tnt2user.exe [Solved]

When I open IE I get a notification that tnt2user wants to run. I never allow it but I don't know how to get rid of it. I'm running windows 7 I have ie version 9.0.8112.16421.

OTL logfile created on: 1/3/2013 10:15:03 AM - Run 1
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\Nancy\Downloads
64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

7.91 Gb Total Physical Memory | 4.52 Gb Available Physical Memory | 57.08% Memory free
15.82 Gb Paging File | 12.13 Gb Available in Paging File | 76.67% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 279.45 Gb Total Space | 65.31 Gb Free Space | 23.37% Space Free | Partition Type: NTFS
Drive D: | 394.18 Gb Total Space | 394.08 Gb Free Space | 99.97% Space Free | Partition Type: NTFS
Drive G: | 1863.01 Gb Total Space | 1150.51 Gb Free Space | 61.76% Space Free | Partition Type: NTFS

Computer Name: NANCY-PC | User Name: Nancy | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Users\Nancy\Downloads\OTL.exe (OldTimer Tools)
PRC - C:\Program Files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe (Apple Inc.)
PRC - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation)
PRC - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
PRC - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe (Malwarebytes Corporation)
PRC - C:\Program Files (x86)\Siber Systems\AI RoboForm\robotaskbaricon.exe (Siber Systems)
PRC - C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_5_502_135.exe (Adobe Systems, Inc.)
PRC - C:\Windows\SysWOW64\Macromed\Flash\FlashUtil32_11_5_502_135_ActiveX.exe (Adobe Systems Incorporated)
PRC - C:\Program Files (x86)\Evernote\Evernote\EvernoteClipper.exe (Evernote Corp., 333 W Evelyn Ave. Mountain View, CA 94041)
PRC - C:\Program Files (x86)\Evernote\Evernote\Evernote.exe (Evernote Corp., 333 W Evelyn Ave. Mountain View, CA 94041)
PRC - C:\Program Files (x86)\Evernote\Evernote\EvernoteTray.exe (Evernote Corp., 333 W Evelyn Ave. Mountain View, CA 94041)
PRC - C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation)
PRC - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
PRC - C:\Windows\AsScrPro.exe (ASUS)
PRC - C:\Program Files (x86)\AWS\WeatherBug\Weather.exe (AWS Convergence Technologies, Inc.)
PRC - C:\Program Files (x86)\ASUS\Wireless Console 3\wcourier.exe (ASUS)
PRC - C:\Program Files (x86)\ASUS\Splendid\ACMON.exe (ASUS)
PRC - C:\Program Files (x86)\Intel\Bluetooth\obexsrv.exe (Intel Corporation)
PRC - C:\Program Files (x86)\Intel\Bluetooth\mediasrv.exe (Intel Corporation)
PRC - C:\Program Files (x86)\Intel\Bluetooth\devmonsrv.exe (Intel Corporation)
PRC - C:\Program Files (x86)\Intel\Bluetooth\btplayerctrl.exe (Intel Corporation)
PRC - C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControl.exe (ASUS)
PRC - C:\Program Files (x86)\ASUS\SmartLogon\sensorsrv.exe (ASUS)
PRC - C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe (ASUS)
PRC - C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe (CyberLink)
PRC - C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe (ASUS)
PRC - C:\Program Files (x86)\ASUS\Sonic Focus\SonicFocusTray.exe (Virage Logic Corporation / Sonic Focus)
PRC - C:\Program Files (x86)\Lexmark 3600-4600 Series\lxdxmsdmon.exe ()
PRC - C:\Program Files (x86)\Lexmark 3600-4600 Series\lxdxmon.exe ()
PRC - C:\Program Files (x86)\ASUS\ATK Package\ATKGFNEX\GFNEXSrv.exe (ASUS)
PRC - C:\Program Files (x86)\Adobe\Elements Organizer 8.0\ElementsOrganizerSyncAgent.exe (Adobe Systems Incorporated)
PRC - C:\Program Files (x86)\Adobe\Elements Organizer 8.0\PhotoshopElementsFileAgent.exe (Adobe Systems Incorporated)
PRC - C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControlUser.exe (ASUS)
PRC - C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\ATKOSD.exe (ASUS)
PRC - C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\AsLdrSrv.exe (ASUS)
PRC - C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin (OpenOffice.org)
PRC - C:\Program Files (x86)\OpenOffice.org 3\program\soffice.exe (OpenOffice.org)
PRC - C:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe (Safer Networking Ltd.)
PRC - C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\WDC.exe (ASUS)
PRC - C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\KBFiltr.exe (ASUS)
PRC - C:\Program Files (x86)\ASUS\ASUS Live Update\ALU.exe ()
PRC - C:\Program Files (x86)\Pinnacle\Shared Files\Programs\USBTip\USBTip.exe (Pinnacle Systems GmbH)


========== Modules (No Company Name) ==========

MOD - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_5_502_135.dll ()
MOD - C:\Program Files (x86)\Mozilla Firefox\mozjs.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\d040079bc7148afeca03c5abb6fc3c61\System.Windows.Forms.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\4e80768a2d88c7a333e43cbb7a6c0705\System.Drawing.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Xml\25e672ea505e50ab058258ac72a54f02\System.Xml.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Configuration\c64ca3678261c8ffcd9e7efd1af6ed54\System.Configuration.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System\9dd758ac0bf7358ac6e4720610fcc63c\System.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\187d7c66735c533de851c76384f86912\mscorlib.ni.dll ()
MOD - C:\Program Files (x86)\Evernote\Evernote\libxml2.dll ()
MOD - C:\Program Files (x86)\Evernote\Evernote\libtidy.dll ()
MOD - C:\Program Files (x86)\Evernote\Evernote\libcef.dll ()
MOD - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll ()
MOD - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll ()
MOD - C:\Program Files (x86)\ASUS\Wireless Console 3\acAuth.dll ()
MOD - C:\Program Files (x86)\ASUS\Splendid\GLCDdll.dll ()
MOD - C:\Program Files (x86)\CyberLink\Power2Go\CLMediaLibrary.dll ()
MOD - C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvcPS.dll ()
MOD - C:\Program Files (x86)\Lexmark 3600-4600 Series\lxdxmsdmon.exe ()
MOD - C:\Program Files (x86)\Lexmark 3600-4600 Series\lxdxmon.exe ()
MOD - C:\Program Files (x86)\Lexmark 3600-4600 Series\lxdxcaps.dll ()
MOD - C:\Program Files (x86)\Lexmark 3600-4600 Series\lxdxscw.dll ()
MOD - C:\Program Files (x86)\Lexmark 3600-4600 Series\lxdxdrs.dll ()
MOD - C:\Program Files (x86)\Lexmark 3600-4600 Series\lxdxcnv4.dll ()
MOD - C:\Program Files (x86)\Lexmark 3600-4600 Series\app4r.monitor.core.dll ()
MOD - C:\Program Files (x86)\Lexmark 3600-4600 Series\app4r.monitor.common.dll ()
MOD - C:\Program Files (x86)\Lexmark 3600-4600 Series\app4r.devmons.mcmdevmon.dll ()
MOD - C:\Program Files (x86)\Lexmark 3600-4600 Series\lxdxdatr.dll ()
MOD - C:\Program Files (x86)\Lexmark 3600-4600 Series\lxdxcats.dll ()
MOD - C:\Program Files (x86)\Adobe\Elements Organizer 8.0\AdobeXMPFiles.dll ()
MOD - C:\Program Files (x86)\Adobe\Elements Organizer 8.0\AdobeXMP.dll ()
MOD - C:\Program Files (x86)\OpenOffice.org 3\program\libxml2.dll ()
MOD - C:\Program Files (x86)\ASUS\ASUS Live Update\ALU.exe ()
MOD - C:\Program Files (x86)\Lexmark 3600-4600 Series\app4r.devmons.mcmdevmon.autoplayutil.dll ()


========== Services (SafeList) ==========

SRV:64bit: - (NisSrv) – C:\Program Files\Microsoft Security Client\NisSrv.exe (Microsoft Corporation)
SRV:64bit: - (MsMpSvc) – C:\Program Files\Microsoft Security Client\MsMpEng.exe (Microsoft Corporation)
SRV:64bit: - (GsServer) – C:\Program Files\Siber Systems\GoodSync\Gs-Server.exe ()
SRV:64bit: - (EvtEng) – C:\Program Files\Intel\WiFi\bin\EvtEng.exe (Intel® Corporation)
SRV:64bit: - (MyWiFiDHCPDNS) – C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe ()
SRV:64bit: - (RegSrvc) – C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe (Intel® Corporation)
SRV:64bit: - (AMPPALR3) – C:\Program Files\Intel\BluetoothHS\BTHSAmpPalService.exe (Intel Corporation)
SRV:64bit: - (AFBAgent) – C:\Windows\SysNative\FBAgent.exe (ASUSTeK Computer Inc.)
SRV:64bit: - (BTHSSecurityMgr) – C:\Program Files\Intel\BluetoothHS\BTHSSecurityMgr.exe (Intel® Corporation)
SRV:64bit: - (wlcrasvc) – C:\Program Files\Windows Live\Mesh\wlcrasvc.exe (Microsoft Corporation)
SRV:64bit: - (TurboBoost) – C:\Program Files\Intel\TurboBoost\TurboBoost.exe (Intel® Corporation)
SRV:64bit: - (lxdx_device) – C:\Windows\SysNative\lxdxcoms.exe ( )
SRV:64bit: - (lxdxCATSCustConnectService) – C:\Windows\SysNative\spool\DRIVERS\x64\3\\lxdxserv.exe ()
SRV:64bit: - (WinDefend) – C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)
SRV - (MBAMService) – C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation)
SRV - (MBAMScheduler) – C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe (Malwarebytes Corporation)
SRV - (AdobeFlashPlayerUpdateSvc) – C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe (Adobe Systems Incorporated)
SRV - (MozillaMaintenance) – C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe (Mozilla Foundation)
SRV - (FLEXnet Licensing Service) – C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe (Acresso Software Inc.)
SRV - (cphs) – C:\Windows\SysWOW64\IntelCpHeciSvc.exe (Intel Corporation)
SRV - (Bluetooth OBEX Service) – C:\Program Files (x86)\Intel\Bluetooth\obexsrv.exe (Intel Corporation)
SRV - (Bluetooth Media Service) – C:\Program Files (x86)\Intel\Bluetooth\mediasrv.exe (Intel Corporation)
SRV - (Bluetooth Device Monitor) – C:\Program Files (x86)\Intel\Bluetooth\devmonsrv.exe (Intel Corporation)
SRV - (clr_optimization_v4.0.30319_32) – C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (Microsoft Corporation)
SRV - (ATKGFNEXSrv) – C:\Program Files (x86)\ASUS\ATK Package\ATKGFNEX\GFNEXSrv.exe (ASUS)
SRV - (lxdx_device) – C:\Windows\SysWOW64\lxdxcoms.exe ( )
SRV - (lxdxCATSCustConnectService) – C:\Windows\system32\spool\DRIVERS\x64\3\\lxdxserv.exe ()
SRV - (AdobeActiveFileMonitor8.0) – C:\Program Files (x86)\Adobe\Elements Organizer 8.0\PhotoshopElementsFileAgent.exe (Adobe Systems Incorporated)
SRV - (ASLDRService) – C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\AsLdrSrv.exe (ASUS)
SRV - (clr_optimization_v2.0.50727_32) – C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (Microsoft Corporation)
SRV - (PCLEPCI) – C:\Windows\SysWOW64\drivers\Pclepci.sys (Pinnacle Systems GmbH)


========== Driver Services (SafeList) ==========

DRV:64bit: - (MBAMProtector) – C:\Windows\SysNative\drivers\mbam.sys (Malwarebytes Corporation)
DRV:64bit: - (USBAAPL64) – C:\Windows\SysNative\drivers\usbaapl64.sys (Apple, Inc.)
DRV:64bit: - (NisDrv) – C:\Windows\SysNative\drivers\NisDrvWFP.sys (Microsoft Corporation)
DRV:64bit: - (GEARAspiWDM) – C:\Windows\SysNative\drivers\GEARAspiWDM.sys (GEAR Software Inc.)
DRV:64bit: - (igfx) – C:\Windows\SysNative\drivers\igdkmd64.sys (Intel Corporation)
DRV:64bit: - (Fs_Rec) – C:\Windows\SysNative\drivers\fs_rec.sys (Microsoft Corporation)
DRV:64bit: - (iBtFltCoex) – C:\Windows\SysNative\drivers\iBtFltCoex.sys (Intel Corporation)
DRV:64bit: - (btmhsf) – C:\Windows\SysNative\drivers\btmhsf.sys (Intel Corporation)
DRV:64bit: - (amdsata) – C:\Windows\SysNative\drivers\amdsata.sys (Advanced Micro Devices)
DRV:64bit: - (amdxata) – C:\Windows\SysNative\drivers\amdxata.sys (Advanced Micro Devices)
DRV:64bit: - (fssfltr) – C:\Windows\SysNative\drivers\fssfltr.sys (Microsoft Corporation)
DRV:64bit: - (NETwNs64) – C:\Windows\SysNative\drivers\NETwNs64.sys (Intel Corporation)
DRV:64bit: - (FLxHCIc) – C:\Windows\SysNative\drivers\FLxHCIc.sys (Fresco Logic)
DRV:64bit: - (FLxHCIh) – C:\Windows\SysNative\drivers\FLxHCIh.sys (Fresco Logic)
DRV:64bit: - (wdkmd) – C:\Windows\SysNative\drivers\WDKMD.sys (Intel Corporation)
DRV:64bit: - (intaud_WaveExtensible) – C:\Windows\SysNative\drivers\intelaud.sys (Intel Corporation)
DRV:64bit: - (iwdbus) – C:\Windows\SysNative\drivers\iwdbus.sys (Intel Corporation)
DRV:64bit: - (AMPPALP) – C:\Windows\SysNative\drivers\AmpPal.sys (Windows ® Win 7 DDK provider)
DRV:64bit: - (AMPPAL) – C:\Windows\SysNative\drivers\AmpPal.sys (Windows ® Win 7 DDK provider)
DRV:64bit: - (btmaux) – C:\Windows\SysNative\drivers\btmaux.sys (Intel Corporation)
DRV:64bit: - (ETD) – C:\Windows\SysNative\drivers\ETD.sys (ELAN Microelectronics Corp.)
DRV:64bit: - (HpSAMD) – C:\Windows\SysNative\drivers\HpSAMD.sys (Hewlett-Packard Company)
DRV:64bit: - (TsUsbFlt) – C:\Windows\SysNative\drivers\TsUsbFlt.sys (Microsoft Corporation)
DRV:64bit: - (TsUsbGD) – C:\Windows\SysNative\drivers\TsUsbGD.sys (Microsoft Corporation)
DRV:64bit: - (iaStor) – C:\Windows\SysNative\drivers\iaStor.sys (Intel Corporation)
DRV:64bit: - (MEIx64) – C:\Windows\SysNative\drivers\HECIx64.sys (Intel Corporation)
DRV:64bit: - (IntcDAud) – C:\Windows\SysNative\drivers\IntcDAud.sys (Intel® Corporation)
DRV:64bit: - (L1C) – C:\Windows\SysNative\drivers\L1C62x64.sys (Atheros Communications, Inc.)
DRV:64bit: - (AmUStor) – C:\Windows\SysNative\drivers\AmUStor.sys (Alcor Micro, Corp.)
DRV:64bit: - (assd) – C:\Windows\SysNative\drivers\assd.sys (ASUS Corporation)
DRV:64bit: - (TurboB) – C:\Windows\SysNative\drivers\TurboB.sys ()
DRV:64bit: - (athr) – C:\Windows\SysNative\drivers\athrx.sys (Atheros Communications, Inc.)
DRV:64bit: - (kbfiltr) – C:\Windows\SysNative\drivers\kbfiltr.sys ( )
DRV:64bit: - (amdsbs) – C:\Windows\SysNative\drivers\amdsbs.sys (AMD Technologies Inc.)
DRV:64bit: - (LSI_SAS2) – C:\Windows\SysNative\drivers\lsi_sas2.sys (LSI Corporation)
DRV:64bit: - (stexstor) – C:\Windows\SysNative\drivers\stexstor.sys (Promise Technology)
DRV:64bit: - (WSDPrintDevice) – C:\Windows\SysNative\drivers\WSDPrint.sys (Microsoft Corporation)
DRV:64bit: - (TPM) – C:\Windows\SysNative\drivers\tpm.sys (Microsoft Corporation)
DRV:64bit: - (SiSGbeLH) – C:\Windows\SysNative\drivers\SiSG664.sys (Silicon Integrated Systems Corp.)
DRV:64bit: - (ebdrv) – C:\Windows\SysNative\drivers\evbda.sys (Broadcom Corporation)
DRV:64bit: - (b06bdrv) – C:\Windows\SysNative\drivers\bxvbda.sys (Broadcom Corporation)
DRV:64bit: - (b57nd60a) – C:\Windows\SysNative\drivers\b57nd60a.sys (Broadcom Corporation)
DRV:64bit: - (hcw85cir) – C:\Windows\SysNative\drivers\hcw85cir.sys (Hauppauge Computer Works, Inc.)
DRV:64bit: - (PxHlpa64) – C:\Windows\SysNative\drivers\PxHlpa64.sys (Sonic Solutions)
DRV:64bit: - (WimFltr) – C:\Windows\SysNative\drivers\WimFltr.sys (Microsoft Corporation)
DRV:64bit: - (emAudio) – C:\Windows\SysNative\drivers\emAudio64.sys (eMPIA Technology, Inc.)
DRV:64bit: - (DCamUSBEMPIA) – C:\Windows\SysNative\drivers\emDevice64.sys (eMPIA Technology, Inc.)
DRV:64bit: - (FiltUSBEMPIA) – C:\Windows\SysNative\drivers\emFilter64.sys (eMPIA Technology, Inc.)
DRV:64bit: - (ScanUSBEMPIA) – C:\Windows\SysNative\drivers\emScan64.sys (eMPIA Technology, Inc.)
DRV:64bit: - (MarvinBus) – C:\Windows\SysNative\drivers\MarvinBus64.sys (Pinnacle Systems GmbH)
DRV - (ATKWMIACPIIO) – C:\Program Files (x86)\ASUS\ATK Package\ATK WMIACPI\atkwmiacpi64.sys (ASUS)
DRV - (WIMMount) – C:\Windows\SysWOW64\drivers\wimmount.sys (Microsoft Corporation)
DRV - (ASMMAP64) – C:\Program Files (x86)\ASUS\ATK Package\ATKGFNEX\ASMMAP64.sys (ASUS)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a;…ion&pf;=cnnb
IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a;…ion&pf;=cnnb
IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {ED0275C3-393C-4615-8D5D-9BEA168DACEB}
IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}…rc=IE-SearchBox
IE:64bit: - HKLM\..\SearchScopes\{9BE31423-EADD-4A53-9854-98AE3D47B026}: "URL" = http://www.ask.com/web?q={searchterms}&l;=dis&o;=ushpl
IE:64bit: - HKLM\..\SearchScopes\{ED0275C3-393C-4615-8D5D-9BEA168DACEB}: "URL" = http://search.yahoo.com/search?p={searchTe…&fr;=hp-pvnb
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://asus.msn.com
IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}…rc=IE-SearchBox

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a;…ion&pf;=cnnb
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = http://feed.snap.do/?publisher=SnapdoEMon&…q={searchTerms}
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://feed.snap.do/?publisher=SnapdoEMon&…q={searchTerms}
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://feed.snap.do/?publisher=SnapdoEMon&…p;searchtype=hp
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Restore = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a;…ion&pf;=cnnb
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = http://feed.snap.do/?publisher=SnapdoEMon&…q={searchTerms}
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://feed.snap.do/?publisher=SnapdoEMon&…q={searchTerms}
IE - HKCU\..\URLSearchHook: - No CLSID value found
IE - HKCU\..\SearchScopes,DefaultScope = {006ee092-9658-4fd6-bd8e-a21a348e59f5}
IE - HKCU\..\SearchScopes\{006ee092-9658-4fd6-bd8e-a21a348e59f5}: "URL" = http://feed.snap.do/?publisher=SnapdoEMon&…q={searchTerms}
IE - HKCU\..\SearchScopes\{44816E91-C68A-2FF3-3D8F-8970062E5600}: "URL" = http://www.bing.com/search?q={searchTerms}…amp;form=ZGAIDF
IE - HKCU\..\SearchScopes\{5FAE818A-DACF-4AE8-BC0C-2089B2FB72FC}: "URL" = http://websearch.ask.com/redirect?client=i…25-A9218B00811B
IE - HKCU\..\SearchScopes\{9BE31423-EADD-4A53-9854-98AE3D47B026}: "URL" = http://www.ask.com/web?q={searchterms}&l;=dis&o;=ushpl
IE - HKCU\..\SearchScopes\{ED0275C3-393C-4615-8D5D-9BEA168DACEB}: "URL" = http://search.yahoo.com/search?p={searchTe…&fr;=hp-pvnb
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

========== FireFox ==========

FF - prefs.js..browser.search.defaultengine: "Ask.com"
FF - prefs.js..browser.search.defaultenginename: "My Web Search"
FF - prefs.js..browser.search.defaultthis.engineName: "Swag Bucks Customized Web Search"
FF - prefs.js..browser.search.defaulturl: "http://search.conduit.com/ResultsExt.aspx?ctid=CT2260173&SearchSource;=3&q;={searchTerms}"
FF - prefs.js..browser.search.order.1: "Ask.com"
FF - prefs.js..browser.search.selectedEngine: "Swag Bucks Customized Web Search"
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "http://us-mg4.mail.yahoo.com/neo/launch?.rand=26gi0q9rci4qq"
FF - prefs.js..extensions.enabledAddons: coralietab%40mozdev.org:2.04.20110724
FF - prefs.js..extensions.enabledAddons: readable%40evernote.com:7.3346.272.999
FF - prefs.js..extensions.enabledAddons: %7B097d3191-e6fa-4728-9826-b533d755359d%7D:0.7.18
FF - prefs.js..extensions.enabledAddons: %7B3e0e7d2a-070f-4a47-b019-91fe5385ba79%7D:3.5.9
FF - prefs.js..extensions.enabledAddons: %7Bb9db16a4-6edc-47ec-a1f4-b86292ed211d%7D:4.9.12
FF - prefs.js..extensions.enabledAddons: %7BE0B8C461-F8FB-49b4-8373-FE32E9252800%7D:5.4
FF - prefs.js..extensions.enabledAddons: %7BDAD0F81A-CF67-4eed-98D6-26F6E47274CA%7D:1.5.5
FF - prefs.js..extensions.enabledAddons: %7B73a6fe31-595d-460b-a920-fcc0f8843232%7D:[removed]
FF - prefs.js..extensions.enabledAddons: infoatoms%40infoatoms.com:1.5.0.0
FF - prefs.js..extensions.enabledAddons: %7B972ce4c6-7e08-4474-a285-3208198ce6fd%7D:17.0.1
FF - prefs.js..keyword.URL: "http://search.mywebsearch.com/mywebsearch/GGmain.jhtml?st=kwd&ptb;=7CDECB22-5BC9-4D82-B776-089F52FF5B93&n;=77ee89a9&ind;=2012121513&p2;=^YK^xdm149^YY^us&si;=455002&searchfor;="


FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_5_502_135.dll File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files\Microsoft Silverlight\5.1.10411.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_5_502_135.dll ()
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.7.2: C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.9.2: C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files (x86)\Microsoft Silverlight\5.1.10411.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3538.0513: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\ZEON/PDF,version=2.0: C:\Program Files (x86)\Nuance\PDF Reader\bin\nppdf.dll (Zeon Corporation)
FF - HKCU\Software\MozillaPlugins\@tightropeinteractive.com/Plugin: C:\Users\Nancy\AppData\Local\TNT2\2.0.0.1378\npTNT2.dll (Freshy.com)
FF - HKCU\Software\MozillaPlugins\@tnt2ghost.com/Plugin: C:\Users\Nancy\AppData\Local\TNT2\2.0.0.1378\npTNT2ghost.dll (Freshy.com)
FF - HKCU\Software\MozillaPlugins\@tnt2toolbar.com/Plugin: C:\Users\Nancy\AppData\Local\TNT2\2.0.0.1267\npTNT2.dll (Freshy.com)
FF - HKCU\Software\MozillaPlugins\amazon.com/AmazonMP3DownloaderPlugin: C:\Program Files (x86)\Amazon\MP3 Downloader\npAmazonMP3DownloaderPlugin1017300.dll (Amazon.com, Inc.)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\extensions\\{22119944-ED35-4ab1-910B-E619EA06A115}: C:\Program Files (x86)\Siber Systems\AI RoboForm\Firefox [2012/12/14 06:34:08 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\extensions\\[removed]: C:\Program Files (x86)\Mozilla Firefox\extensions\[removed] [2012/12/31 07:57:36 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 17.0.1\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012/12/01 08:34:52 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 17.0.1\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2012/12/29 11:52:12 | 000,000,000 | —D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 17.0.1\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012/12/01 08:34:52 | 000,000,000 | —D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 17.0.1\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2012/12/29 11:52:12 | 000,000,000 | —D | M]

[2012/01/28 13:40:33 | 000,000,000 | —D | M] (No name found) – C:\Users\Nancy\AppData\Roaming\Mozilla\Extensions
[2012/12/31 09:44:55 | 000,000,000 | —D | M] (No name found) – C:\Users\Nancy\AppData\Roaming\Mozilla\Firefox\Profiles\pqxe4c84.default\extensions
[2012/08/28 10:29:36 | 000,000,000 | —D | M] (AddThis) – C:\Users\Nancy\AppData\Roaming\Mozilla\Firefox\Profiles\pqxe4c84.default\extensions\{3e0e7d2a-070f-4a47-b019-91fe5385ba79}
[2012/11/22 05:32:06 | 000,000,000 | —D | M] (DownloadHelper) – C:\Users\Nancy\AppData\Roaming\Mozilla\Firefox\Profiles\pqxe4c84.default\extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}
[2012/10/02 15:51:15 | 000,000,000 | —D | M] (Evernote Web Clipper) – C:\Users\Nancy\AppData\Roaming\Mozilla\Firefox\Profiles\pqxe4c84.default\extensions\{E0B8C461-F8FB-49b4-8373-FE32E9252800}
[2012/01/29 05:41:47 | 000,000,000 | —D | M] (IE Tab +) – C:\Users\Nancy\AppData\Roaming\Mozilla\Firefox\Profiles\pqxe4c84.default\extensions\[removed]
[2012/10/06 12:20:09 | 001,088,515 | —- | M] () (No name found) – C:\Users\Nancy\AppData\Roaming\Mozilla\Firefox\Profiles\pqxe4c84.default\extensions\[removed]
[2012/08/27 06:45:46 | 000,455,379 | —- | M] () (No name found) – C:\Users\Nancy\AppData\Roaming\Mozilla\Firefox\Profiles\pqxe4c84.default\extensions\{097d3191-e6fa-4728-9826-b533d755359d}.xpi
[2012/04/29 07:22:27 | 000,097,169 | —- | M] () (No name found) – C:\Users\Nancy\AppData\Roaming\Mozilla\Firefox\Profiles\pqxe4c84.default\extensions\{3d7eb24f-2740-49df-8937-200b1cc08f8a}.xpi
[2012/12/27 17:34:45 | 000,533,036 | —- | M] () (No name found) – C:\Users\Nancy\AppData\Roaming\Mozilla\Firefox\Profiles\pqxe4c84.default\extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi
[2012/11/30 17:03:28 | 000,014,082 | —- | M] () (No name found) – C:\Users\Nancy\AppData\Roaming\Mozilla\Firefox\Profiles\pqxe4c84.default\extensions\{DAD0F81A-CF67-4eed-98D6-26F6E47274CA}.xpi
[2012/10/27 07:06:24 | 001,070,903 | —- | M] () (No name found) – C:\Users\Nancy\AppData\Roaming\Mozilla\Firefox\Profiles\pqxe4c84.default\extensions\{ff356687-aa08-463d-a46c-11c451824939}.xpi
[2012/07/19 06:28:38 | 000,002,345 | —- | M] () – C:\Users\Nancy\AppData\Roaming\Mozilla\Firefox\Profiles\pqxe4c84.default\searchplugins\askcom.xml
[2012/02/02 17:29:30 | 000,000,923 | —- | M] () – C:\Users\Nancy\AppData\Roaming\Mozilla\Firefox\Profiles\pqxe4c84.default\searchplugins\conduit.xml
[2012/12/31 07:57:36 | 000,000,000 | —D | M] (No name found) – C:\Program Files (x86)\Mozilla Firefox\extensions
[2012/12/31 07:57:36 | 000,000,000 | —D | M] (InfoAtoms) – C:\Program Files (x86)\Mozilla Firefox\extensions\[removed]
[2012/12/01 08:34:52 | 000,262,112 | —- | M] (Mozilla Foundation) – C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll
[2012/02/24 06:15:52 | 000,466,944 | —- | M] (Catalina Marketing Corporation) – C:\Program Files (x86)\mozilla firefox\plugins\NPcol400.dll
[2011/03/18 14:32:12 | 000,091,552 | —- | M] (Coupons, Inc.) – C:\Program Files (x86)\mozilla firefox\plugins\npCouponPrinter.dll
[2011/03/18 14:32:14 | 000,091,552 | —- | M] (Coupons, Inc.) – C:\Program Files (x86)\mozilla firefox\plugins\npMozCouponPrinter.dll
[2012/08/30 03:59:07 | 000,002,465 | —- | M] () – C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml
[2012/10/12 13:22:58 | 000,002,058 | —- | M] () – C:\Program Files (x86)\mozilla firefox\searchplugins\twitter.xml

O1 HOSTS File: ([2012/12/31 11:24:43 | 000,445,037 | R— | M]) - C:\Windows\SysNative\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 www.007guard.com
O1 - Hosts: 127.0.0.1 007guard.com
O1 - Hosts: 127.0.0.1 008i.com
O1 - Hosts: 127.0.0.1 www.008k.com
O1 - Hosts: 127.0.0.1 008k.com
O1 - Hosts: 127.0.0.1 www.00hq.com
O1 - Hosts: 127.0.0.1 00hq.com
O1 - Hosts: 127.0.0.1 010402.com
O1 - Hosts: 127.0.0.1 www.032439.com
O1 - Hosts: 127.0.0.1 032439.com
O1 - Hosts: 127.0.0.1 www.0scan.com
O1 - Hosts: 127.0.0.1 0scan.com
O1 - Hosts: 127.0.0.1 www.1000gratisproben.com
O1 - Hosts: 127.0.0.1 1000gratisproben.com
O1 - Hosts: 127.0.0.1 1001namen.com
O1 - Hosts: 127.0.0.1 www.1001namen.com
O1 - Hosts: 127.0.0.1 100888290cs.com
O1 - Hosts: 127.0.0.1 www.100888290cs.com
O1 - Hosts: 127.0.0.1 www.100sexlinks.com
O1 - Hosts: 127.0.0.1 100sexlinks.com
O1 - Hosts: 127.0.0.1 www.10sek.com
O1 - Hosts: 127.0.0.1 10sek.com
O1 - Hosts: 127.0.0.1 www.1-2005-search.com
O1 - Hosts: 127.0.0.1 1-2005-search.com
O1 - Hosts: 127.0.0.1 www.123fporn.info
O1 - Hosts: 15284 more lines…
O2:64bit: - BHO: (RoboForm Toolbar Helper) - {724d43a9-0d85-11d4-9908-00400523e39a} - C:\Program Files (x86)\Siber Systems\AI RoboForm\roboform-x64.dll (Siber Systems Inc.)
O2 - BHO: (AcroIEHlprObj Class) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files (x86)\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (InfoAtoms) - {103089DA-0F31-4A8B-843F-7D24A7FE8345} - C:\Program Files (x86)\InfoAtoms\IE32\InfoAtomsClientIE.dll (InfoAtoms Inc.)
O2 - BHO: (Spybot-S&D; IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files (x86)\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O2 - BHO: (RoboForm Toolbar Helper) - {724d43a9-0d85-11d4-9908-00400523e39a} - C:\Program Files (x86)\Siber Systems\AI RoboForm\roboform.dll (Siber Systems Inc.)
O2 - BHO: (Java™ Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
O2 - BHO: (Java™ Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O3:64bit: - HKLM\..\Toolbar: (&RoboForm; Toolbar) - {724d43a0-0d85-11d4-9908-00400523e39a} - C:\Program Files (x86)\Siber Systems\AI RoboForm\roboform-x64.dll (Siber Systems Inc.)
O3:64bit: - HKLM\..\Toolbar: (no name) - {D6BAE600-1E87-4E36-9327-03A07808E7ED} - No CLSID value found.
O3:64bit: - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3 - HKLM\..\Toolbar: (&RoboForm; Toolbar) - {724d43a0-0d85-11d4-9908-00400523e39a} - C:\Program Files (x86)\Siber Systems\AI RoboForm\roboform.dll (Siber Systems Inc.)
O3 - HKLM\..\Toolbar: (no name) - {D6BAE600-1E87-4E36-9327-03A07808E7ED} - No CLSID value found.
O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {1017A80C-6F09-4548-A84D-EDD6AC9525F0} - No CLSID value found.
O3:64bit: - HKCU\..\Toolbar\WebBrowser: (&RoboForm; Toolbar) - {724D43A0-0D85-11D4-9908-00400523E39A} - C:\Program Files (x86)\Siber Systems\AI RoboForm\roboform-x64.dll (Siber Systems Inc.)
O3 - HKCU\..\Toolbar\WebBrowser: (&RoboForm; Toolbar) - {724D43A0-0D85-11D4-9908-00400523E39A} - C:\Program Files (x86)\Siber Systems\AI RoboForm\roboform.dll (Siber Systems Inc.)
O3:HKU - HKCU\..\Toolbar\WebBrowser: (m OpenOffice.us Search.us.com Toolbar) - {D6BAE600-1E87-4E36-9327-03A07808E7ED} - C:\Users\Nancy\AppData\Local\TNT2\Profiles\10285\passport.dll (Freshy.com)
O4:64bit: - HKLM..\Run: [AmIcoSinglun64] C:\Program Files (x86)\AmIcoSingLun\AmIcoSinglun64.exe (Alcor Micro Corp.)
O4:64bit: - HKLM..\Run: [BTMTrayAgent] C:\Program Files (x86)\Intel\Bluetooth\btmshell.dll (Intel Corporation)
O4:64bit: - HKLM..\Run: [ETDCtrl] C:\Program Files\Elantech\ETDCtrl.exe (ELAN Microelectronics Corp.)
O4:64bit: - HKLM..\Run: [HotKeysCmds] C:\Windows\SysNative\hkcmd.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [IgfxTray] C:\Windows\SysNative\igfxtray.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [IntelPAN] C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe (Intel® Corporation)
O4:64bit: - HKLM..\Run: [IntelTBRunOnce] wscript.exe //b //nologo "C:\Program Files\Intel\TurboBoost\RunTBGadgetOnce.vbs" File not found
O4:64bit: - HKLM..\Run: [lxdxamon] C:\Program Files (x86)\Lexmark 3600-4600 Series\lxdxamon.exe ()
O4:64bit: - HKLM..\Run: [lxdxmon.exe] C:\Program Files (x86)\Lexmark 3600-4600 Series\lxdxmon.exe ()
O4:64bit: - HKLM..\Run: [MSC] C:\Program Files\Microsoft Security Client\msseces.exe (Microsoft Corporation)
O4:64bit: - HKLM..\Run: [Persistence] C:\Windows\SysNative\igfxpers.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [RtHDVBg] C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe (Realtek Semiconductor)
O4 - HKLM..\Run: [APSDaemon] C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
O4 - HKLM..\Run: [ASUSPRP] C:\Program Files (x86)\ASUS\APRP\APRP.EXE (ASUSTek Computer Inc.)
O4 - HKLM..\Run: [ASUSWebStorage] C:\Program Files (x86)\ASUS\ASUS WebStorage\3.0.108.222\AsusWSPanel.exe (ecareme)
O4 - HKLM..\Run: [ATKMEDIA] C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe (ASUS)
O4 - HKLM..\Run: [ATKOSD2] C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe (ASUS)
O4 - HKLM..\Run: [FLxHCIm] C:\Program Files\Fresco Logic Inc\Fresco Logic USB3.0 Host Controller\host\FLxHCIm.exe (Windows ® Win 7 DDK provider)
O4 - HKLM..\Run: [HControlUser] C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControlUser.exe (ASUS)
O4 - HKLM..\Run: [Nuance PDF Reader-reminder] C:\Program Files (x86)\Nuance\PDF Reader\Ereg\Ereg.exe (Nuance Communications, Inc.)
O4 - HKLM..\Run: [PCLEUSBTip] C:\Program Files (x86)\Pinnacle\Shared Files\Programs\USBTip\USBTip.exe (Pinnacle Systems GmbH)
O4 - HKLM..\Run: [SonicMasterTray] C:\Program Files (x86)\ASUS\Sonic Focus\SonicFocusTray.exe (Virage Logic Corporation / Sonic Focus)
O4 - HKLM..\Run: [StopDefragment] Install\StopDefragment.exe File not found
O4 - HKLM..\Run: [USBToolTip] C:\Program Files (x86)\Pinnacle\Shared Files\Programs\USBTip\USBTip.exe (Pinnacle Systems GmbH)
O4 - HKLM..\Run: [Wireless Console 3] C:\Program Files (x86)\ASUS\Wireless Console 3\wcourier.exe (ASUS)
O4 - HKCU..\Run: [DW7] C:\Program Files (x86)\The Weather Channel\The Weather Channel App\TWCApp.exe (The Weather Channel)
O4 - HKCU..\Run: [LaunchList] C:\Program Files (x86)\Pinnacle\Studio 11\LaunchList2.exe (Pinnacle Systems)
O4 - HKCU..\Run: [PhotoshopElements8SyncAgent] C:\Program Files (x86)\Adobe\Elements Organizer 8.0\ElementsOrganizerSyncAgent.exe (Adobe Systems Incorporated)
O4 - HKCU..\Run: [RoboForm] C:\Program Files (x86)\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe (Siber Systems)
O4 - HKCU..\Run: [Weather] C:\Program Files (x86)\AWS\WeatherBug\Weather.exe (AWS Convergence Technologies, Inc.)
O4 - Startup: C:\Users\Nancy\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\EvernoteClipper.lnk = C:\Program Files (x86)\Evernote\Evernote\EvernoteClipper.exe (Evernote Corp., 333 W Evelyn Ave. Mountain View, CA 94041)
O4 - Startup: C:\Users\Nancy\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.1.lnk = C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe ()
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Activities present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 0
O8:64bit: - Extra context menu item: Add to Evernote 4.0 - C:\Program Files (x86)\Evernote\Evernote\EvernoteIE.dll (Evernote Corp., 333 W Evelyn Ave. Mountain View, CA 94041)
O8:64bit: - Extra context menu item: Customize Menu - C:\Program Files (x86)\Siber Systems\AI RoboForm\RoboFormComCustomizeIEMenu.html ()
O8:64bit: - Extra context menu item: Fill Forms - C:\Program Files (x86)\Siber Systems\AI RoboForm\RoboFormComFillForms.html ()
O8:64bit: - Extra context menu item: Save Forms - C:\Program Files (x86)\Siber Systems\AI RoboForm\RoboFormComSavePass.html ()
O8:64bit: - Extra context menu item: Show RoboForm Toolbar - C:\Program Files (x86)\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html ()
O8 - Extra context menu item: Add to Evernote 4.0 - C:\Program Files (x86)\Evernote\Evernote\EvernoteIE.dll (Evernote Corp., 333 W Evelyn Ave. Mountain View, CA 94041)
O8 - Extra context menu item: Customize Menu - C:\Program Files (x86)\Siber Systems\AI RoboForm\RoboFormComCustomizeIEMenu.html ()
O8 - Extra context menu item: Fill Forms - C:\Program Files (x86)\Siber Systems\AI RoboForm\RoboFormComFillForms.html ()
O8 - Extra context menu item: Save Forms - C:\Program Files (x86)\Siber Systems\AI RoboForm\RoboFormComSavePass.html ()
O8 - Extra context menu item: Show RoboForm Toolbar - C:\Program Files (x86)\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html ()
O9:64bit: - Extra Button: Fill Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - C:\Program Files (x86)\Siber Systems\AI RoboForm\roboform-x64.dll (Siber Systems Inc.)
O9:64bit: - Extra 'Tools' menuitem : Fill Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - C:\Program Files (x86)\Siber Systems\AI RoboForm\roboform-x64.dll (Siber Systems Inc.)
O9:64bit: - Extra Button: Save - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - C:\Program Files (x86)\Siber Systems\AI RoboForm\roboform-x64.dll (Siber Systems Inc.)
O9:64bit: - Extra 'Tools' menuitem : Save Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - C:\Program Files (x86)\Siber Systems\AI RoboForm\roboform-x64.dll (Siber Systems Inc.)
O9:64bit: - Extra Button: Show Toolbar - {724d43aa-0d85-11d4-9908-00400523e39a} - C:\Program Files (x86)\Siber Systems\AI RoboForm\roboform-x64.dll (Siber Systems Inc.)
O9:64bit: - Extra 'Tools' menuitem : Show RoboForm Toolbar - {724d43aa-0d85-11d4-9908-00400523e39a} - C:\Program Files (x86)\Siber Systems\AI RoboForm\roboform-x64.dll (Siber Systems Inc.)
O9 - Extra Button: Fill Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - C:\Program Files (x86)\Siber Systems\AI RoboForm\roboform.dll (Siber Systems Inc.)
O9 - Extra 'Tools' menuitem : Fill Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - C:\Program Files (x86)\Siber Systems\AI RoboForm\roboform.dll (Siber Systems Inc.)
O9 - Extra Button: Save - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - C:\Program Files (x86)\Siber Systems\AI RoboForm\roboform.dll (Siber Systems Inc.)
O9 - Extra 'Tools' menuitem : Save Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - C:\Program Files (x86)\Siber Systems\AI RoboForm\roboform.dll (Siber Systems Inc.)
O9 - Extra Button: Show Toolbar - {724d43aa-0d85-11d4-9908-00400523e39a} - C:\Program Files (x86)\Siber Systems\AI RoboForm\roboform.dll (Siber Systems Inc.)
O9 - Extra 'Tools' menuitem : Show RoboForm Toolbar - {724d43aa-0d85-11d4-9908-00400523e39a} - C:\Program Files (x86)\Siber Systems\AI RoboForm\roboform.dll (Siber Systems Inc.)
O9 - Extra Button: @C:\Program Files (x86)\Evernote\Evernote\Resource.dll,-101 - {A95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\Program Files (x86)\Evernote\Evernote\EvernoteIE.dll (Evernote Corp., 333 W Evelyn Ave. Mountain View, CA 94041)
O9 - Extra 'Tools' menuitem : @C:\Program Files (x86)\Evernote\Evernote\Resource.dll,-101 - {A95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\Program Files (x86)\Evernote\Evernote\EvernoteIE.dll (Evernote Corp., 333 W Evelyn Ave. Mountain View, CA 94041)
O9 - Extra 'Tools' menuitem : Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files (x86)\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000010 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000010 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)
O1364bit: - gopher Prefix: missing
O13 - gopher Prefix: missing
O15 - HKCU\..Trusted Domains: //@surf.mar@/ ([]money in Local intranet)
O15 - HKCU\..Trusted Ranges: Range1 ([http] in Local intranet)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 10.9.2)
O16 - DPF: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_23)
O16 - DPF: {CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_31)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 10.9.2)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 10.0.1.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{4B10D4B1-8C84-4010-A352-FE33362F94A0}: DhcpNameServer = [removed] [removed]
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{EC8CE5CB-D60E-49FD-8771-2F4F07E11AC3}: DhcpNameServer = 10.0.1.1
O18:64bit: - Protocol\Handler\livecall - No CLSID value found
O18:64bit: - Protocol\Handler\msnim - No CLSID value found
O18:64bit: - Protocol\Handler\wlmailhtml - No CLSID value found
O18:64bit: - Protocol\Handler\wlpg - No CLSID value found
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\SysWow64\userinit.exe (Microsoft Corporation)
O20:64bit: - Winlogon\Notify\igfxcui: DllName - (igfxdev.dll) - C:\Windows\SysNative\igfxdev.dll (Intel Corporation)
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2013/01/01 08:08:48 | 000,000,108 | —- | M] () - C:\AUTOEXEC.BAT – [ NTFS ]
O32 - AutoRun File - [2011/04/08 04:45:04 | 000,000,000 | RH-D | M] - G:\autorun – [ NTFS ]
O32 - AutoRun File - [2002/10/16 07:56:50 | 000,000,036 | RH– | M] () - G:\autorun.inf – [ NTFS ]
O33 - MountPoints2\{b67c0438-b746-11e1-9bfb-ac72899ab4b4}\Shell - "" = AutoRun
O33 - MountPoints2\{b67c0438-b746-11e1-9bfb-ac72899ab4b4}\Shell\AutoRun\command - "" = F:\LaunchU3.exe -a
O34 - HKLM BootExecute: (autocheck autochk *)
O35:64bit: - HKLM\..comfile [open] – "%1" %*
O35:64bit: - HKLM\..exefile [open] – "%1" %*
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37:64bit: - HKLM\…com [@ = comfile] – "%1" %*
O37:64bit: - HKLM\…exe [@ = exefile] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)


Drivers32:64bit: msacm.l3acm - C:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32:64bit: VIDC.I420 - File not found
Drivers32: msacm.l3acm - C:\Windows\SysWOW64\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: vidc.cvid - C:\Windows\SysWow64\iccvid.dll (Radius Inc.)
Drivers32: vidc.dvsd - C:\Windows\SysWow64\pdvcodec.dll (Matsushita Electric Industrial Co., Ltd.)
Drivers32: VIDC.FFDS - ff_vfw.dll File not found
Drivers32: vidc.i420 - vdrcodec.dll File not found
Drivers32: VIDC.MJPG - C:\Windows\SysWow64\pvmjpg30.dll (Pegasus Imaging Corporation)
Drivers32: VIDC.XVID - xvidvfw.dll File not found

CREATERESTOREPOINT
Restore point Set: OTL Restore Point

========== Files/Folders - Created Within 30 Days ==========

[2013/01/01 09:00:22 | 000,000,000 | —D | C] – C:\Users\Nancy\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Pinnacle Instant DVD Recorder
[2013/01/01 09:00:09 | 000,000,000 | —D | C] – C:\Users\Nancy\AppData\Roaming\InstallShield Installation Information
[2013/01/01 08:10:23 | 000,000,000 | —D | C] – C:\Users\Nancy\Documents\Pinnacle Studio
[2012/12/31 21:07:27 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Pinnacle Hollywood FX 6.0 for Studio 11
[2012/12/31 21:02:40 | 000,000,000 | —D | C] – C:\Users\Public\Documents\Pinnacle Studio
[2012/12/31 21:02:40 | 000,000,000 | —D | C] – C:\Users\Public\Documents\Pinnacle
[2012/12/31 20:37:58 | 000,000,000 | —D | C] – C:\Studio Plus Vista Installer
[2012/12/31 13:50:20 | 000,000,000 | —D | C] – C:\Users\Nancy\Documents\Pinnacle
[2012/12/31 13:27:14 | 000,000,000 | —D | C] – C:\Users\Nancy\AppData\Roaming\MOVAVI
[2012/12/31 12:10:16 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Pinnacle Instant DVD Recorder
[2012/12/31 11:41:46 | 000,000,000 | —D | C] – C:\Program Files (x86)\MSXML 4.0
[2012/12/31 11:22:34 | 000,000,000 | —D | C] – C:\Users\Nancy\AppData\Local\Programs
[2012/12/31 10:05:42 | 000,000,000 | —D | C] – C:\Windows\Minidump
[2012/12/31 07:57:22 | 000,000,000 | —D | C] – C:\Program Files (x86)\InfoAtoms
[2012/12/30 09:21:59 | 000,000,000 | —D | C] – C:\Users\Nancy\Documents\Instant DVD Recorder
[2012/12/30 09:00:24 | 014,326,712 | —- | C] (Pinnacle Systems ) – C:\Windows\SysWow64\drivers\Pinnacle_Video_Driver_32bit.exe
[2012/12/30 09:00:24 | 011,878,776 | —- | C] (Pinnacle Systems ) – C:\Windows\SysWow64\drivers\Pinnacle_Video_Driver_64bit.exe
[2012/12/30 09:00:24 | 000,000,000 | —D | C] – C:\Windows\SysWow64\InstantDVDRecorder
[2012/12/30 08:49:40 | 000,000,000 | —D | C] – C:\temp
[2012/12/30 08:24:34 | 000,401,408 | —- | C] (Pegasus Imaging Corporation) – C:\Windows\SysWow64\pvmjpg30.dll
[2012/12/30 08:24:33 | 000,082,432 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\msxml4r.dll
[2012/12/30 08:24:33 | 000,044,544 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\msxml4a.dll
[2012/12/30 08:24:32 | 001,712,128 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\GDIPLUS.DLL
[2012/12/30 08:20:30 | 000,000,000 | —D | C] – C:\Users\Nancy\My Documents
[2012/12/30 08:20:29 | 000,000,000 | —D | C] – C:\Users\Nancy\Documents\My Projects
[2012/12/30 08:19:16 | 000,000,000 | —D | C] – C:\Users\Public\Documents\My Projects
[2012/12/30 08:17:52 | 000,014,165 | —- | C] (Pinnacle Systems GmbH) – C:\Windows\SysWow64\drivers\Pclepci.sys
[2012/12/30 08:17:47 | 000,041,219 | —- | C] (Pinnacle Systems) – C:\Windows\RSETPATH.exe
[2012/12/30 08:17:08 | 001,047,552 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\MFC71u.DLL
[2012/12/30 08:17:08 | 000,974,848 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\MFC70.DLL
[2012/12/30 08:17:08 | 000,964,608 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\MFC70U.DLL
[2012/12/30 08:17:08 | 000,065,536 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\MFC71DEU.DLL
[2012/12/30 08:17:08 | 000,061,440 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\MFC71ITA.DLL
[2012/12/30 08:17:08 | 000,061,440 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\MFC71FRA.DLL
[2012/12/30 08:17:08 | 000,061,440 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\MFC71ESP.DLL
[2012/12/30 08:17:08 | 000,057,344 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\MFC71ENU.DLL
[2012/12/30 08:17:08 | 000,054,784 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\MSVCI70.DLL
[2012/12/30 08:17:08 | 000,049,152 | —- | C] (Pinnacle Systems) – C:\Windows\SysWow64\PCLEGetGuid.dll
[2012/12/30 08:17:08 | 000,049,152 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\MFC71KOR.DLL
[2012/12/30 08:17:08 | 000,049,152 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\MFC71JPN.DLL
[2012/12/30 08:17:08 | 000,045,056 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\MFC71CHT.DLL
[2012/12/30 08:17:08 | 000,040,960 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\MFC71CHS.DLL
[2012/12/30 08:16:27 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Studio 11
[2012/12/30 08:16:14 | 000,000,000 | —D | C] – C:\ProgramData\Pinnacle Studio
[2012/12/29 14:24:32 | 000,070,656 | —- | C] (Pinnacle Systems) – C:\Windows\SysNative\PCLECoInst64.dll
[2012/12/29 14:24:31 | 000,215,808 | —- | C] (eMPIA Technology, Inc.) – C:\Windows\SysNative\drivers\emDevice64.sys
[2012/12/29 14:24:31 | 000,057,344 | —- | C] (eMPIA Technology, Inc.) – C:\Windows\SysWow64\emVFW.dll
[2012/12/29 14:24:31 | 000,032,768 | —- | C] (eMPIA Technology, Inc.) – C:\Windows\SysWow64\emProp.ax
[2012/12/29 14:24:31 | 000,017,808 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\emYUV.dll
[2012/12/29 14:24:31 | 000,013,824 | —- | C] (eMPIA Technology, Inc.) – C:\Windows\SysNative\emUSD64.dll
[2012/12/29 14:24:31 | 000,006,400 | —- | C] (eMPIA Technology, Inc.) – C:\Windows\SysNative\drivers\emFilter64.sys
[2012/12/29 14:24:31 | 000,006,144 | —- | C] (eMPIA Technology, Inc.) – C:\Windows\SysNative\drivers\emScan64.sys
[2012/12/29 14:24:28 | 000,079,872 | —- | C] (eMPIA Technology, Inc.) – C:\Windows\SysNative\drivers\emAudio64.sys
[2012/12/29 14:24:03 | 000,000,000 | —D | C] – C:\Program Files (x86)\Common Files\Pinnacle
[2012/12/29 14:23:15 | 000,000,000 | —D | C] – C:\Users\Nancy\AppData\Local\Downloaded Installations
[2012/12/29 11:59:07 | 000,000,000 | —D | C] – C:\Users\Nancy\AppData\Local\Pinnacle
[2012/12/29 11:53:03 | 000,233,472 | —- | C] (Pinnacle Systems GmbH) – C:\Windows\SysWow64\DiskIO.dll
[2012/12/29 11:53:03 | 000,184,320 | —- | C] (Pinnacle Systems GmbH) – C:\Windows\SysWow64\RALMain.dll
[2012/12/29 11:53:03 | 000,126,976 | —- | C] (Pinnacle Systems GmbH) – C:\Windows\SysWow64\AVIPrAx.dll
[2012/12/29 11:53:03 | 000,073,728 | —- | C] (Pinnacle Systems GmbH) – C:\Windows\SysWow64\MMAviAx.dll
[2012/12/29 11:53:03 | 000,041,984 | —- | C] (Pinnacle Systems GmbH) – C:\Windows\SysWow64\cacheX.dll
[2012/12/29 11:53:03 | 000,032,768 | —- | C] (Pinnacle Systems GmbH) – C:\Windows\SysWow64\MLPagAx.dll
[2012/12/29 11:52:13 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PrintMe Internet Printing
[2012/12/29 11:50:25 | 001,013,248 | —- | C] (LEAD Technologies, Inc.) – C:\Windows\SysWow64\Ltwvc13n.dll
[2012/12/29 11:50:25 | 000,930,992 | —- | C] (LEAD Technologies, Inc.) – C:\Windows\SysWow64\Ltr13n.dll
[2012/12/29 11:50:25 | 000,453,120 | —- | C] (LEAD Technologies, Inc.) – C:\Windows\SysWow64\ltkrn13n.dll
[2012/12/29 11:50:25 | 000,306,352 | —- | C] (LEAD Technologies, Inc.) – C:\Windows\SysWow64\Ltrio13n.dll
[2012/12/29 11:50:25 | 000,153,088 | —- | C] (LEAD Technologies, Inc.) – C:\Windows\SysWow64\ltfil13n.DLL
[2012/12/29 11:50:24 | 002,079,232 | —- | C] (LEAD Technologies, Inc.) – C:\Windows\SysWow64\LTCLR13s.dll
[2012/12/29 11:50:24 | 001,693,696 | —- | C] (LEAD Technologies, Inc.) – C:\Windows\SysWow64\LTCLR13n.dll
[2012/12/29 11:50:24 | 000,884,736 | —- | C] (Fellowes, Inc.) – C:\Windows\SysWow64\LMUIRes.dll
[2012/12/29 11:50:24 | 000,409,600 | —- | C] (LEAD Technologies, Inc.) – C:\Windows\SysWow64\LFCMP13s.DLL
[2012/12/29 11:50:24 | 000,393,216 | —- | C] (LEAD Technologies, Inc.) – C:\Windows\SysWow64\LFCMP13n.DLL
[2012/12/29 11:50:24 | 000,110,080 | —- | C] (LEAD Technologies, Inc.) – C:\Windows\SysWow64\lfpsd13s.dll
[2012/12/29 11:50:24 | 000,064,512 | —- | C] (LEAD Technologies, Inc.) – C:\Windows\SysWow64\lftga13s.dll
[2012/12/29 11:50:24 | 000,024,576 | —- | C] (LEAD Technologies, Inc.) – C:\Windows\SysWow64\lftga13n.dll
[2012/12/29 11:50:24 | 000,012,288 | —- | C] (Fellowes, Inc.) – C:\Windows\SysWow64\LMLRes.dll
[2012/12/29 11:50:22 | 000,070,144 | —- | C] (LEAD Technologies, Inc.) – C:\Windows\SysWow64\lfbmp13s.dll
[2012/12/29 11:50:22 | 000,030,208 | —- | C] (LEAD Technologies, Inc.) – C:\Windows\SysWow64\lfbmp13n.dll
[2012/12/29 11:50:05 | 001,060,864 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\MFC71.DLL
[2012/12/29 11:49:59 | 000,487,424 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\MSVCP70.DLL
[2012/12/29 11:49:58 | 000,344,064 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\MSVCR70.DLL
[2012/12/29 11:49:58 | 000,089,088 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\atl71.dll
[2012/12/29 11:49:58 | 000,084,992 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\ATL70.DLL
[2012/12/29 11:48:33 | 000,000,000 | —D | C] – C:\ProgramData\Pinnacle
[2012/12/29 11:48:30 | 000,000,000 | —D | C] – C:\Program Files (x86)\Pinnacle
[2012/12/29 11:47:45 | 000,000,000 | —D | C] – C:\Users\Nancy\AppData\Roaming\InstallShield
[2012/12/27 10:53:21 | 000,000,000 | —D | C] – C:\Users\Nancy\Documents\Red Kawa
[2012/12/27 10:53:21 | 000,000,000 | —D | C] – C:\Users\Nancy\AppData\Roaming\Red Kawa
[2012/12/27 09:49:52 | 000,000,000 | —D | C] – C:\Users\Nancy\AppData\Local\Geckofx
[2012/12/27 09:49:39 | 000,000,000 | —D | C] – C:\Users\Nancy\Documents\Regensoft
[2012/12/27 09:49:39 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Regensoft
[2012/12/27 09:49:39 | 000,000,000 | —D | C] – C:\Program Files (x86)\Regensoft
[2012/12/27 09:49:37 | 000,000,000 | —D | C] – C:\Users\Nancy\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\AviSynth 2.5
[2012/12/27 09:49:36 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AviSynth 2.5
[2012/12/27 09:49:36 | 000,000,000 | —D | C] – C:\Program Files (x86)\AviSynth 2.5
[2012/12/27 09:49:30 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Red Kawa
[2012/12/27 09:49:30 | 000,000,000 | —D | C] – C:\Program Files (x86)\Red Kawa
[2012/12/27 08:40:12 | 000,000,000 | —D | C] – C:\Users\Nancy\AppData\Local\{5BEE5DF1-E1B2-4221-8EA6-8FB65E6CD25A}
[2012/12/24 05:40:35 | 000,034,304 | —- | C] (Adobe Systems) – C:\Windows\SysWow64\atmlib.dll
[2012/12/24 05:40:34 | 000,046,080 | —- | C] (Adobe Systems) – C:\Windows\SysNative\atmlib.dll
[2012/12/24 05:40:31 | 000,367,616 | —- | C] (Adobe Systems Incorporated) – C:\Windows\SysNative\atmfd.dll
[2012/12/24 05:40:28 | 000,295,424 | —- | C] (Adobe Systems Incorporated) – C:\Windows\SysWow64\atmfd.dll
[2012/12/18 07:32:08 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes
[2012/12/18 07:31:33 | 000,000,000 | —D | C] – C:\Program Files\iPod
[2012/12/18 07:31:30 | 000,000,000 | —D | C] – C:\Program Files\iTunes
[2012/12/18 07:31:30 | 000,000,000 | —D | C] – C:\Program Files (x86)\iTunes
[2012/12/18 07:31:30 | 000,000,000 | —D | C] – C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69
[2012/12/12 08:19:59 | 000,096,768 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\mshtmled.dll
[2012/12/12 08:19:59 | 000,073,216 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\mshtmled.dll
[2012/12/12 08:19:58 | 000,176,640 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\ieui.dll
[2012/12/12 08:19:57 | 000,248,320 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\ieui.dll
[2012/12/12 08:19:57 | 000,237,056 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\url.dll
[2012/12/12 08:19:57 | 000,231,936 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\url.dll
[2012/12/12 08:19:57 | 000,173,056 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\ieUnatt.exe
[2012/12/12 08:19:57 | 000,142,848 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\ieUnatt.exe
[2012/12/12 08:19:55 | 002,312,704 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\jscript9.dll
[2012/12/12 08:19:55 | 001,494,528 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\inetcpl.cpl
[2012/12/12 08:19:55 | 001,427,968 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\inetcpl.cpl
[2012/12/12 08:19:55 | 000,729,088 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\msfeeds.dll
[2012/12/12 08:19:54 | 000,816,640 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\jscript.dll
[2012/12/12 08:19:54 | 000,717,824 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\jscript.dll
[2012/12/12 08:19:54 | 000,599,040 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\vbscript.dll
[2012/12/12 06:16:57 | 001,161,216 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\kernel32.dll
[2012/12/12 06:16:57 | 000,424,960 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\KernelBase.dll
[2012/12/12 06:16:57 | 000,338,432 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\conhost.exe
[2012/12/12 06:16:57 | 000,215,040 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\winsrv.dll
[2012/12/12 06:16:55 | 000,362,496 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\wow64win.dll
[2012/12/12 06:16:55 | 000,243,200 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\wow64.dll
[2012/12/12 06:16:55 | 000,025,600 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\setup16.exe
[2012/12/12 06:16:55 | 000,016,384 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\ntvdm64.dll
[2012/12/12 06:16:55 | 000,014,336 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\ntvdm64.dll
[2012/12/12 06:16:55 | 000,013,312 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\wow64cpu.dll
[2012/12/12 06:16:55 | 000,005,120 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\wow32.dll
[2012/12/12 06:16:54 | 000,007,680 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\instnm.exe
[2012/12/12 06:16:54 | 000,006,144 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-security-base-l1-1-0.dll
[2012/12/12 06:16:54 | 000,005,120 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-file-l1-1-0.dll
[2012/12/12 06:16:54 | 000,005,120 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-file-l1-1-0.dll
[2012/12/12 06:16:54 | 000,004,608 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-processthreads-l1-1-0.dll
[2012/12/12 06:16:54 | 000,004,096 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-sysinfo-l1-1-0.dll
[2012/12/12 06:16:54 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-heap-l1-1-0.dll
[2012/12/12 06:16:54 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-xstate-l1-1-0.dll
[2012/12/12 06:16:54 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-util-l1-1-0.dll
[2012/12/12 06:16:53 | 000,004,608 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-threadpool-l1-1-0.dll
[2012/12/12 06:16:53 | 000,004,608 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-processthreads-l1-1-0.dll
[2012/12/12 06:16:53 | 000,004,096 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-sysinfo-l1-1-0.dll
[2012/12/12 06:16:53 | 000,004,096 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-synch-l1-1-0.dll
[2012/12/12 06:16:53 | 000,004,096 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-misc-l1-1-0.dll
[2012/12/12 06:16:53 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-rtlsupport-l1-1-0.dll
[2012/12/12 06:16:53 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-processenvironment-l1-1-0.dll
[2012/12/12 06:16:53 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-processenvironment-l1-1-0.dll
[2012/12/12 06:16:53 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-namedpipe-l1-1-0.dll
[2012/12/12 06:16:53 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-namedpipe-l1-1-0.dll
[2012/12/12 06:16:53 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-misc-l1-1-0.dll
[2012/12/12 06:16:53 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-memory-l1-1-0.dll
[2012/12/12 06:16:53 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-memory-l1-1-0.dll
[2012/12/12 06:16:53 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-string-l1-1-0.dll
[2012/12/12 06:16:53 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-string-l1-1-0.dll
[2012/12/12 06:16:53 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-rtlsupport-l1-1-0.dll
[2012/12/12 06:16:53 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-profile-l1-1-0.dll
[2012/12/12 06:16:53 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-profile-l1-1-0.dll
[2012/12/12 06:16:52 | 000,006,144 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-security-base-l1-1-0.dll
[2012/12/12 06:16:52 | 000,004,608 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-threadpool-l1-1-0.dll
[2012/12/12 06:16:52 | 000,004,096 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-synch-l1-1-0.dll
[2012/12/12 06:16:52 | 000,004,096 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-localregistry-l1-1-0.dll
[2012/12/12 06:16:52 | 000,004,096 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-localregistry-l1-1-0.dll
[2012/12/12 06:16:52 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-xstate-l1-1-0.dll
[2012/12/12 06:16:52 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-libraryloader-l1-1-0.dll
[2012/12/12 06:16:52 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-libraryloader-l1-1-0.dll
[2012/12/12 06:16:52 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-interlocked-l1-1-0.dll
[2012/12/12 06:16:52 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-heap-l1-1-0.dll
[2012/12/12 06:16:52 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-util-l1-1-0.dll
[2012/12/12 06:16:52 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-io-l1-1-0.dll
[2012/12/12 06:16:52 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-io-l1-1-0.dll
[2012/12/12 06:16:52 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-interlocked-l1-1-0.dll
[2012/12/12 06:16:52 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-handle-l1-1-0.dll
[2012/12/12 06:16:52 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-handle-l1-1-0.dll
[2012/12/12 06:16:52 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-fibers-l1-1-0.dll
[2012/12/12 06:16:52 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-fibers-l1-1-0.dll
[2012/12/12 06:16:52 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-errorhandling-l1-1-0.dll
[2012/12/12 06:16:52 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-errorhandling-l1-1-0.dll
[2012/12/12 06:16:52 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-delayload-l1-1-0.dll
[2012/12/12 06:16:52 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-delayload-l1-1-0.dll
[2012/12/12 06:16:52 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-debug-l1-1-0.dll
[2012/12/12 06:16:52 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-debug-l1-1-0.dll
[2012/12/12 06:16:52 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-datetime-l1-1-0.dll
[2012/12/12 06:16:52 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-datetime-l1-1-0.dll
[2012/12/12 06:16:51 | 000,004,096 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-localization-l1-1-0.dll
[2012/12/12 06:16:51 | 000,004,096 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-localization-l1-1-0.dll
[2012/12/12 06:16:51 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-console-l1-1-0.dll
[2012/12/12 06:16:51 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-console-l1-1-0.dll
[2012/12/12 06:16:48 | 000,002,048 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\user.exe
[2012/12/12 06:16:34 | 000,478,208 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\dpnet.dll
[2012/12/12 06:16:34 | 000,376,832 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\dpnet.dll
[2012/12/08 07:39:52 | 000,000,000 | —D | C] – C:\Users\Nancy\AppData\Local\{62530663-E778-4D94-9DFA-237FE2EAC0BB}
[2012/12/05 09:13:20 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Evernote
[2011/03/24 06:24:10 | 000,093,184 | —- | C] (Microsoft Corporation) – C:\Users\Nancy\CARDFILE.EXE
[4 C:\ProgramData\*.tmp files -> C:\ProgramData\*.tmp -> ]
[4 C:\ProgramData\*.tmp files -> C:\ProgramData\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2013/01/03 09:48:00 | 000,000,830 | —- | M] () – C:\Windows\tasks\Adobe Flash Player Updater.job
[2013/01/03 06:52:50 | 000,807,600 | —- | M] () – C:\Windows\SysNative\PerfStringBackup.INI
[2013/01/03 06:52:50 | 000,680,644 | —- | M] () – C:\Windows\SysNative\perfh009.dat
[2013/01/03 06:52:50 | 000,129,138 | —- | M] () – C:\Windows\SysNative\perfc009.dat
[2013/01/03 06:23:08 | 000,009,920 | -H– | M] () – C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2013/01/03 06:23:08 | 000,009,920 | -H– | M] () – C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2013/01/03 06:14:50 | 000,067,584 | –S- | M] () – C:\Windows\bootstat.dat
[2013/01/03 06:14:02 | 2077,298,687 | -HS- | M] () – C:\hiberfil.sys
[2013/01/02 06:35:26 | 001,151,360 | —- | M] () – C:\Windows\SysNative\FNTCACHE.DAT
[2013/01/01 14:42:08 | 000,000,349 | —- | M] () – C:\Users\Public\Documents\PCLECHAL.INI
[2013/01/01 13:42:27 | 000,002,546 | —- | M] () – C:\Windows\SysNative\AutoRunFilter.ini
[2013/01/01 08:09:42 | 000,002,056 | —- | M] () – C:\Users\Public\Desktop\Studio.lnk
[2013/01/01 08:08:48 | 000,000,108 | —- | M] () – C:\AUTOEXEC.BAT
[2013/01/01 07:06:41 | 000,045,056 | —- | M] () – C:\Windows\SysNative\acovcnt.exe
[2012/12/31 13:27:10 | 000,005,116 | —- | M] () – C:\ProgramData\xgneqrwu.hrx
[2012/12/31 11:24:43 | 000,445,037 | R— | M] () – C:\Windows\SysNative\drivers\etc\hosts
[2012/12/31 11:22:58 | 000,001,115 | —- | M] () – C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2012/12/31 10:05:24 | 723,116,076 | —- | M] () – C:\Windows\MEMORY.DMP
[2012/12/31 06:03:16 | 000,001,549 | —- | M] () – C:\Windows\SysNative\ServiceFilter.ini
[2012/12/29 11:52:14 | 000,002,027 | —- | M] () – C:\Users\Public\Desktop\Adobe Reader 6.0.lnk
[2012/12/28 12:07:02 | 408,402,406 | —- | M] () – C:\Users\Nancy\Documents\John Denver Japan.mp4
[2012/12/27 09:49:39 | 000,002,156 | —- | M] () – C:\Users\Public\Desktop\YouTube Downloader App.lnk
[2012/12/27 09:49:30 | 000,002,212 | —- | M] () – C:\Users\Public\Desktop\Videora iPod Converter.lnk
[2012/12/19 09:26:39 | 000,444,933 | R— | M] () – C:\Windows\SysNative\drivers\etc\hosts.20121231-112443.backup
[2012/12/18 07:32:09 | 000,001,785 | —- | M] () – C:\Users\Public\Desktop\iTunes.lnk
[2012/12/16 12:11:22 | 000,046,080 | —- | M] (Adobe Systems) – C:\Windows\SysNative\atmlib.dll
[2012/12/16 09:45:03 | 000,367,616 | —- | M] (Adobe Systems Incorporated) – C:\Windows\SysNative\atmfd.dll
[2012/12/16 09:13:28 | 000,295,424 | —- | M] (Adobe Systems Incorporated) – C:\Windows\SysWow64\atmfd.dll
[2012/12/16 09:13:20 | 000,034,304 | —- | M] (Adobe Systems) – C:\Windows\SysWow64\atmlib.dll
[2012/12/14 16:49:28 | 000,024,176 | —- | M] (Malwarebytes Corporation) – C:\Windows\SysNative\drivers\mbam.sys
[2012/12/12 09:48:26 | 000,697,272 | —- | M] (Adobe Systems Incorporated) – C:\Windows\SysWow64\FlashPlayerApp.exe
[2012/12/12 09:48:26 | 000,073,656 | —- | M] (Adobe Systems Incorporated) – C:\Windows\SysWow64\FlashPlayerCPLApp.cpl
[2012/12/12 08:14:04 | 000,262,141 | —- | M] () – C:\Users\Nancy\Documents\Holiday_Coupon.pdf
[2012/12/11 06:14:09 | 002,831,995 | —- | M] () – C:\Users\Nancy\Documents\FR370_Manual_NA_082211.pdf
[4 C:\ProgramData\*.tmp files -> C:\ProgramData\*.tmp -> ]
[4 C:\ProgramData\*.tmp files -> C:\ProgramData\*.tmp -> ]

========== Files Created - No Company Name ==========

[2013/01/01 08:09:42 | 000,002,056 | —- | C] () – C:\Users\Public\Desktop\Studio.lnk
[2013/01/01 07:57:31 | 000,153,088 | —- | C] () – C:\Program Files (x86)\UNWISE.EXE
[2012/12/31 13:27:10 | 000,005,116 | —- | C] () – C:\ProgramData\xgneqrwu.hrx
[2012/12/31 10:05:24 | 723,116,076 | —- | C] () – C:\Windows\MEMORY.DMP
[2012/12/31 08:01:49 | 000,810,496 | —- | C] () – C:\Windows\SysNative\xvidcore.dll
[2012/12/31 08:01:49 | 000,183,808 | —- | C] () – C:\Windows\SysNative\xvidvfw.dll
[2012/12/31 08:01:49 | 000,080,896 | —- | C] () – C:\Windows\SysNative\ff_vfw.dll
[2012/12/31 08:01:37 | 000,389,120 | —- | C] () – C:\Windows\SysWow64\actskn43.ocx
[2012/12/31 08:01:37 | 000,389,120 | —- | C] () – C:\Windows\SysNative\actskn43.ocx
[2012/12/31 06:01:24 | 001,151,360 | —- | C] () – C:\Windows\SysNative\FNTCACHE.DAT
[2012/12/30 09:00:26 | 000,000,081 | —- | C] () – C:\Windows\SysWow64\Autorun.inf
[2012/12/30 08:19:17 | 000,000,108 | —- | C] () – C:\AUTOEXEC.BAT
[2012/12/30 08:17:09 | 000,027,807 | —- | C] () – C:\Windows\wmprfell.prx
[2012/12/30 08:17:09 | 000,025,269 | —- | C] () – C:\Windows\WMPrfAra.prx
[2012/12/30 08:17:09 | 000,020,704 | —- | C] () – C:\Windows\WMPrfJpn.prx
[2012/12/30 08:17:09 | 000,020,481 | —- | C] () – C:\Windows\wmprfheb.prx
[2012/12/30 08:17:09 | 000,020,055 | —- | C] () – C:\Windows\wmprfsky.prx
[2012/12/30 08:17:09 | 000,019,751 | —- | C] () – C:\Windows\wmprfhun.prx
[2012/12/30 08:17:09 | 000,019,437 | —- | C] () – C:\Windows\wmprffra.prx
[2012/12/30 08:17:09 | 000,018,878 | —- | C] () – C:\Windows\wmprfcsy.prx
[2012/12/30 08:17:09 | 000,018,536 | —- | C] () – C:\Windows\wmprfplk.prx
[2012/12/30 08:17:09 | 000,018,422 | —- | C] () – C:\Windows\wmprfptg.prx
[2012/12/30 08:17:09 | 000,017,953 | —- | C] () – C:\Windows\wmprfesp.prx
[2012/12/30 08:17:09 | 000,017,903 | —- | C] () – C:\Windows\WMPrfKor.prx
[2012/12/30 08:17:09 | 000,017,830 | —- | C] () – C:\Windows\wmprfita.prx
[2012/12/30 08:17:09 | 000,017,199 | —- | C] () – C:\Windows\wmprfptb.prx
[2012/12/30 08:17:09 | 000,017,025 | —- | C] () – C:\Windows\WMPrfDeu.prx
[2012/12/30 08:17:09 | 000,017,019 | —- | C] () – C:\Windows\wmprfsve.prx
[2012/12/30 08:17:09 | 000,016,822 | —- | C] () – C:\Windows\wmprftrk.prx
[2012/12/30 08:17:09 | 000,016,814 | —- | C] () – C:\Windows\wmprfslv.prx
[2012/12/30 08:17:09 | 000,016,446 | —- | C] () – C:\Windows\wmprfnor.prx
[2012/12/30 08:17:09 | 000,016,398 | —- | C] () – C:\Windows\wmprfnld.prx
[2012/12/30 08:17:09 | 000,016,265 | —- | C] () – C:\Windows\wmprffin.prx
[2012/12/30 08:17:09 | 000,015,903 | —- | C] () – C:\Windows\wmprfdan.prx
[2012/12/30 08:17:09 | 000,000,635 | —- | C] () – C:\Windows\wmprfrus.prx
[2012/12/30 08:17:09 | 000,000,083 | —- | C] () – C:\Windows\WMPrfCHS.prx
[2012/12/30 08:17:09 | 000,000,077 | —- | C] () – C:\Windows\WMPrfCHT.prx
[2012/12/29 11:52:14 | 000,002,027 | —- | C] () – C:\Users\Public\Desktop\Adobe Reader 6.0.lnk
[2012/12/29 11:52:13 | 000,002,515 | —- | C] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader 6.0.lnk
[2012/12/29 11:50:22 | 000,196,096 | —- | C] () – C:\Windows\SysWow64\macd32.dll
[2012/12/29 11:50:22 | 000,138,752 | —- | C] () – C:\Windows\SysWow64\mase32.dll
[2012/12/29 11:50:22 | 000,136,192 | —- | C] () – C:\Windows\SysWow64\mamc32.dll
[2012/12/29 11:50:22 | 000,057,856 | —- | C] () – C:\Windows\SysWow64\masd32.dll
[2012/12/29 11:50:22 | 000,027,648 | —- | C] () – C:\Windows\SysWow64\ma32.dll
[2012/12/28 11:41:40 | 408,402,406 | —- | C] () – C:\Users\Nancy\Documents\John Denver Japan.mp4
[2012/12/27 09:49:39 | 000,002,156 | —- | C] () – C:\Users\Public\Desktop\YouTube Downloader App.lnk
[2012/12/27 09:49:30 | 000,002,212 | —- | C] () – C:\Users\Public\Desktop\Videora iPod Converter.lnk
[2012/12/18 07:32:09 | 000,001,785 | —- | C] () – C:\Users\Public\Desktop\iTunes.lnk
[2012/12/12 08:14:04 | 000,262,141 | —- | C] () – C:\Users\Nancy\Documents\Holiday_Coupon.pdf
[2012/12/11 06:14:09 | 002,831,995 | —- | C] () – C:\Users\Nancy\Documents\FR370_Manual_NA_082211.pdf
[2012/09/06 06:56:22 | 000,647,168 | —- | C] ( ) – C:\Windows\SysWow64\lxdxpmui.dll
[2012/09/06 06:56:22 | 000,364,544 | —- | C] ( ) – C:\Windows\SysWow64\lxdxinpa.dll
[2012/09/06 06:56:22 | 000,348,160 | —- | C] () – C:\Windows\SysWow64\LXDXinst.dll
[2012/09/06 06:56:22 | 000,339,968 | —- | C] ( ) – C:\Windows\SysWow64\lxdxiesc.dll
[2012/09/06 06:56:22 | 000,335,872 | —- | C] () – C:\Windows\SysWow64\lxdxcomx.dll
[2012/09/06 06:56:21 | 001,105,920 | —- | C] ( ) – C:\Windows\SysWow64\lxdxserv.dll
[2012/09/06 06:56:21 | 000,843,776 | —- | C] ( ) – C:\Windows\SysWow64\lxdxusb1.dll
[2012/09/06 06:56:21 | 000,663,552 | —- | C] ( ) – C:\Windows\SysWow64\lxdxhbn3.dll
[2012/09/06 06:56:21 | 000,589,824 | —- | C] ( ) – C:\Windows\SysWow64\lxdxcoms.exe
[2012/09/06 06:56:21 | 000,569,344 | —- | C] ( ) – C:\Windows\SysWow64\lxdxlmpm.dll
[2012/09/06 06:56:21 | 000,315,392 | —- | C] ( ) – C:\Windows\SysWow64\lxdxih.exe
[2012/09/06 06:56:21 | 000,053,248 | —- | C] ( ) – C:\Windows\SysWow64\lxdxprox.dll
[2012/09/06 06:56:20 | 000,851,968 | —- | C] ( ) – C:\Windows\SysWow64\lxdxcomc.dll
[2012/09/06 06:56:20 | 000,376,832 | —- | C] ( ) – C:\Windows\SysWow64\lxdxcomm.dll
[2012/09/06 06:56:20 | 000,360,448 | —- | C] ( ) – C:\Windows\SysWow64\lxdxcfg.exe
[2012/08/20 18:55:38 | 000,000,024 | —- | C] () – C:\Windows\ATKPF.ini
[2012/04/11 05:03:17 | 000,096,088 | —- | C] () – C:\Users\Nancy\Sweep.bak
[2012/04/05 17:39:56 | 000,145,530 | —- | C] () – C:\Users\Nancy\533435_3696032123872_1367418451_3464299_1118926329_n.jpg
[2012/03/27 09:57:08 | 000,153,600 | —- | C] () – C:\Windows\SysWow64\WSContextMenu.dll
[2012/03/19 22:31:16 | 000,963,912 | —- | C] () – C:\Windows\SysWow64\igkrng600.bin
[2012/03/19 22:31:16 | 000,261,208 | —- | C] () – C:\Windows\SysWow64\igfcg600m.bin
[2012/03/19 22:25:58 | 000,058,880 | —- | C] () – C:\Windows\SysWow64\igdde32.dll
[2012/03/19 21:21:14 | 013,212,672 | —- | C] () – C:\Windows\SysWow64\ig4icd32.dll
[2012/03/16 18:35:35 | 000,096,088 | —- | C] () – C:\Users\Nancy\Sweep.dat
[2012/01/30 09:58:46 | 000,782,336 | —- | C] () – C:\Windows\SysWow64\lxdxdrs.dll
[2012/01/30 09:58:46 | 000,081,920 | —- | C] () – C:\Windows\SysWow64\lxdxcaps.dll
[2012/01/30 09:58:46 | 000,069,632 | —- | C] () – C:\Windows\SysWow64\lxdxcnv4.dll
[2012/01/26 18:40:04 | 000,394,319 | —- | C] () – C:\Users\Nancy\10-ways-to-get-organized-with-evernote.pdf
[2011/12/06 15:55:34 | 000,154,240 | —- | C] () – C:\Windows\AsPatch10430001.exe
[2011/10/31 18:23:58 | 000,103,784 | —- | C] () – C:\Users\Nancy\GoToAssistDownloadHelper.exe
[2011/10/17 23:17:57 | 000,825,186 | —- | C] () – C:\Windows\SysWow64\PerfStringBackup.INI
[2011/10/13 10:01:51 | 007,167,137 | —- | C] () – C:\Users\Nancy\iphone.xml
[2011/10/07 06:46:22 | 001,001,734 | —- | C] () – C:\Users\Nancy\new_dash.pdf
[2011/09/16 14:15:16 | 000,014,318 | —- | C] () – C:\Users\Nancy\about-village-logo.png
[2011/09/14 07:51:41 | 000,055,679 | —- | C] () – C:\Users\Nancy\notebook_calendar_to_do_daily.pdf
[2011/08/02 04:59:00 | 000,039,424 | —- | C] () – C:\Users\Nancy\DisneyTime.exe
[2011/05/26 03:26:14 | 000,145,804 | —- | C] () – C:\Windows\SysWow64\igcompkrng600.bin
[2011/04/10 15:31:16 | 000,230,960 | —- | C] () – C:\Users\Nancy\bookmarks.html
[2011/04/10 05:20:47 | 006,821,257 | —- | C] () – C:\Users\Nancy\Library.xml
[2011/04/01 11:00:05 | 000,121,095 | —- | C] () – C:\Users\Nancy\bookmarks-2011-04-01.json
[2011/03/26 05:28:11 | 007,021,631 | —- | C] () – C:\Users\Nancy\Library touch.xml
[2011/03/24 06:24:44 | 000,008,510 | —- | C] () – C:\Users\Nancy\NANCY.CRD

========== ZeroAccess Check ==========

[2009/07/13 23:55:00 | 000,000,227 | RHS- | M] () – C:\Windows\assembly\Desktop.ini

[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64

[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] /64

[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
"" = C:\Windows\SysNative\shell32.dll – [2012/06/09 00:43:10 | 014,172,672 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shell32.dll – [2012/06/08 23:41:00 | 012,873,728 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\fastprox.dll – [2009/07/13 20:40:51 | 000,909,312 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Free

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\system32\wbem\fastprox.dll – [2010/11/20 07:19:04 | 000,606,208 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Free

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\wbemess.dll – [2009/07/13 20:41:56 | 000,505,856 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Both

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]

========== LOP Check ==========

[2012/03/27 09:37:03 | 000,000,000 | —D | M] – C:\Users\Nancy\AppData\Roaming\Aimersoft Video Converter Pro
[2012/09/06 14:00:35 | 000,000,000 | —D | M] – C:\Users\Nancy\AppData\Roaming\Amazon
[2012/01/28 13:20:25 | 000,000,000 | —D | M] – C:\Users\Nancy\AppData\Roaming\ASUS WebStorage
[2012/02/04 08:36:00 | 000,000,000 | —D | M] – C:\Users\Nancy\AppData\Roaming\Auslogics
[2012/02/24 06:15:52 | 000,000,000 | —D | M] – C:\Users\Nancy\AppData\Roaming\Catalina Marketing Corp
[2012/02/15 08:15:27 | 000,000,000 | —D | M] – C:\Users\Nancy\AppData\Roaming\FlixsterCollections
[2012/10/13 10:16:53 | 000,000,000 | —D | M] – C:\Users\Nancy\AppData\Roaming\Garmin
[2012/01/28 14:59:05 | 000,000,000 | —D | M] – C:\Users\Nancy\AppData\Roaming\GoodSync
[2012/09/06 08:23:51 | 000,000,000 | —D | M] – C:\Users\Nancy\AppData\Roaming\Lexmark Productivity Studio
[2012/12/31 13:27:14 | 000,000,000 | —D | M] – C:\Users\Nancy\AppData\Roaming\MOVAVI
[2012/01/28 12:34:35 | 000,000,000 | —D | M] – C:\Users\Nancy\AppData\Roaming\Nuance
[2012/10/14 08:24:50 | 000,000,000 | —D | M] – C:\Users\Nancy\AppData\Roaming\OpenOffice.org
[2012/12/27 10:53:21 | 000,000,000 | —D | M] – C:\Users\Nancy\AppData\Roaming\Red Kawa
[2012/01/28 14:52:21 | 000,000,000 | —D | M] – C:\Users\Nancy\AppData\Roaming\RoboForm
[2012/07/26 09:08:24 | 000,000,000 | —D | M] – C:\Users\Nancy\AppData\Roaming\WeatherBug
[2012/03/04 08:20:58 | 000,000,000 | —D | M] – C:\Users\Nancy\AppData\Roaming\Windows Live Writer
[2012/01/28 12:34:32 | 000,000,000 | —D | M] – C:\Users\Nancy\AppData\Roaming\Zeon

========== Purity Check ==========



========== Custom Scans ==========

< %USERPROFILE%\..|smtmp;true;true;true /FP >

< %temp%\smtmp\*.* /s > >

< MD5 for: EXPLORER.ADML >
[2009/07/13 21:30:02 | 000,003,695 | —- | M] () MD5=7A4C7F3CB156543113596988479CAFCE – C:\Windows\winsxs\amd64_microsoft-windows-s..ouppolicy.resources_31bf3856ad364e35_6.1.7600.16385_en-us_7ef5713984067904\Explorer.adml

< MD5 for: EXPLORER.ADMX >
[2009/06/10 15:53:55 | 000,003,836 | —- | M] () MD5=AD131A834808E6AFF4A3918DE05BFCF6 – C:\Windows\winsxs\amd64_microsoft-windows-shell-grouppolicy_31bf3856ad364e35_6.1.7600.16385_none_71af9b5b0a86e6b7\Explorer.admx

< MD5 for: EXPLORER.EXE >
[2011/10/17 22:40:45 | 002,870,272 | —- | M] (Microsoft Corporation) MD5=0862495E0C825893DB75EF44FAEA8E93 – C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16768_none_adc24107935a7e25\explorer.exe
[2011/10/17 22:40:45 | 002,616,320 | —- | M] (Microsoft Corporation) MD5=0FB9C74046656D1579A64660AD67B746 – C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.21669_none_ba87e574ddfe652d\explorer.exe
[2009/07/13 20:14:20 | 002,613,248 | —- | M] (Microsoft Corporation) MD5=15BC38A7492BEFE831966ADB477CF76F – C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16385_none_b7fe430bc7ce3761\explorer.exe
[2011/10/17 22:40:45 | 002,614,784 | —- | M] (Microsoft Corporation) MD5=255CF508D7CFB10E0794D6AC93280BD8 – C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20910_none_b8ce9756e0b786a4\explorer.exe
[2011/10/17 22:40:45 | 002,614,784 | —- | M] (Microsoft Corporation) MD5=2AF58D15EDC06EC6FDACCE1F19482BBF – C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16768_none_b816eb59c7bb4020\explorer.exe
[2011/10/17 22:40:45 | 002,871,808 | —- | M] (Microsoft Corporation) MD5=332FEAB1435662FC6C672E25BEB37BE3 – C:\Windows\explorer.exe
[2011/10/17 22:40:45 | 002,871,808 | —- | M] (Microsoft Corporation) MD5=332FEAB1435662FC6C672E25BEB37BE3 – C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17567_none_afa79dc39081d0ba\explorer.exe
[2011/10/17 22:40:45 | 002,871,808 | —- | M] (Microsoft Corporation) MD5=3B69712041F3D63605529BD66DC00C48 – C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.21669_none_b0333b22a99da332\explorer.exe
[2010/11/20 07:17:10 | 002,616,320 | —- | M] (Microsoft Corporation) MD5=40D777B7A95E00593EB1568C68514493 – C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17514_none_ba2f56d3c4bcbafb\explorer.exe
[2011/10/17 22:40:45 | 002,616,320 | —- | M] (Microsoft Corporation) MD5=8B88EBBB05A0E56B7DCC708498C02B3E – C:\Windows\SysWOW64\explorer.exe
[2011/10/17 22:40:45 | 002,616,320 | —- | M] (Microsoft Corporation) MD5=8B88EBBB05A0E56B7DCC708498C02B3E – C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17567_none_b9fc4815c4e292b5\explorer.exe
[2010/11/20 08:24:46 | 002,872,320 | —- | M] (Microsoft Corporation) MD5=AC4C51EB24AA95B77F705AB159189E24 – C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17514_none_afdaac81905bf900\explorer.exe
[2009/07/13 20:39:10 | 002,868,224 | —- | M] (Microsoft Corporation) MD5=C235A51CB740E45FFA0EBFB9BAFCDA64 – C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16385_none_ada998b9936d7566\explorer.exe
[2011/10/17 22:40:45 | 002,870,784 | —- | M] (Microsoft Corporation) MD5=E38899074D4951D31B4040E994DD7C8D – C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20910_none_ae79ed04ac56c4a9\explorer.exe

< MD5 for: EXPLORER.EXE.CONFIG >
[2009/02/26 01:50:32 | 000,000,176 | —- | M] () MD5=E1FD9DE48AF5D7652AA31BBE914F54B8 – C:\Windows\explorer.exe.config

< MD5 for: EXPLORER.EXE.MUI >
[2009/07/13 21:26:48 | 000,022,016 | —- | M] (Microsoft Corporation) MD5=4B87EEFDC8E253F846A7DFB49A8E6C70 – C:\Windows\en-US\explorer.exe.mui
[2009/07/13 21:26:48 | 000,022,016 | —- | M] (Microsoft Corporation) MD5=4B87EEFDC8E253F846A7DFB49A8E6C70 – C:\Windows\winsxs\amd64_microsoft-windows-explorer.resources_31bf3856ad364e35_6.1.7600.16385_en-us_61e778c48d52d19b\explorer.exe.mui
[2009/07/13 21:06:56 | 000,022,016 | —- | M] (Microsoft Corporation) MD5=B9F4B1CA23D60775736059D72BA48526 – C:\Windows\SysWOW64\en-US\explorer.exe.mui
[2009/07/13 21:06:56 | 000,022,016 | —- | M] (Microsoft Corporation) MD5=B9F4B1CA23D60775736059D72BA48526 – C:\Windows\winsxs\wow64_microsoft-windows-explorer.resources_31bf3856ad364e35_6.1.7600.16385_en-us_6c3c2316c1b39396\explorer.exe.mui

< MD5 for: EXPLORER.EXE-A80E4F97.PF >
[2013/01/03 10:01:14 | 000,168,448 | —- | M] () MD5=B060B8FD86A1D547570B432618BD3669 – C:\Windows\Prefetch\EXPLORER.EXE-A80E4F97.pf

< MD5 for: IEXPLORE.EXE >
[2012/06/02 06:47:54 | 000,754,808 | —- | M] (Microsoft Corporation) MD5=004640AB259C1572EBD5FB0A32F63686 – C:\Windows\winsxs\amd64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_9.4.8112.20553_none_0dbfc836999db0ca\iexplore.exe
[2012/05/17 18:21:54 | 000,748,664 | —- | M] (Microsoft Corporation) MD5=0129BB16161C2FD9A6B19111AB047198 – C:\Windows\winsxs\wow64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_9.4.8112.16446_none_1798a687b4d6030f\iexplore.exe
[2012/11/13 21:56:04 | 000,757,296 | —- | M] (Microsoft Corporation) MD5=0D286C0FE561D1A7EB30E83A0FF305B2 – C:\Program Files (x86)\Internet Explorer\iexplore.exe
[2012/11/13 21:56:04 | 000,757,296 | —- | M] (Microsoft Corporation) MD5=0D286C0FE561D1A7EB30E83A0FF305B2 – C:\Windows\winsxs\wow64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_9.4.8112.16457_none_178ed6e5b4dd3857\iexplore.exe
[2012/06/29 00:02:52 | 000,754,784 | —- | M] (Microsoft Corporation) MD5=1223ACBFC1093852DFF039E189599BBD – C:\Windows\winsxs\amd64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_9.4.8112.16448_none_0d45fcc9807373c2\iexplore.exe
[2012/12/14 16:49:28 | 000,216,424 | —- | M] () MD5=22101A85B3CA2FE2BE05FE9A61A7A83D – C:\Program Files (x86)\Malwarebytes' Anti-Malware\Chameleon\iexplore.exe
[2012/08/24 02:34:41 | 000,748,680 | —- | M] (Microsoft Corporation) MD5=22CC6CDBA678790046693654C3B212E4 – C:\Windows\winsxs\wow64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_9.4.8112.16450_none_1787d4dfb4e386f6\iexplore.exe
[2012/05/17 17:59:46 | 000,748,664 | —- | M] (Microsoft Corporation) MD5=268982F1FD671A077C6A2AF41E351436 – C:\Windows\winsxs\wow64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_9.4.8112.20551_none_181271f4ce004017\iexplore.exe
[2012/10/08 03:37:24 | 000,748,704 | —- | M] (Microsoft Corporation) MD5=270A1342BD5AF95CA25A586B4C2F1522 – C:\Windows\winsxs\wow64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_9.4.8112.16455_none_178cd651b4df05a9\iexplore.exe
[2009/07/13 20:17:29 | 000,673,048 | —- | M] (Microsoft Corporation) MD5=2C32E3E596CFE660353753EABEFB0540 – C:\Windows\winsxs\wow64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_8.0.7600.16385_none_19ba3f8a72d988f3\iexplore.exe
[2012/08/24 06:23:44 | 000,754,824 | —- | M] (Microsoft Corporation) MD5=2D53C5F71653EF94E7829846405D4ED2 – C:\Windows\winsxs\amd64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_9.4.8112.16450_none_0d332a8d8082c4fb\iexplore.exe
[2012/06/02 04:08:27 | 000,748,664 | —- | M] (Microsoft Corporation) MD5=34B01BBD8F00B6B9C9248DC4F1E3CD01 – C:\Windows\winsxs\wow64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_9.4.8112.16447_none_1799a6d1b4d51c66\iexplore.exe
[2012/10/08 07:29:46 | 000,754,848 | —- | M] (Microsoft Corporation) MD5=49442BA6DCE4B4E3C1CB0AB193FE29AD – C:\Windows\winsxs\amd64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_9.4.8112.16455_none_0d382bff807e43ae\iexplore.exe
[2012/05/17 21:51:05 | 000,754,808 | —- | M] (Microsoft Corporation) MD5=4E99F42504A99D5024C2EFA015001937 – C:\Windows\winsxs\amd64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_9.4.8112.16446_none_0d43fc3580754114\iexplore.exe
[2012/08/24 05:49:07 | 000,754,824 | —- | M] (Microsoft Corporation) MD5=5A150AFABB25BEA50CEDC8650A7B8A9E – C:\Windows\winsxs\amd64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_9.4.8112.20557_none_0dc3c95e999a1626\iexplore.exe
[2012/06/28 21:45:31 | 000,754,808 | —- | M] (Microsoft Corporation) MD5=5D03518409F37D1483C98869D86E23FF – C:\Windows\winsxs\amd64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_9.4.8112.20554_none_0dc0c880999cca21\iexplore.exe
[2012/06/02 07:52:21 | 000,754,808 | —- | M] (Microsoft Corporation) MD5=610F6596921C4BAA8834ADBB9BE272EE – C:\Windows\winsxs\amd64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_9.4.8112.16447_none_0d44fc7f80745a6b\iexplore.exe
[2012/08/24 02:49:25 | 000,748,680 | —- | M] (Microsoft Corporation) MD5=62188720CE27B982B4285C03163C9FB3 – C:\Windows\winsxs\wow64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_9.4.8112.20557_none_181873b0cdfad821\iexplore.exe
[2011/10/17 22:32:07 | 000,696,592 | —- | M] (Microsoft Corporation) MD5=700B40EA39DFB25517A81032F03D6D20 – C:\Windows\winsxs\amd64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_8.0.7600.16722_none_0fa37b7a3e4ac7e9\iexplore.exe
[2010/11/20 08:28:26 | 000,695,056 | —- | M] (Microsoft Corporation) MD5=86257731DDB311FBC283534CC0091634 – C:\Windows\winsxs\amd64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_8.0.7601.17514_none_1196a9003b674a92\iexplore.exe
[2011/10/17 22:32:07 | 000,696,592 | —- | M] (Microsoft Corporation) MD5=8C6C32E4AF8A3D7155656F5897C504E0 – C:\Windows\winsxs\amd64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_8.0.7600.20861_none_1000d84b5789be20\iexplore.exe
[2011/03/28 18:24:08 | 000,748,336 | —- | M] (Microsoft Corporation) MD5=904E13BA41AF2E353A32CF351CA53639 – C:\Windows\winsxs\wow64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_9.4.8112.16421_none_17a944edb4ca4c7a\iexplore.exe
[2011/10/17 22:32:07 | 000,673,040 | —- | M] (Microsoft Corporation) MD5=9321CF0D023528C71E3645F8433C86C8 – C:\Windows\winsxs\wow64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_8.0.7600.20861_none_1a55829d8bea801b\iexplore.exe
[2012/06/28 20:00:47 | 000,748,664 | —- | M] (Microsoft Corporation) MD5=93569D46D79F9756ED077156496AFE23 – C:\Windows\winsxs\wow64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_9.4.8112.16448_none_179aa71bb4d435bd\iexplore.exe
[2011/10/17 22:32:07 | 000,673,040 | —- | M] (Microsoft Corporation) MD5=AA08B68EF4E35EFA170CF85A44B23B70 – C:\Windows\winsxs\wow64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_8.0.7600.16722_none_19f825cc72ab89e4\iexplore.exe
[2011/10/17 22:39:02 | 000,673,040 | —- | M] (Microsoft Corporation) MD5=AB2BB40A5FE49AD236791AC22BD08869 – C:\Windows\winsxs\wow64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_8.0.7600.20908_none_1a9d66118bb386fd\iexplore.exe
[2012/11/15 22:08:58 | 000,763,424 | —- | M] (Microsoft Corporation) MD5=AC4957E154F750DF54F36ADC8E3E040D – C:\Windows\winsxs\amd64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_9.4.8112.20565_none_0db6f8de99a3ff69\iexplore.exe
[2011/10/17 22:39:02 | 000,696,592 | —- | M] (Microsoft Corporation) MD5=B4881B8F6EDB48CABD44BCC9FB5475C4 – C:\Windows\winsxs\amd64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_8.0.7600.20908_none_1048bbbf5752c502\iexplore.exe
[2012/06/02 03:51:58 | 000,748,664 | —- | M] (Microsoft Corporation) MD5=BE967C74B89577B78FB57C061E12B04C – C:\Windows\winsxs\wow64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_9.4.8112.20553_none_18147288cdfe72c5\iexplore.exe
[2010/11/20 07:22:52 | 000,673,040 | —- | M] (Microsoft Corporation) MD5=C613E69C3B191BB02C7A191741A1D024 – C:\Windows\winsxs\wow64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_8.0.7601.17514_none_1beb53526fc80c8d\iexplore.exe
[2011/10/17 22:39:02 | 000,673,040 | —- | M] (Microsoft Corporation) MD5=C6697A46554E36541E81182B258A19D6 – C:\Windows\winsxs\wow64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_8.0.7600.16766_none_19d0e74472c85f04\iexplore.exe
[2012/10/08 03:22:05 | 000,748,704 | —- | M] (Microsoft Corporation) MD5=CECB15F834FC2B4B150449717ADE18DD – C:\Windows\winsxs\wow64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_9.4.8112.20562_none_1808a252ce07755f\iexplore.exe
[2011/10/17 22:39:02 | 000,696,592 | —- | M] (Microsoft Corporation) MD5=E1BBDE0F187194D4B08335234A4B9FC7 – C:\Windows\winsxs\amd64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_8.0.7600.16766_none_0f7c3cf23e679d09\iexplore.exe
[2012/06/28 18:35:27 | 000,748,664 | —- | M] (Microsoft Corporation) MD5=EB4105348272018D096FEB655CD1608C – C:\Windows\winsxs\wow64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_9.4.8112.20554_none_181572d2cdfd8c1c\iexplore.exe
[2011/03/28 18:24:08 | 000,754,480 | —- | M] (Microsoft Corporation) MD5=F1424C1B9B1813BF825E45DF3790BC8A – C:\Windows\winsxs\amd64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_9.4.8112.16421_none_0d549a9b80698a7f\iexplore.exe
[2009/07/13 20:43:43 | 000,696,600 | —- | M] (Microsoft Corporation) MD5=F2B0D41E1D08D0B2006DF5AA2E74C81E – C:\Windows\winsxs\amd64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_8.0.7600.16385_none_0f6595383e78c6f8\iexplore.exe
[2012/10/08 06:09:10 | 000,754,824 | —- | M] (Microsoft Corporation) MD5=F61714ABCF9BF0CEF0A6249AD4FD490B – C:\Windows\winsxs\amd64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_9.4.8112.20562_none_0db3f80099a6b364\iexplore.exe
[2012/11/13 21:19:28 | 000,757,280 | —- | M] (Microsoft Corporation) MD5=F691418EE9A6344AEB5C1B0518FBF8AE – C:\Windows\winsxs\wow64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_9.4.8112.20565_none_180ba330ce04c164\iexplore.exe
[2012/05/17 20:37:57 | 000,754,808 | —- | M] (Microsoft Corporation) MD5=F8B2D47ED17C1D087D14EC747E5AC57A – C:\Windows\winsxs\amd64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_9.4.8112.20551_none_0dbdc7a2999f7e1c\iexplore.exe
[2012/11/14 02:11:18 | 000,763,424 | —- | M] (Microsoft Corporation) MD5=FD0D2E1FAEBAE5031BE2EB8000D973F1 – C:\Program Files\Internet Explorer\iexplore.exe
[2012/11/14 02:11:18 | 000,763,424 | —- | M] (Microsoft Corporation) MD5=FD0D2E1FAEBAE5031BE2EB8000D973F1 – C:\Windows\winsxs\amd64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_9.4.8112.16457_none_0d3a2c93807c765c\iexplore.exe

< MD5 for: IEXPLORE.EXE.MUI >
[2011/10/17 23:35:28 | 000,004,608 | —- | M] (Microsoft Corporation) MD5=01E762F8A9ADD0EB536BBD0B1A9EE761 – C:\Program Files (x86)\Internet Explorer\zh-CN\iexplore.exe.mui
[2011/10/17 23:35:28 | 000,004,608 | —- | M] (Microsoft Corporation) MD5=01E762F8A9ADD0EB536BBD0B1A9EE761 – C:\Windows\winsxs\wow64_microsoft-windows-i..-optional.resources_31bf3856ad364e35_9.4.8112.16421_zh-cn_70dc44d2d3996773\iexplore.exe.mui
[2011/03/28 18:24:08 | 000,005,632 | —- | M] (Microsoft Corporation) MD5=17FAE936C452188D05852DE8D1082013 – C:\Program Files\Internet Explorer\en-US\iexplore.exe.mui
[2011/03/28 18:24:08 | 000,005,632 | —- | M] (Microsoft Corporation) MD5=17FAE936C452188D05852DE8D1082013 – C:\Windows\winsxs\amd64_microsoft-windows-i..-optional.resources_31bf3856ad364e35_9.4.8112.16421_en-us_07013012b816cb66\iexplore.exe.mui
[2011/10/17 23:34:45 | 000,004,608 | —- | M] (Microsoft Corporation) MD5=1E6D15389084E185432C95038F6A5F44 – C:\Program Files (x86)\Internet Explorer\zh-TW\iexplore.exe.mui
[2011/10/17 23:34:45 | 000,004,608 | —- | M] (Microsoft Corporation) MD5=1E6D15389084E185432C95038F6A5F44 – C:\Windows\winsxs\wow64_microsoft-windows-i..-optional.resources_31bf3856ad364e35_9.4.8112.16421_zh-tw_74d88228d10a43e3\iexplore.exe.mui
[2011/10/17 23:33:20 | 000,006,144 | —- | M] (Microsoft Corporation) MD5=490CD18CE5FB8C3CBFFD63A5314250D9 – C:\Program Files\Internet Explorer\es-ES\iexplore.exe.mui
[2011/10/17 23:33:20 | 000,006,144 | —- | M] (Microsoft Corporation) MD5=490CD18CE5FB8C3CBFFD63A5314250D9 – C:\Windows\winsxs\amd64_microsoft-windows-i..-optional.resources_31bf3856ad364e35_9.4.8112.16421_es-es_06cc8cf6b83dbd0b\iexplore.exe.mui
[2011/03/28 18:24:08 | 000,005,632 | —- | M] (Microsoft Corporation) MD5=4C71CCB3C8817185E67210856778831F – C:\Program Files (x86)\Internet Explorer\en-US\iexplore.exe.mui
[2011/03/28 18:24:08 | 000,005,632 | —- | M] (Microsoft Corporation) MD5=4C71CCB3C8817185E67210856778831F – C:\Windows\winsxs\wow64_microsoft-windows-i..-optional.resources_31bf3856ad364e35_9.4.8112.16421_en-us_1155da64ec778d61\iexplore.exe.mui
[2011/10/17 23:34:02 | 000,005,632 | —- | M] (Microsoft Corporation) MD5=9C0D0AE99FF3BECAD98CE0D329087D87 – C:\Program Files (x86)\Internet Explorer\pt-PT\iexplore.exe.mui
[2011/10/17 23:34:02 | 000,005,632 | —- | M] (Microsoft Corporation) MD5=9C0D0AE99FF3BECAD98CE0D329087D87 – C:\Windows\winsxs\wow64_microsoft-windows-i..-optional.resources_31bf3856ad364e35_9.4.8112.16421_pt-pt_13d3e055589afadc\iexplore.exe.mui
[2011/10/17 23:32:38 | 000,006,144 | —- | M] (Microsoft Corporation) MD5=B5ED0B02C0CF0B9B72801814688D5A00 – C:\Program Files\Internet Explorer\fr-FR\iexplore.exe.mui
[2011/10/17 23:32:38 | 000,006,144 | —- | M] (Microsoft Corporation) MD5=B5ED0B02C0CF0B9B72801814688D5A00 – C:\Windows\winsxs\amd64_microsoft-windows-i..-optional.resources_31bf3856ad364e35_9.4.8112.16421_fr-fr_a98402f5ab0fd36d\iexplore.exe.mui
[2009/07/13 21:29:20 | 000,005,120 | —- | M] (Microsoft Corporation) MD5=C29BCFB504E33FEADDFA2D0183CEF62F – C:\Windows\winsxs\amd64_microsoft-windows-i..-optional.resources_31bf3856ad364e35_8.0.7600.16385_en-us_09122aaf762607df\iexplore.exe.mui
[2009/07/13 21:29:20 | 000,005,120 | —- | M] (Microsoft Corporation) MD5=C29BCFB504E33FEADDFA2D0183CEF62F – C:\Windows\winsxs\amd64_microsoft-windows-i..-optional.resources_31bf3856ad364e35_8.0.7601.17514_en-us_0b433e7773148b79\iexplore.exe.mui
[2011/10/17 23:33:20 | 000,006,144 | —- | M] (Microsoft Corporation) MD5=CF5D2D3D54DE91D2C66796D33E4D6431 – C:\Program Files (x86)\Internet Explorer\es-ES\iexplore.exe.mui
[2011/10/17 23:33:20 | 000,006,144 | —- | M] (Microsoft Corporation) MD5=CF5D2D3D54DE91D2C66796D33E4D6431 – C:\Windows\winsxs\wow64_microsoft-windows-i..-optional.resources_31bf3856ad364e35_9.4.8112.16421_es-es_11213748ec9e7f06\iexplore.exe.mui
[2011/10/17 23:34:02 | 000,005,632 | —- | M] (Microsoft Corporation) MD5=D07D3ED57DBEE3B8F4172C5FAFF5DB0E – C:\Program Files\Internet Explorer\pt-PT\iexplore.exe.mui
[2011/10/17 23:34:02 | 000,005,632 | —- | M] (Microsoft Corporation) MD5=D07D3ED57DBEE3B8F4172C5FAFF5DB0E – C:\Windows\winsxs\amd64_microsoft-windows-i..-optional.resources_31bf3856ad364e35_9.4.8112.16421_pt-pt_097f3603243a38e1\iexplore.exe.mui
[2011/10/17 23:35:28 | 000,004,608 | —- | M] (Microsoft Corporation) MD5=D69A495BB30EAFC1B11218D5204BE291 – C:\Program Files\Internet Explorer\zh-CN\iexplore.exe.mui
[2011/10/17 23:35:28 | 000,004,608 | —- | M] (Microsoft Corporation) MD5=D69A495BB30EAFC1B11218D5204BE291 – C:\Windows\winsxs\amd64_microsoft-windows-i..-optional.resources_31bf3856ad364e35_9.4.8112.16421_zh-cn_66879a809f38a578\iexplore.exe.mui
[2011/10/17 23:34:45 | 000,004,608 | —- | M] (Microsoft Corporation) MD5=DC0612AB746CD754ABEC33385CEBD43A – C:\Program Files\Internet Explorer\zh-TW\iexplore.exe.mui
[2011/10/17 23:34:45 | 000,004,608 | —- | M] (Microsoft Corporation) MD5=DC0612AB746CD754ABEC33385CEBD43A – C:\Windows\winsxs\amd64_microsoft-windows-i..-optional.resources_31bf3856ad364e35_9.4.8112.16421_zh-tw_6a83d7d69ca981e8\iexplore.exe.mui
[2011/10/17 23:32:38 | 000,006,144 | —- | M] (Microsoft Corporation) MD5=F19C598721DC3B8FC08EF800D7F9C1AF – C:\Program Files (x86)\Internet Explorer\fr-FR\iexplore.exe.mui
[2011/10/17 23:32:38 | 000,006,144 | —- | M] (Microsoft Corporation) MD5=F19C598721DC3B8FC08EF800D7F9C1AF – C:\Windows\winsxs\wow64_microsoft-windows-i..-optional.resources_31bf3856ad364e35_9.4.8112.16421_fr-fr_b3d8ad47df709568\iexplore.exe.mui
[2009/07/13 21:05:06 | 000,005,120 | —- | M] (Microsoft Corporation) MD5=FBA4CD95930248053A2C3F43CA70B986 – C:\Windows\winsxs\wow64_microsoft-windows-i..-optional.resources_31bf3856ad364e35_8.0.7600.16385_en-us_1366d501aa86c9da\iexplore.exe.mui
[2009/07/13 21:05:06 | 000,005,120 | —- | M] (Microsoft Corporation) MD5=FBA4CD95930248053A2C3F43CA70B986 – C:\Windows\winsxs\wow64_microsoft-windows-i..-optional.resources_31bf3856ad364e35_8.0.7601.17514_en-us_1597e8c9a7754d74\iexplore.exe.mui

< MD5 for: SERVICES >
[2009/06/10 16:00:26 | 000,017,463 | —- | M] () MD5=D9E1A01B480D961B7CF0509D597A92D6 – C:\Windows\winsxs\amd64_microsoft-windows-w..nfrastructure-other_31bf3856ad364e35_6.1.7600.16385_none_6079f415110c0210\services

< MD5 for: SERVICES.EXE >
[2009/07/13 20:39:37 | 000,328,704 | —- | M] (Microsoft Corporation) MD5=24ACB7E5BE595468E3B9AA488B9B4FCB – C:\Windows\SysNative\services.exe
[2009/07/13 20:39:37 | 000,328,704 | —- | M] (Microsoft Corporation) MD5=24ACB7E5BE595468E3B9AA488B9B4FCB – C:\Windows\winsxs\amd64_microsoft-windows-s..s-servicecontroller_31bf3856ad364e35_6.1.7600.16385_none_2b54b20ee6fa07b1\services.exe

< MD5 for: SERVICES.EXE.MUI >
[2009/07/13 21:25:40 | 000,017,408 | —- | M] (Microsoft Corporation) MD5=6507BF0DC2D1F5F32493C288EAA59277 – C:\Windows\SysNative\en-US\services.exe.mui
[2009/07/13 21:25:40 | 000,017,408 | —- | M] (Microsoft Corporation) MD5=6507BF0DC2D1F5F32493C288EAA59277 – C:\Windows\winsxs\amd64_microsoft-windows-s..ontroller.resources_31bf3856ad364e35_6.1.7600.16385_en-us_c5f238be3fa63468\services.exe.mui

< MD5 for: SERVICES.LNK >
[2009/07/13 23:54:05 | 000,001,288 | —- | M] () MD5=CA0D9F4743DFF86EBAF09D763139E958 – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\services.lnk
[2009/07/13 23:54:05 | 000,001,288 | —- | M] () MD5=CA0D9F4743DFF86EBAF09D763139E958 – C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Administrative Tools\services.lnk

< MD5 for: SERVICES.MOF >
[2009/06/10 15:44:06 | 000,002,866 | —- | M] () MD5=26A11C895A7F0B6D32105EBE127D8500 – C:\Windows\SysNative\wbem\services.mof
[2009/06/10 15:44:06 | 000,002,866 | —- | M] () MD5=26A11C895A7F0B6D32105EBE127D8500 – C:\Windows\winsxs\amd64_microsoft-windows-s..s-servicecontroller_31bf3856ad364e35_6.1.7600.16385_none_2b54b20ee6fa07b1\services.mof

< MD5 for: SERVICES.MSC >
[2009/07/13 21:23:30 | 000,092,745 | —- | M] () MD5=7A1D35F59468B8118AF5B8E21DF78AE2 – C:\Windows\SysNative\en-US\services.msc
[2009/06/10 15:38:36 | 000,092,745 | —- | M] () MD5=7A1D35F59468B8118AF5B8E21DF78AE2 – C:\Windows\SysNative\services.msc
[2009/07/13 21:08:50 | 000,092,745 | —- | M] () MD5=7A1D35F59468B8118AF5B8E21DF78AE2 – C:\Windows\SysWOW64\en-US\services.msc
[2009/06/10 16:21:09 | 000,092,745 | —- | M] () MD5=7A1D35F59468B8118AF5B8E21DF78AE2 – C:\Windows\SysWOW64\services.msc
[2009/07/13 21:23:30 | 000,092,745 | —- | M] () MD5=7A1D35F59468B8118AF5B8E21DF78AE2 – C:\Windows\winsxs\amd64_microsoft-windows-s..cessnapin.resources_31bf3856ad364e35_6.1.7600.16385_en-us_003408aa160fce5b\services.msc
[2009/06/10 15:38:36 | 000,092,745 | —- | M] () MD5=7A1D35F59468B8118AF5B8E21DF78AE2 – C:\Windows\winsxs\amd64_microsoft-windows-servicessnapin_31bf3856ad364e35_6.1.7600.16385_none_2b58d44b5f6beb8a\services.msc
[2009/07/13 21:08:50 | 000,092,745 | —- | M] () MD5=7A1D35F59468B8118AF5B8E21DF78AE2 – C:\Windows\winsxs\x86_microsoft-windows-s..cessnapin.resources_31bf3856ad364e35_6.1.7600.16385_en-us_a4156d265db25d25\services.msc
[2009/06/10 16:21:09 | 000,092,745 | —- | M] () MD5=7A1D35F59468B8118AF5B8E21DF78AE2 – C:\Windows\winsxs\x86_microsoft-windows-servicessnapin_31bf3856ad364e35_6.1.7600.16385_none_cf3a38c7a70e7a54\services.msc

< MD5 for: SERVICES.PTXML >
[2009/07/13 15:16:17 | 000,001,061 | —- | M] () MD5=640D7DD61B1CFA6C96F80F68F78CDFA7 – C:\Windows\SysNative\wdi\perftrack\Services.ptxml
[2009/07/13 15:16:17 | 000,001,061 | —- | M] () MD5=640D7DD61B1CFA6C96F80F68F78CDFA7 – C:\Windows\winsxs\amd64_microsoft-windows-s..s-servicecontroller_31bf3856ad364e35_6.1.7600.16385_none_2b54b20ee6fa07b1\Services.ptxml

< MD5 for: SERVICES.RDB >
[2009/04/23 23:34:14 | 005,472,256 | —- | M] () MD5=81CCB59A28A03DB55807B883CB679027 – C:\Program Files (x86)\OpenOffice.org 3\Basis\program\services.rdb
[2009/04/23 23:35:04 | 000,262,144 | —- | M] () MD5=81CCB59A28A03DB55807B883CB679027 – C:\Program Files (x86)\OpenOffice.org 3\URE\misc\services.rdb
[2009/04/23 23:34:14 | 005,472,256 | —- | M] () MD5=81CCB59A28A03DB55807B883CB679027 – C:\Users\Nancy\AppData\Local\Temp\services.rdb

< MD5 for: SERVICES.SBS >
[2011/03/01 08:58:44 | 000,034,818 | —- | M] () MD5=62AFD4B2025CE6D4706B36F4C4808F9B – C:\Program Files (x86)\Spybot - Search & Destroy\Includes\Services.sbs

< MD5 for: WINLOGON.ADML >
[2009/07/13 21:25:22 | 000,008,013 | —- | M] () MD5=CED0EAD8D152B3D0F114698DE2316C5E – C:\Windows\winsxs\amd64_microsoft-windows-winlogon-adm.resources_31bf3856ad364e35_6.1.7600.16385_en-us_f0f9032ef6930070\WinLogon.adml

< MD5 for: WINLOGON.ADMX >
[2009/06/10 16:04:41 | 000,005,237 | —- | M] () MD5=89D8F50E186A16C2CED3CF36DBBC0B2C – C:\Windows\winsxs\amd64_microsoft-windows-winlogon-adm_31bf3856ad364e35_6.1.7600.16385_none_d7024e6992f3424d\WinLogon.admx

< MD5 for: WINLOGON.EXE >
[2010/11/20 08:25:32 | 000,390,656 | —- | M] (Microsoft Corporation) MD5=1151B1BAA6F350B1DB6598E0FEA7C457 – C:\Windows\SysNative\winlogon.exe
[2010/11/20 08:25:32 | 000,390,656 | —- | M] (Microsoft Corporation) MD5=1151B1BAA6F350B1DB6598E0FEA7C457 – C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7601.17514_none_cde90685eb910636\winlogon.exe
[2009/07/13 20:39:52 | 000,389,120 | —- | M] (Microsoft Corporation) MD5=132328DF455B0028F13BF0ABEE51A63A – C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16385_none_cbb7f2bdeea2829c\winlogon.exe
[2012/12/14 16:49:28 | 000,216,424 | —- | M] () MD5=22101A85B3CA2FE2BE05FE9A61A7A83D – C:\Program Files (x86)\Malwarebytes' Anti-Malware\Chameleon\winlogon.exe

< MD5 for: WINLOGON.EXE.MUI >
[2010/11/20 08:00:26 | 000,023,040 | —- | M] (Microsoft Corporation) MD5=34C7D2E30868EDAFB191341D963ABA5F – C:\Windows\SysNative\en-US\winlogon.exe.mui
[2010/11/20 08:00:26 | 000,023,040 | —- | M] (Microsoft Corporation) MD5=34C7D2E30868EDAFB191341D963ABA5F – C:\Windows\winsxs\amd64_microsoft-windows-winlogon.resources_31bf3856ad364e35_6.1.7601.17514_en-us_291e96fa1ab5fc7b\winlogon.exe.mui
[2009/07/13 21:29:52 | 000,022,528 | —- | M] (Microsoft Corporation) MD5=56D03B64B8C483C1D12A8E4577B3B332 – C:\Windows\winsxs\amd64_microsoft-windows-winlogon.resources_31bf3856ad364e35_6.1.7600.16385_en-us_26ed83321dc778e1\winlogon.exe.mui

< MD5 for: WINLOGON.MFL >
[2009/07/13 21:27:22 | 000,001,080 | —- | M] () MD5=2783ED50691284F7EAE6BE9729337E1A – C:\Windows\SysNative\wbem\en-US\winlogon.mfl
[2009/07/13 21:27:22 | 000,001,080 | —- | M] () MD5=2783ED50691284F7EAE6BE9729337E1A – C:\Windows\winsxs\amd64_microsoft-windows-winlogon-mof.resources_31bf3856ad364e35_6.1.7600.16385_en-us_84afd4fd38ffd276\winlogon.mfl

< MD5 for: WINLOGON.MOF >
[2009/07/13 15:30:01 | 000,003,192 | —- | M] () MD5=DF722B96F32A61783BC310FACF10240B – C:\Windows\SysNative\wbem\winlogon.mof
[2009/07/13 15:30:01 | 000,003,192 | —- | M] () MD5=DF722B96F32A61783BC310FACF10240B – C:\Windows\winsxs\amd64_microsoft-windows-winlogon-mof_31bf3856ad364e35_6.1.7600.16385_none_dc2dbb778f98e40f\winlogon.mof

< %SYSTEMDRIVE%\*.* >
[2011/10/02 06:43:33 | 000,000,102 | -H– | M] () – C:\aaw7boot.cmd
[2011/10/11 18:38:42 | 000,000,044 | —- | M] () – C:\ASUS.md5
[2013/01/01 08:08:48 | 000,000,108 | —- | M] () – C:\AUTOEXEC.BAT
[2012/01/28 05:14:19 | 000,126,244 | —- | M] () – C:\bookmarks-2012-01-28.json
[2009/07/13 20:38:58 | 000,383,562 | RHS- | M] () – C:\bootmgr
[2009/07/29 01:03:37 | 000,008,192 | RHS- | M] () – C:\BOOTSECT.BAK
[2012/01/28 13:30:45 | 000,000,125 | —- | M] () – C:\BurnHelp.txt
[2011/12/06 16:16:16 | 000,014,429 | —- | M] () – C:\devlist.txt
[2011/12/06 00:16:16 | 000,000,009 | —- | M] () – C:\Finish.log
[2013/01/03 06:14:02 | 2077,298,687 | -HS- | M] () – C:\hiberfil.sys
[2011/03/23 14:26:49 | 000,000,366 | -H– | M] () – C:\IPH.PH
[2012/09/04 06:57:48 | 000,000,503 | —- | M] () – C:\lmab.log
[2012/09/06 06:50:00 | 000,001,124 | —- | M] () – C:\lxdx.log
[2012/01/28 14:37:45 | 000,000,540 | —- | M] () – C:\lxdxcomx.log
[2012/01/27 08:54:16 | 006,723,560 | R— | M] () – C:\Money Backup 2011-4.mbf
[2013/01/03 06:14:42 | 4201,390,079 | -HS- | M] () – C:\pagefile.sys
[2011/12/06 00:17:38 | 000,000,233 | —- | M] () – C:\Pass.txt
[2011/03/27 21:35:35 | 000,000,009 | —- | M] () – C:\RECOVERY.DAT
[2012/03/27 05:32:55 | 000,002,364 | —- | M] () – C:\RHDSetup.log
[2012/03/27 05:32:55 | 000,000,206 | —- | M] () – C:\setup.log
[2011/12/06 16:01:47 | 000,000,378 | —- | M] () – C:\setuplogfile.log
[2012/09/24 07:17:52 | 000,000,029 | —- | M] () – C:\test.txt
[2011/05/17 00:57:40 | 002,621,440 | -H– | M] () – C:\U46E.BIN
[2011/05/24 02:32:00 | 000,000,023 | —- | M] () – C:\U46E_WIN7.30
[2007/11/14 14:18:40 | 000,000,553 | —- | M] () – C:\USetup.iss
[2012/02/09 14:32:48 | 000,007,837 | —- | M] () – C:\WirelessDiagLog.csv
[2012/09/04 07:33:55 | 000,000,797 | —- | M] () – C:\Wpssu.log

< %systemroot%\Fonts\*.com >
[2009/07/14 00:32:31 | 000,026,040 | —- | M] () – C:\Windows\Fonts\GlobalMonospace.CompositeFont
[2009/07/14 00:32:31 | 000,026,489 | —- | M] () – C:\Windows\Fonts\GlobalSansSerif.CompositeFont
[2009/07/14 00:32:31 | 000,029,779 | —- | M] () – C:\Windows\Fonts\GlobalSerif.CompositeFont
[2009/07/14 00:32:31 | 000,043,318 | —- | M] () – C:\Windows\Fonts\GlobalUserInterface.CompositeFont

< %systemroot%\Fonts\*.dll >

< %systemroot%\Fonts\*.ini >
[2009/06/10 15:49:50 | 000,000,065 | —- | M] () – C:\Windows\Fonts\desktop.ini

< %systemroot%\Fonts\*.ini2 >

< %systemroot%\Fonts\*.exe >

< %systemroot%\system32\spool\prtprocs\w32x86\*.* >

< %systemroot%\REPAIR\*.bak1 >

< %systemroot%\REPAIR\*.ini >

< %systemroot%\system32\*.jpg >

< %systemroot%\*.jpg >

< %systemroot%\*.png >

< %systemroot%\*.scr >
[2011/05/13 17:42:24 | 000,302,448 | —- | M] (Microsoft Corporation) – C:\Windows\WLXPGSS.SCR

< %systemroot%\*._sy >

< %APPDATA%\Adobe\Update\*.* >

< %ALLUSERSPROFILE%\Favorites\*.* >

< %APPDATA%\Microsoft\*.* >

< %PROGRAMFILES%\*.* >
[2009/07/13 23:54:24 | 000,000,174 | -HS- | M] () – C:\Program Files (x86)\desktop.ini
[2002/07/26 17:02:06 | 000,153,088 | —- | M] () – C:\Program Files (x86)\UNWISE.EXE

< %APPDATA%\Update\*.* >

< %systemroot%\*. /mp /s >

< %systemroot%\System32\config\*.sav >

< %PROGRAMFILES%\bak. /s >

< %systemroot%\system32\bak. /s >

< %ALLUSERSPROFILE%\Start Menu\*.lnk /x >

< %systemroot%\system32\config\systemprofile\*.dat /x >

< %systemroot%\*.config >
[2009/02/26 01:50:32 | 000,000,176 | —- | M] () – C:\Windows\explorer.exe.config

< %systemroot%\system32\*.db >

< %PROGRAMFILES%\Internet Explorer\*.dat >

< %APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x >
[2012/01/28 18:16:00 | 000,000,221 | -HS- | M] () – C:\Users\Nancy\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini

< %USERPROFILE%\Desktop\*.exe >

< %PROGRAMFILES%\Common Files\*.* >

< %systemroot%\*.src >

< %systemroot%\install\*.* >

< %systemroot%\system32\DLL\*.* >

< %systemroot%\system32\HelpFiles\*.* >

< %systemroot%\system32\rundll\*.* >

< %systemroot%\winn32\*.* >

< %systemroot%\Java\*.* >

< %systemroot%\system32\test\*.* >

< %systemroot%\system32\Rundll32\*.* >

< %systemroot%\AppPatch\Custom\*.* >

< HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >

< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs >

========== Alternate Data Streams ==========

@Alternate Data Stream - 147 bytes -> C:\ProgramData\Temp:23E3D912
@Alternate Data Stream - 124 bytes -> C:\ProgramData\Temp:718F6FF0
@Alternate Data Stream - 105 bytes -> C:\ProgramData\Temp:5C321E34

< End of report >


Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 10:27:37 AM, on 1/3/2013
Platform: Windows 7 SP1 (WinNT 6.00.3505)
MSIE: Internet Explorer v9.00 (9.00.8112.16457)
Boot mode: Normal

Running processes:
C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe
C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe
C:\Windows\AsScrPro.exe
C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe
C:\Program Files (x86)\Lexmark 3600-4600 Series\lxdxmon.exe
C:\Program Files (x86)\AWS\WeatherBug\Weather.exe
C:\Program Files (x86)\Adobe\Elements Organizer 8.0\ElementsOrganizerSyncAgent.exe
C:\Program Files (x86)\Siber Systems\AI RoboForm\robotaskbaricon.exe
C:\Program Files (x86)\Lexmark 3600-4600 Series\lxdxMsdMon.exe
C:\Program Files (x86)\ASUS\Sonic Focus\SonicFocusTray.exe
C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe
C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControlUser.exe
C:\Program Files (x86)\ASUS\Wireless Console 3\wcourier.exe
C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
C:\Program Files (x86)\iTunes\iTunesHelper.exe
C:\Program Files (x86)\Pinnacle\Shared Files\Programs\USBTip\USBTip.exe
C:\Program Files (x86)\Intel\Bluetooth\BTPlayerCtrl.exe
C:\Program Files (x86)\Evernote\Evernote\EvernoteClipper.exe
C:\Program Files (x86)\OpenOffice.org 3\program\soffice.exe
C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin
C:\Program Files (x86)\Mozilla Firefox\firefox.exe
C:\Program Files (x86)\Common Files\Apple\Apple Application Support\distnoted.exe
C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe
C:\Program Files (x86)\iTunes\iTunes.exe
C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceHelper.exe
C:\Program Files (x86)\Evernote\Evernote\Evernote.exe
C:\Program Files (x86)\Evernote\Evernote\EvernoteTray.exe
C:\Program Files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe
C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe
C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_5_502_135.exe
C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_5_502_135.exe
C:\Users\Nancy\Downloads\HiJackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a;…ion&pf;=cnnb
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://feed.snap.do/?publisher=SnapdoEMon&…q={searchTerms}
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://feed.snap.do/?publisher=SnapdoEMon&…q={searchTerms}
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://feed.snap.do/?publisher=SnapdoEMon&…p;searchtype=hp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://asus.msn.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,Default_Search_URL = http://feed.snap.do/?publisher=SnapdoEMon&…q={searchTerms}
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://feed.snap.do/?publisher=SnapdoEMon&…q={searchTerms}
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: (no name) - - (no file)
F2 - REG:system.ini: UserInit=userinit.exe
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files (x86)\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: InfoAtoms - {103089DA-0F31-4A8B-843F-7D24A7FE8345} - C:\Program Files (x86)\InfoAtoms\IE32\InfoAtomsClientIE.dll
O2 - BHO: Spybot-S&D; IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~2\SPYBOT~1\SDHelper.dll
O2 - BHO: RoboForm BHO - {724d43a9-0d85-11d4-9908-00400523e39a} - C:\Program Files (x86)\Siber Systems\AI RoboForm\roboform.dll
O2 - BHO: Java™ Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll
O2 - BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll
O3 - Toolbar: &RoboForm; Toolbar - {724d43a0-0d85-11d4-9908-00400523e39a} - C:\Program Files (x86)\Siber Systems\AI RoboForm\roboform.dll
O3 - Toolbar: m OpenOffice.us Search.us.com Toolbar - {D6BAE600-1E87-4E36-9327-03A07808E7ED} - C:\Users\Nancy\AppData\Local\TNT2\Profiles\10285\passport.dll
O4 - HKLM\..\Run: [Nuance PDF Reader-reminder] "C:\Program Files (x86)\Nuance\PDF Reader\Ereg\Ereg.exe" -r "C:\ProgramData\Nuance\PDF Reader\Ereg\Ereg.ini"
O4 - HKLM\..\Run: [ASUSPRP] "C:\Program Files (x86)\ASUS\APRP\APRP.EXE"
O4 - HKLM\..\Run: [ASUSWebStorage] C:\Program Files (x86)\ASUS\ASUS WebStorage\3.0.108.222\AsusWSPanel.exe /S
O4 - HKLM\..\Run: [SonicMasterTray] C:\Program Files (x86)\ASUS\Sonic Focus\SonicFocusTray.exe
O4 - HKLM\..\Run: [FLxHCIm] "C:\Program Files\Fresco Logic Inc\Fresco Logic USB3.0 Host Controller\host\FLxHCIm.exe"
O4 - HKLM\..\Run: [ATKOSD2] C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe
O4 - HKLM\..\Run: [ATKMEDIA] C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe
O4 - HKLM\..\Run: [HControlUser] C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControlUser.exe
O4 - HKLM\..\Run: [StopDefragment] Install\StopDefragment.exe
O4 - HKLM\..\Run: [APSDaemon] "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe"
O4 - HKLM\..\Run: [Wireless Console 3] C:\Program Files (x86)\ASUS\Wireless Console 3\wcourier.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files (x86)\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [PCLEUSBTip] C:\Program Files (x86)\Pinnacle\Shared Files\Programs\USBTip\USBTip.exe
O4 - HKLM\..\Run: [USBToolTip] "C:\Program Files (x86)\Pinnacle\Shared Files\\Programs\USBTip\USBTip.exe"
O4 - HKCU\..\Run: [DW7] "C:\Program Files (x86)\The Weather Channel\The Weather Channel App\TWCApp.exe"
O4 - HKCU\..\Run: [Weather] C:\Program Files (x86)\AWS\WeatherBug\Weather.exe 1
O4 - HKCU\..\Run: [PhotoshopElements8SyncAgent] C:\Program Files (x86)\Adobe\Elements Organizer 8.0\ElementsOrganizerSyncAgent.exe
O4 - HKCU\..\Run: [RoboForm] "C:\Program Files (x86)\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe"
O4 - HKCU\..\Run: [LaunchList] C:\Program Files (x86)\Pinnacle\Studio 11\LaunchList2.exe
O4 - Startup: EvernoteClipper.lnk = C:\Program Files (x86)\Evernote\Evernote\EvernoteClipper.exe
O4 - Startup: OpenOffice.org 3.1.lnk = C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe
O4 - Global Startup: AsusVibeLauncher.lnk = C:\Program Files (x86)\ASUS\AsusVibe\AsusVibeLauncher.exe
O4 - Global Startup: Event Reminder.lnk = C:\Program Files (x86)\The Print Shop 23.1\Remind.exe
O4 - Global Startup: FancyStart daemon.lnk = ?
O8 - Extra context menu item: Add to Evernote 4.0 - res://C:\Program Files (x86)\Evernote\Evernote\EvernoteIE.dll/204
O8 - Extra context menu item: Customize Menu - file://C:\Program Files (x86)\Siber Systems\AI RoboForm\RoboFormComCustomizeIEMenu.html
O8 - Extra context menu item: Fill Forms - file://C:\Program Files (x86)\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O8 - Extra context menu item: Save Forms - file://C:\Program Files (x86)\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O8 - Extra context menu item: Show RoboForm Toolbar - file://C:\Program Files (x86)\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O9 - Extra button: @C:\Program Files (x86)\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1004 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: @C:\Program Files (x86)\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1003 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Fill Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - C:\Program Files (x86)\Siber Systems\AI RoboForm\roboform.dll
O9 - Extra 'Tools' menuitem: Fill Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - C:\Program Files (x86)\Siber Systems\AI RoboForm\roboform.dll
O9 - Extra button: Save - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - C:\Program Files (x86)\Siber Systems\AI RoboForm\roboform.dll
O9 - Extra 'Tools' menuitem: Save Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - C:\Program Files (x86)\Siber Systems\AI RoboForm\roboform.dll
O9 - Extra button: Show Toolbar - {724d43aa-0d85-11d4-9908-00400523e39a} - C:\Program Files (x86)\Siber Systems\AI RoboForm\roboform.dll
O9 - Extra 'Tools' menuitem: Show RoboForm Toolbar - {724d43aa-0d85-11d4-9908-00400523e39a} - C:\Program Files (x86)\Siber Systems\AI RoboForm\roboform.dll
O9 - Extra button: @C:\Program Files (x86)\Evernote\Evernote\Resource.dll,-101 - {A95fe080-8f5d-11d2-a20b-00aa003c157a} - res://C:\Program Files (x86)\Evernote\Evernote\EvernoteIE.dll/204 (file missing)
O9 - Extra 'Tools' menuitem: @C:\Program Files (x86)\Evernote\Evernote\Resource.dll,-101 - {A95fe080-8f5d-11d2-a20b-00aa003c157a} - res://C:\Program Files (x86)\Evernote\Evernote\EvernoteIE.dll/204 (file missing)
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~2\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~2\SPYBOT~1\SDHelper.dll
O10 - Unknown file in Winsock LSP: c:\program files (x86)\common files\microsoft shared\windows live\wlidnsp.dll
O10 - Unknown file in Winsock LSP: c:\program files (x86)\common files\microsoft shared\windows live\wlidnsp.dll
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O18 - Protocol: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files (x86)\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll
O23 - Service: Adobe Active File Monitor V8 (AdobeActiveFileMonitor8.0) - Adobe Systems Incorporated - C:\Program Files (x86)\Adobe\Elements Organizer 8.0\PhotoshopElementsFileAgent.exe
O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
O23 - Service: AFBAgent - Unknown owner - C:\Windows\system32\FBAgent.exe (file missing)
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)
O23 - Service: Intel® Centrino® Bluetooth 3.0 + High Speed Service (AMPPALR3) - Intel Corporation - C:\Program Files\Intel\BluetoothHS\BTHSAmpPalService.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
O23 - Service: ASLDR Service (ASLDRService) - ASUS - C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\ASLDRSrv.exe
O23 - Service: ATKGFNEX Service (ATKGFNEXSrv) - ASUS - C:\Program Files (x86)\ASUS\ATK Package\ATKGFNEX\GFNEXSrv.exe
O23 - Service: Bluetooth Device Monitor - Intel Corporation - C:\Program Files (x86)\Intel\Bluetooth\devmonsrv.exe
O23 - Service: Bluetooth Media Service - Intel Corporation - C:\Program Files (x86)\Intel\Bluetooth\mediasrv.exe
O23 - Service: Bluetooth OBEX Service - Intel Corporation - C:\Program Files (x86)\Intel\Bluetooth\obexsrv.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Intel® Centrino® Wireless Bluetooth® 3.0 + High Speed Security Service (BTHSSecurityMgr) - Intel® Corporation - C:\Program Files\Intel\BluetoothHS\BTHSSecurityMgr.exe
O23 - Service: Intel® Content Protection HECI Service (cphs) - Intel Corporation - C:\Windows\SysWow64\IntelCpHeciSvc.exe
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing)
O23 - Service: Intel® PROSet/Wireless Event Log (EvtEng) - Intel® Corporation - C:\Program Files\Intel\WiFi\bin\EvtEng.exe
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing)
O23 - Service: FLEXnet Licensing Service - Acresso Software Inc. - C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: GoodSync Server (GsServer) - Unknown owner - C:\Program Files\Siber Systems\GoodSync\Gs-Server.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: lmab_device - Unknown owner - C:\Windows\system32\LMabcoms.exe (file missing)
O23 - Service: lxdxCATSCustConnectService - Lexmark International, Inc. - C:\Windows\system32\spool\DRIVERS\x64\3\\lxdxserv.exe
O23 - Service: lxdx_device - - C:\Windows\system32\lxdxcoms.exe
O23 - Service: MBAMScheduler - Malwarebytes Corporation - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe
O23 - Service: MBAMService - Malwarebytes Corporation - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
O23 - Service: Mozilla Maintenance Service (MozillaMaintenance) - Mozilla Foundation - C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)
O23 - Service: Wireless PAN DHCP Server (MyWiFiDHCPDNS) - Unknown owner - C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: PCLEPCI - Pinnacle Systems GmbH - C:\Windows\SysWOW64\drivers\pclepci.sys
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Intel® PROSet/Wireless Registry Service (RegSrvc) - Intel® Corporation - C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: SBSD Security Center Service (SBSDWSCService) - Safer Networking Ltd. - C:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing)
O23 - Service: Intel® Turbo Boost Technology Monitor (TurboBoost) - Intel® Corporation - C:\Program Files\Intel\TurboBoost\TurboBoost.exe
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\Wat\WatUX.exe,-601 (WatAdminSvc) - Unknown owner - C:\Windows\system32\Wat\WatAdminSvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)

–
End of file - 17431 bytes

.
DDS (Ver_11-03-05.01) - NTFS_AMD64
Run by [removed] at 10:28:53.39 on Thu 01/03/2013
Internet Explorer: 9.0.8112.16421 BrowserJavaVersion: 10.9.2
Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.8103.4293 [GMT -5:00]
.
AV: Microsoft Security Essentials *Enabled/Updated* {B140BF4E-23BB-4198-90AB-A51A4C60A69C}
SP: Microsoft Security Essentials *Enabled/Updated* {0A215EAA-0581-4E16-AA1B-9E6837E7EC21}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
============== Running Processes ===============
.
C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\svchost.exe -k RPCSS
C:\Program Files\Microsoft Security Client\MsMpEng.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\system32\WLANExt.exe
C:\Windows\system32\FBAgent.exe
C:\Windows\system32\conhost.exe
C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\ASLDRSrv.exe
C:\Program Files (x86)\ASUS\ATK Package\ATKGFNEX\GFNEXSrv.exe
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Program Files (x86)\Adobe\Elements Organizer 8.0\PhotoshopElementsFileAgent.exe
C:\Program Files\Intel\BluetoothHS\BTHSAmpPalService.exe
C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
C:\Program Files (x86)\Intel\Bluetooth\devmonsrv.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Windows\system32\svchost.exe -k bthsvcs
C:\Program Files\Intel\BluetoothHS\BTHSSecurityMgr.exe
C:\Program Files\Intel\WiFi\bin\EvtEng.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
C:\Program Files\Siber Systems\GoodSync\Gs-Server.exe
C:\Windows\system32\lxdxcoms.exe
C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe
C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
C:\Program Files\Intel\TurboBoost\TurboBoost.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
C:\Program Files (x86)\Intel\Bluetooth\obexsrv.exe
C:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
C:\Windows\system32\taskhost.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\wbem\unsecapp.exe
C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe
C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControl.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\ATKOSD.exe
C:\Program Files\Microsoft Security Client\NisSrv.exe
C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\KBFiltr.exe
C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\WDC.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\Windows\system32\taskeng.exe
C:\Program Files (x86)\ASUS\ASUS Live Update\ALU.exe
C:\Windows\system32\taskeng.exe
C:\Program Files (x86)\ASUS\SmartLogon\sensorsrv.exe
C:\Program Files\ASUS\ASUS Secure Delete\ADDEL.exe
C:\Program Files\P4G\BatteryLife.exe
C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe
C:\WINDOWS\System32\dinotify.exe
C:\Program Files (x86)\ASUS\Splendid\ACMON.exe
C:\Windows\System32\rundll32.exe
C:\Windows\SysWOW64\ACEngSvr.exe
C:\Windows\AsScrPro.exe
C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe
C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Windows\system32\SearchIndexer.exe
C:\Program Files (x86)\AmIcoSingLun\AmIcoSinglun64.exe
C:\Program Files\Elantech\ETDCtrl.exe
C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
C:\Program Files\Microsoft Security Client\msseces.exe
C:\Windows\System32\igfxtray.exe
C:\Windows\System32\igfxpers.exe
C:\Program Files (x86)\Lexmark 3600-4600 Series\lxdxmon.exe
C:\Program Files (x86)\AWS\WeatherBug\Weather.exe
C:\Program Files (x86)\Adobe\Elements Organizer 8.0\ElementsOrganizerSyncAgent.exe
C:\Program Files (x86)\Siber Systems\AI RoboForm\robotaskbaricon.exe
C:\Program Files (x86)\Lexmark 3600-4600 Series\lxdxMsdMon.exe
C:\Program Files (x86)\ASUS\Sonic Focus\SonicFocusTray.exe
C:\Program Files\Fresco Logic Inc\Fresco Logic USB3.0 Host Controller\host\FLxHCIm.exe
C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe
C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControlUser.exe
C:\Program Files (x86)\ASUS\Wireless Console 3\wcourier.exe
C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
C:\Program Files (x86)\iTunes\iTunesHelper.exe
C:\Program Files (x86)\Pinnacle\Shared Files\Programs\USBTip\USBTip.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Elantech\ETDCtrlHelper.exe
C:\Windows\System32\svchost.exe -k LocalServicePeerNet
C:\Program Files (x86)\Intel\Bluetooth\mediasrv.exe
C:\Program Files (x86)\Intel\Bluetooth\BTPlayerCtrl.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Program Files (x86)\Evernote\Evernote\EvernoteClipper.exe
C:\Program Files (x86)\OpenOffice.org 3\program\soffice.exe
C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin
C:\Program Files (x86)\Mozilla Firefox\firefox.exe
C:\Program Files (x86)\Common Files\Apple\Apple Application Support\distnoted.exe
C:\Windows\system32\conhost.exe
C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe
C:\Windows\System32\WUDFHost.exe
C:\Program Files (x86)\iTunes\iTunes.exe
C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceHelper.exe
C:\Windows\system32\conhost.exe
C:\Windows\splwow64.exe
C:\Program Files (x86)\Evernote\Evernote\Evernote.exe
C:\Program Files (x86)\Evernote\Evernote\EvernoteTray.exe
C:\Program Files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe
C:\Program Files\Microsoft Games\Mahjong\Mahjong.exe
C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe
C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_5_502_135.exe
C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_5_502_135.exe
C:\Users\Nancy\Downloads\OTL.exe
C:\Users\Nancy\Downloads\HiJackThis.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\SearchProtocolHost.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe
C:\Users\Nancy\Downloads\dds.scr
C:\Windows\system32\conhost.exe
.
============== Pseudo HJT Report ===============
.
uSearch Page = hxxp://feed.snap.do/?publisher=SnapdoEMon&dpid;=SnapdoEMon&co;=US&userid;=be6fed9d-a96a-4d3e-8869-28d26d99fbfc&searchtype;=ds&q;={searchTerms}
uDefault_Page_URL = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp;=iehome&locale;=en_us&c;=83&bd;=Pavilion&pf;=cnnb
uStart Page = hxxp://feed.snap.do/?publisher=SnapdoEMon&dpid;=SnapdoEMon&co;=US&userid;=be6fed9d-a96a-4d3e-8869-28d26d99fbfc&searchtype;=hp
uSearch Bar = hxxp://feed.snap.do/?publisher=SnapdoEMon&dpid;=SnapdoEMon&co;=US&userid;=be6fed9d-a96a-4d3e-8869-28d26d99fbfc&searchtype;=ds&q;={searchTerms}
mStart Page = hxxp://asus.msn.com
uInternet Settings,ProxyOverride = *.local
uSearchAssistant = hxxp://feed.snap.do/?publisher=SnapdoEMon&dpid;=SnapdoEMon&co;=US&userid;=be6fed9d-a96a-4d3e-8869-28d26d99fbfc&searchtype;=ds&q;={searchTerms}
uURLSearchHooks: H - No File
mWinlogon: Userinit=userinit.exe
BHO: AcroIEHlprObj Class: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - C:\Program Files (x86)\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
BHO: InfoAtoms: {103089da-0f31-4a8b-843f-7d24a7fe8345} - C:\Program Files (x86)\InfoAtoms\IE32\InfoAtomsClientIE.dll
BHO: Spybot-S&D; IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - C:\PROGRA~2\SPYBOT~1\SDHelper.dll
BHO: RoboForm Toolbar Helper: {724d43a9-0d85-11d4-9908-00400523e39a} - C:\Program Files (x86)\Siber Systems\AI RoboForm\roboform.dll
BHO: Java™ Plug-In SSV Helper: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll
BHO: Windows Live ID Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll
TB: &RoboForm; Toolbar: {724d43a0-0d85-11d4-9908-00400523e39a} - C:\Program Files (x86)\Siber Systems\AI RoboForm\roboform.dll
TB: m OpenOffice.us Search.us.com Toolbar: {d6bae600-1e87-4e36-9327-03a07808e7ed} - C:\Users\Nancy\AppData\Local\TNT2\Profiles\10285\passport.dll
TB: {1017A80C-6F09-4548-A84D-EDD6AC9525F0} - No File
TB: {D4027C7F-154A-4066-A1AD-4243D8127440} - No File
uRun: [DW7] "C:\Program Files (x86)\The Weather Channel\The Weather Channel App\TWCApp.exe"
uRun: [Weather] C:\Program Files (x86)\AWS\WeatherBug\Weather.exe 1
uRun: [PhotoshopElements8SyncAgent] C:\Program Files (x86)\Adobe\Elements Organizer 8.0\ElementsOrganizerSyncAgent.exe
uRun: [RoboForm] "C:\Program Files (x86)\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe"
uRun: [LaunchList] C:\Program Files (x86)\Pinnacle\Studio 11\LaunchList2.exe
mRun: [Nuance PDF Reader-reminder] "C:\Program Files (x86)\Nuance\PDF Reader\Ereg\Ereg.exe" -r "C:\ProgramData\Nuance\PDF Reader\Ereg\Ereg.ini"
mRun: [ASUSPRP] "C:\Program Files (x86)\ASUS\APRP\APRP.EXE"
mRun: [ASUSWebStorage] C:\Program Files (x86)\ASUS\ASUS WebStorage\3.0.108.222\AsusWSPanel.exe /S
mRun: [SonicMasterTray] C:\Program Files (x86)\ASUS\Sonic Focus\SonicFocusTray.exe
mRun: [FLxHCIm] "C:\Program Files\Fresco Logic Inc\Fresco Logic USB3.0 Host Controller\host\FLxHCIm.exe"
mRun: [ATKOSD2] C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe
mRun: [ATKMEDIA] C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe
mRun: [HControlUser] C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControlUser.exe
mRun: [StopDefragment] Install\StopDefragment.exe
mRun: [APSDaemon] "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe"
mRun: [Wireless Console 3] C:\Program Files (x86)\ASUS\Wireless Console 3\wcourier.exe
mRun: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
mRun: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime
mRun: [iTunesHelper] "C:\Program Files (x86)\iTunes\iTunesHelper.exe"
mRun: [PCLEUSBTip] C:\Program Files (x86)\Pinnacle\Shared Files\Programs\USBTip\USBTip.exe
mRun: [USBToolTip] "C:\Program Files (x86)\Pinnacle\Shared Files\\Programs\USBTip\USBTip.exe"
StartupFolder: C:\Users\Nancy\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\EVERNO~1.LNK - C:\Program Files (x86)\Evernote\Evernote\EvernoteClipper.exe
StartupFolder: C:\Users\Nancy\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\OPENOF~1.LNK - C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe
StartupFolder: C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\Startup\ASUSVI~1.LNK - C:\Program Files (x86)\ASUS\AsusVibe\AsusVibeLauncher.exe
StartupFolder: C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\Startup\EVENTR~1.LNK - C:\Program Files (x86)\The Print Shop 23.1\Remind.exe
StartupFolder: C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\Startup\FANCYS~1.LNK - C:\Windows\Installer\{C944B4C5-1C4D-4D95-8AC0-7CEF13914131}\_77B5857C27147149171BE7.exe
mPolicies-explorer: NoActiveDesktop = 1 (0x1)
mPolicies-explorer: NoActiveDesktopChanges = 1 (0x1)
mPolicies-system: ConsentPromptBehaviorAdmin = 5 (0x5)
mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3)
mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
IE: Add to Evernote 4.0 - C:\Program Files (x86)\Evernote\Evernote\EvernoteIE.dll/204
IE: Customize Menu - file://C:\Program Files (x86)\Siber Systems\AI RoboForm\RoboFormComCustomizeIEMenu.html
IE: Fill Forms - file://C:\Program Files (x86)\Siber Systems\AI RoboForm\RoboFormComFillForms.html
IE: Save Forms - file://C:\Program Files (x86)\Siber Systems\AI RoboForm\RoboFormComSavePass.html
IE: Show RoboForm Toolbar - file://C:\Program Files (x86)\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
IE: {A95fe080-8f5d-11d2-a20b-00aa003c157a} - res://C:\Program Files (x86)\Evernote\Evernote\EvernoteIE.dll/204
IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
IE: {320AF880-6646-11D3-ABEE-C5DBF3571F46} - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - C:\Program Files (x86)\Siber Systems\AI RoboForm\roboform.dll
IE: {320AF880-6646-11D3-ABEE-C5DBF3571F49} - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - C:\Program Files (x86)\Siber Systems\AI RoboForm\roboform.dll
IE: {724d43aa-0d85-11d4-9908-00400523e39a} - {724d43aa-0d85-11d4-9908-00400523e39a} - C:\Program Files (x86)\Siber Systems\AI RoboForm\roboform.dll
IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~2\SPYBOT~1\SDHelper.dll
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_23-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab
Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files (x86)\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll
BHO-X64: RoboForm Toolbar Helper: {724d43a9-0d85-11d4-9908-00400523e39a} - C:\Program Files (x86)\Siber Systems\AI RoboForm\RoboForm-x64.dll
BHO-X64: RoboForm BHO - No File
BHO-X64: Windows Live ID Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
TB-X64: &RoboForm; Toolbar: {724d43a0-0d85-11d4-9908-00400523e39a} - C:\Program Files (x86)\Siber Systems\AI RoboForm\RoboForm-x64.dll
TB-X64: m OpenOffice.us Search.us.com Toolbar: {D6BAE600-1E87-4E36-9327-03A07808E7ED} - C:\Users\Nancy\AppData\Local\TNT2\Profiles\10285\passport64.dll
TB-X64: {1017A80C-6F09-4548-A84D-EDD6AC9525F0} - No File
TB-X64: {D4027C7F-154A-4066-A1AD-4243D8127440} - No File
mRun-x64: [AmIcoSinglun64] C:\Program Files (x86)\AmIcoSingLun\AmIcoSinglun64.exe
mRun-x64: [ETDCtrl] %ProgramFiles%\Elantech\ETDCtrl.exe
mRun-x64: [IntelPAN] "C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe" /tf Intel PAN Tray
mRun-x64: [BTMTrayAgent] rundll32.exe "C:\Program Files (x86)\Intel\Bluetooth\btmshell.dll",TrayApp
mRun-x64: [IntelTBRunOnce] wscript.exe //b //nologo "C:\Program Files\Intel\TurboBoost\RunTBGadgetOnce.vbs"
mRun-x64: [RtHDVBg] C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe /SF3
mRun-x64: [MSC] "C:\Program Files\Microsoft Security Client\msseces.exe" -hide -runkey
mRun-x64: [IgfxTray] C:\Windows\system32\igfxtray.exe
mRun-x64: [HotKeysCmds] C:\Windows\system32\hkcmd.exe
mRun-x64: [Persistence] C:\Windows\system32\igfxpers.exe
mRun-x64: [lxdxmon.exe] "C:\Program Files (x86)\Lexmark 3600-4600 Series\lxdxmon.exe"
mRun-x64: [lxdxamon] "C:\Program Files (x86)\Lexmark 3600-4600 Series\lxdxamon.exe"
Hosts: 127.0.0.1 www.spywareinfo.com
.
================= FIREFOX ===================
.
FF - ProfilePath - C:\Users\Nancy\AppData\Roaming\Mozilla\Firefox\Profiles\pqxe4c84.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2260173&SearchSource;=3&q;={searchTerms}
FF - prefs.js: browser.search.selectedEngine - Swag Bucks Customized Web Search
FF - prefs.js: browser.startup.homepage - hxxp://us-mg4.mail.yahoo.com/neo/launch?.rand=26gi0q9rci4qq
FF - prefs.js: keyword.URL - hxxp://search.mywebsearch.com/mywebsearch/GGmain.jhtml?st=kwd&ptb;=7CDECB22-5BC9-4D82-B776-089F52FF5B93&n;=77ee89a9&ind;=2012121513&p2;=^YK^xdm149^YY^us&si;=455002&searchfor;=
FF - plugin: C:\Program Files (x86)\Amazon\MP3 Downloader\npAmazonMP3DownloaderPlugin1017300.dll
FF - plugin: C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll
FF - plugin: C:\Program Files (x86)\Microsoft Silverlight\5.1.10411.0\npctrlui.dll
FF - plugin: C:\Program Files (x86)\Mozilla Firefox\plugins\NPcol400.dll
FF - plugin: C:\Program Files (x86)\Mozilla Firefox\plugins\npCouponPrinter.dll
FF - plugin: C:\Program Files (x86)\Mozilla Firefox\plugins\npMozCouponPrinter.dll
FF - plugin: C:\Program Files (x86)\Nuance\PDF Reader\bin\nppdf.dll
FF - plugin: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll
FF - plugin: C:\Users\Nancy\AppData\Local\TNT2\2.0.0.1267\npTNT2Ghost.dll
FF - plugin: C:\Users\Nancy\AppData\Local\TNT2\2.0.0.1378\npTNT2.dll
FF - plugin: C:\Users\Nancy\AppData\Local\TNT2\2.0.0.1378\npTNT2Ghost.dll
FF - plugin: C:\Users\Nancy\AppData\Roaming\Mozilla\Firefox\Profiles\pqxe4c84.default\extensions\[removed]\plugins\npCoralIETab.dll
FF - plugin: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_5_502_135.dll
FF - plugin: C:\Windows\SysWOW64\npDeployJava1.dll
FF - plugin: C:\Windows\SysWOW64\npmproxy.dll
.
—- FIREFOX POLICIES —-
FF - user.js: extentions.y2layers.installId - 6201096d-6e55-4316-8044-ed3bdeb790b5
FF - user.js: extentions.y2layers.defaultEnableAppsList - pagerage,buzzdock,bestvideodownloader,ezlooker,dropdowndeals,twittube,toprelated
topics,interstitialads
.
FF - user.js: extensions.autoDisableScopes - 14
FF - user.js: security.csp.enable - false
.
============= SERVICES / DRIVERS ===============
.
R0 assd;assd;C:\Windows\System32\drivers\assd.sys [2011-12-6 27264]
R0 MpFilter;Microsoft Malware Protection Driver;C:\Windows\System32\drivers\MpFilter.sys [2012-8-30 228768]
R0 PxHlpa64;PxHlpa64;C:\Windows\System32\drivers\PxHlpa64.sys [2012-9-4 55024]
R1 ATKWMIACPIIO;ATKWMIACPI Driver;C:\Program Files (x86)\ASUS\ATK Package\ATK WMIACPI\atkwmiacpi64.sys [2010-7-26 17024]
R1 vwififlt;Virtual WiFi Filter Driver;C:\Windows\System32\drivers\vwififlt.sys [2009-7-13 59904]
R2 AdobeActiveFileMonitor8.0;Adobe Active File Monitor V8;C:\Program Files (x86)\Adobe\Elements Organizer 8.0\PhotoshopElementsFileAgent.exe [2009-9-6 169312]
R2 AFBAgent;AFBAgent;C:\Windows\System32\FBAgent.exe [2011-12-6 379520]
R2 AMPPALR3;Intel® Centrino® Bluetooth 3.0 + High Speed Service;C:\Program Files\Intel\BluetoothHS\BTHSAmpPalService.exe [2011-3-22 1136128]
R2 ASMMAP64;ASMMAP64;C:\Program Files (x86)\ASUS\ATK Package\ATKGFNEX\ASMMAP64.sys [2009-7-2 15416]
R2 Bluetooth Device Monitor;Bluetooth Device Monitor;C:\Program Files (x86)\Intel\Bluetooth\devmonsrv.exe [2011-3-30 923984]
R2 Bluetooth OBEX Service;Bluetooth OBEX Service;C:\Program Files (x86)\Intel\Bluetooth\obexsrv.exe [2011-3-30 1001808]
R2 BTHSSecurityMgr;Intel® Centrino® Wireless Bluetooth® 3.0 + High Speed Security Service;C:\Program Files\Intel\BluetoothHS\BTHSSecurityMgr.exe [2011-2-23 134928]
R2 GsServer;GoodSync Server;C:\Program Files\Siber Systems\GoodSync\Gs-Server.exe [2012-1-26 4674488]
R2 lxdx_device;lxdx_device;C:\Windows\system32\lxdxcoms.exe -service –> C:\Windows\system32\lxdxcoms.exe -service [?]
R2 MBAMScheduler;MBAMScheduler;C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [2012-9-25 398184]
R2 MBAMService;MBAMService;C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2012-4-24 682344]
R2 NisDrv;Microsoft Network Inspection System;C:\Windows\System32\drivers\NisDrvWFP.sys [2011-4-27 128456]
R2 SBSDWSCService;SBSD Security Center Service;C:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe [2012-2-3 1153368]
R2 TurboB;Turbo Boost UI Monitor driver;C:\Windows\System32\drivers\TurboB.sys [2010-4-16 13832]
R2 TurboBoost;Intel® Turbo Boost Technology Monitor;C:\Program Files\Intel\TurboBoost\TurboBoost.exe [2010-4-16 134928]
R3 AMPPAL;Intel® Centrino® Bluetooth 3.0 + High Speed Virtual Adapter;C:\Windows\System32\drivers\AmpPal.sys [2011-3-22 261632]
R3 Bluetooth Media Service;Bluetooth Media Service;C:\Program Files (x86)\Intel\Bluetooth\mediasrv.exe [2011-3-30 1321296]
R3 btmaux;Intel Bluetooth Auxiliary Service;C:\Windows\System32\drivers\btmaux.sys [2011-3-8 51712]
R3 btmhsf;btmhsf;C:\Windows\System32\drivers\btmhsf.sys [2011-11-15 327168]
R3 ETD;ELAN PS/2 Port Input Device;C:\Windows\System32\drivers\ETD.sys [2011-5-26 138024]
R3 FLxHCIc;Fresco Logic xHCI (USB3) Device Driver;C:\Windows\System32\drivers\FLxHCIc.sys [2011-4-8 177152]
R3 FLxHCIh;Fresco Logic xHCI (USB3) Hub Device Driver;C:\Windows\System32\drivers\FLxHCIh.sys [2011-4-8 56320]
R3 iBtFltCoex;iBtFltCoex;C:\Windows\System32\drivers\iBtFltCoex.sys [2011-12-9 60416]
R3 IntcDAud;Intel® Display Audio;C:\Windows\System32\drivers\IntcDAud.sys [2011-5-26 317440]
R3 iwdbus;IWD Bus Enumerator;C:\Windows\System32\drivers\iwdbus.sys [2011-3-24 25496]
R3 L1C;NDIS Miniport Driver for Atheros AR813x/AR815x PCI-E Ethernet Controller;C:\Windows\System32\drivers\L1C62x64.sys [2011-5-26 76912]
R3 MBAMProtector;MBAMProtector;C:\Windows\System32\drivers\mbam.sys [2012-4-24 24176]
R3 MEIx64;Intel® Management Engine Interface ;C:\Windows\System32\drivers\HECIx64.sys [2010-10-19 56344]
R3 NETwNs64;___ Intel® Wireless WiFi Link 5000 Series Adapter Driver for Windows 7 - 64 Bit;C:\Windows\System32\drivers\NETwNs64.sys [2011-5-1 8593920]
R3 NisSrv;Microsoft Network Inspection;C:\Program Files\Microsoft Security Client\NisSrv.exe [2012-9-12 368896]
R3 vwifimp;Microsoft Virtual WiFi Miniport Service;C:\Windows\System32\drivers\vwifimp.sys [2009-7-13 17920]
R3 wdkmd;Intel WiDi KMD;C:\Windows\System32\drivers\WDKMD.sys [2011-3-24 42392]
R3 WSDPrintDevice;WSD Print Support via UMB;C:\Windows\System32\drivers\WSDPrint.sys [2009-7-13 23040]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]
S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-3-18 138576]
S2 lxdxCATSCustConnectService;lxdxCATSCustConnectService;C:\Windows\System32\spool\drivers\x64\3\lxdxserv.exe [2012-9-6 29184]
S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-4-2 250808]
S3 AMPPALP;Intel® Centrino® Bluetooth 3.0 + High Speed Protocol;C:\Windows\System32\drivers\AmpPal.sys [2011-3-22 261632]
S3 AmUStor;AM USB Stroage Driver;C:\Windows\System32\drivers\AmUStor.sys [2010-5-2 44032]
S3 cphs;Intel® Content Protection HECI Service;C:\Windows\SysWOW64\IntelCpHeciSvc.exe [2012-3-19 276248]
S3 fssfltr;fssfltr;C:\Windows\System32\drivers\fssfltr.sys [2011-10-17 48488]
S3 fsssvc;Windows Live Family Safety Service;C:\Program Files (x86)\Windows Live\Family Safety\fsssvc.exe [2011-5-13 1492840]
S3 intaud_WaveExtensible;Intel WiDi Audio Device;C:\Windows\System32\drivers\intelaud.sys [2011-3-24 34200]
S3 MozillaMaintenance;Mozilla Maintenance Service;C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe [2012-4-26 115168]
S3 MyWiFiDHCPDNS;Wireless PAN DHCP Server;C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe [2011-5-2 340240]
S3 SiSGbeLH;SiS191/SiS190 Ethernet Device NDIS 6.0 Driver;C:\Windows\System32\drivers\SiSG664.sys [2009-6-10 56832]
S3 TsUsbFlt;TsUsbFlt;C:\Windows\System32\drivers\TsUsbFlt.sys [2011-2-18 59392]
S3 TsUsbGD;Remote Desktop Generic USB Device;C:\Windows\System32\drivers\TsUsbGD.sys [2011-2-18 31232]
S3 USBAAPL64;Apple Mobile USB Driver;C:\Windows\System32\drivers\usbaapl64.sys [2012-9-28 53760]
S3 WatAdminSvc;Windows Activation Technologies Service;C:\Windows\System32\Wat\WatAdminSvc.exe [2012-1-28 1255736]
S4 wlcrasvc;Windows Live Mesh remote connections service;C:\Program Files\Windows Live\Mesh\wlcrasvc.exe [2010-9-22 57184]
.
=============== Created Last 30 ================
.
2013-01-03 15:10:02 76232 —-a-w- C:\PROGRA~3\Microsoft\Microsoft Antimalware\Definition Updates\{8F4A2D49-4F21-43E7-871B-9308D513E644}\offreg.dll
2013-01-03 11:24:09 9125352 —-a-w- C:\PROGRA~3\Microsoft\Microsoft Antimalware\Definition Updates\{8F4A2D49-4F21-43E7-871B-9308D513E644}\mpengine.dll
2013-01-02 11:48:15 9125352 ——w- C:\PROGRA~3\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
2013-01-01 12:57:31 153088 —-a-w- C:\Program Files (x86)\UNWISE.EXE
2013-01-01 01:37:58 ——– d—–w- C:\Studio Plus Vista Installer
2012-12-31 18:27:14 ——– d—–w- C:\Users\Nancy\AppData\Roaming\MOVAVI
2012-12-31 16:41:46 ——– d—–w- C:\Program Files (x86)\MSXML 4.0
2012-12-31 16:22:34 ——– d—–w- C:\Users\Nancy\AppData\Local\Programs
2012-12-31 13:01:49 810496 —-a-w- C:\Windows\System32\xvidcore.dll
2012-12-31 13:01:49 80896 —-a-w- C:\Windows\System32\ff_vfw.dll
2012-12-31 13:01:49 183808 —-a-w- C:\Windows\System32\xvidvfw.dll
2012-12-31 13:01:37 389120 —-a-w- C:\Windows\SysWow64\actskn43.ocx
2012-12-31 13:01:37 389120 —-a-w- C:\Windows\System32\actskn43.ocx
2012-12-31 12:57:22 ——– d—–w- C:\Program Files (x86)\InfoAtoms
2012-12-30 14:00:24 14326712 —-a-w- C:\Windows\SysWow64\drivers\Pinnacle_Video_Driver_32bit.exe
2012-12-30 14:00:24 11878776 —-a-w- C:\Windows\SysWow64\drivers\Pinnacle_Video_Driver_64bit.exe
2012-12-30 14:00:24 ——– d—–w- C:\Windows\SysWow64\InstantDVDRecorder
2012-12-30 13:49:40 ——– d—–w- C:\temp
2012-12-30 13:24:34 401408 —-a-w- C:\Windows\SysWow64\pvmjpg30.dll
2012-12-30 13:24:33 82432 —-a-w- C:\Windows\SysWow64\msxml4r.dll
2012-12-30 13:24:33 44544 —-a-w- C:\Windows\SysWow64\msxml4a.dll
2012-12-30 13:24:32 1712128 —-a-w- C:\Windows\SysWow64\GDIPLUS.DLL
2012-12-30 13:21:56 729088 —-a-w- C:\Program Files (x86)\Common Files\InstallShield\Professional\RunTime\09\01\Intel32\iKernel.dll
2012-12-30 13:21:56 69715 —-a-w- C:\Program Files (x86)\Common Files\InstallShield\Professional\RunTime\09\01\Intel32\ctor.dll
2012-12-30 13:21:56 5632 —-a-w- C:\Program Files (x86)\Common Files\InstallShield\Professional\RunTime\09\01\Intel32\DotNetInstaller.exe
2012-12-30 13:21:56 266240 —-a-w- C:\Program Files (x86)\Common Files\InstallShield\Professional\RunTime\09\01\Intel32\iscript.dll
2012-12-30 13:21:56 192512 —-a-w- C:\Program Files (x86)\Common Files\InstallShield\Professional\RunTime\09\01\Intel32\iuser.dll
2012-12-30 13:21:55 311428 —-a-w- C:\Program Files (x86)\Common Files\InstallShield\Professional\RunTime\09\01\Intel32\setup.dll
2012-12-30 13:21:55 188548 —-a-w- C:\Program Files (x86)\Common Files\InstallShield\Professional\RunTime\09\01\Intel32\iGdi.dll
2012-12-30 13:16:14 ——– d—–w- C:\PROGRA~3\Pinnacle Studio
2012-12-29 19:24:32 70656 —-a-w- C:\Windows\System32\PCLECoInst64.dll
2012-12-29 19:24:31 6400 —-a-w- C:\Windows\System32\drivers\emFilter64.sys
2012-12-29 19:24:31 6144 —-a-w- C:\Windows\System32\drivers\emScan64.sys
2012-12-29 19:24:31 57344 —-a-w- C:\Windows\SysWow64\emVFW.dll
2012-12-29 19:24:31 32768 —-a-w- C:\Windows\SysWow64\emProp.ax
2012-12-29 19:24:31 215808 —-a-w- C:\Windows\System32\drivers\emDevice64.sys
2012-12-29 19:24:31 17808 —-a-w- C:\Windows\SysWow64\emYUV.dll
2012-12-29 19:24:31 13824 —-a-w- C:\Windows\System32\emUSD64.dll
2012-12-29 19:24:28 79872 —-a-w- C:\Windows\System32\drivers\emAudio64.sys
2012-12-29 19:24:03 ——– d—–w- C:\Program Files (x86)\Common Files\Pinnacle
2012-12-29 19:23:15 ——– d—–w- C:\Users\Nancy\AppData\Local\Downloaded Installations
2012-12-29 16:59:07 ——– d—–w- C:\Users\Nancy\AppData\Local\Pinnacle
2012-12-29 16:53:03 73728 ——w- C:\Windows\SysWow64\MMAviAx.dll
2012-12-29 16:53:03 41984 —-a-w- C:\Windows\SysWow64\cacheX.dll
2012-12-29 16:53:03 32768 ——w- C:\Windows\SysWow64\MLPagAx.dll
2012-12-29 16:53:03 233472 ——w- C:\Windows\SysWow64\DiskIO.dll
2012-12-29 16:53:03 184320 ——w- C:\Windows\SysWow64\RALMain.dll
2012-12-29 16:53:03 126976 ——w- C:\Windows\SysWow64\AVIPrAx.dll
2012-12-29 16:49:59 487424 —-a-w- C:\Windows\SysWow64\MSVCP70.DLL
2012-12-29 16:49:58 89088 ——w- C:\Windows\SysWow64\atl71.dll
2012-12-29 16:49:58 84992 ——w- C:\Windows\SysWow64\ATL70.DLL
2012-12-29 16:49:58 344064 —-a-w- C:\Windows\SysWow64\MSVCR70.DLL
2012-12-29 16:48:30 ——– d—–w- C:\Program Files (x86)\Pinnacle
2012-12-27 15:53:21 ——– d—–w- C:\Users\Nancy\AppData\Roaming\Red Kawa
2012-12-27 14:49:52 ——– d—–w- C:\Users\Nancy\AppData\Local\Geckofx
2012-12-27 14:49:39 ——– d—–w- C:\Program Files (x86)\Regensoft
2012-12-27 14:49:36 ——– d—–w- C:\Program Files (x86)\AviSynth 2.5
2012-12-27 14:49:30 ——– d—–w- C:\Program Files (x86)\Red Kawa
2012-12-27 13:40:12 ——– d—–w- C:\Users\Nancy\AppData\Local\{5BEE5DF1-E1B2-4221-8EA6-8FB65E6CD25A}
2012-12-24 10:40:35 34304 —-a-w- C:\Windows\SysWow64\atmlib.dll
2012-12-24 10:40:34 46080 —-a-w- C:\Windows\System32\atmlib.dll
2012-12-24 10:40:31 367616 —-a-w- C:\Windows\System32\atmfd.dll
2012-12-24 10:40:28 295424 —-a-w- C:\Windows\SysWow64\atmfd.dll
2012-12-18 12:31:33 ——– d—–w- C:\Program Files\iPod
2012-12-18 12:31:30 ——– d—–w- C:\Program Files\iTunes
2012-12-18 12:31:30 ——– d—–w- C:\Program Files (x86)\iTunes
2012-12-18 12:31:30 ——– d—–w- C:\PROGRA~3\34BE82C4-E596-4e99-A191-52C6199EBF69
2012-12-12 13:20:00 2382848 —-a-w- C:\Windows\System32\mshtml.tlb
2012-12-12 13:12:31 6030901 —-a-w- C:\PROGRA~3\SPLCC36.tmp
2012-12-12 11:17:12 2048 —-a-w- C:\Windows\SysWow64\tzres.dll
2012-12-12 11:17:12 2048 —-a-w- C:\Windows\System32\tzres.dll
2012-12-12 11:17:06 3149824 —-a-w- C:\Windows\System32\win32k.sys
2012-12-08 12:39:52 ——– d—–w- C:\Users\Nancy\AppData\Local\{62530663-E778-4D94-9DFA-237FE2EAC0BB}
.
==================== Find3M ====================
.
2013-01-01 12:06:41 45056 —-a-w- C:\Windows\System32\acovcnt.exe
2012-12-14 21:49:28 24176 —-a-w- C:\Windows\System32\drivers\mbam.sys
2012-12-12 14:48:26 73656 —-a-w- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl
2012-12-12 14:48:26 697272 —-a-w- C:\Windows\SysWow64\FlashPlayerApp.exe
2012-12-02 20:41:05 223539 —-a-w- C:\PROGRA~3\SPLCEFD.tmp
2012-11-14 06:11:44 2312704 —-a-w- C:\Windows\System32\jscript9.dll
2012-11-14 06:04:11 1392128 —-a-w- C:\Windows\System32\wininet.dll
2012-11-14 06:02:49 1494528 —-a-w- C:\Windows\System32\inetcpl.cpl
2012-11-14 05:57:46 599040 —-a-w- C:\Windows\System32\vbscript.dll
2012-11-14 05:57:35 173056 —-a-w- C:\Windows\System32\ieUnatt.exe
2012-11-14 02:09:22 1800704 —-a-w- C:\Windows\SysWow64\jscript9.dll
2012-11-14 01:58:15 1427968 —-a-w- C:\Windows\SysWow64\inetcpl.cpl
2012-11-14 01:57:37 1129472 —-a-w- C:\Windows\SysWow64\wininet.dll
2012-11-14 01:49:25 142848 —-a-w- C:\Windows\SysWow64\ieUnatt.exe
2012-11-14 01:48:27 420864 —-a-w- C:\Windows\SysWow64\vbscript.dll
2012-11-14 01:44:42 2382848 —-a-w- C:\Windows\SysWow64\mshtml.tlb
2012-11-06 18:01:41 641793 —-a-w- C:\PROGRA~3\SPLB892.tmp
2012-11-02 05:59:11 478208 —-a-w- C:\Windows\System32\dpnet.dll
2012-11-02 05:11:31 376832 —-a-w- C:\Windows\SysWow64\dpnet.dll
2012-10-25 08:12:26 94208 —-a-w- C:\Windows\SysWow64\QuickTimeVR.qtx
2012-10-25 08:12:26 69632 —-a-w- C:\Windows\SysWow64\QuickTime.qts
2012-10-16 08:38:37 135168 —-a-w- C:\Windows\apppatch\AppPatch64\AcXtrnal.dll
2012-10-16 08:38:34 350208 —-a-w- C:\Windows\apppatch\AppPatch64\AcLayers.dll
2012-10-16 07:39:52 561664 —-a-w- C:\Windows\apppatch\AcLayers.dll
2012-10-09 18:17:13 55296 —-a-w- C:\Windows\System32\dhcpcsvc6.dll
2012-10-09 18:17:13 226816 —-a-w- C:\Windows\System32\dhcpcore6.dll
2012-10-09 17:40:31 44032 —-a-w- C:\Windows\SysWow64\dhcpcsvc6.dll
2012-10-09 17:40:31 193536 —-a-w- C:\Windows\SysWow64\dhcpcore6.dll
.
============= FINISH: 10:29:32.52 ===============

.
UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT
.
DDS (Ver_11-03-05.01)
.
Microsoft Windows 7 Home Premium
Boot Device: \Device\HarddiskVolume2
Install Date: 1/27/2012 11:53:13 PM
System Uptime: 1/3/2013 6:13:51 AM (4 hours ago)
.
Motherboard: ASUSTeK Computer Inc. | | U46E
Processor: Intel® Core™ i7-2640M CPU @ 2.80GHz | CPU 1 | 1596/100mhz
.
==== Disk Partitions =========================
.
C: is FIXED (NTFS) - 279 GiB total, 65.246 GiB free.
D: is FIXED (NTFS) - 394 GiB total, 394.077 GiB free.
E: is CDROM ()
F: is Removable
G: is FIXED (NTFS) - 1863 GiB total, 1150.511 GiB free.
.
==== Disabled Device Manager Items =============
.
Class GUID:
Description:
Device ID: ROOT\SYSTEM\0002
Manufacturer:
Name:
PNP Device ID: ROOT\SYSTEM\0002
Service:
.
==== System Restore Points ===================
.
RP194: 12/31/2012 7:57:45 AM - Installed Pinnacle Video Driver.
RP195: 12/31/2012 11:41:26 AM - Windows Update
RP196: 12/31/2012 12:09:55 PM - Installed Instant DVD Recorder
RP197: 12/31/2012 8:40:24 PM - Installed Studio 10
RP198: 12/31/2012 9:01:58 PM - Installed Studio 11
RP199: 12/31/2012 9:02:42 PM - Installed Studio 11
RP200: 12/31/2012 9:07:52 PM - Installed Instant DVD Recorder
RP201: 1/1/2013 7:50:13 AM - Installed Studio 10
RP202: 1/1/2013 7:51:09 AM - Installed Studio 10
RP203: 1/1/2013 7:53:55 AM - Installed Studio 10
RP204: 1/1/2013 7:54:48 AM - Installed Studio 10
RP205: 1/1/2013 8:05:58 AM - Installed Studio 11
RP206: 1/1/2013 8:07:00 AM - Installed Studio 11
RP207: 1/1/2013 9:00:03 AM - Installed Instant DVD Recorder
RP208: 1/1/2013 2:29:37 PM - Installed Pinnacle Instant DVD Recorder.
RP210: 1/2/2013 6:41:52 AM - Windows Update
RP211: 1/3/2013 10:17:28 AM - OTL Restore Point - 1/3/2013 10:17:19 AM
.
==== Installed Programs ======================
.
??????? Windows Live Mesh ActiveX ??(????)
??????? Windows Live Mesh ActiveX ???
AddrBk 473
Adobe AIR
Adobe Flash Player 11 ActiveX
Adobe Flash Player 11 Plugin
Adobe Photoshop Elements 8.0
Adobe Photoshop.com Inspiration Browser
Adobe Reader 6.0
Alcor Micro USB Card Reader
Amazon MP3 Downloader 1.0.17
Apple Application Support
Apple Software Update
ASUS AI Recovery
ASUS FancyStart
ASUS LifeFrame3
ASUS Live Update
ASUS SmartLogon
ASUS Splendid Video Enhancement Technology
ASUS U Series ScreenSaver
ASUS Virtual Camera
ASUS WebStorage
AsusVibe2.0
ATK Package
Auslogics Disk Defrag
AviSynth 2.5
BigOven
CleanUp!
Contrôle ActiveX Windows Live Mesh pour connexions à distance
Control ActiveX de Windows Live Mesh para conexiones remotas
Controlo ActiveX do Windows Live Mesh para Ligações Remotas
Coupon Printer for Windows
CyberLink LabelPrint
CyberLink Media Suite
CyberLink Power2Go
D3DX10
Daniusoft DVD to MP4 Converter(Build [removed])
Daniusoft Video Converter Pro(Build [removed])
Evernote v. 4.6
Flixster Collections
Galeria de Fotografias do Windows Live
Galerie de photos Windows Live
Galería fotográfica de Windows Live
InfoAtoms [Uninstall]
Intel PROSet Wireless
Intel® Control Center
Intel® Processor Graphics
Intel® WiDi
Java 7 Update 9
Java Auto Updater
Java™ 6 Update 23
Java™ 6 Update 31
JavaFX 2.1.1
Junk Mail filter update
Malwarebytes Anti-Malware version 1.70.0.1100
Mesh Runtime
Microsoft .NET Framework 1.1
Microsoft Money Plus
Microsoft Money Shared Libraries
Microsoft Office 2010
Microsoft SQL Server 2005 Compact Edition [ENU]
Microsoft Visual C++ 2005 Redistributable
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
Microsoft Web Publishing Wizard 1.52
Mozilla Firefox 17.0.1 (x86 en-US)
Mozilla Maintenance Service
MSVCRT
MSVCRT_amd64
MSXML 4.0 SP2 (KB954430)
MSXML 4.0 SP2 (KB973688)
Nuance PDF Reader
OpenOffice.org 3.1
Optimum
Pinnacle Instant DVD Recorder
QuickTime
Realtek High Definition Audio Driver
RoboForm 7-8-5-7 (All Users)
SceneSwitch
Search.us.com
Security Update for Microsoft .NET Framework 4 Client Profile (KB2518870)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2539636)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2572078)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2604121)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2633870)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2656351)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2656368)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2656368v2)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2656405)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2686827)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2729449)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2737019)
Security Update for Microsoft .NET Framework 4 Extended (KB2487367)
Security Update for Microsoft .NET Framework 4 Extended (KB2656351)
Sonic Focus
Spybot - Search & Destroy
SpywareBlaster 4.6
Studio 11
The Print Shop 23.1
Update for Microsoft .NET Framework 4 Client Profile (KB2468871)
Update for Microsoft .NET Framework 4 Client Profile (KB2533523)
Update for Microsoft .NET Framework 4 Client Profile (KB2600217)
Update for Microsoft .NET Framework 4 Extended (KB2468871)
Update for Microsoft .NET Framework 4 Extended (KB2533523)
Update for Microsoft .NET Framework 4 Extended (KB2600217)
Videora iPod Converter 6
WeatherBug
Windows Live
Windows Live ???
Windows Live ????
Windows Live Communications Platform
Windows Live Essentials
Windows Live Installer
Windows Live Mail
Windows Live Mesh
Windows Live Mesh ActiveX Control for Remote Connections
Windows Live Messenger
Windows Live Movie Maker
Windows Live Photo Common
Windows Live Photo Gallery
Windows Live PIMT Platform
Windows Live SOXE
Windows Live SOXE Definitions
Windows Live UX Platform
Windows Live UX Platform Language Pack
Windows Live Writer
Windows Live Writer Resources
WinFlash
Wireless Console 3
Yahoo! Desktop Login
Yahoo! Detect
YouTube Downloader App 3.00
.
==== Event Viewer Messages From Past Week ========
.
12/31/2012 8:03:32 AM, Error: Service Control Manager [7032] - The Service Control Manager tried to take a corrective action (Restart the service) after the unexpected termination of the Windows Installer service, but this action failed with the following error: An instance of the service is already running.
12/31/2012 8:01:32 AM, Error: Service Control Manager [7031] - The Windows Installer service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 120000 milliseconds: Restart the service.
12/31/2012 10:05:51 AM, Error: Microsoft-Windows-WER-SystemErrorReporting [1001] - The computer has rebooted from a bugcheck. The bugcheck was: 0x0000009f (0x0000000000000004, 0x0000000000000258, 0xfffffa8006d1f040, 0xfffff800049c43d0). A dump was saved in: C:\Windows\MEMORY.DMP. Report Id: 123112-65146-01.
12/30/2012 2:50:33 PM, Error: Disk [11] - The driver detected a controller error on \Device\Harddisk1\DR4.
12/29/2012 7:39:55 AM, Error: Disk [11] - The driver detected a controller error on \Device\Harddisk2\DR2.
12/29/2012 2:13:29 PM, Error: cdrom [11] - The driver detected a controller error on \Device\CdRom0.
12/28/2012 6:24:49 AM, Error: Disk [11] - The driver detected a controller error on \Device\Harddisk2\DR4.
12/27/2012 11:48:41 AM, Error: Service Control Manager [7034] - The lxdx_device service terminated unexpectedly. It has done this 1 time(s).
1/3/2013 6:16:52 AM, Error: Microsoft-Windows-DistributedCOM [10016] - The application-specific permission settings do not grant Local Launch permission for the COM Server application with CLSID {C97FCC79-E628-407D-AE68-A06AD6D8B4D1} and APPID {344ED43D-D086-4961-86A6-1106F4ACAD9B} to the user NT AUTHORITY\SYSTEM SID (S-1-5-18) from address LocalHost (Using LRPC). This security permission can be modified using the Component Services administrative tool.
1/3/2013 6:15:27 AM, Error: Service Control Manager [7009] - A timeout was reached (30000 milliseconds) while waiting for the lxdxCATSCustConnectService service to connect.
1/3/2013 6:15:27 AM, Error: Service Control Manager [7000] - The lxdxCATSCustConnectService service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
1/2/2013 6:42:17 AM, Error: Service Control Manager [7011] - A timeout (30000 milliseconds) was reached while waiting for a transaction response from the LanmanServer service.
1/2/2013 6:39:58 AM, Error: volsnap [8] - The flush and hold writes operation on volume C: timed out while waiting for a release writes command.
1/2/2013 6:39:58 AM, Error: Microsoft Antimalware [2001] - Microsoft Antimalware has encountered an error trying to update signatures. New Signature Version: Previous Signature Version: 1.141.2907.0 Update Source: Microsoft Update Server Update Stage: Install Source Path: http://www.microsoft.com Signature Type: AntiVirus Update Type: Full User: NT AUTHORITY\SYSTEM Current Engine Version: Previous Engine Version: 1.1.9002.0 Error code: 0x80240016 Error description: An unexpected problem occurred while checking for updates. For information on installing or troubleshooting updates, see Help and Support.
1/2/2013 6:39:58 AM, Error: Microsoft Antimalware [2001] - Microsoft Antimalware has encountered an error trying to update signatures. New Signature Version: Previous Signature Version: 1.141.2907.0 Update Source: Microsoft Update Server Update Stage: Download Source Path: http://www.microsoft.com Signature Type: AntiVirus Update Type: Full User: NT AUTHORITY\SYSTEM Current Engine Version: Previous Engine Version: 1.1.9002.0 Error code: 0x80240016 Error description: An unexpected problem occurred while checking for updates. For information on installing or troubleshooting updates, see Help and Support.
1/2/2013 6:39:51 AM, Error: Microsoft Antimalware [2001] - Microsoft Antimalware has encountered an error trying to update signatures. New Signature Version: Previous Signature Version: 1.141.2907.0 Update Source: Microsoft Update Server Update Stage: Install Source Path: http://www.microsoft.com Signature Type: AntiVirus Update Type: Full User: NT AUTHORITY\SYSTEM Current Engine Version: Previous Engine Version: 1.1.9002.0 Error code: 0x80240016 Error description: An unexpected problem occurred while checking for updates. For information on installing or troubleshooting updates, see Help and Support.
1/2/2013 6:39:46 AM, Error: Disk [11] - The driver detected a controller error on \Device\Harddisk1\DR2.
1/1/2013 7:12:15 AM, Error: Service Control Manager [7011] - A timeout (30000 milliseconds) was reached while waiting for a transaction response from the WSearch service.
.
==== End Of File ===========================

aswMBR version 0.9.9.1707 Copyright© 2011 AVAST Software Run date: 2013-01-03 13:31:06 —————————– 13:31:06.474 OS Version: Windows x64 6.1.7601 Service Pack 1 13:31:06.474 Number of processors: 4 586 0x2A07 13:31:06.474 ComputerName: NANCY-PC UserName: Nancy 13:31:09.284 Initialize success 13:31:17.234 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1 13:31:17.240 Disk 0 Vendor: ST975042 0001 Size: 715404MB BusType: 3 13:31:17.265 Disk 0 MBR read successfully 13:31:17.271 Disk 0 MBR scan 13:31:17.278 Disk 0 Windows 7 default MBR code 13:31:17.286 Disk 0 Partition 1 00 1C Hidd FAT32 LBA MSDOS5.0 25600 MB offset 2048 13:31:17.311 Disk 0 Partition 2 80 (A) 07 HPFS/NTFS NTFS 286161 MB offset 52430848 13:31:17.342 Disk 0 Partition 3 00 07 HPFS/NTFS NTFS 403641 MB offset 638488576 13:31:17.372 Disk 0 scanning C:\Windows\system32\drivers 13:31:25.993 Service scanning 13:31:51.939 Modules scanning 13:31:51.945 Disk 0 trace - called modules: 13:31:51.983 ntoskrnl.exe CLASSPNP.SYS disk.sys ACPI.sys iaStor.sys hal.dll 13:31:51.987 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0xfffffa8007de1060] 13:31:51.992 3 CLASSPNP.SYS[fffff88001dbd43f] -> nt!IofCallDriver -> [0xfffffa8007789e40] 13:31:51.996 5 ACPI.sys[fffff88000faa7a1] -> nt!IofCallDriver -> \Device\Ide\IAAStorageDevice-1[0xfffffa800778a050] 13:31:52.000 Scan finished successfully 13:32:03.697 Disk 0 MBR has been saved successfully to "C:\Users\Nancy\Downloads\MBR.dat" 13:32:03.703 The log file has been saved successfully to "C:\Users\Nancy\Downloads\aswMBR.txt" # AdwCleaner v2.104 - Logfile created 01/03/2013 at 13:34:12 # Updated 29/12/2012 by Xplode # Operating system : Windows 7 Home Premium Service Pack 1 (64 bits) # User : Nancy - NANCY-PC # Boot Mode : Normal # Running from : C:\Users\Nancy\Downloads\AdwCleaner.exe # Option [Search] ***** [Services] ***** ***** [Files / Folders] ***** File Found : C:\Users\Nancy\AppData\Roaming\Mozilla\Firefox\Profiles\pqxe4c84.default\searchplugins\Askcom.xml File Found : C:\Users\Nancy\AppData\Roaming\Mozilla\Firefox\Profiles\pqxe4c84.default\searchplugins\Conduit.xml Folder Found : C:\ProgramData\InstallMate Folder Found : C:\ProgramData\Tarma Installer Folder Found : C:\Users\Nancy\AppData\Roaming\Mozilla\Firefox\Profiles\pqxe4c84.default\ConduitCommon ***** [Registry] ***** Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{DF7770F7-832F-4BDF-B144-100EDDD0C3AE} Key Found : HKCU\Software\Softonic Key Found : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{006EE092-9658-4FD6-BD8E-A21A348E59F5} Key Found : HKLM\SOFTWARE\Classes\S Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{DF7770F7-832F-4BDF-B144-100EDDD0C3AE} Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{FD79F359-E577-46DB-AA74-D6E6B8B45BA8} Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{7E84186E-B5DE-4226-8A66-6E49C6B511B4} Key Found : HKLM\SOFTWARE\Wow6432Node\Google\Chrome\Extensions\niapdbllcanepiiimjjndipklodoedlc Key Found : HKLM\SOFTWARE\Classes\Interface\{23119123-0854-469D-807A-171568457991} Key Found : HKLM\SOFTWARE\Classes\Interface\{3B181CF2-878B-4758-8FBD-59D8AC5AB12D} Key Found : HKLM\SOFTWARE\Classes\Interface\{490A5A0F-1471-47FF-8BB5-719F1F5238AD} Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{889DF117-14D1-44EE-9F31-C5FB5D47F68B} Key Found : HKLM\SOFTWARE\Tarma Installer Key Found : HKU\S-1-5-21-1846905553-2082907679-4278756267-1001\Software\Microsoft\Internet Explorer\SearchScopes\{006EE092-9658-4FD6-BD8E-A21A348E59F5} Value Found : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{D4027C7F-154A-4066-A1AD-4243D8127440}] ***** [Internet Browsers] ***** -\\ Internet Explorer v9.0.8112.16457 [HKCU\Software\Microsoft\Internet Explorer\Main - Search Page] = hxxp://feed.snap.do/?publisher=SnapdoEMon&dpid=SnapdoEMon&co=US&userid=be6fed9d-a96a-4d3e-8869-28d26d99fbfc&searchtype=ds&q={searchTerms} [HKCU\Software\Microsoft\Internet Explorer\Main - Start Page] = hxxp://feed.snap.do/?publisher=SnapdoEMon&dpid=SnapdoEMon&co=US&userid=be6fed9d-a96a-4d3e-8869-28d26d99fbfc&searchtype=hp [HKCU\Software\Microsoft\Internet Explorer\Main - Search Bar] = hxxp://feed.snap.do/?publisher=SnapdoEMon&dpid=SnapdoEMon&co=US&userid=be6fed9d-a96a-4d3e-8869-28d26d99fbfc&searchtype=ds&q={searchTerms} [HKCU\Software\Microsoft\Internet Explorer\Search - Default_Search_URL] = hxxp://feed.snap.do/?publisher=SnapdoEMon&dpid=SnapdoEMon&co=US&userid=be6fed9d-a96a-4d3e-8869-28d26d99fbfc&searchtype=ds&q={searchTerms} [HKCU\Software\Microsoft\Internet Explorer\Search - SearchAssistant] = hxxp://feed.snap.do/?publisher=SnapdoEMon&dpid=SnapdoEMon&co=US&userid=be6fed9d-a96a-4d3e-8869-28d26d99fbfc&searchtype=ds&q={searchTerms} -\\ Mozilla Firefox v17.0.1 (en-US) File : C:\Users\Nancy\AppData\Roaming\Mozilla\Firefox\Profiles\pqxe4c84.default\prefs.js Found : user_pref("CT2260173..clientLogIsEnabled", false); Found : user_pref("CT2260173..clientLogServiceUrl", "hxxp://clientlog.users.conduit.com/ClientDiagnostics.as[…] Found : user_pref("CT2260173..uninstallLogServiceUrl", "hxxp://uninstall.users.conduit.com/Uninstall.asmx/Re[…] Found : user_pref("CT2260173.ALLOW_SHOWING_HIDDEN_TOOLBAR", false); Found : user_pref("CT2260173.AboutPrivacyUrl", "hxxp://www.conduit.com/privacy/Default.aspx"); Found : user_pref("CT2260173.AppTrackingLastCheckTime", "Sat Apr 14 2012 16:06:15 GMT-0400 (Eastern Daylight[…] Found : user_pref("CT2260173.CT2260173", "CT2260173"); Found : user_pref("CT2260173.CurrentServerDate", "28-4-2012"); Found : user_pref("CT2260173.DSChangedManually", true); Found : user_pref("CT2260173.DSInstall", true); Found : user_pref("CT2260173.DialogsAlignMode", "LTR"); Found : user_pref("CT2260173.DialogsGetterLastCheckTime", "Sat Apr 28 2012 06:45:08 GMT-0400 (Eastern Daylig[…] Found : user_pref("CT2260173.DownloadReferralCookieData", "{\"BannerName\":\"\",\"BannerTypeId\":\"\",\"Bann[…] Found : user_pref("CT2260173.EMailNotifierPollDate", "Fri Feb 03 2012 18:57:14 GMT-0500 (Eastern Standard Ti[…] Found : user_pref("CT2260173.FeedLastCount128940659599556287", 0); Found : user_pref("CT2260173.FeedPollDate128940659196275477", "Sat Apr 28 2012 07:59:50 GMT-0400 (Eastern Da[…] Found : user_pref("CT2260173.FeedPollDate128940659574712536", "Sat Apr 28 2012 06:04:58 GMT-0400 (Eastern Da[…] Found : user_pref("CT2260173.FeedTTL128940659574712536", 40); Found : user_pref("CT2260173.FirstServerDate", "3-2-2012"); Found : user_pref("CT2260173.FirstTime", true); Found : user_pref("CT2260173.FirstTimeFF3", true); Found : user_pref("CT2260173.FixPageNotFoundErrors", false); Found : user_pref("CT2260173.GroupingServerCheckInterval", 1440); Found : user_pref("CT2260173.GroupingServiceUrl", "hxxp://grouping.services.conduit.com/"); Found : user_pref("CT2260173.HPInstall", false); Found : user_pref("CT2260173.HasUserGlobalKeys", true); Found : user_pref("CT2260173.HomePageProtectorEnabled", false); Found : user_pref("CT2260173.HomepageBeforeUnload", "hxxps://login.yahoo.com/config/login_verify2?.intl=us&.[…] Found : user_pref("CT2260173.Initialize", true); Found : user_pref("CT2260173.InitializeCommonPrefs", true); Found : user_pref("CT2260173.InstallationAndCookieDataSentCount", 3); Found : user_pref("CT2260173.InstallationType", "DirectDownload"); Found : user_pref("CT2260173.InstalledDate", "Fri Feb 03 2012 06:26:53 GMT-0500 (Eastern Standard Time)"); Found : user_pref("CT2260173.InvalidateCache", false); Found : user_pref("CT2260173.IsAlertDBUpdated", true); Found : user_pref("CT2260173.IsGrouping", false); Found : user_pref("CT2260173.IsInitSetupIni", true); Found : user_pref("CT2260173.IsMulticommunity", false); Found : user_pref("CT2260173.IsOpenThankYouPage", true); Found : user_pref("CT2260173.IsOpenUninstallPage", true); Found : user_pref("CT2260173.IsProtectorsInit", true); Found : user_pref("CT2260173.LanguagePackLastCheckTime", "Fri Apr 27 2012 13:55:24 GMT-0400 (Eastern Dayligh[…] Found : user_pref("CT2260173.LanguagePackReloadIntervalMM", 1440); Found : user_pref("CT2260173.LanguagePackServiceUrl", "hxxp://translation.users.conduit.com/Translation.ashx[…] Found : user_pref("CT2260173.LastLogin_3.10.0.1", "Wed Apr 18 2012 09:24:39 GMT-0400 (Eastern Daylight Time)[…] Found : user_pref("CT2260173.LastLogin_3.12.0.7", "Wed Apr 25 2012 06:08:00 GMT-0400 (Eastern Daylight Time)[…] Found : user_pref("CT2260173.LastLogin_3.12.2.3", "Sat Apr 28 2012 06:05:00 GMT-0400 (Eastern Daylight Time)[…] Found : user_pref("CT2260173.LastLogin_3.9.0.3", "Wed Mar 07 2012 08:52:37 GMT-0500 (Eastern Standard Time)"[…] Found : user_pref("CT2260173.LatestVersion", "3.12.2.3"); Found : user_pref("CT2260173.Locale", "en"); Found : user_pref("CT2260173.MCDetectTooltipHeight", "83"); Found : user_pref("CT2260173.MCDetectTooltipShow", false); Found : user_pref("CT2260173.MCDetectTooltipUrl", "hxxp://@EB_INSTALL_LINK@/rank/tooltip/?version=1"); Found : user_pref("CT2260173.MCDetectTooltipWidth", "295"); Found : user_pref("CT2260173.MyStuffEnabledAtInstallation", true); Found : user_pref("CT2260173.OriginalFirstVersion", "3.9.0.3"); Found : user_pref("CT2260173.RadioIsPodcast", false); Found : user_pref("CT2260173.RadioLastCheckTime", "Fri Feb 03 2012 06:27:21 GMT-0500 (Eastern Standard Time)[…] Found : user_pref("CT2260173.RadioLastUpdateIPServer", "3"); Found : user_pref("CT2260173.RadioLastUpdateServer", "0"); Found : user_pref("CT2260173.RadioMediaID", "9909"); Found : user_pref("CT2260173.RadioMediaType", "Media Player"); Found : user_pref("CT2260173.RadioMenuSelectedID", "EBRadioMenu_CT22601739909"); Found : user_pref("CT2260173.RadioShrinkedFromSetup", false); Found : user_pref("CT2260173.RadioStationName", "WQXR-FM%20NYC%20(Classical)"); Found : user_pref("CT2260173.RadioStationURL", "hxxp://htc-01.media.globix.net/COMP005996MOD1/meta/wqxr_live[…] Found : user_pref("CT2260173.SHRINK_TOOLBAR", 1); Found : user_pref("CT2260173.SearchCaption", "Swag Bucks Customized Web Search"); Found : user_pref("CT2260173.SearchEngineBeforeUnload", "Swag Bucks Customized Web Search"); Found : user_pref("CT2260173.SearchFromAddressBarIsInit", true); Found : user_pref("CT2260173.SearchFromAddressBarUrl", "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT226[…] Found : user_pref("CT2260173.SearchInNewTabEnabled", true); Found : user_pref("CT2260173.SearchInNewTabIntervalMM", 1440); Found : user_pref("CT2260173.SearchInNewTabLastCheckTime", "Fri Apr 27 2012 12:37:44 GMT-0400 (Eastern Dayli[…] Found : user_pref("CT2260173.SearchInNewTabServiceUrl", "hxxp://newtab.conduit-hosting.com/newtab/?ctid=EB_T[…] Found : user_pref("CT2260173.SearchProtectorEnabled", false); Found : user_pref("CT2260173.SearchProtectorToolbarDisabled", false); Found : user_pref("CT2260173.SendProtectorDataViaLogin", true); Found : user_pref("CT2260173.ServiceMapLastCheckTime", "Fri Apr 27 2012 12:37:46 GMT-0400 (Eastern Daylight […] Found : user_pref("CT2260173.SettingsLastCheckTime", "Sat Apr 28 2012 06:04:57 GMT-0400 (Eastern Daylight Ti[…] Found : user_pref("CT2260173.SettingsLastUpdate", "1331756338"); Found : user_pref("CT2260173.TBHomePageUrl", "hxxp://search.conduit.com/?ctid=CT2260173&SearchSource=13"); Found : user_pref("CT2260173.ThirdPartyComponentsInterval", 504); Found : user_pref("CT2260173.ThirdPartyComponentsLastCheck", "Sat Apr 28 2012 06:04:57 GMT-0400 (Eastern Day[…] Found : user_pref("CT2260173.ThirdPartyComponentsLastUpdate", "1312887586"); Found : user_pref("CT2260173.ToolbarShrinkedFromSetup", false); Found : user_pref("CT2260173.TrusteLinkUrl", "hxxp://trust.conduit.com/CT2260173"); Found : user_pref("CT2260173.TrustedApiDomains", "conduit.com,conduit-hosting.com,conduit-services.com,clien[…] Found : user_pref("CT2260173.UserID", "UN01850715738118513"); Found : user_pref("CT2260173.ValidationData_Search", 2); Found : user_pref("CT2260173.ValidationData_Toolbar", 2); Found : user_pref("CT2260173.WeatherNetwork", ""); Found : user_pref("CT2260173.WeatherPollDate", "Sat Apr 28 2012 07:35:28 GMT-0400 (Eastern Daylight Time)"); Found : user_pref("CT2260173.WeatherUnit", "F"); Found : user_pref("CT2260173.alertChannelId", "657446"); Found : user_pref("CT2260173.approveUntrustedApps", false); Found : user_pref("CT2260173.components.1000034", false); Found : user_pref("CT2260173.components.1000082", false); Found : user_pref("CT2260173.components.1000234", true); Found : user_pref("CT2260173.components.129137782531242622", false); Found : user_pref("CT2260173.generalConfigFromLogin", "{\"ApiMaxAlerts\":\"12\",\"SocialDomains\":\"social.c[…] Found : user_pref("CT2260173.globalFirstTimeInfoLastCheckTime", "Mon Apr 23 2012 08:28:51 GMT-0400 (Eastern […] Found : user_pref("CT2260173.homepageProtectorEnableByLogin", true); Found : user_pref("CT2260173.initDone", true); Found : user_pref("CT2260173.isAppTrackingManagerOn", true); Found : user_pref("CT2260173.isFirstRadioInstallation", false); Found : user_pref("CT2260173.myStuffEnabled", true); Found : user_pref("CT2260173.myStuffPublihserMinWidth", 400); Found : user_pref("CT2260173.myStuffSearchUrl", "hxxp://Apps.conduit.com/search?q=SEARCH_TERM&SearchSourceOr[…] Found : user_pref("CT2260173.myStuffServiceIntervalMM", 1440); Found : user_pref("CT2260173.myStuffServiceUrl", "hxxp://mystuff.conduit-services.com/MyStuffService.ashx?Co[…] Found : user_pref("CT2260173.oldAppsList", "128848965243869714,128848965243869715,111,128958821111237507,128[…] Found : user_pref("CT2260173.revertSettingsEnabled", false); Found : user_pref("CT2260173.searchProtectorDialogDelayInSec", 10); Found : user_pref("CT2260173.searchProtectorEnableByLogin", true); Found : user_pref("CT2260173.testingCtid", ""); Found : user_pref("CT2260173.toolbarAppMetaDataLastCheckTime", "Fri Apr 27 2012 12:37:46 GMT-0400 (Eastern D[…] Found : user_pref("CT2260173.toolbarContextMenuLastCheckTime", "Fri Apr 27 2012 07:26:56 GMT-0400 (Eastern D[…] Found : user_pref("CT2260173.usagesFlag", 2); Found : user_pref("CT2422939.FirstTime", "true"); Found : user_pref("CT2422939.FirstTimeFF3", "true"); Found : user_pref("CT2422939.UserID", "UN60368842681129381"); Found : user_pref("CT2422939.fixUrls", true); Found : user_pref("CT2422939.isPerformedSmartBarTransition", "true"); Found : user_pref("CT2422939.settingsINI", true); Found : user_pref("CT2422939.smartbar.CTID", "CT2422939"); Found : user_pref("CT2422939.smartbar.Uninstall", "0"); Found : user_pref("CT2422939.smartbar.toolbarName", "AccuWeather "); Found : user_pref("CommunityToolbar.ConduitSearchList", "Swag Bucks Customized Web Search"); Found : user_pref("CommunityToolbar.ETag.hxxp://Settings.toolbar.search.conduit.com/root/CT2260173/CT2260173[…] Found : user_pref("CommunityToolbar.ETag.hxxp://alerts.conduit-services.com/root/657446/653307/US", "\"0\"")[…] Found : user_pref("CommunityToolbar.ETag.hxxp://appsmetadata.toolbar.conduit-services.com/?ctid=CT2260173", […] Found : user_pref("CommunityToolbar.ETag.hxxp://contextmenu.toolbar.conduit-services.com/?name=GottenApps&lo[…] Found : user_pref("CommunityToolbar.ETag.hxxp://contextmenu.toolbar.conduit-services.com/?name=OtherApps&loc[…] Found : user_pref("CommunityToolbar.ETag.hxxp://contextmenu.toolbar.conduit-services.com/?name=SharedApps&lo[…] Found : user_pref("CommunityToolbar.ETag.hxxp://contextmenu.toolbar.conduit-services.com/?name=Toolbar&local[…] Found : user_pref("CommunityToolbar.ETag.hxxp://dynamicdialogs.alert.conduit-services.com/alert/dlg.pkg", "\[…] Found : user_pref("CommunityToolbar.ETag.hxxp://dynamicdialogs.toolbar.conduit-services.com/DLG.pkg?ver=3.10[…] Found : user_pref("CommunityToolbar.ETag.hxxp://dynamicdialogs.toolbar.conduit-services.com/DLG.pkg?ver=3.12[…] Found : user_pref("CommunityToolbar.ETag.hxxp://dynamicdialogs.toolbar.conduit-services.com/DLG.pkg?ver=3.12[…] Found : user_pref("CommunityToolbar.ETag.hxxp://dynamicdialogs.toolbar.conduit-services.com/DLG.pkg?ver=3.9.[…] Found : user_pref("CommunityToolbar.ETag.hxxp://servicemap.conduit-services.com/Toolbar/?ownerId=CT2260173",[…] Found : user_pref("CommunityToolbar.ETag.hxxp://translation.toolbar.conduit-services.com/?locale=en", "\"c46[…] Found : user_pref("CommunityToolbar.LatestLibsPath", "file:///C:\\Users\\Nancy\\AppData\\Roaming\\Mozilla\\F[…] Found : user_pref("CommunityToolbar.LatestToolbarVersionInstalled", "3.12.2.3"); Found : user_pref("CommunityToolbar.SearchFromAddressBarSavedUrl", ""); Found : user_pref("CommunityToolbar.ToolbarsList", "CT2260173"); Found : user_pref("CommunityToolbar.ToolbarsList2", "CT2260173"); Found : user_pref("CommunityToolbar.ToolbarsList4", "CT2260173"); Found : user_pref("CommunityToolbar.facebook.settingsLastCheckTime", "Fri Feb 03 2012 06:26:53 GMT-0500 (Eas[…] Found : user_pref("CommunityToolbar.globalUserId", "adc87200-a7fb-488d-bb46-6037ebab5ecb"); Found : user_pref("CommunityToolbar.isAlertUrlAddedToFeedItemTable", true); Found : user_pref("CommunityToolbar.isClickActionAddedToFeedItemTable", true); Found : user_pref("CommunityToolbar.keywordURLSelectedCTID", "CT2260173"); Found : user_pref("CommunityToolbar.notifications.alertDialogsGetterLastCheckTime", "Sat Apr 21 2012 08:07:3[…] Found : user_pref("CommunityToolbar.notifications.alertEnabled", true); Found : user_pref("CommunityToolbar.notifications.alertInfoInterval", 1440); Found : user_pref("CommunityToolbar.notifications.alertInfoLastCheckTime", "Fri Apr 27 2012 13:55:35 GMT-040[…] Found : user_pref("CommunityToolbar.notifications.clientsServerUrl", "hxxp://alert.client.conduit.com"); Found : user_pref("CommunityToolbar.notifications.locale", "en"); Found : user_pref("CommunityToolbar.notifications.loginIntervalMin", 1440); Found : user_pref("CommunityToolbar.notifications.loginLastCheckTime", "Fri Apr 27 2012 13:55:24 GMT-0400 (E[…] Found : user_pref("CommunityToolbar.notifications.loginLastUpdateTime", "1313487611"); Found : user_pref("CommunityToolbar.notifications.messageShowTimeSec", 20); Found : user_pref("CommunityToolbar.notifications.servicesServerUrl", "hxxp://alert.services.conduit.com"); Found : user_pref("CommunityToolbar.notifications.showTrayIcon", false); Found : user_pref("CommunityToolbar.notifications.userCloseIntervalMin", 300); Found : user_pref("CommunityToolbar.notifications.userId", "09fa9322-3a78-4896-83a2-75f835891e4e"); Found : user_pref("CommunityToolbar.originalHomepage", "hxxps://login.yahoo.com/config/login_verify2?.intl=u[…] Found : user_pref("CommunityToolbar.originalSearchEngine", "chrome://browser-region/locale/region.properties[…] Found : user_pref("browser.search.defaultengine", "Ask.com"); Found : user_pref("browser.search.defaultenginename", "My Web Search"); Found : user_pref("browser.search.defaultthis.engineName", "Swag Bucks Customized Web Search"); Found : user_pref("browser.search.defaulturl", "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2260173&Sea[…] Found : user_pref("browser.search.order.1", "Ask.com"); Found : user_pref("browser.search.selectedEngine", "Swag Bucks Customized Web Search"); Found : user_pref("extensions.mywebsearch.prevDefaultEngine", "Ask.com"); Found : user_pref("extensions.mywebsearch.prevKwdEnabled", true); Found : user_pref("extensions.mywebsearch.prevSelectedEngine", "Swag Bucks Customized Web Search"); Found : user_pref("extensions.toolbar.mindspark._14Members_.homepage", "hxxp://home.mywebsearch.com/index.jh[…] Found : user_pref("keyword.URL", "hxxp://search.mywebsearch.com/mywebsearch/GGmain.jhtml?st=kwd&ptb=7CDECB22[…] ************************* AdwCleaner[R1].txt - [18308 octets] - [03/01/2013 13:34:12] ########## EOF - C:\AdwCleaner[R1].txt - [18369 octets] ##########

# AdwCleaner v2.104 - Logfile created 01/03/2013 at 14:33:09 # Updated 29/12/2012 by Xplode # Operating system : Windows 7 Home Premium Service Pack 1 (64 bits) # User : Nancy - NANCY-PC # Boot Mode : Normal # Running from : C:\Users\Nancy\Downloads\AdwCleaner.exe # Option [Delete] ***** [Services] ***** ***** [Files / Folders] ***** File Deleted : C:\Users\Nancy\AppData\Roaming\Mozilla\Firefox\Profiles\pqxe4c84.default\searchplugins\Askcom.xml File Deleted : C:\Users\Nancy\AppData\Roaming\Mozilla\Firefox\Profiles\pqxe4c84.default\searchplugins\Conduit.xml Folder Deleted : C:\ProgramData\InstallMate Folder Deleted : C:\ProgramData\Tarma Installer Folder Deleted : C:\Users\Nancy\AppData\Roaming\Mozilla\Firefox\Profiles\pqxe4c84.default\ConduitCommon ***** [Registry] ***** Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{DF7770F7-832F-4BDF-B144-100EDDD0C3AE} Key Deleted : HKCU\Software\Softonic Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{006EE092-9658-4FD6-BD8E-A21A348E59F5} Key Deleted : HKLM\SOFTWARE\Classes\S Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{DF7770F7-832F-4BDF-B144-100EDDD0C3AE} Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{FD79F359-E577-46DB-AA74-D6E6B8B45BA8} Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{7E84186E-B5DE-4226-8A66-6E49C6B511B4} Key Deleted : HKLM\SOFTWARE\Wow6432Node\Google\Chrome\Extensions\niapdbllcanepiiimjjndipklodoedlc Key Deleted : HKLM\SOFTWARE\Classes\Interface\{23119123-0854-469D-807A-171568457991} Key Deleted : HKLM\SOFTWARE\Classes\Interface\{3B181CF2-878B-4758-8FBD-59D8AC5AB12D} Key Deleted : HKLM\SOFTWARE\Classes\Interface\{490A5A0F-1471-47FF-8BB5-719F1F5238AD} Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{889DF117-14D1-44EE-9F31-C5FB5D47F68B} Key Deleted : HKLM\SOFTWARE\Tarma Installer Value Deleted : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{D4027C7F-154A-4066-A1AD-4243D8127440}] ***** [Internet Browsers] ***** -\\ Internet Explorer v9.0.8112.16457 Replaced : [HKCU\Software\Microsoft\Internet Explorer\Main - Search Page] = hxxp://feed.snap.do/?publisher=SnapdoEMon&dpid=SnapdoEMon&co=US&userid=be6fed9d-a96a-4d3e-8869-28d26d99fbfc&searchtype=ds&q={searchTerms} –> hxxp://www.google.com Replaced : [HKCU\Software\Microsoft\Internet Explorer\Main - Start Page] = hxxp://feed.snap.do/?publisher=SnapdoEMon&dpid=SnapdoEMon&co=US&userid=be6fed9d-a96a-4d3e-8869-28d26d99fbfc&searchtype=hp –> hxxp://www.google.com Replaced : [HKCU\Software\Microsoft\Internet Explorer\Main - Search Bar] = hxxp://feed.snap.do/?publisher=SnapdoEMon&dpid=SnapdoEMon&co=US&userid=be6fed9d-a96a-4d3e-8869-28d26d99fbfc&searchtype=ds&q={searchTerms} –> hxxp://www.google.com Replaced : [HKCU\Software\Microsoft\Internet Explorer\Search - Default_Search_URL] = hxxp://feed.snap.do/?publisher=SnapdoEMon&dpid=SnapdoEMon&co=US&userid=be6fed9d-a96a-4d3e-8869-28d26d99fbfc&searchtype=ds&q={searchTerms} –> hxxp://www.google.com Replaced : [HKCU\Software\Microsoft\Internet Explorer\Search - SearchAssistant] = hxxp://feed.snap.do/?publisher=SnapdoEMon&dpid=SnapdoEMon&co=US&userid=be6fed9d-a96a-4d3e-8869-28d26d99fbfc&searchtype=ds&q={searchTerms} –> hxxp://www.google.com -\\ Mozilla Firefox v17.0.1 (en-US) File : C:\Users\Nancy\AppData\Roaming\Mozilla\Firefox\Profiles\pqxe4c84.default\prefs.js C:\Users\Nancy\AppData\Roaming\Mozilla\Firefox\Profiles\pqxe4c84.default\user.js … Deleted ! Deleted : user_pref("CT2260173..clientLogIsEnabled", false); Deleted : user_pref("CT2260173..clientLogServiceUrl", "hxxp://clientlog.users.conduit.com/ClientDiagnostics.as[…] Deleted : user_pref("CT2260173..uninstallLogServiceUrl", "hxxp://uninstall.users.conduit.com/Uninstall.asmx/Re[…] Deleted : user_pref("CT2260173.ALLOW_SHOWING_HIDDEN_TOOLBAR", false); Deleted : user_pref("CT2260173.AboutPrivacyUrl", "hxxp://www.conduit.com/privacy/Default.aspx"); Deleted : user_pref("CT2260173.AppTrackingLastCheckTime", "Sat Apr 14 2012 16:06:15 GMT-0400 (Eastern Daylight[…] Deleted : user_pref("CT2260173.CT2260173", "CT2260173"); Deleted : user_pref("CT2260173.CurrentServerDate", "28-4-2012"); Deleted : user_pref("CT2260173.DSChangedManually", true); Deleted : user_pref("CT2260173.DSInstall", true); Deleted : user_pref("CT2260173.DialogsAlignMode", "LTR"); Deleted : user_pref("CT2260173.DialogsGetterLastCheckTime", "Sat Apr 28 2012 06:45:08 GMT-0400 (Eastern Daylig[…] Deleted : user_pref("CT2260173.DownloadReferralCookieData", "{\"BannerName\":\"\",\"BannerTypeId\":\"\",\"Bann[…] Deleted : user_pref("CT2260173.EMailNotifierPollDate", "Fri Feb 03 2012 18:57:14 GMT-0500 (Eastern Standard Ti[…] Deleted : user_pref("CT2260173.FeedLastCount128940659599556287", 0); Deleted : user_pref("CT2260173.FeedPollDate128940659196275477", "Sat Apr 28 2012 07:59:50 GMT-0400 (Eastern Da[…] Deleted : user_pref("CT2260173.FeedPollDate128940659574712536", "Sat Apr 28 2012 06:04:58 GMT-0400 (Eastern Da[…] Deleted : user_pref("CT2260173.FeedTTL128940659574712536", 40); Deleted : user_pref("CT2260173.FirstServerDate", "3-2-2012"); Deleted : user_pref("CT2260173.FirstTime", true); Deleted : user_pref("CT2260173.FirstTimeFF3", true); Deleted : user_pref("CT2260173.FixPageNotFoundErrors", false); Deleted : user_pref("CT2260173.GroupingServerCheckInterval", 1440); Deleted : user_pref("CT2260173.GroupingServiceUrl", "hxxp://grouping.services.conduit.com/"); Deleted : user_pref("CT2260173.HPInstall", false); Deleted : user_pref("CT2260173.HasUserGlobalKeys", true); Deleted : user_pref("CT2260173.HomePageProtectorEnabled", false); Deleted : user_pref("CT2260173.HomepageBeforeUnload", "hxxps://login.yahoo.com/config/login_verify2?.intl=us&.[…] Deleted : user_pref("CT2260173.Initialize", true); Deleted : user_pref("CT2260173.InitializeCommonPrefs", true); Deleted : user_pref("CT2260173.InstallationAndCookieDataSentCount", 3); Deleted : user_pref("CT2260173.InstallationType", "DirectDownload"); Deleted : user_pref("CT2260173.InstalledDate", "Fri Feb 03 2012 06:26:53 GMT-0500 (Eastern Standard Time)"); Deleted : user_pref("CT2260173.InvalidateCache", false); Deleted : user_pref("CT2260173.IsAlertDBUpdated", true); Deleted : user_pref("CT2260173.IsGrouping", false); Deleted : user_pref("CT2260173.IsInitSetupIni", true); Deleted : user_pref("CT2260173.IsMulticommunity", false); Deleted : user_pref("CT2260173.IsOpenThankYouPage", true); Deleted : user_pref("CT2260173.IsOpenUninstallPage", true); Deleted : user_pref("CT2260173.IsProtectorsInit", true); Deleted : user_pref("CT2260173.LanguagePackLastCheckTime", "Fri Apr 27 2012 13:55:24 GMT-0400 (Eastern Dayligh[…] Deleted : user_pref("CT2260173.LanguagePackReloadIntervalMM", 1440); Deleted : user_pref("CT2260173.LanguagePackServiceUrl", "hxxp://translation.users.conduit.com/Translation.ashx[…] Deleted : user_pref("CT2260173.LastLogin_3.10.0.1", "Wed Apr 18 2012 09:24:39 GMT-0400 (Eastern Daylight Time)[…] Deleted : user_pref("CT2260173.LastLogin_3.12.0.7", "Wed Apr 25 2012 06:08:00 GMT-0400 (Eastern Daylight Time)[…] Deleted : user_pref("CT2260173.LastLogin_3.12.2.3", "Sat Apr 28 2012 06:05:00 GMT-0400 (Eastern Daylight Time)[…] Deleted : user_pref("CT2260173.LastLogin_3.9.0.3", "Wed Mar 07 2012 08:52:37 GMT-0500 (Eastern Standard Time)"[…] Deleted : user_pref("CT2260173.LatestVersion", "3.12.2.3"); Deleted : user_pref("CT2260173.Locale", "en"); Deleted : user_pref("CT2260173.MCDetectTooltipHeight", "83"); Deleted : user_pref("CT2260173.MCDetectTooltipShow", false); Deleted : user_pref("CT2260173.MCDetectTooltipUrl", "hxxp://@EB_INSTALL_LINK@/rank/tooltip/?version=1"); Deleted : user_pref("CT2260173.MCDetectTooltipWidth", "295"); Deleted : user_pref("CT2260173.MyStuffEnabledAtInstallation", true); Deleted : user_pref("CT2260173.OriginalFirstVersion", "3.9.0.3"); Deleted : user_pref("CT2260173.RadioIsPodcast", false); Deleted : user_pref("CT2260173.RadioLastCheckTime", "Fri Feb 03 2012 06:27:21 GMT-0500 (Eastern Standard Time)[…] Deleted : user_pref("CT2260173.RadioLastUpdateIPServer", "3"); Deleted : user_pref("CT2260173.RadioLastUpdateServer", "0"); Deleted : user_pref("CT2260173.RadioMediaID", "9909"); Deleted : user_pref("CT2260173.RadioMediaType", "Media Player"); Deleted : user_pref("CT2260173.RadioMenuSelectedID", "EBRadioMenu_CT22601739909"); Deleted : user_pref("CT2260173.RadioShrinkedFromSetup", false); Deleted : user_pref("CT2260173.RadioStationName", "WQXR-FM%20NYC%20(Classical)"); Deleted : user_pref("CT2260173.RadioStationURL", "hxxp://htc-01.media.globix.net/COMP005996MOD1/meta/wqxr_live[…] Deleted : user_pref("CT2260173.SHRINK_TOOLBAR", 1); Deleted : user_pref("CT2260173.SearchCaption", "Swag Bucks Customized Web Search"); Deleted : user_pref("CT2260173.SearchEngineBeforeUnload", "Swag Bucks Customized Web Search"); Deleted : user_pref("CT2260173.SearchFromAddressBarIsInit", true); Deleted : user_pref("CT2260173.SearchFromAddressBarUrl", "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT226[…] Deleted : user_pref("CT2260173.SearchInNewTabEnabled", true); Deleted : user_pref("CT2260173.SearchInNewTabIntervalMM", 1440); Deleted : user_pref("CT2260173.SearchInNewTabLastCheckTime", "Fri Apr 27 2012 12:37:44 GMT-0400 (Eastern Dayli[…] Deleted : user_pref("CT2260173.SearchInNewTabServiceUrl", "hxxp://newtab.conduit-hosting.com/newtab/?ctid=EB_T[…] Deleted : user_pref("CT2260173.SearchProtectorEnabled", false); Deleted : user_pref("CT2260173.SearchProtectorToolbarDisabled", false); Deleted : user_pref("CT2260173.SendProtectorDataViaLogin", true); Deleted : user_pref("CT2260173.ServiceMapLastCheckTime", "Fri Apr 27 2012 12:37:46 GMT-0400 (Eastern Daylight […] Deleted : user_pref("CT2260173.SettingsLastCheckTime", "Sat Apr 28 2012 06:04:57 GMT-0400 (Eastern Daylight Ti[…] Deleted : user_pref("CT2260173.SettingsLastUpdate", "1331756338"); Deleted : user_pref("CT2260173.TBHomePageUrl", "hxxp://search.conduit.com/?ctid=CT2260173&SearchSource=13"); Deleted : user_pref("CT2260173.ThirdPartyComponentsInterval", 504); Deleted : user_pref("CT2260173.ThirdPartyComponentsLastCheck", "Sat Apr 28 2012 06:04:57 GMT-0400 (Eastern Day[…] Deleted : user_pref("CT2260173.ThirdPartyComponentsLastUpdate", "1312887586"); Deleted : user_pref("CT2260173.ToolbarShrinkedFromSetup", false); Deleted : user_pref("CT2260173.TrusteLinkUrl", "hxxp://trust.conduit.com/CT2260173"); Deleted : user_pref("CT2260173.TrustedApiDomains", "conduit.com,conduit-hosting.com,conduit-services.com,clien[…] Deleted : user_pref("CT2260173.UserID", "UN01850715738118513"); Deleted : user_pref("CT2260173.ValidationData_Search", 2); Deleted : user_pref("CT2260173.ValidationData_Toolbar", 2); Deleted : user_pref("CT2260173.WeatherNetwork", ""); Deleted : user_pref("CT2260173.WeatherPollDate", "Sat Apr 28 2012 07:35:28 GMT-0400 (Eastern Daylight Time)"); Deleted : user_pref("CT2260173.WeatherUnit", "F"); Deleted : user_pref("CT2260173.alertChannelId", "657446"); Deleted : user_pref("CT2260173.approveUntrustedApps", false); Deleted : user_pref("CT2260173.components.1000034", false); Deleted : user_pref("CT2260173.components.1000082", false); Deleted : user_pref("CT2260173.components.1000234", true); Deleted : user_pref("CT2260173.components.129137782531242622", false); Deleted : user_pref("CT2260173.generalConfigFromLogin", "{\"ApiMaxAlerts\":\"12\",\"SocialDomains\":\"social.c[…] Deleted : user_pref("CT2260173.globalFirstTimeInfoLastCheckTime", "Mon Apr 23 2012 08:28:51 GMT-0400 (Eastern […] Deleted : user_pref("CT2260173.homepageProtectorEnableByLogin", true); Deleted : user_pref("CT2260173.initDone", true); Deleted : user_pref("CT2260173.isAppTrackingManagerOn", true); Deleted : user_pref("CT2260173.isFirstRadioInstallation", false); Deleted : user_pref("CT2260173.myStuffEnabled", true); Deleted : user_pref("CT2260173.myStuffPublihserMinWidth", 400); Deleted : user_pref("CT2260173.myStuffSearchUrl", "hxxp://Apps.conduit.com/search?q=SEARCH_TERM&SearchSourceOr[…] Deleted : user_pref("CT2260173.myStuffServiceIntervalMM", 1440); Deleted : user_pref("CT2260173.myStuffServiceUrl", "hxxp://mystuff.conduit-services.com/MyStuffService.ashx?Co[…] Deleted : user_pref("CT2260173.oldAppsList", "128848965243869714,128848965243869715,111,128958821111237507,128[…] Deleted : user_pref("CT2260173.revertSettingsEnabled", false); Deleted : user_pref("CT2260173.searchProtectorDialogDelayInSec", 10); Deleted : user_pref("CT2260173.searchProtectorEnableByLogin", true); Deleted : user_pref("CT2260173.testingCtid", ""); Deleted : user_pref("CT2260173.toolbarAppMetaDataLastCheckTime", "Fri Apr 27 2012 12:37:46 GMT-0400 (Eastern D[…] Deleted : user_pref("CT2260173.toolbarContextMenuLastCheckTime", "Fri Apr 27 2012 07:26:56 GMT-0400 (Eastern D[…] Deleted : user_pref("CT2260173.usagesFlag", 2); Deleted : user_pref("CT2422939.FirstTime", "true"); Deleted : user_pref("CT2422939.FirstTimeFF3", "true"); Deleted : user_pref("CT2422939.UserID", "UN60368842681129381"); Deleted : user_pref("CT2422939.fixUrls", true); Deleted : user_pref("CT2422939.isPerformedSmartBarTransition", "true"); Deleted : user_pref("CT2422939.settingsINI", true); Deleted : user_pref("CT2422939.smartbar.CTID", "CT2422939"); Deleted : user_pref("CT2422939.smartbar.Uninstall", "0"); Deleted : user_pref("CT2422939.smartbar.toolbarName", "AccuWeather "); Deleted : user_pref("CommunityToolbar.ConduitSearchList", "Swag Bucks Customized Web Search"); Deleted : user_pref("CommunityToolbar.ETag.hxxp://Settings.toolbar.search.conduit.com/root/CT2260173/CT2260173[…] Deleted : user_pref("CommunityToolbar.ETag.hxxp://alerts.conduit-services.com/root/657446/653307/US", "\"0\"")[…] Deleted : user_pref("CommunityToolbar.ETag.hxxp://appsmetadata.toolbar.conduit-services.com/?ctid=CT2260173", […] Deleted : user_pref("CommunityToolbar.ETag.hxxp://contextmenu.toolbar.conduit-services.com/?name=GottenApps&lo[…] Deleted : user_pref("CommunityToolbar.ETag.hxxp://contextmenu.toolbar.conduit-services.com/?name=OtherApps&loc[…] Deleted : user_pref("CommunityToolbar.ETag.hxxp://contextmenu.toolbar.conduit-services.com/?name=SharedApps&lo[…] Deleted : user_pref("CommunityToolbar.ETag.hxxp://contextmenu.toolbar.conduit-services.com/?name=Toolbar&local[…] Deleted : user_pref("CommunityToolbar.ETag.hxxp://dynamicdialogs.alert.conduit-services.com/alert/dlg.pkg", "\[…] Deleted : user_pref("CommunityToolbar.ETag.hxxp://dynamicdialogs.toolbar.conduit-services.com/DLG.pkg?ver=3.10[…] Deleted : user_pref("CommunityToolbar.ETag.hxxp://dynamicdialogs.toolbar.conduit-services.com/DLG.pkg?ver=3.12[…] Deleted : user_pref("CommunityToolbar.ETag.hxxp://dynamicdialogs.toolbar.conduit-services.com/DLG.pkg?ver=3.12[…] Deleted : user_pref("CommunityToolbar.ETag.hxxp://dynamicdialogs.toolbar.conduit-services.com/DLG.pkg?ver=3.9.[…] Deleted : user_pref("CommunityToolbar.ETag.hxxp://servicemap.conduit-services.com/Toolbar/?ownerId=CT2260173",[…] Deleted : user_pref("CommunityToolbar.ETag.hxxp://translation.toolbar.conduit-services.com/?locale=en", "\"c46[…] Deleted : user_pref("CommunityToolbar.LatestLibsPath", "file:///C:\\Users\\Nancy\\AppData\\Roaming\\Mozilla\\F[…] Deleted : user_pref("CommunityToolbar.LatestToolbarVersionInstalled", "3.12.2.3"); Deleted : user_pref("CommunityToolbar.SearchFromAddressBarSavedUrl", ""); Deleted : user_pref("CommunityToolbar.ToolbarsList", "CT2260173"); Deleted : user_pref("CommunityToolbar.ToolbarsList2", "CT2260173"); Deleted : user_pref("CommunityToolbar.ToolbarsList4", "CT2260173"); Deleted : user_pref("CommunityToolbar.facebook.settingsLastCheckTime", "Fri Feb 03 2012 06:26:53 GMT-0500 (Eas[…] Deleted : user_pref("CommunityToolbar.globalUserId", "adc87200-a7fb-488d-bb46-6037ebab5ecb"); Deleted : user_pref("CommunityToolbar.isAlertUrlAddedToFeedItemTable", true); Deleted : user_pref("CommunityToolbar.isClickActionAddedToFeedItemTable", true); Deleted : user_pref("CommunityToolbar.keywordURLSelectedCTID", "CT2260173"); Deleted : user_pref("CommunityToolbar.notifications.alertDialogsGetterLastCheckTime", "Sat Apr 21 2012 08:07:3[…] Deleted : user_pref("CommunityToolbar.notifications.alertEnabled", true); Deleted : user_pref("CommunityToolbar.notifications.alertInfoInterval", 1440); Deleted : user_pref("CommunityToolbar.notifications.alertInfoLastCheckTime", "Fri Apr 27 2012 13:55:35 GMT-040[…] Deleted : user_pref("CommunityToolbar.notifications.clientsServerUrl", "hxxp://alert.client.conduit.com"); Deleted : user_pref("CommunityToolbar.notifications.locale", "en"); Deleted : user_pref("CommunityToolbar.notifications.loginIntervalMin", 1440); Deleted : user_pref("CommunityToolbar.notifications.loginLastCheckTime", "Fri Apr 27 2012 13:55:24 GMT-0400 (E[…] Deleted : user_pref("CommunityToolbar.notifications.loginLastUpdateTime", "1313487611"); Deleted : user_pref("CommunityToolbar.notifications.messageShowTimeSec", 20); Deleted : user_pref("CommunityToolbar.notifications.servicesServerUrl", "hxxp://alert.services.conduit.com"); Deleted : user_pref("CommunityToolbar.notifications.showTrayIcon", false); Deleted : user_pref("CommunityToolbar.notifications.userCloseIntervalMin", 300); Deleted : user_pref("CommunityToolbar.notifications.userId", "09fa9322-3a78-4896-83a2-75f835891e4e"); Deleted : user_pref("CommunityToolbar.originalHomepage", "hxxps://login.yahoo.com/config/login_verify2?.intl=u[…] Deleted : user_pref("CommunityToolbar.originalSearchEngine", "chrome://browser-region/locale/region.properties[…] Deleted : user_pref("browser.search.defaultengine", "Ask.com"); Deleted : user_pref("browser.search.defaultenginename", "My Web Search"); Deleted : user_pref("browser.search.defaultthis.engineName", "Swag Bucks Customized Web Search"); Deleted : user_pref("browser.search.defaulturl", "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2260173&Sea[…] Deleted : user_pref("browser.search.order.1", "Ask.com"); Deleted : user_pref("browser.search.selectedEngine", "Swag Bucks Customized Web Search"); Deleted : user_pref("extensions.mywebsearch.prevDefaultEngine", "Ask.com"); Deleted : user_pref("extensions.mywebsearch.prevKwdEnabled", true); Deleted : user_pref("extensions.mywebsearch.prevSelectedEngine", "Swag Bucks Customized Web Search"); Deleted : user_pref("extensions.toolbar.mindspark._14Members_.homepage", "hxxp://home.mywebsearch.com/index.jh[…] Deleted : user_pref("keyword.URL", "hxxp://search.mywebsearch.com/mywebsearch/GGmain.jhtml?st=kwd&ptb=7CDECB22[…] ************************* AdwCleaner[R1].txt - [18427 octets] - [03/01/2013 13:34:12] AdwCleaner[S1].txt - [18899 octets] - [03/01/2013 14:33:09] ########## EOF - C:\AdwCleaner[S1].txt - [18960 octets] ##########

ComboFix 13-01-03.05 - Nancy 01/03/2013 16:17:09.1.4 - x64 Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.8103.5774 [GMT -5:00] Running from: C:\Users\[removed]\Downloads\ComboFix.exe AV: Microsoft Security Essentials *Enabled/Updated* {B140BF4E-23BB-4198-90AB-A51A4C60A69C} SP: Microsoft Security Essentials *Enabled/Updated* {0A215EAA-0581-4E16-AA1B-9E6837E7EC21} SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) C:\Program Files (x86)\UNWISE.EXE C:\ProgramData\Roaming C:\ProgramData\SPLB892.tmp C:\ProgramData\SPLCC36.tmp C:\ProgramData\SPLCEFD.tmp C:\ProgramData\SPLF0BA.tmp C:\test.txt C:\Users\Nancy\GoToAssistDownloadHelper.exe C:\Windows\AsPatch10430001.exe C:\Windows\msvcr71.dll C:\Windows\SysWow64\AutoRun.inf C:\Windows\SysWow64\URTTemp C:\Windows\SysWow64\URTTemp\regtlib.exe ((((((((((((((((((((((((( Files Created from 2012-12-03 to 2013-01-03 ))))))))))))))))))))))))))))))) 2013-01-03 21:40:05 . 2013-01-03 21:40:05 ——– d—–w- C:\Users\Default\AppData\Local\temp 2013-01-03 11:24:09 . 2012-11-08 17:24:30 9125352 —-a-w- C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{8F4A2D49-4F21-43E7-871B-9308D513E644}\mpengine.dll 2013-01-02 11:48:15 . 2012-11-08 17:24:30 9125352 —-a-w- C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll 2013-01-01 14:00:09 . 2013-01-01 14:00:09 ——– d—–w- C:\Users\Nancy\AppData\Roaming\InstallShield Installation Information 2013-01-01 01:37:58 . 2013-01-01 01:37:58 ——– d—–w- C:\Studio Plus Vista Installer 2012-12-31 18:27:14 . 2012-12-31 18:27:14 ——– d—–w- C:\Users\Nancy\AppData\Roaming\MOVAVI 2012-12-31 16:41:46 . 2012-12-31 16:41:46 ——– d—–w- C:\Program Files (x86)\MSXML 4.0 2012-12-31 16:22:34 . 2012-12-31 16:22:34 ——– d—–w- C:\Users\Nancy\AppData\Local\Programs 2012-12-31 13:01:49 . 2012-01-03 07:03:12 810496 —-a-w- C:\Windows\system32\xvidcore.dll 2012-12-31 13:01:49 . 2012-01-03 07:03:12 80896 —-a-w- C:\Windows\system32\ff_vfw.dll 2012-12-31 13:01:49 . 2012-01-03 07:03:12 183808 —-a-w- C:\Windows\system32\xvidvfw.dll 2012-12-31 13:01:37 . 2012-01-03 07:03:10 389120 —-a-w- C:\Windows\SysWow64\actskn43.ocx 2012-12-31 13:01:37 . 2012-01-03 07:03:10 389120 —-a-w- C:\Windows\system32\actskn43.ocx 2012-12-31 12:57:22 . 2012-12-31 12:57:36 ——– d—–w- C:\Program Files (x86)\InfoAtoms 2012-12-30 14:00:24 . 2008-12-19 16:15:03 ——– d—–w- C:\Windows\SysWow64\InstantDVDRecorder 2012-12-30 14:00:24 . 2008-08-22 13:44:12 11878776 —-a-w- C:\Windows\SysWow64\drivers\Pinnacle_Video_Driver_64bit.exe 2012-12-30 14:00:24 . 2008-08-22 13:42:16 14326712 —-a-w- C:\Windows\SysWow64\drivers\Pinnacle_Video_Driver_32bit.exe 2012-12-30 13:49:40 . 2012-12-31 11:04:27 ——– d—–w- C:\temp 2012-12-30 13:24:34 . 2005-07-12 18:25:06 401408 —-a-w- C:\Windows\SysWow64\pvmjpg30.dll 2012-12-30 13:24:33 . 2003-04-21 20:11:38 82432 —-a-w- C:\Windows\SysWow64\msxml4r.dll 2012-12-30 13:24:33 . 2003-04-21 20:11:34 44544 —-a-w- C:\Windows\SysWow64\msxml4a.dll 2012-12-30 13:24:32 . 2006-11-15 15:29:28 1712128 —-a-w- C:\Windows\SysWow64\GDIPLUS.DLL 2012-12-30 13:21:56 . 2005-03-22 00:04:52 729088 —-a-w- C:\Program Files (x86)\Common Files\InstallShield\Professional\RunTime\09\01\Intel32\iKernel.dll 2012-12-30 13:21:56 . 2003-11-10 23:13:28 69715 —-a-w- C:\Program Files (x86)\Common Files\InstallShield\Professional\RunTime\09\01\Intel32\ctor.dll 2012-12-30 13:21:56 . 2003-11-10 23:12:42 266240 —-a-w- C:\Program Files (x86)\Common Files\InstallShield\Professional\RunTime\09\01\Intel32\iscript.dll 2012-12-30 13:21:56 . 2003-11-10 23:12:12 192512 —-a-w- C:\Program Files (x86)\Common Files\InstallShield\Professional\RunTime\09\01\Intel32\iuser.dll 2012-12-30 13:21:56 . 2003-11-10 23:11:58 5632 —-a-w- C:\Program Files (x86)\Common Files\InstallShield\Professional\RunTime\09\01\Intel32\DotNetInstaller.exe 2012-12-30 13:21:55 . 2012-12-30 13:21:55 311428 —-a-w- C:\Program Files (x86)\Common Files\InstallShield\Professional\RunTime\09\01\Intel32\setup.dll 2012-12-30 13:21:55 . 2012-12-30 13:21:55 188548 —-a-w- C:\Program Files (x86)\Common Files\InstallShield\Professional\RunTime\09\01\Intel32\iGdi.dll 2012-12-30 13:16:14 . 2012-12-30 13:40:42 ——– d—–w- C:\ProgramData\Pinnacle Studio 2012-12-29 19:24:32 . 2007-03-05 21:36:16 70656 —-a-w- C:\Windows\system32\PCLECoInst64.dll 2012-12-29 19:24:31 . 2007-06-21 22:51:46 215808 —-a-w- C:\Windows\system32\drivers\emDevice64.sys 2012-12-29 19:24:31 . 2007-06-21 22:51:32 6400 —-a-w- C:\Windows\system32\drivers\emFilter64.sys 2012-12-29 19:24:31 . 2007-06-21 22:51:30 6144 —-a-w- C:\Windows\system32\drivers\emScan64.sys 2012-12-29 19:24:31 . 2007-06-21 21:21:32 13824 —-a-w- C:\Windows\system32\emUSD64.dll 2012-12-29 19:24:31 . 2006-07-19 23:12:38 57344 —-a-w- C:\Windows\SysWow64\emVFW.dll 2012-12-29 19:24:31 . 2006-07-19 23:12:12 32768 —-a-w- C:\Windows\SysWow64\emProp.ax 2012-12-29 19:24:31 . 2004-09-15 00:25:54 17808 —-a-w- C:\Windows\SysWow64\emYUV.dll 2012-12-29 19:24:28 . 2007-08-31 19:15:34 79872 —-a-w- C:\Windows\system32\drivers\emAudio64.sys 2012-12-29 19:24:03 . 2012-12-29 19:24:03 ——– d—–w- C:\Program Files (x86)\Common Files\Pinnacle 2012-12-29 19:23:15 . 2012-12-29 19:23:15 ——– d—–w- C:\Users\Nancy\AppData\Local\Downloaded Installations 2012-12-29 16:59:07 . 2013-01-01 19:42:11 ——– d—–w- C:\Users\Nancy\AppData\Local\Pinnacle 2012-12-29 16:53:03 . 2007-03-06 22:53:42 41984 —-a-w- C:\Windows\SysWow64\cacheX.dll 2012-12-29 16:53:03 . 2006-04-11 21:03:14 233472 ——w- C:\Windows\SysWow64\DiskIO.dll 2012-12-29 16:53:03 . 2006-04-11 21:03:14 184320 ——w- C:\Windows\SysWow64\RALMain.dll 2012-12-29 16:53:03 . 2005-12-12 21:57:10 32768 ——w- C:\Windows\SysWow64\MLPagAx.dll 2012-12-29 16:53:03 . 2004-01-02 18:28:28 126976 ——w- C:\Windows\SysWow64\AVIPrAx.dll 2012-12-29 16:53:03 . 2001-12-12 04:21:32 73728 ——w- C:\Windows\SysWow64\MMAviAx.dll 2012-12-29 16:49:59 . 2006-10-09 11:07:22 487424 —-a-w- C:\Windows\SysWow64\MSVCP70.DLL 2012-12-29 16:49:58 . 2006-10-09 11:07:22 344064 —-a-w- C:\Windows\SysWow64\MSVCR70.DLL 2012-12-29 16:49:58 . 2003-03-19 11:05:48 89088 ——w- C:\Windows\SysWow64\atl71.dll 2012-12-29 16:49:58 . 2002-01-05 17:18:20 84992 ——w- C:\Windows\SysWow64\ATL70.DLL 2012-12-29 16:48:33 . 2012-12-30 13:40:27 ——– d—–w- C:\ProgramData\Pinnacle 2012-12-29 16:48:30 . 2013-01-01 02:06:43 ——– d—–w- C:\Program Files (x86)\Pinnacle 2012-12-29 16:47:45 . 2012-12-29 16:47:45 ——– d—–w- C:\Users\Nancy\AppData\Roaming\InstallShield 2012-12-27 15:53:21 . 2012-12-27 15:53:21 ——– d—–w- C:\Users\Nancy\AppData\Roaming\Red Kawa 2012-12-27 14:49:52 . 2012-12-27 14:49:52 ——– d—–w- C:\Users\Nancy\AppData\Local\Geckofx 2012-12-27 14:49:39 . 2012-12-27 14:49:39 ——– d—–w- C:\Program Files (x86)\Regensoft 2012-12-27 14:49:36 . 2012-12-27 14:49:37 ——– d—–w- C:\Program Files (x86)\AviSynth 2.5 2012-12-27 14:49:30 . 2012-12-27 14:49:30 ——– d—–w- C:\Program Files (x86)\Red Kawa 2012-12-24 10:40:35 . 2012-12-16 14:13:20 34304 —-a-w- C:\Windows\SysWow64\atmlib.dll 2012-12-24 10:40:34 . 2012-12-16 17:11:22 46080 —-a-w- C:\Windows\system32\atmlib.dll 2012-12-24 10:40:31 . 2012-12-16 14:45:03 367616 —-a-w- C:\Windows\system32\atmfd.dll 2012-12-24 10:40:28 . 2012-12-16 14:13:28 295424 —-a-w- C:\Windows\SysWow64\atmfd.dll 2012-12-18 12:31:33 . 2012-12-18 12:31:33 ——– d—–w- C:\Program Files\iPod 2012-12-18 12:31:30 . 2012-12-18 12:31:59 ——– d—–w- C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69 2012-12-18 12:31:30 . 2012-12-18 12:31:57 ——– d—–w- C:\Program Files\iTunes 2012-12-18 12:31:30 . 2012-12-18 12:31:56 ——– d—–w- C:\Program Files (x86)\iTunes 2012-12-12 13:20:00 . 2012-11-14 05:52:40 2382848 —-a-w- C:\Windows\system32\mshtml.tlb 2012-12-12 11:17:12 . 2012-11-09 05:45:09 2048 —-a-w- C:\Windows\system32\tzres.dll 2012-12-12 11:17:12 . 2012-11-09 04:42:49 2048 —-a-w- C:\Windows\SysWow64\tzres.dll 2012-12-12 11:17:06 . 2012-11-22 03:26:40 3149824 —-a-w- C:\Windows\system32\win32k.sys . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) 2013-01-03 19:34:51 . 2012-01-28 04:54:14 45056 —-a-w- C:\Windows\system32\acovcnt.exe 2012-12-14 21:49:28 . 2012-04-24 15:39:30 24176 —-a-w- C:\Windows\system32\drivers\mbam.sys 2012-12-12 14:48:26 . 2012-04-02 10:17:53 697272 —-a-w- C:\Windows\SysWow64\FlashPlayerApp.exe 2012-12-12 14:48:26 . 2012-01-30 13:18:26 73656 —-a-w- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl 2012-12-12 13:22:43 . 2012-01-28 18:53:11 67413224 —-a-w- C:\Windows\system32\MRT.exe 2012-11-28 09:49:27 . 2012-11-28 09:53:46 972264 ——w- C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{F94DA23E-81D2-4E7F-B9A2-9227BD0E27B3}\gapaengine.dll 2012-10-25 08:12:26 . 2012-10-25 08:12:26 94208 —-a-w- C:\Windows\SysWow64\QuickTimeVR.qtx 2012-10-25 08:12:26 . 2012-10-25 08:12:26 69632 —-a-w- C:\Windows\SysWow64\QuickTime.qts 2012-10-16 08:38:37 . 2012-11-28 09:53:30 135168 —-a-w- C:\Windows\apppatch\AppPatch64\AcXtrnal.dll 2012-10-16 08:38:34 . 2012-11-28 09:53:30 350208 —-a-w- C:\Windows\apppatch\AppPatch64\AcLayers.dll 2012-10-16 07:39:52 . 2012-11-28 09:53:30 561664 —-a-w- C:\Windows\apppatch\AcLayers.dll 2012-10-09 18:17:13 . 2012-11-16 10:16:26 55296 —-a-w- C:\Windows\system32\dhcpcsvc6.dll 2012-10-09 18:17:13 . 2012-11-16 10:16:26 226816 —-a-w- C:\Windows\system32\dhcpcore6.dll 2012-10-09 17:40:31 . 2012-11-16 10:16:26 44032 —-a-w- C:\Windows\SysWow64\dhcpcsvc6.dll 2012-10-09 17:40:31 . 2012-11-16 10:16:26 193536 —-a-w- C:\Windows\SysWow64\dhcpcore6.dll 2012-10-06 10:04:58 . 2012-02-10 10:11:56 972192 ——w- C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\NISBackup\gapaengine.dll ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_LOCAL_MACHINE\Wow6432Node\~\Browser Helper Objects\{103089DA-0F31-4A8B-843F-7D24A7FE8345}] 2012-12-23 00:21:38 144008 —-a-w- C:\Program Files (x86)\InfoAtoms\IE32\InfoAtomsClientIE.dll [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar] "{D6BAE600-1E87-4E36-9327-03A07808E7ED}"= "C:\Users\Nancy\AppData\Local\TNT2\Profiles\10285\passport.dll" [2012-10-14 13:24:26 11104] [HKEY_CLASSES_ROOT\clsid\{d6bae600-1e87-4e36-9327-03a07808e7ed}] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "DW7"="C:\Program Files (x86)\The Weather Channel\The Weather Channel App\TWCApp.exe" [2012-07-19 11:27:49 13003448] "Weather"="C:\Program Files (x86)\AWS\WeatherBug\Weather.exe" [2011-10-05 17:31:46 1652736] "PhotoshopElements8SyncAgent"="C:\Program Files (x86)\Adobe\Elements Organizer 8.0\ElementsOrganizerSyncAgent.exe" [2009-09-06 10:07:42 1893728] "RoboForm"="C:\Program Files (x86)\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe" [2012-12-14 11:33:48 109336] "LaunchList"="C:\Program Files (x86)\Pinnacle\Studio 11\LaunchList2.exe" [2007-03-21 19:41:38 145496] [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] "Nuance PDF Reader-reminder"="C:\Program Files (x86)\Nuance\PDF Reader\Ereg\Ereg.exe" [2008-11-03 18:02:06 328992] "ASUSPRP"="C:\Program Files (x86)\ASUS\APRP\APRP.EXE" [2011-10-18 04:27:25 3331312] "ASUSWebStorage"="C:\Program Files (x86)\ASUS\ASUS WebStorage\3.0.108.222\AsusWSPanel.exe" [2011-07-29 09:43:58 737104] "SonicMasterTray"="C:\Program Files (x86)\ASUS\Sonic Focus\SonicFocusTray.exe" [2010-07-10 06:45:00 984400] "FLxHCIm"="C:\Program Files\Fresco Logic Inc\Fresco Logic USB3.0 Host Controller\host\FLxHCIm.exe" [2011-04-08 23:46:08 43008] "ATKOSD2"="C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe" [2010-08-17 22:55:42 5732992] "ATKMEDIA"="C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe" [2010-10-07 22:05:14 170624] "HControlUser"="C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControlUser.exe" [2009-06-19 18:29:42 105016] "APSDaemon"="C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2012-11-28 19:13:16 59280] "Wireless Console 3"="C:\Program Files (x86)\ASUS\Wireless Console 3\wcourier.exe" [2011-06-10 14:49:10 2255360] "SunJavaUpdateSched"="C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe" [2012-07-03 13:04:54 252848] "QuickTime Task"="C:\Program Files (x86)\QuickTime\QTTask.exe" [2012-10-25 08:12:14 421888] "iTunesHelper"="C:\Program Files (x86)\iTunes\iTunesHelper.exe" [2012-12-12 18:57:10 152544] "PCLEUSBTip"="C:\Program Files (x86)\Pinnacle\Shared Files\Programs\USBTip\USBTip.exe" [2006-10-16 18:50:16 202312] "USBToolTip"="C:\Program Files (x86)\Pinnacle\Shared Files\\Programs\USBTip\USBTip.exe" [2006-10-16 18:50:16 202312] C:\Users\Nancy\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ EvernoteClipper.lnk - C:\Program Files (x86)\Evernote\Evernote\EvernoteClipper.exe [2012-12-3 1044320] OpenOffice.org 3.1.lnk - C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe [2009-4-16 384000] C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\ AsusVibeLauncher.lnk - C:\Program Files (x86)\ASUS\AsusVibe\AsusVibeLauncher.exe [2011-10-17 549040] Event Reminder.lnk - C:\Program Files (x86)\The Print Shop 23.1\Remind.exe [2010-6-21 344064] FancyStart daemon.lnk - C:\Windows\Installer\{C944B4C5-1C4D-4D95-8AC0-7CEF13914131}\_77B5857C27147149171BE7.exe [2012-4-2 12862] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "ConsentPromptBehaviorAdmin"= 5 (0x5) "ConsentPromptBehaviorUser"= 3 (0x3) "EnableUIADesktopToggle"= 0 (0x0) [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32] "mixer4"=wdmaud.drv [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc] @="Service" R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 21:27:14 138576] R2 lxdxCATSCustConnectService;lxdxCATSCustConnectService;C:\Windows\system32\spool\DRIVERS\x64\3\\lxdxserv.exe [2009-10-16 17:00:52 29184] R3 AMPPALP;Intel® Centrino® Bluetooth 3.0 + High Speed Protocol;C:\Windows\system32\DRIVERS\amppal.sys [2011-03-22 09:04:08 261632] R3 AmUStor;AM USB Stroage Driver;C:\Windows\system32\drivers\AmUStor.SYS [2010-05-03 03:46:04 44032] R3 intaud_WaveExtensible;Intel WiDi Audio Device;C:\Windows\system32\drivers\intelaud.sys [2011-03-24 14:47:02 34200] R3 MyWiFiDHCPDNS;Wireless PAN DHCP Server;C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe [2011-05-02 22:13:54 340240] R3 NisDrv;Microsoft Network Inspection System;C:\Windows\system32\DRIVERS\NisDrvWFP.sys [2012-08-31 02:03:48 128456] R3 NisSrv;Microsoft Network Inspection;C:\Program Files\Microsoft Security Client\NisSrv.exe [2012-09-13 01:21:48 368896] R3 SiSGbeLH;SiS191/SiS190 Ethernet Device NDIS 6.0 Driver;C:\Windows\system32\DRIVERS\SiSG664.sys [2009-06-10 20:35:57 56832] R3 TsUsbFlt;TsUsbFlt;C:\Windows\system32\drivers\tsusbflt.sys [2010-11-20 11:07:06 59392] R3 TsUsbGD;Remote Desktop Generic USB Device;C:\Windows\system32\drivers\TsUsbGD.sys [2010-11-20 11:07:06 31232] R3 USBAAPL64;Apple Mobile USB Driver;C:\Windows\system32\Drivers\usbaapl64.sys [2012-09-28 15:32:56 53760] R3 WatAdminSvc;Windows Activation Technologies Service;C:\Windows\system32\Wat\WatAdminSvc.exe [2012-01-28 18:47:25 1255736] R4 wlcrasvc;Windows Live Mesh remote connections service;C:\Program Files\Windows Live\Mesh\wlcrasvc.exe [2010-09-23 01:10:10 57184] S0 assd;assd; [x] S0 PxHlpa64;PxHlpa64;C:\Windows\System32\Drivers\PxHlpa64.sys [2008-06-16 07:00:00 55024] S1 ATKWMIACPIIO;ATKWMIACPI Driver;C:\Program Files (x86)\ASUS\ATK Package\ATK WMIACPI\atkwmiacpi64.sys [2010-07-26 21:57:20 17024] S2 AdobeActiveFileMonitor8.0;Adobe Active File Monitor V8;C:\Program Files (x86)\Adobe\Elements Organizer 8.0\PhotoshopElementsFileAgent.exe [2009-09-06 10:06:20 169312] S2 AFBAgent;AFBAgent;C:\Windows\system32\FBAgent.exe [2011-03-04 00:57:58 379520] S2 AMPPALR3;Intel® Centrino® Bluetooth 3.0 + High Speed Service;C:\Program Files\Intel\BluetoothHS\BTHSAmpPalService.exe [2011-03-22 09:10:26 1136128] S2 ASMMAP64;ASMMAP64;C:\Program Files (x86)\ASUS\ATK Package\ATKGFNEX\ASMMAP64.sys [2009-07-03 01:36:14 15416] S2 Bluetooth Device Monitor;Bluetooth Device Monitor;C:\Program Files (x86)\Intel\Bluetooth\devmonsrv.exe [2011-03-30 22:42:30 923984] S2 Bluetooth OBEX Service;Bluetooth OBEX Service;C:\Program Files (x86)\Intel\Bluetooth\obexsrv.exe [2011-03-30 22:42:34 1001808] S2 BTHSSecurityMgr;Intel® Centrino® Wireless Bluetooth® 3.0 + High Speed Security Service;C:\Program Files\Intel\BluetoothHS\BTHSSecurityMgr.exe [2011-02-24 04:20:56 134928] S2 GsServer;GoodSync Server;C:\Program Files\Siber Systems\GoodSync\Gs-Server.exe [2012-01-26 19:39:52 4674488] S2 lxdx_device;lxdx_device;C:\Windows\system32\lxdxcoms.exe [2009-10-16 17:10:44 1039872] S2 MBAMScheduler;MBAMScheduler;C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [2012-12-14 21:49:28 398184] S2 MBAMService;MBAMService;C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2012-12-14 21:49:28 682344] S2 SBSDWSCService;SBSD Security Center Service;C:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe [2009-01-26 20:31:10 1153368] S2 TurboB;Turbo Boost UI Monitor driver;C:\Windows\system32\DRIVERS\TurboB.sys [2010-04-17 00:07:28 13832] S2 TurboBoost;Intel® Turbo Boost Technology Monitor;C:\Program Files\Intel\TurboBoost\TurboBoost.exe [2010-04-17 00:07:42 134928] S3 AMPPAL;Intel® Centrino® Bluetooth 3.0 + High Speed Virtual Adapter;C:\Windows\system32\DRIVERS\AMPPAL.sys [2011-03-22 09:04:08 261632] S3 Bluetooth Media Service;Bluetooth Media Service;C:\Program Files (x86)\Intel\Bluetooth\mediasrv.exe [2011-03-30 22:42:32 1321296] S3 btmaux;Intel Bluetooth Auxiliary Service;C:\Windows\system32\DRIVERS\btmaux.sys [2011-03-08 22:44:08 51712] S3 btmhsf;btmhsf;C:\Windows\system32\DRIVERS\btmhsf.sys [2011-11-15 06:13:00 327168] S3 ETD;ELAN PS/2 Port Input Device;C:\Windows\system32\DRIVERS\ETD.sys [2010-12-13 13:12:40 138024] S3 FLxHCIc;Fresco Logic xHCI (USB3) Device Driver;C:\Windows\system32\DRIVERS\FLxHCIc.sys [2011-04-08 23:46:08 177152] S3 FLxHCIh;Fresco Logic xHCI (USB3) Hub Device Driver;C:\Windows\system32\DRIVERS\FLxHCIh.sys [2011-04-08 23:46:08 56320] S3 iBtFltCoex;iBtFltCoex;C:\Windows\system32\DRIVERS\iBtFltCoex.sys [2011-12-10 00:45:00 60416] S3 IntcDAud;Intel® Display Audio;C:\Windows\system32\DRIVERS\IntcDAud.sys [2010-10-14 16:28:16 317440] S3 iwdbus;IWD Bus Enumerator;C:\Windows\system32\DRIVERS\iwdbus.sys [2011-03-24 14:47:02 25496] S3 L1C;NDIS Miniport Driver for Atheros AR813x/AR815x PCI-E Ethernet Controller;C:\Windows\system32\DRIVERS\L1C62x64.sys [2010-08-24 09:55:44 76912] S3 MBAMProtector;MBAMProtector;C:\Windows\system32\drivers\mbam.sys [2012-12-14 21:49:28 24176] S3 wdkmd;Intel WiDi KMD;C:\Windows\system32\DRIVERS\WDKMD.sys [2011-03-24 14:47:04 42392] Contents of the 'Scheduled Tasks' folder 2013-01-03 C:\Windows\Tasks\Adobe Flash Player Updater.job - C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-02 10:17:53 . 2012-12-12 14:48:26] ——— X64 Entries ———– [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar] "{D6BAE600-1E87-4E36-9327-03A07808E7ED}"= "C:\Users\Nancy\AppData\Local\TNT2\Profiles\10285\passport64.dll" [2012-10-14 13:24:26 11616] [HKEY_CLASSES_ROOT\CLSID\{D6BAE600-1E87-4E36-9327-03A07808E7ED}] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\AsusWSShellExt_B] @="{6D4133E5-0742-4ADC-8A8C-9303440F7190}" [HKEY_CLASSES_ROOT\CLSID\{6D4133E5-0742-4ADC-8A8C-9303440F7190}] 2011-05-25 07:09:22 227840 —-a-w- C:\Program Files (x86)\ASUS\ASUS WebStorage\3.0.108.222\AsusWSShellExt64.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\AsusWSShellExt_O] @="{64174815-8D98-4CE6-8646-4C039977D808}" [HKEY_CLASSES_ROOT\CLSID\{64174815-8D98-4CE6-8646-4C039977D808}] 2011-05-25 07:09:22 227840 —-a-w- C:\Program Files (x86)\ASUS\ASUS WebStorage\3.0.108.222\AsusWSShellExt64.dll [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "AmIcoSinglun64"="C:\Program Files (x86)\AmIcoSingLun\AmIcoSinglun64.exe" [2010-05-03 05:56:48 324096] "IntelPAN"="C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe" [2011-05-02 22:16:58 1935120] "BTMTrayAgent"="C:\Program Files (x86)\Intel\Bluetooth\btmshell.dll" [2011-03-30 22:41:56 10372368] "IntelTBRunOnce"="wscript.exe" [2009-07-14 01:39:57 168960] "RtHDVBg"="C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe" [2011-07-13 19:58:24 2264168] "MSC"="C:\Program Files\Microsoft Security Client\msseces.exe" [2012-09-13 01:16:10 1289704] "IgfxTray"="C:\Windows\system32\igfxtray.exe" [2012-03-20 03:44:20 170264] "HotKeysCmds"="C:\Windows\system32\hkcmd.exe" [2012-03-20 03:44:20 398616] "Persistence"="C:\Windows\system32\igfxpers.exe" [2012-03-20 03:44:20 439064] "lxdxmon.exe"="C:\Program Files (x86)\Lexmark 3600-4600 Series\lxdxmon.exe" [2010-02-04 05:27:55 672424] "lxdxamon"="C:\Program Files (x86)\Lexmark 3600-4600 Series\lxdxamon.exe" [2010-02-04 05:28:04 16040] ——- Supplementary Scan ——- uLocal Page = C:\Windows\system32\blank.htm uStart Page = hxxp://www.google.com mStart Page = hxxp://asus.msn.com mLocal Page = C:\Windows\SysWOW64\blank.htm uInternet Settings,ProxyOverride = *.local uSearchAssistant = hxxp://www.google.com IE: Add to Evernote 4.0 - C:\Program Files (x86)\Evernote\Evernote\EvernoteIE.dll/204 IE: Customize Menu - file://C:\Program Files (x86)\Siber Systems\AI RoboForm\RoboFormComCustomizeIEMenu.html IE: Fill Forms - file://C:\Program Files (x86)\Siber Systems\AI RoboForm\RoboFormComFillForms.html IE: Save Forms - file://C:\Program Files (x86)\Siber Systems\AI RoboForm\RoboFormComSavePass.html IE: Show RoboForm Toolbar - file://C:\Program Files (x86)\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html TCP: DhcpNameServer = 10.0.1.1 FF - ProfilePath - C:\Users\Nancy\AppData\Roaming\Mozilla\Firefox\Profiles\pqxe4c84.default\ FF - prefs.js: browser.startup.homepage - hxxp://us-mg4.mail.yahoo.com/neo/launch?.rand=26gi0q9rci4qq FF - ExtSQL: 2012-12-31 07:57; [removed]; C:\Program Files (x86)\Mozilla Firefox\extensions\[removed] FF - ExtSQL: !HIDDEN! 2012-12-31 07:57; [removed]; C:\Program Files (x86)\Mozilla Firefox\extensions\[removed] - - - - ORPHANS REMOVED - - - - Toolbar-Locked - (no file) Wow6432Node-HKLM-Run-StopDefragment - Install\StopDefragment.exe Toolbar-Locked - (no file) HKLM-Run-ETDCtrl - C:\Program Files (x86)\Elantech\ETDCtrl.exe

This is everything ComboFix 13-01-03.05 - Nancy 01/03/2013 16:17:09.1.4 - x64 Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.8103.5774 [GMT -5:00] Running from: C:\Users\[removed]\Downloads\ComboFix.exe AV: Microsoft Security Essentials *Enabled/Updated* {B140BF4E-23BB-4198-90AB-A51A4C60A69C} SP: Microsoft Security Essentials *Enabled/Updated* {0A215EAA-0581-4E16-AA1B-9E6837E7EC21} SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) C:\Program Files (x86)\UNWISE.EXE C:\ProgramData\Roaming C:\ProgramData\SPLB892.tmp C:\ProgramData\SPLCC36.tmp C:\ProgramData\SPLCEFD.tmp C:\ProgramData\SPLF0BA.tmp C:\test.txt C:\Users\Nancy\GoToAssistDownloadHelper.exe C:\Windows\AsPatch10430001.exe C:\Windows\msvcr71.dll C:\Windows\SysWow64\AutoRun.inf C:\Windows\SysWow64\URTTemp C:\Windows\SysWow64\URTTemp\regtlib.exe ((((((((((((((((((((((((( Files Created from 2012-12-03 to 2013-01-03 ))))))))))))))))))))))))))))))) 2013-01-03 21:40:05 . 2013-01-03 21:40:05 ——– d—–w- C:\Users\Default\AppData\Local\temp 2013-01-03 11:24:09 . 2012-11-08 17:24:30 9125352 —-a-w- C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{8F4A2D49-4F21-43E7-871B-9308D513E644}\mpengine.dll 2013-01-02 11:48:15 . 2012-11-08 17:24:30 9125352 —-a-w- C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll 2013-01-01 14:00:09 . 2013-01-01 14:00:09 ——– d—–w- C:\Users\Nancy\AppData\Roaming\InstallShield Installation Information 2013-01-01 01:37:58 . 2013-01-01 01:37:58 ——– d—–w- C:\Studio Plus Vista Installer 2012-12-31 18:27:14 . 2012-12-31 18:27:14 ——– d—–w- C:\Users\Nancy\AppData\Roaming\MOVAVI 2012-12-31 16:41:46 . 2012-12-31 16:41:46 ——– d—–w- C:\Program Files (x86)\MSXML 4.0 2012-12-31 16:22:34 . 2012-12-31 16:22:34 ——– d—–w- C:\Users\Nancy\AppData\Local\Programs 2012-12-31 13:01:49 . 2012-01-03 07:03:12 810496 —-a-w- C:\Windows\system32\xvidcore.dll 2012-12-31 13:01:49 . 2012-01-03 07:03:12 80896 —-a-w- C:\Windows\system32\ff_vfw.dll 2012-12-31 13:01:49 . 2012-01-03 07:03:12 183808 —-a-w- C:\Windows\system32\xvidvfw.dll 2012-12-31 13:01:37 . 2012-01-03 07:03:10 389120 —-a-w- C:\Windows\SysWow64\actskn43.ocx 2012-12-31 13:01:37 . 2012-01-03 07:03:10 389120 —-a-w- C:\Windows\system32\actskn43.ocx 2012-12-31 12:57:22 . 2012-12-31 12:57:36 ——– d—–w- C:\Program Files (x86)\InfoAtoms 2012-12-30 14:00:24 . 2008-12-19 16:15:03 ——– d—–w- C:\Windows\SysWow64\InstantDVDRecorder 2012-12-30 14:00:24 . 2008-08-22 13:44:12 11878776 —-a-w- C:\Windows\SysWow64\drivers\Pinnacle_Video_Driver_64bit.exe 2012-12-30 14:00:24 . 2008-08-22 13:42:16 14326712 —-a-w- C:\Windows\SysWow64\drivers\Pinnacle_Video_Driver_32bit.exe 2012-12-30 13:49:40 . 2012-12-31 11:04:27 ——– d—–w- C:\temp 2012-12-30 13:24:34 . 2005-07-12 18:25:06 401408 —-a-w- C:\Windows\SysWow64\pvmjpg30.dll 2012-12-30 13:24:33 . 2003-04-21 20:11:38 82432 —-a-w- C:\Windows\SysWow64\msxml4r.dll 2012-12-30 13:24:33 . 2003-04-21 20:11:34 44544 —-a-w- C:\Windows\SysWow64\msxml4a.dll 2012-12-30 13:24:32 . 2006-11-15 15:29:28 1712128 —-a-w- C:\Windows\SysWow64\GDIPLUS.DLL 2012-12-30 13:21:56 . 2005-03-22 00:04:52 729088 —-a-w- C:\Program Files (x86)\Common Files\InstallShield\Professional\RunTime\09\01\Intel32\iKernel.dll 2012-12-30 13:21:56 . 2003-11-10 23:13:28 69715 —-a-w- C:\Program Files (x86)\Common Files\InstallShield\Professional\RunTime\09\01\Intel32\ctor.dll 2012-12-30 13:21:56 . 2003-11-10 23:12:42 266240 —-a-w- C:\Program Files (x86)\Common Files\InstallShield\Professional\RunTime\09\01\Intel32\iscript.dll 2012-12-30 13:21:56 . 2003-11-10 23:12:12 192512 —-a-w- C:\Program Files (x86)\Common Files\InstallShield\Professional\RunTime\09\01\Intel32\iuser.dll 2012-12-30 13:21:56 . 2003-11-10 23:11:58 5632 —-a-w- C:\Program Files (x86)\Common Files\InstallShield\Professional\RunTime\09\01\Intel32\DotNetInstaller.exe 2012-12-30 13:21:55 . 2012-12-30 13:21:55 311428 —-a-w- C:\Program Files (x86)\Common Files\InstallShield\Professional\RunTime\09\01\Intel32\setup.dll 2012-12-30 13:21:55 . 2012-12-30 13:21:55 188548 —-a-w- C:\Program Files (x86)\Common Files\InstallShield\Professional\RunTime\09\01\Intel32\iGdi.dll 2012-12-30 13:16:14 . 2012-12-30 13:40:42 ——– d—–w- C:\ProgramData\Pinnacle Studio 2012-12-29 19:24:32 . 2007-03-05 21:36:16 70656 —-a-w- C:\Windows\system32\PCLECoInst64.dll 2012-12-29 19:24:31 . 2007-06-21 22:51:46 215808 —-a-w- C:\Windows\system32\drivers\emDevice64.sys 2012-12-29 19:24:31 . 2007-06-21 22:51:32 6400 —-a-w- C:\Windows\system32\drivers\emFilter64.sys 2012-12-29 19:24:31 . 2007-06-21 22:51:30 6144 —-a-w- C:\Windows\system32\drivers\emScan64.sys 2012-12-29 19:24:31 . 2007-06-21 21:21:32 13824 —-a-w- C:\Windows\system32\emUSD64.dll 2012-12-29 19:24:31 . 2006-07-19 23:12:38 57344 —-a-w- C:\Windows\SysWow64\emVFW.dll 2012-12-29 19:24:31 . 2006-07-19 23:12:12 32768 —-a-w- C:\Windows\SysWow64\emProp.ax 2012-12-29 19:24:31 . 2004-09-15 00:25:54 17808 —-a-w- C:\Windows\SysWow64\emYUV.dll 2012-12-29 19:24:28 . 2007-08-31 19:15:34 79872 —-a-w- C:\Windows\system32\drivers\emAudio64.sys 2012-12-29 19:24:03 . 2012-12-29 19:24:03 ——– d—–w- C:\Program Files (x86)\Common Files\Pinnacle 2012-12-29 19:23:15 . 2012-12-29 19:23:15 ——– d—–w- C:\Users\Nancy\AppData\Local\Downloaded Installations 2012-12-29 16:59:07 . 2013-01-01 19:42:11 ——– d—–w- C:\Users\Nancy\AppData\Local\Pinnacle 2012-12-29 16:53:03 . 2007-03-06 22:53:42 41984 —-a-w- C:\Windows\SysWow64\cacheX.dll 2012-12-29 16:53:03 . 2006-04-11 21:03:14 233472 ——w- C:\Windows\SysWow64\DiskIO.dll 2012-12-29 16:53:03 . 2006-04-11 21:03:14 184320 ——w- C:\Windows\SysWow64\RALMain.dll 2012-12-29 16:53:03 . 2005-12-12 21:57:10 32768 ——w- C:\Windows\SysWow64\MLPagAx.dll 2012-12-29 16:53:03 . 2004-01-02 18:28:28 126976 ——w- C:\Windows\SysWow64\AVIPrAx.dll 2012-12-29 16:53:03 . 2001-12-12 04:21:32 73728 ——w- C:\Windows\SysWow64\MMAviAx.dll 2012-12-29 16:49:59 . 2006-10-09 11:07:22 487424 —-a-w- C:\Windows\SysWow64\MSVCP70.DLL 2012-12-29 16:49:58 . 2006-10-09 11:07:22 344064 —-a-w- C:\Windows\SysWow64\MSVCR70.DLL 2012-12-29 16:49:58 . 2003-03-19 11:05:48 89088 ——w- C:\Windows\SysWow64\atl71.dll 2012-12-29 16:49:58 . 2002-01-05 17:18:20 84992 ——w- C:\Windows\SysWow64\ATL70.DLL 2012-12-29 16:48:33 . 2012-12-30 13:40:27 ——– d—–w- C:\ProgramData\Pinnacle 2012-12-29 16:48:30 . 2013-01-01 02:06:43 ——– d—–w- C:\Program Files (x86)\Pinnacle 2012-12-29 16:47:45 . 2012-12-29 16:47:45 ——– d—–w- C:\Users\Nancy\AppData\Roaming\InstallShield 2012-12-27 15:53:21 . 2012-12-27 15:53:21 ——– d—–w- C:\Users\Nancy\AppData\Roaming\Red Kawa 2012-12-27 14:49:52 . 2012-12-27 14:49:52 ——– d—–w- C:\Users\Nancy\AppData\Local\Geckofx 2012-12-27 14:49:39 . 2012-12-27 14:49:39 ——– d—–w- C:\Program Files (x86)\Regensoft 2012-12-27 14:49:36 . 2012-12-27 14:49:37 ——– d—–w- C:\Program Files (x86)\AviSynth 2.5 2012-12-27 14:49:30 . 2012-12-27 14:49:30 ——– d—–w- C:\Program Files (x86)\Red Kawa 2012-12-24 10:40:35 . 2012-12-16 14:13:20 34304 —-a-w- C:\Windows\SysWow64\atmlib.dll 2012-12-24 10:40:34 . 2012-12-16 17:11:22 46080 —-a-w- C:\Windows\system32\atmlib.dll 2012-12-24 10:40:31 . 2012-12-16 14:45:03 367616 —-a-w- C:\Windows\system32\atmfd.dll 2012-12-24 10:40:28 . 2012-12-16 14:13:28 295424 —-a-w- C:\Windows\SysWow64\atmfd.dll 2012-12-18 12:31:33 . 2012-12-18 12:31:33 ——– d—–w- C:\Program Files\iPod 2012-12-18 12:31:30 . 2012-12-18 12:31:59 ——– d—–w- C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69 2012-12-18 12:31:30 . 2012-12-18 12:31:57 ——– d—–w- C:\Program Files\iTunes 2012-12-18 12:31:30 . 2012-12-18 12:31:56 ——– d—–w- C:\Program Files (x86)\iTunes 2012-12-12 13:20:00 . 2012-11-14 05:52:40 2382848 —-a-w- C:\Windows\system32\mshtml.tlb 2012-12-12 11:17:12 . 2012-11-09 05:45:09 2048 —-a-w- C:\Windows\system32\tzres.dll 2012-12-12 11:17:12 . 2012-11-09 04:42:49 2048 —-a-w- C:\Windows\SysWow64\tzres.dll 2012-12-12 11:17:06 . 2012-11-22 03:26:40 3149824 —-a-w- C:\Windows\system32\win32k.sys . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) 2013-01-03 19:34:51 . 2012-01-28 04:54:14 45056 —-a-w- C:\Windows\system32\acovcnt.exe 2012-12-14 21:49:28 . 2012-04-24 15:39:30 24176 —-a-w- C:\Windows\system32\drivers\mbam.sys 2012-12-12 14:48:26 . 2012-04-02 10:17:53 697272 —-a-w- C:\Windows\SysWow64\FlashPlayerApp.exe 2012-12-12 14:48:26 . 2012-01-30 13:18:26 73656 —-a-w- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl 2012-12-12 13:22:43 . 2012-01-28 18:53:11 67413224 —-a-w- C:\Windows\system32\MRT.exe 2012-11-28 09:49:27 . 2012-11-28 09:53:46 972264 ——w- C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{F94DA23E-81D2-4E7F-B9A2-9227BD0E27B3}\gapaengine.dll 2012-10-25 08:12:26 . 2012-10-25 08:12:26 94208 —-a-w- C:\Windows\SysWow64\QuickTimeVR.qtx 2012-10-25 08:12:26 . 2012-10-25 08:12:26 69632 —-a-w- C:\Windows\SysWow64\QuickTime.qts 2012-10-16 08:38:37 . 2012-11-28 09:53:30 135168 —-a-w- C:\Windows\apppatch\AppPatch64\AcXtrnal.dll 2012-10-16 08:38:34 . 2012-11-28 09:53:30 350208 —-a-w- C:\Windows\apppatch\AppPatch64\AcLayers.dll 2012-10-16 07:39:52 . 2012-11-28 09:53:30 561664 —-a-w- C:\Windows\apppatch\AcLayers.dll 2012-10-09 18:17:13 . 2012-11-16 10:16:26 55296 —-a-w- C:\Windows\system32\dhcpcsvc6.dll 2012-10-09 18:17:13 . 2012-11-16 10:16:26 226816 —-a-w- C:\Windows\system32\dhcpcore6.dll 2012-10-09 17:40:31 . 2012-11-16 10:16:26 44032 —-a-w- C:\Windows\SysWow64\dhcpcsvc6.dll 2012-10-09 17:40:31 . 2012-11-16 10:16:26 193536 —-a-w- C:\Windows\SysWow64\dhcpcore6.dll 2012-10-06 10:04:58 . 2012-02-10 10:11:56 972192 ——w- C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\NISBackup\gapaengine.dll ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_LOCAL_MACHINE\Wow6432Node\~\Browser Helper Objects\{103089DA-0F31-4A8B-843F-7D24A7FE8345}] 2012-12-23 00:21:38 144008 —-a-w- C:\Program Files (x86)\InfoAtoms\IE32\InfoAtomsClientIE.dll [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar] "{D6BAE600-1E87-4E36-9327-03A07808E7ED}"= "C:\Users\Nancy\AppData\Local\TNT2\Profiles\10285\passport.dll" [2012-10-14 13:24:26 11104] [HKEY_CLASSES_ROOT\clsid\{d6bae600-1e87-4e36-9327-03a07808e7ed}] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "DW7"="C:\Program Files (x86)\The Weather Channel\The Weather Channel App\TWCApp.exe" [2012-07-19 11:27:49 13003448] "Weather"="C:\Program Files (x86)\AWS\WeatherBug\Weather.exe" [2011-10-05 17:31:46 1652736] "PhotoshopElements8SyncAgent"="C:\Program Files (x86)\Adobe\Elements Organizer 8.0\ElementsOrganizerSyncAgent.exe" [2009-09-06 10:07:42 1893728] "RoboForm"="C:\Program Files (x86)\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe" [2012-12-14 11:33:48 109336] "LaunchList"="C:\Program Files (x86)\Pinnacle\Studio 11\LaunchList2.exe" [2007-03-21 19:41:38 145496] [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] "Nuance PDF Reader-reminder"="C:\Program Files (x86)\Nuance\PDF Reader\Ereg\Ereg.exe" [2008-11-03 18:02:06 328992] "ASUSPRP"="C:\Program Files (x86)\ASUS\APRP\APRP.EXE" [2011-10-18 04:27:25 3331312] "ASUSWebStorage"="C:\Program Files (x86)\ASUS\ASUS WebStorage\3.0.108.222\AsusWSPanel.exe" [2011-07-29 09:43:58 737104] "SonicMasterTray"="C:\Program Files (x86)\ASUS\Sonic Focus\SonicFocusTray.exe" [2010-07-10 06:45:00 984400] "FLxHCIm"="C:\Program Files\Fresco Logic Inc\Fresco Logic USB3.0 Host Controller\host\FLxHCIm.exe" [2011-04-08 23:46:08 43008] "ATKOSD2"="C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe" [2010-08-17 22:55:42 5732992] "ATKMEDIA"="C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe" [2010-10-07 22:05:14 170624] "HControlUser"="C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControlUser.exe" [2009-06-19 18:29:42 105016] "APSDaemon"="C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2012-11-28 19:13:16 59280] "Wireless Console 3"="C:\Program Files (x86)\ASUS\Wireless Console 3\wcourier.exe" [2011-06-10 14:49:10 2255360] "SunJavaUpdateSched"="C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe" [2012-07-03 13:04:54 252848] "QuickTime Task"="C:\Program Files (x86)\QuickTime\QTTask.exe" [2012-10-25 08:12:14 421888] "iTunesHelper"="C:\Program Files (x86)\iTunes\iTunesHelper.exe" [2012-12-12 18:57:10 152544] "PCLEUSBTip"="C:\Program Files (x86)\Pinnacle\Shared Files\Programs\USBTip\USBTip.exe" [2006-10-16 18:50:16 202312] "USBToolTip"="C:\Program Files (x86)\Pinnacle\Shared Files\\Programs\USBTip\USBTip.exe" [2006-10-16 18:50:16 202312] C:\Users\Nancy\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ EvernoteClipper.lnk - C:\Program Files (x86)\Evernote\Evernote\EvernoteClipper.exe [2012-12-3 1044320] OpenOffice.org 3.1.lnk - C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe [2009-4-16 384000] C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\ AsusVibeLauncher.lnk - C:\Program Files (x86)\ASUS\AsusVibe\AsusVibeLauncher.exe [2011-10-17 549040] Event Reminder.lnk - C:\Program Files (x86)\The Print Shop 23.1\Remind.exe [2010-6-21 344064] FancyStart daemon.lnk - C:\Windows\Installer\{C944B4C5-1C4D-4D95-8AC0-7CEF13914131}\_77B5857C27147149171BE7.exe [2012-4-2 12862] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "ConsentPromptBehaviorAdmin"= 5 (0x5) "ConsentPromptBehaviorUser"= 3 (0x3) "EnableUIADesktopToggle"= 0 (0x0) [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32] "mixer4"=wdmaud.drv [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc] @="Service" R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 21:27:14 138576] R2 lxdxCATSCustConnectService;lxdxCATSCustConnectService;C:\Windows\system32\spool\DRIVERS\x64\3\\lxdxserv.exe [2009-10-16 17:00:52 29184] R3 AMPPALP;Intel® Centrino® Bluetooth 3.0 + High Speed Protocol;C:\Windows\system32\DRIVERS\amppal.sys [2011-03-22 09:04:08 261632] R3 AmUStor;AM USB Stroage Driver;C:\Windows\system32\drivers\AmUStor.SYS [2010-05-03 03:46:04 44032] R3 intaud_WaveExtensible;Intel WiDi Audio Device;C:\Windows\system32\drivers\intelaud.sys [2011-03-24 14:47:02 34200] R3 MyWiFiDHCPDNS;Wireless PAN DHCP Server;C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe [2011-05-02 22:13:54 340240] R3 NisDrv;Microsoft Network Inspection System;C:\Windows\system32\DRIVERS\NisDrvWFP.sys [2012-08-31 02:03:48 128456] R3 NisSrv;Microsoft Network Inspection;C:\Program Files\Microsoft Security Client\NisSrv.exe [2012-09-13 01:21:48 368896] R3 SiSGbeLH;SiS191/SiS190 Ethernet Device NDIS 6.0 Driver;C:\Windows\system32\DRIVERS\SiSG664.sys [2009-06-10 20:35:57 56832] R3 TsUsbFlt;TsUsbFlt;C:\Windows\system32\drivers\tsusbflt.sys [2010-11-20 11:07:06 59392] R3 TsUsbGD;Remote Desktop Generic USB Device;C:\Windows\system32\drivers\TsUsbGD.sys [2010-11-20 11:07:06 31232] R3 USBAAPL64;Apple Mobile USB Driver;C:\Windows\system32\Drivers\usbaapl64.sys [2012-09-28 15:32:56 53760] R3 WatAdminSvc;Windows Activation Technologies Service;C:\Windows\system32\Wat\WatAdminSvc.exe [2012-01-28 18:47:25 1255736] R4 wlcrasvc;Windows Live Mesh remote connections service;C:\Program Files\Windows Live\Mesh\wlcrasvc.exe [2010-09-23 01:10:10 57184] S0 assd;assd; [x] S0 PxHlpa64;PxHlpa64;C:\Windows\System32\Drivers\PxHlpa64.sys [2008-06-16 07:00:00 55024] S1 ATKWMIACPIIO;ATKWMIACPI Driver;C:\Program Files (x86)\ASUS\ATK Package\ATK WMIACPI\atkwmiacpi64.sys [2010-07-26 21:57:20 17024] S2 AdobeActiveFileMonitor8.0;Adobe Active File Monitor V8;C:\Program Files (x86)\Adobe\Elements Organizer 8.0\PhotoshopElementsFileAgent.exe [2009-09-06 10:06:20 169312] S2 AFBAgent;AFBAgent;C:\Windows\system32\FBAgent.exe [2011-03-04 00:57:58 379520] S2 AMPPALR3;Intel® Centrino® Bluetooth 3.0 + High Speed Service;C:\Program Files\Intel\BluetoothHS\BTHSAmpPalService.exe [2011-03-22 09:10:26 1136128] S2 ASMMAP64;ASMMAP64;C:\Program Files (x86)\ASUS\ATK Package\ATKGFNEX\ASMMAP64.sys [2009-07-03 01:36:14 15416] S2 Bluetooth Device Monitor;Bluetooth Device Monitor;C:\Program Files (x86)\Intel\Bluetooth\devmonsrv.exe [2011-03-30 22:42:30 923984] S2 Bluetooth OBEX Service;Bluetooth OBEX Service;C:\Program Files (x86)\Intel\Bluetooth\obexsrv.exe [2011-03-30 22:42:34 1001808] S2 BTHSSecurityMgr;Intel® Centrino® Wireless Bluetooth® 3.0 + High Speed Security Service;C:\Program Files\Intel\BluetoothHS\BTHSSecurityMgr.exe [2011-02-24 04:20:56 134928] S2 GsServer;GoodSync Server;C:\Program Files\Siber Systems\GoodSync\Gs-Server.exe [2012-01-26 19:39:52 4674488] S2 lxdx_device;lxdx_device;C:\Windows\system32\lxdxcoms.exe [2009-10-16 17:10:44 1039872] S2 MBAMScheduler;MBAMScheduler;C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [2012-12-14 21:49:28 398184] S2 MBAMService;MBAMService;C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2012-12-14 21:49:28 682344] S2 SBSDWSCService;SBSD Security Center Service;C:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe [2009-01-26 20:31:10 1153368] S2 TurboB;Turbo Boost UI Monitor driver;C:\Windows\system32\DRIVERS\TurboB.sys [2010-04-17 00:07:28 13832] S2 TurboBoost;Intel® Turbo Boost Technology Monitor;C:\Program Files\Intel\TurboBoost\TurboBoost.exe [2010-04-17 00:07:42 134928] S3 AMPPAL;Intel® Centrino® Bluetooth 3.0 + High Speed Virtual Adapter;C:\Windows\system32\DRIVERS\AMPPAL.sys [2011-03-22 09:04:08 261632] S3 Bluetooth Media Service;Bluetooth Media Service;C:\Program Files (x86)\Intel\Bluetooth\mediasrv.exe [2011-03-30 22:42:32 1321296] S3 btmaux;Intel Bluetooth Auxiliary Service;C:\Windows\system32\DRIVERS\btmaux.sys [2011-03-08 22:44:08 51712] S3 btmhsf;btmhsf;C:\Windows\system32\DRIVERS\btmhsf.sys [2011-11-15 06:13:00 327168] S3 ETD;ELAN PS/2 Port Input Device;C:\Windows\system32\DRIVERS\ETD.sys [2010-12-13 13:12:40 138024] S3 FLxHCIc;Fresco Logic xHCI (USB3) Device Driver;C:\Windows\system32\DRIVERS\FLxHCIc.sys [2011-04-08 23:46:08 177152] S3 FLxHCIh;Fresco Logic xHCI (USB3) Hub Device Driver;C:\Windows\system32\DRIVERS\FLxHCIh.sys [2011-04-08 23:46:08 56320] S3 iBtFltCoex;iBtFltCoex;C:\Windows\system32\DRIVERS\iBtFltCoex.sys [2011-12-10 00:45:00 60416] S3 IntcDAud;Intel® Display Audio;C:\Windows\system32\DRIVERS\IntcDAud.sys [2010-10-14 16:28:16 317440] S3 iwdbus;IWD Bus Enumerator;C:\Windows\system32\DRIVERS\iwdbus.sys [2011-03-24 14:47:02 25496] S3 L1C;NDIS Miniport Driver for Atheros AR813x/AR815x PCI-E Ethernet Controller;C:\Windows\system32\DRIVERS\L1C62x64.sys [2010-08-24 09:55:44 76912] S3 MBAMProtector;MBAMProtector;C:\Windows\system32\drivers\mbam.sys [2012-12-14 21:49:28 24176] S3 wdkmd;Intel WiDi KMD;C:\Windows\system32\DRIVERS\WDKMD.sys [2011-03-24 14:47:04 42392] Contents of the 'Scheduled Tasks' folder 2013-01-03 C:\Windows\Tasks\Adobe Flash Player Updater.job - C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-02 10:17:53 . 2012-12-12 14:48:26] ——— X64 Entries ———– [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar] "{D6BAE600-1E87-4E36-9327-03A07808E7ED}"= "C:\Users\Nancy\AppData\Local\TNT2\Profiles\10285\passport64.dll" [2012-10-14 13:24:26 11616] [HKEY_CLASSES_ROOT\CLSID\{D6BAE600-1E87-4E36-9327-03A07808E7ED}] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\AsusWSShellExt_B] @="{6D4133E5-0742-4ADC-8A8C-9303440F7190}" [HKEY_CLASSES_ROOT\CLSID\{6D4133E5-0742-4ADC-8A8C-9303440F7190}] 2011-05-25 07:09:22 227840 —-a-w- C:\Program Files (x86)\ASUS\ASUS WebStorage\3.0.108.222\AsusWSShellExt64.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\AsusWSShellExt_O] @="{64174815-8D98-4CE6-8646-4C039977D808}" [HKEY_CLASSES_ROOT\CLSID\{64174815-8D98-4CE6-8646-4C039977D808}] 2011-05-25 07:09:22 227840 —-a-w- C:\Program Files (x86)\ASUS\ASUS WebStorage\3.0.108.222\AsusWSShellExt64.dll [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "AmIcoSinglun64"="C:\Program Files (x86)\AmIcoSingLun\AmIcoSinglun64.exe" [2010-05-03 05:56:48 324096] "IntelPAN"="C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe" [2011-05-02 22:16:58 1935120] "BTMTrayAgent"="C:\Program Files (x86)\Intel\Bluetooth\btmshell.dll" [2011-03-30 22:41:56 10372368] "IntelTBRunOnce"="wscript.exe" [2009-07-14 01:39:57 168960] "RtHDVBg"="C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe" [2011-07-13 19:58:24 2264168] "MSC"="C:\Program Files\Microsoft Security Client\msseces.exe" [2012-09-13 01:16:10 1289704] "IgfxTray"="C:\Windows\system32\igfxtray.exe" [2012-03-20 03:44:20 170264] "HotKeysCmds"="C:\Windows\system32\hkcmd.exe" [2012-03-20 03:44:20 398616] "Persistence"="C:\Windows\system32\igfxpers.exe" [2012-03-20 03:44:20 439064] "lxdxmon.exe"="C:\Program Files (x86)\Lexmark 3600-4600 Series\lxdxmon.exe" [2010-02-04 05:27:55 672424] "lxdxamon"="C:\Program Files (x86)\Lexmark 3600-4600 Series\lxdxamon.exe" [2010-02-04 05:28:04 16040] ——- Supplementary Scan ——- uLocal Page = C:\Windows\system32\blank.htm uStart Page = hxxp://www.google.com mStart Page = hxxp://asus.msn.com mLocal Page = C:\Windows\SysWOW64\blank.htm uInternet Settings,ProxyOverride = *.local uSearchAssistant = hxxp://www.google.com IE: Add to Evernote 4.0 - C:\Program Files (x86)\Evernote\Evernote\EvernoteIE.dll/204 IE: Customize Menu - file://C:\Program Files (x86)\Siber Systems\AI RoboForm\RoboFormComCustomizeIEMenu.html IE: Fill Forms - file://C:\Program Files (x86)\Siber Systems\AI RoboForm\RoboFormComFillForms.html IE: Save Forms - file://C:\Program Files (x86)\Siber Systems\AI RoboForm\RoboFormComSavePass.html IE: Show RoboForm Toolbar - file://C:\Program Files (x86)\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html TCP: DhcpNameServer = 10.0.1.1 FF - ProfilePath - C:\Users\Nancy\AppData\Roaming\Mozilla\Firefox\Profiles\pqxe4c84.default\ FF - prefs.js: browser.startup.homepage - hxxp://us-mg4.mail.yahoo.com/neo/launch?.rand=26gi0q9rci4qq FF - ExtSQL: 2012-12-31 07:57; [removed]; C:\Program Files (x86)\Mozilla Firefox\extensions\[removed] FF - ExtSQL: !HIDDEN! 2012-12-31 07:57; [removed]; C:\Program Files (x86)\Mozilla Firefox\extensions\[removed] - - - - ORPHANS REMOVED - - - - Toolbar-Locked - (no file) Wow6432Node-HKLM-Run-StopDefragment - Install\StopDefragment.exe Toolbar-Locked - (no file) HKLM-Run-ETDCtrl - C:\Program Files (x86)\Elantech\ETDCtrl.exe

ComboFix 13-01-03.05 - Nancy 01/03/2013 20:11:41.4.4 - x64 Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.8103.5994 [GMT -5:00] Running from: C:\Users\[removed]\Desktop\ComboFix.exe Command switches used :: C:\Users\Nancy\Desktop\cfscript.txt AV: Microsoft Security Essentials *Disabled/Updated* {B140BF4E-23BB-4198-90AB-A51A4C60A69C} SP: Microsoft Security Essentials *Disabled/Updated* {0A215EAA-0581-4E16-AA1B-9E6837E7EC21} SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) C:\Program Files (x86)\InfoAtoms\IE32\InfoAtomsClientIE.dll ((((((((((((((((((((((((( Files Created from 2012-12-04 to 2013-01-04 ))))))))))))))))))))))))))))))) 2013-01-04 01:14:41 . 2013-01-04 01:14:41 ——– d—–w- C:\Users\Default\AppData\Local\temp 2013-01-04 01:01:45 . 2012-11-08 17:24:30 9125352 —-a-w- C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{5199FD4C-D2D1-4450-BF6B-27690C176B86}\mpengine.dll 2013-01-02 11:48:15 . 2012-11-08 17:24:30 9125352 —-a-w- C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll 2013-01-01 14:00:09 . 2013-01-01 14:00:09 ——– d—–w- C:\Users\Nancy\AppData\Roaming\InstallShield Installation Information 2013-01-01 01:37:58 . 2013-01-01 01:37:58 ——– d—–w- C:\Studio Plus Vista Installer 2012-12-31 18:27:14 . 2012-12-31 18:27:14 ——– d—–w- C:\Users\Nancy\AppData\Roaming\MOVAVI 2012-12-31 16:41:46 . 2012-12-31 16:41:46 ——– d—–w- C:\Program Files (x86)\MSXML 4.0 2012-12-31 16:22:34 . 2012-12-31 16:22:34 ——– d—–w- C:\Users\Nancy\AppData\Local\Programs 2012-12-31 13:01:49 . 2012-01-03 07:03:12 810496 —-a-w- C:\Windows\system32\xvidcore.dll 2012-12-31 13:01:49 . 2012-01-03 07:03:12 80896 —-a-w- C:\Windows\system32\ff_vfw.dll 2012-12-31 13:01:49 . 2012-01-03 07:03:12 183808 —-a-w- C:\Windows\system32\xvidvfw.dll 2012-12-31 13:01:37 . 2012-01-03 07:03:10 389120 —-a-w- C:\Windows\SysWow64\actskn43.ocx 2012-12-31 13:01:37 . 2012-01-03 07:03:10 389120 —-a-w- C:\Windows\system32\actskn43.ocx 2012-12-31 12:57:22 . 2012-12-31 12:57:36 ——– d—–w- C:\Program Files (x86)\InfoAtoms 2012-12-30 14:00:24 . 2008-12-19 16:15:03 ——– d—–w- C:\Windows\SysWow64\InstantDVDRecorder 2012-12-30 14:00:24 . 2008-08-22 13:44:12 11878776 —-a-w- C:\Windows\SysWow64\drivers\Pinnacle_Video_Driver_64bit.exe 2012-12-30 14:00:24 . 2008-08-22 13:42:16 14326712 —-a-w- C:\Windows\SysWow64\drivers\Pinnacle_Video_Driver_32bit.exe 2012-12-30 13:49:40 . 2012-12-31 11:04:27 ——– d—–w- C:\temp 2012-12-30 13:24:34 . 2005-07-12 18:25:06 401408 —-a-w- C:\Windows\SysWow64\pvmjpg30.dll 2012-12-30 13:24:33 . 2003-04-21 20:11:38 82432 —-a-w- C:\Windows\SysWow64\msxml4r.dll 2012-12-30 13:24:33 . 2003-04-21 20:11:34 44544 —-a-w- C:\Windows\SysWow64\msxml4a.dll 2012-12-30 13:24:32 . 2006-11-15 15:29:28 1712128 —-a-w- C:\Windows\SysWow64\GDIPLUS.DLL 2012-12-30 13:21:56 . 2005-03-22 00:04:52 729088 —-a-w- C:\Program Files (x86)\Common Files\InstallShield\Professional\RunTime\09\01\Intel32\iKernel.dll 2012-12-30 13:21:56 . 2003-11-10 23:13:28 69715 —-a-w- C:\Program Files (x86)\Common Files\InstallShield\Professional\RunTime\09\01\Intel32\ctor.dll 2012-12-30 13:21:56 . 2003-11-10 23:12:42 266240 —-a-w- C:\Program Files (x86)\Common Files\InstallShield\Professional\RunTime\09\01\Intel32\iscript.dll 2012-12-30 13:21:56 . 2003-11-10 23:12:12 192512 —-a-w- C:\Program Files (x86)\Common Files\InstallShield\Professional\RunTime\09\01\Intel32\iuser.dll 2012-12-30 13:21:56 . 2003-11-10 23:11:58 5632 —-a-w- C:\Program Files (x86)\Common Files\InstallShield\Professional\RunTime\09\01\Intel32\DotNetInstaller.exe 2012-12-30 13:21:55 . 2012-12-30 13:21:55 311428 —-a-w- C:\Program Files (x86)\Common Files\InstallShield\Professional\RunTime\09\01\Intel32\setup.dll 2012-12-30 13:21:55 . 2012-12-30 13:21:55 188548 —-a-w- C:\Program Files (x86)\Common Files\InstallShield\Professional\RunTime\09\01\Intel32\iGdi.dll 2012-12-30 13:16:14 . 2012-12-30 13:40:42 ——– d—–w- C:\ProgramData\Pinnacle Studio 2012-12-29 19:24:32 . 2007-03-05 21:36:16 70656 —-a-w- C:\Windows\system32\PCLECoInst64.dll 2012-12-29 19:24:31 . 2007-06-21 22:51:46 215808 —-a-w- C:\Windows\system32\drivers\emDevice64.sys 2012-12-29 19:24:31 . 2007-06-21 22:51:32 6400 —-a-w- C:\Windows\system32\drivers\emFilter64.sys 2012-12-29 19:24:31 . 2007-06-21 22:51:30 6144 —-a-w- C:\Windows\system32\drivers\emScan64.sys 2012-12-29 19:24:31 . 2007-06-21 21:21:32 13824 —-a-w- C:\Windows\system32\emUSD64.dll 2012-12-29 19:24:31 . 2006-07-19 23:12:38 57344 —-a-w- C:\Windows\SysWow64\emVFW.dll 2012-12-29 19:24:31 . 2006-07-19 23:12:12 32768 —-a-w- C:\Windows\SysWow64\emProp.ax 2012-12-29 19:24:31 . 2004-09-15 00:25:54 17808 —-a-w- C:\Windows\SysWow64\emYUV.dll 2012-12-29 19:24:28 . 2007-08-31 19:15:34 79872 —-a-w- C:\Windows\system32\drivers\emAudio64.sys 2012-12-29 19:24:03 . 2012-12-29 19:24:03 ——– d—–w- C:\Program Files (x86)\Common Files\Pinnacle 2012-12-29 19:23:15 . 2012-12-29 19:23:15 ——– d—–w- C:\Users\Nancy\AppData\Local\Downloaded Installations 2012-12-29 16:59:07 . 2013-01-01 19:42:11 ——– d—–w- C:\Users\Nancy\AppData\Local\Pinnacle 2012-12-29 16:53:03 . 2007-03-06 22:53:42 41984 —-a-w- C:\Windows\SysWow64\cacheX.dll 2012-12-29 16:53:03 . 2006-04-11 21:03:14 233472 ——w- C:\Windows\SysWow64\DiskIO.dll 2012-12-29 16:53:03 . 2006-04-11 21:03:14 184320 ——w- C:\Windows\SysWow64\RALMain.dll 2012-12-29 16:53:03 . 2005-12-12 21:57:10 32768 ——w- C:\Windows\SysWow64\MLPagAx.dll 2012-12-29 16:53:03 . 2004-01-02 18:28:28 126976 ——w- C:\Windows\SysWow64\AVIPrAx.dll 2012-12-29 16:53:03 . 2001-12-12 04:21:32 73728 ——w- C:\Windows\SysWow64\MMAviAx.dll 2012-12-29 16:49:59 . 2006-10-09 11:07:22 487424 —-a-w- C:\Windows\SysWow64\MSVCP70.DLL 2012-12-29 16:49:58 . 2006-10-09 11:07:22 344064 —-a-w- C:\Windows\SysWow64\MSVCR70.DLL 2012-12-29 16:49:58 . 2003-03-19 11:05:48 89088 ——w- C:\Windows\SysWow64\atl71.dll 2012-12-29 16:49:58 . 2002-01-05 17:18:20 84992 ——w- C:\Windows\SysWow64\ATL70.DLL 2012-12-29 16:48:33 . 2012-12-30 13:40:27 ——– d—–w- C:\ProgramData\Pinnacle 2012-12-29 16:48:30 . 2013-01-01 02:06:43 ——– d—–w- C:\Program Files (x86)\Pinnacle 2012-12-29 16:47:45 . 2012-12-29 16:47:45 ——– d—–w- C:\Users\Nancy\AppData\Roaming\InstallShield 2012-12-27 15:53:21 . 2012-12-27 15:53:21 ——– d—–w- C:\Users\Nancy\AppData\Roaming\Red Kawa 2012-12-27 14:49:52 . 2012-12-27 14:49:52 ——– d—–w- C:\Users\Nancy\AppData\Local\Geckofx 2012-12-27 14:49:39 . 2012-12-27 14:49:39 ——– d—–w- C:\Program Files (x86)\Regensoft 2012-12-27 14:49:36 . 2012-12-27 14:49:37 ——– d—–w- C:\Program Files (x86)\AviSynth 2.5 2012-12-27 14:49:30 . 2012-12-27 14:49:30 ——– d—–w- C:\Program Files (x86)\Red Kawa 2012-12-24 10:40:35 . 2012-12-16 14:13:20 34304 —-a-w- C:\Windows\SysWow64\atmlib.dll 2012-12-24 10:40:34 . 2012-12-16 17:11:22 46080 —-a-w- C:\Windows\system32\atmlib.dll 2012-12-24 10:40:31 . 2012-12-16 14:45:03 367616 —-a-w- C:\Windows\system32\atmfd.dll 2012-12-24 10:40:28 . 2012-12-16 14:13:28 295424 —-a-w- C:\Windows\SysWow64\atmfd.dll 2012-12-18 12:31:33 . 2012-12-18 12:31:33 ——– d—–w- C:\Program Files\iPod 2012-12-18 12:31:30 . 2012-12-18 12:31:59 ——– d—–w- C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69 2012-12-18 12:31:30 . 2012-12-18 12:31:57 ——– d—–w- C:\Program Files\iTunes 2012-12-18 12:31:30 . 2012-12-18 12:31:56 ——– d—–w- C:\Program Files (x86)\iTunes 2012-12-12 13:20:00 . 2012-11-14 05:52:40 2382848 —-a-w- C:\Windows\system32\mshtml.tlb 2012-12-12 11:17:12 . 2012-11-09 05:45:09 2048 —-a-w- C:\Windows\system32\tzres.dll 2012-12-12 11:17:12 . 2012-11-09 04:42:49 2048 —-a-w- C:\Windows\SysWow64\tzres.dll 2012-12-12 11:17:06 . 2012-11-22 03:26:40 3149824 —-a-w- C:\Windows\system32\win32k.sys . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) 2013-01-04 00:38:11 . 2012-01-28 04:54:14 45056 —-a-w- C:\Windows\system32\acovcnt.exe 2012-12-14 21:49:28 . 2012-04-24 15:39:30 24176 —-a-w- C:\Windows\system32\drivers\mbam.sys 2012-12-12 14:48:26 . 2012-04-02 10:17:53 697272 —-a-w- C:\Windows\SysWow64\FlashPlayerApp.exe 2012-12-12 14:48:26 . 2012-01-30 13:18:26 73656 —-a-w- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl 2012-12-12 13:22:43 . 2012-01-28 18:53:11 67413224 —-a-w- C:\Windows\system32\MRT.exe 2012-11-28 09:49:27 . 2012-11-28 09:53:46 972264 ——w- C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{F94DA23E-81D2-4E7F-B9A2-9227BD0E27B3}\gapaengine.dll 2012-10-25 08:12:26 . 2012-10-25 08:12:26 94208 —-a-w- C:\Windows\SysWow64\QuickTimeVR.qtx 2012-10-25 08:12:26 . 2012-10-25 08:12:26 69632 —-a-w- C:\Windows\SysWow64\QuickTime.qts 2012-10-16 08:38:37 . 2012-11-28 09:53:30 135168 —-a-w- C:\Windows\apppatch\AppPatch64\AcXtrnal.dll 2012-10-16 08:38:34 . 2012-11-28 09:53:30 350208 —-a-w- C:\Windows\apppatch\AppPatch64\AcLayers.dll 2012-10-16 07:39:52 . 2012-11-28 09:53:30 561664 —-a-w- C:\Windows\apppatch\AcLayers.dll 2012-10-09 18:17:13 . 2012-11-16 10:16:26 55296 —-a-w- C:\Windows\system32\dhcpcsvc6.dll 2012-10-09 18:17:13 . 2012-11-16 10:16:26 226816 —-a-w- C:\Windows\system32\dhcpcore6.dll 2012-10-09 17:40:31 . 2012-11-16 10:16:26 44032 —-a-w- C:\Windows\SysWow64\dhcpcsvc6.dll 2012-10-09 17:40:31 . 2012-11-16 10:16:26 193536 —-a-w- C:\Windows\SysWow64\dhcpcore6.dll 2012-10-06 10:04:58 . 2012-02-10 10:11:56 972192 ——w- C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\NISBackup\gapaengine.dll ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar] "{D6BAE600-1E87-4E36-9327-03A07808E7ED}"= "C:\Users\Nancy\AppData\Local\TNT2\Profiles\10285\passport.dll" [2012-10-14 13:24:26 11104] [HKEY_CLASSES_ROOT\clsid\{d6bae600-1e87-4e36-9327-03a07808e7ed}] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "DW7"="C:\Program Files (x86)\The Weather Channel\The Weather Channel App\TWCApp.exe" [2012-07-19 11:27:49 13003448] "Weather"="C:\Program Files (x86)\AWS\WeatherBug\Weather.exe" [2011-10-05 17:31:46 1652736] "PhotoshopElements8SyncAgent"="C:\Program Files (x86)\Adobe\Elements Organizer 8.0\ElementsOrganizerSyncAgent.exe" [2009-09-06 10:07:42 1893728] "RoboForm"="C:\Program Files (x86)\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe" [2012-12-14 11:33:48 109336] "LaunchList"="C:\Program Files (x86)\Pinnacle\Studio 11\LaunchList2.exe" [2007-03-21 19:41:38 145496] [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] "Nuance PDF Reader-reminder"="C:\Program Files (x86)\Nuance\PDF Reader\Ereg\Ereg.exe" [2008-11-03 18:02:06 328992] "ASUSPRP"="C:\Program Files (x86)\ASUS\APRP\APRP.EXE" [2011-10-18 04:27:25 3331312] "ASUSWebStorage"="C:\Program Files (x86)\ASUS\ASUS WebStorage\3.0.108.222\AsusWSPanel.exe" [2011-07-29 09:43:58 737104] "SonicMasterTray"="C:\Program Files (x86)\ASUS\Sonic Focus\SonicFocusTray.exe" [2010-07-10 06:45:00 984400] "FLxHCIm"="C:\Program Files\Fresco Logic Inc\Fresco Logic USB3.0 Host Controller\host\FLxHCIm.exe" [2011-04-08 23:46:08 43008] "ATKOSD2"="C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe" [2010-08-17 22:55:42 5732992] "ATKMEDIA"="C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe" [2010-10-07 22:05:14 170624] "HControlUser"="C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControlUser.exe" [2009-06-19 18:29:42 105016] "StopDefragment"="Install\StopDefragment.exe" [BU] "APSDaemon"="C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2012-11-28 19:13:16 59280] "Wireless Console 3"="C:\Program Files (x86)\ASUS\Wireless Console 3\wcourier.exe" [2011-06-10 14:49:10 2255360] "SunJavaUpdateSched"="C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe" [2012-07-03 13:04:54 252848] "QuickTime Task"="C:\Program Files (x86)\QuickTime\QTTask.exe" [2012-10-25 08:12:14 421888] "iTunesHelper"="C:\Program Files (x86)\iTunes\iTunesHelper.exe" [2012-12-12 18:57:10 152544] "PCLEUSBTip"="C:\Program Files (x86)\Pinnacle\Shared Files\Programs\USBTip\USBTip.exe" [2006-10-16 18:50:16 202312] "USBToolTip"="C:\Program Files (x86)\Pinnacle\Shared Files\\Programs\USBTip\USBTip.exe" [2006-10-16 18:50:16 202312] C:\Users\Nancy\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ EvernoteClipper.lnk - C:\Program Files (x86)\Evernote\Evernote\EvernoteClipper.exe [2012-12-3 1044320] OpenOffice.org 3.1.lnk - C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe [2009-4-16 384000] C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\ AsusVibeLauncher.lnk - C:\Program Files (x86)\ASUS\AsusVibe\AsusVibeLauncher.exe [2011-10-17 549040] Event Reminder.lnk - C:\Program Files (x86)\The Print Shop 23.1\Remind.exe [2010-6-21 344064] FancyStart daemon.lnk - C:\Windows\Installer\{C944B4C5-1C4D-4D95-8AC0-7CEF13914131}\_77B5857C27147149171BE7.exe [2012-4-2 12862] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "ConsentPromptBehaviorAdmin"= 5 (0x5) "ConsentPromptBehaviorUser"= 3 (0x3) "EnableUIADesktopToggle"= 0 (0x0) [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32] "mixer4"=wdmaud.drv [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc] @="Service" R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 21:27:14 138576] R2 lxdxCATSCustConnectService;lxdxCATSCustConnectService;C:\Windows\system32\spool\DRIVERS\x64\3\\lxdxserv.exe [2009-10-16 17:00:52 29184] R3 AMPPALP;Intel® Centrino® Bluetooth 3.0 + High Speed Protocol;C:\Windows\system32\DRIVERS\amppal.sys [2011-03-22 09:04:08 261632] R3 AmUStor;AM USB Stroage Driver;C:\Windows\system32\drivers\AmUStor.SYS [2010-05-03 03:46:04 44032] R3 intaud_WaveExtensible;Intel WiDi Audio Device;C:\Windows\system32\drivers\intelaud.sys [2011-03-24 14:47:02 34200] R3 MyWiFiDHCPDNS;Wireless PAN DHCP Server;C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe [2011-05-02 22:13:54 340240] R3 NisDrv;Microsoft Network Inspection System;C:\Windows\system32\DRIVERS\NisDrvWFP.sys [2012-08-31 02:03:48 128456] R3 NisSrv;Microsoft Network Inspection;C:\Program Files\Microsoft Security Client\NisSrv.exe [2012-09-13 01:21:48 368896] R3 SiSGbeLH;SiS191/SiS190 Ethernet Device NDIS 6.0 Driver;C:\Windows\system32\DRIVERS\SiSG664.sys [2009-06-10 20:35:57 56832] R3 TsUsbFlt;TsUsbFlt;C:\Windows\system32\drivers\tsusbflt.sys [2010-11-20 11:07:06 59392] R3 TsUsbGD;Remote Desktop Generic USB Device;C:\Windows\system32\drivers\TsUsbGD.sys [2010-11-20 11:07:06 31232] R3 USBAAPL64;Apple Mobile USB Driver;C:\Windows\system32\Drivers\usbaapl64.sys [2012-09-28 15:32:56 53760] R3 WatAdminSvc;Windows Activation Technologies Service;C:\Windows\system32\Wat\WatAdminSvc.exe [2012-01-28 18:47:25 1255736] R4 wlcrasvc;Windows Live Mesh remote connections service;C:\Program Files\Windows Live\Mesh\wlcrasvc.exe [2010-09-23 01:10:10 57184] S0 assd;assd; [x] S0 PxHlpa64;PxHlpa64;C:\Windows\System32\Drivers\PxHlpa64.sys [2008-06-16 07:00:00 55024] S1 ATKWMIACPIIO;ATKWMIACPI Driver;C:\Program Files (x86)\ASUS\ATK Package\ATK WMIACPI\atkwmiacpi64.sys [2010-07-26 21:57:20 17024] S2 AdobeActiveFileMonitor8.0;Adobe Active File Monitor V8;C:\Program Files (x86)\Adobe\Elements Organizer 8.0\PhotoshopElementsFileAgent.exe [2009-09-06 10:06:20 169312] S2 AFBAgent;AFBAgent;C:\Windows\system32\FBAgent.exe [2011-03-04 00:57:58 379520] S2 AMPPALR3;Intel® Centrino® Bluetooth 3.0 + High Speed Service;C:\Program Files\Intel\BluetoothHS\BTHSAmpPalService.exe [2011-03-22 09:10:26 1136128] S2 ASMMAP64;ASMMAP64;C:\Program Files (x86)\ASUS\ATK Package\ATKGFNEX\ASMMAP64.sys [2009-07-03 01:36:14 15416] S2 Bluetooth Device Monitor;Bluetooth Device Monitor;C:\Program Files (x86)\Intel\Bluetooth\devmonsrv.exe [2011-03-30 22:42:30 923984] S2 Bluetooth OBEX Service;Bluetooth OBEX Service;C:\Program Files (x86)\Intel\Bluetooth\obexsrv.exe [2011-03-30 22:42:34 1001808] S2 BTHSSecurityMgr;Intel® Centrino® Wireless Bluetooth® 3.0 + High Speed Security Service;C:\Program Files\Intel\BluetoothHS\BTHSSecurityMgr.exe [2011-02-24 04:20:56 134928] S2 GsServer;GoodSync Server;C:\Program Files\Siber Systems\GoodSync\Gs-Server.exe [2012-01-26 19:39:52 4674488] S2 lxdx_device;lxdx_device;C:\Windows\system32\lxdxcoms.exe [2009-10-16 17:10:44 1039872] S2 MBAMScheduler;MBAMScheduler;C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [2012-12-14 21:49:28 398184] S2 MBAMService;MBAMService;C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2012-12-14 21:49:28 682344] S2 SBSDWSCService;SBSD Security Center Service;C:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe [2009-01-26 20:31:10 1153368] S2 TurboB;Turbo Boost UI Monitor driver;C:\Windows\system32\DRIVERS\TurboB.sys [2010-04-17 00:07:28 13832] S2 TurboBoost;Intel® Turbo Boost Technology Monitor;C:\Program Files\Intel\TurboBoost\TurboBoost.exe [2010-04-17 00:07:42 134928] S3 AMPPAL;Intel® Centrino® Bluetooth 3.0 + High Speed Virtual Adapter;C:\Windows\system32\DRIVERS\AMPPAL.sys [2011-03-22 09:04:08 261632] S3 Bluetooth Media Service;Bluetooth Media Service;C:\Program Files (x86)\Intel\Bluetooth\mediasrv.exe [2011-03-30 22:42:32 1321296] S3 btmaux;Intel Bluetooth Auxiliary Service;C:\Windows\system32\DRIVERS\btmaux.sys [2011-03-08 22:44:08 51712] S3 btmhsf;btmhsf;C:\Windows\system32\DRIVERS\btmhsf.sys [2011-11-15 06:13:00 327168] S3 ETD;ELAN PS/2 Port Input Device;C:\Windows\system32\DRIVERS\ETD.sys [2010-12-13 13:12:40 138024] S3 FLxHCIc;Fresco Logic xHCI (USB3) Device Driver;C:\Windows\system32\DRIVERS\FLxHCIc.sys [2011-04-08 23:46:08 177152] S3 FLxHCIh;Fresco Logic xHCI (USB3) Hub Device Driver;C:\Windows\system32\DRIVERS\FLxHCIh.sys [2011-04-08 23:46:08 56320] S3 iBtFltCoex;iBtFltCoex;C:\Windows\system32\DRIVERS\iBtFltCoex.sys [2011-12-10 00:45:00 60416] S3 IntcDAud;Intel® Display Audio;C:\Windows\system32\DRIVERS\IntcDAud.sys [2010-10-14 16:28:16 317440] S3 iwdbus;IWD Bus Enumerator;C:\Windows\system32\DRIVERS\iwdbus.sys [2011-03-24 14:47:02 25496] S3 L1C;NDIS Miniport Driver for Atheros AR813x/AR815x PCI-E Ethernet Controller;C:\Windows\system32\DRIVERS\L1C62x64.sys [2010-08-24 09:55:44 76912] S3 MBAMProtector;MBAMProtector;C:\Windows\system32\drivers\mbam.sys [2012-12-14 21:49:28 24176] S3 wdkmd;Intel WiDi KMD;C:\Windows\system32\DRIVERS\WDKMD.sys [2011-03-24 14:47:04 42392] — Other Services/Drivers In Memory — *NewlyCreated* - WS2IFSL Contents of the 'Scheduled Tasks' folder 2013-01-04 C:\Windows\Tasks\Adobe Flash Player Updater.job - C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-02 10:17:53 . 2012-12-12 14:48:26] ——— X64 Entries ———– [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar] "{D6BAE600-1E87-4E36-9327-03A07808E7ED}"= "C:\Users\Nancy\AppData\Local\TNT2\Profiles\10285\passport64.dll" [2012-10-14 13:24:26 11616] [HKEY_CLASSES_ROOT\CLSID\{D6BAE600-1E87-4E36-9327-03A07808E7ED}] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\AsusWSShellExt_B] @="{6D4133E5-0742-4ADC-8A8C-9303440F7190}" [HKEY_CLASSES_ROOT\CLSID\{6D4133E5-0742-4ADC-8A8C-9303440F7190}] 2011-05-25 07:09:22 227840 —-a-w- C:\Program Files (x86)\ASUS\ASUS WebStorage\3.0.108.222\AsusWSShellExt64.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\AsusWSShellExt_O] @="{64174815-8D98-4CE6-8646-4C039977D808}" [HKEY_CLASSES_ROOT\CLSID\{64174815-8D98-4CE6-8646-4C039977D808}] 2011-05-25 07:09:22 227840 —-a-w- C:\Program Files (x86)\ASUS\ASUS WebStorage\3.0.108.222\AsusWSShellExt64.dll [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "AmIcoSinglun64"="C:\Program Files (x86)\AmIcoSingLun\AmIcoSinglun64.exe" [2010-05-03 05:56:48 324096] "ETDCtrl"="C:\Program Files (x86)\Elantech\ETDCtrl.exe" [BU] "IntelPAN"="C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe" [2011-05-02 22:16:58 1935120] "BTMTrayAgent"="C:\Program Files (x86)\Intel\Bluetooth\btmshell.dll" [2011-03-30 22:41:56 10372368] "IntelTBRunOnce"="wscript.exe" [2009-07-14 01:39:57 168960] "RtHDVBg"="C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe" [2011-07-13 19:58:24 2264168] "MSC"="C:\Program Files\Microsoft Security Client\msseces.exe" [2012-09-13 01:16:10 1289704] "IgfxTray"="C:\Windows\system32\igfxtray.exe" [2012-03-20 03:44:20 170264] "HotKeysCmds"="C:\Windows\system32\hkcmd.exe" [2012-03-20 03:44:20 398616] "Persistence"="C:\Windows\system32\igfxpers.exe" [2012-03-20 03:44:20 439064] "lxdxmon.exe"="C:\Program Files (x86)\Lexmark 3600-4600 Series\lxdxmon.exe" [2010-02-04 05:27:55 672424] "lxdxamon"="C:\Program Files (x86)\Lexmark 3600-4600 Series\lxdxamon.exe" [2010-02-04 05:28:04 16040] ——- Supplementary Scan ——- uLocal Page = C:\Windows\system32\blank.htm mStart Page = hxxp://asus.msn.com mLocal Page = C:\Windows\SysWOW64\blank.htm uSearchAssistant = hxxp://www.google.com IE: Add to Evernote 4.0 - C:\Program Files (x86)\Evernote\Evernote\EvernoteIE.dll/204 IE: Customize Menu - file://C:\Program Files (x86)\Siber Systems\AI RoboForm\RoboFormComCustomizeIEMenu.html IE: Fill Forms - file://C:\Program Files (x86)\Siber Systems\AI RoboForm\RoboFormComFillForms.html IE: Save Forms - file://C:\Program Files (x86)\Siber Systems\AI RoboForm\RoboFormComSavePass.html IE: Show RoboForm Toolbar - file://C:\Program Files (x86)\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html TCP: DhcpNameServer = 10.0.1.1 FF - ProfilePath - C:\Users\Nancy\AppData\Roaming\Mozilla\Firefox\Profiles\pqxe4c84.default\ FF - prefs.js: browser.startup.homepage - hxxp://us-mg4.mail.yahoo.com/neo/launch?.rand=26gi0q9rci4qq FF - ExtSQL: 2012-12-31 07:57; [removed]; C:\Program Files (x86)\Mozilla Firefox\extensions\[removed] FF - ExtSQL: !HIDDEN! 2012-12-31 07:57; [removed]; C:\Program Files (x86)\Mozilla Firefox\extensions\[removed] - - - - ORPHANS REMOVED - - - - BHO-{103089DA-0F31-4A8B-843F-7D24A7FE8345} - C:\Program Files (x86)\InfoAtoms\IE32\InfoAtomsClientIE.dll Toolbar-Locked - (no file) Toolbar-Locked - (no file) It's still asking me to run tnt2user.exe when I open ie.

[external image: Posted Image] Please download Junkware Removal Tool to your desktop.

• Shut down your protection software now to avoid potential conflicts.
• Run the tool by double-clicking it. If you are using Windows Vista, 7, or 8; instead of double-clicking, right-mouse click JRT.exe and select "Run as Administrator".
• The tool will open and start scanning your system.
• Please be patient as this can take a while to complete depending on your system's specifications.
• On completion, a log (JRT.txt) is saved to your desktop and will automatically open.
• Post the contents of JRT.txt into your next message.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 4.3.7 (01.03.2013:1)
OS: Windows 7 Home Premium x64
Ran by [removed] on Thu 01/03/2013 at 20:23:15.10
Blog: http://thisisudax.blogspot.com
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




~~~ Services



~~~ Registry Values

Successfully repaired: [Registry Value] hkey_current_user\software\microsoft\internet explorer\searchurl\\Default
Successfully repaired: [Registry Value] hkey_users\S-1-5-21-1846905553-2082907679-4278756267-1001\software\microsoft\internet explorer\searchurl\\Default



~~~ Registry Keys

Successfully deleted: [Registry Key] hkey_classes_root\clsid\{103089da-0f31-4a8b-843f-7d24a7fe8345}
Successfully deleted: [Registry Key] hkey_local_machine\software\microsoft\windows\currentversion\explorer\browser helper objects\{103089da-0f31-4a8b-843f-7d24a7fe8345}



~~~ Files

Successfully deleted: [File] "C:\Program Files (x86)\mozilla firefox\plugins\npcouponprinter.dll"
Successfully deleted: [File] "C:\Program Files (x86)\mozilla firefox\plugins\npmozcouponprinter.dll"
Successfully deleted: [File] "C:\Windows\couponprinter.ocx"



~~~ Folders

Successfully deleted: [Folder] "C:\Users\Nancy\AppData\Roaming\red kawa"
Successfully deleted: [Folder] "C:\Program Files (x86)\coupons"
Successfully deleted: [Folder] "C:\Program Files (x86)\infoatoms"
Successfully deleted: [Folder] "C:\Program Files (x86)\red kawa"



~~~ FireFox

Successfully deleted: [Folder] "C:\Program Files (x86)\Mozilla Firefox\extensions\[removed]"
Successfully deleted: [Registry Value] hkey_local_machine\software\mozilla\firefox\extensions\\[removed]
Successfully deleted the following from C:\Users\Nancy\AppData\Roaming\mozilla\firefox\profiles\pqxe4c84.default\prefs.js

user_pref("extensions.toolbar.mindspark._14Members_.hp.enabled", false);
user_pref("extensions.toolbar.mindspark._14Members_.initialized", true);
user_pref("extensions.toolbar.mindspark._14Members_.installation.contextKey", "");
user_pref("extensions.toolbar.mindspark._14Members_.installation.installDate", "2012121513");
user_pref("extensions.toolbar.mindspark._14Members_.installation.partnerId", "^YK^xdm149^YY^us");
user_pref("extensions.toolbar.mindspark._14Members_.installation.partnerSubId", "455002");
user_pref("extensions.toolbar.mindspark._14Members_.installation.success", true);
user_pref("extensions.toolbar.mindspark._14Members_.installation.toolbarId", "7CDECB22-5BC9-4D82-B776-089F52FF5B93");
user_pref("extensions.toolbar.mindspark._14Members_.lastActivePing", "1355596958489");
user_pref("extensions.toolbar.mindspark._14Members_.options.defaultSearch", true);
user_pref("extensions.toolbar.mindspark._14Members_.options.homePageEnabled", true);
user_pref("extensions.toolbar.mindspark._14Members_.options.keywordEnabled", true);
user_pref("extensions.toolbar.mindspark._14Members_.options.tabEnabled", true);
user_pref("extensions.toolbar.mindspark._14Members_.weather.location", "07621");
user_pref("extensions.toolbar.mindspark.hp.enabled", false);
user_pref("extensions.toolbar.mindspark.hp.enabled.guid", "");
user_pref("extensions.toolbar.mindspark.lastInstalled", "[removed]");
user_pref("extentions.y2layers.defaultEnableAppsList", "pagerage,buzzdock,bestvideodownloader,ezlooker,dropdowndeals,twittube,topre
latedtopics,interstitialads");
user_pref("extentions.y2layers.installId", "6201096d-6e55-4316-8044-ed3bdeb790b5");
Emptied folder: C:\Users\Nancy\AppData\Roaming\mozilla\firefox\profiles\pqxe4c84.default\minidumps [150 files]



~~~ Event Viewer Logs were cleared





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on Thu 01/03/2013 at 20:29:05.72
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~