What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

infected laptop [Solved]

24 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #46
Jeff, Wow, I am surprised at what remains after deleting Firefox After running the uninstall tool, the only file I found was C:\Program Files\Mozilla Foxfire It was deleted I am still running in chrome which I'm not quite use to yet. ;) Sorry it took so long but Mondays always seem to take forever. SystemLook 30.07.11 by jpshortstuff Log created at 21:06 on 07/01/2013 by kafura Administrator - Elevation successful ========== regfind ========== Searching for "Firefox" [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\LowRegistry\Audio\PolicyConfig\PropertyStore\5399b4b2_0] @="{0.0.0.00000000}.{2a9b4174-29f7-4ea9-8530-ef140c3c555a}|\Device\HarddiskVolume2\Program Files\Mozilla Firefox\plugin-container.exe%b{00000000-0000-0000-0000-000000000000}" [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\LowRegistry\Audio\PolicyConfig\PropertyStore\81943646_0] @="{0.0.0.00000000}.{2a9b4174-29f7-4ea9-8530-ef140c3c555a}|\Device\HarddiskVolume2\Program Files\Mozilla Firefox\firefox.exe%b{00000000-0000-0000-0000-000000000000}" [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.doc\OpenWithList] "d"="firefox.exe" [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.gif\OpenWithList] "c"="firefox.exe" [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList] "a"="firefox.exe" [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList] "b"="firefox.exe" [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpg\OpenWithList] "g"="firefox.exe" [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht\OpenWithList] "b"="firefox.exe" [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3\OpenWithList] "b"="firefox.exe" [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.msi\OpenWithList] "a"="firefox.exe" [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.odt\OpenWithList] "d"="firefox.exe" [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ots\OpenWithList] "a"="firefox.exe" [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ott\OpenWithList] "a"="firefox.exe" [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList] "b"="firefox.exe" [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.png\OpenWithList] "d"="firefox.exe" [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rar\OpenWithList] "a"="firefox.exe" [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.torrent\OpenWithList] "a"="firefox.exe" [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.txt\OpenWithList] "d"="firefox.exe" [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xls\OpenWithList] "a"="firefox.exe" [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.zip\OpenWithList] "a"="firefox.exe" [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\DDECache\Firefox] [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\DDECache\Firefox\WWW_OpenURL] "ProcessName"="firefox.exe" [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\2008firefox.com] [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\2009-box.com\firefox] [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\2009-box.com\www.firefox] [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\firefoxdownload-now.com] [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\EscDomains\2008firefox.com] [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\EscDomains\2009-box.com\firefox] [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\EscDomains\2009-box.com\www.firefox] [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\EscDomains\firefoxdownload-now.com] [HKEY_CURRENT_USER\Software\Mozilla\Firefox] [HKEY_CURRENT_USER\Software\Safer Networking Limited\PortableSupport] "Firefox"=" " [HKEY_CURRENT_USER\Software\Skype\Toolbars\Firefox] [HKEY_CURRENT_USER\Software\Classes\Applications\firefox.exe] [HKEY_CURRENT_USER\Software\Classes\Applications\firefox.exe\shell\open\command] @=""C:\Program Files\Mozilla Firefox\firefox.exe" "%1"" [HKEY_CURRENT_USER\Software\Classes\Firefox URL] [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SOFTWARE\RealNetworks\Update\6.0\Preferences\CfgWebBrowser1] @="C:\Program Files\Mozilla Firefox\firefox.exe" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SOFTWARE\RealNetworks\Update\6.0\Preferences\Components\BrowserRecordPlugin:15.0\Dir10] @="C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Firefox\\Ext\Chrome\Content" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SOFTWARE\RealNetworks\Update\6.0\Preferences\Components\BrowserRecordPlugin:15.0\Dir11] @="C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Firefox\\Ext\Chrome\Skin" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SOFTWARE\RealNetworks\Update\6.0\Preferences\Components\BrowserRecordPlugin:15.0\Dir12] @="C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Firefox\\Ext\Components" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SOFTWARE\RealNetworks\Update\6.0\Preferences\Components\BrowserRecordPlugin:15.0\Dir7] @="C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Firefox" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SOFTWARE\RealNetworks\Update\6.0\Preferences\Components\BrowserRecordPlugin:15.0\Dir8] @="C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Firefox\\Ext" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SOFTWARE\RealNetworks\Update\6.0\Preferences\Components\BrowserRecordPlugin:15.0\Dir9] @="C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Firefox\\Ext\Chrome" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SOFTWARE\RealNetworks\Update\6.0\Preferences\Components\BrowserRecordPlugin:15.0\File10] @="C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Firefox\\Ext\Components\nprpffbrowserrecordext.dll" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SOFTWARE\RealNetworks\Update\6.0\Preferences\Components\BrowserRecordPlugin:15.0\File11] @="C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Firefox\\Ext\Components\nprpffbrowserrecordlegacyext.dll" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SOFTWARE\RealNetworks\Update\6.0\Preferences\Components\BrowserRecordPlugin:15.0\File12] @="C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Firefox\\Ext\Components\nsirpbrowserrecord.xpt" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SOFTWARE\RealNetworks\Update\6.0\Preferences\Components\BrowserRecordPlugin:15.0\File13] @="C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Firefox\\Ext\install.rdf" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SOFTWARE\RealNetworks\Update\6.0\Preferences\Components\BrowserRecordPlugin:15.0\File6] @="C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Firefox\\Ext\Chrome\Content\browserrecordloader.js" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SOFTWARE\RealNetworks\Update\6.0\Preferences\Components\BrowserRecordPlugin:15.0\File7] @="C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Firefox\\Ext\Chrome\Content\browserrecordloader.xul" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SOFTWARE\RealNetworks\Update\6.0\Preferences\Components\BrowserRecordPlugin:15.0\File8] @="C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Firefox\\Ext\Chrome\Skin\rp_logo.png" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SOFTWARE\RealNetworks\Update\6.0\Preferences\Components\BrowserRecordPlugin:15.0\File9] @="C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Firefox\\Ext\chrome.manifest" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SOFTWARE\RealNetworks\Update\6.0\Preferences\Components\Embed:15.0\File1] @="C:\Program Files\Mozilla Firefox\plugins\nppl3260.dll" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SOFTWARE\RealNetworks\Update\6.0\Preferences\Components\Embed:15.0\File4] @="C:\Program Files\Mozilla Firefox\plugins\nppl3260.xpt" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SOFTWARE\RealNetworks\Update\6.0\Preferences\Components\Playerfiles:15.0\File41] @="C:\Program Files\Mozilla Firefox\plugins\nprpplugin.dll" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SOFTWARE\RealNetworks\Update\6.0\Preferences\Components\rjjava:15.0\File0] @="C:\Program Files\Mozilla Firefox\plugins\nprjplug.dll" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SOFTWARE\RealNetworks\Update\6.0\Preferences\Components\rjjava:15.0\File2] @="C:\Program Files\Mozilla Firefox\plugins\..\plugins\nprjplug.dll" [HKEY_LOCAL_MACHINE\SOFTWARE\Google\Toolbar for Firefox] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\RADAR\HeapLeakDetection\DiagnosedApplications\firefox.exe] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\firefox_RASAPI32] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\firefox_RASMANCS] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders] "C:\Program Files\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}\chrome\icons\default\"="1" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders] "C:\Program Files\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}\chrome\icons\"="1" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders] "C:\Program Files\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}\chrome\"="1" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders] "C:\Program Files\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}\"="1" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders] "C:\Program Files\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}\components\"="" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\026CBE7C1CEB2D04A92127A4E4FC8C90] "7692FC6BE18C0C0489510C7547EF1F02"="C:\Program Files\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}\chrome\skype_ff_extension.jar" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\4408222A31499B14E8869E9AE5DC2DBC] "7692FC6BE18C0C0489510C7547EF1F02"="02:\Software\Skype\Toolbars\Firefox\Plugin\UninstallString" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\4872DFE36C979574AA34CE3485089BBC] "7692FC6BE18C0C0489510C7547EF1F02"="C:\Program Files\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}\components\SkypeFfComponent.xpt" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\6D92CD6C6C911134C96D79905FC237E7] "7692FC6BE18C0C0489510C7547EF1F02"="01:\SOFTWARE\Skype\Toolbars\Firefox\FirstLaunch" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\6F026427365EBD1199B4E9A6558D5939] "C3A3BCE5B08921D4794252CD0BA7F174"="C:\Program Files\Mozilla Firefox\defaults\pref\itms.js" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\99AE00D278179BA4DBA8EA92BCB8E2F6] "7692FC6BE18C0C0489510C7547EF1F02"="C:\Program Files\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}\chrome.manifest" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\A4E74624CB1FFEA4184C365D7574FCC8] "7692FC6BE18C0C0489510C7547EF1F02"="C:\Program Files\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}\chrome\icons\default\" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\2008firefox.com] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\2009-box.com\firefox] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\2009-box.com\www.firefox] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\firefoxdownload-now.com] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\EscDomains\2008firefox.com] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\EscDomains\2009-box.com\firefox] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\EscDomains\2009-box.com\www.firefox] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\EscDomains\firefoxdownload-now.com] [HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Firefox] [HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Firefox\Extensions] "{97E22097-9A2F-45b1-8DAF-36AD648C7EF4}"="C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext" [HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Firefox\Extensions] "{23fcfd51-4958-4f00-80a3-ae97e717ed8b}"="C:\Program Files\DivX\DivX Plus Web Player\firefox\DivXHTML5" [HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@Apple.com/iTunes,version=1.0\MimeTypes\applications/itunes-plugin] "Description"="This plug-in detects the presence of iTunes when opening iTunes Store URLs in a web page with Firefox" [HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\Adobe Reader] "ProductName"="Adobe Reader Plugin for Firefox" [HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\Adobe Reader] "Description"="Handles PDFs in-place in Firefox" [HKEY_LOCAL_MACHINE\SOFTWARE\Safer Networking Limited\PortableSupport] "Firefox"=" " [HKEY_LOCAL_MACHINE\SOFTWARE\Skype\Toolbars\Firefox] [HKEY_LOCAL_MACHINE\SOFTWARE\Synaptics\SynTP\Defaults\AppProfiles\Mozilla Firefox] [HKEY_LOCAL_MACHINE\SOFTWARE\Synaptics\SynTPEnh\OSD\TouchPad\AppProfiles\Mozilla Firefox] [HKEY_LOCAL_MACHINE\SOFTWARE\Synaptics\SynTPEnh\OSD\TouchPad\AppProfiles\Mozilla Firefox] "AppExe"="firefox.exe" [HKEY_LOCAL_MACHINE\SOFTWARE\Synaptics\SynTPEnh\OSD\TouchPad\AppProfiles\Mozilla Firefox] "AppFriendlyName"="Mozilla Firefox" [HKEY_LOCAL_MACHINE\SOFTWARE\Synaptics\SynTPEnh\PlugInConfig\TouchPad\AppProfiles\Mozilla Firefox] [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\services\MozillaMaintenance] "Description"="The Mozilla Maintenance Service ensures that you have the latest and most secure version of Mozilla Firefox on your computer. Keeping Firefox up to date is very important for your online security, and Mozilla strongly recommends that you keep this service enabled." [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\2008firefox.com] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\2009-box.com\firefox] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\2009-box.com\www.firefox] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\firefoxdownload-now.com] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\EscDomains\2008firefox.com] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\EscDomains\2009-box.com\firefox] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\EscDomains\2009-box.com\www.firefox] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\EscDomains\firefoxdownload-now.com] [HKEY_USERS\S-1-5-21-1004960883-3848976763-1364486711-1000\Software\Microsoft\Internet Explorer\LowRegistry\Audio\PolicyConfig\PropertyStore\5399b4b2_0] @="{0.0.0.00000000}.{2a9b4174-29f7-4ea9-8530-ef140c3c555a}|\Device\HarddiskVolume2\Program Files\Mozilla Firefox\plugin-container.exe%b{00000000-0000-0000-0000-000000000000}" [HKEY_USERS\S-1-5-21-1004960883-3848976763-1364486711-1000\Software\Microsoft\Internet Explorer\LowRegistry\Audio\PolicyConfig\PropertyStore\81943646_0] @="{0.0.0.00000000}.{2a9b4174-29f7-4ea9-8530-ef140c3c555a}|\Device\HarddiskVolume2\Program Files\Mozilla Firefox\firefox.exe%b{00000000-0000-0000-0000-000000000000}" [HKEY_USERS\S-1-5-21-1004960883-3848976763-1364486711-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.doc\OpenWithList] "d"="firefox.exe" [HKEY_USERS\S-1-5-21-1004960883-3848976763-1364486711-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.gif\OpenWithList] "c"="firefox.exe" [HKEY_USERS\S-1-5-21-1004960883-3848976763-1364486711-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList] "a"="firefox.exe" [HKEY_USERS\S-1-5-21-1004960883-3848976763-1364486711-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList] "b"="firefox.exe" [HKEY_USERS\S-1-5-21-1004960883-3848976763-1364486711-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpg\OpenWithList] "g"="firefox.exe" [HKEY_USERS\S-1-5-21-1004960883-3848976763-1364486711-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht\OpenWithList] "b"="firefox.exe" [HKEY_USERS\S-1-5-21-1004960883-3848976763-1364486711-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3\OpenWithList] "b"="firefox.exe" [HKEY_USERS\S-1-5-21-1004960883-3848976763-1364486711-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.msi\OpenWithList] "a"="firefox.exe" [HKEY_USERS\S-1-5-21-1004960883-3848976763-1364486711-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.odt\OpenWithList] "d"="firefox.exe" [HKEY_USERS\S-1-5-21-1004960883-3848976763-1364486711-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ots\OpenWithList] "a"="firefox.exe" [HKEY_USERS\S-1-5-21-1004960883-3848976763-1364486711-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ott\OpenWithList] "a"="firefox.exe" [HKEY_USERS\S-1-5-21-1004960883-3848976763-1364486711-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList] "b"="firefox.exe" [HKEY_USERS\S-1-5-21-1004960883-3848976763-1364486711-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.png\OpenWithList] "d"="firefox.exe" [HKEY_USERS\S-1-5-21-1004960883-3848976763-1364486711-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rar\OpenWithList] "a"="firefox.exe" [HKEY_USERS\S-1-5-21-1004960883-3848976763-1364486711-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.torrent\OpenWithList] "a"="firefox.exe" [HKEY_USERS\S-1-5-21-1004960883-3848976763-1364486711-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.txt\OpenWithList] "d"="firefox.exe" [HKEY_USERS\S-1-5-21-1004960883-3848976763-1364486711-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xls\OpenWithList] "a"="firefox.exe" [HKEY_USERS\S-1-5-21-1004960883-3848976763-1364486711-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.zip\OpenWithList] "a"="firefox.exe" [HKEY_USERS\S-1-5-21-1004960883-3848976763-1364486711-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\DDECache\Firefox] [HKEY_USERS\S-1-5-21-1004960883-3848976763-1364486711-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\DDECache\Firefox\WWW_OpenURL] "ProcessName"="firefox.exe" [HKEY_USERS\S-1-5-21-1004960883-3848976763-1364486711-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\2008firefox.com] [HKEY_USERS\S-1-5-21-1004960883-3848976763-1364486711-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\2009-box.com\firefox] [HKEY_USERS\S-1-5-21-1004960883-3848976763-1364486711-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\2009-box.com\www.firefox] [HKEY_USERS\S-1-5-21-1004960883-3848976763-1364486711-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\firefoxdownload-now.com] [HKEY_USERS\S-1-5-21-1004960883-3848976763-1364486711-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\EscDomains\2008firefox.com] [HKEY_USERS\S-1-5-21-1004960883-3848976763-1364486711-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\EscDomains\2009-box.com\firefox] [HKEY_USERS\S-1-5-21-1004960883-3848976763-1364486711-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\EscDomains\2009-box.com\www.firefox] [HKEY_USERS\S-1-5-21-1004960883-3848976763-1364486711-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\EscDomains\firefoxdownload-now.com] [HKEY_USERS\S-1-5-21-1004960883-3848976763-1364486711-1000\Software\Mozilla\Firefox] [HKEY_USERS\S-1-5-21-1004960883-3848976763-1364486711-1000\Software\Safer Networking Limited\PortableSupport] "Firefox"=" " [HKEY_USERS\S-1-5-21-1004960883-3848976763-1364486711-1000\Software\Skype\Toolbars\Firefox] [HKEY_USERS\S-1-5-21-1004960883-3848976763-1364486711-1000\Software\Classes\Applications\firefox.exe] [HKEY_USERS\S-1-5-21-1004960883-3848976763-1364486711-1000\Software\Classes\Applications\firefox.exe\shell\open\command] @=""C:\Program Files\Mozilla Firefox\firefox.exe" "%1"" [HKEY_USERS\S-1-5-21-1004960883-3848976763-1364486711-1000\Software\Classes\Firefox URL] [HKEY_USERS\S-1-5-21-1004960883-3848976763-1364486711-1000_Classes\Applications\firefox.exe] [HKEY_USERS\S-1-5-21-1004960883-3848976763-1364486711-1000_Classes\Applications\firefox.exe\shell\open\command] @=""C:\Program Files\Mozilla Firefox\firefox.exe" "%1"" [HKEY_USERS\S-1-5-21-1004960883-3848976763-1364486711-1000_Classes\Firefox URL] [HKEY_USERS\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\2008firefox.com] [HKEY_USERS\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\2009-box.com\firefox] [HKEY_USERS\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\2009-box.com\www.firefox] [HKEY_USERS\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\firefoxdownload-now.com] [HKEY_USERS\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\EscDomains\2008firefox.com] [HKEY_USERS\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\EscDomains\2009-box.com\firefox] [HKEY_USERS\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\EscDomains\2009-box.com\www.firefox] [HKEY_USERS\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\EscDomains\firefoxdownload-now.com] -= EOF =-
Post #47
Hi,

Ok good. Let's get a fresh copy of Firefox on your system now. You can download it from here to your Desktop and then install it.

Let me know if you are still having the problems with Firefox you were before. :)
Post #48
Jeff, I downloaded Firefox from your link but all the problems are still there refreshing tabs and a scrambled homepage What else can we try? Patrick
Post #49
Hi,

[external image: Posted Image] Clear Java Cache

See this page for instructions on how to clear java's cache.

Go into the Control Panel and double-click the Java Icon. (looks like a coffee cup)
  • Under Temporary Internet Files, click the Delete Files button.
  • There are three options in the window to clear the cache - Leave ALL 3 Checked
    • Downloaded Applets
      Downloaded Applications
      Other Files
  • Click OK on Delete Temporary Files Window
    Note: This deletes ALL the Downloaded Applications and Applets from the CACHE.
  • Click OK to leave the Java Control Panel.
———-

[external image: Posted Image] Malwarebytes

Please open Malwarebytes, update it and then run a Quick Scan. Save the log that is created for your next reply.
———-

ESET Online Scanner

Go here to run an online scannner from ESET. Windows Vista/Windows 7 users will need to right click on their Internet Explorer shortcut, and select Run as Administrator
  • Note: For browsers other than Internet Explorer, you will be prompted to download and install esetsmartinstaller_enu.exe. Click on the link and save the file to a convenient location. Double click on it to install and a new window will open. Follow the prompts.
  • Turn off the real time scanner of any existing antivirus program while performing the online scan
  • Tick the box next to YES, I accept the Terms of Use.
  • Click Start
  • When asked, allow the activex control to install
  • Click Start
  • Make sure that the option Remove found threats is unticked and the Scan Archives option is ticked.
  • Click on Advanced Settings, ensure the options Scan for potentially unwanted applications, Scan for potentially unsafe applications, and Enable Anti-Stealth Technology are ticked.
  • Click Scan
  • Wait for the scan to finish
  • When the scan is done, if it shows a screen that says "Threats found!", then click "List of found threats", and then click "Export to text file…"
  • Save that text file on your desktop. Copy and paste the contents of that log as a reply to this topic.
  • Close the ESET online scan, and let me know how things are now.
———-
Post #50
Hello Jeff, OK, I cleared the Java cache, ran the requested scans and the resulting scans are below. MBAM did not find anything, ESET did. The ESET online scanner did not give me a remove option. I am still working in Chrome. I opened Firefox but did not see any difference. Patrick Malwarebytes Anti-Malware 1.70.0.1100 www.malwarebytes.org Database version: v2013.01.09.09 Windows 7 Service Pack 1 x86 NTFS Internet Explorer 9.0.8112.16421 kafura :: BIFF [administrator] 1/9/2013 5:34:37 PM mbam-log-2013-01-09 (17-34-37).txt Scan type: Quick scan Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM | P2P Scan options disabled: Objects scanned: 214140 Time elapsed: 8 minute(s), 46 second(s) Memory Processes Detected: 0 (No malicious items detected) Memory Modules Detected: 0 (No malicious items detected) Registry Keys Detected: 0 (No malicious items detected) Registry Values Detected: 0 (No malicious items detected) Registry Data Items Detected: 0 (No malicious items detected) Folders Detected: 0 (No malicious items detected) Files Detected: 0 (No malicious items detected) (end) ESET scan results C:\Users\kafura\Downloads\bbbe-latest.exe Win32/OpenCandy application C:\Users\kafura\Downloads\tinyzip.exe probably a variant of Win32/InstallIQ application
Post #51
First open an elevated command prompt > Click Start and type cmd in Start Search.
When cmd.exe populates above, right click it and select Run as Administrator to open an elevated command prompt.

Copy the contents of the code box > right click in the command window and select paste >> Press Enter (do one line at a time if there are more than one)
del C:\Users\kafura\Downloads\bbbe-latest.exe

del C:\Users\kafura\Downloads\tinyzip.exe
Close the Command Prompt box.

Let me know when you get this completed. :)
Post #53
Go to the following and see if they are still there…if they are, please delete them.

C:\Users\kafura\Downloads\bbbe-latest.exe <======
C:\Users\kafura\Downloads\tinyzip.exe <========
Post #55
Hi,

I don't see anything malware related jumping out at me. I think that you might be better served at this time by posting a new topic in the Browsers, Internet and Email forum. Be sure to post what problem you are having with Firefox and also a link to this topic so that the techs there can see what it is we have done. You will be in great hands as they are fantastic. When you finish up there, come back here and we will remove our tools. :)
Post #56
Hey Jeff, Thank you so very much for all your help I will get over to the other forum shortly. I will let you know how things work out :notworthy: Patrick
Post #58
Hello Jeff, Sorry it has taken a while to get back to you, but I've been busy with work. Well, they were great help over at the BI&E forum. I ended up setting up a new user profile for my Firefox and all problems disappeared. However, I can't seem to turn AVG back on. I also need help removing some AOL software that got installed on "accident" by one of my kids. I uninstalled any AOL related programs I found but still have a tool bar in Firefox. I am really trying to make the switch to Chrome as that's what my boss uses and just set me up with a new phone and work Gmail account. Any help will be greatly appreciated Patrick
Post #60
Jeff,
Here are the results of the OTL scan
I just happen to be between shifts, so I will not be able to get back to my computer till Saturday afternoon

Patrick

OTL logfile created on: 1/17/2013 9:19:36 PM - Run 6
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\kafura\Desktop
Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

1.87 Gb Total Physical Memory | 0.60 Gb Available Physical Memory | 32.27% Memory free
4.43 Gb Paging File | 0.44 Gb Available in Paging File | 9.92% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\windows | %ProgramFiles% = C:\Program Files
Drive C: | 223.27 Gb Total Space | 163.89 Gb Free Space | 73.40% Space Free | Partition Type: NTFS

Computer Name: BIFF | User Name: kafura | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Windows\System32\Macromed\Flash\FlashPlayerPlugin_11_5_502_146.exe (Adobe Systems, Inc.)
PRC - C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
PRC - C:\Users\kafura\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Program Files\Google\Chrome\Application\chrome.exe (Google Inc.)
PRC - C:\Windows\System32\taskhost.exe (Microsoft Corporation)
PRC - C:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater\13.2.0\ToolbarUpdater.exe ()
PRC - C:\Users\kafura\AppData\Roaming\Spotify\spotify.exe (Spotify Ltd)
PRC - C:\Users\kafura\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe (Spotify Ltd)
PRC - C:\Program Files\AVG\AVG2013\avgui.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe (SUPERAntiSpyware.com)
PRC - C:\Users\kafura\AppData\Local\Google\Google Talk Plugin\googletalkplugin.exe (Google)
PRC - C:\Program Files\AVG\AVG2013\avgwdsvc.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG2013\avgcfgex.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated)
PRC - C:\Program Files\SUPERAntiSpyware\SASCore.exe (SUPERAntiSpyware.com)
PRC - C:\Program Files\Research In Motion\BlackBerry Desktop\Rim.Desktop.AutoUpdate.exe (Research In Motion)
PRC - C:\Program Files\Real\RealPlayer\Update\realsched.exe (RealNetworks, Inc.)
PRC - C:\Program Files\Common Files\Research In Motion\RIMDeviceManager\RIMDeviceManager.exe (Research In Motion Limited)
PRC - C:\Program Files\Common Files\logishrd\LVMVFM\UMVPFSrv.exe (Logitech Inc.)
PRC - C:\Program Files\Common Files\Research In Motion\USB Drivers\RIMBBLaunchAgent.exe (Research In Motion Limited)
PRC - C:\Program Files\Common Files\logishrd\LQCVFX\COCIManager.exe ()
PRC - C:\Program Files\Logitech\LWS\Webcam Software\LWS.exe (Logitech Inc.)
PRC - C:\Program Files\Logitech\LWS\Webcam Software\CameraHelperShell.exe ()
PRC - C:\Program Files\DivX\DivX Update\DivXUpdate.exe ()
PRC - C:\Program Files\Common Files\Research In Motion\USB Drivers\BbDevMgr.exe (Research In Motion Limited)
PRC - C:\Windows\explorer.exe (Microsoft Corporation)
PRC - C:\Program Files\TOSHIBA\TOSHIBA Service Station\ToshibaServiceStation.exe (TOSHIBA Corporation)
PRC - C:\Program Files\TOSHIBA\TOSHIBA Service Station\TMachInfo.exe (TOSHIBA Corporation)
PRC - C:\Program Files\OpenOffice.org 3\program\soffice.bin (OpenOffice.org)
PRC - C:\Program Files\OpenOffice.org 3\program\soffice.exe (OpenOffice.org)
PRC - C:\Program Files\Common Files\Teleca Shared\Generic.exe (Teleca AB)
PRC - C:\Program Files\HTC\HTC Sync\ClientInitiatedStarter\ClientInitiatedStarter.exe (Teleca)
PRC - C:\Program Files\HTC\HTC Sync\Mobile Phone Monitor\dbgout.exe (Teleca Sweden AB)
PRC - C:\Program Files\HTC\HTC Sync\Mobile Phone Monitor\epmworker.exe (Teleca Sweden AB)
PRC - C:\Program Files\HTC\HTC Sync\Mobile Phone Monitor\FsynSrvStarter.exe (TODO: )
PRC - C:\Program Files\HTC\HTC Sync\Mobile Phone Monitor\HTCVBTServer.exe (Teleca AB)
PRC - C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSmartSrv.exe (TOSHIBA Corporation)
PRC - C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSENotify.exe (TOSHIBA Corporation)
PRC - C:\Program Files\TOSHIBA\ConfigFree\CFIWmxSvcs.exe (TOSHIBA CORPORATION)
PRC - C:\Program Files\TOSHIBA\Power Saver\TosCoSrv.exe (TOSHIBA Corporation)
PRC - C:\Program Files\TOSHIBA\Power Saver\TPwrMain.exe (TOSHIBA Corporation)
PRC - C:\Program Files\TOSHIBA\FlashCards\TCrdMain.exe (TOSHIBA Corporation)
PRC - C:\Windows\System32\TODDSrv.exe (TOSHIBA Corporation)
PRC - C:\Program Files\TOSHIBA\SmoothView\SmoothView.exe (TOSHIBA Corporation)
PRC - C:\Program Files\Common Files\Teleca Shared\logger.exe (Popwire AB)
PRC - C:\Program Files\HTC\HTC Sync\Application Launcher\Application Launcher.exe (Teleca Sweden AB)
PRC - C:\Program Files\Common Files\Teleca Shared\CapabilityManager.exe (Teleca Sweden AB)
PRC - C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe (TOSHIBA CORPORATION)
PRC - C:\Program Files\TOSHIBA\Utilities\KeNotify.exe (TOSHIBA CORPORATION)
PRC - C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe (Yahoo! Inc.)


========== Modules (No Company Name) ==========

MOD - c:\Program Files\WxDownload\sprotector.dll ()
MOD - C:\Windows\System32\Macromed\Flash\NPSWF32_11_5_502_146.dll ()
MOD - C:\windows\assembly\NativeImages_v2.0.50727_32\System.Core\77dfcfed5fd5f67d0d3edc545935bb21\System.Core.ni.dll ()
MOD - C:\windows\assembly\NativeImages_v2.0.50727_32\PresentationFramewo#\d7d20811a7ce7cc589153648cbb1ce5c\PresentationFramework.Aero.ni.dll ()
MOD - C:\windows\assembly\NativeImages_v2.0.50727_32\PresentationUI\679ef75106538d0be017771ec0ceec94\PresentationUI.ni.dll ()
MOD - C:\windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\865d2bf19a7af7fab8660a42d92550fe\System.Windows.Forms.ni.dll ()
MOD - C:\windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\eead6629e384a5b69f9ae35284b7eeed\System.Drawing.ni.dll ()
MOD - C:\windows\assembly\NativeImages_v2.0.50727_32\System.Xml\f687c43e9fdec031988b33ae722c4613\System.Xml.ni.dll ()
MOD - C:\windows\assembly\NativeImages_v2.0.50727_32\System.Configuration\195a77fcc6206f8bb35d419ff2cf0d72\System.Configuration.ni.dll ()
MOD - C:\windows\assembly\NativeImages_v2.0.50727_32\PresentationFramewo#\ff7c9a4f41f7cccc47e696c11b9f8469\PresentationFramework.ni.dll ()
MOD - C:\windows\assembly\NativeImages_v2.0.50727_32\PresentationCore\19b3d17c3ce0e264c4fb62028161adf7\PresentationCore.ni.dll ()
MOD - C:\windows\assembly\NativeImages_v2.0.50727_32\WindowsBase\cf827fe7bc99d9bcf0ba3621054ef527\WindowsBase.ni.dll ()
MOD - C:\windows\assembly\NativeImages_v2.0.50727_32\System\369f8bdca364e2b4936d18dea582912c\System.ni.dll ()
MOD - C:\windows\assembly\NativeImages_v2.0.50727_32\mscorlib\7150b9136fad5b79e88f6c7f9d3d2c39\mscorlib.ni.dll ()
MOD - C:\Program Files\Mozilla Firefox\mozjs.dll ()
MOD - C:\Program Files\Google\Chrome\Application\23.0.1271.97\PepperFlash\pepflashplayer.dll ()
MOD - C:\Program Files\Google\Chrome\Application\23.0.1271.97\ppgooglenaclpluginchrome.dll ()
MOD - C:\Program Files\Google\Chrome\Application\23.0.1271.97\pdf.dll ()
MOD - C:\Program Files\Google\Chrome\Application\23.0.1271.97\libglesv2.dll ()
MOD - C:\Program Files\Google\Chrome\Application\23.0.1271.97\libegl.dll ()
MOD - C:\Program Files\Google\Chrome\Application\23.0.1271.97\avutil-51.dll ()
MOD - C:\Program Files\Google\Chrome\Application\23.0.1271.97\avformat-54.dll ()
MOD - C:\Program Files\Google\Chrome\Application\23.0.1271.97\avcodec-54.dll ()
MOD - C:\windows\assembly\NativeImages_v2.0.50727_32\mscorlib\187d7c66735c533de851c76384f86912\mscorlib.ni.dll ()
MOD - C:\Users\kafura\AppData\Roaming\Spotify\Data\libcef.dll ()
MOD - C:\windows\assembly\GAC_MSIL\System.Windows.Forms\2.0.0.0__b77a5c561934e089\System.Windows.Forms.dll ()
MOD - C:\windows\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\System.dll ()
MOD - C:\windows\assembly\GAC_MSIL\System.Drawing\2.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll ()
MOD - \\?\C:\ProgramData\Microsoft\PlayReady\Cache\S-1-5-21-1004960883-3848976763-1364486711-1000\MSPRindiv01.key ()
MOD - C:\Program Files\Common Files\logishrd\LWSPlugins\LWS\Applets\CameraHelper\DevManagerCore.dll ()
MOD - C:\Program Files\Common Files\logishrd\LQCVFX\COCIManager.exe ()
MOD - C:\Program Files\Logitech\LWS\Webcam Software\QTXml4.dll ()
MOD - C:\Program Files\Logitech\LWS\Webcam Software\ImageFormats\QJpeg4.dll ()
MOD - C:\Program Files\Logitech\LWS\Webcam Software\ImageFormats\QGif4.dll ()
MOD - C:\Program Files\Logitech\LWS\Webcam Software\QTGui4.dll ()
MOD - C:\Program Files\Logitech\LWS\Webcam Software\QTCore4.dll ()
MOD - C:\Program Files\Logitech\LWS\Webcam Software\CameraHelperShell.exe ()
MOD - C:\Program Files\DivX\DivX Update\DivXUpdateCheck.dll ()
MOD - C:\Program Files\DivX\DivX Update\DivXUpdate.exe ()
MOD - C:\windows\assembly\GAC_MSIL\System.Xml\2.0.0.0__b77a5c561934e089\System.Xml.dll ()
MOD - C:\windows\assembly\GAC_MSIL\System.ServiceProcess\2.0.0.0__b03f5f7f11d50a3a\System.ServiceProcess.dll ()
MOD - C:\windows\assembly\GAC_MSIL\System.Configuration\2.0.0.0__b03f5f7f11d50a3a\System.Configuration.dll ()
MOD - C:\Program Files\OpenOffice.org 3\program\libxml2.dll ()
MOD - C:\windows\assembly\GAC\Microsoft.mshtml\7.0.3300.0__b03f5f7f11d50a3a\Microsoft.mshtml.dll ()
MOD - C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll ()
MOD - C:\Program Files\HTC\HTC Sync\Mobile Phone Monitor\tcpsock_object.dll ()
MOD - C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosIPCWraper.dll ()
MOD - C:\Program Files\TOSHIBA\TOSHIBA Disc Creator\NotifyTDC.dll ()
MOD - C:\Program Files\TOSHIBA\FlashCards\Hotkey\FnZ.dll ()
MOD - C:\Program Files\TOSHIBA\FlashCards\BlackPng.dll ()
MOD - C:\Program Files\HTC\HTC Sync\Mobile Phone Monitor\fsync.dll ()
MOD - C:\Program Files\HTC\HTC Sync\ClientInitiatedStarter\fsync.dll ()
MOD - C:\Program Files\TOSHIBA\TOSHIBA Assist\NotifyX.dll ()
MOD - C:\windows\assembly\GAC_MSIL\Accessibility\2.0.0.0__b03f5f7f11d50a3a\Accessibility.dll ()
MOD - C:\Program Files\TOSHIBA\PCDiag\NotifyPCD.dll ()
MOD - C:\Program Files\Common Files\Teleca Shared\boost_log-vc80-mt-1_33.dll ()


========== Services (SafeList) ==========

SRV - (AdobeFlashPlayerUpdateSvc) – C:\Windows\System32\Macromed\Flash\FlashPlayerUpdateService.exe (Adobe Systems Incorporated)
SRV - (MozillaMaintenance) – C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe (Mozilla Foundation)
SRV - (vToolbarUpdater13.2.0) – C:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater\13.2.0\ToolbarUpdater.exe ()
SRV - (AVGIDSAgent) – C:\Program Files\AVG\AVG2013\avgidsagent.exe (AVG Technologies CZ, s.r.o.)
SRV - (avgwd) – C:\Program Files\AVG\AVG2013\avgwdsvc.exe (AVG Technologies CZ, s.r.o.)
SRV - (AdobeARMservice) – C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated)
SRV - (!SASCORE) – C:\Program Files\SUPERAntiSpyware\SASCore.exe (SUPERAntiSpyware.com)
SRV - (SkypeUpdate) – C:\Program Files\Skype\Updater\Updater.exe (Skype Technologies)
SRV - (UMVPFSrv) – C:\Program Files\Common Files\logishrd\LVMVFM\UMVPFSrv.exe (Logitech Inc.)
SRV - (TMachInfo) – C:\Program Files\TOSHIBA\TOSHIBA Service Station\TMachInfo.exe (TOSHIBA Corporation)
SRV - (WatAdminSvc) – C:\Windows\System32\Wat\WatAdminSvc.exe (Microsoft Corporation)
SRV - (TOSHIBA HDD SSD Alert Service) – C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSmartSrv.exe (TOSHIBA Corporation)
SRV - (cfWiMAXService) – C:\Program Files\TOSHIBA\ConfigFree\CFIWmxSvcs.exe (TOSHIBA CORPORATION)
SRV - (TosCoSrv) – C:\Program Files\TOSHIBA\Power Saver\TosCoSrv.exe (TOSHIBA Corporation)
SRV - (TODDSrv) – C:\Windows\System32\TODDSrv.exe (TOSHIBA Corporation)
SRV - (SensrSvc) – C:\Windows\System32\sensrsvc.dll (Microsoft Corporation)
SRV - (WinDefend) – C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)
SRV - (ConfigFree Service) – C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe (TOSHIBA CORPORATION)
SRV - (YahooAUService) – C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe (Yahoo! Inc.)


========== Driver Services (SafeList) ==========

DRV - (USBCCID) – system32\DRIVERS\RtsUCcid.sys File not found
DRV - (RtsUIR) – system32\DRIVERS\Rts516xIR.sys File not found
DRV - (catchme) – C:\Users\kafura\AppData\Local\Temp\catchme.sys File not found
DRV - (avgtp) – C:\Windows\System32\drivers\avgtpx86.sys (AVG Technologies)
DRV - (AVGIDSDriver) – C:\Windows\System32\drivers\avgidsdriverx.sys (AVG Technologies CZ, s.r.o. )
DRV - (AVGIDSHX) – C:\Windows\System32\drivers\avgidshx.sys (AVG Technologies CZ, s.r.o. )
DRV - (Avgmfx86) – C:\Windows\System32\drivers\avgmfx86.sys (AVG Technologies CZ, s.r.o.)
DRV - (Avgldx86) – C:\Windows\System32\drivers\avgldx86.sys (AVG Technologies CZ, s.r.o.)
DRV - (Avgtdix) – C:\Windows\System32\drivers\avgtdix.sys (AVG Technologies CZ, s.r.o.)
DRV - (Avglogx) – C:\Windows\System32\drivers\avglogx.sys (AVG Technologies CZ, s.r.o.)
DRV - (AVGIDSShim) – C:\Windows\System32\drivers\avgidsshimx.sys (AVG Technologies CZ, s.r.o. )
DRV - (Avgrkx86) – C:\Windows\System32\drivers\avgrkx86.sys (AVG Technologies CZ, s.r.o.)
DRV - (RdpVideoMiniport) – C:\Windows\System32\drivers\rdpvideominiport.sys (Microsoft Corporation)
DRV - (TsUsbFlt) – C:\Windows\System32\drivers\TsUsbFlt.sys (Microsoft Corporation)
DRV - (LVUVC) – C:\Windows\System32\drivers\lvuvc.sys (Logitech Inc.)
DRV - (LVRS) – C:\Windows\System32\drivers\lvrs.sys (Logitech Inc.)
DRV - (SASDIFSV) – C:\Program Files\SUPERAntiSpyware\sasdifsv.sys (SUPERAdBlocker.com and SUPERAntiSpyware.com)
DRV - (SASKUTIL) – C:\Program Files\SUPERAntiSpyware\SASKUTIL.SYS (SUPERAdBlocker.com and SUPERAntiSpyware.com)
DRV - (WinUsb) – C:\Windows\System32\drivers\winusb.sys (Microsoft Corporation)
DRV - (RTL8187B) – C:\Windows\System32\drivers\RTL8187B.sys (Realtek Semiconductor Corporation )
DRV - (HTCAND32) – C:\Windows\System32\drivers\ANDROIDUSB.sys (HTC1124 Inc)
DRV - (UsbDiag) – C:\Windows\System32\drivers\lgusbdiag.sys (LG Electronics Inc.)
DRV - (USBModem) – C:\Windows\System32\drivers\lgusbmodem.sys (LG Electronics Inc.)
DRV - (usbbus) – C:\Windows\System32\drivers\lgusbbus.sys (LG Electronics Inc.)
DRV - (tdcmdpst) – C:\Windows\System32\drivers\tdcmdpst.sys (TOSHIBA Corporation.)
DRV - (tos_sps32) – C:\Windows\System32\drivers\tos_sps32.sys (TOSHIBA Corporation)
DRV - (RSUSBSTOR) – C:\Windows\System32\drivers\RtsUStor.sys (Realtek Semiconductor Corp.)
DRV - (TVALZ) – C:\Windows\System32\drivers\TVALZ_O.SYS (TOSHIBA Corporation)
DRV - (vwifimp) – C:\Windows\System32\drivers\vwifimp.sys (Microsoft Corporation)
DRV - (Serial) – C:\Windows\System32\drivers\serial.sys (Brother Industries Ltd.)
DRV - (AgereSoftModem) – C:\Windows\System32\drivers\AGRSM.sys (LSI Corp)
DRV - (LPCFilter) – C:\Windows\System32\drivers\LPCFilter.sys (COMPAL ELECTRONIC INC.)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com/ig/redirectdomain?br…A&bmod;=TSNA
IE - HKLM\..\SearchScopes,DefaultScope =
IE - HKLM\..\SearchScopes\{7AA0C22D-3016-4FE8-9ECC-4E762954DD33}: "URL" = http://www.google.com/search?sourceid=ie7&…amp;rlz=1I7TSNA

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
IE - HKCU\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM;=IE8SRC
IE - HKCU\..\SearchScopes\{7A13F886-FA12-43B1-B7F2-30FE3B84C785}: "URL" = http://us.yhs.search.yahoo.com/avg/search?…p={searchTerms}
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..browser.search.update: false
FF - prefs.js..browser.startup.homepage: "npr.org"
FF - prefs.js..extensions.enabledAddons: adblockpopups%40jessehakanen.net:0.5
FF - prefs.js..extensions.enabledAddons: %7Be4a8a97b-f2ed-450b-b12d-ee082ba24781%7D:1.5
FF - prefs.js..extensions.enabledAddons: %7B23fcfd51-4958-4f00-80a3-ae97e717ed8b%7D:[removed]
FF - prefs.js..extensions.enabledAddons: %7BAE93811A-5C9A-4d34-8462-F7B864FC4696%7D:4.16
FF - prefs.js..extensions.enabledAddons: %7B972ce4c6-7e08-4474-a285-3208198ce6fd%7D:18.0


FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\windows\system32\Macromed\Flash\NPSWF32_11_5_502_146.dll ()
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX VOD Helper,version=1.0.0: C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.10.2: C:\windows\system32\npDeployJava1.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.10.2: C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\5.1.10411.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=14.0.8081.0709: C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@real.com/nppl3260;version=15.0.4.53: C:\Program Files\Real\RealPlayer\Netscape6\nppl3260.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprjplug;version=15.0.4.53: C:\Program Files\Real\RealPlayer\Netscape6\nprjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprpchromebrowserrecordext;version=15.0.4.53: C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprpchromebrowserrecordext.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprphtml5videoshim;version=15.0.4.53: C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprpplugin;version=15.0.4.53: C:\Program Files\Real\RealPlayer\Netscape6\nprpplugin.dll (RealPlayer)
FF - HKLM\Software\MozillaPlugins\@RIM.com/WebSLLauncher,version=1.0: C:\Program Files\Common Files\Research In Motion\BBWebSLLauncher\NPWebSLLauncher.dll ()
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.123\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.123\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKCU\Software\MozillaPlugins\@facebook.com/FBPlugin,version=1.0.3: C:\Users\kafura\AppData\Roaming\Facebook\npfbplugin_1_0_3.dll ( )
FF - HKCU\Software\MozillaPlugins\@talk.google.com/GoogleTalkPlugin: C:\Users\kafura\AppData\Roaming\Mozilla\plugins\npgoogletalk.dll (Google)
FF - HKCU\Software\MozillaPlugins\@talk.google.com/O3DPlugin: C:\Users\kafura\AppData\Roaming\Mozilla\plugins\npgtpo3dautoplugin.dll ()
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Users\kafura\AppData\Local\Google\Update\1.3.21.123\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Users\kafura\AppData\Local\Google\Update\1.3.21.123\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@yahoo.com/BrowserPlus,version=2.9.8: C:\Users\kafura\AppData\Local\Yahoo!\BrowserPlus\2.9.8\Plugins\npybrowserplus_2.9.8.dll (Yahoo! Inc.)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{97E22097-9A2F-45b1-8DAF-36AD648C7EF4}: C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext [2012/06/06 15:11:00 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{23fcfd51-4958-4f00-80a3-ae97e717ed8b}: C:\Program Files\DivX\DivX Plus Web Player\firefox\DivXHTML5 [2012/06/10 09:00:47 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 18.0\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2013/01/08 18:32:16 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 18.0\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2013/01/13 18:53:56 | 000,000,000 | —D | M]

[2010/04/24 00:26:39 | 000,000,000 | —D | M] (No name found) – C:\Users\kafura\AppData\Roaming\mozilla\Extensions
[2013/01/13 18:53:57 | 000,000,000 | —D | M] (No name found) – C:\Users\kafura\AppData\Roaming\mozilla\Firefox\Profiles\kljlj7wg.Patrick\extensions
[2013/01/13 18:53:57 | 000,000,000 | —D | M] (AOL Toolbar) – C:\Users\kafura\AppData\Roaming\mozilla\Firefox\Profiles\kljlj7wg.Patrick\extensions\{7affbfae-c4e2-4915-8c0f-00fa3ec610a1}
[2013/01/13 18:54:25 | 000,000,000 | —D | M] (No name found) – C:\Users\kafura\AppData\Roaming\mozilla\Firefox\Profiles\vufdye7f.default\extensions
[2013/01/13 18:53:57 | 000,000,000 | —D | M] (AOL Toolbar) – C:\Users\kafura\AppData\Roaming\mozilla\Firefox\Profiles\vufdye7f.default\extensions\{7affbfae-c4e2-4915-8c0f-00fa3ec610a1}
[2013/01/13 18:53:10 | 000,000,000 | —D | M] (No name found) – C:\Users\kafura\AppData\Roaming\mozilla\Firefox\Profiles\vufdye7f.default\extensions\staged
[2013/01/12 17:59:23 | 000,372,140 | —- | M] () (No name found) – C:\Users\kafura\AppData\Roaming\mozilla\firefox\profiles\kljlj7wg.Patrick\extensions\{5C46D283-ABDE-4dce-B83C-08881401921C}.xpi
[2013/01/12 17:55:29 | 000,377,738 | —- | M] () (No name found) – C:\Users\kafura\AppData\Roaming\mozilla\firefox\profiles\kljlj7wg.Patrick\extensions\{AE93811A-5C9A-4d34-8462-F7B864FC4696}.xpi
[2012/11/16 22:34:36 | 000,124,993 | —- | M] () (No name found) – C:\Users\kafura\AppData\Roaming\mozilla\firefox\profiles\vufdye7f.default\extensions\[removed]
[2012/10/27 17:54:38 | 000,230,040 | —- | M] () (No name found) – C:\Users\kafura\AppData\Roaming\mozilla\firefox\profiles\vufdye7f.default\extensions\[removed]
[2012/09/17 10:06:42 | 000,128,244 | —- | M] () (No name found) – C:\Users\kafura\AppData\Roaming\mozilla\firefox\profiles\vufdye7f.default\extensions\{1DEC6447-C74F-4886-9002-202C27C703F1}.xpi
[2012/12/29 11:51:06 | 000,377,738 | —- | M] () (No name found) – C:\Users\kafura\AppData\Roaming\mozilla\firefox\profiles\vufdye7f.default\extensions\{AE93811A-5C9A-4d34-8462-F7B864FC4696}.xpi
[2012/11/23 09:17:08 | 000,804,627 | —- | M] () (No name found) – C:\Users\kafura\AppData\Roaming\mozilla\firefox\profiles\vufdye7f.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi
[2012/11/30 12:32:08 | 000,243,496 | —- | M] () (No name found) – C:\Users\kafura\AppData\Roaming\mozilla\firefox\profiles\vufdye7f.default\extensions\{e4a8a97b-f2ed-450b-b12d-ee082ba24781}.xpi
[2013/01/08 18:32:16 | 000,000,000 | —D | M] (No name found) – C:\Program Files\Mozilla Firefox\extensions
[2012/06/10 09:00:47 | 000,000,000 | —D | M] (DivX Plus Web Player HTML5 ) – C:\PROGRAM FILES\DIVX\DIVX PLUS WEB PLAYER\FIREFOX\DIVXHTML5
[2013/01/04 21:45:48 | 000,262,704 | —- | M] (Mozilla Foundation) – C:\Program Files\mozilla firefox\components\browsercomps.dll
[2013/01/04 21:45:12 | 000,002,465 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\bing.xml
[2013/01/04 21:45:12 | 000,002,058 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\twitter.xml

========== Chrome ==========

CHR - homepage: http://www.aol.com/?mtmhp=hyplogusaolp00000020
CHR - Extension: No name found = C:\Users\kafura\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.3_0\
CHR - Extension: No name found = C:\Users\kafura\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\
CHR - Extension: No name found = C:\Users\kafura\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\
CHR - Extension: No name found = C:\Users\kafura\AppData\Local\Google\Chrome\User Data\Default\Extensions\jfmjfhklogoienhpfnppmbcbjfjnkonk\1.5_0\
CHR - Extension: No name found = C:\Users\kafura\AppData\Local\Google\Chrome\User Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl\5.8.0.8855_0\
CHR - Extension: No name found = C:\Users\kafura\AppData\Local\Google\Chrome\User Data\Default\Extensions\nneajnkjbffgblleaoojgaacokifdkhm\2.1.2.145_0\
CHR - Extension: No name found = C:\Users\kafura\AppData\Local\Google\Chrome\User Data\Default\Extensions\ofdgkghcappcbgldakecnnnjnafnghep\1\
CHR - Extension: No name found = C:\Users\kafura\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\

O1 HOSTS File: ([2012/12/31 10:06:05 | 000,000,027 | —- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (RealPlayer Download and Record Plugin for Internet Explorer) - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll (RealPlayer)
O2 - BHO: (DivX Plus Web Player HTML5 ) - {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Program Files\DivX\DivX Plus Web Player\ie\DivXHTML5\DivXHTML5.dll (DivX, LLC)
O2 - BHO: (AVG Safe Search) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG2012\avgssie.dll File not found
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.
O2 - BHO: (Java™ Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
O2 - BHO: (Skype Browser Helper) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O2 - BHO: (Java™ Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O4 - HKLM..\Run: [00TCrdMain] C:\Program Files\TOSHIBA\FlashCards\TCrdMain.exe (TOSHIBA Corporation)
O4 - HKLM..\Run: [AVG_UI] C:\Program Files\AVG\AVG2013\avgui.exe (AVG Technologies CZ, s.r.o.)
O4 - HKLM..\Run: [DivXUpdate] C:\Program Files\DivX\DivX Update\DivXUpdate.exe ()
O4 - HKLM..\Run: [HWSetup] C:\Program Files\TOSHIBA\Utilities\HWSetup.exe (TOSHIBA Electronics, Inc.)
O4 - HKLM..\Run: [KeNotify] C:\Program Files\TOSHIBA\Utilities\KeNotify.exe (TOSHIBA CORPORATION)
O4 - HKLM..\Run: [LWS] C:\Program Files\Logitech\LWS\Webcam Software\LWS.exe (Logitech Inc.)
O4 - HKLM..\Run: [Mobile Connectivity Suite] C:\Program Files\HTC\HTC Sync\Application Launcher\Application Launcher.exe (Teleca Sweden AB)
O4 - HKLM..\Run: [NortonOnlineBackupReminder] C:\Program Files\TOSHIBA\Toshiba Online Backup\Activation\TobuActivation.exe (Toshiba)
O4 - HKLM..\Run: [RIMBBLaunchAgent.exe] C:\Program Files\Common Files\Research In Motion\USB Drivers\RIMBBLaunchAgent.exe (Research In Motion Limited)
O4 - HKLM..\Run: [SmoothView] C:\Program Files\TOSHIBA\SmoothView\SmoothView.exe (TOSHIBA Corporation)
O4 - HKLM..\Run: [SVPWUTIL] C:\Program Files\TOSHIBA\Utilities\SVPWUTIL.exe (TOSHIBA CORPORATION)
O4 - HKLM..\Run: [TkBellExe] C:\Program Files\Real\RealPlayer\Update\realsched.exe (RealNetworks, Inc.)
O4 - HKLM..\Run: [ToshibaServiceStation] C:\Program Files\TOSHIBA\TOSHIBA Service Station\ToshibaServiceStation.exe (TOSHIBA Corporation)
O4 - HKLM..\Run: [TosSENotify] C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosWaitSrv.exe (TOSHIBA Corporation)
O4 - HKLM..\Run: [TPwrMain] C:\Program Files\TOSHIBA\Power Saver\TPwrMain.exe (TOSHIBA Corporation)
O4 - HKCU..\Run: [MyTOSHIBA] C:\Program Files\TOSHIBA\My Toshiba\MyToshiba.exe (TOSHIBA)
O4 - HKCU..\Run: [Spotify] C:\Users\kafura\AppData\Roaming\Spotify\Spotify.exe (Spotify Ltd)
O4 - HKCU..\Run: [Spotify Web Helper] C:\Users\kafura\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe (Spotify Ltd)
O4 - HKCU..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe (SUPERAntiSpyware.com)
O4 - HKLM..\RunOnce: [Malwarebytes Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
O4 - Startup: C:\Users\kafura\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Event Reminder.lnk = C:\pmw\PMREMIND.EXE ()
O4 - Startup: C:\Users\kafura\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.2.lnk = C:\Program Files\OpenOffice.org 3\program\quickstart.exe ()
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O9 - Extra Button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra 'Tools' menuitem : Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.7.0/jinstall-…indows-i586.cab (Reg Error: Value error.)
O16 - DPF: {CAFEEFAC-0017-0000-0009-ABCDEFFEDCBA} http://java.sun.com/update/1.7.0/jinstall-…indows-i586.cab (Java Plug-in 1.7.0_09)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.7.0/jinstall-…indows-i586.cab (Java Plug-in 10.10.2)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.0.1 [removed]
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{1B767279-59A0-4ECD-B116-B25B002EEAAF}: DhcpNameServer = 192.168.0.1 [removed]
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{2B628043-564D-499C-B681-5AC04A3A786D}: DhcpNameServer = [removed] [removed]
O18 - Protocol\Handler\linkscanner {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG2012\avgpp.dll File not found
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O20 - AppInit_DLLs: (c:\progra~1\wxdown~1\sprote~1.dll) - c:\Program Files\WxDownload\sprotector.dll ()
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation)
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009/06/10 15:42:20 | 000,000,024 | —- | M] () - C:\autoexec.bat – [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = ComFile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)

========== Files/Folders - Created Within 30 Days ==========

[2013/01/13 18:54:54 | 000,000,000 | —D | C] – C:\ProgramData\Cloud Software LTD
[2013/01/13 18:53:26 | 000,000,000 | —D | C] – C:\Program Files\WxDownload
[2013/01/13 18:53:10 | 000,000,000 | —D | C] – C:\ProgramData\wxDownload
[2013/01/13 18:52:06 | 000,000,000 | —D | C] – C:\ProgramData\InstallMate
[2013/01/09 19:08:53 | 000,000,000 | —D | C] – C:\Program Files\ESET
[2013/01/09 02:30:02 | 002,345,984 | —- | C] (Microsoft Corporation) – C:\windows\System32\win32k.sys
[2013/01/09 02:29:39 | 000,271,360 | —- | C] (Microsoft Corporation) – C:\windows\System32\conhost.exe
[2013/01/09 02:29:39 | 000,169,984 | —- | C] (Microsoft Corporation) – C:\windows\System32\winsrv.dll
[2013/01/09 02:29:39 | 000,005,120 | -H– | C] (Microsoft Corporation) – C:\windows\System32\api-ms-win-core-file-l1-1-0.dll
[2013/01/09 02:29:38 | 000,006,144 | -H– | C] (Microsoft Corporation) – C:\windows\System32\api-ms-win-security-base-l1-1-0.dll
[2013/01/09 02:29:38 | 000,004,608 | -H– | C] (Microsoft Corporation) – C:\windows\System32\api-ms-win-core-processthreads-l1-1-0.dll
[2013/01/09 02:29:38 | 000,004,096 | -H– | C] (Microsoft Corporation) – C:\windows\System32\api-ms-win-core-sysinfo-l1-1-0.dll
[2013/01/09 02:29:38 | 000,004,096 | -H– | C] (Microsoft Corporation) – C:\windows\System32\api-ms-win-core-synch-l1-1-0.dll
[2013/01/09 02:29:38 | 000,004,096 | -H– | C] (Microsoft Corporation) – C:\windows\System32\api-ms-win-core-misc-l1-1-0.dll
[2013/01/09 02:29:38 | 000,004,096 | -H– | C] (Microsoft Corporation) – C:\windows\System32\api-ms-win-core-localregistry-l1-1-0.dll
[2013/01/09 02:29:38 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:\windows\System32\api-ms-win-core-xstate-l1-1-0.dll
[2013/01/09 02:29:38 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:\windows\System32\api-ms-win-core-processenvironment-l1-1-0.dll
[2013/01/09 02:29:38 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:\windows\System32\api-ms-win-core-namedpipe-l1-1-0.dll
[2013/01/09 02:29:38 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:\windows\System32\api-ms-win-core-memory-l1-1-0.dll
[2013/01/09 02:29:38 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:\windows\System32\api-ms-win-core-libraryloader-l1-1-0.dll
[2013/01/09 02:29:38 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:\windows\System32\api-ms-win-core-interlocked-l1-1-0.dll
[2013/01/09 02:29:38 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:\windows\System32\api-ms-win-core-heap-l1-1-0.dll
[2013/01/09 02:29:38 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\windows\System32\api-ms-win-core-string-l1-1-0.dll
[2013/01/09 02:29:38 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\windows\System32\api-ms-win-core-profile-l1-1-0.dll
[2013/01/09 02:29:38 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\windows\System32\api-ms-win-core-io-l1-1-0.dll
[2013/01/09 02:29:38 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\windows\System32\api-ms-win-core-handle-l1-1-0.dll
[2013/01/09 02:29:38 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\windows\System32\api-ms-win-core-fibers-l1-1-0.dll
[2013/01/09 02:29:38 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\windows\System32\api-ms-win-core-errorhandling-l1-1-0.dll
[2013/01/09 02:29:38 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\windows\System32\api-ms-win-core-delayload-l1-1-0.dll
[2013/01/09 02:29:38 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\windows\System32\api-ms-win-core-debug-l1-1-0.dll
[2013/01/09 02:29:38 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\windows\System32\api-ms-win-core-datetime-l1-1-0.dll
[2013/01/09 02:29:37 | 000,004,608 | -H– | C] (Microsoft Corporation) – C:\windows\System32\api-ms-win-core-threadpool-l1-1-0.dll
[2013/01/09 02:29:37 | 000,004,096 | -H– | C] (Microsoft Corporation) – C:\windows\System32\api-ms-win-core-localization-l1-1-0.dll
[2013/01/09 02:29:37 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\windows\System32\api-ms-win-core-util-l1-1-0.dll
[2013/01/09 02:29:37 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\windows\System32\api-ms-win-core-rtlsupport-l1-1-0.dll
[2013/01/09 02:29:37 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\windows\System32\api-ms-win-core-console-l1-1-0.dll
[2013/01/09 02:29:15 | 002,576,384 | —- | C] (Microsoft Corporation) – C:\windows\System32\gameux.dll
[2013/01/09 02:29:15 | 000,046,592 | —- | C] (Microsoft) – C:\windows\System32\fpb.rs
[2013/01/09 02:29:15 | 000,045,568 | —- | C] (Microsoft) – C:\windows\System32\oflc-nz.rs
[2013/01/09 02:29:15 | 000,044,544 | —- | C] (Microsoft) – C:\windows\System32\pegibbfc.rs
[2013/01/09 02:29:15 | 000,043,520 | —- | C] (Microsoft) – C:\windows\System32\csrr.rs
[2013/01/09 02:29:15 | 000,040,960 | —- | C] (Microsoft) – C:\windows\System32\cob-au.rs
[2013/01/09 02:29:15 | 000,030,720 | —- | C] (Microsoft) – C:\windows\System32\usk.rs
[2013/01/09 02:29:15 | 000,021,504 | —- | C] (Microsoft) – C:\windows\System32\grb.rs
[2013/01/09 02:29:15 | 000,020,480 | —- | C] (Microsoft) – C:\windows\System32\pegi-pt.rs
[2013/01/09 02:29:15 | 000,020,480 | —- | C] (Microsoft) – C:\windows\System32\pegi.rs
[2013/01/09 02:29:15 | 000,015,360 | —- | C] (Microsoft) – C:\windows\System32\djctq.rs
[2013/01/09 02:29:14 | 000,308,736 | —- | C] (Microsoft Corporation) – C:\windows\System32\Wpc.dll
[2013/01/09 02:29:12 | 000,051,712 | —- | C] (Microsoft) – C:\windows\System32\esrb.rs
[2013/01/09 02:29:12 | 000,023,552 | —- | C] (Microsoft) – C:\windows\System32\oflc.rs
[2013/01/09 02:29:12 | 000,020,480 | —- | C] (Microsoft) – C:\windows\System32\pegi-fi.rs
[2013/01/09 02:29:11 | 000,055,296 | —- | C] (Microsoft) – C:\windows\System32\cero.rs
[2013/01/09 02:29:05 | 000,220,160 | —- | C] (Microsoft Corporation) – C:\windows\System32\ncrypt.dll
[2013/01/09 02:28:53 | 000,049,152 | —- | C] (Microsoft Corporation) – C:\windows\System32\taskhost.exe
[2013/01/08 18:32:17 | 000,000,000 | —D | C] – C:\Program Files\Mozilla Maintenance Service
[2013/01/08 18:32:15 | 000,000,000 | —D | C] – C:\Program Files\Mozilla Firefox
[2013/01/06 16:02:05 | 000,000,000 | -HSD | C] – C:\$RECYCLE.BIN
[2013/01/06 15:48:04 | 005,019,547 | R— | C] (Swearware) – C:\Users\kafura\Desktop\ComboFix.exe
[2013/01/06 14:01:31 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome
[2013/01/06 13:53:57 | 000,000,000 | —D | C] – C:\Users\kafura\AppData\Roaming\SUPERAntiSpyware.com
[2013/01/06 13:53:46 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SUPERAntiSpyware
[2013/01/06 13:53:42 | 000,000,000 | —D | C] – C:\ProgramData\SUPERAntiSpyware.com
[2013/01/06 13:53:42 | 000,000,000 | —D | C] – C:\Program Files\SUPERAntiSpyware
[2013/01/06 13:49:47 | 023,034,504 | —- | C] (SUPERAntiSpyware.com) – C:\Users\kafura\Desktop\SUPERAntiSpyware.exe
[2013/01/03 18:42:03 | 000,000,000 | —D | C] – C:\_OTL
[2013/01/01 19:26:02 | 000,000,000 | —D | C] – C:\windows\ERUNT
[2013/01/01 19:25:55 | 000,000,000 | —D | C] – C:\JRT
[2013/01/01 19:25:09 | 000,497,009 | —- | C] (Oleg N. Scherbakov) – C:\Users\kafura\Desktop\JRT.exe
[2013/01/01 01:11:04 | 000,602,112 | —- | C] (OldTimer Tools) – C:\Users\kafura\Desktop\OTL.exe
[2012/12/31 10:08:16 | 000,000,000 | —D | C] – C:\Users\kafura\AppData\Local\temp
[2012/12/31 09:53:59 | 000,518,144 | —- | C] (SteelWerX) – C:\windows\SWREG.exe
[2012/12/31 09:53:59 | 000,406,528 | —- | C] (SteelWerX) – C:\windows\SWSC.exe
[2012/12/31 09:53:59 | 000,060,416 | —- | C] (NirSoft) – C:\windows\NIRCMD.exe
[2012/12/31 09:36:52 | 000,000,000 | —D | C] – C:\Qoobox
[2012/12/31 09:36:27 | 000,000,000 | —D | C] – C:\windows\erdnt
[2012/12/29 20:06:24 | 000,688,992 | R— | C] (Swearware) – C:\Users\kafura\Desktop\dds.com
[2012/12/29 12:50:31 | 000,000,000 | —D | C] – C:\Program Files\Trend Micro
[2012/12/29 12:50:31 | 000,000,000 | —D | C] – C:\Users\kafura\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\HiJackThis
[2012/12/29 11:36:20 | 000,000,000 | —D | C] – C:\Program Files\Common Files\Java
[2012/12/29 11:36:08 | 000,260,528 | —- | C] (Oracle Corporation) – C:\windows\System32\javaws.exe
[2012/12/29 11:35:32 | 000,174,000 | —- | C] (Oracle Corporation) – C:\windows\System32\javaw.exe
[2012/12/29 11:35:32 | 000,093,640 | —- | C] (Oracle Corporation) – C:\windows\System32\WindowsAccessBridge.dll
[2012/12/29 11:35:31 | 000,173,992 | —- | C] (Oracle Corporation) – C:\windows\System32\java.exe
[2012/12/21 03:01:46 | 000,295,424 | —- | C] (Adobe Systems Incorporated) – C:\windows\System32\atmfd.dll
[2012/12/21 03:01:46 | 000,034,304 | —- | C] (Adobe Systems) – C:\windows\System32\atmlib.dll

========== Files - Modified Within 30 Days ==========

[2013/01/17 21:22:21 | 000,000,830 | —- | M] () – C:\windows\tasks\Adobe Flash Player Updater.job
[2013/01/17 20:59:00 | 000,000,886 | —- | M] () – C:\windows\tasks\GoogleUpdateTaskMachineUA.job
[2013/01/17 20:36:00 | 000,000,912 | —- | M] () – C:\windows\tasks\GoogleUpdateTaskUserS-1-5-21-1004960883-3848976763-1364486711-1000UA.job
[2013/01/17 13:59:00 | 000,000,882 | —- | M] () – C:\windows\tasks\GoogleUpdateTaskMachineCore.job
[2013/01/17 12:36:00 | 000,000,860 | —- | M] () – C:\windows\tasks\GoogleUpdateTaskUserS-1-5-21-1004960883-3848976763-1364486711-1000Core.job
[2013/01/16 10:32:50 | 000,067,584 | –S- | M] () – C:\windows\bootstat.dat
[2013/01/13 03:07:15 | 000,016,304 | -H– | M] () – C:\windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2013/01/13 03:07:15 | 000,016,304 | -H– | M] () – C:\windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2013/01/11 17:17:46 | 000,624,178 | —- | M] () – C:\windows\System32\perfh009.dat
[2013/01/11 17:17:46 | 000,106,522 | —- | M] () – C:\windows\System32\perfc009.dat
[2013/01/09 19:34:19 | 000,014,219 | —- | M] () – C:\Users\kafura\Desktop\MSDS Xylol.pdf
[2013/01/09 17:33:14 | 000,001,042 | —- | M] () – C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2013/01/09 08:22:58 | 000,697,864 | —- | M] (Adobe Systems Incorporated) – C:\windows\System32\FlashPlayerApp.exe
[2013/01/09 08:22:58 | 000,074,248 | —- | M] (Adobe Systems Incorporated) – C:\windows\System32\FlashPlayerCPLApp.cpl
[2013/01/09 03:32:23 | 000,358,136 | —- | M] () – C:\windows\System32\FNTCACHE.DAT
[2013/01/09 03:31:02 | 1504,354,304 | -HS- | M] () – C:\hiberfil.sys
[2013/01/08 18:32:18 | 000,001,080 | —- | M] () – C:\Users\Public\Desktop\Mozilla Firefox.lnk
[2013/01/07 20:57:55 | 000,139,264 | —- | M] () – C:\Users\kafura\Desktop\SystemLook.exe
[2013/01/06 15:48:22 | 005,019,547 | R— | M] (Swearware) – C:\Users\kafura\Desktop\ComboFix.exe
[2013/01/06 14:01:31 | 000,002,210 | —- | M] () – C:\Users\Public\Desktop\Google Chrome.lnk
[2013/01/06 14:01:31 | 000,002,194 | —- | M] () – C:\Users\kafura\Application Data\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk
[2013/01/06 13:53:46 | 000,001,936 | —- | M] () – C:\Users\Public\Desktop\SUPERAntiSpyware Free Edition.lnk
[2013/01/06 13:52:32 | 023,034,504 | —- | M] (SUPERAntiSpyware.com) – C:\Users\kafura\Desktop\SUPERAntiSpyware.exe
[2013/01/01 19:25:19 | 000,497,009 | —- | M] (Oleg N. Scherbakov) – C:\Users\kafura\Desktop\JRT.exe
[2013/01/01 01:11:12 | 000,602,112 | —- | M] (OldTimer Tools) – C:\Users\kafura\Desktop\OTL.exe
[2012/12/31 10:06:05 | 000,000,027 | —- | M] () – C:\windows\System32\drivers\etc\hosts
[2012/12/31 09:39:41 | 000,126,976 | —- | M] () – C:\Users\kafura\Desktop\ResetTeaTimer.exe
[2012/12/29 20:06:34 | 000,688,992 | R— | M] (Swearware) – C:\Users\kafura\Desktop\dds.com
[2012/12/29 12:50:31 | 000,002,969 | —- | M] () – C:\Users\kafura\Desktop\HiJackThis.lnk
[2012/12/29 11:35:19 | 000,093,640 | —- | M] (Oracle Corporation) – C:\windows\System32\WindowsAccessBridge.dll
[2012/12/29 11:35:18 | 000,859,072 | —- | M] (Oracle Corporation) – C:\windows\System32\npDeployJava1.dll
[2012/12/29 11:35:18 | 000,779,704 | —- | M] (Oracle Corporation) – C:\windows\System32\deployJava1.dll
[2012/12/29 11:35:18 | 000,260,528 | —- | M] (Oracle Corporation) – C:\windows\System32\javaws.exe
[2012/12/29 11:35:18 | 000,174,000 | —- | M] (Oracle Corporation) – C:\windows\System32\javaw.exe
[2012/12/29 11:35:18 | 000,173,992 | —- | M] (Oracle Corporation) – C:\windows\System32\java.exe

========== Files Created - No Company Name ==========

[2013/01/16 12:31:21 | 000,000,912 | —- | C] () – C:\windows\tasks\GoogleUpdateTaskUserS-1-5-21-1004960883-3848976763-1364486711-1000UA.job
[2013/01/16 12:31:16 | 000,000,860 | —- | C] () – C:\windows\tasks\GoogleUpdateTaskUserS-1-5-21-1004960883-3848976763-1364486711-1000Core.job
[2013/01/09 19:34:14 | 000,014,219 | —- | C] () – C:\Users\kafura\Desktop\MSDS Xylol.pdf
[2013/01/08 18:32:18 | 000,001,092 | —- | C] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
[2013/01/08 18:32:18 | 000,001,080 | —- | C] () – C:\Users\Public\Desktop\Mozilla Firefox.lnk
[2013/01/07 20:58:59 | 000,139,264 | —- | C] () – C:\Users\kafura\Desktop\SystemLook.exe
[2013/01/06 14:01:31 | 000,002,210 | —- | C] () – C:\Users\Public\Desktop\Google Chrome.lnk
[2013/01/06 14:01:31 | 000,002,194 | —- | C] () – C:\Users\kafura\Application Data\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk
[2013/01/06 13:54:15 | 000,000,886 | —- | C] () – C:\windows\tasks\GoogleUpdateTaskMachineUA.job
[2013/01/06 13:54:12 | 000,000,882 | —- | C] () – C:\windows\tasks\GoogleUpdateTaskMachineCore.job
[2013/01/06 13:53:46 | 000,001,936 | —- | C] () – C:\Users\Public\Desktop\SUPERAntiSpyware Free Edition.lnk
[2012/12/31 09:53:59 | 000,256,000 | —- | C] () – C:\windows\PEV.exe
[2012/12/31 09:53:59 | 000,208,896 | —- | C] () – C:\windows\MBR.exe
[2012/12/31 09:53:59 | 000,098,816 | —- | C] () – C:\windows\sed.exe
[2012/12/31 09:53:59 | 000,080,412 | —- | C] () – C:\windows\grep.exe
[2012/12/31 09:53:59 | 000,068,096 | —- | C] () – C:\windows\zip.exe
[2012/12/31 09:39:39 | 000,126,976 | —- | C] () – C:\Users\kafura\Desktop\ResetTeaTimer.exe
[2012/12/29 12:50:31 | 000,002,969 | —- | C] () – C:\Users\kafura\Desktop\HiJackThis.lnk
[2012/08/31 16:44:53 | 000,000,000 | —- | C] () – C:\windows\MSREGUSR.INI
[2012/07/04 11:23:28 | 000,173,074 | —- | C] () – C:\windows\hpoins46.dat
[2012/07/04 11:23:28 | 000,000,601 | —- | C] () – C:\windows\hpomdl46.dat
[2012/01/18 06:44:00 | 010,920,984 | —- | C] () – C:\windows\System32\LogiDPP.dll
[2012/01/18 06:44:00 | 000,336,408 | —- | C] () – C:\windows\System32\DevManagerCore.dll
[2012/01/18 06:44:00 | 000,104,472 | —- | C] () – C:\windows\System32\LogiDPPApp.exe
[2011/08/12 12:20:14 | 000,015,896 | —- | C] () – C:\windows\System32\drivers\iKeyLFT2.dll
[2011/07/26 06:48:54 | 000,028,418 | —- | C] () – C:\windows\System32\lvcoinst.ini
[2010/03/14 20:03:04 | 000,271,673 | —- | C] () – C:\Users\kafura\skywest quiz.mht
[2009/12/25 23:03:29 | 000,008,416 | —- | C] () – C:\Users\kafura\AppData\Roaming\UserTile.png

========== ZeroAccess Check ==========

[2009/07/13 22:42:31 | 000,000,227 | RHS- | M] () – C:\windows\assembly\Desktop.ini

[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shell32.dll – [2012/06/08 22:41:00 | 012,873,728 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\system32\wbem\fastprox.dll – [2010/11/20 06:19:02 | 000,606,208 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Free

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]
"" = %systemroot%\system32\wbem\wbemess.dll – [2009/07/13 19:16:17 | 000,342,528 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Both

========== LOP Check ==========

[2012/02/25 10:32:49 | 000,000,000 | —D | M] – C:\Users\kafura\AppData\Roaming\Astro Gemini Software
[2012/10/07 15:38:50 | 000,000,000 | —D | M] – C:\Users\kafura\AppData\Roaming\AVG2013
[2012/04/08 11:16:04 | 000,000,000 | —D | M] – C:\Users\kafura\AppData\Roaming\Blackberry Desktop
[2010/02/24 15:32:19 | 000,000,000 | —D | M] – C:\Users\kafura\AppData\Roaming\DreamDale
[2010/03/08 17:52:52 | 000,000,000 | —D | M] – C:\Users\kafura\AppData\Roaming\Facebook
[2010/04/22 21:46:42 | 000,000,000 | —D | M] – C:\Users\kafura\AppData\Roaming\InfraRecorder
[2010/04/13 19:37:22 | 000,000,000 | —D | M] – C:\Users\kafura\AppData\Roaming\Leader Technologies
[2010/04/13 11:57:48 | 000,000,000 | —D | M] – C:\Users\kafura\AppData\Roaming\Leadertech
[2010/02/24 15:19:57 | 000,000,000 | —D | M] – C:\Users\kafura\AppData\Roaming\MB3
[2010/02/13 17:06:23 | 000,000,000 | —D | M] – C:\Users\kafura\AppData\Roaming\OpenOffice.org
[2010/01/27 01:44:02 | 000,000,000 | —D | M] – C:\Users\kafura\AppData\Roaming\PlayFirst
[2010/03/21 19:39:59 | 000,000,000 | —D | M] – C:\Users\kafura\AppData\Roaming\Playrix Entertainment
[2012/04/08 11:00:46 | 000,000,000 | —D | M] – C:\Users\kafura\AppData\Roaming\Research In Motion
[2010/02/24 15:08:26 | 000,000,000 | —D | M] – C:\Users\kafura\AppData\Roaming\SmashFrenzy3
[2013/01/17 20:59:06 | 000,000,000 | —D | M] – C:\Users\kafura\AppData\Roaming\Spotify
[2010/02/26 00:26:56 | 000,000,000 | —D | M] – C:\Users\kafura\AppData\Roaming\Teleca
[2012/10/07 15:38:25 | 000,000,000 | —D | M] – C:\Users\kafura\AppData\Roaming\TuneUp Software
[2010/04/22 21:40:30 | 000,000,000 | —D | M] – C:\Users\kafura\AppData\Roaming\WeatherBug
[2009/12/25 00:11:17 | 000,000,000 | —D | M] – C:\Users\kafura\AppData\Roaming\WinBatch

========== Purity Check ==========



< End of report >

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI