yahoo!)"="c:\progra~2\Yahoo!\MESSEN~1\YahooMessenger.exe" [2010-05-11 5252408] "MotoCast"="c:\program files (x86)\Motorola Mobility\MotoCast\MotoLauncher.lnk" [2012-03-14 1886] "Skype"="c:\program files (x86)\Skype\Phone\Skype.exe" [2012-07-13 17420464] "SpybotSD TeaTimer"="c:\program files (x86)\Spybot - Search & Destroy\TeaTimer.exe" [2009-03-05 2260480] "MusicManager"="c:\users\lesae9\AppData\Local\Programs\Google\MusicManager\MusicManager.exe" [2012-08-31 7321600] "Tango"="c:\program files (x86)\Tango\Tango.exe" [2011-11-04 13489992] "HLBackupScheduler"="c:\program files\Backup Assistant Plus\V CAST Backup Scheduler.exe" [2012-08-20 7065224] . [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] "AVG_TRAY"="c:\program files (x86)\AVG\AVG2012\avgtray.exe" [2012-07-31 2596984] "iTunesHelper"="c:\program files (x86)\iTunes\iTunesHelper.exe" [2010-12-14 421160] "GrooveMonitor"="c:\program files (x86)\Microsoft Office\Office12\GrooveMonitor.exe" [2009-02-27 30040] "vProt"="c:\program files (x86)\AVG Secure Search\vprot.exe" [2012-09-13 947808] "Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-07-27 919008] "DivXUpdate"="c:\program files (x86)\DivX\DivX Update\DivXUpdate.exe" [2011-07-28 1259376] "SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2012-01-18 254696] "QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" [2012-04-19 421888] "TkBellExe"="c:\program files (x86)\real\realplayer\Update\realsched.exe" [2012-08-11 296096] "ROC_ROC_NT"="c:\program files (x86)\AVG Secure Search\ROC_ROC_NT.exe" [2012-09-13 856160] . c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\ McAfee Security Scan Plus.lnk - c:\program files (x86)\McAfee Security Scan\2.1.121\SSScheduler.exe [2010-9-2 255536] . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "EnableUIADesktopToggle"= 0 (0x0) . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32] "mixer1"=wdmaud.drv . [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager] BootExecute REG_MULTI_SZ autocheck autochk *\0c:\progra~2\AVG\AVG2012\avgrsa.exe /sync /restart . [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys] @="Driver" . R3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-09-21 250288] S2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2012-07-27 63960] . . HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs Themes . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}] 2008-06-09 18:14 451872 —-a-w- c:\program files (x86)\Common Files\LightScribe\LSRunOnce.exe . Contents of the 'Scheduled Tasks' folder . 2012-09-23 c:\windows\Tasks\Adobe Flash Player Updater.job - c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-07-05 05:54] . 2012-09-23 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2409464188-3064301150-2695696042-1000Core.job - c:\users\lesae9\AppData\Local\Google\Update\GoogleUpdate.exe [2011-11-04 05:41] . 2012-09-23 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2409464188-3064301150-2695696042-1000UA.job - c:\users\lesae9\AppData\Local\Google\Update\GoogleUpdate.exe [2011-11-04 05:41] . 2012-09-17 c:\windows\Tasks\Norton Security Scan for lesae9.job - c:\progra~2\NORTON~2\Engine\312~1.9\Nss.exe [2011-05-22 09:45] . . ——— X64 Entries ———– . . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2008-06-20 1533736] "SmartMenu"="c:\program files (x86)\Hewlett-Packard\HP MediaSmart\SmartMenu.exe" [BU] "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2009-10-03 16395880] . ——- Supplementary Scan ——- . uStart Page = hxxp://www.google.com/ uLocal Page = c:\windows\system32\blank.htm uDefault_Search_URL = hxxp://www.google.com/ie mStart Page = hxxp://www.yahoo.com mLocal Page = c:\windows\SysWOW64\blank.htm mSearch Bar = hxxp://us.rd.yahoo.com/customize/ie/defaults/sb/msgr9/*http://www.yahoo.com/ext/search/search.html uInternet Settings,ProxyOverride = *.local;192.168.*.* uSearchAssistant = hxxp://www.google.com/ie uSearchURL,(Default) = hxxp://www.google.com/search?q=%s IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200 IE: E&xport to Microsoft Excel - c:\progra~2\MICROS~2\Office12\EXCEL.EXE/3000 Trusted Zone: apollogrp.edu Trusted Zone: rhapsody.com\rhap-app-4-0 Trusted Zone: rhapsody.com\rhapreg TCP: DhcpNameServer = 192.168.1.254 Handler: viprotocol - {B658800C-F66E-4EF3-AB85-6C0C227862A9} - c:\program files (x86)\Common Files\AVG Secure Search\ViProtocolInstaller\12.2.6\ViProtocol.dll CLSID: {603d3801-bd81-11d0-a3a5-00c04fd706ec} - %SystemRoot%\SysWow64\browseui.dll . - - - - ORPHANS REMOVED - - - - . WebBrowser-{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39} - (no file) . . . [HKEY_LOCAL_MACHINE\system\ControlSet001\Services\Norton Internet Security] "ImagePath"="\"c:\program files (x86)\Norton Internet Security\Engine\16.0.0.125\ccSvcHst.exe\" /s \"Norton Internet Security\" /m \"c:\program files (x86)\Norton Internet Security\Engine\16.0.0.125\diMaster.dll\" /prefetch:1" . [HKEY_LOCAL_MACHINE\system\ControlSet001\Services\{55662437-DA8C-40c0-AADA-2C816A897A49}] "ImagePath"="\??\c:\program files (x86)\Hewlett-Packard\Media\DVD\000.fcl" . ——————— LOCKED REGISTRY KEYS ——————— . [HKEY_LOCAL_MACHINE\software\Microsoft\Windows CE Services] "SymbolicLinkValue"=hex(6):5c,00,72,00,65,00,67,00,69,00,73,00,74,00,72,00,79, 00,5c,00,4d,00,41,00,43,00,48,00,49,00,4e,00,45,00,5c,00,53,00,4f,00,46,00,\ . [HKEY_LOCAL_MACHINE\software\Wow6432Node\Classes] "SymbolicLinkValue"=hex(6):5c,00,52,00,45,00,47,00,49,00,53,00,54,00,52,00,59, 00,5c,00,4d,00,41,00,43,00,48,00,49,00,4e,00,45,00,5c,00,53,00,4f,00,46,00,\ . [HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 "MSCurrentCountry"=dword:000000b5 . [HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 . [HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 . ———————— Other Running Processes ———————— . c:\program files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe c:\program files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe c:\program files (x86)\AVG\AVG2012\avgfws.exe c:\program files (x86)\AVG\AVG2012\avgwdsvc.exe c:\program files (x86)\Bonjour\mDNSResponder.exe c:\program files (x86)\Motorola Media Link\Lite\NServiceEntry.exe c:\program files (x86)\Flip Video\FlipShare\FlipShareService.exe c:\program files (x86)\Common Files\LightScribe\LSSrvc.exe c:\program files (x86)\Motorola\MotoHelper\MotoHelperService.exe c:\program files (x86)\SMINST\BLService.exe c:\program files (x86)\CyberLink\Shared files\RichVideo.exe c:\programdata\Skype\Toolbars\Skype C2C Service\c2c_service.exe c:\program files (x86)\Hewlett-Packard\Media\TV\Kernel\TV\TVCapSvc.exe c:\program files (x86)\Hewlett-Packard\Media\TV\Kernel\TV\TVSched.exe c:\program files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\12.2.6\ToolbarUpdater.exe c:\program files (x86)\Yahoo!\SoftwareUpdate\YahooAUService.exe c:\program files (x86)\Spybot - Search & Destroy\SDWinSec.exe c:\program files (x86)\AVG\AVG2012\AVGIDSAgent.exe c:\program files (x86)\Motorola\MotoHelper\MotoHelperAgent.exe c:\program files (x86)\Motorola Mobility\MotoCast\MotoCast.exe . ************************************************************************** . Completion time: 2012-09-23 15:23:52 - machine was rebooted ComboFix-quarantined-files.txt 2012-09-23 22:23 ComboFix2.txt 2012-09-22 05:00 ComboFix3.txt 2012-06-30 02:18 . Pre-Run: 182,232,100,864 bytes free Post-Run: 182,170,796,032 bytes free . - - End Of File - - 857FFFAE8EC046B97773DADF61E341FE Here's the log from my updated Malware Bytes scan Malwarebytes Anti-Malware 1.65.0.1400 www.malwarebytes.org Database version: v2012.09.23.07 Windows Vista Service Pack 2 x64 NTFS Internet Explorer 9.0.8112.16421 lesae9 :: LESAE9-PC [administrator] 9/23/2012 3:38:48 PM mbam-log-2012-09-23 (15-38-48).txt Scan type: Quick scan Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM Scan options disabled: P2P Objects scanned: 242630 Time elapsed: 4 minute(s), 37 second(s) Memory Processes Detected: 0 (No malicious items detected) Memory Modules Detected: 0 (No malicious items detected) Registry Keys Detected: 0 (No malicious items detected) Registry Values Detected: 0 (No malicious items detected) Registry Data Items Detected: 0 (No malicious items detected) Folders Detected: 0 (No malicious items detected) Files Detected: 0 (No malicious items detected) (end) Please let me know what else I must do to resolve this issue, Thank you again!!

Tomk

Post #10September 24, 2012, 1:39 AM UTC

For some reason the script did not work. Please try it again. The script has two lines: Folder:: c:\programdata\blekko toolbars It needs to be saved exactly like this.

lesae9

Post #11September 24, 2012, 7:37 AM UTC

Hello TomK, I believe I followed the directions perfectly once again. Here is the log. ComboFix 12-06-28.03 - lesae9 09/23/2012 23:49:25.5.2 - x64 Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.1.1033.18.4092.1955 [GMT -7:00] Running from: c:\users\[removed]\Desktop\ComboFix.exe Command switches used :: c:\users\lesae9\Desktop\CFScript.txt AV: AVG Internet Security 2012 *Disabled/Updated* {5A2746B1-DEE9-F85A-FBCD-ADB11639C5F0} FW: AVG Internet Security 2012 *Disabled* {621CC794-9486-F902-D092-0484E8EA828B} SP: AVG Internet Security 2012 *Disabled/Updated* {E146A755-F8D3-F7D4-C17D-96C36DBE8F4D} SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} . . ((((((((((((((((((((((((( Files Created from 2012-08-24 to 2012-09-24 ))))))))))))))))))))))))))))))) . . 2012-09-24 06:58 . 2012-09-24 06:58 ——– d—–w- c:\windows\system32\config\systemprofile\AppData\Local\temp 2012-09-24 06:58 . 2012-09-24 06:58 ——– d—–w- c:\users\Public\AppData\Local\temp 2012-09-24 06:58 . 2012-09-24 06:58 ——– d—–w- c:\users\Guest\AppData\Local\temp 2012-09-24 06:58 . 2012-09-24 06:58 ——– d—–w- c:\users\Default\AppData\Local\temp 2012-09-24 06:58 . 2012-09-24 06:58 ——– d—–w- c:\users\AppData\AppData\Local\temp 2012-09-22 02:10 . 2012-09-22 02:10 ——– d—–w- C:\_OTL 2012-09-13 02:45 . 2012-09-13 02:46 ——– d—–w- c:\program files (x86)\AVG Secure Search 2012-09-13 01:54 . 2012-09-13 01:54 ——– d—–w- c:\users\lesae9\AppData\Local\Wajam 2012-09-13 01:54 . 2012-09-13 01:54 ——– d—–w- c:\program files (x86)\HiDefMedia 2012-09-05 01:03 . 2012-09-05 01:03 31080 —-a-w- c:\windows\system32\drivers\avgtpx64.sys 2012-09-03 23:33 . 2012-09-03 23:33 ——– d—–w- c:\programdata\McAfee Security Scan 2012-09-03 23:33 . 2012-09-04 00:44 ——– d—–w- c:\program files (x86)\McAfee Security Scan 2012-09-03 23:30 . 2012-09-03 23:30 ——– d—–w- c:\programdata\McAfee . . . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2012-09-21 05:54 . 2012-07-05 07:04 73136 —-a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl 2012-09-21 05:54 . 2012-07-05 07:04 696240 —-a-w- c:\windows\SysWow64\FlashPlayerApp.exe 2012-09-08 00:04 . 2012-06-16 19:24 25928 —-a-w- c:\windows\system32\drivers\mbam.sys 2012-08-30 07:27 . 2012-09-22 02:38 9308616 —-a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{EFE682C6-5E0A-42FC-8B98-E2AD9ACDBF3B}\mpengine.dll 2012-08-29 03:24 . 2012-06-16 18:09 477168 —-a-w- c:\windows\SysWow64\npdeployJava1.dll 2012-08-29 03:24 . 2011-09-23 04:48 473072 —-a-w- c:\windows\SysWow64\deployJava1.dll 2012-08-24 22:43 . 2012-08-24 22:43 384352 —-a-w- c:\windows\system32\drivers\avgtdia.sys 2012-08-20 08:18 . 2012-08-20 08:18 602112 —-a-w- c:\windows\SysWow64\xvid.dll 2012-08-11 18:28 . 2012-05-21 23:24 499712 —-a-w- c:\windows\SysWow64\msvcp71.dll 2012-08-11 18:28 . 2012-05-21 23:24 348160 —-a-w- c:\windows\SysWow64\msvcr71.dll 2012-07-26 10:21 . 2012-07-26 10:21 291680 —-a-w- c:\windows\system32\drivers\avgldx64.sys 2012-07-16 01:03 . 2012-07-16 01:03 184891 —-a-w- C:\torrent.exe 2012-07-04 14:33 . 2012-08-15 10:14 2769408 —-a-w- c:\windows\system32\win32k.sys . . ((((((((((((((((((((((((((((( SnapShot_2012-09-23_22.19.09 ))))))))))))))))))))))))))))))))))))))))) . + 2008-01-21 02:23 . 2012-09-24 07:03 98266 c:\windows\system32\WDI\ShutdownPerformanceDiagnostics_SystemData.bin + 2009-03-12 02:53 . 2012-09-23 22:20 37638 c:\windows\system32\WDI\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-2409464188-3064301150-2695696042-1000_UserData.bin - 2012-09-23 22:09 . 2012-09-23 22:09 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat + 2012-09-24 07:00 . 2012-09-24 07:00 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat - 2012-09-23 22:09 . 2012-09-23 22:09 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat + 2012-09-24 07:00 . 2012-09-24 07:00 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat + 2009-03-12 04:28 . 2012-09-24 06:34 302878 c:\windows\system32\WDI\SuspendPerformanceDiagnostics_SystemData_S3.bin + 2006-11-02 15:45 . 2012-09-23 22:20 117264 c:\windows\system32\WDI\BootPerformanceDiagnostics_SystemData.bin - 2006-11-02 15:45 . 2012-09-23 21:46 117264 c:\windows\system32\WDI\BootPerformanceDiagnostics_SystemData.bin + 2009-01-04 09:03 . 2012-09-24 06:58 336584 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache3.0.0.0.dat - 2009-01-04 09:03 . 2012-09-23 22:07 336584 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache3.0.0.0.dat + 2011-02-10 16:48 . 2012-09-24 06:58 378288 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-System.dat - 2011-02-10 16:48 . 2012-09-23 22:07 378288 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-System.dat + 2011-11-12 18:06 . 2012-09-24 06:58 980504 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-S-1-5-21-2409464188-3064301150-2695696042-1000-12288.dat - 2011-11-12 18:06 . 2012-09-13 02:50 980504 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-S-1-5-21-2409464188-3064301150-2695696042-1000-12288.dat + 2011-11-05 17:36 . 2012-09-24 06:58 2334442 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-S-1-5-21-2409464188-3064301150-2695696042-1000-8192.dat . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 . [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks] "{81017EA9-9AA8-4A6A-9734-7AF40E7D593F}"= "c:\program files (x86)\Yahoo!\Companion\Installs\cpn3\yt.dll" [2012-01-12 1517368] . [HKEY_CLASSES_ROOT\clsid\{81017ea9-9aa8-4a6a-9734-7af40e7d593f}] [HKEY_CLASSES_ROOT\yt.YTNavAssistPlugin.1] [HKEY_CLASSES_ROOT\TypeLib\{003028C2-EA1C-4676-A316-B5CB50917002}] [HKEY_CLASSES_ROOT\yt.YTNavAssistPlugin] . [HKEY_LOCAL_MACHINE\Wow6432Node\~\Browser Helper Objects\{95B7759C-8C7F-4BF1-B163-73684A933233}] 2012-09-13 02:45 1734240 —-a-w- c:\program files (x86)\AVG Secure Search\12.2.5.34\AVG Secure Search_toolbar.dll . [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar] "{95B7759C-8C7F-4BF1-B163-73684A933233}"= "c:\program files (x86)\AVG Secure Search\12.2.5.34\AVG Secure Search_toolbar.dll" [2012-09-13 1734240] . [HKEY_CLASSES_ROOT\clsid\{95b7759c-8c7f-4bf1-b163-73684a933233}] [HKEY_CLASSES_ROOT\AVG Secure Search.PugiObj.1] [HKEY_CLASSES_ROOT\AVG Secure Search.PugiObj] . [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-21 138240] "googletalk"="c:\users\lesae9\AppData\Roaming\Google\Google Talk\googletalk.exe" [2007-01-01 3739648] "Messenger (Yahoo!)"="c:\progra~2\Yahoo!\MESSEN~1\YahooMessenger.exe" [2010-05-11 5252408] "MotoCast"="c:\program files (x86)\Motorola Mobility\MotoCast\MotoLauncher.lnk" [2012-03-14 1886] "Skype"="c:\program files (x86)\Skype\Phone\Skype.exe" [2012-07-13 17420464] "SpybotSD TeaTimer"="c:\program files (x86)\Spybot - Search & Destroy\TeaTimer.exe" [2009-03-05 2260480] "MusicManager"="c:\users\lesae9\AppData\Local\Programs\Google\MusicManager\MusicManager.exe" [2012-08-31 7321600] "Tango"="c:\program files (x86)\Tango\Tango.exe" [2011-11-04 13489992] "HLBackupScheduler"="c:\program files\Backup Assistant Plus\V CAST Backup Scheduler.exe" [2012-08-20 7065224] . [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] "AVG_TRAY"="c:\program files (x86)\AVG\AVG2012\avgtray.exe" [2012-07-31 2596984] "iTunesHelper"="c:\program files (x86)\iTunes\iTunesHelper.exe" [2010-12-14 421160] "GrooveMonitor"="c:\program files (x86)\Microsoft Office\Office12\GrooveMonitor.exe" [2009-02-27 30040] "vProt"="c:\program files (x86)\AVG Secure Search\vprot.exe" [2012-09-13 947808] "Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-07-27 919008] "DivXUpdate"="c:\program files (x86)\DivX\DivX Update\DivXUpdate.exe" [2011-07-28 1259376] "SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2012-01-18 254696] "QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" [2012-04-19 421888] "TkBellExe"="c:\program files (x86)\real\realplayer\Update\realsched.exe" [2012-08-11 296096] "ROC_ROC_NT"="c:\program files (x86)\AVG Secure Search\ROC_ROC_NT.exe" [2012-09-13 856160] . c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\ McAfee Security Scan Plus.lnk - c:\program files (x86)\McAfee Security Scan\2.1.121\SSScheduler.exe [2010-9-2 255536] . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "EnableUIADesktopToggle"= 0 (0x0) . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32] "mixer1"=wdmaud.drv . [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager] BootExecute REG_MULTI_SZ autocheck autochk *\0c:\progra~2\AVG\AVG2012\avgrsa.exe /sync /restart . [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys] @="Driver" . R3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-09-21 250288] S2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2012-07-27 63960] . . HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs Themes . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}] 2008-06-09 18:14 451872 —-a-w- c:\program files (x86)\Common Files\LightScribe\LSRunOnce.exe . Contents of the 'Scheduled Tasks' folder . 2012-09-24 c:\windows\Tasks\Adobe Flash Player Updater.job - c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-07-05 05:54] . 2012-09-24 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2409464188-3064301150-2695696042-1000Core.job - c:\users\lesae9\AppData\Local\Google\Update\GoogleUpdate.exe [2011-11-04 05:41] . 2012-09-24 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2409464188-3064301150-2695696042-1000UA.job - c:\users\lesae9\AppData\Local\Google\Update\GoogleUpdate.exe [2011-11-04 05:41] . 2012-09-17 c:\windows\Tasks\Norton Security Scan for lesae9.job - c:\progra~2\NORTON~2\Engine\312~1.9\Nss.exe [2011-05-22 09:45] . . ——— X64 Entries ———– . . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2008-06-20 1533736] "SmartMenu"="c:\program files (x86)\Hewlett-Packard\HP MediaSmart\SmartMenu.exe" [BU] "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2009-10-03 16395880] . ——- Supplementary Scan ——- . uStart Page = hxxp://www.google.com/ uLocal Page = c:\windows\system32\blank.htm uDefault_Search_URL = hxxp://www.google.com/ie mStart Page = hxxp://www.yahoo.com mLocal Page = c:\windows\SysWOW64\blank.htm mSearch Bar = hxxp://us.rd.yahoo.com/customize/ie/defaults/sb/msgr9/*http://www.yahoo.com/ext/search/search.html uInternet Settings,ProxyOverride = *.local;192.168.*.* uSearchAssistant = hxxp://www.google.com/ie uSearchURL,(Default) = hxxp://www.google.com/search?q=%s IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200 IE: E&xport to Microsoft Excel - c:\progra~2\MICROS~2\Office12\EXCEL.EXE/3000 Trusted Zone: apollogrp.edu Trusted Zone: rhapsody.com\rhap-app-4-0 Trusted Zone: rhapsody.com\rhapreg TCP: DhcpNameServer = 192.168.1.254 Handler: viprotocol - {B658800C-F66E-4EF3-AB85-6C0C227862A9} - c:\program files (x86)\Common Files\AVG Secure Search\ViProtocolInstaller\12.2.6\ViProtocol.dll CLSID: {603d3801-bd81-11d0-a3a5-00c04fd706ec} - %SystemRoot%\SysWow64\browseui.dll . - - - - ORPHANS REMOVED - - - - . WebBrowser-{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39} - (no file) . . . [HKEY_LOCAL_MACHINE\system\ControlSet001\Services\Norton Internet Security] "ImagePath"="\"c:\program files (x86)\Norton Internet Security\Engine\16.0.0.125\ccSvcHst.exe\" /s \"Norton Internet Security\" /m \"c:\program files (x86)\Norton Internet Security\Engine\16.0.0.125\diMaster.dll\" /prefetch:1" . [HKEY_LOCAL_MACHINE\system\ControlSet001\Services\{55662437-DA8C-40c0-AADA-2C816A897A49}] "ImagePath"="\??\c:\program files (x86)\Hewlett-Packard\Media\DVD\000.fcl" . ——————— LOCKED REGISTRY KEYS ——————— . [HKEY_LOCAL_MACHINE\software\Microsoft\Windows CE Services] "SymbolicLinkValue"=hex(6):5c,00,72,00,65,00,67,00,69,00,73,00,74,00,72,00,79, 00,5c,00,4d,00,41,00,43,00,48,00,49,00,4e,00,45,00,5c,00,53,00,4f,00,46,00,\ . [HKEY_LOCAL_MACHINE\software\Wow6432Node\Classes] "SymbolicLinkValue"=hex(6):5c,00,52,00,45,00,47,00,49,00,53,00,54,00,52,00,59, 00,5c,00,4d,00,41,00,43,00,48,00,49,00,4e,00,45,00,5c,00,53,00,4f,00,46,00,\ . [HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 "MSCurrentCountry"=dword:000000b5 . [HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 . [HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 . ———————— Other Running Processes ———————— . c:\program files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe c:\program files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe c:\program files (x86)\AVG\AVG2012\avgfws.exe c:\program files (x86)\AVG\AVG2012\avgwdsvc.exe c:\program files (x86)\Bonjour\mDNSResponder.exe c:\program files (x86)\Motorola Media Link\Lite\NServiceEntry.exe c:\program files (x86)\Flip Video\FlipShare\FlipShareService.exe c:\program files (x86)\Common Files\LightScribe\LSSrvc.exe c:\program files (x86)\Motorola\MotoHelper\MotoHelperService.exe c:\program files (x86)\SMINST\BLService.exe c:\program files (x86)\CyberLink\Shared files\RichVideo.exe c:\programdata\Skype\Toolbars\Skype C2C Service\c2c_service.exe c:\program files (x86)\Hewlett-Packard\Media\TV\Kernel\TV\TVCapSvc.exe c:\program files (x86)\Hewlett-Packard\Media\TV\Kernel\TV\TVSched.exe c:\program files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\12.2.6\ToolbarUpdater.exe c:\program files (x86)\Yahoo!\SoftwareUpdate\YahooAUService.exe c:\program files (x86)\Spybot - Search & Destroy\SDWinSec.exe c:\program files (x86)\AVG\AVG2012\AVGIDSAgent.exe c:\program files (x86)\Motorola\MotoHelper\MotoHelperAgent.exe c:\program files (x86)\Motorola Mobility\MotoCast\MotoCast.exe c:\program files (x86)\Yahoo!\Messenger\ymsgr_tray.exe c:\program files (x86)\Motorola Mobility\MotoCast\bin\MotoCast-thumbnailer.exe . ************************************************************************** . Completion time: 2012-09-24 00:11:52 - machine was rebooted ComboFix-quarantined-files.txt 2012-09-24 07:11 ComboFix2.txt 2012-09-24 05:22 ComboFix3.txt 2012-09-23 22:23 ComboFix4.txt 2012-09-22 05:00 ComboFix5.txt 2012-09-24 06:43 . Pre-Run: 181,475,823,616 bytes free Post-Run: 181,798,158,336 bytes free . - - End Of File - - 17628FC149D82313D43C4897F9D82818

Tomk

Post #12September 24, 2012, 2:35 PM UTC

It appears that you ran ComboFix 2 more times. The good news is that the first time you re-ran it… it worked perfectly.

Let's get an online scan now. This scan usually takes a long time. Hours.

Go here to run an online scanner from ESET.

Turn off the real time scanner of any existing antivirus program while performing the online scan
Tick the box next to YES, I accept the Terms of Use.
Click Start
When asked, allow the activeX control to install
Click Start
Make sure that the option Remove found threats is unticked and the Scan Archives option is ticked.
Click on Advanced Settings, ensure the options Scan for potentially unwanted applications, Scan for potentially unsafe applications, and Enable Anti-Stealth Technology are ticked.
Click Scan
Wait for the scan to finish
When the scan completes, press the LIST OF THREATS FOUND button
Press EXPORT TO TEXT FILE , name the file ESETSCAN and save it to your desktop
Include the contents of this report in your next reply.
Press the BACK button.
Press Finish

lesae9

Post #13September 25, 2012, 10:05 PM UTC

Here are the results of the ESET Scan. C:\torrent.exe Win32/BundleInstaller application C:\Qoobox\Quarantine\C\Program Files (x86)\StartNow Toolbar\ReactivateIE.exe.vir Win32/Toolbar.Zugo application C:\Qoobox\Quarantine\C\Program Files (x86)\StartNow Toolbar\Toolbar32.dll.vir Win32/Toolbar.Zugo application C:\Qoobox\Quarantine\C\Program Files (x86)\StartNow Toolbar\ToolbarBroker.exe.vir Win32/Toolbar.Zugo application C:\Qoobox\Quarantine\C\Program Files (x86)\StartNow Toolbar\ToolbarUpdaterService.exe.vir Win32/Toolbar.Zugo application C:\Users\lesae9\AppData\Roaming\AVG\Rescue\PC Tuneup 2011\120430233309144.rsc a variant of Win32/Toolbar.SearchSuite application

Tomk

Post #14September 26, 2012, 2:31 AM UTC

COMBOFIX-Script

Please open Notepad (Start -> Run -> type notepad in the Open field -> OK) and copy and paste the text present inside the code box below:
```
File::
C:\torrent.exe

Folder::
C:\Program Files (x86)\StartNow Toolbar
```
Save this as CFScript.txt and change the "Save as type" to "All Files" and place it on your desktop.

[external image: Posted Image]
Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before following the steps below. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
Referring to the screenshot above, drag CFScript.txt into ComboFix.exe.
ComboFix will now run a scan on your system. It may reboot your system when it finishes. This is normal.
When finished, it shall produce a log for you. Copy and paste the contents of the log in your next reply.

CAUTION: Do not mouse-click ComboFix's window while it is running. That may cause it to stall.

Then please give me an update on how things are working.

lesae9

Post #15September 27, 2012, 3:33 AM UTC

CFScript. ComboFix Log ComboFix 12-06-28.03 - lesae9 09/26/2012 19:35:08.6.2 - x64 Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.1.1033.18.4092.2091 [GMT -7:00] Running from: c:\users\[removed]\Desktop\ComboFix.exe Command switches used :: c:\users\lesae9\Desktop\CFScript.txt AV: AVG Internet Security 2012 *Disabled/Updated* {5A2746B1-DEE9-F85A-FBCD-ADB11639C5F0} FW: AVG Internet Security 2012 *Disabled* {621CC794-9486-F902-D092-0484E8EA828B} SP: AVG Internet Security 2012 *Disabled/Updated* {E146A755-F8D3-F7D4-C17D-96C36DBE8F4D} SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} . FILE :: "C:\torrent.exe" . . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . . C:\torrent.exe . . ((((((((((((((((((((((((( Files Created from 2012-08-27 to 2012-09-27 ))))))))))))))))))))))))))))))) . . 2012-09-27 02:52 . 2012-09-27 02:52 ——– d—–w- c:\windows\system32\config\systemprofile\AppData\Local\temp 2012-09-27 02:52 . 2012-09-27 02:52 ——– d—–w- c:\users\Public\AppData\Local\temp 2012-09-27 02:52 . 2012-09-27 02:52 ——– d—–w- c:\users\Guest\AppData\Local\temp 2012-09-27 02:52 . 2012-09-27 02:52 ——– d—–w- c:\users\Default\AppData\Local\temp 2012-09-27 02:52 . 2012-09-27 02:52 ——– d—–w- c:\users\AppData\AppData\Local\temp 2012-09-25 22:12 . 2012-08-30 07:27 9308616 —-a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{9DAE99D5-B651-4F64-AA14-5DB762123517}\mpengine.dll 2012-09-25 16:30 . 2012-09-25 16:30 ——– d—–w- c:\program files (x86)\ESET 2012-09-22 02:10 . 2012-09-22 02:10 ——– d—–w- C:\_OTL 2012-09-13 02:45 . 2012-09-13 02:46 ——– d—–w- c:\program files (x86)\AVG Secure Search 2012-09-13 01:54 . 2012-09-13 01:54 ——– d—–w- c:\users\lesae9\AppData\Local\Wajam 2012-09-13 01:54 . 2012-09-13 01:54 ——– d—–w- c:\program files (x86)\HiDefMedia 2012-09-05 01:03 . 2012-09-05 01:03 31080 —-a-w- c:\windows\system32\drivers\avgtpx64.sys 2012-09-03 23:33 . 2012-09-03 23:33 ——– d—–w- c:\programdata\McAfee Security Scan 2012-09-03 23:33 . 2012-09-04 00:44 ——– d—–w- c:\program files (x86)\McAfee Security Scan 2012-09-03 23:30 . 2012-09-03 23:30 ——– d—–w- c:\programdata\McAfee . . . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2012-09-21 05:54 . 2012-07-05 07:04 73136 —-a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl 2012-09-21 05:54 . 2012-07-05 07:04 696240 —-a-w- c:\windows\SysWow64\FlashPlayerApp.exe 2012-09-08 00:04 . 2012-06-16 19:24 25928 —-a-w- c:\windows\system32\drivers\mbam.sys 2012-08-29 03:24 . 2012-06-16 18:09 477168 —-a-w- c:\windows\SysWow64\npdeployJava1.dll 2012-08-29 03:24 . 2011-09-23 04:48 473072 —-a-w- c:\windows\SysWow64\deployJava1.dll 2012-08-24 22:43 . 2012-08-24 22:43 384352 —-a-w- c:\windows\system32\drivers\avgtdia.sys 2012-08-20 08:18 . 2012-08-20 08:18 602112 —-a-w- c:\windows\SysWow64\xvid.dll 2012-08-11 18:28 . 2012-05-21 23:24 499712 —-a-w- c:\windows\SysWow64\msvcp71.dll 2012-08-11 18:28 . 2012-05-21 23:24 348160 —-a-w- c:\windows\SysWow64\msvcr71.dll 2012-07-26 10:21 . 2012-07-26 10:21 291680 —-a-w- c:\windows\system32\drivers\avgldx64.sys 2012-07-04 14:33 . 2012-08-15 10:14 2769408 —-a-w- c:\windows\system32\win32k.sys . . ((((((((((((((((((((((((((((( SnapShot_2012-09-23_22.19.09 ))))))))))))))))))))))))))))))))))))))))) . - 2008-01-21 03:20 . 2012-09-22 10:20 32768 c:\windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat + 2008-01-21 03:20 . 2012-09-27 02:22 32768 c:\windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat + 2008-01-21 03:20 . 2012-09-27 02:22 98304 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat - 2008-01-21 03:20 . 2012-09-22 10:20 98304 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat - 2008-01-21 03:20 . 2012-09-22 10:20 16384 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat + 2008-01-21 03:20 . 2012-09-27 02:22 16384 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat + 2008-01-21 02:23 . 2012-09-27 03:24 98528 c:\windows\system32\WDI\ShutdownPerformanceDiagnostics_SystemData.bin + 2009-03-12 02:53 . 2012-09-27 02:26 37654 c:\windows\system32\WDI\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-2409464188-3064301150-2695696042-1000_UserData.bin - 2012-09-23 22:09 . 2012-09-23 22:09 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat + 2012-09-27 03:07 . 2012-09-27 03:07 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat - 2012-09-23 22:09 . 2012-09-23 22:09 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat + 2012-09-27 03:07 . 2012-09-27 03:07 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat + 2009-03-15 23:11 . 2012-09-25 06:07 408298 c:\windows\system32\WDI\SuspendPerformanceDiagnostics_SystemData_S4.bin + 2009-03-12 04:28 . 2012-09-25 08:38 303038 c:\windows\system32\WDI\SuspendPerformanceDiagnostics_SystemData_S3.bin + 2006-11-02 15:45 . 2012-09-27 02:26 117264 c:\windows\system32\WDI\BootPerformanceDiagnostics_SystemData.bin - 2006-11-02 15:45 . 2012-09-23 21:46 117264 c:\windows\system32\WDI\BootPerformanceDiagnostics_SystemData.bin + 2009-01-04 09:03 . 2012-09-27 03:05 336584 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache3.0.0.0.dat - 2009-01-04 09:03 . 2012-09-23 22:07 336584 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache3.0.0.0.dat + 2011-02-10 16:48 . 2012-09-27 03:05 378288 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-System.dat - 2011-02-10 16:48 . 2012-09-23 22:07 378288 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-System.dat - 2011-11-12 18:06 . 2012-09-13 02:50 980504 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-S-1-5-21-2409464188-3064301150-2695696042-1000-12288.dat + 2011-11-12 18:06 . 2012-09-26 12:50 980504 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-S-1-5-21-2409464188-3064301150-2695696042-1000-12288.dat + 2011-11-05 17:36 . 2012-09-27 03:05 2334442 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-S-1-5-21-2409464188-3064301150-2695696042-1000-8192.dat . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 . [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks] "{81017EA9-9AA8-4A6A-9734-7AF40E7D593F}"= "c:\program files (x86)\Yahoo!\Companion\Installs\cpn3\yt.dll" [2012-01-12 1517368] . [HKEY_CLASSES_ROOT\clsid\{81017ea9-9aa8-4a6a-9734-7af40e7d593f}] [HKEY_CLASSES_ROOT\yt.YTNavAssistPlugin.1] [HKEY_CLASSES_ROOT\TypeLib\{003028C2-EA1C-4676-A316-B5CB50917002}] [HKEY_CLASSES_ROOT\yt.YTNavAssistPlugin] . [HKEY_LOCAL_MACHINE\Wow6432Node\~\Browser Helper Objects\{95B7759C-8C7F-4BF1-B163-73684A933233}] 2012-09-13 02:45 1734240 —-a-w- c:\program files (x86)\AVG Secure Search\12.2.5.34\AVG Secure Search_toolbar.dll . [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar] "{95B7759C-8C7F-4BF1-B163-73684A933233}"= "c:\program files (x86)\AVG Secure Search\12.2.5.34\AVG Secure Search_toolbar.dll" [2012-09-13 1734240] . [HKEY_CLASSES_ROOT\clsid\{95b7759c-8c7f-4bf1-b163-73684a933233}] [HKEY_CLASSES_ROOT\AVG Secure Search.PugiObj.1] [HKEY_CLASSES_ROOT\AVG Secure Search.PugiObj] . [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-21 138240] "googletalk"="c:\users\lesae9\AppData\Roaming\Google\Google Talk\googletalk.exe" [2007-01-01 3739648] "Messenger (Yahoo!)"="c:\progra~2\Yahoo!\MESSEN~1\YahooMessenger.exe" [2010-05-11 5252408] "MotoCast"="c:\program files (x86)\Motorola Mobility\MotoCast\MotoLauncher.lnk" [2012-03-14 1886] "Skype"="c:\program files (x86)\Skype\Phone\Skype.exe" [2012-07-13 17420464] "SpybotSD TeaTimer"="c:\program files (x86)\Spybot - Search & Destroy\TeaTimer.exe" [2009-03-05 2260480] "MusicManager"="c:\users\lesae9\AppData\Local\Programs\Google\MusicManager\MusicManager.exe" [2012-08-31 7321600] "Tango"="c:\program files (x86)\Tango\Tango.exe" [2011-11-04 13489992] "HLBackupScheduler"="c:\program files\Backup Assistant Plus\V CAST Backup Scheduler.exe" [2012-08-20 7065224] . [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] "AVG_TRAY"="c:\program files (x86)\AVG\AVG2012\avgtray.exe" [2012-07-31 2596984] "iTunesHelper"="c:\program files (x86)\iTunes\iTunesHelper.exe" [2010-12-14 421160] "GrooveMonitor"="c:\program files (x86)\Microsoft Office\Office12\GrooveMonitor.exe" [2009-02-27 30040] "vProt"="c:\program files (x86)\AVG Secure Search\vprot.exe" [2012-09-13 947808] "Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-07-27 919008] "DivXUpdate"="c:\program files (x86)\DivX\DivX Update\DivXUpdate.exe" [2011-07-28 1259376] "SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2012-01-18 254696] "QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" [2012-04-19 421888] "TkBellExe"="c:\program files (x86)\real\realplayer\Update\realsched.exe" [2012-08-11 296096] "ROC_ROC_NT"="c:\program files (x86)\AVG Secure Search\ROC_ROC_NT.exe" [2012-09-13 856160] . c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\ McAfee Security Scan Plus.lnk - c:\program files (x86)\McAfee Security Scan\2.1.121\SSScheduler.exe [2010-9-2 255536] . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "EnableUIADesktopToggle"= 0 (0x0) . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32] "mixer1"=wdmaud.drv . [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager] BootExecute REG_MULTI_SZ autocheck autochk *\0c:\progra~2\AVG\AVG2012\avgrsa.exe /sync /restart . [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys] @="Driver" . R3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-09-21 250288] S2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2012-07-27 63960] . . HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs Themes . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}] 2008-06-09 18:14 451872 —-a-w- c:\program files (x86)\Common Files\LightScribe\LSRunOnce.exe . Contents of the 'Scheduled Tasks' folder . 2012-09-27 c:\windows\Tasks\Adobe Flash Player Updater.job - c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-07-05 05:54] . 2012-09-26 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2409464188-3064301150-2695696042-1000Core.job - c:\users\lesae9\AppData\Local\Google\Update\GoogleUpdate.exe [2011-11-04 05:41] . 2012-09-26 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2409464188-3064301150-2695696042-1000UA.job - c:\users\lesae9\AppData\Local\Google\Update\GoogleUpdate.exe [2011-11-04 05:41] . 2012-09-26 c:\windows\Tasks\Norton Security Scan for lesae9.job - c:\progra~2\NORTON~2\Engine\312~1.9\Nss.exe [2011-05-22 09:45] . . ——— X64 Entries ———– . . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2008-06-20 1533736] "SmartMenu"="c:\program files (x86)\Hewlett-Packard\HP MediaSmart\SmartMenu.exe" [BU] "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2009-10-03 16395880] . ——- Supplementary Scan ——- . uStart Page = hxxp://www.google.com/ uLocal Page = c:\windows\system32\blank.htm uDefault_Search_URL = hxxp://www.google.com/ie mStart Page = hxxp://www.yahoo.com mLocal Page = c:\windows\SysWOW64\blank.htm mSearch Bar = hxxp://us.rd.yahoo.com/customize/ie/defaults/sb/msgr9/*http://www.yahoo.com/ext/search/search.html uInternet Settings,ProxyOverride = *.local;192.168.*.* uSearchAssistant = hxxp://www.google.com/ie uSearchURL,(Default) = hxxp://www.google.com/search?q=%s IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200 IE: E&xport to Microsoft Excel - c:\progra~2\MICROS~2\Office12\EXCEL.EXE/3000 Trusted Zone: apollogrp.edu Trusted Zone: rhapsody.com\rhap-app-4-0 Trusted Zone: rhapsody.com\rhapreg TCP: DhcpNameServer = 192.168.1.254 Handler: viprotocol - {B658800C-F66E-4EF3-AB85-6C0C227862A9} - c:\program files (x86)\Common Files\AVG Secure Search\ViProtocolInstaller\12.2.6\ViProtocol.dll CLSID: {603d3801-bd81-11d0-a3a5-00c04fd706ec} - %SystemRoot%\SysWow64\browseui.dll . - - - - ORPHANS REMOVED - - - - . WebBrowser-{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39} - (no file) . . . [HKEY_LOCAL_MACHINE\system\ControlSet001\Services\Norton Internet Security] "ImagePath"="\"c:\program files (x86)\Norton Internet Security\Engine\16.0.0.125\ccSvcHst.exe\" /s \"Norton Internet Security\" /m \"c:\program files (x86)\Norton Internet Security\Engine\16.0.0.125\diMaster.dll\" /prefetch:1" . [HKEY_LOCAL_MACHINE\system\ControlSet001\Services\{55662437-DA8C-40c0-AADA-2C816A897A49}] "ImagePath"="\??\c:\program files (x86)\Hewlett-Packard\Media\DVD\000.fcl" . ——————— LOCKED REGISTRY KEYS ——————— . [HKEY_LOCAL_MACHINE\software\Microsoft\Windows CE Services] "SymbolicLinkValue"=hex(6):5c,00,72,00,65,00,67,00,69,00,73,00,74,00,72,00,79, 00,5c,00,4d,00,41,00,43,00,48,00,49,00,4e,00,45,00,5c,00,53,00,4f,00,46,00,\ . [HKEY_LOCAL_MACHINE\software\Wow6432Node\Classes] "SymbolicLinkValue"=hex(6):5c,00,52,00,45,00,47,00,49,00,53,00,54,00,52,00,59, 00,5c,00,4d,00,41,00,43,00,48,00,49,00,4e,00,45,00,5c,00,53,00,4f,00,46,00,\ . [HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 "MSCurrentCountry"=dword:000000b5 . [HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 . [HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 . ———————— Other Running Processes ———————— . c:\program files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe c:\program files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe c:\program files (x86)\AVG\AVG2012\avgfws.exe c:\program files (x86)\AVG\AVG2012\avgwdsvc.exe c:\program files (x86)\Bonjour\mDNSResponder.exe c:\program files (x86)\Motorola Media Link\Lite\NServiceEntry.exe c:\program files (x86)\Flip Video\FlipShare\FlipShareService.exe c:\program files (x86)\Common Files\LightScribe\LSSrvc.exe c:\program files (x86)\Motorola\MotoHelper\MotoHelperService.exe c:\program files (x86)\SMINST\BLService.exe c:\program files (x86)\CyberLink\Shared files\RichVideo.exe c:\programdata\Skype\Toolbars\Skype C2C Service\c2c_service.exe c:\program files (x86)\Hewlett-Packard\Media\TV\Kernel\TV\TVCapSvc.exe c:\program files (x86)\Hewlett-Packard\Media\TV\Kernel\TV\TVSched.exe c:\program files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\12.2.6\ToolbarUpdater.exe c:\program files (x86)\Yahoo!\SoftwareUpdate\YahooAUService.exe c:\program files (x86)\AVG\AVG2012\AVGIDSAgent.exe c:\program files (x86)\Spybot - Search & Destroy\SDWinSec.exe c:\program files (x86)\Motorola\MotoHelper\MotoHelperAgent.exe c:\program files (x86)\Motorola Mobility\MotoCast\MotoCast.exe c:\program files (x86)\Yahoo!\Messenger\ymsgr_tray.exe c:\program files (x86)\Motorola Mobility\MotoCast\bin\MotoCast-thumbnailer.exe . ************************************************************************** . Completion time: 2012-09-26 20:29:14 - machine was rebooted ComboFix-quarantined-files.txt 2012-09-27 03:29 ComboFix2.txt 2012-09-24 07:11 ComboFix3.txt 2012-09-24 05:22 ComboFix4.txt 2012-09-23 22:23 ComboFix5.txt 2012-09-27 02:30 . Pre-Run: 183,291,506,688 bytes free Post-Run: 183,433,003,008 bytes free . - - End Of File - - 733CD7587B72BA806F4015D1F7A2546D

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

blekkosearch.mysearch [Closed]

✨ Ask AI

Ask AI