Spyware / Malware / Virus Removal

tnt2user.exe [Solved]

12 min read

Looking for the outcome? Ask AI

jeffce

Post #16January 4, 2013, 12:40 PM UTC

Please download SystemLook from one of the links below and save it to your Desktop.
Link 1
Link 2

Right-click and Run as Administrator SystemLook.exe to run it.
Copy the content within the following codebox into the main textfield:
```
:filefind
tnt2user.exe
```
Click the Look button to start the scan.
When finished, a notepad window will open with the results of the scan. Please post this log in your next reply.

Note: The log can also be found on your Desktop entitled SystemLook.txt

starwood

Post #17January 4, 2013, 1:13 PM UTC

SystemLook 30.07.11 by jpshortstuff Log created at 08:12 on 04/01/2013 by Nancy Administrator - Elevation successful ========== filefind ========== Searching for "tnt2user.exe" C:\Users\Nancy\AppData\Local\TNT2\2.0.0.1158\TNT2User.exe –a—- 586592 bytes [13:24 14/10/2012] [13:24 14/10/2012] B336C81BC14ABD140616310509E9DC5F C:\Users\Nancy\AppData\Local\TNT2\2.0.0.1159\TNT2User.exe –a—- 586592 bytes [17:59 15/10/2012] [17:59 15/10/2012] 4862271E3D172F38D6FF01B8CCEA5079 C:\Users\Nancy\AppData\Local\TNT2\2.0.0.1267\TNT2User.exe –a—- 593760 bytes [05:01 09/12/2012] [05:01 09/12/2012] F5F1EF767FC29B56599DE955CEAF87F3 C:\Users\Nancy\AppData\Local\TNT2\2.0.0.1378\TNT2User.exe –a—- 604080 bytes [01:26 01/01/2013] [01:26 01/01/2013] 24D14985FA04C737DDCD1D461746911C -= EOF =-

jeffce

Post #18January 4, 2013, 2:44 PM UTC

Run OTL.exe

Copy/paste the following text written inside of the code box into the Custom Scans/Fixes box located at the bottom of OTL
```
:Services

:Files
C:\Users\Nancy\AppData\Local\TNT2

:Commands
[purity]
[emptytemp]
[start explorer]
[Reboot]
```
Then click the Run Fix button at the top
Let the program run unhindered, reboot when it is done
Then run a new scan and post a new OTL log ( don't check the boxes beside LOP Check or Purity this time )

———-

Post the new OTL log and let me know if you are still having the problems.

starwood

Post #19January 4, 2013, 5:49 PM UTC

OTL logfile created on: 1/4/2013 12:39:36 PM - Run 2
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\Nancy\Downloads
64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

7.91 Gb Total Physical Memory | 5.52 Gb Available Physical Memory | 69.81% Memory free
15.82 Gb Paging File | 13.30 Gb Available in Paging File | 84.04% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 279.45 Gb Total Space | 64.42 Gb Free Space | 23.05% Space Free | Partition Type: NTFS
Drive D: | 394.18 Gb Total Space | 394.08 Gb Free Space | 99.97% Space Free | Partition Type: NTFS

Computer Name: NANCY-PC | User Name: Nancy | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Users\Nancy\Downloads\OTL.exe (OldTimer Tools)
PRC - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation)
PRC - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
PRC - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe (Malwarebytes Corporation)
PRC - C:\Program Files (x86)\Siber Systems\AI RoboForm\robotaskbaricon.exe (Siber Systems)
PRC - C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_5_502_135.exe (Adobe Systems, Inc.)
PRC - C:\Program Files (x86)\Evernote\Evernote\EvernoteClipper.exe (Evernote Corp., 333 W Evelyn Ave. Mountain View, CA 94041)
PRC - C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation)
PRC - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated)
PRC - C:\Windows\AsScrPro.exe (ASUS)
PRC - C:\Program Files (x86)\AWS\WeatherBug\Weather.exe (AWS Convergence Technologies, Inc.)
PRC - C:\Program Files (x86)\ASUS\Wireless Console 3\wcourier.exe (ASUS)
PRC - C:\Program Files (x86)\ASUS\Splendid\ACMON.exe (ASUS)
PRC - C:\Program Files (x86)\Intel\Bluetooth\obexsrv.exe (Intel Corporation)
PRC - C:\Program Files (x86)\Intel\Bluetooth\mediasrv.exe (Intel Corporation)
PRC - C:\Program Files (x86)\Intel\Bluetooth\devmonsrv.exe (Intel Corporation)
PRC - C:\Program Files (x86)\Intel\Bluetooth\btplayerctrl.exe (Intel Corporation)
PRC - C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControl.exe (ASUS)
PRC - C:\Program Files (x86)\ASUS\SmartLogon\sensorsrv.exe (ASUS)
PRC - C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe (ASUS)
PRC - C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe (CyberLink)
PRC - C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe (ASUS)
PRC - C:\Program Files (x86)\ASUS\Sonic Focus\SonicFocusTray.exe (Virage Logic Corporation / Sonic Focus)
PRC - C:\Program Files (x86)\Lexmark 3600-4600 Series\lxdxmsdmon.exe ()
PRC - C:\Program Files (x86)\Lexmark 3600-4600 Series\lxdxmon.exe ()
PRC - C:\Program Files (x86)\ASUS\ATK Package\ATKGFNEX\GFNEXSrv.exe (ASUS)
PRC - C:\Program Files (x86)\Adobe\Elements Organizer 8.0\ElementsOrganizerSyncAgent.exe (Adobe Systems Incorporated)
PRC - C:\Program Files (x86)\Adobe\Elements Organizer 8.0\PhotoshopElementsFileAgent.exe (Adobe Systems Incorporated)
PRC - C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControlUser.exe (ASUS)
PRC - C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\ATKOSD.exe (ASUS)
PRC - C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\AsLdrSrv.exe (ASUS)
PRC - C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin (OpenOffice.org)
PRC - C:\Program Files (x86)\OpenOffice.org 3\program\soffice.exe (OpenOffice.org)
PRC - C:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe (Safer Networking Ltd.)
PRC - C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\WDC.exe (ASUS)
PRC - C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\KBFiltr.exe (ASUS)
PRC - C:\Program Files (x86)\ASUS\ASUS Live Update\ALU.exe ()
PRC - C:\Program Files (x86)\Pinnacle\Shared Files\Programs\USBTip\USBTip.exe (Pinnacle Systems GmbH)

========== Modules (No Company Name) ==========

MOD - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_5_502_135.dll ()
MOD - C:\Program Files (x86)\Mozilla Firefox\mozjs.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\d040079bc7148afeca03c5abb6fc3c61\System.Windows.Forms.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\4e80768a2d88c7a333e43cbb7a6c0705\System.Drawing.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Xml\25e672ea505e50ab058258ac72a54f02\System.Xml.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Configuration\c64ca3678261c8ffcd9e7efd1af6ed54\System.Configuration.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System\9dd758ac0bf7358ac6e4720610fcc63c\System.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\187d7c66735c533de851c76384f86912\mscorlib.ni.dll ()
MOD - C:\Program Files (x86)\Evernote\Evernote\libxml2.dll ()
MOD - C:\Program Files (x86)\Evernote\Evernote\libtidy.dll ()
MOD - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll ()
MOD - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll ()
MOD - C:\Program Files (x86)\ASUS\Wireless Console 3\acAuth.dll ()
MOD - C:\Program Files (x86)\ASUS\Splendid\GLCDdll.dll ()
MOD - C:\Program Files (x86)\CyberLink\Power2Go\CLMediaLibrary.dll ()
MOD - C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvcPS.dll ()
MOD - C:\Program Files (x86)\Lexmark 3600-4600 Series\lxdxmsdmon.exe ()
MOD - C:\Program Files (x86)\Lexmark 3600-4600 Series\lxdxmon.exe ()
MOD - C:\Program Files (x86)\Lexmark 3600-4600 Series\lxdxcaps.dll ()
MOD - C:\Program Files (x86)\Lexmark 3600-4600 Series\lxdxscw.dll ()
MOD - C:\Program Files (x86)\Lexmark 3600-4600 Series\lxdxdrs.dll ()
MOD - C:\Program Files (x86)\Lexmark 3600-4600 Series\lxdxcnv4.dll ()
MOD - C:\Program Files (x86)\Lexmark 3600-4600 Series\app4r.monitor.core.dll ()
MOD - C:\Program Files (x86)\Lexmark 3600-4600 Series\app4r.monitor.common.dll ()
MOD - C:\Program Files (x86)\Lexmark 3600-4600 Series\app4r.devmons.mcmdevmon.dll ()
MOD - C:\Program Files (x86)\Lexmark 3600-4600 Series\lxdxdatr.dll ()
MOD - C:\Program Files (x86)\Lexmark 3600-4600 Series\lxdxcats.dll ()
MOD - C:\Program Files (x86)\Adobe\Elements Organizer 8.0\AdobeXMPFiles.dll ()
MOD - C:\Program Files (x86)\Adobe\Elements Organizer 8.0\AdobeXMP.dll ()
MOD - C:\Program Files (x86)\OpenOffice.org 3\program\libxml2.dll ()
MOD - C:\Program Files (x86)\ASUS\ASUS Live Update\ALU.exe ()
MOD - C:\Program Files (x86)\Lexmark 3600-4600 Series\app4r.devmons.mcmdevmon.autoplayutil.dll ()

========== Services (SafeList) ==========

SRV:64bit: - (NisSrv) – C:\Program Files\Microsoft Security Client\NisSrv.exe (Microsoft Corporation)
SRV:64bit: - (MsMpSvc) – C:\Program Files\Microsoft Security Client\MsMpEng.exe (Microsoft Corporation)
SRV:64bit: - (GsServer) – C:\Program Files\Siber Systems\GoodSync\Gs-Server.exe ()
SRV:64bit: - (EvtEng) – C:\Program Files\Intel\WiFi\bin\EvtEng.exe (Intel® Corporation)
SRV:64bit: - (MyWiFiDHCPDNS) – C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe ()
SRV:64bit: - (RegSrvc) – C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe (Intel® Corporation)
SRV:64bit: - (AMPPALR3) – C:\Program Files\Intel\BluetoothHS\BTHSAmpPalService.exe (Intel Corporation)
SRV:64bit: - (AFBAgent) – C:\Windows\SysNative\FBAgent.exe (ASUSTeK Computer Inc.)
SRV:64bit: - (BTHSSecurityMgr) – C:\Program Files\Intel\BluetoothHS\BTHSSecurityMgr.exe (Intel® Corporation)
SRV:64bit: - (wlcrasvc) – C:\Program Files\Windows Live\Mesh\wlcrasvc.exe (Microsoft Corporation)
SRV:64bit: - (TurboBoost) – C:\Program Files\Intel\TurboBoost\TurboBoost.exe (Intel® Corporation)
SRV:64bit: - (lxdx_device) – C:\Windows\SysNative\lxdxcoms.exe ( )
SRV:64bit: - (lxdxCATSCustConnectService) – C:\Windows\SysNative\spool\DRIVERS\x64\3\\lxdxserv.exe ()
SRV:64bit: - (WinDefend) – C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)
SRV - (MBAMService) – C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation)
SRV - (MBAMScheduler) – C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe (Malwarebytes Corporation)
SRV - (AdobeFlashPlayerUpdateSvc) – C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe (Adobe Systems Incorporated)
SRV - (MozillaMaintenance) – C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe (Mozilla Foundation)
SRV - (AdobeARMservice) – C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated)
SRV - (FLEXnet Licensing Service) – C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe (Acresso Software Inc.)
SRV - (cphs) – C:\Windows\SysWOW64\IntelCpHeciSvc.exe (Intel Corporation)
SRV - (Bluetooth OBEX Service) – C:\Program Files (x86)\Intel\Bluetooth\obexsrv.exe (Intel Corporation)
SRV - (Bluetooth Media Service) – C:\Program Files (x86)\Intel\Bluetooth\mediasrv.exe (Intel Corporation)
SRV - (Bluetooth Device Monitor) – C:\Program Files (x86)\Intel\Bluetooth\devmonsrv.exe (Intel Corporation)
SRV - (clr_optimization_v4.0.30319_32) – C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (Microsoft Corporation)
SRV - (ATKGFNEXSrv) – C:\Program Files (x86)\ASUS\ATK Package\ATKGFNEX\GFNEXSrv.exe (ASUS)
SRV - (lxdx_device) – C:\Windows\SysWOW64\lxdxcoms.exe ( )
SRV - (lxdxCATSCustConnectService) – C:\Windows\system32\spool\DRIVERS\x64\3\\lxdxserv.exe ()
SRV - (AdobeActiveFileMonitor8.0) – C:\Program Files (x86)\Adobe\Elements Organizer 8.0\PhotoshopElementsFileAgent.exe (Adobe Systems Incorporated)
SRV - (ASLDRService) – C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\AsLdrSrv.exe (ASUS)
SRV - (clr_optimization_v2.0.50727_32) – C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (Microsoft Corporation)
SRV - (PCLEPCI) – C:\Windows\SysWOW64\drivers\Pclepci.sys (Pinnacle Systems GmbH)

========== Driver Services (SafeList) ==========

DRV:64bit: - (MBAMProtector) – C:\Windows\SysNative\drivers\mbam.sys (Malwarebytes Corporation)
DRV:64bit: - (USBAAPL64) – C:\Windows\SysNative\drivers\usbaapl64.sys (Apple, Inc.)
DRV:64bit: - (NisDrv) – C:\Windows\SysNative\drivers\NisDrvWFP.sys (Microsoft Corporation)
DRV:64bit: - (GEARAspiWDM) – C:\Windows\SysNative\drivers\GEARAspiWDM.sys (GEAR Software Inc.)
DRV:64bit: - (igfx) – C:\Windows\SysNative\drivers\igdkmd64.sys (Intel Corporation)
DRV:64bit: - (Fs_Rec) – C:\Windows\SysNative\drivers\fs_rec.sys (Microsoft Corporation)
DRV:64bit: - (iBtFltCoex) – C:\Windows\SysNative\drivers\iBtFltCoex.sys (Intel Corporation)
DRV:64bit: - (btmhsf) – C:\Windows\SysNative\drivers\btmhsf.sys (Intel Corporation)
DRV:64bit: - (amdsata) – C:\Windows\SysNative\drivers\amdsata.sys (Advanced Micro Devices)
DRV:64bit: - (amdxata) – C:\Windows\SysNative\drivers\amdxata.sys (Advanced Micro Devices)
DRV:64bit: - (fssfltr) – C:\Windows\SysNative\drivers\fssfltr.sys (Microsoft Corporation)
DRV:64bit: - (NETwNs64) – C:\Windows\SysNative\drivers\NETwNs64.sys (Intel Corporation)
DRV:64bit: - (FLxHCIc) – C:\Windows\SysNative\drivers\FLxHCIc.sys (Fresco Logic)
DRV:64bit: - (FLxHCIh) – C:\Windows\SysNative\drivers\FLxHCIh.sys (Fresco Logic)
DRV:64bit: - (wdkmd) – C:\Windows\SysNative\drivers\WDKMD.sys (Intel Corporation)
DRV:64bit: - (intaud_WaveExtensible) – C:\Windows\SysNative\drivers\intelaud.sys (Intel Corporation)
DRV:64bit: - (iwdbus) – C:\Windows\SysNative\drivers\iwdbus.sys (Intel Corporation)
DRV:64bit: - (AMPPALP) – C:\Windows\SysNative\drivers\AmpPal.sys (Windows ® Win 7 DDK provider)
DRV:64bit: - (AMPPAL) – C:\Windows\SysNative\drivers\AmpPal.sys (Windows ® Win 7 DDK provider)
DRV:64bit: - (btmaux) – C:\Windows\SysNative\drivers\btmaux.sys (Intel Corporation)
DRV:64bit: - (ETD) – C:\Windows\SysNative\drivers\ETD.sys (ELAN Microelectronics Corp.)
DRV:64bit: - (HpSAMD) – C:\Windows\SysNative\drivers\HpSAMD.sys (Hewlett-Packard Company)
DRV:64bit: - (TsUsbFlt) – C:\Windows\SysNative\drivers\TsUsbFlt.sys (Microsoft Corporation)
DRV:64bit: - (TsUsbGD) – C:\Windows\SysNative\drivers\TsUsbGD.sys (Microsoft Corporation)
DRV:64bit: - (iaStor) – C:\Windows\SysNative\drivers\iaStor.sys (Intel Corporation)
DRV:64bit: - (MEIx64) – C:\Windows\SysNative\drivers\HECIx64.sys (Intel Corporation)
DRV:64bit: - (IntcDAud) – C:\Windows\SysNative\drivers\IntcDAud.sys (Intel® Corporation)
DRV:64bit: - (L1C) – C:\Windows\SysNative\drivers\L1C62x64.sys (Atheros Communications, Inc.)
DRV:64bit: - (AmUStor) – C:\Windows\SysNative\drivers\AmUStor.sys (Alcor Micro, Corp.)
DRV:64bit: - (assd) – C:\Windows\SysNative\drivers\assd.sys (ASUS Corporation)
DRV:64bit: - (TurboB) – C:\Windows\SysNative\drivers\TurboB.sys ()
DRV:64bit: - (athr) – C:\Windows\SysNative\drivers\athrx.sys (Atheros Communications, Inc.)
DRV:64bit: - (kbfiltr) – C:\Windows\SysNative\drivers\kbfiltr.sys ( )
DRV:64bit: - (amdsbs) – C:\Windows\SysNative\drivers\amdsbs.sys (AMD Technologies Inc.)
DRV:64bit: - (LSI_SAS2) – C:\Windows\SysNative\drivers\lsi_sas2.sys (LSI Corporation)
DRV:64bit: - (stexstor) – C:\Windows\SysNative\drivers\stexstor.sys (Promise Technology)
DRV:64bit: - (WSDPrintDevice) – C:\Windows\SysNative\drivers\WSDPrint.sys (Microsoft Corporation)
DRV:64bit: - (TPM) – C:\Windows\SysNative\drivers\tpm.sys (Microsoft Corporation)
DRV:64bit: - (SiSGbeLH) – C:\Windows\SysNative\drivers\SiSG664.sys (Silicon Integrated Systems Corp.)
DRV:64bit: - (ebdrv) – C:\Windows\SysNative\drivers\evbda.sys (Broadcom Corporation)
DRV:64bit: - (b06bdrv) – C:\Windows\SysNative\drivers\bxvbda.sys (Broadcom Corporation)
DRV:64bit: - (b57nd60a) – C:\Windows\SysNative\drivers\b57nd60a.sys (Broadcom Corporation)
DRV:64bit: - (hcw85cir) – C:\Windows\SysNative\drivers\hcw85cir.sys (Hauppauge Computer Works, Inc.)
DRV:64bit: - (PxHlpa64) – C:\Windows\SysNative\drivers\PxHlpa64.sys (Sonic Solutions)
DRV:64bit: - (WimFltr) – C:\Windows\SysNative\drivers\WimFltr.sys (Microsoft Corporation)
DRV:64bit: - (emAudio) – C:\Windows\SysNative\drivers\emAudio64.sys (eMPIA Technology, Inc.)
DRV:64bit: - (DCamUSBEMPIA) – C:\Windows\SysNative\drivers\emDevice64.sys (eMPIA Technology, Inc.)
DRV:64bit: - (FiltUSBEMPIA) – C:\Windows\SysNative\drivers\emFilter64.sys (eMPIA Technology, Inc.)
DRV:64bit: - (ScanUSBEMPIA) – C:\Windows\SysNative\drivers\emScan64.sys (eMPIA Technology, Inc.)
DRV:64bit: - (MarvinBus) – C:\Windows\SysNative\drivers\MarvinBus64.sys (Pinnacle Systems GmbH)
DRV - (ATKWMIACPIIO) – C:\Program Files (x86)\ASUS\ATK Package\ATK WMIACPI\atkwmiacpi64.sys (ASUS)
DRV - (WIMMount) – C:\Windows\SysWOW64\drivers\wimmount.sys (Microsoft Corporation)
DRV - (ASMMAP64) – C:\Program Files (x86)\ASUS\ATK Package\ATKGFNEX\ASMMAP64.sys (ASUS)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE:64bit: - HKLM\..\SearchScopes,DefaultScope =
IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}…rc=IE-SearchBox
IE:64bit: - HKLM\..\SearchScopes\{9BE31423-EADD-4A53-9854-98AE3D47B026}: "URL" = http://www.ask.com/web?q={searchterms}&l;=dis&o;=ushpl
IE:64bit: - HKLM\..\SearchScopes\{ED0275C3-393C-4615-8D5D-9BEA168DACEB}: "URL" = http://search.yahoo.com/search?p={searchTe…&fr;=hp-pvnb
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://asus.msn.com
IE - HKLM\..\SearchScopes,DefaultScope =
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}…rc=IE-SearchBox

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://www.msn.com/?ocid=iehp
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = en-US
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0A B7 CA 3E 19 EA CD 01 [binary data]
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = http://www.google.com
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com
IE - HKCU\..\URLSearchHook: - No CLSID value found
IE - HKCU\..\SearchScopes,DefaultScope = {44816E91-C68A-2FF3-3D8F-8970062E5600}
IE - HKCU\..\SearchScopes\{44816E91-C68A-2FF3-3D8F-8970062E5600}: "URL" = http://www.bing.com/search?q={searchTerms}…amp;form=ZGAIDF
IE - HKCU\..\SearchScopes\{ED0275C3-393C-4615-8D5D-9BEA168DACEB}: "URL" = http://search.yahoo.com/search?p={searchTe…&fr;=hp-pvnb
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..browser.search.selectedEngine: "Swagbucks"
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "http://us-mg4.mail.yahoo.com/neo/launch?.rand=26gi0q9rci4qq"
FF - prefs.js..extensions.enabledAddons: coralietab%40mozdev.org:2.04.20110724
FF - prefs.js..extensions.enabledAddons: readable%40evernote.com:7.3346.272.999
FF - prefs.js..extensions.enabledAddons: %7B097d3191-e6fa-4728-9826-b533d755359d%7D:0.7.18
FF - prefs.js..extensions.enabledAddons: %7B3e0e7d2a-070f-4a47-b019-91fe5385ba79%7D:3.5.9
FF - prefs.js..extensions.enabledAddons: %7Bb9db16a4-6edc-47ec-a1f4-b86292ed211d%7D:4.9.12
FF - prefs.js..extensions.enabledAddons: %7BE0B8C461-F8FB-49b4-8373-FE32E9252800%7D:5.4
FF - prefs.js..extensions.enabledAddons: %7BDAD0F81A-CF67-4eed-98D6-26F6E47274CA%7D:1.5.5
FF - prefs.js..extensions.enabledAddons: %7B73a6fe31-595d-460b-a920-fcc0f8843232%7D:[removed]
FF - prefs.js..extensions.enabledAddons: %7B8bdea9d6-6f62-45eb-8ee9-8a81af0d2f94%7D:10.13.40.15
FF - prefs.js..extensions.enabledAddons: %7B972ce4c6-7e08-4474-a285-3208198ce6fd%7D:17.0.1
FF - user.js - File not found

FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_5_502_135.dll File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files\Microsoft Silverlight\5.1.10411.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_5_502_135.dll ()
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.7.2: C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.9.2: C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files (x86)\Microsoft Silverlight\5.1.10411.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3538.0513: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKLM\Software\MozillaPlugins\ZEON/PDF,version=2.0: C:\Program Files (x86)\Nuance\PDF Reader\bin\nppdf.dll (Zeon Corporation)
FF - HKCU\Software\MozillaPlugins\@tightropeinteractive.com/Plugin: C:\Users\Nancy\AppData\Local\TNT2\2.0.0.1378\npTNT2.dll File not found
FF - HKCU\Software\MozillaPlugins\@tnt2ghost.com/Plugin: C:\Users\Nancy\AppData\Local\TNT2\2.0.0.1378\npTNT2ghost.dll File not found
FF - HKCU\Software\MozillaPlugins\@tnt2toolbar.com/Plugin: C:\Users\Nancy\AppData\Local\TNT2\2.0.0.1267\npTNT2.dll File not found
FF - HKCU\Software\MozillaPlugins\amazon.com/AmazonMP3DownloaderPlugin: C:\Program Files (x86)\Amazon\MP3 Downloader\npAmazonMP3DownloaderPlugin1017300.dll (Amazon.com, Inc.)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\extensions\\{22119944-ED35-4ab1-910B-E619EA06A115}: C:\Program Files (x86)\Siber Systems\AI RoboForm\Firefox [2012/12/14 06:34:08 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 17.0.1\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012/12/01 08:34:52 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 17.0.1\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2013/01/04 08:00:55 | 000,000,000 | —D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 17.0.1\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012/12/01 08:34:52 | 000,000,000 | —D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 17.0.1\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2013/01/04 08:00:55 | 000,000,000 | —D | M]

[2012/01/28 13:40:33 | 000,000,000 | —D | M] (No name found) – C:\Users\Nancy\AppData\Roaming\Mozilla\Extensions
[2013/01/04 12:37:48 | 000,000,000 | —D | M] (No name found) – C:\Users\Nancy\AppData\Roaming\Mozilla\Firefox\Profiles\pqxe4c84.default\extensions
[2012/08/28 10:29:36 | 000,000,000 | —D | M] (AddThis) – C:\Users\Nancy\AppData\Roaming\Mozilla\Firefox\Profiles\pqxe4c84.default\extensions\{3e0e7d2a-070f-4a47-b019-91fe5385ba79}
[2013/01/04 12:37:48 | 000,000,000 | —D | M] (Swag Bucks) – C:\Users\Nancy\AppData\Roaming\Mozilla\Firefox\Profiles\pqxe4c84.default\extensions\{8bdea9d6-6f62-45eb-8ee9-8a81af0d2f94}
[2012/11/22 05:32:06 | 000,000,000 | —D | M] (DownloadHelper) – C:\Users\Nancy\AppData\Roaming\Mozilla\Firefox\Profiles\pqxe4c84.default\extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}
[2012/10/02 15:51:15 | 000,000,000 | —D | M] (Evernote Web Clipper) – C:\Users\Nancy\AppData\Roaming\Mozilla\Firefox\Profiles\pqxe4c84.default\extensions\{E0B8C461-F8FB-49b4-8373-FE32E9252800}
[2012/01/29 05:41:47 | 000,000,000 | —D | M] (IE Tab +) – C:\Users\Nancy\AppData\Roaming\Mozilla\Firefox\Profiles\pqxe4c84.default\extensions\[removed]
[2012/10/06 12:20:09 | 001,088,515 | —- | M] () (No name found) – C:\Users\Nancy\AppData\Roaming\Mozilla\Firefox\Profiles\pqxe4c84.default\extensions\[removed]
[2012/08/27 06:45:46 | 000,455,379 | —- | M] () (No name found) – C:\Users\Nancy\AppData\Roaming\Mozilla\Firefox\Profiles\pqxe4c84.default\extensions\{097d3191-e6fa-4728-9826-b533d755359d}.xpi
[2012/04/29 07:22:27 | 000,097,169 | —- | M] () (No name found) – C:\Users\Nancy\AppData\Roaming\Mozilla\Firefox\Profiles\pqxe4c84.default\extensions\{3d7eb24f-2740-49df-8937-200b1cc08f8a}.xpi
[2012/12/27 17:34:45 | 000,533,036 | —- | M] () (No name found) – C:\Users\Nancy\AppData\Roaming\Mozilla\Firefox\Profiles\pqxe4c84.default\extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi
[2012/11/30 17:03:28 | 000,014,082 | —- | M] () (No name found) – C:\Users\Nancy\AppData\Roaming\Mozilla\Firefox\Profiles\pqxe4c84.default\extensions\{DAD0F81A-CF67-4eed-98D6-26F6E47274CA}.xpi
[2012/10/27 07:06:24 | 001,070,903 | —- | M] () (No name found) – C:\Users\Nancy\AppData\Roaming\Mozilla\Firefox\Profiles\pqxe4c84.default\extensions\{ff356687-aa08-463d-a46c-11c451824939}.xpi
[2013/01/04 07:07:16 | 000,002,297 | —- | M] () – C:\Users\Nancy\AppData\Roaming\Mozilla\Firefox\Profiles\pqxe4c84.default\searchplugins\swagbucks.xml
[2013/01/03 20:28:56 | 000,000,000 | —D | M] (No name found) – C:\Program Files (x86)\Mozilla Firefox\extensions
[2012/12/01 08:34:52 | 000,262,112 | —- | M] (Mozilla Foundation) – C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll
[2012/02/24 06:15:52 | 000,466,944 | —- | M] (Catalina Marketing Corporation) – C:\Program Files (x86)\mozilla firefox\plugins\NPcol400.dll
[2012/08/30 03:59:07 | 000,002,465 | —- | M] () – C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml
[2012/10/12 13:22:58 | 000,002,058 | —- | M] () – C:\Program Files (x86)\mozilla firefox\searchplugins\twitter.xml

O1 HOSTS File: ([2013/01/03 20:14:42 | 000,000,027 | —- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2:64bit: - BHO: (RoboForm Toolbar Helper) - {724d43a9-0d85-11d4-9908-00400523e39a} - C:\Program Files (x86)\Siber Systems\AI RoboForm\roboform-x64.dll (Siber Systems Inc.)
O2 - BHO: (Spybot-S&D; IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files (x86)\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O2 - BHO: (RoboForm Toolbar Helper) - {724d43a9-0d85-11d4-9908-00400523e39a} - C:\Program Files (x86)\Siber Systems\AI RoboForm\roboform.dll (Siber Systems Inc.)
O2 - BHO: (Java™ Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
O2 - BHO: (Java™ Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O3:64bit: - HKLM\..\Toolbar: (&RoboForm; Toolbar) - {724d43a0-0d85-11d4-9908-00400523e39a} - C:\Program Files (x86)\Siber Systems\AI RoboForm\roboform-x64.dll (Siber Systems Inc.)
O3:64bit: - HKLM\..\Toolbar: (no name) - {D6BAE600-1E87-4E36-9327-03A07808E7ED} - No CLSID value found.
O3:64bit: - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3 - HKLM\..\Toolbar: (&RoboForm; Toolbar) - {724d43a0-0d85-11d4-9908-00400523e39a} - C:\Program Files (x86)\Siber Systems\AI RoboForm\roboform.dll (Siber Systems Inc.)
O3 - HKLM\..\Toolbar: (no name) - {D6BAE600-1E87-4E36-9327-03A07808E7ED} - No CLSID value found.
O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3:64bit: - HKCU\..\Toolbar\WebBrowser: (&RoboForm; Toolbar) - {724D43A0-0D85-11D4-9908-00400523E39A} - C:\Program Files (x86)\Siber Systems\AI RoboForm\roboform-x64.dll (Siber Systems Inc.)
O3 - HKCU\..\Toolbar\WebBrowser: (&RoboForm; Toolbar) - {724D43A0-0D85-11D4-9908-00400523E39A} - C:\Program Files (x86)\Siber Systems\AI RoboForm\roboform.dll (Siber Systems Inc.)
O3:HKU - HKCU\..\Toolbar\WebBrowser: (m OpenOffice.us Search.us.com Toolbar) - {D6BAE600-1E87-4E36-9327-03A07808E7ED} - C:\Users\Nancy\AppData\Local\TNT2\Profiles\10285\passport.dll File not found
O4:64bit: - HKLM..\Run: [AmIcoSinglun64] C:\Program Files (x86)\AmIcoSingLun\AmIcoSinglun64.exe (Alcor Micro Corp.)
O4:64bit: - HKLM..\Run: [BTMTrayAgent] C:\Program Files (x86)\Intel\Bluetooth\btmshell.dll (Intel Corporation)
O4:64bit: - HKLM..\Run: [ETDCtrl] C:\Program Files\Elantech\ETDCtrl.exe (ELAN Microelectronics Corp.)
O4:64bit: - HKLM..\Run: [HotKeysCmds] C:\Windows\SysNative\hkcmd.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [IgfxTray] C:\Windows\SysNative\igfxtray.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [IntelPAN] C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe (Intel® Corporation)
O4:64bit: - HKLM..\Run: [IntelTBRunOnce] wscript.exe //b //nologo "C:\Program Files\Intel\TurboBoost\RunTBGadgetOnce.vbs" File not found
O4:64bit: - HKLM..\Run: [lxdxamon] C:\Program Files (x86)\Lexmark 3600-4600 Series\lxdxamon.exe ()
O4:64bit: - HKLM..\Run: [lxdxmon.exe] C:\Program Files (x86)\Lexmark 3600-4600 Series\lxdxmon.exe ()
O4:64bit: - HKLM..\Run: [MSC] C:\Program Files\Microsoft Security Client\msseces.exe (Microsoft Corporation)
O4:64bit: - HKLM..\Run: [Persistence] C:\Windows\SysNative\igfxpers.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [RtHDVBg] C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe (Realtek Semiconductor)
O4 - HKLM..\Run: [APSDaemon] C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
O4 - HKLM..\Run: [ASUSPRP] C:\Program Files (x86)\ASUS\APRP\APRP.EXE (ASUSTek Computer Inc.)
O4 - HKLM..\Run: [ASUSWebStorage] C:\Program Files (x86)\ASUS\ASUS WebStorage\3.0.108.222\AsusWSPanel.exe (ecareme)
O4 - HKLM..\Run: [ATKMEDIA] C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe (ASUS)
O4 - HKLM..\Run: [ATKOSD2] C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe (ASUS)
O4 - HKLM..\Run: [FLxHCIm] C:\Program Files\Fresco Logic Inc\Fresco Logic USB3.0 Host Controller\host\FLxHCIm.exe (Windows ® Win 7 DDK provider)
O4 - HKLM..\Run: [HControlUser] C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControlUser.exe (ASUS)
O4 - HKLM..\Run: [Nuance PDF Reader-reminder] C:\Program Files (x86)\Nuance\PDF Reader\Ereg\Ereg.exe (Nuance Communications, Inc.)
O4 - HKLM..\Run: [PCLEUSBTip] C:\Program Files (x86)\Pinnacle\Shared Files\Programs\USBTip\USBTip.exe (Pinnacle Systems GmbH)
O4 - HKLM..\Run: [SonicMasterTray] C:\Program Files (x86)\ASUS\Sonic Focus\SonicFocusTray.exe (Virage Logic Corporation / Sonic Focus)
O4 - HKLM..\Run: [StopDefragment] Install\StopDefragment.exe File not found
O4 - HKLM..\Run: [USBToolTip] C:\Program Files (x86)\Pinnacle\Shared Files\Programs\USBTip\USBTip.exe (Pinnacle Systems GmbH)
O4 - HKLM..\Run: [Wireless Console 3] C:\Program Files (x86)\ASUS\Wireless Console 3\wcourier.exe (ASUS)
O4 - HKCU..\Run: [DW7] C:\Program Files (x86)\The Weather Channel\The Weather Channel App\TWCApp.exe (The Weather Channel)
O4 - HKCU..\Run: [LaunchList] C:\Program Files (x86)\Pinnacle\Studio 11\LaunchList2.exe (Pinnacle Systems)
O4 - HKCU..\Run: [PhotoshopElements8SyncAgent] C:\Program Files (x86)\Adobe\Elements Organizer 8.0\ElementsOrganizerSyncAgent.exe (Adobe Systems Incorporated)
O4 - HKCU..\Run: [RoboForm] C:\Program Files (x86)\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe (Siber Systems)
O4 - HKCU..\Run: [Weather] C:\Program Files (x86)\AWS\WeatherBug\Weather.exe (AWS Convergence Technologies, Inc.)
O4 - Startup: C:\Users\Nancy\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\EvernoteClipper.lnk = C:\Program Files (x86)\Evernote\Evernote\EvernoteClipper.exe (Evernote Corp., 333 W Evelyn Ave. Mountain View, CA 94041)
O4 - Startup: C:\Users\Nancy\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.1.lnk = C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe ()
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Activities present
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O8:64bit: - Extra context menu item: Add to Evernote 4.0 - C:\Program Files (x86)\Evernote\Evernote\EvernoteIE.dll (Evernote Corp., 333 W Evelyn Ave. Mountain View, CA 94041)
O8:64bit: - Extra context menu item: Customize Menu - C:\Program Files (x86)\Siber Systems\AI RoboForm\RoboFormComCustomizeIEMenu.html ()
O8:64bit: - Extra context menu item: Fill Forms - C:\Program Files (x86)\Siber Systems\AI RoboForm\RoboFormComFillForms.html ()
O8:64bit: - Extra context menu item: Save Forms - C:\Program Files (x86)\Siber Systems\AI RoboForm\RoboFormComSavePass.html ()
O8:64bit: - Extra context menu item: Show RoboForm Toolbar - C:\Program Files (x86)\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html ()
O8 - Extra context menu item: Add to Evernote 4.0 - C:\Program Files (x86)\Evernote\Evernote\EvernoteIE.dll (Evernote Corp., 333 W Evelyn Ave. Mountain View, CA 94041)
O8 - Extra context menu item: Customize Menu - C:\Program Files (x86)\Siber Systems\AI RoboForm\RoboFormComCustomizeIEMenu.html ()
O8 - Extra context menu item: Fill Forms - C:\Program Files (x86)\Siber Systems\AI RoboForm\RoboFormComFillForms.html ()
O8 - Extra context menu item: Save Forms - C:\Program Files (x86)\Siber Systems\AI RoboForm\RoboFormComSavePass.html ()
O8 - Extra context menu item: Show RoboForm Toolbar - C:\Program Files (x86)\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html ()
O9:64bit: - Extra Button: Fill Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - C:\Program Files (x86)\Siber Systems\AI RoboForm\roboform-x64.dll (Siber Systems Inc.)
O9:64bit: - Extra 'Tools' menuitem : Fill Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - C:\Program Files (x86)\Siber Systems\AI RoboForm\roboform-x64.dll (Siber Systems Inc.)
O9:64bit: - Extra Button: Save - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - C:\Program Files (x86)\Siber Systems\AI RoboForm\roboform-x64.dll (Siber Systems Inc.)
O9:64bit: - Extra 'Tools' menuitem : Save Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - C:\Program Files (x86)\Siber Systems\AI RoboForm\roboform-x64.dll (Siber Systems Inc.)
O9:64bit: - Extra Button: Show Toolbar - {724d43aa-0d85-11d4-9908-00400523e39a} - C:\Program Files (x86)\Siber Systems\AI RoboForm\roboform-x64.dll (Siber Systems Inc.)
O9:64bit: - Extra 'Tools' menuitem : Show RoboForm Toolbar - {724d43aa-0d85-11d4-9908-00400523e39a} - C:\Program Files (x86)\Siber Systems\AI RoboForm\roboform-x64.dll (Siber Systems Inc.)
O9 - Extra Button: Fill Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - C:\Program Files (x86)\Siber Systems\AI RoboForm\roboform.dll (Siber Systems Inc.)
O9 - Extra 'Tools' menuitem : Fill Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - C:\Program Files (x86)\Siber Systems\AI RoboForm\roboform.dll (Siber Systems Inc.)
O9 - Extra Button: Save - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - C:\Program Files (x86)\Siber Systems\AI RoboForm\roboform.dll (Siber Systems Inc.)
O9 - Extra 'Tools' menuitem : Save Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - C:\Program Files (x86)\Siber Systems\AI RoboForm\roboform.dll (Siber Systems Inc.)
O9 - Extra Button: Show Toolbar - {724d43aa-0d85-11d4-9908-00400523e39a} - C:\Program Files (x86)\Siber Systems\AI RoboForm\roboform.dll (Siber Systems Inc.)
O9 - Extra 'Tools' menuitem : Show RoboForm Toolbar - {724d43aa-0d85-11d4-9908-00400523e39a} - C:\Program Files (x86)\Siber Systems\AI RoboForm\roboform.dll (Siber Systems Inc.)
O9 - Extra Button: @C:\Program Files (x86)\Evernote\Evernote\Resource.dll,-101 - {A95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\Program Files (x86)\Evernote\Evernote\EvernoteIE.dll (Evernote Corp., 333 W Evelyn Ave. Mountain View, CA 94041)
O9 - Extra 'Tools' menuitem : @C:\Program Files (x86)\Evernote\Evernote\Resource.dll,-101 - {A95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\Program Files (x86)\Evernote\Evernote\EvernoteIE.dll (Evernote Corp., 333 W Evelyn Ave. Mountain View, CA 94041)
O9 - Extra 'Tools' menuitem : Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files (x86)\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000010 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000010 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)
O13 - gopher Prefix: missing
O15 - HKCU\..Trusted Domains: //@surf.mar@/ ([]money in Local intranet)
O15 - HKCU\..Trusted Ranges: Range1 ([http] in Local intranet)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 10.9.2)
O16 - DPF: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_23)
O16 - DPF: {CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_31)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 10.9.2)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 10.0.1.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{4B10D4B1-8C84-4010-A352-FE33362F94A0}: DhcpNameServer = [removed] [removed]
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{EC8CE5CB-D60E-49FD-8771-2F4F07E11AC3}: DhcpNameServer = 10.0.1.1
O18:64bit: - Protocol\Handler\livecall - No CLSID value found
O18:64bit: - Protocol\Handler\msnim - No CLSID value found
O18:64bit: - Protocol\Handler\wlmailhtml - No CLSID value found
O18:64bit: - Protocol\Handler\wlpg - No CLSID value found
O20:64bit: - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysWOW64\userinit.exe (Microsoft Corporation)
O20:64bit: - Winlogon\Notify\igfxcui: DllName - (igfxdev.dll) - C:\Windows\SysNative\igfxdev.dll (Intel Corporation)
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2013/01/01 08:08:48 | 000,000,108 | —- | M] () - C:\AUTOEXEC.BAT – [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35:64bit: - HKLM\..comfile [open] – "%1" %*
O35:64bit: - HKLM\..exefile [open] – "%1" %*
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37:64bit: - HKLM\…com [@ = ComFile] – "%1" %*
O37:64bit: - HKLM\…exe [@ = exefile] – "%1" %*
O37 - HKLM\…com [@ = ComFile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)

========== Files/Folders - Created Within 30 Days ==========

[2013/01/04 12:32:15 | 000,000,000 | —D | C] – C:\_OTL
[2013/01/03 20:25:37 | 000,000,000 | -HSD | C] – C:\$RECYCLE.BIN
[2013/01/03 20:23:12 | 000,000,000 | —D | C] – C:\Windows\ERUNT
[2013/01/03 20:23:06 | 000,000,000 | —D | C] – C:\JRT
[2013/01/03 20:14:41 | 000,000,000 | —D | C] – C:\Windows\temp
[2013/01/03 20:10:43 | 000,000,000 | —D | C] – C:\ComboFix
[2013/01/03 20:10:20 | 005,018,515 | R— | C] (Swearware) – C:\Users\Nancy\Desktop\ComboFix.exe
[2013/01/03 19:53:35 | 000,000,000 | —D | C] – C:\Users\Nancy\Desktop\ComboFix
[2013/01/03 16:15:15 | 000,518,144 | —- | C] (SteelWerX) – C:\Windows\SWREG.exe
[2013/01/03 16:15:15 | 000,406,528 | —- | C] (SteelWerX) – C:\Windows\SWSC.exe
[2013/01/03 16:15:15 | 000,060,416 | —- | C] (NirSoft) – C:\Windows\NIRCMD.exe
[2013/01/03 16:14:40 | 000,000,000 | —D | C] – C:\Qoobox
[2013/01/03 16:14:23 | 000,000,000 | —D | C] – C:\Windows\erdnt
[2013/01/01 09:00:22 | 000,000,000 | —D | C] – C:\Users\Nancy\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Pinnacle Instant DVD Recorder
[2013/01/01 09:00:09 | 000,000,000 | —D | C] – C:\Users\Nancy\AppData\Roaming\InstallShield Installation Information
[2013/01/01 08:10:23 | 000,000,000 | —D | C] – C:\Users\Nancy\Documents\Pinnacle Studio
[2012/12/31 21:07:27 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Pinnacle Hollywood FX 6.0 for Studio 11
[2012/12/31 21:02:40 | 000,000,000 | —D | C] – C:\Users\Public\Documents\Pinnacle Studio
[2012/12/31 21:02:40 | 000,000,000 | —D | C] – C:\Users\Public\Documents\Pinnacle
[2012/12/31 20:37:58 | 000,000,000 | —D | C] – C:\Studio Plus Vista Installer
[2012/12/31 13:50:20 | 000,000,000 | —D | C] – C:\Users\Nancy\Documents\Pinnacle
[2012/12/31 13:27:14 | 000,000,000 | —D | C] – C:\Users\Nancy\AppData\Roaming\MOVAVI
[2012/12/31 12:10:16 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Pinnacle Instant DVD Recorder
[2012/12/31 11:41:46 | 000,000,000 | —D | C] – C:\Program Files (x86)\MSXML 4.0
[2012/12/31 11:22:34 | 000,000,000 | —D | C] – C:\Users\Nancy\AppData\Local\Programs
[2012/12/31 10:05:42 | 000,000,000 | —D | C] – C:\Windows\Minidump
[2012/12/30 09:21:59 | 000,000,000 | —D | C] – C:\Users\Nancy\Documents\Instant DVD Recorder
[2012/12/30 09:00:24 | 014,326,712 | —- | C] (Pinnacle Systems ) – C:\Windows\SysWow64\drivers\Pinnacle_Video_Driver_32bit.exe
[2012/12/30 09:00:24 | 011,878,776 | —- | C] (Pinnacle Systems ) – C:\Windows\SysWow64\drivers\Pinnacle_Video_Driver_64bit.exe
[2012/12/30 09:00:24 | 000,000,000 | —D | C] – C:\Windows\SysWow64\InstantDVDRecorder
[2012/12/30 08:49:40 | 000,000,000 | —D | C] – C:\temp
[2012/12/30 08:24:34 | 000,401,408 | —- | C] (Pegasus Imaging Corporation) – C:\Windows\SysWow64\pvmjpg30.dll
[2012/12/30 08:24:33 | 000,082,432 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\msxml4r.dll
[2012/12/30 08:24:33 | 000,044,544 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\msxml4a.dll
[2012/12/30 08:24:32 | 001,712,128 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\GDIPLUS.DLL
[2012/12/30 08:20:30 | 000,000,000 | —D | C] – C:\Users\Nancy\My Documents
[2012/12/30 08:20:29 | 000,000,000 | —D | C] – C:\Users\Nancy\Documents\My Projects
[2012/12/30 08:19:16 | 000,000,000 | —D | C] – C:\Users\Public\Documents\My Projects
[2012/12/30 08:17:52 | 000,014,165 | —- | C] (Pinnacle Systems GmbH) – C:\Windows\SysWow64\drivers\Pclepci.sys
[2012/12/30 08:17:47 | 000,041,219 | —- | C] (Pinnacle Systems) – C:\Windows\RSETPATH.exe
[2012/12/30 08:17:08 | 001,047,552 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\MFC71u.DLL
[2012/12/30 08:17:08 | 000,974,848 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\MFC70.DLL
[2012/12/30 08:17:08 | 000,964,608 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\MFC70U.DLL
[2012/12/30 08:17:08 | 000,065,536 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\MFC71DEU.DLL
[2012/12/30 08:17:08 | 000,061,440 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\MFC71ITA.DLL
[2012/12/30 08:17:08 | 000,061,440 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\MFC71FRA.DLL
[2012/12/30 08:17:08 | 000,061,440 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\MFC71ESP.DLL
[2012/12/30 08:17:08 | 000,057,344 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\MFC71ENU.DLL
[2012/12/30 08:17:08 | 000,054,784 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\MSVCI70.DLL
[2012/12/30 08:17:08 | 000,049,152 | —- | C] (Pinnacle Systems) – C:\Windows\SysWow64\PCLEGetGuid.dll
[2012/12/30 08:17:08 | 000,049,152 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\MFC71KOR.DLL
[2012/12/30 08:17:08 | 000,049,152 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\MFC71JPN.DLL
[2012/12/30 08:17:08 | 000,045,056 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\MFC71CHT.DLL
[2012/12/30 08:17:08 | 000,040,960 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\MFC71CHS.DLL
[2012/12/30 08:16:27 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Studio 11
[2012/12/30 08:16:14 | 000,000,000 | —D | C] – C:\ProgramData\Pinnacle Studio
[2012/12/29 14:24:32 | 000,070,656 | —- | C] (Pinnacle Systems) – C:\Windows\SysNative\PCLECoInst64.dll
[2012/12/29 14:24:31 | 000,215,808 | —- | C] (eMPIA Technology, Inc.) – C:\Windows\SysNative\drivers\emDevice64.sys
[2012/12/29 14:24:31 | 000,057,344 | —- | C] (eMPIA Technology, Inc.) – C:\Windows\SysWow64\emVFW.dll
[2012/12/29 14:24:31 | 000,032,768 | —- | C] (eMPIA Technology, Inc.) – C:\Windows\SysWow64\emProp.ax
[2012/12/29 14:24:31 | 000,017,808 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\emYUV.dll
[2012/12/29 14:24:31 | 000,013,824 | —- | C] (eMPIA Technology, Inc.) – C:\Windows\SysNative\emUSD64.dll
[2012/12/29 14:24:31 | 000,006,400 | —- | C] (eMPIA Technology, Inc.) – C:\Windows\SysNative\drivers\emFilter64.sys
[2012/12/29 14:24:31 | 000,006,144 | —- | C] (eMPIA Technology, Inc.) – C:\Windows\SysNative\drivers\emScan64.sys
[2012/12/29 14:24:28 | 000,079,872 | —- | C] (eMPIA Technology, Inc.) – C:\Windows\SysNative\drivers\emAudio64.sys
[2012/12/29 14:24:03 | 000,000,000 | —D | C] – C:\Program Files (x86)\Common Files\Pinnacle
[2012/12/29 14:23:15 | 000,000,000 | —D | C] – C:\Users\Nancy\AppData\Local\Downloaded Installations
[2012/12/29 11:59:07 | 000,000,000 | —D | C] – C:\Users\Nancy\AppData\Local\Pinnacle
[2012/12/29 11:53:03 | 000,233,472 | —- | C] (Pinnacle Systems GmbH) – C:\Windows\SysWow64\DiskIO.dll
[2012/12/29 11:53:03 | 000,184,320 | —- | C] (Pinnacle Systems GmbH) – C:\Windows\SysWow64\RALMain.dll
[2012/12/29 11:53:03 | 000,126,976 | —- | C] (Pinnacle Systems GmbH) – C:\Windows\SysWow64\AVIPrAx.dll
[2012/12/29 11:53:03 | 000,073,728 | —- | C] (Pinnacle Systems GmbH) – C:\Windows\SysWow64\MMAviAx.dll
[2012/12/29 11:53:03 | 000,041,984 | —- | C] (Pinnacle Systems GmbH) – C:\Windows\SysWow64\cacheX.dll
[2012/12/29 11:53:03 | 000,032,768 | —- | C] (Pinnacle Systems GmbH) – C:\Windows\SysWow64\MLPagAx.dll
[2012/12/29 11:50:25 | 001,013,248 | —- | C] (LEAD Technologies, Inc.) – C:\Windows\SysWow64\Ltwvc13n.dll
[2012/12/29 11:50:25 | 000,930,992 | —- | C] (LEAD Technologies, Inc.) – C:\Windows\SysWow64\Ltr13n.dll
[2012/12/29 11:50:25 | 000,453,120 | —- | C] (LEAD Technologies, Inc.) – C:\Windows\SysWow64\ltkrn13n.dll
[2012/12/29 11:50:25 | 000,306,352 | —- | C] (LEAD Technologies, Inc.) – C:\Windows\SysWow64\Ltrio13n.dll
[2012/12/29 11:50:25 | 000,153,088 | —- | C] (LEAD Technologies, Inc.) – C:\Windows\SysWow64\ltfil13n.DLL
[2012/12/29 11:50:24 | 002,079,232 | —- | C] (LEAD Technologies, Inc.) – C:\Windows\SysWow64\LTCLR13s.dll
[2012/12/29 11:50:24 | 001,693,696 | —- | C] (LEAD Technologies, Inc.) – C:\Windows\SysWow64\LTCLR13n.dll
[2012/12/29 11:50:24 | 000,884,736 | —- | C] (Fellowes, Inc.) – C:\Windows\SysWow64\LMUIRes.dll
[2012/12/29 11:50:24 | 000,409,600 | —- | C] (LEAD Technologies, Inc.) – C:\Windows\SysWow64\LFCMP13s.DLL
[2012/12/29 11:50:24 | 000,393,216 | —- | C] (LEAD Technologies, Inc.) – C:\Windows\SysWow64\LFCMP13n.DLL
[2012/12/29 11:50:24 | 000,110,080 | —- | C] (LEAD Technologies, Inc.) – C:\Windows\SysWow64\lfpsd13s.dll
[2012/12/29 11:50:24 | 000,064,512 | —- | C] (LEAD Technologies, Inc.) – C:\Windows\SysWow64\lftga13s.dll
[2012/12/29 11:50:24 | 000,024,576 | —- | C] (LEAD Technologies, Inc.) – C:\Windows\SysWow64\lftga13n.dll
[2012/12/29 11:50:24 | 000,012,288 | —- | C] (Fellowes, Inc.) – C:\Windows\SysWow64\LMLRes.dll
[2012/12/29 11:50:22 | 000,070,144 | —- | C] (LEAD Technologies, Inc.) – C:\Windows\SysWow64\lfbmp13s.dll
[2012/12/29 11:50:22 | 000,030,208 | —- | C] (LEAD Technologies, Inc.) – C:\Windows\SysWow64\lfbmp13n.dll
[2012/12/29 11:50:05 | 001,060,864 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\MFC71.DLL
[2012/12/29 11:49:59 | 000,487,424 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\MSVCP70.DLL
[2012/12/29 11:49:58 | 000,344,064 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\MSVCR70.DLL
[2012/12/29 11:49:58 | 000,089,088 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\atl71.dll
[2012/12/29 11:49:58 | 000,084,992 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\ATL70.DLL
[2012/12/29 11:48:33 | 000,000,000 | —D | C] – C:\ProgramData\Pinnacle
[2012/12/29 11:48:30 | 000,000,000 | —D | C] – C:\Program Files (x86)\Pinnacle
[2012/12/29 11:47:45 | 000,000,000 | —D | C] – C:\Users\Nancy\AppData\Roaming\InstallShield
[2012/12/27 10:53:21 | 000,000,000 | —D | C] – C:\Users\Nancy\Documents\Red Kawa
[2012/12/27 09:49:52 | 000,000,000 | —D | C] – C:\Users\Nancy\AppData\Local\Geckofx
[2012/12/27 09:49:39 | 000,000,000 | —D | C] – C:\Users\Nancy\Documents\Regensoft
[2012/12/27 09:49:39 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Regensoft
[2012/12/27 09:49:39 | 000,000,000 | —D | C] – C:\Program Files (x86)\Regensoft
[2012/12/27 09:49:37 | 000,000,000 | —D | C] – C:\Users\Nancy\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\AviSynth 2.5
[2012/12/27 09:49:36 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AviSynth 2.5
[2012/12/27 09:49:36 | 000,000,000 | —D | C] – C:\Program Files (x86)\AviSynth 2.5
[2012/12/27 09:49:30 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Red Kawa
[2012/12/27 08:40:12 | 000,000,000 | —D | C] – C:\Users\Nancy\AppData\Local\{5BEE5DF1-E1B2-4221-8EA6-8FB65E6CD25A}
[2012/12/24 05:40:35 | 000,034,304 | —- | C] (Adobe Systems) – C:\Windows\SysWow64\atmlib.dll
[2012/12/24 05:40:34 | 000,046,080 | —- | C] (Adobe Systems) – C:\Windows\SysNative\atmlib.dll
[2012/12/24 05:40:31 | 000,367,616 | —- | C] (Adobe Systems Incorporated) – C:\Windows\SysNative\atmfd.dll
[2012/12/24 05:40:28 | 000,295,424 | —- | C] (Adobe Systems Incorporated) – C:\Windows\SysWow64\atmfd.dll
[2012/12/18 07:32:08 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes
[2012/12/18 07:31:33 | 000,000,000 | —D | C] – C:\Program Files\iPod
[2012/12/18 07:31:30 | 000,000,000 | —D | C] – C:\Program Files\iTunes
[2012/12/18 07:31:30 | 000,000,000 | —D | C] – C:\Program Files (x86)\iTunes
[2012/12/18 07:31:30 | 000,000,000 | —D | C] – C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69
[2012/12/12 08:19:59 | 000,096,768 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\mshtmled.dll
[2012/12/12 08:19:59 | 000,073,216 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\mshtmled.dll
[2012/12/12 08:19:58 | 000,176,640 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\ieui.dll
[2012/12/12 08:19:57 | 000,248,320 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\ieui.dll
[2012/12/12 08:19:57 | 000,237,056 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\url.dll
[2012/12/12 08:19:57 | 000,231,936 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\url.dll
[2012/12/12 08:19:57 | 000,173,056 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\ieUnatt.exe
[2012/12/12 08:19:57 | 000,142,848 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\ieUnatt.exe
[2012/12/12 08:19:55 | 002,312,704 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\jscript9.dll
[2012/12/12 08:19:55 | 001,494,528 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\inetcpl.cpl
[2012/12/12 08:19:55 | 001,427,968 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\inetcpl.cpl
[2012/12/12 08:19:55 | 000,729,088 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\msfeeds.dll
[2012/12/12 08:19:54 | 000,816,640 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\jscript.dll
[2012/12/12 08:19:54 | 000,717,824 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\jscript.dll
[2012/12/12 08:19:54 | 000,599,040 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\vbscript.dll
[2012/12/12 06:16:57 | 001,161,216 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\kernel32.dll
[2012/12/12 06:16:57 | 000,424,960 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\KernelBase.dll
[2012/12/12 06:16:57 | 000,338,432 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\conhost.exe
[2012/12/12 06:16:57 | 000,215,040 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\winsrv.dll
[2012/12/12 06:16:55 | 000,362,496 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\wow64win.dll
[2012/12/12 06:16:55 | 000,243,200 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\wow64.dll
[2012/12/12 06:16:55 | 000,025,600 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\setup16.exe
[2012/12/12 06:16:55 | 000,016,384 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\ntvdm64.dll
[2012/12/12 06:16:55 | 000,014,336 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\ntvdm64.dll
[2012/12/12 06:16:55 | 000,013,312 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\wow64cpu.dll
[2012/12/12 06:16:55 | 000,005,120 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\wow32.dll
[2012/12/12 06:16:54 | 000,007,680 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\instnm.exe
[2012/12/12 06:16:54 | 000,006,144 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-security-base-l1-1-0.dll
[2012/12/12 06:16:54 | 000,005,120 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-file-l1-1-0.dll
[2012/12/12 06:16:54 | 000,005,120 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-file-l1-1-0.dll
[2012/12/12 06:16:54 | 000,004,608 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-processthreads-l1-1-0.dll
[2012/12/12 06:16:54 | 000,004,096 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-sysinfo-l1-1-0.dll
[2012/12/12 06:16:54 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-heap-l1-1-0.dll
[2012/12/12 06:16:54 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-xstate-l1-1-0.dll
[2012/12/12 06:16:54 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-util-l1-1-0.dll
[2012/12/12 06:16:53 | 000,004,608 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-threadpool-l1-1-0.dll
[2012/12/12 06:16:53 | 000,004,608 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-processthreads-l1-1-0.dll
[2012/12/12 06:16:53 | 000,004,096 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-sysinfo-l1-1-0.dll
[2012/12/12 06:16:53 | 000,004,096 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-synch-l1-1-0.dll
[2012/12/12 06:16:53 | 000,004,096 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-misc-l1-1-0.dll
[2012/12/12 06:16:53 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-rtlsupport-l1-1-0.dll
[2012/12/12 06:16:53 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-processenvironment-l1-1-0.dll
[2012/12/12 06:16:53 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-processenvironment-l1-1-0.dll
[2012/12/12 06:16:53 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-namedpipe-l1-1-0.dll
[2012/12/12 06:16:53 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-namedpipe-l1-1-0.dll
[2012/12/12 06:16:53 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-misc-l1-1-0.dll
[2012/12/12 06:16:53 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-memory-l1-1-0.dll
[2012/12/12 06:16:53 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-memory-l1-1-0.dll
[2012/12/12 06:16:53 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-string-l1-1-0.dll
[2012/12/12 06:16:53 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-string-l1-1-0.dll
[2012/12/12 06:16:53 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-rtlsupport-l1-1-0.dll
[2012/12/12 06:16:53 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-profile-l1-1-0.dll
[2012/12/12 06:16:53 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-profile-l1-1-0.dll
[2012/12/12 06:16:52 | 000,006,144 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-security-base-l1-1-0.dll
[2012/12/12 06:16:52 | 000,004,608 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-threadpool-l1-1-0.dll
[2012/12/12 06:16:52 | 000,004,096 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-synch-l1-1-0.dll
[2012/12/12 06:16:52 | 000,004,096 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-localregistry-l1-1-0.dll
[2012/12/12 06:16:52 | 000,004,096 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-localregistry-l1-1-0.dll
[2012/12/12 06:16:52 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-xstate-l1-1-0.dll
[2012/12/12 06:16:52 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-libraryloader-l1-1-0.dll
[2012/12/12 06:16:52 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-libraryloader-l1-1-0.dll
[2012/12/12 06:16:52 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-interlocked-l1-1-0.dll
[2012/12/12 06:16:52 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-heap-l1-1-0.dll
[2012/12/12 06:16:52 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-util-l1-1-0.dll
[2012/12/12 06:16:52 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-io-l1-1-0.dll
[2012/12/12 06:16:52 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-io-l1-1-0.dll
[2012/12/12 06:16:52 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-interlocked-l1-1-0.dll
[2012/12/12 06:16:52 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-handle-l1-1-0.dll
[2012/12/12 06:16:52 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-handle-l1-1-0.dll
[2012/12/12 06:16:52 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-fibers-l1-1-0.dll
[2012/12/12 06:16:52 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-fibers-l1-1-0.dll
[2012/12/12 06:16:52 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-errorhandling-l1-1-0.dll
[2012/12/12 06:16:52 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-errorhandling-l1-1-0.dll
[2012/12/12 06:16:52 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-delayload-l1-1-0.dll
[2012/12/12 06:16:52 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-delayload-l1-1-0.dll
[2012/12/12 06:16:52 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-debug-l1-1-0.dll
[2012/12/12 06:16:52 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-debug-l1-1-0.dll
[2012/12/12 06:16:52 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-datetime-l1-1-0.dll
[2012/12/12 06:16:52 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-datetime-l1-1-0.dll
[2012/12/12 06:16:51 | 000,004,096 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-localization-l1-1-0.dll
[2012/12/12 06:16:51 | 000,004,096 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-localization-l1-1-0.dll
[2012/12/12 06:16:51 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-console-l1-1-0.dll
[2012/12/12 06:16:51 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-console-l1-1-0.dll
[2012/12/12 06:16:48 | 000,002,048 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\user.exe
[2012/12/12 06:16:34 | 000,478,208 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\dpnet.dll
[2012/12/12 06:16:34 | 000,376,832 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\dpnet.dll
[2012/12/08 07:39:52 | 000,000,000 | —D | C] – C:\Users\Nancy\AppData\Local\{62530663-E778-4D94-9DFA-237FE2EAC0BB}
[2011/03/24 06:24:10 | 000,093,184 | —- | C] (Microsoft Corporation) – C:\Users\Nancy\CARDFILE.EXE

========== Files - Modified Within 30 Days ==========

[2013/01/04 12:41:57 | 000,009,920 | -H– | M] () – C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2013/01/04 12:41:57 | 000,009,920 | -H– | M] () – C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2013/01/04 12:36:14 | 000,002,566 | —- | M] () – C:\Windows\SysNative\AutoRunFilter.ini
[2013/01/04 12:36:02 | 000,001,565 | —- | M] () – C:\Windows\SysNative\ServiceFilter.ini
[2013/01/04 12:34:41 | 000,067,584 | –S- | M] () – C:\Windows\bootstat.dat
[2013/01/04 12:33:54 | 2077,298,687 | -HS- | M] () – C:\hiberfil.sys
[2013/01/04 09:48:00 | 000,000,830 | —- | M] () – C:\Windows\tasks\Adobe Flash Player Updater.job
[2013/01/04 09:28:42 | 000,807,600 | —- | M] () – C:\Windows\SysNative\PerfStringBackup.INI
[2013/01/04 09:28:42 | 000,680,644 | —- | M] () – C:\Windows\SysNative\perfh009.dat
[2013/01/04 09:28:42 | 000,129,138 | —- | M] () – C:\Windows\SysNative\perfc009.dat
[2013/01/04 08:00:55 | 000,002,021 | —- | M] () – C:\Users\Public\Desktop\Adobe Reader XI.lnk
[2013/01/03 20:14:42 | 000,000,027 | —- | M] () – C:\Windows\SysNative\drivers\etc\hosts
[2013/01/03 19:38:11 | 000,045,056 | —- | M] () – C:\Windows\SysNative\acovcnt.exe
[2013/01/03 14:31:58 | 005,018,515 | R— | M] (Swearware) – C:\Users\Nancy\Desktop\ComboFix.exe
[2013/01/02 06:35:26 | 001,151,360 | —- | M] () – C:\Windows\SysNative\FNTCACHE.DAT
[2013/01/01 14:42:08 | 000,000,349 | —- | M] () – C:\Users\Public\Documents\PCLECHAL.INI
[2013/01/01 08:09:42 | 000,002,056 | —- | M] () – C:\Users\Public\Desktop\Studio.lnk
[2013/01/01 08:08:48 | 000,000,108 | —- | M] () – C:\AUTOEXEC.BAT
[2012/12/31 13:27:10 | 000,005,116 | —- | M] () – C:\ProgramData\xgneqrwu.hrx
[2012/12/31 11:22:58 | 000,001,115 | —- | M] () – C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2012/12/31 10:05:24 | 723,116,076 | —- | M] () – C:\Windows\MEMORY.DMP
[2012/12/28 12:07:02 | 408,402,406 | —- | M] () – C:\Users\Nancy\Documents\John Denver Japan.mp4
[2012/12/27 09:49:39 | 000,002,156 | —- | M] () – C:\Users\Public\Desktop\YouTube Downloader App.lnk
[2012/12/27 09:49:30 | 000,002,212 | —- | M] () – C:\Users\Public\Desktop\Videora iPod Converter.lnk
[2012/12/19 09:26:39 | 000,444,933 | R— | M] () – C:\Windows\SysNative\drivers\etc\hosts.20121231-112443.backup
[2012/12/18 07:32:09 | 000,001,785 | —- | M] () – C:\Users\Public\Desktop\iTunes.lnk
[2012/12/16 12:11:22 | 000,046,080 | —- | M] (Adobe Systems) – C:\Windows\SysNative\atmlib.dll
[2012/12/16 09:45:03 | 000,367,616 | —- | M] (Adobe Systems Incorporated) – C:\Windows\SysNative\atmfd.dll
[2012/12/16 09:13:28 | 000,295,424 | —- | M] (Adobe Systems Incorporated) – C:\Windows\SysWow64\atmfd.dll
[2012/12/16 09:13:20 | 000,034,304 | —- | M] (Adobe Systems) – C:\Windows\SysWow64\atmlib.dll
[2012/12/14 16:49:28 | 000,024,176 | —- | M] (Malwarebytes Corporation) – C:\Windows\SysNative\drivers\mbam.sys
[2012/12/12 09:48:26 | 000,697,272 | —- | M] (Adobe Systems Incorporated) – C:\Windows\SysWow64\FlashPlayerApp.exe
[2012/12/12 09:48:26 | 000,073,656 | —- | M] (Adobe Systems Incorporated) – C:\Windows\SysWow64\FlashPlayerCPLApp.cpl
[2012/12/12 08:14:04 | 000,262,141 | —- | M] () – C:\Users\Nancy\Documents\Holiday_Coupon.pdf
[2012/12/11 06:14:09 | 002,831,995 | —- | M] () – C:\Users\Nancy\Documents\FR370_Manual_NA_082211.pdf

========== Files Created - No Company Name ==========

[2013/01/04 08:00:55 | 000,002,441 | —- | C] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader XI.lnk
[2013/01/04 08:00:55 | 000,002,021 | —- | C] () – C:\Users\Public\Desktop\Adobe Reader XI.lnk
[2013/01/03 16:15:15 | 000,256,000 | —- | C] () – C:\Windows\PEV.exe
[2013/01/03 16:15:15 | 000,208,896 | —- | C] () – C:\Windows\MBR.exe
[2013/01/03 16:15:15 | 000,098,816 | —- | C] () – C:\Windows\sed.exe
[2013/01/03 16:15:15 | 000,080,412 | —- | C] () – C:\Windows\grep.exe
[2013/01/03 16:15:15 | 000,068,096 | —- | C] () – C:\Windows\zip.exe
[2013/01/01 08:09:42 | 000,002,056 | —- | C] () – C:\Users\Public\Desktop\Studio.lnk
[2012/12/31 13:27:10 | 000,005,116 | —- | C] () – C:\ProgramData\xgneqrwu.hrx
[2012/12/31 10:05:24 | 723,116,076 | —- | C] () – C:\Windows\MEMORY.DMP
[2012/12/31 08:01:49 | 000,810,496 | —- | C] () – C:\Windows\SysNative\xvidcore.dll
[2012/12/31 08:01:49 | 000,183,808 | —- | C] () – C:\Windows\SysNative\xvidvfw.dll
[2012/12/31 08:01:49 | 000,080,896 | —- | C] () – C:\Windows\SysNative\ff_vfw.dll
[2012/12/31 08:01:37 | 000,389,120 | —- | C] () – C:\Windows\SysWow64\actskn43.ocx
[2012/12/31 08:01:37 | 000,389,120 | —- | C] () – C:\Windows\SysNative\actskn43.ocx
[2012/12/31 06:01:24 | 001,151,360 | —- | C] () – C:\Windows\SysNative\FNTCACHE.DAT
[2012/12/30 08:19:17 | 000,000,108 | —- | C] () – C:\AUTOEXEC.BAT
[2012/12/30 08:17:09 | 000,027,807 | —- | C] () – C:\Windows\wmprfell.prx
[2012/12/30 08:17:09 | 000,025,269 | —- | C] () – C:\Windows\WMPrfAra.prx
[2012/12/30 08:17:09 | 000,020,704 | —- | C] () – C:\Windows\WMPrfJpn.prx
[2012/12/30 08:17:09 | 000,020,481 | —- | C] () – C:\Windows\wmprfheb.prx
[2012/12/30 08:17:09 | 000,020,055 | —- | C] () – C:\Windows\wmprfsky.prx
[2012/12/30 08:17:09 | 000,019,751 | —- | C] () – C:\Windows\wmprfhun.prx
[2012/12/30 08:17:09 | 000,019,437 | —- | C] () – C:\Windows\wmprffra.prx
[2012/12/30 08:17:09 | 000,018,878 | —- | C] () – C:\Windows\wmprfcsy.prx
[2012/12/30 08:17:09 | 000,018,536 | —- | C] () – C:\Windows\wmprfplk.prx
[2012/12/30 08:17:09 | 000,018,422 | —- | C] () – C:\Windows\wmprfptg.prx
[2012/12/30 08:17:09 | 000,017,953 | —- | C] () – C:\Windows\wmprfesp.prx
[2012/12/30 08:17:09 | 000,017,903 | —- | C] () – C:\Windows\WMPrfKor.prx
[2012/12/30 08:17:09 | 000,017,830 | —- | C] () – C:\Windows\wmprfita.prx
[2012/12/30 08:17:09 | 000,017,199 | —- | C] () – C:\Windows\wmprfptb.prx
[2012/12/30 08:17:09 | 000,017,025 | —- | C] () – C:\Windows\WMPrfDeu.prx
[2012/12/30 08:17:09 | 000,017,019 | —- | C] () – C:\Windows\wmprfsve.prx
[2012/12/30 08:17:09 | 000,016,822 | —- | C] () – C:\Windows\wmprftrk.prx
[2012/12/30 08:17:09 | 000,016,814 | —- | C] () – C:\Windows\wmprfslv.prx
[2012/12/30 08:17:09 | 000,016,446 | —- | C] () – C:\Windows\wmprfnor.prx
[2012/12/30 08:17:09 | 000,016,398 | —- | C] () – C:\Windows\wmprfnld.prx
[2012/12/30 08:17:09 | 000,016,265 | —- | C] () – C:\Windows\wmprffin.prx
[2012/12/30 08:17:09 | 000,015,903 | —- | C] () – C:\Windows\wmprfdan.prx
[2012/12/30 08:17:09 | 000,000,635 | —- | C] () – C:\Windows\wmprfrus.prx
[2012/12/30 08:17:09 | 000,000,083 | —- | C] () – C:\Windows\WMPrfCHS.prx
[2012/12/30 08:17:09 | 000,000,077 | —- | C] () – C:\Windows\WMPrfCHT.prx
[2012/12/29 11:50:22 | 000,196,096 | —- | C] () – C:\Windows\SysWow64\macd32.dll
[2012/12/29 11:50:22 | 000,138,752 | —- | C] () – C:\Windows\SysWow64\mase32.dll
[2012/12/29 11:50:22 | 000,136,192 | —- | C] () – C:\Windows\SysWow64\mamc32.dll
[2012/12/29 11:50:22 | 000,057,856 | —- | C] () – C:\Windows\SysWow64\masd32.dll
[2012/12/29 11:50:22 | 000,027,648 | —- | C] () – C:\Windows\SysWow64\ma32.dll
[2012/12/28 11:41:40 | 408,402,406 | —- | C] () – C:\Users\Nancy\Documents\John Denver Japan.mp4
[2012/12/27 09:49:39 | 000,002,156 | —- | C] () – C:\Users\Public\Desktop\YouTube Downloader App.lnk
[2012/12/27 09:49:30 | 000,002,212 | —- | C] () – C:\Users\Public\Desktop\Videora iPod Converter.lnk
[2012/12/18 07:32:09 | 000,001,785 | —- | C] () – C:\Users\Public\Desktop\iTunes.lnk
[2012/12/12 08:14:04 | 000,262,141 | —- | C] () – C:\Users\Nancy\Documents\Holiday_Coupon.pdf
[2012/12/11 06:14:09 | 002,831,995 | —- | C] () – C:\Users\Nancy\Documents\FR370_Manual_NA_082211.pdf
[2012/09/06 06:56:22 | 000,647,168 | —- | C] ( ) – C:\Windows\SysWow64\lxdxpmui.dll
[2012/09/06 06:56:22 | 000,364,544 | —- | C] ( ) – C:\Windows\SysWow64\lxdxinpa.dll
[2012/09/06 06:56:22 | 000,348,160 | —- | C] () – C:\Windows\SysWow64\LXDXinst.dll
[2012/09/06 06:56:22 | 000,339,968 | —- | C] ( ) – C:\Windows\SysWow64\lxdxiesc.dll
[2012/09/06 06:56:22 | 000,335,872 | —- | C] () – C:\Windows\SysWow64\lxdxcomx.dll
[2012/09/06 06:56:21 | 001,105,920 | —- | C] ( ) – C:\Windows\SysWow64\lxdxserv.dll
[2012/09/06 06:56:21 | 000,843,776 | —- | C] ( ) – C:\Windows\SysWow64\lxdxusb1.dll
[2012/09/06 06:56:21 | 000,663,552 | —- | C] ( ) – C:\Windows\SysWow64\lxdxhbn3.dll
[2012/09/06 06:56:21 | 000,589,824 | —- | C] ( ) – C:\Windows\SysWow64\lxdxcoms.exe
[2012/09/06 06:56:21 | 000,569,344 | —- | C] ( ) – C:\Windows\SysWow64\lxdxlmpm.dll
[2012/09/06 06:56:21 | 000,315,392 | —- | C] ( ) – C:\Windows\SysWow64\lxdxih.exe
[2012/09/06 06:56:21 | 000,053,248 | —- | C] ( ) – C:\Windows\SysWow64\lxdxprox.dll
[2012/09/06 06:56:20 | 000,851,968 | —- | C] ( ) – C:\Windows\SysWow64\lxdxcomc.dll
[2012/09/06 06:56:20 | 000,376,832 | —- | C] ( ) – C:\Windows\SysWow64\lxdxcomm.dll
[2012/09/06 06:56:20 | 000,360,448 | —- | C] ( ) – C:\Windows\SysWow64\lxdxcfg.exe
[2012/08/20 18:55:38 | 000,000,024 | —- | C] () – C:\Windows\ATKPF.ini
[2012/04/11 05:03:17 | 000,096,088 | —- | C] () – C:\Users\Nancy\Sweep.bak
[2012/04/05 17:39:56 | 000,145,530 | —- | C] () – C:\Users\Nancy\533435_3696032123872_1367418451_3464299_1118926329_n.jpg
[2012/03/27 09:57:08 | 000,153,600 | —- | C] () – C:\Windows\SysWow64\WSContextMenu.dll
[2012/03/19 22:31:16 | 000,963,912 | —- | C] () – C:\Windows\SysWow64\igkrng600.bin
[2012/03/19 22:31:16 | 000,261,208 | —- | C] () – C:\Windows\SysWow64\igfcg600m.bin
[2012/03/19 22:25:58 | 000,058,880 | —- | C] () – C:\Windows\SysWow64\igdde32.dll
[2012/03/19 21:21:14 | 013,212,672 | —- | C] () – C:\Windows\SysWow64\ig4icd32.dll
[2012/03/16 18:35:35 | 000,096,088 | —- | C] () – C:\Users\Nancy\Sweep.dat
[2012/01/30 09:58:46 | 000,782,336 | —- | C] () – C:\Windows\SysWow64\lxdxdrs.dll
[2012/01/30 09:58:46 | 000,081,920 | —- | C] () – C:\Windows\SysWow64\lxdxcaps.dll
[2012/01/30 09:58:46 | 000,069,632 | —- | C] () – C:\Windows\SysWow64\lxdxcnv4.dll
[2012/01/26 18:40:04 | 000,394,319 | —- | C] () – C:\Users\Nancy\10-ways-to-get-organized-with-evernote.pdf
[2011/10/17 23:17:57 | 000,825,186 | —- | C] () – C:\Windows\SysWow64\PerfStringBackup.INI
[2011/10/13 10:01:51 | 007,167,137 | —- | C] () – C:\Users\Nancy\iphone.xml
[2011/10/07 06:46:22 | 001,001,734 | —- | C] () – C:\Users\Nancy\new_dash.pdf
[2011/09/16 14:15:16 | 000,014,318 | —- | C] () – C:\Users\Nancy\about-village-logo.png
[2011/09/14 07:51:41 | 000,055,679 | —- | C] () – C:\Users\Nancy\notebook_calendar_to_do_daily.pdf
[2011/08/02 04:59:00 | 000,039,424 | —- | C] () – C:\Users\Nancy\DisneyTime.exe
[2011/05/26 03:26:14 | 000,145,804 | —- | C] () – C:\Windows\SysWow64\igcompkrng600.bin
[2011/04/10 15:31:16 | 000,230,960 | —- | C] () – C:\Users\Nancy\bookmarks.html
[2011/04/10 05:20:47 | 006,821,257 | —- | C] () – C:\Users\Nancy\Library.xml
[2011/04/01 11:00:05 | 000,121,095 | —- | C] () – C:\Users\Nancy\bookmarks-2011-04-01.json
[2011/03/26 05:28:11 | 007,021,631 | —- | C] () – C:\Users\Nancy\Library touch.xml
[2011/03/24 06:24:44 | 000,008,510 | —- | C] () – C:\Users\Nancy\NANCY.CRD

========== ZeroAccess Check ==========

[2009/07/13 23:55:00 | 000,000,227 | RHS- | M] () – C:\Windows\assembly\Desktop.ini

[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64

[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] /64

[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
"" = C:\Windows\SysNative\shell32.dll – [2012/06/09 00:43:10 | 014,172,672 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shell32.dll – [2012/06/08 23:41:00 | 012,873,728 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\fastprox.dll – [2009/07/13 20:40:51 | 000,909,312 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Free

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\system32\wbem\fastprox.dll – [2010/11/20 07:19:04 | 000,606,208 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Free

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\wbemess.dll – [2009/07/13 20:41:56 | 000,505,856 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Both

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]

========== Alternate Data Streams ==========

@Alternate Data Stream - 147 bytes -> C:\ProgramData\Temp:23E3D912
@Alternate Data Stream - 124 bytes -> C:\ProgramData\Temp:718F6FF0
@Alternate Data Stream - 105 bytes -> C:\ProgramData\Temp:5C321E34

< End of report >

It seems to be working now. I opened IE and didn't get the tnt2user popup.

Thanks!!!

jeffce

Post #20January 4, 2013, 8:15 PM UTC

Hi,

Great to hear!
——–

Run the instructions I provided for AdwCleaner again and post that log.
———-

[external image: Posted Image] Java

Please go to Start > Control Panel > Programs and Features > uninstall all the Java Programs you see, now download the latest Java from the following link and install it:

http://java.com/en/download/index.jsp
———-

See this page for instructions on how to clear java's cache.

Go into the Control Panel and double-click the Java Icon. (looks like a coffee cup)

Under Temporary Internet Files, click the Delete Files button.
There are three options in the window to clear the cache - Leave ALL 3 Checked
- Downloaded Applets
  Downloaded Applications
  Installed Applications and Applets
Click OK on Delete Temporary Files Window
Note: This deletes ALL the Downloaded Applications and Applets from the CACHE.
Click OK to leave the Java Control Panel.

———-

[external image: Posted Image] Malwarebytes

Please open Malwarebytes, update it and then run a Quick Scan. Save the log that is created for your next reply.
———-

ESET Online Scanner

Go here to run an online scannner from ESET. Windows Vista/Windows 7 users will need to right click on their Internet Explorer shortcut, and select Run as Administrator

Note: For browsers other than Internet Explorer, you will be prompted to download and install esetsmartinstaller_enu.exe. Click on the link and save the file to a convenient location. Double click on it to install and a new window will open. Follow the prompts.
Turn off the real time scanner of any existing antivirus program while performing the online scan
Tick the box next to YES, I accept the Terms of Use.
Click Start
When asked, allow the activex control to install
Click Start
Make sure that the option Remove found threats is unticked and the Scan Archives option is ticked.
Click on Advanced Settings, ensure the options Scan for potentially unwanted applications, Scan for potentially unsafe applications, and Enable Anti-Stealth Technology are ticked.
Click Scan
Wait for the scan to finish
When the scan is done, if it shows a screen that says "Threats found!", then click "List of found threats", and then click "Export to text file…"
Save that text file on your desktop. Copy and paste the contents of that log as a reply to this topic.
Close the ESET online scan, and let me know how things are now.

———-

starwood

Post #21January 4, 2013, 9:11 PM UTC

# AdwCleaner v2.104 - Logfile created 01/04/2013 at 15:43:47 # Updated 29/12/2012 by Xplode # Operating system : Windows 7 Home Premium Service Pack 1 (64 bits) # User : Nancy - NANCY-PC # Boot Mode : Normal # Running from : C:\Users\Nancy\Downloads\AdwCleaner.exe # Option [Search] ***** [Services] ***** ***** [Files / Folders] ***** Folder Found : C:\Users\Nancy\AppData\Roaming\Mozilla\Firefox\Profiles\pqxe4c84.default\CT2260173 Folder Found : C:\Users\Nancy\AppData\Roaming\Mozilla\Firefox\Profiles\pqxe4c84.default\extensions\{8bdea9d6-6f62-45eb-8ee9-8a81af0d2f94} Folder Found : C:\Users\Nancy\AppData\Roaming\Mozilla\Firefox\Profiles\pqxe4c84.default\Smartbar ***** [Registry] ***** Key Found : HKCU\Software\AppDataLow\Software\SmartBar ***** [Internet Browsers] ***** -\\ Internet Explorer v9.0.8112.16457 [OK] Registry is clean. -\\ Mozilla Firefox v17.0.1 (en-US) File : C:\Users\Nancy\AppData\Roaming\Mozilla\Firefox\Profiles\pqxe4c84.default\prefs.js Found : user_pref("CT2260173.ENABALE_HISTORY", "{\"dataType\":\"string\",\"data\":\"true\"}"); Found : user_pref("CT2260173.ENABLE_RETURN_WEB_SEARCH_ON_THE_PAGE", "{\"dataType\":\"string\",\"data\":\"tru[…] Found : user_pref("CT2260173.FirstTime", "true"); Found : user_pref("CT2260173.FirstTimeFF3", "true"); Found : user_pref("CT2260173.LoginRevertSettingsEnabled", true); Found : user_pref("CT2260173.RevertSettingsEnabled", true); Found : user_pref("CT2260173.UserID", "UN75331516142487758"); Found : user_pref("CT2260173.addressBarTakeOverEnabledInHidden", "true"); Found : user_pref("CT2260173.embeddedsData", "[{\"appId\":\"128848965243869715\",\"apiPermissions\":{\"cross[…] Found : user_pref("CT2260173.enableAlerts", "never"); Found : user_pref("CT2260173.firstTimeDialogOpened", "true"); Found : user_pref("CT2260173.fixPageNotFoundErrorInHidden", "true"); Found : user_pref("CT2260173.fixUrls", true); Found : user_pref("CT2260173.installType", "DirectDownload"); Found : user_pref("CT2260173.isCheckedStartAsHidden", true); Found : user_pref("CT2260173.isEnableAllDialogs", "{\"dataType\":\"string\",\"data\":\"true\"}"); Found : user_pref("CT2260173.isFirstTimeToolbarLoading", "false"); Found : user_pref("CT2260173.isNewTabEnabled", false); Found : user_pref("CT2260173.isPerformedSmartBarTransition", "true"); Found : user_pref("CT2260173.isToolbarShrinked", "{\"dataType\":\"string\",\"data\":\"false\"}"); Found : user_pref("CT2260173.isWelcomPage", "{\"dataType\":\"boolean\",\"data\":\"true\"}"); Found : user_pref("CT2260173.migrateAppsAndComponents", true); Found : user_pref("CT2260173.navigationAliasesJson", "{\"EB_SEARCH_TERM\":\"\",\"EB_MAIN_FRAME_URL\":\"hxxp%[…] Found : user_pref("CT2260173.search.searchAppId", "128848965243869715"); Found : user_pref("CT2260173.search.searchCount", "0"); Found : user_pref("CT2260173.searchInNewTabEnabled", "false"); Found : user_pref("CT2260173.searchInNewTabEnabledInHidden", "true"); Found : user_pref("CT2260173.selectToSearchBoxEnabled", "{\"dataType\":\"string\",\"data\":\"true\"}"); Found : user_pref("CT2260173.serviceLayer_service_login_isFirstLoginInvoked", "{\"dataType\":\"boolean\",\"d[…] Found : user_pref("CT2260173.serviceLayer_service_login_loginCount", "{\"dataType\":\"number\",\"data\":\"2\[…] Found : user_pref("CT2260173.serviceLayer_service_toolbarGrouping_activeCTID", "{\"dataType\":\"string\",\"d[…] Found : user_pref("CT2260173.serviceLayer_service_toolbarGrouping_activeDownloadUrl", "{\"dataType\":\"strin[…] Found : user_pref("CT2260173.serviceLayer_service_toolbarGrouping_activeToolbarName", "{\"dataType\":\"strin[…] Found : user_pref("CT2260173.serviceLayer_service_toolbarGrouping_invoked", "{\"dataType\":\"string\",\"data[…] Found : user_pref("CT2260173.serviceLayer_services_appTrackingFirstTime_lastUpdate", "1357321106184"); Found : user_pref("CT2260173.serviceLayer_services_appsMetadata_lastUpdate", "1357328671616"); Found : user_pref("CT2260173.serviceLayer_services_gottenAppsContextMenu_lastUpdate", "1357321104913"); Found : user_pref("CT2260173.serviceLayer_services_login_10.13.40.15_lastUpdate", "1357321117010"); Found : user_pref("CT2260173.serviceLayer_services_otherAppsContextMenu_lastUpdate", "1357321104697"); Found : user_pref("CT2260173.serviceLayer_services_searchAPI_lastUpdate", "1357321102740"); Found : user_pref("CT2260173.serviceLayer_services_serviceMap_lastUpdate", "1357321102419"); Found : user_pref("CT2260173.serviceLayer_services_toolbarContextMenu_lastUpdate", "1357321104721"); Found : user_pref("CT2260173.serviceLayer_services_toolbarSettings_lastUpdate", "1357328671557"); Found : user_pref("CT2260173.serviceLayer_services_translation_lastUpdate", "1357321105513"); Found : user_pref("CT2260173.settingsINI", true); Found : user_pref("CT2260173.smartbar.CTID", "CT2260173"); Found : user_pref("CT2260173.smartbar.Uninstall", "0"); Found : user_pref("CT2260173.smartbar.toolbarName", "Swag Bucks "); Found : user_pref("CT2260173.toolbarBornServerTime", "4-1-2013"); Found : user_pref("CT2260173.toolbarCurrentServerTime", "4-1-2013"); Found : user_pref("CT2260173_Firefox.csv", "[{\"from\":\"Abs Layer\",\"action\":\"loading toolbar\",\"time\"[…] ************************* AdwCleaner[R1].txt - [18427 octets] - [03/01/2013 13:34:12] AdwCleaner[R2].txt - [5368 octets] - [04/01/2013 15:43:48] AdwCleaner[S1].txt - [19018 octets] - [03/01/2013 14:33:09] ########## EOF - C:\AdwCleaner[R2].txt - [5489 octets] ########## Malwarebytes Anti-Malware 1.70.0.1100 www.malwarebytes.org Database version: v2012.12.31.05 Windows 7 Service Pack 1 x64 NTFS Internet Explorer 9.0.8112.16421 Nancy :: NANCY-PC [administrator] 1/4/2013 3:53:53 PM mbam-log-2013-01-04 (15-53-53).txt Scan type: Quick scan Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM Scan options disabled: P2P Objects scanned: 208768 Time elapsed: 6 minute(s), 26 second(s) Memory Processes Detected: 0 (No malicious items detected) Memory Modules Detected: 0 (No malicious items detected) Registry Keys Detected: 0 (No malicious items detected) Registry Values Detected: 0 (No malicious items detected) Registry Data Items Detected: 0 (No malicious items detected) Folders Detected: 0 (No malicious items detected) Files Detected: 0 (No malicious items detected) (end) I'm running eset right now and it has found 3 threats so far. I'll post that when it's done.

jeffce

Post #22January 4, 2013, 9:32 PM UTC

starwood

Post #23January 4, 2013, 11:29 PM UTC

C:\Downloads\defragsetup.exe a variant of Win32/Toolbar.Widgi application C:\Downloads\sd-setup.exe a variant of Win32/ELEX application C:\Downloads\videora-ipod-600-setup.exe Win32/OpenCandy application C:\Users\Nancy\Downloads\Brothersoft_downloader_For_Dazzle_DVD_Recorder(1).exe a variant of Win32/BSDownloader application C:\Users\Nancy\Downloads\Brothersoft_downloader_For_Dazzle_DVD_Recorder.exe a variant of Win32/BSDownloader application C:\Users\Nancy\Downloads\cnet2_elecpb185_zip.exe a variant of Win32/InstallCore.D application C:\Users\Nancy\Downloads\defragsetup.exe a variant of Win32/Toolbar.Widgi application C:\Users\Nancy\Downloads\sd-setup.exe a variant of Win32/ELEX application C:\Users\Nancy\Downloads\SoftonicDownloader_for_my-address-book.exe Win32/SoftonicDownloader.C application C:\Users\Nancy\Downloads\videora-ipod-600-setup.exe Win32/OpenCandy application

jeffce

Post #24January 4, 2013, 11:58 PM UTC

[external image: Posted Image] AdwCleaner

Close all open programs and internet browsers.
Double click on adwcleaner.exe to run the tool.
Click on Delete.
Confirm each time with Ok.
You will be prompted to restart your computer. A text file will open after the restart.
Please post the contents of that logfile with your next reply.
You can find the logfile at C:\AdwCleaner[S1].txt as well.

———-

[external image: Posted Image] Run OTL.exe

Copy/paste the following text written inside of the quote box into the Custom Scans/Fixes box located at the bottom of OTL

:Services

:Files
C:\Downloads\defragsetup.exe
C:\Downloads\sd-setup.exe
C:\Downloads\videora-ipod-600-setup.exe
C:\Users\Nancy\Downloads\Brothersoft_downloader_For_Dazzle_DVD_Recorder(1).exe
C:\Users\Nancy\Downloads\Brothersoft_downloader_For_Dazzle_DVD_Recorder.exe
C:\Users\Nancy\Downloads\cnet2_elecpb185_zip.exe
C:\Users\Nancy\Downloads\defragsetup.exe
C:\Users\Nancy\Downloads\sd-setup.exe
C:\Users\Nancy\Downloads\SoftonicDownloader_for_my-address-book.exe
C:\Users\Nancy\Downloads\videora-ipod-600-setup.exe

:Commands
[emptytemp]
[start explorer]
[Reboot]
Then click the Run Fix button at the top
Let the program run unhindered, reboot when it is done
Then run a new scan and post a new OTL log ( don't check the boxes beside LOP Check or Purity this time )

———-

Post the OTL logs and let me know what remaining malware problems you are having.

starwood

Post #25January 5, 2013, 12:41 AM UTC

# AdwCleaner v2.104 - Logfile created 01/04/2013 at 19:19:03
# Updated 29/12/2012 by Xplode
# Operating system : Windows 7 Home Premium Service Pack 1 (64 bits)
# User : Nancy - NANCY-PC
# Boot Mode : Normal
# Running from : C:\Users\Nancy\Downloads\AdwCleaner.exe
# Option [Delete]

***** [Services] *****

***** [Files / Folders] *****

Folder Deleted : C:\Users\Nancy\AppData\Roaming\Mozilla\Firefox\Profiles\pqxe4c84.default\CT2260173
Folder Deleted : C:\Users\Nancy\AppData\Roaming\Mozilla\Firefox\Profiles\pqxe4c84.default\extensions\{8bdea9d6-6f62-45eb-8ee9-8a81af0d2f94}
Folder Deleted : C:\Users\Nancy\AppData\Roaming\Mozilla\Firefox\Profiles\pqxe4c84.default\Smartbar

***** [Registry] *****

Key Deleted : HKCU\Software\AppDataLow\Software\SmartBar

***** [Internet Browsers] *****

-\\ Internet Explorer v9.0.8112.16457

[OK] Registry is clean.

-\\ Mozilla Firefox v17.0.1 (en-US)

File : C:\Users\Nancy\AppData\Roaming\Mozilla\Firefox\Profiles\pqxe4c84.default\prefs.js

Deleted : user_pref("CT2260173.ENABALE_HISTORY", "{\"dataType\":\"string\",\"data\":\"true\"}");
Deleted : user_pref("CT2260173.ENABLE_RETURN_WEB_SEARCH_ON_THE_PAGE", "{\"dataType\":\"string\",\"data\":\"tru[…]
Deleted : user_pref("CT2260173.FirstTime", "true");
Deleted : user_pref("CT2260173.FirstTimeFF3", "true");
Deleted : user_pref("CT2260173.LoginRevertSettingsEnabled", true);
Deleted : user_pref("CT2260173.RevertSettingsEnabled", true);
Deleted : user_pref("CT2260173.UserID", "UN75331516142487758");
Deleted : user_pref("CT2260173.addressBarTakeOverEnabledInHidden", "true");
Deleted : user_pref("CT2260173.embeddedsData", "[{\"appId\":\"128848965243869715\",\"apiPermissions\":{\"cross[…]
Deleted : user_pref("CT2260173.enableAlerts", "never");
Deleted : user_pref("CT2260173.firstTimeDialogOpened", "true");
Deleted : user_pref("CT2260173.fixPageNotFoundErrorInHidden", "true");
Deleted : user_pref("CT2260173.fixUrls", true);
Deleted : user_pref("CT2260173.installType", "DirectDownload");
Deleted : user_pref("CT2260173.isCheckedStartAsHidden", true);
Deleted : user_pref("CT2260173.isEnableAllDialogs", "{\"dataType\":\"string\",\"data\":\"true\"}");
Deleted : user_pref("CT2260173.isFirstTimeToolbarLoading", "false");
Deleted : user_pref("CT2260173.isNewTabEnabled", false);
Deleted : user_pref("CT2260173.isPerformedSmartBarTransition", "true");
Deleted : user_pref("CT2260173.isToolbarShrinked", "{\"dataType\":\"string\",\"data\":\"false\"}");
Deleted : user_pref("CT2260173.isWelcomPage", "{\"dataType\":\"boolean\",\"data\":\"true\"}");
Deleted : user_pref("CT2260173.migrateAppsAndComponents", true);
Deleted : user_pref("CT2260173.navigationAliasesJson", "{\"EB_SEARCH_TERM\":\"\",\"EB_MAIN_FRAME_URL\":\"hxxps[…]
Deleted : user_pref("CT2260173.search.searchAppId", "128848965243869715");
Deleted : user_pref("CT2260173.search.searchCount", "0");
Deleted : user_pref("CT2260173.searchInNewTabEnabled", "false");
Deleted : user_pref("CT2260173.searchInNewTabEnabledInHidden", "true");
Deleted : user_pref("CT2260173.selectToSearchBoxEnabled", "{\"dataType\":\"string\",\"data\":\"true\"}");
Deleted : user_pref("CT2260173.serviceLayer_service_login_isFirstLoginInvoked", "{\"dataType\":\"boolean\",\"d[…]
Deleted : user_pref("CT2260173.serviceLayer_service_login_loginCount", "{\"dataType\":\"number\",\"data\":\"4\[…]
Deleted : user_pref("CT2260173.serviceLayer_service_toolbarGrouping_activeCTID", "{\"dataType\":\"string\",\"d[…]
Deleted : user_pref("CT2260173.serviceLayer_service_toolbarGrouping_activeDownloadUrl", "{\"dataType\":\"strin[…]
Deleted : user_pref("CT2260173.serviceLayer_service_toolbarGrouping_activeToolbarName", "{\"dataType\":\"strin[…]
Deleted : user_pref("CT2260173.serviceLayer_service_toolbarGrouping_invoked", "{\"dataType\":\"string\",\"data[…]
Deleted : user_pref("CT2260173.serviceLayer_services_appTrackingFirstTime_lastUpdate", "1357321106184");
Deleted : user_pref("CT2260173.serviceLayer_services_appTracking_lastUpdate", "1357345121207");
Deleted : user_pref("CT2260173.serviceLayer_services_appsMetadata_lastUpdate", "1357342142265");
Deleted : user_pref("CT2260173.serviceLayer_services_gottenAppsContextMenu_lastUpdate", "1357321104913");
Deleted : user_pref("CT2260173.serviceLayer_services_login_10.13.40.15_lastUpdate", "1357335994933");
Deleted : user_pref("CT2260173.serviceLayer_services_otherAppsContextMenu_lastUpdate", "1357321104697");
Deleted : user_pref("CT2260173.serviceLayer_services_searchAPI_lastUpdate", "1357321102740");
Deleted : user_pref("CT2260173.serviceLayer_services_serviceMap_lastUpdate", "1357335994869");
Deleted : user_pref("CT2260173.serviceLayer_services_toolbarContextMenu_lastUpdate", "1357321104721");
Deleted : user_pref("CT2260173.serviceLayer_services_toolbarSettings_lastUpdate", "1357342142315");
Deleted : user_pref("CT2260173.serviceLayer_services_translation_lastUpdate", "1357335994927");
Deleted : user_pref("CT2260173.settingsINI", true);
Deleted : user_pref("CT2260173.smartbar.CTID", "CT2260173");
Deleted : user_pref("CT2260173.smartbar.Uninstall", "0");
Deleted : user_pref("CT2260173.smartbar.toolbarName", "Swag Bucks ");
Deleted : user_pref("CT2260173.toolbarBornServerTime", "4-1-2013");
Deleted : user_pref("CT2260173.toolbarCurrentServerTime", "5-1-2013");
Deleted : user_pref("CT2260173_Firefox.csv", "[{\"from\":\"Abs Layer\",\"action\":\"loading toolbar\",\"time\"[…]

*************************

AdwCleaner[R1].txt - [18427 octets] - [03/01/2013 13:34:12]
AdwCleaner[R2].txt - [5558 octets] - [04/01/2013 15:43:48]
AdwCleaner[S1].txt - [19018 octets] - [03/01/2013 14:33:09]
AdwCleaner[S2].txt - [5696 octets] - [04/01/2013 19:19:03]

########## EOF - C:\AdwCleaner[S2].txt - [5756 octets] ##########

OTL logfile created on: 1/4/2013 7:31:27 PM - Run 3
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\Nancy\Downloads
64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

7.91 Gb Total Physical Memory | 5.78 Gb Available Physical Memory | 73.00% Memory free
15.82 Gb Paging File | 13.55 Gb Available in Paging File | 85.65% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 279.45 Gb Total Space | 65.57 Gb Free Space | 23.47% Space Free | Partition Type: NTFS
Drive D: | 394.18 Gb Total Space | 394.08 Gb Free Space | 99.97% Space Free | Partition Type: NTFS

Computer Name: NANCY-PC | User Name: Nancy | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Users\Nancy\Downloads\OTL.exe (OldTimer Tools)
PRC - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation)
PRC - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
PRC - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe (Malwarebytes Corporation)
PRC - C:\Program Files (x86)\Siber Systems\AI RoboForm\robotaskbaricon.exe (Siber Systems)
PRC - C:\Program Files (x86)\Evernote\Evernote\EvernoteClipper.exe (Evernote Corp., 333 W Evelyn Ave. Mountain View, CA 94041)
PRC - C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation)
PRC - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated)
PRC - C:\Windows\AsScrPro.exe (ASUS)
PRC - C:\Program Files (x86)\ASUS\APRP\aprp.exe (ASUSTek Computer Inc.)
PRC - C:\Program Files (x86)\AWS\WeatherBug\Weather.exe (AWS Convergence Technologies, Inc.)
PRC - C:\Program Files (x86)\ASUS\Wireless Console 3\wcourier.exe (ASUS)
PRC - C:\Program Files (x86)\ASUS\Splendid\ACMON.exe (ASUS)
PRC - C:\Program Files (x86)\Intel\Bluetooth\obexsrv.exe (Intel Corporation)
PRC - C:\Program Files (x86)\Intel\Bluetooth\mediasrv.exe (Intel Corporation)
PRC - C:\Program Files (x86)\Intel\Bluetooth\devmonsrv.exe (Intel Corporation)
PRC - C:\Program Files (x86)\Intel\Bluetooth\btplayerctrl.exe (Intel Corporation)
PRC - C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControl.exe (ASUS)
PRC - C:\Program Files (x86)\ASUS\SmartLogon\sensorsrv.exe (ASUS)
PRC - C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe (ASUS)
PRC - C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe (CyberLink)
PRC - C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe (ASUS)
PRC - C:\Program Files (x86)\ASUS\Sonic Focus\SonicFocusTray.exe (Virage Logic Corporation / Sonic Focus)
PRC - C:\Program Files (x86)\Lexmark 3600-4600 Series\lxdxmsdmon.exe ()
PRC - C:\Program Files (x86)\Lexmark 3600-4600 Series\lxdxmon.exe ()
PRC - C:\Program Files (x86)\ASUS\ATK Package\ATKGFNEX\GFNEXSrv.exe (ASUS)
PRC - C:\Program Files (x86)\Adobe\Elements Organizer 8.0\ElementsOrganizerSyncAgent.exe (Adobe Systems Incorporated)
PRC - C:\Program Files (x86)\Adobe\Elements Organizer 8.0\PhotoshopElementsFileAgent.exe (Adobe Systems Incorporated)
PRC - C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControlUser.exe (ASUS)
PRC - C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\ATKOSD.exe (ASUS)
PRC - C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\AsLdrSrv.exe (ASUS)
PRC - C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin (OpenOffice.org)
PRC - C:\Program Files (x86)\OpenOffice.org 3\program\soffice.exe (OpenOffice.org)
PRC - C:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe (Safer Networking Ltd.)
PRC - C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\WDC.exe (ASUS)
PRC - C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\KBFiltr.exe (ASUS)
PRC - C:\Program Files (x86)\ASUS\ASUS Live Update\ALU.exe ()
PRC - C:\Program Files (x86)\Pinnacle\Shared Files\Programs\USBTip\USBTip.exe (Pinnacle Systems GmbH)

========== Modules (No Company Name) ==========

MOD - C:\Program Files (x86)\Mozilla Firefox\mozjs.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\d040079bc7148afeca03c5abb6fc3c61\System.Windows.Forms.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\4e80768a2d88c7a333e43cbb7a6c0705\System.Drawing.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Xml\25e672ea505e50ab058258ac72a54f02\System.Xml.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Configuration\c64ca3678261c8ffcd9e7efd1af6ed54\System.Configuration.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System\9dd758ac0bf7358ac6e4720610fcc63c\System.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\187d7c66735c533de851c76384f86912\mscorlib.ni.dll ()
MOD - C:\Program Files (x86)\Evernote\Evernote\libxml2.dll ()
MOD - C:\Program Files (x86)\Evernote\Evernote\libtidy.dll ()
MOD - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll ()
MOD - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll ()
MOD - C:\Program Files (x86)\ASUS\Wireless Console 3\acAuth.dll ()
MOD - C:\Program Files (x86)\ASUS\Splendid\GLCDdll.dll ()
MOD - C:\Program Files (x86)\CyberLink\Power2Go\CLMediaLibrary.dll ()
MOD - C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvcPS.dll ()
MOD - C:\Program Files (x86)\Lexmark 3600-4600 Series\lxdxmsdmon.exe ()
MOD - C:\Program Files (x86)\Lexmark 3600-4600 Series\lxdxmon.exe ()
MOD - C:\Program Files (x86)\Lexmark 3600-4600 Series\lxdxcaps.dll ()
MOD - C:\Program Files (x86)\Lexmark 3600-4600 Series\lxdxscw.dll ()
MOD - C:\Program Files (x86)\Lexmark 3600-4600 Series\lxdxdrs.dll ()
MOD - C:\Program Files (x86)\Lexmark 3600-4600 Series\lxdxcnv4.dll ()
MOD - C:\Program Files (x86)\Lexmark 3600-4600 Series\app4r.monitor.core.dll ()
MOD - C:\Program Files (x86)\Lexmark 3600-4600 Series\app4r.monitor.common.dll ()
MOD - C:\Program Files (x86)\Lexmark 3600-4600 Series\app4r.devmons.mcmdevmon.dll ()
MOD - C:\Program Files (x86)\Lexmark 3600-4600 Series\lxdxdatr.dll ()
MOD - C:\Program Files (x86)\Lexmark 3600-4600 Series\lxdxcats.dll ()
MOD - C:\Program Files (x86)\Adobe\Elements Organizer 8.0\AdobeXMPFiles.dll ()
MOD - C:\Program Files (x86)\Adobe\Elements Organizer 8.0\AdobeXMP.dll ()
MOD - C:\Program Files (x86)\OpenOffice.org 3\program\libxml2.dll ()
MOD - C:\Program Files (x86)\ASUS\ASUS Live Update\ALU.exe ()
MOD - C:\Program Files (x86)\Lexmark 3600-4600 Series\app4r.devmons.mcmdevmon.autoplayutil.dll ()

========== Services (SafeList) ==========

SRV:64bit: - (NisSrv) – C:\Program Files\Microsoft Security Client\NisSrv.exe (Microsoft Corporation)
SRV:64bit: - (MsMpSvc) – C:\Program Files\Microsoft Security Client\MsMpEng.exe (Microsoft Corporation)
SRV:64bit: - (GsServer) – C:\Program Files\Siber Systems\GoodSync\Gs-Server.exe ()
SRV:64bit: - (EvtEng) – C:\Program Files\Intel\WiFi\bin\EvtEng.exe (Intel® Corporation)
SRV:64bit: - (MyWiFiDHCPDNS) – C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe ()
SRV:64bit: - (RegSrvc) – C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe (Intel® Corporation)
SRV:64bit: - (AMPPALR3) – C:\Program Files\Intel\BluetoothHS\BTHSAmpPalService.exe (Intel Corporation)
SRV:64bit: - (AFBAgent) – C:\Windows\SysNative\FBAgent.exe (ASUSTeK Computer Inc.)
SRV:64bit: - (BTHSSecurityMgr) – C:\Program Files\Intel\BluetoothHS\BTHSSecurityMgr.exe (Intel® Corporation)
SRV:64bit: - (wlcrasvc) – C:\Program Files\Windows Live\Mesh\wlcrasvc.exe (Microsoft Corporation)
SRV:64bit: - (TurboBoost) – C:\Program Files\Intel\TurboBoost\TurboBoost.exe (Intel® Corporation)
SRV:64bit: - (lxdx_device) – C:\Windows\SysNative\lxdxcoms.exe ( )
SRV:64bit: - (lxdxCATSCustConnectService) – C:\Windows\SysNative\spool\DRIVERS\x64\3\\lxdxserv.exe ()
SRV:64bit: - (WinDefend) – C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)
SRV - (MBAMService) – C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation)
SRV - (MBAMScheduler) – C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe (Malwarebytes Corporation)
SRV - (AdobeFlashPlayerUpdateSvc) – C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe (Adobe Systems Incorporated)
SRV - (MozillaMaintenance) – C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe (Mozilla Foundation)
SRV - (AdobeARMservice) – C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated)
SRV - (FLEXnet Licensing Service) – C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe (Acresso Software Inc.)
SRV - (cphs) – C:\Windows\SysWOW64\IntelCpHeciSvc.exe (Intel Corporation)
SRV - (Bluetooth OBEX Service) – C:\Program Files (x86)\Intel\Bluetooth\obexsrv.exe (Intel Corporation)
SRV - (Bluetooth Media Service) – C:\Program Files (x86)\Intel\Bluetooth\mediasrv.exe (Intel Corporation)
SRV - (Bluetooth Device Monitor) – C:\Program Files (x86)\Intel\Bluetooth\devmonsrv.exe (Intel Corporation)
SRV - (clr_optimization_v4.0.30319_32) – C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (Microsoft Corporation)
SRV - (ATKGFNEXSrv) – C:\Program Files (x86)\ASUS\ATK Package\ATKGFNEX\GFNEXSrv.exe (ASUS)
SRV - (lxdx_device) – C:\Windows\SysWOW64\lxdxcoms.exe ( )
SRV - (lxdxCATSCustConnectService) – C:\Windows\system32\spool\DRIVERS\x64\3\\lxdxserv.exe ()
SRV - (AdobeActiveFileMonitor8.0) – C:\Program Files (x86)\Adobe\Elements Organizer 8.0\PhotoshopElementsFileAgent.exe (Adobe Systems Incorporated)
SRV - (ASLDRService) – C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\AsLdrSrv.exe (ASUS)
SRV - (clr_optimization_v2.0.50727_32) – C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (Microsoft Corporation)
SRV - (PCLEPCI) – C:\Windows\SysWOW64\drivers\Pclepci.sys (Pinnacle Systems GmbH)

========== Driver Services (SafeList) ==========

DRV:64bit: - (MBAMProtector) – C:\Windows\SysNative\drivers\mbam.sys (Malwarebytes Corporation)
DRV:64bit: - (USBAAPL64) – C:\Windows\SysNative\drivers\usbaapl64.sys (Apple, Inc.)
DRV:64bit: - (NisDrv) – C:\Windows\SysNative\drivers\NisDrvWFP.sys (Microsoft Corporation)
DRV:64bit: - (GEARAspiWDM) – C:\Windows\SysNative\drivers\GEARAspiWDM.sys (GEAR Software Inc.)
DRV:64bit: - (igfx) – C:\Windows\SysNative\drivers\igdkmd64.sys (Intel Corporation)
DRV:64bit: - (Fs_Rec) – C:\Windows\SysNative\drivers\fs_rec.sys (Microsoft Corporation)
DRV:64bit: - (iBtFltCoex) – C:\Windows\SysNative\drivers\iBtFltCoex.sys (Intel Corporation)
DRV:64bit: - (btmhsf) – C:\Windows\SysNative\drivers\btmhsf.sys (Intel Corporation)
DRV:64bit: - (amdsata) – C:\Windows\SysNative\drivers\amdsata.sys (Advanced Micro Devices)
DRV:64bit: - (amdxata) – C:\Windows\SysNative\drivers\amdxata.sys (Advanced Micro Devices)
DRV:64bit: - (fssfltr) – C:\Windows\SysNative\drivers\fssfltr.sys (Microsoft Corporation)
DRV:64bit: - (NETwNs64) – C:\Windows\SysNative\drivers\NETwNs64.sys (Intel Corporation)
DRV:64bit: - (FLxHCIc) – C:\Windows\SysNative\drivers\FLxHCIc.sys (Fresco Logic)
DRV:64bit: - (FLxHCIh) – C:\Windows\SysNative\drivers\FLxHCIh.sys (Fresco Logic)
DRV:64bit: - (wdkmd) – C:\Windows\SysNative\drivers\WDKMD.sys (Intel Corporation)
DRV:64bit: - (intaud_WaveExtensible) – C:\Windows\SysNative\drivers\intelaud.sys (Intel Corporation)
DRV:64bit: - (iwdbus) – C:\Windows\SysNative\drivers\iwdbus.sys (Intel Corporation)
DRV:64bit: - (AMPPALP) – C:\Windows\SysNative\drivers\AmpPal.sys (Windows ® Win 7 DDK provider)
DRV:64bit: - (AMPPAL) – C:\Windows\SysNative\drivers\AmpPal.sys (Windows ® Win 7 DDK provider)
DRV:64bit: - (btmaux) – C:\Windows\SysNative\drivers\btmaux.sys (Intel Corporation)
DRV:64bit: - (ETD) – C:\Windows\SysNative\drivers\ETD.sys (ELAN Microelectronics Corp.)
DRV:64bit: - (HpSAMD) – C:\Windows\SysNative\drivers\HpSAMD.sys (Hewlett-Packard Company)
DRV:64bit: - (TsUsbFlt) – C:\Windows\SysNative\drivers\TsUsbFlt.sys (Microsoft Corporation)
DRV:64bit: - (TsUsbGD) – C:\Windows\SysNative\drivers\TsUsbGD.sys (Microsoft Corporation)
DRV:64bit: - (iaStor) – C:\Windows\SysNative\drivers\iaStor.sys (Intel Corporation)
DRV:64bit: - (MEIx64) – C:\Windows\SysNative\drivers\HECIx64.sys (Intel Corporation)
DRV:64bit: - (IntcDAud) – C:\Windows\SysNative\drivers\IntcDAud.sys (Intel® Corporation)
DRV:64bit: - (L1C) – C:\Windows\SysNative\drivers\L1C62x64.sys (Atheros Communications, Inc.)
DRV:64bit: - (AmUStor) – C:\Windows\SysNative\drivers\AmUStor.sys (Alcor Micro, Corp.)
DRV:64bit: - (assd) – C:\Windows\SysNative\drivers\assd.sys (ASUS Corporation)
DRV:64bit: - (TurboB) – C:\Windows\SysNative\drivers\TurboB.sys ()
DRV:64bit: - (athr) – C:\Windows\SysNative\drivers\athrx.sys (Atheros Communications, Inc.)
DRV:64bit: - (kbfiltr) – C:\Windows\SysNative\drivers\kbfiltr.sys ( )
DRV:64bit: - (amdsbs) – C:\Windows\SysNative\drivers\amdsbs.sys (AMD Technologies Inc.)
DRV:64bit: - (LSI_SAS2) – C:\Windows\SysNative\drivers\lsi_sas2.sys (LSI Corporation)
DRV:64bit: - (stexstor) – C:\Windows\SysNative\drivers\stexstor.sys (Promise Technology)
DRV:64bit: - (WSDPrintDevice) – C:\Windows\SysNative\drivers\WSDPrint.sys (Microsoft Corporation)
DRV:64bit: - (TPM) – C:\Windows\SysNative\drivers\tpm.sys (Microsoft Corporation)
DRV:64bit: - (SiSGbeLH) – C:\Windows\SysNative\drivers\SiSG664.sys (Silicon Integrated Systems Corp.)
DRV:64bit: - (ebdrv) – C:\Windows\SysNative\drivers\evbda.sys (Broadcom Corporation)
DRV:64bit: - (b06bdrv) – C:\Windows\SysNative\drivers\bxvbda.sys (Broadcom Corporation)
DRV:64bit: - (b57nd60a) – C:\Windows\SysNative\drivers\b57nd60a.sys (Broadcom Corporation)
DRV:64bit: - (hcw85cir) – C:\Windows\SysNative\drivers\hcw85cir.sys (Hauppauge Computer Works, Inc.)
DRV:64bit: - (PxHlpa64) – C:\Windows\SysNative\drivers\PxHlpa64.sys (Sonic Solutions)
DRV:64bit: - (WimFltr) – C:\Windows\SysNative\drivers\WimFltr.sys (Microsoft Corporation)
DRV:64bit: - (emAudio) – C:\Windows\SysNative\drivers\emAudio64.sys (eMPIA Technology, Inc.)
DRV:64bit: - (DCamUSBEMPIA) – C:\Windows\SysNative\drivers\emDevice64.sys (eMPIA Technology, Inc.)
DRV:64bit: - (FiltUSBEMPIA) – C:\Windows\SysNative\drivers\emFilter64.sys (eMPIA Technology, Inc.)
DRV:64bit: - (ScanUSBEMPIA) – C:\Windows\SysNative\drivers\emScan64.sys (eMPIA Technology, Inc.)
DRV:64bit: - (MarvinBus) – C:\Windows\SysNative\drivers\MarvinBus64.sys (Pinnacle Systems GmbH)
DRV - (ATKWMIACPIIO) – C:\Program Files (x86)\ASUS\ATK Package\ATK WMIACPI\atkwmiacpi64.sys (ASUS)
DRV - (WIMMount) – C:\Windows\SysWOW64\drivers\wimmount.sys (Microsoft Corporation)
DRV - (ASMMAP64) – C:\Program Files (x86)\ASUS\ATK Package\ATKGFNEX\ASMMAP64.sys (ASUS)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE:64bit: - HKLM\..\SearchScopes,DefaultScope =
IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}…rc=IE-SearchBox
IE:64bit: - HKLM\..\SearchScopes\{9BE31423-EADD-4A53-9854-98AE3D47B026}: "URL" = http://www.ask.com/web?q={searchterms}&l;=dis&o;=ushpl
IE:64bit: - HKLM\..\SearchScopes\{ED0275C3-393C-4615-8D5D-9BEA168DACEB}: "URL" = http://search.yahoo.com/search?p={searchTe…&fr;=hp-pvnb
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://asus.msn.com
IE - HKLM\..\SearchScopes,DefaultScope =
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}…rc=IE-SearchBox

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://www.msn.com/?ocid=iehp
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = en-US
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0A B7 CA 3E 19 EA CD 01 [binary data]
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = http://www.google.com
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com
IE - HKCU\..\URLSearchHook: - No CLSID value found
IE - HKCU\..\SearchScopes,DefaultScope =
IE - HKCU\..\SearchScopes\{44816E91-C68A-2FF3-3D8F-8970062E5600}: "URL" = http://www.bing.com/search?q={searchTerms}…amp;form=ZGAIDF
IE - HKCU\..\SearchScopes\{ED0275C3-393C-4615-8D5D-9BEA168DACEB}: "URL" = http://search.yahoo.com/search?p={searchTe…&fr;=hp-pvnb
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..browser.search.selectedEngine: "Swagbucks"
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "http://us-mg4.mail.yahoo.com/neo/launch?.rand=26gi0q9rci4qq"
FF - prefs.js..extensions.enabledAddons: coralietab%40mozdev.org:2.04.20110724
FF - prefs.js..extensions.enabledAddons: readable%40evernote.com:7.3346.272.999
FF - prefs.js..extensions.enabledAddons: %7B097d3191-e6fa-4728-9826-b533d755359d%7D:0.7.18
FF - prefs.js..extensions.enabledAddons: %7B3e0e7d2a-070f-4a47-b019-91fe5385ba79%7D:3.5.9
FF - prefs.js..extensions.enabledAddons: %7Bb9db16a4-6edc-47ec-a1f4-b86292ed211d%7D:4.9.12
FF - prefs.js..extensions.enabledAddons: %7BE0B8C461-F8FB-49b4-8373-FE32E9252800%7D:5.4
FF - prefs.js..extensions.enabledAddons: %7BDAD0F81A-CF67-4eed-98D6-26F6E47274CA%7D:1.5.5
FF - prefs.js..extensions.enabledAddons: %7B73a6fe31-595d-460b-a920-fcc0f8843232%7D:[removed]
FF - prefs.js..extensions.enabledAddons: %7B972ce4c6-7e08-4474-a285-3208198ce6fd%7D:17.0.1
FF - user.js - File not found

FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_5_502_135.dll File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files\Microsoft Silverlight\5.1.10411.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_5_502_135.dll ()
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.10.2: C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.10.2: C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files (x86)\Microsoft Silverlight\5.1.10411.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3538.0513: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKLM\Software\MozillaPlugins\ZEON/PDF,version=2.0: C:\Program Files (x86)\Nuance\PDF Reader\bin\nppdf.dll (Zeon Corporation)
FF - HKCU\Software\MozillaPlugins\@tightropeinteractive.com/Plugin: C:\Users\Nancy\AppData\Local\TNT2\2.0.0.1378\npTNT2.dll File not found
FF - HKCU\Software\MozillaPlugins\@tnt2ghost.com/Plugin: C:\Users\Nancy\AppData\Local\TNT2\2.0.0.1378\npTNT2ghost.dll File not found
FF - HKCU\Software\MozillaPlugins\@tnt2toolbar.com/Plugin: C:\Users\Nancy\AppData\Local\TNT2\2.0.0.1267\npTNT2.dll File not found
FF - HKCU\Software\MozillaPlugins\amazon.com/AmazonMP3DownloaderPlugin: C:\Program Files (x86)\Amazon\MP3 Downloader\npAmazonMP3DownloaderPlugin1017300.dll (Amazon.com, Inc.)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\extensions\\{22119944-ED35-4ab1-910B-E619EA06A115}: C:\Program Files (x86)\Siber Systems\AI RoboForm\Firefox [2012/12/14 06:34:08 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 17.0.1\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012/12/01 08:34:52 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 17.0.1\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2013/01/04 15:48:10 | 000,000,000 | —D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 17.0.1\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012/12/01 08:34:52 | 000,000,000 | —D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 17.0.1\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2013/01/04 15:48:10 | 000,000,000 | —D | M]

[2012/01/28 13:40:33 | 000,000,000 | —D | M] (No name found) – C:\Users\Nancy\AppData\Roaming\Mozilla\Extensions
[2013/01/04 19:19:05 | 000,000,000 | —D | M] (No name found) – C:\Users\Nancy\AppData\Roaming\Mozilla\Firefox\Profiles\pqxe4c84.default\extensions
[2012/08/28 10:29:36 | 000,000,000 | —D | M] (AddThis) – C:\Users\Nancy\AppData\Roaming\Mozilla\Firefox\Profiles\pqxe4c84.default\extensions\{3e0e7d2a-070f-4a47-b019-91fe5385ba79}
[2012/11/22 05:32:06 | 000,000,000 | —D | M] (DownloadHelper) – C:\Users\Nancy\AppData\Roaming\Mozilla\Firefox\Profiles\pqxe4c84.default\extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}
[2012/10/02 15:51:15 | 000,000,000 | —D | M] (Evernote Web Clipper) – C:\Users\Nancy\AppData\Roaming\Mozilla\Firefox\Profiles\pqxe4c84.default\extensions\{E0B8C461-F8FB-49b4-8373-FE32E9252800}
[2012/01/29 05:41:47 | 000,000,000 | —D | M] (IE Tab +) – C:\Users\Nancy\AppData\Roaming\Mozilla\Firefox\Profiles\pqxe4c84.default\extensions\[removed]
[2012/10/06 12:20:09 | 001,088,515 | —- | M] () (No name found) – C:\Users\Nancy\AppData\Roaming\Mozilla\Firefox\Profiles\pqxe4c84.default\extensions\[removed]
[2012/08/27 06:45:46 | 000,455,379 | —- | M] () (No name found) – C:\Users\Nancy\AppData\Roaming\Mozilla\Firefox\Profiles\pqxe4c84.default\extensions\{097d3191-e6fa-4728-9826-b533d755359d}.xpi
[2012/04/29 07:22:27 | 000,097,169 | —- | M] () (No name found) – C:\Users\Nancy\AppData\Roaming\Mozilla\Firefox\Profiles\pqxe4c84.default\extensions\{3d7eb24f-2740-49df-8937-200b1cc08f8a}.xpi
[2012/12/27 17:34:45 | 000,533,036 | —- | M] () (No name found) – C:\Users\Nancy\AppData\Roaming\Mozilla\Firefox\Profiles\pqxe4c84.default\extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi
[2012/11/30 17:03:28 | 000,014,082 | —- | M] () (No name found) – C:\Users\Nancy\AppData\Roaming\Mozilla\Firefox\Profiles\pqxe4c84.default\extensions\{DAD0F81A-CF67-4eed-98D6-26F6E47274CA}.xpi
[2012/10/27 07:06:24 | 001,070,903 | —- | M] () (No name found) – C:\Users\Nancy\AppData\Roaming\Mozilla\Firefox\Profiles\pqxe4c84.default\extensions\{ff356687-aa08-463d-a46c-11c451824939}.xpi
[2013/01/04 07:07:16 | 000,002,297 | —- | M] () – C:\Users\Nancy\AppData\Roaming\Mozilla\Firefox\Profiles\pqxe4c84.default\searchplugins\swagbucks.xml
[2013/01/03 20:28:56 | 000,000,000 | —D | M] (No name found) – C:\Program Files (x86)\Mozilla Firefox\extensions
[2012/12/01 08:34:52 | 000,262,112 | —- | M] (Mozilla Foundation) – C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll
[2012/02/24 06:15:52 | 000,466,944 | —- | M] (Catalina Marketing Corporation) – C:\Program Files (x86)\mozilla firefox\plugins\NPcol400.dll
[2012/08/30 03:59:07 | 000,002,465 | —- | M] () – C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml
[2012/10/12 13:22:58 | 000,002,058 | —- | M] () – C:\Program Files (x86)\mozilla firefox\searchplugins\twitter.xml

O1 HOSTS File: ([2013/01/03 20:14:42 | 000,000,027 | —- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2:64bit: - BHO: (RoboForm Toolbar Helper) - {724d43a9-0d85-11d4-9908-00400523e39a} - C:\Program Files (x86)\Siber Systems\AI RoboForm\roboform-x64.dll (Siber Systems Inc.)
O2 - BHO: (Spybot-S&D; IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files (x86)\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O2 - BHO: (RoboForm Toolbar Helper) - {724d43a9-0d85-11d4-9908-00400523e39a} - C:\Program Files (x86)\Siber Systems\AI RoboForm\roboform.dll (Siber Systems Inc.)
O2 - BHO: (Java™ Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
O2 - BHO: (Java™ Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O3:64bit: - HKLM\..\Toolbar: (&RoboForm; Toolbar) - {724d43a0-0d85-11d4-9908-00400523e39a} - C:\Program Files (x86)\Siber Systems\AI RoboForm\roboform-x64.dll (Siber Systems Inc.)
O3:64bit: - HKLM\..\Toolbar: (no name) - {D6BAE600-1E87-4E36-9327-03A07808E7ED} - No CLSID value found.
O3:64bit: - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3 - HKLM\..\Toolbar: (&RoboForm; Toolbar) - {724d43a0-0d85-11d4-9908-00400523e39a} - C:\Program Files (x86)\Siber Systems\AI RoboForm\roboform.dll (Siber Systems Inc.)
O3 - HKLM\..\Toolbar: (no name) - {D6BAE600-1E87-4E36-9327-03A07808E7ED} - No CLSID value found.
O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3:64bit: - HKCU\..\Toolbar\WebBrowser: (&RoboForm; Toolbar) - {724D43A0-0D85-11D4-9908-00400523E39A} - C:\Program Files (x86)\Siber Systems\AI RoboForm\roboform-x64.dll (Siber Systems Inc.)
O3 - HKCU\..\Toolbar\WebBrowser: (&RoboForm; Toolbar) - {724D43A0-0D85-11D4-9908-00400523E39A} - C:\Program Files (x86)\Siber Systems\AI RoboForm\roboform.dll (Siber Systems Inc.)
O3:HKU - HKCU\..\Toolbar\WebBrowser: (m OpenOffice.us Search.us.com Toolbar) - {D6BAE600-1E87-4E36-9327-03A07808E7ED} - C:\Users\Nancy\AppData\Local\TNT2\Profiles\10285\passport.dll File not found
O4:64bit: - HKLM..\Run: [AmIcoSinglun64] C:\Program Files (x86)\AmIcoSingLun\AmIcoSinglun64.exe (Alcor Micro Corp.)
O4:64bit: - HKLM..\Run: [BTMTrayAgent] C:\Program Files (x86)\Intel\Bluetooth\btmshell.dll (Intel Corporation)
O4:64bit: - HKLM..\Run: [ETDCtrl] C:\Program Files\Elantech\ETDCtrl.exe (ELAN Microelectronics Corp.)
O4:64bit: - HKLM..\Run: [HotKeysCmds] C:\Windows\SysNative\hkcmd.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [IgfxTray] C:\Windows\SysNative\igfxtray.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [IntelPAN] C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe (Intel® Corporation)
O4:64bit: - HKLM..\Run: [IntelTBRunOnce] wscript.exe //b //nologo "C:\Program Files\Intel\TurboBoost\RunTBGadgetOnce.vbs" File not found
O4:64bit: - HKLM..\Run: [lxdxamon] C:\Program Files (x86)\Lexmark 3600-4600 Series\lxdxamon.exe ()
O4:64bit: - HKLM..\Run: [lxdxmon.exe] C:\Program Files (x86)\Lexmark 3600-4600 Series\lxdxmon.exe ()
O4:64bit: - HKLM..\Run: [MSC] C:\Program Files\Microsoft Security Client\msseces.exe (Microsoft Corporation)
O4:64bit: - HKLM..\Run: [Persistence] C:\Windows\SysNative\igfxpers.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [RtHDVBg] C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe (Realtek Semiconductor)
O4 - HKLM..\Run: [APSDaemon] C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
O4 - HKLM..\Run: [ASUSPRP] C:\Program Files (x86)\ASUS\APRP\APRP.EXE (ASUSTek Computer Inc.)
O4 - HKLM..\Run: [ASUSWebStorage] C:\Program Files (x86)\ASUS\ASUS WebStorage\3.0.108.222\AsusWSPanel.exe (ecareme)
O4 - HKLM..\Run: [ATKMEDIA] C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe (ASUS)
O4 - HKLM..\Run: [ATKOSD2] C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe (ASUS)
O4 - HKLM..\Run: [FLxHCIm] C:\Program Files\Fresco Logic Inc\Fresco Logic USB3.0 Host Controller\host\FLxHCIm.exe (Windows ® Win 7 DDK provider)
O4 - HKLM..\Run: [HControlUser] C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControlUser.exe (ASUS)
O4 - HKLM..\Run: [Nuance PDF Reader-reminder] C:\Program Files (x86)\Nuance\PDF Reader\Ereg\Ereg.exe (Nuance Communications, Inc.)
O4 - HKLM..\Run: [PCLEUSBTip] C:\Program Files (x86)\Pinnacle\Shared Files\Programs\USBTip\USBTip.exe (Pinnacle Systems GmbH)
O4 - HKLM..\Run: [SonicMasterTray] C:\Program Files (x86)\ASUS\Sonic Focus\SonicFocusTray.exe (Virage Logic Corporation / Sonic Focus)
O4 - HKLM..\Run: [StopDefragment] Install\StopDefragment.exe File not found
O4 - HKLM..\Run: [USBToolTip] C:\Program Files (x86)\Pinnacle\Shared Files\Programs\USBTip\USBTip.exe (Pinnacle Systems GmbH)
O4 - HKLM..\Run: [Wireless Console 3] C:\Program Files (x86)\ASUS\Wireless Console 3\wcourier.exe (ASUS)
O4 - HKCU..\Run: [DW7] C:\Program Files (x86)\The Weather Channel\The Weather Channel App\TWCApp.exe (The Weather Channel)
O4 - HKCU..\Run: [LaunchList] C:\Program Files (x86)\Pinnacle\Studio 11\LaunchList2.exe (Pinnacle Systems)
O4 - HKCU..\Run: [PhotoshopElements8SyncAgent] C:\Program Files (x86)\Adobe\Elements Organizer 8.0\ElementsOrganizerSyncAgent.exe (Adobe Systems Incorporated)
O4 - HKCU..\Run: [RoboForm] C:\Program Files (x86)\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe (Siber Systems)
O4 - HKCU..\Run: [Weather] C:\Program Files (x86)\AWS\WeatherBug\Weather.exe (AWS Convergence Technologies, Inc.)
O4 - Startup: C:\Users\Nancy\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\EvernoteClipper.lnk = C:\Program Files (x86)\Evernote\Evernote\EvernoteClipper.exe (Evernote Corp., 333 W Evelyn Ave. Mountain View, CA 94041)
O4 - Startup: C:\Users\Nancy\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.1.lnk = C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe ()
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Activities present
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O8:64bit: - Extra context menu item: Add to Evernote 4.0 - C:\Program Files (x86)\Evernote\Evernote\EvernoteIE.dll (Evernote Corp., 333 W Evelyn Ave. Mountain View, CA 94041)
O8:64bit: - Extra context menu item: Customize Menu - C:\Program Files (x86)\Siber Systems\AI RoboForm\RoboFormComCustomizeIEMenu.html ()
O8:64bit: - Extra context menu item: Fill Forms - C:\Program Files (x86)\Siber Systems\AI RoboForm\RoboFormComFillForms.html ()
O8:64bit: - Extra context menu item: Save Forms - C:\Program Files (x86)\Siber Systems\AI RoboForm\RoboFormComSavePass.html ()
O8:64bit: - Extra context menu item: Show RoboForm Toolbar - C:\Program Files (x86)\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html ()
O8 - Extra context menu item: Add to Evernote 4.0 - C:\Program Files (x86)\Evernote\Evernote\EvernoteIE.dll (Evernote Corp., 333 W Evelyn Ave. Mountain View, CA 94041)
O8 - Extra context menu item: Customize Menu - C:\Program Files (x86)\Siber Systems\AI RoboForm\RoboFormComCustomizeIEMenu.html ()
O8 - Extra context menu item: Fill Forms - C:\Program Files (x86)\Siber Systems\AI RoboForm\RoboFormComFillForms.html ()
O8 - Extra context menu item: Save Forms - C:\Program Files (x86)\Siber Systems\AI RoboForm\RoboFormComSavePass.html ()
O8 - Extra context menu item: Show RoboForm Toolbar - C:\Program Files (x86)\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html ()
O9:64bit: - Extra Button: Fill Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - C:\Program Files (x86)\Siber Systems\AI RoboForm\roboform-x64.dll (Siber Systems Inc.)
O9:64bit: - Extra 'Tools' menuitem : Fill Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - C:\Program Files (x86)\Siber Systems\AI RoboForm\roboform-x64.dll (Siber Systems Inc.)
O9:64bit: - Extra Button: Save - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - C:\Program Files (x86)\Siber Systems\AI RoboForm\roboform-x64.dll (Siber Systems Inc.)
O9:64bit: - Extra 'Tools' menuitem : Save Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - C:\Program Files (x86)\Siber Systems\AI RoboForm\roboform-x64.dll (Siber Systems Inc.)
O9:64bit: - Extra Button: Show Toolbar - {724d43aa-0d85-11d4-9908-00400523e39a} - C:\Program Files (x86)\Siber Systems\AI RoboForm\roboform-x64.dll (Siber Systems Inc.)
O9:64bit: - Extra 'Tools' menuitem : Show RoboForm Toolbar - {724d43aa-0d85-11d4-9908-00400523e39a} - C:\Program Files (x86)\Siber Systems\AI RoboForm\roboform-x64.dll (Siber Systems Inc.)
O9 - Extra Button: Fill Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - C:\Program Files (x86)\Siber Systems\AI RoboForm\roboform.dll (Siber Systems Inc.)
O9 - Extra 'Tools' menuitem : Fill Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - C:\Program Files (x86)\Siber Systems\AI RoboForm\roboform.dll (Siber Systems Inc.)
O9 - Extra Button: Save - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - C:\Program Files (x86)\Siber Systems\AI RoboForm\roboform.dll (Siber Systems Inc.)
O9 - Extra 'Tools' menuitem : Save Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - C:\Program Files (x86)\Siber Systems\AI RoboForm\roboform.dll (Siber Systems Inc.)
O9 - Extra Button: Show Toolbar - {724d43aa-0d85-11d4-9908-00400523e39a} - C:\Program Files (x86)\Siber Systems\AI RoboForm\roboform.dll (Siber Systems Inc.)
O9 - Extra 'Tools' menuitem : Show RoboForm Toolbar - {724d43aa-0d85-11d4-9908-00400523e39a} - C:\Program Files (x86)\Siber Systems\AI RoboForm\roboform.dll (Siber Systems Inc.)
O9 - Extra Button: @C:\Program Files (x86)\Evernote\Evernote\Resource.dll,-101 - {A95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\Program Files (x86)\Evernote\Evernote\EvernoteIE.dll (Evernote Corp., 333 W Evelyn Ave. Mountain View, CA 94041)
O9 - Extra 'Tools' menuitem : @C:\Program Files (x86)\Evernote\Evernote\Resource.dll,-101 - {A95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\Program Files (x86)\Evernote\Evernote\EvernoteIE.dll (Evernote Corp., 333 W Evelyn Ave. Mountain View, CA 94041)
O9 - Extra 'Tools' menuitem : Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files (x86)\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000010 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000010 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)
O13 - gopher Prefix: missing
O15 - HKCU\..Trusted Domains: //@surf.mar@/ ([]money in Local intranet)
O15 - HKCU\..Trusted Ranges: Range1 ([http] in Local intranet)
O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} http://download.eset.com/special/eos/OnlineScanner.cab (OnlineScanner Control)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 10.0.1.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{4B10D4B1-8C84-4010-A352-FE33362F94A0}: DhcpNameServer = [removed] [removed]
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{EC8CE5CB-D60E-49FD-8771-2F4F07E11AC3}: DhcpNameServer = 10.0.1.1
O18:64bit: - Protocol\Handler\livecall - No CLSID value found
O18:64bit: - Protocol\Handler\msnim - No CLSID value found
O18:64bit: - Protocol\Handler\wlmailhtml - No CLSID value found
O18:64bit: - Protocol\Handler\wlpg - No CLSID value found
O20:64bit: - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysWOW64\userinit.exe (Microsoft Corporation)
O20:64bit: - Winlogon\Notify\igfxcui: DllName - (igfxdev.dll) - C:\Windows\SysNative\igfxdev.dll (Intel Corporation)
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2013/01/01 08:08:48 | 000,000,108 | —- | M] () - C:\AUTOEXEC.BAT – [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35:64bit: - HKLM\..comfile [open] – "%1" %*
O35:64bit: - HKLM\..exefile [open] – "%1" %*
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37:64bit: - HKLM\…com [@ = ComFile] – "%1" %*
O37:64bit: - HKLM\…exe [@ = exefile] – "%1" %*
O37 - HKLM\…com [@ = ComFile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)

========== Files/Folders - Created Within 30 Days ==========

[2013/01/04 16:02:33 | 000,000,000 | —D | C] – C:\Program Files (x86)\ESET
[2013/01/04 15:51:27 | 000,000,000 | —D | C] – C:\Program Files (x86)\Common Files\Java
[2013/01/04 15:51:12 | 000,260,528 | —- | C] (Oracle Corporation) – C:\Windows\SysWow64\javaws.exe
[2013/01/04 15:50:56 | 000,174,000 | —- | C] (Oracle Corporation) – C:\Windows\SysWow64\javaw.exe
[2013/01/04 15:50:56 | 000,173,992 | —- | C] (Oracle Corporation) – C:\Windows\SysWow64\java.exe
[2013/01/04 15:50:56 | 000,095,184 | —- | C] (Oracle Corporation) – C:\Windows\SysWow64\WindowsAccessBridge-32.dll
[2013/01/04 12:32:15 | 000,000,000 | —D | C] – C:\_OTL
[2013/01/03 20:25:37 | 000,000,000 | -HSD | C] – C:\$RECYCLE.BIN
[2013/01/03 20:23:12 | 000,000,000 | —D | C] – C:\Windows\ERUNT
[2013/01/03 20:23:06 | 000,000,000 | —D | C] – C:\JRT
[2013/01/03 20:14:41 | 000,000,000 | —D | C] – C:\Windows\temp
[2013/01/03 20:10:43 | 000,000,000 | —D | C] – C:\ComboFix
[2013/01/03 20:10:20 | 005,018,515 | R— | C] (Swearware) – C:\Users\Nancy\Desktop\ComboFix.exe
[2013/01/03 19:53:35 | 000,000,000 | —D | C] – C:\Users\Nancy\Desktop\ComboFix
[2013/01/03 16:15:15 | 000,518,144 | —- | C] (SteelWerX) – C:\Windows\SWREG.exe
[2013/01/03 16:15:15 | 000,406,528 | —- | C] (SteelWerX) – C:\Windows\SWSC.exe
[2013/01/03 16:15:15 | 000,060,416 | —- | C] (NirSoft) – C:\Windows\NIRCMD.exe
[2013/01/03 16:14:40 | 000,000,000 | —D | C] – C:\Qoobox
[2013/01/03 16:14:23 | 000,000,000 | —D | C] – C:\Windows\erdnt
[2013/01/01 09:00:22 | 000,000,000 | —D | C] – C:\Users\Nancy\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Pinnacle Instant DVD Recorder
[2013/01/01 09:00:09 | 000,000,000 | —D | C] – C:\Users\Nancy\AppData\Roaming\InstallShield Installation Information
[2013/01/01 08:10:23 | 000,000,000 | —D | C] – C:\Users\Nancy\Documents\Pinnacle Studio
[2012/12/31 21:07:27 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Pinnacle Hollywood FX 6.0 for Studio 11
[2012/12/31 21:02:40 | 000,000,000 | —D | C] – C:\Users\Public\Documents\Pinnacle Studio
[2012/12/31 21:02:40 | 000,000,000 | —D | C] – C:\Users\Public\Documents\Pinnacle
[2012/12/31 20:37:58 | 000,000,000 | —D | C] – C:\Studio Plus Vista Installer
[2012/12/31 13:50:20 | 000,000,000 | —D | C] – C:\Users\Nancy\Documents\Pinnacle
[2012/12/31 13:27:14 | 000,000,000 | —D | C] – C:\Users\Nancy\AppData\Roaming\MOVAVI
[2012/12/31 12:10:16 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Pinnacle Instant DVD Recorder
[2012/12/31 11:41:46 | 000,000,000 | —D | C] – C:\Program Files (x86)\MSXML 4.0
[2012/12/31 11:22:34 | 000,000,000 | —D | C] – C:\Users\Nancy\AppData\Local\Programs
[2012/12/31 10:05:42 | 000,000,000 | —D | C] – C:\Windows\Minidump
[2012/12/30 09:21:59 | 000,000,000 | —D | C] – C:\Users\Nancy\Documents\Instant DVD Recorder
[2012/12/30 09:00:24 | 014,326,712 | —- | C] (Pinnacle Systems ) – C:\Windows\SysWow64\drivers\Pinnacle_Video_Driver_32bit.exe
[2012/12/30 09:00:24 | 011,878,776 | —- | C] (Pinnacle Systems ) – C:\Windows\SysWow64\drivers\Pinnacle_Video_Driver_64bit.exe
[2012/12/30 09:00:24 | 000,000,000 | —D | C] – C:\Windows\SysWow64\InstantDVDRecorder
[2012/12/30 08:49:40 | 000,000,000 | —D | C] – C:\temp
[2012/12/30 08:24:34 | 000,401,408 | —- | C] (Pegasus Imaging Corporation) – C:\Windows\SysWow64\pvmjpg30.dll
[2012/12/30 08:24:33 | 000,082,432 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\msxml4r.dll
[2012/12/30 08:24:33 | 000,044,544 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\msxml4a.dll
[2012/12/30 08:24:32 | 001,712,128 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\GDIPLUS.DLL
[2012/12/30 08:20:30 | 000,000,000 | —D | C] – C:\Users\Nancy\My Documents
[2012/12/30 08:20:29 | 000,000,000 | —D | C] – C:\Users\Nancy\Documents\My Projects
[2012/12/30 08:19:16 | 000,000,000 | —D | C] – C:\Users\Public\Documents\My Projects
[2012/12/30 08:17:52 | 000,014,165 | —- | C] (Pinnacle Systems GmbH) – C:\Windows\SysWow64\drivers\Pclepci.sys
[2012/12/30 08:17:47 | 000,041,219 | —- | C] (Pinnacle Systems) – C:\Windows\RSETPATH.exe
[2012/12/30 08:17:08 | 001,047,552 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\MFC71u.DLL
[2012/12/30 08:17:08 | 000,974,848 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\MFC70.DLL
[2012/12/30 08:17:08 | 000,964,608 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\MFC70U.DLL
[2012/12/30 08:17:08 | 000,065,536 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\MFC71DEU.DLL
[2012/12/30 08:17:08 | 000,061,440 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\MFC71ITA.DLL
[2012/12/30 08:17:08 | 000,061,440 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\MFC71FRA.DLL
[2012/12/30 08:17:08 | 000,061,440 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\MFC71ESP.DLL
[2012/12/30 08:17:08 | 000,057,344 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\MFC71ENU.DLL
[2012/12/30 08:17:08 | 000,054,784 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\MSVCI70.DLL
[2012/12/30 08:17:08 | 000,049,152 | —- | C] (Pinnacle Systems) – C:\Windows\SysWow64\PCLEGetGuid.dll
[2012/12/30 08:17:08 | 000,049,152 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\MFC71KOR.DLL
[2012/12/30 08:17:08 | 000,049,152 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\MFC71JPN.DLL
[2012/12/30 08:17:08 | 000,045,056 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\MFC71CHT.DLL
[2012/12/30 08:17:08 | 000,040,960 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\MFC71CHS.DLL
[2012/12/30 08:16:27 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Studio 11
[2012/12/30 08:16:14 | 000,000,000 | —D | C] – C:\ProgramData\Pinnacle Studio
[2012/12/29 14:24:32 | 000,070,656 | —- | C] (Pinnacle Systems) – C:\Windows\SysNative\PCLECoInst64.dll
[2012/12/29 14:24:31 | 000,215,808 | —- | C] (eMPIA Technology, Inc.) – C:\Windows\SysNative\drivers\emDevice64.sys
[2012/12/29 14:24:31 | 000,057,344 | —- | C] (eMPIA Technology, Inc.) – C:\Windows\SysWow64\emVFW.dll
[2012/12/29 14:24:31 | 000,032,768 | —- | C] (eMPIA Technology, Inc.) – C:\Windows\SysWow64\emProp.ax
[2012/12/29 14:24:31 | 000,017,808 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\emYUV.dll
[2012/12/29 14:24:31 | 000,013,824 | —- | C] (eMPIA Technology, Inc.) – C:\Windows\SysNative\emUSD64.dll
[2012/12/29 14:24:31 | 000,006,400 | —- | C] (eMPIA Technology, Inc.) – C:\Windows\SysNative\drivers\emFilter64.sys
[2012/12/29 14:24:31 | 000,006,144 | —- | C] (eMPIA Technology, Inc.) – C:\Windows\SysNative\drivers\emScan64.sys
[2012/12/29 14:24:28 | 000,079,872 | —- | C] (eMPIA Technology, Inc.) – C:\Windows\SysNative\drivers\emAudio64.sys
[2012/12/29 14:24:03 | 000,000,000 | —D | C] – C:\Program Files (x86)\Common Files\Pinnacle
[2012/12/29 14:23:15 | 000,000,000 | —D | C] – C:\Users\Nancy\AppData\Local\Downloaded Installations
[2012/12/29 11:59:07 | 000,000,000 | —D | C] – C:\Users\Nancy\AppData\Local\Pinnacle
[2012/12/29 11:53:03 | 000,233,472 | —- | C] (Pinnacle Systems GmbH) – C:\Windows\SysWow64\DiskIO.dll
[2012/12/29 11:53:03 | 000,184,320 | —- | C] (Pinnacle Systems GmbH) – C:\Windows\SysWow64\RALMain.dll
[2012/12/29 11:53:03 | 000,126,976 | —- | C] (Pinnacle Systems GmbH) – C:\Windows\SysWow64\AVIPrAx.dll
[2012/12/29 11:53:03 | 000,073,728 | —- | C] (Pinnacle Systems GmbH) – C:\Windows\SysWow64\MMAviAx.dll
[2012/12/29 11:53:03 | 000,041,984 | —- | C] (Pinnacle Systems GmbH) – C:\Windows\SysWow64\cacheX.dll
[2012/12/29 11:53:03 | 000,032,768 | —- | C] (Pinnacle Systems GmbH) – C:\Windows\SysWow64\MLPagAx.dll
[2012/12/29 11:50:25 | 001,013,248 | —- | C] (LEAD Technologies, Inc.) – C:\Windows\SysWow64\Ltwvc13n.dll
[2012/12/29 11:50:25 | 000,930,992 | —- | C] (LEAD Technologies, Inc.) – C:\Windows\SysWow64\Ltr13n.dll
[2012/12/29 11:50:25 | 000,453,120 | —- | C] (LEAD Technologies, Inc.) – C:\Windows\SysWow64\ltkrn13n.dll
[2012/12/29 11:50:25 | 000,306,352 | —- | C] (LEAD Technologies, Inc.) – C:\Windows\SysWow64\Ltrio13n.dll
[2012/12/29 11:50:25 | 000,153,088 | —- | C] (LEAD Technologies, Inc.) – C:\Windows\SysWow64\ltfil13n.DLL
[2012/12/29 11:50:24 | 002,079,232 | —- | C] (LEAD Technologies, Inc.) – C:\Windows\SysWow64\LTCLR13s.dll
[2012/12/29 11:50:24 | 001,693,696 | —- | C] (LEAD Technologies, Inc.) – C:\Windows\SysWow64\LTCLR13n.dll
[2012/12/29 11:50:24 | 000,884,736 | —- | C] (Fellowes, Inc.) – C:\Windows\SysWow64\LMUIRes.dll
[2012/12/29 11:50:24 | 000,409,600 | —- | C] (LEAD Technologies, Inc.) – C:\Windows\SysWow64\LFCMP13s.DLL
[2012/12/29 11:50:24 | 000,393,216 | —- | C] (LEAD Technologies, Inc.) – C:\Windows\SysWow64\LFCMP13n.DLL
[2012/12/29 11:50:24 | 000,110,080 | —- | C] (LEAD Technologies, Inc.) – C:\Windows\SysWow64\lfpsd13s.dll
[2012/12/29 11:50:24 | 000,064,512 | —- | C] (LEAD Technologies, Inc.) – C:\Windows\SysWow64\lftga13s.dll
[2012/12/29 11:50:24 | 000,024,576 | —- | C] (LEAD Technologies, Inc.) – C:\Windows\SysWow64\lftga13n.dll
[2012/12/29 11:50:24 | 000,012,288 | —- | C] (Fellowes, Inc.) – C:\Windows\SysWow64\LMLRes.dll
[2012/12/29 11:50:22 | 000,070,144 | —- | C] (LEAD Technologies, Inc.) – C:\Windows\SysWow64\lfbmp13s.dll
[2012/12/29 11:50:22 | 000,030,208 | —- | C] (LEAD Technologies, Inc.) – C:\Windows\SysWow64\lfbmp13n.dll
[2012/12/29 11:50:05 | 001,060,864 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\MFC71.DLL
[2012/12/29 11:49:59 | 000,487,424 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\MSVCP70.DLL
[2012/12/29 11:49:58 | 000,344,064 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\MSVCR70.DLL
[2012/12/29 11:49:58 | 000,089,088 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\atl71.dll
[2012/12/29 11:49:58 | 000,084,992 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\ATL70.DLL
[2012/12/29 11:48:33 | 000,000,000 | —D | C] – C:\ProgramData\Pinnacle
[2012/12/29 11:48:30 | 000,000,000 | —D | C] – C:\Program Files (x86)\Pinnacle
[2012/12/29 11:47:45 | 000,000,000 | —D | C] – C:\Users\Nancy\AppData\Roaming\InstallShield
[2012/12/27 10:53:21 | 000,000,000 | —D | C] – C:\Users\Nancy\Documents\Red Kawa
[2012/12/27 09:49:52 | 000,000,000 | —D | C] – C:\Users\Nancy\AppData\Local\Geckofx
[2012/12/27 09:49:39 | 000,000,000 | —D | C] – C:\Users\Nancy\Documents\Regensoft
[2012/12/27 09:49:39 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Regensoft
[2012/12/27 09:49:39 | 000,000,000 | —D | C] – C:\Program Files (x86)\Regensoft
[2012/12/27 09:49:37 | 000,000,000 | —D | C] – C:\Users\Nancy\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\AviSynth 2.5
[2012/12/27 09:49:36 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AviSynth 2.5
[2012/12/27 09:49:36 | 000,000,000 | —D | C] – C:\Program Files (x86)\AviSynth 2.5
[2012/12/27 09:49:30 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Red Kawa
[2012/12/27 08:40:12 | 000,000,000 | —D | C] – C:\Users\Nancy\AppData\Local\{5BEE5DF1-E1B2-4221-8EA6-8FB65E6CD25A}
[2012/12/24 05:40:35 | 000,034,304 | —- | C] (Adobe Systems) – C:\Windows\SysWow64\atmlib.dll
[2012/12/24 05:40:34 | 000,046,080 | —- | C] (Adobe Systems) – C:\Windows\SysNative\atmlib.dll
[2012/12/24 05:40:31 | 000,367,616 | —- | C] (Adobe Systems Incorporated) – C:\Windows\SysNative\atmfd.dll
[2012/12/24 05:40:28 | 000,295,424 | —- | C] (Adobe Systems Incorporated) – C:\Windows\SysWow64\atmfd.dll
[2012/12/18 07:32:08 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes
[2012/12/18 07:31:33 | 000,000,000 | —D | C] – C:\Program Files\iPod
[2012/12/18 07:31:30 | 000,000,000 | —D | C] – C:\Program Files\iTunes
[2012/12/18 07:31:30 | 000,000,000 | —D | C] – C:\Program Files (x86)\iTunes
[2012/12/18 07:31:30 | 000,000,000 | —D | C] – C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69
[2012/12/12 08:19:59 | 000,096,768 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\mshtmled.dll
[2012/12/12 08:19:59 | 000,073,216 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\mshtmled.dll
[2012/12/12 08:19:58 | 000,176,640 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\ieui.dll
[2012/12/12 08:19:57 | 000,248,320 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\ieui.dll
[2012/12/12 08:19:57 | 000,237,056 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\url.dll
[2012/12/12 08:19:57 | 000,231,936 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\url.dll
[2012/12/12 08:19:57 | 000,173,056 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\ieUnatt.exe
[2012/12/12 08:19:57 | 000,142,848 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\ieUnatt.exe
[2012/12/12 08:19:55 | 002,312,704 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\jscript9.dll
[2012/12/12 08:19:55 | 001,494,528 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\inetcpl.cpl
[2012/12/12 08:19:55 | 001,427,968 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\inetcpl.cpl
[2012/12/12 08:19:55 | 000,729,088 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\msfeeds.dll
[2012/12/12 08:19:54 | 000,816,640 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\jscript.dll
[2012/12/12 08:19:54 | 000,717,824 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\jscript.dll
[2012/12/12 08:19:54 | 000,599,040 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\vbscript.dll
[2012/12/12 06:16:57 | 001,161,216 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\kernel32.dll
[2012/12/12 06:16:57 | 000,424,960 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\KernelBase.dll
[2012/12/12 06:16:57 | 000,338,432 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\conhost.exe
[2012/12/12 06:16:57 | 000,215,040 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\winsrv.dll
[2012/12/12 06:16:55 | 000,362,496 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\wow64win.dll
[2012/12/12 06:16:55 | 000,243,200 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\wow64.dll
[2012/12/12 06:16:55 | 000,025,600 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\setup16.exe
[2012/12/12 06:16:55 | 000,016,384 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\ntvdm64.dll
[2012/12/12 06:16:55 | 000,014,336 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\ntvdm64.dll
[2012/12/12 06:16:55 | 000,013,312 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\wow64cpu.dll
[2012/12/12 06:16:55 | 000,005,120 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\wow32.dll
[2012/12/12 06:16:54 | 000,007,680 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\instnm.exe
[2012/12/12 06:16:54 | 000,006,144 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-security-base-l1-1-0.dll
[2012/12/12 06:16:54 | 000,005,120 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-file-l1-1-0.dll
[2012/12/12 06:16:54 | 000,005,120 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-file-l1-1-0.dll
[2012/12/12 06:16:54 | 000,004,608 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-processthreads-l1-1-0.dll
[2012/12/12 06:16:54 | 000,004,096 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-sysinfo-l1-1-0.dll
[2012/12/12 06:16:54 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-heap-l1-1-0.dll
[2012/12/12 06:16:54 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-xstate-l1-1-0.dll
[2012/12/12 06:16:54 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-util-l1-1-0.dll
[2012/12/12 06:16:53 | 000,004,608 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-threadpool-l1-1-0.dll
[2012/12/12 06:16:53 | 000,004,608 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-processthreads-l1-1-0.dll
[2012/12/12 06:16:53 | 000,004,096 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-sysinfo-l1-1-0.dll
[2012/12/12 06:16:53 | 000,004,096 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-synch-l1-1-0.dll
[2012/12/12 06:16:53 | 000,004,096 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-misc-l1-1-0.dll
[2012/12/12 06:16:53 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-rtlsupport-l1-1-0.dll
[2012/12/12 06:16:53 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-processenvironment-l1-1-0.dll
[2012/12/12 06:16:53 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-processenvironment-l1-1-0.dll
[2012/12/12 06:16:53 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-namedpipe-l1-1-0.dll
[2012/12/12 06:16:53 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-namedpipe-l1-1-0.dll
[2012/12/12 06:16:53 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-misc-l1-1-0.dll
[2012/12/12 06:16:53 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-memory-l1-1-0.dll
[2012/12/12 06:16:53 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-memory-l1-1-0.dll
[2012/12/12 06:16:53 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-string-l1-1-0.dll
[2012/12/12 06:16:53 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-string-l1-1-0.dll
[2012/12/12 06:16:53 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-rtlsupport-l1-1-0.dll
[2012/12/12 06:16:53 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-profile-l1-1-0.dll
[2012/12/12 06:16:53 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-profile-l1-1-0.dll
[2012/12/12 06:16:52 | 000,006,144 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-security-base-l1-1-0.dll
[2012/12/12 06:16:52 | 000,004,608 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-threadpool-l1-1-0.dll
[2012/12/12 06:16:52 | 000,004,096 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-synch-l1-1-0.dll
[2012/12/12 06:16:52 | 000,004,096 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-localregistry-l1-1-0.dll
[2012/12/12 06:16:52 | 000,004,096 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-localregistry-l1-1-0.dll
[2012/12/12 06:16:52 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-xstate-l1-1-0.dll
[2012/12/12 06:16:52 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-libraryloader-l1-1-0.dll
[2012/12/12 06:16:52 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-libraryloader-l1-1-0.dll
[2012/12/12 06:16:52 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-interlocked-l1-1-0.dll
[2012/12/12 06:16:52 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-heap-l1-1-0.dll
[2012/12/12 06:16:52 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-util-l1-1-0.dll
[2012/12/12 06:16:52 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-io-l1-1-0.dll
[2012/12/12 06:16:52 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-io-l1-1-0.dll
[2012/12/12 06:16:52 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-interlocked-l1-1-0.dll
[2012/12/12 06:16:52 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-handle-l1-1-0.dll
[2012/12/12 06:16:52 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-handle-l1-1-0.dll
[2012/12/12 06:16:52 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-fibers-l1-1-0.dll
[2012/12/12 06:16:52 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-fibers-l1-1-0.dll
[2012/12/12 06:16:52 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-errorhandling-l1-1-0.dll
[2012/12/12 06:16:52 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-errorhandling-l1-1-0.dll
[2012/12/12 06:16:52 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-delayload-l1-1-0.dll
[2012/12/12 06:16:52 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-delayload-l1-1-0.dll
[2012/12/12 06:16:52 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-debug-l1-1-0.dll
[2012/12/12 06:16:52 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-debug-l1-1-0.dll
[2012/12/12 06:16:52 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-datetime-l1-1-0.dll
[2012/12/12 06:16:52 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-datetime-l1-1-0.dll
[2012/12/12 06:16:51 | 000,004,096 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-localization-l1-1-0.dll
[2012/12/12 06:16:51 | 000,004,096 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-localization-l1-1-0.dll
[2012/12/12 06:16:51 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-console-l1-1-0.dll
[2012/12/12 06:16:51 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-console-l1-1-0.dll
[2012/12/12 06:16:48 | 000,002,048 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\user.exe
[2012/12/12 06:16:34 | 000,478,208 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\dpnet.dll
[2012/12/12 06:16:34 | 000,376,832 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\dpnet.dll
[2012/12/08 07:39:52 | 000,000,000 | —D | C] – C:\Users\Nancy\AppData\Local\{62530663-E778-4D94-9DFA-237FE2EAC0BB}
[2011/03/24 06:24:10 | 000,093,184 | —- | C] (Microsoft Corporation) – C:\Users\Nancy\CARDFILE.EXE

========== Files - Modified Within 30 Days ==========

[2013/01/04 19:35:52 | 000,009,920 | -H– | M] () – C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2013/01/04 19:35:52 | 000,009,920 | -H– | M] () – C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2013/01/04 19:32:58 | 000,807,600 | —- | M] () – C:\Windows\SysNative\PerfStringBackup.INI
[2013/01/04 19:32:58 | 000,680,644 | —- | M] () – C:\Windows\SysNative\perfh009.dat
[2013/01/04 19:32:58 | 000,129,138 | —- | M] () – C:\Windows\SysNative\perfc009.dat
[2013/01/04 19:27:47 | 000,067,584 | –S- | M] () – C:\Windows\bootstat.dat
[2013/01/04 19:27:00 | 2077,298,687 | -HS- | M] () – C:\hiberfil.sys
[2013/01/04 19:21:12 | 000,045,056 | —- | M] () – C:\Windows\SysNative\acovcnt.exe
[2013/01/04 19:18:22 | 000,000,830 | —- | M] () – C:\Windows\tasks\Adobe Flash Player Updater.job
[2013/01/04 15:50:47 | 000,095,184 | —- | M] (Oracle Corporation) – C:\Windows\SysWow64\WindowsAccessBridge-32.dll
[2013/01/04 15:50:45 | 000,260,528 | —- | M] (Oracle Corporation) – C:\Windows\SysWow64\javaws.exe
[2013/01/04 15:50:45 | 000,174,000 | —- | M] (Oracle Corporation) – C:\Windows\SysWow64\javaw.exe
[2013/01/04 15:50:44 | 000,173,992 | —- | M] (Oracle Corporation) – C:\Windows\SysWow64\java.exe
[2013/01/04 15:50:43 | 000,779,704 | —- | M] (Oracle Corporation) – C:\Windows\SysWow64\deployJava1.dll
[2013/01/04 12:36:14 | 000,002,566 | —- | M] () – C:\Windows\SysNative\AutoRunFilter.ini
[2013/01/04 12:36:02 | 000,001,565 | —- | M] () – C:\Windows\SysNative\ServiceFilter.ini
[2013/01/04 08:00:55 | 000,002,021 | —- | M] () – C:\Users\Public\Desktop\Adobe Reader XI.lnk
[2013/01/03 20:14:42 | 000,000,027 | —- | M] () – C:\Windows\SysNative\drivers\etc\hosts
[2013/01/03 14:31:58 | 005,018,515 | R— | M] (Swearware) – C:\Users\Nancy\Desktop\ComboFix.exe
[2013/01/02 06:35:26 | 001,151,360 | —- | M] () – C:\Windows\SysNative\FNTCACHE.DAT
[2013/01/01 14:42:08 | 000,000,349 | —- | M] () – C:\Users\Public\Documents\PCLECHAL.INI
[2013/01/01 08:09:42 | 000,002,056 | —- | M] () – C:\Users\Public\Desktop\Studio.lnk
[2013/01/01 08:08:48 | 000,000,108 | —- | M] () – C:\AUTOEXEC.BAT
[2012/12/31 13:27:10 | 000,005,116 | —- | M] () – C:\ProgramData\xgneqrwu.hrx
[2012/12/31 11:22:58 | 000,001,115 | —- | M] () – C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2012/12/31 10:05:24 | 723,116,076 | —- | M] () – C:\Windows\MEMORY.DMP
[2012/12/28 12:07:02 | 408,402,406 | —- | M] () – C:\Users\Nancy\Documents\John Denver Japan.mp4
[2012/12/27 09:49:39 | 000,002,156 | —- | M] () – C:\Users\Public\Desktop\YouTube Downloader App.lnk
[2012/12/27 09:49:30 | 000,002,212 | —- | M] () – C:\Users\Public\Desktop\Videora iPod Converter.lnk
[2012/12/19 09:26:39 | 000,444,933 | R— | M] () – C:\Windows\SysNative\drivers\etc\hosts.20121231-112443.backup
[2012/12/18 07:32:09 | 000,001,785 | —- | M] () – C:\Users\Public\Desktop\iTunes.lnk
[2012/12/16 12:11:22 | 000,046,080 | —- | M] (Adobe Systems) – C:\Windows\SysNative\atmlib.dll
[2012/12/16 09:45:03 | 000,367,616 | —- | M] (Adobe Systems Incorporated) – C:\Windows\SysNative\atmfd.dll
[2012/12/16 09:13:28 | 000,295,424 | —- | M] (Adobe Systems Incorporated) – C:\Windows\SysWow64\atmfd.dll
[2012/12/16 09:13:20 | 000,034,304 | —- | M] (Adobe Systems) – C:\Windows\SysWow64\atmlib.dll
[2012/12/14 16:49:28 | 000,024,176 | —- | M] (Malwarebytes Corporation) – C:\Windows\SysNative\drivers\mbam.sys
[2012/12/12 09:48:26 | 000,697,272 | —- | M] (Adobe Systems Incorporated) – C:\Windows\SysWow64\FlashPlayerApp.exe
[2012/12/12 09:48:26 | 000,073,656 | —- | M] (Adobe Systems Incorporated) – C:\Windows\SysWow64\FlashPlayerCPLApp.cpl
[2012/12/12 08:14:04 | 000,262,141 | —- | M] () – C:\Users\Nancy\Documents\Holiday_Coupon.pdf
[2012/12/11 06:14:09 | 002,831,995 | —- | M] () – C:\Users\Nancy\Documents\FR370_Manual_NA_082211.pdf

========== Files Created - No Company Name ==========

[2013/01/04 08:00:55 | 000,002,441 | —- | C] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader XI.lnk
[2013/01/04 08:00:55 | 000,002,021 | —- | C] () – C:\Users\Public\Desktop\Adobe Reader XI.lnk
[2013/01/03 16:15:15 | 000,256,000 | —- | C] () – C:\Windows\PEV.exe
[2013/01/03 16:15:15 | 000,208,896 | —- | C] () – C:\Windows\MBR.exe
[2013/01/03 16:15:15 | 000,098,816 | —- | C] () – C:\Windows\sed.exe
[2013/01/03 16:15:15 | 000,080,412 | —- | C] () – C:\Windows\grep.exe
[2013/01/03 16:15:15 | 000,068,096 | —- | C] () – C:\Windows\zip.exe
[2013/01/01 08:09:42 | 000,002,056 | —- | C] () – C:\Users\Public\Desktop\Studio.lnk
[2012/12/31 13:27:10 | 000,005,116 | —- | C] () – C:\ProgramData\xgneqrwu.hrx
[2012/12/31 10:05:24 | 723,116,076 | —- | C] () – C:\Windows\MEMORY.DMP
[2012/12/31 08:01:49 | 000,810,496 | —- | C] () – C:\Windows\SysNative\xvidcore.dll
[2012/12/31 08:01:49 | 000,183,808 | —- | C] () – C:\Windows\SysNative\xvidvfw.dll
[2012/12/31 08:01:49 | 000,080,896 | —- | C] () – C:\Windows\SysNative\ff_vfw.dll
[2012/12/31 08:01:37 | 000,389,120 | —- | C] () – C:\Windows\SysWow64\actskn43.ocx
[2012/12/31 08:01:37 | 000,389,120 | —- | C] () – C:\Windows\SysNative\actskn43.ocx
[2012/12/31 06:01:24 | 001,151,360 | —- | C] () – C:\Windows\SysNative\FNTCACHE.DAT
[2012/12/30 08:19:17 | 000,000,108 | —- | C] () – C:\AUTOEXEC.BAT
[2012/12/30 08:17:09 | 000,027,807 | —- | C] () – C:\Windows\wmprfell.prx
[2012/12/30 08:17:09 | 000,025,269 | —- | C] () – C:\Windows\WMPrfAra.prx
[2012/12/30 08:17:09 | 000,020,704 | —- | C] () – C:\Windows\WMPrfJpn.prx
[2012/12/30 08:17:09 | 000,020,481 | —- | C] () – C:\Windows\wmprfheb.prx
[2012/12/30 08:17:09 | 000,020,055 | —- | C] () – C:\Windows\wmprfsky.prx
[2012/12/30 08:17:09 | 000,019,751 | —- | C] () – C:\Windows\wmprfhun.prx
[2012/12/30 08:17:09 | 000,019,437 | —- | C] () – C:\Windows\wmprffra.prx
[2012/12/30 08:17:09 | 000,018,878 | —- | C] () – C:\Windows\wmprfcsy.prx
[2012/12/30 08:17:09 | 000,018,536 | —- | C] () – C:\Windows\wmprfplk.prx
[2012/12/30 08:17:09 | 000,018,422 | —- | C] () – C:\Windows\wmprfptg.prx
[2012/12/30 08:17:09 | 000,017,953 | —- | C] () – C:\Windows\wmprfesp.prx
[2012/12/30 08:17:09 | 000,017,903 | —- | C] () – C:\Windows\WMPrfKor.prx
[2012/12/30 08:17:09 | 000,017,830 | —- | C] () – C:\Windows\wmprfita.prx
[2012/12/30 08:17:09 | 000,017,199 | —- | C] () – C:\Windows\wmprfptb.prx
[2012/12/30 08:17:09 | 000,017,025 | —- | C] () – C:\Windows\WMPrfDeu.prx
[2012/12/30 08:17:09 | 000,017,019 | —- | C] () – C:\Windows\wmprfsve.prx
[2012/12/30 08:17:09 | 000,016,822 | —- | C] () – C:\Windows\wmprftrk.prx
[2012/12/30 08:17:09 | 000,016,814 | —- | C] () – C:\Windows\wmprfslv.prx
[2012/12/30 08:17:09 | 000,016,446 | —- | C] () – C:\Windows\wmprfnor.prx
[2012/12/30 08:17:09 | 000,016,398 | —- | C] () – C:\Windows\wmprfnld.prx
[2012/12/30 08:17:09 | 000,016,265 | —- | C] () – C:\Windows\wmprffin.prx
[2012/12/30 08:17:09 | 000,015,903 | —- | C] () – C:\Windows\wmprfdan.prx
[2012/12/30 08:17:09 | 000,000,635 | —- | C] () – C:\Windows\wmprfrus.prx
[2012/12/30 08:17:09 | 000,000,083 | —- | C] () – C:\Windows\WMPrfCHS.prx
[2012/12/30 08:17:09 | 000,000,077 | —- | C] () – C:\Windows\WMPrfCHT.prx
[2012/12/29 11:50:22 | 000,196,096 | —- | C] () – C:\Windows\SysWow64\macd32.dll
[2012/12/29 11:50:22 | 000,138,752 | —- | C] () – C:\Windows\SysWow64\mase32.dll
[2012/12/29 11:50:22 | 000,136,192 | —- | C] () – C:\Windows\SysWow64\mamc32.dll
[2012/12/29 11:50:22 | 000,057,856 | —- | C] () – C:\Windows\SysWow64\masd32.dll
[2012/12/29 11:50:22 | 000,027,648 | —- | C] () – C:\Windows\SysWow64\ma32.dll
[2012/12/28 11:41:40 | 408,402,406 | —- | C] () – C:\Users\Nancy\Documents\John Denver Japan.mp4
[2012/12/27 09:49:39 | 000,002,156 | —- | C] () – C:\Users\Public\Desktop\YouTube Downloader App.lnk
[2012/12/27 09:49:30 | 000,002,212 | —- | C] () – C:\Users\Public\Desktop\Videora iPod Converter.lnk
[2012/12/18 07:32:09 | 000,001,785 | —- | C] () – C:\Users\Public\Desktop\iTunes.lnk
[2012/12/12 08:14:04 | 000,262,141 | —- | C] () – C:\Users\Nancy\Documents\Holiday_Coupon.pdf
[2012/12/11 06:14:09 | 002,831,995 | —- | C] () – C:\Users\Nancy\Documents\FR370_Manual_NA_082211.pdf
[2012/09/06 06:56:22 | 000,647,168 | —- | C] ( ) – C:\Windows\SysWow64\lxdxpmui.dll
[2012/09/06 06:56:22 | 000,364,544 | —- | C] ( ) – C:\Windows\SysWow64\lxdxinpa.dll
[2012/09/06 06:56:22 | 000,348,160 | —- | C] () – C:\Windows\SysWow64\LXDXinst.dll
[2012/09/06 06:56:22 | 000,339,968 | —- | C] ( ) – C:\Windows\SysWow64\lxdxiesc.dll
[2012/09/06 06:56:22 | 000,335,872 | —- | C] () – C:\Windows\SysWow64\lxdxcomx.dll
[2012/09/06 06:56:21 | 001,105,920 | —- | C] ( ) – C:\Windows\SysWow64\lxdxserv.dll
[2012/09/06 06:56:21 | 000,843,776 | —- | C] ( ) – C:\Windows\SysWow64\lxdxusb1.dll
[2012/09/06 06:56:21 | 000,663,552 | —- | C] ( ) – C:\Windows\SysWow64\lxdxhbn3.dll
[2012/09/06 06:56:21 | 000,589,824 | —- | C] ( ) – C:\Windows\SysWow64\lxdxcoms.exe
[2012/09/06 06:56:21 | 000,569,344 | —- | C] ( ) – C:\Windows\SysWow64\lxdxlmpm.dll
[2012/09/06 06:56:21 | 000,315,392 | —- | C] ( ) – C:\Windows\SysWow64\lxdxih.exe
[2012/09/06 06:56:21 | 000,053,248 | —- | C] ( ) – C:\Windows\SysWow64\lxdxprox.dll
[2012/09/06 06:56:20 | 000,851,968 | —- | C] ( ) – C:\Windows\SysWow64\lxdxcomc.dll
[2012/09/06 06:56:20 | 000,376,832 | —- | C] ( ) – C:\Windows\SysWow64\lxdxcomm.dll
[2012/09/06 06:56:20 | 000,360,448 | —- | C] ( ) – C:\Windows\SysWow64\lxdxcfg.exe
[2012/08/20 18:55:38 | 000,000,024 | —- | C] () – C:\Windows\ATKPF.ini
[2012/04/11 05:03:17 | 000,096,088 | —- | C] () – C:\Users\Nancy\Sweep.bak
[2012/04/05 17:39:56 | 000,145,530 | —- | C] () – C:\Users\Nancy\533435_3696032123872_1367418451_3464299_1118926329_n.jpg
[2012/03/27 09:57:08 | 000,153,600 | —- | C] () – C:\Windows\SysWow64\WSContextMenu.dll
[2012/03/19 22:31:16 | 000,963,912 | —- | C] () – C:\Windows\SysWow64\igkrng600.bin
[2012/03/19 22:31:16 | 000,261,208 | —- | C] () – C:\Windows\SysWow64\igfcg600m.bin
[2012/03/19 22:25:58 | 000,058,880 | —- | C] () – C:\Windows\SysWow64\igdde32.dll
[2012/03/19 21:21:14 | 013,212,672 | —- | C] () – C:\Windows\SysWow64\ig4icd32.dll
[2012/03/16 18:35:35 | 000,096,088 | —- | C] () – C:\Users\Nancy\Sweep.dat
[2012/01/30 09:58:46 | 000,782,336 | —- | C] () – C:\Windows\SysWow64\lxdxdrs.dll
[2012/01/30 09:58:46 | 000,081,920 | —- | C] () – C:\Windows\SysWow64\lxdxcaps.dll
[2012/01/30 09:58:46 | 000,069,632 | —- | C] () – C:\Windows\SysWow64\lxdxcnv4.dll
[2012/01/26 18:40:04 | 000,394,319 | —- | C] () – C:\Users\Nancy\10-ways-to-get-organized-with-evernote.pdf
[2011/10/17 23:17:57 | 000,825,186 | —- | C] () – C:\Windows\SysWow64\PerfStringBackup.INI
[2011/10/13 10:01:51 | 007,167,137 | —- | C] () – C:\Users\Nancy\iphone.xml
[2011/10/07 06:46:22 | 001,001,734 | —- | C] () – C:\Users\Nancy\new_dash.pdf
[2011/09/16 14:15:16 | 000,014,318 | —- | C] () – C:\Users\Nancy\about-village-logo.png
[2011/09/14 07:51:41 | 000,055,679 | —- | C] () – C:\Users\Nancy\notebook_calendar_to_do_daily.pdf
[2011/08/02 04:59:00 | 000,039,424 | —- | C] () – C:\Users\Nancy\DisneyTime.exe
[2011/05/26 03:26:14 | 000,145,804 | —- | C] () – C:\Windows\SysWow64\igcompkrng600.bin
[2011/04/10 15:31:16 | 000,230,960 | —- | C] () – C:\Users\Nancy\bookmarks.html
[2011/04/10 05:20:47 | 006,821,257 | —- | C] () – C:\Users\Nancy\Library.xml
[2011/04/01 11:00:05 | 000,121,095 | —- | C] () – C:\Users\Nancy\bookmarks-2011-04-01.json
[2011/03/26 05:28:11 | 007,021,631 | —- | C] () – C:\Users\Nancy\Library touch.xml
[2011/03/24 06:24:44 | 000,008,510 | —- | C] () – C:\Users\Nancy\NANCY.CRD

========== ZeroAccess Check ==========

[2009/07/13 23:55:00 | 000,000,227 | RHS- | M] () – C:\Windows\assembly\Desktop.ini

[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64

[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] /64

[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
"" = C:\Windows\SysNative\shell32.dll – [2012/06/09 00:43:10 | 014,172,672 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shell32.dll – [2012/06/08 23:41:00 | 012,873,728 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\fastprox.dll – [2009/07/13 20:40:51 | 000,909,312 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Free

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\system32\wbem\fastprox.dll – [2010/11/20 07:19:04 | 000,606,208 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Free

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\wbemess.dll – [2009/07/13 20:41:56 | 000,505,856 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Both

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]

========== Alternate Data Streams ==========

@Alternate Data Stream - 147 bytes -> C:\ProgramData\Temp:23E3D912
@Alternate Data Stream - 124 bytes -> C:\ProgramData\Temp:718F6FF0
@Alternate Data Stream - 105 bytes -> C:\ProgramData\Temp:5C321E34

< End of report >

jeffce

Post #26January 5, 2013, 1:15 AM UTC

and let me know what remaining malware problems you are having

starwood

Post #27January 5, 2013, 10:49 AM UTC

So far everything seems back to normal. Thanks!

jeffce

Post #28January 5, 2013, 6:49 PM UTC

Providing there are no other malware related problems…

IT APPEARS THAT YOUR LOGS ARE NOW CLEAN SO LETS DO A COUPLE OF THINGS TO WRAP THIS UP!!

This infection appears to have been cleaned, but I can not give you any absolute guarantees. As a precaution, I would go ahead and change all of your passwords as this is especially important after an infection.
———-

The following will implement some cleanup procedures as well as reset System Restore points:

Press the Windows key + R and this will open the Run box. Copy/paste the following text into the Run box as shown and click OK.
Combofix /Uninstall
(Note: There is a space between the ..X and the /U that needs to be there.)

[external image: Posted Image]
———-

Clean up with OTL:

Right-click and Run as Administrator OTL.exe to start the program.
Close all other programs apart from OTL as this step will require a reboot
On the OTL main screen, press the CLEANUP button
Say Yes to the prompt and then allow the program to reboot your computer.

———-

Any of the logs that you created for use in the forums or remaining tools that have not yet been removed can be deleted so they aren't cluttering up your desktop.
If you didn't already have it I would keep Malwarebytes AntiMalware though.

Here are some tips to reduce the potential for spyware infection in the future:

1. Internet Explorer. Even if you don't use it as your main browser it should be kept up-to-date because that is the browser Windows uses for updates.
Make your Internet Explorer more secure - This can be done by following these simple instructions:

From within Internet Explorer click on the Tools menu and then click on Options.
Click once on the Security tab
Click once on the Internet icon so it becomes highlighted.
Click once on the Custom Level button.
Change the Download signed ActiveX controls to Prompt
Change the Download unsigned ActiveX controls to Disable
Change the Initialize and script ActiveX controls not marked as safe to Disable
Change the Installation of desktop items to Prompt
Change the Launching programs and files in an IFRAME to Prompt
Change the Navigate sub-frames across different domains to Prompt
When all these settings have been made, click on the OK button.
If it prompts you as to whether or not you want to save the settings, press the Yes button.
Next press the Apply button and then the OK to exit the Internet Properties page.

2. FireFox. If you use Firefox, I recommend installing the following add-ons to help make your Firefox browser more secure:
NoScript
AdBlock Plus

3. Enable Protected Mode in Internet Explorer. This helps Windows Vista users stay more protected from attack by running Internet Explorer with restricted privileges as well as reducing the ability to write, alter or destroy data on your system or install malicious code. To make sure this is running follow these steps:

Open Internet Explorer
Click on Tools > Internet Options
Press Security tab
Select Internet zone then place check next to Enable Protected Mode if not already done
Do the same for Local Intranet, Trusted Sites and Restricted Sites and then press Apply
Restart Internet Explorer and in the bottom right corner of your screen you will see Protected Mode: On showing you it is enabled.

4. Use and update an anti-virus software - I can not overemphasize the need for you to use and update your anti-virus application on a regular basis. With the ever increasing number of new variants of malware arriving on the scene daily, you become very susceptible to an attack without updated protection.

5. Firewall
Using a third-party firewall will allow you to give/deny access for applications that want to go online. Without a firewall your computer is susceptible to being hacked and taken over. Simply using a firewall in its default configuration can lower your risk greatly. I would personally only recommend using one of the following two below:
Online Armor Free
Agnitum Outpost Firewall Free

6. Make sure you keep your Windows OS current. Windows XP users can visit Windows update regularly to download and install any critical updates and service packs. Windows Vista/7 users can open the Start menu > All Programs > Windows Update > Check for Updates (in left hand task pane) to update these systems. Without these you are leaving the back door open.

7. WOT (Web of Trust) As "Googling" is such an integral part of internet life, this free browser add on warns you about risky websites that try to scam visitors, deliver malware or send spam. It is especially helpful when browsing or searching in unfamiliar territory. WOT's color-coded icons show you ratings for 21 million websites, helping you avoid the dangerous sites. WOT has an add-on available for Firefox, Internet Explorer as well as Google Chrome.

8.Finally, I strongly recommend that you read How to Prevent Malware found here and also PC Safety and Security - What Do I Need?.

Please reply to this thread once more if you are satisfied so that we can mark the problem as resolved.

jeffce

Post #29January 7, 2013, 1:22 AM UTC

Since this issue appears to be resolved … this Topic has been closed. Glad we could be of assistance.

If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread.

Everyone else please follow the instructions here http://forums.whatthetech.com/you_Infected_t106388.html
and start a New Topic.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

tnt2user.exe [Solved]

✨ Ask AI

Ask AI