What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Browser Hijack - Snap.do and Smilebox [Closed]

10 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
A few weeks ago, Firefox was hijacked and kept opening a Smilebox page as the default browser. I attempted to fix this myself by editing about:config. That seemed to do the trick for a while, but the problem returned. I found an executable on the web titled SmileBox ToolBarRemovalTool.exe. Stupidly, I downloaded and ran it. Since then, both Firefox and Microsoft Explorer Browsers have become hijacked. Deleting and re-installing Firefox has had no effect.

A Hijackthis log is attached. Any help removing this would be greatly appreciated.

Andrew

C:\ProgramData\DatacardService\DCSHelper.exe
C:\Program Files (x86)\Adobe\Photoshop Elements 5.0\apdproxy.exe
C:\Program Files (x86)\Vodafone\Vodafone Mobile Connect\Bin\MobileConnect.exe
C:\Program Files (x86)\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
C:\Program Files (x86)\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
C:\Program Files (x86)\Common Files\Pure Networks Shared\Platform\nmctxth.exe
C:\Program Files (x86)\Pure Networks\Network Magic\nmapp.exe
C:\Program Files (x86)\Canon\Solution Menu EX\CNSEMAIN.EXE
C:\Program Files (x86)\Canon\IJ Network Scanner Selector EX\CNMNSST.exe
C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
C:\Program Files (x86)\iTunes\iTunesHelper.exe
C:\Program Files (x86)\Mozilla Firefox\firefox.exe
C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe
C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_3_300_270.exe
C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_3_300_270.exe
C:\Users\Andrew & Jenny\Desktop\HiJackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://feed.snap.do/?publisher=SnapdoIMone…q={searchTerms}
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://feed.snap.do/?publisher=SnapdoIMone…q={searchTerms}
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://feed.snap.do/?publisher=SnapdoIMone…p;searchtype=hp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,Default_Search_URL = http://feed.snap.do/?publisher=SnapdoIMone…q={searchTerms}
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://feed.snap.do/?publisher=SnapdoIMone…q={searchTerms}
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
F2 - REG:system.ini: UserInit=userinit.exe
O1 - Hosts: ::1 localhost
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Snap.DoEngine - {31ad400d-1b06-4e33-a59a-90c2c140cba0} - mscoree.dll (file missing)
O2 - BHO: Web Assistant Helper - {336D0C35-8A85-403a-B9D2-65C292C39087} - C:\Program Files\Web Assistant\Extension32.dll
O2 - BHO: Canon Easy-WebPrint EX BHO - {3785D0AD-BFFF-47F6-BF5B-A587C162FED9} - C:\Program Files (x86)\Canon\Easy-WebPrint EX\ewpexbho.dll
O2 - BHO: ZoneAlarm Toolbar Registrar - {8A4A36C2-0535-4D2C-BD3D-496CB7EED6E3} - C:\Program Files\CheckPoint\ZAForceField\WOW64\TrustChecker\bin\TrustCheckerIEPlugin.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files (x86)\Google\GoogleToolbarNotifier\5.2.4204.1700\swg.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll
O3 - Toolbar: ZoneAlarm Toolbar - {EE2AC4E5-B0B0-4EC6-88A9-BCA1A32AB107} - C:\Program Files\CheckPoint\ZAForceField\WOW64\TrustChecker\bin\TrustCheckerIEPlugin.dll
O3 - Toolbar: Canon Easy-WebPrint EX - {759D9886-0C6F-4498-BAB6-4A5F47C6C72F} - C:\Program Files (x86)\Canon\Easy-WebPrint EX\ewpexhlp.dll
O3 - Toolbar: Snap.Do - {ae07101b-46d4-4a98-af68-0333ea26e113} - mscoree.dll (file missing)
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files (x86)\Adobe\Photoshop Elements 5.0\apdproxy.exe"
O4 - HKLM\..\Run: [MobileConnect] C:\Program Files (x86)\Vodafone\Vodafone Mobile Connect\Bin\MobileConnect.exe /silent
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files (x86)\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [nmctxth] "C:\Program Files (x86)\Common Files\Pure Networks Shared\Platform\nmctxth.exe"
O4 - HKLM\..\Run: [nmapp] "C:\Program Files (x86)\Pure Networks\Network Magic\nmapp.exe" -autorun -nosplash
O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [APSDaemon] "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe"
O4 - HKLM\..\Run: [CanonSolutionMenuEx] C:\Program Files (x86)\Canon\Solution Menu EX\CNSEMAIN.EXE /logon
O4 - HKLM\..\Run: [IJNetworkScannerSelectorEX] C:\Program Files (x86)\Canon\IJ Network Scanner Selector EX\CNMNSST.exe /FORCE
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files (x86)\iTunes\iTunesHelper.exe"
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files (x86)\Common Files\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [LightScribe Control Panel] C:\Program Files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe -hidden
O4 - HKCU\..\Run: [Browser Infrastructure Helper] C:\Users\Andrew & Jenny\AppData\Local\Smartbar\Application\SnapDo.exe startup
O4 - Startup: Microsoft Find Fast.lnk = C:\Program Files (x86)\Microsoft Office\Office\FINDFAST.EXE
O4 - Startup: Microsoft Office Shortcut Bar.lnk = C:\Program Files (x86)\Microsoft Office\Office\MSOFFICE.EXE
O4 - Startup: Office Startup.lnk = C:\Program Files (x86)\Microsoft Office\Office\OSA.EXE
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc…ash/swflash.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{10B9E5EC-7BE7-4BE1-94E0-83807B10831C}: NameServer = 61.8.0.113,210.23.129.34
O17 - HKLM\System\CCS\Services\Tcpip\..\{F0890264-6DAF-4D4D-BE5B-9A458D415355}: NameServer = 211.29.132.12 61.88.88.88
O17 - HKLM\System\CS1\Services\Tcpip\..\{10B9E5EC-7BE7-4BE1-94E0-83807B10831C}: NameServer = 61.8.0.113,210.23.129.34
O17 - HKLM\System\CS2\Services\Tcpip\..\{10B9E5EC-7BE7-4BE1-94E0-83807B10831C}: NameServer = 61.8.0.113,210.23.129.34
O23 - Service: Adobe Active File Monitor V5 (AdobeActiveFileMonitor5.0) - Unknown owner - C:\Program Files (x86)\Adobe\Photoshop Elements 5.0\PhotoshopElementsFileAgent.exe
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)
O23 - Service: AMD External Events Utility - Unknown owner - C:\Windows\system32\atiesrxx.exe (file missing)
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
O23 - Service: Bytemobile Web Configurator (bmwebcfg) - Bytemobile, Inc. - C:\Windows\SysWOW64\bmwebcfg.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: DCService.exe - Unknown owner - C:\ProgramData\DatacardService\DCService.exe
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing)
O23 - Service: Google Update Service (gupdate1ca25dcf555bc70) (gupdate1ca25dcf555bc70) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: Google Update Service (gupdatem) (gupdatem) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files (x86)\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: ZoneAlarm Toolbar IswSvc (IswSvc) - Check Point Software Technologies - C:\Program Files\CheckPoint\ZAForceField\IswSvc.exe
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe
O23 - Service: Mozilla Maintenance Service (MozillaMaintenance) - Mozilla Foundation - C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: NMIndexingService - Nero AG - C:\Program Files (x86)\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: Pure Networks Platform Service (nmservice) - Cisco Systems, Inc. - C:\Program Files (x86)\Common Files\Pure Networks Shared\Platform\nmsrvc.exe
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
O23 - Service: Vodafone Mobile Connect Service (VMCService) - Vodafone - C:\Program Files (x86)\Vodafone\Vodafone Mobile Connect\Bin\VMCService.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Check Point Software Technologies LTD - C:\Windows\SysWOW64\ZoneLabs\vsmon.exe
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\Wat\WatUX.exe,-601 (WatAdminSvc) - Unknown owner - C:\Windows\system32\Wat\WatAdminSvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)
O23 - Service: Web Assistant Updater - Unknown owner - C:\Program Files\Web Assistant\ExtensionUpdaterService.exe
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)

–
End of file - 12963 bytes
Post #2
Hello H andrew and welcome to the WTT forum.

My name is Satchfan and I would be glad to help you with your computer problem.

Please read the following guidelines which will help to make cleaning your machine easier:
  • please follow all instructions in the order posted
  • please continue to review my answers until I tell you your machine appears to be clear. Absence of symptoms does not mean that everything is clear
  • all logs/reports, etc. must be posted in Notepad. Please ensure that word wrap is unchecked. In Notepad click Format, uncheck Word wrap if it is checked
  • if you don't understand something, please don't hesitate to ask for clarification before proceeding
  • the fixes are specific to your problem and should only be used for this issue on this machine.
  • please reply within 3 days. If you do not reply within this period I will post a reminder but topics with no reply in 4 days will be closed!
IMPORTANT:

Please DO NOT install/uninstall any programs unless asked to.
Please DO NOT run any scans other than those requested

===================================================

Download and run AdwCleaner

Download AdwCleaner from here and save it to your desktop.
  • run AdwCleaner and select Delete
  • when it has finished it will ask to reboot - allow the reboot
  • on reboot a log will be produced; please attach the content of the log to your next reply
===================================================

Download and run OTL
  • download OTL to your desktop.
  • double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
  • click Scan all users.
  • under Custom Scan paste this in


    netsvcs
    %SYSTEMDRIVE%\*.exe
    /md5start
    explorer.exe
    winlogon.exe
    Userinit.exe
    svchost.exe
    services.exe
    /md5stop
    %systemroot%\*. /rp /s
    DRIVES
    CREATERESTOREPOINT

  • click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan won’t take long.
  • when the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.
  • please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post it with your next reply.
  • you may need two posts to fit them both in.
===================================================

Run aswMBR
  • download aswMBR.exe to your desktop.
  • double click the aswMBR.exe to run it
  • if asked, accept the AVAST virus definition download
  • click the "Scan" button to start scan
  • on completion of the scan click Save log, save it to your desktop and post in your next reply. Note - do NOT attempt any Fix yet.
Logs to include with next post:

AdwCleaner log
OTL.txt
Extras.txt
aswMBR log

Thanks

Satchfan
Post #3
Thank you Satchfan

The requested logs are:


AdwCleaner log:


# AdwCleaner v2.005 - Logfile created 10/21/2012 at 22:13:07
# Updated 14/10/2012 by Xplode
# Operating system : Windows 7 Home Premium (64 bits)
# User : Andrew & Jenny - HOME-PC
# Boot Mode : Normal
# Running from : C:\Users\Andrew & Jenny\Desktop\adwcleaner.exe
# Option [Delete]


***** [Services] *****

Stopped & Deleted : Web Assistant Updater

***** [Files / Folders] *****

Deleted on reboot : C:\Users\ANDREW~1\AppData\Local\Temp\Zynga
File Deleted : C:\Users\Andrew & Jenny\AppData\Roaming\Mozilla\Firefox\Profiles\7r2we53b.default\searchplugins\MyStart Search.xml
File Deleted : C:\Users\Andrew & Jenny\AppData\Roaming\Mozilla\Firefox\Profiles\7r2we53b.default\searchplugins\Web Search.xml
Folder Deleted : C:\Program Files (x86)\Conduit
Folder Deleted : C:\Program Files (x86)\MyFunCards_5m
Folder Deleted : C:\Program Files\Web Assistant
Folder Deleted : C:\Users\Andrew & Jenny\AppData\Local\Conduit
Folder Deleted : C:\Users\Andrew & Jenny\AppData\Local\Smartbar
Folder Deleted : C:\Users\Andrew & Jenny\AppData\LocalLow\Conduit
Folder Deleted : C:\Users\Andrew & Jenny\AppData\LocalLow\MyFunCards_5m
Folder Deleted : C:\Users\Andrew & Jenny\AppData\LocalLow\Smartbar
Folder Deleted : C:\Users\Andrew & Jenny\AppData\Roaming\Mozilla\Firefox\Profiles\7r2we53b.default\CT3061355
Folder Deleted : C:\Users\Andrew & Jenny\AppData\Roaming\Mozilla\Firefox\Profiles\7r2we53b.default\extensions\{f897eb0e-a3a4-46c3-80eb-2729699d8892}
Folder Deleted : C:\Users\Andrew & Jenny\AppData\Roaming\Mozilla\Firefox\Profiles\7r2we53b.default\extensions\[removed]
Folder Deleted : C:\Users\Andrew & Jenny\AppData\Roaming\Mozilla\Firefox\Profiles\7r2we53b.default\Smartbar
Folder Deleted : C:\Users\ANDREW~1\AppData\Local\Temp\CT3061355
Folder Deleted : C:\Users\ANDREW~1\AppData\Local\Temp\Smartbar

***** [Registry] *****

Key Deleted : HKCU\Software\AppDataLow\Software\Conduit
Key Deleted : HKCU\Software\AppDataLow\Software\SmartBar
Key Deleted : HKCU\Software\IM
Key Deleted : HKCU\Software\ImInstaller
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{31AD400D-1B06-4E33-A59A-90C2C140CBA0}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{336D0C35-8A85-403a-B9D2-65C292C39087}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{AE07101B-46D4-4A98-AF68-0333EA26E113}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{C4B22C87-45EF-4F43-89F2-40DB2078864E}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{31AD400D-1B06-4E33-A59A-90C2C140CBA0}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{336D0C35-8A85-403a-B9D2-65C292C39087}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{AE07101B-46D4-4A98-AF68-0333EA26E113}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{C4B22C87-45EF-4F43-89F2-40DB2078864E}
Key Deleted : HKCU\Software\SmartBar
Key Deleted : HKCU\Software\SmartbarBackup
Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{006EE092-9658-4FD6-BD8E-A21A348E59F5}
Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}
Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{CFF4DB9B-135F-47C0-9269-B4C6572FD61A}
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{B302A1BD-0157-49FA-90F1-4E94F22C7B4B}
Key Deleted : HKLM\SOFTWARE\Classes\AppID\Extension.DLL
Key Deleted : HKLM\SOFTWARE\Classes\Extension.ExtensionHelperObject
Key Deleted : HKLM\SOFTWARE\Classes\Extension.ExtensionHelperObject.1
Key Deleted : HKLM\SOFTWARE\Classes\Toolbar.CT3061355
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{1D5A4199-956E-49BC-B89F-6A35C57C0D13}
Key Deleted : HKLM\Software\Conduit
Key Deleted : HKLM\Software\Web Assistant
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{31AD400D-1B06-4E33-A59A-90C2C140CBA0}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{336D0C35-8A85-403a-B9D2-65C292C39087}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{AE07101B-46D4-4A98-AF68-0333EA26E113}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{A36867C6-302D-49FC-9D8E-1EB037B5F1AB}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{FFB96CC1-7EB3-449D-B827-DB661701C6BB}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Google\Chrome\Extensions\dlnembnfbcpjnepmfjmngjenhhajpdfd
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\{006EE092-9658-4FD6-BD8E-A21A348E59F5}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{31AD400D-1B06-4E33-A59A-90C2C140CBA0}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{336D0C35-8A85-403a-B9D2-65C292C39087}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{31AD400D-1B06-4E33-A59A-90C2C140CBA0}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{336D0C35-8A85-403a-B9D2-65C292C39087}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{AE07101B-46D4-4A98-AF68-0333EA26E113}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{23119123-0854-469D-807A-171568457991}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{A36867C6-302D-49FC-9D8E-1EB037B5F1AB}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{FFB96CC1-7EB3-449D-B827-DB661701C6BB}
Key Deleted : HKLM\SOFTWARE\Google\Chrome\Extensions\dlnembnfbcpjnepmfjmngjenhhajpdfd
Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{31AD400D-1B06-4E33-A59A-90C2C140CBA0}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{336D0C35-8A85-403a-B9D2-65C292C39087}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{336D0C35-8A85-403a-B9D2-65C292C39087}_is1
Key Deleted : HKLM\SOFTWARE\Web Assistant
Value Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Run [Browser Infrastructure Helper]
Value Deleted : HKLM\SOFTWARE\Mozilla\Firefox\extensions [{336D0C35-8A85-403a-B9D2-65C292C39087}]
Value Deleted : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar [{AE07101B-46D4-4A98-AF68-0333EA26E113}]
Value Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{AE07101B-46D4-4A98-AF68-0333EA26E113}]

***** [Internet Browsers] *****

-\\ Internet Explorer v9.0.8112.16421

Replaced : [HKCU\Software\Microsoft\Internet Explorer\Main - Search Page] = hxxp://feed.snap.do/?publisher=SnapdoIMonetizer&dpid=SnapdoIMonetizer&co=AU&userid=a2d6e534-54a3-4d7f-a177-5b91a754350e&searchtype=ds&q={searchTerms} –> hxxp://www.google.com
Replaced : [HKCU\Software\Microsoft\Internet Explorer\Main - Start Page] = hxxp://feed.snap.do/?publisher=SnapdoIMonetizer&dpid=SnapdoIMonetizer&co=AU&userid=a2d6e534-54a3-4d7f-a177-5b91a754350e&searchtype=hp –> hxxp://www.google.com
Replaced : [HKCU\Software\Microsoft\Internet Explorer\Main - Search Bar] = hxxp://feed.snap.do/?publisher=SnapdoIMonetizer&dpid=SnapdoIMonetizer&co=AU&userid=a2d6e534-54a3-4d7f-a177-5b91a754350e&searchtype=ds&q={searchTerms} –> hxxp://www.google.com
Replaced : [HKCU\Software\Microsoft\Internet Explorer\Search - Default_Search_URL] = hxxp://feed.snap.do/?publisher=SnapdoIMonetizer&dpid=SnapdoIMonetizer&co=AU&userid=a2d6e534-54a3-4d7f-a177-5b91a754350e&searchtype=ds&q={searchTerms} –> hxxp://www.google.com
Replaced : [HKCU\Software\Microsoft\Internet Explorer\Search - SearchAssistant] = hxxp://feed.snap.do/?publisher=SnapdoIMonetizer&dpid=SnapdoIMonetizer&co=AU&userid=a2d6e534-54a3-4d7f-a177-5b91a754350e&searchtype=ds&q={searchTerms} –> hxxp://www.google.com

-\\ Mozilla Firefox v16.0.1 (en-US)

Profile name : default
File : C:\Users\Andrew & Jenny\AppData\Roaming\Mozilla\Firefox\Profiles\7r2we53b.default\prefs.js

Deleted : user_pref("CT3061355.1000082.state", "{\"state\":\"stopped\",\"text\":\"Californi…\",\"description[…]
Deleted : user_pref("CT3061355.1000234.TWC_TMP_city", "MELBOURNE");
Deleted : user_pref("CT3061355.1000234.TWC_TMP_country", "AU");
Deleted : user_pref("CT3061355.1000234.TWC_location", "Melbourne, Australia");
Deleted : user_pref("CT3061355.1000234.TWC_region", "OT");
Deleted : user_pref("CT3061355.1000234.TWC_temp_dis", "c");
Deleted : user_pref("CT3061355.1000234.TWC_wind_dis", "kmh");
Deleted : user_pref("CT3061355.1000234.weatherData", "{\"icon\":\"33.png\",\"temperature\":\"12°C\",\"temperat[…]
Deleted : user_pref("CT3061355.ENABALE_HISTORY", "{\"dataType\":\"string\",\"data\":\"true\"}");
Deleted : user_pref("CT3061355.ENABLE_RETURN_WEB_SEARCH_ON_THE_PAGE", "{\"dataType\":\"string\",\"data\":\"tru[…]
Deleted : user_pref("CT3061355.FirstTime", "true");
Deleted : user_pref("CT3061355.FirstTimeFF3", "true");
Deleted : user_pref("CT3061355.UserID", "UN86090203684312299");
Deleted : user_pref("CT3061355.addressBarTakeOverEnabledInHidden", "true");
Deleted : user_pref("CT3061355.autoDisableScopes", -1);
Deleted : user_pref("CT3061355.defaultSearch", "false");
Deleted : user_pref("CT3061355.embeddedsData", "[{\"appId\":\"129559837143067631\",\"apiPermissions\":{\"cross[…]
Deleted : user_pref("CT3061355.enableAlerts", "always");
Deleted : user_pref("CT3061355.enableSearchFromAddressBar", "false");
Deleted : user_pref("CT3061355.firstTimeDialogOpened", "true");
Deleted : user_pref("CT3061355.fixPageNotFoundError", "false");
Deleted : user_pref("CT3061355.fixPageNotFoundErrorInHidden", "true");
Deleted : user_pref("CT3061355.fixUrls", true);
Deleted : user_pref("CT3061355.installId", "ConduitNSISIntegration");
Deleted : user_pref("CT3061355.installType", "ConduitNSISIntegration");
Deleted : user_pref("CT3061355.isEnableAllDialogs", "{\"dataType\":\"string\",\"data\":\"true\"}");
Deleted : user_pref("CT3061355.isNewTabEnabled", true);
Deleted : user_pref("CT3061355.isPerformedSmartBarTransition", "true");
Deleted : user_pref("CT3061355.isToolbarShrinked", "{\"dataType\":\"string\",\"data\":\"false\"}");
Deleted : user_pref("CT3061355.navigationAliasesJson", "{\"EB_SEARCH_TERM\":\"\",\"EB_MAIN_FRAME_URL\":\"\",\"[…]
Deleted : user_pref("CT3061355.openThankYouPage", "false");
Deleted : user_pref("CT3061355.openUninstallPage", "true");
Deleted : user_pref("CT3061355.search.searchAppId", "129559837143067631");
Deleted : user_pref("CT3061355.search.searchCount", "0");
Deleted : user_pref("CT3061355.searchInNewTabEnabledInHidden", "true");
Deleted : user_pref("CT3061355.selectToSearchBoxEnabled", "{\"dataType\":\"string\",\"data\":\"true\"}");
Deleted : user_pref("CT3061355.serviceLayer_service_login_isFirstLoginInvoked", "{\"dataType\":\"boolean\",\"d[…]
Deleted : user_pref("CT3061355.serviceLayer_service_login_loginCount", "{\"dataType\":\"number\",\"data\":\"4\[…]
Deleted : user_pref("CT3061355.serviceLayer_service_toolbarGrouping_activeCTID", "{\"dataType\":\"string\",\"d[…]
Deleted : user_pref("CT3061355.serviceLayer_service_toolbarGrouping_activeDownloadUrl", "{\"dataType\":\"strin[…]
Deleted : user_pref("CT3061355.serviceLayer_service_toolbarGrouping_activeToolbarName", "{\"dataType\":\"strin[…]
Deleted : user_pref("CT3061355.serviceLayer_service_toolbarGrouping_invoked", "{\"dataType\":\"string\",\"data[…]
Deleted : user_pref("CT3061355.serviceLayer_services_appTrackingFirstTime_lastUpdate", "1348154119832");
Deleted : user_pref("CT3061355.serviceLayer_services_appsMetadata_lastUpdate", "1348154119785");
Deleted : user_pref("CT3061355.serviceLayer_services_clientErrorLog_lastUpdate", "1348154122035");
Deleted : user_pref("CT3061355.serviceLayer_services_gottenAppsContextMenu_lastUpdate", "1348154121233");
Deleted : user_pref("CT3061355.serviceLayer_services_login_10.10.27.6_lastUpdate", "1350809453618");
Deleted : user_pref("CT3061355.serviceLayer_services_otherAppsContextMenu_lastUpdate", "1348154121244");
Deleted : user_pref("CT3061355.serviceLayer_services_searchAPI_lastUpdate", "1348154118696");
Deleted : user_pref("CT3061355.serviceLayer_services_serviceMap_lastUpdate", "1350780650536");
Deleted : user_pref("CT3061355.serviceLayer_services_toolbarContextMenu_lastUpdate", "1348154120413");
Deleted : user_pref("CT3061355.serviceLayer_services_toolbarSettings_lastUpdate", "1350816664943");
Deleted : user_pref("CT3061355.serviceLayer_services_translation_lastUpdate", "1350780650940");
Deleted : user_pref("CT3061355.settingsINI", true);
Deleted : user_pref("CT3061355.shouldFirstTimeDialog", "false");
Deleted : user_pref("CT3061355.smartbar.CTID", "CT3061355");
Deleted : user_pref("CT3061355.smartbar.Uninstall", "0");
Deleted : user_pref("CT3061355.smartbar.isHidden", true);
Deleted : user_pref("CT3061355.smartbar.toolbarName", "SmileBox EN ");
Deleted : user_pref("CT3061355.startPage", "userChanged");
Deleted : user_pref("CT3061355.toolbarBornServerTime", "20-9-2012");
Deleted : user_pref("CT3061355.toolbarCurrentServerTime", "21-10-2012");
Deleted : user_pref("browser.search.selectedEngine", "Web Search");
Deleted : user_pref("browser.startup.homepage", "hxxp://feed.snap.do/?publisher=SnapdoIMonetizer&dpid=SnapdoIM[…]
Deleted : user_pref("keyword.URL", "hxxp://feed.snap.do/?publisher=SnapdoIMonetizer&dpid=SnapdoIMonetizer&co=A[…]
Deleted : user_pref("{336D0C35-8A85-403a-B9D2-65C292C39087}.ScriptData_WSG_whiteList", "{\"search.babylon.com\[…]

*************************

AdwCleaner[S1].txt - [13646 octets] - [21/10/2012 22:13:07]

########## EOF - C:\AdwCleaner[S1].txt - [13707 octets] ##########


OTL.txt


OTL logfile created on: 21/10/2012 10:50:58 PM - Run 2
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\Andrew & Jenny\Desktop
64bit- Home Premium Edition (Version = 6.1.7600) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000c09 | Country: Australia | Language: ENA | Date Format: d/MM/yyyy

5.99 Gb Total Physical Memory | 3.96 Gb Available Physical Memory | 66.05% Memory free
11.98 Gb Paging File | 9.95 Gb Available in Paging File | 83.02% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 1397.26 Gb Total Space | 330.37 Gb Free Space | 23.64% Space Free | Partition Type: NTFS
Drive D: | 620.26 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS
Drive E: | 1397.26 Gb Total Space | 1211.80 Gb Free Space | 86.73% Space Free | Partition Type: NTFS
Drive F: | 1397.26 Gb Total Space | 990.05 Gb Free Space | 70.86% Space Free | Partition Type: NTFS
Drive J: | 14.83 Gb Total Space | 11.20 Gb Free Space | 75.54% Space Free | Partition Type: FAT32
Drive K: | 931.49 Gb Total Space | 251.66 Gb Free Space | 27.02% Space Free | Partition Type: NTFS

Computer Name: HOME-PC | User Name: Andrew & Jenny | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2012/10/21 22:08:46 | 000,602,112 | —- | M] (OldTimer Tools) – C:\Users\Andrew & Jenny\Desktop\OTL.exe
PRC - [2011/03/28 11:40:56 | 001,611,160 | —- | M] (CANON INC.) – C:\Program Files (x86)\Canon\Solution Menu EX\CNSEMAIN.EXE
PRC - [2011/01/15 16:48:44 | 000,452,016 | —- | M] (CANON INC.) – C:\Program Files (x86)\Canon\IJ Network Scanner Selector EX\CNMNSST.exe
PRC - [2010/08/19 19:52:14 | 000,241,664 | —- | M] (Huawei Technologies Co., Ltd.) – C:\ProgramData\DatacardService\DCSHelper.exe
PRC - [2010/08/19 19:52:04 | 000,229,376 | —- | M] () – C:\ProgramData\DatacardService\DCService.exe
PRC - [2009/10/17 01:41:10 | 002,384,240 | —- | M] (Check Point Software Technologies LTD) – C:\Windows\SysWOW64\ZoneLabs\vsmon.exe
PRC - [2009/10/17 01:39:40 | 001,037,192 | —- | M] (Check Point Software Technologies LTD) – C:\Program Files (x86)\Zone Labs\ZoneAlarm\zlclient.exe
PRC - [2009/06/19 00:02:54 | 000,472,112 | —- | M] (Cisco Systems, Inc.) – C:\Program Files (x86)\Pure Networks\Network Magic\nmapp.exe
PRC - [2009/06/18 15:41:50 | 000,647,216 | —- | M] (Cisco Systems, Inc.) – C:\Program Files (x86)\Common Files\Pure Networks Shared\Platform\nmsrvc.exe
PRC - [2009/06/18 15:41:50 | 000,647,216 | —- | M] (Cisco Systems, Inc.) – C:\Program Files (x86)\Common Files\Pure Networks Shared\Platform\nmctxth.exe
PRC - [2008/11/04 12:40:24 | 002,087,424 | —- | M] (Vodafone) – C:\Program Files (x86)\Vodafone\Vodafone Mobile Connect\Bin\MobileConnect.exe
PRC - [2008/11/04 12:39:20 | 000,014,336 | —- | M] (Vodafone) – C:\Program Files (x86)\Vodafone\Vodafone Mobile Connect\Bin\VMCService.exe
PRC - [2007/08/10 10:12:20 | 000,118,784 | —- | M] (Bytemobile, Inc.) – C:\Windows\SysWOW64\bmwebcfg.exe
PRC - [2007/05/04 11:39:28 | 000,910,896 | —- | M] (Nero AG) – C:\Program Files (x86)\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
PRC - [2007/05/04 11:39:12 | 000,149,040 | —- | M] (Nero AG) – C:\Program Files (x86)\Common Files\Ahead\Lib\NMBgMonitor.exe
PRC - [2006/12/22 08:31:50 | 000,108,712 | —- | M] () – C:\Program Files (x86)\Adobe\Photoshop Elements 5.0\PhotoshopElementsFileAgent.exe
PRC - [2006/12/22 08:29:56 | 000,067,752 | —- | M] (Adobe Systems Incorporated) – C:\Program Files (x86)\Adobe\Photoshop Elements 5.0\apdproxy.exe
PRC - [1996/11/21 01:00:00 | 000,111,376 | —- | M] () – C:\Program Files (x86)\Microsoft Office\Office\FINDFAST.EXE
PRC - [1996/11/21 01:00:00 | 000,051,984 | —- | M] () – C:\Program Files (x86)\Microsoft Office\Office\OSA.EXE


========== Modules (No Company Name) ==========

MOD - [2012/06/14 09:16:19 | 000,538,112 | —- | M] () – C:\Windows\assembly\NativeImages_v2.0.50727_32\VMC.BaseServices.Xm#\adc5a90eca8f2bb57f15b13935c77471\VMC.BaseServices.XmlSerializers.ni.dll
MOD - [2012/06/14 09:16:17 | 000,675,840 | —- | M] () – C:\Windows\assembly\NativeImages_v2.0.50727_32\VMC.BaseServices.Pl#\2e3569d6bc06250721a4a779c7aacfc4\VMC.BaseServices.Platform.ni.dll
MOD - [2012/06/14 09:16:17 | 000,443,392 | —- | M] () – C:\Windows\assembly\NativeImages_v2.0.50727_32\VMC.BaseServices.Da#\9be9c63304796c983c5fd4077dae3208\VMC.BaseServices.DataAccessor.ni.dll
MOD - [2012/06/14 09:16:16 | 003,505,152 | —- | M] () – C:\Windows\assembly\NativeImages_v2.0.50727_32\MobileConnect\52eb2f93d165ce400a17c666b4002a54\MobileConnect.ni.exe
MOD - [2012/06/14 09:16:16 | 000,339,456 | —- | M] () – C:\Windows\assembly\NativeImages_v2.0.50727_32\VMC.UI.CommonDialogs\91aa1915ebb4ffb0c974bca9a6d1bc5c\VMC.UI.CommonDialogs.ni.dll
MOD - [2012/06/14 09:05:37 | 000,212,992 | —- | M] () – C:\Windows\assembly\NativeImages_v2.0.50727_32\System.ServiceProce#\8b7a7f9c607e09bfa03c07b5ff3a8ae3\System.ServiceProcess.ni.dll
MOD - [2012/06/14 09:04:59 | 012,433,920 | —- | M] () – C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\009c50fb69919b90fb233cb4c35d0ad7\System.Windows.Forms.ni.dll
MOD - [2012/06/14 09:04:51 | 001,591,808 | —- | M] () – C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\ebefde27b0ef7f39bb49c493b34a602c\System.Drawing.ni.dll
MOD - [2012/05/11 21:51:26 | 000,169,984 | —- | M] () – C:\Windows\assembly\NativeImages_v2.0.50727_32\CsUtil\7ed3f53727ef6b89a6a320fa3e185ff8\CsUtil.ni.dll
MOD - [2012/05/11 21:51:26 | 000,101,888 | —- | M] () – C:\Windows\assembly\NativeImages_v2.0.50727_32\Interop.Shell32\d1b011c5b91a91a105a2d62de575c28f\Interop.Shell32.ni.dll
MOD - [2012/05/11 21:51:26 | 000,067,072 | —- | M] () – C:\Windows\assembly\NativeImages_v2.0.50727_32\VMC.ConnectionServi#\73df85c5b92a249345d583effe8b1552\VMC.ConnectionServices.TrafficOptimiser.ni.dll
MOD - [2012/05/11 21:51:26 | 000,036,864 | —- | M] () – C:\Windows\assembly\NativeImages_v2.0.50727_32\Interop.NGCLNAPILib\0ff1b1a98167de1cd9715ff913a66829\Interop.NGCLNAPILib.ni.dll
MOD - [2012/05/11 21:51:25 | 000,727,040 | —- | M] () – C:\Windows\assembly\NativeImages_v2.0.50727_32\WwanWrapper\9666982c39bb4d9b30815bfae66c1376\WwanWrapper.ni.dll
MOD - [2012/05/11 21:51:25 | 000,722,432 | —- | M] () – C:\Windows\assembly\NativeImages_v2.0.50727_32\VMC.ConnectionServi#\07c8c906ceb688879c31c24a43a1eee9\VMC.ConnectionServices.ni.dll
MOD - [2012/05/11 21:51:25 | 000,033,792 | —- | M] () – C:\Windows\assembly\NativeImages_v2.0.50727_32\VMC.WindowsService.#\c0c1270f83dbb0332a133ecb9b6f8741\VMC.WindowsService.Messaging.ni.dll
MOD - [2012/05/11 21:51:24 | 000,248,832 | —- | M] () – C:\Windows\assembly\NativeImages_v2.0.50727_32\VMC.WindowsService.#\cc32f30b07f0444d9e84366d74d221e8\VMC.WindowsService.Core.ni.dll
MOD - [2012/05/11 21:51:23 | 000,030,720 | —- | M] () – C:\Windows\assembly\NativeImages_v2.0.50727_32\VMC.BaseServices.Ou#\2326ab0e72b221164d6b81157b0b4ef4\VMC.BaseServices.OutlookConnector.ni.dll
MOD - [2012/05/11 21:51:22 | 000,251,392 | —- | M] () – C:\Windows\assembly\NativeImages_v2.0.50727_32\Interop.DWUpdateSer#\97e1fe96dd6740bf2d719149f2cba25c\Interop.DWUpdateServiceLib.ni.dll
MOD - [2012/05/11 21:51:20 | 000,997,888 | —- | M] () – C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Management\3f9dee1ce0ccb42145293a5bfcbe7205\System.Management.ni.dll
MOD - [2012/05/11 21:51:20 | 000,403,968 | —- | M] () – C:\Windows\assembly\NativeImages_v2.0.50727_32\VMC.ConnectionServi#\18bf0982ba7357d0f5d988c1b042a116\VMC.ConnectionServicesInterface.ni.dll
MOD - [2012/05/11 21:40:27 | 000,771,584 | —- | M] () – C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Runtime.Remo#\0c00b1a8336dd4c1bd1ebce7780f20b4\System.Runtime.Remoting.ni.dll
MOD - [2012/05/11 21:40:26 | 006,618,624 | —- | M] () – C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Data\294d439cfe959b5528ca81d37d3d502f\System.Data.ni.dll
MOD - [2012/05/11 21:40:26 | 000,627,200 | —- | M] () – C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Transactions\61fbbd8bc7d76972115b292b132ff2d1\System.Transactions.ni.dll
MOD - [2012/05/11 21:39:49 | 000,680,960 | —- | M] () – C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Security\61af058c2bc079f28397a29ed145fbc7\System.Security.ni.dll
MOD - [2012/05/11 21:39:47 | 005,453,312 | —- | M] () – C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Xml\5c85c9c42e1b8a8760de82ecb4c7d582\System.Xml.ni.dll
MOD - [2012/05/11 21:39:45 | 000,971,264 | —- | M] () – C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Configuration\cb079eab134fd1a752ad91db13274110\System.Configuration.ni.dll
MOD - [2012/05/11 21:39:44 | 007,952,384 | —- | M] () – C:\Windows\assembly\NativeImages_v2.0.50727_32\System\2ebb3c259eab50af565e3a8dba6ad20e\System.ni.dll
MOD - [2012/05/11 21:39:37 | 011,490,816 | —- | M] () – C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\5858678a79aae31262b0214424245d06\mscorlib.ni.dll
MOD - [2011/06/24 23:56:36 | 000,087,328 | —- | M] () – C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll
MOD - [2011/06/24 23:56:14 | 001,241,888 | —- | M] () – C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll
MOD - [2009/07/14 12:15:45 | 000,364,544 | —- | M] () – C:\Windows\SysWOW64\msjetoledb40.dll
MOD - [2009/06/11 08:23:19 | 000,261,632 | —- | M] () – C:\Windows\assembly\GAC_32\System.Transactions\2.0.0.0__b77a5c561934e089\System.Transactions.dll
MOD - [2009/06/11 08:23:17 | 002,933,248 | —- | M] () – C:\Windows\assembly\GAC_32\System.Data\2.0.0.0__b77a5c561934e089\System.Data.dll
MOD - [2009/05/13 14:53:24 | 000,394,752 | —- | M] () – C:\Program Files (x86)\Common Files\Pure Networks Shared\Platform\CAntiVirusCOM.dll
MOD - [2009/05/13 14:53:24 | 000,282,112 | —- | M] () – C:\Program Files (x86)\Common Files\Pure Networks Shared\Platform\CFirewallCOM.dll
MOD - [2007/02/16 18:40:42 | 005,521,408 | —- | M] () – C:\Program Files (x86)\Common Files\LightScribe\QtGui4.dll
MOD - [2007/02/16 18:40:40 | 001,466,368 | —- | M] () – C:\Program Files (x86)\Common Files\LightScribe\QtCore4.dll
MOD - [1996/11/21 01:00:00 | 003,774,224 | —- | M] () – C:\Program Files (x86)\Microsoft Office\Office\MSO97.DLL
MOD - [1996/11/21 01:00:00 | 000,111,376 | —- | M] () – C:\Program Files (x86)\Microsoft Office\Office\FINDFAST.EXE
MOD - [1996/11/21 01:00:00 | 000,051,984 | —- | M] () – C:\Program Files (x86)\Microsoft Office\Office\OSA.EXE


========== Services (SafeList) ==========

SRV:64bit: - [2009/10/15 00:30:58 | 000,800,624 | —- | M] (Check Point Software Technologies) [Auto | Running] – C:\Program Files\CheckPoint\ZAForceField\ISWSVC.exe – (IswSvc)
SRV:64bit: - [2009/08/18 02:36:20 | 000,203,264 | —- | M] (AMD) [Auto | Running] – C:\Windows\SysNative\atiesrxx.exe – (AMD External Events Utility)
SRV:64bit: - [2009/07/14 12:41:27 | 001,011,712 | —- | M] (Microsoft Corporation) [Auto | Running] – C:\Program Files\Windows Defender\MpSvc.dll – (WinDefend)
SRV - [2012/10/11 12:05:59 | 000,115,168 | —- | M] (Mozilla Foundation) [On_Demand | Stopped] – C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe – (MozillaMaintenance)
SRV - [2010/08/19 19:52:04 | 000,229,376 | —- | M] () [Auto | Running] – C:\ProgramData\DatacardService\DCService.exe – (DCService.exe)
SRV - [2010/08/13 10:13:32 | 000,066,112 | —- | M] (NOS Microsystems Ltd.) [On_Demand | Stopped] – C:\Program Files (x86)\NOS\bin\getPlus_Helper_3004.dll – (nosGetPlusHelper)
SRV - [2010/03/18 14:16:28 | 000,130,384 | —- | M] (Microsoft Corporation) [Auto | Stopped] – C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe – (clr_optimization_v4.0.30319_32)
SRV - [2009/10/17 01:41:10 | 002,384,240 | —- | M] (Check Point Software Technologies LTD) [Auto | Running] – C:\Windows\SysWOW64\ZoneLabs\vsmon.exe – (vsmon)
SRV - [2009/06/18 15:41:50 | 000,647,216 | —- | M] (Cisco Systems, Inc.) [Auto | Running] – C:\Program Files (x86)\Common Files\Pure Networks Shared\Platform\nmsrvc.exe – (nmservice)
SRV - [2009/06/11 08:23:09 | 000,066,384 | —- | M] (Microsoft Corporation) [Disabled | Stopped] – C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe – (clr_optimization_v2.0.50727_32)
SRV - [2008/11/04 12:39:20 | 000,014,336 | —- | M] (Vodafone) [Auto | Running] – C:\Program Files (x86)\Vodafone\Vodafone Mobile Connect\Bin\VMCService.exe – (VMCService)
SRV - [2007/08/10 10:12:20 | 000,118,784 | —- | M] (Bytemobile, Inc.) [Auto | Running] – C:\Windows\SysWOW64\bmwebcfg.exe – (bmwebcfg)
SRV - [2006/12/22 08:31:50 | 000,108,712 | —- | M] () [Auto | Running] – C:\Program Files (x86)\Adobe\Photoshop Elements 5.0\PhotoshopElementsFileAgent.exe – (AdobeActiveFileMonitor5.0)


========== Driver Services (SafeList) ==========

DRV:64bit: - [2012/03/01 17:54:38 | 000,022,896 | —- | M] (Microsoft Corporation) [Recognizer | Boot | Unknown] – C:\Windows\SysNative\drivers\fs_rec.sys – (Fs_Rec)
DRV:64bit: - [2012/02/15 11:01:50 | 000,052,736 | —- | M] (Apple, Inc.) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\usbaapl64.sys – (USBAAPL64)
DRV:64bit: - [2011/08/01 15:59:06 | 000,045,416 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] – C:\Windows\SysNative\drivers\point64.sys – (Point64)
DRV:64bit: - [2011/03/11 17:22:41 | 000,107,904 | —- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\amdsata.sys – (amdsata)
DRV:64bit: - [2011/03/11 17:22:40 | 000,027,008 | —- | M] (Advanced Micro Devices) [Kernel | Boot | Running] – C:\Windows\SysNative\drivers\amdxata.sys – (amdxata)
DRV:64bit: - [2010/08/31 19:09:00 | 000,256,000 | —- | M] (Huawei Technologies Co., Ltd.) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\ewusbnet.sys – (ewusbnet)
DRV:64bit: - [2010/08/07 18:49:04 | 000,121,600 | —- | M] (Huawei Technologies Co., Ltd.) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\ewusbmdm.sys – (hwdatacard)
DRV:64bit: - [2010/07/27 16:26:34 | 000,086,016 | —- | M] (Huawei Technologies Co., Ltd.) [Kernel | On_Demand | Running] – C:\Windows\SysNative\drivers\ew_jubusenum.sys – (huawei_enumerator)
DRV:64bit: - [2010/07/27 10:52:16 | 000,117,248 | —- | M] (Huawei Technologies Co., Ltd.) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\ew_hwusbdev.sys – (ew_hwusbdev)
DRV:64bit: - [2010/07/08 15:18:38 | 000,694,888 | —- | M] (Realtek Semiconductor Corporation ) [Kernel | On_Demand | Running] – C:\Windows\SysNative\drivers\RTL8192su.sys – (RTL8192su)
DRV:64bit: - [2009/10/15 00:30:04 | 000,032,888 | —- | M] (Check Point Software Technologies) [Kernel | Auto | Running] – C:\Program Files\CheckPoint\ZAForceField\ISWKL.sys – (ISWKL)
DRV:64bit: - [2009/10/12 18:15:26 | 000,351,248 | —- | M] (Kaspersky Lab) [File_System | System | Running] – C:\Windows\SysNative\drivers\klif.sys – (KLIF)
DRV:64bit: - [2009/10/12 18:15:26 | 000,157,712 | —- | M] (Kaspersky Lab) [Kernel | System | Running] – C:\Windows\SysNative\drivers\kl1.sys – (kl1)
DRV:64bit: - [2009/09/22 03:02:56 | 000,445,128 | —- | M] (Check Point Software Technologies LTD) [Kernel | System | Running] – C:\Windows\SysNative\drivers\vsdatant.sys – (Vsdatant)
DRV:64bit: - [2009/08/18 03:48:48 | 006,037,504 | —- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] – C:\Windows\SysNative\drivers\atikmdag.sys – (atikmdag)
DRV:64bit: - [2009/07/14 12:52:20 | 000,194,128 | —- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\amdsbs.sys – (amdsbs)
DRV:64bit: - [2009/07/14 12:48:04 | 000,065,600 | —- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\lsi_sas2.sys – (LSI_SAS2)
DRV:64bit: - [2009/07/14 12:47:48 | 000,077,888 | —- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\HpSAMD.sys – (HpSAMD)
DRV:64bit: - [2009/07/14 12:45:55 | 000,024,656 | —- | M] (Promise Technology) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\stexstor.sys – (stexstor)
DRV:64bit: - [2009/07/14 11:39:20 | 000,023,040 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\WSDPrint.sys – (WSDPrintDevice)
DRV:64bit: - [2009/07/14 11:35:37 | 000,025,088 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\WSDScan.sys – (WSDScan)
DRV:64bit: - [2009/07/14 11:09:15 | 000,145,920 | —- | M] (Microsoft Corporation) [Kernel | Auto | Running] – C:\Windows\SysNative\drivers\rmcast.sys – (RMCAST)
DRV:64bit: - [2009/07/14 11:06:43 | 000,060,288 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\61883.sys – (61883)
DRV:64bit: - [2009/07/14 11:06:43 | 000,048,768 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\avc.sys – (Avc)
DRV:64bit: - [2009/07/14 11:06:42 | 000,061,440 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\msdv.sys – (MSDV)
DRV:64bit: - [2009/07/14 11:06:40 | 000,017,664 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\avcstrm.sys – (AVCSTRM)
DRV:64bit: - [2009/07/14 11:06:39 | 000,056,448 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\mstape.sys – (MSTAPE)
DRV:64bit: - [2009/06/11 07:35:33 | 000,389,120 | —- | M] (Marvell) [Kernel | On_Demand | Running] – C:\Windows\SysNative\drivers\yk62x64.sys – (yukonw7)
DRV:64bit: - [2009/06/11 07:34:33 | 003,286,016 | —- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\evbda.sys – (ebdrv)
DRV:64bit: - [2009/06/11 07:34:28 | 000,468,480 | —- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\bxvbda.sys – (b06bdrv)
DRV:64bit: - [2009/06/11 07:34:23 | 000,270,848 | —- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\b57nd60a.sys – (b57nd60a)
DRV:64bit: - [2009/06/11 07:31:59 | 000,031,232 | —- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\hcw85cir.sys – (hcw85cir)
DRV:64bit: - [2009/05/25 04:38:20 | 000,966,144 | —- | M] (Ralink Technology Corp.) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\netr28ux.sys – (netr28ux)
DRV:64bit: - [2009/05/18 15:17:08 | 000,034,152 | —- | M] (GEAR Software Inc.) [Kernel | On_Demand | Running] – C:\Windows\SysNative\drivers\GEARAspiWDM.sys – (GEARAspiWDM)
DRV:64bit: - [2009/05/13 14:47:44 | 000,033,072 | —- | M] (Cisco Systems, Inc.) [Kernel | Auto | Running] – C:\Windows\SysNative\drivers\purendis.sys – (purendis)
DRV:64bit: - [2009/05/13 14:47:42 | 000,031,536 | —- | M] (Cisco Systems, Inc.) [Kernel | Auto | Running] – C:\Windows\SysNative\drivers\pnarp.sys – (pnarp)
DRV:64bit: - [2008/05/06 16:06:00 | 000,014,464 | —- | M] (Western Digital Technologies) [Kernel | On_Demand | Running] – C:\Windows\SysNative\drivers\wdcsam64.sys – (WDC_SAM)
DRV:64bit: - [2005/03/29 02:30:38 | 000,008,192 | —- | M] () [Kernel | On_Demand | Running] – C:\Windows\SysNative\drivers\ASACPI.sys – (MTsensor)
DRV - [2009/10/17 01:41:16 | 000,445,640 | —- | M] (Check Point Software Technologies LTD) [Kernel | System | Running] – C:\Windows\SysWOW64\drivers\vsdatant.sys – (Vsdatant)
DRV - [2009/07/14 12:19:10 | 000,019,008 | —- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] – C:\Windows\SysWOW64\drivers\wimmount.sys – (WIMMount)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
IE:64bit: - HKLM\..\SearchScopes,DefaultScope =
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\..\SearchScopes,DefaultScope =
IE - HKLM\..\SearchScopes\{acbd5593-e5ee-4c15-b48f-1823ce819dec}: "URL" = http://search.mywebsearch.com/mywebsearch/…r={searchTerms}


IE - HKU\.DEFAULT\..\SearchScopes,DefaultScope =
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-18\..\SearchScopes,DefaultScope =
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-19\..\SearchScopes,DefaultScope =

IE - HKU\S-1-5-20\..\SearchScopes,DefaultScope =

IE - HKU\S-1-5-21-3468640803-2489096565-429190105-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = http://www.google.com
IE - HKU\S-1-5-21-3468640803-2489096565-429190105-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.google.com
IE - HKU\S-1-5-21-3468640803-2489096565-429190105-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com
IE - HKU\S-1-5-21-3468640803-2489096565-429190105-1000\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKU\S-1-5-21-3468640803-2489096565-429190105-1000\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = http://www.google.com
IE - HKU\S-1-5-21-3468640803-2489096565-429190105-1000\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com
IE - HKU\S-1-5-21-3468640803-2489096565-429190105-1000\..\SearchScopes,DefaultScope =
IE - HKU\S-1-5-21-3468640803-2489096565-429190105-1000\..\SearchScopes\{acbd5593-e5ee-4c15-b48f-1823ce819dec}: "URL" = http://search.mywebsearch.com/mywebsearch/…r={searchTerms}
IE - HKU\S-1-5-21-3468640803-2489096565-429190105-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-21-3468640803-2489096565-429190105-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

========== FireFox ==========

FF - prefs.js..extensions.enabledItems: [removed]:1.0
FF - prefs.js..extensions.enabledItems: {E2883E8F-472F-4fb0-9522-AC9BF37916A7}:[removed]
FF - prefs.js..extensions.enabledItems: {FFB96CC1-7EB3-449D-B827-DB661701C6BB}:[removed]
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}:6.0.22
FF - user.js - File not found

FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_3_300_270.dll File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_3_300_270.dll ()
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@canon.com/EPPEX: C:\Program Files (x86)\Canon\Easy-PhotoPrint EX\NPEZFFPI.DLL (CANON INC.)
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: C:\Program Files (x86)\DivX\DivX Web Player\npdivx32.dll (DivX,Inc.)
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Player Plugin,version=1.0.0: C:\Program Files (x86)\DivX\DivX Player\npDivxPlayerPlugin.dll (DivX, Inc)
FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files (x86)\Microsoft Silverlight\4.1.10329.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@nosltd.com/getPlus+®,version=1.6.2.90: C:\Program Files (x86)\NOS\bin\np_gp.dll (NOS Microsystems Ltd.)
FF - HKLM\Software\MozillaPlugins\@pack.google.com/Google Updater;version=14: C:\Program Files (x86)\Google\Google Updater\2.4.2432.1652\npCIDetect14.dll (Google)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.21.123\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.21.123\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

64bit-FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{FFB96CC1-7EB3-449D-B827-DB661701C6BB}: C:\PROGRAM FILES\CHECKPOINT\ZAFORCEFIELD\TRUSTCHECKER [2012/03/10 17:24:42 | 000,000,000 | —D | M]
64bit-FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{336D0C35-8A85-403a-B9D2-65C292C39087}: C:\PROGRAM FILES\WEB ASSISTANT\FIREFOX
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{FFB96CC1-7EB3-449D-B827-DB661701C6BB}: C:\Program Files\CheckPoint\ZAForceField\WOW64\TrustChecker [2009/11/28 18:47:23 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 16.0.1\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012/10/21 19:47:08 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 16.0.1\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2012/10/21 16:47:28 | 000,000,000 | —D | M]

[2009/11/05 21:44:59 | 000,000,000 | —D | M] (No name found) – C:\Users\Andrew & Jenny\AppData\Roaming\Mozilla\Extensions
[2012/10/21 22:13:11 | 000,000,000 | —D | M] (No name found) – C:\Users\Andrew & Jenny\AppData\Roaming\Mozilla\Firefox\Profiles\7r2we53b.default\extensions
[2010/09/19 14:13:20 | 000,000,000 | —D | M] (Microsoft .NET Framework Assistant) – C:\Users\Andrew & Jenny\AppData\Roaming\Mozilla\Firefox\Profiles\7r2we53b.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2011/05/08 00:49:02 | 000,000,000 | —D | M] (No name found) – C:\Users\Andrew & Jenny\AppData\Roaming\Mozilla\Firefox\Profiles\7r2we53b.default\extensions\nostmp
[2012/10/21 19:47:08 | 000,000,000 | —D | M] (No name found) – C:\Program Files (x86)\Mozilla Firefox\extensions
[2012/10/11 12:06:18 | 000,261,600 | —- | M] (Mozilla Foundation) – C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll
[2010/11/15 20:04:35 | 000,472,808 | —- | M] (Sun Microsystems, Inc.) – C:\Program Files (x86)\mozilla firefox\plugins\npdeployJava1.dll
[2012/10/11 12:05:38 | 000,002,465 | —- | M] () – C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml
[2012/10/11 12:05:38 | 000,002,058 | —- | M] () – C:\Program Files (x86)\mozilla firefox\searchplugins\twitter.xml

O1 HOSTS File: ([2006/09/19 08:37:24 | 000,000,761 | —- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: ::1 localhost
O2:64bit: - BHO: (ZoneAlarm Toolbar Registrar) - {8A4A36C2-0535-4D2C-BD3D-496CB7EED6E3} - C:\Program Files\CheckPoint\ZAForceField\TrustChecker\bin\TrustCheckerIEPlugin.dll (Check Point Software Technologies)
O2:64bit: - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.2.4204.1700\swg64.dll (Google Inc.)
O2 - BHO: (Canon Easy-WebPrint EX BHO) - {3785D0AD-BFFF-47F6-BF5B-A587C162FED9} - C:\Program Files (x86)\Canon\Easy-WebPrint EX\ewpexbho.dll (CANON INC.)
O2 - BHO: (ZoneAlarm Toolbar Registrar) - {8A4A36C2-0535-4D2C-BD3D-496CB7EED6E3} - C:\Program Files\CheckPoint\ZAForceField\WOW64\TrustChecker\bin\TrustCheckerIEPlugin.dll (Check Point Software Technologies)
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files (x86)\Google\GoogleToolbarNotifier\5.2.4204.1700\swg.dll (Google Inc.)
O3:64bit: - HKLM\..\Toolbar: (ZoneAlarm Toolbar) - {EE2AC4E5-B0B0-4EC6-88A9-BCA1A32AB107} - C:\Program Files\CheckPoint\ZAForceField\TrustChecker\bin\TrustCheckerIEPlugin.dll (Check Point Software Technologies)
O3 - HKLM\..\Toolbar: (Canon Easy-WebPrint EX) - {759D9886-0C6F-4498-BAB6-4A5F47C6C72F} - C:\Program Files (x86)\Canon\Easy-WebPrint EX\ewpexhlp.dll (CANON INC.)
O3 - HKLM\..\Toolbar: (ZoneAlarm Toolbar) - {EE2AC4E5-B0B0-4EC6-88A9-BCA1A32AB107} - C:\Program Files\CheckPoint\ZAForceField\WOW64\TrustChecker\bin\TrustCheckerIEPlugin.dll (Check Point Software Technologies)
O3:64bit: - HKU\S-1-5-21-3468640803-2489096565-429190105-1000\..\Toolbar\WebBrowser: (ZoneAlarm Toolbar) - {EE2AC4E5-B0B0-4EC6-88A9-BCA1A32AB107} - C:\Program Files\CheckPoint\ZAForceField\TrustChecker\bin\TrustCheckerIEPlugin.dll (Check Point Software Technologies)
O3 - HKU\S-1-5-21-3468640803-2489096565-429190105-1000\..\Toolbar\WebBrowser: (ZoneAlarm Toolbar) - {EE2AC4E5-B0B0-4EC6-88A9-BCA1A32AB107} - C:\Program Files\CheckPoint\ZAForceField\WOW64\TrustChecker\bin\TrustCheckerIEPlugin.dll (Check Point Software Technologies)
O4:64bit: - HKLM..\Run: [CanonMyPrinter] C:\Program Files\Canon\MyPrinter\BJMyPrt.exe (CANON INC.)
O4:64bit: - HKLM..\Run: [IntelliPoint] C:\Program Files\Microsoft IntelliPoint\ipoint.exe (Microsoft Corporation)
O4:64bit: - HKLM..\Run: [ISW] C:\Program Files\CheckPoint\ZAForceField\ForceField.exe (Check Point Software Technologies)
O4:64bit: - HKLM..\Run: [Linksys Wireless Manager] C:\Program Files (x86)\Linksys\Linksys Wireless Manager\LinksysWirelessManager.exe (Cisco Systems, Inc.)
O4 - HKLM..\Run: [Adobe Photo Downloader] C:\Program Files (x86)\Adobe\Photoshop Elements 5.0\apdproxy.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [APSDaemon] C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
O4 - HKLM..\Run: [CanonSolutionMenuEx] C:\Program Files (x86)\Canon\Solution Menu EX\CNSEMAIN.EXE (CANON INC.)
O4 - HKLM..\Run: [IJNetworkScannerSelectorEX] C:\Program Files (x86)\Canon\IJ Network Scanner Selector EX\CNMNSST.exe (CANON INC.)
O4 - HKLM..\Run: [MobileConnect] C:\Program Files (x86)\Vodafone\Vodafone Mobile Connect\Bin\MobileConnect.exe (Vodafone)
O4 - HKLM..\Run: [nmapp] C:\Program Files (x86)\Pure Networks\Network Magic\nmapp.exe (Cisco Systems, Inc.)
O4 - HKLM..\Run: [nmctxth] C:\Program Files (x86)\Common Files\Pure Networks Shared\Platform\nmctxth.exe (Cisco Systems, Inc.)
O4 - HKLM..\Run: [ZoneAlarm Client] C:\Program Files (x86)\Zone Labs\ZoneAlarm\zlclient.exe (Check Point Software Technologies LTD)
O4 - HKU\S-1-5-19..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
O4 - HKU\S-1-5-20..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
O4 - HKU\S-1-5-21-3468640803-2489096565-429190105-1000..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] C:\Program Files (x86)\Common Files\Ahead\Lib\NMBgMonitor.exe (Nero AG)
O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found
O4 - HKU\S-1-5-20..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found
O4 - Startup: C:\Users\Andrew & Jenny\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Find Fast.lnk = C:\Program Files (x86)\Microsoft Office\Office\FINDFAST.EXE ()
O4 - Startup: C:\Users\Andrew & Jenny\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Office Startup.lnk = C:\Program Files (x86)\Microsoft Office\Office\OSA.EXE ()
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000007 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)
O1364bit: - gopher Prefix: missing
O13 - gopher Prefix: missing
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload2.macromedia.com/get/shoc…ash/swflash.cab (Shockwave Flash Object)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{10B9E5EC-7BE7-4BE1-94E0-83807B10831C}: NameServer = 61.8.0.113,210.23.129.34
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{1920803C-24C9-47B6-89FA-DEDCF6FB518E}: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{2DD58651-9A84-40B7-8946-CC3534CA046C}: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{78A6B2B9-CFF7-443B-B184-4F764B1830A5}: DhcpNameServer = 10.1.1.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{AA6BCB74-4936-4938-BE18-4C30E925193F}: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{DF5F2FDB-3C5E-4F6A-990E-FDA759E19F9A}: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{F0890264-6DAF-4D4D-BE5B-9A458D415355}: NameServer = 211.29.132.12 61.88.88.88
O18:64bit: - Protocol\Handler\pure-go {4746C79A-2042-4332-8650-48966E44ABA8} - C:\Program Files (x86)\Common Files\Pure Networks Shared\Platform\amd64\puresp4.dll (Cisco Systems, Inc.)
O18 - Protocol\Handler\pure-go {4746C79A-2042-4332-8650-48966E44ABA8} - C:\Program Files (x86)\Common Files\Pure Networks Shared\Platform\puresp4.dll (Cisco Systems, Inc.)
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\SysWow64\userinit.exe (Microsoft Corporation)
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O24 - Desktop WallPaper:
O24 - Desktop BackupWallPaper:
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2003/07/23 01:12:32 | 000,290,816 | R— | M] () - D:\Autorun.exe – [ CDFS ]
O32 - AutoRun File - [2003/07/16 05:47:12 | 000,000,046 | R— | M] () - D:\autorun.inf – [ CDFS ]
O33 - MountPoints2\{5bb4073e-a76d-11de-838a-002618085d10}\Shell - "" = AutoRun
O33 - MountPoints2\{5bb4073e-a76d-11de-838a-002618085d10}\Shell\AutoRun\command - "" = H:\LaunchU3.exe -a
O33 - MountPoints2\{7984d06a-8e39-11de-90ba-806e6f6e6963}\Shell - "" = AutoRun
O33 - MountPoints2\{7984d06a-8e39-11de-90ba-806e6f6e6963}\Shell\AutoRun\command - "" = D:\Autorun.exe – [2003/07/23 01:12:32 | 000,290,816 | R— | M] ()
O33 - MountPoints2\{9126fd1d-aaa3-11de-8577-002618085d10}\Shell - "" = AutoRun
O33 - MountPoints2\{9126fd1d-aaa3-11de-8577-002618085d10}\Shell\AutoRun\command - "" = G:\setup_vmc_lite.exe /checkApplicationPresence
O33 - MountPoints2\{9146f029-b170-11de-80a7-002618085d10}\Shell - "" = AutoRun
O33 - MountPoints2\{9146f029-b170-11de-80a7-002618085d10}\Shell\AutoRun\command - "" = G:\setup_vmc_lite.exe /checkApplicationPresence
O33 - MountPoints2\{a83f1202-b5ae-11de-8ce1-002618085d10}\Shell - "" = AutoRun
O33 - MountPoints2\{a83f1202-b5ae-11de-8ce1-002618085d10}\Shell\AutoRun\command - "" = H:\setup_vmc_lite.exe /checkApplicationPresence
O33 - MountPoints2\{c71dc276-0be6-11df-9212-002618085d10}\Shell - "" = AutoRun
O33 - MountPoints2\{c71dc276-0be6-11df-9212-002618085d10}\Shell\AutoRun\command - "" = G:\setup_vmc_lite.exe /checkApplicationPresence
O33 - MountPoints2\{c71dc279-0be6-11df-9212-002618085d10}\Shell - "" = AutoRun
O33 - MountPoints2\{c71dc279-0be6-11df-9212-002618085d10}\Shell\AutoRun\command - "" = H:\setup_vmc_lite.exe /checkApplicationPresence
O33 - MountPoints2\{ded609ef-7cbb-11e0-ab48-687f74e6a4cc}\Shell - "" = AutoRun
O33 - MountPoints2\{ded609ef-7cbb-11e0-ab48-687f74e6a4cc}\Shell\AutoRun\command - "" = G:\AutoRun.exe
O33 - MountPoints2\{ded609fa-7cbb-11e0-ab48-687f74e6a4cc}\Shell - "" = AutoRun
O33 - MountPoints2\{ded609fa-7cbb-11e0-ab48-687f74e6a4cc}\Shell\AutoRun\command - "" = G:\AutoRun.exe
O33 - MountPoints2\{ded60a04-7cbb-11e0-ab48-687f74e6a4cc}\Shell - "" = AutoRun
O33 - MountPoints2\{ded60a04-7cbb-11e0-ab48-687f74e6a4cc}\Shell\AutoRun\command - "" = H:\AutoRun.exe
O34 - HKLM BootExecute: (autocheck autochk *)
O35:64bit: - HKLM\..comfile [open] – "%1" %*
O35:64bit: - HKLM\..exefile [open] – "%1" %*
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37:64bit: - HKLM\…com [@ = comfile] – "%1" %*
O37:64bit: - HKLM\…exe [@ = exefile] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)


CREATERESTOREPOINT
Restore point Set: OTL Restore Point

========== Files/Folders - Created Within 30 Days ==========

[2012/10/21 22:09:41 | 004,731,392 | —- | C] (AVAST Software) – C:\Users\Andrew & Jenny\Desktop\aswMBR.exe
[2012/10/21 22:08:43 | 000,602,112 | —- | C] (OldTimer Tools) – C:\Users\Andrew & Jenny\Desktop\OTL.exe
[2012/10/21 20:03:00 | 000,388,608 | —- | C] (Trend Micro Inc.) – C:\Users\Andrew & Jenny\Desktop\HiJackThis.exe
[2012/10/21 19:47:10 | 000,000,000 | —D | C] – C:\Program Files (x86)\Mozilla Maintenance Service
[2012/10/21 18:29:10 | 000,000,000 | —D | C] – C:\Program Files (x86)\Smilebox Toolbar Removal Tool
[2012/10/21 16:47:26 | 000,000,000 | —D | C] – C:\Program Files (x86)\Mozilla Firefox
[2012/09/23 04:01:11 | 000,096,768 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\mshtmled.dll
[2012/09/23 04:01:11 | 000,073,216 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\mshtmled.dll
[2012/09/23 04:01:10 | 000,248,320 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\ieui.dll
[2012/09/23 04:01:10 | 000,231,936 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\url.dll
[2012/09/23 04:01:10 | 000,176,640 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\ieui.dll
[2012/09/23 04:01:10 | 000,173,056 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\ieUnatt.exe
[2012/09/23 04:01:10 | 000,142,848 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\ieUnatt.exe
[2012/09/23 04:01:09 | 000,237,056 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\url.dll
[2012/09/23 04:01:08 | 002,312,704 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\jscript9.dll
[2012/09/23 04:01:08 | 001,494,528 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\inetcpl.cpl
[2012/09/23 04:01:08 | 001,427,968 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\inetcpl.cpl
[2012/09/23 04:01:08 | 000,729,088 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\msfeeds.dll
[2012/09/23 04:01:05 | 000,816,640 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\jscript.dll
[2012/09/23 04:01:05 | 000,717,824 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\jscript.dll
[2012/09/23 04:01:05 | 000,599,040 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\vbscript.dll
[1 C:\Windows\SysNative\drivers\*.tmp files -> C:\Windows\SysNative\drivers\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2012/10/21 22:29:33 | 000,011,120 | -H– | M] () – C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2012/10/21 22:29:33 | 000,011,120 | -H– | M] () – C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2012/10/21 22:28:07 | 000,726,444 | —- | M] () – C:\Windows\SysNative\PerfStringBackup.INI
[2012/10/21 22:28:07 | 000,628,414 | —- | M] () – C:\Windows\SysNative\perfh009.dat
[2012/10/21 22:28:07 | 000,110,598 | —- | M] () – C:\Windows\SysNative\perfc009.dat
[2012/10/21 22:26:10 | 000,000,894 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2012/10/21 22:21:56 | 000,067,584 | –S- | M] () – C:\Windows\bootstat.dat
[2012/10/21 22:21:08 | 529,883,135 | -HS- | M] () – C:\hiberfil.sys
[2012/10/21 22:09:54 | 004,731,392 | —- | M] (AVAST Software) – C:\Users\Andrew & Jenny\Desktop\aswMBR.exe
[2012/10/21 22:08:46 | 000,602,112 | —- | M] (OldTimer Tools) – C:\Users\Andrew & Jenny\Desktop\OTL.exe
[2012/10/21 22:08:29 | 000,538,941 | —- | M] () – C:\Users\Andrew & Jenny\Desktop\adwcleaner.exe
[2012/10/21 21:17:02 | 000,000,898 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2012/10/21 21:02:16 | 000,000,349 | —- | M] () – C:\Users\Public\Documents\PCLECHAL.INI
[2012/10/21 20:03:01 | 000,388,608 | —- | M] (Trend Micro Inc.) – C:\Users\Andrew & Jenny\Desktop\HiJackThis.exe
[2012/10/21 19:47:12 | 000,001,147 | —- | M] () – C:\Users\Public\Desktop\Mozilla Firefox.lnk
[1 C:\Windows\SysNative\drivers\*.tmp files -> C:\Windows\SysNative\drivers\*.tmp -> ]

========== Files Created - No Company Name ==========

[2012/10/21 22:08:19 | 000,538,941 | —- | C] () – C:\Users\Andrew & Jenny\Desktop\adwcleaner.exe
[2012/10/21 19:47:12 | 000,001,159 | —- | C] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
[2012/10/21 19:47:12 | 000,001,147 | —- | C] () – C:\Users\Public\Desktop\Mozilla Firefox.lnk
[2012/09/12 20:52:25 | 000,000,719 | —- | C] () – C:\Users\Andrew & Jenny\Andrew & Jenny - Shortcut.lnk
[2012/07/16 08:31:22 | 000,000,000 | —- | C] () – C:\Users\Andrew & Jenny\AppData\Local\{23E9646A-BDE6-4BF7-B895-B72148184EC6}
[2012/06/22 09:02:55 | 000,000,000 | —- | C] () – C:\Users\Andrew & Jenny\AppData\Local\{D464CB29-9536-4362-990F-35C07B1E7584}
[2012/06/22 08:43:00 | 000,000,000 | —- | C] () – C:\Users\Andrew & Jenny\AppData\Local\{540AEFFB-AD62-45B0-AD3F-C10DEB1F07CD}
[2012/05/09 22:58:54 | 000,000,000 | —- | C] () – C:\Users\Andrew & Jenny\AppData\Local\{B7870E4E-61D8-4AF3-965F-88638A12879E}
[2012/03/21 07:43:00 | 000,000,000 | —- | C] () – C:\Users\Andrew & Jenny\AppData\Local\{A8DFF5FE-27FD-4D08-9EA9-503D7E27032F}
[2012/03/21 03:23:52 | 000,000,000 | —- | C] () – C:\Users\Andrew & Jenny\AppData\Local\{0A84A51C-9464-4018-8534-5CB45F30E169}
[2012/01/16 17:41:40 | 000,382,656 | —- | C] () – C:\Users\Andrew & Jenny\Heath Mail 15 Jan 2.jpg
[2012/01/16 17:40:05 | 000,720,440 | —- | C] () – C:\Users\Andrew & Jenny\Heath Mail 15 Jan.jpg
[2011/12/19 22:01:25 | 000,079,472 | —- | C] () – C:\Users\Andrew & Jenny\Zucchini Slice.avi.index
[2011/12/19 22:01:25 | 000,006,792 | —- | C] () – C:\Users\Andrew & Jenny\Zucchini Slice.avi.A.index
[2011/12/09 13:22:09 | 000,002,048 | —- | C] () – C:\Users\Andrew & Jenny\AppData\Roaming\Officeworks Photobooks Prefs
[2011/11/01 21:36:40 | 005,889,533 | —- | C] () – C:\Users\Andrew & Jenny\hobbit cover.jpg
[2011/11/01 21:35:31 | 004,722,896 | —- | C] () – C:\Users\Andrew & Jenny\hobbit4.jpg
[2011/11/01 21:34:08 | 005,280,784 | —- | C] () – C:\Users\Andrew & Jenny\hobbit3.jpg
[2011/11/01 21:32:12 | 004,995,304 | —- | C] () – C:\Users\Andrew & Jenny\hobbit2.jpg
[2011/11/01 21:29:41 | 005,207,767 | —- | C] () – C:\Users\Andrew & Jenny\hobbit1.jpg
[2011/09/21 22:14:33 | 751,864,020 | —- | C] () – C:\Users\Andrew & Jenny\Zucchini Slice.avi
[2011/08/13 16:48:05 | 000,628,585 | —- | C] () – C:\Users\Andrew & Jenny\Houltram Receipt.jpg
[2011/08/13 16:46:20 | 001,064,617 | —- | C] () – C:\Users\Andrew & Jenny\Houltram Costume Order Form.jpg
[2010/01/28 22:27:53 | 000,000,000 | —- | C] () – C:\ProgramData\DeviceManager.xml.RC4
[2009/12/16 08:38:52 | 000,046,080 | —- | C] () – C:\Users\Andrew & Jenny\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

========== ZeroAccess Check ==========

[2009/07/14 15:55:00 | 000,000,227 | RHS- | M] () – C:\Windows\assembly\Desktop.ini

[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64

[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] /64

[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
"" = C:\Windows\SysNative\shell32.dll – [2012/06/09 16:30:56 | 014,165,504 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shell32.dll – [2012/06/09 15:46:56 | 012,868,608 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\fastprox.dll – [2009/07/14 12:40:51 | 000,909,312 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Free

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\system32\wbem\fastprox.dll – [2009/07/14 12:15:20 | 000,605,696 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Free

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\wbemess.dll – [2009/07/14 12:41:56 | 000,505,856 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Both

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]

========== Custom Scans ==========

< %SYSTEMDRIVE%\*.exe >

< MD5 for: EXPLORER.EXE >
[2011/02/26 17:23:14 | 002,870,272 | —- | M] (Microsoft Corporation) MD5=0862495E0C825893DB75EF44FAEA8E93 – C:\Windows\explorer.exe
[2011/02/26 17:23:14 | 002,870,272 | —- | M] (Microsoft Corporation) MD5=0862495E0C825893DB75EF44FAEA8E93 – C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16768_none_adc24107935a7e25\explorer.exe
[2011/02/26 16:19:21 | 002,616,320 | —- | M] (Microsoft Corporation) MD5=0FB9C74046656D1579A64660AD67B746 – C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.21669_none_ba87e574ddfe652d\explorer.exe
[2009/07/14 12:14:20 | 002,613,248 | —- | M] (Microsoft Corporation) MD5=15BC38A7492BEFE831966ADB477CF76F – C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16385_none_b7fe430bc7ce3761\explorer.exe
[2011/02/26 16:51:13 | 002,614,784 | —- | M] (Microsoft Corporation) MD5=255CF508D7CFB10E0794D6AC93280BD8 – C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20910_none_b8ce9756e0b786a4\explorer.exe
[2009/10/31 16:45:39 | 002,614,272 | —- | M] (Microsoft Corporation) MD5=2626FC9755BE22F805D3CFA0CE3EE727 – C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16450_none_b819b343c7ba6202\explorer.exe
[2011/02/26 16:33:07 | 002,614,784 | —- | M] (Microsoft Corporation) MD5=2AF58D15EDC06EC6FDACCE1F19482BBF – C:\Windows\SysWOW64\explorer.exe
[2011/02/26 16:33:07 | 002,614,784 | —- | M] (Microsoft Corporation) MD5=2AF58D15EDC06EC6FDACCE1F19482BBF – C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16768_none_b816eb59c7bb4020\explorer.exe
[2011/02/25 17:19:30 | 002,871,808 | —- | M] (Microsoft Corporation) MD5=332FEAB1435662FC6C672E25BEB37BE3 – C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17567_none_afa79dc39081d0ba\explorer.exe
[2011/02/26 17:14:34 | 002,871,808 | —- | M] (Microsoft Corporation) MD5=3B69712041F3D63605529BD66DC00C48 – C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.21669_none_b0333b22a99da332\explorer.exe
[2010/11/20 23:17:09 | 002,616,320 | —- | M] (Microsoft Corporation) MD5=40D777B7A95E00593EB1568C68514493 – C:\Windows\SoftwareDistribution\Download\488053cdbca3231eeb2c2af7236d09ed\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17514_none_ba2f56d3c4bcbafb\explorer.exe
[2009/08/03 17:19:07 | 002,868,224 | —- | M] (Microsoft Corporation) MD5=700073016DAC1C3D2E7E2CE4223334B6 – C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20500_none_ae84b558ac4eb41c\explorer.exe
[2011/02/25 16:30:54 | 002,616,320 | —- | M] (Microsoft Corporation) MD5=8B88EBBB05A0E56B7DCC708498C02B3E – C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17567_none_b9fc4815c4e292b5\explorer.exe
[2009/10/31 17:34:59 | 002,870,272 | —- | M] (Microsoft Corporation) MD5=9AAAEC8DAC27AA17B053E6352AD233AE – C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16450_none_adc508f19359a007\explorer.exe
[2009/08/03 16:49:47 | 002,613,248 | —- | M] (Microsoft Corporation) MD5=9FF6C4C91A3711C0A3B18F87B08B518D – C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20500_none_b8d95faae0af7617\explorer.exe
[2010/11/21 00:24:45 | 002,872,320 | —- | M] (Microsoft Corporation) MD5=AC4C51EB24AA95B77F705AB159189E24 – C:\Windows\SoftwareDistribution\Download\488053cdbca3231eeb2c2af7236d09ed\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17514_none_afdaac81905bf900\explorer.exe
[2009/10/31 17:38:38 | 002,870,272 | —- | M] (Microsoft Corporation) MD5=B8EC4BD49CE8F6FC457721BFC210B67F – C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20563_none_ae46d6aeac7ca7c7\explorer.exe
[2009/08/03 16:35:50 | 002,613,248 | —- | M] (Microsoft Corporation) MD5=B95EEB0F4E5EFBF1038A35B3351CF047 – C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16404_none_b853c407c78e3ba9\explorer.exe
[2009/07/14 12:39:10 | 002,868,224 | —- | M] (Microsoft Corporation) MD5=C235A51CB740E45FFA0EBFB9BAFCDA64 – C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16385_none_ada998b9936d7566\explorer.exe
[2009/10/31 17:00:51 | 002,614,272 | —- | M] (Microsoft Corporation) MD5=C76153C7ECA00FA852BB0C193378F917 – C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20563_none_b89b8100e0dd69c2\explorer.exe
[2011/02/26 17:26:45 | 002,870,784 | —- | M] (Microsoft Corporation) MD5=E38899074D4951D31B4040E994DD7C8D – C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20910_none_ae79ed04ac56c4a9\explorer.exe
[2009/08/03 17:17:37 | 002,868,224 | —- | M] (Microsoft Corporation) MD5=F170B4A061C9E026437B193B4D571799 – C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16404_none_adff19b5932d79ae\explorer.exe
[2008/04/30 02:42:08 | 000,090,624 | —- | M] () MD5=FBB39A4487E11F64DCFFD36AEC2D2216 – C:\Program Files\CheckPoint\ZAForceField\Heuristics\explorer.exe

< MD5 for: SERVICES.EXE >
[2009/07/14 12:39:37 | 000,328,704 | —- | M] (Microsoft Corporation) MD5=24ACB7E5BE595468E3B9AA488B9B4FCB – C:\Windows\SysNative\services.exe
[2009/07/14 12:39:37 | 000,328,704 | —- | M] (Microsoft Corporation) MD5=24ACB7E5BE595468E3B9AA488B9B4FCB – C:\Windows\winsxs\amd64_microsoft-windows-s..s-servicecontroller_31bf3856ad364e35_6.1.7600.16385_none_2b54b20ee6fa07b1\services.exe

< MD5 for: SVCHOST.EXE >
[2009/07/14 12:14:41 | 000,020,992 | —- | M] (Microsoft Corporation) MD5=54A47F6B5E09A77E61649109C6A08866 – C:\Windows\SysWOW64\svchost.exe
[2009/07/14 12:14:41 | 000,020,992 | —- | M] (Microsoft Corporation) MD5=54A47F6B5E09A77E61649109C6A08866 – C:\Windows\winsxs\x86_microsoft-windows-services-svchost_31bf3856ad364e35_6.1.7600.16385_none_b591afc466a15356\svchost.exe
[2009/07/14 12:39:46 | 000,027,136 | —- | M] (Microsoft Corporation) MD5=C78655BC80301D76ED4FEF1C1EA40A7D – C:\Windows\SysNative\svchost.exe
[2009/07/14 12:39:46 | 000,027,136 | —- | M] (Microsoft Corporation) MD5=C78655BC80301D76ED4FEF1C1EA40A7D – C:\Windows\winsxs\amd64_microsoft-windows-services-svchost_31bf3856ad364e35_6.1.7600.16385_none_11b04b481efec48c\svchost.exe
[2008/07/02 00:17:12 | 000,090,624 | —- | M] () MD5=FBB39A4487E11F64DCFFD36AEC2D2216 – C:\Program Files\CheckPoint\ZAForceField\Heuristics\svchost.exe

< MD5 for: USERINIT.EXE >
[2010/11/20 23:17:48 | 000,026,624 | —- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 – C:\Windows\SoftwareDistribution\Download\488053cdbca3231eeb2c2af7236d09ed\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7601.17514_none_de3024012ff21116\userinit.exe
[2009/07/14 12:14:43 | 000,026,112 | —- | M] (Microsoft Corporation) MD5=6DE80F60D7DE9CE6B8C2DDFDF79EF175 – C:\Windows\SysWOW64\userinit.exe
[2009/07/14 12:14:43 | 000,026,112 | —- | M] (Microsoft Corporation) MD5=6DE80F60D7DE9CE6B8C2DDFDF79EF175 – C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7600.16385_none_dbff103933038d7c\userinit.exe
[2009/07/14 12:39:48 | 000,030,208 | —- | M] (Microsoft Corporation) MD5=6F8F1376A13114CC10C0E69274F5A4DE – C:\Windows\SysNative\userinit.exe
[2009/07/14 12:39:48 | 000,030,208 | —- | M] (Microsoft Corporation) MD5=6F8F1376A13114CC10C0E69274F5A4DE – C:\Windows\winsxs\amd64_microsoft-windows-userinit_31bf3856ad364e35_6.1.7600.16385_none_381dabbceb60feb2\userinit.exe
[2010/11/21 00:25:24 | 000,030,720 | —- | M] (Microsoft Corporation) MD5=BAFE84E637BF7388C96EF48D4D3FDD53 – C:\Windows\SoftwareDistribution\Download\488053cdbca3231eeb2c2af7236d09ed\amd64_microsoft-windows-userinit_31bf3856ad364e35_6.1.7601.17514_none_3a4ebf84e84f824c\userinit.exe

< MD5 for: WINLOGON.EXE >
[2010/11/21 00:25:30 | 000,390,656 | —- | M] (Microsoft Corporation) MD5=1151B1BAA6F350B1DB6598E0FEA7C457 – C:\Windows\SoftwareDistribution\Download\488053cdbca3231eeb2c2af7236d09ed\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7601.17514_none_cde90685eb910636\winlogon.exe
[2009/07/14 12:39:52 | 000,389,120 | —- | M] (Microsoft Corporation) MD5=132328DF455B0028F13BF0ABEE51A63A – C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16385_none_cbb7f2bdeea2829c\winlogon.exe
[2009/10/28 18:01:57 | 000,389,632 | —- | M] (Microsoft Corporation) MD5=A93D41A4D4B0D91C072D11DD8AF266DE – C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.20560_none_cc522fd507b468f8\winlogon.exe
[2009/10/28 17:24:40 | 000,389,632 | —- | M] (Microsoft Corporation) MD5=DA3E2A6FA9660CC75B471530CE88453A – C:\Windows\SysNative\winlogon.exe
[2009/10/28 17:24:40 | 000,389,632 | —- | M] (Microsoft Corporation) MD5=DA3E2A6FA9660CC75B471530CE88453A – C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16447_none_cbe534e7ee8042ad\winlogon.exe
[2008/07/02 00:17:12 | 000,090,624 | —- | M] () MD5=FBB39A4487E11F64DCFFD36AEC2D2216 – C:\Program Files\CheckPoint\ZAForceField\Heuristics\winlogon.exe

< %systemroot%\*. /rp /s >

========== Drive Information ==========

Physical Drives
—————

Drive: \\\\.\\PHYSICALDRIVE0 - Fixed hard disk media
Interface type: IDE
Media Type: Fixed hard disk media
Model: ST31500341AS ATA Device
Partitions: 1
Status: OK
Status Info: 0

Drive: \\\\.\\PHYSICALDRIVE1 - Fixed hard disk media
Interface type: IDE
Media Type: Fixed hard disk media
Model: ST31500341AS ATA Device
Partitions: 1
Status: OK
Status Info: 0

Drive: \\\\.\\PHYSICALDRIVE2 - Fixed hard disk media
Interface type: IDE
Media Type: Fixed hard disk media
Model: ST31500341AS ATA Device
Partitions: 1
Status: OK
Status Info: 0

Drive: \\\\.\\PHYSICALDRIVE3 - Removable Media
Interface type: USB
Media Type: Removable Media
Model: OLYMPUS XZ-1 USB Device
Partitions: 1
Status: OK
Status Info: 0

Drive: \\\\.\\PHYSICALDRIVE4 - External hard disk media
Interface type: USB
Media Type: External hard disk media
Model: WD My Passport 071A USB Device
Partitions: 1
Status: OK
Status Info: 0

Partitions
—————

DeviceID: Disk #0, Partition #0
PartitionType: Installable File System
Bootable: True
BootPartition: True
PrimaryPartition: True
Size: 1,397.00GB
Starting Offset: 1048576
Hidden sectors: 0


DeviceID: Disk #1, Partition #0
PartitionType: Installable File System
Bootable: False
BootPartition: False
PrimaryPartition: True
Size: 1,397.00GB
Starting Offset: 1048576
Hidden sectors: 0


DeviceID: Disk #2, Partition #0
PartitionType: Installable File System
Bootable: False
BootPartition: False
PrimaryPartition: True
Size: 1,397.00GB
Starting Offset: 1048576
Hidden sectors: 0


DeviceID: Disk #3, Partition #0
PartitionType: Unknown
Bootable: False
BootPartition: False
PrimaryPartition: True
Size: 15.00GB
Starting Offset: 4194304
Hidden sectors: 0


DeviceID: Disk #4, Partition #0
PartitionType: Installable File System
Bootable: False
BootPartition: False
PrimaryPartition: True
Size: 931.00GB
Starting Offset: 1048576
Hidden sectors: 0


========== Alternate Data Streams ==========

@Alternate Data Stream - 168 bytes -> C:\Users\Andrew & Jenny\Documents\nanny agreement.jpeg:3or4kl4x13tuuug3Byamue2s4b

< End of report >


Extras.txt


OTL Extras logfile created on: 21/10/2012 10:29:20 PM - Run 1
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\Andrew & Jenny\Desktop
64bit- Home Premium Edition (Version = 6.1.7600) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000c09 | Country: Australia | Language: ENA | Date Format: d/MM/yyyy

5.99 Gb Total Physical Memory | 4.05 Gb Available Physical Memory | 67.63% Memory free
11.98 Gb Paging File | 10.02 Gb Available in Paging File | 83.63% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 1397.26 Gb Total Space | 330.37 Gb Free Space | 23.64% Space Free | Partition Type: NTFS
Drive D: | 620.26 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS
Drive E: | 1397.26 Gb Total Space | 1211.80 Gb Free Space | 86.73% Space Free | Partition Type: NTFS
Drive F: | 1397.26 Gb Total Space | 990.05 Gb Free Space | 70.86% Space Free | Partition Type: NTFS
Drive J: | 14.83 Gb Total Space | 11.20 Gb Free Space | 75.54% Space Free | Partition Type: FAT32
Drive K: | 931.49 Gb Total Space | 251.66 Gb Free Space | 27.02% Space Free | Partition Type: NTFS

Computer Name: HOME-PC | User Name: Andrew & Jenny | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========


========== File Associations ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]
.url[@ = InternetShortcut] – C:\Windows\SysNative\rundll32.exe (Microsoft Corporation)

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]
.cpl [@ = cplfile] – C:\Windows\SysWow64\control.exe (Microsoft Corporation)

[HKEY_USERS\S-1-5-21-3468640803-2489096565-429190105-1000\SOFTWARE\Classes\]
.html [@ = FirefoxHTML] – C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation)

========== Shell Spawning ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\shell\[command]\command]
batfile [open] – "%1" %*
cmdfile [open] – "%1" %*
comfile [open] – "%1" %*
exefile [open] – "%1" %*
helpfile [open] – Reg Error: Key error.
htmlfile – "C:\Program Files (x86)\Microsoft Office\Office\Winword.exe" /n ()
htmlfile [print] – "C:\Windows\system32\rundll32.exe" "C:\Windows\system32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)
inffile [install] – %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
InternetShortcut [open] – "C:\Windows\system32\rundll32.exe" "C:\Windows\system32\ieframe.dll",OpenURL %l (Microsoft Corporation)
InternetShortcut [print] – "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)
piffile [open] – "%1" %*
regfile [merge] – Reg Error: Key error.
scrfile [config] – "%1"
scrfile [install] – rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] – "%1" /S
txtfile – Reg Error: Key error.
Unknown [openas] – %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] – cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] – Reg Error: Value error.
Drive [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\shell\[command]\command]
batfile [open] – "%1" %*
cmdfile [open] – "%1" %*
comfile [open] – "%1" %*
cplfile [cplopen] – %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] – "%1" %*
helpfile [open] – Reg Error: Key error.
htmlfile – "C:\Program Files (x86)\Microsoft Office\Office\Winword.exe" /n ()
inffile [install] – %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] – "%1" %*
regfile [merge] – Reg Error: Key error.
scrfile [config] – "%1"
scrfile [install] – rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] – "%1" /S
txtfile – Reg Error: Key error.
Unknown [openas] – %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] – cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] – Reg Error: Value error.
Drive [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = 28 4D B2 76 41 04 CA 01 [binary data]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 0

========== Authorized Applications List ==========


========== Vista Active Open Ports Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{033858B3-FCE6-4616-9EE4-3372909EAAED}" = lport=2869 | protocol=6 | dir=in | app=system |
"{047DC8D5-9684-48A4-AE8A-1DF08CD27B00}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{069A4CBA-12AC-4F9B-AF7E-165A47BF08B7}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{076B0D31-0230-45F2-B52A-5F63CC424BFC}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{1CD489AE-279A-43CB-B48E-A1D178C57F5A}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe |
"{2015E096-44CA-4B49-A5A3-1576F6F32D4B}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{251DD1C6-ED81-4B55-AB32-4D894E744CE5}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{27FC2696-4A03-4684-9367-3321F5374EE5}" = lport=445 | protocol=6 | dir=in | app=system |
"{29DD76C4-18B5-4BD1-8967-E7AC65545FBD}" = rport=137 | protocol=17 | dir=out | app=system |
"{43A4077A-C2E6-46CB-9D3B-847E58C4AEA6}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 |
"{4704D83B-B2F4-4EE1-BFDA-38F6AF36BDC9}" = lport=139 | protocol=6 | dir=in | app=system |
"{594E1F9B-2243-4877-9256-AA179E9140C9}" = lport=137 | protocol=17 | dir=in | app=system |
"{81C44706-6592-4DC9-8308-11699BFFC97D}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{8DA1CA42-714C-45B7-9A69-D1A9ECAC52C3}" = rport=138 | protocol=17 | dir=out | app=system |
"{A50B5C61-3173-4D10-B8AE-2920B724ACB5}" = rport=10243 | protocol=6 | dir=out | app=system |
"{A985CE9F-3490-4277-9E1F-6895240D1250}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{AE625748-CC29-4A48-83C3-BB9AC999D89C}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{B90F6106-0981-4636-A772-8F29F36231BD}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{BBC76231-F704-4F3A-B862-E2C5343964F7}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{D33DAB97-F879-4BD7-93AC-B1763D6ECC43}" = lport=138 | protocol=17 | dir=in | app=system |
"{DAE28EBE-0379-4A4A-85BF-737969245489}" = rport=445 | protocol=6 | dir=out | app=system |
"{DCB942E7-53FC-495C-809C-29C9123360AC}" = rport=139 | protocol=6 | dir=out | app=system |
"{EC0BAB6C-EE4C-4BFF-A435-5BDF7ABF9C13}" = lport=10243 | protocol=6 | dir=in | app=system |

========== Vista Active Application Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{04AA063B-BE16-40DF-9EF6-5C8D39A4604E}" = protocol=17 | dir=in | app=c:\program files (x86)\pinnacle\studio 12\programs\studio.exe |
"{068B71D2-2ADE-45C0-8290-77CFB99219C9}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{149C805E-0BD1-46FC-98ED-E0F544D8F0C8}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 |
"{19F43A41-02C4-4CFD-86F5-BD9166CE73A7}" = protocol=17 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe |
"{1ABFEEFA-6DA3-4A04-A9C4-0EFC240F70BB}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{1D485EF6-5621-434B-A910-5F2B5FC3C1EC}" = protocol=17 | dir=in | app=c:\program files (x86)\pinnacle\studio 12\programs\rm.exe |
"{1FF2C286-6F5C-41A6-A3B0-7DC00A275471}" = protocol=6 | dir=out | app=system |
"{25E609E2-3CB3-43A6-B4C3-9FBD78C5C574}" = protocol=6 | dir=in | app=c:\program files (x86)\bonjour\mdnsresponder.exe |
"{2724A984-FA2E-4EE4-A412-FD2FE610F2C2}" = protocol=17 | dir=in | app=c:\program files (x86)\common files\pure networks shared\platform\nmsrvc.exe |
"{2F6CBFB6-CA77-4A2A-875D-D4239009CC9D}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{30B8D3B7-20FD-4660-815C-95609EE4ADE9}" = protocol=6 | dir=in | app=c:\program files (x86)\common files\pure networks shared\platform\nmsrvc.exe |
"{30C2ECF3-4546-4986-A53F-16CFA47CAD01}" = protocol=17 | dir=in | app=%programfiles(x86)%\windows media player\wmplayer.exe |
"{3F869166-5D65-448B-AFCB-AF7DAE9EFCF4}" = protocol=6 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{5387D719-E8F3-4E2D-B2B1-A69A114CDC7D}" = protocol=6 | dir=in | app=c:\program files (x86)\pinnacle\studio 12\programs\umi.exe |
"{61278DD7-77DB-4F19-A9FC-FE5CB55842C5}" = protocol=6 | dir=in | app=c:\program files (x86)\pinnacle\studio 12\programs\studio.exe |
"{6C49888E-9ABD-43AD-A5BC-BFE13E2CC838}" = dir=in | app=c:\program files (x86)\common files\apple\apple application support\webkit2webprocess.exe |
"{6FC1171F-0EE5-40CB-9DB2-A49788693F26}" = protocol=6 | dir=in | app=c:\program files (x86)\bonjour\mdnsresponder.exe |
"{721EE721-910B-43A2-8B4A-1C66D726D7CF}" = dir=in | app=c:\program files (x86)\itunes\itunes.exe |
"{7DB349E5-5536-44C2-9F5E-17C168968D73}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{979F50D6-6299-4B1A-9631-094B01AF3586}" = protocol=6 | dir=in | app=c:\program files (x86)\pinnacle\studio 12\programs\rm.exe |
"{9C1DC77E-E3D0-4711-A776-4B0F9AC862A6}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{9CDFD92F-5F7E-40CF-B823-840FA8784374}" = protocol=17 | dir=in | app=c:\program files (x86)\bonjour\mdnsresponder.exe |
"{A0B47DF6-4238-45E4-9315-A1BA2DCB0991}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 |
"{A15EB74B-CDB5-4059-ABFE-1150718C4FB3}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{AAA60AED-5EB2-4A48-96CF-BD2FB39259FC}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{ADDF937C-000A-45A2-8950-CB8D035747F9}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{BED0D74A-7C22-4AD8-8642-D398C2F9918F}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 |
"{C8DF8091-078C-41FC-B03E-ACFC85FB606C}" = protocol=17 | dir=in | app=c:\program files (x86)\pinnacle\studio 12\programs\umi.exe |
"{CCAA0038-0E77-432C-B0D6-FED0FBB3B14F}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe |
"{DA366FEC-2D7B-4B57-8D21-BDFD59F6E596}" = protocol=6 | dir=in | app=c:\program files (x86)\common files\pure networks shared\platform\nmsrvc.exe |
"{DD708C45-DA22-470B-A78C-DB53237B49B0}" = protocol=17 | dir=in | app=c:\program files (x86)\bonjour\mdnsresponder.exe |
"{DFCC4A4F-3C66-41EC-A3EF-8AA7C851942E}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 |
"{ECDBC909-3DDF-4801-8CC7-5ED87DC6A00E}" = protocol=17 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{EE9FED24-36A4-441B-9614-8BAFA02EDFF2}" = protocol=6 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe |
"{F003FE50-226D-4DFD-81DF-516B58644073}" = protocol=17 | dir=in | app=c:\program files (x86)\common files\pure networks shared\platform\nmsrvc.exe |
"{F21C5EAB-473F-431B-9620-F2303D7CE9BE}" = protocol=6 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{FF210D68-E598-4171-BD93-0B1C98C3A4F6}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"TCP Query User{7BC9C276-04DD-4C30-9648-2E07520671B8}C:\program files (x86)\secondlife\slvoice.exe" = protocol=6 | dir=in | app=c:\program files (x86)\secondlife\slvoice.exe |
"UDP Query User{4804F7A1-E480-4A78-A7A1-035CD4F3FEB5}C:\program files (x86)\secondlife\slvoice.exe" = protocol=17 | dir=in | app=c:\program files (x86)\secondlife\slvoice.exe |

========== HKEY_LOCAL_MACHINE Uninstall List ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{071c9b48-7c32-4621-a0ac-3f809523288f}" = Microsoft Visual C++ 2005 Redistributable (x64)
"{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_Canon_MG6200_series" = Canon MG6200 series MP Drivers
"{56F26668-13DA-497A-883F-61434A10CBAB}" = MobileMe Control Panel
"{5EB90C06-964F-4195-B83E-BD7E55C88415}" = Pinnacle Video Driver
"{624C7F0A-89B2-4C49-9CAB-9D69613EC95A}" = Microsoft IntelliPoint 8.2
"{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}" = Bonjour
"{95120000-00B9-0409-1000-0000000FF1CE}" = Microsoft Application Error Reporting
"{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}" = Microsoft Visual C++ 2005 Redistributable (x64)
"{B8AD779A-82DA-4365-A7D0-AD3DCFC55CFF}" = Apple Mobile Device Support
"{CF8FFD12-602B-422D-AF1D-511B411E7632}" = iTunes
"{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}" = Microsoft .NET Framework 4 Client Profile
"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX 64-bit
"Linksys Wireless Manager" = Linksys Wireless Manager
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft IntelliPoint 8.2" = Microsoft IntelliPoint 8.2
"WinRAR archiver" = WinRAR archiver
"ZoneAlarm Toolbar" = ZoneAlarm Toolbar

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{02E89EFC-7B07-4D5A-AA03-9EC0902914EE}" = VC 9.0 Runtime
"{0E64B098-8018-4256-BA23-C316A43AD9B0}" = QuickTime
"{13F3917B56CD4C25848BDC69916971BB}" = DivX Converter
"{18D10072035C4515918F7E37EAFAACFC}" = AutoUpdate
"{1a413f37-ed88-4fec-9666-5c48dc4b7bb7}" = YouTube Downloader 2.5.7
"{25569723-DC5A-4467-A639-79535BF01B71}" = Adobe Help Center 2.1
"{26A24AE4-039D-4CA4-87B4-2F83216022FF}" = Java™ 6 Update 22
"{2729A2BE-FBF0-4513-859F-4D151514C542}" = Snap.Do
"{27614800-84A9-484E-9CCB-43ED2F1205F5}" = Chessmaster Grandmaster Edition
"{3FC7CBBC4C1E11DCA1A752EA55D89593}" = DivX Version Checker
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{52592821-F0CA-4131-8958-BCAE6E50B523}" = Pure Networks Platform
"{549CE1BD-88E4-4C5E-BF75-B155624714CC}" = Belkin USB Wireless Adaptor
"{57257606-31DA-46A5-BD2F-5235955A7D41}" = Civilization III - Gold Edition
"{5EE7D259-D137-4438-9A5F-42F432EC0421}" = VC80CRTRedist - 8.0.50727.4053
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{73AAEC5C-BA64-4655-A7B7-67874574530B}" = e-tax 2009
"{76F4DD9B-C246-4BE0-00B6-3DE9ABF72299}" = Need For Speed Hot Pursuit 2
"{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}" = Apple Software Update
"{7B63B2922B174135AFC0E1377DD81EC2}" = DivX Codec
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8ADFC4160D694100B5B8A22DE9DCABD9}" = DivX Player
"{8B3776EC-5F0A-4996-A7DF-BB5DA95B240E}" = Vodafone Mobile Connect
"{9576C428-7258-4B59-961C-439925E6AF8F}" = Cisco Network Magic
"{9E4936D8-5C3D-4206-A798-C606947A0391}" = BigPond Media Downloader
"{A7B609FB-83D8-4FC3-8477-1BC65ECFE85B}" = Adobe Photoshop Elements 5.0
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{A96E97134CA649888820BCDE5E300BBD}" = H.264 Decoder
"{AAC389499AEF40428987B3D30CFC76C9}" = MKV Splitter
"{AC76BA86-7AD7-1033-7B44-A95000000001}" = Adobe Reader 9.5.1
"{AC76BA86-7AD7-5464-3428-900000000004}" = Spelling Dictionaries Support For Adobe Reader 9
"{AEF9DC35ADDF4825B049ACBFD1C6EB37}" = AAC Decoder
"{B13A7C41581B411290FBC0395694E2A9}" = DivX Converter
"{B3FED300-806C-11E0-A0D0-B8AC6F97B88E}" = Google Earth
"{B7050CBDB2504B34BC2A9CA0A692CC29}" = DivX Web Player
"{C078C299-C2C2-4110-A6EF-8D5E66C228DA}" = e-tax 2011
"{C1212AE3-DBB9-4365-8473-F8ABC7B06BBB}" = Pinnacle Instant DVD Recorder
"{C73F2967-062E-48F2-A462-D335B8950183}" = Safari
"{D041EB9E-890A-4098-8F94-51DA194AC72A}" = Pinnacle Studio 12
"{D9B4D7EE-481C-4C36-86AB-A8F7417725FF}" = LightScribe 1.6.43.1
"{E2883E8F-472F-4fb0-9522-AC9BF37916A7}" = Adobe Download Manager
"{EB879750-CCBD-4013-BFD5-0294D4DA5BD0}" = Apple Application Support
"{EEFB15EB-FE8B-47DF-A496-1C4D1420294A}" = Doom 3
"{F0F927A8-589F-4569-0001-309A9C79D6D0}" = i-Studio
"{F61DD673-0030-4BB2-A382-7E57E97F1033}" = Nero 7 Essentials
"{FBE569CA-BFEB-4E57-A674-F94D938E1AEF}" = e-tax 2010
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"Adobe Photoshop Elements 5" = Adobe Photoshop Elements 5.0
"Canon Easy-PhotoPrint Pro - Pro9000 series Extention Data" = Canon Easy-PhotoPrint Pro - Pro9000 series Extention Data
"Canon Easy-PhotoPrint Pro - Pro9500 series Extention Data" = Canon Easy-PhotoPrint Pro - Pro9500 series Extention Data
"Canon_IJ_Network_Scanner_Selector_EX" = Canon IJ Network Scanner Selector EX
"Canon_IJ_Network_UTILITY" = Canon IJ Network Tool
"CanonMyPrinter" = Canon My Printer
"CanonSolutionMenuEX" = Canon Solution Menu EX
"CDex" = CDex extraction audio
"DivX Plus DirectShow Filters" = DivX Plus DirectShow Filters
"Easy-PhotoPrint" = Canon Utilities Easy-PhotoPrint
"Easy-PhotoPrint EX" = Canon Easy-PhotoPrint EX
"Easy-PhotoPrint Pro" = Canon Easy-PhotoPrint Pro
"Easy-WebPrint EX" = Canon Easy-WebPrint EX
"Forte Agent" = Forté Agent
"Google Updater" = Google Updater
"GrabIt_is1" = GrabIt 1.7.2 Beta 6 (build 1008)
"InstallShield_{27614800-84A9-484E-9CCB-43ED2F1205F5}" = Chessmaster Grandmaster Edition
"InstallShield_{549CE1BD-88E4-4C5E-BF75-B155624714CC}" = Belkin USB Wireless Adaptor
"InstallShield_{EEFB15EB-FE8B-47DF-A496-1C4D1420294A}" = Doom 3
"MediaRECOVER" = MediaRECOVER
"Mozilla Firefox 16.0.1 (x86 en-US)" = Mozilla Firefox 16.0.1 (x86 en-US)
"MozillaMaintenanceService" = Mozilla Maintenance Service
"MP Navigator EX 5.0" = Canon MP Navigator EX 5.0
"MyFunCards_5mbar Uninstall" = MyFunCards Toolbar
"Network MagicUninstall" = Network Magic
"Office8.0" = Microsoft Office 97, Professional Edition
"Optus Mobile Broadband" = Optus Mobile Broadband
"SecondLife" = SecondLife (remove only)
"stax-Pinnacle_is1" = SureThing Express Labeler
"VLC media player" = VideoLAN VLC media player 0.8.6c
"ZoneAlarm Anti-virus" = ZoneAlarm Anti-virus

========== HKEY_USERS Uninstall List ==========

[HKEY_USERS\S-1-5-21-3468640803-2489096565-429190105-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Officeworks Photobooks" = Officeworks Photobooks

========== Last 20 Event Log Errors ==========

[ Application Events ]
Error - 21/10/2012 4:32:37 AM | Computer Name = Home-PC | Source = WinMgmt | ID = 10
Description =

Error - 21/10/2012 4:32:47 AM | Computer Name = Home-PC | Source = VMCService | ID = 0
Description = GetLoggedOnUser

Error - 21/10/2012 4:34:41 AM | Computer Name = Home-PC | Source = VMCService | ID = 0
Description = GetLoggedOnUser

Error - 21/10/2012 6:00:52 AM | Computer Name = Home-PC | Source = Application Error | ID = 1000
Description = Faulting application name: Studio.exe, version: 12.0.1.6173, time
stamp: 0x48494c0f Faulting module name: QUARTZ.dll, version: 6.6.7600.16905, time
stamp: 0x4ea78ac4 Exception code: 0xc0000005 Fault offset: 0x000c0bc8 Faulting process
id: 0x1508 Faulting application start time: 0x01cdaf72df74cf4b Faulting application
path: C:\Program Files (x86)\Pinnacle\Studio 12\Programs\Studio.exe Faulting module
path: C:\Windows\system32\QUARTZ.dll Report Id: 31fcc4e3-1b66-11e2-93ce-002618085d10

Error - 21/10/2012 7:06:59 AM | Computer Name = Home-PC | Source = Application Hang | ID = 1002
Description = The program firefox.exe version 16.0.1.4666 stopped interacting with
Windows and was closed. To see if more information about the problem is available,
check the problem history in the Action Center control panel. Process ID: f48 Start
Time: 01cdaf68d253341e Termination Time: 102 Application Path: C:\Program Files (x86)\Mozilla
Firefox\firefox.exe Report Id:

Error - 21/10/2012 7:22:31 AM | Computer Name = Home-PC | Source = VMCService | ID = 0
Description = GetLoggedOnUser

Error - 21/10/2012 7:22:33 AM | Computer Name = Home-PC | Source = VMCService | ID = 0
Description = GetLoggedOnUser

Error - 21/10/2012 7:22:35 AM | Computer Name = Home-PC | Source = VMCService | ID = 0
Description = GetLoggedOnUser

Error - 21/10/2012 7:22:53 AM | Computer Name = Home-PC | Source = WinMgmt | ID = 10
Description =

Error - 21/10/2012 7:24:33 AM | Computer Name = Home-PC | Source = VMCService | ID = 0
Description = GetLoggedOnUser

[ System Events ]
Error - 27/09/2012 5:44:52 PM | Computer Name = Home-PC | Source = Service Control Manager | ID = 7000
Description = The Pure Networks Platform Service service failed to start due to
the following error: %%1053

Error - 20/10/2012 4:47:20 PM | Computer Name = Home-PC | Source = atikmdag | ID = 52236
Description = CPLIB :: General - Invalid Parameter

Error - 20/10/2012 4:47:20 PM | Computer Name = Home-PC | Source = atikmdag | ID = 43029
Description = Display is not active

Error - 20/10/2012 4:48:35 PM | Computer Name = Home-PC | Source = Service Control Manager | ID = 7009
Description = A timeout was reached (30000 milliseconds) while waiting for the Adobe
Active File Monitor V5 service to connect.

Error - 20/10/2012 4:48:35 PM | Computer Name = Home-PC | Source = Service Control Manager | ID = 7000
Description = The Adobe Active File Monitor V5 service failed to start due to the
following error: %%1053

Error - 21/10/2012 4:31:02 AM | Computer Name = Home-PC | Source = EventLog | ID = 6008
Description = The previous system shutdown at 7:28:39 PM on ?10/?21/?2012 was unexpected.

Error - 21/10/2012 4:30:56 AM | Computer Name = Home-PC | Source = atikmdag | ID = 52236
Description = CPLIB :: General - Invalid Parameter

Error - 21/10/2012 4:30:56 AM | Computer Name = Home-PC | Source = atikmdag | ID = 43029
Description = Display is not active

Error - 21/10/2012 7:21:50 AM | Computer Name = Home-PC | Source = atikmdag | ID = 52236
Description = CPLIB :: General - Invalid Parameter

Error - 21/10/2012 7:21:50 AM | Computer Name = Home-PC | Source = atikmdag | ID = 43029
Description = Display is not active


< End of report >


aswMBR log


aswMBR version 0.9.9.1665 Copyright© 2011 AVAST Software
Run date: 2012-10-21 23:11:16
—————————–
23:11:16.420 OS Version: Windows x64 6.1.7600
23:11:16.420 Number of processors: 8 586 0x1A05
23:11:16.421 ComputerName: HOME-PC UserName:
23:11:19.111 Initialize success
23:13:47.295 AVAST engine defs: 12102100
23:27:07.100 The log file has been saved successfully to "C:\Users\Andrew & Jenny\Desktop\aswMBR.txt"


aswMBR version 0.9.9.1665 Copyright© 2011 AVAST Software
Run date: 2012-10-21 23:11:16
—————————–
23:11:16.420 OS Version: Windows x64 6.1.7600
23:11:16.420 Number of processors: 8 586 0x1A05
23:11:16.421 ComputerName: HOME-PC UserName:
23:11:19.111 Initialize success
23:13:47.295 AVAST engine defs: 12102100
23:27:07.100 The log file has been saved successfully to "C:\Users\Andrew & Jenny\Desktop\aswMBR.txt"
23:28:07.770 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP2T1L0-6
23:28:07.773 Disk 0 Vendor: ST31500341AS CC1H Size: 1430799MB BusType: 3
23:28:07.776 Disk 1 \Device\Harddisk1\DR1 -> \Device\Ide\IdeDeviceP3T0L0-3
23:28:07.778 Disk 1 Vendor: ST31500341AS CC1H Size: 1430799MB BusType: 3
23:28:07.781 Disk 2 \Device\Harddisk2\DR2 -> \Device\Ide\IdeDeviceP3T1L0-5
23:28:07.783 Disk 2 Vendor: ST31500341AS CC1H Size: 1430799MB BusType: 3
23:28:07.795 Disk 0 MBR read successfully
23:28:07.798 Disk 0 MBR scan
23:28:07.802 Disk 0 Windows 7 default MBR code
23:28:07.810 Disk 0 Partition 1 80 (A) 07 HPFS/NTFS NTFS 1430797 MB offset 2048
23:28:07.831 Disk 0 scanning C:\Windows\system32\drivers
23:28:19.993 Service scanning
23:28:38.562 Modules scanning
23:28:38.572 Disk 0 trace - called modules:
23:28:38.608 ntoskrnl.exe CLASSPNP.SYS disk.sys ACPI.sys ataport.SYS pciide.sys PCIIDEX.SYS hal.dll atapi.sys
23:28:38.613 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0xfffffa80065e5060]
23:28:38.618 3 CLASSPNP.SYS[fffff8800193e43f] -> nt!IofCallDriver -> [0xfffffa80062ef520]
23:28:38.623 5 ACPI.sys[fffff88000f87781] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP2T1L0-6[0xfffffa80062ee060]
23:28:42.056 AVAST engine scan C:\
23:28:51.115 Disk 0 MBR has been saved successfully to "C:\Users\Andrew & Jenny\Desktop\MBR.dat"
23:28:51.125 The log file has been saved successfully to "C:\Users\Andrew & Jenny\Desktop\aswMBR.txt"


aswMBR version 0.9.9.1665 Copyright© 2011 AVAST Software
Run date: 2012-10-21 23:11:16
—————————–
23:11:16.420 OS Version: Windows x64 6.1.7600
23:11:16.420 Number of processors: 8 586 0x1A05
23:11:16.421 ComputerName: HOME-PC UserName:
23:11:19.111 Initialize success
23:13:47.295 AVAST engine defs: 12102100
23:27:07.100 The log file has been saved successfully to "C:\Users\Andrew & Jenny\Desktop\aswMBR.txt"
23:28:07.770 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP2T1L0-6
23:28:07.773 Disk 0 Vendor: ST31500341AS CC1H Size: 1430799MB BusType: 3
23:28:07.776 Disk 1 \Device\Harddisk1\DR1 -> \Device\Ide\IdeDeviceP3T0L0-3
23:28:07.778 Disk 1 Vendor: ST31500341AS CC1H Size: 1430799MB BusType: 3
23:28:07.781 Disk 2 \Device\Harddisk2\DR2 -> \Device\Ide\IdeDeviceP3T1L0-5
23:28:07.783 Disk 2 Vendor: ST31500341AS CC1H Size: 1430799MB BusType: 3
23:28:07.795 Disk 0 MBR read successfully
23:28:07.798 Disk 0 MBR scan
23:28:07.802 Disk 0 Windows 7 default MBR code
23:28:07.810 Disk 0 Partition 1 80 (A) 07 HPFS/NTFS NTFS 1430797 MB offset 2048
23:28:07.831 Disk 0 scanning C:\Windows\system32\drivers
23:28:19.993 Service scanning
23:28:38.562 Modules scanning
23:28:38.572 Disk 0 trace - called modules:
23:28:38.608 ntoskrnl.exe CLASSPNP.SYS disk.sys ACPI.sys ataport.SYS pciide.sys PCIIDEX.SYS hal.dll atapi.sys
23:28:38.613 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0xfffffa80065e5060]
23:28:38.618 3 CLASSPNP.SYS[fffff8800193e43f] -> nt!IofCallDriver -> [0xfffffa80062ef520]
23:28:38.623 5 ACPI.sys[fffff88000f87781] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP2T1L0-6[0xfffffa80062ee060]
23:28:42.056 AVAST engine scan C:\
23:28:51.115 Disk 0 MBR has been saved successfully to "C:\Users\Andrew & Jenny\Desktop\MBR.dat"
23:28:51.125 The log file has been saved successfully to "C:\Users\Andrew & Jenny\Desktop\aswMBR.txt"
23:35:34.675 Disk 0 MBR has been saved successfully to "C:\Users\Andrew & Jenny\Desktop\MBR.dat"
23:35:34.680 The log file has been saved successfully to "C:\Users\Andrew & Jenny\Desktop\aswMBR.txt"


Thanks for your assistance
Post #4
Let’s clear up what we can see and take it from there.

Run OTL
  • double click on the icon to run it.
  • copy/paste ALL the following text written inside the code box into the Custom Scans/Fixes box located at the bottom of OTL

    :Services

:OTL
IE - HKLM\..\SearchScopes\{acbd5593-e5ee-4c15-b48f-1823ce819dec}: "URL" = http://search.mywebsearch.com/mywebsearch/…r={searchTerms}
IE - HKU\S-1-5-21-3468640803-2489096565-429190105-1000\..\SearchScopes\{acbd5593-e5ee-4c15-b48f-1823ce819dec}: "URL" = http://search.mywebsearch.com/mywebsearch/…r={searchTerms}
O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found
O4 - HKU\S-1-5-20..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.

:Commands
[purity]
[emptytemp]
[Reboot]

  • click the Run Fix button at the top
  • let the program run unhindered, reboot when it is done
  • post a new OTL log (don't check the boxes beside LOP Check or Purity this time)
Please let me know the current situation and if there is aby improvement.

Logs to include in the next post:

OTL fix log
New OTL log

Thanks

Satchfan
Post #5
Thanks again Satchfan.

Both Firefox and Explorer seem to be running smoothly with no obvious signs of problems. However, it wouldn't surprise me if you can find thinks lurking without obvious effect that need to be dealt with.

The requested logs are attached:

New OTL Log

OTL logfile created on: 23/10/2012 3:42:33 AM - Run 3
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\Andrew & Jenny\Desktop
64bit- Home Premium Edition (Version = 6.1.7600) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000c09 | Country: Australia | Language: ENA | Date Format: d/MM/yyyy

5.99 Gb Total Physical Memory | 4.33 Gb Available Physical Memory | 72.30% Memory free
11.98 Gb Paging File | 10.26 Gb Available in Paging File | 85.61% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 1397.26 Gb Total Space | 323.72 Gb Free Space | 23.17% Space Free | Partition Type: NTFS
Drive D: | 620.26 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS
Drive E: | 1397.26 Gb Total Space | 1212.49 Gb Free Space | 86.78% Space Free | Partition Type: NTFS
Drive F: | 1397.26 Gb Total Space | 990.05 Gb Free Space | 70.86% Space Free | Partition Type: NTFS
Drive J: | 14.83 Gb Total Space | 11.20 Gb Free Space | 75.54% Space Free | Partition Type: FAT32

Computer Name: HOME-PC | User Name: Andrew & Jenny | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2012/10/21 22:08:46 | 000,602,112 | —- | M] (OldTimer Tools) – C:\Users\Andrew & Jenny\Desktop\OTL.exe
PRC - [2011/03/28 11:40:56 | 001,611,160 | —- | M] (CANON INC.) – C:\Program Files (x86)\Canon\Solution Menu EX\CNSEMAIN.EXE
PRC - [2011/01/15 16:48:44 | 000,452,016 | —- | M] (CANON INC.) – C:\Program Files (x86)\Canon\IJ Network Scanner Selector EX\CNMNSST.exe
PRC - [2010/08/19 19:52:14 | 000,241,664 | —- | M] (Huawei Technologies Co., Ltd.) – C:\ProgramData\DatacardService\DCSHelper.exe
PRC - [2010/08/19 19:52:04 | 000,229,376 | —- | M] () – C:\ProgramData\DatacardService\DCService.exe
PRC - [2009/10/17 01:41:10 | 002,384,240 | —- | M] (Check Point Software Technologies LTD) – C:\Windows\SysWOW64\ZoneLabs\vsmon.exe
PRC - [2009/10/17 01:39:40 | 001,037,192 | —- | M] (Check Point Software Technologies LTD) – C:\Program Files (x86)\Zone Labs\ZoneAlarm\zlclient.exe
PRC - [2009/06/19 00:02:54 | 000,472,112 | —- | M] (Cisco Systems, Inc.) – C:\Program Files (x86)\Pure Networks\Network Magic\nmapp.exe
PRC - [2009/06/18 15:41:50 | 000,647,216 | —- | M] (Cisco Systems, Inc.) – C:\Program Files (x86)\Common Files\Pure Networks Shared\Platform\nmsrvc.exe
PRC - [2009/06/18 15:41:50 | 000,647,216 | —- | M] (Cisco Systems, Inc.) – C:\Program Files (x86)\Common Files\Pure Networks Shared\Platform\nmctxth.exe
PRC - [2008/11/04 12:40:24 | 002,087,424 | —- | M] (Vodafone) – C:\Program Files (x86)\Vodafone\Vodafone Mobile Connect\Bin\MobileConnect.exe
PRC - [2008/11/04 12:39:20 | 000,014,336 | —- | M] (Vodafone) – C:\Program Files (x86)\Vodafone\Vodafone Mobile Connect\Bin\VMCService.exe
PRC - [2007/08/10 10:12:20 | 000,118,784 | —- | M] (Bytemobile, Inc.) – C:\Windows\SysWOW64\bmwebcfg.exe
PRC - [2007/05/04 11:39:28 | 000,910,896 | —- | M] (Nero AG) – C:\Program Files (x86)\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
PRC - [2007/05/04 11:39:12 | 000,149,040 | —- | M] (Nero AG) – C:\Program Files (x86)\Common Files\Ahead\Lib\NMBgMonitor.exe
PRC - [2006/12/22 08:31:50 | 000,108,712 | —- | M] () – C:\Program Files (x86)\Adobe\Photoshop Elements 5.0\PhotoshopElementsFileAgent.exe
PRC - [2006/12/22 08:29:56 | 000,067,752 | —- | M] (Adobe Systems Incorporated) – C:\Program Files (x86)\Adobe\Photoshop Elements 5.0\apdproxy.exe
PRC - [1996/11/21 01:00:00 | 000,111,376 | —- | M] () – C:\Program Files (x86)\Microsoft Office\Office\FINDFAST.EXE
PRC - [1996/11/21 01:00:00 | 000,051,984 | —- | M] () – C:\Program Files (x86)\Microsoft Office\Office\OSA.EXE


========== Modules (No Company Name) ==========

MOD - [2012/06/14 09:16:19 | 000,538,112 | —- | M] () – C:\Windows\assembly\NativeImages_v2.0.50727_32\VMC.BaseServices.Xm#\adc5a90eca8f2bb57f15b13935c77471\VMC.BaseServices.XmlSerializers.ni.dll
MOD - [2012/06/14 09:16:17 | 000,675,840 | —- | M] () – C:\Windows\assembly\NativeImages_v2.0.50727_32\VMC.BaseServices.Pl#\2e3569d6bc06250721a4a779c7aacfc4\VMC.BaseServices.Platform.ni.dll
MOD - [2012/06/14 09:16:17 | 000,443,392 | —- | M] () – C:\Windows\assembly\NativeImages_v2.0.50727_32\VMC.BaseServices.Da#\9be9c63304796c983c5fd4077dae3208\VMC.BaseServices.DataAccessor.ni.dll
MOD - [2012/06/14 09:16:16 | 003,505,152 | —- | M] () – C:\Windows\assembly\NativeImages_v2.0.50727_32\MobileConnect\52eb2f93d165ce400a17c666b4002a54\MobileConnect.ni.exe
MOD - [2012/06/14 09:16:16 | 000,339,456 | —- | M] () – C:\Windows\assembly\NativeImages_v2.0.50727_32\VMC.UI.CommonDialogs\91aa1915ebb4ffb0c974bca9a6d1bc5c\VMC.UI.CommonDialogs.ni.dll
MOD - [2012/06/14 09:05:37 | 000,212,992 | —- | M] () – C:\Windows\assembly\NativeImages_v2.0.50727_32\System.ServiceProce#\8b7a7f9c607e09bfa03c07b5ff3a8ae3\System.ServiceProcess.ni.dll
MOD - [2012/06/14 09:04:59 | 012,433,920 | —- | M] () – C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\009c50fb69919b90fb233cb4c35d0ad7\System.Windows.Forms.ni.dll
MOD - [2012/06/14 09:04:51 | 001,591,808 | —- | M] () – C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\ebefde27b0ef7f39bb49c493b34a602c\System.Drawing.ni.dll
MOD - [2012/05/11 21:51:26 | 000,169,984 | —- | M] () – C:\Windows\assembly\NativeImages_v2.0.50727_32\CsUtil\7ed3f53727ef6b89a6a320fa3e185ff8\CsUtil.ni.dll
MOD - [2012/05/11 21:51:26 | 000,101,888 | —- | M] () – C:\Windows\assembly\NativeImages_v2.0.50727_32\Interop.Shell32\d1b011c5b91a91a105a2d62de575c28f\Interop.Shell32.ni.dll
MOD - [2012/05/11 21:51:26 | 000,067,072 | —- | M] () – C:\Windows\assembly\NativeImages_v2.0.50727_32\VMC.ConnectionServi#\73df85c5b92a249345d583effe8b1552\VMC.ConnectionServices.TrafficOptimiser.ni.dll
MOD - [2012/05/11 21:51:26 | 000,036,864 | —- | M] () – C:\Windows\assembly\NativeImages_v2.0.50727_32\Interop.NGCLNAPILib\0ff1b1a98167de1cd9715ff913a66829\Interop.NGCLNAPILib.ni.dll
MOD - [2012/05/11 21:51:25 | 000,727,040 | —- | M] () – C:\Windows\assembly\NativeImages_v2.0.50727_32\WwanWrapper\9666982c39bb4d9b30815bfae66c1376\WwanWrapper.ni.dll
MOD - [2012/05/11 21:51:25 | 000,722,432 | —- | M] () – C:\Windows\assembly\NativeImages_v2.0.50727_32\VMC.ConnectionServi#\07c8c906ceb688879c31c24a43a1eee9\VMC.ConnectionServices.ni.dll
MOD - [2012/05/11 21:51:25 | 000,033,792 | —- | M] () – C:\Windows\assembly\NativeImages_v2.0.50727_32\VMC.WindowsService.#\c0c1270f83dbb0332a133ecb9b6f8741\VMC.WindowsService.Messaging.ni.dll
MOD - [2012/05/11 21:51:24 | 000,248,832 | —- | M] () – C:\Windows\assembly\NativeImages_v2.0.50727_32\VMC.WindowsService.#\cc32f30b07f0444d9e84366d74d221e8\VMC.WindowsService.Core.ni.dll
MOD - [2012/05/11 21:51:23 | 000,030,720 | —- | M] () – C:\Windows\assembly\NativeImages_v2.0.50727_32\VMC.BaseServices.Ou#\2326ab0e72b221164d6b81157b0b4ef4\VMC.BaseServices.OutlookConnector.ni.dll
MOD - [2012/05/11 21:51:22 | 000,251,392 | —- | M] () – C:\Windows\assembly\NativeImages_v2.0.50727_32\Interop.DWUpdateSer#\97e1fe96dd6740bf2d719149f2cba25c\Interop.DWUpdateServiceLib.ni.dll
MOD - [2012/05/11 21:51:20 | 000,997,888 | —- | M] () – C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Management\3f9dee1ce0ccb42145293a5bfcbe7205\System.Management.ni.dll
MOD - [2012/05/11 21:51:20 | 000,403,968 | —- | M] () – C:\Windows\assembly\NativeImages_v2.0.50727_32\VMC.ConnectionServi#\18bf0982ba7357d0f5d988c1b042a116\VMC.ConnectionServicesInterface.ni.dll
MOD - [2012/05/11 21:40:27 | 000,771,584 | —- | M] () – C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Runtime.Remo#\0c00b1a8336dd4c1bd1ebce7780f20b4\System.Runtime.Remoting.ni.dll
MOD - [2012/05/11 21:40:26 | 006,618,624 | —- | M] () – C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Data\294d439cfe959b5528ca81d37d3d502f\System.Data.ni.dll
MOD - [2012/05/11 21:40:26 | 000,627,200 | —- | M] () – C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Transactions\61fbbd8bc7d76972115b292b132ff2d1\System.Transactions.ni.dll
MOD - [2012/05/11 21:39:49 | 000,680,960 | —- | M] () – C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Security\61af058c2bc079f28397a29ed145fbc7\System.Security.ni.dll
MOD - [2012/05/11 21:39:47 | 005,453,312 | —- | M] () – C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Xml\5c85c9c42e1b8a8760de82ecb4c7d582\System.Xml.ni.dll
MOD - [2012/05/11 21:39:45 | 000,971,264 | —- | M] () – C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Configuration\cb079eab134fd1a752ad91db13274110\System.Configuration.ni.dll
MOD - [2012/05/11 21:39:44 | 007,952,384 | —- | M] () – C:\Windows\assembly\NativeImages_v2.0.50727_32\System\2ebb3c259eab50af565e3a8dba6ad20e\System.ni.dll
MOD - [2012/05/11 21:39:37 | 011,490,816 | —- | M] () – C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\5858678a79aae31262b0214424245d06\mscorlib.ni.dll
MOD - [2011/06/24 23:56:36 | 000,087,328 | —- | M] () – C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll
MOD - [2011/06/24 23:56:14 | 001,241,888 | —- | M] () – C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll
MOD - [2009/07/14 12:15:45 | 000,364,544 | —- | M] () – C:\Windows\SysWOW64\msjetoledb40.dll
MOD - [2009/06/11 08:23:19 | 000,261,632 | —- | M] () – C:\Windows\assembly\GAC_32\System.Transactions\2.0.0.0__b77a5c561934e089\System.Transactions.dll
MOD - [2009/06/11 08:23:17 | 002,933,248 | —- | M] () – C:\Windows\assembly\GAC_32\System.Data\2.0.0.0__b77a5c561934e089\System.Data.dll
MOD - [2009/05/13 14:53:24 | 000,394,752 | —- | M] () – C:\Program Files (x86)\Common Files\Pure Networks Shared\Platform\CAntiVirusCOM.dll
MOD - [2009/05/13 14:53:24 | 000,282,112 | —- | M] () – C:\Program Files (x86)\Common Files\Pure Networks Shared\Platform\CFirewallCOM.dll
MOD - [2007/02/16 18:40:42 | 005,521,408 | —- | M] () – C:\Program Files (x86)\Common Files\LightScribe\QtGui4.dll
MOD - [2007/02/16 18:40:40 | 001,466,368 | —- | M] () – C:\Program Files (x86)\Common Files\LightScribe\QtCore4.dll
MOD - [1996/11/21 01:00:00 | 003,774,224 | —- | M] () – C:\Program Files (x86)\Microsoft Office\Office\MSO97.DLL
MOD - [1996/11/21 01:00:00 | 000,111,376 | —- | M] () – C:\Program Files (x86)\Microsoft Office\Office\FINDFAST.EXE
MOD - [1996/11/21 01:00:00 | 000,051,984 | —- | M] () – C:\Program Files (x86)\Microsoft Office\Office\OSA.EXE


========== Services (SafeList) ==========

SRV:64bit: - [2009/10/15 00:30:58 | 000,800,624 | —- | M] (Check Point Software Technologies) [Auto | Running] – C:\Program Files\CheckPoint\ZAForceField\ISWSVC.exe – (IswSvc)
SRV:64bit: - [2009/08/18 02:36:20 | 000,203,264 | —- | M] (AMD) [Auto | Running] – C:\Windows\SysNative\atiesrxx.exe – (AMD External Events Utility)
SRV:64bit: - [2009/07/14 12:41:27 | 001,011,712 | —- | M] (Microsoft Corporation) [Auto | Running] – C:\Program Files\Windows Defender\MpSvc.dll – (WinDefend)
SRV - [2012/10/11 12:05:59 | 000,115,168 | —- | M] (Mozilla Foundation) [On_Demand | Stopped] – C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe – (MozillaMaintenance)
SRV - [2010/08/19 19:52:04 | 000,229,376 | —- | M] () [Auto | Running] – C:\ProgramData\DatacardService\DCService.exe – (DCService.exe)
SRV - [2010/08/13 10:13:32 | 000,066,112 | —- | M] (NOS Microsystems Ltd.) [On_Demand | Stopped] – C:\Program Files (x86)\NOS\bin\getPlus_Helper_3004.dll – (nosGetPlusHelper)
SRV - [2010/03/18 14:16:28 | 000,130,384 | —- | M] (Microsoft Corporation) [Auto | Stopped] – C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe – (clr_optimization_v4.0.30319_32)
SRV - [2009/10/17 01:41:10 | 002,384,240 | —- | M] (Check Point Software Technologies LTD) [Auto | Running] – C:\Windows\SysWOW64\ZoneLabs\vsmon.exe – (vsmon)
SRV - [2009/06/18 15:41:50 | 000,647,216 | —- | M] (Cisco Systems, Inc.) [Auto | Running] – C:\Program Files (x86)\Common Files\Pure Networks Shared\Platform\nmsrvc.exe – (nmservice)
SRV - [2009/06/11 08:23:09 | 000,066,384 | —- | M] (Microsoft Corporation) [Disabled | Stopped] – C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe – (clr_optimization_v2.0.50727_32)
SRV - [2008/11/04 12:39:20 | 000,014,336 | —- | M] (Vodafone) [Auto | Running] – C:\Program Files (x86)\Vodafone\Vodafone Mobile Connect\Bin\VMCService.exe – (VMCService)
SRV - [2007/08/10 10:12:20 | 000,118,784 | —- | M] (Bytemobile, Inc.) [Auto | Running] – C:\Windows\SysWOW64\bmwebcfg.exe – (bmwebcfg)
SRV - [2006/12/22 08:31:50 | 000,108,712 | —- | M] () [Auto | Running] – C:\Program Files (x86)\Adobe\Photoshop Elements 5.0\PhotoshopElementsFileAgent.exe – (AdobeActiveFileMonitor5.0)


========== Driver Services (SafeList) ==========

DRV:64bit: - [2012/03/01 17:54:38 | 000,022,896 | —- | M] (Microsoft Corporation) [Recognizer | Boot | Unknown] – C:\Windows\SysNative\drivers\fs_rec.sys – (Fs_Rec)
DRV:64bit: - [2012/02/15 11:01:50 | 000,052,736 | —- | M] (Apple, Inc.) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\usbaapl64.sys – (USBAAPL64)
DRV:64bit: - [2011/08/01 15:59:06 | 000,045,416 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] – C:\Windows\SysNative\drivers\point64.sys – (Point64)
DRV:64bit: - [2011/03/11 17:22:41 | 000,107,904 | —- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\amdsata.sys – (amdsata)
DRV:64bit: - [2011/03/11 17:22:40 | 000,027,008 | —- | M] (Advanced Micro Devices) [Kernel | Boot | Running] – C:\Windows\SysNative\drivers\amdxata.sys – (amdxata)
DRV:64bit: - [2010/08/31 19:09:00 | 000,256,000 | —- | M] (Huawei Technologies Co., Ltd.) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\ewusbnet.sys – (ewusbnet)
DRV:64bit: - [2010/08/07 18:49:04 | 000,121,600 | —- | M] (Huawei Technologies Co., Ltd.) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\ewusbmdm.sys – (hwdatacard)
DRV:64bit: - [2010/07/27 16:26:34 | 000,086,016 | —- | M] (Huawei Technologies Co., Ltd.) [Kernel | On_Demand | Running] – C:\Windows\SysNative\drivers\ew_jubusenum.sys – (huawei_enumerator)
DRV:64bit: - [2010/07/27 10:52:16 | 000,117,248 | —- | M] (Huawei Technologies Co., Ltd.) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\ew_hwusbdev.sys – (ew_hwusbdev)
DRV:64bit: - [2010/07/08 15:18:38 | 000,694,888 | —- | M] (Realtek Semiconductor Corporation ) [Kernel | On_Demand | Running] – C:\Windows\SysNative\drivers\RTL8192su.sys – (RTL8192su)
DRV:64bit: - [2009/10/15 00:30:04 | 000,032,888 | —- | M] (Check Point Software Technologies) [Kernel | Auto | Running] – C:\Program Files\CheckPoint\ZAForceField\ISWKL.sys – (ISWKL)
DRV:64bit: - [2009/10/12 18:15:26 | 000,351,248 | —- | M] (Kaspersky Lab) [File_System | System | Running] – C:\Windows\SysNative\drivers\klif.sys – (KLIF)
DRV:64bit: - [2009/10/12 18:15:26 | 000,157,712 | —- | M] (Kaspersky Lab) [Kernel | System | Running] – C:\Windows\SysNative\drivers\kl1.sys – (kl1)
DRV:64bit: - [2009/09/22 03:02:56 | 000,445,128 | —- | M] (Check Point Software Technologies LTD) [Kernel | System | Running] – C:\Windows\SysNative\drivers\vsdatant.sys – (Vsdatant)
DRV:64bit: - [2009/08/18 03:48:48 | 006,037,504 | —- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] – C:\Windows\SysNative\drivers\atikmdag.sys – (atikmdag)
DRV:64bit: - [2009/07/14 12:52:20 | 000,194,128 | —- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\amdsbs.sys – (amdsbs)
DRV:64bit: - [2009/07/14 12:48:04 | 000,065,600 | —- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\lsi_sas2.sys – (LSI_SAS2)
DRV:64bit: - [2009/07/14 12:47:48 | 000,077,888 | —- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\HpSAMD.sys – (HpSAMD)
DRV:64bit: - [2009/07/14 12:45:55 | 000,024,656 | —- | M] (Promise Technology) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\stexstor.sys – (stexstor)
DRV:64bit: - [2009/07/14 11:39:20 | 000,023,040 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\WSDPrint.sys – (WSDPrintDevice)
DRV:64bit: - [2009/07/14 11:35:37 | 000,025,088 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\WSDScan.sys – (WSDScan)
DRV:64bit: - [2009/07/14 11:09:15 | 000,145,920 | —- | M] (Microsoft Corporation) [Kernel | Auto | Running] – C:\Windows\SysNative\drivers\rmcast.sys – (RMCAST)
DRV:64bit: - [2009/07/14 11:06:43 | 000,060,288 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\61883.sys – (61883)
DRV:64bit: - [2009/07/14 11:06:43 | 000,048,768 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\avc.sys – (Avc)
DRV:64bit: - [2009/07/14 11:06:42 | 000,061,440 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\msdv.sys – (MSDV)
DRV:64bit: - [2009/07/14 11:06:40 | 000,017,664 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\avcstrm.sys – (AVCSTRM)
DRV:64bit: - [2009/07/14 11:06:39 | 000,056,448 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\mstape.sys – (MSTAPE)
DRV:64bit: - [2009/06/11 07:35:33 | 000,389,120 | —- | M] (Marvell) [Kernel | On_Demand | Running] – C:\Windows\SysNative\drivers\yk62x64.sys – (yukonw7)
DRV:64bit: - [2009/06/11 07:34:33 | 003,286,016 | —- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\evbda.sys – (ebdrv)
DRV:64bit: - [2009/06/11 07:34:28 | 000,468,480 | —- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\bxvbda.sys – (b06bdrv)
DRV:64bit: - [2009/06/11 07:34:23 | 000,270,848 | —- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\b57nd60a.sys – (b57nd60a)
DRV:64bit: - [2009/06/11 07:31:59 | 000,031,232 | —- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\hcw85cir.sys – (hcw85cir)
DRV:64bit: - [2009/05/25 04:38:20 | 000,966,144 | —- | M] (Ralink Technology Corp.) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\netr28ux.sys – (netr28ux)
DRV:64bit: - [2009/05/18 15:17:08 | 000,034,152 | —- | M] (GEAR Software Inc.) [Kernel | On_Demand | Running] – C:\Windows\SysNative\drivers\GEARAspiWDM.sys – (GEARAspiWDM)
DRV:64bit: - [2009/05/13 14:47:44 | 000,033,072 | —- | M] (Cisco Systems, Inc.) [Kernel | Auto | Running] – C:\Windows\SysNative\drivers\purendis.sys – (purendis)
DRV:64bit: - [2009/05/13 14:47:42 | 000,031,536 | —- | M] (Cisco Systems, Inc.) [Kernel | Auto | Running] – C:\Windows\SysNative\drivers\pnarp.sys – (pnarp)
DRV:64bit: - [2008/05/06 16:06:00 | 000,014,464 | —- | M] (Western Digital Technologies) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\wdcsam64.sys – (WDC_SAM)
DRV:64bit: - [2005/03/29 02:30:38 | 000,008,192 | —- | M] () [Kernel | On_Demand | Running] – C:\Windows\SysNative\drivers\ASACPI.sys – (MTsensor)
DRV - [2009/10/17 01:41:16 | 000,445,640 | —- | M] (Check Point Software Technologies LTD) [Kernel | System | Running] – C:\Windows\SysWOW64\drivers\vsdatant.sys – (Vsdatant)
DRV - [2009/07/14 12:19:10 | 000,019,008 | —- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] – C:\Windows\SysWOW64\drivers\wimmount.sys – (WIMMount)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
IE:64bit: - HKLM\..\SearchScopes,DefaultScope =
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\..\SearchScopes,DefaultScope =

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = http://www.google.com
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.google.com
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = http://www.google.com
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com
IE - HKCU\..\SearchScopes,DefaultScope = {acbd5593-e5ee-4c15-b48f-1823ce819dec}
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

========== FireFox ==========

FF - prefs.js..extensions.enabledItems: [removed]:1.0
FF - prefs.js..extensions.enabledItems: {E2883E8F-472F-4fb0-9522-AC9BF37916A7}:[removed]
FF - prefs.js..extensions.enabledItems: {FFB96CC1-7EB3-449D-B827-DB661701C6BB}:[removed]
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}:6.0.22
FF - user.js - File not found

FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_3_300_270.dll File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_3_300_270.dll ()
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@canon.com/EPPEX: C:\Program Files (x86)\Canon\Easy-PhotoPrint EX\NPEZFFPI.DLL (CANON INC.)
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: C:\Program Files (x86)\DivX\DivX Web Player\npdivx32.dll (DivX,Inc.)
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Player Plugin,version=1.0.0: C:\Program Files (x86)\DivX\DivX Player\npDivxPlayerPlugin.dll (DivX, Inc)
FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files (x86)\Microsoft Silverlight\4.1.10329.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@nosltd.com/getPlus+®,version=1.6.2.90: C:\Program Files (x86)\NOS\bin\np_gp.dll (NOS Microsystems Ltd.)
FF - HKLM\Software\MozillaPlugins\@pack.google.com/Google Updater;version=14: C:\Program Files (x86)\Google\Google Updater\2.4.2432.1652\npCIDetect14.dll (Google)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.21.123\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.21.123\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

64bit-FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{FFB96CC1-7EB3-449D-B827-DB661701C6BB}: C:\PROGRAM FILES\CHECKPOINT\ZAFORCEFIELD\TRUSTCHECKER [2012/03/10 17:24:42 | 000,000,000 | —D | M]
64bit-FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{336D0C35-8A85-403a-B9D2-65C292C39087}: C:\PROGRAM FILES\WEB ASSISTANT\FIREFOX
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{FFB96CC1-7EB3-449D-B827-DB661701C6BB}: C:\Program Files\CheckPoint\ZAForceField\WOW64\TrustChecker [2009/11/28 18:47:23 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 16.0.1\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012/10/21 19:47:08 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 16.0.1\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2012/10/21 16:47:28 | 000,000,000 | —D | M]

[2009/11/05 21:44:59 | 000,000,000 | —D | M] (No name found) – C:\Users\Andrew & Jenny\AppData\Roaming\Mozilla\Extensions
[2012/10/21 22:13:11 | 000,000,000 | —D | M] (No name found) – C:\Users\Andrew & Jenny\AppData\Roaming\Mozilla\Firefox\Profiles\7r2we53b.default\extensions
[2010/09/19 14:13:20 | 000,000,000 | —D | M] (Microsoft .NET Framework Assistant) – C:\Users\Andrew & Jenny\AppData\Roaming\Mozilla\Firefox\Profiles\7r2we53b.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2011/05/08 00:49:02 | 000,000,000 | —D | M] (No name found) – C:\Users\Andrew & Jenny\AppData\Roaming\Mozilla\Firefox\Profiles\7r2we53b.default\extensions\nostmp
[2012/10/21 19:47:08 | 000,000,000 | —D | M] (No name found) – C:\Program Files (x86)\Mozilla Firefox\extensions
[2012/10/11 12:06:18 | 000,261,600 | —- | M] (Mozilla Foundation) – C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll
[2010/11/15 20:04:35 | 000,472,808 | —- | M] (Sun Microsystems, Inc.) – C:\Program Files (x86)\mozilla firefox\plugins\npdeployJava1.dll
[2012/10/11 12:05:38 | 000,002,465 | —- | M] () – C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml
[2012/10/11 12:05:38 | 000,002,058 | —- | M] () – C:\Program Files (x86)\mozilla firefox\searchplugins\twitter.xml

O1 HOSTS File: ([2006/09/19 08:37:24 | 000,000,761 | —- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: ::1 localhost
O2:64bit: - BHO: (ZoneAlarm Toolbar Registrar) - {8A4A36C2-0535-4D2C-BD3D-496CB7EED6E3} - C:\Program Files\CheckPoint\ZAForceField\TrustChecker\bin\TrustCheckerIEPlugin.dll (Check Point Software Technologies)
O2:64bit: - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.2.4204.1700\swg64.dll (Google Inc.)
O2 - BHO: (Canon Easy-WebPrint EX BHO) - {3785D0AD-BFFF-47F6-BF5B-A587C162FED9} - C:\Program Files (x86)\Canon\Easy-WebPrint EX\ewpexbho.dll (CANON INC.)
O2 - BHO: (ZoneAlarm Toolbar Registrar) - {8A4A36C2-0535-4D2C-BD3D-496CB7EED6E3} - C:\Program Files\CheckPoint\ZAForceField\WOW64\TrustChecker\bin\TrustCheckerIEPlugin.dll (Check Point Software Technologies)
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files (x86)\Google\GoogleToolbarNotifier\5.2.4204.1700\swg.dll (Google Inc.)
O3:64bit: - HKLM\..\Toolbar: (ZoneAlarm Toolbar) - {EE2AC4E5-B0B0-4EC6-88A9-BCA1A32AB107} - C:\Program Files\CheckPoint\ZAForceField\TrustChecker\bin\TrustCheckerIEPlugin.dll (Check Point Software Technologies)
O3 - HKLM\..\Toolbar: (Canon Easy-WebPrint EX) - {759D9886-0C6F-4498-BAB6-4A5F47C6C72F} - C:\Program Files (x86)\Canon\Easy-WebPrint EX\ewpexhlp.dll (CANON INC.)
O3 - HKLM\..\Toolbar: (ZoneAlarm Toolbar) - {EE2AC4E5-B0B0-4EC6-88A9-BCA1A32AB107} - C:\Program Files\CheckPoint\ZAForceField\WOW64\TrustChecker\bin\TrustCheckerIEPlugin.dll (Check Point Software Technologies)
O3:64bit: - HKCU\..\Toolbar\WebBrowser: (ZoneAlarm Toolbar) - {EE2AC4E5-B0B0-4EC6-88A9-BCA1A32AB107} - C:\Program Files\CheckPoint\ZAForceField\TrustChecker\bin\TrustCheckerIEPlugin.dll (Check Point Software Technologies)
O3 - HKCU\..\Toolbar\WebBrowser: (ZoneAlarm Toolbar) - {EE2AC4E5-B0B0-4EC6-88A9-BCA1A32AB107} - C:\Program Files\CheckPoint\ZAForceField\WOW64\TrustChecker\bin\TrustCheckerIEPlugin.dll (Check Point Software Technologies)
O4:64bit: - HKLM..\Run: [CanonMyPrinter] C:\Program Files\Canon\MyPrinter\BJMyPrt.exe (CANON INC.)
O4:64bit: - HKLM..\Run: [IntelliPoint] C:\Program Files\Microsoft IntelliPoint\ipoint.exe (Microsoft Corporation)
O4:64bit: - HKLM..\Run: [ISW] C:\Program Files\CheckPoint\ZAForceField\ForceField.exe (Check Point Software Technologies)
O4:64bit: - HKLM..\Run: [Linksys Wireless Manager] C:\Program Files (x86)\Linksys\Linksys Wireless Manager\LinksysWirelessManager.exe (Cisco Systems, Inc.)
O4 - HKLM..\Run: [Adobe Photo Downloader] C:\Program Files (x86)\Adobe\Photoshop Elements 5.0\apdproxy.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [APSDaemon] C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
O4 - HKLM..\Run: [CanonSolutionMenuEx] C:\Program Files (x86)\Canon\Solution Menu EX\CNSEMAIN.EXE (CANON INC.)
O4 - HKLM..\Run: [IJNetworkScannerSelectorEX] C:\Program Files (x86)\Canon\IJ Network Scanner Selector EX\CNMNSST.exe (CANON INC.)
O4 - HKLM..\Run: [MobileConnect] C:\Program Files (x86)\Vodafone\Vodafone Mobile Connect\Bin\MobileConnect.exe (Vodafone)
O4 - HKLM..\Run: [nmapp] C:\Program Files (x86)\Pure Networks\Network Magic\nmapp.exe (Cisco Systems, Inc.)
O4 - HKLM..\Run: [nmctxth] C:\Program Files (x86)\Common Files\Pure Networks Shared\Platform\nmctxth.exe (Cisco Systems, Inc.)
O4 - HKLM..\Run: [ZoneAlarm Client] C:\Program Files (x86)\Zone Labs\ZoneAlarm\zlclient.exe (Check Point Software Technologies LTD)
O4 - HKCU..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] C:\Program Files (x86)\Common Files\Ahead\Lib\NMBgMonitor.exe (Nero AG)
O4 - Startup: C:\Users\Andrew & Jenny\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Find Fast.lnk = C:\Program Files (x86)\Microsoft Office\Office\FINDFAST.EXE ()
O4 - Startup: C:\Users\Andrew & Jenny\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Office Startup.lnk = C:\Program Files (x86)\Microsoft Office\Office\OSA.EXE ()
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000007 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)
O1364bit: - gopher Prefix: missing
O13 - gopher Prefix: missing
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload2.macromedia.com/get/shoc…ash/swflash.cab (Shockwave Flash Object)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{10B9E5EC-7BE7-4BE1-94E0-83807B10831C}: NameServer = 61.8.0.113,210.23.129.34
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{1920803C-24C9-47B6-89FA-DEDCF6FB518E}: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{2DD58651-9A84-40B7-8946-CC3534CA046C}: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{78A6B2B9-CFF7-443B-B184-4F764B1830A5}: DhcpNameServer = 10.1.1.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{AA6BCB74-4936-4938-BE18-4C30E925193F}: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{DF5F2FDB-3C5E-4F6A-990E-FDA759E19F9A}: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{F0890264-6DAF-4D4D-BE5B-9A458D415355}: NameServer = 211.29.132.12 61.88.88.88
O18:64bit: - Protocol\Handler\pure-go {4746C79A-2042-4332-8650-48966E44ABA8} - C:\Program Files (x86)\Common Files\Pure Networks Shared\Platform\amd64\puresp4.dll (Cisco Systems, Inc.)
O18 - Protocol\Handler\pure-go {4746C79A-2042-4332-8650-48966E44ABA8} - C:\Program Files (x86)\Common Files\Pure Networks Shared\Platform\puresp4.dll (Cisco Systems, Inc.)
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\SysWow64\userinit.exe (Microsoft Corporation)
O24 - Desktop WallPaper:
O24 - Desktop BackupWallPaper:
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2003/07/23 01:12:32 | 000,290,816 | R— | M] () - D:\Autorun.exe – [ CDFS ]
O32 - AutoRun File - [2003/07/16 05:47:12 | 000,000,046 | R— | M] () - D:\autorun.inf – [ CDFS ]
O33 - MountPoints2\{5bb4073e-a76d-11de-838a-002618085d10}\Shell - "" = AutoRun
O33 - MountPoints2\{5bb4073e-a76d-11de-838a-002618085d10}\Shell\AutoRun\command - "" = H:\LaunchU3.exe -a
O33 - MountPoints2\{7984d06a-8e39-11de-90ba-806e6f6e6963}\Shell - "" = AutoRun
O33 - MountPoints2\{7984d06a-8e39-11de-90ba-806e6f6e6963}\Shell\AutoRun\command - "" = D:\Autorun.exe – [2003/07/23 01:12:32 | 000,290,816 | R— | M] ()
O33 - MountPoints2\{9126fd1d-aaa3-11de-8577-002618085d10}\Shell - "" = AutoRun
O33 - MountPoints2\{9126fd1d-aaa3-11de-8577-002618085d10}\Shell\AutoRun\command - "" = G:\setup_vmc_lite.exe /checkApplicationPresence
O33 - MountPoints2\{9146f029-b170-11de-80a7-002618085d10}\Shell - "" = AutoRun
O33 - MountPoints2\{9146f029-b170-11de-80a7-002618085d10}\Shell\AutoRun\command - "" = G:\setup_vmc_lite.exe /checkApplicationPresence
O33 - MountPoints2\{a83f1202-b5ae-11de-8ce1-002618085d10}\Shell - "" = AutoRun
O33 - MountPoints2\{a83f1202-b5ae-11de-8ce1-002618085d10}\Shell\AutoRun\command - "" = H:\setup_vmc_lite.exe /checkApplicationPresence
O33 - MountPoints2\{c71dc276-0be6-11df-9212-002618085d10}\Shell - "" = AutoRun
O33 - MountPoints2\{c71dc276-0be6-11df-9212-002618085d10}\Shell\AutoRun\command - "" = G:\setup_vmc_lite.exe /checkApplicationPresence
O33 - MountPoints2\{c71dc279-0be6-11df-9212-002618085d10}\Shell - "" = AutoRun
O33 - MountPoints2\{c71dc279-0be6-11df-9212-002618085d10}\Shell\AutoRun\command - "" = H:\setup_vmc_lite.exe /checkApplicationPresence
O33 - MountPoints2\{ded609ef-7cbb-11e0-ab48-687f74e6a4cc}\Shell - "" = AutoRun
O33 - MountPoints2\{ded609ef-7cbb-11e0-ab48-687f74e6a4cc}\Shell\AutoRun\command - "" = G:\AutoRun.exe
O33 - MountPoints2\{ded609fa-7cbb-11e0-ab48-687f74e6a4cc}\Shell - "" = AutoRun
O33 - MountPoints2\{ded609fa-7cbb-11e0-ab48-687f74e6a4cc}\Shell\AutoRun\command - "" = G:\AutoRun.exe
O33 - MountPoints2\{ded60a04-7cbb-11e0-ab48-687f74e6a4cc}\Shell - "" = AutoRun
O33 - MountPoints2\{ded60a04-7cbb-11e0-ab48-687f74e6a4cc}\Shell\AutoRun\command - "" = H:\AutoRun.exe
O34 - HKLM BootExecute: (autocheck autochk *)
O35:64bit: - HKLM\..comfile [open] – "%1" %*
O35:64bit: - HKLM\..exefile [open] – "%1" %*
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37:64bit: - HKLM\…com [@ = comfile] – "%1" %*
O37:64bit: - HKLM\…exe [@ = exefile] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)

========== Files/Folders - Created Within 30 Days ==========

[2012/10/23 03:19:43 | 000,000,000 | —D | C] – C:\_OTL
[2012/10/21 22:09:41 | 004,731,392 | —- | C] (AVAST Software) – C:\Users\Andrew & Jenny\Desktop\aswMBR.exe
[2012/10/21 22:08:43 | 000,602,112 | —- | C] (OldTimer Tools) – C:\Users\Andrew & Jenny\Desktop\OTL.exe
[2012/10/21 20:03:00 | 000,388,608 | —- | C] (Trend Micro Inc.) – C:\Users\Andrew & Jenny\Desktop\HiJackThis.exe
[2012/10/21 19:47:10 | 000,000,000 | —D | C] – C:\Program Files (x86)\Mozilla Maintenance Service
[2012/10/21 18:29:10 | 000,000,000 | —D | C] – C:\Program Files (x86)\Smilebox Toolbar Removal Tool
[2012/10/21 16:47:26 | 000,000,000 | —D | C] – C:\Program Files (x86)\Mozilla Firefox
[2012/10/21 08:14:49 | 005,505,904 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\ntoskrnl.exe
[2012/10/21 08:14:47 | 003,958,128 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\ntkrnlpa.exe
[2012/10/21 08:14:47 | 003,902,832 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\ntoskrnl.exe
[2012/10/21 08:14:37 | 001,162,240 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\kernel32.dll
[2012/10/21 08:14:37 | 000,425,984 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\KernelBase.dll
[2012/10/21 08:14:37 | 000,338,432 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\conhost.exe
[2012/10/21 08:14:37 | 000,215,040 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\winsrv.dll
[2012/10/21 08:14:36 | 000,362,496 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\wow64win.dll
[2012/10/21 08:14:36 | 000,243,200 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\wow64.dll
[2012/10/21 08:14:36 | 000,025,600 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\setup16.exe
[2012/10/21 08:14:36 | 000,016,384 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\ntvdm64.dll
[2012/10/21 08:14:36 | 000,014,336 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\ntvdm64.dll
[2012/10/21 08:14:35 | 000,013,312 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\wow64cpu.dll
[2012/10/21 08:14:35 | 000,007,680 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\instnm.exe
[2012/10/21 08:14:35 | 000,006,144 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-security-base-l1-1-0.dll
[2012/10/21 08:14:35 | 000,005,120 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-file-l1-1-0.dll
[2012/10/21 08:14:35 | 000,005,120 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-file-l1-1-0.dll
[2012/10/21 08:14:35 | 000,005,120 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\wow32.dll
[2012/10/21 08:14:35 | 000,004,608 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-threadpool-l1-1-0.dll
[2012/10/21 08:14:35 | 000,004,608 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-processthreads-l1-1-0.dll
[2012/10/21 08:14:35 | 000,004,096 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-sysinfo-l1-1-0.dll
[2012/10/21 08:14:35 | 000,004,096 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-sysinfo-l1-1-0.dll
[2012/10/21 08:14:35 | 000,004,096 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-synch-l1-1-0.dll
[2012/10/21 08:14:35 | 000,004,096 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-localregistry-l1-1-0.dll
[2012/10/21 08:14:35 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-xstate-l1-1-0.dll
[2012/10/21 08:14:35 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-util-l1-1-0.dll
[2012/10/21 08:14:35 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-fibers-l1-1-0.dll
[2012/10/21 08:14:34 | 000,006,144 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-security-base-l1-1-0.dll
[2012/10/21 08:14:34 | 000,004,608 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-threadpool-l1-1-0.dll
[2012/10/21 08:14:34 | 000,004,608 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-processthreads-l1-1-0.dll
[2012/10/21 08:14:34 | 000,004,096 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-synch-l1-1-0.dll
[2012/10/21 08:14:34 | 000,004,096 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-misc-l1-1-0.dll
[2012/10/21 08:14:34 | 000,004,096 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-localregistry-l1-1-0.dll
[2012/10/21 08:14:34 | 000,004,096 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-localization-l1-1-0.dll
[2012/10/21 08:14:34 | 000,004,096 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-localization-l1-1-0.dll
[2012/10/21 08:14:34 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-xstate-l1-1-0.dll
[2012/10/21 08:14:34 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-rtlsupport-l1-1-0.dll
[2012/10/21 08:14:34 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-processenvironment-l1-1-0.dll
[2012/10/21 08:14:34 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-processenvironment-l1-1-0.dll
[2012/10/21 08:14:34 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-namedpipe-l1-1-0.dll
[2012/10/21 08:14:34 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-namedpipe-l1-1-0.dll
[2012/10/21 08:14:34 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-misc-l1-1-0.dll
[2012/10/21 08:14:34 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-memory-l1-1-0.dll
[2012/10/21 08:14:34 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-memory-l1-1-0.dll
[2012/10/21 08:14:34 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-libraryloader-l1-1-0.dll
[2012/10/21 08:14:34 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-libraryloader-l1-1-0.dll
[2012/10/21 08:14:34 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-interlocked-l1-1-0.dll
[2012/10/21 08:14:34 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-heap-l1-1-0.dll
[2012/10/21 08:14:34 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-heap-l1-1-0.dll
[2012/10/21 08:14:34 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-util-l1-1-0.dll
[2012/10/21 08:14:34 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-string-l1-1-0.dll
[2012/10/21 08:14:34 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-string-l1-1-0.dll
[2012/10/21 08:14:34 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-rtlsupport-l1-1-0.dll
[2012/10/21 08:14:34 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-profile-l1-1-0.dll
[2012/10/21 08:14:34 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-profile-l1-1-0.dll
[2012/10/21 08:14:34 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-io-l1-1-0.dll
[2012/10/21 08:14:34 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-io-l1-1-0.dll
[2012/10/21 08:14:34 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-interlocked-l1-1-0.dll
[2012/10/21 08:14:34 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-handle-l1-1-0.dll
[2012/10/21 08:14:34 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-handle-l1-1-0.dll
[2012/10/21 08:14:34 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-fibers-l1-1-0.dll
[2012/10/21 08:14:34 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-errorhandling-l1-1-0.dll
[2012/10/21 08:14:34 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-errorhandling-l1-1-0.dll
[2012/10/21 08:14:34 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-delayload-l1-1-0.dll
[2012/10/21 08:14:34 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-delayload-l1-1-0.dll
[2012/10/21 08:14:34 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-debug-l1-1-0.dll
[2012/10/21 08:14:34 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-debug-l1-1-0.dll
[2012/10/21 08:14:34 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-datetime-l1-1-0.dll
[2012/10/21 08:14:34 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-datetime-l1-1-0.dll
[2012/10/21 08:14:34 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-console-l1-1-0.dll
[2012/10/21 08:14:34 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-console-l1-1-0.dll
[2012/10/21 08:14:33 | 000,002,048 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\user.exe
[2012/10/21 08:14:15 | 000,220,160 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\wintrust.dll
[2012/10/21 08:13:17 | 001,462,784 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\crypt32.dll
[2012/10/21 08:13:16 | 000,140,288 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\cryptnet.dll
[2012/09/23 04:01:11 | 000,096,768 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\mshtmled.dll
[2012/09/23 04:01:11 | 000,073,216 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\mshtmled.dll
[2012/09/23 04:01:10 | 000,248,320 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\ieui.dll
[2012/09/23 04:01:10 | 000,231,936 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\url.dll
[2012/09/23 04:01:10 | 000,176,640 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\ieui.dll
[2012/09/23 04:01:10 | 000,173,056 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\ieUnatt.exe
[2012/09/23 04:01:10 | 000,142,848 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\ieUnatt.exe
[2012/09/23 04:01:09 | 000,237,056 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\url.dll
[2012/09/23 04:01:08 | 002,312,704 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\jscript9.dll
[2012/09/23 04:01:08 | 001,494,528 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\inetcpl.cpl
[2012/09/23 04:01:08 | 001,427,968 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\inetcpl.cpl
[2012/09/23 04:01:08 | 000,729,088 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\msfeeds.dll
[2012/09/23 04:01:05 | 000,816,640 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\jscript.dll
[2012/09/23 04:01:05 | 000,717,824 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\jscript.dll
[2012/09/23 04:01:05 | 000,599,040 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\vbscript.dll
[1 C:\Windows\SysNative\drivers\*.tmp files -> C:\Windows\SysNative\drivers\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2012/10/23 03:33:57 | 000,011,120 | -H– | M] () – C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2012/10/23 03:33:57 | 000,011,120 | -H– | M] () – C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2012/10/23 03:30:51 | 000,726,444 | —- | M] () – C:\Windows\SysNative\PerfStringBackup.INI
[2012/10/23 03:30:51 | 000,628,414 | —- | M] () – C:\Windows\SysNative\perfh009.dat
[2012/10/23 03:30:51 | 000,110,598 | —- | M] () – C:\Windows\SysNative\perfc009.dat
[2012/10/23 03:26:53 | 000,000,894 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2012/10/23 03:25:32 | 000,067,584 | –S- | M] () – C:\Windows\bootstat.dat
[2012/10/23 03:25:22 | 529,883,135 | -HS- | M] () – C:\hiberfil.sys
[2012/10/23 03:17:00 | 000,000,898 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2012/10/22 06:51:20 | 000,000,349 | —- | M] () – C:\Users\Public\Documents\PCLECHAL.INI
[2012/10/21 23:35:34 | 000,000,512 | —- | M] () – C:\Users\Andrew & Jenny\Desktop\MBR.dat
[2012/10/21 22:09:54 | 004,731,392 | —- | M] (AVAST Software) – C:\Users\Andrew & Jenny\Desktop\aswMBR.exe
[2012/10/21 22:08:46 | 000,602,112 | —- | M] (OldTimer Tools) – C:\Users\Andrew & Jenny\Desktop\OTL.exe
[2012/10/21 22:08:29 | 000,538,941 | —- | M] () – C:\Users\Andrew & Jenny\Desktop\adwcleaner.exe
[2012/10/21 20:03:01 | 000,388,608 | —- | M] (Trend Micro Inc.) – C:\Users\Andrew & Jenny\Desktop\HiJackThis.exe
[2012/10/21 19:47:12 | 000,001,147 | —- | M] () – C:\Users\Public\Desktop\Mozilla Firefox.lnk
[1 C:\Windows\SysNative\drivers\*.tmp files -> C:\Windows\SysNative\drivers\*.tmp -> ]

========== Files Created - No Company Name ==========

[2012/10/21 23:28:51 | 000,000,512 | —- | C] () – C:\Users\Andrew & Jenny\Desktop\MBR.dat
[2012/10/21 22:08:19 | 000,538,941 | —- | C] () – C:\Users\Andrew & Jenny\Desktop\adwcleaner.exe
[2012/10/21 19:47:12 | 000,001,159 | —- | C] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
[2012/10/21 19:47:12 | 000,001,147 | —- | C] () – C:\Users\Public\Desktop\Mozilla Firefox.lnk
[2012/09/12 20:52:25 | 000,000,719 | —- | C] () – C:\Users\Andrew & Jenny\Andrew & Jenny - Shortcut.lnk
[2012/07/16 08:31:22 | 000,000,000 | —- | C] () – C:\Users\Andrew & Jenny\AppData\Local\{23E9646A-BDE6-4BF7-B895-B72148184EC6}
[2012/06/22 09:02:55 | 000,000,000 | —- | C] () – C:\Users\Andrew & Jenny\AppData\Local\{D464CB29-9536-4362-990F-35C07B1E7584}
[2012/06/22 08:43:00 | 000,000,000 | —- | C] () – C:\Users\Andrew & Jenny\AppData\Local\{540AEFFB-AD62-45B0-AD3F-C10DEB1F07CD}
[2012/05/09 22:58:54 | 000,000,000 | —- | C] () – C:\Users\Andrew & Jenny\AppData\Local\{B7870E4E-61D8-4AF3-965F-88638A12879E}
[2012/03/21 07:43:00 | 000,000,000 | —- | C] () – C:\Users\Andrew & Jenny\AppData\Local\{A8DFF5FE-27FD-4D08-9EA9-503D7E27032F}
[2012/03/21 03:23:52 | 000,000,000 | —- | C] () – C:\Users\Andrew & Jenny\AppData\Local\{0A84A51C-9464-4018-8534-5CB45F30E169}
[2012/01/16 17:41:40 | 000,382,656 | —- | C] () – C:\Users\Andrew & Jenny\Heath Mail 15 Jan 2.jpg
[2012/01/16 17:40:05 | 000,720,440 | —- | C] () – C:\Users\Andrew & Jenny\Heath Mail 15 Jan.jpg
[2011/12/19 22:01:25 | 000,079,472 | —- | C] () – C:\Users\Andrew & Jenny\Zucchini Slice.avi.index
[2011/12/19 22:01:25 | 000,006,792 | —- | C] () – C:\Users\Andrew & Jenny\Zucchini Slice.avi.A.index
[2011/12/09 13:22:09 | 000,002,048 | —- | C] () – C:\Users\Andrew & Jenny\AppData\Roaming\Officeworks Photobooks Prefs
[2011/11/01 21:36:40 | 005,889,533 | —- | C] () – C:\Users\Andrew & Jenny\hobbit cover.jpg
[2011/11/01 21:35:31 | 004,722,896 | —- | C] () – C:\Users\Andrew & Jenny\hobbit4.jpg
[2011/11/01 21:34:08 | 005,280,784 | —- | C] () – C:\Users\Andrew & Jenny\hobbit3.jpg
[2011/11/01 21:32:12 | 004,995,304 | —- | C] () – C:\Users\Andrew & Jenny\hobbit2.jpg
[2011/11/01 21:29:41 | 005,207,767 | —- | C] () – C:\Users\Andrew & Jenny\hobbit1.jpg
[2011/09/21 22:14:33 | 751,864,020 | —- | C] () – C:\Users\Andrew & Jenny\Zucchini Slice.avi
[2011/08/13 16:48:05 | 000,628,585 | —- | C] () – C:\Users\Andrew & Jenny\Houltram Receipt.jpg
[2011/08/13 16:46:20 | 001,064,617 | —- | C] () – C:\Users\Andrew & Jenny\Houltram Costume Order Form.jpg
[2010/01/28 22:27:53 | 000,000,000 | —- | C] () – C:\ProgramData\DeviceManager.xml.RC4
[2009/12/16 08:38:52 | 000,046,080 | —- | C] () – C:\Users\Andrew & Jenny\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

========== ZeroAccess Check ==========

[2009/07/14 15:55:00 | 000,000,227 | RHS- | M] () – C:\Windows\assembly\Desktop.ini

[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64

[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] /64

[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
"" = C:\Windows\SysNative\shell32.dll – [2012/06/09 16:30:56 | 014,165,504 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shell32.dll – [2012/06/09 15:46:56 | 012,868,608 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\fastprox.dll – [2009/07/14 12:40:51 | 000,909,312 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Free

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\system32\wbem\fastprox.dll – [2009/07/14 12:15:20 | 000,605,696 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Free

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\wbemess.dll – [2009/07/14 12:41:56 | 000,505,856 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Both

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]

========== Alternate Data Streams ==========

@Alternate Data Stream - 168 bytes -> C:\Users\Andrew & Jenny\Documents\nanny agreement.jpeg:3or4kl4x13tuuug3Byamue2s4b

< End of report >


OTL Fix Log

All processes killed
========== SERVICES/DRIVERS ==========
========== OTL ==========
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{acbd5593-e5ee-4c15-b48f-1823ce819dec}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{acbd5593-e5ee-4c15-b48f-1823ce819dec}\ not found.
Registry key HKEY_USERS\S-1-5-21-3468640803-2489096565-429190105-1000\Software\Microsoft\Internet Explorer\SearchScopes\{acbd5593-e5ee-4c15-b48f-1823ce819dec}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{acbd5593-e5ee-4c15-b48f-1823ce819dec}\ not found.
Registry value HKEY_USERS\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\RunOnce\\mctadmin deleted successfully.
Registry value HKEY_USERS\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\RunOnce\\mctadmin deleted successfully.
64bit-Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\\WebCheck deleted successfully.
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E6FB5E20-DE35-11CF-9C87-00AA005127ED}\ not found.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\\WebCheck deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E6FB5E20-DE35-11CF-9C87-00AA005127ED}\ not found.
========== COMMANDS ==========

[EMPTYTEMP]

User: All Users

User: Andrew & Jenny
->Temp folder emptied: 5604865134 bytes
->Temporary Internet Files folder emptied: 483577279 bytes
->Java cache emptied: 1789618 bytes
->FireFox cache emptied: 1108509379 bytes
->Apple Safari cache emptied: 726016 bytes
->Flash cache emptied: 164865 bytes

User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes
->Flash cache emptied: 41 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: Public

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32 (64bit) .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 5820455701 bytes
%systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 36052047 bytes
RecycleBin emptied: 3688237527 bytes

Total Files Cleaned = 15,969.00 mb


OTL by OldTimer - Version 3.2.69.0 log created on 10232012_031943

Files\Folders moved on Reboot…
C:\Users\Andrew & Jenny\AppData\Local\Temp\FXSAPIDebugLogFile.txt moved successfully.
C:\Users\Andrew & Jenny\AppData\Local\Temp\FXSTIFFDebugLogFile.txt moved successfully.
C:\Users\Andrew & Jenny\AppData\Local\Temp\~DF519FF11446BAE6B9.TMP moved successfully.
File\Folder C:\Windows\temp\av87C6.tmp not found!
C:\Windows\temp\iswift.dat moved successfully.
C:\Windows\temp\sfdb.dat moved successfully.
C:\Windows\temp\ZLT0255c.TMP moved successfully.

PendingFileRenameOperations files…

Registry entries deleted on Reboot…


Thanks again for your help.

Andrew
Post #6
Hi H_andrew

There’s still a sign of MyWebSearch on your computer which causes redirects.

Run HijackThis
  • click on Config and then on the Misc Tools button
  • if you're viewing HijackThis from the Main Menu, click on Open the Misc Tools Section
  • click on the Open Uninstall Manager button
  • click the Save List button.
Copy and paste that list here.

================================================

Download Malwarebytes-Anti-Malware

Click here.
  • double-click mbam-setup.exe and follow the prompts to install the program.
  • at the end, be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware. and Launch Malwarebytes' Anti-Malware, then click Finish..
  • if an update is found, it will download and install the latest version.
  • once the program has loaded, select Perform quick scan, then click Scan.
  • when the scan is complete, click OK, then Show Results to view the results.
  • be sure that everything is checked, and click Remove Selected.
  • when removal is completed, a log report will open in Notepad and you may be prompted to restart your computer. (see Note below)
  • the log is automatically saved and can be viewed by clicking the Logs tab in MBAM.
  • copy and paste the contents of that report in your next reply and exit MBAM.
NOTE: If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts. Click OK to either and let MBAM proceed with the disinfection process. If asked to restart the computer, please do so immediately. Failure to reboot will prevent MBAM from removing all the malware.

================================================

Run Security Check

Download Security Check by screen317 from here or here.
  • save it to your Desktop.
  • double click SecurityCheck.exe and follow the onscreen instructions inside of the black box.
  • a Notepad document should open automatically called checkup.txt; please post the contents of that document.
Satchfan
Post #7
Satchfan,

Thank you

Have done what you asked. Requested logs are set out below.

Regards

Andrew


HiJackThis Uninstal list

Adobe Download Manager
Adobe Flash Player 11 Plugin
Adobe Help Center 2.1
Adobe Photoshop Elements 5.0
Adobe Reader 9.5.1
Apple Application Support
Apple Software Update
Belkin USB Wireless Adaptor
Belkin USB Wireless Adaptor
BigPond Media Downloader
Canon Easy-PhotoPrint EX
Canon Easy-PhotoPrint Pro
Canon Easy-PhotoPrint Pro - Pro9000 series Extention Data
Canon Easy-PhotoPrint Pro - Pro9500 series Extention Data
Canon Easy-WebPrint EX
Canon IJ Network Scanner Selector EX
Canon IJ Network Tool
Canon MP Navigator EX 5.0
Canon My Printer
Canon Solution Menu EX
Canon Utilities Easy-PhotoPrint
CDex extraction audio
Chessmaster Grandmaster Edition
Civilization III - Gold Edition
DivX Codec
DivX Converter
DivX Player
DivX Plus DirectShow Filters
DivX Web Player
Doom 3
e-tax 2009
e-tax 2010
e-tax 2011
Forté Agent
Google Earth
Google Update Helper
Google Updater
GrabIt 1.7.2 Beta 6 (build 1008)
i-Studio
Java™ 6 Update 22
MediaRECOVER
Microsoft Office 97, Professional Edition
Microsoft Silverlight
Microsoft Visual C++ 2005 Redistributable
Mozilla Firefox 16.0.1 (x86 en-US)
Mozilla Maintenance Service
MSXML 4.0 SP2 (KB954430)
MSXML 4.0 SP2 (KB973688)
MyFunCards Toolbar
Need For Speed Hot Pursuit 2
Nero 7 Essentials
Network Magic
Optus Mobile Broadband
Pinnacle Instant DVD Recorder
Pinnacle Studio 12
QuickTime
Safari
SecondLife (remove only)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2160841)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2446708)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2478663)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2518870)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2539636)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2572078)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2604121)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2633870)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2656351)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2656368)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2656368v2)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2656405)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2686827)
Snap.Do
Spelling Dictionaries Support For Adobe Reader 9
SureThing Express Labeler
Update for Microsoft .NET Framework 4 Client Profile (KB2468871)
Update for Microsoft .NET Framework 4 Client Profile (KB2533523)
Update for Microsoft .NET Framework 4 Client Profile (KB2600217)
VC 9.0 Runtime
VC80CRTRedist - 8.0.50727.4053
VideoLAN VLC media player 0.8.6c
Vodafone Mobile Connect
YouTube Downloader 2.5.7
ZoneAlarm Antivirus
ZoneAlarm Antivirus
ZoneAlarm Firewall
ZoneAlarm Security
ZoneAlarm Security Toolbar





Mbam log


Malwarebytes Anti-Malware (Trial) 1.65.1.1000
www.malwarebytes.org

Database version: v2012.10.23.09

Windows 7 x64 NTFS
Internet Explorer 9.0.8112.16421
Andrew & Jenny :: HOME-PC [administrator]

Protection: Enabled

24/10/2012 8:16:28 AM
mbam-log-2012-10-24 (08-16-28).txt

Scan type: Quick scan
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
Scan options disabled: P2P
Objects scanned: 208874
Time elapsed: 5 minute(s), 36 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 0
(No malicious items detected)

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 0
(No malicious items detected)

Files Detected: 1
C:\Users\Andrew & Jenny\Downloads\VLCSetup.exe (Adware.Hotbar) -> Quarantined and deleted successfully.

(end)

Checkup Text

Results of screen317's Security Check version 0.99.53
Windows 7 x64 (UAC is enabled)
Out of date service pack!!
Internet Explorer 9
``````````````Antivirus/Firewall Check:``````````````
Windows Firewall Disabled!
ZoneAlarm Antivirus
AVG Internet Security 2013
Antivirus up to date!
`````````Anti-malware/Other Utilities Check:`````````
Malwarebytes Anti-Malware version 1.65.1.1000
Java™ 6 Update 22
Java version out of Date!
Adobe Flash Player 11.3.300.270 Flash Player out of Date!
Adobe Reader 9 Adobe Reader out of Date!
Mozilla Firefox (16.0.1)
````````Process Check: objlist.exe by Laurent````````
Malwarebytes Anti-Malware mbamservice.exe
Malwarebytes Anti-Malware mbamgui.exe
AVG avgwdsvc.exe
Malwarebytes' Anti-Malware mbamscheduler.exe
CheckPoint ZoneAlarm vsmon.exe
CheckPoint ZoneAlarm zatray.exe
`````````````````System Health check`````````````````
Total Fragmentation on Drive C:
````````````````````End of Log``````````````````````
Post #8
Looking better

Uninstall SnapDo
  • click Start, Control Panel, Programs and Features.
  • click on SnapDo and then Uninstall.
Can you tell me if there are any outstanding problems.

Satchfan
Post #10

I wondered about 'MyFunCards Toolbar'

A bit remiss of me to have missed that one. :oops: Please uninstall that also.

====================================

AVG Internet Security 2013 is showing up in the SecurityCheck program but not in the "installed programs" list. Can you shed some light on that as it's impossible to have total ZoneAlarm protection and AVG without running into major problems.

====================================

One more scan to check that all the bad syuff has gone.

Run ESET Online Scan

IMPORTANT Please make sure you uncheck the box next to Remove found threats. Eset will detect anything that looks even slightly suspicious, which could include legitimate program files. If you do not uncheck the box, Eset will automatically remove all suspicious files which could leave some of your software inoperable.

Note: You can use either Internet Explorer or Mozilla FireFox for this scan. You will however need to disable your current installed Anti-Virus, how to do so can be read here.

Hold down Control and click on the following link to open ESET OnlineScan in a new window.

ESET OnlineScan 1. Click the Eset online Scanner button.
2. For alternate browsers only: (Microsoft Internet Explorer users can skip these steps)

• Click on esetinstaller.exe to download the ESET Smart Installer. Save it to your desktop.
• Double click on the Eset installer icon on your desktop.

3. Check Yes, I accept the Terms of Use
4. Click the Start button.
5. Accept any security warnings from your browser.
6. Check Scan archives
7. Push the Start button.
8. ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
9. When the scan completes, push List of found threats
10. Push Export to Text file and save the file to your desktop using a unique name, such as ESETScan. Include the contents of this report in your next reply.
Note - if ESET doesn't find any threats, no report will be created.
11. Push the back button.
12. Push Finish
If a log has been produced post it in your next reply.

Please remember to fill me in with the AVG situation also.

Satchfan
Post #11
Satchfan I'm having some trouble complying with these instructions. Firstly, when I attempt to remove MyFuncards toolbar, I get a message pop up saying: "There was a problem starting c:\progra~2\myfunc~2\bar\1.bin\5mbar.dll The specified module could not be found" Secondly, I am having difficulties with AVG and Zonealarm. I think I accidently installed a trial version of AVG when I was trying to follow some of your earlier instructions. I've since tried to uninstall it. Though I seem to have succeeded, Zonealarm is now giving me messages that my subscription has expired even though I only renewed it recently (following the issues I'm trying to resolve here). The EST online scan doesn't progress. Messages I get say that this is due to Zonealarm. However, everything I try to do with respect to Zonealarm simply generates the message that Zonealarm is currently not providing protection as my protection has expired. Any assistance would be appreciated. Kind Regards Andrew
Post #12
Don’t worry, these are all resolvable.

OK let’s deal with them one at a time and I’ll give you recommendations regarding anrivirus and firewall when we finish up.


Run AVG removal tool

Let’s get rid of AVG. Please download and run AVG Removal Tool. You can download it from here.

=================================================

Please download SystemLook from one of the links below and save it to your Desktop.

Download Mirror #1
Download Mirror #2
  • double-click SystemLook.exe to run it.
  • copy the content of the following codebox into the main textfield - please make sure you include the colon, (:), at the beginning.:

    :filefind
*MyFuncards*
*My Web Search*
*MyWebSearch*

:folderfind
*MyFuncards*
My Web Search
*MyWebSearch*

:Regfind
MyFuncards
My Web Search
MyWebSearch

  • click the Look button to start the scan.
  • when finished, a notepad window will open with the results of the scan. Please post this log in your next reply.
Note: The log can also be found on your Desktop entitled SystemLook.txt

=================================================

Re ZoneAlarm

Can you tell me if this is the free or paid version and exactly which version it is.

Satchfan
Post #13
Satchfan,

Have done as you suggested:


SystemLook Log

SystemLook 30.07.11 by jpshortstuff
Log created at 21:45 on 28/10/2012 by Andrew & Jenny
Administrator - Elevation successful
WARNING: SystemLook running under WOW64. Use SystemLook_x64 for accurate results.

========== filefind ==========

Searching for "*MyFuncards*"
C:\Users\Andrew & Jenny\AppData\Roaming\Microsoft\Windows\Cookies\Low\andrew_&_jenny@myfuncards[2].txt –a—- 285 bytes [03:41 14/06/2010] [03:41 14/06/2010] 6C2CD95A60ADA5E2137AC27D18B2891B

Searching for "*My Web Search*"
No files found.

Searching for "*MyWebSearch*"
C:\Users\Andrew & Jenny\AppData\Roaming\Microsoft\Windows\Cookies\Low\andrew_&_jenny@mywebsearch[2].txt –a—- 440 bytes [08:19 25/08/2010] [08:19 25/08/2010] 014A46FDA4BA88F61361036FB071FEA2

========== folderfind ==========

Searching for "*MyFuncards*"
No folders found.

Searching for "My Web Search"
No folders found.

Searching for "*MyWebSearch*"
No folders found.

========== Regfind ==========

Searching for "MyFuncards"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MyFunCards_5mbar Uninstall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MyFunCards_5mbar Uninstall]
"DisplayName"="MyFunCards Toolbar"

Searching for "My Web Search"
No data found.

Searching for "MyWebSearch"
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-21-3468640803-2489096565-429190105-1000\Software\Web Assistant\script_storage]
"WSG_whiteList"="{"search.babylon.com":"q","search.sweetim.com":"q","search.imesh.net":"q","www.search-results.com":"q","home.mywebsearch.com":"searchfor","search.mywebsearch.com":"searchfor","search.mindspark.com":"searchfor","search.conduit.com":"q","search.zugo.com":"p","www2.mystart.com":"q","www.mystart.com":"q","www.bigseekpro.com":"q","bigseekpro.com":"q","bigspeedpro.com":"q","search.esnips.com":"searchQuery","search.foxtab.com":"q","search.brothersoft.com":"keyword","search.softonic.com":"q","www.dogpile.com":"q","search.infospace.com":"q","search.iobit.com":"q","search.iminent.com":"","search.facemoods.com":"s","www.plusnetwork.com":"q","www.alothome.com":"q","alothome.com":"q","search.alothome.com":"q","search.chatvibes.com":"q","search.blekko.com":"","www.searchnu.com":"q","searchnu.com":"q","search.icq.com":"q","search.etype.c
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MyFunCards_5mbar Uninstall]
"HelpLink"="http://search.mywebsearch.com/mywebsearch/default.jhtml"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MyFunCards_5mbar Uninstall]
"UrlInfoAbout"="http://search.mywebsearch.com/mywebsearch/default.jhtml"
[HKEY_USERS\S-1-5-21-3468640803-2489096565-429190105-1000\Software\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-21-3468640803-2489096565-429190105-1000\Software\Web Assistant\script_storage]
"WSG_whiteList"="{"search.babylon.com":"q","search.sweetim.com":"q","search.imesh.net":"q","www.search-results.com":"q","home.mywebsearch.com":"searchfor","search.mywebsearch.com":"searchfor","search.mindspark.com":"searchfor","search.conduit.com":"q","search.zugo.com":"p","www2.mystart.com":"q","www.mystart.com":"q","www.bigseekpro.com":"q","bigseekpro.com":"q","bigspeedpro.com":"q","search.esnips.com":"searchQuery","search.foxtab.com":"q","search.brothersoft.com":"keyword","search.softonic.com":"q","www.dogpile.com":"q","search.infospace.com":"q","search.iobit.com":"q","search.iminent.com":"","search.facemoods.com":"s","www.plusnetwork.com":"q","www.alothome.com":"q","alothome.com":"q","search.alothome.com":"q","search.chatvibes.com":"q","search.blekko.com":"","www.searchnu.com":"q","searchnu.com":"

-= EOF =-



Zonealarm is a paid version. Initially bought from a shop, with the recent update being done online. Under properties it has the following description

ZoneAlarm with Antivirus version: 10.2.081.000
ZoneAlarm license key:
Vsmon version: 10.2.081.000
Driver version: 10.0.217.000
Antivirus engine version: 8.2.11.97
Antivirus signature DAT file version: 1083937568
ZoneAlarm Browser Security: 1.5.396.0
ZoneAlarm ForceField Spyware Scanner: [removed]

I'm not sure that it will help, but the update I bought was the one I was directed to by Zonealarm itself "ZoneAlarm PRO Antivirus + Firewall 3 PC - 1 Year"

Thanks again for your help.

Andrew
Post #14
We’ll address the ZoneAlarm problem shortly.

Please delete the copy of SystemLook that you previously downloaded as it was for a different version to the one we will run this time.

When you have done that:

Clear all your temporary files & Cookies

Download ATF Cleaner
  • double-click ATF-Cleaner.exe (on your desktop) to run the program.
  • under Main choose: Select All
  • click the Empty Selected button.
If you use Firefox browser
  • click Firefox at the top and choose: Select All
  • click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click No at the prompt.

If you use Opera browser
  • click Opera at the top and choose: Select All
  • click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click No at the prompt.

Click Exit on the Main menu to close the program.

===============================================

Run OTL
  • double click on the icon to run it.
  • copy/paste ALL the following text written inside the code box into the Custom Scans/Fixes box located at the bottom of OTL

    :Services

:Reg
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MyFunCards_5mbar Uninstall]
"DisplayName"=-

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-21-3468640803-2489096565-429190105-1000\Software\Web Assistant\script_storage]
"WSG_whiteList"=-

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MyFunCards_5mbar Uninstall]
"HelpLink"=-

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MyFunCards_5mbar Uninstall]
"UrlInfoAbout"=-

[HKEY_USERS\S-1-5-21-3468640803-2489096565-429190105-1000\Software\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-21-3468640803-2489096565-429190105-1000\Software\Web Assistant\script_storage]
"WSG_whiteList"=-

:Files
ipconfig /flushdns /c

:Commands
[purity]
[emptytemp]
[Reboot]

  • click the Run Fix button at the top
  • let the program run unhindered, reboot when it is done
  • please post the OTL fix log
================================================

Please download SystemLook from here and save it to your Desktop.
  • double-click SystemLook.exe to run it.
  • copy the content of the following codebox into the main textfield - please make sure you include the colon, (:), at the beginning.

    :filefind
*MyFuncards*
*MyWebSearch*

:Regfind
MyFuncards
MyWebSearch

  • click the Look button to start the scan.
  • when finished, a notepad window will open with the results of the scan. Please post this log in your next reply.
Note: The log can also be found on your Desktop entitled SystemLook.txt

Logs to include in the next post:

OTL fix log
SystemLook.txt

Satchfan
Post #15
It has been several days since I replied and asked you to run a couple of scans.. Please let me know if you are having problems and still need help. Thanks Satchfan

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI